# ripwire — lineage

Almost nothing in this tool is a new idea. What is new is the *combination*, and the discipline that
holds it together. This document is the row-by-row ledger of where each part came from: the paper,
the specification, or the repository, the one-line lesson taken from it, and the flag or source file
in this tree where that lesson actually lives.

It exists because "inspired by the whole field" is unfalsifiable and "we invented ranked code maps"
is false. Both are cheaper than a table. This is the table.

**The honesty rule this document obeys.** A work is listed as *folded* only if the lesson taken from
it can be named in one sentence **and** pointed at a real flag or source file. Everything else is
*surveyed* — read, catalogued, and not borrowed from. Surveyed is not a weaker form of folded; it is
a different claim, and §3b says so again where it is easy to skim past. Works that were cited during
the research but could not be traced to a shipped decision are named at the end of §2 rather than
padded into the tables — the count is the point, so the count has to be earned.

**A link here is not a dependency and not a debt claim.** No code is copied from any work in §1, §2,
or §3 except where it is vendored, and every vendored library is enumerated with its author and its
licence in [`THIRD_PARTY.md`](../THIRD_PARTY.md). First-party code under `src/` is Apache-2.0; true
third-party code lives under `third_party/` and keeps its own licence. Citing a paper means the idea
was read and applied, not that any of its text or code is here.

**The counts, derived from the tables below:** **42 repositories** and **67 papers** are folded, and
a labelled survey of **237 tools** contributed nothing and says so. **The two sets are disjoint by
construction, so they add rather than nest:** a tool that contributed a lesson gets a row in §3a and
is never repeated in §3b, which makes the field study 42 folded *plus* 237 surveyed — not 42 picked
out of 237. `test/readmedriftcheck.sh` re-derives all three numbers from these tables on every run,
fails if the README's sentence disagrees, and proves the disjointness itself (arm E6) rather than
taking this paragraph's word for it. Arm E9 checks this second restatement of the pair independently
of the bolded one three lines above, after a previous round updated one and not the other.

---

## 1. Classic papers

Ten results, none newer than 2009, that the ranking and quality machinery is built directly on.

| Year | Work | Lesson taken | Where it lives |
| --- | --- | --- | --- |
| 1948 | Shannon, *A Mathematical Theory of Communication* — [doi:10.1002/j.1538-7305.1948.tb01338.x](https://doi.org/10.1002/j.1538-7305.1948.tb01338.x) | Entropy is a sum over a probability distribution — and a floating-point sum is only reproducible if its addends arrive in a fixed order. | `ent=` on `--readability`, summed over the token-text-**sorted** vector so no hash iteration order can reach the output (`src/readability.h`) |
| 1976 | McCabe, *A Complexity Measure* — [doi:10.1109/TSE.1976.233837](https://doi.org/10.1109/TSE.1976.233837) | Complexity is countable from syntax alone: one plus the decision points in a definition. No build, no types. | `cx=` on `--metrics`; the complexity half of `--hotspots` (`src/model.h`) |
| 1981 | Henry & Kafura, *Software Structure Metrics Based on Information Flow* — IEEE Transactions on Software Engineering SE-7(5):510-518 | Information flow has a DIRECTION, and a structure metric that folds reads and writes into one number throws away the half that matters: what a procedure reads is a dependency, what it writes is a hazard for everyone else. | `--nonlocal-state` reports `reads=` and `writes=` as two separate sets and never sums them, down to a per-cell `dir=r|w|rw` (`src/nonlocalstate.h`) |
| 1981 | Weiser, *Program Slicing* — ICSE 1981, extended as [doi:10.1109/TSE.1984.5010248](https://doi.org/10.1109/TSE.1984.5010248) | A slice is fixed by a CRITERION — a program point plus a variable — and the answer is the statements that can affect that variable's value there. The criterion, not the file and not the function, is the unit of the question; backward and forward are two directions over the same criterion, not two features. | `--slice=VAR` and `--slice-flow=back\|fwd`, seeded at a criterion by `--at=FILE:LINE` (`src/slice.h`) |
| 1977 | Halstead, *Elements of Software Science* — Elsevier *(a book, no DOI)* | Volume needs only a TOTAL operator/operand partition, never a per-grammar one: every token falls in exactly one class, so N and η — and therefore V — do not depend on where the line between the classes is drawn. | `vol=` on `--readability`, from one cross-language token-class table; the approximation is disclosed in `--help` and the operator half is reported as `ops=` so a reader can see the split rather than trust it (`src/readability.h`) |
| 1994 | *Okapi BM25* — Robertson, Walker et al. at TREC-3 (1994), in the Robertson & Spärck Jones probabilistic-relevance lineage. The TREC-3 paper has no DOI; the standard citable reference is the later survey, [Robertson & Zaragoza 2009, *The Probabilistic Relevance Framework: BM25 and Beyond*, doi:10.1561/1500000019](https://doi.org/10.1561/1500000019) | Term frequency saturates and long documents must be discounted; raw counts rank badly. | Both lexical rankers, behind `--for` and `--query` (`src/lexical.h`, k1=1.5, b=0.75) |
| 1998 | Page & Brin, *The PageRank Citation Ranking* — [Stanford InfoLab 422](http://ilpubs.stanford.edu:8090/422/) | Importance is a fixed point of who-points-at-whom; a biased teleport vector makes it relative to a query. | The default ranked map and `--rank-by=pagerank` (`src/pagerank.cpp`) |
| 1999 | Kleinberg, *Authoritative Sources in a Hyperlinked Environment* — [doi:10.1145/324133.324140](https://doi.org/10.1145/324133.324140) | One score is not enough: being pointed at and pointing at good things are different kinds of important. | `--rank-by=authority` and `--rank-by=hub` (`src/graph.h`) |
| 2008 | Blondel et al., *Fast unfolding of communities in large networks* — [arXiv:0803.0476](https://arxiv.org/abs/0803.0476) | Modules are recoverable from edges alone by greedy modularity optimisation, cheaply enough to run per invocation. | `--communities`, `--community=ID`, `--zoom` (`src/partition.h`) |
| 2009 | Cormack et al., *Reciprocal Rank Fusion* — [doi:10.1145/1571941.1572114](https://doi.org/10.1145/1571941.1572114) | Rankings fuse on reciprocal rank without score calibration or training — the deterministic way to combine signals. | `--rank-by=rrf` (`src/graph.h`) |

---

## 2. Modern research

Each row changed a decision. Where a paper's finding argued *against* something, the row says so —
several of these are the reason a feature is absent, narrow, or refuses. Two rows run the other way:
the paper argued *for* a mechanism, the measurement here did not reproduce it, and the feature was
rejected rather than shipped on the paper's authority. Those are the LARGER row and the name-versus-body
overlap row — LARGER was rejected before it ever shipped, and the overlap proxy was built, measured on
this repository, and withdrawn. They are the two worth reading first.

Two rows rest on three sources that are not peer-reviewed — a vendor specification, a book, and a
practitioner article. Each is labelled as such in its own row rather than left to look like a paper.

