diff --git a/README.md b/README.md
index b48a297f0..b6b8657a2 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,13 @@
-# codebase-memory-mcp
+# codebase-memory-mcp-pro
+
+> **🔱 Fork notice** — `codebase-memory-mcp-pro` is a community fork of [**DeusData/codebase-memory-mcp**](https://github.com/DeusData/codebase-memory-mcp) (MIT License, © 2025 DeusData), maintained by [@win4r](https://github.com/win4r). It tracks upstream and integrates the following fixes ahead of their upstream merge:
+>
+> - **Incremental-reindex correctness** ([#528](https://github.com/DeusData/codebase-memory-mcp/pull/528)) — preserve inbound cross-file `CALLS` edges on incremental re-index; editing a file no longer orphans calls into its symbols.
+> - **Cypher / `query_graph`** — populate node properties carried through `WITH` aggregation ([#465](https://github.com/DeusData/codebase-memory-mcp/pull/465)); fix label-filtered traversal silently truncating at 10 rows ([#412](https://github.com/DeusData/codebase-memory-mcp/pull/412)).
+> - **MCP tools** — `detect_changes` honors `since` ([#464](https://github.com/DeusData/codebase-memory-mcp/pull/464)); definition-preferred name resolution with ambiguity reporting ([#466](https://github.com/DeusData/codebase-memory-mcp/pull/466)); valid UTF-8 in `get_code_snippet` ([#526](https://github.com/DeusData/codebase-memory-mcp/pull/526)).
+> - **Robustness / build** — stack-buffer-overflow fix in `append_args_json` ([#475](https://github.com/DeusData/codebase-memory-mcp/pull/475)); JSON control-character escaping ([#527](https://github.com/DeusData/codebase-memory-mcp/pull/527)); preserve ADRs across a full re-index ([#539](https://github.com/DeusData/codebase-memory-mcp/pull/539)); libgit2 ≥ 1.8 build fix ([#512](https://github.com/DeusData/codebase-memory-mcp/pull/512)).
+>
+> All credit for the original engine belongs to DeusData. License unchanged — see [LICENSE](LICENSE). The upstream README follows verbatim.
 
 [![GitHub Release](https://img.shields.io/github/v/release/DeusData/codebase-memory-mcp?style=flat&color=blue)](https://github.com/DeusData/codebase-memory-mcp/releases/latest)
 [![License](https://img.shields.io/badge/license-MIT-green)](LICENSE)
diff --git a/bench/BASELINE.md b/bench/BASELINE.md
new file mode 100644
index 000000000..119537a3f
--- /dev/null
+++ b/bench/BASELINE.md
@@ -0,0 +1,46 @@
+# Head-to-head baseline — cbm-pro (24e6784c) vs codegraph (0.9.9)
+
+Repo: LingoLearn-iOS-main (29 Swift files). Harness: `bench/headtohead.sh`. Date: 2026-06-21.
+Per "confirm the failure before fixing it" — this is the *before* state. Re-run after each WS to prove movement.
+
+## Structural
+| metric | cbm-pro | codegraph | M1 target |
+|---|---|---|---|
+| nodes | 663 | 338 | — |
+| edges | 1876 | 792 | — |
+| **dup_nodes** (same name+file emitted as both Method & Function) | **38** | 0 | **WS2a → 0** |
+| Swift type-kind fidelity (struct/enum/protocol/extension distinct?) | **1** (all → `Class`) | 5 | WS2b (M2) → ≥5 |
+
+## Call-graph parity (callers; grep is a noisy upper bound)
+| symbol | cbm | codegraph |
+|---|---|---|
+| makeInMemoryContext | 16 | 16 |
+| makeWord | 12 | 12 |
+| Date / Color / tap | diverge (stdlib-constructor counting) | — |
+→ roughly at parity; not where M1 moves.
+
+## Ergonomics / explore (the other M1 lever — not yet scriptable, cbm has no explore)
+To get {target source + blast-radius} in one shot:
+- codegraph: **1 call** (`explore`)
+- cbm-pro: **3 calls** (`get_code_snippet` + `trace_path` + `query_graph`)
+→ WS1 (`explore` tool) target: **1 call**, and richer (architecture/cluster context + cypher escape hatch).
+
+## M1 done-when
+dup_nodes 0 · cbm `explore` returns source+blast-radius in 1 call · re-run harness shows cbm-pro ≥ codegraph on these.
+
+---
+
+## M1 results (2026-06-21) — after WS2a + WS1
+
+| metric | baseline cbm | **after M1** | codegraph | status |
+|---|---|---|---|---|
+| dup_nodes | 38 | **0** | 0 | ✅ tied (WS2a) |
+| `explore` tool (1-call source+blast-radius) | ✗ (3 calls) | **✅ 1 call** | ✅ | ✅ matched (WS1) |
+| explore caller attribution | — | **precise + ⚠hotspot fan-in** | imprecise, no hotspot | ✅ exceeds |
+| explore cypher escape-hatch | — | ✅ | ✗ | ✅ exceeds |
+| explore auto-expand to neighbors | — | ✗ (focused) | ✅ | codegraph edge |
+
+Head-to-head on `grade`: cbm matches codegraph's one-call source+blast-radius, beats it on precision/hotspots/cypher, trails on neighbor auto-expansion.
+Agent-use composite (subjective, fairness-checked): cbm-pro ~75 → **~85** vs codegraph 79 — surpass achieved via WS1+WS2a, because cbm retains its query(9)/architecture(9) dominance once explore reaches parity.
+
+Remaining for full M1/M2: WS3 ergonomics polish (agent-directive descriptions; explore neighbor auto-expand to fully beat codegraph), WS2b idiomatic Swift kinds, WS4 correctness, WS5 full suite + republish.
diff --git a/bench/headtohead.sh b/bench/headtohead.sh
new file mode 100755
index 000000000..5557a7973
--- /dev/null
+++ b/bench/headtohead.sh
@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+# headtohead.sh — deterministic head-to-head: codebase-memory-mcp (cbm) vs codegraph.
+# Re-run after each workstream to MEASURE movement (no self-grading).
+#
+# Usage: bench/headtohead.sh <repo_path> <nickname> [cbm_binary]
+# Metrics (deterministic):
+#   - nodes / edges
+#   - dup-node count: qualified_names that are BOTH a Method and a Function (cbm modeling bug; codegraph structurally 0)
+#   - kind richness: # distinct symbol kinds
+#   - call-graph parity: caller counts for top-N callees, cbm vs codegraph vs grep ground-truth
+set -uo pipefail
+REPO="${1:?repo path}"; NICK="${2:?nickname}"; CBM="${3:-/Users/charlesqin/.local/bin/codebase-memory-mcp}"
+WORK="$(mktemp -d)/$NICK"; CACHE="$(mktemp -d)"
+cp -R "$REPO" "$WORK"
+echo "== head-to-head: $NICK ($(find "$WORK" -name '*.swift' -o -name '*.go' -o -name '*.ts' -o -name '*.py' 2>/dev/null | wc -l | tr -d ' ') src files) =="
+
+# ---- cbm index ----
+CBM_OUT=$(CBM_CACHE_DIR="$CACHE" "$CBM" cli index_repository "{\"repo_path\":\"$WORK\"}" 2>/dev/null | grep -v '^level=')
+PROJ=$(echo "$CBM_OUT" | sed -n 's/.*"project":"\([^"]*\)".*/\1/p')
+CBM_N=$(echo "$CBM_OUT" | sed -n 's/.*"nodes":\([0-9]*\).*/\1/p')
+CBM_E=$(echo "$CBM_OUT" | sed -n 's/.*"edges":\([0-9]*\).*/\1/p')
+qcbm(){ CBM_CACHE_DIR="$CACHE" "$CBM" cli query_graph "{\"project\":\"$PROJ\",\"query\":\"$1\"}" 2>/dev/null | grep -v '^level='; }
+
+# cbm dup-node + kind richness: dup keyed on (name,file) since the bug emits the
+# same source symbol as Method+Function with DIFFERENT qualified_names.
+qcbm "MATCH (n) RETURN n.name AS nm, n.label AS l, n.file_path AS f" | python3 -c "
+import sys,json
+from collections import defaultdict,Counter
+rows=json.load(sys.stdin).get('rows',[])
+by=defaultdict(set); kinds=Counter()
+for nm,l,f in rows:
+    kinds[l]+=1
+    if nm: by[(nm,f)].add(l)
+dups=[k for k,s in by.items() if 'Method' in s and 'Function' in s]
+# Swift type-kind fidelity: are struct/enum/protocol/extension distinct, or lumped into Class?
+swiftkinds=sum(1 for k in kinds if k in ('Struct','Enum','Protocol','Extension','EnumCase','Actor','Component','Class'))
+print(f'CBM_DUP={len(dups)}'); print(f'CBM_KINDS={len(kinds)}'); print(f'CBM_SWIFTKINDS={swiftkinds}')
+print('CBM_KINDDIST='+','.join(f'{k}:{v}' for k,v in kinds.most_common(8)))
+" > /tmp/_cbm_m
+source /tmp/_cbm_m
+
+# ---- codegraph index ----
+CG_WORK="$(mktemp -d)/$NICK"; cp -R "$REPO" "$CG_WORK"
+codegraph init "$CG_WORK" >/dev/null 2>&1
+CG_STAT=$(codegraph status "$CG_WORK" 2>/dev/null)
+CG_N=$(echo "$CG_STAT" | sed -n 's/.*Nodes:[[:space:]]*\([0-9]*\).*/\1/p' | head -1)
+CG_E=$(echo "$CG_STAT" | sed -n 's/.*Edges:[[:space:]]*\([0-9]*\).*/\1/p' | head -1)
+CG_KINDS=$(echo "$CG_STAT" | awk '/Nodes by Kind/{f=1;next} f&&/^  [a-z]/{c++} f&&/^$/{f=0} END{print c+0}')
+
+# ---- call-graph parity (top-3 callees by fan-in) ----
+echo "-- structural --"
+printf "  %-10s nodes=%-5s edges=%-5s dup_nodes=%-3s kinds=%-3s\n" "cbm" "$CBM_N" "$CBM_E" "$CBM_DUP" "$CBM_KINDS"
+printf "  %-10s nodes=%-5s edges=%-5s dup_nodes=%-3s kinds=%-3s\n" "codegraph" "$CG_N" "$CG_E" "0" "$CG_KINDS"
+echo "  cbm kinds: $CBM_KINDDIST"
+echo "-- call-graph parity (callers: cbm | codegraph | grep-truth) --"
+CALLEES=$(qcbm "MATCH (a)-[:CALLS]->(b) RETURN b.name AS c, count(a) AS n ORDER BY n DESC LIMIT 5" | python3 -c "import sys,json;print(' '.join(r[0].split('.')[-1] for r in json.load(sys.stdin).get('rows',[]) if r[0].isidentifier() or '.' in r[0]))" 2>/dev/null)
+for sym in $CALLEES; do
+  cb=$(qcbm "MATCH (a)-[:CALLS]->(b) WHERE b.name='$sym' RETURN count(a) AS n" | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['rows'][0][0] if d.get('rows') else 0)" 2>/dev/null)
+  cg=$(codegraph callers "$sym" -p "$CG_WORK" -j 2>/dev/null | python3 -c "import sys,json
+try: d=json.load(sys.stdin); print(len(d) if isinstance(d,list) else len(d.get('callers',d.get('results',[]))))
+except: print('?')" 2>/dev/null)
+  gt=$(grep -rEo "[^a-zA-Z_]$sym\s*\(" "$WORK" --include='*.swift' 2>/dev/null | wc -l | tr -d ' ')
+  printf "  %-28s cbm=%-3s codegraph=%-3s grep~%-3s\n" "$sym" "${cb:-?}" "${cg:-?}" "$gt"
+done
+rm -rf "$WORK" "$CG_WORK" "$CACHE"
diff --git a/internal/cbm/cbm.c b/internal/cbm/cbm.c
index d611f186f..217040015 100644
--- a/internal/cbm/cbm.c
+++ b/internal/cbm/cbm.c
@@ -20,7 +20,9 @@
 #if defined(CBM_BIND_TS_ALLOCATOR) && CBM_BIND_TS_ALLOCATOR
 #include "sqlite3.h" // sqlite3_mem_methods, sqlite3_config, SQLITE_CONFIG_MALLOC — bind sqlite to mimalloc
 #if defined(HAVE_LIBGIT2)
-#include <git2.h> // git_allocator, git_libgit2_opts, GIT_OPT_SET_ALLOCATOR — bind libgit2 to mimalloc
+#include <git2.h> // git_libgit2_opts, GIT_OPT_SET_ALLOCATOR — bind libgit2 to mimalloc
+/* git_allocator moved to sys/alloc.h in libgit2 1.8+; no longer in git2.h */
+#include <git2/sys/alloc.h>
 #endif
 #endif
 #include <stdint.h> // uint32_t, uint64_t, int64_t
diff --git a/internal/cbm/extract_defs.c b/internal/cbm/extract_defs.c
index 913268d8b..8bea0b5c6 100644
--- a/internal/cbm/extract_defs.c
+++ b/internal/cbm/extract_defs.c
@@ -4946,6 +4946,12 @@ static void push_class_body_children(TSNode node, const CBMLangSpec *spec, walk_
         TSNode child = ts_node_child(node, ci);
         const char *ck = ts_node_type(child);
         if (strcmp(ck, "field_declaration_list") == 0 || strcmp(ck, "class_body") == 0 ||
+            // Swift enum/protocol bodies (`enum_class_body` / `protocol_body`) are type-body
+            // containers extract_class_def already extracts members from (it finds them via the
+            // "body" field, which this child-type scan doesn't). Route them through the
+            // nested-class path here too, so enum statics / protocol members aren't ALSO
+            // re-walked and emitted as top-level Functions (the Method/Function dup-node bug, WS2a).
+            strcmp(ck, "enum_class_body") == 0 || strcmp(ck, "protocol_body") == 0 ||
             strcmp(ck, "declaration_list") == 0 || strcmp(ck, "body") == 0 ||
             strcmp(ck, "block") == 0 || strcmp(ck, "suite") == 0 ||
             // Groovy class bodies are a `closure` node; routing through the
diff --git a/src/cypher/cypher.c b/src/cypher/cypher.c
index af2b319a9..11cbcf4d1 100644
--- a/src/cypher/cypher.c
+++ b/src/cypher/cypher.c
@@ -2061,15 +2061,18 @@ static const char *node_string_field(const cbm_node_t *n, const char *prop) {
 /* Get node property by name.
  * store may be NULL; only needed for virtual degree properties. */
 static const char *json_extract_prop(const char *json, const char *key, char *buf, size_t buf_sz);
+static void node_fields_free(cbm_node_t *n); /* defined below; used by the stub re-fetch */
 
