diff --git a/.ripwire_quality_acks b/.ripwire_quality_acks
index 3ba12823b..2b4856f35 100644
--- a/.ripwire_quality_acks
+++ b/.ripwire_quality_acks
@@ -627,6 +627,7 @@ ack duplication 5a94cb2859bf1601 71 now=71 was=0 prov=recon a probe TU deliberat
 ack duplication 5ae632d0ded8f363 58 now=58 was=0 prov=recon facet=switch-name-table per-enumerator switches name every enumerator and carry no default: on purpose — that is what makes -Werror=switch a compile error at each one when an enumerator is appended; two such switches over one enum share the enumerator spelling by construction
 ack duplication 5bfc60bf2eec4379 58 now=58 was=0 prov=recon readability-wave1 (clones.h scanCodeTokens extraction): normalizeTokens and objectKeys are both 'call a scanner, emplace_back each visit into a vector, return it' — the same 58-token visitor-to-vector adapter over two unrelated scanners in two different layers (the clone tokenizer in core vs the JSON top-level-key walker in the MCP layer). Neither can call the other; a shared generic adapter would be a cross-layer template earning six lines. Kept as written.
 ack duplication 5c9174022e5a0734 44 DISCLOSE sinks: a reason-to-field switch is the shape every multi-reason sink shares; -Wswitch exhaustiveness over DisclosureWhy is the point (Diagnostics.h 4b)
+ack duplication 5c98961b8ec17a64 35 now=35 was=0 p=src/docparse.h:160 #155 (pr438 B2): inSortedTable is the span form of the table lookup isStrictlySortedTable's tables share; isMarkdownGrammarExtension is the same one-line binary_search over a different table, and merging them would need docparse.h to include externalnames.h for no gain
 ack duplication 5e4956ffb34ce360 36 now=36 was=0 prov=recon M1: a 36-token shape coincidence, not duplication. isMcpProtocolVersionSupported walks a version list and mcpVerbDeclaresLegend walks a field list; both are the C++ spelling of 'is X in this list', over different tables, different types and different call sites. Folding them into one generic helper would couple the protocol handshake to the legend family for no shared meaning.
 ack duplication 5f01b66132b916bd 44 DISCLOSE sinks: a reason-to-field switch is the shape every multi-reason sink shares; -Wswitch exhaustiveness over DisclosureWhy is the point (Diagnostics.h 4b)
 ack duplication 5fad9d85c2552890 32 now=32 was=0 p=src/receiverevidence.h:142 lane FE-B (receiver evidence): lexical clone pairs, not shared logic — the per-language predicates (implicitReceiverLang, classNameReceiverLang, memberNeverReachesFreeFunction, isReceiverEvidenceKind, callableKind, classLike, isThisRoot) are one-line OR-lists over different enum sets that share only the shape with quality.h/model.h/slice.h predicates asking other questions; keyOf/typeKey build different keys into a reused buffer; classAt (innermost class span by byte) vs flipimpact innermostAtLine (by line, other table); impactViaColumn vs lintrules dependencyCapableMask share a bitmask idiom; the JS fixture encode|stringify is a deliberate twin (test/receiverevidencefix: same-named near misses); pargates.py is unchanged since cd87e30e (a regrouped pre-existing pair). The one real clone, the enclosing-function walk, was merged into innermostEnclosingFn instead of acked
diff --git a/changelog.d/155-kotlin-scope-functions.md b/changelog.d/155-kotlin-scope-functions.md
new file mode 100644
index 000000000..f6f2c2003
--- /dev/null
+++ b/changelog.d/155-kotlin-scope-functions.md
@@ -0,0 +1,18 @@
+### Fixed — Kotlin scope functions no longer bind Java methods (#438, thanks @llvm-x86)
+
+A Kotlin call with a trailing lambda to `let`, `run`, `with`, `apply` or `also` now stays off the Java
+method of the same name. Before this change, `s.run { }` bound `Job.run`, and `with( sb ) { }` bound
+`Builder.with`. Ripwire now reads the call as the stdlib scope function. It drops the Java candidates and
+keeps the Kotlin ones. A call with no Kotlin target reports `external=` with that proof.
+
+Calls without a trailing lambda keep their edges. `j.run()` still binds `Job.run`, and `b.with( "x" )` still
+binds `Builder.with`.
+
+Known floors:
+
+- A parenthesised lambda, such as `s.let( { } )`, is not a trailing lambda. Its edge is unchanged.
+- A Java method called from Kotlin with a trailing lambda is dropped when its name is a scope-function name.
+  The spelling alone does not tell the two apart.
+- A receiver of a Java type is not checked. A receiver whose type is an in-tree Kotlin class that defines the method
+  keeps its own binding (`t.run { }` on a `t: Task` binds `Task.run`).
+- A qualified `kotlin.run { }` can still bind an in-tree Kotlin `run`, hedged.
diff --git a/changelog.d/228-django-unittest-hooks.md b/changelog.d/228-django-unittest-hooks.md
new file mode 100644
index 000000000..0725d5011
--- /dev/null
+++ b/changelog.d/228-django-unittest-hooks.md
@@ -0,0 +1,21 @@
+### Fixed — Django and unittest hooks no longer read as dead code (#437, thanks @llvm-x86)
+
+Before: `--quality-delta` reported a Python hook as dead when no call in the tree named it. unittest and Django call
+`setUp`, `tearDown`, `setUpClass` and `setUpTestData` themselves. The runner calls each `test*` method. A closure inside a
+method that called `self.hook()` also lost the call. Each such method appeared as dead code.
+
+Now: the tool treats these names as called. It covers `setUpModule`, `tearDownModule`, `load_tests`, `runTest`, `asyncSetUp` and `asyncTearDown` too. The pytest xunit hooks `setup_module`, `teardown_module`,
+`setup_function`, `teardown_function`, `setup_class`, `teardown_class`, `setup_method` and `teardown_method` count as called too. A `test*`
+method (any name that starts with `test`) and an xunit hook count as called only in a test module: a path `isTestPath` accepts, or a Django `tests.py`. A closure
+that calls `self.` or `cls.` keeps the overrides of the method it calls live. A closure that binds `self` or `cls` as its own
+parameter does not.
+
+The HEAD snapshot scheme moves from 22 to 24. Old cached snapshots are not used.
+
+Not covered, still reported: pytest's conftest hooks such as `pytest_configure`. (`@pytest.fixture` functions are not reported as dead code here.)
+
+The hook names live in one table per framework (`kUnittestHooks`, `kXunitHooks`, `kUnittestModuleHooks` in `quality.h`), shared with `--dead-code` and `--safe-delete`, which now also skip `setUpTestData` and `runTest` in a TestCase subclass.
+
+Limit: the name check ignores types and scope. A method named `setUp`, `tearDown` or `load_tests` in application code is also treated as called. In a test module, any def named `test*` counts as called, nested defs and helper functions included. The tool errs toward live here.
+
+A closure that binds `self` or `cls` as its own parameter does not count, even for `def cb(self=self)`.
diff --git a/changelog.d/versions.md b/changelog.d/versions.md
index ed622a47e..254e403e1 100644
--- a/changelog.d/versions.md
+++ b/changelog.d/versions.md
@@ -1,10 +1,12 @@
 ### Changed — the versions this change moves, stated once
 
-`kParserVer` 206 → 226 (file tag 227): the Rust written-type receivers carried 202 (203) on their branch and the struct-field
+`kParserVer` 206 → 231 (file tag 232): the Rust written-type receivers carried 202 (203) on their branch and the struct-field
 slot join 204 (205), and its fix rounds changed what 204 extracts, so a cache from that branch would replay the older slot
 rows; the interface-dispatch records carried 210 and 212 on theirs; the JS/TS written-binding records carried 218 and the
-Python rebind-withholding records a 224 placeholder on theirs; 226 sits above every live branch and pull-request number
-(212 to 225). A cache written by 0.6.8 is re-parsed once. `kCacheVersion` 36 → 40: a Rust binding typed only through a trait
+Python rebind-withholding records a 224 placeholder on theirs; train 34 took 226; the Kotlin trailing-lambda capture (#155)
+carried a 228 placeholder and another branch holds 229, so 231 sits above every live branch and pull-request number. A cache
+written by 0.6.8 is re-parsed once. `kCacheVersion` 36 → 43: a Rust binding typed only through a trait
 (`&dyn T`, `impl T`, a bound), a Rust `impl T for X` block and a JS/TS binding written after its declaration are new binding
-records, so a cache written before them is rejected and rebuilt (the branches that added them used 37, 38 and 39). The
-quality-snapshot scheme stays 22. The session legend dictionary is `dictv=8c941c6c17d27549 entries=932`.
+records, and a Kotlin call's trailing-lambda byte (#155) widens the reference record, so a cache written before them is
+rejected and rebuilt (the branches that added them used 37, 38, 39 and 41). The quality-snapshot scheme moves 22 → 24 (#228: Django and
+unittest hooks and closure self-dispatch change the dead set; old snapshots are not used; the branch used 23). The session legend dictionary is `dictv=8c941c6c17d27549 entries=932`.
diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
index 582dd93c6..63995a1e4 100644
--- a/docs/ARCHITECTURE.md
+++ b/docs/ARCHITECTURE.md
@@ -258,6 +258,18 @@ triple-quoted string that ends in an escaped `$`). `test/kotlincheck.sh`
 covers extraction, both bridge directions in flat and split layouts, the Java-edge invariant, the
 bodyless-type collapse, hostile nesting, metrics and determinism.
 
+**Kotlin scope functions (#155).** A call with a trailing lambda to `let`, `run`, `with`, `apply` or `also`
+(`s.run { }`, `with( sb ) { }`, `xs.also { }`) is the stdlib inline function, so FE-A (`FalseEdgeRules`, `graph.h`)
+drops every Java candidate of that name and keeps the Kotlin ones; an emptied set is `external=` with that proof.
+The fact is `Reference::trailingLambda`, set by `kotlinTrailingLambda` (`ingest_metrics.h`); the names are
+`kKotlinScopeFunctionNames` (`externalnames.h`, regenerated by one `javap` command recorded there). A receiver rule
+that already picked a Kotlin member (`t.run { }` on a `t: Task` whose class defines `run`) keeps its proof; a pick
+holding a Java method is undone, so `s.run { }` is decided here. Stated floors: no receiver typing beyond that (a
+receiver of a Java type is not checked); a qualified `kotlin.run { }` can still bind an in-tree Kotlin `run` (hedged); no SAM conversion; a parenthesised lambda (`s.let( { } )`) is not trailing and
+keeps the ladder; and a Java method of one of these names called from Kotlin with a trailing lambda is dropped,
+because the spelling alone cannot tell the two apart. `test/kotlincheck.sh` §15 and `test/falseedgecheck.sh` arm J
+pin it.
+
 <a id="clojure-extraction"></a>
 **Clojure extraction.** The vendored Yogthos parser is a fork of Sogaiu's grammar. The grammar
 rules match at the pinned revisions, while Yogthos' generated ABI-15 parser completed 4,930 of 4,933
diff --git a/docs/COMMANDS.md b/docs/COMMANDS.md
index 376f62eb9..ee1492b30 100644
--- a/docs/COMMANDS.md
+++ b/docs/COMMANDS.md
@@ -9,7 +9,7 @@ python3 docs/docs_commands_build.py --bin build/ripwire
 The flag surface below is read from `ripwire --help`, so it cannot disagree with the shipped
 binary. `test/docscommandscheck.sh` fails if it ever does — in either direction.
 
-Sample output is lifted from a real recorded run (`docs/captures/COMMANDS_showcase_2026-10-25.md`), trimmed to the first few lines and
+Sample output is lifted from a real recorded run (`docs/captures/COMMANDS_showcase_2026-10-26.md`), trimmed to the first few lines and
 scrubbed of local paths. It is illustrative, not a golden: run the command yourself for the
 current shape.
 
@@ -70,7 +70,7 @@ _Same map, capped to the 5 highest-ranked symbols._
 $ ./build/ripwire . --top-k=5
 <!-- ripwire map schema=ripwire.map/v1: ranked symbol map: <f p= layer=> groups <s t= n= sc= k= amb=> rows (k= rank), <c n=> resolved callees; the header comment is data. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. pr_iters=N: PageRank iterations. <inv listed= unlisted=>: files the ranked rows show / do not (sum = files=), each named or counted below. <entry p= n=>: a program entry by its language's convention (C/Go/Rust main, Java/C# static main, a script main its module scope calls, __main__.py), callees as c rows; manifest entries not read. <ls p= n= f=>: n= unshown files under dir p=; f= names its code files, the rest (tests, docs, config, test/doc/example dirs) counted. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. overloads=N: N same-name defs merged in this row; shown= counts each. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. amb=K: K calls split over several defs. -->
 <!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
-<!-- files=3618 symbols=31790 edges=29969 shown=5 est_tokens=3336 ambiguous=2927 unresolved=15221 locality_pinned=9 external=8647 declined=30140 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
+<!-- files=3631 symbols=31860 edges=30033 shown=5 est_tokens=3336 ambiguous=2933 unresolved=15249 locality_pinned=9 external=8658 declined=30154 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
 <r schema="ripwire.map/v1" root="." est_tokens="3336" pr_iters="36">
 <f p="src/infra/nodekind.h" layer="infra">
 <s t="fn" n="kindIs" sc="rw" k="0.0037">
@@ -106,7 +106,7 @@ _The same capped map without its inventory tier: --top-k=5 leaves files out, so
 $ ./build/ripwire . --top-k=5 --no-inventory
 <!-- ripwire map schema=ripwire.map/v1: ranked symbol map: <f p= layer=> groups <s t= n= sc= k= amb=> rows (k= rank), <c n=> resolved callees; the header comment is data. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. pr_iters=N: PageRank iterations. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. overloads=N: N same-name defs merged in this row; shown= counts each. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. amb=K: K calls split over several defs. -->
 <!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
-<!-- files=3618 symbols=31790 edges=29969 shown=5 est_tokens=1115 ambiguous=2927 unresolved=15221 locality_pinned=9 external=8647 declined=30140 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
+<!-- files=3631 symbols=31860 edges=30033 shown=5 est_tokens=1115 ambiguous=2933 unresolved=15249 locality_pinned=9 external=8658 declined=30154 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
 <r schema="ripwire.map/v1" root="." est_tokens="1115" pr_iters="36">
 <f p="src/infra/nodekind.h" layer="infra">
 <s t="fn" n="kindIs" sc="rw" k="0.0037">
@@ -140,7 +140,7 @@ _SHAPE the map to fit ~1500 tokens (binary-search top-K)._
 $ ./build/ripwire . --max-tokens=1500
 <!-- ripwire map schema=ripwire.map/v1: ranked symbol map: <f p= layer=> groups <s t= n= sc= k= amb=> rows (k= rank), <c n=> resolved callees; the header comment is data. est_tokens=: price as emitted (an upper bound under compact). over_ceiling=1: budget not met. root=: p= relative to it. pr_iters=N: PageRank iterations. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. max_tokens=/fit_bytes=: tokens asked/the byte cap applied. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. -->
 <!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
-<!-- files=3618 symbols=31790 edges=29969 shown=1 est_tokens=925 ambiguous=2927 unresolved=15221 locality_pinned=9 external=8647 declined=30140 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 max_tokens=1500 fit_bytes=3186 over_ceiling=1 order=important-first -->
+<!-- files=3631 symbols=31860 edges=30033 shown=1 est_tokens=925 ambiguous=2933 unresolved=15249 locality_pinned=9 external=8658 declined=30154 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 max_tokens=1500 fit_bytes=3186 over_ceiling=1 order=important-first -->
 <r schema="ripwire.map/v1" root="." est_tokens="925" pr_iters="36">
 <f p="src/infra/nodekind.h" layer="infra">
 <s t="fn" n="kindIs" sc="rw" k="0.0037">
@@ -215,13 +215,13 @@ _Name-shaped query: the router picks name-exact BM25 (header says which/why)._
 
 ```
 $ ./build/ripwire . --for="rankGraphTeleport"
-<ctx task="rankGraphTeleport" route="name-exact(rankGraphTeleport); anchors: rankGraphTeleport(src/graph.h)" root="." confidence="high" margin_pct="45" at="d3605fde7" doc_mentions="2" schema="ripwire.for/v1" bundle="auto" bodies="1" doc_mentions_capped="1" doc_mentions_total="13" est_tokens="2084">
+<ctx task="rankGraphTeleport" route="name-exact(rankGraphTeleport); anchors: rankGraphTeleport(src/graph.h)" root="." confidence="high" margin_pct="45" at="0712a5182" doc_mentions="2" schema="ripwire.for/v1" bundle="auto" bodies="1" doc_mentions_capped="1" doc_mentions_total="13" est_tokens="2084">
 <!-- ripwire for schema=ripwire.for/v1: bundle=/bodies=/reason= the body posture; d: cx= ccx= complexity, in= callers (absent cx/ccx/in = 0), churn= amp= change, clone= tested= 1, sc= scope, id=p::sc::n; total= shown= capped=1 if cut; task= the query; d pure=1 const/constexpr sig, next= the follow-up to paste; route= name-exact(X)|subtoken+body[:broad|:declined]; confidence=/margin_pct= head score drop (low=flat); b t= n= p= l= full bodies, c n= l= callee signatures; callers of=: the one function's 1-hop callers, s t= n= sc= p=file:line (n=Owner.name folds sc= on a member; sites_at= its call sites, sites_total= if cut; via=name by name only), shown= of total=; d=2 rows: their callers, d2_shown= of d2=; capped=1 if cut; floors; next= the radius; t p= file outside sigs (weaker), t sym= its top symbols (a pointer, not the answer), r= rank (gap = trimmed); d e= its last line (absent=unknown, never 0; l= the name's line); c prov=split: a resolver split arm; may be another arm's (NOT a claim the edge is false) [doc mentions: 2 docs, 1 symbol; doc_mentions=] [floor: kept 3 of 40] -->
 <!-- root= is the crawl root; p= below is RELATIVE to it (single-root only; absent => p= is ingest's own path, unchanged); at=this commit(+dirty). [cut: doc_mentions_capped="1" doc_mentions_total="13" — an indexing cap dropped content not shown here] est_tokens= prices this bundle in tokens -->
 <sigs>
-<d l="11750" e="11778" n="rankGraphTeleport" sc="rw" p="src/graph.h" cx="5" ccx="8" in="7" churn="468" amp="674" r="1" next="--expand=src/graph.h:rankGraphTeleport">
+<d l="11809" e="11837" n="rankGraphTeleport" sc="rw" p="src/graph.h" cx="5" ccx="8" in="7" churn="473" amp="682" r="1" next="--expand=src/graph.h:rankGraphTeleport">
 <doc>PageRank with an explicit teleport / personalization vector p (Σp = 1). The prior is name-quality-biased through biasPrior() so all rank modes share one weighting seam; the transition matrix (edges</doc>inline RankedGraph rankGraphTeleport( const Graph&amp; g, const std::vector&lt;float&gt;&am … [line truncated: 31 more bytes on this line]
-<d l="489" n="The convergence disclosure contract" sc="rank — Personalized PageRank" p="docs/ARCHITECTURE.md" churn="66" amp="168" r="2">#### The convergence disclosure contract</d>
+<d l="501" n="The convergence disclosure contract" sc="rank — Personalized PageRank" p="docs/ARCHITECTURE.md" churn="70" amp="183" r="2">#### The convergence disclosure contract</d>
 <d l="6339" n="Wave-2 adversarial verification (2026-08-19) — six probes against `aa97c9e`" sc="6. Correctness and quality instruments" p="docs/EVALS.md" churn="924" amp="1281" r="3">### Wave-2 adversarial verification (2026-08-19) — six probes against `aa97c9e`</d>
 </sigs>
 <tail total="3" shown="3" capped="0">
@@ -252,14 +252,14 @@ _Restore the <lego>/<compose> sections the --for bundle collapses to a counted s
 
 ```
 $ ./build/ripwire . --for="tree-sitter parse of a source file" --sections=lego,compose
-<ctx task="tree-sitter parse of a source file" route="subtoken+body" root="." confidence="low" margin_pct="0" at="d3605fde7" doc_mentions="3" schema="ripwire.for/v1" bundle="compact" bodies="0" reason="compact-route" budget_bytes="7500" est_tokens="7691">
+<ctx task="tree-sitter parse of a source file" route="subtoken+body" root="." confidence="low" margin_pct="0" at="0712a5182" doc_mentions="3" schema="ripwire.for/v1" bundle="compact" bodies="0" reason="compact-route" budget_bytes="7500" est_tokens="7691">
 <!-- ripwire for schema=ripwire.for/v1: bundle=/bodies=/reason= the body posture; d: cx= ccx= complexity, in= callers (absent cx/ccx/in = 0), churn= amp= change, clone= tested= 1, sc= scope, id=p::sc::n; total= shown= capped=1 if cut; task= the query; d pure=1 const/constexpr sig, next= the follow-up to paste; route= name-exact(X)|subtoken+body[:broad|:declined]; confidence=/margin_pct= head score drop (low=flat); h l= p= n=, c n= l= (joined for same-named callees, shown= counts them), noedge= no callee resolved; fold kind=bodies: b t= n= p= l= top ranked rows' whole bodies, not the answer; served= of total= in budget_bytes=; slice/skip p= n= l=; slice members= of=: a big class's ctor, question-word members; skip bytes= next=; a skip makes sigs next= it, sigs_next= the signatures-only re-call; d mem= an owner's direct member names by the index (question words first, names only), mem_more= names cut; t p= file outside sigs (weaker), t sym= its top symbols (a pointer, not the answer), r= rank (gap = trimmed); field name= type= owner= rel=: a member of owner=, rel=creates held by value, uses by reference/pointer; iface implementors=N: types implementing it, m= its method contract; d layer=: built-in arch layer (game|infra|render|math|audio|ai|test) from a dir name in p=; d e= its last line (absent=unknown, never 0; l= the name's line) [doc mentions: 3 docs, 2 symbols; doc_mentions=] -->
 <!-- root= is the crawl root; p= below is RELATIVE to it (single-root only; absent => p= is ingest's own path, unchanged); at=this commit(+dirty). [budget_bytes= is the default BYTE target this ranked payload was shaped toward: row text shortens toward it, no row of the ranked head is removed for it (sigs past_target=)] [sigs capped=1 with shown=total: rows shrunk, none dropped] [sigs past_target=K: the last K rows are past the budget_bytes target, served because they are rows of the ranked head; none is cut] [sigs next=: one call serving all total= rows uncut] [docs_dropped=N: N shown rows have a doc comment not printed (r>24 always, r5..24 if capped)] [files_first=N: N rows moved so r=1..8 are distinct files' best rows, score order, a repeated name once; same rows; fold, hops keep score order] est_tokens= prices this bundle in tokens -->
 <sigs shown="40" total="40" capped="1" past_target="7" docs_dropped="25" files_first="3" next="--for=&apos;tree-sitter parse of a source file&apos; --signatures-only --token-budget=5600">
 <d l="28" e="63" n="topLevelEvidence" sc="rw::pythonrunner" p="src/pythonrunner.h" cx="4" ccx="3" in="2" churn="5" amp="15" r="1" next="--expand=src/pythonrunner.h:topLevelEvidence">inline bool topLevelEvidence( std::string_view source, const TSLanguage* language, const Predicate&amp; predicate )</d … [line truncated: 1 more bytes on this line]
 <d l="45" e="45" n="kDefaultMaxFileBytes" sc="rw" p="src/ingest.h" churn="59" amp="165" pure="1" r="2">
 <doc>The crawl&apos;s per-file byte ceiling. A text file larger than this is skipped: at this size it is o…</doc>constexpr std::size_t kDefaultMaxFileBytes = 4u * 1024u * 1024u</d>
-<d l="1238" e="1246" n="parseTree" p="src/ingest_sidecap.h" cx="1" in="3" churn="138" amp="270" tested="1" r="3">TSTree* parseTree( TSParser* parser, std::string_view src )</d>
+<d l="1238" e="1246" n="parseTree" p="src/ingest_sidecap.h" cx="1" in="3" churn="139" amp="280" tested="1" r="3">TSTree* parseTree( TSParser* parser, std::string_view src )</d>
 <d l="593" e="667" n="doctorProbeGrammars" p="src/verbs_doctor.h" cx="7" ccx="17" in="1" churn="45" amp="129" r="4">
 <doc>Exercise every registered grammar and its embedded query, reporting loaded and expected totals</doc>inline DoctorGrammarProbe doctorProbeGrammars()</d>
 ... [21 more line(s); run it to see the whole thing]
@@ -279,13 +279,13 @@ _T3 opt-out: the signatures-only lens (no auto bodies, no bundle="auto" attribut
 
 ```
 $ ./build/ripwire . --for="rankGraphTeleport" --signatures-only
-<ctx task="rankGraphTeleport" route="name-exact(rankGraphTeleport); anchors: rankGraphTeleport(src/graph.h)" root="." confidence="high" margin_pct="45" at="d3605fde7" doc_mentions="2" schema="ripwire.for/v1" doc_mentions_capped="1" doc_mentions_total="13" est_tokens="988">
+<ctx task="rankGraphTeleport" route="name-exact(rankGraphTeleport); anchors: rankGraphTeleport(src/graph.h)" root="." confidence="high" margin_pct="45" at="0712a5182" doc_mentions="2" schema="ripwire.for/v1" doc_mentions_capped="1" doc_mentions_total="13" est_tokens="988">
 <!-- ripwire for schema=ripwire.for/v1: bundle=/bodies=/reason= the body posture; d: cx= ccx= complexity, in= callers (absent cx/ccx/in = 0), churn= amp= change, clone= tested= 1, sc= scope, id=p::sc::n; total= shown= capped=1 if cut; task= the query; d pure=1 const/constexpr sig, next= the follow-up to paste; route= name-exact(X)|subtoken+body[:broad|:declined]; confidence=/margin_pct= head score drop (low=flat); t p= file outside sigs (weaker), t sym= its top symbols (a pointer, not the answer), r= rank (gap = trimmed); d e= its last line (absent=unknown, never 0; l= the name's line) [doc mentions: 2 docs, 1 symbol; doc_mentions=] [floor: kept 3 of 40] -->
 <!-- root= is the crawl root; p= below is RELATIVE to it (single-root only; absent => p= is ingest's own path, unchanged); at=this commit(+dirty). [cut: doc_mentions_capped="1" doc_mentions_total="13" — an indexing cap dropped content not shown here] est_tokens= prices this bundle in tokens -->
 <sigs>
-<d l="11750" e="11778" n="rankGraphTeleport" sc="rw" p="src/graph.h" cx="5" ccx="8" in="7" churn="468" amp="674" r="1" next="--expand=src/graph.h:rankGraphTeleport">
+<d l="11809" e="11837" n="rankGraphTeleport" sc="rw" p="src/graph.h" cx="5" ccx="8" in="7" churn="473" amp="682" r="1" next="--expand=src/graph.h:rankGraphTeleport">
 <doc>PageRank with an explicit teleport / personalization vector p (Σp = 1). The prior is name-quality-biased through biasPrior() so all rank modes share one weighting seam; the transition matrix (edges</doc>inline RankedGraph rankGraphTeleport( const Graph&amp; g, const std::vector&lt;float&gt;&am … [line truncated: 31 more bytes on this line]
-<d l="489" n="The convergence disclosure contract" sc="rank — Personalized PageRank" p="docs/ARCHITECTURE.md" churn="66" amp="168" r="2">#### The convergence disclosure contract</d>
+<d l="501" n="The convergence disclosure contract" sc="rank — Personalized PageRank" p="docs/ARCHITECTURE.md" churn="70" amp="183" r="2">#### The convergence disclosure contract</d>
 <d l="6339" n="Wave-2 adversarial verification (2026-08-19) — six probes against `aa97c9e`" sc="6. Correctness and quality instruments" p="docs/EVALS.md" churn="924" amp="1281" r="3">### Wave-2 adversarial verification (2026-08-19) — six probes against `aa97c9e`</d>
 </sigs>
 <tail total="3" shown="3" capped="0">
@@ -314,14 +314,14 @@ _Opt OUT of compact conceptual serving: restore the rank-first auto <bodies> wal
 
 ```
 $ ./build/ripwire . --for="tree-sitter parse of a source file" --auto-bodies
-<ctx task="tree-sitter parse of a source file" route="subtoken+body" root="." confidence="low" margin_pct="0" at="d3605fde7" doc_mentions="3" schema="ripwire.for/v1" bundle="auto" bodies="4" budget_bytes="7500" est_tokens="7576">
+<ctx task="tree-sitter parse of a source file" route="subtoken+body" root="." confidence="low" margin_pct="0" at="0712a5182" doc_mentions="3" schema="ripwire.for/v1" bundle="auto" bodies="4" budget_bytes="7500" est_tokens="7576">
 <!-- ripwire for schema=ripwire.for/v1: bundle=/bodies=/reason= the body posture; d: cx= ccx= complexity, in= callers (absent cx/ccx/in = 0), churn= amp= change, clone= tested= 1, sc= scope, id=p::sc::n; total= shown= capped=1 if cut; task= the query; d pure=1 const/constexpr sig, next= the follow-up to paste; route= name-exact(X)|subtoken+body[:broad|:declined]; confidence=/margin_pct= head score drop (low=flat); b t= n= p= l= full bodies, c n= l= callee signatures; t p= file outside sigs (weaker), t sym= its top symbols (a pointer, not the answer), r= rank (gap = trimmed); field name= type= owner= rel=: a member of owner=, rel=creates held by value, uses by reference/pointer; iface implementors=N: types implementing it, m= its method contract; d layer=: built-in arch layer (game|infra|render|math|audio|ai|test) from a dir name in p=; d e= its last line (absent=unknown, never 0; l= the name's line) [doc mentions: 3 docs, 2 symbols; doc_mentions=] -->
 <!-- root= is the crawl root; p= below is RELATIVE to it (single-root only; absent => p= is ingest's own path, unchanged); at=this commit(+dirty). [budget_bytes= is the default BYTE target this ranked payload was shaped toward: row text shortens toward it, no row of the ranked head is removed for it (sigs past_target=)] [sigs capped=1 with shown=total: rows shrunk, none dropped] [sigs past_target=K: the last K rows are past the budget_bytes target, served because they are rows of the ranked head; none is cut] [sigs next=: one call serving all total= rows uncut] [docs_dropped=N: N shown rows have a doc comment not printed (r>24 always, r5..24 if capped)] [files_first=N: N rows moved so r=1..8 are distinct files' best rows, score order, a repeated name once; same rows; fold, hops keep score order]; lego/compose collapse to a counted stub by default (a disclosed cut): total= that section's own pre-cap row count, shown="0" capped="1" (nothing rendered here), next= names the sections=lego,compose flag that restores both sections byte-identically in one call est_tokens= prices this bundle in tokens -->
 <sigs shown="40" total="40" capped="1" past_target="7" docs_dropped="25" files_first="3" next="--for=&apos;tree-sitter parse of a source file&apos; --signatures-only --token-budget=5600">
 <d l="28" e="63" n="topLevelEvidence" sc="rw::pythonrunner" p="src/pythonrunner.h" cx="4" ccx="3" in="2" churn="5" amp="15" r="1" next="--expand=src/pythonrunner.h:topLevelEvidence">inline bool topLevelEvidence( std::string_view source, const TSLanguage* language, const Predicate&amp; predicate )</d … [line truncated: 1 more bytes on this line]
 <d l="45" e="45" n="kDefaultMaxFileBytes" sc="rw" p="src/ingest.h" churn="59" amp="165" pure="1" r="2">
 <doc>The crawl&apos;s per-file byte ceiling. A text file larger than this is skipped: at this size it is o…</doc>constexpr std::size_t kDefaultMaxFileBytes = 4u * 1024u * 1024u</d>
-<d l="1238" e="1246" n="parseTree" p="src/ingest_sidecap.h" cx="1" in="3" churn="138" amp="270" tested="1" r="3">TSTree* parseTree( TSParser* parser, std::string_view src )</d>
+<d l="1238" e="1246" n="parseTree" p="src/ingest_sidecap.h" cx="1" in="3" churn="139" amp="280" tested="1" r="3">TSTree* parseTree( TSParser* parser, std::string_view src )</d>
 <d l="593" e="667" n="doctorProbeGrammars" p="src/verbs_doctor.h" cx="7" ccx="17" in="1" churn="45" amp="129" r="4">
 <doc>Exercise every registered grammar and its embedded query, reporting loaded and expected totals</doc>inline DoctorGrammarProbe doctorProbeGrammars()</d>
 ... [21 more line(s); run it to see the whole thing]
@@ -346,13 +346,13 @@ _Same query with routing forced OFF (plain subtoken+body BM25) — contrast with
 
 ```
 $ ./build/ripwire . --for="rankGraphTeleport" --no-route
-<ctx task="rankGraphTeleport" root="." confidence="low" margin_pct="0" at="d3605fde7" doc_mentions="6" schema="ripwire.for/v1" bundle="auto" bodies="3" budget_bytes="7500" doc_mentions_capped="1" doc_mentions_total="20" est_tokens="8716">
+<ctx task="rankGraphTeleport" root="." confidence="low" margin_pct="0" at="0712a5182" doc_mentions="6" schema="ripwire.for/v1" bundle="auto" bodies="3" budget_bytes="7500" doc_mentions_capped="1" doc_mentions_total="20" est_tokens="8716">
 <!-- ripwire for schema=ripwire.for/v1: bundle=/bodies=/reason= the body posture; d: cx= ccx= complexity, in= callers (absent cx/ccx/in = 0), churn= amp= change, clone= tested= 1, sc= scope, id=p::sc::n; total= shown= capped=1 if cut; task= the query; d pure=1 const/constexpr sig, next= the follow-up to paste; confidence=/margin_pct= head score drop (low=flat); b t= n= p= l= full bodies, c n= l= callee signatures; t p= file outside sigs (weaker), t sym= its top symbols (a pointer, not the answer), r= rank (gap = trimmed); field name= type= owner= rel=: a member of owner=, rel=creates held by value, uses by reference/pointer; d layer=: built-in arch layer (game|infra|render|math|audio|ai|test) from a dir name in p=; d e= its last line (absent=unknown, never 0; l= the name's line); c prov=split: a resolver split arm; may be another arm's (NOT a claim the edge is false) [doc mentions: 6 docs, 3 symbols; doc_mentions=] -->
 <!-- root= is the crawl root; p= below is RELATIVE to it (single-root only; absent => p= is ingest's own path, unchanged); at=this commit(+dirty). [budget_bytes= is the default BYTE target this ranked payload was shaped toward: row text shortens toward it, no row of the ranked head is removed for it (sigs past_target=)] [sigs capped=1 with shown=total: rows shrunk, none dropped] [sigs past_target=K: the last K rows are past the budget_bytes target, served because they are rows of the ranked head; none is cut] [sigs next=: one call serving all total= rows uncut] [docs_dropped=N: N shown rows have a doc comment not printed (r>24 always, r5..24 if capped)] [cut: doc_mentions_capped="1" doc_mentions_total="20" — an indexing cap dropped content not shown here] est_tokens= prices this bundle in tokens -->
 <sigs shown="40" total="40" capped="1" past_target="14" docs_dropped="25" next="--for=rankGraphTeleport --signatures-only --no-route --token-budget=6600">
-<d l="11791" e="11795" n="rankGraph" sc="rw" p="src/graph.h" cx="2" ccx="1" in="10" churn="468" amp="677" r="1" next="--expand=src/graph.h:rankGraph">
+<d l="11850" e="11854" n="rankGraph" sc="rw" p="src/graph.h" cx="2" ccx="1" in="10" churn="473" amp="685" r="1" next="--expand=src/graph.h:rankGraph">
 <doc>uniform-teleport PageRank (the default</doc>inline RankedGraph rankGraph( const Graph&amp; g, float alpha = 0.85f )</d>
-<d l="11750" e="11778" n="rankGraphTeleport" sc="rw" p="src/graph.h" cx="5" ccx="8" in="7" churn="468" amp="674" r="2">
+<d l="11809" e="11837" n="rankGraphTeleport" sc="rw" p="src/graph.h" cx="5" ccx="8" in="7" churn="473" amp="682" r="2">
 <doc>PageRank with an explicit teleport / personalization vector p (Σp = 1). The prior is name-quali…</doc>inline RankedGraph rankGraphTeleport( const Graph&amp; g, const std::vector&lt;float&gt;&amp; p, float alpha = 0.85f )</d>
 <d l="1464" e="1503" n="churnRankedGraph" p="src/main.cpp" cx="10" ccx="12" in="1" churn="453" amp="579" r="3">inline ChurnRanking churnRankedGraph( const MainDispatch&amp; d )</d>
 <d l="2385" e="2389" n="kChurnRankLegend" sc="rw" p="src/serialize.h" churn="413" amp="525" pure="1" r="4">
@@ -378,14 +378,14 @@ _Cut the result at the relevance cliff (Adaptive-k) — on a flat ranking nothin
 
 ```
 $ ./build/ripwire . --for="tree-sitter parse of a source file" --adaptive
-<ctx task="tree-sitter parse of a source file" route="subtoken+body" root="." confidence="low" margin_pct="0" at="d3605fde7" doc_mentions="3" schema="ripwire.for/v1" bundle="compact" bodies="0" reason="compact-route" budget_bytes="7500" est_tokens="7604">
+<ctx task="tree-sitter parse of a source file" route="subtoken+body" root="." confidence="low" margin_pct="0" at="0712a5182" doc_mentions="3" schema="ripwire.for/v1" bundle="compact" bodies="0" reason="compact-route" budget_bytes="7500" est_tokens="7604">
 <!-- ripwire for schema=ripwire.for/v1: bundle=/bodies=/reason= the body posture; d: cx= ccx= complexity, in= callers (absent cx/ccx/in = 0), churn= amp= change, clone= tested= 1, sc= scope, id=p::sc::n; total= shown= capped=1 if cut; task= the query; d pure=1 const/constexpr sig, next= the follow-up to paste; route= name-exact(X)|subtoken+body[:broad|:declined]; confidence=/margin_pct= head score drop (low=flat); h l= p= n=, c n= l= (joined for same-named callees, shown= counts them), noedge= no callee resolved; fold kind=bodies: b t= n= p= l= top ranked rows' whole bodies, not the answer; served= of total= in budget_bytes=; slice/skip p= n= l=; slice members= of=: a big class's ctor, question-word members; skip bytes= next=; a skip makes sigs next= it, sigs_next= the signatures-only re-call; d mem= an owner's direct member names by the index (question words first, names only), mem_more= names cut; t p= file outside sigs (weaker), t sym= its top symbols (a pointer, not the answer), r= rank (gap = trimmed); field name= type= owner= rel=: a member of owner=, rel=creates held by value, uses by reference/pointer; iface implementors=N: types implementing it, m= its method contract; d layer=: built-in arch layer (game|infra|render|math|audio|ai|test) from a dir name in p=; d e= its last line (absent=unknown, never 0; l= the name's line) [adaptive: kept 40 of 40 - no relevance cliff (broad query saturates the score); capped at the ceiling] [doc mentions: 3 docs, 2 symbols; doc_mentions=] -->
 <!-- root= is the crawl root; p= below is RELATIVE to it (single-root only; absent => p= is ingest's own path, unchanged); at=this commit(+dirty). [budget_bytes= is the default BYTE target this ranked payload was shaped toward: row text shortens toward it, no row of the ranked head is removed for it (sigs past_target=)] [sigs capped=1 with shown=total: rows shrunk, none dropped] [sigs past_target=K: the last K rows are past the budget_bytes target, served because they are rows of the ranked head; none is cut] [sigs next=: one call serving all total= rows uncut] [docs_dropped=N: N shown rows have a doc comment not printed (r>24 always, r5..24 if capped)] [files_first=N: N rows moved so r=1..8 are distinct files' best rows, score order, a repeated name once; same rows; fold, hops keep score order]; lego/compose collapse to a counted stub by default (a disclosed cut): total= that section's own pre-cap row count, shown="0" capped="1" (nothing rendered here), next= names the sections=lego,compose flag that restores both sections byte-identically in one call est_tokens= prices this bundle in tokens -->
 <sigs shown="40" total="40" capped="1" past_target="7" docs_dropped="25" files_first="3" next="--for=&apos;tree-sitter parse of a source file&apos; --signatures-only --adaptive --token-budget=5600">
 <d l="28" e="63" n="topLevelEvidence" sc="rw::pythonrunner" p="src/pythonrunner.h" cx="4" ccx="3" in="2" churn="5" amp="15" r="1" next="--expand=src/pythonrunner.h:topLevelEvidence">inline bool topLevelEvidence( std::string_view source, const TSLanguage* language, const Predicate&amp; predicate )</d … [line truncated: 1 more bytes on this line]
 <d l="45" e="45" n="kDefaultMaxFileBytes" sc="rw" p="src/ingest.h" churn="59" amp="165" pure="1" r="2">
 <doc>The crawl&apos;s per-file byte ceiling. A text file larger than this is skipped: at this size it is o…</doc>constexpr std::size_t kDefaultMaxFileBytes = 4u * 1024u * 1024u</d>
-<d l="1238" e="1246" n="parseTree" p="src/ingest_sidecap.h" cx="1" in="3" churn="138" amp="270" tested="1" r="3">TSTree* parseTree( TSParser* parser, std::string_view src )</d>
+<d l="1238" e="1246" n="parseTree" p="src/ingest_sidecap.h" cx="1" in="3" churn="139" amp="280" tested="1" r="3">TSTree* parseTree( TSParser* parser, std::string_view src )</d>
 <d l="593" e="667" n="doctorProbeGrammars" p="src/verbs_doctor.h" cx="7" ccx="17" in="1" churn="45" amp="129" r="4">
 <doc>Exercise every registered grammar and its embedded query, reporting loaded and expected totals</doc>inline DoctorGrammarProbe doctorProbeGrammars()</d>
 ... [21 more line(s); run it to see the whole thing]
@@ -409,7 +409,7 @@ _Same task with the anchor disabled — the contrast the flag exists for._
 
 ```
 $ ./build/ripwire . --for="why does src/lexical.h chooseForRanker pick name-exact BM25" --no-mention-boost
-<ctx task="why does src/lexical.h chooseForRanker pick name-exact BM25" route="subtoken+body" root="." confidence="low" margin_pct="0" at="d3605fde7" doc_mentions="2" schema="ripwire.for/v1" bundle="compact" bodies="0" reason="compact-route" budget_bytes="7500" doc_mentions_capped="1" doc_mentions_t … [line truncated: 27 more bytes on this line]
+<ctx task="why does src/lexical.h chooseForRanker pick name-exact BM25" route="subtoken+body" root="." confidence="low" margin_pct="0" at="0712a5182" doc_mentions="2" schema="ripwire.for/v1" bundle="compact" bodies="0" reason="compact-route" budget_bytes="7500" doc_mentions_capped="1" doc_mentions_t … [line truncated: 27 more bytes on this line]
 <!-- ripwire for schema=ripwire.for/v1: bundle=/bodies=/reason= the body posture; d: cx= ccx= complexity, in= callers (absent cx/ccx/in = 0), churn= amp= change, clone= tested= 1, sc= scope, id=p::sc::n; total= shown= capped=1 if cut; task= the query; d pure=1 const/constexpr sig, next= the follow-up to paste; route= name-exact(X)|subtoken+body[:broad|:declined]; confidence=/margin_pct= head score drop (low=flat); h l= p= n=, c n= l= (joined for same-named callees, shown= counts them), noedge= no callee resolved; h qword= its name (case-folded, leading _#$@ dropped) equals that question word (by name, not resolved, not the only one), first, calls to 100 (capped=1 next= all); qword_cut= owners not so served, next= the first; fold kind=bodies: b t= n= p= l= top ranked rows' whole bodies, not the answer; served= of total= in budget_bytes=; slice/skip p= n= l=; slice members= of=: a big class's ctor, question-word members; skip bytes= next=; a skip makes sigs next= it, sigs_next= the signatures-only re-call; d mem= an owner's direct member names by the index (question words first, names only), mem_more= names cut; t p= file outside sigs (weaker), t sym= its top symbols (a pointer, not the answer), r= rank (gap = trimmed); field name= type= owner= rel=: a member of owner=, rel=creates held by value, uses by reference/pointer; iface implementors=N: types implementing it, m= its method contract; d layer=: built-in arch layer (game|infra|render|math|audio|ai|test) from a dir name in p=; d e= its last line (absent=unknown, never 0; l= the name's line); c prov=split: a resolver split arm; may be another arm's (NOT a claim the edge is false) [doc mentions: 2 docs, 1 symbol; doc_mentions=] -->
 <!-- root= is the crawl root; p= below is RELATIVE to it (single-root only; absent => p= is ingest's own path, unchanged); at=this commit(+dirty). [budget_bytes= is the default BYTE target this ranked payload was shaped toward: row text shortens toward it, no row of the ranked head is removed for it (sigs past_target=)] [sigs capped=1 with shown=total: rows shrunk, none dropped] [sigs past_target=K: the last K rows are past the budget_bytes target, served because they are rows of the ranked head; none is cut] [sigs sigs_next=: one call serving all total= rows uncut] [docs_dropped=N: N shown rows have a doc comment not printed (r>24 always, r5..24 if capped)] [docs_after_code=N: N doc rows of the shown set moved below its code rows; same rows, reordered, none added or removed; a question naming docs keeps score order] [cut: doc_mentions_capped="1" doc_mentions_total="3" — an indexing cap dropped content not shown here] est_tokens= prices this bundle in tokens -->
 <sigs shown="40" total="40" capped="1" past_target="11" docs_dropped="26" docs_after_code="1" sigs_next="--for=&apos;why does src/lexical.h chooseForRanker pick name-exact BM25&apos; --signatures-only --no-mention-boost --token-budget=6100" next="--expand=src/eval.h:716:runEvalRetrieval">
@@ -439,14 +439,14 @@ _The same task with doc-mention surfacing OFF — the contrast the flag exists f
 
 ```
 $ ./build/ripwire . --for="quality delta acks ledger rubber stamp" --no-doc-mention
-<ctx task="quality delta acks ledger rubber stamp" route="subtoken+body" root="." confidence="low" margin_pct="0" at="d3605fde7" schema="ripwire.for/v1" bundle="compact" bodies="0" reason="compact-route" budget_bytes="7500" est_tokens="8691">
+<ctx task="quality delta acks ledger rubber stamp" route="subtoken+body" root="." confidence="low" margin_pct="0" at="0712a5182" schema="ripwire.for/v1" bundle="compact" bodies="0" reason="compact-route" budget_bytes="7500" est_tokens="8691">
 <!-- ripwire for schema=ripwire.for/v1: bundle=/bodies=/reason= the body posture; d: cx= ccx= complexity, in= callers (absent cx/ccx/in = 0), churn= amp= change, clone= tested= 1, sc= scope, id=p::sc::n; total= shown= capped=1 if cut; task= the query; d pure=1 const/constexpr sig, next= the follow-up to paste; route= name-exact(X)|subtoken+body[:broad|:declined]; confidence=/margin_pct= head score drop (low=flat); h l= p= n=, c n= l= (joined for same-named callees, shown= counts them), noedge= no callee resolved; h calls capped=1 next= the call listing every callee; fold kind=bodies: b t= n= p= l= top ranked rows' whole bodies, not the answer; served= of total= in budget_bytes=; slice/skip p= n= l=; slice members= of=: a big class's ctor, question-word members; skip bytes= next=; a skip makes sigs next= it, sigs_next= the signatures-only re-call; t p= file outside sigs (weaker), t sym= its top symbols (a pointer, not the answer), r= rank (gap = trimmed); field name= type= owner= rel=: a member of owner=, rel=creates held by value, uses by reference/pointer; iface implementors=N: types implementing it, m= its method contract; d layer=: built-in arch layer (game|infra|render|math|audio|ai|test) from a dir name in p=; d e= its last line (absent=unknown, never 0; l= the name's line); c prov=split: a resolver split arm; may be another arm's (NOT a claim the edge is false) -->
 <!-- root= is the crawl root; p= below is RELATIVE to it (single-root only; absent => p= is ingest's own path, unchanged); at=this commit(+dirty). [budget_bytes= is the default BYTE target this ranked payload was shaped toward: row text shortens toward it, no row of the ranked head is removed for it (sigs past_target=)] [sigs capped=1 with shown=total: rows shrunk, none dropped] [sigs past_target=K: the last K rows are past the budget_bytes target, served because they are rows of the ranked head; none is cut] [sigs sigs_next=: one call serving all total= rows uncut] [docs_dropped=N: N shown rows have a doc comment not printed (r>24 always, r5..24 if capped)] [files_first=N: N rows moved so r=1..8 are distinct files' best rows, score order, a repeated name once; same rows; fold, hops keep score order] est_tokens= prices this bundle in tokens -->
 <sigs shown="40" total="40" capped="1" past_target="12" docs_dropped="26" files_first="32" sigs_next="--for=&apos;quality delta acks ledger rubber stamp&apos; --signatures-only --no-doc-mention --token-budget=6100" next="--expand=src/mcpverbs.h:4480:computeQualityDelta">
 <d l="1575" e="1596" n="refPairStaleAcks" p="src/verbs_quality.h" cx="6" ccx="6" in="1" churn="106" amp="205" r="1" next="--expand=src/verbs_quality.h:refPairStaleAcks">
 <doc>L2 stale acks in the range form. A changed-files answer holds no whole target tree to check the …</doc>std::vector&lt;rw::quality::StaleAck&gt; refPairStaleAcks( const gtl::btree_map&lt;std::string, rw::quality::AckRecord&gt;&amp; acks, const RefPairDelta&amp; refs )</d>
 <d l="4480" e="4552" n="computeQualityDelta" sc="rw" p="src/mcpverbs.h" cx="4" ccx="4" in="1" churn="466" amp="552" r="2">inline QualityDeltaOutcome computeQualityDelta( const std::string&amp; root )</d>
-<d l="8732" e="8747" n="staleByKindValue" sc="quality" p="src/quality.h" cx="5" ccx="7" in="2" churn="476" amp="648" r="3">inline std::string staleByKindValue( const std::vector&lt;StaleAck&gt;&amp; staleAcks )</d>
+<d l="8845" e="8860" n="staleByKindValue" sc="quality" p="src/quality.h" cx="5" ccx="7" in="2" churn="481" amp="659" r="3">inline std::string staleByKindValue( const std::vector&lt;StaleAck&gt;&amp; staleAcks )</d>
 <d l="2346" e="2348" n="kAtStampLegend" sc="rw" p="src/serialize.h" churn="413" amp="525" pure="1" r="4">inline constexpr const char* kAtStampLegend = &quot;&lt;!-- at= is the git commit these numbers were computed at</d>
 ... [22 more line(s); run it to see the whole thing]
 ```
@@ -469,7 +469,7 @@ _Interface -> implementors view: every existing impl of the named interface; the
 $ ./build/ripwire . --lego=Vehicle
 <ctx schema="ripwire.lego/v1" root=".">
 <!-- ripwire lego schema=ripwire.lego/v1: ONE interface/base type: <iface n= p= defs= implementors=>, its <m> method contract, every implementor. counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. root=: p= relative to it. methods=0 caveat=not-extracted-for-lang: no <m> contract read for this language. -->
-<lego graph_ambiguous="2927" graph_unresolved="15221" graph_unindexed="269" counts_floor="1">
+<lego graph_ambiguous="2933" graph_unresolved="15249" graph_unindexed="269" counts_floor="1">
 <iface n="Vehicle" p="test/legofix/vehicle.rs" methods="0" caveat="not-extracted-for-lang" defs="1" implementors="2">
 <impl n="Car" p="test/legofix/vehicle.rs:12"/>
 <impl n="Bike" p="test/legofix/vehicle.rs:13"/>
@@ -500,7 +500,7 @@ _The repo's best-in-class instance to imitate before writing new code (picked by
 $ ./build/ripwire . --exemplar="format byte sizes for humans"
 <!-- ripwire exemplar schema=ripwire.exemplar/v1: the best-in-class instance of kind= for the task, chosen by role: n= p= in= ccx= tested=, <bodies>
 <b> to imitate. window: shown= total= capped= (capped=1 cut). root=: p= relative to it. candidates=N: instances of kind= under the ccx ceiling the pick was ranked from. low_confidence=1: weak task-to-kind match, fell back to fn; pass a kind (fn|method|class...) instead. -->
-<exemplar schema="ripwire.exemplar/v1" kind="fn" candidates="15314" n="kindIs" p="src/infra/nodekind.h:46" in="336" ccx="3" root="." tested="1" low_confidence="1">
+<exemplar schema="ripwire.exemplar/v1" kind="fn" candidates="15359" n="kindIs" p="src/infra/nodekind.h:46" in="337" ccx="3" root="." tested="1" low_confidence="1">
 <bodies shown="1" total="1" capped="0">
 <b t="fn" l="46" p="src/infra/nodekind.h" n="kindIs">
 <![CDATA[inline bool kindIs( const char* t, const char ( &lit )[N] ) noexcept
@@ -529,9 +529,9 @@ _Most relevant DOCS' full bodies (markdown only) — recall what is already writ
 
 ```
 $ ./build/ripwire . --recall="quality delta gating exit codes"
-ripwire recall — "quality delta gating exit codes" — 121 relevant of 268 document files, best-first — total=121 shown=8 capped=1 truncated=6 generated_demoted=3 max_tokens=8000 share_bytes=2468 est_tokens=4165
+ripwire recall — "quality delta gating exit codes" — 122 relevant of 270 document files, best-first — total=122 shown=8 capped=1 truncated=6 generated_demoted=3 max_tokens=8000 share_bytes=2468 est_tokens=4165
 
-━━ README.md  (relevance 8.095) ━━  [sections: 2 of 25 selected (60 in doc), section-granular; whole doc 222723 B; lines="2747-2759,2760-2767"; dropped_by_budget=23]
+━━ README.md  (relevance 8.093) ━━  [sections: 2 of 25 selected (60 in doc), section-granular; whole doc 222723 B; lines="2747-2759,2760-2767"; dropped_by_budget=23]
 #### 6.2 Exit codes
 
 This is the part to wire into a script.
@@ -594,13 +594,13 @@ and both are yours, because the file you write is the only thing that sets them:
 
 **Try it**
 
-_The directory-as-knowledge-base pattern: --recall pointed at a 1360588-byte scratch dir of DUMPED TOOL OUTPUT (a git log, this repo's own generated command reference, --help text, an architecture doc, a fabricated JSON access log) instead of a source repo — no index to build, no daemon._
+_The directory-as-knowledge-base pattern: --recall pointed at a 1353762-byte scratch dir of DUMPED TOOL OUTPUT (a git log, this repo's own generated command reference, --help text, an architecture doc, a fabricated JSON access log) instead of a source repo — no index to build, no daemon._
 
 ```
 $ ./build/ripwire <scratch>/aux/kbcorpus --recall="field affinity cache line data layout which fields are read together" --top-k=3 --max-tokens=1200
 ripwire recall — "field affinity cache line data layout which fields are read together" — 2 relevant of 2 document files, best-first — total=2 shown=1 capped=1 truncated=1 max_tokens=1200 share_bytes=2040 est_tokens=957
 
-━━ commands.md  (relevance 10.053) ━━  [sections: 1 of 164 selected (192 in doc), section-granular; whole doc 588971 B; lines="3838-3842"; dropped_by_budget=163]  [truncated: 1865 of 7738 bytes]
+━━ commands.md  (relevance 10.117) ━━  [sections: 1 of 164 selected (192 in doc), section-granular; whole doc 589307 B; lines="3838-3842"; dropped_by_budget=163]  [truncated: 1865 of 7738 bytes]
 ### `--field-affinity[=STRUCT]`
 
 **Answers:** find fields that are read together but declared far apart — the cache-locality lens the CACHE-LOCALITY lens: which fields are READ TOGETHER but declared FAR APART.
@@ -623,7 +623,7 @@ _File-by-file orientation map (top symbols per file)._
 ```
 $ ./build/ripwire . --tree
 <!-- ripwire tree schema=ripwire.tree/v1: each file with its top 3 symbols by rank, files by best symbol: <file p= symbols=> of <s t= n=>; of files= indexed, files_unlisted= have none. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). symbols_capped=: 1 = cut. root=: p= relative to it. pr_iters=N: PageRank iterations. shown_symbols=: <s> rows printed. next=: the one pasteable follow-up. -->
-<tree schema="ripwire.tree/v1" files="3618" files_unlisted="79" shown="80" capped="1" total="3539" has_more="1" next_offset="80" offset="0" limit="0" pr_iters="36" root="." shown_symbols="235" symbols_capped="1" next="--tree --offset=80">
+<tree schema="ripwire.tree/v1" files="3631" files_unlisted="79" shown="80" capped="1" total="3552" has_more="1" next_offset="80" offset="0" limit="0" pr_iters="36" root="." shown_symbols="235" symbols_capped="1" next="--tree --offset=80">
 <file p="src/infra/nodekind.h" symbols="1">
 <s t="fn" n="kindIs"/>
 </file>
@@ -632,7 +632,7 @@ $ ./build/ripwire . --tree
 <s t="macro" n="RW_ASSUME_"/>
 <s t="macro" n="RW_ASSUME_"/>
 </file>
-<file p="src/ingest_metrics.h" symbols="57">
+<file p="src/ingest_metrics.h" symbols="58">
 <s t="fn" n="nodeTextOf"/>
 <s t="fn" n="nodeFieldText"/>
 <s t="struct" n="CtrlKind"/>
@@ -727,7 +727,7 @@ _--no-stable outside --mcp: what the flag does (or says) when there is no stable
 $ ./build/ripwire . --no-stable --top-k=3
 <!-- ripwire map schema=ripwire.map/v1: ranked symbol map: <f p= layer=> groups <s t= n= sc= k= amb=> rows (k= rank), <c n=> resolved callees; the header comment is data. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. pr_iters=N: PageRank iterations. <inv listed= unlisted=>: files the ranked rows show / do not (sum = files=), each named or counted below. <entry p= n=>: a program entry by its language's convention (C/Go/Rust main, Java/C# static main, a script main its module scope calls, __main__.py), callees as c rows; manifest entries not read. <ls p= n= f=>: n= unshown files under dir p=; f= names its code files, the rest (tests, docs, config, test/doc/example dirs) counted. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. amb=K: K calls split over several defs. -->
 <!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
-<!-- files=3618 symbols=31790 edges=29969 shown=3 est_tokens=3272 ambiguous=2927 unresolved=15221 locality_pinned=9 external=8647 declined=30140 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
+<!-- files=3631 symbols=31860 edges=30033 shown=3 est_tokens=3272 ambiguous=2933 unresolved=15249 locality_pinned=9 external=8658 declined=30154 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
 <r schema="ripwire.map/v1" root="." est_tokens="3272" pr_iters="36">
 <f p="src/infra/nodekind.h" layer="infra">
 <s t="fn" n="kindIs" sc="rw" k="0.0037">
@@ -761,7 +761,7 @@ $ ./build/ripwire . --around=rankGraphTeleport
 <!-- ripwire around schema=ripwire.around/v1: call neighbourhood of of=: depth= hops, fanout= kept per hop; absent rows lie outside that boundary. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. overloads=N: N same-name defs merged in this row; shown= counts each. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. <c via="name">: that callee matched by name alone (receiver unproven); it does NOT mean the edge is false. <c x=N>: N same-named via=name rows merged; callees=FILE:SYM lists all. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. amb=K: K calls split over several defs. layer=: built-in arch layer (game|infra|render|math|audio|ai|test) from a dir name in p=; absent if none. -->
 <!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
 <!-- a bound BIT this walk, so raising it would return more: depth_truncated=1 means at least one symbol one hop past depth= is absent; fanout_cut=N means N distinct symbols were dropped by the fanout= cap and appear NOWHERE here (exact, not a floor: a neighbour another hub re-admitted is not counted). Neither attribute is emitted when its bound cut nothing, so absent means that bound did not bind and raising it returns nothing new. The knobs are around-depth=N and around-fanout=K. -->
-<!-- files=3618 symbols=31790 edges=29969 shown=12 est_tokens=3147 ambiguous=2927 unresolved=15221 locality_pinned=9 external=8647 declined=30140 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
+<!-- files=3631 symbols=31860 edges=30033 shown=12 est_tokens=3147 ambiguous=2933 unresolved=15249 locality_pinned=9 external=8658 declined=30154 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
 <r schema="ripwire.around/v1" root="." of="rankGraphTeleport" depth="1" fanout="32" depth_truncated="1" est_tokens="3147">
 <f p="src/graph.h">
 <s t="fn" n="rankGraphTeleport" sc="rw" amb="1" k="1.0000">
@@ -813,18 +813,18 @@ _What SYM calls (1-hop out-edges)._
 ```
 $ ./build/ripwire . --callees=rankGraphTeleport
 <!-- ripwire callees schema=ripwire.callees/v1: 1-hop CALLEES of of= (defs= matched, count= distinct symbols): <s t= n= p= role= tested=>. counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. stdm n= calls=: of declined_calls=, calls named like a standard-type member of their language (C++ container/string/optional/smart pointer, Rust collection/string/Option/Result; n=) on a receiver no rule tied to an in-tree class (Rust: one of an in-tree type no rule typed too: a generic bound, dyn or impl Trait, a type alias, a glob of a glob, a tuple-struct field, a non-plain pattern, behind Option / Result / Rc / Arc / RefCell / Cell / Mutex / RwLock); no edge or row (may be the std member). root=: p= relative to it. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. <s tested=1>: a non-test row an indexed test transitively reaches (absent otherwise, never 0). declined_calls=K: K call sites left unbound, in no count; <dc n= l=|in= p= cands=K via=declined>: one such call SITE (callees: called name, line; callers: calling def, file:line); NOT an edge or a caller/callee claim; cands=K: K in-tree defs it could have meant (K may be 1), the resolver proved none; not a claim this call reaches any of them. dc gate=: builtin or std, a name gate declined it; side, a Ruby call whose in-reach defs answer on the other side of self. next=: the one pasteable follow-up. hop_tested=/hop_untested=: count= split by whether an indexed test reaches the row (in-process calls only). -->
-<callees schema="ripwire.callees/v1" of="rankGraphTeleport" defs="1" count="4" root="." hop_tested="3" hop_untested="1" declined_calls="6" graph_ambiguous="2927" graph_unresolved="15221" graph_unindexed="269" counts_floor="1" next="--expand=rankGraphTeleport">
-<s t="fn" n="biasPrior" p="src/graph.h:11709"/>
+<callees schema="ripwire.callees/v1" of="rankGraphTeleport" defs="1" count="4" root="." hop_tested="3" hop_untested="1" declined_calls="6" graph_ambiguous="2933" graph_unresolved="15249" graph_unindexed="269" counts_floor="1" next="--expand=rankGraphTeleport">
+<s t="fn" n="biasPrior" p="src/graph.h:11768"/>
 <s t="macro" n="PROFILE_SCOPE_DESCRIBE" p="src/infra/profileScope.h:1282" role="macro" tested="1" prov="split"/>
 <s t="macro" n="PROFILE_SCOPE_DESCRIBE" p="src/infra/profileScope.h:1296" role="macro" tested="1" prov="split"/>
 <s t="fn" n="pageRankDouble" p="src/pagerank.cpp:99" tested="1"/>
 <stdm n="begin,end,size" calls="6"/>
-<dc n="size" l="11754" cands="1" via="declined" gate="std"/>
-<dc n="begin" l="11755" cands="2" via="declined" gate="std"/>
-<dc n="end" l="11755" cands="2" via="declined" gate="std"/>
-<dc n="begin" l="11776" cands="2" via="declined" gate="std"/>
-<dc n="end" l="11776" cands="2" via="declined" gate="std"/>
-<dc n="begin" l="11776" cands="2" via="declined" gate="std"/>
+<dc n="size" l="11813" cands="1" via="declined" gate="std"/>
+<dc n="begin" l="11814" cands="2" via="declined" gate="std"/>
+<dc n="end" l="11814" cands="2" via="declined" gate="std"/>
+<dc n="begin" l="11835" cands="2" via="declined" gate="std"/>
+<dc n="end" l="11835" cands="2" via="declined" gate="std"/>
+<dc n="begin" l="11835" cands="2" via="declined" gate="std"/>
 </callees>
 ```
 
@@ -848,10 +848,10 @@ _The resolvable use-sites (call/read/write/import/extends) with file:line; count
 ```
 $ ./build/ripwire . --uses=rankGraphTeleport
 <!-- ripwire uses schema=ripwire.uses/v1: resolvable use-sites of of=: <u role=call|macro|read|write|import|extends|type p=file:line in_id=>. counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. root=: p= relative to it. defs=N: definitions the selector matched; qualify file:name to narrow the call sites. external=1: of= has no definition in the indexed tree under any spelling (stdlib/third-party). count=N: use-site rows in all (a floor). -->
-<uses schema="ripwire.uses/v1" of="rankGraphTeleport" defs="1" external="0" count="9" root="." graph_ambiguous="2927" graph_unresolved="15221" graph_unindexed="269" counts_floor="1">
+<uses schema="ripwire.uses/v1" of="rankGraphTeleport" defs="1" external="0" count="9" root="." graph_ambiguous="2933" graph_unresolved="15249" graph_unindexed="269" counts_floor="1">
 <u role="call" p="src/mcpindex.h:1288" in_id="src/mcpindex.h::rw::getIndex"/>
-<u role="call" p="src/graph.h:11794" in_id="src/graph.h::rw::rankGraph"/>
-<u role="call" p="src/graph.h:12488" in_id="src/graph.h::rw::anchoredLexicalRank"/>
+<u role="call" p="src/graph.h:11853" in_id="src/graph.h::rw::rankGraph"/>
+<u role="call" p="src/graph.h:12547" in_id="src/graph.h::rw::anchoredLexicalRank"/>
 <u role="call" p="src/eval.h:328" in_id="src/eval.h::rw::runEval"/>
 <u role="call" p="src/main.cpp:1439" in_id="churnDecayRanking"/>
 <u role="call" p="src/main.cpp:1478" in_id="churnRankedGraph"/>
@@ -882,13 +882,13 @@ _Composable node-set query: functions within 2 caller-hops of rankGraphTeleport.
 ```
 $ ./build/ripwire . --graph-query='and(callers(name("rankGraphTeleport"),2),kind(all,fn))'
 <!-- ripwire graph-query schema=ripwire.graph-query/v1: graph-query expression over the symbol graph: <s t= n= p=> matching rows. window: shown= capped= (capped=1 cut). counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. root=: p= relative to it. pr_iters=N: PageRank iterations. expr=: the expression as given; count=: symbols it matched (rows page by shown=/total=). -->
-<query schema="ripwire.graph-query/v1" expr="and(callers(name(&quot;rankGraphTeleport&quot;),2),kind(all,fn))" count="55" shown="55" capped="0" graph_ambiguous="2927" graph_unresolved="15221" graph_unindexed="269" counts_floor="1" root="." pr_iters="36">
+<query schema="ripwire.graph-query/v1" expr="and(callers(name(&quot;rankGraphTeleport&quot;),2),kind(all,fn))" count="55" shown="55" capped="0" graph_ambiguous="2933" graph_unresolved="15249" graph_unindexed="269" counts_floor="1" root="." pr_iters="36">
 <s t="fn" n="getIndex" p="src/mcpindex.h:1184"/>
-<s t="fn" n="anchoredLexicalRank" p="src/graph.h:12437"/>
+<s t="fn" n="anchoredLexicalRank" p="src/graph.h:12496"/>
 <s t="fn" n="emitCommunitiesReport" p="src/verbs_report.h:2563"/>
 <s t="fn" n="emitCommunityDrill" p="src/verbs_report.h:2724"/>
 <s t="fn" n="computeLensRanking" p="src/verbs_for.h:84"/>
-<s t="fn" n="rankGraph" p="src/graph.h:11791"/>
+<s t="fn" n="rankGraph" p="src/graph.h:11850"/>
 <s t="fn" n="dispatchMain" p="src/main.cpp:4307"/>
 <s t="fn" n="postCheckJson" p="src/mcpedit.h:1116"/>
 <s t="fn" n="fetchBody" p="src/mcpverbs.h:5436"/>
@@ -919,17 +919,17 @@ _Names referenced but never defined in-corpus (stdlib/third-party surface). The
 ```
 $ ./build/ripwire . --external-surface
 <!-- ripwire external-surface schema=ripwire.external-surface/v1: names used but never defined in the index: <x n= lang= refs= calls=>. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). next=: the one pasteable follow-up. names=N: distinct external names (the x rows' total). builtins_excluded=N: sh BUILTIN rows (echo printf cd exit test ...) dropped from names=; the include-builtins flag keeps them. -->
-<external-surface schema="ripwire.external-surface/v1" names="2902" builtins_excluded="20" shown="100" capped="1" total="2902" has_more="1" next_offset="100" offset="0" limit="0" next="--external-surface --offset=100">
-<x n="grep" lang="sh" refs="14374" calls="14374"/>
-<x n="cat" lang="sh" refs="2663" calls="2663"/>
-<x n="tr" lang="sh" refs="2249" calls="2249"/>
-<x n="python3" lang="sh" refs="1865" calls="1865"/>
-<x n="sed" lang="sh" refs="1798" calls="1798"/>
-<x n="substr" lang="cpp" refs="1293" calls="1293"/>
+<external-surface schema="ripwire.external-surface/v1" names="2904" builtins_excluded="20" shown="100" capped="1" total="2904" has_more="1" next_offset="100" offset="0" limit="0" next="--external-surface --offset=100">
+<x n="grep" lang="sh" refs="14388" calls="14388"/>
+<x n="cat" lang="sh" refs="2678" calls="2678"/>
+<x n="tr" lang="sh" refs="2254" calls="2254"/>
+<x n="python3" lang="sh" refs="1871" calls="1871"/>
+<x n="sed" lang="sh" refs="1799" calls="1799"/>
+<x n="substr" lang="cpp" refs="1295" calls="1295"/>
 <x n="print" lang="py" refs="989" calls="989"/>
 <x n="to_string" lang="cpp" refs="977" calls="977"/>
 <x n="wc" lang="sh" refs="967" calls="967"/>
-<x n="ts_node_is_null" lang="cpp" refs="908" calls="908"/>
+<x n="ts_node_is_null" lang="cpp" refs="910" calls="910"/>
 <x n="string_view" lang="cpp" refs="872" calls="872"/>
 <x n="mktemp" lang="sh" refs="871" calls="871"/>
 ... [17 more line(s); run it to see the whole thing]
@@ -954,12 +954,12 @@ _Shortest directed call-path SRC -> DST. CHANGED: now reports from_p/to_p/from_d
 ```
 $ ./build/ripwire . --path=main,rankGraphTeleport
 <!-- ripwire path schema=ripwire.path/v1: one DIRECTED call path from= to to=, each <s t= n= p=> a hop; reachable=0 hops=0 when none. counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. root=: p= relative to it. from_p=/to_p=: the definitions from= and to= were bound to. from_defs=/to_defs=: definitions of each name, all searched; above 1, qualify file:name. -->
-<path schema="ripwire.path/v1" from="main" to="rankGraphTeleport" from_p="src/main.cpp:4172" to_p="src/graph.h:11750" from_defs="135" to_defs="1" reachable="1" hops="4" root="." graph_ambiguous="2927" graph_unresolved="15221" graph_unindexed="269" counts_floor="1">
+<path schema="ripwire.path/v1" from="main" to="rankGraphTeleport" from_p="src/main.cpp:4172" to_p="src/graph.h:11809" from_defs="135" to_defs="1" reachable="1" hops="4" root="." graph_ambiguous="2933" graph_unresolved="15249" graph_unindexed="269" counts_floor="1">
 <s t="fn" n="main" p="src/main.cpp:4172"/>
 <s t="fn" n="runWithCompactLegend" p="src/main.cpp:4108"/>
 <s t="fn" n="dispatchMain" p="src/main.cpp:4307"/>
 <s t="fn" n="runDefaultMap" p="src/main.cpp:1751"/>
-<s t="fn" n="rankGraphTeleport" p="src/graph.h:11750"/>
+<s t="fn" n="rankGraphTeleport" p="src/graph.h:11809"/>
 </path>
 ```
 
@@ -976,10 +976,10 @@ _Minimal connecting subgraph over 3 symbols (finds shared-caller joins)._
 ```
 $ ./build/ripwire . --connect=rankGraphTeleport,runEval,getIndex
 <!-- ripwire connect schema=ripwire.connect/v1: minimal joining subgraph: <g> groups, <t> terminals, <s connects=> joins, <e f= t=> edges, <unconnected>. counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. hub_floor=D: connects= >= D is hub=1, vacuous. nodes=N: symbols printed, terminals plus joins (a floor). radius=N: undirected hop bound searched (default 6, max 12); raise it with connect-radius=N. terminals=/groups=/edges=: task symbols resolved, connected groups (g), e edges printed. -->
-<connect schema="ripwire.connect/v1" terminals="3" nodes="3" edges="2" radius="6" groups="1" est_tokens="512" hub_floor="246" root="." graph_ambiguous="2927" graph_unresolved="15221" graph_unindexed="269" counts_floor="1">
+<connect schema="ripwire.connect/v1" terminals="3" nodes="3" edges="2" radius="6" groups="1" est_tokens="512" hub_floor="246" root="." graph_ambiguous="2933" graph_unresolved="15249" graph_unindexed="269" counts_floor="1">
 <g terminals="3">
 <t n="runEval" t="fn" p="src/eval.h:171"/>
-<t n="rankGraphTeleport" t="fn" p="src/graph.h:11750"/>
+<t n="rankGraphTeleport" t="fn" p="src/graph.h:11809"/>
 <t n="getIndex" t="fn" p="src/mcpindex.h:1184"/>
 <e f="runEval" t="rankGraphTeleport"/>
 <e f="getIndex" t="rankGraphTeleport"/>
@@ -1086,7 +1086,7 @@ _Test files that transitively reach the changed file._
 ```
 $ ./build/ripwire . --affected=src/graph.h
 <!-- ripwire affected schema=ripwire.affected/v1: test files that transitively reach the changed files/symbols: <test p= partner= hops= run=> in evidence order (order= partners=); seeded_by= the reading taken. counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. run_unknown=1: no runner derivable (a guess would be worse). root=: p= relative to it. seeds=N: symbols the argument matched; only those outside test files seed the caller walk. seed_test_files=N: matched files that are TESTS; listed to run (seed_kind=test), never walk seeds. tests=N: test files listed to run (the rows). reached=N: symbols the transitive caller walk reached from the seeds (seeds excluded). script_gates_unmodelled=N: test/*.sh runners; their subprocess reach is unmodelled, never in tests=/reached=. run_first=N: the first N test files have the most direct evidence (changed/partner/hops=1, else nearest hops=); not a skip list. changed=: the files/symbols argument as given. -->
-<affected schema="ripwire.affected/v1" changed="src/graph.h" seeded_by="file" seeds="611" seed_test_files="0" tests="7" reached="537" script_gates_unmodelled="782" run_first="3" order="evidence" partners="0" root="." graph_ambiguous="2927" graph_unresolved="15221" graph_unindexed="269" counts_floor= … [line truncated: 4 more bytes on this line]
+<affected schema="ripwire.affected/v1" changed="src/graph.h" seeded_by="file" seeds="612" seed_test_files="0" tests="7" reached="537" script_gates_unmodelled="782" run_first="3" order="evidence" partners="0" root="." graph_ambiguous="2933" graph_unresolved="15249" graph_unindexed="269" counts_floor= … [line truncated: 4 more bytes on this line]
 <test p="test/connectcore_harness.cpp" hops="1" run="bash test/connectcorecheck.sh"/>
 <test p="test/cppqualtmplfix/member.cpp" hops="1" run="bash test/cppqualcheck.sh"/>
 <test p="test/verify_csr.cpp" hops="1" run="bash test/a9disclosurecheck.sh"/>
@@ -1143,7 +1143,7 @@ _Mid-task situational report for the current git diff — recorded against a CLE
 $ ./build/ripwire . --situ
 ripwire situational-awareness — 0 changed file(s), 0 symbols in them
 root: .
-at: d3605fde7
+at: 0712a5182
   (0 changed files — working tree is clean, nothing to analyze)
 ```
 
@@ -1162,18 +1162,18 @@ _The continuation packet for the NEXT session: <verified> disk truth (branch/sha
 ```
 $ ./build/ripwire . --handoff
 <!-- ripwire handoff schema=ripwire.handoff/v1: continuation packet for the NEXT session: <verified changed= blast_files=>, <tests n=>, <heuristic n= candidates=>, <note>, <doc p=>. window: capped= (capped=1 cut). est_tokens=: price as emitted (an upper bound under compact). at=: commit+dirty+shallow. root=: p= relative to it. branch=/subject=: the checked out branch and HEAD commit subject; gitok=0: the git diff probe failed, changed counts are floors. cochange_window=/cochange_commits=: the git window the cochange rows were mined in and the commits it held (0: could not look). doc s=: lexical score of that plan/design doc for the branch+subject query. note target=/txt=: a committed notes row on this work (symbol id or path) and its text; a suggestion. -->
-<handoff schema="ripwire.handoff/v1" at="d3605fde7" root="." branch="integration/train-35" subject="train 35: versions fragment names the composed legend dictionary" gitok="1" est_tokens="869">
+<handoff schema="ripwire.handoff/v1" at="0712a5182" root="." branch="integration/train-36" subject="Merge origin/integration/train-35 (harvested head 6580f358) into integration/train-36" gitok="1" est_tokens="880">
 <verified changed="0" blast_files="0">
 <tests n="0">
 </tests>
 </verified>
-<heuristic n="6" candidates="255" capped="1" cochange_window="18mo@HEAD" cochange_commits="5267">
+<heuristic n="6" candidates="162" capped="1" cochange_window="18mo@HEAD" cochange_commits="5296">
 <note target="src/infra/Diagnostics.h" txt="ASSUME_NO_ALIAS is an optimizer fact in release (separate_storage) only where the compiler consumes it: clang 18+ by default, LLVM 17/AppleClang 16 via the CMake -mllvm flag (scalars only), GCC never (debug check only); never on two members of one object;  … [line truncated: 57 more bytes on this line]
 <note target="test/manifestcheck.sh" txt="README.md&apos;s single &apos;&lt;N&gt; gate scripts&apos; claim (~line 1305) is NOT enforced — the derived-vs-stated sibling loop here covers docs/EVALS.md only. It drifted 407→451 unnoticed (fixed 2026-08-23). To close: grep both files (&apos;file:line … [line truncated: 47 more bytes on this line]
-<doc p="CHANGELOG.md" s="9.616"/>
-<doc p="changelog.d/README.md" s="9.094"/>
-<doc p="test/changelogfragfix/tree/changelog.d/README.md" s="9.094"/>
-<doc p="docs/research/answer-completeness.md" s="7.149"/>
+<doc p="CHANGELOG.md" s="9.897"/>
+<doc p="bench/locbench/results/vt2_pooling_freestat/FREESTAT.md" s="9.864"/>
+<doc p="paper/PREPRINT.md" s="9.523"/>
+<doc p="docs/research/answer-completeness.md" s="9.481"/>
 </heuristic>
 ... [1 more line(s); run it to see the whole thing]
 ```
@@ -1197,7 +1197,7 @@ _Pre-PR gate on a CLEAN tree: no obligations, exit 0._
 ```
 $ ./build/ripwire . --test-gate
 <!-- ripwire test-gate schema=ripwire.test-gate/v1: tests <t p= changed= partner= hops= run=> + untested blast radius <u sym= p= l= ccx=>; exit 4 while either exists. tests_capped=/untested_capped=: 1 = cut. counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. at=: commit+dirty+shallow. next=: the one pasteable follow-up. impacted=N: symbols that transitively call the change (changed symbols excluded). shown_tests=/shown_untested=: t rows and u rows printed, two independent counts. script_gates_unmodelled=N: test/*.sh runners in the corpus, a path count; not call-graph modelled. script_gates_registered=N: shell gates test/regression.sh registers as suite members. script_gates_mapped=N: registered gates with exact dependency evidence (literal paths or RIPWIRE_TEST_DEPS). script_gates_unresolved_dynamic=N: registered gates with no mappable deps; they may cover the change unlisted. ccx_bar=N: the cognitive-complexity bar a u row's ccx= is read against. untested_modscope=N: <file-scope> owners excluded from untested= (#324, uncallable); still in impacted=. tests=/untested=: tests to run (t total) / impacted symbols no test reaches (u total). -->
-<test-gate schema="ripwire.test-gate/v1" changed="0" impacted="0" tests="0" untested="0" untested_modscope="0" shown_tests="0" tests_capped="0" shown_untested="0" untested_capped="0" script_gates_unmodelled="782" script_gates_registered="733" script_gates_mapped="235" script_gates_unresolved_dynamic … [line truncated: 136 more bytes on this line]
+<test-gate schema="ripwire.test-gate/v1" changed="0" impacted="0" tests="0" untested="0" untested_modscope="0" shown_tests="0" tests_capped="0" shown_untested="0" untested_capped="0" script_gates_unmodelled="782" script_gates_registered="733" script_gates_mapped="236" script_gates_unresolved_dynamic … [line truncated: 136 more bytes on this line]
 </test-gate>
 ```
 
@@ -1280,18 +1280,18 @@ _Boolean grep: hits where BOTH literals share the matched line (--grep-scope=lin
 $ ./build/ripwire . --grep=DISCLOSE --and=cache
 <!-- ripwire grep schema=ripwire.grep/v1: literal/regex scan grouped by file: <f p=>
 <hit l= in=>CDATA text</hit> (<b>/<a> context around it); complete=1 only for an exhaustive literal scan (beside pattern_meta=, of the literal reading only); <unindexed> = off-index. window: shown= capped= (capped=1 cut). hits_capped=1: hits= is a floor. root=: p= relative to it. parse_degraded=1: E … [line truncated: 1494 more bytes on this line]
-<grep pattern="DISCLOSE" schema="ripwire.grep/v1" root="." terms="DISCLOSE +cache" scope="line" terms_suppressed="1016" files="9" hits="28" shown="28" capped="0" hits_capped="0" suppressed_comment="2" suppressed_string="8" tier_parsed="13" tier_unclassified="0" corpus_oversize="15" corpus_pruned_dir … [line truncated: 119 more bytes on this line]
+<grep pattern="DISCLOSE" schema="ripwire.grep/v1" root="." terms="DISCLOSE +cache" scope="line" terms_suppressed="1018" files="9" hits="26" shown="26" capped="0" hits_capped="0" suppressed_comment="2" suppressed_string="8" tier_parsed="13" tier_unclassified="0" corpus_oversize="15" corpus_pruned_dir … [line truncated: 119 more bytes on this line]
 <f p="src/ingest_cache.h">
-<hit l="2144" in="openCacheFrame" n="5">
+<hit l="2152" in="openCacheFrame" n="5">
 <![CDATA[            DISCLOSE( Diagnostics::answerUnchanged, "a rejected cache is rebuilt from source: this run parses and answers byte-identically",]]>
-<at l="2152" in="openCacheFrame"/>
 <at l="2160" in="openCacheFrame"/>
-<at l="2232" in="openCacheFrame"/>
-<at l="2327" in="ByteR::fitsBelow"/>
+<at l="2168" in="openCacheFrame"/>
+<at l="2240" in="openCacheFrame"/>
+<at l="2335" in="ByteR::fitsBelow"/>
 </hit>
-<hit l="2192" in="openCacheFrame" n="4">
+<hit l="2200" in="openCacheFrame" n="4">
 <![CDATA[        DISCLOSE( Diagnostics::answerUnchanged, "a rejected cache is rebuilt from source: this run parses and answers byte-identically",]]>
-<at l="2210" in="openCacheFrame"/>
+<at l="2218" in="openCacheFrame"/>
 ... [17 more line(s); run it to see the whole thing]
 ```
 
@@ -1309,14 +1309,14 @@ _Drop every hit in a file that ALSO contains the --not literal anywhere (file sc
 $ ./build/ripwire . --grep=DISCLOSE --not=test --grep-scope=file
 <!-- ripwire grep schema=ripwire.grep/v1: literal/regex scan grouped by file: <f p=>
 <hit l= in=>CDATA text</hit> (<b>/<a> context around it); complete=1 only for an exhaustive literal scan (beside pattern_meta=, of the literal reading only); <unindexed> = off-index. window: shown= capped= (capped=1 cut). hits_capped=1: hits= is a floor. root=: p= relative to it. parse_degraded=1: E … [line truncated: 1293 more bytes on this line]
-<grep pattern="DISCLOSE" schema="ripwire.grep/v1" root="." terms="DISCLOSE -test" scope="file" terms_suppressed="1014" files="6" hits="13" shown="13" capped="0" hits_capped="0" suppressed_comment="28" tier_parsed="22" tier_unclassified="0" corpus_oversize="15" corpus_pruned_dirs="6" unindexed_hits=" … [line truncated: 100 more bytes on this line]
+<grep pattern="DISCLOSE" schema="ripwire.grep/v1" root="." terms="DISCLOSE -test" scope="file" terms_suppressed="1014" files="6" hits="13" shown="13" capped="0" hits_capped="0" suppressed_comment="28" tier_parsed="22" tier_unclassified="0" corpus_oversize="15" corpus_pruned_dirs="5" unindexed_hits=" … [line truncated: 100 more bytes on this line]
 <f p="src/commentcoherence.h" parse_degraded="1">
 <hit l="216" in="rw::computeCommentCoherence">
 <![CDATA[                DISCLOSE( scan, CommentCoherenceScan::DisclosureWhy::UnreadableFile, "comment-coherence: an indexed file could not be read — its functions are absent from the report" );]]>
 </hit>
 </f>
 <f p="src/forctorhop.h">
-<hit l="164" in="rw::spliceCtorHop">
+<hit l="168" in="rw::spliceCtorHop">
 <![CDATA[        DISCLOSE( Diagnostics::answerUnchanged, "no row carries ctor_l=: the answer is the one without the constructor hop",]]>
 </hit>
 </f>
@@ -1340,14 +1340,14 @@ _Drop every hit in a file that ALSO contains the --not literal anywhere (file sc
 $ ./build/ripwire . --grep=DISCLOSE --not=test --grep-scope=file
 <!-- ripwire grep schema=ripwire.grep/v1: literal/regex scan grouped by file: <f p=>
 <hit l= in=>CDATA text</hit> (<b>/<a> context around it); complete=1 only for an exhaustive literal scan (beside pattern_meta=, of the literal reading only); <unindexed> = off-index. window: shown= capped= (capped=1 cut). hits_capped=1: hits= is a floor. root=: p= relative to it. parse_degraded=1: E … [line truncated: 1293 more bytes on this line]
-<grep pattern="DISCLOSE" schema="ripwire.grep/v1" root="." terms="DISCLOSE -test" scope="file" terms_suppressed="1014" files="6" hits="13" shown="13" capped="0" hits_capped="0" suppressed_comment="28" tier_parsed="22" tier_unclassified="0" corpus_oversize="15" corpus_pruned_dirs="6" unindexed_hits=" … [line truncated: 100 more bytes on this line]
+<grep pattern="DISCLOSE" schema="ripwire.grep/v1" root="." terms="DISCLOSE -test" scope="file" terms_suppressed="1014" files="6" hits="13" shown="13" capped="0" hits_capped="0" suppressed_comment="28" tier_parsed="22" tier_unclassified="0" corpus_oversize="15" corpus_pruned_dirs="5" unindexed_hits=" … [line truncated: 100 more bytes on this line]
 <f p="src/commentcoherence.h" parse_degraded="1">
 <hit l="216" in="rw::computeCommentCoherence">
 <![CDATA[                DISCLOSE( scan, CommentCoherenceScan::DisclosureWhy::UnreadableFile, "comment-coherence: an indexed file could not be read — its functions are absent from the report" );]]>
 </hit>
 </f>
 <f p="src/forctorhop.h">
-<hit l="164" in="rw::spliceCtorHop">
+<hit l="168" in="rw::spliceCtorHop">
 <![CDATA[        DISCLOSE( Diagnostics::answerUnchanged, "no row carries ctor_l=: the answer is the one without the constructor hop",]]>
 </hit>
 </f>
@@ -1373,7 +1373,7 @@ _Span tiers off: the exhaustive view — the comment and string hits the default
 $ ./build/ripwire . --grep=DISCLOSE --grep-in=any
 <!-- ripwire grep schema=ripwire.grep/v1: literal/regex scan grouped by file: <f p=>
 <hit l= in=>CDATA text</hit> (<b>/<a> context around it); complete=1 only for an exhaustive literal scan (beside pattern_meta=, of the literal reading only); <unindexed> = off-index. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). h … [line truncated: 1542 more bytes on this line]
-<grep pattern="DISCLOSE" schema="ripwire.grep/v1" root="." files="279" hits="1025" shown="100" capped="1" total="1025" has_more="1" next_offset="100" offset="0" limit="0" hits_capped="0" corpus_oversize="15" corpus_pruned_dirs="6" unindexed_hits="8" unindexed_files_scanned="268" unindexed_files_skip … [line truncated: 61 more bytes on this line]
+<grep pattern="DISCLOSE" schema="ripwire.grep/v1" root="." files="279" hits="1025" shown="100" capped="1" total="1025" has_more="1" next_offset="100" offset="0" limit="0" hits_capped="0" corpus_oversize="15" corpus_pruned_dirs="5" unindexed_hits="8" unindexed_files_scanned="268" unindexed_files_skip … [line truncated: 61 more bytes on this line]
 <f p=".coderabbit.yaml">
 <hit l="33" in="path_instructions" occ="2">
 <![CDATA[        A degrade path uses DISCLOSE( sink, why ), never ASSUME(false): a one-argument DISCLOSE( msg ) is a debug trace]]>
@@ -1492,14 +1492,14 @@ $ ./build/ripwire . --query="teleport pagerank" --top-k=5
 <!-- routed: subtoken+body:broad -->
 <!-- ripwire query schema=ripwire.query/v1: lexical-rank map for the query term, the map's row vocabulary. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. amb=K: K calls split over several defs. -->
 <!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
-<!-- files=3618 symbols=31790 edges=29969 shown=5 est_tokens=1286 ambiguous=2927 unresolved=15221 locality_pinned=9 external=8647 declined=30140 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
+<!-- files=3631 symbols=31860 edges=30033 shown=5 est_tokens=1286 ambiguous=2933 unresolved=15249 locality_pinned=9 external=8658 declined=30154 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
 <r schema="ripwire.query/v1" root="." est_tokens="1286">
 <f p="src/serialize.h">
-<s t="var" n="kChurnRankLegend" sc="rw" k="19.1843">
+<s t="var" n="kChurnRankLegend" sc="rw" k="19.1868">
 </s>
 </f>
 <f p="src/mcpverbs.h">
-<s t="fn" n="rankByText" sc="rw" k="15.2901">
+<s t="fn" n="rankByText" sc="rw" k="15.2893">
 <c n="takeRank"/>
 <c n="rankGraph"/>
 <c n="hits"/>
@@ -1524,7 +1524,7 @@ _Importance-weighted detail: FULL bodies for top-2, signatures for the rest._
 
 ```
 $ ./build/ripwire . --for="pagerank power iteration" --detail=2
-<ctx task="pagerank power iteration" route="subtoken+body" root="." confidence="high" margin_pct="22" at="d3605fde7" doc_mentions="5" schema="ripwire.for/v1" budget_bytes="7500" doc_mentions_capped="1" doc_mentions_total="16" est_tokens="8148">
+<ctx task="pagerank power iteration" route="subtoken+body" root="." confidence="high" margin_pct="22" at="0712a5182" doc_mentions="5" schema="ripwire.for/v1" budget_bytes="7500" doc_mentions_capped="1" doc_mentions_total="16" est_tokens="8148">
 <!-- ripwire for schema=ripwire.for/v1: bundle=/bodies=/reason= the body posture; d: cx= ccx= complexity, in= callers (absent cx/ccx/in = 0), churn= amp= change, clone= tested= 1, sc= scope, id=p::sc::n; total= shown= capped=1 if cut; task= the query; d pure=1 const/constexpr sig, next= the follow-up to paste; route= name-exact(X)|subtoken+body[:broad|:declined]; confidence=/margin_pct= head score drop (low=flat); t p= file outside sigs (weaker), t sym= its top symbols (a pointer, not the answer), r= rank (gap = trimmed); field name= type= owner= rel=: a member of owner=, rel=creates held by value, uses by reference/pointer; d layer=: built-in arch layer (game|infra|render|math|audio|ai|test) from a dir name in p=; d e= its last line (absent=unknown, never 0; l= the name's line) [doc mentions: 5 docs, 3 symbols; doc_mentions=] -->
 <!-- root= is the crawl root; p= below is RELATIVE to it (single-root only; absent => p= is ingest's own path, unchanged); at=this commit(+dirty). [budget_bytes= is the default BYTE target this ranked payload was shaped toward: row text shortens toward it, no row of the ranked head is removed for it (sigs past_target=)] [sigs capped=1 with shown=total: rows shrunk, none dropped] [sigs past_target=K: the last K rows are past the budget_bytes target, served because they are rows of the ranked head; none is cut] [sigs next=: one call serving all total= rows uncut] [docs_dropped=N: N shown rows have a doc comment not printed (r>24 always, r5..24 if capped)] [docs_after_code=N: N doc rows of the shown set moved below its code rows; same rows, reordered, none added or removed; a question naming docs keeps score order] [files_first=N: N rows moved so r=1..8 are distinct files' best rows, score order, a repeated name once; same rows; fold, hops keep score order] [cut: doc_mentions_capped="1" doc_mentions_total="16" — an indexing cap dropped content not shown here]; lego/compose collapse to a counted stub by default (a disclosed cut): total= that section's own pre-cap row count, shown="0" capped="1" (nothing rendered here), next= names the sections=lego,compose flag that restores both sections byte-identically in one call est_tokens= prices this bundle in tokens -->
 <sigs shown="40" total="40" capped="1" past_target="14" docs_dropped="23" docs_after_code="6" files_first="6" next="--for=&apos;pagerank power iteration&apos; --signatures-only --token-budget=6200">
@@ -1559,7 +1559,7 @@ $ ./build/ripwire . --pack-signatures --top-k=10
 <!-- ripwire pack-signatures schema=ripwire.pack-signatures/v1: the ranked map plus <sigs>
 <d l= n= sc= pure=> signature rows. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. pr_iters=N: PageRank iterations. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven  … [line truncated: 1465 more bytes on this line]
 <!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
-<!-- files=3618 symbols=31790 edges=29969 shown=10 est_tokens=5989 ambiguous=2927 unresolved=15221 locality_pinned=9 external=8647 declined=30140 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
+<!-- files=3631 symbols=31860 edges=30033 shown=10 est_tokens=5989 ambiguous=2933 unresolved=15249 locality_pinned=9 external=8658 declined=30154 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
 <r root="." est_tokens="6813" pr_iters="36">
 <f p="src/infra/nodekind.h" layer="infra">
 <s t="fn" n="kindIs" sc="rw" k="0.0037">
@@ -1590,7 +1590,7 @@ $ ./build/ripwire . --outline=rankGraphTeleport --top-k=0
 <d l= n= sc= pure=> signature rows. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. -->
 <ctx schema="ripwire.pack-signatures/v1" root="." est_tokens="327">
 <outline>
-<o t="fn" l="11750" p="src/graph.h" n="rankGraphTeleport">
+<o t="fn" l="11809" p="src/graph.h" n="rankGraphTeleport">
 <![CDATA[inline RankedGraph rankGraphTeleport( const Graph& g, const std::vector<float>& p, float alpha = 0.85f )
 {
     PROFILE_SCOPE_DESCRIBE( "rankGraph: PageRank (power iteration)" );
@@ -1621,7 +1621,7 @@ $ ./build/ripwire . --top-k=0 --expand=rankGraphTeleport
 <!-- ripwire expand schema=ripwire.expand/v1: full bodies: <bodies shown= total= capped=> of <b t= l= p= n= sibs= sibs_total= sibs_capped= inc=>; <calls>
 <c n= l=> resolved callees. window: shown= total= capped= (capped=1 cut). sibs_capped=/inc_capped=: 1 = cut. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. scrubbed=1: this CDATA is not the bytes (]]> split or C0 replaced). redacted=1: a credential shape rewr … [line truncated: 336 more bytes on this line]
 <bodies shown="1" total="1" capped="0">
-<b t="fn" l="11750" p="src/graph.h" n="rankGraphTeleport" sibs="&lt;file-scope&gt;,DeclinedSiteKind,kNoDeclinedList,Graph,ImplementorRow,implementorClosure,LegoClosure,LegoClosureWalk,LegoClosureWalk,take,boundOf,add,expand,legoImplementorClosure,kEdgeName,kEdgeLink,kEdgeKindMask,edgeKindByte,edgeNa … [line truncated: 1753 more bytes on this line]
+<b t="fn" l="11809" p="src/graph.h" n="rankGraphTeleport" sibs="&lt;file-scope&gt;,DeclinedSiteKind,kNoDeclinedList,Graph,ImplementorRow,implementorClosure,LegoClosure,LegoClosureWalk,LegoClosureWalk,take,boundOf,add,expand,legoImplementorClosure,kEdgeName,kEdgeLink,kEdgeKindMask,edgeKindByte,edgeNa … [line truncated: 1753 more bytes on this line]
 <![CDATA[inline RankedGraph rankGraphTeleport( const Graph& g, const std::vector<float>& p, float alpha = 0.85f )
 {
     PROFILE_SCOPE_DESCRIBE( "rankGraph: PageRank (power iteration)" );
@@ -1690,7 +1690,7 @@ $ ./build/ripwire . --pack-top-n=3 --top-k=0
 <ctx schema="ripwire.pack-top-n/v1" root="." est_tokens="17427">
 <!-- ripwire pack-top-n schema=ripwire.pack-top-n/v1: the ranked map plus <src p=> bodies of the top-N symbols. window: shown= total= capped= (capped=1 cut). est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. <src truncated=1 lines=1-K/T>: cut at a line end at the byte budget; K of its T lines. <src_cut shown= total= capped=1 budget_bytes=>: files served of the top-N asked, the rest over the byte ceiling; unreadable=N not readable. -->
 <src_cut shown="1" total="3" capped="1" budget_bytes="65536"/>
-<src p="./src/graph.h" truncated="1" lines="1-1047/16217">
+<src p="./src/graph.h" truncated="1" lines="1-1047/16280">
 <![CDATA[#pragma once
 
 // graph.h — resolve references → graph, build the in-edge CSR for PageRank, and the
@@ -1722,14 +1722,14 @@ _--no-redact: emit bodies verbatim (credential redaction is on by default)._
 
 ```
 $ ./build/ripwire . --expand=readAckRecords --top-k=0 --no-redact
-<ctx schema="ripwire.expand/v1" root="." est_tokens="3136">
+<ctx schema="ripwire.expand/v1" root="." est_tokens="3160">
 <!-- ripwire expand schema=ripwire.expand/v1: full bodies: <bodies shown= total= capped=> of <b t= l= p= n= sibs= sibs_total= sibs_capped= inc=>; <calls>
 <c n= l=> resolved callees. window: shown= total= capped= (capped=1 cut). sibs_capped=/inc_capped=: 1 = cut. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. <c via="name">: that callee matched by name alone (receiver unproven); it does NOT mean the edge is fal … [line truncated: 443 more bytes on this line]
 <bodies shown="3" total="3" capped="0">
-<b t="fn" l="7475" p="src/quality.h" n="readAckRecords" sibs="&lt;file-scope&gt;,kBaselineFile,kMinCloneTokens,kCcxBar,kLocBar,kNestBar,kParamBar,kShortHorizonDays,kShortHorizonMinCommits,kReusedHelperMinFanin,kMinorCcxDelta,kMinorLocDelta,kMinorParamDelta,kMaterialGrowthPct,kSubBarGrowthPct,subBarG … [line truncated: 1831 more bytes on this line]
+<b t="fn" l="7588" p="src/quality.h" n="readAckRecords" sibs="&lt;file-scope&gt;,kBaselineFile,kMinCloneTokens,kCcxBar,kLocBar,kNestBar,kParamBar,kShortHorizonDays,kShortHorizonMinCommits,kReusedHelperMinFanin,kMinorCcxDelta,kMinorLocDelta,kMinorParamDelta,kMaterialGrowthPct,kSubBarGrowthPct,subBarG … [line truncated: 1861 more bytes on this line]
 <![CDATA[inline gtl::btree_map<std::string, AckRecord> readAckRecords( const std::string& path, std::size_t& badLines );]]>
 </b>
-<b t="fn" l="7477" p="src/quality.h" n="readAckRecords" sibs="&lt;file-scope&gt;,kBaselineFile,kMinCloneTokens,kCcxBar,kLocBar,kNestBar,kParamBar,kShortHorizonDays,kShortHorizonMinCommits,kReusedHelperMinFanin,kMinorCcxDelta,kMinorLocDelta,kMinorParamDelta,kMaterialGrowthPct,kSubBarGrowthPct,subBarG … [line truncated: 1831 more bytes on this line]
+<b t="fn" l="7590" p="src/quality.h" n="readAckRecords" sibs="&lt;file-scope&gt;,kBaselineFile,kMinCloneTokens,kCcxBar,kLocBar,kNestBar,kParamBar,kShortHorizonDays,kShortHorizonMinCommits,kReusedHelperMinFanin,kMinorCcxDelta,kMinorLocDelta,kMinorParamDelta,kMaterialGrowthPct,kSubBarGrowthPct,subBarG … [line truncated: 1861 more bytes on this line]
 <![CDATA[inline gtl::btree_map<std::string, AckRecord> readAckRecords( const std::string& path )
 {
     std::size_t ignored = 0;
@@ -1758,10 +1758,10 @@ $ ./build/ripwire . --metrics --top-k=10
 <!-- ripwire metrics schema=ripwire.metrics/v1: the ranked map with per-symbol metrics. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. pr_iters=N: PageRank iterations. <inv listed= unlisted=>: files the ranked rows show / do not (sum = files=), each named or counted below. <entry p= n=>: a program entry by its language's convention (C/Go/Rust main, Java/C# static main, a script main its module scope calls, __main__.py), callees as c rows; manifest entries not read. <ls p= n= f=>: n= unshown files under dir p=; f= names its code files, the rest (tests, docs, config, test/doc/example dirs) counted. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. <s tested=1>: a non-test row an indexed test transitively reaches (absent otherwise, never 0). <c via="name">: that callee matched by name alone (receiver unproven); it does NOT mean the edge is false. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. amb=K: K calls split over several defs. locals_floor=1: locals= is a floor. role=hub: in= is 8 or more. s in= out= cx= ccx= loc= params= nest= cbo= lcom4= amp=: callers, callees, cyclomatic/cognitive complexity, lines, parameters, nesting depth, coupled types, class cohesion, callers + co-changed files. ev=/ev_why=: essential complexity (2+: jumps block extract-method; absent: 1) / the jumps behind it, tag:count. ev_floor=1: ev= is a FLOOR; noreturn calls, macro-hidden exits and unresolved gotos are unseen. layer=: built-in arch layer (game|infra|render|math|audio|ai|test) from a dir name in p=; absent if none. l=N: start line; only on a same-name overload's row, one row per body (bodyless decls fold into overloads=). -->
 <!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
 <!-- stem="1": a class/struct/interface of that file whose name shares the most subtokens with the file name, added after the file's top-K rows because the rank cut left it out (no kept row dropped; counted in shown=) -->
-<!-- files=3618 symbols=31790 edges=29969 shown=12 est_tokens=4590 ambiguous=2927 unresolved=15221 locality_pinned=9 external=8647 declined=30140 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
+<!-- files=3631 symbols=31860 edges=30033 shown=12 est_tokens=4590 ambiguous=2933 unresolved=15249 locality_pinned=9 external=8658 declined=30154 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
 <r schema="ripwire.metrics/v1" root="." est_tokens="4590" pr_iters="36">
 <f p="src/infra/nodekind.h" layer="infra">
-<s t="fn" n="kindIs" sc="rw" in="336" out="0" cx="3" ccx="3" role="hub" loc="11" params="2" nest="2" locals="0" locals_floor="1" cbo="0" amp="349" tested="1" k="0.0037" ev="3" ev_floor="1" ev_why="guard-return:1">
+<s t="fn" n="kindIs" sc="rw" in="337" out="0" cx="3" ccx="3" role="hub" loc="11" params="2" nest="2" locals="0" locals_floor="1" cbo="0" amp="350" tested="1" k="0.0037" ev="3" ev_floor="1" ev_why="guard-return:1">
 </s>
 </f>
 <f p="src/infra/Diagnostics.h" layer="infra">
@@ -1794,7 +1794,7 @@ _File->file dependency graph (god-files, cycles)._
 $ ./build/ripwire . --deps
 <!-- ripwire deps schema=ripwire.deps/v1: file-to-file include/import view, heaviest cone first: <f p= afferent= includes= instab= transitive=>, <health>, <godfiles>, <cycles>. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). root=: p= relative to it. files=N: files with at least one include/import directive; this listing's denominator (health files= = corpus). violations=N: edges into a file more unstable by over 0.05 (Martin I); only the worst 12 are listed. from=: the including file of a stable-deps violation; it depends on the more unstable to=. gap=: instab of to= minus instab of from=, project includes only; worst first. godfiles f layer=: built-in arch layer (game|infra|render|math|audio|ai|test) from a dir name in p=; absent if none. layer=test only for a file under a test directory whose dependents are all test paths, by path. health dep_files=N: dependency-capable files (dep_langs=), the ccd/acd/nccd denominator. health dep_langs=: the languages dep_files= counts; compare its numbers across builds only when equal. ccd=/acd=/nccd=: Lakos: sum of per-file transitive cones (self incl) / per file / over a balanced tree's. health shape=: the nccd= verdict: horizontal below 1, vertical 1 to 2, tangled above 2 (a heuristic). health lazy_edges=N: in-closure (lazy) include pairs kept OUT of cones, cycles and ccd; absent at 0. cycle size=/cost=: files in that include cycle / size squared, the cycle's share of ccd=. cycle cut=/cutrefs=: SUGGESTED edge to break it (fewest directives) / that edge's directive count; nothing cut. -->
 <deps schema="ripwire.deps/v1" files="1361" shown="40" capped="1" total="1361" has_more="1" next_offset="40" offset="0" limit="0" root=".">
-<health files="3618" dep_files="3121" ccd="12735" acd="4.1" nccd="0.38" shape="horizontal" lazy_edges="82" dep_langs="cpp,py,ts,go,rs,swift,objc,js,sh,java,rb,cs,c,php,lua,ex,kt"/>
+<health files="3631" dep_files="3132" ccd="12746" acd="4.1" nccd="0.38" shape="horizontal" lazy_edges="82" dep_langs="cpp,py,ts,go,rs,swift,objc,js,sh,java,rb,cs,c,php,lua,ex,kt"/>
 <godfiles total="639" shown="12" capped="1">
 <f p="test/lib/clean-env.sh" afferent="204" layer="test"/>
 <f p="src/model.h" afferent="105"/>
@@ -1804,8 +1804,8 @@ $ ./build/ripwire . --deps
 <f p="src/serialize.h" afferent="45"/>
 <f p="src/infra/os.h" afferent="36" layer="infra"/>
 <f p="test/falseedgefix/jsrebind/src/eng.js" afferent="32" layer="test"/>
+<f p="src/infra/sortutil.h" afferent="28" layer="infra"/>
 <f p="scripts/cxxstd.sh" afferent="27"/>
-<f p="src/infra/sortutil.h" afferent="27" layer="infra"/>
 ... [17 more line(s); run it to see the whole thing]
 ```
 
@@ -1830,16 +1830,16 @@ _Complexity x recent git churn (maintenance pain)._
 $ ./build/ripwire . --hotspots
 <!-- ripwire hotspots schema=ripwire.hotspots/v1: maintenance pain = churn x ccx over window=: <f p= churn= ccx= score= top= top_ccx= top_l=>; unranked_*= no churn/complexity. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). at=: commit+dirty+shallow. root=: p= relative to it. files=/ranked=: files in the window / those with both churn and complexity; ranked + unranked_no_churn + unranked_no_complexity = files. unranked_no_churn=/unranked_no_complexity=: files left out for no commit in window= / no measured complexity. -->
 <!-- extent_suspect_syms=K on a row = K of the file's functions failed an extent/scope containment check (the map, the bundles and the skipped verb mark each one, reasons and all) and are LEFT OUT of that row's ccx=, score= and top=, so its ccx= is a FLOOR of the file's true sum rather than a total. unranked_extent_suspect= counts files with commits whose every scorable function was left out that way (or whose trusted remainder scores 0), so ranked= + unranked_no_churn= + unranked_no_complexity= + unranked_extent_suspect= = files= exactly. Absent = nothing excluded. -->
-<hotspots schema="ripwire.hotspots/v1" window="12mo@HEAD" files="3618" ranked="826" unranked_no_churn="0" unranked_no_complexity="2790" unranked_extent_suspect="2" shown="40" capped="1" total="826" has_more="1" next_offset="40" offset="0" limit="0" root="." at="d3605fde7">
-<f p="src/graph.h" churn="468" ccx="5031" score="2354508" top="buildGraph" top_ccx="1748" top_l="8216"/>
+<hotspots schema="ripwire.hotspots/v1" window="12mo@HEAD" files="3631" ranked="826" unranked_no_churn="0" unranked_no_complexity="2803" unranked_extent_suspect="2" shown="40" capped="1" total="826" has_more="1" next_offset="40" offset="0" limit="0" root="." at="0712a5182">
+<f p="src/graph.h" churn="473" ccx="5049" score="2388177" top="buildGraph" top_ccx="1758" top_l="8255"/>
 <f p="src/serialize.h" churn="413" ccx="2575" score="1063475" top="serialize" top_ccx="295" top_l="3037"/>
-<f p="src/quality.h" churn="476" ccx="1936" score="921536" top="computeDelta" top_ccx="310" top_l="9053"/>
+<f p="src/quality.h" churn="481" ccx="1961" score="943241" top="computeDelta" top_ccx="310" top_l="9166"/>
 <f p="src/mcpverbs.h" churn="466" ccx="1254" score="584364" top="runBatchSub" top_ccx="138" top_l="5869"/>
 <f p="src/main.cpp" churn="453" ccx="1247" score="564891" top="dispatchMain" top_ccx="482" top_l="4307"/>
 <f p="src/cli.h" churn="511" ccx="667" score="340837" top="parseArgs" top_ccx="213" top_l="5379"/>
 <f p="src/ingest_binds.h" churn="120" ccx="2315" score="277800" top="captureJsEvidence" top_ccx="98" top_l="6714"/>
 <f p="src/resolve.h" churn="143" ccx="1863" score="266409" top="buildPreciseIncludeAdjWithContext" top_ccx="84" top_l="4319"/>
-<f p="src/verbs_for.h" churn="221" ccx="930" score="205530" top="runForLensPass" top_ccx="491" top_l="2640"/>
+<f p="src/verbs_for.h" churn="222" ccx="924" score="205128" top="runForLensPass" top_ccx="485" top_l="2640"/>
 <f p="src/verbs_navigate.h" churn="226" ccx="824" score="186224" top="runVerify" top_ccx="144" top_l="1948"/>
 <f p="src/mcp.h" churn="158" ccx="948" score="149784" top="dispatchMcpLine" top_ccx="757" top_l="1120"/>
 ... [17 more line(s); run it to see the whole thing]
@@ -1858,7 +1858,7 @@ _Token-normalized duplicate bodies._
 ```
 $ ./build/ripwire . --clones
 <!-- ripwire clones schema=ripwire.clones/v1: similar normalized-token bodies: <group type=2|3 gid= tokens= n= similarity=> of <f n= p=>; dup_loc=/dup_pct=. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). root=: p= relative to it. groups=/type3=: Type-2 and Type-3 group totals over all groups; total= is their sum. exempt_groups=N: groups whose members all sit on fixture/shell-runner paths quality-delta duplication ignores. idiom_groups=/demoted_groups=: groups of one recognized idiom / those quality-delta demotes to minor; floors. clone_groups=N: clusters after merging pairs (rows sharing gid=); a floor under type3_capped=1. total_loc=N: lines of every function body the detector considered; dup_pct= is dup_loc= over it. group exempt=fixture|shell-runner: every member is on such a path; quality-delta duplication ignores it. group idiom=: the recognized shape every member spells: threshold-ladder, switch-name-table, builder-chain. -->
-<clones schema="ripwire.clones/v1" groups="135" type3="619" exempt_groups="443" idiom_groups="20" demoted_groups="12" clone_groups="364" dup_loc="7676" total_loc="245201" dup_pct="3.1" shown="80" capped="1" total="754" has_more="1" next_offset="80" offset="0" limit="0" root=".">
+<clones schema="ripwire.clones/v1" groups="136" type3="620" exempt_groups="445" idiom_groups="20" demoted_groups="12" clone_groups="365" dup_loc="7679" total_loc="245474" dup_pct="3.1" shown="80" capped="1" total="756" has_more="1" next_offset="80" offset="0" limit="0" root=".">
 <group type="2" gid="49" tokens="338" n="3">
 <f n="rw_is_ripwire_call" p="hooks/ripwire-claude-route.sh:187"/>
 <f n="rw_is_ripwire_call" p="hooks/ripwire-codex-route.sh:104"/>
@@ -1868,7 +1868,7 @@ $ ./build/ripwire . --clones
 <f n="call_sites" p="test/declinecheck.sh:116"/>
 <f n="call_sites" p="test/usesselectorcheck.sh:49"/>
 </group>
-<group type="2" gid="304" tokens="211" n="4" exempt="shell-runner">
+<group type="2" gid="305" tokens="211" n="4" exempt="shell-runner">
 <f n="batch_sub" p="test/mcpclidiffcheck.sh:64"/>
 <f n="batch_sub" p="test/mcptranchecheck.sh:55"/>
 ... [17 more line(s); run it to see the whole thing]
@@ -1889,10 +1889,10 @@ _Per-function size ranking, largest Halstead volume/token entropy/lines first 
 ```
 $ ./build/ripwire . --biggest-first --limit=8
 <!-- ripwire readability schema=ripwire.readability/v1: Posnett/Hindle/Devanbu lens, largest Halstead volume first (a size proxy): <fn p= n= lines= toks= ops= vocab= vol= ent= posnett=>. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). root=: p= relative to it. functions=N: functions and methods measured (bodyless declarations are not). -->
-<readability schema="ripwire.readability/v1" functions="17795" shown="8" capped="1" total="17795" has_more="1" next_offset="8" offset="0" limit="8" root=".">
-<fn p="src/graph.h:8216" n="buildGraph" lines="3485" toks="21485" ops="13827" vocab="1071" vol="216241.0" ent="6.74" posnett="0.000"/>
+<readability schema="ripwire.readability/v1" functions="17849" shown="8" capped="1" total="17849" has_more="1" next_offset="8" offset="0" limit="8" root=".">
+<fn p="src/graph.h:8255" n="buildGraph" lines="3505" toks="21619" ops="13920" vocab="1077" vol="217763.9" ent="6.74" posnett="0.000"/>
 <fn p="src/mcp.h:1120" n="dispatchMcpLine" lines="1773" toks="9055" ops="5750" vocab="794" vol="87226.8" ent="6.54" posnett="0.000"/>
-<fn p="src/verbs_for.h:2640" n="runForLensPass" lines="1610" toks="8648" ops="5262" vocab="709" vol="81893.5" ent="6.59" posnett="0.000"/>
+<fn p="src/verbs_for.h:2640" n="runForLensPass" lines="1610" toks="8627" ops="5255" vocab="710" vol="81712.1" ent="6.58" posnett="0.000"/>
 <fn p="test/forbodyslotfix/src/c/render.c:7" n="render_screen" lines="176" toks="9485" ops="6322" vocab="181" vol="71136.0" ent="4.54" posnett="0.000"/>
 <fn p="src/main.cpp:4307" n="dispatchMain" lines="1515" toks="7344" ops="4717" vocab="655" vol="68705.7" ent="6.36" posnett="0.000"/>
 <fn p="src/main.cpp:1751" n="runDefaultMap" lines="1187" toks="6548" ops="4027" vocab="526" vol="59186.8" ent="6.46" posnett="0.000"/>
@@ -1922,7 +1922,7 @@ _Per function, the non-local MUTABLE state it can reach (transitively), most wri
 ```
 $ ./build/ripwire . --nonlocal-state --limit=8
 <!-- ripwire nonlocal-state schema=ripwire.nonlocal-state/v1: per function, the non-local MUTABLE state it reaches: <fn p= n= writes= reads=> over <cell n= p= dir= via=> rows. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). cells_capped=: 1 = cut. counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. root=: p= relative to it. cells=N: mutable non-local cells found in the corpus (globals, statics, Python module globals; FLOOR). functions=N: functions reaching at least one cell, directly or via callees (all rows, before paging). direct_writes=/direct_reads=: the writes=/reads= cells this function's OWN body writes/reads. cells_total=N: distinct cells reached (read and written counts once); at most 12 cell rows print. at=/at_dir=: one own-body use site (may be more) and what own-body sites do (can be narrower than dir=). cells_shown=/cells_capped=1: only this many of cells_total= cell rows print (cap 12). unanalyzed_langs=/unanalyzed_files=: indexed languages (and their files) this lens skips; NOT zero cells. -->
-<nonlocal_state schema="ripwire.nonlocal-state/v1" cells="976" functions="858" shown="8" capped="1" total="858" has_more="1" next_offset="8" offset="0" limit="8" graph_ambiguous="2927" graph_unresolved="15221" graph_unindexed="269" counts_floor="1" unanalyzed_langs="c,go,rust,javascript,typescript,j … [line truncated: 105 more bytes on this line]
+<nonlocal_state schema="ripwire.nonlocal-state/v1" cells="976" functions="858" shown="8" capped="1" total="858" has_more="1" next_offset="8" offset="0" limit="8" graph_ambiguous="2933" graph_unresolved="15249" graph_unindexed="269" counts_floor="1" unanalyzed_langs="c,go,rust,javascript,typescript,j … [line truncated: 105 more bytes on this line]
 <fn p="bench/bench_svector_wave.cpp:346" n="main" writes="8" reads="14" direct_writes="0" direct_reads="4" cells_total="14" cells_shown="12" cells_capped="1">
 <cell n="kNames" p="bench/bench_svector_wave.cpp:98" dir="rw" at="bench/bench_svector_wave.cpp:358" at_dir="r"/>
 <cell n="kPush" p="bench/bench_svector_wave.cpp:99" dir="rw" at="bench/bench_svector_wave.cpp:358" at_dir="r"/>
@@ -1957,7 +1957,7 @@ _The family join: per function, which of four orthogonal evidence families fire,
 ```
 $ ./build/ripwire . --ensemble --limit=8
 <!-- ripwire ensemble schema=ripwire.ensemble/v1: four orthogonal evidence families joined, ranked by DISTINCT families fired (no composite score): <s p= n= fam= of= fired=>. window: total= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). syms_capped=/files_capped=: 1 = cut. at=: commit+dirty+shallow. root=: p= relative to it. eligible=N: functions and methods with a body, the denominator; ranked + no_family = eligible. no_family=N: eligible symbols where no family fired. bar_ccx=/bar_loc=/bar_nest=/bar_params=: absolute structural bars: cognitive cx, lines, nesting, params. rcut=N: ranks the worst readability decile covers (1 to 40); rrank= inside it fires structural. rmeasured=N: functions the readability lens measured. hcut=N: file ranks the worst churn decile covers (1 to 40); hrank= inside it fires historical. hranked=N: files with any in-window commit; 0 = historical family unavailable. cfiles=N: indexed files the confusion (atom) pack can read: C/C++/ObjC/CUDA. cscope=N: eligible symbols in those files; 0 = confusion family unavailable. lscope=N: eligible symbols in a language the naming pack reads; 0 = lexical family unavailable. shown_syms=N: symbol rows printed; the rest page with offset=next_offset. shown_files=N: file rows printed (fixed cap 20, not paged); files_capped=1 = rows dropped. e f=: the fired family: structural, lexical, confusion or historical. why=: the measurements that crossed, space separated; rule*N = that rule fired N times. top=: the file's most corroborated symbol (most families on one symbol). top_l=: that symbol's line. top_fam=N: families fired on top=, the stronger claim; file rows rank by it. union_fam=N: distinct families firing anywhere in the file (weaker: may be different symbols). union=: the names of those families. syms=N: symbols in the file where at least one family fired. families=N: evidence families joined; ranked=N: symbols at least one fired on; window=: the git span the historical family read. -->
-<ensemble schema="ripwire.ensemble/v1" families="4" eligible="17795" ranked="6921" no_family="10874" bar_ccx="15" bar_loc="60" bar_nest="4" bar_params="5" rcut="40" rmeasured="17795" hcut="40" hranked="3618" window="12mo" cfiles="810" cscope="9392" lscope="17795" shown_syms="8" syms_capped="1" shown … [line truncated: 116 more bytes on this line]
+<ensemble schema="ripwire.ensemble/v1" families="4" eligible="17849" ranked="6945" no_family="10904" bar_ccx="15" bar_loc="60" bar_nest="4" bar_params="5" rcut="40" rmeasured="17849" hcut="40" hranked="3631" window="12mo" cfiles="810" cscope="9399" lscope="17849" shown_syms="8" syms_capped="1" shown … [line truncated: 116 more bytes on this line]
 <s p="src/gitmine.h:1230" n="addRootFilesToGitPathIndex" fam="4" of="4" fired="structural,lexical,confusion,historical">
 <e f="structural" why="ccx=25 ev=6"/>
 <e f="lexical" why="naming-wordy"/>
@@ -1988,17 +1988,17 @@ _THE single wide-angle quality read: six families in one pass, an eligible/ranke
 ```
 $ ./build/ripwire . --quality-panel
 <!-- ripwire quality-panel schema=ripwire.quality-panel/v1: every quality family in ONE report, ranked by distinct families fired: <s p= n= fam= of= fired= join=>; bar_*= thresholds. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). at=: commit+dirty+shallow. root=: p= relative to it. preset=: strict (5 stable families, cut 2), default (6, cut 2), lenient (6, cut 1); selects, never weights. families=6: evidence families: structural lexical confusion historical colocation state. enabled=/enabled_n=: the families this preset COUNTS, and how many. cut=N: distinct enabled families that must fire for a row to rank. cut_reachable=0: cut= exceeds the evaluable families (of=); a corpus fact, never a clean bill of health. eligible=N: functions/methods with a body; ranked= + below_cut= + no_family= = eligible=, always. ranked=N: rows that met the cut (total=); only shown= print, page with offset=. below_cut=N: fired at least one enabled family, but fewer than cut=. no_family=N: no enabled family fired; unavailable= families were never measured. bar_ccx=/bar_loc=/bar_nest=/bar_params=: absolute bars: cognitive complexity, lines, nesting, params. rcut=/rmeasured=: readability decile width (rrank= under it fires) / functions measured. hcut=/hranked=: file churn decile width / files with an in-window commit (hranked=0 voids historical). window=: the git churn window hrank= and churn= are counted over (RELATIVE to this corpus). ccut=/cranked=: colocation decile width / functions reading any outside definition (0 voids it). cfiles=/cscope=: files the confusion atom rules read / eligible symbols in them. lscope=N: symbols the lexical naming rules read. sfiles=/sscope=: files the state lens reads / symbols in them. cells=N: non-local mutable cells the state lens found. tested_scope=N: symbols an indexed test reaches; at 0 no row can carry join=deep+untested. deep_untested=N: rows carrying join=deep+untested across the WHOLE set, not just this page. e f=: the fired family this evidence row belongs to. counted=1: this preset counts the family toward fam=; 0 = fired, not counted. why=: the measurements that crossed (rule*N fired N times; hrank=/churn= are the file's, inherited). -->
-<quality_panel schema="ripwire.quality-panel/v1" preset="default" families="6" enabled="structural,lexical,confusion,historical,colocation,state" enabled_n="6" cut="2" cut_reachable="1" eligible="17795" ranked="1030" below_cut="6237" no_family="10528" bar_ccx="15" bar_loc="60" bar_nest="4" bar_param … [line truncated: 331 more bytes on this line]
+<quality_panel schema="ripwire.quality-panel/v1" preset="default" families="6" enabled="structural,lexical,confusion,historical,colocation,state" enabled_n="6" cut="2" cut_reachable="1" eligible="17849" ranked="1030" below_cut="6261" no_family="10558" bar_ccx="15" bar_loc="60" bar_nest="4" bar_param … [line truncated: 331 more bytes on this line]
 <s p="src/gitmine.h:1230" n="addRootFilesToGitPathIndex" fam="4" of="6" fired="structural,lexical,confusion,historical">
 <e f="structural" counted="1" why="ccx=25 ev=6"/>
 <e f="lexical" counted="1" why="naming-wordy"/>
 <e f="confusion" counted="1" why="atom-embedded-crement*2"/>
 <e f="historical" counted="1" why="hrank=37 churn=75"/>
 </s>
-<s p="src/graph.h:8216" n="buildGraph" fam="4" of="6" fired="structural,confusion,historical,colocation">
-<e f="structural" counted="1" why="ccx=1748 loc=3485 nest=8 humps=89 deep=562 ev=220 rrank=0"/>
+<s p="src/graph.h:8255" n="buildGraph" fam="4" of="6" fired="structural,confusion,historical,colocation">
+<e f="structural" counted="1" why="ccx=1758 loc=3505 nest=8 humps=90 deep=563 ev=221 rrank=0"/>
 <e f="confusion" counted="1" why="atom-embedded-crement*5 atom-nested-ternary*2"/>
-<e f="historical" counted="1" why="hrank=7 churn=468"/>
+<e f="historical" counted="1" why="hrank=7 churn=473"/>
 <e f="colocation" counted="1" why="crank=16"/>
 </s>
 ... [17 more line(s); run it to see the whole thing]
@@ -2025,13 +2025,13 @@ _The local-reasoning lens: to understand this symbol, how much must you know tha
 ```
 $ ./build/ripwire . --context-ratio --limit=8
 <!-- ripwire context-ratio schema=ripwire.context-ratio/v1: LOCAL-REASONING lens: the share of a unit's context outside its file: <s p= n= sites= ents_out= ent_ratio= read_ratio=>. window: total= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). syms_capped=/files_capped=/defs_capped=: 1 = cut. counts_floor=1: every count is a FLOOR, never a total. root=: p= relative to it. units=N: symbols measured (the s row population). file_units=N: files measured (the f row population). defs_per_name_cap=N: most defs one name adds (lowest ids); defs_capped=1 = cut, ents=/rtok= floors. body_bytes_per_token=: the bytes-per-token rate rtok= is estimated at. shown_syms=N: symbol rows printed; the rest page with offset=next_offset. shown_files=N: file rows printed (fixed cap 40, not paged); files_capped=1 = rows dropped. ents=N: distinct in-corpus defs its reference sites resolve to, by name (a FLOOR). files=N: distinct files holding those defs (a FLOOR). files_out=N: of files=, those other than the unit's own file. rtok=N: est. tokens of every resolved def, what a reader must read. rtok_out=N: the part of rtok= defined outside the unit's own file. ext=N: referenced names with no in-corpus def; mostly locals/params, NOT external deps; in neither ratio. amb_names=N: referenced names with 2+ defs, each counted (per name; not the map's per-call amb=). ents=N: distinct in-corpus defs the file's sites resolve to (a FLOOR; a union, not the sum of s rows). files=N: distinct files holding those defs (a FLOOR). files_out=N: of files=, those other than this file. rtok=N: est. tokens of every resolved def, what a reader must read. rtok_out=N: the part of rtok= defined outside this file. ext=N: referenced names with no in-corpus def; mostly locals/params, NOT external deps; in neither ratio. amb_names=N: referenced names with 2+ defs, each counted (per name; not the map's per-call amb=). -->
-<contextratio schema="ripwire.context-ratio/v1" units="26289" file_units="3066" defs_per_name_cap="8" body_bytes_per_token="3.80" shown_syms="8" syms_capped="1" shown_files="40" files_capped="1" total="26289" has_more="1" next_offset="8" offset="0" limit="8" defs_capped="1" counts_floor="1" root="." … [line truncated: 1 more bytes on this line]
-<s p="src/main.cpp:4307" n="dispatchMain" t="fn" sites="1153" ents="219" ents_out="196" ent_ratio="0.895" files="68" files_out="67" rtok="268194" rtok_out="231729" read_ratio="0.864" ext="130" amb_names="25"/>
+<contextratio schema="ripwire.context-ratio/v1" units="26355" file_units="3077" defs_per_name_cap="8" body_bytes_per_token="3.80" shown_syms="8" syms_capped="1" shown_files="40" files_capped="1" total="26355" has_more="1" next_offset="8" offset="0" limit="8" defs_capped="1" counts_floor="1" root="." … [line truncated: 1 more bytes on this line]
+<s p="src/main.cpp:4307" n="dispatchMain" t="fn" sites="1153" ents="219" ents_out="196" ent_ratio="0.895" files="68" files_out="67" rtok="268518" rtok_out="232053" read_ratio="0.864" ext="130" amb_names="25"/>
 <s p="src/mcp.h:1120" n="dispatchMcpLine" t="fn" sites="1349" ents="221" ents_out="195" ent_ratio="0.882" files="46" files_out="45" rtok="88323" rtok_out="83216" read_ratio="0.942" ext="171" amb_names="18"/>
-<s p="src/mcpverbs.h:4480" n="computeQualityDelta" t="fn" sites="66" ents="42" ents_out="38" ent_ratio="0.905" files="15" files_out="14" rtok="82792" rtok_out="81921" read_ratio="0.989" ext="7" amb_names="8"/>
+<s p="src/mcpverbs.h:4480" n="computeQualityDelta" t="fn" sites="66" ents="42" ents_out="38" ent_ratio="0.905" files="15" files_out="14" rtok="83116" rtok_out="82245" read_ratio="0.990" ext="7" amb_names="8"/>
 <s p="src/main.cpp:1751" n="runDefaultMap" t="fn" sites="1142" ents="143" ents_out="131" ent_ratio="0.916" files="41" files_out="40" rtok="86586" rtok_out="81887" read_ratio="0.946" ext="149" amb_names="17"/>
-<s p="src/mcpverbs.h:4968" n="editCheckText" t="fn" sites="43" ents="40" ents_out="40" ent_ratio="1.000" files="23" files_out="23" rtok="73924" rtok_out="73924" read_ratio="1.000" ext="5" amb_names="7"/>
-<s p="src/editpreview.h:338" n="run" t="fn" sites="132" ents="62" ents_out="58" ent_ratio="0.935" files="30" files_out="29" rtok="71357" rtok_out="69154" read_ratio="0.969" ext="33" amb_names="8"/>
+<s p="src/mcpverbs.h:4968" n="editCheckText" t="fn" sites="43" ents="40" ents_out="40" ent_ratio="1.000" files="23" files_out="23" rtok="74248" rtok_out="74248" read_ratio="1.000" ext="5" amb_names="7"/>
+<s p="src/editpreview.h:338" n="run" t="fn" sites="132" ents="62" ents_out="58" ent_ratio="0.935" files="30" files_out="29" rtok="71681" rtok_out="69478" read_ratio="0.969" ext="33" amb_names="8"/>
 ... [23 more line(s); run it to see the whole thing]
 ```
 
@@ -2056,8 +2056,8 @@ _Score the naming-* rules against this repo's own rename history: proxy=old/(old
 ```
 $ ./build/ripwire . --naming-calibration
 <!-- ripwire naming-calibration schema=ripwire.naming-calibration/v1: naming lint rules scored against this repo's OWN rename history (a noisy proxy): <r n= old= new= fired= proxy=>. at=: commit+dirty+shallow. probed=0: no history to mine, nothing scored (r= says why); 1 = the git walk ran. pairs=N: labelled rename pairs that survived the join, the SAMPLE SIZE; a small one means nothing. candidates=N: raw substitutions mined from the patch stream before the join; FLOOR when truncated=1. commits=N: non-merge commits walked (the walk stops at 40000). hunks=N: diff hunks with content on both sides. wide_hunks=N: hunks DROPPED for exceeding the 24-line per-side pairing cap; never mined. drop_old_alive=N: candidates dropped: the old spelling is still an indexed name. drop_new_absent=N: candidates dropped: the new spelling is no eligible indexed symbol at HEAD. drop_ambiguous=N: candidates dropped: a name on both sides of several (split, rework, revert). drop_old_skipped=N: candidates dropped: the lens skips the old spelling, no rule could fire. scope=group-rule: the rule judges co-visible names, which one pair cannot evidence; unscored, not 0/0. o=/n=: one labelled pair's old (abandoned) and new (chosen) spelling. sup=N: distinct hunks that showed this substitution. p at=: path:line of the symbol the pair joined to, not a commit (the root at= is). old_fires=: rules that fired on the old spelling; absent when none. new_fires=: rules that fired on the new spelling; absent when none. -->
-<naming-calibration schema="ripwire.naming-calibration/v1" probed="1" pairs="173" candidates="2296" commits="4834" hunks="99787" wide_hunks="1085" drop_old_alive="554" drop_new_absent="1450" drop_ambiguous="119" drop_old_skipped="0" at="d3605fde7">
-<r n="naming-short" old="2" new="2" fired="4" proxy="0.500"/>
+<naming-calibration schema="ripwire.naming-calibration/v1" probed="1" pairs="175" candidates="2326" commits="4861" hunks="101538" wide_hunks="1085" drop_old_alive="557" drop_new_absent="1475" drop_ambiguous="119" drop_old_skipped="0" at="0712a5182">
+<r n="naming-short" old="2" new="3" fired="5" proxy="0.400"/>
 <r n="naming-wordy" old="1" new="3" fired="4" proxy="0.250"/>
 <r n="naming-series" scope="group-rule"/>
 <r n="naming-underscore" old="0" new="0" fired="0"/>
@@ -2091,10 +2091,10 @@ _The corpus's OWN case-convention vote per (language, kind) group; off-conventio
 ```
 $ ./build/ripwire . --naming-consistency --limit=8
 <!-- ripwire naming-consistency schema=ripwire.naming-consistency/v1: the corpus's case-convention vote per (language, kind): <g lang= kind= style= agree= total=>, <f p= n= propose=> outliers. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). root=: p= relative to it. component_exempt=N: PascalCase .tsx/.jsx functions (read as JSX components by extension alone), kept out of voting and flagging. groups=N: (language, kind) groups with at least one styled name. candidates=N: multi-token styled names scanned. decided=N: groups whose leading style cleared both the sample and agreement floors. flagged=N: off-convention names in decided groups (the f rows). g why=insufficient-sample|no-clear-convention: which bar a style=UNAVAILABLE group missed. -->
-<naming-consistency schema="ripwire.naming-consistency/v1" groups="32" candidates="13645" decided="11" flagged="552" component_exempt="8" shown="8" capped="1" total="552" has_more="1" next_offset="8" offset="0" limit="8" root=".">
-<g lang="cpp" kind="fn" style="camel" agree="7056" total="7484"/>
-<g lang="cpp" kind="var" style="camel" agree="1552" total="1564"/>
-<g lang="py" kind="fn" style="snake" agree="1159" total="1188"/>
+<naming-consistency schema="ripwire.naming-consistency/v1" groups="32" candidates="13669" decided="11" flagged="552" component_exempt="8" shown="8" capped="1" total="552" has_more="1" next_offset="8" offset="0" limit="8" root=".">
+<g lang="cpp" kind="fn" style="camel" agree="7063" total="7491"/>
+<g lang="cpp" kind="var" style="camel" agree="1556" total="1568"/>
+<g lang="py" kind="fn" style="snake" agree="1161" total="1190"/>
 <g lang="py" kind="var" style="UNAVAILABLE" why="no-clear-convention" total="495"/>
 <g lang="ts" kind="fn" style="camel" agree="170" total="181"/>
 <g lang="ts" kind="var" style="UNAVAILABLE" why="insufficient-sample" total="5"/>
@@ -2128,7 +2128,7 @@ _The opt-in --lint modifier: naming predicates over LOCAL variable names too, C/
 ```
 $ ./build/ripwire . --lint --naming-locals
 <!-- ripwire lint schema=ripwire.lint/v1: AST-only checks, facts not gates: <rule name= count= shown_rows= rows_capped= count_capped=> of <f rule= p= in=>. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). findings_capped=/rows_capped=/count_capped=: 1 = cut. counts_floor=1: every count is a FLOOR, never a total. root=: p= relative to it. findings=N: findings over the printed rules; a floor when findings_capped=1. findings_next=: the call counting the floored rules' rest (count_capped=1 rules only, 10x per-rule budget). -->
-<lint schema="ripwire.lint/v1" findings="8215" shown="629" capped="1" total="8215" has_more="1" next_offset="629" offset="0" limit="0" counts_floor="1" findings_capped="1" findings_next="--lint --naming-locals --lint-select=magic-number --lint-max-per-rule=50000" naming_locals="1" root=".">
+<lint schema="ripwire.lint/v1" findings="8234" shown="629" capped="1" total="8234" has_more="1" next_offset="629" offset="0" limit="0" counts_floor="1" findings_capped="1" findings_next="--lint --naming-locals --lint-select=magic-number --lint-max-per-rule=50000" naming_locals="1" root=".">
 <rule name="c-style-cast" count="627" shown_rows="51" rows_capped="1"/>
 <rule name="goto" count="18" shown_rows="1" rows_capped="1"/>
 <rule name="do-while" count="17" shown_rows="0" rows_capped="1"/>
@@ -2163,7 +2163,7 @@ _Functions WITH a doc comment, most name-restating first: c_coeff (high = the co
 ```
 $ ./build/ripwire . --comment-coherence --limit=8
 <!-- ripwire comment-coherence schema=ripwire.comment-coherence/v1: two comment/name content measures per documented function, most name-restating first: <fn p= n= c_coeff= cic=>. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). root=: p= relative to it. documented=N: functions with a doc comment, measured (the rows); a FLOOR when unreadable_files= shows. no_comment=N: eligible symbols with no measurable comment; UNAVAILABLE, never scored as zero. words=/restate=: comment word count (c_coeff= denominator, stopwords kept) / words matching a name word. c_terms=/i_terms=/shared=: comment term set / identifiers the body uses / overlap; cic= shared over union. -->
-<comment_coherence schema="ripwire.comment-coherence/v1" documented="5067" no_comment="12728" shown="8" capped="1" total="5067" has_more="1" next_offset="8" offset="0" limit="8" root=".">
+<comment_coherence schema="ripwire.comment-coherence/v1" documented="5072" no_comment="12777" shown="8" capped="1" total="5072" has_more="1" next_offset="8" offset="0" limit="8" root=".">
 <fn p="src/infra/os.h:446" n="socket" c_coeff="1.000" words="1" restate="1" cic="0.000" c_terms="1" i_terms="5" shared="0"/>
 <fn p="src/lsp.h:496" n="lspLocationJson" c_coeff="1.000" words="1" restate="1" cic="0.000" c_terms="1" i_terms="26" shared="0"/>
 <fn p="src/query.h:267" n="sourceAll" c_coeff="1.000" words="1" restate="1" cic="0.000" c_terms="1" i_terms="12" shared="0"/>
@@ -2196,16 +2196,16 @@ _Files that change together in git (hidden coupling)._
 ```
 $ ./build/ripwire . --cochange
 <!-- ripwire cochange schema=ripwire.cochange/v1: files that change together in git: <pair a= b= together= deg= conf_ab= conf_ba= surprising=>, or for of= <f p= together= conf_rev=>. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). at=: commit+dirty+shallow. root=: p= relative to it. pairs=N: file pairs with 3+ shared commits in window= (after min_recur), surprising or not. sub_windows=N: equal-commit-count slices of window=; the denominator of recur=. driver=a|b: the side whose changes best imply the other's, look there first; absent on a tie. recur=K: slices of sub_windows= the pair co-changed in; 1 = one burst, not a standing coupling. -->
-<cochange schema="ripwire.cochange/v1" pairs="4430" window="18mo@HEAD" sub_windows="3" shown="30" capped="1" total="4430" has_more="1" next_offset="30" offset="0" limit="0" root="." at="d3605fde7">
-<pair a="test/situhunkcheck.sh" b="test/testgatehunkcheck.sh" together="4" deg="1.00" conf_ab="0.57" conf_ba="1.00" driver="b" recur="1" surprising="1"/>
+<cochange schema="ripwire.cochange/v1" pairs="4441" window="18mo@HEAD" sub_windows="3" shown="30" capped="1" total="4441" has_more="1" next_offset="30" offset="0" limit="0" root="." at="0712a5182">
 <pair a="src/layout.h" b="test/layoutfix/attrfields.h" together="4" deg="1.00" conf_ab="0.18" conf_ba="1.00" driver="b" recur="1" surprising="1"/>
 <pair a="test/headsnapcachecheck.sh" b="test/qsnapcachecheck.sh" together="4" deg="1.00" conf_ab="1.00" conf_ba="1.00" recur="2" surprising="1"/>
 <pair a="test/headsnapcachecheck.sh" b="test/qsnapprefetchcheck.sh" together="4" deg="1.00" conf_ab="1.00" conf_ba="0.67" driver="a" recur="2" surprising="1"/>
+<pair a="test/situhunkcheck.sh" b="test/testgatehunkcheck.sh" together="4" deg="1.00" conf_ab="0.57" conf_ba="1.00" driver="b" recur="1" surprising="1"/>
 <pair a="test/qsnapcachecheck.sh" b="test/qsnapprefetchcheck.sh" together="4" deg="1.00" conf_ab="1.00" conf_ba="0.67" driver="a" recur="2" surprising="1"/>
-<pair a="src/fieldaffinity.h" b="test/accessshapefix/walks.cpp" together="3" deg="1.00" conf_ab="0.38" conf_ba="1.00" driver="b" recur="1" surprising="1"/>
-<pair a="test/qschemetripcheck.sh" b="test/rubyrequirecheck.sh" together="3" deg="1.00" conf_ab="0.01" conf_ba="1.00" driver="b" recur="1" surprising="1"/>
-<pair a="test/cachesplitcheck.sh" b="test/evictioncheck.sh" together="3" deg="1.00" conf_ab="1.00" conf_ba="0.23" driver="a" recur="2" surprising="1"/>
-<pair a="test/mcpslicecheck.sh" b="test/mcpverbscheck.sh" together="3" deg="1.00" conf_ab="1.00" conf_ba="0.16" driver="a" recur="2" surprising="1"/>
+<pair a="test/grepcontextcheck.sh" b="test/grepscancheck.sh" together="3" deg="1.00" conf_ab="1.00" conf_ba="1.00" recur="1" surprising="1"/>
+<pair a="test/elixircheck.sh" b="test/elixirsemanticcheck.sh" together="3" deg="1.00" conf_ab="0.14" conf_ba="1.00" driver="b" recur="2" surprising="1"/>
+<pair a="test/javamethodreffix/A.java" b="test/javamethodreffix/Widget.java" together="3" deg="1.00" conf_ab="0.75" conf_ba="1.00" driver="b" recur="1" surprising="1"/>
+<pair a="src/binstale.h" b="src/crossref.h" together="3" deg="1.00" conf_ab="1.00" conf_ba="0.04" driver="a" recur="3" surprising="1"/>
 ... [22 more line(s); run it to see the whole thing]
 ```
 
@@ -2228,16 +2228,16 @@ _Only pairs whose co-change RECURS in 2+ sub-windows of the mined window (sub_wi
 ```
 $ ./build/ripwire . --cochange --cochange-recur=2
 <!-- ripwire cochange schema=ripwire.cochange/v1: files that change together in git: <pair a= b= together= deg= conf_ab= conf_ba= surprising=>, or for of= <f p= together= conf_rev=>. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). at=: commit+dirty+shallow. root=: p= relative to it. pairs=N: file pairs with 3+ shared commits in window= (after min_recur), surprising or not. sub_windows=N: equal-commit-count slices of window=; the denominator of recur=. driver=a|b: the side whose changes best imply the other's, look there first; absent on a tie. recur=K: slices of sub_windows= the pair co-changed in; 1 = one burst, not a standing coupling. -->
-<cochange schema="ripwire.cochange/v1" pairs="3085" window="18mo@HEAD" sub_windows="3" min_recur="2" shown="30" capped="1" total="3085" has_more="1" next_offset="30" offset="0" limit="0" root="." at="d3605fde7">
+<cochange schema="ripwire.cochange/v1" pairs="3088" window="18mo@HEAD" sub_windows="3" min_recur="2" shown="30" capped="1" total="3088" has_more="1" next_offset="30" offset="0" limit="0" root="." at="0712a5182">
+<pair a="test/headsnapcachecheck.sh" b="test/qsnapcachecheck.sh" together="4" deg="1.00" conf_ab="1.00" conf_ba="1.00" recur="2" surprising="1"/>
 <pair a="test/qsnapcachecheck.sh" b="test/qsnapprefetchcheck.sh" together="4" deg="1.00" conf_ab="1.00" conf_ba="0.67" driver="a" recur="2" surprising="1"/>
 <pair a="test/headsnapcachecheck.sh" b="test/qsnapprefetchcheck.sh" together="4" deg="1.00" conf_ab="1.00" conf_ba="0.67" driver="a" recur="2" surprising="1"/>
-<pair a="test/headsnapcachecheck.sh" b="test/qsnapcachecheck.sh" together="4" deg="1.00" conf_ab="1.00" conf_ba="1.00" recur="2" surprising="1"/>
-<pair a="test/elixircheck.sh" b="test/elixirsemanticcheck.sh" together="3" deg="1.00" conf_ab="0.14" conf_ba="1.00" driver="b" recur="2" surprising="1"/>
-<pair a="test/luacheck.sh" b="test/phpcheck.sh" together="3" deg="1.00" conf_ab="0.75" conf_ba="1.00" driver="b" recur="2" surprising="1"/>
 <pair a="test/cachesplitcheck.sh" b="test/evictioncheck.sh" together="3" deg="1.00" conf_ab="1.00" conf_ba="0.23" driver="a" recur="2" surprising="1"/>
 <pair a="test/mcpslicecheck.sh" b="test/mcpverbscheck.sh" together="3" deg="1.00" conf_ab="1.00" conf_ba="0.16" driver="a" recur="2" surprising="1"/>
-<pair a="src/binstale.h" b="src/crossref.h" together="3" deg="1.00" conf_ab="1.00" conf_ba="0.04" driver="a" recur="3" surprising="1"/>
 <pair a="test/pincensuscheck.sh" b="test/scipjoincheck.sh" together="3" deg="1.00" conf_ab="0.38" conf_ba="1.00" driver="b" recur="3" surprising="1"/>
+<pair a="src/binstale.h" b="src/crossref.h" together="3" deg="1.00" conf_ab="1.00" conf_ba="0.04" driver="a" recur="3" surprising="1"/>
+<pair a="test/elixircheck.sh" b="test/elixirsemanticcheck.sh" together="3" deg="1.00" conf_ab="0.14" conf_ba="1.00" driver="b" recur="2" surprising="1"/>
+<pair a="test/luacheck.sh" b="test/phpcheck.sh" together="3" deg="1.00" conf_ab="0.75" conf_ba="1.00" driver="b" recur="2" surprising="1"/>
 ... [22 more line(s); run it to see the whole thing]
 ```
 
@@ -2254,7 +2254,7 @@ _Modularity-violation GROUPS instead of pairs: "X co-changes with {A,B,C}, none
 ```
 $ ./build/ripwire . --cochange --cochange-groups
 <!-- ripwire cochange schema=ripwire.cochange/v1: files that change together in git: <pair a= b= together= deg= conf_ab= conf_ba= surprising=>, or for of= <f p= together= conf_rev=>. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). at=: commit+dirty+shallow. root=: p= relative to it. sub_windows=N: equal-commit-count slices of window=; the denominator of recur=. recur=K: slices of sub_windows= the pair co-changed in; 1 = one burst, not a standing coupling. -->
-<cochange schema="ripwire.cochange/v1" groups="130" pairs_covered="1065" cover="greedy" window="18mo@HEAD" sub_windows="3" shown="30" capped="1" total="130" has_more="1" next_offset="30" offset="0" limit="0" root="." at="d3605fde7">
+<cochange schema="ripwire.cochange/v1" groups="130" pairs_covered="1067" cover="greedy" window="18mo@HEAD" sub_windows="3" shown="30" capped="1" total="130" has_more="1" next_offset="30" offset="0" limit="0" root="." at="0712a5182">
 <group core="src/cli.h" partners="79">
 <f p="src/abicheck.h" together="3" recur="2" conf_core="0.01"/>
 <f p="src/arch.h" together="5" recur="2" conf_core="0.01"/>
@@ -2283,18 +2283,18 @@ _Hotspots scoped to RECENT churn (the regression lens)._
 ```
 $ ./build/ripwire . --hotspots --since="2 weeks ago"
 <!-- ripwire hotspots schema=ripwire.hotspots/v1: maintenance pain = churn x ccx over window=: <f p= churn= ccx= score= top= top_ccx= top_l=>; unranked_*= no churn/complexity. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). at=: commit+dirty+shallow. root=: p= relative to it. files=/ranked=: files in the window / those with both churn and complexity; ranked + unranked_no_churn + unranked_no_complexity = files. unranked_no_churn=/unranked_no_complexity=: files left out for no commit in window= / no measured complexity. -->
-<hotspots schema="ripwire.hotspots/v1" window="2 weeks ago" files="3618" ranked="235" unranked_no_churn="2624" unranked_no_complexity="759" shown="40" capped="1" total="235" has_more="1" next_offset="40" offset="0" limit="0" root="." at="d3605fde7">
-<f p="src/graph.h" churn="140" ccx="5031" score="704340" top="buildGraph" top_ccx="1748" top_l="8216"/>
+<hotspots schema="ripwire.hotspots/v1" window="2 weeks ago" files="3631" ranked="236" unranked_no_churn="2622" unranked_no_complexity="773" shown="40" capped="1" total="236" has_more="1" next_offset="40" offset="0" limit="0" root="." at="0712a5182">
+<f p="src/graph.h" churn="145" ccx="5049" score="732105" top="buildGraph" top_ccx="1758" top_l="8255"/>
 <f p="src/serialize.h" churn="71" ccx="2575" score="182825" top="serialize" top_ccx="295" top_l="3037"/>
-<f p="src/quality.h" churn="61" ccx="1936" score="118096" top="computeDelta" top_ccx="310" top_l="9053"/>
+<f p="src/quality.h" churn="65" ccx="1961" score="127465" top="computeDelta" top_ccx="310" top_l="9166"/>
 <f p="src/ingest_binds.h" churn="49" ccx="2315" score="113435" top="captureJsEvidence" top_ccx="98" top_l="6714"/>
 <f p="src/mcpverbs.h" churn="85" ccx="1254" score="106590" top="runBatchSub" top_ccx="138" top_l="5869"/>
 <f p="src/verbs_navigate.h" churn="72" ccx="824" score="59328" top="runVerify" top_ccx="144" top_l="1948"/>
 <f p="src/receiverevidence.h" churn="53" ccx="1046" score="55438" top="bareClassAt" top_ccx="77" top_l="736"/>
-<f p="src/verbs_for.h" churn="54" ccx="930" score="50220" top="runForLensPass" top_ccx="491" top_l="2640"/>
+<f p="src/verbs_for.h" churn="55" ccx="924" score="50820" top="runForLensPass" top_ccx="485" top_l="2640"/>
 <f p="src/compactlegend.h" churn="74" ccx="325" score="24050" top="applyCompactDialectOnce" top_ccx="49" top_l="2299"/>
 <f p="src/ingest_valuerefs.h" churn="22" ccx="937" score="20614" top="classify" top_ccx="100" top_l="1778"/>
-<f p="src/ingest_sidecap.h" churn="22" ccx="926" score="20372" top="captureTagsFacts" top_ccx="486" top_l="1838"/>
+<f p="src/ingest_sidecap.h" churn="21" ccx="930" score="19530" top="captureTagsFacts" top_ccx="490" top_l="1838"/>
 <f p="src/resolve.h" churn="10" ccx="1863" score="18630" top="buildPreciseIncludeAdjWithContext" top_ccx="84" top_l="4319"/>
 ... [17 more line(s); run it to see the whole thing]
 ```
@@ -2321,7 +2321,7 @@ _Enforce layering rules (exit 2 on violation) — run against the repo's own tes
 $ ./build/ripwire . --arch=test/archfix/rules.txt
 <!-- ripwire arch schema=ripwire.arch/v1: layering rules fit: allowed/denied file-to-file edges, each violation a row. -->
 <arch schema="ripwire.arch/v1" layers="2" rules="1" pathRules="0" violations="0" baselined="0" new_violations="0">
-<metrics modules="1066" typed_modules="514" zone_pain="414" zone_useless="1" zone_ok="99" zone_na="552" propagation_cost="0.001" note="Martin Ca/Ce/I/A/D + zone (main-sequence heuristic, no independent outcome-based validation — folklore, not proof) + reachability — directory-level estimate from … [line truncated: 411 more bytes on this line]
+<metrics modules="1072" typed_modules="520" zone_pain="420" zone_useless="1" zone_ok="99" zone_na="552" propagation_cost="0.001" note="Martin Ca/Ce/I/A/D + zone (main-sequence heuristic, no independent outcome-based validation — folklore, not proof) + reachability — directory-level estimate from … [line truncated: 411 more bytes on this line]
 <m path="." ca="0" ce="0" types="0" abstract="0" I="0.00" A="0.00" D="1.00" zone="n/a" reachable="1" isolated="1"/>
 <m path="./.codex-plugin" ca="0" ce="0" types="0" abstract="0" I="0.00" A="0.00" D="1.00" zone="n/a" reachable="1" isolated="1"/>
 <m path="./.github" ca="0" ce="0" types="0" abstract="0" I="0.00" A="0.00" D="1.00" zone="n/a" reachable="1" isolated="1"/>
@@ -2351,7 +2351,7 @@ _Enforce layering rules (exit 2 on violation) — run against the repo's own tes
 $ ./build/ripwire . --arch=test/archfix/rules.txt
 <!-- ripwire arch schema=ripwire.arch/v1: layering rules fit: allowed/denied file-to-file edges, each violation a row. -->
 <arch schema="ripwire.arch/v1" layers="2" rules="1" pathRules="0" violations="0" baselined="0" new_violations="0">
-<metrics modules="1066" typed_modules="514" zone_pain="414" zone_useless="1" zone_ok="99" zone_na="552" propagation_cost="0.001" note="Martin Ca/Ce/I/A/D + zone (main-sequence heuristic, no independent outcome-based validation — folklore, not proof) + reachability — directory-level estimate from … [line truncated: 411 more bytes on this line]
+<metrics modules="1072" typed_modules="520" zone_pain="420" zone_useless="1" zone_ok="99" zone_na="552" propagation_cost="0.001" note="Martin Ca/Ce/I/A/D + zone (main-sequence heuristic, no independent outcome-based validation — folklore, not proof) + reachability — directory-level estimate from … [line truncated: 411 more bytes on this line]
 <m path="." ca="0" ce="0" types="0" abstract="0" I="0.00" A="0.00" D="1.00" zone="n/a" reachable="1" isolated="1"/>
 <m path="./.codex-plugin" ca="0" ce="0" types="0" abstract="0" I="0.00" A="0.00" D="1.00" zone="n/a" reachable="1" isolated="1"/>
 <m path="./.github" ca="0" ce="0" types="0" abstract="0" I="0.00" A="0.00" D="1.00" zone="n/a" reachable="1" isolated="1"/>
@@ -2377,7 +2377,7 @@ _Enforce layering rules (exit 2 on violation) — run against the repo's own tes
 $ ./build/ripwire . --arch=test/archfix/rules.txt
 <!-- ripwire arch schema=ripwire.arch/v1: layering rules fit: allowed/denied file-to-file edges, each violation a row. -->
 <arch schema="ripwire.arch/v1" layers="2" rules="1" pathRules="0" violations="0" baselined="0" new_violations="0">
-<metrics modules="1066" typed_modules="514" zone_pain="414" zone_useless="1" zone_ok="99" zone_na="552" propagation_cost="0.001" note="Martin Ca/Ce/I/A/D + zone (main-sequence heuristic, no independent outcome-based validation — folklore, not proof) + reachability — directory-level estimate from … [line truncated: 411 more bytes on this line]
+<metrics modules="1072" typed_modules="520" zone_pain="420" zone_useless="1" zone_ok="99" zone_na="552" propagation_cost="0.001" note="Martin Ca/Ce/I/A/D + zone (main-sequence heuristic, no independent outcome-based validation — folklore, not proof) + reachability — directory-level estimate from … [line truncated: 411 more bytes on this line]
 <m path="." ca="0" ce="0" types="0" abstract="0" I="0.00" A="0.00" D="1.00" zone="n/a" reachable="1" isolated="1"/>
 <m path="./.codex-plugin" ca="0" ce="0" types="0" abstract="0" I="0.00" A="0.00" D="1.00" zone="n/a" reachable="1" isolated="1"/>
 <m path="./.github" ca="0" ce="0" types="0" abstract="0" I="0.00" A="0.00" D="1.00" zone="n/a" reachable="1" isolated="1"/>
@@ -2404,7 +2404,7 @@ _Built-in AST checks (c-cast, goto, unsafe-c-fn, ...)._
 ```
 $ ./build/ripwire . --lint
 <!-- ripwire lint schema=ripwire.lint/v1: AST-only checks, facts not gates: <rule name= count= shown_rows= rows_capped= count_capped=> of <f rule= p= in=>. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). findings_capped=/rows_capped=/count_capped=: 1 = cut. counts_floor=1: every count is a FLOOR, never a total. root=: p= relative to it. findings=N: findings over the printed rules; a floor when findings_capped=1. findings_next=: the call counting the floored rules' rest (count_capped=1 rules only, 10x per-rule budget). -->
-<lint schema="ripwire.lint/v1" findings="6733" shown="673" capped="1" total="6733" has_more="1" next_offset="673" offset="0" limit="0" counts_floor="1" findings_capped="1" findings_next="--lint --lint-select=magic-number --lint-max-per-rule=50000" root=".">
+<lint schema="ripwire.lint/v1" findings="6753" shown="673" capped="1" total="6753" has_more="1" next_offset="673" offset="0" limit="0" counts_floor="1" findings_capped="1" findings_next="--lint --lint-select=magic-number --lint-max-per-rule=50000" root=".">
 <rule name="c-style-cast" count="627" shown_rows="73" rows_capped="1"/>
 <rule name="goto" count="18" shown_rows="1" rows_capped="1"/>
 <rule name="do-while" count="17" shown_rows="0" rows_capped="1"/>
@@ -2627,15 +2627,15 @@ _Cluster the call graph into cohesive modules._
 ```
 $ ./build/ripwire . --communities
 <!-- ripwire communities schema=ripwire.communities/v1: call-graph modules (Louvain): <community id= size= dir= label=> of <member t= n= p=>; drill= the verb taking a row's id=; shown_modules=/shown_bridges= <community>/<bridge> rows listed; bridges= community pairs joined by a call edge; isolated= symbols with no call edge: isolated_doc= doc sections, isolated_decl= other bodyless, isolated_header= other header defs, isolated_source= the rest; modules= modules of 2+ symbols; connected_singletons= 1-symbol modules with a call edge; symbols= indexed symbols. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). modules_capped=/bridges_capped=: 1 = cut. counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. root=: p= relative to it. pr_iters=N: PageRank iterations. <bridge a= b=>: two module ids joined by call edges. from_label=/to_label=: the label= of a=/b=. <bridge edges=>: call edges between the two, either direction. -->
-<communities schema="ripwire.communities/v1" drill="--community=ID" modules="3610" shown_modules="30" modules_capped="1" bridges="4544" shown_bridges="12" bridges_capped="1" isolated="14921" isolated_decl="3976" isolated_header="2448" isolated_source="3371" isolated_doc="5126" connected_singletons=" … [line truncated: 193 more bytes on this line]
-<community id="5100" size="1631" dir="src" label="src::emitTo@infra/emit.h:53:2760 [write,run,emit]" shown="5" capped="1">
+<communities schema="ripwire.communities/v1" drill="--community=ID" modules="3620" shown_modules="30" modules_capped="1" bridges="4547" shown_bridges="12" bridges_capped="1" isolated="14942" isolated_decl="3978" isolated_header="2450" isolated_source="3384" isolated_doc="5130" connected_singletons=" … [line truncated: 193 more bytes on this line]
+<community id="5106" size="1630" dir="src" label="src::emitTo@infra/emit.h:53:2760 [write,run,emit]" shown="5" capped="1">
 <member t="macro" n="ASSUME" p="src/infra/Diagnostics.h:386"/>
 <member t="macro" n="RW_ASSUME_" p="src/infra/Diagnostics.h:322"/>
 <member t="macro" n="EXPECTS" p="src/infra/Diagnostics.h:387"/>
 <member t="fn" n="formatTo" p="src/infra/emit.h:141"/>
-<member t="fn" n="relForHash" p="src/model.h:1998"/>
+<member t="fn" n="relForHash" p="src/model.h:2002"/>
 </community>
-<community id="5636" size="547" dir="src" label="src::kindIs@infra/nodekind.h:46:3271 [push,emit,collect]" shown="5" capped="1">
+<community id="5642" size="548" dir="src" label="src::kindIs@infra/nodekind.h:46:3271 [push,emit,collect]" shown="5" capped="1">
 <member t="fn" n="kindIs" p="src/infra/nodekind.h:46"/>
 <member t="fn" n="nodeTextOf" p="src/ingest_metrics.h:161"/>
 <member t="fn" n="fieldChild" p="src/infra/fieldid.h:223"/>
@@ -2658,7 +2658,7 @@ _Drill into ONE call-graph community by id — the drill= the --communities outp
 ```
 $ ./build/ripwire . --community=0
 <!-- ripwire community schema=ripwire.community/v1: ONE module id=: <member t= n= p=> ranked members, its <bridge> edges; size= the TRUE count; dir= its members' most common directory (a top-level file's own path); label= dir::name@file:line:byte of its top fan-in member (non-accessors first) [up to 3 top name verbs]; bridges= modules a call edge joins to it; partition= module count incl. singletons (ids 0..partition-1); modules= those of 2+ symbols; shown_bridges= <bridge> rows listed. window: shown= capped= (capped=1 cut). bridges_capped=: 1 = cut. counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. root=: p= relative to it. pr_iters=N: PageRank iterations. -->
-<community schema="ripwire.community/v1" id="0" size="1" dir=".coderabbit.yaml" label=".coderabbit.yaml::reviews@.coderabbit.yaml:12:928" bridges="0" shown_bridges="0" bridges_capped="0" partition="18531" modules="3610" shown="1" capped="0" pr_iters="36" root="." graph_ambiguous="2927" graph_unresol … [line truncated: 51 more bytes on this line]
+<community schema="ripwire.community/v1" id="0" size="1" dir=".coderabbit.yaml" label=".coderabbit.yaml::reviews@.coderabbit.yaml:12:928" bridges="0" shown_bridges="0" bridges_capped="0" partition="18562" modules="3620" shown="1" capped="0" pr_iters="36" root="." graph_ambiguous="2933" graph_unresol … [line truncated: 51 more bytes on this line]
 <member t="sec" n="reviews" p=".coderabbit.yaml:12"/>
 </community>
 ```
@@ -2683,15 +2683,15 @@ _Nested module hierarchy (multi-level Louvain) + cross-module bridges — levels
 ```
 $ ./build/ripwire . --zoom
 <!-- ripwire zoom schema=ripwire.zoom/v1: nested module hierarchy: <module level= id= size= dir= shown= capped=> of <member t= n= p=>; levels_shown= of levels= printed; symbols= = isolated= + size= of all top_modules=. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. pr_iters=N: PageRank iterations. children=K: K child modules below the levels_shown= cut, unprinted. next=: the one pasteable follow-up. -->
-<zoom schema="ripwire.zoom/v1" levels="5" levels_shown="2" top_modules="1407" symbols="31790" isolated="14921" shown="40" capped="1" total="1407" has_more="1" next_offset="40" offset="0" limit="0" pr_iters="36" graph_ambiguous="2927" graph_unresolved="15221" graph_unindexed="269" counts_floor="1" ne … [line truncated: 24 more bytes on this line]
-<module level="4" id="1652" size="7308" dir="./src">
-<module level="3" id="1652" size="7308" dir="./src" children="20">
+<zoom schema="ripwire.zoom/v1" levels="5" levels_shown="2" top_modules="1414" symbols="31860" isolated="14942" shown="40" capped="1" total="1414" has_more="1" next_offset="40" offset="0" limit="0" pr_iters="36" graph_ambiguous="2933" graph_unresolved="15249" graph_unindexed="269" counts_floor="1" ne … [line truncated: 24 more bytes on this line]
+<module level="4" id="1652" size="7315" dir="./src">
+<module level="3" id="1652" size="7315" dir="./src" children="20">
 </module>
 </module>
-<module level="4" id="8514" size="1237" dir="./test">
-<module level="3" id="8514" size="1072" dir="./test" children="3">
+<module level="4" id="8525" size="1237" dir="./test">
+<module level="3" id="8525" size="1072" dir="./test" children="3">
 </module>
-<module level="3" id="9251" size="165" dir="./test" children="2">
+<module level="3" id="9262" size="165" dir="./test" children="2">
 </module>
 </module>
 <module level="4" id="717" size="312" dir="./docs">
@@ -2720,15 +2720,15 @@ $ ./build/ripwire . --report
 
 # ripwire architecture report
 
-3618 files · 31790 symbols · 29969 edges · 3610 modules (14921 call-graph isolated)
+3631 files · 31860 symbols · 30033 edges · 3620 modules (14942 call-graph isolated)
 
 Root: `.`
 
-Call-graph isolate provenance: 3976 declaration, 2448 header, 3371 source, 5126 document; 0 connected Louvain singletons
+Call-graph isolate provenance: 3978 declaration, 2450 header, 3384 source, 5130 document; 0 connected Louvain singletons
 
-## Modules (call-graph clusters; showing 12 of 3610)
-- **src::emitTo@infra/emit.h:53:2760 [write,run,emit]** — 1631 symbols
-- **src::kindIs@infra/nodekind.h:46:3271 [push,emit,collect]** — 547 symbols
+## Modules (call-graph clusters; showing 12 of 3620)
+- **src::emitTo@infra/emit.h:53:2760 [write,run,emit]** — 1630 symbols
+- **src::kindIs@infra/nodekind.h:46:3271 [push,emit,collect]** — 548 symbols
 - **src::DISCLOSE@infra/Diagnostics.h:616:43369 [read,compute,resolve]** — 335 symbols
 ... [17 more line(s); run it to see the whole thing]
 ```
@@ -2746,7 +2746,7 @@ _Cross-module call seams no test reaches. NOW carries seam_pairs/shown/capped._
 ```
 $ ./build/ripwire . --seams
 <!-- ripwire seams schema=ripwire.seams/v1: cross-directory call edges NO test reaches: <seam from= to= untested= shown= capped=> of <edge caller= p= callee= cp=>. window: shown= capped= (capped=1 cut). counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. root=: p= relative to it. pr_iters=N: PageRank iterations. modules=N: directories holding indexed symbols (a module = parent dir). bridges=N: cross-directory call edges, tested or not; untested= is those no test reaches. test_files=N: test files whose calls seed the reach; 0 means every seam reads untested. seam_pairs=N: directed dir pairs with an untested edge (the seam rows' total). doc_links=N: cross-directory links between two document sections, not in bridges= or untested= (no test exercises a document link); absent at 0. <file-scope> (t=modscope): a file's MODULE SCOPE — where a top-level call and an anonymous callback body's calls live; a CALLER, never a callee, with no body to expand. -->
-<seams schema="ripwire.seams/v1" modules="1064" bridges="4116" untested="2206" doc_links="81" test_files="2917" seam_pairs="18" shown="18" capped="0" pr_iters="36" root="." graph_ambiguous="2927" graph_unresolved="15221" graph_unindexed="269" counts_floor="1">
+<seams schema="ripwire.seams/v1" modules="1070" bridges="4132" untested="2206" doc_links="81" test_files="2928" seam_pairs="18" shown="18" capped="0" pr_iters="36" root="." graph_ambiguous="2933" graph_unresolved="15249" graph_unindexed="269" counts_floor="1">
 <seam from="src" to="src/infra" untested="2095" shown="5" capped="1">
 <edge caller="boundedEditDistance" p="src/didyoumean.h:34" callee="swap" cp="src/infra/svector.h:439"/>
 <edge caller="jsonStr" p="src/serialize.h:10372" callee="escapeMcp" cp="src/infra/jsonesc.h:230"/>
@@ -2777,15 +2777,15 @@ $ ./build/ripwire . --mermaid
 %% ripwire --mermaid: module (directory) dependency graph — node = dir (symbol count), edge = inter-module calls (>= 3). Render at mermaid.live.
 flowchart LR
   subgraph sg0 ["src"]
-    n102["src<br/>9422"]
+    n102["src<br/>9435"]
     n103["src/infra<br/>1301"]
   end
   subgraph sg1 ["test"]
-    n104["test<br/>5517"]
-    n566["test/legochargefix<br/>546"]
-    n400["test/fixtures/recallpassage<br/>314"]
-    n956["test/slotjoinfix<br/>175"]
-    n798["test/ownerhopfix/py/pkg<br/>158"]
+    n104["test<br/>5523"]
+    n571["test/legochargefix<br/>546"]
+    n405["test/fixtures/recallpassage<br/>314"]
+    n962["test/slotjoinfix<br/>175"]
+    n804["test/ownerhopfix/py/pkg<br/>158"]
     n342["test/expandmodefix<br/>151"]
     n344["test/expandsibsfix<br/>149"]
 ... [17 more line(s); run it to see the whole thing]
@@ -2806,8 +2806,8 @@ _Bus-factor: recency-weighted author ownership per file._
 ```
 $ ./build/ripwire . --owners
 <!-- ripwire owners schema=ripwire.owners/v1: recency-weighted author ownership (half-life 6mo): <f p= authors= bf= top= share=>; bf=1 = one person holds it. at=: commit+dirty+shallow. root=: p= relative to it. files=N: files analysed. files=N: single-author files folded into this one row; detail=1 lists each. -->
-<owners schema="ripwire.owners/v1" files="3618" root="." at="d3605fde7">
-<uniform authors="1" bf="1" share="1.00" files="2621"/>
+<owners schema="ripwire.owners/v1" files="3631" root="." at="0712a5182">
+<uniform authors="1" bf="1" share="1.00" files="2631"/>
 <f p=".coderabbit.yaml" authors="2" bf="0" top="<author>" share="0.59"/>
 <f p=".github/pargates-shard-weights.json" authors="3" bf="0" top="<author>" share="0.46"/>
 <f p=".github/workflows/ci.yml" authors="6" bf="0" top="<author>" share="0.46"/>
@@ -2837,7 +2837,7 @@ _Internal functions with no caller found in the index — a name-based graph rea
 ```
 $ ./build/ripwire . --dead-code=src
 <!-- ripwire dead-code schema=ripwire.dead-code/v1: internal-linkage functions with no caller found in the index (not a confidence score): <d n= t= p= l=>; filter= path component. counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. value-ref-excluded=N: internal functions kept off because a table, field or argument in another function or at file scope holds them (matched by name, not a proven call); a floor. root=: p= relative to it. evidence=: the rule every row met, internal linkage and no caller in the index; verify before deleting. register-macro-excluded=N: symbols skipped as self-registering test/bench macros (TEST, BENCHMARK...); a floor. count=N: candidates meeting evidence= (a floor). -->
-<dead-code schema="ripwire.dead-code/v1" count="1" evidence="internal-linkage+zero-callers" register-macro-excluded="0" value-ref-excluded="6" filter="src" root="." graph_ambiguous="2927" graph_unresolved="15221" graph_unindexed="269" counts_floor="1">
+<dead-code schema="ripwire.dead-code/v1" count="1" evidence="internal-linkage+zero-callers" register-macro-excluded="0" value-ref-excluded="6" filter="src" root="." graph_ambiguous="2933" graph_unresolved="15249" graph_unindexed="269" counts_floor="1">
 <d n="unused_helper" t="fn" p="test/archmetricsfix/src/orphan/util.cpp" l="1"/>
 </dead-code>
 ```
@@ -2902,7 +2902,7 @@ _The same clean verdict with what it folded printed back: every stale acknowledg
 ```
 $ ./build/ripwire . --quality-delta --show-stale
 <!-- ripwire quality-delta schema=ripwire.quality-delta/v1: only what the change made WORSE vs baseline=: regressions= minor= gating=; <r kind= sym= p= was= now= gating= bar=>, <sa> acked. value-ref-excluded=N: internal functions kept off because a table, field or argument in another function or at file scope holds them (matched by name, not a proven call); a floor. at=: commit+dirty+shallow. stale=N: ack ledger rows whose target no longer applies (sa rows); never gating. preexisting-worse=N: regressions on symbols that existed at baseline; they gate when major. new-symbol=N: findings on NEW code; new-symbol rows never gate, except defect-shape format-arity. register-macro-excluded=N: symbols kept out of dead-code as self-registering test/bench macros; a floor. declined-call-excluded=N: symbols kept out of dead-code only because a declined call may mean them; a floor. api-new-surface=N: new PUBLIC symbols; a count, never gates, not in regressions=. renames=/rename_window_commits=: git rename pairs read over that many commits, to re-file baseline and acks. acked_by_rename=/acked_by_content=: acked= suppressions matched via git renames / an equal body hash. renames_window_truncated=1: history is deeper than the rename window, older renames unread. acked=N: findings suppressed by the ack ledger, listed as sa rows; never gating. sa key=/why=: the stale ack's ledger hash / target-gone (names nothing now) or finding-gone (no longer fires). head_basis=identity: the floor is this tree's own snapshot; archived-index-hidden: refused, a tracked path is skip-worktree/assume-unchanged; absent: the archived HEAD tree. -->
-<quality-delta schema="ripwire.quality-delta/v1" baseline="git-HEAD" regressions="0" minor="0" acked="0" stale="167" preexisting-worse="0" new-symbol="0" gating="0" register-macro-excluded="62" api-new-surface="0" at="d3605fde7" renames="62" rename_window_commits="400" acked_by_rename="0" acked_by_c … [line truncated: 114 more bytes on this line]
+<quality-delta schema="ripwire.quality-delta/v1" baseline="git-HEAD" regressions="0" minor="0" acked="0" stale="167" preexisting-worse="0" new-symbol="0" gating="0" register-macro-excluded="62" api-new-surface="0" at="0712a5182" renames="62" rename_window_commits="400" acked_by_rename="0" acked_by_c … [line truncated: 114 more bytes on this line]
 <sa kind="api-surface" key="085e3d408c2c4a35" why="target-gone"/>
 <sa kind="api-surface" key="155d74d341a49f3c" why="target-gone"/>
 <sa kind="api-surface" key="1a15386c2d1e47af" why="target-gone"/>
@@ -2931,7 +2931,7 @@ _On a CLEAN tree: nothing got worse, exit 0. The gating shape is in the sandbox
 ```
 $ ./build/ripwire . --quality-delta
 <!-- ripwire quality-delta schema=ripwire.quality-delta/v1: only what the change made WORSE vs baseline=: regressions= minor= gating=; <r kind= sym= p= was= now= gating= bar=>, <sa> acked. at=: commit+dirty+shallow. stale=N: ack ledger rows whose target no longer applies (sa rows); never gating. stale_by_kind=: stale= split by ack kind (kind:N,...); the sa rows are collapsed. stale_next=: the call printing the sa rows and the full header. head_basis=identity: the floor is this tree's own snapshot; archived-index-hidden: refused, a tracked path is skip-worktree/assume-unchanged; absent: the archived HEAD tree. -->
-<quality-delta schema="ripwire.quality-delta/v1" baseline="git-HEAD" regressions="0" gating="0" stale="167" at="d3605fde7" head_basis="identity" stale_by_kind="api-surface:23,complexity:8,dead-code:9,duplication:69,nesting:3,new-clone-of-reused-helper:23,params:1,short-horizon-churn:9,verbosity:22"  … [line truncated: 42 more bytes on this line]
+<quality-delta schema="ripwire.quality-delta/v1" baseline="git-HEAD" regressions="0" gating="0" stale="167" at="0712a5182" head_basis="identity" stale_by_kind="api-surface:23,complexity:8,dead-code:9,duplication:69,nesting:3,new-clone-of-reused-helper:23,params:1,short-horizon-churn:9,verbosity:22"  … [line truncated: 42 more bytes on this line]
 </quality-delta>
 ```
 
@@ -2956,7 +2956,7 @@ _On a CLEAN tree: nothing got worse, exit 0. The gating shape is in the sandbox
 ```
 $ ./build/ripwire . --quality-delta
 <!-- ripwire quality-delta schema=ripwire.quality-delta/v1: only what the change made WORSE vs baseline=: regressions= minor= gating=; <r kind= sym= p= was= now= gating= bar=>, <sa> acked. at=: commit+dirty+shallow. stale=N: ack ledger rows whose target no longer applies (sa rows); never gating. stale_by_kind=: stale= split by ack kind (kind:N,...); the sa rows are collapsed. stale_next=: the call printing the sa rows and the full header. head_basis=identity: the floor is this tree's own snapshot; archived-index-hidden: refused, a tracked path is skip-worktree/assume-unchanged; absent: the archived HEAD tree. -->
-<quality-delta schema="ripwire.quality-delta/v1" baseline="git-HEAD" regressions="0" gating="0" stale="167" at="d3605fde7" head_basis="identity" stale_by_kind="api-surface:23,complexity:8,dead-code:9,duplication:69,nesting:3,new-clone-of-reused-helper:23,params:1,short-horizon-churn:9,verbosity:22"  … [line truncated: 42 more bytes on this line]
+<quality-delta schema="ripwire.quality-delta/v1" baseline="git-HEAD" regressions="0" gating="0" stale="167" at="0712a5182" head_basis="identity" stale_by_kind="api-surface:23,complexity:8,dead-code:9,duplication:69,nesting:3,new-clone-of-reused-helper:23,params:1,short-horizon-churn:9,verbosity:22"  … [line truncated: 42 more bytes on this line]
 </quality-delta>
 ```
 
@@ -2981,7 +2981,7 @@ _A ref range run for two of the twelve kinds only: the named kinds' rows are exa
 ```
 $ ./build/ripwire . --quality-delta=HEAD~1..HEAD --quality-kinds=complexity,dead-code
 <!-- ripwire quality-delta schema=ripwire.quality-delta/v1: only what the change made WORSE vs baseline=: regressions= minor= gating=; <r kind= sym= p= was= now= gating= bar=>, <sa> acked. value-ref-excluded=N: internal functions kept off because a table, field or argument in another function or at file scope holds them (matched by name, not a proven call); a floor. stale=N: ack ledger rows whose target no longer applies (sa rows); never gating. stale_by_kind=: stale= split by ack kind (kind:N,...); the sa rows are collapsed. stale_next=: the call printing the sa rows and the full header. preexisting-worse=N: regressions on symbols that existed at baseline; they gate when major. new-symbol=N: findings on NEW code; new-symbol rows never gate, except defect-shape format-arity. register-macro-excluded=N: symbols kept out of dead-code as self-registering test/bench macros; a floor. declined-call-excluded=N: symbols kept out of dead-code only because a declined call may mean them; a floor. api-new-surface=N: new PUBLIC symbols; a count, never gates, not in regressions=. renames=/rename_window_commits=: git rename pairs read over that many commits, to re-file baseline and acks. acked_by_rename=/acked_by_content=: acked= suppressions matched via git renames / an equal body hash. kinds_skipped=: kinds NOT run, so none of their rows is here and every count covers the rest; a count only they feed is absent. skipped_why=selector (the caller chose; stale acks judged for those kinds only) | memory (see ingest_scope=) | selector,memory (both). acked=N: findings suppressed by the ack ledger, listed as sa rows; never gating. base_ref=/target_ref=: the two resolved full shas a range compared (committed trees; at= omitted). churn=unavailable: range form; short-horizon-churn cannot be measured, so its silence is not no churn. -->
-<quality-delta schema="ripwire.quality-delta/v1" baseline="ref-pair" regressions="0" minor="0" acked="0" stale="17" preexisting-worse="0" new-symbol="0" gating="0" register-macro-excluded="62" api-new-surface="0" base_ref="3e42c36120e3e1983156d9f873a729f126764397" target_ref="d3605fde7ff60e4b1fca435 … [line truncated: 440 more bytes on this line]
+<quality-delta schema="ripwire.quality-delta/v1" baseline="ref-pair" regressions="0" minor="0" acked="0" stale="17" preexisting-worse="0" new-symbol="0" gating="0" register-macro-excluded="62" api-new-surface="0" base_ref="6df53cf0da3d0f16e750d1a150d21655114e7b45" target_ref="0712a5182ef61b6885b76af … [line truncated: 440 more bytes on this line]
 </quality-delta>
 ```
 
@@ -3004,7 +3004,7 @@ _The Delta Maintainability Model scalar for the WORKING TREE vs HEAD — recorde
 ```
 $ ./build/ripwire . --dmm
 <!-- ripwire dmm schema=ripwire.dmm/v1: Delta Maintainability Model base=→target=: dmm= good/(good+bad) units by size_metric=; <p k= dmm= good= bad= d_low= d_high=>. at=: commit+dirty+shallow. available=0: no score at all (dmm=UNAVAILABLE, reason= says why); never read as 1.000 or 0.000. combine=pooled: root dmm= is summed good over summed good+bad of the 3 properties (ripwire's own). low_loc=/low_cx=/low_params=: a unit is LOW risk at or under these lines / cyclomatic / params. base_units=/base_volume=/target_units=/target_volume=: units with a body and their line span per side. reason=: why no score (no unit's size, complexity or params moved; a tree failed to parse ...). -->
-<dmm schema="ripwire.dmm/v1" base="d3605fde7ff60e4b1fca435f5a35be61b5879617" target="working-tree" at="d3605fde7" available="0" combine="pooled" size_metric="physical-loc" low_loc="15" low_cx="5" low_params="2" dmm="UNAVAILABLE" good="0" bad="0" base_units="17795" base_volume="245201" target_units=" … [line truncated: 147 more bytes on this line]
+<dmm schema="ripwire.dmm/v1" base="0712a5182ef61b6885b76af328cae18e839eb110" target="working-tree" at="0712a5182" available="0" combine="pooled" size_metric="physical-loc" low_loc="15" low_cx="5" low_params="2" dmm="UNAVAILABLE" good="0" bad="0" base_units="17849" base_volume="245474" target_units=" … [line truncated: 147 more bytes on this line]
 <p k="size" dmm="UNAVAILABLE" good="0" bad="0" d_low="0" d_high="0"/>
 <p k="complexity" dmm="UNAVAILABLE" good="0" bad="0" d_low="0" d_high="0"/>
 <p k="interfacing" dmm="UNAVAILABLE" good="0" bad="0" d_low="0" d_high="0"/>
@@ -3074,7 +3074,7 @@ _OWNERSHIP partition for a shared tree: every regression here lives in src/infra
 ```
 $ ./build/ripwire . --quality-delta --scope=src/graph.h
 <!-- ripwire quality-delta schema=ripwire.quality-delta/v1: only what the change made WORSE vs baseline=: regressions= minor= gating=; <r kind= sym= p= was= now= gating= bar=>, <sa> acked. value-ref-excluded=N: internal functions kept off because a table, field or argument in another function or at file scope holds them (matched by name, not a proven call); a floor. at=: commit+dirty+shallow. stale=N: ack ledger rows whose target no longer applies (sa rows); never gating. preexisting-worse=N: regressions on symbols that existed at baseline; they gate when major. new-symbol=N: findings on NEW code; new-symbol rows never gate, except defect-shape format-arity. register-macro-excluded=N: symbols kept out of dead-code as self-registering test/bench macros; a floor. declined-call-excluded=N: symbols kept out of dead-code only because a declined call may mean them; a floor. api-new-surface=N: new PUBLIC symbols; a count, never gates, not in regressions=. renames=/rename_window_commits=: git rename pairs read over that many commits, to re-file baseline and acks. acked_by_rename=/acked_by_content=: acked= suppressions matched via git renames / an equal body hash. renames_window_truncated=1: history is deeper than the rename window, older renames unread. r surface=: the api-surface tier, new-symbol or contract-change. acked=N: findings suppressed by the ack ledger, listed as sa rows; never gating. r sev=minor: a small numeric delta, counted in minor=, never gating (absent: major). r origin=new-symbol: a finding on NEW code (absent: preexisting-worse). sa key=/why=: the stale ack's ledger hash / target-gone (names nothing now) or finding-gone (no longer fires). r members=/tokens=: a duplication row's clone group (member ids) / their shared normalized-token count. -->
-<quality-delta schema="ripwire.quality-delta/v1" baseline="git-HEAD" regressions="0" minor="0" acked="0" stale="167" preexisting-worse="0" new-symbol="0" gating="0" register-macro-excluded="62" api-new-surface="2" at="d3605fde7+dirty" renames="62" rename_window_commits="400" acked_by_rename="0" acke … [line truncated: 155 more bytes on this line]
+<quality-delta schema="ripwire.quality-delta/v1" baseline="git-HEAD" regressions="0" minor="0" acked="0" stale="167" preexisting-worse="0" new-symbol="0" gating="0" register-macro-excluded="62" api-new-surface="2" at="0712a5182+dirty" renames="62" rename_window_commits="400" acked_by_rename="0" acke … [line truncated: 155 more bytes on this line]
 <out-of-scope n="9" would-gate="4" note="not yours - do not ack: these rows lie outside the scope this run named. They are disclosed rather than hidden, they never gate this exit code, and the ack refuses to write them.">
 <r kind="api-surface" sym="src/infra/sortutil.h::rw::sortutil::nonNegativeFloatDescKey" was="1" now="2" surface="contract-change" p="src/infra/sortutil.h:109"/>
 <r kind="complexity" sym="src/infra/sortutil.h::rw::sortutil::lessByScoreDescId" was="1" now="67" bar="15" p="src/infra/sortutil.h:49"/>
@@ -3104,10 +3104,10 @@ _Fast per-symbol post-edit contract check vs git HEAD (unchanged on a clean tree
 ```
 $ ./build/ripwire . --edit-check=rankGraphTeleport
 <!-- ripwire edit-check schema=ripwire.edit-check/v1: sym='s contract NOW vs HEAD: status=unchanged|new-symbol|contract-change; <c n= p= incompatible=1 sites_l=> callers. counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. est_tokens=: price as emitted (an upper bound under compact). at=: commit+dirty+shallow. root=: p= relative to it. next=: the one pasteable follow-up. defs=N: overloads at this site (same file, scope, name) folded into one contract; params compared by MAX. callers=N: callers of sym= (the c rows' total; a floor). -->
-<edit-check schema="ripwire.edit-check/v1" sym="rankGraphTeleport" t="fn" p="src/graph.h:11750" status="unchanged" defs="1" callers="7" incompatible="0" at="d3605fde7" graph_ambiguous="2927" graph_unresolved="15221" graph_unindexed="269" counts_floor="1" root="." next="--test-gate=src/graph.h" est_t … [line truncated: 12 more bytes on this line]
+<edit-check schema="ripwire.edit-check/v1" sym="rankGraphTeleport" t="fn" p="src/graph.h:11809" status="unchanged" defs="1" callers="7" incompatible="0" at="0712a5182" graph_ambiguous="2933" graph_unresolved="15249" graph_unindexed="269" counts_floor="1" root="." next="--test-gate=src/graph.h" est_t … [line truncated: 12 more bytes on this line]
 <c n="runEval" p="src/eval.h:171"/>
-<c n="rankGraph" p="src/graph.h:11791"/>
-<c n="anchoredLexicalRank" p="src/graph.h:12437"/>
+<c n="rankGraph" p="src/graph.h:11850"/>
+<c n="anchoredLexicalRank" p="src/graph.h:12496"/>
 <c n="churnDecayRanking" p="src/main.cpp:1425"/>
 <c n="churnRankedGraph" p="src/main.cpp:1464"/>
 <c n="runDefaultMap" p="src/main.cpp:1751"/>
@@ -3158,12 +3158,12 @@ $ ./build/ripwire . --insert-before-symbol=nonNegativeFloatDescKey --edit-payloa
 {"n":"benchAdaptive","p":"bench/bench_radix_ab.cpp:157","l":[162]},
 {"n":"radixSortNonNegativeFloatsDesc","p":"src/infra/sortutil.h:105","l":[114]},
 {"n":"radixSortByScoreDescId","p":"src/infra/sortutil.h:120","l":[180]}],
-"graph_ambiguous":2927,"graph_unresolved":15221,"graph_unindexed":269,"counts_floor":true},"tests_to_run":[{"p":"test/verify_radix.cpp","hops":1,"run":"bash test/greptiercheck.sh"},
+"graph_ambiguous":2933,"graph_unresolved":15249,"graph_unindexed":269,"counts_floor":true},"tests_to_run":[{"p":"test/verify_radix.cpp","hops":1,"run":"bash test/greptiercheck.sh"},
 {"p":"test/adaptivecutshapefix/adaptive_cut_shape_test.cpp","hops":2,"run":"bash test/adaptivecutshapecheck.sh"},
 {"p":"test/includeprecise_unit.cpp","hops":2,"run":"bash test/includeprecisecheck.sh"},
 {"p":"test/verify_csr.cpp","hops":2,"run":"bash test/a9disclosurecheck.sh"},
 {"p":"test/rustimport_unit.cpp","hops":4,"run":"bash test/rustimportprecisecheck.sh"}],
-"order":"evidence","partners":0,"run_first":1,"tests":5,"script_gates_unmodelled":782,"graph_ambiguous":2927,"graph_unresolved":15221,"graph_unindexed":269,"counts_floor":true,"next":"--uses=src/infra/sortutil.h:nonNegativeFloatDescKey"}
+"order":"evidence","partners":0,"run_first":1,"tests":5,"script_gates_unmodelled":782,"graph_ambiguous":2933,"graph_unresolved":15249,"graph_unindexed":269,"counts_floor":true,"next":"--uses=src/infra/sortutil.h:nonNegativeFloatDescKey"}
 ```
 
 ### `--insert-after-symbol=TARGET`
@@ -3179,12 +3179,12 @@ _Insert immediately AFTER one uniquely-resolved definition; replaced_bytes=0 bec
 ```
 $ ./build/ripwire . --insert-after-symbol=lessByScoreDescId --edit-payload=<scratch>/aux/payload_note.h
 {"applied":"insert_after_symbol","symbol":"lessByScoreDescId","file":"src/infra/sortutil.h","span":{"start":2375,"end":2463},"lines":{"start":56,"end":58},"replaced_bytes":0,"old_file_bytes":10824,"new_file_bytes":10912,"file_eol":"lf","eol_normalized":false,"trailing_newline_folded":true,"separator … [line truncated: 652 more bytes on this line]
-"graph_ambiguous":2927,"graph_unresolved":15221,"graph_unindexed":269,"counts_floor":true},"tests_to_run":[{"p":"test/verify_radix.cpp","hops":1,"run":"bash test/greptiercheck.sh"},
+"graph_ambiguous":2933,"graph_unresolved":15249,"graph_unindexed":269,"counts_floor":true},"tests_to_run":[{"p":"test/verify_radix.cpp","hops":1,"run":"bash test/greptiercheck.sh"},
 {"p":"test/adaptivecutshapefix/adaptive_cut_shape_test.cpp","hops":2,"run":"bash test/adaptivecutshapecheck.sh"},
 {"p":"test/includeprecise_unit.cpp","hops":2,"run":"bash test/includeprecisecheck.sh"},
 {"p":"test/verify_csr.cpp","hops":2,"run":"bash test/a9disclosurecheck.sh"},
 {"p":"test/rustimport_unit.cpp","hops":4,"run":"bash test/rustimportprecisecheck.sh"}],
-"order":"evidence","partners":0,"run_first":1,"tests":5,"script_gates_unmodelled":782,"graph_ambiguous":2927,"graph_unresolved":15221,"graph_unindexed":269,"counts_floor":true,"next":"bash test/greptiercheck.sh"}
+"order":"evidence","partners":0,"run_first":1,"tests":5,"script_gates_unmodelled":782,"graph_ambiguous":2933,"graph_unresolved":15249,"graph_unindexed":269,"counts_floor":true,"next":"bash test/greptiercheck.sh"}
 ```
 
 **Caveats (stated by the binary):**
@@ -3230,12 +3230,12 @@ $ ./build/ripwire . --insert-before-symbol=nonNegativeFloatDescKey --edit-payloa
 {"n":"benchAdaptive","p":"bench/bench_radix_ab.cpp:157","l":[162]},
 {"n":"radixSortNonNegativeFloatsDesc","p":"src/infra/sortutil.h:105","l":[114]},
 {"n":"radixSortByScoreDescId","p":"src/infra/sortutil.h:120","l":[180]}],
-"graph_ambiguous":2927,"graph_unresolved":15221,"graph_unindexed":269,"counts_floor":true},"tests_to_run":[{"p":"test/verify_radix.cpp","hops":1,"run":"bash test/greptiercheck.sh"},
+"graph_ambiguous":2933,"graph_unresolved":15249,"graph_unindexed":269,"counts_floor":true},"tests_to_run":[{"p":"test/verify_radix.cpp","hops":1,"run":"bash test/greptiercheck.sh"},
 {"p":"test/adaptivecutshapefix/adaptive_cut_shape_test.cpp","hops":2,"run":"bash test/adaptivecutshapecheck.sh"},
 {"p":"test/includeprecise_unit.cpp","hops":2,"run":"bash test/includeprecisecheck.sh"},
 {"p":"test/verify_csr.cpp","hops":2,"run":"bash test/a9disclosurecheck.sh"},
 {"p":"test/rustimport_unit.cpp","hops":4,"run":"bash test/rustimportprecisecheck.sh"}],
-"order":"evidence","partners":0,"run_first":1,"tests":5,"script_gates_unmodelled":782,"graph_ambiguous":2927,"graph_unresolved":15221,"graph_unindexed":269,"counts_floor":true,"next":"--uses=src/infra/sortutil.h:nonNegativeFloatDescKey"}
+"order":"evidence","partners":0,"run_first":1,"tests":5,"script_gates_unmodelled":782,"graph_ambiguous":2933,"graph_unresolved":15249,"graph_unindexed":269,"counts_floor":true,"next":"--uses=src/infra/sortutil.h:nonNegativeFloatDescKey"}
 ```
 
