diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 6835403db..95598e9ef 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -65,8 +65,12 @@ jobs:
               - 'gitnexus/src/core/parsing/**/parser.js'
               # Test fixtures are intentionally synthetic inputs (broken/unused
               # code, malformed samples) used to exercise the analyzer. CodeQL
-              # findings here are noise, not real bugs.
+              # findings here are noise, not real bugs. The second glob also
+              # covers fixtures nested deeper in the test tree, e.g.
+              # test/integration/cfg/fixtures/ (the CFG/PDG hazard inputs that
+              # deliberately contain use-before-init / unused-variable shapes).
               - '**/test/fixtures/**'
+              - '**/test/**/fixtures/**'
 
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
diff --git a/gitnexus/bench/cfg/baselines.json b/gitnexus/bench/cfg/baselines.json
index 0917b6bdd..606ccd19e 100644
--- a/gitnexus/bench/cfg/baselines.json
+++ b/gitnexus/bench/cfg/baselines.json
@@ -53,5 +53,13 @@
     "taint_reason_bytes_large_max": 198000,
     "taint_zero_match_budget": 0.5,
     "_note": "#2083 M3 U7 (R10): N functions, each with 12 req.body sources + a 4-hop chain + 13 eval sinks (13 deduped findings/fn) at 125->500 fns; the zero-match control (inp.payload/evalish) keeps the identical CFG shape with zero model hits. BOUNDEDNESS pin: kept findings/function == 8 (the scenario cap) at BOTH sizes -- above means the cap was lost, below means detection regressed; total findings grow linearly with N by design. disk_bytes_large_max is the LOAD-BEARING site-harvest absolute ceiling (densest sites of the suite; measured 2335772 at N=500, ceiling ~1.35x). taint_reason_bytes_large_max caps the persisted TAINTED reason bytes (measured 146827 = ~37 B/finding, ceiling ~1.35x; blows on hop-encoding bloat or cap loss). taint_zero_match_budget 0.5 vs measured 0.15: the zero-match pass (match gate only, no solver) must stay a small fraction of the match-dense pass. taint scaling measured ~0.93 (per-function work is N-linear); time/disk/heap/rd ratios all ~1.0."
+  },
+  "go:branchy": {
+    "fingerprint": "bba6ad5452c64125daa1dec4cf25e5e111692748a4ef30f309c9b0e03b3e5017",
+    "scaling_budget": 1.8,
+    "disk_bytes_budget": 1.2,
+    "heap_budget": 1.3,
+    "rd_scaling_budget": 2.0,
+    "_note": "#2195 U7: the first NON-TS scaling scenario -- the C-family analogue of `branchy`, driven through the Go grammar + Go CFG visitor (lang:'go'). ONE Go function with N sequential `if`s (block/edge growth in a single CFG). The `go:` key namespace keeps it out of the TS baseline keyspace (no collision/re-baseline of a TS scenario). Measured time ~1.08, disk ~1.03, heap ~1.0, rd ~1.06 (budgets mirror the TS `branchy` scenario: scaling 1.8 absorbs single-CFG noise + catches a ~4.0 quadratic). Cross-check: fp_blocks 32 / fp_edges 46 are IDENTICAL to the TS branchy fingerprint shape -- the Go visitor builds the same per-`if` block/edge topology. CFG-only (Go has no registered taint model), so no taint gates. Re-baseline the fingerprint only on an intentional Go CFG/harvest-shape change."
   }
 }
diff --git a/gitnexus/bench/cfg/measure.mjs b/gitnexus/bench/cfg/measure.mjs
index a4a2c9eaa..efc0661a8 100644
--- a/gitnexus/bench/cfg/measure.mjs
+++ b/gitnexus/bench/cfg/measure.mjs
@@ -42,12 +42,13 @@ import crypto from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 
 import Parser from 'tree-sitter';
-import TypeScript from 'tree-sitter-typescript';
 import { collectFunctionCfgs } from '../../src/core/ingestion/cfg/collect.ts';
 import { computeReachingDefs } from '../../src/core/ingestion/cfg/reaching-defs.ts';
 import { DEFAULT_PDG_MAX_REACHING_DEF_FACTS_PER_FUNCTION } from '../../src/core/ingestion/cfg/emit.ts';
-import { createTypeScriptCfgVisitor } from '../../src/core/ingestion/cfg/visitors/typescript.ts';
 import { getTreeSitterBufferSize } from '../../src/core/ingestion/constants.ts';
+import { getLanguageGrammar } from '../../src/core/tree-sitter/parser-loader.ts';
+import { getProvider } from '../../src/core/ingestion/languages/index.ts';
+import { SupportedLanguages } from '../../src/config/supported-languages.ts';
 import { buildTaintImportIndex, matchFunctionSites } from '../../src/core/ingestion/taint/match.ts';
 import { TS_JS_TAINT_MODEL } from '../../src/core/ingestion/taint/typescript-model.ts';
 import {
@@ -59,12 +60,53 @@ import { encodeTaintPath } from '../../src/core/ingestion/taint/path-codec.ts';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const BASELINE_PATH = path.resolve(__dirname, 'baselines.json');
 
-const visitor = createTypeScriptCfgVisitor();
-const parser = new Parser();
-parser.setLanguage(TypeScript.typescript);
-// Large synthetic sources exceed tree-sitter's default read buffer; size it
-// from the content exactly as the parse worker does (getTreeSitterBufferSize).
-const parse = (src) => parser.parse(src, undefined, { bufferSize: getTreeSitterBufferSize(src) });
+// ---- per-language registry (the U1 parameterization, #2195) ----
+//
+// A scenario names a `lang` (default 'ts'); the registry resolves its grammar,
+// CFG visitor, and (optional) taint model GENERICALLY — the grammar via the
+// production `getLanguageGrammar` loader and the visitor via the provider's
+// `cfgVisitor` hook (the same seam `cfg-snapshot.test.ts` uses). No language is
+// named in the bench logic itself: adding a language is one row here, not a new
+// static grammar import (the language-naming anti-pattern). Lazy by design —
+// only languages actually referenced by a scenario are loaded, so a missing
+// optional grammar never breaks an unrelated run.
+//
+//   - `grammar`     — SupportedLanguages enum value for `getLanguageGrammar`.
+//   - `taintModel`  — source/sink config threaded into the taint pass. ONLY the
+//                     TS row carries `TS_JS_TAINT_MODEL`; C-family rows have no
+//                     model (matching prod: `getSourceSinkConfig(<c-lang>)` is
+//                     `undefined`), so the TS model never runs against a
+//                     C-family CFG.
+const LANGS = {
+  ts: { grammar: SupportedLanguages.TypeScript, taintModel: TS_JS_TAINT_MODEL },
+  go: { grammar: SupportedLanguages.Go, taintModel: null },
+  java: { grammar: SupportedLanguages.Java, taintModel: null },
+  c: { grammar: SupportedLanguages.C, taintModel: null },
+  cpp: { grammar: SupportedLanguages.CPlusPlus, taintModel: null },
+  csharp: { grammar: SupportedLanguages.CSharp, taintModel: null },
+};
+
+// Lazily build + cache one { parser, visitor, parse, taintModel } toolkit per
+// language id. The parser is created once and reused across parses/reps for that
+// language (parse cost is isolated from CFG-build cost by reusing the tree).
+const langToolkitCache = new Map();
+function langToolkit(langId) {
+  const cached = langToolkitCache.get(langId);
+  if (cached) return cached;
+  const spec = LANGS[langId];
+  if (!spec) throw new Error(`bench: unknown lang '${langId}' (add a row to LANGS)`);
+  const visitor = getProvider(spec.grammar).cfgVisitor;
+  if (!visitor)
+    throw new Error(`bench: provider for '${langId}' has no cfgVisitor (visitor not wired?)`);
+  const parser = new Parser();
+  parser.setLanguage(getLanguageGrammar(spec.grammar));
+  // Large synthetic sources exceed tree-sitter's default read buffer; size it
+  // from the content exactly as the parse worker does (getTreeSitterBufferSize).
+  const parse = (src) => parser.parse(src, undefined, { bufferSize: getTreeSitterBufferSize(src) });
+  const toolkit = { visitor, parse, taintModel: spec.taintModel };
+  langToolkitCache.set(langId, toolkit);
+  return toolkit;
+}
 
 // ---- synthetic generators (one cost dimension each) ----
 
@@ -166,10 +208,28 @@ const SCENARIOS = [
     // cost ~nothing (no solver call), gated as zero-time/dense-time ratio.
     small: 125,
     large: 500, // 4x, like the global sizes — per-fn bodies are ~30 lines
+    lang: 'ts', // taint model is TS-only; never run TS_JS_TAINT_MODEL on a C-family CFG
     taint: { cap: 8 },
     gen: (n) => genTaintFunctions(n, false),
     genZero: (n) => genTaintFunctions(n, true),
   },
+  {
+    name: 'go:branchy',
+    // #2195 U7: the first NON-TS scaling scenario — the C-family analogue of the
+    // TS `branchy` stressor, run through the Go grammar + Go CFG visitor. ONE Go
+    // function with N sequential `if`s → N condition blocks + 2N+ edges in a
+    // single CFG; stresses block/edge growth and the namedChildren walk on the
+    // Go body. The `go:` namespace keys it out of the TS baseline keyspace so a
+    // C-family entry can never collide with (or silently re-baseline) a TS
+    // scenario. CFG-only (Go has no registered taint model — see LANGS), so the
+    // gated metrics are the time/disk/heap/rd scaling ratios + the fingerprint.
+    lang: 'go',
+    gen: (n) => {
+      let s = 'package p\nfunc f(x int) {\n';
+      for (let i = 0; i < n; i++) s += `\tif x > ${i} {\n\t\ts${i}()\n\t}\n`;
+      return s + '}\n';
+    },
+  },
 ];
 
 // taint-dense generator: `zero` swaps every model-matched name for an
@@ -207,14 +267,14 @@ function median(xs) {
   return s.length % 2 ? s[m] : (s[m - 1] + s[m]) / 2;
 }
 
-function measureCollect(src, file, reps) {
-  const root = parse(src).rootNode; // parse ONCE; reuse across reps
-  collectFunctionCfgs(root, visitor, `warmup-${file}`, NO_CAP); // warm JIT (uncounted)
+function measureCollect(tk, src, file, reps) {
+  const root = tk.parse(src).rootNode; // parse ONCE; reuse across reps
+  collectFunctionCfgs(root, tk.visitor, `warmup-${file}`, NO_CAP); // warm JIT (uncounted)
   const samples = [];
   let out;
   for (let i = 0; i < reps; i++) {
     const start = process.hrtime.bigint();
-    out = collectFunctionCfgs(root, visitor, file, NO_CAP);
+    out = collectFunctionCfgs(root, tk.visitor, file, NO_CAP);
     samples.push(Number(process.hrtime.bigint() - start) / 1e6);
   }
   return {
@@ -257,7 +317,7 @@ function measureReachingDefs(cfgs, reps, maxFacts) {
 // maxFindingsPerFunction (deliberately small so the cap BINDS on the dense
 // generator). Also sums the encoded TAINTED `reason` bytes for the kept
 // findings — the persisted-taint disk posture (R10).
-function measureTaint(cfgs, reps, cap) {
+function measureTaint(cfgs, reps, cap, taintModel) {
   const importIndex = buildTaintImportIndex([]); // bench callees are globals
   const pass = () => {
     let analyzed = 0;
@@ -265,7 +325,7 @@ function measureTaint(cfgs, reps, cap) {
     let dropped = 0;
     let reasonBytes = 0;
     for (const c of cfgs) {
-      const matches = matchFunctionSites(c, TS_JS_TAINT_MODEL, importIndex);
+      const matches = matchFunctionSites(c, taintModel, importIndex);
       if (!matches.hasSource || !matches.hasSink) continue;
       const du = computeReachingDefs(c, {
         maxFacts: DEFAULT_PDG_MAX_REACHING_DEF_FACTS_PER_FUNCTION,
@@ -307,7 +367,7 @@ function measureTaint(cfgs, reps, cap) {
 // run without the flag still works).
 const GC = typeof global.gc === 'function' ? () => (global.gc(), global.gc()) : null;
 
-function retainedHeapBytes(src, file) {
+function retainedHeapBytes(tk, src, file) {
   if (!GC) return null;
   // Retained-size-by-RELEASE: measure the heap with the CFGs held, drop them,
   // GC, measure again. The drop isolates exactly the JS heap the cfgSideChannel
@@ -315,7 +375,7 @@ function retainedHeapBytes(src, file) {
   // is flushed) — robust to pre-existing garbage, which is constant across both
   // measurements. The parse tree is a temporary (its native memory isn't on the
   // JS heap); block text strings are fresh copies, so they count here.
-  let cfgs = collectFunctionCfgs(parse(src).rootNode, visitor, file, NO_CAP).cfgs;
+  let cfgs = collectFunctionCfgs(tk.parse(src).rootNode, tk.visitor, file, NO_CAP).cfgs;
   GC();
   const withCfgs = process.memoryUsage().heapUsed;
   if (cfgs.length < 0) throw new Error('unreachable'); // keep cfgs live past withCfgs
@@ -342,8 +402,13 @@ function canonicalizeCfg(cfg) {
   return `${cfg.functionStartLine}:${cfg.functionStartColumn}\n${bindings}\n${blocks.join('\n')}\n${edges.join('\n')}`;
 }
 
-function fingerprint(scenario) {
-  const out = collectFunctionCfgs(parse(scenario.gen(FP_SIZE)).rootNode, visitor, 'fp.ts', NO_CAP);
+function fingerprint(tk, scenario) {
+  const out = collectFunctionCfgs(
+    tk.parse(scenario.gen(FP_SIZE)).rootNode,
+    tk.visitor,
+    'fp',
+    NO_CAP,
+  );
   const canon = out.cfgs.map(canonicalizeCfg).sort().join('\n====\n');
   return {
     fingerprint: crypto.createHash('sha256').update(canon).digest('hex'),
@@ -354,19 +419,23 @@ function fingerprint(scenario) {
 }
 
 function measureScenario(scenario) {
+  // Resolve the scenario's language toolkit ONCE (default 'ts' keeps every
+  // pre-existing TS scenario on the exact same grammar+visitor+model path it
+  // used before the U1 parameterization → byte-identical baselines).
+  const tk = langToolkit(scenario.lang ?? 'ts');
   // Per-scenario sizes (straight-line needs larger N to separate a concat
   // quadratic from noise — see its comment); the rest default to the globals.
   const nSmall = scenario.small ?? SMALL;
   const nLarge = scenario.large ?? LARGE;
-  const small = measureCollect(scenario.gen(nSmall), `${scenario.name}.ts`, REPS);
-  const large = measureCollect(scenario.gen(nLarge), `${scenario.name}.ts`, REPS);
+  const small = measureCollect(tk, scenario.gen(nSmall), `${scenario.name}.src`, REPS);
+  const large = measureCollect(tk, scenario.gen(nLarge), `${scenario.name}.src`, REPS);
   const sizeRatio = nLarge / nSmall;
   const scalingRatio = small.ms > 0 ? large.ms / small.ms / sizeRatio : 0;
   const diskRatio = small.diskBytes > 0 ? large.diskBytes / small.diskBytes / sizeRatio : 0;
 
   // Memory growth (only when --expose-gc gave us a forced GC).
-  const heapSmall = retainedHeapBytes(scenario.gen(nSmall), `${scenario.name}.ts`);
-  const heapLarge = retainedHeapBytes(scenario.gen(nLarge), `${scenario.name}.ts`);
+  const heapSmall = retainedHeapBytes(tk, scenario.gen(nSmall), `${scenario.name}.src`);
+  const heapLarge = retainedHeapBytes(tk, scenario.gen(nLarge), `${scenario.name}.src`);
   const heapRatio =
     heapSmall !== null && heapLarge !== null && heapSmall > 0
       ? heapLarge / heapSmall / sizeRatio
@@ -380,22 +449,28 @@ function measureScenario(scenario) {
   // ratio 0 and the gate would self-disable exactly when the solver is fast.
   const rdRatio = rdLarge.ms / Math.max(rdSmall.ms, 0.001) / sizeRatio;
 
-  // #2083 M3 U7: taint pass cost + boundedness on taint-bearing scenarios.
+  // #2083 M3 U7: taint pass cost + boundedness on taint-bearing scenarios. The
+  // taint model is the scenario's language model (TS_JS_TAINT_MODEL for the TS
+  // taint-dense scenario; a taint scenario requires a model-bearing language).
   let taintMetrics = {};
   if (scenario.taint !== undefined) {
+    if (!tk.taintModel)
+      throw new Error(
+        `bench: scenario '${scenario.name}' has a taint config but lang '${scenario.lang ?? 'ts'}' has no taint model`,
+      );
     const cap = scenario.taint.cap;
-    const tSmall = measureTaint(small.cfgs, REPS, cap);
-    const tLarge = measureTaint(large.cfgs, REPS, cap);
+    const tSmall = measureTaint(small.cfgs, REPS, cap, tk.taintModel);
+    const tLarge = measureTaint(large.cfgs, REPS, cap, tk.taintModel);
     const tRatio = tLarge.ms / Math.max(tSmall.ms, 0.001) / sizeRatio;
     // Zero-match control: identical CFG shape, no model hits — measures the
     // match-gate overhead unmatched functions pay on a real --pdg repo.
     const zeroCfgs = collectFunctionCfgs(
-      parse(scenario.genZero(nLarge)).rootNode,
-      visitor,
-      `${scenario.name}-zero.ts`,
+      tk.parse(scenario.genZero(nLarge)).rootNode,
+      tk.visitor,
+      `${scenario.name}-zero.src`,
       NO_CAP,
     ).cfgs;
-    const tZero = measureTaint(zeroCfgs, REPS, cap);
+    const tZero = measureTaint(zeroCfgs, REPS, cap, tk.taintModel);
     taintMetrics = {
       taint_ms_small: Number(tSmall.ms.toFixed(3)),
       taint_ms_large: Number(tLarge.ms.toFixed(3)),
@@ -431,7 +506,7 @@ function measureScenario(scenario) {
     rd_scaling_ratio: Number(rdRatio.toFixed(3)),
     facts_small: rdSmall.facts,
     facts_large: rdLarge.facts,
-    ...fingerprint(scenario),
+    ...fingerprint(tk, scenario),
   };
 }
 
diff --git a/gitnexus/src/core/ingestion/cfg/cfg-builder.ts b/gitnexus/src/core/ingestion/cfg/cfg-builder.ts
index b6e69126b..57b95a0cb 100644
--- a/gitnexus/src/core/ingestion/cfg/cfg-builder.ts
+++ b/gitnexus/src/core/ingestion/cfg/cfg-builder.ts
@@ -42,10 +42,40 @@ interface MutableBlock {
   statements: StatementFacts[];
 }
 
+/**
+ * Hard ceiling on CFG recursive-descent scope-entry depth (#2195). A language
+ * `CfgVisitor` wraps each nested block scope in {@link CfgBuilder.withNesting} (its
+ * `visitBody` / `visitSeq` choke points), so the live count tracks scope entries,
+ * not statement width. NOTE the count is ~2× LEXICAL nesting for block-bodied
+ * constructs (visitBody → visitSeq both enter), so the effective lexical ceiling
+ * is ~250 levels for block bodies (~500 for single-statement bodies / bare
+ * blocks). Real source nests ≤ ~50 deep, so this fires only on machine-generated
+ * / adversarial input. Both effective ceilings sit far below the engine's native
+ * stack limit (~1.2k+ nesting even on the raised worker `stackSizeMb`), so the
+ * bail is a DETERMINISTIC, language-independent {@link CfgNestingDepthError}
+ * rather than a nondeterministic `RangeError` thrown somewhere mid-walk.
+ */
+export const MAX_CFG_NESTING_DEPTH = 500;
+
+/**
+ * Thrown by the visitor nesting-depth guard ({@link CfgBuilder.enterNesting})
+ * when lexical nesting exceeds {@link MAX_CFG_NESTING_DEPTH}. `collectFunctionCfgs`
+ * catches it and counts the function under `skipped.tooDeeplyNested`, isolating
+ * the bail to one function instead of risking a worker-wide stack overflow.
+ */
+export class CfgNestingDepthError extends Error {
+  constructor(readonly limit: number) {
+    super(`CFG nesting depth exceeded ${limit}`);
+    this.name = 'CfgNestingDepthError';
+  }
+}
+
 export class CfgBuilder {
   private readonly blocks: MutableBlock[] = [];
   private readonly edges: CfgEdgeData[] = [];
   private readonly edgeKeys = new Set<string>();
+  /** Live recursive-descent nesting depth — see {@link enterNesting}. */
+  private nesting = 0;
   readonly entryIndex: number;
   readonly exitIndex: number;
 
@@ -119,6 +149,45 @@ export class CfgBuilder {
     return this.blocks.length;
   }
 
+  /**
+   * Run `fn` inside ONE nested block scope (#2195) — the single choke every
+   * visitor's `visitBody` / `visitSeq` funnels through. Enters on the way in and
+   * exits in a `finally`, so the live depth is balanced on every return AND every
+   * throw and the enter/exit can never drift out of pair (the reason this is one
+   * helper, not 24 hand-paired call sites). Throws {@link CfgNestingDepthError}
+   * when nesting exceeds {@link MAX_CFG_NESTING_DEPTH} — a proactive, deterministic
+   * bail before the native stack can overflow on a pathologically nested function.
+   *
+   * A block-bodied construct passes through BOTH visitBody and visitSeq, so it
+   * costs TWO scopes per lexical level: the effective structural ceiling is
+   * ~MAX_CFG_NESTING_DEPTH/2 (~250) lexical levels for block bodies (~500 for
+   * single-statement bodies / bare blocks, which hit only one of the two). Still
+   * an order of magnitude below the native limit and far above real code (≤ ~50).
+   */
+  withNesting<T>(fn: () => T): T {
+    this.enterNesting();
+    try {
+      return fn();
+    } finally {
+      this.exitNesting();
+    }
+  }
+
+  /**
+   * Increment the nesting counter, throwing {@link CfgNestingDepthError} past the
+   * cap. Prefer {@link withNesting}, which pairs the exit in a `finally`; this is
+   * exposed for direct depth-accounting tests only.
+   */
+  enterNesting(): void {
+    if (++this.nesting > MAX_CFG_NESTING_DEPTH)
+      throw new CfgNestingDepthError(MAX_CFG_NESTING_DEPTH);
+  }
+
+  /** Decrement the nesting counter — the partner of {@link enterNesting}. */
+  exitNesting(): void {
+    this.nesting--;
+  }
+
   /** Produce the serializable CFG. Caller is responsible for having wired the
    *  function's dangling exits to {@link exitIndex} before calling.
    *
diff --git a/gitnexus/src/core/ingestion/cfg/collect.ts b/gitnexus/src/core/ingestion/cfg/collect.ts
index 890987f7d..bdf1b095d 100644
--- a/gitnexus/src/core/ingestion/cfg/collect.ts
+++ b/gitnexus/src/core/ingestion/cfg/collect.ts
@@ -14,6 +14,7 @@
  * cannot blow up worker time/memory. A cap of `0` means no limit.
  */
 import type { SyntaxNode } from '../utils/ast-helpers.js';
+import { CfgNestingDepthError } from './cfg-builder.js';
 import type { CfgVisitor, FunctionCfg } from './types.js';
 
 /**
@@ -24,10 +25,62 @@ import type { CfgVisitor, FunctionCfg } from './types.js';
  */
 export const DEFAULT_PDG_MAX_FUNCTION_LINES = 2000;
 
+/**
+ * CFG-bearing functions skipped during the walk, bucketed by reason (#2195).
+ * Surfaced per-language in the parse telemetry (parsing-processor.ts) so a CFG
+ * coverage gap is observable, not silent. All-zero ⇒ nothing skipped.
+ */
+export interface CfgSkipCounts {
+  /** Source span exceeded `maxFunctionLines` (minified / generated code). */
+  readonly tooManyLines: number;
+  /**
+   * Recursive-descent nesting hit {@link MAX_CFG_NESTING_DEPTH} — a proactive,
+   * deterministic bail (see {@link CfgNestingDepthError}) before a worker stack
+   * overflow.
+   */
+  readonly tooDeeplyNested: number;
+  /**
+   * `buildFunctionCfg` threw an unexpected error. Caught PER FUNCTION so one
+   * malformed function no longer drops the whole file's CFGs (the throw used to
+   * escape to the worker's language-group catch).
+   */
+  readonly buildError: number;
+}
+
 export interface CollectedCfgs {
   readonly cfgs: readonly FunctionCfg[];
-  /** Functions skipped for exceeding `maxFunctionLines` (0 ⇒ none skipped). */
-  readonly skipped: number;
+  /** Per-reason skip counts (#2195). */
+  readonly skipped: CfgSkipCounts;
+}
+
+/**
+ * Convert a CFG built from an EXTRACTED sub-document's AST (script-relative
+ * tree-sitter rows) into the enclosing file's coordinates by adding `offset` to
+ * every source-line field. Needed for embedded scripts — a Vue SFC `<script>`
+ * block parses at row 0 but lives at `lineOffset` in the `.vue` file, and every
+ * other worker-emitted graph node is already file-relative; without this, the
+ * CFG's `functionStartLine` would never join its Function/Method graph node
+ * (inter-procedural taint silently resolves nothing) and BasicBlock source
+ * lines would point at the wrong `.vue` line. A 0 offset returns the input
+ * unchanged (the common case: `.ts`/`.js`/etc. parse at the file root), keeping
+ * non-embedded languages byte-identical. Synthetic bindings keep `declLine` 0.
+ */
+function shiftCfgLines(cfg: FunctionCfg, offset: number): FunctionCfg {
+  if (offset === 0) return cfg;
+  return {
+    ...cfg,
+    functionStartLine: cfg.functionStartLine + offset,
+    functionEndLine: cfg.functionEndLine + offset,
+    blocks: cfg.blocks.map((b) => ({
+      ...b,
+      startLine: b.startLine + offset,
+      endLine: b.endLine + offset,
+      statements: b.statements?.map((s) => ({ ...s, line: s.line + offset })),
+    })),
+    bindings: cfg.bindings?.map((bd) =>
+      bd.declLine > 0 ? { ...bd, declLine: bd.declLine + offset } : bd,
+    ),
+  };
 }
 
 export function collectFunctionCfgs(
@@ -35,9 +88,12 @@ export function collectFunctionCfgs(
   visitor: CfgVisitor<SyntaxNode>,
   filePath: string,
   maxFunctionLines = 0,
+  lineOffset = 0,
 ): CollectedCfgs {
   const cfgs: FunctionCfg[] = [];
-  let skipped = 0;
+  let tooManyLines = 0;
+  let tooDeeplyNested = 0;
+  let buildError = 0;
   const stack: SyntaxNode[] = [root];
 
   while (stack.length) {
@@ -45,10 +101,19 @@ export function collectFunctionCfgs(
     if (visitor.isFunction(node)) {
       const lines = node.endPosition.row - node.startPosition.row + 1;
       if (maxFunctionLines > 0 && lines > maxFunctionLines) {
-        skipped++;
+        tooManyLines++;
       } else {
-        const cfg = visitor.buildFunctionCfg(node, filePath);
-        if (cfg) cfgs.push(cfg);
+        // Isolate the per-function build: a proactive deep-nesting bail
+        // (CfgNestingDepthError) or any other visitor throw is counted and
+        // skipped HERE, so it can't escape to the worker's language-group catch
+        // and silently drop every remaining function's CFG (#2195).
+        try {
+          const cfg = visitor.buildFunctionCfg(node, filePath);
+          if (cfg) cfgs.push(shiftCfgLines(cfg, lineOffset));
+        } catch (err) {
+          if (err instanceof CfgNestingDepthError) tooDeeplyNested++;
+          else buildError++;
+        }
       }
     }
     // Descend regardless (a skipped mega-function may still contain small
@@ -59,5 +124,5 @@ export function collectFunctionCfgs(
     }
   }
 
-  return { cfgs, skipped };
+  return { cfgs, skipped: { tooManyLines, tooDeeplyNested, buildError } };
 }
diff --git a/gitnexus/src/core/ingestion/cfg/control-dependence.ts b/gitnexus/src/core/ingestion/cfg/control-dependence.ts
index 033075327..58fef92b7 100644
--- a/gitnexus/src/core/ingestion/cfg/control-dependence.ts
+++ b/gitnexus/src/core/ingestion/cfg/control-dependence.ts
@@ -1,15 +1,26 @@
 /**
- * Control dependence (#2085 M5 U3) — Ferrante, Ottenstein & Warren §3.1.1 over
- * the post-dominator tree. A block `dependent` is control-dependent on a branch
- * block `controller` when `controller` decides whether `dependent` executes:
- * formally, there is a CFG edge `controller → B` such that `dependent`
- * post-dominates `B` but does NOT strictly post-dominate `controller`.
+ * Control dependence (#2085 M5 U3) — Ferrante, Ottenstein & Warren §3.1.1
+ * semantics. A block `dependent` is control-dependent on a branch block
+ * `controller` when `controller` decides whether `dependent` executes: formally,
+ * there is a CFG edge `controller → B` such that `dependent` post-dominates `B`
+ * but does NOT strictly post-dominate `controller`.
  *
- * Construction (§3.1.1): for each CFG edge `(A, B)` where `B` does NOT
- * post-dominate `A`, walk UP the post-dom tree from `B` to (but not including)
- * `ipdom(A)`; every block on that path is control-dependent on `A`. The branch
- * SENSE of the edge ('T' | 'F') becomes the edge label (KTD4 / KTD3 — it rides
- * the persisted relation's `reason` column).
+ * Construction — the reverse-CFG dominance-frontier formulation (Cytron,
+ * Ferrante, Rosen, Wegman & Zadeck 1991): control dependence IS the dominance
+ * frontier of the reverse CFG, so `A ∈ PDF(X)` (the post-dominance frontier)
+ * ⟺ `X` is control-dependent on `A`. The PDF is computed bottom-up over the
+ * post-dom tree (`PDF_local` from a node's CFG predecessors + `PDF_up` from its
+ * post-dom-tree children) in O(N + E + output) — each up-step is charged to a
+ * distinct emitted edge, NOT re-walked per CFG edge as the original §3.1.1
+ * up-walk did (which was Θ(N²) on a deep post-dom chain). The two formulations
+ * enumerate the IDENTICAL full `(controller, dependent, label)` set (verified
+ * byte-identical on 3203 CFGs + ~1M-case differential fuzz); LLVM, Joern and WALA
+ * use the reverse-DF form. (Only the rare TRUNCATED prefix — when a function
+ * exceeds `maxEdges` — differs from the old prefix: it is now a sorted
+ * deterministic prefix rather than CFG-edge-iteration order. Both are valid,
+ * deterministic subsets; the full untruncated output is unchanged.)
+ * The branch SENSE ('T' | 'F') of the controlling edge becomes the edge label
+ * (KTD4 / KTD3 — it rides the persisted relation's `reason` column).
  *
  * PURE AND DETERMINISTIC (mirrors post-dominators.ts / reaching-defs.ts): no
  * graph, no logger, importable outside the worker; output is deduped per
@@ -18,12 +29,7 @@
  * control-dependent on ITSELF (`controller === dependent`) — the loop predicate
  * gates its own re-execution; this is standard PDG behavior, not a bug.
  */
-import {
-  computePostDominators,
-  postDominates,
-  NO_IPDOM,
-  type PostDomTree,
-} from './post-dominators.js';
+import { computePostDominators, NO_IPDOM, type PostDomTree } from './post-dominators.js';
 import type { CfgEdgeKind, FunctionCfg } from './types.js';
 
 export type CdgLabel = 'T' | 'F';
@@ -111,10 +117,14 @@ function labelFor(kind: CfgEdgeKind, controller: ArmSenses): CdgLabel {
 export function computeControlDependence(
   cfg: FunctionCfg,
   postDom?: PostDomTree,
-  // Heap-safety ceiling on materialized edges, mirroring computeReachingDefs'
-  // `maxFacts` (#2188 review): the pre-dedup walk is O(edges × post-dom depth),
-  // so bound it before it can spike. `0` ⇒ unbounded. On overflow `edges` is a
-  // deterministic prefix and `truncated` is set — never a silent drop.
+  // Output-size ceiling, mirroring computeReachingDefs' `maxFacts` (#2188 review).
+  // The reverse-DF set is the bounded (controller, dependent, label) dependence
+  // relation, so peak working set ≈ output here (no pre-dedup spike like the old
+  // up-walk) — this caps the final edge COUNT, not transient memory. `0` ⇒
+  // unbounded. On overflow `edges` is a deterministic SORTED prefix and
+  // `truncated` is set — never a silent drop. (The sorted prefix is the prefix
+  // CONTENTS may differ from the old up-walk's CFG-edge-iteration prefix at the
+  // cap boundary; the FULL untruncated set is byte-identical — see the module doc.)
   maxEdges: number = 0,
 ): ControlDepResult {
   const tree = postDom ?? computePostDominators(cfg);
@@ -123,42 +133,73 @@ export function computeControlDependence(
   const armSenses = buildArmSenses(cfg);
   const cap = maxEdges > 0 ? maxEdges : Infinity;
 
-  const out: ControlDepEdge[] = [];
-  const seen = new Set<string>();
-  let truncated = false;
+  // Reverse-CFG post-dominance frontier (Cytron, Ferrante, Rosen, Wegman,
+  // Zadeck 1991): control dependence IS the dominance frontier of the reverse
+  // CFG. `A ∈ PDF(X)` ⟺ X is control-dependent on A, so emit (controller=A,
+  // dependent=X). Computing the PDF bottom-up over the post-dom tree charges
+  // each up-step to a DISTINCT emitted entry — O(N+E+output) — instead of the
+  // old Ferrante up-walk that re-climbs the ipdom chain per CFG edge (Θ(N²) on
+  // a deep post-dom chain). Output is the identical (controller, dependent,
+  // label) set (verified byte-identical on 3203 CFGs across all languages +
+  // fuzz) and 1-2 orders of magnitude faster. LLVM (ReverseIDFCalculator),
+  // Joern (CdgPass) and WALA use the same formulation.
+  const children: number[][] = Array.from({ length: n }, () => []);
+  const inEdges: { from: number; kind: CfgEdgeKind }[][] = Array.from({ length: n }, () => []);
+  for (let b = 0; b < n; b++) {
+    const ip = ipdom[b];
+    if (ip !== NO_IPDOM && ip >= 0 && ip < n) children[ip].push(b);
+  }
+  for (const e of cfg.edges) {
+    if (e.from < 0 || e.from >= n || e.to < 0 || e.to >= n) continue;
+    inEdges[e.to].push({ from: e.from, kind: e.kind });
+  }
 
-  scan: for (const e of cfg.edges) {
-    const a = e.from;
-    const b = e.to;
-    if (a < 0 || a >= n || b < 0 || b >= n) continue;
-    // No control dependence when B post-dominates A — every path leaving A
-    // through this edge still reaches B, so A does not decide B's execution.
-    // This guard is exactly AC2: a dependence exists IFF post-dominance fails.
-    if (postDominates(tree, b, a)) continue;
+  // Post-dom-tree post-order (children before parents). Iterative — the post-dom
+  // forest can itself be chain-deep. Roots are the NO_IPDOM nodes (EXIT, plus
+  // any exit-unreachable region per #2188 F2). The reverse of a root-first DFS
+  // visits every parent AFTER all its descendants.
+  const dfs: number[] = [];
+  for (let r = 0; r < n; r++) if (ipdom[r] === NO_IPDOM) dfs.push(r);
+  const preorder: number[] = [];
+  while (dfs.length) {
+    const x = dfs.pop() as number;
+    preorder.push(x);
+    for (const c of children[x]) dfs.push(c);
+  }
+  const order = preorder.reverse();
 
-    // Sense is read from the CONTROLLER's arms, not this edge's kind alone —
-    // seq/loop-back fall-through false arms would otherwise mislabel as 'T'
-    // (#2188 F1).
-    const label = labelFor(e.kind, armSenses[a]);
-    const stop = ipdom[a]; // walk up to ipdom(A), EXCLUSIVE (NO_IPDOM ⇒ to root)
-    let cur = b;
-    let steps = 0;
-    // `steps <= n` is defensive — the ipdom chain is a finite tree.
-    while (cur !== NO_IPDOM && cur !== stop && steps <= n) {
-      const key = `${a}:${cur}:${label}`;
-      if (!seen.has(key)) {
-        // Check BEFORE pushing so `truncated` means a genuine overflow (a new
-        // unique edge had to be dropped), not merely "reached the ceiling" —
-        // exactly `cap` edges is a full, non-truncated result.
-        if (out.length >= cap) {
-          truncated = true;
-          break scan;
-        }
-        seen.add(key);
-        out.push({ controllerBlock: a, dependentBlock: cur, label });
+  // PDF[X]: controller A → the label SET with which A controls X. A set (not one
+  // label) because a controller can reach X via opposite-sense arms (goto-
+  // cycles) — the old (a, cur, label) dedup kept both rows.
+  const pdf: Map<number, Set<CdgLabel>>[] = Array.from({ length: n }, () => new Map());
+  const add = (x: number, a: number, label: CdgLabel): void => {
+    const set = pdf[x].get(a);
+    if (set) set.add(label);
+    else pdf[x].set(a, new Set([label]));
+  };
+  for (const x of order) {
+    // PDF_local: a CFG-predecessor A of X that X does not (immediately) post-
+    // dominate. `A !== X && ipdom[A] !== X` is exactly the production
+    // `!postDominates(X, A)` for one edge A→X (postDominates(X,A) ⟺ ipdom[A]===X),
+    // and it excludes self-edges + NO_IPDOM regions. Sense is read from the
+    // CONTROLLER's arms (seq/loop-back fall-through false arms would otherwise
+    // mislabel as 'T' — #2188 F1).
+    for (const { from: a, kind } of inEdges[x]) {
+      if (a !== x && ipdom[a] !== x) add(x, a, labelFor(kind, armSenses[a]));
+    }
+    // PDF_up: inherit each post-dom child's frontier controller (with its label
+    // set) when X does not post-dominate it.
+    for (const z of children[x]) {
+      for (const [a, labels] of pdf[z]) {
+        if (ipdom[a] !== x) for (const l of labels) add(x, a, l);
       }
-      cur = ipdom[cur];
-      steps += 1;
+    }
+  }
+
+  const out: ControlDepEdge[] = [];
+  for (const x of order) {
+    for (const [a, labels] of pdf[x]) {
+      for (const label of labels) out.push({ controllerBlock: a, dependentBlock: x, label });
     }
   }
 
@@ -168,5 +209,13 @@ export function computeControlDependence(
       x.dependentBlock - y.dependentBlock ||
       (x.label < y.label ? -1 : x.label > y.label ? 1 : 0),
   );
+  // `maxEdges` is a heap-safety backstop applied to the SORTED set (the DF makes
+  // overflow far rarer than the old per-edge walk). Deterministic prefix, never
+  // a silent drop; mirrors computeReachingDefs' `truncated`.
+  let truncated = false;
+  if (cap !== Infinity && out.length > cap) {
+    truncated = true;
+    out.length = cap;
+  }
   return { edges: out, truncated };
 }
diff --git a/gitnexus/src/core/ingestion/cfg/emit.ts b/gitnexus/src/core/ingestion/cfg/emit.ts
index 246baa1d4..998f4c79e 100644
--- a/gitnexus/src/core/ingestion/cfg/emit.ts
+++ b/gitnexus/src/core/ingestion/cfg/emit.ts
@@ -27,6 +27,7 @@ import {
   isExitReachableFromAllBlocks,
   NO_IPDOM,
 } from './post-dominators.js';
+import { augmentForPostDom } from './synthetic-escape.js';
 import type { BindingEntry, FunctionCfg } from './types.js';
 
 /**
@@ -94,6 +95,26 @@ export const REACHING_DEF_FACTS_PER_EDGE_CAP = 4;
 export const DEFAULT_PDG_MAX_REACHING_DEF_FACTS_PER_FUNCTION =
   REACHING_DEF_FACTS_PER_EDGE_CAP * DEFAULT_PDG_MAX_REACHING_DEF_EDGES_PER_FUNCTION;
 
+/**
+ * Fixpoint-iteration budget for {@link computeReachingDefs}, as a multiple of
+ * the function's block count ({@link emitFileReachingDefs} passes
+ * `blocks.length × this` as `maxBlockVisits`). Iterative reaching-defs on a
+ * reducible CFG converges in O(loop-nesting-depth) passes, so a worklist
+ * re-visits each block a small multiple of times for real code; this budget
+ * tolerates a nesting depth far beyond any hand-written function (real code is
+ * ≤ ~15 deep) while truncating the pathological deep nest that otherwise drives
+ * the solver to O(blocks²) — measured at seconds + GB on a machine-generated
+ * 2000-line all-loops function whose fact count stays linear (so `maxFacts`
+ * never fires). Truncation degrades to a sound empty REACHING_DEF for that one
+ * function (status `truncated`), never wrong facts.
+ *
+ * This ceiling is the SOUND backstop, not a perf fix: WTO / loop-aware iteration
+ * ordering was benchmarked and rejected (0% faster — the cost is dense-set
+ * propagation, not visitation order; see the no-go note in reaching-defs.ts at
+ * the RPO-order site). SSA-sparse reaching-defs is the deferred real fix.
+ */
+export const DEFAULT_PDG_MAX_REACHING_DEF_BLOCK_REVISITS = 64;
+
 export interface CfgEmitResult {
   blocks: number;
   edges: number;
@@ -358,7 +379,10 @@ export function emitFileReachingDefs(
       );
       continue;
     }
-    const r = computeReachingDefs(cfg, { maxFacts });
+    const r = computeReachingDefs(cfg, {
+      maxFacts,
+      maxBlockVisits: cfg.blocks.length * DEFAULT_PDG_MAX_REACHING_DEF_BLOCK_REVISITS,
+    });
     if (r.status === 'no-facts') continue;
     result.facts += r.facts.length;
 
@@ -511,12 +535,24 @@ export function emitFileCdg(
 
   for (const cfg of cfgs) {
     const { filePath, functionStartLine, functionStartColumn } = cfg;
+    // Synthetic-escape pass (#2197 U1): restore EXIT reverse-reachability for a
+    // genuine exit-unreachable CYCLE (an unconditional `goto`-cycle / infinite
+    // loop) so the post-dom / CDG pass runs instead of being withheld. A no-op
+    // (returns `cfg` unchanged) for terminating functions and properly-escaped
+    // loops — those stay byte-identical. The synthetic edges are ANALYSIS-ONLY:
+    // they live on the returned shallow clone, never on the persisted `cfg`, so
+    // CFG / REACHING_DEF and the byte-identical-off golden are unaffected. Both
+    // the gate below AND the post-dom / CDG passes must see the augmented view
+    // (KTD7 — the Ferrante walk re-reads `cfg.edges`).
+    const view = augmentForPostDom(cfg);
     // Sound post-dominance requires EXIT reachable from every entry-reachable
-    // block (#2188 review). A CFG that violates it — a future visitor's
-    // multi-terminal / non-terminating shape — would yield a CDG that both
-    // drops real and invents spurious dependences, so skip CDG for it. CFG and
-    // REACHING_DEF (emitted elsewhere, independent of post-dominance) are kept.
-    if (!isExitReachableFromAllBlocks(cfg)) {
+    // block (#2188 review). The synthetic-escape pass recovers genuine cycles;
+    // anything STILL unreachable after it is a residual non-cycle anomaly (a
+    // dangling/dead-end block, a branch-less trapping spin, or a construction
+    // error) — NOT something we bridge (that would mask the bug). Skip CDG for
+    // it and surface the skip. CFG and REACHING_DEF (emitted elsewhere,
+    // independent of post-dominance) are kept.
+    if (!isExitReachableFromAllBlocks(view)) {
       result.skippedUnsoundFunctions++;
       onWarn?.(
         `[cdg] ${filePath}:${functionStartLine}: EXIT not reachable from all ` +
@@ -525,13 +561,16 @@ export function emitFileCdg(
       continue;
     }
     // Compute the post-dom tree once and feed it to the control-dependence
-    // pass (avoids recomputing it) and to the optional POST_DOMINATE emit.
-    const tree = computePostDominators(cfg);
+    // pass (avoids recomputing it) and to the optional POST_DOMINATE emit. The
+    // CDG edges reference BLOCK INDICES, which are identical in `view` and `cfg`
+    // (the augmentation only appends edges), so persisting them keyed off the
+    // original block ids is correct.
+    const tree = computePostDominators(view);
     // Bound the pre-dedup materialization (heap parity with REACHING_DEF). The
     // fixed ceiling is a catastrophe backstop; the per-function edge cap below
     // remains the reporting authority. A ceiling hit is surfaced, not silent.
     const { edges: cdgEdges, truncated } = computeControlDependence(
-      cfg,
+      view,
       tree,
       DEFAULT_PDG_MAX_CDG_MATERIALIZATION_PER_FUNCTION,
     );
diff --git a/gitnexus/src/core/ingestion/cfg/reaching-defs.ts b/gitnexus/src/core/ingestion/cfg/reaching-defs.ts
index 7b7f7233c..ff192e802 100644
--- a/gitnexus/src/core/ingestion/cfg/reaching-defs.ts
+++ b/gitnexus/src/core/ingestion/cfg/reaching-defs.ts
@@ -67,6 +67,19 @@ export interface ReachingDefsLimits {
    * `status: 'truncated'`. `undefined`/0 ⇒ unlimited.
    */
   readonly maxFacts?: number;
+  /**
+   * Maximum total block dequeues in the dataflow fixpoint. Iterative
+   * reaching-defs on a reducible CFG converges in O(loop-nesting-depth) passes,
+   * so a worklist visits each block a small multiple of times for real code; a
+   * pathologically deep loop nest (machine-generated / obfuscated) drives the
+   * pass count — and thus the visit total — to O(blocks²) and the solver to
+   * seconds + GB of heap (`maxFacts` does not help: fact count stays linear).
+   * When the visit total exceeds this budget the fixpoint has NOT converged, so
+   * any facts would be unsound — the solver bails to a sound empty
+   * `status: 'truncated'` (like the `overflow` guard). `undefined`/0 ⇒ unlimited
+   * (the default for direct callers; the emit path sets a per-function budget).
+   */
+  readonly maxBlockVisits?: number;
 }
 
 export interface FunctionDefUse {
@@ -214,6 +227,18 @@ export function computeReachingDefs(cfg: FunctionCfg, limits?: ReachingDefsLimit
   }
 
   // ── iteration order: RPO over reachable blocks, then the rest by index ──
+  // WTO / loop-aware iteration (Bourdoncle 1993) was evaluated as a fix for the
+  // O(blocks²) deep-loop-nest blow-up and REJECTED: on the dense-loop benchmark a
+  // faithful weak-topological-order solver was 104/104 byte-identical to this RPO
+  // worklist but 0% faster. The cost is inherent to dense-set propagation +
+  // lattice merges on the iterated dominance frontier, not to visitation order, so
+  // re-ordering passes buys nothing; the "skip re-evaluating a loop body once its
+  // header stabilises" shortcut is additionally unsound on irreducible (goto)
+  // CFGs. The sound, shipped backstop is the maxBlockVisits ceiling below (a
+  // blocks×64 budget — see emit.ts DEFAULT_PDG_MAX_REACHING_DEF_BLOCK_REVISITS),
+  // which truncates the pathological nest to a sound-empty result. The only real
+  // asymptotic fix is SSA-sparse reaching-defs (propagate along def-use chains, not
+  // dense block sets) — deferred to a tracked follow-up, not a reordering tweak.
   const order = reversePostOrder(cfg.entryIndex, succs, n);
 
   // ── fixpoint ────────────────────────────────────────────────────────────
@@ -222,11 +247,24 @@ export function computeReachingDefs(cfg: FunctionCfg, limits?: ReachingDefsLimit
 
   const inWorklist = new Array(n).fill(true);
   let pending = n;
+  // Fixpoint-iteration ceiling (see ReachingDefsLimits.maxBlockVisits): bound the
+  // total block dequeues so a pathologically deep loop nest can't drive the
+  // worklist to O(blocks²). undefined/0 ⇒ unlimited.
+  const maxBlockVisits =
+    limits?.maxBlockVisits && limits.maxBlockVisits > 0 ? limits.maxBlockVisits : Infinity;
+  let blockVisits = 0;
   while (pending > 0) {
     for (const b of order) {
       if (!inWorklist[b]) continue;
       inWorklist[b] = false;
       pending -= 1;
+      if (++blockVisits > maxBlockVisits) {
+        // Did NOT converge within the budget — the in/out sets are not at the
+        // fixpoint, so any facts would be unsound. Bail to a sound empty
+        // `truncated` result (a coverage gap, not an error), carrying the def/use
+        // telemetry already gathered.
+        return { status: 'truncated', bindings: cfg.bindings, facts: [], defCount, useCount };
+      }
 
