codeweb v0.16.1

Changed

• The repository moved to the codeweb-hq organization. The MCP registry name is now io.github.codeweb-hq/codeweb, and the docs site is at https://codeweb-hq.github.io/codeweb/.

Fixed

• Map Python async def functions and methods. The symbol rule only matched def, so no async function became a node and calls into one were dropped or wired to a same-named function elsewhere (issue #104). SCANNER_VERSION is now 25, so existing caches rebuild.

codeweb v0.16.0

Fixed

• Preserve live outer calls after block-local shadows and keep JSX text out of declaration discovery. Multiline callback bodies retain their enclosing function/arrow extents. Cleanup/campaign proposals no longer include the reproduced live-function and phantom-text cases.
• Resolve simple immutable callable aliases and literal Python decorator dependencies; qualify unsupported callable aliases and decorator factories. Respect parameter/callback bindings and ES namespace export surfaces, including cache invalidation on visibility changes.
• Keep useful partial find/explain/context/risk results on CLI and MCP with shared in-band completeness. Incomplete decision gates remain inconclusive.
• Map supported JSX component renders and known function values, including Python handler registration and JSX event properties. Impact follows reference consumers; direct-call answers expose reference users separately.
• Keep incomplete or dynamic maps and JSX component-like orphans out of deletion proposals. Preserve unresolved-target and ambiguous-call diagnostics through extraction caches.

Added

• Bundle a focused codeweb coding skill for mapped caller inspection, reuse comparison and structural edit verification in Codex. Document the plugin installation path and recognize an installed codeweb-mcp binary in local configuration checks.
• Add opt-in local evidence receipts to context and review. Agents can compare previously mapped callers with a fresh source snapshot and read bounded historical pages. See docs/cli.md.

codeweb v0.15.0

Added

• Explicit pre-edit baselines survive ordinary and automatic graph refreshes. Agents can
  refresh and verify an edit in one diff call, then check repairs against the same baseline.
• Context responses distinguish list/source-evidence limits from graph uncertainty, with
  actionable freshness and recovery information. Local setup diagnostics report installation,
  graph discovery, source freshness and optional-parser availability without changing source.
• First-use instructions include a tested installed-package cycle walkthrough and a
  baseline-preserving MCP workflow.

Fixed

• Diagnostic masking recognizes regex statements after multiline control heads while
  preserving division expressions, avoiding false incomplete-analysis reports.
• Package exclusions keep generated Python bytecode and verification-harness caches out
  of the npm artifact, even after the verification suite has run.
• Refreshing verification rejects baselines without valid node and edge arrays before
  changing the live graph. Baseline parsing and fingerprinting use the same bytes.
• Current documentation count checks include SPEC and recognize formatted counts and
  Codeweb possessive phrasing while leaving dated audit and release records historical.
• Known unsupported same-line JavaScript/TypeScript declaration layouts now carry bounded
  source diagnostics. Gates refuse an unqualified clean verdict when either snapshot has
  detected incomplete analysis. This contains the reported false-clean result; it does not
  claim complete syntax coverage or repair every omitted declaration.
• Gate comments use commit links only when the checkout is clean before and after analysis
  and HEAD is unchanged; otherwise locations remain plain text. Comments include bounded
  evidence and investigation guidance.
• Removed unsupported metadata keys from the shipped hook configuration while retaining
  all three handlers and moving their descriptions into adjacent documentation.

Changed

• Prominent guidance describes mapped-graph limits, exported-symbol exemptions, skipped
  checks, and tested-client scope. Teams availability copy now reflects restricted GitHub
  App access while preserving the ratified planned price and free-local boundary.
• Inconclusive analysis is a non-success result distinct from detected regressions; callers
  must inspect diagnostics rather than interpreting an incomplete comparison as clean.

Documentation

• Updated contributor guidance, operational graph-schema notes, and a documentation index
  describe the required gate, ownership, provenance, freshness and missing data. Audit
  indexes connect historical findings to implementation and verification records.

Verification scope

• Runtime analysis remains deterministic, local and free of required third-party dependencies.
  Optional parser installation is not a substitute for the incomplete-analysis checks.
• Structural results do not establish behavioral correctness. Run the relevant product tests.
  Release-candidate test results and artifact hashes are recorded in the accompanying review.

Also added in product clarity

• Package commands for client setup, local diagnostics, change review, and the existing CI gate.
• Portable change-review HTML with caller evidence, baseline provenance, and explicit analysis limits.
• Report-only gate mode that preserves regression verdicts and still fails on analysis errors.
• A reproducible edit-review demo, a dated Graphify comparison, and pilot and case-study protocols.

Changed

• Public identity: “See what your AI edits affect.” and “Structural checks for AI code changes.”
• Setup uses shared recipes for five clients and shows an observable caller-query check.
• Findings separate body confidence from priority and provide source evidence and an agent task.
• The public Axios demo is re-extracted from a pinned commit with current engine provenance.
• Agent review details are bounded and report omitted counts; supporting HTML retains full evidence.

codeweb v0.14.0

Added

• C and C++ join as first-class languages — 13 native languages ship. Both follow the
  existing per-language contract (langOf + rules, grammar dispatch, regex-tier fallback so the
  AST tier stays optional, fixture-backed extractor suites). tree-sitter-cpp.wasm comes from
  the already-pinned @vscode/tree-sitter-wasm@0.3.1 (ABI 14); tree-sitter-c.wasm comes from
  the tree-sitter org's own GitHub release v0.24.2 (ABI 15) — a second trusted grammar source
  ratified by charter amendment A2, with PROVENANCE.md gaining a source column and a sha256
  per wasm. The language count now propagates to every surface by NAME, gated by
  tests/lang-surfaces.test.mjs, which encodes the live-versus-historical distinction so dated
  records stay untouched.
• The free-forever boundary and the Teams price intent are published. New site pages state
  the ratified contract — anything that runs on one laptop against one repo is free forever;
  money buys hosting, multi-repo aggregation, and human attention — alongside the hosted tier's
  price intent (€10 per active author per month, active author = committed in the last 90 days,
  flat and unlimited). Both pages ride every prose sweep via PROSE_FILES, and
  tests/boundary-pricing.test.mjs pins the wording on both sides of the boundary.
• Two launch pages that argue on re-derivable numbers. An LSP FAQ ("why not just an LSP")
  and a comparison page, both first-class in the site's page table, the sitemap, and
  PROSE_FILES, and both reachable by clicking from the homepage. Every number on them traces
  to a committed receipt; the honesty ledger renders straight from product.json's don't-claim
  list, so a receipt re-run moves the page.
• Three upgrade moments, and the zones that stay ask-free. The gate comment's footer carries
  an org-dashboard line, the trend rail nudges at five or more snapshots in text mode only, and
  the report footer keeps its attribution. The anti-placements are hard rules with tests: never
  in an MCP tool response, never in a hook card, never on an error path, computed only from
  local counters, one line, and suppressible via CODEWEB_NO_PROMO=1.