 **Shaped by:** `--insert-after-symbol`
@@ -3294,11 +3294,11 @@ _The same plan committed: per-file locks, re-verify-before-write, atomic rename,
 
 ```
 $ ./build/ripwire . --edit-plan=<scratch>/aux/edit_plan.json --apply
-{"schema":"ripwire.edit-plan/v1","mode":"apply","edits":1,"files":1,"callers_union":4,"graph_ambiguous":2927,"graph_unresolved":15221,"graph_unindexed":269,"counts_floor":true,"applied":1,"atomic_files":1,"atomic_scope":"per-file","rollback_on_write_error":true,"recheck_before_each_write":true,"mult … [line truncated: 528 more bytes on this line]
+{"schema":"ripwire.edit-plan/v1","mode":"apply","edits":1,"files":1,"callers_union":4,"graph_ambiguous":2933,"graph_unresolved":15249,"graph_unindexed":269,"counts_floor":true,"applied":1,"atomic_files":1,"atomic_scope":"per-file","rollback_on_write_error":true,"recheck_before_each_write":true,"mult … [line truncated: 537 more bytes on this line]
 {"n":"benchAdaptive","p":"bench/bench_radix_ab.cpp:157","l":[162]},
 {"n":"radixSortNonNegativeFloatsDesc","p":"src/infra/sortutil.h:107","l":[116]},
 {"n":"radixSortByScoreDescId","p":"src/infra/sortutil.h:122","l":[182]}],
-"graph_ambiguous":2927,"graph_unresolved":15221,"graph_unindexed":269,"counts_floor":true}}]}
+"graph_ambiguous":2933,"graph_unresolved":15249,"graph_unindexed":269,"counts_floor":true}}]}
 ```
 
 **Shaped by:** `--edit-check`
@@ -3344,19 +3344,19 @@ _Bare --slice=SYM: the INVENTORY of sliceable locals (<v n= l= t=/>), so a calle
 ```
 $ ./build/ripwire . --slice=rankGraphTeleport
 <!-- ripwire slice schema=ripwire.slice/v1: name-based def-use rows of one variable in one definition: <s l= k=def|use|both|scope t= [b= pp= rd=]> (rd= reaching-def lines per reach=cfg|linear), <v n= l= t=> inventory; steps=/depth= flow. at=: commit+dirty+shallow. root=: p= relative to it. sym=/lang=: the sliced definition's name and language; p= is its file:line. vars=N: sliceable local bindings in the definition, one v row each; name one to slice it. counts=as-classified: defs=/uses=/vars=/steps= count what the name classifier rowed; neither floors nor totals. -->
-<slice sym="rankGraphTeleport" p="src/graph.h:11750" t="fn" lang="cpp" schema="ripwire.slice/v1" vars="14" at="d3605fde7" root="." counts="as-classified">
-<v n="alpha" l="11750" t="param"/>
-<v n="g" l="11750" t="param"/>
-<v n="p" l="11750" t="param"/>
-<v n="pw" l="11753" t="decl"/>
-<v n="N" l="11754" t="decl"/>
-<v n="teleport" l="11755" t="decl"/>
-<v n="rankDouble" l="11756" t="decl"/>
-<v n="run" l="11757" t="decl"/>
-<v n="teleportMass" l="11760" t="decl"/>
-<v n="value" l="11761" t="decl"/>
-<v n="inverseMass" l="11767" t="decl"/>
-<v n="value" l="11768" t="decl"/>
+<slice sym="rankGraphTeleport" p="src/graph.h:11809" t="fn" lang="cpp" schema="ripwire.slice/v1" vars="14" at="0712a5182" root="." counts="as-classified">
+<v n="alpha" l="11809" t="param"/>
+<v n="g" l="11809" t="param"/>
+<v n="p" l="11809" t="param"/>
+<v n="pw" l="11812" t="decl"/>
+<v n="N" l="11813" t="decl"/>
+<v n="teleport" l="11814" t="decl"/>
+<v n="rankDouble" l="11815" t="decl"/>
+<v n="run" l="11816" t="decl"/>
+<v n="teleportMass" l="11819" t="decl"/>
+<v n="value" l="11820" t="decl"/>
+<v n="inverseMass" l="11826" t="decl"/>
+<v n="value" l="11827" t="decl"/>
 ... [3 more line(s); run it to see the whole thing]
 ```
 
@@ -3381,17 +3381,17 @@ _Forward flow: which statements the seed's value reaches, at the default depth b
 ```
 $ ./build/ripwire . --slice=rankGraphTeleport:teleport --slice-flow=fwd
 <!-- ripwire slice schema=ripwire.slice/v1: name-based def-use rows of one variable in one definition: <s l= k=def|use|both|scope t= [b= pp= rd=]> (rd= reaching-def lines per reach=cfg|linear), <v n= l= t=> inventory; steps=/depth= flow. at=: commit+dirty+shallow. root=: p= relative to it. sym=/lang=: the sliced definition's name and language; p= is its file:line. order=defuse: seed s rows (no v=) ranked among these rows by def-use coverage (distinct local names on the line) desc, then line; not source order, not a whole-function ranking (measured at chance — docs/EVALS.md) — flow s rows (v=) keep their (d=,l=,v=) order. counts=as-classified: defs=/uses=/vars=/steps= count what the name classifier rowed; neither floors nor totals. -->
-<slice sym="rankGraphTeleport" p="src/graph.h:11750" t="fn" lang="cpp" schema="ripwire.slice/v1" var="teleport" defs="1" uses="3" reach="cfg" flow="fwd" depth="8" steps="7" order="defuse" at="d3605fde7" root="." counts="as-classified">
-<s l="11773" k="use" t="call-arg" rd="11755">
+<slice sym="rankGraphTeleport" p="src/graph.h:11809" t="fn" lang="cpp" schema="ripwire.slice/v1" var="teleport" defs="1" uses="3" reach="cfg" flow="fwd" depth="8" steps="7" order="defuse" at="0712a5182" root="." counts="as-classified">
+<s l="11832" k="use" t="call-arg" rd="11814">
 <![CDATA[run = pageRankDouble( g.inEdges, g.wOutDeg, teleport, rankDouble, PageRankConfig{ .alpha = double( alpha ) } );]]>
 </s>
-<s l="11755" k="def" t="decl">
+<s l="11814" k="def" t="decl">
 <![CDATA[std::vector<double> teleport( pw.begin(), pw.end() );]]>
 </s>
-<s l="11761" k="use" t="read" rd="11755">
+<s l="11820" k="use" t="read" rd="11814">
 <![CDATA[for( const double value : teleport )]]>
 </s>
-<s l="11768" k="use" t="read" rd="11755">
+<s l="11827" k="use" t="read" rd="11814">
 <![CDATA[for( double& value : teleport )]]>
 </s>
 ... [22 more line(s); run it to see the whole thing]
@@ -3435,10 +3435,10 @@ $ ./build/ripwire . --slice-depth=3
 _Hold a LOCATION, not a name: the enclosing-definition chain at FILE:LINE (a compiler error, a diff hunk, a stack frame), outermost -> innermost._
 
 ```
-$ ./build/ripwire . --at=src/graph.h:11752
+$ ./build/ripwire . --at=src/graph.h:11811
 <!-- ripwire at schema=ripwire.at/v1: enclosing-definition chain at p=:l=: sym= innermost, chain= outermost-first, <s n= t= l= el=> spans. root=: p= relative to it. -->
-<at schema="ripwire.at/v1" p="src/graph.h" l="11752" sym="rankGraphTeleport" chain="1" root=".">
-<s n="rankGraphTeleport" t="fn" l="11750" el="11778"/>
+<at schema="ripwire.at/v1" p="src/graph.h" l="11811" sym="rankGraphTeleport" chain="1" root=".">
+<s n="rankGraphTeleport" t="fn" l="11809" el="11837"/>
 </at>
 ```
 
@@ -3462,7 +3462,7 @@ _No-LLM review-evidence bundle for the working-tree diff (clean tree = empty)._
 ```
 $ ./build/ripwire . --pr-context
 <!-- ripwire pr-context schema=ripwire.pr-context/v1: review bundle per changed file vs base=: symbols, callers, blast radius, tests, owners. counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. est_tokens=: price as emitted (an upper bound under compact). at=: commit+dirty+shallow. root=: p= relative to it. truncated=: what the trim ladder dropped to fit budget_tokens= (budget-floor-exceeded: still over). direction=: side reviewed: worktree-since-head, head-since-fork or head-since-ref-tip. skipped_mode_only=N: mode-only (chmod) diffs left out of the changed files; renames stay in. trim_level=0-4: trim ladder step taken to fit budget_tokens= (0 none, 4 counts only); raise token-budget. budget_default=1: the default 8000-token budget applied (no token-budget or max-tokens given). files=N: changed files in the diff (shown= of them listed). -->
-<pr-context schema="ripwire.pr-context/v1" base="working-tree" root="." direction="worktree-since-head" files="0" skipped_mode_only="0" budget_tokens="8000" est_tokens="584" trim_level="0" truncated="none" budget_default="1" at="d3605fde7" graph_ambiguous="2927" graph_unresolved="15221" graph_uninde … [line truncated: 27 more bytes on this line]
+<pr-context schema="ripwire.pr-context/v1" base="working-tree" root="." direction="worktree-since-head" files="0" skipped_mode_only="0" budget_tokens="8000" est_tokens="584" trim_level="0" truncated="none" budget_default="1" at="0712a5182" graph_ambiguous="2933" graph_unresolved="15249" graph_uninde … [line truncated: 27 more bytes on this line]
 <!-- no changed files in the index (clean tree, or the diff touched only non-indexed files) -->
 </pr-context>
 ```
@@ -3488,11 +3488,11 @@ _Pairwise cross-arm conflict sites + suggested landing order (any committish sha
 ```
 $ ./build/ripwire . --merge-scout=HEAD~2,HEAD~1
 <!-- ripwire merge-scout schema=ripwire.merge-scout/v1: cross-branch overlap of arms= refs: <arm ref= base= changed= head_conflicts=>, <pair a= b= conflicts= risks=>, <landing order=>. at=: commit+dirty+shallow. head=: the HEAD commit, bare 9-hex sha (at= adds +dirty). ok=1 on an arm row means the comparison RAN, so changed=/head_conflicts= are real and may legitimately be 0 (an empty but materialized tree is a real index); ok=0 means it did not run at all. no-work note=: arm compared and has no divergent work vs its merge base, so no landing slot. -->
-<merge-scout schema="ripwire.merge-scout/v1" arms="2" head="d3605fde7" at="d3605fde7">
-<arm ref="HEAD~2" base="45d52a1ee" ok="1" changed="0" head_conflicts="0">
+<merge-scout schema="ripwire.merge-scout/v1" arms="2" head="0712a5182" at="0712a5182">
+<arm ref="HEAD~2" base="7a5181f05" ok="1" changed="0" head_conflicts="0">
 <no-work note="no divergent work vs merge-base — see --stray-content"/>
 </arm>
-<arm ref="HEAD~1" base="3e42c3612" ok="1" changed="0" head_conflicts="0">
+<arm ref="HEAD~1" base="6df53cf0d" ok="1" changed="0" head_conflicts="0">
 <no-work note="no divergent work vs merge-base — see --stray-content"/>
 </arm>
 <pair a="HEAD~2" b="HEAD~1" conflicts="0" risks="0"/>
@@ -3567,7 +3567,7 @@ _Which refs of the `lane/` ref family still hold divergent authored work vs HEAD
 ```
 $ ./build/ripwire . --stray-content=lane/
 <!-- ripwire stray-content schema=ripwire.stray-content/v1: per local ref, lines/symbols NOT in HEAD: <ref ok= v= base= stray=>; v=unknown = no merge base. at=: commit+dirty+shallow. head=: the HEAD commit, bare 9-hex sha (at= adds +dirty). head_ref=: HEAD's branch (HEAD when detached); that branch itself is not scanned. refs=N: local branches scanned (refs/heads only); unmerged + superseded + merged + unknown = refs. blobs=N: distinct git blobs read for the sweep. unmerged=N: refs whose authored work the live line genuinely lacks. superseded=N: refs whose work the live line re-implemented (removed the same base code). merged=N: refs whose work HEAD already has; omitted from the rows. name=: the local branch. tip=: the branch tip commit (9 hex). date=: the tip's committer date, YYYY-MM-DD. files=N: files with stray lines; rows capped at 12, a more element counts the rest (detail=1 lists all). ref superseded=N>: of this ref's stray= lines, those in files the live line re-implemented. authored=N: lines this ref authored in the file vs its merge base. del=N: base lines this ref removed (0 = pure addition). redone=N: of del=, the base lines HEAD removed too (the supersession evidence). sim=: minhash containment, 0 to 1, of the ref's blob in HEAD's (pure-addition evidence). head-touched=1: the live line changed this path since the merge base. more files=N: N more file rows of this ref withheld; shown + N = the ref's files=; detail=1 lists all. unknown=N: refs that could not be analysed (v=unknown, e.g. no merge base); never counted merged. -->
-<stray-content schema="ripwire.stray-content/v1" head="d3605fde7" head_ref="integration/train-35" refs="194" blobs="473" unmerged="22" superseded="0" merged="172" unknown="0" filter="lane/" at="d3605fde7">
+<stray-content schema="ripwire.stray-content/v1" head="0712a5182" head_ref="integration/train-36" refs="201" blobs="603" unmerged="26" superseded="0" merged="175" unknown="0" filter="lane/" at="0712a5182">
 <ref name="lane/arise-result" tip="13292db7a" date="2026-09-23" base="60b65f026" ok="1" v="unmerged" stray="16331" files="18" superseded="55">
 <file p="bench/slice/results/arise_line_rank_prereg/narrowpool-results.json" v="unmerged" stray="8629" authored="8629" del="0" redone="0" sim="0.00" head-touched="0"/>
 <file p="bench/slice/results/arise_line_rank_prereg/results.json" v="unmerged" stray="3810" authored="3810" del="0" redone="0" sim="0.00" head-touched="0"/>
@@ -3601,7 +3601,7 @@ _Select the genuinely-unmerged refs of the `lane/` ref family and feed them to m
 ```
 $ ./build/ripwire . --stray-content=lane/ --plan
 <!-- ripwire landing-plan schema=ripwire.landing-plan/v1: stranded-work landing order across refs, fewest conflicts first. at=: commit+dirty+shallow. -->
-<landing-plan schema="ripwire.landing-plan/v1" head="d3605fde7" refs="194" unmerged="22" superseded="0" merged="172" undetermined="0" scouted="12" bounded="10" scout-ok="1" at="d3605fde7">
+<landing-plan schema="ripwire.landing-plan/v1" head="0712a5182" refs="201" unmerged="26" superseded="0" merged="175" undetermined="0" scouted="12" bounded="14" scout-ok="1" at="0712a5182">
 <ref name="lane/arise-result" v="unmerged" stray="16331" files="18" scouted="1"/>
 <ref name="lane/margin-rescore" v="unmerged" stray="13920" files="12" scouted="1"/>
 <ref name="lane/served-syms-result" v="unmerged" stray="6345" files="8" scouted="1"/>
@@ -3637,20 +3637,20 @@ _Cross-branch ABI-break gate over the `lane/` ref family: struct byte-contract d
 ```
 $ ./build/ripwire . --stray-content=lane/ --abi
 <!-- ripwire abi schema=ripwire.abi/v1: contract diff of the indexed symbols between two refs: added/removed/changed signatures. window: shown= capped= (capped=1 cut). at=: commit+dirty+shallow. root=: p= relative to it. -->
-<abi schema="ripwire.abi/v1" head="d3605fde7" head_ref="integration/train-35" refs="194" candidates="1920" compared="277" blobs="101" rows="106" shown="3" capped="0" dropped="0" excluded="103" head_only="227800" unmodelable="815" unrelated="0" broken_refs="1" quiet="184" excluded_refs="7" at="d3605f … [line truncated: 52 more bytes on this line]
-<ref name="lane/for-noise" tip="5541dd8bc" date="2026-10-10" rows="14" shown="1" capped="0" excluded="13" head_only="992" drift="1" head-moved="13">
-<struct n="CandidateProvenance" p="src/serialize.h" l="6574" kind="drift" head_size="24" ref_size="32" size_differs="1" size_delta="8">
-<d n="frameTerms" a="absent" b="std::uint32_t@24"/>
+<abi schema="ripwire.abi/v1" head="0712a5182" head_ref="integration/train-36" refs="201" candidates="1922" compared="341" blobs="129" rows="117" shown="5" capped="0" dropped="0" excluded="112" head_only="230017" unmodelable="1038" unrelated="0" broken_refs="2" quiet="188" excluded_refs="9" at="0712a … [line truncated: 53 more bytes on this line]
+<ref name="lane/rust-degraded" tip="1f69e0c77" date="2026-10-26" rows="6" shown="2" capped="0" excluded="4" head_only="114" drift="2" head-moved="4">
+<struct n="FileHealth" p="src/model.h" l="1797" kind="drift" head_size="20" ref_size="24" size_differs="1" size_delta="4">
+<d n="useBoundsBlanked" a="absent" b="std::uint32_t@20"/>
 </struct>
-</ref>
-<ref name="lane/orient-map-067" tip="6a7046111" date="2026-10-03" rows="16" shown="1" capped="0" excluded="15" head_only="1242" absent="1" head-moved="15">
-<struct n="ObjSpan" p="src/jsrunner.h" l="170" kind="absent" head_size="16">
+<struct n="SkipHealthFinding" p="src/verbs_report.h" l="2024" kind="drift" head_size="24" ref_size="24" size_differs="0" size_delta="0">
+<d n="useBoundsBlanked" a="absent" b="std::uint32_t@20"/>
 </struct>
 </ref>
-<ref name="lane/orient-narrow-v3" tip="eb88882f1" date="2026-10-03" rows="21" shown="1" capped="0" excluded="20" head_only="1183" absent="1" head-moved="20">
-<struct n="ObjSpan" p="src/jsrunner.h" l="170" kind="absent" head_size="16">
+<ref name="lane/for-noise" tip="5541dd8bc" date="2026-10-10" rows="14" shown="1" capped="0" excluded="13" head_only="994" drift="1" head-moved="13">
+<struct n="CandidateProvenance" p="src/serialize.h" l="6574" kind="drift" head_size="24" ref_size="32" size_differs="1" size_delta="8">
+<d n="frameTerms" a="absent" b="std::uint32_t@24"/>
 </struct>
-... [2 more line(s); run it to see the whole thing]
+... [10 more line(s); run it to see the whole thing]
 ```
 
 **Caveats (stated by the binary):**
@@ -3672,10 +3672,10 @@ _Which ref's tree defines or mentions SYM — HEAD first, then every local branc
 ```
 $ ./build/ripwire . --whereis=rankGraphTeleport
 <!-- ripwire whereis schema=ripwire.whereis/v1: every LOCAL ref whose tree holds sym= (refs_scanned=, blobs=), HEAD first: <hit ref= tip= date= p= l= kind= t=>. window: shown= capped= (capped=1 cut). at=: commit+dirty+shallow. next=: the one pasteable follow-up. hits=N: occurrences in HEAD plus every scanned local ref's full tree (the total rows). on-head=1|0: whether HEAD's tree holds it; 0 beside hits = it lives only on a branch. head_labels=index: HEAD kind= from the parsed index; lexical: text heuristic. ref_labels=parsed: another ref's kind= from the index's own tags parse of its blob (one per blob and path; HEAD's own blob takes HEAD's labels); a blob with no line a loose lexical test calls worth parsing is not parsed and its rows read ref; kind=text: such a line no parse read, never a def. unparsed blobs=N: other refs' blobs holding a line worth parsing that no parse read (past the runaway guard, or the parser could not finish); those lines read kind=text; next= lifts the guard. unparsed rows=N: the kind=text rows those blobs gave. hit refs=N: N scanned refs hold this same definition (or kind=text) line (path + text); printed once for the first by name, whose ref= tip= date= l= it carries; defs page only, absent = one ref; hits= counts every copy, listing=all prints each. folded=N: def (or text) rows of other refs a listed row's refs= stands for; shown + more + folded + refs count = hits on the first page. listing=defs|refs: only those kind= rows listed (defs: def and text); under defs <refs count=N next=> counts the kind=ref rows and next= lists them; the window counts listed rows; default: defs if it lists more defs than all, else if shorter; a def the parser does not model (define_method, setattr, assignment) is a counted ref. head_date=: a hit without tip= date= has tip= at=, date= this. -->
-<whereis schema="ripwire.whereis/v1" sym="rankGraphTeleport" on-head="1" refs_scanned="268" blobs="8974" hits="790479" head_labels="index" shown="16" capped="0" listing="defs" folded="1120" ref_labels="parsed" head_date="2026-10-25" at="d3605fde7">
-<unparsed blobs="276" rows="1084" next="--whereis=rankGraphTeleport --detail=1"/>
-<hit ref="HEAD" p="src/graph.h" l="11750" kind="def" t="inline RankedGraph rankGraphTeleport( const Graph&amp; g, const std::vector&lt;float&gt;&amp; p, float alpha = 0.85f )"/>
-<hit ref="arm/for-howitworks-067-f2add" tip="abcbd8b7f" date="2026-10-02" p="src/graph.h" l="4645" kind="text" refs="217" t="inline RankedGraph rankGraphTeleport( const Graph&amp; g, const std::vector&lt;float&gt;&amp; p, float alpha = 0.85f )"/>
+<whereis schema="ripwire.whereis/v1" sym="rankGraphTeleport" on-head="1" refs_scanned="278" blobs="9153" hits="838595" head_labels="index" shown="16" capped="0" listing="defs" folded="1148" ref_labels="parsed" head_date="2026-10-26" at="0712a5182">
+<unparsed blobs="284" rows="1113" next="--whereis=rankGraphTeleport --detail=1"/>
+<hit ref="HEAD" p="src/graph.h" l="11809" kind="def" t="inline RankedGraph rankGraphTeleport( const Graph&amp; g, const std::vector&lt;float&gt;&amp; p, float alpha = 0.85f )"/>
+<hit ref="arm/for-howitworks-067-f2add" tip="abcbd8b7f" date="2026-10-02" p="src/graph.h" l="4645" kind="text" refs="228" t="inline RankedGraph rankGraphTeleport( const Graph&amp; g, const std::vector&lt;float&gt;&amp; p, float alpha = 0.85f )"/>
 <hit ref="arm/for-howitworks-067-f2add" tip="abcbd8b7f" date="2026-10-02" p="src/main.cpp" l="1434" kind="text" refs="218" t="rw::RankedGraph    ranked = isDecay ? rankGraphTeleport( d.g, churnDecayTeleportWorkspace( rootDirs, d.ing, &amp;hasChurnEvidence ) )"/>
 <hit ref="arm/orient-map-067-narrow" tip="cf40f2e31" date="2026-10-02" p="test/showcase_capture.py" l="174" kind="text" refs="10" t="#0 0x102f4a1c8 in rw::rankGraphTeleport(Graph const&amp;, std::vector&lt;float&gt; const&amp;, float) src/graph.h:{TELEPORT_LN}"/>
 ... [14 more line(s); run it to see the whole thing]
@@ -3702,10 +3702,10 @@ _The same page with every t= line whole: the page above previews each line over
 ```
 $ ./build/ripwire . --whereis=rankGraphTeleport --whereis-listing=all --whereis-full-text
 <!-- ripwire whereis schema=ripwire.whereis/v1: every LOCAL ref whose tree holds sym= (refs_scanned=, blobs=), HEAD first: <hit ref= tip= date= p= l= kind= t=>. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). at=: commit+dirty+shallow. next=: the one pasteable follow-up. hits=N: occurrences in HEAD plus every scanned local ref's full tree (the total rows). on-head=1|0: whether HEAD's tree holds it; 0 beside hits = it lives only on a branch. head_labels=index: HEAD kind= from the parsed index; lexical: text heuristic. ref_labels=parsed: another ref's kind= from the index's own tags parse of its blob (one per blob and path; HEAD's own blob takes HEAD's labels); a blob with no line a loose lexical test calls worth parsing is not parsed and its rows read ref; kind=text: such a line no parse read, never a def. unparsed blobs=N: other refs' blobs holding a line worth parsing that no parse read (past the runaway guard, or the parser could not finish); those lines read kind=text; next= lifts the guard. unparsed rows=N: the kind=text rows those blobs gave. more hits=N: rows after this page; page on with offset=next_offset. head_date=: a hit without tip= date= has tip= at=, date= this. -->
-<whereis schema="ripwire.whereis/v1" sym="rankGraphTeleport" on-head="1" refs_scanned="268" blobs="8974" hits="790479" head_labels="index" shown="60" capped="1" total="790479" has_more="1" next_offset="60" offset="0" limit="0" ref_labels="parsed" head_date="2026-10-25" at="d3605fde7">
-<unparsed blobs="276" rows="1084" next="--whereis=rankGraphTeleport --whereis-listing=all --detail=1"/>
-<hit ref="HEAD" p="src/graph.h" l="11750" kind="def" t="inline RankedGraph rankGraphTeleport( const Graph&amp; g, const std::vector&lt;float&gt;&amp; p, float alpha = 0.85f )"/>
-<hit ref="HEAD" p=".ripwire_quality_acks" l="1304" kind="ref" t="ack short-horizon-churn 89b3fd14c192c899 116 cid=b6e271ab92996f75 by=src/* macro-vocabulary rename (VERIFY/DEGRADED_PATH_ALERT family -&gt; ASSUME/EXPECTS/ENSURES/DASSERT/UNREACHABLE/VALIDATE/DISCLOSE): identifier-only churn across 179 … [line truncated: 586 more bytes on this line]
+<whereis schema="ripwire.whereis/v1" sym="rankGraphTeleport" on-head="1" refs_scanned="278" blobs="9153" hits="838595" head_labels="index" shown="60" capped="1" total="838595" has_more="1" next_offset="60" offset="0" limit="0" ref_labels="parsed" head_date="2026-10-26" at="0712a5182">
+<unparsed blobs="284" rows="1113" next="--whereis=rankGraphTeleport --whereis-listing=all --detail=1"/>
+<hit ref="HEAD" p="src/graph.h" l="11809" kind="def" t="inline RankedGraph rankGraphTeleport( const Graph&amp; g, const std::vector&lt;float&gt;&amp; p, float alpha = 0.85f )"/>
+<hit ref="HEAD" p=".ripwire_quality_acks" l="1305" kind="ref" t="ack short-horizon-churn 89b3fd14c192c899 116 cid=b6e271ab92996f75 by=src/* macro-vocabulary rename (VERIFY/DEGRADED_PATH_ALERT family -&gt; ASSUME/EXPECTS/ENSURES/DASSERT/UNREACHABLE/VALIDATE/DISCLOSE): identifier-only churn across 179 … [line truncated: 586 more bytes on this line]
 <hit ref="HEAD" p="present/deck5_ripwire_build.js" l="1157" kind="ref" t="s.addText(&quot;$ ripwire . --callers=rankGraphTeleport&quot;, { x: 8.68, y: 2.1, w: 3.8, h: 0.3, fontFace: MONO, fontSize: 10, color: MUTED, margin: 0 });"/>
 <hit ref="HEAD" p="present/deck5_ripwire_build.js" l="1159" kind="ref" t="{ text: &quot;&lt;callers of=\&quot;rankGraphTeleport\&quot;\n  defs=\&quot;1\&quot; count=\&quot;7\&quot; &quot;, options: { color: TEXT } },"/>
 ... [24 more line(s); run it to see the whole thing]
@@ -3730,11 +3730,11 @@ _The whole hit list asked for by name: under the same 60-row cap HEAD's referenc
 ```
 $ ./build/ripwire . --whereis=rankGraphTeleport --whereis-listing=all
 <!-- ripwire whereis schema=ripwire.whereis/v1: every LOCAL ref whose tree holds sym= (refs_scanned=, blobs=), HEAD first: <hit ref= tip= date= p= l= kind= t=>. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). at=: commit+dirty+shallow. next=: the one pasteable follow-up. hits=N: occurrences in HEAD plus every scanned local ref's full tree (the total rows). on-head=1|0: whether HEAD's tree holds it; 0 beside hits = it lives only on a branch. head_labels=index: HEAD kind= from the parsed index; lexical: text heuristic. ref_labels=parsed: another ref's kind= from the index's own tags parse of its blob (one per blob and path; HEAD's own blob takes HEAD's labels); a blob with no line a loose lexical test calls worth parsing is not parsed and its rows read ref; kind=text: such a line no parse read, never a def. unparsed blobs=N: other refs' blobs holding a line worth parsing that no parse read (past the runaway guard, or the parser could not finish); those lines read kind=text; next= lifts the guard. unparsed rows=N: the kind=text rows those blobs gave. hit t_bytes=N: t= previews an N-byte line (over 300 B): 200 B at most, its first bytes cut on a UTF-8 boundary plus an ellipsis. t_cut rows=N: rows of this page whose t= is a preview (each carries t_bytes=); next= replays this page (same listing, window, rows) with every line whole. more hits=N: rows after this page; page on with offset=next_offset. head_date=: a hit without tip= date= has tip= at=, date= this. -->
-<whereis schema="ripwire.whereis/v1" sym="rankGraphTeleport" on-head="1" refs_scanned="268" blobs="8974" hits="790479" head_labels="index" shown="60" capped="1" total="790479" has_more="1" next_offset="60" offset="0" limit="0" ref_labels="parsed" head_date="2026-10-25" at="d3605fde7">
-<unparsed blobs="276" rows="1084" next="--whereis=rankGraphTeleport --whereis-listing=all --detail=1"/>
+<whereis schema="ripwire.whereis/v1" sym="rankGraphTeleport" on-head="1" refs_scanned="278" blobs="9153" hits="838595" head_labels="index" shown="60" capped="1" total="838595" has_more="1" next_offset="60" offset="0" limit="0" ref_labels="parsed" head_date="2026-10-26" at="0712a5182">
+<unparsed blobs="284" rows="1113" next="--whereis=rankGraphTeleport --whereis-listing=all --detail=1"/>
 <t_cut rows="5" next="--whereis=rankGraphTeleport --whereis-listing=all --whereis-full-text"/>
-<hit ref="HEAD" p="src/graph.h" l="11750" kind="def" t="inline RankedGraph rankGraphTeleport( const Graph&amp; g, const std::vector&lt;float&gt;&amp; p, float alpha = 0.85f )"/>
-<hit ref="HEAD" p=".ripwire_quality_acks" l="1304" kind="ref" t_bytes="815" t="ack short-horizon-churn 89b3fd14c192c899 116 cid=b6e271ab92996f75 by=src/* macro-vocabulary rename (VERIFY/DEGRADED_PATH_ALERT family -&gt; ASSUME/EXPECTS/ENSURES/DASSERT/UNREACHABLE/VALIDATE/DISCLOSE…"/>
+<hit ref="HEAD" p="src/graph.h" l="11809" kind="def" t="inline RankedGraph rankGraphTeleport( const Graph&amp; g, const std::vector&lt;float&gt;&amp; p, float alpha = 0.85f )"/>
+<hit ref="HEAD" p=".ripwire_quality_acks" l="1305" kind="ref" t_bytes="815" t="ack short-horizon-churn 89b3fd14c192c899 116 cid=b6e271ab92996f75 by=src/* macro-vocabulary rename (VERIFY/DEGRADED_PATH_ALERT family -&gt; ASSUME/EXPECTS/ENSURES/DASSERT/UNREACHABLE/VALIDATE/DISCLOSE…"/>
 <hit ref="HEAD" p="present/deck5_ripwire_build.js" l="1157" kind="ref" t="s.addText(&quot;$ ripwire . --callers=rankGraphTeleport&quot;, { x: 8.68, y: 2.1, w: 3.8, h: 0.3, fontFace: MONO, fontSize: 10, color: MUTED, margin: 0 });"/>
 <hit ref="HEAD" p="present/deck5_ripwire_build.js" l="1159" kind="ref" t="{ text: &quot;&lt;callers of=\&quot;rankGraphTeleport\&quot;\n  defs=\&quot;1\&quot; count=\&quot;7\&quot; &quot;, options: { color: TEXT } },"/>
 ... [23 more line(s); run it to see the whole thing]
@@ -3762,7 +3762,7 @@ _The dark-content dashboard: gates BUILT but OFF. CHANGED: no longer invents gat
 $ ./build/ripwire . --flags
 <!-- ripwire flags schema=ripwire.flags/v1: BUILT but DARK: <gate name= kind=compile|cmake|env default= dark= regions=/loc=(#if only) reads= p= l=> with <read p= l=> sites. reads_capped=: 1 = cut. next=: the one pasteable follow-up. gates=/dark_gates=: gate rows (never cut) / those whose default keeps the guarded code out of the build. compile=/cmake=/env=: gates by kind: ifndef/define header gate, CMake option(), getenv read. files=N: files this verb scanned for gates (source + CMakeLists), wider than the map's corpus. -->
 <!-- ROWS AND WHAT IS NEVER CUT: the gate rows ARE the answer this verb was asked for and are never windowed, capped or paged, and gates/dark_gates/compile/cmake/env/files on the root plus regions/loc/reads/dark on every gate are counted over the FULL set before any cap exists. What pages is the read SITES under one gate, at 8 a gate by default: a gate whose sites were cut says shown_reads= (the rows this run printed) with reads_capped="1", against the reads= total already on the same element, and the more reads= child keeps naming the remainder. The pair is emitted ONLY on a gate that was cut, never as a capped="0" on the gates that fit. limit=N raises the per gate cap (offset=M skips that many sites in every gate), detail lifts it entirely, and next= on the root is the exact pasteable invocation that shows every site this run dropped. -->
-<flags schema="ripwire.flags/v1" gates="107" dark_gates="99" compile="13" cmake="12" env="82" files="3625" next="--flags --limit=19">
+<flags schema="ripwire.flags/v1" gates="107" dark_gates="99" compile="13" cmake="12" env="82" files="3638" next="--flags --limit=19">
 <gate name="FIXTURE_DARK_FEATURE" kind="compile" default="0" dark="1" regions="2" loc="13" reads="2" p="test/flagsfix/wiringFlags.h" l="10">
 <read p="test/flagsfix/feature.cpp" l="10"/>
 <read p="test/flagsfix/sub/nested.cpp" l="5"/>
@@ -3843,7 +3843,7 @@ _The cache-locality lens over every aggregate: fields READ TOGETHER but declared
 ```
 $ ./build/ripwire . --field-affinity
 <!-- ripwire field-affinity schema=ripwire.field-affinity/v1: fields read together but declared far apart vs 64-byte lines: <s n= p=> structs, <pair a= b= fns= dist=>, <finding k= f= g=>. window: shown= capped= (capped=1 cut). counts_floor=1: every count is a FLOOR, never a total. root=: p= relative to it. block=64: ASSUMED cache-line bytes; all geometry (dist= wt= ln= lines= findings) is against it. model=lp64-approx: sizes/offsets are the layout verb's LP64 standard-layout MODEL, not the real ABI. weighting=fanin-floor: w= sums 1 + fan-in per co-accessing fn; a reachability proxy, not a frequency. aggregates=N: C-family structs/classes the layout model located a body for (the scanned universe). files=N: C-family files declaring at least one struct/class the modelling pass visited. fns_scanned=N: C-family functions/methods with a readable body scanned for dot/arrow member accesses. accesses=N: member-access sites tied to one aggregate field (FLOOR: bare in-method names uncounted). amb_skipped=N: access sites REFUSED, not guessed: 2+ aggregates declare that field name; in no count here. structs=N: aggregates with 1+ attributed access; the top 20 by sepcost= print (shown=/capped=). findings=N: split-line + straddle findings over ALL structs=, not just the printed rows. min_fns=2: a pair fires split-line only when co-accessed by this many distinct functions. as_loops=N: for-loops the static advance-shape pass classified corpus-wide; report-only, never ranks. as_index=/as_chase=/as_mixed=/as_unknown=: as_loops= by advance shape (chase = pointer chase). agg=: the aggregate keyword (struct, class ...). modeled=1: layout model placed the fields; 0 = affinity only, no geometry, no finding (why= says why). fields=N: fields declared (before the touched-only filter). touched=N: fields with 1+ attributed access; at most 32 f rows print. pairs=N: co-accessed field pairs in all; at most 12 pair rows print (most fns= first). sepcost=: sum over measured pairs of fns x (1 - wt); the struct ranking key. findings=N: this struct's findings, every one printed. size=/align=/lines=: modeled sizeof, alignment, cache lines spanned (modeled=1 only). acc=N: member-access sites attributed to this field (FLOOR). sz=B: the field's modeled size in bytes (absent when the model could not size it). off=/ln=: modeled byte offset and its cache line (off/64); placed=0 instead when the model refused. w=: sum of 1 + fan-in over the co-accessing functions; a static reachability proxy, never a frequency. wt=: separation weight (64 - dist)/64, 0.00 = the two can never share a line; measured=0 instead when unplaced. wt=0.00: split-line fires only when the pair can never share a 64-byte line. w=: the split-line pair's 1 + fan-in weight sum (proxy); straddle rows carry none. off=/sz=/crosses=: straddle field offset, size, and the line its last byte lands on (lines start at off/64). fanin=N: this function's caller count (the w= proxy input). touched=N: distinct fields of this struct the function touches (named in f=); at most 8 fn rows of fns= print. scope=: the function's PROFILE_SCOPE description (first 120 chars), a counter to confirm with. scopes=N: distinct PROFILE_SCOPEs among the co-accessing functions (the scope children). status=: instrumented (a scope exists to measure) or uninstrumented (no witness yet). counter=: the hardware counter to compare across the two layouts. hint=: how to add the missing instrumentation (uninstrumented only). as_stem_ambiguous=/as_stem_unowned=/as_stem_nonptr=: chase names REFUSED - 2+ owners / no owner / owner type has no pointer marker. -->
-<fieldaffinity schema="ripwire.field-affinity/v1" block="64" model="lp64-approx" counts_floor="1" weighting="fanin-floor" aggregates="1920" files="403" fns_scanned="10123" accesses="12026" amb_skipped="33268" structs="840" shown="20" capped="1" findings="9" min_fns="2" as_loops="3258" as_index="8" a … [line truncated: 93 more bytes on this line]
+<fieldaffinity schema="ripwire.field-affinity/v1" block="64" model="lp64-approx" counts_floor="1" weighting="fanin-floor" aggregates="1922" files="403" fns_scanned="10130" accesses="12030" amb_skipped="33321" structs="839" shown="20" capped="1" findings="9" min_fns="2" as_loops="3258" as_index="8" a … [line truncated: 93 more bytes on this line]
 <s n="MainDispatch" p="src/main.cpp" l="502" agg="struct" modeled="1" fields="21" touched="13" fns="25" pairs="48" sepcost="57.12" findings="3" size="168" align="8" lines="3">
 <f n="multiRoot" acc="15" fns="12" sz="1" off="32" ln="0"/>
 <f n="ws" acc="10" fns="9" sz="8" off="40" ln="0"/>
@@ -3878,7 +3878,7 @@ _Which of this repo's doc claims are now false. CHANGED: row attribute at= renam
 ```
 $ ./build/ripwire . --doc-drift
 <!-- ripwire doc-drift schema=ripwire.doc-drift/v1: markdown anchors that no longer hold: <doc p=> of <a k= l= c= why= ref= want= got= tgt=>; unchecked/dated rows disclose the rest. failed_capped=/weak_capped=: 1 = cut. at=: commit+dirty+shallow. next=: the one pasteable follow-up. docs=N: markdown docs scanned for anchors; docs minus clean = the doc rows. clean=N: docs with no failed anchor (drift and dated 0); not proof every anchor was checked. checked=N: anchors verified against the index; checked + unchecked = anchors. prose=N: value anchors dropped as prose (name not in code); subtracted from anchors=, never checked. corpus=N: files the anchors were checked against (index + config/build exts); 0 = no anchor shape, no scan. drift=/dated=: anchors that no longer hold / anchors skipped as dated (unverifiable by date). unchecked=N: anchors not proved (the unchecked rows give each reason); checked + unchecked = anchors. doc shown_failed=/failed_total=: a rows printed / all failed anchors (drift+dated); cut at 12, detail=1 lifts. a kind=/rec=: dated-record, an author-dated failed anchor in dated= / its evidence: line|block|title|stamp. a sym=: the symbol the doc names on that file:line; line-moved = that symbol no longer spans the line. more weak=N: w rows of this group withheld; shown_weak + N = its n=; detail=1 lists all. shown_weak=N: w rows printed of n= (cut at 12 a doc, weak_capped=1); detail=1 lists all. w resolves-to=: the indexed symbol spanning that line; not proof it is the one the doc meant. unchecked r=/note=: why n= anchors were not proved, and what was still checked for them. dated r=/note=: the dating mark that moved n= failed anchors into dated= instead of drift=. -->
-<doc-drift schema="ripwire.doc-drift/v1" docs="265" clean="235" anchors="7066" checked="3304" unchecked="3762" drift="82" dated="109" prose="26" corpus="3736" at="d3605fde7" next="--doc-drift --detail=1">
+<doc-drift schema="ripwire.doc-drift/v1" docs="267" clean="237" anchors="7101" checked="3318" unchecked="3783" drift="79" dated="109" prose="26" corpus="3749" at="0712a5182" next="--doc-drift --detail=1">
 <doc p="docs/research/answer-completeness.md" anchors="187" checked="83" drift="16" dated="0" shown_failed="12" failed_capped="1" failed_total="16">
 <a k="file-line" l="341" c="25" why="line-moved" ref="src/pageview.h:292" sym="pageDisclosure" got="(file scope)" tgt="src/pageview.h:346"/>
 <a k="file-line" l="349" c="99" why="line-moved" ref="src/serialize.h:4169" sym="kForLensDefaultTopN" got="cleanSig" tgt="src/serialize.h:1044"/>
@@ -3912,7 +3912,7 @@ _Which of this repo's doc claims are now false. CHANGED: row attribute at= renam
 ```
 $ ./build/ripwire . --doc-drift
 <!-- ripwire doc-drift schema=ripwire.doc-drift/v1: markdown anchors that no longer hold: <doc p=> of <a k= l= c= why= ref= want= got= tgt=>; unchecked/dated rows disclose the rest. failed_capped=/weak_capped=: 1 = cut. at=: commit+dirty+shallow. next=: the one pasteable follow-up. docs=N: markdown docs scanned for anchors; docs minus clean = the doc rows. clean=N: docs with no failed anchor (drift and dated 0); not proof every anchor was checked. checked=N: anchors verified against the index; checked + unchecked = anchors. prose=N: value anchors dropped as prose (name not in code); subtracted from anchors=, never checked. corpus=N: files the anchors were checked against (index + config/build exts); 0 = no anchor shape, no scan. drift=/dated=: anchors that no longer hold / anchors skipped as dated (unverifiable by date). unchecked=N: anchors not proved (the unchecked rows give each reason); checked + unchecked = anchors. doc shown_failed=/failed_total=: a rows printed / all failed anchors (drift+dated); cut at 12, detail=1 lifts. a kind=/rec=: dated-record, an author-dated failed anchor in dated= / its evidence: line|block|title|stamp. a sym=: the symbol the doc names on that file:line; line-moved = that symbol no longer spans the line. more weak=N: w rows of this group withheld; shown_weak + N = its n=; detail=1 lists all. shown_weak=N: w rows printed of n= (cut at 12 a doc, weak_capped=1); detail=1 lists all. w resolves-to=: the indexed symbol spanning that line; not proof it is the one the doc meant. unchecked r=/note=: why n= anchors were not proved, and what was still checked for them. dated r=/note=: the dating mark that moved n= failed anchors into dated= instead of drift=. -->
-<doc-drift schema="ripwire.doc-drift/v1" docs="265" clean="235" anchors="7066" checked="3304" unchecked="3762" drift="82" dated="109" prose="26" corpus="3736" at="d3605fde7" next="--doc-drift --detail=1">
+<doc-drift schema="ripwire.doc-drift/v1" docs="267" clean="237" anchors="7101" checked="3318" unchecked="3783" drift="79" dated="109" prose="26" corpus="3749" at="0712a5182" next="--doc-drift --detail=1">
 <doc p="docs/research/answer-completeness.md" anchors="187" checked="83" drift="16" dated="0" shown_failed="12" failed_capped="1" failed_total="16">
 <a k="file-line" l="341" c="25" why="line-moved" ref="src/pageview.h:292" sym="pageDisclosure" got="(file scope)" tgt="src/pageview.h:346"/>
 <a k="file-line" l="349" c="99" why="line-moved" ref="src/serialize.h:4169" sym="kForLensDefaultTopN" got="cleanSig" tgt="src/serialize.h:1044"/>
@@ -3945,8 +3945,8 @@ _Same report, with git history splitting stale mentions into deleted-by-commit v
 ```
 $ ./build/ripwire . --doc-drift --with-history
 <!-- ripwire doc-drift schema=ripwire.doc-drift/v1: markdown anchors that no longer hold: <doc p=> of <a k= l= c= why= ref= want= got= tgt=>; unchecked/dated rows disclose the rest. failed_capped=/weak_capped=: 1 = cut. at=: commit+dirty+shallow. next=: the one pasteable follow-up. docs=N: markdown docs scanned for anchors; docs minus clean = the doc rows. clean=N: docs with no failed anchor (drift and dated 0); not proof every anchor was checked. checked=N: anchors verified against the index; checked + unchecked = anchors. prose=N: value anchors dropped as prose (name not in code); subtracted from anchors=, never checked. corpus=N: files the anchors were checked against (index + config/build exts); 0 = no anchor shape, no scan. drift=/dated=: anchors that no longer hold / anchors skipped as dated (unverifiable by date). unchecked=N: anchors not proved (the unchecked rows give each reason); checked + unchecked = anchors. doc shown_failed=/failed_total=: a rows printed / all failed anchors (drift+dated); cut at 12, detail=1 lifts. a kind=/rec=: dated-record, an author-dated failed anchor in dated= / its evidence: line|block|title|stamp. a sym=: the symbol the doc names on that file:line; line-moved = that symbol no longer spans the line. more weak=N: w rows of this group withheld; shown_weak + N = its n=; detail=1 lists all. shown_weak=N: w rows printed of n= (cut at 12 a doc, weak_capped=1); detail=1 lists all. w resolves-to=: the indexed symbol spanning that line; not proof it is the one the doc meant. unchecked r=/note=: why n= anchors were not proved, and what was still checked for them. dated r=/note=: the dating mark that moved n= failed anchors into dated= instead of drift=. -->
-<doc-drift schema="ripwire.doc-drift/v1" docs="265" clean="240" anchors="7066" checked="3287" unchecked="3779" drift="73" dated="101" prose="26" corpus="3736" at="d3605fde7" next="--doc-drift --detail=1">
-<history probed="1" head="d3605fde7" commits="4834" removed-names="48546"/>
+<doc-drift schema="ripwire.doc-drift/v1" docs="267" clean="242" anchors="7101" checked="3301" unchecked="3800" drift="70" dated="101" prose="26" corpus="3749" at="0712a5182" next="--doc-drift --detail=1">
+<history probed="1" head="0712a5182" commits="4861" removed-names="48741"/>
 <doc p="docs/research/answer-completeness.md" anchors="187" checked="83" drift="16" dated="0" shown_failed="12" failed_capped="1" failed_total="16">
 <a k="file-line" l="341" c="25" why="line-moved" ref="src/pageview.h:292" sym="pageDisclosure" got="(file scope)" tgt="src/pageview.h:346"/>
 <a k="file-line" l="349" c="99" why="line-moved" ref="src/serialize.h:4169" sym="kForLensDefaultTopN" got="cleanSig" tgt="src/serialize.h:1044"/>
@@ -3979,7 +3979,7 @@ _The house PLAN/DESIGN format's STRUCTURE check — never semantics; exit 2 when
 ```
 $ ./build/ripwire . --plan-lint=test/planlintfix/wave.md
 <!-- ripwire plan-lint schema=ripwire.plan-lint/v1: structural lint of a plan document: each finding names the section and the rule. at=: commit+dirty+shallow. file=/dialect=: the plan read and whether the PLAN dialect was detected (dialect=0: nothing to lint). cards=/ledger=: card rows found / whether the doc carries a ledger (ledger_line= names its line). git=1: git was available, so the staleness read ran; stale_commits=N: a waiting card N commits behind HEAD is stale. gating=N: findings that fail the plan (exit 2); the rest are advisory. -->
-<plan-lint schema="ripwire.plan-lint/v1" file="test/planlintfix/wave.md" dialect="1" cards="3" ledger="1" ledger_line="21" at="d3605fde7" git="1" stale_commits="20" gating="3">
+<plan-lint schema="ripwire.plan-lint/v1" file="test/planlintfix/wave.md" dialect="1" cards="3" ledger="1" ledger_line="21" at="0712a5182" git="1" stale_commits="20" gating="3">
 <card id="T1" line="10" status="check" tline="12"/>
 <card id="T2" line="14" status="cross" tline="16"/>
 <card id="T5" line="18" status="missing" tline="19" why="unlaunched" gating="1"/>
@@ -4014,8 +4014,8 @@ $ ./build/ripwire . --from-trace=-
 AddressSanitizer:DEADLYSIGNAL
 =================================================================
 ==41337==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000018 (pc 0x000102f4a1c8 bp 0x00016d2f1a40 sp 0x00016d2f19e0 T0)
-    #0 0x102f4a1c8 in rw::rankGraphTeleport(Graph const&, std::vector<float> const&, float) src/graph.h:11752
-    #1 0x102f3e884 in rw::rankGraph(Graph const&, float) src/graph.h:11793
+    #0 0x102f4a1c8 in rw::rankGraphTeleport(Graph const&, std::vector<float> const&, float) src/graph.h:11811
+    #1 0x102f3e884 in rw::rankGraph(Graph const&, float) src/graph.h:11852
     #2 0x102e11f30 in runDefaultMap(MainDispatch const&) src/main.cpp:1753
     #3 0x102e01a44 in main src/main.cpp:4174
     #4 0x1a2b3c0dc in start+0x9dc (dyld:arm64e+0x60dc)
@@ -4044,7 +4044,7 @@ _A command that exits 0: a minimal success record (exit, measured duration, disc
 $ ./build/ripwire . --run-trace="true"
 <ctx schema="ripwire.from-trace/v1" task="run-trace: true">
 <!-- ripwire from-trace schema=ripwire.from-trace/v1: trace frames mapped to indexed symbols, innermost first; the innermost in-corpus body included. task=: the trace source this bundle maps, verbatim (a file path, stdin, or an MCP label). run exit=: the command's OWN exit code; signal=: the signal that killed it; timed_out=1: the timeout_s= cap did. run duration_ms=: wall clock, MEASURED, not deterministic; timeout_s=: the cap it ran under. run lines=: non-empty captured lines; bytes=: the whole capture; dropped_bytes=: middle bytes the cap dropped. -->
-<run exit="0" duration_ms="323" timeout_s="600" lines="0" bytes="0"/>
+<run exit="0" duration_ms="440" timeout_s="600" lines="0" bytes="0"/>
 </ctx>
 ```
 
@@ -4204,7 +4204,7 @@ _Task lens + a compact Mermaid flowchart of the top anchors' 1-hop edges._
 
 ```
 $ ./build/ripwire . --for="pagerank power iteration" --with-graph
-<ctx task="pagerank power iteration" route="subtoken+body" root="." confidence="high" margin_pct="22" at="d3605fde7" doc_mentions="5" schema="ripwire.for/v1" bundle="compact" bodies="0" reason="compact-route" budget_bytes="7500" doc_mentions_capped="1" doc_mentions_total="16" est_tokens="7617">
+<ctx task="pagerank power iteration" route="subtoken+body" root="." confidence="high" margin_pct="22" at="0712a5182" doc_mentions="5" schema="ripwire.for/v1" bundle="compact" bodies="0" reason="compact-route" budget_bytes="7500" doc_mentions_capped="1" doc_mentions_total="16" est_tokens="7617">
 <!-- ripwire for schema=ripwire.for/v1: bundle=/bodies=/reason= the body posture; d: cx= ccx= complexity, in= callers (absent cx/ccx/in = 0), churn= amp= change, clone= tested= 1, sc= scope, id=p::sc::n; total= shown= capped=1 if cut; task= the query; d pure=1 const/constexpr sig, next= the follow-up to paste; route= name-exact(X)|subtoken+body[:broad|:declined]; confidence=/margin_pct= head score drop (low=flat); h l= p= n=, c n= l= (joined for same-named callees, shown= counts them), noedge= no callee resolved; fold kind=bodies: b t= n= p= l= top ranked rows' whole bodies, not the answer; served= of total= in budget_bytes=; slice/skip p= n= l=; slice members= of=: a big class's ctor, question-word members; skip bytes= next=; a skip makes sigs next= it, sigs_next= the signatures-only re-call; d mem= an owner's direct member names by the index (question words first, names only), mem_more= names cut; t p= file outside sigs (weaker), t sym= its top symbols (a pointer, not the answer), r= rank (gap = trimmed); field name= type= owner= rel=: a member of owner=, rel=creates held by value, uses by reference/pointer; d layer=: built-in arch layer (game|infra|render|math|audio|ai|test) from a dir name in p=; d e= its last line (absent=unknown, never 0; l= the name's line); c prov=split: a resolver split arm; may be another arm's (NOT a claim the edge is false) [doc mentions: 5 docs, 3 symbols; doc_mentions=] -->
 <!-- root= is the crawl root; p= below is RELATIVE to it (single-root only; absent => p= is ingest's own path, unchanged); at=this commit(+dirty). [budget_bytes= is the default BYTE target this ranked payload was shaped toward: row text shortens toward it, no row of the ranked head is removed for it (sigs past_target=)] [sigs capped=1 with shown=total: rows shrunk, none dropped] [sigs past_target=K: the last K rows are past the budget_bytes target, served because they are rows of the ranked head; none is cut] [sigs sigs_next=: one call serving all total= rows uncut] [docs_dropped=N: N shown rows have a doc comment not printed (r>24 always, r5..24 if capped)] [docs_after_code=N: N doc rows of the shown set moved below its code rows; same rows, reordered, none added or removed; a question naming docs keeps score order] [files_first=N: N rows moved so r=1..8 are distinct files' best rows, score order, a repeated name once; same rows; fold, hops keep score order] [cut: doc_mentions_capped="1" doc_mentions_total="16" — an indexing cap dropped content not shown here]; lego/compose collapse to a counted stub by default (a disclosed cut): total= that section's own pre-cap row count, shown="0" capped="1" (nothing rendered here), next= names the sections=lego,compose flag that restores both sections byte-identically in one call est_tokens= prices this bundle in tokens -->
 <sigs shown="40" total="40" capped="1" past_target="14" docs_dropped="23" docs_after_code="6" files_first="6" sigs_next="--for=&apos;pagerank power iteration&apos; --signatures-only --token-budget=6200" next="--expand=src/prconverge.h:73:renderDisclosure">
@@ -4277,14 +4277,14 @@ _Environment self-check: binary staleness, grammars, cache dir, git, tracked-bin
 ```
 $ ./build/ripwire . --doctor
 <!-- ripwire doctor schema=ripwire.doctor/v1: setup health: <c n= ok=> checks; exit 1 when one fails. at=: commit+dirty+shallow. n=: the check's name (binary-path, grammars, cache-dir, git, tree-sitter, index-cache, layout ...). loaded=/expected=: grammars whose tags query compiled / grammars compiled in; a shortfall fails the row. dir=: the per-user cache directory scanned (TMPDIR/XDG_CACHE_HOME ladder); unwritable fails the row. blobs=N: ripwire cache blobs in dir=; the scan stops at 4096 (blobs_floor=1 then). bytes=N: total size in bytes of the blobs counted (short when truncated=1). many=1: more than 50 blobs; an eviction-sanity flag, informational, never fails the row. truncated=1: cache-dir, blob scan cut (cap or I/O error); tracked-binaries, scan SKIPPED, stale=0 unmeasured. locks=N: advisory edit-lock files under locks/; unheld ones over a day old are swept on a cache write. volatile=: this row's attributes that read LIVE machine state; a determinism diff strips them, never the row. git=0|1: git runs from PATH; 0 fails the row (churn verbs need it). repo=0|1: the root is inside a git work tree; 0 is a diagnosis, not a failure. history=0|1: the repo has at least one commit; head= prints only when it does. head=: HEAD's short sha (9 hex, the at= width). core_abi=/cpp_grammar_abi=: tree-sitter core language ABI / the C++ grammar's ABI; informational. languages=N: distinct compiled-in grammars (the grammars row's expected=). tracked=N: git ls-files count, printed even when truncated=1 (over 20000 files skips the scan). binaries=N: tracked paths that sniff as binary content. non_git=1: no git history to compare; the row passes unscanned. stale=N: tracked binaries committed before a same-dir same-stem source changed; any fails the row. cache_version=/parser_ver_lean=/parser_ver_rich=/artifact_arch=: index identity; reuse needs all four. rich_verbs=: the verbs that consume the rich artifact (rich=); every other verb reads the lean one. source=: auto (per-root blob), cache-flag (named by the cache flag) or disabled (no-cache: nothing read). lean_path=/rich_path=: the artifact files checked; one path when the cache flag named it. lean=/rich=: can THIS binary open that artifact (ok, absent, parser-version ...); format, never freshness. fsmonitor=: the checkout's core.fsmonitor at startup: unset, builtin, off, or hook (a command git runs). neutralised=1: a hook fsmonitor was overridden to false for this run; 0 when none was needed. filter_drivers=N: filter drivers the repository's own config defines; filter_scope= local|all, filter_pinned= 1 (run with an empty command) or refused. state=: layout records agree, disagree (mixed binary: rebuild clean-first), not-checked or no-records. checked=1: the cross-unit layout comparison ran; 0 = under two comparable records. units=N: translation units that registered a layout record. types=N: layout types recorded (only those registered in src/model.h); omitted on state=disagree. checks=/passed=: checks run / how many passed; exit 1 when passed= is below checks=. built_from=: the commit this binary was built from; at= is the tree HEAD now, a mismatch is normal. self=/which=: this binary's path and the one which ripwire finds on PATH; which_version= is the version line that one prints when they differ. on_path=0|1: whether a ripwire is on PATH; 0 fails the row and hint= carries the export line. same_file=1: the PATH copy is this very file (same device and inode). same_bytes=1: a different file with identical content, a copied install (ok); 0 fails the row; unknown: a file was unreadable; the row fails unverified (hint= names it). self_mtime=/self_size=/which_mtime=/which_size=: epoch mtime and byte size of each binary. hint=: the row's verdict and fix in plain text (which binary is stale, what to run). -->
-<doctor schema="ripwire.doctor/v1" checks="9" passed="8" at="d3605fde7" built_from="45d52a1ee">
-<c n="binary-path" ok="0" self="./build/ripwire" which="<path>" on_path="1" same_file="0" same_bytes="0" self_mtime="1792966777" self_size="58885368" which_mtime="1792454409" which_size="55699800" which_version="ripwi … [line truncated: 393 more bytes on this line]
+<doctor schema="ripwire.doctor/v1" checks="9" passed="8" at="0712a5182" built_from="0712a5182">
+<c n="binary-path" ok="0" self="./build/ripwire" which="<path>" on_path="1" same_file="0" same_bytes="0" self_mtime="1793006914" self_size="58886584" which_mtime="1792454409" which_size="55699800" which_version="ripwi … [line truncated: 393 more bytes on this line]
 <c n="grammars" ok="1" loaded="26" expected="26"/>
-<c n="cache-dir" ok="1" dir="<tmp>" blobs="377" bytes="2066997561" many="1" truncated="0" locks="1" volatile="blobs,blobs_floor,bytes,many,truncated,locks"/>
-<c n="git" ok="1" git="1" repo="1" history="1" head="d3605fde7"/>
+<c n="cache-dir" ok="1" dir="<tmp>" blobs="566" bytes="2139110535" many="1" truncated="0" locks="4" volatile="blobs,blobs_floor,bytes,many,truncated,locks"/>
+<c n="git" ok="1" git="1" repo="1" history="1" head="0712a5182"/>
 <c n="tree-sitter" ok="1" core_abi="15" cpp_grammar_abi="14" languages="26"/>
-<c n="tracked-binaries" ok="1" tracked="4281" binaries="33" non_git="0" truncated="0" stale="0"/>
-<c n="index-cache" ok="1" cache_version="40" parser_ver_lean="226" parser_ver_rich="227" artifact_arch="16" rich_verbs="for,uses,metrics,exemplar,context-ratio,nonlocal-state,quality-panel,verify,eval-retrieval,eval-mined,eval-skills" source="auto" lean_path="<tmp> … [line truncated: 219 more bytes on this line]
+<c n="tracked-binaries" ok="1" tracked="4295" binaries="33" non_git="0" truncated="0" stale="0"/>
+<c n="index-cache" ok="1" cache_version="43" parser_ver_lean="231" parser_ver_rich="232" artifact_arch="16" rich_verbs="for,uses,metrics,exemplar,context-ratio,nonlocal-state,quality-panel,verify,eval-retrieval,eval-mined,eval-skills" source="auto" lean_path="<tmp> … [line truncated: 219 more bytes on this line]
 <c n="git-config-trust" ok="1" fsmonitor="unset" neutralised="0" filter_drivers="0"/>
 <c n="layout" ok="1" state="agree" checked="1" units="2" types="12"/>
 </doctor>
@@ -4311,14 +4311,14 @@ _--doctor plus a LIVE integration inspection for one agent: PATH binary, install
 ```
 $ ./build/ripwire . --doctor --agent=claude
 <!-- ripwire doctor schema=ripwire.doctor/v1: setup health: <c n= ok=> checks; exit 1 when one fails. at=: commit+dirty+shallow. n=: the check's name (binary-path, grammars, cache-dir, git, tree-sitter, index-cache, layout ...). agent=: the agent named by the agent flag; its live-integration c rows follow the built-in checks. loaded=/expected=: grammars whose tags query compiled / grammars compiled in; a shortfall fails the row. dir=: the per-user cache directory scanned (TMPDIR/XDG_CACHE_HOME ladder); unwritable fails the row. blobs=N: ripwire cache blobs in dir=; the scan stops at 4096 (blobs_floor=1 then). bytes=N: total size in bytes of the blobs counted (short when truncated=1). many=1: more than 50 blobs; an eviction-sanity flag, informational, never fails the row. truncated=1: cache-dir, blob scan cut (cap or I/O error); tracked-binaries, scan SKIPPED, stale=0 unmeasured. locks=N: advisory edit-lock files under locks/; unheld ones over a day old are swept on a cache write. volatile=: this row's attributes that read LIVE machine state; a determinism diff strips them, never the row. git=0|1: git runs from PATH; 0 fails the row (churn verbs need it). repo=0|1: the root is inside a git work tree; 0 is a diagnosis, not a failure. history=0|1: the repo has at least one commit; head= prints only when it does. head=: HEAD's short sha (9 hex, the at= width). core_abi=/cpp_grammar_abi=: tree-sitter core language ABI / the C++ grammar's ABI; informational. languages=N: distinct compiled-in grammars (the grammars row's expected=). tracked=N: git ls-files count, printed even when truncated=1 (over 20000 files skips the scan). binaries=N: tracked paths that sniff as binary content. non_git=1: no git history to compare; the row passes unscanned. stale=N: tracked binaries committed before a same-dir same-stem source changed; any fails the row. cache_version=/parser_ver_lean=/parser_ver_rich=/artifact_arch=: index identity; reuse needs all four. rich_verbs=: the verbs that consume the rich artifact (rich=); every other verb reads the lean one. source=: auto (per-root blob), cache-flag (named by the cache flag) or disabled (no-cache: nothing read). lean_path=/rich_path=: the artifact files checked; one path when the cache flag named it. lean=/rich=: can THIS binary open that artifact (ok, absent, parser-version ...); format, never freshness. fsmonitor=: the checkout's core.fsmonitor at startup: unset, builtin, off, or hook (a command git runs). neutralised=1: a hook fsmonitor was overridden to false for this run; 0 when none was needed. filter_drivers=N: filter drivers the repository's own config defines; filter_scope= local|all, filter_pinned= 1 (run with an empty command) or refused. state=: layout records agree, disagree (mixed binary: rebuild clean-first), not-checked or no-records. checked=1: the cross-unit layout comparison ran; 0 = under two comparable records. units=N: translation units that registered a layout record. types=N: layout types recorded (only those registered in src/model.h); omitted on state=disagree. checks=/passed=: checks run / how many passed; exit 1 when passed= is below checks=. built_from=: the commit this binary was built from; at= is the tree HEAD now, a mismatch is normal. self=/which=: this binary's path and the one which ripwire finds on PATH; which_version= is the version line that one prints when they differ. on_path=0|1: whether a ripwire is on PATH; 0 fails the row and hint= carries the export line. same_file=1: the PATH copy is this very file (same device and inode). same_bytes=1: a different file with identical content, a copied install (ok); 0 fails the row; unknown: a file was unreadable; the row fails unverified (hint= names it). self_mtime=/self_size=/which_mtime=/which_size=: epoch mtime and byte size of each binary. hint=: the row's verdict and fix in plain text (which binary is stale, what to run). -->
-<doctor schema="ripwire.doctor/v1" checks="12" passed="10" agent="claude" at="d3605fde7" built_from="45d52a1ee">
-<c n="binary-path" ok="0" self="./build/ripwire" which="<path>" on_path="1" same_file="0" same_bytes="0" self_mtime="1792966777" self_size="58885368" which_mtime="1792454409" which_size="55699800" which_version="ripwi … [line truncated: 393 more bytes on this line]
+<doctor schema="ripwire.doctor/v1" checks="12" passed="10" agent="claude" at="0712a5182" built_from="0712a5182">
+<c n="binary-path" ok="0" self="./build/ripwire" which="<path>" on_path="1" same_file="0" same_bytes="0" self_mtime="1793006914" self_size="58886584" which_mtime="1792454409" which_size="55699800" which_version="ripwi … [line truncated: 393 more bytes on this line]
 <c n="grammars" ok="1" loaded="26" expected="26"/>
-<c n="cache-dir" ok="1" dir="<tmp>" blobs="387" bytes="2067060841" many="1" truncated="0" locks="1" volatile="blobs,blobs_floor,bytes,many,truncated,locks"/>
-<c n="git" ok="1" git="1" repo="1" history="1" head="d3605fde7"/>
+<c n="cache-dir" ok="1" dir="<tmp>" blobs="556" bytes="1852087365" many="1" truncated="0" locks="4" volatile="blobs,blobs_floor,bytes,many,truncated,locks"/>
+<c n="git" ok="1" git="1" repo="1" history="1" head="0712a5182"/>
 <c n="tree-sitter" ok="1" core_abi="15" cpp_grammar_abi="14" languages="26"/>
-<c n="tracked-binaries" ok="1" tracked="4281" binaries="33" non_git="0" truncated="0" stale="0"/>
-<c n="index-cache" ok="1" cache_version="40" parser_ver_lean="226" parser_ver_rich="227" artifact_arch="16" rich_verbs="for,uses,metrics,exemplar,context-ratio,nonlocal-state,quality-panel,verify,eval-retrieval,eval-mined,eval-skills" source="auto" lean_path="<tmp> … [line truncated: 219 more bytes on this line]
+<c n="tracked-binaries" ok="1" tracked="4295" binaries="33" non_git="0" truncated="0" stale="0"/>
+<c n="index-cache" ok="1" cache_version="43" parser_ver_lean="231" parser_ver_rich="232" artifact_arch="16" rich_verbs="for,uses,metrics,exemplar,context-ratio,nonlocal-state,quality-panel,verify,eval-retrieval,eval-mined,eval-skills" source="auto" lean_path="<tmp> … [line truncated: 219 more bytes on this line]
 <c n="git-config-trust" ok="1" fsmonitor="unset" neutralised="0" filter_drivers="0"/>
 <c n="layout" ok="1" state="agree" checked="1" units="2" types="12"/>
 <c n="claude-binary" ok="0" on_path="1" same_file="0" copied_heuristic="0" hint="reinstall the current build so Claude Code shell calls and this doctor resolve the same ripwire binary"/>
@@ -4346,7 +4346,7 @@ $ ./build/ripwire . --skipped
 <!-- ripwire skipped schema=ripwire.skipped/v1: why the index lacks a file <f p= why= bytes= limit= ext=>; indexed but unvouched <h p= why= err= err_ratio=>; <lang> census. root=: p= relative to it. indexed=N: the map's files=; indexed= + oversize= + excluded= + ignored= = every file the crawl enumerated. oversize=N: files dropped for exceeding a size ceiling (row limit= names which). excluded=N: files dropped by an exclude substring you passed. unsupported_ext=N: source/text files no grammar reads; binary assets and excluded/ignored files not counted. excluded_dirs=N: subtrees an exclude pruned; their files are UNKNOWN, not zero, and in no count here. pruned_dirs=N: subtrees pruned by built-in policy (vendor/build, CMakeCache.txt dirs); contents UNKNOWN. ignored=/ignored_dirs=: files / subtrees git ignore rules hid (else indexed); subtree contents UNKNOWN. ignore_mode=: git (rules applied), off (no-ignore flag), unavailable/root-ignored (not consulted, full walk). degraded_parse=/minified_suspect=: counts of the h rows of each why=; those files stay indexed. unmeasured=N: indexed files never parsed (doc pass, binary sniff, nest guard, read error); not health-counted. max_file_size=B: the effective per-file size ceiling in bytes (the max-file-size flag raises it). json_ceiling=/yaml_ceiling=: fixed .json/.yaml byte ceilings the max-file-size flag does NOT raise. ws_freq=R: whitespace share of the leading 4096 bytes; under 0.070 = minified-suspect (never under 256 B). x=/files=: an unindexed extension and its file count (full list; the map's unindexed= is the top 6). files=/symbols=: per language, files with its symbols (FLOOR: symbol-less files uncounted) / symbols (exact). -->
 <!-- why=extent-suspect on an <h> row = the file holds extent_suspect_syms= definitions whose extent, scope or kind FAILED a containment check (the map and bundle rows carry the reasons as extent_suspect=: name, head, scope, error); joined to the parse-health reasons comma-separated, and rowed even when the parse itself is clean. extent_suspect_files= on the root counts such rows. Nothing is dropped. -->
 <!-- why=macro-blanked on an <h> row = this file's symbols come from a SECOND parse. Its first parse held error bytes, so macro_blanked= semicolon-less ALL-CAPS function-like macro invocations, each alone on its line directly inside a class/struct/union body (a shape the C-family grammars misread as a field missing its semicolon, letting one body swallow what follows it), were replaced by spaces with every offset and line unchanged, and that re-parse was adopted because it held STRICTLY FEWER error bytes; names, spans and bodies still read the original bytes. err=, err_ratio= and degraded-parse on such a row describe the ADOPTED parse: a row without degraded-parse parsed clean once blanked. A blanked invocation stays a use of the macro name for the uses verb (role=type, as the unrepaired parse recorded it) but is no call edge, and identifiers inside its parentheses are not recorded. macro_blanked_files= on the root counts such rows. Nothing is dropped. -->
-<skipped indexed="3618" oversize="15" excluded="0" unsupported_ext="269" excluded_dirs="0" pruned_dirs="6" ignored="0" ignored_dirs="0" ignore_mode="git" degraded_parse="125" minified_suspect="3" extent_suspect_files="4" macro_blanked_files="7" unmeasured="30" max_file_size="4194304" json_ceiling="2 … [line truncated: 38 more bytes on this line]
+<skipped indexed="3631" oversize="15" excluded="0" unsupported_ext="269" excluded_dirs="0" pruned_dirs="5" ignored="0" ignored_dirs="0" ignore_mode="git" degraded_parse="125" minified_suspect="3" extent_suspect_files="4" macro_blanked_files="7" unmeasured="30" max_file_size="4194304" json_ceiling="2 … [line truncated: 38 more bytes on this line]
 <f p="bench/locbench/full560.json" why="oversize" bytes="679702" limit="262144"/>
 <f p="bench/locbench/results/r1_anchorhop/heldout_baseline_release.json" why="oversize" bytes="365776" limit="262144"/>
 <f p="bench/locbench/results/r1_anchorhop/heldout_candidate_release.json" why="oversize" bytes="365761" limit="262144"/>
@@ -4434,8 +4434,8 @@ _Rank by git change-frequency prior instead of PageRank._
 $ ./build/ripwire . --rank-by=churn --top-k=5
 <!-- ripwire map schema=ripwire.map/v1: ranked symbol map: <f p= layer=> groups <s t= n= sc= k= amb=> rows (k= rank), <c n=> resolved callees; the header comment is data. est_tokens=: price as emitted (an upper bound under compact). at=: commit+dirty+shallow. root=: p= relative to it. pr_iters=N: PageRank iterations. rank_by=: the ranker behind k=. window=: the git span mined. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. overloads=N: N same-name defs merged in this row; shown= counts each. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. <c via="name">: that callee matched by name alone (receiver unproven); it does NOT mean the edge is false. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. amb=K: K calls split over several defs. -->
 <!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
-<!-- files=3618 symbols=31790 edges=29969 shown=5 est_tokens=1214 ambiguous=2927 unresolved=15221 locality_pinned=9 external=8647 declined=30140 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
-<r schema="ripwire.map/v1" at="d3605fde7" root="." rank_by="churn" window="18mo@HEAD" est_tokens="1214" pr_iters="35">
+<!-- files=3631 symbols=31860 edges=30033 shown=5 est_tokens=1214 ambiguous=2933 unresolved=15249 locality_pinned=9 external=8658 declined=30154 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
+<r schema="ripwire.map/v1" at="0712a5182" root="." rank_by="churn" window="18mo@HEAD" est_tokens="1214" pr_iters="35">
 <f p="src/infra/Diagnostics.h" layer="infra">
 <s t="macro" n="RW_ASSUME_" overloads="2" k="0.0037">
 <c n="RW_CHECK_"/>
@@ -4467,22 +4467,22 @@ a trailing slash is ignored; absolute paths and '..' are refused). The global <r
 _Scope the recent-changes answer to ONE directory. The global <recent> block stays byte-identical, a second <recent scope="src"> page follows it — n=/of= are its counts (of= IS the total, so the paging half carries no total=), capped="1" has_more="1" next_offset= offset= limit= page it, and next= replays THIS run's own corpus flags (--since/--exclude) so the page it names is a page of the same answer. The symbol map collapses to a disclosed <symbols stubbed="1" would_show= next=/> stub — the map was not asked for and was not ranked at all, which is why the header carries no pr_iters=. merge_bombs_skipped= stays on the global block: it counts the window's skipped commits, not the directory's._
 
 ```
-$ ./build/ripwire . --rank-by=churn-decay --since=HEAD~4 --exclude=test --exclude=docs --exclude=skills --exclude=changelog.d --in=src --limit=3
+$ ./build/ripwire . --rank-by=churn-decay --since=HEAD~2 --exclude=test --exclude=docs --exclude=skills --exclude=changelog.d --in=src --limit=3
 <!-- ripwire map schema=ripwire.map/v1: ranked symbol map: <f p= layer=> groups <s t= n= sc= k= amb=> rows (k= rank), <c n=> resolved callees; the header comment is data. window: capped= has_more= next_offset= (capped=1 cut; next_offset= pastes as offset=). est_tokens=: price as emitted (an upper bound under compact). at=: commit+dirty+shallow. root=: p= relative to it. rank_by=: the ranker behind k=. window=: the git span mined. declined=K: K calls left unbound (no evidence chose one def). external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). <recent n= of=>: the n= newest-touched of of= touched files; <rc age_d=> days since its last commit, w= decayed weight. merge_bombs_skipped=N: N commits touching more than 100 INDEXED files skipped, uncounted; a file only they touched is absent; the window's count, so the global block only. <recent scope=DIR>: a second block riding when the global one does, DIR's files only (p= root-relative); of= is its total; capped=/has_more=/next_offset=/offset=/limit= page it, next= is that page. <symbols stubbed=1 would_show=N next=>: the symbol map in= did not ask for was not rendered; N is that run's own shown= — definitions counted individually as shown= counts them, so its rows follow from rows+sum(overloads-1)=shown (not the header's symbols= corpus count); next= fetches it. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. next=: the one pasteable follow-up. -->
 <!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
-<!-- files=554 symbols=15580 edges=19554 shown=0 est_tokens=1684 ambiguous=1909 unresolved=4046 locality_pinned=6 external=5661 declined=25659 skipped_oversize=15 unindexed="tsv:42,scm:24,txt:24,jsonl:23,expected:15,lock:7" unindexed_exts=12 order=important-first -->
-<r schema="ripwire.map/v1" at="d3605fde7" root="." rank_by="churn-decay" window="HEAD~4 half-life=90d" est_tokens="1684">
-<recent n="19" of="19" merge_bombs_skipped="0">
-<rc p="src/graph.h" age_d="0" w="9.76"/>
-<rc p="src/serialize.h" age_d="0" w="8.94"/>
-<rc p="src/compactlegend.h" age_d="0" w="7.93"/>
-<rc p="src/mcpverbs.h" age_d="0" w="6.85"/>
-<rc p="src/model.h" age_d="0" w="5.84"/>
-<rc p="src/verbs_for.h" age_d="0" w="4.99"/>
-<rc p="src/editcheck.h" age_d="0" w="3.92"/>
-<rc p=".github/pargates-shard-weights.json" age_d="0" w="2.99"/>
-<rc p="src/graphlegend.h" age_d="0" w="2.95"/>
-... [18 more line(s); run it to see the whole thing]
+<!-- files=554 symbols=15593 edges=19578 shown=0 est_tokens=1392 ambiguous=1912 unresolved=4049 locality_pinned=6 external=5665 declined=25670 skipped_oversize=15 unindexed="tsv:42,scm:24,txt:24,jsonl:23,expected:15,lock:7" unindexed_exts=12 order=important-first -->
+<r schema="ripwire.map/v1" at="0712a5182" root="." rank_by="churn-decay" window="HEAD~2 half-life=90d" est_tokens="1392">
+<recent n="4" of="4" merge_bombs_skipped="0">
+<rc p="src/graph.h" age_d="0" w="2"/>
+<rc p="src/model.h" age_d="0" w="2"/>
+<rc p="src/forctorhop.h" age_d="0" w="2"/>
+<rc p="src/verbs_for.h" age_d="0" w="0.999"/>
+</recent>
+<recent scope="src" n="3" of="4" capped="1" has_more="1" next_offset="3" offset="0" limit="3" next="--rank-by=churn-decay --since=HEAD~2 --exclude=test --exclude=docs --exclude=skills --exclude=changelog.d --in=src --offset=3 --limit=3">
+<rc p="src/graph.h" age_d="0" w="2"/>
+<rc p="src/model.h" age_d="0" w="2"/>
+<rc p="src/forctorhop.h" age_d="0" w="2"/>
+... [3 more line(s); run it to see the whole thing]
 ```
 
 **Shaped by:** `--external-surface`, `--doctor`, `--legend`, `--max-memory`
@@ -4544,7 +4544,7 @@ _The same gating report under --legend=full — same rows, same exit 2; the defa
 ```
 $ ./build/ripwire . --quality-delta --legend=full
 <!-- ripwire quality-delta: only what a change made WORSE against the floor baseline= names below. Descriptive: weigh and fix the real ones, do not game the number (a wrong abstraction beats a low score). TWELVE KINDS, and kind= on every row names which one: complexity over the ccx bar, verbosity (LOC), nesting, params, duplication, dead-code, api-surface (new public contract drift), error-masking, short-horizon-churn, new-clone-of-reused-helper, placeholder (added stub/TODO), defect-shape (defect= names it). THREE independent axes, in this order: (1) acked findings are suppressed entirely (acked= counts them); (2) ORIGIN — a finding on a symbol that EXISTED at the baseline is preexisting-worse (no origin attribute), one that exists only because the code is NEW carries origin="new-symbol"; (3) MATERIALITY — a small numeric delta is sev="minor", and minor= counts them. EXIT 2 fires only on preexisting-worse AND major, or on format-arity, the gating= count; new-symbol rows never gate, except defect-shape format-arity, so exit 0 is NOT a verdict on them — nothing that existed got worse, but the new debt is yours: read them. Clone kinds are new-symbol only when EVERY member is new; short-horizon-churn is preexisting by construction. preexisting-worse= and new-symbol= partition regressions=. stale= is a FOURTH axis, never gating and never counted in regressions=: rows in the .ripwire_quality_acks ledger whose target no longer applies. api-new-surface= COUNTS the new PUBLIC symbols (never gates, not in regressions=, printed even at zero). register-macro-excluded= is a FLOOR, not a finding: symbols this run excluded from the dead-code kind because their own definition is a registered self-registering test/benchmark macro call. Never gates, never counted in regressions=, printed even at zero (zero means none excluded, not that the check did not run). A gating row's next= is the one pasteable follow-up: expand on FILE:NAME, the body to fix (a duplication row names a SET and carries none). bar= on a complexity/verbosity/nesting/params row is the threshold now= is judged against (ccx 15, loc 60, nest 4, params 5). baseline="git-HEAD" means no sidecar existed, so the working tree was auto-compared against the HEAD tree — anything already committed cannot appear. at= is the git commit (plus a dirty marker when the working tree differs) this list was computed at. The registered families are doctest/Catch2 TEST_CASE, GoogleTest TEST/TEST_F/TEST_P, Google Benchmark BENCHMARK, plus any name a .ripwire_config register_macros= line adds; each registers itself through a static initializer the call graph cannot see, so zero in-edges on one is not evidence of anything. declined-call-excluded= is a FLOOR, not a finding: symbols this run kept out of the dead-code kind only because a call the resolver declined to bind (the map's declined=) could have meant them. Never gates; absent at zero. value-ref-excluded= is a FLOOR, not a finding: symbols this run kept out of the dead-code kind only because a table, field, argument or registering decorator holds them as a VALUE (matched by name; it is not a proven call; the callers verb lists the sites; @classmethod-style wrappers do not count), the --dead-code verb's own rule. Never gates; absent at zero. IDENTITY across a rename or a move: a finding is keyed path::scope::name, which a rename would destroy, so the baseline and the .ripwire_quality_acks ledger are both re-filed into the CURRENT tree's identity before either is read, by two EXACT mechanisms — git's own rename record, and equality of a whitespace-and-name-scrubbed body hash — never a similarity heuristic. renames= is how many rename pairs were read, rename_window_commits= how deep the commit window went, acked_by_rename= and acked_by_content= how many of the acked= suppressions each mechanism is responsible for. Three appear ONLY when true, so an absent one is not a silent no: renames_window_truncated= (history is deeper than the window), renames_truncated= (the pair cap was hit), renames_ambiguous= (an ancestor two current symbols both claim — refused rather than guessed). ORIGIN reads the re-filed baseline too, so a regression carried in with a rename is judged preexisting-worse and GATES instead of slipping through as new-symbol. FLOORS, stated because silence here would read as a guarantee: the two clone kinds key on a member-SET hash and are NOT re-filed, so a clone ack still dies on a rename; ORIGIN follows the rename record but never content, because the baseline stores no content id at all; and a move git recorded no rename for still reads as new-symbol. Each sa row carries key= (the ack identity as stored) and why=, which is target-gone (the key names no symbol or group any more) or finding-gone (the target survived, this kind just does not fire on it). sym= and p=path:line name WHICH ack it is, and are present exactly when the key still names a live symbol: on every finding-gone row, on none of the target-gone rows (there is nothing left to name), and on neither clone kind — a clone key hashes a member SET that no single symbol carries, so those rows are unnameable by construction rather than guessed at. Hygiene disclosure only — the ledger file is never auto-edited. ROWS: sym= is the canonical id the finding regressed on; was= and now= carry the before/after value for the numeric kinds; p="path:line" is the locator (root-relative; the first-sorting member for the clone kinds; omitted, never faked, when none resolves). churn= and surface= are per-kind classification facets (short-horizon-churn's self/ambient split; api-surface's new-symbol/contract-change tier). churn= facets never gate alone: the kind gates only on 2+ COMMITTED in-window rewrites of the edited lines. Every row the header's gating= counter counts also carries a gating attribute set to 1 — marked positively, never by the ABSENCE of sev or origin. CLONE ROWS name the whole group rather than one symbol: members= is the member list and tokens= its shared normalized-token count (the same per-group pair the clones verb reports). idiom= names a RECOGNIZED BODY SHAPE every member spells, out of a closed set of three (threshold-ladder, switch-name-table, builder-chain). idiom= alone changes nothing; a group that ALSO shares no non-keyword identifier between any two members, sits in pairwise-distinct enclosing contexts, and stays under 80 normalized tokens is an idiom COLLISION rather than a copy, and is reported minor instead of gating. Break any one of those and it gates as before, idiom= and all: two bucketing ladders over the SAME enum are a copy. The shape is read off the body's token stream and not a parse tree, so a macro-assembled body classifies as whatever its raw tokens spell — the name is printed so the call can be overruled by reading. -->
-<quality-delta baseline="git-HEAD" regressions="9" minor="1" acked="0" stale="167" preexisting-worse="6" new-symbol="3" gating="5" register-macro-excluded="62" api-new-surface="2" at="d3605fde7+dirty" renames="62" rename_window_commits="400" acked_by_rename="0" acked_by_content="0" renames_window_tr … [line truncated: 64 more bytes on this line]
+<quality-delta baseline="git-HEAD" regressions="9" minor="1" acked="0" stale="167" preexisting-worse="6" new-symbol="3" gating="5" register-macro-excluded="62" api-new-surface="2" at="0712a5182+dirty" renames="62" rename_window_commits="400" acked_by_rename="0" acked_by_content="0" renames_window_tr … [line truncated: 64 more bytes on this line]
 <r kind="api-surface" sym="src/infra/sortutil.h::rw::sortutil::nonNegativeFloatDescKey" was="1" now="2" surface="contract-change" p="src/infra/sortutil.h:109" gating="1" next="--expand=src/infra/sortutil.h:nonNegativeFloatDescKey"/>
 <r kind="complexity" sym="src/infra/sortutil.h::rw::sortutil::lessByScoreDescId" was="1" now="67" bar="15" p="src/infra/sortutil.h:49" gating="1" next="--expand=src/infra/sortutil.h:lessByScoreDescId"/>
 <r kind="dead-code" sym="src/infra/sortutil.h::rw::sortutil::nonNegativeFloatAscKeyCopy" origin="new-symbol" p="src/infra/sortutil.h:119"/>
@@ -4625,7 +4625,7 @@ _The family join: per function, which of four orthogonal evidence families fire,
 ```
 $ ./build/ripwire . --ensemble --limit=8
 <!-- ripwire ensemble schema=ripwire.ensemble/v1: four orthogonal evidence families joined, ranked by DISTINCT families fired (no composite score): <s p= n= fam= of= fired=>. window: total= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). syms_capped=/files_capped=: 1 = cut. at=: commit+dirty+shallow. root=: p= relative to it. eligible=N: functions and methods with a body, the denominator; ranked + no_family = eligible. no_family=N: eligible symbols where no family fired. bar_ccx=/bar_loc=/bar_nest=/bar_params=: absolute structural bars: cognitive cx, lines, nesting, params. rcut=N: ranks the worst readability decile covers (1 to 40); rrank= inside it fires structural. rmeasured=N: functions the readability lens measured. hcut=N: file ranks the worst churn decile covers (1 to 40); hrank= inside it fires historical. hranked=N: files with any in-window commit; 0 = historical family unavailable. cfiles=N: indexed files the confusion (atom) pack can read: C/C++/ObjC/CUDA. cscope=N: eligible symbols in those files; 0 = confusion family unavailable. lscope=N: eligible symbols in a language the naming pack reads; 0 = lexical family unavailable. shown_syms=N: symbol rows printed; the rest page with offset=next_offset. shown_files=N: file rows printed (fixed cap 20, not paged); files_capped=1 = rows dropped. e f=: the fired family: structural, lexical, confusion or historical. why=: the measurements that crossed, space separated; rule*N = that rule fired N times. top=: the file's most corroborated symbol (most families on one symbol). top_l=: that symbol's line. top_fam=N: families fired on top=, the stronger claim; file rows rank by it. union_fam=N: distinct families firing anywhere in the file (weaker: may be different symbols). union=: the names of those families. syms=N: symbols in the file where at least one family fired. families=N: evidence families joined; ranked=N: symbols at least one fired on; window=: the git span the historical family read. -->
-<ensemble schema="ripwire.ensemble/v1" families="4" eligible="17795" ranked="6921" no_family="10874" bar_ccx="15" bar_loc="60" bar_nest="4" bar_params="5" rcut="40" rmeasured="17795" hcut="40" hranked="3618" window="12mo" cfiles="810" cscope="9392" lscope="17795" shown_syms="8" syms_capped="1" shown … [line truncated: 116 more bytes on this line]
+<ensemble schema="ripwire.ensemble/v1" families="4" eligible="17849" ranked="6945" no_family="10904" bar_ccx="15" bar_loc="60" bar_nest="4" bar_params="5" rcut="40" rmeasured="17849" hcut="40" hranked="3631" window="12mo" cfiles="810" cscope="9399" lscope="17849" shown_syms="8" syms_capped="1" shown … [line truncated: 116 more bytes on this line]
 <s p="src/gitmine.h:1230" n="addRootFilesToGitPathIndex" fam="4" of="4" fired="structural,lexical,confusion,historical">
 <e f="structural" why="ccx=25 ev=6"/>
 <e f="lexical" why="naming-wordy"/>
@@ -4661,7 +4661,7 @@ _Drop matching paths (repeatable) before ranking._
 $ ./build/ripwire . --exclude=present --exclude=bench --top-k=5
 <!-- ripwire map schema=ripwire.map/v1: ranked symbol map: <f p= layer=> groups <s t= n= sc= k= amb=> rows (k= rank), <c n=> resolved callees; the header comment is data. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. pr_iters=N: PageRank iterations. <inv listed= unlisted=>: files the ranked rows show / do not (sum = files=), each named or counted below. <entry p= n=>: a program entry by its language's convention (C/Go/Rust main, Java/C# static main, a script main its module scope calls, __main__.py), callees as c rows; manifest entries not read. <ls p= n= f=>: n= unshown files under dir p=; f= names its code files, the rest (tests, docs, config, test/doc/example dirs) counted. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. overloads=N: N same-name defs merged in this row; shown= counts each. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. amb=K: K calls split over several defs. -->
 <!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
-<!-- files=3355 symbols=28547 edges=28581 shown=5 est_tokens=3271 ambiguous=2892 unresolved=12103 locality_pinned=9 external=6296 declined=27843 extent_suspect_syms=12 macro_blanked_files=7 unindexed="txt:56,mod:31,scm:24,xml:13,tsv:10,cmake:5" unindexed_exts=15 order=important-first -->
+<!-- files=3368 symbols=28617 edges=28645 shown=5 est_tokens=3271 ambiguous=2898 unresolved=12132 locality_pinned=9 external=6306 declined=27857 extent_suspect_syms=12 macro_blanked_files=7 unindexed="txt:56,mod:31,scm:24,xml:13,tsv:10,cmake:5" unindexed_exts=15 order=important-first -->
 <r schema="ripwire.map/v1" root="." est_tokens="3271" pr_iters="37">
 <f p="src/infra/nodekind.h" layer="infra">
 <s t="fn" n="kindIs" sc="rw" k="0.0041">
@@ -4692,8 +4692,8 @@ _Full map re-ranked with teleport toward git-changed files — clean tree, so ch
 $ ./build/ripwire . --map-diff --top-k=5
 <!-- ripwire map-diff schema=ripwire.map-diff/v1: the ranked map anchored at at=: what the diff touched, the map's row vocabulary. est_tokens=: price as emitted (an upper bound under compact). at=: commit+dirty+shallow. root=: p= relative to it. pr_iters=N: PageRank iterations. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. overloads=N: N same-name defs merged in this row; shown= counts each. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). changed=K: K indexed git-changed files seed the PageRank teleport (0: uniform, incl. no git). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. amb=K: K calls split over several defs. layer=: built-in arch layer (game|infra|render|math|audio|ai|test) from a dir name in p=; absent if none. -->
 <!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
-<!-- files=3618 symbols=31790 edges=29969 shown=5 est_tokens=1203 ambiguous=2927 unresolved=15221 locality_pinned=9 external=8647 declined=30140 extent_suspect_syms=12 macro_blanked_files=7 changed=0 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
-<r schema="ripwire.map-diff/v1" at="d3605fde7" root="." est_tokens="1203" pr_iters="36">
+<!-- files=3631 symbols=31860 edges=30033 shown=5 est_tokens=1203 ambiguous=2933 unresolved=15249 locality_pinned=9 external=8658 declined=30154 extent_suspect_syms=12 macro_blanked_files=7 changed=0 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
+<r schema="ripwire.map-diff/v1" at="0712a5182" root="." est_tokens="1203" pr_iters="36">
 <f p="src/infra/nodekind.h" layer="infra">
 <s t="fn" n="kindIs" sc="rw" k="0.0037">
 </s>
@@ -4726,7 +4726,7 @@ _Explicit incremental cache at a path OUTSIDE the repo (first call writes it)._
 $ ./build/ripwire . --cache=<scratch>/aux/warm2.ripwirecache --top-k=3
 <!-- ripwire map schema=ripwire.map/v1: ranked symbol map: <f p= layer=> groups <s t= n= sc= k= amb=> rows (k= rank), <c n=> resolved callees; the header comment is data. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. pr_iters=N: PageRank iterations. <inv listed= unlisted=>: files the ranked rows show / do not (sum = files=), each named or counted below. <entry p= n=>: a program entry by its language's convention (C/Go/Rust main, Java/C# static main, a script main its module scope calls, __main__.py), callees as c rows; manifest entries not read. <ls p= n= f=>: n= unshown files under dir p=; f= names its code files, the rest (tests, docs, config, test/doc/example dirs) counted. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. amb=K: K calls split over several defs. -->
 <!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
-<!-- files=3618 symbols=31790 edges=29969 shown=3 est_tokens=3272 ambiguous=2927 unresolved=15221 locality_pinned=9 external=8647 declined=30140 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
+<!-- files=3631 symbols=31860 edges=30033 shown=3 est_tokens=3272 ambiguous=2933 unresolved=15249 locality_pinned=9 external=8658 declined=30154 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
 <r schema="ripwire.map/v1" root="." est_tokens="3272" pr_iters="36">
 <f p="src/infra/nodekind.h" layer="infra">
 <s t="fn" n="kindIs" sc="rw" k="0.0037">
@@ -4776,7 +4776,7 @@ _Force a cold parse (bypass the warm TMPDIR cache) — shows the cold-vs-warm co
 $ ./build/ripwire . --no-cache --top-k=3
 <!-- ripwire map schema=ripwire.map/v1: ranked symbol map: <f p= layer=> groups <s t= n= sc= k= amb=> rows (k= rank), <c n=> resolved callees; the header comment is data. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. pr_iters=N: PageRank iterations. <inv listed= unlisted=>: files the ranked rows show / do not (sum = files=), each named or counted below. <entry p= n=>: a program entry by its language's convention (C/Go/Rust main, Java/C# static main, a script main its module scope calls, __main__.py), callees as c rows; manifest entries not read. <ls p= n= f=>: n= unshown files under dir p=; f= names its code files, the rest (tests, docs, config, test/doc/example dirs) counted. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. amb=K: K calls split over several defs. -->
 <!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
-<!-- files=3618 symbols=31790 edges=29969 shown=3 est_tokens=3272 ambiguous=2927 unresolved=15221 locality_pinned=9 external=8647 declined=30140 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
+<!-- files=3631 symbols=31860 edges=30033 shown=3 est_tokens=3272 ambiguous=2933 unresolved=15249 locality_pinned=9 external=8658 declined=30154 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
 <r schema="ripwire.map/v1" root="." est_tokens="3272" pr_iters="36">
 <f p="src/infra/nodekind.h" layer="infra">
 <s t="fn" n="kindIs" sc="rw" k="0.0037">
@@ -4807,7 +4807,7 @@ _Crawl paths the repo's own .gitignore covers (default honours it and discloses
 $ ./build/ripwire . --no-ignore --top-k=3
 <!-- ripwire map schema=ripwire.map/v1: ranked symbol map: <f p= layer=> groups <s t= n= sc= k= amb=> rows (k= rank), <c n=> resolved callees; the header comment is data. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. pr_iters=N: PageRank iterations. <inv listed= unlisted=>: files the ranked rows show / do not (sum = files=), each named or counted below. <entry p= n=>: a program entry by its language's convention (C/Go/Rust main, Java/C# static main, a script main its module scope calls, __main__.py), callees as c rows; manifest entries not read. <ls p= n= f=>: n= unshown files under dir p=; f= names its code files, the rest (tests, docs, config, test/doc/example dirs) counted. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. amb=K: K calls split over several defs. -->
 <!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
-<!-- files=3618 symbols=31790 edges=29969 shown=3 est_tokens=3272 ambiguous=2927 unresolved=15221 locality_pinned=9 external=8647 declined=30140 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
+<!-- files=3631 symbols=31860 edges=30033 shown=3 est_tokens=3272 ambiguous=2933 unresolved=15249 locality_pinned=9 external=8658 declined=30154 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
 <r schema="ripwire.map/v1" root="." est_tokens="3272" pr_iters="36">
 <f p="src/infra/nodekind.h" layer="infra">
 <s t="fn" n="kindIs" sc="rw" k="0.0037">
@@ -4843,10 +4843,10 @@ _Skip files above a size bound before parsing (note the corpus shrink in the hea
 $ ./build/ripwire . --max-file-size=8K --top-k=3
 <!-- ripwire map schema=ripwire.map/v1: ranked symbol map: <f p= layer=> groups <s t= n= sc= k= amb=> rows (k= rank), <c n=> resolved callees; the header comment is data. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. pr_iters=N: PageRank iterations. <inv listed= unlisted=>: files the ranked rows show / do not (sum = files=), each named or counted below. <entry p= n=>: a program entry by its language's convention (C/Go/Rust main, Java/C# static main, a script main its module scope calls, __main__.py), callees as c rows; manifest entries not read. <ls p= n= f=>: n= unshown files under dir p=; f= names its code files, the rest (tests, docs, config, test/doc/example dirs) counted. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. -->
 <!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
-<!-- files=2585 symbols=10204 edges=3277 shown=3 est_tokens=1702 ambiguous=263 unresolved=1014 locality_pinned=4 external=1059 declined=1195 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=1048 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
+<!-- files=2597 symbols=10248 edges=3300 shown=3 est_tokens=1702 ambiguous=266 unresolved=1012 locality_pinned=4 external=1064 declined=1198 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=1049 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
 <r schema="ripwire.map/v1" root="." est_tokens="1702" pr_iters="35">
 <f p="test/forcallerhopfix/c/fan.c" layer="test">
-<s t="fn" n="fan_target" k="0.0023">
+<s t="fn" n="fan_target" k="0.0022">
 </s>
 </f>
 <f p="test/stdmembergatefix/wrap/list.h" layer="test">
@@ -4923,7 +4923,7 @@ _Eval-only: a per-call-site census of WHICH mechanism resolved each call, and th
 $ ./build/ripwire . --pin-census=<scratch>/aux/pin_census.tsv --top-k=3
 <!-- ripwire map schema=ripwire.map/v1: ranked symbol map: <f p= layer=> groups <s t= n= sc= k= amb=> rows (k= rank), <c n=> resolved callees; the header comment is data. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. pr_iters=N: PageRank iterations. <inv listed= unlisted=>: files the ranked rows show / do not (sum = files=), each named or counted below. <entry p= n=>: a program entry by its language's convention (C/Go/Rust main, Java/C# static main, a script main its module scope calls, __main__.py), callees as c rows; manifest entries not read. <ls p= n= f=>: n= unshown files under dir p=; f= names its code files, the rest (tests, docs, config, test/doc/example dirs) counted. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. amb=K: K calls split over several defs. -->
 <!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
-<!-- files=3618 symbols=31790 edges=29969 shown=3 est_tokens=3272 ambiguous=2927 unresolved=15221 locality_pinned=9 external=8647 declined=30140 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
+<!-- files=3631 symbols=31860 edges=30033 shown=3 est_tokens=3272 ambiguous=2933 unresolved=15249 locality_pinned=9 external=8658 declined=30154 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
 <r schema="ripwire.map/v1" root="." est_tokens="3272" pr_iters="36">
 <f p="src/infra/nodekind.h" layer="infra">
 <s t="fn" n="kindIs" sc="rw" k="0.0037">
@@ -4978,9 +4978,9 @@ _--mcp-legend=inline: every answer of the stdio session carries its own legend (
 $ ./build/ripwire '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize"}' '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"whereis","arguments":{"path":".","symbol":"rankGraphTeleport"}}}' '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"whereis","arguments":{"path":".","symbol":"computeOnePairOverlap"}}}' | ./build/ripwire --mcp --mcp-legend=inline
 {"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-11-25","serverInfo":{"name":"ripwire","version":"1.0"},"capabilities":{"tools":{},"resources":{}},"instructions":"Map before reading files. Start a new task with explore; use from_trace for an error; use impact plus uses before changing a sym … [line truncated: 735 more bytes on this line]
 {"jsonrpc":"2.0","id":2,"result":{"content":[{"type":"text","text":"<!-- ripwire whereis schema=ripwire.whereis/v1: every LOCAL ref whose tree holds sym= (refs_scanned=, blobs=), HEAD first: <hit ref= tip= date= p= l= kind= t=>. window: shown= capped= (capped=1 cut). at=: commit+dirty+shallow. next= … [line truncated: 6553 more bytes on this line]
-"_index":"[index: files=3618 symbols=31790 hash=09a95744]","_fresh":"ok"}}
+"_index":"[index: files=3631 symbols=31860 hash=2da1730f]","_fresh":"ok"}}
 {"jsonrpc":"2.0","id":3,"result":{"content":[{"type":"text","text":"<!-- ripwire whereis schema=ripwire.whereis/v1: every LOCAL ref whose tree holds sym= (refs_scanned=, blobs=), HEAD first: <hit ref= tip= date= p= l= kind= t=>. window: shown= capped= (capped=1 cut). at=: commit+dirty+shallow. next= … [line truncated: 2179 more bytes on this line]
-"_index":"[index: files=3618 symbols=31790 hash=09a95744]","_fresh":"ok"}}
+"_index":"[index: files=3631 symbols=31860 hash=2da1730f]","_fresh":"ok"}}
 ```
 
 ### `--mcp-tools=LIST`
@@ -5078,14 +5078,14 @@ _Self-eval: co-change recall vs BM25._
 $ ./build/ripwire . --eval
 ripwire --eval  (co-change recovery, averaged over 80 historical commits)
   ranker     recall@5  recall@10  recall@20
-  ripwire        5.4%       6.4%      13.4%
-  BM25          13.3%      15.9%      16.9%
-  BM25sub       14.0%      23.1%      30.1%
-  BM25body      15.5%      22.3%      33.9%
-  fused          7.8%      14.6%      27.3%
-  anchored      15.5%      22.7%      34.2%
-  same-dir       0.9%       4.6%      10.9%
-  random         0.1%       0.3%       0.6%   <- floor (random ranking over F=3618 files)
+  ripwire        7.0%       7.5%      13.5%
+  BM25          15.4%      16.9%      19.0%
+  BM25sub       17.4%      25.2%      29.4%
+  BM25body      19.5%      25.7%      36.0%
+  fused         12.9%      16.3%      26.6%
+  anchored      19.7%      26.0%      36.5%
+  same-dir       2.8%       6.1%      11.4%
+  random         0.1%       0.3%       0.6%   <- floor (random ranking over F=3631 files)
   note: `ripwire` here is the DEFAULT MAP's structural-only PageRank (importance, not
         relatedness) — it is NOT what a --for/--query retrieval call ranks with. BM25 /
         BM25sub / BM25body are QUERY-TIME lexical rankers (whole-name / subtoken /
@@ -5108,19 +5108,19 @@ _Known-item retrieval eval: MRR + recall@k per ranker per query mode._
 ```
 $ ./build/ripwire . --eval-retrieval
 ripwire --eval-retrieval  (known-item, 4000 doc-commented symbols; gold is in-corpus by construction)
-  sample: population=7994 scored=4000 rule=smallest-key CAPPED — a SUBSET, not the population
+  sample: population=8003 scored=4000 rule=smallest-key CAPPED — a SUBSET, not the population
           (smallest fnv1a64(scope::name) over the population, cut on the key so an identity is never split;
            path- and order-independent, but a corpus this size is NOT graded exhaustively — say so when citing it)
   ingest: lex=rich (persisted subtoken stats; no per-query corpus re-tokenize)
   ranker    query-mode     MRR  recall@1  recall@5 recall@10
   subtoken  name         0.680     54.5%     84.8%     90.0%
-  subtoken  doc-phrase   0.903     88.3%     92.2%     93.5%
+  subtoken  doc-phrase   0.904     88.3%     92.3%     93.5%
   name-exact name         0.898     82.2%     95.9%     97.4%
-  name-exact doc-phrase   0.013      0.5%      1.9%      2.6%
-  anchored  name         0.688     56.2%     84.1%     88.7%
-  anchored  doc-phrase   0.899     87.5%     92.2%     92.9%
+  name-exact doc-phrase   0.013      0.5%      1.8%      2.6%
+  anchored  name         0.687     56.2%     84.1%     88.7%
+  anchored  doc-phrase   0.900     87.6%     92.3%     93.0%
   routed    name         0.900     82.4%     96.0%     97.6%
-  routed    doc-phrase   0.902     88.2%     92.0%     93.2%
+  routed    doc-phrase   0.902     88.3%     92.1%     93.3%
 ... [6 more line(s); run it to see the whole thing]
 ```
 
@@ -5166,7 +5166,7 @@ _Version + short build info._
 