       const p = preds[b];
       const inB: Lattice =
diff --git a/gitnexus/src/core/ingestion/cfg/synthetic-escape.ts b/gitnexus/src/core/ingestion/cfg/synthetic-escape.ts
new file mode 100644
index 000000000..2934fec22
--- /dev/null
+++ b/gitnexus/src/core/ingestion/cfg/synthetic-escape.ts
@@ -0,0 +1,331 @@
+/**
+ * Synthetic-escape pass for CDG soundness (#2197 U1).
+ *
+ * THE PROBLEM. Control dependence is computed over the post-dominator tree
+ * (control-dependence.ts), which is only sound when EXIT is reverse-reachable
+ * from every entry-reachable block (post-dominators.ts §
+ * {@link isExitReachableFromAllBlocks}). Loop visitors keep that invariant by
+ * giving every loop a structural `header → loopExit` `cond-false` edge — so an
+ * ordinary `while`/`for` always has a path to EXIT. The `goto` handlers
+ * (C/C++/C#/Go), however, wire an UNCONDITIONAL back-edge as plain `seq` with no
+ * such escape:
+ *
+ *   void handler(int a){ start: if (a > 0) { work(); } goto start; }
+ *
+ * Here every body block sits in a trapping cycle (`start … goto start`) with no
+ * path to EXIT, so EXIT is non-reverse-reachable and {@link emitFileCdg} (the
+ * soundness gate) WITHHOLDS all control dependence for the whole function —
+ * silent CDG coverage loss for an entire (common) class of functions.
+ *
+ * THE FIX (nontermination-sensitive control dependence — Ranganath et al.,
+ * TOPLAS 2007). For a genuinely exit-unreachable *cycle* (an infinite loop), add
+ * an ANALYSIS-ONLY virtual escape edge from the cycle's controlling branch to
+ * EXIT, making the post-dom tree well-defined again. The synthetic edge is inert
+ * in the Ferrante walk (EXIT post-dominates its source, so the post-dom guard
+ * skips it) — it only restores reverse-reachability so the REAL control points
+ * inside the loop get their dependences.
+ *
+ * ANALYSIS-ONLY (load-bearing — KTD7). The pass NEVER mutates the input. The
+ * persisted CFG / REACHING_DEF graph and the byte-identical-off golden depend on
+ * `cfg.edges` staying faithful, so the augmentation lives on a shallow-cloned
+ * {@link FunctionCfg} whose `edges` is `[...cfg.edges, ...synthetic]`. Because
+ * both {@link computePostDominators} AND {@link computeControlDependence}
+ * (its Ferrante walk + `buildArmSenses`) re-read `cfg.edges` directly, the
+ * augmented view must be passed to BOTH — feeding only an augmented post-dom
+ * tree would leave the walk on the un-augmented edges (KTD7).
+ *
+ * PURE AND DETERMINISTIC (mirrors post-dominators.ts / reaching-defs.ts). The
+ * SCC routine sorts every adjacency list and emits SCCs root-deterministically,
+ * so the chosen representative — hence the augmented edge set and any downstream
+ * snapshot — is identical across runs.
+ *
+ * WHICH SCCs ARE BRIDGED (KTD2 / KTD6, and the anti-masking guarantee R2). The
+ * decision is gated on the WHOLE entry-reachable trapped region (the union of
+ * the entry-reachable blocks that cannot reach EXIT): the pass bridges only when
+ * that region contains at least one *control point* — a block with ≥2 successors
+ * (a branch terminator). A region with a control point is a real, recoverable
+ * loop (a `goto`-cycle always carries the `if` predicate from its guard); a
+ * region with NO control point is a branch-less infinite spin that carries no
+ * control dependence to recover AND is indistinguishable from a genuine
+ * CFG-construction anomaly (e.g. a disconnected EXIT block), so it is
+ * deliberately LEFT UNBRIDGED — the existing soundness gate then skips the
+ * function and surfaces the skip (R2 / R3). In practice a branch-less trapping
+ * region never comes from a real loop visitor (loops emit the structural escape
+ * edge) — it signals a construction error, exactly what we must not paper over.
+ *
+ * When the region is bridged, EACH exit-less SCC gets one synthetic escape edge
+ * from its *controlling representative*: the entry-reachable member with a branch
+ * terminator (≥2 successors), highest out-degree, lowest-index tie-break. That
+ * branch is the predicate deciding stay-in-loop vs. leave, the faithful escape
+ * representative; attaching the escape anywhere else invents or drops CDG edges
+ * while still passing the AC2 post-dominance property test, so the choice is
+ * pinned by an exact-edge-set test, not `CDG>0`. When an exit-less SCC has NO
+ * internal branch (e.g. the body of an irreducible loop whose control point sits
+ * OUTSIDE the cycle), its escape attaches to the lowest-index member — the
+ * choice is semantically immaterial (the SCC has no internal control point so it
+ * contributes no internal CDG), and a deterministic index keeps snapshots
+ * stable. This per-SCC bridging restores reverse-reachability for the whole
+ * region in one batch, then the gate re-checks (KTD2).
+ *
+ * GRANULARITY OF A MIXED cycle + dead-end FUNCTION. {@link emitFileCdg} is
+ * all-or-nothing per function: it computes CDG only when EXIT is reverse-
+ * reachable from EVERY entry-reachable block. So if a function contains a
+ * recoverable goto-cycle AND a *separate* residual block that is still
+ * exit-unreachable after all escapes (a dangling/dead-end block not in any
+ * bridgeable cycle), the pass restores the cycle but the residual block keeps
+ * EXIT non-reverse-reachable → the WHOLE function is still skipped and surfaced.
+ * We do NOT bridge the residual (that would mask the construction error), and we
+ * do NOT emit partial per-cycle CDG (the emit layer has no partial mode). This
+ * is the documented, intentional trade-off: recover the common goto-cycle case;
+ * surface anything with a genuine residual anomaly rather than guess.
+ */
+import { isExitReachableFromAllBlocks, type PostDomTree } from './post-dominators.js';
+import type { CfgEdgeData, FunctionCfg } from './types.js';
+
+/**
+ * The synthetic escape edge kind. Reuses the existing `cond-false` kind (the
+ * same kind every loop's structural `header → loopExit` escape carries — see the
+ * module doc), so the augmented view is structurally indistinguishable from a
+ * normally-escaped loop and `buildArmSenses`/`labelFor` treat it identically.
+ * The edge is analysis-only and never persisted.
+ */
+const SYNTHETIC_ESCAPE_KIND: CfgEdgeData['kind'] = 'cond-false';
+
+/** Forward / reverse reachability over a CFG's in-range edges. */
+interface Reachability {
+  /** `fromEntry[b]` — block `b` is forward-reachable from ENTRY. */
+  readonly fromEntry: Uint8Array;
+  /** `canReachExit[b]` — block `b` can reach EXIT (reverse-reachable from it). */
+  readonly canReachExit: Uint8Array;
+  /** Forward adjacency (sorted, in-range). */
+  readonly succ: readonly number[][];
+}
+
+function reach(start: number, adj: readonly number[][], n: number): Uint8Array {
+  const seen = new Uint8Array(n);
+  if (start < 0 || start >= n) return seen;
+  const stack = [start];
+  seen[start] = 1;
+  while (stack.length > 0) {
+    const b = stack.pop() as number;
+    for (const next of adj[b]) {
+      if (!seen[next]) {
+        seen[next] = 1;
+        stack.push(next);
+      }
+    }
+  }
+  return seen;
+}
+
+function computeReachability(cfg: FunctionCfg): Reachability {
+  const n = cfg.blocks.length;
+  const succ: number[][] = Array.from({ length: n }, () => []);
+  const pred: number[][] = Array.from({ length: n }, () => []);
+  for (const e of cfg.edges) {
+    if (e.from < 0 || e.from >= n || e.to < 0 || e.to >= n) continue;
+    succ[e.from].push(e.to);
+    pred[e.to].push(e.from);
+  }
+  // Sorted adjacency — determinism (mirrors post-dominators.ts).
+  for (const l of succ) l.sort((a, b) => a - b);
+  return {
+    fromEntry: reach(cfg.entryIndex, succ, n),
+    canReachExit: reach(cfg.exitIndex, pred, n),
+    succ,
+  };
+}
+
+/**
+ * Strongly-connected components of a CFG via an ITERATIVE Tarjan over the
+ * forward edges. Pure and deterministic: nodes are visited in ascending index
+ * and every successor list is iterated in sorted order, so the component
+ * partition (and the per-component member order) is identical across runs.
+ *
+ * Returns `compOf[b]` = the component id of block `b`, plus `members[c]` = the
+ * (ascending-index) members of component `c`. Component ids are assigned in
+ * Tarjan completion order (a reverse-topological order over the condensation),
+ * which is deterministic but not relied upon — callers key on `compOf`.
+ */
+export interface SccResult {
+  readonly compOf: readonly number[];
+  readonly members: readonly (readonly number[])[];
+}
+
+export function computeScc(succ: readonly number[][], n: number): SccResult {
+  const compOf = new Array<number>(n).fill(-1);
+  const members: number[][] = [];
+
+  const index = new Array<number>(n).fill(-1);
+  const lowlink = new Array<number>(n).fill(0);
+  const onStack = new Uint8Array(n);
+  const tarjanStack: number[] = [];
+  let nextIndex = 0;
+
+  // Explicit work stack: each frame tracks the node and how far through its
+  // (sorted) successor list we have iterated, so recursion depth never blows the
+  // JS stack on a large per-function CFG.
+  for (let root = 0; root < n; root++) {
+    if (index[root] !== -1) continue;
+    const work: { node: number; childIdx: number }[] = [{ node: root, childIdx: 0 }];
+    while (work.length > 0) {
+      const frame = work[work.length - 1];
+      const v = frame.node;
+      if (frame.childIdx === 0) {
+        // First visit to v.
+        index[v] = nextIndex;
+        lowlink[v] = nextIndex;
+        nextIndex += 1;
+        tarjanStack.push(v);
+        onStack[v] = 1;
+      }
+      const succs = succ[v];
+      if (frame.childIdx < succs.length) {
+        const w = succs[frame.childIdx];
+        frame.childIdx += 1;
+        if (index[w] === -1) {
+          // Descend into the unvisited child; resume v afterwards.
+          work.push({ node: w, childIdx: 0 });
+        } else if (onStack[w]) {
+          if (index[w] < lowlink[v]) lowlink[v] = index[w];
+        }
+        continue;
+      }
+      // All successors of v processed: propagate lowlink to the parent, and if v
+      // is a component root, pop its component off the Tarjan stack.
+      if (lowlink[v] === index[v]) {
+        const comp: number[] = [];
+        for (;;) {
+          const w = tarjanStack.pop() as number;
+          onStack[w] = 0;
+          comp.push(w);
+          if (w === v) break;
+        }
+        comp.sort((a, b) => a - b); // ascending member order — determinism
+        const id = members.length;
+        for (const w of comp) compOf[w] = id;
+        members.push(comp);
+      }
+      work.pop();
+      if (work.length > 0) {
+        const parent = work[work.length - 1].node;
+        if (lowlink[v] < lowlink[parent]) lowlink[parent] = lowlink[v];
+      }
+    }
+  }
+
+  return { compOf, members };
+}
+
+/**
+ * Restore EXIT reverse-reachability for genuine exit-unreachable cycles so the
+ * post-dom / CDG pass runs on a well-defined tree, WITHOUT masking construction
+ * errors or perturbing sound functions. See the module doc for the full
+ * contract.
+ *
+ * Returns the input `cfg` UNCHANGED (referential no-op) when EXIT is already
+ * reverse-reachable from every entry-reachable block — terminating functions and
+ * properly-escaped loops are byte-identical (zero synthetic edges). Otherwise
+ * returns a SHALLOW-CLONED {@link FunctionCfg} whose `edges` is the original
+ * edges followed by the synthetic escapes; the input's `edges` is never mutated.
+ *
+ * Pass the returned view to BOTH {@link computePostDominators} and
+ * {@link computeControlDependence} (KTD7).
+ */
+export function augmentForPostDom(cfg: FunctionCfg): FunctionCfg {
+  const n = cfg.blocks.length;
+  const { entryIndex, exitIndex } = cfg;
+  if (n === 0 || entryIndex < 0 || entryIndex >= n || exitIndex < 0 || exitIndex >= n) {
+    return cfg; // degenerate — leave to the existing gate
+  }
+
+  const { fromEntry, canReachExit, succ } = computeReachability(cfg);
+
+  // No-op fast path: every entry-reachable block already reaches EXIT.
+  let allReach = true;
+  for (let b = 0; b < n; b++) {
+    if (fromEntry[b] && !canReachExit[b]) {
+      allReach = false;
+      break;
+    }
+  }
+  if (allReach) return cfg;
+
+  // Anti-masking gate (R2): only bridge when the entry-reachable TRAPPED REGION
+  // (the union of entry-reachable blocks that cannot reach EXIT) holds at least
+  // one control point — a block with ≥2 successors. A branch-less trapped region
+  // is a degenerate spin / construction anomaly we refuse to mask; the existing
+  // soundness gate skips it and surfaces the skip. A real `goto`-cycle always
+  // carries its guard's `if`, so it is recovered; a disconnected/dangling EXIT
+  // (no branch anywhere in the trap) is left to skip. See the module doc.
+  let regionHasControlPoint = false;
+  for (let b = 0; b < n; b++) {
+    if (fromEntry[b] && !canReachExit[b] && succ[b].length >= 2) {
+      regionHasControlPoint = true;
+      break;
+    }
+  }
+  if (!regionHasControlPoint) return cfg;
+
+  // Condense into SCCs over the real edges.
+  const { members } = computeScc(succ, n);
+
+  // Bridge EACH exit-less SCC (a trapping cycle: no member can reach EXIT, so
+  // `canReachExit` is false for the whole SCC). `canReachExit` already encodes
+  // the transitive closure, so a single member's flag answers it for the SCC.
+  const synthetic: CfgEdgeData[] = [];
+  for (const comp of members) {
+    if (comp.length === 0) continue;
+    const rep = comp[0]; // ascending-order members → comp[0] is the lowest index
+    if (canReachExit[rep]) continue; // SCC escapes to EXIT — nothing to bridge
+    // Only genuine CYCLES trap. A singleton SCC with no self-edge is an ordinary
+    // acyclic block (ENTRY / the spine) that is exit-unreachable only because it
+    // FEEDS a trap downstream; it gets its path to EXIT for free once the trap is
+    // bridged, so it is never bridged on its own.
+    const isCycle = comp.length > 1 || cfg.edges.some((e) => e.from === rep && e.to === rep);
+    if (!isCycle) continue;
+
+    // Controlling representative: the entry-reachable member with a branch
+    // terminator (≥2 successors), highest out-degree, lowest-index tie-break.
+    // When the SCC has no internal branch (its control point sits outside, e.g.
+    // an irreducible loop body), fall back to the lowest-index member — the
+    // choice is immaterial (no internal control point ⇒ no internal CDG) and a
+    // deterministic index keeps snapshots stable (KTD6).
+    let controller = -1;
+    let bestOutDeg = 1; // require ≥2 to qualify as a branch
+    for (const b of comp) {
+      if (!fromEntry[b]) continue;
+      const outDeg = succ[b].length;
+      if (outDeg >= 2 && outDeg > bestOutDeg) {
+        bestOutDeg = outDeg;
+        controller = b;
+      }
+    }
+    if (controller === -1) {
+      // No internal branch — attach at the lowest entry-reachable member (or the
+      // lowest member if none is entry-reachable, a defensive fallback).
+      controller = comp.find((b) => fromEntry[b]) ?? rep;
+    }
+
+    synthetic.push({ from: controller, to: exitIndex, kind: SYNTHETIC_ESCAPE_KIND });
+  }
+
+  if (synthetic.length === 0) return cfg; // nothing bridgeable — gate will skip
+
+  // Shallow clone with the augmented edge set; the input's `edges` is untouched.
+  return { ...cfg, edges: [...cfg.edges, ...synthetic] };
+}
+
+/**
+ * Convenience: `true` iff {@link augmentForPostDom} returned a DIFFERENT object
+ * (i.e. at least one synthetic escape edge was added). Useful for tests
+ * asserting the no-op path. Reference equality is exact: the no-op path returns
+ * the input unchanged.
+ */
+export function wasAugmented(cfg: FunctionCfg, view: FunctionCfg): boolean {
+  return view !== cfg;
+}
+
+// Re-export so callers can build the augmented view and gate it in one import.
+export { isExitReachableFromAllBlocks };
+export type { PostDomTree };
diff --git a/gitnexus/src/core/ingestion/cfg/visitors/c-cpp-harvest.ts b/gitnexus/src/core/ingestion/cfg/visitors/c-cpp-harvest.ts
new file mode 100644
index 000000000..730bb8930
--- /dev/null
+++ b/gitnexus/src/core/ingestion/cfg/visitors/c-cpp-harvest.ts
@@ -0,0 +1,577 @@
+/**
+ * C / C++ def/use harvester (#2195 U2, plan KTD2) — the C-family analogue of
+ * {@link import('./typescript-harvest.js').TsHarvester}.
+ *
+ * Runs in the parse worker next to the C/C++ CFG visitor, extracting
+ * per-statement variable definition/use facts that ride the side channel for
+ * the reaching-defs / CDG solvers. Output is the per-function binding table
+ * ({@link BindingEntry}[]) plus {@link StatementFacts} the visitor attaches to
+ * blocks as it walks. One class serves both languages: the control-flow node
+ * set is identical (grammar-introspection probe confirmed — see U2 report),
+ * and the harvest's def/use node taxonomy (`declaration`/`init_declarator`/
+ * `assignment_expression`/`update_expression`/`parameter_declaration`) is shared
+ * too; C++-only `lambda_expression` is handled exactly like a nested function
+ * (opaque), so no language naming or branching is needed.
+ *
+ * TWO-PHASE, ORDER-INDEPENDENT (load-bearing — mirrors the TS harvester): the
+ * CFG walk is NOT source-order (`visitFor` builds the init block after the body,
+ * `visitDoWhile` the condition before the body), so resolving names against a
+ * scope stack populated *during* the walk would mis-resolve. Phase 1 pre-scans
+ * the whole function subtree once into a completed lexical scope tree; phase 2
+ * resolves defs/uses against that finished tree from any walk order.
+ *
+ * v1 def-semantics scope:
+ *   - `declaration` → `init_declarator` (an initialized local is a def; a bare
+ *     `int x;` with no initializer writes nothing at runtime — not a def, like
+ *     the TS bare-`var` rule).
+ *   - `assignment_expression` (plain + compound `+=` etc.), `update_expression`
+ *     (`x++`/`--x`) — define and (for compound/update) also use the lvalue.
+ *   - parameters (`parameter_declaration` declarator chain).
+ * EXCLUDED, deliberately (TypeScript-CFA precedent): member / pointer / array
+ * writes (`obj.f = …`, `*p = …`, `a[i] = …`) are NOT scalar defs — their
+ * identifiers are uses only. Both directions of nested-function (C++ lambda)
+ * capture are invisible (the lambda body is an opaque block in the enclosing
+ * CFG, exactly as TS treats arrow/function bodies).
+ *
+ * MAY-DEFS: a def inside a conditionally-evaluated subexpression — the right
+ * operand of `&&`/`||` (`if (a && (x = f()))`), a ternary arm, or a switch
+ * case-test — is a may-def (gen without kill), so the not-taken path's prior
+ * def is not falsely killed.
+ *
+ * Identifiers with no in-function declaration (globals, macros, params of an
+ * enclosing scope) resolve to a SYNTHETIC module-level binding (`name@module`),
+ * applied identically by def and use harvesting.
+ *
+ * RAII NOTE: C++ destructors that run at scope exit are NOT represented in the
+ * tree-sitter AST (they are implicit), so this harvest cannot and does not model
+ * destructor side effects — documented gap, see the visitor doc-comment.
+ *
+ * NOTE: nothing serialized here may carry a field named `nodeId` — the durable
+ * parsedfile-store reviver dedups objects keyed on that field name.
+ */
+import type { SyntaxNode } from '../../utils/ast-helpers.js';
+import type { BindingEntry, StatementFacts } from '../types.js';
+import { CallSiteFactAccumulator } from './call-site-harvest.js';
+import { ScopeTreeHarvester, type Scope, type FactAccumulator } from './scope-tree-harvest.js';
+
+/** Node types that own a nested CFG — their subtrees are opaque to harvesting. */
+const NESTED_FUNCTION_TYPES = new Set(['lambda_expression', 'function_definition']);
+
+/**
+ * Nodes that open a lexical scope for block-local declarations. A `compound_
+ * statement` is one scope; the for-loops open a scope for their loop variable.
+ */
+const SCOPE_TYPES = new Set([
+  'compound_statement',
+  'for_statement',
+  'for_range_loop',
+  'catch_clause',
+]);
+
+/** Type-position subtrees — identifiers inside them are not value uses. */
+const TYPE_CONTEXT_TYPES = new Set([
+  'type_descriptor',
+  'template_argument_list',
+  'template_type',
+  'sized_type_specifier',
+  'primitive_type',
+]);
+
+export class CCppHarvester extends ScopeTreeHarvester {
+  constructor(fnNode: SyntaxNode) {
+    super(fnNode);
+    this.declareParams(fnNode);
+    const body = this.bodyOf(fnNode);
+    if (body) this.prescan(body, this.openScope(body));
+  }
+
+  /** The function/lambda body block (`compound_statement`). */
+  private bodyOf(fnNode: SyntaxNode): SyntaxNode | undefined {
+    const body = fnNode.childForFieldName('body');
+    if (body) return body;
+    return fnNode.namedChildren.find((c) => c.type === 'compound_statement');
+  }
+
+  // ── phase 1: declaration pre-scan ────────────────────────────────────────
+
+  /** The bare identifier a declarator chain ultimately names (or undefined). */
+  private declaratorName(node: SyntaxNode | null): SyntaxNode | undefined {
+    let cur: SyntaxNode | null = node;
+    let hops = 12;
+    while (cur && hops-- > 0) {
+      if (cur.type === 'identifier' || cur.type === 'field_identifier') return cur;
+      // Unwrap pointer/reference/array/init/parenthesized declarator layers.
+      const next =
+        cur.childForFieldName('declarator') ??
+        cur.namedChildren.find(
+          (c) =>
+            c.type === 'identifier' ||
+            c.type === 'field_identifier' ||
+            c.type === 'pointer_declarator' ||
+            c.type === 'reference_declarator' ||
+            c.type === 'array_declarator' ||
+            c.type === 'parenthesized_declarator' ||
+            c.type === 'init_declarator',
+        );
+      if (!next || next.id === cur.id) break;
+      cur = next;
+    }
+    return undefined;
+  }
+
+  private declareParams(fnNode: SyntaxNode): void {
+    // function_definition: declarator → function_declarator → parameter_list.
+    // A C++ lambda routes through abstract_function_declarator.
+    const declarator = fnNode.childForFieldName('declarator');
+    const fnDeclarator = this.findFunctionDeclarator(declarator);
+    const params = fnDeclarator?.childForFieldName('parameters');
+    if (!params) return;
+    for (let i = 0; i < params.namedChildCount; i++) {
+      const p = params.namedChild(i);
+      if (p?.type !== 'parameter_declaration') continue;
+      const name = this.declaratorName(p.childForFieldName('declarator') ?? null);
+      if (name) this.declare(name, 'param', this.root);
+    }
+  }
+
+  private findFunctionDeclarator(node: SyntaxNode | null): SyntaxNode | undefined {
+    let cur: SyntaxNode | null = node;
+    let hops = 10;
+    while (cur && hops-- > 0) {
+      if (cur.type === 'function_declarator' || cur.type === 'abstract_function_declarator') {
+        return cur;
+      }
+      cur = cur.childForFieldName('declarator') ?? null;
+    }
+    return undefined;
+  }
+
+  protected prescan(node: SyntaxNode, scope: Scope): void {
+    this.nearestScopeCache.set(node.id, scope);
+    const t = node.type;
+    if (NESTED_FUNCTION_TYPES.has(t) && node.id !== this.fnId) {
+      // A nested function/lambda body is opaque — do not descend.
+      return;
+    }
+
+    let childScope = scope;
+    if (SCOPE_TYPES.has(t)) childScope = this.openScope(node);
+
+    switch (t) {
+      case 'declaration':
+        this.declareDeclarators(node, childScope);
+        break;
+      case 'for_range_loop': {
+        // `for (int x : xs)` — the declarator binds in the loop scope.
+        const decl = node.childForFieldName('declarator');
+        const name = this.declaratorName(decl ?? null);
+        if (name) this.declare(name, 'var', childScope);
+        break;
+      }
+      case 'catch_clause': {
+        const params = node.childForFieldName('parameters');
+        if (params) {
+          for (let i = 0; i < params.namedChildCount; i++) {
+            const p = params.namedChild(i);
+            if (p?.type !== 'parameter_declaration') continue;
+            const name = this.declaratorName(p.childForFieldName('declarator') ?? null);
+            if (name) this.declare(name, 'catch', childScope);
+          }
+        }
+        break;
+      }
+      default:
+        break;
+    }
+
+    for (let i = 0; i < node.namedChildCount; i++) {
+      const c = node.namedChild(i);
+      if (c) this.prescan(c, childScope);
+    }
+  }
+
+  /**
+   * The `structured_binding_declarator` a declarator binds (C++17 `auto [a,b]`,
+   * or `auto& [a,b]` whose binding sits under a `reference_declarator`), or
+   * undefined. C has no structured bindings, so this is inert for C.
+   */
+  private structuredBinding(declarator: SyntaxNode | null | undefined): SyntaxNode | undefined {
+    let cur = declarator ?? undefined;
+    let hops = 4;
+    while (cur && hops-- > 0) {
+      if (cur.type === 'structured_binding_declarator') return cur;
+      if (cur.type !== 'reference_declarator' && cur.type !== 'pointer_declarator') break;
+      cur = cur.namedChildren.find(
+        (c) =>
+          c.type === 'structured_binding_declarator' ||
+          c.type === 'reference_declarator' ||
+          c.type === 'pointer_declarator',
+      );
+    }
+    return undefined;
+  }
+
+  /** The identifier leaves a `structured_binding_declarator` binds (`[a, b]`). */
+  private structuredBindingNames(sbd: SyntaxNode): SyntaxNode[] {
+    return sbd.namedChildren.filter((c) => c.type === 'identifier');
+  }
+
+  private declareDeclarators(declNode: SyntaxNode, scope: Scope): void {
+    for (let i = 0; i < declNode.namedChildCount; i++) {
+      const d = declNode.namedChild(i);
+      if (!d) continue;
+      if (d.type === 'init_declarator') {
+        const declarator = d.childForFieldName('declarator');
+        const sbd = this.structuredBinding(declarator);
+        if (sbd) {
+          // `auto [a, b] = e;` — every identifier binds a scalar local.
+          for (const id of this.structuredBindingNames(sbd)) this.declare(id, 'var', scope);
+        } else {
+          const name = this.declaratorName(declarator ?? null);
+          if (name) this.declare(name, 'var', scope);
+        }
+      } else if (
+        d.type === 'identifier' ||
+        d.type === 'pointer_declarator' ||
+        d.type === 'array_declarator' ||
+        d.type === 'reference_declarator'
+      ) {
+        // Uninitialized local (`int x;`) — declare the BINDING (so a later
+        // assignment resolves to a real, non-synthetic binding) but the
+        // declaration itself produces no def (handled in phase 2).
+        const name = this.declaratorName(d);
+        if (name) this.declare(name, 'var', scope);
+      }
+    }
+  }
+
+  // ── phase 2: per-statement fact extraction ───────────────────────────────
+
+  /** Def/use facts for one statement (or construct-header expression) node. */
+  facts(node: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(node.startPosition.row + 1);
+    this.walkValue(node, acc);
+    return acc.finish();
+  }
+
+  /** Facts for an expression whose WHOLE evaluation is conditional (case tests). */
+  factsConditional(node: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(node.startPosition.row + 1);
+    this.conditional(() => this.walkValue(node, acc));
+    return acc.finish();
+  }
+
+  /** Facts for a `for (decl : right)` range head: decl binds, right is used. */
+  forRangeHeadFacts(stmt: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(stmt.startPosition.row + 1);
+    const decl = stmt.childForFieldName('declarator');
+    const right = stmt.childForFieldName('right');
+    const name = this.declaratorName(decl ?? null);
+    if (name) this.def(name, acc);
+    if (right) this.walkValue(right, acc);
+    return acc.finish();
+  }
+
+  /** ENTRY-block facts for the function's parameters (defs only). */
+  paramFacts(): StatementFacts | undefined {
+    const declarator = this.fnNode.childForFieldName('declarator');
+    const fnDeclarator = this.findFunctionDeclarator(declarator);
+    const params = fnDeclarator?.childForFieldName('parameters');
+    if (!params) return undefined;
+    const acc = new FactAccumulator(this.fnNode.startPosition.row + 1);
+    for (let i = 0; i < params.namedChildCount; i++) {
+      const p = params.namedChild(i);
+      if (p?.type !== 'parameter_declaration') continue;
+      const name = this.declaratorName(p.childForFieldName('declarator') ?? null);
+      if (name) this.def(name, acc);
+    }
+    return acc.defCount() ? acc.finish() : undefined;
+  }
+
+  /** Def fact for a `catch (T& e)` parameter — prepend to the handler entry block. */
+  catchParamFacts(catchClause: SyntaxNode): StatementFacts | undefined {
+    const params = catchClause.childForFieldName('parameters');
+    if (!params) return undefined;
+    const acc = new FactAccumulator(catchClause.startPosition.row + 1);
+    for (let i = 0; i < params.namedChildCount; i++) {
+      const p = params.namedChild(i);
+      if (p?.type !== 'parameter_declaration') continue;
+      const name = this.declaratorName(p.childForFieldName('declarator') ?? null);
+      if (name) this.def(name, acc);
+    }
+    return acc.defCount() ? acc.finish() : undefined;
+  }
+
+  /** Strip parenthesized wrappers around an lvalue (`(x) = 1`). */
+  private unwrapLvalue(node: SyntaxNode): SyntaxNode {
+    let n = node;
+    let hops = 8;
+    while (n.type === 'parenthesized_expression' && hops-- > 0) {
+      const inner = n.namedChild(0);
+      if (!inner) break;
+      n = inner;
+    }
+    return n;
+  }
+
+  /** Value-position walk: collect uses; route def positions to the lvalue handler. */
+  private walkValue(node: SyntaxNode, acc: FactAccumulator): void {
+    const t = node.type;
+    if (TYPE_CONTEXT_TYPES.has(t)) return;
+    if (NESTED_FUNCTION_TYPES.has(t) && node.id !== this.fnId) {
+      // Opaque nested function / lambda — captured reads/writes are invisible.
+      return;
+    }
+
+    switch (t) {
+      case 'identifier':
+      case 'field_identifier':
+        this.use(node, acc);
+        return;
+      case 'declaration':
+        for (let i = 0; i < node.namedChildCount; i++) {
+          const d = node.namedChild(i);
+          if (d?.type !== 'init_declarator') continue;
+          const declarator = d.childForFieldName('declarator');
+          const value = d.childForFieldName('value');
+          const sbd = this.structuredBinding(declarator);
+          if (sbd && value) {
+            // `auto [a, b] = e;` — each identifier is a scalar def; the result
+            // of `e` flows into all of them (resultDefs covers the whole list).
+            const snap = acc.defSnapshot();
+            for (const id of this.structuredBindingNames(sbd)) this.def(id, acc);
+            this.registerResultDefs(value, acc.defsSince(snap));
+            this.walkValue(value, acc);
+            continue;
+          }
+          const name = declarator ? this.declaratorName(declarator) : undefined;
+          // Only an INITIALIZED declarator writes (`int x = e;`). A bare
+          // `int x;` is not a def (it writes nothing at runtime), matching the
+          // TS bare-`var` rule. Pointer/array/member declarators are not scalar
+          // defs either — their inner identifiers stay uses.
+          if (name && value && declarator?.type === 'identifier') {
+            const snap = acc.defSnapshot();
+            this.def(name, acc);
+            this.registerResultDefs(value, acc.defsSince(snap));
+          } else if (declarator && declarator.type !== 'identifier') {
+            this.walkValue(declarator, acc);
+          }
+          if (value) this.walkValue(value, acc);
+        }
+        return;
+      case 'assignment_expression': {
+        const left = node.childForFieldName('left');
+        const right = node.childForFieldName('right');
+        const op = node.childForFieldName('operator')?.text ?? '=';
+        if (left) {
+          const lv = this.unwrapLvalue(left);
+          if (lv.type === 'identifier') {
+            const snap = acc.defSnapshot();
+            this.def(lv, acc);
+            if (op !== '=') this.use(lv, acc); // compound assign reads too
+            // A plain `x = f(a)` attaches `resultDefs: [x]` to f's site; a
+            // compound `x += f(a)` does not (the prior value flows in too).
+            if (op === '=' && right) this.registerResultDefs(right, acc.defsSince(snap));
+          } else {
+            this.walkValue(lv, acc); // member/pointer/subscript target — uses only
+          }
+        }
+        if (right) this.walkValue(right, acc);
+        return;
+      }
+      case 'update_expression': {
+        const rawArg = node.childForFieldName('argument');
+        const arg = rawArg ? this.unwrapLvalue(rawArg) : null;
+        if (arg?.type === 'identifier') {
+          this.def(arg, acc);
+          this.use(arg, acc);
+        } else if (arg) {
+          this.walkValue(arg, acc);
+        }
+        return;
+      }
+      case 'binary_expression': {
+        const left = node.childForFieldName('left');
+        const right = node.childForFieldName('right');
+        const op = node.childForFieldName('operator')?.text ?? '';
+        if (left) this.walkValue(left, acc);
+        if (right) {
+          if (op === '&&' || op === '||') this.conditional(() => this.walkValue(right, acc));
+          else this.walkValue(right, acc);
+        }
+        return;
+      }
+      case 'conditional_expression': {
+        const cond = node.childForFieldName('condition');
+        const cons = node.childForFieldName('consequence');
+        const alt = node.childForFieldName('alternative');
+        if (cond) this.walkValue(cond, acc);
+        if (cons) this.conditional(() => this.walkValue(cons, acc));
+        if (alt) this.conditional(() => this.walkValue(alt, acc));
+        return;
+      }
+      case 'call_expression':
+        // #2195 U6: explicit case (previously default-descended) — same uses,
+        // plus a taint-site record. Defs/uses stay byte-identical.
+        this.visitCall(node, acc, 'call');
+        return;
+      case 'new_expression':
+        // C++ `new Foo(x)` — constructor call site (`type` field is the callee).
+        this.visitCall(node, acc, 'new');
+        return;
+      case 'field_expression': {
+        // `a.b` / `a->b` — value read of the chain root only; the field name is
+        // not a scalar binding. Mirrors the TS member-read use semantics, plus a
+        // member-read site for the innermost identifier-rooted access.
+        this.walkChain(node, acc, false);
+        return;
+      }
+      default:
+        for (let i = 0; i < node.namedChildCount; i++) {
+          const c = node.namedChild(i);
+          if (c && !TYPE_CONTEXT_TYPES.has(c.type)) this.walkValue(c, acc);
+        }
+    }
+  }
+
+  // ── taint-site harvest (#2195 U6) ────────────────────────────────────────
+
+  /**
+   * When `value`'s root (after stripping parens) is a call/new node, remember
+   * that its site should carry `resultDefs: defs` — consumed by
+   * {@link visitCall} once the value walk reaches the node.
+   */
+  private registerResultDefs(value: SyntaxNode, defs: readonly number[]): void {
+    if (defs.length === 0) return;
+    const root = this.unwrapLvalue(value);
+    if (root.type === 'call_expression' || root.type === 'new_expression') {
+      this.resultDefTargets.set(root.id, [...defs]);
+    }
+  }
+
+  /**
+   * Explicit call/new handler: records a call site (callee path, receiver,
+   * per-arg occurrence entries, result defs) while reproducing EXACTLY the uses
+   * the old default descent recorded — callee chain root + arguments. `new`
+   * sites read the `type` field as the callee; `call` sites the `function`
+   * field.
+   */
+  private visitCall(node: SyntaxNode, acc: FactAccumulator, kind: 'call' | 'new'): void {
+    const calleeNode = node.childForFieldName(kind === 'new' ? 'type' : 'function');
+    const argsNode = node.childForFieldName('arguments');
+    const siteIdx = acc.openCallSite(kind);
+    acc.pushFrame(siteIdx);
+    let calleePath: string | undefined;
+    if (calleeNode) {
+      const callee = this.unwrapLvalue(calleeNode);
+      if (callee.type === 'identifier' || callee.type === 'type_identifier') {
+        // The callee NAME is a statement-level use but NOT a value occurrence in
+        // any enclosing argument (`exec(escape(x))` must not put `escape` into
+        // exec's arg 0). A `new Foo(...)` type identifier is a type, not a
+        // scalar binding — record neither a use nor an occurrence for it.
+        if (callee.type === 'identifier') acc.addUseWithoutOccurrence(this.resolve(callee));
+        calleePath = callee.text;
+      } else if (callee.type === 'field_expression') {
+        // skipFinalRead: the final access IS the callee, carried by the dotted
+        // path — recording it as a member read would double-count.
+        const chain = this.walkChain(callee, acc, true);
+        calleePath = chain.path;
+        if (chain.rootIdx !== undefined) acc.setSiteReceiver(siteIdx, chain.rootIdx);
+      } else if (callee.type === 'qualified_identifier') {
+        // `ns::g(...)` — a static dotted path, no scalar receiver binding.
+        calleePath = this.qualifiedPath(callee);
+        this.walkValue(callee, acc);
+      } else {
+        // Call-rooted chains, function-pointer expressions — the walk still
+        // records uses and nested sites.
+        this.walkValue(callee, acc);
+      }
+      if (calleePath !== undefined) acc.setSiteCallee(siteIdx, calleePath);
+    }
+    const resultDefs = this.resultDefTargets.get(node.id);
+    if (resultDefs !== undefined) acc.setSiteResultDefs(siteIdx, resultDefs);
+    if (argsNode) {
+      let pos = 0;
+      for (let i = 0; i < argsNode.namedChildCount; i++) {
+        const arg = argsNode.namedChild(i);
+        if (!arg || arg.type === 'comment') continue;
+        acc.setFrameArg(pos);
+        this.walkValue(arg, acc);
+        pos++;
+      }
+    }
+    acc.popFrame();
+  }
+
+  /**
+   * Member chain walk shared by value position and callee position. Use-
+   * recording is identical to the old default descent (chain-root identifier
+   * once). Member-read sites: at most ONE per chain — the INNERMOST access —
+   * and only when the chain root is an identifier; `skipFinalRead` suppresses it
+   * when that access is the callee (carried by the dotted path instead).
+   */
+  private walkChain(
+    node: SyntaxNode,
+    acc: FactAccumulator,
+    skipFinalRead: boolean,
+  ): { path?: string; rootIdx?: number } {
+    // Collect field accesses outer→inner (unshift), then resolve the root.
+    const accesses: string[] = [];
+    let cur: SyntaxNode = this.unwrapLvalue(node);
+    for (;;) {
+      if (cur.type === 'field_expression') {
+        const field = cur.childForFieldName('field');
+        accesses.unshift(field?.text ?? '');
+        const obj = cur.childForFieldName('argument');
+        if (!obj) break;
+        cur = this.unwrapLvalue(obj);
+      } else {
+        break;
+      }
+    }
+    let rootIdx: number | undefined;
+    let rootSegment: string | undefined;
+    if (cur.type === 'identifier' || cur.type === 'field_identifier') {
+      rootIdx = this.resolve(cur);
+      acc.addUse(rootIdx);
+      rootSegment = cur.text;
+    } else {
+      this.walkValue(cur, acc); // call-rooted etc. — uses + nested sites
+    }
+    const innermost = accesses[0];
+    if (rootIdx !== undefined && innermost && !(skipFinalRead && accesses.length === 1)) {
+      acc.addMemberRead(rootIdx, innermost);
+    }
+    const path =
+      rootSegment !== undefined && accesses.every((a) => a !== '')
+        ? [rootSegment, ...accesses].join('.')
+        : undefined;
+    return { path, rootIdx };
+  }
+
+  /** Dotted path of a `ns::a::b` qualified_identifier (`::` folded to `.`). */
+  private qualifiedPath(node: SyntaxNode): string | undefined {
+    const segs: string[] = [];
+    let cur: SyntaxNode | null = node;
+    let hops = 16;
+    while (cur && hops-- > 0) {
+      if (cur.type === 'qualified_identifier') {
+        const scope = cur.childForFieldName('scope');
+        const name = cur.childForFieldName('name');
+        if (scope) segs.push(scope.text);
+        cur = name ?? null;
+      } else {
+        segs.push(cur.text);
+        break;
+      }
+    }
+    return segs.length ? segs.join('.') : undefined;
+  }
+}
+
+/**
+ * Ordered, deduplicating def/use + call-site collector for one statement record.
+ * The shared {@link CallSiteFactAccumulator} carries the def/use machinery the
+ * old local class had, plus the taint-site harvest (#2195 U6).
+ */
+const FactAccumulator = CallSiteFactAccumulator;
diff --git a/gitnexus/src/core/ingestion/cfg/visitors/c-cpp.ts b/gitnexus/src/core/ingestion/cfg/visitors/c-cpp.ts
new file mode 100644
index 000000000..9dab1b91c
--- /dev/null
+++ b/gitnexus/src/core/ingestion/cfg/visitors/c-cpp.ts
@@ -0,0 +1,795 @@
+/**
+ * C / C++ CfgVisitor (#2195 U2, plan KTD1).
+ *
+ * Walks a C or C++ function's tree-sitter AST and drives the language-agnostic
+ * {@link CfgBuilder} to produce a serializable {@link FunctionCfg}, plus a
+ * def/use harvest ({@link CCppHarvester}) for the reaching-defs / CDG solvers.
+ *
+ * SHARED CORE, TWO FACTORIES. A grammar-introspection probe (mandatory pre-step,
+ * KTD1) confirmed every control-flow node type and field this visitor uses is
+ * IDENTICAL between tree-sitter-c and tree-sitter-cpp — `if_statement`,
+ * `for_statement`, `while_statement`, `do_statement`, `switch_statement` /
+ * `case_statement`, `return`/`break`/`continue`/`goto_statement` /
+ * `labeled_statement`, `compound_statement`, and the `condition`/`consequence`/
+ * `alternative`/`initializer`/`update`/`body`/`label`/`value` fields. So the C
+ * walk ({@link CCfgWalk}) is grammar-shared, and C++ EXTENDS it ({@link
+ * CppCfgWalk}) with exception flow (`try_statement` / `catch_clause` /
+ * `throw_statement`) and `for_range_loop` — node types that simply never occur
+ * in a C parse, so there is no `if (lang === …)` branching (AGENTS.md
+ * no-language-naming rule). The two factories differ only in which walk class
+ * and function-node set they install.
+ *
+ * Edge-kind contract (matches the TS visitor — RD/CDG consume these):
+ *  - if/else → `cond-true` / `cond-false`
+ *  - loops (for / while / do-while / for-range) → `cond-true` / `loop-back` /
+ *    `cond-false`
+ *  - switch → `switch-case` / `fallthrough` (C-style: a case body that does not
+ *    `break` falls into the next case)
+ *  - try/catch (C++) → `throw` (every protected-region block → the handler)
+ *  - return / throw / break / continue → the matching terminator kind
+ *  - straight-line → `seq`
+ *
+ * Classic hazards, handled explicitly:
+ *  - loops allocate a dedicated loop-exit block so `break` has a target before
+ *    the loop's successor is known; `continue` targets the header/increment.
+ *  - `for (;;) {}` / `while (1) {}` still emit the structural `header → loopExit`
+ *    `cond-false` escape edge so EXIT stays reverse-reachable from every block —
+ *    the post-dominator / CDG pass is unsound otherwise (it silently emits zero
+ *    CDG for the function).
+ *  - C `goto`/`labeled_statement`: labels resolve within the function (forward
+ *    AND backward); an unresolved `goto` (label not in this function) routes to
+ *    EXIT and logs via the builder warn path, preserving single-exit.
+ *  - C++ `try`/`catch`: conservative exceptional flow — EVERY block in the
+ *    protected region edges to the handler (an exception may fire mid-block),
+ *    matching the TS `visitTry` over-approximation. A `throw` with no enclosing
+ *    try routes to EXIT.
+ *
+ * Known limitations:
+ *  - C++ RAII: a destructor runs implicitly at scope exit, but tree-sitter does
+ *    NOT represent that call in the AST. This visitor therefore does NOT model
+ *    destructor-at-scope-exit control/data flow — it is a documented gap, not
+ *    faked. (C++ has no `finally`; `try`/`catch` is the only modeled exception
+ *    construct, so the TS finalizer-frame machinery is unused here.)
+ *  - A `goto` whose label is undefined in the function keeps the conservative
+ *    route-to-EXIT fallback (single-exit preserved; the continuation path is
+ *    approximate). `setjmp`/`longjmp` non-local control is not modeled.
+ *  - Computed `goto` (`goto *ptr;`, a GNU extension) has no static label target
+ *    and routes to EXIT like an unresolved label.
+ *  - Def/use harvest scope: see `c-cpp-harvest.ts` — member/pointer/array writes
+ *    are not scalar defs; C++ lambda bodies are opaque in both directions.
+ *
+ * Returns `undefined` (never throws) for an AST shape it cannot model, so a
+ * malformed function never drops the whole file's CFG group (R4).
+ */
+import type { SyntaxNode } from '../../utils/ast-helpers.js';
+import { CfgBuilder } from '../cfg-builder.js';
+import type { TraversalResult } from '../traversal-result.js';
+import type { CfgVisitor, FunctionCfg } from '../types.js';
+import { CCppHarvester } from './c-cpp-harvest.js';
+
+/** C function node — only `function_definition` owns a CFG-bearing body. */
+const C_FUNCTION_TYPES = new Set(['function_definition']);
+/** C++ adds the lambda as a CFG-bearing function. */
+const CPP_FUNCTION_TYPES = new Set(['function_definition', 'lambda_expression']);
+
+/** Statement node types that break a basic block (everything else coalesces). */
+const C_CONTROL_FLOW_TYPES = new Set([
+  'if_statement',
+  'while_statement',
+  'do_statement',
+  'for_statement',
+  'switch_statement',
+  'return_statement',
+  'break_statement',
+  'continue_statement',
+  'goto_statement',
+  'labeled_statement',
+  'compound_statement',
+]);
+
+/** C++ control-flow node types (C set ∪ exceptions ∪ range-for). */
+const CPP_CONTROL_FLOW_TYPES = new Set([
+  ...C_CONTROL_FLOW_TYPES,
+  'for_range_loop',
+  'try_statement',
+  'throw_statement',
+  'co_return_statement',
+]);
+
+const LOOP_OR_SWITCH_TYPES = new Set([
+  'while_statement',
+  'do_statement',
+  'for_statement',
+  'for_range_loop',
+  'switch_statement',
+]);
+
+const startLineOf = (n: SyntaxNode): number => n.startPosition.row + 1;
+const endLineOf = (n: SyntaxNode): number => n.endPosition.row + 1;
+
+/** A statement sequence that produced no blocks (empty body) is "transparent". */
+type SeqResult = TraversalResult | null;
+
+/** A `break`/`continue` jump-target frame (loop or switch). */
+interface JumpFrame {
+  readonly kind: 'loop' | 'switch';
+  /** Where a `break` jumps to (loop exit / switch exit). */
+  readonly breakTo: number;
+  /** Where a `continue` jumps to (loop header / increment). -1 for a switch. */
+  readonly continueTo: number;
+}
+
+/**
+ * Per-function C walk state. One instance per function so the jump-target stack,
+ * exception-handler stack, and label tables are scoped to that function.
+ *
+ * Designed to be EXTENDED by the C++ walk: the dispatch table is open via the
+ * protected {@link visitStmt} override hook, so C++ adds its node types without
+ * any language conditional in the C core.
+ */
+class CCfgWalk {
+  protected readonly jumps: JumpFrame[] = [];
+  /** Stack of exception-handler entry blocks (catch) a `throw` jumps to. */
+  protected readonly handlers: number[] = [];
+  /** label name → its `labeled_statement` body's entry block (resolved on demand). */
+  protected readonly labelBlocks = new Map<string, number>();
+  /** Pending gotos to a label not yet seen: label → list of source blocks. */
+  protected readonly pendingGotos = new Map<string, number[]>();
+  /** Set of node types that break a block, used by {@link visitSeq}. */
+  protected readonly controlFlowTypes: ReadonlySet<string>;
+
+  constructor(
+    protected readonly builder: CfgBuilder,
+    protected readonly harvest: CCppHarvester,
+    controlFlowTypes: ReadonlySet<string>,
+  ) {
+    this.controlFlowTypes = controlFlowTypes;
+  }
+
+  /** Statements of a block node, ignoring comments. */
+  protected statementsOf(block: SyntaxNode): SyntaxNode[] {
+    return block.namedChildren.filter((c) => c.type !== 'comment');
+  }
+
+  /** The `body` block of a node (field, or the first compound_statement child). */
+  protected bodyBlockOf(node: SyntaxNode): SyntaxNode | undefined {
+    return (
+      node.childForFieldName('body') ??
+      node.namedChildren.find((c) => c.type === 'compound_statement')
+    );
+  }
+
+  /** Visit a body that may be a `compound_statement` or a single statement. */
+  protected visitBody(node: SyntaxNode | undefined | null): SeqResult {
+    return this.builder.withNesting(() => {
+      if (!node) return null;
+      if (node.type === 'compound_statement') return this.visitSeq(this.statementsOf(node));
+      return this.visitStmt(node);
+    });
+  }
+
+  /** Wire a sequence of statements, coalescing straight-line runs into blocks. */
+  visitSeq(stmts: SyntaxNode[]): SeqResult {
+    return this.builder.withNesting(() => {
+      let entry: number | undefined;
+      let dangling: number[] = [];
+      let openSimple: number | undefined;
+
+      for (const stmt of stmts) {
+        if (this.controlFlowTypes.has(stmt.type)) {
+          openSimple = undefined; // close any open straight-line block
+          const res = this.visitStmt(stmt);
+          if (res === null) continue; // transparent (empty nested block)
+          if (entry === undefined) entry = res.entry;
+          else this.builder.connect(dangling, res.entry, 'seq');
+          dangling = [...res.exits];
+        } else {
+          if (openSimple === undefined) {
+            const idx = this.builder.newBlock(
+              startLineOf(stmt),
+              endLineOf(stmt),
+              stmt.text,
+              'normal',
+              this.harvest.facts(stmt),
+            );
+            if (entry === undefined) entry = idx;
+            else this.builder.connect(dangling, idx, 'seq');
+            openSimple = idx;
+            dangling = [idx];
+          } else {
+            this.builder.extendBlock(
+              openSimple,
+              endLineOf(stmt),
+              stmt.text,
+              this.harvest.facts(stmt),
+            );
+          }
+        }
+      }
+
+      if (entry === undefined) return null;
+      return { entry, exits: dangling };
+    });
+  }
+
+  /** Dispatch one statement to its handler. Non-null except for empty blocks. */
+  visitStmt(stmt: SyntaxNode): SeqResult {
+    switch (stmt.type) {
+      case 'if_statement':
+        return this.visitIf(stmt);
+      case 'while_statement':
+        return this.visitWhile(stmt);
+      case 'do_statement':
+        return this.visitDoWhile(stmt);
+      case 'for_statement':
+        return this.visitFor(stmt);
+      case 'switch_statement':
+        return this.visitSwitch(stmt);
+      case 'return_statement':
+        return this.visitReturn(stmt);
+      case 'break_statement':
+        return this.visitBreak(stmt);
+      case 'continue_statement':
+        return this.visitContinue(stmt);
+      case 'goto_statement':
+        return this.visitGoto(stmt);
+      case 'labeled_statement':
+        return this.visitLabeled(stmt);
+      case 'compound_statement':
+        return this.visitSeq(this.statementsOf(stmt));
+      default:
+        return this.visitExtra(stmt) ?? this.visitSimple(stmt);
+    }
+  }
+
+  /**
+   * Extension hook for node types the C core does not handle (C++ try/catch/
+   * throw/for-range). Returns `undefined` to fall through to {@link visitSimple}.
+   * The C core has none, so this is a no-op here.
+   */
+  protected visitExtra(_stmt: SyntaxNode): SeqResult | undefined {
+    return undefined;
+  }
+
+  protected visitSimple(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    return { entry: idx, exits: [idx] };
+  }
+
+  protected visitReturn(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    this.builder.edge(idx, this.builder.exitIndex, 'return');
+    return { entry: idx, exits: [] };
+  }
+
+  protected visitBreak(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(startLineOf(stmt), endLineOf(stmt), stmt.text);
+    const target = this.nearestBreakTarget();
+    this.builder.edge(idx, target ?? this.builder.exitIndex, 'break');
+    return { entry: idx, exits: [] };
+  }
+
+  protected visitContinue(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(startLineOf(stmt), endLineOf(stmt), stmt.text);
+    const target = this.nearestContinueTarget();
+    this.builder.edge(idx, target ?? this.builder.exitIndex, 'continue');
+    return { entry: idx, exits: [] };
+  }
+
+  /** Nearest enclosing loop/switch `break` target, or undefined (→ EXIT). */
+  private nearestBreakTarget(): number | undefined {
+    return this.jumps.length ? this.jumps[this.jumps.length - 1].breakTo : undefined;
+  }
+
+  /** Nearest enclosing loop `continue` target (switches don't catch continue). */
+  private nearestContinueTarget(): number | undefined {
+    for (let i = this.jumps.length - 1; i >= 0; i--) {
+      if (this.jumps[i].kind === 'loop') return this.jumps[i].continueTo;
+    }
+    return undefined;
+  }
+
+  /** `goto label;` — route to the label block if known, else defer / EXIT. */
+  protected visitGoto(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(startLineOf(stmt), endLineOf(stmt), stmt.text);
+    const label = this.labelOf(stmt);
+    if (label === undefined) {
+      // Computed goto (`goto *p;`) or malformed — route to EXIT (single-exit).
+      this.builder.edge(idx, this.builder.exitIndex, 'seq');
+      return { entry: idx, exits: [] };
+    }
+    const target = this.labelBlocks.get(label);
+    if (target !== undefined) {
+      this.builder.edge(idx, target, 'seq'); // backward goto: label already built
+    } else {
+      // Forward goto — wire once the label is created (or to EXIT at finish()).
+      const list = this.pendingGotos.get(label);
+      if (list) list.push(idx);
+      else this.pendingGotos.set(label, [idx]);
+    }
+    return { entry: idx, exits: [] };
+  }
+
+  protected visitLabeled(stmt: SyntaxNode): SeqResult {
+    const label = this.labelOf(stmt);
+    // The labeled statement's body is the trailing named child (no `body` field
+    // on labeled_statement in C/C++).
+    const body =
+      stmt.namedChildren.find((c) => c.type !== 'statement_identifier' && c.type !== 'comment') ??
+      null;
+    const res = this.visitBody(body);
+    if (label !== undefined) {
+      const entry = res?.entry ?? this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+      this.labelBlocks.set(label, entry);
+      // Resolve any forward gotos that were waiting on this label.
+      const pending = this.pendingGotos.get(label);
+      if (pending) {
+        for (const from of pending) this.builder.edge(from, entry, 'seq');
+        this.pendingGotos.delete(label);
+      }
+      if (!res) return { entry, exits: [entry] };
+    }
+    return res;
+  }
+
+  protected visitIf(stmt: SyntaxNode): TraversalResult {
+    const cond = stmt.childForFieldName('condition') ?? stmt;
+    const condBlock = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(cond),
+      cond.text,
+      'normal',
+      this.harvest.facts(cond),
+    );
+    const exits: number[] = [];
+
+    const thenRes = this.visitBody(stmt.childForFieldName('consequence'));
+    if (thenRes) {
+      this.builder.edge(condBlock, thenRes.entry, 'cond-true');
+      exits.push(...thenRes.exits);
+    } else {
+      exits.push(condBlock); // empty then — true path falls through
+    }
+
+    const elseNode = this.elseBodyOf(stmt);
+    if (elseNode) {
+      const elseRes = this.visitBody(elseNode);
+      if (elseRes) {
+        this.builder.edge(condBlock, elseRes.entry, 'cond-false');
+        exits.push(...elseRes.exits);
+      } else {
+        exits.push(condBlock);
+      }
+    } else {
+      exits.push(condBlock); // no else — false path falls through to the join
+    }
+
+    return { entry: condBlock, exits: [...new Set(exits)] };
+  }
+
+  /** The else body node (unwraps an `else_clause` wrapper if present). */
+  private elseBodyOf(ifStmt: SyntaxNode): SyntaxNode | undefined {
+    const alt = ifStmt.childForFieldName('alternative');
+    if (!alt) return undefined;
+    if (alt.type === 'else_clause') {
+      return alt.childForFieldName('body') ?? alt.namedChildren[0];
+    }
+    return alt; // an `else if` is the nested if_statement directly
+  }
+
+  protected visitWhile(stmt: SyntaxNode): TraversalResult {
+    const cond = stmt.childForFieldName('condition') ?? stmt;
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(cond),
+      cond.text,
+      'normal',
+      this.harvest.facts(cond),
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.jumps.push({ kind: 'loop', breakTo: loopExit, continueTo: header });
+    const body = this.visitBody(this.bodyBlockOf(stmt));
+    this.jumps.pop();
+
+    if (body) {
+      this.builder.edge(header, body.entry, 'cond-true');
+      this.builder.connect(body.exits, header, 'loop-back');
+    } else {
+      this.builder.edge(header, header, 'loop-back'); // empty body re-tests
+    }
+    // Always emit the structural exit edge — even `while (1)` keeps EXIT
+    // reverse-reachable for the post-dominator / CDG pass.
+    this.builder.edge(header, loopExit, 'cond-false');
+    return { entry: header, exits: [loopExit] };
+  }
+
+  protected visitDoWhile(stmt: SyntaxNode): TraversalResult {
+    const cond = stmt.childForFieldName('condition') ?? stmt;
+    const condBlock = this.builder.newBlock(
+      startLineOf(cond),
+      endLineOf(cond),
+      cond.text,
+      'normal',
+      this.harvest.facts(cond),
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.jumps.push({ kind: 'loop', breakTo: loopExit, continueTo: condBlock });
+    const body = this.visitBody(this.bodyBlockOf(stmt));
+    this.jumps.pop();
+
+    const backTarget = body ? body.entry : condBlock;
+    if (body) this.builder.connect(body.exits, condBlock, 'seq');
+    this.builder.edge(condBlock, backTarget, 'loop-back'); // cond true → run body again
+    this.builder.edge(condBlock, loopExit, 'cond-false');
+    return { entry: backTarget, exits: [loopExit] };
+  }
+
+  protected visitFor(stmt: SyntaxNode): TraversalResult {
+    const init = stmt.childForFieldName('initializer');
+    const cond = stmt.childForFieldName('condition');
+    const incr = stmt.childForFieldName('update');
+
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      cond ? endLineOf(cond) : startLineOf(stmt),
+      cond ? cond.text : 'for(;;)',
+      'normal',
+      cond ? this.harvest.facts(cond) : undefined,
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    let incrBlock = header;
+    if (incr) {
+      incrBlock = this.builder.newBlock(
+        startLineOf(incr),
+        endLineOf(incr),
+        incr.text,
+        'normal',
+        this.harvest.facts(incr),
+      );
+      this.builder.edge(incrBlock, header, 'loop-back');
+    }
+
+    this.jumps.push({ kind: 'loop', breakTo: loopExit, continueTo: incrBlock });
+    const body = this.visitBody(this.bodyBlockOf(stmt));
+    this.jumps.pop();
+
+    if (body) {
+      this.builder.edge(header, body.entry, 'cond-true');
+      this.builder.connect(body.exits, incrBlock, incr ? 'seq' : 'loop-back');
+    } else {
+      this.builder.edge(header, incrBlock, 'cond-true');
+      if (!incr) this.builder.edge(header, header, 'loop-back');
+    }
+    // Structural exit edge — `for (;;) {}` (no condition) still keeps EXIT
+    // reverse-reachable so CDG is not silently skipped for the function.
+    this.builder.edge(header, loopExit, 'cond-false');
+
+    let entry = header;
+    if (init) {
+      const initBlock = this.builder.newBlock(
+        startLineOf(init),
+        endLineOf(init),
+        init.text,
+        'normal',
+        this.harvest.facts(init),
+      );
+      this.builder.edge(initBlock, header, 'seq');
+      entry = initBlock;
+    }
+    return { entry, exits: [loopExit] };
+  }
+
+  protected visitSwitch(stmt: SyntaxNode): TraversalResult {
+    const value = stmt.childForFieldName('condition') ?? stmt;
+    const dispatch = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(value),
+      value.text,
+      'normal',
+      this.harvest.facts(value),
+    );
+    const switchExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.jumps.push({ kind: 'switch', breakTo: switchExit, continueTo: -1 });
+    const body = stmt.childForFieldName('body');
+    // C/C++ uses ONE `case_statement` node for both `case X:` and `default:`;
+    // a default has no `value` field.
+    const cases = body ? body.namedChildren.filter((c) => c.type === 'case_statement') : [];
+
+    // `case X:` test expressions live in no block — harvest their uses onto the
+    // dispatch block as may-defs/uses (sound over-approx of in-order evaluation).
+    for (const c of cases) {
+      const caseValue = c.childForFieldName('value');
+      if (caseValue) this.builder.attachFacts(dispatch, this.harvest.factsConditional(caseValue));
+    }
+
+    const caseResults = cases.map((c) => this.visitSeq(this.caseStatements(c)));
+    const hasDefault = cases.some((c) => !c.childForFieldName('value'));
+
+    const entryOf: number[] = new Array(cases.length);
+    let after = switchExit;
+    for (let i = cases.length - 1; i >= 0; i--) {
+      entryOf[i] = caseResults[i]?.entry ?? after;
+      after = entryOf[i];
+    }
+
+    for (let i = 0; i < cases.length; i++) {
+      this.builder.edge(dispatch, entryOf[i], 'switch-case');
+    }
+    if (!hasDefault) this.builder.edge(dispatch, switchExit, 'switch-case'); // no-match path
+
+    for (let i = 0; i < cases.length; i++) {
+      const res = caseResults[i];
+      if (!res) continue;
+      const fallTarget = i + 1 < cases.length ? entryOf[i + 1] : switchExit;
+      this.builder.connect(res.exits, fallTarget, 'fallthrough');
+    }
+
+    this.jumps.pop();
+    return { entry: dispatch, exits: [switchExit] };
+  }
+
+  /** A case's body statements (everything but the `value` test and comments). */
+  private caseStatements(caseNode: SyntaxNode): SyntaxNode[] {
+    const value = caseNode.childForFieldName('value');
+    return caseNode.namedChildren.filter((c) => c.id !== value?.id && c.type !== 'comment');
+  }
+
+  /** Nearest enclosing exception handler, or the function EXIT. */
+  protected currentHandler(): number {
+    return this.handlers.length ? this.handlers[this.handlers.length - 1] : this.builder.exitIndex;
+  }
+
+  private labelOf(stmt: SyntaxNode): string | undefined {
+    const id =
+      stmt.childForFieldName('label') ??
+      stmt.namedChildren.find((c) => c.type === 'statement_identifier');
+    return id?.text;
+  }
+
+  /**
+   * Drain any forward gotos whose label never appeared in the function (a label
+   * defined in a header macro, or malformed source) — route them to EXIT so the
+   * graph stays single-exit. Logs via console.warn (the builder's warn path)
+   * so a dropped jump is never silent (R4). Called once after the body walk.
+   */
+  finishGotos(): void {
+    for (const [label, froms] of this.pendingGotos) {
+      // eslint-disable-next-line no-console
+      console.warn(
+        `[cfg] unresolved goto label "${label}" routed to EXIT (${froms.length} site(s))`,
+      );
+      for (const from of froms) this.builder.edge(from, this.builder.exitIndex, 'seq');
+    }
+    this.pendingGotos.clear();
+  }
+}
+
+/**
+ * C++ walk — extends the C core with exception flow and the range-for loop.
+ * These node types never appear in a C parse, so no language conditional is
+ * needed; the C core dispatches them through {@link visitExtra}.
+ */
+class CppCfgWalk extends CCfgWalk {
+  protected override visitExtra(stmt: SyntaxNode): SeqResult | undefined {
+    switch (stmt.type) {
+      case 'for_range_loop':
+        return this.visitForRange(stmt);
+      case 'try_statement':
+        return this.visitTry(stmt);
+      case 'throw_statement':
+        return this.visitThrow(stmt);
+      case 'co_return_statement':
+        // A coroutine `co_return` terminates the coroutine like an ordinary
+        // return: edge to EXIT, no fallthrough (`co_await`/`co_yield` are plain
+        // expressions that continue, so they need no control-flow handling).
+        return this.visitReturn(stmt);
+      default:
+        return undefined;
+    }
+  }
+
+  private visitThrow(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    this.builder.edge(idx, this.currentHandler(), 'throw');
+    return { entry: idx, exits: [] };
+  }
+
+  private visitForRange(stmt: SyntaxNode): TraversalResult {
+    // Header text is synthesized; facts come from the declarator (def) + the
+    // iterated expression (use) directly.
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      startLineOf(stmt),
+      this.forRangeHeaderText(stmt),
+      'normal',
+      this.harvest.forRangeHeadFacts(stmt),
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.jumps.push({ kind: 'loop', breakTo: loopExit, continueTo: header });
+    const body = this.visitBody(this.bodyBlockOf(stmt));
+    this.jumps.pop();
+
+    if (body) {
+      this.builder.edge(header, body.entry, 'cond-true');
+      this.builder.connect(body.exits, header, 'loop-back');
+    } else {
+      this.builder.edge(header, header, 'loop-back');
+    }
+    this.builder.edge(header, loopExit, 'cond-false');
+    return { entry: header, exits: [loopExit] };
+  }
+
+  private forRangeHeaderText(stmt: SyntaxNode): string {
+    const decl = stmt.childForFieldName('declarator')?.text ?? '';
+    const right = stmt.childForFieldName('right')?.text ?? '';
+    return decl || right ? `for(${decl} : ${right})` : 'for(… : …)';
+  }
+
+  /**
+   * try / catch (C++ has no `finally`). Conservative exceptional flow: every
+   * block created while walking the protected body edges to the (first) catch
+   * handler — an exception may fire mid-block, and a branched body must still
+   * reach the handler from any interior block (matching the TS visitTry
+   * over-approximation). Multiple `catch` clauses: a body throw routes to EVERY
+   * handler (the runtime type match is dynamic), and each handler's normal
+   * completion joins the post-try continuation.
+   */
+  private visitTry(stmt: SyntaxNode): SeqResult {
+    const bodyNode = stmt.childForFieldName('body');
+    const catchClauses: SyntaxNode[] = [];
+    for (let i = 0; i < stmt.namedChildCount; i++) {
+      const c = stmt.namedChild(i);
+      if (c?.type === 'catch_clause') catchClauses.push(c);
+    }
+
+    // Build each catch handler. The handler entry is the catch-param binding
+    // block (a facts-only block) in front of the body, so the exception's
+    // binding happens exactly once on handler entry.
+    const handlerEntries: number[] = [];
+    const handlerExits: number[] = [];
+    for (const clause of catchClauses) {
+      const clauseBody = this.bodyBlockOf(clause);
+      let res: SeqResult = clauseBody ? this.visitSeq(this.statementsOf(clauseBody)) : null;
+      if (res === null) {
+        // Empty catch body still CATCHES — synthesize one block so the
+        // exception lands somewhere and the post-try code stays reachable.
+        const idx = this.builder.newBlock(startLineOf(clause), endLineOf(clause), '');
+        res = { entry: idx, exits: [idx] };
+      }
+      const paramFacts = this.harvest.catchParamFacts(clause);
+      if (paramFacts) {
+        const paramBlock = this.builder.newBlock(
+          startLineOf(clause),
+          startLineOf(clause),
+          '',
+          'normal',
+          paramFacts,
+        );
+        this.builder.edge(paramBlock, res.entry, 'seq');
+        res = { entry: paramBlock, exits: res.exits };
+      }
+      handlerEntries.push(res.entry);
+      handlerExits.push(...res.exits);
+    }
+
+    // The protected body's handler is the FIRST catch (if any), else the outer.
+    const tryHandler = handlerEntries[0] ?? this.currentHandler();
+    const protectedStart = this.builder.blockCount;
+    this.handlers.push(tryHandler);
+    const bodyRes = bodyNode ? this.visitSeq(this.statementsOf(bodyNode)) : null;
+    this.handlers.pop();
+
+    // Conservative exceptional edges: every protected-region block → EVERY handler
+    // entry. The runtime catch that matches a thrown type is not statically known,
+    // so over-approximate to ALL clauses — wiring only the first (tryHandler)
+    // orphaned `catch` clauses 2..N, dropping their control/data flow entirely
+    // (the binding `catch(T2 e)` and the handler body became unreachable). Mirrors
+    // the Swift multi-catch handling.
+    if (catchClauses.length > 0) {
+      for (let b = protectedStart; b < this.builder.blockCount; b++) {
+        for (const handler of handlerEntries) this.builder.edge(b, handler, 'throw');
+      }
+    }
+
+    const exits: number[] = [];
+    if (bodyRes) exits.push(...bodyRes.exits);
+    exits.push(...handlerExits);
+    // No catch clause at all — an exception re-propagates to the outer handler.
+    if (catchClauses.length === 0 && bodyRes) {
+      // (A bare `try {}` with no catch is ill-formed C++, but stay robust.)
+      this.builder.connect(bodyRes.exits, this.currentHandler(), 'throw');
+    }
+
+    const entry = bodyRes?.entry ?? handlerEntries[0];
+    if (entry === undefined) return null;
+    return { entry, exits: [...new Set(exits)] };
+  }
+}
+
+/** Build the CFG for one C/C++ function node, or `undefined` if not modelable. */
+function buildFunctionCfg(
+  fnNode: SyntaxNode,
+  filePath: string,
+  functionTypes: ReadonlySet<string>,
+  controlFlowTypes: ReadonlySet<string>,
+  WalkClass: typeof CCfgWalk,
+): FunctionCfg | undefined {
+  try {
+    if (!functionTypes.has(fnNode.type)) return undefined;
+    const startLine = startLineOf(fnNode);
+    const endLine = endLineOf(fnNode);
+    const startColumn = fnNode.startPosition.column;
+
+    // The body is a compound_statement (field `body`, or first such child).
+    const body =
+      fnNode.childForFieldName('body') ??
+      fnNode.namedChildren.find((c) => c.type === 'compound_statement');
+    if (!body || body.type !== 'compound_statement') return undefined; // declaration / no body
+
+    const builder = new CfgBuilder(filePath, startLine, endLine, startColumn);
+    const harvest = new CCppHarvester(fnNode);
+
+    const paramFacts = harvest.paramFacts();
+    if (paramFacts) builder.attachFacts(builder.entryIndex, paramFacts);
+
+    const walk = new WalkClass(builder, harvest, controlFlowTypes);
+    const res = walk.visitSeq(body.namedChildren.filter((c) => c.type !== 'comment'));
+    walk.finishGotos();
+    if (!res) {
+      builder.edge(builder.entryIndex, builder.exitIndex, 'seq'); // empty body
+      return builder.finish(harvest.bindingTable());
+    }
+    builder.edge(builder.entryIndex, res.entry, 'seq');
+    builder.connect(res.exits, builder.exitIndex, 'seq'); // normal fall-off → EXIT
+    return builder.finish(harvest.bindingTable());
+  } catch (err) {
+    // Never throw out of buildFunctionCfg — a malformed AST shape must skip only
+    // this one function's CFG, never drop the whole file's language group (R4).
+    // eslint-disable-next-line no-console
+    console.warn(`[cfg] C/C++ buildFunctionCfg skipped a function in ${filePath}: ${String(err)}`);
+    return undefined;
+  }
+}
+
+/** The C CFG visitor. */
+export function createCCfgVisitor(): CfgVisitor<SyntaxNode> {
+  return {
+    isFunction: (node) => C_FUNCTION_TYPES.has(node.type),
+    buildFunctionCfg: (fnNode, filePath) =>
+      buildFunctionCfg(fnNode, filePath, C_FUNCTION_TYPES, C_CONTROL_FLOW_TYPES, CCfgWalk),
+  };
+}
+
+/** The C++ CFG visitor (C core + exceptions + range-for + lambdas). */
+export function createCppCfgVisitor(): CfgVisitor<SyntaxNode> {
+  return {
+    isFunction: (node) => CPP_FUNCTION_TYPES.has(node.type),
+    buildFunctionCfg: (fnNode, filePath) =>
+      buildFunctionCfg(fnNode, filePath, CPP_FUNCTION_TYPES, CPP_CONTROL_FLOW_TYPES, CppCfgWalk),
+  };
+}
+
+export { C_FUNCTION_TYPES, CPP_FUNCTION_TYPES };
diff --git a/gitnexus/src/core/ingestion/cfg/visitors/call-site-harvest.ts b/gitnexus/src/core/ingestion/cfg/visitors/call-site-harvest.ts
new file mode 100644
index 000000000..ed85bc2dc
--- /dev/null
+++ b/gitnexus/src/core/ingestion/cfg/visitors/call-site-harvest.ts
@@ -0,0 +1,374 @@
+/**
+ * Shared call-site taint substrate for the C-family CFG harvesters (#2195 U6,
+ * plan R7 / KTD2) — the language-agnostic mechanism the C/C++, C#, Java and Go
+ * harvesters layer their grammar-specific call/member walks on top of.
+ *
+ * This file is PURE MECHANISM: it contains no tree-sitter node-type or field
+ * literals (each harvester supplies those when it drives `openCallSite` /
+ * `addMemberRead` / `setFrameArg`), so it names no language and carries nothing
+ * the grammar-literal CI gate needs to validate. It is the C-family analogue of
+ * the `FactAccumulator` site machinery in
+ * {@link import('./typescript-harvest.js')} — extracted into one place because
+ * the four C-family harvesters already share an identical def/use accumulator,
+ * and the site layer is identical across them too (only the per-grammar node
+ * shapes differ, and those live in each harvester's `walkValue`/`visitCall`).
+ *
+ * Produces the same {@link SiteRecord} shape the (future, deferred) shared
+ * taint matcher consumes uniformly across all languages: callee path, receiver,
+ * per-argument occurrence entries (with sanitizer-interposition via-tags),
+ * result defs, spread/template markers, and member reads. INERT BY DESIGN — no
+ * C-family source/sink/sanitizer model is registered today (`getSourceSinkConfig`
+ * returns undefined for every C-family language), so a harvest with no model
+ * produces ZERO TAINTED edges; this only emits the substrate the deferred model
+ * work will match against.
+ *
+ * Sites are emitted on {@link StatementFacts.sites} only when non-empty, exactly
+ * like the TS harvester — flag-off runs never harvest, and most fact-bearing
+ * statements carry no calls.
+ *
+ * NOTE: nothing serialized here may carry a field named `nodeId` — the durable
+ * parsedfile-store reviver dedups objects keyed on that field name.
+ */
+import type { SiteArgOccurrence, SiteRecord, StatementFacts } from '../types.js';
+
+/** Mutable build-time view of a {@link SiteRecord}. */
+interface MutableSite {
+  kind: SiteRecord['kind'];
+  parent?: [number, number];
+  callee?: string;
+  receiver?: number;
+  args?: SiteArgOccurrence[][];
+  resultDefs?: number[];
+  spread?: number;
+  template?: boolean;
+  requireArg?: string;
+  object?: number;
+  property?: string;
+}
+
+/**
+ * One open call/new site during the walk (mirrors the TS `SiteFrame`). `argIdx`
+ * is the argument position currently being walked, or -1 while outside any
+ * argument (callee walk) — occurrences recorded then do NOT land in this frame's
+ * args, but still fan out (via-tagged) to enclosing arg-active frames.
+ */
+interface SiteFrame {
+  siteIdx: number;
+  argIdx: number;
+}
+
+/**
+ * Minimal ordered, deduplicating def/use collector for one statement record,
+ * with NO call-site machinery (#2195 U7). The Kotlin / Python / Ruby / Rust /
+ * Dart / Swift harvesters each carried a BYTE-IDENTICAL copy of this class:
+ * those units harvest NO call sites (the taint substrate is a later step), so a
+ * site-free accumulator keeps their emitted facts free of any `sites` key
+ * (matching the Python harvester) and byte-identical to one another. This is the
+ * no-site sibling of {@link CallSiteFactAccumulator}; `finish` omits `sites`
+ * entirely. `useCount` is live (Ruby's emit guard is `defCount() ||
+ * useCount()`).
+ */
+export class DefUseAccumulator {
+  private readonly defs: number[] = [];
+  private readonly uses: number[] = [];
+  private readonly mayDefs: number[] = [];
+  private readonly defSeen = new Set<number>();
+  private readonly useSeen = new Set<number>();
+  private readonly mayDefSeen = new Set<number>();
+
+  constructor(private readonly line: number) {}
+
+  addDef(idx: number): void {
+    if (this.defSeen.has(idx)) return;
+    this.defSeen.add(idx);
+    this.defs.push(idx);
+  }
+
+  /** A def that may not execute (conditional context) — gen without kill. */
+  addMayDef(idx: number): void {
+    if (this.mayDefSeen.has(idx)) return;
+    this.mayDefSeen.add(idx);
+    this.mayDefs.push(idx);
+  }
+
+  addUse(idx: number): void {
+    if (this.useSeen.has(idx)) return;
+    this.useSeen.add(idx);
+    this.uses.push(idx);
+  }
+
+  defCount(): number {
+    return this.defs.length + this.mayDefs.length;
+  }
+
+  useCount(): number {
+    return this.uses.length;
+  }
+
+  finish(): StatementFacts {
+    return {
+      line: this.line,
+      defs: this.defs,
+      uses: this.uses,
+      // Stay absent when empty — keeps the serialized side-channel payload lean.
+      ...(this.mayDefs.length > 0 ? { mayDefs: this.mayDefs } : {}),
+    };
+  }
+}
+
+/**
+ * Defensive per-statement cap on harvested taint `sites` (#2195 U11). A real
+ * statement carries a handful of call / member-read sites; this only bounds a
+ * pathological or machine-generated statement (e.g. hundreds of nested calls)
+ * from producing an unbounded site list. Mirrors the PDG edge/fact caps' style
+ * (a generous-but-finite limit, checked before each push). Overflow is silent
+ * but observable via {@link CallSiteFactAccumulator.sitesTruncated}; the first
+ * `DEFAULT_PDG_MAX_SITES_PER_STATEMENT` sites are kept fully intact (callee,
+ * args, parent), the over-cap tail is dropped.
+ */
+export const DEFAULT_PDG_MAX_SITES_PER_STATEMENT = 512;
+
+/**
+ * Ordered, deduplicating def/use collector for one statement record, PLUS the
+ * call-site harvest machinery (#2195 U6). A drop-in superset of the simple
+ * def/use accumulator the C-family harvesters used before the substrate landed
+ * — `addDef`/`addMayDef`/`addUse`/`defCount`/`useCount`/`finish` are unchanged,
+ * so harvesters that never open a site emit byte-identical facts (no `sites`
+ * key, since `finish` omits it when empty).
+ */
+export class CallSiteFactAccumulator {
+  private readonly defs: number[] = [];
+  private readonly uses: number[] = [];
+  private readonly mayDefs: number[] = [];
+  private readonly defSeen = new Set<number>();
+  private readonly useSeen = new Set<number>();
+  private readonly mayDefSeen = new Set<number>();
+  /** Taint sites recorded for this statement. */
+  private readonly sites: MutableSite[] = [];
+  /** Composite (object|property|parent) keys of recorded member-read sites — O(1) dedup. */
+  private readonly memberReadKeys = new Set<string>();
+  /** Stack of open call/new sites — the occurrence fan-out targets. */
+  private readonly frames: SiteFrame[] = [];
+  /** Set once the per-statement site cap is hit; over-cap sites are dropped. */
+  private _sitesTruncated = false;
+
+  constructor(private readonly line: number) {}
+
+  /** True iff this statement hit {@link DEFAULT_PDG_MAX_SITES_PER_STATEMENT}. */
+  get sitesTruncated(): boolean {
+    return this._sitesTruncated;
+  }
+
+  addDef(idx: number): void {
+    if (this.defSeen.has(idx)) return;
+    this.defSeen.add(idx);
+    this.defs.push(idx);
+  }
+
+  /** A def that may not execute (conditional context) — gen without kill. */
+  addMayDef(idx: number): void {
+    if (this.mayDefSeen.has(idx)) return;
+    this.mayDefSeen.add(idx);
+    this.mayDefs.push(idx);
+  }
+
+  addUse(idx: number): void {
+    // Occurrence fan-out happens BEFORE the statement-level dedup: `exec(x, x)`
+    // records x at BOTH arg positions even though `uses` lists it once.
+    this.recordOccurrence(idx);
+    this.addUseWithoutOccurrence(idx);
+  }
+
+  /**
+   * Statement-level use that is NOT a value occurrence in any open site
+   * argument — bare callee names only (see each harvester's `visitCall`).
+   */
+  addUseWithoutOccurrence(idx: number): void {
+    if (this.useSeen.has(idx)) return;
+    this.useSeen.add(idx);
+    this.uses.push(idx);
+  }
+
+  defCount(): number {
+    return this.defs.length + this.mayDefs.length;
+  }
+
+  useCount(): number {
+    return this.uses.length;
+  }
+
+  // ── site machinery (#2195 U6, mirrors the TS harvester) ──────────────────
+
+  /** `[defs.length, mayDefs.length]` marker for {@link defsSince}. */
+  defSnapshot(): readonly [number, number] {
+    return [this.defs.length, this.mayDefs.length];
+  }
+
+  /** Binding indices def'd (must- OR may-) since the snapshot was taken. */
+  defsSince(snap: readonly [number, number]): number[] {
+    return [...this.defs.slice(snap[0]), ...this.mayDefs.slice(snap[1])];
+  }
+
+  /**
+   * Open a call/new site; parent = innermost enclosing argument position.
+   * Returns the new site index, or -1 when the per-statement site cap is hit
+   * (the caller threads -1 through `pushFrame`/`setSite*`, all of which no-op on
+   * a sentinel index — see {@link DEFAULT_PDG_MAX_SITES_PER_STATEMENT}).
+   */
+  openCallSite(kind: 'call' | 'new'): number {
+    if (this.sites.length >= DEFAULT_PDG_MAX_SITES_PER_STATEMENT) {
+      this._sitesTruncated = true;
+      return -1;
+    }
+    const site: MutableSite = { kind };
+    const parent = this.innermostArgPosition();
+    if (parent) site.parent = parent;
+    this.sites.push(site);
+    return this.sites.length - 1;
+  }
+
+  pushFrame(siteIdx: number): void {
+    this.frames.push({ siteIdx, argIdx: -1 });
+  }
+
+  popFrame(): void {
+    this.frames.pop();
+  }
+
+  /** Set the argument position the top frame is currently walking. */
+  setFrameArg(argIdx: number): void {
+    const top = this.frames[this.frames.length - 1];
+    if (top) top.argIdx = argIdx;
+  }
+
+  /**
+   * Run `fn` with all open arg frames temporarily detached (argIdx = -1), so
+   * identifier reads inside still record USES but do NOT fan occurrences into
+   * the enclosing sink-argument position (e.g. the non-value operands of a
+   * comma expression — only the final operand's value flows).
+   */
+  suppressOccurrences(fn: () => void): void {
+    const saved = this.frames.map((f) => f.argIdx);
+    for (const f of this.frames) f.argIdx = -1;
+    try {
+      fn();
+    } finally {
+      this.frames.forEach((f, i) => {
+        f.argIdx = saved[i];
+      });
+    }
+  }
+
+  setSiteCallee(siteIdx: number, callee: string): void {
+    const site = this.sites[siteIdx];
+    if (site) site.callee = callee;
+  }
+
+  setSiteReceiver(siteIdx: number, receiver: number): void {
+    const site = this.sites[siteIdx];
+    if (site) site.receiver = receiver;
+  }
+
+  setSiteResultDefs(siteIdx: number, resultDefs: readonly number[]): void {
+    const site = this.sites[siteIdx];
+    if (site) site.resultDefs = [...resultDefs];
+  }
+
+  setSiteSpread(siteIdx: number, firstSpreadArg: number): void {
+    const site = this.sites[siteIdx];
+    if (site && site.spread === undefined) site.spread = firstSpreadArg;
+  }
+
+  /**
+   * Record a value-position member read. Exact duplicates within the statement
+   * (same object/property/parent position) dedup; reads at DIFFERENT argument
+   * positions stay distinct (`exec(req.body, req.body)` is two occurrences).
+   */
+  addMemberRead(object: number, property: string): void {
+    const parent = this.innermostArgPosition();
+    const dedupKey = `${object}|${property}|${parent ? `${parent[0]}:${parent[1]}` : 'top'}`;
+    if (this.memberReadKeys.has(dedupKey)) return;
+    if (this.sites.length >= DEFAULT_PDG_MAX_SITES_PER_STATEMENT) {
+      this._sitesTruncated = true;
+      return;
+    }
+    this.memberReadKeys.add(dedupKey);
+    const site: MutableSite = { kind: 'member-read' };
+    if (parent) site.parent = parent;
+    site.object = object;
+    site.property = property;
+    this.sites.push(site);
+  }
+
+  private innermostArgPosition(): [number, number] | undefined {
+    for (let i = this.frames.length - 1; i >= 0; i--) {
+      const f = this.frames[i];
+      if (f.argIdx >= 0) return [f.siteIdx, f.argIdx];
+    }
+    return undefined;
+  }
+
+  /**
+   * Fan a binding occurrence out to every arg-active open frame, via-tagged
+   * with the site of the IMMEDIATELY nested frame when one exists:
+   * `exec(escape(x))` puts a plain `x` in escape's arg 0 and `[x, escapeIdx]`
+   * in exec's arg 0 — the sanitizer-interposition substrate.
+   */
+  private recordOccurrence(idx: number): void {
+    for (let i = this.frames.length - 1; i >= 0; i--) {
+      const f = this.frames[i];
+      if (f.argIdx < 0) continue;
+      // A nested frame whose site was cap-dropped (siteIdx -1) is not a real via.
+      const next = i + 1 < this.frames.length ? this.frames[i + 1].siteIdx : undefined;
+      const via = next !== undefined && next >= 0 ? next : undefined;
+      this.pushArgEntry(f.siteIdx, f.argIdx, idx, via);
+    }
+  }
+
+  private pushArgEntry(
+    siteIdx: number,
+    argIdx: number,
+    bindingIdx: number,
+    via: number | undefined,
+  ): void {
+    const site = this.sites[siteIdx];
+    if (!site) return; // cap-dropped frame (siteIdx -1) — no target to fan into
+    const args = (site.args ??= []);
+    while (args.length <= argIdx) args.push([]);
+    const list = args[argIdx];
+    // Dedup exact (binding, via) pairs per position — `f(x + x)` is one entry;
+    // `f(x + g(x))` keeps the plain AND the via-tagged entry (distinct paths).
+    for (const e of list) {
+      const match =
+        typeof e === 'number'
+          ? via === undefined && e === bindingIdx
+          : via !== undefined && e[0] === bindingIdx && e[1] === via;
+      if (match) return;
+    }
+    list.push(via === undefined ? bindingIdx : [bindingIdx, via]);
+  }
+
+  finish(): StatementFacts {
+    return {
+      line: this.line,
+      defs: this.defs,
+      uses: this.uses,
+      // Optional fields stay absent when empty — keeps the serialized
+      // side-channel payload lean (most statements have no may-defs / sites).
+      ...(this.mayDefs.length > 0 ? { mayDefs: this.mayDefs } : {}),
+      ...(this.sites.length > 0 ? { sites: this.sites.map(finalizeSite) } : {}),
+    };
+  }
+}
+
+/** Trim trailing empty arg positions; drop `args` entirely when all-empty. */
+const finalizeSite = (site: MutableSite): SiteRecord => {
+  const args = site.args;
+  if (args !== undefined) {
+    let end = args.length;
+    while (end > 0 && args[end - 1].length === 0) end--;
+    if (end === 0) delete site.args;
+    else if (end < args.length) site.args = args.slice(0, end);
+  }
+  return site as SiteRecord;
+};
diff --git a/gitnexus/src/core/ingestion/cfg/visitors/csharp-harvest.ts b/gitnexus/src/core/ingestion/cfg/visitors/csharp-harvest.ts
new file mode 100644
index 000000000..5e0296bf3
--- /dev/null
+++ b/gitnexus/src/core/ingestion/cfg/visitors/csharp-harvest.ts
@@ -0,0 +1,588 @@
+/**
+ * C# def/use harvester (#2195 U3, plan KTD2) — the C# analogue of
+ * {@link import('./typescript-harvest.js').TsHarvester} and the closely-related
+ * {@link import('./c-cpp-harvest.js').CCppHarvester}.
+ *
+ * Runs in the parse worker next to the C# CFG visitor, extracting per-statement
+ * variable definition/use facts that ride the side channel for the reaching-defs
+ * / CDG solvers. Output is the per-function binding table ({@link BindingEntry}[])
+ * plus {@link StatementFacts} the visitor attaches to blocks as it walks.
+ *
+ * TWO-PHASE, ORDER-INDEPENDENT (load-bearing — mirrors the TS / C-C++ harvesters):
+ * the CFG walk is NOT source-order (`visitFor` builds the init block after the
+ * body, `visitDoWhile` the condition before the body), so resolving names against
+ * a scope stack populated *during* the walk would mis-resolve. Phase 1 pre-scans
+ * the whole function subtree once into a completed lexical scope tree; phase 2
+ * resolves defs/uses against that finished tree from any walk order.
+ *
+ * v1 def-semantics scope:
+ *   - `local_declaration_statement` → `variable_declaration` → `variable_declarator`
+ *     (an INITIALIZED local is a def; a bare `int x;` with no initializer writes
+ *     nothing at runtime — not a def, like the TS bare-`var` rule).
+ *   - `assignment_expression` (plain + compound `+=` etc.), `postfix_unary_expression`
+ *     / `prefix_unary_expression` (`x++` / `--x`) — define and (for compound /
+ *     update) also use the lvalue.
+ *   - parameters (`parameter` → `name` field), the `foreach` loop variable
+ *     (`foreach_statement` field `left`), pattern bindings (`declaration_pattern`
+ *     `name`, e.g. `o is string s` / `case int n:`), and catch-clause names
+ *     (`catch_declaration` `name`).
+ * EXCLUDED, deliberately (TypeScript-CFA precedent): member / element / pointer
+ * writes (`obj.F = …`, `a[i] = …`) are NOT scalar defs — their identifiers are
+ * uses only. Nested-function (lambda / local-function / anonymous-method) bodies
+ * are opaque in BOTH directions (writes to and reads of captured outer variables
+ * are invisible).
+ *
+ * MAY-DEFS: a def inside a conditionally-evaluated subexpression — the right
+ * operand of `&&` / `||` / `??` (`a ?? (a = load())`), a ternary arm, or a switch
+ * arm/case test — is a may-def (gen without kill), so the not-taken path's prior
+ * def is not falsely killed.
+ *
+ * Identifiers with no in-function declaration (fields, properties, statics,
+ * namespaced names) resolve to a SYNTHETIC module-level binding (`name@module`),
+ * applied identically by def and use harvesting.
+ *
+ * NOTE: nothing serialized here may carry a field named `nodeId` — the durable
+ * parsedfile-store reviver dedups objects keyed on that field name.
+ */
+import type { SyntaxNode } from '../../utils/ast-helpers.js';
+import type { BindingEntry, StatementFacts } from '../types.js';
+import { CallSiteFactAccumulator } from './call-site-harvest.js';
+import { ScopeTreeHarvester, type Scope, type FactAccumulator } from './scope-tree-harvest.js';
+
+/** Node types that own a nested CFG — their subtrees are opaque to harvesting. */
+const NESTED_FUNCTION_TYPES = new Set([
+  'lambda_expression',
+  'anonymous_method_expression',
+  'local_function_statement',
+  'method_declaration',
+  'constructor_declaration',
+]);
+
+/**
+ * Nodes that open a lexical scope for block-local declarations. A `block` is one
+ * scope; the loop constructs open a scope for their loop variable; a
+ * `catch_clause` scopes its exception name; a `using_statement` scopes its
+ * resource declaration; a `switch_section` scopes its pattern bindings.
+ */
+const SCOPE_TYPES = new Set([
+  'block',
+  'for_statement',
+  'foreach_statement',
+  'while_statement',
+  'using_statement',
+  'catch_clause',
+  'switch_section',
+  'switch_expression_arm',
+]);
+
+export class CsharpHarvester extends ScopeTreeHarvester {
+  constructor(fnNode: SyntaxNode) {
+    super(fnNode);
+    this.declareParams(fnNode);
+    const body = this.bodyOf(fnNode);
+    if (body) this.prescan(body, this.openScope(body));
+  }
+
+  /** The function/lambda body node (a `block` or an expression for `=> expr`). */
+  private bodyOf(fnNode: SyntaxNode): SyntaxNode | undefined {
+    const body = fnNode.childForFieldName('body');
+    if (body) return body;
+    // Anonymous method / local function: the body is the first `block` child.
+    return fnNode.namedChildren.find((c) => c.type === 'block');
+  }
+
+  // ── phase 1: declaration pre-scan ────────────────────────────────────────
+
+  private declareParams(fnNode: SyntaxNode): void {
+    const params =
+      fnNode.childForFieldName('parameters') ??
+      fnNode.namedChildren.find(
+        (c) => c.type === 'parameter_list' || c.type === 'implicit_parameter',
+      );
+    if (!params) return;
+    if (params.type === 'implicit_parameter') {
+      // Single un-parenthesized lambda parameter: `x => …`.
+      this.declare(params, 'param', this.root);
+      return;
+    }
+    for (let i = 0; i < params.namedChildCount; i++) {
+      const p = params.namedChild(i);
+      if (p?.type !== 'parameter') continue;
+      const name = p.childForFieldName('name');
+      if (name) this.declare(name, 'param', this.root);
+    }
+  }
+
+  protected prescan(node: SyntaxNode, scope: Scope): void {
+    this.nearestScopeCache.set(node.id, scope);
+    const t = node.type;
+    if (NESTED_FUNCTION_TYPES.has(t) && node.id !== this.fnId) {
+      // A nested function / lambda body is opaque — do not descend.
+      return;
+    }
+
+    let childScope = scope;
+    if (SCOPE_TYPES.has(t)) childScope = this.openScope(node);
+
+    switch (t) {
+      case 'local_declaration_statement': {
+        const decl = node.namedChildren.find((c) => c.type === 'variable_declaration');
+        if (decl) this.declareVariableDeclaration(decl, childScope);
+        break;
+      }
+      case 'foreach_statement': {
+        // `foreach (var x in xs)` — the `left` is the loop var (identifier or a
+        // `tuple_pattern` of identifiers); binds in the loop scope.
+        const left = node.childForFieldName('left');
+        if (left) this.declareForeachTarget(left, childScope);
+        break;
+      }
+      case 'using_statement': {
+        // `using (var f = Open())` — declaration form binds the resource.
+        const decl = node.namedChildren.find((c) => c.type === 'variable_declaration');
+        if (decl) this.declareVariableDeclaration(decl, childScope);
+        break;
+      }
+      case 'catch_clause': {
+        const declNode = node.namedChildren.find((c) => c.type === 'catch_declaration');
+        const name = declNode?.childForFieldName('name');
+        if (name) this.declare(name, 'catch', childScope);
+        break;
+      }
+      case 'declaration_pattern': {
+        // `o is string s` / `case int n:` — `s`/`n` is a fresh binding.
+        const name = node.childForFieldName('name');
+        if (name) this.declare(name, 'var', childScope);
+        break;
+      }
+      case 'declaration_expression': {
+        // `f(out var n)` / `f(out int n)` — `n` is a fresh out-binding written
+        // by the callee; declare it so its def + later uses resolve to a real
+        // local rather than a synthetic module binding.
+        const name = node.childForFieldName('name');
+        if (name) this.declare(name, 'var', childScope);
+        break;
+      }
+      default:
+        break;
+    }
+
+    for (let i = 0; i < node.namedChildCount; i++) {
+      const c = node.namedChild(i);
+      if (c) this.prescan(c, childScope);
+    }
+  }
+
+  /** Declare every `variable_declarator` name in a `variable_declaration`. */
+  private declareVariableDeclaration(declNode: SyntaxNode, scope: Scope): void {
+    for (let i = 0; i < declNode.namedChildCount; i++) {
+      const d = declNode.namedChild(i);
+      if (d?.type !== 'variable_declarator') continue;
+      const name = d.childForFieldName('name');
+      if (name) {
+        this.declare(name, 'var', scope);
+      } else {
+        // Deconstruction declaration `var (a, b) = …;` — the declarator's name
+        // slot is a `tuple_pattern`; declare each identifier under it (reusing
+        // the foreach tuple-target logic).
+        const tuple = d.namedChildren.find((c) => c.type === 'tuple_pattern');
+        if (tuple) this.declareForeachTarget(tuple, scope);
+      }
+    }
+  }
+
+  /** Declare a `foreach` target — an identifier or a `tuple_pattern`. */
+  private declareForeachTarget(left: SyntaxNode, scope: Scope): void {
+    if (left.type === 'identifier') {
+      this.declare(left, 'var', scope);
+      return;
+    }
+    // `var (k, v)` deconstruction — declare each identifier under the pattern.
+    for (let i = 0; i < left.namedChildCount; i++) {
+      const c = left.namedChild(i);
+      if (c?.type === 'identifier') this.declare(c, 'var', scope);
+    }
+  }
+
+  // ── phase 2: per-statement fact extraction ───────────────────────────────
+
+  /** Def/use facts for one statement (or construct-header expression) node. */
+  facts(node: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(node.startPosition.row + 1);
+    this.walkValue(node, acc);
+    return acc.finish();
+  }
+
+  /** Facts for an expression whose WHOLE evaluation is conditional (case tests). */
+  factsConditional(node: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(node.startPosition.row + 1);
+    this.conditional(() => this.walkValue(node, acc));
+    return acc.finish();
+  }
+
+  /** Facts for a `foreach (decl in right)` head: decl binds, right is used. */
+  forEachHeadFacts(stmt: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(stmt.startPosition.row + 1);
+    const left = stmt.childForFieldName('left');
+    const right = stmt.childForFieldName('right');
+    if (left) this.defForeachTarget(left, acc);
+    if (right) this.walkValue(right, acc);
+    return acc.finish();
+  }
+
+  /** ENTRY-block facts for the function's parameters (defs only). */
+  paramFacts(): StatementFacts | undefined {
+    const params =
+      this.fnNode.childForFieldName('parameters') ??
+      this.fnNode.namedChildren.find(
+        (c) => c.type === 'parameter_list' || c.type === 'implicit_parameter',
+      );
+    if (!params) return undefined;
+    const acc = new FactAccumulator(this.fnNode.startPosition.row + 1);
+    if (params.type === 'implicit_parameter') {
+      this.def(params, acc);
+    } else {
+      for (let i = 0; i < params.namedChildCount; i++) {
+        const p = params.namedChild(i);
+        if (p?.type !== 'parameter') continue;
+        const name = p.childForFieldName('name');
+        if (name) this.def(name, acc);
+      }
+    }
+    return acc.defCount() ? acc.finish() : undefined;
+  }
+
+  /** Def fact for a `catch (T e)` declaration — prepend to the handler entry block. */
+  catchParamFacts(catchClause: SyntaxNode): StatementFacts | undefined {
+    const declNode = catchClause.namedChildren.find((c) => c.type === 'catch_declaration');
+    const name = declNode?.childForFieldName('name');
+    if (!name) return undefined;
+    const acc = new FactAccumulator(catchClause.startPosition.row + 1);
+    this.def(name, acc);
+    return acc.defCount() ? acc.finish() : undefined;
+  }
+
+  /** Strip parenthesized wrappers around an lvalue (`(x) = 1`). */
+  private unwrapLvalue(node: SyntaxNode): SyntaxNode {
+    let n = node;
+    let hops = 8;
+    while (n.type === 'parenthesized_expression' && hops-- > 0) {
+      const inner = n.namedChild(0);
+      if (!inner) break;
+      n = inner;
+    }
+    return n;
+  }
+
+  /** Def a `foreach` target (identifier or tuple) in a header fact accumulator. */
+  private defForeachTarget(left: SyntaxNode, acc: FactAccumulator): void {
+    if (left.type === 'identifier') {
+      this.def(left, acc);
+      return;
+    }
+    for (let i = 0; i < left.namedChildCount; i++) {
+      const c = left.namedChild(i);
+      if (c?.type === 'identifier') this.def(c, acc);
+    }
+  }
+
+  /** Value-position walk: collect uses; route def positions to the lvalue handler. */
+  private walkValue(node: SyntaxNode, acc: FactAccumulator): void {
+    const t = node.type;
+    if (NESTED_FUNCTION_TYPES.has(t) && node.id !== this.fnId) {
+      // Opaque nested function / lambda — captured reads/writes are invisible.
+      return;
+    }
+
+    switch (t) {
+      case 'identifier':
+        this.use(node, acc);
+        return;
+      case 'local_declaration_statement':
+      case 'variable_declaration': {
+        const decl = t === 'variable_declaration' ? node : node.namedChild(0);
+        if (decl && decl.type === 'variable_declaration') {
+          for (let i = 0; i < decl.namedChildCount; i++) {
+            const d = decl.namedChild(i);
+            if (d?.type !== 'variable_declarator') continue;
+            const name = d.childForFieldName('name');
+            if (!name) {
+              // Deconstruction declaration `var (a, b) = e;` — def each
+              // identifier in the `tuple_pattern`; the initializer is the
+              // declarator's non-pattern child.
+              const tuple = d.namedChildren.find((c) => c.type === 'tuple_pattern');
+              const tupleInit = d.namedChildren.find((c) => c.type !== 'tuple_pattern');
+              if (tuple) {
+                const snap = acc.defSnapshot();
+                this.defTupleTargets(tuple, acc);
+                if (tupleInit) this.registerResultDefs(tupleInit, acc.defsSince(snap));
+              }
+              if (tupleInit) this.walkValue(tupleInit, acc);
+              continue;
+            }
+            // The initializer (if any) is the LAST named child after `name`.
+            const init = this.declaratorInit(d);
+            if (name && init) {
+              const snap = acc.defSnapshot();
+              this.def(name, acc);
+              this.registerResultDefs(init, acc.defsSince(snap));
+            }
+            if (init) this.walkValue(init, acc);
+          }
+        }
+        return;
+      }
+      case 'declaration_expression': {
+        // `out var n` / `out int n` — the callee writes `n` (a must-def: C#
+        // requires an out parameter to be assigned before the method returns).
+        const name = node.childForFieldName('name');
+        if (name) this.def(name, acc);
+        return;
+      }
+      case 'assignment_expression': {
+        const left = node.childForFieldName('left');
+        const right = node.childForFieldName('right');
+        const op = node.childForFieldName('operator')?.text ?? '=';
+        if (left) {
+          const lv = this.unwrapLvalue(left);
+          if (lv.type === 'identifier') {
+            const snap = acc.defSnapshot();
+            this.def(lv, acc);
+            if (op !== '=') this.use(lv, acc); // compound assign reads too
+            if (op === '=' && right) this.registerResultDefs(right, acc.defsSince(snap));
+          } else if (lv.type === 'tuple_expression') {
+            this.defTupleTargets(lv, acc); // `(a, b) = …` deconstruction
+          } else {
+            this.walkValue(lv, acc); // member/element target — uses only
+          }
+        }
+        if (right) this.walkValue(right, acc);
+        return;
+      }
+      case 'postfix_unary_expression':
+      case 'prefix_unary_expression': {
+        const arg = node.namedChild(0);
+        const lv = arg ? this.unwrapLvalue(arg) : null;
+        // Only `++`/`--` write; `!x`/`-x`/`~x` are pure reads. The operator is an
+        // anonymous child; treat as a def+use only when the operand is an
+        // identifier AND the op text is an increment/decrement.
+        if (lv?.type === 'identifier' && this.isIncDec(node)) {
+          this.def(lv, acc);
+          this.use(lv, acc);
+        } else if (arg) {
+          this.walkValue(arg, acc);
+        }
+        return;
+      }
+      case 'binary_expression': {
+        const left = node.childForFieldName('left');
+        const right = node.childForFieldName('right');
+        const op = node.childForFieldName('operator')?.text ?? '';
+        if (left) this.walkValue(left, acc);
+        if (right) {
+          if (op === '&&' || op === '||' || op === '??') {
+            this.conditional(() => this.walkValue(right, acc));
+          } else {
+            this.walkValue(right, acc);
+          }
+        }
+        return;
+      }
+      case 'conditional_expression': {
+        const cond = node.childForFieldName('condition');
+        const cons = node.childForFieldName('consequence');
+        const alt = node.childForFieldName('alternative');
+        if (cond) this.walkValue(cond, acc);
+        if (cons) this.conditional(() => this.walkValue(cons, acc));
+        if (alt) this.conditional(() => this.walkValue(alt, acc));
+        return;
+      }
+      case 'invocation_expression':
+        // #2195 U6: explicit case (previously default-descended) — same uses,
+        // plus a taint-site record. Defs/uses stay byte-identical.
+        this.visitCall(node, acc, 'call');
+        return;
+      case 'object_creation_expression':
+        // `new Foo(x)` — constructor call site (`type` field is the callee).
+        this.visitCall(node, acc, 'new');
+        return;
+      case 'member_access_expression': {
+        // `a.B` — value read of the chain root only; the member name is not a
+        // scalar binding. Mirrors the TS member-read use semantics, plus a
+        // member-read site for the innermost identifier-rooted access.
+        this.walkChain(node, acc, false);
+        return;
+      }
+      default:
+        for (let i = 0; i < node.namedChildCount; i++) {
+          const c = node.namedChild(i);
+          if (c) this.walkValue(c, acc);
+        }
+    }
+  }
+
+  // ── taint-site harvest (#2195 U6) ────────────────────────────────────────
+
+  /**
+   * When `value`'s root (after stripping parens) is an invocation/creation
+   * node, remember that its site should carry `resultDefs: defs` — consumed by
+   * {@link visitCall} once the value walk reaches the node.
+   */
+  private registerResultDefs(value: SyntaxNode, defs: readonly number[]): void {
+    if (defs.length === 0) return;
+    const root = this.unwrapLvalue(value);
+    if (root.type === 'invocation_expression' || root.type === 'object_creation_expression') {
+      this.resultDefTargets.set(root.id, [...defs]);
+    }
+  }
+
+  /**
+   * Explicit invocation / object-creation handler: records a call site (callee
+   * path, receiver, per-arg occurrence entries, result defs) while reproducing
+   * EXACTLY the uses the old default descent recorded. C# wraps each argument in
+   * an `argument` node; `new Foo(...)` reads the `type` field as the callee.
+   */
+  private visitCall(node: SyntaxNode, acc: FactAccumulator, kind: 'call' | 'new'): void {
+    const calleeNode = node.childForFieldName(kind === 'new' ? 'type' : 'function');
+    const argsNode = node.childForFieldName('arguments');
+    const siteIdx = acc.openCallSite(kind);
+    acc.pushFrame(siteIdx);
+    let calleePath: string | undefined;
+    if (calleeNode) {
+      const callee = this.unwrapLvalue(calleeNode);
+      if (callee.type === 'identifier') {
+        // For a `new Foo(...)`, the `type` is a type name, not a scalar
+        // binding — record neither a use nor an occurrence for it; for a bare
+        // call the callee name is a statement-level use but not an occurrence.
+        if (kind === 'call') acc.addUseWithoutOccurrence(this.resolve(callee));
+        calleePath = callee.text;
+      } else if (callee.type === 'member_access_expression') {
+        // skipFinalRead: the final access IS the callee, carried by the path.
+        // A static dotted path (`System.Console.WriteLine(...)`) parses as a
+        // member_access_expression chain too, so this one branch covers both
+        // instance and static dotted callees.
+        const chain = this.walkChain(callee, acc, true);
+        calleePath = chain.path;
+        if (chain.rootIdx !== undefined) acc.setSiteReceiver(siteIdx, chain.rootIdx);
+      } else {
+        this.walkValue(callee, acc);
+      }
+      if (calleePath !== undefined) acc.setSiteCallee(siteIdx, calleePath);
+    }
+    const resultDefs = this.resultDefTargets.get(node.id);
+    if (resultDefs !== undefined) acc.setSiteResultDefs(siteIdx, resultDefs);
+    if (argsNode) {
+      let pos = 0;
+      for (let i = 0; i < argsNode.namedChildCount; i++) {
+        const arg = argsNode.namedChild(i);
+        // C# wraps each value in an `argument` node; the value is the inner
+        // expression (a named argument `name: x` exposes the label through the
+        // `name` field — skip it so `x` is what flows).
+        if (!arg || arg.type === 'comment') continue;
+        acc.setFrameArg(pos);
+        const value = arg.type === 'argument' ? this.argumentValue(arg) : arg;
+        if (value) this.walkValue(value, acc);
+        pos++;
+      }
+    }
+    acc.popFrame();
+  }
+
+  /**
+   * The value expression inside an `argument` node. A named argument
+   * (`name: x`) carries the label on the `name` field and the value as a
+   * sibling; a positional argument is just the value. Returns the last named
+   * child that is not the `name`-field label (and skips `ref`/`out`/`in`
+   * modifier keywords, which are anonymous tokens, not named children).
+   */
+  private argumentValue(arg: SyntaxNode): SyntaxNode | undefined {
+    const label = arg.childForFieldName('name');
+    for (let i = arg.namedChildCount - 1; i >= 0; i--) {
+      const c = arg.namedChild(i);
+      if (c && c.id !== label?.id) return c;
+    }
+    return undefined;
+  }
+
+  /**
+   * Member chain walk shared by value position and callee position. Records the
+   * chain-root identifier as a use (identical to the old default descent), plus
+   * at most ONE member-read site — the INNERMOST access — when the root is an
+   * identifier; `skipFinalRead` suppresses it when that access is the callee.
+   */
+  private walkChain(
+    node: SyntaxNode,
+    acc: FactAccumulator,
+    skipFinalRead: boolean,
+  ): { path?: string; rootIdx?: number } {
+    const accesses: string[] = [];
+    let cur: SyntaxNode = this.unwrapLvalue(node);
+    for (;;) {
+      if (cur.type === 'member_access_expression') {
+        const name = cur.childForFieldName('name');
+        accesses.unshift(name?.text ?? '');
+        const expr = cur.childForFieldName('expression');
+        if (!expr) break;
+        cur = this.unwrapLvalue(expr);
+      } else {
+        break;
+      }
+    }
+    let rootIdx: number | undefined;
+    let rootSegment: string | undefined;
+    if (cur.type === 'identifier') {
+      rootIdx = this.resolve(cur);
+      acc.addUse(rootIdx);
+      rootSegment = cur.text;
+    } else {
+      this.walkValue(cur, acc);
+    }
+    const innermost = accesses[0];
+    if (rootIdx !== undefined && innermost && !(skipFinalRead && accesses.length === 1)) {
+      acc.addMemberRead(rootIdx, innermost);
+    }
+    const path =
+      rootSegment !== undefined && accesses.every((a) => a !== '')
+        ? [rootSegment, ...accesses].join('.')
+        : undefined;
+    return { path, rootIdx };
+  }
+
+  /** The initializer value of a `variable_declarator` — the named child after `name`. */
+  private declaratorInit(declarator: SyntaxNode): SyntaxNode | undefined {
+    const name = declarator.childForFieldName('name');
+    for (let i = 0; i < declarator.namedChildCount; i++) {
+      const c = declarator.namedChild(i);
+      if (c && c.id !== name?.id) return c;
+    }
+    return undefined;
+  }
+
+  /** Whether a unary expression is `++`/`--` (the only writing unary ops). */
+  private isIncDec(node: SyntaxNode): boolean {
+    for (let i = 0; i < node.childCount; i++) {
+      const c = node.child(i);
+      if (c && !c.isNamed && (c.text === '++' || c.text === '--')) return true;
+    }
+    return false;
+  }
+
+  /** Def each identifier in a `(a, b) = …` tuple deconstruction target. */
+  private defTupleTargets(tuple: SyntaxNode, acc: FactAccumulator): void {
+    for (let i = 0; i < tuple.namedChildCount; i++) {
+      const c = tuple.namedChild(i);
+      if (!c) continue;
+      // tuple_expression wraps each element in an `argument`.
+      const inner = c.type === 'argument' ? c.namedChild(0) : c;
+      if (inner?.type === 'identifier') this.def(inner, acc);
+      else if (inner) this.walkValue(inner, acc);
+    }
+  }
+}
+
+/**
+ * Ordered, deduplicating def/use + call-site collector for one statement record.
+ * The shared {@link CallSiteFactAccumulator} carries the def/use machinery the
+ * old local class had, plus the taint-site harvest (#2195 U6).
+ */
+const FactAccumulator = CallSiteFactAccumulator;
diff --git a/gitnexus/src/core/ingestion/cfg/visitors/csharp.ts b/gitnexus/src/core/ingestion/cfg/visitors/csharp.ts
new file mode 100644
index 000000000..49b6a6dbc
--- /dev/null
+++ b/gitnexus/src/core/ingestion/cfg/visitors/csharp.ts
@@ -0,0 +1,967 @@
+/**
+ * C# CfgVisitor (#2195 U3, plan KTD2).
+ *
+ * Walks a C# function's tree-sitter AST and drives the language-agnostic
+ * {@link CfgBuilder} to produce a serializable {@link FunctionCfg}, plus a
+ * def/use harvest ({@link CsharpHarvester}) for the reaching-defs / CDG solvers.
+ * Structured like the TS visitor — a `visit_<node_type>` dispatch over the
+ * statement taxonomy, driving a per-function {@link ControlFlowContext} — because
+ * C# shares TS's `finally` semantics (try/finally AND `using`/`lock`-as-finally),
+ * which the finalizer-frame machinery in `control-flow-context.ts` models.
+ *
+ * Every node type and field literal below was grammar-validated against
+ * tree-sitter-c-sharp via the introspection probe before use (mandatory pre-step,
+ * KTD5). Known C# surprises pre-empted: records are `record_declaration` (NOT
+ * `record_struct_declaration`); there is no `else_clause` wrapper (an
+ * `if_statement`'s `alternative` is the else body / nested `if` directly); switch
+ * cases live in `switch_section`s under a `switch_body`; `variable_declarator`
+ * exposes only a `name` field (the initializer is a positional child);
+ * `finally_clause` / `lock_statement` / `catch_filter_clause` expose no field for
+ * their body/condition (positional children).
+ *
+ * Function nodes: `method_declaration`, `local_function_statement`,
+ * `constructor_declaration`, `lambda_expression`, `anonymous_method_expression`,
+ * and expression-bodied members (`body` is an `arrow_expression_clause`).
+ *
+ * Edge-kind contract (matches the TS visitor — RD/CDG consume these):
+ *  - if/else → `cond-true` / `cond-false`
+ *  - loops (for / foreach / while / do-while) → `cond-true` / `loop-back` /
+ *    `cond-false`
+ *  - switch (`switch_statement`) → `switch-case` / `fallthrough`; a
+ *    `switch_expression` arm dispatches as `switch-case` (each arm a guarded
+ *    branch, no fallthrough)
+ *  - try/catch → `throw` (every protected-region block → the handler); a jump
+ *    crossing a `finally` → `finally-return` / `finally-break` / `finally-continue`
+ *  - `using` / `lock` → modeled like try/finally: the dispose (`using`) runs on
+ *    BOTH normal and exception exit (deterministic), so a `return`/`break`/
+ *    `continue` crossing it gets the `finally-*` completion edge too. `lock`'s
+ *    monitor-release is likewise a deterministic finalizer.
+ *  - return / throw / break / continue → the matching terminator kind
+ *  - straight-line → `seq`
+ *
+ * Classic hazards, handled explicitly (mirrors the TS visitor):
+ *  - loops allocate a dedicated loop-exit block so `break` has a target before
+ *    the loop's successor is known; `continue` targets the header/increment.
+ *  - `for (;;) {}` / `while (true) {}` still emit the structural `header →
+ *    loopExit` `cond-false` escape edge so EXIT stays reverse-reachable from
+ *    every block — the post-dominator / CDG pass silently emits zero CDG for the
+ *    function otherwise.
+ *  - labeled `goto`: labels resolve within the function (forward AND backward);
+ *    an unresolved `goto` (incl. `goto case`/`goto default`, which target a
+ *    switch arm this CFG does not label) routes to EXIT and logs, preserving
+ *    single-exit.
+ *  - try/catch: conservative exceptional flow — EVERY block in the protected
+ *    region edges to the handler (an exception may fire mid-block), matching the
+ *    TS `visitTry` over-approximation.
+ *
+ * Known limitations:
+ *  - `yield return` / `yield break`: C# iterator methods compile to a hidden
+ *    state machine; tree-sitter shows only the surface `yield_statement`. This
+ *    visitor models `yield break` as a terminator → EXIT (`return`) and
+ *    `yield return e` as a block whose value continues to the next statement
+ *    (the producer resumes after the consumer pulls). The real suspend/resume
+ *    state-machine control flow is NOT modeled — documented gap, not faked.
+ *  - `goto case L;` / `goto default;` have no statically-labeled CFG target
+ *    (switch arms are not labeled blocks here) and route to EXIT like an
+ *    unresolved label.
+ *  - Async/await suspension points are modeled as straight-line (the awaited
+ *    continuation is not a separate flow), consistent with the TS visitor.
+ *  - Def/use harvest scope: see `csharp-harvest.ts` — member/element writes are
+ *    not scalar defs; nested-function bodies are opaque in both directions.
+ *
+ * Returns `undefined` (never throws) for an AST shape it cannot model, so a
+ * malformed function never drops the whole file's CFG group (R4).
+ */
+import type { SyntaxNode } from '../../utils/ast-helpers.js';
+import { CfgBuilder } from '../cfg-builder.js';
+import {
+  ControlFlowContext,
+  drainFinalizerPending,
+  wireJumpThroughFinalizers,
+} from '../control-flow-context.js';
+import type { TraversalResult } from '../traversal-result.js';
+import type { CfgVisitor, FunctionCfg } from '../types.js';
+import { CsharpHarvester } from './csharp-harvest.js';
+
+/** C# node types that own a CFG-bearing function body. */
+const CSHARP_FUNCTION_TYPES = new Set([
+  'method_declaration',
+  'local_function_statement',
+  'constructor_declaration',
+  'lambda_expression',
+  'anonymous_method_expression',
+]);
+
+/** Statement node types that break a basic block (everything else coalesces). */
+const CONTROL_FLOW_TYPES = new Set([
+  'if_statement',
+  'while_statement',
+  'do_statement',
+  'for_statement',
+  'foreach_statement',
+  'switch_statement',
+  'try_statement',
+  'using_statement',
+  'lock_statement',
+  'return_statement',
+  'break_statement',
+  'continue_statement',
+  'throw_statement',
+  'goto_statement',
+  'labeled_statement',
+  'yield_statement',
+  'block',
+]);
+
+const startLineOf = (n: SyntaxNode): number => n.startPosition.row + 1;
+const endLineOf = (n: SyntaxNode): number => n.endPosition.row + 1;
+
+/** A statement sequence that produced no blocks (empty body) is "transparent". */
+type SeqResult = TraversalResult | null;
+
+/**
+ * Per-function C# walk state. One instance per function so the
+ * {@link ControlFlowContext}, exception-handler stack, and label tables are
+ * scoped to that function and never leak across functions.
+ */
+class CsharpCfgWalk {
+  private readonly cfc = new ControlFlowContext();
+  /** Stack of exception-handler entry blocks (catch/finally) a `throw` jumps to. */
+  private readonly handlers: number[] = [];
+  /** label name → its `labeled_statement` body's entry block (resolved on demand). */
+  private readonly labelBlocks = new Map<string, number>();
+  /** Pending gotos to a label not yet seen: label → list of source blocks. */
+  private readonly pendingGotos = new Map<string, number[]>();
+
+  constructor(
+    private readonly builder: CfgBuilder,
+    private readonly harvest: CsharpHarvester,
+  ) {}
+
+  /** Statements of a block node, ignoring comments. */
+  private statementsOf(block: SyntaxNode): SyntaxNode[] {
+    return block.namedChildren.filter((c) => c.type !== 'comment');
+  }
+
+  /** The `body` block of a node (field, or the first `block` child). */
+  private bodyBlockOf(node: SyntaxNode): SyntaxNode | undefined {
+    return node.childForFieldName('body') ?? node.namedChildren.find((c) => c.type === 'block');
+  }
+
+  /** Visit a body that may be a `block` or a single statement. */
+  private visitBody(node: SyntaxNode | undefined | null): SeqResult {
+    return this.builder.withNesting(() => {
+      if (!node) return null;
+      if (node.type === 'block') return this.visitSeq(this.statementsOf(node));
+      return this.visitStmt(node);
+    });
+  }
+
+  /** Wire a sequence of statements, coalescing straight-line runs into blocks. */
+  visitSeq(stmts: SyntaxNode[]): SeqResult {
+    return this.builder.withNesting(() => {
+      let entry: number | undefined;
+      let dangling: number[] = [];
+      let openSimple: number | undefined;
+
+      for (let i = 0; i < stmts.length; i++) {
+        const stmt = stmts[i];
+        if (this.isUsingLocalDecl(stmt)) {
+          // `using var f = e;` (C# 8 declaration form): the dispose runs at the END
+          // of the enclosing scope, so the REST of this sequence is the protected
+          // body. The acquisition (`var f = e`) is a normal block OUTSIDE the dispose
+          // region (if it throws, the resource was never acquired) (#2206).
+          openSimple = undefined;
+          const acq = this.builder.newBlock(
+            startLineOf(stmt),
+            endLineOf(stmt),
+            stmt.text,
+            'normal',
+            this.harvest.facts(stmt),
+          );
+          if (entry === undefined) entry = acq;
+          else this.builder.connect(dangling, acq, 'seq');
+          const scope = this.buildUsingDeclScope(stmt, stmts.slice(i + 1));
+          this.builder.connect([acq], scope.entry, 'seq');
+          dangling = [...scope.exits];
+          break; // the rest of the sequence is consumed by the dispose scope
+        }
+        if (CONTROL_FLOW_TYPES.has(stmt.type)) {
+          openSimple = undefined; // close any open straight-line block
+          const res = this.visitStmt(stmt);
+          if (res === null) continue; // transparent (empty nested block)
+          if (entry === undefined) entry = res.entry;
+          else this.builder.connect(dangling, res.entry, 'seq');
+          dangling = [...res.exits];
+        } else {
+          if (openSimple === undefined) {
+            const idx = this.builder.newBlock(
+              startLineOf(stmt),
+              endLineOf(stmt),
+              stmt.text,
+              'normal',
+              this.harvest.facts(stmt),
+            );
+            if (entry === undefined) entry = idx;
+            else this.builder.connect(dangling, idx, 'seq');
+            openSimple = idx;
+            dangling = [idx];
+          } else {
+            this.builder.extendBlock(
+              openSimple,
+              endLineOf(stmt),
+              stmt.text,
+              this.harvest.facts(stmt),
+            );
+          }
+        }
+      }
+
+      if (entry === undefined) return null;
+      return { entry, exits: dangling };
+    });
+  }
+
+  /** Dispatch one statement to its handler. Non-null except for empty blocks. */
+  visitStmt(stmt: SyntaxNode): SeqResult {
+    switch (stmt.type) {
+      case 'if_statement':
+        return this.visitIf(stmt);
+      case 'while_statement':
+        return this.visitWhile(stmt);
+      case 'do_statement':
+        return this.visitDoWhile(stmt);
+      case 'for_statement':
+        return this.visitFor(stmt);
+      case 'foreach_statement':
+        return this.visitForEach(stmt);
+      case 'switch_statement':
+        return this.visitSwitch(stmt);
+      case 'try_statement':
+        return this.visitTry(stmt);
+      case 'using_statement':
+        return this.visitUsing(stmt);
+      case 'lock_statement':
+        return this.visitLock(stmt);
+      case 'return_statement':
+        return this.visitReturn(stmt);
+      case 'throw_statement':
+        return this.visitThrow(stmt);
+      case 'break_statement':
+        return this.visitBreak(stmt);
+      case 'continue_statement':
+        return this.visitContinue(stmt);
+      case 'goto_statement':
+        return this.visitGoto(stmt);
+      case 'labeled_statement':
+        return this.visitLabeled(stmt);
+      case 'yield_statement':
+        return this.visitYield(stmt);
+      case 'block':
+        return this.visitSeq(this.statementsOf(stmt));
+      default:
+        return this.visitSimple(stmt);
+    }
+  }
+
+  private visitSimple(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    return { entry: idx, exits: [idx] };
+  }
+
+  private visitReturn(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    // A return crosses EVERY active finally (try/using/lock) before EXIT.
+    wireJumpThroughFinalizers(
+      this.builder,
+      idx,
+      this.cfc.finalizersForReturn(),
+      this.builder.exitIndex,
+      'return',
+    );
+    return { entry: idx, exits: [] };
+  }
+
+  private visitThrow(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    this.builder.edge(idx, this.currentHandler(), 'throw');
+    return { entry: idx, exits: [] };
+  }
+
+  /** `yield return e;` continues; `yield break;` terminates the iterator. */
+  private visitYield(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    // `yield break;` (no value child) ends iteration → EXIT (modeled like return);
+    // `yield return e;` (has a value child) yields one element and CONTINUES, so
+    // it falls through to the next statement. The hidden iterator state machine
+    // is not modeled (documented limitation).
+    if (this.isYieldBreak(stmt)) {
+      wireJumpThroughFinalizers(
+        this.builder,
+        idx,
+        this.cfc.finalizersForReturn(),
+        this.builder.exitIndex,
+        'return',
+      );
+      return { entry: idx, exits: [] };
+    }
+    return { entry: idx, exits: [idx] };
+  }
+
+  /** A `yield break;` has no value child; `yield return e;` has one. */
+  private isYieldBreak(stmt: SyntaxNode): boolean {
+    return stmt.namedChildCount === 0;
+  }
+
+  private visitBreak(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(startLineOf(stmt), endLineOf(stmt), stmt.text);
+    const res = this.cfc.resolveBreak(undefined);
+    const { target, finalizers } = res ?? {
+      target: this.builder.exitIndex,
+      finalizers: this.cfc.finalizersForReturn(),
+    };
+    wireJumpThroughFinalizers(this.builder, idx, finalizers, target, 'break');
+    return { entry: idx, exits: [] };
+  }
+
+  private visitContinue(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(startLineOf(stmt), endLineOf(stmt), stmt.text);
+    const res = this.cfc.resolveContinue(undefined);
+    const { target, finalizers } = res ?? {
+      target: this.builder.exitIndex,
+      finalizers: this.cfc.finalizersForReturn(),
+    };
+    wireJumpThroughFinalizers(this.builder, idx, finalizers, target, 'continue');
+    return { entry: idx, exits: [] };
+  }
+
+  /** `goto label;` — route to the label block if known, else defer / EXIT. */
+  private visitGoto(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(startLineOf(stmt), endLineOf(stmt), stmt.text);
+    const label = this.gotoLabel(stmt);
+    if (label === undefined) {
+      // `goto case L;` / `goto default;` — no statically-labeled CFG target.
+      this.builder.edge(idx, this.builder.exitIndex, 'seq');
+      return { entry: idx, exits: [] };
+    }
+    const target = this.labelBlocks.get(label);
+    if (target !== undefined) {
+      this.builder.edge(idx, target, 'seq'); // backward goto: label already built
+    } else {
+      const list = this.pendingGotos.get(label);
+      if (list) list.push(idx);
+      else this.pendingGotos.set(label, [idx]);
+    }
+    return { entry: idx, exits: [] };
+  }
+
+  private visitLabeled(stmt: SyntaxNode): SeqResult {
+    // `labeled_statement` = label `identifier` + the labeled statement.
+    const labelNode = stmt.namedChildren.find((c) => c.type === 'identifier');
+    const label = labelNode?.text;
+    const body = stmt.namedChildren.find((c) => c.id !== labelNode?.id && c.type !== 'comment');
+    const res = this.visitBody(body ?? null);
+    if (label !== undefined) {
+      const entry = res?.entry ?? this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+      this.labelBlocks.set(label, entry);
+      const pending = this.pendingGotos.get(label);
+      if (pending) {
+        for (const from of pending) this.builder.edge(from, entry, 'seq');
+        this.pendingGotos.delete(label);
+      }
+      if (!res) return { entry, exits: [entry] };
+    }
+    return res;
+  }
+
+  private visitIf(stmt: SyntaxNode): TraversalResult {
+    const cond = stmt.childForFieldName('condition') ?? stmt;
+    const condBlock = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(cond),
+      cond.text,
+      'normal',
+      this.harvest.facts(cond),
+    );
+    const exits: number[] = [];
+
+    const thenRes = this.visitBody(stmt.childForFieldName('consequence'));
+    if (thenRes) {
+      this.builder.edge(condBlock, thenRes.entry, 'cond-true');
+      exits.push(...thenRes.exits);
+    } else {
+      exits.push(condBlock); // empty then — true path falls through
+    }
+
+    // No `else_clause` wrapper in C#: `alternative` is the else body or the
+    // nested `if_statement` for an `else if` chain directly.
+    const elseNode = stmt.childForFieldName('alternative');
+    if (elseNode) {
+      const elseRes = this.visitBody(elseNode);
+      if (elseRes) {
+        this.builder.edge(condBlock, elseRes.entry, 'cond-false');
+        exits.push(...elseRes.exits);
+      } else {
+        exits.push(condBlock);
+      }
+    } else {
+      exits.push(condBlock); // no else — false path falls through to the join
+    }
+
+    return { entry: condBlock, exits: [...new Set(exits)] };
+  }
+
+  private visitWhile(stmt: SyntaxNode): TraversalResult {
+    const cond = stmt.childForFieldName('condition') ?? stmt;
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(cond),
+      cond.text,
+      'normal',
+      this.harvest.facts(cond),
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.cfc.pushLoop(header, loopExit);
+    const body = this.visitBody(this.bodyBlockOf(stmt));
+    this.cfc.pop();
+
+    if (body) {
+      this.builder.edge(header, body.entry, 'cond-true');
+      this.builder.connect(body.exits, header, 'loop-back');
+    } else {
+      this.builder.edge(header, header, 'loop-back'); // empty body re-tests
+    }
+    // Always emit the structural exit edge — even `while (true)` keeps EXIT
+    // reverse-reachable for the post-dominator / CDG pass.
+    this.builder.edge(header, loopExit, 'cond-false');
+    return { entry: header, exits: [loopExit] };
+  }
+
+  private visitDoWhile(stmt: SyntaxNode): TraversalResult {
+    const cond = stmt.childForFieldName('condition') ?? stmt;
+    const condBlock = this.builder.newBlock(
+      startLineOf(cond),
+      endLineOf(cond),
+      cond.text,
+      'normal',
+      this.harvest.facts(cond),
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.cfc.pushLoop(condBlock, loopExit);
+    const body = this.visitBody(this.bodyBlockOf(stmt));
+    this.cfc.pop();
+
+    const backTarget = body ? body.entry : condBlock;
+    if (body) this.builder.connect(body.exits, condBlock, 'seq');
+    this.builder.edge(condBlock, backTarget, 'loop-back'); // cond true → run body again
+    this.builder.edge(condBlock, loopExit, 'cond-false');
+    return { entry: backTarget, exits: [loopExit] };
+  }
+
+  private visitFor(stmt: SyntaxNode): TraversalResult {
+    const init = stmt.childForFieldName('initializer');
+    const cond = stmt.childForFieldName('condition');
+    const incr = stmt.childForFieldName('update');
+
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      cond ? endLineOf(cond) : startLineOf(stmt),
+      cond ? cond.text : 'for(;;)',
+      'normal',
+      cond ? this.harvest.facts(cond) : undefined,
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    let incrBlock = header;
+    if (incr) {
+      incrBlock = this.builder.newBlock(
+        startLineOf(incr),
+        endLineOf(incr),
+        incr.text,
+        'normal',
+        this.harvest.facts(incr),
+      );
+      this.builder.edge(incrBlock, header, 'loop-back');
+    }
+
+    this.cfc.pushLoop(incrBlock, loopExit);
+    const body = this.visitBody(this.bodyBlockOf(stmt));
+    this.cfc.pop();
+
+    if (body) {
+      this.builder.edge(header, body.entry, 'cond-true');
+      this.builder.connect(body.exits, incrBlock, incr ? 'seq' : 'loop-back');
+    } else {
+      this.builder.edge(header, incrBlock, 'cond-true');
+      if (!incr) this.builder.edge(header, header, 'loop-back');
+    }
+    // Structural exit edge — `for (;;) {}` (no condition) still keeps EXIT
+    // reverse-reachable so CDG is not silently skipped for the function.
+    this.builder.edge(header, loopExit, 'cond-false');
+
+    let entry = header;
+    if (init) {
+      const initBlock = this.builder.newBlock(
+        startLineOf(init),
+        endLineOf(init),
+        init.text,
+        'normal',
+        this.harvest.facts(init),
+      );
+      this.builder.edge(initBlock, header, 'seq');
+      entry = initBlock;
+    }
+    return { entry, exits: [loopExit] };
+  }
+
+  private visitForEach(stmt: SyntaxNode): TraversalResult {
+    // Header text is SYNTHESIZED, so facts come from the left/right nodes
+    // directly (the loop variable is a def, the iterated expression a use).
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      startLineOf(stmt),
+      this.forEachHeaderText(stmt),
+      'normal',
+      this.harvest.forEachHeadFacts(stmt),
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.cfc.pushLoop(header, loopExit);
+    const body = this.visitBody(this.bodyBlockOf(stmt));
+    this.cfc.pop();
+
+    if (body) {
+      this.builder.edge(header, body.entry, 'cond-true');
+      this.builder.connect(body.exits, header, 'loop-back');
+    } else {
+      this.builder.edge(header, header, 'loop-back');
+    }
+    this.builder.edge(header, loopExit, 'cond-false');
+    return { entry: header, exits: [loopExit] };
+  }
+
+  private forEachHeaderText(stmt: SyntaxNode): string {
+    const left = stmt.childForFieldName('left')?.text ?? '';
+    const right = stmt.childForFieldName('right')?.text ?? '';
+    return left || right ? `foreach(${left} in ${right})` : 'foreach(… in …)';
+  }
+
+  private visitSwitch(stmt: SyntaxNode): TraversalResult {
+    const value = stmt.childForFieldName('value') ?? stmt;
+    const dispatch = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(value),
+      value.text,
+      'normal',
+      this.harvest.facts(value),
+    );
+    const switchExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.cfc.pushSwitch(switchExit);
+    const body = stmt.childForFieldName('body');
+    const sections = body ? body.namedChildren.filter((c) => c.type === 'switch_section') : [];
+
+    // Each `switch_section`'s case-test patterns/`when` clauses evaluate before
+    // the body runs — harvest their uses (and any pattern binding as a may-def)
+    // onto the dispatch block, one record per section, conditionally (a later
+    // section test only runs when earlier sections didn't match).
+    for (const sec of sections) {
+      for (const test of this.sectionTests(sec)) {
+        this.builder.attachFacts(dispatch, this.harvest.factsConditional(test));
+      }
+    }
+
+    const sectionResults = sections.map((s) => this.visitSeq(this.sectionStatements(s)));
+    const hasDefault = sections.some((s) => this.sectionIsDefault(s));
+
+    const entryOf: number[] = new Array(sections.length);
+    let after = switchExit;
+    for (let i = sections.length - 1; i >= 0; i--) {
+      entryOf[i] = sectionResults[i]?.entry ?? after;
+      after = entryOf[i];
+    }
+
+    for (let i = 0; i < sections.length; i++) {
+      this.builder.edge(dispatch, entryOf[i], 'switch-case');
+    }
+    if (!hasDefault) this.builder.edge(dispatch, switchExit, 'switch-case'); // no-match path
+
+    // A non-`break` section's dangling exits fall through to the next section
+    // (an empty `case 2:` falling into `case 3:`, or `goto case`-less spill).
+    for (let i = 0; i < sections.length; i++) {
+      const res = sectionResults[i];
+      if (!res) continue;
+      const fallTarget = i + 1 < sections.length ? entryOf[i + 1] : switchExit;
+      this.builder.connect(res.exits, fallTarget, 'fallthrough');
+    }
+
+    this.cfc.pop();
+    return { entry: dispatch, exits: [switchExit] };
+  }
+
+  /** A switch_section's body statements (everything but its case labels/patterns). */
+  private sectionStatements(section: SyntaxNode): SyntaxNode[] {
+    return section.namedChildren.filter((c) => this.isStatementLike(c) && c.type !== 'comment');
+  }
+
+  /** The case-test expressions of a section (constant patterns + when clauses). */
+  private sectionTests(section: SyntaxNode): SyntaxNode[] {
+    const out: SyntaxNode[] = [];
+    for (const c of section.namedChildren) {
+      if (c.type === 'when_clause') {
+        const inner = c.namedChild(0);
+        if (inner) out.push(inner);
+      } else if (!this.isStatementLike(c) && c.type !== 'comment') {
+        out.push(c); // a pattern (constant_pattern / declaration_pattern / …)
+      }
+    }
+    return out;
+  }
+
+  /** A `default:` section has only a `default` label (no pattern). */
+  private sectionIsDefault(section: SyntaxNode): boolean {
+    return !section.namedChildren.some(
+      (c) => !this.isStatementLike(c) && c.type !== 'comment' && c.type !== 'when_clause',
+    );
+  }
+
+  /** Heuristic: a section child is statement-like if it ends a basic-block run. */
+  private isStatementLike(node: SyntaxNode): boolean {
+    return node.type.endsWith('_statement') || node.type === 'block';
+  }
+
+  private visitTry(stmt: SyntaxNode): SeqResult {
+    const bodyNode = stmt.childForFieldName('body');
+    const catchClauses: SyntaxNode[] = [];
+    let finallyClause: SyntaxNode | undefined;
+    for (let i = 0; i < stmt.namedChildCount; i++) {
+      const c = stmt.namedChild(i);
+      if (c?.type === 'catch_clause') catchClauses.push(c);
+      else if (c?.type === 'finally_clause') finallyClause = c;
+    }
+    const finallyBody = finallyClause?.namedChildren.find((c) => c.type === 'block');
+    return this.buildProtected(bodyNode ?? null, catchClauses, finallyBody ?? null, stmt);
+  }
+
+  /**
+   * `using (resource) body` — the dispose runs deterministically on BOTH normal
+   * AND exception exit, which is exactly `try { body } finally { dispose }`. We
+   * model the dispose as a synthesized finalizer block (the AST has no Dispose()
+   * call node), so a `return`/`break`/`continue` crossing it threads through and
+   * gets a `finally-*` completion edge.
+   */
+  private visitUsing(stmt: SyntaxNode): SeqResult {
+    const bodyNode = this.bodyBlockOf(stmt) ?? null;
+    // The resource (declaration or expression) is the named child before `body`.
+    const resource = this.usingResource(stmt);
+    const disposeFacts = resource ? this.harvest.facts(resource) : undefined;
+    return this.buildProtectedSynthetic(bodyNode, stmt, 'dispose', disposeFacts, resource ?? stmt);
+  }
+
+  /**
+   * `lock (obj) body` — the monitor release runs on both normal and exception
+   * exit (deterministic finalizer), same shape as `using`'s dispose.
+   */
+  private visitLock(stmt: SyntaxNode): SeqResult {
+    const bodyNode = this.bodyBlockOf(stmt) ?? null;
+    const lockObj = stmt.namedChildren.find((c) => c.type !== 'block');
+    const releaseFacts = lockObj ? this.harvest.facts(lockObj) : undefined;
+    return this.buildProtectedSynthetic(bodyNode, stmt, 'release', releaseFacts, lockObj ?? stmt);
+  }
+
+  /** The `using` resource node (variable_declaration or an expression). */
+  private usingResource(stmt: SyntaxNode): SyntaxNode | undefined {
+    const body = stmt.childForFieldName('body');
+    return stmt.namedChildren.find((c) => c.id !== body?.id && c.type !== 'comment');
+  }
+
+  /**
+   * Whether `stmt` is a C# 8 `using var f = …;` declaration (a
+   * `local_declaration_statement` with a leading `using` keyword) — the dispose
+   * runs at enclosing-scope exit, NOT a delimited block (#2206).
+   */
+  private isUsingLocalDecl(stmt: SyntaxNode): boolean {
+    if (stmt.type !== 'local_declaration_statement') return false;
+    for (let i = 0; i < stmt.childCount; i++) {
+      if (stmt.child(i)?.type === 'using') return true;
+    }
+    return false;
+  }
+
+  /**
+   * Build the dispose scope for a `using var f = …;` declaration: `restStmts` (the
+   * rest of the enclosing block) is the protected body, and a synthetic `dispose`
+   * finalizer runs on normal exit AND on exception, with a `return`/`break`/
+   * `continue` crossing it threading through (finally-* completion edges). Mirrors
+   * {@link buildProtectedSynthetic}, but the body is a statement LIST (#2206).
+   */
+  private buildUsingDeclScope(declStmt: SyntaxNode, restStmts: SyntaxNode[]): SeqResult {
+    const disposeBlock = this.builder.newBlock(endLineOf(declStmt), endLineOf(declStmt), 'dispose');
+    const finFrame = this.cfc.pushFinalizer(disposeBlock);
+
+    const protectedStart = this.builder.blockCount;
+    this.handlers.push(disposeBlock);
+    const bodyRes = this.visitSeq(restStmts);
+    this.handlers.pop();
+
+    for (let b = protectedStart; b < this.builder.blockCount; b++) {
+      this.builder.edge(b, disposeBlock, 'throw');
+    }
+
+    this.cfc.pop();
+    drainFinalizerPending(this.builder, finFrame, [disposeBlock]);
+
+    if (bodyRes) this.builder.connect(bodyRes.exits, disposeBlock, 'seq');
+    this.builder.connect([disposeBlock], this.currentHandler(), 'throw');
+
+    return { entry: bodyRes?.entry ?? disposeBlock, exits: [disposeBlock] };
+  }
+
+  /**
+   * Shared try/catch/finally builder. `catchClauses` may be empty; `finallyBody`
+   * is the finally's `block` (or null). Models the TS `visitTry` semantics:
+   * normal completion of try AND catch flow through finally; a throw in the
+   * protected region routes to the handler; early exits crossing the finally
+   * thread through it (finally-* completion edges).
+   */
+  private buildProtected(
+    bodyNode: SyntaxNode | null,
+    catchClauses: SyntaxNode[],
+    finallyBody: SyntaxNode | null,
+    span: SyntaxNode,
+  ): SeqResult {
+    const finallyRes = finallyBody ? this.visitSeq(this.statementsOf(finallyBody)) : null;
+    const finFrame = finallyRes ? this.cfc.pushFinalizer(finallyRes.entry) : null;
+
+    // Build each catch handler.
+    const catchEntries: number[] = [];
+    const catchExits: number[] = [];
+    let firstCatchEntry: number | undefined;
+    for (const clause of catchClauses) {
+      const clauseBody = clause.childForFieldName('body');
+      if (finallyRes) this.handlers.push(finallyRes.entry);
+      let res: SeqResult = clauseBody ? this.visitSeq(this.statementsOf(clauseBody)) : null;
+      if (finallyRes) this.handlers.pop();
+      if (res === null) {
+        // Empty `catch {}` still catches — synthesize one block so exception
+        // flow lands somewhere and the post-try code stays reachable.
+        const idx = this.builder.newBlock(startLineOf(clause), endLineOf(clause), '');
+        res = { entry: idx, exits: [idx] };
+      }
+      const paramFacts = this.harvest.catchParamFacts(clause);
+      if (paramFacts) {
+        const paramBlock = this.builder.newBlock(
+          startLineOf(clause),
+          startLineOf(clause),
+          '',
+          'normal',
+          paramFacts,
+        );
+        this.builder.edge(paramBlock, res.entry, 'seq');
+        res = { entry: paramBlock, exits: res.exits };
+      }
+      catchEntries.push(res.entry);
+      catchExits.push(...res.exits);
+      if (firstCatchEntry === undefined) firstCatchEntry = res.entry;
+    }
+
+    // Handler for the try body: first catch if present, else finally, else outer.
+    const tryHandler = firstCatchEntry ?? finallyRes?.entry ?? this.currentHandler();
+    const protectedStart = this.builder.blockCount;
+    this.handlers.push(tryHandler);
+    const bodyRes = bodyNode
+      ? bodyNode.type === 'block'
+        ? this.visitSeq(this.statementsOf(bodyNode))
+        : this.visitStmt(bodyNode)
+      : null;
+    this.handlers.pop();
+
+    if (catchClauses.length > 0 || finallyBody) {
+      for (let b = protectedStart; b < this.builder.blockCount; b++) {
+        this.builder.edge(b, tryHandler, 'throw');
+      }
+    }
+
+    if (finFrame && finallyRes) {
+      this.cfc.pop();
+      drainFinalizerPending(this.builder, finFrame, finallyRes.exits);
+    }
+
+    const exits: number[] = [];
+    if (finallyRes) {
+      if (bodyRes) this.builder.connect(bodyRes.exits, finallyRes.entry, 'seq');
+      for (const e of catchExits) this.builder.edge(e, finallyRes.entry, 'seq');
+      exits.push(...finallyRes.exits);
+      // No catch → an exception re-propagates out after finally runs.
+      if (catchClauses.length === 0) {
+        this.builder.connect(finallyRes.exits, this.currentHandler(), 'throw');
+      }
+    } else {
+      if (bodyRes) exits.push(...bodyRes.exits);
+      exits.push(...catchExits);
+    }
+
+    const entry = bodyRes?.entry ?? finallyRes?.entry ?? catchEntries[0];
+    if (entry === undefined) {
+      void span;
+      return null;
+    }
+    return { entry, exits: [...new Set(exits)] };
+  }
+
+  /**
+   * `using`/`lock`: a protected body whose finalizer is a SYNTHESIZED single
+   * block (Dispose() / Monitor.Exit() have no AST node). The finalizer runs on
+   * both normal and exception exit, and crossing jumps thread through it.
+   */
+  private buildProtectedSynthetic(
+    bodyNode: SyntaxNode | null,
+    span: SyntaxNode,
+    text: string,
+    finalizerFacts: StatementFactsLike,
+    factsNode: SyntaxNode,
+  ): SeqResult {
+    void factsNode;
+    const finalizerBlock = this.builder.newBlock(
+      endLineOf(span),
+      endLineOf(span),
+      text,
+      'normal',
+      finalizerFacts ?? undefined,
+    );
+    const finRes: TraversalResult = { entry: finalizerBlock, exits: [finalizerBlock] };
+    const finFrame = this.cfc.pushFinalizer(finRes.entry);
+
+    const protectedStart = this.builder.blockCount;
+    // The finalizer IS the handler — an exception in the body still runs dispose,
+    // which then re-propagates to the outer handler.
+    this.handlers.push(finRes.entry);
+    const bodyRes = bodyNode
+      ? bodyNode.type === 'block'
+        ? this.visitSeq(this.statementsOf(bodyNode))
+        : this.visitStmt(bodyNode)
+      : null;
+    this.handlers.pop();
+
+    for (let b = protectedStart; b < this.builder.blockCount; b++) {
+      this.builder.edge(b, finRes.entry, 'throw');
+    }
+
+    this.cfc.pop();
+    drainFinalizerPending(this.builder, finFrame, finRes.exits);
+
+    // Normal completion of the body flows through the finalizer; the finalizer's
+    // exit re-propagates an exception to the outer handler (it had no catch).
+    if (bodyRes) this.builder.connect(bodyRes.exits, finRes.entry, 'seq');
+    this.builder.connect(finRes.exits, this.currentHandler(), 'throw');
+
+    const entry = bodyRes?.entry ?? finRes.entry;
+    return { entry, exits: [...finRes.exits] };
+  }
+
+  /** Nearest enclosing exception handler, or the function EXIT. */
+  private currentHandler(): number {
+    return this.handlers.length ? this.handlers[this.handlers.length - 1] : this.builder.exitIndex;
+  }
+
+  /** The target label of a `goto label;` (undefined for `goto case`/`goto default`). */
+  private gotoLabel(stmt: SyntaxNode): string | undefined {
+    const id = stmt.namedChildren.find((c) => c.type === 'identifier');
+    return id?.text;
+  }
+}
+
+/** A pre-built {@link StatementFacts} record, or undefined when none. */
+type StatementFactsLike = ReturnType<CsharpHarvester['facts']> | undefined;
+
+/** Build the CFG for one C# function node, or `undefined` if not modelable. */
+function buildFunctionCfg(fnNode: SyntaxNode, filePath: string): FunctionCfg | undefined {
+  try {
+    if (!CSHARP_FUNCTION_TYPES.has(fnNode.type)) return undefined;
+    const startLine = startLineOf(fnNode);
+    const endLine = endLineOf(fnNode);
+    const startColumn = fnNode.startPosition.column;
+
+    // The body is a `block` (field `body`) OR an `arrow_expression_clause`
+    // (expression-bodied member) OR an expression (single-expression lambda).
+    const body =
+      fnNode.childForFieldName('body') ?? fnNode.namedChildren.find((c) => c.type === 'block');
+    if (!body) return undefined; // abstract / partial / interface member — no body
+
+    const builder = new CfgBuilder(filePath, startLine, endLine, startColumn);
+    const harvest = new CsharpHarvester(fnNode);
+
+    const paramFacts = harvest.paramFacts();
+    if (paramFacts) builder.attachFacts(builder.entryIndex, paramFacts);
+
+    if (body.type === 'arrow_expression_clause' || body.type !== 'block') {
+      // Expression-bodied member / single-expression lambda: one block whose
+      // value is returned. For an arrow clause the value is its inner expression.
+      const expr = body.type === 'arrow_expression_clause' ? (body.namedChild(0) ?? body) : body;
+      const blk = builder.newBlock(
+        startLineOf(expr),
+        endLineOf(expr),
+        expr.text,
+        'normal',
+        harvest.facts(expr),
+      );
+      builder.edge(builder.entryIndex, blk, 'seq');
+      builder.edge(blk, builder.exitIndex, 'return');
+      return builder.finish(harvest.bindingTable());
+    }
+
+    const walk = new CsharpCfgWalk(builder, harvest);
+    const res = walk.visitSeq(body.namedChildren.filter((c) => c.type !== 'comment'));
+    if (!res) {
+      builder.edge(builder.entryIndex, builder.exitIndex, 'seq'); // empty body
+      return builder.finish(harvest.bindingTable());
+    }
+    builder.edge(builder.entryIndex, res.entry, 'seq');
+    builder.connect(res.exits, builder.exitIndex, 'seq'); // normal fall-off → EXIT
+    return builder.finish(harvest.bindingTable());
+  } catch (err) {
+    // Never throw out of buildFunctionCfg — a malformed AST shape must skip only
+    // this one function's CFG, never drop the whole file's language group (R4).
+    // eslint-disable-next-line no-console
+    console.warn(`[cfg] C# buildFunctionCfg skipped a function in ${filePath}: ${String(err)}`);
+    return undefined;
+  }
+}
+
+/** Whether a node is a C# function this visitor builds a CFG for. */
+function isFunction(node: SyntaxNode): boolean {
+  return CSHARP_FUNCTION_TYPES.has(node.type);
+}
+
+/** The C# CFG visitor. */
+export function createCsharpCfgVisitor(): CfgVisitor<SyntaxNode> {
+  return { buildFunctionCfg, isFunction };
+}
+
+export { CSHARP_FUNCTION_TYPES };
diff --git a/gitnexus/src/core/ingestion/cfg/visitors/dart-harvest.ts b/gitnexus/src/core/ingestion/cfg/visitors/dart-harvest.ts
new file mode 100644
index 000000000..ff26c6971
--- /dev/null
+++ b/gitnexus/src/core/ingestion/cfg/visitors/dart-harvest.ts
@@ -0,0 +1,542 @@
+/**
+ * Dart def/use harvester (#2195) — the Dart analogue of
+ * {@link import('./kotlin-harvest.js').KotlinHarvester} and the Swift / Python /
+ * Rust harvesters. Like them it harvests NO call-site `sites[]` (the call-site
+ * taint substrate is a later step): it emits only the per-function binding table
+ * ({@link BindingEntry}[]) plus {@link StatementFacts} (defs / uses / mayDefs) via
+ * a local {@link FactAccumulator} with no site machinery, so the produced facts
+ * never carry a `sites` key.
+ *
+ * Runs in the parse worker next to the Dart CFG visitor. Output is the binding
+ * table the {@link import('../cfg-builder.js').CfgBuilder} stamps onto the CFG,
+ * plus the per-block def/use facts the reaching-defs / CDG solvers consume.
+ *
+ * Every node-type literal below was grammar-validated against the VENDORED
+ * tree-sitter-dart via the introspection probe before use (mandatory pre-step —
+ * the grammar-literal CI gate maps `dart-harvest.ts → Dart` and fails on a wrong
+ * literal). Dart's grammar splits a function into SIBLING nodes — a
+ * `function_signature` / `method_signature` / getter/setter signature followed by
+ * a sibling `function_body` (the body, NOT a child of the signature) — so this
+ * harvester takes the `function_body` (or a closure's `function_expression`) as
+ * the function node and reaches the signature via the previous sibling.
+ *
+ * Dart shapes pre-empted (verified by a real parse):
+ *  - parameters: `function_signature`/`method_signature`/`setter_signature` own a
+ *    `formal_parameter_list` → `formal_parameter` (each `name:identifier`). A
+ *    closure (`function_expression`) owns `parameters:formal_parameter_list`.
+ *  - `local_variable_declaration` → `initialized_variable_definition`
+ *    (`name:identifier` `= value`). The declaration kind keyword is `inferred_type`
+ *    (`var`), `final_builtin` (`final`), a `type_identifier`/`void_type` (typed),
+ *    or `late` (anon). A bare `var e;` with no initializer still binds the name.
+ *  - `for_loop_parts` — C-style (`init:local_variable_declaration`,
+ *    `condition:`, `update:`) OR for-in (`inferred_type`? `name:identifier` `in`
+ *    `value:` — or a bare `identifier` `in` `value:` over an existing variable).
+ *  - `catch_clause` → `catch_parameters` (`(e)` or `(e, st)` — both bound).
+ *  - reads: `identifier`, `selector` (`.name` / `(...args)` member/call chain),
+ *    `assignment_expression` (`left:assignable_expression` `operator:` `right:`),
+ *    `if_null_expression` (`a ?? b`), `conditional_expression` (`c ? a : b`),
+ *    logical `&&` / `||` (`logical_and_expression` / `logical_or_expression`).
+ *
+ * TWO-PHASE, ORDER-INDEPENDENT (load-bearing — mirrors the Kotlin / Swift / Rust
+ * harvesters): the CFG walk is NOT source-order (`do … while` builds the condition
+ * after the body), so resolving names against a scope stack populated *during* the
+ * walk would mis-resolve. Phase 1 pre-scans the whole function subtree once,
+ * declaring every bound name into ONE function table; phase 2 resolves defs/uses
+ * against that finished table from any walk order. Dart DOES have block scope +
+ * shadowing, but a single function table is the documented v1 simplification used
+ * by the Kotlin / Swift / Python / Rust harvesters — distinct shadowing
+ * redeclarations of the same name collapse onto one binding (an over-approximation
+ * that can falsely kill across a shadow, the sound direction for taint).
+ *
+ * v1 def-semantics scope:
+ *   - `initialized_variable_definition` (`var`/`final`/typed `PAT = …`) — the
+ *     `name:identifier` is a def; the value is walked for uses. A bare declaration
+ *     with no initializer still binds the name (Dart locals are in scope from the
+ *     declaration; an uninitialized read is a compile error, so binding is safe).
+ *   - `assignment_expression` plain `=` — a plain-identifier lvalue is a def; a
+ *     member / subscript target (`this.x = …`, `a[i] = …`) is NOT a scalar def
+ *     (its root is a use). A compound `+=`/`-=`/… target def-AND-uses the lvalue.
+ *   - `postfix_expression` / `prefix_expression` update (`i++` / `--i`) def-and-use.
+ *   - `for (var e in xs)` — the loop pattern name is a def, the collection a use.
+ *   - `catch (e, st)` — both error binders bind.
+ *   - parameters (incl. closure params) are `param`-kind defs.
+ * EXCLUDED, deliberately (TypeScript-CFA precedent): member / subscript writes
+ * (`obj.f = …`, `a[i] = …`) are NOT scalar defs — their root identifiers are uses
+ * only. Nested-function bodies (`function_expression`) are opaque in BOTH directions.
+ *
+ * MAY-DEFS: a def inside a conditionally-evaluated subexpression — the right
+ * operand of `&&` / `||` short-circuit, the `??` right operand, a conditional
+ * (`? :`) arm, and a `switch`-expression / case-pattern test — is a may-def (gen
+ * WITHOUT kill), so the not-taken path's prior def is not falsely killed.
+ *
+ * Identifiers with no in-function declaration (top-level functions, types,
+ * fields) resolve to a SYNTHETIC module-level binding (`name@module`), applied
+ * identically by def and use harvesting.
+ *
+ * NOTE: nothing serialized here may carry a field named `nodeId` — the durable
+ * parsedfile-store reviver dedups objects keyed on that field name.
+ */
+import type { SyntaxNode } from '../../utils/ast-helpers.js';
+import type { BindingEntry, StatementFacts } from '../types.js';
+import { DefUseAccumulator as FactAccumulator } from './call-site-harvest.js';
+
+/** Node types that own a nested CFG — their subtrees are opaque to harvesting. */
+const NESTED_FUNCTION_TYPES = new Set(['function_expression', 'function_body']);
+
+const COMMENT_TYPES = new Set(['comment', 'documentation_comment']);
+
+const FUNCTION_VALUE_TYPES = new Set(['function_expression']);
+
+export class DartHarvester {
+  private readonly bindings: BindingEntry[] = [];
+  /** Single function-scope name → binding index (v1: no block scope). */
+  private readonly table = new Map<string, number>();
+  private readonly synthetic = new Map<string, number>();
+  private readonly fnId: number;
+  /** >0 while walking a conditionally-evaluated subexpression — defs become may-defs. */
+  private conditionalDepth = 0;
+
+  /**
+   * @param fnNode  The function-bearing node: a `function_body` (whose previous
+   *   sibling is the signature carrying the params) or a `function_expression`
+   *   (a closure, carrying its own `parameters`).
+   * @param signature  The previous-sibling signature for a `function_body`, or
+   *   undefined for a `function_expression` (which carries params directly).
+   */
+  constructor(
+    private readonly fnNode: SyntaxNode,
+    private readonly signature: SyntaxNode | undefined,
+  ) {
+    this.fnId = fnNode.id;
+    this.declareParams();
+    const body = this.bodyOf(fnNode);
+    if (body) this.prescan(body);
+  }
+
+  /** The completed binding table — pass to `CfgBuilder.finish`. */
+  bindingTable(): readonly BindingEntry[] {
+    return this.bindings;
+  }
+
+  /** The body subtree to pre-scan: a `function_body`'s `block`/expr, or a closure's body. */
+  private bodyOf(fnNode: SyntaxNode): SyntaxNode | undefined {
+    if (fnNode.type === 'function_expression') {
+      return fnNode.childForFieldName('body') ?? undefined;
+    }
+    // `function_body` — its child `block` or arrow expression.
+    return fnNode.namedChildren.find((c) => !COMMENT_TYPES.has(c.type));
+  }
+
+  // ── parameters ────────────────────────────────────────────────────────────
+
+  /** The `formal_parameter_list` owning this function's params. */
+  private paramList(): SyntaxNode | undefined {
+    if (this.fnNode.type === 'function_expression') {
+      return this.fnNode.childForFieldName('parameters') ?? undefined;
+    }
+    if (!this.signature) return undefined;
+    // A `method_signature` wraps a `function_signature` / getter / setter that
+    // carries the actual `formal_parameter_list`; unwrap one level first.
+    let sig = this.signature;
+    if (sig.type === 'method_signature') {
+      const inner = sig.namedChildren.find(
+        (c) =>
+          c.type === 'function_signature' ||
+          c.type === 'setter_signature' ||
+          c.type === 'getter_signature' ||
+          c.type === 'constructor_signature' ||
+          c.type === 'factory_constructor_signature',
+      );
+      if (inner) sig = inner;
+    }
+    return sig.namedChildren.find((c) => c.type === 'formal_parameter_list');
+  }
+
+  /** Every `formal_parameter`'s bound name node. */
+  private paramNames(): SyntaxNode[] {
+    const list = this.paramList();
+    if (!list) return [];
+    const names: SyntaxNode[] = [];
+    for (const p of list.namedChildren) {
+      if (p.type !== 'formal_parameter') continue;
+      const name =
+        p.childForFieldName('name') ?? p.namedChildren.find((c) => c.type === 'identifier');
+      if (name) names.push(name);
+    }
+    return names;
+  }
+
+  // ── phase 1: declaration pre-scan ────────────────────────────────────────
+
+  private declare(nameNode: SyntaxNode, kind: BindingEntry['kind']): void {
+    const name = nameNode.text;
+    if (!name || name === '_' || this.table.has(name)) return;
+    this.table.set(name, this.bindings.length);
+    this.bindings.push({
+      name,
+      declLine: nameNode.startPosition.row + 1,
+      declColumn: nameNode.startPosition.column,
+      kind,
+    });
+  }
+
+  private declareParams(): void {
+    for (const name of this.paramNames()) this.declare(name, 'param');
+  }
+
+  /**
+   * Pre-scan the function body once, declaring every bound name. Recurses into
+   * compound expressions but NOT into nested function/closure bodies (opaque).
+   */
+  private prescan(node: SyntaxNode): void {
+    const t = node.type;
+    if (FUNCTION_VALUE_TYPES.has(t) && node.id !== this.fnId) return;
+
+    switch (t) {
+      case 'initialized_variable_definition':
+        this.declareInitializedVar(node, 'let');
+        break;
+      case 'for_loop_parts':
+        this.declareForParts(node);
+        break;
+      case 'catch_parameters':
+        this.declareCatchParams(node);
+        break;
+      default:
+        break;
+    }
+
+    for (let i = 0; i < node.namedChildCount; i++) {
+      const c = node.namedChild(i);
+      if (c) this.prescan(c);
+    }
+  }
+
+  /** Declare every name of an `initialized_variable_definition` (`var a = 1, b = 2`). */
+  private declareInitializedVar(node: SyntaxNode, kind: BindingEntry['kind']): void {
+    const name = node.childForFieldName('name');
+    if (name) this.declare(name, kind);
+    // Trailing comma-separated bindings: each `initialized_identifier` (`b = 2`)
+    // names another local that the `name` field alone misses.
+    for (let i = 0; i < node.namedChildCount; i++) {
+      const c = node.namedChild(i);
+      if (c?.type !== 'initialized_identifier') continue;
+      const id = c.namedChildren.find((g) => g.type === 'identifier');
+      if (id) this.declare(id, kind);
+    }
+  }
+
+  /**
+   * Declare a `for`'s loop variable: a C-style `init:local_variable_declaration`
+   * is handled by its own `initialized_variable_definition` recursion; a for-in
+   * binds the `name:identifier` after the optional `inferred_type`/type. A for-in
+   * over an existing variable (`for (e in xs)`) has no declaration — its bare
+   * `identifier` is a use (an assignment target), not a new binding.
+   */
+  private declareForParts(node: SyntaxNode): void {
+    // for-in declares the loop var only when a binder keyword/type precedes it.
+    if (!this.isForIn(node)) return;
+    if (!this.forInDeclares(node)) return;
+    const name = node.childForFieldName('name');
+    if (name) this.declare(name, 'let');
+  }
+
+  /** A `for_loop_parts` is for-in iff it has an `in` keyword child + a `value` field. */
+  private isForIn(node: SyntaxNode): boolean {
+    return node.children.some((c) => c.type === 'in');
+  }
+
+  /** A for-in declares a fresh loop var iff a binder keyword/type precedes the name. */
+  private forInDeclares(node: SyntaxNode): boolean {
+    return node.namedChildren.some(
+      (c) =>
+        c.type === 'inferred_type' ||
+        c.type === 'final_builtin' ||
+        c.type === 'type_identifier' ||
+        c.type === 'void_type',
+    );
+  }
+
+  /** Declare a `catch (e[, st])` error name(s). */
+  private declareCatchParams(node: SyntaxNode): void {
+    for (const id of node.namedChildren) {
+      if (id.type === 'identifier') this.declare(id, 'catch');
+    }
+  }
+
+  // ── phase 2: per-statement fact extraction ───────────────────────────────
+
+  /** Def/use facts for one statement (or construct-header expression) node. */
+  facts(node: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(node.startPosition.row + 1);
+    this.walkValue(node, acc);
+    return acc.finish();
+  }
+
+  /** Facts for an expression whose WHOLE evaluation is conditional (case tests). */
+  factsConditional(node: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(node.startPosition.row + 1);
+    this.conditional(() => this.walkValue(node, acc));
+    return acc.finish();
+  }
+
+  /**
+   * Facts for a `for` head. For-in: the loop var name is a def, the collection a
+   * use. C-style: the init/condition/update sub-expressions are walked for
+   * defs/uses (the init `local_variable_declaration` defines, the condition reads,
+   * the update def-and-uses).
+   */
+  forHeadFacts(parts: SyntaxNode | undefined): StatementFacts | undefined {
+    const line = (parts ?? this.fnNode).startPosition.row + 1;
+    const acc = new FactAccumulator(line);
+    if (!parts) return undefined;
+    if (this.isForIn(parts)) {
+      const value = parts.childForFieldName('value');
+      if (value) this.walkValue(value, acc);
+      // The loop var: a fresh `for (var e in xs)` binder is a def; a
+      // `for (e in xs)` over an existing var also writes it each iteration (a
+      // def). Either way the `name:identifier` is a def of the loop variable.
+      const name = parts.childForFieldName('name');
+      if (name) this.def(name, acc);
+    } else {
+      // C-style: walk init / condition / update.
+      const init = parts.childForFieldName('init');
+      const cond = parts.childForFieldName('condition');
+      const update = parts.childForFieldName('update');
+      if (init) this.walkValue(init, acc);
+      if (cond) this.walkValue(cond, acc);
+      if (update) this.walkValue(update, acc);
+    }
+    return acc.finish();
+  }
+
+  /** ENTRY-block facts for the parameters (defs only). */
+  paramFacts(): StatementFacts | undefined {
+    const acc = new FactAccumulator(this.fnNode.startPosition.row + 1);
+    for (const name of this.paramNames()) this.def(name, acc);
+    return acc.defCount() ? acc.finish() : undefined;
+  }
+
+  /** Def fact(s) for a `catch (e[, st])` — prepend to the handler entry block. */
+  catchParamFacts(catchParams: SyntaxNode | undefined): StatementFacts | undefined {
+    if (!catchParams) return undefined;
+    const acc = new FactAccumulator(catchParams.startPosition.row + 1);
+    for (const id of catchParams.namedChildren) {
+      if (id.type === 'identifier') this.def(id, acc);
+    }
+    return acc.defCount() ? acc.finish() : undefined;
+  }
+
+  private resolve(nameNode: SyntaxNode): number {
+    const name = nameNode.text;
+    const idx = this.table.get(name);
+    if (idx !== undefined) return idx;
+    let syn = this.synthetic.get(name);
+    if (syn === undefined) {
+      syn = this.bindings.length;
+      this.synthetic.set(name, syn);
+      this.bindings.push({ name, declLine: 0, declColumn: 0, kind: 'module', synthetic: true });
+    }
+    return syn;
+  }
+
+  private def(nameNode: SyntaxNode, acc: FactAccumulator): void {
+    if (nameNode.text === '_') return; // blank target defines nothing
+    if (this.conditionalDepth > 0) acc.addMayDef(this.resolve(nameNode));
+    else acc.addDef(this.resolve(nameNode));
+  }
+
+  private use(nameNode: SyntaxNode, acc: FactAccumulator): void {
+    if (nameNode.text === '_') return;
+    acc.addUse(this.resolve(nameNode));
+  }
+
+  /** Run `fn` with defs demoted to may-defs (conditionally-evaluated context). */
+  private conditional(fn: () => void): void {
+    this.conditionalDepth++;
+    try {
+      fn();
+    } finally {
+      this.conditionalDepth--;
+    }
+  }
+
+  /** Value-position walk: collect uses; route def positions to the pattern handler. */
+  private walkValue(node: SyntaxNode, acc: FactAccumulator): void {
+    const t = node.type;
+    if (FUNCTION_VALUE_TYPES.has(t) && node.id !== this.fnId) return; // opaque closure
+
+    switch (t) {
+      case 'identifier':
+        this.use(node, acc);
+        return;
+      case 'initialized_variable_definition': {
+        const value = node.childForFieldName('value');
+        if (value) this.walkValue(value, acc);
+        const name = node.childForFieldName('name');
+        if (name) this.def(name, acc);
+        // Trailing comma-separated bindings (`var a = 1, b = 2;`): each
+        // `initialized_identifier` is an `identifier` + its own value expr.
+        for (let i = 0; i < node.namedChildCount; i++) {
+          const c = node.namedChild(i);
+          if (c?.type !== 'initialized_identifier') continue;
+          const id = c.namedChildren.find((g) => g.type === 'identifier');
+          const val = c.namedChildren.find((g) => g.type !== 'identifier');
+          if (val) this.walkValue(val, acc);
+          if (id) this.def(id, acc);
+        }
+        return;
+      }
+      case 'assignment_expression': {
+        const lvalue = node.childForFieldName('left');
+        const op = node.childForFieldName('operator');
+        const value = node.childForFieldName('right');
+        if (value) this.walkValue(value, acc);
+        // A `right` field can repeat (an identifier + trailing selectors): walk
+        // every named child after the operator that isn't the lvalue.
+        for (const c of node.namedChildren) {
+          if (c === lvalue) continue;
+          if (c.type === 'assignable_expression') continue;
+          if (c === value) continue;
+          this.walkValue(c, acc);
+        }
+        if (lvalue) {
+          const scalar = this.scalarAssignTarget(lvalue);
+          if (scalar) {
+            this.def(scalar, acc);
+            if (op && op.text !== '=') this.use(scalar, acc); // compound assign reads too
+          } else {
+            // `this.x = …`, `a[i] = …` — a member / subscript write is NOT a
+            // scalar def; walk the lvalue so its root identifier is a use.
+            this.walkValue(lvalue, acc);
+          }
+        }
+        return;
+      }
+      case 'postfix_expression':
+      case 'unary_expression': {
+        // `i++` (`postfix_expression`) / `++i` (`unary_expression` with an
+        // `increment_operator`) — the assignable operand is def-and-use. A
+        // `unary_expression` with no `increment_operator` (`!x`, `-x`, `await e`)
+        // is a pure read and falls through to the generic walk below.
+        const isUpdate =
+          t === 'postfix_expression' ||
+          node.namedChildren.some((c) => c.type === 'increment_operator');
+        const operand = isUpdate
+          ? node.namedChildren.find((c) => c.type === 'assignable_expression')
+          : undefined;
+        if (operand) {
+          const scalar = this.scalarAssignTarget(operand);
+          if (scalar) {
+            this.use(scalar, acc);
+            this.def(scalar, acc);
+          } else {
+            // `obj.x++` / `a[i]++` — member/subscript update, not a scalar def.
+            this.walkValue(operand, acc);
+          }
+        } else {
+          for (let i = 0; i < node.namedChildCount; i++) {
+            const c = node.namedChild(i);
+            if (c) this.walkValue(c, acc);
+          }
+        }
+        return;
+      }
+      case 'selector': {
+        // `.name` / `(...args)` — a member-access suffix name is not a scalar
+        // binding; walk the argument part for uses but skip the bare property id.
+        for (const c of node.namedChildren) {
+          if (
+            c.type === 'unconditional_assignable_selector' ||
+            c.type === 'conditional_assignable_selector'
+          ) {
+            continue; // `.name` — property name is not a use
+          }
+          this.walkValue(c, acc);
+        }
+        return;
+      }
+      case 'logical_and_expression':
+      case 'logical_or_expression': {
+        // `a && b` / `a || b` — the right operand is conditionally evaluated.
+        const operands = node.namedChildren.filter((c) => !COMMENT_TYPES.has(c.type));
+        if (operands.length > 0) this.walkValue(operands[0], acc);
+        for (let i = 1; i < operands.length; i++) {
+          const rhs = operands[i];
+          this.conditional(() => this.walkValue(rhs, acc));
+        }
+        return;
+      }
+      case 'if_null_expression': {
+        // `a ?? b` — the right operand only evaluates when the left is null.
+        const operands = node.namedChildren.filter((c) => !COMMENT_TYPES.has(c.type));
+        if (operands.length > 0) this.walkValue(operands[0], acc);
+        for (let i = 1; i < operands.length; i++) {
+          const rhs = operands[i];
+          this.conditional(() => this.walkValue(rhs, acc));
+        }
+        return;
+      }
+      case 'conditional_expression': {
+        // `c ? a : b` — the condition runs always; both arms are conditional.
+        const operands = node.namedChildren.filter((c) => !COMMENT_TYPES.has(c.type));
+        if (operands.length > 0) this.walkValue(operands[0], acc);
+        for (let i = 1; i < operands.length; i++) {
+          const arm = operands[i];
+          this.conditional(() => this.walkValue(arm, acc));
+        }
+        return;
+      }
+      case 'switch_expression': {
+        // `switch (x) { p1 => a, p2 => b }` (Dart 3): the subject runs always;
+        // each arm (pattern + value) is conditional, so a def inside an arm value
+        // (`z = 1`) is a MAY-def, not an unconditional KILL of the prior `z`
+        // (#2206). Mirrors conditional_expression.
+        const subject = node.childForFieldName('condition');
+        if (subject) this.walkValue(subject, acc);
+        for (const c of node.namedChildren) {
+          if (c.type === 'switch_expression_case') {
+            this.conditional(() => this.walkValue(c, acc));
+          }
+        }
+        return;
+      }
+      case 'inferred_type':
+      case 'final_builtin':
+      case 'type_identifier':
+      case 'void_type':
+        // Binding keyword / type position — no scalar value uses.
+        return;
+      default:
+        for (let i = 0; i < node.namedChildCount; i++) {
+          const c = node.namedChild(i);
+          if (c) this.walkValue(c, acc);
+        }
+    }
+  }
+
+  /**
+   * The bare `identifier` of an `assignable_expression` lvalue WHEN it is a
+   * scalar target (`x = …`), or undefined when it is a member / subscript write
+   * (`obj.x = …`, `a[i] = …`) — those carry a trailing
+   * `unconditional_assignable_selector` / `conditional_assignable_selector` /
+   * `index_selector` and are NOT scalar defs (their root identifier is a use).
+   */
+  private scalarAssignTarget(node: SyntaxNode): SyntaxNode | undefined {
+    // Unwrap nested `assignable_expression` wrappers (defensive).
+    let n = node;
+    let hops = 4;
+    while (n.type === 'assignable_expression' && hops-- > 0) {
+      const named = n.namedChildren.filter((c) => !COMMENT_TYPES.has(c.type));
+      // A single bare identifier child ⇒ scalar target; any trailing selector ⇒
+      // member/subscript write (not scalar).
+      if (named.length === 1 && named[0].type === 'identifier') return named[0];
+      if (named.length === 1 && named[0].type === 'assignable_expression') {
+        n = named[0];
+        continue;
+      }
+      return undefined; // identifier + selector(s) — member/subscript write
+    }
+    return n.type === 'identifier' ? n : undefined;
+  }
+}
diff --git a/gitnexus/src/core/ingestion/cfg/visitors/dart.ts b/gitnexus/src/core/ingestion/cfg/visitors/dart.ts
new file mode 100644
index 000000000..64253055c
--- /dev/null
+++ b/gitnexus/src/core/ingestion/cfg/visitors/dart.ts
@@ -0,0 +1,946 @@
+/**
+ * Dart CfgVisitor (#2195) — the VENDORED-GRAMMAR, SPLIT-FUNCTION brace-family
+ * CFG target. Dart's tree-sitter grammar is unusual: a function is NOT a single
+ * wrapping node — a `function_signature` / `method_signature` / `getter_signature`
+ * / `setter_signature` is followed by a SIBLING `function_body` (the body is a
+ * sibling of the signature, under `program` / `class_body`, NOT a child of the
+ * declaration). This visitor therefore treats the `function_body` itself (and a
+ * closure's `function_expression`) as the CFG-bearing node, reaching the params
+ * via the body's previous-sibling signature — exactly the seam the existing
+ * `dartEnclosingFunctionFinder` uses. Every node type and field literal below was
+ * grammar-validated against the vendored tree-sitter-dart via the introspection
+ * probe before use (mandatory pre-step — the grammar-literal CI gate maps
+ * `dart.ts → Dart` and fails on a wrong literal).
+ *
+ * The visitor drives the language-agnostic {@link CfgBuilder} to produce a
+ * serializable {@link FunctionCfg} plus a def/use harvest ({@link DartHarvester})
+ * for the reaching-defs / CDG solvers, structured like the sibling visitors — a
+ * `visit_<node_type>` dispatch over the control-flow taxonomy driving a
+ * per-function {@link ControlFlowContext} for labeled break/continue and the
+ * try/catch/finally completion chain (Dart shares JVM-style `finally` semantics).
+ *
+ * Dart shapes pre-empted (verified by a real parse):
+ *  - `function_body` — `{ block }` OR an arrow body `=> expr ;` (no `block`
+ *    wrapper). A `getter_signature` / `setter_signature` body is the same
+ *    `function_body` shape.
+ *  - `function_expression` (a closure) — fields `parameters:formal_parameter_list`
+ *    and `body:function_expression_body` (itself a `{ block }` or `=> expr`).
+ *  - `block` — `{ statement* }`; statements are its named children.
+ *  - `if_statement` — `if ( COND ) consequence:STMT [ else alternative:STMT ]`.
+ *    The condition is the named child between `(` and `)`; the consequence/
+ *    alternative are a `block` (braced) or a bare statement (`if (c) a();`). An
+ *    `else if` is the nested `if_statement` in the `alternative` field.
+ *  - `for_statement` — `for ( for_loop_parts ) body:STMT`. `for_loop_parts` is
+ *    C-style (`init:` `condition:` `;` `update:`) OR for-in (`inferred_type`?
+ *    `name:identifier` `in` `value:` — or a bare `identifier in value` over an
+ *    existing variable).
+ *  - `while_statement` — `while condition:parenthesized_expression body:STMT`.
+ *  - `do_statement` — BOTTOM-TEST: `do body:STMT while condition:… ;`.
+ *  - `switch_statement` — `switch condition:parenthesized_expression
+ *    body:switch_block`. A `switch_block` holds `switch_statement_case`
+ *    (`case_builtin constant_pattern : STMT*` — an EMPTY case with no statements
+ *    falls through to the next; an optional leading `label` names it) and one
+ *    `switch_statement_default` (`default : STMT*`). Dart cases do NOT fall
+ *    through implicitly EXCEPT an empty case; an explicit `continue LABEL;` jumps
+ *    to the labeled case. `switch_expression` (`{ switch_expression_case* }`,
+ *    `pat => expr`) never falls through.
+ *  - `try_statement` — `try body:block` then `on type? catch_clause? block`
+ *    groups (the `on Type` / `catch (e[, st])` parts are bare children:
+ *    `on` keyword, `type_identifier`, `catch_clause` → `catch_parameters`, and the
+ *    handler `block`) plus an optional `finally_clause` (`finally block`).
+ *  - jumps: `return_statement` (`return [expr] ;`), `break_statement`
+ *    (`break [label] ;`), `continue_statement` (`continue [label] ;`),
+ *    `throw_expression` (in an `expression_statement`), `rethrow_expression`
+ *    (`rethrow ;`), `assert_statement` (`assert ( … ) ;` — may throw).
+ *  - a labeled LOOP (`outer: for …`) parses as a stray `ERROR [identifier :]`
+ *    SIBLING immediately before the `for_statement` (tree-sitter-dart does not
+ *    model a statement label outside a switch); the visitor reads that ERROR
+ *    sibling as a pending label, so `break outer` still resolves.
+ *
+ * Edge-kind contract (matches the existing visitors — RD/CDG consume these):
+ *  - if / else → `cond-true` / `cond-false`
+ *  - `for` / `while` → `cond-true` / `loop-back` / `cond-false`
+ *  - `do … while` → bottom-test: body runs first, condition `loop-back` (true)
+ *    / `cond-false` (exit)
+ *  - `switch` dispatch → `switch-case`; an EMPTY case spills to the next case via
+ *    a `fallthrough` edge, and an explicit `continue LABEL;` is a `fallthrough`
+ *    to the labeled case. A non-empty case rejoins after the switch (no implicit
+ *    fallthrough).
+ *  - try/on/catch → `throw` (every protected-region block → the first handler); a
+ *    `finally` runs on BOTH normal and exception exit, so a `return`/`break`/
+ *    `continue` crossing it threads through (`finally-*` completion edges). A
+ *    `rethrow` re-routes to the next-outer handler / EXIT.
+ *  - return / throw / break / continue / rethrow → the matching terminator kind;
+ *    a labeled `break outer` / `continue outer` targets the labeled loop frame
+ *  - straight-line → `seq`
+ *
+ * Dart-specific modeling decisions (documented approximations):
+ *  - `while (true) {}` / `for (;;) {}` may never terminate; like the C-family /
+ *    Go / Rust / Swift / Kotlin visitors, this visitor ALWAYS emits the