Changed

• The site and README lead with the deterministic regression gate. The gate is the story;
  the map and graph support it. The ratified identity line is unchanged and still enforced
  verbatim on all four surfaces.
• The gate Action's examples pin a release tag, and gate adoption is observable. Copy-paste
  surfaces name the shipped version instead of @main (the release roll now keeps them
  current), and the weekly acquisition ledger reports the real status of its adoption search
  instead of silently recording a null when the search cannot connect.

Fixed

• Four benchmark instruments repaired, so every number re-derives. node bench/run-all.mjs
  exits 0 again. Every failure was in the instrument, not the product, and all four reproduce at
  pre-release HEAD: the correctness-query oracle dropped ref edges the shipped cycle walk has
  always followed (all five families now measure 0 disagreements over 497,864 comparisons);
  edit-safety imported a module deleted in July and crashed at import, taking six hypotheses
  down with it; the auxiliary harness flagged the footer's hyperlink as a network fetch and
  carried a stale tool-count table; and the performance harness tripped over a /tmp symlink.
  No published number moved as a consequence of the repairs.
• Release drift audit (CLAUDE.md, 150 · Drift Audit) — two claim-bearing corrections.
  product.json's F10 "Sharded subgraphs" (mirrored to the product page) advertised a
  capability whose implementation was deleted on 2026-07-19 by a measured decision recorded in
  bench/results/scale-typescript.json → previous.shardsDecision: the monolithic graph loads
  fast enough at 16k symbols, and the answer-preserving shard contract was never wired to a CLI
  or MCP surface. The feature line is withdrawn rather than restored — the code is gone, and git
  history holds it if a 100k-symbol case ever appears. This resolves charter row C9 the way C8
  was resolved: claim-bearing copy does not ship a feature that does not exist. In the same
  pass, the latency and scaling figures on the honesty ledger and the claim table were refreshed
  from the regenerated bench/results/performance.json — they had been stale in the pessimistic
  direction (worst-case p95 51.9 ms on 3,215 symbols, not 264 ms on 3,201).
• The MCP registry manifest's description said 27 tools while 28 ship. server.json's
  description was the one tool-count surface no sweep read; it now self-heals through the
  release roll like every other mirrored count.

codeweb v0.13.0

Added

• Evidence-backed README proof and acquisition visuals. A compact benchmark strip links its
  three claims to the existing research ledger, three conversion badges lead to the npx trial,
  live demo, and Claude Code install, and a zero-dependency renderer turns completed daily npm
  data into an accessible, mobile-readable line chart near the top of the README. Its large
  headline shows the latest seven completed days while the line preserves the daily trend. The
  scheduled acquisition workflow retains the weekly counter ledger and refreshes the chart
  without a new service, secret, or user-level data. The opening section now exposes the copyable
  npx command, and the quickstart includes a sanitized terminal replay captured from a real
  0.12.0 run against pinned Zod source.
• JSON config-file support (file-level). Imported .json files are now first-class map
  nodes: default imports, named imports (TS resolveJsonModule), namespace imports,
  require('./config.json'), and extensionless require('./config') all resolve to a
  <path>:<module> node — so impact/callers answers cover config edits, mapped json files
  carry staleness stamps (edits and deletions get flagged), and the pre-edit hook cards
  .json edits with the in-repo importer list. File-level by design: json content is never
  parsed — no symbols, no grammar in the loop, determinism untouched — and an orphan json
  file (nothing imports it) never becomes a node, so lock files add no noise. Scan-cache
  format bumps to v18 (one cold re-extract per workspace on upgrade).

Added

• The after-edit gate loop is completable by any MCP client (AC-9). codeweb_refresh
  gains snapshot:true (also refresh.mjs --snapshot): the pre-refresh graph is preserved as
  graph.prev.json, and codeweb_diff's two arguments are now optional — after defaults to
  the discovered graph and before defaults to that snapshot — so the prescribed
  refresh-then-diff loop no longer needs the plugin's shell copy step. A missing snapshot gets
  an actionable remedy naming the exact call.
• codeweb_dependents — the 28th tool (AC-10). The complete "who do I break?" union
  (call + import + inherit + test + ref edges, tagged by kind) was CLI-only; it is now a
  first-class MCP tool derived from the same manifest entry, budgeted with true totals, and
  codeweb_callers points at it for the full-union question.
• Staleness honesty reaches the advisors (AC-11). Every spawned graph-consuming reply now
  carries the call-time staleness verdict (previously only the orient family was annotated —
  codeweb_simulate could pre-flight a refactor from a week-old map with full confidence), and
  the overlap-independent advisors (deadcode, risk, hotspots, break_cycles, reading_order,
  simulate, placement, fitness) joined the auto-refresh set. Overlap-consuming advisors stay
  out by design: refresh drops overlaps, so they get the annotation, never a silent refresh.
• Agent-fallback maps carry their provenance (AC-12). The codebase-anatomy skill's
  meta.engine stamp (hybrid | tools | read) is now read downstream: the briefing payload and
  the session-start injection caveat agent-extracted maps as unverified, instead of answering
  with deterministic-tier authority.

