joyful-ii-V-I · Oct 11, 2026 · Oct 8, 2026 · Oct 8, 2026 · Oct 8, 2026 · Oct 8, 2026
diff --git a/.github/pargates-shard-weights.json b/.github/pargates-shard-weights.json
@@ -274,6 +274,7 @@
 "legendrefcheck.sh": 4.3,
 "legobundlecheck.sh": 10.2,
 "legocheck.sh": 9.6,
+"legotransitivecheck.sh": 2.0,
 "lintbudgetcheck.sh": 16.7,
 "lintcatalogcheck.sh": 1.7,
 "lintcheck.sh": 3.2,
@@ -293,6 +294,7 @@
 "manifestcheck.sh": 62.9,
 "mapdatasectioncheck.sh": 55.0,
 "mapdiffcheck.sh": 3.3,
+"mapinventorycheck.sh": 2.5,
 "matchcapturecheck.sh": 11.8,
 "matchgrammarcheck.sh": 0.6,
 "maxfilesizecheck.sh": 6.8,
@@ -378,6 +380,7 @@
 "oswin32logiccheck.sh": 30.0,
 "outlinecheck.sh": 1.5,
 "overbudgetcommentcheck.sh": 0.5,
+"ownerhopcheck.sh": 53.2,
 "ownerscheck.sh": 5.2,
 "packcallersharecheck.sh": 0.9,
 "packtaskcheck.sh": 20.8,
@@ -544,6 +547,7 @@
 "spectimingcheck.sh": 1.8,
 "staleackcheck.sh": 6.1,
 "statgatecheck.sh": 10.2,
+"stdmembergatecheck.sh": 10.0,
 "structlayoutcheck.sh": 12.0,
 "sublistcountcheck.sh": 9.6,
 "substrfiltercheck.sh": 42.0,

diff --git a/.ripwire_quality_acks b/.ripwire_quality_acks
diff --git a/CHANGELOG.md b/CHANGELOG.md
diff --git a/CMakeLists.txt b/CMakeLists.txt
@@ -1,7 +1,7 @@
 cmake_minimum_required(VERSION 3.24)
 # The version string lives in exactly ONE place — this project() call. --version (main.cpp)
 # reads it via the generated version.h below; test/versioncheck.sh asserts the two never drift.
-project(ripwire VERSION 0.6.5 LANGUAGES C CXX)
+project(ripwire VERSION 0.6.7 LANGUAGES C CXX)
 
 # ---- language standards (C++23 for our own code / C11 for the vendored C dependencies) ----
 set(CMAKE_CXX_STANDARD 23)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
diff --git a/README.md b/README.md
diff --git a/docs/COMMANDS.md b/docs/COMMANDS.md
diff --git a/docs/EVALS.md b/docs/EVALS.md
@@ -21,7 +21,7 @@ section, and it is not an afterthought.
 | **Co-change / known-item evals** | `--eval`, `--eval-retrieval` (see `bench/ANSWERQUALITY.md`) | Whether the tool surfaces the other files a real historical commit touched; and known-item retrieval across four rankers. |
 | **Ensemble calibration harness** | `bench/ensemblecal/` | Whether `--ensemble`'s four evidence families are actually orthogonal, how often each fires, how stable each is across commits — and the preset ladder derived from that (§9). |
 | **Differential argv harness** | `test/argvdiffcheck.sh` | That a refactor changed *nothing observable*: two binaries, every argv vector, stdout + stderr + exit code byte-identical. |
-| **The gate suite** | `test/regression.sh`, `test/pargates.py` | 678 gate scripts plus the determinism, cache-transparency and golden contracts. <!-- gatecount --> |
+| **The gate suite** | `test/regression.sh`, `test/pargates.py` | 683 gate scripts plus the determinism, cache-transparency and golden contracts. <!-- gatecount --> |
 | **`--quality-delta`** | `src/quality.h` | Ten measured code-quality failure modes, reported only where a change made them worse. |
 
 ### The labeling protocol (why the held-out eval is allowed to disagree with the ranker)
@@ -1160,7 +1160,7 @@ rows are hash-only — and no number resembling it will be reported from it.
 **Window 1 (registered 2026-09-02): VOID for the verdict.** Until issue #381 an unconfigured install resolved every session to `treatment`, so this window had no control arm, and the registered treatment − control difference cannot be computed from it. No verdict is read from it. Its four- and six-week dates (2026-09-30, 2026-10-14) are not readout dates.
 