+ *    structural `header → loopExit` `cond-false` escape edge so EXIT stays
+ *    reverse-reachable and the post-dominator / CDG pass is not silently skipped
+ *    for the function. This is the single highest-risk correctness property.
+ *  - try/on/catch: conservative exceptional flow — EVERY block in the protected
+ *    region edges to the first handler (an exception may fire mid-block),
+ *    matching the Java / C# / Swift over-approximation. A `throw` / `rethrow` /
+ *    `assert` with no enclosing handler routes to EXIT (the function propagates
+ *    the error to its caller).
+ *  - a closure (`function_expression`) is collected as its OWN function by
+ *    `isFunction`, so its body gets a standalone CFG; in the ENCLOSING function it
+ *    is an opaque straight-line value (its body is not followed inline).
+ *  - `switch_expression` / `if`-as-expression / `?:` / `??` / `?.` used as a VALUE
+ *    are left INLINE inside their owning statement's block — their conditional
+ *    sub-evaluation is a HARVEST may-def concern (see dart-harvest.ts), not a CFG
+ *    split (consistent with the TS `&&`/`??` treatment).
+ *
+ * Known limitations:
+ *  - block-scope shadowing in the harvest is flattened to one function table (see
+ *    dart-harvest.ts) — a documented v1 over-approximation.
+ *  - `async` / `await` / `async*` / `sync*`: suspension/yield points are normal
+ *    straight-line flow (no scheduler edges). A closure passed to `Future`/stream
+ *    APIs gets its own CFG like any closure.
+ *  - a generative/redirecting constructor's `: initializer` list and a
+ *    `factory` constructor body are NOT modeled as a distinct function node in
+ *    this v1 set (the `function_body` after a `constructor_signature` IS modeled;
+ *    the initializer list runs straight-line into it — documented gap).
+ *
+ * Returns `undefined` (never throws) for an AST shape it cannot model, so a
+ * malformed function never drops the whole file's CFG group (R4).
+ */
+import type { SyntaxNode } from '../../utils/ast-helpers.js';
+import { CfgBuilder } from '../cfg-builder.js';
+import {
+  ControlFlowContext,
+  drainFinalizerPending,
+  wireJumpThroughFinalizers,
+} from '../control-flow-context.js';
+import type { TraversalResult } from '../traversal-result.js';
+import type { CfgVisitor, FunctionCfg } from '../types.js';
+import { DartHarvester } from './dart-harvest.js';
+
+/** Signature node types whose SIBLING `function_body` owns a CFG-bearing body. */
+const DART_SIGNATURE_TYPES = new Set([
+  'function_signature',
+  'method_signature',
+  'getter_signature',
+  'setter_signature',
+  'constructor_signature',
+  'factory_constructor_signature',
+]);
+
+/** Statement node types that break a basic block (everything else coalesces). */
+const CONTROL_FLOW_TYPES = new Set([
+  'if_statement',
+  'for_statement',
+  'while_statement',
+  'do_statement',
+  'switch_statement',
+  'try_statement',
+  'return_statement',
+  'break_statement',
+  'continue_statement',
+  'assert_statement',
+]);
+
+/** Comment node types tree-sitter-dart surfaces. */
+const COMMENT_TYPES = new Set(['comment', 'documentation_comment']);
+
+const startLineOf = (n: SyntaxNode): number => n.startPosition.row + 1;
+const endLineOf = (n: SyntaxNode): number => n.endPosition.row + 1;
+
+const isComment = (n: SyntaxNode): boolean => COMMENT_TYPES.has(n.type);
+
+/** Whether an `expression_statement` is a bare `throw …;`. */
+const isThrowStatement = (n: SyntaxNode): boolean =>
+  n.type === 'expression_statement' && n.namedChildren.some((c) => c.type === 'throw_expression');
+
+/** Whether an `expression_statement` is a bare `rethrow;`. */
+const isRethrowStatement = (n: SyntaxNode): boolean =>
+  n.type === 'expression_statement' && n.namedChildren.some((c) => c.type === 'rethrow_expression');
+
+/**
+ * Whether a node is a LABELED `continue LABEL;` (a switch fallthrough-spill),
+ * vs a bare `continue;` (which targets the enclosing loop). Only the labeled form
+ * is stripped from a case body and handled via {@link caseContinueLabel}.
+ */
+const isLabeledContinue = (n: SyntaxNode): boolean =>
+  n.type === 'continue_statement' && n.namedChildren.some((c) => c.type === 'identifier');
+
+/** A statement sequence that produced no blocks (empty body) is "transparent". */
+type SeqResult = TraversalResult | null;
+
+/**
+ * Per-function Dart walk state. One instance per function so the
+ * {@link ControlFlowContext}, exception-handler stack, and labeled-frame
+ * bookkeeping are scoped to that function and never leak across functions.
+ */
+class DartCfgWalk {
+  private readonly cfc = new ControlFlowContext();
+  /** Stack of exception-handler entry blocks (catch/finally) a `throw` jumps to. */
+  private readonly handlers: number[] = [];
+  /** Label(s) pending attachment to the NEXT pushed loop/switch frame. */
+  private pendingLabels: string[] = [];
+
+  constructor(
+    private readonly builder: CfgBuilder,
+    private readonly harvest: DartHarvester,
+  ) {}
+
+  /** Named statements of a `block`, ignoring comments. */
+  private statementsOf(block: SyntaxNode): SyntaxNode[] {
+    return block.namedChildren.filter((c) => !isComment(c));
+  }
+
+  /** Unwrap a body STMT: a `block` yields its statements; a bare statement is itself. */
+  private visitBody(node: SyntaxNode | undefined | null): SeqResult {
+    return this.builder.withNesting(() => {
+      if (!node) return null;
+      if (node.type === 'block') return this.visitSeq(this.statementsOf(node));
+      if (isComment(node)) return null;
+      return this.visitStmt(node);
+    });
+  }
+
+  /** Wire a sequence of statements, coalescing straight-line runs into blocks. */
+  visitSeq(stmts: SyntaxNode[]): SeqResult {
+    return this.builder.withNesting(() => {
+      let entry: number | undefined;
+      let dangling: number[] = [];
+      let openSimple: number | undefined;
+
+      for (const stmt of stmts) {
+        if (this.isControlFlow(stmt)) {
+          openSimple = undefined; // close any open straight-line block
+          const res = this.visitStmt(stmt);
+          if (res === null) continue; // transparent (empty nested block / label-only)
+          if (entry === undefined) entry = res.entry;
+          else this.builder.connect(dangling, res.entry, 'seq');
+          dangling = [...res.exits];
+        } else {
+          if (openSimple === undefined) {
+            const idx = this.builder.newBlock(
+              startLineOf(stmt),
+              endLineOf(stmt),
+              stmt.text,
+              'normal',
+              this.harvest.facts(stmt),
+            );
+            if (entry === undefined) entry = idx;
+            else this.builder.connect(dangling, idx, 'seq');
+            openSimple = idx;
+            dangling = [idx];
+          } else {
+            this.builder.extendBlock(
+              openSimple,
+              endLineOf(stmt),
+              stmt.text,
+              this.harvest.facts(stmt),
+            );
+          }
+        }
+      }
+
+      if (entry === undefined) return null;
+      return { entry, exits: dangling };
+    });
+  }
+
+  /** Whether a statement node breaks the current straight-line block. */
+  private isControlFlow(stmt: SyntaxNode): boolean {
+    if (this.isLabelError(stmt)) return true; // a stray label sibling — queue it
+    if (isThrowStatement(stmt) || isRethrowStatement(stmt)) return true;
+    return CONTROL_FLOW_TYPES.has(stmt.type);
+  }
+
+  /**
+   * A labeled LOOP outside a switch (`outer: for …`) is mis-parsed by
+   * tree-sitter-dart as a stray `ERROR [identifier :]` SIBLING preceding the
+   * loop. Recognize that exact shape so the label still resolves a `break outer`.
+   */
+  private isLabelError(stmt: SyntaxNode): boolean {
+    if (stmt.type !== 'ERROR') return false;
+    const id = stmt.namedChildren.find((c) => c.type === 'identifier');
+    return id !== undefined && stmt.children.some((c) => c.type === ':');
+  }
+
+  /** Dispatch one statement to its handler. Non-null except for empty / label-only. */
+  visitStmt(stmt: SyntaxNode): SeqResult {
+    if (this.isLabelError(stmt)) {
+      const id = stmt.namedChildren.find((c) => c.type === 'identifier');
+      if (id?.text) this.pendingLabels = [...this.pendingLabels, id.text];
+      return null; // emits no block of its own
+    }
+    if (isThrowStatement(stmt)) return this.visitThrow(stmt);
+    if (isRethrowStatement(stmt)) return this.visitRethrow(stmt);
+    switch (stmt.type) {
+      case 'if_statement':
+        return this.visitIf(stmt);
+      case 'for_statement':
+        return this.visitFor(stmt);
+      case 'while_statement':
+        return this.visitWhile(stmt);
+      case 'do_statement':
+        return this.visitDoWhile(stmt);
+      case 'switch_statement':
+        return this.visitSwitch(stmt);
+      case 'try_statement':
+        return this.visitTry(stmt);
+      case 'return_statement':
+        return this.visitReturn(stmt);
+      case 'break_statement':
+        return this.visitBreak(stmt);
+      case 'continue_statement':
+        return this.visitContinue(stmt);
+      case 'assert_statement':
+        return this.visitAssert(stmt);
+      case 'block':
+        return this.visitSeq(this.statementsOf(stmt));
+      default:
+        return this.visitSimple(stmt);
+    }
+  }
+
+  private visitSimple(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    return { entry: idx, exits: [idx] };
+  }
+
+  /** Take and clear the labels queued by a preceding label sibling. */
+  private takeLabels(): string[] {
+    const labels = this.pendingLabels;
+    this.pendingLabels = [];
+    return labels;
+  }
+
+  // ── jumps (return / throw / rethrow / break / continue / assert) ──────────
+
+  /** `return [expr];` — threads through every active finalizer before EXIT. */
+  private visitReturn(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    wireJumpThroughFinalizers(
+      this.builder,
+      idx,
+      this.cfc.finalizersForReturn(),
+      this.builder.exitIndex,
+      'return',
+    );
+    return { entry: idx, exits: [] };
+  }
+
+  /** `throw e;` — routes to the nearest enclosing handler (catch/finally), else EXIT. */
+  private visitThrow(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    this.builder.edge(idx, this.currentHandler(), 'throw');
+    return { entry: idx, exits: [] };
+  }
+
+  /**
+   * `rethrow;` — re-raises the current exception. Inside a handler it propagates
+   * past the CURRENT catch to the next-outer handler / EXIT, which is exactly
+   * what `currentHandler()` resolves to (the in-flight catch is not on the
+   * handler stack while its own body is walked). Terminates its block.
+   */
+  private visitRethrow(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    this.builder.edge(idx, this.currentHandler(), 'throw');
+    return { entry: idx, exits: [] };
+  }
+
+  private visitBreak(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(startLineOf(stmt), endLineOf(stmt), stmt.text);
+    const label = this.jumpLabel(stmt);
+    const res = this.cfc.resolveBreak(label);
+    const { target, finalizers } = res ?? {
+      target: this.builder.exitIndex,
+      finalizers: this.cfc.finalizersForReturn(),
+    };
+    wireJumpThroughFinalizers(this.builder, idx, finalizers, target, 'break');
+    return { entry: idx, exits: [] };
+  }
+
+  private visitContinue(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(startLineOf(stmt), endLineOf(stmt), stmt.text);
+    const label = this.jumpLabel(stmt);
+    const res = this.cfc.resolveContinue(label);
+    const { target, finalizers } = res ?? {
+      target: this.builder.exitIndex,
+      finalizers: this.cfc.finalizersForReturn(),
+    };
+    wireJumpThroughFinalizers(this.builder, idx, finalizers, target, 'continue');
+    return { entry: idx, exits: [] };
+  }
+
+  /**
+   * `assert ( cond [, msg] );` — may throw an `AssertionError`. Modeled as a
+   * straight-line block that ALSO edges to the current handler (the assertion
+   * may fire), so the error path stays represented while the success path falls
+   * through. Conservative; deduped by the builder.
+   */
+  private visitAssert(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    this.builder.edge(idx, this.currentHandler(), 'throw');
+    return { entry: idx, exits: [idx] };
+  }
+
+  /** The `identifier` label of a `break outer;` / `continue outer;`, if any. */
+  private jumpLabel(stmt: SyntaxNode): string | undefined {
+    const id = stmt.namedChildren.find((c) => c.type === 'identifier');
+    return id?.text || undefined;
+  }
+
+  // ── branches (if/else) ─────────────────────────────────────────────────────
+
+  /**
+   * `if ( COND ) consequence:STMT [ else alternative:STMT ]`. The consequence /
+   * alternative are a `block` or a bare statement; an `else if` is the nested
+   * `if_statement` in the `alternative` field.
+   */
+  private visitIf(stmt: SyntaxNode): TraversalResult {
+    const cond = this.parenCondition(stmt);
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      cond ? endLineOf(cond) : startLineOf(stmt),
+      cond ? `if (${cond.text})` : 'if',
+      'normal',
+      cond ? this.harvest.facts(cond) : undefined,
+    );
+
+    const consequence = stmt.childForFieldName('consequence');
+    const alternative = stmt.childForFieldName('alternative');
+
+    const exits: number[] = [];
+    const thenRes = this.visitBody(consequence);
+    if (thenRes) {
+      this.builder.edge(header, thenRes.entry, 'cond-true');
+      exits.push(...thenRes.exits);
+    } else {
+      exits.push(header); // empty then — true path falls through
+    }
+
+    if (alternative) {
+      const elseRes = this.visitBody(alternative);
+      if (elseRes) {
+        this.builder.edge(header, elseRes.entry, 'cond-false');
+        exits.push(...elseRes.exits);
+      } else {
+        exits.push(header);
+      }
+    } else {
+      exits.push(header); // no else — false path falls through to the join
+    }
+
+    return { entry: header, exits: [...new Set(exits)] };
+  }
+
+  /** The condition expression of an `if` — the named child between `(` and `)`. */
+  private parenCondition(stmt: SyntaxNode): SyntaxNode | undefined {
+    let sawOpen = false;
+    for (let i = 0; i < stmt.childCount; i++) {
+      const c = stmt.child(i);
+      if (!c) continue;
+      if (c.type === '(') {
+        sawOpen = true;
+        continue;
+      }
+      if (c.type === ')') return undefined;
+      if (sawOpen && c.isNamed && !isComment(c)) return c;
+    }
+    return undefined;
+  }
+
+  // ── loops ───────────────────────────────────────────────────────────────
+
+  /** `for ( for_loop_parts ) body:STMT` (C-style and for-in). */
+  private visitFor(stmt: SyntaxNode): TraversalResult {
+    const labels = this.takeLabels();
+    const parts = stmt.namedChildren.find((c) => c.type === 'for_loop_parts');
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      parts ? endLineOf(parts) : startLineOf(stmt),
+      this.forHeaderText(stmt, parts),
+      'normal',
+      this.harvest.forHeadFacts(parts),
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.cfc.pushLoop(header, loopExit, labels);
+    const body = this.visitBody(stmt.childForFieldName('body'));
+    this.cfc.pop();
+
+    if (body) {
+      this.builder.edge(header, body.entry, 'cond-true');
+      this.builder.connect(body.exits, header, 'loop-back');
+    } else {
+      this.builder.edge(header, header, 'loop-back'); // empty body re-iterates
+    }
+    // Structural exit edge — even `for (;;) {}` keeps EXIT reverse-reachable.
+    this.builder.edge(header, loopExit, 'cond-false');
+    return { entry: header, exits: [loopExit] };
+  }
+
+  private forHeaderText(stmt: SyntaxNode, parts: SyntaxNode | undefined): string {
+    return parts ? `for ${parts.text}` : 'for';
+  }
+
+  /** `while condition:parenthesized_expression body:STMT`. */
+  private visitWhile(stmt: SyntaxNode): TraversalResult {
+    const labels = this.takeLabels();
+    const cond = stmt.childForFieldName('condition');
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      cond ? endLineOf(cond) : startLineOf(stmt),
+      cond ? `while ${cond.text}` : 'while',
+      'normal',
+      cond ? this.harvest.facts(cond) : undefined,
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.cfc.pushLoop(header, loopExit, labels);
+    const body = this.visitBody(stmt.childForFieldName('body'));
+    this.cfc.pop();
+
+    if (body) {
+      this.builder.edge(header, body.entry, 'cond-true');
+      this.builder.connect(body.exits, header, 'loop-back');
+    } else {
+      this.builder.edge(header, header, 'loop-back'); // empty body re-tests
+    }
+    // Structural exit edge — even `while (true) {}` keeps EXIT reverse-reachable.
+    this.builder.edge(header, loopExit, 'cond-false');
+    return { entry: header, exits: [loopExit] };
+  }
+
+  /**
+   * `do body:STMT while condition:… ;` — BOTTOM-TEST: the body runs at least
+   * once, THEN the condition decides whether to loop back.
+   */
+  private visitDoWhile(stmt: SyntaxNode): TraversalResult {
+    const labels = this.takeLabels();
+    const cond = stmt.childForFieldName('condition');
+    const condBlock = this.builder.newBlock(
+      cond ? startLineOf(cond) : endLineOf(stmt),
+      cond ? endLineOf(cond) : endLineOf(stmt),
+      cond ? `while ${cond.text}` : 'while',
+      'normal',
+      cond ? this.harvest.facts(cond) : undefined,
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    // `continue` re-tests the condition; `break` leaves the loop.
+    this.cfc.pushLoop(condBlock, loopExit, labels);
+    const body = this.visitBody(stmt.childForFieldName('body'));
+    this.cfc.pop();
+
+    const backTarget = body ? body.entry : condBlock;
+    if (body) this.builder.connect(body.exits, condBlock, 'seq');
+    this.builder.edge(condBlock, backTarget, 'loop-back'); // cond true → run body again
+    // Structural exit edge — even `do {} while (true)` keeps EXIT reachable.
+    this.builder.edge(condBlock, loopExit, 'cond-false');
+    return { entry: backTarget, exits: [loopExit] };
+  }
+
+  // ── switch (no implicit fallthrough; empty-case + continue-label spill) ─────
+
+  /**
+   * `switch condition:parenthesized_expression body:switch_block`. A non-empty
+   * case rejoins after the switch (no implicit fallthrough). An EMPTY case (no
+   * statements) spills into the next case (Dart empty-case fallthrough). An
+   * explicit `continue LABEL;` jumps to the labeled case.
+   */
+  private visitSwitch(stmt: SyntaxNode): TraversalResult {
+    const labels = this.takeLabels();
+    const value = stmt.childForFieldName('condition');
+    const dispatch = this.builder.newBlock(
+      startLineOf(stmt),
+      value ? endLineOf(value) : startLineOf(stmt),
+      value ? `switch ${value.text}` : 'switch',
+      'normal',
+      value ? this.harvest.facts(value) : undefined,
+    );
+    const switchExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    const block = stmt.childForFieldName('body');
+    const cases = block
+      ? block.namedChildren.filter(
+          (c) => c.type === 'switch_statement_case' || c.type === 'switch_statement_default',
+        )
+      : [];
+
+    this.cfc.pushSwitch(switchExit, labels);
+
+    // Phase 1: build each case body. Register case labels so `continue LABEL`
+    // can target a labeled case's entry.
+    const caseBodies: SeqResult[] = [];
+    const caseLabels: (string | undefined)[] = [];
+    for (const c of cases) {
+      caseLabels.push(this.caseLabel(c));
+      // A case-pattern test runs conditionally before the body — harvest its
+      // uses onto the dispatch block (a later case tests only if earlier ones
+      // didn't match; any def there is a may-def).
+      for (const pat of this.casePatterns(c)) {
+        this.builder.attachFacts(dispatch, this.harvest.factsConditional(pat));
+      }
+      caseBodies.push(this.visitSeq(this.caseStatements(c)));
+    }
+
+    // The entry block of each case (its body, or the NEXT non-empty case's entry
+    // for an empty fallthrough case, or switchExit when nothing follows).
+    const entryOf: number[] = new Array(cases.length);
+    let after = switchExit;
+    for (let i = cases.length - 1; i >= 0; i--) {
+      entryOf[i] = caseBodies[i]?.entry ?? after;
+      after = entryOf[i];
+    }
+
+    // Resolve a `continue LABEL` target: the entry of the case carrying LABEL.
+    const labelTarget = (name: string): number | undefined => {
+      const idx = caseLabels.findIndex((l) => l === name);
+      return idx >= 0 ? entryOf[idx] : undefined;
+    };
+
+    const hasDefault = cases.some((c) => c.type === 'switch_statement_default');
+
+    // Dispatch edges: one per case.
+    for (let i = 0; i < cases.length; i++) {
+      this.builder.edge(dispatch, entryOf[i], 'switch-case');
+    }
+    if (!hasDefault) this.builder.edge(dispatch, switchExit, 'switch-case'); // no-match path
+
+    // Case-body completion: a non-empty case rejoins after the switch UNLESS it
+    // ends in an explicit `continue LABEL` (handled as the body's own terminator)
+    // — and an EMPTY case spills into the next case (fallthrough edge). A bare
+    // `break;` inside a case is a normal break to switchExit (the jump handler).
+    for (let i = 0; i < cases.length; i++) {
+      const res = caseBodies[i];
+      const contLabel = this.caseContinueLabel(cases[i]);
+      if (!res) {
+        // Empty case — spill to the next case (or switchExit).
+        this.builder.edge(
+          dispatch,
+          i + 1 < cases.length ? entryOf[i + 1] : switchExit,
+          'fallthrough',
+        );
+        continue;
+      }
+      if (contLabel) {
+        const tgt = labelTarget(contLabel);
+        if (tgt !== undefined) this.builder.connect(res.exits, tgt, 'fallthrough');
+        else this.builder.connect(res.exits, switchExit, 'seq');
+      } else {
+        this.builder.connect(res.exits, switchExit, 'seq');
+      }
+    }
+
+    this.cfc.pop();
+    return { entry: dispatch, exits: [switchExit] };
+  }
+
+  /** The `label` name of a `switch_statement_case` (`myLabel: case …`), if any. */
+  private caseLabel(c: SyntaxNode): string | undefined {
+    const label = c.namedChildren.find((ch) => ch.type === 'label');
+    const id = label?.namedChildren.find((ch) => ch.type === 'identifier');
+    return id?.text || undefined;
+  }
+
+  /**
+   * Case-pattern nodes of a `switch_statement_case` whose test evaluates before
+   * the body — the only DISTINCT pattern node tree-sitter-dart emits is
+   * `constant_pattern` (`case 1:` / `case 1 || 2:`); a relational guard
+   * (`case > 5:`) is a bare `relational_operator` + operand, not a wrapper node.
+   * Harvesting the `constant_pattern` uses onto the dispatch block covers the
+   * common case; the rest fold into the body walk.
+   */
+  private casePatterns(c: SyntaxNode): SyntaxNode[] {
+    return c.namedChildren.filter((ch) => ch.type === 'constant_pattern');
+  }
+
+  /** Body statements of a switch case/default (skip the case keyword/pattern/label). */
+  private caseStatements(c: SyntaxNode): SyntaxNode[] {
+    const NON_BODY = new Set(['case_builtin', 'label', 'constant_pattern']);
+    // A LABELED `continue LABEL;` at a case tail is a fallthrough-spill, handled
+    // via caseContinueLabel — drop it from the body. But a BARE `continue;` targets
+    // the ENCLOSING LOOP (valid Dart) and MUST stay in the body: dropping it
+    // silently removes the jump and fabricates a false case→next-statement
+    // fall-through path. Only drop the labeled form.
+    return c.namedChildren.filter(
+      (ch) => !isComment(ch) && !NON_BODY.has(ch.type) && !isLabeledContinue(ch),
+    );
+  }
+
+  /** A trailing `continue LABEL;` in a case spills to the labeled case. */
+  private caseContinueLabel(c: SyntaxNode): string | undefined {
+    const cont = c.namedChildren.find((ch) => isLabeledContinue(ch));
+    if (!cont) return undefined;
+    const id = cont.namedChildren.find((ch) => ch.type === 'identifier');
+    return id?.text || undefined;
+  }
+
+  // ── try / on / catch / finally ─────────────────────────────────────────────
+
+  /**
+   * `try body:block (on TYPE? catch_clause? block)* finally_clause?`. The handler
+   * groups are bare siblings: an `on type_identifier`, an optional `catch_clause`
+   * (→ `catch_parameters`), and the handler `block`. The `finally` runs on BOTH
+   * normal and exception exit — a `return`/`break`/`continue` crossing it threads
+   * through (`finally-*` completion edges). Mirrors the Java/Kotlin `visitTry`.
+   */
+  private visitTry(stmt: SyntaxNode): SeqResult {
+    const bodyNode = stmt.childForFieldName('body');
+    const finallyClause = stmt.namedChildren.find((c) => c.type === 'finally_clause');
+    const finallyBody = finallyClause?.namedChildren.find((c) => c.type === 'block');
+    const handlerGroups = this.handlerGroups(stmt);
+
+    // The explicit finally is a finalizer the whole protected region threads through.
+    const finallyRes = finallyBody ? this.visitSeq(this.statementsOf(finallyBody)) : null;
+    const finallyFrame = finallyRes ? this.cfc.pushFinalizer(finallyRes.entry) : null;
+    const finalizerEntry = finallyRes?.entry;
+    const finalizerExits = finallyRes?.exits ?? null;
+
+    // Build each catch/on handler.
+    const catchExits: number[] = [];
+    let firstCatchEntry: number | undefined;
+    for (const group of handlerGroups) {
+      const clauseBody = group.block;
+      if (finalizerEntry !== undefined) this.handlers.push(finalizerEntry);
+      let res: SeqResult = clauseBody ? this.visitSeq(this.statementsOf(clauseBody)) : null;
+      if (finalizerEntry !== undefined) this.handlers.pop();
+      if (res === null) {
+        // Empty `on T { }` / `catch (e) {}` still catches — synthesize one block
+        // so exception flow lands somewhere and post-try code stays reachable.
+        const anchor = clauseBody ?? group.catchClause ?? stmt;
+        const idx = this.builder.newBlock(startLineOf(anchor), endLineOf(anchor), '');
+        res = { entry: idx, exits: [idx] };
+      }
+      const paramFacts = this.harvest.catchParamFacts(group.catchParameters);
+      if (paramFacts) {
+        const anchor = group.catchParameters ?? group.catchClause ?? stmt;
+        const paramBlock = this.builder.newBlock(
+          startLineOf(anchor),
+          startLineOf(anchor),
+          '',
+          'normal',
+          paramFacts,
+        );
+        this.builder.edge(paramBlock, res.entry, 'seq');
+        res = { entry: paramBlock, exits: res.exits };
+      }
+      catchExits.push(...res.exits);
+      if (firstCatchEntry === undefined) firstCatchEntry = res.entry;
+    }
+
+    // Handler for the try body: first catch if present, else the finally, else outer.
+    const tryHandler = firstCatchEntry ?? finalizerEntry ?? this.currentHandler();
+    const protectedStart = this.builder.blockCount;
+    this.handlers.push(tryHandler);
+    const bodyRes = bodyNode ? this.visitSeq(this.statementsOf(bodyNode)) : null;
+    this.handlers.pop();
+
+    if (handlerGroups.length > 0 || finalizerEntry !== undefined) {
+      for (let b = protectedStart; b < this.builder.blockCount; b++) {
+        this.builder.edge(b, tryHandler, 'throw');
+      }
+    }
+
+    // Pop the finalizer frame and drain its pending completion legs.
+    if (finallyFrame && finallyRes) {
+      this.cfc.pop();
+      drainFinalizerPending(this.builder, finallyFrame, finallyRes.exits);
+    }
+
+    const exits: number[] = [];
+    if (finalizerEntry !== undefined) {
+      if (bodyRes) this.builder.connect(bodyRes.exits, finalizerEntry, 'seq');
+      for (const e of catchExits) this.builder.edge(e, finalizerEntry, 'seq');
+      if (finalizerExits) exits.push(...finalizerExits);
+      // No catch → an exception re-propagates out after the finally runs.
+      if (handlerGroups.length === 0 && finalizerExits) {
+        this.builder.connect(finalizerExits, this.currentHandler(), 'throw');
+      }
+    } else {
+      if (bodyRes) exits.push(...bodyRes.exits);
+      exits.push(...catchExits);
+    }
+
+    const entry = bodyRes?.entry ?? finalizerEntry ?? firstCatchEntry;
+    if (entry === undefined) return null;
+    return { entry, exits: [...new Set(exits)] };
+  }
+
+  /**
+   * The handler groups of a `try_statement`: each is an `on TYPE` and/or
+   * `catch (params)` plus the handler `block` that follows it. The `on`/`type`/
+   * `catch_clause`/`block` are bare children in source order, so a group is a
+   * `catch_clause` (or an `on` keyword + `type_identifier`) followed by a `block`.
+   */
+  private handlerGroups(
+    stmt: SyntaxNode,
+  ): Array<{ catchClause?: SyntaxNode; catchParameters?: SyntaxNode; block?: SyntaxNode }> {
+    const groups: Array<{
+      catchClause?: SyntaxNode;
+      catchParameters?: SyntaxNode;
+      block?: SyntaxNode;
+    }> = [];
+    const bodyNode = stmt.childForFieldName('body');
+    let pendingCatch: SyntaxNode | undefined;
+    let sawOn = false;
+    for (let i = 0; i < stmt.childCount; i++) {
+      const c = stmt.child(i);
+      if (!c) continue;
+      if (c.type === 'finally_clause') break; // finally is separate
+      if (c.type === 'on') {
+        sawOn = true;
+        continue;
+      }
+      if (c.type === 'catch_clause') {
+        pendingCatch = c;
+        continue;
+      }
+      if (c.type === 'block' && c !== bodyNode) {
+        const catchParameters = pendingCatch?.namedChildren.find(
+          (ch) => ch.type === 'catch_parameters',
+        );
+        groups.push({ catchClause: pendingCatch, catchParameters, block: c });
+        pendingCatch = undefined;
+        sawOn = false;
+      }
+    }
+    // A trailing `on T catch (e)` with no `{}` body is malformed; ignore here.
+    void sawOn;
+    return groups;
+  }
+
+  /** Nearest enclosing exception handler, or the function EXIT. */
+  private currentHandler(): number {
+    return this.handlers.length ? this.handlers[this.handlers.length - 1] : this.builder.exitIndex;
+  }
+}
+
+/** The signature node that precedes a `function_body` (params live there). */
+function signatureFor(fnNode: SyntaxNode): SyntaxNode | undefined {
+  if (fnNode.type !== 'function_body') return undefined;
+  const prev = fnNode.previousSibling;
+  if (!prev) return undefined;
+  if (DART_SIGNATURE_TYPES.has(prev.type)) return prev;
+  // A `method_signature` wraps a `function_signature` / getter / setter — the
+  // params live on the wrapped signature for a plain method but the wrapper still
+  // carries them transitively; return the wrapper (paramList searches its named
+  // children, which include the `formal_parameter_list`).
+  return undefined;
+}
+
+/** The body STMT of a `function_body` / `function_expression`: a `block` or an arrow expr. */
+function bodyAndArrow(fnNode: SyntaxNode): { block?: SyntaxNode; arrowExpr?: SyntaxNode } {
+  let container: SyntaxNode | undefined = fnNode;
+  if (fnNode.type === 'function_expression') {
+    container = fnNode.childForFieldName('body') ?? undefined; // function_expression_body
+  }
+  if (!container) return {};
+  const block = container.namedChildren.find((c) => c.type === 'block');
+  if (block) return { block };
+  // Arrow body `=> expr`: the expression is the first non-comment named child.
+  const arrowExpr = container.namedChildren.find((c) => !COMMENT_TYPES.has(c.type));
+  return { arrowExpr };
+}
+
+/** Build the CFG for one Dart function node, or `undefined` if not modelable. */
+function buildFunctionCfg(fnNode: SyntaxNode, filePath: string): FunctionCfg | undefined {
+  try {
+    if (!isFunction(fnNode)) return undefined;
+    const signature = signatureFor(fnNode);
+    // Anchor the span/column to the signature when present (so same-line
+    // functions `void a(){} void b(){}` get distinct start columns from the
+    // signature, and the span covers the declaration head), else the body node.
+    const anchor = signature ?? fnNode;
+    const startLine = startLineOf(anchor);
+    const endLine = endLineOf(fnNode);
+    const startColumn = anchor.startPosition.column;
+
+    const { block, arrowExpr } = bodyAndArrow(fnNode);
+
+    const builder = new CfgBuilder(filePath, startLine, endLine, startColumn);
+    const harvest = new DartHarvester(fnNode, signature);
+
+    const paramFacts = harvest.paramFacts();
+    if (paramFacts) builder.attachFacts(builder.entryIndex, paramFacts);
+
+    // Arrow body (`=> expr`): one block whose value is returned.
+    if (!block && arrowExpr) {
+      const blk = builder.newBlock(
+        startLineOf(arrowExpr),
+        endLineOf(arrowExpr),
+        arrowExpr.text,
+        'normal',
+        harvest.facts(arrowExpr),
+      );
+      builder.edge(builder.entryIndex, blk, 'seq');
+      builder.edge(blk, builder.exitIndex, 'return');
+      return builder.finish(harvest.bindingTable());
+    }
+
+    const walk = new DartCfgWalk(builder, harvest);
+    const res = block ? walk.visitSeq(block.namedChildren.filter((c) => !isComment(c))) : null;
+
+    if (!res) {
+      builder.edge(builder.entryIndex, builder.exitIndex, 'seq'); // empty body
+      return builder.finish(harvest.bindingTable());
+    }
+    builder.edge(builder.entryIndex, res.entry, 'seq');
+    builder.connect(res.exits, builder.exitIndex, 'seq'); // normal fall-off → EXIT
+    return builder.finish(harvest.bindingTable());
+  } catch (err) {
+    // Never throw out of buildFunctionCfg — a malformed AST shape must skip only
+    // this one function's CFG, never drop the whole file's language group (R4).
+    // eslint-disable-next-line no-console
+    console.warn(`[cfg] Dart buildFunctionCfg skipped a function in ${filePath}: ${String(err)}`);
+    return undefined;
+  }
+}
+
+/**
+ * Whether a node is a Dart function this visitor builds a CFG for: a
+ * `function_body` whose previous sibling is a signature (top-level fn / method /
+ * getter / setter / constructor), or a `function_expression` (a closure).
+ */
+function isFunction(node: SyntaxNode): boolean {
+  if (node.type === 'function_expression') return true;
+  if (node.type !== 'function_body') return false;
+  const prev = node.previousSibling;
+  return prev !== null && DART_SIGNATURE_TYPES.has(prev.type);
+}
+
+/** The Dart CFG visitor. */
+export function createDartCfgVisitor(): CfgVisitor<SyntaxNode> {
+  return { buildFunctionCfg, isFunction };
+}
+
+export { DART_SIGNATURE_TYPES };
diff --git a/gitnexus/src/core/ingestion/cfg/visitors/go-harvest.ts b/gitnexus/src/core/ingestion/cfg/visitors/go-harvest.ts
new file mode 100644
index 000000000..59e1a25f0
--- /dev/null
+++ b/gitnexus/src/core/ingestion/cfg/visitors/go-harvest.ts
@@ -0,0 +1,669 @@
+/**
+ * Go def/use harvester (#2195 U5, plan KTD2) — the Go analogue of
+ * {@link import('./typescript-harvest.js').TsHarvester} and the closely-related
+ * {@link import('./java-harvest.js').JavaHarvester} / {@link
+ * import('./csharp-harvest.js').CsharpHarvester}.
+ *
+ * Runs in the parse worker next to the Go CFG visitor, extracting per-statement
+ * variable definition/use facts that ride the side channel for the reaching-defs
+ * / CDG solvers. Output is the per-function binding table ({@link BindingEntry}[])
+ * plus {@link StatementFacts} the visitor attaches to blocks as it walks.
+ *
+ * Every node type and field literal below was grammar-validated against
+ * tree-sitter-go via the introspection probe before use (mandatory pre-step,
+ * KTD5). Go shapes pre-empted (verified by a real parse):
+ *  - declarations: `short_var_declaration` (`a, b := f()`, fields `left`/`right`
+ *    of `expression_list`s) and `var_declaration` → `var_spec` (fields `name`*,
+ *    `type`?, `value`?) [block form wraps specs in a `var_spec_list`].
+ *  - assignments: `assignment_statement` (fields `left`/`operator`/`right`, all
+ *    `expression_list`s; covers `=`, `+=`, multi-assign `a, b = b, a`), and
+ *    `inc_statement` / `dec_statement` (`x++` / `x--`).
+ *  - loop binders: `range_clause` (`for k, v := range xs`, fields `left`/`right`;
+ *    the `=` reassign form and the bare `for range xs` form both parse here).
+ *  - `selector_expression` (`a.b`, fields `operand`/`field`), `index_expression`
+ *    (`m[k]`, fields `operand`/`index`), `parenthesized_expression`,
+ *    `binary_expression` (fields `left`/`operator`/`right`), `unary_expression`
+ *    (fields `operator`/`operand`; `*p` deref + `<-ch` receive).
+ *
+ * TWO-PHASE, ORDER-INDEPENDENT (load-bearing — mirrors the TS / Java / C#
+ * harvesters): the CFG walk is NOT source-order (`visitFor` builds the init block
+ * after the body, the `for`-clause condition before the update), so resolving
+ * names against a scope stack populated *during* the walk would mis-resolve.
+ * Phase 1 pre-scans the whole function subtree once into a completed lexical
+ * scope tree; phase 2 resolves defs/uses against that finished tree from any
+ * walk order.
+ *
+ * v1 def-semantics scope:
+ *   - `short_var_declaration` `:=` — every identifier in the `left`
+ *     `expression_list` is a def (`a, b := f()` defines BOTH `a` and `b`).
+ *   - `var_declaration` → `var_spec` — an INITIALIZED spec (`var x = 1`,
+ *     `var x int = 1`) defines each `name`; a bare `var x int` writes nothing at
+ *     runtime (not a def, the TS bare-`var` rule).
+ *   - `assignment_statement` (plain `=` + compound `+=` …) — each identifier in
+ *     the `left` list is a def; a compound op also USES the lvalue.
+ *   - `inc_statement` / `dec_statement` (`x++` / `x--`) — def AND use the lvalue.
+ *   - parameters (`parameter_declaration` `name`, incl. variadic), the method
+ *     receiver (`method_declaration` `receiver`), and the `range` loop variables
+ *     (`range_clause` `left`).
+ * EXCLUDED, deliberately (TypeScript-CFA precedent): selector / index / pointer
+ * writes (`obj.f = …`, `m[k] = …`, `*p = …`) are NOT scalar defs — their root
+ * identifiers are uses only. Nested-function (`func_literal`) bodies are opaque in
+ * BOTH directions (writes to and reads of captured outer variables are invisible).
+ *
+ * MAY-DEFS: a def inside a conditionally-evaluated subexpression — the right
+ * operand of `&&` / `||` — is a may-def (gen without kill), so the not-taken
+ * path's prior def is not falsely killed. (Go has no ternary or `??`; assignment
+ * is a statement, not an expression, so in-expression assignment defs do not
+ * occur — `&&`/`||` short-circuit is the only conditional-def shape, and it can
+ * only surface a may-def via a nested closure, which is opaque anyway. The
+ * machinery is kept for switch/select case-test parity.)
+ *
+ * Identifiers with no in-function declaration (package-level vars, imported
+ * names, functions) resolve to a SYNTHETIC module-level binding (`name@module`),
+ * applied identically by def and use harvesting.
+ *
+ * NOTE: nothing serialized here may carry a field named `nodeId` — the durable
+ * parsedfile-store reviver dedups objects keyed on that field name.
+ */
+import type { SyntaxNode } from '../../utils/ast-helpers.js';
+import type { BindingEntry, StatementFacts } from '../types.js';
+import { CallSiteFactAccumulator } from './call-site-harvest.js';
+import { ScopeTreeHarvester, type Scope, type FactAccumulator } from './scope-tree-harvest.js';
+
+/** Node types that own a nested CFG — their subtrees are opaque to harvesting. */
+const NESTED_FUNCTION_TYPES = new Set([
+  'func_literal',
+  'function_declaration',
+  'method_declaration',
+]);
+
+/**
+ * Nodes that open a lexical scope for block-local declarations. A `block` is one
+ * scope; the loop / branch constructs open a scope for their init / loop var; a
+ * switch/select case scopes its case-local declarations.
+ */
+const SCOPE_TYPES = new Set([
+  'block',
+  'for_statement',
+  'if_statement',
+  'expression_switch_statement',
+  'type_switch_statement',
+  'select_statement',
+  'expression_case',
+  'type_case',
+  'default_case',
+  'communication_case',
+]);
+
+export class GoHarvester extends ScopeTreeHarvester {
+  constructor(fnNode: SyntaxNode) {
+    super(fnNode);
+    this.declareReceiver(fnNode);
+    this.declareParams(fnNode);
+    const body = this.bodyOf(fnNode);
+    if (body && body.type === 'block') this.prescan(body, this.openScope(body));
+  }
+
+  /** The function/method/literal body node (always a `block` in Go). */
+  private bodyOf(fnNode: SyntaxNode): SyntaxNode | undefined {
+    return fnNode.childForFieldName('body') ?? undefined;
+  }
+
+  // ── phase 1: declaration pre-scan ────────────────────────────────────────
+
+  /** Go override: `_` is the blank identifier and binds nothing. */
+  protected override declare(nameNode: SyntaxNode, kind: BindingEntry['kind'], scope: Scope): void {
+    const name = nameNode.text;
+    if (!name || name === '_' || scope.table.has(name)) return; // `_` is the blank identifier
+    scope.table.set(name, this.bindings.length);
+    this.bindings.push({
+      name,
+      declLine: nameNode.startPosition.row + 1,
+      declColumn: nameNode.startPosition.column,
+      kind,
+    });
+  }
+
+  /** Method receiver: `func (r *T) M()` — `r` binds at function scope. */
+  private declareReceiver(fnNode: SyntaxNode): void {
+    const recv = fnNode.childForFieldName('receiver');
+    if (!recv) return;
+    for (let i = 0; i < recv.namedChildCount; i++) {
+      const p = recv.namedChild(i);
+      if (p?.type !== 'parameter_declaration') continue;
+      const name = p.childForFieldName('name');
+      if (name) this.declare(name, 'param', this.root);
+    }
+  }
+
+  private declareParams(fnNode: SyntaxNode): void {
+    const params = fnNode.childForFieldName('parameters');
+    if (!params) return;
+    for (let i = 0; i < params.namedChildCount; i++) {
+      const p = params.namedChild(i);
+      if (p?.type !== 'parameter_declaration' && p?.type !== 'variadic_parameter_declaration') {
+        continue;
+      }
+      // A single `parameter_declaration` can name several params: `a, b int`.
+      for (let j = 0; j < p.namedChildCount; j++) {
+        const c = p.namedChild(j);
+        if (c?.type === 'identifier') this.declare(c, 'param', this.root);
+      }
+    }
+  }
+
+  protected prescan(node: SyntaxNode, scope: Scope): void {
+    this.nearestScopeCache.set(node.id, scope);
+    const t = node.type;
+    if (NESTED_FUNCTION_TYPES.has(t) && node.id !== this.fnId) {
+      // A nested function literal is opaque — do not descend.
+      return;
+    }
+
+    let childScope = scope;
+    if (SCOPE_TYPES.has(t)) childScope = this.openScope(node);
+
+    switch (t) {
+      case 'short_var_declaration': {
+        // `a, b := …` — every identifier on the left is a fresh binding.
+        const left = node.childForFieldName('left');
+        if (left) this.declareIdentifiers(left, childScope);
+        break;
+      }
+      case 'var_declaration':
+        this.declareVarDeclaration(node, childScope);
+        break;
+      case 'range_clause': {
+        // `for k, v := range xs` — the `:=` form binds the loop vars; the `=`
+        // reassign form references existing names (not declared here).
+        if (this.rangeIsShort(node)) {
+          const left = node.childForFieldName('left');
+          if (left) this.declareIdentifiers(left, childScope);
+        }
+        break;
+      }
+      case 'type_switch_statement': {
+        // `switch t := i.(type)` — `t` binds once for the whole switch (the
+        // per-case narrowed `t` shares the name).
+        const alias = node.childForFieldName('alias');
+        if (alias) this.declareIdentifiers(alias, childScope);
+        break;
+      }
+      case 'receive_statement': {
+        // `case v := <-ch` inside a select — the `:=` form binds `v`.
+        if (this.receiveIsShort(node)) {
+          const left = node.childForFieldName('left');
+          if (left) this.declareIdentifiers(left, childScope);
+        }
+        break;
+      }
+      default:
+        break;
+    }
+
+    for (let i = 0; i < node.namedChildCount; i++) {
+      const c = node.namedChild(i);
+      if (c) this.prescan(c, childScope);
+    }
+  }
+
+  /** Declare every identifier child of an `expression_list` (LHS of `:=`). */
+  private declareIdentifiers(list: SyntaxNode, scope: Scope): void {
+    for (let i = 0; i < list.namedChildCount; i++) {
+      const c = list.namedChild(i);
+      if (c?.type === 'identifier') this.declare(c, 'var', scope);
+    }
+  }
+
+  /** Declare names of an INITIALIZED `var_spec` (a bare `var x int` writes nothing). */
+  private declareVarDeclaration(declNode: SyntaxNode, scope: Scope): void {
+    const specs = this.varSpecs(declNode);
+    for (const spec of specs) {
+      const hasValue = spec.childForFieldName('value') !== null;
+      if (!hasValue) continue; // bare `var x int` — not a runtime write
+      for (let i = 0; i < spec.namedChildCount; i++) {
+        const c = spec.namedChild(i);
+        if (c?.type === 'identifier') this.declare(c, 'var', scope);
+      }
+    }
+  }
+
+  /** The `var_spec` nodes of a `var_declaration` (single or `var ( … )` block). */
+  private varSpecs(declNode: SyntaxNode): SyntaxNode[] {
+    const out: SyntaxNode[] = [];
+    for (let i = 0; i < declNode.namedChildCount; i++) {
+      const c = declNode.namedChild(i);
+      if (!c) continue;
+      if (c.type === 'var_spec') out.push(c);
+      else if (c.type === 'var_spec_list') {
+        for (let j = 0; j < c.namedChildCount; j++) {
+          const s = c.namedChild(j);
+          if (s?.type === 'var_spec') out.push(s);
+        }
+      }
+    }
+    return out;
+  }
+
+  /** A `range_clause` is the `:=` short form iff it has no `=` operator token. */
+  private rangeIsShort(node: SyntaxNode): boolean {
+    return this.hasAnonChild(node, ':=');
+  }
+
+  /** A `receive_statement` (`case v := <-ch`) is the `:=` short form. */
+  private receiveIsShort(node: SyntaxNode): boolean {
+    return this.hasAnonChild(node, ':=');
+  }
+
+  private hasAnonChild(node: SyntaxNode, text: string): boolean {
+    for (let i = 0; i < node.childCount; i++) {
+      const c = node.child(i);
+      if (c && !c.isNamed && c.text === text) return true;
+    }
+    return false;
+  }
+
+  // ── phase 2: per-statement fact extraction ───────────────────────────────
+
+  /** Def/use facts for one statement (or construct-header expression) node. */
+  facts(node: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(node.startPosition.row + 1);
+    this.walkValue(node, acc);
+    return acc.finish();
+  }
+
+  /** Facts for an expression whose WHOLE evaluation is conditional (case tests). */
+  factsConditional(node: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(node.startPosition.row + 1);
+    this.conditional(() => this.walkValue(node, acc));
+    return acc.finish();
+  }
+
+  /**
+   * Facts for a `for … range right` head: the `:=` loop vars are defs (the `=`
+   * reassign form's vars are also written), and `right` is used.
+   */
+  rangeHeadFacts(rangeClause: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(rangeClause.startPosition.row + 1);
+    const left = rangeClause.childForFieldName('left');
+    const right = rangeClause.childForFieldName('right');
+    if (left) {
+      for (let i = 0; i < left.namedChildCount; i++) {
+        const c = left.namedChild(i);
+        if (c?.type === 'identifier') this.def(c, acc);
+        else if (c) this.walkValue(c, acc);
+      }
+    }
+    if (right) this.walkValue(right, acc);
+    return acc.finish();
+  }
+
+  /**
+   * Facts for a `switch t := i.(type)` head: `t` binds (a def) and the inspected
+   * value is used.
+   */
+  typeSwitchHeadFacts(stmt: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(stmt.startPosition.row + 1);
+    const alias = stmt.childForFieldName('alias');
+    const value = stmt.childForFieldName('value');
+    if (alias) {
+      for (let i = 0; i < alias.namedChildCount; i++) {
+        const c = alias.namedChild(i);
+        if (c?.type === 'identifier') this.def(c, acc);
+      }
+    }
+    if (value) this.walkValue(value, acc);
+    return acc.finish();
+  }
+
+  /** ENTRY-block facts for the receiver + parameters (defs only). */
+  paramFacts(): StatementFacts | undefined {
+    const acc = new FactAccumulator(this.fnNode.startPosition.row + 1);
+    const recv = this.fnNode.childForFieldName('receiver');
+    if (recv) {
+      for (let i = 0; i < recv.namedChildCount; i++) {
+        const p = recv.namedChild(i);
+        if (p?.type !== 'parameter_declaration') continue;
+        const name = p.childForFieldName('name');
+        if (name) this.def(name, acc);
+      }
+    }
+    const params = this.fnNode.childForFieldName('parameters');
+    if (params) {
+      for (let i = 0; i < params.namedChildCount; i++) {
+        const p = params.namedChild(i);
+        if (p?.type !== 'parameter_declaration' && p?.type !== 'variadic_parameter_declaration') {
+          continue;
+        }
+        for (let j = 0; j < p.namedChildCount; j++) {
+          const c = p.namedChild(j);
+          if (c?.type === 'identifier') this.def(c, acc);
+        }
+      }
+    }
+    return acc.defCount() ? acc.finish() : undefined;
+  }
+
+  /** Go override: the blank identifier (`_`) defines nothing. */
+  protected override def(nameNode: SyntaxNode, acc: FactAccumulator): void {
+    if (nameNode.text === '_') return; // blank identifier defines nothing
+    if (this.conditionalDepth > 0) acc.addMayDef(this.resolve(nameNode));
+    else acc.addDef(this.resolve(nameNode));
+  }
+
+  /** Go override: the blank identifier (`_`) is read of nothing. */
+  protected override use(nameNode: SyntaxNode, acc: FactAccumulator): void {
+    if (nameNode.text === '_') return;
+    acc.addUse(this.resolve(nameNode));
+  }
+
+  /** Strip parenthesized wrappers around an lvalue (`(x) = 1`). */
+  private unwrapLvalue(node: SyntaxNode): SyntaxNode {
+    let n = node;
+    let hops = 8;
+    while (n.type === 'parenthesized_expression' && hops-- > 0) {
+      const inner = n.namedChild(0);
+      if (!inner) break;
+      n = inner;
+    }
+    return n;
+  }
+
+  /** Def each identifier of an LHS `expression_list`; route non-identifiers to uses. */
+  private defLeftList(list: SyntaxNode, acc: FactAccumulator, alsoUse: boolean): void {
+    for (let i = 0; i < list.namedChildCount; i++) {
+      const c = list.namedChild(i);
+      if (!c) continue;
+      const lv = this.unwrapLvalue(c);
+      if (lv.type === 'identifier') {
+        this.def(lv, acc);
+        if (alsoUse) this.use(lv, acc); // compound assign (`+=`) reads too
+      } else {
+        // selector / index / pointer-deref target — uses only (root identifier).
+        this.walkValue(lv, acc);
+      }
+    }
+  }
+
+  /** Value-position walk: collect uses; route def positions to the lvalue handler. */
+  private walkValue(node: SyntaxNode, acc: FactAccumulator): void {
+    const t = node.type;
+    if (NESTED_FUNCTION_TYPES.has(t) && node.id !== this.fnId) {
+      // Opaque nested function literal — captured reads/writes are invisible.
+      return;
+    }
+
+    switch (t) {
+      case 'identifier':
+        this.use(node, acc);
+        return;
+      case 'short_var_declaration': {
+        const left = node.childForFieldName('left');
+        const right = node.childForFieldName('right');
+        // Register result-defs BEFORE walking the value so the nested call site
+        // (reached during the value walk) carries them — single-target only
+        // (`x := f(a)`; a multi-target `a, b := f()` attaches nothing).
+        if (left && right) this.registerListResultDefs(left, right);
+        if (right) this.walkValue(right, acc);
+        if (left) {
+          for (let i = 0; i < left.namedChildCount; i++) {
+            const c = left.namedChild(i);
+            if (c?.type === 'identifier') this.def(c, acc);
+          }
+        }
+        return;
+      }
+      case 'var_declaration': {
+        for (const spec of this.varSpecs(node)) {
+          const value = spec.childForFieldName('value');
+          if (value && this.singleSpecName(spec)) this.registerResultDefs(value, [spec]);
+          if (value) this.walkValue(value, acc);
+          if (value) {
+            for (let i = 0; i < spec.namedChildCount; i++) {
+              const c = spec.namedChild(i);
+              if (c?.type === 'identifier') this.def(c, acc);
+            }
+          }
+        }
+        return;
+      }
+      case 'assignment_statement': {
+        const left = node.childForFieldName('left');
+        const right = node.childForFieldName('right');
+        const op = node.childForFieldName('operator')?.text ?? '=';
+        // Plain `x = f(a)` attaches `resultDefs: [x]`; a compound `x += f(a)`
+        // does not (the prior value flows in too).
+        if (op === '=' && left && right) this.registerListResultDefs(left, right);
+        if (right) this.walkValue(right, acc);
+        if (left) this.defLeftList(left, acc, op !== '=');
+        return;
+      }
+      case 'receive_statement': {
+        // `select { case v := <-ch: }` / `case v = <-ch:` — the left
+        // identifier(s) are DEFS of the channel-received value; `<-ch` (right)
+        // is a use of the channel. A bare `case <-ch:` has no left (uses only).
+        const left = node.childForFieldName('left');
+        const right = node.childForFieldName('right');
+        const isShort = node.children.some((c) => !c.isNamed && c.text === ':=');
+        if (isShort && left && right) this.registerListResultDefs(left, right);
+        if (right) this.walkValue(right, acc);
+        if (left) this.defLeftList(left, acc, false);
+        return;
+      }
+      case 'inc_statement':
+      case 'dec_statement': {
+        // `x++` / `x--` — def AND use the lvalue when it's a plain identifier.
+        const operand = node.namedChild(0);
+        const lv = operand ? this.unwrapLvalue(operand) : null;
+        if (lv?.type === 'identifier') {
+          this.def(lv, acc);
+          this.use(lv, acc);
+        } else if (operand) {
+          this.walkValue(operand, acc);
+        }
+        return;
+      }
+      case 'binary_expression': {
+        const left = node.childForFieldName('left');
+        const right = node.childForFieldName('right');
+        const op = node.childForFieldName('operator')?.text ?? '';
+        if (left) this.walkValue(left, acc);
+        if (right) {
+          if (op === '&&' || op === '||') this.conditional(() => this.walkValue(right, acc));
+          else this.walkValue(right, acc);
+        }
+        return;
+      }
+      case 'call_expression':
+        // #2195 U6: explicit case (previously default-descended) — same uses,
+        // plus a taint-site record. Go has no `new` (constructor calls are plain
+        // `call_expression`s). Defs/uses stay byte-identical.
+        this.visitCall(node, acc);
+        return;
+      case 'selector_expression': {
+        // `a.b` — value read of the operand root only; the field name is not a
+        // scalar binding. Mirrors the TS member-read use semantics, plus a
+        // member-read site for the innermost identifier-rooted access.
+        this.walkChain(node, acc, false);
+        return;
+      }
+      default:
+        for (let i = 0; i < node.namedChildCount; i++) {
+          const c = node.namedChild(i);
+          if (c) this.walkValue(c, acc);
+        }
+    }
+  }
+
+  // ── taint-site harvest (#2195 U6) ────────────────────────────────────────
+
+  /** The single `var_spec` name when the spec declares exactly one name, else undefined. */
+  private singleSpecName(spec: SyntaxNode): SyntaxNode | undefined {
+    const names: SyntaxNode[] = [];
+    for (let i = 0; i < spec.namedChildCount; i++) {
+      const c = spec.namedChild(i);
+      if (c?.type === 'identifier') names.push(c);
+    }
+    return names.length === 1 ? names[0] : undefined;
+  }
+
+  /**
+   * Register result-defs for a single-target LHS `expression_list` → RHS
+   * `expression_list` whose sole element is a call. `a, b := f()` (multi-target)
+   * and `x, y := f(), g()` attach nothing — the per-target mapping is ambiguous,
+   * matching the TS harvester's per-declarator restriction.
+   */
+  private registerListResultDefs(left: SyntaxNode, right: SyntaxNode): void {
+    const leftNames = this.listIdentifiers(left);
+    const rightVals = this.listElements(right);
+    if (leftNames.length !== 1 || rightVals.length !== 1) return;
+    this.registerResultDefs(rightVals[0], [leftNames[0]]);
+  }
+
+  /** Identifier elements of an `expression_list` (`a, b` ⇒ [a, b]). */
+  private listIdentifiers(list: SyntaxNode): SyntaxNode[] {
+    const out: SyntaxNode[] = [];
+    for (let i = 0; i < list.namedChildCount; i++) {
+      const c = list.namedChild(i);
+      if (c?.type === 'identifier') out.push(c);
+    }
+    return out;
+  }
+
+  /** Named elements of an `expression_list` (or the node itself if not a list). */
+  private listElements(list: SyntaxNode): SyntaxNode[] {
+    if (list.type !== 'expression_list') return [list];
+    const out: SyntaxNode[] = [];
+    for (let i = 0; i < list.namedChildCount; i++) {
+      const c = list.namedChild(i);
+      if (c) out.push(c);
+    }
+    return out;
+  }
+
+  /**
+   * When `value`'s root (after stripping parens) is a call, remember its site
+   * should carry `resultDefs` — the binding indices of `targets` (def-position
+   * identifiers, resolved against the completed scope tree). Consumed by
+   * {@link visitCall} once the value walk reaches the node.
+   */
+  private registerResultDefs(value: SyntaxNode, targets: readonly SyntaxNode[]): void {
+    const root = this.unwrapLvalue(value);
+    if (root.type !== 'call_expression') return;
+    const defs: number[] = [];
+    for (const target of targets) {
+      // A `var_spec` carries its name(s) as children; an identifier resolves
+      // directly. Skip the blank identifier (`_`), which binds nothing.
+      const names = target.type === 'identifier' ? [target] : this.listIdentifiers(target);
+      for (const n of names) {
+        if (n.text === '_') continue;
+        defs.push(this.resolve(n));
+      }
+    }
+    if (defs.length > 0) this.resultDefTargets.set(root.id, defs);
+  }
+
+  /**
+   * Explicit `call_expression` handler. Records a call site (callee path,
+   * receiver, per-arg occurrence entries, result defs) while reproducing EXACTLY
+   * the uses the old default descent recorded (callee chain root + arguments).
+   */
+  private visitCall(node: SyntaxNode, acc: FactAccumulator): void {
+    const calleeNode = node.childForFieldName('function');
+    const argsNode = node.childForFieldName('arguments');
+    const siteIdx = acc.openCallSite('call');
+    acc.pushFrame(siteIdx);
+    let calleePath: string | undefined;
+    if (calleeNode) {
+      const callee = this.unwrapLvalue(calleeNode);
+      if (callee.type === 'identifier') {
+        if (callee.text !== '_') acc.addUseWithoutOccurrence(this.resolve(callee));
+        calleePath = callee.text;
+      } else if (callee.type === 'selector_expression') {
+        // skipFinalRead: the final `.field` IS the callee, carried by the path.
+        const chain = this.walkChain(callee, acc, true);
+        calleePath = chain.path;
+        if (chain.rootIdx !== undefined) acc.setSiteReceiver(siteIdx, chain.rootIdx);
+      } else {
+        // Call-rooted chains, conversions (`T(x)`), parenthesized funcs — the
+        // walk still records uses and nested sites.
+        this.walkValue(callee, acc);
+      }
+      if (calleePath !== undefined) acc.setSiteCallee(siteIdx, calleePath);
+    }
+    const resultDefs = this.resultDefTargets.get(node.id);
+    if (resultDefs !== undefined) acc.setSiteResultDefs(siteIdx, resultDefs);
+    if (argsNode) {
+      let pos = 0;
+      for (let i = 0; i < argsNode.namedChildCount; i++) {
+        const arg = argsNode.namedChild(i);
+        if (!arg || arg.type === 'comment') continue;
+        // `f(xs...)` — a variadic spread. Mark the first spread position so the
+        // matcher degrades soundly; the inner value still walks for occurrences.
+        if (arg.type === 'variadic_argument') {
+          acc.setFrameArg(pos);
+          acc.setSiteSpread(siteIdx, pos);
+          const inner = arg.namedChild(0);
+          if (inner) this.walkValue(inner, acc);
+        } else {
+          acc.setFrameArg(pos);
+          this.walkValue(arg, acc);
+        }
+        pos++;
+      }
+    }
+    acc.popFrame();
+  }
+
+  /**
+   * `selector_expression` chain walk shared by value position and callee
+   * position. Records the chain-root identifier as a use (identical to the old
+   * default descent) plus at most ONE member-read site — the INNERMOST access —
+   * when the root is an identifier; `skipFinalRead` suppresses it when that
+   * access is the callee (carried by the dotted path instead).
+   */
+  private walkChain(
+    node: SyntaxNode,
+    acc: FactAccumulator,
+    skipFinalRead: boolean,
+  ): { path?: string; rootIdx?: number } {
+    const accesses: string[] = [];
+    let cur: SyntaxNode = this.unwrapLvalue(node);
+    for (;;) {
+      if (cur.type === 'selector_expression') {
+        const field = cur.childForFieldName('field');
+        accesses.unshift(field?.text ?? '');
+        const operand = cur.childForFieldName('operand');
+        if (!operand) break;
+        cur = this.unwrapLvalue(operand);
+      } else {
+        break;
+      }
+    }
+    let rootIdx: number | undefined;
+    let rootSegment: string | undefined;
+    if (cur.type === 'identifier' && cur.text !== '_') {
+      rootIdx = this.resolve(cur);
+      acc.addUse(rootIdx);
+      rootSegment = cur.text;
+    } else {
+      this.walkValue(cur, acc);
+    }
+    const innermost = accesses[0];
+    if (rootIdx !== undefined && innermost && !(skipFinalRead && accesses.length === 1)) {
+      acc.addMemberRead(rootIdx, innermost);
+    }
+    const path =
+      rootSegment !== undefined && accesses.every((a) => a !== '')
+        ? [rootSegment, ...accesses].join('.')
+        : undefined;
+    return { path, rootIdx };
+  }
+}
+
+/**
+ * Ordered, deduplicating def/use + call-site collector for one statement record.
+ * The shared {@link CallSiteFactAccumulator} carries the def/use machinery the
+ * old local class had, plus the taint-site harvest (#2195 U6).
+ */
+const FactAccumulator = CallSiteFactAccumulator;
diff --git a/gitnexus/src/core/ingestion/cfg/visitors/go.ts b/gitnexus/src/core/ingestion/cfg/visitors/go.ts
new file mode 100644
index 000000000..ccd0014e1
--- /dev/null
+++ b/gitnexus/src/core/ingestion/cfg/visitors/go.ts
@@ -0,0 +1,888 @@
+/**
+ * Go CfgVisitor (#2195 U5, plan KTD2) — the highest-divergence C-family target.
+ *
+ * Walks a Go function / method / closure's tree-sitter AST and drives the
+ * language-agnostic {@link CfgBuilder} to produce a serializable
+ * {@link FunctionCfg}, plus a def/use harvest ({@link GoHarvester}) for the
+ * reaching-defs / CDG solvers. Structured like the Java / C# visitors — a
+ * `visit_<node_type>` dispatch over the statement taxonomy, driving a
+ * per-function {@link ControlFlowContext} for labeled break/continue and the
+ * `defer` completion chain (Go's analogue of finally route-through).
+ *
+ * Every node type and field literal below was grammar-validated against
+ * tree-sitter-go via the introspection probe before use (mandatory pre-step,
+ * KTD5). Go shapes pre-empted (verified by a real parse):
+ *  - functions: `function_declaration`, `method_declaration` (field `receiver`),
+ *    `func_literal` — all carry `parameters` + a `body` `block`.
+ *  - `if_statement` fields `initializer`? / `condition` / `consequence` /
+ *    `alternative`?; `else if` ⇒ `alternative` is a nested `if_statement`, plain
+ *    `else` ⇒ `alternative` is a `block` (NO `else_clause` wrapper).
+ *  - `for_statement` — Go's SINGLE loop keyword. `body` is a `block`; the first
+ *    child is a `for_clause` (C-style, fields `initializer`?/`condition`?/`update`?)
+ *    OR a `range_clause` (for-range, fields `left`?/`right`) OR a bare condition
+ *    expression (while-style) OR ABSENT (`for {}` infinite). All four handled.
+ *  - `expression_switch_statement` (fields `initializer`?/`value`?; children
+ *    `expression_case` [field `value`=`expression_list`] / `default_case`) and
+ *    `type_switch_statement` (fields `alias`?/`value`; children `type_case`
+ *    [field `type`] / `default_case`) — cases do NOT fall through by default.
+ *  - `fallthrough_statement` — EXPLICIT fallthrough to the next case (the
+ *    opposite of C; modeled with a `fallthrough` edge).
+ *  - `select_statement` (children `communication_case` [field `communication`=
+ *    `receive_statement`/`send_statement`] / `default_case`).
+ *  - `return_statement` (multiple-return via an `expression_list`),
+ *    `break_statement` / `continue_statement` (BOTH may carry a `label_name`),
+ *    `goto_statement` (`label_name` child), `labeled_statement` (field `label`=
+ *    `label_name`).
+ *  - `defer_statement` / `go_statement` — each wraps a `call_expression`.
+ *
+ * Edge-kind contract (matches the TS / Java / C# visitors — RD/CDG consume these):
+ *  - if/else → `cond-true` / `cond-false`
+ *  - for-loops (all four shapes) → `cond-true` / `loop-back` / `cond-false`
+ *  - switch / select dispatch → `switch-case`; an explicit `fallthrough` → a
+ *    `fallthrough` edge to the next case (Go cases otherwise do NOT fall through)
+ *  - a `return` / normal completion threads through the active `defer` chain as
+ *    `return` (first leg) + `finally-return` (each defer's completion leg)
+ *  - return / break / continue → the matching terminator kind; a labeled
+ *    `break outer;` / `continue outer;` targets the labeled frame, not the
+ *    nearest one
+ *  - straight-line → `seq`
+ *
+ * Go-specific modeling decisions (documented approximations — see the plan U5):
+ *  - `defer f()`: deferred calls run at FUNCTION RETURN in LIFO order. Modeled as
+ *    stacked completion legs (the {@link ControlFlowContext} finalizer machinery,
+ *    Go's analogue of a `finally` route-through): each `defer` pushes a finalizer
+ *    frame that stays active for the rest of the function, so every `return` AND
+ *    the normal fall-off thread through ALL active defers innermost-first (LIFO).
+ *    APPROXIMATION: a `defer` is registered at the point it executes, so a defer
+ *    inside a not-yet-run branch is conservatively treated as active for the
+ *    whole remaining function tail (Go would only run it if that branch ran). The
+ *    panic/recover path is not modeled (documented gap).
+ *  - `go f()`: spawns a goroutine — a SEPARATE flow. Decision (the simpler correct
+ *    option): the `go` call is modeled as a normal straight-line statement in the
+ *    CURRENT CFG and the spawned body is NOT followed inline. When the argument is
+ *    a `go func(){…}()` closure, that `func_literal` is still collected as its OWN
+ *    function by `isFunction` (the worker enumerates every function node), so its
+ *    body gets a standalone CFG — nothing is dropped. A bare `go namedFn()` call's
+ *    callee body lives in its own function CFG already. No edge is dropped, so no
+ *    warning is logged for the common shapes.
+ *  - `select {}` with no `default` BLOCKS forever; `for {}` (and `for cond {}`,
+ *    and a `for {…}` with no `break`) may never terminate. Exactly as the sibling
+ *    visitors emit a structural `header → loopExit` `cond-false` edge for
+ *    `while(true)`, this visitor emits a structural exit-escape edge for EVERY
+ *    for-loop shape AND for a `select` with no default, so EXIT stays
+ *    reverse-reachable from every block — the post-dominator / CDG pass silently
+ *    emits ZERO control-dependence for the function otherwise (CFG / REACHING_DEF
+ *    survive; CDG goes to zero). This is the single highest-risk correctness
+ *    property of the visitor.
+ *
+ * Classic hazards, handled explicitly (mirrors the Java / C# visitors):
+ *  - loops allocate a dedicated loop-exit block so `break` has a target before
+ *    the loop's successor is known; `continue` targets the header / update.
+ *  - labeled `break outer;` / `continue outer;`: the label resolves against the
+ *    frame of the construct it names (a labeled loop / switch / select), NOT the
+ *    nearest enclosing frame. An UNLABELED break never targets a labeled-block
+ *    frame (control-flow-context.ts enforces this).
+ *  - `goto label;`: labels resolve within the function (forward AND backward);
+ *    an unresolved `goto` (label in a sibling scope Go would reject, or malformed)
+ *    routes to EXIT and logs, preserving single-exit.
+ *
+ * Known limitations:
+ *  - `go`/goroutine inter-flow scheduling and channel happens-before are not
+ *    modeled (each goroutine body is an independent CFG).
+ *  - panic / recover: a `panic()` is a normal call here (no abnormal edge), and
+ *    `recover()` inside a deferred closure is opaque; the panic-unwind path
+ *    through defers is not modeled — documented gap, not faked.
+ *  - Def/use harvest scope: see `go-harvest.ts` — selector / index / pointer
+ *    writes are not scalar defs; `func_literal` bodies are opaque in both
+ *    directions.
+ *
+ * Returns `undefined` (never throws) for an AST shape it cannot model, so a
+ * malformed function never drops the whole file's CFG group (R4).
+ */
+import type { SyntaxNode } from '../../utils/ast-helpers.js';
+import { CfgBuilder } from '../cfg-builder.js';
+import {
+  ControlFlowContext,
+  drainFinalizerPending,
+  wireJumpThroughFinalizers,
+} from '../control-flow-context.js';
+import type { FinalizerFrame } from '../control-flow-context.js';
+import type { TraversalResult } from '../traversal-result.js';
+import type { CfgVisitor, FunctionCfg } from '../types.js';
+import { GoHarvester } from './go-harvest.js';
+
+/** Go node types that own a CFG-bearing function body. */
+const GO_FUNCTION_TYPES = new Set(['function_declaration', 'method_declaration', 'func_literal']);
+
+/** Statement node types that break a basic block (everything else coalesces). */
+const CONTROL_FLOW_TYPES = new Set([
+  'if_statement',
+  'for_statement',
+  'expression_switch_statement',
+  'type_switch_statement',
+  'select_statement',
+  'return_statement',
+  'break_statement',
+  'continue_statement',
+  'goto_statement',
+  'labeled_statement',
+  'fallthrough_statement',
+  'defer_statement',
+  'block',
+]);
+
+const startLineOf = (n: SyntaxNode): number => n.startPosition.row + 1;
+const endLineOf = (n: SyntaxNode): number => n.endPosition.row + 1;
+
+/** A statement sequence that produced no blocks (empty body) is "transparent". */
+type SeqResult = TraversalResult | null;
+
+/**
+ * Per-function Go walk state. One instance per function so the
+ * {@link ControlFlowContext}, the `defer` finalizer chain, and the label tables
+ * are scoped to that function and never leak across functions.
+ */
+class GoCfgWalk {
+  private readonly cfc = new ControlFlowContext();
+  /** label name → its `labeled_statement` body's entry block (resolved on demand). */
+  private readonly labelBlocks = new Map<string, number>();
+  /** Pending gotos to a label not yet seen: label → list of source blocks. */
+  private readonly pendingGotos = new Map<string, number[]>();
+  /** Label(s) pending attachment to the NEXT pushed loop/switch/select frame. */
+  private pendingLabels: string[] = [];
+  /**
+   * Active `defer` finalizer frames in source (push) order. Innermost-LIFO is the
+   * REVERSE of this list — `finalizersForReturn()` already yields innermost-first,
+   * matching Go's LIFO defer execution. Frames stay active for the whole function
+   * tail and are drained once at the top-level walk's end.
+   */
+  private readonly deferFrames: FinalizerFrame[] = [];
+
+  constructor(
+    private readonly builder: CfgBuilder,
+    private readonly harvest: GoHarvester,
+  ) {}
+
+  /** Statements of a block node, ignoring comments. */
+  private statementsOf(block: SyntaxNode): SyntaxNode[] {
+    return block.namedChildren.filter((c) => c.type !== 'comment');
+  }
+
+  /** The `body` block of a node. */
+  private bodyBlockOf(node: SyntaxNode): SyntaxNode | undefined {
+    return node.childForFieldName('body') ?? node.namedChildren.find((c) => c.type === 'block');
+  }
+
+  /** Visit a body that may be a `block` or a single statement. */
+  private visitBody(node: SyntaxNode | undefined | null): SeqResult {
+    return this.builder.withNesting(() => {
+      if (!node) return null;
+      if (node.type === 'block') return this.visitSeq(this.statementsOf(node));
+      return this.visitStmt(node);
+    });
+  }
+
+  /** Wire a sequence of statements, coalescing straight-line runs into blocks. */
+  visitSeq(stmts: SyntaxNode[]): SeqResult {
+    return this.builder.withNesting(() => {
+      let entry: number | undefined;
+      let dangling: number[] = [];
+      let openSimple: number | undefined;
+
+      for (const stmt of stmts) {
+        if (CONTROL_FLOW_TYPES.has(stmt.type)) {
+          openSimple = undefined; // close any open straight-line block
+          const res = this.visitStmt(stmt);
+          if (res === null) continue; // transparent (empty nested block)
+          if (entry === undefined) entry = res.entry;
+          else this.builder.connect(dangling, res.entry, 'seq');
+          dangling = [...res.exits];
+        } else {
+          if (openSimple === undefined) {
+            const idx = this.builder.newBlock(
+              startLineOf(stmt),
+              endLineOf(stmt),
+              stmt.text,
+              'normal',
+              this.harvest.facts(stmt),
+            );
+            if (entry === undefined) entry = idx;
+            else this.builder.connect(dangling, idx, 'seq');
+            openSimple = idx;
+            dangling = [idx];
+          } else {
+            this.builder.extendBlock(
+              openSimple,
+              endLineOf(stmt),
+              stmt.text,
+              this.harvest.facts(stmt),
+            );
+          }
+        }
+      }
+
+      if (entry === undefined) return null;
+      return { entry, exits: dangling };
+    });
+  }
+
+  /** Dispatch one statement to its handler. Non-null except for empty blocks. */
+  visitStmt(stmt: SyntaxNode): SeqResult {
+    switch (stmt.type) {
+      case 'if_statement':
+        return this.visitIf(stmt);
+      case 'for_statement':
+        return this.visitFor(stmt);
+      case 'expression_switch_statement':
+        return this.visitExprSwitch(stmt);
+      case 'type_switch_statement':
+        return this.visitTypeSwitch(stmt);
+      case 'select_statement':
+        return this.visitSelect(stmt);
+      case 'return_statement':
+        return this.visitReturn(stmt);
+      case 'break_statement':
+        return this.visitBreak(stmt);
+      case 'continue_statement':
+        return this.visitContinue(stmt);
+      case 'goto_statement':
+        return this.visitGoto(stmt);
+      case 'labeled_statement':
+        return this.visitLabeled(stmt);
+      case 'fallthrough_statement':
+        return this.visitFallthrough(stmt);
+      case 'defer_statement':
+        return this.visitDefer(stmt);
+      case 'block':
+        return this.visitSeq(this.statementsOf(stmt));
+      default:
+        return this.visitSimple(stmt);
+    }
+  }
+
+  private visitSimple(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    return { entry: idx, exits: [idx] };
+  }
+
+  /**
+   * `return [expr…]` — threads through EVERY active `defer` (innermost-first =
+   * LIFO) before EXIT. `finalizersForReturn()` yields the active finalizer frames
+   * innermost-first, which is exactly Go's defer execution order.
+   */
+  private visitReturn(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    wireJumpThroughFinalizers(
+      this.builder,
+      idx,
+      this.cfc.finalizersForReturn(),
+      this.builder.exitIndex,
+      'return',
+    );
+    return { entry: idx, exits: [] };
+  }
+
+  private visitBreak(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(startLineOf(stmt), endLineOf(stmt), stmt.text);
+    const label = this.jumpLabel(stmt);
+    const res = this.cfc.resolveBreak(label);
+    const { target, finalizers } = res ?? {
+      target: this.builder.exitIndex,
+      finalizers: this.cfc.finalizersForReturn(),
+    };
+    wireJumpThroughFinalizers(this.builder, idx, finalizers, target, 'break');
+    return { entry: idx, exits: [] };
+  }
+
+  private visitContinue(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(startLineOf(stmt), endLineOf(stmt), stmt.text);
+    const label = this.jumpLabel(stmt);
+    const res = this.cfc.resolveContinue(label);
+    const { target, finalizers } = res ?? {
+      target: this.builder.exitIndex,
+      finalizers: this.cfc.finalizersForReturn(),
+    };
+    wireJumpThroughFinalizers(this.builder, idx, finalizers, target, 'continue');
+    return { entry: idx, exits: [] };
+  }
+
+  /** The trailing `label_name` of a `break`/`continue`, if any. */
+  private jumpLabel(stmt: SyntaxNode): string | undefined {
+    const id = stmt.namedChildren.find((c) => c.type === 'label_name');
+    return id?.text;
+  }
+
+  /** `goto label;` — route to the label block if known, else defer / EXIT. */
+  private visitGoto(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(startLineOf(stmt), endLineOf(stmt), stmt.text);
+    const label = stmt.namedChildren.find((c) => c.type === 'label_name')?.text;
+    if (label === undefined) {
+      this.builder.edge(idx, this.builder.exitIndex, 'seq'); // malformed — single-exit
+      return { entry: idx, exits: [] };
+    }
+    const target = this.labelBlocks.get(label);
+    if (target !== undefined) {
+      this.builder.edge(idx, target, 'seq'); // backward goto: label already built
+    } else {
+      const list = this.pendingGotos.get(label);
+      if (list) list.push(idx);
+      else this.pendingGotos.set(label, [idx]);
+    }
+    return { entry: idx, exits: [] };
+  }
+
+  /**
+   * `label: <statement>` — the label names the construct it directly wraps. For a
+   * loop / switch / select we forward the label so its pushed frame carries it
+   * (`break outer;` then resolves to it); for any other labeled statement we
+   * register the label block so a `goto label` reaches it.
+   */
+  private visitLabeled(stmt: SyntaxNode): SeqResult {
+    const labelNode = stmt.childForFieldName('label');
+    const label = labelNode?.text;
+    const body =
+      stmt.namedChildren.find((c) => c.id !== labelNode?.id && c.type !== 'comment') ?? null;
+
+    if (label !== undefined && body && this.isBreakableStatement(body)) {
+      // Forward the label to the loop/switch/select frame this statement pushes.
+      this.pendingLabels = [...this.pendingLabels, label];
+      const res = this.visitStmt(body);
+      this.registerLabel(label, res?.entry ?? this.synthLabelBlock(stmt));
+      return res ?? { entry: this.labelBlocks.get(label)!, exits: [] };
+    }
+
+    const res = this.visitBody(body);
+    if (label !== undefined) {
+      const entry = res?.entry ?? this.synthLabelBlock(stmt);
+      this.registerLabel(label, entry);
+      if (!res) return { entry, exits: [entry] };
+    }
+    return res;
+  }
+
+  private synthLabelBlock(stmt: SyntaxNode): number {
+    return this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+  }
+
+  /** Register a resolved label block and wire any forward gotos that waited on it. */
+  private registerLabel(label: string, entry: number): void {
+    this.labelBlocks.set(label, entry);
+    const pending = this.pendingGotos.get(label);
+    if (pending) {
+      for (const from of pending) this.builder.edge(from, entry, 'seq');
+      this.pendingGotos.delete(label);
+    }
+  }
+
+  private isBreakableStatement(node: SyntaxNode): boolean {
+    return (
+      node.type === 'for_statement' ||
+      node.type === 'expression_switch_statement' ||
+      node.type === 'type_switch_statement' ||
+      node.type === 'select_statement'
+    );
+  }
+
+  /** Take and clear the labels queued by an enclosing `labeled_statement`. */
+  private takeLabels(): string[] {
+    const labels = this.pendingLabels;
+    this.pendingLabels = [];
+    return labels;
+  }
+
+  /**
+   * `fallthrough` — EXPLICIT transfer to the next case body (Go cases do not fall
+   * through implicitly). Recorded as a marker block; the enclosing switch wires
+   * the `fallthrough` edge from a case body whose dangling exit is this block.
+   * It carries no normal exit (control leaves to the next case).
+   */
+  private visitFallthrough(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(startLineOf(stmt), endLineOf(stmt), stmt.text);
+    this.fallthroughBlocks.add(idx);
+    return { entry: idx, exits: [idx] };
+  }
+
+  /** Blocks that are an explicit `fallthrough` terminator (per-function). */
+  private readonly fallthroughBlocks = new Set<number>();
+
+  /**
+   * `defer f()` — register the deferred call as a finalizer frame that stays
+   * active for the rest of the function tail. Every later `return` (and the
+   * normal fall-off) threads through it; LIFO across multiple defers falls out of
+   * `finalizersForReturn()` yielding innermost-first. The defer's call expression
+   * carries its def/use facts. The frame is NOT popped here — the top-level walk
+   * drains all defer frames once at function end.
+   */
+  private visitDefer(stmt: SyntaxNode): TraversalResult {
+    // A single facts-only block is created for the deferred call body; it is the
+    // finalizer entry that completion legs route through.
+    const call = stmt.namedChildren.find((c) => c.type !== 'comment') ?? stmt;
+    const deferBlock = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(call),
+    );
+    const frame = this.cfc.pushFinalizer(deferBlock);
+    this.deferFrames.push(frame);
+    // The `defer` statement itself is a no-op at its source position — control
+    // falls straight through to the next statement (the deferred body only runs
+    // at function exit, modeled by the completion-leg threading). We therefore
+    // return a SEPARATE marker block as the in-line position so the deferred
+    // block stays out of the straight-line flow.
+    const marker = this.builder.newBlock(startLineOf(stmt), startLineOf(stmt), '');
+    return { entry: marker, exits: [marker] };
+  }
+
+  /**
+   * Drain the active `defer` chain at function end. Each deferred block is a
+   * single block, so its "exit" is itself; the chain runs innermost-first (LIFO,
+   * matching Go). Returns the block set control reaches AFTER the whole defer
+   * chain runs (to be wired to EXIT by the caller), or `normalExits` unchanged
+   * when there are no defers.
+   *
+   * Two completion sources converge here:
+   *  - `return` statements that crossed these frames registered pending legs via
+   *    `wireJumpThroughFinalizers`; {@link drainFinalizerPending} wires them
+   *    (return → defer[0]; defer[i] → defer[i+1]; defer[last] → EXIT).
+   *  - the function's NORMAL fall-off is threaded explicitly here through the
+   *    same chain (`return` first leg, `finally-return` inter-defer legs); the
+   *    builder de-dups, so legs shared with the return paths collapse.
+   */
+  finishDefers(normalExits: readonly number[]): readonly number[] {
+    if (this.deferFrames.length === 0) return normalExits;
+    // Innermost-first (LIFO): the LAST-registered defer runs first.
+    const lifo = [...this.deferFrames].reverse();
+    // Pop the frames off the active stack and drain any pending completion legs
+    // the return/break handlers registered while these frames were active.
+    for (let i = 0; i < lifo.length; i++) this.cfc.pop();
+    for (const frame of lifo) drainFinalizerPending(this.builder, frame, [frame.entry]);
+
+    // Thread the normal fall-off through the chain innermost-first: the first leg
+    // keeps the bare `return` kind (the "kind ⟹ source terminator" invariant), the
+    // inter-defer legs are `finally-return` completion edges.
+    if (normalExits.length > 0) {
+      this.builder.connect(normalExits, lifo[0].entry, 'return');
+      for (let i = 0; i + 1 < lifo.length; i++) {
+        this.builder.edge(lifo[i].entry, lifo[i + 1].entry, 'finally-return');
+      }
+    }
+    // After the outermost defer runs, control reaches EXIT.
+    return [lifo[lifo.length - 1].entry];
+  }
+
+  /**
+   * Route any forward `goto`s whose label never appeared in the function to EXIT
+   * (single-exit preserved) and log them so a dropped jump is never silent (R4).
+   * Called once after the body walk.
+   */
+  flushGotos(builder: CfgBuilder): void {
+    for (const [label, froms] of this.pendingGotos) {
+      // eslint-disable-next-line no-console
+      console.warn(
+        `[cfg] Go: unresolved goto label "${label}" routed to EXIT (${froms.length} site(s))`,
+      );
+      for (const from of froms) builder.edge(from, builder.exitIndex, 'seq');
+    }
+    this.pendingGotos.clear();
+  }
+
+  private visitIf(stmt: SyntaxNode): TraversalResult {
+    const cond = stmt.childForFieldName('condition') ?? stmt;
+    const init = stmt.childForFieldName('initializer');
+    // The header block carries the (optional) initializer's facts AND the
+    // condition's facts — both evaluate before the branch.
+    const header = this.builder.newBlock(
+      init ? startLineOf(init) : startLineOf(stmt),
+      endLineOf(cond),
+      init ? `${init.text}; ${cond.text}` : cond.text,
+      'normal',
+      this.harvest.facts(cond),
+    );
+    if (init) this.builder.attachFacts(header, this.harvest.facts(init));
+
+    const exits: number[] = [];
+
+    const thenRes = this.visitBody(stmt.childForFieldName('consequence'));
+    if (thenRes) {
+      this.builder.edge(header, thenRes.entry, 'cond-true');
+      exits.push(...thenRes.exits);
+    } else {
+      exits.push(header); // empty then — true path falls through
+    }
+
+    // No `else_clause` wrapper in Go: `alternative` is the else `block` or the
+    // nested `if_statement` of an `else if` chain directly.
+    const elseNode = stmt.childForFieldName('alternative');
+    if (elseNode) {
+      const elseRes = this.visitBody(elseNode);
+      if (elseRes) {
+        this.builder.edge(header, elseRes.entry, 'cond-false');
+        exits.push(...elseRes.exits);
+      } else {
+        exits.push(header);
+      }
+    } else {
+      exits.push(header); // no else — false path falls through to the join
+    }
+
+    return { entry: header, exits: [...new Set(exits)] };
+  }
+
+  /**
+   * `for_statement` — Go's single loop keyword covers all four shapes:
+   *   1. `for clause { }`  (`for_clause`: init?/cond?/update? — C-style)
+   *   2. `for range x { }` (`range_clause`)
+   *   3. `for cond { }`    (a bare condition expression — while-style)
+   *   4. `for { }`         (no header child — infinite)
+   */
+  private visitFor(stmt: SyntaxNode): TraversalResult {
+    const labels = this.takeLabels();
+    const head = this.forHeadChild(stmt);
+    if (head?.type === 'for_clause') return this.visitForClause(stmt, head, labels);
+    if (head?.type === 'range_clause') return this.visitForRange(stmt, head, labels);
+    // While-style (bare condition) or infinite (`for {}`): `head` is the
+    // condition expression (or undefined).
+    return this.visitForCond(stmt, head ?? undefined, labels);
+  }
+
+  /** The header child of a `for_statement` (for_clause / range_clause / cond), or undefined. */
+  private forHeadChild(stmt: SyntaxNode): SyntaxNode | undefined {
+    const body = stmt.childForFieldName('body');
+    return stmt.namedChildren.find((c) => c.id !== body?.id && c.type !== 'comment');
+  }
+
+  private visitForClause(stmt: SyntaxNode, clause: SyntaxNode, labels: string[]): TraversalResult {
+    const init = clause.childForFieldName('initializer');
+    const cond = clause.childForFieldName('condition');
+    const incr = clause.childForFieldName('update');
+
+    const header = this.builder.newBlock(
+      cond ? startLineOf(cond) : startLineOf(stmt),
+      cond ? endLineOf(cond) : startLineOf(stmt),
+      cond ? cond.text : 'for{}',
+      'normal',
+      cond ? this.harvest.facts(cond) : undefined,
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    let incrBlock = header;
+    if (incr) {
+      incrBlock = this.builder.newBlock(
+        startLineOf(incr),
+        endLineOf(incr),
+        incr.text,
+        'normal',
+        this.harvest.facts(incr),
+      );
+      this.builder.edge(incrBlock, header, 'loop-back');
+    }
+
+    this.cfc.pushLoop(incrBlock, loopExit, labels);
+    const body = this.visitBody(this.bodyBlockOf(stmt));
+    this.cfc.pop();
+
+    if (body) {
+      this.builder.edge(header, body.entry, 'cond-true');
+      this.builder.connect(body.exits, incrBlock, incr ? 'seq' : 'loop-back');
+    } else {
+      this.builder.edge(header, incrBlock, 'cond-true');
+      if (!incr) this.builder.edge(header, header, 'loop-back');
+    }
+    // Structural exit edge — `for ;; {}` (no condition) still keeps EXIT
+    // reverse-reachable so CDG is not silently skipped for the function.
+    this.builder.edge(header, loopExit, 'cond-false');
+
+    let entry = header;
+    if (init) {
+      const initBlock = this.builder.newBlock(
+        startLineOf(init),
+        endLineOf(init),
+        init.text,
+        'normal',
+        this.harvest.facts(init),
+      );
+      this.builder.edge(initBlock, header, 'seq');
+      entry = initBlock;
+    }
+    return { entry, exits: [loopExit] };
+  }
+
+  private visitForRange(stmt: SyntaxNode, clause: SyntaxNode, labels: string[]): TraversalResult {
+    // Header carries the range head facts (loop vars are defs, the iterated
+    // expression is a use).
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(clause),
+      clause.text,
+      'normal',
+      this.harvest.rangeHeadFacts(clause),
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.cfc.pushLoop(header, loopExit, labels);
+    const body = this.visitBody(this.bodyBlockOf(stmt));
+    this.cfc.pop();
+
+    if (body) {
+      this.builder.edge(header, body.entry, 'cond-true');
+      this.builder.connect(body.exits, header, 'loop-back');
+    } else {
+      this.builder.edge(header, header, 'loop-back');
+    }
+    this.builder.edge(header, loopExit, 'cond-false');
+    return { entry: header, exits: [loopExit] };
+  }
+
+  private visitForCond(
+    stmt: SyntaxNode,
+    cond: SyntaxNode | undefined,
+    labels: string[],
+  ): TraversalResult {
+    const header = this.builder.newBlock(
+      cond ? startLineOf(cond) : startLineOf(stmt),
+      cond ? endLineOf(cond) : startLineOf(stmt),
+      cond ? cond.text : 'for{}',
+      'normal',
+      cond ? this.harvest.facts(cond) : undefined,
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.cfc.pushLoop(header, loopExit, labels);
+    const body = this.visitBody(this.bodyBlockOf(stmt));
+    this.cfc.pop();
+
+    if (body) {
+      this.builder.edge(header, body.entry, 'cond-true');
+      this.builder.connect(body.exits, header, 'loop-back');
+    } else {
+      this.builder.edge(header, header, 'loop-back'); // empty `for {}` body re-tests
+    }
+    // Always emit the structural exit edge — even `for {}` (infinite, no
+    // condition) and `for cond {}` keep EXIT reverse-reachable for the CDG pass.
+    this.builder.edge(header, loopExit, 'cond-false');
+    return { entry: header, exits: [loopExit] };
+  }
+
+  private visitExprSwitch(stmt: SyntaxNode): TraversalResult {
+    const labels = this.takeLabels();
+    const value = stmt.childForFieldName('value');
+    const init = stmt.childForFieldName('initializer');
+    const dispatch = this.builder.newBlock(
+      startLineOf(stmt),
+      value ? endLineOf(value) : startLineOf(stmt),
+      value ? value.text : 'switch{}',
+      'normal',
+      value ? this.harvest.facts(value) : undefined,
+    );
+    if (init) this.builder.attachFacts(dispatch, this.harvest.facts(init));
+    const switchExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.cfc.pushSwitch(switchExit, labels);
+    const cases = stmt.namedChildren.filter(
+      (c) => c.type === 'expression_case' || c.type === 'default_case',
+    );
+
+    // Each `expression_case`'s test value(s) evaluate before the body — harvest
+    // their uses CONDITIONALLY onto the dispatch block (a later case only tests
+    // when earlier cases didn't match).
+    for (const c of cases) {
+      if (c.type !== 'expression_case') continue;
+      const test = c.childForFieldName('value');
+      if (test) this.builder.attachFacts(dispatch, this.harvest.factsConditional(test));
+    }
+
+    const result = this.buildCases(dispatch, switchExit, cases, (c) => this.exprCaseBody(c));
+    this.cfc.pop();
+    return result;
+  }
+
+  private visitTypeSwitch(stmt: SyntaxNode): TraversalResult {
+    const labels = this.takeLabels();
+    const dispatch = this.builder.newBlock(
+      startLineOf(stmt),
+      startLineOf(stmt),
+      this.typeSwitchHeaderText(stmt),
+      'normal',
+      this.harvest.typeSwitchHeadFacts(stmt),
+    );
+    const switchExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.cfc.pushSwitch(switchExit, labels);
+    const cases = stmt.namedChildren.filter(
+      (c) => c.type === 'type_case' || c.type === 'default_case',
+    );
+    const result = this.buildCases(dispatch, switchExit, cases, (c) => this.typeCaseBody(c));
+    this.cfc.pop();
+    return result;
+  }
+
+  private visitSelect(stmt: SyntaxNode): TraversalResult {
+    const labels = this.takeLabels();
+    const dispatch = this.builder.newBlock(startLineOf(stmt), startLineOf(stmt), 'select');
+    const selectExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.cfc.pushSwitch(selectExit, labels);
+    const cases = stmt.namedChildren.filter(
+      (c) => c.type === 'communication_case' || c.type === 'default_case',
+    );
+
+    // A comm case's communication clause (`v := <-ch` / `ch <- x`) evaluates as
+    // part of dispatch — harvest its facts onto the dispatch block.
+    for (const c of cases) {
+      if (c.type !== 'communication_case') continue;
+      const comm = c.childForFieldName('communication');
+      if (comm) this.builder.attachFacts(dispatch, this.harvest.facts(comm));
+    }
+
+    const hasDefault = cases.some((c) => c.type === 'default_case');
+    const result = this.buildCases(dispatch, selectExit, cases, (c) => this.commCaseBody(c));
+
+    // A `select` with NO default BLOCKS until a case is ready — and a `select {}`
+    // with no cases at all blocks forever. Either way EXIT must stay
+    // reverse-reachable: emit a structural escape edge dispatch → selectExit so
+    // the CDG pass is not silently skipped for the function.
+    if (!hasDefault) this.builder.edge(dispatch, selectExit, 'switch-case');
+
+    this.cfc.pop();
+    return result;
+  }
+
+  /**
+   * Shared dispatch builder for expression-switch / type-switch / select. Cases
+   * do NOT fall through by default (the opposite of C); an EXPLICIT
+   * `fallthrough` block in a case body spills into the NEXT case instead of the
+   * switch exit. `default_case` is the no-match target; without one, the dispatch
+   * also reaches the switch exit directly (no-match path).
+   */
+  private buildCases(
+    dispatch: number,
+    switchExit: number,
+    cases: SyntaxNode[],
+    bodyOf: (c: SyntaxNode) => SyntaxNode[],
+  ): TraversalResult {
+    const caseResults = cases.map((c) => this.visitSeq(bodyOf(c)));
+    const hasDefault = cases.some((c) => c.type === 'default_case');
+
+    const entryOf: number[] = new Array(cases.length);
+    let after = switchExit;
+    for (let i = cases.length - 1; i >= 0; i--) {
+      entryOf[i] = caseResults[i]?.entry ?? after;
+      after = entryOf[i];
+    }
+
+    for (let i = 0; i < cases.length; i++) {
+      this.builder.edge(dispatch, entryOf[i], 'switch-case');
+    }
+    if (!hasDefault) this.builder.edge(dispatch, switchExit, 'switch-case'); // no-match path
+
+    // Case bodies rejoin AFTER the switch (no implicit fallthrough), UNLESS the
+    // body ends in an explicit `fallthrough`, which spills into the next case.
+    for (let i = 0; i < cases.length; i++) {
+      const res = caseResults[i];
+      if (!res) continue;
+      const fallTarget = i + 1 < cases.length ? entryOf[i + 1] : switchExit;
+      for (const ex of res.exits) {
+        if (this.fallthroughBlocks.has(ex)) {
+          this.builder.edge(ex, fallTarget, 'fallthrough');
+        } else {
+          this.builder.edge(ex, switchExit, 'seq');
+        }
+      }
+    }
+
+    return { entry: dispatch, exits: [switchExit] };
+  }
+
+  /** `expression_case` body statements (everything but the `value` test). */
+  private exprCaseBody(caseNode: SyntaxNode): SyntaxNode[] {
+    const value = caseNode.childForFieldName('value');
+    return caseNode.namedChildren.filter((c) => c.id !== value?.id && c.type !== 'comment');
+  }
+
+  /** `type_case` body statements (everything but the `type` field children). */
+  private typeCaseBody(caseNode: SyntaxNode): SyntaxNode[] {
+    const typeIds = new Set<number>();
+    // All `type` field children (a type_case may list several types).
+    for (let i = 0; i < caseNode.childCount; i++) {
+      if (caseNode.fieldNameForChild(i) === 'type') {
+        const c = caseNode.child(i);
+        if (c) typeIds.add(c.id);
+      }
+    }
+    return caseNode.namedChildren.filter((c) => !typeIds.has(c.id) && c.type !== 'comment');
+  }
+
+  /** `communication_case` body statements (everything but the `communication` clause). */
+  private commCaseBody(caseNode: SyntaxNode): SyntaxNode[] {
+    const comm = caseNode.childForFieldName('communication');
+    return caseNode.namedChildren.filter((c) => c.id !== comm?.id && c.type !== 'comment');
+  }
+
+  private typeSwitchHeaderText(stmt: SyntaxNode): string {
+    const alias = stmt.childForFieldName('alias')?.text;
+    const value = stmt.childForFieldName('value')?.text ?? '';
+    return alias ? `switch ${alias} := ${value}.(type)` : `switch ${value}.(type)`;
+  }
+}
+
+/** Build the CFG for one Go function node, or `undefined` if not modelable. */
+function buildFunctionCfg(fnNode: SyntaxNode, filePath: string): FunctionCfg | undefined {
+  try {
+    if (!GO_FUNCTION_TYPES.has(fnNode.type)) return undefined;
+    const startLine = startLineOf(fnNode);
+    const endLine = endLineOf(fnNode);
+    const startColumn = fnNode.startPosition.column;
+
+    const body = fnNode.childForFieldName('body');
+    if (!body || body.type !== 'block') return undefined; // forward decl / interface method
+
+    const builder = new CfgBuilder(filePath, startLine, endLine, startColumn);
+    const harvest = new GoHarvester(fnNode);
+
+    const paramFacts = harvest.paramFacts();
+    if (paramFacts) builder.attachFacts(builder.entryIndex, paramFacts);
+
+    const walk = new GoCfgWalk(builder, harvest);
+    const res = walk.visitSeq(body.namedChildren.filter((c) => c.type !== 'comment'));
+
+    builder.edge(builder.entryIndex, res ? res.entry : builder.exitIndex, 'seq');
+    // Normal fall-off threads through the active `defer` chain (LIFO) → EXIT.
+    const normalExits = res ? res.exits : [builder.entryIndex];
+    const afterDefers = walk.finishDefers(normalExits);
+    builder.connect(afterDefers, builder.exitIndex, 'seq');
+    walk.flushGotos(builder);
+    return builder.finish(harvest.bindingTable());
+  } catch (err) {
+    // Never throw out of buildFunctionCfg — a malformed AST shape must skip only
+    // this one function's CFG, never drop the whole file's language group (R4).
+    // eslint-disable-next-line no-console
+    console.warn(`[cfg] Go buildFunctionCfg skipped a function in ${filePath}: ${String(err)}`);
+    return undefined;
+  }
+}
+
+/** Whether a node is a Go function this visitor builds a CFG for. */
+function isFunction(node: SyntaxNode): boolean {
+  return GO_FUNCTION_TYPES.has(node.type);
+}
+
+/** The Go CFG visitor. */
+export function createGoCfgVisitor(): CfgVisitor<SyntaxNode> {
+  return { buildFunctionCfg, isFunction };
+}
+
+export { GO_FUNCTION_TYPES };
diff --git a/gitnexus/src/core/ingestion/cfg/visitors/java-harvest.ts b/gitnexus/src/core/ingestion/cfg/visitors/java-harvest.ts
new file mode 100644
index 000000000..549d212f7
--- /dev/null
+++ b/gitnexus/src/core/ingestion/cfg/visitors/java-harvest.ts
@@ -0,0 +1,517 @@
+/**
+ * Java def/use harvester (#2195 U4, plan KTD2) — the Java analogue of
+ * {@link import('./typescript-harvest.js').TsHarvester} and the closely-related
+ * {@link import('./csharp-harvest.js').CsharpHarvester}.
+ *
+ * Runs in the parse worker next to the Java CFG visitor, extracting per-statement
+ * variable definition/use facts that ride the side channel for the reaching-defs
+ * / CDG solvers. Output is the per-function binding table ({@link BindingEntry}[])
+ * plus {@link StatementFacts} the visitor attaches to blocks as it walks.
+ *
+ * TWO-PHASE, ORDER-INDEPENDENT (load-bearing — mirrors the TS / C# harvesters):
+ * the CFG walk is NOT source-order (`visitFor` builds the init block after the
+ * body, `visitDoWhile` the condition before the body), so resolving names against
+ * a scope stack populated *during* the walk would mis-resolve. Phase 1 pre-scans
+ * the whole function subtree once into a completed lexical scope tree; phase 2
+ * resolves defs/uses against that finished tree from any walk order.
+ *
+ * v1 def-semantics scope:
+ *   - `local_variable_declaration` → `variable_declarator` (an INITIALIZED local
+ *     is a def; a bare `int x;` with no initializer writes nothing at runtime —
+ *     not a def, like the TS bare-`var` rule).
+ *   - `assignment_expression` (plain + compound `+=` etc.) and `update_expression`
+ *     (`x++` / `--x`) — define and (for compound / update) also use the lvalue.
+ *   - parameters (`formal_parameter` / `spread_parameter` → `name`), the
+ *     enhanced-for loop variable (`enhanced_for_statement` field `name`), and
+ *     catch parameters (`catch_formal_parameter` → `name`), incl. multi-catch.
+ * EXCLUDED, deliberately (TypeScript-CFA precedent): field / array writes
+ * (`obj.f = …`, `a[i] = …`) are NOT scalar defs — their identifiers are uses
+ * only. Nested-function (lambda) bodies are opaque in BOTH directions (writes to
+ * and reads of captured outer variables are invisible).
+ *
+ * MAY-DEFS: a def inside a conditionally-evaluated subexpression — the right
+ * operand of `&&` / `||` (`a && (x = f())`), a ternary arm, or a switch case test
+ * — is a may-def (gen without kill), so the not-taken path's prior def is not
+ * falsely killed. (Java has no `??`.)
+ *
+ * Identifiers with no in-function declaration (fields, statics, imported names)
+ * resolve to a SYNTHETIC module-level binding (`name@module`), applied
+ * identically by def and use harvesting.
+ *
+ * NOTE: nothing serialized here may carry a field named `nodeId` — the durable
+ * parsedfile-store reviver dedups objects keyed on that field name.
+ */
+import type { SyntaxNode } from '../../utils/ast-helpers.js';
+import type { BindingEntry, StatementFacts } from '../types.js';
+import { CallSiteFactAccumulator } from './call-site-harvest.js';
+import { ScopeTreeHarvester, type Scope, type FactAccumulator } from './scope-tree-harvest.js';
+
+/** Node types that own a nested CFG — their subtrees are opaque to harvesting. */
+const NESTED_FUNCTION_TYPES = new Set([
+  'lambda_expression',
+  'method_declaration',
+  'constructor_declaration',
+  'compact_constructor_declaration',
+]);
+
+/**
+ * Nodes that open a lexical scope for block-local declarations. A `block` is one
+ * scope; the loop constructs open a scope for their loop variable; a
+ * `catch_clause` scopes its exception name; a `try_with_resources_statement`
+ * scopes its resource declarations; a switch group/rule scopes its statements.
+ */
+const SCOPE_TYPES = new Set([
+  'block',
+  'for_statement',
+  'enhanced_for_statement',
+  'while_statement',
+  'do_statement',
+  'catch_clause',
+  'try_with_resources_statement',
+  'switch_block_statement_group',
+  'switch_rule',
+]);
+
+/** Comment node types tree-sitter-java surfaces (NOT `comment`). */
+const COMMENT_TYPES = new Set(['line_comment', 'block_comment']);
+
+export class JavaHarvester extends ScopeTreeHarvester {
+  constructor(fnNode: SyntaxNode) {
+    super(fnNode);
+    this.declareParams(fnNode);
+    const body = this.bodyOf(fnNode);
+    if (body && body.type === 'block') this.prescan(body, this.openScope(body));
+  }
+
+  /** The function/lambda body node (a `block`, or an expression for `x -> expr`). */
+  private bodyOf(fnNode: SyntaxNode): SyntaxNode | undefined {
+    const body = fnNode.childForFieldName('body');
+    if (body) return body;
+    return fnNode.namedChildren.find((c) => c.type === 'block');
+  }
+
+  // ── phase 1: declaration pre-scan ────────────────────────────────────────
+
+  private declareParams(fnNode: SyntaxNode): void {
+    const params = fnNode.childForFieldName('parameters');
+    if (!params) {
+      // Lambda single un-parenthesized parameter: `x -> …` (a bare identifier).
+      const lambdaParam = fnNode.namedChildren.find((c) => c.type === 'identifier');
+      if (fnNode.type === 'lambda_expression' && lambdaParam) {
+        this.declare(lambdaParam, 'param', this.root);
+      }
+      // Lambda inferred parameters: `(x, y) -> …`.
+      const inferred = fnNode.namedChildren.find((c) => c.type === 'inferred_parameters');
+      if (inferred) {
+        for (let i = 0; i < inferred.namedChildCount; i++) {
+          const p = inferred.namedChild(i);
+          if (p?.type === 'identifier') this.declare(p, 'param', this.root);
+        }
+      }
+      return;
+    }
+    for (let i = 0; i < params.namedChildCount; i++) {
+      const p = params.namedChild(i);
+      if (p?.type !== 'formal_parameter' && p?.type !== 'spread_parameter') continue;
+      const name = this.paramName(p);
+      if (name) this.declare(name, 'param', this.root);
+    }
+  }
+
+  /** The `name` identifier of a `formal_parameter` / `spread_parameter`. */
+  private paramName(param: SyntaxNode): SyntaxNode | undefined {
+    const named = param.childForFieldName('name');
+    if (named) return named;
+    // `spread_parameter` (`int... xs`) exposes its name through a nested
+    // variable_declarator rather than a `name` field.
+    const declarator = param.namedChildren.find((c) => c.type === 'variable_declarator');
+    return declarator?.childForFieldName('name');
+  }
+
+  protected prescan(node: SyntaxNode, scope: Scope): void {
+    this.nearestScopeCache.set(node.id, scope);
+    const t = node.type;
+    if (NESTED_FUNCTION_TYPES.has(t) && node.id !== this.fnId) {
+      // A nested function / lambda body is opaque — do not descend.
+      return;
+    }
+
+    let childScope = scope;
+    if (SCOPE_TYPES.has(t)) childScope = this.openScope(node);
+
+    switch (t) {
+      case 'local_variable_declaration':
+        this.declareVariableDeclaration(node, childScope);
+        break;
+      case 'enhanced_for_statement': {
+        const name = node.childForFieldName('name');
+        if (name) this.declare(name, 'var', childScope);
+        break;
+      }
+      case 'resource': {
+        // `try (var f = open())` — the resource binds in the try scope.
+        const name = node.childForFieldName('name');
+        if (name) this.declare(name, 'var', childScope);
+        break;
+      }
+      case 'catch_clause': {
+        const param = node.namedChildren.find((c) => c.type === 'catch_formal_parameter');
+        const name = param?.childForFieldName('name');
+        if (name) this.declare(name, 'catch', childScope);
+        break;
+      }
+      default:
+        break;
+    }
+
+    for (let i = 0; i < node.namedChildCount; i++) {
+      const c = node.namedChild(i);
+      if (c) this.prescan(c, childScope);
+    }
+  }
+
+  /** Declare every `variable_declarator` name in a `local_variable_declaration`. */
+  private declareVariableDeclaration(declNode: SyntaxNode, scope: Scope): void {
+    for (let i = 0; i < declNode.namedChildCount; i++) {
+      const d = declNode.namedChild(i);
+      if (d?.type !== 'variable_declarator') continue;
+      const name = d.childForFieldName('name');
+      if (name) this.declare(name, 'var', scope);
+    }
+  }
+
+  // ── phase 2: per-statement fact extraction ───────────────────────────────
+
+  /** Def/use facts for one statement (or construct-header expression) node. */
+  facts(node: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(node.startPosition.row + 1);
+    this.walkValue(node, acc);
+    return acc.finish();
+  }
+
+  /** Facts for an expression whose WHOLE evaluation is conditional (case tests). */
+  factsConditional(node: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(node.startPosition.row + 1);
+    this.conditional(() => this.walkValue(node, acc));
+    return acc.finish();
+  }
+
+  /** Facts for a `for (T name : value)` head: name binds, value is used. */
+  forEachHeadFacts(stmt: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(stmt.startPosition.row + 1);
+    const name = stmt.childForFieldName('name');
+    const value = stmt.childForFieldName('value');
+    if (name) this.def(name, acc);
+    if (value) this.walkValue(value, acc);
+    return acc.finish();
+  }
+
+  /** Facts for the resource-close finalizer: each resource is USED on close. */
+  resourceCloseFacts(resources: readonly SyntaxNode[]): StatementFacts | undefined {
+    const first = resources[0];
+    if (!first) return undefined;
+    const acc = new FactAccumulator(first.startPosition.row + 1);
+    for (const r of resources) {
+      const name = r.childForFieldName('name');
+      if (name) this.use(name, acc);
+    }
+    return acc.useCount() ? acc.finish() : undefined;
+  }
+
+  /** ENTRY-block facts for the function's parameters (defs only). */
+  paramFacts(): StatementFacts | undefined {
+    const acc = new FactAccumulator(this.fnNode.startPosition.row + 1);
+    const params = this.fnNode.childForFieldName('parameters');
+    if (params) {
+      for (let i = 0; i < params.namedChildCount; i++) {
+        const p = params.namedChild(i);
+        if (p?.type !== 'formal_parameter' && p?.type !== 'spread_parameter') continue;
+        const name = this.paramName(p);
+        if (name) this.def(name, acc);
+      }
+    } else if (this.fnNode.type === 'lambda_expression') {
+      const lambdaParam = this.fnNode.namedChildren.find((c) => c.type === 'identifier');
+      if (lambdaParam) this.def(lambdaParam, acc);
+      const inferred = this.fnNode.namedChildren.find((c) => c.type === 'inferred_parameters');
+      if (inferred) {
+        for (let i = 0; i < inferred.namedChildCount; i++) {
+          const p = inferred.namedChild(i);
+          if (p?.type === 'identifier') this.def(p, acc);
+        }
+      }
+    }
+    return acc.defCount() ? acc.finish() : undefined;
+  }
+
+  /** Def fact for a `catch (T e)` parameter — prepend to the handler entry block. */
+  catchParamFacts(catchClause: SyntaxNode): StatementFacts | undefined {
+    const param = catchClause.namedChildren.find((c) => c.type === 'catch_formal_parameter');
+    const name = param?.childForFieldName('name');
+    if (!name) return undefined;
+    const acc = new FactAccumulator(catchClause.startPosition.row + 1);
+    this.def(name, acc);
+    return acc.defCount() ? acc.finish() : undefined;
+  }
+
+  /** Strip parenthesized wrappers around an lvalue (`(x) = 1`). */
+  private unwrapLvalue(node: SyntaxNode): SyntaxNode {
+    let n = node;
+    let hops = 8;
+    while (n.type === 'parenthesized_expression' && hops-- > 0) {
+      const inner = n.namedChildren.find((c) => !COMMENT_TYPES.has(c.type));
+      if (!inner) break;
+      n = inner;
+    }
+    return n;
+  }
+
+  /** Value-position walk: collect uses; route def positions to the lvalue handler. */
+  private walkValue(node: SyntaxNode, acc: FactAccumulator): void {
+    const t = node.type;
+    if (NESTED_FUNCTION_TYPES.has(t) && node.id !== this.fnId) {
+      // Opaque nested function / lambda — captured reads/writes are invisible.
+      return;
+    }
+
+    switch (t) {
+      case 'identifier':
+        this.use(node, acc);
+        return;
+      case 'local_variable_declaration': {
+        for (let i = 0; i < node.namedChildCount; i++) {
+          const d = node.namedChild(i);
+          if (d?.type !== 'variable_declarator') continue;
+          const name = d.childForFieldName('name');
+          const value = d.childForFieldName('value');
+          // Only an INITIALIZED declarator writes (`int x = e;`). A bare
+          // `int x;` is not a def (it writes nothing at runtime), matching the
+          // TS bare-`var` rule.
+          if (name && value) {
+            const snap = acc.defSnapshot();
+            this.def(name, acc);
+            this.registerResultDefs(value, acc.defsSince(snap));
+          }
+          if (value) this.walkValue(value, acc);
+        }
+        return;
+      }
+      case 'assignment_expression': {
+        const left = node.childForFieldName('left');
+        const right = node.childForFieldName('right');
+        const op = node.childForFieldName('operator')?.text ?? '=';
+        if (left) {
+          const lv = this.unwrapLvalue(left);
+          if (lv.type === 'identifier') {
+            const snap = acc.defSnapshot();
+            this.def(lv, acc);
+            if (op !== '=') this.use(lv, acc); // compound assign reads too
+            if (op === '=' && right) this.registerResultDefs(right, acc.defsSince(snap));
+          } else {
+            this.walkValue(lv, acc); // field/array target — uses only
+          }
+        }
+        if (right) this.walkValue(right, acc);
+        return;
+      }
+      case 'update_expression': {
+        // `x++` / `++x` / `x--` / `--x` — the only writing unary ops. The operand
+        // is an anonymous (non-field) child; treat as def+use when it's an
+        // identifier.
+        const operand = this.updateOperand(node);
+        const lv = operand ? this.unwrapLvalue(operand) : null;
+        if (lv?.type === 'identifier') {
+          this.def(lv, acc);
+          this.use(lv, acc);
+        } else if (operand) {
+          this.walkValue(operand, acc);
+        }
+        return;
+      }
+      case 'binary_expression': {
+        const left = node.childForFieldName('left');
+        const right = node.childForFieldName('right');
+        const op = node.childForFieldName('operator')?.text ?? '';
+        if (left) this.walkValue(left, acc);
+        if (right) {
+          if (op === '&&' || op === '||') this.conditional(() => this.walkValue(right, acc));
+          else this.walkValue(right, acc);
+        }
+        return;
+      }
+      case 'ternary_expression': {
+        const cond = node.childForFieldName('condition');
+        const cons = node.childForFieldName('consequence');
+        const alt = node.childForFieldName('alternative');
+        if (cond) this.walkValue(cond, acc);
+        if (cons) this.conditional(() => this.walkValue(cons, acc));
+        if (alt) this.conditional(() => this.walkValue(alt, acc));
+        return;
+      }
+      case 'method_invocation':
+        // #2195 U6: explicit case (previously default-descended) — same uses,
+        // plus a taint-site record. Defs/uses stay byte-identical.
+        this.visitCall(node, acc);
+        return;
+      case 'object_creation_expression':
+        // `new Foo(x)` — constructor call site (`type` field is the callee).
+        this.visitNew(node, acc);
+        return;
+      case 'field_access': {
+        // `a.b` — value read of the object root only; the field name is not a
+        // scalar binding. Mirrors the TS member-read use semantics, plus a
+        // member-read site for the innermost identifier-rooted access.
+        this.walkChain(node, acc, false);
+        return;
+      }
+      default:
+        for (let i = 0; i < node.namedChildCount; i++) {
+          const c = node.namedChild(i);
+          if (c) this.walkValue(c, acc);
+        }
+    }
+  }
+
+  // ── taint-site harvest (#2195 U6) ────────────────────────────────────────
+
+  /**
+   * When `value`'s root (after stripping parens) is a method-invocation /
+   * object-creation node, remember its site should carry `resultDefs: defs`.
+   */
+  private registerResultDefs(value: SyntaxNode, defs: readonly number[]): void {
+    if (defs.length === 0) return;
+    const root = this.unwrapLvalue(value);
+    if (root.type === 'method_invocation' || root.type === 'object_creation_expression') {
+      this.resultDefTargets.set(root.id, [...defs]);
+    }
+  }
+
+  /**
+   * Explicit `method_invocation` handler. Unlike a member-chain callee, Java
+   * carries the method NAME on the `name` field and the receiver on a sibling
+   * `object` field (`db.query(x)` ⇒ object `db`, name `query`); a bare call
+   * (`exec(x)`) has no `object`. Reproduces EXACTLY the uses the old default
+   * descent recorded (object root + arguments) and adds the call site.
+   */
+  private visitCall(node: SyntaxNode, acc: FactAccumulator): void {
+    const objectNode = node.childForFieldName('object');
+    const nameNode = node.childForFieldName('name');
+    const argsNode = node.childForFieldName('arguments');
+    const siteIdx = acc.openCallSite('call');
+    acc.pushFrame(siteIdx);
+    let receiverPath: string | undefined;
+    if (objectNode) {
+      // The receiver is a value read (object chain root) — record its uses and
+      // the member-read sites, and capture its dotted path + binding root.
+      const chain = this.walkChain(objectNode, acc, false);
+      receiverPath = chain.path;
+      if (chain.rootIdx !== undefined) acc.setSiteReceiver(siteIdx, chain.rootIdx);
+    }
+    if (nameNode) {
+      // The method NAME was a (synthetic) statement-level use under the old
+      // default descent — preserve it byte-identically, but never as a value
+      // occurrence in an enclosing argument (`exec(escape(x))` must not put the
+      // `escape` name into exec's arg 0).
+      acc.addUseWithoutOccurrence(this.resolve(nameNode));
+      const callee =
+        receiverPath !== undefined ? `${receiverPath}.${nameNode.text}` : nameNode.text;
+      acc.setSiteCallee(siteIdx, callee);
+    }
+    const resultDefs = this.resultDefTargets.get(node.id);
+    if (resultDefs !== undefined) acc.setSiteResultDefs(siteIdx, resultDefs);
+    this.walkArgs(argsNode, acc);
+    acc.popFrame();
+  }
+
+  /** Explicit `object_creation_expression` (`new Foo(x)`) handler. */
+  private visitNew(node: SyntaxNode, acc: FactAccumulator): void {
+    const typeNode = node.childForFieldName('type');
+    const argsNode = node.childForFieldName('arguments');
+    const siteIdx = acc.openCallSite('new');
+    acc.pushFrame(siteIdx);
+    if (typeNode) {
+      // The type name is not a scalar binding — record it only as the callee
+      // path, never a use/occurrence (matches the type-position semantics).
+      acc.setSiteCallee(siteIdx, typeNode.text.replace(/\s+/g, ''));
+    }
+    const resultDefs = this.resultDefTargets.get(node.id);
+    if (resultDefs !== undefined) acc.setSiteResultDefs(siteIdx, resultDefs);
+    this.walkArgs(argsNode, acc);
+    acc.popFrame();
+  }
+
+  /** Walk an `argument_list`, tagging each positional argument for occurrences. */
+  private walkArgs(argsNode: SyntaxNode | null, acc: FactAccumulator): void {
+    if (!argsNode) return;
+    let pos = 0;
+    for (let i = 0; i < argsNode.namedChildCount; i++) {
+      const arg = argsNode.namedChild(i);
+      if (!arg || COMMENT_TYPES.has(arg.type)) continue;
+      acc.setFrameArg(pos);
+      this.walkValue(arg, acc);
+      pos++;
+    }
+  }
+
+  /**
+   * `field_access` chain walk shared by value position and the method-invocation
+   * receiver. Records the chain-root identifier as a use (identical to the old
+   * default descent) plus at most ONE member-read site — the INNERMOST access —
+   * when the root is an identifier; `skipFinalRead` suppresses it when that
+   * access is the callee (never the case for `field_access`, which is value-only).
+   */
+  private walkChain(
+    node: SyntaxNode,
+    acc: FactAccumulator,
+    skipFinalRead: boolean,
+  ): { path?: string; rootIdx?: number } {
+    const accesses: string[] = [];
+    let cur: SyntaxNode = this.unwrapLvalue(node);
+    for (;;) {
+      if (cur.type === 'field_access') {
+        const field = cur.childForFieldName('field');
+        accesses.unshift(field?.text ?? '');
+        const obj = cur.childForFieldName('object');
+        if (!obj) break;
+        cur = this.unwrapLvalue(obj);
+      } else {
+        break;
+      }
+    }
+    let rootIdx: number | undefined;
+    let rootSegment: string | undefined;
+    if (cur.type === 'identifier') {
+      rootIdx = this.resolve(cur);
+      acc.addUse(rootIdx);
+      rootSegment = cur.text;
+    } else if (cur.type === 'this' || cur.type === 'super') {
+      rootSegment = cur.text; // `this`/`super` are path segments, never bind
+    } else {
+      this.walkValue(cur, acc);
+    }
+    const innermost = accesses[0];
+    if (rootIdx !== undefined && innermost && !(skipFinalRead && accesses.length === 1)) {
+      acc.addMemberRead(rootIdx, innermost);
+    }
+    const path =
+      rootSegment !== undefined && accesses.every((a) => a !== '')
+        ? [rootSegment, ...accesses].join('.')
+        : undefined;
+    return { path, rootIdx };
+  }
+
+  /** The operand identifier of an `update_expression` (`x++` / `--x`). */
+  private updateOperand(node: SyntaxNode): SyntaxNode | undefined {
+    for (let i = 0; i < node.namedChildCount; i++) {
+      const c = node.namedChild(i);
+      if (c && !COMMENT_TYPES.has(c.type)) return c;
+    }
+    return undefined;
+  }
+}
+
+/**
+ * Ordered, deduplicating def/use + call-site collector for one statement record.
+ * The shared {@link CallSiteFactAccumulator} carries the def/use machinery the
+ * old local class had, plus the taint-site harvest (#2195 U6).
+ */
+const FactAccumulator = CallSiteFactAccumulator;
diff --git a/gitnexus/src/core/ingestion/cfg/visitors/java.ts b/gitnexus/src/core/ingestion/cfg/visitors/java.ts
new file mode 100644
index 000000000..f9ba90a7a
--- /dev/null
+++ b/gitnexus/src/core/ingestion/cfg/visitors/java.ts
@@ -0,0 +1,1004 @@
+/**
+ * Java CfgVisitor (#2195 U4, plan KTD2).
+ *
+ * Walks a Java method/constructor/lambda's tree-sitter AST and drives the
+ * language-agnostic {@link CfgBuilder} to produce a serializable
+ * {@link FunctionCfg}, plus a def/use harvest ({@link JavaHarvester}) for the
+ * reaching-defs / CDG solvers. Structured like the C# visitor — a
+ * `visit_<node_type>` dispatch over the statement taxonomy, driving a
+ * per-function {@link ControlFlowContext} — because Java shares C#'s `finally`
+ * semantics (try/finally, try-with-resources auto-close = finally, labeled
+ * break/continue), which the finalizer-frame + labeled-frame machinery in
+ * `control-flow-context.ts` models.
+ *
+ * Every node type and field literal below was grammar-validated against
+ * tree-sitter-java via the introspection probe before use (mandatory pre-step,
+ * KTD5). Known Java surprises pre-empted (verified by a real parse):
+ *  - Generics are `generic_type` (NOT `parameterized_type`, which this grammar
+ *    does not have).
+ *  - BOTH the classic colon `switch` and the arrow `switch` parse under
+ *    `switch_expression` (there is no `switch_statement` node). Its body is a
+ *    `switch_block` (field `body`). A classic group is a
+ *    `switch_block_statement_group` (`switch_label` + statements, FALLS THROUGH);
+ *    an arrow rule is a `switch_rule` (`switch_label` `->` one body, does NOT
+ *    fall through). Case tests live in a `switch_label`.
+ *  - Comments are `line_comment` / `block_comment` (NOT `comment`).
+ *  - An `if`/`while`/`do`/`synchronized` condition is wrapped in a
+ *    `parenthesized_expression`; `consequence`/`alternative`/`body` are
+ *    statements directly (no `else_clause` wrapper — an `else if` is the nested
+ *    `if_statement` in the `alternative` field).
+ *  - `for_statement` uses the `init` field (NOT `initializer`), plus `condition`,
+ *    `update`, `body`. `enhanced_for_statement` uses `type`/`name`/`value`/`body`.
+ *  - `try_with_resources_statement` carries a `resources` field
+ *    (`resource_specification` of `resource` nodes); a plain `try_statement` has
+ *    `body` + `catch_clause`s + an optional `finally_clause`.
+ *  - `labeled_statement` = a leading `identifier` (the label) then the labeled
+ *    statement (no field). `break`/`continue` carry an optional trailing
+ *    `identifier` label.
+ *
+ * Function nodes: `method_declaration`, `constructor_declaration`,
+ * `compact_constructor_declaration` (a record's canonical-constructor body), and
+ * `lambda_expression`.
+ *
+ * Edge-kind contract (matches the TS / C# visitors — RD/CDG consume these):
+ *  - if/else → `cond-true` / `cond-false`
+ *  - loops (for / enhanced-for / while / do-while) → `cond-true` / `loop-back` /
+ *    `cond-false`
+ *  - switch → `switch-case` / `fallthrough`; a `switch_block_statement_group`
+ *    (classic colon form) falls through to the next group when it does not
+ *    `break`/`return`/`yield`; a `switch_rule` (arrow form) does NOT fall
+ *    through (its single body always rejoins after the switch).
+ *  - try/catch → `throw` (every protected-region block → the handler); a
+ *    `try_with_resources_statement`'s auto-close runs on BOTH normal and
+ *    exception exit (finally semantics), so a `return`/`break`/`continue`
+ *    crossing it gets a `finally-*` completion edge too. `synchronized`'s
+ *    monitor-release is likewise a deterministic finalizer.
+ *  - return / throw / break / continue → the matching terminator kind; a labeled
+ *    `break outer;` / `continue outer;` targets the labeled frame, not the
+ *    nearest one.
+ *  - straight-line → `seq`
+ *
+ * Classic hazards, handled explicitly (mirrors the C# / TS visitors):
+ *  - loops allocate a dedicated loop-exit block so `break` has a target before
+ *    the loop's successor is known; `continue` targets the header/increment.
+ *  - `for (;;) {}` / `while (true) {}` still emit the structural `header →
+ *    loopExit` `cond-false` escape edge so EXIT stays reverse-reachable from
+ *    every block — the post-dominator / CDG pass silently emits zero CDG for the
+ *    function otherwise.
+ *  - labeled `break outer;` / `continue outer;`: the label resolves against the
+ *    frame of the construct it names (a labeled loop/switch, or a labeled block),
+ *    NOT the nearest enclosing frame. An UNLABELED break never targets a labeled
+ *    block frame (control-flow-context.ts enforces this).
+ *  - try/catch: conservative exceptional flow — EVERY block in the protected
+ *    region edges to the handler (an exception may fire mid-block), matching the
+ *    TS `visitTry` over-approximation.
+ *
+ * Known limitations:
+ *  - `switch` as an EXPRESSION value (`int r = switch (x) { … };`) is left INLINE
+ *    inside its owning statement's block — its arms are not modeled as separate
+ *    CFG blocks (the value flows to the assignment). Only a `switch` used as a
+ *    STATEMENT (a direct statement child) is modeled as a dispatch construct.
+ *    This mirrors the C# `switch_expression`-in-return handling — documented gap.
+ *  - `yield` (in a switch expression) continues to the next statement (it yields
+ *    one value to the enclosing switch and the arm ends); the switch-expression
+ *    state machine is not modeled, consistent with the inline-value-switch gap.
+ *  - Exceptions thrown by a method call mid-statement are over-approximated by
+ *    the conservative per-block throw edge inside a `try`; outside any `try` they
+ *    are not modeled (no edge), matching TS.
+ *  - Def/use harvest scope: see `java-harvest.ts` — field/array writes are not
+ *    scalar defs; nested-function (lambda) bodies are opaque in both directions.
+ *
+ * Returns `undefined` (never throws) for an AST shape it cannot model, so a
+ * malformed function never drops the whole file's CFG group (R4).
+ */
+import type { SyntaxNode } from '../../utils/ast-helpers.js';
+import { CfgBuilder } from '../cfg-builder.js';
+import {
+  ControlFlowContext,
+  drainFinalizerPending,
+  wireJumpThroughFinalizers,
+} from '../control-flow-context.js';
+import type { TraversalResult } from '../traversal-result.js';
+import type { CfgVisitor, FunctionCfg, StatementFacts } from '../types.js';
+import { JavaHarvester } from './java-harvest.js';
+
+/** Java node types that own a CFG-bearing function body. */
+const JAVA_FUNCTION_TYPES = new Set([
+  'method_declaration',
+  'constructor_declaration',
+  'compact_constructor_declaration',
+  'lambda_expression',
+]);
+
+/** Statement node types that break a basic block (everything else coalesces). */
+const CONTROL_FLOW_TYPES = new Set([
+  'if_statement',
+  'while_statement',
+  'do_statement',
+  'for_statement',
+  'enhanced_for_statement',
+  'switch_expression',
+  'try_statement',
+  'try_with_resources_statement',
+  'synchronized_statement',
+  'return_statement',
+  'break_statement',
+  'continue_statement',
+  'throw_statement',
+  'labeled_statement',
+  'yield_statement',
+  'block',
+]);
+
+/** Comment node types tree-sitter-java surfaces (NOT `comment`). */
+const COMMENT_TYPES = new Set(['line_comment', 'block_comment']);
+
+const startLineOf = (n: SyntaxNode): number => n.startPosition.row + 1;
+const endLineOf = (n: SyntaxNode): number => n.endPosition.row + 1;
+
+const isComment = (n: SyntaxNode): boolean => COMMENT_TYPES.has(n.type);
+
+/** A statement sequence that produced no blocks (empty body) is "transparent". */
+type SeqResult = TraversalResult | null;
+
+/** A pre-built {@link StatementFacts} record, or undefined when none. */
+type StatementFactsLike = StatementFacts | undefined;
+
+/**
+ * Per-function Java walk state. One instance per function so the
+ * {@link ControlFlowContext}, exception-handler stack, and labeled-block frame
+ * bookkeeping are scoped to that function and never leak across functions.
+ */
+class JavaCfgWalk {
+  private readonly cfc = new ControlFlowContext();
+  /** Stack of exception-handler entry blocks (catch/finally) a `throw` jumps to. */
+  private readonly handlers: number[] = [];
+  /** Label(s) pending attachment to the NEXT pushed loop/switch frame. */
+  private pendingLabels: string[] = [];
+
+  constructor(
+    private readonly builder: CfgBuilder,
+    private readonly harvest: JavaHarvester,
+  ) {}
+
+  /** Statements of a block node, ignoring comments. */
+  private statementsOf(block: SyntaxNode): SyntaxNode[] {
+    return block.namedChildren.filter((c) => !isComment(c));
+  }
+
+  /** The `body` block of a node (field, or the first `block` child). */
+  private bodyBlockOf(node: SyntaxNode): SyntaxNode | undefined {
+    return node.childForFieldName('body') ?? node.namedChildren.find((c) => c.type === 'block');
+  }
+
+  /** Strip a `parenthesized_expression` wrapper (Java `if`/`while` conditions). */
+  private unwrapParen(node: SyntaxNode): SyntaxNode {
+    if (node.type === 'parenthesized_expression') {
+      const inner = node.namedChildren.find((c) => !isComment(c));
+      if (inner) return inner;
+    }
+    return node;
+  }
+
+  /** Visit a body that may be a `block` or a single statement. */
+  private visitBody(node: SyntaxNode | undefined | null): SeqResult {
+    return this.builder.withNesting(() => {
+      if (!node) return null;
+      if (node.type === 'block') return this.visitSeq(this.statementsOf(node));
+      return this.visitStmt(node);
+    });
+  }
+
+  /** Wire a sequence of statements, coalescing straight-line runs into blocks. */
+  visitSeq(stmts: SyntaxNode[]): SeqResult {
+    return this.builder.withNesting(() => {
+      let entry: number | undefined;
+      let dangling: number[] = [];
+      let openSimple: number | undefined;
+
+      for (const stmt of stmts) {
+        // A `switch_expression` only breaks a block when it is a STATEMENT switch.
+        // Used as a value (inside a declaration / return) it coalesces normally.
+        const breaks =
+          CONTROL_FLOW_TYPES.has(stmt.type) &&
+          (stmt.type !== 'switch_expression' || this.isStatementSwitch(stmt));
+        if (breaks) {
+          openSimple = undefined; // close any open straight-line block
+          const res = this.visitStmt(stmt);
+          if (res === null) continue; // transparent (empty nested block)
+          if (entry === undefined) entry = res.entry;
+          else this.builder.connect(dangling, res.entry, 'seq');
+          dangling = [...res.exits];
+        } else {
+          if (openSimple === undefined) {
+            const idx = this.builder.newBlock(
+              startLineOf(stmt),
+              endLineOf(stmt),
+              stmt.text,
+              'normal',
+              this.harvest.facts(stmt),
+            );
+            if (entry === undefined) entry = idx;
+            else this.builder.connect(dangling, idx, 'seq');
+            openSimple = idx;
+            dangling = [idx];
+          } else {
+            this.builder.extendBlock(
+              openSimple,
+              endLineOf(stmt),
+              stmt.text,
+              this.harvest.facts(stmt),
+            );
+          }
+        }
+      }
+
+      if (entry === undefined) return null;
+      return { entry, exits: dangling };
+    });
+  }
+
+  /** Dispatch one statement to its handler. Non-null except for empty blocks. */
+  visitStmt(stmt: SyntaxNode): SeqResult {
+    switch (stmt.type) {
+      case 'if_statement':
+        return this.visitIf(stmt);
+      case 'while_statement':
+        return this.visitWhile(stmt);
+      case 'do_statement':
+        return this.visitDoWhile(stmt);
+      case 'for_statement':
+        return this.visitFor(stmt);
+      case 'enhanced_for_statement':
+        return this.visitForEach(stmt);
+      case 'switch_expression':
+        return this.visitSwitch(stmt);
+      case 'try_statement':
+      case 'try_with_resources_statement':
+        return this.visitTry(stmt);
+      case 'synchronized_statement':
+        return this.visitSynchronized(stmt);
+      case 'return_statement':
+        return this.visitReturn(stmt);
+      case 'throw_statement':
+        return this.visitThrow(stmt);
+      case 'break_statement':
+        return this.visitBreak(stmt);
+      case 'continue_statement':
+        return this.visitContinue(stmt);
+      case 'labeled_statement':
+        return this.visitLabeled(stmt);
+      case 'yield_statement':
+        return this.visitYield(stmt);
+      case 'block':
+        return this.visitSeq(this.statementsOf(stmt));
+      default:
+        return this.visitSimple(stmt);
+    }
+  }
+
+  private visitSimple(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    return { entry: idx, exits: [idx] };
+  }
+
+  private visitReturn(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    // A return crosses EVERY active finalizer (finally / try-with-resources /
+    // synchronized) before EXIT.
+    wireJumpThroughFinalizers(
+      this.builder,
+      idx,
+      this.cfc.finalizersForReturn(),
+      this.builder.exitIndex,
+      'return',
+    );
+    return { entry: idx, exits: [] };
+  }
+
+  private visitThrow(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    this.builder.edge(idx, this.currentHandler(), 'throw');
+    return { entry: idx, exits: [] };
+  }
+
+  /**
+   * `yield e;` (switch-expression arm value) — yields one value to the enclosing
+   * switch and the arm ends; modeled as a block that continues to whatever
+   * follows (the switch-expression state machine is not modeled, see the visitor
+   * limitations). It carries the yielded value's def/use facts.
+   */
+  private visitYield(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    return { entry: idx, exits: [idx] };
+  }
+
+  private visitBreak(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(startLineOf(stmt), endLineOf(stmt), stmt.text);
+    const label = this.jumpLabel(stmt);
+    const res = this.cfc.resolveBreak(label);
+    const { target, finalizers } = res ?? {
+      target: this.builder.exitIndex,
+      finalizers: this.cfc.finalizersForReturn(),
+    };
+    wireJumpThroughFinalizers(this.builder, idx, finalizers, target, 'break');
+    return { entry: idx, exits: [] };
+  }
+
+  private visitContinue(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(startLineOf(stmt), endLineOf(stmt), stmt.text);
+    const label = this.jumpLabel(stmt);
+    const res = this.cfc.resolveContinue(label);
+    const { target, finalizers } = res ?? {
+      target: this.builder.exitIndex,
+      finalizers: this.cfc.finalizersForReturn(),
+    };
+    wireJumpThroughFinalizers(this.builder, idx, finalizers, target, 'continue');
+    return { entry: idx, exits: [] };
+  }
+
+  /** The trailing label `identifier` of a `break`/`continue`, if any. */
+  private jumpLabel(stmt: SyntaxNode): string | undefined {
+    const id = stmt.namedChildren.find((c) => c.type === 'identifier');
+    return id?.text;
+  }
+
+  /**
+   * `label: <statement>` — the label names the construct it directly wraps. For a
+   * loop/switch we forward the label so its pushed frame carries it (`break
+   * outer;` then resolves to it); for any other labeled statement we push a
+   * labeled-block frame around its body so `break label;` reaches the join after.
+   */
+  private visitLabeled(stmt: SyntaxNode): SeqResult {
+    const labelNode = stmt.namedChildren.find((c) => c.type === 'identifier');
+    const label = labelNode?.text;
+    const body = stmt.namedChildren.find((c) => c.id !== labelNode?.id && !isComment(c)) ?? null;
+    if (!body || label === undefined) return this.visitBody(body);
+
+    if (this.isLoopOrSwitchStatement(body)) {
+      // Forward the label to the loop/switch frame this statement pushes.
+      this.pendingLabels = [...this.pendingLabels, label];
+      return this.visitStmt(body);
+    }
+
+    // Labeled non-loop (`blk: { … break blk; … }`) — a break-to-label join after
+    // the body; an unlabeled break never matches it.
+    const joinBlock = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+    this.cfc.pushLabeledBlock(joinBlock, [label]);
+    const res = this.visitBody(body);
+    this.cfc.pop();
+    if (res) this.builder.connect(res.exits, joinBlock, 'seq');
+    const entry = res?.entry ?? joinBlock;
+    return { entry, exits: [joinBlock] };
+  }
+
+  private isLoopOrSwitchStatement(node: SyntaxNode): boolean {
+    return (
+      node.type === 'for_statement' ||
+      node.type === 'enhanced_for_statement' ||
+      node.type === 'while_statement' ||
+      node.type === 'do_statement' ||
+      (node.type === 'switch_expression' && this.isStatementSwitch(node))
+    );
+  }
+
+  /** Take and clear the labels queued by an enclosing `labeled_statement`. */
+  private takeLabels(): string[] {
+    const labels = this.pendingLabels;
+    this.pendingLabels = [];
+    return labels;
+  }
+
+  private visitIf(stmt: SyntaxNode): TraversalResult {
+    const cond = this.condOf(stmt) ?? stmt;
+    const condBlock = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(cond),
+      cond.text,
+      'normal',
+      this.harvest.facts(cond),
+    );
+    const exits: number[] = [];
+
+    const thenRes = this.visitBody(stmt.childForFieldName('consequence'));
+    if (thenRes) {
+      this.builder.edge(condBlock, thenRes.entry, 'cond-true');
+      exits.push(...thenRes.exits);
+    } else {
+      exits.push(condBlock); // empty then — true path falls through
+    }
+
+    // No `else_clause` wrapper in Java: `alternative` is the else body or the
+    // nested `if_statement` of an `else if` chain directly.
+    const elseNode = stmt.childForFieldName('alternative');
+    if (elseNode) {
+      const elseRes = this.visitBody(elseNode);
+      if (elseRes) {
+        this.builder.edge(condBlock, elseRes.entry, 'cond-false');
+        exits.push(...elseRes.exits);
+      } else {
+        exits.push(condBlock);
+      }
+    } else {
+      exits.push(condBlock); // no else — false path falls through to the join
+    }
+
+    return { entry: condBlock, exits: [...new Set(exits)] };
+  }
+
+  /** The (paren-unwrapped) condition expression of an if/while/do/synchronized. */
+  private condOf(stmt: SyntaxNode): SyntaxNode | undefined {
+    const cond = stmt.childForFieldName('condition');
+    return cond ? this.unwrapParen(cond) : undefined;
+  }
+
+  private visitWhile(stmt: SyntaxNode): TraversalResult {
+    const labels = this.takeLabels();
+    const cond = this.condOf(stmt) ?? stmt;
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(cond),
+      cond.text,
+      'normal',
+      this.harvest.facts(cond),
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.cfc.pushLoop(header, loopExit, labels);
+    const body = this.visitBody(this.bodyBlockOf(stmt));
+    this.cfc.pop();
+
+    if (body) {
+      this.builder.edge(header, body.entry, 'cond-true');
+      this.builder.connect(body.exits, header, 'loop-back');
+    } else {
+      this.builder.edge(header, header, 'loop-back'); // empty body re-tests
+    }
+    // Always emit the structural exit edge — even `while (true)` keeps EXIT
+    // reverse-reachable for the post-dominator / CDG pass.
+    this.builder.edge(header, loopExit, 'cond-false');
+    return { entry: header, exits: [loopExit] };
+  }
+
+  private visitDoWhile(stmt: SyntaxNode): TraversalResult {
+    const labels = this.takeLabels();
+    const cond = this.condOf(stmt) ?? stmt;
+    const condBlock = this.builder.newBlock(
+      startLineOf(cond),
+      endLineOf(cond),
+      cond.text,
+      'normal',
+      this.harvest.facts(cond),
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.cfc.pushLoop(condBlock, loopExit, labels);
+    const body = this.visitBody(this.bodyBlockOf(stmt));
+    this.cfc.pop();
+
+    const backTarget = body ? body.entry : condBlock;
+    if (body) this.builder.connect(body.exits, condBlock, 'seq');
+    this.builder.edge(condBlock, backTarget, 'loop-back'); // cond true → run body again
+    this.builder.edge(condBlock, loopExit, 'cond-false');
+    return { entry: backTarget, exits: [loopExit] };
+  }
+
+  private visitFor(stmt: SyntaxNode): TraversalResult {
+    const labels = this.takeLabels();
+    const init = stmt.childForFieldName('init');
+    const cond = stmt.childForFieldName('condition');
+    const incr = stmt.childForFieldName('update');
+
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      cond ? endLineOf(cond) : startLineOf(stmt),
+      cond ? cond.text : 'for(;;)',
+      'normal',
+      cond ? this.harvest.facts(cond) : undefined,
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    let incrBlock = header;
+    if (incr) {
+      incrBlock = this.builder.newBlock(
+        startLineOf(incr),
+        endLineOf(incr),
+        incr.text,
+        'normal',
+        this.harvest.facts(incr),
+      );
+      this.builder.edge(incrBlock, header, 'loop-back');
+    }
+
+    this.cfc.pushLoop(incrBlock, loopExit, labels);
+    const body = this.visitBody(this.bodyBlockOf(stmt));
+    this.cfc.pop();
+
+    if (body) {
+      this.builder.edge(header, body.entry, 'cond-true');
+      this.builder.connect(body.exits, incrBlock, incr ? 'seq' : 'loop-back');
+    } else {
+      this.builder.edge(header, incrBlock, 'cond-true');
+      if (!incr) this.builder.edge(header, header, 'loop-back');
+    }
+    // Structural exit edge — `for (;;) {}` (no condition) still keeps EXIT
+    // reverse-reachable so CDG is not silently skipped for the function.
+    this.builder.edge(header, loopExit, 'cond-false');
+
+    let entry = header;
+    if (init) {
+      const initBlock = this.builder.newBlock(
+        startLineOf(init),
+        endLineOf(init),
+        init.text,
+        'normal',
+        this.harvest.facts(init),
+      );
+      this.builder.edge(initBlock, header, 'seq');
+      entry = initBlock;
+    }
+    return { entry, exits: [loopExit] };
+  }
+
+  private visitForEach(stmt: SyntaxNode): TraversalResult {
+    const labels = this.takeLabels();
+    // Header text is SYNTHESIZED, so facts come from the name/value nodes
+    // directly (the loop variable is a def, the iterated expression a use).
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      startLineOf(stmt),
+      this.forEachHeaderText(stmt),
+      'normal',
+      this.harvest.forEachHeadFacts(stmt),
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.cfc.pushLoop(header, loopExit, labels);
+    const body = this.visitBody(this.bodyBlockOf(stmt));
+    this.cfc.pop();
+
+    if (body) {
+      this.builder.edge(header, body.entry, 'cond-true');
+      this.builder.connect(body.exits, header, 'loop-back');
+    } else {
+      this.builder.edge(header, header, 'loop-back');
+    }
+    this.builder.edge(header, loopExit, 'cond-false');
+    return { entry: header, exits: [loopExit] };
+  }
+
+  private forEachHeaderText(stmt: SyntaxNode): string {
+    const name = stmt.childForFieldName('name')?.text ?? '';
+    const value = stmt.childForFieldName('value')?.text ?? '';
+    return name || value ? `for(${name} : ${value})` : 'for(… : …)';
+  }
+
+  /**
+   * `synchronized (obj) body` — the monitor release runs on BOTH normal AND
+   * exception exit (deterministic finalizer), exactly like a `finally`. Modeled
+   * as a synthesized finalizer block so a `return`/`break`/`continue` crossing it
+   * threads through and gets a `finally-*` completion edge.
+   */
+  private visitSynchronized(stmt: SyntaxNode): SeqResult {
+    const bodyNode = this.bodyBlockOf(stmt) ?? null;
+    const lockExpr = this.synchronizedLock(stmt);
+    const releaseFacts = lockExpr ? this.harvest.facts(lockExpr) : undefined;
+    return this.buildProtectedSynthetic(bodyNode, stmt, 'release', releaseFacts);
+  }
+
+  /** The locked expression of a `synchronized (expr) {…}` (paren-unwrapped). */
+  private synchronizedLock(stmt: SyntaxNode): SyntaxNode | undefined {
+    const body = stmt.childForFieldName('body');
+    const expr = stmt.namedChildren.find((c) => c.id !== body?.id && !isComment(c));
+    return expr ? this.unwrapParen(expr) : undefined;
+  }
+
+  /** Whether a `switch_expression` is used as a STATEMENT (vs an expression value). */
+  private isStatementSwitch(node: SyntaxNode): boolean {
+    const p = node.parent;
+    if (!p) return false;
+    // A statement-position switch is a direct child of a `block`, a classic
+    // group, or an arrow rule body; an expression-value switch is nested under a
+    // declaration / return / assignment / argument and is NOT one of these.
+    return (
+      p.type === 'block' ||
+      p.type === 'switch_block_statement_group' ||
+      p.type === 'switch_rule' ||
+      p.type === 'labeled_statement'
+    );
+  }
+
+  private visitSwitch(stmt: SyntaxNode): TraversalResult {
+    const labels = this.takeLabels();
+    const value = this.condOf(stmt) ?? stmt;
+    const dispatch = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(value),
+      value.text,
+      'normal',
+      this.harvest.facts(value),
+    );
+    const switchExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.cfc.pushSwitch(switchExit, labels);
+    const body = stmt.childForFieldName('body');
+    // A `switch_block` holds `switch_block_statement_group`s (classic, fall
+    // through) OR `switch_rule`s (arrow, no fallthrough); never both.
+    const groups = body
+      ? body.namedChildren.filter(
+          (c) => c.type === 'switch_block_statement_group' || c.type === 'switch_rule',
+        )
+      : [];
+
+    // Each group's case-test expression(s) evaluate before the body runs —
+    // harvest their uses (and any pattern binding as a may-def) onto the dispatch
+    // block, one record per test, CONDITIONALLY (a later case test only runs when
+    // earlier cases didn't match).
+    for (const g of groups) {
+      for (const test of this.caseTests(g)) {
+        this.builder.attachFacts(dispatch, this.harvest.factsConditional(test));
+      }
+    }
+
+    const groupResults = groups.map((g) => this.visitSeq(this.caseStatements(g)));
+    const hasDefault = groups.some((g) => this.caseIsDefault(g));
+    const arrowForm = groups.some((g) => g.type === 'switch_rule');
+
+    const entryOf: number[] = new Array(groups.length);
+    let after = switchExit;
+    for (let i = groups.length - 1; i >= 0; i--) {
+      entryOf[i] = groupResults[i]?.entry ?? after;
+      after = entryOf[i];
+    }
+
+    for (let i = 0; i < groups.length; i++) {
+      this.builder.edge(dispatch, entryOf[i], 'switch-case');
+    }
+    if (!hasDefault) this.builder.edge(dispatch, switchExit, 'switch-case'); // no-match path
+
+    // Classic colon groups FALL THROUGH to the next group when not break/return-
+    // terminated; arrow rules NEVER fall through (each body rejoins after).
+    for (let i = 0; i < groups.length; i++) {
+      const res = groupResults[i];
+      if (!res) continue;
+      if (groups[i].type === 'switch_rule') {
+        this.builder.connect(res.exits, switchExit, 'seq');
+      } else {
+        const fallTarget = i + 1 < groups.length ? entryOf[i + 1] : switchExit;
+        this.builder.connect(res.exits, fallTarget, 'fallthrough');
+      }
+    }
+    void arrowForm;
+
+    this.cfc.pop();
+    return { entry: dispatch, exits: [switchExit] };
+  }
+
+  /** A switch group/rule's body statements (everything but its `switch_label`). */
+  private caseStatements(group: SyntaxNode): SyntaxNode[] {
+    return group.namedChildren.filter((c) => c.type !== 'switch_label' && !isComment(c));
+  }
+
+  /** The case-test value expressions of a group (a `switch_label`'s values). */
+  private caseTests(group: SyntaxNode): SyntaxNode[] {
+    const label = group.namedChildren.find((c) => c.type === 'switch_label');
+    if (!label) return [];
+    return label.namedChildren.filter((c) => !isComment(c));
+  }
+
+  /** A `default:` group has a `switch_label` with no value children. */
+  private caseIsDefault(group: SyntaxNode): boolean {
+    const label = group.namedChildren.find((c) => c.type === 'switch_label');
+    if (!label) return false;
+    return label.namedChildren.filter((c) => !isComment(c)).length === 0;
+  }
+
+  /**
+   * try / catch / finally / try-with-resources. The `resources` of a
+   * try-with-resources auto-close on BOTH normal and exception exit — exactly
+   * `finally`-shaped — so we synthesize a close finalizer that wraps an explicit
+   * `finally` (if any).
+   */
+  private visitTry(stmt: SyntaxNode): SeqResult {
+    const bodyNode = stmt.childForFieldName('body');
+    const catchClauses: SyntaxNode[] = [];
+    let finallyClause: SyntaxNode | undefined;
+    for (let i = 0; i < stmt.namedChildCount; i++) {
+      const c = stmt.namedChild(i);
+      if (c?.type === 'catch_clause') catchClauses.push(c);
+      else if (c?.type === 'finally_clause') finallyClause = c;
+    }
+    const finallyBody = finallyClause?.namedChildren.find((c) => c.type === 'block');
+
+    // try-with-resources: the resource close is a deterministic finalizer that
+    // runs after the body and (if present) before the explicit finally. Model it
+    // as a synthesized close block prepended to the finalizer chain.
+    const resources = this.tryResources(stmt);
+    return this.buildProtected(
+      bodyNode ?? null,
+      catchClauses,
+      finallyBody ?? null,
+      resources,
+      stmt,
+    );
+  }
+
+  /** The `resource` nodes of a try-with-resources, or [] for a plain try. */
+  private tryResources(stmt: SyntaxNode): SyntaxNode[] {
+    const spec = stmt.childForFieldName('resources');
+    if (!spec) return [];
+    return spec.namedChildren.filter((c) => c.type === 'resource');
+  }
+
+  /**
+   * Shared try/catch/finally builder. `catchClauses` may be empty; `finallyBody`
+   * is the explicit finally's `block` (or null); `resources` are try-with-
+   * resources resources (auto-close = an implicit finally that runs first).
+   *
+   * Models the TS/C# `visitTry` semantics: normal completion of try AND catch
+   * flow through the finalizers; a throw in the protected region routes to the
+   * handler; early exits crossing a finalizer thread through it (`finally-*`
+   * completion edges). The resource close finalizer (synthesized) and the
+   * explicit finally are chained so a crossing jump threads BOTH.
+   */
+  private buildProtected(
+    bodyNode: SyntaxNode | null,
+    catchClauses: SyntaxNode[],
+    finallyBody: SyntaxNode | null,
+    resources: SyntaxNode[],
+    span: SyntaxNode,
+  ): SeqResult {
+    // Innermost finalizer first on the active stack = outermost lexically. The
+    // resource close runs BEFORE the explicit finally, so push the explicit
+    // finally first (deeper) then the close (shallower / nearer the jump).
+    const explicitFinRes = finallyBody ? this.visitSeq(this.statementsOf(finallyBody)) : null;
+    const explicitFrame = explicitFinRes ? this.cfc.pushFinalizer(explicitFinRes.entry) : null;
+
+    // Synthesized resource-close finalizer (a single block; close()/AutoCloseable
+    // has no AST node), carrying the resource bindings' facts as uses.
+    let closeRes: TraversalResult | null = null;
+    let closeFrame: ReturnType<ControlFlowContext['pushFinalizer']> | null = null;
+    if (resources.length > 0) {
+      const closeFacts = this.harvest.resourceCloseFacts(resources);
+      const closeBlock = this.builder.newBlock(
+        endLineOf(span),
+        endLineOf(span),
+        'close',
+        'normal',
+        closeFacts,
+      );
+      closeRes = { entry: closeBlock, exits: [closeBlock] };
+      // The close's normal exit flows into the explicit finally (if any).
+      if (explicitFinRes) this.builder.edge(closeBlock, explicitFinRes.entry, 'seq');
+      closeFrame = this.cfc.pushFinalizer(closeRes.entry);
+    }
+
+    // The entry of the finalizer chain (what normal/exception completion runs
+    // first): close (if any) else explicit finally.
+    const finalizerEntry = closeRes?.entry ?? explicitFinRes?.entry;
+    // The set of normal exits AFTER the whole finalizer chain runs.
+    const finalizerExits = explicitFinRes?.exits ?? closeRes?.exits ?? null;
+
+    // Build each catch handler.
+    const catchEntries: number[] = [];
+    const catchExits: number[] = [];
+    let firstCatchEntry: number | undefined;
+    for (const clause of catchClauses) {
+      const clauseBody = clause.childForFieldName('body');
+      if (finalizerEntry !== undefined) this.handlers.push(finalizerEntry);
+      let res: SeqResult = clauseBody ? this.visitSeq(this.statementsOf(clauseBody)) : null;
+      if (finalizerEntry !== undefined) this.handlers.pop();
+      if (res === null) {
+        // Empty `catch {}` still catches — synthesize one block so exception flow
+        // lands somewhere and the post-try code stays reachable.
+        const idx = this.builder.newBlock(startLineOf(clause), endLineOf(clause), '');
+        res = { entry: idx, exits: [idx] };
+      }
+      const paramFacts = this.harvest.catchParamFacts(clause);
+      if (paramFacts) {
+        const paramBlock = this.builder.newBlock(
+          startLineOf(clause),
+          startLineOf(clause),
+          '',
+          'normal',
+          paramFacts,
+        );
+        this.builder.edge(paramBlock, res.entry, 'seq');
+        res = { entry: paramBlock, exits: res.exits };
+      }
+      catchEntries.push(res.entry);
+      catchExits.push(...res.exits);
+      if (firstCatchEntry === undefined) firstCatchEntry = res.entry;
+    }
+
+    // Handler for the try body: first catch if present, else the finalizer
+    // chain, else the outer handler.
+    const tryHandler = firstCatchEntry ?? finalizerEntry ?? this.currentHandler();
+    const protectedStart = this.builder.blockCount;
+    this.handlers.push(tryHandler);
+    const bodyRes = bodyNode
+      ? bodyNode.type === 'block'
+        ? this.visitSeq(this.statementsOf(bodyNode))
+        : this.visitStmt(bodyNode)
+      : null;
+    this.handlers.pop();
+
+    if (catchClauses.length > 0 || finalizerEntry !== undefined) {
+      for (let b = protectedStart; b < this.builder.blockCount; b++) {
+        this.builder.edge(b, tryHandler, 'throw');
+      }
+    }
+
+    // Pop the finalizer frames (inner→outer) and drain their pending legs.
+    if (closeFrame && closeRes) {
+      this.cfc.pop();
+      drainFinalizerPending(this.builder, closeFrame, closeRes.exits);
+    }
+    if (explicitFrame && explicitFinRes) {
+      this.cfc.pop();
+      drainFinalizerPending(this.builder, explicitFrame, explicitFinRes.exits);
+    }
+
+    const exits: number[] = [];
+    if (finalizerEntry !== undefined) {
+      if (bodyRes) this.builder.connect(bodyRes.exits, finalizerEntry, 'seq');
+      for (const e of catchExits) this.builder.edge(e, finalizerEntry, 'seq');
+      if (finalizerExits) exits.push(...finalizerExits);
+      // No catch → an exception re-propagates out after the finalizers run.
+      if (catchClauses.length === 0 && finalizerExits) {
+        this.builder.connect(finalizerExits, this.currentHandler(), 'throw');
+      }
+    } else {
+      if (bodyRes) exits.push(...bodyRes.exits);
+      exits.push(...catchExits);
+    }
+
+    const entry = bodyRes?.entry ?? finalizerEntry ?? catchEntries[0];
+    if (entry === undefined) {
+      void span;
+      return null;
+    }
+    return { entry, exits: [...new Set(exits)] };
+  }
+
+  /**
+   * `synchronized`: a protected body whose finalizer is a SYNTHESIZED single
+   * block (Monitor exit has no AST node). The finalizer runs on both normal and
+   * exception exit, and crossing jumps thread through it.
+   */
+  private buildProtectedSynthetic(
+    bodyNode: SyntaxNode | null,
+    span: SyntaxNode,
+    text: string,
+    finalizerFacts: StatementFactsLike,
+  ): SeqResult {
+    const finalizerBlock = this.builder.newBlock(
+      endLineOf(span),
+      endLineOf(span),
+      text,
+      'normal',
+      finalizerFacts ?? undefined,
+    );
+    const finRes: TraversalResult = { entry: finalizerBlock, exits: [finalizerBlock] };
+    const finFrame = this.cfc.pushFinalizer(finRes.entry);
+
+    const protectedStart = this.builder.blockCount;
+    // The finalizer IS the handler — an exception in the body still runs the
+    // release, which then re-propagates to the outer handler.
+    this.handlers.push(finRes.entry);
+    const bodyRes = bodyNode
+      ? bodyNode.type === 'block'
+        ? this.visitSeq(this.statementsOf(bodyNode))
+        : this.visitStmt(bodyNode)
+      : null;
+    this.handlers.pop();
+
+    for (let b = protectedStart; b < this.builder.blockCount; b++) {
+      this.builder.edge(b, finRes.entry, 'throw');
+    }
+
+    this.cfc.pop();
+    drainFinalizerPending(this.builder, finFrame, finRes.exits);
+
+    // Normal completion of the body flows through the finalizer; the finalizer's
+    // exit re-propagates an exception to the outer handler (it had no catch).
+    if (bodyRes) this.builder.connect(bodyRes.exits, finRes.entry, 'seq');
+    this.builder.connect(finRes.exits, this.currentHandler(), 'throw');
+
+    const entry = bodyRes?.entry ?? finRes.entry;
+    return { entry, exits: [...finRes.exits] };
+  }
+
+  /** Nearest enclosing exception handler, or the function EXIT. */
+  private currentHandler(): number {
+    return this.handlers.length ? this.handlers[this.handlers.length - 1] : this.builder.exitIndex;
+  }
+}
+
+/** Build the CFG for one Java function node, or `undefined` if not modelable. */
+function buildFunctionCfg(fnNode: SyntaxNode, filePath: string): FunctionCfg | undefined {
+  try {
+    if (!JAVA_FUNCTION_TYPES.has(fnNode.type)) return undefined;
+    const startLine = startLineOf(fnNode);
+    const endLine = endLineOf(fnNode);
+    const startColumn = fnNode.startPosition.column;
+
+    // The body is a `block` (field `body`) OR an expression (single-expression
+    // lambda `x -> expr`).
+    const body =
+      fnNode.childForFieldName('body') ?? fnNode.namedChildren.find((c) => c.type === 'block');
+    if (!body) return undefined; // abstract / interface method — no body
+
+    const builder = new CfgBuilder(filePath, startLine, endLine, startColumn);
+    const harvest = new JavaHarvester(fnNode);
+
+    const paramFacts = harvest.paramFacts();
+    if (paramFacts) builder.attachFacts(builder.entryIndex, paramFacts);
+
+    if (body.type !== 'block') {
+      // Single-expression lambda (`x -> expr`): one block whose value is returned.
+      const blk = builder.newBlock(
+        startLineOf(body),
+        endLineOf(body),
+        body.text,
+        'normal',
+        harvest.facts(body),
+      );
+      builder.edge(builder.entryIndex, blk, 'seq');
+      builder.edge(blk, builder.exitIndex, 'return');
+      return builder.finish(harvest.bindingTable());
+    }
+
+    const walk = new JavaCfgWalk(builder, harvest);
+    const res = walk.visitSeq(body.namedChildren.filter((c) => !isComment(c)));
+    if (!res) {
+      builder.edge(builder.entryIndex, builder.exitIndex, 'seq'); // empty body
+      return builder.finish(harvest.bindingTable());
+    }
+    builder.edge(builder.entryIndex, res.entry, 'seq');
+    builder.connect(res.exits, builder.exitIndex, 'seq'); // normal fall-off → EXIT
+    return builder.finish(harvest.bindingTable());
+  } catch (err) {
+    // Never throw out of buildFunctionCfg — a malformed AST shape must skip only
+    // this one function's CFG, never drop the whole file's language group (R4).
+    // eslint-disable-next-line no-console
+    console.warn(`[cfg] Java buildFunctionCfg skipped a function in ${filePath}: ${String(err)}`);
+    return undefined;
+  }
+}
+
+/** Whether a node is a Java function this visitor builds a CFG for. */
+function isFunction(node: SyntaxNode): boolean {
+  return JAVA_FUNCTION_TYPES.has(node.type);
+}
+
+/** The Java CFG visitor. */
+export function createJavaCfgVisitor(): CfgVisitor<SyntaxNode> {
+  return { buildFunctionCfg, isFunction };
+}
+
+export { JAVA_FUNCTION_TYPES };
diff --git a/gitnexus/src/core/ingestion/cfg/visitors/kotlin-harvest.ts b/gitnexus/src/core/ingestion/cfg/visitors/kotlin-harvest.ts
new file mode 100644
index 000000000..f226112f7
--- /dev/null
+++ b/gitnexus/src/core/ingestion/cfg/visitors/kotlin-harvest.ts
@@ -0,0 +1,556 @@
+/**
+ * Kotlin def/use harvester (#2195) — the Kotlin analogue of
+ * {@link import('./swift-harvest.js').SwiftHarvester} and the C-family / Go /
+ * Rust / Python harvesters. Like the Swift / Python / Rust harvesters it harvests
+ * NO call-site `sites[]` (the call-site taint substrate is a later step): it emits
+ * only the per-function binding table ({@link BindingEntry}[]) plus
+ * {@link StatementFacts} (defs / uses / mayDefs) via a local
+ * {@link FactAccumulator} with no site machinery, so the produced facts never
+ * carry a `sites` key.
+ *
+ * Runs in the parse worker next to the Kotlin CFG visitor. Output is the binding
+ * table the {@link import('../cfg-builder.js').CfgBuilder} stamps onto the CFG,
+ * plus the per-block def/use facts the reaching-defs / CDG solvers consume.
+ *
+ * Every node-type literal below was grammar-validated against the VENDORED
+ * tree-sitter-kotlin via the introspection probe before use (mandatory pre-step).
+ * The grammar is FIELD-LESS for the constructs harvested here (no
+ * `childForFieldName` fields on `parameter` / `property_declaration` /
+ * `for_statement` / etc.), so this harvester navigates by child TYPE and position.
+ * Kotlin shapes pre-empted (verified by a real parse):
+ *  - functions: `function_declaration` (`fun` `simple_identifier`
+ *    `function_value_parameters` `function_body`), `anonymous_function`
+ *    (`fun function_value_parameters function_body`), `lambda_literal`
+ *    (`{ lambda_parameters? -> statements }`).
+ *  - parameters: `function_value_parameters` → `parameter`
+ *    (`simple_identifier : user_type`). A lambda's params live in
+ *    `lambda_parameters` → `variable_declaration` (each a `simple_identifier`,
+ *    optionally `: user_type`).
+ *  - `property_declaration` — `binding_pattern_kind` (`val`/`var`), then a
+ *    `variable_declaration` (`simple_identifier`) OR a `multi_variable_declaration`
+ *    (`( variable_declaration, … )` for `val (a, b) = p`), then `= value`.
+ *  - `for_statement` — pattern is a `variable_declaration` / `multi_variable_declaration`
+ *    after `(`; the iterated collection is the expression after `in`.
+ *  - `catch_block` — `catch ( simple_identifier : user_type ) { statements }`; the
+ *    bound error is the `simple_identifier`.
+ *  - `when_subject` — `( expr )` or `( val variable_declaration = expr )`.
+ *  - reads: `simple_identifier`, `navigation_expression` (`a.b` / `a?.b`),
+ *    `call_expression`, `assignment` (`directly_assignable_expression` lvalue +
+ *    operator + value), `elvis_expression` (`a ?: b`).
+ *
+ * TWO-PHASE, ORDER-INDEPENDENT (load-bearing — mirrors the Swift / Rust / Go
+ * harvesters): the CFG walk is NOT source-order (`do … while` builds the condition
+ * after the body), so resolving names against a scope stack populated *during* the
+ * walk would mis-resolve. Phase 1 pre-scans the whole function subtree once,
+ * declaring every bound name into ONE function table; phase 2 resolves defs/uses
+ * against that finished table from any walk order. Kotlin DOES have block scope +
+ * shadowing, but a single function table is the documented v1 simplification used
+ * by the Swift / Python / Rust harvesters — distinct shadowing redeclarations of
+ * the same name collapse onto one binding (an over-approximation that can falsely
+ * kill across a shadow, the sound direction for taint).
+ *
+ * v1 def-semantics scope:
+ *   - `property_declaration` (`val`/`var PAT = …`) — each `simple_identifier` leaf
+ *     of the `variable_declaration` / `multi_variable_declaration` is a def; the
+ *     value is walked for uses.
+ *   - `assignment` plain `=` — a plain-identifier lvalue is a def; a
+ *     `navigation_expression` / subscript target (`this.x = …`, `a[i] = …`) is NOT
+ *     a scalar def (its root is a use). A compound `+=`/`-=`/… target def-AND-uses
+ *     the lvalue.
+ *   - `for (x in xs)` — the loop pattern's leaves are defs, the collection a use.
+ *   - a `when (val r = e)` subject binds `r`.
+ *   - `catch_block`'s error identifier binds.
+ *   - parameters (incl. lambda params) are `param`-kind defs.
+ * EXCLUDED, deliberately (TypeScript-CFA precedent): member / subscript writes
+ * (`obj.f = …`, `a[i] = …`) are NOT scalar defs — their root identifiers are uses
+ * only. Nested-function bodies (`lambda_literal`, nested `anonymous_function` /
+ * `function_declaration`) are opaque in BOTH directions.
+ *
+ * MAY-DEFS: a def inside a conditionally-evaluated subexpression — the right
+ * operand of `&&` / `||` short-circuit, the elvis (`?:`) right operand and a
+ * safe-call (`?.`) chain, and a `when`-entry case test — is a may-def (gen WITHOUT
+ * kill), so the not-taken path's prior def is not falsely killed.
+ *
+ * Identifiers with no in-function declaration (top-level functions, types,
+ * properties) resolve to a SYNTHETIC module-level binding (`name@module`), applied
+ * identically by def and use harvesting.
+ *
+ * NOTE: nothing serialized here may carry a field named `nodeId` — the durable
+ * parsedfile-store reviver dedups objects keyed on that field name.
+ */
+import type { SyntaxNode } from '../../utils/ast-helpers.js';
+import type { BindingEntry, StatementFacts } from '../types.js';
+import { DefUseAccumulator as FactAccumulator } from './call-site-harvest.js';
+
+/** Node types that own a nested CFG — their subtrees are opaque to harvesting. */
+const NESTED_FUNCTION_TYPES = new Set([
+  'function_declaration',
+  'anonymous_function',
+  'lambda_literal',
+]);
+
+const COMMENT_TYPES = new Set(['line_comment', 'multiline_comment', 'shebang_line']);
+
+export class KotlinHarvester {
+  private readonly bindings: BindingEntry[] = [];
+  /** Single function-scope name → binding index (v1: no block scope). */
+  private readonly table = new Map<string, number>();
+  private readonly synthetic = new Map<string, number>();
+  private readonly fnId: number;
+  /** >0 while walking a conditionally-evaluated subexpression — defs become may-defs. */
+  private conditionalDepth = 0;
+
+  constructor(private readonly fnNode: SyntaxNode) {
+    this.fnId = fnNode.id;
+    this.declareParams(fnNode);
+    const body = this.bodyOf(fnNode);
+    if (body) this.prescan(body);
+  }
+
+  /** The completed binding table — pass to `CfgBuilder.finish`. */
+  bindingTable(): readonly BindingEntry[] {
+    return this.bindings;
+  }
+
+  /** The function/lambda body subtree to pre-scan (`statements` or `function_body`). */
+  private bodyOf(fnNode: SyntaxNode): SyntaxNode | undefined {
+    if (fnNode.type === 'lambda_literal') {
+      return fnNode.namedChildren.find((c) => c.type === 'statements');
+    }
+    return fnNode.namedChildren.find((c) => c.type === 'function_body');
+  }
+
+  // ── phase 1: declaration pre-scan ────────────────────────────────────────
+
+  private declare(nameNode: SyntaxNode, kind: BindingEntry['kind']): void {
+    const name = nameNode.text;
+    if (!name || name === '_' || this.table.has(name)) return;
+    this.table.set(name, this.bindings.length);
+    this.bindings.push({
+      name,
+      declLine: nameNode.startPosition.row + 1,
+      declColumn: nameNode.startPosition.column,
+      kind,
+    });
+  }
+
+  /** Declare every parameter binder of a fn / anonymous fn / lambda. */
+  private declareParams(fnNode: SyntaxNode): void {
+    const params = fnNode.namedChildren.find((c) => c.type === 'function_value_parameters');
+    if (params) {
+      for (const p of params.namedChildren) {
+        if (p.type !== 'parameter') continue;
+        const name = p.namedChildren.find((c) => c.type === 'simple_identifier');
+        if (name) this.declare(name, 'param');
+      }
+    }
+    // Lambda params: `lambda_parameters` → `variable_declaration`(s).
+    const lambdaParams = fnNode.namedChildren.find((c) => c.type === 'lambda_parameters');
+    if (lambdaParams) {
+      for (const vd of lambdaParams.namedChildren) {
+        if (vd.type === 'variable_declaration') this.declareVariableDeclaration(vd, 'param');
+        else if (vd.type === 'multi_variable_declaration') {
+          for (const inner of vd.namedChildren) {
+            if (inner.type === 'variable_declaration')
+              this.declareVariableDeclaration(inner, 'param');
+          }
+        }
+      }
+    }
+  }
+
+  /** Declare the `simple_identifier` of a `variable_declaration`. */
+  private declareVariableDeclaration(vd: SyntaxNode, kind: BindingEntry['kind']): void {
+    const id = vd.namedChildren.find((c) => c.type === 'simple_identifier') ?? vd;
+    if (id.type === 'simple_identifier') this.declare(id, kind);
+  }
+
+  /**
+   * Pre-scan the function body once, declaring every bound name. Recurses into
+   * compound expressions but NOT into nested function/lambda bodies (opaque).
+   */
+  private prescan(node: SyntaxNode): void {
+    const t = node.type;
+    if (NESTED_FUNCTION_TYPES.has(t) && node.id !== this.fnId) return;
+
+    switch (t) {
+      case 'property_declaration':
+        this.declarePropertyPattern(node, 'let');
+        break;
+      case 'for_statement':
+        this.declareForPattern(node);
+        break;
+      case 'catch_block':
+        this.declareCatchParam(node);
+        break;
+      case 'when_subject':
+        this.declareWhenSubject(node);
+        break;
+      default:
+        break;
+    }
+
+    for (let i = 0; i < node.namedChildCount; i++) {
+      const c = node.namedChild(i);
+      if (c) this.prescan(c);
+    }
+  }
+
+  /** Declare every binder of a `property_declaration`'s pattern (single or multi). */
+  private declarePropertyPattern(node: SyntaxNode, kind: BindingEntry['kind']): void {
+    const single = node.namedChildren.find((c) => c.type === 'variable_declaration');
+    if (single) {
+      this.declareVariableDeclaration(single, kind);
+      return;
+    }
+    const multi = node.namedChildren.find((c) => c.type === 'multi_variable_declaration');
+    if (multi) {
+      for (const vd of multi.namedChildren) {
+        if (vd.type === 'variable_declaration') this.declareVariableDeclaration(vd, kind);
+      }
+    }
+  }
+
+  /** Declare a `for` loop variable (`variable_declaration` / `multi_variable_declaration`). */
+  private declareForPattern(node: SyntaxNode): void {
+    const single = node.namedChildren.find((c) => c.type === 'variable_declaration');
+    if (single) {
+      this.declareVariableDeclaration(single, 'let');
+      return;
+    }
+    const multi = node.namedChildren.find((c) => c.type === 'multi_variable_declaration');
+    if (multi) {
+      for (const vd of multi.namedChildren) {
+        if (vd.type === 'variable_declaration') this.declareVariableDeclaration(vd, 'let');
+      }
+    }
+  }
+
+  /** Declare a `catch (e: T)` error name. */
+  private declareCatchParam(node: SyntaxNode): void {
+    const id = node.namedChildren.find((c) => c.type === 'simple_identifier');
+    if (id) this.declare(id, 'catch');
+  }
+
+  /** Declare a `when (val r = e)` subject binding. */
+  private declareWhenSubject(node: SyntaxNode): void {
+    const vd = node.namedChildren.find((c) => c.type === 'variable_declaration');
+    if (vd) this.declareVariableDeclaration(vd, 'let');
+  }
+
+  // ── phase 2: per-statement fact extraction ───────────────────────────────
+
+  /** Def/use facts for one statement (or construct-header expression) node. */
+  facts(node: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(node.startPosition.row + 1);
+    this.walkValue(node, acc);
+    return acc.finish();
+  }
+
+  /** Facts for an expression whose WHOLE evaluation is conditional (case tests). */
+  factsConditional(node: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(node.startPosition.row + 1);
+    this.conditional(() => this.walkValue(node, acc));
+    return acc.finish();
+  }
+
+  /**
+   * Facts for a `for ( PAT in COLLECTION )` head: the loop pattern's leaves are
+   * defs, the iterated collection a use.
+   */
+  forHeadFacts(stmt: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(stmt.startPosition.row + 1);
+    const collection = this.forCollection(stmt);
+    if (collection) this.walkValue(collection, acc);
+    this.defForPattern(stmt, acc);
+    return acc.finish();
+  }
+
+  /** Facts for a `when` subject: a `val r = e` binds `r` (def); the expr's uses. */
+  whenSubjectFacts(subject: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(subject.startPosition.row + 1);
+    const vd = subject.namedChildren.find((c) => c.type === 'variable_declaration');
+    // Walk the subject's value expression(s) for uses; bind the `val` name.
+    for (const c of subject.namedChildren) {
+      if (c.type === 'variable_declaration') continue;
+      this.walkValue(c, acc);
+    }
+    if (vd) this.defVariableDeclaration(vd, acc);
+    return acc.finish();
+  }
+
+  /**
+   * Def-ONLY facts for a value-position binding carrier (`val x = <branch>`,
+   * #2205): just the bound name's def, attached to the continuation block the
+   * branch arms rejoin. The branch subject + arm-value USES are already harvested
+   * onto the branch's own blocks (visitWhen / visitIf), so this must not re-walk
+   * them — only the `variable_declaration` leaves are defs here.
+   */
+  bindingDefFacts(stmt: SyntaxNode): StatementFacts | undefined {
+    const acc = new FactAccumulator(stmt.startPosition.row + 1);
+    this.defForPattern(stmt, acc);
+    return acc.defCount() ? acc.finish() : undefined;
+  }
+
+  /** ENTRY-block facts for the parameters (defs only). */
+  paramFacts(): StatementFacts | undefined {
+    const acc = new FactAccumulator(this.fnNode.startPosition.row + 1);
+    const params = this.fnNode.namedChildren.find((c) => c.type === 'function_value_parameters');
+    if (params) {
+      for (const p of params.namedChildren) {
+        if (p.type !== 'parameter') continue;
+        const name = p.namedChildren.find((c) => c.type === 'simple_identifier');
+        if (name) this.def(name, acc);
+      }
+    }
+    const lambdaParams = this.fnNode.namedChildren.find((c) => c.type === 'lambda_parameters');
+    if (lambdaParams) {
+      for (const vd of lambdaParams.namedChildren) {
+        if (vd.type === 'variable_declaration') this.defVariableDeclaration(vd, acc);
+        else if (vd.type === 'multi_variable_declaration') {
+          for (const inner of vd.namedChildren) {
+            if (inner.type === 'variable_declaration') this.defVariableDeclaration(inner, acc);
+          }
+        }
+      }
+    }
+    return acc.defCount() ? acc.finish() : undefined;
+  }
+
+  /** Def fact for a `catch (e: T)` error name — prepend to the handler entry block. */
+  catchParamFacts(catchBlock: SyntaxNode): StatementFacts | undefined {
+    const id = catchBlock.namedChildren.find((c) => c.type === 'simple_identifier');
+    if (!id) return undefined;
+    const acc = new FactAccumulator(catchBlock.startPosition.row + 1);
+    this.def(id, acc);
+    return acc.defCount() ? acc.finish() : undefined;
+  }
+
+  private resolve(nameNode: SyntaxNode): number {
+    const name = nameNode.text;
+    const idx = this.table.get(name);
+    if (idx !== undefined) return idx;
+    let syn = this.synthetic.get(name);
+    if (syn === undefined) {
+      syn = this.bindings.length;
+      this.synthetic.set(name, syn);
+      this.bindings.push({ name, declLine: 0, declColumn: 0, kind: 'module', synthetic: true });
+    }
+    return syn;
+  }
+
+  private def(nameNode: SyntaxNode, acc: FactAccumulator): void {
+    if (nameNode.text === '_') return; // blank target defines nothing
+    if (this.conditionalDepth > 0) acc.addMayDef(this.resolve(nameNode));
+    else acc.addDef(this.resolve(nameNode));
+  }
+
+  private use(nameNode: SyntaxNode, acc: FactAccumulator): void {
+    if (nameNode.text === '_') return;
+    acc.addUse(this.resolve(nameNode));
+  }
+
+  /** Run `fn` with defs demoted to may-defs (conditionally-evaluated context). */
+  private conditional(fn: () => void): void {
+    this.conditionalDepth++;
+    try {
+      fn();
+    } finally {
+      this.conditionalDepth--;
+    }
+  }
+
+  /** Def the `simple_identifier` of a `variable_declaration`. */
+  private defVariableDeclaration(vd: SyntaxNode, acc: FactAccumulator): void {
+    const id = vd.namedChildren.find((c) => c.type === 'simple_identifier');
+    if (id) this.def(id, acc);
+  }
+
+  /** Def every binder of a `for` loop pattern. */
+  private defForPattern(stmt: SyntaxNode, acc: FactAccumulator): void {
+    const single = stmt.namedChildren.find((c) => c.type === 'variable_declaration');
+    if (single) {
+      this.defVariableDeclaration(single, acc);
+      return;
+    }
+    const multi = stmt.namedChildren.find((c) => c.type === 'multi_variable_declaration');
+    if (multi) {
+      for (const vd of multi.namedChildren) {
+        if (vd.type === 'variable_declaration') this.defVariableDeclaration(vd, acc);
+      }
+    }
+  }
+
+  /** The iterated collection of a `for_statement` — the named child after `in`. */
+  private forCollection(stmt: SyntaxNode): SyntaxNode | undefined {
+    let sawIn = false;
+    for (let i = 0; i < stmt.childCount; i++) {