Changed

• Claim values now trace to receipts, mechanically. check-consistency gained
  auditClaimValues: the published headline stats (the 74%/44% recall pair, the ~126×
  impact-cost ratio, the "more than N comparisons" floor) are recomputed from their committed
  receipt files and every surface restating a different value fails the build — closing the
  drift class behind charter C6, where a re-run moved a receipt and every surface silently kept
  the old number. Deliberately out of scope: the ±-form deltas (three legitimate values from
  two receipts share one textual form). The requirements companion gained a one-way parity
  check (a YAML-traced AC id must still exist in SPEC.md); the reverse — new ACs needing trace
  records — is a re-baseline, which stays the operator's requirements process.
• A weekly-vitals workflow is drafted (weekly-vitals.yml): the full gate, prove-red, and
  the bench budget gate on a Monday schedule, so SPEC's kill-criteria tripwires can trip
  between pushes (nothing executed for 18 days straight in August). Merging it is the
  operator's adoption decision, recorded in the file header.
• The evals floor grew from one product case to four (MCP initialize, tools/list carries
  the new tool, query --help), release tooling gained CLI smoke tests (version-sync no-op on
  an aligned repo; screenshot usage-not-stacktrace), bench:all now measures the tools/list
  definitions surface (toolsListBytes — measured, not gated: the descriptions are P1's
  experimental subject), trend --json emits one line (NDJSON-appendable), the impact answer
  states its closure semantics (call+inherit; ref/import/test users via dependents), a dead
  bench helper was removed, the graph schema's additive-only versioning stance is recorded in
  the reference, and the extractor's cache-invariant map got its one page
  (docs/extractor-invariants.md) — measurement over refactoring, per the hotspot ruling.
• The distribution trigger's second arm is finally measurable. The weekly acquisition
  ledger now records gateReposExternal (unique external repos referencing the gate Action in
  a workflow file, via public GitHub code search — same no-telemetry ethics as every counter).
  The parked Teams tier's own trigger (">10 external repos on the gate Action") could never be
  observed firing before.
• The gate Action is stranger-ready. codeweb-ref now really accepts a commit sha (clone
  --branch fails on shas — branch/tag keep the shallow clone, shas fall back to
  clone+checkout); a new history input persists a small cross-PR metrics ledger via the
  Actions cache and renders the structural trend line in the sticky comment (previously the
  trajectory feature was unreachable by adopters); the docs pin the action and codeweb-ref
  to release tags instead of @main and show the monorepo matrix pattern. The self-gate
  dogfoods history.
• The gate joined the product loop. A first map of a repo with .github/ now prints a
  fourth next: line pointing at the CI gate, and every report/demo footer carries a
  "gate your PRs" link — the team-lead doorway existed only in docs before.
• The Marketplace-publish step is gone (charter non-goal 6). Publishing auto-triggered
  whenever a VSCE_PAT secret existed — a secret must not be able to override a standing
  instruction. The .vsix still builds and attaches to every release; the removal is recorded
  in place and pinned by the workflow test.
• Grammar provenance is machine-verified. PROVENANCE.md records a sha256 per vendored
  wasm and tests/grammar-provenance.test.mjs recomputes them (both directions: no digest-less
  wasm, no phantom rows) plus the runtime-pin pairing; the refresh recipe now names the
  ts-engine.mjs version stamp, and release prep inventories @vscode/tree-sitter-wasm@latest
  so the recorded Kotlin/Swift/C/C++ blockers resolve the moment upstream ships them.
• The LSP question is answered on the deciding surfaces (product page + README): an LSP
  answers one hop on demand in an editor session; codeweb builds one deterministic whole-graph
  artifact agents query over MCP and CI diffs to gate a PR. Capability comparison only — no
  invented numbers.
• Non-Claude MCP clients get the full loop, documented. The start page now carries
  per-client registration blocks (Cursor, Windsurf, Codex CLI, Gemini CLI, plugin-less Claude
  Code) and a paste-ready rules snippet that teaches the before/after edit loop — the ambient
  behavior the Claude plugin's hooks provide, for clients that surface neither hooks nor the
  server's built-in instructions. The README names the loop's entry tools and links both.
• D4 closed — the last Spring-Cleaning debt item. codeweb_risk's ranking assembly moved
  into lib/risk.mjs (rankRisk — one truth for the CLI and a future MCP fast path), and
  run.mjs's banner now reads optimize's --json totals instead of scraping its prose (a
  wording tweak used to silently blank the ready/LOC fields; humans keep a rendered headline
  and CODEWEB_VERBOSE=1 shows the full advisory from optimize.md).
• D1 residue closed. reading-order's CLI budget default now derives from the tool
  manifest via budgetOf() (the 40-vs-20 two-literal pair is gone — the manifest is the one
  truth); campaign's deliberate CLI/MCP budget divergence is documented at the site; and the
  release gate now flags a TOOL_BEHAVIOR entry whose manifest spec was removed (dead
  behavior — the reverse already threw at startup).
• The post-edit hook warns once, on one channel. The structural warning rides the
  structured additionalContext only; stderr is the fallback when that write fails — the same
  warning used to arrive twice.
• External-review verdicts now record the reviewed commit (git rev-parse HEAD of the
  clone, first line of the verdict) — an adopt/avoid ruling without the commit it judged was a
  claim without a source.