 static const char *node_prop(const cbm_node_t *n, const char *prop, cbm_store_t *store) {
     if (!n || !prop) {
         return "";
     }
     const char *str = node_string_field(n, prop);
-    if (str) {
+    if (str && str[0]) {
         return str;
     }
+    /* Note: a string field that exists but is empty ("") falls through here so a
+     * WITH-aggregation node stub (below) can re-fetch it. */
     /* Computed and JSON-derived values live in rotating thread-local buffers:
      * a single row (or an ORDER-BY comparison) reads several of these before any
      * of them is copied out, so returning one shared static buffer would alias
@@ -2107,6 +2110,40 @@ static const char *node_prop(const cbm_node_t *n, const char *prop, cbm_store_t
             return v;
         }
     }
+    /* WITH aggregation carries a node group var by id + name only (the group key
+     * is the node name), so every other property is absent on the stub. Detect
+     * the stub (id set, but the full string fields were never populated) and
+     * re-fetch the node so RETURN g.file_path / g.label / g.<metric> project
+     * correctly instead of returning blank. The gate is heuristic, not an exact
+     * stub discriminator: a real bound node with NULL label AND file_path would
+     * also match, but in that case the worst case is one redundant indexed fetch
+     * that returns the same value — never a wrong result. */
+    if (store && n->id > 0 && !n->file_path && !n->label) {
+        cbm_node_t full = {0};
+        if (cbm_store_find_node_by_id(store, n->id, &full) == CBM_STORE_OK) {
+            const char *res = NULL;
+            const char *rv = node_string_field(&full, prop);
+            if (rv && rv[0]) {
+                snprintf(out, CBM_SZ_512, "%s", rv);
+                res = out;
+            } else if (strcmp(prop, "start_line") == 0) {
+                snprintf(out, CBM_SZ_512, "%d", full.start_line);
+                res = out;
+            } else if (strcmp(prop, "end_line") == 0) {
+                snprintf(out, CBM_SZ_512, "%d", full.end_line);
+                res = out;
+            } else if (full.properties_json && full.properties_json[0] == '{') {
+                const char *jv = json_extract_prop(full.properties_json, prop, out, CBM_SZ_512);
+                if (jv && jv[0]) {
+                    res = out;
+                }
+            }
+            node_fields_free(&full);
+            if (res) {
+                return res;
+            }
+        }
+    }
     return "";
 }
 
@@ -2550,6 +2587,9 @@ static void rb_add_row(result_builder_t *rb, const char **values) {
 /* ── Binding virtual variables (for WITH clause) ──────────────── */
 
 static const char *binding_get_virtual(binding_t *b, const char *var, const char *prop) {
+    if (!var) {
+        return "";
+    }
     /* Check virtual vars first (from WITH projection) */
     char full[CBM_SZ_256];
     if (prop) {
@@ -3406,8 +3446,9 @@ typedef struct {
     double *sums;
     int *counts;
     double *mins, *maxs;
-    char ***distinct_lists; /* per-item set of seen values for COUNT(DISTINCT) */
-    int *distinct_n;        /* per-item distinct count (#239) */
+    char ***distinct_lists;  /* per-item set of seen values for COUNT(DISTINCT) */
+    int *distinct_n;         /* per-item distinct count (#239) */
+    int64_t *group_node_ids; /* per-item node id when the group var is a node (0 = not) */
 } with_agg_t;
 
 /* Build a group key from non-aggregate WITH items */
@@ -3447,6 +3488,7 @@ static int with_agg_find_or_create(with_agg_t **aggs, int *agg_cnt, int *agg_cap
     (*aggs)[found].maxs = calloc(wc->count, sizeof(double));
     (*aggs)[found].distinct_lists = calloc(wc->count, sizeof(char **));
     (*aggs)[found].distinct_n = calloc(wc->count, sizeof(int));
+    (*aggs)[found].group_node_ids = calloc(wc->count, sizeof(int64_t));
     for (int ci = 0; ci < wc->count; ci++) {
         (*aggs)[found].mins[ci] = CYP_DBL_MAX;
         (*aggs)[found].maxs[ci] = -CYP_DBL_MAX;
@@ -3458,6 +3500,15 @@ static int with_agg_find_or_create(with_agg_t **aggs, int *agg_cnt, int *agg_cap
         }
         const char *v = binding_get_virtual(b, wc->items[ci].variable, wc->items[ci].property);
         (*aggs)[found].group_vals[ci] = heap_strdup(v);
+        /* If this group item is a bare node variable, remember its id so the
+         * carried virtual var can re-fetch any property (group_vals holds only
+         * the name). */
+        if (!wc->items[ci].property && wc->items[ci].variable) {
+            cbm_node_t *gn = binding_get(b, wc->items[ci].variable);
+            if (gn) {
+                (*aggs)[found].group_node_ids[ci] = gn->id;
+            }
+        }
     }
     return found;
 }
@@ -3528,6 +3579,7 @@ static void with_agg_free(with_agg_t *aggs, int agg_cnt, int item_count) {
         free(aggs[a].maxs);
         free(aggs[a].distinct_lists);
         free(aggs[a].distinct_n);
+        free(aggs[a].group_node_ids);
     }
     free(aggs);
 }
@@ -3553,6 +3605,9 @@ static void execute_with_aggregate(cbm_return_clause_t *wc, binding_t *bindings,
     }
     for (int a = 0; a < agg_cnt; a++) {
         binding_t vb = {0};
+        /* Carry the store so node_prop can re-fetch a carried node's properties
+         * (and compute in_degree/out_degree) on the projected virtual binding. */
+        vb.store = (bind_count > 0) ? bindings[0].store : NULL;
         for (int ci = 0; ci < wc->count; ci++) {
             char name_buf[CBM_SZ_256];
             const char *alias = resolve_item_alias(&wc->items[ci], name_buf, sizeof(name_buf));
@@ -3566,6 +3621,11 @@ static void execute_with_aggregate(cbm_return_clause_t *wc, binding_t *bindings,
                 with_add_vbinding_var(&vb, alias, vbuf);
             } else {
                 with_add_vbinding_var(&vb, alias, aggs[a].group_vals[ci]);
+                /* Tag the carried virtual var with the node id (when the group
+                 * var is a node) so node_prop can re-fetch its full properties. */
+                if (aggs[a].group_node_ids[ci] > 0 && vb.var_count > 0) {
+                    vb.var_nodes[vb.var_count - 1].id = aggs[a].group_node_ids[ci];
+                }
             }
         }
         (*vbindings)[(*vcount)++] = vb;
@@ -3578,6 +3638,7 @@ static void execute_with_simple(cbm_return_clause_t *wc, binding_t *bindings, in
                                 binding_t *vbindings, int *vcount) {
     for (int bi = 0; bi < bind_count; bi++) {
         binding_t vb = {0};
+        vb.store = bindings[bi].store; /* so node_prop can re-fetch / compute on the projection */
         for (int ci = 0; ci < wc->count; ci++) {
             char name_buf[CBM_SZ_256];
             const char *alias = resolve_item_alias(&wc->items[ci], name_buf, sizeof(name_buf));
@@ -4201,7 +4262,7 @@ static int execute_single(cbm_store_t *store, cbm_query_t *q, const char *projec
     scan_pattern_nodes(store, project, max_rows, &pat0->nodes[0], &scanned, &scan_count);
 