+      const c = stmt.child(i);
+      if (!c) continue;
+      if (c.type === 'in') {
+        sawIn = true;
+        continue;
+      }
+      if (c.type === ')') return undefined;
+      if (sawIn && c.isNamed && !COMMENT_TYPES.has(c.type)) return c;
+    }
+    return undefined;
+  }
+
+  /** Value-position walk: collect uses; route def positions to the pattern handler. */
+  private walkValue(node: SyntaxNode, acc: FactAccumulator): void {
+    const t = node.type;
+    if (NESTED_FUNCTION_TYPES.has(t) && node.id !== this.fnId) return; // opaque
+
+    switch (t) {
+      case 'simple_identifier':
+        this.use(node, acc);
+        return;
+      case 'property_declaration': {
+        // Walk the value for uses, then def each pattern binder.
+        const binder = node.namedChildren.find(
+          (c) => c.type === 'variable_declaration' || c.type === 'multi_variable_declaration',
+        );
+        const value = this.propertyValue(node);
+        if (value) this.walkValue(value, acc);
+        if (binder?.type === 'variable_declaration') this.defVariableDeclaration(binder, acc);
+        else if (binder?.type === 'multi_variable_declaration') {
+          for (const vd of binder.namedChildren) {
+            if (vd.type === 'variable_declaration') this.defVariableDeclaration(vd, acc);
+          }
+        }
+        return;
+      }
+      case 'assignment': {
+        const lvalue = node.namedChildren.find((c) => c.type === 'directly_assignable_expression');
+        const op = this.assignmentOperator(node);
+        const value = this.assignmentValue(node);
+        if (value) this.walkValue(value, acc);
+        if (lvalue) {
+          const lv = this.unwrapAssignable(lvalue);
+          if (lv.type === 'simple_identifier') {
+            this.def(lv, acc);
+            if (op !== '=') this.use(lv, acc); // compound assign reads too
+          } else {
+            // `this.x = …`, `a[i] = …` — root is a use only (not a scalar def).
+            this.walkValue(lv, acc);
+          }
+        }
+        return;
+      }
+      case 'postfix_expression':
+      case 'prefix_expression': {
+        // `x++` / `--x` — def AND use the operand when it is a plain identifier
+        // and the operator is an increment/decrement. Other pre/postfix forms
+        // (`-x`, `!x`, `x!!`, `x?`) are pure reads → walk the operand as a use.
+        const operand = node.namedChild(0);
+        if (operand?.type === 'simple_identifier' && this.isIncDec(node)) {
+          this.def(operand, acc);
+          this.use(operand, acc);
+        } else if (operand) {
+          this.walkValue(operand, acc);
+        }
+        return;
+      }
+      case 'navigation_expression': {
+        // `a.b` / `a?.b` — value read of the chain root only; the suffix name is
+        // not a scalar binding.
+        const target = node.namedChild(0);
+        if (target) this.walkValue(target, acc);
+        return;
+      }
+      case 'conjunction_expression':
+      case 'disjunction_expression': {
+        // `a && b` / `a || b` — the right operand is conditionally evaluated.
+        const operands = node.namedChildren.filter((c) => !COMMENT_TYPES.has(c.type));
+        if (operands.length > 0) this.walkValue(operands[0], acc);
+        for (let i = 1; i < operands.length; i++) {
+          const rhs = operands[i];
+          this.conditional(() => this.walkValue(rhs, acc));
+        }
+        return;
+      }
+      case 'elvis_expression': {
+        // `a ?: b` — the right operand only evaluates when the left is null.
+        const operands = node.namedChildren.filter((c) => !COMMENT_TYPES.has(c.type));
+        if (operands.length > 0) this.walkValue(operands[0], acc);
+        for (let i = 1; i < operands.length; i++) {
+          const rhs = operands[i];
+          this.conditional(() => this.walkValue(rhs, acc));
+        }
+        return;
+      }
+      case 'when_subject':
+      case 'user_type':
+      case 'type_identifier':
+      case 'binding_pattern_kind':
+        // Binding keyword / type position — no scalar value uses.
+        return;
+      default:
+        for (let i = 0; i < node.namedChildCount; i++) {
+          const c = node.namedChild(i);
+          if (c) this.walkValue(c, acc);
+        }
+    }
+  }
+
+  /** True iff `node` carries a `++` / `--` operator token (`x++` / `--x`). */
+  private isIncDec(node: SyntaxNode): boolean {
+    for (let i = 0; i < node.childCount; i++) {
+      const c = node.child(i);
+      if (c && !c.isNamed && (c.text === '++' || c.text === '--')) return true;
+    }
+    return false;
+  }
+
+  /** The `= value` expression of a `property_declaration` (the child after `=`). */
+  private propertyValue(node: SyntaxNode): SyntaxNode | undefined {
+    let sawEq = false;
+    for (let i = 0; i < node.childCount; i++) {
+      const c = node.child(i);
+      if (!c) continue;
+      if (c.type === '=') {
+        sawEq = true;
+        continue;
+      }
+      if (sawEq && c.isNamed && !COMMENT_TYPES.has(c.type)) return c;
+    }
+    return undefined;
+  }
+
+  /** The assignment operator text (`=` / `+=` / …) of an `assignment`. */
+  private assignmentOperator(node: SyntaxNode): string {
+    for (let i = 0; i < node.childCount; i++) {
+      const c = node.child(i);
+      if (c && !c.isNamed && /^[+\-*/%]?=$/.test(c.type)) return c.type;
+    }
+    return '=';
+  }
+
+  /** The right-hand value of an `assignment` (the named child after the operator). */
+  private assignmentValue(node: SyntaxNode): SyntaxNode | undefined {
+    let sawOp = false;
+    for (let i = 0; i < node.childCount; i++) {
+      const c = node.child(i);
+      if (!c) continue;
+      if (!c.isNamed && /^[+\-*/%]?=$/.test(c.type)) {
+        sawOp = true;
+        continue;
+      }
+      if (sawOp && c.isNamed && !COMMENT_TYPES.has(c.type)) return c;
+    }
+    return undefined;
+  }
+
+  /** Strip a `directly_assignable_expression` wrapper around an lvalue. */
+  private unwrapAssignable(node: SyntaxNode): SyntaxNode {
+    let n = node;
+    let hops = 4;
+    while (n.type === 'directly_assignable_expression' && hops-- > 0) {
+      const inner = n.namedChild(0);
+      if (!inner) break;
+      n = inner;
+    }
+    return n;
+  }
+}
diff --git a/gitnexus/src/core/ingestion/cfg/visitors/kotlin.ts b/gitnexus/src/core/ingestion/cfg/visitors/kotlin.ts
new file mode 100644
index 000000000..d1889a260
--- /dev/null
+++ b/gitnexus/src/core/ingestion/cfg/visitors/kotlin.ts
@@ -0,0 +1,996 @@
+/**
+ * Kotlin CfgVisitor (#2195) — the VENDORED-GRAMMAR JVM/brace-family CFG target.
+ *
+ * Kotlin's tree-sitter grammar (vendored, NOT an npm package — loaded via
+ * `requireVendoredGrammar('tree-sitter-kotlin')`, exactly like tree-sitter-swift)
+ * is field-less for control flow: NONE of the control-flow nodes expose
+ * `childForFieldName` fields (verified by a real parse — every `fieldNameForChild`
+ * came back null), so this visitor navigates purely by child TYPE and position.
+ * Every node-type literal below was grammar-validated against the vendored
+ * tree-sitter-kotlin via the introspection probe before use (mandatory pre-step —
+ * the grammar-literal CI gate maps `kotlin.ts → Kotlin` and fails on a wrong
+ * literal).
+ *
+ * Structured like the Java / C# visitors — a `visit_<node_type>` dispatch over the
+ * statement taxonomy driving a per-function {@link ControlFlowContext} — because
+ * Kotlin shares JVM `finally` semantics (try/catch/finally + labeled
+ * break/continue), which the finalizer-frame + labeled-frame machinery in
+ * `control-flow-context.ts` models.
+ *
+ * Kotlin's defining quirk: `if` / `when` / `try` are EXPRESSIONS. The visitor
+ * treats each as a control-flow construct when it appears in STATEMENT position
+ * (a direct child of a `statements` list) and as opaque straight-line value when
+ * nested inside an expression (e.g. `val y = if (x) 1 else 2`) — exactly the
+ * Java statement-vs-value-switch split.
+ *
+ * Kotlin shapes pre-empted (verified by a real parse):
+ *  - functions: `function_declaration` (name `simple_identifier`,
+ *    `function_value_parameters`, optional `: user_type`, `function_body`),
+ *    `anonymous_function` (`fun (...) function_body`), and `lambda_literal`
+ *    (`{ lambda_parameters? -> statements }`). A `function_body` is either
+ *    `{ statements }` OR an expression body `= expr` (no `statements` wrapper).
+ *  - `if_expression`: `if ( COND ) control_structure_body [ else
+ *    (control_structure_body | if_expression) ]`. No `else_clause` wrapper — an
+ *    `else if` is the nested `if_expression` after the `else` keyword.
+ *  - `when_expression`: `when when_subject? { when_entry* }`. A `when_subject` is
+ *    `( expr )` or `( val v = expr )`. A `when_entry` is `when_condition*` (comma
+ *    separated, OR an `else` keyword) `-> control_structure_body`. Arms do NOT
+ *    fall through. A `when_condition` may wrap a `range_test` (`in 1..10`),
+ *    `type_test` (`is T` / `!is T`), or a plain expression.
+ *  - `for_statement`: `for ( (variable_declaration | multi_variable_declaration)
+ *    in COLLECTION ) control_structure_body`.
+ *  - `while_statement`: `while ( COND ) control_structure_body`.
+ *  - `do_while_statement` — BOTTOM-TEST: `do control_structure_body while ( COND )`.
+ *  - `try_expression`: `try { statements } catch_block* finally_block?`. A
+ *    `catch_block` is `catch ( simple_identifier : user_type ) { statements }`;
+ *    a `finally_block` is `finally { statements }`.
+ *  - `jump_expression` — `return [expr]` / `return@label` / `break` / `break@label`
+ *    / `continue` / `continue@label` / `throw expr`. The leading anonymous keyword
+ *    child (`return` / `return@` / `break` / `break@` / `continue` / `continue@` /
+ *    `throw`) decides; a labeled jump carries a `label` named child.
+ *  - `label` — a labeled loop is preceded by a SIBLING `label` (`outer@`) in the
+ *    same `statements`, NOT a wrapper; the jump's target label child is `outer`.
+ *  - `control_structure_body` wraps either `{ statements }` or a single bare
+ *    statement (`if (c) a()`).
+ *
+ * Edge-kind contract (matches the existing visitors — RD/CDG consume these):
+ *  - if / else → `cond-true` / `cond-false`
+ *  - `when` dispatch → `switch-case` (NO fallthrough — each arm rejoins after)
+ *  - `for` / `while` → `cond-true` / `loop-back` / `cond-false`
+ *  - `do … while` → bottom-test: body runs first, condition `loop-back` (true) /
+ *    `cond-false` (exit)
+ *  - try/catch → `throw` (every protected-region block → the handler); a
+ *    `finally` runs on BOTH normal and exception exit, so a `return`/`break`/
+ *    `continue` crossing it threads through it (`finally-*` completion edges).
+ *  - return(@label) / throw / break(@label) / continue(@label) → the matching
+ *    terminator kind; a labeled jump targets the labeled loop frame.
+ *  - straight-line → `seq`
+ *
+ * Classic hazards, handled explicitly (mirrors Java / C# / Swift):
+ *  - loops allocate a dedicated loop-exit block so `break` has a target before the
+ *    loop's successor is known; `continue` targets the header.
+ *  - `while (true) {}` / `do {} while (true)` still emit the structural `header →
+ *    loopExit` `cond-false` escape edge so EXIT stays reverse-reachable from every
+ *    block — the post-dominator / CDG pass silently emits zero CDG otherwise. This
+ *    is the single highest-risk correctness property.
+ *  - labeled `break@outer` / `continue@outer`: the label resolves against the
+ *    labeled loop frame, NOT the nearest one.
+ *  - try/catch: conservative exceptional flow — EVERY block in the protected
+ *    region edges to the handler (an exception may fire mid-block), matching the
+ *    Java/C#/TS over-approximation.
+ *
+ * Kotlin-specific modeling decisions (documented approximations):
+ *  - `if` / `when` / `try` used as an EXPRESSION VALUE (assigned, returned inline,
+ *    passed as an argument) is left INLINE inside its owning statement's block —
+ *    its arms are not modeled as separate CFG blocks (the value flows to the
+ *    consumer). Only a STATEMENT-position construct (a direct `statements` child)
+ *    becomes a dispatch/branch construct. This mirrors the Java inline-value-switch
+ *    gap — documented, not faked.
+ *  - a `lambda_literal` / nested `anonymous_function` / nested
+ *    `function_declaration` is collected as its OWN function by `isFunction`, so
+ *    its body gets a standalone CFG; in the ENCLOSING function it is an opaque
+ *    straight-line value (its body is not followed inline). A `return@label`
+ *    inside a lambda routes to the lambda's OWN EXIT (the lambda is its own CFG).
+ *  - a `throw` with no enclosing `try`/`catch` routes to EXIT (the function
+ *    propagates the exception to its caller), matching Java.
+ *
+ * Known limitations:
+ *  - `?.` safe-call and `?:` elvis short-circuit are NOT modeled as branches —
+ *    their conditional sub-evaluation is a HARVEST may-def concern (see
+ *    kotlin-harvest.ts), not a CFG split (consistent with the TS `&&`/`??`
+ *    treatment, which also stays in one block).
+ *  - secondary-constructor `constructor(...)` bodies and property getters/setters
+ *    are NOT function nodes in this grammar's CFG-bearing set; v1 does not build a
+ *    CFG for them (documented gap).
+ *  - `inline fun` non-local returns: a `return` inside an inline-lambda argument
+ *    can return from the ENCLOSING function in real Kotlin; the lambda is modeled
+ *    as its own CFG (the conservative, sound-for-RD direction), so that non-local
+ *    return is not threaded into the enclosing function — a documented v1 gap.
+ *
+ * Returns `undefined` (never throws) for an AST shape it cannot model, so a
+ * malformed function never drops the whole file's CFG group (R4).
+ */
+import type { SyntaxNode } from '../../utils/ast-helpers.js';
+import { CfgBuilder } from '../cfg-builder.js';
+import {
+  ControlFlowContext,
+  drainFinalizerPending,
+  wireJumpThroughFinalizers,
+} from '../control-flow-context.js';
+import type { TraversalResult } from '../traversal-result.js';
+import type { CfgVisitor, FunctionCfg } from '../types.js';
+import { KotlinHarvester } from './kotlin-harvest.js';
+
+/** Kotlin node types that own a CFG-bearing function body. */
+const KOTLIN_FUNCTION_TYPES = new Set([
+  'function_declaration',
+  'anonymous_function',
+  'lambda_literal',
+]);
+
+/** Statement node types that break a basic block (everything else coalesces). */
+const CONTROL_FLOW_TYPES = new Set([
+  'if_expression',
+  'when_expression',
+  'for_statement',
+  'while_statement',
+  'do_while_statement',
+  'try_expression',
+  'jump_expression',
+  'label',
+]);
+
+/** Comment / non-code node types tree-sitter-kotlin surfaces (NOT `comment`). */
+const COMMENT_TYPES = new Set(['line_comment', 'multiline_comment', 'shebang_line']);
+
+const startLineOf = (n: SyntaxNode): number => n.startPosition.row + 1;
+const endLineOf = (n: SyntaxNode): number => n.endPosition.row + 1;
+
+const isComment = (n: SyntaxNode): boolean => COMMENT_TYPES.has(n.type);
+
+/** A statement sequence that produced no blocks (empty body) is "transparent". */
+type SeqResult = TraversalResult | null;
+
+/**
+ * Per-function Kotlin walk state. One instance per function so the
+ * {@link ControlFlowContext}, exception-handler stack, and labeled-frame
+ * bookkeeping are scoped to that function and never leak across functions.
+ */
+class KotlinCfgWalk {
+  private readonly cfc = new ControlFlowContext();
+  /** Stack of exception-handler entry blocks (catch/finally) a `throw` jumps to. */
+  private readonly handlers: number[] = [];
+  /** Label(s) pending attachment to the NEXT pushed loop frame. */
+  private pendingLabels: string[] = [];
+
+  constructor(
+    private readonly builder: CfgBuilder,
+    private readonly harvest: KotlinHarvester,
+  ) {}
+
+  /** Named statements of a `statements` node, ignoring comments. */
+  private statementsOf(block: SyntaxNode): SyntaxNode[] {
+    return block.namedChildren.filter((c) => !isComment(c));
+  }
+
+  /**
+   * Unwrap a `control_structure_body`: a `{ statements }` block yields its
+   * `statements` node; a bare single statement (`if (c) a()`) yields itself.
+   */
+  private bodyOf(csb: SyntaxNode | undefined | null): SyntaxNode | undefined {
+    if (!csb) return undefined;
+    if (csb.type === 'control_structure_body') {
+      const stmts = csb.namedChildren.find((c) => c.type === 'statements');
+      if (stmts) return stmts;
+      const single = csb.namedChildren.find((c) => !isComment(c));
+      return single;
+    }
+    return csb;
+  }
+
+  /** Visit a `control_structure_body` (block or single statement). */
+  private visitBody(csb: SyntaxNode | undefined | null): SeqResult {
+    return this.builder.withNesting(() => {
+      const inner = this.bodyOf(csb);
+      if (!inner) return null;
+      if (inner.type === 'statements') return this.visitSeq(this.statementsOf(inner));
+      return this.visitStmt(inner);
+    });
+  }
+
+  /** Wire a sequence of statements, coalescing straight-line runs into blocks. */
+  visitSeq(stmts: SyntaxNode[]): SeqResult {
+    return this.builder.withNesting(() => {
+      let entry: number | undefined;
+      let dangling: number[] = [];
+      let openSimple: number | undefined;
+
+      for (const stmt of stmts) {
+        if (this.isControlFlow(stmt)) {
+          openSimple = undefined; // close any open straight-line block
+          const res = this.visitStmt(stmt);
+          if (res === null) continue; // transparent (empty nested block / label-only)
+          if (entry === undefined) entry = res.entry;
+          else this.builder.connect(dangling, res.entry, 'seq');
+          dangling = [...res.exits];
+        } else {
+          if (openSimple === undefined) {
+            const idx = this.builder.newBlock(
+              startLineOf(stmt),
+              endLineOf(stmt),
+              stmt.text,
+              'normal',
+              this.harvest.facts(stmt),
+            );
+            if (entry === undefined) entry = idx;
+            else this.builder.connect(dangling, idx, 'seq');
+            openSimple = idx;
+            dangling = [idx];
+          } else {
+            this.builder.extendBlock(
+              openSimple,
+              endLineOf(stmt),
+              stmt.text,
+              this.harvest.facts(stmt),
+            );
+          }
+        }
+      }
+
+      if (entry === undefined) return null;
+      return { entry, exits: dangling };
+    });
+  }
+
+  /**
+   * Whether a statement breaks the current straight-line block. `if` / `when` /
+   * `try` are EXPRESSIONS in Kotlin — they break a block when used as a STATEMENT
+   * (a direct child of a `statements` list), OR when they are the value of a
+   * `val/var x = <branch>` binding (#2205) — `visitStmt`'s `property_declaration`
+   * case then models the arms as control flow. Other value positions (an
+   * assignment RHS, a call argument) still coalesce — a remaining gap.
+   */
+  private isControlFlow(stmt: SyntaxNode): boolean {
+    if (stmt.type === 'label') return true; // queue label, emit no block
+    if (stmt.type === 'property_declaration') {
+      const v = this.directValue(stmt);
+      return v !== undefined && this.isModelableValueBranch(v);
+    }
+    if (!CONTROL_FLOW_TYPES.has(stmt.type)) return false;
+    if (this.isExpressionConstruct(stmt.type)) return this.isStatementPosition(stmt);
+    return true;
+  }
+
+  private isExpressionConstruct(type: string): boolean {
+    return type === 'if_expression' || type === 'when_expression' || type === 'try_expression';
+  }
+
+  /**
+   * Whether an expression-construct (`if`/`when`/`try`) is in STATEMENT position
+   * (a direct `statements` child, or a `control_structure_body` that is itself a
+   * bare statement) vs an expression VALUE (nested under a declaration / jump /
+   * assignment / argument). Statement-position constructs are modeled as
+   * dispatch/branch; value-position ones stay inline.
+   */
+  private isStatementPosition(node: SyntaxNode): boolean {
+    const p = node.parent;
+    if (!p) return false;
+    return p.type === 'statements' || p.type === 'control_structure_body';
+  }
+
+  /** Dispatch one statement to its handler. Non-null except for empty / label-only. */
+  visitStmt(stmt: SyntaxNode): SeqResult {
+    if (stmt.type === 'label') {
+      // A label preceding its loop — queue it; the loop construct picks it up.
+      const name = this.labelName(stmt);
+      if (name !== undefined) this.pendingLabels = [...this.pendingLabels, name];
+      return null; // emits no block of its own
+    }
+    switch (stmt.type) {
+      case 'if_expression':
+        return this.isStatementPosition(stmt) ? this.visitIf(stmt) : this.visitSimple(stmt);
+      case 'when_expression':
+        return this.isStatementPosition(stmt) ? this.visitWhen(stmt) : this.visitSimple(stmt);
+      case 'try_expression':
+        return this.isStatementPosition(stmt) ? this.visitTry(stmt) : this.visitSimple(stmt);
+      case 'for_statement':
+        return this.visitFor(stmt);
+      case 'while_statement':
+        return this.visitWhile(stmt);
+      case 'do_while_statement':
+        return this.visitDoWhile(stmt);
+      case 'jump_expression':
+        return this.visitJump(stmt);
+      case 'property_declaration': {
+        // `val x = when (k) { … }` / `val x = if (c) a else b` (#2205): the value
+        // is a value-position branch — model it as control flow and bind the
+        // result on the rejoin, instead of collapsing the whole decl to one block.
+        const value = this.directValue(stmt);
+        if (value && this.isModelableValueBranch(value)) return this.visitBindBranch(stmt, value);
+        return this.visitSimple(stmt);
+      }
+      default:
+        return this.visitSimple(stmt);
+    }
+  }
+
+  private visitSimple(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    return { entry: idx, exits: [idx] };
+  }
+
+  // ── jump expressions (return / throw / break / continue) ──────────────────
+
+  /** The leading anonymous keyword of a `jump_expression` decides its kind. */
+  private jumpKeyword(stmt: SyntaxNode): string {
+    const first = stmt.child(0);
+    return first?.text ?? '';
+  }
+
+  private visitJump(stmt: SyntaxNode): TraversalResult {
+    const kw = this.jumpKeyword(stmt);
+    if (kw === 'return' || kw === 'return@') return this.visitReturn(stmt);
+    if (kw === 'throw') return this.visitThrow(stmt);
+    if (kw === 'break' || kw === 'break@') return this.visitBreak(stmt);
+    if (kw === 'continue' || kw === 'continue@') return this.visitContinue(stmt);
+    // Unknown jump — straight through (defensive; the grammar emits only the above).
+    return this.visitSimple(stmt);
+  }
+
+  /** `return [expr]` / `return@label` — threads through every active finalizer. */
+  private visitReturn(stmt: SyntaxNode): TraversalResult {
+    // `return when (k) { … }` / `return if (c) a else b` (#2205): the returned
+    // value is a value-position branch — model it as control flow, with each arm
+    // returning (its value IS the function result), threading finalizers per arm.
+    const branch = stmt.namedChildren.find(
+      (c) => c.type === 'when_expression' || c.type === 'if_expression',
+    );
+    if (branch && this.isModelableValueBranch(branch)) {
+      const res = this.visitBranchExpr(branch);
+      const finalizers = this.cfc.finalizersForReturn();
+      for (const ex of res.exits) {
+        wireJumpThroughFinalizers(this.builder, ex, finalizers, this.builder.exitIndex, 'return');
+      }
+      return { entry: res.entry, exits: [] };
+    }
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    wireJumpThroughFinalizers(
+      this.builder,
+      idx,
+      this.cfc.finalizersForReturn(),
+      this.builder.exitIndex,
+      'return',
+    );
+    return { entry: idx, exits: [] };
+  }
+
+  /** `throw e` — routes to the nearest enclosing handler (catch/finally), else EXIT. */
+  private visitThrow(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    this.builder.edge(idx, this.currentHandler(), 'throw');
+    return { entry: idx, exits: [] };
+  }
+
+  private visitBreak(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(startLineOf(stmt), endLineOf(stmt), stmt.text);
+    const label = this.jumpLabel(stmt);
+    const res = this.cfc.resolveBreak(label);
+    const { target, finalizers } = res ?? {
+      target: this.builder.exitIndex,
+      finalizers: this.cfc.finalizersForReturn(),
+    };
+    wireJumpThroughFinalizers(this.builder, idx, finalizers, target, 'break');
+    return { entry: idx, exits: [] };
+  }
+
+  private visitContinue(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(startLineOf(stmt), endLineOf(stmt), stmt.text);
+    const label = this.jumpLabel(stmt);
+    const res = this.cfc.resolveContinue(label);
+    const { target, finalizers } = res ?? {
+      target: this.builder.exitIndex,
+      finalizers: this.cfc.finalizersForReturn(),
+    };
+    wireJumpThroughFinalizers(this.builder, idx, finalizers, target, 'continue');
+    return { entry: idx, exits: [] };
+  }
+
+  /** The target `label` of a `break@outer` / `continue@outer` / `return@x`, if any. */
+  private jumpLabel(stmt: SyntaxNode): string | undefined {
+    const label = stmt.namedChildren.find((c) => c.type === 'label');
+    return label ? this.stripLabel(label.text) : undefined;
+  }
+
+  /** The name of a `label` sibling (`outer@` ⇒ `outer`; jump target `outer` ⇒ `outer`). */
+  private labelName(label: SyntaxNode): string | undefined {
+    const id = label.namedChildren.find((c) => c.type === 'simple_identifier');
+    if (id?.text) return this.stripLabel(id.text);
+    return this.stripLabel(label.text) || undefined;
+  }
+
+  private stripLabel(text: string): string {
+    return text.replace(/@$/, '').replace(/^@/, '').trim();
+  }
+
+  /** Take and clear the labels queued by a preceding `label` sibling. */
+  private takeLabels(): string[] {
+    const labels = this.pendingLabels;
+    this.pendingLabels = [];
+    return labels;
+  }
+
+  // ── branches ──────────────────────────────────────────────────────────────
+
+  /**
+   * The direct value expression of a `= VALUE` carrier (`property_declaration`,
+   * a `function_body` expression body): the first named child after the `=`
+   * token. Returns the DIRECT value only — `val x = f(when …)` yields the call,
+   * not the nested `when`, so an argument-position branch is left inline (#2205).
+   */
+  private directValue(stmt: SyntaxNode): SyntaxNode | undefined {
+    let sawEq = false;
+    for (let i = 0; i < stmt.childCount; i++) {
+      const c = stmt.child(i);
+      if (!c) continue;
+      if (c.type === '=') {
+        sawEq = true;
+        continue;
+      }
+      if (sawEq && c.isNamed && !isComment(c)) return c;
+    }
+    return undefined;
+  }
+
+  /**
+   * Whether `node` is a value-position branch worth modeling as control flow
+   * (#2205): a `when` with ≥2 arms, or an `if` that has an `else` (a value-position
+   * `if` always does). A single-arm `when` / else-less `if` carries no real
+   * control dependence, so it stays an inline {@link visitSimple} block.
+   */
+  private isModelableValueBranch(node: SyntaxNode): boolean {
+    if (node.type === 'when_expression') {
+      return node.namedChildren.filter((c) => c.type === 'when_entry').length >= 2;
+    }
+    if (node.type === 'if_expression') return this.elseNodeOf(node) !== undefined;
+    return false;
+  }
+
+  /**
+   * Model a value-position `when`/`if` as control flow regardless of its
+   * statement/value position — {@link visitStmt}'s `isStatementPosition` gate keeps
+   * value-position branches inline, so call the branch handlers directly here.
+   */
+  private visitBranchExpr(node: SyntaxNode): TraversalResult {
+    return node.type === 'when_expression' ? this.visitWhen(node) : this.visitIf(node);
+  }
+
+  /**
+   * `val x = <branch>` (#2205): visit the branch as control flow, then rejoin its
+   * arms at a facts-only continuation carrying ONLY the bound name's def (the
+   * subject + arm-value uses are already harvested onto the branch's blocks). The
+   * arms are now control-dependent on the branch condition, and `x` is defined at
+   * the join — mirrors the Rust visitor's value-position `let` handling.
+   */
+  private visitBindBranch(stmt: SyntaxNode, branch: SyntaxNode): TraversalResult {
+    const res = this.visitBranchExpr(branch);
+    const cont = this.builder.newBlock(
+      startLineOf(stmt),
+      startLineOf(stmt),
+      '',
+      'normal',
+      this.harvest.bindingDefFacts(stmt),
+    );
+    this.builder.connect(res.exits, cont, 'seq');
+    return { entry: res.entry, exits: [cont] };
+  }
+
+  /**
+   * A `fun f() = EXPR` expression body (#2205). A value-position branch is modeled
+   * as control flow (each arm yields the returned function result); any other
+   * expression stays one block. The caller wires entry ← ENTRY and exits → EXIT
+   * with a `return` edge (the body's value is the function's result).
+   */
+  visitExprBody(expr: SyntaxNode): TraversalResult {
+    if (this.isModelableValueBranch(expr)) return this.visitBranchExpr(expr);
+    const blk = this.builder.newBlock(
+      startLineOf(expr),
+      endLineOf(expr),
+      expr.text,
+      'normal',
+      this.harvest.facts(expr),
+    );
+    return { entry: blk, exits: [blk] };
+  }
+
+  /**
+   * `if ( COND ) control_structure_body [ else (control_structure_body |
+   * if_expression) ]`. The else child after the `else` keyword is either the
+   * else body (`control_structure_body`) or a nested `if_expression` (`else if`).
+   */
+  private visitIf(stmt: SyntaxNode): TraversalResult {
+    const cond = this.parenCondition(stmt);
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      cond ? endLineOf(cond) : startLineOf(stmt),
+      cond ? `if (${cond.text})` : 'if',
+      'normal',
+      cond ? this.harvest.facts(cond) : undefined,
+    );
+
+    const bodies = stmt.namedChildren.filter((c) => c.type === 'control_structure_body');
+    const elseNode = this.elseNodeOf(stmt);
+
+    const exits: number[] = [];
+    const thenRes = this.visitBody(bodies[0]);
+    if (thenRes) {
+      this.builder.edge(header, thenRes.entry, 'cond-true');
+      exits.push(...thenRes.exits);
+    } else {
+      exits.push(header); // empty then — true path falls through
+    }
+
+    if (elseNode) {
+      const elseRes = this.visitBody(elseNode);
+      if (elseRes) {
+        this.builder.edge(header, elseRes.entry, 'cond-false');
+        exits.push(...elseRes.exits);
+      } else {
+        exits.push(header);
+      }
+    } else {
+      exits.push(header); // no else — false path falls through to the join
+    }
+
+    return { entry: header, exits: [...new Set(exits)] };
+  }
+
+  /**
+   * The node after the `else` keyword: a nested `if_expression` (`else if`) or the
+   * else-body `control_structure_body`.
+   */
+  private elseNodeOf(stmt: SyntaxNode): SyntaxNode | undefined {
+    let sawElse = false;
+    for (let i = 0; i < stmt.childCount; i++) {
+      const c = stmt.child(i);
+      if (!c) continue;
+      if (sawElse && c.isNamed) return c;
+      if (c.type === 'else') sawElse = true;
+    }
+    return undefined;
+  }
+
+  /** The condition expression of an `if`/`while` (the named child between `(` and `)`). */
+  private parenCondition(stmt: SyntaxNode): SyntaxNode | undefined {
+    let sawOpen = false;
+    for (let i = 0; i < stmt.childCount; i++) {
+      const c = stmt.child(i);
+      if (!c) continue;
+      if (c.type === '(') {
+        sawOpen = true;
+        continue;
+      }
+      if (c.type === ')') return undefined;
+      if (sawOpen && c.isNamed && !isComment(c)) return c;
+    }
+    return undefined;
+  }
+
+  // ── when (no fallthrough) ──────────────────────────────────────────────────
+
+  /**
+   * `when when_subject? { when_entry* }`. Arms do NOT fall through — each
+   * `when_entry` body rejoins after the `when`. The subject (and each entry's
+   * `when_condition` tests) evaluate before the body; their uses are harvested
+   * onto the dispatch block (a later entry's test runs only when earlier ones
+   * didn't match, so any binding there is a may-def).
+   */
+  private visitWhen(stmt: SyntaxNode): TraversalResult {
+    const labels = this.takeLabels();
+    const subject = stmt.namedChildren.find((c) => c.type === 'when_subject');
+    const dispatch = this.builder.newBlock(
+      startLineOf(stmt),
+      subject ? endLineOf(subject) : startLineOf(stmt),
+      subject ? `when ${subject.text}` : 'when',
+      'normal',
+      subject ? this.harvest.whenSubjectFacts(subject) : undefined,
+    );
+    const whenExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.cfc.pushSwitch(whenExit, labels);
+    const entries = stmt.namedChildren.filter((c) => c.type === 'when_entry');
+
+    // Each entry's case tests evaluate conditionally before its body.
+    for (const entry of entries) {
+      for (const test of this.entryConditions(entry)) {
+        this.builder.attachFacts(dispatch, this.harvest.factsConditional(test));
+      }
+    }
+
+    const entryResults = entries.map((e) => this.visitBody(this.entryBody(e)));
+    const hasElse = entries.some((e) => this.entryIsElse(e));
+
+    for (const res of entryResults) {
+      // An EMPTY-body arm still dispatches — it falls straight to the join. Wiring
+      // it (rather than skipping) keeps the dispatch from ending up with ZERO
+      // successors, which would orphan whenExit and break EXIT reverse-reachability
+      // (so the whole function's CDG gets dropped). The canonical trigger is an
+      // all-empty `when` with an `else` arm — `when(k){0->{};else->{}}` — where the
+      // no-match edge below is suppressed. The builder dedups, so this coexists
+      // with the no-match edge.
+      this.builder.edge(dispatch, res ? res.entry : whenExit, 'switch-case');
+    }
+    // A `when` with no `else` (statement position) may match no arm — the no-match
+    // path falls straight to the join.
+    if (!hasElse) this.builder.edge(dispatch, whenExit, 'switch-case');
+
+    const exits: number[] = [whenExit];
+    // Each non-empty arm rejoins after the when (no fallthrough); an empty arm's
+    // dispatch edge already targets whenExit above.
+    for (const res of entryResults) {
+      if (!res) continue;
+      this.builder.connect(res.exits, whenExit, 'seq');
+    }
+
+    this.cfc.pop();
+    return { entry: dispatch, exits };
+  }
+
+  /** The `when_condition` test(s) of a `when_entry` (empty for an `else` arm). */
+  private entryConditions(entry: SyntaxNode): SyntaxNode[] {
+    return entry.namedChildren.filter((c) => c.type === 'when_condition');
+  }
+
+  /** The body `control_structure_body` of a `when_entry`. */
+  private entryBody(entry: SyntaxNode): SyntaxNode | undefined {
+    return entry.namedChildren.find((c) => c.type === 'control_structure_body');
+  }
+
+  /** An `else ->` arm has an `else` keyword child and no `when_condition`. */
+  private entryIsElse(entry: SyntaxNode): boolean {
+    return entry.children.some((c) => c.type === 'else');
+  }
+
+  // ── loops ───────────────────────────────────────────────────────────────
+
+  /** `for ( PAT in COLLECTION ) control_structure_body`. */
+  private visitFor(stmt: SyntaxNode): TraversalResult {
+    const labels = this.takeLabels();
+    const collection = this.forCollection(stmt);
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      collection ? endLineOf(collection) : startLineOf(stmt),
+      this.forHeaderText(stmt),
+      'normal',
+      this.harvest.forHeadFacts(stmt),
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.cfc.pushLoop(header, loopExit, labels);
+    const body = this.visitBody(this.loopBody(stmt));
+    this.cfc.pop();
+
+    if (body) {
+      this.builder.edge(header, body.entry, 'cond-true');
+      this.builder.connect(body.exits, header, 'loop-back');
+    } else {
+      this.builder.edge(header, header, 'loop-back'); // empty body re-iterates
+    }
+    this.builder.edge(header, loopExit, 'cond-false');
+    return { entry: header, exits: [loopExit] };
+  }
+
+  /** The iterated collection of a `for` — the named child after `in` before `)`. */
+  private forCollection(stmt: SyntaxNode): SyntaxNode | undefined {
+    let sawIn = false;
+    for (let i = 0; i < stmt.childCount; i++) {
+      const c = stmt.child(i);
+      if (!c) continue;
+      if (c.type === 'in') {
+        sawIn = true;
+        continue;
+      }
+      if (c.type === ')') return undefined;
+      if (sawIn && c.isNamed && !isComment(c)) return c;
+    }
+    return undefined;
+  }
+
+  private forHeaderText(stmt: SyntaxNode): string {
+    const pat = stmt.namedChildren.find(
+      (c) => c.type === 'variable_declaration' || c.type === 'multi_variable_declaration',
+    );
+    const collection = this.forCollection(stmt);
+    const p = pat?.text ?? '';
+    const col = collection?.text ?? '';
+    return p || col ? `for (${p} in ${col})` : 'for';
+  }
+
+  /** The loop body `control_structure_body` (the LAST one — for/while/do). */
+  private loopBody(stmt: SyntaxNode): SyntaxNode | undefined {
+    const all = stmt.namedChildren.filter((c) => c.type === 'control_structure_body');
+    return all.length ? all[all.length - 1] : undefined;
+  }
+
+  /** `while ( COND ) control_structure_body`. */
+  private visitWhile(stmt: SyntaxNode): TraversalResult {
+    const labels = this.takeLabels();
+    const cond = this.parenCondition(stmt);
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      cond ? endLineOf(cond) : startLineOf(stmt),
+      cond ? `while (${cond.text})` : 'while',
+      'normal',
+      cond ? this.harvest.facts(cond) : undefined,
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.cfc.pushLoop(header, loopExit, labels);
+    const body = this.visitBody(this.loopBody(stmt));
+    this.cfc.pop();
+
+    if (body) {
+      this.builder.edge(header, body.entry, 'cond-true');
+      this.builder.connect(body.exits, header, 'loop-back');
+    } else {
+      this.builder.edge(header, header, 'loop-back'); // empty body re-tests
+    }
+    // Structural exit edge — even `while (true) {}` keeps EXIT reverse-reachable.
+    this.builder.edge(header, loopExit, 'cond-false');
+    return { entry: header, exits: [loopExit] };
+  }
+
+  /**
+   * `do control_structure_body while ( COND )` — BOTTOM-TEST: the body runs at
+   * least once, THEN the condition decides whether to loop back.
+   */
+  private visitDoWhile(stmt: SyntaxNode): TraversalResult {
+    const labels = this.takeLabels();
+    const cond = this.doWhileCondition(stmt);
+    const condBlock = this.builder.newBlock(
+      cond ? startLineOf(cond) : endLineOf(stmt),
+      cond ? endLineOf(cond) : endLineOf(stmt),
+      cond ? `while (${cond.text})` : 'while',
+      'normal',
+      cond ? this.harvest.facts(cond) : undefined,
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    // `continue` re-tests the condition; `break` leaves the loop.
+    this.cfc.pushLoop(condBlock, loopExit, labels);
+    const body = this.visitBody(this.loopBody(stmt));
+    this.cfc.pop();
+
+    const backTarget = body ? body.entry : condBlock;
+    if (body) this.builder.connect(body.exits, condBlock, 'seq');
+    this.builder.edge(condBlock, backTarget, 'loop-back'); // cond true → run body again
+    // Structural exit edge — even `do {} while (true)` keeps EXIT reachable.
+    this.builder.edge(condBlock, loopExit, 'cond-false');
+    return { entry: backTarget, exits: [loopExit] };
+  }
+
+  /** The condition of a `do … while ( COND )` — the named child after the trailing `while`. */
+  private doWhileCondition(stmt: SyntaxNode): SyntaxNode | undefined {
+    let sawWhile = false;
+    for (let i = 0; i < stmt.childCount; i++) {
+      const c = stmt.child(i);
+      if (!c) continue;
+      if (c.type === 'while') {
+        sawWhile = true;
+        continue;
+      }
+      if (sawWhile && c.type === ')') return undefined;
+      if (sawWhile && c.isNamed && !isComment(c)) return c;
+    }
+    return undefined;
+  }
+
+  // ── try / catch / finally ──────────────────────────────────────────────────
+
+  /**
+   * `try { statements } catch_block* finally_block?`. The `finally` runs on BOTH
+   * normal and exception exit (finally semantics) — a `return`/`break`/`continue`
+   * crossing it threads through and gets a `finally-*` completion edge. Mirrors
+   * the Java `visitTry`.
+   */
+  private visitTry(stmt: SyntaxNode): SeqResult {
+    const bodyNode = stmt.namedChildren.find((c) => c.type === 'statements');
+    const catchBlocks = stmt.namedChildren.filter((c) => c.type === 'catch_block');
+    const finallyBlock = stmt.namedChildren.find((c) => c.type === 'finally_block');
+    const finallyBody = finallyBlock?.namedChildren.find((c) => c.type === 'statements');
+
+    // The explicit finally is a finalizer the whole protected region threads through.
+    const finallyRes = finallyBody ? this.visitSeq(this.statementsOf(finallyBody)) : null;
+    const finallyFrame = finallyRes ? this.cfc.pushFinalizer(finallyRes.entry) : null;
+    const finalizerEntry = finallyRes?.entry;
+    const finalizerExits = finallyRes?.exits ?? null;
+
+    // Build each catch handler.
+    const catchEntries: number[] = [];
+    const catchExits: number[] = [];
+    let firstCatchEntry: number | undefined;
+    for (const clause of catchBlocks) {
+      const clauseBody = clause.namedChildren.find((c) => c.type === 'statements');
+      if (finalizerEntry !== undefined) this.handlers.push(finalizerEntry);
+      let res: SeqResult = clauseBody ? this.visitSeq(this.statementsOf(clauseBody)) : null;
+      if (finalizerEntry !== undefined) this.handlers.pop();
+      if (res === null) {
+        // Empty `catch {}` still catches — synthesize one block so exception flow
+        // lands somewhere and post-try code stays reachable.
+        const idx = this.builder.newBlock(startLineOf(clause), endLineOf(clause), '');
+        res = { entry: idx, exits: [idx] };
+      }
+      const paramFacts = this.harvest.catchParamFacts(clause);
+      if (paramFacts) {
+        const paramBlock = this.builder.newBlock(
+          startLineOf(clause),
+          startLineOf(clause),
+          '',
+          'normal',
+          paramFacts,
+        );
+        this.builder.edge(paramBlock, res.entry, 'seq');
+        res = { entry: paramBlock, exits: res.exits };
+      }
+      catchEntries.push(res.entry);
+      catchExits.push(...res.exits);
+      if (firstCatchEntry === undefined) firstCatchEntry = res.entry;
+    }
+
+    // Handler for the try body: first catch if present, else the finally, else outer.
+    const tryHandler = firstCatchEntry ?? finalizerEntry ?? this.currentHandler();
+    const protectedStart = this.builder.blockCount;
+    this.handlers.push(tryHandler);
+    let bodyRes = bodyNode ? this.visitSeq(this.statementsOf(bodyNode)) : null;
+    this.handlers.pop();
+
+    if (bodyRes === null && (catchBlocks.length > 0 || finalizerEntry !== undefined)) {
+      // An empty `try {}` body still establishes a protected region. Synthesize
+      // one block (like the empty-`catch` case above) so the throw-edge loop
+      // wires the catch handler(s) and the try's entry is the body — otherwise
+      // the catch handler block + its error binding are orphaned (unreachable
+      // from ENTRY) and control routes straight to the finally, bypassing catch.
+      const idx = this.builder.newBlock(startLineOf(stmt), startLineOf(stmt), '');
+      bodyRes = { entry: idx, exits: [idx] };
+    }
+
+    if (catchBlocks.length > 0 || finalizerEntry !== undefined) {
+      for (let b = protectedStart; b < this.builder.blockCount; b++) {
+        this.builder.edge(b, tryHandler, 'throw');
+      }
+    }
+
+    // Pop the finalizer frame and drain its pending completion legs.
+    if (finallyFrame && finallyRes) {
+      this.cfc.pop();
+      drainFinalizerPending(this.builder, finallyFrame, finallyRes.exits);
+    }
+
+    const exits: number[] = [];
+    if (finalizerEntry !== undefined) {
+      if (bodyRes) this.builder.connect(bodyRes.exits, finalizerEntry, 'seq');
+      for (const e of catchExits) this.builder.edge(e, finalizerEntry, 'seq');
+      if (finalizerExits) exits.push(...finalizerExits);
+      // No catch → an exception re-propagates out after the finally runs.
+      if (catchBlocks.length === 0 && finalizerExits) {
+        this.builder.connect(finalizerExits, this.currentHandler(), 'throw');
+      }
+    } else {
+      if (bodyRes) exits.push(...bodyRes.exits);
+      exits.push(...catchExits);
+    }
+
+    const entry = bodyRes?.entry ?? finalizerEntry ?? catchEntries[0];
+    if (entry === undefined) return null;
+    return { entry, exits: [...new Set(exits)] };
+  }
+
+  /** Nearest enclosing exception handler, or the function EXIT. */
+  private currentHandler(): number {
+    return this.handlers.length ? this.handlers[this.handlers.length - 1] : this.builder.exitIndex;
+  }
+}
+
+/** The function/lambda body `statements`, or an expression body, or undefined. */
+function bodyStatementsOf(fnNode: SyntaxNode): SyntaxNode | undefined {
+  if (fnNode.type === 'lambda_literal') {
+    return fnNode.namedChildren.find((c) => c.type === 'statements');
+  }
+  const fb = fnNode.namedChildren.find((c) => c.type === 'function_body');
+  if (!fb) return undefined;
+  // `function_body` is `{ statements }` OR an expression body `= expr`.
+  const stmts = fb.namedChildren.find((c) => c.type === 'statements');
+  if (stmts) return stmts;
+  // Expression body — return the body itself so the caller treats it as one block.
+  return fb;
+}
+
+/** Build the CFG for one Kotlin function node, or `undefined` if not modelable. */
+function buildFunctionCfg(fnNode: SyntaxNode, filePath: string): FunctionCfg | undefined {
+  try {
+    if (!KOTLIN_FUNCTION_TYPES.has(fnNode.type)) return undefined;
+    const startLine = startLineOf(fnNode);
+    const endLine = endLineOf(fnNode);
+    const startColumn = fnNode.startPosition.column;
+
+    // A `function_declaration` / `anonymous_function` needs a `function_body`; a
+    // `lambda_literal` carries its `statements` directly. Absence of a body
+    // container ⇒ an abstract / interface-member / signature-only declaration with
+    // nothing to model (return undefined).
+    const hasBody =
+      fnNode.type === 'lambda_literal' ||
+      fnNode.namedChildren.some((c) => c.type === 'function_body');
+    if (!hasBody) return undefined;
+
+    const body = bodyStatementsOf(fnNode);
+
+    const builder = new CfgBuilder(filePath, startLine, endLine, startColumn);
+    const harvest = new KotlinHarvester(fnNode);
+
+    const paramFacts = harvest.paramFacts();
+    if (paramFacts) builder.attachFacts(builder.entryIndex, paramFacts);
+
+    // Expression body (`fun f() = expr` / a `function_body` that is `= expr`):
+    // the body's value is returned. A value-position branch (`= when (k) { … }`)
+    // is modeled as control flow so each arm is control-dependent on the
+    // condition (#2205); any other expression is one block.
+    if (body && body.type === 'function_body') {
+      const expr = body.namedChildren.find((c) => !isComment(c) && c.type !== 'statements');
+      if (expr) {
+        const res = new KotlinCfgWalk(builder, harvest).visitExprBody(expr);
+        builder.edge(builder.entryIndex, res.entry, 'seq');
+        builder.connect(res.exits, builder.exitIndex, 'return');
+        return builder.finish(harvest.bindingTable());
+      }
+      // `function_body` with neither statements nor an expression — empty.
+      builder.edge(builder.entryIndex, builder.exitIndex, 'seq');
+      return builder.finish(harvest.bindingTable());
+    }
+
+    const walk = new KotlinCfgWalk(builder, harvest);
+    const res = body ? walk.visitSeq(body.namedChildren.filter((c) => !isComment(c))) : null;
+
+    if (!res) {
+      builder.edge(builder.entryIndex, builder.exitIndex, 'seq'); // empty body
+      return builder.finish(harvest.bindingTable());
+    }
+    builder.edge(builder.entryIndex, res.entry, 'seq');
+    builder.connect(res.exits, builder.exitIndex, 'seq'); // normal fall-off → EXIT
+    return builder.finish(harvest.bindingTable());
+  } catch (err) {
+    // Never throw out of buildFunctionCfg — a malformed AST shape must skip only
+    // this one function's CFG, never drop the whole file's language group (R4).
+    // eslint-disable-next-line no-console
+    console.warn(`[cfg] Kotlin buildFunctionCfg skipped a function in ${filePath}: ${String(err)}`);
+    return undefined;
+  }
+}
+
+/** Whether a node is a Kotlin function/lambda this visitor builds a CFG for. */
+function isFunction(node: SyntaxNode): boolean {
+  return KOTLIN_FUNCTION_TYPES.has(node.type);
+}
+
+/** The Kotlin CFG visitor. */
+export function createKotlinCfgVisitor(): CfgVisitor<SyntaxNode> {
+  return { buildFunctionCfg, isFunction };
+}
+
+export { KOTLIN_FUNCTION_TYPES };
diff --git a/gitnexus/src/core/ingestion/cfg/visitors/php-harvest.ts b/gitnexus/src/core/ingestion/cfg/visitors/php-harvest.ts
new file mode 100644
index 000000000..9bd680407
--- /dev/null
+++ b/gitnexus/src/core/ingestion/cfg/visitors/php-harvest.ts
@@ -0,0 +1,665 @@
+/**
+ * PHP def/use harvester (PDG layer — brace-family CFG, closest to Java/C#).
+ *
+ * Runs in the parse worker next to the PHP CFG visitor, extracting per-statement
+ * variable definition/use facts that ride the side channel for the reaching-defs
+ * / CDG solvers. Output is the per-function binding table ({@link BindingEntry}[])
+ * plus {@link StatementFacts} the visitor attaches to blocks as it walks. The
+ * call-site substrate ({@link CallSiteFactAccumulator}) is harvested too (it is
+ * INERT until a PHP source/sink model is registered).
+ *
+ * TWO-PHASE, ORDER-INDEPENDENT (load-bearing — mirrors the Java / C# harvesters):
+ * the CFG walk is NOT source-order (`visitFor` builds the init block after the
+ * body, `visitDoWhile` the condition before the body), so resolving names against
+ * a scope stack populated *during* the walk would mis-resolve. Phase 1 pre-scans
+ * the whole function subtree once into a completed lexical scope tree; phase 2
+ * resolves defs/uses against that finished tree from any walk order.
+ *
+ * PHP-SPECIFIC NOTE — PHP variables are FUNCTION-SCOPED (no block scope): a `$x`
+ * written inside an `if` body is the SAME variable as one written at the top
+ * level (unlike Java/C# block scoping). So the harvester declares EVERY assigned/
+ * parameter/foreach/catch variable into the single function-root scope; there is
+ * no per-block shadowing. The grammar carries the leading `$` on `variable_name`
+ * text (`$x`), which we keep as the binding name (consistent and unambiguous).
+ *
+ * Every node type and field literal below was grammar-validated against
+ * tree-sitter-php (`php_only` export) via the introspection probe before use
+ * (mandatory pre-step). PHP shapes pre-empted (verified by a real parse):
+ *  - functions: `function_definition`/`method_declaration` (fields
+ *    `name`/`parameters`/`body`), `anonymous_function` (`parameters`/`body` plus
+ *    an `anonymous_function_use_clause` capturing outer vars), `arrow_function`
+ *    (`parameters`/`body`; body is an EXPRESSION).
+ *  - parameters: `simple_parameter` / `variadic_parameter` /
+ *    `property_promotion_parameter`, each with a `name` field (`variable_name` or
+ *    a `by_ref` wrapping one); `simple_parameter` may carry `default_value`.
+ *  - assignment: `assignment_expression` (`left`/`right`),
+ *    `augmented_assignment_expression` (`left`/`operator`/`right`, def+use),
+ *    `update_expression` (`argument`/`operator`, def+use). An lvalue may be a
+ *    `variable_name`, a `list_literal` (`[$a,$b]` / `list($a,$b)` destructure),
+ *    a `member_access_expression` (`$o->p` — a USE of the object, not a scalar
+ *    def), or a `subscript_expression` (`$a[$i]` — same).
+ *  - `foreach_statement`: the iterable + a value `variable_name`, OR a
+ *    `pair` (`$k => $v`) binding both — NO field names (positional children).
+ *  - `catch_clause` (`type`/`name`/`body`): `name` is the exception
+ *    `variable_name`.
+ *  - conditional contexts: `binary_expression` operator `&&`/`||`/`??`,
+ *    `conditional_expression` (`condition`/`body`/`alternative`; short `?:` omits
+ *    `body`), and switch/match case tests.
+ *
+ * v1 def-semantics scope:
+ *   - assignment / augmented-assignment / update to a `variable_name` (or to a
+ *     `list_literal` destructure target) — define (and, for augmented/update, use)
+ *     the variable.
+ *   - parameters, the `foreach` value/key variable, catch parameters, and
+ *     `anonymous_function` `use (...)` captures (by-value AND by-ref).
+ * EXCLUDED, deliberately (TypeScript-CFA precedent, mirrored by Java): property /
+ * array-element writes (`$o->p = …`, `$a[$i] = …`) are NOT scalar defs — their
+ * variables are uses only. Nested-function (closure / arrow) bodies are opaque in
+ * BOTH directions.
+ *
+ * MAY-DEFS: a def inside a conditionally-evaluated subexpression — the right
+ * operand of `&&` / `||` / `??` (`$a && ($x = f())`, `$c ?? ($c = load())`), a
+ * ternary arm, or a switch/match case test — is a may-def (gen without kill), so
+ * the not-taken path's prior def is not falsely killed.
+ *
+ * Identifiers with no in-function declaration (globals, statics, imported names)
+ * resolve to a SYNTHETIC module-level binding (`name@module`), applied
+ * identically by def and use harvesting.
+ *
+ * NOTE: nothing serialized here may carry a field named `nodeId` — the durable
+ * parsedfile-store reviver dedups objects keyed on that field name.
+ */
+import type { SyntaxNode } from '../../utils/ast-helpers.js';
+import type { BindingEntry, StatementFacts } from '../types.js';
+import { CallSiteFactAccumulator } from './call-site-harvest.js';
+
+/**
+ * The per-statement def/use + call-site collector, aliased to the shared
+ * {@link CallSiteFactAccumulator} (one name for the value and the type).
+ */
+type FactAccumulator = CallSiteFactAccumulator;
+
+/** Node types that own a nested CFG — their subtrees are opaque to harvesting. */
+const NESTED_FUNCTION_TYPES = new Set([
+  'function_definition',
+  'method_declaration',
+  'anonymous_function',
+  'arrow_function',
+]);
+
+export class PhpHarvester {
+  private readonly bindings: BindingEntry[] = [];
+  /** PHP is function-scoped: one flat table, name → binding index. */
+  private readonly table = new Map<string, number>();
+  private readonly synthetic = new Map<string, number>();
+  private readonly fnId: number;
+  /** >0 while walking a conditionally-evaluated subexpression — defs become may-defs. */
+  private conditionalDepth = 0;
+  /**
+   * Call/new node id → bindings whose declarator/assignment VALUE is exactly
+   * that call. Registered before the value walk, consumed by {@link visitCall} /
+   * {@link visitNew} (mirrors the Java harvester's `resultDefTargets`).
+   */
+  private readonly resultDefTargets = new Map<number, number[]>();
+
+  constructor(private readonly fnNode: SyntaxNode) {
+    this.fnId = fnNode.id;
+    this.declareParams(fnNode);
+    this.declareUseClause(fnNode);
+    const body = this.bodyOf(fnNode);
+    if (body) this.prescan(body);
+  }
+
+  /** The completed binding table — pass to `CfgBuilder.finish`. */
+  bindingTable(): readonly BindingEntry[] {
+    return this.bindings;
+  }
+
+  /** The function/closure body node (a `compound_statement`, or an expression). */
+  private bodyOf(fnNode: SyntaxNode): SyntaxNode | undefined {
+    return fnNode.childForFieldName('body') ?? undefined;
+  }
+
+  // ── phase 1: declaration pre-scan ────────────────────────────────────────
+
+  private declare(name: string, declNode: SyntaxNode, kind: BindingEntry['kind']): void {
+    if (!name || this.table.has(name)) return;
+    this.table.set(name, this.bindings.length);
+    this.bindings.push({
+      name,
+      declLine: declNode.startPosition.row + 1,
+      declColumn: declNode.startPosition.column,
+      kind,
+    });
+  }
+
+  /** The `$name` text of a parameter's `name` field (a `variable_name` or `by_ref`). */
+  private paramVarName(param: SyntaxNode): SyntaxNode | undefined {
+    const name = param.childForFieldName('name');
+    if (!name) return undefined;
+    if (name.type === 'by_ref') {
+      return name.namedChildren.find((c) => c.type === 'variable_name');
+    }
+    return name.type === 'variable_name' ? name : undefined;
+  }
+
+  private declareParams(fnNode: SyntaxNode): void {
+    const params = fnNode.childForFieldName('parameters');
+    if (!params) return;
+    for (let i = 0; i < params.namedChildCount; i++) {
+      const p = params.namedChild(i);
+      if (!p) continue;
+      if (
+        p.type !== 'simple_parameter' &&
+        p.type !== 'variadic_parameter' &&
+        p.type !== 'property_promotion_parameter'
+      ) {
+        continue;
+      }
+      const varName = this.paramVarName(p);
+      if (varName) this.declare(varName.text, varName, 'param');
+    }
+  }
+
+  /** `anonymous_function ... use ($a, &$b)` — each captured var binds in the closure. */
+  private declareUseClause(fnNode: SyntaxNode): void {
+    if (fnNode.type !== 'anonymous_function') return;
+    const clause = fnNode.namedChildren.find((c) => c.type === 'anonymous_function_use_clause');
+    if (!clause) return;
+    for (const v of this.useClauseVars(clause)) this.declare(v.text, v, 'param');
+  }
+
+  /** The captured `variable_name`s of a `use (...)` clause (unwrapping `by_ref`). */
+  private useClauseVars(clause: SyntaxNode): SyntaxNode[] {
+    const out: SyntaxNode[] = [];
+    for (let i = 0; i < clause.namedChildCount; i++) {
+      const c = clause.namedChild(i);
+      if (!c) continue;
+      if (c.type === 'variable_name') out.push(c);
+      else if (c.type === 'by_ref') {
+        const inner = c.namedChildren.find((x) => x.type === 'variable_name');
+        if (inner) out.push(inner);
+      }
+    }
+    return out;
+  }
+
+  /**
+   * Walk the function body once, declaring every assigned / foreach / catch
+   * variable into the FLAT function scope (PHP has no block scoping). Nested
+   * function/closure bodies are NOT descended (opaque).
+   */
+  private prescan(node: SyntaxNode): void {
+    const t = node.type;
+    if (NESTED_FUNCTION_TYPES.has(t) && node.id !== this.fnId) return;
+
+    switch (t) {
+      case 'assignment_expression': {
+        const left = node.childForFieldName('left');
+        if (left) this.declareLvalue(left);
+        break;
+      }
+      case 'augmented_assignment_expression': {
+        const left = node.childForFieldName('left');
+        if (left && left.type === 'variable_name') this.declare(left.text, left, 'var');
+        break;
+      }
+      case 'update_expression': {
+        const arg = node.childForFieldName('argument');
+        if (arg && arg.type === 'variable_name') this.declare(arg.text, arg, 'var');
+        break;
+      }
+      case 'foreach_statement': {
+        for (const v of this.foreachTargets(node)) this.declare(v.text, v, 'var');
+        break;
+      }
+      case 'catch_clause': {
+        const name = node.childForFieldName('name');
+        if (name && name.type === 'variable_name') this.declare(name.text, name, 'catch');
+        break;
+      }
+      default:
+        break;
+    }
+
+    for (let i = 0; i < node.namedChildCount; i++) {
+      const c = node.namedChild(i);
+      if (c) this.prescan(c);
+    }
+  }
+
+  /**
+   * Declare the variable(s) named by an assignment lvalue: a plain
+   * `variable_name`, or a `list_literal` destructure (`[$a,$b]` / `list($a,$b)`,
+   * possibly keyed `["x" => $e]`). Member / subscript targets bind nothing.
+   */
+  private declareLvalue(left: SyntaxNode): void {
+    if (left.type === 'variable_name') {
+      this.declare(left.text, left, 'var');
+    } else if (left.type === 'list_literal') {
+      for (const v of this.listTargets(left)) this.declare(v.text, v, 'var');
+    }
+  }
+
+  /** Every `variable_name` bound by a `list_literal` (including keyed entries). */
+  private listTargets(list: SyntaxNode): SyntaxNode[] {
+    const out: SyntaxNode[] = [];
+    const walk = (n: SyntaxNode): void => {
+      if (n.type === 'variable_name') {
+        out.push(n);
+        return;
+      }
+      // Keyed (`"x" => $e`) entries and nested lists descend; non-variable keys
+      // (the string/int key) are not lvalues and carry no `variable_name`.
+      for (let i = 0; i < n.namedChildCount; i++) {
+        const c = n.namedChild(i);
+        if (c) walk(c);
+      }
+    };
+    for (let i = 0; i < list.namedChildCount; i++) {
+      const c = list.namedChild(i);
+      if (c) walk(c);
+    }
+    return out;
+  }
+
+  /**
+   * The bound variable(s) of a `foreach ($it as [$k =>] $v)`: the value (and key)
+   * `variable_name`s. The structure is positional — the FIRST named child is the
+   * iterable, then either a bare `variable_name` (value) or a `pair` ($k => $v).
+   */
+  private foreachTargets(stmt: SyntaxNode): SyntaxNode[] {
+    const out: SyntaxNode[] = [];
+    // Skip the iterable (first named child); collect value / pair targets after.
+    for (let i = 1; i < stmt.namedChildCount; i++) {
+      const c = stmt.namedChild(i);
+      if (!c) continue;
+      if (c.type === 'variable_name') out.push(c);
+      else if (c.type === 'pair') {
+        for (let j = 0; j < c.namedChildCount; j++) {
+          const v = c.namedChild(j);
+          if (v?.type === 'variable_name') out.push(v);
+        }
+      }
+      // `body` (compound_statement / colon_block) is not a target — it has its
+      // own non-variable_name/non-pair type, so it is skipped here.
+    }
+    return out;
+  }
+
+  // ── phase 2: per-statement fact extraction ───────────────────────────────
+
+  /** Def/use facts for one statement (or construct-header expression) node. */
+  facts(node: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(node.startPosition.row + 1);
+    this.walkValue(node, acc);
+    return acc.finish();
+  }
+
+  /** Facts for an expression whose WHOLE evaluation is conditional (case tests). */
+  factsConditional(node: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(node.startPosition.row + 1);
+    this.conditional(() => this.walkValue(node, acc));
+    return acc.finish();
+  }
+
+  /** Facts for a `foreach ($it as [$k =>] $v)` head: targets bind, iterable used. */
+  foreachHeadFacts(stmt: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(stmt.startPosition.row + 1);
+    const iterable = stmt.namedChild(0);
+    if (iterable) this.walkValue(iterable, acc);
+    for (const v of this.foreachTargets(stmt)) this.def(v, acc);
+    return acc.finish();
+  }
+
+  /** ENTRY-block facts for the function's parameters (defs only). */
+  paramFacts(): StatementFacts | undefined {
+    const acc = new FactAccumulator(this.fnNode.startPosition.row + 1);
+    const params = this.fnNode.childForFieldName('parameters');
+    if (params) {
+      for (let i = 0; i < params.namedChildCount; i++) {
+        const p = params.namedChild(i);
+        if (!p) continue;
+        if (
+          p.type !== 'simple_parameter' &&
+          p.type !== 'variadic_parameter' &&
+          p.type !== 'property_promotion_parameter'
+        ) {
+          continue;
+        }
+        const varName = this.paramVarName(p);
+        if (varName) this.def(varName, acc);
+      }
+    }
+    // A closure's `use (...)` captures are live on entry too — model as defs.
+    if (this.fnNode.type === 'anonymous_function') {
+      const clause = this.fnNode.namedChildren.find(
+        (c) => c.type === 'anonymous_function_use_clause',
+      );
+      if (clause) for (const v of this.useClauseVars(clause)) this.def(v, acc);
+    }
+    return acc.defCount() ? acc.finish() : undefined;
+  }
+
+  /** Def fact for a `catch (T $e)` parameter — prepend to the handler entry block. */
+  catchParamFacts(catchClause: SyntaxNode): StatementFacts | undefined {
+    const name = catchClause.childForFieldName('name');
+    if (!name || name.type !== 'variable_name') return undefined;
+    const acc = new FactAccumulator(catchClause.startPosition.row + 1);
+    this.def(name, acc);
+    return acc.defCount() ? acc.finish() : undefined;
+  }
+
+  private resolve(nameNode: SyntaxNode): number {
+    const name = nameNode.text;
+    const idx = this.table.get(name);
+    if (idx !== undefined) return idx;
+    let syn = this.synthetic.get(name);
+    if (syn === undefined) {
+      syn = this.bindings.length;
+      this.synthetic.set(name, syn);
+      this.bindings.push({ name, declLine: 0, declColumn: 0, kind: 'module', synthetic: true });
+    }
+    return syn;
+  }
+
+  private def(nameNode: SyntaxNode, acc: FactAccumulator): void {
+    if (this.conditionalDepth > 0) acc.addMayDef(this.resolve(nameNode));
+    else acc.addDef(this.resolve(nameNode));
+  }
+
+  private use(nameNode: SyntaxNode, acc: FactAccumulator): void {
+    acc.addUse(this.resolve(nameNode));
+  }
+
+  /** Run `fn` with defs demoted to may-defs (conditionally-evaluated context). */
+  private conditional(fn: () => void): void {
+    this.conditionalDepth++;
+    try {
+      fn();
+    } finally {
+      this.conditionalDepth--;
+    }
+  }
+
+  /** Strip parenthesized wrappers around an lvalue (`($x) = 1`). */
+  private unwrapParen(node: SyntaxNode): SyntaxNode {
+    let n = node;
+    let hops = 8;
+    while (n.type === 'parenthesized_expression' && hops-- > 0) {
+      const inner = n.namedChildren.find((c) => c.type !== 'comment');
+      if (!inner) break;
+      n = inner;
+    }
+    return n;
+  }
+
+  /** Value-position walk: collect uses; route def positions to the lvalue handler. */
+  private walkValue(node: SyntaxNode, acc: FactAccumulator): void {
+    const t = node.type;
+    if (NESTED_FUNCTION_TYPES.has(t) && node.id !== this.fnId) {
+      // Opaque nested function / closure — captured reads/writes are invisible.
+      return;
+    }
+
+    switch (t) {
+      case 'variable_name':
+        this.use(node, acc);
+        return;
+      case 'assignment_expression': {
+        const left = node.childForFieldName('left');
+        const right = node.childForFieldName('right');
+        if (left) {
+          const lv = this.unwrapParen(left);
+          if (lv.type === 'variable_name') {
+            const snap = acc.defSnapshot();
+            this.def(lv, acc);
+            if (right) this.registerResultDefs(right, acc.defsSince(snap));
+          } else if (lv.type === 'list_literal') {
+            // Destructure: every target binds; non-variable keys are uses.
+            for (const v of this.listTargets(lv)) this.def(v, acc);
+          } else {
+            this.walkValue(lv, acc); // member / subscript target — uses only
+          }
+        }
+        if (right) this.walkValue(right, acc);
+        return;
+      }
+      case 'augmented_assignment_expression': {
+        const left = node.childForFieldName('left');
+        const right = node.childForFieldName('right');
+        if (left) {
+          const lv = this.unwrapParen(left);
+          if (lv.type === 'variable_name') {
+            this.def(lv, acc);
+            this.use(lv, acc); // compound assign reads too
+          } else {
+            this.walkValue(lv, acc);
+          }
+        }
+        if (right) this.walkValue(right, acc);
+        return;
+      }
+      case 'update_expression': {
+        const arg = node.childForFieldName('argument');
+        const lv = arg ? this.unwrapParen(arg) : null;
+        if (lv?.type === 'variable_name') {
+          this.def(lv, acc);
+          this.use(lv, acc);
+        } else if (arg) {
+          this.walkValue(arg, acc);
+        }
+        return;
+      }
+      case 'binary_expression': {
+        const left = node.childForFieldName('left');
+        const right = node.childForFieldName('right');
+        const op = node.childForFieldName('operator')?.text ?? '';
+        if (left) this.walkValue(left, acc);
+        if (right) {
+          if (op === '&&' || op === '||' || op === '??' || op === 'and' || op === 'or') {
+            this.conditional(() => this.walkValue(right, acc));
+          } else {
+            this.walkValue(right, acc);
+          }
+        }
+        return;
+      }
+      case 'conditional_expression': {
+        const cond = node.childForFieldName('condition');
+        const body = node.childForFieldName('body');
+        const alt = node.childForFieldName('alternative');
+        if (cond) this.walkValue(cond, acc);
+        if (body) this.conditional(() => this.walkValue(body, acc));
+        if (alt) this.conditional(() => this.walkValue(alt, acc));
+        return;
+      }
+      case 'function_call_expression':
+        this.visitCall(node, acc, 'function');
+        return;
+      case 'member_call_expression':
+      case 'nullsafe_member_call_expression':
+        this.visitCall(node, acc, 'member');
+        return;
+      case 'scoped_call_expression':
+        this.visitCall(node, acc, 'scoped');
+        return;
+      case 'object_creation_expression':
+        this.visitNew(node, acc);
+        return;
+      case 'member_access_expression':
+      case 'nullsafe_member_access_expression': {
+        // `$o->p` — value read of the object root only (the property name is not
+        // a scalar binding); record the innermost identifier-rooted member read.
+        this.walkChain(node, acc);
+        return;
+      }
+      default:
+        for (let i = 0; i < node.namedChildCount; i++) {
+          const c = node.namedChild(i);
+          if (c) this.walkValue(c, acc);
+        }
+    }
+  }
+
+  // ── taint-site harvest ───────────────────────────────────────────────────
+
+  /**
+   * When `value`'s root (after stripping parens) is a call / object-creation
+   * node, remember its site should carry `resultDefs: defs`.
+   */
+  private registerResultDefs(value: SyntaxNode, defs: readonly number[]): void {
+    if (defs.length === 0) return;
+    const root = this.unwrapParen(value);
+    if (
+      root.type === 'function_call_expression' ||
+      root.type === 'member_call_expression' ||
+      root.type === 'nullsafe_member_call_expression' ||
+      root.type === 'scoped_call_expression' ||
+      root.type === 'object_creation_expression'
+    ) {
+      this.resultDefTargets.set(root.id, [...defs]);
+    }
+  }
+
+  /**
+   * Call-site handler for the three PHP call shapes:
+   *  - `function`: `function_call_expression` (`function` field = name, no receiver)
+   *  - `member`:   `member_call_expression` (`object` receiver, `name` method)
+   *  - `scoped`:   `scoped_call_expression` (`scope` class, `name` method)
+   * Reproduces the same uses the default descent recorded plus the call site.
+   */
+  private visitCall(
+    node: SyntaxNode,
+    acc: FactAccumulator,
+    shape: 'function' | 'member' | 'scoped',
+  ): void {
+    const argsNode = node.childForFieldName('arguments');
+    const siteIdx = acc.openCallSite('call');
+    acc.pushFrame(siteIdx);
+
+    if (shape === 'function') {
+      const fnNode = node.childForFieldName('function');
+      if (fnNode) {
+        if (fnNode.type === 'name' || fnNode.type === 'qualified_name') {
+          acc.setSiteCallee(siteIdx, fnNode.text);
+        } else {
+          // dynamic callee (`$fn()`, `($obj->cb)()`) — record uses, no static path
+          this.walkValue(fnNode, acc);
+        }
+      }
+    } else if (shape === 'member') {
+      const objectNode = node.childForFieldName('object');
+      const nameNode = node.childForFieldName('name');
+      let receiverPath: string | undefined;
+      if (objectNode) {
+        const chain = this.walkChain(objectNode, acc);
+        receiverPath = chain.path;
+        if (chain.rootIdx !== undefined) acc.setSiteReceiver(siteIdx, chain.rootIdx);
+      }
+      if (nameNode && nameNode.type === 'name') {
+        const callee =
+          receiverPath !== undefined ? `${receiverPath}.${nameNode.text}` : nameNode.text;
+        acc.setSiteCallee(siteIdx, callee);
+      }
+    } else {
+      // scoped: `C::method(...)` — scope is a class name (not a binding).
+      const scopeNode = node.childForFieldName('scope');
+      const nameNode = node.childForFieldName('name');
+      const scopeText =
+        scopeNode && (scopeNode.type === 'name' || scopeNode.type === 'qualified_name')
+          ? scopeNode.text
+          : undefined;
+      if (nameNode && nameNode.type === 'name') {
+        const callee = scopeText !== undefined ? `${scopeText}.${nameNode.text}` : nameNode.text;
+        acc.setSiteCallee(siteIdx, callee);
+      }
+    }
+
+    const resultDefs = this.resultDefTargets.get(node.id);
+    if (resultDefs !== undefined) acc.setSiteResultDefs(siteIdx, resultDefs);
+    this.walkArgs(argsNode, acc);
+    acc.popFrame();
+  }
+
+  /** Explicit `object_creation_expression` (`new Foo($x)`) handler. */
+  private visitNew(node: SyntaxNode, acc: FactAccumulator): void {
+    const argsNode = node.childForFieldName('arguments');
+    const siteIdx = acc.openCallSite('new');
+    acc.pushFrame(siteIdx);
+    // The class name is the first `name`/`qualified_name` child (not a binding).
+    const className = node.namedChildren.find(
+      (c) => c.type === 'name' || c.type === 'qualified_name',
+    );
+    if (className) acc.setSiteCallee(siteIdx, className.text.replace(/\s+/g, ''));
+    const resultDefs = this.resultDefTargets.get(node.id);
+    if (resultDefs !== undefined) acc.setSiteResultDefs(siteIdx, resultDefs);
+    this.walkArgs(argsNode, acc);
+    acc.popFrame();
+  }
+
+  /** Walk an `arguments` node, tagging each positional `argument` for occurrences. */
+  private walkArgs(argsNode: SyntaxNode | null, acc: FactAccumulator): void {
+    if (!argsNode) return;
+    let pos = 0;
+    for (let i = 0; i < argsNode.namedChildCount; i++) {
+      const arg = argsNode.namedChild(i);
+      if (!arg || arg.type === 'comment') continue;
+      if (arg.type !== 'argument') {
+        // A spread (`...$xs`) or other non-`argument` child — still walk for uses.
+        this.walkValue(arg, acc);
+        continue;
+      }
+      acc.setFrameArg(pos);
+      this.walkValue(arg, acc);
+      pos++;
+    }
+  }
+
+  /**
+   * Member-access chain walk shared by value position and a method-call receiver.
+   * Records the chain-root `variable_name` as a use plus at most ONE member-read
+   * site — the innermost access — when the root is a variable.
+   */
+  private walkChain(node: SyntaxNode, acc: FactAccumulator): { path?: string; rootIdx?: number } {
+    const accesses: string[] = [];
+    let cur: SyntaxNode = this.unwrapParen(node);
+    for (;;) {
+      if (
+        cur.type === 'member_access_expression' ||
+        cur.type === 'nullsafe_member_access_expression'
+      ) {
+        const field = cur.childForFieldName('name');
+        accesses.unshift(field?.text ?? '');
+        const obj = cur.childForFieldName('object');
+        if (!obj) break;
+        cur = this.unwrapParen(obj);
+      } else {
+        break;
+      }
+    }
+    let rootIdx: number | undefined;
+    let rootSegment: string | undefined;
+    if (cur.type === 'variable_name') {
+      rootIdx = this.resolve(cur);
+      acc.addUse(rootIdx);
+      rootSegment = cur.text;
+    } else {
+      this.walkValue(cur, acc);
+    }
+    const innermost = accesses[0];
+    if (rootIdx !== undefined && innermost) acc.addMemberRead(rootIdx, innermost);
+    const path =
+      rootSegment !== undefined && accesses.every((a) => a !== '')
+        ? [rootSegment, ...accesses].join('.')
+        : undefined;
+    return { path, rootIdx };
+  }
+}
+
+/**
+ * Ordered, deduplicating def/use + call-site collector for one statement record.
+ * The shared {@link CallSiteFactAccumulator} carries the def/use machinery plus
+ * the taint-site harvest.
+ */
+const FactAccumulator = CallSiteFactAccumulator;
diff --git a/gitnexus/src/core/ingestion/cfg/visitors/php.ts b/gitnexus/src/core/ingestion/cfg/visitors/php.ts
new file mode 100644
index 000000000..f9a73c74f
--- /dev/null
+++ b/gitnexus/src/core/ingestion/cfg/visitors/php.ts
@@ -0,0 +1,846 @@
+/**
+ * PHP CfgVisitor (PDG layer — brace-family, closest to Java/C#).
+ *
+ * Walks a PHP function / method / closure / arrow-function tree-sitter AST and
+ * drives the language-agnostic {@link CfgBuilder} to produce a serializable
+ * {@link FunctionCfg}, plus a def/use harvest ({@link PhpHarvester}) for the
+ * reaching-defs / CDG solvers. Structured like the Java / C# visitors — a
+ * `visit_<node_type>` dispatch over the statement taxonomy, driving a
+ * per-function {@link ControlFlowContext} — because PHP shares their `finally`
+ * semantics (try/catch/finally) and C-style switch FALLTHROUGH.
+ *
+ * Every node type and field literal below was grammar-validated against
+ * tree-sitter-php (`php_only` export) via the introspection probe before use
+ * (mandatory pre-step). PHP shapes pre-empted (verified by a real parse):
+ *  - functions: `function_definition` / `method_declaration` (fields
+ *    `name`/`parameters`/`body`, body a `compound_statement`),
+ *    `anonymous_function` (`parameters`/`body` + `anonymous_function_use_clause`),
+ *    `arrow_function` (`parameters`/`body`; body is an EXPRESSION).
+ *  - `if_statement` field `condition` (a `parenthesized_expression`), `body`, and
+ *    zero-or-more `alternative` fields, each an `else_if_clause`
+ *    (`condition`/`body`) or a trailing `else_clause` (`body`). PHP has no nested-
+ *    `if` else chain — `elseif` is its own clause. The ALTERNATIVE colon syntax
+ *    (`if … : … elseif … : … else: … endif;`) parses to the SAME node types with
+ *    a `colon_block` body instead of `compound_statement`, so reading the `body`
+ *    field handles both uniformly.
+ *  - `for_statement` fields `initialize` / `condition` / `update` / `body` (NOT
+ *    `init`/`incr`); `foreach_statement` field `body` plus POSITIONAL children:
+ *    the iterable `variable_name`, then a value `variable_name` OR a `pair`
+ *    (`$k => $v`); `while_statement` (`condition`/`body`); `do_statement`
+ *    (`body`/`condition`).
+ *  - `switch_statement` (`condition`/`body` = `switch_block`); the block holds
+ *    `case_statement` (field `value`, body statements are siblings — FALLS
+ *    THROUGH) and `default_statement`. `match_expression` (`condition`/`body` =
+ *    `match_block`) is a value-position expression with NO fallthrough.
+ *  - `try_statement` field `body`; `catch_clause` (`type`/`name`/`body`),
+ *    `finally_clause` (`body`).
+ *  - `return_statement`; `break_statement` / `continue_statement` carry an
+ *    optional `integer` child (`break 2;` targets the 2nd enclosing loop/switch);
+ *    `throw` is a `throw_expression` wrapped in an `expression_statement` (there
+ *    is NO `throw_statement` node); `goto_statement` + `named_label_statement`.
+ *
+ * Edge-kind contract (matches the existing visitors — RD/CDG consume these):
+ *  - if/elseif/else → `cond-true` / `cond-false`
+ *  - loops (for / foreach / while / do-while) → `cond-true` / `loop-back` /
+ *    `cond-false`
+ *  - switch → `switch-case` / `fallthrough` (a `case` with no `break`/`return`
+ *    falls through to the next case); `match` is left INLINE as a value
+ *    (no fallthrough — see the limitations).
+ *  - try/catch → `throw` (every protected-region block → the handler); a
+ *    `finally` runs on normal AND exception exit, so a `return`/`break`/`continue`
+ *    crossing it gets a `finally-*` completion edge.
+ *  - return / throw / break / continue → the matching terminator kind; `break N`
+ *    / `continue N` target the N-th enclosing loop/switch (not the nearest).
+ *  - straight-line → `seq`
+ *
+ * Classic hazards, handled explicitly (mirrors the Java / TS visitors):
+ *  - loops allocate a dedicated loop-exit block so `break` has a target before
+ *    the loop's successor is known; `continue` targets the header / update.
+ *  - `for (;;) {}` / `while (true) {}` still emit the structural `header →
+ *    loopExit` `cond-false` escape edge so EXIT stays reverse-reachable from
+ *    every block — the post-dominator / CDG pass silently emits zero CDG for the
+ *    function otherwise.
+ *  - `break N` / `continue N`: each loop/switch frame is pushed with a UNIQUE
+ *    synthetic label, and an N-level jump resolves against the label of the N-th
+ *    enclosing loop/switch frame — reusing the existing finalizer-threading
+ *    machinery so a jump that crosses a `finally` still threads through it.
+ *  - try/catch: conservative exceptional flow — EVERY block in the protected
+ *    region edges to the handler (an exception may fire mid-block).
+ *
+ * Known limitations:
+ *  - `match` is a value-position EXPRESSION (`$r = match($x) { … }`), kept INLINE
+ *    inside its owning statement's block — its arms are not modeled as separate
+ *    CFG blocks (the value flows to the assignment). Documented gap, mirroring the
+ *    Java inline-value-switch handling.
+ *  - context-manager-style suppression and PHP's exception-from-mid-call outside
+ *    any `try` are not modeled (no edge), matching the other visitors.
+ *  - `goto` / named labels are modeled as straight-line blocks (the label is a
+ *    plain block; a `goto` does NOT create a jump edge — PHP `goto` is rare and
+ *    intra-function only; an over-approximation here would harm precision more
+ *    than the missing edge). Documented gap.
+ *  - Def/use harvest scope: see `php-harvest.ts` — property / array-element
+ *    writes are not scalar defs; nested-function (closure / arrow) bodies are
+ *    opaque in both directions.
+ *
+ * Returns `undefined` (never throws) for an AST shape it cannot model, so a
+ * malformed function never drops the whole file's CFG group (R4).
+ */
+import type { SyntaxNode } from '../../utils/ast-helpers.js';
+import { CfgBuilder } from '../cfg-builder.js';
+import {
+  ControlFlowContext,
+  drainFinalizerPending,
+  wireJumpThroughFinalizers,
+} from '../control-flow-context.js';
+import type { TraversalResult } from '../traversal-result.js';
+import type { CfgVisitor, FunctionCfg } from '../types.js';
+import { PhpHarvester } from './php-harvest.js';
+
+/** PHP node types that own a CFG-bearing function body. */
+const PHP_FUNCTION_TYPES = new Set([
+  'function_definition',
+  'method_declaration',
+  'anonymous_function',
+  'arrow_function',
+]);
+
+/** Statement node types that break a basic block (everything else coalesces). */
+const CONTROL_FLOW_TYPES = new Set([
+  'if_statement',
+  'for_statement',
+  'foreach_statement',
+  'while_statement',
+  'do_statement',
+  'switch_statement',
+  'try_statement',
+  'return_statement',
+  'break_statement',
+  'continue_statement',
+  'goto_statement',
+  'named_label_statement',
+  'compound_statement',
+]);
+
+const startLineOf = (n: SyntaxNode): number => n.startPosition.row + 1;
+const endLineOf = (n: SyntaxNode): number => n.endPosition.row + 1;
+
+const isComment = (n: SyntaxNode): boolean => n.type === 'comment';
+
+/** A statement sequence that produced no blocks (empty body) is "transparent". */
+type SeqResult = TraversalResult | null;
+
+/**
+ * Per-function PHP walk state. One instance per function so the
+ * {@link ControlFlowContext}, exception-handler stack, and the `break N` /
+ * `continue N` synthetic-label bookkeeping are scoped to that function and never
+ * leak across functions.
+ */
+class PhpCfgWalk {
+  private readonly cfc = new ControlFlowContext();
+  /** Stack of exception-handler entry blocks (catch / finally) a `throw` jumps to. */
+  private readonly handlers: number[] = [];
+  /**
+   * Synthetic labels of the active loop/switch frames, innermost LAST — so the
+   * N-th enclosing frame's label is `loopLabels[length - N]`. PHP's `break N` /
+   * `continue N` resolve against these (no source labels exist).
+   */
+  private readonly loopLabels: string[] = [];
+  private labelSeq = 0;
+
+  constructor(
+    private readonly builder: CfgBuilder,
+    private readonly harvest: PhpHarvester,
+  ) {}
+
+  /** Statements of a body node, ignoring comments. */
+  private statementsOf(block: SyntaxNode): SyntaxNode[] {
+    return block.namedChildren.filter((c) => !isComment(c));
+  }
+
+  /** The `body` block of a node (a `compound_statement` / `colon_block` / stmt). */
+  private bodyBlockOf(node: SyntaxNode): SyntaxNode | undefined {
+    return node.childForFieldName('body') ?? undefined;
+  }
+
+  /** Strip a `parenthesized_expression` wrapper (PHP `if`/`while` conditions). */
+  private unwrapParen(node: SyntaxNode): SyntaxNode {
+    if (node.type === 'parenthesized_expression') {
+      const inner = node.namedChildren.find((c) => !isComment(c));
+      if (inner) return inner;
+    }
+    return node;
+  }
+
+  /** Visit a body that may be a block-ish container or a single statement. */
+  private visitBody(node: SyntaxNode | undefined | null): SeqResult {
+    return this.builder.withNesting(() => {
+      if (!node) return null;
+      if (node.type === 'compound_statement' || node.type === 'colon_block') {
+        return this.visitSeq(this.statementsOf(node));
+      }
+      return this.visitStmt(node);
+    });
+  }
+
+  /** Wire a sequence of statements, coalescing straight-line runs into blocks. */
+  visitSeq(stmts: SyntaxNode[]): SeqResult {
+    return this.builder.withNesting(() => {
+      let entry: number | undefined;
+      let dangling: number[] = [];
+      let openSimple: number | undefined;
+
+      for (const stmt of stmts) {
+        // An `expression_statement` wrapping a bare `throw_expression` is a
+        // terminator (PHP has no `throw_statement` node), so it breaks the block.
+        const breaks = CONTROL_FLOW_TYPES.has(stmt.type) || this.isThrowStatement(stmt);
+        if (breaks) {
+          openSimple = undefined; // close any open straight-line block
+          const res = this.visitStmt(stmt);
+          if (res === null) continue; // transparent (empty nested block)
+          if (entry === undefined) entry = res.entry;
+          else this.builder.connect(dangling, res.entry, 'seq');
+          dangling = [...res.exits];
+        } else {
+          if (openSimple === undefined) {
+            const idx = this.builder.newBlock(
+              startLineOf(stmt),
+              endLineOf(stmt),
+              stmt.text,
+              'normal',
+              this.harvest.facts(stmt),
+            );
+            if (entry === undefined) entry = idx;
+            else this.builder.connect(dangling, idx, 'seq');
+            openSimple = idx;
+            dangling = [idx];
+          } else {
+            this.builder.extendBlock(
+              openSimple,
+              endLineOf(stmt),
+              stmt.text,
+              this.harvest.facts(stmt),
+            );
+          }
+        }
+      }
+
+      if (entry === undefined) return null;
+      return { entry, exits: dangling };
+    });
+  }
+
+  /** Dispatch one statement to its handler. Non-null except for empty blocks. */
+  visitStmt(stmt: SyntaxNode): SeqResult {
+    if (this.isThrowStatement(stmt)) return this.visitThrow(stmt);
+    switch (stmt.type) {
+      case 'if_statement':
+        return this.visitIf(stmt);
+      case 'for_statement':
+        return this.visitFor(stmt);
+      case 'foreach_statement':
+        return this.visitForEach(stmt);
+      case 'while_statement':
+        return this.visitWhile(stmt);
+      case 'do_statement':
+        return this.visitDoWhile(stmt);
+      case 'switch_statement':
+        return this.visitSwitch(stmt);
+      case 'try_statement':
+        return this.visitTry(stmt);
+      case 'return_statement':
+        return this.visitReturn(stmt);
+      case 'break_statement':
+        return this.visitBreak(stmt);
+      case 'continue_statement':
+        return this.visitContinue(stmt);
+      case 'compound_statement':
+      case 'colon_block':
+        return this.visitSeq(this.statementsOf(stmt));
+      case 'goto_statement':
+      case 'named_label_statement':
+        // `goto` / labels are modeled as straight-line blocks (no jump edge — see
+        // the visitor limitations); they still carry their text + facts.
+        return this.visitSimple(stmt);
+      default:
+        return this.visitSimple(stmt);
+    }
+  }
+
+  /** True for an `expression_statement` whose value is a bare `throw_expression`. */
+  private isThrowStatement(stmt: SyntaxNode): boolean {
+    if (stmt.type !== 'expression_statement') return false;
+    const inner = stmt.namedChildren.find((c) => !isComment(c));
+    return inner?.type === 'throw_expression';
+  }
+
+  private visitSimple(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    return { entry: idx, exits: [idx] };
+  }
+
+  private visitReturn(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    // A return crosses EVERY active finally before EXIT.
+    wireJumpThroughFinalizers(
+      this.builder,
+      idx,
+      this.cfc.finalizersForReturn(),
+      this.builder.exitIndex,
+      'return',
+    );
+    return { entry: idx, exits: [] };
+  }
+
+  private visitThrow(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    this.builder.edge(idx, this.currentHandler(), 'throw');
+    return { entry: idx, exits: [] };
+  }
+
+  private visitBreak(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(startLineOf(stmt), endLineOf(stmt), stmt.text);
+    const label = this.jumpLabel(stmt);
+    const res = this.cfc.resolveBreak(label);
+    const { target, finalizers } = res ?? {
+      target: this.builder.exitIndex,
+      finalizers: this.cfc.finalizersForReturn(),
+    };
+    wireJumpThroughFinalizers(this.builder, idx, finalizers, target, 'break');
+    return { entry: idx, exits: [] };
+  }
+
+  private visitContinue(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(startLineOf(stmt), endLineOf(stmt), stmt.text);
+    const label = this.jumpLabel(stmt);
+    const res = this.cfc.resolveContinue(label);
+    const { target, finalizers } = res ?? {
+      target: this.builder.exitIndex,
+      finalizers: this.cfc.finalizersForReturn(),
+    };
+    wireJumpThroughFinalizers(this.builder, idx, finalizers, target, 'continue');
+    return { entry: idx, exits: [] };
+  }
+
+  /**
+   * Resolve a `break N` / `continue N` to the SYNTHETIC label of the N-th
+   * enclosing loop/switch frame (innermost = 1). Returns undefined for a bare
+   * `break`/`continue` (no level), so the context resolves the nearest frame as
+   * usual. PHP counts BOTH loop AND switch frames for `break N` and `continue N`
+   * (a `switch` acts like a loop level for `continue`), which is exactly the set
+   * pushed onto {@link loopLabels} here — so one count serves both.
+   */
+  private jumpLabel(stmt: SyntaxNode): string | undefined {
+    const level = this.jumpLevel(stmt);
+    if (level <= 1) return undefined; // bare break/continue → nearest frame
+    const n = this.loopLabels.length;
+    if (level > n) return undefined; // over-deep level → conservative fallback
+    return this.loopLabels[n - level];
+  }
+
+  /** The integer level of a `break N;` / `continue N;` (default 1). */
+  private jumpLevel(stmt: SyntaxNode): number {
+    const intNode = stmt.namedChildren.find((c) => c.type === 'integer');
+    if (!intNode) return 1;
+    const v = parseInt(intNode.text, 10);
+    return Number.isFinite(v) && v >= 1 ? v : 1;
+  }
+
+  /** Push a fresh synthetic loop/switch label and return it. */
+  private nextLabel(): string {
+    const label = `__php_lvl_${this.labelSeq++}`;
+    return label;
+  }
+
+  /**
+   * `if cond: … elseif cond: … else: …`. PHP has NO nested-if else chain: the
+   * `if_statement` carries the condition + body plus zero-or-more `alternative`
+   * fields, each an `else_if_clause` (its own condition + body) or a trailing
+   * `else_clause`. The elif chain is threaded on the `cond-false` edge. Handles
+   * both brace bodies and the colon (`endif`) syntax uniformly (body field).
+   */
+  private visitIf(stmt: SyntaxNode): TraversalResult {
+    const cond = this.condOf(stmt) ?? stmt;
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(cond),
+      cond.text,
+      'normal',
+      this.harvest.facts(cond),
+    );
+
+    const exits: number[] = [];
+    const thenRes = this.visitBody(stmt.childForFieldName('body'));
+    if (thenRes) {
+      this.builder.edge(header, thenRes.entry, 'cond-true');
+      exits.push(...thenRes.exits);
+    } else {
+      exits.push(header); // empty then — true path falls through
+    }
+
+    const alternatives = this.alternativesOf(stmt);
+    let falseFrom = header;
+    for (const alt of alternatives) {
+      if (alt.type === 'else_if_clause') {
+        const elifCondRaw = alt.childForFieldName('condition');
+        const elifCond = elifCondRaw ? this.unwrapParen(elifCondRaw) : alt;
+        const elifHeader = this.builder.newBlock(
+          startLineOf(alt),
+          endLineOf(elifCond),
+          elifCond.text,
+          'normal',
+          this.harvest.facts(elifCond),
+        );
+        this.builder.edge(falseFrom, elifHeader, 'cond-false');
+        const elifRes = this.visitBody(alt.childForFieldName('body'));
+        if (elifRes) {
+          this.builder.edge(elifHeader, elifRes.entry, 'cond-true');
+          exits.push(...elifRes.exits);
+        } else {
+          exits.push(elifHeader);
+        }
+        falseFrom = elifHeader;
+      } else if (alt.type === 'else_clause') {
+        const elseRes = this.visitBody(alt.childForFieldName('body'));
+        if (elseRes) {
+          this.builder.edge(falseFrom, elseRes.entry, 'cond-false');
+          exits.push(...elseRes.exits);
+        } else {
+          exits.push(falseFrom);
+        }
+        falseFrom = -1; // an else consumes the false path entirely
+      }
+    }
+    if (falseFrom >= 0) exits.push(falseFrom); // no trailing else → fall through
+
+    return { entry: header, exits: [...new Set(exits)] };
+  }
+
+  /** The `alternative`-field children of an `if_statement`, in source order. */
+  private alternativesOf(stmt: SyntaxNode): SyntaxNode[] {
+    const out: SyntaxNode[] = [];
+    for (let i = 0; i < stmt.childCount; i++) {
+      if (stmt.fieldNameForChild(i) === 'alternative') {
+        const c = stmt.child(i);
+        if (c) out.push(c);
+      }
+    }
+    return out;
+  }
+
+  /** The (paren-unwrapped) condition expression of an if/while/do/switch. */
+  private condOf(stmt: SyntaxNode): SyntaxNode | undefined {
+    const cond = stmt.childForFieldName('condition');
+    return cond ? this.unwrapParen(cond) : undefined;
+  }
+
+  private visitWhile(stmt: SyntaxNode): TraversalResult {
+    const label = this.nextLabel();
+    const cond = this.condOf(stmt) ?? stmt;
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(cond),
+      cond.text,
+      'normal',
+      this.harvest.facts(cond),
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.loopLabels.push(label);
+    this.cfc.pushLoop(header, loopExit, [label]);
+    const body = this.visitBody(this.bodyBlockOf(stmt));
+    this.cfc.pop();
+    this.loopLabels.pop();
+
+    if (body) {
+      this.builder.edge(header, body.entry, 'cond-true');
+      this.builder.connect(body.exits, header, 'loop-back');
+    } else {
+      this.builder.edge(header, header, 'loop-back'); // empty body re-tests
+    }
+    // Always emit the structural exit edge — even `while (true)` keeps EXIT
+    // reverse-reachable for the post-dominator / CDG pass.
+    this.builder.edge(header, loopExit, 'cond-false');
+    return { entry: header, exits: [loopExit] };
+  }
+
+  private visitDoWhile(stmt: SyntaxNode): TraversalResult {
+    const label = this.nextLabel();
+    const cond = this.condOf(stmt) ?? stmt;
+    const condBlock = this.builder.newBlock(
+      startLineOf(cond),
+      endLineOf(cond),
+      cond.text,
+      'normal',
+      this.harvest.facts(cond),
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.loopLabels.push(label);
+    this.cfc.pushLoop(condBlock, loopExit, [label]);
+    const body = this.visitBody(this.bodyBlockOf(stmt));
+    this.cfc.pop();
+    this.loopLabels.pop();
+
+    const backTarget = body ? body.entry : condBlock;
+    if (body) this.builder.connect(body.exits, condBlock, 'seq');
+    this.builder.edge(condBlock, backTarget, 'loop-back'); // cond true → run body again
+    this.builder.edge(condBlock, loopExit, 'cond-false');
+    return { entry: backTarget, exits: [loopExit] };
+  }
+
+  private visitFor(stmt: SyntaxNode): TraversalResult {
+    const label = this.nextLabel();
+    const init = stmt.childForFieldName('initialize');
+    const cond = stmt.childForFieldName('condition');
+    const incr = stmt.childForFieldName('update');
+
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      cond ? endLineOf(cond) : startLineOf(stmt),
+      cond ? cond.text : 'for(;;)',
+      'normal',
+      cond ? this.harvest.facts(cond) : undefined,
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    let incrBlock = header;
+    if (incr) {
+      incrBlock = this.builder.newBlock(
+        startLineOf(incr),
+        endLineOf(incr),
+        incr.text,
+        'normal',
+        this.harvest.facts(incr),
+      );
+      this.builder.edge(incrBlock, header, 'loop-back');
+    }
+
+    this.loopLabels.push(label);
+    this.cfc.pushLoop(incrBlock, loopExit, [label]);
+    const body = this.visitBody(this.bodyBlockOf(stmt));
+    this.cfc.pop();
+    this.loopLabels.pop();
+
+    if (body) {
+      this.builder.edge(header, body.entry, 'cond-true');
+      this.builder.connect(body.exits, incrBlock, incr ? 'seq' : 'loop-back');
+    } else {
+      this.builder.edge(header, incrBlock, 'cond-true');
+      if (!incr) this.builder.edge(header, header, 'loop-back');
+    }
+    // Structural exit edge — `for (;;) {}` (no condition) still keeps EXIT
+    // reverse-reachable so CDG is not silently skipped for the function.
+    this.builder.edge(header, loopExit, 'cond-false');
+
+    let entry = header;
+    if (init) {
+      const initBlock = this.builder.newBlock(
+        startLineOf(init),
+        endLineOf(init),
+        init.text,
+        'normal',
+        this.harvest.facts(init),
+      );
+      this.builder.edge(initBlock, header, 'seq');
+      entry = initBlock;
+    }
+    return { entry, exits: [loopExit] };
+  }
+
+  private visitForEach(stmt: SyntaxNode): TraversalResult {
+    const label = this.nextLabel();
+    // Header text is SYNTHESIZED, so facts come from the iterable (use) + the
+    // loop target variable(s) (def) directly.
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      startLineOf(stmt),
+      this.forEachHeaderText(stmt),
+      'normal',
+      this.harvest.foreachHeadFacts(stmt),
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.loopLabels.push(label);
+    this.cfc.pushLoop(header, loopExit, [label]);
+    const body = this.visitBody(this.bodyBlockOf(stmt));
+    this.cfc.pop();
+    this.loopLabels.pop();
+
+    if (body) {
+      this.builder.edge(header, body.entry, 'cond-true');
+      this.builder.connect(body.exits, header, 'loop-back');
+    } else {
+      this.builder.edge(header, header, 'loop-back');
+    }
+    this.builder.edge(header, loopExit, 'cond-false');
+    return { entry: header, exits: [loopExit] };
+  }
+
+  private forEachHeaderText(stmt: SyntaxNode): string {
+    const first = stmt.namedChild(0);
+    return first ? `foreach(${first.text} as …)` : 'foreach(… as …)';
+  }
+
+  private visitSwitch(stmt: SyntaxNode): TraversalResult {
+    const label = this.nextLabel();
+    const value = this.condOf(stmt) ?? stmt;
+    const dispatch = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(value),
+      value.text,
+      'normal',
+      this.harvest.facts(value),
+    );
+    const switchExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.loopLabels.push(label);
+    this.cfc.pushSwitch(switchExit, [label]);
+
+    const body = stmt.childForFieldName('body');
+    // A `switch_block` holds `case_statement`s (field `value`, fall through) and a
+    // `default_statement`.
+    const groups = body
+      ? body.namedChildren.filter(
+          (c) => c.type === 'case_statement' || c.type === 'default_statement',
+        )
+      : [];
+
+    // Each case-test expression evaluates before its body runs — harvest its uses
+    // onto the dispatch block, CONDITIONALLY (a later case test only runs when
+    // earlier cases didn't match).
+    for (const g of groups) {
+      const test = this.caseTest(g);
+      if (test) this.builder.attachFacts(dispatch, this.harvest.factsConditional(test));
+    }
+
+    const groupResults = groups.map((g) => this.visitSeq(this.caseStatements(g)));
+    const hasDefault = groups.some((g) => g.type === 'default_statement');
+
+    const entryOf: number[] = new Array(groups.length);
+    let after = switchExit;
+    for (let i = groups.length - 1; i >= 0; i--) {
+      entryOf[i] = groupResults[i]?.entry ?? after;
+      after = entryOf[i];
+    }
+
+    for (let i = 0; i < groups.length; i++) {
+      this.builder.edge(dispatch, entryOf[i], 'switch-case');
+    }
+    if (!hasDefault) this.builder.edge(dispatch, switchExit, 'switch-case'); // no-match path
+
+    // C-style FALLTHROUGH: a case with no break/return falls through to the next.
+    for (let i = 0; i < groups.length; i++) {
+      const res = groupResults[i];
+      if (!res) continue;
+      const fallTarget = i + 1 < groups.length ? entryOf[i + 1] : switchExit;
+      this.builder.connect(res.exits, fallTarget, 'fallthrough');
+    }
+
+    this.cfc.pop();
+    this.loopLabels.pop();
+    return { entry: dispatch, exits: [switchExit] };
+  }
+
+  /** A switch group's body statements (everything but its case-test value). */
+  private caseStatements(group: SyntaxNode): SyntaxNode[] {
+    const value = group.childForFieldName('value');
+    return group.namedChildren.filter((c) => c.id !== value?.id && !isComment(c));
+  }
+
+  /** The case-test value expression of a `case_statement` (default has none). */
+  private caseTest(group: SyntaxNode): SyntaxNode | undefined {
+    return group.childForFieldName('value') ?? undefined;
+  }
+
+  /**
+   * try / catch / finally. A `finally` runs on BOTH normal and exception exit —
+   * a `return`/`break`/`continue` crossing it threads through it (`finally-*`
+   * completion edges).
+   */
+  private visitTry(stmt: SyntaxNode): SeqResult {
+    const bodyNode = stmt.childForFieldName('body');
+    const catchClauses: SyntaxNode[] = [];
+    let finallyClause: SyntaxNode | undefined;
+    for (let i = 0; i < stmt.namedChildCount; i++) {
+      const c = stmt.namedChild(i);
+      if (c?.type === 'catch_clause') catchClauses.push(c);
+      else if (c?.type === 'finally_clause') finallyClause = c;
+    }
+    const finallyBody = finallyClause?.childForFieldName('body');
+
+    return this.buildProtected(bodyNode ?? null, catchClauses, finallyBody ?? null);
+  }
+
+  /**
+   * Shared try/catch/finally builder (mirrors the Java visitor). `catchClauses`
+   * may be empty; `finallyBody` is the explicit finally's body (or null).
+   *
+   * Normal completion of try AND catch flows through the finally; a throw in the
+   * protected region routes to the handler; early exits crossing the finally
+   * thread through it (`finally-*` completion edges).
+   */
+  private buildProtected(
+    bodyNode: SyntaxNode | null,
+    catchClauses: SyntaxNode[],
+    finallyBody: SyntaxNode | null,
+  ): SeqResult {
+    const finallyRes = finallyBody ? this.visitBody(finallyBody) : null;
+    const finFrame = finallyRes ? this.cfc.pushFinalizer(finallyRes.entry) : null;
+    const finalizerEntry = finallyRes?.entry;
+
+    // Build each catch handler.
+    const catchEntries: number[] = [];
+    const catchExits: number[] = [];
+    let firstCatchEntry: number | undefined;
+    for (const clause of catchClauses) {
+      const clauseBody = clause.childForFieldName('body');
+      if (finalizerEntry !== undefined) this.handlers.push(finalizerEntry);
+      let res: SeqResult = clauseBody ? this.visitBody(clauseBody) : null;
+      if (finalizerEntry !== undefined) this.handlers.pop();
+      if (res === null) {
+        // Empty `catch {}` still catches — synthesize one block so exception flow
+        // lands somewhere and the post-try code stays reachable.
+        const idx = this.builder.newBlock(startLineOf(clause), endLineOf(clause), '');
+        res = { entry: idx, exits: [idx] };
+      }
+      const paramFacts = this.harvest.catchParamFacts(clause);
+      if (paramFacts) {
+        const paramBlock = this.builder.newBlock(
+          startLineOf(clause),
+          startLineOf(clause),
+          '',
+          'normal',
+          paramFacts,
+        );
+        this.builder.edge(paramBlock, res.entry, 'seq');
+        res = { entry: paramBlock, exits: res.exits };
+      }
+      catchEntries.push(res.entry);
+      catchExits.push(...res.exits);
+      if (firstCatchEntry === undefined) firstCatchEntry = res.entry;
+    }
+
+    // Handler for the try body: first catch if present, else the finally, else
+    // the outer handler.
+    const tryHandler = firstCatchEntry ?? finalizerEntry ?? this.currentHandler();
+    const protectedStart = this.builder.blockCount;
+    this.handlers.push(tryHandler);
+    const bodyRes = bodyNode ? this.visitBody(bodyNode) : null;
+    this.handlers.pop();
+
+    if (catchClauses.length > 0 || finalizerEntry !== undefined) {
+      for (let b = protectedStart; b < this.builder.blockCount; b++) {
+        this.builder.edge(b, tryHandler, 'throw');
+      }
+    }
+
+    // Pop the finalizer frame and drain its pending crossing-jump legs.
+    if (finFrame && finallyRes) {
+      this.cfc.pop();
+      drainFinalizerPending(this.builder, finFrame, finallyRes.exits);
+    }
+
+    const exits: number[] = [];
+    if (finalizerEntry !== undefined && finallyRes) {
+      if (bodyRes) this.builder.connect(bodyRes.exits, finalizerEntry, 'seq');
+      for (const e of catchExits) this.builder.edge(e, finalizerEntry, 'seq');
+      exits.push(...finallyRes.exits);
+      // No catch → an exception re-propagates out after the finally runs.
+      if (catchClauses.length === 0) {
+        this.builder.connect(finallyRes.exits, this.currentHandler(), 'throw');
+      }
+    } else {
+      if (bodyRes) exits.push(...bodyRes.exits);
+      exits.push(...catchExits);
+    }
+
+    const entry = bodyRes?.entry ?? finalizerEntry ?? catchEntries[0];
+    if (entry === undefined) return null;
+    return { entry, exits: [...new Set(exits)] };
+  }
+
+  /** Nearest enclosing exception handler, or the function EXIT. */
+  private currentHandler(): number {
+    return this.handlers.length ? this.handlers[this.handlers.length - 1] : this.builder.exitIndex;
+  }
+}
+
+/** Build the CFG for one PHP function node, or `undefined` if not modelable. */
+function buildFunctionCfg(fnNode: SyntaxNode, filePath: string): FunctionCfg | undefined {
+  try {
+    if (!PHP_FUNCTION_TYPES.has(fnNode.type)) return undefined;
+    const startLine = startLineOf(fnNode);
+    const endLine = endLineOf(fnNode);
+    const startColumn = fnNode.startPosition.column;
+
+    const body = fnNode.childForFieldName('body');
+    if (!body) return undefined; // abstract / interface method — no body
+
+    const builder = new CfgBuilder(filePath, startLine, endLine, startColumn);
+    const harvest = new PhpHarvester(fnNode);
+
+    const paramFacts = harvest.paramFacts();
+    if (paramFacts) builder.attachFacts(builder.entryIndex, paramFacts);
+
+    if (fnNode.type === 'arrow_function' || body.type !== 'compound_statement') {
+      // `fn($x) => expr` — the body is an EXPRESSION (no block): one block whose
+      // value is returned.
+      const blk = builder.newBlock(
+        startLineOf(body),
+        endLineOf(body),
+        body.text,
+        'normal',
+        harvest.facts(body),
+      );
+      builder.edge(builder.entryIndex, blk, 'seq');
+      builder.edge(blk, builder.exitIndex, 'return');
+      return builder.finish(harvest.bindingTable());
+    }
+
+    const walk = new PhpCfgWalk(builder, harvest);
+    const res = walk.visitSeq(body.namedChildren.filter((c) => c.type !== 'comment'));
+    if (!res) {
+      builder.edge(builder.entryIndex, builder.exitIndex, 'seq'); // empty body
+      return builder.finish(harvest.bindingTable());
+    }
+    builder.edge(builder.entryIndex, res.entry, 'seq');
+    builder.connect(res.exits, builder.exitIndex, 'seq'); // normal fall-off → EXIT
+    return builder.finish(harvest.bindingTable());
+  } catch (err) {
+    // Never throw out of buildFunctionCfg — a malformed AST shape must skip only
+    // this one function's CFG, never drop the whole file's language group (R4).
+    // eslint-disable-next-line no-console
+    console.warn(`[cfg] PHP buildFunctionCfg skipped a function in ${filePath}: ${String(err)}`);
+    return undefined;
+  }
+}
+
+/** Whether a node is a PHP function this visitor builds a CFG for. */
+function isFunction(node: SyntaxNode): boolean {
+  return PHP_FUNCTION_TYPES.has(node.type);
+}
+
+/** The PHP CFG visitor. */
+export function createPhpCfgVisitor(): CfgVisitor<SyntaxNode> {
+  return { buildFunctionCfg, isFunction };
+}
+
+export { PHP_FUNCTION_TYPES };
diff --git a/gitnexus/src/core/ingestion/cfg/visitors/python-harvest.ts b/gitnexus/src/core/ingestion/cfg/visitors/python-harvest.ts
new file mode 100644
index 000000000..f5a4863c6
--- /dev/null
+++ b/gitnexus/src/core/ingestion/cfg/visitors/python-harvest.ts
@@ -0,0 +1,660 @@
+/**
+ * Python def/use harvester — the Python analogue of
+ * {@link import('./typescript-harvest.js').TsHarvester} and the C-family
+ * harvesters ({@link import('./go-harvest.js').GoHarvester} et al.). Python is
+ * the most structurally divergent CFG target (indentation blocks, no braces,
+ * comprehensions, `with`, `try/except/else/finally`, `match/case`), so this
+ * harvester exercises the shared reaching-defs / CDG substrate against a grammar
+ * with none of the brace-family assumptions.
+ *
+ * Runs in the parse worker next to the Python CFG visitor, extracting
+ * per-statement variable definition/use facts that ride the side channel for the
+ * reaching-defs / CDG solvers. Output is the per-function binding table
+ * ({@link BindingEntry}[]) plus {@link StatementFacts} the visitor attaches to
+ * blocks as it walks. NO `sites[]` are harvested here — the call-site taint
+ * substrate is a later step (this unit emits only bindings + defs/uses + mayDefs
+ * via the local {@link FactAccumulator}, which has no site machinery at all).
+ *
+ * Every node type and field literal below was grammar-validated against
+ * tree-sitter-python (0.23.x) via the introspection probe before use (mandatory
+ * pre-step). Python shapes pre-empted (verified by a real parse):
+ *  - functions: `function_definition` (fields `name`/`parameters`/`body`; async
+ *    is the SAME node with an `async` token child) and `lambda` (fields
+ *    `parameters`=`lambda_parameters`, `body`).
+ *  - parameters: bare `identifier`, `default_parameter` (fields `name`/`value`),
+ *    `typed_parameter` (no `name` field — the binder is a named child:
+ *    `identifier` / `list_splat_pattern` / `dictionary_splat_pattern`),
+ *    `typed_default_parameter` (fields `name`/`type`/`value`),
+ *    `list_splat_pattern` (`*args`), `dictionary_splat_pattern` (`**kwargs`).
+ *  - assignment targets: `assignment` (fields `left`/`right`/optional `type`;
+ *    LHS may be `identifier`, `pattern_list`, `tuple_pattern`, `list_pattern`,
+ *    `attribute`, or `subscript`), `augmented_assignment` (fields
+ *    `left`/`operator`/`right` — read+write), `named_expression` walrus (fields
+ *    `name`/`value`).
+ *  - unpacking patterns: `pattern_list` / `tuple_pattern` / `list_pattern`
+ *    nest `identifier` and `list_splat_pattern` (`*rest`) targets.
+ *  - binders: `for_statement` (fields `left`/`right`), `for_in_clause`
+ *    (comprehension binder, fields `left`/`right`), `with_item` (field `value`
+ *    = `as_pattern` whose `alias`=`as_pattern_target`, or a bare expression),
+ *    `except_clause` / `except_group_clause` (`as_pattern` → `as_pattern_target`),
+ *    `global_statement` / `nonlocal_statement` (identifier children).
+ *  - reads: `attribute` (fields `object`/`attribute`), `subscript` (fields
+ *    `value`/`subscript`), `call` (fields `function`/`arguments`),
+ *    `boolean_operator` (fields `left`/`operator`/`right`),
+ *    `conditional_expression` (ternary: consequent / condition / alternative in
+ *    source order), `parenthesized_expression`.
+ *
+ * TWO-PHASE, ORDER-INDEPENDENT (load-bearing — mirrors the TS / Go harvesters):
+ * the CFG walk is NOT source-order, so resolving names against a scope stack
+ * populated *during* the walk would mis-resolve. Phase 1 pre-scans the whole
+ * function subtree once, declaring every in-function name (Python's def-on-first-
+ * assignment scoping has a SINGLE function scope — there is no block scope, so
+ * the whole function body shares one table). Phase 2 resolves defs/uses against
+ * that finished table from any walk order.
+ *
+ * Python scope model (deliberately simplified, documented): Python binds names
+ * at FUNCTION scope on first assignment anywhere in the body (no block scope).
+ * We therefore declare all assignment / for / with / except / walrus /
+ * comprehension targets and parameters into the single function table.
+ * `global x` / `nonlocal x` names are recorded as SYNTHETIC module-level
+ * bindings (`name@module`) so their writes/reads share one binding with the
+ * outer scope rather than minting a confusing function-local. Comprehension
+ * targets technically have their OWN scope in Py3 (a leaked `i` after `[i for
+ * i in xs]` does NOT exist), but we declare them in the function table anyway —
+ * a documented over-approximation that keeps the comprehension target a real
+ * def (the plan's explicit ask) without modeling nested comprehension scopes.
+ *
+ * v1 def-semantics scope:
+ *   - `assignment` plain `=` — each identifier target in the (possibly nested)
+ *     LHS pattern is a def; a `*rest` splat target is a def; an `attribute` /
+ *     `subscript` target is NOT a scalar def (its root identifier is a use).
+ *   - `augmented_assignment` (`x += 1`) — def AND use the lvalue.
+ *   - `named_expression` walrus (`(n := f())`) — `n` is a def.
+ *   - `for_statement` / `for_in_clause` `left` — loop/comprehension targets are
+ *     defs; `right` is a use.
+ *   - `with_item` `as` alias (`with cm as fh`) — `fh` is a def.
+ *   - `except ... as e` — `e` is a `catch`-kind def (matters to the taint pass).
+ *   - parameters (incl. defaults, `*args`, `**kwargs`, typed) — `param`-kind defs.
+ * EXCLUDED, deliberately (TypeScript-CFA precedent): attribute / subscript
+ * writes (`obj.f = …`, `arr[i] = …`) are NOT scalar defs — their root
+ * identifiers are uses only. Nested function (`function_definition` / `lambda`)
+ * bodies are opaque in BOTH directions (reads of and writes to captured outer
+ * variables are invisible — callback flows are later-pass territory).
+ *
+ * MAY-DEFS: a def inside a conditionally-evaluated subexpression is a may-def
+ * (gen WITHOUT kill), so the not-taken path's prior def is not falsely killed.
+ * Python's conditional-def shapes: a walrus in the right operand of `or` / `and`
+ * short-circuit (`a or (x := b)`), a walrus in either non-test arm of a ternary
+ * (`(a := p) if c else (b := q)`), and a `case`-clause guard / pattern test.
+ *
+ * NOTE: nothing serialized here may carry a field named `nodeId` — the durable
+ * parsedfile-store reviver dedups objects keyed on that field name.
+ */
+import type { SyntaxNode } from '../../utils/ast-helpers.js';
+import type { BindingEntry, StatementFacts } from '../types.js';
+import { DefUseAccumulator as FactAccumulator } from './call-site-harvest.js';
+
+/** Node types that own a nested CFG — their subtrees are opaque to harvesting. */
+const NESTED_FUNCTION_TYPES = new Set(['function_definition', 'lambda']);
+
+/** LHS pattern containers whose identifier/splat leaves are assignment targets. */
+const PATTERN_LIST_TYPES = new Set(['pattern_list', 'tuple_pattern', 'list_pattern']);
+
+export class PythonHarvester {
+  private readonly bindings: BindingEntry[] = [];
+  /** Single function-scope name → binding index (Python has no block scope). */
+  private readonly table = new Map<string, number>();
+  private readonly synthetic = new Map<string, number>();
+  /** Names declared `global`/`nonlocal` — resolve to the synthetic module binding. */
+  private readonly globalNames = new Set<string>();
+  private readonly fnId: number;
+  /** >0 while walking a conditionally-evaluated subexpression — defs become may-defs. */
+  private conditionalDepth = 0;
+
+  constructor(private readonly fnNode: SyntaxNode) {
+    this.fnId = fnNode.id;
+    this.declareParams(fnNode);
+    const body = this.bodyOf(fnNode);
+    if (body) this.prescan(body);
+  }
+
+  /** The completed binding table — pass to `CfgBuilder.finish`. */
+  bindingTable(): readonly BindingEntry[] {
+    return this.bindings;
+  }
+
+  /** The function/lambda body node (a `block` for `def`, an expression for `lambda`). */
+  private bodyOf(fnNode: SyntaxNode): SyntaxNode | undefined {
+    return fnNode.childForFieldName('body') ?? undefined;
+  }
+
+  // ── phase 1: declaration pre-scan ────────────────────────────────────────
+
+  private declare(nameNode: SyntaxNode, kind: BindingEntry['kind']): void {
+    const name = nameNode.text;
+    if (!name || name === '_' || this.table.has(name) || this.globalNames.has(name)) return;
+    this.table.set(name, this.bindings.length);
+    this.bindings.push({
+      name,
+      declLine: nameNode.startPosition.row + 1,
+      declColumn: nameNode.startPosition.column,
+      kind,
+    });
+  }
+
+  /** Declare every parameter binder (incl. defaults, typed, `*args`, `**kwargs`). */
+  private declareParams(fnNode: SyntaxNode): void {
+    const params =
+      fnNode.childForFieldName('parameters') ??
+      fnNode.namedChildren.find((c) => c.type === 'parameters' || c.type === 'lambda_parameters');
+    if (!params) return;
+    for (let i = 0; i < params.namedChildCount; i++) {
+      const p = params.namedChild(i);
+      if (p) this.declareParam(p);
+    }
+  }
+
+  /** Declare the binder identifier(s) of one parameter node. */
+  private declareParam(p: SyntaxNode): void {
+    switch (p.type) {
+      case 'identifier':
+        this.declare(p, 'param');
+        return;
+      case 'default_parameter':
+      case 'typed_default_parameter': {
+        const name = p.childForFieldName('name');
+        if (name) this.declareParamBinder(name);
+        return;
+      }
+      case 'typed_parameter': {
+        // No `name` field — the binder is the first non-`type` named child
+        // (an identifier or a splat pattern).
+        const typeNode = p.childForFieldName('type');
+        for (let i = 0; i < p.namedChildCount; i++) {
+          const c = p.namedChild(i);
+          if (c && c.id !== typeNode?.id) {
+            this.declareParamBinder(c);
+            break;
+          }
+        }
+        return;
+      }
+      case 'list_splat_pattern':
+      case 'dictionary_splat_pattern':
+        this.declareParamBinder(p);
+        return;
+      default:
+        // tuple-grouped params and the like — declare any identifier leaves.
+        this.declareParamBinder(p);
+    }
+  }
+
+  /** Declare a binder that may be an identifier or a `*`/`**` splat pattern. */
+  private declareParamBinder(node: SyntaxNode): void {
+    if (node.type === 'identifier') {
+      this.declare(node, 'param');
+      return;
+    }
+    if (node.type === 'list_splat_pattern' || node.type === 'dictionary_splat_pattern') {
+      const id = node.namedChild(0);
+      if (id?.type === 'identifier') this.declare(id, 'param');
+      return;
+    }
+    // Nested grouping — declare identifier descendants up to the next binder.
+    for (let i = 0; i < node.namedChildCount; i++) {
+      const c = node.namedChild(i);
+      if (c?.type === 'identifier') this.declare(c, 'param');
+    }
+  }
+
+  /**
+   * Pre-scan the function body once, declaring every in-function name. Recurses
+   * into compound statements but NOT into nested `function_definition` / `lambda`
+   * bodies (opaque). `global`/`nonlocal` are processed FIRST in a sibling sweep
+   * so a later assignment to a global name does not mint a function-local.
+   */
+  private prescan(node: SyntaxNode): void {
+    const t = node.type;
+    if (NESTED_FUNCTION_TYPES.has(t) && node.id !== this.fnId) return;
+
+    switch (t) {
+      case 'global_statement':
+      case 'nonlocal_statement': {
+        for (let i = 0; i < node.namedChildCount; i++) {
+          const c = node.namedChild(i);
+          if (c?.type === 'identifier') this.globalNames.add(c.text);
+        }
+        return;
+      }
+      case 'assignment': {
+        const left = node.childForFieldName('left');
+        if (left) this.declareTargets(left);
+        break;
+      }
+      case 'augmented_assignment': {
+        const left = node.childForFieldName('left');
+        if (left) this.declareTargets(left);
+        break;
+      }
+      case 'named_expression': {
+        const name = node.childForFieldName('name');
+        if (name?.type === 'identifier') this.declare(name, 'let');
+        break;
+      }
+      case 'for_statement':
+      case 'for_in_clause': {
+        const left = node.childForFieldName('left');
+        if (left) this.declareTargets(left);
+        break;
+      }
+      case 'with_item': {
+        this.declareWithItem(node);
+        break;
+      }
+      case 'except_clause':
+      case 'except_group_clause': {
+        this.declareExceptAlias(node);
+        break;
+      }
+      default:
+        break;
+    }
+
+    for (let i = 0; i < node.namedChildCount; i++) {
+      const c = node.namedChild(i);
+      if (c) this.prescan(c);
+    }
+  }
+
+  /** Declare identifier/splat leaves of an assignment / loop target pattern. */
+  private declareTargets(target: SyntaxNode): void {
+    const t = target.type;
+    if (t === 'identifier') {
+      this.declare(target, 'let');
+      return;
+    }
+    if (PATTERN_LIST_TYPES.has(t)) {
+      for (let i = 0; i < target.namedChildCount; i++) {
+        const c = target.namedChild(i);
+        if (c) this.declareTargets(c);
+      }
+      return;
+    }
+    if (t === 'list_splat_pattern') {
+      const id = target.namedChild(0);
+      if (id?.type === 'identifier') this.declare(id, 'let');
+      return;
+    }
+    // attribute / subscript target — not a scalar def (root is a use only).
+  }
+
+  /** `with EXPR as TARGET` — declare the alias target(s). */
+  private declareWithItem(item: SyntaxNode): void {
+    const value = item.childForFieldName('value') ?? item.namedChild(0);
+    if (value?.type !== 'as_pattern') return;
+    const alias = value.childForFieldName('alias') ?? this.asPatternTarget(value);
+    if (alias) this.declareAsTarget(alias);
+  }
+
+  /** `except E as e` — declare `e`. */
+  private declareExceptAlias(clause: SyntaxNode): void {
+    for (let i = 0; i < clause.namedChildCount; i++) {
+      const c = clause.namedChild(i);
+      if (c?.type === 'as_pattern') {
+        const alias = c.childForFieldName('alias') ?? this.asPatternTarget(c);
+        if (alias) this.declareAsTarget(alias, 'catch');
+      }
+    }
+  }
+
+  /** The `as_pattern_target` child of an `as_pattern` (when no `alias` field). */
+  private asPatternTarget(asPattern: SyntaxNode): SyntaxNode | undefined {
+    return asPattern.namedChildren.find((c) => c.type === 'as_pattern_target');
+  }
+
+  /** Declare an `as_pattern_target` (or its identifier child) as a binding. */
+  private declareAsTarget(target: SyntaxNode, kind: BindingEntry['kind'] = 'let'): void {
+    if (target.type === 'identifier') {
+      this.declare(target, kind);
+      return;
+    }
+    // `as_pattern_target` wraps an identifier (or a tuple pattern).
+    const inner = target.namedChild(0);
+    if (inner?.type === 'identifier') this.declare(inner, kind);
+    else if (inner) this.declareTargets(inner);
+    else this.declare(target, kind); // a bare `as_pattern_target` text IS the name
+  }
+
+  // ── phase 2: per-statement fact extraction ───────────────────────────────
+
+  /** Def/use facts for one statement (or construct-header expression) node. */
+  facts(node: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(node.startPosition.row + 1);
+    this.walkValue(node, acc);
+    return acc.finish();
+  }
+
+  /** Facts for an expression whose WHOLE evaluation is conditional (case tests). */
+  factsConditional(node: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(node.startPosition.row + 1);
+    this.conditional(() => this.walkValue(node, acc));
+    return acc.finish();
+  }
+
+  /**
+   * Facts for a `for TARGET in ITER` / `for_in_clause` head: the loop target(s)
+   * are defs, the iterated expression is a use.
+   */
+  loopHeadFacts(headNode: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(headNode.startPosition.row + 1);
+    const left = headNode.childForFieldName('left');
+    const right = headNode.childForFieldName('right');
+    if (right) this.walkValue(right, acc);
+    if (left) this.defTargets(left, acc);
+    return acc.finish();
+  }
+
+  /** Facts for a `with_item`: the `as` alias is a def, the value an use. */
+  withItemFacts(item: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(item.startPosition.row + 1);
+    const value = item.childForFieldName('value') ?? item.namedChild(0);
+    if (!value) return acc.finish();
+    if (value.type === 'as_pattern') {
+      const inner = value.namedChild(0);
+      if (inner) this.walkValue(inner, acc);
+      const alias = value.childForFieldName('alias') ?? this.asPatternTarget(value);
+      if (alias) this.defAsTarget(alias, acc);
+    } else {
+      this.walkValue(value, acc);
+    }
+    return acc.finish();
+  }
+
+  /** Facts for an `except E as e:` header: `e` is a def, `E` a use. */
+  exceptHeadFacts(clause: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(clause.startPosition.row + 1);
+    const block = clause.namedChildren.find((c) => c.type === 'block');
+    for (let i = 0; i < clause.namedChildCount; i++) {
+      const c = clause.namedChild(i);
+      if (!c || c.id === block?.id) continue;
+      if (c.type === 'as_pattern') {
+        const exc = c.namedChild(0);
+        if (exc) this.walkValue(exc, acc);
+        const alias = c.childForFieldName('alias') ?? this.asPatternTarget(c);
+        if (alias) this.defAsTarget(alias, acc);
+      } else {
+        this.walkValue(c, acc);
+      }
+    }
+    return acc.finish();
+  }
+
+  /** ENTRY-block facts for the parameters (defs only — incl. default-value uses). */
+  paramFacts(): StatementFacts | undefined {
+    const params =
+      this.fnNode.childForFieldName('parameters') ??
+      this.fnNode.namedChildren.find(
+        (c) => c.type === 'parameters' || c.type === 'lambda_parameters',
+      );
+    if (!params) return undefined;
+    const acc = new FactAccumulator(this.fnNode.startPosition.row + 1);
+    for (let i = 0; i < params.namedChildCount; i++) {
+      const p = params.namedChild(i);
+      if (p) this.defParam(p, acc);
+    }
+    return acc.defCount() || acc.finish().uses.length ? acc.finish() : undefined;
+  }
+
+  /** Def the binder(s) of one parameter node and use any default-value expr. */
+  private defParam(p: SyntaxNode, acc: FactAccumulator): void {
+    switch (p.type) {
+      case 'identifier':
+        this.def(p, acc);
+        return;
+      case 'default_parameter':
+      case 'typed_default_parameter': {
+        const value = p.childForFieldName('value');
+        if (value) this.walkValue(value, acc);
+        const name = p.childForFieldName('name');
+        if (name) this.defParamBinder(name, acc);
+        return;
+      }
+      case 'typed_parameter': {
+        const typeNode = p.childForFieldName('type');
+        for (let i = 0; i < p.namedChildCount; i++) {
+          const c = p.namedChild(i);
+          if (c && c.id !== typeNode?.id) {
+            this.defParamBinder(c, acc);
+            break;
+          }
+        }
+        return;
+      }
+      case 'list_splat_pattern':
+      case 'dictionary_splat_pattern':
+        this.defParamBinder(p, acc);
+        return;
+      default:
+        this.defParamBinder(p, acc);
+    }
+  }
+
+  private defParamBinder(node: SyntaxNode, acc: FactAccumulator): void {
+    if (node.type === 'identifier') {
+      this.def(node, acc);
+      return;
+    }
+    if (node.type === 'list_splat_pattern' || node.type === 'dictionary_splat_pattern') {
+      const id = node.namedChild(0);
+      if (id?.type === 'identifier') this.def(id, acc);
+      return;
+    }
+    for (let i = 0; i < node.namedChildCount; i++) {
+      const c = node.namedChild(i);
+      if (c?.type === 'identifier') this.def(c, acc);
+    }
+  }
+
+  private resolve(nameNode: SyntaxNode): number {
+    const name = nameNode.text;
+    if (!this.globalNames.has(name)) {
+      const idx = this.table.get(name);
+      if (idx !== undefined) return idx;
+    }
+    let idx = this.synthetic.get(name);
+    if (idx === undefined) {
+      idx = this.bindings.length;
+      this.synthetic.set(name, idx);
+      this.bindings.push({ name, declLine: 0, declColumn: 0, kind: 'module', synthetic: true });
+    }
+    return idx;
+  }
+
+  private def(nameNode: SyntaxNode, acc: FactAccumulator): void {
+    if (nameNode.text === '_') return; // blank target defines nothing of interest
+    if (this.conditionalDepth > 0) acc.addMayDef(this.resolve(nameNode));
+    else acc.addDef(this.resolve(nameNode));
+  }
+
+  private use(nameNode: SyntaxNode, acc: FactAccumulator): void {
+    if (nameNode.text === '_') return;
+    acc.addUse(this.resolve(nameNode));
+  }
+
+  /** Run `fn` with defs demoted to may-defs (conditionally-evaluated context). */
+  private conditional(fn: () => void): void {
+    this.conditionalDepth++;
+    try {
+      fn();
+    } finally {
+      this.conditionalDepth--;
+    }
+  }
+
+  /**
+   * Def each identifier/splat leaf of an assignment / loop target pattern; route
+   * attribute / subscript targets to the value walk (root identifier is a use).
+   */
+  private defTargets(target: SyntaxNode, acc: FactAccumulator): void {
+    const t = target.type;
+    if (t === 'identifier') {
+      this.def(target, acc);
+      return;
+    }
+    if (PATTERN_LIST_TYPES.has(t)) {
+      for (let i = 0; i < target.namedChildCount; i++) {
+        const c = target.namedChild(i);
+        if (c) this.defTargets(c, acc);
+      }
+      return;
+    }
+    if (t === 'list_splat_pattern') {
+      const id = target.namedChild(0);
+      if (id?.type === 'identifier') this.def(id, acc);
+      else if (id) this.defTargets(id, acc);
+      return;
+    }
+    // attribute / subscript / call target — uses only (the root identifier).
+    this.walkValue(target, acc);
+  }
+
+  /** Def an `as_pattern_target` (or its identifier child). */
+  private defAsTarget(target: SyntaxNode, acc: FactAccumulator): void {
+    if (target.type === 'identifier') {
+      this.def(target, acc);
+      return;
+    }
+    const inner = target.namedChild(0);
+    if (inner?.type === 'identifier') this.def(inner, acc);
+    else if (inner) this.defTargets(inner, acc);
+    else this.def(target, acc);
+  }
+
+  /** Value-position walk: collect uses; route def positions to the target handler. */
+  private walkValue(node: SyntaxNode, acc: FactAccumulator): void {
+    const t = node.type;
+    if (NESTED_FUNCTION_TYPES.has(t) && node.id !== this.fnId) return; // opaque
+
+    switch (t) {
+      case 'identifier':
+        this.use(node, acc);
+        return;
+      case 'assignment': {
+        const left = node.childForFieldName('left');
+        const right = node.childForFieldName('right');
+        if (right) this.walkValue(right, acc);
+        if (left) this.defTargets(left, acc);
+        return;
+      }
+      case 'augmented_assignment': {
+        const left = node.childForFieldName('left');
+        const right = node.childForFieldName('right');
+        if (right) this.walkValue(right, acc);
+        if (left) {
+          // `x += v` reads AND writes a plain-identifier lvalue.
+          if (left.type === 'identifier') {
+            this.use(left, acc);
+            this.def(left, acc);
+          } else {
+            this.walkValue(left, acc); // attribute/subscript lvalue — use only
+          }
+        }
+        return;
+      }
+      case 'named_expression': {
+        // walrus `(n := v)` — `n` is a def, `v` a use.
+        const name = node.childForFieldName('name');
+        const value = node.childForFieldName('value');
+        if (value) this.walkValue(value, acc);
+        if (name?.type === 'identifier') this.def(name, acc);
+        return;
+      }
+      case 'boolean_operator': {
+        // `a or b` / `a and b` — the right operand is conditionally evaluated, so
+        // any def inside it (a walrus) is a may-def; uses are still recorded.
+        const left = node.childForFieldName('left');
+        const right = node.childForFieldName('right');
+        if (left) this.walkValue(left, acc);
+        if (right) this.conditional(() => this.walkValue(right, acc));
+        return;
+      }
+      case 'conditional_expression': {
+        // `consequent if condition else alternative`. The condition always
+        // evaluates; each arm is conditional (its walrus defs are may-defs).
+        const children = node.namedChildren;
+        const [consequent, condition, alternative] = children;
+        if (condition) this.walkValue(condition, acc);
+        if (consequent) this.conditional(() => this.walkValue(consequent, acc));
+        if (alternative) this.conditional(() => this.walkValue(alternative, acc));
+        return;
+      }
+      case 'attribute': {
+        // `a.b` — value read of the operand root only; the attribute name is not
+        // a scalar binding.
+        const obj = node.childForFieldName('object');
+        if (obj) this.walkValue(obj, acc);
+        return;
+      }
+      case 'subscript': {
+        // `a[i]` — both the container root and the index are uses.
+        const value = node.childForFieldName('value');
+        const sub = node.childForFieldName('subscript');
+        if (value) this.walkValue(value, acc);
+        if (sub) this.walkValue(sub, acc);
+        return;
+      }
+      case 'call': {
+        // Reproduce default-descent uses: callee chain + arguments. No site
+        // record (taint substrate is a later step).
+        const fn = node.childForFieldName('function');
+        const args = node.childForFieldName('arguments');
+        if (fn) this.walkValue(fn, acc);
+        if (args) this.walkValue(args, acc);
+        return;
+      }
+      case 'list_comprehension':
+      case 'set_comprehension':
+      case 'dictionary_comprehension':
+      case 'generator_expression': {
+        this.walkComprehension(node, acc);
+        return;
+      }
+      case 'keyword_argument': {
+        // `f(k=v)` — `k` is a parameter name, not a use; only `v` is a use.
+        const value = node.childForFieldName('value');
+        if (value) this.walkValue(value, acc);
+        return;
+      }
+      default:
+        for (let i = 0; i < node.namedChildCount; i++) {
+          const c = node.namedChild(i);
+          if (c) this.walkValue(c, acc);
+        }
+    }
+  }
+
+  /**
+   * A comprehension (`[body for t in src if g]`): each `for_in_clause` target is
+   * a def, its source a use; the `body` and any `if_clause` are uses. Kept INLINE
+   * (no separate CFG blocks) per the plan — the target binding is harvested so it
+   * is a real def. The `for_in_clause` source is walked in the ENCLOSING context
+   * (it reads outer names), the body/filter after the targets are bound.
+   */
+  private walkComprehension(node: SyntaxNode, acc: FactAccumulator): void {
+    const body = node.childForFieldName('body');
+    for (let i = 0; i < node.namedChildCount; i++) {
+      const c = node.namedChild(i);
+      if (!c) continue;
+      if (c.type === 'for_in_clause') {
+        const left = c.childForFieldName('left');
+        const right = c.childForFieldName('right');
+        if (right) this.walkValue(right, acc);
+        if (left) this.defTargets(left, acc);
+      } else if (c.id !== body?.id) {
+        // `if_clause` filter (and any other auxiliary clause) — uses only.
+        this.walkValue(c, acc);
+      }
+    }
+    if (body) this.walkValue(body, acc);
+  }
+}
diff --git a/gitnexus/src/core/ingestion/cfg/visitors/python.ts b/gitnexus/src/core/ingestion/cfg/visitors/python.ts
new file mode 100644
index 000000000..2410e9c82
--- /dev/null
+++ b/gitnexus/src/core/ingestion/cfg/visitors/python.ts
@@ -0,0 +1,775 @@
+/**
+ * Python CfgVisitor — the most STRUCTURALLY DIVERGENT CFG target (PDG layer
+ * beyond the C-family). Python has no braces (suites are indented `block` nodes),
+ * `elif` clauses, `for`/`while ... else` (the else runs on NORMAL completion, not
+ * on `break`), `with` (deterministic `__exit__` on both normal AND exception
+ * exit — a try/finally analogue), `try` / `except` / `except-group` (except-star)
+ * / `else` / `finally`, and `match`/`case` (no fallthrough). A good stress test
+ * that the shared CFG core
+ * carries no hidden brace-family assumptions.
+ *
+ * Walks a Python `function_definition` / `lambda`'s tree-sitter AST and drives
+ * the language-agnostic {@link CfgBuilder} to produce a serializable
+ * {@link FunctionCfg}, plus a def/use harvest ({@link PythonHarvester}) for the
+ * reaching-defs / CDG solvers. Structured like the C-family visitors — a
+ * `visit_<node_type>` dispatch over the statement taxonomy, driving a
+ * per-function {@link ControlFlowContext} for break/continue and the `with` /
+ * `finally` completion chain (finalizer route-through). NO call-site `sites[]`
+ * are harvested (taint substrate is a later step — see python-harvest.ts).
+ *
+ * Every node type and field literal below was grammar-validated against
+ * tree-sitter-python (0.23.x) via the introspection probe before use (mandatory
+ * pre-step). Python shapes pre-empted (verified by a real parse):
+ *  - functions: `function_definition` (fields `name`/`parameters`/`body`; async
+ *    is the SAME node with an `async` token child), `lambda` (fields
+ *    `parameters`/`body`; the body is an EXPRESSION, not a `block`).
+ *  - `if_statement` fields `condition`/`consequence` plus ZERO-OR-MORE
+ *    `alternative` fields, each an `elif_clause` (fields `condition`/`consequence`)
+ *    or an `else_clause` (field `body`) — Python has no nested-`if` else chain.
+ *  - `for_statement` fields `left`/`right`/`body` + optional `alternative`
+ *    (`else_clause`); `while_statement` fields `condition`/`body` + optional
+ *    `alternative` (`else_clause`). The loop `else` runs on the cond-false /
+ *    normal-completion path, NOT on `break`.
+ *  - `with_statement` field `body`; a `with_clause` of `with_item`s (field
+ *    `value` = `as_pattern` or a bare expression). `__exit__` runs on normal AND
+ *    exception exit — modeled as a finalizer (try/finally analogue).
+ *  - `try_statement` field `body`; children `except_clause` /
+ *    `except_group_clause` (each holds the exception expr/`as_pattern` + a
+ *    `block`), `else_clause` (field `body`, runs if NO exception), and
+ *    `finally_clause` (holds a `block`).
+ *  - `match_statement` fields `subject`/`body`; the `body` `block` holds
+ *    `case_clause`s (field `alternative`), each with `case_pattern` child(ren),
+ *    an optional `guard` (`if_clause`), and a `consequence` `block`. No
+ *    fallthrough between cases.
+ *  - `return_statement` / `raise_statement` / `break_statement` /
+ *    `continue_statement` / `pass_statement`.
+ *
+ * Edge-kind contract (matches the existing visitors — RD/CDG consume these):
+ *  - if/elif/else → `cond-true` / `cond-false`
+ *  - for/while → `cond-true` / `loop-back` / `cond-false`; the loop `else` runs
+ *    on the `cond-false` / normal-completion path (NOT on `break`)
+ *  - match dispatch → `switch-case` (no fallthrough — like Go's switch)
+ *  - try/except → `throw` (every protected block → each except handler)
+ *  - a `break`/`continue`/`return` crossing a `with` `__exit__` or a `finally`
+ *    threads through as `break`/`continue`/`return` (first leg) +
+ *    `finally-break`/`finally-continue`/`finally-return` (each completion leg)
+ *  - return/raise/break/continue → the matching terminator kind
+ *  - straight-line → `seq`
+ *
+ * Python-specific modeling decisions (documented approximations):
+ *  - `with EXPR as t:` runs the body then `__exit__` deterministically on BOTH
+ *    the normal exit and an exception (it can suppress the exception, but the
+ *    common case re-raises). Modeled exactly like `try/finally`: a finalizer
+ *    frame for the body's exit-dispose, with the protected body edging the
+ *    dispose block on `throw`. APPROXIMATION: exception SUPPRESSION by a context
+ *    manager is not modeled (the dispose re-propagates), the sound direction.
+ *  - the loop `else` clause runs once on normal completion (the loop ran to
+ *    exhaustion without `break`). It sits on the `cond-false` edge BEFORE the
+ *    join; a `break` targets the loop exit AFTER the else, so `break` skips it.
+ *  - `match`/`case` cases do NOT fall through (like Go). The dispatch fans a
+ *    `switch-case` edge to each case body; a guarded / non-wildcard tail with no
+ *    `case _` also reaches the join directly (no-match path), keeping EXIT
+ *    reverse-reachable.
+ *  - `while True:` (and any loop with no statically-false exit) STILL emits the
+ *    structural `header → loopExit` `cond-false` edge — exactly like the
+ *    C-family visitors — so EXIT stays reverse-reachable and the post-dominator /
+ *    CDG pass is not silently skipped for the function. Highest-risk property.
+ *  - `lambda` has an EXPRESSION body (no `block`): one block whose value is the
+ *    returned expression.
+ *  - comprehensions are harvested for their target bindings but kept INLINE (no
+ *    separate CFG blocks) — the plan's explicit choice.
+ *
+ * Known limitations:
+ *  - async (`async def`, `await`, `async for`, `async with`) is the same node
+ *    shape as the sync form plus an `async` token; the suspension points are
+ *    modeled as normal straight-line control flow (no scheduler edges).
+ *  - generators (`yield` / `yield from`): a `yield` is a normal expression here
+ *    (no suspend/resume edge); the generator's resumption flow is not modeled.
+ *  - comprehension target scoping: comprehension targets are declared in the
+ *    single function table (Python 3 gives them their own scope; the leaked-name
+ *    distinction is not modeled) — see python-harvest.ts.
+ *  - context-manager exception SUPPRESSION and `recover`-style flow are not
+ *    modeled (the `with` dispose always re-propagates).
+ *
+ * Returns `undefined` (never throws) for an AST shape it cannot model, so a
+ * malformed function never drops the whole file's CFG group (R4).
+ */
+import type { SyntaxNode } from '../../utils/ast-helpers.js';
+import { CfgBuilder } from '../cfg-builder.js';
+import {
+  ControlFlowContext,
+  drainFinalizerPending,
+  wireJumpThroughFinalizers,
+} from '../control-flow-context.js';
+import type { TraversalResult } from '../traversal-result.js';
+import type { CfgVisitor, FunctionCfg } from '../types.js';
+import { PythonHarvester } from './python-harvest.js';
+
+/** Python node types that own a CFG-bearing function body. */
+const PY_FUNCTION_TYPES = new Set(['function_definition', 'lambda']);
+
+/** Statement node types that break a basic block (everything else coalesces). */
+const CONTROL_FLOW_TYPES = new Set([
+  'if_statement',
+  'for_statement',
+  'while_statement',
+  'with_statement',
+  'try_statement',
+  'match_statement',
+  'return_statement',
+  'raise_statement',
+  'break_statement',
+  'continue_statement',
+  'block',
+]);
+
+const startLineOf = (n: SyntaxNode): number => n.startPosition.row + 1;
+const endLineOf = (n: SyntaxNode): number => n.endPosition.row + 1;
+
+/** A statement sequence that produced no blocks (empty body) is "transparent". */
+type SeqResult = TraversalResult | null;
+
+/**
+ * Per-function Python walk state. One instance per function so the
+ * {@link ControlFlowContext}, the exception-handler stack, and the `with` /
+ * `finally` finalizer chain are scoped to that function and never leak across
+ * functions.
+ */
+class PythonCfgWalk {
+  private readonly cfc = new ControlFlowContext();
+  /** Stack of exception-handler entry blocks (except/finally/with-dispose) a `raise` jumps to. */
+  private readonly handlers: number[] = [];
+
+  constructor(
+    private readonly builder: CfgBuilder,
+    private readonly harvest: PythonHarvester,
+  ) {}
+
+  /** Statements of a block node, ignoring comments. */
+  private statementsOf(block: SyntaxNode): SyntaxNode[] {
+    return block.namedChildren.filter((c) => c.type !== 'comment');
+  }
+
+  /** The `body` block of a node (field, or the first `block` child). */
+  private bodyBlockOf(node: SyntaxNode): SyntaxNode | undefined {
+    return node.childForFieldName('body') ?? node.namedChildren.find((c) => c.type === 'block');
+  }
+
+  /** Visit a body that may be a `block` or a single statement. */
+  private visitBody(node: SyntaxNode | undefined | null): SeqResult {
+    return this.builder.withNesting(() => {
+      if (!node) return null;
+      if (node.type === 'block') return this.visitSeq(this.statementsOf(node));
+      return this.visitStmt(node);
+    });
+  }
+
+  /** Wire a sequence of statements, coalescing straight-line runs into blocks. */
+  visitSeq(stmts: SyntaxNode[]): SeqResult {
+    return this.builder.withNesting(() => {
+      let entry: number | undefined;
+      let dangling: number[] = [];
+      let openSimple: number | undefined;
+
+      for (const stmt of stmts) {
+        if (CONTROL_FLOW_TYPES.has(stmt.type)) {
+          openSimple = undefined; // close any open straight-line block
+          const res = this.visitStmt(stmt);
+          if (res === null) continue; // transparent (empty nested block)
+          if (entry === undefined) entry = res.entry;
+          else this.builder.connect(dangling, res.entry, 'seq');
+          dangling = [...res.exits];
+        } else {
+          if (openSimple === undefined) {
+            const idx = this.builder.newBlock(
+              startLineOf(stmt),
+              endLineOf(stmt),
+              stmt.text,
+              'normal',
+              this.harvest.facts(stmt),
+            );
+            if (entry === undefined) entry = idx;
+            else this.builder.connect(dangling, idx, 'seq');
+            openSimple = idx;
+            dangling = [idx];
+          } else {
+            this.builder.extendBlock(
+              openSimple,
+              endLineOf(stmt),
+              stmt.text,
+              this.harvest.facts(stmt),
+            );
+          }
+        }
+      }
+
+      if (entry === undefined) return null;
+      return { entry, exits: dangling };
+    });
+  }
+
+  /** Dispatch one statement to its handler. Non-null except for empty blocks. */
+  visitStmt(stmt: SyntaxNode): SeqResult {
+    switch (stmt.type) {
+      case 'if_statement':
+        return this.visitIf(stmt);
+      case 'for_statement':
+        return this.visitFor(stmt);
+      case 'while_statement':
+        return this.visitWhile(stmt);
+      case 'with_statement':
+        return this.visitWith(stmt);
+      case 'try_statement':
+        return this.visitTry(stmt);
+      case 'match_statement':
+        return this.visitMatch(stmt);
+      case 'return_statement':
+        return this.visitReturn(stmt);
+      case 'raise_statement':
+        return this.visitRaise(stmt);
+      case 'break_statement':
+        return this.visitBreak(stmt);
+      case 'continue_statement':
+        return this.visitContinue(stmt);
+      case 'block':
+        return this.visitSeq(this.statementsOf(stmt));
+      default:
+        return this.visitSimple(stmt);
+    }
+  }
+
+  private visitSimple(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    return { entry: idx, exits: [idx] };
+  }
+
+  /** `return [expr]` — threads through EVERY active `with`/`finally` before EXIT. */
+  private visitReturn(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    wireJumpThroughFinalizers(
+      this.builder,
+      idx,
+      this.cfc.finalizersForReturn(),
+      this.builder.exitIndex,
+      'return',
+    );
+    return { entry: idx, exits: [] };
+  }
+
+  /** `raise [expr]` — jumps to the nearest handler (except / with-dispose / EXIT). */
+  private visitRaise(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    this.builder.edge(idx, this.currentHandler(), 'throw');
+    return { entry: idx, exits: [] };
+  }
+
+  private visitBreak(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(startLineOf(stmt), endLineOf(stmt), stmt.text);
+    const res = this.cfc.resolveBreak();
+    const { target, finalizers } = res ?? {
+      target: this.builder.exitIndex,
+      finalizers: this.cfc.finalizersForReturn(),
+    };
+    wireJumpThroughFinalizers(this.builder, idx, finalizers, target, 'break');
+    return { entry: idx, exits: [] };
+  }
+
+  private visitContinue(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(startLineOf(stmt), endLineOf(stmt), stmt.text);
+    const res = this.cfc.resolveContinue();
+    const { target, finalizers } = res ?? {
+      target: this.builder.exitIndex,
+      finalizers: this.cfc.finalizersForReturn(),
+    };
+    wireJumpThroughFinalizers(this.builder, idx, finalizers, target, 'continue');
+    return { entry: idx, exits: [] };
+  }
+
+  /**
+   * `if cond: … elif cond: … else: …`. Python has NO nested-if else chain: an
+   * `if_statement` carries the condition + consequence plus zero-or-more
+   * `alternative` fields, each an `elif_clause` (its own condition + consequence)
+   * or a single trailing `else_clause`. The elif chain is threaded on the
+   * `cond-false` edge.
+   */
+  private visitIf(stmt: SyntaxNode): TraversalResult {
+    const cond = stmt.childForFieldName('condition') ?? stmt;
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(cond),
+      cond.text,
+      'normal',
+      this.harvest.facts(cond),
+    );
+
+    const exits: number[] = [];
+    const thenRes = this.visitBody(stmt.childForFieldName('consequence'));
+    if (thenRes) {
+      this.builder.edge(header, thenRes.entry, 'cond-true');
+      exits.push(...thenRes.exits);
+    } else {
+      exits.push(header); // empty then — true path falls through
+    }
+
+    // The alternatives, in source order: elif_clause* then optional else_clause.
+    const alternatives = this.alternativesOf(stmt);
+    let falseFrom = header; // block whose cond-false edge feeds the next alternative
+    for (const alt of alternatives) {
+      if (alt.type === 'elif_clause') {
+        const elifCond = alt.childForFieldName('condition') ?? alt;
+        const elifHeader = this.builder.newBlock(
+          startLineOf(alt),
+          endLineOf(elifCond),
+          elifCond.text,
+          'normal',
+          this.harvest.facts(elifCond),
+        );
+        this.builder.edge(falseFrom, elifHeader, 'cond-false');
+        const elifRes = this.visitBody(alt.childForFieldName('consequence'));
+        if (elifRes) {
+          this.builder.edge(elifHeader, elifRes.entry, 'cond-true');
+          exits.push(...elifRes.exits);
+        } else {
+          exits.push(elifHeader);
+        }
+        falseFrom = elifHeader;
+      } else if (alt.type === 'else_clause') {
+        const elseRes = this.visitBody(alt.childForFieldName('body'));
+        if (elseRes) {
+          this.builder.edge(falseFrom, elseRes.entry, 'cond-false');
+          exits.push(...elseRes.exits);
+        } else {
+          exits.push(falseFrom);
+        }
+        falseFrom = -1; // an else consumes the false path entirely
+      }
+    }
+    // No trailing else: the last header's cond-false falls through to the join.
+    if (falseFrom >= 0) exits.push(falseFrom);
+
+    return { entry: header, exits: [...new Set(exits)] };
+  }
+
+  /** The `alternative`-field children of an `if_statement`, in source order. */
+  private alternativesOf(stmt: SyntaxNode): SyntaxNode[] {
+    const out: SyntaxNode[] = [];
+    for (let i = 0; i < stmt.childCount; i++) {
+      if (stmt.fieldNameForChild(i) === 'alternative') {
+        const c = stmt.child(i);
+        if (c) out.push(c);
+      }
+    }
+    return out;
+  }
+
+  /**
+   * `for TARGET in ITER: … [else: …]`. Header = the iteration test (a use of the
+   * iterable + a def of the target). The loop `else` runs on NORMAL completion
+   * (the cond-false path) — a `break` targets the loop exit AFTER the else, so it
+   * skips the else.
+   */
+  private visitFor(stmt: SyntaxNode): TraversalResult {
+    const left = stmt.childForFieldName('left');
+    const right = stmt.childForFieldName('right');
+    const headEnd = right ? endLineOf(right) : startLineOf(stmt);
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      headEnd,
+      this.loopHeaderText(stmt, left, right),
+      'normal',
+      this.harvest.loopHeadFacts(stmt),
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.cfc.pushLoop(header, loopExit, []);
+    const body = this.visitBody(this.bodyBlockOf(stmt));
+    this.cfc.pop();
+
+    if (body) {
+      this.builder.edge(header, body.entry, 'cond-true');
+      this.builder.connect(body.exits, header, 'loop-back');
+    } else {
+      this.builder.edge(header, header, 'loop-back'); // empty body re-tests
+    }
+
+    this.wireLoopElse(stmt, header, loopExit);
+    return { entry: header, exits: [loopExit] };
+  }
+
+  /** `while cond: … [else: …]`. Same `else`-on-normal-completion semantics as `for`. */
+  private visitWhile(stmt: SyntaxNode): TraversalResult {
+    const cond = stmt.childForFieldName('condition') ?? stmt;
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(cond),
+      cond.text,
+      'normal',
+      this.harvest.facts(cond),
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.cfc.pushLoop(header, loopExit, []);
+    const body = this.visitBody(this.bodyBlockOf(stmt));
+    this.cfc.pop();
+
+    if (body) {
+      this.builder.edge(header, body.entry, 'cond-true');
+      this.builder.connect(body.exits, header, 'loop-back');
+    } else {
+      this.builder.edge(header, header, 'loop-back'); // empty `while c: pass` re-tests
+    }
+
+    this.wireLoopElse(stmt, header, loopExit);
+    return { entry: header, exits: [loopExit] };
+  }
+
+  /**
+   * Wire the optional loop `else` clause. The else runs once on normal completion
+   * (the header's `cond-false` edge). With an else, the cond-false edge goes
+   * `header → elseEntry` and the else's exits reach `loopExit`; without one, the
+   * structural `header → loopExit` `cond-false` edge keeps EXIT reverse-reachable
+   * (critical for `while True:` — and matches the C-family visitors). A `break`
+   * always targets `loopExit` directly, so it never runs the else.
+   */
+  private wireLoopElse(stmt: SyntaxNode, header: number, loopExit: number): void {
+    const elseClause = this.loopElseOf(stmt);
+    if (elseClause) {
+      const elseRes = this.visitBody(elseClause.childForFieldName('body'));
+      if (elseRes) {
+        this.builder.edge(header, elseRes.entry, 'cond-false');
+        this.builder.connect(elseRes.exits, loopExit, 'seq');
+        return;
+      }
+    }
+    // No (or empty) else — normal completion falls straight to the loop exit.
+    this.builder.edge(header, loopExit, 'cond-false');
+  }
+
+  /** The `else_clause` of a `for`/`while` (its `alternative` field), if any. */
+  private loopElseOf(stmt: SyntaxNode): SyntaxNode | undefined {
+    const alt = stmt.childForFieldName('alternative');
+    return alt?.type === 'else_clause' ? alt : undefined;
+  }
+
+  private loopHeaderText(
+    stmt: SyntaxNode,
+    left: SyntaxNode | null,
+    right: SyntaxNode | null,
+  ): string {
+    const l = left?.text ?? '';
+    const r = right?.text ?? '';
+    return l || r ? `for ${l} in ${r}` : stmt.text.split('\n')[0];
+  }
+
+  /**
+   * `with EXPR [as t], …: BODY`. The context managers' `__exit__` runs
+   * deterministically on BOTH the normal exit and an exception — modeled exactly
+   * like `try/finally`: a finalizer frame holding the dispose block, plus a
+   * `throw` edge from every protected-body block to the dispose. A
+   * `return`/`break`/`continue` inside the body threads through the dispose. The
+   * dispose re-propagates on the exception path (suppression is not modeled).
+   */
+  private visitWith(stmt: SyntaxNode): SeqResult {
+    // The dispose block carries the `with`-header facts (the `as` aliases are
+    // defs, the manager expressions uses) — it runs on every exit, so attaching
+    // the binding facts here is the single execution point of the bindings.
+    const items = this.withItems(stmt);
+    const dispose = this.builder.newBlock(
+      startLineOf(stmt),
+      startLineOf(stmt),
+      this.withHeaderText(stmt),
+    );
+    for (const item of items) this.builder.attachFacts(dispose, this.harvest.withItemFacts(item));
+
+    const finFrame = this.cfc.pushFinalizer(dispose);
+    // The body raises into the dispose (which re-propagates to the outer handler).
+    this.handlers.push(dispose);
+    const protectedStart = this.builder.blockCount;
+    const body = this.visitBody(this.bodyBlockOf(stmt));
+    this.handlers.pop();
+
+    // Conservative exceptional edges: ANY block in the with-body may raise to the
+    // dispose (an exception fires mid-block) — sound over-approximation.
+    for (let b = protectedStart; b < this.builder.blockCount; b++) {
+      this.builder.edge(b, dispose, 'throw');
+    }
+
+    this.cfc.pop();
+    drainFinalizerPending(this.builder, finFrame, [dispose]);
+
+    // Normal completion of the body flows into the dispose; the dispose's normal
+    // exit is the with-statement's exit. The dispose re-propagates the exception
+    // path to the OUTER handler (a CM normally re-raises).
+    if (body) this.builder.connect(body.exits, dispose, 'seq');
+    this.builder.edge(dispose, this.currentHandler(), 'throw');
+
+    const entry = body?.entry ?? dispose;
+    return { entry, exits: [dispose] };
+  }
+
+  /** The `with_item`s of a `with_statement` (under its `with_clause`). */
+  private withItems(stmt: SyntaxNode): SyntaxNode[] {
+    const clause = stmt.namedChildren.find((c) => c.type === 'with_clause');
+    if (!clause) return [];
+    return clause.namedChildren.filter((c) => c.type === 'with_item');
+  }
+
+  private withHeaderText(stmt: SyntaxNode): string {
+    const clause = stmt.namedChildren.find((c) => c.type === 'with_clause');
+    return clause ? `with ${clause.text}` : 'with';
+  }
+
+  /**
+   * `try: BODY [except …: H]* [else: E] [finally: F]`. Mirrors the TS visitor's
+   * try-route-through:
+   *  - `finally` runs on every exit (normal, exception, and early jumps) — a
+   *    finalizer frame for early-exit threading + a normal/exceptional join.
+   *  - each `except` / except-group handler catches from the protected body.
+   *  - `else` runs only if the body completed with no exception.
+   */
+  private visitTry(stmt: SyntaxNode): SeqResult {
+    const bodyNode = stmt.childForFieldName('body');
+    const exceptClauses: SyntaxNode[] = [];
+    let elseClause: SyntaxNode | undefined;
+    let finallyClause: SyntaxNode | undefined;
+    for (let i = 0; i < stmt.namedChildCount; i++) {
+      const c = stmt.namedChild(i);
+      if (!c) continue;
+      if (c.type === 'except_clause' || c.type === 'except_group_clause') exceptClauses.push(c);
+      else if (c.type === 'else_clause') elseClause = c;
+      else if (c.type === 'finally_clause') finallyClause = c;
+    }
+
+    // Build finally first — known as both a normal join and a handler target. It
+    // runs OUTSIDE this try's finalizer frame (a return inside finally threads
+    // only OUTER finallys).
+    const finallyBlock = finallyClause
+      ? (this.bodyBlockOf(finallyClause) ??
+        finallyClause.namedChildren.find((c) => c.type === 'block'))
+      : undefined;
+    const finallyRes = finallyBlock ? this.visitSeq(this.statementsOf(finallyBlock)) : null;
+    const finFrame = finallyRes ? this.cfc.pushFinalizer(finallyRes.entry) : null;
+
+    // Each except handler. A `raise` inside a handler propagates to finally (if
+    // any), else the outer handler.
+    const handlerEntries: number[] = [];
+    const handlerExits: number[] = [];
+    for (const clause of exceptClauses) {
+      if (finallyRes) this.handlers.push(finallyRes.entry);
+      const handlerBlock = clause.namedChildren.find((c) => c.type === 'block');
+      // The `except E as e:` header binds `e` — its own facts-only block in front
+      // of the handler body (the binding happens once, on handler entry).
+      const headFacts = this.harvest.exceptHeadFacts(clause);
+      const headBlock = this.builder.newBlock(
+        startLineOf(clause),
+        startLineOf(clause),
+        '',
+        'normal',
+        headFacts,
+      );
+      const bodyRes = handlerBlock ? this.visitSeq(this.statementsOf(handlerBlock)) : null;
+      if (bodyRes) {
+        this.builder.edge(headBlock, bodyRes.entry, 'seq');
+        handlerExits.push(...bodyRes.exits);
+      } else {
+        handlerExits.push(headBlock); // empty handler body — header is the exit
+      }
+      handlerEntries.push(headBlock);
+      if (finallyRes) this.handlers.pop();
+    }
+
+    // Handler for the try body: the first except if present, else finally, else
+    // the outer handler.
+    const tryHandler = handlerEntries[0] ?? finallyRes?.entry ?? this.currentHandler();
+    const protectedStart = this.builder.blockCount;
+    this.handlers.push(tryHandler);
+    const bodyRes = bodyNode ? this.visitSeq(this.statementsOf(bodyNode)) : null;
+    this.handlers.pop();
+
+    // Conservative exceptional edges: ANY protected-region block may raise to
+    // EACH handler (an unmatched exception type tries the next handler).
+    if (exceptClauses.length > 0 || finallyClause) {
+      const targets =
+        handlerEntries.length > 0 ? handlerEntries : finallyRes ? [finallyRes.entry] : [];
+      for (let b = protectedStart; b < this.builder.blockCount; b++) {
+        for (const h of targets) this.builder.edge(b, h, 'throw');
+      }
+    }
+
+    // The `else` runs only on no-exception normal completion of the body.
+    let normalAfterBody: number[] = bodyRes ? [...bodyRes.exits] : [];
+    if (elseClause) {
+      const elseRes = this.visitBody(elseClause.childForFieldName('body'));
+      if (elseRes && bodyRes) {
+        this.builder.connect(bodyRes.exits, elseRes.entry, 'seq');
+        normalAfterBody = [...elseRes.exits];
+      } else if (elseRes) {
+        normalAfterBody = [...elseRes.exits];
+      }
+    }
+
+    // Close the finalizer frame; wire crossing-jump completion legs.
+    if (finFrame && finallyRes) {
+      this.cfc.pop();
+      drainFinalizerPending(this.builder, finFrame, finallyRes.exits);
+    }
+
+    const exits: number[] = [];
+    if (finallyRes) {
+      // Normal completion of (body→else) AND each handler flows through finally.
+      this.builder.connect(normalAfterBody, finallyRes.entry, 'seq');
+      this.builder.connect(handlerExits, finallyRes.entry, 'seq');
+      exits.push(...finallyRes.exits);
+      // A try with no except → an uncaught exception re-propagates after finally.
+      if (handlerEntries.length === 0) {
+        this.builder.connect(finallyRes.exits, this.currentHandler(), 'throw');
+      }
+    } else {
+      exits.push(...normalAfterBody);
+      exits.push(...handlerExits);
+    }
+
+    const entry = bodyRes?.entry ?? finallyRes?.entry ?? handlerEntries[0];
+    if (entry === undefined) return null;
+    return { entry, exits: [...new Set(exits)] };
+  }
+
+  /**
+   * `match SUBJECT: case P [if guard]: BODY …`. Cases do NOT fall through (like
+   * Go's switch). Each case body is dispatched from the subject block with a
+   * `switch-case` edge; a `match` with no `case _` wildcard also reaches the join
+   * directly (no-match path), keeping EXIT reverse-reachable.
+   */
+  private visitMatch(stmt: SyntaxNode): TraversalResult {
+    const subject = stmt.childForFieldName('subject');
+    const dispatch = this.builder.newBlock(
+      startLineOf(stmt),
+      subject ? endLineOf(subject) : startLineOf(stmt),
+      subject ? `match ${subject.text}` : 'match',
+      'normal',
+      subject ? this.harvest.facts(subject) : undefined,
+    );
+    const matchExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    const body =
+      stmt.childForFieldName('body') ?? stmt.namedChildren.find((c) => c.type === 'block');
+    const cases = body ? body.namedChildren.filter((c) => c.type === 'case_clause') : [];
+
+    // A case guard (`case P if g:`) evaluates conditionally — harvest its uses
+    // onto the dispatch block (a later case only tests when earlier patterns
+    // didn't match; defs there are may-defs).
+    for (const c of cases) {
+      const guard = c.childForFieldName('guard');
+      if (guard) this.builder.attachFacts(dispatch, this.harvest.factsConditional(guard));
+    }
+
+    this.cfc.pushSwitch(matchExit, []);
+    let hasWildcard = false;
+    for (const c of cases) {
+      const caseBody = this.visitBody(c.childForFieldName('consequence'));
+      const entry = caseBody?.entry ?? matchExit;
+      this.builder.edge(dispatch, entry, 'switch-case');
+      if (caseBody) this.builder.connect(caseBody.exits, matchExit, 'seq');
+      if (this.isWildcardCase(c)) hasWildcard = true;
+    }
+    this.cfc.pop();
+
+    // No catch-all `case _` (or no cases) → a no-match path reaches the exit
+    // directly. Keeps EXIT reverse-reachable even when every case body jumps.
+    if (!hasWildcard) this.builder.edge(dispatch, matchExit, 'switch-case');
+
+    return { entry: dispatch, exits: [matchExit] };
+  }
+
+  /** A `case _:` (bare wildcard with no guard) is the unconditional catch-all. */
+  private isWildcardCase(caseClause: SyntaxNode): boolean {
+    if (caseClause.childForFieldName('guard')) return false;
+    const pattern = caseClause.namedChildren.find((c) => c.type === 'case_pattern');
+    return pattern?.text.trim() === '_';
+  }
+
+  /** Nearest enclosing exception handler, or the function EXIT. */
+  private currentHandler(): number {
+    return this.handlers.length ? this.handlers[this.handlers.length - 1] : this.builder.exitIndex;
+  }
+}
+
+/** Build the CFG for one Python function/lambda node, or `undefined` if not modelable. */
+function buildFunctionCfg(fnNode: SyntaxNode, filePath: string): FunctionCfg | undefined {
+  try {
+    if (!PY_FUNCTION_TYPES.has(fnNode.type)) return undefined;
+    const startLine = startLineOf(fnNode);
+    const endLine = endLineOf(fnNode);
+    const startColumn = fnNode.startPosition.column;
+
+    const body = fnNode.childForFieldName('body');
+    if (!body) return undefined; // no body — nothing to model
+
+    const builder = new CfgBuilder(filePath, startLine, endLine, startColumn);
+    const harvest = new PythonHarvester(fnNode);
+
+    const paramFacts = harvest.paramFacts();
+    if (paramFacts) builder.attachFacts(builder.entryIndex, paramFacts);
+
+    if (fnNode.type === 'lambda' || body.type !== 'block') {
+      // `lambda x: expr` — the body is an EXPRESSION (no `block`): one block whose
+      // value is returned. Threads through no finally (a lambda has none).
+      const blk = builder.newBlock(
+        startLineOf(body),
+        endLineOf(body),
+        body.text,
+        'normal',
+        harvest.facts(body),
+      );
+      builder.edge(builder.entryIndex, blk, 'seq');
+      builder.edge(blk, builder.exitIndex, 'return');
+      return builder.finish(harvest.bindingTable());
+    }
+
+    const walk = new PythonCfgWalk(builder, harvest);
+    const res = walk.visitSeq(body.namedChildren.filter((c) => c.type !== 'comment'));
+    if (!res) {
+      builder.edge(builder.entryIndex, builder.exitIndex, 'seq'); // empty body
+      return builder.finish(harvest.bindingTable());
+    }
+    builder.edge(builder.entryIndex, res.entry, 'seq');
+    builder.connect(res.exits, builder.exitIndex, 'seq'); // normal fall-off → EXIT
+    return builder.finish(harvest.bindingTable());
+  } catch (err) {
+    // Never throw out of buildFunctionCfg — a malformed AST shape must skip only
+    // this one function's CFG, never drop the whole file's language group (R4).
+    // eslint-disable-next-line no-console
+    console.warn(`[cfg] Python buildFunctionCfg skipped a function in ${filePath}: ${String(err)}`);
+    return undefined;
+  }
+}
+
+/** Whether a node is a Python function this visitor builds a CFG for. */
+function isFunction(node: SyntaxNode): boolean {
+  return PY_FUNCTION_TYPES.has(node.type);
+}
+
+/** The Python CFG visitor. */
+export function createPythonCfgVisitor(): CfgVisitor<SyntaxNode> {
+  return { buildFunctionCfg, isFunction };
+}
+
+export { PY_FUNCTION_TYPES };
diff --git a/gitnexus/src/core/ingestion/cfg/visitors/ruby-harvest.ts b/gitnexus/src/core/ingestion/cfg/visitors/ruby-harvest.ts
new file mode 100644
index 000000000..8c0faedf9
--- /dev/null
+++ b/gitnexus/src/core/ingestion/cfg/visitors/ruby-harvest.ts
@@ -0,0 +1,482 @@
+/**
+ * Ruby def/use harvester — the Ruby analogue of
+ * {@link import('./python-harvest.js').PythonHarvester} (the closest structural
+ * sibling: implicit/keyword-delimited blocks, statement-modifier forms, a
+ * begin/rescue/else/ensure exception model, and `case`/`when` + `case`/`in`
+ * pattern matching). Like the Python harvester, this unit emits ONLY the
+ * per-function binding table ({@link BindingEntry}[]) plus {@link StatementFacts}
+ * (defs / uses / mayDefs) — NO call-site `sites[]` are harvested (the taint
+ * substrate is a later step), so it uses a local {@link FactAccumulator} with no
+ * site machinery at all and the emitted facts carry no `sites` key.
+ *
+ * Runs in the parse worker next to the Ruby CFG visitor.
+ *
+ * Every node type and field literal below was grammar-validated against
+ * tree-sitter-ruby via the introspection probe before use (mandatory pre-step).
+ * Ruby shapes pre-empted (verified by a real parse):
+ *  - functions: `method` / `singleton_method` (fields `name`/`parameters`/`body`;
+ *    `parameters` is a `method_parameters`; `body` is a `body_statement`), and
+ *    blocks `do_block` (`body` = `body_statement`) / `block` (`body` =
+ *    `block_body`) / `lambda` (`body` = a `block` wrapping a `block_body`) — each
+ *    has a `parameters` (`block_parameters` / `lambda_parameters`).
+ *  - parameters: bare `identifier`, `optional_parameter` (fields `name`/`value`),
+ *    `splat_parameter` / `hash_splat_parameter` / `block_parameter` /
+ *    `keyword_parameter` (field `name`).
+ *  - assignment: `assignment` (fields `left`/`right`; LHS may be `identifier`,
+ *    `left_assignment_list` (multi `a, b = …`), `instance_variable` (`@x`),
+ *    `class_variable` (`@@x`), `global_variable` (`$x`), `constant`),
+ *    `operator_assignment` (fields `left`/`operator`/`right` — read+write).
+ *  - binders: `for` (fields `pattern`/`value`=`in`/`body`), block `parameters`
+ *    (`block_parameters` of identifier / optional / splat leaves), rescue
+ *    `variable` (an `exception_variable` wrapping the bound `identifier`).
+ *  - reads: `call` (fields `receiver`?/`method`/`arguments`), `binary` (fields
+ *    `left`/`operator`/`right`), `parenthesized_statements`.
+ *
+ * TWO-PHASE, ORDER-INDEPENDENT (load-bearing — mirrors the Python / TS / Go
+ * harvesters): the CFG walk is NOT source-order, so resolving names against a
+ * scope stack populated *during* the walk would mis-resolve. Phase 1 pre-scans
+ * the whole function subtree once, declaring every in-function local name; phase
+ * 2 resolves defs/uses against that finished table from any walk order.
+ *
+ * Ruby scope model (deliberately simplified, documented): Ruby binds LOCAL
+ * variables on first assignment; block parameters and block-local variables have
+ * their own block scope, but — exactly as the Python harvester declares all
+ * targets in a SINGLE function table (a documented over-approximation) — this
+ * harvester declares every assignment / for / block-param / rescue-variable /
+ * method-param target into one function-scope table. Instance/class/global
+ * variables (`@x` / `@@x` / `$x`) and bare constants are NOT local variables: a
+ * read or write of one is recorded as a use only (an attribute-like write — its
+ * "name" is not a function-scoped scalar def), matching the TS/Python member-
+ * write exclusion. A bare method call with no parens (`foo`) is indistinguishable
+ * from a local read at this layer; we resolve such an identifier against the
+ * local table and only mint a SYNTHETIC module binding when it is unknown (the
+ * conservative direction — a real method call resolves to a `module` synthetic,
+ * never a false local def).
+ *
+ * v1 def-semantics scope:
+ *   - `assignment` plain `=` — each `identifier` target in the (possibly
+ *     `left_assignment_list`) LHS is a def; an `@x`/`@@x`/`$x`/`Const` target or
+ *     an index/attribute target is NOT a scalar def (root is a use only).
+ *   - `operator_assignment` (`x += 1`, `x ||= y`) — def AND use the lvalue.
+ *   - `for x in xs` / `for a, b in xs` — the loop target(s) are defs; `xs` a use.
+ *   - block params (`|x|`, `|x, y|`, `|*rest|`) — `param`-kind defs.
+ *   - `rescue ... => e` — `e` is a `catch`-kind def (matters to the taint pass).
+ *   - method parameters (incl. defaults, `*splat`, `**kwsplat`, `&block`,
+ *     keyword) — `param`-kind defs.
+ *
+ * MAY-DEFS: a def inside a conditionally-evaluated subexpression is a may-def
+ * (gen WITHOUT kill), so the not-taken path's prior def is not falsely killed.
+ * Ruby's conditional-def shapes: an assignment in the right operand of `&&`/`and`
+ * / `||`/`or` short-circuit (`a && (x = 1)`), and a `when`/`in` case-test
+ * expression / `in`-clause guard (a later case only evaluates when earlier
+ * patterns did not match).
+ *
+ * NOTE: nothing serialized here may carry a field named `nodeId` — the durable
+ * parsedfile-store reviver dedups objects keyed on that field name.
+ */
+import type { SyntaxNode } from '../../utils/ast-helpers.js';
+import type { BindingEntry, StatementFacts } from '../types.js';
+import { DefUseAccumulator as FactAccumulator } from './call-site-harvest.js';
+
+/** Node types that own a nested CFG — their subtrees are opaque to harvesting. */
+const NESTED_FUNCTION_TYPES = new Set([
+  'method',
+  'singleton_method',
+  'do_block',
+  'block',
+  'lambda',
+]);
+
+/** Parameter container node types (method + block + lambda). */
+const PARAM_CONTAINER_TYPES = new Set([
+  'method_parameters',
+  'block_parameters',
+  'lambda_parameters',
+]);
+
+/** Parameter leaf node types whose `name` field (or bare identifier) is the binder. */
+const NAMED_PARAM_TYPES = new Set([
+  'optional_parameter',
+  'splat_parameter',
+  'hash_splat_parameter',
+  'block_parameter',
+  'keyword_parameter',
+]);
+
+export class RubyHarvester {
+  private readonly bindings: BindingEntry[] = [];
+  /** Single function-scope name → binding index (documented over-approximation). */
+  private readonly table = new Map<string, number>();
+  private readonly synthetic = new Map<string, number>();
+  private readonly fnId: number;
+  /** >0 while walking a conditionally-evaluated subexpression — defs become may-defs. */
+  private conditionalDepth = 0;
+
+  constructor(private readonly fnNode: SyntaxNode) {
+    this.fnId = fnNode.id;
+    this.declareParams(fnNode);
+    const body = this.bodyOf(fnNode);
+    if (body) this.prescan(body);
+  }
+
+  /** The completed binding table — pass to `CfgBuilder.finish`. */
+  bindingTable(): readonly BindingEntry[] {
+    return this.bindings;
+  }
+
+  /** The function/block/lambda body node. */
+  private bodyOf(fnNode: SyntaxNode): SyntaxNode | undefined {
+    return fnNode.childForFieldName('body') ?? undefined;
+  }
+
+  // ── phase 1: declaration pre-scan ────────────────────────────────────────
+
+  private declare(nameNode: SyntaxNode, kind: BindingEntry['kind']): void {
+    const name = nameNode.text;
+    if (!name || name === '_' || this.table.has(name)) return;
+    this.table.set(name, this.bindings.length);
+    this.bindings.push({
+      name,
+      declLine: nameNode.startPosition.row + 1,
+      declColumn: nameNode.startPosition.column,
+      kind,
+    });
+  }
+
+  /** Declare every parameter binder (method / block / lambda). */
+  private declareParams(fnNode: SyntaxNode): void {
+    const params = this.paramsOf(fnNode);
+    if (!params) return;
+    for (let i = 0; i < params.namedChildCount; i++) {
+      const p = params.namedChild(i);
+      if (p) this.declareParam(p);
+    }
+  }
+
+  /** The `parameters` field (or first parameter-container child) of a function node. */
+  private paramsOf(fnNode: SyntaxNode): SyntaxNode | undefined {
+    const field = fnNode.childForFieldName('parameters');
+    if (field) return field;
+    return fnNode.namedChildren.find((c) => PARAM_CONTAINER_TYPES.has(c.type));
+  }
+
+  /** Declare the binder identifier of one parameter node. */
+  private declareParam(p: SyntaxNode): void {
+    if (p.type === 'identifier') {
+      this.declare(p, 'param');
+      return;
+    }
+    if (NAMED_PARAM_TYPES.has(p.type)) {
+      const name =
+        p.childForFieldName('name') ?? p.namedChildren.find((c) => c.type === 'identifier');
+      if (name) this.declare(name, 'param');
+      return;
+    }
+    // Destructured / grouped block param — declare any identifier leaves.
+    for (let i = 0; i < p.namedChildCount; i++) {
+      const c = p.namedChild(i);
+      if (c?.type === 'identifier') this.declare(c, 'param');
+      else if (c) this.declareParam(c);
+    }
+  }
+
+  /**
+   * Pre-scan the function body once, declaring every in-function local name.
+   * Recurses into compound statements but NOT into nested function/block/lambda
+   * bodies (opaque).
+   */
+  private prescan(node: SyntaxNode): void {
+    const t = node.type;
+    if (NESTED_FUNCTION_TYPES.has(t) && node.id !== this.fnId) return;
+
+    switch (t) {
+      case 'assignment': {
+        const left = node.childForFieldName('left');
+        if (left) this.declareTargets(left);
+        break;
+      }
+      case 'operator_assignment': {
+        const left = node.childForFieldName('left');
+        if (left) this.declareTargets(left);
+        break;
+      }
+      case 'for': {
+        const pattern = node.childForFieldName('pattern');
+        if (pattern) this.declareTargets(pattern);
+        break;
+      }
+      case 'rescue': {
+        this.declareRescueVar(node);
+        break;
+      }
+      default:
+        break;
+    }
+
+    // A nested `do_block`/`block`/`lambda` body is opaque, but its OWN block
+    // parameters are declared (they are not local to THIS function, yet the
+    // single-table model harvests them where used) — handled by declareParam in