 **Window 2: the readout clock restarts at the release that ships `arm=auto` as the default.** The rule is unchanged: one readout at four weeks, at least 40 recommended prompts per arm, and one extension to six weeks if the readout is underpowered.
-**Window start:** PENDING (the release that ships `arm=auto` writes its release date here as YYYY-MM-DD)
+**Window start:** 2026-10-11
 
 `bench/routing_ab_report.py` reads the `Window start` line: a date gives the readout date (start + 28 days) and the one-time extension date (start + 42 days); `PENDING` gives no date.
 
@@ -5861,7 +5861,7 @@ four `--quality-delta` shapes, against 2–6 before: this lane closed `sa@key`,
 shapes by absolute legend size and reports the fraction as INFO. A `legend<=payload` arm is
 unsatisfiable on the case these verbs exist to handle well — a clean tree's payload is near-zero by
 construction — so at 40% of a 572 B payload the whole legend would have to fit in 381 B, shorter than
-the list of the ten measured kinds (eleven since 0.6.5). **A ≤40% relative ceiling for `--quality-delta` and ≤50% for
+the list of the ten measured kinds (twelve kinds now, with placeholder and defect-shape). **A ≤40% relative ceiling for `--quality-delta` and ≤50% for
 `--safe-delete`/`--test-gate` were considered and are recorded as UNREACHABLE rather than as missed
 work**: post-fix fractions are 87.0% / 91.4% / 78.8% on the clean cases and 81.4–86.7% wherever
 the payload is real. The same reasoning `test/testgatelegendbudgetcheck.sh` recorded in 2026-08-28.
@@ -5888,7 +5888,7 @@ copy here would be exactly the dialect divergence that gate exists to catch. Com
 tags, wrap, stable-order defaults), seven individually invoked standalone gates (`g1freshcheck`,
 `skillscan`, `htmlexport`, `compresscheck`, `handoffcheck`, `releaseinstallcheck`,
 `taskroutecheck`), and a single loop
-naming **678 gate scripts**, all of which exist on disk. <!-- gatecount -->
+naming **683 gate scripts**, all of which exist on disk. <!-- gatecount -->
 
 `python3 test/pargates.py . ./build/ripwire -j 6` runs the same scripts in parallel so a full
 verification fits in one sitting. It does not modify `regression.sh`.
@@ -6196,7 +6196,7 @@ These are the exact `kind=` strings the binary emits, from `src/quality.h`:
 `complexity` · `verbosity` · `nesting` · `params` · `duplication` · `dead-code` · `api-surface` ·
 `error-masking` · `short-horizon-churn` · `new-clone-of-reused-helper` · `placeholder` · `defect-shape`
 
-The first ten each target a failure mode measured in the literature; `placeholder` (added 0.6.5) is an
+The first ten each target a failure mode measured in the literature; `placeholder` (added 0.6.7) is an
 honesty check on "done" — a stub or TODO the change added — and never gates. `defect-shape` carries four
 facets in `defect=` (`format-arity`, `utf8-cut`, `dedup-first`, `vacuous-assert`), shapes this project's own
 code review kept finding; only `format-arity` gates, and on any origin (new-symbol rows never gate, except
@@ -6220,9 +6220,9 @@ output.
 The verb reports only what a change made *worse*, against git HEAD. `--quality-ack` records a
 reviewed exception; `--ack-only=KIND` scopes it.
 
-### error-masking widened: log-only and rethrow-only (0.6.5) — hand-labelled precision, and which shapes gate
+### error-masking widened: log-only and rethrow-only (0.6.7) — hand-labelled precision, and which shapes gate
 
-`error-masking` counted only an EMPTY handler (empty braces, `pass`, `...`, a comment-only body). 0.6.5 adds
+`error-masking` counted only an EMPTY handler (empty braces, `pass`, `...`, a comment-only body). 0.6.7 adds
 two shapes from `src/handlershape.h`, walked over the same parse the query rows use:
 
 - **log-only** — a BROAD handler (catches everything, or the root error type: `Exception`, `Throwable`,
@@ -6274,7 +6274,7 @@ each, 24 gating across the 40). This repository has no Python/JS handler of eith
 added in that window, so on upgrade its own reports are unchanged; the replay shows the widening costs no
 noise here, not that it finds anything here. The rows the shapes produce were measured on the corpus above.
 