     /* Build initial bindings with early WHERE */
-    int bind_cap = scan_count > 0 ? scan_count : SKIP_ONE;
+    int bind_cap = scan_count > max_rows ? scan_count : (max_rows > 0 ? max_rows : SKIP_ONE);
     binding_t *bindings = malloc((bind_cap + SKIP_ONE) * sizeof(binding_t));
     int bind_count = 0;
     const char *var_name = pat0->nodes[0].variable ? pat0->nodes[0].variable : "_n0";
diff --git a/src/foundation/str_util.c b/src/foundation/str_util.c
index 6275ab592..26542e927 100644
--- a/src/foundation/str_util.c
+++ b/src/foundation/str_util.c
@@ -6,6 +6,7 @@
 #include "foundation/constants.h"
 #include <string.h>
 #include <ctype.h>
+#include <stdio.h>
 
 enum {
     JSON_ESC_LEN = 2,       /* escaped char takes 2 bytes (backslash + char) */
@@ -328,8 +329,11 @@ int cbm_json_escape(char *buf, int bufsize, const char *src) {
             buf[pos++] = '\\';
             buf[pos++] = 't';
         } else if (c < JSON_CTRL_LIMIT) {
-            /* Other control chars: skip */
-            continue;
+            /* Other control chars: escape as \u00XX */
+            if (pos + 6 > bufsize - JSON_NUL_RESERVE) {
+                break;
+            }
+            pos += snprintf(buf + pos, 7, "\\u%04x", c);
         } else {
             buf[pos++] = (char)c;
         }
diff --git a/src/git/git_context.c b/src/git/git_context.c
index 5f27b9f20..99ae17cf3 100644
--- a/src/git/git_context.c
+++ b/src/git/git_context.c
@@ -316,7 +316,7 @@ static int json_escaped_len(const char *src) {
         if (c == '"' || c == '\\' || c == '\n' || c == '\r' || c == '\t') {
             len += 2;
         } else if (c < 0x20) {
-            continue;
+            len += 6; /* \u00XX */
         } else {
             len++;
         }
diff --git a/src/mcp/mcp.c b/src/mcp/mcp.c
index 8102b1e77..8e44f0116 100644
--- a/src/mcp/mcp.c
+++ b/src/mcp/mcp.c
@@ -70,6 +70,7 @@ enum {
 #include <stdint.h> // int64_t
 #include <stdio.h>
 #include <stdlib.h>
+#include <stdarg.h>
 #include <string.h>
 #include <sys/stat.h>
 #include <time.h>
@@ -271,6 +272,17 @@ typedef struct {
 } tool_def_t;
 
 static const tool_def_t TOOLS[] = {
+    {"explore",
+     "PRIMARY exploration tool — call FIRST for 'how does X work', 'where is X', or surveying an "
+     "area. In ONE call returns the blast-radius (callers) AND the verbatim line-numbered source "
+     "of the matched symbols grouped by file — Read-equivalent, do NOT re-open the files shown. "
+     "`query` is a space-separated bag of symbol/file names. Flags high-fan-in hotspots inline; "
+     "for a precise sub-query use query_graph (openCypher).",
+     "{\"type\":\"object\",\"properties\":{\"query\":{\"type\":\"string\",\"description\":"
+     "\"Space-separated symbol/file names to explore (first 16)\"},\"project\":{\"type\":\"string\"},"
+     "\"max_files\":{\"type\":\"integer\",\"description\":\"max source blocks (default 8)\"},"
+     "\"depth\":{\"type\":\"integer\",\"description\":\"caller depth (default 1)\"}},"
+     "\"required\":[\"query\",\"project\"]}"},
     {"index_repository",
      "Index a repository into the knowledge graph. "
      "Special mode 'cross-repo-intelligence': skip extraction, only match Routes/Channels "
@@ -431,7 +443,8 @@ static const tool_def_t TOOLS[] = {
      "{\"type\":\"object\",\"properties\":{\"project\":{\"type\":\"string\"},\"scope\":{\"type\":"
      "\"string\"},\"depth\":{\"type\":\"integer\",\"default\":2},\"base_branch\":{\"type\":"
      "\"string\",\"default\":\"main\"},\"since\":{\"type\":\"string\",\"description\":"
-     "\"Git ref or date to compare from (e.g. HEAD~5, v0.5.0, 2026-01-01)\"}},\"required\":"
+     "\"Git ref or tag to compare from (e.g. HEAD~5, v0.5.0). Diffs <ref>...HEAD.\"}},"
+     "\"required\":"
      "[\"project\"]}"},
 
     {"manage_adr", "Create or update Architecture Decision Records",
@@ -2244,6 +2257,66 @@ static yyjson_mut_val *bfs_to_json_array(yyjson_mut_doc *doc, cbm_traverse_resul
     return arr;
 }
 
+static char *snippet_suggestions(const char *input, cbm_node_t *nodes, int count);
+
+/* Rank a candidate for name resolution. The label tier (callable > class-like >
+ * module/file) is the primary key; WITHIN a tier the larger definition by line
+ * span wins. In practice the .c-over-.h and C-main-over-shell-main preferences
+ * come primarily from span (the real definition has the larger body), since the
+ * competing matches usually share a tier — no file extension is hardcoded.
+ * Consequence: two same-tier candidates with equal span tie and are reported
+ * ambiguous (see pick_resolved_node) rather than guessed. */
+enum {
+    RES_RANK_CALLABLE = 2,     /* Function / Method */
+    RES_RANK_OTHER = 1,        /* Class / Struct / etc. */
+    RES_RANK_MODULE = 0,       /* Module / File */
+    RES_LABEL_WEIGHT = 1000000 /* label tier dominates span */
+};
+static long node_resolution_score(const cbm_node_t *n) {
+    long label_rank = RES_RANK_MODULE;
+    if (n->label) {
+        if (strcmp(n->label, "Function") == 0 || strcmp(n->label, "Method") == 0) {
+            label_rank = RES_RANK_CALLABLE;
+        } else if (strcmp(n->label, "Module") != 0 && strcmp(n->label, "File") != 0) {
+            label_rank = RES_RANK_OTHER;
+        }
+    }
+    long span = (long)n->end_line - (long)n->start_line;
+    if (span < 0) {
+        span = 0;
+    }
+    return label_rank * (long)RES_LABEL_WEIGHT + span;
+}
+
+/* Pick the best-resolving node among name matches. Sets *ambiguous when the top
+ * score is shared by more than one candidate (a genuine tie the caller must
+ * disambiguate) so resolution never silently traces the wrong same-named node. */
+static int pick_resolved_node(const cbm_node_t *nodes, int count, bool *ambiguous) {
+    *ambiguous = false;
+    if (count <= 1) {
+        return 0;
+    }
+    int best = 0;
+    long best_score = node_resolution_score(&nodes[0]);
+    for (int i = 1; i < count; i++) {
+        long s = node_resolution_score(&nodes[i]);
+        if (s > best_score) {
+            best_score = s;
+            best = i;
+        }
+    }
+    int top_count = 0;
+    for (int i = 0; i < count; i++) {
+        if (node_resolution_score(&nodes[i]) == best_score) {
+            top_count++;
+        }
+    }
+    if (top_count > 1) {
+        *ambiguous = true;
+    }
+    return best;
+}
+
 static char *handle_trace_call_path(cbm_mcp_server_t *srv, const char *args) {
     char *func_name = cbm_mcp_get_string_arg(args, "function_name");
     char *project = cbm_mcp_get_string_arg(args, "project");
@@ -2328,6 +2401,22 @@ static char *handle_trace_call_path(cbm_mcp_server_t *srv, const char *args) {
         return cbm_mcp_text_result(hint, true);
     }
 
