harden: E.3 boolean truncation, docs parity, golden fixture

Use json('true') for list-cap markers; exercise >3 caller branch via
ProductCard now() fixture; fix stale unimported-exports action text;
add architecture + skill evidence lines; refresh affected goldens.

Author: SutuSebastian

docs/architecture.md

@@ -190,6 +190,8 @@ Three **mutually exclusive** CLI entry shapes; all converge on `applyDiffPayload
 
 **Show / snippet wiring:** **`src/cli/show-snippet-args.ts`** (shared argv parser) + **`src/cli/show-snippet-render.ts`** (shared terminal/JSON error helpers) + **`src/cli/cmd-show.ts`** + **`src/cli/cmd-snippet.ts`** — sibling CLI verbs sharing the same parser shape (`<name>` or **`--query '<field:value …>'`** + **`--with-fts`** + `--kind` + `--in <path>` + `--json`; show adds **`--print-sql`**) and the pure engines **`src/application/show-engine.ts`** (exact lookup + envelope builders), **`src/application/search-query-parser.ts`** + **`src/application/search-engine.ts`** (field-qualified search → parameterized SQL on `symbols`, optional `source_fts` join), and **`src/application/show-search-mode.ts`** (shared parse/normalize + FTS resolution + **`executeShowLookup`** + **`formatShowSearchSqlForQuery`** for CLI/MCP/HTTP). Exact lookup: `findSymbolsByName({db, name, kind?, inPath?})`. Query lookup: `searchSymbols({db, parsed, withFts?})`. Snippet FS read: `readSymbolSource({match, projectRoot, indexedContentHash?})` + `getIndexedContentHash(db, filePath)`. **`buildShowResult`** + **`buildSnippetResult`** envelope builders — same engines the MCP show/snippet tools call. Both verbs return the same `{matches, disambiguation?, warning?}` envelope — single match → `{matches: [{...}]}`; multi-match adds `{n, by_kind, files, hint}`; optional **`warning`** when FTS was requested but `source_fts` is empty. Snippet matches add `source` / `stale` / `missing` fields (additive — no shape divergence). **`--in <path>`** and **`path:`** inside **`--query`** normalize through `toProjectRelative(projectRoot, p)` (from **`src/application/validate-engine.ts`**). Stale-file behavior on `snippet`: `hashContent` (from **`src/hash.ts`**) compares on-disk content against `files.content_hash`; mismatch sets `stale: true` but source IS still returned. MCP tools `show` and `snippet` register parallel to the CLI surface (see [§ MCP wiring](#cli-usage)).
 
+**Evidence columns (high-judgment recipes):** Some bundled recipes add optional **`reason`** and **`evidence_json`** TEXT columns on each result row — factual detection path for agents, not pass/fail verdicts. Contract: [golden-queries.md § Evidence columns](./golden-queries.md#evidence-columns-high-judgment-recipes).
+
 **Recipes wiring:** **`src/application/recipes-loader.ts`** (pure transport-agnostic loader) + **`src/application/query-recipes.ts`** (cache + public API — `getQueryRecipeSql` / `getQueryRecipeActions` / `getQueryRecipeParams` / `listQueryRecipeIds` / `listQueryRecipeCatalog` / `getQueryRecipeCatalogEntry`, shared by CLI + MCP). Recipes live as file pairs: **`<id>.sql`** + optional **`<id>.md`**. The loader reads `templates/recipes/` (bundled, ships in npm package next to `templates/agents/`) and `<state-dir>/recipes/` (project-local — default `.codemap/recipes/`; honors `--state-dir` / `CODEMAP_STATE_DIR`; root-only resolution per the registry plan, no walk-up). Project recipes win on id collision; entries that override a bundled id carry **`shadows: true`** in the catalog so agents reading `codemap://recipes` at session start see when a recipe behaves differently from the documented bundled version. Per-row **`actions`** templates and recipe **`params`** declarations live in YAML frontmatter on each `<id>.md` — uniform shape across bundled + project. Param types are `string | number | boolean`; CLI passes values via repeatable `--params key=value[,key=value]`, MCP / HTTP pass nested `params: {key: value}` to `query_recipe`. Validation runs before SQL binding; missing / unknown / malformed params return the same `{error}` envelope as query failures. Hand-rolled YAML parser is scoped to block-list `actions:` and `params:` only (no `js-yaml` dep). Load-time validation rejects empty SQL and DML / DDL keywords (`INSERT` / `UPDATE` / `DELETE` / `DROP` / `CREATE` / `ALTER` / `ATTACH` / `DETACH` / `REPLACE` / `TRUNCATE` / `VACUUM` / `PRAGMA`) with recipe-aware error messages — defence in depth alongside the runtime `PRAGMA query_only=1` backstop in `query-engine.ts` (PR #35). `<state-dir>/index.db` is gitignored; `<state-dir>/recipes/` is NOT (verified via `git check-ignore`) — recipes are git-tracked source code authored for human review.
 