| Work | Lesson taken | Where it lives |
| --- | --- | --- |
| *Lost in the Middle* — [arXiv:2307.03172](https://arxiv.org/abs/2307.03172) | Accuracy swings more than twenty points with *where* the answer sits in the window; a long context can score below no context. | Why the map is ranked and capped rather than dumped: `--top-k`, and `--order` for the position of the important rows |
| LongCodeBench — [arXiv:2505.07897](https://arxiv.org/abs/2505.07897) | For code specifically the effect is not a mild prose degradation but a resolve-rate collapse — roughly 29% to 3% as context grows 32K to 256K. | Budgets are treated as a correctness feature, not thrift: `--token-budget`, `--max-tokens` |
| Context selection for repository-level generation — [arXiv:2503.20589](https://arxiv.org/abs/2503.20589) | Definitions plus invoked-API signatures reached 37.8% Pass@1; adding top-5 *similar snippets* dropped it to 19.6%. Similarity-selected code actively hurts. | No similarity-snippet output exists anywhere in the tool. `--pack-signatures` emits contracts, and `--exemplar` picks by role — fan-in, complexity, test coverage — never by text similarity (`src/exemplar.h`) |
| Agentless — [arXiv:2407.01489](https://arxiv.org/abs/2407.01489) | A three-rung ladder (tree, then skeletons, then bodies for the selected few) localises well with no ML at all: signatures are usually enough to decide what to expand. | The detail ladder: `--tree` → `--pack-signatures` → `--expand` |
| RepoGraph — [arXiv:2410.14684](https://arxiv.org/abs/2410.14684) | Dependency-graph-structured retrieval beats sequence retrieval, and one hop beats two — the second hop adds noise, not recall (k=1 29.7% > k=2 26.0%). | The hop count is exposed as `--around-depth=N`, and the paper's form is `--around-depth=1`. **This landing is partial, and the row says so rather than rounding up to "shipped".** The default is **2**, not the paper's 1 (`src/cli.h`), and `N` is not capped — nothing in the tool enforces the lesson, it only makes it reachable. The research record says `--around` *should* stay shallow, which is an aspiration, not a landed default. The second hop is not cheap on this repository: `--around=buildGraph` returns 31 symbols at depth 1 and 283 at depth 2. Whether the default moves to 1 is an open question, not a settled one |
| cAST — [arXiv:2506.15655](https://arxiv.org/abs/2506.15655) | Never cut mid-construct; pack along syntax boundaries and budget by content, not by lines. | The budgeted packer emits a whole definition or skips it and discloses the skip — it never ships a truncated body |
| HCP — [arXiv:2406.18294](https://arxiv.org/abs/2406.18294) | Full bodies for the head and signatures for the tail costs a fraction of all-bodies and loses almost nothing, provided the dependency edges survive. | `--detail=N`, and the body/signature split inside `--pack-task` (`src/packtask.h`) |
| Adaptive-k — [arXiv:2506.08479](https://arxiv.org/abs/2506.08479) | Cut a ranked list at its largest score gap rather than at a fixed k; the knee moves by more than an order of magnitude between queries. | `--adaptive` |
| LARGER — [arXiv:2605.16352](https://arxiv.org/abs/2605.16352) | Lexical anchors plus confidence-filtered deterministic graph expansion beat plain lexical retrieval on public localization benchmarks, with no embeddings involved. | **The row where a paper argued *for* a mechanism and the measurement said no.** The confidence-filtered anchor-expansion candidate was built, pre-registered against a held-out slice, and scored **+0.41pp** paired with a 95% lower bound of **+0.00pp** — rejected outright by the acceptance gate and never shipped ([`EVALS.md`](EVALS.md) §7, calibration in `bench/locbench/anchorhop_calib.json`). `--anchor` is therefore absent from `--help` and refuses to run without an explicit development environment variable; §8 lists the figure that circulates for it as *not published*. What survived is the paper's cheaper half: query-shape routing, opted out with `--no-route`, and the query-mention anchor, opted out with `--no-mention-boost` (`src/filter.h`, `src/lexical.h`) |
| *Keyword search is all you need* (AAAI 2026) — [arXiv:2602.23368](https://arxiv.org/abs/2602.23368) | Agentic keyword search reaches most of a retrieval-augmented pipeline's quality with no vector store at all. | There are no embeddings in this binary. `--grep`, `--regex` and `--match` are first-class verbs rather than the fallback (`src/search.h`) |
| SWE-bench — [arXiv:2310.06770](https://arxiv.org/abs/2310.06770) | A retrieval claim is only checkable against a target nobody in the loop chose: real issues, the real commits that fixed them, and an execution-validated outcome. It is the reason a number here can be argued with rather than trusted. | The SWE-bench-Lite arm of the agent-in-the-loop pilot and the Multi-SWE-bench C++ `n=121` file@10 scoreboard, in [`EVALS.md`](EVALS.md) and `bench/multiswe/` |
| LocAgent / Loc-Bench — [arXiv:2503.09089](https://arxiv.org/abs/2503.09089) | A strict metric — an instance scores only if **all** gold locations are inside the top k — and a frozen public dataset, so results are comparable rather than self-reported. | `bench/locbench/`, and every localization number in [`EVALS.md`](EVALS.md) |
| ONTO — [arXiv:2604.17512](https://arxiv.org/abs/2604.17512) | Genuinely tabular rows re-encode far cheaper as parallel arrays than as repeated per-row markup. | `--format=columnar` (`src/columnar.h`) |
| Controlled serialization study — [arXiv:2603.03306](https://arxiv.org/abs/2603.03306) | The same compact re-encoding collapses on *nested* data, and the headline savings are measured against pretty-printed JSON — a baseline minified XML already beats. | `--format=columnar` refuses every non-tabular verb with exit 1 instead of degrading quietly; the nested map is never re-encoded |
| Tokenizer and formatting cost — [arXiv:2508.13666](https://arxiv.org/abs/2508.13666) | A single characters-per-token divisor is 20–35% wrong on code, and the spread is dominated by language, not by the tokenizer. | The per-language calibration behind `est_tokens` — and the decision *not* to vendor a byte-pair table, which would buy exactness for the wrong tokenizer |
| AI-generated code smells — [arXiv:2605.02741](https://arxiv.org/abs/2605.02741) | Bloat tracks architectural decay almost perfectly, and the named failure modes are god-class growth, inline re-implementation of existing interfaces, and file separation mistaken for cohesion. | Three of `--quality-delta`'s ten kinds: verbosity, duplication, and reuse-decline (`src/quality.h`) |
| Agent-code maintainability — [arXiv:2606.21804](https://arxiv.org/abs/2606.21804) | Classical complexity did not predict real agent-code maintenance failures. Contract drift and code growth did. | The api-surface kind in `--quality-delta`, and `--edit-check` as a standalone contract check (`src/editcheck.h`) |
| Metric feedback into the loop — [arXiv:2505.23953](https://arxiv.org/abs/2505.23953) | Feeding measured complexity back after a failed attempt raised Pass@1 from 12.5% to 35.7%; the oracle has to be re-readable, not just a verdict. | `--quality-delta` reports only what a change made *worse*, itemised, in a form meant to go back into the next prompt |
| ARISE — [arXiv:2605.03117](https://arxiv.org/abs/2605.03117) | Statement-level definition-use edges exposed as a queryable agent primitive lifted Function Recall@1 by 17 points over an unmodified SWE-agent — the graph's granularity floor, not its ranking, was the binding constraint. | `--slice=SYM[:VAR]` and the rung-2 `--slice-flow` (`src/slice.h`) — per-line def/use rows inside one resolved definition, plus the bounded transitive BFS over reaching-definition edges. **Bounded, and the output says so**: name-based, intra-procedural, no alias analysis, no control dependence, disclosed depth truncation; the paper's three-tier graph API remains a design note. The reference implementation is now published ([FARD-Lab/ARISE](https://github.com/FARD-Lab/ARISE), MIT) and was audited line-by-line against this slicer 2026-08-31 — the core reaching-definition rule matches; the divergences (their traversal is seed-variable-filtered and unbounded, ours chains operand variables under a disclosed bound) are recorded in [`EVALS.md`](EVALS.md) |
| What context does a coding agent need to act — [arXiv:2607.09691](https://arxiv.org/abs/2607.09691) | With localization held constant, skeletons and signatures added nothing to EDITING accuracy, while compressed source matched whole files at roughly a third of the tokens — the map earns its tokens at finding, the bodies at acting. | `--compress` now composes with the body-serving bundles (`--for` auto-bodies, `--pack-task`), disclosed per bundle as `compress="1"` (`src/serialize.h`, `src/packtask.h`); the signature map itself stays a finding surface |
| Agent Retrieval Bench — [arXiv:2607.24882](https://arxiv.org/abs/2607.24882) | Across four retrieval families no single retriever dominates, and none can say when its ranking is untrustworthy — abstention is the unsolved axis. And its trace2code split carries a mechanical fact: real failing-test traces frame the *test*, the answer is the *source* the test exercises. | `confidence=`/`margin_pct=` on every `--for` root, derived from the same relevance-cliff statistic `--adaptive` cuts on so the two can never disagree (`src/main.cpp`); the benchmark's loss buckets then drove `--from-trace`'s disclosed test→source hop (`src/tracelocus.h`), the trace-shaped half of the document-tier demotion (`src/queryshape.h`), and the file-grain tail (`src/serialize.h`). The abstention axis itself stays honestly open: calibrating a refusal threshold on `confidence=`/`margin_pct=` alone was measured against pre-registered bands and **failed** ([`EVALS.md`](EVALS.md), the recorded negative), so no operating point ships. `bench/arb/run_arb.py` is the loss-first instrument against the benchmark itself |
| SWE-Explore — [arXiv:2606.07297](https://arxiv.org/abs/2606.07297) | Exploration is scored at line grain under a hard budget, and three losses there are mechanical, not model-quality: a repository's own meta-prose (issue templates, `CONTRIBUTING`, changelogs) lexically captures pasted bug-report queries; vendored single-file bundles escape path-keyed tiers; and file-grouped, line-sorted serving loses the ranker's true order for any consumer that truncates at a budget. | The bug-report-form half of the query-shape document demotion (`src/queryshape.h`, `src/filter.h`); the vendored-bundle evidence signal, bytes-per-line past `kVendoredBundleLineBytes` demoting the file (`src/filter.h`); the per-row rank fact `r=` and the file-grain `<tail>` so a budgeted reader keeps rank order (`src/serialize.h`). `bench/swex/run_swex.py` is the loss-first instrument; the benchmark's own `eval.py` is the scorer of record, unmodified |
| Compiling corrections into enforcement — [arXiv:2606.13174](https://arxiv.org/abs/2606.13174) | User corrections recur; an agent that only *recalls* them re-pays the lesson, one that meets them at the moment of action does not. | Committed `.ripwire_notes` now surface on `--edit-check=SYM` (`src/editcheck.h`) — the gotcha appears at the pre-change check, not only in retrieval. **Surfacing, not enforcement**: nothing blocks; the paper's compiled runtime rules are not landed |
| Nagappan & Ball, *Use of relative code churn measures to predict defect density* — [ICSE'05](https://www.microsoft.com/en-us/research/wp-content/uploads/2016/02/icse05churn.pdf) | Process history predicts defects at least as well as any static complexity number — complex code that never changes costs nothing. | `--hotspots` is complexity multiplied by git churn; churn is also a ranking signal in its own right, `--rank-by=churn` (`src/gitmine.h`) |
| Gall, Hajek & Jazayeri, *Detection of Logical Coupling Based on Product Release History* — ICSM 1998 *(no DOI recorded here; the paper is indexed under IEEE ICSM'98)* | Two modules can be coupled through change history alone, with nothing in the code to reveal it — so a coupling report that reads only the code is incomplete by construction, not merely imprecise. | The co-change miner and the verb built on it: `--cochange`, and the partner scan behind `--situ` / `--pr-context` (`src/gitmine.h`) |
| Wong, Cai, Kim & Dalton, *Detecting Software Modularity Violations* — ICSE 2011, the **Clio** tool — [doi:10.1145/1985793.1985850](https://doi.org/10.1145/1985793.1985850) | Two things, and the second was missing here for a year. Files that repeatedly change together while no static dependency explains it are a measurable design defect rather than noise — provided the pair clears a support floor first. And a discrepancy is not a violation the *first* time it appears: Clio mines over the last five releases and reports only the ones that **recur**, which is what separates a one-week refactor sprint from an eighteen-month defect scoring the identical `together=`. | `surprising="1"` on `--cochange` over the `together>=3` floor; the recurrence half is `recur=` / `sub_windows=` on every row with `--cochange-recur=K` to filter on it, and the asymmetric confidence (`conf = frq(x₁∪x₂)/frq(x₁)`) is `conf_ab=` / `conf_ba=` / `driver=` — `deg=` is their max, which is what it always was without saying so (`src/gitmine.h`, `src/main.cpp`). Calibrated against the paper's own precision band before shipping, and the result — including what it does *not* measure — is in [`EVALS.md`](EVALS.md) §7 |
