Add indexed call-site evidence to graph queries

TESTING_GUIDE.md

@@ -236,7 +236,7 @@ Candidate-ordered parallel-index recovery tests must prove that the fatal result
   `JsonEnvelopeWrapperTests.cs` owns global JSON-envelope token-role coverage. Keep parser-accepted separated and inline query values, option ordering, the `--` end-of-options form, missing-value boundaries for other value-bearing options, and a genuine `--json-envelope` output request together so preprocessing cannot consume command data, suppress a structured error envelope, or place its injected `--json` after the positional boundary.
   Status-explain coverage must enumerate the source-generated `StatusResult` serializer properties and require every serialized top-level key to succeed without opening a database. Keep major readiness/trust/extension/maintenance/cap-hit metadata assertions, dotted-member resolution, bounded valid unknown candidates, and redaction of hostile field input in the same focused fixture so serialization and explainability cannot drift independently. Keep every structured explain response key registered for status `--fields` projection, and exercise the response through a bounded JSON projection that proves the outer envelope also omits runtime and path metadata.
   Safety-recipe semantic coverage must keep safe and unsafe controls in separate indexed files: assert that `Regex.Escape` / `Regex.Unescape` and literal `UseShellExecute=false` are absent, while matching, source-defined, or unresolved Regex members, literal `true`, and propagated shell-policy values remain with classification evidence. Include alias trivia, alias-like comments and strings, a qualified BCL call in a file with a bare `BoundedRegex` alias, a line break before literal `false`, and computed continuations after block and line comments. Also retain a bare receiver from a legacy index without current reference identity, add enough safe helpers to saturate the normal result envelope, keep count output aligned with full JSON, and retain a separate `new Regex` construction positive.
-  Graph snippet-length validation uses one command/format matrix across `references`, `callers`, and `callees`. Keep explicit `--snippet-lines` fail-fast without `--body`, reject location-only and count output even when `--body` is present, preserve the zero/range errors, and retain successful text/JSON body excerpts through the accepted maximum. Also cover option-like literals supplied through `--query` and `--`, plus two-page bounded body projection with clean stderr, correct total counts, and cursor continuation. Top-level compact aliases must validate the original arguments before database access, and bounded count replay must preserve snippet-like query literals.
+  Graph snippet-length validation uses one command/format matrix across `references`, `callers`, and `callees`. Keep explicit `--snippet-lines` fail-fast without `--body`, reject location-only and count output even when `--body` is present, preserve the zero/range errors, and retain successful text/JSON body excerpts through the accepted maximum. Body-mode coverage must preserve the definition/container `body_*` excerpt while separately asserting centered `callsite_*` evidence for `references`, `callers`, `callees`, and `impact`: persisted representative line/column/span (including a physical token that differs from the resolved symbol name), deterministic `first_reference` selection, grouped/omitted counts, indexed-source behavior, long-line truncation, redacted recovery paths, legacy nullable columns, and rejection of excerpts whose indexed chunks omit the exact focus line. Also cover option-like literals supplied through `--query` and `--`, plus two-page bounded body/call-site projections with clean stderr, correct total counts, byte caps, field discovery, and cursor continuation. A call-site-only projection must materialize the evidence, while projections excluding both field families must not. Top-level compact aliases must validate the original arguments before database access, and bounded count replay must preserve snippet-like query literals.
   Search-to-find recovery coverage must exercise `--regex` and `--all` in human and JSON modes, option-shaped and shell-sensitive query values, normalized path/language/exclusion/limit arguments, and explicit non-equivalent or unsafe cases. Assert typed argv plus POSIX-shell and PowerShell displays, absence of implicit workspace defaults, and the no-execution markers; an unmappable request must return no alternative command.
   C# `unused` partial-family coverage must reuse one multi-file fixture across regular JSON, compact, `--by-bucket`, and `--actionable`; include PascalCase, lower-camel, and underscore-prefixed private static readonly collections read or written from a sibling declaration, top-level and nested partial types, genuinely unused private members, an unrelated same-named family, a containing-type generic-arity collision, and a family-external occurrence in a matched peer file. Split the sibling usage file with production overlap and place a multiline raw string across a chunk boundary so semantic membership and lexical masking cannot regress into name-only, flattened-qualified-name, whole-file evidence sharing, or independent per-chunk interpretation. Keep a nullable-content overlap fixture so a missing chunk cannot hide text retained by its successor, and preserve successful conservative fallback for read-only legacy chunk schemas without `chunk_index`; cumulative overlap coverage must remain a linear windowed pass rather than a per-chunk scan of every predecessor. Keep reconstruction scoped to the matched peer file and compare SQLite VM progress before and after adding unrelated repository chunks so absent planner statistics cannot reintroduce a candidate-by-repository scan.
   `CliFlagSchemaTests.cs` and `ConsoleUiTests.cs` keep command help, runtime value validation, and each generated shell's option/value catalog aligned with `CliFlagSchema`, and check every Fish command scope against the shared per-command completion projection. When an accepted value or alias changes, assert its registry normalization plus command usage, runtime validation, and Bash / Zsh / Fish / PowerShell completion visibility; add the value to the schema instead of weakening this parity contract.