 ```
 $ ./build/ripwire --version
-ripwire 0.6.8 (dev, AppleClang 21.0.0.21000101, emit=std::print, built_from=45d52a1ee)
+ripwire 0.6.8 (dev, AppleClang 21.0.0.21000101, emit=std::print, built_from=0712a5182)
 ```
 
 **Shaped by:** `--verify`, `--metrics`, `--deps`, `--naming-locals`, `--arch`, `--dry-run`, `--doc-drift`, `--from-trace`
diff --git a/docs/captures/COMMANDS_showcase_2026-10-26.md b/docs/captures/COMMANDS_showcase_2026-10-26.md
new file mode 100644
index 000000000..f3afc2aea
--- /dev/null
+++ b/docs/captures/COMMANDS_showcase_2026-10-26.md
@@ -0,0 +1,7925 @@
+# ripwire — every verb, run for real
+
+- **Date:** 2026-10-26 (regenerated capture; supersedes any older `docs/captures/COMMANDS_showcase_*.md`)
+- **Lives in `docs/captures/`** — a directory the crawl/retrieval lenses SKIP (`kCrawlSkipDirs`, src/ingest.h): a generated doc that quotes every verb's output out-scores the source for any query about the tool and was measured at 77% of `--recall` on this repo when it sat at the root. `test/argvdiffcheck.sh` harvests its `## `-heading command lines as differential vectors — keep that format.
+- **Version:** `ripwire 0.6.8 (dev, AppleClang 21.0.0.21000101, emit=std::print, built_from=0712a5182)`
+- **Repo:** the ripwire repo @ `0712a518` — **CLEAN — `git status --porcelain` is empty**. The diff-aware verbs (`--situ`/`--test-gate`/`--quality-delta`/`--pr-context`/`--map-diff`/`--edit-check`) answer a question about the WORKING TREE, so that condition is part of their answer and every one of their captions below states which tree it recorded against. A clean tree is the honest default for a showcase, so they appear TWICE: once here on the clean tree (their empty/exit-0 shape) and once in the final section against a throwaway `git clone --local` sandbox carrying one deliberate regression, so their real gating shapes are visible without writing a byte into the read-only repo.
+- **Corpus:** the ripwire repo itself (dogfood), via `./build/ripwire`
+- **Sandbox diff** (the last section only): `.ripwire_notes        |  2 ++
+ .ripwire_quality_acks |  1 +
+ src/infra/sortutil.h  | 31 ++++++++++++++++++++++++++++---
+ 3 files changed, 31 insertions(+), 3 deletions(-)` — one preexisting function made deeply nested, one function's arity changed 1 -> 2, one copy-paste duplicate helper, one new 8-parameter public function.
+
+**How to read the blocks:** ripwire's real XML output is minified — often ONE long line. For scanability, long minified lines are displayed re-wrapped with a line break at every tag seam (`><`). Header COMMENT lines (the legends) always appear in full — they are exempt from the per-line cut; any OTHER display line over 300 bytes is cut with a `… [line truncated: N more bytes]` marker, which can hit a long root element or row. `--plan-lanes` emits JSON and is re-wrapped at object seams the same way. Long outputs are cut to their first ~30 display lines with a `… [N more display lines; full output is M bytes]` marker giving the true size. Exit codes are recorded when non-zero; wall time when >1s.
+
+**Not run (and why):** `ripwire <git-url>` (network clone), `--listen` / `--mcp-token` / `--allow-remote-edits` (the HTTP-server posture; `--mcp` itself IS captured in its own section as a one-shot stdio JSON-RPC exchange, and `wrap claude` shows the wiring), `--arch --baseline[-update]` (state writer against the read-only repo — `--note-add` / `--quality-baseline` / `--quality-ack` / the three edit verbs / `--edit-plan` ARE shown, inside the throwaway sandbox clone; `--index-out` / `--pin-census` write to scratch), `--eval-mined` (needs a `minedpair.jsonl` artifact from `bench/mine_traces.py`; none present in the tree), `--refetch` (git-url only), `--lsp` (the editor transport — its one-shot dialogues are gated by `test/lspcheck.sh`, not by showcase blocks), `--max-memory` (the memory guard is silent on this repo by construction; its stops are gated by `test/memguardcheck.sh`), `--force` (wrap-only modifier), `--scan-skills` bare form (would sweep `~/.claude/skills`; the explicit-DIR form is shown instead), `--help` (212 lines — read it from the binary).
+
+
+---
+
+# understand a codebase cold
+
+## `./build/ripwire .`
+
+*The default ranked symbol map — start here when landing cold in a repo.*
+
+**wall time: 3.03s**
+
+`````
+<!-- ripwire map schema=ripwire.map/v1: ranked symbol map: <f p= layer=> groups <s t= n= sc= k= amb=> rows (k= rank), <c n=> resolved callees; the header comment is data. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. pr_iters=N: PageRank iterations. data_sections_cut=N: N data Sections (headings, data keys) swapped out of this top-K for lower-ranked code rows; next= pages them first. <inv listed= unlisted=>: files the ranked rows show / do not (sum = files=), each named or counted below. <entry p= n=>: a program entry by its language's convention (C/Go/Rust main, Java/C# static main, a script main its module scope calls, __main__.py), callees as c rows; manifest entries not read. <ls p= n= f=>: n= unshown files under dir p=; f= names its code files, the rest (tests, docs, config, test/doc/example dirs) counted. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. overloads=N: N same-name defs merged in this row; shown= counts each. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. <c via="name">: that callee matched by name alone (receiver unproven); it does NOT mean the edge is false. <c x=N>: N same-named via=name rows merged; callees=FILE:SYM lists all. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. amb=K: K calls split over several defs. next=: the one pasteable follow-up. -->
+<!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
+<!-- stem="1": a class/struct/interface of that file whose name shares the most subtokens with the file name, added after the file's top-K rows because the rank cut left it out (no kept row dropped; counted in shown=) -->
+<!-- files=3631 symbols=31860 edges=30033 shown=238 est_tokens=10709 ambiguous=2933 unresolved=15249 locality_pinned=9 external=8658 declined=30154 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
+<r schema="ripwire.map/v1" root="." est_tokens="10709" pr_iters="36" data_sections_cut="1" next="--graph-query=&apos;kind(all,sec)&apos; --offset=0 --limit=200">
+<f p="src/infra/nodekind.h" layer="infra">
+<s t="fn" n="kindIs" sc="rw" k="0.0037">
+</s>
+</f>
+<f p="src/infra/Diagnostics.h" layer="infra">
+<s t="macro" n="ASSUME" amb="1" k="0.0022">
+<c n="RW_ASSUME_" prov="split"/>
+<c n="RW_ASSUME_" prov="split"/>
+</s>
+<s t="macro" n="RW_ASSUME_" overloads="2" k="0.0022">
+<c n="RW_CHECK_"/>
+</s>
+<s t="macro" n="RW_CHECK_" k="0.0019">
+<c n="handleAssert" via="name"/>
+</s>
+<s t="macro" n="EXPECTS" amb="1" k="0.0017">
+<c n="RW_ASSUME_" prov="split"/>
+<c n="RW_ASSUME_" prov="split"/>
+</s>
+<s t="macro" n="ENSURES" amb="1" k="0.0010">
+<c n="RW_ASSUME_" prov="split"/>
+<c n="RW_ASSUME_" prov="split"/>
+</s>
+<s t="macro" n="DISCLOSE" k="0.0009">
+<c n="RW_DISCLOSE_ARGC_"/>
+… [815 more display lines; full output is 26584 bytes on 1 raw line(s)]
+`````
+
+stderr:
+
+`````
+ripwire: cache <tmp>: over its 2048 MiB budget — evicted 115 blob(s) of other roots or other ripwire builds (this build's blobs for this root are kept)
+`````
+
+## `./build/ripwire . --top-k=5`
+
+*Same map, capped to the 5 highest-ranked symbols.*
+
+**wall time: 1.98s**
+
+`````
+<!-- ripwire map schema=ripwire.map/v1: ranked symbol map: <f p= layer=> groups <s t= n= sc= k= amb=> rows (k= rank), <c n=> resolved callees; the header comment is data. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. pr_iters=N: PageRank iterations. <inv listed= unlisted=>: files the ranked rows show / do not (sum = files=), each named or counted below. <entry p= n=>: a program entry by its language's convention (C/Go/Rust main, Java/C# static main, a script main its module scope calls, __main__.py), callees as c rows; manifest entries not read. <ls p= n= f=>: n= unshown files under dir p=; f= names its code files, the rest (tests, docs, config, test/doc/example dirs) counted. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. overloads=N: N same-name defs merged in this row; shown= counts each. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. amb=K: K calls split over several defs. -->
+<!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
+<!-- files=3631 symbols=31860 edges=30033 shown=5 est_tokens=3336 ambiguous=2933 unresolved=15249 locality_pinned=9 external=8658 declined=30154 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
+<r schema="ripwire.map/v1" root="." est_tokens="3336" pr_iters="36">
+<f p="src/infra/nodekind.h" layer="infra">
+<s t="fn" n="kindIs" sc="rw" k="0.0037">
+</s>
+</f>
+<f p="src/infra/Diagnostics.h" layer="infra">
+<s t="macro" n="ASSUME" amb="1" k="0.0022">
+<c n="RW_ASSUME_" prov="split"/>
+<c n="RW_ASSUME_" prov="split"/>
+</s>
+<s t="macro" n="RW_ASSUME_" overloads="2" k="0.0022">
+<c n="RW_CHECK_"/>
+</s>
+</f>
+<f p="src/ingest_metrics.h">
+<s t="fn" n="nodeTextOf" k="0.0021">
+</s>
+</f>
+<inv listed="3" unlisted="3628">
+<entry p="scripts/changelog_assemble.py" n="main">
+<c n="repoRoot"/>
+<c n="fragmentNames"/>
+<c n="check"/>
+<c n="assembledEntries"/>
+<c n="release"/>
+</entry>
+<entry p="scripts/optremarks.py" n="main">
+… [67 more display lines; full output is 8280 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --top-k=5 --no-inventory`
+
+*The same capped map without its inventory tier: --top-k=5 leaves files out, so the default map appends <inv listed= unlisted=> (program entries, and the files the ranked rows left out) after its rows; --no-inventory drops that tier, and the ranked rows are the same.*
+
+**wall time: 3.23s**
+
+`````
+<!-- ripwire map schema=ripwire.map/v1: ranked symbol map: <f p= layer=> groups <s t= n= sc= k= amb=> rows (k= rank), <c n=> resolved callees; the header comment is data. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. pr_iters=N: PageRank iterations. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. overloads=N: N same-name defs merged in this row; shown= counts each. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. amb=K: K calls split over several defs. -->
+<!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
+<!-- files=3631 symbols=31860 edges=30033 shown=5 est_tokens=1115 ambiguous=2933 unresolved=15249 locality_pinned=9 external=8658 declined=30154 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
+<r schema="ripwire.map/v1" root="." est_tokens="1115" pr_iters="36">
+<f p="src/infra/nodekind.h" layer="infra">
+<s t="fn" n="kindIs" sc="rw" k="0.0037">
+</s>
+</f>
+<f p="src/infra/Diagnostics.h" layer="infra">
+<s t="macro" n="ASSUME" amb="1" k="0.0022">
+<c n="RW_ASSUME_" prov="split"/>
+<c n="RW_ASSUME_" prov="split"/>
+</s>
+<s t="macro" n="RW_ASSUME_" overloads="2" k="0.0022">
+<c n="RW_CHECK_"/>
+</s>
+</f>
+<f p="src/ingest_metrics.h">
+<s t="fn" n="nodeTextOf" k="0.0021">
+</s>
+</f>
+</r>
+`````
+
+## `./build/ripwire . --top-k=0 --expand=rankGraphTeleport`
+
+*NEW since the last capture: --top-k=0 means PAYLOAD-ONLY — no ranked map rides along with the body you asked for.*
+
+**wall time: 1.39s**
+
+`````
+<ctx schema="ripwire.expand/v1" root="." est_tokens="1241">
+<!-- ripwire expand schema=ripwire.expand/v1: full bodies: <bodies shown= total= capped=> of <b t= l= p= n= sibs= sibs_total= sibs_capped= inc=>; <calls>
+<c n= l=> resolved callees. window: shown= total= capped= (capped=1 cut). sibs_capped=/inc_capped=: 1 = cut. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. scrubbed=1: this CDATA is not the bytes (]]> split or C0 replaced). redacted=1: a credential shape rewr … [line truncated: 336 more bytes on this line]
+<bodies shown="1" total="1" capped="0">
+<b t="fn" l="11809" p="src/graph.h" n="rankGraphTeleport" sibs="&lt;file-scope&gt;,DeclinedSiteKind,kNoDeclinedList,Graph,ImplementorRow,implementorClosure,LegoClosure,LegoClosureWalk,LegoClosureWalk,take,boundOf,add,expand,legoImplementorClosure,kEdgeName,kEdgeLink,kEdgeKindMask,edgeKindByte,edgeNa … [line truncated: 1753 more bytes on this line]
+<![CDATA[inline RankedGraph rankGraphTeleport( const Graph& g, const std::vector<float>& p, float alpha = 0.85f )
+{
+    PROFILE_SCOPE_DESCRIBE( "rankGraph: PageRank (power iteration)" );
+    const std::vector<float> pw = biasPrior( g, p );
+    const std::size_t N = pw.size();
+    std::vector<double> teleport( pw.begin(), pw.end() );
+    std::vector<double> rankDouble( N, 0.0 );
+    PageRankRun         run{};   // an N == 0 graph never enters the kernel: { 0, converged } — see PageRankRun
+    if( N )
+    {
+        double teleportMass = 0.0;
+        for( const double value : teleport )
+        {
+            teleportMass += value;
+        }
+        if( teleportMass > 0.0 )
+        {
+            const double inverseMass = 1.0 / teleportMass;
+            for( double& value : teleport )
+            {
+                value *= inverseMass;
+            }
+        }
+        run = pageRankDouble( g.inEdges, g.wOutDeg, teleport, rankDouble, PageRankConfig{ .alpha = double( alpha ) } );
+    }
+    std::vector<float> r( N, 0.f );
+    std::transform( rankDouble.begin(), rankDouble.end(), r.begin(), []( double value ) { return float( value ); } );
+    return { std::move( r ), run.iterationCount, run.hasConverged };
+}]]><calls total="4"><c n="biasPrior" l="11768">inline std::vector&lt;float&gt; biasPrior( const Graph&amp; g, const std::vector&lt;float&gt;&amp; p )</c><c n="PROFILE_SCOPE_DESCRIBE" l="1282">#define PROFILE_SCOPE_DESCRIBE( desc )</c><c n="PROFILE_SCOPE_DESCRIBE" l="1296">#define PROFILE_SCOPE_DESC … [line truncated: 289 more bytes on this line]
+`````
+
+## `./build/ripwire . --top-k=0`
+
+*--top-k=0 with NO payload verb asked for — REFUSES (exit 1) naming the payload verbs, never an empty map.*
+
+**exit code: 1**
+
+`````
+(empty)
+`````
+
+stderr:
+
+`````
+ripwire: --top-k=0 means "no ranked map, payload only" — pass a payload verb (--expand=SYM / --outline=SYM / --pack-signatures / --pack-top-n=N), or use --top-k=1 for the smallest map
+`````
+
+## `./build/ripwire . --max-tokens=1500`
+
+*SHAPE the map to fit ~1500 tokens (binary-search top-K).*
+
+**wall time: 2.18s**
+
+`````
+<!-- ripwire map schema=ripwire.map/v1: ranked symbol map: <f p= layer=> groups <s t= n= sc= k= amb=> rows (k= rank), <c n=> resolved callees; the header comment is data. est_tokens=: price as emitted (an upper bound under compact). over_ceiling=1: budget not met. root=: p= relative to it. pr_iters=N: PageRank iterations. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. max_tokens=/fit_bytes=: tokens asked/the byte cap applied. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. -->
+<!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
+<!-- files=3631 symbols=31860 edges=30033 shown=1 est_tokens=925 ambiguous=2933 unresolved=15249 locality_pinned=9 external=8658 declined=30154 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 max_tokens=1500 fit_bytes=3186 over_ceiling=1 order=important-first -->
+<r schema="ripwire.map/v1" root="." est_tokens="925" pr_iters="36">
+<f p="src/infra/nodekind.h" layer="infra">
+<s t="fn" n="kindIs" sc="rw" k="0.0037">
+</s>
+</f>
+</r>
+`````
+
+## `./build/ripwire . --token-budget=100`
+
+*GATE form: exit 3 if the map's own est_tokens exceeds the budget (over-budget failure shape).*
+
+**exit code: 3** — **wall time: 2.86s**
+
+`````
+<!-- ripwire map schema=ripwire.map/v1: the ranked map WITHHELD whole, no rows: withheld=1 marks this record, withheld_est_tokens= the map's price, over budget= (the token budget asked); rerun with a larger token budget, or max-tokens to shape a map that fits. -->
+<r schema="ripwire.map/v1" withheld_est_tokens="10709" budget="100" withheld="1"/>
+`````
+
+stderr:
+
+`````
+ripwire: --token-budget exceeded: withheld_est_tokens=10709 > budget=100
+`````
+
+## `./build/ripwire . --for="incremental cache invalidation when a file content hash changes"`
+
+*The task lens: ranked signatures + quality metrics framed for the task.*
+
+**wall time: 7.14s**
+
+`````
+<ctx task="incremental cache invalidation when a file content hash changes" route="subtoken+body" root="." confidence="low" margin_pct="0" at="0712a5182" doc_mentions="5" schema="ripwire.for/v1" bundle="compact" bodies="0" reason="compact-route" budget_bytes="7500" doc_mentions_capped="1" doc_mentio … [line truncated: 31 more bytes on this line]
+<!-- ripwire for schema=ripwire.for/v1: bundle=/bodies=/reason= the body posture; d: cx= ccx= complexity, in= callers (absent cx/ccx/in = 0), churn= amp= change, clone= tested= 1, sc= scope, id=p::sc::n; total= shown= capped=1 if cut; task= the query; d pure=1 const/constexpr sig, next= the follow-up to paste; route= name-exact(X)|subtoken+body[:broad|:declined]; confidence=/margin_pct= head score drop (low=flat); h l= p= n=, c n= l= (joined for same-named callees, shown= counts them), noedge= no callee resolved; h calls capped=1 next= the call listing every callee; fold kind=bodies: b t= n= p= l= top ranked rows' whole bodies, not the answer; served= of total= in budget_bytes=; slice/skip p= n= l=; slice members= of=: a big class's ctor, question-word members; skip bytes= next=; a skip makes sigs next= it, sigs_next= the signatures-only re-call; d mem= an owner's direct member names by the index (question words first, names only), mem_more= names cut; t p= file outside sigs (weaker), t sym= its top symbols (a pointer, not the answer), r= rank (gap = trimmed); field name= type= owner= rel=: a member of owner=, rel=creates held by value, uses by reference/pointer; iface implementors=N: types implementing it, m= its method contract; d layer=: built-in arch layer (game|infra|render|math|audio|ai|test) from a dir name in p=; d e= its last line (absent=unknown, never 0; l= the name's line); c via=name: that callee matched by name alone, receiver unproven (NOT a claim the edge is false) [doc mentions: 5 docs, 3 symbols; doc_mentions=] -->
+<!-- root= is the crawl root; p= below is RELATIVE to it (single-root only; absent => p= is ingest's own path, unchanged); at=this commit(+dirty). [budget_bytes= is the default BYTE target this ranked payload was shaped toward: row text shortens toward it, no row of the ranked head is removed for it (sigs past_target=)] [sigs capped=1 with shown=total: rows shrunk, none dropped] [sigs past_target=K: the last K rows are past the budget_bytes target, served because they are rows of the ranked head; none is cut] [sigs next=: one call serving all total= rows uncut] [docs_dropped=N: N shown rows have a doc comment not printed (r>24 always, r5..24 if capped)] [files_first=N: N rows moved so r=1..8 are distinct files' best rows, score order, a repeated name once; same rows; fold, hops keep score order] [cut: doc_mentions_capped="1" doc_mentions_total="6" — an indexing cap dropped content not shown here]; lego/compose collapse to a counted stub by default (a disclosed cut): total= that section's own pre-cap row count, shown="0" capped="1" (nothing rendered here), next= names the sections=lego,compose flag that restores both sections byte-identically in one call est_tokens= prices this bundle in tokens -->
+<sigs shown="40" total="40" capped="1" past_target="15" docs_dropped="30" files_first="17" next="--for=&apos;incremental cache invalidation when a file content hash changes&apos; --signatures-only --token-budget=6700">
+<d l="136" e="136" n="kCacheMagic" p="src/ingest_cache.h" churn="279" amp="455" pure="1" r="1" next="--expand=src/ingest_cache.h:kCacheMagic">
+<doc>incremental cache (--cache): per-file content hash + raw facts so a re-run re-parses ONLY      c…</doc>constexpr std::uint32_t kCacheMagic = 0x4b505443</d>
+<d l="2329" e="2329" n="kHeadSnapCacheScheme" sc="quality" p="src/quality.h" churn="481" amp="657" pure="1" r="2">
+<doc>and every file whose content hash differs is re-parsed — so a stale or foreign blob self-heals…</doc>constexpr std::uint32_t kHeadSnapCacheScheme = 1</d>
+<d l="767" e="774" n="mcpRebuildBaseline" sc="rw" p="src/mcpindex.h" cx="2" ccx="1" in="1" churn="50" amp="121" r="3">inline McpRebuildBaseline mcpRebuildBaseline( const McpIndex&amp; ix, bool isIncrementalPass )</d>
+<d l="279" e="579" n="prewarmTagsQueries" p="src/ingest_prewarm.h" cx="53" ccx="160" in="1" churn="14" amp="52" tested="1" r="4">inline void prewarmTagsQueries( const std::vector&lt;std::string&gt;&amp; files, const HashMap&lt;std::string, FileFacts&gt;&amp; cache, long long cacheWriteNs, IngestFile … [line truncated: 20 more bytes on this line]
+<d l="277" e="306" n="ingestCommitTree" sc="rw::dmm" p="src/dmm.h" cx="6" ccx="5" in="1" churn="16" amp="77" r="5">inline bool ingestCommitTree( const std::string&amp; root, const std::string&amp; sha, const std::vector&lt;std::string&gt;&amp; excludes, std::size_t maxFileBytes, IngestResult&amp; ou … [line truncated: 7 more bytes on this line]
+<d l="9428" e="9459" n="legoImplementorsOnSurface" sc="rw" p="src/serialize.h" cx="10" ccx="13" in="2" churn="413" amp="527" r="6">inline std::vector&lt;std::vector&lt;NodeId&gt;&gt; legoImplementorsOnSurface( const IngestResult&amp; ing, const std::vector&lt;std::vector&lt;NodeId&gt;&gt;&amp; imple … [line truncated: 62 more bytes on this line]
+<d l="1635" e="1640" n="spanTierMemoPath" sc="rw" p="src/ingest_astquery.h" cx="1" in="3" churn="44" amp="139" tested="1" r="7">inline std::string spanTierMemoPath( const std::string&amp; diskPath )</d>
+<d l="762" e="959" n="runParsePool" p="src/ingest_parsepool.h" cx="25" ccx="54" in="1" churn="51" amp="137" tested="1" r="8">inline RawFacts runParsePool( IngestResult&amp; result, const char* rootDir, std::string_view cacheFile, bool captureValueUses, HashMap&lt;std::string, FileFacts&gt;&amp; cach … [line truncated: 98 more bytes on this line]
+<d l="494" e="569" n="McpIndex" sc="McpIndex" p="src/mcpindex.h" churn="50" amp="120" r="9">
+<doc>persistent in-memory index (parse once, reuse across MCP calls) ---- The MCP server is long-live…</doc>struct McpIndex</d>
+<d l="1184" e="1347" n="getIndex" sc="rw" p="src/mcpindex.h" cx="22" ccx="39" in="35" churn="50" amp="155" r="10">inline const McpIndex&amp; getIndex( const std::string&amp; root )</d>
+<d l="1870" e="1878" n="contentHash64" p="src/ingest_cache.h" cx="2" ccx="1" in="4" churn="279" amp="459" tested="1" r="11">inline std::uint64_t contentHash64( std::string_view s ) noexcept</d>
+<d l="1971" e="1978" n="CacheEntry" sc="CacheEntry" p="src/ingest_cache.h" churn="279" amp="455" r="12">struct CacheEntry</d>
+<d l="1885" e="1901" n="blobChecksum" p="src/ingest_cache.h" cx="5" ccx="5" in="4" churn="279" amp="459" tested="1" r="13">inline std::uint64_t blobChecksum( std::string_view s ) noexcept</d>
+<d l="1887" e="1911" n="contentIdsBySym" sc="quality" p="src/quality.h" cx="3" ccx="3" in="1" churn="481" amp="658" r="14">inline ContentIdIndex contentIdsBySym( const IngestResult&amp; ing, const Graph&amp; g, std::string_view root )</d>
+<d l="3126" e="3168" n="buildCacheWritePlan" p="src/ingest_cache.h" cx="11" ccx="14" in="1" churn="279" amp="456" tested="1" r="15">inline std::vector&lt;CacheWriteRow&gt; buildCacheWritePlan( const std::vector&lt;std::uint32_t&gt;&amp; orderIn, const std::vector&lt;std::uint64_t&gt;&amp; pathHashes … [line truncated: 25 more bytes on this line]
+<d l="3095" e="3113" n="buildCachePathKeys" p="src/ingest_cache.h" cx="3" ccx="3" in="1" churn="279" amp="456" tested="1" r="16">inline CachePathKeys buildCachePathKeys( const std::vector&lt;std::string&gt;&amp; files, std::string_view rootDir )</d>
+<d l="2623" e="2640" n="reAbsolutize" p="src/ingest_cache.h" cx="4" ccx="3" in="1" churn="279" amp="456" tested="1" r="17">inline std::string reAbsolutize( std::string_view rel, std::string_view root )</d>
+<d l="463" e="483" n="indexContentHash" sc="mcpdetail" p="src/mcpindex.h" cx="5" ccx="7" in="1" churn="50" amp="121" r="18">inline std::uint64_t indexContentHash( const std::vector&lt;std::string&gt;&amp; files, const std::vector&lt;long long&gt;&amp; fileMtime, const std::vector&lt;std::uint64_t&gt … [line truncated: 25 more bytes on this line]
+<d l="400" e="408" n="makeHandle" sc="mcpdetail" p="src/mcpindex.h" cx="1" in="2" churn="50" amp="122" r="19">inline std::string makeHandle( const std::string&amp; canonId, const std::string&amp; path, const std::string&amp; name, std::uint64_t contentHash )</d>
+<d l="25" e="45" n="IngestFileScan" sc="IngestFileScan" p="src/ingest_prewarm.h" churn="14" amp="51" r="20" mem="markExtractPartial">struct IngestFileScan</d>
+<d l="354" e="359" n="byteHash" sc="mcpdetail" p="src/mcpindex.h" cx="2" ccx="1" in="7" churn="50" amp="127" r="21">inline std::uint64_t byteHash( const char* data, std::size_t n ) noexcept</d>
+<d l="131" e="136" n="collectExtractPartials" p="src/ingest_prewarm.h" cx="1" in="1" churn="14" amp="52" clone="1" tested="1" r="22">inline void collectExtractPartials( const IngestFileScan&amp; scan, IngestResult&amp; result )</d>
+<d l="125" e="136" n="emitGrepHandleLegend" p="src/verbs_grep.h" cx="2" ccx="1" in="1" churn="50" amp="128" r="23">void emitGrepHandleLegend( bool enabled )</d>
+… [127 more display lines; full output is 20051 bytes on 8 raw line(s)]
+`````
+
+## `./build/ripwire . --for="rankGraphTeleport"`
+
+*Name-shaped query: the router picks name-exact BM25 (header says which/why).*
+
+**wall time: 6.06s**
+
+`````
+<ctx task="rankGraphTeleport" route="name-exact(rankGraphTeleport); anchors: rankGraphTeleport(src/graph.h)" root="." confidence="high" margin_pct="45" at="0712a5182" doc_mentions="2" schema="ripwire.for/v1" bundle="auto" bodies="1" doc_mentions_capped="1" doc_mentions_total="13" est_tokens="2084">
+<!-- ripwire for schema=ripwire.for/v1: bundle=/bodies=/reason= the body posture; d: cx= ccx= complexity, in= callers (absent cx/ccx/in = 0), churn= amp= change, clone= tested= 1, sc= scope, id=p::sc::n; total= shown= capped=1 if cut; task= the query; d pure=1 const/constexpr sig, next= the follow-up to paste; route= name-exact(X)|subtoken+body[:broad|:declined]; confidence=/margin_pct= head score drop (low=flat); b t= n= p= l= full bodies, c n= l= callee signatures; callers of=: the one function's 1-hop callers, s t= n= sc= p=file:line (n=Owner.name folds sc= on a member; sites_at= its call sites, sites_total= if cut; via=name by name only), shown= of total=; d=2 rows: their callers, d2_shown= of d2=; capped=1 if cut; floors; next= the radius; t p= file outside sigs (weaker), t sym= its top symbols (a pointer, not the answer), r= rank (gap = trimmed); d e= its last line (absent=unknown, never 0; l= the name's line); c prov=split: a resolver split arm; may be another arm's (NOT a claim the edge is false) [doc mentions: 2 docs, 1 symbol; doc_mentions=] [floor: kept 3 of 40] -->
+<!-- root= is the crawl root; p= below is RELATIVE to it (single-root only; absent => p= is ingest's own path, unchanged); at=this commit(+dirty). [cut: doc_mentions_capped="1" doc_mentions_total="13" — an indexing cap dropped content not shown here] est_tokens= prices this bundle in tokens -->
+<sigs>
+<d l="11809" e="11837" n="rankGraphTeleport" sc="rw" p="src/graph.h" cx="5" ccx="8" in="7" churn="473" amp="682" r="1" next="--expand=src/graph.h:rankGraphTeleport">
+<doc>PageRank with an explicit teleport / personalization vector p (Σp = 1). The prior is name-quality-biased through biasPrior() so all rank modes share one weighting seam; the transition matrix (edges</doc>inline RankedGraph rankGraphTeleport( const Graph&amp; g, const std::vector&lt;float&gt;&am … [line truncated: 31 more bytes on this line]
+<d l="501" n="The convergence disclosure contract" sc="rank — Personalized PageRank" p="docs/ARCHITECTURE.md" churn="70" amp="183" r="2">#### The convergence disclosure contract</d>
+<d l="6339" n="Wave-2 adversarial verification (2026-08-19) — six probes against `aa97c9e`" sc="6. Correctness and quality instruments" p="docs/EVALS.md" churn="924" amp="1281" r="3">### Wave-2 adversarial verification (2026-08-19) — six probes against `aa97c9e`</d>
+</sigs>
+<tail total="3" shown="3" capped="0">
+<t p="src/graph.h" sym="rankGraphTeleport"/>
+<t p="docs/ARCHITECTURE.md" sym="The convergence disclosure contract"/>
+<t p="docs/EVALS.md" sym="Wave-2 adversarial verification (2026-08-19) — six probes against `aa97c9e`"/>
+</tail>
+<callers of="rw::rankGraphTeleport" shown="7" total="7" capped="1" d2="48" d2_shown="4" next="--impact=rw::rankGraphTeleport">
+<s t="fn" n="getIndex" sc="rw" p="src/mcpindex.h:1184" sites_at="src/mcpindex.h:1288"/>
+<s t="fn" n="rankGraph" sc="rw" p="src/graph.h:11850" sites_at="src/graph.h:11853"/>
+<s t="fn" n="anchoredLexicalRank" sc="rw" p="src/graph.h:12496" sites_at="src/graph.h:12547"/>
+<s t="fn" n="runEval" sc="rw" p="src/eval.h:171" sites_at="src/eval.h:328"/>
+<s t="fn" n="churnDecayRanking" p="src/main.cpp:1425" sites_at="src/main.cpp:1439"/>
+<s t="fn" n="churnRankedGraph" p="src/main.cpp:1464" sites_at="src/main.cpp:1478 src/main.cpp:1479 src/main.cpp:1493"/>
+<s t="fn" n="runDefaultMap" p="src/main.cpp:1751" sites_at="src/main.cpp:1871"/>
+<s t="fn" n="fetchBody" sc="rw" p="src/mcpverbs.h:5436" d="2"/>
+<s t="fn" n="computeLensRanking" p="src/verbs_for.h:84" d="2"/>
+<s t="fn" n="dispatchMcpLine" sc="rw" p="src/mcp.h:1120" d="2"/>
+<s t="fn" n="postCheckJson" sc="mcpedit" p="src/mcpedit.h:1116" d="2"/>
+</callers>
+<bodies shown="1" total="1" capped="0">
+<b t="fn" l="11809" p="src/graph.h" n="rankGraphTeleport">
+<![CDATA[inline RankedGraph rankGraphTeleport( const Graph& g, const std::vector<float>& p, float alpha = 0.85f )
+… [28 more display lines; full output is 5868 bytes on 29 raw line(s)]
+`````
+
+## `./build/ripwire . --for="rankGraphTeleport" --no-route`
+
+*Same query with routing forced OFF (plain subtoken+body BM25) — contrast with the routed run.*
+
+**wall time: 3.19s**
+
+`````
+<ctx task="rankGraphTeleport" root="." confidence="low" margin_pct="0" at="0712a5182" doc_mentions="6" schema="ripwire.for/v1" bundle="auto" bodies="3" budget_bytes="7500" doc_mentions_capped="1" doc_mentions_total="20" est_tokens="8716">
+<!-- ripwire for schema=ripwire.for/v1: bundle=/bodies=/reason= the body posture; d: cx= ccx= complexity, in= callers (absent cx/ccx/in = 0), churn= amp= change, clone= tested= 1, sc= scope, id=p::sc::n; total= shown= capped=1 if cut; task= the query; d pure=1 const/constexpr sig, next= the follow-up to paste; confidence=/margin_pct= head score drop (low=flat); b t= n= p= l= full bodies, c n= l= callee signatures; t p= file outside sigs (weaker), t sym= its top symbols (a pointer, not the answer), r= rank (gap = trimmed); field name= type= owner= rel=: a member of owner=, rel=creates held by value, uses by reference/pointer; d layer=: built-in arch layer (game|infra|render|math|audio|ai|test) from a dir name in p=; d e= its last line (absent=unknown, never 0; l= the name's line); c prov=split: a resolver split arm; may be another arm's (NOT a claim the edge is false) [doc mentions: 6 docs, 3 symbols; doc_mentions=] -->
+<!-- root= is the crawl root; p= below is RELATIVE to it (single-root only; absent => p= is ingest's own path, unchanged); at=this commit(+dirty). [budget_bytes= is the default BYTE target this ranked payload was shaped toward: row text shortens toward it, no row of the ranked head is removed for it (sigs past_target=)] [sigs capped=1 with shown=total: rows shrunk, none dropped] [sigs past_target=K: the last K rows are past the budget_bytes target, served because they are rows of the ranked head; none is cut] [sigs next=: one call serving all total= rows uncut] [docs_dropped=N: N shown rows have a doc comment not printed (r>24 always, r5..24 if capped)] [cut: doc_mentions_capped="1" doc_mentions_total="20" — an indexing cap dropped content not shown here] est_tokens= prices this bundle in tokens -->
+<sigs shown="40" total="40" capped="1" past_target="14" docs_dropped="25" next="--for=rankGraphTeleport --signatures-only --no-route --token-budget=6600">
+<d l="11850" e="11854" n="rankGraph" sc="rw" p="src/graph.h" cx="2" ccx="1" in="10" churn="473" amp="685" r="1" next="--expand=src/graph.h:rankGraph">
+<doc>uniform-teleport PageRank (the default</doc>inline RankedGraph rankGraph( const Graph&amp; g, float alpha = 0.85f )</d>
+<d l="11809" e="11837" n="rankGraphTeleport" sc="rw" p="src/graph.h" cx="5" ccx="8" in="7" churn="473" amp="682" r="2">
+<doc>PageRank with an explicit teleport / personalization vector p (Σp = 1). The prior is name-quali…</doc>inline RankedGraph rankGraphTeleport( const Graph&amp; g, const std::vector&lt;float&gt;&amp; p, float alpha = 0.85f )</d>
+<d l="1464" e="1503" n="churnRankedGraph" p="src/main.cpp" cx="10" ccx="12" in="1" churn="453" amp="579" r="3">inline ChurnRanking churnRankedGraph( const MainDispatch&amp; d )</d>
+<d l="2385" e="2389" n="kChurnRankLegend" sc="rw" p="src/serialize.h" churn="413" amp="525" pure="1" r="4">
+<doc>L10 (2026-09-04): the old wording claimed &quot;the same corpus ranked by pagerank orders differently…</doc>inline constexpr const char* kChurnRankLegend = &quot;&lt;!-- rank_by=churn: k= is PageRank re-run with the teleport BIASED by git CHANGE-FREQUENCY over window= &quot; &quot;(a c…</d>
+<d l="11800" e="11805" n="RankedGraph" sc="RankedGraph" p="src/graph.h" churn="473" amp="675" r="5">struct RankedGraph</d>
+<d l="11843" e="11847" n="takeRank" sc="rw" p="src/graph.h" cx="1" in="2" churn="473" amp="677" r="6">inline std::vector&lt;float&gt; takeRank( RankedGraph ranked, RankDisclosure&amp; disclosureOut )</d>
+<d l="11768" e="11792" n="biasPrior" sc="rw" p="src/graph.h" cx="5" ccx="4" in="1" churn="473" amp="676" r="7">inline std::vector&lt;float&gt; biasPrior( const Graph&amp; g, const std::vector&lt;float&gt;&amp; p )</d>
+<d l="1974" e="2000" n="churnTeleportWorkspace" sc="rw" p="src/gitmine.h" cx="6" ccx="9" in="1" churn="75" amp="128" r="8">inline std::vector&lt;float&gt; churnTeleportWorkspace( const std::vector&lt;std::string&gt;&amp; rootDirs, const IngestResult&amp; ing, const char* since = &quot;18 months ago& … [line truncated: 20 more bytes on this line]
+<d l="1425" e="1462" n="churnDecayRanking" p="src/main.cpp" cx="7" ccx="7" in="1" churn="453" amp="579" r="9">inline ChurnRanking churnDecayRanking( const MainDispatch&amp; d, const rw::SinceScope&amp; sinceScope, bool isScoped, const char* verbLabel )</d>
+<d l="480" e="526" n="rankByText" sc="rw" p="src/mcpverbs.h" cx="11" ccx="19" in="1" churn="466" amp="552" r="10">inline std::string rankByText( const std::string&amp; root, std::string_view mode, int topK, bool stable = false )</d>
+<d l="48" e="49" n="pageRankDouble" sc="rw" p="src/pagerank.h" cx="1" churn="8" amp="37" r="11">PageRankRun pageRankDouble( const sparseCsr&lt;float&gt;&amp; inEdges, std::span&lt;const double&gt; weightedOutDegree, std::span&lt;const double&gt; teleport, std::span&lt;double&gt; rank…</d>
+<d l="2181" e="2193" n="churnDecayTeleport" sc="rw" p="src/gitmine.h" cx="4" ccx="3" churn="75" amp="127" r="12">inline std::vector&lt;float&gt; churnDecayTeleport( const std::string&amp; root, const IngestResult&amp; ing, const SinceScope* scope = nullptr, bool* outHasChurnEvidence = n…</d>
+<d l="240" e="244" n="didYouMean" sc="rw" p="src/didyoumean.h" cx="2" ccx="1" in="7" churn="10" amp="59" r="13">inline std::string didYouMean( const IngestResult&amp; ing, std::string_view name )</d>
+<d l="99" e="206" n="pageRankDouble" sc="rw" p="src/pagerank.cpp" cx="19" ccx="34" in="2" churn="14" amp="44" tested="1" r="14">PageRankRun pageRankDouble( const sparseCsr&lt;float&gt;&amp; inEdges, std::span&lt;const double&gt; weightedOutDegree, std::span&lt;const double&gt; teleport, std::span&lt … [line truncated: 45 more bytes on this line]
+<d l="1184" e="1347" n="getIndex" sc="rw" p="src/mcpindex.h" cx="22" ccx="39" in="35" churn="50" amp="155" r="15">inline const McpIndex&amp; getIndex( const std::string&amp; root )</d>
+<d l="2279" e="2306" n="churnDecayTeleportWorkspace" sc="rw" p="src/gitmine.h" cx="5" ccx="6" in="1" churn="75" amp="128" r="16">inline std::vector&lt;float&gt; churnDecayTeleportWorkspace( const std::vector&lt;std::string&gt;&amp; rootDirs, const IngestResult&amp; ing, bool* outHasChurnEvidence = n … [line truncated: 12 more bytes on this line]
+<d l="1974" e="1979" n="DataSectionsCut" sc="DataSectionsCut" p="src/serialize.h" churn="413" amp="525" r="17">struct DataSectionsCut</d>
+<d l="4823" n="Fixed — `rank_by` over MCP no longer answers a different ranking than `--rank-by` on a tree with uncommitted changes" sc="[0.6.2] — 2026-09-21" p="CHANGELOG.md" churn="1056" amp="925" r="18">### Fixed — `rank_by` over MCP no longer answers a different ranking than `--rank-by` on … [line truncated: 36 more bytes on this line]
+<d l="14320" n="2. Gates for A" sc="Map data Sections never crowd code out of the default map (#339 F1) — PRE-REGISTERED 2026-09-30 (before any fix code or arm number)" p="docs/EVALS.md" churn="924" amp="1281" r="19">### 2. Gates for A</d>
+<d l="12496" e="12549" n="anchoredLexicalRank" sc="rw" p="src/graph.h" cx="11" ccx="12" in="4" churn="473" amp="679" r="20">inline std::vector&lt;float&gt; anchoredLexicalRank( const Graph&amp; g, const std::vector&lt;float&gt;&amp; lex )</d>
+<d l="171" e="380" n="runEval" sc="rw" p="src/eval.h" cx="46" ccx="69" in="1" churn="18" amp="52" r="21">inline int runEval( const std::string&amp; root, const IngestResult&amp; ing, const Graph&amp; g, const std::vector&lt;char&gt;&amp; currentDiff )</d>
+<d l="501" n="The convergence disclosure contract" sc="rank — Personalized PageRank" p="docs/ARCHITECTURE.md" churn="70" amp="183" r="22">#### The convergence disclosure contract</d>
+<d l="6339" n="Wave-2 adversarial verification (2026-08-19) — six probes against `aa97c9e`" sc="6. Correctness and quality instruments" p="docs/EVALS.md" churn="924" amp="1281" r="23">### Wave-2 adversarial verification (2026-08-19) — six probes against `aa97c9e`</d>
+… [155 more display lines; full output is 24115 bytes on 72 raw line(s)]
+`````
+
+## `./build/ripwire . --for="rankGraphTeleport" --signatures-only`
+
+*T3 opt-out: the signatures-only lens (no auto bodies, no bundle="auto" attribute) — contrast with the terminal default above.*
+
+**wall time: 4.02s**
+
+`````
+<ctx task="rankGraphTeleport" route="name-exact(rankGraphTeleport); anchors: rankGraphTeleport(src/graph.h)" root="." confidence="high" margin_pct="45" at="0712a5182" doc_mentions="2" schema="ripwire.for/v1" doc_mentions_capped="1" doc_mentions_total="13" est_tokens="988">
+<!-- ripwire for schema=ripwire.for/v1: bundle=/bodies=/reason= the body posture; d: cx= ccx= complexity, in= callers (absent cx/ccx/in = 0), churn= amp= change, clone= tested= 1, sc= scope, id=p::sc::n; total= shown= capped=1 if cut; task= the query; d pure=1 const/constexpr sig, next= the follow-up to paste; route= name-exact(X)|subtoken+body[:broad|:declined]; confidence=/margin_pct= head score drop (low=flat); t p= file outside sigs (weaker), t sym= its top symbols (a pointer, not the answer), r= rank (gap = trimmed); d e= its last line (absent=unknown, never 0; l= the name's line) [doc mentions: 2 docs, 1 symbol; doc_mentions=] [floor: kept 3 of 40] -->
+<!-- root= is the crawl root; p= below is RELATIVE to it (single-root only; absent => p= is ingest's own path, unchanged); at=this commit(+dirty). [cut: doc_mentions_capped="1" doc_mentions_total="13" — an indexing cap dropped content not shown here] est_tokens= prices this bundle in tokens -->
+<sigs>
+<d l="11809" e="11837" n="rankGraphTeleport" sc="rw" p="src/graph.h" cx="5" ccx="8" in="7" churn="473" amp="682" r="1" next="--expand=src/graph.h:rankGraphTeleport">
+<doc>PageRank with an explicit teleport / personalization vector p (Σp = 1). The prior is name-quality-biased through biasPrior() so all rank modes share one weighting seam; the transition matrix (edges</doc>inline RankedGraph rankGraphTeleport( const Graph&amp; g, const std::vector&lt;float&gt;&am … [line truncated: 31 more bytes on this line]
+<d l="501" n="The convergence disclosure contract" sc="rank — Personalized PageRank" p="docs/ARCHITECTURE.md" churn="70" amp="183" r="2">#### The convergence disclosure contract</d>
+<d l="6339" n="Wave-2 adversarial verification (2026-08-19) — six probes against `aa97c9e`" sc="6. Correctness and quality instruments" p="docs/EVALS.md" churn="924" amp="1281" r="3">### Wave-2 adversarial verification (2026-08-19) — six probes against `aa97c9e`</d>
+</sigs>
+<tail total="3" shown="3" capped="0">
+<t p="src/graph.h" sym="rankGraphTeleport"/>
+<t p="docs/ARCHITECTURE.md" sym="The convergence disclosure contract"/>
+<t p="docs/EVALS.md" sym="Wave-2 adversarial verification (2026-08-19) — six probes against `aa97c9e`"/>
+</tail>
+</ctx>
+`````
+
+## `./build/ripwire . --for="tree-sitter parse of a source file" --adaptive`
+
+*Cut the result at the relevance cliff (Adaptive-k) — on a flat ranking nothing is cut and the header says so ([adaptive: kept N of N]).*
+
+**wall time: 3.70s**
+
+`````
+<ctx task="tree-sitter parse of a source file" route="subtoken+body" root="." confidence="low" margin_pct="0" at="0712a5182" doc_mentions="3" schema="ripwire.for/v1" bundle="compact" bodies="0" reason="compact-route" budget_bytes="7500" est_tokens="7604">
+<!-- ripwire for schema=ripwire.for/v1: bundle=/bodies=/reason= the body posture; d: cx= ccx= complexity, in= callers (absent cx/ccx/in = 0), churn= amp= change, clone= tested= 1, sc= scope, id=p::sc::n; total= shown= capped=1 if cut; task= the query; d pure=1 const/constexpr sig, next= the follow-up to paste; route= name-exact(X)|subtoken+body[:broad|:declined]; confidence=/margin_pct= head score drop (low=flat); h l= p= n=, c n= l= (joined for same-named callees, shown= counts them), noedge= no callee resolved; fold kind=bodies: b t= n= p= l= top ranked rows' whole bodies, not the answer; served= of total= in budget_bytes=; slice/skip p= n= l=; slice members= of=: a big class's ctor, question-word members; skip bytes= next=; a skip makes sigs next= it, sigs_next= the signatures-only re-call; d mem= an owner's direct member names by the index (question words first, names only), mem_more= names cut; t p= file outside sigs (weaker), t sym= its top symbols (a pointer, not the answer), r= rank (gap = trimmed); field name= type= owner= rel=: a member of owner=, rel=creates held by value, uses by reference/pointer; iface implementors=N: types implementing it, m= its method contract; d layer=: built-in arch layer (game|infra|render|math|audio|ai|test) from a dir name in p=; d e= its last line (absent=unknown, never 0; l= the name's line) [adaptive: kept 40 of 40 - no relevance cliff (broad query saturates the score); capped at the ceiling] [doc mentions: 3 docs, 2 symbols; doc_mentions=] -->
+<!-- root= is the crawl root; p= below is RELATIVE to it (single-root only; absent => p= is ingest's own path, unchanged); at=this commit(+dirty). [budget_bytes= is the default BYTE target this ranked payload was shaped toward: row text shortens toward it, no row of the ranked head is removed for it (sigs past_target=)] [sigs capped=1 with shown=total: rows shrunk, none dropped] [sigs past_target=K: the last K rows are past the budget_bytes target, served because they are rows of the ranked head; none is cut] [sigs next=: one call serving all total= rows uncut] [docs_dropped=N: N shown rows have a doc comment not printed (r>24 always, r5..24 if capped)] [files_first=N: N rows moved so r=1..8 are distinct files' best rows, score order, a repeated name once; same rows; fold, hops keep score order]; lego/compose collapse to a counted stub by default (a disclosed cut): total= that section's own pre-cap row count, shown="0" capped="1" (nothing rendered here), next= names the sections=lego,compose flag that restores both sections byte-identically in one call est_tokens= prices this bundle in tokens -->
+<sigs shown="40" total="40" capped="1" past_target="7" docs_dropped="25" files_first="3" next="--for=&apos;tree-sitter parse of a source file&apos; --signatures-only --adaptive --token-budget=5600">
+<d l="28" e="63" n="topLevelEvidence" sc="rw::pythonrunner" p="src/pythonrunner.h" cx="4" ccx="3" in="2" churn="5" amp="15" r="1" next="--expand=src/pythonrunner.h:topLevelEvidence">inline bool topLevelEvidence( std::string_view source, const TSLanguage* language, const Predicate&amp; predicate )</d … [line truncated: 1 more bytes on this line]
+<d l="45" e="45" n="kDefaultMaxFileBytes" sc="rw" p="src/ingest.h" churn="59" amp="165" pure="1" r="2">
+<doc>The crawl&apos;s per-file byte ceiling. A text file larger than this is skipped: at this size it is o…</doc>constexpr std::size_t kDefaultMaxFileBytes = 4u * 1024u * 1024u</d>
+<d l="1238" e="1246" n="parseTree" p="src/ingest_sidecap.h" cx="1" in="3" churn="139" amp="280" tested="1" r="3">TSTree* parseTree( TSParser* parser, std::string_view src )</d>
+<d l="593" e="667" n="doctorProbeGrammars" p="src/verbs_doctor.h" cx="7" ccx="17" in="1" churn="45" amp="129" r="4">
+<doc>Exercise every registered grammar and its embedded query, reporting loaded and expected totals</doc>inline DoctorGrammarProbe doctorProbeGrammars()</d>
+<d l="1797" e="1808" n="FileHealth" sc="FileHealth" p="src/model.h" churn="243" amp="430" r="5">struct FileHealth</d>
+<d l="100" e="232" n="kLangTable" p="src/ingest_crawl.h" churn="79" amp="208" pure="1" r="6">constexpr std::array&lt;LangEntry, 57&gt; kLangTable =</d>
+<d l="369" e="441" n="sliceAtRev" sc="slicediff" p="src/slicediff.h" cx="13" ccx="13" in="1" churn="12" amp="73" r="7">inline RevSide sliceAtRev( const std::string&amp; root, const std::string&amp; sha, const std::string&amp; rel, const Symbol&amp; sym, SliceFam fam, const ::TSLanguage* grammar…</ … [line truncated: 2 more bytes on this line]
+<d l="308" e="343" n="SliceScan" sc="SliceScan" p="src/slice.h" churn="51" amp="102" r="8" mem="disclose">struct SliceScan</d>
+<d l="456" e="491" n="AstWalk" sc="rw" p="src/ingest.h" churn="59" amp="165" r="9">enum class AstWalk : std::uint8_t</d>
+<d l="1307" e="1310" n="astroFenceTailIsBlank" p="src/ingest_sidecap.h" cx="1" in="2" churn="139" amp="279" tested="1" r="10">inline bool astroFenceTailIsBlank( std::string_view src, std::size_t from, std::size_t to ) noexcept</d>
+<d l="134" e="134" n="kMaxKotlinStringNestDepth" sc="rw" p="src/ingest.h" churn="59" amp="165" pure="1" r="11">constexpr std::uint32_t kMaxKotlinStringNestDepth = 128u</d>
+<d l="2122" e="2151" n="collectGatedLocalNames" sc="rw" p="src/ingest_astquery.h" cx="6" ccx="5" in="1" churn="44" amp="137" r="12">std::vector&lt;LocalNameFact&gt; collectGatedLocalNames( std::string_view defBytes, std::uint32_t defStartLine, Lang lang )</d>
+<d l="881" e="932" n="scanModule" sc="detail" p="src/jsrunner.h" cx="16" ccx="15" in="3" churn="17" amp="81" r="13">inline ModuleScan scanModule( std::string_view source, std::string_view path )</d>
+<d l="255" e="259" n="hasPhantomScopeSeparator" p="src/ingest_names.h" cx="2" ccx="1" in="2" churn="59" amp="163" tested="1" r="14">inline bool hasPhantomScopeSeparator( TSNode qualified ) noexcept</d>
+<d l="713" e="752" n="jsonNestsTooDeep" p="src/ingest_crawl.h" cx="13" ccx="20" in="1" churn="79" amp="209" tested="1" r="15">bool jsonNestsTooDeep( std::string_view bytes ) noexcept</d>
+<d l="87" e="97" n="hasMainGuard" sc="rw::pythonrunner" p="src/pythonrunner.h" cx="2" ccx="2" in="1" churn="5" amp="14" r="16">inline bool hasMainGuard( std::string_view source )</d>
+<d l="104" e="104" n="kMaxYamlNestDepth" sc="rw" p="src/ingest.h" churn="59" amp="165" pure="1" r="17">constexpr std::uint32_t kMaxYamlNestDepth = 64u</d>
+<d l="1819" e="1972" n="spanTiersOfFiles" sc="rw" p="src/ingest_astquery.h" cx="28" ccx="55" in="2" churn="44" amp="138" r="18">SpanTierBatch spanTiersOfFiles( std::span&lt;const std::string&gt; diskPaths, bool useMemo )</d>
+<d l="326" e="332" n="DisclosureWhy" sc="SliceScan" p="src/slice.h" churn="51" amp="102" r="19">enum class DisclosureWhy : std::uint8_t</d>
+<d l="2599" e="2663" n="sliceScanDefinition" sc="slicev" p="src/slice.h" cx="12" ccx="11" in="3" churn="51" amp="105" r="20">inline SliceScan sliceScanDefinition( const std::string&amp; src, const Symbol&amp; sym, SliceFam fam, const ::TSLanguage* grammar, std::string_view varName )</d>
+<d l="351" e="663" n="runParseWorker" p="src/ingest_parsepool.h" cx="50" ccx="116" in="1" churn="51" amp="137" tested="1" r="21">inline void runParseWorker( ParsePoolShared&amp; sh, unsigned t )</d>
+<d l="48" e="67" n="LintRule" sc="LintRule" p="src/lintrules.h" churn="55" amp="144" r="22">struct LintRule</d>
+<d l="1445" e="1470" n="measureHealthAdoptingMemberMacroReparse" p="src/ingest_sidecap.h" cx="7" ccx="6" in="2" churn="139" amp="279" tested="1" r="23">inline FileHealth measureHealthAdoptingMemberMacroReparse( TSParser* parser, Lang lang, std::string_view bytes, TreeGuard&amp; tree, MemberMacroRepa … [line truncated: 19 more bytes on this line]
+<d l="2757" e="2779" n="buildMemoryStopAttr" sc="rw" p="src/serialize.h" cx="7" ccx="8" in="2" churn="413" amp="527" r="24">inline std::string buildMemoryStopAttr( const IngestResult&amp; ing, bool json )</d>
+… [138 more display lines; full output is 19866 bytes on 44 raw line(s)]
+`````
+
+## `./build/ripwire . --for="why does src/lexical.h chooseForRanker pick name-exact BM25"`
+
+*Mention anchoring (default-on): a path and a Symbol literally named in the task get lifted; the header says what anchored.*
+
+**wall time: 3.26s**
+
+`````
+<ctx task="why does src/lexical.h chooseForRanker pick name-exact BM25" route="subtoken+body" root="." confidence="high" margin_pct="26" at="0712a5182" mention_anchored="3" doc_mentions="4" schema="ripwire.for/v1" bundle="compact" bodies="0" reason="compact-route" budget_bytes="7500" doc_mentions_ca … [line truncated: 50 more bytes on this line]
+<!-- ripwire for schema=ripwire.for/v1: bundle=/bodies=/reason= the body posture; d: cx= ccx= complexity, in= callers (absent cx/ccx/in = 0), churn= amp= change, clone= tested= 1, sc= scope, id=p::sc::n; total= shown= capped=1 if cut; task= the query; d pure=1 const/constexpr sig, next= the follow-up to paste; route= name-exact(X)|subtoken+body[:broad|:declined]; confidence=/margin_pct= head score drop (low=flat); h l= p= n=, c n= l= (joined for same-named callees, shown= counts them), noedge= no callee resolved; h qword= its name (case-folded, leading _#$@ dropped) equals that question word (by name, not resolved, not the only one), first, calls to 100 (capped=1 next= all); qword_cut= owners not so served, next= the first; fold kind=bodies: b t= n= p= l= top ranked rows' whole bodies, not the answer; served= of total= in budget_bytes=; slice/skip p= n= l=; slice members= of=: a big class's ctor, question-word members; skip bytes= next=; a skip makes sigs next= it, sigs_next= the signatures-only re-call; t p= file outside sigs (weaker), t sym= its top symbols (a pointer, not the answer), r= rank (gap = trimmed); field name= type= owner= rel=: a member of owner=, rel=creates held by value, uses by reference/pointer; iface implementors=N: types implementing it, m= its method contract; d layer=: built-in arch layer (game|infra|render|math|audio|ai|test) from a dir name in p=; d e= its last line (absent=unknown, never 0; l= the name's line); c prov=split: a resolver split arm; may be another arm's (NOT a claim the edge is false) [mention anchor: 1 file + 2 symbols; mention_anchored=] [doc mentions: 4 docs, 2 symbols; doc_mentions=] -->
+<!-- root= is the crawl root; p= below is RELATIVE to it (single-root only; absent => p= is ingest's own path, unchanged); at=this commit(+dirty). [budget_bytes= is the default BYTE target this ranked payload was shaped toward: row text shortens toward it, no row of the ranked head is removed for it (sigs past_target=)] [sigs capped=1 with shown=total: rows shrunk, none dropped] [sigs past_target=K: the last K rows are past the budget_bytes target, served because they are rows of the ranked head; none is cut] [sigs sigs_next=: one call serving all total= rows uncut] [docs_dropped=N: N shown rows have a doc comment not printed (r>24 always, r5..24 if capped)] [docs_after_code=N: N doc rows of the shown set moved below its code rows; same rows, reordered, none added or removed; a question naming docs keeps score order] [cut: doc_mentions_capped="1" doc_mentions_total="7" — an indexing cap dropped content not shown here] est_tokens= prices this bundle in tokens -->
+<sigs shown="40" total="40" capped="1" past_target="12" docs_dropped="25" docs_after_code="3" sigs_next="--for=&apos;why does src/lexical.h chooseForRanker pick name-exact BM25&apos; --signatures-only --token-budget=6200" next="--expand=src/eval.h:716:runEvalRetrieval">
+<d l="1769" e="1775" n="lexicalScoresNameExactRanked" sc="rw" p="src/lexical.h" cx="1" in="4" churn="62" amp="119" r="1" next="--expand=src/lexical.h:lexicalScoresNameExactRanked">
+<doc>The name-exact ranker AS THE RETRIEVAL LENS SERVES IT: whole-name BM25 plus the definition-over-…</doc>inline std::vector&lt;float&gt; lexicalScoresNameExactRanked( const IngestResult&amp; ing, std::string_view query, const std::vector&lt;float&gt;* symbolScoreMul )</d>
+<d l="158" e="169" n="printEvalRankerNote" sc="rw" p="src/eval.h" cx="1" in="1" churn="18" amp="52" r="2">
+<doc>P11.12: the interpretive footer for --eval&apos;s ranker table, pulled into its own function so the 9…</doc>inline void printEvalRankerNote()</d>
+<d l="716" e="795" n="runEvalRetrieval" sc="rw" p="src/eval.h" cx="7" ccx="10" in="1" churn="18" amp="52" r="3">inline int runEvalRetrieval( const IngestResult&amp; ing, const Graph&amp; g )</d>
+<d l="140" e="140" n="kWeakLexicalScoreThreshold" sc="rw" p="src/lexical.h" churn="62" amp="115" pure="1" r="4">
+<doc>calling agent knows to reformulate rather than trust the ranking. Calibrated empirically (2026-0…</doc>inline constexpr float kWeakLexicalScoreThreshold = 1.0f</d>
+<d l="2213" e="2322" n="chooseForRanker" sc="rw" p="src/lexical.h" cx="18" ccx="23" in="7" churn="62" amp="122" r="5">inline RouteChoice chooseForRanker( const IngestResult&amp; ing, std::string_view query )</d>
+<d l="6595" e="6608" n="candidatesRootTag" sc="rw" p="src/serialize.h" cx="5" ccx="4" in="1" churn="413" amp="526" r="6">inline std::string candidatesRootTag( std::size_t keep, std::size_t corpusCount, const CandidateProvenance&amp; prov )</d>
+<d l="1472" e="1625" n="lexicalScoresNameExactTiered" sc="rw" p="src/lexical.h" cx="38" ccx="65" in="2" churn="62" amp="117" r="7">inline std::vector&lt;float&gt; lexicalScoresNameExactTiered( const IngestResult&amp; ing, std::string_view query, const std::vector&lt;float&gt;* symbolScoreMul )</d>
+<d l="1089" e="1190" n="runEvalMined" sc="rw" p="src/eval.h" cx="25" ccx="38" in="1" churn="18" amp="52" r="8">inline int runEvalMined( const std::string&amp; root, const IngestResult&amp; ing, const Graph&amp; g, const std::string&amp; path )</d>
+<d l="792" e="796" n="NameCorpusStats" sc="NameCorpusStats" p="src/naminglens.h" churn="18" amp="44" r="9">struct NameCorpusStats</d>
+<d l="687" e="972" n="runEvalSkills" sc="rw" p="src/skilleval.h" cx="56" ccx="97" in="1" churn="19" amp="75" r="10">inline int runEvalSkills( const std::string&amp; root, const IngestResult&amp; ing, const Graph&amp; g, const std::string&amp; labelsPath )</d>
+<d l="47" e="62" n="hasIdentifierShape" sc="namesplit" p="src/infra/namesplit.h" layer="infra" cx="8" ccx="7" in="3" churn="9" amp="38" r="11">inline bool hasIdentifierShape( std::string_view w ) noexcept</d>
+<d l="47" e="92" n="LensRanking" sc="LensRanking" p="src/packtask.h" churn="87" amp="205" r="12">struct LensRanking</d>
+<d l="158" e="162" n="Bm25Params" sc="Bm25Params" p="src/lexical.h" churn="62" amp="115" r="13">struct Bm25Params</d>
+<d l="222" e="225" n="bm25ImpactBound" sc="rw" p="src/lexical.h" cx="1" in="1" churn="62" amp="116" r="14">inline double bm25ImpactBound( double idf, double T, const Bm25Params&amp; p ) noexcept</d>
+<d l="171" e="380" n="runEval" sc="rw" p="src/eval.h" cx="46" ccx="69" in="1" churn="18" amp="52" r="15">inline int runEval( const std::string&amp; root, const IngestResult&amp; ing, const Graph&amp; g, const std::vector&lt;char&gt;&amp; currentDiff )</d>
+<d l="84" e="321" n="computeLensRanking" p="src/verbs_for.h" cx="50" ccx="81" in="3" churn="222" amp="334" r="16">rw::LensRanking computeLensRanking( const MainDispatch&amp; d, std::string_view task, bool compactCandidate = false, bool fullDistribution = false ) // deep-tail: the file-grain tail rea … [line truncated: 65 more bytes on this line]
+<d l="31" e="31" n="kLexWeightDoc" sc="rw" p="src/lexindex.h" churn="9" amp="13" pure="1" r="17">inline constexpr int kLexWeightDoc = 2</d>
+<d l="6574" e="6580" n="CandidateProvenance" sc="CandidateProvenance" p="src/serialize.h" churn="413" amp="525" r="18">struct CandidateProvenance</d>
+<d l="1628" e="1631" n="lexicalScoresNameExact" sc="rw" p="src/lexical.h" cx="1" in="3" churn="62" amp="118" r="19">inline std::vector&lt;float&gt; lexicalScoresNameExact( const IngestResult&amp; ing, std::string_view query )</d>
+<d l="615" e="655" n="runEvalViews" p="src/main.cpp" cx="5" ccx="4" in="1" churn="453" amp="579" r="20">std::optional&lt;int&gt; runEvalViews( const MainDispatch&amp; d )</d>
+<d l="329" e="344" n="takeQualifiedIdent" sc="layout" p="src/layout.h" cx="9" ccx="8" in="6" churn="31" amp="136" r="21">inline std::string_view takeQualifiedIdent( std::string_view src, std::size_t&amp; i )</d>
+<d l="839" e="844" n="RecallSectionPick" sc="RecallSectionPick" p="src/recall.h" churn="27" amp="72" r="22">struct RecallSectionPick</d>
+<d l="665" e="681" n="binomialChoose" sc="skilleval" p="src/skilleval.h" cx="4" ccx="3" in="1" churn="19" amp="75" r="23">inline double binomialChoose( std::size_t n, std::size_t k )</d>
+… [146 more display lines; full output is 21536 bytes on 18 raw line(s)]
+`````
+
+## `./build/ripwire . --for="why does src/lexical.h chooseForRanker pick name-exact BM25" --no-mention-boost`
+
+*Same task with the anchor disabled — the contrast the flag exists for.*
+
+**wall time: 4.14s**
+
+`````
+<ctx task="why does src/lexical.h chooseForRanker pick name-exact BM25" route="subtoken+body" root="." confidence="low" margin_pct="0" at="0712a5182" doc_mentions="2" schema="ripwire.for/v1" bundle="compact" bodies="0" reason="compact-route" budget_bytes="7500" doc_mentions_capped="1" doc_mentions_t … [line truncated: 27 more bytes on this line]
+<!-- ripwire for schema=ripwire.for/v1: bundle=/bodies=/reason= the body posture; d: cx= ccx= complexity, in= callers (absent cx/ccx/in = 0), churn= amp= change, clone= tested= 1, sc= scope, id=p::sc::n; total= shown= capped=1 if cut; task= the query; d pure=1 const/constexpr sig, next= the follow-up to paste; route= name-exact(X)|subtoken+body[:broad|:declined]; confidence=/margin_pct= head score drop (low=flat); h l= p= n=, c n= l= (joined for same-named callees, shown= counts them), noedge= no callee resolved; h qword= its name (case-folded, leading _#$@ dropped) equals that question word (by name, not resolved, not the only one), first, calls to 100 (capped=1 next= all); qword_cut= owners not so served, next= the first; fold kind=bodies: b t= n= p= l= top ranked rows' whole bodies, not the answer; served= of total= in budget_bytes=; slice/skip p= n= l=; slice members= of=: a big class's ctor, question-word members; skip bytes= next=; a skip makes sigs next= it, sigs_next= the signatures-only re-call; d mem= an owner's direct member names by the index (question words first, names only), mem_more= names cut; t p= file outside sigs (weaker), t sym= its top symbols (a pointer, not the answer), r= rank (gap = trimmed); field name= type= owner= rel=: a member of owner=, rel=creates held by value, uses by reference/pointer; iface implementors=N: types implementing it, m= its method contract; d layer=: built-in arch layer (game|infra|render|math|audio|ai|test) from a dir name in p=; d e= its last line (absent=unknown, never 0; l= the name's line); c prov=split: a resolver split arm; may be another arm's (NOT a claim the edge is false) [doc mentions: 2 docs, 1 symbol; doc_mentions=] -->
+<!-- root= is the crawl root; p= below is RELATIVE to it (single-root only; absent => p= is ingest's own path, unchanged); at=this commit(+dirty). [budget_bytes= is the default BYTE target this ranked payload was shaped toward: row text shortens toward it, no row of the ranked head is removed for it (sigs past_target=)] [sigs capped=1 with shown=total: rows shrunk, none dropped] [sigs past_target=K: the last K rows are past the budget_bytes target, served because they are rows of the ranked head; none is cut] [sigs sigs_next=: one call serving all total= rows uncut] [docs_dropped=N: N shown rows have a doc comment not printed (r>24 always, r5..24 if capped)] [docs_after_code=N: N doc rows of the shown set moved below its code rows; same rows, reordered, none added or removed; a question naming docs keeps score order] [cut: doc_mentions_capped="1" doc_mentions_total="3" — an indexing cap dropped content not shown here] est_tokens= prices this bundle in tokens -->
+<sigs shown="40" total="40" capped="1" past_target="11" docs_dropped="26" docs_after_code="1" sigs_next="--for=&apos;why does src/lexical.h chooseForRanker pick name-exact BM25&apos; --signatures-only --no-mention-boost --token-budget=6100" next="--expand=src/eval.h:716:runEvalRetrieval">
+<d l="1769" e="1775" n="lexicalScoresNameExactRanked" sc="rw" p="src/lexical.h" cx="1" in="4" churn="62" amp="119" r="1" next="--expand=src/lexical.h:lexicalScoresNameExactRanked">
+<doc>The name-exact ranker AS THE RETRIEVAL LENS SERVES IT: whole-name BM25 plus the definition-over-…</doc>inline std::vector&lt;float&gt; lexicalScoresNameExactRanked( const IngestResult&amp; ing, std::string_view query, const std::vector&lt;float&gt;* symbolScoreMul )</d>
+<d l="158" e="169" n="printEvalRankerNote" sc="rw" p="src/eval.h" cx="1" in="1" churn="18" amp="52" r="2">
+<doc>P11.12: the interpretive footer for --eval&apos;s ranker table, pulled into its own function so the 9…</doc>inline void printEvalRankerNote()</d>
+<d l="716" e="795" n="runEvalRetrieval" sc="rw" p="src/eval.h" cx="7" ccx="10" in="1" churn="18" amp="52" r="3">inline int runEvalRetrieval( const IngestResult&amp; ing, const Graph&amp; g )</d>
+<d l="140" e="140" n="kWeakLexicalScoreThreshold" sc="rw" p="src/lexical.h" churn="62" amp="115" pure="1" r="4">
+<doc>calling agent knows to reformulate rather than trust the ranking. Calibrated empirically (2026-0…</doc>inline constexpr float kWeakLexicalScoreThreshold = 1.0f</d>
+<d l="6595" e="6608" n="candidatesRootTag" sc="rw" p="src/serialize.h" cx="5" ccx="4" in="1" churn="413" amp="526" r="5">inline std::string candidatesRootTag( std::size_t keep, std::size_t corpusCount, const CandidateProvenance&amp; prov )</d>
+<d l="1472" e="1625" n="lexicalScoresNameExactTiered" sc="rw" p="src/lexical.h" cx="38" ccx="65" in="2" churn="62" amp="117" r="6">inline std::vector&lt;float&gt; lexicalScoresNameExactTiered( const IngestResult&amp; ing, std::string_view query, const std::vector&lt;float&gt;* symbolScoreMul )</d>
+<d l="1089" e="1190" n="runEvalMined" sc="rw" p="src/eval.h" cx="25" ccx="38" in="1" churn="18" amp="52" r="7">inline int runEvalMined( const std::string&amp; root, const IngestResult&amp; ing, const Graph&amp; g, const std::string&amp; path )</d>
+<d l="792" e="796" n="NameCorpusStats" sc="NameCorpusStats" p="src/naminglens.h" churn="18" amp="44" r="8">struct NameCorpusStats</d>
+<d l="687" e="972" n="runEvalSkills" sc="rw" p="src/skilleval.h" cx="56" ccx="97" in="1" churn="19" amp="75" r="9">inline int runEvalSkills( const std::string&amp; root, const IngestResult&amp; ing, const Graph&amp; g, const std::string&amp; labelsPath )</d>
+<d l="47" e="62" n="hasIdentifierShape" sc="namesplit" p="src/infra/namesplit.h" layer="infra" cx="8" ccx="7" in="3" churn="9" amp="38" r="10">inline bool hasIdentifierShape( std::string_view w ) noexcept</d>
+<d l="47" e="92" n="LensRanking" sc="LensRanking" p="src/packtask.h" churn="87" amp="205" r="11">struct LensRanking</d>
+<d l="158" e="162" n="Bm25Params" sc="Bm25Params" p="src/lexical.h" churn="62" amp="115" r="12">struct Bm25Params</d>
+<d l="2213" e="2322" n="chooseForRanker" sc="rw" p="src/lexical.h" cx="18" ccx="23" in="7" churn="62" amp="122" r="13">inline RouteChoice chooseForRanker( const IngestResult&amp; ing, std::string_view query )</d>
+<d l="222" e="225" n="bm25ImpactBound" sc="rw" p="src/lexical.h" cx="1" in="1" churn="62" amp="116" r="14">inline double bm25ImpactBound( double idf, double T, const Bm25Params&amp; p ) noexcept</d>
+<d l="171" e="380" n="runEval" sc="rw" p="src/eval.h" cx="46" ccx="69" in="1" churn="18" amp="52" r="15">inline int runEval( const std::string&amp; root, const IngestResult&amp; ing, const Graph&amp; g, const std::vector&lt;char&gt;&amp; currentDiff )</d>
+<d l="84" e="321" n="computeLensRanking" p="src/verbs_for.h" cx="50" ccx="81" in="3" churn="222" amp="334" r="16">rw::LensRanking computeLensRanking( const MainDispatch&amp; d, std::string_view task, bool compactCandidate = false, bool fullDistribution = false ) // deep-tail: the file-grain tail rea … [line truncated: 65 more bytes on this line]
+<d l="31" e="31" n="kLexWeightDoc" sc="rw" p="src/lexindex.h" churn="9" amp="13" pure="1" r="17">inline constexpr int kLexWeightDoc = 2</d>
+<d l="6574" e="6580" n="CandidateProvenance" sc="CandidateProvenance" p="src/serialize.h" churn="413" amp="525" r="18">struct CandidateProvenance</d>
+<d l="1628" e="1631" n="lexicalScoresNameExact" sc="rw" p="src/lexical.h" cx="1" in="3" churn="62" amp="118" r="19">inline std::vector&lt;float&gt; lexicalScoresNameExact( const IngestResult&amp; ing, std::string_view query )</d>
+<d l="615" e="655" n="runEvalViews" p="src/main.cpp" cx="5" ccx="4" in="1" churn="453" amp="579" r="20">std::optional&lt;int&gt; runEvalViews( const MainDispatch&amp; d )</d>
+<d l="329" e="344" n="takeQualifiedIdent" sc="layout" p="src/layout.h" cx="9" ccx="8" in="6" churn="31" amp="136" r="21">inline std::string_view takeQualifiedIdent( std::string_view src, std::size_t&amp; i )</d>
+<d l="839" e="844" n="RecallSectionPick" sc="RecallSectionPick" p="src/recall.h" churn="27" amp="72" r="22">struct RecallSectionPick</d>
+<d l="665" e="681" n="binomialChoose" sc="skilleval" p="src/skilleval.h" cx="4" ccx="3" in="1" churn="19" amp="75" r="23">inline double binomialChoose( std::size_t n, std::size_t k )</d>
+… [156 more display lines; full output is 21827 bytes on 18 raw line(s)]
+`````
+
+## `./build/ripwire . --lego=Vehicle`
+
+*Interface -> implementors view: every existing impl of the named interface; the method contract is extracted for the C-family/Java/TS/Python tiers — for a Rust trait (this fixture) it discloses caveat="not-extracted-for-lang" rather than an empty list.*
+
+**wall time: 1.30s**
+
+`````
+<ctx schema="ripwire.lego/v1" root=".">
+<!-- ripwire lego schema=ripwire.lego/v1: ONE interface/base type: <iface n= p= defs= implementors=>, its <m> method contract, every implementor. counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. root=: p= relative to it. methods=0 caveat=not-extracted-for-lang: no <m> contract read for this language. -->
+<lego graph_ambiguous="2933" graph_unresolved="15249" graph_unindexed="269" counts_floor="1">
+<iface n="Vehicle" p="test/legofix/vehicle.rs" methods="0" caveat="not-extracted-for-lang" defs="1" implementors="2">
+<impl n="Car" p="test/legofix/vehicle.rs:12"/>
+<impl n="Bike" p="test/legofix/vehicle.rs:13"/>
+</iface>
+</lego>
+</ctx>
+`````
+
+## `./build/ripwire . --exemplar="format byte sizes for humans"`
+
+*The repo's best-in-class instance to imitate before writing new code (picked by ROLE).*
+
+**wall time: 2.58s**
+
+`````
+<!-- ripwire exemplar schema=ripwire.exemplar/v1: the best-in-class instance of kind= for the task, chosen by role: n= p= in= ccx= tested=, <bodies>
+<b> to imitate. window: shown= total= capped= (capped=1 cut). root=: p= relative to it. candidates=N: instances of kind= under the ccx ceiling the pick was ranked from. low_confidence=1: weak task-to-kind match, fell back to fn; pass a kind (fn|method|class...) instead. -->
+<exemplar schema="ripwire.exemplar/v1" kind="fn" candidates="15359" n="kindIs" p="src/infra/nodekind.h:46" in="337" ccx="3" root="." tested="1" low_confidence="1">
+<bodies shown="1" total="1" capped="0">
+<b t="fn" l="46" p="src/infra/nodekind.h" n="kindIs">
+<![CDATA[inline bool kindIs( const char* t, const char ( &lit )[N] ) noexcept
+{
+    for( std::size_t i = 0; i < N; ++i )   // N includes lit's NUL — comparing it is what makes this equality, not a prefix test
+    {
+        if( t[i] != lit[i] )
+        {
+            return false;
+        }
+    }
+    return true;
+}]]></b></bodies></exemplar>
+`````
+
+## `./build/ripwire . --help-task="calls(runDefaultMap, rankGraphTeleport)"`
+
+*Deterministic enhanced help: a closed claim in the task is a structured shape, so the router recommends the ONE command that answers it (--verify) with the evidence behind the pick. Advice only — nothing executes.*
+
+**wall time: 2.10s**
+
+`````
+<!-- ripwire help-task schema=ripwire.help-task/v1: which verb answers this task: status=recommend|abstain confidence= score= margin=, <facts> the evidence. choice intent= skill= reason=: the route matched, the skill owning it, the evidence in words. git=/dirty=: the root is a git repo / its tree differs from HEAD (the stamp's +dirty). trace=1: the task text has a stack/sanitizer trace shape; it routes to from-trace. resolved_symbols=N: indexed names the task NAMES; a bare short/common word needs backticks or F(). -->
+<task-route schema="ripwire.help-task/v1" status="recommend" confidence="high" score="100" margin="100">
+<facts git="1" dirty="0" trace="0" resolved_symbols="2"/>
+<choice intent="verify-claim" skill="ripwire-navigate" reason="closed claim grammar" score="100">
+<run>ripwire &apos;.&apos; --verify=&apos;calls(runDefaultMap, rankGraphTeleport)&apos;</run>
+</choice>
+</task-route>
+`````
+
+## `./build/ripwire . --help-task="write a cheerful release announcement"`
+
+*The honest half of the contract: a task with no ripwire-shaped evidence ABSTAINS with zero commands rather than guessing.*
+
+**wall time: 2.94s**
+
+`````
+<!-- ripwire help-task schema=ripwire.help-task/v1: which verb answers this task: status=recommend|abstain confidence= score= margin=, <facts> the evidence. git=/dirty=: the root is a git repo / its tree differs from HEAD (the stamp's +dirty). trace=1: the task text has a stack/sanitizer trace shape; it routes to from-trace. resolved_symbols=N: indexed names the task NAMES; a bare short/common word needs backticks or F(). -->
+<task-route schema="ripwire.help-task/v1" status="abstain" confidence="none" score="0" margin="0">
+<facts git="1" dirty="0" trace="0" resolved_symbols="0"/>
+</task-route>
+`````
+
+## `./build/ripwire . --recall="quality delta gating exit codes"`
+
+*Most relevant DOCS' full bodies (markdown only) — recall what is already written down.*
+
+**wall time: 1.28s**
+
+`````
+ripwire recall — "quality delta gating exit codes" — 122 relevant of 270 document files, best-first — total=122 shown=8 capped=1 truncated=6 generated_demoted=3 max_tokens=8000 share_bytes=2468 est_tokens=4165
+
+━━ README.md  (relevance 8.093) ━━  [sections: 2 of 25 selected (60 in doc), section-granular; whole doc 222723 B; lines="2747-2759,2760-2767"; dropped_by_budget=23]
+#### 6.2 Exit codes
+
+This is the part to wire into a script.
+
+| Code | Meaning |
+| --- | --- |
+| 0 | The command completed. |
+| 1 | The command refused the request. A refusal names the reason on stderr. When `--callers`, `--callees`, `--uses`, `--impact` or `--path` refuse a selector that matches no indexed definition, they also print an answer on stdout: the verb's element with `found="0"` and the name to retry with. |
+| 2 | A policy gate fired: `--arch` found a layering violation, `--scan-skill` found a CRITICAL, `--quality-delta` found new debt. |
+| 3 | The output exceeded the token budget that you set. |
+| 4 | `--test-gate` found an open obligation. |
+| 5 | The memory guard stopped the run: over `--max-memory` (default 65% of the machine's memory) with no partial answer possible, or a verb other than the default map facing a partial index. One stderr line names the limit and the override. |
+
+#### 6.3 JSON output
+
+`--json` emits JSON instead of XML, with keys mirroring the XML attribute names one to one. It is an
+allow-list: the default map, `--for`, `--pack-task`, `--callers`, `--callees`, `--impact`,
+`--quality-delta`, `--test-gate`, `--metrics`, and `--plan-lanes`, which is JSON-native. Every other
+verb refuses on stderr with exit 1 rather than silently falling back to XML, so a verb added tomorrow
+refuses by default.
+
+
+
+━━ CHANGELOG.md  (relevance 7.518) ━━  [sections: 1 of 109 selected (451 in doc), section-granular; whole doc 998064 B; lines="558-579"; dropped_by_budget=108]  [truncated: 2264 of 3826 bytes]
+### Changed — `--quality-delta=A..B` answers the kinds it can under memory pressure, and exits 6 when that answer has no gating row (#387 follow-up)
+
+A tripped memory guard in the range form used to give exit 5 and nothing, so on a large repository a four-file change
+… [114 more lines, 10620 bytes total]
+`````
+
+## `./build/ripwire <scratch>/aux/kbcorpus --recall="field affinity cache line data layout which fields are read together" --top-k=3 --max-tokens=1200`
+
+*The directory-as-knowledge-base pattern: --recall pointed at a 1353762-byte scratch dir of DUMPED TOOL OUTPUT (a git log, this repo's own generated command reference, --help text, an architecture doc, a fabricated JSON access log) instead of a source repo — no index to build, no daemon.*
+
+`````
+ripwire recall — "field affinity cache line data layout which fields are read together" — 2 relevant of 2 document files, best-first — total=2 shown=1 capped=1 truncated=1 max_tokens=1200 share_bytes=2040 est_tokens=957
+
+━━ commands.md  (relevance 10.117) ━━  [sections: 1 of 164 selected (192 in doc), section-granular; whole doc 589307 B; lines="3838-3842"; dropped_by_budget=163]  [truncated: 1865 of 7738 bytes]
+### `--field-affinity[=STRUCT]`
+
+**Answers:** find fields that are read together but declared far apart — the cache-locality lens the CACHE-LOCALITY lens: which fields are READ TOGETHER but declared FAR APART.
+
+Builds a static field CO-ACCESS affinity graph (one observation per indexed C-family function body) and diffs it against the DECLARED field order and 64-byte cache-line geometry, reusing --layout's LP64 offset model. Bare = every aggregate in the repo, ranked by separation cost; =STRUCT narrows the  … [line truncated: 1355 more bytes on this line]
+
+(capped: 1 of 2 relevant document files omitted — raise --max-tokens/budget_tokens or narrow the query for 1 more (~2548-byte budget))
+`````
+
+stderr:
+
+`````
+ripwire: redacted 1 secret from emitted context (keyword-gated-secret=1) — pass --no-redact to disable
+`````
+
+## `./build/ripwire . --tree`
+
+*File-by-file orientation map (top symbols per file).*
+
+**wall time: 1.18s**
+
+`````
+<!-- ripwire tree schema=ripwire.tree/v1: each file with its top 3 symbols by rank, files by best symbol: <file p= symbols=> of <s t= n=>; of files= indexed, files_unlisted= have none. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). symbols_capped=: 1 = cut. root=: p= relative to it. pr_iters=N: PageRank iterations. shown_symbols=: <s> rows printed. next=: the one pasteable follow-up. -->
+<tree schema="ripwire.tree/v1" files="3631" files_unlisted="79" shown="80" capped="1" total="3552" has_more="1" next_offset="80" offset="0" limit="0" pr_iters="36" root="." shown_symbols="235" symbols_capped="1" next="--tree --offset=80">
+<file p="src/infra/nodekind.h" symbols="1">
+<s t="fn" n="kindIs"/>
+</file>
+<file p="src/infra/Diagnostics.h" symbols="87">
+<s t="macro" n="ASSUME"/>
+<s t="macro" n="RW_ASSUME_"/>
+<s t="macro" n="RW_ASSUME_"/>
+</file>
+<file p="src/ingest_metrics.h" symbols="58">
+<s t="fn" n="nodeTextOf"/>
+<s t="fn" n="nodeFieldText"/>
+<s t="struct" n="CtrlKind"/>
+</file>
+<file p="src/infra/diagnostics.cpp" symbols="15">
+<s t="method" n="handleAssert"/>
+<s t="fn" n="orEmpty"/>
+<s t="fn" n="writeNotice"/>
+</file>
+<file p="src/infra/fieldid.h" symbols="13">
+<s t="fn" n="fieldChild"/>
+<s t="fn" n="fieldIdFor"/>
+<s t="fn" n="fieldIdRegistry"/>
+</file>
+<file p="src/infra/emit.h" symbols="29">
+<s t="fn" n="formatTo"/>
+<s t="fn" n="emitTo"/>
+<s t="fn" n="emitTo"/>
+</file>
+… [368 more display lines; full output is 11197 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --html=<scratch>/aux/map2.html`
+
+*Self-contained HTML force-directed call graph.*
+
+**wall time: 5.02s**
+
+`````
+(empty)
+`````
+
+Artifact written:
+
+`````
+  156034 <scratch>/aux/map2.html
+`````
+
+## `./build/ripwire . --order=stable --top-k=5`
+
+*Stable (path/id) emit order — provider KV-cache hits across re-runs.*
+
+**wall time: 1.78s**
+
+`````
+<!-- ripwire map schema=ripwire.map/v1: ranked symbol map: <f p= layer=> groups <s t= n= sc= k= amb=> rows (k= rank), <c n=> resolved callees; the header comment is data. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. pr_iters=N: PageRank iterations. <inv listed= unlisted=>: files the ranked rows show / do not (sum = files=), each named or counted below. <entry p= n=>: a program entry by its language's convention (C/Go/Rust main, Java/C# static main, a script main its module scope calls, __main__.py), callees as c rows; manifest entries not read. <ls p= n= f=>: n= unshown files under dir p=; f= names its code files, the rest (tests, docs, config, test/doc/example dirs) counted. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. overloads=N: N same-name defs merged in this row; shown= counts each. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. lens=: attributes another form of this answer serves, withheld here. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. amb=K: K calls split over several defs. -->
+<!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
+<r schema="ripwire.map/v1" root="." pr_iters="36" lens="k,est_tokens">
+<f p="src/infra/Diagnostics.h" layer="infra">
+<s t="macro" n="RW_ASSUME_" overloads="2">
+<c n="RW_CHECK_"/>
+</s>
+<s t="macro" n="ASSUME" amb="1">
+<c n="RW_ASSUME_" prov="split"/>
+<c n="RW_ASSUME_" prov="split"/>
+</s>
+</f>
+<f p="src/infra/nodekind.h" layer="infra">
+<s t="fn" n="kindIs" sc="rw">
+</s>
+</f>
+<f p="src/ingest_metrics.h">
+<s t="fn" n="nodeTextOf">
+</s>
+</f>
+<inv listed="3" unlisted="3628">
+<entry p="scripts/changelog_assemble.py" n="main">
+<c n="repoRoot"/>
+<c n="fragmentNames"/>
+<c n="check"/>
+<c n="assembledEntries"/>
+<c n="release"/>
+</entry>
+<entry p="scripts/optremarks.py" n="main">
+<c n="parse_record_file"/>
+… [67 more display lines; full output is 8298 bytes on 1 raw line(s)]
+`````
+
+
+---
+
+# navigate / answer a question
+
+## `./build/ripwire . --around=rankGraphTeleport`
+
+*Ego graph around one symbol — depth 1 BY DEFAULT now (the root's depth= says so): ~6 KB where the 2-hop neighbourhood is ~64 KB on this repo.*
+
+**wall time: 1.17s**
+
+`````
+<!-- ripwire around schema=ripwire.around/v1: call neighbourhood of of=: depth= hops, fanout= kept per hop; absent rows lie outside that boundary. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. overloads=N: N same-name defs merged in this row; shown= counts each. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. <c via="name">: that callee matched by name alone (receiver unproven); it does NOT mean the edge is false. <c x=N>: N same-named via=name rows merged; callees=FILE:SYM lists all. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. amb=K: K calls split over several defs. layer=: built-in arch layer (game|infra|render|math|audio|ai|test) from a dir name in p=; absent if none. -->
+<!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
+<!-- a bound BIT this walk, so raising it would return more: depth_truncated=1 means at least one symbol one hop past depth= is absent; fanout_cut=N means N distinct symbols were dropped by the fanout= cap and appear NOWHERE here (exact, not a floor: a neighbour another hub re-admitted is not counted). Neither attribute is emitted when its bound cut nothing, so absent means that bound did not bind and raising it returns nothing new. The knobs are around-depth=N and around-fanout=K. -->
+<!-- files=3631 symbols=31860 edges=30033 shown=12 est_tokens=3147 ambiguous=2933 unresolved=15249 locality_pinned=9 external=8658 declined=30154 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
+<r schema="ripwire.around/v1" root="." of="rankGraphTeleport" depth="1" fanout="32" depth_truncated="1" est_tokens="3147">
+<f p="src/graph.h">
+<s t="fn" n="rankGraphTeleport" sc="rw" amb="1" k="1.0000">
+<c n="biasPrior"/>
+<c n="PROFILE_SCOPE_DESCRIBE" prov="split"/>
+<c n="PROFILE_SCOPE_DESCRIBE" prov="split"/>
+<c n="pageRankDouble"/>
+</s>
+<s t="fn" n="biasPrior" sc="rw" k="0.5000">
+<c n="ASSUME_NO_ALIAS_BUF"/>
+</s>
+<s t="fn" n="rankGraph" sc="rw" k="0.5000">
+<c n="rankGraphTeleport"/>
+</s>
+<s t="fn" n="anchoredLexicalRank" sc="rw" k="0.5000">
+<c n="rankGraphTeleport"/>
+<c n="blendMaxNorm"/>
+<c n="ASSUME"/>
+</s>
+</f>
+<f p="src/eval.h">
+<s t="fn" n="runEval" sc="rw" amb="5" k="0.5000">
+<c n="rankFiles"/>
+<c n="addRecall"/>
+<c n="bm25Seeded"/>
+<c n="anchoredFileScore"/>
+… [164 more display lines; full output is 7789 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --around=rankGraphTeleport --around-depth=2`
+
+*The restoring knob: --around-depth=2 brings back the whole 2-hop neighbourhood (depth="2" on the root) — pay for it only when the 1-hop view was not enough.*
+
+**wall time: 1.27s**
+
+`````
+<!-- ripwire around schema=ripwire.around/v1: call neighbourhood of of=: depth= hops, fanout= kept per hop; absent rows lie outside that boundary. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. lpin=K: K calls pinned by locality alone (a guess). overloads=N: N same-name defs merged in this row; shown= counts each. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. <c via="name">: that callee matched by name alone (receiver unproven); it does NOT mean the edge is false. <c x=N>: N same-named via=name rows merged; callees=FILE:SYM lists all. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. amb=K: K calls split over several defs. layer=: built-in arch layer (game|infra|render|math|audio|ai|test) from a dir name in p=; absent if none. -->
+<!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
+<!-- a bound BIT this walk, so raising it would return more: depth_truncated=1 means at least one symbol one hop past depth= is absent; fanout_cut=N means N distinct symbols were dropped by the fanout= cap and appear NOWHERE here (exact, not a floor: a neighbour another hub re-admitted is not counted). Neither attribute is emitted when its bound cut nothing, so absent means that bound did not bind and raising it returns nothing new. The knobs are around-depth=N and around-fanout=K. -->
+<!-- files=3631 symbols=31860 edges=30033 shown=155 est_tokens=21505 ambiguous=2933 unresolved=15249 locality_pinned=9 external=8658 declined=30154 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
+<r schema="ripwire.around/v1" root="." of="rankGraphTeleport" depth="2" fanout="32" depth_truncated="1" fanout_cut="77" est_tokens="21505">
+<f p="src/graph.h">
+<s t="fn" n="rankGraphTeleport" sc="rw" amb="1" k="1.0000">
+<c n="biasPrior"/>
+<c n="PROFILE_SCOPE_DESCRIBE" prov="split"/>
+<c n="PROFILE_SCOPE_DESCRIBE" prov="split"/>
+<c n="pageRankDouble"/>
+</s>
+<s t="fn" n="biasPrior" sc="rw" k="0.5000">
+<c n="ASSUME_NO_ALIAS_BUF"/>
+</s>
+<s t="fn" n="rankGraph" sc="rw" k="0.5000">
+<c n="rankGraphTeleport"/>
+</s>
+<s t="fn" n="anchoredLexicalRank" sc="rw" k="0.5000">
+<c n="rankGraphTeleport"/>
+<c n="blendMaxNorm"/>
+<c n="ASSUME"/>
+</s>
+<s t="fn" n="buildFnPtrBindTables" sc="rw" amb="1" k="0.3333">
+<c n="PROFILE_SCOPE_DESCRIBE" prov="split"/>
+<c n="PROFILE_SCOPE_DESCRIBE" prov="split"/>
+<c n="isReceiverEvidenceKind"/>
+<c n="appendUint"/>
+</s>
+<s t="fn" n="buildFieldNarrowTables" sc="rw" amb="1" k="0.3333">
+… [1951 more display lines; full output is 53260 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --around=rankGraphTeleport --around-fanout=4`
+
+*The other knob: --around-fanout=4 keeps only the 4 strongest edges per node (default 32) — the same 1-hop depth, a quarter of the rows.*
+
+**wall time: 1.28s**
+
+`````
+<!-- ripwire around schema=ripwire.around/v1: call neighbourhood of of=: depth= hops, fanout= kept per hop; absent rows lie outside that boundary. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. amb=K: K calls split over several defs. -->
+<!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
+<!-- a bound BIT this walk, so raising it would return more: depth_truncated=1 means at least one symbol one hop past depth= is absent; fanout_cut=N means N distinct symbols were dropped by the fanout= cap and appear NOWHERE here (exact, not a floor: a neighbour another hub re-admitted is not counted). Neither attribute is emitted when its bound cut nothing, so absent means that bound did not bind and raising it returns nothing new. The knobs are around-depth=N and around-fanout=K. -->
+<!-- files=3631 symbols=31860 edges=30033 shown=5 est_tokens=1477 ambiguous=2933 unresolved=15249 locality_pinned=9 external=8658 declined=30154 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
+<r schema="ripwire.around/v1" root="." of="rankGraphTeleport" depth="1" fanout="4" depth_truncated="1" fanout_cut="7" est_tokens="1477">
+<f p="src/graph.h">
+<s t="fn" n="rankGraphTeleport" sc="rw" amb="1" k="1.0000">
+<c n="biasPrior"/>
+<c n="PROFILE_SCOPE_DESCRIBE" prov="split"/>
+<c n="PROFILE_SCOPE_DESCRIBE" prov="split"/>
+<c n="pageRankDouble"/>
+</s>
+<s t="fn" n="biasPrior" sc="rw" k="0.5000">
+<c n="ASSUME_NO_ALIAS_BUF"/>
+</s>
+<s t="fn" n="rankGraph" sc="rw" k="0.5000">
+<c n="rankGraphTeleport"/>
+</s>
+<s t="fn" n="anchoredLexicalRank" sc="rw" k="0.5000">
+<c n="rankGraphTeleport"/>
+<c n="blendMaxNorm"/>
+<c n="ASSUME"/>
+</s>
+</f>
+<f p="src/main.cpp">
+<s t="fn" n="churnRankedGraph" k="0.5000">
+<c n="resolveSinceScope"/>
+<c n="defaultWindowLabel"/>
+<c n="churnTeleport"/>
+<c n="churnTeleportWorkspace"/>
+<c n="churnDecayTeleportWorkspace"/>
+<c n="churnWindowStamp"/>
+<c n="isShallow"/>
+<c n="rankGraphTeleport"/>
+<c n="churnDecayWindowLabel"/>
+<c n="discloseUniformChurnFallback"/>
+<c n="churnDecayRanking"/>
+</s>
+</f>
+</r>
+`````
+
+## `./build/ripwire . --callers=rankGraphTeleport`
+
+*Who calls SYM (1-hop in-edges).*
+
+**wall time: 1.30s**
+
+`````
+<!-- ripwire callers schema=ripwire.callers/v1: 1-hop CALLERS of of= (defs= matched, count= distinct symbols): <s t= n= p=>; hop_tested=/hop_untested=. counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. root=: p= relative to it. <s sites_at=>: its calls of the leaf name, any receiver, as file:line (p= is its def line); not proof each binds. next=: the one pasteable follow-up. -->
+<callers schema="ripwire.callers/v1" of="rankGraphTeleport" defs="1" count="7" root="." hop_tested="0" hop_untested="7" graph_ambiguous="2933" graph_unresolved="15249" graph_unindexed="269" counts_floor="1" next="--uses=rankGraphTeleport">
+<s t="fn" n="getIndex" p="src/mcpindex.h:1184" sites_at="src/mcpindex.h:1288"/>
+<s t="fn" n="rankGraph" p="src/graph.h:11850" sites_at="src/graph.h:11853"/>
+<s t="fn" n="anchoredLexicalRank" p="src/graph.h:12496" sites_at="src/graph.h:12547"/>
+<s t="fn" n="runEval" p="src/eval.h:171" sites_at="src/eval.h:328"/>
+<s t="fn" n="churnDecayRanking" p="src/main.cpp:1425" sites_at="src/main.cpp:1439"/>
+<s t="fn" n="churnRankedGraph" p="src/main.cpp:1464" sites_at="src/main.cpp:1478 src/main.cpp:1479 src/main.cpp:1493"/>
+<s t="fn" n="runDefaultMap" p="src/main.cpp:1751" sites_at="src/main.cpp:1871"/>
+</callers>
+`````
+
+## `./build/ripwire . --callers=rankGraphTeleport --legend=full`
+
+*The same rows under --legend=full: the default is the compact dialect (one compact comment plus schema="ripwire.callers/v1" on the root), and --legend=full restores the prose legend — every row byte and every completeness attribute (counts_floor=, graph_ambiguous=, next=) identical, ~3 KB more legend. Works on EVERY XML verb.*
+
+`````
+<!-- ripwire callers/callees: the 1-hop call hierarchy read off the call graph — the callers form lists symbols that CALL of=; the callees form lists symbols of= itself calls. of= is the selector you passed, defs= how many DEFINITIONS it resolved to (rows UNION every def's neighbours), count= the DISTINCT neighbour symbols (a floor, per counts_floor=), windowed by limit= and offset=. A neighbour that is an indexed function-like #define is a macro row (t="macro", role="macro" on the XML row): the edge crosses a macro expansion, not a plain call — rows carry no role= otherwise. Rows are ordered SOURCE first, then test/bench, then docs; within a tier callers rank by each row's own caller count (most-called first); callees keep path order. hop_tested=/hop_untested= partition count= by the tested= lens below (1-hop, never transitive). tested="1" on a row means an indexed test transitively reaches it (never 0, omitted when it does not). BLIND SPOT the test-gate legend also names: only a CALL EDGE from an INDEXED test symbol counts here, so a shell or CLI-level test running a built binary as a SUBPROCESS is invisible to it and a repo tested that way reads all-untested. Read untested= as no in-process test reaches it, not as no test covers it. next= is the one pasteable follow-up (the uses verb on this selector: the call sites). sites_at= on a caller row: its calls of the called LEAF name, any receiver or qualifier, as file:line tokens (space-separated, ascending; two calls on one line are one site); p= stays where the caller is DEFINED. Matched by name like the uses verb's call rows, so not proof each binds here; absent when no call there is spelled like it (an aliased import). counts_floor="1" means every count here is a FLOOR, never a total: edges are extracted from source TEXT by NAME. Missing: dynamic dispatch (virtual/interface/duck-typed), a most-vexing-parse declaration with no call expression, a function-pointer/callback bound to more than one function in scope (reassigned, table-indexed, lambda-bound, or address-taken/reference-bound), and a plain-name binding (fp=handler) whose variable type is not PROVABLY a function pointer (a same-file typedef/declarator; a HEADER typedef is missed; auto/template types are read as unpinned, so KEPT). A macro-generated call site is role="macro" only when its name uniquely names an indexed function-like #define (C-family, t="macro"); a shared name stays a plain call, an unindexed macro is no edge. Read a zero as "none found", never as "none exists". graph_ambiguous=/graph_unresolved= are the whole graph's resolver gauge (calls split over several defs / calls whose in-repo defs were all language-filtered), the map header's ambiguous=/unresolved=. graph_unindexed=N is a third gauge: files no grammar could read (the map header's unindexed=), whose calls raise neither gauge above; absent when zero, and so is this sentence. COUNTING UNIT differs by verb: callers, callees, edit-check, graph-query and pr-context counts are DISTINCT SYMBOLS (repeated calls from one caller, and calls to two overloads, collapse into ONE row; multiplicity survives only in the call graph's edge weight). The reach counts (impact's reaches=, pr-context's dependents=) are the size of a transitive reach SET, each symbol counted once. The uses verb counts call SITES, one row per occurrence — a larger count there for the same symbol is these units agreeing, not disagreeing. The map header's edges= is a unit again different — distinct (caller,callee) PAIRS — and that document carries neither this marker nor this clause. -->
+<!-- root= on this element is the crawl root every p= below is RELATIVE to (single-root runs only; absent => p= is the path ingest itself used, unchanged). -->
+<callers of="rankGraphTeleport" defs="1" count="7" root="." hop_tested="0" hop_untested="7" graph_ambiguous="2933" graph_unresolved="15249" graph_unindexed="269" counts_floor="1" next="--uses=rankGraphTeleport">
+<s t="fn" n="getIndex" p="src/mcpindex.h:1184" sites_at="src/mcpindex.h:1288"/>
+<s t="fn" n="rankGraph" p="src/graph.h:11850" sites_at="src/graph.h:11853"/>
+<s t="fn" n="anchoredLexicalRank" p="src/graph.h:12496" sites_at="src/graph.h:12547"/>
+<s t="fn" n="runEval" p="src/eval.h:171" sites_at="src/eval.h:328"/>
+<s t="fn" n="churnDecayRanking" p="src/main.cpp:1425" sites_at="src/main.cpp:1439"/>
+<s t="fn" n="churnRankedGraph" p="src/main.cpp:1464" sites_at="src/main.cpp:1478 src/main.cpp:1479 src/main.cpp:1493"/>
+<s t="fn" n="runDefaultMap" p="src/main.cpp:1751" sites_at="src/main.cpp:1871"/>
+</callers>
+`````
+
+## `./build/ripwire . --callers=DoesNotExist`
+
+*Unknown-symbol REFUSAL shape (exit 1) with a did-you-mean from real edit distance.*
+
+**exit code: 1** — **wall time: 4.17s**
+
+`````
+<!-- ripwire callers schema=ripwire.callers/v1: 1-hop CALLERS of of= (defs= matched, count= distinct symbols): <s t= n= p=>; hop_tested=/hop_untested=. found=0: no indexed definition matched the selector, nothing listed or counted (zero = none found, not none exists); exit stays 1. -->
+<callers schema="ripwire.callers/v1" of="DoesNotExist" found="0"/>
+`````
+
+stderr:
+
+`````
+ripwire: --callers symbol not found: DoesNotExist
+`````
+
+## `./build/ripwire . --callees=rankGraphTeleport`
+
+*What SYM calls (1-hop out-edges).*
+
+**wall time: 1.37s**
+
+`````
+<!-- ripwire callees schema=ripwire.callees/v1: 1-hop CALLEES of of= (defs= matched, count= distinct symbols): <s t= n= p= role= tested=>. counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. stdm n= calls=: of declined_calls=, calls named like a standard-type member of their language (C++ container/string/optional/smart pointer, Rust collection/string/Option/Result; n=) on a receiver no rule tied to an in-tree class (Rust: one of an in-tree type no rule typed too: a generic bound, dyn or impl Trait, a type alias, a glob of a glob, a tuple-struct field, a non-plain pattern, behind Option / Result / Rc / Arc / RefCell / Cell / Mutex / RwLock); no edge or row (may be the std member). root=: p= relative to it. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. <s tested=1>: a non-test row an indexed test transitively reaches (absent otherwise, never 0). declined_calls=K: K call sites left unbound, in no count; <dc n= l=|in= p= cands=K via=declined>: one such call SITE (callees: called name, line; callers: calling def, file:line); NOT an edge or a caller/callee claim; cands=K: K in-tree defs it could have meant (K may be 1), the resolver proved none; not a claim this call reaches any of them. dc gate=: builtin or std, a name gate declined it; side, a Ruby call whose in-reach defs answer on the other side of self. next=: the one pasteable follow-up. hop_tested=/hop_untested=: count= split by whether an indexed test reaches the row (in-process calls only). -->
+<callees schema="ripwire.callees/v1" of="rankGraphTeleport" defs="1" count="4" root="." hop_tested="3" hop_untested="1" declined_calls="6" graph_ambiguous="2933" graph_unresolved="15249" graph_unindexed="269" counts_floor="1" next="--expand=rankGraphTeleport">
+<s t="fn" n="biasPrior" p="src/graph.h:11768"/>
+<s t="macro" n="PROFILE_SCOPE_DESCRIBE" p="src/infra/profileScope.h:1282" role="macro" tested="1" prov="split"/>
+<s t="macro" n="PROFILE_SCOPE_DESCRIBE" p="src/infra/profileScope.h:1296" role="macro" tested="1" prov="split"/>
+<s t="fn" n="pageRankDouble" p="src/pagerank.cpp:99" tested="1"/>
+<stdm n="begin,end,size" calls="6"/>
+<dc n="size" l="11813" cands="1" via="declined" gate="std"/>
+<dc n="begin" l="11814" cands="2" via="declined" gate="std"/>
+<dc n="end" l="11814" cands="2" via="declined" gate="std"/>
+<dc n="begin" l="11835" cands="2" via="declined" gate="std"/>
+<dc n="end" l="11835" cands="2" via="declined" gate="std"/>
+<dc n="begin" l="11835" cands="2" via="declined" gate="std"/>
+</callees>
+`````
+
+## `./build/ripwire . --uses=rankGraphTeleport`
+
+*The resolvable use-sites (call/read/write/import/extends) with file:line; count= is a floor.*
+
+**wall time: 1.59s**
+
+`````
+<!-- ripwire uses schema=ripwire.uses/v1: resolvable use-sites of of=: <u role=call|macro|read|write|import|extends|type p=file:line in_id=>. counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. root=: p= relative to it. defs=N: definitions the selector matched; qualify file:name to narrow the call sites. external=1: of= has no definition in the indexed tree under any spelling (stdlib/third-party). count=N: use-site rows in all (a floor). -->
+<uses schema="ripwire.uses/v1" of="rankGraphTeleport" defs="1" external="0" count="9" root="." graph_ambiguous="2933" graph_unresolved="15249" graph_unindexed="269" counts_floor="1">
+<u role="call" p="src/mcpindex.h:1288" in_id="src/mcpindex.h::rw::getIndex"/>
+<u role="call" p="src/graph.h:11853" in_id="src/graph.h::rw::rankGraph"/>
+<u role="call" p="src/graph.h:12547" in_id="src/graph.h::rw::anchoredLexicalRank"/>
+<u role="call" p="src/eval.h:328" in_id="src/eval.h::rw::runEval"/>
+<u role="call" p="src/main.cpp:1439" in_id="churnDecayRanking"/>
+<u role="call" p="src/main.cpp:1478" in_id="churnRankedGraph"/>
+<u role="call" p="src/main.cpp:1479" in_id="churnRankedGraph"/>
+<u role="call" p="src/main.cpp:1493" in_id="churnRankedGraph"/>
+<u role="call" p="src/main.cpp:1871" in_id="runDefaultMap"/>
+</uses>
+`````
+
+## `./build/ripwire . --graph-query='and(callers(name("rankGraphTeleport"),2),kind(all,fn))'`
+
+*Composable node-set query: functions within 2 caller-hops of rankGraphTeleport.*
+
+**wall time: 1.60s**
+
+`````
+<!-- ripwire graph-query schema=ripwire.graph-query/v1: graph-query expression over the symbol graph: <s t= n= p=> matching rows. window: shown= capped= (capped=1 cut). counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. root=: p= relative to it. pr_iters=N: PageRank iterations. expr=: the expression as given; count=: symbols it matched (rows page by shown=/total=). -->
+<query schema="ripwire.graph-query/v1" expr="and(callers(name(&quot;rankGraphTeleport&quot;),2),kind(all,fn))" count="55" shown="55" capped="0" graph_ambiguous="2933" graph_unresolved="15249" graph_unindexed="269" counts_floor="1" root="." pr_iters="36">
+<s t="fn" n="getIndex" p="src/mcpindex.h:1184"/>
+<s t="fn" n="anchoredLexicalRank" p="src/graph.h:12496"/>
+<s t="fn" n="emitCommunitiesReport" p="src/verbs_report.h:2563"/>
+<s t="fn" n="emitCommunityDrill" p="src/verbs_report.h:2724"/>
+<s t="fn" n="computeLensRanking" p="src/verbs_for.h:84"/>
+<s t="fn" n="rankGraph" p="src/graph.h:11850"/>
+<s t="fn" n="dispatchMain" p="src/main.cpp:4307"/>
+<s t="fn" n="postCheckJson" p="src/mcpedit.h:1116"/>
+<s t="fn" n="fetchBody" p="src/mcpverbs.h:5436"/>
+<s t="fn" n="runEvalRetrieval" p="src/eval.h:716"/>
+<s t="fn" n="runEvalMined" p="src/eval.h:1089"/>
+<s t="fn" n="dispatchMcpLine" p="src/mcp.h:1120"/>
+<s t="fn" n="runEditVerb" p="src/mcpedit.h:1189"/>
+<s t="fn" n="churnDecayRanking" p="src/main.cpp:1425"/>
+<s t="fn" n="fetchBodyByName" p="src/mcpverbs.h:5359"/>
+<s t="fn" n="anchoredFileScore" p="src/eval.h:111"/>
+<s t="fn" n="symbolQueryJson" p="src/mcpverbs.h:758"/>
+<s t="fn" n="analyzeToString" p="src/mcpverbs.h:433"/>
+<s t="fn" n="grepHitsJson" p="src/mcpverbs.h:1300"/>
+<s t="fn" n="cochangePartnersJson" p="src/mcpverbs.h:1479"/>
+<s t="fn" n="mentionsJson" p="src/mcpverbs.h:1890"/>
+<s t="fn" n="forTaskText" p="src/mcpverbs.h:2438"/>
+<s t="fn" n="legoText" p="src/mcpverbs.h:2914"/>
+<s t="fn" n="ownersText" p="src/mcpverbs.h:2955"/>
+<s t="fn" n="exemplarText" p="src/mcpverbs.h:3096"/>
+<s t="fn" n="impactText" p="src/mcpverbs.h:3178"/>
+<s t="fn" n="usesText" p="src/mcpverbs.h:3529"/>
+<s t="fn" n="pathText" p="src/mcpverbs.h:3714"/>
+… [28 more display lines; full output is 3650 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --external-surface`
+
+*Names referenced but never defined in-corpus (stdlib/third-party surface). The root carries names/shown/capped; the default is a 100-row window now, so total= and a pasteable next= join them when it bites (the explicit --limit form carries the same quintet). The sh BUILTINS (cd/echo/set…) are dropped and COUNTED as builtins_excluded= — grep/sed/git stay, they ARE the surface.*
+
+**wall time: 1.28s**
+
+`````
+<!-- ripwire external-surface schema=ripwire.external-surface/v1: names used but never defined in the index: <x n= lang= refs= calls=>. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). next=: the one pasteable follow-up. names=N: distinct external names (the x rows' total). builtins_excluded=N: sh BUILTIN rows (echo printf cd exit test ...) dropped from names=; the include-builtins flag keeps them. -->
+<external-surface schema="ripwire.external-surface/v1" names="2904" builtins_excluded="20" shown="100" capped="1" total="2904" has_more="1" next_offset="100" offset="0" limit="0" next="--external-surface --offset=100">
+<x n="grep" lang="sh" refs="14388" calls="14388"/>
+<x n="cat" lang="sh" refs="2678" calls="2678"/>
+<x n="tr" lang="sh" refs="2254" calls="2254"/>
+<x n="python3" lang="sh" refs="1871" calls="1871"/>
+<x n="sed" lang="sh" refs="1799" calls="1799"/>
+<x n="substr" lang="cpp" refs="1295" calls="1295"/>
+<x n="print" lang="py" refs="989" calls="989"/>
+<x n="to_string" lang="cpp" refs="977" calls="977"/>
+<x n="wc" lang="sh" refs="967" calls="967"/>
+<x n="ts_node_is_null" lang="cpp" refs="910" calls="910"/>
+<x n="string_view" lang="cpp" refs="872" calls="872"/>
+<x n="mktemp" lang="sh" refs="871" calls="871"/>
+<x n="dirname" lang="sh" refs="825" calls="825"/>
+<x n="cmp" lang="sh" refs="698" calls="698"/>
+<x n="ts_node_type" lang="cpp" refs="688" calls="688"/>
+<x n="xmllint" lang="sh" refs="651" calls="651"/>
+<x n="uint32_t" lang="cpp" refs="648" calls="648"/>
+<x n="stdout" lang="cpp" refs="647" calls="0"/>
+<x n="size_t" lang="cpp" refs="594" calls="594"/>
+<x n="diff" lang="sh" refs="575" calls="575"/>
+<x n="stderr" lang="cpp" refs="555" calls="0"/>
+<x n="awk" lang="sh" refs="528" calls="528"/>
+<x n="ex" lang="cpp" refs="483" calls="390"/>
+<x n="tail" lang="sh" refs="446" calls="446"/>
+<x n="rm" lang="sh" refs="381" calls="381"/>
+<x n="add_argument" lang="py" refs="317" calls="317"/>
+<x n="rfind" lang="cpp" refs="271" calls="271"/>
+<x n="ts_node_start_byte" lang="cpp" refs="255" calls="255"/>
+… [73 more display lines; full output is 5604 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --external-surface --include-builtins`
+
+*The restoring knob: --include-builtins keeps the shell builtins in the same 100-row window (they now compete for rows, so the window's tail differs).*
+
+**wall time: 1.35s**
+
+`````
+<!-- ripwire external-surface schema=ripwire.external-surface/v1: names used but never defined in the index: <x n= lang= refs= calls=>. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). next=: the one pasteable follow-up. names=N: distinct external names (the x rows' total). -->
+<external-surface schema="ripwire.external-surface/v1" names="2924" shown="100" capped="1" total="2924" has_more="1" next_offset="100" offset="0" limit="0" next="--external-surface --include-builtins --offset=100">
+<x n="grep" lang="sh" refs="14388" calls="14388"/>
+<x n="printf" lang="sh" refs="13443" calls="13443"/>
+<x n="echo" lang="sh" refs="8268" calls="8268"/>
+<x n="exit" lang="sh" refs="2903" calls="2903"/>
+<x n="cat" lang="sh" refs="2678" calls="2678"/>
+<x n="tr" lang="sh" refs="2254" calls="2254"/>
+<x n="cd" lang="sh" refs="2185" calls="2185"/>
+<x n="python3" lang="sh" refs="1871" calls="1871"/>
+<x n="sed" lang="sh" refs="1799" calls="1799"/>
+<x n="return" lang="sh" refs="1464" calls="1464"/>
+<x n="substr" lang="cpp" refs="1295" calls="1295"/>
+<x n="command" lang="sh" refs="997" calls="997"/>
+<x n="print" lang="py" refs="989" calls="989"/>
+<x n="to_string" lang="cpp" refs="977" calls="977"/>
+<x n="wc" lang="sh" refs="967" calls="967"/>
+<x n="ts_node_is_null" lang="cpp" refs="910" calls="910"/>
+<x n="string_view" lang="cpp" refs="872" calls="872"/>
+<x n="mktemp" lang="sh" refs="871" calls="871"/>
+<x n="dirname" lang="sh" refs="825" calls="825"/>
+<x n="pwd" lang="sh" refs="780" calls="780"/>
+<x n="trap" lang="sh" refs="738" calls="738"/>
+<x n="cmp" lang="sh" refs="698" calls="698"/>
+<x n="ts_node_type" lang="cpp" refs="688" calls="688"/>
+<x n="xmllint" lang="sh" refs="651" calls="651"/>
+<x n="uint32_t" lang="cpp" refs="648" calls="648"/>
+<x n="stdout" lang="cpp" refs="647" calls="0"/>
+<x n="size_t" lang="cpp" refs="594" calls="594"/>
+<x n="diff" lang="sh" refs="575" calls="575"/>
+… [73 more display lines; full output is 5478 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --path=main,rankGraphTeleport`
+
+*Shortest directed call-path SRC -> DST. CHANGED: now reports from_p/to_p/from_defs and resolves the right `main` (was reachable="0").*
+
+**wall time: 1.34s**
+
+`````
+<!-- ripwire path schema=ripwire.path/v1: one DIRECTED call path from= to to=, each <s t= n= p=> a hop; reachable=0 hops=0 when none. counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. root=: p= relative to it. from_p=/to_p=: the definitions from= and to= were bound to. from_defs=/to_defs=: definitions of each name, all searched; above 1, qualify file:name. -->
+<path schema="ripwire.path/v1" from="main" to="rankGraphTeleport" from_p="src/main.cpp:4172" to_p="src/graph.h:11809" from_defs="135" to_defs="1" reachable="1" hops="4" root="." graph_ambiguous="2933" graph_unresolved="15249" graph_unindexed="269" counts_floor="1">
+<s t="fn" n="main" p="src/main.cpp:4172"/>
+<s t="fn" n="runWithCompactLegend" p="src/main.cpp:4108"/>
+<s t="fn" n="dispatchMain" p="src/main.cpp:4307"/>
+<s t="fn" n="runDefaultMap" p="src/main.cpp:1751"/>
+<s t="fn" n="rankGraphTeleport" p="src/graph.h:11809"/>
+</path>
+`````
+
+## `./build/ripwire . --connect=rankGraphTeleport,runEval,getIndex`
+
+*Minimal connecting subgraph over 3 symbols (finds shared-caller joins).*
+
+**wall time: 1.71s**
+
+`````
+<!-- ripwire connect schema=ripwire.connect/v1: minimal joining subgraph: <g> groups, <t> terminals, <s connects=> joins, <e f= t=> edges, <unconnected>. counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. hub_floor=D: connects= >= D is hub=1, vacuous. nodes=N: symbols printed, terminals plus joins (a floor). radius=N: undirected hop bound searched (default 6, max 12); raise it with connect-radius=N. terminals=/groups=/edges=: task symbols resolved, connected groups (g), e edges printed. -->
+<connect schema="ripwire.connect/v1" terminals="3" nodes="3" edges="2" radius="6" groups="1" est_tokens="512" hub_floor="246" root="." graph_ambiguous="2933" graph_unresolved="15249" graph_unindexed="269" counts_floor="1">
+<g terminals="3">
+<t n="runEval" t="fn" p="src/eval.h:171"/>
+<t n="rankGraphTeleport" t="fn" p="src/graph.h:11809"/>
+<t n="getIndex" t="fn" p="src/mcpindex.h:1184"/>
+<e f="runEval" t="rankGraphTeleport"/>
+<e f="getIndex" t="rankGraphTeleport"/>
+</g>
+</connect>
+`````
+
+## `./build/ripwire . --impact=rankGraphTeleport`
+
+*Transitive blast radius — everything that reaches SYM. NOW carries shown/capped.*
+
+**wall time: 2.03s**
+
+`````
+<!-- ripwire impact schema=ripwire.impact/v1: transitive blast radius of of=: <s t= n= p=> reach set, <f via= p=> importers; defs= matched, reaches= their transitive callers, radius_tested= non-tests an indexed test reaches, radius_untested= the rest; importers= files that #include/import a def's file. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). importers_capped=/files_capped=: 1 = cut. counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. root=: p= relative to it. pr_iters=N: PageRank iterations. shown_importers=: <f> rows (limit= sizes them). importers_next=: the call listing every importer. files files=/shown_files=: files the WHOLE reach set touches (rides beside a cut symbol window) / listed; rf syms= reached symbols there, d= fewest hops; files_capped=1 + files_next= when cut. <f lazy=1>: every edge from that importer into a def file is deferred (in a function/block body, or an autoload), firing only if reached; lazy=0: at least one is load-time. declined_calls=K: K call sites left unbound, in no count; <dc n= l=|in= p= cands=K via=declined>: one such call SITE (callees: called name, line; callers: calling def, file:line); NOT an edge or a caller/callee claim; cands=K: K in-tree defs it could have meant (K may be 1), the resolver proved none; not a claim this call reaches any of them. <s d=N>: hops to of= (1 = direct caller), set where it changes. by_depth=k:n: n of reaches= at depth k, shallowest rows first. next=: the one pasteable follow-up. -->
+<impact schema="ripwire.impact/v1" of="rankGraphTeleport" defs="1" reaches="67" by_depth="1:7,2:48,3:10,4:2" importers="46" shown_importers="40" importers_capped="1" importers_next="--impact=rankGraphTeleport --limit=46" radius_tested="0" radius_untested="67" declined_calls="1" root="." shown="40" c … [line truncated: 212 more bytes on this line]
+<files files="14" shown_files="14" files_capped="0">
+<rf p="src/main.cpp" syms="9" d="1"/>
+<rf p="src/eval.h" syms="4" d="1"/>
+<rf p="src/graph.h" syms="2" d="1"/>
+<rf p="src/mcpindex.h" syms="1" d="1"/>
+<rf p="src/mcpverbs.h" syms="28" d="2"/>
+<rf p="src/verbs_report.h" syms="6" d="2"/>
+<rf p="src/editplan.h" syms="4" d="2"/>
+<rf p="src/verbs_for.h" syms="3" d="2"/>
+<rf p="src/mcp.h" syms="2" d="2"/>
+<rf p="src/mcpedit.h" syms="2" d="2"/>
+<rf p="src/verbs_change.h" syms="2" d="2"/>
+<rf p="src/verbs_navigate.h" syms="2" d="2"/>
+<rf p="src/lsp.h" syms="1" d="2"/>
+<rf p="src/mcpserver.h" syms="1" d="2"/>
+</files>
+<s t="fn" n="getIndex" p="src/mcpindex.h:1184" d="1"/>
+<s t="fn" n="anchoredLexicalRank" p="src/graph.h:12496"/>
+<s t="fn" n="rankGraph" p="src/graph.h:11850"/>
+<s t="fn" n="churnDecayRanking" p="src/main.cpp:1425"/>
+<s t="fn" n="runDefaultMap" p="src/main.cpp:1751"/>
+<s t="fn" n="churnRankedGraph" p="src/main.cpp:1464"/>
+<s t="fn" n="runEval" p="src/eval.h:171"/>
+<s t="fn" n="emitCommunitiesReport" p="src/verbs_report.h:2563" d="2"/>
+<s t="fn" n="emitCommunityDrill" p="src/verbs_report.h:2724"/>
+<s t="fn" n="computeLensRanking" p="src/verbs_for.h:84"/>
+<s t="fn" n="dispatchMain" p="src/main.cpp:4307"/>
+<s t="fn" n="postCheckJson" p="src/mcpedit.h:1116"/>
+… [70 more display lines; full output is 6868 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --mentions=rankGraphTeleport`
+
+*Markdown docs that name SYM in a backtick (doc<->code edges).*
+
+**wall time: 1.52s**
+
+`````
+<!-- ripwire mentions schema=ripwire.mentions/v1: markdown FILES naming of= in backticks (docs=, sections=): <doc p= mentions=>; not a call edge. root=: p= relative to it. defs=N: definitions of= resolved to; rows union their doc mentions. -->
+<!-- unbackticked_docs=N: N more markdown files, over readable indexed markdown, name of= as a whole word but not as a clean one-line backtick span (prose, a code block, a span broken across lines) - not in docs=; a text match, so a ceiling -->
+<mentions schema="ripwire.mentions/v1" of="rankGraphTeleport" defs="1" docs="6" sections="13" unbackticked_docs="4" root=".">
+<doc p="docs/ARCHITECTURE.md" mentions="1"/>
+<doc p="docs/EVALS.md" mentions="3"/>
+<doc p="prompts/help-wanted/certified-ranking-order.md" mentions="2"/>
+<doc p="prompts/help-wanted/correctness-fuzzers.md" mentions="1"/>
+<doc p="prompts/help-wanted/graph-unit-tests.md" mentions="5"/>
+<doc p="prompts/help-wanted/next-uses-bare-name.md" mentions="1"/>
+</mentions>
+`````
+
+## `./build/ripwire . --affected=src/graph.h`
+
+*Test files that transitively reach the changed file.*
+
+**wall time: 1.96s**
+
+`````
+<!-- ripwire affected schema=ripwire.affected/v1: test files that transitively reach the changed files/symbols: <test p= partner= hops= run=> in evidence order (order= partners=); seeded_by= the reading taken. counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. run_unknown=1: no runner derivable (a guess would be worse). root=: p= relative to it. seeds=N: symbols the argument matched; only those outside test files seed the caller walk. seed_test_files=N: matched files that are TESTS; listed to run (seed_kind=test), never walk seeds. tests=N: test files listed to run (the rows). reached=N: symbols the transitive caller walk reached from the seeds (seeds excluded). script_gates_unmodelled=N: test/*.sh runners; their subprocess reach is unmodelled, never in tests=/reached=. run_first=N: the first N test files have the most direct evidence (changed/partner/hops=1, else nearest hops=); not a skip list. changed=: the files/symbols argument as given. -->
+<affected schema="ripwire.affected/v1" changed="src/graph.h" seeded_by="file" seeds="612" seed_test_files="0" tests="7" reached="537" script_gates_unmodelled="782" run_first="3" order="evidence" partners="0" root="." graph_ambiguous="2933" graph_unresolved="15249" graph_unindexed="269" counts_floor= … [line truncated: 4 more bytes on this line]
+<test p="test/connectcore_harness.cpp" hops="1" run="bash test/connectcorecheck.sh"/>
+<test p="test/cppqualtmplfix/member.cpp" hops="1" run="bash test/cppqualcheck.sh"/>
+<test p="test/verify_csr.cpp" hops="1" run="bash test/a9disclosurecheck.sh"/>
+<test p="test/fuzz/readers/readers_ingest.cpp" hops="2" run_unknown="1"/>
+<test p="test/includeprecise_unit.cpp" hops="3" run="bash test/includeprecisecheck.sh"/>
+<test p="test/rustimport_unit.cpp" hops="3" run="bash test/rustimportprecisecheck.sh"/>
+<test p="test/columnarcommafix/columnar_comma_test.cpp" hops="4" run="bash test/columnarcommacheck.sh"/>
+</affected>
+`````
+
+## `./build/ripwire . --situ`
+
+*Mid-task situational report for the current git diff — recorded against a CLEAN tree (contrast with the sandbox run below).*
+
+**wall time: 2.91s**
+
+`````
+ripwire situational-awareness — 0 changed file(s), 0 symbols in them
+root: .
+at: 0712a5182
+  (0 changed files — working tree is clean, nothing to analyze)
+`````
+
+## `./build/ripwire . --test-gate`
+
+*Pre-PR gate on a CLEAN tree: no obligations, exit 0.*
+
+**wall time: 5.28s**
+
+`````
+<!-- ripwire test-gate schema=ripwire.test-gate/v1: tests <t p= changed= partner= hops= run=> + untested blast radius <u sym= p= l= ccx=>; exit 4 while either exists. tests_capped=/untested_capped=: 1 = cut. counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. at=: commit+dirty+shallow. next=: the one pasteable follow-up. impacted=N: symbols that transitively call the change (changed symbols excluded). shown_tests=/shown_untested=: t rows and u rows printed, two independent counts. script_gates_unmodelled=N: test/*.sh runners in the corpus, a path count; not call-graph modelled. script_gates_registered=N: shell gates test/regression.sh registers as suite members. script_gates_mapped=N: registered gates with exact dependency evidence (literal paths or RIPWIRE_TEST_DEPS). script_gates_unresolved_dynamic=N: registered gates with no mappable deps; they may cover the change unlisted. ccx_bar=N: the cognitive-complexity bar a u row's ccx= is read against. untested_modscope=N: <file-scope> owners excluded from untested= (#324, uncallable); still in impacted=. tests=/untested=: tests to run (t total) / impacted symbols no test reaches (u total). -->
+<test-gate schema="ripwire.test-gate/v1" changed="0" impacted="0" tests="0" untested="0" untested_modscope="0" shown_tests="0" tests_capped="0" shown_untested="0" untested_capped="0" script_gates_unmodelled="782" script_gates_registered="733" script_gates_mapped="236" script_gates_unresolved_dynamic … [line truncated: 136 more bytes on this line]
+</test-gate>
+`````
+
+## `./build/ripwire . --grep=DISCLOSE`
+
+*Literal trigram-indexed search. Each hit carries its MATCHED line as the <hit> element's own CDATA (the <m> wrapper is gone), plus shown/capped/hits_capped and a pasteable next= on the root.*
+
+**wall time: 1.39s**
+
+`````
+<!-- ripwire grep schema=ripwire.grep/v1: literal/regex scan grouped by file: <f p=>
+<hit l= in=>CDATA text</hit> (<b>/<a> context around it); complete=1 only for an exhaustive literal scan (beside pattern_meta=, of the literal reading only); <unindexed> = off-index. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). c … [line truncated: 2184 more bytes on this line]
+<grep pattern="DISCLOSE" schema="ripwire.grep/v1" root="." files="254" hits="856" shown="100" capped="1" total="856" has_more="1" next_offset="100" offset="0" limit="0" hits_capped="0" suppressed_comment="166" suppressed_string="5" tier_parsed="80" tier_unclassified="659" tier_budget="bytes" tier_fi … [line truncated: 201 more bytes on this line]
+<f p=".coderabbit.yaml">
+<hit l="33" in="path_instructions" occ="2">
+<![CDATA[        A degrade path uses DISCLOSE( sink, why ), never ASSUME(false): a one-argument DISCLOSE( msg ) is a debug trace]]>
+</hit>
+</f>
+<f p="src/abicheck.h" parse_degraded="1">
+<hit l="494" in="abicheck::collectAuthoredSites">
+<![CDATA[            DISCLOSE( result, AbiResult::DisclosureWhy::NoMergeBase, "abi: no merge-base for a ref (unrelated history?) — that ref is counted, not compared" );]]>
+</hit>
+</f>
+<f p="src/arch.h">
+<hit l="507" in="rw::parseArchRules">
+<![CDATA[        DISCLOSE( Diagnostics::answerRefused, "--arch exits 1 with path:line and the reason on stderr; no report is printed",]]>
+</hit>
+<hit l="846" in="rw::readArchBaselineSidecar">
+<![CDATA[    if( sidecar.refused ) { DISCLOSE( baseline, ArchBaselineRead::DisclosureWhy::SymlinkRefused, "arch: refusing to read the arch baseline sidecar through a symlink" ); }]]>
+</hit>
+<hit l="897" in="rw::openArchBaselineSidecar">
+<![CDATA[        DISCLOSE( Diagnostics::answerRefused, "--baseline exits 1: pathguard names the refused link on stderr and the verb says it cannot write the sidecar",]]>
+</hit>
+</f>
+<f p="src/atoms.h">
+<hit l="372" in="atomdetail::collectExclusions">
+<![CDATA[        DISCLOSE( ex, Exclusions::DisclosureWhy::ForHeaderSaturated, "atoms: the for-header exclusion stream spent its whole budget; the rules reading it are suppressed this run" );]]>
+</hit>
+<hit l="376" in="atomdetail::collectExclusions">
+<![CDATA[        DISCLOSE( ex, Exclusions::DisclosureWhy::StmtCrementSaturated, "atoms: the statement-crement exclusion stream spent its whole budget; the rules reading it are suppressed this run" );]]>
+… [434 more display lines; full output is 28801 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --grep=DISCLOSE --grep-context=1`
+
+*Same search with one line of source context either side.*
+
+**wall time: 1.18s**
+
+`````
+<!-- ripwire grep schema=ripwire.grep/v1: literal/regex scan grouped by file: <f p=>
+<hit l= in=>CDATA text</hit> (<b>/<a> context around it); complete=1 only for an exhaustive literal scan (beside pattern_meta=, of the literal reading only); <unindexed> = off-index. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). c … [line truncated: 2184 more bytes on this line]
+<grep pattern="DISCLOSE" schema="ripwire.grep/v1" root="." files="254" hits="856" shown="100" capped="1" total="856" has_more="1" next_offset="100" offset="0" limit="0" hits_capped="0" suppressed_comment="166" suppressed_string="5" tier_parsed="80" tier_unclassified="659" tier_budget="bytes" tier_fi … [line truncated: 201 more bytes on this line]
+<f p=".coderabbit.yaml">
+<hit l="33" in="path_instructions" occ="2">
+<b>
+<![CDATA[        External input (files, git, env, argv, MCP/JSON, data read back from a cache) is checked with VALIDATE.]]>
+</b>
+<![CDATA[        A degrade path uses DISCLOSE( sink, why ), never ASSUME(false): a one-argument DISCLOSE( msg ) is a debug trace]]>
+<a>
+<![CDATA[        that ships nothing, and a Diagnostics::answerUnchanged reason must be true. A count that cannot be a total must be]]>
+</a>
+</hit>
+</f>
+<f p="src/abicheck.h" parse_degraded="1">
+<hit l="494" in="abicheck::collectAuthoredSites">
+<b>
+<![CDATA[        {]]>
+</b>
+<![CDATA[            DISCLOSE( result, AbiResult::DisclosureWhy::NoMergeBase, "abi: no merge-base for a ref (unrelated history?) — that ref is counted, not compared" );]]>
+<a>
+<![CDATA[            continue;]]>
+</a>
+</hit>
+</f>
+<f p="src/arch.h">
+<hit l="507" in="rw::parseArchRules">
+<b>
+<![CDATA[        rw::emitTo( stderr, "ripwire: --arch: {}:{}: {} — rules file rejected\n", path.c_str(), lineNo, why );]]>
+</b>
+… [1018 more display lines; full output is 40584 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --grep=DISCLOSE --grep-before=1 --grep-after=2 --limit=3`
+
+*The asymmetric spelling of the same context: one line before and two after each hit (ripgrep's -B/-A), on a three-hit window.*
+
+**wall time: 1.18s**
+
+`````
+<!-- ripwire grep schema=ripwire.grep/v1: literal/regex scan grouped by file: <f p=>
+<hit l= in=>CDATA text</hit> (<b>/<a> context around it); complete=1 only for an exhaustive literal scan (beside pattern_meta=, of the literal reading only); <unindexed> = off-index. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). c … [line truncated: 1687 more bytes on this line]
+<grep pattern="DISCLOSE" schema="ripwire.grep/v1" root="." files="254" hits="856" shown="3" capped="1" total="856" has_more="1" next_offset="3" offset="0" limit="3" hits_capped="0" suppressed_comment="166" suppressed_string="5" tier_parsed="80" tier_unclassified="659" tier_budget="bytes" tier_files= … [line truncated: 195 more bytes on this line]
+<f p=".coderabbit.yaml">
+<hit l="33" in="path_instructions" occ="2">
+<b>
+<![CDATA[        External input (files, git, env, argv, MCP/JSON, data read back from a cache) is checked with VALIDATE.]]>
+</b>
+<![CDATA[        A degrade path uses DISCLOSE( sink, why ), never ASSUME(false): a one-argument DISCLOSE( msg ) is a debug trace]]>
+<a>
+<![CDATA[        that ships nothing, and a Diagnostics::answerUnchanged reason must be true. A count that cannot be a total must be
+        labelled a floor; a zero means none found. Flag silent zeros, undisclosed truncation, and gate arms]]></a></hit></f><f p="src/abicheck.h" parse_degraded="1"><hit l="494" in="abicheck::collectAuthoredSites"><b><![CDATA[        {]]></b><![CDATA[            DISCLOSE( result, AbiResult::Disclosu … [line truncated: 148 more bytes on this line]
+        }]]></a></hit></f><f p="src/arch.h"><hit l="507" in="rw::parseArchRules"><b><![CDATA[        rw::emitTo( stderr, "ripwire: --arch: {}:{}: {} — rules file rejected\n", path.c_str(), lineNo, why );]]></b><![CDATA[        DISCLOSE( Diagnostics::answerRefused, "--arch exits 1 with path:line an … [line truncated: 134 more bytes on this line]
+        return false;]]></a></hit></f><unindexed count="8" shown="3" capped="1"><f p="CMakeLists.txt"><hit l="122"><![CDATA[# ASSUME and the DISCLOSE( msg ) trace live, which is the only configuration that can catch an]]></hit><hit l="346"><![CDATA[# -DCMAKE_BUILD_TYPE=Release" locally — Release d … [line truncated: 381 more bytes on this line]
+`````
+
+## `./build/ripwire . --regex='fnv1a\w+'`
+
+*Regex search + enclosing symbol.*
+
+**wall time: 1.56s**
+
+`````
+<!-- ripwire grep schema=ripwire.grep/v1: literal/regex scan grouped by file: <f p=>
+<hit l= in=>CDATA text</hit> (<b>/<a> context around it); complete=1 only for an exhaustive literal scan (beside pattern_meta=, of the literal reading only); <unindexed> = off-index. window: shown= capped= (capped=1 cut). hits_capped=1: hits= is a floor. regex_lines_skipped=N: N lines too long for t … [line truncated: 1773 more bytes on this line]
+<grep pattern="fnv1a\w+" schema="ripwire.grep/v1" root="." files="26" hits="84" shown="84" capped="0" hits_capped="0" suppressed_comment="65" suppressed_string="26" tier_parsed="43" tier_unclassified="0" corpus_oversize="15" corpus_pruned_dirs="5" unindexed_hits="23" unindexed_files_scanned="268" un … [line truncated: 77 more bytes on this line]
+<f p="src/arch.h">
+<hit l="678" in="rw::fnv1a64">
+<![CDATA[inline std::uint64_t fnv1a64( std::string_view s ) noexcept]]>
+</hit>
+<hit l="683" in="rw::fnv1a64">
+<![CDATA[        h = hashutil::fnv1aAbsorb( h, c );]]>
+</hit>
+<hit l="788" in="rw::archViolHash">
+<![CDATA[            h = hashutil::fnv1aAbsorb( h, c );]]>
+</hit>
+<hit l="791" in="rw::archViolHash">
+<![CDATA[        h = hashutil::fnv1aMultiply( h ); // NUL separator byte]]>
+</hit>
+</f>
+<f p="src/cloneidiom.h">
+<hit l="607" in="rw::classifyCloneGroupIdioms">
+<![CDATA[                ids.push_back( fnv1a64( t.text ) );]]>
+</hit>
+</f>
+<f p="src/clones.h">
+<hit l="675" in="rw::cloneTokenHash">
+<![CDATA[        h = hashutil::fnv1aAbsorb( h, c );]]>
+</hit>
+<hit l="677" in="rw::cloneTokenHash">
+<![CDATA[    h ^= 0x9e3779b97f4a7c15ull;  h = hashutil::fnv1aMultiply( h );   // token separator so [ab][c] != [a][bc]]]>
+</hit>
+<hit l="782" in="rw::findClonesType3">
+… [413 more display lines; full output is 20770 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --match='(if_statement)'`
+
+*Tree-sitter structural query WITHOUT a capture — a bare node query gets a capture AUTO-ADDED (auto_captured="1") and matches the same nodes the explicit form does.*
+
+**wall time: 2.13s**
+
+`````
+<!-- ripwire match schema=ripwire.match/v1: tree-sitter structural query: <m p= in=> captured nodes with their enclosing symbol; grammars=/eligible_files= the scope. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). counts_floor=1: every count is a FLOOR, never a total. hits_capped=1: hits= is a floor. root=: p= relative to it. auto_captured=1: the query bound no @capture, so @m was appended to its single top-level pattern. of_files=: indexed files in all (eligible_files= of them are in the query's languages). -->
+<match schema="ripwire.match/v1" hits="5000" shown="100" capped="1" total="5000" has_more="1" next_offset="100" offset="0" limit="0" counts_floor="1" hits_capped="1" auto_captured="1" grammars="cpp,c,python,go,typescript,tsx,swift,objc,javascript,bash,java,csharp,php,dart,lua,gdscript" eligible_file … [line truncated: 34 more bytes on this line]
+<m p="bench/agentloop/analyze.py:37" in="load_results">if data.get( "schema" ) != SCHEMA:         raise SystemExit( f"{path}: unexpected schema {data.get('schema')!r} (expecte</m>
+<m p="bench/agentloop/analyze.py:48" in="load_results">if not str( data.get( "tasks_lock_content_sha256", "" ) ).startswith( "questions:" ):         train_repos = select_tasks</m>
+<m p="bench/agentloop/analyze.py:50" in="load_results">if train_repos:             raise SystemExit(                 f"{path}: records from repo(s) that re-derive to LocBench </m>
+<m p="bench/agentloop/analyze.py:72" in="pair_by_task_seed">if base and ctx and base["status"] == "ok" and ctx["status"] == "ok":             paired.append( ( instance_id, base["re</m>
+<m p="bench/agentloop/analyze.py:101" in="clustered_bootstrap_lower">if not repos: return 0.0, []</m>
+<m p="bench/agentloop/analyze.py:117" in="loc_hit_delta">if base["localization_hit"] is None or ctx["localization_hit"] is None: return 0.0</m>
+<m p="bench/agentloop/analyze.py:126" in="paired_ratio">if bv: ratios.append( cv / bv - 1 )</m>
+<m p="bench/agentloop/analyze.py:127" in="paired_ratio">if not ratios: return None, None</m>
+<m p="bench/agentloop/analyze.py:146" in="substitution_rate">if rw is None or native is None:         return None</m>
+<m p="bench/agentloop/analyze.py:169" in="analyze">if not paired:         out["note"] = "zero complete paired (baseline,ripwire_cli) runs — nothing to analyze yet"      </m>
+<m p="bench/agentloop/analyze.py:206" in="print_report">if contaminated:         print( f"  ** {contaminated} baseline run(s) invoked ripwire despite the no-ripwire contract " </m>
+<m p="bench/agentloop/analyze.py:210" in="print_report">if "note" in out:         print( f"  {out['note']}" ); return</m>
+<m p="bench/agentloop/analyze.py:295" in="self_test">if out["n_pairs"] != 27: failures.append( f"expected 27 paired runs, got {out['n_pairs']}" )</m>
+<m p="bench/agentloop/analyze.py:296" in="self_test">if out["n_incomplete"] != 2:         failures.append( f"expected 2 incomplete pairs (the orphan + the contaminated-basel</m>
+<m p="bench/agentloop/analyze.py:299" in="self_test">if out["n_repos"] != 3: failures.append( f"expected 3 repos, got {out['n_repos']}" )</m>
+<m p="bench/agentloop/analyze.py:300" in="self_test">if out.get( "n_contaminated_baseline" ) != 1:         failures.append( f"expected exactly 1 contaminated baseline run co</m>
+<m p="bench/agentloop/analyze.py:303" in="self_test">if not ( out["resolved_delta_mean"] &gt; 0 ): failures.append( "expected a positive resolved-rate delta" )</m>
+<m p="bench/agentloop/analyze.py:304" in="self_test">if not ( out["resolved_delta_bootstrap_95_lower"] &gt; 0 ):         failures.append( "expected a POSITIVE bootstrap 95% low</m>
+<m p="bench/agentloop/analyze.py:306" in="self_test">if out["tokens_out_ratio_p50"] is None or abs( out["tokens_out_ratio_p50"] - 0.08 ) &gt; 1e-6:         failures.append( f"e</m>
+<m p="bench/agentloop/analyze.py:309" in="self_test">if out.get( "n_resolved_pairs" ) != 27:         failures.append( f"expected all 27 pairs resolution-scored, got {out.get</m>
+<m p="bench/agentloop/analyze.py:312" in="self_test">if out.get( "substitution_rate_baseline" ) != 0.0:         failures.append( f"expected baseline substitution rate 0.0 (n</m>
+<m p="bench/agentloop/analyze.py:315" in="self_test">if out.get( "substitution_rate_ripwire" ) is None or abs( out["substitution_rate_ripwire"] - 0.75 ) &gt; 1e-9:         fail</m>
+<m p="bench/agentloop/analyze.py:318" in="self_test">if out.get( "n_substitution_ripwire" ) != 27:         failures.append( f"expected 27 substitution-scored ripwire runs, g</m>
+<m p="bench/agentloop/analyze.py:324" in="self_test">if out3.get( "substitution_rate_ripwire" ) is not None or out3.get( "n_substitution_ripwire" ) != 0:         failures.ap</m>
+<m p="bench/agentloop/analyze.py:330" in="self_test">if out2["n_pairs"] != 27:         failures.append( f"evaluator-none: expected 27 pairs, got {out2['n_pairs']}" )</m>
+<m p="bench/agentloop/analyze.py:332" in="self_test">if out2["n_resolved_pairs"] != 0:         failures.append( f"evaluator-none: expected 0 resolution-scored pairs, got {ou</m>
+<m p="bench/agentloop/analyze.py:334" in="self_test">if out2["resolved_delta_mean"] is not None or out2["resolved_delta_bootstrap_95_lower"] is not None:         failures.ap</m>
+<m p="bench/agentloop/analyze.py:336" in="self_test">if out2["tokens_out_ratio_p50"] is None or abs( out2["tokens_out_ratio_p50"] - 0.08 ) &gt; 1e-6:         failures.append( "</m>
+… [73 more display lines; full output is 16956 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --match='(if_statement) @i'`
+
+*The same shape query WITH an explicit capture — identical hits, no auto_captured= attribute.*
+
+**wall time: 2.10s**
+
+`````
+<!-- ripwire match schema=ripwire.match/v1: tree-sitter structural query: <m p= in=> captured nodes with their enclosing symbol; grammars=/eligible_files= the scope. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). counts_floor=1: every count is a FLOOR, never a total. hits_capped=1: hits= is a floor. root=: p= relative to it. of_files=: indexed files in all (eligible_files= of them are in the query's languages). -->
+<match schema="ripwire.match/v1" hits="5000" shown="100" capped="1" total="5000" has_more="1" next_offset="100" offset="0" limit="0" counts_floor="1" hits_capped="1" grammars="cpp,c,python,go,typescript,tsx,swift,objc,javascript,bash,java,csharp,php,dart,lua,gdscript" eligible_files="2739" of_files= … [line truncated: 16 more bytes on this line]
+<m p="bench/agentloop/analyze.py:37" in="load_results">if data.get( "schema" ) != SCHEMA:         raise SystemExit( f"{path}: unexpected schema {data.get('schema')!r} (expecte</m>
+<m p="bench/agentloop/analyze.py:48" in="load_results">if not str( data.get( "tasks_lock_content_sha256", "" ) ).startswith( "questions:" ):         train_repos = select_tasks</m>
+<m p="bench/agentloop/analyze.py:50" in="load_results">if train_repos:             raise SystemExit(                 f"{path}: records from repo(s) that re-derive to LocBench </m>
+<m p="bench/agentloop/analyze.py:72" in="pair_by_task_seed">if base and ctx and base["status"] == "ok" and ctx["status"] == "ok":             paired.append( ( instance_id, base["re</m>
+<m p="bench/agentloop/analyze.py:101" in="clustered_bootstrap_lower">if not repos: return 0.0, []</m>
+<m p="bench/agentloop/analyze.py:117" in="loc_hit_delta">if base["localization_hit"] is None or ctx["localization_hit"] is None: return 0.0</m>
+<m p="bench/agentloop/analyze.py:126" in="paired_ratio">if bv: ratios.append( cv / bv - 1 )</m>
+<m p="bench/agentloop/analyze.py:127" in="paired_ratio">if not ratios: return None, None</m>
+<m p="bench/agentloop/analyze.py:146" in="substitution_rate">if rw is None or native is None:         return None</m>
+<m p="bench/agentloop/analyze.py:169" in="analyze">if not paired:         out["note"] = "zero complete paired (baseline,ripwire_cli) runs — nothing to analyze yet"      </m>
+<m p="bench/agentloop/analyze.py:206" in="print_report">if contaminated:         print( f"  ** {contaminated} baseline run(s) invoked ripwire despite the no-ripwire contract " </m>
+<m p="bench/agentloop/analyze.py:210" in="print_report">if "note" in out:         print( f"  {out['note']}" ); return</m>
+<m p="bench/agentloop/analyze.py:295" in="self_test">if out["n_pairs"] != 27: failures.append( f"expected 27 paired runs, got {out['n_pairs']}" )</m>
+<m p="bench/agentloop/analyze.py:296" in="self_test">if out["n_incomplete"] != 2:         failures.append( f"expected 2 incomplete pairs (the orphan + the contaminated-basel</m>
+<m p="bench/agentloop/analyze.py:299" in="self_test">if out["n_repos"] != 3: failures.append( f"expected 3 repos, got {out['n_repos']}" )</m>
+<m p="bench/agentloop/analyze.py:300" in="self_test">if out.get( "n_contaminated_baseline" ) != 1:         failures.append( f"expected exactly 1 contaminated baseline run co</m>
+<m p="bench/agentloop/analyze.py:303" in="self_test">if not ( out["resolved_delta_mean"] &gt; 0 ): failures.append( "expected a positive resolved-rate delta" )</m>
+<m p="bench/agentloop/analyze.py:304" in="self_test">if not ( out["resolved_delta_bootstrap_95_lower"] &gt; 0 ):         failures.append( "expected a POSITIVE bootstrap 95% low</m>
+<m p="bench/agentloop/analyze.py:306" in="self_test">if out["tokens_out_ratio_p50"] is None or abs( out["tokens_out_ratio_p50"] - 0.08 ) &gt; 1e-6:         failures.append( f"e</m>
+<m p="bench/agentloop/analyze.py:309" in="self_test">if out.get( "n_resolved_pairs" ) != 27:         failures.append( f"expected all 27 pairs resolution-scored, got {out.get</m>
+<m p="bench/agentloop/analyze.py:312" in="self_test">if out.get( "substitution_rate_baseline" ) != 0.0:         failures.append( f"expected baseline substitution rate 0.0 (n</m>
+<m p="bench/agentloop/analyze.py:315" in="self_test">if out.get( "substitution_rate_ripwire" ) is None or abs( out["substitution_rate_ripwire"] - 0.75 ) &gt; 1e-9:         fail</m>
+<m p="bench/agentloop/analyze.py:318" in="self_test">if out.get( "n_substitution_ripwire" ) != 27:         failures.append( f"expected 27 substitution-scored ripwire runs, g</m>
+<m p="bench/agentloop/analyze.py:324" in="self_test">if out3.get( "substitution_rate_ripwire" ) is not None or out3.get( "n_substitution_ripwire" ) != 0:         failures.ap</m>
+<m p="bench/agentloop/analyze.py:330" in="self_test">if out2["n_pairs"] != 27:         failures.append( f"evaluator-none: expected 27 pairs, got {out2['n_pairs']}" )</m>
+<m p="bench/agentloop/analyze.py:332" in="self_test">if out2["n_resolved_pairs"] != 0:         failures.append( f"evaluator-none: expected 0 resolution-scored pairs, got {ou</m>
+<m p="bench/agentloop/analyze.py:334" in="self_test">if out2["resolved_delta_mean"] is not None or out2["resolved_delta_bootstrap_95_lower"] is not None:         failures.ap</m>
+<m p="bench/agentloop/analyze.py:336" in="self_test">if out2["tokens_out_ratio_p50"] is None or abs( out2["tokens_out_ratio_p50"] - 0.08 ) &gt; 1e-6:         failures.append( "</m>
+… [73 more display lines; full output is 16840 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --query="teleport pagerank" --top-k=5`
+
+*Raw BM25 ranking (debug lens; --for is the real verb).*
+
+**wall time: 2.32s**
+
+`````
+<!-- routed: subtoken+body:broad -->
+<!-- ripwire query schema=ripwire.query/v1: lexical-rank map for the query term, the map's row vocabulary. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. amb=K: K calls split over several defs. -->
+<!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
+<!-- files=3631 symbols=31860 edges=30033 shown=5 est_tokens=1286 ambiguous=2933 unresolved=15249 locality_pinned=9 external=8658 declined=30154 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
+<r schema="ripwire.query/v1" root="." est_tokens="1286">
+<f p="src/serialize.h">
+<s t="var" n="kChurnRankLegend" sc="rw" k="19.1868">
+</s>
+</f>
+<f p="src/mcpverbs.h">
+<s t="fn" n="rankByText" sc="rw" k="15.2893">
+<c n="takeRank"/>
+<c n="rankGraph"/>
+<c n="hits"/>
+<c n="rrfFuse"/>
+<c n="getIndex"/>
+<c n="captureXml"/>
+<c n="serialize"/>
+</s>
+</f>
+<f p="src/gitmine.h">
+<s t="fn" n="churnPriorFromFreq" sc="rw" k="13.4594">
+<c n="DISCLOSE"/>
+</s>
+</f>
+<f p="src/pagerank.cpp">
+<s t="fn" n="pageRankDouble" sc="rw" amb="3" k="13.2439">
+<c n="ASSUME"/>
+<c n="DASSERT"/>
+<c n="DISCLOSE"/>
+… [21 more display lines; full output is 3219 bytes on 1 raw line(s)]
+`````
+
+
+---
+
+# zoom the detail ladder
+
+## `./build/ripwire . --for="pagerank power iteration" --detail=2`
+
+*Importance-weighted detail: FULL bodies for top-2, signatures for the rest.*
+
+**wall time: 6.70s**
+
+`````
+<ctx task="pagerank power iteration" route="subtoken+body" root="." confidence="high" margin_pct="22" at="0712a5182" doc_mentions="5" schema="ripwire.for/v1" budget_bytes="7500" doc_mentions_capped="1" doc_mentions_total="16" est_tokens="8148">
+<!-- ripwire for schema=ripwire.for/v1: bundle=/bodies=/reason= the body posture; d: cx= ccx= complexity, in= callers (absent cx/ccx/in = 0), churn= amp= change, clone= tested= 1, sc= scope, id=p::sc::n; total= shown= capped=1 if cut; task= the query; d pure=1 const/constexpr sig, next= the follow-up to paste; route= name-exact(X)|subtoken+body[:broad|:declined]; confidence=/margin_pct= head score drop (low=flat); t p= file outside sigs (weaker), t sym= its top symbols (a pointer, not the answer), r= rank (gap = trimmed); field name= type= owner= rel=: a member of owner=, rel=creates held by value, uses by reference/pointer; d layer=: built-in arch layer (game|infra|render|math|audio|ai|test) from a dir name in p=; d e= its last line (absent=unknown, never 0; l= the name's line) [doc mentions: 5 docs, 3 symbols; doc_mentions=] -->
+<!-- root= is the crawl root; p= below is RELATIVE to it (single-root only; absent => p= is ingest's own path, unchanged); at=this commit(+dirty). [budget_bytes= is the default BYTE target this ranked payload was shaped toward: row text shortens toward it, no row of the ranked head is removed for it (sigs past_target=)] [sigs capped=1 with shown=total: rows shrunk, none dropped] [sigs past_target=K: the last K rows are past the budget_bytes target, served because they are rows of the ranked head; none is cut] [sigs next=: one call serving all total= rows uncut] [docs_dropped=N: N shown rows have a doc comment not printed (r>24 always, r5..24 if capped)] [docs_after_code=N: N doc rows of the shown set moved below its code rows; same rows, reordered, none added or removed; a question naming docs keeps score order] [files_first=N: N rows moved so r=1..8 are distinct files' best rows, score order, a repeated name once; same rows; fold, hops keep score order] [cut: doc_mentions_capped="1" doc_mentions_total="16" — an indexing cap dropped content not shown here]; lego/compose collapse to a counted stub by default (a disclosed cut): total= that section's own pre-cap row count, shown="0" capped="1" (nothing rendered here), next= names the sections=lego,compose flag that restores both sections byte-identically in one call est_tokens= prices this bundle in tokens -->
+<sigs shown="40" total="40" capped="1" past_target="14" docs_dropped="23" docs_after_code="6" files_first="6" next="--for=&apos;pagerank power iteration&apos; --signatures-only --token-budget=6200">
+<d l="422" e="422" n="kScoreTieAbsEps" sc="rw" p="src/eval.h" churn="18" amp="51" pure="1" r="1" next="--expand=src/eval.h:kScoreTieAbsEps">
+<doc>NodeId order. Renumbering an otherwise-identical graph (the exact &quot;same probe file, different so…</doc>inline constexpr float kScoreTieAbsEps = 1e-6f</d>
+<d l="73" e="144" n="renderDisclosure" sc="rw" p="src/prconverge.h" cx="12" ccx="15" in="14" churn="3" amp="41" r="2">
+<doc>Render one form of the disclosure. Empty string whenever there is nothing to say — no power it…</doc>inline std::string renderDisclosure( const RankDisclosure&amp; d, DiscloseAs as )</d>
+<d l="99" e="206" n="pageRankDouble" sc="rw" p="src/pagerank.cpp" cx="19" ccx="34" in="2" churn="14" amp="44" tested="1" r="3">
+<doc>The PageRank power iteration itself — the numeric kernel every ranked document&apos;s order comes f…</doc>PageRankRun pageRankDouble( const sparseCsr&lt;float&gt;&amp; inEdges, std::span&lt;const double&gt; weightedOutDegree, std::span&lt;const double&gt; teleport, std::span&lt;double&gt; r … [line truncated: 10 more bytes on this line]
+<d l="480" e="526" n="rankByText" sc="rw" p="src/mcpverbs.h" cx="11" ccx="19" in="1" churn="466" amp="552" r="4">inline std::string rankByText( const std::string&amp; root, std::string_view mode, int topK, bool stable = false )</d>
+<d l="11800" e="11805" n="RankedGraph" sc="RankedGraph" p="src/graph.h" churn="473" amp="675" r="5">struct RankedGraph</d>
+<d l="2385" e="2389" n="kChurnRankLegend" sc="rw" p="src/serialize.h" churn="413" amp="525" pure="1" r="6">inline constexpr const char* kChurnRankLegend = &quot;&lt;!-- rank_by=churn: k= is PageRank re-run with the teleport BIASED by git CHANGE-FREQUENCY over window= &quot; &quot;(a c…</d>
+<d l="1372" e="1393" n="sliceRdIterationCeiling" sc="slicev" p="src/slice.h" cx="9" ccx="12" in="1" churn="51" amp="103" r="7">inline std::uint32_t sliceRdIterationCeiling() noexcept</d>
+<d l="31" e="44" n="PageRankRun" sc="PageRankRun" p="src/pagerank.h" churn="8" amp="37" r="8">struct PageRankRun</d>
+<d l="51" e="56" n="RankDisclosure" sc="RankDisclosure" p="src/prconverge.h" churn="3" amp="27" r="9">