| Mo, Cai, Kazman & Xiao, *Architecture Anti-patterns: Automatically Detectable Violations of Design Principles* — IEEE TSE 2019, extending *Hotspot Patterns* — [doi:10.1109/WICSA.2015.12](https://doi.org/10.1109/WICSA.2015.12) *(the TSE extension's own DOI is not recorded here rather than guessed)* | The violation condition is "co-changes above a floor **and** no structural relation in *either* direction" — the symmetry is load-bearing, so the structural check has to run both ways and transitively, not one hop forward. And the reportable unit is the minimal set of **groups** around a core file, not a pair list: a group names the file to fix, where three pair rows leave that implicit. | The symmetric, memoized include closure in `StaticIncludeCoupling::isStaticallyCoupled` (`src/gitmine.h`), shared by the per-file and repo-wide scans — the one-directional one-hop version was a shipped false-positive source and `test/cochangesurprisecheck.sh` pins the fix. The grouping is `--cochange-groups` (`cochangeViolationGroups`, `src/gitmine.h`). **This landing is partial, and the row says so rather than rounding up:** minimum set cover is NP-hard, so what ships is the greedy approximation and the output carries `cover="greedy"` — `groups=` is an upper bound on the minimum, not the minimum the paper defines |
| SonarSource, *Cognitive Complexity* — [specification](https://www.sonarsource.com/docs/CognitiveComplexity.pdf) *(vendor specification, not peer-reviewed)* | Weight by nesting, and do not penalise a flat N-case switch — a readability measure should reward the shape people actually find readable. | `ccx=` emitted alongside `cx=` on `--metrics`, and used ahead of `cx` by `--hotspots` |
| Posnett, Hindle & Devanbu, *A simpler model of software readability* — [doi:10.1145/1985441.1985454](https://doi.org/10.1145/1985441.1985454) (MSR 2011) | The one classic readability model with a published closed form — and it was fitted on snippets of twenty lines or fewer, so what it can honestly produce is an ORDER, never a grade. | `--readability`, which emits P least-readable-first and states the fit range in `--help`. The same lens carries the later evidence that no readability model tracks measured understandability (Scalabrino ASE'17, Trockman MSR'18, Fakhoury ICPC'19), which is why P never gates, never appears in `--quality-delta`, and is never called a verdict (`src/readability.h`) |
| Peitek, Apel, Parnin, Brechmann & Siegmund, *Program Comprehension and Code Complexity Metrics: An fMRI Study* — [doi:10.1109/ICSE43902.2021.00056](https://doi.org/10.1109/ICSE43902.2021.00056) (ICSE 2021) | Halstead **volume** is among the metrics that best track measured cognitive load; the derived difficulty and effort numbers are not. | `vol=` is the only Halstead quantity `--readability` emits — D and E are computed nowhere in the tree (`src/readability.h`) |
| Butler, Wermelinger, Yu & Sharp, *Relating Identifier Naming Flaws and Code Quality* (WCRE 2009) and *Exploring the Influence of Identifier Names on Code Quality* (CSMR 2010) — [oro.open.ac.uk/19224](https://oro.open.ac.uk/19224/) | A useful set of naming flaws is purely mechanical — capitalisation anomalies, consecutive underscores, excessive words, digit-series siblings — each decidable from facts the index already holds, with no dictionary and no model. | Four of the nine `naming-*` rules in `--lint`: `naming-case`, `naming-underscore`, `naming-wordy` and `naming-series` (`src/naminglens.h`) |
| Arnaoudova, Di Penta & Antoniol, *Linguistic antipatterns: what they are and how developers perceive them* — [doi:10.1007/s10664-014-9350-8](https://doi.org/10.1007/s10664-014-9350-8) (CSMR 2013, EMSE 2016) | A name that promises a return contract can be checked against the declared type — but only where that type is actually recoverable, so the rule has to go silent rather than guess. | `naming-predicate` (LAPD A2) and `naming-setter` (LAPD A3), which fire only on a KNOWN return type and stay silent on every unresolvable one — the syntax-only band of `--lint`, owned rather than apologised for (`src/naminglens.h`) |
| Beniamini, Gingichashvili, Klein Orbach & Feitelson, *Meaningful Identifier Names: The Case of Single-Letter Variables* — [doi:10.1109/ICPC.2017.18](https://doi.org/10.1109/ICPC.2017.18) (ICPC 2017), with the effect size from Hofmeister, Siegmund & Holt (SANER 2017), who measured full words read faster than abbreviations or single letters | A single letter costs comprehension by ROLE, not by length: it is conventional and understood as a loop or lambda local, and expensive on anything visible beyond one screen. | `naming-short` is gated by role rather than by scope span — `eligibleSymbol()` admits only Function, Method and module-level Var, so an idiomatic loop or lambda local is never even a candidate (`src/naminglens.h`) |
| Alsuhaibani, Newman, Decker, Collard & Maletic, *On the Naming of Methods: A Survey of Professional Developers* — [arXiv:2102.13555](https://arxiv.org/abs/2102.13555) (ICSE 2021), with the [ICPC 2022 automated scorer](https://doi.org/10.1145/3524610.3527780) | Over 1100 professional developers converge on a concrete ceiling: a method name should be at most five words. | The threshold inside `naming-wordy` — more than five split tokens, not Butler's four and not a tunable (`src/naminglens.h`) |
| Gopstein, Iannacone, Yan, DeLong, Zhuang, Yeh & Cappos, *Understanding Misunderstandings in Source Code* — [doi:10.1145/3106237.3106264](https://doi.org/10.1145/3106237.3106264) (ESEC/FSE 2017), with the in-the-wild prevalence and bug-fix correlation from [MSR 2018](https://doi.org/10.1145/3196398.3196432) | Fifteen validated micro-patterns measurably raise the rate at which a human mispredicts what a snippet does, and each one is small enough to be a single AST shape. | The seven that a tree-sitter pattern can decide from SHAPE alone, shipped as the atoms pack inside `--lint` (`src/atoms.h`). The macro and operator-precedence atoms are named as deliberately out of scope rather than approximated, because a rule that cries wolf is worse than a missing rule |
| MNire and the CIC name-versus-body proxy — [MNire, doi:10.1145/3377811.3380926](https://doi.org/10.1145/3377811.3380926) (ICSE 2020); [Scalabrino et al., doi:10.1109/ICPC.2016.7503707](https://doi.org/10.1109/ICPC.2016.7503707) (ICPC 2016) | **The second row where a paper argued *for* a mechanism and the measurement said no — and the only one anywhere in this document where the feature was built, measured, and then withdrawn.** Overlap between a name's tokens and its body's vocabulary is *non-monotonic* with quality: near-zero overlap is the signature of successful abstraction at least as often as of a lying name, so no threshold on that axis has a defensible direction. | `naming-body-mismatch` was implemented, then measured on this repository's own `src/`: it produced 159 of the lens's 217 naming findings, and the flagged set was dominated by the best-named symbols in the tree (`didYouMean`, `transitiveCallers`, `symbolAdjacency`). It was **withdrawn before the lens landed** — its axis (name↔body vocabulary overlap) is non-monotonic with quality and has no defensible threshold at any cut, full stop, so no direct descendant of it ships. The numbers, the reasoning and a do-not-re-add note are recorded at the top of `src/naminglens.h`, and the substrate the rule needed (`splitIdentifier`, `tokensAgree`) is kept and labelled there rather than deleted |
| Spärck Jones, *A statistical interpretation of term specificity and its application in retrieval* — [doi:10.1108/eb026526](https://doi.org/10.1108/eb026526) (Journal of Documentation, 1972) | A term that occurs in most documents carries little discriminating information; the deficiency is *how rare a term is*, and it composes with corpus size the way BM25's own idf term already does. Crucially the deficiency is one-sided: a RARE term is never penalised, only a common one is ever discounted — which is what gives this axis the defensible direction §9.0a needed and the withdrawn row above did not have. | `naming-uninformative`, §9.0a candidate 1 and `naming-body-mismatch`'s successor: fires only when EVERY split subtoken of a name has low idf over the corpus of eligible identifier NAMES (not body/doc text — a narrower corpus than lexical.h's BM25 one) AND the body clears a size floor. Reuses lexical.h's exact idf expression and `lexSubtokenHash` (`src/lexindex.h`) rather than a second implementation; gated by `test/nameinfocheck.sh` on a hand-controlled corpus where document frequencies are exactly derivable (`src/naminglens.h`) |
| Steidl, Hummel & Juergens, *Quality Analysis of Source Code Comments* — [doi:10.1109/ICPC.2013.6613836](https://doi.org/10.1109/ICPC.2013.6613836) (ICPC 2013); Scalabrino, Linares-Vásquez, Poshyvanyk & Oliveto, *Improving Code Readability Models with Textual Features* — [doi:10.1109/ICPC.2016.7503707](https://doi.org/10.1109/ICPC.2016.7503707) (ICPC 2016), extended in [doi:10.1002/smr.1958](https://doi.org/10.1002/smr.1958) (JSEP 2018) | Two DIFFERENT deterministic, word-level measures of what a comment says, not whether it is fresh: Steidl's c_coeff is the fraction of a comment's words within Levenshtein distance 2 of a word in the method's own name (HIGH is BAD — it means the comment just restates the name); Scalabrino's CIC is the Jaccard overlap between the comment's vocabulary and the method's own identifier vocabulary. NOT the same axis as the withdrawn name-versus-body proxy row above — that compared a NAME against its BODY and was non-monotonic with quality; these compare a COMMENT against the NAME and against the method's IDENTIFIERS, and the direction each takes is stated, not assumed. | `--comment-coherence` emits both, per documented function/method, and states the "HIGH c_coeff is bad" direction in `--help` itself so a reader cannot invert it; UNAVAILABLE (never a zero) where no doc comment exists (`src/commentcoherence.h`) |
| di Biase, Rastogi, Bruntink & van Deursen, *The Delta Maintainability Model: measuring maintainability of fine-grained code changes* — [doi:10.1109/TechDebt.2019.00030](https://doi.org/10.1109/TechDebt.2019.00030) (TechDebt 2019) | Maintainability has to be measured on the CHANGE, not on the tree, or the measure punishes whoever touches pre-existing bad code — and a gate that punishes touching a mess is a gate people route around. Classify only the volume a change MOVED, count removing high-risk code as good, and the number becomes one comparable scalar per commit. | `--dmm`, which scores good/(good+bad) over the three risk properties and contributes exactly zero for a unit whose size, complexity and parameter count did not move — the delta-not-level property is the reason the verb exists (`src/dmm.h`) |
| Kamiya, Kusumoto & Inoue (2002), *CCFinder: a multilinguistic token-based code clone detection system for large scale source code* — [doi:10.1109/TSE.2002.1019480](https://doi.org/10.1109/TSE.2002.1019480) | Normalise identifiers and literals to token classes, then hash: duplication survives renaming, and detecting it needs no types. | `--clones`, and the duplication kind in `--quality-delta` (`src/clones.h`) |
| Component-coupling metrics — Lakos CCD/ACD/NCCD (*Large-Scale C++ Software Design*, 1996 — *a book, no DOI*) and [Martin's Ca/Ce/I/A/D](https://devlead.io/DevTips/PrinciplesOfComponentCoupling) *(practitioner article, not peer-reviewed)* | Both are widely implemented and neither has independent outcome-based validation. A search for one came back empty. | Both are emitted and both are labelled in `--help` as a design heuristic rather than a validated signal, and **neither is ever allowed to gate** — `--deps`, `--arch` (`src/arch.h`) |
| Fowler, *Refactoring: Improving the Design of Existing Code*, 2nd ed. (2018) — Addison-Wesley *(a book, not peer-reviewed, no DOI)* | The **Global Data** and **Mutable Data** smells name this hazard precisely and then stop: prose, no metric, no threshold, no detector. A smell that ships no measurement is an invitation, not a rival. | `--nonlocal-state` is the missing numeric side — the cell universe is exactly "global data" narrowed to what is also mutable (`src/nonlocalstate.h`) |
| Marinescu (2004), *Detection Strategies: Metrics-Based Rules for Detecting Design Flaws* — ICSM 2004 | ATFD (Access To Foreign Data) is the closest existing NUMBER for "reaches into distant state": how many other classes' attributes a class touches. It is one-hop, per-class, Java, and direction-blind. | `--nonlocal-state` is the stated delta from it — per FUNCTION, TRANSITIVE over the call graph, cross-language, and read/write split; the header names ATFD as the nearest prior art rather than implying novelty (`src/nonlocalstate.h`) |