@@ -1330,7 +1330,7 @@ dotnet test --filter "FullyQualifiedName~GitHelperTests"
   `JsonEnvelopeWrapperTests.cs` は global JSON envelope の token role coverage を担当します。前処理が command data を消費したり、構造化 error envelope を抑止したり、補う `--json` を positional 境界より後ろへ置いたりしないよう、parser が受理する分離形式と inline 形式の query 値、option 順序、`--` end-of-options 形式、他の value-bearing option の missing-value 境界、実際の `--json-envelope` 出力要求を同じ fixture で維持してください。
   status explain の coverage は source-generated `StatusResult` serializer property を列挙し、database を開かずに serialized top-level key がすべて成功することを必須にします。主要な readiness / trust / extension / maintenance / cap-hit metadata、dot 区切り member resolution、unknown key に対する上限付きの有効な candidate、悪意ある field input の redaction を同じ focused fixture に置き、serialization と explainability が独立して drift しないようにしてください。structured explain response の全 key を status の `--fields` projection に登録し、outer envelope からも runtime / path metadata が省略されることを上限付き JSON projection で固定してください。
   safety recipe の意味論 coverage では、安全側と危険側の control を別々の indexed file に置いてください。`Regex.Escape` / `Regex.Unescape` と literal `UseShellExecute=false` が除外され、matching、source-defined、または解決不能な Regex member、literal `true`、伝播された shell-policy 値が classification evidence 付きで残ることを検証します。alias の trivia、alias に見える comment / string、bare `BoundedRegex` alias と完全修飾 BCL call が同居する file、literal `false` の前の改行、block / line comment の後に続く計算式を含めます。また、現行 reference identity を持たない legacy index の bare receiver を残すこと、通常の result envelope を埋める数の safe helper、count 出力と full JSON の一致、別の `new Regex` construction 正例も維持してください。
-  graph の snippet 長 validation は、`references`、`callers`、`callees` を横断する1つの command / format matrix で検証します。明示した `--snippet-lines` は `--body` なしで fail-fast し、`--body` があっても location-only / count 出力では拒否すること、zero / range error を維持すること、受理上限まで text / JSON の body excerpt が成功することを固定してください。さらに、`--query` と `--` で渡した option 風 literal、および stderr が空で total count と cursor continuation が正しい2ページの bounded body projection も検証してください。top-level compact alias は database access より前に原引数を検証し、bounded count replay は snippet 風の query literal を維持しなければなりません。
+  graph の snippet 長 validation は、`references`、`callers`、`callees` を横断する1つの command / format matrix で検証します。明示した `--snippet-lines` は `--body` なしで fail-fast し、`--body` があっても location-only / count 出力では拒否すること、zero / range error を維持すること、受理上限まで text / JSON の body excerpt が成功することを固定してください。body mode の coverage では定義 / container の `body_*` 抜粋を維持しつつ、`references`、`callers`、`callees`、`impact` の centered な `callsite_*` evidence を個別に検証します。永続化した代表行 / 列 / span（解決済み symbol 名と物理 token が異なる場合を含む）、決定的な `first_reference` 選択、group / 省略件数、indexed source の利用、長い行の truncation、recovery path の伏字、legacy の nullable column、indexed chunk が正確な focus 行を欠く抜粋の拒否を固定してください。さらに、`--query` と `--` で渡した option 風 literal、および stderr が空で total count、byte cap、field discovery、cursor continuation が正しい2ページの bounded body / call-site projection も検証してください。call-site field だけの投影では evidence を materialize し、両 field family を除外した投影では materialize しないことを固定します。top-level compact alias は database access より前に原引数を検証し、bounded count replay は snippet 風の query literal を維持しなければなりません。
   search から find への recovery coverage では、human / JSON mode の `--regex` と `--all`、option 風および shell-sensitive な query 値、正規化した path / language / exclude / limit 引数、明示的に非等価または unsafe な case を検証してください。型付き argv と POSIX shell / PowerShell 表示、暗黙の workspace default が含まれないこと、未実行 marker を固定し、対応不能な request が代替 command を返さないことを必須にします。
   C# `unused` の partial-family coverage では、通常の JSON、compact、`--by-bucket`、`--actionable` で1つの multi-file fixture を共有してください。sibling declaration から read または write される PascalCase、lower-camel、underscore-prefixed の private static readonly collection、top-level / nested partial type、本当に未使用の private member、無関係な同名 family、containing type の generic-arity collision、matched peer file 内の family 外 occurrence を含めます。sibling usage file は本番の overlap 設定で分割し、複数行 raw string を chunk 境界にまたがせて、semantic membership と lexical masking が name-only、平坦化された qualified name、file 全体の evidence 共有、または独立した chunk 単位の解釈へ戻らないことを固定します。欠損 chunk が後続 chunk に残る text を隠さないよう nullable-content overlap fixture を維持し、`chunk_index` のない read-only legacy chunk schema では保守的 fallback が成功することも固定してください。累積 overlap coverage は各 chunk から全 predecessor を走査せず、線形な window pass のままにします。reconstruction を一致した peer file に限定し、無関係な repository chunk の追加前後で SQLite VM progress を比較して、planner statistics がなくても candidate × repository scan が再発しないことを固定してください。
   `CliFlagSchemaTests.cs` と `ConsoleUiTests.cs` は command help、runtime value validation、各生成 shell の option / value 全カタログを `CliFlagSchema` と同期させ、Fish の全 command scope を共有の command 別 completion 射影と照合します。受理値または alias を変更するときは、registry normalization に加えて command usage、runtime validation、Bash / Zsh / Fish / PowerShell completion への露出を検証し、この parity 契約を弱めず schema に値を追加してください。