-### placeholder (0.6.5) — what the eleventh kind counts, and a labelled sample
+### placeholder (0.6.7) — what the eleventh kind counts, and a labelled sample
 
 A stub or TODO the change ADDED, counted per enclosing symbol and compared with the baseline like
 error-masking. Every row is `origin="new-symbol"` by construction and never gates. It counts: Rust
@@ -7005,7 +7005,7 @@ Listed because the reason is more useful than the silence.
   shipped**. See `bench/locbench/anchorhop_calib.json`. The mention anchor's reproducible numbers are
   the ablations in §4.
 - **A single round gate-count.** Two in-tree numbers disagree (`test/pargates.py`'s docstring says
-  ~210; `test/argvdiffcheck.sh` says 200+), while the loop in `test/regression.sh` names 678. The <!-- gatecount -->
+  ~210; `test/argvdiffcheck.sh` says 200+), while the loop in `test/regression.sh` names 683. The <!-- gatecount -->
   loop is the authority; the stale docstrings are a known drift. Since 2026-09-10 the number is not
   written by hand anywhere: `docs/gatecount_build.py` derives it from the loop and rewrites every
   published site, `test/gatecountcheck.sh` fails if any of them drifts, and `test/manifestcheck.sh`

diff --git a/docs/LIMITS.md b/docs/LIMITS.md
@@ -17,10 +17,10 @@ it once, marked `×N`.
 
 | total caps | files | caps whose file discloses | caps whose file discloses NOTHING |
 | --- | --- | --- | --- |
-| 240 | 96 | 140 | **100** |
+| 253 | 98 | 149 | **104** |
 
 Plus 7 ranking and apportionment parameters, in their own table below: they are not caps, they
-are not counted as caps, and 240 + 7 is the 247 constants this generator parses out of `src/`.
+are not counted as caps, and 253 + 7 is the 260 constants this generator parses out of `src/`.
 
 ## INDEXING, OUTPUT or BOUNDARY — which half of the answer a cap bounds
 
@@ -38,8 +38,8 @@ None of them truncates anything, so none can be judged by `shown=`/`total=` and
 a disclosure — labelling them OUTPUT would ask for a `capped="1"` that could never honestly fire.
 The distinction was named in review on #108 and the rows below now carry it.
 
-The `class` column below carries that answer where it is known. **132 of 240 caps are classified
-(47 INDEXING, 41 OUTPUT, 44 BOUNDARY); the remaining 108 render `—`, which means NOT YET
+The `class` column below carries that answer where it is known. **139 of 253 caps are classified
+(49 INDEXING, 46 OUTPUT, 44 BOUNDARY); the remaining 114 render `—`, which means NOT YET
 CLASSIFIED — never "neither".** Classifications live in `docs/limits_classes.tsv`, a sidecar with
 a known expiry:
 the tag belongs on the declaration itself, and this file exists only because the round that
@@ -89,7 +89,7 @@ refuse to write, so the column cannot be satisfied by pointing at nothing.
 
 ## Caps, by file
 
-One table for each of the 96 files that declare a cap — the 240 caps counted above, and no parameter.
+One table for each of the 98 files that declare a cap — the 253 caps counted above, and no parameter.
 
 ### `src/abicheck.h`
 
@@ -190,6 +190,9 @@ Discloses: **none**
 | `kMaxRenameProbeFiles` | `32` | INDEXING | HEAD copies one rename probe reads; past it the probe stops (a hint, never a claim) |
 | `kMaxWorktreePaths` | `8192` | INDEXING | — |
 | `kWhereisHits` | `60` | OUTPUT | — |
+| `kWhereisParseMaxBlobs` | `256` | — | — |
+| `kWhereisTextPreviewCapBytes` | `200` | OUTPUT | the printed preview, the ellipsis included |
+| `kWhereisTextWholeMaxBytes` | `300` | OUTPUT | a line up to this prints whole, so a cut drops 100+ bytes |
 
 ### `src/darkflags.h`
 
@@ -323,7 +326,7 @@ Discloses: `capped`, `hosts_capped`
 
 ### `src/forpage.h`
 
-Discloses: **none**
+Discloses: `capped`
 
 | constant | value | class | note |
 | --- | --- | --- | --- |
@@ -359,6 +362,7 @@ Discloses: `importers_capped`
 | constant | value | class | note |
 | --- | --- | --- | --- |
 | `kChaConeCap` | `4096` | INDEXING | per-walk discovery cap, unchanged from the per-call walk |
+| `kImpactFileRollupCap` | `20` | — | — |
 | `kMaxEdges` | `256` | — | total emitted edge cap |
 | `kMaxNodes` | `96` | — | total emitted node cap (§3 size caps) |
 | `kMaxRadius` | `12` | — | — |
@@ -475,6 +479,7 @@ Discloses: **none**
 
 | constant | value | class | note |
 | --- | --- | --- | --- |
+| `kExtendChainCap` | `16` | INDEXING | factory-of-a-factory links the receiver rule follows (nunjucks: 2); past it, no class |
 | `kMaxQualifierHops` | `32` | INDEXING | `a::b::c::…` past 32 segments is not written C++ |
 