| Bansiya & Davis (2002), *A Hierarchical Model for Object-Oriented Design Quality Assessment* — [doi:10.1109/32.979986](https://doi.org/10.1109/32.979986) | **A row where a published metric argued the case for doing it differently.** QMOOD's DAM — (private+protected attributes)/(total attributes) — and MOOD's AHF/MHF are pure DECLARED-VISIBILITY counting: a class with 100% private fields whose getters hand out mutable internal collections scores DAM = 1.0. Declared visibility is not encapsulation. | `--nonlocal-state` counts what code is observed to TOUCH, never what a declaration claims, so no visibility keyword can earn a clean score (`src/nonlocalstate.h`) |
| Potanin, Noble & Biddle (2004), *Checking Ownership and Confinement* — Concurrency and Computation: Practice and Experience 16(7):671-687 | The only published MEASUREMENT of how much state is reachable from outside — and it is DYNAMIC: dominator-based ownership over Java heap snapshots, one language, with a tool (`Fox`) that was never maintained. | `--nonlocal-state` is the static, source-level, cross-language approximation of the same question — strictly weaker evidence, available before anything runs, and the header says so in exactly those terms (`src/nonlocalstate.h`) |
| Meyers & Binkley (2007), *An Empirical Study of Slice-Based Cohesion and Coupling Metrics* — ACM TOSEM 17(1) | Slice-based coupling already puts globals in its output set, so any "reachable state" measure has to argue its delta rather than assume one. A slice is computed per VARIABLE over a dependence graph and answers which statements affect a value; the globals fall out as a by-product. | `--nonlocal-state` runs the other direction — per FUNCTION, over the CALL graph, name-resolved not dependence-resolved — and reports the cells themselves with their direction. Much cheaper, and much weaker: with no dependence graph it cannot tell a live write from a dead one, and it says so (`src/nonlocalstate.h`) |
| Chilimbi, Davidson & Larus (1999), *Cache-Conscious Structure Definition* — PLDI 1999 (the `bbcache` tool) | A field co-access AFFINITY GRAPH — built from a static, points-to-free `<function, struct type>` access enumeration — plus a separation weight `wt(fi,fj) = (block − dist)/block` are enough to say which co-accessed fields are declared too far apart, with no debug info and no profiling needed to build the graph itself. | `--field-affinity` reproduces the affinity graph and the separation weight verbatim, ranking every aggregate in the repository instead of one instrumented binary (`src/fieldaffinity.h`) |
| Hundt, Mannarswamy & Chakrabarti (2006), *Practical Structure Layout Optimization and Advice* — CGO 2006 (HP SYZYGY, HP-UX Itanium) | Reporting ADVICE instead of automatically transforming the layout is the right posture for a static field-reordering tool: a *compiler* would first have to prove no pointer aliases the struct's memory pool, and every one of five later attempts that tried automatic reordering anyway (GCC `-fipa-struct-reorg`, LLVM heap SRA, esan, StructFieldCacheAnalysis, Qualcomm's AoS→SoA RFC) is dead. | `--field-affinity` never exits non-zero and ships no rewrite mode — `split-line`/`straddle` findings are advice, never a transform (`src/fieldaffinity.h`) |
| Beck & Diehl (2011), *On the Congruence of Modularity and Code Coupling* — FSE 2011 | congruence(C) = cohesion/(cohesion+coupling) over the package hierarchy is, for a single class, already the distance-weighted fraction of its coupling that stays inside its own boundary — the ratio itself is published, and Robert Martin's older instability I = Ce/(Ca+Ce), shipped for years by NDepend, is the same fraction's crude ancestor. Neither is a contribution to claim. | `--context-ratio` emits the complement of that quantity with the file as the boundary, and states it as a REFINEMENT rather than a new metric: reader-token weighting published side by side with the edge count, and every `--uses` reference role counted, not calls alone (`src/contextratio.h`) |
| Marmoset — ECOOP 2024, [arXiv:2405.17590](https://arxiv.org/abs/2405.17590) | **Novelty tier: RARE BUT REAL, checked twice, not just asserted once.** The insight that a chase pointer colocated with its hot payload avoids a second cache-line fetch is COMMODITY (Boost.Intrusive's own performance docs; Carruth's CppCon 2014 talk) and claimed by nobody here as new — cited exactly like Chilimbi/Davidson/Larus and Hundt/Mannarswamy/Chakrabarti already are, above. What a two-round search (a 14-query/8-catalog research pass, then an INDEPENDENT novelty-refuter run against a non-overlapping source set and explicitly told to try to kill the claim) did not find is the DETECTION-AND-PRIVILEGING mechanism: a purely static, no-execution, source-level classification of a traversal's access shape (index vs. pointer-chase) that then privileges the specific chase field in an automated field-colocation check, surfaced as review advice. Marmoset is the closest structural cousin found — a static compiler that AUTO-SYNTHESIZES packed ADT layouts from access shape — and is also the sharpest refutation of the overreaching version of this claim: Marmoset is an automatic TRANSFORM (this lens has no rewrite mode — see the file header's GRAVEYARD section above), and it is scoped to functional ADTs, not general C/C++ structs with pointer members. **SAFE claim, stated once and not since strengthened:** *"No shipping static-analysis tool, and no published academic work found in a multi-angle search independently repeated by a second, non-overlapping search, combines (a) purely static, no-execution, no-debug-info classification of a loop or traversal's access shape as index/handle-based versus pointer-chase-based with (b) a chase-pointer-specific field-colocation check that treats the traversal pointer as a distinguished, higher-priority case of pairwise field affinity, surfaced as compile-time review advice."* Neither search was a formal patent clearance (no ACM DL/IEEE Xplore pass, no USPTO classification search), and the claim is scoped exactly to what was checked — it does not say "first ever" or "no tool has ever analyzed pointer traversal shape" (Marmoset does, four rows and one arXiv ID away from disproving an unscoped version of this claim). | `src/accessshape.h`'s file header (access-shape classification, Phase A) and `src/fieldaffinity.h`'s Phase B addendum (the chase-pointer sepCost refinement, currently report-only pending the real-corpus precision floor — see `docs/FIELDAFFINITY.md` §8) |
| The novelty-refuter's independent second search: Object Fusion (CMU, unpublished course project — no DOI recorded here rather than guessed), DMon (OSDI 2021), DINAMITE, Intel Advisor, PerfLint, and Lattner's *Automatic Pool Allocation* / LLVM Data Structure Analysis (PLDI 2005 — no DOI re-verified in this session; cited by name and venue only, not confidently as a hyperlink) | **The UNSAFE claims this row's SAFE wording (above) deliberately does NOT make, and the specific citation that would refute each if it did:** (1) "no tool has ever statically analyzed pointer-traversal access shape at all" — refuted by Marmoset (above) and by this search's own findings; (2) "no tool colocates fields based on access pattern" — refuted by DMon/PerfLint-style dynamic layout advisors, which DO some field colocation, just not a chase-pointer-DISTINGUISHED case and not from static-only evidence; (3) "the detection mechanism itself, not just the privileging step, is unprecedented" — refuted by Object Fusion, which names the identical failure mode a year before this plan did, though it requires MANUAL developer annotation of key/next accessors rather than detecting them; (4) "profiling-based traversal tools don't already do something adjacent" — refuted by DMon and DINAMITE, both of which require EXECUTION, the first of the two required prongs this claim is scoped around; (5) "whole-program static pointer analysis hasn't already modelled linked structures" — refuted by Lattner's LLVM Data Structure Analysis / Automatic Pool Allocation, which statically models pointer-based data structures for a DIFFERENT consumer (pool allocation / hardware prefetcher design), never as chase-pointer-distinguished field-colocation advice — the second of the two required prongs. Every one of the five fails on at least one prong; neither search found a work that clears both. | Same as the Marmoset row above — `src/accessshape.h`, `src/fieldaffinity.h`'s Phase B addendum, and `docs/FIELDAFFINITY.md` §8's honest report-only status |
| Rafiei Oskooei, Ilci, Kayim, Uzun, Can, Kara, Orhan & Aktas, *Deep Agentic Search for Repository-Level Code Question Answering: An Empirical Study* — [arXiv:2608.01507](https://arxiv.org/abs/2608.01507) | A head-to-head external to this project: semantic search over a pre-built index answered 65.2% of repository questions correctly against 46.2% for a planner that delegates exploration to a sub-agent in an isolated context window, at less than half the cost, and 41.8% of the delegated arm's failures happened silently at the planner→sub-agent hand-off — a fluent, confident, wrong answer with no visible seam. That hand-off is a failure mode a single-process design does not have a place for. | `--for` / MCP `for`: one process returns the ranked anchor's body in one call with `route=` naming its own evidence in the same response, no summarizing intermediary between query and answer (`src/main.cpp`, `src/filter.h`) |
| Jha, *Does Fault Localization Beat a Fresh Attempt? A Placebo-Controlled Study of Test-Guided Code Repair* — [arXiv:2609.00854](https://arxiv.org/abs/2609.00854) | A three-arm design — blind whole-solution resampling, spectrum-based localized infilling, and same-length infilling at a disjoint *random* code span as the placebo — is what let the paper show localized infilling losing decisively to blind resampling at matched attempt count (3:40, p = 3.0×10⁻⁹). Without the random-span arm run at matched cost, a ranking win and a smaller-context-helps-regardless-of-content win are indistinguishable. | The standing placebo-arm requirement for fault-localization / retrieval head-to-heads, [`METHODOLOGY.md`](METHODOLOGY.md) §8 |
| Liu, *What Does Context Compression Cost an Agent? Interaction Costs Unrevealed by Task-Completion Metrics* — [arXiv:2608.16370](https://arxiv.org/abs/2608.16370) | Task-completion metrics can hide a compression scheme's real cost: in one of six measured model/regime comparisons, completion moved 80%→85% (p = 1.0, i.e. unchanged) while retrieval calls rose 21.0→63.9 (p = .002); five of six comparisons showed a significant retrieval-call surge. Every token-budget flag here is a compression scheme by this definition, and nothing in the eval suite yet counts the follow-up calls a tight budget induces. | The owed follow-up-call-count column, registered as unmeasured in [`EVALS.md`](EVALS.md)'s "ARISE fault-localization head-to-head" section |
| Bogliolo, *From SQL Generation to Tool Selection: A Domain-Oriented Pattern for MCP Servers* — [arXiv:2608.22063](https://arxiv.org/abs/2608.22063) | A fixed, domain-aligned tool set beats free-form query synthesis and lets small models match large ones on it — the paper's own pooled score moved 0.605 (generic tool pack) to 0.939 (verticalized pack), with the smallest model tested improving most. External corroboration, after the fact, of a closed verb catalogue over an open query language. | The closed verb catalogue in `--help`; `--graph-query=EXPR`'s closed node-set expression language (`src/verbs_navigate.h`); `--verify=CLAIM`'s closed claim grammar with a three-valued verdict (`src/verify.h`) |
| Paul, Helm, Glavaš & Gurevych, *OctoLong: Mid-Training on Cross-Repository Code Contexts Enhances Long-Context Modeling* — [arXiv:2608.05141](https://arxiv.org/abs/2608.05141) | A cross-repository context-curation pipeline is only as trustworthy as its linking discipline — OctoLong instruments an AST parser, a language server and a package manager to curate genuinely dependency-linked spans across repository boundaries rather than merely co-located ones. External corroboration of the same discipline applied here. | Multi-root workspaces (`ripwire <dir1> <dir2> ...`): cross-root edges admitted only on explicit include/import/FFI evidence, never on same-name coincidence (`src/resolve.h`) |
| Shao, Zeng, Zhao & Yu, *HyperFL: Query-Adaptive Representation Learning for Software Fault Localization* — [arXiv:2608.02967](https://arxiv.org/abs/2608.02967) | Adapting the retrieval representation to the shape of the query, rather than serving every query from one fixed embedding space, is worth doing — HyperFL does it with a learned hypernetwork generating per-query LoRA parameters. External motivation, after the fact and without the learner, for choosing a representation deterministically instead. | The `--for` query-shape router: name-exact BM25 versus subtoken+body BM25, chosen per query with the evidence printed as `route=` (`src/lexical.h`, `src/filter.h`) |