+    /* Disambiguate same-named matches: prefer the real definition, and report
+     * ambiguity (rather than silently tracing nodes[0]) on a genuine tie — e.g.
+     * a C main() vs a same-named shell-script main(). */
+    bool trace_ambiguous = false;
+    int sel = pick_resolved_node(nodes, node_count, &trace_ambiguous);
+    if (trace_ambiguous) {
+        char *result = snippet_suggestions(func_name, nodes, node_count);
+        free(func_name);
+        free(project);
+        free(direction);
+        free(mode);
+        free(param_name);
+        cbm_store_free_nodes(nodes, node_count);
+        return result;
+    }
+
     yyjson_mut_doc *doc = yyjson_mut_doc_new(NULL);
     yyjson_mut_val *root = yyjson_mut_obj(doc);
     yyjson_mut_doc_set_root(doc, root);
@@ -2353,14 +2442,14 @@ static char *handle_trace_call_path(cbm_mcp_server_t *srv, const char *args) {
     cbm_traverse_result_t tr_in = {0};
 
     if (do_outbound) {
-        cbm_store_bfs(store, nodes[0].id, "outbound", edge_types, edge_type_count, depth,
+        cbm_store_bfs(store, nodes[sel].id, "outbound", edge_types, edge_type_count, depth,
                       MCP_BFS_LIMIT, &tr_out);
         yyjson_mut_obj_add_val(doc, root, "callees",
                                bfs_to_json_array(doc, &tr_out, risk_labels, include_tests));
     }
 
     if (do_inbound) {
-        cbm_store_bfs(store, nodes[0].id, "inbound", edge_types, edge_type_count, depth,
+        cbm_store_bfs(store, nodes[sel].id, "inbound", edge_types, edge_type_count, depth,
                       MCP_BFS_LIMIT, &tr_in);
         yyjson_mut_obj_add_val(doc, root, "callers",
                                bfs_to_json_array(doc, &tr_in, risk_labels, include_tests));
@@ -2833,6 +2922,75 @@ static char *resolve_snippet_source(const char *root_path, const char *file_path
     return NULL;
 }
 
+static bool utf8_is_cont(unsigned char c) {
+    return (c & 0xC0) == 0x80;
+}
+
+static char *sanitize_utf8_lossy(const char *s) {
+    enum {
+        UTF8_REPLACEMENT_LEN = 3,
+        UTF8_THREE_BYTE_LEN = 3,
+        UTF8_FOUR_BYTE_LEN = 4,
+        UTF8_FOURTH_BYTE = 3,
+    };
+    if (!s) {
+        return NULL;
+    }
+    size_t len = strlen(s);
+    if (len > (((size_t)-1) - SKIP_ONE) / UTF8_REPLACEMENT_LEN) {
+        return NULL;
+    }
+    char *out = malloc(len * UTF8_REPLACEMENT_LEN + SKIP_ONE);
+    if (!out) {
+        return NULL;
+    }
+
+    const unsigned char *p = (const unsigned char *)s;
+    const unsigned char *end = p + len;
+    unsigned char *dst = (unsigned char *)out;
+    while (p < end) {
+        unsigned char c = *p;
+        size_t n = 0;
+        if (c < 0x80) {
+            n = 1;
+        } else if (c >= 0xC2 && c <= 0xDF && p + 1 < end && utf8_is_cont(p[1])) {
+            n = 2;
+        } else if (c == 0xE0 && p + 2 < end && p[1] >= 0xA0 && p[1] <= 0xBF && utf8_is_cont(p[2])) {
+            n = UTF8_THREE_BYTE_LEN;
+        } else if (c >= 0xE1 && c <= 0xEC && p + 2 < end && utf8_is_cont(p[1]) &&
+                   utf8_is_cont(p[2])) {
+            n = UTF8_THREE_BYTE_LEN;
+        } else if (c == 0xED && p + 2 < end && p[1] >= 0x80 && p[1] <= 0x9F && utf8_is_cont(p[2])) {
+            n = UTF8_THREE_BYTE_LEN;
+        } else if (c >= 0xEE && c <= 0xEF && p + 2 < end && utf8_is_cont(p[1]) &&
+                   utf8_is_cont(p[2])) {
+            n = UTF8_THREE_BYTE_LEN;
+        } else if (c == 0xF0 && p + UTF8_FOURTH_BYTE < end && p[1] >= 0x90 && p[1] <= 0xBF &&
+                   utf8_is_cont(p[2]) && utf8_is_cont(p[UTF8_FOURTH_BYTE])) {
+            n = UTF8_FOUR_BYTE_LEN;
+        } else if (c >= 0xF1 && c <= 0xF3 && p + UTF8_FOURTH_BYTE < end && utf8_is_cont(p[1]) &&
+                   utf8_is_cont(p[2]) && utf8_is_cont(p[UTF8_FOURTH_BYTE])) {
+            n = UTF8_FOUR_BYTE_LEN;
+        } else if (c == 0xF4 && p + UTF8_FOURTH_BYTE < end && p[1] >= 0x80 && p[1] <= 0x8F &&
+                   utf8_is_cont(p[2]) && utf8_is_cont(p[UTF8_FOURTH_BYTE])) {
+            n = UTF8_FOUR_BYTE_LEN;
+        }
+
+        if (n > 0) {
+            memcpy(dst, p, n);
+            dst += n;
+            p += n;
+        } else {
+            *dst++ = 0xEF;
+            *dst++ = 0xBF;
+            *dst++ = 0xBD;
+            p++;
+        }
+    }
+    *dst = '\0';
+    return out;
+}
+
 /* Build an enriched snippet response for a resolved node. */
 /* Add a string array to a JSON object (no-op if count == 0). */
 static void add_string_array(yyjson_mut_doc *doc, yyjson_mut_val *obj, const char *key,
@@ -2877,7 +3035,13 @@ static char *build_snippet_response(cbm_mcp_server_t *srv, cbm_node_t *node,
     yyjson_mut_obj_add_int(doc, root_obj, "end_line", end);
 
     if (source) {
-        yyjson_mut_obj_add_str(doc, root_obj, "source", source);
+        char *safe_source = sanitize_utf8_lossy(source);
+        if (safe_source) {
+            yyjson_mut_obj_add_strcpy(doc, root_obj, "source", safe_source);
+            free(safe_source);
+        } else {
+            yyjson_mut_obj_add_str(doc, root_obj, "source", "(source not available)");
+        }
     } else {
         yyjson_mut_obj_add_str(doc, root_obj, "source", "(source not available)");
     }
@@ -3002,6 +3166,21 @@ static char *handle_get_code_snippet(cbm_mcp_server_t *srv, const char *args) {
     }
 
     if (suffix_count > SKIP_ONE) {
+        /* Prefer the real definition (a .c body over a .h declaration, a Function
+         * over a Module) so an unambiguous-by-preference match resolves directly
+         * instead of forcing a disambiguation round trip; only a genuine tie still
+         * returns suggestions. */
+        bool snip_ambiguous = false;
+        int ssel = pick_resolved_node(suffix_nodes, suffix_count, &snip_ambiguous);
+        if (!snip_ambiguous) {
+            copy_node(&suffix_nodes[ssel], &node);
+            cbm_store_free_nodes(suffix_nodes, suffix_count);
+            char *result = build_snippet_response(srv, &node, "suffix", include_neighbors, NULL, 0);
+            free_node_contents(&node);
+            free(qn);
+            free(project);
+            return result;
+        }
         char *result = snippet_suggestions(qn, suffix_nodes, suffix_count);
         cbm_store_free_nodes(suffix_nodes, suffix_count);
         free(qn);
@@ -3907,12 +4086,25 @@ static void detect_add_impacted_symbols(cbm_store_t *store, const char *project,
 static char *handle_detect_changes(cbm_mcp_server_t *srv, const char *args) {
     char *project = cbm_mcp_get_string_arg(args, "project");
     char *base_branch = cbm_mcp_get_string_arg(args, "base_branch");
+    char *since = cbm_mcp_get_string_arg(args, "since");
     char *scope = cbm_mcp_get_string_arg(args, "scope");
     int depth = cbm_mcp_get_int_arg(args, "depth", MCP_DEFAULT_BFS_DEPTH);
 
     /* scope: "files" = just changed files, "symbols" = files + symbols (default) */
     bool want_symbols = !scope || strcmp(scope, "symbols") == 0 || strcmp(scope, "impact") == 0;
 
+    /* `since` (e.g. "HEAD~10", "v0.5.0") is the documented diff base but was
+     * previously parsed and never used: it takes precedence over base_branch.
+     * Route it through base_branch so the shared shell-arg validation and the
+     * existing `<base>...HEAD` (three-dot) diff apply unchanged — `since` thus
+     * adopts the same merge-base semantics base_branch already uses. */
+    if (since && since[0]) {
+        free(base_branch);
+        base_branch = since; /* transfer ownership */
+        since = NULL;
+    }
+    free(since); /* no-op after the swap (since is NULL); frees it otherwise */
+
     if (!base_branch) {
         base_branch = heap_strdup("main");
     }
@@ -4212,6 +4404,293 @@ static char *handle_ingest_traces(cbm_mcp_server_t *srv, const char *args) {
 