 ### `src/ingest_parsepool.h`
@@ -492,6 +497,7 @@ Discloses: **none**
 
 | constant | value | class | note |
 | --- | --- | --- | --- |
+| `kBaseScopeScanCap` | `4096` | INDEXING | statements the unindexed scope scans read (not the index) |
 | `kMaxImportContainerDepth` | `256` | INDEXING | — |
 
 ### `src/ingest_sidecap.h`
@@ -583,8 +589,18 @@ Discloses: **none**
 
 | constant | value | class | note |
 | --- | --- | --- | --- |
+| `kMaxUnservedSelectors` | `16` | — | — |
 | `kRecentRows` | `40` | — | F3: ~45 B a row; the file-level answer, not the file list |
 
+### `src/mapinventory.h`
+
+Discloses: `entries_capped`, `names_capped`
+
+| constant | value | class | note |
+| --- | --- | --- | --- |
+| `kInventoryEntryCap` | `256` | OUTPUT | — |
+| `kInventoryNameCeiling` | `2000` | OUTPUT | — |
+
 ### `src/mcp.h`
 
 Discloses: `hits_capped`
@@ -630,7 +646,6 @@ Discloses: `capped`, `blast_radius_capped`, `calledBy_capped`, `coboost_commits_
 | `kMcpPageValueMax` | `1000000000` | — | == cli.h's kPageValueMax |
 | `kMcpRecallTopKMax` | `1000` | — | — |
 | `kOtherDefCap` | `4` | OUTPUT | disclosure, not a listing — cap the tail |
-| `kRowCap` | `100` | — | — |
 
 ### `src/mention.h`
 
@@ -708,6 +723,7 @@ Discloses: `capped`, `count_capped`, `findings_capped`, `hits_capped`, `importer
 | constant | value | class | note |
 | --- | --- | --- | --- |
 | `kCallHierarchyRowCap` | `40` | — | — |
+| `kCallSitesPerRowCap` | `16` | — | — |
 | `kCochangePartnerCap` | `30` | — | — |
 | `kExternalSurfaceRowCap` | `100` | — | names, by ref count (≈ 5.2 KB on this repo) |
 | `kImportReachRowCap` | `40` | — | — |
@@ -851,6 +867,7 @@ Discloses: `hits_capped`
 | constant | value | class | note |
 | --- | --- | --- | --- |
 | `kGrepCollectionBudget` | `4000000` | — | — |
+| `kGrepLiftRowCap` | `10` | — | a RANKED code+string answer's default window (CLI and MCP alike) |
 | `kGrepMatchedLineMaxBytes` | `512` | — | — |
 | `kGrepTierFileBudget` | `128` | — | hit files classified per call |
 | `kMaxAffixSet` | `8` | — | cap on prefix/suffix set sizes |
@@ -867,7 +884,7 @@ Discloses: **none**
 
 ### `src/serialize.h`
 
-Discloses: `capped`, `calls_capped`, `inc_capped`, `sibs_capped`
+Discloses: `capped`, `calls_capped`, `entries_capped`, `files_capped`, `importers_capped`, `inc_capped`, `names_capped`, `sibs_capped`
 
 | constant | value | class | note |
 | --- | --- | --- | --- |
@@ -879,6 +896,7 @@ Discloses: `capped`, `calls_capped`, `inc_capped`, `sibs_capped`
 | `kForFileTailShownCap` | `24` | — | — |
 | `kForLensDefaultTopN` | `40` | — | — |
 | `kForPayloadBudgetBytes` | `7500` | — | — |
+| `kLegoClosureRowCap` | `200` | OUTPUT | — |
 | `kMaxExpandIncludes` | `24` | — | inc= cap |
 | `kMaxExpandSibs` | `100` | — | sibs= cap — a BLOW-UP GUARD, set above the tail, not a trim of the |
 | `kMaxSig` | `240` | OUTPUT | — |
@@ -984,8 +1002,17 @@ Discloses: `capped`, `coboost_commits_capped`, `terms_capped`
 
 | constant | value | class | note |
 | --- | --- | --- | --- |
+| `kForOwnerHopRows` | `3` | — | — |
 | `kJsonEnvelopeDigitsMax` | `10` | — | — |
 
+### `src/verbs_grep.h`
+
+Discloses: `capped`, `hits_capped`, `importers_capped`, `unindexed_candidates_capped`
+
+| constant | value | class | note |
+| --- | --- | --- | --- |
+| `kGrepHitRefsMax` | `4` | — | — |
+
 ### `src/verbs_lint.h`
 