**Two co-change parameters here were derived independently and landed on the published values — and
saying so is stronger than silence.** The bulk-commit cap (`kCoBoostMaxFilesPerCommit`, `src/gitmine.h`)
was chosen from this tool's own history and is **30 files** — the same number as Code Maat's
`--max-changeset-size 30` default and Clio's "commits touching more than 30 files are discarded as
noise". The support floor `together>=3` sits inside the range Clio sweeps for the same threshold
(`th_s` 2–10) and is one clear of the coincidence floor of 2. Neither value was copied and neither is
arbitrary: three independent derivations agreeing on a cut is evidence about the cut, and a reader
entitled to ask "why 30?" deserves that answer rather than a shrug. The rows above are the citation;
this paragraph is the calibration.

**Cited during the research and deliberately not given a row**, because no shipped decision traces
to them alone rather than to a paper already listed: the *Power of Noise* result on plausible-but-wrong
context and the Chroma context-degradation study (both corroborate the two context rows above);
GraphCoder, RepoHyper, RepoCoder, LongCodeZip and the retrieval-augmented-code-generation survey
(read as background for the ladder, no distinct decision); the static-analysis-feedback replications
that agree with the metric-feedback row; type-constrained generation; and the ecosystem-scale
dependency-risk work — the zero-runtime-dependency posture here is an engineering judgement, and the
record is explicit that no head-to-head study supports it. One further finding shaped the tool with
no citable identifier in the research record and so appears here rather than in the table: the
measured unreliability of using a language model as a judge, which is why every evaluation instrument
in this repository is a deterministic oracle.

