v0.5.0 — trustworthy live map

The live map now claims only what it can back. This release eliminates the false positives that made findings noisy, and adds method-level code intelligence — validated end-to-end by dogfooding against a large real Next.js/Supabase repo.

Added

• Class methods are indexed as symbols (kind: "method", container class in metadata). Method-level questions — "where is getUserRoles defined and who calls it?" — now resolve to real graph anchors with caller edges in context_packet, instead of dead-ending because the symbol index only knew the class shell.
• Near-miss corrections everywhere agents dead-ended. Unresolved symbols in context packets suggest the closest indexed symbols (getUserRole → getUserRoles); file_not_found errors suggest the closest indexed paths (path-prefix ranked, basename fallback). Weak matches stay silent instead of emitting junk.
• Indexer capability stamping. When an older agentmako install shares a project store with a newer one (global MCP server + workspace CLI), re-indexing with the older writer silently downgrades index content; writers now detect this and log a loud warning before proceeding.

Fixed — false-positive elimination

• imports_deps.unresolved and composer import evidence no longer count npm packages, node builtins, or workspace packages as "unresolved" — only relative/re-export edges that should have resolved to indexable source. Asset imports (.scss, .svg, …) excluded from the engine's unresolved-internal-imports finding.
• imports_cycles no longer reports loops closed by import type edges — all 7 cycles reported on the test repo were type-only false positives.
• Query-time alignment diagnostics persist under one answer_diagnostics source, scoped to the files each pass recomputed, so findings resolve when the code is fixed instead of staying active forever. Name-heuristic detectors downgraded from confirmed/high to probable/medium; destructured-parameter misalignment and ambiguous identity-name classification fixed.
• Staleness is now change-based, not clock-based: sha256 gates every mtime comparison (git checkout / touch / format-identical writes no longer read as changes); revision drift is scoped to change sets overlapping what a run analyzed (README edits no longer flip every source stale); wall-clock TTL expiry reports unknown instead of claiming stale, while genuine post-run file changes upgrade a source to stale even within TTL.
• Context packets: backticked prose is no longer a "missing code literal"; lone words like "import"/"reference" no longer trigger blocking graph gates; sentence-initial capitalized words are not symbol anchors; a value covered under one anchor kind covers its siblings.
• git_precommit_check no longer blocks commits for custom hook modules, type-only imports, method calls sharing hook names, or conventionally-named auth wrappers (withApiAuth, requireUser, …).
• Migration-sourced schema snapshots report the live DB as unknown (unverified) instead of permanently stale, ending the per-usage stale-evidence finding flood.
• The Reef daemon self-terminates when orphaned (state home removed or superseded) instead of living forever holding its port and DB handles.

Full details in CHANGELOG.md.

Verification: full tsc -b, all 126 smoke tests, plus live dogfooding on a 2,350-file production Next.js/Supabase repo.