+<doc>What a ranked document discloses about the power iteration that ordered it. `isPageRank == false…</doc>struct RankDisclosure</d>
+<d l="13772" e="13781" n="navRelevanceWeight" sc="rw" p="src/graph.h" cx="2" ccx="1" in="2" churn="473" amp="677" r="10">inline std::uint32_t navRelevanceWeight( const Graph&amp; g, NodeId n ) noexcept</d>
+<d l="11809" e="11837" n="rankGraphTeleport" sc="rw" p="src/graph.h" cx="5" ccx="8" in="7" churn="473" amp="682" r="11">inline RankedGraph rankGraphTeleport( const Graph&amp; g, const std::vector&lt;float&gt;&amp; p, float alpha = 0.85f )</d>
+<d l="1247" e="1247" n="kPowerShellPathPrependScope" sc="rw::oswin" p="src/infra/os_win32_logic.h" layer="infra" churn="20" amp="50" pure="1" r="12">inline constexpr std::string_view kPowerShellPathPrependScope = &quot;in PowerShell, for this window</d>
+<d l="1241" e="1246" n="powerShellPathPrependHint" sc="rw::oswin" p="src/infra/os_win32_logic.h" layer="infra" cx="1" in="4" churn="20" amp="54" tested="1" r="13">inline std::string powerShellPathPrependHint( std::string_view programDir ) noexcept</d>
+<d l="1207" e="1231" n="powerShellSingleQuote" sc="rw::oswin" p="src/infra/os_win32_logic.h" layer="infra" cx="8" ccx="6" in="2" churn="20" amp="52" tested="1" r="14">inline std::string powerShellSingleQuote( std::string_view s ) noexcept</d>
+<d l="1051" e="1051" n="path_prepend_hint" sc="rw::os" p="src/infra/os.h" layer="infra" cx="1" in="1" churn="31" amp="71" r="15">inline std::string path_prepend_hint( std::string_view dir )</d>
+<d l="58" e="89" n="HOT_FILES" p="scripts/optremarks.py" churn="14" amp="69" r="16">HOT_FILES = ( &quot;src/pagerank.cpp&quot;, # the power-iteration loop — G2&apos;s no-allocation scope &quot;src/infra/radixSort.h&quot;, # LSD radix entry points &quot;src/infra/radixSort.inl&quot;, # the counting … [line truncated: 76 more bytes on this line]
+<d l="2198" e="2206" n="dynamic_map::leftmost_leaf" p="src/infra/dynamic_map.hpp" layer="infra" cx="2" ccx="1" in="7" churn="7" amp="38" pure="1" r="17">handle_t leftmost_leaf() const</d>
+<d l="1402" e="1418" n="discloseUniformChurnFallback" p="src/main.cpp" cx="3" ccx="2" in="2" churn="453" amp="580" r="18">inline void discloseUniformChurnFallback( bool hasChurnEvidence, bool stubbed, const char* verbLabel, const std::string&amp; windowStamp )</d>
+<d l="293" e="298" n="doctorPathPrependLine" p="src/verbs_doctor.h" cx="2" ccx="1" in="2" churn="45" amp="130" r="19">inline std::string doctorPathPrependLine( const std::string&amp; selfPath )</d>
+<d l="235" e="243" n="doctorWhichRipwire" p="src/verbs_doctor.h" cx="3" ccx="2" in="1" churn="45" amp="129" r="20">inline std::string doctorWhichRipwire( rw::os::stat_t&amp; st )</d>
+<d l="54" e="75" n="testIterationCeiling" p="src/pagerank.cpp" cx="7" ccx="9" in="1" churn="14" amp="43" tested="1" r="21">std::uint32_t testIterationCeiling() noexcept</d>
+<d l="2325" e="2339" n="rankByLegendFor" sc="rw" p="src/serialize.h" cx="4" ccx="4" in="1" churn="413" amp="526" r="22">inline const char* rankByLegendFor( const char* label ) noexcept</d>
+… [156 more display lines; full output is 22215 bytes on 72 raw line(s)]
+`````
+
+## `./build/ripwire . --pack-signatures --top-k=10`
+
+*Body-elided decl skeletons — recounted on this corpus. Measured as element bytes: the <d> signature+doc elements --pack-signatures emits, against the SAME symbols' full <b> bodies from --expand, with the CORPUS-ROOT PREFIX SUBTRACTED FROM BOTH SIDES. That subtraction is the whole methodology and the figure is meaningless without it: the root repeats inside every element's id= and p=, it is not what this verb elides, and counting it makes the headline a function of how deep the checkout happens to sit on disk — on one corpus, three spellings of the same root read 18.6 points apart before the subtraction and agree exactly after it. Root-neutralised on THIS repo: 88.8% fewer bytes at top-10, 86.2% at top-50, 87.4% at top-100 (re-derived 2026-10-10 when the C++ standard-member gate stopped std::vector/std::string calls such as out.push_back() and s.empty() from binding to in-tree namesakes by name: the ranked top-10/50 lost one-line container accessors (svector::push_back, WidePath::c_str, every empty) and gained one-line forwarding helpers and macros (kindIs, ASSUME, formatTo, emitTo) whose signature is nearly the whole body, so less of the set is elidable, from 92.7/88.7/87.6; before that, re-derived 2026-09-20 when the native Windows port landed: src/infra/os_win32.cpp and os_win32_logic.h are ~3,900 lines of new, heavily commented infra that the ranked top-10/50/100 now reach, and their bodies are this ratio's DENOMINATOR, so the figure rises without --pack-signatures eliding anything new, from top-50 87.1. Measured by test/showcasecapturecheck.sh's own recount arm on the combined tree, which is the gate that would otherwise report the drift; before that, re-derived 2026-09-17 at the self-check macro vocabulary rename: VERIFY/VERIFY_TEXT/VERIFY_DEBUG_ONLY/VERIFY_NOT_REACHED/VERIFY_SAME_THREAD/VERIFY_NO_ALIAS*/DYNMAP_VERIFY/DEGRADED_PATH_ALERT renamed to ASSUME/EXPECTS/ENSURES/DASSERT/UNREACHABLE/ASSUME_SAME_THREAD*/ASSUME_NO_ALIAS*/DYNMAP_ASSUME/DISCLOSE (plus new VALIDATE sites) across 839 identifier renames in 179 files, and a hand-written Diagnostics.h/diagnostics.cpp replacing the old ones outright: this moves both WHICH symbols the ranked top-10/50/100 hold and how large their bodies are, from top-50 85.2. A real re-derivation of a corpus that changed, not a tolerance edit; previously re-derived 2026-09-12 when the <d> rows dropped the path-repeating id= for the short sc= scope: the signature side shrank, the bodies did not; before that, 89.5% / 81.8% / 84.3% re-derived 2026-09-10 at the sibs= cap raise: kMaxExpandSibs went 8 -> 100, so --expand's <b> bodies now carry the file context the old cap hid — 89.3% of all sibling names — and the body side is this ratio's DENOMINATOR, so the figure rises without --pack-signatures eliding anything new. Measured on a fixed tree with the top-50 membership and the signature side unchanged: top-50 from 71.0. A real re-derivation of a corpus that changed, not a tolerance edit; previously re-derived 2026-09-09 at the printf-family -> std::print conversion: converting ~1,500 emitter call sites to rw::emitTo/emitRaw/formatTo across 93 files changes how large the ranked symbols' BODIES are, and the body side is this ratio's denominator — top-50 from 72.3. A real re-derivation of a corpus that changed, not a tolerance edit; previously re-derived 2026-09-08 at the confident-zero round, issues #62/#63/#66: that change adds symbols to src/graphlegend.h and the new src/preprocdead.h and re-homes two long comment blocks from call sites onto the helpers they explain, which moves both WHICH symbols the ranked top-50 holds and how large their bodies are — top-50 from 74.0. A real re-derivation of a corpus that changed, not a tolerance edit; previously re-derived 2026-09-06 at the stranger-audit fix round: the doctor, cache-sweep and html-provenance bodies grew this corpus's BODY side, moving top-50 from 75.6 — a real re-derivation, not a tolerance edit; before that, re-derived 2026-09-05 at the capture-audit close: lane L7's P16 caps --expand's sibs= at 8 names, which SHRINKS the body side of this ratio and moved the figure down from 84.5/80.2/80.6 — the V1 2026-08-15 re-center, when sibs=/inc= first grew the body side from 70.0/61.0/63.8, in reverse; both were real re-derivations, not tolerance edits). top-50 is the number to quote, because the sigs payload is top-50 regardless of --top-k and is therefore what THIS command emits. A single small/trivial body can still invert it (signature+doc bigger than the body), like the --format=columnar sibling below. test/showcasecapturecheck.sh (C) re-derives all three from this repo every run, in the same quantity, and fails if the caption and the recount drift apart.*
+
+**wall time: 3.50s**
+
+`````
+<ctx schema="ripwire.pack-signatures/v1">
+<!-- ripwire pack-signatures schema=ripwire.pack-signatures/v1: the ranked map plus <sigs>
+<d l= n= sc= pure=> signature rows. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. pr_iters=N: PageRank iterations. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven  … [line truncated: 1465 more bytes on this line]
+<!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
+<!-- files=3631 symbols=31860 edges=30033 shown=10 est_tokens=5989 ambiguous=2933 unresolved=15249 locality_pinned=9 external=8658 declined=30154 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
+<r root="." est_tokens="6813" pr_iters="36">
+<f p="src/infra/nodekind.h" layer="infra">
+<s t="fn" n="kindIs" sc="rw" k="0.0037">
+</s>
+</f>
+<f p="src/infra/Diagnostics.h" layer="infra">
+<s t="macro" n="ASSUME" amb="1" k="0.0022">
+<c n="RW_ASSUME_" prov="split"/>
+<c n="RW_ASSUME_" prov="split"/>
+</s>
+<s t="macro" n="RW_ASSUME_" overloads="2" k="0.0022">
+<c n="RW_CHECK_"/>
+</s>
+<s t="macro" n="RW_CHECK_" k="0.0019">
+<c n="handleAssert" via="name"/>
+</s>
+<s t="macro" n="EXPECTS" amb="1" k="0.0017">
+<c n="RW_ASSUME_" prov="split"/>
+<c n="RW_ASSUME_" prov="split"/>
+</s>
+</f>
+<f p="src/ingest_metrics.h">
+<s t="fn" n="nodeTextOf" k="0.0021">
+</s>
+</f>
+… [148 more display lines; full output is 14953 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --outline=rankGraphTeleport --top-k=0`
+
+*Control-flow skeleton of one symbol, payload-only via the new --top-k=0.*
+
+**wall time: 6.59s**
+
+`````
+<!-- ripwire pack-signatures schema=ripwire.pack-signatures/v1: the ranked map plus <sigs>
+<d l= n= sc= pure=> signature rows. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. -->
+<ctx schema="ripwire.pack-signatures/v1" root="." est_tokens="327">
+<outline>
+<o t="fn" l="11809" p="src/graph.h" n="rankGraphTeleport">
+<![CDATA[inline RankedGraph rankGraphTeleport( const Graph& g, const std::vector<float>& p, float alpha = 0.85f )
+{
+    PROFILE_SCOPE_DESCRIBE( "rankGraph: PageRank (power iteration)" );
+    const std::vector<float> pw = biasPrior( g, p );
+    const std::size_t N = pw.size();
+    std::vector<double> teleport( pw.begin(), pw.end() );
+    std::vector<double> rankDouble( N, 0.0 );
+    PageRankRun         run{};   // an N == 0 graph never enters the kernel: { 0, converged } — see PageRankRun
+    if( N )
+    {
+  ...
+    }
+    std::vector<float> r( N, 0.f );
+    std::transform( rankDouble.begin(), rankDouble.end(), r.begin(), []( double value ) { return float( value ); } );
+    return { std::move( r ), run.iterationCount, run.hasConverged };
+}
+]]></o></outline></ctx>
+`````
+
+## `./build/ripwire . --outline=rankGraphTeleport:1-10 --top-k=0`
+
+*CHANGED: a line range on --outline is now STRIPPED with a stderr note (it used to refuse).*
+
+**wall time: 2.72s**
+
+`````
+<!-- ripwire pack-signatures schema=ripwire.pack-signatures/v1: the ranked map plus <sigs>
+<d l= n= sc= pure=> signature rows. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. -->
+<ctx schema="ripwire.pack-signatures/v1" root="." est_tokens="327">
+<outline>
+<o t="fn" l="11809" p="src/graph.h" n="rankGraphTeleport">
+<![CDATA[inline RankedGraph rankGraphTeleport( const Graph& g, const std::vector<float>& p, float alpha = 0.85f )
+{
+    PROFILE_SCOPE_DESCRIBE( "rankGraph: PageRank (power iteration)" );
+    const std::vector<float> pw = biasPrior( g, p );
+    const std::size_t N = pw.size();
+    std::vector<double> teleport( pw.begin(), pw.end() );
+    std::vector<double> rankDouble( N, 0.0 );
+    PageRankRun         run{};   // an N == 0 graph never enters the kernel: { 0, converged } — see PageRankRun
+    if( N )
+    {
+  ...
+    }
+    std::vector<float> r( N, 0.f );
+    std::transform( rankDouble.begin(), rankDouble.end(), r.begin(), []( double value ) { return float( value ); } );
+    return { std::move( r ), run.iterationCount, run.hasConverged };
+}
+]]></o></outline></ctx>
+`````
+
+stderr:
+
+`````
+ripwire: --outline=rankGraphTeleport:1-10: --outline has no line-range form — outlining the whole symbol (use --expand=rankGraphTeleport:1-10 for a body slice)
+`````
+
+## `./build/ripwire . --expand=rankGraphTeleport --top-k=0`
+
+*Full body + inline callee signatures.*
+
+**wall time: 2.78s**
+
+`````
+<ctx schema="ripwire.expand/v1" root="." est_tokens="1241">
+<!-- ripwire expand schema=ripwire.expand/v1: full bodies: <bodies shown= total= capped=> of <b t= l= p= n= sibs= sibs_total= sibs_capped= inc=>; <calls>
+<c n= l=> resolved callees. window: shown= total= capped= (capped=1 cut). sibs_capped=/inc_capped=: 1 = cut. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. scrubbed=1: this CDATA is not the bytes (]]> split or C0 replaced). redacted=1: a credential shape rewr … [line truncated: 336 more bytes on this line]
+<bodies shown="1" total="1" capped="0">
+<b t="fn" l="11809" p="src/graph.h" n="rankGraphTeleport" sibs="&lt;file-scope&gt;,DeclinedSiteKind,kNoDeclinedList,Graph,ImplementorRow,implementorClosure,LegoClosure,LegoClosureWalk,LegoClosureWalk,take,boundOf,add,expand,legoImplementorClosure,kEdgeName,kEdgeLink,kEdgeKindMask,edgeKindByte,edgeNa … [line truncated: 1753 more bytes on this line]
+<![CDATA[inline RankedGraph rankGraphTeleport( const Graph& g, const std::vector<float>& p, float alpha = 0.85f )
+{
+    PROFILE_SCOPE_DESCRIBE( "rankGraph: PageRank (power iteration)" );
+    const std::vector<float> pw = biasPrior( g, p );
+    const std::size_t N = pw.size();
+    std::vector<double> teleport( pw.begin(), pw.end() );
+    std::vector<double> rankDouble( N, 0.0 );
+    PageRankRun         run{};   // an N == 0 graph never enters the kernel: { 0, converged } — see PageRankRun
+    if( N )
+    {
+        double teleportMass = 0.0;
+        for( const double value : teleport )
+        {
+            teleportMass += value;
+        }
+        if( teleportMass > 0.0 )
+        {
+            const double inverseMass = 1.0 / teleportMass;
+            for( double& value : teleport )
+            {
+                value *= inverseMass;
+            }
+        }
+        run = pageRankDouble( g.inEdges, g.wOutDeg, teleport, rankDouble, PageRankConfig{ .alpha = double( alpha ) } );
+    }
+    std::vector<float> r( N, 0.f );
+    std::transform( rankDouble.begin(), rankDouble.end(), r.begin(), []( double value ) { return float( value ); } );
+    return { std::move( r ), run.iterationCount, run.hasConverged };
+}]]><calls total="4"><c n="biasPrior" l="11768">inline std::vector&lt;float&gt; biasPrior( const Graph&amp; g, const std::vector&lt;float&gt;&amp; p )</c><c n="PROFILE_SCOPE_DESCRIBE" l="1282">#define PROFILE_SCOPE_DESCRIBE( desc )</c><c n="PROFILE_SCOPE_DESCRIBE" l="1296">#define PROFILE_SCOPE_DESC … [line truncated: 289 more bytes on this line]
+`````
+
+## `./build/ripwire . --expand=rankGraphTeleport:1-12 --top-k=0`
+
+*Body SLICE: lines 1..12 of the symbol's own body, with lines="lo-hi/total" marking it partial.*
+
+**wall time: 3.75s**
+
+`````
+<ctx schema="ripwire.expand/v1" root="." est_tokens="1080">
+<!-- ripwire expand schema=ripwire.expand/v1: full bodies: <bodies shown= total= capped=> of <b t= l= p= n= sibs= sibs_total= sibs_capped= inc=>; <calls>
+<c n= l=> resolved callees. window: shown= total= capped= (capped=1 cut). sibs_capped=/inc_capped=: 1 = cut. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. scrubbed=1: this CDATA is not the bytes (]]> split or C0 replaced). redacted=1: a credential shape rewr … [line truncated: 336 more bytes on this line]
+<bodies shown="1" total="1" capped="0">
+<b t="fn" l="11809" p="src/graph.h" n="rankGraphTeleport" lines="1-12/29" sibs="&lt;file-scope&gt;,DeclinedSiteKind,kNoDeclinedList,Graph,ImplementorRow,implementorClosure,LegoClosure,LegoClosureWalk,LegoClosureWalk,take,boundOf,add,expand,legoImplementorClosure,kEdgeName,kEdgeLink,kEdgeKindMask,edg … [line truncated: 1769 more bytes on this line]
+<![CDATA[inline RankedGraph rankGraphTeleport( const Graph& g, const std::vector<float>& p, float alpha = 0.85f )
+{
+    PROFILE_SCOPE_DESCRIBE( "rankGraph: PageRank (power iteration)" );
+    const std::vector<float> pw = biasPrior( g, p );
+    const std::size_t N = pw.size();
+    std::vector<double> teleport( pw.begin(), pw.end() );
+    std::vector<double> rankDouble( N, 0.0 );
+    PageRankRun         run{};   // an N == 0 graph never enters the kernel: { 0, converged } — see PageRankRun
+    if( N )
+    {
+        double teleportMass = 0.0;
+        for( const double value : teleport )]]><calls total="4"><c n="biasPrior" l="11768">inline std::vector&lt;float&gt; biasPrior( const Graph&amp; g, const std::vector&lt;float&gt;&amp; p )</c><c n="PROFILE_SCOPE_DESCRIBE" l="1282">#define PROFILE_SCOPE_DESCRIBE( desc )</c><c n="PROFILE_SCOPE_DE … [line truncated: 332 more bytes on this line]
+`````
+
+## `./build/ripwire . --expand=compressBody --top-k=0 --compress`
+
+*Comments stripped + blank runs collapsed — compressBody is the function that implements --compress itself, chosen because it is comment-heavy enough to show a real reduction (the previously captioned symbol had no comments or blank runs, so before/after were byte-identical under a caption promising a difference).*
+
+**wall time: 4.17s**
+
+`````
+<ctx schema="ripwire.expand/v1" root="." est_tokens="1924">
+<!-- ripwire expand schema=ripwire.expand/v1: full bodies: <bodies shown= total= capped=> of <b t= l= p= n= sibs= sibs_total= sibs_capped= inc=>; <calls>
+<c n= l=> resolved callees. window: shown= total= capped= (capped=1 cut). sibs_capped=/inc_capped=: 1 = cut. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. scrubbed=1: this CDATA is not the bytes (]]> split or C0 replaced). redacted=1: a credential shape rewr … [line truncated: 336 more bytes on this line]
+<bodies shown="1" total="1" capped="0" compress="1">
+<b t="fn" l="4385" p="src/serialize.h" n="compressBody" sibs="&lt;file-scope&gt;,xmlSafeByte,xmlScrubIsLossy,xmlControlCharRef,kXmlEscapeByteset,escapeXml,writeMultiRootTable,kMultiRootTableLegend,multiRootTableLegend,xmlCommentText,ctxRootOpen,ctxRootJsonScrubKeys,appendCdataSafe,XmlWriter,XmlWrite … [line truncated: 1888 more bytes on this line]
+<![CDATA[inline std::string compressBody( std::string_view src )
+{
+
+
+    std::string out;
+    out.reserve( src.size() );
+
+    const std::size_t N = src.size();
+    std::size_t       i = 0;
+
+    while( i < N )
+    {
+        const char c = src[i];
+
+
+        if( c == '"' )
+        {
+
+            if( i >= 1 && src[i - 1] == 'R' && ( i < 2 || src[i - 2] != '\\' ) )
+            {
+
+                std::size_t j = i + 1;
+                std::string delim;
+                while( j < N && src[j] != '(' && src[j] != '\n' )
+                {
+… [170 more display lines; full output is 7348 bytes on 195 raw line(s)]
+`````
+
+## `./build/ripwire . --expand=readAckRecords --top-k=0 --no-redact`
+
+*--no-redact: emit bodies verbatim (credential redaction is on by default).*
+
+**wall time: 3.97s**
+
+`````
+<ctx schema="ripwire.expand/v1" root="." est_tokens="3160">
+<!-- ripwire expand schema=ripwire.expand/v1: full bodies: <bodies shown= total= capped=> of <b t= l= p= n= sibs= sibs_total= sibs_capped= inc=>; <calls>
+<c n= l=> resolved callees. window: shown= total= capped= (capped=1 cut). sibs_capped=/inc_capped=: 1 = cut. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. <c via="name">: that callee matched by name alone (receiver unproven); it does NOT mean the edge is fal … [line truncated: 443 more bytes on this line]
+<bodies shown="3" total="3" capped="0">
+<b t="fn" l="7588" p="src/quality.h" n="readAckRecords" sibs="&lt;file-scope&gt;,kBaselineFile,kMinCloneTokens,kCcxBar,kLocBar,kNestBar,kParamBar,kShortHorizonDays,kShortHorizonMinCommits,kReusedHelperMinFanin,kMinorCcxDelta,kMinorLocDelta,kMinorParamDelta,kMaterialGrowthPct,kSubBarGrowthPct,subBarG … [line truncated: 1861 more bytes on this line]
+<![CDATA[inline gtl::btree_map<std::string, AckRecord> readAckRecords( const std::string& path, std::size_t& badLines );]]>
+</b>
+<b t="fn" l="7590" p="src/quality.h" n="readAckRecords" sibs="&lt;file-scope&gt;,kBaselineFile,kMinCloneTokens,kCcxBar,kLocBar,kNestBar,kParamBar,kShortHorizonDays,kShortHorizonMinCommits,kReusedHelperMinFanin,kMinorCcxDelta,kMinorLocDelta,kMinorParamDelta,kMaterialGrowthPct,kSubBarGrowthPct,subBarG … [line truncated: 1861 more bytes on this line]
+<![CDATA[inline gtl::btree_map<std::string, AckRecord> readAckRecords( const std::string& path )
+{
+    std::size_t ignored = 0;
+    return readAckRecords( path, ignored );
+}]]><calls total="1"><c n="readAckRecords" l="7596">inline gtl::btree_map&lt;std::string, AckRecord&gt; readAckRecords( const std::string&amp; path, std::size_t&amp; badLines )</c></calls></b><b t="fn" l="7596" p="src/quality.h" n="readAckRecords" sibs="&lt;file-scope&gt;,kBaselineFile,kMinCloneToke … [line truncated: 2172 more bytes on this line]
+{
+    badLines = 0;
+    gtl::btree_map<std::string, AckRecord> out;
+    // openRegularFileStream, not a stream opened on the name: a FIFO planted at the ledger's name blocked that open until
+    // a writer appeared, so --quality-delta hung before any output, and a link to /dev/zero never reached end of file.
+    // Anything that is not a regular file now reads as no ledger, and stderr says so (docparse.h). Still one line at a
+    // time, as the std::ifstream it replaces read it: a large ledger is never held whole.
+    rw::pathguard::NoFollowRead ledger = docparse::detail::openRegularFileStream( "the quality-acks ledger", path );
+    std::string                 line;
+    while( ledger.readLine( line ) )
+    {
+        while( !line.empty() && ( line.back() == '\r' || line.back() == '\n' ) )
+        {
+            line.pop_back(); // CRLF tolerance (merged-in Windows checkout)
+        }
+        if( line.empty() || line[0] == '#' )
+        {
+… [46 more display lines; full output is 12043 bytes on 68 raw line(s)]
+`````
+
+## `./build/ripwire . --pack-top-n=3 --top-k=0`
+
+*Pack the top-3 ranked symbols' full bodies (deprecated verb; see stderr).*
+
+**wall time: 2.72s**
+
+`````
+<ctx schema="ripwire.pack-top-n/v1" root="." est_tokens="17427">
+<!-- ripwire pack-top-n schema=ripwire.pack-top-n/v1: the ranked map plus <src p=> bodies of the top-N symbols. window: shown= total= capped= (capped=1 cut). est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. <src truncated=1 lines=1-K/T>: cut at a line end at the byte budget; K of its T lines. <src_cut shown= total= capped=1 budget_bytes=>: files served of the top-N asked, the rest over the byte ceiling; unreadable=N not readable. -->
+<src_cut shown="1" total="3" capped="1" budget_bytes="65536"/>
+<src p="./src/graph.h" truncated="1" lines="1-1047/16280">
+<![CDATA[#pragma once
+
+// graph.h — resolve references → graph, build the in-edge CSR for PageRank, and the
+// resolved out-edges for serialization. Ranking lives in pagerank.cpp.
+
+#include "model.h"
+#include "elixir_resolve.h"      // lexical module/name/arity resolution; reuses cached Binding records
+#include "filter.h"              // isTestPath — for the Q2 tested= post-pass
+#include "pageview.h"            // LB-H: kImportReachRowCap — the import tier's display cap lives with the rest of the truncation vocabulary
+#include "nextverb.h"            // cut-fix E: nextFlag / nextAttrXml — the import tier's importers_next=
+#include "graphlegend.h"         // M15: graphGaugeAttrXml/Json + kGraphCountFloorAttrXml/Json — graphCountFloorAttrXml( g ) below
+#include "lintrules.h"           // langOfPath / dependencyCapable — the file-language classification
+                                 // restrictDependencyHealth() needs (owns the extension table, kept in sync
+                                 // by hand with ingest.cpp's kLangTable per its own header comment)
+#include "infra/sparseCsr.h"     // first-party infra math (src/infra/)
+#include "infra/csrverify.h"     // structural gate, ASSUME'd after every production CSR build
+#include "infra/hashutil.h"      // fnv1aAbsorb — internDeclinedList buckets a declined call's candidate list by its bytes
+#include "pagerank.h"            // double-precision PageRank kernel over float CSR storage
+#include "prconverge.h"          // RankDisclosure — the power iteration's own account, carried with its result
+#include "smallvec.h"            // rw::SmallVec — THE ONE ALIAS (src/smallvec.h picks the implementation)
+#include "resolve.h"             // P2-D one-hop type narrowing (Rule 1: class membership) — applied before the name-based fallback
+#include "receiverevidence.h"    // FE-B: typed receivers RESOLVE; a call nothing proves keeps its rows marked via="name"
+#include "ifacedispatch.h"       // lane L6: a call on an interface-typed receiver names its implementors' methods (BaseBound)
+#include "langfacts.h"           // langFacts(l): the per-language facts the resolver reads instead of a Lang:: compare
+#include "scipoverlay.h"         // SCIP precision overlay (data struct only; parser lives in scip.h)
+#include "pincensus.h"           // eval-only per-call-site decision census (--pin-census); inert unless armed
+… [1021 more display lines; full output is 66121 bytes on 1047 raw line(s)]
+`````
+
+stderr:
+
+`````
+ripwire: --pack-top-n is deprecated — use --pack-task/--detail instead (unchanged behavior for now)
+`````
+
+
+---
+
+# assess quality / structure
+
+## `./build/ripwire . --metrics --top-k=10`
+
+*Fan-in/out + complexity annotations on the map.*
+
+**wall time: 5.78s**
+
+`````
+<!-- ripwire metrics schema=ripwire.metrics/v1: the ranked map with per-symbol metrics. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. pr_iters=N: PageRank iterations. <inv listed= unlisted=>: files the ranked rows show / do not (sum = files=), each named or counted below. <entry p= n=>: a program entry by its language's convention (C/Go/Rust main, Java/C# static main, a script main its module scope calls, __main__.py), callees as c rows; manifest entries not read. <ls p= n= f=>: n= unshown files under dir p=; f= names its code files, the rest (tests, docs, config, test/doc/example dirs) counted. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. <s tested=1>: a non-test row an indexed test transitively reaches (absent otherwise, never 0). <c via="name">: that callee matched by name alone (receiver unproven); it does NOT mean the edge is false. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. amb=K: K calls split over several defs. locals_floor=1: locals= is a floor. role=hub: in= is 8 or more. s in= out= cx= ccx= loc= params= nest= cbo= lcom4= amp=: callers, callees, cyclomatic/cognitive complexity, lines, parameters, nesting depth, coupled types, class cohesion, callers + co-changed files. ev=/ev_why=: essential complexity (2+: jumps block extract-method; absent: 1) / the jumps behind it, tag:count. ev_floor=1: ev= is a FLOOR; noreturn calls, macro-hidden exits and unresolved gotos are unseen. layer=: built-in arch layer (game|infra|render|math|audio|ai|test) from a dir name in p=; absent if none. l=N: start line; only on a same-name overload's row, one row per body (bodyless decls fold into overloads=). -->
+<!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
+<!-- stem="1": a class/struct/interface of that file whose name shares the most subtokens with the file name, added after the file's top-K rows because the rank cut left it out (no kept row dropped; counted in shown=) -->
+<!-- files=3631 symbols=31860 edges=30033 shown=12 est_tokens=4590 ambiguous=2933 unresolved=15249 locality_pinned=9 external=8658 declined=30154 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
+<r schema="ripwire.metrics/v1" root="." est_tokens="4590" pr_iters="36">
+<f p="src/infra/nodekind.h" layer="infra">
+<s t="fn" n="kindIs" sc="rw" in="337" out="0" cx="3" ccx="3" role="hub" loc="11" params="2" nest="2" locals="0" locals_floor="1" cbo="0" amp="350" tested="1" k="0.0037" ev="3" ev_floor="1" ev_why="guard-return:1">
+</s>
+</f>
+<f p="src/infra/Diagnostics.h" layer="infra">
+<s t="macro" n="ASSUME" in="163" out="2" cx="0" ccx="0" role="hub" loc="2" cbo="2" amp="232" tested="1" amb="1" k="0.0022">
+<c n="RW_ASSUME_" prov="split"/>
+<c n="RW_ASSUME_" prov="split"/>
+</s>
+<s t="macro" n="RW_ASSUME_" l="322" in="3" out="1" cx="0" ccx="0" loc="2" cbo="1" amp="72" tested="1" k="0.0022">
+<c n="RW_CHECK_"/>
+</s>
+<s t="macro" n="RW_ASSUME_" l="364" in="3" out="3" cx="0" ccx="0" loc="7" cbo="3" amp="72" tested="1" amb="1" k="0.0022">
+<c n="RW_ASSUME_RELEASE_" prov="split"/>
+<c n="RW_ASSUME_RELEASE_" prov="split"/>
+<c n="RW_ASSUME_RELEASE_" prov="split"/>
+</s>
+<s t="macro" n="RW_CHECK_" in="2" out="1" cx="0" ccx="0" loc="9" cbo="1" amp="71" tested="1" k="0.0019">
+<c n="handleAssert" via="name"/>
+</s>
+<s t="macro" n="EXPECTS" in="122" out="2" cx="0" ccx="0" role="hub" loc="2" cbo="2" amp="191" tested="1" amb="1" k="0.0017">
+<c n="RW_ASSUME_" prov="split"/>
+<c n="RW_ASSUME_" prov="split"/>
+</s>
+</f>
+… [102 more display lines; full output is 11385 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --deps`
+
+*File->file dependency graph (god-files, cycles).*
+
+**wall time: 1.92s**
+
+`````
+<!-- ripwire deps schema=ripwire.deps/v1: file-to-file include/import view, heaviest cone first: <f p= afferent= includes= instab= transitive=>, <health>, <godfiles>, <cycles>. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). root=: p= relative to it. files=N: files with at least one include/import directive; this listing's denominator (health files= = corpus). violations=N: edges into a file more unstable by over 0.05 (Martin I); only the worst 12 are listed. from=: the including file of a stable-deps violation; it depends on the more unstable to=. gap=: instab of to= minus instab of from=, project includes only; worst first. godfiles f layer=: built-in arch layer (game|infra|render|math|audio|ai|test) from a dir name in p=; absent if none. layer=test only for a file under a test directory whose dependents are all test paths, by path. health dep_files=N: dependency-capable files (dep_langs=), the ccd/acd/nccd denominator. health dep_langs=: the languages dep_files= counts; compare its numbers across builds only when equal. ccd=/acd=/nccd=: Lakos: sum of per-file transitive cones (self incl) / per file / over a balanced tree's. health shape=: the nccd= verdict: horizontal below 1, vertical 1 to 2, tangled above 2 (a heuristic). health lazy_edges=N: in-closure (lazy) include pairs kept OUT of cones, cycles and ccd; absent at 0. cycle size=/cost=: files in that include cycle / size squared, the cycle's share of ccd=. cycle cut=/cutrefs=: SUGGESTED edge to break it (fewest directives) / that edge's directive count; nothing cut. -->
+<deps schema="ripwire.deps/v1" files="1361" shown="40" capped="1" total="1361" has_more="1" next_offset="40" offset="0" limit="0" root=".">
+<health files="3631" dep_files="3132" ccd="12746" acd="4.1" nccd="0.38" shape="horizontal" lazy_edges="82" dep_langs="cpp,py,ts,go,rs,swift,objc,js,sh,java,rb,cs,c,php,lua,ex,kt"/>
+<godfiles total="639" shown="12" capped="1">
+<f p="test/lib/clean-env.sh" afferent="204" layer="test"/>
+<f p="src/model.h" afferent="105"/>
+<f p="src/infra/emit.h" afferent="87" layer="infra"/>
+<f p="src/infra/Diagnostics.h" afferent="65" layer="infra"/>
+<f p="src/graph.h" afferent="47"/>
+<f p="src/serialize.h" afferent="45"/>
+<f p="src/infra/os.h" afferent="36" layer="infra"/>
+<f p="test/falseedgefix/jsrebind/src/eng.js" afferent="32" layer="test"/>
+<f p="src/infra/sortutil.h" afferent="28" layer="infra"/>
+<f p="scripts/cxxstd.sh" afferent="27"/>
+<f p="src/infra/jsonesc.h" afferent="26" layer="infra"/>
+<f p="src/ingest.h" afferent="26"/>
+</godfiles>
+<stabledeps violations="45">
+<v from="src/gitstamp.h" to="src/quality.h" gap="0.50"/>
+<v from="test/declinedsitefix/rb/lib/rake/task.rb" to="test/legotransitivefix/rb/task.rb" gap="0.50"/>
+<v from="src/graph.h" to="src/pincensus.h" gap="0.48"/>
+<v from="src/serialize.h" to="src/mapinventory.h" gap="0.47"/>
+<v from="src/infra/sortutil.h" to="src/infra/radixSort.h" gap="0.47"/>
+<v from="src/model.h" to="src/structlayout.h" gap="0.45"/>
+<v from="src/graph.h" to="src/ifacedispatch.h" gap="0.44"/>
+<v from="src/infra/profileScope.h" to="src/infra/profilePmc.h" gap="0.33"/>
+<v from="src/model.h" to="src/infra/profileScope.h" gap="0.28"/>
+<v from="src/testmap.h" to="src/jsrunner.h" gap="0.26"/>
+<v from="test/cyclecutfix/b.h" to="test/cyclecutfix/c.h" gap="0.25"/>
+<v from="test/cyclecutfix/c.h" to="test/cyclecutfix/a.h" gap="0.25"/>
+… [904 more display lines; full output is 24136 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --hotspots`
+
+*Complexity x recent git churn (maintenance pain).*
+
+**wall time: 6.87s**
+
+`````
+<!-- ripwire hotspots schema=ripwire.hotspots/v1: maintenance pain = churn x ccx over window=: <f p= churn= ccx= score= top= top_ccx= top_l=>; unranked_*= no churn/complexity. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). at=: commit+dirty+shallow. root=: p= relative to it. files=/ranked=: files in the window / those with both churn and complexity; ranked + unranked_no_churn + unranked_no_complexity = files. unranked_no_churn=/unranked_no_complexity=: files left out for no commit in window= / no measured complexity. -->
+<!-- extent_suspect_syms=K on a row = K of the file's functions failed an extent/scope containment check (the map, the bundles and the skipped verb mark each one, reasons and all) and are LEFT OUT of that row's ccx=, score= and top=, so its ccx= is a FLOOR of the file's true sum rather than a total. unranked_extent_suspect= counts files with commits whose every scorable function was left out that way (or whose trusted remainder scores 0), so ranked= + unranked_no_churn= + unranked_no_complexity= + unranked_extent_suspect= = files= exactly. Absent = nothing excluded. -->
+<hotspots schema="ripwire.hotspots/v1" window="12mo@HEAD" files="3631" ranked="826" unranked_no_churn="0" unranked_no_complexity="2803" unranked_extent_suspect="2" shown="40" capped="1" total="826" has_more="1" next_offset="40" offset="0" limit="0" root="." at="0712a5182">
+<f p="src/graph.h" churn="473" ccx="5049" score="2388177" top="buildGraph" top_ccx="1758" top_l="8255"/>
+<f p="src/serialize.h" churn="413" ccx="2575" score="1063475" top="serialize" top_ccx="295" top_l="3037"/>
+<f p="src/quality.h" churn="481" ccx="1961" score="943241" top="computeDelta" top_ccx="310" top_l="9166"/>
+<f p="src/mcpverbs.h" churn="466" ccx="1254" score="584364" top="runBatchSub" top_ccx="138" top_l="5869"/>
+<f p="src/main.cpp" churn="453" ccx="1247" score="564891" top="dispatchMain" top_ccx="482" top_l="4307"/>
+<f p="src/cli.h" churn="511" ccx="667" score="340837" top="parseArgs" top_ccx="213" top_l="5379"/>
+<f p="src/ingest_binds.h" churn="120" ccx="2315" score="277800" top="captureJsEvidence" top_ccx="98" top_l="6714"/>
+<f p="src/resolve.h" churn="143" ccx="1863" score="266409" top="buildPreciseIncludeAdjWithContext" top_ccx="84" top_l="4319"/>
+<f p="src/verbs_for.h" churn="222" ccx="924" score="205128" top="runForLensPass" top_ccx="485" top_l="2640"/>
+<f p="src/verbs_navigate.h" churn="226" ccx="824" score="186224" top="runVerify" top_ccx="144" top_l="1948"/>
+<f p="src/mcp.h" churn="158" ccx="948" score="149784" top="dispatchMcpLine" top_ccx="757" top_l="1120"/>
+<f p="src/ingest_sidecap.h" churn="139" ccx="930" score="129270" top="captureTagsFacts" top_ccx="490" top_l="1838"/>
+<f p="src/compactlegend.h" churn="324" ccx="325" score="105300" top="applyCompactDialectOnce" top_ccx="49" top_l="2299"/>
+<f p="src/ingest_cache.h" churn="279" ccx="350" score="97650" top="saveCache" top_ccx="95" top_l="3224"/>
+<f p="src/crossref.h" churn="95" ccx="1014" score="96330" top="streamBlobs" top_ccx="43" top_l="537"/>
+<f p="src/verbs_report.h" churn="80" ccx="1143" score="91440" top="runStructureText" top_ccx="251" top_l="3189"/>
+<f p="src/verbs_quality.h" churn="106" ccx="743" score="78758" top="runQualityDelta" top_ccx="343" top_l="1714"/>
+<f p="src/receiverevidence.h" churn="67" ccx="1046" score="70082" top="bareClassAt" top_ccx="77" top_l="736"/>
+<f p="src/gitmine.h" churn="75" ccx="670" score="50250" top="applyCoChangeBoost" top_ccx="95" top_l="3119"/>
+<f p="src/ingest_relations.h" churn="73" ccx="681" score="49713" top="captureFields" top_ccx="87" top_l="1307"/>
+<f p="src/search.h" churn="64" ccx="697" score="44608" top="grepCollect" top_ccx="59" top_l="1427"/>
+<f p="src/lexical.h" churn="62" ccx="689" score="42718" top="lexicalScoresTiered" top_ccx="450" top_l="470"/>
+<f p="src/slice.h" churn="51" ccx="831" score="42381" top="sliceClassify" top_ccx="183" top_l="608"/>
+<f p="src/ingest_crawl.h" churn="79" ccx="519" score="41001" top="collectSources" top_ccx="90" top_l="1742"/>
+<f p="src/verbs_change.h" churn="82" ccx="449" score="36818" top="runChangeViews" top_ccx="157" top_l="245"/>
+<f p="src/ingest_valuerefs.h" churn="38" ccx="937" score="35606" top="classify" top_ccx="100" top_l="1778"/>
+<f p="src/packtask.h" churn="87" ccx="393" score="34191" top="packTaskBundleText" top_ccx="218" top_l="1438"/>
+… [14 more display lines; full output is 5767 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --clones`
+
+*Token-normalized duplicate bodies.*
+
+**wall time: 3.73s**
+
+`````
+<!-- ripwire clones schema=ripwire.clones/v1: similar normalized-token bodies: <group type=2|3 gid= tokens= n= similarity=> of <f n= p=>; dup_loc=/dup_pct=. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). root=: p= relative to it. groups=/type3=: Type-2 and Type-3 group totals over all groups; total= is their sum. exempt_groups=N: groups whose members all sit on fixture/shell-runner paths quality-delta duplication ignores. idiom_groups=/demoted_groups=: groups of one recognized idiom / those quality-delta demotes to minor; floors. clone_groups=N: clusters after merging pairs (rows sharing gid=); a floor under type3_capped=1. total_loc=N: lines of every function body the detector considered; dup_pct= is dup_loc= over it. group exempt=fixture|shell-runner: every member is on such a path; quality-delta duplication ignores it. group idiom=: the recognized shape every member spells: threshold-ladder, switch-name-table, builder-chain. -->
+<clones schema="ripwire.clones/v1" groups="136" type3="620" exempt_groups="445" idiom_groups="20" demoted_groups="12" clone_groups="365" dup_loc="7679" total_loc="245474" dup_pct="3.1" shown="80" capped="1" total="756" has_more="1" next_offset="80" offset="0" limit="0" root=".">
+<group type="2" gid="49" tokens="338" n="3">
+<f n="rw_is_ripwire_call" p="hooks/ripwire-claude-route.sh:187"/>
+<f n="rw_is_ripwire_call" p="hooks/ripwire-codex-route.sh:104"/>
+<f n="rw_is_ripwire_call" p="hooks/ripwire-nudge.sh:623"/>
+</group>
+<group type="2" gid="236" tokens="213" n="2" exempt="shell-runner">
+<f n="call_sites" p="test/declinecheck.sh:116"/>
+<f n="call_sites" p="test/usesselectorcheck.sh:49"/>
+</group>
+<group type="2" gid="305" tokens="211" n="4" exempt="shell-runner">
+<f n="batch_sub" p="test/mcpclidiffcheck.sh:64"/>
+<f n="batch_sub" p="test/mcptranchecheck.sh:55"/>
+<f n="batch_sub" p="test/mcpw2fixcheck.sh:52"/>
+<f n="batch_sub" p="test/mcpw3fixcheck.sh:51"/>
+</group>
+<group type="2" gid="48" tokens="163" n="3">
+<f n="rw_cmd_word" p="hooks/ripwire-claude-route.sh:157"/>
+<f n="rw_cmd_word" p="hooks/ripwire-codex-route.sh:74"/>
+<f n="rw_cmd_word" p="hooks/ripwire-nudge.sh:593"/>
+</group>
+<group type="2" gid="209" tokens="153" n="2" exempt="shell-runner">
+<f n="mcp_text" p="test/blindspotcheck.sh:120"/>
+<f n="mcp_text" p="test/xmlwellformed.sh:322"/>
+</group>
+<group type="2" gid="325" tokens="151" n="3" exempt="shell-runner">
+<f n="monotonic_check" p="test/pyimportprecisecheck.sh:89"/>
+<f n="monotonic_check" p="test/rustimportprecisecheck.sh:141"/>
+<f n="monotonic_check" p="test/tsimportprecisecheck.sh:170"/>
+… [308 more display lines; full output is 16199 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --cochange`
+
+*Files that change together in git (hidden coupling).*
+
+**wall time: 5.67s**
+
+`````
+<!-- ripwire cochange schema=ripwire.cochange/v1: files that change together in git: <pair a= b= together= deg= conf_ab= conf_ba= surprising=>, or for of= <f p= together= conf_rev=>. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). at=: commit+dirty+shallow. root=: p= relative to it. pairs=N: file pairs with 3+ shared commits in window= (after min_recur), surprising or not. sub_windows=N: equal-commit-count slices of window=; the denominator of recur=. driver=a|b: the side whose changes best imply the other's, look there first; absent on a tie. recur=K: slices of sub_windows= the pair co-changed in; 1 = one burst, not a standing coupling. -->
+<cochange schema="ripwire.cochange/v1" pairs="4441" window="18mo@HEAD" sub_windows="3" shown="30" capped="1" total="4441" has_more="1" next_offset="30" offset="0" limit="0" root="." at="0712a5182">
+<pair a="src/layout.h" b="test/layoutfix/attrfields.h" together="4" deg="1.00" conf_ab="0.18" conf_ba="1.00" driver="b" recur="1" surprising="1"/>
+<pair a="test/headsnapcachecheck.sh" b="test/qsnapcachecheck.sh" together="4" deg="1.00" conf_ab="1.00" conf_ba="1.00" recur="2" surprising="1"/>
+<pair a="test/headsnapcachecheck.sh" b="test/qsnapprefetchcheck.sh" together="4" deg="1.00" conf_ab="1.00" conf_ba="0.67" driver="a" recur="2" surprising="1"/>
+<pair a="test/situhunkcheck.sh" b="test/testgatehunkcheck.sh" together="4" deg="1.00" conf_ab="0.57" conf_ba="1.00" driver="b" recur="1" surprising="1"/>
+<pair a="test/qsnapcachecheck.sh" b="test/qsnapprefetchcheck.sh" together="4" deg="1.00" conf_ab="1.00" conf_ba="0.67" driver="a" recur="2" surprising="1"/>
+<pair a="test/grepcontextcheck.sh" b="test/grepscancheck.sh" together="3" deg="1.00" conf_ab="1.00" conf_ba="1.00" recur="1" surprising="1"/>
+<pair a="test/elixircheck.sh" b="test/elixirsemanticcheck.sh" together="3" deg="1.00" conf_ab="0.14" conf_ba="1.00" driver="b" recur="2" surprising="1"/>
+<pair a="test/javamethodreffix/A.java" b="test/javamethodreffix/Widget.java" together="3" deg="1.00" conf_ab="0.75" conf_ba="1.00" driver="b" recur="1" surprising="1"/>
+<pair a="src/binstale.h" b="src/crossref.h" together="3" deg="1.00" conf_ab="1.00" conf_ba="0.04" driver="a" recur="3" surprising="1"/>
+<pair a="test/cachesplitcheck.sh" b="test/evictioncheck.sh" together="3" deg="1.00" conf_ab="1.00" conf_ba="0.23" driver="a" recur="2" surprising="1"/>
+<pair a="src/fieldaffinity.h" b="test/accessshapefix/walks.cpp" together="3" deg="1.00" conf_ab="0.38" conf_ba="1.00" driver="b" recur="1" surprising="1"/>
+<pair a="test/mcpslicecheck.sh" b="test/mcpverbscheck.sh" together="3" deg="1.00" conf_ab="1.00" conf_ba="0.16" driver="a" recur="2" surprising="1"/>
+<pair a="src/accessshape.h" b="test/accessshapefix/walks.cpp" together="3" deg="1.00" conf_ab="0.75" conf_ba="1.00" driver="b" recur="1" surprising="1"/>
+<pair a="test/rubyrecvcheck.sh" b="test/rubyrequirecheck.sh" together="3" deg="1.00" conf_ab="0.50" conf_ba="1.00" driver="b" recur="1" surprising="1"/>
+<pair a="test/pincensuscheck.sh" b="test/scipjoincheck.sh" together="3" deg="1.00" conf_ab="0.38" conf_ba="1.00" driver="b" recur="3" surprising="1"/>
+<pair a="test/qschemetripcheck.sh" b="test/rubyrequirecheck.sh" together="3" deg="1.00" conf_ab="0.01" conf_ba="1.00" driver="b" recur="1" surprising="1"/>
+<pair a="test/grepcheck.sh" b="test/grepscancheck.sh" together="3" deg="1.00" conf_ab="0.50" conf_ba="1.00" driver="b" recur="1" surprising="1"/>
+<pair a="test/grepcheck.sh" b="test/grepcontextcheck.sh" together="3" deg="1.00" conf_ab="0.50" conf_ba="1.00" driver="b" recur="1" surprising="1"/>
+<pair a="test/luacheck.sh" b="test/phpcheck.sh" together="3" deg="1.00" conf_ab="0.75" conf_ba="1.00" driver="b" recur="2" surprising="1"/>
+<pair a="bench/agentloop/analyze.py" b="bench/agentloop/run_agentloop.py" together="8" deg="0.89" conf_ab="0.89" conf_ba="0.44" driver="a" recur="1" surprising="1"/>
+<pair a="src/graph.h" b="src/ingest_jsimports.h" together="8" deg="0.89" conf_ab="0.02" conf_ba="0.89" driver="b" recur="2" surprising="1"/>
+<pair a="src/ingest_model.h" b="src/model.h" together="35" deg="0.88" conf_ab="0.88" conf_ba="0.15" driver="a" recur="3" surprising="1"/>
+<pair a="hooks/ripwire-claude-route.sh" b="hooks/ripwire-codex-route.sh" together="18" deg="0.86" conf_ab="0.82" conf_ba="0.86" driver="b" recur="3" surprising="1"/>
+<pair a="src/ingest_ruby.h" b="src/model.h" together="6" deg="0.86" conf_ab="0.86" conf_ba="0.03" driver="a" recur="1" surprising="1"/>
+<pair a="src/cli.h" b="src/sarif.h" together="6" deg="0.86" conf_ab="0.01" conf_ba="0.86" driver="b" recur="3" surprising="1"/>
+<pair a="src/graph.h" b="src/ingest_ruby.h" together="6" deg="0.86" conf_ab="0.01" conf_ba="0.86" driver="b" recur="1" surprising="1"/>
+<pair a="src/ingest_cache.h" b="src/ingest_ruby.h" together="6" deg="0.86" conf_ab="0.02" conf_ba="0.86" driver="b" recur="1" surprising="1"/>
+<pair a="src/fielduses.h" b="src/verbs_navigate.h" together="5" deg="0.83" conf_ab="0.83" conf_ba="0.02" driver="a" recur="3" surprising="1"/>
+<pair a="src/serialize.h" b="src/verify.h" together="5" deg="0.83" conf_ab="0.01" conf_ba="0.83" driver="b" recur="2" surprising="1"/>
+<pair a="test/anchorcheck.sh" b="test/routecheck.sh" together="13" deg="0.81" conf_ab="0.81" conf_ba="0.72" driver="a" recur="3" surprising="1"/>
+</cochange>
+`````
+
+## `./build/ripwire . --hotspots --since="2 weeks ago"`
+
+*Hotspots scoped to RECENT churn (the regression lens).*
+
+**wall time: 8.47s**
+
+`````
+<!-- ripwire hotspots schema=ripwire.hotspots/v1: maintenance pain = churn x ccx over window=: <f p= churn= ccx= score= top= top_ccx= top_l=>; unranked_*= no churn/complexity. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). at=: commit+dirty+shallow. root=: p= relative to it. files=/ranked=: files in the window / those with both churn and complexity; ranked + unranked_no_churn + unranked_no_complexity = files. unranked_no_churn=/unranked_no_complexity=: files left out for no commit in window= / no measured complexity. -->
+<hotspots schema="ripwire.hotspots/v1" window="2 weeks ago" files="3631" ranked="236" unranked_no_churn="2622" unranked_no_complexity="773" shown="40" capped="1" total="236" has_more="1" next_offset="40" offset="0" limit="0" root="." at="0712a5182">
+<f p="src/graph.h" churn="145" ccx="5049" score="732105" top="buildGraph" top_ccx="1758" top_l="8255"/>
+<f p="src/serialize.h" churn="71" ccx="2575" score="182825" top="serialize" top_ccx="295" top_l="3037"/>
+<f p="src/quality.h" churn="65" ccx="1961" score="127465" top="computeDelta" top_ccx="310" top_l="9166"/>
+<f p="src/ingest_binds.h" churn="49" ccx="2315" score="113435" top="captureJsEvidence" top_ccx="98" top_l="6714"/>
+<f p="src/mcpverbs.h" churn="85" ccx="1254" score="106590" top="runBatchSub" top_ccx="138" top_l="5869"/>
+<f p="src/verbs_navigate.h" churn="72" ccx="824" score="59328" top="runVerify" top_ccx="144" top_l="1948"/>
+<f p="src/receiverevidence.h" churn="53" ccx="1046" score="55438" top="bareClassAt" top_ccx="77" top_l="736"/>
+<f p="src/verbs_for.h" churn="55" ccx="924" score="50820" top="runForLensPass" top_ccx="485" top_l="2640"/>
+<f p="src/compactlegend.h" churn="74" ccx="325" score="24050" top="applyCompactDialectOnce" top_ccx="49" top_l="2299"/>
+<f p="src/ingest_valuerefs.h" churn="22" ccx="937" score="20614" top="classify" top_ccx="100" top_l="1778"/>
+<f p="src/ingest_sidecap.h" churn="21" ccx="930" score="19530" top="captureTagsFacts" top_ccx="490" top_l="1838"/>
+<f p="src/resolve.h" churn="10" ccx="1863" score="18630" top="buildPreciseIncludeAdjWithContext" top_ccx="84" top_l="4319"/>
+<f p="src/ingest_cache.h" churn="51" ccx="350" score="17850" top="saveCache" top_ccx="95" top_l="3224"/>
+<f p="src/cli.h" churn="23" ccx="667" score="15341" top="parseArgs" top_ccx="213" top_l="5379"/>
+<f p="src/pathgaps.h" churn="30" ccx="474" score="14220" top="pathBridge" top_ccx="130" top_l="1214"/>
+<f p="src/main.cpp" churn="11" ccx="1247" score="13717" top="dispatchMain" top_ccx="482" top_l="4307"/>
+<f p="src/verbs_quality.h" churn="17" ccx="743" score="12631" top="runQualityDelta" top_ccx="343" top_l="1714"/>
+<f p="src/graphlegend.h" churn="67" ccx="147" score="9849" top="declinedSitesLegend" top_ccx="29" top_l="762"/>
+<f p="src/model.h" churn="70" ccx="129" score="9030" top="shadowSuppressedSite" top_ccx="14" top_l="2295"/>
+<f p="src/mcp.h" churn="8" ccx="948" score="7584" top="dispatchMcpLine" top_ccx="757" top_l="1120"/>
+<f p="src/valuerefindex.h" churn="17" ccx="433" score="7361" top="resolveName" top_ccx="52" top_l="734"/>
+<f p="src/search.h" churn="10" ccx="697" score="6970" top="grepCollect" top_ccx="59" top_l="1427"/>
+<f p="src/testmap.h" churn="13" ccx="480" score="6240" top="rankTestRows" top_ccx="42" top_l="248"/>
+<f p="src/ingest_relations.h" churn="9" ccx="681" score="6129" top="captureFields" top_ccx="87" top_l="1307"/>
+<f p="src/defattrib.h" churn="21" ccx="284" score="5964" top="tsContractSignatures" top_ccx="24" top_l="100"/>
+<f p="test/receiverevidencecheck.sh" churn="47" ccx="94" score="4418" top="impact_send" top_ccx="8" top_l="863"/>
+<f p="src/ingest_metrics.h" churn="8" ccx="534" score="4272" top="ev_finalize" top_ccx="92" top_l="900"/>
+<f p="src/verbs_grep.h" churn="15" ccx="258" score="3870" top="emitGrepReport" top_ccx="97" top_l="958"/>
+… [13 more display lines; full output is 5130 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --arch=test/archfix/rules.txt`
+
+*Enforce layering rules (exit 2 on violation) — run against the repo's own test fixture rules.*
+
+**wall time: 1.24s**
+
+`````
+<!-- ripwire arch schema=ripwire.arch/v1: layering rules fit: allowed/denied file-to-file edges, each violation a row. -->
+<arch schema="ripwire.arch/v1" layers="2" rules="1" pathRules="0" violations="0" baselined="0" new_violations="0">
+<metrics modules="1072" typed_modules="520" zone_pain="420" zone_useless="1" zone_ok="99" zone_na="552" propagation_cost="0.001" note="Martin Ca/Ce/I/A/D + zone (main-sequence heuristic, no independent outcome-based validation — folklore, not proof) + reachability — directory-level estimate from … [line truncated: 411 more bytes on this line]
+<m path="." ca="0" ce="0" types="0" abstract="0" I="0.00" A="0.00" D="1.00" zone="n/a" reachable="1" isolated="1"/>
+<m path="./.codex-plugin" ca="0" ce="0" types="0" abstract="0" I="0.00" A="0.00" D="1.00" zone="n/a" reachable="1" isolated="1"/>
+<m path="./.github" ca="0" ce="0" types="0" abstract="0" I="0.00" A="0.00" D="1.00" zone="n/a" reachable="1" isolated="1"/>
+<m path="./.github/workflows" ca="0" ce="0" types="0" abstract="0" I="0.00" A="0.00" D="1.00" zone="n/a" reachable="1" isolated="1"/>
+<m path="./bench" ca="0" ce="1" types="20" abstract="2" I="1.00" A="0.10" D="0.10" zone="ok" reachable="1"/>
+<m path="./bench/agentloop" ca="0" ce="0" types="0" abstract="0" I="0.00" A="0.00" D="1.00" zone="n/a" reachable="1" isolated="1"/>
+<m path="./bench/agentloop/editsuite" ca="0" ce="0" types="0" abstract="0" I="0.00" A="0.00" D="1.00" zone="n/a" reachable="1" isolated="1"/>
+<m path="./bench/agentloop/editsuite/fixture" ca="0" ce="0" types="1" abstract="0" I="0.00" A="0.00" D="1.00" zone="pain" reachable="1" isolated="1"/>
+<m path="./bench/agentloop/editsuite/fixture/test" ca="0" ce="0" types="0" abstract="0" I="0.00" A="0.00" D="1.00" zone="n/a" reachable="1" isolated="1"/>
+<m path="./bench/agentloop/fixtures/grader" ca="0" ce="0" types="0" abstract="0" I="0.00" A="0.00" D="1.00" zone="n/a" reachable="1" isolated="1"/>
+<m path="./bench/agentloop/results" ca="0" ce="0" types="0" abstract="0" I="0.00" A="0.00" D="1.00" zone="n/a" reachable="1" isolated="1"/>
+<m path="./bench/arb" ca="0" ce="0" types="0" abstract="0" I="0.00" A="0.00" D="1.00" zone="n/a" reachable="1" isolated="1"/>
+<m path="./bench/arise-h2h" ca="0" ce="0" types="0" abstract="0" I="0.00" A="0.00" D="1.00" zone="n/a" reachable="1" isolated="1"/>
+<m path="./bench/arise-h2h/swe_agent_bundle_ripwire" ca="0" ce="0" types="0" abstract="0" I="0.00" A="0.00" D="1.00" zone="n/a" reachable="1" isolated="1"/>
+<m path="./bench/capsweep" ca="0" ce="0" types="0" abstract="0" I="0.00" A="0.00" D="1.00" zone="n/a" reachable="1" isolated="1"/>
+<m path="./bench/cppbench" ca="0" ce="0" types="1" abstract="0" I="0.00" A="0.00" D="1.00" zone="pain" reachable="1" isolated="1"/>
+<m path="./bench/cppbench/results" ca="0" ce="0" types="0" abstract="0" I="0.00" A="0.00" D="1.00" zone="n/a" reachable="1" isolated="1"/>
+<m path="./bench/ensemblecal" ca="0" ce="0" types="0" abstract="0" I="0.00" A="0.00" D="1.00" zone="n/a" reachable="1" isolated="1"/>
+<m path="./bench/fixround" ca="0" ce="0" types="0" abstract="0" I="0.00" A="0.00" D="1.00" zone="n/a" reachable="1" isolated="1"/>
+<m path="./bench/graft-h2h" ca="0" ce="0" types="0" abstract="0" I="0.00" A="0.00" D="1.00" zone="n/a" reachable="1" isolated="1"/>
+<m path="./bench/h4fixtures/bash" ca="0" ce="0" types="0" abstract="0" I="0.00" A="0.00" D="1.00" zone="n/a" reachable="1" isolated="1"/>
+<m path="./bench/h4fixtures/c" ca="0" ce="0" types="1" abstract="0" I="0.00" A="0.00" D="1.00" zone="pain" reachable="1" isolated="1"/>
+<m path="./bench/h4fixtures/cpp" ca="0" ce="0" types="2" abstract="1" I="0.00" A="0.50" D="0.50" zone="ok" reachable="1" isolated="1"/>
+<m path="./bench/h4fixtures/cppvex" ca="0" ce="0" types="0" abstract="0" I="0.00" A="0.00" D="1.00" zone="n/a" reachable="1" isolated="1"/>
+<m path="./bench/h4fixtures/csharp" ca="0" ce="0" types="3" abstract="0" I="0.00" A="0.00" D="1.00" zone="pain" reachable="1" isolated="1"/>
+<m path="./bench/h4fixtures/go" ca="0" ce="0" types="1" abstract="0" I="0.00" A="0.00" D="1.00" zone="pain" reachable="1" isolated="1"/>
+<m path="./bench/h4fixtures/go2" ca="0" ce="0" types="1" abstract="0" I="0.00" A="0.00" D="1.00" zone="pain" reachable="1" isolated="1"/>
+… [1047 more display lines; full output is 154687 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --lint`
+
+*Built-in AST checks (c-cast, goto, unsafe-c-fn, ...).*
+
+**wall time: 2.58s**
+
+`````
+<!-- ripwire lint schema=ripwire.lint/v1: AST-only checks, facts not gates: <rule name= count= shown_rows= rows_capped= count_capped=> of <f rule= p= in=>. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). findings_capped=/rows_capped=/count_capped=: 1 = cut. counts_floor=1: every count is a FLOOR, never a total. root=: p= relative to it. findings=N: findings over the printed rules; a floor when findings_capped=1. findings_next=: the call counting the floored rules' rest (count_capped=1 rules only, 10x per-rule budget). -->
+<lint schema="ripwire.lint/v1" findings="6753" shown="673" capped="1" total="6753" has_more="1" next_offset="673" offset="0" limit="0" counts_floor="1" findings_capped="1" findings_next="--lint --lint-select=magic-number --lint-max-per-rule=50000" root=".">
+<rule name="c-style-cast" count="627" shown_rows="73" rows_capped="1"/>
+<rule name="goto" count="18" shown_rows="1" rows_capped="1"/>
+<rule name="do-while" count="17" shown_rows="0" rows_capped="1"/>
+<rule name="unsafe-c-fn" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="weak-crypto" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="redundant-parens" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="suspicious-semicolon" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="typedef-over-using" count="37" shown_rows="0" rows_capped="1"/>
+<rule name="magic-number" count="471" shown_rows="270" rows_capped="1" count_capped="1"/>
+<rule name="empty-catch" count="1" shown_rows="0" rows_capped="1"/>
+<rule name="self-assign" count="3" shown_rows="0" rows_capped="1"/>
+<rule name="large-function" count="324" shown_rows="33" rows_capped="1"/>
+<rule name="deep-nesting" count="382" shown_rows="38" rows_capped="1"/>
+<rule name="inconsistent-return" count="2" shown_rows="0" rows_capped="1"/>
+<rule name="unreachable-code" count="5" shown_rows="0" rows_capped="1"/>
+<rule name="naming-short" count="1823" shown_rows="77" rows_capped="1"/>
+<rule name="naming-wordy" count="305" shown_rows="16" rows_capped="1"/>
+<rule name="naming-series" count="907" shown_rows="0" rows_capped="1"/>
+<rule name="naming-underscore" count="2" shown_rows="0" rows_capped="1"/>
+<rule name="naming-case" count="81" shown_rows="0" rows_capped="1"/>
+<rule name="naming-predicate" count="1" shown_rows="0" rows_capped="1"/>
+<rule name="naming-setter" count="2" shown_rows="0" rows_capped="1"/>
+<rule name="naming-confusable" count="568" shown_rows="30" rows_capped="1"/>
+<rule name="naming-uninformative" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="atom-comma-operator" count="3" shown_rows="0" rows_capped="1"/>
+<rule name="atom-embedded-crement" count="175" shown_rows="8" rows_capped="1"/>
+<rule name="atom-assign-as-value" count="69" shown_rows="5" rows_capped="1"/>
+<rule name="atom-nested-ternary" count="195" shown_rows="19" rows_capped="1"/>
+… [685 more display lines; full output is 70581 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --lint-rules=test/lintrulesfix/rules`
+
+*User lint rules (YAML, ast-grep style) from a directory.*
+
+**wall time: 1.58s**
+
+`````
+<!-- ripwire lint schema=ripwire.lint/v1: AST-only checks, facts not gates: <rule name= count= shown_rows= rows_capped= count_capped=> of <f rule= p= in=>. window: shown= capped= (capped=1 cut). rows_capped=: 1 = cut. root=: p= relative to it. findings=N: findings over the printed rules; a floor when findings_capped=1. -->
+<lint schema="ripwire.lint/v1" findings="5" shown="5" capped="0" root=".">
+<rule name="broken-query" sev="error" count="0" shown_rows="0" rows_capped="0" compiled="0"/>
+<rule name="no-printf" sev="warn" count="5" shown_rows="5" rows_capped="0"/>
+<f rule="no-printf" sev="warn" p="test/coplintfix/position.cpp:41" in="demo">use LOG() instead of printf</f>
+<f rule="no-printf" sev="warn" p="test/coplintfix/safe.cpp:15" in="safe_demo">use LOG() instead of printf</f>
+<f rule="no-printf" sev="warn" p="test/coplintfix/safe.cpp:27" in="safe_demo">use LOG() instead of printf</f>
+<f rule="no-printf" sev="warn" p="test/lintrulesfix/sample.cpp:8" in="greet">use LOG() instead of printf</f>
+<f rule="no-printf" sev="warn" p="test/usesfix/store.cpp:24" in="run">use LOG() instead of printf</f>
+</lint>
+`````
+
+stderr:
+
+`````
+ripwire: lint-rules: test/lintrulesfix/rules/malformed.yaml:5: expected 'key: value' — file skipped
+[math degraded] lint-rules: malformed rule file skipped  (lintrules.h:399, auto rw::parseLintRuleFile(const std::string &, std::string_view, std::vector<LintRule> &)::(anonymous class)::operator()(std::size_t, const char *) const — logged once per site)
+ripwire: AST query did not compile for any grammar: (this_is_not_a_real_node @x @@@ ((( )
+`````
+
+## `./build/ripwire . --lint --with-profile=report.txt`
+
+*Join MEASURED heat onto --lint findings — runs in a tiny fabricated demo corpus (one cache-pointer-chase-loop finding under a PROFILE_SCOPE site) because a real report needs a RIPWIRE_PROFILE build; the finding inside the profiled scope gains heat_* columns from the report's #PROF_TSV row.*
+
+Input file:
+
+`````
+#PROF_TSV_BEGIN	one row per scope, aggregated across threads; counters are RAW integers
+scope	file	line	calls	total_ms	l1d_mpki
+walk: chase pass	x.cpp	9	12	48.500	7.250
+#PROF_TSV_END
+`````
+
+`````
+<!-- ripwire lint schema=ripwire.lint/v1: AST-only checks, facts not gates: <rule name= count= shown_rows= rows_capped= count_capped=> of <f rule= p= in=>. window: shown= capped= (capped=1 cut). rows_capped=: 1 = cut. root=: p= relative to it. findings=N: findings over the printed rules; a floor when findings_capped=1. -->
+<lint schema="ripwire.lint/v1" findings="1" shown="1" capped="0" heat_joined="1" root=".">
+<rule name="c-style-cast" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="goto" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="do-while" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="unsafe-c-fn" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="weak-crypto" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="redundant-parens" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="suspicious-semicolon" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="typedef-over-using" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="magic-number" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="empty-catch" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="self-assign" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="large-function" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="deep-nesting" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="inconsistent-return" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="unreachable-code" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="naming-short" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="naming-wordy" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="naming-series" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="naming-underscore" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="naming-case" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="naming-predicate" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="naming-setter" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="naming-confusable" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="naming-uninformative" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="atom-comma-operator" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="atom-embedded-crement" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="atom-assign-as-value" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="atom-nested-ternary" count="0" shown_rows="0" rows_capped="0"/>
+… [13 more display lines; full output is 3428 bytes on 1 raw line(s)]
+`````
+
+The joined finding — past the display cut above, extracted so the join is visible:
+
+`````
+<f rule="cache-pointer-chase-loop" p="src/x.cpp:11" in="walk" heat_scope="walk: chase pass" heat_calls="12" heat_total_ms="48.500" heat_l1d_mpki="7.250">p = p-&gt;next</f>
+`````
+
+## `./build/ripwire . --communities`
+
+*Cluster the call graph into cohesive modules.*
+
+**wall time: 1.10s**
+
+`````
+<!-- ripwire communities schema=ripwire.communities/v1: call-graph modules (Louvain): <community id= size= dir= label=> of <member t= n= p=>; drill= the verb taking a row's id=; shown_modules=/shown_bridges= <community>/<bridge> rows listed; bridges= community pairs joined by a call edge; isolated= symbols with no call edge: isolated_doc= doc sections, isolated_decl= other bodyless, isolated_header= other header defs, isolated_source= the rest; modules= modules of 2+ symbols; connected_singletons= 1-symbol modules with a call edge; symbols= indexed symbols. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). modules_capped=/bridges_capped=: 1 = cut. counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. root=: p= relative to it. pr_iters=N: PageRank iterations. <bridge a= b=>: two module ids joined by call edges. from_label=/to_label=: the label= of a=/b=. <bridge edges=>: call edges between the two, either direction. -->
+<communities schema="ripwire.communities/v1" drill="--community=ID" modules="3620" shown_modules="30" modules_capped="1" bridges="4547" shown_bridges="12" bridges_capped="1" isolated="14942" isolated_decl="3978" isolated_header="2450" isolated_source="3384" isolated_doc="5130" connected_singletons=" … [line truncated: 193 more bytes on this line]
+<community id="5106" size="1630" dir="src" label="src::emitTo@infra/emit.h:53:2760 [write,run,emit]" shown="5" capped="1">
+<member t="macro" n="ASSUME" p="src/infra/Diagnostics.h:386"/>
+<member t="macro" n="RW_ASSUME_" p="src/infra/Diagnostics.h:322"/>
+<member t="macro" n="EXPECTS" p="src/infra/Diagnostics.h:387"/>
+<member t="fn" n="formatTo" p="src/infra/emit.h:141"/>
+<member t="fn" n="relForHash" p="src/model.h:2002"/>
+</community>
+<community id="5642" size="548" dir="src" label="src::kindIs@infra/nodekind.h:46:3271 [push,emit,collect]" shown="5" capped="1">
+<member t="fn" n="kindIs" p="src/infra/nodekind.h:46"/>
+<member t="fn" n="nodeTextOf" p="src/ingest_metrics.h:161"/>
+<member t="fn" n="fieldChild" p="src/infra/fieldid.h:223"/>
+<member t="fn" n="forEachChild" p="src/infra/tschildren.h:89"/>
+<member t="fn" n="enumTableAt" p="src/infra/enumcount.h:85"/>
+</community>
+<community id="5125" size="335" dir="src" label="src::DISCLOSE@infra/Diagnostics.h:616:43369 [read,compute,resolve]" shown="5" capped="1">
+<member t="fn" n="isStructOrNamedType" p="src/model.h:120"/>
+<member t="macro" n="DISCLOSE" p="src/infra/Diagnostics.h:616"/>
+<member t="fn" n="shSingleQuote" p="src/infra/shquote.h:19"/>
+<member t="fn" n="gitOneLine" p="src/quality.h:2003"/>
+<member t="fn" n="gitCmd" p="src/gitcmd.h:134"/>
+</community>
+<community id="3821" size="181" dir="docs" label="docs::`--top-k=N`@COMMANDS.md:59:9077 [pack,allow,insert]" shown="5" capped="1">
+<member t="sec" n="`--top-k=N`" p="docs/COMMANDS.md:59"/>
+<member t="sec" n="`--no-inventory`" p="docs/COMMANDS.md:95"/>
+<member t="sec" n="`--max-tokens=N`" p="docs/COMMANDS.md:129"/>
+<member t="sec" n="`--token-budget=N[K|M|G]`" p="docs/COMMANDS.md:160"/>
+<member t="sec" n="`--help-task=TASK`" p="docs/COMMANDS.md:184"/>
+</community>
+… [189 more display lines; full output is 16947 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --zoom`
+
+*Nested module hierarchy (multi-level Louvain) + cross-module bridges — levels_shown="2" of levels= BY DEFAULT over the 40 largest top modules (~8 KB, where the whole tree is ~220 KB); a module AT the cut carries children=.*
+
+**wall time: 1.09s**
+
+`````
+<!-- ripwire zoom schema=ripwire.zoom/v1: nested module hierarchy: <module level= id= size= dir= shown= capped=> of <member t= n= p=>; levels_shown= of levels= printed; symbols= = isolated= + size= of all top_modules=. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. pr_iters=N: PageRank iterations. children=K: K child modules below the levels_shown= cut, unprinted. next=: the one pasteable follow-up. -->
+<zoom schema="ripwire.zoom/v1" levels="5" levels_shown="2" top_modules="1414" symbols="31860" isolated="14942" shown="40" capped="1" total="1414" has_more="1" next_offset="40" offset="0" limit="0" pr_iters="36" graph_ambiguous="2933" graph_unresolved="15249" graph_unindexed="269" counts_floor="1" ne … [line truncated: 24 more bytes on this line]
+<module level="4" id="1652" size="7315" dir="./src">
+<module level="3" id="1652" size="7315" dir="./src" children="20">
+</module>
+</module>
+<module level="4" id="8525" size="1237" dir="./test">
+<module level="3" id="8525" size="1072" dir="./test" children="3">
+</module>
+<module level="3" id="9262" size="165" dir="./test" children="2">
+</module>
+</module>
+<module level="4" id="717" size="312" dir="./docs">
+<module level="3" id="717" size="312" dir="./docs" children="1">
+</module>
+</module>
+<module level="4" id="1405" size="148" dir="./bench/agentloop">
+<module level="3" id="1405" size="148" dir="./bench/agentloop" children="3">
+</module>
+</module>
+<module level="4" id="4594" size="224" dir="./test">
+<module level="3" id="4594" size="224" dir="./test" children="2">
+</module>
+</module>
+<module level="4" id="1755" size="99" dir="./bench/locbench">
+<module level="3" id="1755" size="99" dir="./bench/locbench" children="2">
+</module>
+</module>
+<module level="4" id="14036" size="106" dir="./test/ownerhopfix/py/pkg">
+<module level="3" id="14037" size="106" dir="./test/ownerhopfix/py/pkg" children="1">
+… [135 more display lines; full output is 7291 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --zoom --zoom-levels=3`
+
+*The restoring knob: --zoom-levels=N prints N levels (0 = the whole tree); here three, ~11 KB.*
+
+**wall time: 1.50s**
+
+`````
+<!-- ripwire zoom schema=ripwire.zoom/v1: nested module hierarchy: <module level= id= size= dir= shown= capped=> of <member t= n= p=>; levels_shown= of levels= printed; symbols= = isolated= + size= of all top_modules=. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. pr_iters=N: PageRank iterations. children=K: K child modules below the levels_shown= cut, unprinted. next=: the one pasteable follow-up. -->
+<zoom schema="ripwire.zoom/v1" levels="5" levels_shown="3" top_modules="1414" symbols="31860" isolated="14942" shown="40" capped="1" total="1414" has_more="1" next_offset="40" offset="0" limit="0" pr_iters="36" graph_ambiguous="2933" graph_unresolved="15249" graph_unindexed="269" counts_floor="1" ne … [line truncated: 40 more bytes on this line]
+<module level="4" id="1652" size="7315" dir="./src">
+<module level="3" id="1652" size="7315" dir="./src">
+<module level="2" id="1663" size="5925" dir="./src" children="73">
+</module>
+<module level="2" id="5981" size="387" dir="./src/infra" children="12">
+</module>
+<module level="2" id="4809" size="204" dir="./src" children="16">
+</module>
+<module level="2" id="5967" size="61" dir="./src/infra" children="5">
+</module>
+<module level="2" id="1665" size="114" dir="./src/infra" children="5">
+</module>
+<module level="2" id="6009" size="67" dir="./src" children="6">
+</module>
+<module level="2" id="4839" size="85" dir="./src" children="6">
+</module>
+<module level="2" id="1654" size="123" dir="./src/infra" children="3">
+</module>
+<module level="2" id="6108" size="49" dir="./src/infra" children="4">
+</module>
+<module level="2" id="7880" size="41" dir="./src" children="2">
+</module>
+<module level="2" id="6597" size="38" dir="./src" children="3">
+</module>
+<module level="2" id="1677" size="33" dir="./bench" children="3">
+</module>
+<module level="2" id="5541" size="37" dir="./src/infra" children="2">
+</module>
+… [273 more display lines; full output is 12337 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --report`
+
+*Architecture summary (modules, god-files, cycles) as markdown.*
+
+**wall time: 1.33s**
+
+`````
+<!-- ripwire markdown: no run of 4-or-more backticks in this output — safe to embed inside a wider fence -->
+
+# ripwire architecture report
+
+3631 files · 31860 symbols · 30033 edges · 3620 modules (14942 call-graph isolated)
+
+Root: `.`
+
+Call-graph isolate provenance: 3978 declaration, 2450 header, 3384 source, 5130 document; 0 connected Louvain singletons
+
+## Modules (call-graph clusters; showing 12 of 3620)
+- **src::emitTo@infra/emit.h:53:2760 [write,run,emit]** — 1630 symbols
+- **src::kindIs@infra/nodekind.h:46:3271 [push,emit,collect]** — 548 symbols
+- **src::DISCLOSE@infra/Diagnostics.h:616:43369 [read,compute,resolve]** — 335 symbols
+- **docs::`--top-k=N`@COMMANDS.md:59:9077 [pack,allow,insert]** — 181 symbols
+- **test/ownerhopfix/py/pkg::big_handler_001@broadcast.py:3:72** — 106 symbols
+- **src::buf@infra/svector.h:125:8942 [insert,find,push]** — 91 symbols
+- **src/infra::fail@os_win32.cpp:63:2553 [open,get,close]** — 89 symbols
+- **test::no@estchargecheck.sh:52:4108 [skip,set]** — 63 symbols
+- **src::child@ingest_valuerefs.h:656:33874 [emit,resolve,open]** — 62 symbols
+- **src::rowOffsets@infra/sparseCsr.h:248:8990 [connect,compute,expand]** — 55 symbols
+- **src::sliceKindIs@slice.h:368:24239 [match,collect,push]** — 48 symbols
+- **src/infra::DYNMAP_ASSUME@dynamic_map.hpp:90:4411 [insert,erase,find]** — 44 symbols
+
+## God files (most depended-on; showing 10 of 230)
+- `src/model.h` — 105 dependents
+- `src/infra/emit.h` — 87 dependents
+- `src/infra/Diagnostics.h` — 65 dependents
+- `src/graph.h` — 47 dependents
+- `src/serialize.h` — 45 dependents
+… [35 more lines, 3998 bytes total]
+`````
+
+## `./build/ripwire . --seams`
+
+*Cross-module call seams no test reaches. NOW carries seam_pairs/shown/capped.*
+
+**wall time: 1.14s**
+
+`````
+<!-- ripwire seams schema=ripwire.seams/v1: cross-directory call edges NO test reaches: <seam from= to= untested= shown= capped=> of <edge caller= p= callee= cp=>. window: shown= capped= (capped=1 cut). counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. root=: p= relative to it. pr_iters=N: PageRank iterations. modules=N: directories holding indexed symbols (a module = parent dir). bridges=N: cross-directory call edges, tested or not; untested= is those no test reaches. test_files=N: test files whose calls seed the reach; 0 means every seam reads untested. seam_pairs=N: directed dir pairs with an untested edge (the seam rows' total). doc_links=N: cross-directory links between two document sections, not in bridges= or untested= (no test exercises a document link); absent at 0. <file-scope> (t=modscope): a file's MODULE SCOPE — where a top-level call and an anonymous callback body's calls live; a CALLER, never a callee, with no body to expand. -->
+<seams schema="ripwire.seams/v1" modules="1070" bridges="4132" untested="2206" doc_links="81" test_files="2928" seam_pairs="18" shown="18" capped="0" pr_iters="36" root="." graph_ambiguous="2933" graph_unresolved="15249" graph_unindexed="269" counts_floor="1">
+<seam from="src" to="src/infra" untested="2095" shown="5" capped="1">
+<edge caller="boundedEditDistance" p="src/didyoumean.h:34" callee="swap" cp="src/infra/svector.h:439"/>
+<edge caller="jsonStr" p="src/serialize.h:10372" callee="escapeMcp" cp="src/infra/jsonesc.h:230"/>
+<edge caller="baseNameOf" p="src/mention.h:274" callee="afterLast" cp="src/infra/namesplit.h:157"/>
+<edge caller="jsonEscape" p="src/mcpjson.h:877" callee="escapeMcp" cp="src/infra/jsonesc.h:230"/>
+<edge caller="nextAttrXml" p="src/nextverb.h:46" callee="utf8SeqLen" cp="src/infra/jsonesc.h:59"/>
+</seam>
+<seam from="bench" to="src/infra" untested="64" shown="5" capped="1">
+<edge caller="infraSortSmall" p="bench/bench_radix_ab.cpp:73" callee="sortKeySmall" cp="src/infra/radixSort.h:91"/>
+<edge caller="isSorted" p="bench/bench_sort_large.cpp:42" callee="lessByFromTo" cp="src/infra/sortutil.h:210"/>
+<edge caller="benchScores" p="bench/bench_radix_ab.cpp:133" callee="lessByScoreDescId" cp="src/infra/sortutil.h:49"/>
+<edge caller="benchScores" p="bench/bench_radix_ab.cpp:133" callee="nonNegativeFloatDescKey" cp="src/infra/sortutil.h:70"/>
+<edge caller="benchAdaptive" p="bench/bench_radix_ab.cpp:157" callee="nonNegativeFloatDescKey" cp="src/infra/sortutil.h:70"/>
+</seam>
+<seam from="bench/multiswe" to="bench/locbench" untested="8" shown="5" capped="1">
+<edge caller="main" p="bench/multiswe/run_multiswe.py:301" callee="run_ctx" cp="bench/locbench/run_locbench.py:166"/>
+<edge caller="main" p="bench/multiswe/run_multiswe.py:301" callee="parse_candidates" cp="bench/locbench/run_locbench.py:223"/>
+<edge caller="main" p="bench/multiswe/run_multiswe.py:301" callee="norm_path" cp="bench/locbench/run_locbench.py:241"/>
+<edge caller="main" p="bench/multiswe/run_multiswe.py:301" callee="ranked_files_from_candidates" cp="bench/locbench/run_locbench.py:245"/>
+<edge caller="main" p="bench/multiswe/run_multiswe.py:301" callee="file_ranks" cp="bench/locbench/run_locbench.py:251"/>
+</seam>
+<seam from="bench/cppbench" to="bench/locbench" untested="7" shown="5" capped="1">
+<edge caller="main" p="bench/cppbench/run_cppbench.py:280" callee="run_ctx" cp="bench/locbench/run_locbench.py:166"/>
+<edge caller="main" p="bench/cppbench/run_cppbench.py:280" callee="parse_candidates" cp="bench/locbench/run_locbench.py:223"/>
+<edge caller="main" p="bench/cppbench/run_cppbench.py:280" callee="norm_path" cp="bench/locbench/run_locbench.py:241"/>
+<edge caller="main" p="bench/cppbench/run_cppbench.py:280" callee="ranked_files_from_candidates" cp="bench/locbench/run_locbench.py:245"/>
+<edge caller="main" p="bench/cppbench/run_cppbench.py:280" callee="file_ranks" cp="bench/locbench/run_locbench.py:251"/>
+</seam>
+… [60 more display lines; full output is 9244 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --mermaid`
+
+*Module (directory) dependency graph as a Mermaid diagram.*
+
+**wall time: 1.14s**
+
+`````
+%% ripwire --mermaid: module (directory) dependency graph — node = dir (symbol count), edge = inter-module calls (>= 3). Render at mermaid.live.
+flowchart LR
+  subgraph sg0 ["src"]
+    n102["src<br/>9435"]
+    n103["src/infra<br/>1301"]
+  end
+  subgraph sg1 ["test"]
+    n104["test<br/>5523"]
+    n571["test/legochargefix<br/>546"]
+    n405["test/fixtures/recallpassage<br/>314"]
+    n962["test/slotjoinfix<br/>175"]
+    n804["test/ownerhopfix/py/pkg<br/>158"]
+    n342["test/expandmodefix<br/>151"]
+    n344["test/expandsibsfix<br/>149"]
+    n945["test/rubyschemafix<br/>99"]
+    n424["test/forbodyfoldfix/py<br/>98"]
+    n927["test/rubyattrsfix<br/>85"]
+    n734["test/lib<br/>81"]
+  end
+  n74["docs<br/>862"]
+  n2[".github<br/>628"]
+  n0["(root)<br/>606"]
+  subgraph sg5 ["bench"]
+    n4["bench<br/>545"]
+    n5["bench/agentloop<br/>331"]
+    n49["bench/locbench/results/r5_pooling<br/>237"]
+    n50["bench/locbench/results/r6_expansion<br/>187"]
+    n59["bench/recalleval<br/>113"]
+    n43["bench/locbench<br/>107"]
+    n38["bench/headtohead/r3-headroom-2026-08-03<br/>102"]
+… [20 more lines, 1592 bytes total]
+`````
+
+## `./build/ripwire . --owners`
+
+*Bus-factor: recency-weighted author ownership per file.*
+
+**wall time: 3.88s**
+
+`````
+<!-- ripwire owners schema=ripwire.owners/v1: recency-weighted author ownership (half-life 6mo): <f p= authors= bf= top= share=>; bf=1 = one person holds it. at=: commit+dirty+shallow. root=: p= relative to it. files=N: files analysed. files=N: single-author files folded into this one row; detail=1 lists each. -->
+<owners schema="ripwire.owners/v1" files="3631" root="." at="0712a5182">
+<uniform authors="1" bf="1" share="1.00" files="2631"/>
+<f p=".coderabbit.yaml" authors="2" bf="0" top="<author>" share="0.59"/>
+<f p=".github/pargates-shard-weights.json" authors="3" bf="0" top="<author>" share="0.46"/>
+<f p=".github/workflows/ci.yml" authors="6" bf="0" top="<author>" share="0.46"/>
+<f p=".github/workflows/nightly.yml" authors="2" bf="1" top="<author>" share="0.86"/>
+<f p=".github/workflows/release.yml" authors="3" bf="0" top="<author>" share="0.52"/>
+<f p="AGENTS.md" authors="2" bf="0" top="<author>" share="0.71"/>
+<f p="CHANGELOG.md" authors="18" bf="0" top="<author>" share="0.51"/>
+<f p="CLAUDE.md" authors="5" bf="0" top="<author>" share="0.41"/>
+<f p="CONTRIBUTING.md" authors="6" bf="0" top="<author>" share="0.45"/>
+<f p="INSTALL.md" authors="2" bf="1" top="<author>" share="0.87"/>
+<f p="README.md" authors="21" bf="0" top="<author>" share="0.40"/>
+<f p="SECURITY.md" authors="3" bf="0" top="<author>" share="0.46"/>
+<f p="THIRD_PARTY.md" authors="8" bf="0" top="<author>" share="0.38"/>
+<f p="bench/ANSWERQUALITY.md" authors="2" bf="0" top="<author>" share="0.72"/>
+<f p="bench/PROFILE.md" authors="5" bf="0" top="<author>" share="0.78"/>
+<f p="bench/agentloop/README.md" authors="2" bf="1" top="<author>" share="0.89"/>
+<f p="bench/agentloop/grade_answers.py" authors="3" bf="0" top="<author>" share="0.51"/>
+<f p="bench/agentloop/run_agentloop.py" authors="3" bf="1" top="<author>" share="0.90"/>
+<f p="bench/agentloop/run_editsuite.py" authors="2" bf="0" top="<author>" share="0.80"/>
+<f p="bench/arb/run_arb.py" authors="2" bf="0" top="<author>" share="0.65"/>
+<f p="bench/capsweep/capsweep.py" authors="2" bf="1" top="<author>" share="0.92"/>
+<f p="bench/mine_traces.py" authors="2" bf="0" top="<author>" share="0.72"/>
+<f p="bench/representative_perfgate.sh" authors="3" bf="0" top="<author>" share="0.68"/>
+<f p="bench/routing_ab_report.py" authors="2" bf="0" top="<author>" share="0.63"/>
+<f p="bench/scip_match_diag.py" authors="2" bf="0" top="<author>" share="0.51"/>
+<f p="bench/scip_pin_precision.py" authors="2" bf="0" top="<author>" share="0.74"/>
+<f p="bench/shotgun/README.md" authors="3" bf="0" top="<author>" share="0.49"/>
+… [974 more display lines; full output is 106558 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --dead-code=src`
+
+*Internal functions with no caller found in the index — a name-based graph reading, not a confidence score. NOTE the filter is a path-COMPONENT match: 'src' matches any .../src/... segment; use ./src to pin the root directory.*
+
+**wall time: 1.23s**
+
+`````
+<!-- ripwire dead-code schema=ripwire.dead-code/v1: internal-linkage functions with no caller found in the index (not a confidence score): <d n= t= p= l=>; filter= path component. counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. value-ref-excluded=N: internal functions kept off because a table, field or argument in another function or at file scope holds them (matched by name, not a proven call); a floor. root=: p= relative to it. evidence=: the rule every row met, internal linkage and no caller in the index; verify before deleting. register-macro-excluded=N: symbols skipped as self-registering test/bench macros (TEST, BENCHMARK...); a floor. count=N: candidates meeting evidence= (a floor). -->
+<dead-code schema="ripwire.dead-code/v1" count="1" evidence="internal-linkage+zero-callers" register-macro-excluded="0" value-ref-excluded="6" filter="src" root="." graph_ambiguous="2933" graph_unresolved="15249" graph_unindexed="269" counts_floor="1">
+<d n="unused_helper" t="fn" p="test/archmetricsfix/src/orphan/util.cpp" l="1"/>
+</dead-code>
+`````
+
+## `./build/ripwire . --exercises=test/regression.sh`
+
+*Which symbols a TEST FILE exercises — the reverse direction of --affected.*
+
+**wall time: 1.12s**
+
+`````
+<!-- ripwire exercises schema=ripwire.exercises/v1: NON-TEST symbols this test transitively calls (what it covers): <t p= run=>; the inverse of affected. window: shown= capped= (capped=1 cut). seed_files_capped=: 1 = cut. counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. root=: p= relative to it. pr_iters=N: PageRank iterations. seed_files=N: test files the pattern matched. shown_seed_files=N: of those, printed as t rows (at most 20). test_symbols=N: symbols in those test files, the walk's seeds. reaches=N: non-test symbols the tests transitively call (the s rows' total). harness=script|mixed: seeds include shell gates, whose subprocess coverage is unseen; note= says so. of=: the test file pattern given. -->
+<exercises schema="ripwire.exercises/v1" of="test/regression.sh" seed_files="1" shown_seed_files="1" seed_files_capped="0" test_symbols="4" reaches="0" harness="script" note="a shell gate invokes the compiled binary as a subprocess; script-to-binary edges are not modelled, so reaches= counts call-gr … [line truncated: 189 more bytes on this line]
+<t p="test/regression.sh" run="bash test/regression.sh"/>
+</exercises>
+`````
+
+## `./build/ripwire . --community=0`
+
+*Drill into ONE call-graph community by id — the drill= the --communities output itself advertises.*
+
+**wall time: 1.12s**
+
+`````
+<!-- ripwire community schema=ripwire.community/v1: ONE module id=: <member t= n= p=> ranked members, its <bridge> edges; size= the TRUE count; dir= its members' most common directory (a top-level file's own path); label= dir::name@file:line:byte of its top fan-in member (non-accessors first) [up to 3 top name verbs]; bridges= modules a call edge joins to it; partition= module count incl. singletons (ids 0..partition-1); modules= those of 2+ symbols; shown_bridges= <bridge> rows listed. window: shown= capped= (capped=1 cut). bridges_capped=: 1 = cut. counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. root=: p= relative to it. pr_iters=N: PageRank iterations. -->
+<community schema="ripwire.community/v1" id="0" size="1" dir=".coderabbit.yaml" label=".coderabbit.yaml::reviews@.coderabbit.yaml:12:928" bridges="0" shown_bridges="0" bridges_capped="0" partition="18562" modules="3620" shown="1" capped="0" pr_iters="36" root="." graph_ambiguous="2933" graph_unresol … [line truncated: 51 more bytes on this line]
+<member t="sec" n="reviews" p=".coderabbit.yaml:12"/>
+</community>
+`````
+
+## `./build/ripwire . --quality-delta`
+
+*On a CLEAN tree: nothing got worse, exit 0. The gating shape is in the sandbox section below.*
+
+**wall time: 32.37s**
+
+`````
+<!-- ripwire quality-delta schema=ripwire.quality-delta/v1: only what the change made WORSE vs baseline=: regressions= minor= gating=; <r kind= sym= p= was= now= gating= bar=>, <sa> acked. at=: commit+dirty+shallow. stale=N: ack ledger rows whose target no longer applies (sa rows); never gating. stale_by_kind=: stale= split by ack kind (kind:N,...); the sa rows are collapsed. stale_next=: the call printing the sa rows and the full header. head_basis=identity: the floor is this tree's own snapshot; archived-index-hidden: refused, a tracked path is skip-worktree/assume-unchanged; absent: the archived HEAD tree. -->
+<quality-delta schema="ripwire.quality-delta/v1" baseline="git-HEAD" regressions="0" gating="0" stale="167" at="0712a5182" head_basis="identity" stale_by_kind="api-surface:23,complexity:8,dead-code:9,duplication:69,nesting:3,new-clone-of-reused-helper:23,params:1,short-horizon-churn:9,verbosity:22"  … [line truncated: 42 more bytes on this line]
+</quality-delta>
+`````
+
+stderr:
+
+`````
+ripwire: no ./.ripwire_quality_baseline — auto-comparing the working tree vs git HEAD (commit the baseline with --quality-baseline to pin it)
+`````
+
+## `./build/ripwire . --quality-delta --show-stale`
+
+*The same clean verdict with what it folded printed back: every stale acknowledgement as an <sa kind= key= why=> row and the full header. The regression-free answer above keeps only stale= and stale_by_kind= (and stale_next= names this call), and folds only when that saves a quarter of the bytes. Refused without --quality-delta.*
+
+**wall time: 28.04s**
+
+`````
+<!-- ripwire quality-delta schema=ripwire.quality-delta/v1: only what the change made WORSE vs baseline=: regressions= minor= gating=; <r kind= sym= p= was= now= gating= bar=>, <sa> acked. value-ref-excluded=N: internal functions kept off because a table, field or argument in another function or at file scope holds them (matched by name, not a proven call); a floor. at=: commit+dirty+shallow. stale=N: ack ledger rows whose target no longer applies (sa rows); never gating. preexisting-worse=N: regressions on symbols that existed at baseline; they gate when major. new-symbol=N: findings on NEW code; new-symbol rows never gate, except defect-shape format-arity. register-macro-excluded=N: symbols kept out of dead-code as self-registering test/bench macros; a floor. declined-call-excluded=N: symbols kept out of dead-code only because a declined call may mean them; a floor. api-new-surface=N: new PUBLIC symbols; a count, never gates, not in regressions=. renames=/rename_window_commits=: git rename pairs read over that many commits, to re-file baseline and acks. acked_by_rename=/acked_by_content=: acked= suppressions matched via git renames / an equal body hash. renames_window_truncated=1: history is deeper than the rename window, older renames unread. acked=N: findings suppressed by the ack ledger, listed as sa rows; never gating. sa key=/why=: the stale ack's ledger hash / target-gone (names nothing now) or finding-gone (no longer fires). head_basis=identity: the floor is this tree's own snapshot; archived-index-hidden: refused, a tracked path is skip-worktree/assume-unchanged; absent: the archived HEAD tree. -->
+<quality-delta schema="ripwire.quality-delta/v1" baseline="git-HEAD" regressions="0" minor="0" acked="0" stale="167" preexisting-worse="0" new-symbol="0" gating="0" register-macro-excluded="62" api-new-surface="0" at="0712a5182" renames="62" rename_window_commits="400" acked_by_rename="0" acked_by_c … [line truncated: 114 more bytes on this line]
+<sa kind="api-surface" key="085e3d408c2c4a35" why="target-gone"/>
+<sa kind="api-surface" key="155d74d341a49f3c" why="target-gone"/>
+<sa kind="api-surface" key="1a15386c2d1e47af" why="target-gone"/>
+<sa kind="api-surface" key="298e798c7f075715" why="target-gone"/>
+<sa kind="api-surface" key="56acdf9b5c314a14" why="target-gone"/>
+<sa kind="api-surface" key="5a07390012b46e06" why="target-gone"/>
+<sa kind="api-surface" key="6eef859578c8c376" why="target-gone"/>
+<sa kind="api-surface" key="6f2394762f82a855" why="target-gone"/>
+<sa kind="api-surface" key="7f2c3eefdf6e512e" why="target-gone"/>
+<sa kind="api-surface" key="802e513731103806" why="target-gone"/>
+<sa kind="api-surface" key="b6a24afef32a68a8" why="target-gone"/>
+<sa kind="api-surface" key="c923e661c197b265" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="1926b0d9e94541a0" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="1d3814ba687a4aef" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="1db76028879244ef" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="25c9f0504fd376a4" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="36e39c7ab0fc1686" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="4bce64bd920de0c3" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="61f0e361ef7dee27" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="79625906f9f71ad0" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="8ecb190954dce18a" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="995375dfa4e63104" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="ee71e4fffa361902" why="target-gone"/>
+<sa kind="complexity" key="0001f7edbff929e5" why="finding-gone" sym="src/cli.h::rw::validateLegendModifier" p="src/cli.h:4506"/>
+<sa kind="complexity" key="38c814a492cc9c8a" why="finding-gone" sym="emitForLensJson" p="src/verbs_for.h:1787"/>
+<sa kind="complexity" key="3a0425468e6a18cf" why="finding-gone" sym="src/crossref.h::crossref::writeWhereisPage" p="src/crossref.h:4849"/>
+<sa kind="complexity" key="5b224c7fe142bd56" why="finding-gone" sym="runForLens" p="src/verbs_for.h:4253"/>
+<sa kind="complexity" key="685ade09a168535e" why="finding-gone" sym="src/crossref.h::crossref::computeWhereis" p="src/crossref.h:3661"/>
+… [140 more display lines; full output is 16170 bytes on 1 raw line(s)]
+`````
+
+stderr:
+
+`````
+ripwire: no ./.ripwire_quality_baseline — auto-comparing the working tree vs git HEAD (commit the baseline with --quality-baseline to pin it)
+`````
+
+## `./build/ripwire . --edit-check=rankGraphTeleport`
+
+*Fast per-symbol post-edit contract check vs git HEAD (unchanged on a clean tree).*
+
+**wall time: 18.07s**
+
+`````
+<!-- ripwire edit-check schema=ripwire.edit-check/v1: sym='s contract NOW vs HEAD: status=unchanged|new-symbol|contract-change; <c n= p= incompatible=1 sites_l=> callers. counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. est_tokens=: price as emitted (an upper bound under compact). at=: commit+dirty+shallow. root=: p= relative to it. next=: the one pasteable follow-up. defs=N: overloads at this site (same file, scope, name) folded into one contract; params compared by MAX. callers=N: callers of sym= (the c rows' total; a floor). -->
+<edit-check schema="ripwire.edit-check/v1" sym="rankGraphTeleport" t="fn" p="src/graph.h:11809" status="unchanged" defs="1" callers="7" incompatible="0" at="0712a5182" graph_ambiguous="2933" graph_unresolved="15249" graph_unindexed="269" counts_floor="1" root="." next="--test-gate=src/graph.h" est_t … [line truncated: 12 more bytes on this line]
+<c n="runEval" p="src/eval.h:171"/>
+<c n="rankGraph" p="src/graph.h:11850"/>
+<c n="anchoredLexicalRank" p="src/graph.h:12496"/>
+<c n="churnDecayRanking" p="src/main.cpp:1425"/>
+<c n="churnRankedGraph" p="src/main.cpp:1464"/>
+<c n="runDefaultMap" p="src/main.cpp:1751"/>
+<c n="getIndex" p="src/mcpindex.h:1184"/>
+</edit-check>
+`````
+
+## `./build/ripwire . --pr-context`
+
+*No-LLM review-evidence bundle for the working-tree diff (clean tree = empty).*
+
+**wall time: 4.32s**
+
+`````
+<!-- ripwire pr-context schema=ripwire.pr-context/v1: review bundle per changed file vs base=: symbols, callers, blast radius, tests, owners. counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. est_tokens=: price as emitted (an upper bound under compact). at=: commit+dirty+shallow. root=: p= relative to it. truncated=: what the trim ladder dropped to fit budget_tokens= (budget-floor-exceeded: still over). direction=: side reviewed: worktree-since-head, head-since-fork or head-since-ref-tip. skipped_mode_only=N: mode-only (chmod) diffs left out of the changed files; renames stay in. trim_level=0-4: trim ladder step taken to fit budget_tokens= (0 none, 4 counts only); raise token-budget. budget_default=1: the default 8000-token budget applied (no token-budget or max-tokens given). files=N: changed files in the diff (shown= of them listed). -->
+<pr-context schema="ripwire.pr-context/v1" base="working-tree" root="." direction="worktree-since-head" files="0" skipped_mode_only="0" budget_tokens="8000" est_tokens="584" trim_level="0" truncated="none" budget_default="1" at="0712a5182" graph_ambiguous="2933" graph_unresolved="15249" graph_uninde … [line truncated: 27 more bytes on this line]
+<!-- no changed files in the index (clean tree, or the diff touched only non-indexed files) -->
+</pr-context>
+`````
+
+## `./build/ripwire . --pr-context=HEAD~1`
+
+*The BASEREF form: diffed against merge-base(BASEREF, HEAD), never the ref tip — here the previous commit on the current line (a ref with NO merge base falls back to a disclosed two-dot diff: anchor="ref-tip-two-dot").*
+
+**wall time: 12.23s**
+
+`````
+<!-- ripwire pr-context schema=ripwire.pr-context/v1: review bundle per changed file vs base=: symbols, callers, blast radius, tests, owners. window: shown= capped= (capped=1 cut). counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. est_tokens=: price as emitted (an upper bound under compact). at=: commit+dirty+shallow. root=: p= relative to it. truncated=: what the trim ladder dropped to fit budget_tokens= (budget-floor-exceeded: still over). anchor=merge-base: diffed from merge base(base, HEAD); ref-tip-two-dot = no merge base, two-dot view. base_sha=: the merge-base commit (9 hex) the diff is anchored at. base_moved=N: paths the base ref changed since the fork that this work never touched; excluded. direction=: side reviewed: worktree-since-head, head-since-fork or head-since-ref-tip. skipped_mode_only=N: mode-only (chmod) diffs left out of the changed files; renames stay in. trim_level=0-4: trim ladder step taken to fit budget_tokens= (0 none, 4 counts only); raise token-budget. budget_default=1: the default 8000-token budget applied (no token-budget or max-tokens given). commits=N: this file's commits in window=; 0 = the window could not look, not no partners. partners=N: co-change partners NOT in the diff; rows are its top shown= (the cochange verb lists all). dependents=N: distinct symbols transitively calling this file's symbols (reach set, a FLOOR). files_other=N: non-changed files among those reached; the f rows are its top shown=. authors=N: distinct authors of this file (0 = no git data). bf=1: one author holds over 80% of recency-weighted commits (bus-factor risk). no-ref-work note=: the base ref's tip is the merge base, so it has no work of its own; rows are HEAD's. files=N: changed files in the diff (shown= of them listed). file symbols=: indexed symbols in that changed file. changed-symbols count= / tests count=: that section's full count (shown= of it listed). tests count=: test files reaching this file (shown= of them listed). impact files=: files holding the transitive callers (dependents=). impactf deps=: transitive callers in that file. test run=: the command that runs that test file (run_unknown=1: none derivable). changed-symbols sections=N: doc headings folded into count=, no row each; count minus sections = rows. -->
+<pr-context schema="ripwire.pr-context/v1" base="HEAD~1" root="." anchor="merge-base" base_sha="6df53cf0d" base_moved="0" direction="head-since-fork" files="12" skipped_mode_only="0" budget_tokens="8000" est_tokens="3328" trim_level="3" truncated="per-symbol-rows+cochange-list+owner-list-dropped" bu … [line truncated: 119 more bytes on this line]
+<no-ref-work note="HEAD~1 tip == merge-base, so that ref has no divergent work of its own; this bundle is HEAD's work since the fork. For the ref's OWN diff see merge-scout or stray-content"/>
+<file p="src/model.h" symbols="135">
+<impact dependents="1035" files="119" files_other="117" shown="2" capped="1">
+<f p="src/receiverevidence.h" deps="61"/>
+<f p="src/resolve.h" deps="59"/>
+</impact>
+<tests count="6" shown="3" capped="1">
+<test p="test/cloneband_harness.cpp" run="bash test/clonebandcheck.sh"/>
+<test p="test/columnarcommafix/columnar_comma_test.cpp" run="bash test/columnarcommacheck.sh"/>
+<test p="test/includeprecise_unit.cpp" run="bash test/includeprecisecheck.sh"/>
+</tests>
+<changed-symbols count="135"/>
+<cochange window="18mo@HEAD" commits="230" partners="110" shown="0" capped="1"/>
+<owners authors="20" bf="0" shown="0" capped="1"/>
+</file>
+<file p="src/graph.h" symbols="612">
+<impact dependents="537" files="85" files_other="84" shown="2" capped="1">
+<f p="src/mcpverbs.h" deps="42"/>
+<f p="src/receiverevidence.h" deps="27"/>
+</impact>
+<tests count="7" shown="3" capped="1">
+<test p="test/columnarcommafix/columnar_comma_test.cpp" run="bash test/columnarcommacheck.sh"/>
+<test p="test/connectcore_harness.cpp" run="bash test/connectcorecheck.sh"/>
+<test p="test/cppqualtmplfix/member.cpp" run="bash test/cppqualcheck.sh"/>
+</tests>
+<changed-symbols count="612"/>
+<cochange window="18mo@HEAD" commits="451" partners="146" shown="0" capped="1"/>
+<owners authors="16" bf="0" shown="0" capped="1"/>
+… [102 more display lines; full output is 8319 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --merge-scout=HEAD~2,HEAD~1`
+
+*Pairwise cross-arm conflict sites + suggested landing order (any committish sharing a merge base with HEAD works as an arm; one that does not is reported ok="0", never compared).*
+
+**wall time: 24.28s**
+
+`````
+<!-- ripwire merge-scout schema=ripwire.merge-scout/v1: cross-branch overlap of arms= refs: <arm ref= base= changed= head_conflicts=>, <pair a= b= conflicts= risks=>, <landing order=>. at=: commit+dirty+shallow. head=: the HEAD commit, bare 9-hex sha (at= adds +dirty). ok=1 on an arm row means the comparison RAN, so changed=/head_conflicts= are real and may legitimately be 0 (an empty but materialized tree is a real index); ok=0 means it did not run at all. no-work note=: arm compared and has no divergent work vs its merge base, so no landing slot. -->
+<merge-scout schema="ripwire.merge-scout/v1" arms="2" head="0712a5182" at="0712a5182">
+<arm ref="HEAD~2" base="7a5181f05" ok="1" changed="0" head_conflicts="0">
+<no-work note="no divergent work vs merge-base — see --stray-content"/>
+</arm>
+<arm ref="HEAD~1" base="6df53cf0d" ok="1" changed="0" head_conflicts="0">
+<no-work note="no divergent work vs merge-base — see --stray-content"/>
+</arm>
+<pair a="HEAD~2" b="HEAD~1" conflicts="0" risks="0"/>
+<landing order=""/>
+</merge-scout>
+`````
+
+## `./build/ripwire . --stray-content=lane/`
+
+*Which refs of the `lane/` ref family still hold divergent authored work vs HEAD, with verdicts.*
+
+**wall time: 50.87s**
+
+`````
+<!-- ripwire stray-content schema=ripwire.stray-content/v1: per local ref, lines/symbols NOT in HEAD: <ref ok= v= base= stray=>; v=unknown = no merge base. at=: commit+dirty+shallow. head=: the HEAD commit, bare 9-hex sha (at= adds +dirty). head_ref=: HEAD's branch (HEAD when detached); that branch itself is not scanned. refs=N: local branches scanned (refs/heads only); unmerged + superseded + merged + unknown = refs. blobs=N: distinct git blobs read for the sweep. unmerged=N: refs whose authored work the live line genuinely lacks. superseded=N: refs whose work the live line re-implemented (removed the same base code). merged=N: refs whose work HEAD already has; omitted from the rows. name=: the local branch. tip=: the branch tip commit (9 hex). date=: the tip's committer date, YYYY-MM-DD. files=N: files with stray lines; rows capped at 12, a more element counts the rest (detail=1 lists all). ref superseded=N>: of this ref's stray= lines, those in files the live line re-implemented. authored=N: lines this ref authored in the file vs its merge base. del=N: base lines this ref removed (0 = pure addition). redone=N: of del=, the base lines HEAD removed too (the supersession evidence). sim=: minhash containment, 0 to 1, of the ref's blob in HEAD's (pure-addition evidence). head-touched=1: the live line changed this path since the merge base. more files=N: N more file rows of this ref withheld; shown + N = the ref's files=; detail=1 lists all. unknown=N: refs that could not be analysed (v=unknown, e.g. no merge base); never counted merged. -->
+<stray-content schema="ripwire.stray-content/v1" head="0712a5182" head_ref="integration/train-36" refs="201" blobs="603" unmerged="26" superseded="0" merged="175" unknown="0" filter="lane/" at="0712a5182">
+<ref name="lane/arise-result" tip="13292db7a" date="2026-09-23" base="60b65f026" ok="1" v="unmerged" stray="16331" files="18" superseded="55">
+<file p="bench/slice/results/arise_line_rank_prereg/narrowpool-results.json" v="unmerged" stray="8629" authored="8629" del="0" redone="0" sim="0.00" head-touched="0"/>
+<file p="bench/slice/results/arise_line_rank_prereg/results.json" v="unmerged" stray="3810" authored="3810" del="0" redone="0" sim="0.00" head-touched="0"/>
+<file p="bench/slice/results/arise_line_rank_prereg/scorer-results.json" v="unmerged" stray="1213" authored="1213" del="0" redone="0" sim="0.00" head-touched="0"/>
+<file p="docs/research/arise-line-ranking-prereg.md" v="unmerged" stray="625" authored="625" del="0" redone="0" sim="0.00" head-touched="0"/>
+<file p="bench/slice/score_arise_linerank.py" v="unmerged" stray="537" authored="537" del="0" redone="0" sim="0.00" head-touched="0"/>
+<file p="bench/slice/run_slice_linerecall_r3.py" v="unmerged" stray="326" authored="326" del="0" redone="0" sim="0.00" head-touched="0"/>
+<file p="test/slicerank_unit.cpp" v="unmerged" stray="258" authored="258" del="0" redone="0" sim="0.00" head-touched="0"/>
+<file p="bench/slice/score_arise_narrowpool.py" v="unmerged" stray="199" authored="199" del="0" redone="0" sim="0.00" head-touched="0"/>
+<file p="bench/slice/results/arise_line_rank_prereg/instance_ids.txt" v="unmerged" stray="182" authored="182" del="0" redone="0" sim="0.00" head-touched="0"/>
+<file p="src/slice.h" v="unmerged" stray="132" authored="172" del="6" redone="0" sim="0.98" head-touched="1"/>
+<file p="bench/slice/results/arise_line_rank_prereg/RESULTS.md" v="unmerged" stray="126" authored="126" del="0" redone="0" sim="0.00" head-touched="0"/>
+<file p="bench/slice/results/arise_line_rank_prereg/scorer-summary.json" v="unmerged" stray="82" authored="82" del="0" redone="0" sim="0.00" head-touched="0"/>
+<more files="6"/>
+</ref>
+<ref name="lane/margin-rescore" tip="9ffd3628c" date="2026-09-23" base="755f9026f" ok="1" v="unmerged" stray="13920" files="12" superseded="0">
+<file p="bench/locbench/results/margin_rescore/calib.json" v="unmerged" stray="6592" authored="6592" del="0" redone="0" sim="0.00" head-touched="0"/>
+<file p="bench/locbench/results/served_syms_prereg/calib.json" v="unmerged" stray="3862" authored="3862" del="0" redone="0" sim="0.00" head-touched="0"/>
+<file p="docs/research/confidence-and-abstention.md" v="unmerged" stray="828" authored="828" del="0" redone="0" sim="0.00" head-touched="0"/>
+<file p="bench/locbench/calibrate_confidence.py" v="unmerged" stray="745" authored="745" del="0" redone="0" sim="0.00" head-touched="0"/>
+<file p="bench/locbench/served_syms_signal.py" v="unmerged" stray="671" authored="671" del="0" redone="0" sim="0.00" head-touched="0"/>
+<file p="bench/locbench/test_served_syms_signal.py" v="unmerged" stray="588" authored="588" del="0" redone="0" sim="0.00" head-touched="0"/>
+<file p="bench/locbench/results/margin_rescore/calib.md" v="unmerged" stray="214" authored="214" del="0" redone="0" sim="0.00" head-touched="0"/>
+<file p="bench/locbench/results/served_syms_prereg/calib.md" v="unmerged" stray="111" authored="111" del="0" redone="0" sim="0.00" head-touched="0"/>
+<file p="bench/locbench/results/margin_rescore/instance_ids.txt" v="unmerged" stray="92" authored="92" del="0" redone="0" sim="0.00" head-touched="0"/>
+<file p="bench/locbench/results/served_syms_prereg/instance_ids.txt" v="unmerged" stray="92" authored="92" del="0" redone="0" sim="0.00" head-touched="0"/>
+<file p="bench/locbench/results/margin_rescore/POPULATION.md" v="unmerged" stray="63" authored="63" del="0" redone="0" sim="0.00" head-touched="0"/>
+<file p="bench/locbench/results/served_syms_prereg/POPULATION.md" v="unmerged" stray="62" authored="62" del="0" redone="0" sim="0.00" head-touched="0"/>
+… [258 more display lines; full output is 33874 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --stray-content=arm/for-howitworks-067-f2add`
+
+*A second selection, the one branch `arm/for-howitworks-067-f2add` (no ref family left to select on this checkout), picked at capture time from the refs this checkout really has and never the selection above: merged refs are OMITTED from the rows and counted in merged=; refs sharing no merge base with HEAD (a shallow clone, or a pre-rewrite history) land in unknown= with ok="0" — the counters always reconcile against refs=.*
+
+**wall time: 11.55s**
+
+`````
+<!-- ripwire stray-content schema=ripwire.stray-content/v1: per local ref, lines/symbols NOT in HEAD: <ref ok= v= base= stray=>; v=unknown = no merge base. at=: commit+dirty+shallow. head=: the HEAD commit, bare 9-hex sha (at= adds +dirty). head_ref=: HEAD's branch (HEAD when detached); that branch itself is not scanned. refs=N: local branches scanned (refs/heads only); unmerged + superseded + merged + unknown = refs. blobs=N: distinct git blobs read for the sweep. unmerged=N: refs whose authored work the live line genuinely lacks. superseded=N: refs whose work the live line re-implemented (removed the same base code). merged=N: refs whose work HEAD already has; omitted from the rows. name=: the local branch. tip=: the branch tip commit (9 hex). date=: the tip's committer date, YYYY-MM-DD. files=N: files with stray lines; rows capped at 12, a more element counts the rest (detail=1 lists all). ref superseded=N>: of this ref's stray= lines, those in files the live line re-implemented. authored=N: lines this ref authored in the file vs its merge base. del=N: base lines this ref removed (0 = pure addition). redone=N: of del=, the base lines HEAD removed too (the supersession evidence). sim=: minhash containment, 0 to 1, of the ref's blob in HEAD's (pure-addition evidence). head-touched=1: the live line changed this path since the merge base. more files=N: N more file rows of this ref withheld; shown + N = the ref's files=; detail=1 lists all. unknown=N: refs that could not be analysed (v=unknown, e.g. no merge base); never counted merged. -->
+<stray-content schema="ripwire.stray-content/v1" head="0712a5182" head_ref="integration/train-36" refs="1" blobs="96" unmerged="1" superseded="0" merged="0" unknown="0" filter="arm/for-howitworks-067-f2add" at="0712a5182">
+<ref name="arm/for-howitworks-067-f2add" tip="abcbd8b7f" date="2026-10-02" base="953818d6f" ok="1" v="unmerged" stray="3271" files="39" superseded="151">
+<file p="src/forhow.h" v="unmerged" stray="2160" authored="2160" del="0" redone="0" sim="0.00" head-touched="0"/>
+<file p="test/forhowcheck.sh" v="unmerged" stray="472" authored="472" del="0" redone="0" sim="0.00" head-touched="0"/>
+<file p="src/forhowbase.h" v="unmerged" stray="141" authored="141" del="0" redone="0" sim="0.00" head-touched="0"/>
+<file p=".ripwire_quality_acks" v="unmerged" stray="73" authored="73" del="7" redone="1" sim="0.89" head-touched="1"/>
+<file p="src/mcpverbs.h" v="superseded" stray="62" authored="76" del="21" redone="19" sim="0.77" head-touched="1"/>
+<file p="CHANGELOG.md" v="unmerged" stray="52" authored="52" del="0" redone="0" sim="0.59" head-touched="1"/>
+<file p="test/compactroutecheck.sh" v="superseded" stray="31" authored="32" del="1" redone="1" sim="0.45" head-touched="1"/>
+<file p="src/legenddict.h" v="unmerged" stray="26" authored="35" del="4" redone="0" sim="0.98" head-touched="1"/>
+<file p="src/verbs_for.h" v="unmerged" stray="26" authored="26" del="60" redone="13" sim="0.65" head-touched="1"/>
+<file p="test/callsrankordercheck.sh" v="unmerged" stray="24" authored="25" del="5" redone="0" sim="0.43" head-touched="0"/>
+<file p="test/mentioncheck.sh" v="unmerged" stray="23" authored="24" del="4" redone="0" sim="0.96" head-touched="0"/>
+<file p="src/cli.h" v="unmerged" stray="21" authored="21" del="1" redone="0" sim="0.95" head-touched="1"/>
+<more files="27"/>
+</ref>
+</stray-content>
+`````
+
+## `./build/ripwire . --stray-content=lane/ --plan`
+
+*Select the genuinely-unmerged refs of the `lane/` ref family and feed them to merge-scout for a landing order (a fully merged selection yields an empty landing set — still a measurement, disclosed on the root).*
+
+**wall time: 173.44s**
+
+`````
+<!-- ripwire landing-plan schema=ripwire.landing-plan/v1: stranded-work landing order across refs, fewest conflicts first. at=: commit+dirty+shallow. -->
+<landing-plan schema="ripwire.landing-plan/v1" head="0712a5182" refs="201" unmerged="26" superseded="0" merged="175" undetermined="0" scouted="12" bounded="14" scout-ok="1" at="0712a5182">
+<ref name="lane/arise-result" v="unmerged" stray="16331" files="18" scouted="1"/>
+<ref name="lane/margin-rescore" v="unmerged" stray="13920" files="12" scouted="1"/>
+<ref name="lane/served-syms-result" v="unmerged" stray="6345" files="8" scouted="1"/>
+<ref name="lane/orient-narrow-v3" v="unmerged" stray="3273" files="46" scouted="1"/>
+<ref name="lane/for-howitworks-067" v="unmerged" stray="3248" files="39" scouted="1"/>
+<ref name="lane/m1-lookback-harness" v="unmerged" stray="3164" files="14" scouted="1"/>
+<ref name="lane/orient-map-067" v="unmerged" stray="2475" files="40" scouted="1"/>
+<ref name="lane/served-syms-prereg" v="unmerged" stray="2134" files="4" scouted="1"/>
+<ref name="lane/crossctx-external-prereg" v="unmerged" stray="2054" files="6" scouted="1"/>
+<ref name="lane/for-noise" v="unmerged" stray="1821" files="47" scouted="1"/>
+<ref name="lane/arise-line-ranking" v="unmerged" stray="1538" files="7" scouted="1"/>
+<ref name="lane/for-noise-body-slot" v="unmerged" stray="1524" files="39" scouted="1"/>
+<ref name="lane/ep-manifest" v="unmerged" stray="1241" files="34" scouted="0"/>
+<ref name="lane/qn-input" v="unmerged" stray="978" files="44" scouted="0"/>
+<ref name="lane/research-abstention" v="unmerged" stray="898" files="2" scouted="0"/>
+<ref name="lane/rust-degraded" v="unmerged" stray="740" files="23" scouted="0"/>
+<ref name="lane/rank-fusion" v="unmerged" stray="581" files="13" scouted="0"/>
+<ref name="lane/ind5-glob-imports" v="unmerged" stray="352" files="11" scouted="0"/>
+<ref name="lane/tracked-in-skipdirs-065" v="unmerged" stray="330" files="14" scouted="0"/>
+<ref name="lane/testgate-subdir-335" v="unmerged" stray="268" files="4" scouted="0"/>
+<ref name="lane/deck-refresh-1021" v="unmerged" stray="232" files="3" scouted="0"/>
+<ref name="lane/map-stem-tight" v="unmerged" stray="155" files="11" scouted="0"/>
+<ref name="lane/agent-surface-scan-066" v="unmerged" stray="79" files="4" scouted="0"/>
+<ref name="lane/deck-refresh-068" v="unmerged" stray="16" files="1" scouted="0"/>
+<ref name="lane/lineage-skillspector-066" v="unmerged" stray="9" files="3" scouted="0"/>
+<ref name="lane/evals-stage1-scope-066" v="unmerged" stray="1" files="1" scouted="0"/>
+<arm ref="lane/arise-result" base="60b65f026" ok="1" changed="217" head_conflicts="2">
+<sym p="bench/slice/run_slice_linerecall_r3.py" id="SEED"/>
+… [33524 more display lines; full output is 4640806 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --stray-content=zzzz-no-such-ref --plan`
+
+*A --plan filter that selects NO ref REFUSES (exit 1) naming the substring — before the wave-3 close this fell through to the '>512 refs match' sentence, and --abi under the same filter answered an empty measurement at exit 0.*
+
+**exit code: 1** — **wall time: 9.83s**
+
+`````
+(empty)
+`````
+
+stderr:
+
+`````
+ripwire: --plan: --stray-content=zzzz-no-such-ref matches no local ref — a zero here would be a failure, not a measurement
+  (the filter is a substring match against refs/heads names; run bare --stray-content to list them, e.g. --stray-content=feat/)
+`````
+
+## `./build/ripwire . --stray-content=lane/ --abi`
+
+*Cross-branch ABI-break gate over the `lane/` ref family: struct byte-contract drift on each ref's AUTHORED paths — exit 2 when any drift row is found (the only kind that gates), 0 when the compared refs are clean, and exit 1 if the --stray-content filter matches no ref at all.*
+
+**exit code: 2** — **wall time: 471.53s**
+
+`````
+<!-- ripwire abi schema=ripwire.abi/v1: contract diff of the indexed symbols between two refs: added/removed/changed signatures. window: shown= capped= (capped=1 cut). at=: commit+dirty+shallow. root=: p= relative to it. -->
+<abi schema="ripwire.abi/v1" head="0712a5182" head_ref="integration/train-36" refs="201" candidates="1922" compared="341" blobs="129" rows="117" shown="5" capped="0" dropped="0" excluded="112" head_only="230017" unmodelable="1038" unrelated="0" broken_refs="2" quiet="188" excluded_refs="9" at="0712a … [line truncated: 53 more bytes on this line]
+<ref name="lane/rust-degraded" tip="1f69e0c77" date="2026-10-26" rows="6" shown="2" capped="0" excluded="4" head_only="114" drift="2" head-moved="4">
+<struct n="FileHealth" p="src/model.h" l="1797" kind="drift" head_size="20" ref_size="24" size_differs="1" size_delta="4">
+<d n="useBoundsBlanked" a="absent" b="std::uint32_t@20"/>
+</struct>
+<struct n="SkipHealthFinding" p="src/verbs_report.h" l="2024" kind="drift" head_size="24" ref_size="24" size_differs="0" size_delta="0">
+<d n="useBoundsBlanked" a="absent" b="std::uint32_t@20"/>
+</struct>
+</ref>
+<ref name="lane/for-noise" tip="5541dd8bc" date="2026-10-10" rows="14" shown="1" capped="0" excluded="13" head_only="994" drift="1" head-moved="13">
+<struct n="CandidateProvenance" p="src/serialize.h" l="6574" kind="drift" head_size="24" ref_size="32" size_differs="1" size_delta="8">
+<d n="frameTerms" a="absent" b="std::uint32_t@24"/>
+</struct>
+</ref>
+<ref name="lane/orient-map-067" tip="6a7046111" date="2026-10-03" rows="16" shown="1" capped="0" excluded="15" head_only="1244" absent="1" head-moved="15">
+<struct n="ObjSpan" p="src/jsrunner.h" l="170" kind="absent" head_size="16">
+</struct>
+</ref>
+<ref name="lane/orient-narrow-v3" tip="eb88882f1" date="2026-10-03" rows="21" shown="1" capped="0" excluded="20" head_only="1185" absent="1" head-moved="20">
+<struct n="ObjSpan" p="src/jsrunner.h" l="170" kind="absent" head_size="16">
+</struct>
+</ref>
+</abi>
+`````
+
+## `./build/ripwire . --whereis=rankGraphTeleport`
+
+*Which ref's tree defines or mentions SYM — HEAD first, then every local branch. The default lists the kind="def" rows (here the first 60, most on branches, each carrying tip= and date=) and counts the references in <refs count= next=>: on this symbol HEAD's references would fill the 60-row cap before the branch definitions arrive, so the whole list (below) shows fewer definitions, and the default serves the page that shows more of them, whatever its bytes.*
+
+**wall time: 30.28s**
+
+`````
+<!-- ripwire whereis schema=ripwire.whereis/v1: every LOCAL ref whose tree holds sym= (refs_scanned=, blobs=), HEAD first: <hit ref= tip= date= p= l= kind= t=>. window: shown= capped= (capped=1 cut). at=: commit+dirty+shallow. next=: the one pasteable follow-up. hits=N: occurrences in HEAD plus every scanned local ref's full tree (the total rows). on-head=1|0: whether HEAD's tree holds it; 0 beside hits = it lives only on a branch. head_labels=index: HEAD kind= from the parsed index; lexical: text heuristic. ref_labels=parsed: another ref's kind= from the index's own tags parse of its blob (one per blob and path; HEAD's own blob takes HEAD's labels); a blob with no line a loose lexical test calls worth parsing is not parsed and its rows read ref; kind=text: such a line no parse read, never a def. unparsed blobs=N: other refs' blobs holding a line worth parsing that no parse read (past the runaway guard, or the parser could not finish); those lines read kind=text; next= lifts the guard. unparsed rows=N: the kind=text rows those blobs gave. hit refs=N: N scanned refs hold this same definition (or kind=text) line (path + text); printed once for the first by name, whose ref= tip= date= l= it carries; defs page only, absent = one ref; hits= counts every copy, listing=all prints each. folded=N: def (or text) rows of other refs a listed row's refs= stands for; shown + more + folded + refs count = hits on the first page. listing=defs|refs: only those kind= rows listed (defs: def and text); under defs <refs count=N next=> counts the kind=ref rows and next= lists them; the window counts listed rows; default: defs if it lists more defs than all, else if shorter; a def the parser does not model (define_method, setattr, assignment) is a counted ref. head_date=: a hit without tip= date= has tip= at=, date= this. -->
+<whereis schema="ripwire.whereis/v1" sym="rankGraphTeleport" on-head="1" refs_scanned="278" blobs="9153" hits="838595" head_labels="index" shown="16" capped="0" listing="defs" folded="1148" ref_labels="parsed" head_date="2026-10-26" at="0712a5182">
+<unparsed blobs="284" rows="1113" next="--whereis=rankGraphTeleport --detail=1"/>
+<hit ref="HEAD" p="src/graph.h" l="11809" kind="def" t="inline RankedGraph rankGraphTeleport( const Graph&amp; g, const std::vector&lt;float&gt;&amp; p, float alpha = 0.85f )"/>
+<hit ref="arm/for-howitworks-067-f2add" tip="abcbd8b7f" date="2026-10-02" p="src/graph.h" l="4645" kind="text" refs="228" t="inline RankedGraph rankGraphTeleport( const Graph&amp; g, const std::vector&lt;float&gt;&amp; p, float alpha = 0.85f )"/>
+<hit ref="arm/for-howitworks-067-f2add" tip="abcbd8b7f" date="2026-10-02" p="src/main.cpp" l="1434" kind="text" refs="218" t="rw::RankedGraph    ranked = isDecay ? rankGraphTeleport( d.g, churnDecayTeleportWorkspace( rootDirs, d.ing, &amp;hasChurnEvidence ) )"/>
+<hit ref="arm/orient-map-067-narrow" tip="cf40f2e31" date="2026-10-02" p="test/showcase_capture.py" l="174" kind="text" refs="10" t="#0 0x102f4a1c8 in rw::rankGraphTeleport(Graph const&amp;, std::vector&lt;float&gt; const&amp;, float) src/graph.h:{TELEPORT_LN}"/>
+<hit ref="arm/orient-map-067-narrow" tip="cf40f2e31" date="2026-10-02" p="docs/EVALS.md" l="14295" kind="text" refs="170" t="- **(i) Static.** A&apos;s diff leaves `priorwt::weight`, graph.h:4378, `biasPrior`, `rankGraphTeleport`, `rankGraph` and `diffTeleport` byte-unchanged. `rankDefaultMap`&apos; … [line truncated: 36 more bytes on this line]
+<hit ref="arm/orient-map-067-narrow" tip="cf40f2e31" date="2026-10-02" p="docs/EVALS.md" l="14413" kind="text" refs="170" t="- Gate S (i): `priorwt::weight`, the `priorWeight` assignment, `biasPrior`, `rankGraphTeleport`, `rankGraph`, `diffTeleport`"/>
+<hit ref="backup/train-26a-a3cdcce3" tip="a3cdcce34" date="2026-10-07" p="docs/COMMANDS.md" l="202" kind="text" refs="74" t="&lt;![CDATA[inline RankedGraph rankGraphTeleport( const Graph&amp; g, const std::vector&lt;float&gt;&amp; p, float alpha = 0.85f )"/>
+<hit ref="backup/train-26a-a3cdcce3" tip="a3cdcce34" date="2026-10-07" p="docs/COMMANDS.md" l="1591" kind="text" refs="74" t="&lt;![CDATA[inline RankedGraph rankGraphTeleport( const Graph&amp; g, const std::vector&lt;float&gt;&amp; p, float alpha = 0.85f )"/>
+<hit ref="integration/train-17" tip="33c391528" date="2026-09-23" p="src/graph.h" l="3954" kind="def" refs="50" t="inline RankedGraph rankGraphTeleport( const Graph&amp; g, const std::vector&lt;float&gt;&amp; p, float alpha = 0.85f )"/>
+<hit ref="integration/train-26b" tip="7608d1f64" date="2026-10-08" p="test/crossrefcheck.sh" l="251" kind="text" refs="25" t="&quot;def src/graph.h&quot;) ok &quot;whereis: rankGraphTeleport&apos;s first def row is src/graph.h (was a docs/captures CDATA row)&quot; ;;"/>
+<hit ref="integration/train-26c" tip="4c38d363f" date="2026-10-10" p="docs/COMMANDS.md" l="1623" kind="text" refs="9" t="&lt;![CDATA[inline RankedGraph rankGraphTeleport( const Graph&amp; g, const std::vector&lt;float&gt;&amp; p, float alpha = 0.85f )"/>
+<hit ref="lane/answer-honesty-067" tip="95fed7e5b" date="2026-10-02" p="docs/captures/COMMANDS_showcase_2026-09-14.md" l="101" kind="text" refs="27" t="&lt;![CDATA[inline RankedGraph rankGraphTeleport( const Graph&amp; g, const std::vector&lt;float&gt;&amp; p, float alpha = 0.85f )"/>
+<hit ref="lane/answer-honesty-067" tip="95fed7e5b" date="2026-10-02" p="docs/captures/COMMANDS_showcase_2026-09-14.md" l="242" kind="text" refs="27" t="&lt;![CDATA[inline RankedGraph rankGraphTeleport( const Graph&amp; g, const std::vector&lt;float&gt;&amp; p, float alpha = 0.85f )"/>
+<hit ref="lane/answer-honesty-067" tip="95fed7e5b" date="2026-10-02" p="docs/captures/COMMANDS_showcase_2026-09-14.md" l="1485" kind="text" refs="27" t="&lt;![CDATA[inline RankedGraph rankGraphTeleport( const Graph&amp; g, const std::vector&lt;float&gt;&amp; p, float alpha = 0.85f )"/>
+<hit ref="lane/answer-honesty-067" tip="95fed7e5b" date="2026-10-02" p="docs/captures/COMMANDS_showcase_2026-09-14.md" l="1526" kind="text" refs="27" t="&lt;![CDATA[inline RankedGraph rankGraphTeleport( const Graph&amp; g, const std::vector&lt;float&gt;&amp; p, float alpha = 0.85f )"/>
+<hit ref="lane/answer-honesty-067" tip="95fed7e5b" date="2026-10-02" p="docs/captures/COMMANDS_showcase_2026-09-14.md" l="3049" kind="text" refs="27" t="&lt;![CDATA[inline RankedGraph rankGraphTeleport( const Graph&amp; g, const std::vector&lt;float&gt;&amp; p, float alpha = 0.85f )"/>
+<refs count="837431" next="--whereis=rankGraphTeleport --whereis-listing=refs"/>
+</whereis>
+`````
+
+## `./build/ripwire . --whereis=rankGraphTeleport --whereis-listing=all`
+
+*The whole hit list asked for by name: under the same 60-row cap HEAD's references fill the list, so it shows far fewer definitions (here HEAD's one) than the default above (here 60). The default serves the all page only when it shows the same definitions as the defs page in strictly fewer bytes (a tie serves it too).*
+
+**wall time: 28.18s**
+
+`````
+<!-- ripwire whereis schema=ripwire.whereis/v1: every LOCAL ref whose tree holds sym= (refs_scanned=, blobs=), HEAD first: <hit ref= tip= date= p= l= kind= t=>. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). at=: commit+dirty+shallow. next=: the one pasteable follow-up. hits=N: occurrences in HEAD plus every scanned local ref's full tree (the total rows). on-head=1|0: whether HEAD's tree holds it; 0 beside hits = it lives only on a branch. head_labels=index: HEAD kind= from the parsed index; lexical: text heuristic. ref_labels=parsed: another ref's kind= from the index's own tags parse of its blob (one per blob and path; HEAD's own blob takes HEAD's labels); a blob with no line a loose lexical test calls worth parsing is not parsed and its rows read ref; kind=text: such a line no parse read, never a def. unparsed blobs=N: other refs' blobs holding a line worth parsing that no parse read (past the runaway guard, or the parser could not finish); those lines read kind=text; next= lifts the guard. unparsed rows=N: the kind=text rows those blobs gave. hit t_bytes=N: t= previews an N-byte line (over 300 B): 200 B at most, its first bytes cut on a UTF-8 boundary plus an ellipsis. t_cut rows=N: rows of this page whose t= is a preview (each carries t_bytes=); next= replays this page (same listing, window, rows) with every line whole. more hits=N: rows after this page; page on with offset=next_offset. head_date=: a hit without tip= date= has tip= at=, date= this. -->
+<whereis schema="ripwire.whereis/v1" sym="rankGraphTeleport" on-head="1" refs_scanned="278" blobs="9153" hits="838595" head_labels="index" shown="60" capped="1" total="838595" has_more="1" next_offset="60" offset="0" limit="0" ref_labels="parsed" head_date="2026-10-26" at="0712a5182">
+<unparsed blobs="284" rows="1113" next="--whereis=rankGraphTeleport --whereis-listing=all --detail=1"/>
+<t_cut rows="5" next="--whereis=rankGraphTeleport --whereis-listing=all --whereis-full-text"/>
+<hit ref="HEAD" p="src/graph.h" l="11809" kind="def" t="inline RankedGraph rankGraphTeleport( const Graph&amp; g, const std::vector&lt;float&gt;&amp; p, float alpha = 0.85f )"/>
+<hit ref="HEAD" p=".ripwire_quality_acks" l="1305" kind="ref" t_bytes="815" t="ack short-horizon-churn 89b3fd14c192c899 116 cid=b6e271ab92996f75 by=src/* macro-vocabulary rename (VERIFY/DEGRADED_PATH_ALERT family -&gt; ASSUME/EXPECTS/ENSURES/DASSERT/UNREACHABLE/VALIDATE/DISCLOSE…"/>
+<hit ref="HEAD" p="present/deck5_ripwire_build.js" l="1157" kind="ref" t="s.addText(&quot;$ ripwire . --callers=rankGraphTeleport&quot;, { x: 8.68, y: 2.1, w: 3.8, h: 0.3, fontFace: MONO, fontSize: 10, color: MUTED, margin: 0 });"/>
+<hit ref="HEAD" p="present/deck5_ripwire_build.js" l="1159" kind="ref" t="{ text: &quot;&lt;callers of=\&quot;rankGraphTeleport\&quot;\n  defs=\&quot;1\&quot; count=\&quot;7\&quot; &quot;, options: { color: TEXT } },"/>
+<hit ref="HEAD" p="present/deck5_ripwire_build.js" l="1173" kind="ref" t_bytes="413" t="&quot;- The --callers example: `ripwire . --callers=rankGraphTeleport` answered defs=\&quot;1\&quot; count=\&quot;6\&quot; counts_floor=\&quot;1\&quot;, with runEval and rankGraph as its first two rows, on main 4 … [line truncated: 26 more bytes on this line]
+<hit ref="HEAD" p="src/cli.h" l="86" kind="ref" t="// tokens on --around=rankGraphTeleport vs 5,860 B at depth 1; the root&apos;s"/>
+<hit ref="HEAD" p="src/crossref.h" l="3651" kind="ref" t="// code above the real definition: `--whereis=rankGraphTeleport` opened with three kind=&quot;def&quot; rows into"/>
+<hit ref="HEAD" p="src/didyoumean.h" l="238" kind="ref" t="// `--path=rankGraphTeleport,` printed &quot;endpoint not found:  (did you mean &apos;A&apos;?)&quot;. Guarded at the shared walk"/>
+<hit ref="HEAD" p="src/eval.h" l="328" kind="ref" t="const std::vector&lt;float&gt; r = rankGraphTeleport( g, diffTeleport( ing, seedMask ) ).rank;"/>
+<hit ref="HEAD" p="src/graph.h" l="234" kind="ref" t="// renormalized to Σ=1 in rankGraphTeleport — so every teleport-based"/>
+<hit ref="HEAD" p="src/graph.h" l="11747" kind="ref" t="// prior (never the edges) and renormalized in rankGraphTeleport. Every symbol whose name is missing from"/>
+<hit ref="HEAD" p="src/graph.h" l="11797" kind="ref" t="// discard out. That is what this used to be: rankGraphTeleport called pageRankDouble, threw away its return,"/>
+<hit ref="HEAD" p="src/graph.h" l="11842" kind="ref" t="// `rank = takeRank( rankGraphTeleport( … ), d )` is the only spelling, and it fills both or neither."/>
+<hit ref="HEAD" p="src/graph.h" l="11853" kind="ref" t="return rankGraphTeleport( g, std::vector&lt;float&gt;( N, N ? 1.0f / float( N ) : 0.f ), alpha );"/>
+<hit ref="HEAD" p="src/graph.h" l="12477" kind="ref" t="// the anchor-count is not a cliff), run the EXISTING PPR machinery (rankGraphTeleport — the same"/>
+<hit ref="HEAD" p="src/graph.h" l="12547" kind="ref" t="const std::vector&lt;float&gt; ppr = rankGraphTeleport( g, p ).rank;"/>
+<hit ref="HEAD" p="src/main.cpp" l="1439" kind="ref" t="rw::RankedGraph ranked  = stubbed ? rw::RankedGraph{} : rankGraphTeleport( d.g, churnPriorFromDecayed( d.ing, mined.weights, mined.anyHistory ) );"/>
+<hit ref="HEAD" p="src/main.cpp" l="1478" kind="ref" t="rw::RankedGraph    ranked = isDecay ? rankGraphTeleport( d.g, churnDecayTeleportWorkspace( rootDirs, d.ing, &amp;hasChurnEvidence ) )"/>
+<hit ref="HEAD" p="src/main.cpp" l="1479" kind="ref" t=": rankGraphTeleport( d.g, churnTeleportWorkspace( rootDirs, d.ing, &quot;18 months ago&quot;, &amp;hasChurnEvidence ) );"/>
+<hit ref="HEAD" p="src/main.cpp" l="1493" kind="ref" t="rw::RankedGraph    ranked = rankGraphTeleport( d.g, churnTeleport( d.root, d.ing, &quot;18 months ago&quot;, d.cfg.since.empty() ? nullptr : &amp;sinceScope, &amp;hasChurnEvidence ) );"/>
+<hit ref="HEAD" p="src/main.cpp" l="1871" kind="ref" t="rank = rw::takeRank( rankGraphTeleport( g, diffTeleport( ing, changed ) ), rankDisclosure );"/>
+<hit ref="HEAD" p="src/mcp.h" l="2746" kind="ref" t="//   queries:[&quot;callers:rankGraphTeleport&quot;, {&quot;verb&quot;:&quot;slice&quot;,&quot;symbol&quot;:&quot;…&quot;}]"/>
+<hit ref="HEAD" p="src/mcpindex.h" l="1252" kind="ref" t="// symbols, the rest uniform, then rankGraphTeleport (which also applies the name-quality biasPrior"/>
+<hit ref="HEAD" p="src/mcpindex.h" l="1288" kind="ref" t="const auto [ wsRank, wsIters, wsConverged ] = rankGraphTeleport( ix.g, diffTeleport( ix.ing, changed ) );"/>
+<hit ref="HEAD" p="src/mcpverbs.h" l="5772" kind="ref" t="// the colon is a SEPARATOR, and `callers: rankGraphTeleport` is how a human writes one. Untrimmed, the"/>
+<hit ref="HEAD" p="src/mcpverbs.h" l="5774" kind="ref" t="//   symbol not found: &apos; rankGraphTeleport&apos; (did you mean &apos;rankGraphTeleport&apos;?)"/>
+… [36 more display lines; full output is 13362 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --quality-delta=HEAD~1..HEAD --quality-kinds=complexity,dead-code`
+
+*A ref range run for two of the twelve kinds only: the named kinds' rows are exactly their rows in the full answer, the header names the others (kinds_skipped=, skipped_why="selector"), and a pass no named kind needs does not run. The replay a memory-stopped range answer hands back (kinds_next=) is this flag. Refused without --quality-delta=A..B.*
+
+**wall time: 18.23s**
+
+`````
+<!-- ripwire quality-delta schema=ripwire.quality-delta/v1: only what the change made WORSE vs baseline=: regressions= minor= gating=; <r kind= sym= p= was= now= gating= bar=>, <sa> acked. value-ref-excluded=N: internal functions kept off because a table, field or argument in another function or at file scope holds them (matched by name, not a proven call); a floor. stale=N: ack ledger rows whose target no longer applies (sa rows); never gating. stale_by_kind=: stale= split by ack kind (kind:N,...); the sa rows are collapsed. stale_next=: the call printing the sa rows and the full header. preexisting-worse=N: regressions on symbols that existed at baseline; they gate when major. new-symbol=N: findings on NEW code; new-symbol rows never gate, except defect-shape format-arity. register-macro-excluded=N: symbols kept out of dead-code as self-registering test/bench macros; a floor. declined-call-excluded=N: symbols kept out of dead-code only because a declined call may mean them; a floor. api-new-surface=N: new PUBLIC symbols; a count, never gates, not in regressions=. renames=/rename_window_commits=: git rename pairs read over that many commits, to re-file baseline and acks. acked_by_rename=/acked_by_content=: acked= suppressions matched via git renames / an equal body hash. kinds_skipped=: kinds NOT run, so none of their rows is here and every count covers the rest; a count only they feed is absent. skipped_why=selector (the caller chose; stale acks judged for those kinds only) | memory (see ingest_scope=) | selector,memory (both). acked=N: findings suppressed by the ack ledger, listed as sa rows; never gating. base_ref=/target_ref=: the two resolved full shas a range compared (committed trees; at= omitted). churn=unavailable: range form; short-horizon-churn cannot be measured, so its silence is not no churn. -->
+<quality-delta schema="ripwire.quality-delta/v1" baseline="ref-pair" regressions="0" minor="0" acked="0" stale="17" preexisting-worse="0" new-symbol="0" gating="0" register-macro-excluded="62" api-new-surface="0" base_ref="6df53cf0da3d0f16e750d1a150d21655114e7b45" target_ref="0712a5182ef61b6885b76af … [line truncated: 440 more bytes on this line]
+</quality-delta>
+`````
+
+## `./build/ripwire . --whereis=rankGraphTeleport --whereis-listing=all --whereis-full-text`
+
+*The same page with every t= line whole: the page above previews each line over 300 B (200 B and t_bytes=, the <t_cut rows= next=> naming this call), and --whereis-full-text replays it with the same listing, window, rows and labels. MCP: full_text=true.*
+
+**wall time: 26.61s**
+
+`````
+<!-- ripwire whereis schema=ripwire.whereis/v1: every LOCAL ref whose tree holds sym= (refs_scanned=, blobs=), HEAD first: <hit ref= tip= date= p= l= kind= t=>. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). at=: commit+dirty+shallow. next=: the one pasteable follow-up. hits=N: occurrences in HEAD plus every scanned local ref's full tree (the total rows). on-head=1|0: whether HEAD's tree holds it; 0 beside hits = it lives only on a branch. head_labels=index: HEAD kind= from the parsed index; lexical: text heuristic. ref_labels=parsed: another ref's kind= from the index's own tags parse of its blob (one per blob and path; HEAD's own blob takes HEAD's labels); a blob with no line a loose lexical test calls worth parsing is not parsed and its rows read ref; kind=text: such a line no parse read, never a def. unparsed blobs=N: other refs' blobs holding a line worth parsing that no parse read (past the runaway guard, or the parser could not finish); those lines read kind=text; next= lifts the guard. unparsed rows=N: the kind=text rows those blobs gave. more hits=N: rows after this page; page on with offset=next_offset. head_date=: a hit without tip= date= has tip= at=, date= this. -->
+<whereis schema="ripwire.whereis/v1" sym="rankGraphTeleport" on-head="1" refs_scanned="278" blobs="9153" hits="838595" head_labels="index" shown="60" capped="1" total="838595" has_more="1" next_offset="60" offset="0" limit="0" ref_labels="parsed" head_date="2026-10-26" at="0712a5182">
+<unparsed blobs="284" rows="1113" next="--whereis=rankGraphTeleport --whereis-listing=all --detail=1"/>
+<hit ref="HEAD" p="src/graph.h" l="11809" kind="def" t="inline RankedGraph rankGraphTeleport( const Graph&amp; g, const std::vector&lt;float&gt;&amp; p, float alpha = 0.85f )"/>
+<hit ref="HEAD" p=".ripwire_quality_acks" l="1305" kind="ref" t="ack short-horizon-churn 89b3fd14c192c899 116 cid=b6e271ab92996f75 by=src/* macro-vocabulary rename (VERIFY/DEGRADED_PATH_ALERT family -&gt; ASSUME/EXPECTS/ENSURES/DASSERT/UNREACHABLE/VALIDATE/DISCLOSE): identifier-only churn across 179 … [line truncated: 586 more bytes on this line]
+<hit ref="HEAD" p="present/deck5_ripwire_build.js" l="1157" kind="ref" t="s.addText(&quot;$ ripwire . --callers=rankGraphTeleport&quot;, { x: 8.68, y: 2.1, w: 3.8, h: 0.3, fontFace: MONO, fontSize: 10, color: MUTED, margin: 0 });"/>
+<hit ref="HEAD" p="present/deck5_ripwire_build.js" l="1159" kind="ref" t="{ text: &quot;&lt;callers of=\&quot;rankGraphTeleport\&quot;\n  defs=\&quot;1\&quot; count=\&quot;7\&quot; &quot;, options: { color: TEXT } },"/>
+<hit ref="HEAD" p="present/deck5_ripwire_build.js" l="1173" kind="ref" t="&quot;- The --callers example: `ripwire . --callers=rankGraphTeleport` answered defs=\&quot;1\&quot; count=\&quot;6\&quot; counts_floor=\&quot;1\&quot;, with runEval and rankGraph as its first two rows, on main 40a1895b. On ma … [line truncated: 260 more bytes on this line]
+<hit ref="HEAD" p="src/cli.h" l="86" kind="ref" t="// tokens on --around=rankGraphTeleport vs 5,860 B at depth 1; the root&apos;s"/>
+<hit ref="HEAD" p="src/crossref.h" l="3651" kind="ref" t="// code above the real definition: `--whereis=rankGraphTeleport` opened with three kind=&quot;def&quot; rows into"/>
+<hit ref="HEAD" p="src/didyoumean.h" l="238" kind="ref" t="// `--path=rankGraphTeleport,` printed &quot;endpoint not found:  (did you mean &apos;A&apos;?)&quot;. Guarded at the shared walk"/>
+<hit ref="HEAD" p="src/eval.h" l="328" kind="ref" t="const std::vector&lt;float&gt; r = rankGraphTeleport( g, diffTeleport( ing, seedMask ) ).rank;"/>
+<hit ref="HEAD" p="src/graph.h" l="234" kind="ref" t="// renormalized to Σ=1 in rankGraphTeleport — so every teleport-based"/>
+<hit ref="HEAD" p="src/graph.h" l="11747" kind="ref" t="// prior (never the edges) and renormalized in rankGraphTeleport. Every symbol whose name is missing from"/>
+<hit ref="HEAD" p="src/graph.h" l="11797" kind="ref" t="// discard out. That is what this used to be: rankGraphTeleport called pageRankDouble, threw away its return,"/>
+<hit ref="HEAD" p="src/graph.h" l="11842" kind="ref" t="// `rank = takeRank( rankGraphTeleport( … ), d )` is the only spelling, and it fills both or neither."/>
+<hit ref="HEAD" p="src/graph.h" l="11853" kind="ref" t="return rankGraphTeleport( g, std::vector&lt;float&gt;( N, N ? 1.0f / float( N ) : 0.f ), alpha );"/>
+<hit ref="HEAD" p="src/graph.h" l="12477" kind="ref" t="// the anchor-count is not a cliff), run the EXISTING PPR machinery (rankGraphTeleport — the same"/>
+<hit ref="HEAD" p="src/graph.h" l="12547" kind="ref" t="const std::vector&lt;float&gt; ppr = rankGraphTeleport( g, p ).rank;"/>
+<hit ref="HEAD" p="src/main.cpp" l="1439" kind="ref" t="rw::RankedGraph ranked  = stubbed ? rw::RankedGraph{} : rankGraphTeleport( d.g, churnPriorFromDecayed( d.ing, mined.weights, mined.anyHistory ) );"/>
+<hit ref="HEAD" p="src/main.cpp" l="1478" kind="ref" t="rw::RankedGraph    ranked = isDecay ? rankGraphTeleport( d.g, churnDecayTeleportWorkspace( rootDirs, d.ing, &amp;hasChurnEvidence ) )"/>
+<hit ref="HEAD" p="src/main.cpp" l="1479" kind="ref" t=": rankGraphTeleport( d.g, churnTeleportWorkspace( rootDirs, d.ing, &quot;18 months ago&quot;, &amp;hasChurnEvidence ) );"/>
+<hit ref="HEAD" p="src/main.cpp" l="1493" kind="ref" t="rw::RankedGraph    ranked = rankGraphTeleport( d.g, churnTeleport( d.root, d.ing, &quot;18 months ago&quot;, d.cfg.since.empty() ? nullptr : &amp;sinceScope, &amp;hasChurnEvidence ) );"/>
+<hit ref="HEAD" p="src/main.cpp" l="1871" kind="ref" t="rank = rw::takeRank( rankGraphTeleport( g, diffTeleport( ing, changed ) ), rankDisclosure );"/>
+<hit ref="HEAD" p="src/mcp.h" l="2746" kind="ref" t="//   queries:[&quot;callers:rankGraphTeleport&quot;, {&quot;verb&quot;:&quot;slice&quot;,&quot;symbol&quot;:&quot;…&quot;}]"/>
+<hit ref="HEAD" p="src/mcpindex.h" l="1252" kind="ref" t="// symbols, the rest uniform, then rankGraphTeleport (which also applies the name-quality biasPrior"/>
+<hit ref="HEAD" p="src/mcpindex.h" l="1288" kind="ref" t="const auto [ wsRank, wsIters, wsConverged ] = rankGraphTeleport( ix.g, diffTeleport( ix.ing, changed ) );"/>
+<hit ref="HEAD" p="src/mcpverbs.h" l="5772" kind="ref" t="// the colon is a SEPARATOR, and `callers: rankGraphTeleport` is how a human writes one. Untrimmed, the"/>
+<hit ref="HEAD" p="src/mcpverbs.h" l="5774" kind="ref" t="//   symbol not found: &apos; rankGraphTeleport&apos; (did you mean &apos;rankGraphTeleport&apos;?)"/>
+<hit ref="HEAD" p="src/selectorrefuse.h" l="7" kind="ref" t="// (&quot;that file defines no &apos;rankGraphTeleport&apos;&quot;), names the files that DO define the name, and hands back a"/>
+… [35 more display lines; full output is 14375 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --whereis=computeOnePairOverlap --with-history`
+
+*Same, plus a git-history <fate> row (never / removed-by-commit) for names no tree carries.*
+
+**wall time: 35.26s**
+
+`````
+<!-- ripwire whereis schema=ripwire.whereis/v1: every LOCAL ref whose tree holds sym= (refs_scanned=, blobs=), HEAD first: <hit ref= tip= date= p= l= kind= t=>. window: shown= capped= (capped=1 cut). at=: commit+dirty+shallow. next=: the one pasteable follow-up. hits=N: occurrences in HEAD plus every scanned local ref's full tree (the total rows). on-head=1|0: whether HEAD's tree holds it; 0 beside hits = it lives only on a branch. head_labels=index: HEAD kind= from the parsed index; lexical: text heuristic. ref_labels=parsed: another ref's kind= from the index's own tags parse of its blob (one per blob and path; HEAD's own blob takes HEAD's labels); a blob with no line a loose lexical test calls worth parsing is not parsed and its rows read ref; kind=text: such a line no parse read, never a def. hit refs=N: N scanned refs hold this same definition (or kind=text) line (path + text); printed once for the first by name, whose ref= tip= date= l= it carries; defs page only, absent = one ref; hits= counts every copy, listing=all prints each. folded=N: def (or text) rows of other refs a listed row's refs= stands for; shown + more + folded + refs count = hits on the first page. listing=defs|refs: only those kind= rows listed (defs: def and text); under defs <refs count=N next=> counts the kind=ref rows and next= lists them; the window counts listed rows; default: defs if it lists more defs than all, else if shorter; a def the parser does not model (define_method, setattr, assignment) is a counted ref. head_date=: a hit without tip= date= has tip= at=, date= this. -->
+<whereis schema="ripwire.whereis/v1" sym="computeOnePairOverlap" on-head="1" refs_scanned="278" blobs="9153" hits="84125" head_labels="index" shown="2" capped="0" listing="defs" folded="277" ref_labels="parsed" head_date="2026-10-26" at="0712a5182">
+<history probed="1" head="0712a5182" commits="4861" removed-names="48741"/>
+<hit ref="HEAD" p="src/mergescout.h" l="696" kind="def" t="inline PairOverlap computeOnePairOverlap( std::size_t a, std::size_t b, const Arm&amp; armA, const Arm&amp; armB )"/>
+<hit ref="arm/for-howitworks-067-f2add" tip="abcbd8b7f" date="2026-10-02" p="src/mergescout.h" l="696" kind="def" refs="278" t="inline PairOverlap computeOnePairOverlap( std::size_t a, std::size_t b, const Arm&amp; armA, const Arm&amp; armB )"/>
+<refs count="83846" next="--whereis=computeOnePairOverlap --whereis-listing=refs"/>
+</whereis>
+`````
+
+## `./build/ripwire . --flags`
+
+*The dark-content dashboard: gates BUILT but OFF. CHANGED: no longer invents gates from comments/heredocs, so the count only reflects real ifndef/define, CMake option(), and getenv gates.*
+
+**wall time: 4.57s**
+
+`````
+<!-- ripwire flags schema=ripwire.flags/v1: BUILT but DARK: <gate name= kind=compile|cmake|env default= dark= regions=/loc=(#if only) reads= p= l=> with <read p= l=> sites. reads_capped=: 1 = cut. next=: the one pasteable follow-up. gates=/dark_gates=: gate rows (never cut) / those whose default keeps the guarded code out of the build. compile=/cmake=/env=: gates by kind: ifndef/define header gate, CMake option(), getenv read. files=N: files this verb scanned for gates (source + CMakeLists), wider than the map's corpus. -->
+<!-- ROWS AND WHAT IS NEVER CUT: the gate rows ARE the answer this verb was asked for and are never windowed, capped or paged, and gates/dark_gates/compile/cmake/env/files on the root plus regions/loc/reads/dark on every gate are counted over the FULL set before any cap exists. What pages is the read SITES under one gate, at 8 a gate by default: a gate whose sites were cut says shown_reads= (the rows this run printed) with reads_capped="1", against the reads= total already on the same element, and the more reads= child keeps naming the remainder. The pair is emitted ONLY on a gate that was cut, never as a capped="0" on the gates that fit. limit=N raises the per gate cap (offset=M skips that many sites in every gate), detail lifts it entirely, and next= on the root is the exact pasteable invocation that shows every site this run dropped. -->