 Discloses: `capped`, `count_capped`, `ellipsis_capped`, `findings_capped`, `hits_capped`, `rows_capped`

diff --git a/docs/LINEAGE.md b/docs/LINEAGE.md
@@ -81,7 +81,7 @@ left to look like a paper.
 | ONTO — [arXiv:2604.17512](https://arxiv.org/abs/2604.17512) | Genuinely tabular rows re-encode far cheaper as parallel arrays than as repeated per-row markup. | `--format=columnar` (`src/columnar.h`) |
 | Controlled serialization study — [arXiv:2603.03306](https://arxiv.org/abs/2603.03306) | The same compact re-encoding collapses on *nested* data, and the headline savings are measured against pretty-printed JSON — a baseline minified XML already beats. | `--format=columnar` refuses every non-tabular verb with exit 1 instead of degrading quietly; the nested map is never re-encoded |
 | Tokenizer and formatting cost — [arXiv:2508.13666](https://arxiv.org/abs/2508.13666) | A single characters-per-token divisor is 20–35% wrong on code, and the spread is dominated by language, not by the tokenizer. | The per-language calibration behind `est_tokens` — and the decision *not* to vendor a byte-pair table, which would buy exactness for the wrong tokenizer |
-| AI-generated code smells — [arXiv:2605.02741](https://arxiv.org/abs/2605.02741) | Bloat tracks architectural decay almost perfectly, and the named failure modes are god-class growth, inline re-implementation of existing interfaces, and file separation mistaken for cohesion. | Three of `--quality-delta`'s eleven kinds: verbosity, duplication, and new-clone-of-reused-helper (`src/quality.h`) |
+| AI-generated code smells — [arXiv:2605.02741](https://arxiv.org/abs/2605.02741) | Bloat tracks architectural decay almost perfectly, and the named failure modes are god-class growth, inline re-implementation of existing interfaces, and file separation mistaken for cohesion. | Three of `--quality-delta`'s twelve kinds: verbosity, duplication, and new-clone-of-reused-helper (`src/quality.h`) |
 | Agent-code maintainability — [arXiv:2606.21804](https://arxiv.org/abs/2606.21804) | Classical complexity did not predict real agent-code maintenance failures. Contract drift and code growth did. | The api-surface kind in `--quality-delta`, and `--edit-check` as a standalone contract check (`src/editcheck.h`) |
 | Metric feedback into the loop — [arXiv:2505.23953](https://arxiv.org/abs/2505.23953) | Feeding measured complexity back after a failed attempt raised Pass@1 from 12.5% to 35.7%; the oracle has to be re-readable, not just a verdict. | `--quality-delta` reports only what a change made *worse*, itemised, in a form meant to go back into the next prompt |
 | ARISE — [arXiv:2605.03117](https://arxiv.org/abs/2605.03117) | Statement-level definition-use edges exposed as a queryable agent primitive lifted Function Recall@1 by 17 points over an unmodified SWE-agent — the graph's granularity floor, not its ranking, was the binding constraint. | `--slice=SYM[:VAR]` and the rung-2 `--slice-flow` (`src/slice.h`) — per-line def/use rows inside one resolved definition, plus the bounded transitive BFS over reaching-definition edges. **Bounded, and the output says so**: name-based, intra-procedural, no alias analysis, no control dependence, disclosed depth truncation; the paper's three-tier graph API remains a design note. The reference implementation is now published ([FARD-Lab/ARISE](https://github.com/FARD-Lab/ARISE), MIT) and was audited line-by-line against this slicer 2026-08-31 — the core reaching-definition rule matches; the divergences (their traversal is seed-variable-filtered and unbounded, ours chains operand variables under a disclosed bound) are recorded in [`EVALS.md`](EVALS.md) |
@@ -273,7 +273,7 @@ disclosed; it is not a lesson this tool folded, so it does not get a row above.
 
 **Related work, not counted: [NVIDIA SkillSpector](https://github.com/NVIDIA/SkillSpector) (Apache-2.0).** The later
 hardening of `src/skillscan.h` — the `--scan-skill`/`--scan-skills` scanner and the `wrap` pre-install scan — was
-informed by ideas from SkillSpector, surveyed as related work: in 0.6.6, `EXFILTRATE:net-exfil` is graded by whether a
+informed by ideas from SkillSpector, surveyed as related work: in 0.6.7, `EXFILTRATE:net-exfil` is graded by whether a
 credential-shaped source is on the line (issue #353). No SkillSpector code or pattern text is included today. A
 counted lineage row, with exact per-rule attribution, will be added once the planned port of its code-based checks
 lands; until then it is not in the table above, and the counts stay at 49 repositories.