+    // the visitor's per-block harvester instance, not here. We only recurse to
+    // collect assignment/for/rescue local targets in THIS function body.
+    for (let i = 0; i < node.namedChildCount; i++) {
+      const c = node.namedChild(i);
+      if (c) this.prescan(c);
+    }
+  }
+
+  /** `rescue [Exc] => e` — declare `e` (a `catch`-kind def). */
+  private declareRescueVar(clause: SyntaxNode): void {
+    const variable = clause.childForFieldName('variable');
+    const id = variable?.namedChildren.find((c) => c.type === 'identifier') ?? variable;
+    if (id?.type === 'identifier') this.declare(id, 'catch');
+  }
+
+  /** Declare identifier leaves of an assignment / loop target (skip non-local LHS). */
+  private declareTargets(target: SyntaxNode): void {
+    const t = target.type;
+    if (t === 'identifier') {
+      this.declare(target, 'let');
+      return;
+    }
+    if (t === 'left_assignment_list') {
+      for (let i = 0; i < target.namedChildCount; i++) {
+        const c = target.namedChild(i);
+        if (c) this.declareTargets(c);
+      }
+      return;
+    }
+    if (t === 'splat_parameter' || t === 'rest_assignment') {
+      const id = target.namedChildren.find((c) => c.type === 'identifier');
+      if (id) this.declare(id, 'let');
+      return;
+    }
+    // instance/class/global var, constant, element/attribute target — not a
+    // function-scoped scalar def (the root identifier is a use only).
+  }
+
+  // ── phase 2: per-statement fact extraction ───────────────────────────────
+
+  /** Def/use facts for one statement (or construct-header expression) node. */
+  facts(node: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(node.startPosition.row + 1);
+    this.walkValue(node, acc);
+    return acc.finish();
+  }
+
+  /** Facts for an expression whose WHOLE evaluation is conditional (case tests). */
+  factsConditional(node: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(node.startPosition.row + 1);
+    this.conditional(() => this.walkValue(node, acc));
+    return acc.finish();
+  }
+
+  /**
+   * Facts for a `for PATTERN in VALUE` head: the loop target(s) are defs, the
+   * iterated expression is a use.
+   */
+  loopHeadFacts(forNode: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(forNode.startPosition.row + 1);
+    const pattern = forNode.childForFieldName('pattern');
+    const value = forNode.childForFieldName('value');
+    if (value) this.walkValue(value, acc);
+    if (pattern) this.defTargets(pattern, acc);
+    return acc.finish();
+  }
+
+  /**
+   * Def-ONLY facts for a value-position assignment (`x = if … / case …`, #2205):
+   * just the LHS target(s), attached to the continuation block the branch arms
+   * rejoin. The branch condition + arm-value USES are harvested onto the branch's
+   * own blocks (visitIf / visitCase), so this must not re-walk the RHS.
+   */
+  assignmentDefFacts(stmt: SyntaxNode): StatementFacts | undefined {
+    const acc = new FactAccumulator(stmt.startPosition.row + 1);
+    const left = stmt.childForFieldName('left');
+    if (left) this.defTargets(left, acc);
+    return acc.defCount() ? acc.finish() : undefined;
+  }
+
+  /** Facts for a `rescue [Exc] => e` header: `e` is a def, the exception list a use. */
+  rescueHeadFacts(clause: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(clause.startPosition.row + 1);
+    const exceptions = clause.childForFieldName('exceptions');
+    if (exceptions) this.walkValue(exceptions, acc);
+    const variable = clause.childForFieldName('variable');
+    const id = variable?.namedChildren.find((c) => c.type === 'identifier');
+    if (id) this.def(id, acc);
+    return acc.finish();
+  }
+
+  /** ENTRY-block facts for the parameters (defs only — incl. default-value uses). */
+  paramFacts(): StatementFacts | undefined {
+    const params = this.paramsOf(this.fnNode);
+    if (!params) return undefined;
+    const acc = new FactAccumulator(this.fnNode.startPosition.row + 1);
+    for (let i = 0; i < params.namedChildCount; i++) {
+      const p = params.namedChild(i);
+      if (p) this.defParam(p, acc);
+    }
+    return acc.defCount() || acc.useCount() ? acc.finish() : undefined;
+  }
+
+  /** Def the binder of one parameter node and use any default-value expr. */
+  private defParam(p: SyntaxNode, acc: FactAccumulator): void {
+    if (p.type === 'identifier') {
+      this.def(p, acc);
+      return;
+    }
+    if (p.type === 'optional_parameter' || p.type === 'keyword_parameter') {
+      const value = p.childForFieldName('value');
+      if (value) this.walkValue(value, acc);
+      const name = p.childForFieldName('name');
+      if (name) this.def(name, acc);
+      return;
+    }
+    if (NAMED_PARAM_TYPES.has(p.type)) {
+      const name =
+        p.childForFieldName('name') ?? p.namedChildren.find((c) => c.type === 'identifier');
+      if (name) this.def(name, acc);
+      return;
+    }
+    for (let i = 0; i < p.namedChildCount; i++) {
+      const c = p.namedChild(i);
+      if (c?.type === 'identifier') this.def(c, acc);
+      else if (c) this.defParam(c, acc);
+    }
+  }
+
+  private resolve(nameNode: SyntaxNode): number {
+    const name = nameNode.text;
+    const idx = this.table.get(name);
+    if (idx !== undefined) return idx;
+    let s = this.synthetic.get(name);
+    if (s === undefined) {
+      s = this.bindings.length;
+      this.synthetic.set(name, s);
+      this.bindings.push({ name, declLine: 0, declColumn: 0, kind: 'module', synthetic: true });
+    }
+    return s;
+  }
+
+  private def(nameNode: SyntaxNode, acc: FactAccumulator): void {
+    if (nameNode.text === '_') return;
+    if (this.conditionalDepth > 0) acc.addMayDef(this.resolve(nameNode));
+    else acc.addDef(this.resolve(nameNode));
+  }
+
+  private use(nameNode: SyntaxNode, acc: FactAccumulator): void {
+    if (nameNode.text === '_') return;
+    // Resolve only known LOCAL names; an unknown bare identifier is a method
+    // call (resolves to a `module` synthetic — never a false local).
+    acc.addUse(this.resolve(nameNode));
+  }
+
+  /** Run `fn` with defs demoted to may-defs (conditionally-evaluated context). */
+  private conditional(fn: () => void): void {
+    this.conditionalDepth++;
+    try {
+      fn();
+    } finally {
+      this.conditionalDepth--;
+    }
+  }
+
+  /**
+   * Def each identifier leaf of an assignment / loop target; route non-local
+   * targets (`@x`, index/attribute writes) to the value walk (root is a use).
+   */
+  private defTargets(target: SyntaxNode, acc: FactAccumulator): void {
+    const t = target.type;
+    if (t === 'identifier') {
+      this.def(target, acc);
+      return;
+    }
+    if (t === 'left_assignment_list') {
+      for (let i = 0; i < target.namedChildCount; i++) {
+        const c = target.namedChild(i);
+        if (c) this.defTargets(c, acc);
+      }
+      return;
+    }
+    if (t === 'splat_parameter' || t === 'rest_assignment') {
+      const id = target.namedChildren.find((c) => c.type === 'identifier');
+      if (id) this.def(id, acc);
+      else this.walkValue(target, acc);
+      return;
+    }
+    // instance/class/global var, constant, element/attribute target — uses only.
+    this.walkValue(target, acc);
+  }
+
+  /** Value-position walk: collect uses; route def positions to the target handler. */
+  private walkValue(node: SyntaxNode, acc: FactAccumulator): void {
+    const t = node.type;
+    if (NESTED_FUNCTION_TYPES.has(t) && node.id !== this.fnId) return; // opaque
+
+    switch (t) {
+      case 'identifier':
+        this.use(node, acc);
+        return;
+      // Non-local variables and constants — recorded as neither a scalar def nor
+      // a local use (they are not function-scoped locals); nothing to add.
+      case 'instance_variable':
+      case 'class_variable':
+      case 'global_variable':
+      case 'constant':
+      case 'self':
+        return;
+      case 'assignment': {
+        const left = node.childForFieldName('left');
+        const right = node.childForFieldName('right');
+        if (right) this.walkValue(right, acc);
+        if (left) this.defTargets(left, acc);
+        return;
+      }
+      case 'operator_assignment': {
+        const left = node.childForFieldName('left');
+        const right = node.childForFieldName('right');
+        if (right) this.walkValue(right, acc);
+        if (left) {
+          if (left.type === 'identifier') {
+            this.use(left, acc);
+            this.def(left, acc);
+          } else {
+            this.walkValue(left, acc); // non-local lvalue — use only
+          }
+        }
+        return;
+      }
+      case 'binary': {
+        // `a && b` / `a || b` / `and` / `or` — the right operand is conditionally
+        // evaluated, so any def inside it is a may-def; uses are still recorded.
+        const left = node.childForFieldName('left');
+        const right = node.childForFieldName('right');
+        const op = node.childForFieldName('operator')?.text ?? '';
+        if (left) this.walkValue(left, acc);
+        if (right) {
+          if (op === '&&' || op === '||' || op === 'and' || op === 'or') {
+            this.conditional(() => this.walkValue(right, acc));
+          } else {
+            this.walkValue(right, acc);
+          }
+        }
+        return;
+      }
+      case 'call': {
+        // `recv.meth(args)` / `meth(args)` — the receiver root + arguments are
+        // uses (the method name is not a scalar binding). A nested block child is
+        // its OWN function CFG (opaque here).
+        const receiver = node.childForFieldName('receiver');
+        const args = node.childForFieldName('arguments');
+        if (receiver) this.walkValue(receiver, acc);
+        if (args) this.walkValue(args, acc);
+        return;
+      }
+      default:
+        for (let i = 0; i < node.namedChildCount; i++) {
+          const c = node.namedChild(i);
+          if (c) this.walkValue(c, acc);
+        }
+    }
+  }
+}
diff --git a/gitnexus/src/core/ingestion/cfg/visitors/ruby.ts b/gitnexus/src/core/ingestion/cfg/visitors/ruby.ts
new file mode 100644
index 000000000..bec57ecbd
--- /dev/null
+++ b/gitnexus/src/core/ingestion/cfg/visitors/ruby.ts
@@ -0,0 +1,1008 @@
+/**
+ * Ruby CfgVisitor (PDG layer beyond the C-family). Structurally closest to the
+ * Python visitor — keyword/indentation-free blocks delimited by `end`,
+ * statement-modifier forms (`expr if c`, `expr while c`), a
+ * begin/rescue/else/ensure exception model (ensure = finally, rescue = catch,
+ * the `else` runs if no exception), and `case`/`when` + `case`/`in` pattern
+ * matching with no fallthrough. Ruby adds a few wrinkles the other visitors do
+ * not have: `if`/`case`/`begin` are EXPRESSIONS, a method body is itself an
+ * implicit `begin` (its `body_statement` can carry trailing `rescue`/`ensure`),
+ * blocks (`do … end` / `{ … }`) and lambdas are their own CFG-bearing closures,
+ * and `until` inverts the loop sense of `while`.
+ *
+ * Walks a Ruby `method` / `singleton_method` / block / `lambda`'s tree-sitter
+ * AST and drives the language-agnostic {@link CfgBuilder} to produce a
+ * serializable {@link FunctionCfg}, plus a def/use harvest
+ * ({@link RubyHarvester}) for the reaching-defs / CDG solvers. Structured like
+ * the Python / Go visitors — a `visit_<node_type>` dispatch over the statement
+ * taxonomy, driving a per-function {@link ControlFlowContext} for break/continue
+ * (next ≈ continue, redo ≈ loop-back) and the begin/ensure finalizer chain. NO
+ * call-site `sites[]` are harvested (taint substrate is a later step — see
+ * ruby-harvest.ts).
+ *
+ * Every node type and field literal below was grammar-validated against
+ * tree-sitter-ruby via the introspection probe before use (mandatory pre-step).
+ * Ruby shapes pre-empted (verified by a real parse):
+ *  - functions: `method` / `singleton_method` (fields `name`/`parameters`/`body`;
+ *    `body` is a `body_statement`). Blocks: `do_block` (`body` = `body_statement`)
+ *    / `block` (`body` = `block_body`); `lambda` (`->(){}`; `body` = a `block`
+ *    wrapping a `block_body`). The `lambda { }` keyword form is a `call` to
+ *    `lambda` carrying a `block` — its block is collected as its own function.
+ *  - `if` / `unless` fields `condition`/`consequence`(`then`)/`alternative`; the
+ *    `alternative` is a nested `elsif` (own `condition`/`consequence`/`alternative`)
+ *    or a trailing `else`. `if_modifier` / `unless_modifier` fields `body`/`condition`.
+ *  - `while` / `until` fields `condition`/`body`(`do`); `while_modifier` /
+ *    `until_modifier` fields `body`/`condition`. `for` fields `pattern`/`value`
+ *    (an `in` wrapping the iterable) / `body`(`do`).
+ *  - `case` fields `value` + `when` children (fields `pattern` (repeatable) /
+ *    `body`(`then`)) + a trailing `else`. `case_match` (the `case … in` form)
+ *    has fields `value` +
+ *    `clauses`(`in_clause`, fields `pattern`/`guard`?(`if_guard`)/`body`) + an
+ *    `else` field. No fallthrough in either.
+ *  - `begin` directly holds its protected statements then typed `rescue` /
+ *    `else` / `ensure` children (no field names). `rescue` fields
+ *    `exceptions`?(`exceptions`)/`variable`?(`exception_variable`)/`body`(`then`).
+ *    A method `body_statement` can carry the SAME trailing `rescue`/`else`/`ensure`
+ *    children (an implicit begin). `rescue_modifier` fields `body`/`handler`.
+ *  - `return` / `next` / `break` hold an optional `argument_list` child;
+ *    `redo` / `retry` / `yield` are leaf-ish (`yield` may hold an `argument_list`).
+ *
+ * Edge-kind contract (matches the existing visitors — RD/CDG consume these):
+ *  - if/unless/elsif/else → `cond-true` / `cond-false` (unless inverts the
+ *    senses — its body is the cond-false arm)
+ *  - while/until/for → `cond-true` / `loop-back` / `cond-false`; `until` inverts
+ *    (its body runs while the condition is FALSE), still modeled with the same
+ *    edge kinds (the loop body is `cond-true`, the exit `cond-false`)
+ *  - case/when, case/in → `switch-case` (no fallthrough — like Go / Python match)
+ *  - begin/rescue → `throw` (every protected-region block → each rescue handler);
+ *    ensure completion → `finally-return` / `finally-break` / `finally-continue`
+ *  - return → `return`; `break` → `break`; `next` ≈ continue → `continue`;
+ *    `redo` → `loop-back` (re-enters the loop/block body); a jump crossing an
+ *    `ensure` threads through it
+ *  - straight-line → `seq`
+ *
+ * Ruby-specific modeling decisions (documented approximations):
+ *  - a method body is an implicit `begin`: its `body_statement`'s trailing
+ *    `rescue`/`else`/`ensure` children are modeled exactly like a `begin`.
+ *  - `ensure` runs on BOTH the normal exit and an exception (finally semantics);
+ *    the `rescue`-less `begin`/method re-propagates the exception after ensure.
+ *  - `loop do … end` is `xs.loop`-shaped only when written as `loop { }`; the
+ *    bare `loop do … end` is a `call` to `loop` carrying a `do_block`. The block
+ *    body becomes its OWN function CFG (a closure), which — like `while true` —
+ *    must still keep EXIT reverse-reachable. Inside the block, the structural
+ *    exit-escape edge is emitted (the block body's normal fall-off reaches its
+ *    EXIT). At the CALL site, the `loop … end` is a normal straight-line call.
+ *  - `while true` (and any loop with no statically-false exit) STILL emits the
+ *    structural `header → loopExit` `cond-false` edge so EXIT stays
+ *    reverse-reachable and the post-dominator / CDG pass is not silently skipped.
+ *    The single highest-risk correctness property of the visitor.
+ *  - `retry` re-enters the nearest enclosing `begin` (its protected body); the
+ *    edge is a `loop-back` to that begin's entry. Outside a begin it routes to
+ *    EXIT (single-exit preserved) — a documented approximation.
+ *  - `redo` re-runs the current loop/block body without re-testing the condition
+ *    — modeled as a `loop-back` to the loop's continue target.
+ *  - `if`/`case`/`begin` are EXPRESSIONS in Ruby (they have a value); as
+ *    STATEMENTS they are modeled as control constructs. As an `assignment` RHS
+ *    (`x = if c then 1 else 2 end` / `x = case k … end`) they are ALSO modeled as
+ *    control flow now — the arms branch and the LHS binds at the rejoin (#2205,
+ *    see {@link visitBindBranch}). Remaining inline (the same gap Java still has):
+ *    a branch nested deeper in an expression (`x = f(if c …)`, `x = (if c …) + 1`)
+ *    and an `operator_assignment` RHS (`x ||= if c …`).
+ *
+ * Known limitations:
+ *  - `yield` is a normal expression here (no suspend/resume edge to the block
+ *    passed by the caller); the generator-style resumption flow is not modeled.
+ *  - `retry`'s re-enter target is the nearest lexical `begin`; a `retry` reached
+ *    from a `rescue` whose begin is not on the active handler stack falls back to
+ *    EXIT (documented approximation, not faked).
+ *  - expression-position `case`/`begin`/`if` arms are inline (see above).
+ *  - Def/use harvest scope: see ruby-harvest.ts — `@x`/`@@x`/`$x`/constant and
+ *    index/attribute writes are not scalar defs; nested block / lambda bodies are
+ *    opaque in both directions.
+ *
+ * Returns `undefined` (never throws) for an AST shape it cannot model, so a
+ * malformed function never drops the whole file's CFG group (R4).
+ */
+import type { SyntaxNode } from '../../utils/ast-helpers.js';
+import { CfgBuilder } from '../cfg-builder.js';
+import {
+  ControlFlowContext,
+  drainFinalizerPending,
+  wireJumpThroughFinalizers,
+} from '../control-flow-context.js';
+import type { TraversalResult } from '../traversal-result.js';
+import type { CfgVisitor, FunctionCfg } from '../types.js';
+import { RubyHarvester } from './ruby-harvest.js';
+
+/** Ruby node types that own a CFG-bearing function/closure body. */
+const RUBY_FUNCTION_TYPES = new Set(['method', 'singleton_method', 'do_block', 'block', 'lambda']);
+
+/** Statement node types that break a basic block (everything else coalesces). */
+const CONTROL_FLOW_TYPES = new Set([
+  'if',
+  'unless',
+  'if_modifier',
+  'unless_modifier',
+  'while',
+  'until',
+  'while_modifier',
+  'until_modifier',
+  'for',
+  'case',
+  'case_match',
+  'begin',
+  'return',
+  'break',
+  'next',
+  'redo',
+  'retry',
+  'body_statement',
+  'block_body',
+]);
+
+/**
+ * Value-position branch constructs (#2205). When one of these is an `assignment`
+ * RHS (`x = if … / case …`) or a `return` value, it is modeled as control flow
+ * (its arms carry control dependence) instead of coalescing inline. `if`/`unless`
+ * always branch (the condition gates the then-arm even without `else`).
+ */
+const VALUE_BRANCH_EXPR_TYPES = new Set(['if', 'unless', 'case', 'case_match']);
+
+const startLineOf = (n: SyntaxNode): number => n.startPosition.row + 1;
+const endLineOf = (n: SyntaxNode): number => n.endPosition.row + 1;
+
+/** A statement sequence that produced no blocks (empty body) is "transparent". */
+type SeqResult = TraversalResult | null;
+
+/**
+ * Per-function Ruby walk state. One instance per function so the
+ * {@link ControlFlowContext}, the exception-handler stack, and the `begin`
+ * re-enter stack (for `retry`) are scoped to that function and never leak.
+ */
+class RubyCfgWalk {
+  private readonly cfc = new ControlFlowContext();
+  /** Stack of exception-handler entry blocks (rescue / ensure) a raise jumps to. */
+  private readonly handlers: number[] = [];
+  /** Stack of nearest-enclosing `begin` protected-body entry blocks (for `retry`). */
+  private readonly beginEntries: number[] = [];
+  /**
+   * For a block / lambda function (`do … end`, `{ … }`, `->(){}`), the body entry
+   * a `redo` re-enters when there is no enclosing real loop. A bare block is
+   * implicitly re-runnable by `redo`; set once the body's first block is known.
+   */
+  private blockRedoTarget: number | undefined;
+
+  /** Record the block-function body entry that a bare `redo` re-enters. */
+  setBlockRedoTarget(entry: number): void {
+    this.blockRedoTarget = entry;
+  }
+
+  constructor(
+    private readonly builder: CfgBuilder,
+    private readonly harvest: RubyHarvester,
+  ) {}
+
+  /** Statements of a body node (`then`/`do`/`else`/`ensure`/`body_statement`/…), no comments. */
+  private statementsOf(body: SyntaxNode): SyntaxNode[] {
+    return body.namedChildren.filter((c) => c.type !== 'comment');
+  }
+
+  /** Visit a body that may be a wrapper (`then`/`do`/`block_body`/`body_statement`) or a single statement. */
+  private visitBody(node: SyntaxNode | undefined | null): SeqResult {
+    return this.builder.withNesting(() => {
+      if (!node) return null;
+      if (this.isBodyWrapper(node)) return this.visitSeq(this.statementsOf(node));
+      return this.visitStmt(node);
+    });
+  }
+
+  private isBodyWrapper(node: SyntaxNode): boolean {
+    return (
+      node.type === 'then' ||
+      node.type === 'do' ||
+      node.type === 'else' ||
+      node.type === 'ensure' ||
+      node.type === 'body_statement' ||
+      node.type === 'block_body'
+    );
+  }
+
+  /** Wire a sequence of statements, coalescing straight-line runs into blocks. */
+  visitSeq(stmts: SyntaxNode[]): SeqResult {
+    return this.builder.withNesting(() => {
+      let entry: number | undefined;
+      let dangling: number[] = [];
+      let openSimple: number | undefined;
+
+      for (const stmt of stmts) {
+        // A value-position branch on an assignment RHS (`x = if …`) is NOT in
+        // CONTROL_FLOW_TYPES (its node is `assignment`), so route it out of the
+        // coalescing path explicitly so visitStmt models its arms (#2205).
+        if (CONTROL_FLOW_TYPES.has(stmt.type) || this.isValueBranchAssignment(stmt)) {
+          openSimple = undefined; // close any open straight-line block
+          const res = this.visitStmt(stmt);
+          if (res === null) continue; // transparent (empty nested block)
+          if (entry === undefined) entry = res.entry;
+          else this.builder.connect(dangling, res.entry, 'seq');
+          dangling = [...res.exits];
+        } else {
+          if (openSimple === undefined) {
+            const idx = this.builder.newBlock(
+              startLineOf(stmt),
+              endLineOf(stmt),
+              stmt.text,
+              'normal',
+              this.harvest.facts(stmt),
+            );
+            if (entry === undefined) entry = idx;
+            else this.builder.connect(dangling, idx, 'seq');
+            openSimple = idx;
+            dangling = [idx];
+          } else {
+            this.builder.extendBlock(
+              openSimple,
+              endLineOf(stmt),
+              stmt.text,
+              this.harvest.facts(stmt),
+            );
+          }
+        }
+      }
+
+      if (entry === undefined) return null;
+      return { entry, exits: dangling };
+    });
+  }
+
+  /** Dispatch one statement to its handler. Non-null except for empty blocks. */
+  visitStmt(stmt: SyntaxNode): SeqResult {
+    switch (stmt.type) {
+      case 'if':
+      case 'unless':
+        return this.visitIf(stmt);
+      case 'if_modifier':
+      case 'unless_modifier':
+        return this.visitIfModifier(stmt);
+      case 'while':
+      case 'until':
+        return this.visitWhile(stmt);
+      case 'while_modifier':
+      case 'until_modifier':
+        return this.visitWhileModifier(stmt);
+      case 'for':
+        return this.visitFor(stmt);
+      case 'case':
+        return this.visitCase(stmt);
+      case 'case_match':
+        return this.visitCaseMatch(stmt);
+      case 'begin':
+        return this.visitBegin(stmt);
+      case 'return':
+        return this.visitReturn(stmt);
+      case 'break':
+        return this.visitBreak(stmt);
+      case 'next':
+        return this.visitNext(stmt);
+      case 'redo':
+        return this.visitRedo(stmt);
+      case 'retry':
+        return this.visitRetry(stmt);
+      case 'body_statement':
+        return this.visitImplicitBegin(stmt);
+      case 'block_body':
+        return this.visitSeq(this.statementsOf(stmt));
+      case 'assignment': {
+        // `x = if c then a else b end` / `x = case … end` (#2205): model the RHS
+        // branch as control flow and bind the LHS on the rejoin.
+        const branch = this.assignmentBranch(stmt);
+        if (branch) return this.visitBindBranch(stmt, branch);
+        return this.visitSimple(stmt);
+      }
+      default:
+        return this.visitSimple(stmt);
+    }
+  }
+
+  private visitSimple(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    return { entry: idx, exits: [idx] };
+  }
+
+  /**
+   * `return [expr]` — threads through EVERY active `ensure` before EXIT.
+   * (A value-position branch RETURN is handled the idiomatic Ruby way already:
+   * `def f; if c then a else b end; end` is the implicit last-expression and is
+   * modeled as statement position. Bare `return if … end` is not a clean
+   * grammar shape — tree-sitter-ruby drops the value — so it stays a plain
+   * return; the assignment carrier is the value-branch fix here, #2205.)
+   */
+  private visitReturn(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    wireJumpThroughFinalizers(
+      this.builder,
+      idx,
+      this.cfc.finalizersForReturn(),
+      this.builder.exitIndex,
+      'return',
+    );
+    return { entry: idx, exits: [] };
+  }
+
+  /** `break [expr]` — exits the nearest loop/block; threads through any `ensure`. */
+  private visitBreak(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    const res = this.cfc.resolveBreak();
+    const { target, finalizers } = res ?? {
+      target: this.builder.exitIndex,
+      finalizers: this.cfc.finalizersForReturn(),
+    };
+    wireJumpThroughFinalizers(this.builder, idx, finalizers, target, 'break');
+    return { entry: idx, exits: [] };
+  }
+
+  /** `next [expr]` ≈ continue — re-tests the nearest loop header; threads `ensure`. */
+  private visitNext(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    const res = this.cfc.resolveContinue();
+    const { target, finalizers } = res ?? {
+      target: this.builder.exitIndex,
+      finalizers: this.cfc.finalizersForReturn(),
+    };
+    wireJumpThroughFinalizers(this.builder, idx, finalizers, target, 'continue');
+    return { entry: idx, exits: [] };
+  }
+
+  /**
+   * `redo` — re-run the current loop/block body WITHOUT re-evaluating the
+   * condition. Modeled as a `loop-back` to the nearest loop's continue target
+   * (the loop header in the visitor's model). Outside a loop it routes to EXIT.
+   */
+  private visitRedo(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(startLineOf(stmt), endLineOf(stmt), stmt.text);
+    // A `redo` inside a real loop re-runs that loop's body (its continue target);
+    // a `redo` inside a bare block re-enters the block body. Falls back to EXIT
+    // when neither exists (single-exit preserved).
+    const target = this.cfc.continueTarget() ?? this.blockRedoTarget;
+    if (target !== undefined) this.builder.edge(idx, target, 'loop-back');
+    else this.builder.edge(idx, this.builder.exitIndex, 'seq');
+    return { entry: idx, exits: [] };
+  }
+
+  /**
+   * `retry` — re-enter the nearest enclosing `begin`'s protected body. Modeled as
+   * a `loop-back` to that begin's entry block. Outside any begin it routes to
+   * EXIT (single-exit preserved) — a documented approximation.
+   */
+  private visitRetry(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(startLineOf(stmt), endLineOf(stmt), stmt.text);
+    const begin = this.beginEntries[this.beginEntries.length - 1];
+    if (begin !== undefined) this.builder.edge(idx, begin, 'loop-back');
+    else this.builder.edge(idx, this.builder.exitIndex, 'seq');
+    return { entry: idx, exits: [] };
+  }
+
+  /**
+   * `if cond … elsif cond … else …` and `unless cond … else …`. Ruby has no
+   * nested-if else chain: an `if`/`unless` carries `condition`/`consequence`(then)
+   * plus an optional `alternative` that is an `elsif` (its own
+   * condition/consequence/alternative) or a trailing `else`. `unless` inverts the
+   * sense — its consequence is the cond-FALSE arm.
+   */
+  /** The value-position branch on an `assignment` RHS (`x = if … / case …`), or
+   *  undefined when the RHS is anything else (#2205). */
+  private assignmentBranch(stmt: SyntaxNode): SyntaxNode | undefined {
+    if (stmt.type !== 'assignment') return undefined;
+    const right = stmt.childForFieldName('right');
+    return right && VALUE_BRANCH_EXPR_TYPES.has(right.type) ? right : undefined;
+  }
+
+  /** Whether a statement is an `assignment` with a value-position-branch RHS —
+   *  routes it out of `visitSeq`'s coalescing path so its arms are modeled. */
+  private isValueBranchAssignment(stmt: SyntaxNode): boolean {
+    return this.assignmentBranch(stmt) !== undefined;
+  }
+
+  /** Model a value-position `if`/`unless`/`case`/`case_match` as control flow,
+   *  bypassing the statement/value-position distinction (#2205). */
+  private visitBranchExpr(node: SyntaxNode): TraversalResult {
+    switch (node.type) {
+      case 'if':
+      case 'unless':
+        return this.visitIf(node);
+      case 'case':
+        return this.visitCase(node);
+      case 'case_match':
+        return this.visitCaseMatch(node);
+      default:
+        return this.visitSimple(node); // unreachable — guarded by VALUE_BRANCH_EXPR_TYPES
+    }
+  }
+
+  /**
+   * `x = if … / case …` (#2205): visit the RHS branch as control flow, then rejoin
+   * its arms at a facts-only continuation carrying ONLY the LHS target def (the
+   * condition + arm-value uses are already harvested onto the branch's blocks).
+   * The arms are now control-dependent on the branch condition, and `x` is defined
+   * at the join — mirrors the Rust visitor's value-position `let` handling.
+   */
+  private visitBindBranch(stmt: SyntaxNode, branch: SyntaxNode): TraversalResult {
+    const res = this.visitBranchExpr(branch);
+    const cont = this.builder.newBlock(
+      startLineOf(stmt),
+      startLineOf(stmt),
+      '',
+      'normal',
+      this.harvest.assignmentDefFacts(stmt),
+    );
+    this.builder.connect(res.exits, cont, 'seq');
+    return { entry: res.entry, exits: [cont] };
+  }
+
+  private visitIf(stmt: SyntaxNode): TraversalResult {
+    const inverted = stmt.type === 'unless';
+    const cond = stmt.childForFieldName('condition') ?? stmt;
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(cond),
+      cond.text,
+      'normal',
+      this.harvest.facts(cond),
+    );
+    const thenKind = inverted ? 'cond-false' : 'cond-true';
+    const elseKind = inverted ? 'cond-true' : 'cond-false';
+
+    const exits: number[] = [];
+    const thenRes = this.visitBody(stmt.childForFieldName('consequence'));
+    if (thenRes) {
+      this.builder.edge(header, thenRes.entry, thenKind);
+      exits.push(...thenRes.exits);
+    } else {
+      exits.push(header); // empty consequence — that path falls through
+    }
+
+    const alt = stmt.childForFieldName('alternative');
+    if (alt) {
+      const { exits: altExits } = this.visitIfAlternative(alt, header, elseKind);
+      exits.push(...altExits);
+    } else {
+      exits.push(header); // no else — the complement path falls through to the join
+    }
+
+    return { entry: header, exits: [...new Set(exits)] };
+  }
+
+  /**
+   * Thread an `if`/`unless` alternative: an `elsif` (its own condition chained on
+   * the parent's false edge) or a trailing `else`. Returns the dangling exits.
+   */
+  private visitIfAlternative(
+    alt: SyntaxNode,
+    falseFrom: number,
+    falseKind: 'cond-true' | 'cond-false',
+  ): { exits: number[] } {
+    const exits: number[] = [];
+    if (alt.type === 'elsif') {
+      const cond = alt.childForFieldName('condition') ?? alt;
+      const elifHeader = this.builder.newBlock(
+        startLineOf(alt),
+        endLineOf(cond),
+        cond.text,
+        'normal',
+        this.harvest.facts(cond),
+      );
+      this.builder.edge(falseFrom, elifHeader, falseKind);
+      const thenRes = this.visitBody(alt.childForFieldName('consequence'));
+      if (thenRes) {
+        this.builder.edge(elifHeader, thenRes.entry, 'cond-true');
+        exits.push(...thenRes.exits);
+      } else {
+        exits.push(elifHeader);
+      }
+      const nested = alt.childForFieldName('alternative');
+      if (nested) {
+        exits.push(...this.visitIfAlternative(nested, elifHeader, 'cond-false').exits);
+      } else {
+        exits.push(elifHeader); // elsif with no further alternative falls through
+      }
+    } else {
+      // a trailing `else` (consumes the false path entirely).
+      const elseRes = this.visitBody(alt);
+      if (elseRes) {
+        this.builder.edge(falseFrom, elseRes.entry, falseKind);
+        exits.push(...elseRes.exits);
+      } else {
+        exits.push(falseFrom);
+      }
+    }
+    return { exits };
+  }
+
+  /**
+   * `expr if cond` / `expr unless cond` — the modifier statement-form. The body
+   * runs on the taken branch; the complement falls straight through to the join.
+   */
+  private visitIfModifier(stmt: SyntaxNode): TraversalResult {
+    const inverted = stmt.type === 'unless_modifier';
+    const cond = stmt.childForFieldName('condition');
+    const body = stmt.childForFieldName('body');
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      cond ? endLineOf(cond) : startLineOf(stmt),
+      cond ? cond.text : stmt.text,
+      'normal',
+      cond ? this.harvest.facts(cond) : undefined,
+    );
+    const takenKind = inverted ? 'cond-false' : 'cond-true';
+    const exits: number[] = [header]; // the complement path falls through
+
+    const bodyRes = body ? this.visitStmt(body) : null;
+    if (bodyRes) {
+      this.builder.edge(header, bodyRes.entry, takenKind);
+      exits.push(...bodyRes.exits);
+    } else {
+      this.builder.edge(header, header, takenKind === 'cond-true' ? 'cond-true' : 'cond-false');
+    }
+    return { entry: header, exits: [...new Set(exits)] };
+  }
+
+  /**
+   * `while cond … end` / `until cond … end`. `until` inverts (its body runs while
+   * the condition is FALSE); both are modeled with `cond-true` to the body and
+   * `cond-false` to the loop exit (the inversion is a semantic note, not a
+   * structural change — the header is a single control point either way).
+   */
+  private visitWhile(stmt: SyntaxNode): TraversalResult {
+    const cond = stmt.childForFieldName('condition') ?? stmt;
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(cond),
+      cond.text,
+      'normal',
+      this.harvest.facts(cond),
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.cfc.pushLoop(header, loopExit, []);
+    const body = this.visitBody(stmt.childForFieldName('body'));
+    this.cfc.pop();
+
+    if (body) {
+      this.builder.edge(header, body.entry, 'cond-true');
+      this.builder.connect(body.exits, header, 'loop-back');
+    } else {
+      this.builder.edge(header, header, 'loop-back'); // empty body re-tests
+    }
+    // Always emit the structural exit edge — even `while true` keeps EXIT
+    // reverse-reachable for the post-dominator / CDG pass.
+    this.builder.edge(header, loopExit, 'cond-false');
+    return { entry: header, exits: [loopExit] };
+  }
+
+  /** `expr while cond` / `expr until cond` — the modifier loop-form. */
+  private visitWhileModifier(stmt: SyntaxNode): TraversalResult {
+    const cond = stmt.childForFieldName('condition') ?? stmt;
+    const body = stmt.childForFieldName('body');
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(cond),
+      cond.text,
+      'normal',
+      this.harvest.facts(cond),
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.cfc.pushLoop(header, loopExit, []);
+    const bodyRes = body ? this.visitStmt(body) : null;
+    this.cfc.pop();
+
+    if (bodyRes) {
+      this.builder.edge(header, bodyRes.entry, 'cond-true');
+      this.builder.connect(bodyRes.exits, header, 'loop-back');
+    } else {
+      this.builder.edge(header, header, 'loop-back');
+    }
+    this.builder.edge(header, loopExit, 'cond-false');
+    return { entry: header, exits: [loopExit] };
+  }
+
+  /**
+   * `for PATTERN in VALUE … end`. Header = the iteration test (a def of the
+   * pattern target(s) + a use of the iterable).
+   */
+  private visitFor(stmt: SyntaxNode): TraversalResult {
+    const value = stmt.childForFieldName('value');
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      value ? endLineOf(value) : startLineOf(stmt),
+      this.forHeaderText(stmt),
+      'normal',
+      this.harvest.loopHeadFacts(stmt),
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.cfc.pushLoop(header, loopExit, []);
+    const body = this.visitBody(stmt.childForFieldName('body'));
+    this.cfc.pop();
+
+    if (body) {
+      this.builder.edge(header, body.entry, 'cond-true');
+      this.builder.connect(body.exits, header, 'loop-back');
+    } else {
+      this.builder.edge(header, header, 'loop-back');
+    }
+    this.builder.edge(header, loopExit, 'cond-false');
+    return { entry: header, exits: [loopExit] };
+  }
+
+  private forHeaderText(stmt: SyntaxNode): string {
+    const pattern = stmt.childForFieldName('pattern')?.text ?? '';
+    const value = stmt.childForFieldName('value')?.text ?? '';
+    return pattern || value ? `for ${pattern} ${value}` : stmt.text.split('\n')[0];
+  }
+
+  /**
+   * `case VALUE; when P; … else; … end`. Cases do NOT fall through (like Go /
+   * Python match). The subject block fans a `switch-case` edge to each `when`
+   * body; a `case` with no `else` also reaches the join directly (no-match path),
+   * keeping EXIT reverse-reachable.
+   */
+  private visitCase(stmt: SyntaxNode): TraversalResult {
+    const value = stmt.childForFieldName('value');
+    const dispatch = this.builder.newBlock(
+      startLineOf(stmt),
+      value ? endLineOf(value) : startLineOf(stmt),
+      value ? `case ${value.text}` : 'case',
+      'normal',
+      value ? this.harvest.facts(value) : undefined,
+    );
+    const caseExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    const whenClauses = stmt.namedChildren.filter((c) => c.type === 'when');
+    const elseClause = stmt.namedChildren.find((c) => c.type === 'else');
+
+    // Each `when` pattern evaluates conditionally before its body — harvest its
+    // uses onto the dispatch block (a later case only tests when earlier
+    // patterns did not match).
+    for (const w of whenClauses) {
+      for (const pat of this.whenPatterns(w)) {
+        this.builder.attachFacts(dispatch, this.harvest.factsConditional(pat));
+      }
+    }
+
+    this.cfc.pushSwitch(caseExit, []);
+    for (const w of whenClauses) {
+      const bodyRes = this.visitBody(w.childForFieldName('body'));
+      const entry = bodyRes?.entry ?? caseExit;
+      this.builder.edge(dispatch, entry, 'switch-case');
+      if (bodyRes) this.builder.connect(bodyRes.exits, caseExit, 'seq');
+    }
+    if (elseClause) {
+      const elseRes = this.visitBody(elseClause);
+      const entry = elseRes?.entry ?? caseExit;
+      this.builder.edge(dispatch, entry, 'switch-case');
+      if (elseRes) this.builder.connect(elseRes.exits, caseExit, 'seq');
+    } else {
+      // No `else` → a no-match path reaches the exit directly (keeps EXIT
+      // reverse-reachable even when every when body jumps).
+      this.builder.edge(dispatch, caseExit, 'switch-case');
+    }
+    this.cfc.pop();
+
+    return { entry: dispatch, exits: [caseExit] };
+  }
+
+  /** The `pattern`-field children of a `when` clause (a `when` may list several). */
+  private whenPatterns(whenClause: SyntaxNode): SyntaxNode[] {
+    const out: SyntaxNode[] = [];
+    for (let i = 0; i < whenClause.childCount; i++) {
+      if (whenClause.fieldNameForChild(i) === 'pattern') {
+        const c = whenClause.child(i);
+        if (c) out.push(c);
+      }
+    }
+    return out;
+  }
+
+  /**
+   * `case VALUE; in PATTERN [if guard]; … else; … end` — the pattern-matching
+   * form (`case_match`). Same no-fallthrough dispatch as `case`/`when`; each
+   * `in_clause` body is dispatched with a `switch-case` edge and an `in_clause`
+   * guard is harvested as a conditional use on the dispatch.
+   */
+  private visitCaseMatch(stmt: SyntaxNode): TraversalResult {
+    const value = stmt.childForFieldName('value');
+    const dispatch = this.builder.newBlock(
+      startLineOf(stmt),
+      value ? endLineOf(value) : startLineOf(stmt),
+      value ? `case ${value.text}` : 'case',
+      'normal',
+      value ? this.harvest.facts(value) : undefined,
+    );
+    const caseExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    const clauses = stmt.namedChildren.filter((c) => c.type === 'in_clause');
+    const elseClause =
+      stmt.childForFieldName('else') ?? stmt.namedChildren.find((c) => c.type === 'else');
+
+    // An `in`-clause guard (`in P if g`) evaluates conditionally on the dispatch.
+    for (const c of clauses) {
+      const guard = c.childForFieldName('guard');
+      if (guard) this.builder.attachFacts(dispatch, this.harvest.factsConditional(guard));
+    }
+
+    this.cfc.pushSwitch(caseExit, []);
+    for (const c of clauses) {
+      const bodyRes = this.visitBody(c.childForFieldName('body'));
+      const entry = bodyRes?.entry ?? caseExit;
+      this.builder.edge(dispatch, entry, 'switch-case');
+      if (bodyRes) this.builder.connect(bodyRes.exits, caseExit, 'seq');
+    }
+    if (elseClause) {
+      const elseRes = this.visitBody(elseClause);
+      const entry = elseRes?.entry ?? caseExit;
+      this.builder.edge(dispatch, entry, 'switch-case');
+      if (elseRes) this.builder.connect(elseRes.exits, caseExit, 'seq');
+    } else {
+      // A `case … in` with no `else` raises NoMatchingPatternError on no match,
+      // but the structural no-match edge keeps EXIT reverse-reachable.
+      this.builder.edge(dispatch, caseExit, 'switch-case');
+    }
+    this.cfc.pop();
+
+    return { entry: dispatch, exits: [caseExit] };
+  }
+
+  /**
+   * `begin … [rescue …]* [else …] [ensure …] end`. Mirrors the Python
+   * try-route-through:
+   *  - `ensure` runs on every exit (normal, exception, early jumps) — a finalizer
+   *    frame for early-exit threading + a normal/exceptional join.
+   *  - each `rescue` handler catches from the protected body.
+   *  - `else` runs only if the body completed with no exception.
+   */
+  private visitBegin(stmt: SyntaxNode): SeqResult {
+    const children = this.statementsOf(stmt);
+    return this.buildProtected(stmt, children);
+  }
+
+  /**
+   * A method `body_statement` is an implicit `begin` — its trailing
+   * `rescue`/`else`/`ensure` children behave exactly like a `begin`'s. When there
+   * are none, this is just a straight statement sequence.
+   */
+  private visitImplicitBegin(stmt: SyntaxNode): SeqResult {
+    const children = this.statementsOf(stmt);
+    const hasHandlers = children.some(
+      (c) => c.type === 'rescue' || c.type === 'else' || c.type === 'ensure',
+    );
+    if (!hasHandlers) return this.visitSeq(children);
+    return this.buildProtected(stmt, children);
+  }
+
+  /**
+   * Shared begin/rescue/else/ensure builder. `children` is the construct's
+   * ordered named children: leading protected statements, then the typed
+   * `rescue` / `else` / `ensure` clauses.
+   */
+  private buildProtected(span: SyntaxNode, children: SyntaxNode[]): SeqResult {
+    const protectedStmts: SyntaxNode[] = [];
+    const rescueClauses: SyntaxNode[] = [];
+    let elseClause: SyntaxNode | undefined;
+    let ensureClause: SyntaxNode | undefined;
+    for (const c of children) {
+      if (c.type === 'rescue') rescueClauses.push(c);
+      else if (c.type === 'else') elseClause = c;
+      else if (c.type === 'ensure') ensureClause = c;
+      else protectedStmts.push(c);
+    }
+
+    // Build ensure first — it is both a normal join and a handler target. It runs
+    // OUTSIDE this begin's finalizer frame (a return inside ensure threads only
+    // OUTER ensures).
+    const ensureRes = ensureClause ? this.visitSeq(this.statementsOf(ensureClause)) : null;
+    const finFrame = ensureRes ? this.cfc.pushFinalizer(ensureRes.entry) : null;
+
+    // Pre-create each rescue's facts-only HEAD block (`rescue Exc => e` binds `e`
+    // once, on handler entry) so the protected body knows its handler target
+    // BEFORE either body is walked — this lets a `retry` inside a rescue handler
+    // re-enter the protected body's real entry (which is walked next).
+    const handlerEntries = rescueClauses.map((clause) =>
+      this.builder.newBlock(
+        startLineOf(clause),
+        startLineOf(clause),
+        '',
+        'normal',
+        this.harvest.rescueHeadFacts(clause),
+      ),
+    );
+
+    // Handler for the protected body: the first rescue if present, else ensure,
+    // else the outer handler.
+    const tryHandler = handlerEntries[0] ?? ensureRes?.entry ?? this.currentHandler();
+    const protectedStart = this.builder.blockCount;
+    this.handlers.push(tryHandler);
+    const bodyRes = this.visitSeq(protectedStmts);
+    this.handlers.pop();
+    // Block range covering ONLY the protected body (rescue handler bodies are
+    // walked afterward and must NOT get the conservative per-block throw edge).
+    const protectedEnd = this.builder.blockCount;
+
+    // The protected body's entry is where a `retry` re-enters (a `loop-back`).
+    // Push it for BOTH the rescue-handler bodies AND already-walked body (already
+    // done above — a `retry` in the body itself is a non-idiom, but harmless).
+    const beginEntry = bodyRes?.entry ?? handlerEntries[0] ?? this.builder.exitIndex;
+    this.beginEntries.push(beginEntry);
+
+    // Walk each rescue handler body now (within the begin-entry scope so a
+    // `retry` re-enters the protected body). A raise inside a handler propagates
+    // to ensure (if any), else the outer handler.
+    const handlerExits: number[] = [];
+    rescueClauses.forEach((clause, i) => {
+      if (ensureRes) this.handlers.push(ensureRes.entry);
+      const headBlock = handlerEntries[i];
+      const handlerBodyRes = this.visitBody(clause.childForFieldName('body'));
+      if (handlerBodyRes) {
+        this.builder.edge(headBlock, handlerBodyRes.entry, 'seq');
+        handlerExits.push(...handlerBodyRes.exits);
+      } else {
+        handlerExits.push(headBlock); // empty handler — header is the exit
+      }
+      if (ensureRes) this.handlers.pop();
+    });
+
+    this.beginEntries.pop();
+
+    // Conservative exceptional edges: ANY protected-region block may raise to
+    // EACH handler (an unmatched exception type tries the next handler).
+    if (rescueClauses.length > 0 || ensureClause) {
+      const targets =
+        handlerEntries.length > 0 ? handlerEntries : ensureRes ? [ensureRes.entry] : [];
+      for (let b = protectedStart; b < protectedEnd; b++) {
+        for (const h of targets) this.builder.edge(b, h, 'throw');
+      }
+    }
+
+    // The `else` runs only on no-exception normal completion of the body.
+    let normalAfterBody: number[] = bodyRes ? [...bodyRes.exits] : [];
+    if (elseClause) {
+      const elseRes = this.visitBody(elseClause);
+      if (elseRes && bodyRes) {
+        this.builder.connect(bodyRes.exits, elseRes.entry, 'seq');
+        normalAfterBody = [...elseRes.exits];
+      } else if (elseRes) {
+        normalAfterBody = [...elseRes.exits];
+      }
+    }
+
+    // Close the finalizer frame; wire crossing-jump completion legs.
+    if (finFrame && ensureRes) {
+      this.cfc.pop();
+      drainFinalizerPending(this.builder, finFrame, ensureRes.exits);
+    }
+
+    const exits: number[] = [];
+    if (ensureRes) {
+      // Normal completion of (body→else) AND each handler flows through ensure.
+      this.builder.connect(normalAfterBody, ensureRes.entry, 'seq');
+      this.builder.connect(handlerExits, ensureRes.entry, 'seq');
+      exits.push(...ensureRes.exits);
+      // A begin with no rescue → an uncaught exception re-propagates after ensure.
+      if (handlerEntries.length === 0) {
+        this.builder.connect(ensureRes.exits, this.currentHandler(), 'throw');
+      }
+    } else {
+      exits.push(...normalAfterBody);
+      exits.push(...handlerExits);
+    }
+
+    const entry = bodyRes?.entry ?? ensureRes?.entry ?? handlerEntries[0];
+    if (entry === undefined) {
+      void span;
+      return null;
+    }
+    return { entry, exits: [...new Set(exits)] };
+  }
+
+  /** Nearest enclosing exception handler, or the function EXIT. */
+  private currentHandler(): number {
+    return this.handlers.length ? this.handlers[this.handlers.length - 1] : this.builder.exitIndex;
+  }
+}
+
+/** The body node of a Ruby function/block/lambda (a `block` for `lambda` unwraps once). */
+function functionBody(fnNode: SyntaxNode): SyntaxNode | undefined {
+  const body = fnNode.childForFieldName('body');
+  if (!body) return undefined;
+  // A `lambda`'s `body` is a `block` wrapping a `block_body` — unwrap to the
+  // inner body so the walk sees the statement sequence.
+  if (fnNode.type === 'lambda' && body.type === 'block') {
+    return body.childForFieldName('body') ?? body;
+  }
+  return body;
+}
+
+/** Build the CFG for one Ruby function/block/lambda node, or `undefined` if not modelable. */
+function buildFunctionCfg(fnNode: SyntaxNode, filePath: string): FunctionCfg | undefined {
+  try {
+    if (!RUBY_FUNCTION_TYPES.has(fnNode.type)) return undefined;
+    const startLine = startLineOf(fnNode);
+    const endLine = endLineOf(fnNode);
+    const startColumn = fnNode.startPosition.column;
+
+    const body = functionBody(fnNode);
+    if (!body) {
+      // No body — an empty `def f; end` still gets a trivial ENTRY → EXIT CFG so
+      // it is not silently dropped.
+      const builder = new CfgBuilder(filePath, startLine, endLine, startColumn);
+      const harvest = new RubyHarvester(fnNode);
+      const paramFacts = harvest.paramFacts();
+      if (paramFacts) builder.attachFacts(builder.entryIndex, paramFacts);
+      builder.edge(builder.entryIndex, builder.exitIndex, 'seq');
+      return builder.finish(harvest.bindingTable());
+    }
+
+    const builder = new CfgBuilder(filePath, startLine, endLine, startColumn);
+    const harvest = new RubyHarvester(fnNode);
+
+    const paramFacts = harvest.paramFacts();
+    if (paramFacts) builder.attachFacts(builder.entryIndex, paramFacts);
+
+    const walk = new RubyCfgWalk(builder, harvest);
+    // For a bare block / lambda, a `redo` re-enters the block body. The body's
+    // first block is the NEXT index the builder will allocate (entry + exit are
+    // already taken). Set it so a top-level `redo` inside the block loops back.
+    if (fnNode.type !== 'method' && fnNode.type !== 'singleton_method') {
+      walk.setBlockRedoTarget(builder.blockCount);
+    }
+    const res = walk.visitStmt(body);
+    if (!res) {
+      builder.edge(builder.entryIndex, builder.exitIndex, 'seq'); // empty body
+      return builder.finish(harvest.bindingTable());
+    }
+    builder.edge(builder.entryIndex, res.entry, 'seq');
+    builder.connect(res.exits, builder.exitIndex, 'seq'); // normal fall-off → EXIT
+    return builder.finish(harvest.bindingTable());
+  } catch (err) {
+    // Never throw out of buildFunctionCfg — a malformed AST shape must skip only
+    // this one function's CFG, never drop the whole file's language group (R4).
+    // eslint-disable-next-line no-console
+    console.warn(`[cfg] Ruby buildFunctionCfg skipped a function in ${filePath}: ${String(err)}`);
+    return undefined;
+  }
+}
+
+/** Whether a node is a Ruby function/closure this visitor builds a CFG for. */
+function isFunction(node: SyntaxNode): boolean {
+  return RUBY_FUNCTION_TYPES.has(node.type);
+}
+
+/** The Ruby CFG visitor. */
+export function createRubyCfgVisitor(): CfgVisitor<SyntaxNode> {
+  return { buildFunctionCfg, isFunction };
+}
+
+export { RUBY_FUNCTION_TYPES };
diff --git a/gitnexus/src/core/ingestion/cfg/visitors/rust-harvest.ts b/gitnexus/src/core/ingestion/cfg/visitors/rust-harvest.ts
new file mode 100644
index 000000000..baccb7411
--- /dev/null
+++ b/gitnexus/src/core/ingestion/cfg/visitors/rust-harvest.ts
@@ -0,0 +1,592 @@
+/**
+ * Rust def/use harvester (#2195 U7) — the Rust analogue of
+ * {@link import('./typescript-harvest.js').TsHarvester} and the C-family /
+ * Go / Python harvesters. Like the Python harvester it harvests NO call-site
+ * `sites[]` (the call-site taint substrate is a later step): it emits only the
+ * per-function binding table ({@link BindingEntry}[]) plus {@link StatementFacts}
+ * (defs / uses / mayDefs) via a local {@link FactAccumulator} with no site
+ * machinery, so the produced facts never carry a `sites` key.
+ *
+ * Runs in the parse worker next to the Rust CFG visitor. Output is the binding
+ * table the {@link import('../cfg-builder.js').CfgBuilder} stamps onto the CFG,
+ * plus the per-block def/use facts the reaching-defs / CDG solvers consume.
+ *
+ * Every node type and field literal below was grammar-validated against
+ * tree-sitter-rust via the introspection probe before use (mandatory pre-step).
+ * Rust shapes pre-empted (verified by a real parse):
+ *  - functions: `function_item` (fields `name`/`parameters`/`return_type`/`body`;
+ *    methods are `function_item` inside an `impl_item`'s `declaration_list`) and
+ *    `closure_expression` (field `parameters`=`closure_parameters`, `body` is a
+ *    `block` OR a bare expression).
+ *  - parameters: `parameter` (field `pattern`, optional `mutable_specifier`),
+ *    `self_parameter`. A `closure_parameters` lists bare `identifier`s and/or
+ *    `parameter` nodes.
+ *  - declarations: `let_declaration` (field `pattern`, optional `value`, optional
+ *    `alternative` block for `let … else`; optional `mutable_specifier`). The
+ *    `mut` keyword is irrelevant to def-ness.
+ *  - patterns (each bound `identifier` leaf is a def): `identifier`,
+ *    `tuple_pattern`, `slice_pattern`, `struct_pattern` (`field_pattern`s whose
+ *    `name` is a `shorthand_field_identifier`, or `name: pat`), `tuple_struct_pattern`
+ *    (field `type` is the variant path — NOT a binding; the inner patterns bind),
+ *    `ref_pattern` / `mut_pattern` (the inner identifier binds), `captured_pattern`
+ *    (`v @ subpat` — `v` binds, and the subpattern's leaves bind), `or_pattern`,
+ *    `range_pattern` (binds nothing). The wildcard `_` binds nothing.
+ *  - assignments: `assignment_expression` (fields `left`/`right`),
+ *    `compound_assignment_expr` (fields `left`/`operator`/`right` — read+write).
+ *  - loop / match binders: `for_expression` `pattern`; `match_arm` `pattern`
+ *    (a `match_pattern` whose leaves bind, plus an optional `if` guard with field
+ *    `condition`); `let_condition` `pattern` (`if let` / `while let`).
+ *  - reads: `field_expression` (fields `value`/`field`), `call_expression`
+ *    (fields `function`/`arguments`), `binary_expression` (fields
+ *    `left`/`operator`/`right`), `try_expression` (`expr?`).
+ *
+ * TWO-PHASE, ORDER-INDEPENDENT (load-bearing — mirrors the TS / Go / C
+ * harvesters): the CFG walk is NOT source-order, so resolving names against a
+ * scope stack populated *during* the walk would mis-resolve. Phase 1 pre-scans
+ * the whole function subtree once, declaring every bound name into ONE function
+ * table; phase 2 resolves defs/uses against that finished table from any walk
+ * order. Rust DOES have block scope + shadowing, but a single function table is
+ * the documented v1 simplification used by the Python harvester — distinct
+ * shadowing redeclarations of the same name collapse onto one binding (an
+ * over-approximation that can falsely kill across a shadow, the sound direction
+ * for taint: never a missed flow).
+ *
+ * v1 def-semantics scope:
+ *   - `let PAT = …` (and `let PAT = … else { … }`) — each identifier leaf of PAT
+ *     is a def; the value (and the `else` block) are walked for uses.
+ *   - `assignment_expression` plain `=` — a plain-identifier lvalue is a def; a
+ *     `field_expression` / index lvalue is NOT a scalar def (its root is a use).
+ *   - `compound_assignment_expr` (`x += 1`) — def AND use the lvalue.
+ *   - `for PAT in ITER` — the loop pattern's leaves are defs, ITER a use.
+ *   - `match` arm patterns bind their leaves; `if let` / `while let` patterns bind.
+ *   - parameters (incl. `mut`, typed, closure params) are `param`-kind defs.
+ * EXCLUDED, deliberately (TypeScript-CFA precedent): field / index writes
+ * (`obj.f = …`, `arr[i] = …`) are NOT scalar defs — their root identifiers are
+ * uses only. Nested-function bodies (`closure_expression`, an inner
+ * `function_item`) are opaque in BOTH directions (captured reads/writes invisible).
+ *
+ * MAY-DEFS: a def inside a conditionally-evaluated subexpression — the right
+ * operand of `&&` / `||` short-circuit, and a match-arm guard / `if let` pattern
+ * test — is a may-def (gen WITHOUT kill), so the not-taken path's prior def is
+ * not falsely killed. (Rust assignment is an expression but yields `()`, so an
+ * in-`&&` assignment is rare; the machinery is kept for guard / case-test parity.)
+ *
+ * Identifiers with no in-function declaration (module items, imported names,
+ * constants, enum variants) resolve to a SYNTHETIC module-level binding
+ * (`name@module`), applied identically by def and use harvesting.
+ *
+ * NOTE: nothing serialized here may carry a field named `nodeId` — the durable
+ * parsedfile-store reviver dedups objects keyed on that field name.
+ */
+import type { SyntaxNode } from '../../utils/ast-helpers.js';
+import type { BindingEntry, StatementFacts } from '../types.js';
+import { DefUseAccumulator as FactAccumulator } from './call-site-harvest.js';
+
+/** Node types that own a nested CFG — their subtrees are opaque to harvesting. */
+const NESTED_FUNCTION_TYPES = new Set(['function_item', 'closure_expression']);
+
+/** Pattern containers whose identifier leaves are binding targets. */
+const PATTERN_CONTAINER_TYPES = new Set([
+  'tuple_pattern',
+  'slice_pattern',
+  'or_pattern',
+  'reference_pattern',
+]);
+
+export class RustHarvester {
+  private readonly bindings: BindingEntry[] = [];
+  /** Single function-scope name → binding index (v1: no block scope). */
+  private readonly table = new Map<string, number>();
+  private readonly synthetic = new Map<string, number>();
+  private readonly fnId: number;
+  /** >0 while walking a conditionally-evaluated subexpression — defs become may-defs. */
+  private conditionalDepth = 0;
+
+  constructor(private readonly fnNode: SyntaxNode) {
+    this.fnId = fnNode.id;
+    this.declareParams(fnNode);
+    const body = this.bodyOf(fnNode);
+    if (body) this.prescan(body);
+  }
+
+  /** The completed binding table — pass to `CfgBuilder.finish`. */
+  bindingTable(): readonly BindingEntry[] {
+    return this.bindings;
+  }
+
+  /** The function/closure body node (a `block` for a fn, block-or-expr for a closure). */
+  private bodyOf(fnNode: SyntaxNode): SyntaxNode | undefined {
+    return fnNode.childForFieldName('body') ?? undefined;
+  }
+
+  // ── phase 1: declaration pre-scan ────────────────────────────────────────
+
+  private declare(nameNode: SyntaxNode, kind: BindingEntry['kind']): void {
+    const name = nameNode.text;
+    if (!name || name === '_' || this.table.has(name)) return;
+    this.table.set(name, this.bindings.length);
+    this.bindings.push({
+      name,
+      declLine: nameNode.startPosition.row + 1,
+      declColumn: nameNode.startPosition.column,
+      kind,
+    });
+  }
+
+  /** Declare every parameter binder of a fn / closure (incl. `mut`, typed). */
+  private declareParams(fnNode: SyntaxNode): void {
+    const params =
+      fnNode.childForFieldName('parameters') ??
+      fnNode.namedChildren.find((c) => c.type === 'parameters' || c.type === 'closure_parameters');
+    if (!params) return;
+    for (let i = 0; i < params.namedChildCount; i++) {
+      const p = params.namedChild(i);
+      if (!p) continue;
+      if (p.type === 'parameter') {
+        const pat = p.childForFieldName('pattern');
+        if (pat) this.declarePattern(pat, 'param');
+      } else if (p.type === 'self_parameter') {
+        // `&self` / `self` — bind `self` so reads of it resolve to a real
+        // binding rather than a synthetic module name.
+        const id = p.namedChildren.find((c) => c.type === 'self');
+        if (id) this.declare(id, 'param');
+      } else if (p.type === 'identifier') {
+        // Bare closure param `|x|`.
+        this.declare(p, 'param');
+      } else {
+        // Typed closure param without the `parameter` wrapper, etc.
+        this.declarePattern(p, 'param');
+      }
+    }
+  }
+
+  /**
+   * Pre-scan the function body once, declaring every bound name. Recurses into
+   * compound expressions but NOT into nested `function_item` / `closure_expression`
+   * bodies (opaque).
+   */
+  private prescan(node: SyntaxNode): void {
+    const t = node.type;
+    if (NESTED_FUNCTION_TYPES.has(t) && node.id !== this.fnId) return;
+
+    switch (t) {
+      case 'let_declaration': {
+        const pat = node.childForFieldName('pattern');
+        if (pat) this.declarePattern(pat, 'let');
+        break;
+      }
+      case 'for_expression': {
+        const pat = node.childForFieldName('pattern');
+        if (pat) this.declarePattern(pat, 'let');
+        break;
+      }
+      case 'let_condition': {
+        // `if let PAT = …` / `while let PAT = …`.
+        const pat = node.childForFieldName('pattern');
+        if (pat) this.declarePattern(pat, 'let');
+        break;
+      }
+      case 'match_arm': {
+        const pat = node.childForFieldName('pattern');
+        if (pat) this.declarePattern(pat, 'let');
+        break;
+      }
+      default:
+        break;
+    }
+
+    for (let i = 0; i < node.namedChildCount; i++) {
+      const c = node.namedChild(i);
+      if (c) this.prescan(c);
+    }
+  }
+
+  /**
+   * Declare every identifier leaf of a binding pattern. Handles the full Rust
+   * pattern taxonomy: tuple / slice / struct / tuple-struct / ref / mut /
+   * captured (`@`) / or patterns. A `tuple_struct_pattern`'s `type` field is the
+   * variant PATH (`Some`, `Ok`) — not a binding; only its inner patterns bind.
+   * `_`, literals and range patterns bind nothing.
+   */
+  private declarePattern(pat: SyntaxNode, kind: BindingEntry['kind']): void {
+    const t = pat.type;
+    if (t === 'identifier') {
+      this.declare(pat, kind);
+      return;
+    }
+    if (t === '_') return; // standalone wildcard pattern is the `_` node
+    if (t === 'match_pattern') {
+      // The arm pattern wrapper — declare its (non-guard) sub-patterns. The
+      // guard `if cond` is a value test, not a binder.
+      const guard = pat.childForFieldName('condition');
+      for (let i = 0; i < pat.namedChildCount; i++) {
+        const c = pat.namedChild(i);
+        if (c && c.id !== guard?.id) this.declarePattern(c, kind);
+      }
+      return;
+    }
+    if (PATTERN_CONTAINER_TYPES.has(t)) {
+      for (let i = 0; i < pat.namedChildCount; i++) {
+        const c = pat.namedChild(i);
+        if (c) this.declarePattern(c, kind);
+      }
+      return;
+    }
+    if (t === 'tuple_struct_pattern') {
+      // `Some(n)` / `Ok(v)` — the `type` field is the variant path (not a binder);
+      // every other named child is an inner binding pattern.
+      const typeNode = pat.childForFieldName('type');
+      for (let i = 0; i < pat.namedChildCount; i++) {
+        const c = pat.namedChild(i);
+        if (c && c.id !== typeNode?.id) this.declarePattern(c, kind);
+      }
+      return;
+    }
+    if (t === 'struct_pattern') {
+      // `Point { x, y }` — each `field_pattern` binds; shorthand `x` binds `x`,
+      // `x: pat` binds `pat`'s leaves. The `type` field is the struct path.
+      for (let i = 0; i < pat.namedChildCount; i++) {
+        const c = pat.namedChild(i);
+        if (!c) continue;
+        if (c.type === 'field_pattern') {
+          this.declareFieldPattern(c, kind);
+        } else if (c.type === 'shorthand_field_identifier') {
+          this.declare(c, kind);
+        }
+      }
+      return;
+    }
+    if (t === 'ref_pattern' || t === 'mut_pattern' || t === 'reference_pattern') {
+      // `ref r` / `mut m` / `&p` — unwrap to the inner pattern.
+      for (let i = 0; i < pat.namedChildCount; i++) {
+        const c = pat.namedChild(i);
+        if (c && c.type !== 'mutable_specifier') this.declarePattern(c, kind);
+      }
+      return;
+    }
+    if (t === 'captured_pattern') {
+      // `v @ subpat` — `v` binds AND the subpattern's leaves bind.
+      for (let i = 0; i < pat.namedChildCount; i++) {
+        const c = pat.namedChild(i);
+        if (c) this.declarePattern(c, kind);
+      }
+      return;
+    }
+    // range_pattern / literal patterns / scoped paths bind nothing.
+  }
+
+  /** `field_pattern` — shorthand `x` binds `x`; `x: pat` binds `pat`'s leaves. */
+  private declareFieldPattern(field: SyntaxNode, kind: BindingEntry['kind']): void {
+    const name = field.childForFieldName('name');
+    const pattern = field.childForFieldName('pattern');
+    if (pattern) {
+      this.declarePattern(pattern, kind);
+      return;
+    }
+    if (name && name.type === 'shorthand_field_identifier') {
+      this.declare(name, kind);
+      return;
+    }
+    // Fallback: declare any identifier / shorthand leaf.
+    for (let i = 0; i < field.namedChildCount; i++) {
+      const c = field.namedChild(i);
+      if (c?.type === 'shorthand_field_identifier' || c?.type === 'identifier')
+        this.declare(c, kind);
+    }
+  }
+
+  // ── phase 2: per-statement fact extraction ───────────────────────────────
+
+  /** Def/use facts for one statement (or construct-header expression) node. */
+  facts(node: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(node.startPosition.row + 1);
+    this.walkValue(node, acc);
+    return acc.finish();
+  }
+
+  /** Facts for an expression whose WHOLE evaluation is conditional (guards/tests). */
+  factsConditional(node: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(node.startPosition.row + 1);
+    this.conditional(() => this.walkValue(node, acc));
+    return acc.finish();
+  }
+
+  /**
+   * Facts for a `for PAT in ITER` head: the loop pattern's leaves are defs, the
+   * iterated expression a use.
+   */
+  forHeadFacts(stmt: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(stmt.startPosition.row + 1);
+    const value = stmt.childForFieldName('value');
+    const pat = stmt.childForFieldName('pattern');
+    if (value) this.walkValue(value, acc);
+    if (pat) this.defPattern(pat, acc);
+    return acc.finish();
+  }
+
+  /**
+   * Facts for ONLY a `let_declaration`'s PATTERN bindings (no value walk) — used
+   * when the value is a control-flow expression already harvested by the visitor,
+   * so the binding defs land on a separate continuation block without
+   * double-counting the value's uses.
+   */
+  letPatternFacts(stmt: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(stmt.startPosition.row + 1);
+    const pat = stmt.childForFieldName('pattern');
+    if (pat) this.defPattern(pat, acc);
+    return acc.finish();
+  }
+
+  /**
+   * Facts for a `let PAT = VALUE` condition (`if let` / `while let`): the value
+   * is a use, the pattern's leaves are defs. When `conditional` is true the defs
+   * become may-defs (a `while let` re-test may not bind on the exit iteration).
+   */
+  letConditionFacts(cond: SyntaxNode, conditional: boolean): StatementFacts {
+    const acc = new FactAccumulator(cond.startPosition.row + 1);
+    const run = (): void => {
+      const value = cond.childForFieldName('value');
+      const pat = cond.childForFieldName('pattern');
+      if (value) this.walkValue(value, acc);
+      if (pat) this.defPattern(pat, acc);
+    };
+    if (conditional) this.conditional(run);
+    else run();
+    return acc.finish();
+  }
+
+  /**
+   * Facts for a `match` arm's PATTERN bindings (#2206): `Some(n) => …` binds `n`
+   * from the matched subject. The bindings are MAY-defs (only the arm that
+   * actually matches binds; a later arm tests only when earlier ones didn't) and
+   * are attached to the dispatch block, co-located with the subject's use, so a
+   * tainted subject can propagate to the arm binding. The guard is skipped by
+   * {@link defPattern}'s `match_pattern` handling. `undefined` when the pattern
+   * binds nothing (`_`, a literal, a unit variant).
+   */
+  matchArmPatternFacts(arm: SyntaxNode): StatementFacts | undefined {
+    const acc = new FactAccumulator(arm.startPosition.row + 1);
+    const pat = arm.childForFieldName('pattern');
+    if (pat) this.conditional(() => this.defPattern(pat, acc));
+    return acc.defCount() ? acc.finish() : undefined;
+  }
+
+  /** ENTRY-block facts for the parameters (defs only — incl. default-position uses). */
+  paramFacts(): StatementFacts | undefined {
+    const params =
+      this.fnNode.childForFieldName('parameters') ??
+      this.fnNode.namedChildren.find(
+        (c) => c.type === 'parameters' || c.type === 'closure_parameters',
+      );
+    if (!params) return undefined;
+    const acc = new FactAccumulator(this.fnNode.startPosition.row + 1);
+    for (let i = 0; i < params.namedChildCount; i++) {
+      const p = params.namedChild(i);
+      if (!p) continue;
+      if (p.type === 'parameter') {
+        const pat = p.childForFieldName('pattern');
+        if (pat) this.defPattern(pat, acc);
+      } else if (p.type === 'self_parameter') {
+        const id = p.namedChildren.find((c) => c.type === 'self');
+        if (id) this.def(id, acc);
+      } else if (p.type === 'identifier') {
+        this.def(p, acc);
+      } else {
+        this.defPattern(p, acc);
+      }
+    }
+    return acc.defCount() ? acc.finish() : undefined;
+  }
+
+  private resolve(nameNode: SyntaxNode): number {
+    const name = nameNode.text;
+    const idx = this.table.get(name);
+    if (idx !== undefined) return idx;
+    let syn = this.synthetic.get(name);
+    if (syn === undefined) {
+      syn = this.bindings.length;
+      this.synthetic.set(name, syn);
+      this.bindings.push({ name, declLine: 0, declColumn: 0, kind: 'module', synthetic: true });
+    }
+    return syn;
+  }
+
+  private def(nameNode: SyntaxNode, acc: FactAccumulator): void {
+    if (nameNode.text === '_') return; // blank target defines nothing
+    if (this.conditionalDepth > 0) acc.addMayDef(this.resolve(nameNode));
+    else acc.addDef(this.resolve(nameNode));
+  }
+
+  private use(nameNode: SyntaxNode, acc: FactAccumulator): void {
+    if (nameNode.text === '_') return;
+    acc.addUse(this.resolve(nameNode));
+  }
+
+  /** Run `fn` with defs demoted to may-defs (conditionally-evaluated context). */
+  private conditional(fn: () => void): void {
+    this.conditionalDepth++;
+    try {
+      fn();
+    } finally {
+      this.conditionalDepth--;
+    }
+  }
+
+  /**
+   * Def each identifier leaf of a binding pattern (the def-position analogue of
+   * {@link declarePattern}). A `tuple_struct_pattern`'s `type` field path is a
+   * variant name, not a def; its inner patterns bind. A struct field shorthand
+   * binds; `_` binds nothing.
+   */
+  private defPattern(pat: SyntaxNode, acc: FactAccumulator): void {
+    const t = pat.type;
+    if (t === 'identifier') {
+      this.def(pat, acc);
+      return;
+    }
+    if (t === '_') return; // standalone wildcard pattern is the `_` node
+    if (t === 'match_pattern') {
+      const guard = pat.childForFieldName('condition');
+      for (let i = 0; i < pat.namedChildCount; i++) {
+        const c = pat.namedChild(i);
+        if (c && c.id !== guard?.id) this.defPattern(c, acc);
+      }
+      return;
+    }
+    if (PATTERN_CONTAINER_TYPES.has(t)) {
+      for (let i = 0; i < pat.namedChildCount; i++) {
+        const c = pat.namedChild(i);
+        if (c) this.defPattern(c, acc);
+      }
+      return;
+    }
+    if (t === 'tuple_struct_pattern') {
+      const typeNode = pat.childForFieldName('type');
+      for (let i = 0; i < pat.namedChildCount; i++) {
+        const c = pat.namedChild(i);
+        if (c && c.id !== typeNode?.id) this.defPattern(c, acc);
+      }
+      return;
+    }
+    if (t === 'struct_pattern') {
+      for (let i = 0; i < pat.namedChildCount; i++) {
+        const c = pat.namedChild(i);
+        if (!c) continue;
+        if (c.type === 'field_pattern') this.defFieldPattern(c, acc);
+        else if (c.type === 'shorthand_field_identifier') this.def(c, acc);
+      }
+      return;
+    }
+    if (t === 'ref_pattern' || t === 'mut_pattern' || t === 'reference_pattern') {
+      for (let i = 0; i < pat.namedChildCount; i++) {
+        const c = pat.namedChild(i);
+        if (c && c.type !== 'mutable_specifier') this.defPattern(c, acc);
+      }
+      return;
+    }
+    if (t === 'captured_pattern') {
+      for (let i = 0; i < pat.namedChildCount; i++) {
+        const c = pat.namedChild(i);
+        if (c) this.defPattern(c, acc);
+      }
+      return;
+    }
+    // range / literal / scoped path — binds nothing.
+  }
+
+  private defFieldPattern(field: SyntaxNode, acc: FactAccumulator): void {
+    const name = field.childForFieldName('name');
+    const pattern = field.childForFieldName('pattern');
+    if (pattern) {
+      this.defPattern(pattern, acc);
+      return;
+    }
+    if (name && name.type === 'shorthand_field_identifier') {
+      this.def(name, acc);
+      return;
+    }
+    for (let i = 0; i < field.namedChildCount; i++) {
+      const c = field.namedChild(i);
+      if (c?.type === 'shorthand_field_identifier' || c?.type === 'identifier') this.def(c, acc);
+    }
+  }
+
+  /** Value-position walk: collect uses; route def positions to the pattern handler. */
+  private walkValue(node: SyntaxNode, acc: FactAccumulator): void {
+    const t = node.type;
+    if (NESTED_FUNCTION_TYPES.has(t) && node.id !== this.fnId) return; // opaque
+
+    switch (t) {
+      case 'identifier':
+        this.use(node, acc);
+        return;
+      case 'let_declaration': {
+        const value = node.childForFieldName('value');
+        const pat = node.childForFieldName('pattern');
+        const alt = node.childForFieldName('alternative'); // `let … else { … }`
+        if (value) this.walkValue(value, acc);
+        if (alt) this.walkValue(alt, acc);
+        if (pat) this.defPattern(pat, acc);
+        return;
+      }
+      case 'let_condition': {
+        const value = node.childForFieldName('value');
+        const pat = node.childForFieldName('pattern');
+        if (value) this.walkValue(value, acc);
+        if (pat) this.defPattern(pat, acc);
+        return;
+      }
+      case 'assignment_expression': {
+        const left = node.childForFieldName('left');
+        const right = node.childForFieldName('right');
+        if (right) this.walkValue(right, acc);
+        if (left) {
+          if (left.type === 'identifier') {
+            this.def(left, acc);
+          } else {
+            // field / index lvalue (`obj.f = …`, `a[i] = …`) — root is a use only.
+            this.walkValue(left, acc);
+          }
+        }
+        return;
+      }
+      case 'compound_assignment_expr': {
+        const left = node.childForFieldName('left');
+        const right = node.childForFieldName('right');
+        if (right) this.walkValue(right, acc);
+        if (left) {
+          if (left.type === 'identifier') {
+            this.use(left, acc);
+            this.def(left, acc);
+          } else {
+            this.walkValue(left, acc);
+          }
+        }
+        return;
+      }
+      case 'binary_expression': {
+        const left = node.childForFieldName('left');
+        const right = node.childForFieldName('right');
+        const op = node.childForFieldName('operator')?.text ?? '';
+        if (left) this.walkValue(left, acc);
+        if (right) {
+          if (op === '&&' || op === '||') this.conditional(() => this.walkValue(right, acc));
+          else this.walkValue(right, acc);
+        }
+        return;
+      }
+      case 'field_expression': {
+        // `a.b` — value read of the chain root only; the field name is not a
+        // scalar binding.
+        const value = node.childForFieldName('value');
+        if (value) this.walkValue(value, acc);
+        return;
+      }
+      default:
+        for (let i = 0; i < node.namedChildCount; i++) {
+          const c = node.namedChild(i);
+          if (c) this.walkValue(c, acc);
+        }
+    }
+  }
+}
diff --git a/gitnexus/src/core/ingestion/cfg/visitors/rust.ts b/gitnexus/src/core/ingestion/cfg/visitors/rust.ts
new file mode 100644
index 000000000..fe952d14b
--- /dev/null
+++ b/gitnexus/src/core/ingestion/cfg/visitors/rust.ts
@@ -0,0 +1,730 @@
+/**
+ * Rust CfgVisitor (#2195 U7) — the EXPRESSION-ORIENTED CFG target. Unlike the
+ * C-family / Go / Python visitors (statement languages), Rust control flow is
+ * built from EXPRESSIONS: `if` / `loop` / `while` / `for` / `match` / `block`
+ * are all expressions that produce a value. The visitor still drives the
+ * language-agnostic {@link CfgBuilder} to produce a serializable
+ * {@link FunctionCfg} plus a def/use harvest ({@link RustHarvester}) for the
+ * reaching-defs / CDG solvers, structured like the sibling visitors — a
+ * `visit_<node_type>` dispatch over the control-flow taxonomy driving a
+ * per-function {@link ControlFlowContext} for labeled break/continue.
+ *
+ * Every node type and field literal below was grammar-validated against
+ * tree-sitter-rust via the introspection probe before use (mandatory pre-step).
+ * Rust shapes pre-empted (verified by a real parse):
+ *  - functions: `function_item` (fields `name`/`parameters`/`return_type`/`body`;
+ *    a method is a `function_item` inside an `impl_item`'s `declaration_list`)
+ *    and `closure_expression` (field `parameters`=`closure_parameters`; `body` is
+ *    a `block` OR a bare expression — `|x| x + 1`).
+ *  - `if_expression` fields `condition` / `consequence` (a `block`) /
+ *    `alternative` (an `else_clause` wrapping a `block` or a nested
+ *    `if_expression` of an `else if`). The condition can be a `let_condition`
+ *    (`if let PAT = e`) or a `let_chain` (`if let PAT = e && cond`).
+ *  - `loop_expression` field `body` — the INFINITE loop (NO `condition` field);
+ *    an optional `label` NAMED CHILD (label is NOT a field). The key
+ *    non-terminating case.
+ *  - `while_expression` fields `condition` (may be a `let_condition` for
+ *    `while let`) / `body`; optional `label` named child.
+ *  - `for_expression` fields `pattern` / `value` / `body`; optional `label`
+ *    named child.
+ *  - `match_expression` fields `value` / `body` (a `match_block` of `match_arm`s).
+ *    A `match_arm` has field `pattern` (a `match_pattern`, which may carry an `if`
+ *    guard with field `condition`) and field `value` (the arm body — an
+ *    expression or a `block`). Arms do NOT fall through.
+ *  - `break_expression` — optional `label` named child AND an optional value
+ *    expression (`break 'a 42`). `continue_expression` — optional `label`.
+ *  - `return_expression` — optional value child. `try_expression` (`expr?`) —
+ *    the early-return operator.
+ *  - a `label` node's bare name is its `identifier` child's text (`'outer`'s name
+ *    is `outer`), matching `break 'outer` / `continue 'outer`.
+ *
+ * Edge-kind contract (matches the existing visitors — RD/CDG consume these):
+ *  - if / else (incl. `if let`) → `cond-true` / `cond-false`
+ *  - `loop {}` (no condition) → `loop-back` (body re-enters) PLUS a structural
+ *    `cond-false` escape edge (header → loopExit) so EXIT stays reverse-reachable
+ *  - `while` / `while let` / `for` → `cond-true` / `loop-back` / `cond-false`
+ *  - `match` dispatch → `switch-case` (NO fallthrough — like Go / Python)
+ *  - `break` / `continue` / `return` → the matching terminator kind; a labeled
+ *    `break 'outer` / `continue 'outer` targets the labeled loop frame; a
+ *    `break value` is still a `break` edge
+ *  - the `?` operator (`try_expression`) → `throw` — an early error-return edge to
+ *    EXIT from the `?` site (a conservative throw-like edge; the Err/None path)
+ *  - straight-line → `seq`
+ *
+ * Rust-specific modeling decisions (documented approximations):
+ *  - `loop {}` is the canonical Rust infinite loop with NO condition. We ALWAYS
+ *    emit a structural `header → loopExit` escape edge (exactly as the C-family /
+ *    Go visitors do for `while(true)` / `for {}`), so EXIT stays reverse-reachable
+ *    and the post-dominator / CDG pass is not silently skipped for the function.
+ *    This is the single highest-risk correctness property. A `loop {}` that
+ *    DOES `break` also reaches EXIT via the break; the structural escape edge is
+ *    emitted either way.
+ *  - the `?` operator desugars to a `match` that returns the Err/None early. We
+ *    model it conservatively as a `throw` edge to the function EXIT from the block
+ *    that contains the `?` — so the post-`?` continuation stays reachable (the Ok
+ *    path) AND the early-exit path is represented. Multiple `?` in one block emit
+ *    one early-exit edge per `?`-bearing block (deduped by the builder).
+ *  - a closure (`closure_expression`) is collected as its OWN function by
+ *    `isFunction`, so its body gets a standalone CFG; in the ENCLOSING function it
+ *    is an opaque straight-line value (its body is not followed inline), exactly
+ *    as the Go visitor treats a spawned closure and the TS visitor an arrow body.
+ *  - the trailing tail expression of a `block` (no `;`) is the block's value; for
+ *    control-flow purposes it just falls off normally to the block's successor.
+ *
+ * Known limitations:
+ *  - panic: a `panic!()` (or an out-of-bounds index, an `unwrap` on `None`) aborts
+ *    the function abnormally, but tree-sitter sees only a normal macro/method call.
+ *    The panic-unwind path is NOT modeled (documented gap, not faked) — Rust has
+ *    no try/catch, so there is no handler structure to route to.
+ *  - async (`async fn`, `.await`): the suspension points are modeled as normal
+ *    straight-line control flow (no scheduler edges).
+ *  - block scope + shadowing in the def/use harvest is flattened to one function
+ *    table (see rust-harvest.ts) — a documented v1 over-approximation.
+ *  - macro bodies (`println!`, `vec!`, custom macros) are opaque token trees — any
+ *    control flow expanded by a macro is invisible.
+ *
+ * Returns `undefined` (never throws) for an AST shape it cannot model, so a
+ * malformed function never drops the whole file's CFG group (R4).
+ */
+import type { SyntaxNode } from '../../utils/ast-helpers.js';
+import { CfgBuilder } from '../cfg-builder.js';
+import { ControlFlowContext, wireJumpThroughFinalizers } from '../control-flow-context.js';
+import type { TraversalResult } from '../traversal-result.js';
+import type { CfgVisitor, FunctionCfg } from '../types.js';
+import { RustHarvester } from './rust-harvest.js';
+
+/** Rust node types that own a CFG-bearing function body. */
+const RUST_FUNCTION_TYPES = new Set(['function_item', 'closure_expression']);
+
+/**
+ * Expression / statement node types that break a basic block (everything else
+ * coalesces). `expression_statement` is the `<expr>;` wrapper; the control-flow
+ * EXPRESSIONS inside it are unwrapped by {@link visitStmt}.
+ */
+const CONTROL_FLOW_TYPES = new Set([
+  'expression_statement',
+  'if_expression',
+  'loop_expression',
+  'while_expression',
+  'for_expression',
+  'match_expression',
+  'return_expression',
+  'break_expression',
+  'continue_expression',
+  'block',
+]);
+
+/** Expression node types that the statement walker treats as control-flow. */
+const CONTROL_FLOW_EXPR_TYPES = new Set([
+  'if_expression',
+  'loop_expression',
+  'while_expression',
+  'for_expression',
+  'match_expression',
+  'return_expression',
+  'break_expression',
+  'continue_expression',
+  'block',
+]);
+
+/** Node types whose subtrees are opaque (a nested function owns its own CFG). */
+const NESTED_FUNCTION_TYPES = new Set(['function_item', 'closure_expression']);
+
+/** Rust comment node types — line (`//`) and block (slash-star) comments. */
+const COMMENT_TYPES = new Set(['line_comment', 'block_comment']);
+const isNotComment = (n: SyntaxNode): boolean => !COMMENT_TYPES.has(n.type);
+
+const startLineOf = (n: SyntaxNode): number => n.startPosition.row + 1;
+const endLineOf = (n: SyntaxNode): number => n.endPosition.row + 1;
+
+/** A statement sequence that produced no blocks (empty body) is "transparent". */
+type SeqResult = TraversalResult | null;
+
+/**
+ * Per-function Rust walk state. One instance per function so the
+ * {@link ControlFlowContext} and label tables are scoped to that function and
+ * never leak across functions.
+ */
+class RustCfgWalk {
+  private readonly cfc = new ControlFlowContext();
+
+  constructor(
+    private readonly builder: CfgBuilder,
+    private readonly harvest: RustHarvester,
+  ) {}
+
+  /** Statements of a `block`, ignoring comments. */
+  private statementsOf(block: SyntaxNode): SyntaxNode[] {
+    return block.namedChildren.filter(isNotComment);
+  }
+
+  /** The `body` of a node (a `block`, or a bare expression for a closure / arm). */
+  private bodyOf(node: SyntaxNode): SyntaxNode | undefined {
+    return node.childForFieldName('body') ?? undefined;
+  }
+
+  /** Visit a body that may be a `block` or a single expression. */
+  private visitBody(node: SyntaxNode | undefined | null): SeqResult {
+    return this.builder.withNesting(() => {
+      if (!node) return null;
+      if (node.type === 'block') return this.visitSeq(this.statementsOf(node));
+      return this.visitStmt(node);
+    });
+  }
+
+  /** Wire a sequence of statements, coalescing straight-line runs into blocks. */
+  visitSeq(stmts: SyntaxNode[]): SeqResult {
+    return this.builder.withNesting(() => {
+      let entry: number | undefined;
+      let dangling: number[] = [];
+      let openSimple: number | undefined;
+
+      for (const stmt of stmts) {
+        if (this.isControlFlow(stmt)) {
+          openSimple = undefined; // close any open straight-line block
+          const res = this.visitStmt(stmt);
+          if (res === null) continue; // transparent (empty nested block)
+          if (entry === undefined) entry = res.entry;
+          else this.builder.connect(dangling, res.entry, 'seq');
+          dangling = [...res.exits];
+        } else {
+          const idx =
+            openSimple === undefined ? this.openBlock(stmt) : this.extendOpen(openSimple, stmt);
+          if (openSimple === undefined) {
+            if (entry === undefined) entry = idx;
+            else this.builder.connect(dangling, idx, 'seq');
+            dangling = [idx];
+          }
+          openSimple = idx;
+          // A straight-line statement that contains a `?` early-returns to EXIT.
+          this.wireTryExits(stmt, idx);
+        }
+      }
+
+      if (entry === undefined) return null;
+      return { entry, exits: dangling };
+    });
+  }
+
+  private openBlock(stmt: SyntaxNode): number {
+    return this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+  }
+
+  private extendOpen(open: number, stmt: SyntaxNode): number {
+    this.builder.extendBlock(open, endLineOf(stmt), stmt.text, this.harvest.facts(stmt));
+    return open;
+  }
+
+  /** Whether a statement node breaks the current straight-line block. */
+  private isControlFlow(stmt: SyntaxNode): boolean {
+    if (stmt.type === 'expression_statement') {
+      const inner = this.exprStmtInner(stmt);
+      return inner ? CONTROL_FLOW_EXPR_TYPES.has(inner.type) : false;
+    }
+    if (stmt.type === 'let_declaration') {
+      // `let v = loop {…}` / `let w = if c {…} else {…}` / `let PAT = e else {…}`
+      // — the value is a control-flow EXPRESSION, or the let-else alternative
+      // block is divergent; either way the let must be modeled structurally.
+      const value = stmt.childForFieldName('value');
+      const alt = stmt.childForFieldName('alternative');
+      return (value !== null && CONTROL_FLOW_EXPR_TYPES.has(value.type)) || alt !== null;
+    }
+    return CONTROL_FLOW_TYPES.has(stmt.type);
+  }
+
+  /** The inner expression of an `expression_statement` (`if x {…};`). */
+  private exprStmtInner(stmt: SyntaxNode): SyntaxNode | undefined {
+    return stmt.namedChildren.find(isNotComment);
+  }
+
+  /** Dispatch one statement to its handler. Non-null except for empty blocks. */
+  visitStmt(stmt: SyntaxNode): SeqResult {
+    // Unwrap an `expression_statement` to its control-flow expression.
+    if (stmt.type === 'expression_statement') {
+      const inner = this.exprStmtInner(stmt);
+      if (inner && CONTROL_FLOW_EXPR_TYPES.has(inner.type)) return this.visitStmt(inner);
+      return this.visitSimple(stmt);
+    }
+    if (stmt.type === 'let_declaration') return this.visitLet(stmt);
+    switch (stmt.type) {
+      case 'if_expression':
+        return this.visitIf(stmt);
+      case 'loop_expression':
+        return this.visitLoop(stmt);
+      case 'while_expression':
+        return this.visitWhile(stmt);
+      case 'for_expression':
+        return this.visitFor(stmt);
+      case 'match_expression':
+        return this.visitMatch(stmt);
+      case 'return_expression':
+        return this.visitReturn(stmt);
+      case 'break_expression':
+        return this.visitBreak(stmt);
+      case 'continue_expression':
+        return this.visitContinue(stmt);
+      case 'block':
+        return this.visitSeq(this.statementsOf(stmt));
+      default:
+        return this.visitSimple(stmt);
+    }
+  }
+
+  private visitSimple(stmt: SyntaxNode): TraversalResult {
+    const idx = this.openBlock(stmt);
+    this.wireTryExits(stmt, idx);
+    return { entry: idx, exits: [idx] };
+  }
+
+  /**
+   * `let PAT = VALUE [else { ALT }]` whose VALUE is a control-flow expression
+   * (`let v = loop {…}`, `let w = if c {…} else {…}`, `let m = match …`) or which
+   * has a divergent let-else ALT block. A plain `let x = e;` never reaches here
+   * (it coalesces into a straight-line block in {@link visitSeq}).
+   *
+   * The value's control-flow construct is visited as a sub-CFG; the let-pattern's
+   * bindings are defs that happen on the value's NORMAL completion — attached to a
+   * facts-only continuation block the value's exits feed. For a `let … else`, the
+   * ALT block runs on the refutable-failure path and (per Rust's rules) MUST
+   * diverge (return/break/continue/panic); it is visited as control flow, so its
+   * own jumps wire directly to their targets and it contributes no normal exit.
+   */
+  private visitLet(stmt: SyntaxNode): TraversalResult {
+    const value = stmt.childForFieldName('value');
+    const alt = stmt.childForFieldName('alternative');
+    const cfValue = value !== null && CONTROL_FLOW_EXPR_TYPES.has(value.type);
+
+    let entry: number;
+    let normalExits: number[];
+    if (cfValue && value) {
+      // `let v = loop {…}` — the value is a control-flow construct: visit it, then
+      // attach ONLY the pattern's binding defs to a facts-only continuation (the
+      // value's uses are already harvested onto its own blocks).
+      const valueRes = this.visitStmt(value);
+      const cont = this.builder.newBlock(
+        startLineOf(stmt),
+        startLineOf(stmt),
+        '',
+        'normal',
+        this.harvest.letPatternFacts(stmt),
+      );
+      this.builder.connect(valueRes?.exits ?? [], cont, 'seq');
+      entry = valueRes ? valueRes.entry : cont;
+      normalExits = [cont];
+    } else {
+      // A simple-value `let PAT = e [else {…}]` — ONE block with the whole let's
+      // facts (value uses + pattern defs). It reaches here only via the let-else
+      // alternative (a plain `let x = e;` coalesces in visitSeq).
+      const idx = this.openBlock(stmt);
+      this.wireTryExits(stmt, idx);
+      entry = idx;
+      normalExits = [idx];
+    }
+
+    // `let … else { … }` — the else block runs on the binding-FAILURE path and
+    // (per Rust) MUST diverge (return/break/continue/panic); visit it as control
+    // flow so its jumps wire themselves to their targets. It is NOT on the normal
+    // continuation — branched from the binding site with a `cond-false` (refute)
+    // edge.
+    if (alt) {
+      const altRes = this.visitBody(alt);
+      if (altRes) this.builder.connect(normalExits, altRes.entry, 'cond-false');
+    }
+
+    return { entry, exits: normalExits };
+  }
+
+  /**
+   * Emit a `throw` (early-return) edge to EXIT for every `?` operator inside a
+   * straight-line statement's subtree (excluding nested function bodies). The
+   * `?` desugars to "return Err(...) early"; modeling it as a throw-like edge to
+   * EXIT keeps the early-exit path represented while the Ok path falls through
+   * normally. Deduped by the builder, so repeated `?` in a block emit one edge.
+   */
+  private wireTryExits(stmt: SyntaxNode, fromBlock: number): void {
+    if (this.containsTry(stmt)) this.builder.edge(fromBlock, this.builder.exitIndex, 'throw');
+  }
+
+  private containsTry(node: SyntaxNode): boolean {
+    if (node.type === 'try_expression') return true;
+    if (NESTED_FUNCTION_TYPES.has(node.type)) return false; // opaque
+    for (let i = 0; i < node.namedChildCount; i++) {
+      const c = node.namedChild(i);
+      if (c && this.containsTry(c)) return true;
+    }
+    return false;
+  }
+
+  /** `return [expr]` — direct edge to the function EXIT. */
+  private visitReturn(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    // A `return f()?;` early-returns on the `?` path too.
+    this.wireTryExits(stmt, idx);
+    this.builder.edge(idx, this.builder.exitIndex, 'return');
+    return { entry: idx, exits: [] };
+  }
+
+  /**
+   * `break ['label] [value]` — targets the labeled loop frame if labeled, else the
+   * nearest enclosing loop. `break value` is still a `break` edge (the value is a
+   * normal use harvested onto the block).
+   */
+  private visitBreak(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    this.wireTryExits(stmt, idx);
+    const label = this.jumpLabel(stmt);
+    const res = this.cfc.resolveBreak(label);
+    const { target, finalizers } = res ?? {
+      target: this.builder.exitIndex,
+      finalizers: this.cfc.finalizersForReturn(),
+    };
+    wireJumpThroughFinalizers(this.builder, idx, finalizers, target, 'break');
+    return { entry: idx, exits: [] };
+  }
+
+  /** `continue ['label]` — re-tests the labeled (or nearest) loop header. */
+  private visitContinue(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(startLineOf(stmt), endLineOf(stmt), stmt.text);
+    const label = this.jumpLabel(stmt);
+    const res = this.cfc.resolveContinue(label);
+    const { target, finalizers } = res ?? {
+      target: this.builder.exitIndex,
+      finalizers: this.cfc.finalizersForReturn(),
+    };
+    wireJumpThroughFinalizers(this.builder, idx, finalizers, target, 'continue');
+    return { entry: idx, exits: [] };
+  }
+
+  /** The bare name (`outer`) of a `break`/`continue`'s `'label`, if any. */
+  private jumpLabel(stmt: SyntaxNode): string | undefined {
+    const label = stmt.namedChildren.find((c) => c.type === 'label');
+    return this.labelName(label);
+  }
+
+  /** The bare identifier name of a `label` node (`'outer` ⇒ `outer`). */
+  private labelName(label: SyntaxNode | undefined): string | undefined {
+    if (!label) return undefined;
+    const id = label.namedChildren.find((c) => c.type === 'identifier');
+    return id?.text ?? label.text.replace(/^'/, '');
+  }
+
+  /**
+   * The optional `'label` of a loop expression (a NAMED CHILD, not a field — Rust
+   * attaches the label directly to the loop, unlike Go's `labeled_statement`).
+   */
+  private loopLabels(stmt: SyntaxNode): string[] {
+    const label = stmt.namedChildren.find((c) => c.type === 'label');
+    const name = this.labelName(label);
+    return name !== undefined ? [name] : [];
+  }
+
+  /**
+   * `if COND { … } [else { … } | else if …]`. The condition can be a plain
+   * expression, a `let_condition` (`if let PAT = e`), or a `let_chain`. The header
+   * carries the condition's def/use facts (an `if let` pattern is a def, its value
+   * a use). The else `alternative` is an `else_clause` wrapping a `block` or a
+   * nested `if_expression` (the `else if` chain).
+   */
+  private visitIf(stmt: SyntaxNode): TraversalResult {
+    const cond = stmt.childForFieldName('condition') ?? stmt;
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(cond),
+      cond.text,
+      'normal',
+      this.condFacts(cond, false),
+    );
+    this.wireTryExits(cond, header);
+
+    const exits: number[] = [];
+    const thenRes = this.visitBody(stmt.childForFieldName('consequence'));
+    if (thenRes) {
+      this.builder.edge(header, thenRes.entry, 'cond-true');
+      exits.push(...thenRes.exits);
+    } else {
+      exits.push(header); // empty then — true path falls through
+    }
+
+    const elseNode = this.elseBodyOf(stmt);
+    if (elseNode) {
+      const elseRes = this.visitBody(elseNode);
+      if (elseRes) {
+        this.builder.edge(header, elseRes.entry, 'cond-false');
+        exits.push(...elseRes.exits);
+      } else {
+        exits.push(header);
+      }
+    } else {
+      exits.push(header); // no else — false path falls through to the join
+    }
+
+    return { entry: header, exits: [...new Set(exits)] };
+  }
+
+  /** The else body of an `if_expression` (unwraps the `else_clause` wrapper). */
+  private elseBodyOf(stmt: SyntaxNode): SyntaxNode | undefined {
+    const alt = stmt.childForFieldName('alternative');
+    if (!alt) return undefined;
+    if (alt.type === 'else_clause') {
+      // The clause wraps a `block` or a nested `if_expression` (`else if`).
+      return alt.namedChildren.find(isNotComment);
+    }
+    return alt;
+  }
+
+  /**
+   * `loop { … }` — Rust's INFINITE loop (NO condition). Body exits re-enter the
+   * header (`loop-back`); a `break` reaches `loopExit`. We ALWAYS emit a
+   * structural `header → loopExit` `cond-false` escape edge so EXIT stays
+   * reverse-reachable (a `loop {}` with no break never reaches EXIT otherwise, and
+   * the CDG pass would be silently skipped for the whole function).
+   */
+  private visitLoop(stmt: SyntaxNode): TraversalResult {
+    const labels = this.loopLabels(stmt);
+    const header = this.builder.newBlock(startLineOf(stmt), startLineOf(stmt), 'loop');
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.cfc.pushLoop(header, loopExit, labels);
+    const body = this.visitBody(this.bodyOf(stmt));
+    this.cfc.pop();
+
+    if (body) {
+      this.builder.edge(header, body.entry, 'cond-true');
+      this.builder.connect(body.exits, header, 'loop-back');
+    } else {
+      this.builder.edge(header, header, 'loop-back'); // empty `loop {}` re-enters
+    }
+    // Structural escape edge — keeps EXIT reverse-reachable even for `loop {}`
+    // with no `break` (the canonical Rust non-terminating case).
+    this.builder.edge(header, loopExit, 'cond-false');
+    return { entry: header, exits: [loopExit] };
+  }
+
+  /**
+   * `while COND { … }` (and `while let PAT = e { … }`). Standard loop: header
+   * tests, true → body → loop-back, false → loop exit. The `while let` pattern is
+   * a may-def on the header (the binding does not happen on the exit iteration).
+   */
+  private visitWhile(stmt: SyntaxNode): TraversalResult {
+    const labels = this.loopLabels(stmt);
+    const cond = stmt.childForFieldName('condition') ?? stmt;
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(cond),
+      cond.text,
+      'normal',
+      this.condFacts(cond, true),
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.cfc.pushLoop(header, loopExit, labels);
+    const body = this.visitBody(this.bodyOf(stmt));
+    this.cfc.pop();
+
+    if (body) {
+      this.builder.edge(header, body.entry, 'cond-true');
+      this.builder.connect(body.exits, header, 'loop-back');
+    } else {
+      this.builder.edge(header, header, 'loop-back'); // empty body re-tests
+    }
+    // Structural exit edge — even `while true {}` keeps EXIT reverse-reachable.
+    this.builder.edge(header, loopExit, 'cond-false');
+    return { entry: header, exits: [loopExit] };
+  }
+
+  /**
+   * `for PAT in ITER { … }`. The header binds the loop pattern (a def) and uses
+   * the iterated expression. Standard loop topology.
+   */
+  private visitFor(stmt: SyntaxNode): TraversalResult {
+    const labels = this.loopLabels(stmt);
+    const value = stmt.childForFieldName('value');
+    const headEnd = value ? endLineOf(value) : startLineOf(stmt);
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      headEnd,
+      this.forHeaderText(stmt),
+      'normal',
+      this.harvest.forHeadFacts(stmt),
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.cfc.pushLoop(header, loopExit, labels);
+    const body = this.visitBody(this.bodyOf(stmt));
+    this.cfc.pop();
+
+    if (body) {
+      this.builder.edge(header, body.entry, 'cond-true');
+      this.builder.connect(body.exits, header, 'loop-back');
+    } else {
+      this.builder.edge(header, header, 'loop-back'); // empty body re-iterates
+    }
+    this.builder.edge(header, loopExit, 'cond-false');
+    return { entry: header, exits: [loopExit] };
+  }
+
+  private forHeaderText(stmt: SyntaxNode): string {
+    const pat = stmt.childForFieldName('pattern')?.text ?? '';
+    const value = stmt.childForFieldName('value')?.text ?? '';
+    return pat || value ? `for ${pat} in ${value}` : 'for';
+  }
+
+  /**
+   * `match VALUE { PAT [if guard] => ARM, … }`. Arms do NOT fall through (like
+   * Go / Python). Each arm body is dispatched from the subject block with a
+   * `switch-case` edge; arm bodies rejoin AFTER the match. A `match` with no
+   * irrefutable `_` arm also reaches the join directly (no-match path), keeping
+   * EXIT reverse-reachable.
+   */
+  private visitMatch(stmt: SyntaxNode): TraversalResult {
+    const value = stmt.childForFieldName('value');
+    const dispatch = this.builder.newBlock(
+      startLineOf(stmt),
+      value ? endLineOf(value) : startLineOf(stmt),
+      value ? `match ${value.text}` : 'match',
+      'normal',
+      value ? this.harvest.facts(value) : undefined,
+    );
+    if (value) this.wireTryExits(value, dispatch);
+    const matchExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    const body =
+      stmt.childForFieldName('body') ?? stmt.namedChildren.find((c) => c.type === 'match_block');
+    const arms = body ? body.namedChildren.filter((c) => c.type === 'match_arm') : [];
+
+    // Each arm's pattern bindings (`Some(n) =>`) are MAY-defs from the matched
+    // subject, and a guarded arm (`PAT if g`) evaluates `g` conditionally — both
+    // are harvested onto the dispatch block (co-located with the subject's use, so
+    // a tainted subject reaches the binding), as may-defs (a later arm binds/tests
+    // only when earlier ones didn't match). #2206.
+    for (const arm of arms) {
+      const patFacts = this.harvest.matchArmPatternFacts(arm);
+      if (patFacts) this.builder.attachFacts(dispatch, patFacts);
+      const guard = this.armGuard(arm);
+      if (guard) this.builder.attachFacts(dispatch, this.harvest.factsConditional(guard));
+    }
+
+    this.cfc.pushSwitch(matchExit, []);
+    let hasIrrefutable = false;
+    for (const arm of arms) {
+      // The arm body may be an expr or block; its pattern bindings were harvested
+      // onto the dispatch above (#2206).
+      const armBody = this.visitBody(arm.childForFieldName('value'));
+      const entry = armBody?.entry ?? matchExit;
+      this.builder.edge(dispatch, entry, 'switch-case');
+      if (armBody) this.builder.connect(armBody.exits, matchExit, 'seq');
+      if (this.isIrrefutableArm(arm)) hasIrrefutable = true;
+    }
+    this.cfc.pop();
+
+    // No catch-all arm → a no-match path reaches the exit directly. (A real Rust
+    // match is exhaustive, but a non-`_`-tailed match keeps EXIT reverse-reachable
+    // even when every arm body jumps.)
+    if (!hasIrrefutable) this.builder.edge(dispatch, matchExit, 'switch-case');
+
+    return { entry: dispatch, exits: [matchExit] };
+  }
+
+  /** The guard condition of a `match_arm` (`PAT if g`), if any. */
+  private armGuard(arm: SyntaxNode): SyntaxNode | undefined {
+    const pat = arm.childForFieldName('pattern');
+    return pat?.childForFieldName('condition') ?? undefined;
+  }
+
+  /** A `_ =>` arm with no guard is the unconditional catch-all. */
+  private isIrrefutableArm(arm: SyntaxNode): boolean {
+    if (this.armGuard(arm)) return false;
+    const pat = arm.childForFieldName('pattern');
+    return pat?.text.trim() === '_';
+  }
+
+  /**
+   * Def/use facts for an `if`/`while` condition. A `let_condition` binds a pattern
+   * (a def — a may-def for `while let`, which re-tests) and uses its value; a
+   * `let_chain` threads through each `let_condition`. A plain expression is walked
+   * for uses.
+   */
+  private condFacts(cond: SyntaxNode, loopCond: boolean): ReturnType<RustHarvester['facts']> {
+    if (cond.type === 'let_condition') {
+      return this.harvest.letConditionFacts(cond, loopCond);
+    }
+    // A `let_chain` (`let PAT = e && cond`) — harvest the whole chain. The let
+    // bindings inside it are defs (may-defs for a while-let chain).
+    return this.harvest.facts(cond);
+  }
+}
+
+/** Build the CFG for one Rust function / closure node, or `undefined`. */
+function buildFunctionCfg(fnNode: SyntaxNode, filePath: string): FunctionCfg | undefined {
+  try {
+    if (!RUST_FUNCTION_TYPES.has(fnNode.type)) return undefined;
+    const startLine = startLineOf(fnNode);
+    const endLine = endLineOf(fnNode);
+    const startColumn = fnNode.startPosition.column;
+
+    const body = fnNode.childForFieldName('body');
+    if (!body) return undefined; // trait method signature / no body
+
+    const builder = new CfgBuilder(filePath, startLine, endLine, startColumn);
+    const harvest = new RustHarvester(fnNode);
+
+    const paramFacts = harvest.paramFacts();
+    if (paramFacts) builder.attachFacts(builder.entryIndex, paramFacts);
+
+    const walk = new RustCfgWalk(builder, harvest);
+
+    if (body.type !== 'block') {
+      // A closure with an expression body (`|x| x + 1`): one block whose value is
+      // the returned expression. A `?` inside it early-returns to EXIT.
+      const res = walk.visitStmt(body);
+      builder.edge(builder.entryIndex, res ? res.entry : builder.exitIndex, 'seq');
+      builder.connect(res ? res.exits : [builder.entryIndex], builder.exitIndex, 'seq');
+      return builder.finish(harvest.bindingTable());
+    }
+
+    const res = walk.visitSeq(body.namedChildren.filter(isNotComment));
+    if (!res) {
+      builder.edge(builder.entryIndex, builder.exitIndex, 'seq'); // empty body
+      return builder.finish(harvest.bindingTable());
+    }
+    builder.edge(builder.entryIndex, res.entry, 'seq');
+    builder.connect(res.exits, builder.exitIndex, 'seq'); // normal fall-off → EXIT
+    return builder.finish(harvest.bindingTable());
+  } catch (err) {
+    // Never throw out of buildFunctionCfg — a malformed AST shape must skip only
+    // this one function's CFG, never drop the whole file's language group (R4).
+    // eslint-disable-next-line no-console
+    console.warn(`[cfg] Rust buildFunctionCfg skipped a function in ${filePath}: ${String(err)}`);
+    return undefined;
+  }
+}
+
+/** Whether a node is a Rust function/closure this visitor builds a CFG for. */
+function isFunction(node: SyntaxNode): boolean {
+  return RUST_FUNCTION_TYPES.has(node.type);
+}
+
+/** The Rust CFG visitor. */
+export function createRustCfgVisitor(): CfgVisitor<SyntaxNode> {
+  return { buildFunctionCfg, isFunction };
+}
+
+export { RUST_FUNCTION_TYPES };
diff --git a/gitnexus/src/core/ingestion/cfg/visitors/scope-tree-harvest.ts b/gitnexus/src/core/ingestion/cfg/visitors/scope-tree-harvest.ts
new file mode 100644
index 000000000..1822e58ae
--- /dev/null
+++ b/gitnexus/src/core/ingestion/cfg/visitors/scope-tree-harvest.ts
@@ -0,0 +1,171 @@
+/**
+ * Shared scope-tree substrate for the C-family / Go / Java / C# def/use
+ * harvesters (#2197 U6, plan KTD4 — a byte-equivalent consolidation).
+ *
+ * The Go ({@link import('./go-harvest.js').GoHarvester}), Java ({@link
+ * import('./java-harvest.js').JavaHarvester}), C# ({@link
+ * import('./csharp-harvest.js').CsharpHarvester}) and C/C++ ({@link
+ * import('./c-cpp-harvest.js').CCppHarvester}) harvesters each carried a
+ * BYTE-IDENTICAL copy of the lexical scope tree machinery: the {@link Scope}
+ * record, the binding/scope/synthetic state, the two-phase resolution cache, and
+ * the `openScope` / `nearestScopeOf` / `resolve` / `def` / `use` / `conditional`
+ * / `bindingTable` methods. This base holds that one copy; the four harvesters
+ * extend it and supply ONLY their genuine per-language variation — the
+ * `prescan` switch (abstract) and, for Go, the blank-identifier (`_`) overrides
+ * of `declare` / `def` / `use`.
+ *
+ * TWO-PHASE, ORDER-INDEPENDENT (load-bearing): the CFG walk is NOT source-order
+ * (`visitFor` builds the init block after the body, `visitDoWhile` the condition
+ * before the body), so resolving names against a scope stack populated *during*
+ * the walk would mis-resolve. Phase 1 (`prescan`, per-language) pre-scans the
+ * whole function subtree once into a completed lexical scope tree; phase 2
+ * (`resolve`) resolves defs/uses against that finished tree from any walk order.
+ *
+ * Identifiers with no in-function declaration (globals, fields, imports, …)
+ * resolve to a SYNTHETIC module-level binding (`name@module`), created on first
+ * reference and applied identically by def and use harvesting.
+ *
+ * NOTE: nothing serialized via the harvested bindings/facts may carry a field
+ * named `nodeId` — the durable parsedfile-store reviver dedups objects keyed on
+ * that field name.
+ */
+import type { SyntaxNode } from '../../utils/ast-helpers.js';
+import type { BindingEntry } from '../types.js';
+import { CallSiteFactAccumulator } from './call-site-harvest.js';
+
+/**
+ * The per-statement def/use + call-site collector, aliased to the shared
+ * {@link CallSiteFactAccumulator} (one name for the value and the type).
+ */
+export type FactAccumulator = CallSiteFactAccumulator;
+
+export interface Scope {
+  readonly parent: Scope | null;
+  /** name → binding index */
+  readonly table: Map<string, number>;
+}
+
+/**
+ * Abstract base owning the lexical scope tree + the two-phase resolution
+ * substrate. Subclasses provide the per-language constructor wiring (param /
+ * receiver declaration + the body `prescan` kick-off) and the abstract
+ * `prescan`; Go additionally overrides `declare` / `def` / `use` for its `_`
+ * blank-identifier semantics.
+ */
+export abstract class ScopeTreeHarvester {
+  protected readonly bindings: BindingEntry[] = [];
+  protected readonly scopeByNode = new Map<number, Scope>();
+  protected readonly root: Scope = { parent: null, table: new Map() };
+  protected readonly synthetic = new Map<string, number>();
+  protected readonly fnId: number;
+  /** Innermost enclosing scope per visited node id (prescan-filled) — O(scope-chain) phase-2 resolution. */
+  protected readonly nearestScopeCache = new Map<number, Scope>();
+  /** >0 while walking a conditionally-evaluated subexpression — defs become may-defs. */
+  protected conditionalDepth = 0;
+  /**
+   * Call/new node id → bindings whose declaration/assignment VALUE is exactly
+   * that call (#2195 U6). Registered before the value walk, consumed by the
+   * language harvester's `visitCall` (mirrors the TS harvester's
+   * `resultDefTargets`).
+   */
+  protected readonly resultDefTargets = new Map<number, number[]>();
+
+  constructor(protected readonly fnNode: SyntaxNode) {
+    this.fnId = fnNode.id;
+    this.scopeByNode.set(fnNode.id, this.root);
+  }
+
+  /** The completed binding table — pass to `CfgBuilder.finish`. */
+  bindingTable(): readonly BindingEntry[] {
+    return this.bindings;
+  }
+
+  // ── phase 1: declaration pre-scan ────────────────────────────────────────
+
+  protected openScope(node: SyntaxNode): Scope {
+    const existing = this.scopeByNode.get(node.id);
+    if (existing) return existing;
+    const scope: Scope = { parent: this.nearestScopeOf(node), table: new Map() };
+    this.scopeByNode.set(node.id, scope);
+    return scope;
+  }
+
+  protected nearestScopeOf(node: SyntaxNode): Scope {
+    for (let p = node.parent; p; p = p.parent) {
+      const s = this.scopeByNode.get(p.id);
+      if (s) return s;
+      if (p.id === this.fnId) break;
+    }
+    return this.root;
+  }
+
+  protected declare(nameNode: SyntaxNode, kind: BindingEntry['kind'], scope: Scope): void {
+    const name = nameNode.text;
+    if (!name || scope.table.has(name)) return;
+    scope.table.set(name, this.bindings.length);
+    this.bindings.push({
+      name,
+      declLine: nameNode.startPosition.row + 1,
+      declColumn: nameNode.startPosition.column,
+      kind,
+    });
+  }
+
+  /**
+   * Phase-1 declaration pre-scan — the only genuine per-language variation (each
+   * grammar has a distinct declaration-node taxonomy). Walks the function
+   * subtree once, filling `nearestScopeCache` and the scope tables.
+   */
+  protected abstract prescan(node: SyntaxNode, scope: Scope): void;
+
+  // ── phase 2: per-statement fact extraction ───────────────────────────────
+
+  protected resolve(nameNode: SyntaxNode): number {
+    const name = nameNode.text;
+    const cached = this.nearestScopeCache.get(nameNode.id);
+    let startScope: Scope | null = cached ?? null;
+    if (!startScope) {
+      for (let p: SyntaxNode | null = nameNode; p; p = p.parent) {
+        const scope = this.scopeByNode.get(p.id) ?? this.nearestScopeCache.get(p.id);
+        if (scope) {
+          startScope = scope;
+          break;
+        }
+        if (p.id === this.fnId) {
+          startScope = this.root;
+          break;
+        }
+      }
+    }
+    for (let s: Scope | null = startScope; s; s = s.parent) {
+      const idx = s.table.get(name);
+      if (idx !== undefined) return idx;
+    }
+    let idx = this.synthetic.get(name);
+    if (idx === undefined) {
+      idx = this.bindings.length;
+      this.synthetic.set(name, idx);
+      this.bindings.push({ name, declLine: 0, declColumn: 0, kind: 'module', synthetic: true });
+    }
+    return idx;
+  }
+
+  protected def(nameNode: SyntaxNode, acc: FactAccumulator): void {
+    if (this.conditionalDepth > 0) acc.addMayDef(this.resolve(nameNode));
+    else acc.addDef(this.resolve(nameNode));
+  }
+
+  protected use(nameNode: SyntaxNode, acc: FactAccumulator): void {
+    acc.addUse(this.resolve(nameNode));
+  }
+
+  /** Run `fn` with defs demoted to may-defs (conditionally-evaluated context). */
+  protected conditional(fn: () => void): void {
+    this.conditionalDepth++;
+    try {
+      fn();
+    } finally {
+      this.conditionalDepth--;
+    }
+  }
+}
diff --git a/gitnexus/src/core/ingestion/cfg/visitors/swift-harvest.ts b/gitnexus/src/core/ingestion/cfg/visitors/swift-harvest.ts
new file mode 100644
index 000000000..7e17a6eee
--- /dev/null
+++ b/gitnexus/src/core/ingestion/cfg/visitors/swift-harvest.ts
@@ -0,0 +1,533 @@
+/**
+ * Swift def/use harvester (#2195) — the Swift analogue of
+ * {@link import('./typescript-harvest.js').TsHarvester} and the C-family / Go /
+ * Rust / Python harvesters. Like the Python / Rust harvesters it harvests NO
+ * call-site `sites[]` (the call-site taint substrate is a later step): it emits
+ * only the per-function binding table ({@link BindingEntry}[]) plus
+ * {@link StatementFacts} (defs / uses / mayDefs) via a local
+ * {@link FactAccumulator} with no site machinery, so the produced facts never
+ * carry a `sites` key.
+ *
+ * Runs in the parse worker next to the Swift CFG visitor. Output is the binding
+ * table the {@link import('../cfg-builder.js').CfgBuilder} stamps onto the CFG,
+ * plus the per-block def/use facts the reaching-defs / CDG solvers consume.
+ *
+ * Every node type and field literal below was grammar-validated against the
+ * VENDORED tree-sitter-swift via the introspection probe before use (mandatory
+ * pre-step). Swift shapes pre-empted (verified by a real parse):
+ *  - functions: `function_declaration` / `init_declaration` / `deinit_declaration`
+ *    (field `body`=`function_body`, which wraps a `statements` node) and
+ *    `lambda_literal` (a closure — its `statements` follow an optional
+ *    `lambda_function_type` + `in`, NO `function_body` wrapper).
+ *  - parameters: `parameter` (fields `external_name`?/`name`=`simple_identifier`,
+ *    plus a type child). A closure's parameters live in `lambda_function_type` →
+ *    `lambda_function_type_parameters` (bare `simple_identifier`s).
+ *  - `property_declaration` — Swift's `let`/`var` binding: a `value_binding_pattern`
+ *    (`mutability` = `let`/`var`), then repeated `name`=`pattern` + `value`= pairs
+ *    (`let p = 1, q = 2`). A `pattern` binds via `bound_identifier`=`simple_identifier`
+ *    or nests `pattern`s for tuple destructuring (`let (a, b) = pair`).
+ *  - optional binding (`if let` / `while let` / `guard let`): a `value_binding_pattern`
+ *    in the construct's `condition` fields, then a `bound_identifier` field and the
+ *    bound value as further `condition` fields.
+ *  - `for_statement` fields `item`=`pattern` / `collection` / optional `where_clause`.
+ *  - `catch_block` field `error`=`pattern` (the bound error).
+ *  - reads: `simple_identifier`, `navigation_expression` (`a.b` — fields
+ *    `target`/`suffix`), `call_expression` (`f()` — `call_suffix`),
+ *    `assignment` (fields `target`/`operator`/`result`).
+ *
+ * TWO-PHASE, ORDER-INDEPENDENT (load-bearing — mirrors the Rust / Go / C
+ * harvesters): the CFG walk is NOT source-order (`repeat … while` builds the
+ * condition after the body), so resolving names against a scope stack populated
+ * *during* the walk would mis-resolve. Phase 1 pre-scans the whole function
+ * subtree once, declaring every bound name into ONE function table; phase 2
+ * resolves defs/uses against that finished table from any walk order. Swift DOES
+ * have block scope + shadowing, but a single function table is the documented v1
+ * simplification used by the Python / Rust harvesters — distinct shadowing
+ * redeclarations of the same name collapse onto one binding (an over-approximation
+ * that can falsely kill across a shadow, the sound direction for taint).
+ *
+ * v1 def-semantics scope:
+ *   - `property_declaration` (`let`/`var PAT = …`) — each `simple_identifier`
+ *     leaf of every `name` pattern is a def; the values are walked for uses.
+ *   - `assignment` plain `=` — a plain-identifier target is a def; a
+ *     `navigation_expression` / subscript target (`self.x = …`, `a[i] = …`) is
+ *     NOT a scalar def (its root is a use). A compound `+=`/`-=`/… target
+ *     def-AND-uses the lvalue.
+ *   - `for x in xs` — the loop pattern's leaves are defs, the collection a use.
+ *   - optional binding (`if let` / `while let` / `guard let`) binds its pattern.
+ *   - `catch_block`'s `error` pattern binds.
+ *   - parameters (incl. closure params) are `param`-kind defs.
+ * EXCLUDED, deliberately (TypeScript-CFA precedent): member / subscript writes
+ * (`obj.f = …`, `a[i] = …`) are NOT scalar defs — their root identifiers are
+ * uses only. Nested-function bodies (`lambda_literal`, a nested
+ * `function_declaration`) are opaque in BOTH directions (captured reads/writes
+ * invisible).
+ *
+ * MAY-DEFS: a def inside a conditionally-evaluated subexpression — the right
+ * operand of `&&` / `||` short-circuit, and a switch-case `where` guard / case
+ * test — is a may-def (gen WITHOUT kill), so the not-taken path's prior def is
+ * not falsely killed. A `while let` re-test binding is also a may-def (the bind
+ * does not happen on the exit iteration).
+ *
+ * Identifiers with no in-function declaration (module/global functions, types,
+ * enum cases) resolve to a SYNTHETIC module-level binding (`name@module`),
+ * applied identically by def and use harvesting.
+ *
+ * NOTE: nothing serialized here may carry a field named `nodeId` — the durable
+ * parsedfile-store reviver dedups objects keyed on that field name.
+ */
+import type { SyntaxNode } from '../../utils/ast-helpers.js';
+import type { BindingEntry, StatementFacts } from '../types.js';
+import { DefUseAccumulator as FactAccumulator } from './call-site-harvest.js';
+
+/** Node types that own a nested CFG — their subtrees are opaque to harvesting. */
+const NESTED_FUNCTION_TYPES = new Set([
+  'function_declaration',
+  'init_declaration',
+  'deinit_declaration',
+  'lambda_literal',
+]);
+
+export class SwiftHarvester {
+  private readonly bindings: BindingEntry[] = [];
+  /** Single function-scope name → binding index (v1: no block scope). */
+  private readonly table = new Map<string, number>();
+  private readonly synthetic = new Map<string, number>();
+  private readonly fnId: number;
+  /** >0 while walking a conditionally-evaluated subexpression — defs become may-defs. */
+  private conditionalDepth = 0;
+
+  constructor(private readonly fnNode: SyntaxNode) {
+    this.fnId = fnNode.id;
+    this.declareParams(fnNode);
+    const body = this.bodyOf(fnNode);
+    if (body) this.prescan(body);
+  }
+
+  /** The completed binding table — pass to `CfgBuilder.finish`. */
+  bindingTable(): readonly BindingEntry[] {
+    return this.bindings;
+  }
+
+  /**
+   * The function/closure body `statements` node. A `function_declaration` /
+   * `init_declaration` / `deinit_declaration` wraps it in a `function_body`; a
+   * `lambda_literal` carries the `statements` directly.
+   */
+  private bodyOf(fnNode: SyntaxNode): SyntaxNode | undefined {
+    const fb =
+      fnNode.childForFieldName('body') ??
+      fnNode.namedChildren.find((c) => c.type === 'function_body');
+    if (fb && fb.type === 'function_body') {
+      return fb.namedChildren.find((c) => c.type === 'statements') ?? fb;
+    }
+    // lambda_literal — its `statements` is a direct named child.
+    return fnNode.namedChildren.find((c) => c.type === 'statements');
+  }
+
+  // ── phase 1: declaration pre-scan ────────────────────────────────────────
+
+  private declare(nameNode: SyntaxNode, kind: BindingEntry['kind']): void {
+    const name = nameNode.text;
+    if (!name || name === '_' || this.table.has(name)) return;
+    this.table.set(name, this.bindings.length);
+    this.bindings.push({
+      name,
+      declLine: nameNode.startPosition.row + 1,
+      declColumn: nameNode.startPosition.column,
+      kind,
+    });
+  }
+
+  /** Declare every parameter binder of a fn / init / closure. */
+  private declareParams(fnNode: SyntaxNode): void {
+    for (const p of fnNode.namedChildren) {
+      if (p.type === 'parameter') {
+        const name = p.childForFieldName('name');
+        if (name && name.type === 'simple_identifier') this.declare(name, 'param');
+      }
+    }
+    // Closure params live in lambda_function_type → lambda_function_type_parameters.
+    const lambdaType = fnNode.namedChildren.find((c) => c.type === 'lambda_function_type');
+    if (lambdaType) this.declareClosureParams(lambdaType);
+  }
+
+  private declareClosureParams(lambdaType: SyntaxNode): void {
+    for (const params of lambdaType.namedChildren) {
+      if (params.type !== 'lambda_function_type_parameters') continue;
+      for (const id of params.namedChildren) {
+        if (id.type === 'simple_identifier') this.declare(id, 'param');
+        else if (id.type === 'lambda_parameter') {
+          const name =
+            id.childForFieldName('name') ??
+            id.namedChildren.find((c) => c.type === 'simple_identifier');
+          if (name) this.declare(name, 'param');
+        }
+      }
+    }
+  }
+
+  /**
+   * Pre-scan the function body once, declaring every bound name. Recurses into
+   * compound expressions but NOT into nested `function_declaration` /
+   * `lambda_literal` bodies (opaque).
+   */
+  private prescan(node: SyntaxNode): void {
+    const t = node.type;
+    if (NESTED_FUNCTION_TYPES.has(t) && node.id !== this.fnId) return;
+
+    switch (t) {
+      case 'property_declaration':
+        // `let`/`var PAT = …` — declare every `name` pattern's leaves.
+        for (let i = 0; i < node.childCount; i++) {
+          if (node.fieldNameForChild(i) === 'name') {
+            const pat = node.child(i);
+            if (pat) this.declarePattern(pat);
+          }
+        }
+        break;
+      case 'for_statement': {
+        const pat = node.childForFieldName('item');
+        if (pat) this.declarePattern(pat);
+        break;
+      }
+      case 'catch_block': {
+        const err = node.childForFieldName('error');
+        if (err) this.declarePattern(err);
+        break;
+      }
+      case 'switch_pattern': {
+        // `case let n` / `case (let a, let b)` / `case .some(let v)` — declare
+        // the value binding(s) so a body use resolves to a real local.
+        const pat = node.namedChildren.find((c) => c.type === 'pattern');
+        if (pat) this.declarePattern(pat);
+        break;
+      }
+      default:
+        // Optional binding (`if let` / `while let` / `guard let`): a
+        // `value_binding_pattern` condition followed by a `bound_identifier`.
+        if (t === 'if_statement' || t === 'while_statement' || t === 'guard_statement') {
+          this.declareOptionalBindings(node);
+        }
+        break;
+    }
+
+    for (let i = 0; i < node.namedChildCount; i++) {
+      const c = node.namedChild(i);
+      if (c) this.prescan(c);
+    }
+  }
+
+  /** Declare the bindings of each optional binding in a condition. */
+  private declareOptionalBindings(node: SyntaxNode): void {
+    for (let i = 0; i < node.childCount; i++) {
+      const child = node.child(i);
+      if (!child) continue;
+      // `if/guard let v = e` — a direct `bound_identifier` field.
+      if (node.fieldNameForChild(i) === 'bound_identifier') {
+        this.declare(child, 'let');
+      } else if (child.type === 'pattern') {
+        // `if/guard case PAT = e` (e.g. `case .some(let v)`): the binder is nested
+        // in a `pattern` condition child, not a direct `bound_identifier`, so it
+        // was missed and resolved to a synthetic global. declarePattern finds its
+        // bound leaves (#2206).
+        this.declarePattern(child);
+      }
+    }
+  }
+
+  /**
+   * Declare every `simple_identifier` leaf of a binding pattern. Handles the
+   * common Swift pattern shapes: a `bound_identifier` simple pattern and tuple
+   * destructuring (`(a, b)`), which nests `pattern` children. `_` (the wildcard)
+   * binds nothing.
+   */
+  private declarePattern(pat: SyntaxNode): void {
+    const bound = pat.childForFieldName?.('bound_identifier');
+    if (bound && bound.type === 'simple_identifier') {
+      this.declare(bound, 'let');
+      return;
+    }
+    if (pat.type === 'simple_identifier') {
+      this.declare(pat, 'let');
+      return;
+    }
+    // Tuple / nested pattern — recurse into child patterns / identifiers.
+    for (let i = 0; i < pat.namedChildCount; i++) {
+      const c = pat.namedChild(i);
+      if (!c) continue;
+      if (c.type === 'pattern') this.declarePattern(c);
+      else if (c.type === 'simple_identifier') this.declare(c, 'let');
+      else if (c.type === 'value_binding_pattern') continue;
+      else this.declarePattern(c);
+    }
+  }
+
+  // ── phase 2: per-statement fact extraction ───────────────────────────────
+
+  /** Def/use facts for one statement (or construct-header expression) node. */
+  facts(node: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(node.startPosition.row + 1);
+    this.walkValue(node, acc);
+    return acc.finish();
+  }
+
+  /** Facts for an expression whose WHOLE evaluation is conditional (guards/tests). */
+  factsConditional(node: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(node.startPosition.row + 1);
+    this.conditional(() => this.walkValue(node, acc));
+    return acc.finish();
+  }
+
+  /**
+   * MAY-def facts for a `switch_pattern`'s value bindings (`case let n` /
+   * `case .some(let v)`). The binding only takes effect when the case matches,
+   * so it is a may-def on the dispatch block — propagated into the case body
+   * where the bound name is read.
+   */
+  switchPatternFacts(switchPattern: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(switchPattern.startPosition.row + 1);
+    const pat = switchPattern.namedChildren.find((c) => c.type === 'pattern');
+    if (pat) this.conditional(() => this.defPattern(pat, acc));
+    return acc.finish();
+  }
+
+  /**
+   * Facts for a `for item in COLLECTION` head: the loop pattern's leaves are
+   * defs, the iterated collection a use. The `where` guard (if any) is harvested
+   * conditionally.
+   */
+  forHeadFacts(stmt: SyntaxNode): StatementFacts {
+    const acc = new FactAccumulator(stmt.startPosition.row + 1);
+    const collection = stmt.childForFieldName('collection');
+    const item = stmt.childForFieldName('item');
+    if (collection) this.walkValue(collection, acc);
+    if (item) this.defPattern(item, acc);
+    const where = stmt.namedChildren.find((c) => c.type === 'where_clause');
+    if (where) this.conditional(() => this.walkValue(where, acc));
+    return acc.finish();
+  }
+
+  /**
+   * Facts for an `if`/`while`/`guard` condition: optional bindings bind their
+   * pattern (a def — a may-def when `conditional`), and the condition expression
+   * children are uses. The construct's `condition` / `bound_identifier` fields are
+   * interleaved, so we walk all children and classify them.
+   */
+  conditionFacts(stmt: SyntaxNode, conditional: boolean): StatementFacts {
+    const acc = new FactAccumulator(stmt.startPosition.row + 1);
+    const run = (): void => {
+      for (let i = 0; i < stmt.childCount; i++) {
+        const field = stmt.fieldNameForChild(i);
+        const child = stmt.child(i);
+        if (!child) continue;
+        if (field === 'bound_identifier') this.def(child, acc);
+        else if (field === 'condition') {
+          // `value_binding_pattern` (`let`) and the `=` operator carry no uses.
+          if (child.type === 'value_binding_pattern') continue;
+          if (!child.isNamed) continue;
+          // `if/guard case PAT = e` (e.g. `case .some(let v)`): the `pattern` child
+          // BINDS — its leaves are defs (a may-def when conditional), not uses, so
+          // a tainted subject propagates to the binding (#2206). The matched
+          // subject and any other condition child are uses.
+          if (child.type === 'pattern') this.defPattern(child, acc);
+          else this.walkValue(child, acc);
+        }
+      }
+    };
+    if (conditional) this.conditional(run);
+    else run();
+    return acc.finish();
+  }
+
+  /** ENTRY-block facts for the parameters (defs only). */
+  paramFacts(): StatementFacts | undefined {
+    const acc = new FactAccumulator(this.fnNode.startPosition.row + 1);
+    for (const p of this.fnNode.namedChildren) {
+      if (p.type === 'parameter') {
+        const name = p.childForFieldName('name');
+        if (name && name.type === 'simple_identifier') this.def(name, acc);
+      }
+    }
+    const lambdaType = this.fnNode.namedChildren.find((c) => c.type === 'lambda_function_type');
+    if (lambdaType) {
+      for (const params of lambdaType.namedChildren) {
+        if (params.type !== 'lambda_function_type_parameters') continue;
+        for (const id of params.namedChildren) {
+          if (id.type === 'simple_identifier') this.def(id, acc);
+          else if (id.type === 'lambda_parameter') {
+            const name =
+              id.childForFieldName('name') ??
+              id.namedChildren.find((c) => c.type === 'simple_identifier');
+            if (name) this.def(name, acc);
+          }
+        }
+      }
+    }
+    return acc.defCount() ? acc.finish() : undefined;
+  }
+
+  /** Def fact for a `catch let e` error pattern — prepend to the handler entry block. */
+  catchErrorFacts(catchBlock: SyntaxNode): StatementFacts | undefined {
+    const err = catchBlock.childForFieldName('error');
+    if (!err) return undefined;
+    const acc = new FactAccumulator(catchBlock.startPosition.row + 1);
+    this.defPattern(err, acc);
+    return acc.defCount() ? acc.finish() : undefined;
+  }
+
+  private resolve(nameNode: SyntaxNode): number {
+    const name = nameNode.text;
+    const idx = this.table.get(name);
+    if (idx !== undefined) return idx;
+    let syn = this.synthetic.get(name);
+    if (syn === undefined) {
+      syn = this.bindings.length;
+      this.synthetic.set(name, syn);
+      this.bindings.push({ name, declLine: 0, declColumn: 0, kind: 'module', synthetic: true });
+    }
+    return syn;
+  }
+
+  private def(nameNode: SyntaxNode, acc: FactAccumulator): void {
+    if (nameNode.text === '_') return; // blank target defines nothing
+    if (this.conditionalDepth > 0) acc.addMayDef(this.resolve(nameNode));
+    else acc.addDef(this.resolve(nameNode));
+  }
+
+  private use(nameNode: SyntaxNode, acc: FactAccumulator): void {
+    if (nameNode.text === '_') return;
+    acc.addUse(this.resolve(nameNode));
+  }
+
+  /** Run `fn` with defs demoted to may-defs (conditionally-evaluated context). */
+  private conditional(fn: () => void): void {
+    this.conditionalDepth++;
+    try {
+      fn();
+    } finally {
+      this.conditionalDepth--;
+    }
+  }
+
+  /**
+   * Def each `simple_identifier` leaf of a binding pattern (the def-position
+   * analogue of {@link declarePattern}). Tuple destructuring recurses; `_` binds
+   * nothing.
+   */
+  private defPattern(pat: SyntaxNode, acc: FactAccumulator): void {
+    const bound = pat.childForFieldName?.('bound_identifier');
+    if (bound && bound.type === 'simple_identifier') {
+      this.def(bound, acc);
+      return;
+    }
+    if (pat.type === 'simple_identifier') {
+      this.def(pat, acc);
+      return;
+    }
+    for (let i = 0; i < pat.namedChildCount; i++) {
+      const c = pat.namedChild(i);
+      if (!c) continue;
+      if (c.type === 'pattern') this.defPattern(c, acc);
+      else if (c.type === 'simple_identifier') this.def(c, acc);
+      else if (c.type === 'value_binding_pattern') continue;
+      else this.defPattern(c, acc);
+    }
+  }
+
+  /** Value-position walk: collect uses; route def positions to the pattern handler. */
+  private walkValue(node: SyntaxNode, acc: FactAccumulator): void {
+    const t = node.type;
+    if (NESTED_FUNCTION_TYPES.has(t) && node.id !== this.fnId) return; // opaque
+
+    switch (t) {
+      case 'simple_identifier':
+        this.use(node, acc);
+        return;
+      case 'property_declaration': {
+        // Walk each `value` for uses, then def each `name` pattern's leaves.
+        const names: SyntaxNode[] = [];
+        for (let i = 0; i < node.childCount; i++) {
+          const field = node.fieldNameForChild(i);
+          const child = node.child(i);
+          if (!child) continue;
+          if (field === 'value') this.walkValue(child, acc);
+          else if (field === 'name') names.push(child);
+          else if (field === 'computed_value') this.walkValue(child, acc);
+        }
+        for (const pat of names) this.defPattern(pat, acc);
+        return;
+      }
+      case 'assignment': {
+        const target = node.childForFieldName('target');
+        const result = node.childForFieldName('result');
+        const op = node.childForFieldName('operator')?.text ?? '=';
+        if (result) this.walkValue(result, acc);
+        if (target) {
+          const lv = this.unwrapAssignable(target);
+          if (lv.type === 'simple_identifier') {
+            this.def(lv, acc);
+            if (op !== '=') this.use(lv, acc); // compound assign reads too
+          } else {
+            // `self.x = …`, `a[i] = …` — root is a use only (not a scalar def).
+            this.walkValue(lv, acc);
+          }
+        }
+        return;
+      }
+      case 'navigation_expression': {
+        // `a.b` — value read of the chain root only; the suffix name is not a
+        // scalar binding.
+        const target = node.childForFieldName('target');
+        if (target) this.walkValue(target, acc);
+        return;
+      }
+      case 'try_expression': {
+        // `try expr` / `try? expr` / `try! expr` — the wrapped expression's uses.
+        const expr = node.childForFieldName('expr');
+        if (expr) this.walkValue(expr, acc);
+        else
+          for (let i = 0; i < node.namedChildCount; i++) {
+            const c = node.namedChild(i);
+            if (c && c.type !== 'try_operator') this.walkValue(c, acc);
+          }
+        return;
+      }
+      case 'conjunction_expression':
+      case 'disjunction_expression': {
+        // `a && b` / `a || b` — the right operand is conditionally evaluated.
+        const lhs = node.childForFieldName('lhs');
+        const rhs = node.childForFieldName('rhs');
+        if (lhs) this.walkValue(lhs, acc);
+        else if (node.namedChildCount > 0) this.walkValue(node.namedChild(0)!, acc);
+        if (rhs) this.conditional(() => this.walkValue(rhs, acc));
+        else if (node.namedChildCount > 1) {
+          this.conditional(() => this.walkValue(node.namedChild(node.namedChildCount - 1)!, acc));
+        }
+        return;
+      }
+      case 'value_binding_pattern':
+      case 'type_identifier':
+      case 'user_type':
+        // Binding keyword / type position — no scalar value uses.
+        return;
+      default:
+        for (let i = 0; i < node.namedChildCount; i++) {
+          const c = node.namedChild(i);
+          if (c) this.walkValue(c, acc);
+        }
+    }
+  }
+
+  /** Strip a `directly_assignable_expression` wrapper around an lvalue. */
+  private unwrapAssignable(node: SyntaxNode): SyntaxNode {
+    let n = node;
+    let hops = 4;
+    while (n.type === 'directly_assignable_expression' && hops-- > 0) {
+      const inner = n.namedChild(0);
+      if (!inner) break;
+      n = inner;
+    }
+    return n;
+  }
+}
diff --git a/gitnexus/src/core/ingestion/cfg/visitors/swift.ts b/gitnexus/src/core/ingestion/cfg/visitors/swift.ts
new file mode 100644
index 000000000..57af723d4
--- /dev/null
+++ b/gitnexus/src/core/ingestion/cfg/visitors/swift.ts
@@ -0,0 +1,952 @@
+/**
+ * Swift CfgVisitor (#2195) — the VENDORED-GRAMMAR, control-keyword-overloaded
+ * CFG target. Swift's tree-sitter grammar is unusual: a single
+ * `control_transfer_statement` node represents `break` / `continue` / `return` /
+ * `throw` (distinguished by its leading keyword child), there is no separate
+ * `block` node (statement lists are bare `statements` nodes), optional binding
+ * (`if let` / `guard let` / `while let`) is folded into the construct's
+ * `condition` fields with no dedicated `if_let` node, and `defer` is parsed as a
+ * `call_expression` to a `defer` identifier carrying a trailing-closure
+ * `lambda_literal` (NOT a `defer_statement`). Every node type and field literal
+ * below was grammar-validated against the vendored tree-sitter-swift via the
+ * introspection probe before use (mandatory pre-step — the grammar-literal CI
+ * gate maps `swift.ts → Swift`).
+ *
+ * The visitor drives the language-agnostic {@link CfgBuilder} to produce a
+ * serializable {@link FunctionCfg} plus a def/use harvest ({@link SwiftHarvester})
+ * for the reaching-defs / CDG solvers, structured like the sibling visitors — a
+ * `visit_<node_type>` dispatch over the control-flow taxonomy driving a
+ * per-function {@link ControlFlowContext} for labeled break/continue and the
+ * `defer` completion chain (Swift's analogue of finally / Go-defer route-through).
+ *
+ * Swift shapes pre-empted (verified by a real parse):
+ *  - functions: `function_declaration` / `init_declaration` / `deinit_declaration`
+ *    (field `body`=`function_body`, which wraps a `statements`) and `lambda_literal`
+ *    (a closure — `statements` follows an optional `lambda_function_type` + `in`).
+ *  - `if_statement` field `condition` (a plain expr, or a `value_binding_pattern`
+ *    +`bound_identifier`+value for `if let`); the THEN body is the first
+ *    `statements`; an optional `else` keyword is followed by EITHER a nested
+ *    `if_statement` (`else if`) OR the else-body `statements`.
+ *  - `guard_statement` — like `if`, but its `else` `statements` MUST diverge
+ *    (return/throw/break/continue); the guard body continues straight-line after.
+ *  - `for_statement` fields `item`=`pattern` / `collection` / optional `where_clause`;
+ *    body is the trailing `statements`.
+ *  - `while_statement` field `condition` (may be a `value_binding_pattern` for
+ *    `while let`); body `statements`.
+ *  - `repeat_while_statement` — BOTTOM-TEST: body `statements` then the `while`
+ *    keyword + `condition`.
+ *  - `switch_statement` field `expr`; children `switch_entry` (each with a
+ *    `switch_pattern` or `default_keyword`, an optional `where_keyword`+guard, a
+ *    `statements` body, and an optional trailing `fallthrough` keyword child).
+ *    Cases do NOT fall through implicitly; an explicit `fallthrough` spills to the
+ *    next case.
+ *  - `do_statement` — `statements` body + one or more `catch_block` (field
+ *    `error`=`pattern`); `try_expression` (`try`/`try?`/`try!`).
+ *  - `control_transfer_statement` — break / continue / return / throw, the first
+ *    keyword child decides; `break outer` / `continue outer` carry the label as a
+ *    `result` `simple_identifier`; `return x` / `throw e` carry the value.
+ *  - `statement_label` (`outer:`) — a SIBLING preceding the labeled loop/switch in
+ *    the same `statements`, NOT a wrapper.
+ *
+ * Edge-kind contract (matches the existing visitors — RD/CDG consume these):
+ *  - if / else (incl. `if let`) → `cond-true` / `cond-false`
+ *  - guard → `cond-true` (body continuation) / `cond-false` (the diverging else)
+ *  - `for` / `while` / `while let` → `cond-true` / `loop-back` / `cond-false`
+ *  - `repeat … while` → bottom-test: body runs first, condition `loop-back` (true)
+ *    / `cond-false` (exit)
+ *  - `switch` dispatch → `switch-case` (NO implicit fallthrough); an explicit
+ *    `fallthrough` → a `fallthrough` edge to the next case
+ *  - `do`/`catch` → `throw` (each protected block edges to the first handler)
+ *  - a `defer` (and the normal completion / each `return`) threads through the
+ *    active defer chain as `return` (first leg) + `finally-return` (each defer's
+ *    completion leg), LIFO
+ *  - return / throw / break / continue → the matching terminator kind; a labeled
+ *    `break outer` / `continue outer` targets the labeled loop frame
+ *  - straight-line → `seq`
+ *
+ * Swift-specific modeling decisions (documented approximations):
+ *  - `defer { … }` runs at SCOPE EXIT in LIFO order. Modeled exactly as the Go
+ *    visitor models Go's `defer`: each registers a finalizer frame that stays
+ *    active for the rest of the function tail, so every later `return` AND the
+ *    normal fall-off thread through ALL active defers innermost-first. APPROXIMATION:
+ *    a `defer` is registered at the point it executes, so a defer inside a
+ *    not-yet-run branch is conservatively treated as active for the whole remaining
+ *    function tail. Swift `defer` is scope-bound (block-level), not function-bound;
+ *    modeling it as function-tail-bound is a sound over-approximation for v1.
+ *  - `while true {}` / `repeat {} while true` may never terminate; like the
+ *    C-family / Go / Rust visitors, this visitor ALWAYS emits the structural
+ *    `header → loopExit` `cond-false` escape edge so EXIT stays reverse-reachable
+ *    and the post-dominator / CDG pass is not silently skipped for the function.
+ *    This is the single highest-risk correctness property.
+ *  - `try` / `try?` / `try!` and a `throw` inside a `do` route to the enclosing
+ *    `catch` conservatively (every protected block → the first handler, matching
+ *    the C++/TS over-approximation). A `throw` with no enclosing `do/catch` routes
+ *    to EXIT (the function propagates the error to its caller).
+ *  - a closure (`lambda_literal`) is collected as its OWN function by `isFunction`,
+ *    so its body gets a standalone CFG; in the ENCLOSING function it is an opaque
+ *    straight-line value (its body is not followed inline) — except a `defer`'s
+ *    trailing closure, which is unwrapped to model scope-exit flow.
+ *
+ * Known limitations:
+ *  - computed properties (`var y: Int { get { … } set { … } }`) have their bodies
+ *    inside `computed_getter` / `computed_setter` rather than a function node; v1
+ *    does NOT build a CFG for them (documented gap, not faked).
+ *  - `async` / `await`: suspension points are normal straight-line flow (no
+ *    scheduler edges). `Task { … }` closures get their own CFG like any closure.
+ *  - block-scope shadowing in the harvest is flattened to one function table (see
+ *    swift-harvest.ts) — a documented v1 over-approximation.
+ *  - the panic-like `fatalError()` / forced-unwrap traps abort abnormally but
+ *    tree-sitter sees a normal call — that abnormal path is not modeled.
+ *
+ * Returns `undefined` (never throws) for an AST shape it cannot model, so a
+ * malformed function never drops the whole file's CFG group (R4).
+ */
+import type { SyntaxNode } from '../../utils/ast-helpers.js';
+import { CfgBuilder } from '../cfg-builder.js';
+import { ControlFlowContext, wireJumpThroughFinalizers } from '../control-flow-context.js';
+import { drainFinalizerPending } from '../control-flow-context.js';
+import type { FinalizerFrame } from '../control-flow-context.js';
+import type { TraversalResult } from '../traversal-result.js';
+import type { CfgVisitor, FunctionCfg } from '../types.js';
+import { SwiftHarvester } from './swift-harvest.js';
+
+/** Swift node types that own a CFG-bearing function body. */
+const SWIFT_FUNCTION_TYPES = new Set([
+  'function_declaration',
+  'init_declaration',
+  'deinit_declaration',
+  'lambda_literal',
+]);
+
+/** Statement node types that break a basic block (everything else coalesces). */
+const CONTROL_FLOW_TYPES = new Set([
+  'if_statement',
+  'guard_statement',
+  'for_statement',
+  'while_statement',
+  'repeat_while_statement',
+  'switch_statement',
+  'do_statement',
+  'control_transfer_statement',
+  'statements',
+]);
+
+const startLineOf = (n: SyntaxNode): number => n.startPosition.row + 1;
+const endLineOf = (n: SyntaxNode): number => n.endPosition.row + 1;
+
+/** A statement sequence that produced no blocks (empty body) is "transparent". */
+type SeqResult = TraversalResult | null;
+
+/**
+ * Per-function Swift walk state. One instance per function so the
+ * {@link ControlFlowContext}, the `defer` finalizer chain, and the label tables
+ * are scoped to that function and never leak across functions.
+ */
+class SwiftCfgWalk {
+  private readonly cfc = new ControlFlowContext();
+  /** Stack of `do`/`catch` handler entry blocks a `throw`/`try` jumps to. */
+  private readonly handlers: number[] = [];
+  /** Label(s) pending attachment to the NEXT pushed loop/switch frame. */
+  private pendingLabels: string[] = [];
+  /**
+   * Active `defer` finalizer frames in source (push) order. Innermost-LIFO is the
+   * REVERSE of this list. Frames stay active for the whole function tail and are
+   * drained once at the top-level walk's end (mirrors the Go visitor).
+   */
+  private readonly deferFrames: FinalizerFrame[] = [];
+
+  constructor(
+    private readonly builder: CfgBuilder,
+    private readonly harvest: SwiftHarvester,
+  ) {}
+
+  /** Statements of a `statements` node, ignoring comments. */
+  private statementsOf(block: SyntaxNode): SyntaxNode[] {
+    return block.namedChildren.filter(
+      (c) => c.type !== 'comment' && c.type !== 'multiline_comment',
+    );
+  }
+
+  /** The body `statements` of a loop/branch node (the LAST `statements` child). */
+  private bodyStatements(node: SyntaxNode): SyntaxNode | undefined {
+    const all = node.namedChildren.filter((c) => c.type === 'statements');
+    return all.length ? all[all.length - 1] : undefined;
+  }
+
+  /** Visit a body that is a `statements` node (or a single statement). */
+  private visitBody(node: SyntaxNode | undefined | null): SeqResult {
+    return this.builder.withNesting(() => {
+      if (!node) return null;
+      if (node.type === 'statements') return this.visitSeq(this.statementsOf(node));
+      return this.visitStmt(node);
+    });
+  }
+
+  /** Wire a sequence of statements, coalescing straight-line runs into blocks. */
+  visitSeq(stmts: SyntaxNode[]): SeqResult {
+    return this.builder.withNesting(() => {
+      let entry: number | undefined;
+      let dangling: number[] = [];
+      let openSimple: number | undefined;
+
+      for (const stmt of stmts) {
+        if (this.isControlFlow(stmt)) {
+          openSimple = undefined; // close any open straight-line block
+          const res = this.visitStmt(stmt);
+          if (res === null) continue; // transparent (empty nested block / label)
+          if (entry === undefined) entry = res.entry;
+          else this.builder.connect(dangling, res.entry, 'seq');
+          dangling = [...res.exits];
+        } else {
+          if (openSimple === undefined) {
+            const idx = this.builder.newBlock(
+              startLineOf(stmt),
+              endLineOf(stmt),
+              stmt.text,
+              'normal',
+              this.harvest.facts(stmt),
+            );
+            if (entry === undefined) entry = idx;
+            else this.builder.connect(dangling, idx, 'seq');
+            openSimple = idx;
+            dangling = [idx];
+          } else {
+            this.builder.extendBlock(
+              openSimple,
+              endLineOf(stmt),
+              stmt.text,
+              this.harvest.facts(stmt),
+            );
+          }
+          // A straight-line statement may contain a `try` — it can error-return.
+          this.wireTryExits(stmt, openSimple);
+        }
+      }
+
+      if (entry === undefined) return null;
+      return { entry, exits: dangling };
+    });
+  }
+
+  /** Whether a statement node breaks the current straight-line block. */
+  private isControlFlow(stmt: SyntaxNode): boolean {
+    if (stmt.type === 'statement_label') return true; // queue label, emit no block
+    if (this.isDeferCall(stmt)) return true;
+    return CONTROL_FLOW_TYPES.has(stmt.type);
+  }
+
+  /** Dispatch one statement to its handler. Non-null except for empty / label-only. */
+  visitStmt(stmt: SyntaxNode): SeqResult {
+    if (stmt.type === 'statement_label') {
+      // A label preceding its loop/switch — queue it; the construct picks it up.
+      const name = this.labelName(stmt);
+      if (name !== undefined) this.pendingLabels = [...this.pendingLabels, name];
+      return null; // emits no block of its own
+    }
+    if (this.isDeferCall(stmt)) return this.visitDefer(stmt);
+    switch (stmt.type) {
+      case 'if_statement':
+        return this.visitIf(stmt);
+      case 'guard_statement':
+        return this.visitGuard(stmt);
+      case 'for_statement':
+        return this.visitFor(stmt);
+      case 'while_statement':
+        return this.visitWhile(stmt);
+      case 'repeat_while_statement':
+        return this.visitRepeatWhile(stmt);
+      case 'switch_statement':
+        return this.visitSwitch(stmt);
+      case 'do_statement':
+        return this.visitDo(stmt);
+      case 'control_transfer_statement':
+        return this.visitControlTransfer(stmt);
+      case 'statements':
+        return this.visitSeq(this.statementsOf(stmt));
+      default:
+        return this.visitSimple(stmt);
+    }
+  }
+
+  private visitSimple(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    this.wireTryExits(stmt, idx);
+    return { entry: idx, exits: [idx] };
+  }
+
+  // ── control transfer (break / continue / return / throw) ─────────────────
+
+  /** The leading keyword of a `control_transfer_statement` decides its kind. */
+  private transferKeyword(stmt: SyntaxNode): string {
+    const first = stmt.child(0);
+    return first?.text ?? '';
+  }
+
+  private visitControlTransfer(stmt: SyntaxNode): TraversalResult {
+    const kw = this.transferKeyword(stmt);
+    switch (kw) {
+      case 'return':
+        return this.visitReturn(stmt);
+      case 'throw':
+        return this.visitThrow(stmt);
+      case 'break':
+        return this.visitBreak(stmt);
+      case 'continue':
+        return this.visitContinue(stmt);
+      default:
+        // `fallthrough` standalone (rare outside a switch) / unknown — straight
+        // through (the switch handler treats the in-case `fallthrough` keyword).
+        return this.visitSimple(stmt);
+    }
+  }
+
+  /** `return [expr]` — threads through every active `defer` (LIFO) before EXIT. */
+  private visitReturn(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    this.wireTryExits(stmt, idx);
+    wireJumpThroughFinalizers(
+      this.builder,
+      idx,
+      this.cfc.finalizersForReturn(),
+      this.builder.exitIndex,
+      'return',
+    );
+    return { entry: idx, exits: [] };
+  }
+
+  /** `throw e` — routes to the nearest enclosing `catch` handler, else EXIT. */
+  private visitThrow(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      this.harvest.facts(stmt),
+    );
+    this.builder.edge(idx, this.currentHandler(), 'throw');
+    return { entry: idx, exits: [] };
+  }
+
+  private visitBreak(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(startLineOf(stmt), endLineOf(stmt), stmt.text);
+    const label = this.jumpLabel(stmt);
+    const res = this.cfc.resolveBreak(label);
+    const { target, finalizers } = res ?? {
+      target: this.builder.exitIndex,
+      finalizers: this.cfc.finalizersForReturn(),
+    };
+    wireJumpThroughFinalizers(this.builder, idx, finalizers, target, 'break');
+    return { entry: idx, exits: [] };
+  }
+
+  private visitContinue(stmt: SyntaxNode): TraversalResult {
+    const idx = this.builder.newBlock(startLineOf(stmt), endLineOf(stmt), stmt.text);
+    const label = this.jumpLabel(stmt);
+    const res = this.cfc.resolveContinue(label);
+    const { target, finalizers } = res ?? {
+      target: this.builder.exitIndex,
+      finalizers: this.cfc.finalizersForReturn(),
+    };
+    wireJumpThroughFinalizers(this.builder, idx, finalizers, target, 'continue');
+    return { entry: idx, exits: [] };
+  }
+
+  /** The `result` label of a `break outer` / `continue outer`, if any. */
+  private jumpLabel(stmt: SyntaxNode): string | undefined {
+    const result = stmt.childForFieldName('result');
+    return result?.type === 'simple_identifier' ? result.text : undefined;
+  }
+
+  /** The bare name of a `statement_label` (`outer:` ⇒ `outer`). */
+  private labelName(label: SyntaxNode): string | undefined {
+    const id = label.namedChildren.find((c) => c.type === 'simple_identifier');
+    if (id?.text) return id.text;
+    const stripped = label.text.replace(/:\s*$/, '').trim();
+    return stripped || undefined;
+  }
+
+  /** Take and clear the labels queued by a preceding `statement_label`. */
+  private takeLabels(): string[] {
+    const labels = this.pendingLabels;
+    this.pendingLabels = [];
+    return labels;
+  }
+
+  // ── branches ──────────────────────────────────────────────────────────────
+
+  /**
+   * `if COND { … } [else { … } | else if …]`. COND may be a plain expression or
+   * an optional binding (`if let y = opt`). The else is the node AFTER the `else`
+   * keyword — a nested `if_statement` (`else if`) or the else-body `statements`.
+   */
+  private visitIf(stmt: SyntaxNode): TraversalResult {
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      this.conditionEndLine(stmt),
+      this.conditionText(stmt),
+      'normal',
+      this.harvest.conditionFacts(stmt, false),
+    );
+
+    const exits: number[] = [];
+    const thenRes = this.visitBody(this.thenStatements(stmt));
+    if (thenRes) {
+      this.builder.edge(header, thenRes.entry, 'cond-true');
+      exits.push(...thenRes.exits);
+    } else {
+      exits.push(header); // empty then — true path falls through
+    }
+
+    const elseNode = this.elseNodeOf(stmt);
+    if (elseNode) {
+      const elseRes = this.visitBody(elseNode);
+      if (elseRes) {
+        this.builder.edge(header, elseRes.entry, 'cond-false');
+        exits.push(...elseRes.exits);
+      } else {
+        exits.push(header);
+      }
+    } else {
+      exits.push(header); // no else — false path falls through to the join
+    }
+
+    return { entry: header, exits: [...new Set(exits)] };
+  }
+
+  /**
+   * `guard COND else { … }` — the inverse of `if`. The `else` body runs when COND
+   * is false and (per Swift) MUST diverge (return/throw/break/continue); it is
+   * branched with a `cond-false` edge. The guard body CONTINUES straight-line on
+   * the true path (`cond-true`).
+   */
+  private visitGuard(stmt: SyntaxNode): TraversalResult {
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      this.conditionEndLine(stmt),
+      this.conditionText(stmt),
+      'normal',
+      this.harvest.conditionFacts(stmt, false),
+    );
+
+    // The else body is the guard's `statements` (after the `else` keyword).
+    const elseNode = this.elseNodeOf(stmt) ?? this.bodyStatements(stmt);
+    if (elseNode) {
+      const elseRes = this.visitBody(elseNode);
+      if (elseRes) {
+        this.builder.edge(header, elseRes.entry, 'cond-false');
+        // The else MUST diverge; any normal exit it leaves rejoins EXIT-bound
+        // flow conservatively (Swift forbids fall-through, but stay robust).
+        this.builder.connect(elseRes.exits, this.builder.exitIndex, 'seq');
+      } else {
+        this.builder.edge(header, this.builder.exitIndex, 'cond-false');
+      }
+    } else {
+      this.builder.edge(header, this.builder.exitIndex, 'cond-false');
+    }
+
+    // The true path continues straight-line after the guard.
+    return { entry: header, exits: [header] };
+  }
+
+  /** The THEN body `statements` of an `if`/`guard` (the first `statements` child). */
+  private thenStatements(stmt: SyntaxNode): SyntaxNode | undefined {
+    return stmt.namedChildren.find((c) => c.type === 'statements');
+  }
+
+  /** The node after the `else` keyword: a nested `if_statement` or the else `statements`. */
+  private elseNodeOf(stmt: SyntaxNode): SyntaxNode | undefined {
+    let sawElse = false;
+    for (let i = 0; i < stmt.childCount; i++) {
+      const c = stmt.child(i);
+      if (!c) continue;
+      if (sawElse && c.isNamed) return c;
+      if (c.type === 'else') sawElse = true;
+    }
+    return undefined;
+  }
+
+  /** End line of a construct's condition (the last `condition`-field child). */
+  private conditionEndLine(stmt: SyntaxNode): number {
+    let line = startLineOf(stmt);
+    for (let i = 0; i < stmt.childCount; i++) {
+      const field = stmt.fieldNameForChild(i);
+      const c = stmt.child(i);
+      if (c && (field === 'condition' || field === 'bound_identifier')) line = endLineOf(c);
+    }
+    return line;
+  }
+
+  /** Display text for a construct's condition (joined `condition`-field children). */
+  private conditionText(stmt: SyntaxNode): string {
+    const parts: string[] = [];
+    const kw = stmt.child(0);
+    if (kw && !kw.isNamed) parts.push(kw.text);
+    for (let i = 0; i < stmt.childCount; i++) {
+      const field = stmt.fieldNameForChild(i);
+      const c = stmt.child(i);
+      if (c && (field === 'condition' || field === 'bound_identifier')) parts.push(c.text);
+    }
+    return parts.join(' ') || stmt.text;
+  }
+
+  // ── loops ───────────────────────────────────────────────────────────────
+
+  /** `for item in COLLECTION [where …] { … }`. */
+  private visitFor(stmt: SyntaxNode): TraversalResult {
+    const labels = this.takeLabels();
+    const collection = stmt.childForFieldName('collection');
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      collection ? endLineOf(collection) : startLineOf(stmt),
+      this.forHeaderText(stmt),
+      'normal',
+      this.harvest.forHeadFacts(stmt),
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.cfc.pushLoop(header, loopExit, labels);
+    const body = this.visitBody(this.bodyStatements(stmt));
+    this.cfc.pop();
+
+    if (body) {
+      this.builder.edge(header, body.entry, 'cond-true');
+      this.builder.connect(body.exits, header, 'loop-back');
+    } else {
+      this.builder.edge(header, header, 'loop-back'); // empty body re-iterates
+    }
+    this.builder.edge(header, loopExit, 'cond-false');
+    return { entry: header, exits: [loopExit] };
+  }
+
+  private forHeaderText(stmt: SyntaxNode): string {
+    const item = stmt.childForFieldName('item')?.text ?? '';
+    const collection = stmt.childForFieldName('collection')?.text ?? '';
+    return item || collection ? `for ${item} in ${collection}` : 'for';
+  }
+
+  /** `while COND { … }` (and `while let PAT = e { … }`). */
+  private visitWhile(stmt: SyntaxNode): TraversalResult {
+    const labels = this.takeLabels();
+    const header = this.builder.newBlock(
+      startLineOf(stmt),
+      this.conditionEndLine(stmt),
+      this.conditionText(stmt),
+      'normal',
+      this.harvest.conditionFacts(stmt, true),
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.cfc.pushLoop(header, loopExit, labels);
+    const body = this.visitBody(this.bodyStatements(stmt));
+    this.cfc.pop();
+
+    if (body) {
+      this.builder.edge(header, body.entry, 'cond-true');
+      this.builder.connect(body.exits, header, 'loop-back');
+    } else {
+      this.builder.edge(header, header, 'loop-back'); // empty body re-tests
+    }
+    // Structural exit edge — even `while true {}` keeps EXIT reverse-reachable.
+    this.builder.edge(header, loopExit, 'cond-false');
+    return { entry: header, exits: [loopExit] };
+  }
+
+  /**
+   * `repeat { … } while COND` — BOTTOM-TEST: the body runs at least once, THEN
+   * the condition decides whether to loop back. The body entry is the loop entry;
+   * the condition block is the loop-back / exit decision.
+   */
+  private visitRepeatWhile(stmt: SyntaxNode): TraversalResult {
+    const labels = this.takeLabels();
+    const cond = stmt.childForFieldName('condition');
+    const condBlock = this.builder.newBlock(
+      cond ? startLineOf(cond) : endLineOf(stmt),
+      cond ? endLineOf(cond) : endLineOf(stmt),
+      cond ? `while ${cond.text}` : 'while',
+      'normal',
+      cond ? this.harvest.facts(cond) : undefined,
+    );
+    const loopExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    // `continue` re-tests the condition; `break` leaves the loop.
+    this.cfc.pushLoop(condBlock, loopExit, labels);
+    const body = this.visitBody(this.bodyStatements(stmt));
+    this.cfc.pop();
+
+    const backTarget = body ? body.entry : condBlock;
+    if (body) this.builder.connect(body.exits, condBlock, 'seq');
+    this.builder.edge(condBlock, backTarget, 'loop-back'); // cond true → run body again
+    // Structural exit edge — even `repeat {} while true` keeps EXIT reachable.
+    this.builder.edge(condBlock, loopExit, 'cond-false');
+    return { entry: backTarget, exits: [loopExit] };
+  }
+
+  // ── switch ───────────────────────────────────────────────────────────────
+
+  /**
+   * `switch EXPR { case … : … fallthrough? … default: … }`. Cases do NOT fall
+   * through implicitly (the opposite of C); an explicit `fallthrough` keyword at
+   * the end of a `switch_entry` spills into the NEXT entry's body. A `where` guard
+   * on a case is harvested conditionally onto the dispatch block.
+   */
+  private visitSwitch(stmt: SyntaxNode): TraversalResult {
+    const labels = this.takeLabels();
+    const value = stmt.childForFieldName('expr');
+    const dispatch = this.builder.newBlock(
+      startLineOf(stmt),
+      value ? endLineOf(value) : startLineOf(stmt),
+      value ? `switch ${value.text}` : 'switch',
+      'normal',
+      value ? this.harvest.facts(value) : undefined,
+    );
+    const switchExit = this.builder.newBlock(endLineOf(stmt), endLineOf(stmt), '');
+
+    this.cfc.pushSwitch(switchExit, labels);
+    const entries = stmt.namedChildren.filter((c) => c.type === 'switch_entry');
+
+    // A case `where` guard evaluates conditionally before the body — harvest its
+    // uses onto the dispatch block (a later case tests only when earlier ones
+    // didn't match; any def there is a may-def).
+    for (const entry of entries) {
+      // `case let n` value bindings are may-defs on the dispatch block (the case
+      // may not match) — propagated into the body where the name is read.
+      const pat = this.entryPattern(entry);
+      if (pat) this.builder.attachFacts(dispatch, this.harvest.switchPatternFacts(pat));
+      const guard = this.entryGuard(entry);
+      if (guard) this.builder.attachFacts(dispatch, this.harvest.factsConditional(guard));
+    }
+
+    const entryResults = entries.map((e) => this.visitBody(this.entryBody(e)));
+    const hasDefault = entries.some((e) => this.entryIsDefault(e));
+
+    const entryOf: number[] = new Array(entries.length);
+    let after = switchExit;
+    for (let i = entries.length - 1; i >= 0; i--) {
+      entryOf[i] = entryResults[i]?.entry ?? after;
+      after = entryOf[i];
+    }
+
+    for (let i = 0; i < entries.length; i++) {
+      this.builder.edge(dispatch, entryOf[i], 'switch-case');
+    }
+    if (!hasDefault) this.builder.edge(dispatch, switchExit, 'switch-case'); // no-match path
+
+    // A case body rejoins AFTER the switch (no implicit fallthrough) UNLESS the
+    // entry ends in an explicit `fallthrough`, which spills into the next entry.
+    for (let i = 0; i < entries.length; i++) {
+      const res = entryResults[i];
+      if (!res) continue;
+      const fallsThrough = this.entryFallsThrough(entries[i]);
+      const fallTarget = i + 1 < entries.length ? entryOf[i + 1] : switchExit;
+      if (fallsThrough) this.builder.connect(res.exits, fallTarget, 'fallthrough');
+      else this.builder.connect(res.exits, switchExit, 'seq');
+    }
+
+    this.cfc.pop();
+    return { entry: dispatch, exits: [switchExit] };
+  }
+
+  /** The `switch_pattern` of a `switch_entry` (absent for `default:`). */
+  private entryPattern(entry: SyntaxNode): SyntaxNode | undefined {
+    return entry.namedChildren.find((c) => c.type === 'switch_pattern');
+  }
+
+  /** The `where` guard expression of a `switch_entry`, if any. */
+  private entryGuard(entry: SyntaxNode): SyntaxNode | undefined {
+    let sawWhere = false;
+    for (let i = 0; i < entry.childCount; i++) {
+      const c = entry.child(i);
+      if (!c) continue;
+      if (sawWhere && c.isNamed) return c;
+      if (c.type === 'where_keyword') sawWhere = true;
+    }
+    return undefined;
+  }
+
+  /** The body `statements` of a `switch_entry`. */
+  private entryBody(entry: SyntaxNode): SyntaxNode | undefined {
+    return entry.namedChildren.find((c) => c.type === 'statements');
+  }
+
+  private entryIsDefault(entry: SyntaxNode): boolean {
+    return (
+      entry.namedChildren.some((c) => c.type === 'default_keyword') ||
+      entry.children.some((c) => c.type === 'default_keyword')
+    );
+  }
+
+  /** A `switch_entry` ends in an explicit `fallthrough` keyword child. */
+  private entryFallsThrough(entry: SyntaxNode): boolean {
+    for (let i = 0; i < entry.childCount; i++) {
+      if (entry.child(i)?.type === 'fallthrough') return true;
+    }
+    return false;
+  }
+
+  // ── do / catch (error handling) ──────────────────────────────────────────
+
+  /**
+   * `do { … } catch [pat] { … }`. Conservative exceptional flow (mirrors the C++
+   * `try`/`catch` over-approximation): every block created while walking the
+   * protected `do` body edges to the FIRST catch handler — a `try`/`throw` may
+   * fire mid-block. Each `catch_block`'s normal completion joins the post-`do`
+   * continuation.
+   */
+  private visitDo(stmt: SyntaxNode): SeqResult {
+    const bodyNode = stmt.namedChildren.find((c) => c.type === 'statements');
+    const catchBlocks = stmt.namedChildren.filter((c) => c.type === 'catch_block');
+
+    // Build each catch handler. The handler entry is the error-binding block (a
+    // facts-only block) in front of the body, so the binding happens once on entry.
+    const handlerEntries: number[] = [];
+    const handlerExits: number[] = [];
+    for (const clause of catchBlocks) {
+      const clauseBody = clause.namedChildren.find((c) => c.type === 'statements');
+      let res: SeqResult = clauseBody ? this.visitSeq(this.statementsOf(clauseBody)) : null;
+      if (res === null) {
+        // Empty catch body still CATCHES — synthesize one block so the error
+        // lands somewhere and post-`do` code stays reachable.
+        const idx = this.builder.newBlock(startLineOf(clause), endLineOf(clause), '');
+        res = { entry: idx, exits: [idx] };
+      }
+      const errFacts = this.harvest.catchErrorFacts(clause);
+      if (errFacts) {
+        const errBlock = this.builder.newBlock(
+          startLineOf(clause),
+          startLineOf(clause),
+          '',
+          'normal',
+          errFacts,
+        );
+        this.builder.edge(errBlock, res.entry, 'seq');
+        res = { entry: errBlock, exits: res.exits };
+      }
+      handlerEntries.push(res.entry);
+      handlerExits.push(...res.exits);
+    }
+
+    // The protected body's handler is the FIRST catch (if any), else the outer.
+    const doHandler = handlerEntries[0] ?? this.currentHandler();
+    const protectedStart = this.builder.blockCount;
+    this.handlers.push(doHandler);
+    const bodyRes = bodyNode ? this.visitSeq(this.statementsOf(bodyNode)) : null;
+    this.handlers.pop();
+
+    // Conservative exceptional edges: every protected-region block → EACH catch
+    // handler. Swift tries the catch clauses in order until one matches; the
+    // thrown type is unknown at CFG time, so any protected block may reach ANY
+    // clause. Edging only the first handler orphaned the 2nd..Nth catch blocks
+    // (unreachable from ENTRY, stranding their error bindings + def/use facts).
+    if (handlerEntries.length > 0) {
+      for (let b = protectedStart; b < this.builder.blockCount; b++) {
+        for (const handler of handlerEntries) this.builder.edge(b, handler, 'throw');
+      }
+    }
+
+    const exits: number[] = [];
+    if (bodyRes) exits.push(...bodyRes.exits);
+    exits.push(...handlerExits);
+    // No catch at all — a `do {}` without `catch` is just a scope: the body
+    // flows straight through to its own normal exits (no extra edge needed).
+
+    const entry = bodyRes?.entry ?? handlerEntries[0];
+    if (entry === undefined) return null;
+    return { entry, exits: [...new Set(exits)] };
+  }
+
+  /** Nearest enclosing `catch` handler, or the function EXIT. */
+  private currentHandler(): number {
+    return this.handlers.length ? this.handlers[this.handlers.length - 1] : this.builder.exitIndex;
+  }
+
+  /**
+   * Emit a `throw` edge to the nearest handler (or EXIT) for every `try`/`try?`/
+   * `try!` operator inside a straight-line statement's subtree (excluding nested
+   * function bodies). A `try` can propagate an error mid-statement; routing it
+   * keeps the error path represented while the success path falls through.
+   * Deduped by the builder, so repeated `try` in a statement emit one edge.
+   */
+  private wireTryExits(stmt: SyntaxNode, fromBlock: number): void {
+    if (this.containsTry(stmt)) this.builder.edge(fromBlock, this.currentHandler(), 'throw');
+  }
+
+  private containsTry(node: SyntaxNode): boolean {
+    if (node.type === 'try_expression') {
+      // `try?` / `try!` handle the error in-place (optional / trap), so only a
+      // bare `try` propagates — but conservatively any `try` may error in a
+      // throwing context; route all to the handler (deduped, low cost).
+      return true;
+    }
+    if (SWIFT_FUNCTION_TYPES.has(node.type)) return false; // opaque nested fn
+    for (let i = 0; i < node.namedChildCount; i++) {
+      const c = node.namedChild(i);
+      if (c && this.containsTry(c)) return true;
+    }
+    return false;
+  }
+
+  // ── defer ──────────────────────────────────────────────────────────────
+
+  /**
+   * `defer { … }` is parsed as a `call_expression` whose callee is a bare
+   * `defer` identifier carrying a trailing-closure `lambda_literal`. Detect that
+   * exact shape so the deferred body threads the function-exit completion chain.
+   */
+  private isDeferCall(stmt: SyntaxNode): boolean {
+    if (stmt.type !== 'call_expression') return false;
+    const callee = stmt.namedChild(0);
+    if (!callee || callee.type !== 'simple_identifier' || callee.text !== 'defer') return false;
+    return this.deferClosure(stmt) !== undefined;
+  }
+
+  /** The trailing-closure `lambda_literal` body of a `defer { … }` call. */
+  private deferClosure(stmt: SyntaxNode): SyntaxNode | undefined {
+    for (let i = 0; i < stmt.namedChildCount; i++) {
+      const c = stmt.namedChild(i);
+      if (c?.type === 'call_suffix') {
+        const lambda = c.namedChildren.find((x) => x.type === 'lambda_literal');
+        if (lambda) return lambda;
+      }
+      if (c?.type === 'lambda_literal') return c;
+    }
+    return undefined;
+  }
+
+  /**
+   * `defer { … }` — register the deferred body as a finalizer frame that stays
+   * active for the rest of the function tail (mirrors the Go visitor). Every later
+   * `return` AND the normal fall-off thread through it; LIFO across multiple
+   * defers falls out of `finalizersForReturn()` yielding innermost-first. The
+   * deferred block carries the closure body's def/use facts. The `defer` itself is
+   * a no-op at its source position — control falls straight through.
+   */
+  private visitDefer(stmt: SyntaxNode): TraversalResult {
+    const lambda = this.deferClosure(stmt);
+    const deferBlock = this.builder.newBlock(
+      startLineOf(stmt),
+      endLineOf(stmt),
+      stmt.text,
+      'normal',
+      lambda ? this.harvest.facts(lambda) : undefined,
+    );
+    const frame = this.cfc.pushFinalizer(deferBlock);
+    this.deferFrames.push(frame);
+    // The `defer` statement is a no-op inline — return a SEPARATE marker block as
+    // the source position so the deferred block stays out of straight-line flow.
+    const marker = this.builder.newBlock(startLineOf(stmt), startLineOf(stmt), '');
+    return { entry: marker, exits: [marker] };
+  }
+
+  /**
+   * Drain the active `defer` chain at function end (mirrors the Go visitor). The
+   * chain runs innermost-first (LIFO). Returns the block set control reaches AFTER
+   * the whole defer chain runs (to be wired to EXIT by the caller), or
+   * `normalExits` unchanged when there are no defers.
+   */
+  finishDefers(normalExits: readonly number[]): readonly number[] {
+    if (this.deferFrames.length === 0) return normalExits;
+    const lifo = [...this.deferFrames].reverse();
+    for (let i = 0; i < lifo.length; i++) this.cfc.pop();
+    for (const frame of lifo) drainFinalizerPending(this.builder, frame, [frame.entry]);
+
+    if (normalExits.length > 0) {
+      this.builder.connect(normalExits, lifo[0].entry, 'return');
+      for (let i = 0; i + 1 < lifo.length; i++) {
+        this.builder.edge(lifo[i].entry, lifo[i + 1].entry, 'finally-return');
+      }
+    }
+    return [lifo[lifo.length - 1].entry];
+  }
+}
+
+/** Build the CFG for one Swift function node, or `undefined` if not modelable. */
+function buildFunctionCfg(fnNode: SyntaxNode, filePath: string): FunctionCfg | undefined {
+  try {
+    if (!SWIFT_FUNCTION_TYPES.has(fnNode.type)) return undefined;
+    const startLine = startLineOf(fnNode);
+    const endLine = endLineOf(fnNode);
+    const startColumn = fnNode.startPosition.column;
+
+    // A function/init/deinit must own a `function_body`; a lambda owns its
+    // `statements` directly. Absence ⇒ a protocol requirement / signature-only
+    // declaration with no body to model (return undefined). A PRESENT-but-empty
+    // body is a valid empty function (ENTRY → EXIT), distinct from "no body".
+    const hasBodyContainer =
+      fnNode.childForFieldName('body') !== null ||
+      fnNode.namedChildren.some((c) => c.type === 'function_body') ||
+      (fnNode.type === 'lambda_literal' &&
+        fnNode.namedChildren.some((c) => c.type === 'statements')) ||
+      fnNode.type === 'lambda_literal';
+    if (!hasBodyContainer) return undefined;
+
+    const body = bodyStatementsOf(fnNode); // may be undefined for an empty body
+
+    const builder = new CfgBuilder(filePath, startLine, endLine, startColumn);
+    const harvest = new SwiftHarvester(fnNode);
+
+    const paramFacts = harvest.paramFacts();
+    if (paramFacts) builder.attachFacts(builder.entryIndex, paramFacts);
+
+    const walk = new SwiftCfgWalk(builder, harvest);
+    const res = body
+      ? walk.visitSeq(
+          body.namedChildren.filter((c) => c.type !== 'comment' && c.type !== 'multiline_comment'),
+        )
+      : null;
+
+    builder.edge(builder.entryIndex, res ? res.entry : builder.exitIndex, 'seq');
+    // Normal fall-off threads through the active `defer` chain (LIFO) → EXIT.
+    const normalExits = res ? res.exits : [builder.entryIndex];
+    const afterDefers = walk.finishDefers(normalExits);
+    builder.connect(afterDefers, builder.exitIndex, 'seq');
+    return builder.finish(harvest.bindingTable());
+  } catch (err) {
+    // Never throw out of buildFunctionCfg — a malformed AST shape must skip only
+    // this one function's CFG, never drop the whole file's language group (R4).
+    // eslint-disable-next-line no-console
+    console.warn(`[cfg] Swift buildFunctionCfg skipped a function in ${filePath}: ${String(err)}`);
+    return undefined;
+  }
+}
+
+/**
+ * The function's body `statements` node. A `function_declaration` / `init_` /
+ * `deinit_declaration` wraps it in a `function_body`; a `lambda_literal` carries
+ * the `statements` directly (after an optional `lambda_function_type` + `in`).
+ */
+function bodyStatementsOf(fnNode: SyntaxNode): SyntaxNode | undefined {
+  const fb =
+    fnNode.childForFieldName('body') ??
+    fnNode.namedChildren.find((c) => c.type === 'function_body');
+  if (fb && fb.type === 'function_body') {
+    return fb.namedChildren.find((c) => c.type === 'statements');
+  }
+  if (fnNode.type === 'lambda_literal') {
+    return fnNode.namedChildren.find((c) => c.type === 'statements');
+  }
+  return undefined;
+}
+
+/** Whether a node is a Swift function/closure this visitor builds a CFG for. */
+function isFunction(node: SyntaxNode): boolean {
+  return SWIFT_FUNCTION_TYPES.has(node.type);
+}
+
+/** The Swift CFG visitor. */
+export function createSwiftCfgVisitor(): CfgVisitor<SyntaxNode> {
+  return { buildFunctionCfg, isFunction };
+}
+
+export { SWIFT_FUNCTION_TYPES };
diff --git a/gitnexus/src/core/ingestion/cfg/visitors/typescript.ts b/gitnexus/src/core/ingestion/cfg/visitors/typescript.ts
index 1382fdb66..43676591b 100644
--- a/gitnexus/src/core/ingestion/cfg/visitors/typescript.ts
+++ b/gitnexus/src/core/ingestion/cfg/visitors/typescript.ts
@@ -76,8 +76,6 @@ const TS_FUNCTION_TYPES = new Set([
   'method_definition',
   'generator_function_declaration',
   'generator_function',
-  'async_function_declaration',
-  'async_arrow_function',
 ]);
 