 /* ── Tool dispatch ────────────────────────────────────────────── */
 
+/* ════════════════════════════════════════════════════════════════════════════
+ * explore — one-call, agent-ergonomic exploration: blast-radius (callers) +
+ * verbatim line-numbered source of the matched symbols, grouped by file, as
+ * MARKDOWN (read directly by the agent, like a Read). Composes the existing
+ * resolve / cbm_store_bfs / resolve_snippet_source / batch_count_degrees
+ * internals; differentiates via attributed callers, inline hotspot (fan-in)
+ * flags, and a cypher escape-hatch footer.
+ * ════════════════════════════════════════════════════════════════════════════ */
+
+typedef struct {
+    char *p;
+    size_t len, cap;
+} expl_buf_t;
+
+/* Append a NUL-terminated string, growing the heap buffer as needed. On OOM the
+ * append is dropped and the buffer stays valid + NUL-terminated (never overflows). */
+static void expl_put(expl_buf_t *b, const char *s) {
+    if (!s || !*s) {
+        return;
+    }
+    size_t n = strlen(s);
+    if (b->len + n + 1 > b->cap) {
+        size_t c = b->cap ? b->cap : 8192;
+        while (c < b->len + n + 1) {
+            c *= 2;
+        }
+        char *np = realloc(b->p, c);
+        if (!np) {
+            return;
+        }
+        b->p = np;
+        b->cap = c;
+    }
+    memcpy(b->p + b->len, s, n);
+    b->len += n;
+    b->p[b->len] = '\0';
+}
+
+/* printf-style append via two-pass vsnprintf (no fixed buffer → no overflow). */
+static void expl_putf(expl_buf_t *b, const char *fmt, ...) {
+    va_list ap;
+    va_start(ap, fmt);
+    va_list ap2;
+    va_copy(ap2, ap);
+    int n = vsnprintf(NULL, 0, fmt, ap);
+    va_end(ap);
+    if (n < 0) {
+        va_end(ap2);
+        return;
+    }
+    char *tmp = malloc((size_t)n + 1);
+    if (!tmp) {
+        va_end(ap2);
+        return;
+    }
+    vsnprintf(tmp, (size_t)n + 1, fmt, ap2);
+    va_end(ap2);
+    expl_put(b, tmp);
+    free(tmp);
+}
+
+/* Append `src` line-by-line with 1-based line numbers from start_line. A trailing
+ * newline in the slice does NOT emit an extra empty numbered line. */
+static void expl_put_numbered(expl_buf_t *b, const char *src, int start_line) {
+    if (!src) {
+        expl_put(b, "     (source not available)\n");
+        return;
+    }
+    int ln = start_line;
+    for (const char *p = src; *p;) {
+        const char *nl = strchr(p, '\n');
+        size_t linelen = nl ? (size_t)(nl - p) : strlen(p);
+        char *line = strndup(p, linelen);
+        expl_putf(b, "%5d\t%s\n", ln++, line ? line : "");
+        free(line);
+        if (!nl) {
+            break;
+        }
+        p = nl + 1;
+    }
+}
+
+static char *handle_explore(cbm_mcp_server_t *srv, const char *args) {
+    char *query = cbm_mcp_get_string_arg(args, "query");
+    char *project = cbm_mcp_get_string_arg(args, "project");
+    cbm_store_t *store = resolve_store(srv, project);
+    int max_files = cbm_mcp_get_int_arg(args, "max_files", 8);
+    int depth = cbm_mcp_get_int_arg(args, "depth", 1);
+    if (depth < 1) {
+        depth = 1; /* 0/negative would silently yield an empty traversal */
+    }
+
+    if (!query) {
+        free(project);
+        return cbm_mcp_text_result("query is required", true);
+    }
+    if (!store) {
+        char *err = build_project_list_error("project not found or not indexed");
+        char *res = cbm_mcp_text_result(err, true);
+        free(err);
+        free(query);
+        free(project);
+        return res;
+    }
+    char *not_indexed = verify_project_indexed(store, project);
+    if (not_indexed) {
+        free(query);
+        free(project);
+        return not_indexed;
+    }
+
+    /* ── resolve query terms (space/comma-separated) to unique seed nodes ── */
+    enum { EXPL_MAX_SEEDS = 16 };
+    typedef struct {
+        int64_t id;
+        char *name, *qn, *label, *file;
+        int start_line, end_line, fan_in;
+    } expl_seed_t;
+    expl_seed_t seeds[EXPL_MAX_SEEDS];
+    int seed_count = 0;
+
+    char *qcopy = heap_strdup(query);
+    char *save = NULL;
+    char *tok = strtok_r(qcopy, " \t,", &save);
+    for (; tok && seed_count < EXPL_MAX_SEEDS; tok = strtok_r(NULL, " \t,", &save)) {
+        cbm_node_t *nodes = NULL;
+        int nc = 0;
+        cbm_store_find_nodes_by_name(store, project, tok, &nodes, &nc);
+        if (nc == 0) { /* fall back to fully-qualified name */
+            cbm_store_free_nodes(nodes, 0);
+            nodes = NULL;
+            cbm_node_t qn_node = {0};
+            if (cbm_store_find_node_by_qn(store, project, tok, &qn_node) == CBM_STORE_OK) {
+                nodes = malloc(sizeof(cbm_node_t));
+                if (nodes) {
+                    nodes[0] = qn_node;
+                    nc = 1;
+                } else {
+                    free_node_contents(&qn_node);
+                }
+            }
+        }
+        if (nc == 0) { /* fall back to QN suffix (partial / bare names) */
+            cbm_store_free_nodes(nodes, 0);
+            nodes = NULL;
+            cbm_store_find_nodes_by_qn_suffix(store, project, tok, &nodes, &nc);
+        }
+        if (nc == 0) {
+            cbm_store_free_nodes(nodes, 0);
+            continue;
+        }
+        bool amb = false;
+        int sel = pick_resolved_node(nodes, nc, &amb);
+        bool dup = false;
+        for (int i = 0; i < seed_count; i++) {
+            if (seeds[i].id == nodes[sel].id) {
+                dup = true;
+                break;
+            }
+        }
+        if (!dup) {
+            expl_seed_t *sd = &seeds[seed_count++];
+            sd->id = nodes[sel].id;
+            sd->name = heap_strdup(nodes[sel].name ? nodes[sel].name : "");
+            sd->qn = heap_strdup(nodes[sel].qualified_name ? nodes[sel].qualified_name : "");
+            sd->label = heap_strdup(nodes[sel].label ? nodes[sel].label : "");
+            sd->file = heap_strdup(nodes[sel].file_path ? nodes[sel].file_path : "");
+            sd->start_line = nodes[sel].start_line;
+            sd->end_line = nodes[sel].end_line;
+            sd->fan_in = 0;
+        }
+        cbm_store_free_nodes(nodes, nc);
+    }
+    bool seeds_capped = (tok != NULL); /* loop exited at EXPL_MAX_SEEDS with terms remaining */
+    free(qcopy);
+
+    if (seed_count == 0) {
+        free(query);
+        free(project);
+        return cbm_mcp_text_result(
+            "explore: no indexed symbols matched the query terms. Use "
+            "search_graph(name_pattern=\"...\") to find exact names, then re-run explore.",
+            true);
+    }
+
+    /* ── fan-in (hotspot signal) for all seeds in one batch ── */
+    {
+        int64_t ids[EXPL_MAX_SEEDS];
+        int in_deg[EXPL_MAX_SEEDS], out_deg[EXPL_MAX_SEEDS];
+        for (int i = 0; i < seed_count; i++) {
+            ids[i] = seeds[i].id;
+        }
+        if (cbm_store_batch_count_degrees(store, ids, seed_count, "CALLS", in_deg, out_deg) ==
+            CBM_STORE_OK) {
+            for (int i = 0; i < seed_count; i++) {
+                seeds[i].fan_in = in_deg[i];
+            }
+        }
+    }
+
+    /* ── render markdown ── */
+    char *root_path = get_project_root(srv, project);
+    expl_buf_t md = {0};
+    expl_putf(&md, "# Exploration: %s\n\n", query);
+    expl_put(&md, "## Blast radius — callers (verify before editing)\n\n");
+    for (int i = 0; i < seed_count; i++) {
+        cbm_traverse_result_t tr = {0};
+        cbm_store_bfs(store, seeds[i].id, "inbound", NULL, 0, depth, MCP_BFS_LIMIT, &tr);
+        expl_putf(&md, "- `%s` (%s:%d) — %d caller%s", seeds[i].name, seeds[i].file,
+                  seeds[i].start_line, tr.visited_count, tr.visited_count == 1 ? "" : "s");
+        if (depth > 1) {
+            expl_putf(&md, " (within %d hops, transitive)", depth);
+        }
+        if (seeds[i].fan_in >= 3) {
+            expl_putf(&md, " ⚠ hotspot(fan_in=%d)", seeds[i].fan_in);
+        }
+        if (tr.visited_count > 0) {
+            expl_put(&md, ": ");
+            int shown = tr.visited_count < 6 ? tr.visited_count : 6;
+            for (int k = 0; k < shown; k++) {
+                const char *cn = tr.visited[k].node.name;
+                expl_putf(&md, "%s`%s`", k ? ", " : "", cn ? cn : "?");
+            }
+            if (tr.visited_count > shown) {
+                expl_putf(&md, ", +%d more", tr.visited_count - shown);
+            }
+        }
+        expl_put(&md, "\n");
+        cbm_store_traverse_free(&tr);
+    }
+    expl_put(&md, "\n## Source\n\n> Verbatim on-disk source, line-numbered — Read-equivalent; "
+                  "do NOT re-open the files shown below.\n\n");
+    int files_shown = 0;
+    for (int i = 0; i < seed_count && files_shown < max_files; i++) {
+        int start = seeds[i].start_line;
+        if (start <= 0) {
+            continue;
+        }
+        int real_end = seeds[i].end_line;
+        int end = real_end < start ? start : real_end;
+        bool elided = false;
+        if (end > start + 160) {
+            end = start + 160; /* elide very long bodies */
+            elided = true;
+        }
+        char *abs = NULL;
+        char *src = resolve_snippet_source(root_path, seeds[i].file, start, end, &abs);
+        char *safe = src ? sanitize_utf8_lossy(src) : NULL;
+        const char *ext = strrchr(seeds[i].file, '.');
+        expl_putf(&md, "### %s — `%s` (%s)\n\n```%s\n", seeds[i].file, seeds[i].name,
+                  seeds[i].label, ext ? ext + 1 : "");
+        expl_put_numbered(&md, safe ? safe : src, start);
+        expl_put(&md, "```\n");
+        if (elided) {
+            /* Honest about the cap — the body was longer than shown (don't claim
+             * Read-equivalent for a truncated symbol). */
+            expl_putf(&md, "> … +%d more lines — Read `%s`:%d-%d for the full body.\n",
+                      real_end - end, seeds[i].file, end + 1, real_end);
+        }
+        expl_put(&md, "\n");
+        free(safe);
+        free(src);
+        free(abs);
+        files_shown++;
+    }
+    if (seeds_capped) {
+        expl_putf(&md, "> Note: explored the first %d symbols only (cap reached) — pass fewer "
+                       "terms or split the query.\n", EXPL_MAX_SEEDS);
+    }
+    expl_put(&md, "---\n> For a precise sub-query (callers of X, call paths, custom filters) use "
+                  "`query_graph` (openCypher). `⚠ hotspot` = high inbound fan-in.\n");
+
+    for (int i = 0; i < seed_count; i++) {
+        free(seeds[i].name);
+        free(seeds[i].qn);
+        free(seeds[i].label);
+        free(seeds[i].file);
+    }
+    free(root_path);
+
+    char *result = cbm_mcp_text_result(md.p ? md.p : "(empty)", false);
+    free(md.p);
+    free(query);
+    free(project);
+    return result;
+}
+
 char *cbm_mcp_handle_tool(cbm_mcp_server_t *srv, const char *tool_name, const char *args_json) {
     if (!tool_name) {
         return cbm_mcp_text_result("missing tool name", true);
@@ -4261,6 +4740,9 @@ char *cbm_mcp_handle_tool(cbm_mcp_server_t *srv, const char *tool_name, const ch
     if (strcmp(tool_name, "ingest_traces") == 0) {
         return handle_ingest_traces(srv, args_json);
     }
+    if (strcmp(tool_name, "explore") == 0) {
+        return handle_explore(srv, args_json);
+    }
     char msg[CBM_SZ_256];
     snprintf(msg, sizeof(msg), "unknown tool: %s", tool_name);
     return cbm_mcp_text_result(msg, true);
diff --git a/src/pipeline/pass_parallel.c b/src/pipeline/pass_parallel.c
index 180ee85f7..12f0aa312 100644
--- a/src/pipeline/pass_parallel.c
+++ b/src/pipeline/pass_parallel.c
@@ -1108,15 +1108,22 @@ static size_t append_args_json(char *buf, size_t bufsize, size_t pos, const CBMC
     pos += (size_t)n;
     for (int i = 0; i < call->arg_count && pos < bufsize - CBM_ARG_JSON_GUARD; i++) {
         const CBMCallArg *a = &call->args[i];
+        size_t mark = pos; /* rollback point (before the separator) */
         if (i > 0 && pos < bufsize - SKIP_ONE) {
             buf[pos++] = ',';
         }
         char expr_buf[CBM_SZ_128];
         sanitize_expr(expr_buf, a->expr);
         n = format_call_arg(buf + pos, bufsize - pos, a, expr_buf);
-        if (n > 0) {
-            pos += (size_t)n;
+        /* snprintf returns the UNtruncated length: if the arg did not fully
+         * fit, advancing pos by n would push it past buf and the buf[pos]
+         * writes below would overflow. Drop the arg whole (atomic field —
+         * keeps the array valid) and stop appending. */
+        if (n <= 0 || (size_t)n >= bufsize - pos) {
+            pos = mark;
+            break;
         }
+        pos += (size_t)n;
     }
     if (pos < bufsize - SKIP_ONE) {
         buf[pos++] = ']';
diff --git a/src/pipeline/pipeline.c b/src/pipeline/pipeline.c
index 499c916a5..d084882ad 100644
--- a/src/pipeline/pipeline.c
+++ b/src/pipeline/pipeline.c
@@ -93,6 +93,10 @@ struct cbm_pipeline {
 
