[sjkim1127]

Summary

• Add strings --context --contains TEXT to join canonical string reference evidence to known function entries and immediate callers/callees.
• Add callgraph --function ENTRY and canonical xref coverage to callgraph output.
• Retain unknown owners as references, preserve legacy string arrays and graph payload fields, and use deterministic bounded span queries at the existing static-analysis owner.
• Include CLI documentation and a full validation report. No decompiler algorithm, matcher, denominator or ranking changes.

Validation

• Focused nextest: 38 passed.
• Full fission-static + fission-cli nextest: 204 passed, 1 pre-existing ignored fixture test.
• Crate check/clippy, locked release CLI build, workspace fmt and diff checks passed.
• Real release CLI: 24 navigation commands + 5 unchanged binary hashes; 6 legacy payload comparisons preserved; repeat output identical on 5 PE/ELF fixtures including x86-64 and AArch64.
• Existing project/history CLI regression: 43 commands + 2 unchanged binary hashes passed.
• Saved project names, canonical reference ID/evidence joins, empty-query coverage and unknown function/ISA error behavior covered.

Scope and limits

One-hop indexed navigation over printable ASCII. No recursive pointer traversal, unresolved indirect-call recovery, tail-call recovery, p-code execution or global completeness claim. Local validation was macOS arm64. The existing ignored fact-coverage fixture was not validated. PR #176 and unrelated decompiler work are preserved.

Report: docs/validation/2026-10-12-string-navigation.md.