**The ARISE bibliography, surveyed 2026-08-31.** The ARISE row above is folded; its reference list was
then read as a source in its own right. The paper's two arXiv versions do not share a bibliography — v1
(4 May 2026) cites 44 works, v2 (3 Jul 2026) cites 38, and only 26 are common to both — so the survey
took the union of 56. Two earned rows above: Weiser, whose slice criterion is the unit `--slice` asks
its question in, and SWE-bench, which was already an instrument here and had no row. The rest were read
and are named here rather than padded into the tables, because nothing in this tree traces to them yet.
The dependence-graph line this tool does not implement: **Ferrante, Ottenstein & Warren** (control
dependence, which `--slice-flow` does not model and, until this survey, did not disclose that it does
not model); **Horwitz, Reps & Binkley** (the interprocedural boundary `--slice-flow` stops at); and
**Tip**'s survey, which supplies the vocabulary for both. The graph-schema and localization-agent line,
read for their schemas and tool surfaces rather than their loops, which are LLM-valued where every
instrument here is a deterministic oracle: **Yamaguchi, Golde, Arp & Rieck**'s code property graphs and
Joern, **CodexGraph**, **CGM**, **CoSIL**, **OrcaLoca**, **KGCompass**, **CodePlan**, **AutoCodeRover**
and **SpecRover**, and **LingmaAgent**. The learned-representation line, whose representations are
separable from their models but whose models are the contribution: **Allamanis, Brockschmidt &
Khademi**, **code2vec**, **GraphCodeBERT** and **Devign**. **Utture, Liu, Kalhauge & Palsberg** on
pruning false positives from static call graphs, whose published rule is model-free and whose
measurement this tree cannot yet make. **Shi et al.** on irrelevant context, which corroborates the two
context rows above rather than adding a third. The fault-localization literature, surveyed family by
family against what is shipped here — **Jones & Harrold**'s Tarantula, **Papadakis & Le Traon**'s
Metallaxis, the **Wong et al.** and **Liu et al.** surveys, **FlexFL**, **AgentFL**, **RGFL**, and
**Hossain et al.**'s deep dive — with the honest finding that no static, deterministic, build-free
family among them is missing. **Takahashi, Sae-Lim, Hayashi & Saeki** on smell-aware bug localization,
the one mechanism in that literature this tree lacks. The benchmark line: **Bench4BL**, **RepoQA**,
**RepoBench**, **LONGCODEU**. The program-comprehension studies that describe what a developer actually
does on landing cold in an unfamiliar tree: **Baltes, Moseler, Beck & Diehl**; **Bexell, Söderberg,
Rydenfält & Eldh**; **Shah, Rexin, Chernova, Allen-Perez, Griswold & Soosai Raj**; and **Tang, Xu,
Karmakar & Li**. And, orthogonal to a deterministic zero-dependency mapper but read all the same:
**EXPEREPAIR**, **SWE-fixer**, **RLCoder**, and the model, serving and monorepo-scale reports ARISE
cites for context.