 /** Statement node types that break a basic block (everything else coalesces). */
@@ -87,7 +85,6 @@ const CONTROL_FLOW_TYPES = new Set([
   'do_statement',
   'for_statement',
   'for_in_statement',
-  'for_of_statement',
   'switch_statement',
   'try_statement',
   'return_statement',
@@ -103,7 +100,6 @@ const LOOP_OR_SWITCH_TYPES = new Set([
   'do_statement',
   'for_statement',
   'for_in_statement',
-  'for_of_statement',
   'switch_statement',
 ]);
 
@@ -146,52 +142,56 @@ class TsCfgWalk {
 
   /** Visit a body that may be a `statement_block` or a single statement. */
   private visitBody(node: SyntaxNode | undefined | null): SeqResult {
-    if (!node) return null;
-    if (node.type === 'statement_block') return this.visitSeq(this.statementsOf(node));
-    return this.visitStmt(node);
+    return this.builder.withNesting(() => {
+      if (!node) return null;
+      if (node.type === 'statement_block') return this.visitSeq(this.statementsOf(node));
+      return this.visitStmt(node);
+    });
   }
 
   /** Wire a sequence of statements, coalescing straight-line runs into blocks. */
   visitSeq(stmts: SyntaxNode[]): SeqResult {
-    let entry: number | undefined;
-    let dangling: number[] = [];
-    let openSimple: number | undefined;
+    return this.builder.withNesting(() => {
+      let entry: number | undefined;
+      let dangling: number[] = [];
+      let openSimple: number | undefined;
 
-    for (const stmt of stmts) {
-      if (CONTROL_FLOW_TYPES.has(stmt.type)) {
-        openSimple = undefined; // close any open straight-line block
-        const res = this.visitStmt(stmt);
-        if (res === null) continue; // transparent (empty nested block)
-        if (entry === undefined) entry = res.entry;
-        else this.builder.connect(dangling, res.entry, 'seq');
-        dangling = [...res.exits];
-      } else {
-        // Simple statement — coalesce into the current straight-line block.
-        if (openSimple === undefined) {
-          const idx = this.builder.newBlock(
-            startLineOf(stmt),
-            endLineOf(stmt),
-            stmt.text,
-            'normal',
-            this.harvest.facts(stmt),
-          );
-          if (entry === undefined) entry = idx;
-          else this.builder.connect(dangling, idx, 'seq');
-          openSimple = idx;
-          dangling = [idx];
+      for (const stmt of stmts) {
+        if (CONTROL_FLOW_TYPES.has(stmt.type)) {
+          openSimple = undefined; // close any open straight-line block
+          const res = this.visitStmt(stmt);
+          if (res === null) continue; // transparent (empty nested block)
+          if (entry === undefined) entry = res.entry;
+          else this.builder.connect(dangling, res.entry, 'seq');
+          dangling = [...res.exits];
         } else {
-          this.builder.extendBlock(
-            openSimple,
-            endLineOf(stmt),
-            stmt.text,
-            this.harvest.facts(stmt),
-          );
+          // Simple statement — coalesce into the current straight-line block.
+          if (openSimple === undefined) {
+            const idx = this.builder.newBlock(
+              startLineOf(stmt),
+              endLineOf(stmt),
+              stmt.text,
+              'normal',
+              this.harvest.facts(stmt),
+            );
+            if (entry === undefined) entry = idx;
+            else this.builder.connect(dangling, idx, 'seq');
+            openSimple = idx;
+            dangling = [idx];
+          } else {
+            this.builder.extendBlock(
+              openSimple,
+              endLineOf(stmt),
+              stmt.text,
+              this.harvest.facts(stmt),
+            );
+          }
         }
       }
-    }
 
-    if (entry === undefined) return null;
-    return { entry, exits: dangling };
+      if (entry === undefined) return null;
+      return { entry, exits: dangling };
+    });
   }
 
   /** Dispatch one statement to its handler. Non-null except for empty blocks. */
@@ -206,7 +206,6 @@ class TsCfgWalk {
       case 'for_statement':
         return this.visitFor(stmt);
       case 'for_in_statement':
-      case 'for_of_statement':
         return this.visitForIn(stmt);
       case 'switch_statement':
         return this.visitSwitch(stmt);
diff --git a/gitnexus/src/core/ingestion/languages/c-cpp.ts b/gitnexus/src/core/ingestion/languages/c-cpp.ts
index 3d427fed8..172bea0cd 100644
--- a/gitnexus/src/core/ingestion/languages/c-cpp.ts
+++ b/gitnexus/src/core/ingestion/languages/c-cpp.ts
@@ -70,6 +70,7 @@ import {
   type CppConstraintPayload,
 } from './cpp/constraint-extractor.js';
 import { assertCloneable } from '../workers/clone-safety.js';
+import { createCCfgVisitor, createCppCfgVisitor } from '../cfg/visitors/c-cpp.js';
 
 const C_BUILT_INS: ReadonlySet<string> = new Set([
   'printf',
@@ -401,6 +402,7 @@ export const cProvider = defineLanguage({
 
   // ── RFC #909 Ring 3: scope-based resolution hooks (RFC §5) ──────────
   emitScopeCaptures: emitCScopeCaptures,
+  cfgVisitor: createCCfgVisitor(),
   // Worker-side: snapshot the module-level `static`-linkage marks
   // `emitCScopeCaptures` just populated for this file (`markStaticName` →
   // `staticNames`) into plain data on `ParsedFile.captureSideChannel`, so the
@@ -484,6 +486,7 @@ export const cppProvider = defineLanguage({
 
   // ── RFC #909 Ring 3: scope-based resolution hooks (RFC §5) ──────────
   emitScopeCaptures: emitCppScopeCaptures,
+  cfgVisitor: createCppCfgVisitor(),
   // Worker-side: snapshot the module-level capture marks `emitCppScopeCaptures`
   // just populated for this file into plain data on `ParsedFile.captureSideChannel`,
   // so the main thread can restore them via `applyCaptureSideChannel` WITHOUT a
diff --git a/gitnexus/src/core/ingestion/languages/cobol.ts b/gitnexus/src/core/ingestion/languages/cobol.ts
index a28f87a8f..44891cef4 100644
--- a/gitnexus/src/core/ingestion/languages/cobol.ts
+++ b/gitnexus/src/core/ingestion/languages/cobol.ts
@@ -34,6 +34,11 @@ export const cobolProvider = defineLanguage({
   exportChecker: () => false,
   importResolver: () => null,
 
+  // No `cfgVisitor`: COBOL is the deliberate non-goal of the PDG-language
+  // rollout (#2195). There is no installed tree-sitter grammar and COBOL's
+  // PERFORM / GO-TO control flow is exotic; the worker's `provider.cfgVisitor &&`
+  // gate therefore emits no CFG/PDG layer for COBOL (see worker-roundtrip.test.ts).
+
   // ── Scope-resolution hooks ───────────────────────────────────────
   emitScopeCaptures: emitCobolScopeCaptures,
   interpretImport: interpretCobolImport,
diff --git a/gitnexus/src/core/ingestion/languages/csharp.ts b/gitnexus/src/core/ingestion/languages/csharp.ts
index 870c6c862..612e33fdb 100644
--- a/gitnexus/src/core/ingestion/languages/csharp.ts
+++ b/gitnexus/src/core/ingestion/languages/csharp.ts
@@ -24,6 +24,7 @@ import { createMethodExtractor } from '../method-extractors/generic.js';
 import { csharpMethodConfig } from '../method-extractors/configs/csharp.js';
 import { createVariableExtractor } from '../variable-extractors/generic.js';
 import { csharpVariableConfig } from '../variable-extractors/configs/csharp.js';
+import { createCsharpCfgVisitor } from '../cfg/visitors/csharp.js';
 import {
   emitCsharpScopeCaptures,
   interpretCsharpImport,
@@ -200,6 +201,7 @@ export const csharpProvider = defineLanguage({
   // the full per-hook rationale and the canonical capture vocabulary
   // in ./csharp/query.ts (CSHARP_SCOPE_QUERY constant).
   emitScopeCaptures: emitCsharpScopeCaptures,
+  cfgVisitor: createCsharpCfgVisitor(),
   interpretImport: interpretCsharpImport,
   interpretTypeBinding: interpretCsharpTypeBinding,
   bindingScopeFor: csharpBindingScopeFor,
diff --git a/gitnexus/src/core/ingestion/languages/dart.ts b/gitnexus/src/core/ingestion/languages/dart.ts
index e79ad4708..b2a71ec81 100644
--- a/gitnexus/src/core/ingestion/languages/dart.ts
+++ b/gitnexus/src/core/ingestion/languages/dart.ts
@@ -22,6 +22,7 @@ import { dartExportChecker } from '../export-detection.js';
 import { createImportResolver } from '../import-resolvers/resolver-factory.js';
 import { dartImportConfig } from '../import-resolvers/configs/dart.js';
 import { DART_QUERIES } from '../tree-sitter-queries.js';
+import { createDartCfgVisitor } from '../cfg/visitors/dart.js';
 import { createFieldExtractor } from '../field-extractors/generic.js';
 import { dartConfig as dartFieldConfig } from '../field-extractors/configs/dart.js';
 import { createMethodExtractor } from '../method-extractors/generic.js';
@@ -131,6 +132,7 @@ export const dartProvider = defineLanguage({
   // emit-side `ScopeResolver` lives in `dart/scope-resolver.ts`; the same
   // function references flow through both interfaces.
   emitScopeCaptures: emitDartScopeCaptures,
+  cfgVisitor: createDartCfgVisitor(),
   interpretImport: interpretDartImport,
   interpretTypeBinding: interpretDartTypeBinding,
   bindingScopeFor: dartBindingScopeFor,
diff --git a/gitnexus/src/core/ingestion/languages/go.ts b/gitnexus/src/core/ingestion/languages/go.ts
index 2b9b85a52..039a04693 100644
--- a/gitnexus/src/core/ingestion/languages/go.ts
+++ b/gitnexus/src/core/ingestion/languages/go.ts
@@ -11,6 +11,7 @@
 import { SupportedLanguages } from 'gitnexus-shared';
 import { createClassExtractor } from '../class-extractors/generic.js';
 import { goClassConfig } from '../class-extractors/configs/go.js';
+import { createGoCfgVisitor } from '../cfg/visitors/go.js';
 import { defineLanguage } from '../language-provider.js';
 import { typeConfig as goConfig } from '../type-extractors/go.js';
 import { goExportChecker } from '../export-detection.js';
@@ -141,6 +142,7 @@ export const goProvider = defineLanguage({
 
   // ── RFC #909 Ring 3: scope-based resolution hooks ──────────
   emitScopeCaptures: emitGoScopeCaptures,
+  cfgVisitor: createGoCfgVisitor(),
   interpretImport: interpretGoImport,
   interpretTypeBinding: interpretGoTypeBinding,
   bindingScopeFor: goBindingScopeFor,
diff --git a/gitnexus/src/core/ingestion/languages/java.ts b/gitnexus/src/core/ingestion/languages/java.ts
index f7ca23de3..22b9a48a3 100644
--- a/gitnexus/src/core/ingestion/languages/java.ts
+++ b/gitnexus/src/core/ingestion/languages/java.ts
@@ -26,6 +26,7 @@ import { createMethodExtractor } from '../method-extractors/generic.js';
 import { javaMethodConfig } from '../method-extractors/configs/jvm.js';
 import { createVariableExtractor } from '../variable-extractors/generic.js';
 import { javaVariableConfig } from '../variable-extractors/configs/jvm.js';
+import { createJavaCfgVisitor } from '../cfg/visitors/java.js';
 import type { SymbolDefinition } from 'gitnexus-shared';
 import {
   emitJavaScopeCaptures,
@@ -118,6 +119,9 @@ export const javaProvider = defineLanguage({
 
   // ── RFC #909 Ring 3: scope-based resolution hooks ──
   emitScopeCaptures: emitJavaScopeCaptures,
+
+  // ── PDG: per-function CFG + def/use harvest (#2195 U4) ──
+  cfgVisitor: createJavaCfgVisitor(),
   interpretImport: interpretJavaImport,
   interpretTypeBinding: interpretJavaTypeBinding,
   bindingScopeFor: javaBindingScopeFor,
diff --git a/gitnexus/src/core/ingestion/languages/kotlin.ts b/gitnexus/src/core/ingestion/languages/kotlin.ts
index 4cf87a76f..d4999d022 100644
--- a/gitnexus/src/core/ingestion/languages/kotlin.ts
+++ b/gitnexus/src/core/ingestion/languages/kotlin.ts
@@ -22,6 +22,7 @@ import type { AstFrameworkPatternConfig } from '../language-provider.js';
 import type { SyntaxNode } from '../utils/ast-helpers.js';
 import { createCallExtractor } from '../call-extractors/generic.js';
 import { kotlinCallConfig } from '../call-extractors/configs/jvm.js';
+import { createKotlinCfgVisitor } from '../cfg/visitors/kotlin.js';
 import { createFieldExtractor } from '../field-extractors/generic.js';
 import { kotlinConfig } from '../field-extractors/configs/jvm.js';
 import { createMethodExtractor } from '../method-extractors/generic.js';
@@ -177,6 +178,8 @@ export const kotlinProvider = defineLanguage({
 
   // ── RFC #909 Ring 3: scope-based resolution hooks ──
   emitScopeCaptures: emitKotlinScopeCaptures,
+  // ── #2195 PDG layer: Kotlin CFG visitor (vendored grammar) ──
+  cfgVisitor: createKotlinCfgVisitor(),
   // Worker-side: snapshot the module-level companion-scope marks
   // `emitKotlinScopeCaptures` just populated for this file (`markCompanionScope`
   // → `companionScopesByFile`) into plain data on `ParsedFile.captureSideChannel`,
diff --git a/gitnexus/src/core/ingestion/languages/php.ts b/gitnexus/src/core/ingestion/languages/php.ts
index 9b3aabec6..c58db55ad 100644
--- a/gitnexus/src/core/ingestion/languages/php.ts
+++ b/gitnexus/src/core/ingestion/languages/php.ts
@@ -20,6 +20,7 @@ import {
 import { SupportedLanguages } from 'gitnexus-shared';
 import { createClassExtractor } from '../class-extractors/generic.js';
 import { phpClassConfig } from '../class-extractors/configs/php.js';
+import { createPhpCfgVisitor } from '../cfg/visitors/php.js';
 import { defineLanguage, type AstFrameworkPatternConfig } from '../language-provider.js';
 import { typeConfig as phpConfig } from '../type-extractors/php.js';
 import { phpExportChecker } from '../export-detection.js';
@@ -297,6 +298,7 @@ export const phpProvider = defineLanguage({
   builtInNames: BUILT_INS,
   // ── RFC #909 Ring 3: scope-based resolution hooks ──────────────────────
   emitScopeCaptures: emitPhpScopeCaptures,
+  cfgVisitor: createPhpCfgVisitor(),
   interpretImport: interpretPhpImport,
   interpretTypeBinding: interpretPhpTypeBinding,
   // LanguageProvider uses (def, callsite); phpArityCompatibility uses (def, callsite) — same.
diff --git a/gitnexus/src/core/ingestion/languages/python.ts b/gitnexus/src/core/ingestion/languages/python.ts
index 67eeca7e0..8ce49accd 100644
--- a/gitnexus/src/core/ingestion/languages/python.ts
+++ b/gitnexus/src/core/ingestion/languages/python.ts
@@ -27,6 +27,7 @@ import { createVariableExtractor } from '../variable-extractors/generic.js';
 import { pythonVariableConfig } from '../variable-extractors/configs/python.js';
 import { createCallExtractor } from '../call-extractors/generic.js';
 import { pythonCallConfig } from '../call-extractors/configs/python.js';
+import { createPythonCfgVisitor } from '../cfg/visitors/python.js';
 import type { CaptureMap } from '../language-provider.js';
 import type { SyntaxNode } from '../utils/ast-helpers.js';
 import {
@@ -137,6 +138,7 @@ export const pythonProvider = defineLanguage({
   // full per-hook rationale and the canonical capture vocabulary in
   // ./python/query.ts (PYTHON_SCOPE_QUERY constant).
   emitScopeCaptures: emitPythonScopeCaptures,
+  cfgVisitor: createPythonCfgVisitor(),
   interpretImport: interpretPythonImport,
   interpretTypeBinding: interpretPythonTypeBinding,
   bindingScopeFor: pythonBindingScopeFor,
diff --git a/gitnexus/src/core/ingestion/languages/ruby.ts b/gitnexus/src/core/ingestion/languages/ruby.ts
index a5101bfcf..d8f340472 100644
--- a/gitnexus/src/core/ingestion/languages/ruby.ts
+++ b/gitnexus/src/core/ingestion/languages/ruby.ts
@@ -28,6 +28,7 @@ import { createVariableExtractor } from '../variable-extractors/generic.js';
 import { rubyVariableConfig } from '../variable-extractors/configs/ruby.js';
 import { createCallExtractor } from '../call-extractors/generic.js';
 import { rubyCallConfig } from '../call-extractors/configs/ruby.js';
+import { createRubyCfgVisitor } from '../cfg/visitors/ruby.js';
 import {
   emitRubyScopeCaptures,
   rubyArityCompatibility,
@@ -205,6 +206,7 @@ export const rubyProvider = defineLanguage({
   builtInNames: BUILT_INS,
   // ── RFC #909 Ring 3: scope-based resolution hooks ──────────
   emitScopeCaptures: emitRubyScopeCaptures,
+  cfgVisitor: createRubyCfgVisitor(),
   interpretImport: interpretRubyImport,
   interpretTypeBinding: interpretRubyTypeBinding,
   bindingScopeFor: rubyBindingScopeFor,
diff --git a/gitnexus/src/core/ingestion/languages/rust.ts b/gitnexus/src/core/ingestion/languages/rust.ts
index 9f1bbc7ae..a0102c334 100644
--- a/gitnexus/src/core/ingestion/languages/rust.ts
+++ b/gitnexus/src/core/ingestion/languages/rust.ts
@@ -28,6 +28,7 @@ import { createVariableExtractor } from '../variable-extractors/generic.js';
 import { rustVariableConfig } from '../variable-extractors/configs/rust.js';
 import { createCallExtractor } from '../call-extractors/generic.js';
 import { rustCallConfig } from '../call-extractors/configs/rust.js';
+import { createRustCfgVisitor } from '../cfg/visitors/rust.js';
 import {
   emitRustScopeCaptures,
   rustArityCompatibility,
@@ -178,6 +179,7 @@ export const rustProvider = defineLanguage({
   builtInNames: BUILT_INS,
   // ── RFC #909 Ring 3: scope-based resolution hooks ──────────
   emitScopeCaptures: emitRustScopeCaptures,
+  cfgVisitor: createRustCfgVisitor(),
   interpretImport: interpretRustImport,
   interpretTypeBinding: interpretRustTypeBinding,
   bindingScopeFor: rustBindingScopeFor,
diff --git a/gitnexus/src/core/ingestion/languages/swift.ts b/gitnexus/src/core/ingestion/languages/swift.ts
index 9c6d9974e..02a7b89e8 100644
--- a/gitnexus/src/core/ingestion/languages/swift.ts
+++ b/gitnexus/src/core/ingestion/languages/swift.ts
@@ -25,6 +25,7 @@ import { createVariableExtractor } from '../variable-extractors/generic.js';
 import { swiftVariableConfig } from '../variable-extractors/configs/swift.js';
 import { createCallExtractor } from '../call-extractors/generic.js';
 import { swiftCallConfig } from '../call-extractors/configs/swift.js';
+import { createSwiftCfgVisitor } from '../cfg/visitors/swift.js';
 import {
   emitSwiftScopeCaptures,
   interpretSwiftImport,
@@ -247,6 +248,7 @@ export const swiftProvider = defineLanguage({
   // ── Scope-based resolution hooks (RFC #909 Ring 3, issue #937). See
   //    languages/swift/ for the implementations. ──────────────────────
   emitScopeCaptures: emitSwiftScopeCaptures,
+  cfgVisitor: createSwiftCfgVisitor(),
   interpretImport: interpretSwiftImport,
   interpretTypeBinding: interpretSwiftTypeBinding,
   bindingScopeFor: swiftBindingScopeFor,
diff --git a/gitnexus/src/core/ingestion/languages/vue.ts b/gitnexus/src/core/ingestion/languages/vue.ts
index 08c085298..d6493a950 100644
--- a/gitnexus/src/core/ingestion/languages/vue.ts
+++ b/gitnexus/src/core/ingestion/languages/vue.ts
@@ -37,6 +37,7 @@ import {
   resolveTsImportTarget,
 } from './typescript/index.js';
 import { emitVueScopeCaptures } from './vue/captures.js';
+import { createTypeScriptCfgVisitor } from '../cfg/visitors/typescript.js';
 
 const VUE_SPECIFIC_BUILT_INS = [
   'ref',
@@ -88,6 +89,11 @@ export const vueProvider = defineLanguage({
   variableExtractor: createVariableExtractor(typescriptVariableConfig),
   classExtractor: vueClassExtractor,
   builtInNames: VUE_BUILT_INS,
+  // Vue SFC <script> blocks are extracted and parsed with the TypeScript
+  // grammar (parse-worker GRAMMAR_BY_LANGUAGE[Vue] = TypeScript.typescript),
+  // so the TS CFG visitor builds CFGs for the script's functions verbatim —
+  // no Vue-specific visitor needed (#2195).
+  cfgVisitor: createTypeScriptCfgVisitor(),
   // Scope-resolution pipeline hooks (RFC #909 Ring 3)
   emitScopeCaptures: emitVueScopeCaptures,
   interpretImport: interpretTsImport,
diff --git a/gitnexus/src/core/ingestion/parsing-processor.ts b/gitnexus/src/core/ingestion/parsing-processor.ts
index 815099674..6b087ab55 100644
--- a/gitnexus/src/core/ingestion/parsing-processor.ts
+++ b/gitnexus/src/core/ingestion/parsing-processor.ts
@@ -8,6 +8,7 @@ import { accumulateExportedTypesFromParsedNode, type ExportedTypeMap } from './c
 import type { ParsedFile } from 'gitnexus-shared';
 import { WorkerPool } from './workers/worker-pool.js';
 import type { SkippedPath } from './workers/clone-safety.js';
+import type { CfgSkipCounts } from './cfg/collect.js';
 import { logger } from '../logger.js';
 import type {
   ParseWorkerResult,
@@ -198,6 +199,31 @@ export const dispatchChunkParse = async (
     logger.warn(`  Skipped unsupported languages: ${summary}`);
   }
 
+  // Per-language CFG skip telemetry (#2195): functions skipped during the worker
+  // CFG walk, bucketed by reason. Only surfaced for a `--pdg` run (otherwise
+  // `cfgSkipped` is empty). Warn ONLY when a robustness-relevant bucket
+  // (too-deeply-nested / build-error) is non-zero — a too-many-lines skip is the
+  // expected, benign minified/generated-code case and would otherwise be spam.
+  const cfgSkipped = new Map<string, CfgSkipCounts>();
+  for (const result of chunkResults) {
+    for (const [lang, counts] of Object.entries(result.cfgSkipped ?? {})) {
+      const prev = cfgSkipped.get(lang) ?? { tooManyLines: 0, tooDeeplyNested: 0, buildError: 0 };
+      cfgSkipped.set(lang, {
+        tooManyLines: prev.tooManyLines + counts.tooManyLines,
+        tooDeeplyNested: prev.tooDeeplyNested + counts.tooDeeplyNested,
+        buildError: prev.buildError + counts.buildError,
+      });
+    }
+  }
+  for (const [lang, c] of cfgSkipped) {
+    if (c.tooDeeplyNested > 0 || c.buildError > 0) {
+      logger.warn(
+        `  CFG functions skipped (${lang}): ${c.tooDeeplyNested} too-deeply-nested, ` +
+          `${c.buildError} build-error(s), ${c.tooManyLines} over line cap`,
+      );
+    }
+  }
+
   // Clone-safety telemetry (#2112): files whose parse output carried a value
   // the structured-clone algorithm couldn't serialize across the worker
   // boundary. The worker sanitized/dropped the offending value so the run
diff --git a/gitnexus/src/core/ingestion/scope-resolution/pipeline/run.ts b/gitnexus/src/core/ingestion/scope-resolution/pipeline/run.ts
index 733f76be3..aa30c2416 100644
--- a/gitnexus/src/core/ingestion/scope-resolution/pipeline/run.ts
+++ b/gitnexus/src/core/ingestion/scope-resolution/pipeline/run.ts
@@ -778,6 +778,7 @@ export function runScopeResolution(
     let rdTruncated = 0;
     let cdgEdges = 0;
     let cdgDropped = 0;
+    let cdgSkippedUnsound = 0;
     // ── M3 taint setup (#2083 U4) ────────────────────────────────────────
     // Explicit model-registration seam (idempotent, cheap) — the registry
     // stays empty on non-pdg runs, preserving default-run parity. The
@@ -899,6 +900,7 @@ export function runScopeResolution(
         if (PROF) pdgMs += performance.now() - tCdg;
         cdgEdges += cdg.edges;
         cdgDropped += cdg.droppedEdges;
+        cdgSkippedUnsound += cdg.skippedUnsoundFunctions;
 
         // M3 (#2083 U4): taint over the SAME validated CFGs, inside the SAME
         // per-file try (a taint throw costs this file's taint layer only —
@@ -975,6 +977,9 @@ export function runScopeResolution(
           (rdTruncated > 0 ? `, ${rdTruncated} function(s) hit the fact limit` : '') +
           `; ${cdgEdges} CDG edges` +
           (cdgDropped > 0 ? `, ${cdgDropped} CDG edges dropped (per-function cap)` : '') +
+          (cdgSkippedUnsound > 0
+            ? `, ${cdgSkippedUnsound} function(s) CDG-skipped (EXIT not reachable from all blocks)`
+            : '') +
           // M3 volume telemetry — only for languages with a registered model.
           (taintSpec !== undefined
             ? `; taint: ${taintTotals.findings} TAINTED, ${taintTotals.kills} SANITIZES ` +
@@ -987,6 +992,20 @@ export function runScopeResolution(
             : ''),
       );
     }
+    // R8 (#2195): CDG soundness skips surface UNCONDITIONALLY (parity with the
+    // taint/RD gap warns) — not buried in the logger.debug stats line above. A
+    // function whose EXIT is not reverse-reachable from every block gets NO
+    // control dependence (an unmodeled non-terminating / multi-terminal CFG
+    // shape the synthetic-escape pass could not bridge). Withholding CDG
+    // silently would let a language's control dependence erode unnoticed; CFG
+    // and REACHING_DEF do not depend on post-dominance and are unaffected.
+    if (cdgSkippedUnsound > 0) {
+      logger.warn(
+        `[cfg] lang=${provider.language}: ${cdgSkippedUnsound} function(s) had control ` +
+          `dependence skipped (EXIT not reverse-reachable from all blocks); ` +
+          `CFG and REACHING_DEF are unaffected`,
+      );
+    }
     // R4: taint coverage gaps and cap drops surface UNCONDITIONALLY (never
     // logger.debug, never input.onWarn) at the per-language aggregate, with
     // counts and up to 5 example functions. Per-function warns above cover
diff --git a/gitnexus/src/core/ingestion/workers/parse-worker.ts b/gitnexus/src/core/ingestion/workers/parse-worker.ts
index f29b63c16..6c603984f 100644
--- a/gitnexus/src/core/ingestion/workers/parse-worker.ts
+++ b/gitnexus/src/core/ingestion/workers/parse-worker.ts
@@ -130,7 +130,11 @@ import {
   persistDurableParsedFileShardSync,
 } from '../../../storage/parsedfile-store.js';
 import { extractLaravelRoutes, type ExtractedRoute } from '../route-extractors/laravel.js';
-import { collectFunctionCfgs, DEFAULT_PDG_MAX_FUNCTION_LINES } from '../cfg/collect.js';
+import {
+  collectFunctionCfgs,
+  DEFAULT_PDG_MAX_FUNCTION_LINES,
+  type CfgSkipCounts,
+} from '../cfg/collect.js';
 
 import { logger } from '../../logger.js';
 export type { ExtractedRoute } from '../route-extractors/laravel.js';
@@ -412,6 +416,17 @@ export interface ParseWorkerResult {
    * entries predate the field; consumers must guard with `?? []`.
    */
   skippedPaths?: SkippedPath[];
+  /**
+   * Per-language CFG-bearing functions skipped during the worker walk, bucketed
+   * by reason (#2195): too-many-lines, too-deeply-nested (the proactive
+   * depth-guard bail), or build-error. Survives the parse cache (a small number
+   * map, kept by `...result` in slimParseWorkerResultsForCache) and is merged +
+   * logged per-language in `dispatchChunkParse` (alongside `skippedLanguages`),
+   * so a CFG coverage gap is visible. Like that sibling telemetry the warn is
+   * emitted for freshly-parsed chunks, not re-emitted on a warm cache hit.
+   * Optional for cache backward-compatibility — older shards predate it.
+   */
+  cfgSkipped?: Record<string, CfgSkipCounts>;
   fileCount: number;
 }
 
@@ -878,6 +893,7 @@ const processBatch = (
     fileScopeBindings: [],
     parsedFiles: [],
     skippedLanguages: {},
+    cfgSkipped: {},
     fileCount: 0,
   };
 
@@ -1258,19 +1274,37 @@ const processFileGroup = (
       // SCHEMA_BUMP + the pdg-folded chunk-hash key (see parse-cache.ts).
       if (PDG_ENABLED && provider.cfgVisitor) {
         // Isolate the CFG build per file: a throw here (an unexpected tree-sitter
-        // node shape, a deep-nesting stack overflow) must NOT propagate — it
-        // would escape processFileGroup to the language-group catch, which treats
-        // any throw as "parser unavailable" and silently drops EVERY remaining
-        // file in the group. Skip CFG for this one file; parsing + scope
-        // resolution proceed unaffected (CFG is a strictly-additive opt-in).
+        // node shape) must NOT propagate — it would escape processFileGroup to the
+        // language-group catch, which treats any throw as "parser unavailable" and
+        // silently drops EVERY remaining file in the group. Skip CFG for this one
+        // file; parsing + scope resolution proceed unaffected (CFG is a
+        // strictly-additive opt-in). collectFunctionCfgs ALSO isolates per
+        // FUNCTION now (#2195) — a deep-nesting bail or a single malformed function
+        // is counted in `skipped` and skipped, not allowed to lose the whole file.
         try {
-          const { cfgs } = collectFunctionCfgs(
+          const { cfgs, skipped } = collectFunctionCfgs(
             tree.rootNode,
             provider.cfgVisitor,
             file.path,
             PDG_MAX_FUNCTION_LINES,
+            // Embedded scripts (Vue SFC <script>) parse at row 0 but live at
+            // `lineOffset` in the file — shift the CFG into file coordinates so
+            // it joins its graph node and BasicBlock lines map to source.
+            lineOffset,
           );
           if (cfgs.length) withChannels = { ...withChannels, cfgSideChannel: cfgs };
+          // Surface per-function CFG skips per-language (#2195): merged + logged
+          // in mergeChunkResults. Only accumulate when something was skipped so
+          // the common (nothing-skipped) case stays a no-op.
+          if (skipped.tooManyLines || skipped.tooDeeplyNested || skipped.buildError) {
+            const agg = (result.cfgSkipped ??= {});
+            const prev = agg[language] ?? { tooManyLines: 0, tooDeeplyNested: 0, buildError: 0 };
+            agg[language] = {
+              tooManyLines: prev.tooManyLines + skipped.tooManyLines,
+              tooDeeplyNested: prev.tooDeeplyNested + skipped.tooDeeplyNested,
+              buildError: prev.buildError + skipped.buildError,
+            };
+          }
         } catch (err) {
           const message = `CFG build failed for ${file.path}: ${err instanceof Error ? err.message : String(err)}`;
           if (parentPort) parentPort.postMessage({ type: 'warning', message });
@@ -2385,6 +2419,7 @@ let accumulated: ParseWorkerResult = {
   fileScopeBindings: [],
   parsedFiles: [],
   skippedLanguages: {},
+  cfgSkipped: {},
   fileCount: 0,
 };
 let cumulativeProcessed = 0;
@@ -2524,6 +2559,7 @@ parentPort!.on('message', (msg: WorkerIncomingMessage) => {
         fileScopeBindings: [],
         parsedFiles: [],
         skippedLanguages: {},
+        cfgSkipped: {},
         fileCount: 0,
       };
       cumulativeProcessed = 0;
diff --git a/gitnexus/src/core/ingestion/workers/worker-pool.ts b/gitnexus/src/core/ingestion/workers/worker-pool.ts
index c46cf5a33..acdc0339d 100644
--- a/gitnexus/src/core/ingestion/workers/worker-pool.ts
+++ b/gitnexus/src/core/ingestion/workers/worker-pool.ts
@@ -912,6 +912,16 @@ export const createWorkerPool = (
       new Worker(url, {
         stderr: true,
         workerData: workerStoreData,
+        // The CFG visitors build per-function control-flow graphs by RECURSIVE
+        // descent over the tree-sitter AST, so deeply-nested source overflows
+        // the worker thread's call stack. A worker's stack is governed by
+        // `resourceLimits.stackSizeMb` (Node default 4 MB) — the main process's
+        // `--stack-size` flag does NOT propagate to worker threads — so raise it
+        // here. This pushes the overflow threshold from ~1.5k to several-k
+        // nesting levels (far beyond any hand-written code); a deeper machine-
+        // generated nest is still caught per-function (buildFunctionCfg's R4
+        // try/catch) and only that function's PDG is skipped, never a crash.
+        resourceLimits: { stackSizeMb: 16 },
       }));
   /** Spawn + wire stderr capture in one step (used by all spawn sites). */
   const spawnAndCapture = (url: URL): Worker => {
diff --git a/gitnexus/test/helpers/cfg-harness.ts b/gitnexus/test/helpers/cfg-harness.ts
new file mode 100644
index 000000000..e5d787836
--- /dev/null
+++ b/gitnexus/test/helpers/cfg-harness.ts
@@ -0,0 +1,121 @@
+/**
+ * Language-agnostic CFG unit-test harness (#2195 U1).
+ *
+ * Generalizes the TS-bound `ts-cfg-harness` into a factory parameterized by a
+ * tree-sitter grammar + a {@link CfgVisitor}, so each language's CFG visitor
+ * unit tests can drive the real worker-side builder against real source —
+ * never hand-built mocks. Function discovery delegates to `visitor.isFunction`,
+ * so this helper carries NO language-specific node-type knowledge (the
+ * no-language-naming rule the shared ingestion core follows).
+ */
+import Parser from 'tree-sitter';
+import type { SyntaxNode } from '../../src/core/ingestion/utils/ast-helpers.js';
+import type { CfgVisitor, FunctionCfg, SiteRecord } from '../../src/core/ingestion/cfg/types.js';
+
+export interface CfgHarness {
+  /** Parse `code` with the configured grammar; returns the root node. */
+  parse(code: string): SyntaxNode;
+  /** Every function node under `root` (pre-order), per `visitor.isFunction`. */
+  collectFunctions(root: SyntaxNode): SyntaxNode[];
+  /** CFG of the function at `index` (default 0). Throws if absent/undefined. */
+  cfgOf(code: string, index?: number): FunctionCfg;
+  /** Every function's CFG, in source order. */
+  cfgsOf(code: string): FunctionCfg[];
+}
+
+/**
+ * Build a CFG harness for one grammar + visitor. `filePath` is the synthetic
+ * path threaded into `buildFunctionCfg` (it only affects BasicBlock ids, not
+ * CFG shape). The parser is created once and reused across parses.
+ */
+export function makeCfgHarness(
+  grammar: Parser.Language,
+  visitor: CfgVisitor<SyntaxNode>,
+  filePath = 'fixture',
+): CfgHarness {
+  const parser = new Parser();
+  parser.setLanguage(grammar);
+
+  const parse = (code: string): SyntaxNode => parser.parse(code).rootNode;
+
+  const collectFunctions = (root: SyntaxNode): SyntaxNode[] => {
+    const out: SyntaxNode[] = [];
+    const stack: SyntaxNode[] = [root];
+    while (stack.length) {
+      const n = stack.pop() as SyntaxNode;
+      if (visitor.isFunction(n)) out.push(n);
+      for (let i = n.namedChildCount - 1; i >= 0; i--) {
+        const c = n.namedChild(i);
+        if (c) stack.push(c);
+      }
+    }
+    return out;
+  };
+
+  const cfgOf = (code: string, index = 0): FunctionCfg => {
+    const fn = collectFunctions(parse(code))[index];
+    if (!fn) throw new Error(`no function at index ${index}`);
+    const cfg = visitor.buildFunctionCfg(fn, filePath);
+    if (!cfg) throw new Error('buildFunctionCfg returned undefined');
+    return cfg;
+  };
+
+  const cfgsOf = (code: string): FunctionCfg[] =>
+    collectFunctions(parse(code))
+      .map((fn) => visitor.buildFunctionCfg(fn, filePath))
+      .filter((c): c is FunctionCfg => c !== undefined);
+
+  return { parse, collectFunctions, cfgOf, cfgsOf };
+}
+
+// ── shared CFG-shape assertions (#2195 U8) ───────────────────────────────────
+// Byte-identical helpers the per-language `*-visitor.test.ts` files each copied.
+// CFG-shape only — EXIT-reachability soundness asserts against the production
+// `isExitReachableFromAllBlocks` (post-dominators.ts) directly, not a re-impl.
+
+/** The distinct edge kinds present in `cfg`. */
+export const edgeKinds = (cfg: FunctionCfg): Set<string> => new Set(cfg.edges.map((e) => e.kind));
+
+/** Index of the (first) block whose text contains `substr`. Throws if none. */
+export const block = (cfg: FunctionCfg, substr: string): number => {
+  const b = cfg.blocks.find((bl) => bl.text.includes(substr));
+  if (!b) throw new Error(`no block containing ${JSON.stringify(substr)}`);
+  return b.index;
+};
+
+/** Is `to` forward-reachable from `from` over `cfg`'s edges? */
+export function reaches(cfg: FunctionCfg, from: number, to: number): boolean {
+  const adj = new Map<number, number[]>();
+  for (const e of cfg.edges) (adj.get(e.from) ?? adj.set(e.from, []).get(e.from)!).push(e.to);
+  const seen = new Set([from]);
+  const stack = [from];
+  while (stack.length) {
+    const n = stack.pop() as number;
+    if (n === to) return true;
+    for (const nx of adj.get(n) ?? []) if (!seen.has(nx)) (seen.add(nx), stack.push(nx));
+  }
+  return seen.has(to);
+}
+
+/** Is `idx` reachable from ENTRY? */
+export const reachable = (cfg: FunctionCfg, idx: number): boolean =>
+  reaches(cfg, cfg.entryIndex, idx);
+
+/** Resolve a binding by name → its index in the function's binding table. */
+export function bindingIdx(cfg: FunctionCfg, name: string): number {
+  const i = (cfg.bindings ?? []).findIndex((b) => b.name === name);
+  if (i < 0) throw new Error(`no binding ${name}`);
+  return i;
+}
+
+/** Every taint `SiteRecord` harvested across the function's statements. */
+export function allSites(cfg: FunctionCfg): SiteRecord[] {
+  const out: SiteRecord[] = [];
+  for (const b of cfg.blocks) for (const s of b.statements ?? []) out.push(...(s.sites ?? []));
+  return out;
+}
+
+/** True iff at least one statement carries a (non-empty) `sites` array. */
+export function hasAnySites(cfg: FunctionCfg): boolean {
+  return cfg.blocks.some((b) => (b.statements ?? []).some((s) => (s.sites ?? []).length > 0));
+}
diff --git a/gitnexus/test/helpers/literal-collectors.ts b/gitnexus/test/helpers/literal-collectors.ts
index e75a44e2d..f4aed2937 100644
--- a/gitnexus/test/helpers/literal-collectors.ts
+++ b/gitnexus/test/helpers/literal-collectors.ts
@@ -139,6 +139,17 @@ function fileLanguages(relPath: string): SupportedLanguages[] {
   }
   const base = relPath.replace(/\.ts$/, '').split('/').pop() ?? '';
   if (BASENAME_LANGS[base]) return BASENAME_LANGS[base];
+  // A `<lang>-harvest.ts` CFG def/use harvester is validated against the SAME
+  // grammar(s) as its `<lang>.ts` CFG visitor (go-harvest → Go, c-cpp-harvest →
+  // C+C++, typescript-harvest → TS, …) — strip the suffix and reuse the visitor
+  // basename map. The two genuinely language-agnostic harvesters —
+  // call-site-harvest.ts (pure taint-site mechanism) and scope-tree-harvest.ts
+  // (shared lexical-scope substrate) — name no grammar, so their stripped base
+  // (`call-site`, `scope-tree`) misses BASENAME_LANGS and they fall through to
+  // the valid-if-any ALL_LANGS bucket below (correct: they pin no per-grammar
+  // literal).
+  const harvestBase = base.replace(/-harvest$/, '');
+  if (harvestBase !== base && BASENAME_LANGS[harvestBase]) return BASENAME_LANGS[harvestBase];
   // generic / shared / cross-language helpers → any grammar (valid-if-any)
   return [...ALL_LANGS];
 }
@@ -183,6 +194,17 @@ function mode2Files(): string[] {
       if (existsSync(cap)) files.push(cap);
     }
   }
+  // CFG visitors (cfg/visitors/<lang>.ts) AND their def/use harvesters
+  // (cfg/visitors/<lang>-harvest.ts) hard-code tree-sitter node-type and field
+  // literals directly; include them so the gate validates per-language CFG
+  // literals against the right grammar (basename → grammar via `fileLanguages`:
+  // c-cpp[-harvest] → C+C++, csharp[-harvest] → C#, go[-harvest] → Go,
+  // typescript[-harvest] → TS, …; the language-agnostic call-site-harvest.ts and
+  // scope-tree-harvest.ts carry no grammar literal and stay valid-if-any).
+  // Without this, the gate stays green on a dead literal in a new visitor or
+  // harvester — the exact failure KTD5 warns about.
+  const cfgVisitorsDir = join(INGESTION_DIR, 'cfg', 'visitors');
+  if (existsSync(cfgVisitorsDir)) walkTs(cfgVisitorsDir, files);
   const exportDetection = join(INGESTION_DIR, 'export-detection.ts');
   if (existsSync(exportDetection)) files.push(exportDetection);
   return files;
diff --git a/gitnexus/test/helpers/ts-cfg-harness.ts b/gitnexus/test/helpers/ts-cfg-harness.ts
index 12f8509c6..3c5e32a81 100644
--- a/gitnexus/test/helpers/ts-cfg-harness.ts
+++ b/gitnexus/test/helpers/ts-cfg-harness.ts
@@ -6,58 +6,23 @@
  * structures the pipeline feeds `computeReachingDefs` / `matchFunctionSites` /
  * `computeTaintFlows`, never hand-built mocks. Extracted from the byte-identical
  * copies that lived in model-match / propagate / taint-emit / harvest tests.
+ *
+ * The grammar-agnostic engine now lives in {@link makeCfgHarness} (#2195 U1);
+ * this module is the thin TS binding that preserves the original exports.
  */
-
-import Parser from 'tree-sitter';
 import TypeScript from 'tree-sitter-typescript';
 import type { ParsedImport } from 'gitnexus-shared';
-import type { SyntaxNode } from '../../src/core/ingestion/utils/ast-helpers.js';
-import {
-  createTypeScriptCfgVisitor,
-  TS_FUNCTION_TYPES,
-} from '../../src/core/ingestion/cfg/visitors/typescript.js';
-import type { FunctionCfg } from '../../src/core/ingestion/cfg/types.js';
+import { createTypeScriptCfgVisitor } from '../../src/core/ingestion/cfg/visitors/typescript.js';
 import { emitTsScopeCaptures } from '../../src/core/ingestion/languages/typescript/captures.js';
 import { interpretTsImport } from '../../src/core/ingestion/languages/typescript/interpret.js';
+import { makeCfgHarness } from './cfg-harness.js';
 
-const visitor = createTypeScriptCfgVisitor();
+const harness = makeCfgHarness(TypeScript.typescript, createTypeScriptCfgVisitor(), 'fixture.ts');
 
-export function parse(code: string): SyntaxNode {
-  const parser = new Parser();
-  parser.setLanguage(TypeScript.typescript);
-  return parser.parse(code).rootNode;
-}
-
-export function collectFunctions(root: SyntaxNode): SyntaxNode[] {
-  const out: SyntaxNode[] = [];
-  const stack = [root];
-  while (stack.length) {
-    const n = stack.pop() as SyntaxNode;
-    if (TS_FUNCTION_TYPES.has(n.type)) out.push(n);
-    for (let i = n.namedChildCount - 1; i >= 0; i--) {
-      const c = n.namedChild(i);
-      if (c) stack.push(c);
-    }
-  }
-  return out;
-}
-
-/** The CFG of the function at `index` (default 0). */
-export function cfgOf(code: string, index = 0): FunctionCfg {
-  const fns = collectFunctions(parse(code));
-  const fn = fns[index];
-  if (!fn) throw new Error(`no function at index ${index}`);
-  const cfg = visitor.buildFunctionCfg(fn, 'fixture.ts');
-  if (!cfg) throw new Error('buildFunctionCfg returned undefined');
-  return cfg;
-}
-
-/** Every function's CFG, in source order. */
-export function cfgsOf(code: string): FunctionCfg[] {
-  return collectFunctions(parse(code))
-    .map((fn) => visitor.buildFunctionCfg(fn, 'fixture.ts'))
-    .filter((c): c is FunctionCfg => c !== undefined);
-}
+export const parse = harness.parse;
+export const collectFunctions = harness.collectFunctions;
+export const cfgOf = harness.cfgOf;
+export const cfgsOf = harness.cfgsOf;
 
 /** Real ParsedImports via the TS scope-capture + interpreter path. */
 export function importsFor(src: string): ParsedImport[] {
diff --git a/gitnexus/test/integration/cfg/__snapshots__/pipeline-pdg.test.ts.snap b/gitnexus/test/integration/cfg/__snapshots__/pipeline-pdg.test.ts.snap
new file mode 100644
index 000000000..06e4b033e
--- /dev/null
+++ b/gitnexus/test/integration/cfg/__snapshots__/pipeline-pdg.test.ts.snap
@@ -0,0 +1,93 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`U7 — C-family worker-mode --pdg pipeline > C#: --pdg off is byte-identical (zero PDG nodes/edges, stable golden digest) 1`] = `
+{
+  "byRelType": {
+    "CALLS": 7,
+    "DEFINES": 3,
+    "HAS_METHOD": 16,
+    "MEMBER_OF": 9,
+    "STEP_IN_PROCESS": 3,
+  },
+  "byType": {
+    "Class": 2,
+    "Community": 3,
+    "File": 1,
+    "Function": 1,
+    "Method": 15,
+    "Namespace": 1,
+    "Process": 1,
+  },
+  "edgeDigest": "2271af66531e4fb54afb2d6e0a024abc536e2109f445e0ecff9868c01661ebfa",
+  "relationships": 38,
+  "symbols": 24,
+}
+`;
+
+exports[`U7 — C-family worker-mode --pdg pipeline > C++: --pdg off is byte-identical (zero PDG nodes/edges, stable golden digest) 1`] = `
+{
+  "byRelType": {
+    "DEFINES": 6,
+  },
+  "byType": {
+    "File": 1,
+    "Function": 6,
+  },
+  "edgeDigest": "4e8cfcfe7cbde0d0a858e2f5db8af82713fbb42527d23e6fabf704382d8088df",
+  "relationships": 6,
+  "symbols": 7,
+}
+`;
+
+exports[`U7 — C-family worker-mode --pdg pipeline > C: --pdg off is byte-identical (zero PDG nodes/edges, stable golden digest) 1`] = `
+{
+  "byRelType": {
+    "DEFINES": 9,
+  },
+  "byType": {
+    "File": 1,
+    "Function": 9,
+  },
+  "edgeDigest": "887c0c3f91a858df6333d2105f03160b3232ff625f6dc04328425a0bbbd58cd3",
+  "relationships": 9,
+  "symbols": 10,
+}
+`;
+
+exports[`U7 — C-family worker-mode --pdg pipeline > Go: --pdg off is byte-identical (zero PDG nodes/edges, stable golden digest) 1`] = `
+{
+  "byRelType": {
+    "CALLS": 14,
+    "DEFINES": 28,
+    "MEMBER_OF": 22,
+  },
+  "byType": {
+    "Community": 8,
+    "File": 1,
+    "Function": 28,
+  },
+  "edgeDigest": "731ee1aa406fe7a96c5747dc2e5059f9079fd883dfca70a1933d49ce7f161a99",
+  "relationships": 64,
+  "symbols": 37,
+}
+`;
+
+exports[`U7 — C-family worker-mode --pdg pipeline > Java: --pdg off is byte-identical (zero PDG nodes/edges, stable golden digest) 1`] = `
+{
+  "byRelType": {
+    "CALLS": 10,
+    "DEFINES": 1,
+    "HAS_METHOD": 21,
+    "MEMBER_OF": 14,
+  },
+  "byType": {
+    "Class": 1,
+    "Community": 4,
+    "File": 1,
+    "Method": 21,
+  },
+  "edgeDigest": "b5e4c1459c59f385949964c3e4e479e67c98a2eaa7e102f4acacb108a9ccec29",
+  "relationships": 46,
+  "symbols": 27,
+}
+`;
diff --git a/gitnexus/test/integration/cfg/cfg-emit.test.ts b/gitnexus/test/integration/cfg/cfg-emit.test.ts
index 84459e0aa..db0540933 100644
--- a/gitnexus/test/integration/cfg/cfg-emit.test.ts
+++ b/gitnexus/test/integration/cfg/cfg-emit.test.ts
@@ -112,6 +112,35 @@ describe('U4 — emitFileCfgs node/edge shape', () => {
   });
 });
 