Fixed

• C7 truth sweep (2026-08-16 drift audit). The charter-ruled-fabricated sponsorship cost
  premise still shipped through surfaces the claims gate never read: the report and demo footer
  tooltips, trend.mjs's five-snapshot rail, and the FUNDING.yml comment. All now carry the
  ratified support framing, single-sourced from product-copy.mjs (SPONSOR_LINE), and the
  gate closes the class — the cost-premise scan now sweeps every prose surface plus
  FUNDING.yml, trend, and the gate comment; the generated artifacts (report template, live
  demo) and the remaining site pages joined PROSE_FILES; and a numeric public claim hardcoded
  in any script outside `p...

codeweb v0.12.0

Added

• MCP-registry publishing is automated (.github/workflows/mcp-registry.yml): every
  published release now submits server.json to registry.modelcontextprotocol.io via GitHub
  Actions OIDC — no browser login, no stored secret. The server name and the npm package's new
  mcpName field carry the canonical io.github.GhostlyGawd/codeweb identity (casing matched
  to the namespace's existing registry listings); this release is the first whose npm tarball
  ships the mcpName ownership handshake the registry requires.

codeweb v0.11.0

Added

• A terminal-editorial redesign of the whole site (owner-approved mock). Near-black paper,
  JetBrains Mono everywhere, a Doto dot-matrix wordmark and numerals, square corners, film
  grain, viewfinder frame — and one accent, spent only on meaning. The homepage opens on the
  live axios map with merge() pre-selected and its 56-function blast radius lit in
  chartreuse; the map itself went dithered (pixel-square nodes, stippled edges, HUD crosshairs).
  Benchmark stats render as pixel-block meters (grep 44% vs codeweb 74%). Fonts are
  self-hosted, same-origin; the social-preview card matches.
• The report UI itself is redesigned to the same system. Domain bubbles became dithered
  square blocks with their symbol count set inside; edges are straight stippled strokes with an
  accent "blast" state, so a selection's impact reads at a glance; the selected node wears the
  accent with a viewfinder frame. The masthead is a mono-caps HUD (pixel glyph, boxed tabs,
  square search and buttons), findings badges are monochrome (accent = high-confidence only),
  and every place a hue used to carry data — domain slots, matrix cells, treemap density — now
  uses a luminance ramp, which survives every kind of color-vision deficiency by construction.
  Dark is the default; light is an explicit paper mode and auto follows the OS. Labels get a
  deterministic screen-space collision cull, so dense graphs stop rendering as label mush.
• A README banner in the brand language (assets/brand/banner.png): Doto wordmark, pixel
  glyph, caps tagline, and a dithered mini-map with one accent-selected node. The pipeline
  SVGs (demo.svg, pipeline.svg) and the homepage stage illustrations are redrawn in the
  same square/stipple/single-accent language.
• An unlisted npm-downloads dashboard at /downloads.html: daily download counts of
  @ghostlygawd/codeweb over time, fetched client-side from npm's public API and drawn as a
  dependency-free SVG. Built with the site but excluded from the sitemap and linked from nowhere.

Changed

• One ratified identity, on every surface (CHARTER.md, new at the repo root, with a
  CLAUDE.md pointer so agents read it first). The job line — "Your agents break less code
  and burn fewer tokens." — now leads the README, the site homepage, tagline, and og titles,
  and the npm / plugin / marketplace / MCP-registry / GitHub-About listings; check-consistency
  reads the line from the charter and fails any of those surfaces if it drifts. External review
  is billed as a feature note, not a second mode. The support copy drops the "AI bills from
  benchmarking" story, ruled fabricated in the charter's interview (C7): sponsoring supports
  the project and sponsors get featured README/site placement, and the enterprise offer
  softens to an email doorway — no price, no SLA claim. docs/ROADMAP.md is rewritten to the
  charter's Now/Next/Not-now with dated corrections, and the two strategy documents carrying
  the fabricated cost premise now open with correction banners.
• The funnel leads with the trial. A "Try it on your repo" section (the npx one-liner) sits
  directly under the README hero, and the homepage hero carries the same command — seeing your
  own repo mapped is the pitch. The axios case study is demoted from a bold callout to a plain
  link under the screenshots. The README masthead drops the hero graphic and the decorative
  engine/MCP/sponsor badges: a text wordmark, the tagline, and three badges (CI, npm, license).
• Every screenshot and the live demo now show the redesigned report. The demo is the same
  committed axios graph re-rendered through the new template (274 product symbols, 8 domains),
  the five README/site screenshots are re-shot from it, the blast-radius caption now states
  what the committed graph actually contains (27 call edges into AxiosError — the old "58
  users" figure doesn't match this artifact), and the injected demo nav matches the HUD
  (caps, square, no pills).
• Plain-language pass over the whole marketing funnel. The README, homepage, and plugin
  listing now state what codeweb is instead of performing the problem — the rhetorical-question
  opener and "Today…" windup are gone, and the proof bullets carry spec-sheet labels
  (Correctness / Duplication / Speed at scale / Agent lift / Limits). Study apparatus left the
  pitch too: the hero's grep-vs-codeweb benchmark table, the "referee"/"oracle" framing, and
  the outbound vite/axios repo links are gone or moved behind the evidence ledger — the pitch
  says what you get; the research page says how it was measured. The proof section is now
  "Benchmarks": benefit-first bullets (callers found 44%→74%, impact answers at 1/126th the
  tokens, renamed-duplicate detection text search can't do) with no meta-talk about our own
  rigor — the 32/33 pre-registration story lives on the research page. Engineering properties
  left the marquee: the DETERMINISTIC · READ-ONLY · ZERO-DEPENDENCY strip is gone from the hero
  (README and hero.svg), and the plugin/marketplace listings say "27 MCP tools" — read-only and
  zero-dep stay where the worry arises, in install and trust copy. Shorter sentences,
  stats stated as outcomes ("+0.31 recall" now reads "with grep agents found 44% of a
  function's callers; with codeweb, 74%. Your agents break code they don't see"), and the
  MCP tool list regrouped by when agents meet each tool (which also
  surfaces codeweb_explain, previously undocumented in the README). Density is now gated:
  marketing paragraphs cap at ~55 words, enforced by tests/copy-density.test.mjs, with the
  voice rules recorded in CONTRIBUTING.md. And the README is a landing page again: its
  reference half — outputs, per-tool docs, the capability table, the full MCP tool groups, the
  component tree — moved to docs/reference.md, linked per-job from the README (which drops
  from ~650 to ~330 lines). Two overclaims corrected:
  the homepage no longer calls 16k+ graphs "measured green" (the expand-all receipt says
  green:false at that scale), and the pre-registration page no longer says the full study
  re-runs in CI (CI re-measures the standing budgets; the study re-runs via bench/run-all.mjs).
  The stale "286-test suite" figure is dropped or time-qualified everywhere it appeared.
• The regression gate is ONE verdict with a declared strictness knob. gateVerdict (graph-ops)
  now backs diff/CI, simulate, the post-edit hook, codemod, and review --gate; payloads carry
  verdict.check (orphan-gate vs call-caller-preflight), exported symbols that lost every
  in-edge are LISTED and flagged exempt instead of silently dropped, and every doc states the real
  rule. simulate/codemod speak for their own check instead of borrowing the gate's.
• run.mjs joins the fleet's stream contract: results (the done block, or the new --json
  one-liner) on stdout, progress on stderr; wrong-path targets exit 2, not the stage-failure code.
• codeweb_context: bodies: "windows"|"full" replaces full's second meaning — full is
  the unabridged-list switch only. Agents wanting whole caller bodies pass bodies:"full".
• One pagination dialect over MCP: offset honored on risk/hotspots/break_cycles,
  nextOffset beside every remaining, reading_order surfaces its truncation, and the MCP layer
  now rejects unknown argument names and non-boolean booleans the way the CLI always did.
• The shared parser coaches: did-you-mean on unknown flags, --flag=value accepted, and the
  no-map cause+remedy is APPENDED to a tool's usage instead of replaced by it.
• One name per concept: "domain" everywhere the report/brief/og said "areas"; deadcode's heading
  hedges up front and shows the annotate --suppress door; "blast radius" defined at the lens,
  settings, and optimize surfaces.