+<flags schema="ripwire.flags/v1" gates="107" dark_gates="99" compile="13" cmake="12" env="82" files="3638" next="--flags --limit=19">
+<gate name="FIXTURE_DARK_FEATURE" kind="compile" default="0" dark="1" regions="2" loc="13" reads="2" p="test/flagsfix/wiringFlags.h" l="10">
+<read p="test/flagsfix/feature.cpp" l="10"/>
+<read p="test/flagsfix/sub/nested.cpp" l="5"/>
+</gate>
+<gate name="PROFILE_PMC_VERBOSE" kind="compile" default="0" dark="1" regions="2" loc="11" reads="2" p="src/infra/profilePmc.h" l="78">
+<read p="src/infra/profilePmc.h" l="81"/>
+<read p="src/infra/profilePmc.h" l="480"/>
+</gate>
+<gate name="ALIASFIX_ALL" kind="compile" default="0" dark="1" regions="0" loc="0" reads="2" p="test/flagsaliasfix/aliases.h" l="7">
+<aliases n="2" regions="2" loc="8"/>
+<read p="test/flagsaliasfix/aliases.h" l="11"/>
+<read p="test/flagsaliasfix/aliases.h" l="15"/>
+</gate>
+<gate name="ALIASFIX_TURNS" kind="compile" default="0" dark="1" regions="1" loc="4" reads="1" p="test/flagsaliasfix/aliases.h" l="15">
+<alias-of name="ALIASFIX_ALL"/>
+<read p="test/flagsaliasfix/use.cpp" l="10"/>
+</gate>
+<gate name="ALIASFIX_WALLS" kind="compile" default="0" dark="1" regions="1" loc="4" reads="1" p="test/flagsaliasfix/aliases.h" l="11">
+<alias-of name="ALIASFIX_ALL"/>
+<read p="test/flagsaliasfix/use.cpp" l="3"/>
+</gate>
+<gate name="PROFILE_BARRIER" kind="compile" default="0" dark="1" regions="1" loc="3" reads="1" p="src/infra/profileScope.h" l="60">
+<read p="src/infra/profileScope.h" l="122"/>
+</gate>
+<gate name="FIXTURE_CMAKE_DARK" kind="cmake" default="OFF" dark="1" regions="1" loc="1" reads="3" p="test/flagsfix/CMakeLists.txt" l="4">
+<read p="test/flagsfix/CMakeLists.txt" l="4"/>
+<read p="test/flagsfix/CMakeLists.txt" l="10"/>
+… [409 more display lines; full output is 25048 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --flags --flip=RIPWIRE_ASAN`
+
+*Blast radius of turning ONE gate on: live code, symbols, transitive reach, covering tests.*
+
+**wall time: 3.58s**
+
+`````
+<!-- ripwire flip schema=ripwire.flip/v1: the blast radius of flipping one build gate: the regions and symbols it toggles. root=: p= relative to it. -->
+<flip schema="ripwire.flip/v1" gate="RIPWIRE_ASAN" kind="cmake" default="OFF" dark="1" runtime="0" p="CMakeLists.txt" l="14" family="1" regions="0" loc="0" branches="0" bindings="0" hosts="0" filescope="0" downstream="0" dependents="0" tests="0" untested="0" files="3638" root=".">
+<member name="RIPWIRE_ASAN" via="self" regions="0" loc="0" branches="0"/>
+<lights r="0" b="0">
+</lights>
+<hosts n="0">
+</hosts>
+<downstream n="0">
+</downstream>
+<tests n="0">
+</tests>
+<untested n="0">
+</untested>
+<build n="13" note="CMake read sites: a switch here can add whole translation units or link targets, which this verb does NOT follow">
+<c p="CMakeLists.txt" l="14"/>
+<c p="CMakeLists.txt" l="18"/>
+<c p="CMakeLists.txt" l="24"/>
+<c p="CMakeLists.txt" l="36"/>
+<c p="CMakeLists.txt" l="38"/>
+<c p="CMakeLists.txt" l="1048"/>
+<c p="CMakeLists.txt" l="1053"/>
+<c p="CMakeLists.txt" l="1089"/>
+<c p="CMakeLists.txt" l="1102"/>
+<c p="CMakeLists.txt" l="1107"/>
+<c p="CMakeLists.txt" l="1146"/>
+<c p="CMakeLists.txt" l="1199"/>
+<c p="CMakeLists.txt" l="1201"/>
+</build>
+</flip>
+`````
+
+## `./build/ripwire . --flags --flip=RIPWIRE_ASA`
+
+*Unknown-gate refusal (exit 1) with a did-you-mean from a real edit distance (one character off RIPWIRE_ASAN).*
+
+**exit code: 1** — **wall time: 3.10s**
+
+`````
+(empty)
+`````
+
+stderr:
+
+`````
+ripwire: --flip: no gate named 'RIPWIRE_ASA' in . (did you mean 'RIPWIRE_ASAN'?)
+ripwire: run `ripwire . --flags` for the gate table
+`````
+
+## `./build/ripwire . --plan-lanes=3 --task="add a --since filter to the doc-drift verb and cover it with tests"`
+
+*NEW VERB: pre-hoc lane plan — which of 3 parallel worktrees would COLLIDE, before a line is written. JSON on stdout.*
+
+**wall time: 11.48s**
+
+`````
+{"v":1,"verb":"plan-lanes","at":"0712a5182","root":".","task":"add a --since filter to the doc-drift verb and cover it with tests","source":"partition","requested":3,"lane_count":3,"claim_key":"path+scope+name","on_conflict":"producing-lane-rebases","corpus":{"files":3631,"symbols":31860,"edges":300 … [line truncated: 338 more bytes on this line]
+"symbols":[{"p":"./src/docdrift.h","n":"DriftResult","scope":"DriftResult","l":286,"id":"./src/docdrift.h::DriftResult::DriftResult"},
+{"p":"./src/docdrift.h","n":"computeDocDrift","scope":"docdrift","l":2441,"id":"./src/docdrift.h::docdrift::computeDocDrift"},
+{"p":"./src/docdrift.h","n":"kDocDriftLegend","scope":"docdrift","l":2739,"id":"./src/docdrift.h::docdrift::kDocDriftLegend"},
+{"p":"./src/docdrift.h","n":"writeDocDriftPage","scope":"docdrift","l":2909,"id":"./src/docdrift.h::docdrift::writeDocDriftPage"},
+{"p":"./src/mcpverbs.h","n":"docDriftText","scope":"rw","l":655,"id":"./src/mcpverbs.h::rw::docDriftText"},
+{"p":"./src/verbs_change.h","n":"runDocDrift","scope":"","l":1678,"id":null}]},"lanes":[{"id":"lane-0","task":"add a --since filter to the doc-drift verb and cover it with tests","claims":{"symbols":[{"p":"./src/verbs_change.h","n":"runAbiCheck","scope":"","key":"183da9aaf74a4a92","id":null,"id_addr … [line truncated: 113 more bytes on this line]
+{"p":"./src/editcheck.h","n":"editCheckPriceRoot","scope":"rw","key":"33219bb04158a6a8","id":"./src/editcheck.h::rw::editCheckPriceRoot","id_addressable":true,"id_collides_with":0,"l":1211,"ord":0,"overloads":1,"amb":0,"cx":8,"ccx":10,"churn":61,"tested":0},
+{"p":"./src/docdrift.h","n":"writeGateability","scope":"docdrift","key":"42c456dfb55faee4","id":"./src/docdrift.h::docdrift::writeGateability","id_addressable":true,"id_collides_with":0,"l":2685,"ord":0,"overloads":1,"amb":2,"cx":6,"ccx":6,"churn":36,"tested":0},
+{"p":"./src/darkflags.h","n":"writeFlags","scope":"darkflags","key":"5c2c4a2b311b8dba","id":"./src/darkflags.h::darkflags::writeFlags","id_addressable":true,"id_collides_with":0,"l":1298,"ord":0,"overloads":1,"amb":1,"cx":8,"ccx":8,"churn":32,"tested":0},
+{"p":"./src/docdrift.h","n":"docDriftNextAttr","scope":"docdrift","key":"7723ed789a1c9c09","id":"./src/docdrift.h::docdrift::docDriftNextAttr","id_addressable":true,"id_collides_with":0,"l":2864,"ord":0,"overloads":1,"amb":0,"cx":6,"ccx":5,"churn":36,"tested":0},
+{"p":"./src/docdrift.h","n":"recordWeakDisclosures","scope":"docdrift","key":"972779210e49c0cf","id":"./src/docdrift.h::docdrift::recordWeakDisclosures","id_addressable":true,"id_collides_with":0,"l":2430,"ord":0,"overloads":1,"amb":0,"cx":2,"ccx":1,"churn":36,"tested":0},
+{"p":"./src/testmap.h","n":"scriptGatesUnmodelledCount","scope":"rw","key":"98c4487e2e9e08bc","id":"./src/testmap.h::rw::scriptGatesUnmodelledCount","id_addressable":true,"id_collides_with":0,"l":1793,"ord":0,"overloads":1,"amb":0,"cx":4,"ccx":4,"churn":61,"tested":0},
+{"p":"./src/main.cpp","n":"scanReportVerbPrecedence","scope":"","key":"9ab981e987e8108e","id":null,"id_addressable":false,"id_collides_with":0,"l":3031,"ord":0,"overloads":1,"amb":0,"cx":8,"ccx":11,"churn":453,"tested":0},
+{"p":"./src/pageview.h","n":"secondaryCutAttrs","scope":"rw","key":"a10ea8d3bdca1dfb","id":"./src/pageview.h::rw::secondaryCutAttrs","id_addressable":true,"id_collides_with":0,"l":399,"ord":0,"overloads":1,"amb":0,"cx":3,"ccx":2,"churn":28,"tested":0},
+{"p":"./src/main.cpp","n":"emitNoteAddUnprovenDefs","scope":"","key":"a950332ccfce6b8d","id":null,"id_addressable":false,"id_collides_with":0,"l":691,"ord":0,"overloads":1,"amb":1,"cx":2,"ccx":1,"churn":453,"tested":0},
+{"p":"./src/docdrift.h","n":"sortDocsByLiveDrift","scope":"docdrift","key":"d5de682411b9a9a9","id":"./src/docdrift.h::docdrift::sortDocsByLiveDrift","id_addressable":true,"id_collides_with":0,"l":2390,"ord":0,"overloads":1,"amb":0,"cx":2,"ccx":2,"churn":36,"tested":0},
+{"p":"./src/mcpverbs.h","n":"unknownSubVerbRefusal","scope":"rw","key":"e336d39b0a6addea","id":"./src/mcpverbs.h::rw::unknownSubVerbRefusal","id_addressable":true,"id_collides_with":0,"l":5840,"ord":0,"overloads":1,"amb":0,"cx":3,"ccx":2,"churn":466,"tested":0}],
+"files":[{"p":"./src/darkflags.h","symbols":1,"churn":32,"ccx":8,"hotspot_rank":56},
+{"p":"./src/docdrift.h","symbols":4,"churn":36,"ccx":14,"hotspot_rank":38},
+{"p":"./src/editcheck.h","symbols":1,"churn":61,"ccx":10,"hotspot_rank":41},
+{"p":"./src/main.cpp","symbols":2,"churn":453,"ccx":12,"hotspot_rank":5},
+{"p":"./src/mcpverbs.h","symbols":1,"churn":466,"ccx":2,"hotspot_rank":4},
+{"p":"./src/pageview.h","symbols":1,"churn":28,"ccx":2,"hotspot_rank":129},
+{"p":"./src/testmap.h","symbols":1,"churn":61,"ccx":4,"hotspot_rank":33},
+{"p":"./src/verbs_change.h","symbols":1,"churn":82,"ccx":9,"hotspot_rank":25}]},"blast_radius":{"reaches":47,"files_total":16,"capped":false,"files":["./src/darkflags.h","./src/docdrift.h","./src/editcheck.h","./src/editplan.h","./src/editpreview.h","./src/flipimpact.h","./src/main.cpp","./src/mcp.h … [line truncated: 182 more bytes on this line]
+"tests_total":0,"tests_capped":false,"tests_granularity":"claimed-symbols","untested":47,"module_span":1,"notes":[],
+"execution":{"policy":"codex-lane/v1","model":"gpt-5.6-terra","reasoning":"high","rule":"moderate-cross-module","basis":"structural-only","signals":{"claims":12,"files":8,"module_span":1,"max_ccx":11,"sum_ccx":61,"ambiguous_calls":6,"blast_reaches":47,"contract_touches":0,"conflicts":0,"untested":47 … [line truncated: 142 more bytes on this line]
+{"id":"lane-1","task":"add a --since filter to the doc-drift verb and cover it with tests","claims":{"symbols":[{"p":"./src/gitmine.h","n":"gitWindowBoundarySha","scope":"rw","key":"18627516699d7062","id":"./src/gitmine.h::rw::gitWindowBoundarySha","id_addressable":true,"id_collides_with":0,"l":1674 … [line truncated: 69 more bytes on this line]
+{"p":"./src/cli.h","n":"kViewFlags","scope":"rw","key":"2a2f2487082cc6d8","id":"./src/cli.h::rw::kViewFlags","id_addressable":true,"id_collides_with":0,"l":3327,"ord":0,"overloads":1,"amb":0,"cx":0,"ccx":0,"churn":511,"tested":0},
+… [69 more display lines; full output is 20481 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --plan-lanes --brief=<scratch>/aux/lanes_brief.txt`
+
+*NEW VERB, explicit form: one line per lane, lane boundaries are the ones you wrote (the defensible mode).*
+
+**wall time: 13.97s**
+
+Input file:
+
+`````
+add a --since filter to the doc-drift verb
+add the CLI parse arm and help text for the new filter
+write regression tests for the new filter
+`````
+
+`````
+{"v":1,"verb":"plan-lanes","at":"0712a5182","root":".","task":null,"source":"brief","requested":3,"lane_count":3,"claim_key":"path+scope+name","on_conflict":"producing-lane-rebases","corpus":{"files":3631,"symbols":31860,"edges":30033,"ambiguous":2933,"unresolved":15249},"carve":null,"core":{"files" … [line truncated: 4 more bytes on this line]
+"symbols":[]},"lanes":[{"id":"lane-0","task":"add a --since filter to the doc-drift verb","claims":{"symbols":[{"p":"./src/docdrift.h","n":"recordUnchecked","scope":"docdrift","key":"12641dab14abc8fd","id":"./src/docdrift.h::docdrift::recordUnchecked","id_addressable":true,"id_collides_with":0,"l":2 … [line truncated: 72 more bytes on this line]
+{"p":"./src/docdrift.h","n":"sortWeakGroupsByPath","scope":"docdrift","key":"1944ba506280ff80","id":"./src/docdrift.h::docdrift::sortWeakGroupsByPath","id_addressable":true,"id_collides_with":0,"l":2401,"ord":0,"overloads":1,"amb":0,"cx":1,"ccx":0,"churn":36,"tested":0},
+{"p":"./src/mcpverbs.h","n":"docDriftText","scope":"rw","key":"1fa68e8d93c05a59","id":"./src/mcpverbs.h::rw::docDriftText","id_addressable":true,"id_collides_with":0,"l":655,"ord":0,"overloads":1,"amb":0,"cx":1,"ccx":0,"churn":466,"tested":0},
+{"p":"./src/cli.h","n":"kViewFlags","scope":"rw","key":"2a2f2487082cc6d8","id":"./src/cli.h::rw::kViewFlags","id_addressable":true,"id_collides_with":0,"l":3327,"ord":0,"overloads":1,"amb":0,"cx":0,"ccx":0,"churn":511,"tested":0},
+{"p":"./src/recall.h","n":"docFileMask","scope":"rw","key":"3149a219f599664c","id":"./src/recall.h::rw::docFileMask","id_addressable":true,"id_collides_with":0,"l":110,"ord":0,"overloads":1,"amb":0,"cx":4,"ccx":4,"churn":27,"tested":0},
+{"p":"./src/docdrift.h","n":"writeDocDriftPage","scope":"docdrift","key":"380b7de5df1cfd73","id":"./src/docdrift.h::docdrift::writeDocDriftPage","id_addressable":true,"id_collides_with":0,"l":2909,"ord":0,"overloads":1,"amb":10,"cx":14,"ccx":15,"churn":36,"tested":0},
+{"p":"./src/docdrift.h","n":"computeDocDrift","scope":"docdrift","key":"3b19cc3d8996c3b2","id":"./src/docdrift.h::docdrift::computeDocDrift","id_addressable":true,"id_collides_with":0,"l":2441,"ord":0,"overloads":1,"amb":1,"cx":26,"ccx":38,"churn":36,"tested":0},
+{"p":"./src/docdrift.h","n":"DriftResult","scope":"DriftResult","key":"422ab39546b6e0bd","id":"./src/docdrift.h::DriftResult::DriftResult","id_addressable":true,"id_collides_with":0,"l":286,"ord":0,"overloads":1,"amb":0,"cx":0,"ccx":0,"churn":36,"tested":0},
+{"p":"./src/verbs_change.h","n":"runDocDrift","scope":"","key":"904831e5c0f66b39","id":null,"id_addressable":false,"id_collides_with":0,"l":1678,"ord":0,"overloads":1,"amb":1,"cx":5,"ccx":4,"churn":82,"tested":0},
+{"p":"./src/ensemble.h","n":"kEnsembleChurnSince","scope":"ensemble","key":"a34fc78c05bf56a8","id":"./src/ensemble.h::ensemble::kEnsembleChurnSince","id_addressable":true,"id_collides_with":0,"l":120,"ord":0,"overloads":1,"amb":0,"cx":0,"ccx":0,"churn":23,"tested":0},
+{"p":"./src/mcpverbs.h","n":"unknownSubVerbRefusal","scope":"rw","key":"e336d39b0a6addea","id":"./src/mcpverbs.h::rw::unknownSubVerbRefusal","id_addressable":true,"id_collides_with":0,"l":5840,"ord":0,"overloads":1,"amb":0,"cx":3,"ccx":2,"churn":466,"tested":0},
+{"p":"./src/docdrift.h","n":"kDocDriftLegend","scope":"docdrift","key":"ff2ba74637bbbebf","id":"./src/docdrift.h::docdrift::kDocDriftLegend","id_addressable":true,"id_collides_with":0,"l":2739,"ord":0,"overloads":1,"amb":0,"cx":0,"ccx":0,"churn":36,"tested":0}],
+"files":[{"p":"./src/cli.h","symbols":1,"churn":511,"ccx":0,"hotspot_rank":6},
+{"p":"./src/docdrift.h","symbols":6,"churn":36,"ccx":54,"hotspot_rank":38},
+{"p":"./src/ensemble.h","symbols":1,"churn":23,"ccx":0,"hotspot_rank":105},
+{"p":"./src/mcpverbs.h","symbols":2,"churn":466,"ccx":2,"hotspot_rank":4},
+{"p":"./src/recall.h","symbols":1,"churn":27,"ccx":4,"hotspot_rank":64},
+{"p":"./src/verbs_change.h","symbols":1,"churn":82,"ccx":4,"hotspot_rank":25}],
+"symbols_total":3466,"symbols_capped":true},"blast_radius":{"reaches":13,"files_total":7,"capped":false,"files":["./src/docdrift.h","./src/main.cpp","./src/mcp.h","./src/mcpserver.h","./src/mcpverbs.h","./src/recall.h","./src/verbs_for.h"]},"tests_to_run":[],
+"tests_total":0,"tests_capped":false,"tests_granularity":"claimed-symbols","untested":13,"module_span":6,"notes":[],
+"execution":{"policy":"codex-lane/v1","model":"gpt-5.6-sol","reasoning":"xhigh","rule":"wide-contract-work","basis":"structural-only","signals":{"claims":12,"files":6,"module_span":6,"max_ccx":38,"sum_ccx":64,"ambiguous_calls":12,"blast_reaches":13,"contract_touches":1,"conflicts":0,"untested":13,"t … [line truncated: 139 more bytes on this line]
+{"id":"lane-1","task":"add the CLI parse arm and help text for the new filter","claims":{"symbols":[{"p":"./scripts/optremarks.py","n":"main","scope":"","key":"01b3b880f77d1512","id":null,"id_addressable":false,"id_collides_with":134,"l":279,"ord":0,"overloads":1,"amb":0,"cx":23,"ccx":31,"churn":14, … [line truncated: 12 more bytes on this line]
+{"p":"./src/cli.h","n":"HelpLine","scope":"rw","key":"1489844dbc310b82","id":"./src/cli.h::rw::HelpLine","id_addressable":true,"id_collides_with":0,"l":2948,"ord":0,"overloads":1,"amb":0,"cx":0,"ccx":0,"churn":511,"tested":0},
+{"p":"./src/cli.h","n":"HelpFilter","scope":"HelpFilter","key":"3103a5e8bfc33d38","id":"./src/cli.h::HelpFilter::HelpFilter","id_addressable":true,"id_collides_with":0,"l":3027,"ord":0,"overloads":1,"amb":0,"cx":0,"ccx":0,"churn":511,"tested":0},
+{"p":"./docs/docs_commands_build.py","n":"main","scope":"","key":"4015853681ded3bc","id":null,"id_addressable":false,"id_collides_with":134,"l":885,"ord":0,"overloads":1,"amb":0,"cx":19,"ccx":28,"churn":18,"tested":0},
+{"p":"./src/mcprefusal.h","n":"kMcpValueFields","scope":"rw::mcprefuse","key":"4a7106e488a2aa80","id":"./src/mcprefusal.h::rw::mcprefuse::kMcpValueFields","id_addressable":true,"id_collides_with":0,"l":304,"ord":0,"overloads":1,"amb":0,"cx":0,"ccx":0,"churn":49,"tested":0},
+{"p":"./src/cli.h","n":"serveHelpSelector","scope":"rw","key":"4b247ee064fc4e94","id":"./src/cli.h::rw::serveHelpSelector","id_addressable":true,"id_collides_with":0,"l":3092,"ord":0,"overloads":1,"amb":1,"cx":4,"ccx":3,"churn":511,"tested":0},
+{"p":"./src/query.h","n":"tryParsePredicateOnAll","scope":"query","key":"786acc4dbfec612b","id":"./src/query.h::query::tryParsePredicateOnAll","id_addressable":false,"id_collides_with":1,"l":113,"ord":0,"overloads":2,"amb":0,"cx":1,"ccx":0,"churn":20,"tested":0},
+{"p":"./src/cli.h","n":"printUsageTier","scope":"rw","key":"82b7af67acdca479","id":"./src/cli.h::rw::printUsageTier","id_addressable":true,"id_collides_with":0,"l":3078,"ord":0,"overloads":1,"amb":0,"cx":2,"ccx":1,"churn":511,"tested":0},
+… [60 more display lines; full output is 18606 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --plan-lanes=99 --task=x`
+
+*Out-of-range refusal shape for the lane count.*
+
+**exit code: 1** — **wall time: 2.48s**
+
+`````
+(empty)
+`````
+
+stderr:
+
+`````
+ripwire: --plan-lanes=99 is out of range — N must be 2..16 (1 is not a fan-out)
+`````
+
+## `./build/ripwire . --layout=Symbol`
+
+*CPU/GPU contract view of one struct: computed offsets/sizes/padding + mirror check.*
+
+**wall time: 1.70s**
+
+`````
+<!-- ripwire layout schema=ripwire.layout/v1: struct field layout vs cache lines: offsets, padding, hot/cold split candidates. root=: p= relative to it. sym=: the aggregate name asked for. found=1: a C-family struct/class/union body was located for sym=. defs=N: same-name aggregate defs found; a more element counts any not shown. mirror=: single|match|mismatch (byte drift, exits nonzero)|stub|spelling, over same-name defs. asserts=N: static_assert tripwires in indexed files that mention sym=. conflicts=N: asserts contradicting the computed size (agree=0 rows); nonzero exits nonzero. scanned=N: indexed C-family files read for asserts. agg=: struct, class or union. fields=N: member rows listed. modeled=0: size/align/tail pad not computed; off= only up to the first unknown. ty=: the field type as written, before macro expansion (as= gives the expansion). sz=N: field bytes incl. array extent (LP64 model); sized=0 instead when unknown. al=N: field alignment in bytes (LP64 model). off=N: computed byte offset; absent after an earlier field of unknown size. d=: caveat detail: the first site this kind fired on, or a plain description. count=N: member sites this one caveat row stands for (absent = 1). -->
+<layout schema="ripwire.layout/v1" sym="Symbol" found="1" defs="1" mirror="single" asserts="2" conflicts="0" scanned="810" root=".">
+<def p="src/model.h" l="600" agg="struct" modeled="0" fields="23">
+<f n="id" ty="NodeId" as="std::uint32_t" sz="4" al="4" off="0"/>
+<f n="kind" ty="SymKind" as="std::uint8_t" sz="1" al="1" off="4"/>
+<f n="lang" ty="Lang" as="std::uint8_t" sz="1" al="1" off="5"/>
+<f n="ppAlt" ty="std::uint16_t" sz="2" al="2" off="6"/>
+<f n="fileId" ty="std::uint32_t" sz="4" al="4" off="8"/>
+<f n="line" ty="std::uint32_t" sz="4" al="4" off="12"/>
+<f n="sigStartByte" ty="std::uint32_t" sz="4" al="4" off="16"/>
+<f n="sigEndByte" ty="std::uint32_t" sz="4" al="4" off="20"/>
+<f n="endByte" ty="std::uint32_t" sz="4" al="4" off="24"/>
+<f n="cx" ty="std::uint32_t" sz="4" al="4" off="28"/>
+<f n="ccx" ty="std::uint32_t" sz="4" al="4" off="32"/>
+<f n="loc" ty="std::uint32_t" sz="4" al="4" off="36"/>
+<f n="locals" ty="std::uint32_t" sz="4" al="4" off="40"/>
+<f n="humps" ty="std::uint16_t" sz="2" al="2" off="44"/>
+<f n="deepLoc" ty="std::uint16_t" sz="2" al="2" off="46"/>
+<f n="ev" ty="std::uint16_t" sz="2" al="2" off="48"/>
+<f n="evWhy" ty="std::array&lt;std::uint8_t, kEvWhyTagCount&gt;" sized="0"/>
+<f n="params" ty="std::uint16_t" sz="2" al="2"/>
+<f n="maxNest" ty="std::uint8_t" sz="1" al="1"/>
+<f n="arityExact" ty="std::uint8_t" sz="1" al="1"/>
+<f n="extentSuspect" ty="std::uint8_t" sz="1" al="1"/>
+<f n="name" ty="std::string" sized="0"/>
+<f n="scope" ty="std::string" sized="0"/>
+<caveat k="compound-type" d="evWhy: std::array&lt;std::uint8_t, kEvWhyTagCount&gt;"/>
+<caveat k="unknown-type" d="evWhy: std::array&lt;std::uint8_t, kEvWhyTagCount&gt;" count="3"/>
+<caveat k="bitfield" d="the bit allocation unit and packing order are implementation-defined" count="5"/>
+</def>
+<assert p="src/model.h" l="800" kind="mention" t="static_assert( sizeof( Symbol ) == 64 + 2 * sizeof( std::string ), &quot;Symbol size changed — verify the new field uses the smallest type + is grouped (SoA); see model.h&quot; )"/>
+<assert p="src/renamemine.h" l="512" kind="mention" t="static_assert( kRuleCount &lt;= std::numeric_limits&lt;decltype( firedRuleMask( std::declval&lt;const Symbol&amp;&gt;(), std::string_view() ) )&gt;::digits, &quot;firedRuleMask holds one bit per naming rule — widen it before kRuleCount outgro" … [line truncated: 2 more bytes on this line]
+</layout>
+`````
+
+## `./build/ripwire . --layout=Lang`
+
+*The honest refusal (exit 1): Lang is an `enum class`, not a struct — no offsets are fabricated.*
+
+**exit code: 1** — **wall time: 1.70s**
+
+`````
+(empty)
+`````
+
+stderr:
+
+`````
+ripwire: --layout: 'Lang' is an enum, --layout models structs (a scoped/unscoped enum's underlying type is not a byte layout)
+`````
+
+## `./build/ripwire . --doc-drift`
+
+*Which of this repo's doc claims are now false. CHANGED: row attribute at= renamed to tgt= (at= is now only the root sha stamp).*
+
+**wall time: 5.52s**
+
+`````
+<!-- ripwire doc-drift schema=ripwire.doc-drift/v1: markdown anchors that no longer hold: <doc p=> of <a k= l= c= why= ref= want= got= tgt=>; unchecked/dated rows disclose the rest. failed_capped=/weak_capped=: 1 = cut. at=: commit+dirty+shallow. next=: the one pasteable follow-up. docs=N: markdown docs scanned for anchors; docs minus clean = the doc rows. clean=N: docs with no failed anchor (drift and dated 0); not proof every anchor was checked. checked=N: anchors verified against the index; checked + unchecked = anchors. prose=N: value anchors dropped as prose (name not in code); subtracted from anchors=, never checked. corpus=N: files the anchors were checked against (index + config/build exts); 0 = no anchor shape, no scan. drift=/dated=: anchors that no longer hold / anchors skipped as dated (unverifiable by date). unchecked=N: anchors not proved (the unchecked rows give each reason); checked + unchecked = anchors. doc shown_failed=/failed_total=: a rows printed / all failed anchors (drift+dated); cut at 12, detail=1 lifts. a kind=/rec=: dated-record, an author-dated failed anchor in dated= / its evidence: line|block|title|stamp. a sym=: the symbol the doc names on that file:line; line-moved = that symbol no longer spans the line. more weak=N: w rows of this group withheld; shown_weak + N = its n=; detail=1 lists all. shown_weak=N: w rows printed of n= (cut at 12 a doc, weak_capped=1); detail=1 lists all. w resolves-to=: the indexed symbol spanning that line; not proof it is the one the doc meant. unchecked r=/note=: why n= anchors were not proved, and what was still checked for them. dated r=/note=: the dating mark that moved n= failed anchors into dated= instead of drift=. -->
+<doc-drift schema="ripwire.doc-drift/v1" docs="267" clean="237" anchors="7101" checked="3318" unchecked="3783" drift="79" dated="109" prose="26" corpus="3749" at="0712a5182" next="--doc-drift --detail=1">
+<doc p="docs/research/answer-completeness.md" anchors="187" checked="83" drift="16" dated="0" shown_failed="12" failed_capped="1" failed_total="16">
+<a k="file-line" l="341" c="25" why="line-moved" ref="src/pageview.h:292" sym="pageDisclosure" got="(file scope)" tgt="src/pageview.h:346"/>
+<a k="file-line" l="349" c="99" why="line-moved" ref="src/serialize.h:4169" sym="kForLensDefaultTopN" got="cleanSig" tgt="src/serialize.h:1044"/>
+<a k="file-line" l="353" c="89" why="line-moved" ref="src/serialize.h:4435" sym="kForPayloadBudgetBytes" got="compressBody" tgt="src/serialize.h:933"/>
+<a k="file-line" l="356" c="42" why="line-moved" ref="src/serialize.h:1010" sym="kForFileTailShownCap" got="forSoftRowDropFill" tgt="src/serialize.h:1119"/>
+<a k="file-line" l="358" c="89" why="line-moved" ref="src/serialize.h:5481" sym="kForAnchorBodyBudgetBytes" got="SigsCutReport" tgt="src/serialize.h:1097"/>
+<a k="file-line" l="360" c="88" why="line-moved" ref="src/serialize.h:5800" sym="kForCompactSurfaceBudgetBytes" got="sigsOpenTag" tgt="src/serialize.h:1172"/>
+<a k="file-line" l="366" c="43" why="line-moved" ref="src/serialize.h:6534" sym="kWithGraphNodeCap" got="packSignatures" tgt="src/serialize.h:9223"/>
+<a k="file-line" l="367" c="51" why="line-moved" ref="src/forpage.h:287" sym="kForPageRowsDefault" got="forCandidatePageDoc" tgt="src/forpage.h:60"/>
+<a k="file-line" l="380" c="44" why="line-moved" ref="src/serialize.h:2460" sym="kFillOrderThreshold" got="(file scope)" tgt="src/serialize.h:1512"/>
+<a k="file-line" l="382" c="62" why="line-moved" ref="src/main.cpp:1283" sym="kRecentRows" got="(file scope)" tgt="src/main.cpp:1225"/>
+<a k="file-line" l="399" c="48" why="line-moved" ref="src/serialize.h:5317" sym="kMaxExpandSibs" got="sigLadderDryDrop" tgt="src/serialize.h:7409"/>
+<a k="file-line" l="400" c="50" why="line-moved" ref="src/serialize.h:5342" sym="kMaxExpandIncludes" got="SigLadderOutcome" tgt="src/serialize.h:7418"/>
+<more drift="4"/>
+</doc>
+<doc p="prompts/help-wanted/graph-unit-tests.md" anchors="164" checked="94" drift="8" dated="0">
+<a k="file-line" l="96" c="6" why="range-straddles" ref="src/infra/Diagnostics.h:265-321" got="RW_CHECK_" tgt="src/infra/Diagnostics.h:321"/>
+<a k="file-line" l="99" c="57" why="line-moved" ref="Diagnostics.h:543-550" sym="DISCLOSE" got="(file scope)" tgt="src/infra/Diagnostics.h:616"/>
+<a k="file-line" l="132" c="18" why="range-straddles" ref="src/graph.h:2742-2755" sym="buildGraph" got="jsCallThroughWrittenBinding" tgt="src/graph.h:2755"/>
+<a k="file-line" l="155" c="17" why="line-moved" ref="src/graph.h:3228" sym="biasPrior" got="BuiltinMethodGate" tgt="src/graph.h:11768"/>
+<a k="file-line" l="170" c="3" why="line-moved" ref="src/graph.h:3915" sym="computeImpure" got="Reach" tgt="src/graph.h:13668"/>
+<a k="const" l="301" c="421" why="const-value" ref="maxIterationCount = 90" want="90" got="400" tgt="test/verify_pagerank.cpp:59"/>
+<a k="const" l="301" c="510" why="const-value" ref="maxIterationCount = 89" want="89" got="400" tgt="test/verify_pagerank.cpp:59"/>
+<a k="const" l="303" c="18" why="const-value" ref="maxIterationCount = 1" want="1" got="400" tgt="test/verify_pagerank.cpp:59"/>
+</doc>
+<doc p="CHANGELOG.md" anchors="1538" checked="654" drift="7" dated="10" shown_failed="12" failed_capped="1" failed_total="17">
+<a k="file-line" l="157" c="63" why="past-eof" kind="dated-record" rec="block" ref="src/helper/dev/index.ts:77" got="1 lines" tgt="test/mapinvfix/ts/index.ts"/>
+<a k="file-line" l="722" c="5" why="missing-file" kind="dated-record" rec="block" ref="cmd.c:206"/>
+… [228 more display lines; full output is 23860 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --doc-drift --gateability`
+
+*The finishable to-do list: docs whose LIVE failing anchors a date-stamp would reclassify.*
+
+**wall time: 4.54s**
+
+`````
+<!-- ripwire doc-drift schema=ripwire.doc-drift/v1: markdown anchors that no longer hold: <doc p=> of <a k= l= c= why= ref= want= got= tgt=>; unchecked/dated rows disclose the rest. failed_capped=/weak_capped=: 1 = cut. at=: commit+dirty+shallow. next=: the one pasteable follow-up. docs=N: markdown docs scanned for anchors; docs minus clean = the doc rows. clean=N: docs with no failed anchor (drift and dated 0); not proof every anchor was checked. checked=N: anchors verified against the index; checked + unchecked = anchors. prose=N: value anchors dropped as prose (name not in code); subtracted from anchors=, never checked. corpus=N: files the anchors were checked against (index + config/build exts); 0 = no anchor shape, no scan. drift=/dated=: anchors that no longer hold / anchors skipped as dated (unverifiable by date). unchecked=N: anchors not proved (the unchecked rows give each reason); checked + unchecked = anchors. doc shown_failed=/failed_total=: a rows printed / all failed anchors (drift+dated); cut at 12, detail=1 lifts. a kind=/rec=: dated-record, an author-dated failed anchor in dated= / its evidence: line|block|title|stamp. a sym=: the symbol the doc names on that file:line; line-moved = that symbol no longer spans the line. more weak=N: w rows of this group withheld; shown_weak + N = its n=; detail=1 lists all. shown_weak=N: w rows printed of n= (cut at 12 a doc, weak_capped=1); detail=1 lists all. w resolves-to=: the indexed symbol spanning that line; not proof it is the one the doc meant. unchecked r=/note=: why n= anchors were not proved, and what was still checked for them. dated r=/note=: the dating mark that moved n= failed anchors into dated= instead of drift=. -->
+<doc-drift schema="ripwire.doc-drift/v1" docs="267" clean="237" anchors="7101" checked="3318" unchecked="3783" drift="79" dated="109" prose="26" corpus="3749" at="0712a5182" next="--doc-drift --detail=1">
+<doc p="docs/research/answer-completeness.md" anchors="187" checked="83" drift="16" dated="0" shown_failed="12" failed_capped="1" failed_total="16">
+<a k="file-line" l="341" c="25" why="line-moved" ref="src/pageview.h:292" sym="pageDisclosure" got="(file scope)" tgt="src/pageview.h:346"/>
+<a k="file-line" l="349" c="99" why="line-moved" ref="src/serialize.h:4169" sym="kForLensDefaultTopN" got="cleanSig" tgt="src/serialize.h:1044"/>
+<a k="file-line" l="353" c="89" why="line-moved" ref="src/serialize.h:4435" sym="kForPayloadBudgetBytes" got="compressBody" tgt="src/serialize.h:933"/>
+<a k="file-line" l="356" c="42" why="line-moved" ref="src/serialize.h:1010" sym="kForFileTailShownCap" got="forSoftRowDropFill" tgt="src/serialize.h:1119"/>
+<a k="file-line" l="358" c="89" why="line-moved" ref="src/serialize.h:5481" sym="kForAnchorBodyBudgetBytes" got="SigsCutReport" tgt="src/serialize.h:1097"/>
+<a k="file-line" l="360" c="88" why="line-moved" ref="src/serialize.h:5800" sym="kForCompactSurfaceBudgetBytes" got="sigsOpenTag" tgt="src/serialize.h:1172"/>
+<a k="file-line" l="366" c="43" why="line-moved" ref="src/serialize.h:6534" sym="kWithGraphNodeCap" got="packSignatures" tgt="src/serialize.h:9223"/>
+<a k="file-line" l="367" c="51" why="line-moved" ref="src/forpage.h:287" sym="kForPageRowsDefault" got="forCandidatePageDoc" tgt="src/forpage.h:60"/>
+<a k="file-line" l="380" c="44" why="line-moved" ref="src/serialize.h:2460" sym="kFillOrderThreshold" got="(file scope)" tgt="src/serialize.h:1512"/>
+<a k="file-line" l="382" c="62" why="line-moved" ref="src/main.cpp:1283" sym="kRecentRows" got="(file scope)" tgt="src/main.cpp:1225"/>
+<a k="file-line" l="399" c="48" why="line-moved" ref="src/serialize.h:5317" sym="kMaxExpandSibs" got="sigLadderDryDrop" tgt="src/serialize.h:7409"/>
+<a k="file-line" l="400" c="50" why="line-moved" ref="src/serialize.h:5342" sym="kMaxExpandIncludes" got="SigLadderOutcome" tgt="src/serialize.h:7418"/>
+<more drift="4"/>
+</doc>
+<doc p="prompts/help-wanted/graph-unit-tests.md" anchors="164" checked="94" drift="8" dated="0">
+<a k="file-line" l="96" c="6" why="range-straddles" ref="src/infra/Diagnostics.h:265-321" got="RW_CHECK_" tgt="src/infra/Diagnostics.h:321"/>
+<a k="file-line" l="99" c="57" why="line-moved" ref="Diagnostics.h:543-550" sym="DISCLOSE" got="(file scope)" tgt="src/infra/Diagnostics.h:616"/>
+<a k="file-line" l="132" c="18" why="range-straddles" ref="src/graph.h:2742-2755" sym="buildGraph" got="jsCallThroughWrittenBinding" tgt="src/graph.h:2755"/>
+<a k="file-line" l="155" c="17" why="line-moved" ref="src/graph.h:3228" sym="biasPrior" got="BuiltinMethodGate" tgt="src/graph.h:11768"/>
+<a k="file-line" l="170" c="3" why="line-moved" ref="src/graph.h:3915" sym="computeImpure" got="Reach" tgt="src/graph.h:13668"/>
+<a k="const" l="301" c="421" why="const-value" ref="maxIterationCount = 90" want="90" got="400" tgt="test/verify_pagerank.cpp:59"/>
+<a k="const" l="301" c="510" why="const-value" ref="maxIterationCount = 89" want="89" got="400" tgt="test/verify_pagerank.cpp:59"/>
+<a k="const" l="303" c="18" why="const-value" ref="maxIterationCount = 1" want="1" got="400" tgt="test/verify_pagerank.cpp:59"/>
+</doc>
+<doc p="CHANGELOG.md" anchors="1538" checked="654" drift="7" dated="10" shown_failed="12" failed_capped="1" failed_total="17">
+<a k="file-line" l="157" c="63" why="past-eof" kind="dated-record" rec="block" ref="src/helper/dev/index.ts:77" got="1 lines" tgt="test/mapinvfix/ts/index.ts"/>
+<a k="file-line" l="722" c="5" why="missing-file" kind="dated-record" rec="block" ref="cmd.c:206"/>
+… [255 more display lines; full output is 25115 bytes on 1 raw line(s)]
+`````
+
+Tail of the same output — the `<gateability>` section:
+
+`````
+<gateability docs="25" projected_drift="0">
+<fix p="docs/research/answer-completeness.md" live="16"/>
+<fix p="prompts/help-wanted/graph-unit-tests.md" live="8"/>
+<fix p="CHANGELOG.md" live="7"/>
+<fix p="test/docdriftfix/NOTES.md" live="7"/>
+<fix p="THIRD_PARTY.md" live="6"/>
+<fix p="README.md" live="5"/>
+<fix p="docs/LSP.md" live="4"/>
+<fix p="prompts/help-wanted/kotlin-scope-functions.md" live="4"/>
+<fix p="CONTRIBUTING.md" live="2"/>
+<fix p="docs/COMMANDS.md" live="2"/>
+<fix p="prompts/help-wanted/uses-qualified-selector.md" live="2"/>
+<fix p="test/docdriftfix/live_notes.md" live="2"/>
+<fix p="test/gateabilityfix/UNDATED.md" live="2"/>
+<fix p="bench/nestcal/r1-2026-08-07/REPORT.md" live="1"/>
+<fix p="changelog.d/ix1-struct-field-slots.md" live="1"/>
+<fix p="docs/EVALS.md" live="1"/>
+<fix p="docs/LINEAGE.md" live="1"/>
+<fix p="docs/OPTREMARKS.md" live="1"/>
+<fix p="prompts/help-wanted/nesting-refusals-visible.md" live="1"/>
+<fix p="prompts/help-wanted/scala-jvm-bridge.md" live="1"/>
+<fix p="prompts/help-wanted/ts-literal-receivers.md" live="1"/>
+<fix p="skills/ripwire-fresh-eyes/SKILL.md" live="1"/>
+<fix p="skills/ripwire-mcp/SKILL.md" live="1"/>
+<fix p="test/docdriftfix/record_line.md" live="1"/>
+`````
+
+## `./build/ripwire . --doc-drift --with-history`
+
+*Same report, with git history splitting stale mentions into deleted-by-commit vs never-existed.*
+
+**wall time: 8.96s**
+
+`````
+<!-- ripwire doc-drift schema=ripwire.doc-drift/v1: markdown anchors that no longer hold: <doc p=> of <a k= l= c= why= ref= want= got= tgt=>; unchecked/dated rows disclose the rest. failed_capped=/weak_capped=: 1 = cut. at=: commit+dirty+shallow. next=: the one pasteable follow-up. docs=N: markdown docs scanned for anchors; docs minus clean = the doc rows. clean=N: docs with no failed anchor (drift and dated 0); not proof every anchor was checked. checked=N: anchors verified against the index; checked + unchecked = anchors. prose=N: value anchors dropped as prose (name not in code); subtracted from anchors=, never checked. corpus=N: files the anchors were checked against (index + config/build exts); 0 = no anchor shape, no scan. drift=/dated=: anchors that no longer hold / anchors skipped as dated (unverifiable by date). unchecked=N: anchors not proved (the unchecked rows give each reason); checked + unchecked = anchors. doc shown_failed=/failed_total=: a rows printed / all failed anchors (drift+dated); cut at 12, detail=1 lifts. a kind=/rec=: dated-record, an author-dated failed anchor in dated= / its evidence: line|block|title|stamp. a sym=: the symbol the doc names on that file:line; line-moved = that symbol no longer spans the line. more weak=N: w rows of this group withheld; shown_weak + N = its n=; detail=1 lists all. shown_weak=N: w rows printed of n= (cut at 12 a doc, weak_capped=1); detail=1 lists all. w resolves-to=: the indexed symbol spanning that line; not proof it is the one the doc meant. unchecked r=/note=: why n= anchors were not proved, and what was still checked for them. dated r=/note=: the dating mark that moved n= failed anchors into dated= instead of drift=. -->
+<doc-drift schema="ripwire.doc-drift/v1" docs="267" clean="242" anchors="7101" checked="3301" unchecked="3800" drift="70" dated="101" prose="26" corpus="3749" at="0712a5182" next="--doc-drift --detail=1">
+<history probed="1" head="0712a5182" commits="4861" removed-names="48741"/>
+<doc p="docs/research/answer-completeness.md" anchors="187" checked="83" drift="16" dated="0" shown_failed="12" failed_capped="1" failed_total="16">
+<a k="file-line" l="341" c="25" why="line-moved" ref="src/pageview.h:292" sym="pageDisclosure" got="(file scope)" tgt="src/pageview.h:346"/>
+<a k="file-line" l="349" c="99" why="line-moved" ref="src/serialize.h:4169" sym="kForLensDefaultTopN" got="cleanSig" tgt="src/serialize.h:1044"/>
+<a k="file-line" l="353" c="89" why="line-moved" ref="src/serialize.h:4435" sym="kForPayloadBudgetBytes" got="compressBody" tgt="src/serialize.h:933"/>
+<a k="file-line" l="356" c="42" why="line-moved" ref="src/serialize.h:1010" sym="kForFileTailShownCap" got="forSoftRowDropFill" tgt="src/serialize.h:1119"/>
+<a k="file-line" l="358" c="89" why="line-moved" ref="src/serialize.h:5481" sym="kForAnchorBodyBudgetBytes" got="SigsCutReport" tgt="src/serialize.h:1097"/>
+<a k="file-line" l="360" c="88" why="line-moved" ref="src/serialize.h:5800" sym="kForCompactSurfaceBudgetBytes" got="sigsOpenTag" tgt="src/serialize.h:1172"/>
+<a k="file-line" l="366" c="43" why="line-moved" ref="src/serialize.h:6534" sym="kWithGraphNodeCap" got="packSignatures" tgt="src/serialize.h:9223"/>
+<a k="file-line" l="367" c="51" why="line-moved" ref="src/forpage.h:287" sym="kForPageRowsDefault" got="forCandidatePageDoc" tgt="src/forpage.h:60"/>
+<a k="file-line" l="380" c="44" why="line-moved" ref="src/serialize.h:2460" sym="kFillOrderThreshold" got="(file scope)" tgt="src/serialize.h:1512"/>
+<a k="file-line" l="382" c="62" why="line-moved" ref="src/main.cpp:1283" sym="kRecentRows" got="(file scope)" tgt="src/main.cpp:1225"/>
+<a k="file-line" l="399" c="48" why="line-moved" ref="src/serialize.h:5317" sym="kMaxExpandSibs" got="sigLadderDryDrop" tgt="src/serialize.h:7409"/>
+<a k="file-line" l="400" c="50" why="line-moved" ref="src/serialize.h:5342" sym="kMaxExpandIncludes" got="SigLadderOutcome" tgt="src/serialize.h:7418"/>
+<more drift="4"/>
+</doc>
+<doc p="prompts/help-wanted/graph-unit-tests.md" anchors="164" checked="94" drift="8" dated="0">
+<a k="file-line" l="96" c="6" why="range-straddles" ref="src/infra/Diagnostics.h:265-321" got="RW_CHECK_" tgt="src/infra/Diagnostics.h:321"/>
+<a k="file-line" l="99" c="57" why="line-moved" ref="Diagnostics.h:543-550" sym="DISCLOSE" got="(file scope)" tgt="src/infra/Diagnostics.h:616"/>
+<a k="file-line" l="132" c="18" why="range-straddles" ref="src/graph.h:2742-2755" sym="buildGraph" got="jsCallThroughWrittenBinding" tgt="src/graph.h:2755"/>
+<a k="file-line" l="155" c="17" why="line-moved" ref="src/graph.h:3228" sym="biasPrior" got="BuiltinMethodGate" tgt="src/graph.h:11768"/>
+<a k="file-line" l="170" c="3" why="line-moved" ref="src/graph.h:3915" sym="computeImpure" got="Reach" tgt="src/graph.h:13668"/>
+<a k="const" l="301" c="421" why="const-value" ref="maxIterationCount = 90" want="90" got="400" tgt="test/verify_pagerank.cpp:59"/>
+<a k="const" l="301" c="510" why="const-value" ref="maxIterationCount = 89" want="89" got="400" tgt="test/verify_pagerank.cpp:59"/>
+<a k="const" l="303" c="18" why="const-value" ref="maxIterationCount = 1" want="1" got="400" tgt="test/verify_pagerank.cpp:59"/>
+</doc>
+<doc p="test/docdriftfix/NOTES.md" anchors="30" checked="21" drift="7" dated="0">
+<a k="file-line" l="9" c="64" why="line-moved" ref="code.h:23" sym="stableHelper" got="movedHelper" tgt="test/docdriftfix/code.h:17"/>
+… [208 more display lines; full output is 23839 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --from-trace=-`
+
+*Map a pasted stack trace onto indexed symbols. CHANGED: in_corpus= now reports the real count (was 0).*
+
+**wall time: 2.44s**
+
+Input file:
+
+`````
+AddressSanitizer:DEADLYSIGNAL
+=================================================================
+==41337==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000018 (pc 0x000102f4a1c8 bp 0x00016d2f1a40 sp 0x00016d2f19e0 T0)
+    #0 0x102f4a1c8 in rw::rankGraphTeleport(Graph const&, std::vector<float> const&, float) src/graph.h:11811
+    #1 0x102f3e884 in rw::rankGraph(Graph const&, float) src/graph.h:11852
+    #2 0x102e11f30 in runDefaultMap(MainDispatch const&) src/main.cpp:1753
+    #3 0x102e01a44 in main src/main.cpp:4174
+    #4 0x1a2b3c0dc in start+0x9dc (dyld:arm64e+0x60dc)
+==41337==ABORTING
+`````
+
+`````
+<ctx schema="ripwire.from-trace/v1" task="&lt;stdin&gt;" next="--slice=@src/graph.h:11811" est_tokens="1967">
+<!-- ripwire from-trace schema=ripwire.from-trace/v1: trace frames mapped to indexed symbols, innermost first; the innermost in-corpus body included. window: shown= total= capped= (capped=1 cut). est_tokens=: price as emitted (an upper bound under compact). <d r=N>: rank N in this ranking, rows in r= order. <d cx= ccx=>: cyclomatic/cognitive complexity. <d in=N>: N callers in the index (absent: not measured). sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. next=: the one pasteable follow-up. task=: the trace source this bundle maps, verbatim (a file path, stdin, or an MCP label). src=/format=: the trace read and its dominant frame format, python|asan|node|compiler|generic. frame_lines=/parsed=: frame-shaped input lines / those yielding a path:line; the rest matched no format. in_corpus=: parsed frames in indexed files; always suspects= + merged= + unresolved=. suspects=/merged=/unresolved=: frame rows / folded into a claimed symbol / unresolved rows (indexed file, no def). skipped=N: frames outside every root, listed as skipped rows, never ranked. rank=N: frame order, innermost in-corpus first; p= is the trace's own path:line, defs are sigs l=. resolved_by=name|line: bound by the frame's own name, else by the def enclosing its line. innermost=1: the innermost in-corpus frame (rank 1); its full body is served. -->
+<!-- ledger: budget=7500 bytes (allowance 9583 bytes = ceiling + the single-entry overshoot a whole first signature costs) -->
+<trace src="&lt;stdin&gt;" format="asan" frame_lines="5" parsed="4" in_corpus="4" skipped="0" merged="0" unresolved="0" suspects="4">
+<frame rank="1" n="rankGraphTeleport" t="fn" p="src/graph.h:11811" resolved_by="name" innermost="1"/>
+<frame rank="2" n="rankGraph" t="fn" p="src/graph.h:11852" resolved_by="name"/>
+<frame rank="3" n="runDefaultMap" t="fn" p="src/main.cpp:1753" resolved_by="name"/>
+<frame rank="4" n="main" t="fn" p="src/main.cpp:4174" resolved_by="name"/>
+</trace>
+<sigs>
+<d l="11809" n="rankGraphTeleport" sc="rw" p="src/graph.h" cx="5" ccx="8" in="7" r="1" next="--expand=src/graph.h:rankGraphTeleport">
+<doc>PageRank with an explicit teleport / personalization vector p (Σp = 1). The prior is name-quality-biased through biasPrior() so all rank modes share one weighting seam; the transition matrix (edges</doc>inline RankedGraph rankGraphTeleport( const Graph&amp; g, const std::vector&lt;float&gt;&am … [line truncated: 31 more bytes on this line]
+<d l="11850" n="rankGraph" sc="rw" p="src/graph.h" cx="2" ccx="1" in="10" r="2">
+<doc>uniform-teleport PageRank (the default</doc>inline RankedGraph rankGraph( const Graph&amp; g, float alpha = 0.85f )</d>
+<d l="1751" n="runDefaultMap" p="src/main.cpp" cx="224" ccx="313" in="1" r="3">int runDefaultMap( const MainDispatch&amp; d )</d>
+<d l="4172" n="main" p="src/main.cpp" cx="17" ccx="20" in="0" r="4">int main( int argc, char** argv )</d>
+</sigs>
+<bodies shown="1" total="1" capped="0">
+<b t="fn" l="11809" p="src/graph.h" n="rankGraphTeleport">
+<![CDATA[inline RankedGraph rankGraphTeleport( const Graph& g, const std::vector<float>& p, float alpha = 0.85f )
+{
+    PROFILE_SCOPE_DESCRIBE( "rankGraph: PageRank (power iteration)" );
+    const std::vector<float> pw = biasPrior( g, p );
+    const std::size_t N = pw.size();
+    std::vector<double> teleport( pw.begin(), pw.end() );
+    std::vector<double> rankDouble( N, 0.0 );
+    PageRankRun         run{};   // an N == 0 graph never enters the kernel: { 0, converged } — see PageRankRun
+    if( N )
+    {
+        double teleportMass = 0.0;
+… [18 more display lines; full output is 4915 bytes on 29 raw line(s)]
+`````
+
+## `./build/ripwire . --notes`
+
+*List all field notes (write-side memory) — the committed .ripwire_notes at the repo root, each with the sha/branch it was recorded at.*
+
+**wall time: 1.51s**
+
+`````
+<ctx schema="ripwire.notes/v1">
+<!-- ripwire notes schema=ripwire.notes/v1: field notes by target: <target id= dangling=> holds <note d= sha= branch=>; the kept count comment: notes= rows, targets= <target> rows, dangling= targets matching nothing indexed (listed, surfaced nowhere). dangling=1: matches nothing indexed. -->
+<!-- notes=2 targets=2 dangling=0 -->
+<notes>
+<target id="src/infra/Diagnostics.h" dangling="0">
+<note d="2026-09-12" sha="42b7c8d" branch="lane/noalias-docs">
+<![CDATA[ASSUME_NO_ALIAS is an optimizer fact in release (separate_storage) only where the compiler consumes it: clang 18+ by default, LLVM 17/AppleClang 16 via the CMake -mllvm flag (scalars only), GCC never (debug check only); never on two members of one object; ASSUME_NO_ALIAS_BUF for OWNING cont … [line truncated: 22 more bytes on this line]
+</note>
+</target>
+<target id="test/manifestcheck.sh" dangling="0">
+<note d="2026-08-23" sha="42634f5" branch="claude/fervent-volhard-ddfd9f">
+<![CDATA[README.md's single '<N> gate scripts' claim (~line 1305) is NOT enforced — the derived-vs-stated sibling loop here covers docs/EVALS.md only. It drifted 407→451 unnoticed (fixed 2026-08-23). To close: grep both files ('file:line:' parsing) in the gateCountClaims arm.]]>
+</note>
+</target>
+</notes>
+</ctx>
+`````
+
+## `./build/ripwire . --pack-task="add a new output format flag to the CLI"`
+
+*ONE budget-shared bundle: ranking + top bodies + caller sigs + notes + tests_to_run. CHANGED: <d> rows now carry n=/id=.*
+
+**wall time: 2.60s**
+
+`````
+<ctx schema="ripwire.pack-task/v1" task="add a new output format flag to the CLI" route="subtoken+body:declined(add;156-carriers,57-defs)" root="." est_tokens="4187" budget_tokens="6000">
+<!-- ripwire pack-task schema=ripwire.pack-task/v1: one-call task bundle for task= under budget_tokens=: <sigs>
+<d n= sc= l= p=> ranking, <far>
+<s t= n= p=> ranked but over 1 hop out (of_top= ranked rows) > <bodies>
+<b t= n= p= l=> with <calls>
+<c n= l=> callees > <callers>
+<s rel=caller|callee shared=> 1-hop from the bodies (of_top= bodies; shared= bodies reached, absent at 1) > notes > <tests>
+<test p= run=> (run= when derivable). window: shown= total= capped= (capped=1 cut). est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. <d r=N>: rank N in this ranking, rows in r= order. <d cx= ccx=>: cyclomatic/cognitive complexity. <d in=N>: N callers in the ind … [line truncated: 384 more bytes on this line]
+<!-- ledger: budget=12744 bytes (6000-token target, ceiling 14160) | ranking: full | bodies: kept 5 of 6 (capped) | callers: 20 of 20 | notes: none | tests: none | far: 6 of 6 -->
+<sigs>
+<d l="3088" n="printUsage" sc="rw" p="src/cli.h" cx="1" ccx="0" in="1" r="1" next="--expand=src/cli.h:printUsage">
+<doc>Print the authoritative CLI usage and flag catalog to the caller-provided output stream</doc>inline void printUsage( std::FILE* out ) noexcept</d>
+<d l="459" n="wrapCliAddPost" sc="rw" p="src/wrap.h" cx="4" ccx="2" in="1" r="2">
+<doc>claude&apos;s `mcp add … -- ripwire --mcp`: the flag goes on the end of that command line, ahead of its newline</doc>inline std::string wrapCliAddPost( const AgentTarget&amp; row, std::string_view toolsArg )</d>
+<d l="699" n="wrapEmitCliFirst" sc="rw" p="src/wrap.h" cx="10" ccx="5" in="1" r="3">
+<doc>ONE recipe path for every agent that can shell out, and the point is that the RECOMMENDATION does not vary by agent — only the MCP alternative does. Before this there were four near-identical CLI-fi</doc>inline void wrapEmitCliFirst( const AgentTarget&amp; row, const std::string&amp; token, c … [line truncated: 83 more bytes on this line]
+<d l="442" n="wrapWritesToolsArg" sc="rw" p="src/wrap.h" cx="6" ccx="1" in="2" r="4">
+<doc>mcp-tools pass-through. Written into the server command only where its argument shape is known to be one more plain argument: the JSON args arrays (cursor/windsurf/gemini), opencode&apos;s command array</doc>inline bool wrapWritesToolsArg( const AgentTarget&amp; row ) noexcept</d>
+<d l="190" n="callHierarchyPageNext" sc="rw" p="src/nextverb.h" cx="4" ccx="3" in="4" r="5">
+<doc>L8 (train 29): the NEXT PAGE of a callers listing — the CLI --callers root&apos;s next=, find_referencing_symbols&apos; next and find_symbol&apos;s calledBy_next all name this one call, so the three cannot spell t</doc>inline std::string callHierarchyPageNext( bool wantCallers, std::string_vi … [line truncated: 98 more bytes on this line]
+<d l="1828" n="classNewGroupXml" sc="rw" p="src/testmap.h" cx="8" ccx="11" in="1" r="6">inline std::string classNewGroupXml( const IngestResult&amp; ing, std::span&lt;const ClassNewRow&gt; rows, std::string_view rootPrefix, EscapeFn ex )</d>
+<far of_top="12" shown="6" total="6" capped="0">
+<s t="fn" n="toUint" p="src/tracein.h:103"/>
+<s t="cls" n="AgentTarget" p="src/wrap.h:110"/>
+<s t="var" n="kJsonShapeModifiers" p="src/main.cpp:3536"/>
+<s t="fn" n="cliRefusesFileList" p="src/situ.h:213"/>
+<s t="cls" n="McpValueSpec" p="src/mcprefusal.h:268"/>
+<s t="var" n="kInRideAlong" p="src/main.cpp:3367"/>
+</far>
+</sigs>
+… [67 more display lines; full output is 12092 bytes on 59 raw line(s)]
+`````
+
+## `./build/ripwire . --pack-task="add a new output format flag to the CLI" --partition=3`
+
+*Fan-out form: one shared core + 3 per-agent slices carved along call-graph communities.*
+
+**wall time: 2.22s**
+
+`````
+<ctx-partitions schema="ripwire.pack-task/v1" partitions="3" requested="3" core_symbols="6" surface="42" modules="16" split="0" budget_per_agent_tokens="6000" core_budget_tokens="2040" partition_budget_tokens="3960" total_bytes="21930" overlap_mean="0.011" overlap_max="0.033" shared_symbols="2" unio … [line truncated: 36 more bytes on this line]
+<!-- ripwire pack-task schema=ripwire.pack-task/v1: N minimally overlapping agent bundles carved along call-graph communities plus one shared core; each <bundle> wraps a <ctx>; bundle role=core|partition i= symbols= modules= bytes= tokens=: one agent's ctx, symbols= ids assigned, bytes= its size; tokens= = est_tokens= = bytes/2.36 (flat, the densest rate; the inner ctx est_tokens= is language-weighted). Inner ctx task= root= budget_tokens= dropped_positive=: the task, p= base, the slice's token target, ranked candidates its budget cut. of_top=: rows ranked (far) / bodies (callers); s rel=caller|callee shared=: 1-hop edge, bodies reached (absent at 1). window: shown= total= capped= (capped=1 cut). run_unknown=1: no runner derivable (a guess would be worse). est_tokens=: price as emitted (an upper bound under compact). <d r=N>: rank N in this ranking, rows in r= order. <d cx= ccx=>: cyclomatic/cognitive complexity. <d in=N>: N callers in the index (absent: not measured). route=: the ranker: name-exact(X) = the task names symbol X (anchors: its evidence), subtoken+body = conceptual BM25 (:broad = 1-2 plain words, plain rg may also win; :declined(...) = a name hit refused as a common name). sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. next=: the one pasteable follow-up. pure=1: const/constexpr signature (Swift: non-mutating) and no transitive side effect found; a hint. partitions=/requested=: partitions carved / asked for. modules=/split=: call-graph groups found / cuts forced to split one. core_symbols=/surface=: ids in the shared core / core plus the assignable remainder. budget_per_agent_tokens=: one agent's budget, core_budget_tokens= plus partition_budget_tokens=. total_bytes=N: bytes of all bundles together. overlap_mean=/overlap_max=: pairwise Jaccard over the ids partitions name, before trimming. shared_symbols=/union_symbols=: ids two or more partitions name / ids any partition names. core_overlap=: share of the core surface a partition reaches anyway. layer=: built-in arch layer (game|infra|render|math|audio|ai|test) from a dir name in p=; absent if none. -->
+<bundle role="core" symbols="6" bytes="2899" tokens="1228" est_tokens="1228">
+<ctx task="add a new output format flag to the CLI" route="subtoken+body:declined(add;156-carriers,57-defs)" root="." dropped_positive="2" est_tokens="1002" budget_tokens="2040">
+<!-- slice budget=4332 bytes (2040-token target, ceiling 4814) | ranking: capped | bodies: kept 2 of 6 (capped) | callers: kept 1 of 20 | notes: none | tests: none | far: none -->
+<sigs shown="4" total="6" capped="1">
+<d l="3088" n="printUsage" sc="rw" p="src/cli.h" cx="1" ccx="0" in="1" r="1" next="--expand=src/cli.h:printUsage">
+<doc>Print the authoritative CLI usage and flag catalog to the caller-provided output stream</doc>inline void printUsage( std::FILE* out ) noexcept</d>
+<d l="459" n="wrapCliAddPost" sc="rw" p="src/wrap.h" cx="4" ccx="2" in="1" r="2">
+<doc>claude&apos;s `mcp add … -- ripwire --mcp`: the flag goes on the end of that command line, ahead of…</doc>inline std::string wrapCliAddPost( const AgentTarget&amp; row, std::string_view toolsArg )</d>
+<d l="699" n="wrapEmitCliFirst" sc="rw" p="src/wrap.h" cx="10" ccx="5" in="1" r="3">
+<doc>ONE recipe path for every agent that can shell out, and the point is that the RECOMMENDATION doe…</doc>inline void wrapEmitCliFirst( const AgentTarget&amp; row, const std::string&amp; token, const std::string_view executablePath, const WrapListing&amp; listing ) noexcept</d>
+<d l="442" n="wrapWritesToolsArg" sc="rw" p="src/wrap.h" cx="6" ccx="1" in="2" r="4">
+<doc>mcp-tools pass-through. Written into the server command only where its argument shape is known t…</doc>inline bool wrapWritesToolsArg( const AgentTarget&amp; row ) noexcept</d>
+</sigs>
+<bodies shown="2" total="6" capped="1">
+<b t="fn" l="3088" p="src/cli.h" n="printUsage">
+<![CDATA[inline void printUsage( std::FILE* out ) noexcept { printUsageTier( out, HelpTier::Full, {} ); }]]>
+<calls total="1">
+<c n="printUsageTier" l="3078">inline bool printUsageTier( std::FILE* out, HelpTier tier, std::string_view want ) noexcept</c>
+</calls>
+</b>
+<b t="fn" l="459" p="src/wrap.h" n="wrapCliAddPost">
+<![CDATA[inline std::string wrapCliAddPost( const AgentTarget& row, std::string_view toolsArg )
+{
+    std::string post( row.mcpAddPost );
+    if( !toolsArg.empty() && wrapWritesToolsArg( row ) && post.ends_with( '\n' ) )
+    {
+        post.insert( post.size() - 1, " " + std::string( toolsArg ) );
+    }
+… [117 more display lines; full output is 24851 bytes on 124 raw line(s)]
+`````
+
+## `./build/ripwire . --for="pagerank power iteration" --with-graph`
+
+*Task lens + a compact Mermaid flowchart of the top anchors' 1-hop edges.*
+
+**wall time: 9.46s**
+
+`````
+<ctx task="pagerank power iteration" route="subtoken+body" root="." confidence="high" margin_pct="22" at="0712a5182" doc_mentions="5" schema="ripwire.for/v1" bundle="compact" bodies="0" reason="compact-route" budget_bytes="7500" doc_mentions_capped="1" doc_mentions_total="16" est_tokens="7617">
+<!-- ripwire for schema=ripwire.for/v1: bundle=/bodies=/reason= the body posture; d: cx= ccx= complexity, in= callers (absent cx/ccx/in = 0), churn= amp= change, clone= tested= 1, sc= scope, id=p::sc::n; total= shown= capped=1 if cut; task= the query; d pure=1 const/constexpr sig, next= the follow-up to paste; route= name-exact(X)|subtoken+body[:broad|:declined]; confidence=/margin_pct= head score drop (low=flat); h l= p= n=, c n= l= (joined for same-named callees, shown= counts them), noedge= no callee resolved; fold kind=bodies: b t= n= p= l= top ranked rows' whole bodies, not the answer; served= of total= in budget_bytes=; slice/skip p= n= l=; slice members= of=: a big class's ctor, question-word members; skip bytes= next=; a skip makes sigs next= it, sigs_next= the signatures-only re-call; d mem= an owner's direct member names by the index (question words first, names only), mem_more= names cut; t p= file outside sigs (weaker), t sym= its top symbols (a pointer, not the answer), r= rank (gap = trimmed); field name= type= owner= rel=: a member of owner=, rel=creates held by value, uses by reference/pointer; d layer=: built-in arch layer (game|infra|render|math|audio|ai|test) from a dir name in p=; d e= its last line (absent=unknown, never 0; l= the name's line); c prov=split: a resolver split arm; may be another arm's (NOT a claim the edge is false) [doc mentions: 5 docs, 3 symbols; doc_mentions=] -->
+<!-- root= is the crawl root; p= below is RELATIVE to it (single-root only; absent => p= is ingest's own path, unchanged); at=this commit(+dirty). [budget_bytes= is the default BYTE target this ranked payload was shaped toward: row text shortens toward it, no row of the ranked head is removed for it (sigs past_target=)] [sigs capped=1 with shown=total: rows shrunk, none dropped] [sigs past_target=K: the last K rows are past the budget_bytes target, served because they are rows of the ranked head; none is cut] [sigs sigs_next=: one call serving all total= rows uncut] [docs_dropped=N: N shown rows have a doc comment not printed (r>24 always, r5..24 if capped)] [docs_after_code=N: N doc rows of the shown set moved below its code rows; same rows, reordered, none added or removed; a question naming docs keeps score order] [files_first=N: N rows moved so r=1..8 are distinct files' best rows, score order, a repeated name once; same rows; fold, hops keep score order] [cut: doc_mentions_capped="1" doc_mentions_total="16" — an indexing cap dropped content not shown here]; lego/compose collapse to a counted stub by default (a disclosed cut): total= that section's own pre-cap row count, shown="0" capped="1" (nothing rendered here), next= names the sections=lego,compose flag that restores both sections byte-identically in one call est_tokens= prices this bundle in tokens -->
+<sigs shown="40" total="40" capped="1" past_target="14" docs_dropped="23" docs_after_code="6" files_first="6" sigs_next="--for=&apos;pagerank power iteration&apos; --signatures-only --token-budget=6200" next="--expand=src/prconverge.h:73:renderDisclosure">
+<d l="422" e="422" n="kScoreTieAbsEps" sc="rw" p="src/eval.h" churn="18" amp="51" pure="1" r="1" next="--expand=src/eval.h:kScoreTieAbsEps">
+<doc>NodeId order. Renumbering an otherwise-identical graph (the exact &quot;same probe file, different so…</doc>inline constexpr float kScoreTieAbsEps = 1e-6f</d>
+<d l="73" e="144" n="renderDisclosure" sc="rw" p="src/prconverge.h" cx="12" ccx="15" in="14" churn="3" amp="41" r="2">
+<doc>Render one form of the disclosure. Empty string whenever there is nothing to say — no power it…</doc>inline std::string renderDisclosure( const RankDisclosure&amp; d, DiscloseAs as )</d>
+<d l="99" e="206" n="pageRankDouble" sc="rw" p="src/pagerank.cpp" cx="19" ccx="34" in="2" churn="14" amp="44" tested="1" r="3">
+<doc>The PageRank power iteration itself — the numeric kernel every ranked document&apos;s order comes f…</doc>PageRankRun pageRankDouble( const sparseCsr&lt;float&gt;&amp; inEdges, std::span&lt;const double&gt; weightedOutDegree, std::span&lt;const double&gt; teleport, std::span&lt;double&gt; r … [line truncated: 10 more bytes on this line]
+<d l="480" e="526" n="rankByText" sc="rw" p="src/mcpverbs.h" cx="11" ccx="19" in="1" churn="466" amp="552" r="4">inline std::string rankByText( const std::string&amp; root, std::string_view mode, int topK, bool stable = false )</d>
+<d l="11800" e="11805" n="RankedGraph" sc="RankedGraph" p="src/graph.h" churn="473" amp="675" r="5">struct RankedGraph</d>
+<d l="2385" e="2389" n="kChurnRankLegend" sc="rw" p="src/serialize.h" churn="413" amp="525" pure="1" r="6">inline constexpr const char* kChurnRankLegend = &quot;&lt;!-- rank_by=churn: k= is PageRank re-run with the teleport BIASED by git CHANGE-FREQUENCY over window= &quot; &quot;(a c…</d>
+<d l="1372" e="1393" n="sliceRdIterationCeiling" sc="slicev" p="src/slice.h" cx="9" ccx="12" in="1" churn="51" amp="103" r="7">inline std::uint32_t sliceRdIterationCeiling() noexcept</d>
+<d l="31" e="44" n="PageRankRun" sc="PageRankRun" p="src/pagerank.h" churn="8" amp="37" r="8" mem="disclose">struct PageRankRun</d>
+<d l="51" e="56" n="RankDisclosure" sc="RankDisclosure" p="src/prconverge.h" churn="3" amp="27" r="9">
+<doc>What a ranked document discloses about the power iteration that ordered it. `isPageRank == false…</doc>struct RankDisclosure</d>
+<d l="13772" e="13781" n="navRelevanceWeight" sc="rw" p="src/graph.h" cx="2" ccx="1" in="2" churn="473" amp="677" r="10">inline std::uint32_t navRelevanceWeight( const Graph&amp; g, NodeId n ) noexcept</d>
+<d l="11809" e="11837" n="rankGraphTeleport" sc="rw" p="src/graph.h" cx="5" ccx="8" in="7" churn="473" amp="682" r="11">inline RankedGraph rankGraphTeleport( const Graph&amp; g, const std::vector&lt;float&gt;&amp; p, float alpha = 0.85f )</d>
+<d l="1247" e="1247" n="kPowerShellPathPrependScope" sc="rw::oswin" p="src/infra/os_win32_logic.h" layer="infra" churn="20" amp="50" pure="1" r="12">inline constexpr std::string_view kPowerShellPathPrependScope = &quot;in PowerShell, for this window</d>
+<d l="1241" e="1246" n="powerShellPathPrependHint" sc="rw::oswin" p="src/infra/os_win32_logic.h" layer="infra" cx="1" in="4" churn="20" amp="54" tested="1" r="13">inline std::string powerShellPathPrependHint( std::string_view programDir ) noexcept</d>
+<d l="1207" e="1231" n="powerShellSingleQuote" sc="rw::oswin" p="src/infra/os_win32_logic.h" layer="infra" cx="8" ccx="6" in="2" churn="20" amp="52" tested="1" r="14">inline std::string powerShellSingleQuote( std::string_view s ) noexcept</d>
+<d l="1051" e="1051" n="path_prepend_hint" sc="rw::os" p="src/infra/os.h" layer="infra" cx="1" in="1" churn="31" amp="71" r="15">inline std::string path_prepend_hint( std::string_view dir )</d>
+<d l="58" e="89" n="HOT_FILES" p="scripts/optremarks.py" churn="14" amp="69" r="16">HOT_FILES = ( &quot;src/pagerank.cpp&quot;, # the power-iteration loop — G2&apos;s no-allocation scope &quot;src/infra/radixSort.h&quot;, # LSD radix entry points &quot;src/infra/radixSort.inl&quot;, # the counting … [line truncated: 76 more bytes on this line]
+<d l="2198" e="2206" n="dynamic_map::leftmost_leaf" p="src/infra/dynamic_map.hpp" layer="infra" cx="2" ccx="1" in="7" churn="7" amp="38" pure="1" r="17">handle_t leftmost_leaf() const</d>
+<d l="1402" e="1418" n="discloseUniformChurnFallback" p="src/main.cpp" cx="3" ccx="2" in="2" churn="453" amp="580" r="18">inline void discloseUniformChurnFallback( bool hasChurnEvidence, bool stubbed, const char* verbLabel, const std::string&amp; windowStamp )</d>
+<d l="293" e="298" n="doctorPathPrependLine" p="src/verbs_doctor.h" cx="2" ccx="1" in="2" churn="45" amp="130" r="19">inline std::string doctorPathPrependLine( const std::string&amp; selfPath )</d>
+<d l="235" e="243" n="doctorWhichRipwire" p="src/verbs_doctor.h" cx="3" ccx="2" in="1" churn="45" amp="129" r="20">inline std::string doctorWhichRipwire( rw::os::stat_t&amp; st )</d>
+<d l="54" e="75" n="testIterationCeiling" p="src/pagerank.cpp" cx="7" ccx="9" in="1" churn="14" amp="43" tested="1" r="21">std::uint32_t testIterationCeiling() noexcept</d>
+<d l="2325" e="2339" n="rankByLegendFor" sc="rw" p="src/serialize.h" cx="4" ccx="4" in="1" churn="413" amp="526" r="22">inline const char* rankByLegendFor( const char* label ) noexcept</d>
+… [124 more display lines; full output is 19081 bytes on 10 raw line(s)]
+`````
+
+## `./build/ripwire . --export=cc.json:<scratch>/aux/ripwire2.cc.json`
+
+*Per-file metrics as CodeCharta cc.json.*
+
+**wall time: 6.36s**
+
+`````
+(empty)
+`````
+
+Artifact written:
+
+`````
+  563192 <scratch>/aux/ripwire2.cc.json
+{"projectName":"project","apiVersion":"1.3","attributeDescriptors":{"loc":{"title":"Lines of Code","description":"Physical line count","direction":-1},"symbols":{"title":"Symbols","description":"Definitions in the file","direction":-1},"cx":{"title":"Cyclomatic Complexity","description":"Sum of per-symbol cyclomatic complexity","direction":-1},"cognitive_cx":{"title":"Cognitive Complexity","descri
+`````
+
+## `./build/ripwire . --batch=<scratch>/aux/batch2.txt`
+
+*One-turn sweep: 4 newline-delimited verb:arg sub-queries answered in ONE deduped <batch>.*
+
+**wall time: 11.27s**
+
+Input file:
+
+`````
+for:incremental cache invalidation
+callers:rankGraphTeleport
+grep:DISCLOSE
+lego:Vehicle
+`````
+
+`````
+<batch schema="ripwire.batch/v1" n="4" requested="4" cap="16">
+<!-- ripwire batch schema=ripwire.batch/v1: n= read sub-queries in one sweep (requested=, cap=): each <q> wraps one sub-answer verbatim in CDATA. i=/verb=/ok=: sub-query index, its verb text, 1 answered (payload in CDATA) or 0 failed. -->
+<q i="0" verb="for" ok="1">
+<![CDATA[<ctx task="incremental cache invalidation" route="subtoken+body" root="." confidence="high" margin_pct="22" at="0712a5182" doc_mentions="5" doc_mentions_capped="1" doc_mentions_total="7" bundle="sigs" lens="churn,amp,tested" budget_bytes="7500" est_tokens="7136">
+<!-- ripwire lens for "incremental cache invalidation" [doc mentions: 5 docs discussing 3 top-ranked symbols surfaced; doc_mentions= on the root repeats the doc count] [cut: doc_mentions_capped="1" doc_mentions_total="7" — an indexing cap dropped content not shown here]: reusable building blocks (cx=complexity, in=reuse-count; an absent cx/ccx/in is 0) — prefer composing/reusing these over reimplementing; sc=scope (full id p::sc::n); route= name-exact(X)|subtoken+body[:broad|:declined]; bundle=sigs: signatures only in this bundle, no inline bodies — fetch a symbol's full body with the fetch_body verb [confidence= derives from the ranked head's largest relative score drop (margin_pct=, whole percent, 0 = none; the same gap the adaptive flag cuts at). low = flat ranking: treat the set as a starting point, not an answer]; lens="churn,amp,tested": the three per-row quality columns the CLI for lens carries and this dialect does NOT (they need a git and a quality pass this server does not run per request); an absent column here means NOT MEASURED, never measured-and-zero; est_tokens= prices this bundle in tokens; tail: file-grain rows, WEAKER evidence than the ranked rows: first the positive-score files NOT among the shown sigs rows, the files of trimmed rows first, best-symbol rank order; then the file page's first 40 rows not listed above, file-first (the IDF share of the query's subtokens its top 8 symbols cover); sym= its top symbols by lens rank (a pointer, not the answer); total=every positive-score file, shown=printed, capped=1 when they differ, next= the page from its first unprinted row. r= on a ranked row is its 1-based rank in this lens ranking, rows in r= order, p= the file (a gap = a budget-trimmed row); e= on a d row: the 1-based line where that definition ends, body-inclusive; absent when the extent is not known (extent_suspect, docs, config), never 0; l= is the line of the definition's name, so a definition can start above l=; lego/compose collapse to a counted stub by default (a disclosed cut): total= that section's own pre-cap row count, shown="0" capped="1" (nothing rendered here), next= names the sections=lego,compose flag that restores both sections byte-identically in one call -->
+<!-- root= is the crawl root; p= below is RELATIVE to it (single-root only; absent => p= is ingest's own path, unchanged); at=this commit(+dirty). [budget_bytes= is the default BYTE target this ranked payload was shaped toward: row text shortens toward it, no row of the ranked head is removed for it (sigs past_target=)] [sigs capped=1 with shown=total: rows shrunk, none dropped] [sigs past_target=K: the last K rows are past the budget_bytes target, served because they are rows of the ranked head; none is cut] [sigs next_budget_tokens=: call this tool again with that budget_tokens to get all total= rows uncut] [docs_dropped=N: N shown rows have a doc comment not printed (r>24 always, r5..24 if capped)] [docs_after_code=N: N doc rows of the shown set moved below its code rows; same rows, reordered, none added or removed; a question naming docs keeps score order] [files_first=N: N rows moved so r=1..8 are distinct files' best rows, score order, a repeated name once; same rows; fold, hops keep score order] -->
+<!-- <d cx= ccx=>: cyclomatic/cognitive complexity. pure=1: const/constexpr signature (Swift: non-mutating) and no transitive side effect found; a hint. task=: the trace source this bundle maps, verbatim (a file path, stdin, or an MCP label). layer=: built-in arch layer (game|infra|render|math|audio|ai|test) from a dir name in p=; absent if none. -->
+<sigs shown="40" total="40" capped="1" past_target="11" docs_dropped="13" docs_after_code="1" files_first="9" next_budget_tokens="5600">
+<d l="136" e="136" n="kCacheMagic" p="src/ingest_cache.h" pure="1" r="1" next="--expand=src/ingest_cache.h:kCacheMagic">
+<doc>incremental cache (--cache): per-file content hash + raw facts so a re-run re-parses ONLY      c…</doc>constexpr std::uint32_t kCacheMagic = 0x4b505443</d>
+<d l="1635" e="1640" n="spanTierMemoPath" sc="rw" p="src/ingest_astquery.h" cx="1" in="3" r="2">
+<doc>Composed exactly the way every OTHER blob family is (quality.h): one fixed-width identity hex pe…</doc>inline std::string spanTierMemoPath( const std::string&amp; diskPath )</d>
+<d l="277" e="306" n="ingestCommitTree" sc="rw::dmm" p="src/dmm.h" cx="6" ccx="5" in="1" r="3">
+<doc>Ingest the tree at `sha`, materialized out of `root`&apos;s object store. The HEAD side reuses the SA…</doc>inline bool ingestCommitTree( const std::string&amp; root, const std::string&amp; sha, const std::vector&lt;std::string&gt;&amp; excludes, std::size_t maxFileBytes, IngestResult&amp;… … [line truncated: 4 more bytes on this line]
+<d l="891" e="894" n="mcpRefreshedThisRequest" sc="rw" p="src/mcpindex.h" cx="1" in="2" r="4">
+<doc>P1-15 — the `_reingest` envelope field for a response whose handling ran an INCREMENTAL pass, …</doc>inline bool mcpRefreshedThisRequest( std::uint64_t passesAtEntry )</d>
+<d l="1797" e="1808" n="FileHealth" sc="FileHealth" p="src/model.h" r="5">struct FileHealth</d>
+<d l="9428" e="9459" n="legoImplementorsOnSurface" sc="rw" p="src/serialize.h" cx="10" ccx="13" in="2" r="6">inline std::vector&lt;std::vector&lt;NodeId&gt;&gt; legoImplementorsOnSurface( const IngestResult&amp; ing, const std::vector&lt;std::vector&lt;NodeId&gt;&gt;&amp; implementors, const std::ve … [line truncated: 8 more bytes on this line]
+<d l="4436" e="4544" n="computeHeadSnapshot" sc="quality" p="src/quality.h" cx="19" ccx="21" in="3" r="7">inline std::pair&lt;Snapshot, bool&gt; computeHeadSnapshot( const std::string&amp; root, const std::string_view* cacheNever = nullptr, std::size_t maxFileBytes = kDefault…</d>
+<d l="762" e="959" n="runParsePool" p="src/ingest_parsepool.h" cx="25" ccx="54" in="1" r="8">inline RawFacts runParsePool( IngestResult&amp; result, const char* rootDir, std::string_view cacheFile, bool captureValueUses, HashMap&lt;std::string, FileFacts&gt;&amp; cache, const CacheLoadStats&amp; cac … [line truncated: 66 more bytes on this line]
+<d l="767" e="774" n="mcpRebuildBaseline" sc="rw" p="src/mcpindex.h" cx="2" ccx="1" in="1" r="9">inline McpRebuildBaseline mcpRebuildBaseline( const McpIndex&amp; ix, bool isIncrementalPass )</d>
+<d l="1184" e="1347" n="getIndex" sc="rw" p="src/mcpindex.h" cx="22" ccx="39" in="35" r="10">inline const McpIndex&amp; getIndex( const std::string&amp; root )</d>
+<d l="923" e="930" n="mcpFreshFields" sc="rw" p="src/mcpindex.h" cx="2" ccx="1" in="1" r="11">inline std::string mcpFreshFields( std::uint64_t passesAtEntry )</d>
+<d l="494" e="569" n="McpIndex" sc="McpIndex" p="src/mcpindex.h" r="12">struct McpIndex</d>
+<d l="1099" e="1112" n="receiptNextFor" sc="mcpedit" p="src/mcpedit.h" cx="4" ccx="3" in="1" r="13">inline std::string receiptNextFor( const std::string&amp; fileIdentity, const std::string&amp; symbolName, const std::string&amp; foldJson, const std::string&amp; firstTestRun )</d>
+<d l="299" e="538" n="ingest" sc="rw" p="src/ingest.cpp" cx="14" ccx="22" in="16" r="14">IngestResult ingest( const char* rootDir, const std::vector&lt;std::string&gt;&amp; excludeSubstr, std::string_view cacheFile, std::size_t maxFileBytes, bool captureValueUses, std::string_view excludeLabel, bool … [line truncated: 37 more bytes on this line]
+<d l="229" e="232" n="cacheArtifactVerdict" sc="rw" p="src/ingest.cpp" cx="1" in="1" r="15">const char* cacheArtifactVerdict( const std::string&amp; path, bool captureValueUses )</d>
+<d l="3814" e="3825" n="cachePathIsDirectory" p="src/main.cpp" cx="3" ccx="2" in="1" r="16">static bool cachePathIsDirectory( const std::string&amp; cachePath )</d>
+<d l="269" e="272" n="oracleCachePath" sc="gitoracle" p="src/gitoracle.h" cx="1" in="1" r="17">inline std::string oracleCachePath( const std::string&amp; root, const std::string&amp; headSha )</d>
+<d l="2218" e="2222" n="compiledQueryCache" p="src/ingest_crawl.h" cx="1" in="3" r="18">HashMap&lt;const TSLanguage*, TSQuery*&gt;&amp; compiledQueryCache()</d>
+… [107 more display lines; full output is 51554 bytes on 1 raw line(s)]
+`````
+
+
+---
+
+# self-diagnosis
+
+## `./build/ripwire . --doctor`
+
+*Environment self-check: binary staleness, grammars, cache dir, git, tracked-binary staleness — exit 1 when any check fails (here: the PATH install is older than ./build).*
+
+**exit code: 1** — **wall time: 54.51s**
+
+`````
+<!-- ripwire doctor schema=ripwire.doctor/v1: setup health: <c n= ok=> checks; exit 1 when one fails. at=: commit+dirty+shallow. n=: the check's name (binary-path, grammars, cache-dir, git, tree-sitter, index-cache, layout ...). loaded=/expected=: grammars whose tags query compiled / grammars compiled in; a shortfall fails the row. dir=: the per-user cache directory scanned (TMPDIR/XDG_CACHE_HOME ladder); unwritable fails the row. blobs=N: ripwire cache blobs in dir=; the scan stops at 4096 (blobs_floor=1 then). bytes=N: total size in bytes of the blobs counted (short when truncated=1). many=1: more than 50 blobs; an eviction-sanity flag, informational, never fails the row. truncated=1: cache-dir, blob scan cut (cap or I/O error); tracked-binaries, scan SKIPPED, stale=0 unmeasured. locks=N: advisory edit-lock files under locks/; unheld ones over a day old are swept on a cache write. volatile=: this row's attributes that read LIVE machine state; a determinism diff strips them, never the row. git=0|1: git runs from PATH; 0 fails the row (churn verbs need it). repo=0|1: the root is inside a git work tree; 0 is a diagnosis, not a failure. history=0|1: the repo has at least one commit; head= prints only when it does. head=: HEAD's short sha (9 hex, the at= width). core_abi=/cpp_grammar_abi=: tree-sitter core language ABI / the C++ grammar's ABI; informational. languages=N: distinct compiled-in grammars (the grammars row's expected=). tracked=N: git ls-files count, printed even when truncated=1 (over 20000 files skips the scan). binaries=N: tracked paths that sniff as binary content. non_git=1: no git history to compare; the row passes unscanned. stale=N: tracked binaries committed before a same-dir same-stem source changed; any fails the row. cache_version=/parser_ver_lean=/parser_ver_rich=/artifact_arch=: index identity; reuse needs all four. rich_verbs=: the verbs that consume the rich artifact (rich=); every other verb reads the lean one. source=: auto (per-root blob), cache-flag (named by the cache flag) or disabled (no-cache: nothing read). lean_path=/rich_path=: the artifact files checked; one path when the cache flag named it. lean=/rich=: can THIS binary open that artifact (ok, absent, parser-version ...); format, never freshness. fsmonitor=: the checkout's core.fsmonitor at startup: unset, builtin, off, or hook (a command git runs). neutralised=1: a hook fsmonitor was overridden to false for this run; 0 when none was needed. filter_drivers=N: filter drivers the repository's own config defines; filter_scope= local|all, filter_pinned= 1 (run with an empty command) or refused. state=: layout records agree, disagree (mixed binary: rebuild clean-first), not-checked or no-records. checked=1: the cross-unit layout comparison ran; 0 = under two comparable records. units=N: translation units that registered a layout record. types=N: layout types recorded (only those registered in src/model.h); omitted on state=disagree. checks=/passed=: checks run / how many passed; exit 1 when passed= is below checks=. built_from=: the commit this binary was built from; at= is the tree HEAD now, a mismatch is normal. self=/which=: this binary's path and the one which ripwire finds on PATH; which_version= is the version line that one prints when they differ. on_path=0|1: whether a ripwire is on PATH; 0 fails the row and hint= carries the export line. same_file=1: the PATH copy is this very file (same device and inode). same_bytes=1: a different file with identical content, a copied install (ok); 0 fails the row; unknown: a file was unreadable; the row fails unverified (hint= names it). self_mtime=/self_size=/which_mtime=/which_size=: epoch mtime and byte size of each binary. hint=: the row's verdict and fix in plain text (which binary is stale, what to run). -->
+<doctor schema="ripwire.doctor/v1" checks="9" passed="8" at="0712a5182" built_from="0712a5182">
+<c n="binary-path" ok="0" self="./build/ripwire" which="<path>" on_path="1" same_file="0" same_bytes="0" self_mtime="1793006914" self_size="58886584" which_mtime="1792454409" which_size="55699800" which_version="ripwi … [line truncated: 393 more bytes on this line]
+<c n="grammars" ok="1" loaded="26" expected="26"/>
+<c n="cache-dir" ok="1" dir="<tmp>" blobs="566" bytes="2139110535" many="1" truncated="0" locks="4" volatile="blobs,blobs_floor,bytes,many,truncated,locks"/>
+<c n="git" ok="1" git="1" repo="1" history="1" head="0712a5182"/>
+<c n="tree-sitter" ok="1" core_abi="15" cpp_grammar_abi="14" languages="26"/>
+<c n="tracked-binaries" ok="1" tracked="4295" binaries="33" non_git="0" truncated="0" stale="0"/>
+<c n="index-cache" ok="1" cache_version="43" parser_ver_lean="231" parser_ver_rich="232" artifact_arch="16" rich_verbs="for,uses,metrics,exemplar,context-ratio,nonlocal-state,quality-panel,verify,eval-retrieval,eval-mined,eval-skills" source="auto" lean_path="<tmp> … [line truncated: 219 more bytes on this line]
+<c n="git-config-trust" ok="1" fsmonitor="unset" neutralised="0" filter_drivers="0"/>
+<c n="layout" ok="1" state="agree" checked="1" units="2" types="12"/>
+</doctor>
+`````
+
+
+---
+
+# security
+
+## `./build/ripwire --scan-skill=skills/ripwire-orient/SKILL.md`
+
+*Scan a single skill file for injection/exfiltration patterns before installing.*
+
+`````
+<!-- ripwire scan-skills schema=ripwire.scan-skills/v1: injection/exfiltration/path-traversal scan of skill files: files= findings= skipped= verdict=. files=N: files scanned (unscannable ones are skipped=). findings=N: pattern hits; rows print up to 200 (shown= capped=1 past that). verdict=clean|warn|critical: the worst finding's severity, the same as exit 0/1/2. -->
+<skillscan schema="ripwire.scan-skills/v1" files="1" findings="0" verdict="clean">
+</skillscan>
+`````
+
+stderr:
+
+`````
+ripwire scan: 0 finding(s) in skills/ripwire-orient/SKILL.md
+`````
+
+## `./build/ripwire --scan-skills=skills`
+
+*Scan a whole skills directory (exit 2 = CRITICAL, 1 = WARN). Explicit-DIR form only.*
+
+`````
+<!-- ripwire scan-skills schema=ripwire.scan-skills/v1: injection/exfiltration/path-traversal scan of skill files: files= findings= skipped= verdict=. files=N: files scanned (unscannable ones are skipped=). findings=N: pattern hits; rows print up to 200 (shown= capped=1 past that). verdict=clean|warn|critical: the worst finding's severity, the same as exit 0/1/2. -->
+<skillscan schema="ripwire.scan-skills/v1" files="26" findings="0" verdict="clean">
+</skillscan>
+`````
+
+stderr:
+
+`````
+ripwire scan: 0 finding(s) total (26 skill file(s) scanned, 0 unscannable file(s) skipped, 0 denylisted subtree(s) not descended)
+`````
+
+
+---
+
+# knobs / modes
+
+## `./build/ripwire . --rank-by=churn --top-k=5`
+
+*Rank by git change-frequency prior instead of PageRank.*
+
+**wall time: 11.58s**
+
+`````
+<!-- ripwire map schema=ripwire.map/v1: ranked symbol map: <f p= layer=> groups <s t= n= sc= k= amb=> rows (k= rank), <c n=> resolved callees; the header comment is data. est_tokens=: price as emitted (an upper bound under compact). at=: commit+dirty+shallow. root=: p= relative to it. pr_iters=N: PageRank iterations. rank_by=: the ranker behind k=. window=: the git span mined. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. overloads=N: N same-name defs merged in this row; shown= counts each. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. <c via="name">: that callee matched by name alone (receiver unproven); it does NOT mean the edge is false. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. amb=K: K calls split over several defs. -->
+<!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
+<!-- files=3631 symbols=31860 edges=30033 shown=5 est_tokens=1214 ambiguous=2933 unresolved=15249 locality_pinned=9 external=8658 declined=30154 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
+<r schema="ripwire.map/v1" at="0712a5182" root="." rank_by="churn" window="18mo@HEAD" est_tokens="1214" pr_iters="35">
+<f p="src/infra/Diagnostics.h" layer="infra">
+<s t="macro" n="RW_ASSUME_" overloads="2" k="0.0037">
+<c n="RW_CHECK_"/>
+</s>
+<s t="macro" n="ASSUME" amb="1" k="0.0034">
+<c n="RW_ASSUME_" prov="split"/>
+<c n="RW_ASSUME_" prov="split"/>
+</s>
+<s t="macro" n="RW_CHECK_" k="0.0032">
+<c n="handleAssert" via="name"/>
+</s>
+</f>
+<f p="src/infra/nodekind.h" layer="infra">
+<s t="fn" n="kindIs" sc="rw" k="0.0031">
+</s>
+</f>
+</r>
+`````
+
+## `./build/ripwire . --rank-by=churn-decay --since=HEAD~2 --exclude=test --exclude=docs --exclude=skills --exclude=changelog.d --in=src --limit=3`
+
+*Scope the recent-changes answer to ONE directory. The global <recent> block stays byte-identical, a second <recent scope="src"> page follows it — n=/of= are its counts (of= IS the total, so the paging half carries no total=), capped="1" has_more="1" next_offset= offset= limit= page it, and next= replays THIS run's own corpus flags (--since/--exclude) so the page it names is a page of the same answer. The symbol map collapses to a disclosed <symbols stubbed="1" would_show= next=/> stub — the map was not asked for and was not ranked at all, which is why the header carries no pr_iters=. merge_bombs_skipped= stays on the global block: it counts the window's skipped commits, not the directory's.*
+
+**wall time: 14.03s**
+
+`````
+<!-- ripwire map schema=ripwire.map/v1: ranked symbol map: <f p= layer=> groups <s t= n= sc= k= amb=> rows (k= rank), <c n=> resolved callees; the header comment is data. window: capped= has_more= next_offset= (capped=1 cut; next_offset= pastes as offset=). est_tokens=: price as emitted (an upper bound under compact). at=: commit+dirty+shallow. root=: p= relative to it. rank_by=: the ranker behind k=. window=: the git span mined. declined=K: K calls left unbound (no evidence chose one def). external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). <recent n= of=>: the n= newest-touched of of= touched files; <rc age_d=> days since its last commit, w= decayed weight. merge_bombs_skipped=N: N commits touching more than 100 INDEXED files skipped, uncounted; a file only they touched is absent; the window's count, so the global block only. <recent scope=DIR>: a second block riding when the global one does, DIR's files only (p= root-relative); of= is its total; capped=/has_more=/next_offset=/offset=/limit= page it, next= is that page. <symbols stubbed=1 would_show=N next=>: the symbol map in= did not ask for was not rendered; N is that run's own shown= — definitions counted individually as shown= counts them, so its rows follow from rows+sum(overloads-1)=shown (not the header's symbols= corpus count); next= fetches it. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. next=: the one pasteable follow-up. -->
+<!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
+<!-- files=554 symbols=15593 edges=19578 shown=0 est_tokens=1392 ambiguous=1912 unresolved=4049 locality_pinned=6 external=5665 declined=25670 skipped_oversize=15 unindexed="tsv:42,scm:24,txt:24,jsonl:23,expected:15,lock:7" unindexed_exts=12 order=important-first -->
+<r schema="ripwire.map/v1" at="0712a5182" root="." rank_by="churn-decay" window="HEAD~2 half-life=90d" est_tokens="1392">
+<recent n="4" of="4" merge_bombs_skipped="0">
+<rc p="src/graph.h" age_d="0" w="2"/>
+<rc p="src/model.h" age_d="0" w="2"/>
+<rc p="src/forctorhop.h" age_d="0" w="2"/>
+<rc p="src/verbs_for.h" age_d="0" w="0.999"/>
+</recent>
+<recent scope="src" n="3" of="4" capped="1" has_more="1" next_offset="3" offset="0" limit="3" next="--rank-by=churn-decay --since=HEAD~2 --exclude=test --exclude=docs --exclude=skills --exclude=changelog.d --in=src --offset=3 --limit=3">
+<rc p="src/graph.h" age_d="0" w="2"/>
+<rc p="src/model.h" age_d="0" w="2"/>
+<rc p="src/forctorhop.h" age_d="0" w="2"/>
+</recent>
+<symbols stubbed="1" would_show="200" next="--rank-by=churn-decay --since=HEAD~2 --exclude=test --exclude=docs --exclude=skills --exclude=changelog.d"/>
+</r>
+`````
+
+## `./build/ripwire . --rank-by=bogus --top-k=5`
+
+*An unknown value REFUSES (exit 1), NAMED, with the supported set listed.*
+
+**exit code: 1**
+
+`````
+(empty)
+`````
+
+stderr:
+
+`````
+ripwire: --rank-by: unknown value 'bogus' (supported: pagerank|authority|hub|rrf|churn|churn-decay)
+`````
+
+## `./build/ripwire . --callers=rankGraphTeleport --format=columnar`
+
+*Columnar output: paths table + parallel arrays, ~15-60% fewer tokens on MANY-row lists — small results can be LARGER (the columnar legend is a fixed cost).*
+
+**wall time: 3.49s**
+
+`````
+<!-- ripwire callers schema=ripwire.callers/v1: 1-hop CALLERS of of= (defs= matched, count= distinct symbols): <s t= n= p=>; hop_tested=/hop_untested=. counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. root=: p= relative to it. format=columnar: parallel arrays, not row attributes: <paths> maps I=path, each <cols> array holds n= comma-separated values in one row order, fields= naming them (the path column indexes <paths>; &#44; is a comma). <tested> column: 1 = a non-test row an indexed test transitively reaches; 0 = none found, or a test row. <sites_at> column: each row's calls of the leaf name, any receiver, as file:line, space-separated; not proof each binds. next=: the one pasteable follow-up. -->
+<callers schema="ripwire.callers/v1" of="rankGraphTeleport" defs="1" count="7" hop_tested="0" hop_untested="7" root="." graph_ambiguous="2933" graph_unresolved="15249" graph_unindexed="269" counts_floor="1" next="--uses=rankGraphTeleport" format="columnar">
+<paths>0=src/mcpindex.h 1=src/graph.h 2=src/eval.h 3=src/main.cpp</paths>
+<cols n="7" fields="path,name,line,kind,tested,sites_at">
+<path>0,1,1,2,3,3,3</path>
+<name>getIndex,rankGraph,anchoredLexicalRank,runEval,churnDecayRanking,churnRankedGraph,runDefaultMap</name>
+<line>1184,11850,12496,171,1425,1464,1751</line>
+<kind>fn,fn,fn,fn,fn,fn,fn</kind>
+<tested>0,0,0,0,0,0,0</tested>
+<sites_at>src/mcpindex.h:1288,src/graph.h:11853,src/graph.h:12547,src/eval.h:328,src/main.cpp:1439,src/main.cpp:1478 src/main.cpp:1479 src/main.cpp:1493,src/main.cpp:1871</sites_at>
+</cols>
+</callers>
+`````
+
+## `./build/ripwire . --for="cache invalidation" --format=candidates --top-k=5`
+
+*Flat top-K export for an external reranker.*
+
+**wall time: 7.77s**
+
+`````
+<!-- ripwire candidates: flat top K export for an external reranker. r=rank(1 based) s=SCORE n=name id=canonical k=KIND-tag p=path l=line. Note k= is the kind here and the PageRank score in the ranked map; on this row the score is s=. Root: count= rows exported of total= RANKED CORPUS symbols (total is the corpus size, never a match count), capped="1" means the top-k cut dropped some; route= names the ranker (s= is comparable only within one route); anchored= counts query-mention lifts (0 = the anchor ran and moved nothing); weak="1" means the top raw lexical score is below the confidence bar, so these rows rest on thin textual evidence; doc_tier= names the query SHAPE (a pasted trace, a pasted bug-report form) that scored documents down for this run, absent when none did. -->
+<candidates count="5" total="31860" capped="1" route="subtoken+body" anchored="0">
+<cand r="1" s="14.8928" n="spanTierMemoPath" id="src/ingest_astquery.h::rw::spanTierMemoPath" k="fn" p="src/ingest_astquery.h" l="1635">
+<sig>inline std::string spanTierMemoPath( const std::string&amp; diskPath )</sig>
+</cand>
+<cand r="2" s="9.75604" n="legoImplementorsOnSurface" id="src/serialize.h::rw::legoImplementorsOnSurface" k="fn" p="src/serialize.h" l="9428">
+<sig>inline std::vector&lt;std::vector&lt;NodeId&gt;&gt; legoImplementorsOnSurface( const IngestResult&amp; ing, const std::vector&lt;std::vector&lt;NodeId&gt;&gt;&amp; implementors, const std::vector&lt;NodeId&gt;&amp; surfaceIds )</sig>
+</cand>
+<cand r="3" s="8.19102" n="See the map — not just the numbers" id="README.md::Rip&apos;n Fast. Fewer Tokens. Better Code.::See the map — not just the numbers" k="sec" p="README.md" l="344">
+<sig>### See the map — not just the numbers</sig>
+</cand>
+<cand r="4" s="7.45701" n="receiptNextFor" id="src/mcpedit.h::mcpedit::receiptNextFor" k="fn" p="src/mcpedit.h" l="1099">
+<sig>inline std::string receiptNextFor( const std::string&amp; fileIdentity, const std::string&amp; symbolName, const std::string&amp; foldJson, const std::string&amp; firstTestRun )</sig>
+</cand>
+<cand r="5" s="6.59302" n="cacheArtifactVerdict" id="src/ingest.cpp::rw::cacheArtifactVerdict" k="fn" p="src/ingest.cpp" l="229">
+<sig>const char* cacheArtifactVerdict( const std::string&amp; path, bool captureValueUses )</sig>
+</cand>
+</candidates>
+`````
+
+## `./build/ripwire . --callers=rankGraphTeleport --format=bogus`
+
+*An unknown --format value REFUSES (exit 1), named, with the supported set listed.*
+
+**exit code: 1**
+
+`````
+(empty)
+`````
+
+stderr:
+
+`````
+ripwire: --format: unknown value 'bogus' (supported: xml|columnar|rows|candidates)
+`````
+
+## `./build/ripwire . --callers=rankGraphTeleport --json`
+
+*Machine-parseable JSON, same content, keys mirror the XML attrs.*
+
+**wall time: 11.87s**
+
+`````
+{"of":"rankGraphTeleport","defs":1,"count":7,"root":".","hop_tested":0,"hop_untested":7,"graph_ambiguous":2933,"graph_unresolved":15249,"graph_unindexed":269,"counts_floor":true,"callers":[{"t":"fn","n":"getIndex","p":"src/mcpindex.h:1184","sites_at":["src/mcpindex.h:1288"]},
+{"t":"fn","n":"rankGraph","p":"src/graph.h:11850","sites_at":["src/graph.h:11853"]},
+{"t":"fn","n":"anchoredLexicalRank","p":"src/graph.h:12496","sites_at":["src/graph.h:12547"]},
+{"t":"fn","n":"runEval","p":"src/eval.h:171","sites_at":["src/eval.h:328"]},
+{"t":"fn","n":"churnDecayRanking","p":"src/main.cpp:1425","sites_at":["src/main.cpp:1439"]},
+{"t":"fn","n":"churnRankedGraph","p":"src/main.cpp:1464","sites_at":["src/main.cpp:1478","src/main.cpp:1479","src/main.cpp:1493"]},
+{"t":"fn","n":"runDefaultMap","p":"src/main.cpp:1751","sites_at":["src/main.cpp:1871"]}]}
+`````
+
+## `./build/ripwire . --hotspots --json`
+
+*JSON refusal shape: an unsupported verb refuses loudly instead of silently falling back to XML.*
+
+**exit code: 1** — **wall time: 1.75s**
+
+`````
+(empty)
+`````
+
+stderr:
+
+`````
+ripwire: --json is not yet supported for --hotspots — supported: the default map, --for, --pack-task, --callers/--callees, --impact, --quality-delta, --test-gate, --metrics, and --plan-lanes which is JSON-native (e.g. ripwire <dir> --callers=SYM --json)
+`````
+
+## `./build/ripwire . --hotspots --limit=3 --offset=3`
+
+*Pagination: 3 items, skipping the first 3 (deterministic seams).*
+
+**wall time: 22.35s**
+
+`````
+<!-- ripwire hotspots schema=ripwire.hotspots/v1: maintenance pain = churn x ccx over window=: <f p= churn= ccx= score= top= top_ccx= top_l=>; unranked_*= no churn/complexity. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). at=: commit+dirty+shallow. root=: p= relative to it. files=/ranked=: files in the window / those with both churn and complexity; ranked + unranked_no_churn + unranked_no_complexity = files. unranked_no_churn=/unranked_no_complexity=: files left out for no commit in window= / no measured complexity. -->
+<!-- extent_suspect_syms=K on a row = K of the file's functions failed an extent/scope containment check (the map, the bundles and the skipped verb mark each one, reasons and all) and are LEFT OUT of that row's ccx=, score= and top=, so its ccx= is a FLOOR of the file's true sum rather than a total. unranked_extent_suspect= counts files with commits whose every scorable function was left out that way (or whose trusted remainder scores 0), so ranked= + unranked_no_churn= + unranked_no_complexity= + unranked_extent_suspect= = files= exactly. Absent = nothing excluded. -->
+<hotspots schema="ripwire.hotspots/v1" window="12mo@HEAD" files="3631" ranked="826" unranked_no_churn="0" unranked_no_complexity="2803" unranked_extent_suspect="2" shown="3" capped="1" total="826" has_more="1" next_offset="6" offset="3" limit="3" root="." at="0712a5182">
+<f p="src/mcpverbs.h" churn="466" ccx="1254" score="584364" top="runBatchSub" top_ccx="138" top_l="5869"/>
+<f p="src/main.cpp" churn="453" ccx="1247" score="564891" top="dispatchMain" top_ccx="482" top_l="4307"/>
+<f p="src/cli.h" churn="511" ccx="667" score="340837" top="parseArgs" top_ccx="213" top_l="5379"/>
+</hotspots>
+`````
+
+## `./build/ripwire . --ignore-tests --top-k=5`
+
+*Drop test paths from the corpus before ranking.*
+
+**wall time: 3.47s**
+
+`````
+<!-- ripwire map schema=ripwire.map/v1: ranked symbol map: <f p= layer=> groups <s t= n= sc= k= amb=> rows (k= rank), <c n=> resolved callees; the header comment is data. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. pr_iters=N: PageRank iterations. <inv listed= unlisted=>: files the ranked rows show / do not (sum = files=), each named or counted below. <entry p= n=>: a program entry by its language's convention (C/Go/Rust main, Java/C# static main, a script main its module scope calls, __main__.py), callees as c rows; manifest entries not read. <ls p= n= f=>: n= unshown files under dir p=; f= names its code files, the rest (tests, docs, config, test/doc/example dirs) counted. declined=K: K calls left unbound (no evidence chose one def). external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). macro_blanked_files=K: K files indexed from a macro-blanked re-parse. overloads=N: N same-name defs merged in this row; shown= counts each. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. amb=K: K calls split over several defs. -->
+<!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
+<!-- files=3631 symbols=16970 edges=20304 shown=5 est_tokens=3277 ambiguous=1930 unresolved=4243 locality_pinned=6 external=5829 declined=26171 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
+<r schema="ripwire.map/v1" root="." est_tokens="3277" pr_iters="37">
+<f p="src/infra/nodekind.h" layer="infra">
+<s t="fn" n="kindIs" sc="rw" k="0.0057">
+</s>
+</f>
+<f p="src/infra/Diagnostics.h" layer="infra">
+<s t="macro" n="ASSUME" amb="1" k="0.0034">
+<c n="RW_ASSUME_" prov="split"/>
+<c n="RW_ASSUME_" prov="split"/>
+</s>
+<s t="macro" n="RW_ASSUME_" overloads="2" k="0.0032">
+<c n="RW_CHECK_"/>
+</s>
+</f>
+<f p="src/ingest_metrics.h">
+<s t="fn" n="nodeTextOf" k="0.0032">
+</s>
+</f>
+<inv listed="3" unlisted="3628">
+<entry p="scripts/changelog_assemble.py" n="main">
+<c n="repoRoot"/>
+<c n="fragmentNames"/>
+<c n="check"/>
+<c n="assembledEntries"/>
+<c n="release"/>
+</entry>
+<entry p="scripts/optremarks.py" n="main">
+… [67 more display lines; full output is 8139 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --exclude=present --exclude=bench --top-k=5`
+
+*Drop matching paths (repeatable) before ranking.*
+
+**wall time: 3.53s**
+
+`````
+<!-- ripwire map schema=ripwire.map/v1: ranked symbol map: <f p= layer=> groups <s t= n= sc= k= amb=> rows (k= rank), <c n=> resolved callees; the header comment is data. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. pr_iters=N: PageRank iterations. <inv listed= unlisted=>: files the ranked rows show / do not (sum = files=), each named or counted below. <entry p= n=>: a program entry by its language's convention (C/Go/Rust main, Java/C# static main, a script main its module scope calls, __main__.py), callees as c rows; manifest entries not read. <ls p= n= f=>: n= unshown files under dir p=; f= names its code files, the rest (tests, docs, config, test/doc/example dirs) counted. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. overloads=N: N same-name defs merged in this row; shown= counts each. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. amb=K: K calls split over several defs. -->
+<!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
+<!-- files=3368 symbols=28617 edges=28645 shown=5 est_tokens=3271 ambiguous=2898 unresolved=12132 locality_pinned=9 external=6306 declined=27857 extent_suspect_syms=12 macro_blanked_files=7 unindexed="txt:56,mod:31,scm:24,xml:13,tsv:10,cmake:5" unindexed_exts=15 order=important-first -->
+<r schema="ripwire.map/v1" root="." est_tokens="3271" pr_iters="37">
+<f p="src/infra/nodekind.h" layer="infra">
+<s t="fn" n="kindIs" sc="rw" k="0.0041">
+</s>
+</f>
+<f p="src/infra/Diagnostics.h" layer="infra">
+<s t="macro" n="ASSUME" amb="1" k="0.0024">
+<c n="RW_ASSUME_" prov="split"/>
+<c n="RW_ASSUME_" prov="split"/>
+</s>
+<s t="macro" n="RW_ASSUME_" overloads="2" k="0.0023">
+<c n="RW_CHECK_"/>
+</s>
+</f>
+<f p="src/ingest_metrics.h">
+<s t="fn" n="nodeTextOf" k="0.0023">
+</s>
+</f>
+<inv listed="3" unlisted="3365">
+<entry p="scripts/changelog_assemble.py" n="main">
+<c n="repoRoot"/>
+<c n="fragmentNames"/>
+<c n="check"/>
+<c n="assembledEntries"/>
+<c n="release"/>
+</entry>
+<entry p="scripts/optremarks.py" n="main">
+… [65 more display lines; full output is 8119 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --map-diff --top-k=5`
+
+*Full map re-ranked with teleport toward git-changed files — clean tree, so changed=0 and it degrades to the plain map.*
+
+**wall time: 6.65s**
+
+`````
+<!-- ripwire map-diff schema=ripwire.map-diff/v1: the ranked map anchored at at=: what the diff touched, the map's row vocabulary. est_tokens=: price as emitted (an upper bound under compact). at=: commit+dirty+shallow. root=: p= relative to it. pr_iters=N: PageRank iterations. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. overloads=N: N same-name defs merged in this row; shown= counts each. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). changed=K: K indexed git-changed files seed the PageRank teleport (0: uniform, incl. no git). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. amb=K: K calls split over several defs. layer=: built-in arch layer (game|infra|render|math|audio|ai|test) from a dir name in p=; absent if none. -->
+<!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
+<!-- files=3631 symbols=31860 edges=30033 shown=5 est_tokens=1203 ambiguous=2933 unresolved=15249 locality_pinned=9 external=8658 declined=30154 extent_suspect_syms=12 macro_blanked_files=7 changed=0 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
+<r schema="ripwire.map-diff/v1" at="0712a5182" root="." est_tokens="1203" pr_iters="36">
+<f p="src/infra/nodekind.h" layer="infra">
+<s t="fn" n="kindIs" sc="rw" k="0.0037">
+</s>
+</f>
+<f p="src/infra/Diagnostics.h" layer="infra">
+<s t="macro" n="ASSUME" amb="1" k="0.0022">
+<c n="RW_ASSUME_" prov="split"/>
+<c n="RW_ASSUME_" prov="split"/>
+</s>
+<s t="macro" n="RW_ASSUME_" overloads="2" k="0.0022">
+<c n="RW_CHECK_"/>
+</s>
+</f>
+<f p="src/ingest_metrics.h">
+<s t="fn" n="nodeTextOf" k="0.0021">
+</s>
+</f>
+</r>
+`````
+
+## `./build/ripwire . --no-cache --top-k=3`
+
+*Force a cold parse (bypass the warm TMPDIR cache) — shows the cold-vs-warm cost.*
+
+**wall time: 6.36s**
+
+`````
+<!-- ripwire map schema=ripwire.map/v1: ranked symbol map: <f p= layer=> groups <s t= n= sc= k= amb=> rows (k= rank), <c n=> resolved callees; the header comment is data. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. pr_iters=N: PageRank iterations. <inv listed= unlisted=>: files the ranked rows show / do not (sum = files=), each named or counted below. <entry p= n=>: a program entry by its language's convention (C/Go/Rust main, Java/C# static main, a script main its module scope calls, __main__.py), callees as c rows; manifest entries not read. <ls p= n= f=>: n= unshown files under dir p=; f= names its code files, the rest (tests, docs, config, test/doc/example dirs) counted. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. amb=K: K calls split over several defs. -->
+<!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
+<!-- files=3631 symbols=31860 edges=30033 shown=3 est_tokens=3272 ambiguous=2933 unresolved=15249 locality_pinned=9 external=8658 declined=30154 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
+<r schema="ripwire.map/v1" root="." est_tokens="3272" pr_iters="36">
+<f p="src/infra/nodekind.h" layer="infra">
+<s t="fn" n="kindIs" sc="rw" k="0.0037">
+</s>
+</f>
+<f p="src/infra/Diagnostics.h" layer="infra">
+<s t="macro" n="ASSUME" amb="1" k="0.0022">
+<c n="RW_ASSUME_" prov="split"/>
+<c n="RW_ASSUME_" prov="split"/>
+</s>
+<s t="macro" n="RW_ASSUME_" k="0.0022">
+<c n="RW_CHECK_"/>
+</s>
+</f>
+<inv listed="2" unlisted="3629">
+<entry p="scripts/changelog_assemble.py" n="main">
+<c n="repoRoot"/>
+<c n="fragmentNames"/>
+<c n="check"/>
+<c n="assembledEntries"/>
+<c n="release"/>
+</entry>
+<entry p="scripts/optremarks.py" n="main">
+<c n="parse_record_file"/>
+<c n="is_foreign"/>
+</entry>
+<entry p="src/main.cpp" n="main">
+… [63 more display lines; full output is 8141 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --cache=<scratch>/aux/warm2.ripwirecache --top-k=3`
+
+*Explicit incremental cache at a path OUTSIDE the repo (first call writes it).*
+
+**wall time: 6.22s**
+
+`````
+<!-- ripwire map schema=ripwire.map/v1: ranked symbol map: <f p= layer=> groups <s t= n= sc= k= amb=> rows (k= rank), <c n=> resolved callees; the header comment is data. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. pr_iters=N: PageRank iterations. <inv listed= unlisted=>: files the ranked rows show / do not (sum = files=), each named or counted below. <entry p= n=>: a program entry by its language's convention (C/Go/Rust main, Java/C# static main, a script main its module scope calls, __main__.py), callees as c rows; manifest entries not read. <ls p= n= f=>: n= unshown files under dir p=; f= names its code files, the rest (tests, docs, config, test/doc/example dirs) counted. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. amb=K: K calls split over several defs. -->
+<!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
+<!-- files=3631 symbols=31860 edges=30033 shown=3 est_tokens=3272 ambiguous=2933 unresolved=15249 locality_pinned=9 external=8658 declined=30154 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
+<r schema="ripwire.map/v1" root="." est_tokens="3272" pr_iters="36">
+<f p="src/infra/nodekind.h" layer="infra">
+<s t="fn" n="kindIs" sc="rw" k="0.0037">
+</s>
+</f>
+<f p="src/infra/Diagnostics.h" layer="infra">
+<s t="macro" n="ASSUME" amb="1" k="0.0022">
+<c n="RW_ASSUME_" prov="split"/>
+<c n="RW_ASSUME_" prov="split"/>
+</s>
+<s t="macro" n="RW_ASSUME_" k="0.0022">
+<c n="RW_CHECK_"/>
+</s>
+</f>
+<inv listed="2" unlisted="3629">
+<entry p="scripts/changelog_assemble.py" n="main">
+<c n="repoRoot"/>
+<c n="fragmentNames"/>
+<c n="check"/>
+<c n="assembledEntries"/>
+<c n="release"/>
+</entry>
+<entry p="scripts/optremarks.py" n="main">
+<c n="parse_record_file"/>
+<c n="is_foreign"/>
+</entry>
+<entry p="src/main.cpp" n="main">
+… [63 more display lines; full output is 8141 bytes on 1 raw line(s)]
+`````
+
+Artifact written:
+
+`````
+ 28779725 <scratch>/aux/warm2.ripwirecache
+`````
+
+## `./build/ripwire . --max-file-size=8K --top-k=3`
+
+*Skip files above a size bound before parsing (note the corpus shrink in the header).*
+
+**wall time: 2.86s**
+
+`````
+<!-- ripwire map schema=ripwire.map/v1: ranked symbol map: <f p= layer=> groups <s t= n= sc= k= amb=> rows (k= rank), <c n=> resolved callees; the header comment is data. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. pr_iters=N: PageRank iterations. <inv listed= unlisted=>: files the ranked rows show / do not (sum = files=), each named or counted below. <entry p= n=>: a program entry by its language's convention (C/Go/Rust main, Java/C# static main, a script main its module scope calls, __main__.py), callees as c rows; manifest entries not read. <ls p= n= f=>: n= unshown files under dir p=; f= names its code files, the rest (tests, docs, config, test/doc/example dirs) counted. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. -->
+<!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
+<!-- files=2597 symbols=10248 edges=3300 shown=3 est_tokens=1702 ambiguous=266 unresolved=1012 locality_pinned=4 external=1064 declined=1198 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=1049 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
+<r schema="ripwire.map/v1" root="." est_tokens="1702" pr_iters="35">
+<f p="test/forcallerhopfix/c/fan.c" layer="test">
+<s t="fn" n="fan_target" k="0.0022">
+</s>
+</f>
+<f p="test/stdmembergatefix/wrap/list.h" layer="test">
+<s t="method" n="size" sc="List" k="0.0014">
+</s>
+</f>
+<f p="test/fnliteralfix/arrows.ts" layer="test">
+<s t="fn" n="sink" k="0.0013">
+</s>
+</f>
+<inv listed="3" unlisted="2594">
+<entry p="src/tsprobe.cpp" n="main">
+<c n="langIndex"/>
+<c n="kindIndex"/>
+<c n="langName"/>
+</entry>
+<ls p="." n="6"/>
+<ls p=".codex-plugin" n="1"/>
+<ls p="bench" n="137"/>
+<ls p="changelog.d" n="32"/>
+<ls p="docs" n="3"/>
+<ls p="hooks" n="1"/>
+<ls p="paper" n="1"/>
+<ls p="present" n="2"/>
+… [18 more display lines; full output is 4246 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --scip=does_not_exist.scip --callers=rankGraphTeleport`
+
+*SCIP overlay with a missing index REFUSES (exit 1) naming the file — never silently serves the name-based map you named a precision index to improve on (it used to degrade in silence).*
+
+**exit code: 1**
+
+`````
+(empty)
+`````
+
+stderr:
+
+`````
+ripwire: --scip=does_not_exist.scip: cannot open the index — refusing rather than serving the name-based map you named a precision index to improve on (generate one with scip-clang/scip-python, or drop --scip)
+`````
+
+## `./build/ripwire src test --top-k=5`
+
+*Multi-root workspace: ONE merged graph over two roots, paths labeled <root>/<rel>.*
+
+**wall time: 5.09s**
+
+`````
+<!-- ripwire map schema=ripwire.map/v1: ranked symbol map: <f p= layer=> groups <s t= n= sc= k= amb=> rows (k= rank), <c n=> resolved callees; the header comment is data. est_tokens=: price as emitted (an upper bound under compact). <root label= p=>: a workspace root; label= prefixes every p=/id=. pr_iters=N: PageRank iterations. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. overloads=N: N same-name defs merged in this row; shown= counts each. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). roots=N: N workspace roots. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. amb=K: K calls split over several defs. -->
+<!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
+<!-- files=3210 symbols=25578 edges=27729 shown=5 est_tokens=1130 ambiguous=2820 unresolved=8365 locality_pinned=9 external=4947 declined=27533 extent_suspect_syms=12 macro_blanked_files=7 roots=2 unindexed="txt:53,mod:31,xml:13,tsv:8,jsonl:3,manifest:3" unindexed_exts=13 order=important-first -->
+<r schema="ripwire.map/v1" est_tokens="1130" pr_iters="37">
+<root label="src" p="src"/>
+<root label="test" p="test"/>
+<f p="src/infra/nodekind.h" layer="infra">
+<s t="fn" n="kindIs" sc="rw" k="0.0045">
+</s>
+</f>
+<f p="src/infra/Diagnostics.h" layer="infra">
+<s t="macro" n="ASSUME" amb="1" k="0.0027">
+<c n="RW_ASSUME_" prov="split"/>
+<c n="RW_ASSUME_" prov="split"/>
+</s>
+<s t="macro" n="RW_ASSUME_" overloads="2" k="0.0026">
+<c n="RW_CHECK_"/>
+</s>
+</f>
+<f p="src/ingest_metrics.h">
+<s t="fn" n="nodeTextOf" k="0.0025">
+</s>
+</f>
+</r>
+`````
+
+stderr:
+
+`````
+ripwire: cache <tmp>: over its 2048 MiB budget — evicted 31 blob(s) of other roots or other ripwire builds (this build's blobs for this root are kept)
+`````
+
+## `./build/ripwire . --eval`
+
+*Self-eval: co-change recall vs BM25.*
+
+**wall time: 20.52s**
+
+`````
+ripwire --eval  (co-change recovery, averaged over 80 historical commits)
+  ranker     recall@5  recall@10  recall@20
+  ripwire        7.0%       7.5%      13.5%
+  BM25          15.4%      16.9%      19.0%
+  BM25sub       17.4%      25.2%      29.4%
+  BM25body      19.5%      25.7%      36.0%
+  fused         12.9%      16.3%      26.6%
+  anchored      19.7%      26.0%      36.5%
+  same-dir       2.8%       6.1%      11.4%
+  random         0.1%       0.3%       0.6%   <- floor (random ranking over F=3631 files)
+  note: `ripwire` here is the DEFAULT MAP's structural-only PageRank (importance, not
+        relatedness) — it is NOT what a --for/--query retrieval call ranks with. BM25 /
+        BM25sub / BM25body are QUERY-TIME lexical rankers (whole-name / subtoken /
+        subtoken+body); fused = RRF(ripwire, BM25sub); anchored = BM25body + anchored PPR
+        expansion (--for --anchor, EXPERIMENTAL). The SHIPPED default for --for/--query is
+        the subtoken+body lexical family (routed to name-exact only for an identifier-shaped
+        query — lexical.h chooseForRanker), so a gap between the ripwire and BM25* rows here
+        is structural-importance-vs-lexical-relatedness on a co-change task, not the shipped
+        retrieval path losing to an alternative it was never running.
+`````
+
+## `./build/ripwire . --eval-retrieval`
+
+*Known-item retrieval eval: MRR + recall@k per ranker per query mode.*
+
+**wall time: 154.38s**
+
+`````
+ripwire --eval-retrieval  (known-item, 4000 doc-commented symbols; gold is in-corpus by construction)
+  sample: population=8003 scored=4000 rule=smallest-key CAPPED — a SUBSET, not the population
+          (smallest fnv1a64(scope::name) over the population, cut on the key so an identity is never split;
+           path- and order-independent, but a corpus this size is NOT graded exhaustively — say so when citing it)
+  ingest: lex=rich (persisted subtoken stats; no per-query corpus re-tokenize)
+  ranker    query-mode     MRR  recall@1  recall@5 recall@10
+  subtoken  name         0.680     54.5%     84.8%     90.0%
+  subtoken  doc-phrase   0.904     88.3%     92.3%     93.5%
+  name-exact name         0.898     82.2%     95.9%     97.4%
+  name-exact doc-phrase   0.013      0.5%      1.8%      2.6%
+  anchored  name         0.687     56.2%     84.1%     88.7%
+  anchored  doc-phrase   0.900     87.6%     92.3%     93.0%
+  routed    name         0.900     82.4%     96.0%     97.6%
+  routed    doc-phrase   0.902     88.3%     92.1%     93.3%
+  note: routing chose name-exact on 3989/4000 NAME queries (a NAME query is always identifier-shaped);
+        the confidence gate routes doc-phrase queries to name-exact ONLY when EVERY content word names a symbol
+        (or an explicit camel/snake token appears) AND every matched name is specific enough to anchor on —
+        a common name (many definitions, or a subtoken carried by many symbol names) declines the route — so
+        conceptual prose falls back to subtoken+body; routed tracks the better ranker on BOTH modes
+        (routed==name-exact on name, ~=subtoken+body on doc-phrase).
+`````
+
+## `./build/ripwire . --eval-stray=<scratch>/aux/stray_labels2.tsv`
+
+*Labelled verdict-accuracy eval for --stray-content — three labels over REAL local refs (names resolved at capture time); exit 3 when accuracy is under the floor. Read got= against v= in the stray-content run: a ref the verb could not analyse (unknown) must never be credited as a merged hit.*
+
+**exit code: 3** — **wall time: 81.90s**
+
+Input file:
+
+`````
+# ref<TAB>verdict labels for --eval-stray (the first three local branches, resolved at capture time; a missing branch is padded with a nonexistent name on purpose)
+arm/for-howitworks-067-f2add	merged
+arm/for-howitworks-067-placebo	unmerged
+arm/orient-map-067-narrow	merged
+`````
+
+`````
+<!-- ripwire stray-content eval: labelled verdict accuracy. Each row is one branch whose true state was established by hand; want= is the label, got= is what the classifier said. A branch absent from the report scores as merged ONLY when it is a real ref this repo has (merged refs are omitted by design); a label naming a ref that does not exist is refused, not scored (see badRefs on refusal). unknown= on the root counts cases whose verdict is unknown (no merge-base / unrelated history); its own bucket, never folded into merged. Use this to MEASURE a threshold change instead of eyeballing it. -->
+<stray-eval cases="3" correct="1" unknown="0" accuracy="33.3">
+<case ref="arm/for-howitworks-067-f2add" want="merged" got="unmerged" hit="0" reported="1"/>
+<case ref="arm/for-howitworks-067-placebo" want="unmerged" got="unmerged" hit="1" reported="1"/>
+<case ref="arm/orient-map-067-narrow" want="merged" got="unmerged" hit="0" reported="1"/>
+</stray-eval>
+`````
+
+## `./build/ripwire skills --eval-skills=<scratch>/aux/skills_labels2.tsv`
+
+*Labelled skill-ROUTING eval over the repo's own skills/ directory (4 hand-labelled prompts).*
+
+**wall time: 1.11s**
+
+Input file:
+
+`````
+orient in an unfamiliar codebase fast	ripwire-orient	judged
+who calls this function and what is the blast radius	ripwire-navigate	judged
+plan parallel worktrees so the lanes do not collide	ripwire-change-check	judged
+what is the weather in Paris	none	neg
+`````
+
+`````
+ripwire --eval-skills  (skill routing over K=16 candidate skills [ripwire-router excluded]; 3 positive + 1 negative prompts; corpus '<scratch>/aux/skills_labels2.tsv'; split test=4 dev=0)
+  arm           hit@1   hit@2     mrr   sep-auc   fire/abstain@ORACLE-th (upper bound)
+  overlap       66.7%   66.7%   0.689     0.000    50.0% (th=-1.000)
+  name          33.3%   66.7%   0.537     0.667    50.0% (th=0.000)
+  bm25-desc     66.7%   66.7%   0.689     0.667    75.0% (th=2.865)
+  bm25-full     33.3%   66.7%   0.611     1.000    50.0% (th=0.426)
+  for-routed    33.3%   33.3%   0.556     1.000    50.0% (th=0.663)
+  random         6.2%   12.5%   0.211     0.500   <- floor (uniform-random ranking; auc 0.5 by definition)
+  provenance hit@1 (bm25-desc): router 0/0, desc 0/0, judged 2/3 (desc rows quote the descriptions - expect them easiest; judged is the honest number)
+  judged-only hit@1 per arm: overlap 2/3, name 1/3, bm25-desc 2/3, bm25-full 1/3, for-routed 1/3
+  router-magnet: with ripwire-router ADMITTED as a candidate it takes top-1 on 1/3 positive prompts (bm25-desc arm) - why it is excluded above
+  per-skill (bm25-desc): name / permitted-rows / won / pos-fires / false-fires / neg-fires
+    ripwire-before-you-build     0     0     1     1     0
+    ripwire-change-check         1     0     0     0     0
+    ripwire-find-bug             0     0     0     0     0
+    ripwire-fresh-eyes           0     0     0     0     1
+    ripwire-graph-query          0     0     0     0     0
+    ripwire-handoff              0     0     0     0     0
+    ripwire-layers               0     0     0     0     0
+    ripwire-mcp                  0     0     0     0     0
+    ripwire-navigate             1     1     1     0     0
+    ripwire-opt-remarks          0     0     0     0     0
+    ripwire-orient               1     1     1     0     0
+    ripwire-perf-target          0     0     0     0     0
+    ripwire-quality-bar          0     0     0     0     0
+    ripwire-reuse-first          0     0     0     0     0
+    ripwire-security-scan        0     0     0     0     0
+    ripwire-write-tests          0     0     0     0     0
+  misses (overlap):
+    line 3   want=ripwire-change-check got=ripwire-before-you-build "plan parallel worktrees so the lanes do not collide"
+… [19 more lines, 3665 bytes total]
+`````
+
+## `./build/ripwire wrap claude`
+
+*Print the recipe to wire ripwire into Claude Code as an MCP server.*
+
+`````
+# ripwire -> Claude Code (CLI-first)
+# RECOMMENDED — this agent can run shell commands, so call the CLI directly. It costs
+# nothing until you invoke it, and it reads CLAUDE.md, so the paste block below IS the wiring:
+ripwire . --for="<your task>"
+#
+# ...every follow-up call answers with the compact legend by default (terse definitions of only the
+# attributes the answer carries; the payload is byte-identical either way). Add --legend=full when a
+# definition's reasoning is needed -- `ripwire --help` carries the measured saving (one place,
+# gate-held) -- this line does not repeat it, because two copies of a number is one that goes stale:
+#   ripwire . --callers=SYM --legend=full
+#
+# ALTERNATIVE — register the MCP server instead, for a warm index across calls:
+claude mcp add ripwire -- ripwire --mcp
+# verbs the agent can then call mid-task (33 total):
+#   read:             analyze, rank_by, find_symbol, find_referencing_symbols, grep, cochange, memory_recall, situational_awareness, mentions, for, lego, owners, fetch_body, batch, flags, doc_drift, slice
+#   flagship reflex:  exemplar, quality_delta, quality_baseline, impact, uses, affected, path_between, connect, explore, from_trace, edit_check, whereis, stray_content
+#   edit:             replace_symbol_body, insert_before_symbol, insert_after_symbol
+bash skills/install.sh   # deploy to ${CLAUDE_CONFIG_DIR:-~/.claude}/skills (drift-gated)
+bash skills/install.sh --hook   # RECOMMENDED: advisory Read/Grep -> ripwire CLI nudge + session primer (opt-in, never blocks)
+#
+# context wiring — a binary on PATH is invisible to an agent until its rules file says when
+# to reach for it. Paste the block below into CLAUDE.md:
+# --- paste into CLAUDE.md ---
+## ripwire — deterministic codebase maps (on PATH as `ripwire`)
+Reach for it BEFORE blind grep + whole-file reads. First call ~1s cold; after that warm, ~0.1s.
+- Orient on a task: `ripwire <dir> --for="<task in words>"` — ranked, quality-annotated
+  signatures. Paste symbol/file names from the issue verbatim; named mentions get anchored.
+- One task: `--pack-task="<task>" --legend=compact`; before parallel agents: `--plan-lanes=N --task="<goal>"`, then read `lanes[].execution`.
+- Have a stack trace / build error: `ripwire <dir> --from-trace=FILE --legend=compact` (`-` = stdin) —
+  paste the error, don't paraphrase it into a query.
+… [14 more lines, 4058 bytes total]
+`````
+
+## `./build/ripwire --version`
+
+*Version + short build info.*
+
+`````
+ripwire 0.6.8 (dev, AppleClang 21.0.0.21000101, emit=std::print, built_from=0712a5182)
+`````
+
+
+---
+
+# navigate — seeds, claims, slices, shapes
+
+## `./build/ripwire . --at=src/graph.h:11811`
+
+*Hold a LOCATION, not a name: the enclosing-definition chain at FILE:LINE (a compiler error, a diff hunk, a stack frame), outermost -> innermost.*
+
+`````
+<!-- ripwire at schema=ripwire.at/v1: enclosing-definition chain at p=:l=: sym= innermost, chain= outermost-first, <s n= t= l= el=> spans. root=: p= relative to it. -->
+<at schema="ripwire.at/v1" p="src/graph.h" l="11811" sym="rankGraphTeleport" chain="1" root=".">
+<s n="rankGraphTeleport" t="fn" l="11809" el="11837"/>
+</at>
+`````
+
+## `./build/ripwire . --callers=@src/graph.h:11811`
+
+*The same seed in a SELECTOR position: @FILE:LINE resolves to the innermost enclosing definition, then --callers runs on it.*
+
+**wall time: 1.43s**
+
+`````
+<!-- ripwire callers schema=ripwire.callers/v1: 1-hop CALLERS of of= (defs= matched, count= distinct symbols): <s t= n= p=>; hop_tested=/hop_untested=. counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. root=: p= relative to it. <s sites_at=>: its calls of the leaf name, any receiver, as file:line (p= is its def line); not proof each binds. next=: the one pasteable follow-up. -->
+<callers schema="ripwire.callers/v1" of="@src/graph.h:11811" defs="1" count="7" root="." hop_tested="0" hop_untested="7" graph_ambiguous="2933" graph_unresolved="15249" graph_unindexed="269" counts_floor="1" next="--uses=@src/graph.h:11811">
+<s t="fn" n="getIndex" p="src/mcpindex.h:1184" sites_at="src/mcpindex.h:1288"/>
+<s t="fn" n="rankGraph" p="src/graph.h:11850" sites_at="src/graph.h:11853"/>
+<s t="fn" n="anchoredLexicalRank" p="src/graph.h:12496" sites_at="src/graph.h:12547"/>
+<s t="fn" n="runEval" p="src/eval.h:171" sites_at="src/eval.h:328"/>
+<s t="fn" n="churnDecayRanking" p="src/main.cpp:1425" sites_at="src/main.cpp:1439"/>
+<s t="fn" n="churnRankedGraph" p="src/main.cpp:1464" sites_at="src/main.cpp:1478 src/main.cpp:1479 src/main.cpp:1493"/>
+<s t="fn" n="runDefaultMap" p="src/main.cpp:1751" sites_at="src/main.cpp:1871"/>
+</callers>
+`````
+
+## `./build/ripwire . --at=src/graph.h:999999`
+
+*A seed past the end of the file — the refusal shape for a faulted location.*
+
+**exit code: 1** — **wall time: 1.33s**
+
+`````
+(empty)
+`````
+
+stderr:
+
+`````
+ripwire: the at flag's seed 'src/graph.h:999999' named no location (./src/graph.h has only 16280 lines — the seed asked for line 999999)
+`````
+
+## `./build/ripwire . --verify="calls(runDefaultMap, rankGraphTeleport)"`
+
+*VERIFY a closed claim in one call: three-valued verdict (confirmed / refuted / not-established) with the evidence rows inline.*
+
+**wall time: 3.39s**
+
+`````
+<!-- ripwire verify schema=ripwire.verify/v1: ONE structured claim, verdict=confirmed|refuted|unknown, its witness rows <s t= n= p=> inline. window: shown= capped= (capped=1 cut). counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. root=: p= relative to it. claim=/shape=: the claim as given and its shape; from_defs=/to_defs=: defs each name resolved to. hops=N: call edges on the witness path (a confirmed reach claim only). -->
+<verify schema="ripwire.verify/v1" claim="calls(runDefaultMap, rankGraphTeleport)" shape="calls" verdict="confirmed" from_defs="1" to_defs="1" hops="1" root="." graph_ambiguous="2933" graph_unresolved="15249" graph_unindexed="269" counts_floor="1" shown="2" capped="0">
+<s t="fn" n="runDefaultMap" p="src/main.cpp:1751"/>
+<s t="fn" n="rankGraphTeleport" p="src/graph.h:11809"/>
+</verify>
+`````
+
+## `./build/ripwire . --verify="unused(rankGraphTeleport)"`
+
+*A claim that is FALSE — the refuted shape, with the references that refute it.*
+
+**wall time: 2.24s**
+
+`````
+<!-- ripwire verify schema=ripwire.verify/v1: ONE structured claim, verdict=confirmed|refuted|unknown, its witness rows <s t= n= p=> inline. window: shown= capped= (capped=1 cut). counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. root=: p= relative to it. claim=/shape=: the claim as given and its shape; from_defs=/to_defs=: defs each name resolved to. -->
+<verify schema="ripwire.verify/v1" claim="unused(rankGraphTeleport)" shape="unused" verdict="refuted" defs="1" external="0" count="9" root="." graph_ambiguous="2933" graph_unresolved="15249" graph_unindexed="269" counts_floor="1" shown="9" capped="0">
+<u role="call" p="src/eval.h:328" in_id="src/eval.h::rw::runEval"/>
+<u role="call" p="src/graph.h:11853" in_id="src/graph.h::rw::rankGraph"/>
+<u role="call" p="src/graph.h:12547" in_id="src/graph.h::rw::anchoredLexicalRank"/>
+<u role="call" p="src/main.cpp:1439" in_id="churnDecayRanking"/>
+<u role="call" p="src/main.cpp:1478" in_id="churnRankedGraph"/>
+<u role="call" p="src/main.cpp:1479" in_id="churnRankedGraph"/>
+<u role="call" p="src/main.cpp:1493" in_id="churnRankedGraph"/>
+<u role="call" p="src/main.cpp:1871" in_id="runDefaultMap"/>
+<u role="call" p="src/mcpindex.h:1288" in_id="src/mcpindex.h::rw::getIndex"/>
+</verify>
+`````
+
+## `./build/ripwire . --verify="contains(src/graph.h, \"no such literal anywhere\")"`
+
+*A literal-scan absence: refuted only with complete= evidence, never on a partial scan.*
+
+**wall time: 2.05s**
+
+`````
+<!-- ripwire verify schema=ripwire.verify/v1: ONE structured claim, verdict=confirmed|refuted|unknown, its witness rows <s t= n= p=> inline. window: shown= capped= (capped=1 cut). root=: p= relative to it. claim=/shape=: the claim as given and its shape; from_defs=/to_defs=: defs each name resolved to. -->
+<verify schema="ripwire.verify/v1" claim="contains(src/graph.h, &quot;no such literal anywhere&quot;)" shape="contains" verdict="refuted" hits="0" root="." complete="1" shown="0" capped="0">
+</verify>
+`````
+
+## `./build/ripwire . --verify="frobnicate(x)"`
+
+*An unparseable claim — the refusal names the accepted shapes.*
+
+**exit code: 1** — **wall time: 1.51s**
+
+`````
+(empty)
+`````
+
+stderr:
+
+`````
+ripwire: --verify claim not recognized: 'frobnicate(x)' — unknown shape word. The claim language is CLOSED; the shapes are: calls(A, B) does A transitively call B · uses(SYM) is SYM referenced anywhere · unused(SYM) is SYM referenced nowhere · contains(FILE, "LITERAL") do FILE's bytes contain t … [line truncated: 218 more bytes on this line]
+`````
+
+## `./build/ripwire . --slice=rankGraphTeleport`
+
+*Bare --slice=SYM: the INVENTORY of sliceable locals (<v n= l= t=/>), so a caller can pick VAR.*
+
+**wall time: 4.32s**
+
+`````
+<!-- ripwire slice schema=ripwire.slice/v1: name-based def-use rows of one variable in one definition: <s l= k=def|use|both|scope t= [b= pp= rd=]> (rd= reaching-def lines per reach=cfg|linear), <v n= l= t=> inventory; steps=/depth= flow. at=: commit+dirty+shallow. root=: p= relative to it. sym=/lang=: the sliced definition's name and language; p= is its file:line. vars=N: sliceable local bindings in the definition, one v row each; name one to slice it. counts=as-classified: defs=/uses=/vars=/steps= count what the name classifier rowed; neither floors nor totals. -->
+<slice sym="rankGraphTeleport" p="src/graph.h:11809" t="fn" lang="cpp" schema="ripwire.slice/v1" vars="14" at="0712a5182" root="." counts="as-classified">
+<v n="alpha" l="11809" t="param"/>
+<v n="g" l="11809" t="param"/>
+<v n="p" l="11809" t="param"/>
+<v n="pw" l="11812" t="decl"/>
+<v n="N" l="11813" t="decl"/>
+<v n="teleport" l="11814" t="decl"/>
+<v n="rankDouble" l="11815" t="decl"/>
+<v n="run" l="11816" t="decl"/>
+<v n="teleportMass" l="11819" t="decl"/>
+<v n="value" l="11820" t="decl"/>
+<v n="inverseMass" l="11826" t="decl"/>
+<v n="value" l="11827" t="decl"/>
+<v n="r" l="11834" t="decl"/>
+<v n="value" l="11835" t="param"/>
+</slice>
+`````
+
+## `./build/ripwire . --slice=rankGraphTeleport:teleport`
+
+*Intra-procedural def-use slice of ONE variable: one <s> row per line touching it, k=def|use|both, reaching definitions flow-sensitive (reach=cfg).*
+
+**wall time: 4.58s**
+
+`````
+<!-- ripwire slice schema=ripwire.slice/v1: name-based def-use rows of one variable in one definition: <s l= k=def|use|both|scope t= [b= pp= rd=]> (rd= reaching-def lines per reach=cfg|linear), <v n= l= t=> inventory; steps=/depth= flow. at=: commit+dirty+shallow. root=: p= relative to it. sym=/lang=: the sliced definition's name and language; p= is its file:line. order=defuse: seed s rows (no v=) ranked among these rows by def-use coverage (distinct local names on the line) desc, then line; not source order, not a whole-function ranking (measured at chance — docs/EVALS.md) — flow s rows (v=) keep their (d=,l=,v=) order. counts=as-classified: defs=/uses=/vars=/steps= count what the name classifier rowed; neither floors nor totals. -->
+<slice sym="rankGraphTeleport" p="src/graph.h:11809" t="fn" lang="cpp" schema="ripwire.slice/v1" var="teleport" defs="1" uses="3" reach="cfg" order="defuse" at="0712a5182" root="." counts="as-classified">
+<s l="11832" k="use" t="call-arg" rd="11814">
+<![CDATA[run = pageRankDouble( g.inEdges, g.wOutDeg, teleport, rankDouble, PageRankConfig{ .alpha = double( alpha ) } );]]>
+</s>
+<s l="11814" k="def" t="decl">
+<![CDATA[std::vector<double> teleport( pw.begin(), pw.end() );]]>
+</s>
+<s l="11820" k="use" t="read" rd="11814">
+<![CDATA[for( const double value : teleport )]]>
+</s>
+<s l="11827" k="use" t="read" rd="11814">
+<![CDATA[for( double& value : teleport )]]>
+</s>
+</slice>
+`````
+
+## `./build/ripwire . --slice=rankGraphTeleport:teleport --slice-flow=back --slice-depth=3`
+
+*TRANSITIVE backward value-flow from the seed variable, bounded BFS (depth= disclosed; a cut frontier says flow_truncated=1).*
+
+**wall time: 5.45s**
+
+`````
+<!-- ripwire slice schema=ripwire.slice/v1: name-based def-use rows of one variable in one definition: <s l= k=def|use|both|scope t= [b= pp= rd=]> (rd= reaching-def lines per reach=cfg|linear), <v n= l= t=> inventory; steps=/depth= flow. at=: commit+dirty+shallow. root=: p= relative to it. sym=/lang=: the sliced definition's name and language; p= is its file:line. order=defuse: seed s rows (no v=) ranked among these rows by def-use coverage (distinct local names on the line) desc, then line; not source order, not a whole-function ranking (measured at chance — docs/EVALS.md) — flow s rows (v=) keep their (d=,l=,v=) order. counts=as-classified: defs=/uses=/vars=/steps= count what the name classifier rowed; neither floors nor totals. -->
+<slice sym="rankGraphTeleport" p="src/graph.h:11809" t="fn" lang="cpp" schema="ripwire.slice/v1" var="teleport" defs="1" uses="3" reach="cfg" flow="back" depth="3" steps="3" order="defuse" at="0712a5182" root="." counts="as-classified">
+<s l="11832" k="use" t="call-arg" rd="11814">
+<![CDATA[run = pageRankDouble( g.inEdges, g.wOutDeg, teleport, rankDouble, PageRankConfig{ .alpha = double( alpha ) } );]]>
+</s>
+<s l="11814" k="def" t="decl">
+<![CDATA[std::vector<double> teleport( pw.begin(), pw.end() );]]>
+</s>
+<s l="11820" k="use" t="read" rd="11814">
+<![CDATA[for( const double value : teleport )]]>
+</s>
+<s l="11827" k="use" t="read" rd="11814">
+<![CDATA[for( double& value : teleport )]]>
+</s>
+<s l="11812" k="def" t="decl" v="pw" d="1" f="11814">
+<![CDATA[const std::vector<float> pw = biasPrior( g, p );]]>
+</s>
+<s l="11809" k="def" t="param" v="g" d="2" f="11812">
+<![CDATA[inline RankedGraph rankGraphTeleport( const Graph& g, const std::vector<float>& p, float alpha = 0.85f )]]>
+</s>
+<s l="11809" k="def" t="param" v="p" d="2" f="11812">
+<![CDATA[inline RankedGraph rankGraphTeleport( const Graph& g, const std::vector<float>& p, float alpha = 0.85f )]]>
+</s>
+</slice>
+`````
+
+## `./build/ripwire . --slice=rankGraphTeleport:teleport --slice-flow=fwd`
+
+*Forward flow: which statements the seed's value reaches, at the default depth bound.*
+
+**wall time: 2.97s**
+
+`````
+<!-- ripwire slice schema=ripwire.slice/v1: name-based def-use rows of one variable in one definition: <s l= k=def|use|both|scope t= [b= pp= rd=]> (rd= reaching-def lines per reach=cfg|linear), <v n= l= t=> inventory; steps=/depth= flow. at=: commit+dirty+shallow. root=: p= relative to it. sym=/lang=: the sliced definition's name and language; p= is its file:line. order=defuse: seed s rows (no v=) ranked among these rows by def-use coverage (distinct local names on the line) desc, then line; not source order, not a whole-function ranking (measured at chance — docs/EVALS.md) — flow s rows (v=) keep their (d=,l=,v=) order. counts=as-classified: defs=/uses=/vars=/steps= count what the name classifier rowed; neither floors nor totals. -->
+<slice sym="rankGraphTeleport" p="src/graph.h:11809" t="fn" lang="cpp" schema="ripwire.slice/v1" var="teleport" defs="1" uses="3" reach="cfg" flow="fwd" depth="8" steps="7" order="defuse" at="0712a5182" root="." counts="as-classified">
+<s l="11832" k="use" t="call-arg" rd="11814">
+<![CDATA[run = pageRankDouble( g.inEdges, g.wOutDeg, teleport, rankDouble, PageRankConfig{ .alpha = double( alpha ) } );]]>
+</s>
+<s l="11814" k="def" t="decl">
+<![CDATA[std::vector<double> teleport( pw.begin(), pw.end() );]]>
+</s>
+<s l="11820" k="use" t="read" rd="11814">
+<![CDATA[for( const double value : teleport )]]>
+</s>
+<s l="11827" k="use" t="read" rd="11814">
+<![CDATA[for( double& value : teleport )]]>
+</s>
+<s l="11822" k="use" t="read" v="value" d="2" f="11820" b="11820">
+<![CDATA[teleportMass += value;]]>
+</s>
+<s l="11829" k="both" t="assign" v="value" d="2" f="11827" b="11827">
+<![CDATA[value *= inverseMass;]]>
+</s>
+<s l="11836" k="use" t="read" v="run" d="2" f="11832">
+<![CDATA[return { std::move( r ), run.iterationCount, run.hasConverged };]]>
+</s>
+<s l="11822" k="both" t="assign" v="teleportMass" d="3" f="11822">
+<![CDATA[teleportMass += value;]]>
+</s>
+<s l="11824" k="use" t="read" v="teleportMass" d="3" f="11822">
+<![CDATA[if( teleportMass > 0.0 )]]>
+</s>
+<s l="11826" k="use" t="read" v="teleportMass" d="3" f="11822">
+<![CDATA[const double inverseMass = 1.0 / teleportMass;]]>
+</s>
+<s l="11829" k="use" t="read" v="inverseMass" d="4" f="11826">
+<![CDATA[value *= inverseMass;]]>
+</s>
+</slice>
+`````
+
+## `./build/ripwire . --slice=rankGraphTeleport:nosuchvar`
+
+*A variable the definition does not bind — the refusal shape, naming the inventory.*
+
+**exit code: 1** — **wall time: 1.27s**
+
+`````
+(empty)
+`````
+
+stderr:
+
+`````
+ripwire: --slice: no occurrence of 'nosuchvar' in rankGraphTeleport — sliceable locals: alpha, g, p, pw, N, teleport, rankDouble, run, teleportMass, value, inverseMass, r (bare --slice=rankGraphTeleport lists them with first-def lines)
+`````
+
+## `./build/ripwire . --slice-depth=3`
+
+*--slice-depth without --slice-flow is refused loudly rather than silently ignored.*
+
+**exit code: 1**
+
+`````
+(empty)
+`````
+
+stderr:
+
+`````
+ripwire: --slice-depth bounds the --slice-flow BFS — pass both (e.g. ripwire <dir> --slice=parseArgs:argIndex --slice-flow=fwd --slice-depth=4)
+`````
+
+## `./build/ripwire . --slice=rankGraphTeleport:teleport --legend=compact`
+
+*The compact legend posture: rows byte-identical, a versioned schema id replaces the repeated explanatory prose — for a many-small-calls loop.*
+
+**wall time: 3.07s**
+
+`````
+<!-- ripwire slice schema=ripwire.slice/v1: name-based def-use rows of one variable in one definition: <s l= k=def|use|both|scope t= [b= pp= rd=]> (rd= reaching-def lines per reach=cfg|linear), <v n= l= t=> inventory; steps=/depth= flow. at=: commit+dirty+shallow. root=: p= relative to it. sym=/lang=: the sliced definition's name and language; p= is its file:line. order=defuse: seed s rows (no v=) ranked among these rows by def-use coverage (distinct local names on the line) desc, then line; not source order, not a whole-function ranking (measured at chance — docs/EVALS.md) — flow s rows (v=) keep their (d=,l=,v=) order. counts=as-classified: defs=/uses=/vars=/steps= count what the name classifier rowed; neither floors nor totals. -->
+<slice sym="rankGraphTeleport" p="src/graph.h:11809" t="fn" lang="cpp" schema="ripwire.slice/v1" var="teleport" defs="1" uses="3" reach="cfg" order="defuse" at="0712a5182" root="." counts="as-classified">
+<s l="11832" k="use" t="call-arg" rd="11814">
+<![CDATA[run = pageRankDouble( g.inEdges, g.wOutDeg, teleport, rankDouble, PageRankConfig{ .alpha = double( alpha ) } );]]>
+</s>
+<s l="11814" k="def" t="decl">
+<![CDATA[std::vector<double> teleport( pw.begin(), pw.end() );]]>
+</s>
+<s l="11820" k="use" t="read" rd="11814">
+<![CDATA[for( const double value : teleport )]]>
+</s>
+<s l="11827" k="use" t="read" rd="11814">
+<![CDATA[for( double& value : teleport )]]>
+</s>
+</slice>
+`````
+
+## `./build/ripwire . --pattern='rankGraphTeleport($A, $B, $C)'`
+
+*Structural search written in CODE: $NAME binds one node; grammars=/shapes= disclose what the pattern became per grammar (a 3-argument call shape — the 2-argument spelling has no call site in this repo and correctly reports hits=0).*
+
+**wall time: 2.04s**
+
+`````
+<!-- ripwire pattern schema=ripwire.pattern/v1: structural pattern hits with their enclosing symbol. window: shown= capped= (capped=1 cut). hits_capped=1: hits= is a floor. root=: p= relative to it. -->
+<pattern schema="ripwire.pattern/v1" hits="1" shown="1" capped="0" hits_capped="0" q="rankGraphTeleport($A, $B, $C)" grammars="cpp,cpp/cu,c,python,go,rust,typescript,tsx,swift,objc,javascript,java,csharp" shapes="cpp:call_expression,cpp/cu:call_expression,c:call_expression,python:call,go:call_expres … [line truncated: 309 more bytes on this line]
+<m p="src/graph.h:11853" in="rankGraph">rankGraphTeleport( g, std::vector&lt;float&gt;( N, N ? 1.0f / float( N ) : 0.f ), alpha )</m>
+</pattern>
+`````
+
+## `./build/ripwire . --pattern='DISCLOSE(...)'`
+
+*The ellipsis form over a macro-shaped call site; unsupported= names the families this verb does not serve.*
+
+**wall time: 2.53s**
+
+`````
+<!-- ripwire pattern schema=ripwire.pattern/v1: structural pattern hits with their enclosing symbol. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). ellipsis_capped=: 1 = cut. hits_capped=1: hits= is a floor. root=: p= relative to it. -->
+<pattern schema="ripwire.pattern/v1" hits="297" shown="100" capped="1" total="297" has_more="1" next_offset="100" offset="0" limit="0" hits_capped="0" q="DISCLOSE(...)" grammars="cpp,cpp/cu,c,python,go,rust,typescript,tsx,swift,objc,javascript,java,csharp" shapes="cpp:call_expression,cpp/cu:call_exp … [line truncated: 446 more bytes on this line]
+<m p="src/abicheck.h:494" in="collectAuthoredSites">DISCLOSE( result, AbiResult::DisclosureWhy::NoMergeBase, "abi: no merge-base for a ref (unrelated history?) — that ref</m>
+<m p="src/arch.h:507" in="parseArchRules">DISCLOSE( Diagnostics::answerRefused, "--arch exits 1 with path:line and the reason on stderr; no report is printed",   </m>
+<m p="src/arch.h:846" in="readArchBaselineSidecar">DISCLOSE( baseline, ArchBaselineRead::DisclosureWhy::SymlinkRefused, "arch: refusing to read the arch baseline sidecar t</m>
+<m p="src/arch.h:897" in="openArchBaselineSidecar">DISCLOSE( Diagnostics::answerRefused, "--baseline exits 1: pathguard names the refused link on stderr and the verb says </m>
+<m p="src/atoms.h:372" in="collectExclusions">DISCLOSE( ex, Exclusions::DisclosureWhy::ForHeaderSaturated, "atoms: the for-header exclusion stream spent its whole bud</m>
+<m p="src/atoms.h:376" in="collectExclusions">DISCLOSE( ex, Exclusions::DisclosureWhy::StmtCrementSaturated, "atoms: the statement-crement exclusion stream spent its </m>
+<m p="src/atoms.h:380" in="collectExclusions">DISCLOSE( ex, Exclusions::DisclosureWhy::StmtAssignSaturated, "atoms: the statement-assign exclusion stream spent its wh</m>
+<m p="src/atoms.h:384" in="collectExclusions">DISCLOSE( ex, Exclusions::DisclosureWhy::InnerCommaSaturated, "atoms: the inner-comma exclusion stream spent its whole b</m>
+<m p="src/clones.h:909" in="findClonesType3">DISCLOSE( st, Type3Stats::DisclosureWhy::PairCapHit, "clones: Type-3 pair cap hit — first N compared (both-gate-surviv</m>
+<m p="src/commentcoherence.h:216" in="computeCommentCoherence">DISCLOSE( scan, CommentCoherenceScan::DisclosureWhy::UnreadableFile, "comment-coherence: an indexed file could not be re</m>
+<m p="src/crossref.h:557" in="streamBlobs">DISCLOSE( st, StreamBlobStats::DisclosureWhy::ListUnwritable, "crossref: cannot write the blob-batch list — cross-bran</m>
+<m p="src/crossref.h:573" in="streamBlobs">DISCLOSE( st, StreamBlobStats::DisclosureWhy::BatchNotStarted, "crossref: git cat-file --batch failed to start — cross</m>
+<m p="src/crossref.h:635" in="streamBlobs">DISCLOSE( st, StreamBlobStats::DisclosureWhy::StreamEndedMidBlob,                       "crossref: git cat-file stream e</m>
+<m p="src/crossref.h:849" in="enumerateRefs">DISCLOSE( dropSink, RefEnumeration::DisclosureWhy::TipNotObjectName, "crossref: for-each-ref yielded a ref whose tip is </m>
+<m p="src/crossref.h:881" in="diffRaw">DISCLOSE( "crossref: refusing a diff whose revision arguments are not resolved object names" )</m>
+<m p="src/crossref.h:984" in="parallelIndexed">DISCLOSE( sweep, ParallelSweep::DisclosureWhy::WorkerThrew, "crossref: a git worker threw — this shard of the sweep is</m>
+<m p="src/crossref.h:1038" in="streamBlobsInSlices">DISCLOSE( stats, StreamBlobStats::DisclosureWhy::BatchNotStarted, "crossref: a blob-stream slice was never read — comp</m>
+<m p="src/crossref.h:1256" in="probeRefBase">DISCLOSE( plumb, RefPlumbing::DisclosureWhy::RevisionNotObjectName, "crossref: ref tip or HEAD is not a resolved object </m>
+<m p="src/crossref.h:1267" in="probeRefBase">DISCLOSE( plumb, RefPlumbing::DisclosureWhy::MergeBaseNotObjectName, "crossref: merge-base returned something that is no</m>
+<m p="src/crossref.h:1274" in="probeRefBase">DISCLOSE( plumb, RefPlumbing::DisclosureWhy::NoMergeBase, "crossref: no merge-base for ref (shallow clone or unrelated h</m>
+<m p="src/crossref.h:2253" in="lsTree">DISCLOSE( "crossref: refusing to list a tree whose revision argument is not a resolved object name" )</m>
+<m p="src/crossref.h:2649" in="relabelHeadHitsFromIndex">DISCLOSE( "whereis: the index's def sites match no HEAD row (working tree drifted from HEAD?) — keeping the lexical la</m>
+<m p="src/crossref.h:2882" in="readBranchParseBatch">DISCLOSE( reads[ k ], BranchBlobReadBack::DisclosureWhy::NotReadBackWhole,                       "whereis: a blob the pa</m>
+<m p="src/crossref.h:3110" in="scanWorktree">DISCLOSE( scan, WorktreeScan::DisclosureWhy::ListingFailed, "whereis: git could not list the working tree's changes — </m>
+<m p="src/crossref.h:3120" in="scanWorktree">DISCLOSE( scan, WorktreeScan::DisclosureWhy::OverPathCap, "whereis: more changed paths than the overlay reads — the re</m>