 **Tool / resource handlers (transport-agnostic):** **`src/application/tool-handlers.ts`** + **`src/application/resource-handlers.ts`** — pure functions that take the args object an MCP tool / resource URI accepts and return a discriminated **`ToolResult`** (`{ok: true, format: 'json'|'sarif'|'annotations'|'mermaid'|'diff'|'diff-json'|'codeclimate'|'badge', payload}` — badge arm also carries `badgeStyle`; `{ok: false, error}`) or a **`ResourcePayload`** (`{mimeType, text}`). MCP and HTTP both wrap the same handlers — MCP translates to `{content: [{type: "text", text}]}`, HTTP translates to `(status, body)` with the right `Content-Type`. Engine layer untouched; transport changes don't ripple into the SQL.

docs/plans/agent-enrichment-wave.md

@@ -91,4 +91,4 @@ Each PR: `harden-pr full` → merge. Do not batch plans 1–4 into one PR.
 
 ## Current slice
 
-**Active:** Plan 1 **complete** (slices 1.0–1.4 on `feat/evidence-chains-boundary`) — open **PR #B**, then Plan 2 spike **2.0**.
+**Active:** Plan 1 shipped in [**PR #174**](https://github.com/stainless-code/codemap/pull/174) (awaiting merge) — next: Plan 2 spike **2.0** (`graph-estimated-crap.md`).

fixtures/golden/minimal/call-resolution-stats.json

@@ -1,7 +1,7 @@
 [
   {
-    "total_calls": 47,
-    "resolved_calls": 26,
+    "total_calls": 48,
+    "resolved_calls": 27,
     "method_calls_deferred": 20,
     "unresolved_queue": 1,
     "residual_meta": "1"

fixtures/golden/minimal/components-touching-deprecated.json

@@ -1,4 +1,11 @@
 [
+  {
+    "component": "ProductCard",
+    "component_file": "src/components/shop/ProductCard.tsx",
+    "deprecated_symbol": "now",
+    "deprecated_file": "src/utils/date.ts",
+    "via": "call"
+  },
   {
     "component": "ShopButton",
     "component_file": "src/components/shop/ShopButton.tsx",

fixtures/golden/minimal/coverage-rows-after-ingest.json

@@ -2,8 +2,15 @@
   {
     "file_path": "src/components/shop/ProductCard.tsx",
     "name": "ProductCard",
-    "hit_statements": 3,
-    "total_statements": 3,
+    "hit_statements": 2,
+    "total_statements": 2,
+    "coverage_pct": 100
+  },
+  {
+    "file_path": "src/components/shop/ProductCard.tsx",
+    "name": "spread",
+    "hit_statements": 1,
+    "total_statements": 1,
     "coverage_pct": 100
   },
   {

fixtures/golden/minimal/deprecated-symbols.json

@@ -17,7 +17,7 @@
     "signature": "now(): number",
     "doc_comment": "@deprecated Use `Date.now()` directly. Kept as a fixture for the\n`deprecated-symbols` recipe golden test.",
     "reason": "has_callers",
-    "evidence_json": "[{\"kind\":\"caller\",\"name\":\"ShopButton\",\"file_path\":\"src/components/shop/ShopButton.tsx\",\"line_start\":10},{\"kind\":\"caller\",\"name\":\"run\",\"file_path\":\"src/consumer.ts\",\"line_start\":27},{\"kind\":\"caller\",\"name\":\"run\",\"file_path\":\"src/consumer.ts\",\"line_start\":30}]"
+    "evidence_json": "[{\"kind\":\"caller\",\"name\":\"ProductCard\",\"file_path\":\"src/components/shop/ProductCard.tsx\",\"line_start\":12},{\"kind\":\"caller\",\"name\":\"ShopButton\",\"file_path\":\"src/components/shop/ShopButton.tsx\",\"line_start\":10},{\"kind\":\"caller\",\"name\":\"run\",\"file_path\":\"src/consumer.ts\",\"line_start\":27},{\"truncated\":true}]"
   },
   {
     "name": "epochMs",

fixtures/golden/minimal/files-hashes.json

@@ -115,9 +115,9 @@
   },
   {
     "path": "src/components/shop/ProductCard.tsx",
-    "content_hash": "27b25a905655574a3002adc140b36e91b95f8f1a5db0758ba172115595134122",
+    "content_hash": "130e72381a5b03071f22f161e178d2800c48124d1bbc33359520218ad48e3a1e",
     "language": "tsx",
-    "line_count": 23
+    "line_count": 24
   },
   {
     "path": "src/components/shop/ShopButton.default.ts",

fixtures/golden/minimal/files-largest.json

@@ -43,8 +43,8 @@
   },
   {
     "path": "src/components/shop/ProductCard.tsx",
-    "line_count": 23,
-    "size": 654,
+    "line_count": 24,
+    "size": 748,
     "language": "tsx"
   },
   {

fixtures/golden/minimal/find-export-sites.json

@@ -7,7 +7,7 @@
     "is_re_export": 0,
     "re_export_source": null,
     "line_start": 10,
-    "line_end": 22,
+    "line_end": 23,
     "column_start": 16,
     "column_end": 27
   },

fixtures/golden/minimal/find-jsx-usages.json

@@ -2,8 +2,8 @@
   {
     "file_path": "src/components/shop/ProductCard.tsx",
     "component_name": "article",
-    "line_start": 15,
-    "line_end": 19,
+    "line_start": 16,
+    "line_end": 20,
     "is_self_closing": 0,
     "is_fragment": 0,
     "is_lowercase": 1,