Fixed

• find_similar.count is the true match total again (it reported the capped length), with
  more.remaining when capped.
• Three product-page tool cards rendered the literal word "undefined" (data key drift); the site
  build now fails on a desc-less tool.
• The CI gate action stamped "structural regressions" over setup failures — exit 2 now names the
  shallow-checkout cause and remedy, ci-gate forwards the child's stderr tail, and the quickstart
  bins exit 2 (never the regression code) on old Node.
• codeweb_map failures keep the extractor's escapes-first explanation instead of a beheaded
  stderr tail recommending a flag the tool cannot pass.
• The pre-edit hook no longer returns permissionDecision: "allow" — it is advisory context only.
• The SessionStart hook says one line (once per workspace) on an unmapped repo with source,
  instead of the silence that read as "the plugin doesn't work".
• annotate refuses to invent a fresh .codeweb/ in an unmapped cwd; refresh/fitness/placement/
  codemod resolve graphs through the one loader.
• Docs that lied outside the consistency sweep (README's gitignored "bundled sample", agent-tools'
  stale tool count, tests/README's Node floor, the runbook's test count, marketplace.json's
  version) — corrected and swept from now on; new docs/cli.md tables every bin, flag,
  environment variable, and exit code; new CONTRIBUTING.md.
• site/data/product.json's (currently unrendered) elevator still said "24 deterministic MCP
  query tools" — corrected to 27, and check-consistency now scans every prose string in the
  site data file so this class self-catches.

