Search: prose queries miss camelCase symbols matching all words; stale 'warming' note in context tool description #4451

Version: tracedecay 1.0.0-beta.87+9fa204c1 on macOS (Darwin 25.6), mixed TS/Python/Rust monorepo of about 7k files.

1. Prose queries rank one-word exact symbols above a camelCase symbol that matches every query word

A function named like fetchWidgetAutoTagItemsForwardTotal is indexed. An exact-name search ranks it first, and the route list shows split:fetch|widget|auto|tag|items|forward|total. Prose queries built from the same words never return it:

• tracedecay_search query widget auto tag items forward total → results are a const widget and two fields named tag (exact_message, routed as prose, margin -0.50). The 7-of-7 subtoken match is absent from the page, and the trimmed ranks 4-5 do not contain it either.
• tracedecay_search query widget-tool auto-tag query rows per item → four fields named item plus one function named item.
• tracedecay_context gives the same pattern. Before we excluded JSON data (see 3), its top 5 were query keys from JSON files.

Expected: a symbol whose split subtokens cover most of the query words should outrank a symbol that matches one word exactly. Hyphenated prose (auto-tag) should also match the camelCase subtokens (AutoTag).

2. The "graph is still warming" note in the tracedecay_context description never updates

The MCP tool description is generated at handshake and says "The graph is still warming, and 3 broad context calls are available." It stays that way for the whole session after tracedecay_status reports code_index_freshness: current / retrieval_serving: serving. Agents read the stale note and skip tracedecay for direct file reads. Suggestion: keep the description static and report warming state per response (the freshness: / indexing: header already does this).

3. Smaller items

• JSON keys as const symbols: these flood name-based ranking in repos with many JSON evidence/fixture files. Moving them down, or making them opt-in, would help. We fixed it locally with index.exclude.v1, which cut source bytes from 184 MB to 115 MB.
• Privacy false positive: a JSON manifest that maps file paths to 64-hex sha256 digests ({"files": {"path": "<sha256>"}}) is withheld as "privacy sanitizer quarantined credential-bearing keys". It holds no credential-named keys, only hex digests.
• tracedecay_status wait_for: when the call returns timed_out, the error text includes "before the index reached the requested state", so naive grep reached checks pass by mistake. A distinct token such as wait: timed_out that never appears alongside "reached" would avoid this.
• CLI configuration_set with layer: {"kind":"project"}: it fails with a generic application_surface_invalid_request ("inconsistent with the application contract"). It works only with project_id set. The error could name the missing field.