+describe('collectFunctionCfgs — lineOffset → file coordinates (#2195 P1, Vue SFC)', () => {
+  it('shifts functionStartLine + block + statement lines by lineOffset', () => {
+    const code = `function f(x: number) { if (x) { a(); } else { b(); } }`;
+    const base = collectFunctionCfgs(tsRoot(code), visitor(), 'x.vue').cfgs;
+    const shifted = collectFunctionCfgs(tsRoot(code), visitor(), 'x.vue', 0, 5).cfgs;
+    expect(base.length).toBeGreaterThan(0);
+    expect(shifted).toHaveLength(base.length);
+    expect(shifted[0].functionStartLine).toBe(base[0].functionStartLine + 5);
+    expect(shifted[0].functionEndLine).toBe(base[0].functionEndLine + 5);
+    // functionStartColumn is a COLUMN, not a line — unchanged.
+    expect(shifted[0].functionStartColumn).toBe(base[0].functionStartColumn);
+    for (let i = 0; i < base[0].blocks.length; i++) {
+      expect(shifted[0].blocks[i].startLine).toBe(base[0].blocks[i].startLine + 5);
+      expect(shifted[0].blocks[i].endLine).toBe(base[0].blocks[i].endLine + 5);
+    }
+    // per-statement source lines shift too (file-accurate taint/explain hops).
+    const stmtLines = (cfgs: readonly FunctionCfg[]): number[] =>
+      cfgs[0].blocks.flatMap((b) => (b.statements ?? []).map((s) => s.line));
+    expect(stmtLines(shifted)).toEqual(stmtLines(base).map((l) => l + 5));
+  });
+
+  it('lineOffset 0 is a byte-identical no-op (non-embedded files unchanged)', () => {
+    const code = `function g() { while (true) { tick(); } }`;
+    const withZero = collectFunctionCfgs(tsRoot(code), visitor(), 'g.ts', 0, 0).cfgs;
+    const omitted = collectFunctionCfgs(tsRoot(code), visitor(), 'g.ts').cfgs;
+    expect(JSON.stringify(withZero)).toBe(JSON.stringify(omitted));
+  });
+});
+
 describe('U4 — AC2: every BasicBlock is reachable from its function ENTRY', () => {
   // Fixtures deliberately contain no dead code, so the reachability closure
   // from each function's ENTRY (block index 0) must cover all of its blocks.
diff --git a/gitnexus/test/integration/cfg/fixtures/c-hazards.c b/gitnexus/test/integration/cfg/fixtures/c-hazards.c
new file mode 100644
index 000000000..ec089adaf
--- /dev/null
+++ b/gitnexus/test/integration/cfg/fixtures/c-hazards.c
@@ -0,0 +1,87 @@
+/* C CFG hazard fixture (#2195 U2). Exercises every modeled C control-flow
+ * construct so the pipeline emits BasicBlock + CFG + REACHING_DEF + CDG. */
+
+int straight_line(int a, int b) {
+  int x = a + b;
+  int y = x * 2;
+  return y;
+}
+
+int if_else(int x) {
+  int r;
+  if (x > 0) {
+    r = 1;
+  } else {
+    r = -1;
+  }
+  return r;
+}
+
+int while_loop(int n) {
+  int i = 0;
+  int sum = 0;
+  while (i < n) {
+    sum = sum + i;
+    i++;
+  }
+  return sum;
+}
+
+int do_while_loop(int n) {
+  int i = 0;
+  int sum = 0;
+  do {
+    sum = sum + i;
+    i++;
+  } while (i < n);
+  return sum;
+}
+
+int for_loop(int n) {
+  int sum = 0;
+  for (int i = 0; i < n; i++) {
+    sum = sum + i;
+  }
+  return sum;
+}
+
+const char *switch_fallthrough(int code) {
+  const char *msg;
+  switch (code) {
+    case 1:
+      msg = "one";
+    case 2:
+      msg = "two-or-more";
+      break;
+    default:
+      msg = "other";
+  }
+  return msg;
+}
+
+int goto_jump(int n) {
+  int i = 0;
+  int sum = 0;
+loop:
+  if (i >= n) goto end;
+  sum = sum + i;
+  i++;
+  goto loop;
+end:
+  return sum;
+}
+
+/* Non-terminating loop: EXIT must stay reverse-reachable for the CDG pass. */
+void server_forever(void) {
+  for (;;) {
+    handle_request();
+  }
+}
+
+int may_def(int a) {
+  int x = 0;
+  if (a && (x = compute())) {
+    use(x);
+  }
+  return x;
+}
diff --git a/gitnexus/test/integration/cfg/fixtures/cpp-hazards.cpp b/gitnexus/test/integration/cfg/fixtures/cpp-hazards.cpp
new file mode 100644
index 000000000..7deab3764
--- /dev/null
+++ b/gitnexus/test/integration/cfg/fixtures/cpp-hazards.cpp
@@ -0,0 +1,61 @@
+// C++ CFG hazard fixture (#2195 U2). Exercises the C core plus the C++-only
+// constructs: try/catch, throw, range-for, and lambdas.
+
+#include <vector>
+#include <stdexcept>
+
+int if_else(int x) {
+  int r;
+  if (x > 0) {
+    r = 1;
+  } else {
+    r = -1;
+  }
+  return r;
+}
+
+int try_catch(int x) {
+  int result = 0;
+  try {
+    if (x < 0) {
+      throw std::runtime_error("negative");
+    }
+    result = compute(x);
+  } catch (const std::exception &e) {
+    result = -1;
+    handle(e);
+  }
+  return result;
+}
+
+void throw_no_try(int x) {
+  if (x < 0) {
+    throw std::runtime_error("bad");
+  }
+  proceed(x);
+}
+
+int range_for(const std::vector<int> &xs) {
+  int sum = 0;
+  for (int x : xs) {
+    sum = sum + x;
+  }
+  return sum;
+}
+
+int with_lambda(int n) {
+  auto doubler = [](int v) {
+    if (v > 0) {
+      return v * 2;
+    }
+    return 0;
+  };
+  return doubler(n);
+}
+
+// Non-terminating server loop — EXIT must stay reverse-reachable for the CDG pass.
+void run_forever() {
+  while (true) {
+    poll();
+  }
+}
diff --git a/gitnexus/test/integration/cfg/fixtures/csharp-hazards.cs b/gitnexus/test/integration/cfg/fixtures/csharp-hazards.cs
new file mode 100644
index 000000000..55253c258
--- /dev/null
+++ b/gitnexus/test/integration/cfg/fixtures/csharp-hazards.cs
@@ -0,0 +1,159 @@
+// C# CFG hazard fixture (#2195 U3). Exercises every control-flow construct the
+// csharp CfgVisitor models, so the worker-mode pipeline produces non-trivial
+// BasicBlock / CFG / REACHING_DEF / CDG counts (and so the byte-identical-off
+// golden gate has real shapes to compare). Mirrors c-hazards.c / cpp-hazards.cpp.
+
+using System;
+using System.Collections.Generic;
+
+namespace Hazards
+{
+    public class Demo
+    {
+        // if / else-if / else.
+        public int Classify(int x)
+        {
+            if (x > 0)
+            {
+                return 1;
+            }
+            else if (x < 0)
+            {
+                return -1;
+            }
+            else
+            {
+                return 0;
+            }
+        }
+
+        // for, foreach, while, do-while + break / continue.
+        public int Loops(int[] xs, int n)
+        {
+            int total = 0;
+            for (int i = 0; i < n; i++)
+            {
+                if (i == 3) { continue; }
+                total += i;
+            }
+            foreach (var x in xs)
+            {
+                if (x < 0) { break; }
+                total += x;
+            }
+            int j = 0;
+            while (j < n)
+            {
+                total += j;
+                j++;
+            }
+            do
+            {
+                total -= 1;
+            } while (total > 100);
+            return total;
+        }
+
+        // switch_statement with fallthrough-empty section + default.
+        public string Name(int code)
+        {
+            switch (code)
+            {
+                case 1:
+                case 2:
+                    return "low";
+                case 3:
+                    return "three";
+                default:
+                    return "other";
+            }
+        }
+
+        // switch_expression arms.
+        public int Score(int grade) => grade switch
+        {
+            1 => 100,
+            2 => 80,
+            _ => 0,
+        };
+
+        // try / catch / finally with a return crossing the finally.
+        public int Guarded(int x)
+        {
+            try
+            {
+                if (x < 0) { throw new ArgumentException(nameof(x)); }
+                return Compute(x);
+            }
+            catch (ArgumentException e)
+            {
+                Log(e);
+                return -1;
+            }
+            finally
+            {
+                Cleanup();
+            }
+        }
+
+        // using (deterministic dispose on both normal and exception exit).
+        public int ReadAll(string path)
+        {
+            using (var reader = Open(path))
+            {
+                return reader.Read();
+            }
+        }
+
+        // lock (monitor release finalizer).
+        private readonly object _sync = new object();
+        public void Touch(int v)
+        {
+            lock (_sync)
+            {
+                _value += v;
+            }
+        }
+
+        // goto / labeled statement.
+        public int Retry(int limit)
+        {
+            int attempts = 0;
+        start:
+            attempts++;
+            if (attempts < limit) { goto start; }
+            return attempts;
+        }
+
+        // yield iterator (state-machine limitation documented; surface flow only).
+        public IEnumerable<int> Take(int[] src, int count)
+        {
+            int taken = 0;
+            foreach (var item in src)
+            {
+                if (taken >= count) { yield break; }
+                taken++;
+                yield return item;
+            }
+        }
+
+        // null-coalescing may-def + local function.
+        public int Resolve(string s)
+        {
+            int Parse(string v) => int.Parse(v);
+            string chosen = s ?? (s = "0");
+            return Parse(chosen);
+        }
+
+        private int _value;
+        private int Compute(int x) => x * 2;
+        private static void Log(Exception e) { }
+        private void Cleanup() { }
+        private Reader Open(string path) => new Reader();
+    }
+
+    public class Reader
+    {
+        public int Read() => 0;
+    }
+}
diff --git a/gitnexus/test/integration/cfg/fixtures/dart-hazards.dart b/gitnexus/test/integration/cfg/fixtures/dart-hazards.dart
new file mode 100644
index 000000000..9ef3d4790
--- /dev/null
+++ b/gitnexus/test/integration/cfg/fixtures/dart-hazards.dart
@@ -0,0 +1,134 @@
+// Dart CFG hazard fixture (#2195) — one of every control-flow shape the Dart
+// CfgVisitor models, so the worker-roundtrip / integration passes exercise the
+// real (vendored) grammar end-to-end. Mirrors the sibling fixtures
+// (kotlin-hazards, swift-hazards, java-hazards). Dart splits a function into a
+// SIGNATURE + a sibling `function_body`, and `if`/`switch`-expression/`?:`/`??`
+// are expressions — this fixture stresses statement-position constructs plus a
+// few value-position ones (which stay inline as harvest may-defs).
+
+// if / else-if / else + a value-position `?:` (stays inline) + arrow body.
+int branching(int x) {
+  if (x > 0) {
+    positive();
+  } else if (x < 0) {
+    negative();
+  } else {
+    zero();
+  }
+  final sign = x >= 0 ? 1 : -1; // value-position conditional — not a branch
+  return sign;
+}
+
+// switch statement: empty-case fallthrough, an explicit `continue LABEL`, a
+// default, and a no-implicit-fallthrough non-empty case.
+void dispatch(int x) {
+  switch (x) {
+    case 1:
+    case 2:
+      small();
+      break;
+    case 3:
+      medium();
+      continue big;
+    big:
+    case 4:
+      large();
+      break;
+    default:
+      other();
+  }
+  after();
+}
+
+// switch EXPRESSION used as a value — stays inline (no branch edges).
+int classify(int x) {
+  return switch (x) {
+    1 => 10,
+    2 => 20,
+    _ => 0,
+  };
+}
+
+// for-in (binds the loop var) + c-style for + while + do-while (bottom-test).
+void loops(List items) {
+  for (var item in items) {
+    consume(item);
+  }
+  for (var i = 0; i < 10; i++) {
+    index(i);
+  }
+  while (running()) {
+    tick();
+  }
+  do {
+    retry();
+  } while (shouldRetry());
+}
+
+// while (true) {} — keeps EXIT reverse-reachable (structural escape edge).
+void spin(bool stop) {
+  while (true) {
+    if (stop) {
+      break;
+    }
+    work();
+  }
+  done();
+}
+
+// try / on / catch / finally — exception flow + finally completion edges.
+int guarded() {
+  try {
+    return risky();
+  } on FormatException catch (e, st) {
+    handle(e, st);
+  } catch (err) {
+    fallback(err);
+  } finally {
+    cleanup();
+  }
+  return 0;
+}
+
+// rethrow — re-raises past the current handler.
+void propagate() {
+  try {
+    risky();
+  } catch (e) {
+    log(e);
+    rethrow;
+  }
+}
+
+// labeled break/continue across nested loops.
+void labeled(List xs, List ys) {
+  outer:
+  for (var i in xs) {
+    for (var j in ys) {
+      if (match(i, j)) {
+        break outer;
+      }
+      continue outer;
+    }
+  }
+  done();
+}
+
+// harvest: var / final / typed locals, compound assign, member write (not a
+// scalar def), null-coalescing (`??`) as a may-def, and a closure (own CFG).
+int harvest(List xs, int? maybe) {
+  var total = 0;
+  final base = compute();
+  int n = base ?? 1;
+  total += base;
+  xs.forEach((e) {
+    total += e;
+  });
+  return n;
+}
+
+// assert may throw — modeled as a straight-line block with a handler edge.
+void checked(bool ok) {
+  assert(ok, 'must be ok');
+  proceed();
+}
diff --git a/gitnexus/test/integration/cfg/fixtures/go-hazards.go b/gitnexus/test/integration/cfg/fixtures/go-hazards.go
new file mode 100644
index 000000000..b04887551
--- /dev/null
+++ b/gitnexus/test/integration/cfg/fixtures/go-hazards.go
@@ -0,0 +1,189 @@
+// Go CFG hazard fixture (#2195 U5). Exercises every control-flow construct the
+// Go visitor models, including the EXIT-reachability hazards (`for {}` /
+// `select {}` with no default) the CDG soundness gate depends on. Used by the
+// worker-mode PDG pipeline assertions and the cross-language CFG snapshot.
+package hazards
+
+import "errors"
+
+// ifWithInitializer — `if init; cond { } else if { } else { }`.
+func ifWithInitializer(x int) int {
+	if v := x * 2; v > 0 {
+		return v
+	} else if v < 0 {
+		return -v
+	} else {
+		return 0
+	}
+}
+
+// forClause — C-style three-clause for, with continue/break.
+func forClause(n int) int {
+	sum := 0
+	for i := 0; i < n; i++ {
+		if i%2 == 0 {
+			continue
+		}
+		if i > 100 {
+			break
+		}
+		sum += i
+	}
+	return sum
+}
+
+// forWhile — condition-only (while-style) loop.
+func forWhile(x int) int {
+	for x > 0 {
+		x--
+	}
+	return x
+}
+
+// forRange — for-range over a slice; multi-return loop vars.
+func forRange(xs []int) int {
+	total := 0
+	for k, v := range xs {
+		total += k + v
+	}
+	return total
+}
+
+// forInfinite — `for {}` with no condition: NON-terminating shape. EXIT must
+// stay reverse-reachable (structural exit edge) or CDG silently goes to zero.
+func forInfinite(ch chan int) {
+	for {
+		v := <-ch
+		if v < 0 {
+			handle(v)
+		}
+	}
+}
+
+// exprSwitch — expression switch; cases do NOT fall through by default.
+func exprSwitch(x int) string {
+	switch x {
+	case 1:
+		return "one"
+	case 2, 3:
+		return "few"
+	default:
+		return "many"
+	}
+}
+
+// explicitFallthrough — Go's EXPLICIT fallthrough (opposite of C).
+func explicitFallthrough(x int) int {
+	r := 0
+	switch x {
+	case 1:
+		r = 1
+		fallthrough
+	case 2:
+		r += 2
+	default:
+		r = -1
+	}
+	return r
+}
+
+// typeSwitch — type switch with an alias binding.
+func typeSwitch(i interface{}) string {
+	switch t := i.(type) {
+	case int:
+		return useInt(t)
+	case string, []byte:
+		return "str"
+	default:
+		return "other"
+	}
+}
+
+// selectDispatch — select across communication cases (with default).
+func selectDispatch(ch chan int, out chan int) {
+	select {
+	case v := <-ch:
+		out <- v
+	case out <- 0:
+		sent()
+	default:
+		none()
+	}
+}
+
+// selectBlocking — `select {}` with NO default blocks forever: EXIT must stay
+// reverse-reachable (structural escape edge) or CDG silently goes to zero.
+func selectBlocking(x bool) {
+	if x {
+		setup()
+	}
+	select {}
+}
+
+// deferLifo — deferred calls run at function return in LIFO order.
+func deferLifo(path string) (err error) {
+	defer first()
+	defer second()
+	f, e := open(path)
+	if e != nil {
+		return errors.New("open failed")
+	}
+	use(f)
+	return nil
+}
+
+// labeledJumps — labeled break / continue / goto.
+func labeledJumps(grid [][]int) int {
+	found := -1
+outer:
+	for i := 0; i < len(grid); i++ {
+		for j := 0; j < len(grid[i]); j++ {
+			if grid[i][j] == 0 {
+				continue outer
+			}
+			if grid[i][j] < 0 {
+				found = i
+				break outer
+			}
+		}
+	}
+	if found < 0 {
+		goto done
+	}
+	report(found)
+done:
+	return found
+}
+
+// multiReturn — `a, b := f()` defines both names.
+func multiReturn() int {
+	a, b := pair()
+	return a + b
+}
+
+// goroutine — `go func(){…}()` spawns a separate flow (not followed inline).
+func goroutine(jobs chan int) {
+	go func() {
+		for j := range jobs {
+			process(j)
+		}
+	}()
+	go worker(1)
+	after()
+}
+
+// Helper stubs so the fixture parses as a complete package.
+func handle(v int)            {}
+func useInt(t int) string     { return "" }
+func sent()                   {}
+func none()                   {}
+func first()                  {}
+func second()                 {}
+func open(p string) (int, error) { return 0, nil }
+func use(x int)               {}
+func report(i int)            {}
+func pair() (int, int)        { return 1, 2 }
+func process(j int)           {}
+func worker(n int)            {}
+func after()                  {}
+func setup()                  {}
diff --git a/gitnexus/test/integration/cfg/fixtures/java-hazards.java b/gitnexus/test/integration/cfg/fixtures/java-hazards.java
new file mode 100644
index 000000000..6ad285032
--- /dev/null
+++ b/gitnexus/test/integration/cfg/fixtures/java-hazards.java
@@ -0,0 +1,149 @@
+// Java CFG hazard fixture (#2195 U4). Each method exercises one control-flow
+// construct the Java CfgVisitor models; the worker-mode pipeline + snapshot
+// tests assert non-trivial BasicBlock / CFG / REACHING_DEF / CDG output here.
+package fixtures;
+
+import java.io.IOException;
+
+class Hazards {
+
+  // if / else — cond-true / cond-false to both arms, joining after.
+  int branch(int x) {
+    int r;
+    if (x > 0) {
+      r = 1;
+    } else {
+      r = 2;
+    }
+    return r;
+  }
+
+  // classic C-style for — init once, condition header, back-edge through update.
+  int classicFor(int n) {
+    int sum = 0;
+    for (int i = 0; i < n; i++) {
+      sum += i;
+    }
+    return sum;
+  }
+
+  // enhanced for (for-each) — loop var def, iterated value use.
+  int forEach(int[] xs) {
+    int total = 0;
+    for (int v : xs) {
+      total += v;
+    }
+    return total;
+  }
+
+  // while — bottom-of-header re-test, back-edge.
+  int whileLoop(int x) {
+    while (x > 0) {
+      x = step(x);
+    }
+    return x;
+  }
+
+  // do-while — body runs before the test.
+  int doWhile(int x) {
+    do {
+      x = step(x);
+    } while (x > 0);
+    return x;
+  }
+
+  // try-with-resources — the resource closes on BOTH normal and exception exit
+  // (finally semantics); a return inside crosses the close (finally-return).
+  int withResources(String path) throws IOException {
+    try (var r = open(path)) {
+      return read(r);
+    } catch (IOException e) {
+      return handle(e);
+    } finally {
+      cleanup();
+    }
+  }
+
+  // labeled break — `break outer;` from a nested loop targets the labeled frame.
+  int labeledBreak(int[][] grid, int needle) {
+    int found = -1;
+    outer:
+    for (int i = 0; i < grid.length; i++) {
+      for (int j = 0; j < grid[i].length; j++) {
+        if (grid[i][j] == needle) {
+          found = i;
+          break outer;
+        }
+      }
+    }
+    return found;
+  }
+
+  // classic colon switch — fallthrough between break-less cases; the case test
+  // is recorded as a may-def on the dispatch block.
+  int classicSwitch(int x) {
+    int r = 0;
+    switch (x) {
+      case 1:
+      case 2:
+        r = 10;
+        break;
+      case 3:
+        r = 30;
+      default:
+        r = -1;
+    }
+    return r;
+  }
+
+  // arrow switch — each rule rejoins after the switch (no fallthrough).
+  int arrowSwitch(int x) {
+    int r = 0;
+    switch (x) {
+      case 1 -> r = 1;
+      case 2, 3 -> r = 2;
+      default -> r = -1;
+    }
+    return r;
+  }
+
+  // switch expression with yield — yields a value to the enclosing switch.
+  int yieldSwitch(int x) {
+    int r = switch (x) {
+      case 1 -> 10;
+      default -> {
+        yield 20;
+      }
+    };
+    return r;
+  }
+
+  // synchronized — the monitor release is a deterministic finalizer.
+  void sync(Object lock) {
+    synchronized (lock) {
+      touch();
+    }
+    after();
+  }
+
+  // a server-style non-terminating loop — EXIT must stay reverse-reachable so
+  // CDG is not silently skipped for the method.
+  void serve() {
+    while (true) {
+      if (ready()) {
+        handle();
+      }
+    }
+  }
+
+  // helpers (no bodies of interest)
+  int step(int x) { return x - 1; }
+  Object open(String p) { return null; }
+  int read(Object r) { return 0; }
+  int handle(IOException e) { return 0; }
+  void cleanup() {}
+  void touch() {}
+  void after() {}
+  boolean ready() { return false; }
+  void handle() {}
+}
diff --git a/gitnexus/test/integration/cfg/fixtures/kotlin-hazards.kt b/gitnexus/test/integration/cfg/fixtures/kotlin-hazards.kt
new file mode 100644
index 000000000..98d877e54
--- /dev/null
+++ b/gitnexus/test/integration/cfg/fixtures/kotlin-hazards.kt
@@ -0,0 +1,115 @@
+// Kotlin CFG hazard fixture (#2195) — one of every control-flow shape the Kotlin
+// CfgVisitor models, so the worker-roundtrip / integration passes exercise the
+// real (vendored) grammar end-to-end. Mirrors the sibling fixtures
+// (swift-hazards, java-hazards, go-hazards). Kotlin's grammar is field-less for
+// control flow and `if`/`when`/`try` are expressions — this fixture stresses both
+// statement-position constructs and a value-position one.
+
+package fixtures
+
+// if / else-if / else (statement position) + a value-position `if` (stays inline)
+fun branching(x: Int): Int {
+    if (x > 0) {
+        positive()
+    } else if (x < 0) {
+        negative()
+    } else {
+        zero()
+    }
+    val sign = if (x >= 0) 1 else -1 // value-position if — not modeled as a branch
+    return sign
+}
+
+// when — with subject (no fallthrough) + range/type tests + else
+fun dispatch(x: Any) {
+    when (x) {
+        1, 2 -> small()
+        in 3..10 -> medium()
+        is String -> text(x)
+        else -> other()
+    }
+    after()
+}
+
+// when — without subject (guard form) + a short-circuit guard
+fun guarded(x: Int, y: Int) {
+    when {
+        x > 0 && y < 5 -> both()
+        x > 0 -> onlyX()
+        else -> neither()
+    }
+}
+
+// for-in (binds the loop var) + while + do-while (bottom-test)
+fun loops(xs: List<Int>) {
+    for (item in xs) {
+        consume(item)
+    }
+    while (running()) {
+        tick()
+    }
+    do {
+        retry()
+    } while (shouldRetry())
+}
+
+// destructuring + elvis (`?:`) + safe call (`?.`) — harvest may-defs, not branches
+fun harvest(p: Pair<Int, Int>, s: String?): Int {
+    val (a, b) = p
+    val len = s?.length ?: 0
+    var total = a
+    total += b
+    return total + len
+}
+
+// try / catch / finally — the finally runs on both normal and exception exit; a
+// return inside the try threads through the finally
+fun protect(): Int {
+    try {
+        val r = risky()
+        return r
+    } catch (e: Exception) {
+        handle(e)
+        return -1
+    } finally {
+        cleanup()
+    }
+}
+
+// labeled break@outer / continue@loop escaping nested loops
+fun labeled(xs: List<Int>, ys: List<Int>) {
+    outer@ for (i in xs) {
+        for (j in ys) {
+            if (i == j) break@outer
+            if (i < 0) continue@outer
+            pair(i, j)
+        }
+    }
+    done()
+}
+
+// while (true) {} — keeps EXIT reverse-reachable via the structural escape edge
+fun spin(flag: Boolean) {
+    while (true) {
+        if (flag) {
+            step()
+        }
+    }
+}
+
+// throw with no enclosing try/catch routes to EXIT
+fun maybeThrow(x: Boolean) {
+    if (x) throw RuntimeException("bad")
+    finish()
+}
+
+// a lambda is its own CFG; return@label routes to the lambda's EXIT
+fun lambdas(xs: List<Int>) {
+    xs.forEach { x ->
+        if (x < 0) return@forEach
+        use(x)
+    }
+}
+
+// expression-body function
+fun square(n: Int) = n * n
diff --git a/gitnexus/test/integration/cfg/fixtures/php-hazards.php b/gitnexus/test/integration/cfg/fixtures/php-hazards.php
new file mode 100644
index 000000000..cf1868792
--- /dev/null
+++ b/gitnexus/test/integration/cfg/fixtures/php-hazards.php
@@ -0,0 +1,142 @@
+<?php
+
+// PHP CFG hazard fixture for the PDG layer — one construct per function, with
+// distinctive call text so a test can locate the block for a region. Mirrors the
+// other languages' cfg hazard fixtures (java-hazards / python-hazards).
+
+namespace App\Cfg;
+
+function ifElifElse(int $x): void
+{
+    if ($x > 0) {
+        positive();
+    } elseif ($x < 0) {
+        negative();
+    } else {
+        zero();
+    }
+    after();
+}
+
+function loops(array $arr, int $n): void
+{
+    for ($i = 0; $i < $n; $i++) {
+        forBody();
+    }
+    foreach ($arr as $v) {
+        eachValue($v);
+    }
+    foreach ($arr as $k => $v) {
+        eachPair($k, $v);
+    }
+    while ($n > 0) {
+        whileBody();
+        $n--;
+    }
+    do {
+        doBody();
+    } while ($n < 10);
+}
+
+function switchFallthrough(int $x): string
+{
+    switch ($x) {
+        case 1:
+            one();
+            break;
+        case 2:
+            two();
+            // falls through (no break)
+        case 3:
+            three();
+            break;
+        default:
+            other();
+    }
+    return done();
+}
+
+function matchValue(int $x): string
+{
+    $r = match ($x) {
+        1, 2 => "low",
+        3 => "mid",
+        default => "high",
+    };
+    return $r;
+}
+
+function tryCatchFinally(): void
+{
+    try {
+        risky();
+    } catch (\TypeError | \ValueError $e) {
+        handleTyped($e);
+    } catch (\Exception $ex) {
+        handleOther($ex);
+    } finally {
+        cleanup();
+    }
+    afterTry();
+}
+
+function breakTwo(): void
+{
+    while (true) {
+        for ($i = 0; ; $i++) {
+            if (cond()) {
+                break 2;
+            }
+            if (other()) {
+                continue 2;
+            }
+            innerBody();
+        }
+        unreachableAfterInner();
+    }
+    afterLoops();
+}
+
+function infiniteLoop(int $x): void
+{
+    while (true) {
+        if ($x) {
+            tick();
+        }
+    }
+}
+
+function returnThroughFinally(int $x): int
+{
+    try {
+        if ($x > 0) {
+            return earlyReturn();
+        }
+        body();
+    } finally {
+        releaseLock();
+    }
+    return fallReturn();
+}
+
+function defsAndUses(array $data): int
+{
+    $x = $data;
+    $y = transform($x);
+    [$a, $b] = split($y);
+    list($c, $d) = pair($a);
+    return $b + $c + $d;
+}
+
+function closureCapture(int $b): callable
+{
+    $c = make();
+    return function (int $a) use ($b, &$c) {
+        return $a + $b + $c;
+    };
+}
+
+function arrowFn(int $n): callable
+{
+    return fn(int $a) => $a * $n;
+}
diff --git a/gitnexus/test/integration/cfg/fixtures/python-hazards.py b/gitnexus/test/integration/cfg/fixtures/python-hazards.py
new file mode 100644
index 000000000..ee01a83de
--- /dev/null
+++ b/gitnexus/test/integration/cfg/fixtures/python-hazards.py
@@ -0,0 +1,125 @@
+# Python CFG hazard fixture. Exercises every control-flow construct the Python
+# visitor models, including the EXIT-reachability hazard (`while True:` with no
+# static exit) the CDG soundness gate depends on, plus the structural divergences
+# from the brace family: indentation blocks, elif, for/while-else, with,
+# try/except/except*/else/finally, match/case, comprehensions, and the def shapes
+# (tuple/list unpack, walrus, augmented assign, global/nonlocal, *args/**kwargs).
+
+
+def if_elif_else(x):
+    """if / elif / else branch senses."""
+    if x > 0:
+        r = positive()
+    elif x < 0:
+        r = negative()
+    else:
+        r = zero()
+    return r
+
+
+def for_else(xs):
+    """for-else: the else runs on NORMAL completion, not on break."""
+    found = None
+    for i in xs:
+        if matches(i):
+            found = i
+            break
+    else:
+        found = default()
+    return found
+
+
+def while_else(x):
+    """while-else: same else-on-normal-completion / not-on-break semantics."""
+    while x > 0:
+        if done(x):
+            break
+        x -= 1
+    else:
+        finished()
+    return x
+
+
+def while_true_loop(x):
+    """while True: keeps EXIT reverse-reachable (CDG soundness hazard)."""
+    while True:
+        if should_stop(x):
+            return collect()
+        x = step(x)
+
+
+def with_dispose(path):
+    """with runs __exit__ on BOTH the normal and the exception exit."""
+    with open(path) as fh, lock() as l:
+        data = fh.read()
+        use(l)
+    return process(data)
+
+
+def with_early_return(path):
+    """a return inside a `with` threads through the dispose."""
+    with open(path) as fh:
+        return fh.read()
+
+
+def try_except_else_finally(payload):
+    """try / except / except* / else / finally completion edges."""
+    try:
+        result = parse(payload)
+    except ValueError as e:
+        result = recover(e)
+    except (TypeError, KeyError):
+        result = fallback()
+    else:
+        validate(result)
+    finally:
+        cleanup()
+    return result
+
+
+def try_except_group(payload):
+    """except* group handler."""
+    try:
+        body(payload)
+    except* ValueError as eg:
+        handle_group(eg)
+
+
+def match_dispatch(command):
+    """match / case: no fallthrough; the no-wildcard path keeps EXIT reachable."""
+    match command:
+        case "start":
+            on_start()
+        case ["move", x, y]:
+            on_move(x, y)
+        case {"kind": k} if k > 0:
+            on_kind(k)
+        case _:
+            on_default()
+    return ack()
+
+
+def defs_and_uses(a, b=1, *args, **kwargs):
+    """tuple/list unpack, walrus, augmented assign, comprehension, global."""
+    global COUNTER
+    x, y = compute(a, b)
+    [p, q] = pair()
+    first, *rest = sequence(args)
+    if (n := length(kwargs)) > 0:
+        total = n + x + y + p + q
+    squares = [i * i for i in rest if i > 0]
+    COUNTER += 1
+    return total if a else squares
+
+
+def nested_loops_labels(matrix):
+    """nested loops with continue/break and a comprehension target."""
+    out = []
+    for row in matrix:
+        for cell in row:
+            if cell is None:
+                continue
+            if cell < 0:
+                break
+            out.append(cell)
+    return [v for v in out]
diff --git a/gitnexus/test/integration/cfg/fixtures/ruby-hazards.rb b/gitnexus/test/integration/cfg/fixtures/ruby-hazards.rb
new file mode 100644
index 000000000..ffb2109af
--- /dev/null
+++ b/gitnexus/test/integration/cfg/fixtures/ruby-hazards.rb
@@ -0,0 +1,172 @@
+# Ruby CFG hazard fixture. Exercises every control-flow construct the Ruby
+# visitor models, including the EXIT-reachability hazard (`while true` / `loop do`
+# with no static exit) the CDG soundness gate depends on, plus the Ruby-specific
+# shapes: keyword/`end`-delimited blocks, elsif/unless, the statement-modifier
+# forms (`x if c`, `x while c`), until (inverted), case/when (no fallthrough),
+# case/in pattern matching, begin/rescue/else/ensure (+ method-level implicit
+# begin), retry, blocks/lambdas as closures, next/break/redo, and the def shapes
+# (multiple assignment, operator-assign, block params, rescue `=> e`).
+
+def if_elif_else(x)
+  # if / elsif / else branch senses.
+  if x > 0
+    r = positive()
+  elsif x < 0
+    r = negative()
+  else
+    r = zero()
+  end
+  r
+end
+
+def unless_form(x)
+  # unless inverts the sense — the body is the cond-false arm.
+  guard() unless x
+  done()
+end
+
+def modifier_forms(c)
+  # statement-modifier if / while.
+  y = compute() if c
+  step() while c
+  y
+end
+
+def while_loop(x)
+  # while: header + body + loop-back.
+  while x > 0
+    x -= 1
+  end
+  x
+end
+
+def until_loop
+  # until inverts: the body runs while the condition is FALSE.
+  until done?
+    advance()
+  end
+end
+
+def for_loop(xs)
+  # for: the loop var is a def, the iterable a use.
+  total = 0
+  for i in xs
+    total += i
+  end
+  total
+end
+
+def infinite_loop(x)
+  # `while true` with no static exit — the EXIT-reachability / CDG hazard. The
+  # structural cond-false escape edge keeps the post-dominator pass running.
+  while true
+    handle() if x
+  end
+end
+
+def loop_block
+  # `loop do … end` — the block is its own closure CFG; its body's normal
+  # fall-off must keep the block EXIT reverse-reachable.
+  loop do
+    work()
+  end
+end
+
+def case_when(x)
+  # case/when — no fallthrough between case bodies.
+  case x
+  when 1
+    one()
+  when 2, 3
+    two_or_three()
+  else
+    other()
+  end
+end
+
+def case_in(obj)
+  # case/in pattern matching — no fallthrough; the patterns bind.
+  case obj
+  in [a, b]
+    pair(a, b)
+  in { id: } if id > 0
+    by_id(id)
+  in Integer
+    int()
+  else
+    no_match()
+  end
+end
+
+def begin_rescue_else_ensure
+  # begin/rescue/else/ensure — ensure runs on every path; the else only on the
+  # no-exception path; the protected body throws to the handler.
+  begin
+    risky()
+  rescue StandardError => e
+    handle(e)
+  rescue TypeError
+    handle_type()
+  else
+    no_error()
+  ensure
+    cleanup()
+  end
+  after()
+end
+
+def method_implicit_begin
+  # a method body is an implicit begin — trailing rescue/ensure thread correctly.
+  perform()
+rescue => err
+  recover(err)
+ensure
+  finalize()
+end
+
+def retry_loop
+  # retry re-enters the begin protected body.
+  attempts = 0
+  begin
+    attempts += 1
+    connect()
+  rescue
+    retry if attempts < 3
+  end
+end
+
+def return_through_ensure(x)
+  # a return inside begin threads through ensure (finally-return).
+  begin
+    return early() if x
+    body()
+  ensure
+    release()
+  end
+end
+
+def block_jumps(xs)
+  # next ≈ continue, break exits, redo re-runs the block body.
+  xs.each do |n|
+    next if n.skip?
+    break if n.stop?
+    redo if n.retry?
+    use(n)
+  end
+end
+
+def def_shapes(a, b = 1, *rest, key:, **opts, &blk)
+  # def shapes: defaults, splat, kwsplat, keyword, block param; multiple assign;
+  # operator-assign; instance/class/global vars (NOT scalar local defs).
+  first, second = a, b
+  total = first
+  total += second
+  @cache = total
+  @@registry = rest
+  $global = opts
+  blk.call(key) if blk
+  total
+end
+
+square = ->(q) { q * q }
+doubler = lambda { |r| r + r }
diff --git a/gitnexus/test/integration/cfg/fixtures/rust-hazards.rs b/gitnexus/test/integration/cfg/fixtures/rust-hazards.rs
new file mode 100644
index 000000000..4870bbdbb
--- /dev/null
+++ b/gitnexus/test/integration/cfg/fixtures/rust-hazards.rs
@@ -0,0 +1,172 @@
+// Rust CFG hazard fixture (#2195 U7). Exercises every control-flow construct the
+// Rust visitor models, including the EXIT-reachability hazard (`loop {}` — the
+// canonical INFINITE loop with NO condition) the CDG soundness gate depends on,
+// plus the Rust-specific shapes: everything is an EXPRESSION (if / loop / while /
+// for / match / block), `if let` / `while let` / let-chains, labeled break /
+// continue (with a value), the `?` early-return operator, let-else, and the
+// destructuring def shapes (tuple / struct / slice / tuple-struct patterns).
+
+// ── if / else if / else (incl. if let) ──────────────────────────────────────
+
+fn if_elif_else(x: i32) -> i32 {
+    if x > 0 {
+        positive()
+    } else if x < 0 {
+        negative()
+    } else {
+        zero()
+    }
+}
+
+fn if_let_chain(opt: Option<i32>) -> i32 {
+    // `if let PAT = e && cond` — a let-chain condition; the binding is a def.
+    if let Some(n) = opt && n > 0 {
+        both(n)
+    } else {
+        none()
+    }
+}
+
+// ── loop {} — the INFINITE loop (NO condition), the EXIT-reachability hazard ──
+
+fn loop_forever(x: bool) {
+    // `loop {}` never terminates on its own; the visitor must emit a structural
+    // escape edge so EXIT stays reverse-reachable (else CDG is silently skipped).
+    loop {
+        if x {
+            tick();
+        }
+    }
+}
+
+fn loop_with_break(items: Vec<i32>) -> i32 {
+    let mut i = 0;
+    // `let v = loop { break value; }` — a loop in value position whose `break`
+    // carries a value.
+    let found = loop {
+        if i >= items.len() {
+            break -1;
+        }
+        if is_match(i) {
+            break i as i32;
+        }
+        i += 1;
+    };
+    found
+}
+
+// ── while / while let / for ─────────────────────────────────────────────────
+
+fn while_loop(mut x: i32) -> i32 {
+    while x > 0 {
+        x -= 1;
+    }
+    x
+}
+
+fn while_let(mut it: Iter) -> i32 {
+    let mut sum = 0;
+    // `while let Some(n) = it.next()` — the binding is a MAY-def (no bind on the
+    // exit iteration).
+    while let Some(n) = it.next() {
+        sum += n;
+    }
+    sum
+}
+
+fn for_loop(xs: Vec<i32>) -> i32 {
+    let mut total = 0;
+    for item in xs {
+        total += item;
+    }
+    total
+}
+
+// ── labeled break / continue from nested loops ──────────────────────────────
+
+fn labeled_jumps(grid: Vec<Vec<i32>>) -> i32 {
+    'outer: for row in grid {
+        for cell in row {
+            if cell < 0 {
+                break 'outer; // exits BOTH loops
+            }
+            if cell == 0 {
+                continue 'outer; // re-tests the OUTER loop
+            }
+            use_cell(cell);
+        }
+    }
+    done()
+}
+
+// ── match (no fallthrough) + guards + binding patterns ──────────────────────
+
+fn match_arms(x: i32) -> i32 {
+    match x {
+        0 => zero(),
+        1 | 2 => small(),          // or-pattern
+        n if n > 100 => big(n),    // guarded arm
+        v @ 3..=9 => mid(v),       // captured (`@`) + range pattern
+        _ => {                     // block-bodied catch-all arm
+            let r = other();
+            r
+        }
+    }
+}
+
+// ── return + the ? early-return operator ────────────────────────────────────
+
+fn try_operator(opt: Option<i32>) -> Option<i32> {
+    // `opt?` early-returns None on the None path (a throw-like edge to EXIT);
+    // the Ok path falls through.
+    let n = opt?;
+    if n > 0 {
+        return Some(n * 2);
+    }
+    Some(n)
+}
+
+// ── let destructuring + let-else ────────────────────────────────────────────
+
+fn destructuring() -> i32 {
+    let (a, b) = pair();          // tuple pattern — both a and b are defs
+    let Point { x, y } = point(); // struct pattern — x and y are defs
+    let [p, q] = couple();        // slice pattern — p and q are defs
+    a + b + x + y + p + q
+}
+
+fn let_else(opt: Option<i32>) -> i32 {
+    // `let Some(n) = e else { … }` — the else block diverges (return) on the
+    // binding-failure path; `n` is a def on the success path.
+    let Some(n) = opt else {
+        return -1;
+    };
+    n * 2
+}
+
+// ── closures (own CFG; opaque to the enclosing function) ────────────────────
+
+fn with_closure(xs: Vec<i32>) -> i32 {
+    let doubler = |v: i32| -> i32 { v * 2 }; // closure body is its own CFG
+    let mut total = 0;
+    for x in xs {
+        total += doubler(x);
+    }
+    total
+}
+
+// ── method + impl block ─────────────────────────────────────────────────────
+
+struct Counter {
+    value: i32,
+}
+
+impl Counter {
+    fn bump(&mut self, by: i32) -> i32 {
+        self.value += by;
+        if self.value > 100 {
+            return self.value;
+        }
+        self.value
+    }
+}
diff --git a/gitnexus/test/integration/cfg/fixtures/swift-hazards.swift b/gitnexus/test/integration/cfg/fixtures/swift-hazards.swift
new file mode 100644
index 000000000..037fb8275
--- /dev/null
+++ b/gitnexus/test/integration/cfg/fixtures/swift-hazards.swift
@@ -0,0 +1,136 @@
+// Swift CFG hazard fixture (#2195) — one of every control-flow shape the Swift
+// CfgVisitor models, so the worker-roundtrip / integration passes exercise the
+// real grammar end-to-end. Mirrors the sibling fixtures (go-hazards, rust-hazards).
+
+import Foundation
+
+// if / else + optional binding (`if let`)
+func branching(_ x: Int, opt: Int?) -> Int {
+    if x > 0 {
+        positive()
+    } else if x < 0 {
+        negative()
+    } else {
+        zero()
+    }
+    if let y = opt {
+        use(y)
+    }
+    return x
+}
+
+// guard let early-exit — the else MUST diverge, the body continues
+func guarded(opt: Int?) -> Int {
+    guard let value = opt else {
+        return -1
+    }
+    guard ready() else {
+        return -2
+    }
+    return value
+}
+
+// for-in / while / repeat-while (bottom-test) + `where`
+func loops() {
+    for item in collection where item > 0 {
+        consume(item)
+    }
+    while running() {
+        tick()
+    }
+    repeat {
+        retry()
+    } while shouldRetry()
+}
+
+// switch — no implicit fallthrough + explicit `fallthrough` + `where` guard
+func dispatch(_ x: Int) {
+    switch x {
+    case 1:
+        one()
+        fallthrough
+    case 2 where x > 0:
+        two()
+    case let n where n > 10:
+        big(n)
+    default:
+        other()
+    }
+}
+
+// do / catch (Swift error handling) with `try` / `try?` / `try!`
+func errorHandling() {
+    do {
+        try risky()
+        let cached = try? maybe()
+        try! forced()
+        deeper(cached)
+    } catch let error {
+        handle(error)
+    } catch {
+        fallbackHandler()
+    }
+    afterDo()
+}
+
+// defer — runs at scope exit, LIFO
+func deferred() -> Int {
+    defer { cleanupA() }
+    defer { cleanupB() }
+    let result = compute()
+    return result
+}
+
+// labeled break / continue
+func labeled() {
+    outer: for i in rows {
+        for j in cols {
+            if skip(i, j) {
+                continue outer
+            }
+            if stop(i, j) {
+                break outer
+            }
+            process(i, j)
+        }
+    }
+    done()
+}
+
+// `while true {}` — non-terminating; EXIT must stay reverse-reachable
+func eventLoop(_ active: Bool) {
+    while true {
+        if active {
+            poll()
+        }
+    }
+}
+
+// tuple destructuring + straight-line def/use
+func destructure(pair: (Int, Int)) {
+    let (a, b) = pair
+    let sum = a + b
+    use(sum)
+}
+
+// init / deinit are CFG-bearing
+class Resource {
+    var handle: Int
+
+    init(handle: Int) {
+        self.handle = handle
+    }
+
+    deinit {
+        release(handle)
+    }
+
+    // a closure is its own CFG
+    func register() {
+        events.forEach { event in
+            if event.isValid {
+                accept(event)
+            }
+        }
+    }
+}
diff --git a/gitnexus/test/integration/cfg/fixtures/vue-hazards.vue b/gitnexus/test/integration/cfg/fixtures/vue-hazards.vue
new file mode 100644
index 000000000..cef98e8b1
--- /dev/null
+++ b/gitnexus/test/integration/cfg/fixtures/vue-hazards.vue
@@ -0,0 +1,83 @@
+<!--
+  Vue SFC CFG hazard fixture (#2195 capstone). The <script setup lang="ts">
+  block is extracted by the SFC script extractor and parsed with the TypeScript
+  grammar; the Vue provider reuses the TypeScript CfgVisitor, so the worker
+  builds the same per-function CFG it would for a .ts file. Each function below
+  carries real branching, AND `eventLoop` is a non-terminating `while (true)`
+  with an interior `if` — the EXIT-reachability / CDG soundness hazard. The
+  <template> exists only to make this a realistic SFC; the CFG comes from the
+  script.
+-->
+<template>
+  <div class="counter" @click="onClick">{{ count }}</div>
+</template>
+
+<script setup lang="ts">
+import { ref } from 'vue';
+
+const count = ref(0);
+
+// if / else-if / else — branch senses; rejoin at the return.
+function classify(x: number): string {
+  let label: string;
+  if (x > 0) {
+    label = positive();
+  } else if (x < 0) {
+    label = negative();
+  } else {
+    label = zero();
+  }
+  return label;
+}
+
+// A non-terminating loop with an interior branch — keeps EXIT reverse-reachable
+// only via the structural escape edge, so CDG must stay > 0 (the silent-zero
+// hazard). A loop-carried accumulator (`sum`) gives the def/use harvest a fact.
+function eventLoop(x: number): number {
+  let sum = 0;
+  while (true) {
+    if (shouldStop(x)) {
+      return collect(sum);
+    }
+    sum = step(sum, x);
+    x = advance(x);
+  }
+}
+
+// A second branching shape so the script has multiple CFG-bearing functions.
+function onClick(): void {
+  if (count.value > 0) {
+    handle(count.value);
+  } else {
+    reset();
+  }
+}
+
+function positive(): string {
+  return 'positive';
+}
+function negative(): string {
+  return 'negative';
+}
+function zero(): string {
+  return 'zero';
+}
+function shouldStop(x: number): boolean {
+  return x > 100;
+}
+function collect(s: number): number {
+  return s;
+}
+function step(s: number, x: number): number {
+  return s + x;
+}
+function advance(x: number): number {
+  return x + 1;
+}
+function handle(v: number): void {
+  count.value = v - 1;
+}
+function reset(): void {
+  count.value = 0;
+}
+</script>
diff --git a/gitnexus/test/integration/cfg/pipeline-pdg.test.ts b/gitnexus/test/integration/cfg/pipeline-pdg.test.ts
index 2177c761a..00f4ed8f7 100644
--- a/gitnexus/test/integration/cfg/pipeline-pdg.test.ts
+++ b/gitnexus/test/integration/cfg/pipeline-pdg.test.ts
@@ -2,10 +2,13 @@ import { describe, it, expect, afterAll } from 'vitest';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
+import crypto from 'crypto';
 import { runPipelineFromRepo } from '../../../src/core/ingestion/pipeline.js';
 import type { PipelineResult } from '../../../src/types/pipeline.js';
 import { decodeTaintPath } from '../../../src/core/ingestion/taint/path-codec.js';
 import { fixtureTaintTotals } from '../../helpers/taint-fixture.js';
+import { isLanguageAvailable } from '../../../src/core/tree-sitter/parser-loader.js';
+import { SupportedLanguages } from '../../../src/config/supported-languages.js';
 
 // U7 — end-to-end proof that the `--pdg` opt-in reaches BOTH sinks: the parse
 // worker builds a per-function CFG (workerData.pdg) and scope-resolution emits
@@ -187,3 +190,356 @@ describe('U7 — end-to-end --pdg pipeline', () => {
     expect(cdg).toBe(0);
   }, 60000);
 });
+
+// ── C-family worker-mode PDG (#2195 U7) ─────────────────────────────────────
+//
+// The same both-sinks proof as the TS block above, run through the REAL worker
+// pipeline for each of C, C++, C#, Java, Go. Each language gets its own tiny
+// repo (one hazard fixture with real branching AND a non-terminating
+// loop/`select`) and we assert, under `--pdg`:
+//   - BasicBlock + CFG > 0 (the worker built a per-function CFG and emit wired it)
+//   - REACHING_DEF > 0 (the def/use harvest populates the data-dependence layer)
+//   - CDG > 0 AND ≥1 CDG edge is sourced INSIDE the non-terminating-loop
+//     function itself (`hazard`, below) — not merely an aggregate satisfied by
+//     any branching function in the fixture. This is the load-bearing claim:
+//     the post-dom/CDG pass was NOT skipped for the function whose loop traps
+//     EXIT, i.e. EXIT stays reverse-reachable end-to-end through the worker even
+//     with the non-terminating loop/`select`. (#2197 U3 — the prior whole-
+//     fixture `cdg > 0` aggregate did not isolate the hazard function.)
+// and without `--pdg` (both the default run and an explicit `pdg:false` run):
+//   - BasicBlock + CFG + REACHING_DEF + CDG == 0
+//   - the non-PDG graph is byte-identical between the two flag-off runs and
+//     matches a committed digest snapshot (the per-language byte-identical-off
+//     golden parity gate — R3; the cross-repo gate is pipeline-graph-golden).
+//
+// ⚠ Requires a FRESH `dist/parse-worker.js` — CFGs are built in the worker from
+// `dist/`. A stale bundle silently zeros CFG output. `pretest:integration` (and
+// the U7 verification recipe) run `node scripts/build.js` first.
+
+const C_FAMILY_FIXTURES = path.join(__dirname, 'fixtures');
+
+// `hazard`: a substring of a BasicBlock's `text` that appears ONLY inside the
+// fixture's non-terminating-loop function (`for(;;)` / `while(true)` / `for{}`).
+// It locates that function's block anchor so the CDG assertion can prove the
+// function specifically is CDG-bearing (see `cdgSourcedInHazardFunction`). C#
+// has no such loop (its `Retry` goto-cycle is conditional and terminates), so
+// it has no `hazard` and keeps the whole-fixture aggregate only.
+const C_FAMILY: ReadonlyArray<{ lang: string; fixture: string; hazard?: string }> = [
+  { lang: 'C', fixture: 'c-hazards.c', hazard: 'handle_request' }, // server_forever: for(;;)
+  { lang: 'C++', fixture: 'cpp-hazards.cpp', hazard: 'poll(' }, // run_forever: while(true)
+  { lang: 'C#', fixture: 'csharp-hazards.cs' }, // no non-terminating loop in the fixture
+  { lang: 'Java', fixture: 'java-hazards.java', hazard: 'ready(' }, // serve: while(true)
+  { lang: 'Go', fixture: 'go-hazards.go', hazard: 'handle(v)' }, // forInfinite: for{}
+];
+
+// ── Remaining-language worker-mode PDG (#2195 capstone) ─────────────────────
+//
+// The same both-sinks worker proof, run for the eight languages whose CFG
+// visitors completed the PDG-language rollout AFTER the C-family: the dynamic
+// languages (Python, PHP, Ruby), the systems/app languages (Rust, Swift,
+// Kotlin, Dart), AND Vue (whose provider reuses the TypeScript CfgVisitor — the
+// .vue file routes through the worker's Vue→TypeScript grammar mapping and the
+// SFC <script setup> extractor). Each fixture carries real branching AND a
+// non-terminating loop (`while True:` / `loop {}` / `while (true)`), and we
+// assert CDG > 0 AND that ≥1 CDG edge is sourced INSIDE that non-terminating-
+// loop function (`hazard`) — proving EXIT stays reverse-reachable end-to-end
+// through the worker for the silent-zero hazard function specifically, not just
+// in aggregate (#2197 U3). The right extension per language routes the worker to
+// the correct provider/grammar (Swift/Kotlin/Dart grammars are vendored).
+//
+// COBOL is the deliberate non-goal of #2195 (no installed grammar; exotic
+// PERFORM / GO-TO control flow). Its provider has no `cfgVisitor`, so the worker
+// emits no cfgSideChannel — that gate is asserted in `worker-roundtrip.test.ts`.
+const REMAINING_LANGS: ReadonlyArray<{
+  lang: string;
+  fixture: string;
+  hazard?: string;
+  // Vendored/optional grammar: gate on isLanguageAvailable so CI on a platform
+  // lacking the prebuilt grammar skips rather than fails (#2197 U4).
+  vendored?: boolean;
+}> = [
+  { lang: 'Python', fixture: 'python-hazards.py', hazard: 'should_stop' }, // while_true_loop
+  { lang: 'PHP', fixture: 'php-hazards.php', hazard: 'tick(' }, // infiniteLoop: while(true)
+  { lang: 'Ruby', fixture: 'ruby-hazards.rb', hazard: 'handle()' }, // infinite_loop: while true
+  { lang: 'Rust', fixture: 'rust-hazards.rs', hazard: 'tick(' }, // loop_forever: loop {}
+  { lang: 'Swift', fixture: 'swift-hazards.swift', hazard: 'poll(', vendored: true }, // eventLoop: while true
+  { lang: 'Kotlin', fixture: 'kotlin-hazards.kt', hazard: 'step(', vendored: true }, // spin: while(true)
+  { lang: 'Dart', fixture: 'dart-hazards.dart', hazard: 'work(', vendored: true }, // spin: while(true)
+  { lang: 'Vue', fixture: 'vue-hazards.vue', hazard: 'shouldStop' }, // eventLoop: while(true)
+];
+
+const cFamilyTmpDirs: string[] = [];
+function freshLangRepo(fixture: string): string {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gn-pdg-lang-'));
+  fs.copyFileSync(path.join(C_FAMILY_FIXTURES, fixture), path.join(dir, fixture));
+  cFamilyTmpDirs.push(dir);
+  return dir;
+}
+
+// Force worker-pool parsing even for a single small file: the CFG is built IN
+// the worker, so the proof is only meaningful on the worker path.
+const WORKER_PDG = {
+  pdg: true,
+  workerThresholdsForTest: { minFiles: 1, minBytes: 1 },
+  workerPoolSize: 2,
+} as const;
+const WORKER_OFF = {
+  workerThresholdsForTest: { minFiles: 1, minBytes: 1 },
+  workerPoolSize: 2,
+} as const;
+
+/**
+ * Deterministic, path/id-independent digest of the non-PDG graph: sorted
+ * label→count and relType→count maps + a sha256 over symbolic edge triples
+ * (label:name keyed, not opaque ids). Mirrors `pipeline-graph-golden`'s
+ * technique so the snapshot is stable across id-format refactors and only
+ * trips on a real semantic change to the C-family graph.
+ */
+function graphDigest(result: PipelineResult): {
+  symbols: number;
+  relationships: number;
+  byType: Record<string, number>;
+  byRelType: Record<string, number>;
+  edgeDigest: string;
+} {
+  const byType: Record<string, number> = {};
+  const byRelType: Record<string, number> = {};
+  const nodeKey = new Map<string, string>();
+  result.graph.forEachNode((n) => {
+    byType[n.label] = (byType[n.label] ?? 0) + 1;
+    const props = n.properties as Record<string, unknown>;
+    const fp = (props.filePath as string | undefined) ?? '';
+    const nm = (props.name as string | undefined) ?? '';
+    nodeKey.set(n.id, `${n.label}:${nm}@${fp}`);
+  });
+  const triples: string[] = [];
+  for (const rel of result.graph.iterRelationships()) {
+    byRelType[rel.type] = (byRelType[rel.type] ?? 0) + 1;
+    const src = nodeKey.get(rel.sourceId) ?? `?:${rel.sourceId}`;
+    const dst = nodeKey.get(rel.targetId) ?? `?:${rel.targetId}`;
+    triples.push(`${rel.type}|${src}|${dst}`);
+  }
+  triples.sort();
+  const sortObj = (o: Record<string, number>): Record<string, number> => {
+    const out: Record<string, number> = {};
+    for (const k of Object.keys(o).sort()) out[k] = o[k];
+    return out;
+  };
+  return {
+    symbols: result.graph.nodeCount,
+    relationships: result.graph.relationshipCount,
+    byType: sortObj(byType),
+    byRelType: sortObj(byRelType),
+    edgeDigest: crypto.createHash('sha256').update(triples.join('\n')).digest('hex'),
+  };
+}
+
+/**
+ * Parse a BasicBlock node id into its function anchor (#2197 U3). emit.ts
+ * templates the id as `BasicBlock:<filePath>:<fnLine>:<fnCol>:<blockIndex>`
+ * (filePath may itself contain `:` on some platforms) — so the anchor is every
+ * segment except the trailing block index, and the function anchor is the id
+ * with its final `:<blockIndex>` segment stripped. All blocks of one function
+ * share that anchor; block indices restart at 0 per function.
+ */
+function functionAnchorOf(blockId: string): string {
+  return blockId.slice(0, blockId.lastIndexOf(':'));
+}
+
+/**
+ * Whether ≥1 CDG edge is sourced inside the fixture's non-terminating-loop
+ * function — the load-bearing #2197 U3 claim. Locates that function via
+ * `hazardMarker` (a substring of a block `text` unique to the hazard function),
+ * derives its block anchor, collects every BasicBlock id under that anchor, and
+ * checks whether any CDG edge's source block is one of them. Unlike the whole-
+ * fixture `cdg > 0` aggregate (satisfied by ANY branching function), this proves
+ * the post-dom/CDG pass actually ran for the function whose loop traps EXIT.
+ */
+function cdgSourcedInHazardFunction(result: PipelineResult, hazardMarker: string): boolean {
+  // Find the hazard function's anchor from the block whose text carries the
+  // marker, and (separately) every block id grouped by anchor.
+  let hazardAnchor: string | undefined;
+  const idsByAnchor = new Map<string, Set<string>>();
+  result.graph.forEachNode((n) => {
+    if (n.label !== 'BasicBlock') return;
+    const anchor = functionAnchorOf(n.id);
+    (idsByAnchor.get(anchor) ?? idsByAnchor.set(anchor, new Set()).get(anchor)!).add(n.id);
+    const text = (n.properties as { text?: string }).text ?? '';
+    if (text.includes(hazardMarker)) hazardAnchor = anchor;
+  });
+  if (hazardAnchor === undefined) return false; // marker not found → fail the assertion
+  const hazardBlockIds = idsByAnchor.get(hazardAnchor) ?? new Set<string>();
+  for (const rel of result.graph.iterRelationships()) {
+    if (rel.type === 'CDG' && hazardBlockIds.has(rel.sourceId)) return true;
+  }
+  return false;
+}
+
+describe('U7 — C-family worker-mode --pdg pipeline', () => {
+  afterAll(() => {
+    for (const d of cFamilyTmpDirs) fs.rmSync(d, { recursive: true, force: true });
+  });
+
+  for (const { lang, fixture, hazard } of C_FAMILY) {
+    it(`${lang}: --pdg on emits BasicBlock + CFG + REACHING_DEF + CDG (> 0) via the worker`, async () => {
+      const result = await runPipelineFromRepo(freshLangRepo(fixture), () => {}, WORKER_PDG);
+      // The CFG is built in the worker — a stale dist silently zeros this.
+      expect(result.usedWorkerPool).toBe(true);
+      const { basicBlocks, cfgEdges, reachingDefs, cdg } = counts(result);
+      expect(basicBlocks, `${lang} BasicBlock count`).toBeGreaterThan(0);
+      expect(cfgEdges, `${lang} CFG edge count`).toBeGreaterThan(0);
+      // def/use harvest populated the data-dependence layer.
+      expect(reachingDefs, `${lang} REACHING_DEF count`).toBeGreaterThan(0);
+      // CDG > 0 proves the post-dom/CDG pass ran for SOME function in the fixture.
+      expect(cdg, `${lang} CDG count`).toBeGreaterThan(0);
+      // The load-bearing claim (#2197 U3): ≥1 CDG edge is sourced INSIDE the
+      // non-terminating-loop function itself — so the post-dom/CDG pass was NOT
+      // skipped for the function whose loop traps EXIT, i.e. EXIT stays
+      // reverse-reachable end-to-end through the worker even with that loop. The
+      // whole-fixture aggregate above would pass on any branching function; this
+      // pins it to the hazard. (C# has no such loop → no `hazard` → aggregate only.)
+      if (hazard !== undefined) {
+        expect(
+          cdgSourcedInHazardFunction(result, hazard),
+          `${lang} CDG edge sourced inside the non-terminating-loop function (marker ${JSON.stringify(hazard)})`,
+        ).toBe(true);
+      }
+
+      // Both CFG and CDG endpoints are persisted BasicBlocks; CDG carries a T/F.
+      const blockIds = new Set<string>();
+      result.graph.forEachNode((n) => {
+        if (n.label === 'BasicBlock') blockIds.add(n.id);
+      });
+      for (const rel of result.graph.iterRelationships()) {
+        if (rel.type === 'CFG' || rel.type === 'REACHING_DEF' || rel.type === 'CDG') {
+          expect(blockIds.has(rel.sourceId), `${lang} ${rel.type} source is a BasicBlock`).toBe(
+            true,
+          );
+          expect(blockIds.has(rel.targetId), `${lang} ${rel.type} target is a BasicBlock`).toBe(
+            true,
+          );
+        }
+        if (rel.type === 'CDG') expect(['T', 'F']).toContain(rel.reason);
+      }
+    }, 60000);
+
+    it(`${lang}: --pdg off is byte-identical (zero PDG nodes/edges, stable golden digest)`, async () => {
+      // Default (no pdg flag) and explicit pdg:false must produce the IDENTICAL
+      // graph — the R3 parity property — and neither carries any PDG layer.
+      const defaultRun = await runPipelineFromRepo(freshLangRepo(fixture), () => {}, WORKER_OFF);
+      const offRun = await runPipelineFromRepo(freshLangRepo(fixture), () => {}, {
+        ...WORKER_OFF,
+        pdg: false,
+      });
+
+      for (const r of [defaultRun, offRun]) {
+        const { basicBlocks, cfgEdges, reachingDefs, tainted, sanitizes, cdg } = counts(r);
+        expect(basicBlocks).toBe(0);
+        expect(cfgEdges).toBe(0);
+        expect(reachingDefs).toBe(0);
+        expect(tainted).toBe(0);
+        expect(sanitizes).toBe(0);
+        expect(cdg).toBe(0);
+      }
+
+      const defaultDigest = graphDigest(defaultRun);
+      const offDigest = graphDigest(offRun);
+      // pdg:false ≡ pdg-absent — the dominant existing-user path is untouched.
+      expect(offDigest).toEqual(defaultDigest);
+      // None of the PDG node/rel types leak into the flag-off graph.
+      for (const t of ['BasicBlock'] as const) expect(defaultDigest.byType[t]).toBeUndefined();
+      for (const t of ['CFG', 'REACHING_DEF', 'CDG', 'TAINTED', 'SANITIZES'] as const)
+        expect(defaultDigest.byRelType[t]).toBeUndefined();
+      // Committed golden: the flag-off graph is pinned by snapshot so a future
+      // refactor that silently rewires the C-family graph trips this gate.
+      expect(defaultDigest).toMatchSnapshot();
+    }, 90000);
+  }
+});
+
+describe('U7 — remaining languages worker-mode --pdg pipeline (#2195 capstone)', () => {
+  afterAll(() => {
+    for (const d of cFamilyTmpDirs) fs.rmSync(d, { recursive: true, force: true });
+  });
+
+  for (const { lang, fixture, hazard, vendored } of REMAINING_LANGS) {
+    // Vendored grammars (Swift/Kotlin/Dart) may lack a prebuild on the CI
+    // platform — skip rather than fail when the grammar can't load (#2197 U4).
+    const testFn =
+      !vendored || isLanguageAvailable(SupportedLanguages[lang as keyof typeof SupportedLanguages])
+        ? it
+        : it.skip;
+    testFn(
+      `${lang}: --pdg on emits BasicBlock + CFG + REACHING_DEF + CDG (> 0) via the worker`,
+      async () => {
+        const result = await runPipelineFromRepo(freshLangRepo(fixture), () => {}, WORKER_PDG);
+        // The CFG is built in the worker — a stale dist silently zeros this.
+        expect(result.usedWorkerPool, `${lang} used the worker pool`).toBe(true);
+        const { basicBlocks, cfgEdges, reachingDefs, cdg } = counts(result);
+        expect(basicBlocks, `${lang} BasicBlock count`).toBeGreaterThan(0);
+        expect(cfgEdges, `${lang} CFG edge count`).toBeGreaterThan(0);
+        // def/use harvest populated the data-dependence layer.
+        expect(reachingDefs, `${lang} REACHING_DEF count`).toBeGreaterThan(0);
+        // CDG > 0 proves the post-dom/CDG pass ran for SOME function in the fixture.
+        expect(cdg, `${lang} CDG count`).toBeGreaterThan(0);
+        // The load-bearing claim (#2197 U3): ≥1 CDG edge is sourced INSIDE the
+        // non-terminating-loop function itself — so the post-dom/CDG pass was NOT
+        // skipped for the function whose loop traps EXIT, i.e. EXIT stays
+        // reverse-reachable end-to-end through the worker even with that loop. The
+        // whole-fixture aggregate above would pass on any branching function; this
+        // pins it to the hazard.
+        if (hazard !== undefined) {
+          expect(
+            cdgSourcedInHazardFunction(result, hazard),
+            `${lang} CDG edge sourced inside the non-terminating-loop function (marker ${JSON.stringify(hazard)})`,
+          ).toBe(true);
+        }
+
+        // Both CFG and CDG endpoints are persisted BasicBlocks; CDG carries a T/F.
+        const blockIds = new Set<string>();
+        result.graph.forEachNode((n) => {
+          if (n.label === 'BasicBlock') blockIds.add(n.id);
+        });
+        for (const rel of result.graph.iterRelationships()) {
+          if (rel.type === 'CFG' || rel.type === 'REACHING_DEF' || rel.type === 'CDG') {
+            expect(blockIds.has(rel.sourceId), `${lang} ${rel.type} source is a BasicBlock`).toBe(
+              true,
+            );
+            expect(blockIds.has(rel.targetId), `${lang} ${rel.type} target is a BasicBlock`).toBe(
+              true,
+            );
+          }
+          if (rel.type === 'CDG') expect(['T', 'F']).toContain(rel.reason);
+        }
+      },
+      60000,
+    );
+
+    testFn(
+      `${lang}: --pdg off emits zero PDG nodes/edges (the R3 flag-off gate)`,
+      async () => {
+        // Default (no pdg flag) and explicit pdg:false must both produce a graph
+        // with NO PDG layer — the existing-user path stays untouched.
+        const defaultRun = await runPipelineFromRepo(freshLangRepo(fixture), () => {}, WORKER_OFF);
+        const offRun = await runPipelineFromRepo(freshLangRepo(fixture), () => {}, {
+          ...WORKER_OFF,
+          pdg: false,
+        });
+
+        for (const r of [defaultRun, offRun]) {
+          const { basicBlocks, cfgEdges, reachingDefs, tainted, sanitizes, cdg } = counts(r);
+          expect(basicBlocks).toBe(0);
+          expect(cfgEdges).toBe(0);
+          expect(reachingDefs).toBe(0);
+          expect(tainted).toBe(0);
+          expect(sanitizes).toBe(0);
+          expect(cdg).toBe(0);
+        }
+
+        // pdg:false ≡ pdg-absent — the symbolic graph digest is identical.
+        expect(graphDigest(offRun)).toEqual(graphDigest(defaultRun));
+      },
+      90000,
+    );
+  }
+});
diff --git a/gitnexus/test/integration/cfg/worker-roundtrip.test.ts b/gitnexus/test/integration/cfg/worker-roundtrip.test.ts
index e61112ee0..5649f45cb 100644
--- a/gitnexus/test/integration/cfg/worker-roundtrip.test.ts
+++ b/gitnexus/test/integration/cfg/worker-roundtrip.test.ts
@@ -27,15 +27,17 @@ const tsVisitor = (): CfgVisitor<SyntaxNode> => {
   return v;
 };
 
-describe('U3 — TS/JS provider exposes a cfgVisitor; others do not (worker gate)', () => {
+describe('CFG provider gate — a cfgVisitor enables the worker CFG path', () => {
   it('TS and JS providers carry a cfgVisitor', () => {
     expect(getProvider(SupportedLanguages.TypeScript).cfgVisitor).toBeDefined();
     expect(getProvider(SupportedLanguages.JavaScript).cfgVisitor).toBeDefined();
   });
 
-  it('a non-CFG language (Python) has no cfgVisitor ⇒ worker emits no cfgSideChannel', () => {
+  it('a non-CFG language (COBOL) has no cfgVisitor ⇒ worker emits no cfgSideChannel', () => {
     // `provider.cfgVisitor &&` short-circuits in the worker → no CFG, no field.
-    expect(getProvider(SupportedLanguages.Python).cfgVisitor).toBeUndefined();
+    // COBOL is the deliberate non-goal of the PDG-language rollout (#2195) —
+    // every other supported language now carries a cfgVisitor.
+    expect(getProvider(SupportedLanguages.Cobol).cfgVisitor).toBeUndefined();
   });
 });
 
@@ -46,7 +48,7 @@ describe('U3 — collectFunctionCfgs', () => {
       function b() { return 1; }
     `);
     const { cfgs, skipped } = collectFunctionCfgs(root, tsVisitor(), 'a.ts');
-    expect(skipped).toBe(0);
+    expect(skipped).toEqual({ tooManyLines: 0, tooDeeplyNested: 0, buildError: 0 });
     expect(cfgs).toHaveLength(2);
     const a = cfgs.find((c) => c.blocks.some((bl) => bl.text.includes('p();')));
     expect(a).toBeDefined();
@@ -64,18 +66,56 @@ describe('U3 — collectFunctionCfgs', () => {
       'x.ts',
     );
     expect(cfgs).toHaveLength(0);
-    expect(skipped).toBe(0);
+    expect(skipped).toEqual({ tooManyLines: 0, tooDeeplyNested: 0, buildError: 0 });
   });
 
   it('maxFunctionLines skips an over-cap function and counts the skip', () => {
     const big = `function big() {\n${'  step();\n'.repeat(20)}}`;
     const root = tsRoot(`${big}\nfunction small() { ok(); }`);
     const { cfgs, skipped } = collectFunctionCfgs(root, tsVisitor(), 'f.ts', 5);
-    expect(skipped).toBe(1); // big() exceeds the 5-line cap
+    expect(skipped.tooManyLines).toBe(1); // big() exceeds the 5-line cap
+    expect(skipped.tooDeeplyNested).toBe(0);
+    expect(skipped.buildError).toBe(0);
     // small() is still built
     expect(cfgs.some((c) => c.blocks.some((bl) => bl.text.includes('ok();')))).toBe(true);
     expect(cfgs.some((c) => c.blocks.some((bl) => bl.text.includes('step();')))).toBe(false);
   });
+
+  it('a pathologically deep nest is bailed proactively and counted (#2195)', () => {
+    // A function nested far past MAX_CFG_NESTING_DEPTH (real code is ≤ ~50 deep).
+    // The visitor's proactive guard throws CfgNestingDepthError; collect counts
+    // it under tooDeeplyNested and ISOLATES it — the sibling function still
+    // builds (the bail must not drop the whole file's CFGs).
+    const deep = `function deep() { ${'if (c) {'.repeat(1200)} leaf(); ${'}'.repeat(1200)} }`;
+    const root = tsRoot(`${deep}\nfunction sibling() { ok(); }`);
+    const { cfgs, skipped } = collectFunctionCfgs(root, tsVisitor(), 'deep.ts');
+    expect(skipped.tooDeeplyNested).toBe(1);
+    expect(skipped.tooManyLines).toBe(0);
+    expect(skipped.buildError).toBe(0);
+    // sibling() survives the bail
+    expect(cfgs.some((c) => c.blocks.some((bl) => bl.text.includes('ok();')))).toBe(true);
+    expect(cfgs.some((c) => c.blocks.some((bl) => bl.text.includes('leaf();')))).toBe(false);
+  });
+
+  it('isolates a generic build error to one function and counts it (buildError, #2195)', () => {
+    // A non-CfgNestingDepthError throw from buildFunctionCfg used to escape to the
+    // worker language-group catch and drop EVERY remaining file's CFG. It must now
+    // be caught per function, counted under buildError, and NOT stop the sibling.
+    const real = tsVisitor();
+    const flaky: CfgVisitor<SyntaxNode> = {
+      isFunction: (n) => real.isFunction(n),
+      buildFunctionCfg: (n, fp) => {
+        if (n.text.includes('boom()')) throw new Error('synthetic build failure');
+        return real.buildFunctionCfg(n, fp);
+      },
+    };
+    const root = tsRoot(`function bad() { boom(); }\nfunction good() { ok(); }`);
+    const { cfgs, skipped } = collectFunctionCfgs(root, flaky, 'be.ts');
+    expect(skipped).toEqual({ tooManyLines: 0, tooDeeplyNested: 0, buildError: 1 });
+    // good() still builds — the throw didn't drop the file's other CFGs
+    expect(cfgs.some((c) => c.blocks.some((bl) => bl.text.includes('ok();')))).toBe(true);
+    expect(cfgs.some((c) => c.blocks.some((bl) => bl.text.includes('boom();')))).toBe(false);
+  });
 });
 
 describe('U3 — CFG side-channel JSON round-trip (no AST leakage, no field loss)', () => {
diff --git a/gitnexus/test/integration/literal-collectors.test.ts b/gitnexus/test/integration/literal-collectors.test.ts
index 9715cdb18..064bc0445 100644
--- a/gitnexus/test/integration/literal-collectors.test.ts
+++ b/gitnexus/test/integration/literal-collectors.test.ts
@@ -82,6 +82,29 @@ describe('literal-collectors', () => {
     });
   });
 
+  describe('fileLanguages — `*-harvest.ts` map to their grammar (U10)', () => {
+    const fl = __test.fileLanguages;
+    it('maps each <lang>-harvest.ts to the same grammar(s) as its <lang>.ts visitor', () => {
+      expect(fl('cfg/visitors/go-harvest.ts')).toEqual([SupportedLanguages.Go]);
+      expect(fl('cfg/visitors/csharp-harvest.ts')).toEqual([SupportedLanguages.CSharp]);
+      expect(fl('cfg/visitors/typescript-harvest.ts')).toEqual([SupportedLanguages.TypeScript]);
+      expect(fl('cfg/visitors/c-cpp-harvest.ts')).toEqual([
+        SupportedLanguages.C,
+        SupportedLanguages.CPlusPlus,
+      ]);
+      // a harvester pins exactly its visitor's grammar set, not the weak ALL_LANGS
+      expect(fl('cfg/visitors/go-harvest.ts')).toEqual(fl('cfg/visitors/go.ts'));
+    });
+    it('leaves the language-agnostic harvesters valid-if-any (ALL_LANGS)', () => {
+      const all = fl('cfg/visitors/call-site-harvest.ts');
+      const scopeTree = fl('cfg/visitors/scope-tree-harvest.ts');
+      // both name no grammar → fall through to the full gated set, which is far
+      // larger than any single-/dual-language harvester mapping
+      expect(all.length).toBeGreaterThan(2);
+      expect(scopeTree).toEqual(all);
+    });
+  });
+
   describe('Mode 4 — registry resolution layer (TypeChecker-gated)', () => {
     it('scans the resolution layer and tags literals by language dir', () => {
       const { nodeTypes } = __test.collectResolutionLayerLiterals();
diff --git a/gitnexus/test/unit/cfg/c-cpp-visitor.test.ts b/gitnexus/test/unit/cfg/c-cpp-visitor.test.ts
new file mode 100644
index 000000000..a9263e37f
--- /dev/null
+++ b/gitnexus/test/unit/cfg/c-cpp-visitor.test.ts
@@ -0,0 +1,423 @@
+import { describe, it, expect, vi } from 'vitest';
+import { createRequire } from 'node:module';
+import { requireVendoredGrammar } from '../../../src/core/tree-sitter/vendored-grammars.js';
+import {
+  createCCfgVisitor,
+  createCppCfgVisitor,
+} from '../../../src/core/ingestion/cfg/visitors/c-cpp.js';
+import {
+  makeCfgHarness,
+  type CfgHarness,
+  block,
+  edgeKinds,
+  reaches,
+  reachable,
+  bindingIdx,
+  allSites,
+  hasAnySites,
+} from '../../helpers/cfg-harness.js';
+import { isExitReachableFromAllBlocks } from '../../../src/core/ingestion/cfg/post-dominators.js';
+import { augmentForPostDom } from '../../../src/core/ingestion/cfg/synthetic-escape.js';
+import { computeControlDependence } from '../../../src/core/ingestion/cfg/control-dependence.js';
+
+// U2 — the C/C++ CfgVisitor, one hazard per test (KTD5: real-parser regression,
+// NOT snapshot-pinning). Each fixture's distinctive statement text (step(),
+// done(), handle(e), …) lets us locate the block for a region by text and assert
+// the control-flow topology around it.
+
+const cGrammar = requireVendoredGrammar('tree-sitter-c') as Parameters<typeof makeCfgHarness>[0];
+const cppGrammar = createRequire(import.meta.url)('tree-sitter-cpp') as Parameters<
+  typeof makeCfgHarness
+>[0];
+
+const c: CfgHarness = makeCfgHarness(cGrammar, createCCfgVisitor(), 'fixture.c');
+const cpp: CfgHarness = makeCfgHarness(cppGrammar, createCppCfgVisitor(), 'fixture.cpp');
+
+describe('C CfgVisitor — structure', () => {
+  it('straight-line body: ENTRY → block → EXIT (seq)', () => {
+    const cfg = c.cfgOf(`void f() { a(); b(); c(); }`);
+    expect(cfg.blocks.filter((b) => b.kind === 'normal')).toHaveLength(1);
+    const body = block(cfg, 'a();');
+    expect(cfg.edges).toContainEqual({ from: cfg.entryIndex, to: body, kind: 'seq' });
+    expect(reaches(cfg, body, cfg.exitIndex)).toBe(true);
+  });
+
+  it('empty body: ENTRY → EXIT', () => {
+    const cfg = c.cfgOf(`void f() {}`);
+    expect(cfg.blocks).toHaveLength(2);
+    expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+  });
+
+  it('malformed/unmodeled body returns undefined without throwing', () => {
+    // A forward-declaration prototype (`int f(int);`) has no compound_statement
+    // body — buildFunctionCfg must return undefined rather than throw.
+    const root = c.parse(`int f(int);`);
+    const fns = c.collectFunctions(root);
+    // No function_definition (only a declaration) → nothing to build.
+    expect(fns).toHaveLength(0);
+    // And a body-less function node yields undefined, not a throw.
+    const decl = c.parse(`void g() { x(); }`);
+    const fn = c.collectFunctions(decl)[0];
+    expect(() => createCCfgVisitor().buildFunctionCfg(fn, 'f.c')).not.toThrow();
+  });
+});
+
+describe('C CfgVisitor — branching', () => {
+  it('if/else: cond-true to then, cond-false to else, both reach the join', () => {
+    const cfg = c.cfgOf(`void f(int x) { if (x) { a(); } else { b(); } c(); }`);
+    const kinds = edgeKinds(cfg);
+    expect(kinds.has('cond-true')).toBe(true);
+    expect(kinds.has('cond-false')).toBe(true);
+    const join = block(cfg, 'c();');
+    expect(reaches(cfg, block(cfg, 'a();'), join)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'b();'), join)).toBe(true);
+  });
+
+  it('plain if (no else): condition reaches both the body and the join', () => {
+    const cfg = c.cfgOf(`void f(int x) { if (x) { a(); } b(); }`);
+    const cond = block(cfg, 'x');
+    expect(reaches(cfg, cond, block(cfg, 'a();'))).toBe(true);
+    expect(reaches(cfg, cond, block(cfg, 'b();'))).toBe(true);
+  });
+});
+
+describe('C CfgVisitor — loops', () => {
+  it('while loop: header + back-edge + exit', () => {
+    const cfg = c.cfgOf(`void f(int x) { while (x > 0) { step(); } done(); }`);
+    const header = block(cfg, 'x > 0');
+    const body = block(cfg, 'step();');
+    expect(cfg.edges).toContainEqual({ from: body, to: header, kind: 'loop-back' });
+    expect(edgeKinds(cfg).has('cond-true')).toBe(true);
+    expect(reaches(cfg, header, block(cfg, 'done();'))).toBe(true);
+  });
+
+  it('do-while runs the body BEFORE testing, then loops back from the bottom', () => {
+    const cfg = c.cfgOf(`void f(int x) { do { step(); } while (x > 0); done(); }`);
+    const body = block(cfg, 'step();');
+    const cond = block(cfg, 'x > 0');
+    expect(reaches(cfg, cfg.entryIndex, body)).toBe(true); // body runs first
+    // The back-edge / condition tests at the BOTTOM (cond reachable from body).
+    expect(reaches(cfg, body, cond)).toBe(true);
+    expect(cfg.edges).toContainEqual({ from: cond, to: body, kind: 'loop-back' });
+    expect(reaches(cfg, cond, block(cfg, 'done();'))).toBe(true);
+  });
+
+  it('C-style for: init once, condition header, back-edge through increment', () => {
+    const cfg = c.cfgOf(`void f() { for (int i = 0; i < n; i++) { step(); } done(); }`);
+    const init = block(cfg, 'int i = 0');
+    const header = block(cfg, 'i < n');
+    const incr = block(cfg, 'i++');
+    const body = block(cfg, 'step();');
+    expect(cfg.edges).toContainEqual({ from: cfg.entryIndex, to: init, kind: 'seq' });
+    expect(reaches(cfg, body, incr)).toBe(true);
+    expect(cfg.edges).toContainEqual({ from: incr, to: header, kind: 'loop-back' });
+    expect(reaches(cfg, header, block(cfg, 'done();'))).toBe(true);
+  });
+
+  it('for(;;) {} keeps EXIT reverse-reachable AND emits CDG > 0', () => {
+    // The header has a cond-false escape to the loop-exit even with no condition;
+    // the inner `if` is a real control point. Assert through the production
+    // post-dom/CDG passes (matching go/python/ruby/rust/vue) — CDG is only
+    // computed when EXIT stays reverse-reachable, so a non-empty CDG proves the
+    // structural exit-escape edge keeps the function CDG-bearing.
+    const cfg = c.cfgOf(`void f(int x) { for (;;) { if (x) { g(); } } }`);
+    expect(edgeKinds(cfg).has('cond-false')).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+    expect(computeControlDependence(cfg).edges.length).toBeGreaterThan(0);
+  });
+});
+
+describe('C CfgVisitor — switch (C-style fallthrough)', () => {
+  it('a case without break falls into the next case (switch-case + fallthrough)', () => {
+    const cfg = c.cfgOf(`void f(int x) {
+      switch (x) {
+        case 1: one();
+        case 2: two(); break;
+        default: other();
+      }
+      after();
+    }`);
+    expect(edgeKinds(cfg).has('switch-case')).toBe(true);
+    expect(edgeKinds(cfg).has('fallthrough')).toBe(true);
+    // case 1 (no break) FALLS THROUGH into case 2.
+    expect(reaches(cfg, block(cfg, 'one();'), block(cfg, 'two();'))).toBe(true);
+    // both cases reach the post-switch continuation.
+    expect(reaches(cfg, block(cfg, 'two();'), block(cfg, 'after();'))).toBe(true);
+  });
+
+  it('break-terminated case does not fall into the next case', () => {
+    const cfg = c.cfgOf(`void f(int x) {
+      switch (x) { case 1: one(); break; case 2: two(); break; }
+      after();
+    }`);
+    expect(reaches(cfg, block(cfg, 'one();'), block(cfg, 'two();'))).toBe(false);
+    expect(reaches(cfg, block(cfg, 'one();'), block(cfg, 'after();'))).toBe(true);
+  });
+});
+
+describe('C CfgVisitor — goto / labels', () => {
+  it('backward goto wires to an already-seen label block', () => {
+    const cfg = c.cfgOf(
+      `void f() { int i = 0; loop: work(); i++; if (i < 10) goto loop; done(); }`,
+    );
+    const gotoB = block(cfg, 'goto loop;');
+    const label = block(cfg, 'work();');
+    expect(reaches(cfg, gotoB, label)).toBe(true);
+    expect(cfg.edges.some((e) => e.from === gotoB && e.to === label)).toBe(true);
+  });
+
+  it('forward goto wires to a label that appears later', () => {
+    const cfg = c.cfgOf(`void f(int x) { if (x) goto end; work(); end: done(); }`);
+    const gotoB = block(cfg, 'goto end;');
+    const label = block(cfg, 'done();');
+    expect(reaches(cfg, gotoB, label)).toBe(true);
+    // the goto skips work() on its path.
+    expect(reachable(cfg, block(cfg, 'work();'))).toBe(true);
+  });
+
+  it('goto to an UNDEFINED label routes to EXIT (single-exit preserved) and warns', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    try {
+      const cfg = c.cfgOf(`void f() { work(); goto missing; }`);
+      const gotoB = block(cfg, 'goto missing;');
+      expect(reaches(cfg, gotoB, cfg.exitIndex)).toBe(true);
+      expect(warn).toHaveBeenCalled();
+    } finally {
+      warn.mockRestore();
+    }
+  });
+
+  // #2197 U1 — an UNCONDITIONAL goto-cycle traps EXIT (the `goto start` has no
+  // exit path), so without the synthetic-escape pass `emitFileCdg` would withhold
+  // ALL control dependence. After the pass the cycle is bridged and CDG is
+  // emitted. The conditional goto tests above already had an exit path (the
+  // if-false arm reaches `done()`), so they did NOT exercise this gap.
+  it('unconditional goto-cycle: bridged → EXIT reachable AND CDG emitted (C)', () => {
+    const cfg = c.cfgOf(`void handler(int a){ start: if(a>0){work();} goto start; }`);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(false); // trapped without the pass
+    const view = augmentForPostDom(cfg);
+    expect(isExitReachableFromAllBlocks(view)).toBe(true);
+    expect(computeControlDependence(view).edges.length).toBeGreaterThan(0);
+  });
+
+  it('unconditional goto-cycle: bridged → EXIT reachable AND CDG emitted (C++)', () => {
+    const cfg = cpp.cfgOf(`void handler(int a){ start: if(a>0){work();} goto start; }`);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(false);
+    const view = augmentForPostDom(cfg);
+    expect(isExitReachableFromAllBlocks(view)).toBe(true);
+    expect(computeControlDependence(view).edges.length).toBeGreaterThan(0);
+  });
+});
+
+describe('C CfgVisitor — def/use harvest', () => {
+  it('int x = a + b; use(x); produces a def of x and a use in the consumer', () => {
+    const cfg = c.cfgOf(`void f(int a, int b) { int x = a + b; use(x); }`);
+    const x = bindingIdx(cfg, 'x');
+    // x is defined somewhere…
+    const defined = cfg.blocks.some((bl) => bl.statements?.some((s) => s.defs.includes(x)));
+    expect(defined).toBe(true);
+    // …and used somewhere.
+    const used = cfg.blocks.some((bl) => bl.statements?.some((s) => s.uses.includes(x)));
+    expect(used).toBe(true);
+  });
+
+  it('if (a && (x = f())) records x as a MAY-def, not a must-kill', () => {
+    const cfg = c.cfgOf(`void f(int a) { int x = 0; if (a && (x = g())) h(x); }`);
+    const x = bindingIdx(cfg, 'x');
+    const hasMayDef = cfg.blocks.some((bl) =>
+      bl.statements?.some((s) => (s.mayDefs ?? []).includes(x)),
+    );
+    expect(hasMayDef).toBe(true);
+  });
+});
+
+describe('C++ CfgVisitor — structured bindings (#2195 P1)', () => {
+  const isDef = (cfg: FunctionCfg, idx: number): boolean =>
+    cfg.blocks.some((bl) => bl.statements?.some((s) => s.defs.includes(idx)));
+
+  it('auto [a, b] = mk(); defines BOTH a and b (not just the first / neither)', () => {
+    const cfg = cpp.cfgOf(`void f() { auto [a, b] = mk(); use(a); use(b); }`);
+    expect(isDef(cfg, bindingIdx(cfg, 'a'))).toBe(true);
+    expect(isDef(cfg, bindingIdx(cfg, 'b'))).toBe(true);
+    // a later use(a) must resolve to the SAME binding the declaration defs —
+    // i.e. `a` is a real local, not a synthetic module binding.
+    const a = bindingIdx(cfg, 'a');
+    const usedA = cfg.blocks.some((bl) => bl.statements?.some((s) => s.uses.includes(a)));
+    expect(usedA).toBe(true);
+  });
+
+  it('auto& [a, b] = ref(); (reference structured binding) defines both names', () => {
+    const cfg = cpp.cfgOf(`void f() { auto& [a, b] = ref(); sink(a, b); }`);
+    expect(isDef(cfg, bindingIdx(cfg, 'a'))).toBe(true);
+    expect(isDef(cfg, bindingIdx(cfg, 'b'))).toBe(true);
+  });
+});
+
+describe('C++ CfgVisitor — coroutines (#2195 P1)', () => {
+  it('co_return edges to EXIT (return), not a seq fallthrough to the next statement', () => {
+    const cfg = cpp.cfgOf(`Task f(int x) { if (x) co_return early(); main(); }`);
+    const co = block(cfg, 'co_return early();');
+    // co_return is a return terminator: it edges to EXIT…
+    expect(
+      cfg.edges.some((e) => e.from === co && e.to === cfg.exitIndex && e.kind === 'return'),
+    ).toBe(true);
+    // …and never falls through to the following statement.
+    expect(cfg.edges.some((e) => e.from === co && e.kind === 'seq')).toBe(false);
+  });
+});
+
+describe('C CfgVisitor — functionStartColumn', () => {
+  it('two same-line functions get distinct functionStartColumn', () => {
+    const cfgs = c.cfgsOf(`int a(){return 1;} int b(){return 2;}`);
+    expect(cfgs).toHaveLength(2);
+    expect(cfgs[0].functionStartLine).toBe(cfgs[1].functionStartLine); // same line
+    expect(cfgs[0].functionStartColumn).not.toBe(cfgs[1].functionStartColumn); // distinct column
+  });
+});
+
+describe('C++ CfgVisitor — exceptions', () => {
+  it('try/catch: a throw edge runs from each protected block to the handler', () => {
+    const cfg = cpp.cfgOf(`void f() {
+      try { risky(); deeper(); } catch (std::exception& e) { handle(e); }
+      after();
+    }`);
+    expect(edgeKinds(cfg).has('throw')).toBe(true);
+    const handler = block(cfg, 'handle(e);');
+    // every protected-region block reaches the handler.
+    expect(reaches(cfg, block(cfg, 'risky();'), handler)).toBe(true);
+    // and after() is still reachable (handler completion rejoins).
+    expect(reachable(cfg, block(cfg, 'after();'))).toBe(true);
+  });
+
+  it('multi-catch: a body throw reaches EVERY handler (clauses 2..N not orphaned)', () => {
+    const cfg = cpp.cfgOf(`void f() {
+      try { risky(); } catch (int e) { a(e); } catch (double d) { b(d); } catch (...) { c(); }
+      after();
+    }`);
+    const risky = block(cfg, 'risky();');
+    // The matching catch is dynamic, so the body throw must reach all three handlers.
+    expect(reaches(cfg, risky, block(cfg, 'a(e);'))).toBe(true);
+    expect(reaches(cfg, risky, block(cfg, 'b(d);'))).toBe(true);
+    expect(reaches(cfg, risky, block(cfg, 'c();'))).toBe(true);
+    // none of the later handlers is orphaned (all reachable from ENTRY); the
+    // post-try continuation still rejoins.
+    expect(reachable(cfg, block(cfg, 'b(d);'))).toBe(true);
+    expect(reachable(cfg, block(cfg, 'after();'))).toBe(true);
+  });
+
+  it('throw inside a branched try body reaches the handler from the interior block', () => {
+    const cfg = cpp.cfgOf(`void f(int x) {
+      try { guard(); if (x) { deep(); } } catch (int e) { onErr(); }
+    }`);
+    const handler = block(cfg, 'onErr();');
+    expect(reaches(cfg, block(cfg, 'deep();'), handler)).toBe(true);
+  });
+
+  it('throw with NO enclosing try routes to EXIT and ends its block', () => {
+    const cfg = cpp.cfgOf(`void f(int x) { if (x) { throw 1; } done(); }`);
+    const thr = block(cfg, 'throw 1;');
+    expect(cfg.edges).toContainEqual({ from: thr, to: cfg.exitIndex, kind: 'throw' });
+    // throw terminates its block — control does not fall into done() from it.
+    expect(reaches(cfg, thr, block(cfg, 'done();'))).toBe(false);
+    expect(reachable(cfg, block(cfg, 'done();'))).toBe(true); // via the if false branch
+  });
+});
+
+describe('C++ CfgVisitor — range-for', () => {
+  it('for_range_loop: header + body + loop-back + exit', () => {
+    const cfg = cpp.cfgOf(`void f(std::vector<int>& xs) { for (int x : xs) { use(x); } done(); }`);
+    const body = block(cfg, 'use(x);');
+    expect(edgeKinds(cfg).has('cond-true')).toBe(true);
+    expect(edgeKinds(cfg).has('loop-back')).toBe(true);
+    // the loop body loops back to the header and the loop has an exit to done().
+    const header = cfg.edges.find((e) => e.kind === 'loop-back' && e.from === body)?.to;
+    expect(header).toBeDefined();
+    expect(reachable(cfg, block(cfg, 'done();'))).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+  });
+
+  it('range-for declarator defines the loop variable; iterated expr is a use', () => {
+    const cfg = cpp.cfgOf(`void f(std::vector<int>& xs) { for (int x : xs) { use(x); } }`);
+    const x = bindingIdx(cfg, 'x');
+    const defined = cfg.blocks.some((bl) => bl.statements?.some((s) => s.defs.includes(x)));
+    expect(defined).toBe(true);
+  });
+});
+
+describe('C++ CfgVisitor — lambdas are CFG-bearing functions', () => {
+  it('a lambda body yields its own well-formed CFG', () => {
+    const cfgs = cpp.cfgsOf(`void f() { auto g = [](int x) { if (x) { a(); } return x; }; }`);
+    // f and the lambda are both CFG-bearing.
+    expect(cfgs.length).toBeGreaterThanOrEqual(2);
+    for (const cfg of cfgs) {
+      expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+    }
+  });
+});
+
+// U6 — call-site `sites[]` taint substrate. INERT BY DESIGN: no C-family taint
+// model is registered, so these sites produce zero TAINTED edges; they only
+// give the deferred per-language source/sink model something to match against.
+// The assertions verify the substrate is harvested in the TS `SiteRecord` shape.
+describe('C CfgVisitor — call-site sites[] substrate', () => {
+  it('a bare call records a `call` site with callee name + arg occurrence', () => {
+    const cfg = c.cfgOf(`void f(int cmd) { exec(cmd); }`);
+    const sites = allSites(cfg);
+    const exec = sites.find((s) => s.kind === 'call' && s.callee === 'exec');
+    expect(exec).toBeDefined();
+    // `cmd` (binding 0) occurs at argument position 0.
+    expect(exec?.args?.[0]).toContainEqual(bindingIdx(cfg, 'cmd'));
+  });
+
+  it('a method call (`db.query(x)`) records the receiver binding + dotted callee', () => {
+    const cfg = c.cfgOf(`void f(int x) { db.query(x); }`);
+    const site = allSites(cfg).find((s) => s.kind === 'call' && s.callee === 'db.query');
+    expect(site).toBeDefined();
+    expect(site?.receiver).toBe(bindingIdx(cfg, 'db'));
+    expect(site?.args?.[0]).toContainEqual(bindingIdx(cfg, 'x'));
+  });
+
+  it('a nested call (`exec(escape(x))`) via-tags the inner site (sanitizer substrate)', () => {
+    const cfg = c.cfgOf(`void f(int x) { exec(escape(x)); }`);
+    const sites = allSites(cfg);
+    const exec = sites.findIndex((s) => s.callee === 'exec');
+    const escape = sites.findIndex((s) => s.callee === 'escape');
+    expect(exec).toBeGreaterThanOrEqual(0);
+    expect(escape).toBeGreaterThanOrEqual(0);
+    const x = bindingIdx(cfg, 'x');
+    // escape's arg 0 carries a plain `x`; exec's arg 0 carries `[x, escapeSiteIdx]`.
+    expect(sites[escape].args?.[0]).toContainEqual(x);
+    expect(sites[exec].args?.[0]).toContainEqual([x, escape]);
+  });
+
+  it('a call assigned to a variable records resultDefs', () => {
+    const cfg = c.cfgOf(`void f(int a) { int y = load(a); }`);
+    const site = allSites(cfg).find((s) => s.callee === 'load');
+    expect(site?.resultDefs).toContain(bindingIdx(cfg, 'y'));
+  });
+
+  it('a CFG-only function (no calls) emits NO sites key (omit-when-empty)', () => {
+    const cfg = c.cfgOf(`void f(int a, int b) { int x = a + b; }`);
+    expect(hasAnySites(cfg)).toBe(false);
+    expect(allSites(cfg)).toHaveLength(0);
+  });
+});
+
+describe('C++ CfgVisitor — call-site sites[] substrate', () => {
+  it('a `new Foo(x)` records a `new` site with the constructor as callee', () => {
+    const cfg = cpp.cfgOf(`void f(int x) { auto p = new Foo(x); }`);
+    const site = allSites(cfg).find((s) => s.kind === 'new');
+    expect(site).toBeDefined();
+    expect(site?.callee).toBe('Foo');
+    expect(site?.args?.[0]).toContainEqual(bindingIdx(cfg, 'x'));
+    // `auto p = new Foo(x)` attaches resultDefs of `p` to the new site.
+    expect(site?.resultDefs).toContain(bindingIdx(cfg, 'p'));
+  });
+
+  it('a `ns::g(z)` namespace call folds `::` into a dotted callee path', () => {
+    const cfg = cpp.cfgOf(`void f(int z) { ns::g(z); }`);
+    const site = allSites(cfg).find((s) => s.kind === 'call' && s.callee === 'ns.g');
+    expect(site).toBeDefined();
+    expect(site?.args?.[0]).toContainEqual(bindingIdx(cfg, 'z'));
+  });
+});
diff --git a/gitnexus/test/unit/cfg/cfg-builder.test.ts b/gitnexus/test/unit/cfg/cfg-builder.test.ts
index f3738af14..1bef8cc41 100644
--- a/gitnexus/test/unit/cfg/cfg-builder.test.ts
+++ b/gitnexus/test/unit/cfg/cfg-builder.test.ts
@@ -1,5 +1,10 @@
 import { describe, it, expect } from 'vitest';
-import { CfgBuilder, reachableBlocks } from '../../../src/core/ingestion/cfg/cfg-builder.js';
+import {
+  CfgBuilder,
+  CfgNestingDepthError,
+  MAX_CFG_NESTING_DEPTH,
+  reachableBlocks,
+} from '../../../src/core/ingestion/cfg/cfg-builder.js';
 import { ControlFlowContext } from '../../../src/core/ingestion/cfg/control-flow-context.js';
 
 // The CFG core is AST-agnostic — these tests drive the builder + context the
@@ -118,3 +123,48 @@ describe('ControlFlowContext', () => {
     expect(ctx.breakTarget()).toBe(210); // unlabeled → nearest (inner)
   });
 });
+
+describe('CfgBuilder — nesting-depth guard (#2195)', () => {
+  it('throws a typed CfgNestingDepthError carrying the limit once the depth exceeds the cap', () => {
+    const b = new CfgBuilder('f.ts', 1, 1);
+    // Drive enterNesting up to the cap — exactly MAX is allowed, MAX+1 bails.
+    for (let i = 0; i < MAX_CFG_NESTING_DEPTH; i++) b.enterNesting();
+    // Capture unconditionally: a `catch`-only assertion would silently pass if a
+    // future change stopped throwing (the error never surfaces). `caught` stays
+    // undefined and the instanceof check fails loudly if no throw occurs.
+    let caught: unknown;
+    try {
+      b.enterNesting();
+    } catch (err) {
+      caught = err;
+    }
+    expect(caught).toBeInstanceOf(CfgNestingDepthError);
+    expect((caught as CfgNestingDepthError).limit).toBe(MAX_CFG_NESTING_DEPTH);
+  });
+
+  it('withNesting balances the counter on return AND on throw (sibling scopes do not accumulate)', () => {
+    const b = new CfgBuilder('f.ts', 1, 1);
+    // Run/throw a shallow scope many more times than the cap: withNesting's
+    // finally keeps the live depth at 0, so width (sibling blocks) never trips
+    // the guard — including the throwing path (the finally must still fire).
+    for (let i = 0; i < MAX_CFG_NESTING_DEPTH * 3; i++) {
+      expect(b.withNesting(() => 7)).toBe(7);
+      expect(() =>
+        b.withNesting(() => {
+          throw new Error('boom');
+        }),
+      ).toThrow('boom');
+    }
+    // Depth is back to 0, so one more scope is fine.
+    expect(() => b.withNesting(() => 0)).not.toThrow();
+  });
+
+  it('exitNesting unwinds the counter so sibling scopes do not accumulate', () => {
+    const b = new CfgBuilder('f.ts', 1, 1);
+    for (let i = 0; i < MAX_CFG_NESTING_DEPTH * 3; i++) {
+      b.enterNesting();
+      b.exitNesting();
+    }
+    expect(() => b.enterNesting()).not.toThrow();
+  });
+});
diff --git a/gitnexus/test/unit/cfg/control-dependence.test.ts b/gitnexus/test/unit/cfg/control-dependence.test.ts
index e307fb69b..e131a946e 100644
--- a/gitnexus/test/unit/cfg/control-dependence.test.ts
+++ b/gitnexus/test/unit/cfg/control-dependence.test.ts
@@ -6,8 +6,10 @@ import {
 } from '../../../src/core/ingestion/cfg/control-dependence.js';
 import {
   computePostDominators,
+  isExitReachableFromAllBlocks,
   postDominates,
 } from '../../../src/core/ingestion/cfg/post-dominators.js';
+import { augmentForPostDom } from '../../../src/core/ingestion/cfg/synthetic-escape.js';
 import type {
   BasicBlockData,
   CfgEdgeData,
@@ -76,8 +78,10 @@ function succsOf(cfg: FunctionCfg): number[][] {
  * post-dominates `b` iff every path from `b` to EXIT passes through `p`:
  * reflexive (`p === b`), else true exactly when EXIT is unreachable from `b`
  * once `p` is removed (AND `b` can reach EXIT at all). Defined only for the
- * exit-reachable fixtures used below — the exit-unreachable case is the known
- * unsound region (#2188 F2) and is deliberately excluded from the AC2 set.
+ * exit-reachable fixtures used below. A raw exit-unreachable cycle (#2188 F2)
+ * would be unsound, so the AC2 set now feeds the synthetic-escape pass's
+ * AUGMENTED view of every goto-cycle fixture (#2197 U1) — once bridged it IS
+ * exit-reachable and the Ferrante walk must equal this independent reference.
  */
 function independentPostDom(cfg: FunctionCfg, succs: number[][], p: number, b: number): boolean {
   if (p === b) return true;
@@ -255,10 +259,42 @@ describe('computeControlDependence — Ferrante §3.1.1', () => {
         [2, 1, 'loop-back'],
         [1, 3, 'cond-false'],
       ]),
-      // NOTE: the exit-unreachable case is deliberately NOT an AC2 fixture — its
-      // dependence set is unsound (#2188 F2), so asserting walk == independent
-      // reference would (correctly) fail. It has its own characterization test
-      // above that documents the degenerate behavior.
+      // Escaped `goto`-cycle (#2197 U1): after the synthetic-escape pass the
+      // exit-unreachable cycle is bridged and the dependence set becomes a SOUND
+      // over-approximation, so it now joins the AC2 set (the obsolete
+      // exit-unreachable exclusion is lifted — see the AUGMENTED-view note below).
+      // Repro shape: ENTRY=0, EXIT=1, b2=`(a>0)` predicate, b3=`work()`,
+      // b4=`goto start`; the `if` predicate (b2) is the only control point.
+      gotoCycle: augmentForPostDom(
+        mkCfg(
+          5,
+          [
+            [0, 2, 'seq'],
+            [2, 3, 'cond-true'],
+            [2, 4, 'seq'],
+            [3, 4, 'seq'],
+            [4, 2, 'seq'],
+          ],
+          { entry: 0, exit: 1 },
+        ),
+      ),
+      // Spine before the goto label — ENTRY + straight-line stmts are in the
+      // exit-unreachable closure but must reach EXIT after the bridge.
+      gotoCycleSpine: augmentForPostDom(
+        mkCfg(
+          7,
+          [
+            [0, 2, 'seq'],
+            [2, 3, 'seq'],
+            [3, 4, 'seq'],
+            [4, 5, 'cond-true'],
+            [4, 6, 'seq'],
+            [5, 6, 'seq'],
+            [6, 4, 'seq'],
+          ],
+          { entry: 0, exit: 1 },
+        ),
+      ),
       // nested if: outer branch (0) → inner branch (1) or outer-else (5);
       // inner branch → 2/3 → inner join (4); 4 and 5 → outer join (6, exit).
       nestedIf: mkCfg(
@@ -286,6 +322,15 @@ describe('computeControlDependence — Ferrante §3.1.1', () => {
       ]),
     };
 
+    it.each(Object.keys(fixtures))(
+      '%s: is exit-reachable from all blocks (the AC2 reference is well-defined)',
+      (name) => {
+        // Every AC2 fixture — including the AUGMENTED goto-cycle ones (#2197 U1)
+        // — must be exit-reachable, else the node-removal reference is undefined.
+        expect(isExitReachableFromAllBlocks(fixtures[name])).toBe(true);
+      },
+    );
+
     it.each(Object.keys(fixtures))(
       '%s: tree-walk pair set equals the brute-force reference',
       (name) => {
@@ -357,6 +402,84 @@ describe('computeControlDependence — maxEdges materialization ceiling (#2188)'
   });
 });
 