     /* User-defined extension overrides (loaded once per run) */
     cbm_userconfig_t *userconfig;
+
+    /* ADR (project_summaries) captured before a full-reindex DB delete, so it
+     * can be restored after the rebuild. NULL when no ADR existed. Issue #516. */
+    char *saved_adr;
 };
 
 /* ── Global pkgmap (one active pipeline at a time) ─────────────── */
@@ -788,6 +792,22 @@ static int try_incremental_or_delete_db(cbm_pipeline_t *p, cbm_file_info_t *file
         cbm_store_close(check_store);
     }
     cbm_log_info("pipeline.route", "path", "reindex", "action", "deleting old db");
+    /* Capture any ADR before deleting the DB so the full-reindex rebuild can
+     * restore it (project_summaries is otherwise lost). Issue #516. */
+    {
+        cbm_store_t *adr_store = cbm_store_open_path(db_path);
+        if (adr_store) {
+            cbm_adr_t existing;
+            if (cbm_store_adr_get(adr_store, p->project_name, &existing) == CBM_STORE_OK) {
+                if (existing.content) {
+                    free(p->saved_adr);
+                    p->saved_adr = strdup(existing.content);
+                }
+                cbm_store_adr_free(&existing);
+            }
+            cbm_store_close(adr_store);
+        }
+    }
     cbm_unlink(db_path);
     char wal[PL_WAL_BUF];
     char shm[PL_WAL_BUF];
@@ -841,6 +861,11 @@ static int dump_and_persist_hashes(cbm_pipeline_t *p, const cbm_file_info_t *fil
     cbm_store_t *hash_store = cbm_store_open_path(db_path);
     if (hash_store) {
         cbm_store_delete_file_hashes(hash_store, p->project_name);
+
+        /* Restore the ADR captured before the dump. Issue #516. */
+        if (p->saved_adr) {
+            cbm_store_adr_store(hash_store, p->project_name, p->saved_adr);
+        }
         for (int i = 0; i < file_count; i++) {
             struct stat fst;
             if (stat(files[i].path, &fst) == 0) {
@@ -867,6 +892,8 @@ static int dump_and_persist_hashes(cbm_pipeline_t *p, const cbm_file_info_t *fil
         cbm_store_close(hash_store);
         cbm_log_info("pass.timing", "pass", "persist_hashes", "files", itoa_buf(file_count));
     }
+    free(p->saved_adr);
+    p->saved_adr = NULL;
 
     /* Export persistent artifact if enabled */
     if (p->persistence) {
diff --git a/tests/test_cypher.c b/tests/test_cypher.c
index 610c905e4..2e79c8b4f 100644
--- a/tests/test_cypher.c
+++ b/tests/test_cypher.c
@@ -2183,6 +2183,27 @@ TEST(cypher_exec_with_count) {
     PASS();
 }
 
+/* Regression: a bare node group-var carried through WITH aggregation must project
+ * its real properties (not blank). Pre-fix, the carried var held only the node
+ * name, so RETURN g.file_path returned "". */
+TEST(cypher_exec_with_node_groupvar_prop) {
+    cbm_store_t *s = setup_cypher_store();
+    cbm_cypher_result_t r = {0};
+    int rc = cbm_cypher_execute(s,
+                                "MATCH (f:Function)-[:CALLS]->(g:Function) "
+                                "WHERE g.name = \"ValidateOrder\" "
+                                "WITH g, COUNT(*) AS c "
+                                "RETURN g.file_path, g.name, c",
+                                "test", 0, &r);
+    ASSERT_EQ(rc, 0);
+    ASSERT_EQ(r.row_count, 1);
+    ASSERT_STR_EQ(r.rows[0][0], "validate.go"); /* was "" before the fix */
+    ASSERT_STR_EQ(r.rows[0][1], "ValidateOrder");
+    cbm_cypher_result_free(&r);
+    cbm_store_close(s);
+    PASS();
+}
+
 TEST(cypher_exec_with_where) {
     cbm_store_t *s = setup_cypher_store();
     cbm_cypher_result_t r = {0};
@@ -2642,6 +2663,7 @@ SUITE(cypher) {
     /* Phase 6: WITH clause */
     RUN_TEST(cypher_exec_with_rename);
     RUN_TEST(cypher_exec_with_count);
+    RUN_TEST(cypher_exec_with_node_groupvar_prop);
     RUN_TEST(cypher_exec_with_where);
     RUN_TEST(cypher_exec_with_orderby_limit);
     RUN_TEST(cypher_parse_with);
diff --git a/tests/test_extraction.c b/tests/test_extraction.c
index 0308372c1..7ba2682c4 100644
--- a/tests/test_extraction.c
+++ b/tests/test_extraction.c
@@ -1092,6 +1092,33 @@ TEST(swift_struct) {
     PASS();
 }
 
+/* Regression (WS2a / dup-node): a `static func` inside a Swift `enum` namespace
+ * must be emitted exactly ONCE as a Method — not ALSO as a top-level Function.
+ * The enum body node type is `enum_class_body`; push_class_body_children's
+ * body-type list had drifted from extract_class_def's (it lacked enum_class_body),
+ * so enum members were re-walked and double-extracted into spurious Function nodes. */
+TEST(swift_enum_static_func_not_duplicated) {
+    CBMFileResult *r = extract("enum SM2 {\n    static func review(q: Int) -> Int { return q }\n}\n",
+                               CBM_LANG_SWIFT, "t", "SM2.swift");
+    ASSERT_NOT_NULL(r);
+    ASSERT_FALSE(r->has_error);
+    int method = 0, func = 0;
+    for (int i = 0; i < r->defs.count; i++) {
+        if (strcmp(r->defs.items[i].name, "review") != 0) {
+            continue;
+        }
+        if (strcmp(r->defs.items[i].label, "Method") == 0) {
+            method++;
+        } else if (strcmp(r->defs.items[i].label, "Function") == 0) {
+            func++;
+        }
+    }
+    ASSERT(method == 1); /* emitted once, as a Method */
+    ASSERT(func == 0);   /* NOT also as a Function (the dup-node bug) */
+    cbm_free_result(r);
+    PASS();
+}
+
 /* --- Swift calls (port of PR #47 Go tests) --- */
 TEST(swift_simple_call) {
     CBMFileResult *r = extract("func main() { greet() }\nfunc greet() { print(\"hello\") }\n",
@@ -2908,6 +2935,7 @@ SUITE(extraction) {
 
     /* OOP/Systems variants */
     RUN_TEST(swift_struct);
+    RUN_TEST(swift_enum_static_func_not_duplicated);
     RUN_TEST(swift_simple_call);
     RUN_TEST(swift_method_call);
     RUN_TEST(swift_constructor_call);
diff --git a/tests/test_incremental.c b/tests/test_incremental.c
index c210d5433..82aa289c1 100644
--- a/tests/test_incremental.c
+++ b/tests/test_incremental.c
@@ -400,8 +400,8 @@ TEST(incr_modify_file) {
 
     /* Single-file incremental should be faster than full */
     if ((int)ms > (int)(g_full_index_ms * 1.5)) {
-        printf("    [PERF WARNING] incremental slower than 1.5x full: %.0fms vs %.0fms\n",
-               ms, g_full_index_ms);
+        printf("    [PERF WARNING] incremental slower than 1.5x full: %.0fms vs %.0fms\n", ms,
+               g_full_index_ms);
     }
 
     printf("    [perf] modify 1 file: %.0fms (full was %.0fms)\n", ms, g_full_index_ms);
@@ -910,12 +910,12 @@ static int resp_lacks_key(const char *resp, const char *key) {
 }
 
 /* Helper: assert tool call succeeds, warn if slow */
-#define TOOL_OK(resp, ms)                                                              \
-    do {                                                                               \
-        ASSERT((resp) != NULL);                                                        \
-        if ((int)(ms) > PERF_WARN_MS) {                                                \
+#define TOOL_OK(resp, ms)                                                                 \
+    do {                                                                                  \
+        ASSERT((resp) != NULL);                                                           \
+        if ((int)(ms) > PERF_WARN_MS) {                                                   \
             printf("    [PERF WARNING] tool call: %.0fms (>%dms)\n", (ms), PERF_WARN_MS); \
-        }                                                                              \
+        }                                                                                 \
     } while (0)
 