**Two attributions corrected in that reading.** ARISE's v1 bibliography credits
[doi:10.1145/3702652.3744218](https://doi.org/10.1145/3702652.3744218), *Needles in a Haystack: Student
Struggles with Working on Large Code Bases*, to Pearce, Singh, Hales, Finlayson & Becker at SIGCSE; the
DOI resolves to Shah, Rexin, Chernova, Allen-Perez, Griswold & Soosai Raj at ICER 2025. It credits *An
extensive study on smell-aware bug localization* to Takahashi, Higo & Kusumoto at JSS 177:110957;
Crossref gives Takahashi, Sae-Lim, Hayashi & Saeki, JSS 178:110986
([doi:10.1016/j.jss.2021.110986](https://doi.org/10.1016/j.jss.2021.110986)). The names used above are
the ones the DOIs carry, which is the only defensible rule for a document whose purpose is credit.

---

## 3. The tool field

### 3a. Folded — a named lesson, and where it landed

Every row below names a specific thing taken. Five of them are vendored code and say so; the rest are
ideas. Vendoring a library is not by itself a lesson: `third_party/` holds one library that no
shipped target links, and it is named in the near-miss paragraph below rather than given a row here.

| Repository | Lesson taken | Where it lives |
| --- | --- | --- |
| [Graft](https://github.com/trailhq/Graft) | A tests-to-run row says WHY it is one, and a test file that is itself in the diff is an obligation on its own evidence — Graft's blast verb keeps a four-valued per-area test signal (`changed` / `stale` / `none` / `na`, in its blast module); folded as `changed=` / `partner=` / `hops=` on every `<test>`/`<t>` row in evidence order, which also closed a silent zero (a diff of `{src, its test}` exited `--test-gate` with nothing to run). Second lesson: the MCP `initialize` `instructions` string is the one channel a schema-deferring host cannot strip (Graft's MCP instructions module), so it now tells the agent to load the verbs in one lookup. Taken from the 2026-09-07 head-to-head (`bench/graft-h2h/`), where Graft's plain lexical `ask` named the stem-partner test the graph walk missed. | `src/testmap.h` (`rankTestRows`, `isTestPartnerOf`, `kTestRowEvidenceLegend`), `src/situ.h`, `src/verbs_change.h`; `src/mcp.h` (`kMcpServerInstructions`); the `<recent>` rows of `--rank-by=churn-decay` (`src/gitmine.h::recentRowsFromDecayed`) answer the same head-to-head's "what changed recently" loss |
| [tree-sitter](https://github.com/tree-sitter/tree-sitter) | Incremental parsing with a per-language query convention, so symbol extraction is inherited from maintained grammars instead of written per language. | The whole ingest stage (`src/ingest.cpp`); vendored grammars enumerated in [`THIRD_PARTY.md`](../THIRD_PARTY.md) |
| [aider repo-map](https://aider.chat/2023/10/22/repomap.html) | Rank a whole-repository symbol map with PageRank over the reference graph, and hand an agent the map rather than the files. This is the direct ancestor of the default run. | The default ranked map; also the interpreted-versus-compiled comparison arm in the head-to-head ([`EVALS.md`](EVALS.md) §2) |
| [ctags](https://ctags.io/) | The durable unit of code navigation is a tiny fixed record — name, kind, and where it is — not a document. | The `<s t= n= id= k=>` symbol row: kind, name, canonical id, and a rank, nested inside its `<f p=>` file element so the path is written once per file. Line numbers are the one part of the ctags record deliberately dropped from the map — a line number goes stale on the next edit, and the map is a thing an agent rebuilds per turn |
| [PyDriller](https://pydriller.readthedocs.io/en/latest/deltamaintainability.html) | The DMM paper states the model; the reference implementation states the CONSTANTS. The three low-risk boundaries (15 lines, cyclomatic 5, 2 parameters) and the exact good/bad asymmetry were read out of `pydriller/domain/commit.py` rather than re-derived from prose, and the 0/0 case returning `None` is where `--dmm`'s UNAVAILABLE token comes from. | `--dmm`'s thresholds and `scoreProperty` (`src/dmm.h`); the deviation — volume is physical line span where PyDriller uses lizard's non-comment `nloc` — is disclosed on every report as `size_metric="physical-loc"` |
| [Zoekt](https://github.com/sourcegraph/zoekt/blob/main/doc/design.md) | Index trigrams and intersect posting lists: pick the rarest trigrams first, then verify candidates, instead of scanning files. | The substring and regex index behind `--grep` and `--regex` (`src/search.h`) |
| [ripgrep](https://github.com/BurntSushi/ripgrep) | A scanner fast enough stops being something you run and becomes something that is always on — and smart committed defaults beat configuration. | The name; the committed crawl skip-list rather than a per-repository ignore file (`src/ingest.h`); the warm-run latency target |
| [ast-grep](https://github.com/ast-grep/ast-grep) | Metavariable patterns over the syntax tree are a better query surface for code shape than regular expressions, and they make lint rules user-authorable. | `--match=QUERY`, and the YAML rule shape read by `--lint-rules=DIR` (`src/lintrules.h`) |
| [Semgrep](https://semgrep.dev/blog/2024/modernizing-static-analysis-for-c/) | Useful analysis is possible without include resolution or type information — own that band explicitly rather than apologising for it. | The syntax-only scope of `--lint`, stated as a limit rather than implied |
| [CodeQL](https://codeql.github.com/docs/codeql-language-guides/analyzing-data-flow-in-cpp/) | Use-after-move, null-dereference and the rest need real dataflow over a compiled program. Approximating them from syntax produces noise and costs trust. | The checks deliberately **not** implemented: `--lint` ships no dataflow rules, and the omission is documented rather than silent |
| [clang-tidy](https://clang.llvm.org/extra/clang-tidy/checks/list.html) | A specific, well-chosen set of checks is purely structural — branch clones, else-after-return, C-style casts, empty-bodied conditionals — and needs no build at all. | The built-in rules behind `--lint` (`src/lintrules.h`) |
| [SCIP](https://sourcegraph.com/blog/announcing-scip) | A human-readable cross-repository symbol moniker, in an index format compact enough to consume as an *optional* precision layer over a cheaper resolver. | `--scip=index.scip`, which replaces guessed call edges with precise ones where the index covers them (`src/scip.h`, `src/scipoverlay.h`) |
| [Glean](https://engineering.fb.com/2024/12/19/developer-tools/glean-open-source-code-indexing/) | Expose derived predicates over the base graph so callers can compose their own question, instead of shipping one fixed verb per question. | `--graph-query=EXPR` — sources, filters and bounded closure, composed by the caller |
| [stack-graphs](https://github.blog/open-source/introducing-stack-graphs/) | Make the unit of incrementality the *file*: reparse and re-merge one file rather than the tree. | The content-hashed per-file warm cache — a warm run is gated byte-identical to a cold one (`src/ingest.cpp`) |
| [Serena](https://github.com/oraios/serena) | A language-server-backed toolkit resolves what a name-based graph can only guess at. The gap is real and permanent at this cost point. | The guesses are labelled instead of hidden: `amb=` per symbol, `ambiguous=` per document, `counts_floor=` on every count name resolution cannot prove is total (`src/resolve.h` for `amb=`, `src/graphlegend.h` for `counts_floor=` and the legend that defines it) |
| [probe](https://github.com/probelabs/probe) | Determinism is a product feature worth advertising, not an implementation detail. | Two runs over one tree are byte-identical, gated on every push — `test/det-gate.sh` |
| [codebase-memory-mcp](https://github.com/DeusData/codebase-memory-mcp) | A committable index artifact turns a team's or CI's cold start into someone else's warm one. | `--cache=FILE` and `--index-out`; it is also a measured head-to-head arm, so the comparison is a number rather than an opinion ([`EVALS.md`](EVALS.md) §2) |
| [Sourcegraph / Cody](https://sourcegraph.com/blog/how-cody-understands-your-codebase) | A vendor operating at scale deprecated embeddings in favour of keyword and structural retrieval — the strongest available external evidence against the embedding-first default. | The architecture: no embeddings, no vector store, no model weights in the binary |
| [CodeScene](https://codescene.com/product/behavioral-code-analysis) | Combine the code metric with the change history — complexity that never changes is not where the risk is. | The shape of `--hotspots`, and the `--since` window that scopes it |
| [Code Maat](https://github.com/adamtornhill/code-maat) | Bulk commits — mass renames, reformats, licence sweeps — have to be dropped before co-change is mined, or they manufacture coupling between every file they touch. | The per-commit file-count cap on every co-change walk: `kCoBoostMaxFilesPerCommit`, and the same literal passed by `--cochange`, `--situ` and `--pr-context` (`src/gitmine.h`) |
| [ArchUnit](https://www.archunit.org/userguide/html/000_Index.html) | Architecture as a test, with a frozen baseline so an existing violation set can be grandfathered and only *new* debt fails the build. | `--arch=FILE --baseline` and `--baseline-update`, with exit 2 on a new violation |
| [dependency-cruiser](https://github.com/sverweij/dependency-cruiser) | Layering rules belong to the project, in a checked-in file, not to the tool. The tool enforces; it does not opine. | `--arch=FILE` reads user-authored allow/deny rules and ships none of its own (`src/arch.h`) |
| [include-what-you-use](https://github.com/include-what-you-use/include-what-you-use/blob/master/docs/WhyIWYU.md) | Deciding an include is unused needs real type resolution; a syntactic approximation is noise wearing a useful name. | Not attempted. `--deps` reports the include graph as a fact and stops there — the one place this tool most wanted a heuristic and does not ship one |
| [ruff](https://astral.sh/ruff) | Parse once, then run every check over the same tree — the parse, not the checks, is the cost. | `--lint`, `--metrics`, `--clones` and the map all read one shared parse of the corpus |
| [uv](https://github.com/astral-sh/uv/blob/main/BENCHMARKS.md) | Past a latency threshold a tool changes category: it stops being something you invoke and becomes something that runs every turn. | The design target — a repository map an agent can afford to rebuild per turn, with the medians published in [`EVALS.md`](EVALS.md) |
| [unordered_dense](https://github.com/martinus/unordered_dense) | A dense open-addressing map with contiguous values beats the standard node-based one on both lookup and iteration. | Vendored. The symbol table and every hot lookup; `std::unordered_map` is banned by house rule |
| [svector](https://github.com/martinus/svector) | Most per-symbol edge lists are tiny, so the small ones belong inline rather than on the heap. | Vendored. Edge and reference lists |
| [gtl](https://github.com/greg7mdp/gtl) | When iteration order must be sorted and deterministic, a cache-friendly B-tree beats a hash map plus a sort. | Vendored. The sorted containers on deterministic output paths |
| [octocode](https://github.com/bgauryy/octocode-mcp) | Elision has to describe itself: every truncation carries its own denominator and a visible marker, so a caller can tell *shortened* from *all there is*. | The `shown_<noun>=` / `<noun>_capped=` disclosure vocabulary on every windowed listing, with the rule set that governs it in `src/pageview.h` and the machine-readable legend the document carries with it in `src/graphlegend.h` |
| [doctest](https://github.com/doctest/doctest) | A single-header test framework keeps the test build inside a zero-dependency contract. | Vendored. The C++ unit harnesses under `test/`, built only with `-DRIPWIRE_TESTS=ON` |
| [Namesake](https://github.com/nalmadi/Namesake) | The identifier confusions that actually bite a reader are between names visible at the same time — so compare co-visible names, not the whole corpus. | `naming-confusable` in `--lint`, scanned within one (file, scope) group: edit distance ≤2 between names of five characters or more, the same tokens reordered, or a bare/digit-suffixed twin. A scan too large to run in full is reported saturated, so its count is disclosed as a floor (`src/naminglens.h`) |
| [Spiral / Ronin](https://github.com/casics/spiral) | The conservative heuristic split — case transitions, digit boundaries, separators, ACRONYMWord handling — is fully described in prose, so it can be reimplemented from the description; and it has to be, because the source is GPLv3 while first-party code here is Apache-2.0. | `splitIdentifier()` in `src/naminglens.h`, written from the description and not ported. No Spiral code is in this tree and nothing was added to [`THIRD_PARTY.md`](../THIRD_PARTY.md) — the one row here where the lesson taken is *how to take a lesson without taking the code* |
| [CHA](https://link.springer.com/chapter/10.1007/3-540-49538-X_5) — Dean, Grove & Chambers, *Optimization of Object-Oriented Programs Using Static Class Hierarchy Analysis*, ECOOP 1995 | A still-ambiguous receiver-typed call narrows by static type alone: intersect the candidate set with the receiver class's transitive subtype cone, no whole-program build. Ripwire's delta: name-based over the extracted symbol graph, not a compiled type hierarchy, and a SOUND prune of an already-ambiguous tier — a receiver type the cone can't resolve stays ambiguous and degrades rather than guessing a candidate. Citation debt: this landed as B2.1 well before this row existed. | B2.1 CHA-lite receiver-type-cone narrowing, in the resolver's ambiguous-tier prune (`src/graph.h`) |
| [golang.org/x/tools deadcode](https://pkg.go.dev/golang.org/x/tools/cmd/deadcode) | Frame "dead" as NOT-REACHABLE-FROM-a-declared-entry-point: build a call graph via RTA from every `main` and report what it never reaches, so a chain of any length can be dead. Ripwire's delta: `--dead-code` is not this — it is in-degree/linkage-evidence based (zero in-edges plus internal `static` linkage on a free function), no entry-point traversal and no whole-program closure. The reachability framing this row names is planned separately as `--unreachable-from` and is not shipped. | `--dead-code`'s in-degree + `static`-linkage check (`src/main.cpp`) |
| [SVF](https://github.com/SVF-tools/SVF) | Resolve an indirect call through a variable→function binding table rather than giving up on it — points-to analysis' core move, stripped from IR scale to AST scale: one hop, same-file evidence, and a tombstone on reassignment instead of a merged points-to set. Ripwire's delta: no IR and no whole-program build, so the binding is written-evidence only and the blind spot is disclosed rather than approximated. | `src/ingest_binds.h`; gate `test/fnptrcheck.sh`, whose arm (t) pins the same-file limit as a KNOWN blind spot |
| [Code Pathfinder](https://github.com/shivasurya/code-pathfinder) | Emit findings in SARIF 2.1.0 so they land in the host's existing code-scanning UI instead of a bespoke format nobody ingests — distribution is part of the tool, not a wrapper around it. | `--sarif` (with `--lint`), `src/sarif.h`; gate `test/sarifcheck.sh` |
| [SpotBugs](https://github.com/spotbugs/spotbugs) | Confidence is a disclosed axis SEPARATE from severity: "how sure am I" is answered independently of "how bad is it", so a consumer can filter on either without the other moving. Ripwire's delta: the axis landed on the CALL GRAPH, not on the linter — `--lint`'s built-ins carry no `sev=` at all by design, and a tree-sitter match has no resolver ambiguity, so a confidence number there would be invented rather than measured. | `prov="split"`, the third value of the existing per-edge provenance attribute, emitted on each arm of a k-way pick the resolver could not decide and keyed from the same predicate that increments `ambOut` (`src/graph.h`, `src/serialize.h`); gate `test/resolverhonestycheck.sh` |
| [graphify](https://github.com/Graphify-Labs/graphify) | Edge confidence is not a number in a footer — it is drawn: a guessed edge must LOOK different from a resolved one in the rendered graph, every time, not only in the text. Ripwire's delta: dashed rather than faded, because a faded solid line reads as a DISTANT edge rather than an uncertain one. | `--html`'s two-pass edge paint and the `"a":1` flag in LINKS (`src/htmlexport.h`), with a counted legend clause; gate `test/htmlexport.sh`. Before this the renderer contained zero occurrences of amb/confidence/dashed/opacity — ripwire computed `amb=` and discarded it at render time |
| [gortex](https://github.com/zzet/gortex) | Mine the repository's OWN history, not the last N months of wall-clock time. A window anchored to `now` is right for a live checkout and wrong for every pinned corpus, archived release and eval — and eval corpora are pinned by definition. Measured: on rocksdb at `0e2801ac` (HEAD dated 2024-10-17) gortex mined 9,854 co-change edges where ripwire's `--cochange` returned zero rows and exited 1 claiming "git unavailable / no history", which was false on both counts. | The default history window anchors on HEAD's committer date across all five miner construction sites and six window labels (`src/gitmine.h`, `src/main.cpp`, `src/verbs_report.h`, `src/mcpverbs.h`); an explicit `--since` is never re-anchored, so it is the opt-out. Gate `test/sincewindowcheck.sh` arm 4 |
| [vulture](https://github.com/jendrikseipp/vulture) | Attach a CONFIDENCE tier (60-100%) to each dead-code finding instead of one undifferentiated list, so the near-certain findings can be triaged separately from the merely-plausible ones. Ripwire's delta: `--dead-code`'s `confidence="high"` is currently a FIXED literal on every finding, not tiers — tiering by ripwire's own evidence (linkage + in-degree + amb on incoming edges), explicitly NOT vulture's self-described-rough 60/90/100 numbers, is planned and not yet shipped. | the fixed `confidence="high"` literal on every `--dead-code` finding (`src/main.cpp`) |
| [codesight](https://github.com/Houseofmvps/codesight) | A per-facet write budget sized to roughly one screen of prose (~300 tokens per generated article) generalises to a SHARE floor: the least a document can be given and still be worth serving when one fixed budget is divided among several competing documents — distinct from the absolute last-resort minimum, which is a different, smaller number. | `kRecallShareFloorBytes = 900` in the water-filling recall budget (`src/recall.h`) |
| [cocoindex-code](https://github.com/cocoindex-io/cocoindex-code) | Staleness is not only "does the index still describe the tree" — already solved here — it is also "can THIS BINARY read this artifact": a foreign format, parser, or architecture version has to refuse cleanly and NAME why, not misread silently. | `--doctor` check 7's `<c n="index-cache">` row and the named `CacheReject` refusal enum (`src/ingest_cache.h`). **Second lesson, same repo, taken 2026-09-06:** when the question names a file, that file's own declaration/definition partner is the answer far more often than the largest thing that transitively depends on it — measured, cocoindex returned `db/wal_manager.h` as result #1 in 55 B where `--situ` missed it entirely in 3,104 B. Now surfaced ahead of the transitive list in `--situ`. **codanna** reached the same incremental-as-a-contract framing independently and is credited here rather than given a duplicate row, because the lesson and the artifact it points at are the same one |

**Read and not folded, and worth naming because they are the near misses.** A scoped-snippet view
with scope breadcrumbs — the one rung of the detail ladder that is still missing here — was designed
against `grep-ast`'s TreeContext and never shipped. `graphify` contributed a measured head-to-head
comparison and no design lesson, so it appears in [`EVALS.md`](EVALS.md) §2 and not in §3a — it is
still in the surveyed table below, where a catalogued-and-not-borrowed-from tool belongs. codesight's
own detectors (routes, schema/ORM, UI components) are read and declined separately from the size
lesson folded above: they have no C or C++ support at all, which is exactly the language band
codesight's own README disclaims and ripwire's own scope begins.