codeweb v0.10.0

Changed

• The last hand-rolled CLI flag loops now route through the shared parseArgs(spec) (lib/cli.mjs),
  so every front door enforces the one #24 unknown-flag policy — reject with usage, exit 2, never a
  silent positional. explain.mjs and diff.mjs were the live bug: a no-else for (const t of argv) { if (t === '--json') … else if (!t.startsWith('-')) pos.push(t) } swallowed a typo instead
  of erroring, so explain g.json sym --jsno exited 0 as if the run were clean; both now exit
  2 with unknown flag: --jsno and the usage. brief.mjs/coverage.mjs/stats.mjs already
  died on an unknown flag but still hand-rolled the loop (now one spec apiece), and
  bench-ts-engine.mjs swallowed an unknown flag into its target positional — a stray --engine
  became the path (exit 1 "target not found"), the original #24 shape — now exit 2 with usage.
  Accepted flags, positionals, and --help (exit 0) are preserved exactly;
  tests/cli-unknown-flags.test.mjs pins the failing→passing exit codes and the surviving legit
  surface. (round 2, finding #39)
• The post-edit structural-regression hook now extracts IN-PROCESS instead of spawning a child
  node process — the last residual term of the hook fast-path floor. Enabled by #40 making
  extract-symbols importable with a side-effect-free import, the hook lazily
  import()s runExtract (after the inert-fire guard, so a no-op fire still pays nothing) and calls
  it directly, killing the child node boot plus the fragment stringify(child)+JSON.parse(hook)
  round-trip across the process boundary. The symbol-set delta/splice against the #18a baseline
  fragment is runExtract's own warm-cache machinery (WS-D's #17 name-delta path) — the hook adds no
  splice or invalidation logic, so the in-process fire runs exactly what IE-EQUIVALENCE proved
  byte-identical. Measured at the 16.8k-symbol class (median-of-5, this box): no-change fire
  1,089 ms → 698 ms (the forced-spawn path vs in-process on the same corpus; 0 extractor child
  processes vs 1, strace-verified), under the 700 ms floor and down from #18a's 889 ms row. A
  fail-open crash ladder keeps the guarantee: CODEWEB_HOOK_INPROC=0 forces the old spawn (the
  rollback lever), and any throw from the lazy import or runExtract triggers one spawn fallback,
  bumped as hookInprocFallbacks so a silent divergence is ledger-visible. additionalContext is
  byte-identical across both transports (path-parity test). (round 2, finding #18b)
• The symbol extractor is being decomposed into testable, importable pieces (the tracked residual
  of round-1 #25, now actually being closed). Stage 1: per-file call/ref/inherit derivation —
  deriveFileEdges, the precision gate (alias > same-file > unique-in-package, drop-ambiguous, plus
  the short-name / closure-local / role / rb-php filters) — moved verbatim out of the 1,400-line
  orchestrator into scripts/lib/edge-derive.mjs as a createEdgeDeriver(ctx) factory
  (import-resolve's proven template: explicit injected context, zero module-global reach-back). The
  free-variable context was re-derived against the current engine, not the spec-time table:
  injected byName, pkgOf, roleFor (the #10 ref role-gate), resolveFileMember,
  closureLocalIds (the WS-D-review magnet fix), legacyFallback; KEYWORDS/parseSignature/
  isTestFile/buildInnermostIndex are the lib's own pure-module imports; idFile (the id→file
  split) is now defined there as one truth and imported back. Edge derivation is now unit-testable
  in-process at function-call speed (tests/edge-derive.test.mjs, no spawn) while staying
  byte-identical to the old inline function — proven by IE-EQUIVALENCE at 40 trials and a full
  self-map cold+warm byte-cmp. Stage 2: the two remaining global-resolution passes joined the same
  lib as pure functions — markPublicApi (the v10 public-API entrypoint walk, now doing no fs: the
  orchestrator injects readPkg + the statted sources map and applies the returned ids-to-stamp,
  order-safe because the walk never reads pub) and resolveTypedIntents (Java/C# typed-receiver
  dispatch), which mechanically retires the finding's named shadowing smells (rel loop-var vs the
  rel() fn, a files local vs the global). Stage 3: the orchestrator now exposes
  runExtract(opts) and its import is side-effect-free — argv parsing, every process.exit, and
  the --out/stdout writes moved to a main() reached only through the repo's proven
  import.meta.url guard idiom; the guard-path exits became ExtractError throws with
  byte-identical message text (usage / bad-engine / not-found / empty-tree / zero-symbols), which
  main() prints and exits on. Run state that was module-global is now runExtract locals; the WASM
  parser engines stay memoized process-wide (the load promise is single-flighted, so concurrent
  first-calls don't double-init). import('extract-symbols.mjs') now parses no argv, writes no
  files, and never exits — the precondition for the in-process hook (#18b) and for running the
  extractor under node:test's concurrent subtests. Stage 4a: the starter trio of spawn→in-process
  test conversions — incremental-edges (the IE-EQUIVALENCE property sweep, the suite's dominant
  wall term: its ~330-490 child launches at CI depth become function calls, cutting the test's own
  wall ~4.5×, 12.9 s → 2.85 s at 40 trials — every assertion identical, the edged N/M reads moved
  from stderr to the returned banner, the fragment byte-compares to JSON.stringify(fragment), and
  a new IE-INPROC-PARITY spawn keeps the CLI surface pinned byte-for-byte), plus call-apply-chain
  and test-edges (extractor in-process, their query.mjs spawns untouched). Stage 4b: the
  import/edge-precision + language-extraction family (18 more files) went in-process too, clearing
  the plan's bar — 22 extractor-invoking spawn sites retired (the convertible subset dropped
  80→58), and the dynamic extractor child-process launches during the incremental-edges run drop
  from 116 to 1 at 10 trials (≈382→1 at 40-trial CI depth). Non-extractor spawns (query.mjs,
  context-pack.mjs) and the CLI-surface owners (cli-front-door, empty-target) stay spawn-based.
  (round 2, finding #40)
• "Expand all symbols" no longer freezes the main thread: the force sim now seeds compactly, has a
  real long-range term, and runs in interruptible slices so no single task blows a frame — plus the
  receipt that judges it is measured honestly. The old anneal packed every symbol onto its area
  bubble (radius-14 hatch) and repelled only within a 3×3 grid neighborhood, so the ONLY way the
  layout could spread was an accidental ±185k-px explosion whose first step was one ~1.2s synchronous
  task at 16.8k. Now symbols seed on a golden-spiral phyllotaxis hatch (near-equilibrium spacing), a
  Barnes-Hut-lite far-field monopole (per-cell mass + center of mass, pushing every node from each
  non-adjacent cell, with a 2×CUT coarsening latch when live cells exceed 4096) gives repulsion its
  missing long-range term, and gStep became gStepChunk(deadline) — a cursor-driven state
  machine that accumulates forces across slices with the grid/aggregate snapshot frozen per logical
  step and exactly ONE integrate + alpha-decay per completed step, so slicing changes only WHEN work
  runs, never the arithmetic (bitwise-equal to a whole-step run — pinned in the lab). gTick and the
  reduced-motion loop drive it against their budgets; motion-safe settles now redraw at most once per
  second as discrete progress stills. The result at 16.8k (node sim lab, bench/experiments/report-sim-lab.mjs):
  the worst single uninterruptible task drops from 774 ms → 93 ms (≤ the 250 ms no-freeze floor) and
  the ±185k spread compacts to ~230k px, while the per-step settled cost stays ~270 ms — the far
  field is O(n·cells) and reaching the ≤50 ms/frame primary target at this scale needs a hierarchical
  tree (a documented floor, per the finding's fallback: no task > 250 ms + interactive, not a pass).
  The receipt (__codewebStage.expandAll) was rewritten from an unstable 10-frame sample that straddled
  the explosion (508→116→37 ms across back-to-back calls) to a run-to-settle returning
  {settledMsPerFrame, maxSingleStepMs, totalSettleMs, steps}, and report-scale.mjs gates on both
  settledMsPerFrame ≤ 50 and maxSingleStepMs ≤ 250. Layout stays a pure, bitwise-deterministic
  function of (graph, interaction sequence) — seeded, no Math.random, insertion-order iteration.
  (round 2, finding #35)
• The interactive graph's draw loop got substantially cheaper per frame: theme colors are read once
  per draw, edges stroke in exact style batches, and labels are screen-space-gated and capped. Every
  labeled node used to call getComputedStyle (up to one per symbol — 16.8k reads on a full 16.8k
  draw); cvColors() is now hoisted to one call at the top of gDraw (theme flips already redraw, so
  it stays in sync). Edges stroked one beginPath+stroke each (104k strokes at 16.8k); they now
  group into ≤432 exact style buckets keyed state|bubble-pair|min(weight,72) — alpha saturates at
  weight 29 and width at 72, so the key reproduces the old per-edge stroke/width byte-for-byte (a
  50k-edge property test asserts equality), and each bucket strokes once. Labels used a world-space
  radius gate (nd.r > 7.5, so a big node lost its label when zoomed out) with no cap; they now use a
  screen-space gate (nd.r * cam.k > 7.5) and a per-frame cap of 300, picked by a position-independent
  rank (bubbles > selection/search hits > screen radius, tie-break by id) so they never flicker across
  anneal frames. The search highlight set is computed once in refreshHits (stored id/domain Sets) and
  reused by gDraw instead of rescanning the active node set every frame. __codewebStage.drawOnce()
  times ...