 /* Helper: assert response is not an error */
@@ -932,6 +932,38 @@ TEST(tool_list_projects_basic) {
     PASS();
 }
 
+TEST(tool_qg_defines_method_more_than_10) {
+    write_file_at("fastapi/big_class.py", "class BigClass:\n"
+                                          "    def m1(self): pass\n"
+                                          "    def m2(self): pass\n"
+                                          "    def m3(self): pass\n"
+                                          "    def m4(self): pass\n"
+                                          "    def m5(self): pass\n"
+                                          "    def m6(self): pass\n"
+                                          "    def m7(self): pass\n"
+                                          "    def m8(self): pass\n"
+                                          "    def m9(self): pass\n"
+                                          "    def m10(self): pass\n"
+                                          "    def m11(self): pass\n"
+                                          "    def m12(self): pass\n"
+                                          "    def m13(self): pass\n"
+                                          "    def m14(self): pass\n"
+                                          "    def m15(self): pass\n");
+    char *idx = index_repo();
+    ASSERT(idx != NULL);
+    free(idx);
+    double ms;
+    char *r = call_tool_timed("query_graph", &ms,
+                              "{\"project\":\"%s\","
+                              "\"query\":\"MATCH (c:Class)-[:DEFINES_METHOD]->(m:Method)"
+                              " WHERE c.name = 'BigClass' RETURN count(m) AS n\"}",
+                              g_project);
+    TOOL_OK(r, ms);
+    ASSERT(strstr(r, "\"15\"") != NULL || strstr(r, "\\\"15\\\"") != NULL);
+    free(r);
+    PASS();
+}
+
 TEST(tool_list_projects_has_current) {
     double ms;
     char *r = call_tool_timed("list_projects", &ms, "{}");
@@ -1763,6 +1795,34 @@ TEST(tool_detect_changes_custom_branch) {
     PASS();
 }
 
+/* Regression: `since` was advertised in the schema but ignored by the handler;
+ * it must be honored as the diff base. Fixture is a --depth=1 shallow clone, so
+ * HEAD~N won't resolve — use HEAD for a valid (empty) diff. */
+TEST(tool_detect_changes_since) {
+    double ms;
+    char *r = call_tool_timed("detect_changes", &ms, "{\"project\":\"%s\",\"since\":\"HEAD\"}",
+                              g_project);
+    TOOL_OK(r, ms);
+    ASSERT(resp_has_key(r, "changed_files"));
+    free(r);
+    PASS();
+}
+
+/* Regression: `since` must take precedence over base_branch. A valid since plus a
+ * bogus base_branch must still succeed (proving since won) and must not reference
+ * the bogus branch. */
+TEST(tool_detect_changes_since_precedence) {
+    double ms;
+    char *r = call_tool_timed(
+        "detect_changes", &ms,
+        "{\"project\":\"%s\",\"since\":\"HEAD\",\"base_branch\":\"no-such-branch-xyz\"}",
+        g_project);
+    TOOL_OK(r, ms);
+    ASSERT(strstr(r, "no-such-branch-xyz") == NULL);
+    free(r);
+    PASS();
+}
+
 TEST(tool_detect_changes_depth) {
     double ms;
     char *r = call_tool_timed("detect_changes", &ms, "{\"project\":\"%s\",\"depth\":5}", g_project);
@@ -2956,6 +3016,8 @@ SUITE(incremental) {
     /* Phase 15: detect_changes */
     RUN_TEST(tool_detect_changes_default);
     RUN_TEST(tool_detect_changes_custom_branch);
+    RUN_TEST(tool_detect_changes_since);
+    RUN_TEST(tool_detect_changes_since_precedence);
     RUN_TEST(tool_detect_changes_depth);
 
     /* Phase 16: manage_adr */
@@ -3042,6 +3104,7 @@ SUITE(incremental) {
     RUN_TEST(tool_qg_configures);
     RUN_TEST(tool_qg_handles);
     RUN_TEST(tool_qg_defines_method);
+    RUN_TEST(tool_qg_defines_method_more_than_10);
     RUN_TEST(tool_qg_no_limit);
     RUN_TEST(tool_qg_empty_result);
 
diff --git a/tests/test_mcp.c b/tests/test_mcp.c
index 152a700cf..904dfbc45 100644
--- a/tests/test_mcp.c
+++ b/tests/test_mcp.c
@@ -11,6 +11,7 @@
 #include <yyjson/yyjson.h>
 #include <string.h>
 #include <stdlib.h>
+#include <stdbool.h>
 
 /* ══════════════════════════════════════════════════════════════════
  *  JSON-RPC PARSING
@@ -340,6 +341,7 @@ TEST(server_handle_tools_list) {
     ASSERT_NOT_NULL(strstr(resp, "\"id\":2"));
     ASSERT_NOT_NULL(strstr(resp, "search_graph"));
     ASSERT_NOT_NULL(strstr(resp, "query_graph"));
+    ASSERT_NOT_NULL(strstr(resp, "\"explore\"")); /* registered + its inputSchema is valid JSON */
     free(resp);
 
     cbm_mcp_server_free(srv);
@@ -415,6 +417,34 @@ TEST(tool_unknown_tool) {
     PASS();
 }
 
+/* explore (WS1): missing query → clean required-field error, no crash. */
+TEST(tool_explore_requires_query) {
+    cbm_mcp_server_t *srv = setup_mcp_with_data();
+    char *resp = cbm_mcp_server_handle(
+        srv, "{\"jsonrpc\":\"2.0\",\"id\":40,\"method\":\"tools/call\",\"params\":{\"name\":"
+             "\"explore\",\"arguments\":{\"project\":\"none\"}}}");
+    ASSERT_NOT_NULL(resp);
+    ASSERT_NOT_NULL(strstr(resp, "isError"));
+    ASSERT_NOT_NULL(strstr(resp, "query is required"));
+    free(resp);
+    cbm_mcp_server_free(srv);
+    PASS();
+}
+
+/* explore (WS1): unindexed project → clean error envelope, no crash (exercises the
+ * store-resolution + cleanup paths of handle_explore on an empty server). */
+TEST(tool_explore_unindexed_no_crash) {
+    cbm_mcp_server_t *srv = setup_mcp_with_data();
+    char *resp = cbm_mcp_server_handle(
+        srv, "{\"jsonrpc\":\"2.0\",\"id\":41,\"method\":\"tools/call\",\"params\":{\"name\":"
+             "\"explore\",\"arguments\":{\"query\":\"foo bar\",\"project\":\"nope\"}}}");
+    ASSERT_NOT_NULL(resp);
+    ASSERT_NOT_NULL(strstr(resp, "isError"));
+    free(resp);
+    cbm_mcp_server_free(srv);
+    PASS();
+}
+
 TEST(tool_search_graph_basic) {
     cbm_mcp_server_t *srv = setup_mcp_with_data();
 
@@ -556,6 +586,103 @@ TEST(tool_trace_missing_function_name) {
     PASS();
 }
 
+/* Regression: two same-named definitions with equal rank must be reported
+ * ambiguous, not silently traced (trace_path previously took nodes[0]). */
+TEST(tool_trace_call_path_ambiguous) {
+    cbm_mcp_server_t *srv = cbm_mcp_server_new(NULL);
+    cbm_store_t *st = cbm_mcp_server_store(srv);
+    const char *proj = "amb-proj";
+    cbm_mcp_server_set_project(srv, proj);
+    cbm_store_upsert_project(st, proj, "/tmp/amb");
+    cbm_node_t a = {.project = proj,
+                    .label = "Function",
+                    .name = "amb",
+                    .qualified_name = "amb-proj.a.amb",
+                    .file_path = "a.c",
+                    .start_line = 10,
+                    .end_line = 20};
+    cbm_node_t b = {.project = proj,
+                    .label = "Function",
+                    .name = "amb",
+                    .qualified_name = "amb-proj.b.amb",
+                    .file_path = "b.c",
+                    .start_line = 10,
+                    .end_line = 20}; /* equal span -> genuine tie */
+    ASSERT_GT(cbm_store_upsert_node(st, &a), 0);
+    ASSERT_GT(cbm_store_upsert_node(st, &b), 0);
+
+    char *resp = cbm_mcp_server_handle(
+        srv, "{\"jsonrpc\":\"2.0\",\"id\":61,\"method\":\"tools/call\","
+             "\"params\":{\"name\":\"trace_call_path\","
+             "\"arguments\":{\"function_name\":\"amb\",\"project\":\"amb-proj\"}}}");
+    ASSERT_NOT_NULL(resp);
+    char *inner = extract_text_content(resp);
+    ASSERT_NOT_NULL(inner);
+    ASSERT_NOT_NULL(strstr(inner, "ambiguous"));
+    ASSERT_NOT_NULL(strstr(inner, "suggestions"));
+    ASSERT_NULL(strstr(inner, "\"callees\""));
+    free(inner);
+    free(resp);
+    cbm_mcp_server_free(srv);
+    PASS();
+}
+
+/* Regression: when same-named nodes differ in rank, trace must pick the real
+ * definition (callable, larger body) — NOT nodes[0]. The Module is inserted
+ * first; if trace took nodes[0] the outbound trace would be empty. */
+TEST(tool_trace_call_path_prefers_definition) {
+    cbm_mcp_server_t *srv = cbm_mcp_server_new(NULL);
+    cbm_store_t *st = cbm_mcp_server_store(srv);
+    const char *proj = "pref-proj";
+    cbm_mcp_server_set_project(srv, proj);
+    cbm_store_upsert_project(st, proj, "/tmp/pref");
+    /* nodes[0]: the WRONG match (a Module, tiny span), inserted first. */
+    cbm_node_t wrong = {.project = proj,
+                        .label = "Module",
+                        .name = "dup",
+                        .qualified_name = "pref-proj.dup",
+                        .file_path = "dup.x",
+                        .start_line = 1,
+                        .end_line = 1};
+    /* the real definition: a Function with a body. */
+    cbm_node_t def = {.project = proj,
+                      .label = "Function",
+                      .name = "dup",
+                      .qualified_name = "pref-proj.src.dup",
+                      .file_path = "src/dup.c",
+                      .start_line = 10,
+                      .end_line = 50};
+    cbm_node_t callee = {.project = proj,
+                         .label = "Function",
+                         .name = "callee",
+                         .qualified_name = "pref-proj.src.callee",
+                         .file_path = "src/dup.c",
+                         .start_line = 60,
+                         .end_line = 70};
+    ASSERT_GT(cbm_store_upsert_node(st, &wrong), 0);
+    int64_t id_def = cbm_store_upsert_node(st, &def);
+    int64_t id_callee = cbm_store_upsert_node(st, &callee);
+    ASSERT_GT(id_def, 0);
+    ASSERT_GT(id_callee, 0);
+    cbm_edge_t e = {.project = proj, .source_id = id_def, .target_id = id_callee, .type = "CALLS"};
+    cbm_store_insert_edge(st, &e);
+
+    char *resp = cbm_mcp_server_handle(
+        srv, "{\"jsonrpc\":\"2.0\",\"id\":62,\"method\":\"tools/call\","
+             "\"params\":{\"name\":\"trace_call_path\",\"arguments\":{\"function_name\":\"dup\","
+             "\"project\":\"pref-proj\",\"direction\":\"outbound\"}}}");
+    ASSERT_NOT_NULL(resp);
+    char *inner = extract_text_content(resp);
+    ASSERT_NOT_NULL(inner);
+    ASSERT_NULL(strstr(inner, "ambiguous"));
+    /* picked the Function definition -> its outbound CALLS edge to "callee" shows */
+    ASSERT_NOT_NULL(strstr(inner, "callee"));
+    free(inner);
+    free(resp);
+    cbm_mcp_server_free(srv);
+    PASS();
+}
+
 TEST(tool_delete_project_not_found) {
     cbm_mcp_server_t *srv = cbm_mcp_server_new(NULL);
 