And [pdqsort](https://github.com/orlp/pdqsort) is the near miss that is actually *in the tree*: it is
vendored at `third_party/pdqsort.hpp`, licensed and attributed in [`THIRD_PARTY.md`](../THIRD_PARTY.md)
like every other vendored library — and **currently unused by any shipped target**. The ranking sorts
are a deterministic radix pass with a `std::sort` fallback below the radix threshold (`src/infra/sortutil.h`),
chosen because a stable radix key is easier to make byte-identical across platforms than a
pattern-defeating quicksort's pivot choices. The only consumer of the pdqsort wrapper
(`src/infra/fastSort.h`) is a benchmark that no build target compiles. It stays vendored and stays
disclosed; it is not a lesson this tool folded, so it does not get a row above.

### 3b. Surveyed — the labelled landscape

**Surveyed is not borrowed-from.** Nothing in this table contributed a lesson to ripwire; the table
records that the field was catalogued before the claims in §3a were made, which is what makes "only
these twenty-nine" a meaningful statement rather than a shrug. Tools that *did* contribute are in
§3a — and in §2, where a tool's own paper is the citation — and none of them is repeated here, so no
tool is counted twice and the two counts add rather than nest. That is not a promise: arm (E6) of
`test/readmedriftcheck.sh` intersects the two tables' names and fails on any overlap, and arm (E7)
fails if any name appears twice *within* this table.

**A Round-B observation (2026-09-05), the most reusable thing that harvest learned.** The "code
intelligence for AI agents" category — the Repo-map and context-for-agents row below, ripwire's own
most direct competitive neighbourhood — is roughly **seven direct competitors, every one of them
created between 2025-07 and 2026-07.** Rank this cohort by momentum (commits/90d, contributors,
releases), not stars: star counts in this specific cohort are hype-inflated relative to established
repositories (Understand-Anything shows a 325:1 star:watcher ratio against Dgraph's 61:1), while
fork:star ratios (roughly 8-19:1 across the cohort) look organic by the same measure.

| Category | Tools surveyed | n |
| --- | --- | --- |
| IDE pair-programmers | Copilot, Cursor, Windsurf, Continue.dev, Tabnine, Codeium, Amazon Q Developer, JetBrains AI, Supermaven, Zed AI | 10 |
| Autonomous coding harnesses | Claude Code, Codex CLI, Devin, OpenHands, SWE-agent, Cline, RooCode, Goose | 8 |
| Agent orchestration frameworks | LangGraph, AutoGen, CrewAI, DSPy, Mastra | 5 |
| Code-mod and migration | OpenRewrite, Codemod, comby, jscodeshift, Sourcegraph Batch Changes | 5 |
| AI pull-request reviewers | CodeRabbit, Greptile, Graphite Diamond, Cursor Bugbot, Qodo Merge, DeepSource, Sourcery, Ellipsis, Bito, Korbit, Cubic, Baz, Entelligence, CodeAnt, Devlo, Trag, Panto, Macroscope | 18 |
| Deterministic linters and aggregators | ESLint, Biome, oxlint, Pylint, Cppcheck, Bandit, reviewdog, pre-commit, MegaLinter, Trunk, Qlty, ShellCheck | 12 |
| Compile- or type-required analysis | SonarQube, Clang Static Analyzer, Infer, Clippy, golangci-lint, Staticcheck, Coverity, Error Prone, Doop, Phasar | 10 |
| Security and supply chain | Snyk, Socket, gitleaks, TruffleHog, Trivy, Checkov, KICS, Grype, Syft, OSV-Scanner, Dependabot, Renovate, sigstore, Pixee, ZeroPath, Mobb, Copilot Autofix | 17 |
| Type checkers | mypy, pyright, ty, pyrefly, tsgo, Sorbet, PHPStan, Psalm | 8 |
| Formal methods and contracts | Kani, CBMC, ESBMC, KLEE, Dafny, Verus, Frama-C, Why3, TLA+, Apalache, Alloy, SPARK, Lean, Rocq, JML | 15 |
| Property-based testing and fuzzing | Hypothesis, QuickCheck, fast-check, proptest, jqwik, AFL++, libFuzzer, OSS-Fuzz, Atheris, Jazzer, Hypofuzz | 11 |
| Mutation testing and coverage | Stryker, mutmut, PIT, cargo-mutants, coverage.py, llvm-cov, Launchable, BuildPulse | 8 |
| Sanitizers | AddressSanitizer, UndefinedBehaviorSanitizer, ThreadSanitizer, Valgrind | 4 |
| AI test generation | Qodo, EarlyAI, Diffblue, TestGen-LLM | 4 |
| Architecture linters | NDepend, Sonargraph, madge, import-linter, Lattix, ArchUnitNET, jQAssistant, Depends | 8 |
| Build systems and caching | Bazel, Buck2, Nx, Turborepo, Pants, sccache, ccache, BuildBuddy, Depot | 9 |
| Agent sandboxes and dev environments | E2B, Modal, Northflank, Daytona, Koyeb, Blaxel, Dev Containers, Codespaces, Gitpod, Nix, devbox | 11 |
| Version control and release | gh CLI, Graphite, Sapling, jujutsu, git-branchless, semantic-release, changesets | 7 |
| Code search engines | grep.app, OpenGrok, livegrep | 3 |
| Code intelligence and index formats | LSP, Kythe, LSIF, clangd | 4 |
| Repo-map and context-for-agents | CodeGraph (npm), Code-Graph-RAG (vitali87), GitNexus, tree-sitter-analyzer, repowise, grepai, Repomix, gitingest, kit, claude-context, codanna, grep-ast, Understand-Anything, Tura | 14 |
| Debugging and time travel | gdb, lldb, rr, Pernosco, Replay.io, WinDbg-TTD, Sentry Autofix, Rollbar | 8 |
| Profilers | perf, py-spy, pprof, Coz, hyperfine, criterion | 6 |
| Agent memory and context compression | Mem0, Letta, Zep, cognee, headroom, LLMLingua, Ix | 7 |
| Evaluation and observability | LangSmith, Langfuse, Braintrust, Galileo, Arize, AgentOps, Promptfoo, Ragas, DeepEval, OpenTelemetry | 10 |
| Clone and duplication detection | PMD-CPD, jscpd | 2 |
| Code metrics and churn | cqmetrics, churn (danmayer), code-forensics | 3 |
| Documentation and diagrams | Doxygen, Sphinx, Mintlify, Swimm, Mermaid, CodeSee | 6 |
| Graph databases | Dgraph, NebulaGraph | 2 |
| Benchmark-only research artifacts | Chronos (Kodezi) | 1 |
| Formatting libraries | fmtlib/fmt | 1 |

**CodeGraph is not Code-Graph-RAG.** The r7 head-to-head round's opponent was `@colbymchenry/codegraph`
(npm), listed above as "CodeGraph (npm)" — an unrelated project from `vitali87/code-graph-rag`
(Python, Memgraph-backed), listed separately as "Code-Graph-RAG (vitali87)" despite the
near-identical name. Both names are recorded so neither the r7 result nor a future head-to-head
against the other can be misread as being about the same tool.

**Round B's 2026-09-05 additions to this table, and why each was read and declined.**
Understand-Anything's 27-way type taxonomy and 3-step complexity badge are TypeScript/web-shaped;
`--color-by=cx`'s continuous ramp and user-definable `--arch` layers are more general. Ix's per-field
zero-vs-omitted disclosure is already sharper here (see `serialize.h`'s `locals=` applicability
guard), and its savings ledger conflicts with the telemetry-stays-local rule. Chronos (Kodezi) is not
a system — its own README states "research paper, benchmarks, and evaluation results only", and
`reference_implementations/NOTICE.md` states the published code is not the model; its Adaptive
Graph-Guided Retrieval adaptive-depth stop was read and declined because an adaptive boundary cannot
be stated in one attribute. Dgraph and NebulaGraph contribute query-language vocabulary only —
ripwire already discloses more than DQL, which documents no `hasNextPage` and no total-count
mechanism at all. code-forensics has been dead since 2023-01 and ships no licence file despite a
README claim of one; its ideas (temporal coupling, a per-module knowledge map) are read, never a
line taken. Tura is AGPL-3.0, a licence hazard under the same rule that keeps Spiral's code out of
this tree (§3a) — README only, nothing built against it. fmtlib/fmt was explicitly rejected: C++23
`std::format` is already in the standard library and every CI leg carries libstdc++ 13+, so vendoring
it would be a G3 regression.

---

## What is actually new

Nothing in the tables above. The parts that are not borrowed are the constraints imposed on them:

- **Determinism as a contract, not a tendency.** Two runs byte-identical, and a warm run byte-identical to a cold one, gated on every push.
- **Every count that cannot be proven total says so, in the output.** `counts_floor=`, `shown_*`, `*_capped=`, `amb=` — the vocabulary is defined by a legend the document carries with it.
- **An advertised number is an enumerated, gated number.** Including the three in this document's own header.
- **One compiled binary, no runtime dependencies, no embeddings, no server, no network.** Each of those is a thing several tools above have and this one does not, which is a trade and is described as one.
- **The process that keeps the other four true.** Every document that makes claims — the tool's own output included — is treated as a claims corpus and adversarially audited; a gate must be shown able to fail before its green is trusted; and eighteen consecutive audit rounds have each found real defects, including in this document. The method ships as [`METHODOLOGY.md`](METHODOLOGY.md), and a paper writing it up as transferable method is in preparation — the working draft lives in [`paper/`](../paper/).

The combination is the contribution. The pieces are everybody's.