+<m p="src/crossref.h:3131" in="scanWorktree">DISCLOSE( scan, WorktreeScan::DisclosureWhy::CopyUnread, "whereis: a changed path could not be read from the working tre</m>
+<m p="src/crossref.h:3516" in="whereisSitesOf">DISCLOSE( Diagnostics::answerUnchanged, "lsTree lists the same rows per ref: only slower",                   "crossref: </m>
+<m p="src/darkflags.h:968" in="collectCMakeFiles">DISCLOSE( out, CMakeScan::DisclosureWhy::SymlinkEscapesRoot, "flags: a CMake file's symlink target leaves the root — f</m>
+… [73 more display lines; full output is 17772 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --pattern='x'`
+
+*A pattern that collapses to a bare token is REFUSED — never reported as hits=0.*
+
+**exit code: 1** — **wall time: 1.79s**
+
+`````
+(empty)
+`````
+
+stderr:
+
+`````
+ripwire: --pattern: this pattern collapses to a single bare token, which is a TEXT search, not a structural one — a clean parse is not enough (a bare word parses fine in most grammars and means nothing structural). Give it a shape (foo($X), $A + $B, if ($C) { ... }) or use the grep flag for litera … [line truncated: 176 more bytes on this line]
+`````
+
+## `./build/ripwire . --grep=DISCLOSE --and=cache`
+
+*Boolean grep: hits where BOTH literals share the matched line (--grep-scope=line is the default).*
+
+**wall time: 2.42s**
+
+`````
+<!-- ripwire grep schema=ripwire.grep/v1: literal/regex scan grouped by file: <f p=>
+<hit l= in=>CDATA text</hit> (<b>/<a> context around it); complete=1 only for an exhaustive literal scan (beside pattern_meta=, of the literal reading only); <unindexed> = off-index. window: shown= capped= (capped=1 cut). hits_capped=1: hits= is a floor. root=: p= relative to it. parse_degraded=1: E … [line truncated: 1494 more bytes on this line]
+<grep pattern="DISCLOSE" schema="ripwire.grep/v1" root="." terms="DISCLOSE +cache" scope="line" terms_suppressed="1018" files="9" hits="26" shown="26" capped="0" hits_capped="0" suppressed_comment="2" suppressed_string="8" tier_parsed="13" tier_unclassified="0" corpus_oversize="15" corpus_pruned_dir … [line truncated: 119 more bytes on this line]
+<f p="src/ingest_cache.h">
+<hit l="2152" in="openCacheFrame" n="5">
+<![CDATA[            DISCLOSE( Diagnostics::answerUnchanged, "a rejected cache is rebuilt from source: this run parses and answers byte-identically",]]>
+<at l="2160" in="openCacheFrame"/>
+<at l="2168" in="openCacheFrame"/>
+<at l="2240" in="openCacheFrame"/>
+<at l="2335" in="ByteR::fitsBelow"/>
+</hit>
+<hit l="2200" in="openCacheFrame" n="4">
+<![CDATA[        DISCLOSE( Diagnostics::answerUnchanged, "a rejected cache is rebuilt from source: this run parses and answers byte-identically",]]>
+<at l="2218" in="openCacheFrame"/>
+<at l="2524" in="readDef"/>
+<at l="2670" in="readFileRecord"/>
+</hit>
+<hit l="2708" in="readFileRecord">
+<![CDATA[                DISCLOSE( Diagnostics::answerUnchanged, "a rejected cache is rebuilt from source: this run parses and answers byte-identically",]]>
+</hit>
+<hit l="3502" in="saveCache">
+<![CDATA[        DISCLOSE( Diagnostics::answerUnchanged, "this answer is already computed in memory: only the next run starts cold", "ingest: saveCache rename(tmp -> cache) failed — old cache preserved" );]]>
+</hit>
+</f>
+<f p="src/ingest_crawl.h" parse_degraded="1">
+<hit l="2150" in="isReadableCacheBlob">
+<![CDATA[        DISCLOSE( Diagnostics::answerUnchanged, "a rejected cache is rebuilt from source: this run parses and answers byte-identically",]]>
+</hit>
+</f>
+<f p="src/ingest_docpass.h">
+… [104 more display lines; full output is 10166 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --grep=DISCLOSE --not=test --grep-scope=file`
+
+*Drop every hit in a file that ALSO contains the --not literal anywhere (file scope).*
+
+**wall time: 1.22s**
+
+`````
+<!-- ripwire grep schema=ripwire.grep/v1: literal/regex scan grouped by file: <f p=>
+<hit l= in=>CDATA text</hit> (<b>/<a> context around it); complete=1 only for an exhaustive literal scan (beside pattern_meta=, of the literal reading only); <unindexed> = off-index. window: shown= capped= (capped=1 cut). hits_capped=1: hits= is a floor. root=: p= relative to it. parse_degraded=1: E … [line truncated: 1293 more bytes on this line]
+<grep pattern="DISCLOSE" schema="ripwire.grep/v1" root="." terms="DISCLOSE -test" scope="file" terms_suppressed="1014" files="6" hits="13" shown="13" capped="0" hits_capped="0" suppressed_comment="28" tier_parsed="22" tier_unclassified="0" corpus_oversize="15" corpus_pruned_dirs="5" unindexed_hits=" … [line truncated: 100 more bytes on this line]
+<f p="src/commentcoherence.h" parse_degraded="1">
+<hit l="216" in="rw::computeCommentCoherence">
+<![CDATA[                DISCLOSE( scan, CommentCoherenceScan::DisclosureWhy::UnreadableFile, "comment-coherence: an indexed file could not be read — its functions are absent from the report" );]]>
+</hit>
+</f>
+<f p="src/forctorhop.h">
+<hit l="168" in="rw::spliceCtorHop">
+<![CDATA[        DISCLOSE( Diagnostics::answerUnchanged, "no row carries ctor_l=: the answer is the one without the constructor hop",]]>
+</hit>
+</f>
+<f p="src/forslots.h">
+<hit l="180" in="rw::spliceInitSlots">
+<![CDATA[        DISCLOSE( Diagnostics::answerUnchanged, "no row carries slots=: the answer is the one without initializer slots",]]>
+</hit>
+</f>
+<f p="src/ingest_docpass.h">
+<hit l="34" in="rw::publishDocBridgeBlob" n="3">
+<![CDATA[        DISCLOSE( Diagnostics::answerUnchanged, "the doc text is kept for this run: only the bridge cache is not written",]]>
+<at l="42" in="rw::publishDocBridgeBlob"/>
+<at l="48" in="rw::publishDocBridgeBlob"/>
+</hit>
+<hit l="184" in="runDocPostPass">
+<![CDATA[                        DISCLOSE( "ingest: doc post-pass worker exception on a file — skipped" );]]>
+</hit>
+</f>
+<f p="src/ingest_prewarm.h">
+<hit l="213" in="refuseNesting">
+… [65 more display lines; full output is 6641 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --grep=DISCLOSE --grep=cache`
+
+*A second --grep= REFUSES and names --and= as the AND spelling — no silent overwrite.*
+
+**exit code: 1**
+
+`````
+(empty)
+`````
+
+stderr:
+
+`````
+ripwire: --grep given twice; did you mean --grep='A' --and='B'?
+`````
+
+## `./build/ripwire . --grep=DISCLOSE --grep-in=any`
+
+*Span tiers off: the exhaustive view — the comment and string hits the default tier held back (suppressed_comment=96 / suppressed_string=29 in the plain --grep block above) now print alongside the code hits; hits= grows accordingly.*
+
+**wall time: 1.83s**
+
+`````
+<!-- ripwire grep schema=ripwire.grep/v1: literal/regex scan grouped by file: <f p=>
+<hit l= in=>CDATA text</hit> (<b>/<a> context around it); complete=1 only for an exhaustive literal scan (beside pattern_meta=, of the literal reading only); <unindexed> = off-index. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). h … [line truncated: 1542 more bytes on this line]
+<grep pattern="DISCLOSE" schema="ripwire.grep/v1" root="." files="279" hits="1025" shown="100" capped="1" total="1025" has_more="1" next_offset="100" offset="0" limit="0" hits_capped="0" corpus_oversize="15" corpus_pruned_dirs="5" unindexed_hits="8" unindexed_files_scanned="268" unindexed_files_skip … [line truncated: 61 more bytes on this line]
+<f p=".coderabbit.yaml">
+<hit l="33" in="path_instructions" occ="2">
+<![CDATA[        A degrade path uses DISCLOSE( sink, why ), never ASSUME(false): a one-argument DISCLOSE( msg ) is a debug trace]]>
+</hit>
+</f>
+<f p=".github/workflows/ci.yml">
+<hit l="243" in="release">
+<![CDATA[    #   Release — defines NDEBUG, which compiles the DISCLOSE( msg ) trace out; the optimizer-visible build.]]>
+</hit>
+<hit l="244" in="release">
+<![CDATA[    #   plain   — NDEBUG off, so the DISCLOSE( msg ) trace compiles in and the degrade-path gates can observe]]>
+</hit>
+</f>
+<f p="docs/limits_build.py">
+<hit l="3">
+<![CDATA[# whether the file it lives in DISCLOSES a truncation when it fires.]]>
+</hit>
+</f>
+<f p="scripts/optremarks.py">
+<hit l="146" in="COLD_FILES">
+<![CDATA[      "the ASSUME / DISCLOSE handlers. They run on a degrade path: once, after something has already gone wrong." ),]]>
+</hit>
+</f>
+<f p="src/abicheck.h" parse_degraded="1">
+<hit l="111">
+<![CDATA[#include "infra/Diagnostics.h"  // ASSUME / DISCLOSE]]>
+</hit>
+… [417 more display lines; full output is 26519 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --grep=deterministic`
+
+*A literal whose classified hits are all prose: the answer serves tier="comment+string" rather than an empty code tier, and tier_unclassified= says how many hits the fixed parse budget never classified.*
+
+**wall time: 1.04s**
+
+`````
+<!-- ripwire grep schema=ripwire.grep/v1: literal/regex scan grouped by file: <f p=>
+<hit l= in=>CDATA text</hit> (<b>/<a> context around it); complete=1 only for an exhaustive literal scan (beside pattern_meta=, of the literal reading only); <unindexed> = off-index. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). c … [line truncated: 2219 more bytes on this line]
+<grep pattern="deterministic" schema="ripwire.grep/v1" root="." files="541" hits="1299" shown="100" capped="1" total="1299" has_more="1" next_offset="100" offset="0" limit="0" hits_capped="0" suppressed_comment="262" tier="code+string" tier_partial="1" tier_parsed="81" tier_unclassified="1404" tier_ … [line truncated: 230 more bytes on this line]
+<f p=".github/workflows/ci.yml">
+<hit l="854" in="windows">
+<![CDATA[          # on the machine is not one deterministic build step (G3). Read it back rather than assume it took.]]>
+</hit>
+<hit l="891" in="windows">
+<![CDATA[          # 951-byte legend plus one bare <r>, is deterministic across two runs, and parses as well-formed]]>
+</hit>
+</f>
+<f p="present/deck5_ripwire_build.js">
+<hit l="124">
+<![CDATA[  s.addText("A zero-runtime-dependency C++23 CLI that maps any codebase into a ranked, deterministic call graph for coding agents — and puts a tripwire on every claim it emits.",]]>
+</hit>
+<hit l="362">
+<![CDATA[    ["Kotlin", "by @xCatG: calls resolve between Kotlin and Java, both ways; no sanitizer finding across 501 real .kt files, deterministic on ~9,500 more (#126)", CYAN],]]>
+</hit>
+<hit l="388" line_bytes="574">
+<![CDATA[    "- Kotlin — merged: #126, merge commit 1ad9184a (2026-09-11); PR body, PR author xCatG: “vendored fwcd/tree-sitter-kotlin grammar … a JVM interop bridge that resolves Kotlin↔Java calls bidirectionally”; “Zero ASan/UBSan/LSan findings across 501 real .kt files (8 local Androi … [line truncated: 224 more bytes on this line]
+</hit>
+<hit l="458" line_bytes="532">
+<![CDATA[    "FOOTER (the instruments). From the release notes' Highlights: 'Three readouts, all registered before the work began, and none of them a model's opinion. A frozen bank of 30 retrieval questions, each answered in ONE call on a 2,066-file C++ corpus pinned at one commit, scored on the gol … [line truncated: 224 more bytes on this line]
+</hit>
+<hit l="1051">
+<![CDATA[    ["parallel parse", "query compile overlaps parse scheduling; files schedule by size — ids stay deterministic"],]]>
+</hit>
+<hit l="1386">
+<![CDATA[  foot(s, "the MCP server exposes the same deterministic engine — one index, shared with the CLI, staleness-checked");]]>
+</hit>
+… [668 more display lines; full output is 40164 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --grep=DISCLOSE --handles`
+
+*h= on each editable enclosing-symbol row: a freshness-pinned identity an edit verb can target and must refuse on after any file change.*
+
+**wall time: 1.09s**
+
+`````
+<!-- ripwire grep schema=ripwire.grep/v1: literal/regex scan grouped by file: <f p=>
+<hit l= in=>CDATA text</hit> (<b>/<a> context around it); complete=1 only for an exhaustive literal scan (beside pattern_meta=, of the literal reading only); <unindexed> = off-index. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). c … [line truncated: 2184 more bytes on this line]
+<grep pattern="DISCLOSE" schema="ripwire.grep/v1" root="." files="254" hits="856" shown="100" capped="1" total="856" has_more="1" next_offset="100" offset="0" limit="0" hits_capped="0" suppressed_comment="166" suppressed_string="5" tier_parsed="80" tier_unclassified="659" tier_budget="bytes" tier_fi … [line truncated: 201 more bytes on this line]
+<f p=".coderabbit.yaml">
+<hit l="33" in="path_instructions" occ="2">
+<![CDATA[        A degrade path uses DISCLOSE( sink, why ), never ASSUME(false): a one-argument DISCLOSE( msg ) is a debug trace]]>
+</hit>
+</f>
+<f p="src/abicheck.h" parse_degraded="1">
+<hit l="494" in="abicheck::collectAuthoredSites">
+<![CDATA[            DISCLOSE( result, AbiResult::DisclosureWhy::NoMergeBase, "abi: no merge-base for a ref (unrelated history?) — that ref is counted, not compared" );]]>
+</hit>
+</f>
+<f p="src/arch.h">
+<hit l="507" in="rw::parseArchRules">
+<![CDATA[        DISCLOSE( Diagnostics::answerRefused, "--arch exits 1 with path:line and the reason on stderr; no report is printed",]]>
+</hit>
+<hit l="846" in="rw::readArchBaselineSidecar">
+<![CDATA[    if( sidecar.refused ) { DISCLOSE( baseline, ArchBaselineRead::DisclosureWhy::SymlinkRefused, "arch: refusing to read the arch baseline sidecar through a symlink" ); }]]>
+</hit>
+<hit l="897" in="rw::openArchBaselineSidecar">
+<![CDATA[        DISCLOSE( Diagnostics::answerRefused, "--baseline exits 1: pathguard names the refused link on stderr and the verb says it cannot write the sidecar",]]>
+</hit>
+</f>
+<f p="src/atoms.h">
+<hit l="372" in="atomdetail::collectExclusions">
+<![CDATA[        DISCLOSE( ex, Exclusions::DisclosureWhy::ForHeaderSaturated, "atoms: the for-header exclusion stream spent its whole budget; the rules reading it are suppressed this run" );]]>
+</hit>
+<hit l="376" in="atomdetail::collectExclusions">
+<![CDATA[        DISCLOSE( ex, Exclusions::DisclosureWhy::StmtCrementSaturated, "atoms: the statement-crement exclusion stream spent its whole budget; the rules reading it are suppressed this run" );]]>
+… [434 more display lines; full output is 31626 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --grep=DISCLOSE --legend=compact`
+
+*The grep compact legend (ripwire.grep/v1).*
+
+**wall time: 1.33s**
+
+`````
+<!-- ripwire grep schema=ripwire.grep/v1: literal/regex scan grouped by file: <f p=>
+<hit l= in=>CDATA text</hit> (<b>/<a> context around it); complete=1 only for an exhaustive literal scan (beside pattern_meta=, of the literal reading only); <unindexed> = off-index. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). c … [line truncated: 2184 more bytes on this line]
+<grep pattern="DISCLOSE" schema="ripwire.grep/v1" root="." files="254" hits="856" shown="100" capped="1" total="856" has_more="1" next_offset="100" offset="0" limit="0" hits_capped="0" suppressed_comment="166" suppressed_string="5" tier_parsed="80" tier_unclassified="659" tier_budget="bytes" tier_fi … [line truncated: 201 more bytes on this line]
+<f p=".coderabbit.yaml">
+<hit l="33" in="path_instructions" occ="2">
+<![CDATA[        A degrade path uses DISCLOSE( sink, why ), never ASSUME(false): a one-argument DISCLOSE( msg ) is a debug trace]]>
+</hit>
+</f>
+<f p="src/abicheck.h" parse_degraded="1">
+<hit l="494" in="abicheck::collectAuthoredSites">
+<![CDATA[            DISCLOSE( result, AbiResult::DisclosureWhy::NoMergeBase, "abi: no merge-base for a ref (unrelated history?) — that ref is counted, not compared" );]]>
+</hit>
+</f>
+<f p="src/arch.h">
+<hit l="507" in="rw::parseArchRules">
+<![CDATA[        DISCLOSE( Diagnostics::answerRefused, "--arch exits 1 with path:line and the reason on stderr; no report is printed",]]>
+</hit>
+<hit l="846" in="rw::readArchBaselineSidecar">
+<![CDATA[    if( sidecar.refused ) { DISCLOSE( baseline, ArchBaselineRead::DisclosureWhy::SymlinkRefused, "arch: refusing to read the arch baseline sidecar through a symlink" ); }]]>
+</hit>
+<hit l="897" in="rw::openArchBaselineSidecar">
+<![CDATA[        DISCLOSE( Diagnostics::answerRefused, "--baseline exits 1: pathguard names the refused link on stderr and the verb says it cannot write the sidecar",]]>
+</hit>
+</f>
+<f p="src/atoms.h">
+<hit l="372" in="atomdetail::collectExclusions">
+<![CDATA[        DISCLOSE( ex, Exclusions::DisclosureWhy::ForHeaderSaturated, "atoms: the for-header exclusion stream spent its whole budget; the rules reading it are suppressed this run" );]]>
+</hit>
+<hit l="376" in="atomdetail::collectExclusions">
+<![CDATA[        DISCLOSE( ex, Exclusions::DisclosureWhy::StmtCrementSaturated, "atoms: the statement-crement exclusion stream spent its whole budget; the rules reading it are suppressed this run" );]]>
+… [434 more display lines; full output is 28801 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --for="tree-sitter parse of a source file" --legend=compact`
+
+*The --for compact legend (ripwire.for/v1) — every data/completeness attribute kept.*
+
+**wall time: 4.46s**
+
+`````
+<ctx task="tree-sitter parse of a source file" route="subtoken+body" root="." confidence="low" margin_pct="0" at="0712a5182" doc_mentions="3" schema="ripwire.for/v1" bundle="compact" bodies="0" reason="compact-route" budget_bytes="7500" est_tokens="7558">
+<!-- ripwire for schema=ripwire.for/v1: bundle=/bodies=/reason= the body posture; d: cx= ccx= complexity, in= callers (absent cx/ccx/in = 0), churn= amp= change, clone= tested= 1, sc= scope, id=p::sc::n; total= shown= capped=1 if cut; task= the query; d pure=1 const/constexpr sig, next= the follow-up to paste; route= name-exact(X)|subtoken+body[:broad|:declined]; confidence=/margin_pct= head score drop (low=flat); h l= p= n=, c n= l= (joined for same-named callees, shown= counts them), noedge= no callee resolved; fold kind=bodies: b t= n= p= l= top ranked rows' whole bodies, not the answer; served= of total= in budget_bytes=; slice/skip p= n= l=; slice members= of=: a big class's ctor, question-word members; skip bytes= next=; a skip makes sigs next= it, sigs_next= the signatures-only re-call; d mem= an owner's direct member names by the index (question words first, names only), mem_more= names cut; t p= file outside sigs (weaker), t sym= its top symbols (a pointer, not the answer), r= rank (gap = trimmed); field name= type= owner= rel=: a member of owner=, rel=creates held by value, uses by reference/pointer; iface implementors=N: types implementing it, m= its method contract; d layer=: built-in arch layer (game|infra|render|math|audio|ai|test) from a dir name in p=; d e= its last line (absent=unknown, never 0; l= the name's line) [doc mentions: 3 docs, 2 symbols; doc_mentions=] -->
+<!-- root= is the crawl root; p= below is RELATIVE to it (single-root only; absent => p= is ingest's own path, unchanged); at=this commit(+dirty). [budget_bytes= is the default BYTE target this ranked payload was shaped toward: row text shortens toward it, no row of the ranked head is removed for it (sigs past_target=)] [sigs capped=1 with shown=total: rows shrunk, none dropped] [sigs past_target=K: the last K rows are past the budget_bytes target, served because they are rows of the ranked head; none is cut] [sigs next=: one call serving all total= rows uncut] [docs_dropped=N: N shown rows have a doc comment not printed (r>24 always, r5..24 if capped)] [files_first=N: N rows moved so r=1..8 are distinct files' best rows, score order, a repeated name once; same rows; fold, hops keep score order]; lego/compose collapse to a counted stub by default (a disclosed cut): total= that section's own pre-cap row count, shown="0" capped="1" (nothing rendered here), next= names the sections=lego,compose flag that restores both sections byte-identically in one call est_tokens= prices this bundle in tokens -->
+<sigs shown="40" total="40" capped="1" past_target="7" docs_dropped="25" files_first="3" next="--for=&apos;tree-sitter parse of a source file&apos; --signatures-only --token-budget=5600">
+<d l="28" e="63" n="topLevelEvidence" sc="rw::pythonrunner" p="src/pythonrunner.h" cx="4" ccx="3" in="2" churn="5" amp="15" r="1" next="--expand=src/pythonrunner.h:topLevelEvidence">inline bool topLevelEvidence( std::string_view source, const TSLanguage* language, const Predicate&amp; predicate )</d … [line truncated: 1 more bytes on this line]
+<d l="45" e="45" n="kDefaultMaxFileBytes" sc="rw" p="src/ingest.h" churn="59" amp="165" pure="1" r="2">
+<doc>The crawl&apos;s per-file byte ceiling. A text file larger than this is skipped: at this size it is o…</doc>constexpr std::size_t kDefaultMaxFileBytes = 4u * 1024u * 1024u</d>
+<d l="1238" e="1246" n="parseTree" p="src/ingest_sidecap.h" cx="1" in="3" churn="139" amp="280" tested="1" r="3">TSTree* parseTree( TSParser* parser, std::string_view src )</d>
+<d l="593" e="667" n="doctorProbeGrammars" p="src/verbs_doctor.h" cx="7" ccx="17" in="1" churn="45" amp="129" r="4">
+<doc>Exercise every registered grammar and its embedded query, reporting loaded and expected totals</doc>inline DoctorGrammarProbe doctorProbeGrammars()</d>
+<d l="1797" e="1808" n="FileHealth" sc="FileHealth" p="src/model.h" churn="243" amp="430" r="5">struct FileHealth</d>
+<d l="100" e="232" n="kLangTable" p="src/ingest_crawl.h" churn="79" amp="208" pure="1" r="6">constexpr std::array&lt;LangEntry, 57&gt; kLangTable =</d>
+<d l="369" e="441" n="sliceAtRev" sc="slicediff" p="src/slicediff.h" cx="13" ccx="13" in="1" churn="12" amp="73" r="7">inline RevSide sliceAtRev( const std::string&amp; root, const std::string&amp; sha, const std::string&amp; rel, const Symbol&amp; sym, SliceFam fam, const ::TSLanguage* grammar…</ … [line truncated: 2 more bytes on this line]
+<d l="308" e="343" n="SliceScan" sc="SliceScan" p="src/slice.h" churn="51" amp="102" r="8" mem="disclose">struct SliceScan</d>
+<d l="456" e="491" n="AstWalk" sc="rw" p="src/ingest.h" churn="59" amp="165" r="9">enum class AstWalk : std::uint8_t</d>
+<d l="1307" e="1310" n="astroFenceTailIsBlank" p="src/ingest_sidecap.h" cx="1" in="2" churn="139" amp="279" tested="1" r="10">inline bool astroFenceTailIsBlank( std::string_view src, std::size_t from, std::size_t to ) noexcept</d>
+<d l="134" e="134" n="kMaxKotlinStringNestDepth" sc="rw" p="src/ingest.h" churn="59" amp="165" pure="1" r="11">constexpr std::uint32_t kMaxKotlinStringNestDepth = 128u</d>
+<d l="2122" e="2151" n="collectGatedLocalNames" sc="rw" p="src/ingest_astquery.h" cx="6" ccx="5" in="1" churn="44" amp="137" r="12">std::vector&lt;LocalNameFact&gt; collectGatedLocalNames( std::string_view defBytes, std::uint32_t defStartLine, Lang lang )</d>
+<d l="881" e="932" n="scanModule" sc="detail" p="src/jsrunner.h" cx="16" ccx="15" in="3" churn="17" amp="81" r="13">inline ModuleScan scanModule( std::string_view source, std::string_view path )</d>
+<d l="255" e="259" n="hasPhantomScopeSeparator" p="src/ingest_names.h" cx="2" ccx="1" in="2" churn="59" amp="163" tested="1" r="14">inline bool hasPhantomScopeSeparator( TSNode qualified ) noexcept</d>
+<d l="713" e="752" n="jsonNestsTooDeep" p="src/ingest_crawl.h" cx="13" ccx="20" in="1" churn="79" amp="209" tested="1" r="15">bool jsonNestsTooDeep( std::string_view bytes ) noexcept</d>
+<d l="87" e="97" n="hasMainGuard" sc="rw::pythonrunner" p="src/pythonrunner.h" cx="2" ccx="2" in="1" churn="5" amp="14" r="16">inline bool hasMainGuard( std::string_view source )</d>
+<d l="104" e="104" n="kMaxYamlNestDepth" sc="rw" p="src/ingest.h" churn="59" amp="165" pure="1" r="17">constexpr std::uint32_t kMaxYamlNestDepth = 64u</d>
+<d l="1819" e="1972" n="spanTiersOfFiles" sc="rw" p="src/ingest_astquery.h" cx="28" ccx="55" in="2" churn="44" amp="138" r="18">SpanTierBatch spanTiersOfFiles( std::span&lt;const std::string&gt; diskPaths, bool useMemo )</d>
+<d l="326" e="332" n="DisclosureWhy" sc="SliceScan" p="src/slice.h" churn="51" amp="102" r="19">enum class DisclosureWhy : std::uint8_t</d>
+<d l="2599" e="2663" n="sliceScanDefinition" sc="slicev" p="src/slice.h" cx="12" ccx="11" in="3" churn="51" amp="105" r="20">inline SliceScan sliceScanDefinition( const std::string&amp; src, const Symbol&amp; sym, SliceFam fam, const ::TSLanguage* grammar, std::string_view varName )</d>
+<d l="351" e="663" n="runParseWorker" p="src/ingest_parsepool.h" cx="50" ccx="116" in="1" churn="51" amp="137" tested="1" r="21">inline void runParseWorker( ParsePoolShared&amp; sh, unsigned t )</d>
+<d l="48" e="67" n="LintRule" sc="LintRule" p="src/lintrules.h" churn="55" amp="144" r="22">struct LintRule</d>
+<d l="1445" e="1470" n="measureHealthAdoptingMemberMacroReparse" p="src/ingest_sidecap.h" cx="7" ccx="6" in="2" churn="139" amp="279" tested="1" r="23">inline FileHealth measureHealthAdoptingMemberMacroReparse( TSParser* parser, Lang lang, std::string_view bytes, TreeGuard&amp; tree, MemberMacroRepa … [line truncated: 19 more bytes on this line]
+<d l="2757" e="2779" n="buildMemoryStopAttr" sc="rw" p="src/serialize.h" cx="7" ccx="8" in="2" churn="413" amp="527" r="24">inline std::string buildMemoryStopAttr( const IngestResult&amp; ing, bool json )</d>
+… [138 more display lines; full output is 19751 bytes on 44 raw line(s)]
+`````
+
+## `./build/ripwire . --for="tree-sitter parse of a source file" --sections=lego,compose`
+
+*Restore the <lego>/<compose> sections the --for bundle collapses to a counted stub by default (this is the stub's own next= spelling).*
+
+**wall time: 3.60s**
+
+`````
+<ctx task="tree-sitter parse of a source file" route="subtoken+body" root="." confidence="low" margin_pct="0" at="0712a5182" doc_mentions="3" schema="ripwire.for/v1" bundle="compact" bodies="0" reason="compact-route" budget_bytes="7500" est_tokens="7691">
+<!-- ripwire for schema=ripwire.for/v1: bundle=/bodies=/reason= the body posture; d: cx= ccx= complexity, in= callers (absent cx/ccx/in = 0), churn= amp= change, clone= tested= 1, sc= scope, id=p::sc::n; total= shown= capped=1 if cut; task= the query; d pure=1 const/constexpr sig, next= the follow-up to paste; route= name-exact(X)|subtoken+body[:broad|:declined]; confidence=/margin_pct= head score drop (low=flat); h l= p= n=, c n= l= (joined for same-named callees, shown= counts them), noedge= no callee resolved; fold kind=bodies: b t= n= p= l= top ranked rows' whole bodies, not the answer; served= of total= in budget_bytes=; slice/skip p= n= l=; slice members= of=: a big class's ctor, question-word members; skip bytes= next=; a skip makes sigs next= it, sigs_next= the signatures-only re-call; d mem= an owner's direct member names by the index (question words first, names only), mem_more= names cut; t p= file outside sigs (weaker), t sym= its top symbols (a pointer, not the answer), r= rank (gap = trimmed); field name= type= owner= rel=: a member of owner=, rel=creates held by value, uses by reference/pointer; iface implementors=N: types implementing it, m= its method contract; d layer=: built-in arch layer (game|infra|render|math|audio|ai|test) from a dir name in p=; d e= its last line (absent=unknown, never 0; l= the name's line) [doc mentions: 3 docs, 2 symbols; doc_mentions=] -->
+<!-- root= is the crawl root; p= below is RELATIVE to it (single-root only; absent => p= is ingest's own path, unchanged); at=this commit(+dirty). [budget_bytes= is the default BYTE target this ranked payload was shaped toward: row text shortens toward it, no row of the ranked head is removed for it (sigs past_target=)] [sigs capped=1 with shown=total: rows shrunk, none dropped] [sigs past_target=K: the last K rows are past the budget_bytes target, served because they are rows of the ranked head; none is cut] [sigs next=: one call serving all total= rows uncut] [docs_dropped=N: N shown rows have a doc comment not printed (r>24 always, r5..24 if capped)] [files_first=N: N rows moved so r=1..8 are distinct files' best rows, score order, a repeated name once; same rows; fold, hops keep score order] est_tokens= prices this bundle in tokens -->
+<sigs shown="40" total="40" capped="1" past_target="7" docs_dropped="25" files_first="3" next="--for=&apos;tree-sitter parse of a source file&apos; --signatures-only --token-budget=5600">
+<d l="28" e="63" n="topLevelEvidence" sc="rw::pythonrunner" p="src/pythonrunner.h" cx="4" ccx="3" in="2" churn="5" amp="15" r="1" next="--expand=src/pythonrunner.h:topLevelEvidence">inline bool topLevelEvidence( std::string_view source, const TSLanguage* language, const Predicate&amp; predicate )</d … [line truncated: 1 more bytes on this line]
+<d l="45" e="45" n="kDefaultMaxFileBytes" sc="rw" p="src/ingest.h" churn="59" amp="165" pure="1" r="2">
+<doc>The crawl&apos;s per-file byte ceiling. A text file larger than this is skipped: at this size it is o…</doc>constexpr std::size_t kDefaultMaxFileBytes = 4u * 1024u * 1024u</d>
+<d l="1238" e="1246" n="parseTree" p="src/ingest_sidecap.h" cx="1" in="3" churn="139" amp="280" tested="1" r="3">TSTree* parseTree( TSParser* parser, std::string_view src )</d>
+<d l="593" e="667" n="doctorProbeGrammars" p="src/verbs_doctor.h" cx="7" ccx="17" in="1" churn="45" amp="129" r="4">
+<doc>Exercise every registered grammar and its embedded query, reporting loaded and expected totals</doc>inline DoctorGrammarProbe doctorProbeGrammars()</d>
+<d l="1797" e="1808" n="FileHealth" sc="FileHealth" p="src/model.h" churn="243" amp="430" r="5">struct FileHealth</d>
+<d l="100" e="232" n="kLangTable" p="src/ingest_crawl.h" churn="79" amp="208" pure="1" r="6">constexpr std::array&lt;LangEntry, 57&gt; kLangTable =</d>
+<d l="369" e="441" n="sliceAtRev" sc="slicediff" p="src/slicediff.h" cx="13" ccx="13" in="1" churn="12" amp="73" r="7">inline RevSide sliceAtRev( const std::string&amp; root, const std::string&amp; sha, const std::string&amp; rel, const Symbol&amp; sym, SliceFam fam, const ::TSLanguage* grammar…</ … [line truncated: 2 more bytes on this line]
+<d l="308" e="343" n="SliceScan" sc="SliceScan" p="src/slice.h" churn="51" amp="102" r="8" mem="disclose">struct SliceScan</d>
+<d l="456" e="491" n="AstWalk" sc="rw" p="src/ingest.h" churn="59" amp="165" r="9">enum class AstWalk : std::uint8_t</d>
+<d l="1307" e="1310" n="astroFenceTailIsBlank" p="src/ingest_sidecap.h" cx="1" in="2" churn="139" amp="279" tested="1" r="10">inline bool astroFenceTailIsBlank( std::string_view src, std::size_t from, std::size_t to ) noexcept</d>
+<d l="134" e="134" n="kMaxKotlinStringNestDepth" sc="rw" p="src/ingest.h" churn="59" amp="165" pure="1" r="11">constexpr std::uint32_t kMaxKotlinStringNestDepth = 128u</d>
+<d l="2122" e="2151" n="collectGatedLocalNames" sc="rw" p="src/ingest_astquery.h" cx="6" ccx="5" in="1" churn="44" amp="137" r="12">std::vector&lt;LocalNameFact&gt; collectGatedLocalNames( std::string_view defBytes, std::uint32_t defStartLine, Lang lang )</d>
+<d l="881" e="932" n="scanModule" sc="detail" p="src/jsrunner.h" cx="16" ccx="15" in="3" churn="17" amp="81" r="13">inline ModuleScan scanModule( std::string_view source, std::string_view path )</d>
+<d l="255" e="259" n="hasPhantomScopeSeparator" p="src/ingest_names.h" cx="2" ccx="1" in="2" churn="59" amp="163" tested="1" r="14">inline bool hasPhantomScopeSeparator( TSNode qualified ) noexcept</d>
+<d l="713" e="752" n="jsonNestsTooDeep" p="src/ingest_crawl.h" cx="13" ccx="20" in="1" churn="79" amp="209" tested="1" r="15">bool jsonNestsTooDeep( std::string_view bytes ) noexcept</d>
+<d l="87" e="97" n="hasMainGuard" sc="rw::pythonrunner" p="src/pythonrunner.h" cx="2" ccx="2" in="1" churn="5" amp="14" r="16">inline bool hasMainGuard( std::string_view source )</d>
+<d l="104" e="104" n="kMaxYamlNestDepth" sc="rw" p="src/ingest.h" churn="59" amp="165" pure="1" r="17">constexpr std::uint32_t kMaxYamlNestDepth = 64u</d>
+<d l="1819" e="1972" n="spanTiersOfFiles" sc="rw" p="src/ingest_astquery.h" cx="28" ccx="55" in="2" churn="44" amp="138" r="18">SpanTierBatch spanTiersOfFiles( std::span&lt;const std::string&gt; diskPaths, bool useMemo )</d>
+<d l="326" e="332" n="DisclosureWhy" sc="SliceScan" p="src/slice.h" churn="51" amp="102" r="19">enum class DisclosureWhy : std::uint8_t</d>
+<d l="2599" e="2663" n="sliceScanDefinition" sc="slicev" p="src/slice.h" cx="12" ccx="11" in="3" churn="51" amp="105" r="20">inline SliceScan sliceScanDefinition( const std::string&amp; src, const Symbol&amp; sym, SliceFam fam, const ::TSLanguage* grammar, std::string_view varName )</d>
+<d l="351" e="663" n="runParseWorker" p="src/ingest_parsepool.h" cx="50" ccx="116" in="1" churn="51" amp="137" tested="1" r="21">inline void runParseWorker( ParsePoolShared&amp; sh, unsigned t )</d>
+<d l="48" e="67" n="LintRule" sc="LintRule" p="src/lintrules.h" churn="55" amp="144" r="22">struct LintRule</d>
+<d l="1445" e="1470" n="measureHealthAdoptingMemberMacroReparse" p="src/ingest_sidecap.h" cx="7" ccx="6" in="2" churn="139" amp="279" tested="1" r="23">inline FileHealth measureHealthAdoptingMemberMacroReparse( TSParser* parser, Lang lang, std::string_view bytes, TreeGuard&amp; tree, MemberMacroRepa … [line truncated: 19 more bytes on this line]
+<d l="2757" e="2779" n="buildMemoryStopAttr" sc="rw" p="src/serialize.h" cx="7" ccx="8" in="2" churn="413" amp="527" r="24">inline std::string buildMemoryStopAttr( const IngestResult&amp; ing, bool json )</d>
+… [149 more display lines; full output is 20084 bytes on 44 raw line(s)]
+`````
+
+## `./build/ripwire . --for="tree-sitter parse of a source file" --auto-bodies`
+
+*Opt OUT of compact conceptual serving: restore the rank-first auto <bodies> walk (bundle="auto").*
+
+**wall time: 4.28s**
+
+`````
+<ctx task="tree-sitter parse of a source file" route="subtoken+body" root="." confidence="low" margin_pct="0" at="0712a5182" doc_mentions="3" schema="ripwire.for/v1" bundle="auto" bodies="4" budget_bytes="7500" est_tokens="7576">
+<!-- ripwire for schema=ripwire.for/v1: bundle=/bodies=/reason= the body posture; d: cx= ccx= complexity, in= callers (absent cx/ccx/in = 0), churn= amp= change, clone= tested= 1, sc= scope, id=p::sc::n; total= shown= capped=1 if cut; task= the query; d pure=1 const/constexpr sig, next= the follow-up to paste; route= name-exact(X)|subtoken+body[:broad|:declined]; confidence=/margin_pct= head score drop (low=flat); b t= n= p= l= full bodies, c n= l= callee signatures; t p= file outside sigs (weaker), t sym= its top symbols (a pointer, not the answer), r= rank (gap = trimmed); field name= type= owner= rel=: a member of owner=, rel=creates held by value, uses by reference/pointer; iface implementors=N: types implementing it, m= its method contract; d layer=: built-in arch layer (game|infra|render|math|audio|ai|test) from a dir name in p=; d e= its last line (absent=unknown, never 0; l= the name's line) [doc mentions: 3 docs, 2 symbols; doc_mentions=] -->
+<!-- root= is the crawl root; p= below is RELATIVE to it (single-root only; absent => p= is ingest's own path, unchanged); at=this commit(+dirty). [budget_bytes= is the default BYTE target this ranked payload was shaped toward: row text shortens toward it, no row of the ranked head is removed for it (sigs past_target=)] [sigs capped=1 with shown=total: rows shrunk, none dropped] [sigs past_target=K: the last K rows are past the budget_bytes target, served because they are rows of the ranked head; none is cut] [sigs next=: one call serving all total= rows uncut] [docs_dropped=N: N shown rows have a doc comment not printed (r>24 always, r5..24 if capped)] [files_first=N: N rows moved so r=1..8 are distinct files' best rows, score order, a repeated name once; same rows; fold, hops keep score order]; lego/compose collapse to a counted stub by default (a disclosed cut): total= that section's own pre-cap row count, shown="0" capped="1" (nothing rendered here), next= names the sections=lego,compose flag that restores both sections byte-identically in one call est_tokens= prices this bundle in tokens -->
+<sigs shown="40" total="40" capped="1" past_target="7" docs_dropped="25" files_first="3" next="--for=&apos;tree-sitter parse of a source file&apos; --signatures-only --token-budget=5600">
+<d l="28" e="63" n="topLevelEvidence" sc="rw::pythonrunner" p="src/pythonrunner.h" cx="4" ccx="3" in="2" churn="5" amp="15" r="1" next="--expand=src/pythonrunner.h:topLevelEvidence">inline bool topLevelEvidence( std::string_view source, const TSLanguage* language, const Predicate&amp; predicate )</d … [line truncated: 1 more bytes on this line]
+<d l="45" e="45" n="kDefaultMaxFileBytes" sc="rw" p="src/ingest.h" churn="59" amp="165" pure="1" r="2">
+<doc>The crawl&apos;s per-file byte ceiling. A text file larger than this is skipped: at this size it is o…</doc>constexpr std::size_t kDefaultMaxFileBytes = 4u * 1024u * 1024u</d>
+<d l="1238" e="1246" n="parseTree" p="src/ingest_sidecap.h" cx="1" in="3" churn="139" amp="280" tested="1" r="3">TSTree* parseTree( TSParser* parser, std::string_view src )</d>
+<d l="593" e="667" n="doctorProbeGrammars" p="src/verbs_doctor.h" cx="7" ccx="17" in="1" churn="45" amp="129" r="4">
+<doc>Exercise every registered grammar and its embedded query, reporting loaded and expected totals</doc>inline DoctorGrammarProbe doctorProbeGrammars()</d>
+<d l="1797" e="1808" n="FileHealth" sc="FileHealth" p="src/model.h" churn="243" amp="430" r="5">struct FileHealth</d>
+<d l="100" e="232" n="kLangTable" p="src/ingest_crawl.h" churn="79" amp="208" pure="1" r="6">constexpr std::array&lt;LangEntry, 57&gt; kLangTable =</d>
+<d l="369" e="441" n="sliceAtRev" sc="slicediff" p="src/slicediff.h" cx="13" ccx="13" in="1" churn="12" amp="73" r="7">inline RevSide sliceAtRev( const std::string&amp; root, const std::string&amp; sha, const std::string&amp; rel, const Symbol&amp; sym, SliceFam fam, const ::TSLanguage* grammar…</ … [line truncated: 2 more bytes on this line]
+<d l="308" e="343" n="SliceScan" sc="SliceScan" p="src/slice.h" churn="51" amp="102" r="8">struct SliceScan</d>
+<d l="456" e="491" n="AstWalk" sc="rw" p="src/ingest.h" churn="59" amp="165" r="9">enum class AstWalk : std::uint8_t</d>
+<d l="1307" e="1310" n="astroFenceTailIsBlank" p="src/ingest_sidecap.h" cx="1" in="2" churn="139" amp="279" tested="1" r="10">inline bool astroFenceTailIsBlank( std::string_view src, std::size_t from, std::size_t to ) noexcept</d>
+<d l="134" e="134" n="kMaxKotlinStringNestDepth" sc="rw" p="src/ingest.h" churn="59" amp="165" pure="1" r="11">constexpr std::uint32_t kMaxKotlinStringNestDepth = 128u</d>
+<d l="2122" e="2151" n="collectGatedLocalNames" sc="rw" p="src/ingest_astquery.h" cx="6" ccx="5" in="1" churn="44" amp="137" r="12">std::vector&lt;LocalNameFact&gt; collectGatedLocalNames( std::string_view defBytes, std::uint32_t defStartLine, Lang lang )</d>
+<d l="881" e="932" n="scanModule" sc="detail" p="src/jsrunner.h" cx="16" ccx="15" in="3" churn="17" amp="81" r="13">inline ModuleScan scanModule( std::string_view source, std::string_view path )</d>
+<d l="255" e="259" n="hasPhantomScopeSeparator" p="src/ingest_names.h" cx="2" ccx="1" in="2" churn="59" amp="163" tested="1" r="14">inline bool hasPhantomScopeSeparator( TSNode qualified ) noexcept</d>
+<d l="713" e="752" n="jsonNestsTooDeep" p="src/ingest_crawl.h" cx="13" ccx="20" in="1" churn="79" amp="209" tested="1" r="15">bool jsonNestsTooDeep( std::string_view bytes ) noexcept</d>
+<d l="87" e="97" n="hasMainGuard" sc="rw::pythonrunner" p="src/pythonrunner.h" cx="2" ccx="2" in="1" churn="5" amp="14" r="16">inline bool hasMainGuard( std::string_view source )</d>
+<d l="104" e="104" n="kMaxYamlNestDepth" sc="rw" p="src/ingest.h" churn="59" amp="165" pure="1" r="17">constexpr std::uint32_t kMaxYamlNestDepth = 64u</d>
+<d l="1819" e="1972" n="spanTiersOfFiles" sc="rw" p="src/ingest_astquery.h" cx="28" ccx="55" in="2" churn="44" amp="138" r="18">SpanTierBatch spanTiersOfFiles( std::span&lt;const std::string&gt; diskPaths, bool useMemo )</d>
+<d l="326" e="332" n="DisclosureWhy" sc="SliceScan" p="src/slice.h" churn="51" amp="102" r="19">enum class DisclosureWhy : std::uint8_t</d>
+<d l="2599" e="2663" n="sliceScanDefinition" sc="slicev" p="src/slice.h" cx="12" ccx="11" in="3" churn="51" amp="105" r="20">inline SliceScan sliceScanDefinition( const std::string&amp; src, const Symbol&amp; sym, SliceFam fam, const ::TSLanguage* grammar, std::string_view varName )</d>
+<d l="351" e="663" n="runParseWorker" p="src/ingest_parsepool.h" cx="50" ccx="116" in="1" churn="51" amp="137" tested="1" r="21">inline void runParseWorker( ParsePoolShared&amp; sh, unsigned t )</d>
+<d l="48" e="67" n="LintRule" sc="LintRule" p="src/lintrules.h" churn="55" amp="144" r="22">struct LintRule</d>
+<d l="1445" e="1470" n="measureHealthAdoptingMemberMacroReparse" p="src/ingest_sidecap.h" cx="7" ccx="6" in="2" churn="139" amp="279" tested="1" r="23">inline FileHealth measureHealthAdoptingMemberMacroReparse( TSParser* parser, Lang lang, std::string_view bytes, TreeGuard&amp; tree, MemberMacroRepa … [line truncated: 19 more bytes on this line]
+<d l="2757" e="2779" n="buildMemoryStopAttr" sc="rw" p="src/serialize.h" cx="7" ccx="8" in="2" churn="413" amp="527" r="24">inline std::string buildMemoryStopAttr( const IngestResult&amp; ing, bool json )</d>
+… [134 more display lines; full output is 20303 bytes on 55 raw line(s)]
+`````
+
+## `./build/ripwire . --for="quality delta acks ledger rubber stamp"`
+
+*Doc-mention surfacing (default ON): a markdown doc naming a top-resolved symbol in a backtick rides in below that symbol — the legend's [doc mentions: …] clause says it fired.*
+
+**wall time: 3.77s**
+
+`````
+<ctx task="quality delta acks ledger rubber stamp" route="subtoken+body" root="." confidence="low" margin_pct="0" at="0712a5182" doc_mentions="1" schema="ripwire.for/v1" bundle="compact" bodies="0" reason="compact-route" budget_bytes="7500" est_tokens="8763">
+<!-- ripwire for schema=ripwire.for/v1: bundle=/bodies=/reason= the body posture; d: cx= ccx= complexity, in= callers (absent cx/ccx/in = 0), churn= amp= change, clone= tested= 1, sc= scope, id=p::sc::n; total= shown= capped=1 if cut; task= the query; d pure=1 const/constexpr sig, next= the follow-up to paste; route= name-exact(X)|subtoken+body[:broad|:declined]; confidence=/margin_pct= head score drop (low=flat); h l= p= n=, c n= l= (joined for same-named callees, shown= counts them), noedge= no callee resolved; h calls capped=1 next= the call listing every callee; fold kind=bodies: b t= n= p= l= top ranked rows' whole bodies, not the answer; served= of total= in budget_bytes=; slice/skip p= n= l=; slice members= of=: a big class's ctor, question-word members; skip bytes= next=; a skip makes sigs next= it, sigs_next= the signatures-only re-call; t p= file outside sigs (weaker), t sym= its top symbols (a pointer, not the answer), r= rank (gap = trimmed); field name= type= owner= rel=: a member of owner=, rel=creates held by value, uses by reference/pointer; iface implementors=N: types implementing it, m= its method contract; d layer=: built-in arch layer (game|infra|render|math|audio|ai|test) from a dir name in p=; d e= its last line (absent=unknown, never 0; l= the name's line); c prov=split: a resolver split arm; may be another arm's (NOT a claim the edge is false) [doc mentions: 1 doc, 1 symbol; doc_mentions=] -->
+<!-- root= is the crawl root; p= below is RELATIVE to it (single-root only; absent => p= is ingest's own path, unchanged); at=this commit(+dirty). [budget_bytes= is the default BYTE target this ranked payload was shaped toward: row text shortens toward it, no row of the ranked head is removed for it (sigs past_target=)] [sigs capped=1 with shown=total: rows shrunk, none dropped] [sigs past_target=K: the last K rows are past the budget_bytes target, served because they are rows of the ranked head; none is cut] [sigs sigs_next=: one call serving all total= rows uncut] [docs_dropped=N: N shown rows have a doc comment not printed (r>24 always, r5..24 if capped)] [docs_after_code=N: N doc rows of the shown set moved below its code rows; same rows, reordered, none added or removed; a question naming docs keeps score order] [files_first=N: N rows moved so r=1..8 are distinct files' best rows, score order, a repeated name once; same rows; fold, hops keep score order] est_tokens= prices this bundle in tokens -->
+<sigs shown="40" total="40" capped="1" past_target="12" docs_dropped="25" docs_after_code="1" files_first="33" sigs_next="--for=&apos;quality delta acks ledger rubber stamp&apos; --signatures-only --token-budget=6200" next="--expand=src/mcpverbs.h:4480:computeQualityDelta">
+<d l="1575" e="1596" n="refPairStaleAcks" p="src/verbs_quality.h" cx="6" ccx="6" in="1" churn="106" amp="205" r="1" next="--expand=src/verbs_quality.h:refPairStaleAcks">
+<doc>L2 stale acks in the range form. A changed-files answer holds no whole target tree to check the …</doc>std::vector&lt;rw::quality::StaleAck&gt; refPairStaleAcks( const gtl::btree_map&lt;std::string, rw::quality::AckRecord&gt;&amp; acks, const RefPairDelta&amp; refs )</d>
+<d l="4480" e="4552" n="computeQualityDelta" sc="rw" p="src/mcpverbs.h" cx="4" ccx="4" in="1" churn="466" amp="552" r="2">inline QualityDeltaOutcome computeQualityDelta( const std::string&amp; root )</d>
+<d l="8845" e="8860" n="staleByKindValue" sc="quality" p="src/quality.h" cx="5" ccx="7" in="2" churn="481" amp="659" r="3">inline std::string staleByKindValue( const std::vector&lt;StaleAck&gt;&amp; staleAcks )</d>
+<d l="2346" e="2348" n="kAtStampLegend" sc="rw" p="src/serialize.h" churn="413" amp="525" pure="1" r="4">inline constexpr const char* kAtStampLegend = &quot;&lt;!-- at= is the git commit these numbers were computed at</d>
+<d l="243" e="283" n="openRegularFileStream" sc="detail" p="src/docparse.h" cx="7" ccx="8" in="2" churn="30" amp="73" tested="1" r="5">inline rw::pathguard::NoFollowRead openRegularFileStream( std::string_view what, const std::string&amp; path )</d>
+<d l="314" e="371" n="computeDmm" sc="rw::dmm" p="src/dmm.h" cx="9" ccx="6" in="1" churn="16" amp="77" r="6">inline Result computeDmm( const std::string&amp; root, std::string_view spec, const IngestResult&amp; wo…</d>
+<d l="67" e="67" n="kNotesFile" sc="rw::notes" p="src/notes.h" churn="20" amp="81" r="7">inline const char* kNotesFile = &quot;.ripwire_notes&quot;</d>
+<d l="763" e="831" n="writePlanLint" sc="planlint" p="src/planlint.h" cx="16" ccx="22" in="1" churn="17" amp="73" r="8">inline void writePlanLint( std::FILE* out, const LintResult&amp; res )</d>
+<d l="527" e="550" n="refPairBasis" p="src/verbs_quality.h" cx="3" ccx="2" in="1" churn="106" amp="205" r="9">
+<doc>The REF-PAIR floor&apos;s comparison, once loadRefPairDelta has both sides: the base snapshot is the …</doc>void refPairBasis( const rw::Config&amp; cfg, const std::string&amp; root, RefPairDelta&amp; refs, DeltaBasis&amp; out )</d>
+<d l="814" e="849" n="refuseForeignAckSelection" p="src/verbs_quality.h" cx="9" ccx="12" in="1" churn="106" amp="205" r="10">std::optional&lt;int&gt; refuseForeignAckSelection( const rw::Config&amp; cfg, const rw::quality::Scope&amp; scope, const std::vector&lt;rw::quality::Regression&gt;&amp; outOf … [line truncated: 16 more bytes on this line]
+<d l="1714" e="2458" n="runQualityDelta" p="src/verbs_quality.h" cx="147" ccx="343" in="2" churn="106" amp="206" r="11">std::optional&lt;int&gt; runQualityDelta( const MainDispatch&amp; d )</d>
+<d l="497" e="523" n="DeltaBasis" sc="DeltaBasis" p="src/verbs_quality.h" churn="106" amp="204" r="12">struct DeltaBasis</d>
+<d l="1413" e="1438" n="ackNothingToAccept" p="src/verbs_quality.h" cx="6" ccx="7" in="1" churn="106" amp="205" r="13">int ackNothingToAccept( const std::string&amp; acksFile, const gtl::btree_map&lt;std::string, rw::quality::AckRecord&gt;&amp; acks, const rw::quality::Scope&amp; scope, std::size… … [line truncated: 4 more bytes on this line]
+<d l="195" e="195" n="kAcksFile" sc="quality" p="src/quality.h" churn="481" amp="657" r="14">inline const char* kAcksFile = &quot;.ripwire_quality_acks&quot;</d>
+<d l="1464" e="1500" n="inspectDirtyBaselinePin" p="src/verbs_quality.h" cx="5" ccx="6" in="1" churn="106" amp="205" r="15">DirtyPinVerdict inspectDirtyBaselinePin( const MainDispatch&amp; d, const std::string&amp; acksFile )</d>
+<d l="8307" e="8318" n="IdentityHealing" sc="IdentityHealing" p="src/quality.h" churn="481" amp="657" r="16">struct IdentityHealing</d>
+<d l="4572" e="4686" n="qualityDeltaJson" sc="rw" p="src/mcpverbs.h" cx="26" ccx="39" in="1" churn="466" amp="552" r="17">inline std::pair&lt;std::string, std::string&gt; qualityDeltaJson( const std::string&amp; root, bool showStale = false )</d>
+<d l="7844" e="7857" n="writeAckRecords" sc="quality" p="src/quality.h" cx="2" ccx="1" in="2" churn="481" amp="659" r="18">inline bool writeAckRecords( const std::string&amp; path, const gtl::btree_map&lt;std::string, AckRecord&gt;&amp; acks )</d>
+<d l="8801" e="8839" n="staleAcksXml" sc="quality" p="src/quality.h" cx="5" ccx="8" in="1" churn="481" amp="658" r="19">inline std::string staleAcksXml( const std::vector&lt;StaleAck&gt;&amp; staleAcks, EscapeFn esc )</d>
+<d l="4372" e="4372" n="qualityAcksPath" sc="rw" p="src/mcpverbs.h" cx="1" in="1" churn="466" amp="552" r="20">inline std::string qualityAcksPath( const std::string&amp; root )</d>
+<d l="4377" e="4405" n="QualityDeltaOutcome" sc="QualityDeltaOutcome" p="src/mcpverbs.h" churn="466" amp="551" r="21">struct QualityDeltaOutcome</d>
+<d l="555" e="656" n="resolveDeltaBasis" p="src/verbs_quality.h" cx="10" ccx="13" in="1" churn="106" amp="205" r="22">std::optional&lt;int&gt; resolveDeltaBasis( const MainDispatch&amp; d, const std::string&amp; baselineFile, RefPairDelta&amp; refs, DeltaBasis&amp; out )</d>
+<d l="4131" e="4145" n="atomicWriteFile" sc="quality" p="src/quality.h" cx="3" ccx="2" in="5" churn="481" amp="662" tested="1" r="23">inline bool atomicWriteFile( const std::string&amp; path, const std::string&amp; blob )</d>
+<d l="2166" e="2169" n="gitHeadSha" sc="quality" p="src/quality.h" cx="1" in="16" churn="481" amp="673" r="24">inline std::string gitHeadSha( const std::string&amp; root )</d>
+… [193 more display lines; full output is 22995 bytes on 45 raw line(s)]
+`````
+
+## `./build/ripwire . --for="quality delta acks ledger rubber stamp" --no-doc-mention`
+
+*The same task with doc-mention surfacing OFF — the contrast the flag exists for (no [doc mentions] clause, one fewer row).*
+
+**wall time: 4.52s**
+
+`````
+<ctx task="quality delta acks ledger rubber stamp" route="subtoken+body" root="." confidence="low" margin_pct="0" at="0712a5182" schema="ripwire.for/v1" bundle="compact" bodies="0" reason="compact-route" budget_bytes="7500" est_tokens="8691">
+<!-- ripwire for schema=ripwire.for/v1: bundle=/bodies=/reason= the body posture; d: cx= ccx= complexity, in= callers (absent cx/ccx/in = 0), churn= amp= change, clone= tested= 1, sc= scope, id=p::sc::n; total= shown= capped=1 if cut; task= the query; d pure=1 const/constexpr sig, next= the follow-up to paste; route= name-exact(X)|subtoken+body[:broad|:declined]; confidence=/margin_pct= head score drop (low=flat); h l= p= n=, c n= l= (joined for same-named callees, shown= counts them), noedge= no callee resolved; h calls capped=1 next= the call listing every callee; fold kind=bodies: b t= n= p= l= top ranked rows' whole bodies, not the answer; served= of total= in budget_bytes=; slice/skip p= n= l=; slice members= of=: a big class's ctor, question-word members; skip bytes= next=; a skip makes sigs next= it, sigs_next= the signatures-only re-call; t p= file outside sigs (weaker), t sym= its top symbols (a pointer, not the answer), r= rank (gap = trimmed); field name= type= owner= rel=: a member of owner=, rel=creates held by value, uses by reference/pointer; iface implementors=N: types implementing it, m= its method contract; d layer=: built-in arch layer (game|infra|render|math|audio|ai|test) from a dir name in p=; d e= its last line (absent=unknown, never 0; l= the name's line); c prov=split: a resolver split arm; may be another arm's (NOT a claim the edge is false) -->
+<!-- root= is the crawl root; p= below is RELATIVE to it (single-root only; absent => p= is ingest's own path, unchanged); at=this commit(+dirty). [budget_bytes= is the default BYTE target this ranked payload was shaped toward: row text shortens toward it, no row of the ranked head is removed for it (sigs past_target=)] [sigs capped=1 with shown=total: rows shrunk, none dropped] [sigs past_target=K: the last K rows are past the budget_bytes target, served because they are rows of the ranked head; none is cut] [sigs sigs_next=: one call serving all total= rows uncut] [docs_dropped=N: N shown rows have a doc comment not printed (r>24 always, r5..24 if capped)] [files_first=N: N rows moved so r=1..8 are distinct files' best rows, score order, a repeated name once; same rows; fold, hops keep score order] est_tokens= prices this bundle in tokens -->
+<sigs shown="40" total="40" capped="1" past_target="12" docs_dropped="26" files_first="32" sigs_next="--for=&apos;quality delta acks ledger rubber stamp&apos; --signatures-only --no-doc-mention --token-budget=6100" next="--expand=src/mcpverbs.h:4480:computeQualityDelta">
+<d l="1575" e="1596" n="refPairStaleAcks" p="src/verbs_quality.h" cx="6" ccx="6" in="1" churn="106" amp="205" r="1" next="--expand=src/verbs_quality.h:refPairStaleAcks">
+<doc>L2 stale acks in the range form. A changed-files answer holds no whole target tree to check the …</doc>std::vector&lt;rw::quality::StaleAck&gt; refPairStaleAcks( const gtl::btree_map&lt;std::string, rw::quality::AckRecord&gt;&amp; acks, const RefPairDelta&amp; refs )</d>
+<d l="4480" e="4552" n="computeQualityDelta" sc="rw" p="src/mcpverbs.h" cx="4" ccx="4" in="1" churn="466" amp="552" r="2">inline QualityDeltaOutcome computeQualityDelta( const std::string&amp; root )</d>
+<d l="8845" e="8860" n="staleByKindValue" sc="quality" p="src/quality.h" cx="5" ccx="7" in="2" churn="481" amp="659" r="3">inline std::string staleByKindValue( const std::vector&lt;StaleAck&gt;&amp; staleAcks )</d>
+<d l="2346" e="2348" n="kAtStampLegend" sc="rw" p="src/serialize.h" churn="413" amp="525" pure="1" r="4">inline constexpr const char* kAtStampLegend = &quot;&lt;!-- at= is the git commit these numbers were computed at</d>
+<d l="243" e="283" n="openRegularFileStream" sc="detail" p="src/docparse.h" cx="7" ccx="8" in="2" churn="30" amp="73" tested="1" r="5">inline rw::pathguard::NoFollowRead openRegularFileStream( std::string_view what, const std::string&amp; path )</d>
+<d l="314" e="371" n="computeDmm" sc="rw::dmm" p="src/dmm.h" cx="9" ccx="6" in="1" churn="16" amp="77" r="6">inline Result computeDmm( const std::string&amp; root, std::string_view spec, const IngestResult&amp; wo…</d>
+<d l="67" e="67" n="kNotesFile" sc="rw::notes" p="src/notes.h" churn="20" amp="81" r="7">inline const char* kNotesFile = &quot;.ripwire_notes&quot;</d>
+<d l="763" e="831" n="writePlanLint" sc="planlint" p="src/planlint.h" cx="16" ccx="22" in="1" churn="17" amp="73" r="8">inline void writePlanLint( std::FILE* out, const LintResult&amp; res )</d>
+<d l="527" e="550" n="refPairBasis" p="src/verbs_quality.h" cx="3" ccx="2" in="1" churn="106" amp="205" r="9">
+<doc>The REF-PAIR floor&apos;s comparison, once loadRefPairDelta has both sides: the base snapshot is the …</doc>void refPairBasis( const rw::Config&amp; cfg, const std::string&amp; root, RefPairDelta&amp; refs, DeltaBasis&amp; out )</d>
+<d l="814" e="849" n="refuseForeignAckSelection" p="src/verbs_quality.h" cx="9" ccx="12" in="1" churn="106" amp="205" r="10">std::optional&lt;int&gt; refuseForeignAckSelection( const rw::Config&amp; cfg, const rw::quality::Scope&amp; scope, const std::vector&lt;rw::quality::Regression&gt;&amp; outOf … [line truncated: 16 more bytes on this line]
+<d l="1714" e="2458" n="runQualityDelta" p="src/verbs_quality.h" cx="147" ccx="343" in="2" churn="106" amp="206" r="11">std::optional&lt;int&gt; runQualityDelta( const MainDispatch&amp; d )</d>
+<d l="497" e="523" n="DeltaBasis" sc="DeltaBasis" p="src/verbs_quality.h" churn="106" amp="204" r="12">struct DeltaBasis</d>
+<d l="1413" e="1438" n="ackNothingToAccept" p="src/verbs_quality.h" cx="6" ccx="7" in="1" churn="106" amp="205" r="13">int ackNothingToAccept( const std::string&amp; acksFile, const gtl::btree_map&lt;std::string, rw::quality::AckRecord&gt;&amp; acks, const rw::quality::Scope&amp; scope, std::size… … [line truncated: 4 more bytes on this line]
+<d l="195" e="195" n="kAcksFile" sc="quality" p="src/quality.h" churn="481" amp="657" r="14">inline const char* kAcksFile = &quot;.ripwire_quality_acks&quot;</d>
+<d l="1464" e="1500" n="inspectDirtyBaselinePin" p="src/verbs_quality.h" cx="5" ccx="6" in="1" churn="106" amp="205" r="15">DirtyPinVerdict inspectDirtyBaselinePin( const MainDispatch&amp; d, const std::string&amp; acksFile )</d>
+<d l="8307" e="8318" n="IdentityHealing" sc="IdentityHealing" p="src/quality.h" churn="481" amp="657" r="16">struct IdentityHealing</d>
+<d l="4572" e="4686" n="qualityDeltaJson" sc="rw" p="src/mcpverbs.h" cx="26" ccx="39" in="1" churn="466" amp="552" r="17">inline std::pair&lt;std::string, std::string&gt; qualityDeltaJson( const std::string&amp; root, bool showStale = false )</d>
+<d l="7844" e="7857" n="writeAckRecords" sc="quality" p="src/quality.h" cx="2" ccx="1" in="2" churn="481" amp="659" r="18">inline bool writeAckRecords( const std::string&amp; path, const gtl::btree_map&lt;std::string, AckRecord&gt;&amp; acks )</d>
+<d l="8801" e="8839" n="staleAcksXml" sc="quality" p="src/quality.h" cx="5" ccx="8" in="1" churn="481" amp="658" r="19">inline std::string staleAcksXml( const std::vector&lt;StaleAck&gt;&amp; staleAcks, EscapeFn esc )</d>
+<d l="4372" e="4372" n="qualityAcksPath" sc="rw" p="src/mcpverbs.h" cx="1" in="1" churn="466" amp="552" r="20">inline std::string qualityAcksPath( const std::string&amp; root )</d>
+<d l="4377" e="4405" n="QualityDeltaOutcome" sc="QualityDeltaOutcome" p="src/mcpverbs.h" churn="466" amp="551" r="21">struct QualityDeltaOutcome</d>
+<d l="555" e="656" n="resolveDeltaBasis" p="src/verbs_quality.h" cx="10" ccx="13" in="1" churn="106" amp="205" r="22">std::optional&lt;int&gt; resolveDeltaBasis( const MainDispatch&amp; d, const std::string&amp; baselineFile, RefPairDelta&amp; refs, DeltaBasis&amp; out )</d>
+<d l="4131" e="4145" n="atomicWriteFile" sc="quality" p="src/quality.h" cx="3" ccx="2" in="5" churn="481" amp="662" tested="1" r="23">inline bool atomicWriteFile( const std::string&amp; path, const std::string&amp; blob )</d>
+<d l="2166" e="2169" n="gitHeadSha" sc="quality" p="src/quality.h" cx="1" in="16" churn="481" amp="673" r="24">inline std::string gitHeadSha( const std::string&amp; root )</d>
+… [193 more display lines; full output is 22814 bytes on 45 raw line(s)]
+`````
+
+## `./build/ripwire . --safe-delete=rankGraphTeleport`
+
+*"Can I delete this?" — callers + transitive impact + every use site + how much of the radius is tested, composed in ONE call; risk= names what was found, never a verdict.*
+
+**wall time: 1.62s**
+
+`````
+<!-- ripwire safe-delete schema=ripwire.safe-delete/v1: can sym= go, a READ never a verdict: callers= impact_reaches= uses= tested_self= risk=; <c n= p= amb=>; radius_tested= non-tests of impact_reaches= an indexed test reaches, radius_untested= the rest; t= p= its tower-front match's kind and file:line; defs= matched; ambiguous_callers= callers with a call split over several defs; dead_code_candidate=1 only at defs=1 with no caller, for a t=fn with a body, outside .h/.hpp/.hh/.hxx, whose signature spells static (0 never means in use). window: shown= capped= (capped=1 cut). counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. root=: p= relative to it. amb=K: K calls split over several defs. c sites_at=: its calls of the leaf name, any receiver, as file:line (p= is its def line); not proof each binds. -->
+<safe-delete schema="ripwire.safe-delete/v1" sym="rankGraphTeleport" t="fn" p="src/graph.h:11809" defs="1" callers="7" ambiguous_callers="2" impact_reaches="67" uses="9" tested_self="0" radius_tested="0" radius_untested="67" dead_code_candidate="0" risk="untested-radius" shown="7" capped="0" graph_a … [line truncated: 89 more bytes on this line]
+<c n="runEval" p="src/eval.h:171" sites_at="src/eval.h:328" amb="5"/>
+<c n="rankGraph" p="src/graph.h:11850" sites_at="src/graph.h:11853"/>
+<c n="anchoredLexicalRank" p="src/graph.h:12496" sites_at="src/graph.h:12547"/>
+<c n="churnDecayRanking" p="src/main.cpp:1425" sites_at="src/main.cpp:1439"/>
+<c n="churnRankedGraph" p="src/main.cpp:1464" sites_at="src/main.cpp:1478 src/main.cpp:1479 src/main.cpp:1493"/>
+<c n="runDefaultMap" p="src/main.cpp:1751" sites_at="src/main.cpp:1871" amb="10"/>
+<c n="getIndex" p="src/mcpindex.h:1184" sites_at="src/mcpindex.h:1288"/>
+</safe-delete>
+`````
+
+## `./build/ripwire . --safe-delete=DoesNotExist`
+
+*Unknown-symbol refusal shape for --safe-delete.*
+
+**exit code: 1** — **wall time: 1.46s**
+
+`````
+(empty)
+`````
+
+stderr:
+
+`````
+ripwire: --safe-delete symbol not found: DoesNotExist
+`````
+
+## `./build/ripwire . --handoff`
+
+*The continuation packet for the NEXT session: <verified> disk truth (branch/sha, changed symbols, blast radius, tests) + <heuristic> labeled suggestions. Recorded against a CLEAN tree.*
+
+**wall time: 7.50s**
+
+`````
+<!-- ripwire handoff schema=ripwire.handoff/v1: continuation packet for the NEXT session: <verified changed= blast_files=>, <tests n=>, <heuristic n= candidates=>, <note>, <doc p=>. window: capped= (capped=1 cut). est_tokens=: price as emitted (an upper bound under compact). at=: commit+dirty+shallow. root=: p= relative to it. branch=/subject=: the checked out branch and HEAD commit subject; gitok=0: the git diff probe failed, changed counts are floors. cochange_window=/cochange_commits=: the git window the cochange rows were mined in and the commits it held (0: could not look). doc s=: lexical score of that plan/design doc for the branch+subject query. note target=/txt=: a committed notes row on this work (symbol id or path) and its text; a suggestion. -->
+<handoff schema="ripwire.handoff/v1" at="0712a5182" root="." branch="integration/train-36" subject="Merge origin/integration/train-35 (harvested head 6580f358) into integration/train-36" gitok="1" est_tokens="880">
+<verified changed="0" blast_files="0">
+<tests n="0">
+</tests>
+</verified>
+<heuristic n="6" candidates="162" capped="1" cochange_window="18mo@HEAD" cochange_commits="5296">
+<note target="src/infra/Diagnostics.h" txt="ASSUME_NO_ALIAS is an optimizer fact in release (separate_storage) only where the compiler consumes it: clang 18+ by default, LLVM 17/AppleClang 16 via the CMake -mllvm flag (scalars only), GCC never (debug check only); never on two members of one object;  … [line truncated: 57 more bytes on this line]
+<note target="test/manifestcheck.sh" txt="README.md&apos;s single &apos;&lt;N&gt; gate scripts&apos; claim (~line 1305) is NOT enforced — the derived-vs-stated sibling loop here covers docs/EVALS.md only. It drifted 407→451 unnoticed (fixed 2026-08-23). To close: grep both files (&apos;file:line … [line truncated: 47 more bytes on this line]
+<doc p="CHANGELOG.md" s="9.897"/>
+<doc p="bench/locbench/results/vt2_pooling_freestat/FREESTAT.md" s="9.864"/>
+<doc p="paper/PREPRINT.md" s="9.523"/>
+<doc p="docs/research/answer-completeness.md" s="9.481"/>
+</heuristic>
+</handoff>
+`````
+
+## `./build/ripwire . --handoff --token-budget=1200`
+
+*The same packet under a hard ceiling: heuristic rows drop tail-first (withheld= disclosed), verified rows never drop.*
+
+**wall time: 6.73s**
+
+`````
+<!-- ripwire handoff schema=ripwire.handoff/v1: continuation packet for the NEXT session: <verified changed= blast_files=>, <tests n=>, <heuristic n= candidates=>, <note>, <doc p=>. window: capped= (capped=1 cut). est_tokens=: price as emitted (an upper bound under compact). over_ceiling=1: budget not met. withheld=: rows the budget cut. at=: commit+dirty+shallow. root=: p= relative to it. branch=/subject=: the checked out branch and HEAD commit subject; gitok=0: the git diff probe failed, changed counts are floors. cochange_window=/cochange_commits=: the git window the cochange rows were mined in and the commits it held (0: could not look). doc s=: lexical score of that plan/design doc for the branch+subject query. note target=/txt=: a committed notes row on this work (symbol id or path) and its text; a suggestion. budget=: the token-budget cap this packet was fitted to; est_tokens= prices what it delivers. withheld_rows=N: heuristic rows the budget dropped (withheld=1 says so); verified rows are never dropped. -->
+<handoff schema="ripwire.handoff/v1" at="0712a5182" root="." branch="integration/train-36" subject="Merge origin/integration/train-35 (harvested head 6580f358) into integration/train-36" gitok="1" budget="1200" withheld="1" withheld_rows="3" est_tokens="944" over_ceiling="1">
+<verified changed="0" blast_files="0">
+<tests n="0">
+</tests>
+</verified>
+<heuristic n="3" candidates="162" capped="1" cochange_window="18mo@HEAD" cochange_commits="5296">
+<note target="src/infra/Diagnostics.h" txt="ASSUME_NO_ALIAS is an optimizer fact in release (separate_storage) only where the compiler consumes it: clang 18+ by default, LLVM 17/AppleClang 16 via the CMake -mllvm flag (scalars only), GCC never (debug check only); never on two members of one object;  … [line truncated: 57 more bytes on this line]
+<note target="test/manifestcheck.sh" txt="README.md&apos;s single &apos;&lt;N&gt; gate scripts&apos; claim (~line 1305) is NOT enforced — the derived-vs-stated sibling loop here covers docs/EVALS.md only. It drifted 407→451 unnoticed (fixed 2026-08-23). To close: grep both files (&apos;file:line … [line truncated: 47 more bytes on this line]
+<doc p="CHANGELOG.md" s="9.897"/>
+</heuristic>
+</handoff>
+`````
+
+## `./build/ripwire . --skipped`
+
+*WHY a file is not in the index (oversize / excluded / unsupported-ext / gitignored) and which indexed files it cannot vouch for (degraded-parse, minified-suspect), plus the per-language census.*
+
+**wall time: 1.29s**
+
+`````
+<ctx schema="ripwire.skipped/v1">
+<!-- ripwire skipped schema=ripwire.skipped/v1: why the index lacks a file <f p= why= bytes= limit= ext=>; indexed but unvouched <h p= why= err= err_ratio=>; <lang> census. root=: p= relative to it. indexed=N: the map's files=; indexed= + oversize= + excluded= + ignored= = every file the crawl enumerated. oversize=N: files dropped for exceeding a size ceiling (row limit= names which). excluded=N: files dropped by an exclude substring you passed. unsupported_ext=N: source/text files no grammar reads; binary assets and excluded/ignored files not counted. excluded_dirs=N: subtrees an exclude pruned; their files are UNKNOWN, not zero, and in no count here. pruned_dirs=N: subtrees pruned by built-in policy (vendor/build, CMakeCache.txt dirs); contents UNKNOWN. ignored=/ignored_dirs=: files / subtrees git ignore rules hid (else indexed); subtree contents UNKNOWN. ignore_mode=: git (rules applied), off (no-ignore flag), unavailable/root-ignored (not consulted, full walk). degraded_parse=/minified_suspect=: counts of the h rows of each why=; those files stay indexed. unmeasured=N: indexed files never parsed (doc pass, binary sniff, nest guard, read error); not health-counted. max_file_size=B: the effective per-file size ceiling in bytes (the max-file-size flag raises it). json_ceiling=/yaml_ceiling=: fixed .json/.yaml byte ceilings the max-file-size flag does NOT raise. ws_freq=R: whitespace share of the leading 4096 bytes; under 0.070 = minified-suspect (never under 256 B). x=/files=: an unindexed extension and its file count (full list; the map's unindexed= is the top 6). files=/symbols=: per language, files with its symbols (FLOOR: symbol-less files uncounted) / symbols (exact). -->
+<!-- why=extent-suspect on an <h> row = the file holds extent_suspect_syms= definitions whose extent, scope or kind FAILED a containment check (the map and bundle rows carry the reasons as extent_suspect=: name, head, scope, error); joined to the parse-health reasons comma-separated, and rowed even when the parse itself is clean. extent_suspect_files= on the root counts such rows. Nothing is dropped. -->
+<!-- why=macro-blanked on an <h> row = this file's symbols come from a SECOND parse. Its first parse held error bytes, so macro_blanked= semicolon-less ALL-CAPS function-like macro invocations, each alone on its line directly inside a class/struct/union body (a shape the C-family grammars misread as a field missing its semicolon, letting one body swallow what follows it), were replaced by spaces with every offset and line unchanged, and that re-parse was adopted because it held STRICTLY FEWER error bytes; names, spans and bodies still read the original bytes. err=, err_ratio= and degraded-parse on such a row describe the ADOPTED parse: a row without degraded-parse parsed clean once blanked. A blanked invocation stays a use of the macro name for the uses verb (role=type, as the unrepaired parse recorded it) but is no call edge, and identifiers inside its parentheses are not recorded. macro_blanked_files= on the root counts such rows. Nothing is dropped. -->
+<skipped indexed="3631" oversize="15" excluded="0" unsupported_ext="269" excluded_dirs="0" pruned_dirs="5" ignored="0" ignored_dirs="0" ignore_mode="git" degraded_parse="125" minified_suspect="3" extent_suspect_files="4" macro_blanked_files="7" unmeasured="30" max_file_size="4194304" json_ceiling="2 … [line truncated: 38 more bytes on this line]
+<f p="bench/locbench/full560.json" why="oversize" bytes="679702" limit="262144"/>
+<f p="bench/locbench/results/r1_anchorhop/heldout_baseline_release.json" why="oversize" bytes="365776" limit="262144"/>
+<f p="bench/locbench/results/r1_anchorhop/heldout_candidate_release.json" why="oversize" bytes="365761" limit="262144"/>
+<f p="bench/locbench/results/r3_pathtok/heldout_baseline.json" why="oversize" bytes="440937" limit="262144"/>
+<f p="bench/locbench/results/r3_pathtok/heldout_candidate_w3.json" why="oversize" bytes="440925" limit="262144"/>
+<f p="bench/locbench/results/r3_pathtok/train_w0.json" why="oversize" bytes="342194" limit="262144"/>
+<f p="bench/locbench/results/r3_pathtok/train_w1.json" why="oversize" bytes="342123" limit="262144"/>
+<f p="bench/locbench/results/r3_pathtok/train_w2.json" why="oversize" bytes="342117" limit="262144"/>
+<f p="bench/locbench/results/r3_pathtok/train_w3.json" why="oversize" bytes="342138" limit="262144"/>
+<f p="bench/locbench/results/r4_siblift/train_1x1.json" why="oversize" bytes="342197" limit="262144"/>
+<f p="bench/locbench/results/r4_siblift/train_1x2.json" why="oversize" bytes="342194" limit="262144"/>
+<f p="bench/locbench/results/r4_siblift/train_2x1.json" why="oversize" bytes="342187" limit="262144"/>
+<f p="bench/locbench/results/r4_siblift/train_2x2.json" why="oversize" bytes="342210" limit="262144"/>
+<f p="bench/locbench/results/r4_siblift/train_base.json" why="oversize" bytes="342194" limit="262144"/>
+<f p="bench/locbench/results/vt2_pooling_freestat/vt2_train_base.json" why="oversize" bytes="342396" limit="262144"/>
+<f p=".github/pargates-macos-plain-skip.txt" why="unsupported-ext" bytes="986" ext=".txt"/>
+<f p="CMakeLists.txt" why="unsupported-ext" bytes="110239" ext=".txt"/>
+<f p="bench/agentloop/editsuite/expected/i1/stats.py.expected" why="unsupported-ext" bytes="603" ext=".expected"/>
+<f p="bench/agentloop/editsuite/expected/i2/matrix.cpp.expected" why="unsupported-ext" bytes="973" ext=".expected"/>
+<f p="bench/agentloop/editsuite/expected/i3/text.py.expected" why="unsupported-ext" bytes="338" ext=".expected"/>
+<f p="bench/agentloop/editsuite/expected/p1/geometry.cpp.expected" why="unsupported-ext" bytes="723" ext=".expected"/>
+<f p="bench/agentloop/editsuite/expected/p2/stats.py.expected" why="unsupported-ext" bytes="575" ext=".expected"/>
+<f p="bench/agentloop/editsuite/expected/p2/text.py.expected" why="unsupported-ext" bytes="312" ext=".expected"/>
+<f p="bench/agentloop/editsuite/expected/p3/matrix.cpp.expected" why="unsupported-ext" bytes="824" ext=".expected"/>
+<f p="bench/agentloop/editsuite/expected/p3/stats.py.expected" why="unsupported-ext" bytes="593" ext=".expected"/>
+… [441 more display lines; full output is 46965 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --no-ignore --top-k=3`
+
+*Crawl paths the repo's own .gitignore covers (default honours it and discloses ignored_files=/ignored_dirs= only when it dropped anything — this repo's crawl drops nothing, so the header is identical to the default map's; --skipped's ignore_mode= says which rule applied).*
+
+**wall time: 1.27s**
+
+`````
+<!-- ripwire map schema=ripwire.map/v1: ranked symbol map: <f p= layer=> groups <s t= n= sc= k= amb=> rows (k= rank), <c n=> resolved callees; the header comment is data. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. pr_iters=N: PageRank iterations. <inv listed= unlisted=>: files the ranked rows show / do not (sum = files=), each named or counted below. <entry p= n=>: a program entry by its language's convention (C/Go/Rust main, Java/C# static main, a script main its module scope calls, __main__.py), callees as c rows; manifest entries not read. <ls p= n= f=>: n= unshown files under dir p=; f= names its code files, the rest (tests, docs, config, test/doc/example dirs) counted. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. amb=K: K calls split over several defs. -->
+<!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
+<!-- files=3631 symbols=31860 edges=30033 shown=3 est_tokens=3272 ambiguous=2933 unresolved=15249 locality_pinned=9 external=8658 declined=30154 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
+<r schema="ripwire.map/v1" root="." est_tokens="3272" pr_iters="36">
+<f p="src/infra/nodekind.h" layer="infra">
+<s t="fn" n="kindIs" sc="rw" k="0.0037">
+</s>
+</f>
+<f p="src/infra/Diagnostics.h" layer="infra">
+<s t="macro" n="ASSUME" amb="1" k="0.0022">
+<c n="RW_ASSUME_" prov="split"/>
+<c n="RW_ASSUME_" prov="split"/>
+</s>
+<s t="macro" n="RW_ASSUME_" k="0.0022">
+<c n="RW_CHECK_"/>
+</s>
+</f>
+<inv listed="2" unlisted="3629">
+<entry p="scripts/changelog_assemble.py" n="main">
+<c n="repoRoot"/>
+<c n="fragmentNames"/>
+<c n="check"/>
+<c n="assembledEntries"/>
+<c n="release"/>
+</entry>
+<entry p="scripts/optremarks.py" n="main">
+<c n="parse_record_file"/>
+<c n="is_foreign"/>
+</entry>
+<entry p="src/main.cpp" n="main">
+… [63 more display lines; full output is 8141 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --no-stable --top-k=3`
+
+*--no-stable outside --mcp: what the flag does (or says) when there is no stable-by-default ordering to opt out of.*
+
+**wall time: 2.07s**
+
+`````
+<!-- ripwire map schema=ripwire.map/v1: ranked symbol map: <f p= layer=> groups <s t= n= sc= k= amb=> rows (k= rank), <c n=> resolved callees; the header comment is data. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. pr_iters=N: PageRank iterations. <inv listed= unlisted=>: files the ranked rows show / do not (sum = files=), each named or counted below. <entry p= n=>: a program entry by its language's convention (C/Go/Rust main, Java/C# static main, a script main its module scope calls, __main__.py), callees as c rows; manifest entries not read. <ls p= n= f=>: n= unshown files under dir p=; f= names its code files, the rest (tests, docs, config, test/doc/example dirs) counted. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. amb=K: K calls split over several defs. -->
+<!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
+<!-- files=3631 symbols=31860 edges=30033 shown=3 est_tokens=3272 ambiguous=2933 unresolved=15249 locality_pinned=9 external=8658 declined=30154 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
+<r schema="ripwire.map/v1" root="." est_tokens="3272" pr_iters="36">
+<f p="src/infra/nodekind.h" layer="infra">
+<s t="fn" n="kindIs" sc="rw" k="0.0037">
+</s>
+</f>
+<f p="src/infra/Diagnostics.h" layer="infra">
+<s t="macro" n="ASSUME" amb="1" k="0.0022">
+<c n="RW_ASSUME_" prov="split"/>
+<c n="RW_ASSUME_" prov="split"/>
+</s>
+<s t="macro" n="RW_ASSUME_" k="0.0022">
+<c n="RW_CHECK_"/>
+</s>
+</f>
+<inv listed="2" unlisted="3629">
+<entry p="scripts/changelog_assemble.py" n="main">
+<c n="repoRoot"/>
+<c n="fragmentNames"/>
+<c n="check"/>
+<c n="assembledEntries"/>
+<c n="release"/>
+</entry>
+<entry p="scripts/optremarks.py" n="main">
+<c n="parse_record_file"/>
+<c n="is_foreign"/>
+</entry>
+<entry p="src/main.cpp" n="main">
+… [63 more display lines; full output is 8141 bytes on 1 raw line(s)]
+`````
+
+stderr:
+
+`````
+ripwire: --no-stable is read only by --mcp/--listen (it opts out of the stable ordering the server turns on) — it changed nothing here; the CLI map orders important-first unless you pass --order=stable
+`````
+
+## `./build/ripwire . --run-trace="cat <scratch>/aux/asan_trace_now.txt; exit 1"`
+
+*EXEC-MODE --from-trace: run a command, and on a non-zero exit map its captured output onto indexed symbols in the same call — the whole fix-loop entry. ripwire exits 4 here because the wrapped command failed, which is the signal, not an incident.*
+
+**exit code: 4** — **wall time: 2.19s**
+
+`````
+<ctx schema="ripwire.from-trace/v1" task="run-trace: cat <scratch>/aux/asan_trace_now.txt; exit 1" next="--slice=@src/graph.h:11811" est_tokens="2537">
+<!-- ripwire from-trace schema=ripwire.from-trace/v1: trace frames mapped to indexed symbols, innermost first; the innermost in-corpus body included. window: shown= total= capped= (capped=1 cut). est_tokens=: price as emitted (an upper bound under compact). <d r=N>: rank N in this ranking, rows in r= order. <d cx= ccx=>: cyclomatic/cognitive complexity. <d in=N>: N callers in the index (absent: not measured). sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. next=: the one pasteable follow-up. task=: the trace source this bundle maps, verbatim (a file path, stdin, or an MCP label). src=/format=: the trace read and its dominant frame format, python|asan|node|compiler|generic. frame_lines=/parsed=: frame-shaped input lines / those yielding a path:line; the rest matched no format. in_corpus=: parsed frames in indexed files; always suspects= + merged= + unresolved=. suspects=/merged=/unresolved=: frame rows / folded into a claimed symbol / unresolved rows (indexed file, no def). skipped=N: frames outside every root, listed as skipped rows, never ranked. rank=N: frame order, innermost in-corpus first; p= is the trace's own path:line, defs are sigs l=. resolved_by=name|line: bound by the frame's own name, else by the def enclosing its line. innermost=1: the innermost in-corpus frame (rank 1); its full body is served. run exit=: the command's OWN exit code; signal=: the signal that killed it; timed_out=1: the timeout_s= cap did. run duration_ms=: wall clock, MEASURED, not deterministic; timeout_s=: the cap it ran under. run lines=: non-empty captured lines; bytes=: the whole capture; dropped_bytes=: middle bytes the cap dropped. lines view=tail: the last shown= of total= output lines; view=relevant: shown= of relevant= error/frame-shaped ones. lines relevant=N: captured lines that are error-marked or frame-shaped; the relevant view picks from these. -->
+<!-- ledger: budget=7500 bytes (allowance 9583 bytes = ceiling + the single-entry overshoot a whole first signature costs) -->
+<run exit="1" duration_ms="446" timeout_s="600" lines="9" bytes="606"/>
+<lines view="relevant" shown="7" relevant="7" total="9">
+<![CDATA[AddressSanitizer:DEADLYSIGNAL
+==41337==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000018 (pc 0x000102f4a1c8 bp 0x00016d2f1a40 sp 0x00016d2f19e0 T0)
+    #0 0x102f4a1c8 in rw::rankGraphTeleport(Graph const&, std::vector<float> const&, float) src/graph.h:11811
+    #1 0x102f3e884 in rw::rankGraph(Graph const&, float) src/graph.h:11852
+    #2 0x102e11f30 in runDefaultMap(MainDispatch const&) src/main.cpp:1753
+    #3 0x102e01a44 in main src/main.cpp:4174
+    #4 0x1a2b3c0dc in start+0x9dc (dyld:arm64e+0x60dc)]]></lines><trace src="run-trace: cat <scratch>/aux/asan_trace_now.txt; exit 1" format="asan" frame_lines="5" parsed="4" in_corpus="4" skipped="0" merged="0" unresolved="0" suspects … [line truncated: 1475 more bytes on this line]
+{
+    PROFILE_SCOPE_DESCRIBE( "rankGraph: PageRank (power iteration)" );
+    const std::vector<float> pw = biasPrior( g, p );
+    const std::size_t N = pw.size();
+    std::vector<double> teleport( pw.begin(), pw.end() );
+    std::vector<double> rankDouble( N, 0.0 );
+    PageRankRun         run{};   // an N == 0 graph never enters the kernel: { 0, converged } — see PageRankRun
+    if( N )
+    {
+        double teleportMass = 0.0;
+        for( const double value : teleport )
+        {
+            teleportMass += value;
+        }
+        if( teleportMass > 0.0 )
+        {
+            const double inverseMass = 1.0 / teleportMass;
+            for( double& value : teleport )
+            {
+                value *= inverseMass;
+            }
+        }
+        run = pageRankDouble( g.inEdges, g.wOutDeg, teleport, rankDouble, PageRankConfig{ .alpha = double( alpha ) } );
+    }
+    std::vector<float> r( N, 0.f );
+    std::transform( rankDouble.begin(), rankDouble.end(), r.begin(), []( double value ) { return float( value ); } );
+    return { std::move( r ), run.iterationCount, run.hasConverged };
+}]]><calls total="4"><c n="biasPrior" l="11768">inline std::vector&lt;float&gt; biasPrior( const Graph&amp; g, const std::vector&lt;float&gt;&amp; p )</c><c n="PROFILE_SCOPE_DESCRIBE" l="1282">#define PROFILE_SCOPE_DESCRIBE( desc )</c><c n="PROFILE_SCOPE_DESCRIBE" l="1296">#define PROFILE_SCOPE_DESC … [line truncated: 289 more bytes on this line]
+`````
+
+## `./build/ripwire . --run-trace="true"`
+
+*A command that exits 0: a minimal success record (exit, measured duration, disclosed output tail) and NO bundle — nothing failed, nothing to map.*
+
+**wall time: 2.01s**
+
+`````
+<ctx schema="ripwire.from-trace/v1" task="run-trace: true">
+<!-- ripwire from-trace schema=ripwire.from-trace/v1: trace frames mapped to indexed symbols, innermost first; the innermost in-corpus body included. task=: the trace source this bundle maps, verbatim (a file path, stdin, or an MCP label). run exit=: the command's OWN exit code; signal=: the signal that killed it; timed_out=1: the timeout_s= cap did. run duration_ms=: wall clock, MEASURED, not deterministic; timeout_s=: the cap it ran under. run lines=: non-empty captured lines; bytes=: the whole capture; dropped_bytes=: middle bytes the cap dropped. -->
+<run exit="0" duration_ms="440" timeout_s="600" lines="0" bytes="0"/>
+</ctx>
+`````
+
+## `./build/ripwire . --run-trace="sleep 30" --run-timeout=2`
+
+*A command still running at the cap: its process group is killed and the run reports timed_out=1 — an honest timeout, never an empty success.*
+
+**exit code: 4** — **wall time: 3.84s**
+
+`````
+<ctx schema="ripwire.from-trace/v1" task="run-trace: sleep 30">
+<!-- ripwire from-trace schema=ripwire.from-trace/v1: trace frames mapped to indexed symbols, innermost first; the innermost in-corpus body included. task=: the trace source this bundle maps, verbatim (a file path, stdin, or an MCP label). run duration_ms=: wall clock, MEASURED, not deterministic; timeout_s=: the cap it ran under. run lines=: non-empty captured lines; bytes=: the whole capture; dropped_bytes=: middle bytes the cap dropped. run frames=0: the command FAILED but its output carried no mappable frame, so no bundle follows. -->
+<run timed_out="1" signal="9" duration_ms="2008" timeout_s="2" lines="0" bytes="0" frames="0"/>
+</ctx>
+`````
+
+stderr:
+
+`````
+ripwire: --run-trace: TIMEOUT — the command exceeded the 2 s cap; its process group was killed
+`````
+
+## `./build/ripwire . --run-timeout=5`
+
+*--run-timeout alone is refused loudly (it only modifies --run-trace).*
+
+**exit code: 1**
+
+`````
+(empty)
+`````
+
+stderr:
+
+`````
+ripwire: --run-timeout=SECONDS modifies --run-trace — pass it too (e.g. ripwire <dir> --run-trace="make -j" --run-timeout=60)
+`````
+
+
+---
+
+# assess quality — the wider lens family
+
+## `./build/ripwire . --quality-panel`
+
+*THE single wide-angle quality read: six families in one pass, an eligible/ranked shortlist rather than a firehose.*
+
+**wall time: 11.03s**
+
+`````
+<!-- ripwire quality-panel schema=ripwire.quality-panel/v1: every quality family in ONE report, ranked by distinct families fired: <s p= n= fam= of= fired= join=>; bar_*= thresholds. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). at=: commit+dirty+shallow. root=: p= relative to it. preset=: strict (5 stable families, cut 2), default (6, cut 2), lenient (6, cut 1); selects, never weights. families=6: evidence families: structural lexical confusion historical colocation state. enabled=/enabled_n=: the families this preset COUNTS, and how many. cut=N: distinct enabled families that must fire for a row to rank. cut_reachable=0: cut= exceeds the evaluable families (of=); a corpus fact, never a clean bill of health. eligible=N: functions/methods with a body; ranked= + below_cut= + no_family= = eligible=, always. ranked=N: rows that met the cut (total=); only shown= print, page with offset=. below_cut=N: fired at least one enabled family, but fewer than cut=. no_family=N: no enabled family fired; unavailable= families were never measured. bar_ccx=/bar_loc=/bar_nest=/bar_params=: absolute bars: cognitive complexity, lines, nesting, params. rcut=/rmeasured=: readability decile width (rrank= under it fires) / functions measured. hcut=/hranked=: file churn decile width / files with an in-window commit (hranked=0 voids historical). window=: the git churn window hrank= and churn= are counted over (RELATIVE to this corpus). ccut=/cranked=: colocation decile width / functions reading any outside definition (0 voids it). cfiles=/cscope=: files the confusion atom rules read / eligible symbols in them. lscope=N: symbols the lexical naming rules read. sfiles=/sscope=: files the state lens reads / symbols in them. cells=N: non-local mutable cells the state lens found. tested_scope=N: symbols an indexed test reaches; at 0 no row can carry join=deep+untested. deep_untested=N: rows carrying join=deep+untested across the WHOLE set, not just this page. e f=: the fired family this evidence row belongs to. counted=1: this preset counts the family toward fam=; 0 = fired, not counted. why=: the measurements that crossed (rule*N fired N times; hrank=/churn= are the file's, inherited). -->
+<quality_panel schema="ripwire.quality-panel/v1" preset="default" families="6" enabled="structural,lexical,confusion,historical,colocation,state" enabled_n="6" cut="2" cut_reachable="1" eligible="17849" ranked="1030" below_cut="6261" no_family="10558" bar_ccx="15" bar_loc="60" bar_nest="4" bar_param … [line truncated: 331 more bytes on this line]
+<s p="src/gitmine.h:1230" n="addRootFilesToGitPathIndex" fam="4" of="6" fired="structural,lexical,confusion,historical">
+<e f="structural" counted="1" why="ccx=25 ev=6"/>
+<e f="lexical" counted="1" why="naming-wordy"/>
+<e f="confusion" counted="1" why="atom-embedded-crement*2"/>
+<e f="historical" counted="1" why="hrank=37 churn=75"/>
+</s>
+<s p="src/graph.h:8255" n="buildGraph" fam="4" of="6" fired="structural,confusion,historical,colocation">
+<e f="structural" counted="1" why="ccx=1758 loc=3505 nest=8 humps=90 deep=563 ev=221 rrank=0"/>
+<e f="confusion" counted="1" why="atom-embedded-crement*5 atom-nested-ternary*2"/>
+<e f="historical" counted="1" why="hrank=7 churn=473"/>
+<e f="colocation" counted="1" why="crank=16"/>
+</s>
+<s p="src/graphlegend.h:762" n="declinedSitesLegend" fam="4" of="6" fired="structural,lexical,confusion,historical">
+<e f="structural" counted="1" why="ccx=29 ev=2"/>
+<e f="lexical" counted="1" why="naming-confusable"/>
+<e f="confusion" counted="1" why="atom-nested-ternary*5"/>
+<e f="historical" counted="1" why="hrank=18 churn=206"/>
+</s>
+<s p="src/ingest_relations.h:320" n="lookupInScope" fam="4" of="6" fired="structural,confusion,historical,state">
+<e f="structural" counted="1" why="params=5 ev=6"/>
+<e f="confusion" counted="1" why="atom-embedded-crement"/>
+<e f="historical" counted="1" why="hrank=39 churn=73"/>
+<e f="state" counted="1" why="reads=1"/>
+</s>
+<s p="src/ingest_sidecap.h:1838" n="captureTagsFacts" fam="4" of="6" fired="structural,confusion,historical,colocation">
+<e f="structural" counted="1" why="ccx=490 loc=799 nest=6 params=12 humps=34 deep=188 ev=46 rrank=11"/>
+<e f="confusion" counted="1" why="atom-nested-ternary"/>
+<e f="historical" counted="1" why="hrank=23 churn=139"/>
+… [188 more display lines; full output is 15676 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --biggest-first --limit=8`
+
+*Per-function size ranking, largest Halstead volume/token entropy/lines first — a size proxy, not a readability order (withdrawn, docs/EVALS.md §8) — a RANKING lens, not a grade.*
+
+**wall time: 1.55s**
+
+`````
+<!-- ripwire readability schema=ripwire.readability/v1: Posnett/Hindle/Devanbu lens, largest Halstead volume first (a size proxy): <fn p= n= lines= toks= ops= vocab= vol= ent= posnett=>. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). root=: p= relative to it. functions=N: functions and methods measured (bodyless declarations are not). -->
+<readability schema="ripwire.readability/v1" functions="17849" shown="8" capped="1" total="17849" has_more="1" next_offset="8" offset="0" limit="8" root=".">
+<fn p="src/graph.h:8255" n="buildGraph" lines="3505" toks="21619" ops="13920" vocab="1077" vol="217763.9" ent="6.74" posnett="0.000"/>
+<fn p="src/mcp.h:1120" n="dispatchMcpLine" lines="1773" toks="9055" ops="5750" vocab="794" vol="87226.8" ent="6.54" posnett="0.000"/>
+<fn p="src/verbs_for.h:2640" n="runForLensPass" lines="1610" toks="8627" ops="5255" vocab="710" vol="81712.1" ent="6.58" posnett="0.000"/>
+<fn p="test/forbodyslotfix/src/c/render.c:7" n="render_screen" lines="176" toks="9485" ops="6322" vocab="181" vol="71136.0" ent="4.54" posnett="0.000"/>
+<fn p="src/main.cpp:4307" n="dispatchMain" lines="1515" toks="7344" ops="4717" vocab="655" vol="68705.7" ent="6.36" posnett="0.000"/>
+<fn p="src/main.cpp:1751" n="runDefaultMap" lines="1187" toks="6548" ops="4027" vocab="526" vol="59186.8" ent="6.46" posnett="0.000"/>
+<fn p="src/packtask.h:1438" n="packTaskBundleText" lines="832" toks="5794" ops="3547" vocab="527" vol="52387.4" ent="6.56" posnett="0.000"/>
+<fn p="src/lexical.h:470" n="lexicalScoresTiered" lines="972" toks="5633" ops="3570" vocab="369" vol="48035.3" ent="6.33" posnett="0.000"/>
+</readability>
+`````
+
+## `./build/ripwire . --comment-coherence --limit=8`
+
+*Functions WITH a doc comment, most name-restating first: c_coeff (high = the comment repeats the name) and cic (Jaccard of comment vs identifier vocabulary), both reported, never collapsed.*
+
+**wall time: 2.56s**
+
+`````
+<!-- ripwire comment-coherence schema=ripwire.comment-coherence/v1: two comment/name content measures per documented function, most name-restating first: <fn p= n= c_coeff= cic=>. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). root=: p= relative to it. documented=N: functions with a doc comment, measured (the rows); a FLOOR when unreadable_files= shows. no_comment=N: eligible symbols with no measurable comment; UNAVAILABLE, never scored as zero. words=/restate=: comment word count (c_coeff= denominator, stopwords kept) / words matching a name word. c_terms=/i_terms=/shared=: comment term set / identifiers the body uses / overlap; cic= shared over union. -->
+<comment_coherence schema="ripwire.comment-coherence/v1" documented="5072" no_comment="12777" shown="8" capped="1" total="5072" has_more="1" next_offset="8" offset="0" limit="8" root=".">
+<fn p="src/infra/os.h:446" n="socket" c_coeff="1.000" words="1" restate="1" cic="0.000" c_terms="1" i_terms="5" shared="0"/>
+<fn p="src/lsp.h:496" n="lspLocationJson" c_coeff="1.000" words="1" restate="1" cic="0.000" c_terms="1" i_terms="26" shared="0"/>
+<fn p="src/query.h:267" n="sourceAll" c_coeff="1.000" words="1" restate="1" cic="0.000" c_terms="1" i_terms="12" shared="0"/>
+<fn p="src/verbs_quality.h:2494" n="runDmm" c_coeff="1.000" words="1" restate="1" cic="0.029" c_terms="1" i_terms="35" shared="1"/>
+<fn p="src/infra/dynamic_map.hpp:1955" n="erase_rec" c_coeff="1.000" words="1" restate="1" cic="0.048" c_terms="1" i_terms="21" shared="1"/>
+<fn p="test/verify_os_win32_logic.cpp:249" n="WidePath: separators, the Git Bash drive spelling, and nothing else rewritten" c_coeff="1.000" words="2" restate="2" cic="0.133" c_terms="2" i_terms="15" shared="2"/>
+<fn p="test/verify_os_win32_logic.cpp:191" n="utf: every scalar value round-trips UTF-8 -&gt; UTF-16 -&gt; UTF-8 byte-exactly" c_coeff="1.000" words="5" restate="5" cic="0.150" c_terms="4" i_terms="19" shared="3"/>
+<fn p="test/lintfix/bad.cpp:23" n="emptyCatchFunc" c_coeff="1.000" words="2" restate="2" cic="0.400" c_terms="2" i_terms="5" shared="2"/>
+</comment_coherence>
+`````
+
+## `./build/ripwire . --context-ratio --limit=8`
+
+*The local-reasoning lens: to understand this symbol, how much must you know that is NOT in front of you (ent_ratio= edge share, read_ratio= token-weighted).*
+
+**wall time: 1.95s**
+
+`````
+<!-- ripwire context-ratio schema=ripwire.context-ratio/v1: LOCAL-REASONING lens: the share of a unit's context outside its file: <s p= n= sites= ents_out= ent_ratio= read_ratio=>. window: total= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). syms_capped=/files_capped=/defs_capped=: 1 = cut. counts_floor=1: every count is a FLOOR, never a total. root=: p= relative to it. units=N: symbols measured (the s row population). file_units=N: files measured (the f row population). defs_per_name_cap=N: most defs one name adds (lowest ids); defs_capped=1 = cut, ents=/rtok= floors. body_bytes_per_token=: the bytes-per-token rate rtok= is estimated at. shown_syms=N: symbol rows printed; the rest page with offset=next_offset. shown_files=N: file rows printed (fixed cap 40, not paged); files_capped=1 = rows dropped. ents=N: distinct in-corpus defs its reference sites resolve to, by name (a FLOOR). files=N: distinct files holding those defs (a FLOOR). files_out=N: of files=, those other than the unit's own file. rtok=N: est. tokens of every resolved def, what a reader must read. rtok_out=N: the part of rtok= defined outside the unit's own file. ext=N: referenced names with no in-corpus def; mostly locals/params, NOT external deps; in neither ratio. amb_names=N: referenced names with 2+ defs, each counted (per name; not the map's per-call amb=). ents=N: distinct in-corpus defs the file's sites resolve to (a FLOOR; a union, not the sum of s rows). files=N: distinct files holding those defs (a FLOOR). files_out=N: of files=, those other than this file. rtok=N: est. tokens of every resolved def, what a reader must read. rtok_out=N: the part of rtok= defined outside this file. ext=N: referenced names with no in-corpus def; mostly locals/params, NOT external deps; in neither ratio. amb_names=N: referenced names with 2+ defs, each counted (per name; not the map's per-call amb=). -->
+<contextratio schema="ripwire.context-ratio/v1" units="26355" file_units="3077" defs_per_name_cap="8" body_bytes_per_token="3.80" shown_syms="8" syms_capped="1" shown_files="40" files_capped="1" total="26355" has_more="1" next_offset="8" offset="0" limit="8" defs_capped="1" counts_floor="1" root="." … [line truncated: 1 more bytes on this line]
+<s p="src/main.cpp:4307" n="dispatchMain" t="fn" sites="1153" ents="219" ents_out="196" ent_ratio="0.895" files="68" files_out="67" rtok="268518" rtok_out="232053" read_ratio="0.864" ext="130" amb_names="25"/>
+<s p="src/mcp.h:1120" n="dispatchMcpLine" t="fn" sites="1349" ents="221" ents_out="195" ent_ratio="0.882" files="46" files_out="45" rtok="88323" rtok_out="83216" read_ratio="0.942" ext="171" amb_names="18"/>
+<s p="src/mcpverbs.h:4480" n="computeQualityDelta" t="fn" sites="66" ents="42" ents_out="38" ent_ratio="0.905" files="15" files_out="14" rtok="83116" rtok_out="82245" read_ratio="0.990" ext="7" amb_names="8"/>
+<s p="src/main.cpp:1751" n="runDefaultMap" t="fn" sites="1142" ents="143" ents_out="131" ent_ratio="0.916" files="41" files_out="40" rtok="86586" rtok_out="81887" read_ratio="0.946" ext="149" amb_names="17"/>
+<s p="src/mcpverbs.h:4968" n="editCheckText" t="fn" sites="43" ents="40" ents_out="40" ent_ratio="1.000" files="23" files_out="23" rtok="74248" rtok_out="74248" read_ratio="1.000" ext="5" amb_names="7"/>
+<s p="src/editpreview.h:338" n="run" t="fn" sites="132" ents="62" ents_out="58" ent_ratio="0.935" files="30" files_out="29" rtok="71681" rtok_out="69478" read_ratio="0.969" ext="33" amb_names="8"/>
+<s p="src/mcpindex.h:1184" n="getIndex" t="fn" sites="174" ents="86" ents_out="67" ent_ratio="0.779" files="30" files_out="29" rtok="70537" rtok_out="66814" read_ratio="0.947" ext="20" amb_names="13"/>
+<s p="src/mcpverbs.h:4692" n="qualityBaselineJson" t="fn" sites="39" ents="43" ents_out="42" ent_ratio="0.977" files="25" files_out="24" rtok="64919" rtok_out="64890" read_ratio="1.000" ext="6" amb_names="9"/>
+<f p="src/main.cpp" sites="4102" ents="506" ents_out="428" ent_ratio="0.846" files="107" files_out="106" rtok="453636" rtok_out="381804" read_ratio="0.842" ext="566" amb_names="50"/>
+<f p="src/mcpverbs.h" sites="5737" ents="692" ents_out="616" ent_ratio="0.890" files="109" files_out="108" rtok="388500" rtok_out="323780" read_ratio="0.833" ext="665" amb_names="52"/>
+<f p="src/verbs_navigate.h" sites="4205" ents="474" ents_out="441" ent_ratio="0.930" files="84" files_out="83" rtok="140971" rtok_out="125575" read_ratio="0.891" ext="400" amb_names="39"/>
+<f p="src/verbs_for.h" sites="3827" ents="395" ents_out="304" ent_ratio="0.770" files="87" files_out="86" rtok="188498" rtok_out="123338" read_ratio="0.654" ext="444" amb_names="34"/>
+<f p="src/quality.h" sites="5711" ents="598" ents_out="335" ent_ratio="0.560" files="93" files_out="92" rtok="171646" rtok_out="117504" read_ratio="0.685" ext="679" amb_names="75"/>
+<f p="src/graph.h" sites="12204" ents="928" ents_out="470" ent_ratio="0.506" files="113" files_out="112" rtok="191681" rtok_out="105961" read_ratio="0.553" ext="1074" amb_names="117"/>
+<f p="src/mcpindex.h" sites="731" ents="214" ents_out="176" ent_ratio="0.822" files="50" files_out="49" rtok="97878" rtok_out="90733" read_ratio="0.927" ext="135" amb_names="36"/>
+<f p="src/mcp.h" sites="1915" ents="292" ents_out="237" ent_ratio="0.812" files="56" files_out="55" rtok="137504" rtok_out="88314" read_ratio="0.642" ext="248" amb_names="23"/>
+<f p="src/verbs_change.h" sites="1411" ents="249" ents_out="222" ent_ratio="0.892" files="69" files_out="68" rtok="86212" rtok_out="80624" read_ratio="0.935" ext="139" amb_names="31"/>
+<f p="src/editpreview.h" sites="475" ents="123" ents_out="117" ent_ratio="0.951" files="43" files_out="42" rtok="78911" rtok_out="76580" read_ratio="0.970" ext="75" amb_names="20"/>
+<f p="src/verbs_quality.h" sites="2263" ents="330" ents_out="262" ent_ratio="0.794" files="75" files_out="74" rtok="105560" rtok_out="68087" read_ratio="0.645" ext="223" amb_names="32"/>
+<f p="test/verify_csr.cpp" sites="199" ents="50" ents_out="47" ent_ratio="0.940" files="23" files_out="22" rtok="63606" rtok_out="62861" read_ratio="0.988" ext="33" amb_names="13"/>
+<f p="src/ingest_sidecap.h" sites="1889" ents="322" ents_out="258" ent_ratio="0.801" files="68" files_out="67" rtok="69584" rtok_out="56337" read_ratio="0.810" ext="253" amb_names="35"/>
+<f p="src/verbs_report.h" sites="4063" ents="283" ents_out="235" ent_ratio="0.830" files="65" files_out="64" rtok="73683" rtok_out="51847" read_ratio="0.704" ext="423" amb_names="28"/>
+<f p="src/mcpserver.h" sites="471" ents="117" ents_out="101" ent_ratio="0.863" files="35" files_out="34" rtok="51999" rtok_out="49274" read_ratio="0.948" ext="69" amb_names="21"/>
+<f p="src/packtask.h" sites="1724" ents="226" ents_out="174" ent_ratio="0.770" files="50" files_out="49" rtok="60840" rtok_out="48273" read_ratio="0.793" ext="228" amb_names="28"/>
+<f p="src/ingest_astquery.h" sites="1702" ents="270" ents_out="226" ent_ratio="0.837" files="71" files_out="70" rtok="62600" rtok_out="41672" read_ratio="0.666" ext="234" amb_names="46"/>
+<f p="src/ingest_parsepool.h" sites="733" ents="161" ents_out="150" ent_ratio="0.932" files="49" files_out="48" rtok="45909" rtok_out="38764" read_ratio="0.844" ext="112" amb_names="27"/>
+<f p="src/verbs_grep.h" sites="1012" ents="177" ents_out="142" ent_ratio="0.802" files="52" files_out="51" rtok="53838" rtok_out="34698" read_ratio="0.644" ext="139" amb_names="19"/>
+<f p="src/serialize.h" sites="7794" ents="561" ents_out="297" ent_ratio="0.529" files="97" files_out="96" rtok="88901" rtok_out="33549" read_ratio="0.377" ext="728" amb_names="51"/>
+… [21 more display lines; full output is 11151 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --nonlocal-state --limit=8`
+
+*Per function, the non-local MUTABLE state it can reach (transitively), most writes first — unsound by construction, and the legend says where.*
+
+**wall time: 4.01s**
+
+`````
+<!-- ripwire nonlocal-state schema=ripwire.nonlocal-state/v1: per function, the non-local MUTABLE state it reaches: <fn p= n= writes= reads=> over <cell n= p= dir= via=> rows. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). cells_capped=: 1 = cut. counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. root=: p= relative to it. cells=N: mutable non-local cells found in the corpus (globals, statics, Python module globals; FLOOR). functions=N: functions reaching at least one cell, directly or via callees (all rows, before paging). direct_writes=/direct_reads=: the writes=/reads= cells this function's OWN body writes/reads. cells_total=N: distinct cells reached (read and written counts once); at most 12 cell rows print. at=/at_dir=: one own-body use site (may be more) and what own-body sites do (can be narrower than dir=). cells_shown=/cells_capped=1: only this many of cells_total= cell rows print (cap 12). unanalyzed_langs=/unanalyzed_files=: indexed languages (and their files) this lens skips; NOT zero cells. -->
+<nonlocal_state schema="ripwire.nonlocal-state/v1" cells="976" functions="858" shown="8" capped="1" total="858" has_more="1" next_offset="8" offset="0" limit="8" graph_ambiguous="2933" graph_unresolved="15249" graph_unindexed="269" counts_floor="1" unanalyzed_langs="c,go,rust,javascript,typescript,j … [line truncated: 105 more bytes on this line]
+<fn p="bench/bench_svector_wave.cpp:346" n="main" writes="8" reads="14" direct_writes="0" direct_reads="4" cells_total="14" cells_shown="12" cells_capped="1">
+<cell n="kNames" p="bench/bench_svector_wave.cpp:98" dir="rw" at="bench/bench_svector_wave.cpp:358" at_dir="r"/>
+<cell n="kPush" p="bench/bench_svector_wave.cpp:99" dir="rw" at="bench/bench_svector_wave.cpp:358" at_dir="r"/>
+<cell n="kReads" p="bench/bench_svector_wave.cpp:100" dir="rw" at="bench/bench_svector_wave.cpp:358" at_dir="r"/>
+<cell n="kSamples" p="bench/bench_svector_wave.cpp:101" dir="rw" at="bench/bench_svector_wave.cpp:358" at_dir="r"/>
+<cell n="g_api" p="src/infra/profilePmc.h:140" dir="rw" via="ensure_thread_counting"/>
+<cell n="g_keyOf" p="bench/bench_svector_wave.cpp:145" dir="rw" via="regenerate"/>
+<cell n="g_perf" p="src/infra/profilePmc.h:289" dir="rw" via="ensure_thread_counting"/>
+<cell n="g_readOf" p="bench/bench_svector_wave.cpp:146" dir="rw" via="regenerate"/>
+<cell n="g_arm" p="bench/bench_svector_wave.cpp:65" dir="r" via="runArm"/>
+<cell n="g_bytes" p="bench/bench_svector_wave.cpp:67" dir="r" via="runArm"/>
+<cell n="g_count" p="bench/bench_svector_wave.cpp:66" dir="r" via="runArm"/>
+<cell n="g_once" p="src/infra/profilePmc.h:290" dir="r" via="ensure_thread_counting"/>
+</fn>
+<fn p="bench/bench_svector_wave.cpp:295" n="sweep" writes="6" reads="13" direct_writes="4" direct_reads="1" cells_total="13" cells_shown="12" cells_capped="1">
+<cell n="kNames" p="bench/bench_svector_wave.cpp:98" dir="rw" at="bench/bench_svector_wave.cpp:317" at_dir="w"/>
+<cell n="kPush" p="bench/bench_svector_wave.cpp:99" dir="rw" at="bench/bench_svector_wave.cpp:318" at_dir="w"/>
+<cell n="kReads" p="bench/bench_svector_wave.cpp:100" dir="rw" at="bench/bench_svector_wave.cpp:319" at_dir="rw"/>
+<cell n="kSamples" p="bench/bench_svector_wave.cpp:101" dir="rw" at="bench/bench_svector_wave.cpp:313" at_dir="w"/>
+<cell n="g_keyOf" p="bench/bench_svector_wave.cpp:145" dir="rw" via="regenerate"/>
+<cell n="g_readOf" p="bench/bench_svector_wave.cpp:146" dir="rw" via="regenerate"/>
+<cell n="g_api" p="src/infra/profilePmc.h:140" dir="r" via="read"/>
+<cell n="g_arm" p="bench/bench_svector_wave.cpp:65" dir="r" via="runArm"/>
+<cell n="g_bytes" p="bench/bench_svector_wave.cpp:67" dir="r" via="runArm"/>
+<cell n="g_count" p="bench/bench_svector_wave.cpp:66" dir="r" via="runArm"/>
+<cell n="g_perf" p="src/infra/profilePmc.h:289" dir="r" via="read"/>
+<cell n="g_pool" p="bench/bench_svector_wave.cpp:144" dir="r" via="regenerate"/>
+</fn>
+… [41 more display lines; full output is 7601 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --ensemble --limit=8`
+
+*The family join: per function, which of four orthogonal evidence families fire, ranked by how many agree.*
+
+**wall time: 6.83s**
+
+`````
+<!-- ripwire ensemble schema=ripwire.ensemble/v1: four orthogonal evidence families joined, ranked by DISTINCT families fired (no composite score): <s p= n= fam= of= fired=>. window: total= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). syms_capped=/files_capped=: 1 = cut. at=: commit+dirty+shallow. root=: p= relative to it. eligible=N: functions and methods with a body, the denominator; ranked + no_family = eligible. no_family=N: eligible symbols where no family fired. bar_ccx=/bar_loc=/bar_nest=/bar_params=: absolute structural bars: cognitive cx, lines, nesting, params. rcut=N: ranks the worst readability decile covers (1 to 40); rrank= inside it fires structural. rmeasured=N: functions the readability lens measured. hcut=N: file ranks the worst churn decile covers (1 to 40); hrank= inside it fires historical. hranked=N: files with any in-window commit; 0 = historical family unavailable. cfiles=N: indexed files the confusion (atom) pack can read: C/C++/ObjC/CUDA. cscope=N: eligible symbols in those files; 0 = confusion family unavailable. lscope=N: eligible symbols in a language the naming pack reads; 0 = lexical family unavailable. shown_syms=N: symbol rows printed; the rest page with offset=next_offset. shown_files=N: file rows printed (fixed cap 20, not paged); files_capped=1 = rows dropped. e f=: the fired family: structural, lexical, confusion or historical. why=: the measurements that crossed, space separated; rule*N = that rule fired N times. top=: the file's most corroborated symbol (most families on one symbol). top_l=: that symbol's line. top_fam=N: families fired on top=, the stronger claim; file rows rank by it. union_fam=N: distinct families firing anywhere in the file (weaker: may be different symbols). union=: the names of those families. syms=N: symbols in the file where at least one family fired. families=N: evidence families joined; ranked=N: symbols at least one fired on; window=: the git span the historical family read. -->
+<ensemble schema="ripwire.ensemble/v1" families="4" eligible="17849" ranked="6945" no_family="10904" bar_ccx="15" bar_loc="60" bar_nest="4" bar_params="5" rcut="40" rmeasured="17849" hcut="40" hranked="3631" window="12mo" cfiles="810" cscope="9399" lscope="17849" shown_syms="8" syms_capped="1" shown … [line truncated: 116 more bytes on this line]
+<s p="src/gitmine.h:1230" n="addRootFilesToGitPathIndex" fam="4" of="4" fired="structural,lexical,confusion,historical">
+<e f="structural" why="ccx=25 ev=6"/>
+<e f="lexical" why="naming-wordy"/>
+<e f="confusion" why="atom-embedded-crement*2"/>
+<e f="historical" why="hrank=37 churn=75"/>
+</s>
+<s p="src/graphlegend.h:762" n="declinedSitesLegend" fam="4" of="4" fired="structural,lexical,confusion,historical">
+<e f="structural" why="ccx=29 ev=2"/>
+<e f="lexical" why="naming-confusable"/>
+<e f="confusion" why="atom-nested-ternary*5"/>
+<e f="historical" why="hrank=18 churn=206"/>
+</s>
+<s p="src/serialize.h:10031" n="packDeps" fam="4" of="4" fired="structural,lexical,confusion,historical">
+<e f="structural" why="ccx=117 loc=298 nest=5 params=16 humps=4 deep=14 ev=5 rrank=27"/>
+<e f="lexical" why="naming-confusable"/>
+<e f="confusion" why="atom-nested-ternary*2"/>
+<e f="historical" why="hrank=10 churn=413"/>
+</s>
+<s p="src/compactlegend.h:1729" n="payloadSubCapAttrs" fam="3" of="4" fired="structural,confusion,historical">
+<e f="structural" why="ccx=45 nest=6 humps=2 deep=11"/>
+<e f="confusion" why="atom-assign-as-value"/>
+<e f="historical" why="hrank=12 churn=324"/>
+</s>
+<s p="src/compactlegend.h:2299" n="applyCompactDialectOnce" fam="3" of="4" fired="structural,confusion,historical">
+<e f="structural" why="ccx=49 loc=120 nest=4 humps=1 deep=1 ev=3"/>
+<e f="confusion" why="atom-nested-ternary"/>
+<e f="historical" why="hrank=12 churn=324"/>
+</s>
+… [36 more display lines; full output is 7490 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --field-affinity`
+
+*The cache-locality lens over every aggregate: fields READ TOGETHER but declared FAR APART (split-line / straddle findings, Chilimbi separation weight) — advice only, never a rewrite.*
+
+**wall time: 2.41s**
+
+`````
+<!-- ripwire field-affinity schema=ripwire.field-affinity/v1: fields read together but declared far apart vs 64-byte lines: <s n= p=> structs, <pair a= b= fns= dist=>, <finding k= f= g=>. window: shown= capped= (capped=1 cut). counts_floor=1: every count is a FLOOR, never a total. root=: p= relative to it. block=64: ASSUMED cache-line bytes; all geometry (dist= wt= ln= lines= findings) is against it. model=lp64-approx: sizes/offsets are the layout verb's LP64 standard-layout MODEL, not the real ABI. weighting=fanin-floor: w= sums 1 + fan-in per co-accessing fn; a reachability proxy, not a frequency. aggregates=N: C-family structs/classes the layout model located a body for (the scanned universe). files=N: C-family files declaring at least one struct/class the modelling pass visited. fns_scanned=N: C-family functions/methods with a readable body scanned for dot/arrow member accesses. accesses=N: member-access sites tied to one aggregate field (FLOOR: bare in-method names uncounted). amb_skipped=N: access sites REFUSED, not guessed: 2+ aggregates declare that field name; in no count here. structs=N: aggregates with 1+ attributed access; the top 20 by sepcost= print (shown=/capped=). findings=N: split-line + straddle findings over ALL structs=, not just the printed rows. min_fns=2: a pair fires split-line only when co-accessed by this many distinct functions. as_loops=N: for-loops the static advance-shape pass classified corpus-wide; report-only, never ranks. as_index=/as_chase=/as_mixed=/as_unknown=: as_loops= by advance shape (chase = pointer chase). agg=: the aggregate keyword (struct, class ...). modeled=1: layout model placed the fields; 0 = affinity only, no geometry, no finding (why= says why). fields=N: fields declared (before the touched-only filter). touched=N: fields with 1+ attributed access; at most 32 f rows print. pairs=N: co-accessed field pairs in all; at most 12 pair rows print (most fns= first). sepcost=: sum over measured pairs of fns x (1 - wt); the struct ranking key. findings=N: this struct's findings, every one printed. size=/align=/lines=: modeled sizeof, alignment, cache lines spanned (modeled=1 only). acc=N: member-access sites attributed to this field (FLOOR). sz=B: the field's modeled size in bytes (absent when the model could not size it). off=/ln=: modeled byte offset and its cache line (off/64); placed=0 instead when the model refused. w=: sum of 1 + fan-in over the co-accessing functions; a static reachability proxy, never a frequency. wt=: separation weight (64 - dist)/64, 0.00 = the two can never share a line; measured=0 instead when unplaced. wt=0.00: split-line fires only when the pair can never share a 64-byte line. w=: the split-line pair's 1 + fan-in weight sum (proxy); straddle rows carry none. off=/sz=/crosses=: straddle field offset, size, and the line its last byte lands on (lines start at off/64). fanin=N: this function's caller count (the w= proxy input). touched=N: distinct fields of this struct the function touches (named in f=); at most 8 fn rows of fns= print. scope=: the function's PROFILE_SCOPE description (first 120 chars), a counter to confirm with. scopes=N: distinct PROFILE_SCOPEs among the co-accessing functions (the scope children). status=: instrumented (a scope exists to measure) or uninstrumented (no witness yet). counter=: the hardware counter to compare across the two layouts. hint=: how to add the missing instrumentation (uninstrumented only). as_stem_ambiguous=/as_stem_unowned=/as_stem_nonptr=: chase names REFUSED - 2+ owners / no owner / owner type has no pointer marker. -->
+<fieldaffinity schema="ripwire.field-affinity/v1" block="64" model="lp64-approx" counts_floor="1" weighting="fanin-floor" aggregates="1922" files="403" fns_scanned="10130" accesses="12030" amb_skipped="33321" structs="839" shown="20" capped="1" findings="9" min_fns="2" as_loops="3258" as_index="8" a … [line truncated: 93 more bytes on this line]
+<s n="MainDispatch" p="src/main.cpp" l="502" agg="struct" modeled="1" fields="21" touched="13" fns="25" pairs="48" sepcost="57.12" findings="3" size="168" align="8" lines="3">
+<f n="multiRoot" acc="15" fns="12" sz="1" off="32" ln="0"/>
+<f n="ws" acc="10" fns="9" sz="8" off="40" ln="0"/>
+<f n="fanInPtr" acc="6" fns="6" sz="8" off="56" ln="0"/>
+<f n="qmetrics" acc="1" fns="1" sz="8" off="64" ln="1"/>
+<f n="ampPtr" acc="7" fns="7" sz="8" off="72" ln="1"/>
+<f n="cboPtr" acc="2" fns="2" sz="8" off="80" ln="1"/>
+<f n="testedPtr" acc="8" fns="8" sz="8" off="88" ln="1"/>
+<f n="lcom4Ptr" acc="2" fns="2" sz="8" off="96" ln="1"/>
+<f n="impurePtr" acc="5" fns="5" sz="8" off="104" ln="1"/>
+<f n="forChurn" acc="2" fns="2" sz="8" off="112" ln="1"/>
+<f n="redactCounts" acc="11" fns="7" sz="8" off="120" ln="1"/>
+<f n="grepPhases" acc="1" fns="1" sz="8" off="152" ln="2"/>
+<f n="valueUses" acc="5" fns="5" sz="1" off="160" ln="2"/>
+<pair a="multiRoot" b="ws" fns="8" w="8" dist="8" wt="0.88"/>
+<pair a="ampPtr" b="testedPtr" fns="7" w="7" dist="16" wt="0.75"/>
+<pair a="fanInPtr" b="testedPtr" fns="6" w="6" dist="32" wt="0.50"/>
+<pair a="fanInPtr" b="ampPtr" fns="6" w="6" dist="16" wt="0.75"/>
+<pair a="fanInPtr" b="redactCounts" fns="5" w="5" dist="64" wt="0.00"/>
+<pair a="fanInPtr" b="impurePtr" fns="5" w="5" dist="48" wt="0.25"/>
+<pair a="ampPtr" b="redactCounts" fns="5" w="5" dist="48" wt="0.25"/>
+<pair a="ampPtr" b="impurePtr" fns="5" w="5" dist="32" wt="0.50"/>
+<pair a="testedPtr" b="redactCounts" fns="5" w="5" dist="32" wt="0.50"/>
+<pair a="testedPtr" b="impurePtr" fns="5" w="5" dist="16" wt="0.75"/>
+<pair a="impurePtr" b="redactCounts" fns="5" w="5" dist="16" wt="0.75"/>
+<pair a="ws" b="redactCounts" fns="2" w="2" dist="80" wt="0.00"/>
+<finding k="split-line" f="fanInPtr" g="redactCounts" dist="64" wt="0.00" fns="5" w="5"/>
+<finding k="split-line" f="ws" g="impurePtr" dist="64" wt="0.00" fns="2" w="2"/>
+… [510 more display lines; full output is 45635 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --field-affinity=Symbol`
+
+*The same lens narrowed to ONE struct — the one --layout=Symbol shows the offsets for.*
+
+**wall time: 2.19s**
+
+`````
+<!-- ripwire field-affinity schema=ripwire.field-affinity/v1: fields read together but declared far apart vs 64-byte lines: <s n= p=> structs, <pair a= b= fns= dist=>, <finding k= f= g=>. window: shown= capped= (capped=1 cut). counts_floor=1: every count is a FLOOR, never a total. root=: p= relative to it. sym=: the struct asked for; only its own fields and pairs are reported. block=64: ASSUMED cache-line bytes; all geometry (dist= wt= ln= lines= findings) is against it. model=lp64-approx: sizes/offsets are the layout verb's LP64 standard-layout MODEL, not the real ABI. weighting=fanin-floor: w= sums 1 + fan-in per co-accessing fn; a reachability proxy, not a frequency. aggregates=N: C-family structs/classes the layout model located a body for (the scanned universe). files=N: C-family files declaring at least one struct/class the modelling pass visited. fns_scanned=N: C-family functions/methods with a readable body scanned for dot/arrow member accesses. accesses=N: member-access sites tied to one aggregate field (FLOOR: bare in-method names uncounted). amb_skipped=N: access sites REFUSED, not guessed: 2+ aggregates declare that field name; in no count here. structs=N: aggregates with 1+ attributed access; the top 20 by sepcost= print (shown=/capped=). findings=N: split-line + straddle findings over ALL structs=, not just the printed rows. min_fns=2: a pair fires split-line only when co-accessed by this many distinct functions. as_loops=N: for-loops the static advance-shape pass classified corpus-wide; report-only, never ranks. as_index=/as_chase=/as_mixed=/as_unknown=: as_loops= by advance shape (chase = pointer chase). agg=: the aggregate keyword (struct, class ...). modeled=1: layout model placed the fields; 0 = affinity only, no geometry, no finding (why= says why). fields=N: fields declared (before the touched-only filter). touched=N: fields with 1+ attributed access; at most 32 f rows print. pairs=N: co-accessed field pairs in all; at most 12 pair rows print (most fns= first). sepcost=: sum over measured pairs of fns x (1 - wt); the struct ranking key. findings=N: this struct's findings, every one printed. acc=N: member-access sites attributed to this field (FLOOR). sz=B: the field's modeled size in bytes (absent when the model could not size it). w=: sum of 1 + fan-in over the co-accessing functions; a static reachability proxy, never a frequency. fanin=N: this function's caller count (the w= proxy input). touched=N: distinct fields of this struct the function touches (named in f=); at most 8 fn rows of fns= print. scope=: the function's PROFILE_SCOPE description (first 120 chars), a counter to confirm with. scopes=N: distinct PROFILE_SCOPEs among the co-accessing functions (the scope children). status=: instrumented (a scope exists to measure) or uninstrumented (no witness yet). counter=: the hardware counter to compare across the two layouts. placed=0: the model gave no offset for this field; no off=/ln= and no geometry for its pairs. measured=0: an endpoint is unplaced, so no dist=/wt= and no finding for this pair. as_stem_ambiguous=/as_stem_unowned=/as_stem_nonptr=: chase names REFUSED - 2+ owners / no owner / owner type has no pointer marker. -->
+<fieldaffinity schema="ripwire.field-affinity/v1" block="64" model="lp64-approx" counts_floor="1" weighting="fanin-floor" aggregates="1922" files="403" fns_scanned="10130" accesses="12030" amb_skipped="33321" structs="1" shown="1" capped="0" findings="0" min_fns="2" as_loops="3258" as_index="8" as_c … [line truncated: 103 more bytes on this line]
+<s n="Symbol" p="src/model.h" l="600" agg="struct" modeled="0" fields="23" touched="2" fns="139" pairs="1" sepcost="0.00" findings="0" why="compound-type,unknown-type,bitfield">
+<f n="extentSuspect" acc="17" fns="11" sz="1" placed="0"/>
+<f n="sigStartByte" acc="319" fns="132" sz="4" placed="0"/>
+<pair a="sigStartByte" b="extentSuspect" fns="4" w="4" measured="0"/>
+<fn n="markExtentSuspects" p="src/ingest_model.h" l="562" fanin="0" touched="2" f="sigStartByte,extentSuspect" scope="ingest/build-model: extent honesty (containment check)"/>
+<fn n="mayCarryEndLine" p="src/serialize.h" l="4803" fanin="0" touched="2" f="sigStartByte,extentSuspect"/>
+<fn n="packSignatures" p="src/serialize.h" l="5860" fanin="0" touched="2" f="sigStartByte,extentSuspect"/>
+<fn n="packBodies" p="src/serialize.h" l="7690" fanin="0" touched="2" f="sigStartByte,extentSuspect"/>
+<fn n="buildCandidates" p="src/abicheck.h" l="304" fanin="0" touched="1" f="sigStartByte"/>
+<fn n="OwnerIndex" p="src/atoms.h" l="167" fanin="0" touched="1" f="sigStartByte"/>
+<fn n="ownerOf" p="src/atoms.h" l="174" fanin="0" touched="1" f="sigStartByte"/>
+<fn n="ownerOf" p="src/backhops.h" l="104" fanin="0" touched="1" f="sigStartByte"/>
+<validate scopes="9" status="instrumented" counter="l1d-cache-misses">
+<scope n="buildGraph/2e: Java Class::method members (issue #74)"/>
+<scope n="buildGraph/2h: FE-A false-edge rules"/>
+<scope n="buildGraph/8: HTTP-route edges"/>
+<scope n="ingest/build-model: extent honesty (containment check)"/>
+<scope n="ingest/build-model: lex stats CSR + file signatures (B0)"/>
+<scope n="lexical: pass 2 via persisted subtoken stats (cached tf/dl, no corpus re-tokenize)"/>
+<scope n="lint: mergeCachePack"/>
+<scope n="naminglens: checkScopeGroups (series + confusable)"/>
+<scope n="naminglens: final sort"/>
+</validate>
+</s>
+</fieldaffinity>
+`````
+
+## `./build/ripwire . --naming-consistency --limit=8`
+
+*The corpus's OWN case-convention vote per (language, kind) group; off-convention names get a mechanical propose= (a suggestion, never a blind rename).*
+
+**wall time: 1.22s**
+
+`````
+<!-- ripwire naming-consistency schema=ripwire.naming-consistency/v1: the corpus's case-convention vote per (language, kind): <g lang= kind= style= agree= total=>, <f p= n= propose=> outliers. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). root=: p= relative to it. component_exempt=N: PascalCase .tsx/.jsx functions (read as JSX components by extension alone), kept out of voting and flagging. groups=N: (language, kind) groups with at least one styled name. candidates=N: multi-token styled names scanned. decided=N: groups whose leading style cleared both the sample and agreement floors. flagged=N: off-convention names in decided groups (the f rows). g why=insufficient-sample|no-clear-convention: which bar a style=UNAVAILABLE group missed. -->
+<naming-consistency schema="ripwire.naming-consistency/v1" groups="32" candidates="13669" decided="11" flagged="552" component_exempt="8" shown="8" capped="1" total="552" has_more="1" next_offset="8" offset="0" limit="8" root=".">
+<g lang="cpp" kind="fn" style="camel" agree="7063" total="7491"/>
+<g lang="cpp" kind="var" style="camel" agree="1556" total="1568"/>
+<g lang="py" kind="fn" style="snake" agree="1161" total="1190"/>
+<g lang="py" kind="var" style="UNAVAILABLE" why="no-clear-convention" total="495"/>
+<g lang="ts" kind="fn" style="camel" agree="170" total="181"/>
+<g lang="ts" kind="var" style="UNAVAILABLE" why="insufficient-sample" total="5"/>
+<g lang="go" kind="fn" style="UNAVAILABLE" why="no-clear-convention" total="62"/>
+<g lang="go" kind="var" style="UNAVAILABLE" why="insufficient-sample" total="11"/>
+<g lang="rs" kind="fn" style="snake" agree="102" total="112"/>
+<g lang="rs" kind="var" style="UNAVAILABLE" why="insufficient-sample" total="13"/>
+<g lang="swift" kind="fn" style="UNAVAILABLE" why="no-clear-convention" total="47"/>
+<g lang="swift" kind="var" style="UNAVAILABLE" why="insufficient-sample" total="17"/>
+<g lang="objc" kind="fn" style="UNAVAILABLE" why="insufficient-sample" total="18"/>
+<g lang="js" kind="fn" style="camel" agree="148" total="150"/>
+<g lang="js" kind="var" style="UNAVAILABLE" why="insufficient-sample" total="3"/>
+<g lang="sh" kind="fn" style="UNAVAILABLE" why="no-clear-convention" total="1413"/>
+<g lang="java" kind="fn" style="camel" agree="110" total="110"/>
+<g lang="java" kind="var" style="UNAVAILABLE" why="insufficient-sample" total="1"/>
+<g lang="rb" kind="fn" style="snake" agree="54" total="54"/>
+<g lang="rb" kind="var" style="UNAVAILABLE" why="insufficient-sample" total="17"/>
+<g lang="cs" kind="fn" style="pascal" agree="39" total="39"/>
+<g lang="cs" kind="var" style="UNAVAILABLE" why="insufficient-sample" total="3"/>
+<g lang="c" kind="fn" style="UNAVAILABLE" why="no-clear-convention" total="434"/>
+<g lang="c" kind="var" style="UNAVAILABLE" why="insufficient-sample" total="15"/>
+<g lang="php" kind="fn" style="UNAVAILABLE" why="insufficient-sample" total="9"/>
+<g lang="php" kind="var" style="UNAVAILABLE" why="insufficient-sample" total="1"/>
+<g lang="lua" kind="fn" style="UNAVAILABLE" why="insufficient-sample" total="15"/>
+<g lang="ex" kind="fn" style="snake" agree="20" total="20"/>
+… [13 more display lines; full output is 4430 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --naming-calibration`
+
+*Score the naming-* rules against this repo's own rename history: proxy=old/(old+new) per rule, 0.50 = chance; read pairs= (sample size) first.*
+
+**wall time: 14.75s**
+
+`````
+<!-- ripwire naming-calibration schema=ripwire.naming-calibration/v1: naming lint rules scored against this repo's OWN rename history (a noisy proxy): <r n= old= new= fired= proxy=>. at=: commit+dirty+shallow. probed=0: no history to mine, nothing scored (r= says why); 1 = the git walk ran. pairs=N: labelled rename pairs that survived the join, the SAMPLE SIZE; a small one means nothing. candidates=N: raw substitutions mined from the patch stream before the join; FLOOR when truncated=1. commits=N: non-merge commits walked (the walk stops at 40000). hunks=N: diff hunks with content on both sides. wide_hunks=N: hunks DROPPED for exceeding the 24-line per-side pairing cap; never mined. drop_old_alive=N: candidates dropped: the old spelling is still an indexed name. drop_new_absent=N: candidates dropped: the new spelling is no eligible indexed symbol at HEAD. drop_ambiguous=N: candidates dropped: a name on both sides of several (split, rework, revert). drop_old_skipped=N: candidates dropped: the lens skips the old spelling, no rule could fire. scope=group-rule: the rule judges co-visible names, which one pair cannot evidence; unscored, not 0/0. o=/n=: one labelled pair's old (abandoned) and new (chosen) spelling. sup=N: distinct hunks that showed this substitution. p at=: path:line of the symbol the pair joined to, not a commit (the root at= is). old_fires=: rules that fired on the old spelling; absent when none. new_fires=: rules that fired on the new spelling; absent when none. -->
+<naming-calibration schema="ripwire.naming-calibration/v1" probed="1" pairs="175" candidates="2326" commits="4861" hunks="101538" wide_hunks="1085" drop_old_alive="557" drop_new_absent="1475" drop_ambiguous="119" drop_old_skipped="0" at="0712a5182">
+<r n="naming-short" old="2" new="3" fired="5" proxy="0.400"/>
+<r n="naming-wordy" old="1" new="3" fired="4" proxy="0.250"/>
+<r n="naming-series" scope="group-rule"/>
+<r n="naming-underscore" old="0" new="0" fired="0"/>
+<r n="naming-case" old="1" new="1" fired="2" proxy="0.500"/>
+<r n="naming-predicate" old="1" new="0" fired="1" proxy="1.000"/>
+<r n="naming-setter" old="0" new="0" fired="0"/>
+<r n="naming-confusable" scope="group-rule"/>
+<!-- 4 rename rows withheld: the project's own rebrand, which names a private pre-release identifier -->
+<p o="ATTR" n="ATTR_RE" sup="1" at="./bench/recalleval/run_recalleval.py:84"/>
+<p o="DEGRADED_PATH_ALERT" n="DISCLOSE" sup="412" at="./test/showcase_coverage_check.py:154"/>
+<p o="ELOOP" n="err" sup="1" at="./test/sliceflowcheck.sh:242"/>
+<p o="InRepoImportCounter" n="ImportResolver" sup="1" at="./src/resolve.h:3562"/>
+<p o="PACK_MAGIC" n="payload" sup="1" at="./test/legendcostcheck.sh:48"/>
+<p o="RunEval" n="DriveEval" sup="2" at="./test/attribmultideffix/cpp/eval_user.cc:4"/>
+<p o="RunPiece" n="DrivePiece" sup="3" at="./test/attribmultideffix/cpp/piece_user.cc:4"/>
+<p o="Subtoken" n="Member" sup="1" at="./test/callformfix/csharp/Main.cs:9"/>
+<p o="TTCA" n="answer" sup="1" at="./src/ifacedispatch.h:298"/>
+<p o="_famBIsFamily" n="_famBKind" sup="1" at="./test/showcase_capture.py:491"/>
+<p o="above" n="below" sup="1" at="./src/pathgaps.h:625"/>
+<p o="advice" n="next" sup="1" at="./bench/bench_svector_diff.cpp:76"/>
+<p o="appendCalleeNameRow" n="collectCalleeNameRow" sup="1" at="./src/serialize.h:7079"/>
+<p o="atomicWriteQSnap" n="atomicWriteFile" sup="5" at="./src/quality.h:4131"/>
+<p o="bare" n="flagged" sup="1" at="./test/editcheckanswercheck.sh:136"/>
+<p o="blobs" n="unread" sup="1" at="./src/crossref.h:718"/>
+… [156 more display lines; full output is 16229 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --lint --naming-locals`
+
+*The opt-in --lint modifier: naming predicates over LOCAL variable names too, C/C++ only, only inside functions already past a size/complexity gate.*
+
+**wall time: 3.92s**
+
+`````
+<!-- ripwire lint schema=ripwire.lint/v1: AST-only checks, facts not gates: <rule name= count= shown_rows= rows_capped= count_capped=> of <f rule= p= in=>. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). findings_capped=/rows_capped=/count_capped=: 1 = cut. counts_floor=1: every count is a FLOOR, never a total. root=: p= relative to it. findings=N: findings over the printed rules; a floor when findings_capped=1. findings_next=: the call counting the floored rules' rest (count_capped=1 rules only, 10x per-rule budget). -->
+<lint schema="ripwire.lint/v1" findings="8234" shown="629" capped="1" total="8234" has_more="1" next_offset="629" offset="0" limit="0" counts_floor="1" findings_capped="1" findings_next="--lint --naming-locals --lint-select=magic-number --lint-max-per-rule=50000" naming_locals="1" root=".">
+<rule name="c-style-cast" count="627" shown_rows="51" rows_capped="1"/>
+<rule name="goto" count="18" shown_rows="1" rows_capped="1"/>
+<rule name="do-while" count="17" shown_rows="0" rows_capped="1"/>
+<rule name="unsafe-c-fn" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="weak-crypto" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="redundant-parens" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="suspicious-semicolon" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="typedef-over-using" count="37" shown_rows="0" rows_capped="1"/>
+<rule name="magic-number" count="471" shown_rows="206" rows_capped="1" count_capped="1"/>
+<rule name="empty-catch" count="1" shown_rows="0" rows_capped="1"/>
+<rule name="self-assign" count="3" shown_rows="0" rows_capped="1"/>
+<rule name="large-function" count="324" shown_rows="23" rows_capped="1"/>
+<rule name="deep-nesting" count="382" shown_rows="23" rows_capped="1"/>
+<rule name="inconsistent-return" count="2" shown_rows="0" rows_capped="1"/>
+<rule name="unreachable-code" count="5" shown_rows="0" rows_capped="1"/>
+<rule name="naming-short" count="3295" shown_rows="206" rows_capped="1"/>
+<rule name="naming-wordy" count="314" shown_rows="15" rows_capped="1"/>
+<rule name="naming-series" count="907" shown_rows="0" rows_capped="1"/>
+<rule name="naming-underscore" count="2" shown_rows="0" rows_capped="1"/>
+<rule name="naming-case" count="81" shown_rows="0" rows_capped="1"/>
+<rule name="naming-predicate" count="1" shown_rows="0" rows_capped="1"/>
+<rule name="naming-setter" count="2" shown_rows="0" rows_capped="1"/>
+<rule name="naming-confusable" count="568" shown_rows="26" rows_capped="1"/>
+<rule name="naming-uninformative" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="atom-comma-operator" count="3" shown_rows="0" rows_capped="1"/>
+<rule name="atom-embedded-crement" count="175" shown_rows="6" rows_capped="1"/>
+<rule name="atom-assign-as-value" count="69" shown_rows="3" rows_capped="1"/>
+<rule name="atom-nested-ternary" count="195" shown_rows="9" rows_capped="1"/>
+… [641 more display lines; full output is 72667 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --lint-catalog`
+
+*The built-in rule registry — one row per rule with sev=/category=/rationale/lang=/since=; no corpus needed.*
+
+**wall time: 1.61s**
+
+`````
+<!-- ripwire lint-catalog schema=ripwire.lint-catalog/v1: the built-in lint rule registry: <rule name= sev= cat= lang= since=>. rules=N: rules in the built-in registry, one rule row each, never cut. -->
+<lintcatalog schema="ripwire.lint-catalog/v1" rules="39">
+<rule name="c-style-cast" sev="warn" cat="style" lang="cpp,c,objc,java,cs" since="v0.1.0">a C-style cast — cppcoreguidelines-pro-type-cstyle-cast prefers the explicit static_cast/const_cast/reinterpret_cast</rule>
+<rule name="goto" sev="warn" cat="control-flow" lang="cpp,c,objc,go,cs" since="v0.1.0">a goto statement — cppcoreguidelines-avoid-goto</rule>
+<rule name="do-while" sev="info" cat="style" lang="cpp,c,objc,ts,js,swift,java,cs" since="v0.1.0">a do/while loop shape (on Swift, its do/catch block shares the same grammar node and also matches)</rule>
+<rule name="unsafe-c-fn" sev="error" cat="security" lang="cpp,c,objc,ts,js,go,rs" since="v0.1.0">a call to an unbounded C string function (strcpy/strcat/sprintf/gets)</rule>
+<rule name="weak-crypto" sev="error" cat="security" lang="cpp,c,objc,ts,js,go,rs" since="v0.1.0">a call to a broken hash or cipher (MD5/SHA1/MD4/RC4)</rule>
+<rule name="redundant-parens" sev="info" cat="style" lang="cpp,c,objc,py,ts,js,go,rs,java,cs" since="v0.1.0">a doubly-parenthesized expression — readability-redundant-parentheses</rule>
+<rule name="suspicious-semicolon" sev="warn" cat="correctness" lang="cpp,c,objc" since="v0.1.0">an if-body that is just `;` — bugprone-suspicious-semicolon</rule>
+<rule name="typedef-over-using" sev="info" cat="style" lang="cpp,c,objc" since="v0.1.0">a C-style typedef struct/union where `using` is preferred</rule>
+<rule name="magic-number" sev="info" cat="maintainability" lang="cpp,c,objc" since="v0.1.0">a non-trivial numeric literal inside a function body, outside a const/constexpr init</rule>
+<rule name="empty-catch" sev="warn" cat="error-masking" lang="cpp,c,objc" since="v0.1.0">a catch block with an empty body</rule>
+<rule name="self-assign" sev="warn" cat="correctness" lang="cpp,c,objc,ts,js,rs,java,cs" since="v0.1.0">x = x — almost always a copy-paste bug</rule>
+<rule name="large-function" sev="info" cat="maintainability" lang="cpp,c" since="v0.1.0">a function body over 80 lines</rule>
+<rule name="deep-nesting" sev="info" cat="maintainability" lang="cpp,c" since="v0.1.0">brace nesting depth over 4 inside a function body</rule>
+<rule name="inconsistent-return" sev="info" cat="maintainability" lang="cpp,c" since="v0.1.0">a bare `return;` mixed with a value-returning return in the same function</rule>
+<rule name="unreachable-code" sev="warn" cat="correctness" lang="cpp,c,objc,py,ts,js,go,java,cs" since="v0.1.0">a statement after an unconditional return/break/continue/throw/raise in the same block</rule>
+<rule name="naming-short" sev="info" cat="naming" lang="cpp,c,objc,py,ts,js,go,rs,swift,java,cs,rb,sh,php,lua,ex,dart,kt,gd,clj" since="v0.2.2">a 1-2 letter Function/Method/Var name — visible far beyond any tiny scope [Beniamini/Hofmeister]</rule>
+<rule name="naming-wordy" sev="info" cat="naming" lang="cpp,c,objc,py,ts,js,go,rs,swift,java,cs,rb,sh,php,lua,ex,dart,kt,gd,clj" since="v0.2.2">more than 5 split tokens in one name [Butler; AlSuhaibani]</rule>
+<rule name="naming-series" sev="info" cat="naming" lang="cpp,c,objc,py,ts,js,go,rs,swift,java,cs,rb,sh,php,lua,ex,dart,kt,gd,clj" since="v0.2.2">foo1/foo2/... digit-suffix siblings sharing a base name in one scope [Butler]</rule>
+<rule name="naming-underscore" sev="info" cat="naming" lang="cpp,c,objc,py,ts,js,go,rs,swift,java,cs,rb,sh,php,lua,ex,dart,kt,gd,clj" since="v0.2.2">internal consecutive underscores, or a C-family reserved __x/_X form [Butler]</rule>
+<rule name="naming-case" sev="info" cat="naming" lang="cpp,c,objc,py,ts,js,go,rs,swift,java,cs,rb,sh,php,lua,ex,dart,kt,gd,clj" since="v0.2.2">snake_case and camelCase mixed inside one name [Butler]</rule>
+<rule name="naming-predicate" sev="info" cat="naming" lang="cpp,c,objc,py,ts,js,go,rs,swift,java,cs,rb,sh,php,lua,ex,dart,kt,gd,clj" since="v0.2.2">an is/has/can/should/was-prefixed name whose KNOWN return type is not bool-like [LAPD A2]</rule>
+<rule name="naming-setter" sev="info" cat="naming" lang="cpp,c,objc,py,ts,js,go,rs,swift,java,cs,rb,sh,php,lua,ex,dart,kt,gd,clj" since="v0.2.2">a set-prefixed name whose KNOWN return type is not void-like [LAPD A3]</rule>
+<rule name="naming-confusable" sev="info" cat="naming" lang="cpp,c,objc,py,ts,js,go,rs,swift,java,cs,rb,sh,php,lua,ex,dart,kt,gd,clj" since="v0.2.2">a co-visible pair within edit distance &lt;=2, reordered tokens, or a bare/digit-suffixed twin [Namesake]</rule>
+<rule name="naming-uninformative" sev="info" cat="naming" lang="cpp,c,objc,py,ts,js,go,rs,swift,java,cs,rb,sh,php,lua,ex,dart,kt,gd,clj" since="v0.2.2">every split subtoken is corpus-ubiquitous (BM25 idf) on a body past the size floor — fires only at the low end [Sparck Jones 1972]</rule>
+<rule name="atom-comma-operator" sev="info" cat="readability" lang="cpp,c,objc" since="v0.2.2">the comma operator inside an expression (never a for-header comma) [Gopstein FSE 2017]</rule>
+<rule name="atom-embedded-crement" sev="info" cat="readability" lang="cpp,c,objc" since="v0.2.2">++/-- evaluated inside a larger expression (never a whole statement) [Gopstein FSE 2017]</rule>
+<rule name="atom-assign-as-value" sev="info" cat="readability" lang="cpp,c,objc" since="v0.2.2">an assignment whose VALUE is consumed (a condition, an argument, ...) [Gopstein FSE 2017]</rule>
+<rule name="atom-nested-ternary" sev="info" cat="readability" lang="cpp,c,objc" since="v0.2.2">a conditional expression inside a conditional expression [Gopstein FSE 2017]</rule>
+… [12 more display lines; full output is 7800 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --legend-dict`
+
+*The session legend dictionary the MCP server serves as ripwire://legend-dict/full — one definition per line, headed by its dictv= version; no corpus needed. =roster lists the completeness attributes it defines.*
+
+`````
+ripwire legend dictionary ripwire.dict/v1 dictv=8c941c6c17d27549 entries=932
+<about legend="ref" dict= dictv=>: the answer's rows come first; its root keeps only task= changed= from= to=, and this LAST child carries every other root attribute unchanged (schema= included); legend="ref": a definition is sent once per session (this dictionary's core, or the first answer that ne … [line truncated: 83 more bytes on this line]
+schema=ripwire.KEY/v1: the line ripwire.KEY/v1 below reads the answer's rows
+window: shown= total= capped= has_more= next_offset= offset= limit= page a list (capped=1 cut; next_offset= pastes as offset=)
+X_capped= (any attribute ending _capped): 1 = cut
+under ref, est_tokens= and over_ceiling= price the answer with its inline legend: an upper bound
+under ref, a <g n= p=> group of n <= 8 runner-less rows prints as its n single rows, each run_unknown=1
+ripwire.map/v1 <r>: ranked symbol map: <f p= layer=> groups <s t= n= sc= k= amb=> rows (k= rank), <c n=> resolved callees; the header comment is data
+ripwire.map-diff/v1 <r>: the ranked map anchored at at=: what the diff touched, the map's row vocabulary
+ripwire.metrics/v1 <r>: the ranked map with per-symbol metrics
+ripwire.around/v1 <r>: call neighbourhood of of=: depth= hops, fanout= kept per hop; absent rows lie outside that boundary
+ripwire.query/v1 <r>: lexical-rank map for the query term, the map's row vocabulary
+ripwire.pack-signatures/v1 <ctx>: the ranked map plus <sigs><d l= n= sc= pure=> signature rows
+ripwire.pack-top-n/v1 <ctx>: the ranked map plus <src p=> bodies of the top-N symbols
+ripwire.skipped/v1 <ctx>: why the index lacks a file <f p= why= bytes= limit= ext=>; indexed but unvouched <h p= why= err= err_ratio=>; <lang> census
+ripwire.notes/v1 <ctx>: field notes by target: <target id= dangling=> holds <note d= sha= branch=>; the kept count comment: notes= rows, targets= <target> rows, dangling= targets matching nothing indexed (listed, surfaced nowhere)
+ripwire.lego/v1 <ctx>: ONE interface/base type: <iface n= p= defs= implementors=>, its <m> method contract, every implementor
+ripwire.expand/v1 <ctx>: full bodies: <bodies shown= total= capped=> of <b t= l= p= n= sibs= sibs_total= sibs_capped= inc=>; <calls><c n= l=> resolved callees
+ripwire.expand-file/v1 <ctx>: the file's own text: <src p= sym=>; <s n= sc= l=/> per scoped symbol; full id = p::sc::n
+ripwire.candidate-page/v1 <sigs>: budgeted-bundle candidate page: a resumable window over the ranked candidate set the bundle cuts, for task= under budget_tokens=, one tier per page, ranks global across pages
+ripwire.pack-task/v1 <ctx>: one-call task bundle for task= under budget_tokens=: <sigs><d n= sc= l= p=> ranking, <far><s t= n= p=> ranked but over 1 hop out (of_top= ranked rows) > <bodies><b t= n= p= l=> with <calls><c n= l=> callees > <callers><s rel=caller|callee shared=> 1-hop from the bodies (o … [line truncated: 105 more bytes on this line]
+ripwire.from-trace/v1 <ctx>: trace frames mapped to indexed symbols, innermost first; the innermost in-corpus body included
+ripwire.exemplar/v1 <ctx>: the best-in-class instance of kind= for the task, chosen by role: <exemplar n= p= in= ccx= tested=>, <bodies><b> to imitate
+ripwire.pack-task/v1 <ctx-partitions>: N minimally overlapping agent bundles carved along call-graph communities plus one shared core; each <bundle> wraps a <ctx>; bundle role=core|partition i= symbols= modules= bytes= tokens=: one agent's ctx, symbols= ids assigned, bytes= its size; tokens= = est_t … [line truncated: 345 more bytes on this line]
+ripwire.callers/v1 <callers>: 1-hop CALLERS of of= (defs= matched, count= distinct symbols): <s t= n= p=>; hop_tested=/hop_untested=
+ripwire.callees/v1 <callees>: 1-hop CALLEES of of= (defs= matched, count= distinct symbols): <s t= n= p= role= tested=>
+ripwire.uses/v1 <uses>: resolvable use-sites of of=: <u role=call|macro|read|write|import|extends|type p=file:line in_id=>
+ripwire.impact/v1 <impact>: transitive blast radius of of=: <s t= n= p=> reach set, <f via= p=> importers; defs= matched, reaches= their transitive callers, radius_tested= non-tests an indexed test reaches, radius_untested= the rest; importers= files that #include/import a def's file
+ripwire.path/v1 <path>: one DIRECTED call path from= to to=, each <s t= n= p=> a hop; reachable=0 hops=0 when none
+ripwire.connect/v1 <connect>: minimal joining subgraph: <g> groups, <t> terminals, <s connects=> joins, <e f= t=> edges, <unconnected>
+… [903 more display lines; full output is 97621 bytes on 933 raw line(s)]
+`````
+
+## `./build/ripwire . --lint --lint-select=cache-`
+
+*Run ONLY one rule family; the root carries selected="K of N" so a filtered zero is never confusable with an unfiltered one.*
+
+**wall time: 3.34s**
+
+`````
+<!-- ripwire lint schema=ripwire.lint/v1: AST-only checks, facts not gates: <rule name= count= shown_rows= rows_capped= count_capped=> of <f rule= p= in=>. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). rows_capped=: 1 = cut. root=: p= relative to it. findings=N: findings over the printed rules; a floor when findings_capped=1. -->
+<lint schema="ripwire.lint/v1" findings="693" shown="626" capped="1" total="693" has_more="1" next_offset="626" offset="0" limit="0" selected="8 of 39" select="cache-" root=".">