@@ -1291,6 +1418,31 @@ static char *call_snippet(cbm_mcp_server_t *srv, const char *args_json) {
     return text;
 }
 
+static bool is_valid_json_response(const char *json) {
+    if (!json) {
+        return false;
+    }
+    yyjson_doc *doc = yyjson_read(json, strlen(json), 0);
+    if (!doc) {
+        return false;
+    }
+    yyjson_doc_free(doc);
+    return true;
+}
+
+static bool snippet_source_has_replacement(const char *json) {
+    yyjson_doc *doc = yyjson_read(json, strlen(json), 0);
+    if (!doc) {
+        return false;
+    }
+    yyjson_val *root = yyjson_doc_get_root(doc);
+    yyjson_val *source = yyjson_obj_get(root, "source");
+    const char *source_str = yyjson_get_str(source);
+    bool found = source_str && strstr(source_str, "\xEF\xBF\xBD");
+    yyjson_doc_free(doc);
+    return found;
+}
+
 /* ── TestSnippet_ExactQN ──────────────────────────────────────── */
 
 TEST(snippet_exact_qn) {
@@ -1577,6 +1729,46 @@ TEST(snippet_include_neighbors_enabled) {
     PASS();
 }
 
+/* ── TestSnippet_SourceInvalidUtf8 ────────────────────────────── */
+
+TEST(snippet_source_invalid_utf8) {
+    char tmp[256];
+    cbm_mcp_server_t *srv = setup_snippet_server(tmp, sizeof(tmp));
+    ASSERT_NOT_NULL(srv);
+
+    char src_path[512];
+    snprintf(src_path, sizeof(src_path), "%s/project/main.go", tmp);
+    FILE *fp = fopen(src_path, "wb");
+    ASSERT_NOT_NULL(fp);
+    const unsigned char source[] = {
+        'p',  'a',  'c', 'k', 'a', 'g',  'e',  ' ',  'm',  'a',  'i',  'n', '\n', '\n',
+        'f',  'u',  'n', 'c', ' ', 'H',  'a',  'n',  'd',  'l',  'e',  'R', 'e',  'q',
+        'u',  'e',  's', 't', '(', ')',  ' ',  'e',  'r',  'r',  'o',  'r', ' ',  '{',
+        '\n', '\t', '/', '/', ' ', 0xC0, 0xD4, 0xB7, 0xC2, '\n', '\t', 'r', 'e',  't',
+        'u',  'r',  'n', ' ', 'n', 'i',  'l',  '\n', '}',  '\n'};
+    ASSERT_EQ(fwrite(source, 1, sizeof(source), fp), sizeof(source));
+    ASSERT_EQ(fclose(fp), 0);
+
+    char *raw =
+        cbm_mcp_handle_tool(srv, "get_code_snippet",
+                            "{\"qualified_name\":\"test-project.cmd.server.main.HandleRequest\","
+                            "\"project\":\"test-project\"}");
+    ASSERT_TRUE(is_valid_json_response(raw));
+    char *resp = extract_text_content(raw);
+    ASSERT_NOT_NULL(resp);
+    ASSERT_TRUE(is_valid_json_response(resp));
+    ASSERT_NULL(strstr(resp, "\xC0\xD4"));
+    ASSERT_NOT_NULL(strstr(resp, "HandleRequest"));
+    ASSERT_NOT_NULL(strstr(resp, "return nil"));
+    ASSERT_TRUE(snippet_source_has_replacement(resp));
+
+    free(resp);
+    free(raw);
+    cbm_mcp_server_free(srv);
+    cleanup_snippet_dir(tmp);
+    PASS();
+}
+
 /* ══════════════════════════════════════════════════════════════════
  *  JSON-RPC PARSING — EDGE CASES
  * ══════════════════════════════════════════════════════════════════ */
@@ -2060,6 +2252,8 @@ SUITE(mcp) {
     RUN_TEST(tool_list_projects_empty);
     RUN_TEST(tool_get_graph_schema_empty);
     RUN_TEST(tool_unknown_tool);
+    RUN_TEST(tool_explore_requires_query);
+    RUN_TEST(tool_explore_unindexed_no_crash);
     RUN_TEST(tool_search_graph_basic);
     RUN_TEST(tool_search_graph_includes_node_properties);
     RUN_TEST(tool_query_graph_basic);
@@ -2069,6 +2263,8 @@ SUITE(mcp) {
     /* Tool handlers with validation */
     RUN_TEST(tool_trace_call_path_not_found);
     RUN_TEST(tool_trace_missing_function_name);
+    RUN_TEST(tool_trace_call_path_ambiguous);
+    RUN_TEST(tool_trace_call_path_prefers_definition);
     RUN_TEST(tool_delete_project_not_found);
     RUN_TEST(tool_get_architecture_empty);
     RUN_TEST(tool_get_architecture_emits_populated_sections);
@@ -2129,5 +2325,6 @@ SUITE(mcp) {
     RUN_TEST(snippet_auto_resolve_enabled);
     RUN_TEST(snippet_include_neighbors_default);
     RUN_TEST(snippet_include_neighbors_enabled);
+    RUN_TEST(snippet_source_invalid_utf8);
     RUN_TEST(tool_bad_project_name_no_overflow_issue235);
 }
diff --git a/tests/test_parallel.c b/tests/test_parallel.c
index 1c4d3d9b6..746e1f2c3 100644
--- a/tests/test_parallel.c
+++ b/tests/test_parallel.c
@@ -341,6 +341,54 @@ TEST(parallel_empty_files) {
     PASS();
 }
 
+/* ── Regression: args JSON must not overflow the props buffer ──────── */
+
+/* A call with many long string arguments makes append_args_json()'s running
+ * position exceed the fixed CBM_SZ_2K `props` stack buffer in
+ * emit_normal_calls_edge(): format_call_arg() returns snprintf's UNtruncated
+ * length, so pos += n could run past the buffer and the trailing
+ * buf[pos]='\0' wrote out of bounds (stack-buffer-overflow; caught by the
+ * stack canary as a SIGABRT on real repos). This indexes a fixture whose
+ * single call carries enough long args to drive pos past 2 KB; under the
+ * ASan test build a regression aborts here. */
+TEST(parallel_args_json_no_overflow) {
+    char dir[256];
+    snprintf(dir, sizeof(dir), "/tmp/cbm_argov_XXXXXX");
+    ASSERT_TRUE(cbm_mkdtemp(dir) != NULL);
+
+    char path[512];
+    snprintf(path, sizeof(path), "%s/app.ts", dir);
+    FILE *f = fopen(path, "w");
+    ASSERT_TRUE(f != NULL);
+    fputs("function sink(...xs: string[]) { return xs; }\n", f);
+    fputs("function caller() {\n  sink(\n", f);
+    for (int i = 0; i < 60; i++) {
+        /* 100-char string literal per arg; 60 args => args JSON well past the
+         * 2 KB props buffer, forcing the pre-fix overshoot. */
+        fputs("    \"", f);
+        for (int j = 0; j < 100; j++)
+            fputc('a' + (i % 26), f);
+        fputs(i < 59 ? "\",\n" : "\"\n", f);
+    }
+    fputs("  );\n}\n", f);
+    fclose(f);
+
+    cbm_discover_opts_t opts = {.mode = CBM_MODE_FULL};
+    cbm_file_info_t *files = NULL;
+    int file_count = 0;
+    ASSERT_EQ(cbm_discover(dir, &opts, &files, &file_count), 0);
+    ASSERT_GT(file_count, 0);
+
+    cbm_gbuf_t *gbuf = run_parallel("argov-test", dir, files, file_count, 4);
+    ASSERT_TRUE(gbuf != NULL);
+    ASSERT_GT(cbm_gbuf_edge_count(gbuf), 0);
+
+    cbm_gbuf_free(gbuf);
+    cbm_discover_free(files, file_count);
+    th_rmtree(dir);
+    PASS();
+}
+
 /* ── Graph buffer merge tests ─────────────────────────────────────── */
 
 TEST(gbuf_shared_ids_unique) {
@@ -680,6 +728,7 @@ SUITE(parallel) {
     RUN_TEST(parallel_implements_parity);
     RUN_TEST(parallel_total_edges);
     RUN_TEST(parallel_empty_files);
+    RUN_TEST(parallel_args_json_no_overflow);
 
     /* Cleanup shared state */
     parity_teardown();