codeweb v0.9.0

Added

• Warm refreshes stop paying the AST tax (Spec A). The tree-sitter engine now initializes
  lazily — a cheap availability probe decides cache namespaces and meta stamps up front, and
  the WASM runtime loads only at the first file that actually needs a parse. AST products
  (qualified methods, dispatch edges, exact per-node complexity) ride the scan cache, so a
  warm cached extraction on codeweb itself dropped 1.89s → 0.38s (5×) with byte-identical
  fragments — felt directly by the MCP auto-refresh, the post-edit hook, and every staleness
  check. The banner now reports the tier's state (ast: loaded|idle|off).
• The AST performance gate finally has a committed verdict
  (bench/results/ts-engine-bench.json): cold extraction costs 3.6–4.3× regex
  (~+1.35 ms/symbol, axios + self) — paid once per changed file — and the warm path is
  engine-free, so default-on stands. Also fixes the bench's regex arm, which had silently
  benchmarked tree-sitter against itself ever since the tier went default-on.
• The pipeline memoizes its downstream stages (Spec B). cluster/overlap/optimize/report
  are pure functions of the extracted fragment (+ CODEWEB_* levers), so a re-run whose
  fragment is byte-identical reuses their outputs — wall-time changes, never a byte
  (property-tested modulo the generatedAt stamp). Extract itself now rides the scan cache
  inside run.mjs, making a no-change re-map of codeweb ~0.4s end to end. --full
  forces a recompute.
• Overlap survives monorepo scale — with declared caps. Mapping TypeScript's src/
  exposed two quadratic passes (overlap sat at 100% CPU for 8+ minutes): all-pairs body
  confirmation inside huge same-name groups, and twin seeding through hub labels with
  thousands of callers. Same-name groups now body-confirm on a deterministic 12-node sample
  (the finding's evidence says so), >50-caller hub labels are excluded from twin seeding, a
  200k global pair budget seeds smallest groups first, and 400+-line bodies shingle their
  first 400 lines — every cap counted in the md header. Deterministic, reported, never silent.
• Fixed: an input-dependent HANG in the shared tokenizer. The string-literal regex in
  lib/shingles.mjs ((?:\\.|(?!\1).)*) backtracked exponentially on unterminated-quote
  content — one lone apostrophe in a big real-world body (TypeScript's testRunner fixtures)
  pinned the whole overlap stage at 100% CPU for 15+ minutes. Replaced with a linear-time
  matcher (each char consumed exactly one way) + a regression test; identical semantics.
  Found by the Spec B scale test; this also protects find_similar and the edit-time
  duplication check, which share the tokenizer.
• The scale verdict is committed (bench/results/scale-typescript.json): TypeScript
  src/ — 16,286 symbols, 44,640 edges, 709 files including checker.ts — maps in 43s
  cold, 4s memoized re-run, queries answer in ~200ms on the 13.5MB graph, and the top
  findings are real compiler duplication (substituteExpression ×9, drifted). On that
  evidence lib/shards.mjs is deleted: monolithic graphs hold with 10× headroom, the
  sharding layer had zero consumers, and git history keeps it if a 100k-symbol case ever
  materializes.
• codeweb consolidated itself (bench/results/self-campaign.json): the campaign's three
  product-true merges are executed — findTarget (both hooks; the duplication had hidden
  REAL drift, one hook's language list was seven languages stale), load() (diff/review →
  the canonical loadGraph, with better errors), and edgeKey (break-cycles/diff →
  graph-ops, NUL-separated collision-safe variant). Before/after gate: −22 nodes, −2
  duplication findings, coupling −25, zero structural regressions. The 65 DELETE steps
  are honestly skipped as false orphans (walker closures dispatched through function tables —
  exactly the --orphans cross-check caveat, applied to ourselves).
• npm run bench:all — the standing benchmark suite behind every published number
  (Spec C): pipeline timings, a representative 12-call MCP session (bytes/≈tokens/validity),
  per-tool response budgets, and the ts-engine gate, written to bench/results/benchmarks.json
  (+ a site mirror). A new CI job runs it with --gate: budgets live in bench/budgets.json,
  and breaking one fails the build. check-consistency now also audits that every evidence
  source cited by the ledger and README exists — claims physically can't rot.
• Replay A/B gains cost-to-coverage (Spec D). The workflow runs cells sequentially and
  records each cell's true token cost from the harness's own budget.spent() deltas (never
  solver self-report); the analyzer reports per-condition means and costToFullCoverageTokens
  — the discriminator when both arms hit the coverage ceiling. Old cells without cost report
  null and are counted, not fabricated. Corpus v3 is frozen after nine mining runs across
  six repos (funnels committed as bench/results/replay-mine-*.json): the miner re-derived
  the v2 task independently at a wider follow-up window (identical answer key — the instrument
  reproduces its own ground truth), one new 4-caller candidate was rejected under
  hand-verification (a feature-PR rewrite mentioning the symbol, not a caller fix), and the
  corpus stays at one fully-verified task — honestly. True-breakage tasks are rare; that is
  the finding.
• Role overrides (Spec E). codeweb.rules.json gains roles: [{glob, role}] — heuristics
  can't know a repo's private layout, so the repo says it once and extraction honors it (first
  match wins, invalid roles fail loudly, absent config is byte-identical to before). codeweb's
  own config marks docs/** as generated (it's the built website), completing the
  vite-playground precision lesson on our own map.
• Python, Go, and Rust join the dispatch tier (Spec F). Three vendored pinned grammars +
  dedicated tree walkers wire the calls regex precision-gates away: self.m()/cls.m(),
  Go receiver methods, Rust self.m(), and typed-receiver calls (p: Pipe, q Pipe,
  p: &Pipe) resolved globally under the one-owner rule — ambiguity drops and is counted,
  never guessed. Nodes stay byte-identical between engines; products ride the scan cache.
• Caller-reliance contracts v2 (Spec G). The explain card (and the ambient pre-edit card)
  now also reports: callers that try/catch or .catch() the symbol ("thrown types are
  contract"), callees that mutate a named parameter ("callers share that object"), and callers
  that null-check the result ("keep null/undefined returns possible"). Same conservatism as
  v1 — line-visible evidence or no claim.
• Type-3 (near-miss) clone detection (Spec H). The AST tier fingerprints each function's
  statements (identifier/literal-normalized, order-independent multiset); overlap pairs bodies
  sharing ≥70% of them — reordered or lightly-edited copies the exact and Type-2 passes cannot
  see. A distinct near-miss-clone finding kind, REVIEW-only by construction, bounded and
  deterministic.
• Ruby, PHP, Kotlin, and Swift on the deterministic fast path (Spec I) — eleven native
  languages. Discovery with owner-qualified methods (Ruby def self., Kotlin extension
  fun Type.name, Swift extension members), visibility-as-export per language's own rules,
  comment/string masking, precision-gated calls, test-role detection (spec/, _spec.rb,
  *Test.php, *Tests.swift), and package manifests (Gemfile, composer.json, Package.swift).
  Verified on sinatra (1,173 symbols), monolog (1,622), okio (3,874, mixed Kotlin+Java),
  and Alamofire (2,616) — zero keyword phantoms, deterministic.
• The report closes the loop to the editor (Spec J). The inspector shows Open in editor
  (vscode://file/...) once the viewer supplies their project root — stored in localStorage,
  client-side only, because the shipped report still never embeds the absolute source path
  (the standing privacy invariant, now pinned by a second test).
• npm + VS Code distribution, prepared (Spec J). The package is publish-ready (codeweb +
  codeweb-mcp bins with shebangs, files whitelist, LICENSE, zero runtime deps — verified by
  an npm pack test); the release workflow builds and attaches the .vsix to every GitHub
  Release and carries npm/Marketplace publish steps that no-op until NPM_TOKEN/VSCE_PAT
  are configured. Publishing stays a human decision; the prep is done.