+<rule name="cache-node-container" count="29" shown_rows="15" rows_capped="1"/>
+<rule name="cache-vector-of-raw-ptr" count="59" shown_rows="56" rows_capped="1"/>
+<rule name="cache-vector-of-indirect" count="245" shown_rows="235" rows_capped="1"/>
+<rule name="cache-heap-alloc-in-loop" count="5" shown_rows="2" rows_capped="1"/>
+<rule name="cache-pointer-chase-loop" count="8" shown_rows="1" rows_capped="1"/>
+<rule name="cache-gather-subscript" count="325" shown_rows="298" rows_capped="1"/>
+<rule name="cache-shared-ptr-by-value" count="21" shown_rows="19" rows_capped="1"/>
+<rule name="cache-manual-prefetch" count="1" shown_rows="0" rows_capped="1"/>
+<f rule="cache-vector-of-indirect" p="bench/agentloop/editsuite/fixture/matrix.cpp:3" in="">vector&lt;std::vector&lt;double&gt;&gt;</f>
+<f rule="cache-gather-subscript" p="bench/bench_chase_ab.cpp:106" in="linkChain">nodes[ perm[i] ]</f>
+<f rule="cache-gather-subscript" p="bench/bench_chase_ab.cpp:106" in="linkChain">nodes[ perm[ i + 1 ] ]</f>
+<f rule="cache-pointer-chase-loop" p="bench/bench_chase_ab.cpp:118" in="chase">p = p-&gt;next</f>
+<f rule="cache-node-container" p="bench/bench_convergence.cpp:40" in="">map</f>
+<f rule="cache-gather-subscript" p="bench/bench_convergence.cpp:77" in="main">byName[ symN[i] ]</f>
+<f rule="cache-vector-of-indirect" p="bench/bench_convergence.cpp:82" in="main">vector&lt;std::vector&lt;std::vector&lt;std::uint32_t&gt;&gt;&gt;</f>
+<f rule="cache-vector-of-indirect" p="bench/bench_convergence.cpp:82" in="main">vector&lt;std::vector&lt;std::uint32_t&gt;&gt;</f>
+<f rule="cache-gather-subscript" p="bench/bench_convergence.cpp:97" in="main">m[ symN[id] ]</f>
+<f rule="cache-vector-of-indirect" p="bench/bench_newline_ab.cpp:279" in="main">vector&lt;std::vector&lt;double&gt;&gt;</f>
+<f rule="cache-gather-subscript" p="bench/bench_ordered_map.cpp:89" in="aggregateMax">m[ in.keys[ i ] ]</f>
+<f rule="cache-node-container" p="bench/bench_svector3.cpp:62" in="">map</f>
+<f rule="cache-vector-of-indirect" p="bench/bench_svector3.cpp:85" in="main">vector&lt;std::vector&lt;std::vector&lt;std::uint32_t&gt;&gt;&gt;</f>
+<f rule="cache-vector-of-indirect" p="bench/bench_svector3.cpp:85" in="main">vector&lt;std::vector&lt;std::uint32_t&gt;&gt;</f>
+<f rule="cache-gather-subscript" p="bench/bench_svector3.cpp:95" in="main">m[ symN[id] ]</f>
+<f rule="cache-node-container" p="bench/bench_svector_wave.cpp:94" in="">map</f>
+<f rule="cache-gather-subscript" p="bench/bench_svector_wave.cpp:155" in="build">m[ g_pool[ g_keyOf[i] ] ]</f>
+<f rule="cache-gather-subscript" p="bench/bench_svector_wave.cpp:162" in="readSize">g_pool[ g_readOf[i] ]</f>
+<f rule="cache-gather-subscript" p="bench/bench_svector_wave.cpp:172" in="readIterate">g_pool[ g_readOf[i] ]</f>
+<f rule="cache-gather-subscript" p="bench/bench_svector_wave.cpp:184" in="rehash">m[ g_pool[i] ]</f>
+… [607 more display lines; full output is 73564 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --lint --lint-ignore=naming-,cache-`
+
+*DROP two families, applied after selection; the raw select=/ignore= you passed rides on the root.*
+
+**wall time: 2.91s**
+
+`````
+<!-- ripwire lint schema=ripwire.lint/v1: AST-only checks, facts not gates: <rule name= count= shown_rows= rows_capped= count_capped=> of <f rule= p= in=>. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). findings_capped=/rows_capped=/count_capped=: 1 = cut. counts_floor=1: every count is a FLOOR, never a total. root=: p= relative to it. findings=N: findings over the printed rules; a floor when findings_capped=1. findings_next=: the call counting the floored rules' rest (count_capped=1 rules only, 10x per-rule budget). -->
+<lint schema="ripwire.lint/v1" findings="2371" shown="729" capped="1" total="2371" has_more="1" next_offset="729" offset="0" limit="0" counts_floor="1" findings_capped="1" findings_next="--lint --lint-select=magic-number --lint-max-per-rule=50000" selected="22 of 39" ignore="naming-,cache-" root="." … [line truncated: 1 more bytes on this line]
+<rule name="c-style-cast" count="627" shown_rows="121" rows_capped="1"/>
+<rule name="goto" count="18" shown_rows="1" rows_capped="1"/>
+<rule name="do-while" count="17" shown_rows="0" rows_capped="1"/>
+<rule name="unsafe-c-fn" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="weak-crypto" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="redundant-parens" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="suspicious-semicolon" count="0" shown_rows="0" rows_capped="0"/>
+<rule name="typedef-over-using" count="37" shown_rows="0" rows_capped="1"/>
+<rule name="magic-number" count="471" shown_rows="423" rows_capped="1" count_capped="1"/>
+<rule name="empty-catch" count="1" shown_rows="0" rows_capped="1"/>
+<rule name="self-assign" count="3" shown_rows="0" rows_capped="1"/>
+<rule name="large-function" count="324" shown_rows="59" rows_capped="1"/>
+<rule name="deep-nesting" count="382" shown_rows="62" rows_capped="1"/>
+<rule name="inconsistent-return" count="2" shown_rows="0" rows_capped="1"/>
+<rule name="unreachable-code" count="5" shown_rows="0" rows_capped="1"/>
+<rule name="atom-comma-operator" count="3" shown_rows="0" rows_capped="1"/>
+<rule name="atom-embedded-crement" count="175" shown_rows="20" rows_capped="1"/>
+<rule name="atom-assign-as-value" count="69" shown_rows="9" rows_capped="1"/>
+<rule name="atom-nested-ternary" count="195" shown_rows="32" rows_capped="1"/>
+<rule name="atom-implicit-predicate" count="3" shown_rows="2" rows_capped="1"/>
+<rule name="atom-octal-literal" count="39" shown_rows="0" rows_capped="1"/>
+<rule name="atom-reversed-subscript" count="0" shown_rows="0" rows_capped="0"/>
+<f rule="magic-number" p="bench/agentloop/editsuite/fixture/geometry.cpp:7" in="area_of_triangle">0.5</f>
+<f rule="magic-number" p="bench/bench_chase_ab.cpp:100" in="linkChain">1023u</f>
+<f rule="large-function" p="bench/bench_chase_ab.cpp:161" in="main">main (90 lines)</f>
+<f rule="magic-number" p="bench/bench_chase_ab.cpp:167" in="main">20</f>
+<f rule="atom-implicit-predicate" p="bench/bench_chase_ab.cpp:234" in="main">delta &lt; 0.02 &amp;&amp; delta &gt; -0.02</f>
+<f rule="magic-number" p="bench/bench_chase_ab.cpp:234" in="main">0.02</f>
+… [724 more display lines; full output is 66380 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --lint --lint-select=goto --lint-max-per-rule=4`
+
+*A rule that spends its own match budget (here 4, set BELOW the default 5000 so the floor shows on this repo): goto carries count_capped="1", its count= is a FLOOR, and the root names the call that counts the rest — findings_next= re-runs only the floored rules under a 10x budget.*
+
+**wall time: 2.83s**
+
+`````
+<!-- ripwire lint schema=ripwire.lint/v1: AST-only checks, facts not gates: <rule name= count= shown_rows= rows_capped= count_capped=> of <f rule= p= in=>. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). findings_capped=/rows_capped=/count_capped=: 1 = cut. counts_floor=1: every count is a FLOOR, never a total. root=: p= relative to it. findings=N: findings over the printed rules; a floor when findings_capped=1. findings_next=: the call counting the floored rules' rest (count_capped=1 rules only, 10x per-rule budget). -->
+<lint schema="ripwire.lint/v1" findings="4" shown="4" capped="1" total="4" has_more="0" next_offset="4" offset="0" limit="0" counts_floor="1" findings_capped="1" findings_next="--lint --lint-select=goto --lint-max-per-rule=40" selected="1 of 39" select="goto" root=".">
+<rule name="goto" count="4" shown_rows="4" rows_capped="0" count_capped="1"/>
+<f rule="goto" p="src/clones.h:909" in="findClonesType3">goto done;</f>
+<f rule="goto" p="src/infra/timsort.hpp:508" in="mergeLo">goto epilogue;</f>
+<f rule="goto" p="src/infra/timsort.hpp:517" in="mergeLo">goto epilogue;</f>
+<f rule="goto" p="src/infra/timsort.hpp:534" in="mergeLo">goto epilogue;</f>
+</lint>
+`````
+
+## `./build/ripwire . --lint --lint-select=goto --lint-max-per-rule=40`
+
+*Pasting that findings_next=: the same rule under a 10x budget counts its true total — no count_capped=, no findings_next=.*
+
+**wall time: 3.01s**
+
+`````
+<!-- ripwire lint schema=ripwire.lint/v1: AST-only checks, facts not gates: <rule name= count= shown_rows= rows_capped= count_capped=> of <f rule= p= in=>. window: shown= capped= (capped=1 cut). rows_capped=: 1 = cut. root=: p= relative to it. findings=N: findings over the printed rules; a floor when findings_capped=1. -->
+<lint schema="ripwire.lint/v1" findings="18" shown="18" capped="0" selected="1 of 39" select="goto" root=".">
+<rule name="goto" count="18" shown_rows="18" rows_capped="0"/>
+<f rule="goto" p="src/clones.h:909" in="findClonesType3">goto done;</f>
+<f rule="goto" p="src/infra/timsort.hpp:508" in="mergeLo">goto epilogue;</f>
+<f rule="goto" p="src/infra/timsort.hpp:517" in="mergeLo">goto epilogue;</f>
+<f rule="goto" p="src/infra/timsort.hpp:534" in="mergeLo">goto epilogue;</f>
+<f rule="goto" p="src/infra/timsort.hpp:541" in="mergeLo">goto epilogue;</f>
+<f rule="goto" p="src/infra/timsort.hpp:551" in="mergeLo">goto epilogue;</f>
+<f rule="goto" p="src/infra/timsort.hpp:558" in="mergeLo">goto epilogue;</f>
+<f rule="goto" p="src/infra/timsort.hpp:633" in="mergeHi">goto epilogue;</f>
+<f rule="goto" p="src/infra/timsort.hpp:644" in="mergeHi">goto epilogue;</f>
+<f rule="goto" p="src/infra/timsort.hpp:663" in="mergeHi">goto epilogue;</f>
+<f rule="goto" p="src/infra/timsort.hpp:670" in="mergeHi">goto epilogue;</f>
+<f rule="goto" p="src/infra/timsort.hpp:683" in="mergeHi">goto epilogue;</f>
+<f rule="goto" p="src/infra/timsort.hpp:689" in="mergeHi">goto epilogue;</f>
+<f rule="goto" p="test/forbodyslotfix/src/c/cmd-find.c:101" in="cmd_find_target">goto error;</f>
+<f rule="goto" p="test/forbodyslotfix/src/c/cmd-find.c:103" in="cmd_find_target">goto error;</f>
+<f rule="goto" p="test/forbodyslotfix/src/c/cmd-find.c:105" in="cmd_find_target">goto error;</f>
+<f rule="goto" p="test/sliceflowsensfix/disclosed.cpp:22" in="cd03">goto done;</f>
+<f rule="goto" p="test/unreachablefix/dead.cpp:48" in="withGoto">goto done;</f>
+</lint>
+`````
+
+## `./build/ripwire . --lint --lint-select=cach-`
+
+*An unresolvable PREFIX refuses (exit 1) with a did-you-mean from a real edit distance (one character off cache-).*
+
+**exit code: 1** — **wall time: 2.84s**
+
+`````
+(empty)
+`````
+
+stderr:
+
+`````
+ripwire: --lint-select: 'cach-' matches no rule or family (did you mean 'cache-'?) — see --lint-catalog for the full registry
+`````
+
+## `./build/ripwire . --lint --lint-select=nosuchfamily`
+
+*A PREFIX with no near miss at all: the refusal points at --lint-catalog instead of guessing.*
+
+**exit code: 1** — **wall time: 2.80s**
+
+`````
+(empty)
+`````
+
+stderr:
+
+`````
+ripwire: --lint-select: 'nosuchfamily' matches no rule or family — see --lint-catalog for the full registry
+`````
+
+## `./build/ripwire . --lint --sarif`
+
+*The SAME findings as SARIF 2.1.0 (what github/codeql-action/upload-sarif consumes) — pure re-serialization, results count == the native run's.*
+
+**wall time: 2.76s**
+
+`````
+{"version":"2.1.0","$schema":"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json","runs":[{"tool":{"driver":{"name":"ripwire","rules":[{"id":"c-style-cast","shortDescription":{"text":"c-style-cast"},"properties":{"builtin":true,"capped":false,"applicable": … [line truncated: 7 more bytes on this line]
+{"id":"goto","shortDescription":{"text":"goto"},"properties":{"builtin":true,"capped":false,"applicable":true}},
+{"id":"do-while","shortDescription":{"text":"do-while"},"properties":{"builtin":true,"capped":false,"applicable":true}},
+{"id":"unsafe-c-fn","shortDescription":{"text":"unsafe-c-fn"},"properties":{"builtin":true,"capped":false,"applicable":true}},
+{"id":"weak-crypto","shortDescription":{"text":"weak-crypto"},"properties":{"builtin":true,"capped":false,"applicable":true}},
+{"id":"redundant-parens","shortDescription":{"text":"redundant-parens"},"properties":{"builtin":true,"capped":false,"applicable":true}},
+{"id":"suspicious-semicolon","shortDescription":{"text":"suspicious-semicolon"},"properties":{"builtin":true,"capped":false,"applicable":true}},
+{"id":"typedef-over-using","shortDescription":{"text":"typedef-over-using"},"properties":{"builtin":true,"capped":false,"applicable":true}},
+{"id":"magic-number","shortDescription":{"text":"magic-number"},"properties":{"builtin":true,"capped":true,"applicable":true}},
+{"id":"empty-catch","shortDescription":{"text":"empty-catch"},"properties":{"builtin":true,"capped":false,"applicable":true}},
+{"id":"self-assign","shortDescription":{"text":"self-assign"},"properties":{"builtin":true,"capped":false,"applicable":true}},
+{"id":"large-function","shortDescription":{"text":"large-function"},"properties":{"builtin":true,"capped":false,"applicable":true}},
+{"id":"deep-nesting","shortDescription":{"text":"deep-nesting"},"properties":{"builtin":true,"capped":false,"applicable":true}},
+{"id":"inconsistent-return","shortDescription":{"text":"inconsistent-return"},"properties":{"builtin":true,"capped":false,"applicable":true}},
+{"id":"unreachable-code","shortDescription":{"text":"unreachable-code"},"properties":{"builtin":true,"capped":false,"applicable":true}},
+{"id":"naming-short","shortDescription":{"text":"naming-short"},"properties":{"builtin":true,"capped":false,"applicable":true}},
+{"id":"naming-wordy","shortDescription":{"text":"naming-wordy"},"properties":{"builtin":true,"capped":false,"applicable":true}},
+{"id":"naming-series","shortDescription":{"text":"naming-series"},"properties":{"builtin":true,"capped":false,"applicable":true}},
+{"id":"naming-underscore","shortDescription":{"text":"naming-underscore"},"properties":{"builtin":true,"capped":false,"applicable":true}},
+{"id":"naming-case","shortDescription":{"text":"naming-case"},"properties":{"builtin":true,"capped":false,"applicable":true}},
+{"id":"naming-predicate","shortDescription":{"text":"naming-predicate"},"properties":{"builtin":true,"capped":false,"applicable":true}},
+{"id":"naming-setter","shortDescription":{"text":"naming-setter"},"properties":{"builtin":true,"capped":false,"applicable":true}},
+{"id":"naming-confusable","shortDescription":{"text":"naming-confusable"},"properties":{"builtin":true,"capped":false,"applicable":true}},
+{"id":"naming-uninformative","shortDescription":{"text":"naming-uninformative"},"properties":{"builtin":true,"capped":false,"applicable":true}},
+{"id":"atom-comma-operator","shortDescription":{"text":"atom-comma-operator"},"properties":{"builtin":true,"capped":false,"applicable":true}},
+{"id":"atom-embedded-crement","shortDescription":{"text":"atom-embedded-crement"},"properties":{"builtin":true,"capped":false,"applicable":true}},
+{"id":"atom-assign-as-value","shortDescription":{"text":"atom-assign-as-value"},"properties":{"builtin":true,"capped":false,"applicable":true}},
+{"id":"atom-nested-ternary","shortDescription":{"text":"atom-nested-ternary"},"properties":{"builtin":true,"capped":false,"applicable":true}},
+{"id":"atom-implicit-predicate","shortDescription":{"text":"atom-implicit-predicate"},"properties":{"builtin":true,"capped":false,"applicable":true}},
+{"id":"atom-octal-literal","shortDescription":{"text":"atom-octal-literal"},"properties":{"builtin":true,"capped":false,"applicable":true}},
+… [13515 more display lines; full output is 1913639 bytes on 1 raw line(s)]
+`````
+
+Parsed summary of the same SARIF (past the display cut):
+
+`````
+sarif 2.1.0 rules= 39 results= 6753
+`````
+
+## `./build/ripwire . --lint --sarif --limit=5`
+
+*SARIF is always the FULL result set: paging alongside it refuses loudly.*
+
+**exit code: 1**
+
+`````
+(empty)
+`````
+
+stderr:
+
+`````
+ripwire: --sarif always emits the full result set — drop --limit=N/--offset=M
+`````
+
+## `./build/ripwire . --dmm`
+
+*The Delta Maintainability Model scalar for the WORKING TREE vs HEAD — recorded against a CLEAN tree (the sandbox section shows a real delta). UNAVAILABLE is a stated reason, never 0 or 1.*
+
+**wall time: 9.93s**
+
+`````
+<!-- ripwire dmm schema=ripwire.dmm/v1: Delta Maintainability Model base=→target=: dmm= good/(good+bad) units by size_metric=; <p k= dmm= good= bad= d_low= d_high=>. at=: commit+dirty+shallow. available=0: no score at all (dmm=UNAVAILABLE, reason= says why); never read as 1.000 or 0.000. combine=pooled: root dmm= is summed good over summed good+bad of the 3 properties (ripwire's own). low_loc=/low_cx=/low_params=: a unit is LOW risk at or under these lines / cyclomatic / params. base_units=/base_volume=/target_units=/target_volume=: units with a body and their line span per side. reason=: why no score (no unit's size, complexity or params moved; a tree failed to parse ...). -->
+<dmm schema="ripwire.dmm/v1" base="0712a5182ef61b6885b76af328cae18e839eb110" target="working-tree" at="0712a5182" available="0" combine="pooled" size_metric="physical-loc" low_loc="15" low_cx="5" low_params="2" dmm="UNAVAILABLE" good="0" bad="0" base_units="17849" base_volume="245474" target_units=" … [line truncated: 147 more bytes on this line]
+<p k="size" dmm="UNAVAILABLE" good="0" bad="0" d_low="0" d_high="0"/>
+<p k="complexity" dmm="UNAVAILABLE" good="0" bad="0" d_low="0" d_high="0"/>
+<p k="interfacing" dmm="UNAVAILABLE" good="0" bad="0" d_low="0" d_high="0"/>
+</dmm>
+`````
+
+## `./build/ripwire . --dmm=HEAD`
+
+*The per-commit scalar: HEAD vs its first parent, with the three separately actionable sub-scores.*
+
+**wall time: 16.42s**
+
+`````
+<!-- ripwire dmm schema=ripwire.dmm/v1: Delta Maintainability Model base=→target=: dmm= good/(good+bad) units by size_metric=; <p k= dmm= good= bad= d_low= d_high=>. at=: commit+dirty+shallow. available=0: no score at all (dmm=UNAVAILABLE, reason= says why); never read as 1.000 or 0.000. combine=pooled: root dmm= is summed good over summed good+bad of the 3 properties (ripwire's own). low_loc=/low_cx=/low_params=: a unit is LOW risk at or under these lines / cyclomatic / params. base_units=/base_volume=/target_units=/target_volume=: units with a body and their line span per side. -->
+<dmm schema="ripwire.dmm/v1" base="6df53cf0da3d0f16e750d1a150d21655114e7b45" target="0712a5182ef61b6885b76af328cae18e839eb110" at="0712a5182" available="1" combine="pooled" size_metric="physical-loc" low_loc="15" low_cx="5" low_params="2" dmm="0.877" good="229" bad="32" base_units="17828" base_volum … [line truncated: 55 more bytes on this line]
+<p k="size" dmm="0.713" good="62" bad="25" d_low="62" d_high="25"/>
+<p k="complexity" dmm="0.954" good="83" bad="4" d_low="83" d_high="4"/>
+<p k="interfacing" dmm="0.966" good="84" bad="3" d_low="84" d_high="3"/>
+</dmm>
+`````
+
+## `./build/ripwire . --dmm=HEAD~3..HEAD`
+
+*The range form: tree HEAD vs tree HEAD~3.*
+
+**wall time: 17.74s**
+
+`````
+<!-- ripwire dmm schema=ripwire.dmm/v1: Delta Maintainability Model base=→target=: dmm= good/(good+bad) units by size_metric=; <p k= dmm= good= bad= d_low= d_high=>. at=: commit+dirty+shallow. available=0: no score at all (dmm=UNAVAILABLE, reason= says why); never read as 1.000 or 0.000. combine=pooled: root dmm= is summed good over summed good+bad of the 3 properties (ripwire's own). low_loc=/low_cx=/low_params=: a unit is LOW risk at or under these lines / cyclomatic / params. base_units=/base_volume=/target_units=/target_volume=: units with a body and their line span per side. -->
+<dmm schema="ripwire.dmm/v1" base="a45f4da6b732d05e0282b5d5cd95064d5730f591" target="0712a5182ef61b6885b76af328cae18e839eb110" at="0712a5182" available="1" combine="pooled" size_metric="physical-loc" low_loc="15" low_cx="5" low_params="2" dmm="0.877" good="229" bad="32" base_units="17828" base_volum … [line truncated: 55 more bytes on this line]
+<p k="size" dmm="0.713" good="62" bad="25" d_low="62" d_high="25"/>
+<p k="complexity" dmm="0.954" good="83" bad="4" d_low="83" d_high="4"/>
+<p k="interfacing" dmm="0.966" good="84" bad="3" d_low="84" d_high="3"/>
+</dmm>
+`````
+
+## `./build/ripwire . --cochange --cochange-groups`
+
+*Modularity-violation GROUPS instead of pairs: "X co-changes with {A,B,C}, none of which it depends on" — a greedy cover, disclosed as greedy.*
+
+**wall time: 5.56s**
+
+`````
+<!-- ripwire cochange schema=ripwire.cochange/v1: files that change together in git: <pair a= b= together= deg= conf_ab= conf_ba= surprising=>, or for of= <f p= together= conf_rev=>. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). at=: commit+dirty+shallow. root=: p= relative to it. sub_windows=N: equal-commit-count slices of window=; the denominator of recur=. recur=K: slices of sub_windows= the pair co-changed in; 1 = one burst, not a standing coupling. -->
+<cochange schema="ripwire.cochange/v1" groups="130" pairs_covered="1067" cover="greedy" window="18mo@HEAD" sub_windows="3" shown="30" capped="1" total="130" has_more="1" next_offset="30" offset="0" limit="0" root="." at="0712a5182">
+<group core="src/cli.h" partners="79">
+<f p="src/abicheck.h" together="3" recur="2" conf_core="0.01"/>
+<f p="src/arch.h" together="5" recur="2" conf_core="0.01"/>
+<f p="src/clones.h" together="6" recur="2" conf_core="0.01"/>
+<f p="src/codexdoctor.h" together="3" recur="2" conf_core="0.01"/>
+<f p="src/columnar.h" together="3" recur="2" conf_core="0.01"/>
+<f p="src/commentcoherence.h" together="3" recur="2" conf_core="0.01"/>
+<f p="src/compactlegend.h" together="105" recur="3" conf_core="0.21"/>
+<f p="src/contextratio.h" together="4" recur="2" conf_core="0.01"/>
+<f p="src/countfloor.h" together="3" recur="1" conf_core="0.01"/>
+<f p="src/crossref.h" together="20" recur="3" conf_core="0.04"/>
+<f p="src/darkflags.h" together="4" recur="2" conf_core="0.01"/>
+<f p="src/didyoumean.h" together="3" recur="1" conf_core="0.01"/>
+<f p="src/dmm.h" together="4" recur="2" conf_core="0.01"/>
+<f p="src/editcheck.h" together="11" recur="3" conf_core="0.02"/>
+<f p="src/editplan.h" together="9" recur="2" conf_core="0.02"/>
+<f p="src/editpreview.h" together="6" recur="3" conf_core="0.01"/>
+<f p="src/ensemble.h" together="7" recur="2" conf_core="0.01"/>
+<f p="src/eval.h" together="3" recur="1" conf_core="0.01"/>
+<f p="src/filter.h" together="4" recur="1" conf_core="0.01"/>
+<f p="src/flipimpact.h" together="4" recur="2" conf_core="0.01"/>
+<f p="src/forpage.h" together="5" recur="2" conf_core="0.01"/>
+<f p="src/githarden.h" together="5" recur="3" conf_core="0.01"/>
+<f p="src/gitmine.h" together="11" recur="2" conf_core="0.02"/>
+<f p="src/graph.h" together="52" recur="3" conf_core="0.10"/>
+<f p="src/graphlegend.h" together="48" recur="3" conf_core="0.10"/>
+<f p="src/handoff.h" together="6" recur="2" conf_core="0.01"/>
+<f p="src/infra/os_win32.cpp" together="3" recur="2" conf_core="0.01"/>
+… [847 more display lines; full output is 56290 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --cochange --cochange-recur=2`
+
+*Only pairs whose co-change RECURS in 2+ sub-windows of the mined window (sub_windows= is the denominator) — a one-off sprint stops reading like a structural defect.*
+
+**wall time: 5.41s**
+
+`````
+<!-- ripwire cochange schema=ripwire.cochange/v1: files that change together in git: <pair a= b= together= deg= conf_ab= conf_ba= surprising=>, or for of= <f p= together= conf_rev=>. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). at=: commit+dirty+shallow. root=: p= relative to it. pairs=N: file pairs with 3+ shared commits in window= (after min_recur), surprising or not. sub_windows=N: equal-commit-count slices of window=; the denominator of recur=. driver=a|b: the side whose changes best imply the other's, look there first; absent on a tie. recur=K: slices of sub_windows= the pair co-changed in; 1 = one burst, not a standing coupling. -->
+<cochange schema="ripwire.cochange/v1" pairs="3088" window="18mo@HEAD" sub_windows="3" min_recur="2" shown="30" capped="1" total="3088" has_more="1" next_offset="30" offset="0" limit="0" root="." at="0712a5182">
+<pair a="test/headsnapcachecheck.sh" b="test/qsnapcachecheck.sh" together="4" deg="1.00" conf_ab="1.00" conf_ba="1.00" recur="2" surprising="1"/>
+<pair a="test/qsnapcachecheck.sh" b="test/qsnapprefetchcheck.sh" together="4" deg="1.00" conf_ab="1.00" conf_ba="0.67" driver="a" recur="2" surprising="1"/>
+<pair a="test/headsnapcachecheck.sh" b="test/qsnapprefetchcheck.sh" together="4" deg="1.00" conf_ab="1.00" conf_ba="0.67" driver="a" recur="2" surprising="1"/>
+<pair a="test/cachesplitcheck.sh" b="test/evictioncheck.sh" together="3" deg="1.00" conf_ab="1.00" conf_ba="0.23" driver="a" recur="2" surprising="1"/>
+<pair a="test/mcpslicecheck.sh" b="test/mcpverbscheck.sh" together="3" deg="1.00" conf_ab="1.00" conf_ba="0.16" driver="a" recur="2" surprising="1"/>
+<pair a="test/pincensuscheck.sh" b="test/scipjoincheck.sh" together="3" deg="1.00" conf_ab="0.38" conf_ba="1.00" driver="b" recur="3" surprising="1"/>
+<pair a="src/binstale.h" b="src/crossref.h" together="3" deg="1.00" conf_ab="1.00" conf_ba="0.04" driver="a" recur="3" surprising="1"/>
+<pair a="test/elixircheck.sh" b="test/elixirsemanticcheck.sh" together="3" deg="1.00" conf_ab="0.14" conf_ba="1.00" driver="b" recur="2" surprising="1"/>
+<pair a="test/luacheck.sh" b="test/phpcheck.sh" together="3" deg="1.00" conf_ab="0.75" conf_ba="1.00" driver="b" recur="2" surprising="1"/>
+<pair a="src/graph.h" b="src/ingest_jsimports.h" together="8" deg="0.89" conf_ab="0.02" conf_ba="0.89" driver="b" recur="2" surprising="1"/>
+<pair a="src/ingest_model.h" b="src/model.h" together="35" deg="0.88" conf_ab="0.88" conf_ba="0.15" driver="a" recur="3" surprising="1"/>
+<pair a="hooks/ripwire-claude-route.sh" b="hooks/ripwire-codex-route.sh" together="18" deg="0.86" conf_ab="0.82" conf_ba="0.86" driver="b" recur="3" surprising="1"/>
+<pair a="src/cli.h" b="src/sarif.h" together="6" deg="0.86" conf_ab="0.01" conf_ba="0.86" driver="b" recur="3" surprising="1"/>
+<pair a="src/fielduses.h" b="src/verbs_navigate.h" together="5" deg="0.83" conf_ab="0.83" conf_ba="0.02" driver="a" recur="3" surprising="1"/>
+<pair a="src/serialize.h" b="src/verify.h" together="5" deg="0.83" conf_ab="0.01" conf_ba="0.83" driver="b" recur="2" surprising="1"/>
+<pair a="test/anchorcheck.sh" b="test/routecheck.sh" together="13" deg="0.81" conf_ab="0.81" conf_ba="0.72" driver="a" recur="3" surprising="1"/>
+<pair a="test/nestedimportcheck.sh" b="test/preproccondcheck.sh" together="4" deg="0.80" conf_ab="0.67" conf_ba="0.80" driver="b" recur="2" surprising="1"/>
+<pair a="src/ingest_cache.h" b="src/quality.h" together="208" deg="0.79" conf_ab="0.79" conf_ba="0.46" driver="a" recur="3" surprising="1"/>
+<pair a="src/graph.h" b="src/ingest_model.h" together="31" deg="0.78" conf_ab="0.07" conf_ba="0.78" driver="b" recur="3" surprising="1"/>
+<pair a="hooks/ripwire-claude-route.sh" b="hooks/ripwire-claude-toolroute.sh" together="6" deg="0.75" conf_ab="0.27" conf_ba="0.75" driver="b" recur="2" surprising="1"/>
+<pair a="test/estchargecheck.sh" b="test/tracecheck.sh" together="3" deg="0.75" conf_ab="0.05" conf_ba="0.75" driver="b" recur="3" surprising="1"/>
+<pair a="test/droppedpositivecheck.sh" b="test/mcpforparitycheck.sh" together="3" deg="0.75" conf_ab="0.75" conf_ba="0.30" driver="a" recur="2" surprising="1"/>
+<pair a="test/tracecheck.sh" b="test/w3fixbudgetcheck.sh" together="3" deg="0.75" conf_ab="0.75" conf_ba="0.75" recur="3" surprising="1"/>
+<pair a="src/ingest_sidecap.h" b="src/preprocdead.h" together="3" deg="0.75" conf_ab="0.02" conf_ba="0.75" driver="b" recur="2" surprising="1"/>
+<pair a="src/infra/profilePmc.h" b="test/pmccheck_harness.cpp" together="3" deg="0.75" conf_ab="0.50" conf_ba="0.75" driver="b" recur="2" surprising="1"/>
+<pair a="src/abicheck.h" b="src/landingplan.h" together="3" deg="0.75" conf_ab="0.27" conf_ba="0.75" driver="b" recur="3" surprising="1"/>
+<pair a="test/estchargecheck.sh" b="test/w3fixbudgetcheck.sh" together="3" deg="0.75" conf_ab="0.05" conf_ba="0.75" driver="b" recur="2" surprising="1"/>
+<pair a="src/callhierarchy.h" b="src/verbs_navigate.h" together="32" deg="0.74" conf_ab="0.74" conf_ba="0.15" driver="a" recur="3" surprising="1"/>
+<pair a="hooks/ripwire-claude-route.sh" b="test/routehookcheck.sh" together="14" deg="0.74" conf_ab="0.64" conf_ba="0.74" driver="b" recur="3" surprising="1"/>
+<pair a="src/ingest_cache.h" b="src/ingest_model.h" together="29" deg="0.72" conf_ab="0.11" conf_ba="0.72" driver="b" recur="3" surprising="1"/>
+</cochange>
+`````
+
+## `./build/ripwire . --html=<scratch>/aux/map2.html --color-by=community`
+
+*The HTML graph with the initial colour mode set to community (the page embeds all five modes and keeps a live selector).*
+
+**wall time: 4.67s**
+
+`````
+(empty)
+`````
+
+Artifact written:
+
+`````
+  156039 <scratch>/aux/map2.html
+`````
+
+## `./build/ripwire . --index-out=<scratch>/aux/ci_index`
+
+*CI generate-and-exit: cold-parse and write BOTH committable cache families (lean + rich), no map on stdout.*
+
+**wall time: 6.02s**
+
+`````
+(empty)
+`````
+
+stderr:
+
+`````
+ripwire: --index-out wrote <scratch>/aux/ci_index.lean.ripwirecache (28779725 bytes, lean family)
+ripwire: --index-out wrote <scratch>/aux/ci_index.rich.ripwirecache (58976312 bytes, rich family)
+`````
+
+Artifact written:
+
+`````
+ 28779725 <scratch>/aux/ci_index.lean.ripwirecache
+ 58976312 <scratch>/aux/ci_index.rich.ripwirecache
+ 87756037 total
+`````
+
+## `./build/ripwire . --cache=<scratch>/aux/ci_index.lean.ripwirecache --top-k=3`
+
+*Consume the lean artifact in a PR job: restore-equivalence, never blob-byte-identity.*
+
+**wall time: 1.86s**
+
+`````
+<!-- ripwire map schema=ripwire.map/v1: ranked symbol map: <f p= layer=> groups <s t= n= sc= k= amb=> rows (k= rank), <c n=> resolved callees; the header comment is data. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. pr_iters=N: PageRank iterations. <inv listed= unlisted=>: files the ranked rows show / do not (sum = files=), each named or counted below. <entry p= n=>: a program entry by its language's convention (C/Go/Rust main, Java/C# static main, a script main its module scope calls, __main__.py), callees as c rows; manifest entries not read. <ls p= n= f=>: n= unshown files under dir p=; f= names its code files, the rest (tests, docs, config, test/doc/example dirs) counted. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. amb=K: K calls split over several defs. -->
+<!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
+<!-- files=3631 symbols=31860 edges=30033 shown=3 est_tokens=3272 ambiguous=2933 unresolved=15249 locality_pinned=9 external=8658 declined=30154 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
+<r schema="ripwire.map/v1" root="." est_tokens="3272" pr_iters="36">
+<f p="src/infra/nodekind.h" layer="infra">
+<s t="fn" n="kindIs" sc="rw" k="0.0037">
+</s>
+</f>
+<f p="src/infra/Diagnostics.h" layer="infra">
+<s t="macro" n="ASSUME" amb="1" k="0.0022">
+<c n="RW_ASSUME_" prov="split"/>
+<c n="RW_ASSUME_" prov="split"/>
+</s>
+<s t="macro" n="RW_ASSUME_" k="0.0022">
+<c n="RW_CHECK_"/>
+</s>
+</f>
+<inv listed="2" unlisted="3629">
+<entry p="scripts/changelog_assemble.py" n="main">
+<c n="repoRoot"/>
+<c n="fragmentNames"/>
+<c n="check"/>
+<c n="assembledEntries"/>
+<c n="release"/>
+</entry>
+<entry p="scripts/optremarks.py" n="main">
+<c n="parse_record_file"/>
+<c n="is_foreign"/>
+</entry>
+<entry p="src/main.cpp" n="main">
+… [63 more display lines; full output is 8141 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --pin-census=<scratch>/aux/pin_census.tsv --top-k=3`
+
+*Eval-only: a per-call-site census of WHICH mechanism resolved each call, and the canonical id of every surviving target.*
+
+**wall time: 2.37s**
+
+`````
+<!-- ripwire map schema=ripwire.map/v1: ranked symbol map: <f p= layer=> groups <s t= n= sc= k= amb=> rows (k= rank), <c n=> resolved callees; the header comment is data. est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. pr_iters=N: PageRank iterations. <inv listed= unlisted=>: files the ranked rows show / do not (sum = files=), each named or counted below. <entry p= n=>: a program entry by its language's convention (C/Go/Rust main, Java/C# static main, a script main its module scope calls, __main__.py), callees as c rows; manifest entries not read. <ls p= n= f=>: n= unshown files under dir p=; f= names its code files, the rest (tests, docs, config, test/doc/example dirs) counted. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. prov=scip|binding|import|split|final-segment: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick; final-segment = a qualified type matched by last name only. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. amb=K: K calls split over several defs. -->
+<!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
+<!-- files=3631 symbols=31860 edges=30033 shown=3 est_tokens=3272 ambiguous=2933 unresolved=15249 locality_pinned=9 external=8658 declined=30154 extent_suspect_syms=12 macro_blanked_files=7 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
+<r schema="ripwire.map/v1" root="." est_tokens="3272" pr_iters="36">
+<f p="src/infra/nodekind.h" layer="infra">
+<s t="fn" n="kindIs" sc="rw" k="0.0037">
+</s>
+</f>
+<f p="src/infra/Diagnostics.h" layer="infra">
+<s t="macro" n="ASSUME" amb="1" k="0.0022">
+<c n="RW_ASSUME_" prov="split"/>
+<c n="RW_ASSUME_" prov="split"/>
+</s>
+<s t="macro" n="RW_ASSUME_" k="0.0022">
+<c n="RW_CHECK_"/>
+</s>
+</f>
+<inv listed="2" unlisted="3629">
+<entry p="scripts/changelog_assemble.py" n="main">
+<c n="repoRoot"/>
+<c n="fragmentNames"/>
+<c n="check"/>
+<c n="assembledEntries"/>
+<c n="release"/>
+</entry>
+<entry p="scripts/optremarks.py" n="main">
+<c n="parse_record_file"/>
+<c n="is_foreign"/>
+</entry>
+<entry p="src/main.cpp" n="main">
+… [63 more display lines; full output is 8141 bytes on 1 raw line(s)]
+`````
+
+Artifact written:
+
+`````
+# ripwire pin-census v3	C=kind\tmech\tpre\tpost\tflags\tcaller_id\tcallee\ttargets(|-sep)\tline
+# v3 field escape: every id and callee field is escaped, so no separator occurs inside one. A backslash is
+#   written \\, TAB \t, LF \n, CR \r, every other control byte 0x00-0x1f and the targets separator | as \xHH
+#   (lowercase hex). Split lines on LF, fields on TAB and targets on |, THEN decode. Columns are unchanged
+#   from v2 and an id without those bytes is spelled exactly as in v2; a C++ out-of-line template member
+#   whose template-argument list spans lines keeps its line break as \n instead of splitting the row.
+# line is the 1-based call-site line in the caller's file (v2, appended LAST so v1 readers are unchanged):
+#   the key a SCIP occurrence joins on, so a coverage loss can be classified per site instead of guessed.
+  129635 <scratch>/aux/pin_census.tsv
+`````
+
+## `./build/ripwire . --plan-lint=test/planlintfix/wave.md`
+
+*The house PLAN/DESIGN format's STRUCTURE check — never semantics; exit 2 when a card or ledger row gates.*
+
+**exit code: 2** — **wall time: 3.44s**
+
+`````
+<!-- ripwire plan-lint schema=ripwire.plan-lint/v1: structural lint of a plan document: each finding names the section and the rule. at=: commit+dirty+shallow. file=/dialect=: the plan read and whether the PLAN dialect was detected (dialect=0: nothing to lint). cards=/ledger=: card rows found / whether the doc carries a ledger (ledger_line= names its line). git=1: git was available, so the staleness read ran; stale_commits=N: a waiting card N commits behind HEAD is stale. gating=N: findings that fail the plan (exit 2); the rest are advisory. -->
+<plan-lint schema="ripwire.plan-lint/v1" file="test/planlintfix/wave.md" dialect="1" cards="3" ledger="1" ledger_line="21" at="0712a5182" git="1" stale_commits="20" gating="3">
+<card id="T1" line="10" status="check" tline="12"/>
+<card id="T2" line="14" status="cross" tline="16"/>
+<card id="T5" line="18" status="missing" tline="19" why="unlaunched" gating="1"/>
+<ledger-orphan id="T9" line="24" gating="1"/>
+<owed line="22">
+<![CDATA[- 2026-08-01 — T2 owed a re-check]]>
+</owed>
+<owed line="24" gating="1">
+<![CDATA[- 2026-08-03 — T9 owed a kickoff review, still pending]]>
+</owed>
+</plan-lint>
+`````
+
+## `./build/ripwire . --plan-lint=test/planlintfix/wave_ledger.md`
+
+*The ledger-shaped fixture through the same check (exit 2: one gating card).*
+
+**exit code: 2** — **wall time: 3.12s**
+
+`````
+<!-- ripwire plan-lint schema=ripwire.plan-lint/v1: structural lint of a plan document: each finding names the section and the rule. at=: commit+dirty+shallow. file=/dialect=: the plan read and whether the PLAN dialect was detected (dialect=0: nothing to lint). cards=/ledger=: card rows found / whether the doc carries a ledger (ledger_line= names its line). git=1: git was available, so the staleness read ran; stale_commits=N: a waiting card N commits behind HEAD is stale. gating=N: findings that fail the plan (exit 2); the rest are advisory. -->
+<plan-lint schema="ripwire.plan-lint/v1" file="test/planlintfix/wave_ledger.md" dialect="1" cards="4" ledger="1" ledger_line="17" at="0712a5182" git="1" stale_commits="20" gating="1">
+<card id="T1" line="4" status="check" tline="6"/>
+<card id="T2" line="8" status="check" tline="18" src="ledger"/>
+<card id="T5" line="11" status="missing" tline="12" why="unlaunched" gating="1"/>
+<card id="T7" line="14" status="check" tline="20" src="ledger"/>
+</plan-lint>
+`````
+
+## `./build/ripwire . --doctor --agent=claude`
+
+*--doctor plus a LIVE integration inspection for one agent: PATH binary, installed-skill manifest parity, hook executability, MCP wiring — read-only, fixed repair commands, never config contents; exit 1 when any check fails.*
+
+**exit code: 1** — **wall time: 28.14s**
+
+`````
+<!-- ripwire doctor schema=ripwire.doctor/v1: setup health: <c n= ok=> checks; exit 1 when one fails. at=: commit+dirty+shallow. n=: the check's name (binary-path, grammars, cache-dir, git, tree-sitter, index-cache, layout ...). agent=: the agent named by the agent flag; its live-integration c rows follow the built-in checks. loaded=/expected=: grammars whose tags query compiled / grammars compiled in; a shortfall fails the row. dir=: the per-user cache directory scanned (TMPDIR/XDG_CACHE_HOME ladder); unwritable fails the row. blobs=N: ripwire cache blobs in dir=; the scan stops at 4096 (blobs_floor=1 then). bytes=N: total size in bytes of the blobs counted (short when truncated=1). many=1: more than 50 blobs; an eviction-sanity flag, informational, never fails the row. truncated=1: cache-dir, blob scan cut (cap or I/O error); tracked-binaries, scan SKIPPED, stale=0 unmeasured. locks=N: advisory edit-lock files under locks/; unheld ones over a day old are swept on a cache write. volatile=: this row's attributes that read LIVE machine state; a determinism diff strips them, never the row. git=0|1: git runs from PATH; 0 fails the row (churn verbs need it). repo=0|1: the root is inside a git work tree; 0 is a diagnosis, not a failure. history=0|1: the repo has at least one commit; head= prints only when it does. head=: HEAD's short sha (9 hex, the at= width). core_abi=/cpp_grammar_abi=: tree-sitter core language ABI / the C++ grammar's ABI; informational. languages=N: distinct compiled-in grammars (the grammars row's expected=). tracked=N: git ls-files count, printed even when truncated=1 (over 20000 files skips the scan). binaries=N: tracked paths that sniff as binary content. non_git=1: no git history to compare; the row passes unscanned. stale=N: tracked binaries committed before a same-dir same-stem source changed; any fails the row. cache_version=/parser_ver_lean=/parser_ver_rich=/artifact_arch=: index identity; reuse needs all four. rich_verbs=: the verbs that consume the rich artifact (rich=); every other verb reads the lean one. source=: auto (per-root blob), cache-flag (named by the cache flag) or disabled (no-cache: nothing read). lean_path=/rich_path=: the artifact files checked; one path when the cache flag named it. lean=/rich=: can THIS binary open that artifact (ok, absent, parser-version ...); format, never freshness. fsmonitor=: the checkout's core.fsmonitor at startup: unset, builtin, off, or hook (a command git runs). neutralised=1: a hook fsmonitor was overridden to false for this run; 0 when none was needed. filter_drivers=N: filter drivers the repository's own config defines; filter_scope= local|all, filter_pinned= 1 (run with an empty command) or refused. state=: layout records agree, disagree (mixed binary: rebuild clean-first), not-checked or no-records. checked=1: the cross-unit layout comparison ran; 0 = under two comparable records. units=N: translation units that registered a layout record. types=N: layout types recorded (only those registered in src/model.h); omitted on state=disagree. checks=/passed=: checks run / how many passed; exit 1 when passed= is below checks=. built_from=: the commit this binary was built from; at= is the tree HEAD now, a mismatch is normal. self=/which=: this binary's path and the one which ripwire finds on PATH; which_version= is the version line that one prints when they differ. on_path=0|1: whether a ripwire is on PATH; 0 fails the row and hint= carries the export line. same_file=1: the PATH copy is this very file (same device and inode). same_bytes=1: a different file with identical content, a copied install (ok); 0 fails the row; unknown: a file was unreadable; the row fails unverified (hint= names it). self_mtime=/self_size=/which_mtime=/which_size=: epoch mtime and byte size of each binary. hint=: the row's verdict and fix in plain text (which binary is stale, what to run). -->
+<doctor schema="ripwire.doctor/v1" checks="12" passed="10" agent="claude" at="0712a5182" built_from="0712a5182">
+<c n="binary-path" ok="0" self="./build/ripwire" which="<path>" on_path="1" same_file="0" same_bytes="0" self_mtime="1793006914" self_size="58886584" which_mtime="1792454409" which_size="55699800" which_version="ripwi … [line truncated: 393 more bytes on this line]
+<c n="grammars" ok="1" loaded="26" expected="26"/>
+<c n="cache-dir" ok="1" dir="<tmp>" blobs="556" bytes="1852087365" many="1" truncated="0" locks="4" volatile="blobs,blobs_floor,bytes,many,truncated,locks"/>
+<c n="git" ok="1" git="1" repo="1" history="1" head="0712a5182"/>
+<c n="tree-sitter" ok="1" core_abi="15" cpp_grammar_abi="14" languages="26"/>
+<c n="tracked-binaries" ok="1" tracked="4295" binaries="33" non_git="0" truncated="0" stale="0"/>
+<c n="index-cache" ok="1" cache_version="43" parser_ver_lean="231" parser_ver_rich="232" artifact_arch="16" rich_verbs="for,uses,metrics,exemplar,context-ratio,nonlocal-state,quality-panel,verify,eval-retrieval,eval-mined,eval-skills" source="auto" lean_path="<tmp> … [line truncated: 219 more bytes on this line]
+<c n="git-config-trust" ok="1" fsmonitor="unset" neutralised="0" filter_drivers="0"/>
+<c n="layout" ok="1" state="agree" checked="1" units="2" types="12"/>
+<c n="claude-binary" ok="0" on_path="1" same_file="0" copied_heuristic="0" hint="reinstall the current build so Claude Code shell calls and this doctor resolve the same ripwire binary"/>
+<c n="claude-skills" ok="1" manifest="1" declared="16" live="16"/>
+<c n="claude-hooks" ok="1" configured="1" nudge_refs="2" route_hook="1"/>
+</doctor>
+`````
+
+## `./build/ripwire . --doctor --agent=nosuch`
+
+*Other --agent values refuse.*
+
+**exit code: 1**
+
+`````
+(empty)
+`````
+
+stderr:
+
+`````
+ripwire: unsupported --agent value 'nosuch' (supported: codex, claude)
+`````
+
+
+---
+
+# the dirty-tree verbs (throwaway clone, NOT the read-only repo)
+
+Everything below runs with `cwd` = the throwaway clone at `<scratch>/dirty` (`git clone --local` of this repo, then one deliberate regression in `src/infra/sortutil.h`). The read-only repo is never touched. The binary is the same `build/ripwire`, addressed absolutely.
+
+## `./build/ripwire . --situ`
+
+*Situational report for a real diff: blast radius + tests + co-change + forgotten co-change partners.*
+
+**wall time: 12.42s**
+
+`````
+ripwire situational-awareness — 1 changed file(s), 13 symbols in them
+root: .
+at: 0712a5182+dirty
+  change_set: granularity=file changed_symbols=13 file_symbols=13 files_narrowed=0 files_file_granular=1 diff_hunks=7 diff_hunks_located=6 diff_hunks_unlocated=1 — seeds = symbols a diff -U0-vs-HEAD hunk overlaps (function/method body spans only); an unlocated hunk (module-level, deletion, rename) … [line truncated: 34 more bytes on this line]
+  [1] blast radius: 246 symbols across 58 files transitively depend on these changes (showing 8 of 58 files — shown=8 total=58 capped=1 prcontext_cap=20 (--pr-context's own per-file list is cut at 20 too); next: --situ --limit=58)
+        counts_floor=1 graph_ambiguous=2933 graph_unresolved=15249 graph_unindexed=269 (files no grammar in this build could read at all) (the map header's own gauges) — every count above is a FLOOR, never a total: call edges are name-based, so dynamic dispatch, callbacks and macros can be missing … [line truncated: 45 more bytes on this line]
+        src/mcpverbs.h  (33 dependent symbols)
+        src/quality.h  (15 dependent symbols)
+        src/verbs_quality.h  (14 dependent symbols)
+        src/verbs_for.h  (13 dependent symbols)
+        src/editcheck.h  (9 dependent symbols)
+        src/resolve.h  (9 dependent symbols)
+        src/verbs_navigate.h  (9 dependent symbols)
+        src/graph.h  (8 dependent symbols)
+  [2] tests to run (5) order=evidence: [changed] you edited it, [partner] named after a changed file, then hops asc (1 = direct); "(n): a, b" = n runner-less files sharing that evidence; a (run: …) is relative to root:
+        test/verify_radix.cpp [hops=1]   (run: bash test/greptiercheck.sh)
+        test/adaptivecutshapefix/adaptive_cut_shape_test.cpp [hops=2]   (run: bash test/adaptivecutshapecheck.sh)
+        test/includeprecise_unit.cpp [hops=2]   (run: bash test/includeprecisecheck.sh)
+        test/verify_csr.cpp [hops=2]   (run: bash test/a9disclosurecheck.sh)
+        test/rustimport_unit.cpp [hops=4]   (run: bash test/rustimportprecisecheck.sh)
+        script_gates_unmodelled=782 — test/*.sh gates never appear above: script-to-binary edges are not call edges (a path count)
+  [3] co-change — usually edited with these but NOT in your diff (0) window="18mo@HEAD" commits="5296":
+        (none — 5296 commits were mined and none co-edited a file outside your diff)
+  next: --test-gate
+`````
+
+## `./build/ripwire . --test-gate`
+
+*The pre-PR gate with real obligations — exit 4 when tests-to-run or untested blast radius is non-empty.*
+
+**exit code: 4** — **wall time: 9.40s**
+
+`````
+<!-- ripwire test-gate schema=ripwire.test-gate/v1: tests <t p= changed= partner= hops= run=> + untested blast radius <u sym= p= l= ccx=>; exit 4 while either exists. window: total= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). tests_capped=/untested_capped=: 1 = cut. counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. declined_calls=K: K call sites left unbound (no evidence chose one def), in no count or row. at=: commit+dirty+shallow. root=: p= relative to it. next=: the one pasteable follow-up. impacted=N: symbols that transitively call the change (changed symbols excluded). shown_tests=/shown_untested=: t rows and u rows printed, two independent counts. script_gates_unmodelled=N: test/*.sh runners in the corpus, a path count; not call-graph modelled. run_first=N: the first N t rows have the most direct evidence (changed/partner/hops=1, else nearest hops=); not a skip list. script_gates_registered=N: shell gates test/regression.sh registers as suite members. script_gates_mapped=N: registered gates with exact dependency evidence (literal paths or RIPWIRE_TEST_DEPS). script_gates_unresolved_dynamic=N: registered gates with no mappable deps; they may cover the change unlisted. ccx_bar=N: the cognitive-complexity bar a u row's ccx= is read against. change_granularity=: how the change set seeded — symbol = only symbols a git hunk (diff -U0 vs HEAD) locates inside a function/method body; file = whole changed files (an unlocated hunk — module-level, deletion, rename — returns its file to file-granular); mixed = both. changed_symbols=/file_symbols=: the seeds the walk used vs all symbols of the changed files. files_narrowed=/files_file_granular=: changed files under each treatment. diff_hunks=/diff_hunks_located=/diff_hunks_unlocated=: the hunk tally; an unlocated hunk is WHY a file went file-granular. untested_modscope=N: <file-scope> owners excluded from untested= (#324, uncallable); still in impacted=. tests=/untested=: tests to run (t total) / impacted symbols no test reaches (u total). -->
+<test-gate schema="ripwire.test-gate/v1" changed="1" impacted="246" tests="5" untested="222" untested_modscope="1" shown_tests="5" tests_capped="0" shown_untested="25" untested_capped="1" script_gates_unmodelled="782" script_gates_registered="733" script_gates_mapped="236" script_gates_unresolved_dy … [line truncated: 443 more bytes on this line]
+<t p="test/verify_radix.cpp" hops="1" run="bash test/greptiercheck.sh"/>
+<t p="test/adaptivecutshapefix/adaptive_cut_shape_test.cpp" hops="2" run="bash test/adaptivecutshapecheck.sh"/>
+<t p="test/includeprecise_unit.cpp" hops="2" run="bash test/includeprecisecheck.sh"/>
+<t p="test/verify_csr.cpp" hops="2" run="bash test/a9disclosurecheck.sh"/>
+<t p="test/rustimport_unit.cpp" hops="4" run="bash test/rustimportprecisecheck.sh"/>
+<u sym="dispatchMcpLine" p="src/mcp.h" l="1120" ccx="757"/>
+<u sym="runForLensPass" p="src/verbs_for.h" l="2640" ccx="485"/>
+<u sym="dispatchMain" p="src/main.cpp" l="4307" ccx="482"/>
+<u sym="runQualityDelta" p="src/verbs_quality.h" l="1714" ccx="343"/>
+<u sym="runDefaultMap" p="src/main.cpp" l="1751" ccx="313"/>
+<u sym="computeDelta" p="src/quality.h" l="9166" ccx="310"/>
+<u sym="serialize" p="src/serialize.h" l="3037" ccx="295"/>
+<u sym="runStructureText" p="src/verbs_report.h" l="3189" ccx="251"/>
+<u sym="packSignatures" p="src/serialize.h" l="5860" ccx="219"/>
+<u sym="packTaskBundleText" p="src/packtask.h" l="1438" ccx="218"/>
+<u sym="runChangeViews" p="src/verbs_change.h" l="245" ccx="157"/>
+<u sym="runBatchSub" p="src/mcpverbs.h" l="5869" ccx="138"/>
+<u sym="runArchViews" p="src/verbs_report.h" l="407" ccx="135"/>
+<u sym="pathBridge" p="src/pathgaps.h" l="1214" ccx="130"/>
+<u sym="pathNearSink" p="src/pathgaps.h" l="757" ccx="124"/>
+<u sym="packLego" p="src/serialize.h" l="9741" ccx="124"/>
+<u sym="serializeJson" p="src/serialize.h" l="10961" ccx="114"/>
+<u sym="emitGrepReport" p="src/verbs_grep.h" l="958" ccx="97"/>
+<u sym="applyMentionBoost" p="src/mention.h" l="980" ccx="92"/>
+<u sym="runLsp" p="src/lsp.h" l="943" ccx="89"/>
+<u sym="forCandidatePageDoc" p="src/forpage.h" l="198" ccx="84"/>
+<u sym="runCrossRef" p="src/verbs_change.h" l="1454" ccx="83"/>
+<u sym="runCallHierarchy" p="src/verbs_navigate.h" l="262" ccx="83"/>
+<u sym="computeLensRanking" p="src/verbs_for.h" l="84" ccx="81"/>
+<u sym="sliceEmitBody" p="src/slice.h" l="3272" ccx="78"/>
+</test-gate>
+`````
+
+## `./build/ripwire . --quality-delta`
+
+*Every row carries p="file:line", the gating rows are marked gating="1" and now bar= (the threshold each numeric row is judged against), and the exit-2 refusal prints a naming line on stderr; a gating row carries a pasteable next=.*
+
+**exit code: 2** — **wall time: 39.75s**
+
+`````
+<!-- ripwire quality-delta schema=ripwire.quality-delta/v1: only what the change made WORSE vs baseline=: regressions= minor= gating=; <r kind= sym= p= was= now= gating= bar=>, <sa> acked. value-ref-excluded=N: internal functions kept off because a table, field or argument in another function or at file scope holds them (matched by name, not a proven call); a floor. at=: commit+dirty+shallow. next=: the one pasteable follow-up. stale=N: ack ledger rows whose target no longer applies (sa rows); never gating. preexisting-worse=N: regressions on symbols that existed at baseline; they gate when major. new-symbol=N: findings on NEW code; new-symbol rows never gate, except defect-shape format-arity. register-macro-excluded=N: symbols kept out of dead-code as self-registering test/bench macros; a floor. declined-call-excluded=N: symbols kept out of dead-code only because a declined call may mean them; a floor. api-new-surface=N: new PUBLIC symbols; a count, never gates, not in regressions=. renames=/rename_window_commits=: git rename pairs read over that many commits, to re-file baseline and acks. acked_by_rename=/acked_by_content=: acked= suppressions matched via git renames / an equal body hash. renames_window_truncated=1: history is deeper than the rename window, older renames unread. r surface=: the api-surface tier, new-symbol or contract-change. acked=N: findings suppressed by the ack ledger, listed as sa rows; never gating. r sev=minor: a small numeric delta, counted in minor=, never gating (absent: major). r origin=new-symbol: a finding on NEW code (absent: preexisting-worse). sa key=/why=: the stale ack's ledger hash / target-gone (names nothing now) or finding-gone (no longer fires). r members=/tokens=: a duplication row's clone group (member ids) / their shared normalized-token count. -->
+<quality-delta schema="ripwire.quality-delta/v1" baseline="git-HEAD" regressions="9" minor="1" acked="0" stale="167" preexisting-worse="6" new-symbol="3" gating="5" register-macro-excluded="62" api-new-surface="2" at="0712a5182+dirty" renames="62" rename_window_commits="400" acked_by_rename="0" acke … [line truncated: 98 more bytes on this line]
+<r kind="api-surface" sym="src/infra/sortutil.h::rw::sortutil::nonNegativeFloatDescKey" was="1" now="2" surface="contract-change" p="src/infra/sortutil.h:109" gating="1" next="--expand=src/infra/sortutil.h:nonNegativeFloatDescKey"/>
+<r kind="complexity" sym="src/infra/sortutil.h::rw::sortutil::lessByScoreDescId" was="1" now="67" bar="15" p="src/infra/sortutil.h:49" gating="1" next="--expand=src/infra/sortutil.h:lessByScoreDescId"/>
+<r kind="dead-code" sym="src/infra/sortutil.h::rw::sortutil::nonNegativeFloatAscKeyCopy" origin="new-symbol" p="src/infra/sortutil.h:119"/>
+<r kind="dead-code" sym="src/infra/sortutil.h::rw::sortutil::sortScoredIdsWithOptions" origin="new-symbol" p="src/infra/sortutil.h:129"/>
+<r kind="duplication" members="src/infra/sortutil.h::rw::sortutil::nonNegativeFloatAscKeyCopy | src/infra/sortutil.h::rw::sortutil::nonNegativeFloatDescKey" tokens="59" p="src/infra/sortutil.h:119" gating="1"/>
+<r kind="nesting" sym="src/infra/sortutil.h::rw::sortutil::lessByScoreDescId" was="1" now="6" bar="4" p="src/infra/sortutil.h:49" gating="1" next="--expand=src/infra/sortutil.h:lessByScoreDescId"/>
+<r kind="new-clone-of-reused-helper" sym="src/infra/sortutil.h::rw::sortutil::nonNegativeFloatAscKeyCopy | src/infra/sortutil.h::rw::sortutil::nonNegativeFloatDescKey" was="0" now="4" p="src/infra/sortutil.h:119" gating="1" next="--expand=src/infra/sortutil.h:nonNegativeFloatDescKey"/>
+<r kind="params" sym="src/infra/sortutil.h::rw::sortutil::sortScoredIdsWithOptions" was="0" now="8" bar="5" origin="new-symbol" p="src/infra/sortutil.h:129"/>
+<r kind="verbosity" sym="src/infra/sortutil.h::rw::sortutil::lessByScoreDescId" was="8" now="47" bar="60" sev="minor" p="src/infra/sortutil.h:49"/>
+<sa kind="api-surface" key="085e3d408c2c4a35" why="target-gone"/>
+<sa kind="api-surface" key="155d74d341a49f3c" why="target-gone"/>
+<sa kind="api-surface" key="1a15386c2d1e47af" why="target-gone"/>
+<sa kind="api-surface" key="298e798c7f075715" why="target-gone"/>
+<sa kind="api-surface" key="56acdf9b5c314a14" why="target-gone"/>
+<sa kind="api-surface" key="5a07390012b46e06" why="target-gone"/>
+<sa kind="api-surface" key="6eef859578c8c376" why="target-gone"/>
+<sa kind="api-surface" key="6f2394762f82a855" why="target-gone"/>
+<sa kind="api-surface" key="7f2c3eefdf6e512e" why="target-gone"/>
+<sa kind="api-surface" key="802e513731103806" why="target-gone"/>
+<sa kind="api-surface" key="b6a24afef32a68a8" why="target-gone"/>
+<sa kind="api-surface" key="c923e661c197b265" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="1926b0d9e94541a0" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="1d3814ba687a4aef" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="1db76028879244ef" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="25c9f0504fd376a4" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="36e39c7ab0fc1686" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="4bce64bd920de0c3" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="61f0e361ef7dee27" why="target-gone"/>
+… [149 more display lines; full output is 18050 bytes on 1 raw line(s)]
+`````
+
+stderr:
+
+`````
+ripwire: no ./.ripwire_quality_baseline — auto-comparing the working tree vs git HEAD (commit the baseline with --quality-baseline to pin it)
+ripwire: --quality-delta gating: 5 preexisting-worse major finding(s); first: api-surface src/infra/sortutil.h::rw::sortutil::nonNegativeFloatDescKey at src/infra/sortutil.h:109 (was=1 now=2)
+`````
+
+## `./build/ripwire . --quality-delta --legend=full`
+
+*The same gating report under --legend=full — same rows, same exit 2; the default compact comment (schema="ripwire.quality-delta/v1", the shape an agent's edit loop should run) becomes ~4 KB of prose legend.*
+
+**exit code: 2** — **wall time: 20.10s**
+
+`````
+<!-- ripwire quality-delta: only what a change made WORSE against the floor baseline= names below. Descriptive: weigh and fix the real ones, do not game the number (a wrong abstraction beats a low score). TWELVE KINDS, and kind= on every row names which one: complexity over the ccx bar, verbosity (LOC), nesting, params, duplication, dead-code, api-surface (new public contract drift), error-masking, short-horizon-churn, new-clone-of-reused-helper, placeholder (added stub/TODO), defect-shape (defect= names it). THREE independent axes, in this order: (1) acked findings are suppressed entirely (acked= counts them); (2) ORIGIN — a finding on a symbol that EXISTED at the baseline is preexisting-worse (no origin attribute), one that exists only because the code is NEW carries origin="new-symbol"; (3) MATERIALITY — a small numeric delta is sev="minor", and minor= counts them. EXIT 2 fires only on preexisting-worse AND major, or on format-arity, the gating= count; new-symbol rows never gate, except defect-shape format-arity, so exit 0 is NOT a verdict on them — nothing that existed got worse, but the new debt is yours: read them. Clone kinds are new-symbol only when EVERY member is new; short-horizon-churn is preexisting by construction. preexisting-worse= and new-symbol= partition regressions=. stale= is a FOURTH axis, never gating and never counted in regressions=: rows in the .ripwire_quality_acks ledger whose target no longer applies. api-new-surface= COUNTS the new PUBLIC symbols (never gates, not in regressions=, printed even at zero). register-macro-excluded= is a FLOOR, not a finding: symbols this run excluded from the dead-code kind because their own definition is a registered self-registering test/benchmark macro call. Never gates, never counted in regressions=, printed even at zero (zero means none excluded, not that the check did not run). A gating row's next= is the one pasteable follow-up: expand on FILE:NAME, the body to fix (a duplication row names a SET and carries none). bar= on a complexity/verbosity/nesting/params row is the threshold now= is judged against (ccx 15, loc 60, nest 4, params 5). baseline="git-HEAD" means no sidecar existed, so the working tree was auto-compared against the HEAD tree — anything already committed cannot appear. at= is the git commit (plus a dirty marker when the working tree differs) this list was computed at. The registered families are doctest/Catch2 TEST_CASE, GoogleTest TEST/TEST_F/TEST_P, Google Benchmark BENCHMARK, plus any name a .ripwire_config register_macros= line adds; each registers itself through a static initializer the call graph cannot see, so zero in-edges on one is not evidence of anything. declined-call-excluded= is a FLOOR, not a finding: symbols this run kept out of the dead-code kind only because a call the resolver declined to bind (the map's declined=) could have meant them. Never gates; absent at zero. value-ref-excluded= is a FLOOR, not a finding: symbols this run kept out of the dead-code kind only because a table, field, argument or registering decorator holds them as a VALUE (matched by name; it is not a proven call; the callers verb lists the sites; @classmethod-style wrappers do not count), the --dead-code verb's own rule. Never gates; absent at zero. IDENTITY across a rename or a move: a finding is keyed path::scope::name, which a rename would destroy, so the baseline and the .ripwire_quality_acks ledger are both re-filed into the CURRENT tree's identity before either is read, by two EXACT mechanisms — git's own rename record, and equality of a whitespace-and-name-scrubbed body hash — never a similarity heuristic. renames= is how many rename pairs were read, rename_window_commits= how deep the commit window went, acked_by_rename= and acked_by_content= how many of the acked= suppressions each mechanism is responsible for. Three appear ONLY when true, so an absent one is not a silent no: renames_window_truncated= (history is deeper than the window), renames_truncated= (the pair cap was hit), renames_ambiguous= (an ancestor two current symbols both claim — refused rather than guessed). ORIGIN reads the re-filed baseline too, so a regression carried in with a rename is judged preexisting-worse and GATES instead of slipping through as new-symbol. FLOORS, stated because silence here would read as a guarantee: the two clone kinds key on a member-SET hash and are NOT re-filed, so a clone ack still dies on a rename; ORIGIN follows the rename record but never content, because the baseline stores no content id at all; and a move git recorded no rename for still reads as new-symbol. Each sa row carries key= (the ack identity as stored) and why=, which is target-gone (the key names no symbol or group any more) or finding-gone (the target survived, this kind just does not fire on it). sym= and p=path:line name WHICH ack it is, and are present exactly when the key still names a live symbol: on every finding-gone row, on none of the target-gone rows (there is nothing left to name), and on neither clone kind — a clone key hashes a member SET that no single symbol carries, so those rows are unnameable by construction rather than guessed at. Hygiene disclosure only — the ledger file is never auto-edited. ROWS: sym= is the canonical id the finding regressed on; was= and now= carry the before/after value for the numeric kinds; p="path:line" is the locator (root-relative; the first-sorting member for the clone kinds; omitted, never faked, when none resolves). churn= and surface= are per-kind classification facets (short-horizon-churn's self/ambient split; api-surface's new-symbol/contract-change tier). churn= facets never gate alone: the kind gates only on 2+ COMMITTED in-window rewrites of the edited lines. Every row the header's gating= counter counts also carries a gating attribute set to 1 — marked positively, never by the ABSENCE of sev or origin. CLONE ROWS name the whole group rather than one symbol: members= is the member list and tokens= its shared normalized-token count (the same per-group pair the clones verb reports). idiom= names a RECOGNIZED BODY SHAPE every member spells, out of a closed set of three (threshold-ladder, switch-name-table, builder-chain). idiom= alone changes nothing; a group that ALSO shares no non-keyword identifier between any two members, sits in pairwise-distinct enclosing contexts, and stays under 80 normalized tokens is an idiom COLLISION rather than a copy, and is reported minor instead of gating. Break any one of those and it gates as before, idiom= and all: two bucketing ladders over the SAME enum are a copy. The shape is read off the body's token stream and not a parse tree, so a macro-assembled body classifies as whatever its raw tokens spell — the name is printed so the call can be overruled by reading. -->
+<quality-delta baseline="git-HEAD" regressions="9" minor="1" acked="0" stale="167" preexisting-worse="6" new-symbol="3" gating="5" register-macro-excluded="62" api-new-surface="2" at="0712a5182+dirty" renames="62" rename_window_commits="400" acked_by_rename="0" acked_by_content="0" renames_window_tr … [line truncated: 64 more bytes on this line]
+<r kind="api-surface" sym="src/infra/sortutil.h::rw::sortutil::nonNegativeFloatDescKey" was="1" now="2" surface="contract-change" p="src/infra/sortutil.h:109" gating="1" next="--expand=src/infra/sortutil.h:nonNegativeFloatDescKey"/>
+<r kind="complexity" sym="src/infra/sortutil.h::rw::sortutil::lessByScoreDescId" was="1" now="67" bar="15" p="src/infra/sortutil.h:49" gating="1" next="--expand=src/infra/sortutil.h:lessByScoreDescId"/>
+<r kind="dead-code" sym="src/infra/sortutil.h::rw::sortutil::nonNegativeFloatAscKeyCopy" origin="new-symbol" p="src/infra/sortutil.h:119"/>
+<r kind="dead-code" sym="src/infra/sortutil.h::rw::sortutil::sortScoredIdsWithOptions" origin="new-symbol" p="src/infra/sortutil.h:129"/>
+<r kind="duplication" members="src/infra/sortutil.h::rw::sortutil::nonNegativeFloatAscKeyCopy | src/infra/sortutil.h::rw::sortutil::nonNegativeFloatDescKey" tokens="59" p="src/infra/sortutil.h:119" gating="1"/>
+<r kind="nesting" sym="src/infra/sortutil.h::rw::sortutil::lessByScoreDescId" was="1" now="6" bar="4" p="src/infra/sortutil.h:49" gating="1" next="--expand=src/infra/sortutil.h:lessByScoreDescId"/>
+<r kind="new-clone-of-reused-helper" sym="src/infra/sortutil.h::rw::sortutil::nonNegativeFloatAscKeyCopy | src/infra/sortutil.h::rw::sortutil::nonNegativeFloatDescKey" was="0" now="4" p="src/infra/sortutil.h:119" gating="1" next="--expand=src/infra/sortutil.h:nonNegativeFloatDescKey"/>
+<r kind="params" sym="src/infra/sortutil.h::rw::sortutil::sortScoredIdsWithOptions" was="0" now="8" bar="5" origin="new-symbol" p="src/infra/sortutil.h:129"/>
+<r kind="verbosity" sym="src/infra/sortutil.h::rw::sortutil::lessByScoreDescId" was="8" now="47" bar="60" sev="minor" p="src/infra/sortutil.h:49"/>
+<sa kind="api-surface" key="085e3d408c2c4a35" why="target-gone"/>
+<sa kind="api-surface" key="155d74d341a49f3c" why="target-gone"/>
+<sa kind="api-surface" key="1a15386c2d1e47af" why="target-gone"/>
+<sa kind="api-surface" key="298e798c7f075715" why="target-gone"/>
+<sa kind="api-surface" key="56acdf9b5c314a14" why="target-gone"/>
+<sa kind="api-surface" key="5a07390012b46e06" why="target-gone"/>
+<sa kind="api-surface" key="6eef859578c8c376" why="target-gone"/>
+<sa kind="api-surface" key="6f2394762f82a855" why="target-gone"/>
+<sa kind="api-surface" key="7f2c3eefdf6e512e" why="target-gone"/>
+<sa kind="api-surface" key="802e513731103806" why="target-gone"/>
+<sa kind="api-surface" key="b6a24afef32a68a8" why="target-gone"/>
+<sa kind="api-surface" key="c923e661c197b265" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="1926b0d9e94541a0" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="1d3814ba687a4aef" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="1db76028879244ef" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="25c9f0504fd376a4" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="36e39c7ab0fc1686" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="4bce64bd920de0c3" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="61f0e361ef7dee27" why="target-gone"/>
+… [149 more display lines; full output is 23042 bytes on 1 raw line(s)]
+`````
+
+stderr:
+
+`````
+ripwire: no ./.ripwire_quality_baseline — auto-comparing the working tree vs git HEAD (commit the baseline with --quality-baseline to pin it)
+ripwire: --quality-delta gating: 5 preexisting-worse major finding(s); first: api-surface src/infra/sortutil.h::rw::sortutil::nonNegativeFloatDescKey at src/infra/sortutil.h:109 (was=1 now=2)
+`````
+
+## `./build/ripwire . --quality-delta --json`
+
+*The same findings as JSON (one of the CI/scripting verbs --json supports) — same exit 2 as the XML form.*
+
+**exit code: 2** — **wall time: 20.08s**
+
+`````
+{"baseline":"git-HEAD","regressions":9,"minor":1,"acked":0,"stale":167,"preexisting-worse":6,"new-symbol":3,"gating":5,"register-macro-excluded":62,"api-new-surface":2,"at":"0712a5182+dirty","renames":62,"rename_window_commits":400,"acked_by_rename":0,"acked_by_content":0,"renames_window_truncated": … [line truncated: 239 more bytes on this line]
+{"kind":"complexity","sym":"src/infra/sortutil.h::rw::sortutil::lessByScoreDescId","was":1,"now":67,"p":"src/infra/sortutil.h:49","gating":true},
+{"kind":"dead-code","sym":"src/infra/sortutil.h::rw::sortutil::nonNegativeFloatAscKeyCopy","p":"src/infra/sortutil.h:119","origin":"new-symbol"},
+{"kind":"dead-code","sym":"src/infra/sortutil.h::rw::sortutil::sortScoredIdsWithOptions","p":"src/infra/sortutil.h:129","origin":"new-symbol"},
+{"kind":"duplication","members":"src/infra/sortutil.h::rw::sortutil::nonNegativeFloatAscKeyCopy | src/infra/sortutil.h::rw::sortutil::nonNegativeFloatDescKey","tokens":59,"p":"src/infra/sortutil.h:119","gating":true},
+{"kind":"nesting","sym":"src/infra/sortutil.h::rw::sortutil::lessByScoreDescId","was":1,"now":6,"p":"src/infra/sortutil.h:49","gating":true},
+{"kind":"new-clone-of-reused-helper","sym":"src/infra/sortutil.h::rw::sortutil::nonNegativeFloatAscKeyCopy | src/infra/sortutil.h::rw::sortutil::nonNegativeFloatDescKey","was":0,"now":4,"p":"src/infra/sortutil.h:119","gating":true},
+{"kind":"params","sym":"src/infra/sortutil.h::rw::sortutil::sortScoredIdsWithOptions","was":0,"now":8,"p":"src/infra/sortutil.h:129","origin":"new-symbol"},
+{"kind":"verbosity","sym":"src/infra/sortutil.h::rw::sortutil::lessByScoreDescId","was":8,"now":47,"p":"src/infra/sortutil.h:49","sev":"minor"}],
+"sa":[{"kind":"api-surface","key":"085e3d408c2c4a35","why":"target-gone"},
+{"kind":"api-surface","key":"155d74d341a49f3c","why":"target-gone"},
+{"kind":"api-surface","key":"1a15386c2d1e47af","why":"target-gone"},
+{"kind":"api-surface","key":"298e798c7f075715","why":"target-gone"},
+{"kind":"api-surface","key":"56acdf9b5c314a14","why":"target-gone"},
+{"kind":"api-surface","key":"5a07390012b46e06","why":"target-gone"},
+{"kind":"api-surface","key":"6eef859578c8c376","why":"target-gone"},
+{"kind":"api-surface","key":"6f2394762f82a855","why":"target-gone"},
+{"kind":"api-surface","key":"7f2c3eefdf6e512e","why":"target-gone"},
+{"kind":"api-surface","key":"802e513731103806","why":"target-gone"},
+{"kind":"api-surface","key":"b6a24afef32a68a8","why":"target-gone"},
+{"kind":"api-surface","key":"c923e661c197b265","why":"target-gone"},
+{"kind":"api-surface:new-symbol","key":"1926b0d9e94541a0","why":"target-gone"},
+{"kind":"api-surface:new-symbol","key":"1d3814ba687a4aef","why":"target-gone"},
+{"kind":"api-surface:new-symbol","key":"1db76028879244ef","why":"target-gone"},
+{"kind":"api-surface:new-symbol","key":"25c9f0504fd376a4","why":"target-gone"},
+{"kind":"api-surface:new-symbol","key":"36e39c7ab0fc1686","why":"target-gone"},
+{"kind":"api-surface:new-symbol","key":"4bce64bd920de0c3","why":"target-gone"},
+{"kind":"api-surface:new-symbol","key":"61f0e361ef7dee27","why":"target-gone"},
+{"kind":"api-surface:new-symbol","key":"79625906f9f71ad0","why":"target-gone"},
+{"kind":"api-surface:new-symbol","key":"8ecb190954dce18a","why":"target-gone"},
+… [146 more display lines; full output is 16644 bytes on 1 raw line(s)]
+`````
+
+stderr:
+
+`````
+ripwire: no ./.ripwire_quality_baseline — auto-comparing the working tree vs git HEAD (commit the baseline with --quality-baseline to pin it)
+ripwire: --quality-delta gating: 5 preexisting-worse major finding(s); first: api-surface src/infra/sortutil.h::rw::sortutil::nonNegativeFloatDescKey at src/infra/sortutil.h:109 (was=1 now=2)
+`````
+
+## `./build/ripwire . --quality-delta --quality-ack --ack-only=zzznope`
+
+*NEW FLAG: --ack-only matching nothing REFUSES rather than falling back to acking everything.*
+
+**exit code: 1** — **wall time: 15.47s**
+
+`````
+(empty)
+`````
+
+stderr:
+
+`````
+ripwire: no ./.ripwire_quality_baseline — auto-comparing the working tree vs git HEAD (commit the baseline with --quality-baseline to pin it)
+ripwire: ack provenance backfill — 0 clone row(s) reconstructed from the current tree, 213 re-derived, 21 left UNVERIFIED (their group was not found here — a floor, not proof it is gone), 56 left legacy (member set not found cloning here — a floor, not proof it is gone), 1311 ineligible (no cu … [line truncated: 200 more bytes on this line]
+ripwire: --ack-only=zzznope matched none of the 9 finding(s) — nothing written
+`````
+
+## `./build/ripwire . --quality-delta --quality-ack --ack-only=api-surface`
+
+*NEW FLAG: ack only the api-surface findings — a per-finding ratchet instead of a rubber stamp.*
+
+**wall time: 18.13s**
+
+`````
+(empty)
+`````
+
+stderr:
+
+`````
+ripwire: no ./.ripwire_quality_baseline — auto-comparing the working tree vs git HEAD (commit the baseline with --quality-baseline to pin it)
+ripwire: ack provenance backfill — 0 clone row(s) reconstructed from the current tree, 213 re-derived, 21 left UNVERIFIED (their group was not found here — a floor, not proof it is gone), 56 left legacy (member set not found cloning here — a floor, not proof it is gone), 1311 ineligible (no cu … [line truncated: 200 more bytes on this line]
+ripwire: acknowledged 1 of 9 finding(s) (8 left UNACKED by --ack-only, 0 already acked) → ./.ripwire_quality_acks
+`````
+
+## `./build/ripwire . --quality-delta`
+
+*Re-run after the partial ack: acked=3, the rest still gate (exit 2).*
+
+**exit code: 2** — **wall time: 23.07s**
+
+`````
+<!-- ripwire quality-delta schema=ripwire.quality-delta/v1: only what the change made WORSE vs baseline=: regressions= minor= gating=; <r kind= sym= p= was= now= gating= bar=>, <sa> acked. value-ref-excluded=N: internal functions kept off because a table, field or argument in another function or at file scope holds them (matched by name, not a proven call); a floor. at=: commit+dirty+shallow. next=: the one pasteable follow-up. stale=N: ack ledger rows whose target no longer applies (sa rows); never gating. preexisting-worse=N: regressions on symbols that existed at baseline; they gate when major. new-symbol=N: findings on NEW code; new-symbol rows never gate, except defect-shape format-arity. register-macro-excluded=N: symbols kept out of dead-code as self-registering test/bench macros; a floor. declined-call-excluded=N: symbols kept out of dead-code only because a declined call may mean them; a floor. api-new-surface=N: new PUBLIC symbols; a count, never gates, not in regressions=. renames=/rename_window_commits=: git rename pairs read over that many commits, to re-file baseline and acks. acked_by_rename=/acked_by_content=: acked= suppressions matched via git renames / an equal body hash. renames_window_truncated=1: history is deeper than the rename window, older renames unread. acked=N: findings suppressed by the ack ledger, listed as sa rows; never gating. r sev=minor: a small numeric delta, counted in minor=, never gating (absent: major). r origin=new-symbol: a finding on NEW code (absent: preexisting-worse). sa key=/why=: the stale ack's ledger hash / target-gone (names nothing now) or finding-gone (no longer fires). r members=/tokens=: a duplication row's clone group (member ids) / their shared normalized-token count. -->
+<quality-delta schema="ripwire.quality-delta/v1" baseline="git-HEAD" regressions="8" minor="1" acked="1" stale="167" preexisting-worse="5" new-symbol="3" gating="4" register-macro-excluded="62" api-new-surface="2" at="0712a5182+dirty" renames="62" rename_window_commits="400" acked_by_rename="0" acke … [line truncated: 98 more bytes on this line]
+<r kind="complexity" sym="src/infra/sortutil.h::rw::sortutil::lessByScoreDescId" was="1" now="67" bar="15" p="src/infra/sortutil.h:49" gating="1" next="--expand=src/infra/sortutil.h:lessByScoreDescId"/>
+<r kind="dead-code" sym="src/infra/sortutil.h::rw::sortutil::nonNegativeFloatAscKeyCopy" origin="new-symbol" p="src/infra/sortutil.h:119"/>
+<r kind="dead-code" sym="src/infra/sortutil.h::rw::sortutil::sortScoredIdsWithOptions" origin="new-symbol" p="src/infra/sortutil.h:129"/>
+<r kind="duplication" members="src/infra/sortutil.h::rw::sortutil::nonNegativeFloatAscKeyCopy | src/infra/sortutil.h::rw::sortutil::nonNegativeFloatDescKey" tokens="59" p="src/infra/sortutil.h:119" gating="1"/>
+<r kind="nesting" sym="src/infra/sortutil.h::rw::sortutil::lessByScoreDescId" was="1" now="6" bar="4" p="src/infra/sortutil.h:49" gating="1" next="--expand=src/infra/sortutil.h:lessByScoreDescId"/>
+<r kind="new-clone-of-reused-helper" sym="src/infra/sortutil.h::rw::sortutil::nonNegativeFloatAscKeyCopy | src/infra/sortutil.h::rw::sortutil::nonNegativeFloatDescKey" was="0" now="4" p="src/infra/sortutil.h:119" gating="1" next="--expand=src/infra/sortutil.h:nonNegativeFloatDescKey"/>
+<r kind="params" sym="src/infra/sortutil.h::rw::sortutil::sortScoredIdsWithOptions" was="0" now="8" bar="5" origin="new-symbol" p="src/infra/sortutil.h:129"/>
+<r kind="verbosity" sym="src/infra/sortutil.h::rw::sortutil::lessByScoreDescId" was="8" now="47" bar="60" sev="minor" p="src/infra/sortutil.h:49"/>
+<sa kind="api-surface" key="085e3d408c2c4a35" why="target-gone"/>
+<sa kind="api-surface" key="155d74d341a49f3c" why="target-gone"/>
+<sa kind="api-surface" key="1a15386c2d1e47af" why="target-gone"/>
+<sa kind="api-surface" key="298e798c7f075715" why="target-gone"/>
+<sa kind="api-surface" key="56acdf9b5c314a14" why="target-gone"/>
+<sa kind="api-surface" key="5a07390012b46e06" why="target-gone"/>
+<sa kind="api-surface" key="6eef859578c8c376" why="target-gone"/>
+<sa kind="api-surface" key="6f2394762f82a855" why="target-gone"/>
+<sa kind="api-surface" key="7f2c3eefdf6e512e" why="target-gone"/>
+<sa kind="api-surface" key="802e513731103806" why="target-gone"/>
+<sa kind="api-surface" key="b6a24afef32a68a8" why="target-gone"/>
+<sa kind="api-surface" key="c923e661c197b265" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="1926b0d9e94541a0" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="1d3814ba687a4aef" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="1db76028879244ef" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="25c9f0504fd376a4" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="36e39c7ab0fc1686" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="4bce64bd920de0c3" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="61f0e361ef7dee27" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="79625906f9f71ad0" why="target-gone"/>
+… [148 more display lines; full output is 17753 bytes on 1 raw line(s)]
+`````
+
+stderr:
+
+`````
+ripwire: no ./.ripwire_quality_baseline — auto-comparing the working tree vs git HEAD (commit the baseline with --quality-baseline to pin it)
+ripwire: --quality-delta gating: 4 preexisting-worse major finding(s); first: complexity src/infra/sortutil.h::rw::sortutil::lessByScoreDescId at src/infra/sortutil.h:49 (was=1 now=67)
+`````
+
+## `./build/ripwire . --ack-only=gating`
+
+*--ack-only WITHOUT --quality-ack REFUSES loudly (exit 1, the pairing named) — it used to be silently ignored.*
+
+**exit code: 1**
+
+`````
+(empty)
+`````
+
+stderr:
+
+`````
+ripwire: --ack-only=SUBSTR narrows --quality-ack — pass both (e.g. ripwire <dir> --quality-delta --ack-only=contract-change --quality-ack="reason")
+`````
+
+## `./build/ripwire . --edit-check=nonNegativeFloatDescKey`
+
+*A real contract-change: was=1 now=2 params, with the call sites that are now provably incompatible, and a pasteable next= (--uses=SYM) on the root.*
+
+**wall time: 4.38s**
+
+`````
+<!-- ripwire edit-check schema=ripwire.edit-check/v1: sym='s contract NOW vs HEAD: status=unchanged|new-symbol|contract-change; <c n= p= incompatible=1 sites_l=> callers. counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. est_tokens=: price as emitted (an upper bound under compact). at=: commit+dirty+shallow. root=: p= relative to it. next=: the one pasteable follow-up. defs=N: overloads at this site (same file, scope, name) folded into one contract; params compared by MAX. callers=N: callers of sym= (the c rows' total; a floor). -->
+<edit-check schema="ripwire.edit-check/v1" sym="nonNegativeFloatDescKey" t="fn" p="src/infra/sortutil.h:109" status="contract-change" defs="1" params_was="1" params_now="2" public_was="1" public_now="1" defs_was="1" defs_now="1" change="params,broken-callers" callers="4" incompatible="4" at="0712a51 … [line truncated: 161 more bytes on this line]
+<c n="benchScores" p="bench/bench_radix_ab.cpp:133" incompatible="1" sites_l="146,152"/>
+<c n="benchAdaptive" p="bench/bench_radix_ab.cpp:157" incompatible="1" sites_l="162"/>
+<c n="radixSortNonNegativeFloatsDesc" p="src/infra/sortutil.h:138" incompatible="1" sites_l="147"/>
+<c n="radixSortByScoreDescId" p="src/infra/sortutil.h:153" incompatible="1" sites_l="213"/>
+</edit-check>
+`````
+
+## `./build/ripwire . --edit-check=nonNegativeFloatDescKey --legend=full`
+
+*The same verdict under --legend=full: the default's one compact comment (the post-edit reflex at its cheapest) becomes ~5.7 KB of prose legend, every <c incompatible=> row identical.*
+
+**wall time: 4.12s**
+
+`````
+<!-- ripwire edit-check: SYM's contract (param count + publicness) NOW vs git HEAD — unchanged/new-symbol/contract-change, or no-baseline when the root has no git HEAD to compare against (not a repository, or no commit yet): then NOTHING is claimed about the contract, and a symbol is never called new for want of a baseline — plus its 1-hop callers. A caller is flagged incompatible="1" when its argument count was reliably counted and NO definition in the folded set could accept it: every one has a FIXED arity that disagrees. A variadic, defaulted or implicit-receiver definition (a Python/Ruby method, whose params counts the self/cls the call site never writes) has no fixed arity and is never flagged. That makes the ARITY half one-sided — a call the compared definitions could accept is never flagged — but it is NOT a proof that the call site binds to THIS definition. Call edges are matched by NAME, so a receiver-qualified call to a same-named callee this tool does not index (a standard-library or third-party method) is measured against the one definition it does index; a clean, compiling tree can therefore carry a nonzero incompatible= with nothing edited at all, and on a widely-shared name it can be most of that name's callers. Read incompatible= as a fact about the tree as it stands — call sites worth OPENING, not a verdict — and status= as a fact about the edit. Warm path hits the qheadsnap/qsnap cache — never a full quality-delta style recompute. defs= is how many DEFINITIONS at this site (same file, same scope, same name — the overload set) are folded into this one contract; a selector matching more than one SITE is refused instead, so defs= only ever counts overloads. params_was and params_now are the MAX over that set on each side (the same MAX the baseline snapshot stores), and publicness is the OR. That MAX has TWO consequences, in opposite directions. It can read like a break and not be one: adding a WIDER overload beside an unchanged one raises params_now with no existing definition altered, so it reports status="contract-change" with incompatible="0" and a def row still carrying the old parameter count — no seen caller breaks. And it can read like safety and not be: REMOVING an overload whose parameter count is BELOW the MAX moves neither number, because the MAX survives on both sides, while the call site that used the removed definition no longer binds. defs_was=/defs_now= is what closes that: the count of definitions sharing this symbol's DEFINITION SITE — same file, same scope, same name — on each side. That is the population the baseline snapshot buckets by, so the two numbers answer the same question and are equal on an unedited tree. A same-named definition in ANOTHER FILE is a different contract and is counted on neither side, so defs_now= agrees with the root's defs= by construction and only defs_was= can move it. status is therefore the join of THREE was-vs-now facts — the params MAX, publicness, and the definition COUNT — and change= names which of them carried it. change= adds broken-callers when a seen caller is also flagged, but never on its own — for the reason stated at the top: incompatible= describes the TREE and status= describes the EDIT, so a headline must not turn on it. RESIDUAL: an overload whose arity changes BELOW the MAX while the COUNT stays the same moves none of the three. The root's incompatible= is the COUNT of flagged callers (a c row's incompatible="1" is the per-caller flag). sites_l= rides on a flagged row only: a c row's p= is where that CALLER is DEFINED, and sites_l= is the ascending LINE list of its call-role reference sites to this name — the lines to open, the same rows the uses verb prints, including the ones whose argument count could not be counted (so sites_l= can be wider than the evidence the flag rests on). Two calls on one line are ONE site. p= is the definition the selector resolved to; when defs is above 1 EVERY folded definition is listed as its own def row (p=, t=, params=), which is what tells a widened single definition apart from an added overload. At defs="1" no def row is emitted: the root's own p=/t= is that definition, and params_now is its parameter count. next= is the one pasteable follow-up: on a contract-change the uses verb on SYM (the call sites), otherwise the test gate on the definition's file. est_tokens= prices THIS document, through the tool's ONE emitted-bytes estimator. counts_floor="1" means every count here is a FLOOR, never a total: edges are extracted from source TEXT by NAME. Missing: dynamic dispatch (virtual/interface/duck-typed), a most-vexing-parse declaration with no call expression, a function-pointer/callback bound to more than one function in scope (reassigned, table-indexed, lambda-bound, or address-taken/reference-bound), and a plain-name binding (fp=handler) whose variable type is not PROVABLY a function pointer (a same-file typedef/declarator; a HEADER typedef is missed; auto/template types are read as unpinned, so KEPT). A macro-generated call site is role="macro" only when its name uniquely names an indexed function-like #define (C-family, t="macro"); a shared name stays a plain call, an unindexed macro is no edge. Read a zero as "none found", never as "none exists". graph_ambiguous=/graph_unresolved= are the whole graph's resolver gauge (calls split over several defs / calls whose in-repo defs were all language-filtered), the map header's ambiguous=/unresolved=. graph_unindexed=N is a third gauge: files no grammar could read (the map header's unindexed=), whose calls raise neither gauge above; absent when zero, and so is this sentence. COUNTING UNIT differs by verb: callers, callees, edit-check, graph-query and pr-context counts are DISTINCT SYMBOLS (repeated calls from one caller, and calls to two overloads, collapse into ONE row; multiplicity survives only in the call graph's edge weight). The reach counts (impact's reaches=, pr-context's dependents=) are the size of a transitive reach SET, each symbol counted once. The uses verb counts call SITES, one row per occurrence — a larger count there for the same symbol is these units agreeing, not disagreeing. The map header's edges= is a unit again different — distinct (caller,callee) PAIRS — and that document carries neither this marker nor this clause. -->
+<edit-check sym="nonNegativeFloatDescKey" t="fn" p="src/infra/sortutil.h:109" status="contract-change" defs="1" params_was="1" params_now="2" public_was="1" public_now="1" defs_was="1" defs_now="1" change="params,broken-callers" callers="4" incompatible="4" at="0712a5182+dirty" graph_ambiguous="2933 … [line truncated: 131 more bytes on this line]
+<c n="benchScores" p="bench/bench_radix_ab.cpp:133" incompatible="1" sites_l="146,152"/>
+<c n="benchAdaptive" p="bench/bench_radix_ab.cpp:157" incompatible="1" sites_l="162"/>
+<c n="radixSortNonNegativeFloatsDesc" p="src/infra/sortutil.h:138" incompatible="1" sites_l="147"/>
+<c n="radixSortByScoreDescId" p="src/infra/sortutil.h:153" incompatible="1" sites_l="213"/>
+</edit-check>
+`````
+
+## `./build/ripwire . --pr-context`
+
+*The review-evidence bundle with an actual changed file.*
+
+**wall time: 7.45s**
+
+`````
+<!-- ripwire pr-context schema=ripwire.pr-context/v1: review bundle per changed file vs base=: symbols, callers, blast radius, tests, owners. window: shown= capped= (capped=1 cut). counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. est_tokens=: price as emitted (an upper bound under compact). at=: commit+dirty+shallow. root=: p= relative to it. truncated=: what the trim ladder dropped to fit budget_tokens= (budget-floor-exceeded: still over). direction=: side reviewed: worktree-since-head, head-since-fork or head-since-ref-tip. skipped_mode_only=N: mode-only (chmod) diffs left out of the changed files; renames stay in. trim_level=0-4: trim ladder step taken to fit budget_tokens= (0 none, 4 counts only); raise token-budget. budget_default=1: the default 8000-token budget applied (no token-budget or max-tokens given). commits=N: this file's commits in window=; 0 = the window could not look, not no partners. partners=N: co-change partners NOT in the diff; rows are its top shown= (the cochange verb lists all). dependents=N: distinct symbols transitively calling this file's symbols (reach set, a FLOOR). files_other=N: non-changed files among those reached; the f rows are its top shown=. authors=N: distinct authors of this file (0 = no git data). bf=1: one author holds over 80% of recency-weighted commits (bus-factor risk). files=N: changed files in the diff (shown= of them listed). file symbols=: indexed symbols in that changed file. changed-symbols count= / tests count=: that section's full count (shown= of it listed). tests count=: test files reaching this file (shown= of them listed). impact files=: files holding the transitive callers (dependents=). impactf deps=: transitive callers in that file. test run=: the command that runs that test file (run_unknown=1: none derivable). author email=/share=: a committer of this file / its fraction of the recency-weighted commits. s callers=N: direct callers of that changed symbol; caller rows are its top shown= (callers verb: all). -->
+<pr-context schema="ripwire.pr-context/v1" base="working-tree" root="." direction="worktree-since-head" files="1" skipped_mode_only="0" budget_tokens="8000" est_tokens="3226" trim_level="0" truncated="none" budget_default="1" at="0712a5182+dirty" graph_ambiguous="2933" graph_unresolved="15249" graph … [line truncated: 34 more bytes on this line]
+<file p="src/infra/sortutil.h" symbols="13">
+<impact dependents="246" files="58" files_other="58" shown="20" capped="1">
+<f p="src/mcpverbs.h" deps="33"/>
+<f p="src/quality.h" deps="15"/>
+<f p="src/verbs_quality.h" deps="14"/>
+<f p="src/verbs_for.h" deps="13"/>
+<f p="src/editcheck.h" deps="9"/>
+<f p="src/resolve.h" deps="9"/>
+<f p="src/verbs_navigate.h" deps="9"/>
+<f p="src/graph.h" deps="8"/>
+<f p="src/serialize.h" deps="8"/>
+<f p="src/main.cpp" deps="7"/>
+<f p="src/verbs_change.h" deps="7"/>
+<f p="src/defattrib.h" deps="6"/>
+<f p="src/mergescout.h" deps="6"/>
+<f p="src/testmap.h" deps="6"/>
+<f p="bench/bench_sort_large.cpp" deps="5"/>
+<f p="src/defectshape.h" deps="5"/>
+<f p="src/situ.h" deps="5"/>
+<f p="src/verbs_grep.h" deps="5"/>
+<f p="src/callhierarchy.h" deps="4"/>
+<f p="src/editplan.h" deps="4"/>
+</impact>
+<tests count="5" shown="5" capped="0">
+<test p="test/adaptivecutshapefix/adaptive_cut_shape_test.cpp" run="bash test/adaptivecutshapecheck.sh"/>
+<test p="test/includeprecise_unit.cpp" run="bash test/includeprecisecheck.sh"/>
+<test p="test/rustimport_unit.cpp" run="bash test/rustimportprecisecheck.sh"/>
+<test p="test/verify_csr.cpp" run="bash test/a9disclosurecheck.sh"/>
+… [80 more display lines; full output is 8063 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --map-diff --top-k=5`
+
+*The map re-ranked with a teleport toward the changed file (changed=1 here, not 0).*
+
+**wall time: 6.20s**
+
+`````
+<!-- ripwire map-diff schema=ripwire.map-diff/v1: the ranked map anchored at at=: what the diff touched, the map's row vocabulary. est_tokens=: price as emitted (an upper bound under compact). at=: commit+dirty+shallow. root=: p= relative to it. pr_iters=N: PageRank iterations. declined=K: K call sites without edges, including inert Elixir quote sites after unquote/unquote_splicing re-entry. external=K: K calls proven outside the tree, no edge. locality_pinned=K: K calls pinned by locality alone (a guess). extent_suspect_syms=K: K defs failed containment, corpus-wide. macro_blanked_files=K: K files indexed from a macro-blanked re-parse. files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (every def language-filtered or unreachable, or binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable). changed=K: K indexed git-changed files seed the PageRank teleport (0: uniform, incl. no git). skipped_oversize=K: K files over a size ceiling, not indexed. unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most). unindexed_exts=E: E such extensions in all, the list cut. sc=: enclosing scope; the full id is p::sc::n (p= of the row or its <f>) and selectors take it. layer=: built-in arch layer (game|infra|render|math|audio|ai|test) from a dir name in p=; absent if none. -->
+<!-- t=modscope=a-file's-MODULE-SCOPE(n=<file-scope>):the-statements-outside-every-named-definition,where-a-top-level-call-and-an-anonymous-callback-body's-calls-live;a-CALLER-never-a-callee(nothing-in-the-source-can-name-it)-with-no-body-to-expand;a-file-with-no-such-call-has-no-such-row -->
+<!-- files=3631 symbols=31862 edges=30034 shown=5 est_tokens=1126 ambiguous=2933 unresolved=15249 locality_pinned=9 external=8658 declined=30157 extent_suspect_syms=12 macro_blanked_files=7 changed=1 skipped_oversize=15 unindexed="txt:77,tsv:52,mod:31,jsonl:26,scm:24,expected:15" unindexed_exts=20 order=important-first -->
+<r schema="ripwire.map-diff/v1" at="0712a5182+dirty" root="." est_tokens="1126" pr_iters="27">
+<f p="src/infra/radixSort.h" layer="infra">
+<s t="fn" n="sortKeySmall" sc="radix" k="0.1166">
+</s>
+</f>
+<f p="src/infra/sortutil.h" layer="infra">
+<s t="fn" n="radixSortByScoreDescId" sc="rw::sortutil" k="0.0954">
+<c n="lessByScoreDescId"/>
+<c n="radixSortUint32ByKey"/>
+<c n="nonNegativeFloatDescKey"/>
+</s>
+<s t="fn" n="nonNegativeFloatDescKey" sc="rw::sortutil" k="0.0749">
+</s>
+<s t="fn" n="lessByScoreDescId" sc="rw::sortutil" k="0.0692">
+</s>
+<s t="fn" n="lessByFromTo" sc="rw::sortutil" k="0.0679">
+</s>
+</f>
+</r>
+`````
+
+## `./build/ripwire . --clones`
+
+*The duplicated helper the sandbox edit introduced shows up as a clone group.*
+
+**wall time: 3.16s**
+
+`````
+<!-- ripwire clones schema=ripwire.clones/v1: similar normalized-token bodies: <group type=2|3 gid= tokens= n= similarity=> of <f n= p=>; dup_loc=/dup_pct=. window: shown= total= capped= has_more= next_offset= offset= limit= (capped=1 cut; next_offset= pastes as offset=). root=: p= relative to it. groups=/type3=: Type-2 and Type-3 group totals over all groups; total= is their sum. exempt_groups=N: groups whose members all sit on fixture/shell-runner paths quality-delta duplication ignores. idiom_groups=/demoted_groups=: groups of one recognized idiom / those quality-delta demotes to minor; floors. clone_groups=N: clusters after merging pairs (rows sharing gid=); a floor under type3_capped=1. total_loc=N: lines of every function body the detector considered; dup_pct= is dup_loc= over it. group exempt=fixture|shell-runner: every member is on such a path; quality-delta duplication ignores it. group idiom=: the recognized shape every member spells: threshold-ladder, switch-name-table, builder-chain. -->
+<clones schema="ripwire.clones/v1" groups="137" type3="620" exempt_groups="445" idiom_groups="20" demoted_groups="12" clone_groups="366" dup_loc="7688" total_loc="245528" dup_pct="3.1" shown="80" capped="1" total="757" has_more="1" next_offset="80" offset="0" limit="0" root=".">
+<group type="2" gid="49" tokens="338" n="3">
+<f n="rw_is_ripwire_call" p="hooks/ripwire-claude-route.sh:187"/>
+<f n="rw_is_ripwire_call" p="hooks/ripwire-codex-route.sh:104"/>
+<f n="rw_is_ripwire_call" p="hooks/ripwire-nudge.sh:623"/>
+</group>
+<group type="2" gid="237" tokens="213" n="2" exempt="shell-runner">
+<f n="call_sites" p="test/declinecheck.sh:116"/>
+<f n="call_sites" p="test/usesselectorcheck.sh:49"/>
+</group>
+<group type="2" gid="306" tokens="211" n="4" exempt="shell-runner">
+<f n="batch_sub" p="test/mcpclidiffcheck.sh:64"/>
+<f n="batch_sub" p="test/mcptranchecheck.sh:55"/>
+<f n="batch_sub" p="test/mcpw2fixcheck.sh:52"/>
+<f n="batch_sub" p="test/mcpw3fixcheck.sh:51"/>
+</group>
+<group type="2" gid="48" tokens="163" n="3">
+<f n="rw_cmd_word" p="hooks/ripwire-claude-route.sh:157"/>
+<f n="rw_cmd_word" p="hooks/ripwire-codex-route.sh:74"/>
+<f n="rw_cmd_word" p="hooks/ripwire-nudge.sh:593"/>
+</group>
+<group type="2" gid="210" tokens="153" n="2" exempt="shell-runner">
+<f n="mcp_text" p="test/blindspotcheck.sh:120"/>
+<f n="mcp_text" p="test/xmlwellformed.sh:322"/>
+</group>
+<group type="2" gid="326" tokens="151" n="3" exempt="shell-runner">
+<f n="monotonic_check" p="test/pyimportprecisecheck.sh:89"/>
+<f n="monotonic_check" p="test/rustimportprecisecheck.sh:141"/>
+<f n="monotonic_check" p="test/tsimportprecisecheck.sh:170"/>
+… [308 more display lines; full output is 16199 bytes on 1 raw line(s)]
+`````
+
+## `./build/ripwire . --stray-content=zz-orphan`
+
+*CHANGED: a ref with NO merge base with HEAD now reports v="unknown" ok="0" in its own bucket — the absence of an answer, never a claim it is merged. (The sandbox carries a deliberately parentless branch built with `git commit-tree`; a shallow CI clone puts every ref here.)*
+
+**wall time: 5.56s**
+
+`````
+<!-- ripwire stray-content schema=ripwire.stray-content/v1: per local ref, lines/symbols NOT in HEAD: <ref ok= v= base= stray=>; v=unknown = no merge base. at=: commit+dirty+shallow. head=: the HEAD commit, bare 9-hex sha (at= adds +dirty). head_ref=: HEAD's branch (HEAD when detached); that branch itself is not scanned. refs=N: local branches scanned (refs/heads only); unmerged + superseded + merged + unknown = refs. blobs=N: distinct git blobs read for the sweep. unmerged=N: refs whose authored work the live line genuinely lacks. superseded=N: refs whose work the live line re-implemented (removed the same base code). merged=N: refs whose work HEAD already has; omitted from the rows. name=: the local branch. tip=: the branch tip commit (9 hex). date=: the tip's committer date, YYYY-MM-DD. files=N: files with stray lines; rows capped at 12, a more element counts the rest (detail=1 lists all). ref superseded=N>: of this ref's stray= lines, those in files the live line re-implemented. unknown=N: refs that could not be analysed (v=unknown, e.g. no merge base); never counted merged. -->
+<stray-content schema="ripwire.stray-content/v1" head="0712a5182" head_ref="integration/train-36" refs="1" blobs="0" unmerged="0" superseded="0" merged="0" unknown="1" filter="zz-orphan" at="0712a5182+dirty">
+<ref name="zz-orphan-lane" tip="c549ff50a" date="2026-10-26" base="" ok="0" v="unknown" stray="0" files="0" superseded="0">
+</ref>
+</stray-content>
+`````
+
+stderr:
+
+`````
+[math degraded] crossref: no merge-base for ref (shallow clone or unrelated history?) — verdict is unknown, not merged  (crossref.h:1274, RefPlumbing rw::crossref::probeRefBase(const std::string &, const RefInfo &, const std::string &) — logged once per site)
+`````
+
+## `./build/ripwire . --stray-content=zz-orphan --plan`
+
+*CHANGED: --plan surfaces those same refs as an <undetermined> row rather than silently dropping them.*
+
+**wall time: 7.89s**
+
+`````
+<!-- ripwire landing-plan schema=ripwire.landing-plan/v1: stranded-work landing order across refs, fewest conflicts first. at=: commit+dirty+shallow. -->
+<landing-plan schema="ripwire.landing-plan/v1" head="0712a5182" refs="1" unmerged="0" superseded="0" merged="0" undetermined="1" scouted="0" bounded="0" scout-ok="1" at="0712a5182+dirty">
+<undetermined name="zz-orphan-lane" v="unknown" reason="no merge base with HEAD (shallow clone or unrelated history) — this ref could not be analysed, it is NOT known to be merged; deepen the clone and re-run"/>
+</landing-plan>
+`````
+
+stderr:
+
+`````
+[math degraded] crossref: no merge-base for ref (shallow clone or unrelated history?) — verdict is unknown, not merged  (crossref.h:1274, RefPlumbing rw::crossref::probeRefBase(const std::string &, const RefInfo &, const std::string &) — logged once per site)
+`````
+
+## `./build/ripwire . --dmm`
+
+*The DMM scalar on a REAL delta: the sandbox edit grew one unit past the nesting/complexity thresholds and added an 8-parameter one, so dmm is low and the three sub-scores say which property moved.*
+
+**wall time: 9.39s**
+
+`````
+<!-- ripwire dmm schema=ripwire.dmm/v1: Delta Maintainability Model base=→target=: dmm= good/(good+bad) units by size_metric=; <p k= dmm= good= bad= d_low= d_high=>. at=: commit+dirty+shallow. available=0: no score at all (dmm=UNAVAILABLE, reason= says why); never read as 1.000 or 0.000. combine=pooled: root dmm= is summed good over summed good+bad of the 3 properties (ripwire's own). low_loc=/low_cx=/low_params=: a unit is LOW risk at or under these lines / cyclomatic / params. base_units=/base_volume=/target_units=/target_volume=: units with a body and their line span per side. -->
+<dmm schema="ripwire.dmm/v1" base="0712a5182ef61b6885b76af328cae18e839eb110" target="working-tree" at="0712a5182+dirty" available="1" combine="pooled" size_metric="physical-loc" low_loc="15" low_cx="5" low_params="2" dmm="0.142" good="23" bad="139" base_units="17849" base_volume="245474" target_unit … [line truncated: 33 more bytes on this line]
+<p k="size" dmm="0.130" good="7" bad="47" d_low="7" d_high="47"/>
+<p k="complexity" dmm="0.130" good="7" bad="47" d_low="7" d_high="47"/>
+<p k="interfacing" dmm="0.167" good="9" bad="45" d_low="9" d_high="45"/>
+</dmm>
+`````
+
+## `./build/ripwire . --quality-delta --scope=src/graph.h`
+
+*OWNERSHIP partition for a shared tree: every regression here lives in src/infra/, so under a scope naming src/graph.h they ALL print under <out-of-scope> with a do-not-ack banner and never gate — scoped-out-gating= says how many would have.*
+
+**wall time: 21.65s**
+
+`````
+<!-- ripwire quality-delta schema=ripwire.quality-delta/v1: only what the change made WORSE vs baseline=: regressions= minor= gating=; <r kind= sym= p= was= now= gating= bar=>, <sa> acked. value-ref-excluded=N: internal functions kept off because a table, field or argument in another function or at file scope holds them (matched by name, not a proven call); a floor. at=: commit+dirty+shallow. stale=N: ack ledger rows whose target no longer applies (sa rows); never gating. preexisting-worse=N: regressions on symbols that existed at baseline; they gate when major. new-symbol=N: findings on NEW code; new-symbol rows never gate, except defect-shape format-arity. register-macro-excluded=N: symbols kept out of dead-code as self-registering test/bench macros; a floor. declined-call-excluded=N: symbols kept out of dead-code only because a declined call may mean them; a floor. api-new-surface=N: new PUBLIC symbols; a count, never gates, not in regressions=. renames=/rename_window_commits=: git rename pairs read over that many commits, to re-file baseline and acks. acked_by_rename=/acked_by_content=: acked= suppressions matched via git renames / an equal body hash. renames_window_truncated=1: history is deeper than the rename window, older renames unread. r surface=: the api-surface tier, new-symbol or contract-change. acked=N: findings suppressed by the ack ledger, listed as sa rows; never gating. r sev=minor: a small numeric delta, counted in minor=, never gating (absent: major). r origin=new-symbol: a finding on NEW code (absent: preexisting-worse). sa key=/why=: the stale ack's ledger hash / target-gone (names nothing now) or finding-gone (no longer fires). r members=/tokens=: a duplication row's clone group (member ids) / their shared normalized-token count. -->
+<quality-delta schema="ripwire.quality-delta/v1" baseline="git-HEAD" regressions="0" minor="0" acked="0" stale="167" preexisting-worse="0" new-symbol="0" gating="0" register-macro-excluded="62" api-new-surface="2" at="0712a5182+dirty" renames="62" rename_window_commits="400" acked_by_rename="0" acke … [line truncated: 155 more bytes on this line]
+<out-of-scope n="9" would-gate="4" note="not yours - do not ack: these rows lie outside the scope this run named. They are disclosed rather than hidden, they never gate this exit code, and the ack refuses to write them.">
+<r kind="api-surface" sym="src/infra/sortutil.h::rw::sortutil::nonNegativeFloatDescKey" was="1" now="2" surface="contract-change" p="src/infra/sortutil.h:109"/>
+<r kind="complexity" sym="src/infra/sortutil.h::rw::sortutil::lessByScoreDescId" was="1" now="67" bar="15" p="src/infra/sortutil.h:49"/>
+<r kind="dead-code" sym="src/infra/sortutil.h::rw::sortutil::nonNegativeFloatAscKeyCopy" origin="new-symbol" p="src/infra/sortutil.h:119"/>
+<r kind="dead-code" sym="src/infra/sortutil.h::rw::sortutil::sortScoredIdsWithOptions" origin="new-symbol" p="src/infra/sortutil.h:129"/>
+<r kind="duplication" members="src/infra/sortutil.h::rw::sortutil::nonNegativeFloatAscKeyCopy | src/infra/sortutil.h::rw::sortutil::nonNegativeFloatDescKey" tokens="59" p="src/infra/sortutil.h:119"/>
+<r kind="nesting" sym="src/infra/sortutil.h::rw::sortutil::lessByScoreDescId" was="1" now="6" bar="4" p="src/infra/sortutil.h:49"/>
+<r kind="new-clone-of-reused-helper" sym="src/infra/sortutil.h::rw::sortutil::nonNegativeFloatAscKeyCopy | src/infra/sortutil.h::rw::sortutil::nonNegativeFloatDescKey" was="0" now="4" p="src/infra/sortutil.h:119"/>
+<r kind="params" sym="src/infra/sortutil.h::rw::sortutil::sortScoredIdsWithOptions" was="0" now="8" bar="5" origin="new-symbol" p="src/infra/sortutil.h:129"/>
+<r kind="verbosity" sym="src/infra/sortutil.h::rw::sortutil::lessByScoreDescId" was="8" now="47" bar="60" sev="minor" p="src/infra/sortutil.h:49"/>
+</out-of-scope>
+<sa kind="api-surface" key="085e3d408c2c4a35" why="target-gone"/>
+<sa kind="api-surface" key="155d74d341a49f3c" why="target-gone"/>
+<sa kind="api-surface" key="1a15386c2d1e47af" why="target-gone"/>
+<sa kind="api-surface" key="298e798c7f075715" why="target-gone"/>
+<sa kind="api-surface" key="56acdf9b5c314a14" why="target-gone"/>
+<sa kind="api-surface" key="5a07390012b46e06" why="target-gone"/>
+<sa kind="api-surface" key="6eef859578c8c376" why="target-gone"/>
+<sa kind="api-surface" key="6f2394762f82a855" why="target-gone"/>
+<sa kind="api-surface" key="7f2c3eefdf6e512e" why="target-gone"/>
+<sa kind="api-surface" key="802e513731103806" why="target-gone"/>
+<sa kind="api-surface" key="b6a24afef32a68a8" why="target-gone"/>
+<sa kind="api-surface" key="c923e661c197b265" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="1926b0d9e94541a0" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="1d3814ba687a4aef" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="1db76028879244ef" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="25c9f0504fd376a4" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="36e39c7ab0fc1686" why="target-gone"/>
+… [151 more display lines; full output is 18020 bytes on 1 raw line(s)]
+`````
+
+stderr:
+
+`````
+ripwire: no ./.ripwire_quality_baseline — auto-comparing the working tree vs git HEAD (commit the baseline with --quality-baseline to pin it)
+`````
+
+## `./build/ripwire . --quality-delta --quality-ack --scope=src/graph.h --ack-only=api-surface`
+
+*The rubber-stamp guard: an --ack-only that names an OUT-OF-SCOPE row refuses (exit 1) and writes nothing.*
+
+**exit code: 1** — **wall time: 21.16s**
+
+`````
+(empty)
+`````
+
+stderr:
+
+`````
+ripwire: no ./.ripwire_quality_baseline — auto-comparing the working tree vs git HEAD (commit the baseline with --quality-baseline to pin it)
+ripwire: --ack-only=api-surface selects 1 finding(s) OUT OF SCOPE for --scope=src/graph.h — refusing, and writing nothing at all:
+    api-surface src/infra/sortutil.h::rw::sortutil::nonNegativeFloatDescKey at src/infra/sortutil.h:109
+  those rows belong to whoever is editing those paths. Acking them here writes their debt into a committed ledger under YOUR
+  reason string, which is how a per-finding ratchet becomes a rubber stamp. Narrow the pattern, or widen the scope if they really are yours.
+`````
+
+## `./build/ripwire . --handoff`
+
+*The continuation packet with a REAL diff: verified changed symbols + blast radius + tests-to-run, then the heuristic rows.*
+
+**wall time: 17.15s**
+
+`````
+<!-- ripwire handoff schema=ripwire.handoff/v1: continuation packet for the NEXT session: <verified changed= blast_files=>, <tests n=>, <heuristic n= candidates=>, <note>, <doc p=>. window: capped= (capped=1 cut). est_tokens=: price as emitted (an upper bound under compact). at=: commit+dirty+shallow. root=: p= relative to it. branch=/subject=: the checked out branch and HEAD commit subject; gitok=0: the git diff probe failed, changed counts are floors. cochange_window=/cochange_commits=: the git window the cochange rows were mined in and the commits it held (0: could not look). doc s=: lexical score of that plan/design doc for the branch+subject query. t run=: the command that runs that test (run_unknown=1: none derivable). -->
+<handoff schema="ripwire.handoff/v1" at="0712a5182+dirty" root="." branch="integration/train-36" subject="Merge origin/integration/train-35 (harvested head 6580f358) into integration/train-36" gitok="1" est_tokens="905">
+<verified changed="1" blast_files="58">
+<f p="src/infra/sortutil.h">
+<s n="svLess"/>
+<s n="lessByScoreDescId"/>
+<s n="radixSortUint32ByKey"/>
+<s n="nonNegativeFloatDescKey"/>
+<s n="nonNegativeFloatAscKeyCopy"/>
+<s n="sortScoredIdsWithOptions"/>
+<s n="radixSortNonNegativeFloatsDesc"/>
+<s n="radixSortByScoreDescId"/>
+<s n="radixSortByScoreDescId"/>
+<s n="radixSortIdsAscending"/>
+<s n="lessByFromTo"/>
+<s n="radixSortByFromTo"/>
+<s n="radixSortByFromTo"/>
+</f>
+<tests n="5">
+<t p="test/verify_radix.cpp" run="bash test/greptiercheck.sh"/>
+<t p="test/adaptivecutshapefix/adaptive_cut_shape_test.cpp" run="bash test/adaptivecutshapecheck.sh"/>
+<t p="test/includeprecise_unit.cpp" run="bash test/includeprecisecheck.sh"/>
+<t p="test/verify_csr.cpp" run="bash test/a9disclosurecheck.sh"/>
+<t p="test/rustimport_unit.cpp" run="bash test/rustimportprecisecheck.sh"/>
+</tests>
+</verified>
+<heuristic n="4" candidates="160" capped="1" cochange_window="18mo@HEAD" cochange_commits="5296">
+<doc p="CHANGELOG.md" s="9.897"/>
+<doc p="bench/locbench/results/vt2_pooling_freestat/FREESTAT.md" s="9.864"/>
+<doc p="paper/PREPRINT.md" s="9.523"/>
+<doc p="docs/research/answer-completeness.md" s="9.482"/>
+</heuristic>
+</handoff>
+`````
+
+## `./build/ripwire . --note-add="lessByScoreDescId: keep this branch-free — it sits inside the PageRank sort comparator"`
+
+*Pin a field note (write-side memory) to a symbol; committed to .ripwire_notes in the sandbox. The BARE name is resolved through the same resolver the read verbs use and stored as the canonical id — the rewrite is echoed on stderr, because a silent one is not a disclosure.*
+
+**wall time: 3.80s**
+
+`````
+src/infra/sortutil.h::rw::sortutil::lessByScoreDescId	2026-10-26	keep this branch-free — it sits inside the PageRank sort comparator	0712a5182ef61b6885b76af328cae18e839eb110	integration/train-36
+`````
+
+stderr:
+
+`````
+ripwire: --note-add: tip: notes that say "chose X over Y because Z" surface better — consider adding the why
+ripwire: --note-add: target 'lessByScoreDescId' canonicalised to 'src/infra/sortutil.h::rw::sortutil::lessByScoreDescId' — that is the id --for/--expand key notes by
+`````
+
+## `./build/ripwire . --notes`
+
+*The note is listed under the canonical id, dangling="0" — i.e. it will actually surface. (Before the H1 fix the bare name was stored verbatim and read dangling="1": recorded, and surfaced nowhere.)*
+
+**wall time: 1.58s**
+
+`````
+<ctx schema="ripwire.notes/v1">
+<!-- ripwire notes schema=ripwire.notes/v1: field notes by target: <target id= dangling=> holds <note d= sha= branch=>; the kept count comment: notes= rows, targets= <target> rows, dangling= targets matching nothing indexed (listed, surfaced nowhere). dangling=1: matches nothing indexed. -->
+<!-- notes=3 targets=3 dangling=0 -->
+<notes>
+<target id="src/infra/Diagnostics.h" dangling="0">
+<note d="2026-09-12" sha="42b7c8d" branch="lane/noalias-docs">
+<![CDATA[ASSUME_NO_ALIAS is an optimizer fact in release (separate_storage) only where the compiler consumes it: clang 18+ by default, LLVM 17/AppleClang 16 via the CMake -mllvm flag (scalars only), GCC never (debug check only); never on two members of one object; ASSUME_NO_ALIAS_BUF for OWNING cont … [line truncated: 22 more bytes on this line]
+</note>
+</target>
+<target id="src/infra/sortutil.h::rw::sortutil::lessByScoreDescId" dangling="0">
+<note d="2026-10-26" sha="0712a51" branch="integration/train-36">
+<![CDATA[keep this branch-free — it sits inside the PageRank sort comparator]]>
+</note>
+</target>
+<target id="test/manifestcheck.sh" dangling="0">
+<note d="2026-08-23" sha="42634f5" branch="claude/fervent-volhard-ddfd9f">
+<![CDATA[README.md's single '<N> gate scripts' claim (~line 1305) is NOT enforced — the derived-vs-stated sibling loop here covers docs/EVALS.md only. It drifted 407→451 unnoticed (fixed 2026-08-23). To close: grep both files ('file:line:' parsing) in the gateCountClaims arm.]]>
+</note>
+</target>
+</notes>
+</ctx>
+`````
+
+## `./build/ripwire . --note-add="gitOneLine: which one?"`
+
+*Two definitions carry this name, so the write REFUSES rather than pick one: a note keys ONE canonical id, and an ambiguous selector is refused, never silently narrowed. Every candidate is named, with a runnable retry.*
+
+**exit code: 1** — **wall time: 1.29s**
+
+`````
+(empty)
+`````
+
+stderr:
+
+`````
+ripwire: --note-add: tip: notes that say "chose X over Y because Z" surface better — consider adding the why
+ripwire: --note-add: target 'gitOneLine' is ambiguous — it matches 2 definitions in 2 distinct contracts, and a note keys ONE canonical id (it would surface on one of them and look absent on the rest). Qualify one: ./src/handoff.h:gitOneLine, ./src/quality.h:gitOneLine — e.g. --note-add="./src/h … [line truncated: 33 more bytes on this line]
+`````
+
+## `./build/ripwire . --note-add="lessByScoreDescIdd: typo"`
+
+*A name that resolves to nothing is refused with the read verbs' own did-you-mean — never written as a dead note.*
+
+**exit code: 1** — **wall time: 1.16s**
+
+`````
+(empty)
+`````
+
+stderr:
+
+`````
+ripwire: --note-add: tip: notes that say "chose X over Y because Z" surface better — consider adding the why
+ripwire: --note-add: target not found: lessByScoreDescIdd (did you mean 'lessByScoreDescId'?) — a note keys the canonical id a read verb resolves; to note a FILE instead, pass a path (one with a '/' or an extension), which may name a file that does not exist yet
+`````
+
+## `./build/ripwire . --note-add="src/infra/sortutil.h::rw::sortutil::lessByScoreDescId: chose the flat two-branch compare over the nested ladder because the comparator sits inside the PageRank sort"`
+
+*The same symbol addressed by its CANONICAL id: already canonical, so nothing is rewritten and both notes land on ONE target.*
+
+**wall time: 2.79s**
+
+`````
+src/infra/sortutil.h::rw::sortutil::lessByScoreDescId	2026-10-26	chose the flat two-branch compare over the nested ladder because the comparator sits inside the PageRank sort	0712a5182ef61b6885b76af328cae18e839eb110	integration/train-36
+`````
+
+## `./build/ripwire . --expand=lessByScoreDescId --top-k=0`
+
+*Both notes riding along with the symbol's body — the <note> elements follow the body, past the display cut, so they are extracted below.*
+
+**wall time: 1.87s**
+
+`````
+<ctx schema="ripwire.expand/v1" root="." est_tokens="834">
+<!-- ripwire expand schema=ripwire.expand/v1: full bodies: <bodies shown= total= capped=> of <b t= l= p= n= sibs= sibs_total= sibs_capped= inc=>; <calls>
+<c n= l=> resolved callees. window: shown= total= capped= (capped=1 cut). est_tokens=: price as emitted (an upper bound under compact). root=: p= relative to it. scrubbed=1: this CDATA is not the bytes (]]> split or C0 replaced). redacted=1: a credential shape rewritten to [REDACTED:kind]; the no-re … [line truncated: 130 more bytes on this line]
+<bodies shown="1" total="1" capped="0">
+<b t="fn" l="49" p="src/infra/sortutil.h" n="lessByScoreDescId" sibs="svLess,radixSortUint32ByKey,nonNegativeFloatDescKey,nonNegativeFloatAscKeyCopy,sortScoredIdsWithOptions,radixSortNonNegativeFloatsDesc,radixSortByScoreDescId,radixSortByScoreDescId,radixSortIdsAscending,lessByFromTo,radixSortByFro … [line truncated: 126 more bytes on this line]
+<![CDATA[inline bool lessByScoreDescId( const std::vector<float>& scores, std::uint32_t a, std::uint32_t b ) noexcept
+{
+    if( a < scores.size() )
+    {
+        if( b < scores.size() )
+        {
+            if( scores[ a ] != scores[ b ] )
+            {
+                if( scores[ a ] > scores[ b ] )
+                {
+                    if( scores[ a ] > 0.0f && scores[ b ] > 0.0f ) return true;
+                    else if( scores[ a ] > 0.0f && scores[ b ] == 0.0f ) return true;
+                    else if( scores[ a ] == 0.0f || scores[ b ] == 0.0f ) return true;
+                    else return true;
+                }
+                else
+                {
+                    if( scores[ b ] > 0.0f && scores[ a ] > 0.0f ) return false;
+                    else if( scores[ b ] > 0.0f && scores[ a ] == 0.0f ) return false;
+                    else if( scores[ b ] == 0.0f || scores[ a ] == 0.0f ) return false;
+                    else return false;
+                }
+            }
+            else
+            {
+… [22 more display lines; full output is 3201 bytes on 47 raw line(s)]
+`````
+
+The <note> element on the same output — past the 30-line display cut above:
+
+`````
+<note d="2026-10-26" sha="0712a51" branch="integration/train-36">
+<![CDATA[chose the flat two-branch compare over the nested ladder because the comparator sits inside the PageRank sort]]>
+</note>
+<note d="2026-10-26" sha="0712a51" branch="integration/train-36">
+<![CDATA[keep this branch-free — it sits inside the PageRank sort comparator]]>
+</note>
+`````
+
+## `./build/ripwire . --replace-symbol-body=lessByScoreDescId --edit-payload=<scratch>/aux/empty_payload.h`
+
+*An EMPTY payload refuses — it never implies deletion.*
+
+**exit code: 1**
+
+`````
+(empty)
+`````
+
+stderr:
+
+`````
+ripwire: --edit-payload is empty; empty never means delete
+`````
+
+## `./build/ripwire . --replace-symbol-body=lessByScoreDescId --edit-payload=<scratch>/aux/payload_lessByScoreDescId.h`
+
+*Whole-symbol replace without a whole-file read: the payload is the ORIGINAL flat body, so this edit undoes the sandbox's deep-nesting regression. The receipt's span is the POST-edit byte range; replaced_bytes counts the old bytes overwritten.*
+
+**wall time: 9.35s**
+
+Input file:
+
+`````
+inline bool lessByScoreDescId( const std::vector<float>& scores, std::uint32_t a, std::uint32_t b ) noexcept
+{
+    if( scores[a] != scores[b] )
+    {
+        return scores[a] > scores[b];
+    }
+    return a < b;
+}
+`````
+
+`````
+{"applied":"replace_symbol_body","symbol":"lessByScoreDescId","file":"src/infra/sortutil.h","span":{"start":2162,"end":2375},"lines":{"start":49,"end":56},"replaced_bytes":1718,"old_file_bytes":12329,"new_file_bytes":10824,"file_eol":"lf","eol_normalized":false,"trailing_newline_folded":true,"separa … [line truncated: 726 more bytes on this line]
+"graph_ambiguous":2933,"graph_unresolved":15249,"graph_unindexed":269,"counts_floor":true},"tests_to_run":[{"p":"test/verify_radix.cpp","hops":1,"run":"bash test/greptiercheck.sh"},
+{"p":"test/adaptivecutshapefix/adaptive_cut_shape_test.cpp","hops":2,"run":"bash test/adaptivecutshapecheck.sh"},
+{"p":"test/includeprecise_unit.cpp","hops":2,"run":"bash test/includeprecisecheck.sh"},
+{"p":"test/verify_csr.cpp","hops":2,"run":"bash test/a9disclosurecheck.sh"},
+{"p":"test/rustimport_unit.cpp","hops":4,"run":"bash test/rustimportprecisecheck.sh"}],
+"order":"evidence","partners":0,"run_first":1,"tests":5,"script_gates_unmodelled":782,"graph_ambiguous":2933,"graph_unresolved":15249,"graph_unindexed":269,"counts_floor":true,"next":"bash test/greptiercheck.sh"}
+`````
+
+stderr:
+
+`````
+ripwire edit: applied atomically; receipt carries region, blob_sha, edit_check, tests_to_run; next: bash test/greptiercheck.sh
+`````
+
+## `./build/ripwire . --edit-check=lessByScoreDescId`
+
+*The closed loop: contract unchanged (same params, same publicness) after the replace — nothing provably incompatible.*
+
+**wall time: 4.64s**
+
+`````
+<!-- ripwire edit-check schema=ripwire.edit-check/v1: sym='s contract NOW vs HEAD: status=unchanged|new-symbol|contract-change; <c n= p= incompatible=1 sites_l=> callers. counts_floor=1: every count is a FLOOR, never a total. graph_ambiguous=/graph_unresolved=: resolver gauge. graph_unindexed=N: N files no grammar could read (the map header's unindexed=); their calls raise neither gauge. est_tokens=: price as emitted (an upper bound under compact). at=: commit+dirty+shallow. root=: p= relative to it. next=: the one pasteable follow-up. defs=N: overloads at this site (same file, scope, name) folded into one contract; params compared by MAX. callers=N: callers of sym= (the c rows' total; a floor). -->
+<edit-check schema="ripwire.edit-check/v1" sym="lessByScoreDescId" t="fn" p="src/infra/sortutil.h:49" status="unchanged" defs="1" callers="4" incompatible="0" at="0712a5182+dirty" graph_ambiguous="2933" graph_unresolved="15249" graph_unindexed="269" counts_floor="1" root="." next="--test-gate=src/in … [line truncated: 33 more bytes on this line]
+<note d="2026-10-26" sha="0712a51" branch="integration/train-36">
+<![CDATA[chose the flat two-branch compare over the nested ladder because the comparator sits inside the PageRank sort]]>
+</note>
+<note d="2026-10-26" sha="0712a51" branch="integration/train-36">
+<![CDATA[keep this branch-free — it sits inside the PageRank sort comparator]]>
+</note>
+<c n="benchScores" p="bench/bench_radix_ab.cpp:133"/>
+<c n="benchScoreCase" p="bench/bench_sort_large.cpp:230"/>
+<c n="radixSortByScoreDescId" p="src/infra/sortutil.h:114"/>
+<c n="verifyRipwireWrappers" p="test/verify_radix.cpp:249"/>
+</edit-check>
+`````
+
+## `./build/ripwire . --insert-after-symbol=lessByScoreDescId --edit-payload=<scratch>/aux/payload_note.h`
+
+*Insert immediately AFTER one uniquely-resolved definition; replaced_bytes=0 because the insert verbs never overwrite. The receipt carries the folded post-edit verification (lines=, edit_check, tests_to_run) so the loop closes in one call.*
+
+**wall time: 6.16s**
+
+`````
+{"applied":"insert_after_symbol","symbol":"lessByScoreDescId","file":"src/infra/sortutil.h","span":{"start":2375,"end":2463},"lines":{"start":56,"end":58},"replaced_bytes":0,"old_file_bytes":10824,"new_file_bytes":10912,"file_eol":"lf","eol_normalized":false,"trailing_newline_folded":true,"separator … [line truncated: 652 more bytes on this line]
+"graph_ambiguous":2933,"graph_unresolved":15249,"graph_unindexed":269,"counts_floor":true},"tests_to_run":[{"p":"test/verify_radix.cpp","hops":1,"run":"bash test/greptiercheck.sh"},
+{"p":"test/adaptivecutshapefix/adaptive_cut_shape_test.cpp","hops":2,"run":"bash test/adaptivecutshapecheck.sh"},
+{"p":"test/includeprecise_unit.cpp","hops":2,"run":"bash test/includeprecisecheck.sh"},
+{"p":"test/verify_csr.cpp","hops":2,"run":"bash test/a9disclosurecheck.sh"},
+{"p":"test/rustimport_unit.cpp","hops":4,"run":"bash test/rustimportprecisecheck.sh"}],
+"order":"evidence","partners":0,"run_first":1,"tests":5,"script_gates_unmodelled":782,"graph_ambiguous":2933,"graph_unresolved":15249,"graph_unindexed":269,"counts_floor":true,"next":"bash test/greptiercheck.sh"}
+`````
+
+stderr:
+
+`````
+ripwire edit: applied atomically; receipt carries region, blob_sha, edit_check, tests_to_run; next: bash test/greptiercheck.sh
+`````
+
+## `./build/ripwire . --insert-after-symbol=lessByScoreDescId --edit-payload=<scratch>/aux/payload_note.h --no-post-check`
+
+*The opt-out: the same insert with the folded verification skipped — lines= still rides (it is free), edit_check/tests_to_run do not, and the two pasteable commands stay on stderr.*
+
+**wall time: 2.81s**
+
+`````
+{"applied":"insert_after_symbol","symbol":"lessByScoreDescId","file":"src/infra/sortutil.h","span":{"start":2375,"end":2463},"lines":{"start":56,"end":58},"replaced_bytes":0,"old_file_bytes":10912,"new_file_bytes":11000,"file_eol":"lf","eol_normalized":false,"trailing_newline_folded":true,"separator … [line truncated: 572 more bytes on this line]
+`````
+
+stderr:
+
+`````
+ripwire edit: applied atomically; receipt carries region, blob_sha (post-check skipped); next: --edit-check=src/infra/sortutil.h:lessByScoreDescId
+`````
+
+## `./build/ripwire . --insert-before-symbol=nonNegativeFloatDescKey --edit-payload=<scratch>/aux/payload_note.h --edit-target-file=src/infra/sortutil.h`
+
+*Insert BEFORE, with --edit-target-file pinning which same-named definition (here unambiguous — the disambiguator is simply honoured).*
+
+**wall time: 7.47s**
+
+`````
+{"applied":"insert_before_symbol","symbol":"nonNegativeFloatDescKey","file":"src/infra/sortutil.h","span":{"start":2895,"end":2983},"lines":{"start":74,"end":75},"replaced_bytes":0,"old_file_bytes":11000,"new_file_bytes":11088,"file_eol":"lf","eol_normalized":false,"trailing_newline_folded":false,"s … [line truncated: 755 more bytes on this line]
+{"n":"benchAdaptive","p":"bench/bench_radix_ab.cpp:157","l":[162]},
+{"n":"radixSortNonNegativeFloatsDesc","p":"src/infra/sortutil.h:105","l":[114]},
+{"n":"radixSortByScoreDescId","p":"src/infra/sortutil.h:120","l":[180]}],
+"graph_ambiguous":2933,"graph_unresolved":15249,"graph_unindexed":269,"counts_floor":true},"tests_to_run":[{"p":"test/verify_radix.cpp","hops":1,"run":"bash test/greptiercheck.sh"},
+{"p":"test/adaptivecutshapefix/adaptive_cut_shape_test.cpp","hops":2,"run":"bash test/adaptivecutshapecheck.sh"},
+{"p":"test/includeprecise_unit.cpp","hops":2,"run":"bash test/includeprecisecheck.sh"},
+{"p":"test/verify_csr.cpp","hops":2,"run":"bash test/a9disclosurecheck.sh"},
+{"p":"test/rustimport_unit.cpp","hops":4,"run":"bash test/rustimportprecisecheck.sh"}],
+"order":"evidence","partners":0,"run_first":1,"tests":5,"script_gates_unmodelled":782,"graph_ambiguous":2933,"graph_unresolved":15249,"graph_unindexed":269,"counts_floor":true,"next":"--uses=src/infra/sortutil.h:nonNegativeFloatDescKey"}
+`````
+
+stderr:
+
+`````
+ripwire edit: applied atomically; receipt carries region, blob_sha, edit_check, tests_to_run; next: --uses=src/infra/sortutil.h:nonNegativeFloatDescKey
+`````
+
+## `./build/ripwire . --replace-symbol-body=DoesNotExist --edit-payload=<scratch>/aux/payload_note.h`
+
+*An unknown TARGET refuses and leaves every file byte-identical.*
+
+**exit code: 1** — **wall time: 3.49s**
+
+`````
+(empty)
+`````
+
+stderr:
+
+`````
+ripwire: --replace-symbol-body: symbol 'DoesNotExist' not found
+`````
+
+## `./build/ripwire . --edit-plan=<scratch>/aux/edit_plan.json --dry-run`
+
+*A versioned multi-edit TRANSACTION preflighted without writing: the receipt shows what each op would read and touch.*
+
+**wall time: 3.52s**
+
+Input file:
+
+`````
+{
+ "version": 1,
+ "edits": [
+  {
+   "op": "insert_before_symbol",
+   "target": "nonNegativeFloatDescKey",
+   "payload": "plan_note.h"
+  }
+ ]
+}
+`````
+
+`````
+{"schema":"ripwire.edit-plan/v1","mode":"dry-run","edits":1,"files":1,"callers_union":4,"graph_ambiguous":2933,"graph_unresolved":15249,"graph_unindexed":269,"counts_floor":true,"atomic_scope":"per-file","rollback_on_write_error":true,"recheck_before_each_write":true,"multifile_crash_atomic":false," … [line truncated: 353 more bytes on this line]
+`````
+
+## `./build/ripwire . --edit-plan=<scratch>/aux/edit_plan.json --apply`
+
+*The same plan committed: per-file locks, re-verify-before-write, atomic rename, rollback on a later failure.*
+
+**wall time: 6.87s**
+
+`````
+{"schema":"ripwire.edit-plan/v1","mode":"apply","edits":1,"files":1,"callers_union":4,"graph_ambiguous":2933,"graph_unresolved":15249,"graph_unindexed":269,"counts_floor":true,"applied":1,"atomic_files":1,"atomic_scope":"per-file","rollback_on_write_error":true,"recheck_before_each_write":true,"mult … [line truncated: 537 more bytes on this line]
+{"n":"benchAdaptive","p":"bench/bench_radix_ab.cpp:157","l":[162]},
+{"n":"radixSortNonNegativeFloatsDesc","p":"src/infra/sortutil.h:107","l":[116]},
+{"n":"radixSortByScoreDescId","p":"src/infra/sortutil.h:122","l":[182]}],
+"graph_ambiguous":2933,"graph_unresolved":15249,"graph_unindexed":269,"counts_floor":true}}]}
+`````
+
+## `./build/ripwire . --edit-plan=<scratch>/aux/edit_plan.json`
+
+*Neither --dry-run nor --apply: the mode is explicit, so this refuses.*
+
+**exit code: 1**
+
+`````
+(empty)
+`````
+
+stderr:
+
+`````
+ripwire: --edit-plan requires exactly one of --dry-run or --apply
+`````
+
+## `./build/ripwire . --quality-delta`
+
+*After the agent's edits: the complexity/nesting rows on lessByScoreDescId are gone (the replace undid them), the rest still gate (exit 2).*
+
+**exit code: 2** — **wall time: 23.81s**
+
+`````
+<!-- ripwire quality-delta schema=ripwire.quality-delta/v1: only what the change made WORSE vs baseline=: regressions= minor= gating=; <r kind= sym= p= was= now= gating= bar=>, <sa> acked. value-ref-excluded=N: internal functions kept off because a table, field or argument in another function or at file scope holds them (matched by name, not a proven call); a floor. at=: commit+dirty+shallow. next=: the one pasteable follow-up. stale=N: ack ledger rows whose target no longer applies (sa rows); never gating. preexisting-worse=N: regressions on symbols that existed at baseline; they gate when major. new-symbol=N: findings on NEW code; new-symbol rows never gate, except defect-shape format-arity. register-macro-excluded=N: symbols kept out of dead-code as self-registering test/bench macros; a floor. declined-call-excluded=N: symbols kept out of dead-code only because a declined call may mean them; a floor. api-new-surface=N: new PUBLIC symbols; a count, never gates, not in regressions=. renames=/rename_window_commits=: git rename pairs read over that many commits, to re-file baseline and acks. acked_by_rename=/acked_by_content=: acked= suppressions matched via git renames / an equal body hash. renames_window_truncated=1: history is deeper than the rename window, older renames unread. acked=N: findings suppressed by the ack ledger, listed as sa rows; never gating. r origin=new-symbol: a finding on NEW code (absent: preexisting-worse). sa key=/why=: the stale ack's ledger hash / target-gone (names nothing now) or finding-gone (no longer fires). r members=/tokens=: a duplication row's clone group (member ids) / their shared normalized-token count. -->
+<quality-delta schema="ripwire.quality-delta/v1" baseline="git-HEAD" regressions="5" minor="0" acked="1" stale="167" preexisting-worse="2" new-symbol="3" gating="2" register-macro-excluded="62" api-new-surface="2" at="0712a5182+dirty" renames="62" rename_window_commits="400" acked_by_rename="0" acke … [line truncated: 98 more bytes on this line]
+<r kind="dead-code" sym="src/infra/sortutil.h::rw::sortutil::nonNegativeFloatAscKeyCopy" origin="new-symbol" p="src/infra/sortutil.h:88"/>
+<r kind="dead-code" sym="src/infra/sortutil.h::rw::sortutil::sortScoredIdsWithOptions" origin="new-symbol" p="src/infra/sortutil.h:98"/>
+<r kind="duplication" members="src/infra/sortutil.h::rw::sortutil::nonNegativeFloatAscKeyCopy | src/infra/sortutil.h::rw::sortutil::nonNegativeFloatDescKey" tokens="59" p="src/infra/sortutil.h:88" gating="1"/>
+<r kind="new-clone-of-reused-helper" sym="src/infra/sortutil.h::rw::sortutil::nonNegativeFloatAscKeyCopy | src/infra/sortutil.h::rw::sortutil::nonNegativeFloatDescKey" was="0" now="4" p="src/infra/sortutil.h:88" gating="1" next="--expand=src/infra/sortutil.h:nonNegativeFloatDescKey"/>
+<r kind="params" sym="src/infra/sortutil.h::rw::sortutil::sortScoredIdsWithOptions" was="0" now="8" bar="5" origin="new-symbol" p="src/infra/sortutil.h:98"/>
+<sa kind="api-surface" key="085e3d408c2c4a35" why="target-gone"/>
+<sa kind="api-surface" key="155d74d341a49f3c" why="target-gone"/>
+<sa kind="api-surface" key="1a15386c2d1e47af" why="target-gone"/>
+<sa kind="api-surface" key="298e798c7f075715" why="target-gone"/>
+<sa kind="api-surface" key="56acdf9b5c314a14" why="target-gone"/>
+<sa kind="api-surface" key="5a07390012b46e06" why="target-gone"/>
+<sa kind="api-surface" key="6eef859578c8c376" why="target-gone"/>
+<sa kind="api-surface" key="6f2394762f82a855" why="target-gone"/>
+<sa kind="api-surface" key="7f2c3eefdf6e512e" why="target-gone"/>
+<sa kind="api-surface" key="802e513731103806" why="target-gone"/>
+<sa kind="api-surface" key="b6a24afef32a68a8" why="target-gone"/>
+<sa kind="api-surface" key="c923e661c197b265" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="1926b0d9e94541a0" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="1d3814ba687a4aef" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="1db76028879244ef" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="25c9f0504fd376a4" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="36e39c7ab0fc1686" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="4bce64bd920de0c3" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="61f0e361ef7dee27" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="79625906f9f71ad0" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="8ecb190954dce18a" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="995375dfa4e63104" why="target-gone"/>
+<sa kind="api-surface:new-symbol" key="ee71e4fffa361902" why="target-gone"/>
+… [145 more display lines; full output is 17117 bytes on 1 raw line(s)]
+`````
+
+stderr:
+
+`````
+ripwire: no ./.ripwire_quality_baseline — auto-comparing the working tree vs git HEAD (commit the baseline with --quality-baseline to pin it)
+ripwire: --quality-delta gating: 2 preexisting-worse major finding(s); first: duplication src/infra/sortutil.h::rw::sortutil::nonNegativeFloatAscKeyCopy | src/infra/sortutil.h::rw::sortutil::nonNegativeFloatDescKey at src/infra/sortutil.h:88 (was=0 now=59)
+`````
+
+## `./build/ripwire . --quality-baseline`
+
+*REFUSES, exit 1: this sandbox tree is already regressed, and pinning here would swallow that debt into the floor so every later delta read clean. It names how many gating findings it would absorb, the first of them, and the way forward.*
+
+**exit code: 1** — **wall time: 19.56s**
+
+`````
+(empty)
+`````
+
+stderr:
+
+`````
+ripwire: --quality-baseline: this tree already holds 2 gating finding(s) against HEAD — pinning here would absorb
+  them into the floor, and every later --quality-delta would read clean. First: duplication src/infra/sortutil.h::rw::sortutil::nonNegativeFloatAscKeyCopy | src/infra/sortutil.h::rw::sortutil::nonNegativeFloatDescKey (was=0 now=59)
+  Commit the tree first, or pass --allow-dirty to pin anyway (the sidecar then records the 2 absorbed, and every
+  report against it carries baseline_absorbed="2").
+`````
+
+## `./build/ripwire . --quality-baseline --allow-dirty`
+
+*The consent form: pin anyway. The sidecar is stamped with the dirty pin and the absorbed count, so the fact outlives the process that knew it.*
+
+**wall time: 28.37s**
+
+`````
+(empty)
+`````
+
+stderr:
+
+`````
+ripwire: --quality-baseline --allow-dirty: pinned with 2 gating finding(s) ABSORBED into the floor (stamped in the sidecar; every --quality-delta against it carries baseline_absorbed="2")
+ripwire: wrote ./.ripwire_quality_baseline (snapshot of 30924 per-symbol rows, 31862 indexed symbols total)
+`````
+
+Artifact written:
+
+`````
+ 5234589 .ripwire_quality_baseline
+# ripwire quality baseline v6 — regenerate with --quality-baseline; do not hand-edit
+producer 2f117b08357d2069e6aa7f22cdc9d010e6bf33bff6cdd6cf3280d637183ba207
+head 0712a5182ef61b6885b76af328cae18e839eb110
+dirty 1
+absorbed 2
+ccx 67c15011ee8b 0
+ccx d19d7c13cbc7 2
+ccx 1f7edbff929e5 10
+ccx 6a732f6699b
+`````
+
+## `./build/ripwire . --quality-delta`
+
+*Against that sidecar the same tree reads regressions=0 — but baseline_absorbed= is on the root, so this green means clean SINCE THE PIN, never clean. A baseline is a floor YOU chose, and it belongs BEFORE the change.*
+
+**wall time: 18.92s**
+
+`````
+<!-- ripwire quality-delta schema=ripwire.quality-delta/v1: only what the change made WORSE vs baseline=: regressions= minor= gating=; <r kind= sym= p= was= now= gating= bar=>, <sa> acked. value-ref-excluded=N: internal functions kept off because a table, field or argument in another function or at file scope holds them (matched by name, not a proven call); a floor. at=: commit+dirty+shallow. stale=N: ack ledger rows whose target no longer applies (sa rows); never gating. stale_by_kind=: stale= split by ack kind (kind:N,...); the sa rows are collapsed. stale_next=: the call printing the sa rows and the full header. preexisting-worse=N: regressions on symbols that existed at baseline; they gate when major. new-symbol=N: findings on NEW code; new-symbol rows never gate, except defect-shape format-arity. register-macro-excluded=N: symbols kept out of dead-code as self-registering test/bench macros; a floor. declined-call-excluded=N: symbols kept out of dead-code only because a declined call may mean them; a floor. api-new-surface=N: new PUBLIC symbols; a count, never gates, not in regressions=. renames=/rename_window_commits=: git rename pairs read over that many commits, to re-file baseline and acks. acked_by_rename=/acked_by_content=: acked= suppressions matched via git renames / an equal body hash. renames_window_truncated=1: history is deeper than the rename window, older renames unread. acked=N: findings suppressed by the ack ledger, listed as sa rows; never gating. -->
+<quality-delta schema="ripwire.quality-delta/v1" baseline="sidecar" regressions="0" minor="0" acked="0" stale="167" preexisting-worse="0" new-symbol="0" gating="0" register-macro-excluded="62" api-new-surface="0" at="0712a5182+dirty" renames="62" rename_window_commits="400" acked_by_rename="0" acked … [line truncated: 316 more bytes on this line]
+</quality-delta>
+`````
+
+
+---
+
+# the MCP dialect — the same verbs over stdio JSON-RPC (one-shot exchange, not a persistent server)
+
+## `printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize"}' '{"jsonrpc":"2.0","id":2,"method":"tools/list"}' | ./build/ripwire --mcp`
+
+*initialize + tools/list: the manifest an agent host loads at session start — every verb's name, description and input schema.*
+
+`````
+{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-11-25","serverInfo":{"name":"ripwire","version":"1.0"},"capabilities":{"tools":{},"resources":{}},"instructions":"Map before reading files. Start a new task with explore; use from_trace for an error; use impact plus uses before changing a sym … [line truncated: 738 more bytes on this line]
+{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"analyze","description":"Architecture map for a directory: signatures and the call graph for the top symbols. Use when landing cold in a repo or subdir, before reading files; for a task-scoped inventory use 'for', for one symbol's neighborhood find_ … [line truncated: 742 more bytes on this line]
+{"name":"rank_by","description":"The SAME architecture map 'analyze' serves, ranked by a different signal instead of plain PageRank. rank_by = pagerank (default, omit it — the CLI's own unbiased --rank-by=pagerank; 'analyze' can rank differently on a tree with uncommitted changes, where it biases  … [line truncated: 1077 more bytes on this line]
+{"name":"find_symbol","description":"A symbol's 1-hop neighborhood: the symbol (with a fetch_body handle) plus direct callers (calledBy) and callees (calls). Full transitive reach: 'impact'. Read/write/import sites, not just calls: 'uses'. JSON {symbol, calledBy, calls, defs, count, hop_tested, hop_ … [line truncated: 1181 more bytes on this line]
+{"name":"find_referencing_symbols","description":"Direct (1-hop) callers of a symbol, each with a fetch_body handle. For the full transitive blast radius use 'impact', for read/write/import sites 'uses'. JSON {symbol, calledBy, defs, count, hop_tested, hop_untested, declined_calls, counts_floor}; ca … [line truncated: 945 more bytes on this line]
+{"name":"grep","description":"Trigram literal search; each hit annotated with its enclosing symbol (which function/class it is in). Hits carry text; enclosing rows a fetch_body handle. pattern = the literal; in=any lifts the span tiering (default: tightest non-empty tier; rest rides as suppressed_co … [line truncated: 837 more bytes on this line]
+{"name":"cochange","description":"Files that historically change together with this file — the co-edit partners. Fowler's Shotgun Surgery as change coupling. dep_capable=false means neither side could carry one (sh/md/json/binary), so surprising is undefined rather than informative. file = the fil … [line truncated: 700 more bytes on this line]
+{"name":"memory_recall","description":"Most relevant memory notes / docs for a task, full text — the few that matter, not the whole corpus. path = docs/memory dir; task = what you're working on; top_k = docs to return, 1..1000 (default 8), refused outside that band, never clamped; budget_tokens =  … [line truncated: 790 more bytes on this line]
+{"name":"situational_awareness","description":"The 5 things to know about a diff, as JSON: blast_radius, tests_to_run, forgotten (usual co-change partners missing from this diff), hotspot_alert, modules_touched. forgotten = the Shotgun Surgery check. diff/files optional — defaults to 'git diff HEA … [line truncated: 1297 more bytes on this line]
+{"name":"mentions","description":"Docs (markdown plans/designs) that name a code symbol in a backtick. symbol = the code symbol name; limit/offset page the files. An @FILE:LINE line-seed rebinds to the innermost definition enclosing that line and answers for it, disclosing the rebound name as 'sym'  … [line truncated: 625 more bytes on this line]
