P1: Add Python symbols, call hierarchy, and rename capability truth

[tomdps]

Parent

Tracking parent #248; epic #243. This is one vertical delivery slice. Do not close or bypass the parent tracker from this child.

Goal

Complete #248 read-only breadth with semantic document/workspace symbols, incoming/outgoing call hierarchy, and prepare-rename capability discovery over the same exact session.

Dependency contract

• P1: Add Python type intelligence routes #263 (P1: Add Python type intelligence routes)

Required behavior

1. Route Python document/workspace symbols, incoming/outgoing/both call hierarchy, and rename-capability discovery through negotiated service methods. prepareRename returns only supported/refused range/placeholder/provenance; it must never call textDocument/rename, return edits, validate, or apply.
2. Normalize nested symbol/container identity, ranges/kinds, hierarchy edges/cycles/completeness, rename target range/placeholder, document/snapshot versions, provider/cap observations, deterministic order, and every lifecycle/failure state.
3. Graph lexical fallback is allowed only for document/workspace symbols when labeled degraded semantic:false/confidence:lexical; no graph fallback for call hierarchy or rename capability.
4. Generate the machine-readable capability matrix from implemented/negotiated methods for JSON/status/help/descriptors and hidden warm initialize; never advertise an unimplemented or failed semantic route.
5. Exercise aliases/methods/decorators/cross-package/cycles/recursion/dynamic dispatch/reflection and make incompleteness/unsupported explicit. Reuse all resource, restart, cancellation, cleanup, provenance, type-gate separation, and packed-install constraints.

Acceptance criteria

• Nested/module/class/function/property symbols, duplicate names, workspace packages/config roots, overlay symbol changes, incoming/outgoing/recursive/cyclic calls, aliases/methods/decorators, prepareRename success/refusal/ambiguity/generated/read-only/out-of-root/malformed cells are exercised.
• Dynamic/reflection/monkey-patch cases remain unsupported/incomplete; all provider/session/cap/fallback states from prior children apply; no hierarchy/rename graph fallback exists.
• Clean packed install covers every capability; manifests advertise only observed/accepted routes; no public ASP route or readiness wording appears.
• Parent P1 — Add truthful Python LSP semantic inspection and navigation #248 closes only after all three child PRs, exact cleanup/orphan evidence, package provenance, real-repo comparisons, and local proof pass.

Observable outcomes

• Clean success carries positive execution/provenance evidence; zero diagnostics alone is never proof.
• Findings and every unavailable/invalid/timeout/crash/resource/stale/unsupported state are machine-readable and fail or degrade exactly as the capability contract says.
• No implicit fallback, partial result, or skipped execution is reported as a pass.
• Target source, configuration, lockfiles, environments, and caches remain unchanged except where this issue explicitly owns a validation-gated atomic edit; every temporary resource/process is cleaned.

Non-goals

• WorkspaceEdit/textDocument rename
• edit preview/apply
• file operations/import rewrites
• final cross-platform/release claims

Verification

Run focused behavior first, then the configured repository proof only after the acceptance matrix works:

• npm run build
• node --test tests/contracts.test.mjs tests/semantic-adapter.test.mjs tests/semantic-server-manager.test.mjs tests/semantic-provider-integration.test.mjs tests/inspect-commands.test.mjs tests/asp-provider.test.mjs tests/opcore-facade.test.mjs
• npm run lint
• npm run pack:check
• bash ./scripts/ci/run-local-ci-equivalent.sh
• Attach exact real-tool/artifact versions, argv/config/cwd/source, normalized result examples, before/after cleanliness evidence, and packed-install proof where the slice changes public package behavior.

Execution rule

Implement only after a just-in-time review against current dev. Keep exactly one implementation run active. PR base is dev; require green checks, clean scoped diff, merged PR, closed child, parent checklist update, focused reproductions, and opcore-ci proof before starting the next child. Do not claim Python readiness/parity, ASP authority, old-tool replacement, security/SAST, all-stack support, automatic fixes, or a blended score.