Changed

• The paper program is archived; the receipts stay. paper/ is retired from main:
  the runnable instruments and every frozen result (nulls and the discarded pilot included)
  now live in bench/ as the product's benchmark suite (bench/README.md,
  node bench/run-all.mjs), and the site's Paper page is gone — the evidence ledger on the
  Research page (now including the 2026 blind replay A/B null) plus the CHANGELOG's Research
  notes are the public record. The manuscript, pre-registration (H1–H18), and figure
  apparatus remain in git history, last present at tag v0.8.0. README and ROADMAP
  rewritten to point at receipts instead of the manuscript.

codeweb v0.8.0

Added

• Java and C# call wiring (tree-sitter dispatch tier). The regex engine still finds every
  symbol; for Java/C# files an optional AST pass now adds the call edges regex could never
  claim safely: this.helper() calls inside a class, and receiver.method() calls where the
  receiver's declared type names exactly one class in the repo (two classes with the same name
  → the edge is dropped and counted in the banner, never guessed). Nodes are untouched —
  identical between engines — so determinism holds. Grammars vendored from
  @vscode/tree-sitter-wasm@0.3.1 (scripts/grammars/PROVENANCE.md records the ABI trap that
  rules out the older grammar package). Spec: docs/specs/java-cs-tree-sitter.md.
• The ledger now counts whether advice was FOLLOWED, not just delivered. When a pre-edit
  card names caller files and a later edit in the same session touches one of them (30-minute
  window, once per file, the changed symbol's own file excluded), the ledger bumps
  cardCallersFollowed and the session brief reports "N card-named caller(s) followed" —
  the difference between "we showed advice" and "the advice changed what happened."
  Spec: docs/specs/card-correlation.md.

Research

• The replay miner is tested and honest about its funnel. paper/experiments/replay-mine.mjs
  (mines real commits that changed a function's definition and — per the repo's own later
  fixes — missed caller files) gained a TDD suite on synthetic git histories
  (tests/replay-mine.test.mjs, P1–P5) and a stage-by-stage funnel report. The tests + a
  hand-audit of the first frozen corpus exposed and fixed three miner bugs: a prefilter that
  silently zeroed every Java/C# candidate, a raw def-line comparison that read a prettier
  reformat as a "signature change" (which had produced 2 invalid tasks), and instructions
  truncated mid-hunk at 4KB (now: complete-or-rejected). Spec: docs/specs/replay-corpus.md.
• The replay A/B protocol went blind before spending. The v1 pilot leaked its own answer
  key three ways (the grading list pasted into solver prompts, self-reported coverage, and
  full-history isolation that let solvers read the historical fix commit). It is preserved —
  discarded — in paper/results/replay-ab-pilot.json; the v2 harness solves in a
  history-free export of the base revision and the workflow itself computes coverage as
  filesChanged ∩ missedByChange. Spec amendments: docs/specs/replay-run.md.
• Replay A/B result: both arms at ceiling (honest null). The v2 corpus froze at ONE
  fully-verified task — axios buildFullPath gaining allowAbsoluteUrls, where the real 2025
  change missed 2 of its 3 caller files and axios needed two follow-up PRs (#6810, #6814).
  Blind-replayed 4× per arm: all 8 cells covered both missed files with 0 structural
  regressions — with or without codeweb. On a 3-caller single-package change, a capable
  agent's grep saturates; the historical miss does not reproduce, so ambient context is
  bounded near zero on this task shape. The run proves the instrument (leak-free,
  fixed-function grading, ambient engagement verified in every treatment cell — the card's
  caller list matched ground truth exactly) and shows guarded mining makes true breakage
  tasks RARE: 2 of 3 v1 tasks and the only new candidate died under scrutiny. Discriminating
  between the arms needs many-caller cross-package tasks or cost-to-coverage metrics —
  recorded as the corpus growth path. Full data: paper/results/replay-ab{,-raw}.json.