+{"name":"for","description":"Task-lens ranked, signatures-only inventory of the building blocks most relevant to a task (cx=complexity, in=reuse-count). task = the task in plain words; budget_tokens = an optional soft row target (the CLI --for --token-budget). The header carries route= (which ranker … [line truncated: 1061 more bytes on this line]
+{"name":"lego","description":"Interface-to-impls view for ONE named interface/base: its method contract plus EVERY implementor (own-language only), each with file path. Use when implementing against a KNOWN interface (contrast 'for', which sprays top interfaces for a task). type = interface/base nam … [line truncated: 841 more bytes on this line]
+{"name":"owners","description":"Bus-factor: recency-weighted (6-month half-life) author ownership per file. symbol = optional, restricts to the file that defines it; limit/offset page the rows. at= is the commit these numbers were computed at (+dirty = the working tree differed). An @FILE:LINE line- … [line truncated: 879 more bytes on this line]
+{"name":"replace_symbol_body","description":"Replace a symbol's ENTIRE definition (signature through closing brace) with new_body — splices over the full def span, preserving every byte outside it verbatim; new_body must be a complete, well-formed definition. One trailing newline folds (trailing_n … [line truncated: 1323 more bytes on this line]
+{"name":"insert_before_symbol","description":"Insert text immediately BEFORE a symbol's definition (its first byte); padded to the file's own blank-line seam (separator_padded=N). Same refusal contract as replace_symbol_body (not found / ambiguous / stale index / symlink / concurrent write, file unc … [line truncated: 877 more bytes on this line]
+{"name":"insert_after_symbol","description":"Insert text immediately AFTER a symbol's definition (past its final byte, which is preserved exactly); padded to the file's own blank-line seam (separator_padded=N); one trailing newline folds (trailing_newline_folded). Same refusal contract as replace_sy … [line truncated: 878 more bytes on this line]
+{"name":"fetch_body","description":"Full (or partial-range) source of a symbol's definition, addressed by the stable `handle` a read verb attached to it (bodies on request, not by default). start_line/end_line are optional, 1-based, INCLUSIVE and BODY-RELATIVE (line 1 = the def's first line), clampe … [line truncated: 1049 more bytes on this line]
+{"name":"exemplar","description":"BEFORE writing a function / method / class / struct / interface / variable, get the repo's single best-in-class instance of that kind to imitate — signature AND full body. chosen by ROLE, NEVER by text similarity to your task: candidates are first filtered to cogn … [line truncated: 1375 more bytes on this line]
+{"name":"quality_delta","description":"Your PR self-check, run every time you think a change is DONE — pairs with the CLI-only --test-gate (names the tests to run + the untested blast radius; not MCP-exposed) to form the two-step pre-PR gate. Reports ONLY what your working tree made WORSE vs basel … [line truncated: 862 more bytes on this line]
+{"name":"quality_baseline","description":"PIN the quality floor: writes .ripwire_quality_baseline stamped with the current git HEAD sha, snapshotting complexity / duplication / dead-code / API surface. Call once at the start of non-trivial work, then quality_delta compares against this pinned floor  … [line truncated: 445 more bytes on this line]
+{"name":"impact","description":"IS IT SAFE TO CHANGE X? — the TRANSITIVE blast radius of a symbol via calls, nearest first (d= hop depth), then PageRank. Use before modifying or deleting a symbol; it beats find_referencing_symbols (direct callers only), and 'uses' catches the read/write/import sit … [line truncated: 1325 more bytes on this line]
+{"name":"uses","description":"The STATICALLY RESOLVABLE use-sites of a symbol, not just calls: role (call | read | write | import | extends), file:line, and enclosing symbol. Use to see the footprint before renaming or changing a name — find_referencing_symbols and impact follow only calls. extern … [line truncated: 1146 more bytes on this line]
+{"name":"affected","description":"WHICH TESTS TO RUN for a change — test files that transitively reach the changed files/symbols, ranked by evidence (edited > partner-named > hop distance). files = changed files and/or symbols, comma-separated: each item is tried as an indexed PATH pattern first,  … [line truncated: 1238 more bytes on this line]
+{"name":"path_between","description":"Does A REACH B, and HOW? — the shortest directed CALL path between two symbols, hop-by-hop. reachable=\"0\" hops=\"0\" is a valid 'not reachable' answer — call edges are name-based, so a missing dynamic/callback edge can hide a real path. Named path_between  … [line truncated: 709 more bytes on this line]
+{"name":"connect","description":"When a task touches 2..16 named symbols, returns the minimal subgraph RELATING them - terminals, the fewest joining intermediaries (with signatures), and call edges in true direction - finding the shared-caller joins a directed path_between cannot; unrelated symbols  … [line truncated: 950 more bytes on this line]
+{"name":"explore","description":"ONE-call task orientation: the routed+anchored ranking, full bodies of the top hits, their 1-hop callers, field notes, and tests_to_run — ALL under one deterministic byte budget, in a fixed section order (ranking > bodies > callers > notes > tests) that degrades gr … [line truncated: 2135 more bytes on this line]
+{"name":"from_trace","description":"Paste a stack trace / sanitizer report / compiler error and get it mapped onto indexed symbols, ranked INNERMOST-first: the parsed <trace> frame map, the ranked suspects' signatures, and the innermost in-corpus symbol's FULL body. Out-of-corpus frames are listed a … [line truncated: 1233 more bytes on this line]
+{"name":"edit_check","description":"Just edited a symbol? Did its CONTRACT (param count + publicness) change vs git HEAD, and which 1-hop callers are NOW INCOMPATIBLE with the new arity by fixed-arity evidence (not a guess — every folded definition disagrees)? This is call sites worth OPENING, not … [line truncated: 1908 more bytes on this line]
+{"name":"whereis","description":"WHERE DOES THIS CONTENT LIVE? Which branch's tree defines or mentions a symbol, HEAD first, with on-head=0 naming the case this verb exists for: content that lives only on a branch (a finished fix stranded on 1 of 30 refs). Each distinct blob is read once (content-ad … [line truncated: 1475 more bytes on this line]
+{"name":"stray_content","description":"Per branch: the lines its own divergent work AUTHORED (vs its merge-base with HEAD) that the live line does NOT have. Four verdicts (unmerged+superseded+merged+unknown=refs): v=unmerged is genuinely absent; v=superseded means the live line re-implemented the wo … [line truncated: 1123 more bytes on this line]
+{"name":"flags","description":"WHAT IS BUILT BUT DARK here — the answer to 'why don't I see feature X?'. Harvests all three gate patterns (ifndef/define header gates, CMake option(), getenv reads) with each gate's kind, DEFAULT, the size of the code it guards, and its read sites. When a name is bo … [line truncated: 1434 more bytes on this line]
+{"name":"doc_drift","description":"WHICH OF THIS REPO'S DOC CLAIMS ARE NOW FALSE. Verifies the CHECKABLE anchors in every markdown file against the live index and returns ONLY the ones that no longer hold: file:line refs (missing-file / past-eof / line-moved), backticked symbol mentions (undefined), … [line truncated: 1167 more bytes on this line]
+{"name":"slice","description":"WHERE IS THIS VARIABLE DEFINED AND USED inside one function — NAME-BASED intra-procedural def-use rows of one variable inside ONE uniquely-resolved definition (the ARISE slicer, arXiv:2605.03117). symbol alone lists the sliceable locals to pick from; add var (or spel … [line truncated: 1722 more bytes on this line]
+{"name":"batch","description":"ONE-TURN CONTEXT SWEEP: answer up to 16 heterogeneous READ sub-queries in a single call (the deterministic $0 counterpart of a parallel-search agent). queries = array over the SAME path, in EITHER grammar: {verb, ...args} objects, or the CLI --batch file's own \"verb:a … [line truncated: 2040 more bytes on this line]
+`````
+
+The manifest, summarised (name / description bytes / required args) — what the host pays in context every session:
+
+`````
+tools= 33  manifest_bytes= 47445  (~tokens at 4 bytes/token: 11861 )
+explore                      desc_bytes= 1340 schema_bytes=  958 required=['task']
+batch                        desc_bytes= 1235 schema_bytes=  962 required=['queries']
+edit_check                   desc_bytes= 1180 schema_bytes=  889 required=['symbol']
+slice                        desc_bytes=  953 schema_bytes=  932 required=['symbol']
+whereis                      desc_bytes=  701 schema_bytes=  941 required=['symbol']
+flags                        desc_bytes=  881 schema_bytes=  720 required=[]
+exemplar                     desc_bytes=  954 schema_bytes=  591 required=[]
+replace_symbol_body          desc_bytes=  865 schema_bytes=  610 required=['symbol', 'new_body']
+impact                       desc_bytes=  821 schema_bytes=  666 required=['symbol']
+situational_awareness        desc_bytes=  865 schema_bytes=  581 required=[]
+affected                     desc_bytes=  790 schema_bytes=  610 required=['files']
+from_trace                   desc_bytes=  836 schema_bytes=  559 required=['trace']
+find_symbol                  desc_bytes=  752 schema_bytes=  590 required=['symbol']
+doc_drift                    desc_bytes=  728 schema_bytes=  604 required=[]
+uses                         desc_bytes=  626 schema_bytes=  682 required=['symbol']
+stray_content                desc_bytes=  678 schema_bytes=  604 required=[]
+rank_by                      desc_bytes=  758 schema_bytes=  481 required=[]
+for                          desc_bytes=  453 schema_bytes=  777 required=['task']
+fetch_body                   desc_bytes=  623 schema_bytes=  588 required=['handle']
+connect                      desc_bytes=  535 schema_bytes=  580 required=['symbols']
+find_referencing_symbols     desc_bytes=  505 schema_bytes=  590 required=['symbol']
+insert_after_symbol          desc_bytes=  458 schema_bytes=  577 required=['symbol', 'text']
+insert_before_symbol         desc_bytes=  455 schema_bytes=  578 required=['symbol', 'text']
+owners                       desc_bytes=  425 schema_bytes=  625 required=[]
+quality_delta                desc_bytes=  742 schema_bytes=  279 required=[]
+lego                         desc_bytes=  360 schema_bytes=  651 required=['type']
+grep                         desc_bytes=  445 schema_bytes=  562 required=['pattern']
+memory_recall                desc_bytes=  447 schema_bytes=  500 required=['task']
+path_between                 desc_bytes=  357 schema_bytes=  506 required=['from', 'to']
+cochange                     desc_bytes=  388 schema_bytes=  476 required=['file']
+analyze                      desc_bytes=  546 schema_bytes=  318 required=[]
+mentions                     desc_bytes=  305 schema_bytes=  486 required=['symbol']
+quality_baseline             desc_bytes=  407 schema_bytes=  193 required=[]
+`````
+
+## `printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize"}' '{"jsonrpc":"2.0","id":2,"method":"tools/list"}' | ./build/ripwire --mcp --mcp-tools=core`
+
+*--mcp-tools=core: the server lists only the core profile's tools (explore, batch, from_trace, impact, uses, fetch_body, edit_check, quality_delta), so a host that loads every schema at session start pays only for those.*
+
+`````
+{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-11-25","serverInfo":{"name":"ripwire","version":"1.0"},"capabilities":{"tools":{},"resources":{}},"instructions":"Map before reading files. Start a new task with explore; use from_trace for an error; use impact plus uses before changing a sym … [line truncated: 955 more bytes on this line]
+{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"fetch_body","description":"Full (or partial-range) source of a symbol's definition, addressed by the stable `handle` a read verb attached to it (bodies on request, not by default). start_line/end_line are optional, 1-based, INCLUSIVE and BODY-RELAT … [line truncated: 1092 more bytes on this line]
+{"name":"quality_delta","description":"Your PR self-check, run every time you think a change is DONE — pairs with the CLI-only --test-gate (names the tests to run + the untested blast radius; not MCP-exposed) to form the two-step pre-PR gate. Reports ONLY what your working tree made WORSE vs basel … [line truncated: 862 more bytes on this line]
+{"name":"impact","description":"IS IT SAFE TO CHANGE X? — the TRANSITIVE blast radius of a symbol via calls, nearest first (d= hop depth), then PageRank. Use before modifying or deleting a symbol; it beats find_referencing_symbols (direct callers only), and 'uses' catches the read/write/import sit … [line truncated: 1325 more bytes on this line]
+{"name":"uses","description":"The STATICALLY RESOLVABLE use-sites of a symbol, not just calls: role (call | read | write | import | extends), file:line, and enclosing symbol. Use to see the footprint before renaming or changing a name — find_referencing_symbols and impact follow only calls. extern … [line truncated: 1146 more bytes on this line]
+{"name":"explore","description":"ONE-call task orientation: the routed+anchored ranking, full bodies of the top hits, their 1-hop callers, field notes, and tests_to_run — ALL under one deterministic byte budget, in a fixed section order (ranking > bodies > callers > notes > tests) that degrades gr … [line truncated: 2135 more bytes on this line]
+{"name":"from_trace","description":"Paste a stack trace / sanitizer report / compiler error and get it mapped onto indexed symbols, ranked INNERMOST-first: the parsed <trace> frame map, the ranked suspects' signatures, and the innermost in-corpus symbol's FULL body. Out-of-corpus frames are listed a … [line truncated: 1233 more bytes on this line]
+{"name":"edit_check","description":"Just edited a symbol? Did its CONTRACT (param count + publicness) change vs git HEAD, and which 1-hop callers are NOW INCOMPATIBLE with the new arity by fixed-arity evidence (not a guess — every folded definition disagrees)? This is call sites worth OPENING, not … [line truncated: 1908 more bytes on this line]
+{"name":"batch","description":"ONE-TURN CONTEXT SWEEP: answer up to 16 heterogeneous READ sub-queries in a single call (the deterministic $0 counterpart of a parallel-search agent). queries = array over the SAME path, in EITHER grammar: {verb, ...args} objects, or the CLI --batch file's own \"verb:a … [line truncated: 2040 more bytes on this line]
+`````
+
+The core manifest, summarised (name / description bytes / required args):
+
+`````
+tools= 8  manifest_bytes= 14186  (~tokens at 4 bytes/token: 3546 )
+explore                      desc_bytes= 1340 schema_bytes=  958 required=['task']
+batch                        desc_bytes= 1235 schema_bytes=  962 required=['queries']
+edit_check                   desc_bytes= 1180 schema_bytes=  889 required=['symbol']
+impact                       desc_bytes=  821 schema_bytes=  666 required=['symbol']
+from_trace                   desc_bytes=  836 schema_bytes=  559 required=['trace']
+uses                         desc_bytes=  626 schema_bytes=  682 required=['symbol']
+fetch_body                   desc_bytes=  623 schema_bytes=  588 required=['handle']
+quality_delta                desc_bytes=  742 schema_bytes=  279 required=[]
+`````
+
+## `printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize"}' '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"for","arguments":{"path":".","task":"pagerank power iteration"}}}' | ./build/ripwire --mcp`
+
+*MCP `for`: always bundle=sigs (never the CLI's compact route), the same ranked signatures as --for.*
+
+**wall time: 3.85s**
+
+`````
+{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-11-25","serverInfo":{"name":"ripwire","version":"1.0"},"capabilities":{"tools":{},"resources":{}},"instructions":"Map before reading files. Start a new task with explore; use from_trace for an error; use impact plus uses before changing a sym … [line truncated: 738 more bytes on this line]
+{"jsonrpc":"2.0","id":2,"result":{"content":[{"type":"text","text":"<ctx task=\"pagerank power iteration\" route=\"subtoken+body\" root=\".\" confidence=\"high\" margin_pct=\"22\" at=\"0712a5182\" doc_mentions=\"5\" doc_mentions_capped=\"1\" doc_mentions_total=\"16\" bundle=\"sigs\" lens=\"churn,amp … [line truncated: 17957 more bytes on this line]
+"_index":"[index: files=3631 symbols=31860 hash=2da1730f]","_fresh":"ok"}}
+`````
+
+## `printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize"}' '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"whereis","arguments":{"path":".","symbol":"rankGraphTeleport"}}}' '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"whereis","arguments":{"path":".","symbol":"computeOnePairOverlap"}}}' | ./build/ripwire --mcp --mcp-legend=inline`
+
+*--mcp-legend=inline: every answer of the stdio session carries its own legend (the default, session, sends each definition once per session after the first answer).*
+
+**wall time: 37.16s**
+
+`````
+{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-11-25","serverInfo":{"name":"ripwire","version":"1.0"},"capabilities":{"tools":{},"resources":{}},"instructions":"Map before reading files. Start a new task with explore; use from_trace for an error; use impact plus uses before changing a sym … [line truncated: 735 more bytes on this line]
+{"jsonrpc":"2.0","id":2,"result":{"content":[{"type":"text","text":"<!-- ripwire whereis schema=ripwire.whereis/v1: every LOCAL ref whose tree holds sym= (refs_scanned=, blobs=), HEAD first: <hit ref= tip= date= p= l= kind= t=>. window: shown= capped= (capped=1 cut). at=: commit+dirty+shallow. next= … [line truncated: 6553 more bytes on this line]
+"_index":"[index: files=3631 symbols=31860 hash=2da1730f]","_fresh":"ok"}}
+{"jsonrpc":"2.0","id":3,"result":{"content":[{"type":"text","text":"<!-- ripwire whereis schema=ripwire.whereis/v1: every LOCAL ref whose tree holds sym= (refs_scanned=, blobs=), HEAD first: <hit ref= tip= date= p= l= kind= t=>. window: shown= capped= (capped=1 cut). at=: commit+dirty+shallow. next= … [line truncated: 2179 more bytes on this line]
+"_index":"[index: files=3631 symbols=31860 hash=2da1730f]","_fresh":"ok"}}
+`````
+
+## `printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize"}' '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"explore","arguments":{"path":".","task":"add a new output format flag to the CLI","budget_tokens":2000}}}' | ./build/ripwire --mcp`
+
+*MCP `explore` = --pack-task under a token budget, one call.*
+
+**wall time: 2.58s**
+
+`````
+{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-11-25","serverInfo":{"name":"ripwire","version":"1.0"},"capabilities":{"tools":{},"resources":{}},"instructions":"Map before reading files. Start a new task with explore; use from_trace for an error; use impact plus uses before changing a sym … [line truncated: 738 more bytes on this line]
+{"jsonrpc":"2.0","id":2,"result":{"content":[{"type":"text","text":"<ctx schema=\"ripwire.pack-task/v1\" task=\"add a new output format flag to the CLI\" route=\"subtoken+body:declined(add;156-carriers,57-defs)\" root=\".\" dropped_positive=\"2\" est_tokens=\"1494\" budget_tokens=\"2000\"><!-- ripwi … [line truncated: 4001 more bytes on this line]
+"_index":"[index: files=3631 symbols=31860 hash=2da1730f]","_fresh":"ok"}}
+`````
+
+## `printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize"}' '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"fetch_body","arguments":{"path":".","handle":"rankGraphTeleport"}}}' | ./build/ripwire --mcp`
+
+*MCP `fetch_body`: the lazy-body handle posture — bodies only after ranked retrieval, by bare name here.*
+
+**wall time: 2.69s**
+
+`````
+{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-11-25","serverInfo":{"name":"ripwire","version":"1.0"},"capabilities":{"tools":{},"resources":{}},"instructions":"Map before reading files. Start a new task with explore; use from_trace for an error; use impact plus uses before changing a sym … [line truncated: 738 more bytes on this line]
+{"jsonrpc":"2.0","id":2,"result":{"content":[{"type":"text","text":"{\"resolved_from_name\":\"rankGraphTeleport\",\"handle\":\"sym#cfb3dc25a9d1fa2c@2d70514834240030\",\"name\":\"rankGraphTeleport\",\"kind\":\"fn\",\"file\":\"src/graph.h\",\"line\":11809,\"start_line\":1,\"end_line\":29,\"total_lines … [line truncated: 1330 more bytes on this line]
+"_index":"[index: files=3631 symbols=31860 hash=2da1730f]","_fresh":"ok"}}
+`````
+
+## `printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize"}' '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"grep","arguments":{"path":".","pattern":"DISCLOSE","limit":3}}}' | ./build/ripwire --mcp`
+
+*MCP `grep` with paging args.*
+
+**wall time: 2.32s**
+
+`````
+{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-11-25","serverInfo":{"name":"ripwire","version":"1.0"},"capabilities":{"tools":{},"resources":{}},"instructions":"Map before reading files. Start a new task with explore; use from_trace for an error; use impact plus uses before changing a sym … [line truncated: 738 more bytes on this line]
+{"jsonrpc":"2.0","id":2,"result":{"content":[{"type":"text","text":"{\"pattern\":\"DISCLOSE\",\"root\":\".\",\"files\":254,\"shown\":3,\"capped\":true,\"total\":856,\"has_more\":true,\"next_offset\":3,\"offset\":0,\"limit\":3,\"hits_capped\":false,\"next\":\"--grep=DISCLOSE --offset=3 --legend=compa … [line truncated: 608 more bytes on this line]
+{\"file\":\"src/abicheck.h\",\"line\":494,\"in\":\"abicheck::collectAuthoredSites\",\"parse_degraded\":true,\"text\":\"            DISCLOSE( result, AbiResult::DisclosureWhy::NoMergeBase, \\\"abi: no merge-base for a ref (unrelated history?) — that ref is counted, not compared\\\" );\"},
+{\"file\":\"src/arch.h\",\"line\":507,\"in\":\"rw::parseArchRules\",\"text\":\"        DISCLOSE( Diagnostics::answerRefused, \\\"--arch exits 1 with path:line and the reason on stderr; no report is printed\\\",\"}],\"parse_degraded_note\":\"a hit carrying parse_degraded:true sits in a file whose par … [line truncated: 464 more bytes on this line]
+{\"file\":\"CMakeLists.txt\",\"line\":346},
+{\"file\":\"CMakeLists.txt\",\"line\":867}]},\"enclosing\":[{\"n\":\"path_instructions\",\"callers\":0,\"handle_omitted\":\"non-code\"},
+{\"n\":\"abicheck::collectAuthoredSites\",\"callers\":1,\"cx\":9,\"handle\":\"sym#1ab32951dcc2d860@b046719c64b5631a\"},
+{\"n\":\"rw::parseArchRules\",\"callers\":2,\"cx\":33,\"handle\":\"sym#f5dd171cfba47899@6964465e492a1d23\"}]}"}],
+"_index":"[index: files=3631 symbols=31860 hash=2da1730f]","_fresh":"ok"}}
+`````
+
+## `printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize"}' '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"slice","arguments":{"path":".","symbol":"rankGraphTeleport","var":"teleport","flow":"back","depth":3}}}' | ./build/ripwire --mcp`
+
+*MCP `slice` — the CLI's --slice/--slice-flow/--slice-depth as one verb.*
+
+**wall time: 4.06s**
+
+`````
+{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-11-25","serverInfo":{"name":"ripwire","version":"1.0"},"capabilities":{"tools":{},"resources":{}},"instructions":"Map before reading files. Start a new task with explore; use from_trace for an error; use impact plus uses before changing a sym … [line truncated: 738 more bytes on this line]
+{"jsonrpc":"2.0","id":2,"result":{"content":[{"type":"text","text":"<!-- ripwire slice schema=ripwire.slice/v1: name-based def-use rows of one variable in one definition: <s l= k=def|use|both|scope t= [b= pp= rd=]> (rd= reaching-def lines per reach=cfg|linear), <v n= l= t=> inventory; steps=/depth=  … [line truncated: 1777 more bytes on this line]
+"_index":"[index: files=3631 symbols=31860 hash=2da1730f]","_fresh":"ok"}}
+`````
+
+## `printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize"}' '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"find_symbol","arguments":{"path":".","symbol":"DoesNotExist"}}}' | ./build/ripwire --mcp`
+
+*MCP error shape: an unknown symbol comes back as a JSON-RPC error/refusal, not an empty success.*
+
+**wall time: 4.26s**
+
+`````
+{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-11-25","serverInfo":{"name":"ripwire","version":"1.0"},"capabilities":{"tools":{},"resources":{}},"instructions":"Map before reading files. Start a new task with explore; use from_trace for an error; use impact plus uses before changing a sym … [line truncated: 738 more bytes on this line]
+{"jsonrpc":"2.0","id":2,"error":{"code":-32602,"message":"symbol not found: 'DoesNotExist' — pass the final name segment; add scope to disambiguate — or @FILE:LINE when you hold a location","data":{"answer":"{\"of\":\"DoesNotExist\",\"found\":0}"}}}
+`````
+
+## `printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize"}' '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"batch","arguments":{"path":".","queries":[{"verb":"for","task":"incremental cache invalidation"},{"verb":"find_referencing_symbols","symbol":"rankGraphTeleport"},{"verb":"grep","pattern":"DISCLOSE","limit":2}]}}}' | ./build/ripwire --mcp`
+
+*MCP `batch`: three independent read queries answered in ONE round-trip — NOTE the sub-query grammar is {verb, ...args} objects with MCP verb names, not the CLI --batch file's verb:arg lines.*
+
+**wall time: 3.39s**
+
+`````
+{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-11-25","serverInfo":{"name":"ripwire","version":"1.0"},"capabilities":{"tools":{},"resources":{}},"instructions":"Map before reading files. Start a new task with explore; use from_trace for an error; use impact plus uses before changing a sym … [line truncated: 738 more bytes on this line]
+{"jsonrpc":"2.0","id":2,"result":{"content":[{"type":"text","text":"<batch schema=\"ripwire.batch/v1\" n=\"3\" requested=\"3\" cap=\"16\"><!-- ripwire batch schema=ripwire.batch/v1: n= read sub-queries in one sweep (requested=, cap=): each <q> wraps one sub-answer verbatim in CDATA. i=/verb=/ok=: su … [line truncated: 19403 more bytes on this line]
+{\"name\":\"rankGraph\",\"kind\":\"fn\",\"file\":\"src/graph.h\",\"line\":11850,\"handle\":\"sym#b90da690b120eeb3@2d70514834240030\",\"sites_at\":[\"src/graph.h:11853\"]},
+{\"name\":\"anchoredLexicalRank\",\"kind\":\"fn\",\"file\":\"src/graph.h\",\"line\":12496,\"handle\":\"sym#b3a5ca7873636567@2d70514834240030\",\"sites_at\":[\"src/graph.h:12547\"]},
+{\"name\":\"runEval\",\"kind\":\"fn\",\"file\":\"src/eval.h\",\"line\":171,\"handle\":\"sym#358fe2cb69804698@1f9d26ff6c500240\",\"sites_at\":[\"src/eval.h:328\"]},
+{\"name\":\"churnDecayRanking\",\"kind\":\"fn\",\"file\":\"src/main.cpp\",\"line\":1425,\"handle\":\"sym#f43b7580f05a651a@90c022c977317008\",\"sites_at\":[\"src/main.cpp:1439\"]},
+{\"name\":\"churnRankedGraph\",\"kind\":\"fn\",\"file\":\"src/main.cpp\",\"line\":1464,\"handle\":\"sym#4b5b63d3932ca0ff@90c022c977317008\",\"sites_at\":[\"src/main.cpp:1478\",\"src/main.cpp:1479\",\"src/main.cpp:1493\"]},
+{\"name\":\"runDefaultMap\",\"kind\":\"fn\",\"file\":\"src/main.cpp\",\"line\":1751,\"handle\":\"sym#6e2725cb96590ec8@90c022c977317008\",\"sites_at\":[\"src/main.cpp:1871\"]}],\"sites_note\":\"sites_at= on a caller row: its calls of the called LEAF name, any receiver or qualifier, as file:line token … [line truncated: 1241 more bytes on this line]
+{\"file\":\"src/abicheck.h\",\"line\":494,\"in\":\"abicheck::collectAuthoredSites\",\"parse_degraded\":true,\"text\":\"            DISCLOSE( result, AbiResult::DisclosureWhy::NoMergeBase, \\\"abi: no merge-base for a ref (unrelated history?) — that ref is counted, not compared\\\" );\"}],\"parse_d … [line truncated: 540 more bytes on this line]
+{\"file\":\"CMakeLists.txt\",\"line\":346}]},\"enclosing\":[{\"n\":\"path_instructions\",\"callers\":0,\"handle_omitted\":\"non-code\"},
+{\"n\":\"abicheck::collectAuthoredSites\",\"callers\":1,\"cx\":9,\"handle\":\"sym#1ab32951dcc2d860@b046719c64b5631a\"}]}]]></q></batch>"}],
+"_index":"[index: files=3631 symbols=31860 hash=2da1730f]","_fresh":"ok"}}
+`````
+
+## `printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize"}' '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"batch","arguments":{"path":".","queries":["for:incremental cache invalidation","callers:rankGraphTeleport"]}}}' | ./build/ripwire --mcp`
+
+*The CLI --batch spelling handed to MCP `batch`: refused, with the accepted shape named.*
+
+**wall time: 3.69s**
+
+`````
+{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-11-25","serverInfo":{"name":"ripwire","version":"1.0"},"capabilities":{"tools":{},"resources":{}},"instructions":"Map before reading files. Start a new task with explore; use from_trace for an error; use impact plus uses before changing a sym … [line truncated: 738 more bytes on this line]
+{"jsonrpc":"2.0","id":2,"result":{"content":[{"type":"text","text":"<batch schema=\"ripwire.batch/v1\" n=\"2\" requested=\"2\" cap=\"16\"><!-- ripwire batch schema=ripwire.batch/v1: n= read sub-queries in one sweep (requested=, cap=): each <q> wraps one sub-answer verbatim in CDATA. i=/verb=/ok=: su … [line truncated: 19386 more bytes on this line]
+{\"name\":\"rankGraph\",\"kind\":\"fn\",\"file\":\"src/graph.h\",\"line\":11850,\"handle\":\"sym#b90da690b120eeb3@2d70514834240030\",\"sites_at\":[\"src/graph.h:11853\"]},
+{\"name\":\"anchoredLexicalRank\",\"kind\":\"fn\",\"file\":\"src/graph.h\",\"line\":12496,\"handle\":\"sym#b3a5ca7873636567@2d70514834240030\",\"sites_at\":[\"src/graph.h:12547\"]},
+{\"name\":\"runEval\",\"kind\":\"fn\",\"file\":\"src/eval.h\",\"line\":171,\"handle\":\"sym#358fe2cb69804698@1f9d26ff6c500240\",\"sites_at\":[\"src/eval.h:328\"]},
+{\"name\":\"churnDecayRanking\",\"kind\":\"fn\",\"file\":\"src/main.cpp\",\"line\":1425,\"handle\":\"sym#f43b7580f05a651a@90c022c977317008\",\"sites_at\":[\"src/main.cpp:1439\"]},
+{\"name\":\"churnRankedGraph\",\"kind\":\"fn\",\"file\":\"src/main.cpp\",\"line\":1464,\"handle\":\"sym#4b5b63d3932ca0ff@90c022c977317008\",\"sites_at\":[\"src/main.cpp:1478\",\"src/main.cpp:1479\",\"src/main.cpp:1493\"]},
+{\"name\":\"runDefaultMap\",\"kind\":\"fn\",\"file\":\"src/main.cpp\",\"line\":1751,\"handle\":\"sym#6e2725cb96590ec8@90c022c977317008\",\"sites_at\":[\"src/main.cpp:1871\"]}],\"sites_note\":\"sites_at= on a caller row: its calls of the called LEAF name, any receiver or qualifier, as file:line token … [line truncated: 370 more bytes on this line]
+"_index":"[index: files=3631 symbols=31860 hash=2da1730f]","_fresh":"ok"}}
+`````
+
+## `printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize"}' '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"edit_check","arguments":{"path":".","symbol":"rankGraphTeleport"}}}' | ./build/ripwire --mcp`
+
+*MCP `edit_check` on a CLEAN tree.*
+
+**wall time: 10.83s**
+
+`````
+{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-11-25","serverInfo":{"name":"ripwire","version":"1.0"},"capabilities":{"tools":{},"resources":{}},"instructions":"Map before reading files. Start a new task with explore; use from_trace for an error; use impact plus uses before changing a sym … [line truncated: 738 more bytes on this line]
+{"jsonrpc":"2.0","id":2,"result":{"content":[{"type":"text","text":"<!-- ripwire edit-check schema=ripwire.edit-check/v1: sym='s contract NOW vs HEAD: status=unchanged|new-symbol|contract-change; <c n= p= incompatible=1 sites_l=> callers. counts_floor=1: every count is a FLOOR, never a total. graph_ … [line truncated: 1170 more bytes on this line]
+"_index":"[index: files=3631 symbols=31860 hash=2da1730f]","_fresh":"ok"}}
+`````
+
+## `printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize"}' '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"edit_check","arguments":{"path":".","symbol":"rankGraphTeleport","legend":"compact"}}}' | ./build/ripwire --mcp`
+
+*The same MCP `edit_check` with legend:"compact" — the CLI --legend=compact dialect on the MCP side (declared on the 16 XML verbs): ~5.5 KB of legend down to ~600 B, rows identical; an unknown or empty legend value is refused, never read as the default.*
+
+**wall time: 10.49s**
+
+`````
+{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-11-25","serverInfo":{"name":"ripwire","version":"1.0"},"capabilities":{"tools":{},"resources":{}},"instructions":"Map before reading files. Start a new task with explore; use from_trace for an error; use impact plus uses before changing a sym … [line truncated: 738 more bytes on this line]
+{"jsonrpc":"2.0","id":2,"result":{"content":[{"type":"text","text":"<!-- ripwire edit-check schema=ripwire.edit-check/v1: sym='s contract NOW vs HEAD: status=unchanged|new-symbol|contract-change; <c n= p= incompatible=1 sites_l=> callers. counts_floor=1: every count is a FLOOR, never a total. graph_ … [line truncated: 1170 more bytes on this line]
+"_index":"[index: files=3631 symbols=31860 hash=2da1730f]","_fresh":"ok"}}
+`````
+
+## `printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize"}' '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"nosuchverb","arguments":{"path":"."}}}' | ./build/ripwire --mcp`
+
+*An unknown verb name — the JSON-RPC error shape.*
+
+`````
+{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-11-25","serverInfo":{"name":"ripwire","version":"1.0"},"capabilities":{"tools":{},"resources":{}},"instructions":"Map before reading files. Start a new task with explore; use from_trace for an error; use impact plus uses before changing a sym … [line truncated: 738 more bytes on this line]
+{"jsonrpc":"2.0","id":2,"error":{"code":-32602,"message":"unknown tool: 'nosuchverb' — call tools/list for the 33 available tools"}}
+`````
diff --git a/docs/docs_commands_build.py b/docs/docs_commands_build.py
index bd8f9decb..e9c05324f 100644
--- a/docs/docs_commands_build.py
+++ b/docs/docs_commands_build.py
@@ -79,6 +79,26 @@ def is_address( match ):
     return match.group( 1 ).lower() not in FILE_EXT_NOT_TLD
 
 
+def scrub_root( text, root, repl ):
+    """Replace `root` with `repl` only where it is a WHOLE path: not preceded by a path character and not
+    followed by one (a trailing '.' counts as punctuation unless a name continues after it). A plain
+    str.replace turned `src/wrap` into `src.rap` for a checkout at `/w` (#438 review); `root + "/"` still
+    becomes `repl + "/"`. test/showcasecapturecheck.sh arm (S) pins the bytes."""
+    root = root.rstrip( '/' )
+    if not root:
+        return text
+    pat = re.compile( r'(?<![\w./-])' + re.escape( root ) + r'(?![\w-]|\.[\w-])' )
+    return pat.sub( lambda _m: repl, text )
+
+
+def scratch_outside_repo( repo, scratch ):
+    """True when `scratch` is not `repo` and not inside it. A scratch dir inside the repo would be
+    scrubbed as a repo path (`./build/sc/aux/…`) instead of `<scratch>`."""
+    r = os.path.realpath( repo )
+    s = os.path.realpath( scratch )
+    return s != r and not s.startswith( r + os.sep )
+
+
 def scrub_emails( text ):
     return EMAIL.sub( lambda m: '<author>' if is_address( m ) else m.group( 0 ), text )
 
diff --git a/src/externalnames.h b/src/externalnames.h
index 7c3657365..bc4181383 100644
--- a/src/externalnames.h
+++ b/src/externalnames.h
@@ -375,6 +375,19 @@ inline constexpr std::string_view kRustStdMemberNames[] = {
     "to_uppercase", "to_vec", "trim", "unwrap", "unwrap_or", "unwrap_or_default", "unwrap_or_else", "values"
 };
 
+// ── THE KOTLIN SCOPE-FUNCTION TABLE (graph.h FalseEdgeRules, the Kotlin arm; gate test/kotlincheck.sh §15 and test/falseedgecheck.sh
+// arm J). A Kotlin call with a TRAILING lambda to one of these names is the stdlib scope function, never a Java method of the same
+// name: `s.run { }`, `with( sb ) { }`, `s?.let { }`, `xs.also { }`. The fact is the call's trailing lambda (ingest_metrics.h
+// kotlinTrailingLambda); the name alone is never a veto — `block.run()` on a Runnable has no lambda and keeps its edge.
+// PROVENANCE: the five functions the Kotlin documentation names as scope functions — "There are five of them: let, run, with,
+// apply, and also" (https://kotlinlang.org/docs/scope-functions.html, read 2026-10-24) — each an inline function of kotlin-stdlib
+// 2.4.0 (https://repo1.maven.org/maven2/org/jetbrains/kotlin/kotlin-stdlib/2.4.0/kotlin-stdlib-2.4.0.jar), class
+// kotlin.StandardKt__StandardKt. Regenerated and diffed by ONE command, which prints exactly these five names:
+//     javap -p -cp kotlin-stdlib-2.4.0.jar kotlin.StandardKt__StandardKt | sed -n 's/.* \([a-z][A-Za-z]*\)(.*/\1/p' | grep -xE 'let|run|with|apply|also' | LC_ALL=C sort -u
+// takeIf, takeUnless, repeat and use stay OUT: the documentation does not call them scope functions, and no corpus evidence joined them.
+// 5 names; sorted by byte (isStrictlySortedTable below).
+inline constexpr std::string_view kKotlinScopeFunctionNames[] = { "also", "apply", "let", "run", "with" };
+
 // The standard templates whose `->` reaches their FIRST template argument, so a `->` call through a declaration written
 // `std::unique_ptr<ns::List>` / `std::shared_ptr<…>` / `std::optional<…>` may be a member of that argument (graph.h
 // StdMemberGate::stdArrowPointee reads the declaration's recorded text). std::weak_ptr and std::reference_wrapper have no
@@ -406,6 +419,16 @@ static_assert( isStrictlySortedTable( kRustStdMemberNames ), "kRustStdMemberName
 static_assert( isStrictlySortedTable( kCppStdArrowTemplates ), "kCppStdArrowTemplates must be strictly sorted (binary search)" );
 static_assert( isStrictlySortedTable( kCppStdElementFirstArg ), "kCppStdElementFirstArg must be strictly sorted (binary search)" );
 static_assert( isStrictlySortedTable( kCppStdElementSecondArg ), "kCppStdElementSecondArg must be strictly sorted (binary search)" );
+static_assert( isStrictlySortedTable( kKotlinScopeFunctionNames ), "kKotlinScopeFunctionNames must be strictly sorted (binary search)" );
+// #155: the lookup of a strictly sorted table (isStrictlySortedTable), taken as a span so a new table reuses it.
+inline bool inSortedTable( std::span<const std::string_view> table, std::string_view name ) noexcept
+{
+    return std::binary_search( table.begin(), table.end(), name, rw::sortutil::svLess );
+}
+inline bool isKotlinScopeFunction( std::string_view name ) noexcept
+{
+    return inSortedTable( kKotlinScopeFunctionNames, name );
+}
 
 // Which template argument an element access of the standard container `name` ("map", "vector") yields: 0 or 1, or -1 when `name`
 // is no container of kCppStdElementFirstArg / kCppStdElementSecondArg.
diff --git a/src/graph.h b/src/graph.h
index 58fcb880c..418aeab7b 100644
--- a/src/graph.h
+++ b/src/graph.h
@@ -5668,8 +5668,17 @@ struct DispositionTally
 // external= with proof (one `C external` census row) or unresolved= without, and every other call keeps the unchanged ladder.
 // CLASS-BODY KEEP. A function of the class whose BODY is the caller survives rule (1): Python evaluates a class body as a
 // scope, so `DEFAULTS = _default()` there reaches the `_default` defined above it.
-// STATED FLOORS (named in test/falseedgecheck.sh's header): implicit-receiver languages (Java, C#, C++, Kotlin, Swift,
-// Ruby, ObjC) are untouched — a bare call there reaches the enclosing class's methods; PHP, Lua and Zig have no arm; a
+// (4) KOTLIN SCOPE FUNCTIONS (#155; test/kotlincheck.sh §15, test/falseedgecheck.sh arm J). A Kotlin call with a TRAILING lambda to
+//     let/run/with/apply/also (externalnames.h kKotlinScopeFunctionNames) is the stdlib inline function. Java and other JVM
+//     candidates of that name drop; Kotlin candidates keep; an emptied set is external=. A receiver rule that already picked a Kotlin
+//     member (`t.run { }` on a `t: Task` whose class defines run) keeps its proof; a pick holding a Java method is undone, so
+//     `s.run { }` (which carries a receiver) is decided here. One fact: Reference::trailingLambda (ingest_metrics.h kotlinTrailingLambda).
+// STATED FLOORS (named in test/falseedgecheck.sh's header): implicit-receiver languages (Java, C#, C++, Swift, Ruby, ObjC) are
+// untouched — a bare call there reaches the enclosing class's methods. Kotlin's scope arm (4) keys on the spelling and the
+// trailing lambda ALONE: no receiver typing beyond the Kotlin pick above (a receiver of a Java type is not checked), no SAM conversion, qualified `kotlin.run { }` can still bind an in-tree Kotlin `run` (hedged),
+// a parenthesised lambda (`s.let( { } )`, `with( x, { } )`) is NOT trailing and keeps the ladder, and a Java method of
+// that name called from Kotlin WITH a trailing lambda is dropped (the same spelling is indistinguishable here).
+// PHP, Lua and Zig have no arm; a
 // Go package whose name differs from its path's last element is not recognised as an import (its calls keep the
 // ladder); a JS `require` inside a function body and browser-only globals are not modelled; a JS script's top-level
 // function reached from another script by a bare global-table name would read as external.
@@ -5999,6 +6008,32 @@ struct FalseEdgeRules
         }
         return ( !lookup( r.fileId, r.calleeName, bound ) && externalnames::isJsGlobalName( r.calleeName ) ) ? Verdict::External : Verdict::Keep;
     }
+    // #155 KOTLIN SCOPE FUNCTIONS (test/kotlincheck.sh §15, test/falseedgecheck.sh arm J): a Kotlin call with a trailing lambda to
+    // let/run/with/apply/also IS the stdlib inline function. A Java (or other JVM-compatible) candidate of that name is a method
+    // the call cannot reach: dropped. Kotlin candidates are kept and narrowed. An emptied set is External with that proof (the name
+    // is the stdlib scope function, externalnames.h). Nothing dropped → Keep: the ladder decides exactly as before.
+    Verdict kotlinScopeDecide( const Reference& r, std::span<const NodeId> ids, rw::SmallVec<NodeId, 2>& kept ) const
+    {
+        kept.clear();
+        bool dropped = false;
+        for( NodeId c : ids )
+        {
+            const Symbol& s = ing.symbols[ c ];
+            if( langCompatible( s.lang, r.lang ) && !langFacts( s.lang ).trailingLambdaScopeFns )
+            {
+                dropped = true;
+                continue;
+            }
+            kept.push_back( c );
+        }
+        if( !dropped )
+        {
+            kept.clear();
+            return Verdict::Keep;
+        }
+        const bool anyKotlin = std::any_of( kept.begin(), kept.end(), [ & ]( NodeId c ) { return langFacts( ing.symbols[ c ].lang ).trailingLambdaScopeFns; } );
+        return anyKotlin ? Verdict::Narrow : Verdict::External;
+    }
     bool aliasIsForeign( const Alias& a, const Reference& r ) const
     {
         if( a.fromIdentifier )   // `const { x } = G`: foreign iff G is a global object no binding in the file hides
@@ -6012,6 +6047,10 @@ struct FalseEdgeRules
     Verdict decide( const Reference& r, std::span<const NodeId> ids, rw::SmallVec<NodeId, 2>& kept ) const
     {
         kept.clear();
+        if( active && langFacts( r.lang ).trailingLambdaScopeFns && r.role == RefRole::Call && r.trailingLambda && externalnames::isKotlinScopeFunction( r.calleeName ) )
+        {
+            return kotlinScopeDecide( r, ids, kept );   // #155: ahead of the receiver gate — `s.run { }` carries a receiver
+        }
         if( !active || r.role != RefRole::Call || !r.qualifier.empty() || r.fromSymbol >= ing.symbols.size() || r.recv != RecvKind::None )
         {
             return Verdict::Keep;
@@ -10189,9 +10228,29 @@ inline Graph buildGraph( const IngestResult& ing, const ScipOverlay* scip = null
         // nested namesakes dropped, an inherited body, an interface's dispatch split); otherwise narrowed stays false and the name-based fallback
         // runs. Skipped when the call was already pinned canonically or by Rule 1 (the more specific / already-resolved signals).
         const bool narrowedBeforeReceiverRules = narrowed;
+        // #155: a Kotlin trailing-lambda scope call is the stdlib function unless its receiver's type proves a Kotlin member; FE-A decides the rest.
+        const bool kotlinScopeCall = langFacts( r.lang ).trailingLambdaScopeFns && r.role == RefRole::Call && r.trailingLambda
+                                     && externalnames::isKotlinScopeFunction( r.calleeName );
+        // #155: a receiver rule still decides such a call when every candidate it picks is a Kotlin definition (`t.run { }` on a
+        // `t: Task` whose class defines run, beside another class's run); a pick holding a Java (non-Kotlin) method is undone, and
+        // FE-A below decides the call (kotlincheck §15 tree f).
+        const auto kotlinScopeUndo = [ & ]() noexcept -> bool
+        {
+            if( !kotlinScopeCall
+                || std::all_of( cand.begin(), cand.end(), [ & ]( NodeId c ) noexcept { return langFacts( ing.symbols[ c ].lang ).trailingLambdaScopeFns; } ) )
+            {
+                return false;
+            }
+            cand.clear();
+            return true;
+        };
         if( !scipPinned && !canonical && !narrowed && writtenRoot != JsWrittenRoot::Pinned )
         {
             narrowed = narrowTo( narrower.rule2RecvVarType( r, classIds, chaUp ), r, cand ) || narrower.forgetClaim();
+            if( narrowed && kotlinScopeUndo() )
+            {
+                narrowed = narrower.forgetClaim();
+            }
         }
         // P2-D Rule 2c (CLASS-NAME receiver, Phase 4b): `Cls.m()` resolves to `Cls::m` (or the shallowest base defining `m`) when Cls is an in-repo class that no
         // local and no C++ member of the caller's class or its bases hides (then 2b reads the member). After Rule 2, before 2b. See Narrower::rule2cClassNameRecv.
@@ -10230,7 +10289,7 @@ inline Graph buildGraph( const IngestResult& ing, const ScipOverlay* scip = null
                     cand.push_back( c );
                 }
             }
-            narrowed = !cand.empty();
+            narrowed = !cand.empty() && !kotlinScopeUndo();
         }
         // lane L6 (ifacedispatch.h): the receiver's recorded type is an interface, a trait or a class declaring the callee with
         // no body — C++ through class identity's dispatch split (Rule 2 on a local or parameter, Rule 2b's field), every other
diff --git a/src/ingest_cache.h b/src/ingest_cache.h
index 6c2b744c1..e9339652c 100644
--- a/src/ingest_cache.h
+++ b/src/ingest_cache.h
@@ -91,6 +91,7 @@ struct RawRef
     std::string   memberVia;           // FE-B on #373: the method a Ruby typed receiver was built by (`new`, a finder); see model.h
     bool          memberFactory = false;   // FE-B on #373: memberCtor names a FactoryBot factory, not a class
     bool          forwarded = false;       // lane fcall-forward fix 1: a JS/TS `f.call/f.apply` site standing for `f( … )` (model.h Reference::forwarded)
+    bool          trailingLambda = false;  // #155: a Kotlin call whose lambda is written after its argument list (model.h Reference::trailingLambda)
     std::uint32_t baseBind = 0;          // lane lego-transitive fix 1, an inherit ref only: 1 + the name byte of the same-file
                                          //   declaration the base binds to (ingest_relations.h localBaseBinding); 0 none, ~0u unknown
 };
@@ -144,7 +145,11 @@ constexpr std::uint32_t kCacheMagic   = 0x4b505443;   // "CTPK"
 //   all match) rather than silently re-absolutizing a key that was never root-relative to begin
 //   with — a v2 cache simply misses on every lookup that survives the guard, which is exactly the
 //   self-healing full-reparse path already used for any other corrupt/stale cache.
-constexpr std::uint32_t kCacheVersion = 40;           // 40: train 34 — strictly above main 39 and every live value (train-33 refs, #432 39; #427 / #429 38): the
+// 43 (train 36, #155 Kotlin scope functions; the PR's placeholder was 41): the `trailingLambda` u8 in writeRef/readRef changes
+// the on-disk ref record, so an older cache must be rejected. 43 sits above every live value: main / train 35 40, #438's 41,
+// lane rust-degraded's placeholder 42.
+constexpr std::uint32_t kCacheVersion = 43;           // 43: train 36 — #155 Kotlin trailingLambda ref byte (above 40 / 41 / 42)
+                                                      // 40: train 34 — strictly above main 39 and every live value (train-33 refs, #432 39; #427 / #429 38): the
                                                       //    fc3-js-rebind record change (LocalBindKind JsRebind, appended) lands; no other train-34 lane changed a format.
                                                       // 39: train 33 — strictly above main 36 and every live value (lane l6-iface 38, #427 / #429 38): the
                                                       //    l6-iface record change (LocalBindKind DispatchType + ImplBlock, appended) lands; no other train-33 lane changed a format.
@@ -353,7 +358,10 @@ constexpr std::uint32_t kCacheVersion = 40;           // 40: train 34 — strict
                                                       //    (Py `pkg.mod`, TS `./x`, Rust `crate::a::b`/`mod:x`) —
                                                       //    a target FORMAT change → old caches must be rejected.
                                                       // 4: Include gained a `bool isAngle` (quote/angle) field
-constexpr std::uint32_t kParserVer    = 226;          // bump on any grammar/.scm/extraction change
+constexpr std::uint32_t kParserVer    = 231;          // bump on any grammar/.scm/extraction change
+                                                      // 231 = 2026-10-25 (train 36: #438 Kotlin trailing-lambda capture, #437, #431): strictly above every
+                                                      //   live number — main / train 35 226 (rich 227), #438's placeholder 228, lane rust-degraded's placeholder
+                                                      //   229 (rich 230). Rich file tag 232. kCacheVersion 43 moves with it (#438's trailingLambda ref byte).
                                                       // 226 = 2026-10-24 (train 34: lean2b, fc2-lego-extparent, honest-lex, ind4b-k5-tighten-k5c, hop1, fc3-js-rebind):
                                                       //   strictly above every live number — main 224 (rich 225), #432 224, lane ind4b's placeholder 224 (it collided with
                                                       //   main's), lane ind5-glob-imports 222 (223, reserved), lane fc3-js-rebind 218, #426 216, #420 214. Rich file tag 227.
@@ -2340,6 +2348,13 @@ struct ByteR
         const std::uint8_t v = u8();
         return fitsBelow( v, enumCount ) ? E( v ) : E{};
     }
+    // A FLAG byte: the writer stores a bool as exactly 0 or 1, so any other value is corruption, same as an enum byte past its
+    // count. `u8() != 0` read a 2 as true; a doctored trailingLambda byte then dropped the Java candidates of a Kotlin call that
+    // has no trailing lambda (CodeRabbit on PR #441; test/cachefuzzcheck.sh Part 3, flag arms). Same refusal path as fitsBelow.
+    bool flagU8()
+    {
+        return enumU8<std::uint8_t>( 2 ) != 0;
+    }
     // A 16-bit field the writer stores in a u32 slot (writeDef's ppAlt/humps/deepLoc/ev/params, writeRef's argCount).
     // The writer only ever holds a uint16_t there; a plain `std::uint16_t( u32() )` kept the low bits of a wider value
     // and believed them (test/hazardpatterncheck.sh rule D, test/cachefuzzcheck.sh Part 3).
@@ -2452,7 +2467,7 @@ inline void writeDef( ByteW& w, const RawDef& d, bool withLex, std::size_t fileD
         }
     }
 }
-inline void   writeRef( ByteW& w, const RawRef& r ) { w.u32( r.startByte ); w.u8( std::uint8_t( r.lang ) ); w.str( r.name ); w.u8( r.isInherit ? 1 : 0 ); w.u8( r.isDocLink ? 1 : 0 ); w.str( r.qualifier ); w.u8( std::uint8_t( r.recv ) ); w.str( r.recvVar ); w.u8( r.isCompose ? 1 : 0 ); w.str( r.fieldName ); w.str( r.composeRel ); w.u8( std::uint8_t( r.role ) ); w.u32( r.line ); w.u32( r.argCount ); w.u8( r.argCountKnown ? 1 : 0 ); w.u8( r.viaArrow ? 1 : 0 ); w.u8( r.qualifierRootsStd ? 1 : 0 ); w.u8( r.memberCall ? 1 : 0 ); w.str( r.memberRoot ); w.str( r.memberPath ); w.str( r.memberCtor ); w.str( r.memberVia ); w.u8( r.memberFactory ? 1 : 0 ); w.u8( r.forwarded ? 1 : 0 ); if( r.isInherit ) { w.u32( r.baseBind ); } }
+inline void   writeRef( ByteW& w, const RawRef& r ) { w.u32( r.startByte ); w.u8( std::uint8_t( r.lang ) ); w.str( r.name ); w.u8( r.isInherit ? 1 : 0 ); w.u8( r.isDocLink ? 1 : 0 ); w.str( r.qualifier ); w.u8( std::uint8_t( r.recv ) ); w.str( r.recvVar ); w.u8( r.isCompose ? 1 : 0 ); w.str( r.fieldName ); w.str( r.composeRel ); w.u8( std::uint8_t( r.role ) ); w.u32( r.line ); w.u32( r.argCount ); w.u8( r.argCountKnown ? 1 : 0 ); w.u8( r.viaArrow ? 1 : 0 ); w.u8( r.qualifierRootsStd ? 1 : 0 ); w.u8( r.memberCall ? 1 : 0 ); w.str( r.memberRoot ); w.str( r.memberPath ); w.str( r.memberCtor ); w.str( r.memberVia ); w.u8( r.memberFactory ? 1 : 0 ); w.u8( r.forwarded ? 1 : 0 ); w.u8( r.trailingLambda ? 1 : 0 ); if( r.isInherit ) { w.u32( r.baseBind ); } }
 
 // loadCache's countFits() bounds a corrupt on-disk record COUNT against remaining bytes /
 // minRecordBytes BEFORE reserve() — the guard that keeps a hostile blob's 0xFFFFFFFF count from reaching
@@ -2473,13 +2488,13 @@ inline void   writeRef( ByteW& w, const RawRef& r ) { w.u32( r.startByte ); w.u8
 // `qualifierRootsStd` u8 then added a 9th u8 — 40 -> 41, kCacheVersion 25; FE-A's `memberCall` u8 and `memberRoot`
 // str then added a 10th u8 and a 6th str — 41 -> 46, kCacheVersion 28; FE-B's `memberPath` and `memberCtor` strs then
 // added a 7th and 8th str — 46 -> 54, kCacheVersion 29; fcall-forward fix 1's `forwarded` u8 then added a 12th u8 —
-// 59 -> 60, kCacheVersion 33).
+// 59 -> 60, kCacheVersion 33; #155's `trailingLambda` u8 then added a 13th u8 — 60 -> 61, kCacheVersion 41).
 // verifyCacheRecordMinimaTripwire() below derives these
 // same numbers from the REAL writer functions at runtime so the next field added to writeDef/writeRef
 // can't silently stale them.
 inline constexpr std::size_t kMinDefRecordBytesLean      = 92;   // 17×u32 + 16×u8 + 2×str(len u32, empty) (paramsMin u32: 88 -> 92, kCacheVersion 33)
 inline constexpr std::size_t kMinDefRecordBytesRichExtra =  9;   // v10 rich withLex extra: dlWeighted u32 + tokenCount u32 + tfWidth u8
-inline constexpr std::size_t kMinRefRecordBytes          = 60;   // 3×u32 + 12×u8 + 9×str(len u32, empty)
+inline constexpr std::size_t kMinRefRecordBytes          = 61;   // 3×u32 + 13×u8 + 9×str(len u32, empty)
 
 inline std::size_t minDefRecordBytes( bool captureValueUses ) noexcept
 {
@@ -2596,11 +2611,11 @@ inline RawDef readDef( ByteR& r, bool withLex, const std::vector<std::uint64_t>&
     }
     return d;
 }
-inline RawRef readRef ( ByteR& r ) { RawRef x; x.startByte = r.u32(); x.lang = r.enumU8<Lang>( kLangCount ); x.name = r.str(); x.isInherit = r.u8() != 0; x.isDocLink = r.u8() != 0; x.qualifier = r.str(); x.recv = r.enumU8<RecvKind>( kRecvKindCount ); x.recvVar = r.str(); x.isCompose = r.u8() != 0; x.fieldName = r.str(); x.composeRel = r.str(); x.role = r.enumU8<RefRole>( kRefRoleCount ); x.line = r.u32(); x.argCount = r.u16Of32(); x.argCountKnown = r.u8() != 0; x.viaArrow = r.u8() != 0; x.qualifierRootsStd = r.u8() != 0; x.memberCall = r.u8() != 0; x.memberRoot = r.str(); x.memberPath = r.str(); x.memberCtor = r.str(); x.memberVia = r.str(); x.memberFactory = r.u8() != 0; x.forwarded = r.u8() != 0; if( x.isInherit ) { x.baseBind = r.u32(); } return x; }
+inline RawRef readRef ( ByteR& r ) { RawRef x; x.startByte = r.u32(); x.lang = r.enumU8<Lang>( kLangCount ); x.name = r.str(); x.isInherit = r.flagU8(); x.isDocLink = r.flagU8(); x.qualifier = r.str(); x.recv = r.enumU8<RecvKind>( kRecvKindCount ); x.recvVar = r.str(); x.isCompose = r.flagU8(); x.fieldName = r.str(); x.composeRel = r.str(); x.role = r.enumU8<RefRole>( kRefRoleCount ); x.line = r.u32(); x.argCount = r.u16Of32(); x.argCountKnown = r.flagU8(); x.viaArrow = r.flagU8(); x.qualifierRootsStd = r.flagU8(); x.memberCall = r.flagU8(); x.memberRoot = r.str(); x.memberPath = r.str(); x.memberCtor = r.str(); x.memberVia = r.str(); x.memberFactory = r.flagU8(); x.forwarded = r.flagU8(); x.trailingLambda = r.flagU8(); if( x.isInherit ) { x.baseBind = r.u32(); } return x; }
 inline void   writeBind( ByteW& w, const RawBind& b ) { w.u32( b.startByte ); w.u8( std::uint8_t( b.lang ) ); w.u8( std::uint8_t( b.kind ) ); w.u8( b.isFromAssignment ? 1 : 0 ); w.u8( b.resultIndex ); w.u8( b.unwrapDepth ); w.u32( b.spanStart ); w.u32( b.spanEnd ); w.str( b.var ); w.str( b.typeName ); w.str( b.importedName ); }
-inline RawBind readBind( ByteR& r ) { RawBind b; b.startByte = r.u32(); b.lang = r.enumU8<Lang>( kLangCount ); b.kind = r.enumU8<LocalBindKind>( kLocalBindKindCount ); b.isFromAssignment = r.u8() != 0; b.resultIndex = r.u8(); b.unwrapDepth = r.u8(); b.spanStart = r.u32(); b.spanEnd = r.u32(); b.var = r.str(); b.typeName = r.str(); b.importedName = r.str(); return b; }
+inline RawBind readBind( ByteR& r ) { RawBind b; b.startByte = r.u32(); b.lang = r.enumU8<Lang>( kLangCount ); b.kind = r.enumU8<LocalBindKind>( kLocalBindKindCount ); b.isFromAssignment = r.flagU8(); b.resultIndex = r.u8(); b.unwrapDepth = r.u8(); b.spanStart = r.u32(); b.spanEnd = r.u32(); b.var = r.str(); b.typeName = r.str(); b.importedName = r.str(); return b; }
 inline void   writeFfi( ByteW& w, const BindingAlias& a ) { w.u8( std::uint8_t( a.kind ) ); w.u8( a.lowConf ? 1 : 0 ); w.str( a.aliasName ); w.str( a.targetName ); w.str( a.targetScope ); }
-inline BindingAlias readFfi( ByteR& r ) { BindingAlias a; a.kind = r.enumU8<BindKind>( kBindKindCount ); a.lowConf = r.u8() != 0; a.aliasName = r.str(); a.targetName = r.str(); a.targetScope = r.str(); return a; }
+inline BindingAlias readFfi( ByteR& r ) { BindingAlias a; a.kind = r.enumU8<BindKind>( kBindKindCount ); a.lowConf = r.flagU8(); a.aliasName = r.str(); a.targetName = r.str(); a.targetScope = r.str(); return a; }
 // B6.3: RouteDef needs no startByte (its handler is resolved by NAME in buildGraph); RawRouteUse mirrors
 // RawBind (startByte for the enclosing-def byte-span attribution done in the ingest() model-build below).
 inline void   writeRouteDef( ByteW& w, const RouteDef& d ) { w.u32( d.line ); w.u8( std::uint8_t( d.method ) ); w.str( d.path ); w.str( d.handlerName ); }
@@ -2732,11 +2747,11 @@ inline bool readFileRecord( ByteR& r, bool captureValueUses, std::vector<std::ui
     ffOut.incs.reserve( ni );
     for( std::uint32_t j = 0; j < ni && r.ok; ++j )
     {
-        const bool          isAngle    = r.u8() != 0;
-        const bool          isLazy     = r.u8() != 0;   // kParserVer 72: TS/JS function-body require/import marker; parser version 82: Ruby autoload
-        const bool          isSymbolic = r.u8() != 0;   // parser version 82: a Ruby constant target, resolved by index, never by path
+        const bool          isAngle    = r.flagU8();
+        const bool          isLazy     = r.flagU8();   // kParserVer 72: TS/JS function-body require/import marker; parser version 82: Ruby autoload
+        const bool          isSymbolic = r.flagU8();   // parser version 82: a Ruby constant target, resolved by index, never by path
         const std::uint32_t byte       = r.u32();       // parser version 82: the directive's start byte (lexical nesting recovery)
-        const bool          isValueUse = r.u8() != 0;   // parser version 93 / format 21: argument or rescue origin — not narrow evidence
+        const bool          isValueUse = r.flagU8();   // parser version 93 / format 21: argument or rescue origin — not narrow evidence
         ffOut.incs.push_back( Include { 0, isAngle, isLazy, isSymbolic, byte, isValueUse, r.str() } );
     }
     const std::uint32_t nb = r.u32();
@@ -2790,7 +2805,7 @@ inline bool readFileRecord( ByteR& r, bool captureValueUses, std::vector<std::ui
         ConstOpen co;                                   // parser version 82 (fileId re-labelled by the caller)
         co.startByte     = r.u32();
         co.endByte       = r.u32();
-        co.namespaceOnly = r.u8() != 0;
+        co.namespaceOnly = r.flagU8();
         co.written       = r.str();
         ffOut.constOpens.push_back( std::move( co ) );
     }
diff --git a/src/ingest_metrics.h b/src/ingest_metrics.h
index 276148977..58c84a385 100644
--- a/src/ingest_metrics.h
+++ b/src/ingest_metrics.h
@@ -1679,6 +1679,16 @@ inline ParamShape cc_paramShape( TSNode defNode, Lang lang, SymKind kind, std::s
     return {};   // no parameter-list node found at all → can't be sure → not filterable (safe)
 }
 
+// #155 KOTLIN TRAILING LAMBDA: true when a Kotlin call_expression writes its lambda AFTER the argument list — the grammar's
+// annotated_lambda directly under its call_suffix: `s.run { }`, `with( sb ) { }`, `s?.let { }`, `xs.also { }`. The lambda of
+// `s.let( { } )` sits inside value_arguments, so it is NOT a trailing lambda (a disclosed floor, FalseEdgeRules' Kotlin arm).
+// Not noexcept: firstChildOfKind's cursor allocates (infra/tschildren.h A4-F25).
+inline bool kotlinTrailingLambda( TSNode call )
+{
+    const TSNode suffix = kindIs( ts_node_type( call ), "call_expression" ) ? firstChildOfKind( call, /*namedOnly=*/true, { "call_suffix" } ) : TSNode{};   // one call_suffix per call_expression
+    return !ts_node_is_null( suffix ) && !ts_node_is_null( firstChildOfKind( suffix, /*namedOnly=*/true, { "annotated_lambda" } ) );
+}
+
 // B2.2 CALL-SITE ARITY: count the positional arguments of the call whose callee identifier is `nameNode`.
 // Returns { argCount, known }. `known` is true ONLY when a recognized call node + argument container is
 // found for a supported language AND no spread/splat/apply/pack-expansion argument is present (which would make the count
diff --git a/src/ingest_model.h b/src/ingest_model.h
index f8cdeb0f7..ffb95cf71 100644
--- a/src/ingest_model.h
+++ b/src/ingest_model.h
@@ -905,6 +905,7 @@ inline void emitReferences( IngestResult& result, std::vector<RawRef>& rawRefs,
         ref.memberVia   = std::move( r.memberVia );     // FE-B on #373: the method a Ruby typed receiver was built by
         ref.memberFactory = r.memberFactory;            // FE-B on #373: memberCtor names a FactoryBot factory
         ref.forwarded   = r.forwarded;                  // lane fcall-forward fix 1: an `f.call/f.apply` site standing for `f( … )`
+        ref.trailingLambda = r.trailingLambda;          // #155: a Kotlin call whose lambda trails its argument list (scope-function arm)
         ref.baseBind    = r.baseBind;                   // lane lego-transitive fix 1: an inherit ref's same-file base binding
         ref.fieldName   = std::move( r.fieldName );   // S5-E: the member variable name (e.g. "m_pool")
         ref.composeRel  = std::move( r.composeRel );  // S5-E: "creates" or "uses"
diff --git a/src/ingest_sidecap.h b/src/ingest_sidecap.h
index 11cc7776e..ec10247c0 100644
--- a/src/ingest_sidecap.h
+++ b/src/ingest_sidecap.h
@@ -2556,6 +2556,10 @@ void captureTagsFacts( TSQueryCursor* cursor, const LangEntry& le, std::uint32_t
                     }
                     auto [ ac, ak ] = callArity( nameNode, le.lang, src );               // B2.2: call-site positional arg count
                     r.argCount = ac;  r.argCountKnown = ak;                              //   → arity filter in graph.h
+                    if( langFacts( le.lang ).trailingLambdaScopeFns )
+                    {
+                        r.trailingLambda = kotlinTrailingLambda( roleNode );   // #155: `x.run { }` / `with( x ) { }` — graph.h FalseEdgeRules' Kotlin arm
+                    }
                 }
                 refs.push_back( std::move( r ) );
             }
diff --git a/src/langfacts.h b/src/langfacts.h
index bd9713a39..94213b3a4 100644
--- a/src/langfacts.h
+++ b/src/langfacts.h
@@ -116,6 +116,19 @@ struct LangFacts
     /// open too (ifacedispatch.h). A Kotlin-only tree is unchanged.
     bool samFromJavaLambdas = false;
 
+    /// Kotlin: `run`, `let`, `apply`, `also` and `with` are stdlib scope functions, and a call to one with a trailing lambda is
+    /// that function, never a Java or other-language method of the same name (graph.h FE-A, kotlinScopeDecide; the call-site fact
+    /// is captured in ingest_sidecap.h).
+    bool trailingLambdaScopeFns = false;
+
+    /// Python: unittest, Django and pytest call setUp, tearDown, setup_method and the other test-framework hooks themselves
+    /// (quality.h pythonFrameworkInvokedSymbol).
+    bool frameworkEntryHooks = false;
+
+    /// Python: a closure inside a method can call `self.hook()` / `cls.hook()` for its host, so a receiver-bound call dispatches
+    /// through the host's overrides (quality.h pythonReceiverParameters, pythonDispatchRequests). A separate fact from the hooks.
+    bool closureReceiverDispatch = false;
+
     /// Kotlin: an `interface` is a class_declaration like a class (queries/kotlin/tags.scm: "both land here as @definition.class"),
     /// so the symbol's kind cannot tell the two apart; shared code that needs an interface (ifacedispatch.h's lambda test) reads a
     /// class of such a language as a possible one.
@@ -182,7 +195,7 @@ inline constexpr std::array<std::string_view, 3> kJavaObjectMethods = { "equals"
 inline constexpr std::array<LangFacts, kLangCount> kLangFacts = { {
     { .lang = Lang::Cpp, .defectShapeNeedsMacroSet = true, .noNestedNamedFunctions = true, .memberSeparator = "::",
       .transitiveIncludes = true },
-    { .lang = Lang::Python, .baseImportEvidence = BaseImportEvidence::PythonImport },
+    { .lang = Lang::Python, .frameworkEntryHooks = true, .closureReceiverDispatch = true, .baseImportEvidence = BaseImportEvidence::PythonImport },
     { .lang = Lang::TypeScript, .overloadSignatures = true, .structuralTyping = true, .importBoundConstruction = true, .baseImportEvidence = BaseImportEvidence::JsImport,
       .writtenBindingUndecided = true },
     { .lang = Lang::Go, .structuralTyping = true },
@@ -206,7 +219,7 @@ inline constexpr std::array<LangFacts, kLangCount> kLangFacts = { {
     { .lang = Lang::Lua },
     { .lang = Lang::Elixir, .hasInertQuoteRegions = true },
     { .lang = Lang::Dart },
-    { .lang = Lang::Kotlin, .samFromJavaLambdas = true, .interfaceReadsAsClass = true, .anonymousImplementors = true, .overloadsWithoutArity = true,
+    { .lang = Lang::Kotlin, .samFromJavaLambdas = true, .trailingLambdaScopeFns = true, .interfaceReadsAsClass = true, .anonymousImplementors = true, .overloadsWithoutArity = true,
       .baseImportEvidence = BaseImportEvidence::JvmImport },
     { .lang = Lang::GDScript },
     { .lang = Lang::Clojure },
diff --git a/src/model.h b/src/model.h
index ec7cacd9e..03077bd8b 100644
--- a/src/model.h
+++ b/src/model.h
@@ -976,6 +976,10 @@ struct Reference
     //   Function/Method (no via="name", no class/const/object target): an import proves a binding, not a function.
     //   Sits beside memberFactory in the alignment padding before baseBind: sizeof(Reference) is unchanged.
     bool          forwarded = false;
+    // #155 (test/kotlincheck.sh §15, test/falseedgecheck.sh arm J): a Kotlin call whose lambda is written AFTER the argument list
+    //   (`s.run { }`, `with( x ) { }`); the trailing lambda of a stdlib scope function. graph.h FalseEdgeRules' Kotlin arm drops
+    //   the Java-method edge such a call would bind.
+    bool          trailingLambda = false;
     // lane lego-transitive fix 1 (test/legotransitivecheck.sh NS arms), an INHERIT ref only (isInherit): the same-file declaration
     //   the base name binds to by the language's lexical lookup, as 1 + the byte its name starts at (ingest_relations.h
     //   localBaseBinding; 0 = no enclosing scope declares it, 0xFFFFFFFF = a scope too large to read, nothing proven). On an
diff --git a/src/quality.h b/src/quality.h
index 9c45885c6..ae3ff97e3 100644
--- a/src/quality.h
+++ b/src/quality.h
@@ -818,6 +818,45 @@ inline bool languageInvokedSymbol( const Symbol& s ) noexcept
     return false;
 }
 
+// Python test-framework hook names, ONE table per framework (CONTRIBUTING: one place per feature family). Two consumers read
+// them: pythonFrameworkInvokedSymbol below (the --quality-delta dead set) and pythonRunnerRoot (--dead-code / --safe-delete).
+//   kXunitHooks           pytest's xunit-style fixtures, collected from a test module with no call in the tree
+//   kUnittestHooks        unittest/Django TestCase methods the runner calls around a test (class scope)
+//   kUnittestModuleHooks  unittest's module-level entry points
+inline constexpr std::array<std::string_view, 8> kXunitHooks = { "setup_module", "teardown_module", "setup_function", "teardown_function",
+                                                                  "setup_class",  "teardown_class",  "setup_method",   "teardown_method" };
+inline constexpr std::array<std::string_view, 8> kUnittestHooks = { "setUp",         "tearDown",     "setUpClass", "tearDownClass",
+                                                                    "setUpTestData", "runTest",      "asyncSetUp", "asyncTearDown" };
+inline constexpr std::array<std::string_view, 3> kUnittestModuleHooks = { "setUpModule", "tearDownModule", "load_tests" };
+
+// Python test-framework entry points (#228). unittest and Django's TestCase call the kUnittestHooks names around tests, the
+// kUnittestModuleHooks names around a module, and run every test* method as a test. Pytest runs test_* too, and calls the
+// kXunitHooks names (setup_method, teardown_module, ...) of a test module. No call in the indexed tree names them, so zero
+// in-edges says nothing. Name-level, like the dunder rule in languageInvokedSymbol: errs toward live. The test* and xunit
+// clauses also need a test module (isTestPath, or Django's tests.py), so a helper named testSomething or setup_method in
+// application code still reads as dead. Not covered, still reported: pytest's conftest hooks (pytest_configure ...).
+// @pytest.fixture functions need no clause here: a decorated def is handed to its decorator as a value (ingest_valuerefs.h
+// emitDecorators), so --quality-delta never reports one, and --dead-code lists none (pythonDecoratedDef, decorated-excluded=).
+inline bool pythonFrameworkInvokedSymbol( const Symbol& s, std::string_view p ) noexcept
+{
+    if( !langFacts( s.lang ).frameworkEntryHooks || ( s.kind != SymKind::Method && s.kind != SymKind::Function ) )
+    {
+        return false;
+    }
+    const std::string_view n = s.name;
+    if( std::ranges::contains( kUnittestHooks, n ) || std::ranges::contains( kUnittestModuleHooks, n ) )
+    {
+        return true;
+    }
+    if( n.substr( 0, 4 ) != "test" && !std::ranges::contains( kXunitHooks, n ) )
+    {
+        return false;
+    }
+    const std::size_t      sl = p.rfind( '/' );
+    const std::string_view fn = sl == std::string_view::npos ? p : p.substr( sl + 1 );
+    return isTestPath( p ) || fn == "tests.py";
+}
+
 // A "dead deletion-candidate": has a body, no caller in the indexed tree, not invoked from file scope, not
 // invoked by the LANGUAGE itself (languageInvokedSymbol, above), not a test fixture, not produced by a
 // registered self-registering macro. A SIMPLE,
@@ -865,6 +904,10 @@ inline bool isDeadCandidate( const IngestResult& ing, const Graph& g, NodeId i,
         return false; // Q-DIAL-2: the LANGUAGE calls it — see languageInvokedSymbol (this replaced a blanket header exclusion)
     }
     const std::string_view p = rootRelPath( ing, s.fileId );   // #228: a directory above the root never decides this
+    if( pythonFrameworkInvokedSymbol( s, p ) )
+    {
+        return false; // #228: unittest/Django/pytest call this by protocol (see pythonFrameworkInvokedSymbol)
+    }
     if( isFixturePath( p ) )
     {
         return false; // fixtures are dead by design (noise rules)
@@ -1204,8 +1247,29 @@ inline void forEachSymbolBody( const IngestResult& ing, Fn&& visit )
     }
 }
 
-// Direct Python class members only; module-level and nested functions have no class owner.
-inline std::vector<NodeId> pythonMethodOwners( const IngestResult& ing )
+// Direct Python class members get an owner: the enclosing class. A def nested inside a method gets a host: the
+// nearest enclosing method, whose self/cls it reads as a free variable. Module-level functions have neither.
+struct PythonScopes
+{
+    std::vector<NodeId> owner;
+    std::vector<NodeId> host;
+};
+
+// Records one definition's enclosing scope: a class makes it a direct member; a method, or a closure in one, makes
+// the nearest method its host.
+inline void pythonRecordParent( PythonScopes& scopes, const IngestResult& ing, NodeId id, NodeId parent ) noexcept
+{
+    if( ing.symbols[parent].kind != SymKind::Class )
+    {
+        scopes.host[id] = scopes.owner[parent] != kNoNode ? parent : scopes.host[parent];
+    }
+    else if( ing.symbols[id].kind != SymKind::Class )
+    {
+        scopes.owner[id] = parent;
+    }
+}
+
+inline PythonScopes pythonMethodOwners( const IngestResult& ing )
 {
     const bool hasClasses = std::any_of( ing.symbols.begin(), ing.symbols.end(), []( const Symbol& s )
     {
@@ -1215,7 +1279,9 @@ inline std::vector<NodeId> pythonMethodOwners( const IngestResult& ing )
     {
         return {};
     }
-    std::vector<NodeId> owner( ing.symbols.size(), kNoNode );
+    PythonScopes scopes;
+    scopes.owner.assign( ing.symbols.size(), kNoNode );
+    scopes.host.assign( ing.symbols.size(), kNoNode );
     SymbolsByFile byFile = symbolsByFileInIdOrder( ing, []( const Symbol& s )
     {
         return s.lang == Lang::Python && ( s.kind == SymKind::Class || s.kind == SymKind::Function || s.kind == SymKind::Method );
@@ -1240,50 +1306,85 @@ inline std::vector<NodeId> pythonMethodOwners( const IngestResult& ing )
             {
                 parents.pop_back();
             }
-            if( s.kind != SymKind::Class && !parents.empty() && ing.symbols[parents.back()].kind == SymKind::Class )
+            if( !parents.empty() )
             {
-                owner[id] = parents.back();
+                pythonRecordParent( scopes, ing, id, parents.back() );
             }
             parents.push_back( id );
         }
     }
-    return owner;
+    return scopes;
 }
 
-// Python VarDecl bindings are parameter names in source order (emitBindings); the first one
-// identifies the conventional receiver. Reuse those AST facts, including commented/typed parameters.
-// A non-receiver first parameter is marked 3 so a later parameter named cls cannot replace it.
-inline std::vector<std::uint8_t> pythonReceiverParameters( const IngestResult& ing )
+// The conventional receiver of each Python def and the receiver names it binds as parameters. Parameters are
+// VarDecl bindings in source order (emitBindings). kind: 1 self, 2 cls, 3 a first parameter that is neither, 0 none;
+// the first parameter decides it, so a later parameter named cls cannot replace it. bound: bit 1 self, bit 2 cls,
+// wherever the name sits in the list.
+struct PythonReceivers
+{
+    std::vector<std::uint8_t> kind;
+    std::vector<std::uint8_t> bound;
+};
+
+inline PythonReceivers pythonReceiverParameters( const IngestResult& ing )
 {
-    std::vector<std::uint8_t> receiver( ing.symbols.size(), 0 );
+    PythonReceivers receivers;
+    receivers.kind.assign( ing.symbols.size(), 0 );
+    receivers.bound.assign( ing.symbols.size(), 0 );
     for( const Binding& b : ing.bindings )
     {
-        if( b.fromSymbol >= receiver.size() || ing.symbols[b.fromSymbol].lang != Lang::Python
-            || b.kind != LocalBindKind::VarDecl || b.spanStart != 0 || b.spanEnd != 0 || receiver[b.fromSymbol] != 0 )
+        if( b.fromSymbol >= receivers.kind.size() || !langFacts( ing.symbols[b.fromSymbol].lang ).closureReceiverDispatch
+            || b.kind != LocalBindKind::VarDecl || b.spanStart != 0 || b.spanEnd != 0 )
         {
             continue;
         }
-        receiver[b.fromSymbol] = b.var == "self" ? 1 : b.var == "cls" ? 2 : 3;
+        const std::uint8_t name = b.var == "self" ? 1 : b.var == "cls" ? 2 : 0;
+        receivers.bound[ b.fromSymbol ] |= name;
+        if( receivers.kind[ b.fromSymbol ] == 0 )
+        {
+            receivers.kind[ b.fromSymbol ] = name != 0 ? name : 3;
+        }
     }
-    return receiver;
+    return receivers;
 }
 
-// Deduplicate receiver-call evidence before walking inheritance; repeated call sites have the same
-// possible targets. Views borrow the ingested reference names for this one snapshot computation.
+// The method whose receiver a self./cls. call reads, or kNoNode. A method reads its own receiver. A closure nested
+// in a method reads the enclosing method's, unless the closure binds that receiver name itself. The method's receiver
+// must be the conventional one: self for ThisObj, cls for the NamedVar cls.
+inline NodeId pythonReceiverScope( const PythonScopes& scopes, const PythonReceivers& receivers, const Reference& r ) noexcept
+{
+    const std::uint8_t want  = r.recv == RecvKind::ThisObj ? 1 : 2;
+    NodeId             scope = kNoNode;
+    if( scopes.owner[ r.fromSymbol ] != kNoNode )
+    {
+        scope = r.fromSymbol;
+    }
+    else if( scopes.host[ r.fromSymbol ] != kNoNode && ( receivers.bound[ r.fromSymbol ] & want ) == 0 )
+    {
+        scope = scopes.host[ r.fromSymbol ];
+    }
+    return scope != kNoNode && receivers.kind[ scope ] == want ? scope : kNoNode;
+}
+
+// Deduplicate receiver-call evidence before walking inheritance; repeated call sites have the same possible targets.
+// Views borrow the ingested reference names for this one snapshot computation.
 inline std::vector<std::pair<NodeId, std::string_view>> pythonDispatchRequests( const IngestResult& ing,
-    std::span<const NodeId> owner, std::span<const std::uint8_t> receiver )
+    const PythonScopes& scopes, const PythonReceivers& receivers )
 {
     std::vector<std::pair<NodeId, std::string_view>> requests;
     for( const Reference& r : ing.references )
     {
-        if( r.lang != Lang::Python || r.role != RefRole::Call || r.fromSymbol >= owner.size()
-            || owner[r.fromSymbol] == kNoNode || !r.qualifier.empty()
-            || !( ( r.recv == RecvKind::ThisObj && receiver[r.fromSymbol] == 1 )
-                  || ( r.recv == RecvKind::NamedVar && r.recvVar == "cls" && receiver[r.fromSymbol] == 2 ) ) )
+        const bool selfOrCls = r.recv == RecvKind::ThisObj || ( r.recv == RecvKind::NamedVar && r.recvVar == "cls" );
+        if( !langFacts( r.lang ).closureReceiverDispatch || r.role != RefRole::Call || r.fromSymbol >= scopes.owner.size()
+            || !r.qualifier.empty() || !selfOrCls )
         {
             continue;
         }
-        requests.emplace_back( owner[r.fromSymbol], r.calleeName );
+        const NodeId scope = pythonReceiverScope( scopes, receivers, r );
+        if( scope != kNoNode )
+        {
+            requests.emplace_back( scopes.owner[ scope ], r.calleeName );
+        }
     }
     std::sort( requests.begin(), requests.end(), []( const auto& a, const auto& b )
     {
@@ -1311,11 +1412,12 @@ inline std::vector<NodeId> pythonDispatchClasses( const Graph& g, NodeId base )
 // This is conservative liveness, not a model of Python's MRO, descriptors, or monkey-patching.
 inline std::vector<NodeId> pythonDispatchedMethodIds( const IngestResult& ing, const Graph& g )
 {
-    const std::vector<NodeId> owner = pythonMethodOwners( ing );
-    if( owner.empty() )
+    const PythonScopes scopes = pythonMethodOwners( ing );
+    if( scopes.owner.empty() )
     {
         return {};
     }
+    const std::vector<NodeId>& owner = scopes.owner;
     HashMap<NodeId, std::vector<NodeId>> methods;
     methods.reserve( 32 );
     for( NodeId i = 0; i < owner.size(); ++i )
@@ -1325,9 +1427,9 @@ inline std::vector<NodeId> pythonDispatchedMethodIds( const IngestResult& ing, c
             methods[ owner[i] ].push_back( i );
         }
     }
-    const std::vector<std::uint8_t> receiver = pythonReceiverParameters( ing );
+    const PythonReceivers receivers = pythonReceiverParameters( ing );
     std::vector<NodeId> result;
-    for( const auto& [ base, name ] : pythonDispatchRequests( ing, owner, receiver ) )
+    for( const auto& [ base, name ] : pythonDispatchRequests( ing, scopes, receivers ) )
     {
         for( NodeId id : pythonDispatchClasses( g, base ) )
         {
@@ -2337,8 +2439,10 @@ inline std::string cacheRootKeyHex( const std::string& root )
 // `static_assert( quality::kIngestParserVerMirror == kParserVer && … )`, so a missed mirror now fails the build. It does
 // not include this header; it relies on ingest.cpp including quality.h (line 13) before ingest_cache.h, and a reorder
 // that broke that fails the build on the undeclared name rather than passing.
-constexpr std::uint32_t kIngestCacheVersionMirror   = 40;   // MUST equal ingest.cpp's kCacheVersion (gated); 40 = train 34 (fc3-js-rebind JsRebind; above main 39), 39 = train 33 (above main 36 and l6-iface 38), 38 = train 32 lane l6-iface fix round 1: LocalBindKind ImplBlock (train renumbers), 37 = train 32 lane l6-iface: LocalBindKind DispatchType (train renumbers), 36 = train 30 (above call-result-typing's and fcall-forward's 33, name-template-dispatch's 35, main's 34), 34 = train 29 (above lane arity-min's and call-result-typing's 33), 33 = train 29 lane arity-min: def record paramsMin (the train renumbers), 33 = lane call-result-typing: RawBind resultIndex + unwrapDepth, 33 = lane fcall-forward: ref `forwarded` byte, 35 = lane name-template-dispatch: RefRole Pattern 11, 32 = train 28: RefRole Subscript 9 + Inert 10, 31 = train 27: lego-transitive's inherit-ref baseBind (the lane's 30), 29 = FE-B ref memberPath/memberCtor + 4 bind kinds, 28 = FE-A ref memberCall/memberRoot, 27 = corrected fnScope values, 26 = function-local def scope span (25 = #157 + #150)
-constexpr std::uint32_t kIngestParserVerMirror    = 226;  // MUST equal ingest.cpp's kParserVer   (gated)
+constexpr std::uint32_t kIngestCacheVersionMirror   = 43;   // MUST equal ingest.cpp's kCacheVersion (gated); 43 = train 36 (#155 trailingLambda ref byte; above main 40, #438's placeholder 41, rust-degraded's 42), 40 = train 34 (fc3-js-rebind JsRebind; above main 39), 39 = train 33 (above main 36 and l6-iface 38), 38 = train 32 lane l6-iface fix round 1: LocalBindKind ImplBlock (train renumbers), 37 = train 32 lane l6-iface: LocalBindKind DispatchType (train renumbers), 36 = train 30 (above call-result-typing's and fcall-forward's 33, name-template-dispatch's 35, main's 34), 34 = train 29 (above lane arity-min's and call-result-typing's 33), 33 = train 29 lane arity-min: def record paramsMin (the train renumbers), 33 = lane call-result-typing: RawBind resultIndex + unwrapDepth, 33 = lane fcall-forward: ref `forwarded` byte, 35 = lane name-template-dispatch: RefRole Pattern 11, 32 = train 28: RefRole Subscript 9 + Inert 10, 31 = train 27: lego-transitive's inherit-ref baseBind (the lane's 30), 29 = FE-B ref memberPath/memberCtor + 4 bind kinds, 28 = FE-A ref memberCall/memberRoot, 27 = corrected fnScope values, 26 = function-local def scope span (25 = #157 + #150)
+constexpr std::uint32_t kIngestParserVerMirror    = 231;  // MUST equal ingest.cpp's kParserVer   (gated)
+                                                          // 231 = 2026-10-25 (train 36: above main 226/227, #438 228, rust-degraded 229/230;
+                                                          //   see the kParserVer note)
                                                           // 226 = 2026-10-24 (train 34: above main / #432 / ind4b 224/225, ind5 222/223,
                                                           //   fc3 218/219; see the kParserVer note)
                                                           // 224 = 2026-10-23 (train 33: above main 220/221, ind5 222/223, #420 214/215, fc1 216/217,
@@ -3520,6 +3624,9 @@ inline void evictOldHeadSnapCaches( const std::string& dir, const std::string& r
 //   pythonDispatchClasses     (quality.h) — downward-only inheritance reachability
 //   pythonDispatchedMethodIds  (quality.h) — Python inherited receiver-call evidence for the dead set
 //   isDeadCandidate            (quality.h) — the dead-set predicate itself
+//   pythonFrameworkInvokedSymbol (quality.h) — the framework-hook exemption isDeadCandidate calls into (#228)
+//   pythonRecordParent         (quality.h) — fills the closure host and owner that pythonReceiverScope reads (#228)
+//   pythonReceiverScope        (quality.h) — which method a self./cls. call in a closure belongs to (#228)
 //   isFixturePath              (quality.h) — a fixture-path exemption isDeadCandidate calls into
 //   isTestScriptPath           (quality.h) — the test-script exemption isDeadCandidate calls into (the exact
 //                                             helper B10.1a added without a bump — the finding this guards)
@@ -3657,7 +3764,14 @@ inline void evictOldHeadSnapCaches( const std::string& dir, const std::string& r
 // the standard-member gate gained a Rust row (graph.h kStdMemberNames), so a Rust definition a DECLINED call could have meant is
 // no dead candidate (Graph::gateDeclinedTarget), as v15 did for the builtin-method gate. No extraction change: kParserVer and its
 // mirror stay. The producer identity already keeps this build's blobs apart; bumped 21 -> 22 so the history above stays complete.
-constexpr std::uint32_t kQSnapCacheScheme = 22;
+// v23 (2026-10-24, #228: Django/unittest hooks and closure dispatch) — no blob shape change; the dead SET's inputs moved.
+// isDeadCandidate exempts Python framework entry points (pythonFrameworkInvokedSymbol: setUp, tearDown, setUpClass,
+// tearDownClass, setUpTestData, setUpModule, tearDownModule, load_tests, and test* methods in test modules), and
+// pythonDispatchedMethodIds keeps a self./cls. call inside a closure nested in a method live: the overrides of the called name on that method's class and its subclasses.
+// The producer identity already keeps this build's blobs apart; bumped 22 -> 23 so the history above stays complete.
+// v24 (2026-10-25, train 36) — #228's v23 was the PR's placeholder; renumbered above every live value (main / train 35 / every
+// other ref 22, #437 23). No further shape change.
+constexpr std::uint32_t kQSnapCacheScheme = 24;
 constexpr char          kQSnapMagic[4]    = { 'Q', 'S', 'N', 'P' };
 
 // The qsnap EXCLUDES-config key folds the qsnap SCHEME (independent of the ingest cache's kHeadSnapCacheScheme)
@@ -10066,15 +10180,11 @@ inline bool pythonRunnerRoot( std::string_view path, const Symbol& s, std::strin
     const std::string_view baseName   = slash == std::string_view::npos ? path : path.substr( slash + 1 );
     const bool             pytestFile = ( baseName.starts_with( "test_" ) || baseName.ends_with( "_test.py" ) ) && baseName.ends_with( ".py" );
     const std::string_view name       = s.name;
-    constexpr std::array<std::string_view, 8> kXunitHooks = { "setup_module", "teardown_module", "setup_function", "teardown_function",
-                                                              "setup_class",  "teardown_class",  "setup_method",   "teardown_method" };
-    constexpr std::array<std::string_view, 6> kUnittestHooks = { "setUp", "tearDown", "setUpClass", "tearDownClass", "asyncSetUp", "asyncTearDown" };
-    const auto listed = []( const auto& table, std::string_view n ) noexcept { return std::find( table.begin(), table.end(), n ) != table.end(); };
-    if( pytestFile && ( name.starts_with( "test" ) || listed( kXunitHooks, name ) ) )
+    if( pytestFile && ( name.starts_with( "test" ) || std::ranges::contains( kXunitHooks, name ) ) )
     {
         return true;
     }
-    if( s.scope.empty() || !( name.starts_with( "test" ) || listed( kUnittestHooks, name ) ) )
+    if( s.scope.empty() || !( name.starts_with( "test" ) || std::ranges::contains( kUnittestHooks, name ) ) )
     {
         return false;
     }
diff --git a/test/cachefuzzcheck.sh b/test/cachefuzzcheck.sh
index 6987ffb46..5e71d6b07 100755
--- a/test/cachefuzzcheck.sh
+++ b/test/cachefuzzcheck.sh
@@ -937,13 +937,13 @@ for i in range(n):
             pmin["def.paramsMin"] = (p + 14 * 4, struct.unpack_from("<I", blob, p + 14 * 4)[0], struct.unpack_from("<I", blob, p + 13 * 4)[0])
         skip(15 * 4 + 6 + 2 * 4); site("def.kind"); site("def.lang"); s(); s(); skip(8)   # #150: +1 u8 (scopeRootsStd); cache v26: +2 u32 (fnScopeStart/End) before kind; cache v33: +1 u32 (paramsMin) after params
     for _ in range(u32()):                                                # refs
-        skip(4); site("ref.lang"); s(); skip(2); s(); site("ref.recv"); s(); skip(1); s(); s(); site("ref.role"); site32("ref.argCount", 4); skip(12); s(); s(); s(); s(); skip(2)   # line, argCount, argCountKnown, viaArrow, #150's qualifierRootsStd, FE-A's memberCall u8 + memberRoot str, FE-B's memberPath + memberCtor + memberVia strs, memberFactory u8, fcall-forward's forwarded u8
+        skip(4); site("ref.lang"); s(); skip(2); s(); site("ref.recv"); s(); skip(1); s(); s(); site("ref.role"); site32("ref.argCount", 4); skip(12); s(); s(); s(); s(); skip(1); site("ref.forwarded"); site("ref.trailingLambda")   # line, argCount, argCountKnown, viaArrow, #150's qualifierRootsStd, FE-A's memberCall u8 + memberRoot str, FE-B's memberPath + memberCtor + memberVia strs, memberFactory u8, fcall-forward's forwarded u8, #155's trailingLambda u8
     for _ in range(u32()):                                                # includes
-        skip(3 + 4 + 1); s()
+        site("include.isAngle"); skip(2 + 4 + 1); s()
     for _ in range(u32()):                                                # binds
-        skip(4); site("bind.lang"); site("bind.kind"); skip(1 + 2 + 8); s(); s(); s()   # isFromAssignment, resultIndex/unwrapDepth (v33), spanStart/End
+        skip(4); site("bind.lang"); site("bind.kind"); site("bind.isFromAssignment"); skip(2 + 8); s(); s(); s()   # isFromAssignment, resultIndex/unwrapDepth (v33), spanStart/End
     for _ in range(u32()):                                                # FFI aliases
-        site("ffi.kind"); skip(1); s(); s(); s()
+        site("ffi.kind"); site("ffi.lowConf"); s(); s(); s()
     for _ in range(u32()):                                                # route defs
         skip(4); site("routedef.method"); s(); s()
     for _ in range(u32()):                                                # route uses
@@ -1008,6 +1008,17 @@ else:
     for tag, value in (("above", params + 1), ("inrange", params if orig != params else 0)):
         open(f"{outdir}/def.paramsMin.{tag}.cache", "wb").write(rebuilt_with(off, value, 4))
         print(f"def.paramsMin\tpmin\t{tag}\t{value}\t{orig}\t{params}")
+# The same three runs cover the FLAG bytes (a bool the writer stores as 0 or 1). `r.u8() != 0` read a 2 as true: a doctored
+# `trailingLambda` byte made a Kotlin call without a trailing lambda drop its Java candidates (CodeRabbit on PR #441). (a) the
+# values 2 and 255 must refuse that record, (c) the other legal value (1 - orig) must be accepted.
+for cls in ("ref.forwarded", "ref.trailingLambda", "bind.isFromAssignment", "ffi.lowConf", "include.isAngle"):
+    if cls not in sites:
+        print(f"{cls}\tflag\tABSENT\t-\t-\t-")
+        continue
+    off, orig = sites[cls]
+    for tag, value in (("two", 2), ("allones", 255), ("inrange", 1 - orig if orig in (0, 1) else 0)):
+        open(f"{outdir}/{cls}.{tag}.cache", "wb").write(rebuilt_with(off, value))
+        print(f"{cls}\tflag\t{tag}\t{value}\t{orig}\t2")
 PYEOF
 planRc=$?
 if [ "$planRc" -ne 0 ]; then
@@ -1022,6 +1033,7 @@ elif [ -n "$GOOD_RECORDS" ]; then
         mutant="$EDIR/$cls.$tag.cache"
         if [ "$enum" = "u16" ]; then what="16-bit field stored wider than 16 bits"
         elif [ "$enum" = "pmin" ]; then what="paramsMin above its def's params ($enumCount)"
+        elif [ "$enum" = "flag" ]; then what="flag byte other than 0 or 1"
         else what="$enum byte past the last enumerator (count $enumCount)"; fi
         if cmp -s "$mutant" "$EDIR/good.cache"; then
             no "[enum:$cls=$value] the mutation did not take (mutant equals the good cache)"
diff --git a/test/deadprecisioncheck.sh b/test/deadprecisioncheck.sh
index 7beb09fec..73a9032de 100755
--- a/test/deadprecisioncheck.sh
+++ b/test/deadprecisioncheck.sh
@@ -84,6 +84,12 @@ class LegacyCase(unittest.TestCase):
 
     def test_case(self, static=None):
         self.assertEqual(self.x, 1)
+
+    def setUpTestData(self, static=None):
+        pass
+
+    def runTest(self, static=None):
+        pass
 PYSRC
 cat >"$T/pkg/core.py" <<'PYSRC'
 def app_route(fn):
@@ -123,11 +129,11 @@ root = ET.parse(sys.argv[1]).getroot()
 names = [node.get("n") for node in root.findall("d")]
 if names != ["orphan_c"]:
     raise SystemExit(f"FAIL R1/R2/R3 expected only the C static orphan, found {names}")
-if root.get("runner-root-excluded") != "4":
-    raise SystemExit(f"FAIL R2 runner-root-excluded= should count the 4 test-runner roots (test_param, setup_module, setUp, test_case), found {root.get('runner-root-excluded')!r}")
+if root.get("runner-root-excluded") != "6":
+    raise SystemExit(f"FAIL R2 runner-root-excluded= should count the 6 test-runner roots (test_param, setup_module, setUp, test_case, setUpTestData, runTest), found {root.get('runner-root-excluded')!r}")
 if root.get("decorated-excluded") != "2":
     raise SystemExit(f"FAIL R2 decorated-excluded= should count the 2 decorated defs (@pytest.fixture resource, @app_route handler), found {root.get('decorated-excluded')!r}")
-print("PASS R1-R3 comment static is not linkage; test-runner roots (runner-root-excluded=4) and decorated defs (decorated-excluded=2) counted apart; C orphan kept")
+print("PASS R1-R3 comment static is not linkage; test-runner roots (runner-root-excluded=6) and decorated defs (decorated-excluded=2) counted apart; C orphan kept")
 PY
 [ $? -eq 0 ] || exit 1
 if grep -qE 'runner-root-excluded|decorated-excluded' "$TMP/a"; then echo "FAIL R2 runner-root-excluded=/decorated-excluded= must be absent at 0 (deadfix corpus)"; exit 1; fi
diff --git a/test/falseedgecheck.sh b/test/falseedgecheck.sh
index 47d8487bc..c2dd9fa86 100755
--- a/test/falseedgecheck.sh
+++ b/test/falseedgecheck.sh
@@ -88,6 +88,10 @@
 #            without a declaration (FIX2 C1/C2); patterns nested 20000 deep.
 #            FLOOR (FC3 delta2 C3, card FC6, pre-existing at 320f8d8f): a member `.limit()` site rides UNHEDGED in a caller row merged
 #            with a bare imported `limit(...)` call (kysely clear.test.ts / insert.test.ts `.$call( limit( 1, dialect ) )`).
+#   (J) Kotlin (#155): a call with a TRAILING lambda to let/run/with/apply/also is the stdlib scope function: its Java
+#            candidates are dropped, and an emptied set is external= (kt/: `s.run { }`, `with( sb ) { }`, `s?.let { }`,
+#            `xs.also { }`, `apply { }`). The same Java names with no lambda (`block.run()`), and Kotlin's own definition of
+#            `run` (ktown/: `go` binds Task.run; build's `s.run { length }` is pinned there, the receiver gap), keep their edges.
 #   (F) propagation: --callers and --impact of the in-repo decoys no longer list the false callers.
 #   (G) disclosure: every call the arms above unbind is a `C external` census row (empty targets) — except a Python bare
 #            name nothing binds and no builtin table holds (run_all's `process`, siblings.py's `helper`), which has no
@@ -251,7 +255,7 @@ reaches_fn(){
 }
 
 # ── census: one per root, written FIRST so no arm reads a missing file ─────────────────────────────────────────
-ROOTS="go gonomod gomodcomment goreplace js ts tsimport py c cpp rs jsrebind"
+ROOTS="go gonomod gomodcomment goreplace js ts tsimport py c cpp rs jsrebind kt ktown"
 for r in $ROOTS; do
     if ! rw "$r" --pin-census="$TMP/$r.tsv" >"$TMP/$r.map.xml"; then no "($r) the census run exited non-zero"; fi
     if [ ! -s "$TMP/$r.tsv" ]; then no "($r) the census run wrote no census — every census arm for this root would be vacuous"; fi
@@ -462,6 +466,26 @@ elif ! grep -q '<callers [^>]* defs="1"' "$deepf"; then no "(jsrebind) --callers
 elif grep -q 'test/assign.test.js' "$deepf"; then no "(jsrebind) the 20000-deep assignment still binds a row: $( tr '<' '\n' <"$deepf" | grep 'assign.test' | tr '\n' ';' )"
 else ok "(jsrebind) 20000-deep object patterns: exit 0, the written \`Eng\` binds no row"; fi
 
+echo "=== (J) Kotlin: a trailing-lambda scope function never binds a Java method (#155) ==="
+# A Kotlin call with a trailing lambda to let/run/with/apply/also is the stdlib scope function: its Java candidates are dropped
+# and an emptied set is external= (kotlin scope arm of FalseEdgeRules). Kotlin's own candidates are kept, and a call with no
+# lambda (`block.run()` on a Runnable) keeps every candidate the ladder had.
+exactly kt callers java/jobs/Job.java:run "fn dispatch kt/Dispatch.kt;fn kick kt/Use.kt"
+lacks kt callers java/jobs/Job.java:run "build kt/Use.kt"
+exactly kt callers java/lib/Builder.java:with "fn realWith kt/Scopes.kt"
+exactly kt callers java/lib/Builder.java:apply ""
+exactly kt callers java/lib/Builder.java:let ""
+exactly kt callers java/lib/Builder.java:also ""
+# Kotlin DEFINES run (ktown): own-language-first keeps the Kotlin run for go and build (the receiver gap, pinned); kick's j.run()
+# has no lambda and keeps Job.run, as it did before the fix.
+exactly ktown callers kt/Task.kt:run "fn build kt/Task.kt;fn go kt/Task.kt"
+exactly ktown callers java/jobs/Job.java:run "fn kick kt/Task.kt"
+
+externals kt kt/Use.kt build run
+externals kt kt/Scopes.kt useWith with
+externals kt kt/Scopes.kt useApply apply
+externals kt kt/Scopes.kt useLet let
+externals kt kt/Scopes.kt useAlso also
 echo "=== (F) propagation: the decoys' callers and impact ==="
 exactly go callers hist/history.go:append "fn Remember hist/history.go"
 lacks go impact hist/history.go:append "Collect algo/algo.go"
diff --git a/test/falseedgefix/README.md b/test/falseedgefix/README.md
index 572e3093c..7dcaec4f5 100644
--- a/test/falseedgefix/README.md
+++ b/test/falseedgefix/README.md
@@ -34,6 +34,10 @@ plus near-miss calls whose edges are real and must stay.
   callable variable, a bare `Worker()` construction, a class-body call.
 - `c/` — the functions `opts_parse()` and `region()` beside same-named structs; the macro `CLAMP` is kept; `find_type()` (an outside library) beside
   `enum find_type`. `cpp/` is the control: `Point( v )` constructs a struct in C++ and keeps its rows.
+- `kt/` (Kotlin beside Java) — `s.run { }`, `with( sb ) { }`, `s?.let { }`, `xs.also { }`, `apply { }` each carry a TRAILING
+  lambda and bind no Java method (`Job.run`, `Builder.with/apply/let/also`); the same Java names reached with no lambda
+  (`block.run()` on a Runnable) and a real `b.with( "x" )` keep their edges. `ktown/` — Kotlin DEFINES `run`: the
+  trailing-lambda `go` binds the Kotlin `Task.run`, and `build`'s `s.run { length }` is pinned there (the receiver gap).
 - `rs/` — `use termkit::render; render( n )` beside the method `History::render`. Kept: a same-module function,
   `h.render()`, `History::new()`, `History::render( &h )`, `Self::width()`.
 
diff --git a/test/falseedgefix/kt/java/jobs/Job.java b/test/falseedgefix/kt/java/jobs/Job.java
new file mode 100644
index 000000000..c1758eaa3
--- /dev/null
+++ b/test/falseedgefix/kt/java/jobs/Job.java
@@ -0,0 +1,7 @@
+package jobs;
+
+public class Job implements Runnable {
+    @Override
+    public void run() {
+    }
+}
diff --git a/test/falseedgefix/kt/java/lib/Builder.java b/test/falseedgefix/kt/java/lib/Builder.java
new file mode 100644
index 000000000..c8366ec4b
--- /dev/null
+++ b/test/falseedgefix/kt/java/lib/Builder.java
@@ -0,0 +1,8 @@
+package lib;
+
+public class Builder {
+    public Builder with(String s) { return this; }
+    public Builder apply(int x) { return this; }
+    public void let() { }
+    public void also() { }
+}
diff --git a/test/falseedgefix/kt/kt/Dispatch.kt b/test/falseedgefix/kt/kt/Dispatch.kt
new file mode 100644
index 000000000..f9843b450
--- /dev/null
+++ b/test/falseedgefix/kt/kt/Dispatch.kt
@@ -0,0 +1 @@
+fun dispatch(block: Runnable) = block.run()
diff --git a/test/falseedgefix/kt/kt/Scopes.kt b/test/falseedgefix/kt/kt/Scopes.kt
new file mode 100644
index 000000000..e552c4826
--- /dev/null
+++ b/test/falseedgefix/kt/kt/Scopes.kt
@@ -0,0 +1,9 @@
+fun useWith(sb: StringBuilder): String = with(sb) { toString() }
+
+fun useApply(): MutableList<Int> = mutableListOf<Int>().apply { add(1) }
+
+fun useLet(s: String?): Int = s?.let { it.length } ?: 0
+
+fun useAlso(xs: MutableList<Int>) = xs.also { it.clear() }
+
+fun realWith(b: lib.Builder) = b.with("x")
diff --git a/test/falseedgefix/kt/kt/Use.kt b/test/falseedgefix/kt/kt/Use.kt
new file mode 100644
index 000000000..bcfeb5599
--- /dev/null
+++ b/test/falseedgefix/kt/kt/Use.kt
@@ -0,0 +1,7 @@
+data class User(val name: String)
+
+fun build(s: String): User = s.run { User(this) }
+
+fun kick(j: jobs.Job) {
+    j.run()
+}
diff --git a/test/falseedgefix/ktown/java/jobs/Job.java b/test/falseedgefix/ktown/java/jobs/Job.java
new file mode 100644
index 000000000..c1758eaa3
--- /dev/null
+++ b/test/falseedgefix/ktown/java/jobs/Job.java
@@ -0,0 +1,7 @@
+package jobs;
+
+public class Job implements Runnable {
+    @Override
+    public void run() {
+    }
+}
diff --git a/test/falseedgefix/ktown/kt/Task.kt b/test/falseedgefix/ktown/kt/Task.kt
new file mode 100644
index 000000000..4f823043d
--- /dev/null
+++ b/test/falseedgefix/ktown/kt/Task.kt
@@ -0,0 +1,11 @@
+class Task {
+    fun run(block: () -> Unit) = block()
+}
+
+fun go(t: Task) = t.run { }
+
+fun build(s: String): Int = s.run { length }
+
+fun kick(j: jobs.Job) {
+    j.run()
+}
diff --git a/test/kotlincheck.sh b/test/kotlincheck.sh
index 18a15ca53..37f213304 100755
--- a/test/kotlincheck.sh
+++ b/test/kotlincheck.sh
@@ -1127,6 +1127,261 @@ pyedit "$TMP/jvminv_mut/k/Kt.kt" 'interface Marker' '// interface Marker removed
              || no "mutation 14c: with no Kotlin Marker, Tagged did not become the Java Marker's implementor: [$( markerImpls "$TMP/jvminv_mut" )]"; } \
     || no "mutation 14c: the Marker deletion did not apply — the arm would have been inert"
 
+# ════════════════════════════════════════════════════════════════════════
+echo
+echo "=== 15. KOTLIN SCOPE FUNCTIONS (#155): a trailing-lambda call to let/run/with/apply/also never binds a Java method ==="
+# ════════════════════════════════════════════════════════════════════════
+# The fact is the call's TRAILING LAMBDA, read at the call site (`x.run { }`, `with( x ) { }`, `x?.let { }`), never the name:
+# `block.run()` on a Runnable (no lambda) keeps its Java edge, and a Kotlin `run` the tree defines keeps its own. Each tree
+# asks ONE question (does Kotlin define the name or not), so no arm mixes the own-language rule with the trailing-lambda rule.
+# Trees: a = Use.kt (build, kick) beside Job.java; b = Scopes.kt (the four bare/safe-call shapes and a real b.with()) beside
+# Builder.java; c = Task.kt, which DEFINES run (tree C of the issue); d = the true-edge shapes; e = a parenthesised lambda (floor).
+SC="$TMP/scope"; rm -rf "$SC"; mkdir -p "$SC/a/java/jobs" "$SC/a/kt" "$SC/b/java/lib" "$SC/b/kt" "$SC/c/java/jobs" "$SC/c/kt" "$SC/d/java/jobs" "$SC/d/kt" "$SC/e/java/lib" "$SC/e/kt" "$SC/jo/java/jobs" "$SC/jo/java/lib"
+cat > "$SC/a/java/jobs/Job.java" <<'JAVA'
+package jobs;
+
+public class Job implements Runnable {
+    @Override
+    public void run() {
+    }
+}
+JAVA
+cat > "$SC/a/kt/Use.kt" <<'KT'
+data class User(val name: String)
+
+fun build(s: String): User = s.run { User(this) }
+
+fun kick(j: jobs.Job) {
+    j.run()
+}
+KT
+cat > "$SC/b/java/lib/Builder.java" <<'JAVA'
+package lib;
+
+public class Builder {
+    public Builder with(String s) { return this; }
+    public Builder apply(int x) { return this; }
+    public void let() { }
+    public void also() { }
+}
+JAVA
+cat > "$SC/b/kt/Scopes.kt" <<'KT'
+fun useWith(sb: StringBuilder): String = with(sb) { toString() }
+
+fun useApply(): MutableList<Int> = mutableListOf<Int>().apply { add(1) }
+
+fun useLet(s: String?): Int = s?.let { it.length } ?: 0
+
+fun useAlso(xs: MutableList<Int>) = xs.also { it.clear() }
+
+fun realWith(b: lib.Builder) = b.with("x")
+
+fun typedApply(b: lib.Builder) = b.apply { }
+KT
+cp "$SC/a/java/jobs/Job.java" "$SC/c/java/jobs/Job.java"; cp "$SC/a/java/jobs/Job.java" "$SC/d/java/jobs/Job.java"; cp "$SC/a/java/jobs/Job.java" "$SC/jo/java/jobs/Job.java"
+cat > "$SC/c/kt/Task.kt" <<'KT'
+class Task {
+    fun run(block: () -> Unit) = block()
+}
+
+fun go(t: Task) = t.run { }
+
+fun build(s: String): Int = s.run { length }
+
+fun kick(j: jobs.Job) {
+    j.run()
+}
+KT
+cat > "$SC/d/kt/Dispatch.kt" <<'KT'
+fun dispatch(block: Runnable) = block.run()
+KT
+cat > "$SC/d/kt/Kick.kt" <<'KT'
+fun kick(j: jobs.Job) {
+    j.run()
+}
+KT
+cp "$SC/b/java/lib/Builder.java" "$SC/e/java/lib/Builder.java"
+cat > "$SC/e/kt/Paren.kt" <<'KT'
+fun useParen(s: String): Int = s.let({ it.length })
+KT
+cat > "$SC/jo/java/lib/Builder.java" <<'JAVA'
+package lib;
+
+public class Builder {
+    public Builder with(String s) { return this; }
+    public Builder apply(int x) { return this; }
+    public void let() { }
+    public void also() { }
+}
+JAVA
+cat > "$SC/jo/java/lib/Caller.java" <<'JAVA'
+package lib;
+
+public class Caller {
+    public void go() {
+        Builder b = new Builder();
+        b.with("x");
+        b.apply(1);
+        b.let();
+        b.also();
+    }
+
+    public void spin(jobs.Job j) {
+        j.run();
+    }
+}
+JAVA
+
+# callerNames ROOT SEL — the --callers rows as "name@file " tokens, sorted (the line number is dropped: a shifted line is no failure)
+callerNames(){ "$BIN" "$1" --callers="$2" --no-cache 2>/dev/null | grep -oE '<s t="[a-z]*" n="[^"]*" p="[^"]*"' | sed -E 's/<s t="[a-z]*" n="([^"]*)" p="([^"]*):[0-9]+"/\1@\2/' | LC_ALL=C sort | tr '\n' ' '; }
+# expectCallers ROOT SEL WANT LABEL — the caller rows of SEL are exactly WANT
+expectCallers(){ local got; got="$( callerNames "$1" "$2" )"; if [ "$got" = "$3" ]; then ok "$4"; else no "$4: got [$got], want [$3]"; fi; }
+# matchRows ROOT QUERY — the tree-sitter captures of QUERY as "file:line in=symbol" tokens
+matchRows(){ "$BIN" "$1" --no-cache --match="$2" 2>/dev/null | grep -oE '<m p="[^"]*" in="[^"]*"' | LC_ALL=C sort -u | tr '\n' ' '; }
+
+# PRESENCE first: each trailing-lambda shape and its no-lambda twin must be in the tree, or an absence below proves nothing.
+Q_NAV_LAMBDA='(call_expression (navigation_expression) (call_suffix (annotated_lambda) @l)) @c'
+Q_BARE_LAMBDA='(call_expression (simple_identifier) (call_suffix (value_arguments) (annotated_lambda) @l)) @c'
+Q_NAV_PLAIN='(call_expression (navigation_expression) (call_suffix (value_arguments) @v)) @c'
+for spec in "a|Q_NAV_LAMBDA|in=\"build\"|s.run { } (navigation, trailing lambda)" "b|Q_BARE_LAMBDA|in=\"useWith\"|with( x ) { } (bare call, ordinary argument and trailing lambda)" \
+            "b|Q_NAV_LAMBDA|in=\"useLet\"|x?.let { } (safe call, trailing lambda)" "a|Q_NAV_PLAIN|in=\"kick\"|j.run() (navigation, no lambda)"; do
+    IFS='|' read -r tree qname needle label <<< "$spec"
+    qv="${!qname}"
+    if matchRows "$SC/$tree" "$qv" | grep -qF "$needle"; then ok "presence: --match finds $label"
+    else no "presence: --match does not find $label ($needle) — the arms below would be vacuous"; fi
+done
+
+# THE DEFECT AND ITS CONTROLS, one question per tree.
+expectCallers "$SC/a" run 'kick@kt/Use.kt ' "15a tree A: --callers=run is exactly kick — the Kotlin s.run { User(this) } no longer binds Job.run"
+expectCallers "$SC/d" Job.java:run 'dispatch@kt/Dispatch.kt kick@kt/Kick.kt ' "15b tree D: block.run() on a Runnable and j.run() still bind Job.run (the true edges)"
+expectCallers "$SC/b" with 'realWith@kt/Scopes.kt ' "15c tree B: with( sb ) { } binds nothing in Java, and realWith's b.with( \"x\" ) still binds Builder.with"
+expectCallers "$SC/b" apply '' "15d tree B: mutableList.apply { } binds nothing in Java"
+expectCallers "$SC/b" let '' "15e tree B: s?.let { } binds nothing in Java"
+expectCallers "$SC/b" also '' "15f tree B: xs.also { } binds nothing in Java"
+# Tree C (Kotlin DEFINES run): own-language-first keeps the Kotlin run for the two trailing-lambda and receiver sites. PINNED at
+# today's answer: build (s.run { length }) reaches the Kotlin run, not Job.run — the receiver gap the fix does not close (a
+# navigation_expression arm in isMemberAccessNode is the next round). kick's j.run() binds Job.run on main (the kit's claim
+# that it reaches Task.run is stale); the arm pins that too.
+expectCallers "$SC/c" Task.kt:run 'build@kt/Task.kt go@kt/Task.kt ' "15g tree C: go still binds Task.run; build is pinned at today's answer (receiver gap: the Kotlin run takes s.run { length })"
+expectCallers "$SC/c" Job.java:run 'kick@kt/Task.kt ' "15h tree C: kick's j.run() still binds Job.run (no lambda, so the fix does not touch it)"
+# FLOOR, pinned: a parenthesised lambda is not the trailing-lambda grammar, so its Java edge stays (disclosed, not closed).
+expectCallers "$SC/e" let 'useParen@kt/Paren.kt ' "15i floor: s.let({ it.length }) keeps its Builder.let edge (the parenthesised lambda is out of scope)"
+# Tree F (Kotlin only, two classes define run): a receiver whose type the source states still picks ITS class's run — the arm
+# skips a receiver pick only when it holds a Java method (rv-pr438: skipping every pick split go and go2 over both runs, via="name").
+mkdir -p "$SC/f/kt"
+cat > "$SC/f/kt/A.kt" <<'KT'
+class Task {
+    fun run(block: () -> Unit) = block()
+}
+class Other {
+    fun run(block: () -> Unit) = block()
+}
+fun go(t: Task) = t.run { }
+fun go2() { val o = Other(); o.run { } }
+KT
+expectCallers "$SC/f" Task.run 'go@kt/A.kt ' "15l tree F: t.run { } on a typed t: Task binds Task.run alone (the receiver rule still decides a Kotlin pick)"
+expectCallers "$SC/f" Other.run 'go2@kt/A.kt ' "15l tree F: o.run { } on a constructed Other binds Other.run alone"
+goRow="$( "$BIN" "$SC/c" --callers=Task.kt:run --no-cache 2>/dev/null | grep -oE '<s t="fn" n="go" [^>]*>' )"
+case "$goRow" in
+    "") no "15m tree C: --callers=Task.kt:run printed no go row — the via= check below would be vacuous" ;;
+    *'via="name"'*) no "15m tree C: go's t.run { } binds Task.run only by name ($goRow), but its receiver t: Task proves it" ;;
+    *) ok "15m tree C: go's t.run { } binds Task.run with its receiver proof (no via=\"name\")" ;;
+esac
+
+# DISPOSITION: every refused site is a C external census row, the header gauge rises by exactly that many, and nothing is unaccounted.
+ext_names(){ python3 - "$1" <<'PY'
+import sys
+for line in open( sys.argv[ 1 ], encoding="utf-8", errors="replace" ):
+    f = line.rstrip( "\n" ).split( "\t" )
+    if len( f ) >= 9 and f[ 0 ] == "C" and f[ 1 ] == "external":
+        head, _, tail = f[ 5 ].partition( "::" )
+        print( tail.rsplit( "#", 1 )[ 0 ].split( "::" )[ -1 ] + ">" + f[ 6 ] )
+PY
+}
+for t in a b c; do
+    "$BIN" "$SC/$t" --no-cache --pin-census="$TMP/sc_$t.tsv" > "$TMP/sc_$t.xml" 2>/dev/null
+done
+want_ext(){ # tree the external= the census must state, the sorted census rows it must hold
+    local t="$1" n="$2" rows="$3" got gx
+    gx="$( grep -m1 '^# dispositions ' "$TMP/sc_$t.tsv" | grep -oE ' external=[0-9]+' | grep -oE '[0-9]+$' )"
+    got="$( ext_names "$TMP/sc_$t.tsv" | LC_ALL=C sort | tr '\n' ' ' )"
+    if [ "${gx:-x}" = "$n" ] && [ "$got" = "$rows" ] && grep -m1 '^# dispositions ' "$TMP/sc_$t.tsv" | grep -q ' unaccounted=0'; then
+        ok "disposition (tree $t): external=$n, the census rows are [${rows:-none}], unaccounted=0 — each refusal is counted"
+    else
+        no "disposition (tree $t): external=${gx:-?} census=[${got:-none}], want external=$n [${rows:-none}] with unaccounted=0"
+    fi
+}
+want_ext a 1 'build>run '
+want_ext b 5 'typedApply>apply useAlso>also useApply>apply useLet>let useWith>with '
+want_ext c 0 ''
+
+# MUTATION, keyed on the fact: the same site with NO trailing lambda (s.run()) must bind Job.run again, so the arm reads the lambda.
+rm -rf "$TMP/scmut"; cp -R "$SC/a" "$TMP/scmut"
+if pyedit "$TMP/scmut/kt/Use.kt" 's.run { User(this) }' 's.run()'; then
+    expectCallers "$TMP/scmut" run 'build@kt/Use.kt kick@kt/Use.kt ' "15k mutation: s.run() with no lambda binds Job.run again (the arm keys on the trailing lambda, not the name)"
+else
+    no "15k mutation: the s.run { } -> s.run() edit did not apply — the arm would be inert"
+fi
+
+# JAVA INVARIANT (the §14c pattern): a Java-only tree, then the same tree plus the Kotlin scope shapes. Every Java caller row
+# of the Java definitions named below, and every Java row of the full map, must be exactly what the Java-only tree gave.
+cp -R "$SC/jo" "$SC/jk"; mkdir -p "$SC/jk/kt"; cp "$SC/b/kt/Scopes.kt" "$SC/jk/kt/"; cp "$SC/a/kt/Use.kt" "$SC/jk/kt/"
+javaCallers(){ "$BIN" "$1" --callers="$2" --no-cache 2>/dev/null | grep -oE '<s t="[a-z]*" n="[^"]*" p="[^"]*\.java:[0-9]+"' | LC_ALL=C sort | tr '\n' ' '; }
+jmoved=""; jcount=0
+for target in Job.java:run Builder.java:with Builder.java:apply Builder.java:let Builder.java:also; do
+    a="$( javaCallers "$SC/jo" "$target" )"; b="$( javaCallers "$SC/jk" "$target" )"
+    [ -n "$a" ] && jcount=$(( jcount + 1 ))
+    [ "$a" = "$b" ] || jmoved="$jmoved $target"
+done
+if [ "$jcount" -eq 5 ] && [ -z "$jmoved" ]; then
+    ok "invariant: adding the Kotlin scope shapes moved NO Java caller row (Job.run, Builder.with/apply/let/also each keep their Java caller)"
+else
+    no "invariant: Java caller rows moved or were empty (populated targets: $jcount of 5; moved:${jmoved:- none})"
+fi
+"$BIN" "$SC/jo" --top-k=100000 --no-cache > "$TMP/jo.xml" 2>/dev/null
+"$BIN" "$SC/jk" --top-k=100000 --no-cache > "$TMP/jk.xml" 2>/dev/null
+read -r jrows jdiff <<< "$( python3 - "$TMP/jo.xml" "$TMP/jk.xml" <<'PYEOF'
+import sys, xml.etree.ElementTree as ET
+def java_rows(path):
+    raw = open(path, encoding="utf-8", errors="replace").read()
+    root = ET.fromstring(raw[raw.find("<r "):])
+    rows = set()
+    for f in root.iter("f"):
+        if not f.get("p", "").endswith(".java"):
+            continue
+        for s in f.iter("s"):
+            key = (f.get("p"), s.get("t"), s.get("n"), s.get("id") or "")
+            rows.add(key + ("amb", s.get("amb") or ""))
+            for c in s.iter("c"):
+                rows.add(key + ("c", c.get("n"), c.get("prov") or ""))
+    return rows
+a, b = java_rows(sys.argv[1]), java_rows(sys.argv[2])
+print(len(a), len(a ^ b))
+PYEOF
+)"
+if [ "${jrows:-0}" -gt 0 ] && [ "${jdiff:-x}" = 0 ]; then
+    ok "invariant: the full map's $jrows Java rows (edges, prov=, amb=) are identical with and without the Kotlin files"
+else
+    no "invariant: the map's Java rows moved (rows=${jrows:-?}, symmetric difference=${jdiff:-?})"
+fi
+
+# DETERMINISM: a warm run from the cache equals a cold run, two cold runs are byte-identical, and the XML is well formed.
+mkdir -p "$TMP/scd_warm"
+"$BIN" "$SC/b" --top-k=100000 --no-cache > "$TMP/scd_cold.xml" 2>/dev/null
+"$BIN" "$SC/b" --top-k=100000 --no-cache > "$TMP/scd_cold2.xml" 2>/dev/null
+TMPDIR="$TMP/scd_warm" "$BIN" "$SC/b" --top-k=100000 > "$TMP/scd_w1.xml" 2>/dev/null
+TMPDIR="$TMP/scd_warm" "$BIN" "$SC/b" --top-k=100000 > "$TMP/scd_w2.xml" 2>/dev/null
+if cmp -s "$TMP/scd_cold.xml" "$TMP/scd_cold2.xml" && cmp -s "$TMP/scd_cold.xml" "$TMP/scd_w1.xml" && cmp -s "$TMP/scd_cold.xml" "$TMP/scd_w2.xml"; then
+    ok "determinism: cold run, second cold run and warm runs (cache written, then served) are byte-identical"
+else
+    no "determinism: the scope tree's cold, warm or repeated runs differ"
+fi
+if xmllint --noout "$TMP/scd_cold.xml" 2>/dev/null && xmllint --noout "$TMP/sc_a.xml" 2>/dev/null; then
+    ok "determinism: the map XML of the scope trees is well formed (xmllint --noout)"
+else
+    no "determinism: xmllint rejects the scope tree's map XML"
+fi
+
 # ─── Summary ──────────────────────────────────────────────────────────────────
 echo
 if [ "$fail" -eq 0 ]; then
diff --git a/test/langidentity/ratchet.tsv b/test/langidentity/ratchet.tsv
index 74414f830..827ff10c6 100644
--- a/test/langidentity/ratchet.tsv
+++ b/test/langidentity/ratchet.tsv
@@ -15,7 +15,9 @@
 #   ingest_sidecap.h's Rust member-root arm moved to the call-result family. No other train-30 lane added or removed one.
 # 339 -> 335 (train 32a, recount on the merged tree): lane rust-receivers removed three (its Java / C# / Kotlin / Swift hook
 #   rows; the lane wrote 336), and main at f156be85 already counted 338 against its 339 ceiling. Lane member-names adds none.
-ceiling	335
+# 335 -> 333 (train 36, recount on the composed tree #431 + #438 + #437 over train 35): train 35's head counted 335; the
+#   composed tree counts 333 (net two fewer shared-file predicates from the merged branches).
+ceiling	333
 perlang	ingest_elixir.h
 perlang	elixir_resolve.h
 perlang	ingest_clojure.h
diff --git a/test/pyimportprecisecheck.sh b/test/pyimportprecisecheck.sh
index 5769a8f00..31494b1bf 100755
--- a/test/pyimportprecisecheck.sh
+++ b/test/pyimportprecisecheck.sh
@@ -205,7 +205,7 @@ if python3 - "$TMP/pn.fresh" "$TMP/pn.bin" "$ROOT" <<'PY'
 import copy, pathlib, re, struct, sys, xml.etree.ElementTree as ET
 from collections import Counter
 
-# readFileRecord/writeBind in ingest_cache.h, lean cache v40 (train 34: 39 -> 40 appended LocalBindKind::JsRebind only, a JS/TS record no Python fixture writes; train 33: 38 -> 39 moved the number only, above every live 38; lane l6-iface fix round 1: 37 -> 38 appended LocalBindKind::ImplBlock only;
+# readFileRecord/writeBind in ingest_cache.h, lean cache v43 (train 36: 40 -> 43, #155 appends a `trailingLambda` u8 to every RawRef after `forwarded`, taken below; train 34: 39 -> 40 appended LocalBindKind::JsRebind only, a JS/TS record no Python fixture writes; train 33: 38 -> 39 moved the number only, above every live 38; lane l6-iface fix round 1: 37 -> 38 appended LocalBindKind::ImplBlock only;
 # lane l6-iface: 36 -> 37 appended LocalBindKind::DispatchType only, no
 # record layout change; train renumbers) (train 30: 34 -> 36 moved the number only, above three lanes'
 # 33/33/35; name-template-dispatch: 32 -> 35 appended RefRole::Pattern = 11 only; fcall-forward: a RawRef appends the `forwarded` u8 after memberFactory; call-result-typing: a bind record gains two u8 after isFromAssignment, resultIndex and unwrapDepth, which a
@@ -214,7 +214,7 @@ from collections import Counter
 # string searches: walk the counted arrays and require complete file coverage, clean parse health and exact EOF.
 blob = pathlib.Path(sys.argv[2]).read_bytes()
 endian = '<' if sys.byteorder == 'little' else '>'
-assert blob[:4] == b'CTPK' and struct.unpack_from(endian + 'I', blob, 4)[0] == 40, 'update the cache walker for a new layout'
+assert blob[:4] == b'CTPK' and struct.unpack_from(endian + 'I', blob, 4)[0] == 43, 'update the cache walker for a new layout'
 table, count = struct.unpack_from(endian + 'QI', blob, len(blob) - 24)
 assert count == 5 == struct.unpack_from(endian + 'I', blob, 21)[0], 'all five fixtures must be cached'
 assert table + count * 32 == len(blob) - 24, 'cache table bounds'
@@ -244,7 +244,7 @@ for i in range(count):
         string(); string(); take(13)  # argCount is serialized u32, narrowed by u16Of32 on read
         for _ in range(4):
             string()  # memberRoot/memberPath/memberCtor/memberVia
-        take(2)  # memberFactory, forwarded (fcall-forward)
+        take(3)  # memberFactory, forwarded (fcall-forward), trailingLambda (#155)
         if inherit:
             take(4)  # baseBind
     incs = []
diff --git a/test/qschemetrip.hash b/test/qschemetrip.hash
index 1db263ca9..b4fad624d 100644
--- a/test/qschemetrip.hash
+++ b/test/qschemetrip.hash
@@ -1 +1 @@
-ec5455c6c9bcf87e8a617d937aa6fc94c039111cd7ae573b813e059b451ca188
+f7bd2b616ac79475a182b01090743358250f1f89842f2101ea7fcd70fa40f40a
diff --git a/test/qschemetripcheck.sh b/test/qschemetripcheck.sh
index 9afaaf79d..629217dec 100755
--- a/test/qschemetripcheck.sh
+++ b/test/qschemetripcheck.sh
@@ -34,6 +34,20 @@ SRC="$ROOT/src/quality.h"
 ING="$ROOT/src/ingest_cache.h"   # extraction-identity constants moved here (2026-08-29 ingest.cpp section split); the hashed CONCAT label keeps its historical spelling so the pin holds
 PIN="$ROOT/test/qschemetrip.hash"
 # RE-PIN LOG (the pin is a bare hash, so its justification has to live here).
+# 2026-10-25, train 36 (#431, #438, #437 merged onto integration/train-35 5b7924e0): RE-DERIVED ONCE with UPDATE_GOLDEN=1 on the
+#   composed tree (the two branch pins 89afd39c… / 957e1fb2… conflicted -> f7bd2b61…). Watched text: kParserVer 228 -> 231 (rich 232)
+#   and kCacheVersion 41 -> 43 (above main / train 35 226 / 40, #438's placeholders 228 / 41, lane rust-degraded's 229 / 42), both
+#   mirrors with them; kQSnapCacheScheme 23 -> 24 (above #437's placeholder 23); #437's quality.h functions and #438's langfacts column.
+# 2026-10-25, #155 (Kotlin scope functions, fix/155-kotlin-scope-fns): RE-DERIVED ONCE with UPDATE_GOLDEN=1 (ec5455c6c9…ca188
+#   -> the pin above). Watched text: kParserVer 226 -> 228 and kCacheVersion 40 -> 41 — both PLACEHOLDERS
+#   above every live value (the train renumbers them), with quality.h's two mirrors moved in the feature commit. The
+#   kMinRefRecordBytes 60 -> 61 change rode with them. kQSnapCacheScheme stays 22: no watched quality.h function moved.
+# 2026-10-25, #437 maintainer finish (#228): RE-PINNED ONCE with UPDATE_GOLDEN=1 (e0519551… -> 957e1fb2…) after pythonFrameworkInvokedSymbol
+#   gained the pytest xunit hooks (kXunitHooks, shared with pythonRunnerRoot) and pythonReceiverParameters / pythonDispatchRequests moved
+#   from the frameworkEntryHooks fact to its own closureReceiverDispatch fact (no behavior change). kQSnapCacheScheme stays 23, the
+#   PR's placeholder: the train renumbers it and re-pins again.
+# 2026-10-24, #228 (Django/unittest hooks, closure self-dispatch): RE-PINNED with UPDATE_GOLDEN=1 after isDeadCandidate gained
+#   pythonFrameworkInvokedSymbol and pythonMethodOwners / pythonDispatchRequests gained the closure host. kQSnapCacheScheme 22 -> 23.
 # 2026-10-24, train 34 (lean2b, fc2-lego-extparent, honest-lex, ind4b-k5-tighten-k5c, hop1, fc3-js-rebind merged onto main
 #   7abad955): RE-DERIVED ONCE with UPDATE_GOLDEN=1 on the merged tree (3e88ca157f…36842 -> ec5455c6c9…ca188). Watched text:
 #   kParserVer 224 -> 226 (rich file tag 227; above main / #432 224 / 225, lane ind4b's placeholder 224, lane ind5-glob-imports
diff --git a/test/qualitycheck.sh b/test/qualitycheck.sh
index b9b011701..2f454a5cc 100755
--- a/test/qualitycheck.sh
+++ b/test/qualitycheck.sh
@@ -463,6 +463,221 @@ else
     no "Python inherited self/cls hooks were classified dead or the orphan was hidden"
 fi
 
+# Python test-framework hooks (#228): unittest and Django call setUp/tearDown/setUpClass/setUpTestData and
+# test_* methods by protocol, so the call graph never sees them. Closures inside a method reach the method's
+# self/cls as a free variable. Both must stay live. The orphans are the sensitivity control: the arm must
+# still see real dead code in the same tree.
+if python3 - "$BIN" "$WORK/django-hooks" <<'PYHOOKS'
+import pathlib
+import subprocess
+import sys
+import xml.etree.ElementTree as ET
+
+binary, directory = sys.argv[1:]
+root = pathlib.Path(directory)
+root.mkdir()
+
+def git(*args):
+    return subprocess.run(["git", "-c", "user.name=Fixture", "-c", "user.email=fixture@example.invalid",
+                           "-c", "core.hooksPath=/dev/null", *args], cwd=root,
+                          check=True, capture_output=True, text=True)
+
+def run(*args):
+    return subprocess.run([binary, ".", *args, "--no-cache"], cwd=root, text=True, capture_output=True)
+
+def dead_rows(result):
+    assert result.returncode in (0, 2), result.stderr
+    return sorted(row.attrib["sym"] for row in ET.fromstring(result.stdout).findall("r")
+                  if row.attrib["kind"] == "dead-code")
+
+(root / "app.py").write_text("def main():\n    return 0\n")
+git("init", "-q")
+git("add", ".")
+git("commit", "-qm", "application only")
+
+(root / "tests").mkdir()
+(root / "tests/__init__.py").write_text("")
+(root / "tests/base_case.py").write_text("""from django.test import TestCase
+
+
+class BaseCase(TestCase):
+    @classmethod
+    def setUpTestData(cls):
+        def inner():
+            return cls.make_shared()
+        cls.shared = inner()
+
+    @classmethod
+    def make_shared(cls):
+        return 1
+
+    @classmethod
+    def setUpClass(cls):
+        super().setUpClass()
+
+    def setUp(self):
+        self.value = self.make_value()
+
+    def make_value(self):
+        return 2
+
+    def tearDown(self):
+        pass
+
+    def test_thing(self):
+        self.run_closure()
+        self.run_bound()
+        return self.value
+
+    def testCamel(self):
+        return 3
+
+    def run_closure(self):
+        def inner():
+            return self.closure_hook()
+        return inner()
+
+    def closure_hook(self):
+        return 4
+
+    def run_bound(self):
+        def cb(self):
+            return self.bound_hook()
+        return cb
+
+    def bound_hook(self):
+        return 10
+
+    def never_called(self):
+        return 5
+
+
+def unused_helper():
+    return 6
+""")
+(root / "tests/test_fw.py").write_text("""from tests.base_case import BaseCase
+
+
+class FwCase(BaseCase):
+    @classmethod
+    def make_shared(cls):
+        return 9
+
+    def setUp(self):
+        super().setUp()
+
+    def make_value(self):
+        return 7
+
+    def closure_hook(self):
+        return 8
+
+    def bound_hook(self):
+        return 11
+""")
+(root / "app_helpers.py").write_text("""def test_helper():
+    return 1
+
+
+class Svc:
+    def testThing(self):
+        return 2
+
+    def setup_method(self, method):
+        return 3
+""")
+(root / "tests/test_xunit.py").write_text("""def setup_module(module):
+    return 1
+
+
+def teardown_module(module):
+    return 2
+
+
+def setup_function(function):
+    return 3
+
+
+def teardown_function(function):
+    return 4
+
+
+class TestShop:
+    @classmethod
+    def setup_class(cls):
+        return 5
+
+    @classmethod
+    def teardown_class(cls):
+        return 6
+
+    def setup_method(self, method):
+        return 7
+
+    def teardown_method(self, method):
+        return 8
+
+    def test_buy(self):
+        return 9
+""")
+(root / "plugin_hooks.py").write_text("""import pytest
+
+
+@pytest.fixture
+def shared_resource():
+    return 1
+
+
+def pytest_configure(config):
+    return 2
+""")
+(root / "checks").mkdir()
+(root / "checks/tests.py").write_text("""from django.test import TestCase
+
+
+class ChecksTests(TestCase):
+    def setUp(self):
+        self.ready = True
+
+    def test_one(self):
+        return self.ready
+
+    def testlower(self):
+        return 1
+
+    def runTest(self):
+        return 2
+
+    async def asyncSetUp(self):
+        return 3
+
+    async def asyncTearDown(self):
+        return 4
+""")
+git("add", ".")
+git("commit", "-qm", "django hooks")
+
+# Framework hooks, the closure dispatch, and the subclass overrides must not be dead. The two orphans
+# (never_called, unused_helper) are the control: the arm must still see real dead code in this shape.
+rows = dead_rows(run("--quality-delta=HEAD~1..HEAD"))
+# Negatives: a test* def in application code stays dead (the test-module clause), and a closure that binds self as
+# its own parameter does not keep the host's overrides live (the bound-receiver clause). The pytest xunit hooks in
+# tests/test_xunit.py are live (kXunitHooks, shared with pythonRunnerRoot); the same name in application code
+# (Svc.setup_method) is not.
+# plugin_hooks.py: a conftest hook (pytest_configure) is still reported; the @pytest.fixture beside it is not (the changelog
+# fragment says so, and a decorated def is a value-use: ingest_valuerefs.h emitDecorators).
+expected = sorted(["tests/base_case.py::BaseCase::never_called", "unused_helper", "test_helper", "pytest_configure",
+                   "app_helpers.py::Svc::testThing", "app_helpers.py::Svc::setup_method",
+                   "tests/test_fw.py::FwCase::bound_hook"])
+assert rows == expected, rows
+print("django hooks and closure dispatch stay live; the two orphans gate")
+PYHOOKS
+then
+    ok "Django/unittest hooks (setUp, setUpTestData, test_*) and closure self-dispatch are not dead"
+else
+    no "Django/unittest hooks or closure self-dispatch classified dead (#228)"
+fi
+
 # ── (U) THE UNCHANGED-TREE INVARIANT — a no-op diff must never gate (issue #228, part 1) ──────────────────
 #
 # THE CONTRACT: a working tree whose TRACKED files are identical to HEAD reports regressions="0" gating="0"
diff --git a/test/showcase_capture.py b/test/showcase_capture.py
index 9de230afc..5a49f0e10 100644
--- a/test/showcase_capture.py
+++ b/test/showcase_capture.py
@@ -11,7 +11,6 @@
 ABIN = os.path.join(REPO, "build", "ripwire")
 DIRTY = os.path.join(SCRATCH, "dirty")          # throwaway --local clone with ONE deliberate regression
 AUX = os.path.join(SCRATCH, "aux")
-os.makedirs(AUX, exist_ok=True)
 
 # The capture is a SHIPPED document, so it goes through the SAME public-export scrub docs/COMMANDS.md
 # is built with — imported, not re-spelled, so the two can never drift apart and a new leak shape has
@@ -23,6 +22,10 @@
 except ImportError as exc:
     sys.exit(f"showcase_capture: cannot import the export scrub from docs/docs_commands_build.py ({exc}) — "
              f"refusing to write an unscrubbed capture")
+if not exportscrub.scratch_outside_repo( REPO, SCRATCH ):
+    sys.exit(f"showcase_capture: the scratch dir is inside the repo ({SCRATCH}) — it would publish as ./… paths, "
+             f"not <scratch>; point RIPWIRE_SHOWCASE_SCRATCH outside the checkout")
+os.makedirs(AUX, exist_ok=True)
 
 # --- formatting (defined HERE, above the command table, because the --in=DIR case DERIVES its own
 # --since window from what the PUBLISHED block shows — see chooseInWindow below — and cannot do that
@@ -1014,10 +1017,12 @@ def mustReplace( text, old, new, what ):
 # Root-neutralise the published text: the checkout's absolute path is machine detail, not a claim
 # (same rationale as the --pack-signatures methodology), and the public scrub gate bans home paths.
 # Disclosed here rather than silent, in the order applied:
-#   1. every occurrence of the repo root becomes "."
-#   2. every occurrence of this run's per-run temp dir becomes "<scratch>" — same mechanism, same
+#   1. every occurrence of this run's per-run temp dir becomes "<scratch>" (first: it is the longer,
+#      more specific path) — same mechanism as 2, same
 #      reason: `/var/folders/…/ripwire_showcase_o6h2ey7l/aux/batch2.txt` is one mktemp draw on one
 #      machine, so publishing it dates the document to a directory nobody can reproduce
+#   2. every occurrence of the repo root becomes "." — both via exportscrub.scrub_root, which replaces only
+#      a WHOLE path (a checkout at /w once turned src/wrap into src.rap; showcasecapturecheck arm (S))
 #   3. the shared public-export scrub (exportscrub.scrub): home paths, other temp paths, internal
 #      branch/document names, OWNERSHIP-row identity attributes and git author addresses. The last two
 #      matter most here — --owners and --pr-context read real git history, so a capture of a real run
@@ -1025,7 +1030,7 @@ def mustReplace( text, old, new, what ):
 #      docs/docs_commands_build.py): `top=` on --hotspots is a SYMBOL NAME and survives untouched, as
 #      do ripwire's own `symbol@file.ext` community labels, which have the address shape but are not
 #      addresses. One implementation, shared with docs/COMMANDS.md, so a widened scrub reaches both.
-published = "\n".join(doc).replace(REPO, ".").replace(SCRATCH, "<scratch>")
+published = exportscrub.scrub_root(exportscrub.scrub_root("\n".join(doc), SCRATCH, "<scratch>"), REPO, ".")
 published = exportscrub.scrub(published, "ripwire")
 
 # Refuse rather than write what test/docscommandscheck.sh arm (E) would reject. Note which class is
diff --git a/test/showcasecapturecheck.sh b/test/showcasecapturecheck.sh
index b284e1023..a50bb6379 100755
--- a/test/showcasecapturecheck.sh
+++ b/test/showcasecapturecheck.sh
@@ -30,6 +30,11 @@
 #       drifts onto a line inside a DIFFERENT function exits 0 with a well-formed <at> element naming
 #       the wrong symbol. main's 09-05 and 09-07 captures shipped exactly that — l="1148"
 #       sym="buildGraph" under a rankGraphTeleport demo — and this arm is red on both.
+#   (S) SCRUB BOUNDARY (train 36, #438 review) — the capture replaces the repo root with "." and the
+#       per-run scratch dir with "<scratch>" only where the root is a WHOLE path (not inside a longer one):
+#       a checkout at /w once turned `src/wrap` into `src.rap` and `.github/workflows` into `.github.orkflows`.
+#       Byte-exact over a planted text with ROOT=/w and a scratch dir outside it; a mutation (plain str.replace)
+#       must differ; and the generator refuses a scratch dir inside the repo (it would publish ./… paths).
 #
 # NOTE: the python3 helpers below live in FILES under $TMP, not `<<'PY' ... PY` heredocs inside a `$( )`
 # command substitution — macOS's stock bash (3.2.57, frozen there for licensing reasons) has a long-standing
@@ -634,6 +639,62 @@ EOF
     fi
 fi
 
+# (S) SCRUB BOUNDARY — see the header. The planted text and its expected bytes are files (bash 3.2 note above).
+cat >"$TMP/s_in.txt" <<'EOF'
+$ ./build/ripwire /w --at=/w/src/graph.h:10
+src/wrap.h .github/workflows/ci.yml which.hy /which.hy a/w /w/x/w b "/w" (/w) /w. /w/
+scratch=/tmp/rw_sc_q/aux/b.txt /tmp/rw_sc_qq /w/.github/workflows/ci.yml
+EOF
+cat >"$TMP/s_want.txt" <<'EOF'
+$ ./build/ripwire . --at=./src/graph.h:10
+src/wrap.h .github/workflows/ci.yml which.hy /which.hy a/w ./x/w b "." (.) .. ./
+scratch=<scratch>/aux/b.txt /tmp/rw_sc_qq ./.github/workflows/ci.yml
+EOF
+cat >"$TMP/s_run.py" <<'EOF'
+import sys
+sys.path.insert(0, sys.argv[1])
+import docs_commands_build as ex
+t = open(sys.argv[2]).read()
+if sys.argv[3] == "mutant":
+    out = t.replace("/w", ".").replace("/tmp/rw_sc_q", "<scratch>")
+else:
+    out = ex.scrub_root(ex.scrub_root(t, "/tmp/rw_sc_q", "<scratch>"), "/w", ".")
+sys.stdout.write(out)
+EOF
+if python3 "$TMP/s_run.py" "$ROOT/docs" "$TMP/s_in.txt" fixed >"$TMP/s_got.txt" 2>"$TMP/s_err.txt" && cmp -s "$TMP/s_got.txt" "$TMP/s_want.txt"; then
+    ok "(S) scrub boundary: ROOT=/w + an outside scratch dir scrub byte-exact (src/wrap, .github/workflows, which.hy, a/w kept)"
+else
+    no "(S) scrub boundary: ROOT=/w output differs from the expected bytes: $( diff "$TMP/s_want.txt" "$TMP/s_got.txt" 2>&1 | head -6 | tr '\n' '|' ) $( tail -1 "$TMP/s_err.txt" )"
+fi
+python3 "$TMP/s_run.py" "$ROOT/docs" "$TMP/s_in.txt" mutant >"$TMP/s_mut.txt" 2>/dev/null
+if ! cmp -s "$TMP/s_mut.txt" "$TMP/s_want.txt" && grep -q 'src\.rap' "$TMP/s_mut.txt"; then
+    ok "(S) mutation control: a plain str.replace scrub produces src.rap (the arm can fail)"
+else
+    no "(S) mutation control: the plain-replace mutant matched the expected bytes — (S) proves nothing"
+fi
+cat >"$TMP/s_inside.py" <<'EOF'
+import sys
+sys.path.insert(0, sys.argv[1])
+import docs_commands_build as ex
+r = sys.argv[2]
+cases = [(r + "/build/sc", False), (r + "/../elsewhere_sc", True), (r + "_sc", True), ("/tmp/rw_sc_q", True)]
+bad = [c for c, want in cases if ex.scratch_outside_repo(r, c) != want]
+print("BAD " + " ".join(bad) if bad else "OK")
+EOF
+sOut="$( python3 "$TMP/s_inside.py" "$ROOT/docs" "$ROOT" 2>&1 | tail -1 )"
+if [ "$sOut" = "OK" ] && grep -q 'scratch_outside_repo( *REPO, *SCRATCH *)' "$SCRIPT"; then
+    ok "(S) a scratch dir inside the repo is refused (scratch_outside_repo: inside / sibling-prefix / outside cases; the generator calls it)"
+else
+    no "(S) scratch-inside-repo refusal missing or wrong: $sOut"
+fi
+# The arms above call scrub_root directly; they cannot see the generator go back to a plain replace. Pin the call site: both the
+# scratch dir and the repo root go through exportscrub.scrub_root, and no .replace( REPO / SCRATCH ) is left in the generator.
+if grep -qE 'scrub_root\(.*SCRATCH, *"<scratch>"\), *REPO, *"\."' "$SCRIPT" && ! grep -qE '\.replace\( *(REPO|SCRATCH)\b' "$SCRIPT"; then
+    ok "(S) the generator scrubs the scratch dir and the repo root through scrub_root (no plain .replace( REPO / SCRATCH ))"
+else
+    no "(S) showcase_capture.py no longer routes the root and scratch scrub through exportscrub.scrub_root"
+fi
+
 echo
 if [ "$fail" -eq 0 ]; then
     echo "ALL PASS"
diff --git a/test/type3clonecheck.sh b/test/type3clonecheck.sh
index 8234ba1e6..8b0bc6291 100755
--- a/test/type3clonecheck.sh
+++ b/test/type3clonecheck.sh
@@ -89,7 +89,7 @@ BIN="${1:-${RIPWIRE_BIN:-$ROOT/build/ripwire}}"
 [ "${BIN#/}" = "$BIN" ] && BIN="$ROOT/$BIN"
 [ -x "$BIN" ] || { echo "  FAIL  PART 2 needs a ripwire binary at $BIN (build first, or set RIPWIRE_BIN)"; exit 2; }
 p2fail=0
-p2ok(){ printf '  PASS  %s\n' "$*"; }
+ok(){ printf '  PASS  %s\n' "$*" || { p2fail=1; printf '  FAIL  could not write the PASS line for: %s\n' "$*"; }; return 0; }
 p2no(){ printf '  FAIL  %s\n' "$*"; p2fail=1; }
 echo "type3clonecheck: PART 2 (grouping + duplication %) BIN=$BIN"
 
@@ -144,21 +144,21 @@ N="$( cl "$W2/noclone" )"
 # first. If the detector found no near-miss pairs in grp/, the grouping arms would pass vacuously.
 t3="$( attr type3 "$G" )"
 [ "${t3:-0}" -ge 3 ] \
-    && p2ok "guard: grp/ yields $t3 Type-3 PAIRS (the grouping arms have something to group)" \
+    && ok "guard: grp/ yields $t3 Type-3 PAIRS (the grouping arms have something to group)" \
     || p2no "guard: grp/ yielded type3=${t3:-none} — expected >= 3 pairs; the grouping arms would be inert"
 
 # ── arm F: every emitted group row carries a gid= ────────────────────────────────────────────────────
 rows="$( printf '%s' "$G" | grep -oE '<group [^>]*>' | wc -l | tr -d ' ' )"
 gids="$( printf '%s' "$G" | grep -oE '<group [^>]*>' | grep -cE 'gid="[0-9]+"' | tr -d ' ' )"
 [ "$rows" -gt 0 ] && [ "$rows" = "$gids" ] \
-    && p2ok "arm F: all $rows group rows carry gid=" \
+    && ok "arm F: all $rows group rows carry gid=" \
     || p2no "arm F: $gids of $rows group rows carry gid="
 
 # ── arm G: UNION-FIND — three mutually-similar bodies collapse to ONE group id, not three ────────────
 distinct="$( printf '%s' "$G" | grep -oE 'gid="[0-9]+"' | sort -u | wc -l | tr -d ' ' )"
 cg="$( attr clone_groups "$G" )"
 if [ "$distinct" = 1 ] && [ "$cg" = 1 ]; then
-    p2ok "arm G: $t3 pairs over three mutual near-copies collapse to ONE component (clone_groups=1, 1 distinct gid)"
+    ok "arm G: $t3 pairs over three mutual near-copies collapse to ONE component (clone_groups=1, 1 distinct gid)"
 else
     p2no "arm G: expected 1 component, got clone_groups=${cg:-absent} with $distinct distinct gid values over $t3 pairs"
 fi
@@ -172,24 +172,24 @@ cp "$W2/dupexact/two.py" "$W2/two/pairA.py"
 T="$( cl "$W2/two" )"
 cg2="$( attr clone_groups "$T" )"
 [ "$cg2" = 2 ] \
-    && p2ok "arm G-mut: two independent clone relations report clone_groups=2 (grouping discriminates)" \
+    && ok "arm G-mut: two independent clone relations report clone_groups=2 (grouping discriminates)" \
     || p2no "arm G-mut: two independent clone relations reported clone_groups=${cg2:-absent}, expected 2"
 
 # ── arm H: the duplication percentage, computed by hand on dupexact/ ─────────────────────────────────
 dl="$( attr dup_loc "$D" )"; tl="$( attr total_loc "$D" )"; dp="$( attr dup_pct "$D" )"
 if [ -n "$dl" ] && [ -n "$tl" ] && [ "${tl:-0}" -gt 0 ] && [ "$(( dl * 2 ))" = "$tl" ]; then
-    p2ok "arm H1: two identical equal-LOC bodies ⇒ dup_loc($dl) is exactly half of total_loc($tl)"
+    ok "arm H1: two identical equal-LOC bodies ⇒ dup_loc($dl) is exactly half of total_loc($tl)"
 else
     p2no "arm H1: dup_loc=${dl:-absent} total_loc=${tl:-absent} — expected dup_loc*2 == total_loc"
 fi
 [ "$dp" = "50.0" ] \
-    && p2ok "arm H2: dup_pct=50.0 on the hand-computed corpus" \
+    && ok "arm H2: dup_pct=50.0 on the hand-computed corpus" \
     || p2no "arm H2: dup_pct=${dp:-absent}, expected 50.0"
 
 # ── arm I: a corpus with no clones reports a REAL zero (none found), not an absent attribute ─────────
 ndl="$( attr dup_loc "$N" )"; ndp="$( attr dup_pct "$N" )"; ncg="$( attr clone_groups "$N" )"
 if [ "$ndl" = 0 ] && [ "$ndp" = "0.0" ] && [ "$ncg" = 0 ]; then
-    p2ok "arm I: a clone-free corpus reports dup_loc=0 dup_pct=0.0 clone_groups=0 (none found, stated)"
+    ok "arm I: a clone-free corpus reports dup_loc=0 dup_pct=0.0 clone_groups=0 (none found, stated)"
 else
     p2no "arm I: clone-free corpus reported dup_loc=${ndl:-absent} dup_pct=${ndp:-absent} clone_groups=${ncg:-absent}"
 fi
@@ -204,10 +204,10 @@ fi
 if printf '%s' "$G" | grep -qE '<clones [^>]*(counts_floor|type3_capped)='; then
     p2no "arm J1: counts_floor=/type3_capped= on a run whose Type-3 pair cap did NOT fire — a floor claim with nothing dropped"
 else
-    p2ok "arm J1: no counts_floor=/type3_capped= when the pair cap did not fire (the counts are not floors on this run)"
+    ok "arm J1: no counts_floor=/type3_capped= when the pair cap did not fire (the counts are not floors on this run)"
 fi
 printf '%s' "$G" | grep -q 'dup_pct=duplicated-LOC' \
-    && p2ok "arm J2: the legend DEFINES dup_pct (numerator, denominator and the per-group counting rule)" \
+    && ok "arm J2: the legend DEFINES dup_pct (numerator, denominator and the per-group counting rule)" \
     || p2no "arm J2: the legend does not define dup_pct"
 
 # ── arm K: determinism + well-formedness of the extended output ──────────────────────────────────────
@@ -215,12 +215,12 @@ G2="$( cl "$W2/grp" )"
 if [ -z "$G" ]; then
     p2no "arm K1: EMPTY --clones output — vacuously identical, not deterministic"
 elif [ "$G" = "$G2" ]; then
-    p2ok "arm K1: two --clones runs byte-identical (determinism)"
+    ok "arm K1: two --clones runs byte-identical (determinism)"
 else
     p2no "arm K1: two --clones runs DIFFER"
 fi
 if command -v xmllint >/dev/null 2>&1; then
-    printf '%s' "$G" | xmllint --noout - 2>"$W2/xl" && p2ok "arm K2: extended --clones output is well-formed XML" \
+    printf '%s' "$G" | xmllint --noout - 2>"$W2/xl" && ok "arm K2: extended --clones output is well-formed XML" \
         || { p2no "arm K2: xmllint rejected the extended output"; sed 's/^/    /' "$W2/xl" | head -3; }
 else
     p2no "arm K2: xmllint missing — cannot verify well-formedness (install libxml2-utils)"