+describe('computeControlDependence — reverse-DF formulation regressions (#2195)', () => {
+  // The Ferrante up-walk was replaced by the reverse-CFG post-dominance frontier
+  // (Cytron/CFRWZ 1991; LLVM ReverseIDFCalculator / Joern CdgPass). These pin the
+  // three invariants the rewrite must preserve: multi-label-per-pair, the
+  // self-edge / NO_IPDOM seed guard, and linear (not quadratic) scaling.
+
+  it('keeps BOTH senses when one controller reaches a dependent via opposite arms', () => {
+    // Minimised goto-cycle shape: A (block 1) reaches X (block 2) by BOTH its true
+    // arm and its false arm, with a third escape (1→3) so X does NOT post-dominate
+    // A (else it would be a plain diamond join controlling nothing). The PDF must
+    // union the label SET — the old (a, cur, label) dedup kept both rows — not
+    // collapse the pair to a single sense.
+    const cfg = mkCfg(
+      4,
+      [
+        [0, 1, 'seq'],
+        [1, 2, 'cond-true'],
+        [1, 2, 'cond-false'],
+        [1, 3, 'seq'], // escape so X(2) is not a post-dominator of A(1)
+        [2, 3, 'seq'],
+      ],
+      { entry: 0, exit: 3 },
+    );
+    const { edges } = computeControlDependence(cfg);
+    expect(serAll(edges).sort()).toEqual(['1->2:F', '1->2:T']);
+  });
+
+  it('a literal self-edge never invents a self control-dependence (PDF_local a!==x guard)', () => {
+    // Standard while loop (header 1, body 2) PLUS a spurious LITERAL self-edge
+    // 1→1. The header legitimately depends on itself via the body back-edge
+    // (1->1:T is inherited through PDF_up), but the literal self in-edge must
+    // contribute NOTHING: without the `a !== x` PDF_local guard it would seed a
+    // bogus 1->1:F (the loop-back complement of the header's true arm).
+    const cfg = mkCfg(4, [
+      [0, 1, 'seq'],
+      [1, 2, 'cond-true'],
+      [2, 1, 'loop-back'],
+      [1, 1, 'loop-back'], // spurious literal self-edge — must be ignored
+      [1, 3, 'cond-false'],
+    ]);
+    const { edges } = computeControlDependence(cfg);
+    expect(serAll(edges).sort()).toEqual(['1->1:T', '1->2:T']);
+    expect(edges.some((e) => ser(e) === '1->1:F')).toBe(false);
+  });
+
+  it('scales linearly on a fan-into-chain (perf tripwire: was a Θ(N²) up-walk)', () => {
+    // fanChain(N): block 0 fans one edge to every node of a length-(N-2) spine
+    // whose ipdom chain tops out at EXIT. The old Ferrante up-walk re-climbed the
+    // shared spine once per fan edge → Θ(N²) (~7.1s at N=16k); the reverse-DF form
+    // is O(N+E+output) (~13ms). Coarse wall-clock tripwire, not a microbenchmark:
+    // a revert to quadratic blows past the ceiling by >5×. post-dom is built
+    // outside the timed region so this isolates the rewritten function.
+    const N = 16000;
+    const M = N - 2; // chain blocks 1..M; block 0 = fan source; block N-1 = EXIT
+    const exit = N - 1;
+    const edges: [number, number, CfgEdgeKind][] = [];
+    for (let i = 1; i <= M; i++) {
+      edges.push([0, i, 'switch-case']); // fan: 0 → every chain node
+      edges.push([i, i === M ? exit : i + 1, 'seq']); // spine: i → i+1 (→ EXIT)
+    }
+    const cfg = mkCfg(N, edges, { entry: 0, exit });
+    const postDom = computePostDominators(cfg); // built OUTSIDE the timed region
+    const t0 = performance.now();
+    const { edges: cdg } = computeControlDependence(cfg, postDom);
+    const ms = performance.now() - t0;
+    // Block 0 controls every chain node EXCEPT the last (M): the sole edge into
+    // EXIT is M→exit, so M post-dominates the whole fan (ipdom[0]===M) and is
+    // controlled by nothing. The other M-1 spine nodes are each 0-controlled.
+    // Assert IDENTITY too (not just count) so a fast-but-wrong reimplementation
+    // emitting M-1 mis-attributed edges can't pass on length alone.
+    expect(cdg).toHaveLength(M - 1);
+    expect(cdg.every((e) => e.controllerBlock === 0)).toBe(true);
+    expect(cdg.every((e) => e.dependentBlock >= 1 && e.dependentBlock < M)).toBe(true);
+    expect(new Set(cdg.map((e) => e.dependentBlock)).size).toBe(M - 1); // all distinct
+    expect(ms).toBeLessThan(1000);
+  });
+});
+
 describe('#2188 F1 — branch-label correctness on the REAL TS visitor (regression)', () => {
   // The label is the AC3 "under what condition does X run?" answer. The bug:
   // branchSense inferred it from the edge KIND alone, but the M1 visitor wires a
diff --git a/gitnexus/test/unit/cfg/csharp-visitor.test.ts b/gitnexus/test/unit/cfg/csharp-visitor.test.ts
new file mode 100644
index 000000000..01b7b058c
--- /dev/null
+++ b/gitnexus/test/unit/cfg/csharp-visitor.test.ts
@@ -0,0 +1,465 @@
+import { describe, it, expect, vi } from 'vitest';
+import { createRequire } from 'node:module';
+import { createCsharpCfgVisitor } from '../../../src/core/ingestion/cfg/visitors/csharp.js';
+import type { FunctionCfg } from '../../../src/core/ingestion/cfg/types.js';
+import {
+  makeCfgHarness,
+  type CfgHarness,
+  block,
+  edgeKinds,
+  reaches,
+  reachable,
+  bindingIdx,
+  allSites,
+  hasAnySites,
+} from '../../helpers/cfg-harness.js';
+import { isExitReachableFromAllBlocks } from '../../../src/core/ingestion/cfg/post-dominators.js';
+import { augmentForPostDom } from '../../../src/core/ingestion/cfg/synthetic-escape.js';
+import { computeControlDependence } from '../../../src/core/ingestion/cfg/control-dependence.js';
+
+// U3 — the C# CfgVisitor, one hazard per test (KTD5: real-parser regression,
+// NOT snapshot-pinning). Each fixture's distinctive statement text (step(),
+// done(), handle(e), …) lets us locate the block for a region by text and assert
+// the control-flow topology around it.
+
+// tree-sitter-c-sharp declares `main: "bindings/node"` (no extension) — load the
+// explicit subpath, mirroring parser-loader.ts (#1013).
+const csGrammar = createRequire(import.meta.url)(
+  'tree-sitter-c-sharp/bindings/node/index.js',
+) as Parameters<typeof makeCfgHarness>[0];
+
+const cs: CfgHarness = makeCfgHarness(csGrammar, createCsharpCfgVisitor(), 'fixture.cs');
+
+const hasDef = (cfg: FunctionCfg, idx: number): boolean =>
+  cfg.blocks.some((bl) => bl.statements?.some((s) => s.defs.includes(idx)));
+const hasUse = (cfg: FunctionCfg, idx: number): boolean =>
+  cfg.blocks.some((bl) => bl.statements?.some((s) => s.uses.includes(idx)));
+const hasMayDef = (cfg: FunctionCfg, idx: number): boolean =>
+  cfg.blocks.some((bl) => bl.statements?.some((s) => (s.mayDefs ?? []).includes(idx)));
+
+const wrap = (body: string): string => `class C { void M(${''}) { ${body} } }`;
+
+describe('C# CfgVisitor — structure', () => {
+  it('straight-line body: ENTRY → block → EXIT (seq)', () => {
+    const cfg = cs.cfgOf(`class C { void M() { a(); b(); c(); } }`);
+    expect(cfg.blocks.filter((b) => b.kind === 'normal')).toHaveLength(1);
+    const body = block(cfg, 'a();');
+    expect(cfg.edges).toContainEqual({ from: cfg.entryIndex, to: body, kind: 'seq' });
+    expect(reaches(cfg, body, cfg.exitIndex)).toBe(true);
+  });
+
+  it('empty body: ENTRY → EXIT', () => {
+    const cfg = cs.cfgOf(`class C { void M() {} }`);
+    expect(cfg.blocks).toHaveLength(2);
+    expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+  });
+
+  it('expression-bodied method: single block returns its value', () => {
+    const cfg = cs.cfgOf(`class C { int M(int n) => n * 2; }`);
+    const body = block(cfg, 'n * 2');
+    expect(cfg.edges).toContainEqual({ from: body, to: cfg.exitIndex, kind: 'return' });
+  });
+
+  it('constructor and local function are CFG-bearing functions', () => {
+    const cfgs = cs.cfgsOf(
+      `class C { C(int a) { x = a; } void Outer() { int L(int z) { return z; } L(1); } }`,
+    );
+    // constructor C, Outer, and the local function L = 3 CFGs.
+    expect(cfgs.length).toBeGreaterThanOrEqual(3);
+    for (const cfg of cfgs) expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+  });
+
+  it('unmodeled member shape (no body) → graceful partial, no throw', () => {
+    // An abstract method has no body block → buildFunctionCfg returns undefined,
+    // never throws; a property (not a function) is not collected at all.
+    const root = cs.parse(`abstract class C { public abstract void M(); int P => 1; }`);
+    const fns = cs.collectFunctions(root);
+    for (const fn of fns) {
+      expect(() => createCsharpCfgVisitor().buildFunctionCfg(fn, 'f.cs')).not.toThrow();
+    }
+  });
+});
+
+describe('C# CfgVisitor — branching', () => {
+  it('if/else: cond-true to then, cond-false to else, both reach the join', () => {
+    const cfg = cs.cfgOf(wrap(`if (x > 0) { a(); } else { b(); } c();`).replace('M()', 'M(int x)'));
+    const kinds = edgeKinds(cfg);
+    expect(kinds.has('cond-true')).toBe(true);
+    expect(kinds.has('cond-false')).toBe(true);
+    const join = block(cfg, 'c();');
+    expect(reaches(cfg, block(cfg, 'a();'), join)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'b();'), join)).toBe(true);
+  });
+
+  it('else if chains through the nested alternative (no else_clause wrapper)', () => {
+    const cfg = cs.cfgOf(
+      `class C { void M(int x) { if (x > 0) { a(); } else if (x < 0) { b(); } else { c(); } } }`,
+    );
+    // all three arms reach EXIT; the else-if condition is its own block.
+    expect(reaches(cfg, block(cfg, 'a();'), cfg.exitIndex)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'b();'), cfg.exitIndex)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'c();'), cfg.exitIndex)).toBe(true);
+  });
+});
+
+describe('C# CfgVisitor — loops', () => {
+  it('while loop: header + back-edge + exit', () => {
+    const cfg = cs.cfgOf(`class C { void M(int x) { while (x > 0) { step(); } done(); } }`);
+    const header = block(cfg, 'x > 0');
+    const body = block(cfg, 'step();');
+    expect(cfg.edges).toContainEqual({ from: body, to: header, kind: 'loop-back' });
+    expect(edgeKinds(cfg).has('cond-true')).toBe(true);
+    expect(reaches(cfg, header, block(cfg, 'done();'))).toBe(true);
+  });
+
+  it('do-while runs the body BEFORE testing, then loops back from the bottom', () => {
+    const cfg = cs.cfgOf(`class C { void M(int x) { do { step(); } while (x > 0); done(); } }`);
+    const body = block(cfg, 'step();');
+    const cond = block(cfg, 'x > 0');
+    expect(reaches(cfg, cfg.entryIndex, body)).toBe(true); // body runs first
+    expect(reaches(cfg, body, cond)).toBe(true);
+    expect(cfg.edges).toContainEqual({ from: cond, to: body, kind: 'loop-back' });
+    expect(reaches(cfg, cond, block(cfg, 'done();'))).toBe(true);
+  });
+
+  it('C-style for: init once, condition header, back-edge through update', () => {
+    const cfg = cs.cfgOf(
+      `class C { void M(int n) { for (int i = 0; i < n; i++) { step(); } done(); } }`,
+    );
+    const init = block(cfg, 'int i = 0');
+    const header = block(cfg, 'i < n');
+    const incr = block(cfg, 'i++');
+    const body = block(cfg, 'step();');
+    expect(cfg.edges).toContainEqual({ from: cfg.entryIndex, to: init, kind: 'seq' });
+    expect(reaches(cfg, body, incr)).toBe(true);
+    expect(cfg.edges).toContainEqual({ from: incr, to: header, kind: 'loop-back' });
+    expect(reaches(cfg, header, block(cfg, 'done();'))).toBe(true);
+  });
+
+  it('foreach: header + body + loop-back + exit; loop var is a def, source a use', () => {
+    const cfg = cs.cfgOf(
+      `class C { void M(int[] xs) { foreach (var x in xs) { use(x); } done(); } }`,
+    );
+    const body = block(cfg, 'use(x);');
+    expect(edgeKinds(cfg).has('cond-true')).toBe(true);
+    expect(edgeKinds(cfg).has('loop-back')).toBe(true);
+    const header = cfg.edges.find((e) => e.kind === 'loop-back' && e.from === body)?.to;
+    expect(header).toBeDefined();
+    expect(reaches(cfg, header!, block(cfg, 'done();'))).toBe(true);
+    const x = bindingIdx(cfg, 'x');
+    expect(hasDef(cfg, x)).toBe(true);
+  });
+
+  it('while (true) {} keeps EXIT reverse-reachable AND emits CDG > 0', () => {
+    // The inner `if` is a real control point; assert through the production
+    // post-dom/CDG passes (matching go/python/ruby/rust/vue) — CDG is only
+    // computed when EXIT stays reverse-reachable, so a non-empty CDG proves the
+    // structural exit-escape edge keeps the function CDG-bearing.
+    const cfg = cs.cfgOf(`class C { void M(bool x) { while (true) { if (x) { g(); } } } }`);
+    expect(edgeKinds(cfg).has('cond-false')).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+    expect(computeControlDependence(cfg).edges.length).toBeGreaterThan(0);
+  });
+
+  it('for (;;) {} keeps EXIT reverse-reachable AND emits CDG > 0', () => {
+    const cfg = cs.cfgOf(`class C { void M(bool x) { for (;;) { if (x) { g(); } } } }`);
+    expect(edgeKinds(cfg).has('cond-false')).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+    expect(computeControlDependence(cfg).edges.length).toBeGreaterThan(0);
+  });
+});
+
+describe('C# CfgVisitor — switch', () => {
+  it('switch_statement: cases dispatch, break-terminated case rejoins after', () => {
+    const cfg = cs.cfgOf(`class C { void M(int x) {
+      switch (x) {
+        case 1: one(); break;
+        case 2: two(); break;
+        default: other(); break;
+      }
+      after();
+    } }`);
+    expect(edgeKinds(cfg).has('switch-case')).toBe(true);
+    expect(reaches(cfg, block(cfg, 'one();'), block(cfg, 'after();'))).toBe(true);
+    expect(reaches(cfg, block(cfg, 'two();'), block(cfg, 'after();'))).toBe(true);
+    // break-terminated case 1 does not fall into case 2.
+    expect(reaches(cfg, block(cfg, 'one();'), block(cfg, 'two();'))).toBe(false);
+  });
+
+  it('empty case section falls through to the next section', () => {
+    const cfg = cs.cfgOf(`class C { void M(int x) {
+      switch (x) { case 1: case 2: shared(); break; default: d(); break; }
+      after();
+    } }`);
+    // case 1 (empty) reaches the shared body.
+    expect(reaches(cfg, block(cfg, 'shared();'), block(cfg, 'after();'))).toBe(true);
+    expect(edgeKinds(cfg).has('switch-case')).toBe(true);
+  });
+
+  it('switch_expression arms each dispatch as a guarded branch (switch-case)', () => {
+    const cfg = cs.cfgOf(
+      `class C { int M(int x) { return x switch { 1 => a(), 2 => b(), _ => c() }; } }`,
+    );
+    // The switch-expression lives inside the return block — it does not break a
+    // basic block, but the function still has a well-formed single-exit CFG.
+    expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+    expect(edgeKinds(cfg).has('return')).toBe(true);
+  });
+});
+
+describe('C# CfgVisitor — using / lock (deterministic finalizer)', () => {
+  it('using runs the body then dispose on the NORMAL exit path', () => {
+    const cfg = cs.cfgOf(`class C { void M() { using (var f = Open()) { read(f); } after(); } }`);
+    const body = block(cfg, 'read(f);');
+    const dispose = block(cfg, 'dispose');
+    // body → dispose → after()  (normal completion threads through the dispose).
+    expect(reaches(cfg, body, dispose)).toBe(true);
+    expect(reaches(cfg, dispose, block(cfg, 'after();'))).toBe(true);
+  });
+
+  it('using disposes on the EXCEPTION path too (throw routes through dispose)', () => {
+    const cfg = cs.cfgOf(`class C { void M() { using (var f = Open()) { risky(f); } } }`);
+    const body = block(cfg, 'risky(f);');
+    const dispose = block(cfg, 'dispose');
+    // a throw in the protected body reaches the dispose finalizer.
+    expect(edgeKinds(cfg).has('throw')).toBe(true);
+    expect(reaches(cfg, body, dispose)).toBe(true);
+  });
+
+  it('a return inside using crosses the dispose (finally-return completion edge)', () => {
+    const cfg = cs.cfgOf(`class C { int M() { using (var f = Open()) { return read(f); } } }`);
+    expect(edgeKinds(cfg).has('finally-return')).toBe(true);
+  });
+
+  it('using var (C# 8 declaration form) disposes at enclosing-scope exit (#2206)', () => {
+    const cfg = cs.cfgOf(`class C { void M() { using var f = Open(); read(f); } }`);
+    const dispose = block(cfg, 'dispose');
+    // the rest of the scope (read(f)) is protected; dispose runs at the end and on
+    // the exception path.
+    expect(reaches(cfg, block(cfg, 'read(f);'), dispose)).toBe(true);
+    expect(edgeKinds(cfg).has('throw')).toBe(true);
+  });
+
+  it('a return after a using var declaration crosses the dispose (finally-return, #2206)', () => {
+    const cfg = cs.cfgOf(`class C { int M() { using var f = Open(); return read(f); } }`);
+    expect(block(cfg, 'dispose')).toBeGreaterThanOrEqual(0);
+    expect(edgeKinds(cfg).has('finally-return')).toBe(true);
+  });
+
+  it('lock body runs then releases the monitor (finalizer semantics)', () => {
+    const cfg = cs.cfgOf(`class C { void M(object sync) { lock (sync) { touch(); } after(); } }`);
+    const body = block(cfg, 'touch();');
+    const release = block(cfg, 'release');
+    expect(reaches(cfg, body, release)).toBe(true);
+    expect(reaches(cfg, release, block(cfg, 'after();'))).toBe(true);
+  });
+});
+
+describe('C# CfgVisitor — try/catch/finally completion edges', () => {
+  it('try/catch: a throw edge runs from each protected block to the handler', () => {
+    const cfg = cs.cfgOf(`class C { void M() {
+      try { risky(); deeper(); } catch (System.Exception e) { handle(e); }
+      after();
+    } }`);
+    expect(edgeKinds(cfg).has('throw')).toBe(true);
+    const handler = block(cfg, 'handle(e);');
+    expect(reaches(cfg, block(cfg, 'risky();'), handler)).toBe(true);
+    expect(reachable(cfg, block(cfg, 'after();'))).toBe(true);
+  });
+
+  it('finally runs on normal completion of the try', () => {
+    const cfg = cs.cfgOf(`class C { void M() {
+      try { work(); } finally { cleanup(); }
+      after();
+    } }`);
+    const body = block(cfg, 'work();');
+    const fin = block(cfg, 'cleanup();');
+    expect(reaches(cfg, body, fin)).toBe(true);
+    expect(reaches(cfg, fin, block(cfg, 'after();'))).toBe(true);
+  });
+
+  it('return crossing a finally emits a finally-return completion edge', () => {
+    const cfg = cs.cfgOf(`class C { int M() {
+      try { return compute(); } finally { cleanup(); }
+    } }`);
+    expect(edgeKinds(cfg).has('finally-return')).toBe(true);
+  });
+
+  it('break crossing a finally emits a finally-break completion edge', () => {
+    const cfg = cs.cfgOf(`class C { void M(int n) {
+      for (int i = 0; i < n; i++) {
+        try { if (done()) break; } finally { tick(); }
+      }
+      after();
+    } }`);
+    expect(edgeKinds(cfg).has('finally-break')).toBe(true);
+  });
+});
+
+describe('C# CfgVisitor — goto / labels', () => {
+  it('backward goto wires to an already-seen label block', () => {
+    const cfg = cs.cfgOf(
+      `class C { void M() { int i = 0; top: work(); i++; if (i < 10) goto top; done(); } }`,
+    );
+    const gotoB = block(cfg, 'goto top;');
+    const label = block(cfg, 'work();');
+    expect(reaches(cfg, gotoB, label)).toBe(true);
+    expect(cfg.edges.some((e) => e.from === gotoB && e.to === label)).toBe(true);
+  });
+
+  it('forward goto wires to a label that appears later', () => {
+    const cfg = cs.cfgOf(`class C { void M(int x) { if (x > 0) goto end; work(); end: done(); } }`);
+    const gotoB = block(cfg, 'goto end;');
+    const label = block(cfg, 'done();');
+    expect(reaches(cfg, gotoB, label)).toBe(true);
+    expect(reachable(cfg, block(cfg, 'work();'))).toBe(true);
+  });
+
+  // #2197 U1 — an UNCONDITIONAL goto-cycle traps EXIT (the `goto start` has no
+  // exit path); the synthetic-escape pass bridges it so CDG is emitted instead
+  // of withheld. The conditional goto tests above already had an exit path.
+  it('unconditional goto-cycle: bridged → EXIT reachable AND CDG emitted', () => {
+    const cfg = cs.cfgOf(`class K { void handler(int a){ start: if(a>0){work();} goto start; } }`);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(false); // trapped without the pass
+    const view = augmentForPostDom(cfg);
+    expect(isExitReachableFromAllBlocks(view)).toBe(true);
+    expect(computeControlDependence(view).edges.length).toBeGreaterThan(0);
+  });
+});
+
+describe('C# CfgVisitor — yield', () => {
+  it('yield break terminates the iterator (routes to EXIT)', () => {
+    const cfg = cs.cfgOf(`class C { System.Collections.Generic.IEnumerable<int> G(int x) {
+      if (x < 0) { yield break; }
+      yield return x;
+    } }`);
+    const yb = block(cfg, 'yield break;');
+    expect(reaches(cfg, yb, cfg.exitIndex)).toBe(true);
+    // yield break terminates its block — does not fall into yield return.
+    expect(reaches(cfg, yb, block(cfg, 'yield return x;'))).toBe(false);
+  });
+
+  it('yield return continues to the next statement', () => {
+    const cfg = cs.cfgOf(`class C { System.Collections.Generic.IEnumerable<int> G() {
+      yield return 1;
+      done();
+    } }`);
+    const yr = block(cfg, 'yield return 1;');
+    expect(reaches(cfg, yr, block(cfg, 'done();'))).toBe(true);
+  });
+});
+
+describe('C# CfgVisitor — def/use harvest', () => {
+  it('local declaration: int x = a + b; use(x); → def of x + use of x', () => {
+    const cfg = cs.cfgOf(`class C { void M(int a, int b) { int x = a + b; use(x); } }`);
+    const x = bindingIdx(cfg, 'x');
+    expect(hasDef(cfg, x)).toBe(true);
+    expect(hasUse(cfg, x)).toBe(true);
+  });
+
+  it('c ?? (c = load()) records c as a MAY-def, not a must-kill', () => {
+    const cfg = cs.cfgOf(`class C { void M(string c) { var v = c ?? (c = load()); use(v); } }`);
+    const c = bindingIdx(cfg, 'c');
+    expect(hasMayDef(cfg, c)).toBe(true);
+  });
+
+  it('a && (x = f()) records x as a may-def inside the short-circuit', () => {
+    const cfg = cs.cfgOf(`class C { void M(bool a) { int x = 0; if (a && (x = g()) > 0) h(x); } }`);
+    const x = bindingIdx(cfg, 'x');
+    expect(hasMayDef(cfg, x)).toBe(true);
+  });
+
+  it('compound assignment reads AND writes the lvalue', () => {
+    const cfg = cs.cfgOf(`class C { void M() { int z = 1; z += 3; } }`);
+    const z = bindingIdx(cfg, 'z');
+    expect(hasDef(cfg, z)).toBe(true);
+    expect(hasUse(cfg, z)).toBe(true);
+  });
+
+  it('out var n records n as a callee-written def (#2195 P1)', () => {
+    const cfg = cs.cfgOf(`class C { void M(string s) { int.TryParse(s, out var n); use(n); } }`);
+    const n = bindingIdx(cfg, 'n');
+    expect(hasDef(cfg, n)).toBe(true);
+    expect(hasUse(cfg, n)).toBe(true);
+  });
+
+  it('var (a, b) = T() deconstruction declaration defines BOTH a and b (#2195 P1)', () => {
+    const cfg = cs.cfgOf(`class C { void M() { var (a, b) = T(); use(a); use(b); } }`);
+    expect(hasDef(cfg, bindingIdx(cfg, 'a'))).toBe(true);
+    expect(hasDef(cfg, bindingIdx(cfg, 'b'))).toBe(true);
+  });
+});
+
+describe('C# CfgVisitor — functionStartColumn', () => {
+  it('two same-line methods get distinct functionStartColumn', () => {
+    const cfgs = cs.cfgsOf(`class C { int A() { return 1; } int B() { return 2; } }`);
+    expect(cfgs).toHaveLength(2);
+    expect(cfgs[0].functionStartLine).toBe(cfgs[1].functionStartLine); // same line
+    expect(cfgs[0].functionStartColumn).not.toBe(cfgs[1].functionStartColumn); // distinct column
+  });
+});
+
+describe('C# CfgVisitor — does not throw on exotic shapes', () => {
+  it('lambda / anonymous method bodies build their own CFGs', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    try {
+      const cfgs = cs.cfgsOf(`class C { void M() {
+        System.Func<int, int> f = x => { if (x > 0) { return x; } return 0; };
+        System.Action h = delegate () { act(); };
+        f(1); h();
+      } }`);
+      expect(cfgs.length).toBeGreaterThanOrEqual(3); // M, lambda, anon method
+      for (const cfg of cfgs) expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+    } finally {
+      warn.mockRestore();
+    }
+  });
+});
+
+// U6 — call-site `sites[]` taint substrate. INERT BY DESIGN: no C# taint model
+// is registered, so these sites produce zero TAINTED edges; they only give the
+// deferred per-language source/sink model something to match against.
+describe('C# CfgVisitor — call-site sites[] substrate', () => {
+  const cfgOf = (body: string): FunctionCfg =>
+    cs.cfgOf(`class C { void f(int cmd, int x, int a) { ${body} } }`);
+
+  it('a bare invocation records a `call` site with callee name + arg occurrence', () => {
+    const cfg = cfgOf(`Exec(cmd);`);
+    const site = allSites(cfg).find((s) => s.kind === 'call' && s.callee === 'Exec');
+    expect(site).toBeDefined();
+    expect(site?.args?.[0]).toContainEqual(bindingIdx(cfg, 'cmd'));
+  });
+
+  it('a member invocation (`db.Query(x)`) records the receiver + dotted callee', () => {
+    const cfg = cfgOf(`db.Query(x);`);
+    const site = allSites(cfg).find((s) => s.kind === 'call' && s.callee === 'db.Query');
+    expect(site).toBeDefined();
+    expect(site?.receiver).toBe(bindingIdx(cfg, 'db'));
+    expect(site?.args?.[0]).toContainEqual(bindingIdx(cfg, 'x'));
+  });
+
+  it('`new Foo(x)` records a `new` site with the type as callee', () => {
+    const cfg = cfgOf(`var p = new Foo(x);`);
+    const site = allSites(cfg).find((s) => s.kind === 'new');
+    expect(site?.callee).toBe('Foo');
+    expect(site?.args?.[0]).toContainEqual(bindingIdx(cfg, 'x'));
+    expect(site?.resultDefs).toContain(bindingIdx(cfg, 'p'));
+  });
+
+  it('a nested invocation via-tags the inner site (sanitizer substrate)', () => {
+    const cfg = cfgOf(`Exec(Escape(x));`);
+    const sites = allSites(cfg);
+    const exec = sites.findIndex((s) => s.callee === 'Exec');
+    const escape = sites.findIndex((s) => s.callee === 'Escape');
+    expect(exec).toBeGreaterThanOrEqual(0);
+    expect(escape).toBeGreaterThanOrEqual(0);
+    const x = bindingIdx(cfg, 'x');
+    expect(sites[escape].args?.[0]).toContainEqual(x);
+    expect(sites[exec].args?.[0]).toContainEqual([x, escape]);
+  });
+
+  it('a CFG-only function (no calls) emits NO sites key (omit-when-empty)', () => {
+    const cfg = cs.cfgOf(`class C { void f(int a, int b) { int x = a + b; } }`);
+    expect(hasAnySites(cfg)).toBe(false);
+  });
+});
diff --git a/gitnexus/test/unit/cfg/dart-visitor.test.ts b/gitnexus/test/unit/cfg/dart-visitor.test.ts
new file mode 100644
index 000000000..8fa1c225b
--- /dev/null
+++ b/gitnexus/test/unit/cfg/dart-visitor.test.ts
@@ -0,0 +1,440 @@
+import { describe, it, expect } from 'vitest';
+import { requireVendoredGrammar } from '../../../src/core/tree-sitter/vendored-grammars.js';
+import { createDartCfgVisitor } from '../../../src/core/ingestion/cfg/visitors/dart.js';
+import type { FunctionCfg } from '../../../src/core/ingestion/cfg/types.js';
+import {
+  makeCfgHarness,
+  type CfgHarness,
+  block,
+  edgeKinds,
+  reaches,
+  reachable,
+  bindingIdx,
+} from '../../helpers/cfg-harness.js';
+import { isExitReachableFromAllBlocks } from '../../../src/core/ingestion/cfg/post-dominators.js';
+import { computeControlDependence } from '../../../src/core/ingestion/cfg/control-dependence.js';
+
+// The Dart CfgVisitor, one hazard per test (real-parser regression, NOT
+// snapshot-pinning). Dart's grammar is VENDORED (not an npm package): the grammar
+// loads from vendor/ via `requireVendoredGrammar('tree-sitter-dart')`, exactly
+// like the Kotlin/Swift tests load their vendored grammars. Dart also splits a
+// function into a SIGNATURE + a SIBLING `function_body`, so `isFunction` selects
+// the body node — the harness collects those transparently. Each fixture's
+// distinctive statement text (step(), done(), handle(e), …) lets us locate the
+// block for a region by text and assert the control-flow topology around it.
+
+const dartGrammar = requireVendoredGrammar('tree-sitter-dart') as Parameters<
+  typeof makeCfgHarness
+>[0];
+
+const dart: CfgHarness = makeCfgHarness(dartGrammar, createDartCfgVisitor(), 'fixture.dart');
+
+const definesBinding = (cfg: FunctionCfg, idx: number): boolean =>
+  cfg.blocks.some((bl) => bl.statements?.some((s) => s.defs.includes(idx)));
+const usesBinding = (cfg: FunctionCfg, idx: number): boolean =>
+  cfg.blocks.some((bl) => bl.statements?.some((s) => s.uses.includes(idx)));
+
+describe('Dart CfgVisitor — structure', () => {
+  it('straight-line body: ENTRY → block → EXIT (seq)', () => {
+    const cfg = dart.cfgOf(`void f() { a(); b(); c(); }`);
+    expect(cfg.blocks.filter((b) => b.kind === 'normal')).toHaveLength(1);
+    const body = block(cfg, 'a();');
+    expect(cfg.edges).toContainEqual({ from: cfg.entryIndex, to: body, kind: 'seq' });
+    expect(reaches(cfg, body, cfg.exitIndex)).toBe(true);
+  });
+
+  it('empty body: ENTRY → EXIT', () => {
+    const cfg = dart.cfgOf(`void f() {}`);
+    expect(cfg.blocks).toHaveLength(2);
+    expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+  });
+
+  it('arrow-body function: ENTRY → block → EXIT (return)', () => {
+    const cfg = dart.cfgOf(`int f(int x) => x + 1;`);
+    expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+    expect(edgeKinds(cfg).has('return')).toBe(true);
+    // The parameter is bound and used.
+    expect(definesBinding(cfg, bindingIdx(cfg, 'x'))).toBe(true);
+    expect(usesBinding(cfg, bindingIdx(cfg, 'x'))).toBe(true);
+  });
+
+  it('an unmodeled shape (abstract method, no body) builds no CFG and never throws', () => {
+    // An abstract method declaration has a `function_signature`/`method_signature`
+    // but NO sibling `function_body` — `isFunction` rejects it; a real function
+    // still builds. buildFunctionCfg must never throw.
+    const root = dart.parse(`abstract class P { void f(); }`);
+    const fns = dart.collectFunctions(root);
+    for (const fn of fns) {
+      expect(() => createDartCfgVisitor().buildFunctionCfg(fn, 'p.dart')).not.toThrow();
+    }
+    const cfg = dart.cfgOf(`void g() { x(); }`);
+    expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+  });
+
+  it('a class method is a CFG-bearing function and binds its params', () => {
+    const cfg = dart.cfgOf(`class C { void m(int a) { g(a); } }`);
+    expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+    expect(definesBinding(cfg, bindingIdx(cfg, 'a'))).toBe(true);
+  });
+
+  it('a getter with an arrow body builds a CFG', () => {
+    const cfgs = dart.cfgsOf(`class C { int get v => 3; }`);
+    expect(cfgs.length).toBeGreaterThanOrEqual(1);
+    const getter = cfgs[0];
+    expect(reaches(getter, getter.entryIndex, getter.exitIndex)).toBe(true);
+    expect(edgeKinds(getter).has('return')).toBe(true);
+  });
+});
+
+describe('Dart CfgVisitor — branching (if/else)', () => {
+  it('if/else: cond-true to then, cond-false to else, both reach the join', () => {
+    const cfg = dart.cfgOf(`void f(int x) { if (x > 0) { a(); } else { b(); } c(); }`);
+    const kinds = edgeKinds(cfg);
+    expect(kinds.has('cond-true')).toBe(true);
+    expect(kinds.has('cond-false')).toBe(true);
+    const join = block(cfg, 'c();');
+    expect(reaches(cfg, block(cfg, 'a();'), join)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'b();'), join)).toBe(true);
+  });
+
+  it('else-if chain branches each condition', () => {
+    const cfg = dart.cfgOf(
+      `void f(int x) { if (x == 1) { a(); } else if (x == 2) { b(); } else { c(); } d(); }`,
+    );
+    const join = block(cfg, 'd();');
+    expect(reaches(cfg, block(cfg, 'a();'), join)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'b();'), join)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'c();'), join)).toBe(true);
+  });
+
+  it('if without braces (bare body statement) still branches', () => {
+    const cfg = dart.cfgOf(`void f(int x) { if (x > 0) a(); else b(); c(); }`);
+    expect(edgeKinds(cfg).has('cond-true')).toBe(true);
+    expect(edgeKinds(cfg).has('cond-false')).toBe(true);
+    expect(reaches(cfg, block(cfg, 'a();'), block(cfg, 'c();'))).toBe(true);
+  });
+});
+
+describe('Dart CfgVisitor — loops', () => {
+  it('for-in: header + body + loop-back + exit; binds the loop var', () => {
+    const cfg = dart.cfgOf(`void f(List xs) { for (var e in xs) { step(e); } done(); }`);
+    const header = block(cfg, 'for (var e in xs)');
+    const body = block(cfg, 'step(e)');
+    expect(cfg.edges).toContainEqual({ from: body, to: header, kind: 'loop-back' });
+    expect(edgeKinds(cfg).has('cond-true')).toBe(true);
+    expect(reaches(cfg, header, block(cfg, 'done();'))).toBe(true);
+    expect(definesBinding(cfg, bindingIdx(cfg, 'e'))).toBe(true);
+  });
+
+  it('for-in over an existing variable `(e in xs)` still defines e each iteration', () => {
+    const cfg = dart.cfgOf(`void f(List xs) { var e; for (e in xs) { use(e); } }`);
+    expect(definesBinding(cfg, bindingIdx(cfg, 'e'))).toBe(true);
+    expect(usesBinding(cfg, bindingIdx(cfg, 'e'))).toBe(true);
+  });
+
+  it('c-style for: header tests, body loops back', () => {
+    const cfg = dart.cfgOf(`void f() { for (var i = 0; i < 10; i++) { step(i); } done(); }`);
+    const header = block(cfg, 'for (var i = 0');
+    const body = block(cfg, 'step(i)');
+    expect(cfg.edges).toContainEqual({ from: body, to: header, kind: 'loop-back' });
+    expect(edgeKinds(cfg).has('cond-true')).toBe(true);
+    expect(reaches(cfg, header, block(cfg, 'done();'))).toBe(true);
+    expect(definesBinding(cfg, bindingIdx(cfg, 'i'))).toBe(true);
+  });
+
+  it('while: header tests first, body loops back', () => {
+    const cfg = dart.cfgOf(`void f() { while (cond()) { step(); } done(); }`);
+    const header = block(cfg, 'while (cond())');
+    const body = block(cfg, 'step();');
+    expect(cfg.edges).toContainEqual({ from: body, to: header, kind: 'loop-back' });
+    expect(edgeKinds(cfg).has('cond-true')).toBe(true);
+    expect(reaches(cfg, header, block(cfg, 'done();'))).toBe(true);
+  });
+
+  it('do-while runs the body BEFORE testing, then loops back from the bottom', () => {
+    const cfg = dart.cfgOf(`void f() { do { step(); } while (cond()); done(); }`);
+    const body = block(cfg, 'step();');
+    const cond = block(cfg, 'while (cond())');
+    expect(reaches(cfg, cfg.entryIndex, body)).toBe(true); // body runs first
+    expect(reaches(cfg, body, cond)).toBe(true); // condition tests at the bottom
+    expect(cfg.edges).toContainEqual({ from: cond, to: body, kind: 'loop-back' });
+    expect(reaches(cfg, cond, block(cfg, 'done();'))).toBe(true);
+  });
+
+  it('while (true) {} keeps EXIT reverse-reachable AND emits CDG > 0', () => {
+    // The inner `if` is a real control point; assert through the production
+    // post-dom/CDG passes (matching go/python/ruby/rust/vue) — CDG is only
+    // computed when EXIT stays reverse-reachable, so a non-empty CDG proves the
+    // structural exit-escape edge keeps the function CDG-bearing.
+    const cfg = dart.cfgOf(`void f(bool x) { while (true) { if (x) { g(); } } }`);
+    expect(edgeKinds(cfg).has('cond-false')).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+    expect(computeControlDependence(cfg).edges.length).toBeGreaterThan(0);
+  });
+
+  it('for (;;) {} keeps EXIT reverse-reachable AND emits CDG > 0', () => {
+    const cfg = dart.cfgOf(`void f(bool x) { for (;;) { if (x) { g(); } } }`);
+    expect(edgeKinds(cfg).has('cond-false')).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+    expect(computeControlDependence(cfg).edges.length).toBeGreaterThan(0);
+  });
+});
+
+describe('Dart CfgVisitor — switch', () => {
+  it('non-empty cases do NOT implicitly fall through; each rejoins after', () => {
+    const cfg = dart.cfgOf(`void f(int x) {
+      switch (x) {
+        case 1: one(); break;
+        case 2: two(); break;
+        default: other();
+      }
+      after();
+    }`);
+    expect(edgeKinds(cfg).has('switch-case')).toBe(true);
+    // case 1 body does NOT flow into case 2 body (no implicit fallthrough).
+    expect(reaches(cfg, block(cfg, 'one();'), block(cfg, 'two();'))).toBe(false);
+    // every arm reaches the post-switch continuation.
+    expect(reaches(cfg, block(cfg, 'one();'), block(cfg, 'after();'))).toBe(true);
+    expect(reaches(cfg, block(cfg, 'two();'), block(cfg, 'after();'))).toBe(true);
+    expect(reaches(cfg, block(cfg, 'other();'), block(cfg, 'after();'))).toBe(true);
+  });
+
+  it('an EMPTY case falls through to the next case (Dart empty-case fallthrough)', () => {
+    const cfg = dart.cfgOf(`void f(int x) {
+      switch (x) {
+        case 1:
+        case 2:
+          a();
+          break;
+        default:
+          d();
+      }
+      after();
+    }`);
+    expect(edgeKinds(cfg).has('fallthrough')).toBe(true);
+    // The empty `case 1:` dispatch reaches the shared `a()` body via fallthrough.
+    expect(reachable(cfg, block(cfg, 'a();'))).toBe(true);
+    expect(reaches(cfg, block(cfg, 'a();'), block(cfg, 'after();'))).toBe(true);
+  });
+
+  it('explicit `continue LABEL;` jumps to the labeled case', () => {
+    const cfg = dart.cfgOf(`void f(int x) {
+      switch (x) {
+        case 1: a(); continue done;
+        case 2: b(); break;
+        done:
+        case 3: c(); break;
+        default: d();
+      }
+      after();
+    }`);
+    expect(edgeKinds(cfg).has('fallthrough')).toBe(true);
+    // case 1's `continue done` reaches the labeled case 3 body c().
+    expect(reaches(cfg, block(cfg, 'a();'), block(cfg, 'c();'))).toBe(true);
+    expect(reachable(cfg, block(cfg, 'after();'))).toBe(true);
+  });
+
+  it('a switch with NO default lets the no-match path fall to the join', () => {
+    const cfg = dart.cfgOf(`void f(int x) { switch (x) { case 1: a(); break; } after(); }`);
+    expect(edgeKinds(cfg).has('switch-case')).toBe(true);
+    expect(reachable(cfg, block(cfg, 'after();'))).toBe(true);
+  });
+
+  it('a BARE `continue;` in a case targets the loop — no false case→default fall-through', () => {
+    // `continue;` (no label) jumps to the for-loop header. The bug DROPPED it,
+    // fabricating a DIRECT case-1 → default fall-through edge. With the continue
+    // modeled, no such direct edge exists (the only path from tainted() to sink()
+    // is the legitimate loop back-edge, i.e. a later iteration).
+    const cfg = dart.cfgOf(`void f(List xs) {
+      for (var x in xs) {
+        switch (x) {
+          case 1: tainted(); continue;
+          default: sink();
+        }
+      }
+    }`);
+    const tainted = block(cfg, 'tainted();');
+    const sink = block(cfg, 'sink();');
+    expect(cfg.edges.some((e) => e.from === tainted && e.to === sink)).toBe(false);
+  });
+
+  it('a switch EXPRESSION used as a value stays inline (no branch edges)', () => {
+    const cfg = dart.cfgOf(`void f(int x) {
+      var y = switch (x) { 1 => one(), 2 => two(), _ => other() };
+      use(y);
+    }`);
+    // The value-position switch expression coalesces; no switch-case edges.
+    expect(edgeKinds(cfg).has('switch-case')).toBe(false);
+    expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+    expect(definesBinding(cfg, bindingIdx(cfg, 'y'))).toBe(true);
+  });
+
+  it('a switch-EXPRESSION arm write is a may-def, not a hard kill of the prior def (#2206)', () => {
+    const cfg = dart.cfgOf(`void f(int x) {
+      int z = 0;
+      var y = switch (x) { 1 => z = 10, _ => z = 20 };
+      use(z);
+    }`);
+    const z = bindingIdx(cfg, 'z');
+    // only one arm runs, so the arm writes (z=10 / z=20) are MAY-defs — they must
+    // not unconditionally KILL the prior `int z = 0`.
+    expect(cfg.blocks.some((bl) => bl.statements?.some((s) => (s.mayDefs ?? []).includes(z)))).toBe(
+      true,
+    );
+  });
+});
+
+describe('Dart CfgVisitor — try/on/catch/finally', () => {
+  it('try/on/catch/finally: a throw edge runs to the handler; finally completion edges', () => {
+    const cfg = dart.cfgOf(`void f() {
+      try { risky(); }
+      on Exception catch (e, st) { handle(e, st); }
+      finally { cleanup(); }
+      after();
+    }`);
+    const kinds = edgeKinds(cfg);
+    expect(kinds.has('throw')).toBe(true);
+    const handler = block(cfg, 'handle(e, st)');
+    expect(reaches(cfg, block(cfg, 'risky();'), handler)).toBe(true);
+    // the finally runs on both normal and exception exit.
+    const fin = block(cfg, 'cleanup();');
+    expect(reaches(cfg, block(cfg, 'risky();'), fin)).toBe(true);
+    expect(reaches(cfg, handler, fin)).toBe(true);
+    // after() is still reachable (finally completion rejoins).
+    expect(reachable(cfg, block(cfg, 'after();'))).toBe(true);
+    // the `on … catch (e, st)` binds both error names.
+    expect(definesBinding(cfg, bindingIdx(cfg, 'e'))).toBe(true);
+    expect(definesBinding(cfg, bindingIdx(cfg, 'st'))).toBe(true);
+  });
+
+  it('try with finally only (no catch) still threads cleanup on both paths', () => {
+    const cfg = dart.cfgOf(`void f() { try { risky(); } finally { cleanup(); } after(); }`);
+    const fin = block(cfg, 'cleanup();');
+    expect(reaches(cfg, block(cfg, 'risky();'), fin)).toBe(true);
+    expect(reachable(cfg, block(cfg, 'after();'))).toBe(true);
+  });
+
+  it('a return inside a try threads through the finally (finally-return completion)', () => {
+    const cfg = dart.cfgOf(`int f() {
+      try { return compute(); } finally { cleanup(); }
+    }`);
+    const kinds = edgeKinds(cfg);
+    expect(kinds.has('return')).toBe(true);
+    expect(kinds.has('finally-return')).toBe(true);
+    const fin = block(cfg, 'cleanup();');
+    expect(reaches(cfg, fin, cfg.exitIndex)).toBe(true);
+  });
+
+  it('rethrow re-routes to the outer handler / EXIT and ends its block', () => {
+    const cfg = dart.cfgOf(`void f() { try { risky(); } catch (e) { rethrow; } }`);
+    const re = block(cfg, 'rethrow;');
+    expect(edgeKinds(cfg).has('throw')).toBe(true);
+    // rethrow with no outer handler propagates to EXIT.
+    expect(cfg.edges).toContainEqual({ from: re, to: cfg.exitIndex, kind: 'throw' });
+    expect(reaches(cfg, re, cfg.exitIndex)).toBe(true);
+    expect(definesBinding(cfg, bindingIdx(cfg, 'e'))).toBe(true);
+  });
+
+  it('a throw with NO enclosing try routes to EXIT and ends its block', () => {
+    const cfg = dart.cfgOf(`void f(bool x) { if (x) throw StateError('x'); done(); }`);
+    const thr = block(cfg, "throw StateError('x')");
+    expect(cfg.edges).toContainEqual({ from: thr, to: cfg.exitIndex, kind: 'throw' });
+    // throw terminates its block — control does not fall into done() from it.
+    expect(reaches(cfg, thr, block(cfg, 'done();'))).toBe(false);
+    expect(reachable(cfg, block(cfg, 'done();'))).toBe(true); // via the if false branch
+  });
+});
+
+describe('Dart CfgVisitor — labeled break/continue', () => {
+  it('labeled `break outer` escapes BOTH loops and reaches done()', () => {
+    const cfg = dart.cfgOf(`void f(List xs, List ys) {
+      outer: for (var i in xs) {
+        for (var j in ys) { break outer; }
+      }
+      done();
+    }`);
+    const brk = block(cfg, 'break outer;');
+    expect(edgeKinds(cfg).has('break')).toBe(true);
+    expect(reaches(cfg, brk, block(cfg, 'done();'))).toBe(true);
+  });
+
+  it('labeled `continue outer` targets the outer loop header', () => {
+    const cfg = dart.cfgOf(`void f(List xs, List ys) {
+      outer: for (var i in xs) {
+        for (var j in ys) { continue outer; }
+      }
+      done();
+    }`);
+    expect(edgeKinds(cfg).has('continue')).toBe(true);
+    const outer = block(cfg, 'for (var i in xs)');
+    const cont = block(cfg, 'continue outer;');
+    expect(reaches(cfg, cont, outer)).toBe(true);
+  });
+});
+
+describe('Dart CfgVisitor — closures (own CFG)', () => {
+  it('a closure is collected as its own CFG; both keep EXIT reachable', () => {
+    const cfgs = dart.cfgsOf(`void f(List xs) {
+      xs.forEach((e) {
+        use(e);
+      });
+    }`);
+    // f and the closure are both CFG-bearing.
+    expect(cfgs.length).toBeGreaterThanOrEqual(2);
+    for (const cfg of cfgs) expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+    // The closure's CFG is the one that binds its own param `e` (the enclosing
+    // f's block text also contains `use(e);`, so match on the binding instead).
+    const closure = cfgs.find((c) => (c.bindings ?? []).some((b) => b.name === 'e'));
+    expect(closure).toBeDefined();
+    expect(definesBinding(closure!, bindingIdx(closure!, 'e'))).toBe(true);
+  });
+});
+
+describe('Dart CfgVisitor — def/use harvest', () => {
+  it('var x = compute(); use(x) produces a def of x and a use in the consumer', () => {
+    const cfg = dart.cfgOf(`void f() { var x = compute(); use(x); }`);
+    const x = bindingIdx(cfg, 'x');
+    expect(definesBinding(cfg, x)).toBe(true);
+    expect(usesBinding(cfg, x)).toBe(true);
+  });
+
+  it('final and typed local declarations both define', () => {
+    const cfg = dart.cfgOf(`void f() { final b = compute(); int c = 3; use(b); use(c); }`);
+    for (const name of ['b', 'c']) {
+      const idx = bindingIdx(cfg, name);
+      expect(definesBinding(cfg, idx)).toBe(true);
+      expect(usesBinding(cfg, idx)).toBe(true);
+    }
+  });
+
+  it('compound assign `x += step()` defines AND uses x', () => {
+    const cfg = dart.cfgOf(`void f() { var x = 0; x += step(); }`);
+    const x = bindingIdx(cfg, 'x');
+    expect(definesBinding(cfg, x)).toBe(true);
+    expect(usesBinding(cfg, x)).toBe(true);
+  });
+
+  it('a member write `obj.x = 1` does NOT define a scalar `x`; the root is a use', () => {
+    const cfg = dart.cfgOf(`void f(C obj) { obj.x = compute(); }`);
+    // `obj` is used (it is the assignment target's root); no scalar `x` binding.
+    expect(usesBinding(cfg, bindingIdx(cfg, 'obj'))).toBe(true);
+  });
+
+  it('multi-variable declaration `var a = 1, b = 2;` defines BOTH names (#2195 P2)', () => {
+    const cfg = dart.cfgOf(`void f() { var a = 1, b = 2; use(a); use(b); }`);
+    // The bug dropped every name after the first — `b` became a synthetic
+    // global. Both must be real locals defined by the declaration.
+    expect(definesBinding(cfg, bindingIdx(cfg, 'a'))).toBe(true);
+    expect(definesBinding(cfg, bindingIdx(cfg, 'b'))).toBe(true);
+    expect(usesBinding(cfg, bindingIdx(cfg, 'b'))).toBe(true); // use(b)
+  });
+});
+
+describe('Dart CfgVisitor — functionStartColumn', () => {
+  it('two same-line functions get distinct functionStartColumn', () => {
+    const cfgs = dart.cfgsOf(`void a() { x(); } void b() { y(); }`);
+    expect(cfgs).toHaveLength(2);
+    expect(cfgs[0].functionStartLine).toBe(cfgs[1].functionStartLine); // same line
+    expect(cfgs[0].functionStartColumn).not.toBe(cfgs[1].functionStartColumn); // distinct column
+  });
+});
diff --git a/gitnexus/test/unit/cfg/go-visitor.test.ts b/gitnexus/test/unit/cfg/go-visitor.test.ts
new file mode 100644
index 000000000..fcb6a4b74
--- /dev/null
+++ b/gitnexus/test/unit/cfg/go-visitor.test.ts
@@ -0,0 +1,483 @@
+import { describe, it, expect, vi } from 'vitest';
+import { createRequire } from 'node:module';
+import { createGoCfgVisitor } from '../../../src/core/ingestion/cfg/visitors/go.js';
+import type { FunctionCfg } from '../../../src/core/ingestion/cfg/types.js';
+import {
+  makeCfgHarness,
+  type CfgHarness,
+  block,
+  edgeKinds,
+  reaches,
+  reachable,
+  bindingIdx,
+  allSites,
+  hasAnySites,
+} from '../../helpers/cfg-harness.js';
+import { isExitReachableFromAllBlocks } from '../../../src/core/ingestion/cfg/post-dominators.js';
+import { computeControlDependence } from '../../../src/core/ingestion/cfg/control-dependence.js';
+import { augmentForPostDom } from '../../../src/core/ingestion/cfg/synthetic-escape.js';
+
+// U5 — the Go CfgVisitor, one hazard per test (KTD5: real-parser regression,
+// NOT snapshot-pinning). Each fixture's distinctive statement text (step(),
+// done(), one(), …) lets us locate the block for a region by text and assert the
+// control-flow topology around it. Go is the highest-divergence target — the
+// EXIT-reachability regressions for `for {}` / `select {}` are load-bearing.
+
+const goGrammar = createRequire(import.meta.url)('tree-sitter-go') as Parameters<
+  typeof makeCfgHarness
+>[0];
+
+const go: CfgHarness = makeCfgHarness(goGrammar, createGoCfgVisitor(), 'fixture.go');
+
+const hasDef = (cfg: FunctionCfg, idx: number): boolean =>
+  cfg.blocks.some((bl) => bl.statements?.some((s) => s.defs.includes(idx)));
+const hasUse = (cfg: FunctionCfg, idx: number): boolean =>
+  cfg.blocks.some((bl) => bl.statements?.some((s) => s.uses.includes(idx)));
+const hasMayDef = (cfg: FunctionCfg, idx: number): boolean =>
+  cfg.blocks.some((bl) => bl.statements?.some((s) => (s.mayDefs ?? []).includes(idx)));
+
+/** Wrap a Go function body in a minimal compilable package. */
+const pkg = (src: string): string => `package main\n${src}\n`;
+
+describe('Go CfgVisitor — structure', () => {
+  it('straight-line body: ENTRY → block → EXIT (seq)', () => {
+    const cfg = go.cfgOf(pkg(`func f() { a(); b(); c() }`));
+    expect(cfg.blocks.filter((b) => b.kind === 'normal')).toHaveLength(1);
+    const body = block(cfg, 'a()');
+    expect(cfg.edges).toContainEqual({ from: cfg.entryIndex, to: body, kind: 'seq' });
+    expect(reaches(cfg, body, cfg.exitIndex)).toBe(true);
+  });
+
+  it('empty body: ENTRY → EXIT', () => {
+    const cfg = go.cfgOf(pkg(`func f() {}`));
+    expect(cfg.blocks).toHaveLength(2);
+    expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+  });
+
+  it('function, method, and func literal are all CFG-bearing', () => {
+    const cfgs = go.cfgsOf(
+      pkg(`func f() { x() }\nfunc (r *T) M() { y() }\nvar g = func() { z() }`),
+    );
+    expect(cfgs.length).toBeGreaterThanOrEqual(3); // f, M, the func literal
+    for (const cfg of cfgs) expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+  });
+
+  it('forward declaration / no body → undefined, never throws', () => {
+    const root = go.parse(pkg(`type I interface { M() }`));
+    const fns = go.collectFunctions(root);
+    for (const fn of fns) {
+      expect(() => createGoCfgVisitor().buildFunctionCfg(fn, 'f.go')).not.toThrow();
+    }
+  });
+});
+
+describe('Go CfgVisitor — if', () => {
+  it('if with initializer: init+cond on the header, both arms reach the join', () => {
+    const cfg = go.cfgOf(pkg(`func f() { if v := compute(); v > 0 { a() } else { b() }; c() }`));
+    const kinds = edgeKinds(cfg);
+    expect(kinds.has('cond-true')).toBe(true);
+    expect(kinds.has('cond-false')).toBe(true);
+    const join = block(cfg, 'c()');
+    expect(reaches(cfg, block(cfg, 'a()'), join)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'b()'), join)).toBe(true);
+    // the initializer `v := compute()` defines v and the condition uses it.
+    const v = bindingIdx(cfg, 'v');
+    expect(hasDef(cfg, v)).toBe(true);
+    expect(hasUse(cfg, v)).toBe(true);
+  });
+
+  it('else if chains through the nested alternative (no else_clause wrapper)', () => {
+    const cfg = go.cfgOf(
+      pkg(`func f(x int) { if x > 0 { a() } else if x < 0 { b() } else { c() } }`),
+    );
+    expect(reaches(cfg, block(cfg, 'a()'), cfg.exitIndex)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'b()'), cfg.exitIndex)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'c()'), cfg.exitIndex)).toBe(true);
+  });
+});
+
+describe('Go CfgVisitor — for (Go single loop keyword, four shapes)', () => {
+  it('for_clause (C-style): init once, condition header, back-edge through update', () => {
+    const cfg = go.cfgOf(pkg(`func f(n int) { for i := 0; i < n; i++ { step() }; done() }`));
+    const init = block(cfg, 'i := 0');
+    const header = block(cfg, 'i < n');
+    const incr = block(cfg, 'i++');
+    const body = block(cfg, 'step()');
+    expect(cfg.edges).toContainEqual({ from: cfg.entryIndex, to: init, kind: 'seq' });
+    expect(reaches(cfg, body, incr)).toBe(true);
+    expect(cfg.edges).toContainEqual({ from: incr, to: header, kind: 'loop-back' });
+    expect(reaches(cfg, header, block(cfg, 'done()'))).toBe(true);
+  });
+
+  it('for cond {} (while-style): header + back-edge + exit', () => {
+    const cfg = go.cfgOf(pkg(`func f(x int) { for x > 0 { step() }; done() }`));
+    const header = block(cfg, 'x > 0');
+    const body = block(cfg, 'step()');
+    expect(cfg.edges).toContainEqual({ from: body, to: header, kind: 'loop-back' });
+    expect(edgeKinds(cfg).has('cond-true')).toBe(true);
+    expect(reaches(cfg, header, block(cfg, 'done()'))).toBe(true);
+  });
+
+  it('for range: header + body + loop-back; loop vars are defs, source a use', () => {
+    const cfg = go.cfgOf(pkg(`func f(xs []int) { for k, v := range xs { use(k, v) }; done() }`));
+    const body = block(cfg, 'use(k, v)');
+    expect(edgeKinds(cfg).has('cond-true')).toBe(true);
+    expect(edgeKinds(cfg).has('loop-back')).toBe(true);
+    const header = cfg.edges.find((e) => e.kind === 'loop-back' && e.from === body)?.to;
+    expect(header).toBeDefined();
+    expect(reaches(cfg, header!, block(cfg, 'done()'))).toBe(true);
+    expect(hasDef(cfg, bindingIdx(cfg, 'k'))).toBe(true);
+    expect(hasDef(cfg, bindingIdx(cfg, 'v'))).toBe(true);
+    expect(hasUse(cfg, bindingIdx(cfg, 'xs'))).toBe(true);
+  });
+
+  it('for {} (infinite) keeps EXIT reverse-reachable AND emits CDG > 0', () => {
+    const cfg = go.cfgOf(pkg(`func f(x bool) { for { if x { g() } } }`));
+    expect(edgeKinds(cfg).has('cond-false')).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+    // The inner `if` is a real control point — CDG must be non-empty (it is only
+    // computed when EXIT stays reverse-reachable).
+    expect(computeControlDependence(cfg).edges.length).toBeGreaterThan(0);
+  });
+});
+
+describe('Go CfgVisitor — switch (no implicit fallthrough)', () => {
+  it('expression_switch cases do NOT fall through by default', () => {
+    const cfg = go.cfgOf(
+      pkg(`func f(x int) {
+        switch x {
+        case 1:
+          one()
+        case 2:
+          two()
+        default:
+          other()
+        }
+        after()
+      }`),
+    );
+    expect(edgeKinds(cfg).has('switch-case')).toBe(true);
+    // each case body rejoins after the switch...
+    expect(reaches(cfg, block(cfg, 'one()'), block(cfg, 'after()'))).toBe(true);
+    expect(reaches(cfg, block(cfg, 'two()'), block(cfg, 'after()'))).toBe(true);
+    // ...but case 1 does NOT fall into case 2 (Go has no implicit fallthrough).
+    expect(reaches(cfg, block(cfg, 'one()'), block(cfg, 'two()'))).toBe(false);
+  });
+
+  it('explicit fallthrough_statement adds a fallthrough edge to the next case', () => {
+    const cfg = go.cfgOf(
+      pkg(`func f(x int) {
+        switch x {
+        case 1:
+          one()
+          fallthrough
+        case 2:
+          two()
+        }
+        after()
+      }`),
+    );
+    expect(edgeKinds(cfg).has('fallthrough')).toBe(true);
+    // case 1 (via fallthrough) reaches case 2's body.
+    expect(reaches(cfg, block(cfg, 'one()'), block(cfg, 'two()'))).toBe(true);
+  });
+
+  it('type_switch dispatches across type cases', () => {
+    const cfg = go.cfgOf(
+      pkg(`func f(i interface{}) {
+        switch t := i.(type) {
+        case int:
+          useInt(t)
+        case string:
+          useStr(t)
+        default:
+          other()
+        }
+        after()
+      }`),
+    );
+    expect(edgeKinds(cfg).has('switch-case')).toBe(true);
+    expect(reaches(cfg, block(cfg, 'useInt(t)'), block(cfg, 'after()'))).toBe(true);
+    expect(reaches(cfg, block(cfg, 'useStr(t)'), block(cfg, 'after()'))).toBe(true);
+    // the type-switch alias `t` is a def on the dispatch header.
+    expect(hasDef(cfg, bindingIdx(cfg, 't'))).toBe(true);
+  });
+});
+
+describe('Go CfgVisitor — select', () => {
+  it('select dispatches across communication cases (no implicit fallthrough)', () => {
+    const cfg = go.cfgOf(
+      pkg(`func f(ch chan int) {
+        select {
+        case v := <-ch:
+          use(v)
+        case ch <- 1:
+          sent()
+        default:
+          none()
+        }
+        after()
+      }`),
+    );
+    expect(edgeKinds(cfg).has('switch-case')).toBe(true);
+    expect(reaches(cfg, block(cfg, 'use(v)'), block(cfg, 'after()'))).toBe(true);
+    expect(reaches(cfg, block(cfg, 'sent()'), block(cfg, 'after()'))).toBe(true);
+    // comm case 1 does not fall into comm case 2.
+    expect(reaches(cfg, block(cfg, 'use(v)'), block(cfg, 'sent()'))).toBe(false);
+  });
+
+  it('select {} with no default keeps EXIT reverse-reachable AND emits CDG > 0', () => {
+    // The CDG probe required by the plan: a `select {}` blocks forever, so EXIT
+    // must stay reverse-reachable or CDG is silently skipped for the function.
+    const cfg = go.cfgOf(pkg(`func f(x bool) { if x { g() }; select {} }`));
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+    expect(computeControlDependence(cfg).edges.length).toBeGreaterThan(0);
+  });
+
+  it('bare select {} keeps EXIT reverse-reachable on its own', () => {
+    const cfg = go.cfgOf(pkg(`func f() { select {} }`));
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+    expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+  });
+});
+
+describe('Go CfgVisitor — defer (LIFO completion legs)', () => {
+  it('defer body runs on the normal exit path', () => {
+    const cfg = go.cfgOf(pkg(`func f() { defer cleanup(); work() }`));
+    const cleanup = block(cfg, 'defer cleanup()');
+    const work = block(cfg, 'work()');
+    // normal completion of work threads through the deferred cleanup → EXIT.
+    expect(reaches(cfg, work, cleanup)).toBe(true);
+    expect(reaches(cfg, cleanup, cfg.exitIndex)).toBe(true);
+  });
+
+  it('defer runs on a return path too (return threads through the defer)', () => {
+    const cfg = go.cfgOf(
+      pkg(`func f(x bool) int { defer cleanup(); if x { return 1 }; return 2 }`),
+    );
+    const cleanup = block(cfg, 'defer cleanup()');
+    expect(reaches(cfg, block(cfg, 'return 1'), cleanup)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'return 2'), cleanup)).toBe(true);
+    expect(reaches(cfg, cleanup, cfg.exitIndex)).toBe(true);
+  });
+
+  it('two defers run LIFO: the last-registered runs first', () => {
+    const cfg = go.cfgOf(pkg(`func f() { defer first(); defer second(); work() }`));
+    const first = block(cfg, 'defer first()');
+    const second = block(cfg, 'defer second()');
+    // LIFO: `second` runs before `first` on the exit path.
+    expect(reaches(cfg, second, first)).toBe(true);
+    expect(reaches(cfg, first, cfg.exitIndex)).toBe(true);
+    // the deferred call facts are present (cleanup runs at exit).
+    expect(edgeKinds(cfg).has('finally-return')).toBe(true);
+  });
+});
+
+describe('Go CfgVisitor — labeled break / continue / goto', () => {
+  it('labeled break exits the OUTER loop from a nested loop', () => {
+    const cfg = go.cfgOf(
+      pkg(`func f() {
+      outer:
+        for i := 0; i < 10; i++ {
+          for j := 0; j < 10; j++ {
+            if cond() { break outer }
+          }
+        }
+        done()
+      }`),
+    );
+    expect(edgeKinds(cfg).has('break')).toBe(true);
+    const brk = block(cfg, 'break outer');
+    // the labeled break reaches the post-loop `done()`, skipping both loops.
+    expect(reaches(cfg, brk, block(cfg, 'done()'))).toBe(true);
+  });
+
+  it('labeled continue re-tests the OUTER loop', () => {
+    const cfg = go.cfgOf(
+      pkg(`func f() {
+      outer:
+        for i := 0; i < 10; i++ {
+          for j := 0; j < 10; j++ {
+            if cond() { continue outer }
+          }
+        }
+      }`),
+    );
+    expect(edgeKinds(cfg).has('continue')).toBe(true);
+    const outerHeader = block(cfg, 'i < 10');
+    expect(reaches(cfg, block(cfg, 'continue outer'), outerHeader)).toBe(true);
+  });
+
+  it('goto reaches a forward label', () => {
+    const cfg = go.cfgOf(pkg(`func f(x bool) { if x { goto end }; work(); end: done() }`));
+    const gotoB = block(cfg, 'goto end');
+    const label = block(cfg, 'done()');
+    expect(reaches(cfg, gotoB, label)).toBe(true);
+    expect(reachable(cfg, block(cfg, 'work()'))).toBe(true);
+  });
+
+  // #2197 U1 — an UNCONDITIONAL goto-cycle traps EXIT (the `goto start` has no
+  // exit path); the synthetic-escape pass bridges it so CDG is emitted instead
+  // of withheld. The forward goto above had an exit path (it skips to `done()`).
+  it('unconditional goto-cycle: bridged → EXIT reachable AND CDG emitted', () => {
+    const cfg = go.cfgOf(pkg(`func handler(a int){ start: if a>0 { work() }\n goto start }`));
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(false); // trapped without the pass
+    const view = augmentForPostDom(cfg);
+    expect(isExitReachableFromAllBlocks(view)).toBe(true);
+    expect(computeControlDependence(view).edges.length).toBeGreaterThan(0);
+  });
+});
+
+describe('Go CfgVisitor — go statement (spawned flow not followed inline)', () => {
+  it('go func(){…}() does not throw; the closure body builds its own CFG', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    try {
+      const cfgs = go.cfgsOf(pkg(`func f() { go func() { run() }(); go worker(1); after() }`));
+      // f plus the spawned closure = at least 2 CFGs.
+      expect(cfgs.length).toBeGreaterThanOrEqual(2);
+      for (const cfg of cfgs) expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+      // The `go` call is a normal straight-line statement in f — `after()` runs.
+      const f = cfgs[0];
+      expect(reachable(f, block(f, 'after()'))).toBe(true);
+      // No dropped edge → no warning for the common shapes.
+      expect(warn).not.toHaveBeenCalled();
+    } finally {
+      warn.mockRestore();
+    }
+  });
+});
+
+describe('Go CfgVisitor — def/use harvest', () => {
+  it('a, b := f() defines BOTH a and b (multiple-return assignment)', () => {
+    const cfg = go.cfgOf(pkg(`func f() { a, b := load(); use(a, b) }`));
+    expect(hasDef(cfg, bindingIdx(cfg, 'a'))).toBe(true);
+    expect(hasDef(cfg, bindingIdx(cfg, 'b'))).toBe(true);
+    expect(hasUse(cfg, bindingIdx(cfg, 'a'))).toBe(true);
+    expect(hasUse(cfg, bindingIdx(cfg, 'b'))).toBe(true);
+  });
+
+  it('x := …; use(x) → def then use', () => {
+    const cfg = go.cfgOf(pkg(`func f(a int, b int) { x := a + b; use(x) }`));
+    const x = bindingIdx(cfg, 'x');
+    expect(hasDef(cfg, x)).toBe(true);
+    expect(hasUse(cfg, x)).toBe(true);
+  });
+
+  it('compound assignment (x += 1) reads AND writes the lvalue', () => {
+    const cfg = go.cfgOf(pkg(`func f() { x := 1; x += 3 }`));
+    const x = bindingIdx(cfg, 'x');
+    expect(hasDef(cfg, x)).toBe(true);
+    expect(hasUse(cfg, x)).toBe(true);
+  });
+
+  it('inc_statement (x++) reads and writes', () => {
+    const cfg = go.cfgOf(pkg(`func f() { x := 0; x++ }`));
+    const x = bindingIdx(cfg, 'x');
+    expect(hasDef(cfg, x)).toBe(true);
+    expect(hasUse(cfg, x)).toBe(true);
+  });
+
+  it('var with initializer is a def; bare var (no value) is not', () => {
+    const cfg = go.cfgOf(pkg(`func f() { var a = 1; var b int; use(a, b) }`));
+    const a = bindingIdx(cfg, 'a');
+    expect(hasDef(cfg, a)).toBe(true);
+    // `var b int` writes nothing at runtime → `b` is a use-only synthetic-ish
+    // binding (no def fact); the use(b) reads it.
+    expect(hasUse(cfg, bindingIdx(cfg, 'b'))).toBe(true);
+  });
+
+  it('selector write (obj.f = …) is NOT a scalar def — root identifier is a use', () => {
+    const cfg = go.cfgOf(pkg(`func f(obj *T) { obj.field = 1; use(obj) }`));
+    // `obj` is used (its field is written), never a scalar def for `field`.
+    expect(hasUse(cfg, bindingIdx(cfg, 'obj'))).toBe(true);
+  });
+
+  it('a && (cond) short-circuit right operand uses are recorded', () => {
+    // Go has no in-expression assignment, so the conditional machinery is
+    // exercised via the may-def path of a switch case test; here we just confirm
+    // the && right operand is walked (its identifier is a use).
+    const cfg = go.cfgOf(pkg(`func f(a bool, b bool) { if a && b { g() } }`));
+    expect(hasUse(cfg, bindingIdx(cfg, 'b'))).toBe(true);
+  });
+
+  it('switch case test is harvested as a conditional (may-def-capable) use', () => {
+    const cfg = go.cfgOf(pkg(`func f(x int, k int) { switch x { case k: a() } }`));
+    // `k` (the case test) is used on the dispatch block; the conditional context
+    // means any def there would be a may-def (none here, but the path is live).
+    expect(hasUse(cfg, bindingIdx(cfg, 'k'))).toBe(true);
+    void hasMayDef; // may-def path covered structurally by the conditional walk
+  });
+
+  it('select receive `case v := <-ch` defines v, not a use-only (#2195 P2)', () => {
+    const cfg = go.cfgOf(pkg(`func f(ch chan int) { select { case v := <-ch: use(v) } }`));
+    const v = bindingIdx(cfg, 'v');
+    // the channel-received binding is a DEF (the channel-sourced value flows
+    // into v) — the bug recorded it as a use of an uninitialized var instead.
+    expect(hasDef(cfg, v)).toBe(true);
+    // and the channel `ch` is read.
+    expect(hasUse(cfg, bindingIdx(cfg, 'ch'))).toBe(true);
+  });
+});
+
+describe('Go CfgVisitor — functionStartColumn', () => {
+  it('two same-line funcs get distinct functionStartColumn', () => {
+    const cfgs = go.cfgsOf(pkg(`func A() { x() }; func B() { y() }`));
+    expect(cfgs).toHaveLength(2);
+    expect(cfgs[0].functionStartLine).toBe(cfgs[1].functionStartLine);
+    expect(cfgs[0].functionStartColumn).not.toBe(cfgs[1].functionStartColumn);
+  });
+});
+
+// U6 — call-site `sites[]` taint substrate. INERT BY DESIGN: no Go taint model
+// is registered, so these sites produce zero TAINTED edges; they only give the
+// deferred per-language source/sink model something to match against. Go has no
+// `new` — constructor-style calls are plain `call_expression`s.
+describe('Go CfgVisitor — call-site sites[] substrate', () => {
+  const cfgOf = (body: string): FunctionCfg =>
+    go.cfgOf(pkg(`func f(cmd, x, a int, xs []int) { ${body} }`));
+
+  it('a bare call records a `call` site with callee name + arg occurrence', () => {
+    const cfg = cfgOf(`exec(cmd)`);
+    const site = allSites(cfg).find((s) => s.kind === 'call' && s.callee === 'exec');
+    expect(site).toBeDefined();
+    expect(site?.args?.[0]).toContainEqual(bindingIdx(cfg, 'cmd'));
+  });
+
+  it('a selector call (`db.Query(x)`) records the receiver binding + dotted callee', () => {
+    const cfg = cfgOf(`db.Query(x)`);
+    const site = allSites(cfg).find((s) => s.kind === 'call' && s.callee === 'db.Query');
+    expect(site).toBeDefined();
+    expect(site?.receiver).toBe(bindingIdx(cfg, 'db'));
+    expect(site?.args?.[0]).toContainEqual(bindingIdx(cfg, 'x'));
+  });
+
+  it('a call assigned with `:=` records resultDefs', () => {
+    const cfg = cfgOf(`r := load(a); _ = r`);
+    const site = allSites(cfg).find((s) => s.callee === 'load');
+    expect(site?.resultDefs).toContain(bindingIdx(cfg, 'r'));
+  });
+
+  it('a variadic call (`g(xs...)`) marks the spread position', () => {
+    const cfg = cfgOf(`g(xs...)`);
+    const site = allSites(cfg).find((s) => s.callee === 'g');
+    expect(site?.spread).toBe(0);
+    expect(site?.args?.[0]).toContainEqual(bindingIdx(cfg, 'xs'));
+  });
+
+  it('a nested call via-tags the inner site (sanitizer substrate)', () => {
+    const cfg = cfgOf(`exec(escape(x))`);
+    const sites = allSites(cfg);
+    const exec = sites.findIndex((s) => s.callee === 'exec');
+    const escape = sites.findIndex((s) => s.callee === 'escape');
+    expect(exec).toBeGreaterThanOrEqual(0);
+    expect(escape).toBeGreaterThanOrEqual(0);
+    const x = bindingIdx(cfg, 'x');
+    expect(sites[escape].args?.[0]).toContainEqual(x);
+    expect(sites[exec].args?.[0]).toContainEqual([x, escape]);
+  });
+
+  it('a CFG-only function (no calls) emits NO sites key (omit-when-empty)', () => {
+    const cfg = cfgOf(`x := a + a; _ = x`);
+    expect(hasAnySites(cfg)).toBe(false);
+  });
+});
diff --git a/gitnexus/test/unit/cfg/harness.test.ts b/gitnexus/test/unit/cfg/harness.test.ts
new file mode 100644
index 000000000..8e64e3a29
--- /dev/null
+++ b/gitnexus/test/unit/cfg/harness.test.ts
@@ -0,0 +1,56 @@
+import { describe, it, expect } from 'vitest';
+import TypeScript from 'tree-sitter-typescript';
+import { createTypeScriptCfgVisitor } from '../../../src/core/ingestion/cfg/visitors/typescript.js';
+import type { CfgVisitor, FunctionCfg } from '../../../src/core/ingestion/cfg/types.js';
+import type { SyntaxNode } from '../../../src/core/ingestion/utils/ast-helpers.js';
+import { makeCfgHarness } from '../../helpers/cfg-harness.js';
+import { cfgOf as tsBoundCfgOf } from '../../helpers/ts-cfg-harness.js';
+
+describe('makeCfgHarness — language-parameterized CFG harness (#2195 U1)', () => {
+  it('reproduces the TS-bound harness CFG when driven with the TS grammar+visitor', () => {
+    const code = 'function f(x: number) { if (x > 0) { a(); } else { b(); } return x; }';
+    const generic = makeCfgHarness(
+      TypeScript.typescript,
+      createTypeScriptCfgVisitor(),
+      'fixture.ts',
+    ).cfgOf(code);
+    // The thin TS binding (ts-cfg-harness) must be a pure delegate of the
+    // generalized engine: same grammar + visitor + filePath ⇒ identical CFG.
+    expect(generic).toEqual(tsBoundCfgOf(code));
+  });
+
+  it('delegates function discovery to visitor.isFunction (no hardcoded TS node set)', () => {
+    // Stub visitor: recognizes ONLY arrow_function and emits a sentinel 1-block
+    // CFG. If the harness carried TS-specific function detection it would
+    // over-collect (function_declaration, method_definition, …); delegating to
+    // isFunction means it finds exactly the arrows — proving zero TS coupling.
+    const built: string[] = [];
+    const stub: CfgVisitor<SyntaxNode> = {
+      isFunction: (n) => n.type === 'arrow_function',
+      buildFunctionCfg: (fn, filePath): FunctionCfg => {
+        built.push(fn.type);
+        return {
+          filePath,
+          functionStartLine: fn.startPosition.row + 1,
+          functionEndLine: fn.endPosition.row + 1,
+          functionStartColumn: fn.startPosition.column,
+          entryIndex: 0,
+          exitIndex: 1,
+          blocks: [
+            { index: 0, startLine: 1, endLine: 1, text: '', kind: 'entry' },
+            { index: 1, startLine: 1, endLine: 1, text: '', kind: 'exit' },
+          ],
+          edges: [{ from: 0, to: 1, kind: 'seq' }],
+        };
+      },
+    };
+    const code = [
+      'function fd() { return 1; }',
+      'const a = () => 2;',
+      'const b = (x) => x + 1;',
+    ].join('\n');
+    const cfgs = makeCfgHarness(TypeScript.typescript, stub, 'stub.ts').cfgsOf(code);
+    expect(cfgs).toHaveLength(2); // the two arrows; the function_declaration is ignored
+    expect(built).toEqual(['arrow_function', 'arrow_function']);
+  });
+});
diff --git a/gitnexus/test/unit/cfg/harvest.test.ts b/gitnexus/test/unit/cfg/harvest.test.ts
index 7c8e3a823..a77a36149 100644
--- a/gitnexus/test/unit/cfg/harvest.test.ts
+++ b/gitnexus/test/unit/cfg/harvest.test.ts
@@ -710,3 +710,71 @@ describe('M3 U1 — taint-site harvest: templates, callbacks, statement granular
     expect(execSite.args).toEqual([[bindingIdx(cfg, 'x')]]);
   });
 });
+
+import {
+  CallSiteFactAccumulator,
+  DEFAULT_PDG_MAX_SITES_PER_STATEMENT as MAX_SITES,
+} from '../../../src/core/ingestion/cfg/visitors/call-site-harvest.js';
+
+describe('U11 — per-statement site cap (defensive bound on harvested sites[])', () => {
+  it('records every site for a statement below the cap (unchanged)', () => {
+    const acc = new CallSiteFactAccumulator(1);
+    for (let i = 0; i < 5; i++) acc.setSiteCallee(acc.openCallSite('call'), `f${i}`);
+    const facts = acc.finish();
+    expect(facts.sites).toHaveLength(5);
+    expect(acc.sitesTruncated).toBe(false);
+    expect(facts.sites!.map((s) => s.callee)).toEqual(['f0', 'f1', 'f2', 'f3', 'f4']);
+  });
+
+  it('caps a pathological statement at exactly the limit and flags truncation', () => {
+    const acc = new CallSiteFactAccumulator(1);
+    const indices: number[] = [];
+    for (let i = 0; i < MAX_SITES + 50; i++) {
+      const idx = acc.openCallSite('call');
+      acc.setSiteCallee(idx, `f${i}`);
+      indices.push(idx);
+    }
+    const facts = acc.finish();
+    // exactly the cap recorded — not the requested over-count, not unbounded
+    expect(facts.sites).toHaveLength(MAX_SITES);
+    expect(acc.sitesTruncated).toBe(true);
+    // under-cap opens get 0..cap-1; the first over-cap open gets the -1 sentinel
+    expect(indices[MAX_SITES - 1]).toBe(MAX_SITES - 1);
+    expect(indices[MAX_SITES]).toBe(-1);
+    // KEPT sites stay fully intact (no clobber from the dropped tail)
+    expect(facts.sites![0].callee).toBe('f0');
+    expect(facts.sites![MAX_SITES - 1].callee).toBe(`f${MAX_SITES - 1}`);
+  });
+
+  it('member-reads past the cap are dropped, not unbounded', () => {
+    const acc = new CallSiteFactAccumulator(1);
+    for (let i = 0; i < MAX_SITES; i++) acc.openCallSite('call'); // fill to the cap
+    acc.addMemberRead(0, 'body'); // would-be site #cap+1
+    expect(acc.finish().sites).toHaveLength(MAX_SITES);
+    expect(acc.sitesTruncated).toBe(true);
+  });
+
+  it('occurrence machinery stays sound when a nested frame is cap-dropped', () => {
+    const acc = new CallSiteFactAccumulator(1);
+    const outer = acc.openCallSite('call'); // a KEPT outer sink site
+    acc.setSiteCallee(outer, 'sink');
+    acc.pushFrame(outer);
+    acc.setFrameArg(0);
+    // Saturate the remaining budget so the next openCallSite is cap-dropped.
+    for (let i = 1; i < MAX_SITES; i++) acc.openCallSite('call');
+    const nested = acc.openCallSite('call'); // over cap → -1 sentinel
+    expect(nested).toBe(-1);
+    acc.setSiteCallee(nested, 'dropped'); // must no-op, not throw
+    acc.pushFrame(nested);
+    acc.setFrameArg(0);
+    acc.addUse(7); // a use inside the dropped nested call — must not crash
+    acc.popFrame();
+    acc.popFrame();
+    const facts = acc.finish();
+    expect(facts.uses).toContain(7); // still recorded statement-level
+    // outer (kept) fanned the use in as a PLAIN occurrence — no dangling -1 via
+    const flat = (facts.sites![outer].args ?? []).flat();
+    expect(flat).toContain(7);
+    expect(flat.some((e) => Array.isArray(e) && e[1] === -1)).toBe(false);
+  });
+});
diff --git a/gitnexus/test/unit/cfg/java-visitor.test.ts b/gitnexus/test/unit/cfg/java-visitor.test.ts
new file mode 100644
index 000000000..7070a9ee9
--- /dev/null
+++ b/gitnexus/test/unit/cfg/java-visitor.test.ts
@@ -0,0 +1,547 @@
+import { describe, it, expect, vi } from 'vitest';
+import { createRequire } from 'node:module';
+import { createJavaCfgVisitor } from '../../../src/core/ingestion/cfg/visitors/java.js';
+import type { FunctionCfg } from '../../../src/core/ingestion/cfg/types.js';
+import {
+  makeCfgHarness,
+  type CfgHarness,
+  block,
+  edgeKinds,
+  reaches,
+  reachable,
+  bindingIdx,
+  allSites,
+  hasAnySites,
+} from '../../helpers/cfg-harness.js';
+import { isExitReachableFromAllBlocks } from '../../../src/core/ingestion/cfg/post-dominators.js';
+import { computeControlDependence } from '../../../src/core/ingestion/cfg/control-dependence.js';
+
+// U4 — the Java CfgVisitor, one hazard per test (KTD5: real-parser regression,
+// NOT snapshot-pinning). Each fixture's distinctive statement text (step(),
+// done(), handle(e), …) lets us locate the block for a region by text and assert
+// the control-flow topology around it.
+
+const javaGrammar = createRequire(import.meta.url)('tree-sitter-java') as Parameters<
+  typeof makeCfgHarness
+>[0];
+
+const java: CfgHarness = makeCfgHarness(javaGrammar, createJavaCfgVisitor(), 'fixture.java');
+
+const hasDef = (cfg: FunctionCfg, idx: number): boolean =>
+  cfg.blocks.some((bl) => bl.statements?.some((s) => s.defs.includes(idx)));
+const hasUse = (cfg: FunctionCfg, idx: number): boolean =>
+  cfg.blocks.some((bl) => bl.statements?.some((s) => s.uses.includes(idx)));
+const hasMayDef = (cfg: FunctionCfg, idx: number): boolean =>
+  cfg.blocks.some((bl) => bl.statements?.some((s) => (s.mayDefs ?? []).includes(idx)));
+
+const wrap = (body: string): string => `class C { void m(int x) { ${body} } }`;
+
+describe('Java CfgVisitor — structure', () => {
+  it('straight-line body: ENTRY → block → EXIT (seq)', () => {
+    const cfg = java.cfgOf(`class C { void m() { a(); b(); c(); } }`);
+    expect(cfg.blocks.filter((b) => b.kind === 'normal')).toHaveLength(1);
+    const body = block(cfg, 'a();');
+    expect(cfg.edges).toContainEqual({ from: cfg.entryIndex, to: body, kind: 'seq' });
+    expect(reaches(cfg, body, cfg.exitIndex)).toBe(true);
+  });
+
+  it('empty body: ENTRY → EXIT', () => {
+    const cfg = java.cfgOf(`class C { void m() {} }`);
+    expect(cfg.blocks).toHaveLength(2);
+    expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+  });
+
+  it('constructor, compact constructor, and lambda are CFG-bearing functions', () => {
+    const cfgs = java.cfgsOf(
+      `class C { C(int a) { this.x = a; } void outer() { Runnable r = () -> { go(); }; r.run(); } }`,
+    );
+    // constructor C, outer, and the lambda = 3 CFGs.
+    expect(cfgs.length).toBeGreaterThanOrEqual(3);
+    for (const cfg of cfgs) expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+  });
+
+  it('record compact constructor is CFG-bearing', () => {
+    const cfgs = java.cfgsOf(`record R(int a) { R { if (a < 0) throw new RuntimeException(); } }`);
+    expect(cfgs.length).toBeGreaterThanOrEqual(1);
+    for (const cfg of cfgs) expect(reachable(cfg, cfg.exitIndex)).toBe(true);
+  });
+
+  it('single-expression lambda: one block returns its value', () => {
+    const cfgs = java.cfgsOf(
+      `class C { void m() { java.util.function.Function<Integer,Integer> f = z -> z * 2; f.apply(1); } }`,
+    );
+    // The lambda's OWN cfg has a single body block whose text IS exactly the
+    // expression (the enclosing method's block contains the whole lambda source).
+    const lambda = cfgs.find((c) => c.blocks.some((b) => b.text === 'z * 2'));
+    expect(lambda).toBeDefined();
+    const body = lambda!.blocks.find((b) => b.text === 'z * 2')!.index;
+    expect(lambda!.edges).toContainEqual({ from: body, to: lambda!.exitIndex, kind: 'return' });
+  });
+
+  it('abstract method (no body) → graceful undefined, no throw', () => {
+    const root = java.parse(`abstract class C { abstract void m(); }`);
+    const fns = java.collectFunctions(root);
+    for (const fn of fns) {
+      expect(() => createJavaCfgVisitor().buildFunctionCfg(fn, 'f.java')).not.toThrow();
+    }
+  });
+});
+
+describe('Java CfgVisitor — branching', () => {
+  it('if/else: cond-true to then, cond-false to else, both reach the join', () => {
+    const cfg = java.cfgOf(wrap(`if (x > 0) { a(); } else { b(); } c();`));
+    const kinds = edgeKinds(cfg);
+    expect(kinds.has('cond-true')).toBe(true);
+    expect(kinds.has('cond-false')).toBe(true);
+    const join = block(cfg, 'c();');
+    expect(reaches(cfg, block(cfg, 'a();'), join)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'b();'), join)).toBe(true);
+  });
+
+  it('else if chains through the nested alternative (no else_clause wrapper)', () => {
+    const cfg = java.cfgOf(
+      `class C { void m(int x) { if (x > 0) { a(); } else if (x < 0) { b(); } else { c(); } } }`,
+    );
+    expect(reaches(cfg, block(cfg, 'a();'), cfg.exitIndex)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'b();'), cfg.exitIndex)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'c();'), cfg.exitIndex)).toBe(true);
+  });
+});
+
+describe('Java CfgVisitor — loops', () => {
+  it('while loop: header + back-edge + exit', () => {
+    const cfg = java.cfgOf(`class C { void m(int x) { while (x > 0) { step(); } done(); } }`);
+    const header = block(cfg, 'x > 0');
+    const body = block(cfg, 'step();');
+    expect(cfg.edges).toContainEqual({ from: body, to: header, kind: 'loop-back' });
+    expect(edgeKinds(cfg).has('cond-true')).toBe(true);
+    expect(reaches(cfg, header, block(cfg, 'done();'))).toBe(true);
+  });
+
+  it('do-while runs the body BEFORE testing, then loops back from the bottom', () => {
+    const cfg = java.cfgOf(`class C { void m(int x) { do { step(); } while (x > 0); done(); } }`);
+    const body = block(cfg, 'step();');
+    const cond = block(cfg, 'x > 0');
+    expect(reaches(cfg, cfg.entryIndex, body)).toBe(true); // body runs first
+    expect(reaches(cfg, body, cond)).toBe(true);
+    expect(cfg.edges).toContainEqual({ from: cond, to: body, kind: 'loop-back' });
+    expect(reaches(cfg, cond, block(cfg, 'done();'))).toBe(true);
+  });
+
+  it('classic for: init once, condition header, back-edge through update', () => {
+    const cfg = java.cfgOf(
+      `class C { void m(int n) { for (int i = 0; i < n; i++) { step(); } done(); } }`,
+    );
+    const init = block(cfg, 'int i = 0');
+    const header = block(cfg, 'i < n');
+    const incr = block(cfg, 'i++');
+    const body = block(cfg, 'step();');
+    expect(cfg.edges).toContainEqual({ from: cfg.entryIndex, to: init, kind: 'seq' });
+    expect(reaches(cfg, body, incr)).toBe(true);
+    expect(cfg.edges).toContainEqual({ from: incr, to: header, kind: 'loop-back' });
+    expect(reaches(cfg, header, block(cfg, 'done();'))).toBe(true);
+  });
+
+  it('enhanced for (for-each): header + body + loop-back + exit; loop var is a def', () => {
+    const cfg = java.cfgOf(`class C { void m(int[] xs) { for (int v : xs) { use(v); } done(); } }`);
+    const body = block(cfg, 'use(v);');
+    expect(edgeKinds(cfg).has('cond-true')).toBe(true);
+    expect(edgeKinds(cfg).has('loop-back')).toBe(true);
+    const header = cfg.edges.find((e) => e.kind === 'loop-back' && e.from === body)?.to;
+    expect(header).toBeDefined();
+    expect(reaches(cfg, header!, block(cfg, 'done();'))).toBe(true);
+    const v = bindingIdx(cfg, 'v');
+    expect(hasDef(cfg, v)).toBe(true);
+  });
+
+  it('while (true) {} keeps EXIT reverse-reachable AND emits CDG > 0', () => {
+    // The inner `if` is a real control point; assert through the production
+    // post-dom/CDG passes (matching go/python/ruby/rust/vue) — CDG is only
+    // computed when EXIT stays reverse-reachable, so a non-empty CDG proves the
+    // structural exit-escape edge keeps the function CDG-bearing.
+    const cfg = java.cfgOf(`class C { void m(boolean x) { while (true) { if (x) { g(); } } } }`);
+    expect(edgeKinds(cfg).has('cond-false')).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+    expect(computeControlDependence(cfg).edges.length).toBeGreaterThan(0);
+  });
+
+  it('for (;;) {} keeps EXIT reverse-reachable AND emits CDG > 0', () => {
+    const cfg = java.cfgOf(`class C { void m(boolean x) { for (;;) { if (x) { g(); } } } }`);
+    expect(edgeKinds(cfg).has('cond-false')).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+    expect(computeControlDependence(cfg).edges.length).toBeGreaterThan(0);
+  });
+});
+
+describe('Java CfgVisitor — labeled break/continue', () => {
+  it('break outer; from a nested loop targets the labeled (outer) frame', () => {
+    const cfg = java.cfgOf(`class C { void m() {
+      outer:
+      for (int i = 0; i < 3; i++) {
+        for (int j = 0; j < 3; j++) {
+          if (hit()) break outer;
+          inner();
+        }
+        afterInner();
+      }
+      done();
+    } }`);
+    expect(edgeKinds(cfg).has('break')).toBe(true);
+    const brk = block(cfg, 'break outer;');
+    // The labeled break skips past BOTH loops to the post-outer-loop continuation
+    // (done()), not just the inner loop's exit (afterInner()).
+    expect(reaches(cfg, brk, block(cfg, 'done();'))).toBe(true);
+    // It must NOT route back into the outer loop body's afterInner().
+    expect(reaches(cfg, brk, block(cfg, 'afterInner();'))).toBe(false);
+  });
+
+  it('continue outer; from a nested loop continues the labeled (outer) loop', () => {
+    const cfg = java.cfgOf(`class C { void m() {
+      outer:
+      for (int i = 0; i < 3; i++) {
+        for (int j = 0; j < 3; j++) {
+          if (skip()) continue outer;
+          inner();
+        }
+      }
+      done();
+    } }`);
+    expect(edgeKinds(cfg).has('continue')).toBe(true);
+    expect(reaches(cfg, block(cfg, 'continue outer;'), block(cfg, 'i < 3'))).toBe(true);
+  });
+
+  it('unlabeled break does NOT match a labeled BLOCK frame', () => {
+    // `blk:` labels a plain block; an UNLABELED break here is a compile error in
+    // real Java, but the CFG must still route it to EXIT (no labeled-block match),
+    // and a labeled `break blk;` must reach the post-block join.
+    const cfg = java.cfgOf(`class C { void m() {
+      blk: {
+        if (cond()) break blk;
+        work();
+      }
+      done();
+    } }`);
+    const brk = block(cfg, 'break blk;');
+    // labeled break reaches the join after the labeled block (done()).
+    expect(reaches(cfg, brk, block(cfg, 'done();'))).toBe(true);
+    // work() after the break is still reachable (false arm of the if).
+    expect(reachable(cfg, block(cfg, 'work();'))).toBe(true);
+  });
+});
+
+describe('Java CfgVisitor — switch', () => {
+  it('classic colon switch: break-terminated case rejoins, fallthrough on break-less', () => {
+    const cfg = java.cfgOf(`class C { void m(int x) {
+      switch (x) {
+        case 1: one(); break;
+        case 2: two(); break;
+        default: other();
+      }
+      after();
+    } }`);
+    expect(edgeKinds(cfg).has('switch-case')).toBe(true);
+    expect(reaches(cfg, block(cfg, 'one();'), block(cfg, 'after();'))).toBe(true);
+    expect(reaches(cfg, block(cfg, 'two();'), block(cfg, 'after();'))).toBe(true);
+    // break-terminated case 1 does not fall into case 2.
+    expect(reaches(cfg, block(cfg, 'one();'), block(cfg, 'two();'))).toBe(false);
+  });
+
+  it('empty colon case falls through to the next case (fallthrough edge)', () => {
+    const cfg = java.cfgOf(`class C { void m(int x) {
+      switch (x) { case 1: case 2: shared(); break; default: d(); }
+      after();
+    } }`);
+    expect(reaches(cfg, block(cfg, 'shared();'), block(cfg, 'after();'))).toBe(true);
+    expect(edgeKinds(cfg).has('switch-case')).toBe(true);
+    // a break-less default flows to after().
+    expect(reaches(cfg, block(cfg, 'd();'), block(cfg, 'after();'))).toBe(true);
+  });
+
+  it('a non-break case FALLS THROUGH to the next case (classic semantics)', () => {
+    const cfg = java.cfgOf(`class C { void m(int x) {
+      switch (x) { case 1: one(); case 2: two(); break; default: d(); }
+      after();
+    } }`);
+    // case 1 has no break → it falls into case 2's body.
+    expect(reaches(cfg, block(cfg, 'one();'), block(cfg, 'two();'))).toBe(true);
+    expect(edgeKinds(cfg).has('fallthrough')).toBe(true);
+  });
+
+  it('arrow switch: each rule rejoins after the switch, no fallthrough', () => {
+    const cfg = java.cfgOf(`class C { void m(int x) {
+      switch (x) {
+        case 1 -> a();
+        case 2, 3 -> b();
+        default -> c();
+      }
+      after();
+    } }`);
+    expect(edgeKinds(cfg).has('switch-case')).toBe(true);
+    expect(reaches(cfg, block(cfg, 'a();'), block(cfg, 'after();'))).toBe(true);
+    expect(reaches(cfg, block(cfg, 'b();'), block(cfg, 'after();'))).toBe(true);
+    // arrow rule a() does NOT fall into b().
+    expect(reaches(cfg, block(cfg, 'a();'), block(cfg, 'b();'))).toBe(false);
+    expect(edgeKinds(cfg).has('fallthrough')).toBe(false);
+  });
+
+  it('switch case-test is recorded as a may-def/use on the dispatch block', () => {
+    const cfg = java.cfgOf(`class C { void m(int x, int k) {
+      switch (x) { case 1: a(); break; default: b(); }
+    } }`);
+    // The dispatch block (switch value `x`) uses x; the case-test constants carry
+    // no bindings, but a value-bearing dispatch records the discriminant use.
+    const x = bindingIdx(cfg, 'x');
+    expect(hasUse(cfg, x)).toBe(true);
+  });
+
+  it('switch EXPRESSION value with yield stays inline; method has a single-exit CFG', () => {
+    const cfg = java.cfgOf(`class C { int m(int x) {
+      int r = switch (x) { case 1 -> 10; default -> { yield 20; } };
+      return r;
+    } }`);
+    expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+    expect(edgeKinds(cfg).has('return')).toBe(true);
+  });
+
+  it('statement switch with a yield arm builds a dispatch with a yield block', () => {
+    const cfg = java.cfgOf(`class C { int m(int x) {
+      switch (x) {
+        case 1: yield 10;
+        default: yield 20;
+      }
+    } }`);
+    // statement-position switch breaks a block → switch-case dispatch edges.
+    expect(edgeKinds(cfg).has('switch-case')).toBe(true);
+  });
+});
+
+describe('Java CfgVisitor — try / catch / finally / try-with-resources', () => {
+  it('try/catch: a throw edge runs from each protected block to the handler', () => {
+    const cfg = java.cfgOf(`class C { void m() {
+      try { risky(); deeper(); } catch (java.lang.Exception e) { handle(e); }
+      after();
+    } }`);
+    expect(edgeKinds(cfg).has('throw')).toBe(true);
+    const handler = block(cfg, 'handle(e);');
+    expect(reaches(cfg, block(cfg, 'risky();'), handler)).toBe(true);
+    expect(reachable(cfg, block(cfg, 'after();'))).toBe(true);
+  });
+
+  it('finally runs on normal completion of the try', () => {
+    const cfg = java.cfgOf(`class C { void m() {
+      try { work(); } finally { cleanup(); }
+      after();
+    } }`);
+    const body = block(cfg, 'work();');
+    const fin = block(cfg, 'cleanup();');
+    expect(reaches(cfg, body, fin)).toBe(true);
+    expect(reaches(cfg, fin, block(cfg, 'after();'))).toBe(true);
+  });
+
+  it('return crossing a finally emits a finally-return completion edge', () => {
+    const cfg = java.cfgOf(`class C { int m() {
+      try { return compute(); } finally { cleanup(); }
+    } }`);
+    expect(edgeKinds(cfg).has('finally-return')).toBe(true);
+  });
+
+  it('break crossing a finally emits a finally-break completion edge', () => {
+    const cfg = java.cfgOf(`class C { void m(int n) {
+      for (int i = 0; i < n; i++) {
+        try { if (done()) break; } finally { tick(); }
+      }
+      after();
+    } }`);
+    expect(edgeKinds(cfg).has('finally-break')).toBe(true);
+  });
+
+  it('try-with-resources closes resources on the NORMAL exit path', () => {
+    const cfg = java.cfgOf(`class C { void m() {
+      try (var r = open()) { read(r); }
+      after();
+    } }`);
+    const body = block(cfg, 'read(r);');
+    const close = block(cfg, 'close');
+    // body → close → after() (normal completion threads through the close).
+    expect(reaches(cfg, body, close)).toBe(true);
+    expect(reaches(cfg, close, block(cfg, 'after();'))).toBe(true);
+  });
+
+  it('try-with-resources closes resources on the EXCEPTION path too', () => {
+    const cfg = java.cfgOf(`class C { void m() {
+      try (var r = open()) { risky(r); }
+    } }`);
+    const body = block(cfg, 'risky(r);');
+    const close = block(cfg, 'close');
+    expect(edgeKinds(cfg).has('throw')).toBe(true);
+    expect(reaches(cfg, body, close)).toBe(true);
+  });
+
+  it('a return inside try-with-resources crosses the close (finally-return)', () => {
+    const cfg = java.cfgOf(`class C { int m() {
+      try (var r = open()) { return read(r); }
+    } }`);
+    expect(edgeKinds(cfg).has('finally-return')).toBe(true);
+  });
+
+  it('multi-catch (A | B) binds the exception name as a def in the handler', () => {
+    const cfg = java.cfgOf(`class C { void m() {
+      try { x(); } catch (java.io.IOException | java.lang.RuntimeException e) { handle(e); }
+    } }`);
+    expect(edgeKinds(cfg).has('throw')).toBe(true);
+    const e = bindingIdx(cfg, 'e');
+    expect(hasDef(cfg, e)).toBe(true);
+  });
+});
+
+describe('Java CfgVisitor — synchronized (deterministic finalizer)', () => {
+  it('synchronized body runs then releases the monitor on the normal path', () => {
+    const cfg = java.cfgOf(`class C { void m(Object lock) {
+      synchronized (lock) { touch(); }
+      after();
+    } }`);
+    const body = block(cfg, 'touch();');
+    const release = block(cfg, 'release');
+    expect(reaches(cfg, body, release)).toBe(true);
+    expect(reaches(cfg, release, block(cfg, 'after();'))).toBe(true);
+  });
+
+  it('synchronized releases the monitor on the exception path (throw → release)', () => {
+    const cfg = java.cfgOf(`class C { void m(Object lock) { synchronized (lock) { risky(); } } }`);
+    expect(edgeKinds(cfg).has('throw')).toBe(true);
+    const body = block(cfg, 'risky();');
+    const release = block(cfg, 'release');
+    expect(reaches(cfg, body, release)).toBe(true);
+  });
+
+  it('a return inside synchronized crosses the release (finally-return)', () => {
+    const cfg = java.cfgOf(
+      `class C { int m(Object lock) { synchronized (lock) { return get(); } } }`,
+    );
+    expect(edgeKinds(cfg).has('finally-return')).toBe(true);
+  });
+});
+
+describe('Java CfgVisitor — def/use harvest', () => {
+  it('local declaration: int x = a + b; use(x); → def of x + use of x', () => {
+    const cfg = java.cfgOf(`class C { void m(int a, int b) { int x = a + b; use(x); } }`);
+    const x = bindingIdx(cfg, 'x');
+    expect(hasDef(cfg, x)).toBe(true);
+    expect(hasUse(cfg, x)).toBe(true);
+  });
+
+  it('bare uninitialized local is NOT a def until assigned', () => {
+    const cfg = java.cfgOf(`class C { void m() { int x; x = 5; use(x); } }`);
+    const x = bindingIdx(cfg, 'x');
+    // the assignment defines x; the declaration alone does not.
+    expect(hasDef(cfg, x)).toBe(true);
+    expect(hasUse(cfg, x)).toBe(true);
+  });
+
+  it('a && (x = g()) records x as a may-def inside the short-circuit', () => {
+    const cfg = java.cfgOf(
+      `class C { void m(boolean a) { int x = 0; if (a && (x = g()) > 0) h(x); } }`,
+    );
+    const x = bindingIdx(cfg, 'x');
+    expect(hasMayDef(cfg, x)).toBe(true);
+  });
+
+  it('ternary arms record their writes as may-defs', () => {
+    const cfg = java.cfgOf(
+      `class C { void m(int a) { int x = 0; int y = a > 0 ? (x = 1) : (x = 2); use(y); } }`,
+    );
+    const x = bindingIdx(cfg, 'x');
+    expect(hasMayDef(cfg, x)).toBe(true);
+  });
+
+  it('compound assignment reads AND writes the lvalue', () => {
+    const cfg = java.cfgOf(`class C { void m() { int z = 1; z += 3; } }`);
+    const z = bindingIdx(cfg, 'z');
+    expect(hasDef(cfg, z)).toBe(true);
+    expect(hasUse(cfg, z)).toBe(true);
+  });
+
+  it('field/array writes are NOT scalar defs (their roots are uses)', () => {
+    const cfg = java.cfgOf(`class C { void m(int[] a) { a[0] = 1; this.f = 2; } }`);
+    // `a` is a parameter; the array write `a[0] = 1` reads a (subscript root),
+    // it does not define `a`. No `this.f` scalar binding is created.
+    const a = bindingIdx(cfg, 'a');
+    expect(hasUse(cfg, a)).toBe(true);
+  });
+});
+
+describe('Java CfgVisitor — functionStartColumn', () => {
+  it('two same-line methods get distinct functionStartColumn', () => {
+    const cfgs = java.cfgsOf(`class C { int a() { return 1; } int b() { return 2; } }`);
+    expect(cfgs).toHaveLength(2);
+    expect(cfgs[0].functionStartLine).toBe(cfgs[1].functionStartLine); // same line
+    expect(cfgs[0].functionStartColumn).not.toBe(cfgs[1].functionStartColumn); // distinct column
+  });
+});
+
+describe('Java CfgVisitor — does not throw on exotic shapes', () => {
+  it('nested lambdas / anonymous-class methods each build their own CFGs', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    try {
+      const cfgs = java.cfgsOf(`class C { void m() {
+        Runnable r = () -> { if (cond()) { go(); } };
+        java.util.function.Function<Integer,Integer> f = z -> z + 1;
+        r.run();
+      } }`);
+      expect(cfgs.length).toBeGreaterThanOrEqual(3); // m, lambda block, lambda expr
+      for (const cfg of cfgs) expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+    } finally {
+      warn.mockRestore();
+    }
+  });
+});
+
+// U6 — call-site `sites[]` taint substrate. INERT BY DESIGN: no Java taint model
+// is registered, so these sites produce zero TAINTED edges; they only give the
+// deferred per-language source/sink model something to match against.
+describe('Java CfgVisitor — call-site sites[] substrate', () => {
+  const cfgOf = (body: string): FunctionCfg =>
+    java.cfgOf(`class C { void f(int cmd, int x, int a) { ${body} } }`);
+
+  it('a bare method call records a `call` site with callee + arg occurrence', () => {
+    const cfg = cfgOf(`exec(cmd);`);
+    const site = allSites(cfg).find((s) => s.kind === 'call' && s.callee === 'exec');
+    expect(site).toBeDefined();
+    expect(site?.args?.[0]).toContainEqual(bindingIdx(cfg, 'cmd'));
+  });
+
+  it('a receiver call (`db.query(x)`) records the receiver binding + dotted callee', () => {
+    // Java carries the method NAME on the `name` field and the receiver on the
+    // sibling `object` field — the substrate normalizes both to receiver+callee.
+    const cfg = cfgOf(`db.query(x);`);
+    const site = allSites(cfg).find((s) => s.kind === 'call' && s.callee === 'db.query');
+    expect(site).toBeDefined();
+    expect(site?.receiver).toBe(bindingIdx(cfg, 'db'));
+    expect(site?.args?.[0]).toContainEqual(bindingIdx(cfg, 'x'));
+  });
+
+  it('`new Foo(x)` records a `new` site with the type as callee', () => {
+    const cfg = cfgOf(`Object p = new Foo(x);`);
+    const site = allSites(cfg).find((s) => s.kind === 'new');
+    expect(site?.callee).toBe('Foo');
+    expect(site?.args?.[0]).toContainEqual(bindingIdx(cfg, 'x'));
+    expect(site?.resultDefs).toContain(bindingIdx(cfg, 'p'));
+  });
+
+  it('a nested call via-tags the inner site (sanitizer substrate)', () => {
+    const cfg = cfgOf(`exec(escape(x));`);
+    const sites = allSites(cfg);
+    const exec = sites.findIndex((s) => s.callee === 'exec');
+    const escape = sites.findIndex((s) => s.callee === 'escape');
+    expect(exec).toBeGreaterThanOrEqual(0);
+    expect(escape).toBeGreaterThanOrEqual(0);
+    const x = bindingIdx(cfg, 'x');
+    expect(sites[escape].args?.[0]).toContainEqual(x);
+    expect(sites[exec].args?.[0]).toContainEqual([x, escape]);
+  });
+
+  it('a CFG-only function (no calls) emits NO sites key (omit-when-empty)', () => {
+    const cfg = java.cfgOf(`class C { void f(int a, int b) { int x = a + b; } }`);
+    expect(hasAnySites(cfg)).toBe(false);
+  });
+});
diff --git a/gitnexus/test/unit/cfg/kotlin-visitor.test.ts b/gitnexus/test/unit/cfg/kotlin-visitor.test.ts
new file mode 100644
index 000000000..431565268
--- /dev/null
+++ b/gitnexus/test/unit/cfg/kotlin-visitor.test.ts
@@ -0,0 +1,426 @@
+import { describe, it, expect } from 'vitest';
+import { requireVendoredGrammar } from '../../../src/core/tree-sitter/vendored-grammars.js';
+import { createKotlinCfgVisitor } from '../../../src/core/ingestion/cfg/visitors/kotlin.js';
+import type { FunctionCfg } from '../../../src/core/ingestion/cfg/types.js';
+import {
+  makeCfgHarness,
+  type CfgHarness,
+  block,
+  edgeKinds,
+  reaches,
+  reachable,
+  bindingIdx,
+} from '../../helpers/cfg-harness.js';
+import { isExitReachableFromAllBlocks } from '../../../src/core/ingestion/cfg/post-dominators.js';
+import { computeControlDependence } from '../../../src/core/ingestion/cfg/control-dependence.js';
+
+// The Kotlin CfgVisitor, one hazard per test (real-parser regression, NOT
+// snapshot-pinning). Kotlin's grammar is VENDORED (not an npm package): the
+// grammar loads from vendor/ via `requireVendoredGrammar('tree-sitter-kotlin')`,
+// exactly like the Swift test loads the vendored tree-sitter-swift. Each fixture's
+// distinctive statement text (step(), done(), handle(e), …) lets us locate the
+// block for a region by text and assert the control-flow topology around it.
+
+const kotlinGrammar = requireVendoredGrammar('tree-sitter-kotlin') as Parameters<
+  typeof makeCfgHarness
+>[0];
+
+const kotlin: CfgHarness = makeCfgHarness(kotlinGrammar, createKotlinCfgVisitor(), 'fixture.kt');
+
+const definesBinding = (cfg: FunctionCfg, idx: number): boolean =>
+  cfg.blocks.some((bl) => bl.statements?.some((s) => s.defs.includes(idx)));
+const usesBinding = (cfg: FunctionCfg, idx: number): boolean =>
+  cfg.blocks.some((bl) => bl.statements?.some((s) => s.uses.includes(idx)));
+
+describe('Kotlin CfgVisitor — structure', () => {
+  it('straight-line body: ENTRY → block → EXIT (seq)', () => {
+    const cfg = kotlin.cfgOf(`fun f() { a(); b(); c() }`);
+    expect(cfg.blocks.filter((b) => b.kind === 'normal')).toHaveLength(1);
+    const body = block(cfg, 'a()');
+    expect(cfg.edges).toContainEqual({ from: cfg.entryIndex, to: body, kind: 'seq' });
+    expect(reaches(cfg, body, cfg.exitIndex)).toBe(true);
+  });
+
+  it('empty body: ENTRY → EXIT', () => {
+    const cfg = kotlin.cfgOf(`fun f() {}`);
+    expect(cfg.blocks).toHaveLength(2);
+    expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+  });
+
+  it('expression-body function: ENTRY → block → EXIT', () => {
+    const cfg = kotlin.cfgOf(`fun f(x: Int) = x + 1`);
+    expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+    expect(edgeKinds(cfg).has('return')).toBe(true);
+    // The parameter is bound and used.
+    expect(definesBinding(cfg, bindingIdx(cfg, 'x'))).toBe(true);
+  });
+
+  it('an unmodeled shape produces a graceful partial CFG (never throws)', () => {
+    // An abstract / interface method (no body) — buildFunctionCfg must return
+    // undefined rather than throw; a real function still builds.
+    const root = kotlin.parse(`interface P { fun f() }`);
+    const fns = kotlin.collectFunctions(root);
+    for (const fn of fns) {
+      expect(() => createKotlinCfgVisitor().buildFunctionCfg(fn, 'p.kt')).not.toThrow();
+    }
+    const cfg = kotlin.cfgOf(`fun g() { x() }`);
+    expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+  });
+
+  it('a class method is a CFG-bearing function', () => {
+    const cfg = kotlin.cfgOf(`class C { fun m(a: Int) { g(a) } }`);
+    expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+    expect(definesBinding(cfg, bindingIdx(cfg, 'a'))).toBe(true);
+  });
+});
+
+describe('Kotlin CfgVisitor — branching (if/else)', () => {
+  it('if/else: cond-true to then, cond-false to else, both reach the join', () => {
+    const cfg = kotlin.cfgOf(`fun f(x: Int) { if (x > 0) { a() } else { b() }; c() }`);
+    const kinds = edgeKinds(cfg);
+    expect(kinds.has('cond-true')).toBe(true);
+    expect(kinds.has('cond-false')).toBe(true);
+    const join = block(cfg, 'c()');
+    expect(reaches(cfg, block(cfg, 'a()'), join)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'b()'), join)).toBe(true);
+  });
+
+  it('else-if chain branches each condition', () => {
+    const cfg = kotlin.cfgOf(
+      `fun f(x: Int) { if (x == 1) { a() } else if (x == 2) { b() } else { c() }; d() }`,
+    );
+    const join = block(cfg, 'd()');
+    expect(reaches(cfg, block(cfg, 'a()'), join)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'b()'), join)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'c()'), join)).toBe(true);
+  });
+
+  it('if without braces (bare control_structure_body) still branches', () => {
+    const cfg = kotlin.cfgOf(`fun f(x: Int) { if (x > 0) a() else b(); c() }`);
+    expect(edgeKinds(cfg).has('cond-true')).toBe(true);
+    expect(edgeKinds(cfg).has('cond-false')).toBe(true);
+    expect(reaches(cfg, block(cfg, 'a()'), block(cfg, 'c()'))).toBe(true);
+  });
+
+  it('an if as a binding VALUE is modeled as a branch with literal arms (#2205)', () => {
+    const cfg = kotlin.cfgOf(`fun f(x: Int) { val y = if (x > 0) 1 else 2; use(y) }`);
+    // value-position `if` (with else) IS modeled now: both arms branch, y binds
+    // at the rejoin (previously this whole decl coalesced into one block).
+    expect(edgeKinds(cfg).has('cond-true')).toBe(true);
+    expect(edgeKinds(cfg).has('cond-false')).toBe(true);
+    expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+    expect(definesBinding(cfg, bindingIdx(cfg, 'y'))).toBe(true);
+  });
+});
+
+describe('Kotlin CfgVisitor — when (no fallthrough)', () => {
+  it('when with subject: each arm dispatches and rejoins after (no fallthrough)', () => {
+    const cfg = kotlin.cfgOf(`fun f(x: Int) {
+      when (x) {
+        1 -> one()
+        2 -> two()
+        else -> other()
+      }
+      after()
+    }`);
+    expect(edgeKinds(cfg).has('switch-case')).toBe(true);
+    // arm 1 does NOT fall into arm 2 (Kotlin when has no fallthrough).
+    expect(reaches(cfg, block(cfg, 'one()'), block(cfg, 'two()'))).toBe(false);
+    // every arm reaches the post-when continuation.
+    expect(reaches(cfg, block(cfg, 'one()'), block(cfg, 'after()'))).toBe(true);
+    expect(reaches(cfg, block(cfg, 'two()'), block(cfg, 'after()'))).toBe(true);
+    expect(reaches(cfg, block(cfg, 'other()'), block(cfg, 'after()'))).toBe(true);
+  });
+
+  it('when WITHOUT subject (guard form) dispatches each condition', () => {
+    const cfg = kotlin.cfgOf(`fun f(x: Int) {
+      when {
+        x > 0 -> pos()
+        else -> nonpos()
+      }
+      after()
+    }`);
+    expect(edgeKinds(cfg).has('switch-case')).toBe(true);
+    expect(reachable(cfg, block(cfg, 'pos()'))).toBe(true);
+    expect(reachable(cfg, block(cfg, 'nonpos()'))).toBe(true);
+    expect(reaches(cfg, block(cfg, 'pos()'), block(cfg, 'after()'))).toBe(true);
+  });
+
+  it('a when with NO else lets the no-match path fall to the join', () => {
+    const cfg = kotlin.cfgOf(`fun f(x: Int) { when (x) { 1 -> a() }; after() }`);
+    expect(edgeKinds(cfg).has('switch-case')).toBe(true);
+    // the dispatch can reach after() without entering arm 1 (no-match path).
+    expect(reachable(cfg, block(cfg, 'after()'))).toBe(true);
+  });
+
+  it('all-empty arms WITH else still dispatch (no orphaned join, EXIT reverse-reachable)', () => {
+    // `when(k){0->{};else->{}}`: every arm body is empty and the `else` suppresses
+    // the no-match edge — the dispatch must still reach the join, else EXIT is not
+    // reverse-reachable and the whole function's CDG is dropped (was a real bug).
+    const cfg = kotlin.cfgOf(`fun f(k: Int) { when (k) { 0 -> {}; else -> {} }; after() }`);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+    expect(reaches(cfg, cfg.entryIndex, block(cfg, 'after()'))).toBe(true);
+  });
+
+  it('all-empty arms in value position (val x = when) stay EXIT reverse-reachable', () => {
+    const cfg = kotlin.cfgOf(`fun f(k: Int) { val x = when (k) { 0 -> {}; else -> {} }; use(x) }`);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+  });
+});
+
+describe('Kotlin CfgVisitor — value-position branches (#2205)', () => {
+  it('val x = when (...) models the arms as control flow (CDG-bearing), binds x at the join', () => {
+    const cfg = kotlin.cfgOf(
+      `fun f(k: Int) { val x = when (k) { 0 -> a(); 1 -> b(); else -> c() }; use(x) }`,
+    );
+    // Arms are modeled (not collapsed into one straight-line block)…
+    expect(edgeKinds(cfg).has('switch-case')).toBe(true);
+    expect(block(cfg, 'a()')).toBeGreaterThanOrEqual(0);
+    expect(block(cfg, 'c()')).toBeGreaterThanOrEqual(0);
+    // …each arm is control-dependent on the dispatch…
+    expect(computeControlDependence(cfg).edges.length).toBeGreaterThan(0);
+    // …and x is defined at the rejoin and used downstream.
+    expect(definesBinding(cfg, bindingIdx(cfg, 'x'))).toBe(true);
+    expect(usesBinding(cfg, bindingIdx(cfg, 'x'))).toBe(true);
+  });
+
+  it('val r = if (c) ... else ... models both arms (cond-true/cond-false), binds r', () => {
+    const cfg = kotlin.cfgOf(`fun f(c: Boolean) { val r = if (c) x() else y(); use(r) }`);
+    expect(edgeKinds(cfg).has('cond-true')).toBe(true);
+    expect(edgeKinds(cfg).has('cond-false')).toBe(true);
+    expect(computeControlDependence(cfg).edges.length).toBeGreaterThan(0);
+    expect(definesBinding(cfg, bindingIdx(cfg, 'r'))).toBe(true);
+  });
+
+  it('return when (...) models the arms; each arm returns', () => {
+    const cfg = kotlin.cfgOf(`fun f(k: Int): Int { return when (k) { 0 -> a(); else -> b() } }`);
+    expect(edgeKinds(cfg).has('switch-case')).toBe(true);
+    expect(edgeKinds(cfg).has('return')).toBe(true);
+    expect(computeControlDependence(cfg).edges.length).toBeGreaterThan(0);
+  });
+
+  it('expression-body fun f() = when (...) models the arms (CDG-bearing)', () => {
+    const cfg = kotlin.cfgOf(`fun f(k: Int): Int = when (k) { 0 -> a(); 1 -> b(); else -> c() }`);
+    expect(edgeKinds(cfg).has('switch-case')).toBe(true);
+    expect(edgeKinds(cfg).has('return')).toBe(true);
+    expect(computeControlDependence(cfg).edges.length).toBeGreaterThan(0);
+  });
+
+  it('argument-position when stays inline — val x = f(when (...)) is NOT split', () => {
+    // The DIRECT value is the call `f(...)`, not the nested `when`, so it is a
+    // single straight-line block (no switch-case from a top-level dispatch).
+    const cfg = kotlin.cfgOf(`fun g(k: Int) { val x = f(when (k) { 0 -> 1; else -> 2 }) }`);
+    expect(edgeKinds(cfg).has('switch-case')).toBe(false);
+  });
+
+  it('single-arm when in value position stays inline (no real control dependence)', () => {
+    const cfg = kotlin.cfgOf(`fun f(k: Int) { val x = when (k) { else -> a() }; use(x) }`);
+    expect(edgeKinds(cfg).has('switch-case')).toBe(false);
+  });
+});
+
+describe('Kotlin CfgVisitor — loops', () => {
+  it('for-in: header + body + loop-back + exit; binds the loop var', () => {
+    const cfg = kotlin.cfgOf(`fun f(xs: List<Int>) { for (x in xs) { step(x) }; done() }`);
+    const header = block(cfg, 'for (x in xs)');
+    const body = block(cfg, 'step(x)');
+    expect(cfg.edges).toContainEqual({ from: body, to: header, kind: 'loop-back' });
+    expect(edgeKinds(cfg).has('cond-true')).toBe(true);
+    expect(reaches(cfg, header, block(cfg, 'done()'))).toBe(true);
+    expect(definesBinding(cfg, bindingIdx(cfg, 'x'))).toBe(true);
+  });
+
+  it('while: header tests first, body loops back', () => {
+    const cfg = kotlin.cfgOf(`fun f() { while (cond()) { step() }; done() }`);
+    const header = block(cfg, 'while (cond())');
+    const body = block(cfg, 'step()');
+    expect(cfg.edges).toContainEqual({ from: body, to: header, kind: 'loop-back' });
+    expect(edgeKinds(cfg).has('cond-true')).toBe(true);
+    expect(reaches(cfg, header, block(cfg, 'done()'))).toBe(true);
+  });
+
+  it('do-while runs the body BEFORE testing, then loops back from the bottom', () => {
+    const cfg = kotlin.cfgOf(`fun f() { do { step() } while (cond()); done() }`);
+    const body = block(cfg, 'step()');
+    const cond = block(cfg, 'while (cond())');
+    expect(reaches(cfg, cfg.entryIndex, body)).toBe(true); // body runs first
+    expect(reaches(cfg, body, cond)).toBe(true); // condition tests at the bottom
+    expect(cfg.edges).toContainEqual({ from: cond, to: body, kind: 'loop-back' });
+    expect(reaches(cfg, cond, block(cfg, 'done()'))).toBe(true);
+  });
+
+  it('while (true) {} keeps EXIT reverse-reachable AND emits CDG > 0', () => {
+    // The inner `if` is a real control point; assert through the production
+    // post-dom/CDG passes (matching go/python/ruby/rust/vue) — CDG is only
+    // computed when EXIT stays reverse-reachable, so a non-empty CDG proves the
+    // structural exit-escape edge keeps the function CDG-bearing.
+    const cfg = kotlin.cfgOf(`fun f(x: Boolean) { while (true) { if (x) { g() } } }`);
+    expect(edgeKinds(cfg).has('cond-false')).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+    expect(computeControlDependence(cfg).edges.length).toBeGreaterThan(0);
+  });
+
+  it('do {} while (true) keeps EXIT reverse-reachable', () => {
+    const cfg = kotlin.cfgOf(`fun f() { do { work() } while (true) }`);
+    expect(edgeKinds(cfg).has('cond-false')).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+    expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+  });
+});
+
+describe('Kotlin CfgVisitor — try/catch/finally', () => {
+  it('try/catch/finally: a throw edge runs to the handler; finally completion edges', () => {
+    const cfg = kotlin.cfgOf(`fun f() {
+      try { risky() } catch (e: Exception) { handle(e) } finally { cleanup() }
+      after()
+    }`);
+    const kinds = edgeKinds(cfg);
+    expect(kinds.has('throw')).toBe(true);
+    const handler = block(cfg, 'handle(e)');
+    expect(reaches(cfg, block(cfg, 'risky()'), handler)).toBe(true);
+    // the finally runs on both normal and exception exit.
+    const fin = block(cfg, 'cleanup()');
+    expect(reaches(cfg, block(cfg, 'risky()'), fin)).toBe(true);
+    expect(reaches(cfg, handler, fin)).toBe(true);
+    // after() is still reachable (finally completion rejoins).
+    expect(reachable(cfg, block(cfg, 'after()'))).toBe(true);
+    // the catch binds the error `e`.
+    expect(definesBinding(cfg, bindingIdx(cfg, 'e'))).toBe(true);
+  });
+
+  it('a return inside a try threads through the finally (finally-return completion)', () => {
+    const cfg = kotlin.cfgOf(`fun f(): Int {
+      try { return compute() } finally { cleanup() }
+    }`);
+    const kinds = edgeKinds(cfg);
+    expect(kinds.has('return')).toBe(true);
+    expect(kinds.has('finally-return')).toBe(true);
+    const fin = block(cfg, 'cleanup()');
+    expect(reaches(cfg, fin, cfg.exitIndex)).toBe(true);
+  });
+
+  it('a throw with NO enclosing try/catch routes to EXIT and ends its block', () => {
+    const cfg = kotlin.cfgOf(`fun f(x: Boolean) { if (x) throw RuntimeException(); done() }`);
+    const thr = block(cfg, 'throw RuntimeException()');
+    expect(cfg.edges).toContainEqual({ from: thr, to: cfg.exitIndex, kind: 'throw' });
+    // throw terminates its block — control does not fall into done() from it.
+    expect(reaches(cfg, thr, block(cfg, 'done()'))).toBe(false);
+    expect(reachable(cfg, block(cfg, 'done()'))).toBe(true); // via the if false branch
+  });
+
+  it('empty try {} with catch + finally keeps the catch handler reachable (#2195)', () => {
+    // An empty try body still establishes a protected region — the catch (and
+    // its error binding) must not be orphaned/unreachable from ENTRY.
+    const cfg = kotlin.cfgOf(
+      `fun f() { try {} catch (e: Exception) { handle(e) } finally { cl() }; a() }`,
+    );
+    expect(reachable(cfg, block(cfg, 'handle(e)'))).toBe(true);
+    expect(reachable(cfg, block(cfg, 'cl()'))).toBe(true);
+    expect(reachable(cfg, block(cfg, 'a()'))).toBe(true);
+    expect(definesBinding(cfg, bindingIdx(cfg, 'e'))).toBe(true);
+  });
+});
+
+describe('Kotlin CfgVisitor — labeled break/continue', () => {
+  it('labeled break@outer escapes BOTH loops and reaches done()', () => {
+    const cfg = kotlin.cfgOf(`fun f(xs: List<Int>, ys: List<Int>) {
+      outer@ for (i in xs) {
+        for (j in ys) { break@outer }
+      }
+      done()
+    }`);
+    const brk = block(cfg, 'break@outer');
+    expect(edgeKinds(cfg).has('break')).toBe(true);
+    expect(reaches(cfg, brk, block(cfg, 'done()'))).toBe(true);
+  });
+
+  it('continue@loop targets the outer loop header', () => {
+    const cfg = kotlin.cfgOf(`fun f(xs: List<Int>, ys: List<Int>) {
+      loop@ for (i in xs) {
+        for (j in ys) { continue@loop }
+      }
+      done()
+    }`);
+    expect(edgeKinds(cfg).has('continue')).toBe(true);
+    const outer = block(cfg, 'for (i in xs)');
+    const cont = block(cfg, 'continue@loop');
+    expect(reaches(cfg, cont, outer)).toBe(true);
+  });
+});
+
+describe('Kotlin CfgVisitor — lambdas (own CFG)', () => {
+  it('a lambda is collected as its own CFG; return@label routes to the lambda EXIT', () => {
+    const cfgs = kotlin.cfgsOf(`fun f(xs: List<Int>) {
+      xs.forEach { x ->
+        if (x < 0) return@forEach
+        use(x)
+      }
+    }`);
+    // f and the lambda are both CFG-bearing.
+    expect(cfgs.length).toBeGreaterThanOrEqual(2);
+    for (const cfg of cfgs) expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+    // The lambda's CFG (the one containing return@forEach) keeps EXIT reachable.
+    const lambdaCfg = cfgs.find((c) => c.blocks.some((b) => b.text.includes('return@forEach')));
+    expect(lambdaCfg).toBeDefined();
+    const ret = lambdaCfg!.blocks.find((b) => b.text.includes('return@forEach'))!.index;
+    expect(reaches(lambdaCfg!, ret, lambdaCfg!.exitIndex)).toBe(true);
+  });
+});
+
+describe('Kotlin CfgVisitor — def/use harvest', () => {
+  it('val x = compute(); use(x) produces a def of x and a use in the consumer', () => {
+    const cfg = kotlin.cfgOf(`fun f() { val x = compute(); use(x) }`);
+    const x = bindingIdx(cfg, 'x');
+    expect(definesBinding(cfg, x)).toBe(true);
+    expect(usesBinding(cfg, x)).toBe(true);
+  });
+
+  it('destructuring `val (a, b) = p` defines both names', () => {
+    const cfg = kotlin.cfgOf(`fun f(p: Pair<Int, Int>) { val (a, b) = p; use(a); use(b) }`);
+    for (const name of ['a', 'b']) {
+      const idx = bindingIdx(cfg, name);
+      expect(definesBinding(cfg, idx)).toBe(true);
+    }
+  });
+
+  it('var reassignment defines the variable again', () => {
+    const cfg = kotlin.cfgOf(`fun f() { var y = 0; y = compute(); use(y) }`);
+    const y = bindingIdx(cfg, 'y');
+    expect(definesBinding(cfg, y)).toBe(true);
+    expect(usesBinding(cfg, y)).toBe(true);
+  });
+
+  it('compound assign `x += 1` defines AND uses x', () => {
+    const cfg = kotlin.cfgOf(`fun f() { var x = 0; x += step() }`);
+    const x = bindingIdx(cfg, 'x');
+    expect(definesBinding(cfg, x)).toBe(true);
+    expect(usesBinding(cfg, x)).toBe(true);
+  });
+
+  const defStmtCount = (cfg: FunctionCfg, idx: number): number =>
+    cfg.blocks.flatMap((bl) => bl.statements ?? []).filter((s) => s.defs.includes(idx)).length;
+
+  it('postfix `x++` defines AND uses the operand (#2195 P2)', () => {
+    const cfg = kotlin.cfgOf(`fun f() { var x = 0; x++ }`);
+    const x = bindingIdx(cfg, 'x');
+    // `var x = 0` defs x once; `x++` must def it AGAIN (the loop-counter
+    // reaching-def the bug dropped) — not record x as a use-only.
+    expect(defStmtCount(cfg, x)).toBe(2);
+    expect(usesBinding(cfg, x)).toBe(true);
+  });
+
+  it('prefix `--x` defines the operand too (#2195 P2)', () => {
+    const cfg = kotlin.cfgOf(`fun f() { var x = 0; --x }`);
+    const x = bindingIdx(cfg, 'x');
+    expect(defStmtCount(cfg, x)).toBe(2);
+  });
+});
+
+describe('Kotlin CfgVisitor — functionStartColumn', () => {
+  it('two same-line functions get distinct functionStartColumn', () => {
+    const cfgs = kotlin.cfgsOf(`fun a() { x() }; fun b() { y() }`);
+    expect(cfgs).toHaveLength(2);
+    expect(cfgs[0].functionStartLine).toBe(cfgs[1].functionStartLine); // same line
+    expect(cfgs[0].functionStartColumn).not.toBe(cfgs[1].functionStartColumn); // distinct column
+  });
+});
diff --git a/gitnexus/test/unit/cfg/php-visitor.test.ts b/gitnexus/test/unit/cfg/php-visitor.test.ts
new file mode 100644
index 000000000..8afae6a82
--- /dev/null
+++ b/gitnexus/test/unit/cfg/php-visitor.test.ts
@@ -0,0 +1,387 @@
+import { describe, it, expect } from 'vitest';
+import { createRequire } from 'node:module';
+import { createPhpCfgVisitor } from '../../../src/core/ingestion/cfg/visitors/php.js';
+import type { FunctionCfg } from '../../../src/core/ingestion/cfg/types.js';
+import {
+  makeCfgHarness,
+  type CfgHarness,
+  block,
+  edgeKinds,
+  reaches,
+  reachable,
+  bindingIdx,
+  allSites,
+} from '../../helpers/cfg-harness.js';
+import { isExitReachableFromAllBlocks } from '../../../src/core/ingestion/cfg/post-dominators.js';
+import { computeControlDependence } from '../../../src/core/ingestion/cfg/control-dependence.js';
+
+// The PHP CfgVisitor, one hazard per test (real-parser regression, NOT
+// snapshot-pinning). Each fixture's distinctive statement text (a(), step(),
+// handle($e), …) lets us locate the block for a region by text and assert the
+// control-flow topology around it. tree-sitter-php's runtime grammar is the
+// `php_only` export (matching parser-loader.ts).
+
+const phpGrammar = (createRequire(import.meta.url)('tree-sitter-php') as { php_only: unknown })
+  .php_only as Parameters<typeof makeCfgHarness>[0];
+
+const php: CfgHarness = makeCfgHarness(phpGrammar, createPhpCfgVisitor(), 'fixture.php');
+
+const wrap = (body: string): string => `<?php function f($x) { ${body} }`;
+
+const hasDef = (cfg: FunctionCfg, idx: number): boolean =>
+  cfg.blocks.some((bl) => bl.statements?.some((s) => s.defs.includes(idx)));
+const hasUse = (cfg: FunctionCfg, idx: number): boolean =>
+  cfg.blocks.some((bl) => bl.statements?.some((s) => s.uses.includes(idx)));
+const hasMayDef = (cfg: FunctionCfg, idx: number): boolean =>
+  cfg.blocks.some((bl) => bl.statements?.some((s) => (s.mayDefs ?? []).includes(idx)));
+
+describe('PHP CfgVisitor — structure', () => {
+  it('straight-line body: ENTRY → block → EXIT (seq)', () => {
+    const cfg = php.cfgOf(`<?php function f() { a(); b(); c(); }`);
+    expect(cfg.blocks.filter((b) => b.kind === 'normal')).toHaveLength(1);
+    const body = block(cfg, 'a();');
+    expect(cfg.edges).toContainEqual({ from: cfg.entryIndex, to: body, kind: 'seq' });
+    expect(reaches(cfg, body, cfg.exitIndex)).toBe(true);
+  });
+
+  it('empty body: ENTRY → EXIT', () => {
+    const cfg = php.cfgOf(`<?php function f() {}`);
+    expect(cfg.blocks).toHaveLength(2);
+    expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+  });
+
+  it('method, anonymous function, and arrow function are CFG-bearing', () => {
+    const cfgs = php.cfgsOf(
+      `<?php class C { public function m($a) { return $a; } }
+       $clo = function ($b) { return $b; };
+       $arr = fn ($c) => $c * 2;`,
+    );
+    // method m, the closure, and the arrow = 3 CFGs.
+    expect(cfgs.length).toBeGreaterThanOrEqual(3);
+    for (const cfg of cfgs) expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+  });
+
+  it('arrow function: one block returns its expression value', () => {
+    const cfgs = php.cfgsOf(`<?php $g = fn ($z) => $z * 2;`);
+    const arrow = cfgs.find((c) => c.blocks.some((b) => b.text === '$z * 2'));
+    expect(arrow).toBeDefined();
+    const body = arrow!.blocks.find((b) => b.text === '$z * 2')!.index;
+    expect(arrow!.edges).toContainEqual({ from: body, to: arrow!.exitIndex, kind: 'return' });
+  });
+
+  it('abstract method (no body) → graceful undefined, no throw', () => {
+    const root = php.parse(`<?php abstract class C { abstract public function m(); }`);
+    const fns = php.collectFunctions(root);
+    for (const fn of fns) {
+      expect(() => createPhpCfgVisitor().buildFunctionCfg(fn, 'x.php')).not.toThrow();
+    }
+  });
+});
+
+describe('PHP CfgVisitor — branching', () => {
+  it('if / elseif / else → cond-true & cond-false; join reachable', () => {
+    const cfg = php.cfgOf(
+      wrap(`if ($x > 0) { pos(); } elseif ($x < 0) { neg(); } else { zero(); } after();`),
+    );
+    const kinds = edgeKinds(cfg);
+    expect(kinds.has('cond-true')).toBe(true);
+    expect(kinds.has('cond-false')).toBe(true);
+    const after = block(cfg, 'after();');
+    expect(reaches(cfg, block(cfg, 'pos();'), after)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'neg();'), after)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'zero();'), after)).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+  });
+
+  it('alternative colon if/elseif/else (endif) is modeled like the brace form', () => {
+    const cfg = php.cfgOf(
+      wrap(`if ($x): pos(); elseif ($x): mid(); else: zero(); endif; after();`),
+    );
+    const kinds = edgeKinds(cfg);
+    expect(kinds.has('cond-true')).toBe(true);
+    expect(kinds.has('cond-false')).toBe(true);
+    const after = block(cfg, 'after();');
+    expect(reaches(cfg, block(cfg, 'pos();'), after)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'zero();'), after)).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+  });
+});
+
+describe('PHP CfgVisitor — loops', () => {
+  it('for: cond-true / loop-back / cond-false; body loops back', () => {
+    const cfg = php.cfgOf(wrap(`for ($i = 0; $i < $x; $i++) { body(); } after();`));
+    const kinds = edgeKinds(cfg);
+    expect(kinds.has('cond-true')).toBe(true);
+    expect(kinds.has('loop-back')).toBe(true);
+    expect(kinds.has('cond-false')).toBe(true);
+    expect(reaches(cfg, block(cfg, 'body();'), block(cfg, 'after();'))).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+  });
+
+  it('foreach ($it as $v): loops with cond-true / loop-back / cond-false', () => {
+    const cfg = php.cfgOf(wrap(`foreach ($x as $v) { use1($v); } after();`));
+    const kinds = edgeKinds(cfg);
+    expect(kinds.has('cond-true')).toBe(true);
+    expect(kinds.has('loop-back')).toBe(true);
+    expect(kinds.has('cond-false')).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+  });
+
+  it('while: cond-true / loop-back / cond-false', () => {
+    const cfg = php.cfgOf(wrap(`while ($x > 0) { tick(); } after();`));
+    const kinds = edgeKinds(cfg);
+    expect(kinds.has('cond-true')).toBe(true);
+    expect(kinds.has('loop-back')).toBe(true);
+    expect(kinds.has('cond-false')).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+  });
+
+  it('do-while: body runs before the test (loop-back from the condition)', () => {
+    const cfg = php.cfgOf(wrap(`do { tick(); } while ($x < 3); after();`));
+    const kinds = edgeKinds(cfg);
+    expect(kinds.has('loop-back')).toBe(true);
+    expect(kinds.has('cond-false')).toBe(true);
+    // The body is the loop entry — control reaches it before the condition.
+    const body = block(cfg, 'tick();');
+    expect(reachable(cfg, body)).toBe(true);
+    expect(reaches(cfg, body, block(cfg, 'after();'))).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+  });
+
+  it('while (true) {} keeps EXIT reverse-reachable AND emits CDG > 0', () => {
+    const cfg = php.cfgOf(wrap(`while (true) { if ($x) { g(); } }`));
+    // The inner `if` is a real control point; assert through the production
+    // post-dom/CDG passes (matching go/python/ruby/rust/vue) — CDG is only
+    // computed when EXIT stays reverse-reachable, so a non-empty CDG proves the
+    // structural cond-false escape edge keeps the function CDG-bearing.
+    expect(edgeKinds(cfg).has('cond-false')).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+    expect(computeControlDependence(cfg).edges.length).toBeGreaterThan(0);
+  });
+
+  it('for (;;) {} (no condition) keeps EXIT reverse-reachable', () => {
+    const cfg = php.cfgOf(wrap(`for (;;) { step(); }`));
+    expect(edgeKinds(cfg).has('cond-false')).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+  });
+});
+
+describe('PHP CfgVisitor — switch / match', () => {
+  it('switch: C-style FALLTHROUGH (a case with no break flows to the next)', () => {
+    const cfg = php.cfgOf(
+      wrap(
+        `switch ($x) { case 1: a(); break; case 2: b(); case 3: c(); break; default: d(); } e();`,
+      ),
+    );
+    const kinds = edgeKinds(cfg);
+    expect(kinds.has('switch-case')).toBe(true);
+    expect(kinds.has('fallthrough')).toBe(true);
+    // case 2 (no break) falls through to case 3.
+    const c2 = block(cfg, 'b();');
+    const c3 = block(cfg, 'c();');
+    expect(cfg.edges).toContainEqual({ from: c2, to: c3, kind: 'fallthrough' });
+    // case 1's break skips case 2's body, but the switch join is reachable.
+    expect(reaches(cfg, block(cfg, 'a();'), block(cfg, 'e();'))).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+  });
+
+  it('switch without break: no switch-case edge is mislabeled fallthrough at the dispatch', () => {
+    const cfg = php.cfgOf(wrap(`switch ($x) { case 1: a(); } after();`));
+    // No default → the no-match path reaches the join directly.
+    expect(edgeKinds(cfg).has('switch-case')).toBe(true);
+    expect(reaches(cfg, block(cfg, 'a();'), block(cfg, 'after();'))).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+  });
+
+  it('match is a value expression (no fallthrough), kept inline — value flows to the assign', () => {
+    const cfg = php.cfgOf(wrap(`$r = match ($x) { 1, 2 => "low", default => "high" }; return $r;`));
+    // match arms are NOT separate dispatch blocks (documented inline-value gap).
+    expect(edgeKinds(cfg).has('fallthrough')).toBe(false);
+    expect(edgeKinds(cfg).has('switch-case')).toBe(false);
+    // The match value and the return both reach EXIT.
+    expect(reaches(cfg, block(cfg, 'match ($x)'), cfg.exitIndex)).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+  });
+});
+
+describe('PHP CfgVisitor — try / catch / finally', () => {
+  it('try/catch/finally: throw edges to the handler; normal flow crosses finally', () => {
+    const cfg = php.cfgOf(
+      wrap(`try { risky(); } catch (\\E $e) { handle($e); } finally { cleanup(); } after();`),
+    );
+    expect(edgeKinds(cfg).has('throw')).toBe(true);
+    // Body and catch both reach the finally, then after().
+    const fin = block(cfg, 'cleanup();');
+    expect(reaches(cfg, block(cfg, 'risky();'), fin)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'handle($e)'), fin)).toBe(true);
+    expect(reaches(cfg, fin, block(cfg, 'after();'))).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+  });
+
+  it('multi-catch type list (TypeError | ValueError) catches and reaches the join', () => {
+    const cfg = php.cfgOf(
+      wrap(`try { risky(); } catch (\\TypeError | \\ValueError $e) { handle($e); } after();`),
+    );
+    expect(edgeKinds(cfg).has('throw')).toBe(true);
+    expect(reaches(cfg, block(cfg, 'handle($e)'), block(cfg, 'after();'))).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+  });
+
+  it('return inside try threads through finally (finally-return completion edge)', () => {
+    const cfg = php.cfgOf(
+      wrap(`try { if ($x) { return early(); } body(); } finally { release(); } return tail();`),
+    );
+    expect(edgeKinds(cfg).has('finally-return')).toBe(true);
+    // The early return's first leg goes to the finally entry, not straight to EXIT.
+    const ret = block(cfg, 'return early()');
+    const fin = block(cfg, 'release();');
+    expect(reaches(cfg, ret, fin)).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+  });
+});
+
+describe('PHP CfgVisitor — break N / continue N', () => {
+  it('break 2 targets the 2nd enclosing loop (escapes both)', () => {
+    const cfg = php.cfgOf(
+      `<?php function f() {
+        while (true) {
+          for ($i = 0; ; $i++) {
+            if (cond()) { break 2; }
+            inner();
+          }
+          afterInner();
+        }
+        afterOuter();
+      }`,
+    );
+    expect(edgeKinds(cfg).has('break')).toBe(true);
+    const brk = block(cfg, 'break 2');
+    // break 2 escapes the OUTER loop → reaches afterOuter(), NOT afterInner().
+    expect(reaches(cfg, brk, block(cfg, 'afterOuter();'))).toBe(true);
+    expect(reaches(cfg, brk, block(cfg, 'afterInner();'))).toBe(false);
+  });
+
+  it('continue 2 targets the 2nd enclosing loop header', () => {
+    const cfg = php.cfgOf(
+      `<?php function f() {
+        while (cond1()) {
+          for ($i = 0; $i < 3; $i++) {
+            if (cond2()) { continue 2; }
+            inner();
+          }
+        }
+        done();
+      }`,
+    );
+    expect(edgeKinds(cfg).has('continue')).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+  });
+
+  it('bare break targets the nearest loop', () => {
+    const cfg = php.cfgOf(wrap(`while ($x) { if ($x) { break; } step(); } after();`));
+    expect(edgeKinds(cfg).has('break')).toBe(true);
+    expect(reaches(cfg, block(cfg, 'break;'), block(cfg, 'after();'))).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+  });
+});
+
+describe('PHP CfgVisitor — def/use harvest', () => {
+  it('$x = $a defines $x and uses $a', () => {
+    const cfg = php.cfgOf(`<?php function f($a) { $x = $a; }`);
+    expect(hasDef(cfg, bindingIdx(cfg, '$x'))).toBe(true);
+    expect(hasUse(cfg, bindingIdx(cfg, '$a'))).toBe(true);
+  });
+
+  it('[$a, $b] = f() and list($c, $d) = g() define all targets', () => {
+    const cfg = php.cfgOf(`<?php function f() { [$a, $b] = h(); list($c, $d) = g(); }`);
+    for (const name of ['$a', '$b', '$c', '$d']) {
+      expect(hasDef(cfg, bindingIdx(cfg, name))).toBe(true);
+    }
+  });
+
+  it('foreach ($it as $k => $v) defines both $k and $v', () => {
+    const cfg = php.cfgOf(`<?php function f($it) { foreach ($it as $k => $v) { use1($k, $v); } }`);
+    expect(hasDef(cfg, bindingIdx(cfg, '$k'))).toBe(true);
+    expect(hasDef(cfg, bindingIdx(cfg, '$v'))).toBe(true);
+    expect(hasUse(cfg, bindingIdx(cfg, '$it'))).toBe(true);
+  });
+
+  it('catch (T $e) defines the exception variable', () => {
+    const cfg = php.cfgOf(`<?php function f() { try { r(); } catch (\\E $e) { log($e); } }`);
+    expect(hasDef(cfg, bindingIdx(cfg, '$e'))).toBe(true);
+  });
+
+  it('parameters (incl. default, variadic, by-ref) are ENTRY defs', () => {
+    const cfg = php.cfgOf(`<?php function f($a, $b = 1, &$c, ...$rest) { use1($a); }`);
+    for (const name of ['$a', '$b', '$c', '$rest']) {
+      expect(hasDef(cfg, bindingIdx(cfg, name))).toBe(true);
+    }
+  });
+
+  it('conditional def (right of &&) is a may-def, not a must-def', () => {
+    const cfg = php.cfgOf(`<?php function f($a) { $r = $a && ($x = load()); }`);
+    const x = bindingIdx(cfg, '$x');
+    expect(hasMayDef(cfg, x)).toBe(true);
+    expect(hasDef(cfg, x)).toBe(false);
+  });
+
+  it('property write ($o->p = v) is NOT a scalar def — $o is a use only', () => {
+    // $o is a local (not a param) so the only def site that could exist is the
+    // member-write itself — which must NOT count as a scalar def.
+    const cfg = php.cfgOf(`<?php function f() { $o = make(); $o->prop = compute(); }`);
+    expect(hasUse(cfg, bindingIdx(cfg, '$o'))).toBe(true);
+    // The member-write defines no scalar binding for `prop` — it never appears
+    // as a binding name in the table.
+    expect((cfg.bindings ?? []).some((b) => b.name === 'prop' || b.name === '$prop')).toBe(false);
+  });
+
+  it('closure use ($b, &$c) captures bind in the closure body', () => {
+    const cfgs = php.cfgsOf(
+      `<?php function outer($b) { return function ($a) use ($b, &$c) { return $a + $b + $c; }; }`,
+    );
+    const closure = cfgs.find((c) => (c.bindings ?? []).some((bd) => bd.name === '$a'));
+    expect(closure).toBeDefined();
+    expect((closure!.bindings ?? []).some((bd) => bd.name === '$b')).toBe(true);
+    expect((closure!.bindings ?? []).some((bd) => bd.name === '$c')).toBe(true);
+  });
+});
+
+describe('PHP CfgVisitor — taint-site substrate', () => {
+  it('records a call site with a callee path for a function call', () => {
+    const cfg = php.cfgOf(`<?php function f($req) { exec($req); }`);
+    const sites = allSites(cfg);
+    expect(sites.some((s) => s.kind === 'call' && s.callee === 'exec')).toBe(true);
+  });
+
+  it('records a member-call receiver + callee (db->query)', () => {
+    const cfg = php.cfgOf(`<?php function f($req) { $db->query($req); }`);
+    const sites = allSites(cfg);
+    const call = sites.find((s) => s.kind === 'call' && (s.callee ?? '').endsWith('query'));
+    expect(call).toBeDefined();
+    expect(call!.receiver).toBe(bindingIdx(cfg, '$db'));
+  });
+
+  it('nested sanitizer call exec(escape($req)) is via-tagged for interposition', () => {
+    const cfg = php.cfgOf(`<?php function f($req) { exec(escape($req)); }`);
+    const sites = allSites(cfg);
+    expect(sites.some((s) => s.callee === 'exec')).toBe(true);
+    expect(sites.some((s) => s.callee === 'escape')).toBe(true);
+  });
+});
+
+describe('PHP CfgVisitor — robustness', () => {
+  it('unmodeled / malformed body shape → graceful partial CFG, never throws', () => {
+    // Deeply nested + a syntax-error tail. The visitor must not throw out.
+    const root = php.parse(`<?php function f($x) { if ($x) { while (true) { @@@ } } }`);
+    const fns = php.collectFunctions(root);
+    for (const fn of fns) {
+      expect(() => createPhpCfgVisitor().buildFunctionCfg(fn, 'x.php')).not.toThrow();
+    }
+  });
+
+  it('goto / named label are modeled as straight-line blocks (no crash)', () => {
+    const cfg = php.cfgOf(`<?php function f() { start(); goto end; end: done(); }`);
+    expect(reachable(cfg, block(cfg, 'done()'))).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+  });
+});
diff --git a/gitnexus/test/unit/cfg/python-visitor.test.ts b/gitnexus/test/unit/cfg/python-visitor.test.ts
new file mode 100644
index 000000000..473cb6d4a
--- /dev/null
+++ b/gitnexus/test/unit/cfg/python-visitor.test.ts
@@ -0,0 +1,391 @@
+import { describe, it, expect } from 'vitest';
+import { createRequire } from 'node:module';
+import { createPythonCfgVisitor } from '../../../src/core/ingestion/cfg/visitors/python.js';
+import type { FunctionCfg } from '../../../src/core/ingestion/cfg/types.js';
+import {
+  makeCfgHarness,
+  type CfgHarness,
+  block,
+  edgeKinds,
+  reaches,
+  reachable,
+  bindingIdx,
+} from '../../helpers/cfg-harness.js';
+import { isExitReachableFromAllBlocks } from '../../../src/core/ingestion/cfg/post-dominators.js';
+import { computeControlDependence } from '../../../src/core/ingestion/cfg/control-dependence.js';
+
+// The Python CfgVisitor — one hazard per test (real-parser regression, NOT
+// snapshot-pinning). Each fixture's distinctive statement text (a(), one(),
+// done(), …) lets us locate the block for a region by text and assert the
+// control-flow topology around it. Python is the most structurally divergent
+// target: indentation blocks, elif, for/while-else, with, try/except/else/finally,
+// match/case. The `while True:` EXIT-reachability + CDG regressions are
+// load-bearing.
+
+const pyGrammar = createRequire(import.meta.url)('tree-sitter-python') as Parameters<
+  typeof makeCfgHarness
+>[0];
+
+const py: CfgHarness = makeCfgHarness(pyGrammar, createPythonCfgVisitor(), 'fixture.py');
+
+const hasDef = (cfg: FunctionCfg, idx: number): boolean =>
+  cfg.blocks.some((bl) => bl.statements?.some((s) => s.defs.includes(idx)));
+const hasUse = (cfg: FunctionCfg, idx: number): boolean =>
+  cfg.blocks.some((bl) => bl.statements?.some((s) => s.uses.includes(idx)));
+const hasMayDef = (cfg: FunctionCfg, idx: number): boolean =>
+  cfg.blocks.some((bl) => bl.statements?.some((s) => (s.mayDefs ?? []).includes(idx)));
+
+/** An edge {from, to, kind} exists. */
+const hasEdge = (cfg: FunctionCfg, from: number, to: number, kind: string): boolean =>
+  cfg.edges.some((e) => e.from === from && e.to === to && e.kind === kind);
+
+describe('Python CfgVisitor — structure', () => {
+  it('straight-line body: ENTRY → block → EXIT (seq)', () => {
+    const cfg = py.cfgOf(`def f():\n    a()\n    b()\n    c()\n`);
+    expect(cfg.blocks.filter((b) => b.kind === 'normal')).toHaveLength(1);
+    const body = block(cfg, 'a()');
+    expect(cfg.edges).toContainEqual({ from: cfg.entryIndex, to: body, kind: 'seq' });
+    expect(reaches(cfg, body, cfg.exitIndex)).toBe(true);
+  });
+
+  it('empty body (pass only): ENTRY → block → EXIT', () => {
+    const cfg = py.cfgOf(`def f():\n    pass\n`);
+    expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+  });
+
+  it('function and lambda are both CFG-bearing', () => {
+    const cfgs = py.cfgsOf(`def f():\n    x()\n\ng = lambda y: y + 1\n`);
+    expect(cfgs.length).toBeGreaterThanOrEqual(2);
+    for (const cfg of cfgs) expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+  });
+
+  it('async def is the same node; its body builds a CFG', () => {
+    const cfg = py.cfgOf(`async def f(c):\n    await c\n    work()\n`);
+    expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+    expect(reachable(cfg, block(cfg, 'work()'))).toBe(true);
+  });
+
+  it('unmodeled / no-body shape → undefined, never throws', () => {
+    const root = py.parse(`class C:\n    x = 1\n`);
+    const fns = py.collectFunctions(root);
+    for (const fn of fns) {
+      expect(() => createPythonCfgVisitor().buildFunctionCfg(fn, 'f.py')).not.toThrow();
+    }
+  });
+});
+
+describe('Python CfgVisitor — if / elif / else', () => {
+  it('if/elif/else: branch senses; every arm reaches the join', () => {
+    const cfg = py.cfgOf(
+      `def f(x):\n    if x > 0:\n        a()\n    elif x < 0:\n        b()\n    else:\n        c()\n    after()\n`,
+    );
+    const kinds = edgeKinds(cfg);
+    expect(kinds.has('cond-true')).toBe(true);
+    expect(kinds.has('cond-false')).toBe(true);
+    const join = block(cfg, 'after()');
+    expect(reaches(cfg, block(cfg, 'a()'), join)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'b()'), join)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'c()'), join)).toBe(true);
+    // the if-true arm is reached by cond-true; the elif chains on cond-false.
+    const ifHeader = block(cfg, 'x > 0');
+    const elifHeader = block(cfg, 'x < 0');
+    expect(hasEdge(cfg, ifHeader, block(cfg, 'a()'), 'cond-true')).toBe(true);
+    expect(hasEdge(cfg, ifHeader, elifHeader, 'cond-false')).toBe(true);
+    expect(hasEdge(cfg, elifHeader, block(cfg, 'b()'), 'cond-true')).toBe(true);
+    expect(hasEdge(cfg, elifHeader, block(cfg, 'c()'), 'cond-false')).toBe(true);
+  });
+
+  it('if with no else: cond-true to the body, seq fall-through to the join', () => {
+    // Mirrors the shared TS/Go visitor contract: a no-else `if` emits only the
+    // taken `cond-true` arm; the not-taken path falls through to the join as
+    // `seq`, which the CDG pass treats as the complement (false) arm.
+    const cfg = py.cfgOf(`def f(x):\n    if x:\n        a()\n    after()\n`);
+    const header = cfg.blocks.find((b) => b.text === 'x')!.index;
+    const after = block(cfg, 'after()');
+    expect(hasEdge(cfg, header, block(cfg, 'a()'), 'cond-true')).toBe(true);
+    // both the taken arm and the fall-through reach the join.
+    expect(reaches(cfg, header, after)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'a()'), after)).toBe(true);
+    // the `if` is a real control point — CDG is non-empty.
+    expect(computeControlDependence(cfg).edges.length).toBeGreaterThan(0);
+  });
+});
+
+describe('Python CfgVisitor — for / while with the loop else', () => {
+  it('for: header + body + loop-back; loop var is a def, iterable a use', () => {
+    const cfg = py.cfgOf(`def f(xs):\n    for i in xs:\n        step(i)\n    done()\n`);
+    const body = block(cfg, 'step(i)');
+    expect(edgeKinds(cfg).has('cond-true')).toBe(true);
+    expect(edgeKinds(cfg).has('loop-back')).toBe(true);
+    const header = cfg.edges.find((e) => e.kind === 'loop-back' && e.from === body)?.to;
+    expect(header).toBeDefined();
+    expect(reaches(cfg, header!, block(cfg, 'done()'))).toBe(true);
+    expect(hasDef(cfg, bindingIdx(cfg, 'i'))).toBe(true);
+    expect(hasUse(cfg, bindingIdx(cfg, 'xs'))).toBe(true);
+  });
+
+  it('for-else: the else runs on NORMAL completion (cond-false), NOT on break', () => {
+    const cfg = py.cfgOf(
+      `def f(xs):\n    for i in xs:\n        if i:\n            break\n    else:\n        noBreak()\n    after()\n`,
+    );
+    const header = cfg.blocks.find((b) => b.text.startsWith('for '))!.index;
+    const elseB = block(cfg, 'noBreak()');
+    const breakB = block(cfg, 'break');
+    // the else is on the cond-false (normal completion) edge from the header...
+    expect(hasEdge(cfg, header, elseB, 'cond-false')).toBe(true);
+    // ...and the break does NOT route through the else.
+    expect(reaches(cfg, breakB, elseB)).toBe(false);
+    // both the else and the break reach the post-loop join.
+    expect(reaches(cfg, elseB, block(cfg, 'after()'))).toBe(true);
+    expect(reaches(cfg, breakB, block(cfg, 'after()'))).toBe(true);
+  });
+
+  it('while-else: same else-on-normal-completion / not-on-break semantics', () => {
+    const cfg = py.cfgOf(
+      `def f(x):\n    while x > 0:\n        if cond():\n            break\n        x -= 1\n    else:\n        clean()\n    after()\n`,
+    );
+    const header = block(cfg, 'x > 0');
+    const elseB = block(cfg, 'clean()');
+    const breakB = block(cfg, 'break');
+    expect(hasEdge(cfg, header, elseB, 'cond-false')).toBe(true);
+    expect(reaches(cfg, breakB, elseB)).toBe(false);
+    expect(reaches(cfg, breakB, block(cfg, 'after()'))).toBe(true);
+  });
+
+  it('while True: keeps EXIT reverse-reachable AND emits CDG > 0', () => {
+    const cfg = py.cfgOf(`def f(x):\n    while True:\n        if x:\n            g()\n`);
+    expect(edgeKinds(cfg).has('cond-false')).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+    expect(computeControlDependence(cfg).edges.length).toBeGreaterThan(0);
+  });
+
+  it('continue re-tests the loop header', () => {
+    const cfg = py.cfgOf(
+      `def f(xs):\n    for i in xs:\n        if i:\n            continue\n        use(i)\n`,
+    );
+    const header = cfg.blocks.find((b) => b.text.startsWith('for '))!.index;
+    expect(edgeKinds(cfg).has('continue')).toBe(true);
+    expect(reaches(cfg, block(cfg, 'continue'), header)).toBe(true);
+  });
+});
+
+describe('Python CfgVisitor — with (deterministic dispose on normal AND exception exit)', () => {
+  it('with runs the body then __exit__ (dispose) on the normal path', () => {
+    const cfg = py.cfgOf(`def f():\n    with open('x') as fh:\n        use(fh)\n    after()\n`);
+    const dispose = cfg.blocks.find((b) => b.text.startsWith('with '))!.index;
+    const body = block(cfg, 'use(fh)');
+    // body → dispose → after on the normal path.
+    expect(reaches(cfg, body, dispose)).toBe(true);
+    expect(reaches(cfg, dispose, block(cfg, 'after()'))).toBe(true);
+    // the `as fh` alias is a def.
+    expect(hasDef(cfg, bindingIdx(cfg, 'fh'))).toBe(true);
+  });
+
+  it('with runs __exit__ on the EXCEPTION path too (body raises → dispose via throw)', () => {
+    const cfg = py.cfgOf(`def f():\n    with lock() as l:\n        boom()\n    after()\n`);
+    const dispose = cfg.blocks.find((b) => b.text.startsWith('with '))!.index;
+    const body = block(cfg, 'boom()');
+    // an exception inside the body routes to the dispose via a throw edge.
+    expect(hasEdge(cfg, body, dispose, 'throw')).toBe(true);
+    expect(edgeKinds(cfg).has('throw')).toBe(true);
+  });
+
+  it('return inside a with threads through the dispose', () => {
+    const cfg = py.cfgOf(`def f():\n    with open('x') as fh:\n        return read(fh)\n`);
+    const dispose = cfg.blocks.find((b) => b.text.startsWith('with '))!.index;
+    const ret = block(cfg, 'return read(fh)');
+    expect(reaches(cfg, ret, dispose)).toBe(true);
+    expect(reaches(cfg, dispose, cfg.exitIndex)).toBe(true);
+  });
+});
+
+describe('Python CfgVisitor — try / except / else / finally', () => {
+  it('try/except/else/finally: completion edges; finally runs on all paths', () => {
+    const cfg = py.cfgOf(
+      `def f():\n    try:\n        body()\n    except ValueError as e:\n        handle(e)\n    else:\n        noerr()\n    finally:\n        cleanup()\n    after()\n`,
+    );
+    const finallyB = block(cfg, 'cleanup()');
+    expect(reaches(cfg, block(cfg, 'body()'), finallyB)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'handle(e)'), finallyB)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'noerr()'), finallyB)).toBe(true);
+    expect(reaches(cfg, finallyB, block(cfg, 'after()'))).toBe(true);
+    // the protected body can throw to the handler.
+    expect(edgeKinds(cfg).has('throw')).toBe(true);
+    // the else runs only after the body (no exception).
+    expect(reaches(cfg, block(cfg, 'body()'), block(cfg, 'noerr()'))).toBe(true);
+    // `except E as e` binds e (catch-kind).
+    expect(hasDef(cfg, bindingIdx(cfg, 'e'))).toBe(true);
+  });
+
+  it('except group (except*) is a handler from the body', () => {
+    const cfg = py.cfgOf(
+      `def f():\n    try:\n        body()\n    except* ValueError as e:\n        handle(e)\n    after()\n`,
+    );
+    expect(reaches(cfg, block(cfg, 'body()'), block(cfg, 'handle(e)'))).toBe(true);
+    expect(reaches(cfg, block(cfg, 'handle(e)'), block(cfg, 'after()'))).toBe(true);
+    expect(edgeKinds(cfg).has('throw')).toBe(true);
+  });
+
+  it('multiple except clauses are both reachable from the protected body', () => {
+    const cfg = py.cfgOf(
+      `def f():\n    try:\n        body()\n    except ValueError:\n        handleV()\n    except (TypeError, KeyError):\n        handleT()\n    after()\n`,
+    );
+    expect(reaches(cfg, block(cfg, 'body()'), block(cfg, 'handleV()'))).toBe(true);
+    expect(reaches(cfg, block(cfg, 'body()'), block(cfg, 'handleT()'))).toBe(true);
+  });
+
+  it('return inside try threads through finally', () => {
+    const cfg = py.cfgOf(
+      `def f(x):\n    try:\n        if x:\n            return 1\n        body()\n    finally:\n        cleanup()\n`,
+    );
+    const finallyB = block(cfg, 'cleanup()');
+    expect(reaches(cfg, block(cfg, 'return 1'), finallyB)).toBe(true);
+    expect(edgeKinds(cfg).has('finally-return')).toBe(true);
+    expect(reaches(cfg, finallyB, cfg.exitIndex)).toBe(true);
+  });
+});
+
+describe('Python CfgVisitor — match / case (no fallthrough)', () => {
+  it('match dispatches across cases; no fallthrough between case bodies', () => {
+    const cfg = py.cfgOf(
+      `def f(x):\n    match x:\n        case 1:\n            one()\n        case 2:\n            two()\n        case _:\n            other()\n    after()\n`,
+    );
+    expect(edgeKinds(cfg).has('switch-case')).toBe(true);
+    // each case body rejoins after the match...
+    expect(reaches(cfg, block(cfg, 'one()'), block(cfg, 'after()'))).toBe(true);
+    expect(reaches(cfg, block(cfg, 'two()'), block(cfg, 'after()'))).toBe(true);
+    expect(reaches(cfg, block(cfg, 'other()'), block(cfg, 'after()'))).toBe(true);
+    // ...but case 1 does NOT fall into case 2 (no implicit fallthrough).
+    expect(reaches(cfg, block(cfg, 'one()'), block(cfg, 'two()'))).toBe(false);
+  });
+
+  it('match with no wildcard keeps EXIT reverse-reachable (no-match path)', () => {
+    const cfg = py.cfgOf(
+      `def f(x):\n    match x:\n        case 1:\n            one()\n        case 2:\n            two()\n    after()\n`,
+    );
+    // the dispatch reaches the exit directly (no `case _`) so after() is reachable.
+    const dispatch = cfg.blocks.find((b) => b.text.startsWith('match '))!.index;
+    expect(reaches(cfg, dispatch, block(cfg, 'after()'))).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+  });
+
+  it('a case guard is harvested as a conditional use on the dispatch', () => {
+    const cfg = py.cfgOf(
+      `def f(x, k):\n    match x:\n        case y if y > k:\n            use(y)\n        case _:\n            other()\n`,
+    );
+    expect(hasUse(cfg, bindingIdx(cfg, 'k'))).toBe(true);
+  });
+});
+
+describe('Python CfgVisitor — def/use harvest', () => {
+  it('x = a then use(x): def then use', () => {
+    const cfg = py.cfgOf(`def f(a):\n    x = a\n    use(x)\n`);
+    const x = bindingIdx(cfg, 'x');
+    expect(hasDef(cfg, x)).toBe(true);
+    expect(hasUse(cfg, x)).toBe(true);
+  });
+
+  it('tuple unpack a, b = f() defines BOTH a and b', () => {
+    const cfg = py.cfgOf(`def f():\n    a, b = load()\n    use(a, b)\n`);
+    expect(hasDef(cfg, bindingIdx(cfg, 'a'))).toBe(true);
+    expect(hasDef(cfg, bindingIdx(cfg, 'b'))).toBe(true);
+    expect(hasUse(cfg, bindingIdx(cfg, 'a'))).toBe(true);
+    expect(hasUse(cfg, bindingIdx(cfg, 'b'))).toBe(true);
+  });
+
+  it('list unpack [c, d] = pair() and star target first, *rest = seq() define all', () => {
+    const cfg = py.cfgOf(`def f():\n    [c, d] = pair()\n    first, *rest = seq()\n`);
+    expect(hasDef(cfg, bindingIdx(cfg, 'c'))).toBe(true);
+    expect(hasDef(cfg, bindingIdx(cfg, 'd'))).toBe(true);
+    expect(hasDef(cfg, bindingIdx(cfg, 'first'))).toBe(true);
+    expect(hasDef(cfg, bindingIdx(cfg, 'rest'))).toBe(true);
+  });
+
+  it('augmented assignment x += 1 reads AND writes the lvalue', () => {
+    const cfg = py.cfgOf(`def f():\n    x = 1\n    x += 3\n`);
+    const x = bindingIdx(cfg, 'x');
+    expect(hasDef(cfg, x)).toBe(true);
+    expect(hasUse(cfg, x)).toBe(true);
+  });
+
+  it('walrus (n := f()) defines n; the condition uses it', () => {
+    const cfg = py.cfgOf(`def f():\n    if (n := compute()) > 0:\n        use(n)\n`);
+    const n = bindingIdx(cfg, 'n');
+    expect(hasDef(cfg, n)).toBe(true);
+    expect(hasUse(cfg, n)).toBe(true);
+  });
+
+  it('comprehension target [i for i in xs] defines i; xs is a use', () => {
+    const cfg = py.cfgOf(`def f(xs):\n    a = [i for i in xs if i > 0]\n    use(a)\n`);
+    expect(hasDef(cfg, bindingIdx(cfg, 'i'))).toBe(true);
+    expect(hasUse(cfg, bindingIdx(cfg, 'xs'))).toBe(true);
+    expect(hasDef(cfg, bindingIdx(cfg, 'a'))).toBe(true);
+  });
+
+  it('with ... as t defines t; for ... in src uses src', () => {
+    const cfg = py.cfgOf(`def f(src):\n    with src as t:\n        use(t)\n`);
+    expect(hasDef(cfg, bindingIdx(cfg, 't'))).toBe(true);
+    expect(hasUse(cfg, bindingIdx(cfg, 'src'))).toBe(true);
+  });
+
+  it('a walrus in a ternary arm is a may-def (conditional context)', () => {
+    const cfg = py.cfgOf(`def f(c, p, q):\n    x = (a := p) if c else (b := q)\n    use(x)\n`);
+    // both arm walruses are conditionally evaluated → may-defs, not must-defs.
+    expect(hasMayDef(cfg, bindingIdx(cfg, 'a'))).toBe(true);
+    expect(hasMayDef(cfg, bindingIdx(cfg, 'b'))).toBe(true);
+    expect(hasDef(cfg, bindingIdx(cfg, 'a'))).toBe(false);
+  });
+
+  it('a walrus in an or/and right operand is a may-def', () => {
+    const cfg = py.cfgOf(`def f(a, b):\n    z = a or (w := b)\n    use(z)\n`);
+    expect(hasMayDef(cfg, bindingIdx(cfg, 'w'))).toBe(true);
+  });
+
+  it('attribute write obj.f = 1 is NOT a scalar def; root is a use', () => {
+    const cfg = py.cfgOf(`def f(obj):\n    obj.field = 1\n    use(obj)\n`);
+    expect(hasUse(cfg, bindingIdx(cfg, 'obj'))).toBe(true);
+    // no `field` binding exists (member writes are not scalar defs).
+    expect((cfg.bindings ?? []).some((b) => b.name === 'field')).toBe(false);
+  });
+
+  it('parameters (incl. *args / **kwargs / defaults) define at ENTRY', () => {
+    const cfg = py.cfgOf(`def f(a, b=1, *args, **kwargs):\n    use(a, b, args, kwargs)\n`);
+    for (const name of ['a', 'b', 'args', 'kwargs']) {
+      expect(hasDef(cfg, bindingIdx(cfg, name))).toBe(true);
+    }
+  });
+
+  it('global names resolve to a shared synthetic module binding (no false local)', () => {
+    const cfg = py.cfgOf(`def f():\n    global G\n    G = 1\n    use(G)\n`);
+    const g = bindingIdx(cfg, 'G');
+    expect((cfg.bindings ?? [])[g].synthetic).toBe(true);
+    expect(hasUse(cfg, g)).toBe(true);
+  });
+});
+
+describe('Python CfgVisitor — functionStartColumn', () => {
+  it('two same-line lambdas get distinct functionStartColumn', () => {
+    const cfgs = py.cfgsOf(`d = {"a": lambda: x(), "b": lambda: y()}\n`);
+    expect(cfgs.length).toBeGreaterThanOrEqual(2);
+    expect(cfgs[0].functionStartLine).toBe(cfgs[1].functionStartLine);
+    expect(cfgs[0].functionStartColumn).not.toBe(cfgs[1].functionStartColumn);
+  });
+});
+
+describe('Python CfgVisitor — production CDG probe (plan-required)', () => {
+  it('while True / nested if gives exitReachable=true and CDG edges > 0', () => {
+    const cfg = py.cfgOf(`def f(x):\n    while True:\n        if x:\n            g()\n`);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+    expect(computeControlDependence(cfg).edges.length).toBeGreaterThan(0);
+  });
+});
+
+describe('Python CfgVisitor — no taint sites harvested (this unit)', () => {
+  it('statements carry NO sites key (taint substrate is a later step)', () => {
+    const cfg = py.cfgOf(`def f(cmd):\n    exec(cmd)\n    x = escape(cmd)\n    use(x)\n`);
+    const anySites = cfg.blocks.some((b) =>
+      (b.statements ?? []).some((s) => (s as { sites?: unknown }).sites !== undefined),
+    );
+    expect(anySites).toBe(false);
+  });
+});
diff --git a/gitnexus/test/unit/cfg/reaching-defs.test.ts b/gitnexus/test/unit/cfg/reaching-defs.test.ts
index 01dc598ed..244bc8f58 100644
--- a/gitnexus/test/unit/cfg/reaching-defs.test.ts
+++ b/gitnexus/test/unit/cfg/reaching-defs.test.ts
@@ -347,6 +347,30 @@ describe('computeReachingDefs — determinism and convergence', () => {
     expect(capped.defCount).toBe(full.defCount);
     expect(capped.useCount).toBe(full.useCount);
   });
+
+  it('maxBlockVisits ceiling: a budget below convergence bails to a sound empty truncated', () => {
+    // entry → body (self-loop, forces re-processing) → exit; body defs+uses x.
+    const blocks: BlockSpec[] = [{}, {}, { stmts: [stmt(3, [0], [0])] }];
+    const edges: [number, number][] = [
+      [0, 2],
+      [2, 2], // self-loop → the fixpoint re-visits block 2
+      [2, 1],
+    ];
+    // Unbounded (and a generous budget) converge with the loop-carried fact.
+    const full = computeReachingDefs(mkCfg(blocks, edges, ['x']));
+    expect(full.status).toBe('computed');
+    expect(full.facts.length).toBeGreaterThan(0);
+    const budgeted = computeReachingDefs(mkCfg(blocks, edges, ['x']), { maxBlockVisits: 1000 });
+    expect(budgeted.status).toBe('computed');
+    expect(render(budgeted.facts)).toEqual(render(full.facts)); // byte-identical for normal code
+
+    // A budget below convergence cannot reach the fixpoint, so facts would be
+    // unsound → return NONE (sound), status 'truncated', telemetry preserved.
+    const capped = computeReachingDefs(mkCfg(blocks, edges, ['x']), { maxBlockVisits: 1 });
+    expect(capped.status).toBe('truncated');
+    expect(capped.facts).toEqual([]);
+    expect(capped.defCount).toBe(full.defCount);
+  });
 });
 
 describe('computeReachingDefs — parser-direct acceptance (with U1/U2)', () => {
diff --git a/gitnexus/test/unit/cfg/ruby-visitor.test.ts b/gitnexus/test/unit/cfg/ruby-visitor.test.ts
new file mode 100644
index 000000000..56d254925
--- /dev/null
+++ b/gitnexus/test/unit/cfg/ruby-visitor.test.ts
@@ -0,0 +1,423 @@
+import { describe, it, expect } from 'vitest';
+import { createRequire } from 'node:module';
+import { createRubyCfgVisitor } from '../../../src/core/ingestion/cfg/visitors/ruby.js';
+import type { FunctionCfg } from '../../../src/core/ingestion/cfg/types.js';
+import {
+  makeCfgHarness,
+  type CfgHarness,
+  block,
+  edgeKinds,
+  reaches,
+  bindingIdx,
+} from '../../helpers/cfg-harness.js';
+import { isExitReachableFromAllBlocks } from '../../../src/core/ingestion/cfg/post-dominators.js';
+import { computeControlDependence } from '../../../src/core/ingestion/cfg/control-dependence.js';
+
+// The Ruby CfgVisitor — one hazard per test (real-parser regression, NOT
+// snapshot-pinning). Each fixture's distinctive statement text (one(), done(),
+// after(), …) lets us locate the block for a region by text and assert the
+// control-flow topology around it. Ruby is structurally close to Python:
+// keyword/`end`-delimited blocks, statement-modifier forms, begin/rescue/else/
+// ensure, case/when + case/in. The `while true` EXIT-reachability + CDG
+// regressions are load-bearing.
+
+const rubyGrammar = createRequire(import.meta.url)('tree-sitter-ruby') as Parameters<
+  typeof makeCfgHarness
+>[0];
+
+const rb: CfgHarness = makeCfgHarness(rubyGrammar, createRubyCfgVisitor(), 'fixture.rb');
+
+const hasDef = (cfg: FunctionCfg, idx: number): boolean =>
+  cfg.blocks.some((bl) => bl.statements?.some((s) => s.defs.includes(idx)));
+const hasUse = (cfg: FunctionCfg, idx: number): boolean =>
+  cfg.blocks.some((bl) => bl.statements?.some((s) => s.uses.includes(idx)));
+const hasMayDef = (cfg: FunctionCfg, idx: number): boolean =>
+  cfg.blocks.some((bl) => bl.statements?.some((s) => (s.mayDefs ?? []).includes(idx)));
+
+/** An edge {from, to, kind} exists. */
+const hasEdge = (cfg: FunctionCfg, from: number, to: number, kind: string): boolean =>
+  cfg.edges.some((e) => e.from === from && e.to === to && e.kind === kind);
+
+describe('Ruby CfgVisitor — structure', () => {
+  it('straight-line body: ENTRY → block → EXIT (seq)', () => {
+    const cfg = rb.cfgOf(`def f\n  a()\n  b()\n  c()\nend\n`);
+    expect(cfg.blocks.filter((b) => b.kind === 'normal')).toHaveLength(1);
+    const body = block(cfg, 'a()');
+    expect(hasEdge(cfg, cfg.entryIndex, body, 'seq')).toBe(true);
+    expect(reaches(cfg, body, cfg.exitIndex)).toBe(true);
+  });
+
+  it('empty method body: ENTRY → EXIT, never throws', () => {
+    const cfg = rb.cfgOf(`def f\nend\n`);
+    expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+  });
+
+  it('method, singleton_method, block and lambda are all CFG-bearing', () => {
+    const cfgs = rb.cfgsOf(
+      `def f\n  x()\nend\n\ndef self.g\n  y()\nend\n\n[1].each { |n| use(n) }\n\nh = ->(q) { q + 1 }\n`,
+    );
+    expect(cfgs.length).toBeGreaterThanOrEqual(4);
+    for (const cfg of cfgs) expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+  });
+
+  it('unmodeled / no-method shape → never throws', () => {
+    const root = rb.parse(`class C\n  X = 1\nend\n`);
+    const fns = rb.collectFunctions(root);
+    for (const fn of fns) {
+      expect(() => createRubyCfgVisitor().buildFunctionCfg(fn, 'f.rb')).not.toThrow();
+    }
+  });
+});
+
+describe('Ruby CfgVisitor — if / elsif / else / unless', () => {
+  it('if/elsif/else: branch senses; every arm reaches the join', () => {
+    const cfg = rb.cfgOf(
+      `def f(x)\n  if x > 0\n    a()\n  elsif x < 0\n    b()\n  else\n    c()\n  end\n  after()\nend\n`,
+    );
+    const kinds = edgeKinds(cfg);
+    expect(kinds.has('cond-true')).toBe(true);
+    expect(kinds.has('cond-false')).toBe(true);
+    const join = block(cfg, 'after()');
+    expect(reaches(cfg, block(cfg, 'a()'), join)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'b()'), join)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'c()'), join)).toBe(true);
+    const ifHeader = block(cfg, 'x > 0');
+    const elifHeader = block(cfg, 'x < 0');
+    expect(hasEdge(cfg, ifHeader, block(cfg, 'a()'), 'cond-true')).toBe(true);
+    expect(hasEdge(cfg, ifHeader, elifHeader, 'cond-false')).toBe(true);
+    expect(hasEdge(cfg, elifHeader, block(cfg, 'b()'), 'cond-true')).toBe(true);
+    expect(hasEdge(cfg, elifHeader, block(cfg, 'c()'), 'cond-false')).toBe(true);
+  });
+
+  it('unless inverts the branch sense (body is the cond-false arm)', () => {
+    const cfg = rb.cfgOf(`def f(x)\n  unless x\n    u()\n  end\n  after()\nend\n`);
+    const header = cfg.blocks.find((b) => b.text === 'x')!.index;
+    // unless's body runs when the condition is FALSE.
+    expect(hasEdge(cfg, header, block(cfg, 'u()'), 'cond-false')).toBe(true);
+    expect(reaches(cfg, header, block(cfg, 'after()'))).toBe(true);
+    expect(computeControlDependence(cfg).edges.length).toBeGreaterThan(0);
+  });
+
+  it('if with no else: cond-true to the body, fall-through to the join', () => {
+    const cfg = rb.cfgOf(`def f(x)\n  if x\n    a()\n  end\n  after()\nend\n`);
+    const header = cfg.blocks.find((b) => b.text === 'x')!.index;
+    const after = block(cfg, 'after()');
+    expect(hasEdge(cfg, header, block(cfg, 'a()'), 'cond-true')).toBe(true);
+    expect(reaches(cfg, header, after)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'a()'), after)).toBe(true);
+    expect(computeControlDependence(cfg).edges.length).toBeGreaterThan(0);
+  });
+});
+
+describe('Ruby CfgVisitor — statement-modifier forms', () => {
+  it('`x = 1 if c` runs the body on cond-true; complement falls through', () => {
+    const cfg = rb.cfgOf(`def f(c)\n  y = 1 if c\n  after()\nend\n`);
+    expect(edgeKinds(cfg).has('cond-true')).toBe(true);
+    const header = cfg.blocks.find((b) => b.text === 'c')!.index;
+    const body = block(cfg, 'y = 1');
+    expect(hasEdge(cfg, header, body, 'cond-true')).toBe(true);
+    // both the taken body and the complement reach the join.
+    expect(reaches(cfg, header, block(cfg, 'after()'))).toBe(true);
+    expect(reaches(cfg, body, block(cfg, 'after()'))).toBe(true);
+  });
+
+  it('`step() while c` is a modifier loop: cond-true / loop-back / cond-false', () => {
+    const cfg = rb.cfgOf(`def f(c)\n  step() while c\n  after()\nend\n`);
+    const kinds = edgeKinds(cfg);
+    expect(kinds.has('cond-true')).toBe(true);
+    expect(kinds.has('loop-back')).toBe(true);
+    expect(kinds.has('cond-false')).toBe(true);
+    const header = cfg.blocks.find((b) => b.text === 'c')!.index;
+    expect(reaches(cfg, block(cfg, 'step()'), header)).toBe(true);
+  });
+});
+
+describe('Ruby CfgVisitor — while / until / for / loop', () => {
+  it('while: header + body + loop-back; exit reachable', () => {
+    const cfg = rb.cfgOf(`def f(x)\n  while x > 0\n    x -= 1\n  end\n  done()\nend\n`);
+    expect(edgeKinds(cfg).has('cond-true')).toBe(true);
+    expect(edgeKinds(cfg).has('loop-back')).toBe(true);
+    const body = block(cfg, 'x -= 1');
+    const header = cfg.edges.find((e) => e.kind === 'loop-back' && e.from === body)?.to;
+    expect(header).toBeDefined();
+    expect(reaches(cfg, header!, block(cfg, 'done()'))).toBe(true);
+  });
+
+  it('until inverts: body runs while the condition is false, exit on cond-false', () => {
+    const cfg = rb.cfgOf(`def f\n  until done\n    step()\n  end\n  after()\nend\n`);
+    const kinds = edgeKinds(cfg);
+    expect(kinds.has('cond-true')).toBe(true); // header → body
+    expect(kinds.has('loop-back')).toBe(true);
+    expect(kinds.has('cond-false')).toBe(true); // header → loop exit
+    const body = block(cfg, 'step()');
+    const header = cfg.edges.find((e) => e.kind === 'loop-back' && e.from === body)?.to;
+    expect(header).toBeDefined();
+    expect(reaches(cfg, header!, block(cfg, 'after()'))).toBe(true);
+  });
+
+  it('for x in xs: loop var is a def, iterable a use; loop-back + exit', () => {
+    const cfg = rb.cfgOf(`def f(xs)\n  for i in xs\n    use(i)\n  end\n  done()\nend\n`);
+    expect(edgeKinds(cfg).has('cond-true')).toBe(true);
+    expect(edgeKinds(cfg).has('loop-back')).toBe(true);
+    expect(hasDef(cfg, bindingIdx(cfg, 'i'))).toBe(true);
+    expect(hasUse(cfg, bindingIdx(cfg, 'xs'))).toBe(true);
+    const body = block(cfg, 'use(i)');
+    const header = cfg.edges.find((e) => e.kind === 'loop-back' && e.from === body)?.to;
+    expect(reaches(cfg, header!, block(cfg, 'done()'))).toBe(true);
+  });
+
+  it('`while true` keeps EXIT reverse-reachable AND emits CDG > 0', () => {
+    const cfg = rb.cfgOf(`def f(x)\n  while true\n    g() if x\n  end\nend\n`);
+    expect(edgeKinds(cfg).has('cond-false')).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+    expect(computeControlDependence(cfg).edges.length).toBeGreaterThan(0);
+  });
+
+  it('`loop do … end` block keeps its own EXIT reverse-reachable', () => {
+    // `loop do … end` parses as a call carrying a do_block — the block is its own
+    // CFG. The block body's normal fall-off reaches the block EXIT (structural
+    // escape), so the post-dominator pass is not silently skipped for it.
+    const cfgs = rb.cfgsOf(`def f\n  loop do\n    work()\n  end\nend\n`);
+    expect(cfgs.length).toBeGreaterThanOrEqual(2);
+    for (const cfg of cfgs) expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+  });
+});
+
+describe('Ruby CfgVisitor — case / when (no fallthrough)', () => {
+  it('case/when dispatches across cases; no fallthrough between case bodies', () => {
+    const cfg = rb.cfgOf(
+      `def f(x)\n  case x\n  when 1\n    one()\n  when 2\n    two()\n  else\n    other()\n  end\n  after()\nend\n`,
+    );
+    expect(edgeKinds(cfg).has('switch-case')).toBe(true);
+    expect(reaches(cfg, block(cfg, 'one()'), block(cfg, 'after()'))).toBe(true);
+    expect(reaches(cfg, block(cfg, 'two()'), block(cfg, 'after()'))).toBe(true);
+    expect(reaches(cfg, block(cfg, 'other()'), block(cfg, 'after()'))).toBe(true);
+    // case 1 does NOT fall into case 2 (no implicit fallthrough).
+    expect(reaches(cfg, block(cfg, 'one()'), block(cfg, 'two()'))).toBe(false);
+  });
+
+  it('case/when with no else keeps EXIT reverse-reachable (no-match path)', () => {
+    const cfg = rb.cfgOf(
+      `def f(x)\n  case x\n  when 1\n    one()\n  when 2\n    two()\n  end\n  after()\nend\n`,
+    );
+    const dispatch = cfg.blocks.find((b) => b.text.startsWith('case '))!.index;
+    expect(reaches(cfg, dispatch, block(cfg, 'after()'))).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+  });
+});
+
+describe('Ruby CfgVisitor — case / in (pattern matching, no fallthrough)', () => {
+  it('case/in dispatches; the array-pattern binds, no fallthrough', () => {
+    const cfg = rb.cfgOf(
+      `def f(obj)\n  case obj\n  in [a, b]\n    pair(a, b)\n  in Integer\n    int()\n  else\n    no()\n  end\nend\n`,
+    );
+    expect(edgeKinds(cfg).has('switch-case')).toBe(true);
+    expect(reaches(cfg, block(cfg, 'pair(a, b)'), cfg.exitIndex)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'int()'), cfg.exitIndex)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'no()'), cfg.exitIndex)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'pair(a, b)'), block(cfg, 'int()'))).toBe(false);
+  });
+
+  it('an in-clause guard is harvested as a conditional use on the dispatch', () => {
+    const cfg = rb.cfgOf(
+      `def f(x, k)\n  case x\n  in Integer if x > k\n    use(x)\n  else\n    other()\n  end\nend\n`,
+    );
+    expect(hasUse(cfg, bindingIdx(cfg, 'k'))).toBe(true);
+  });
+});
+
+describe('Ruby CfgVisitor — begin / rescue / else / ensure', () => {
+  it('begin/rescue/else/ensure: completion edges; ensure runs on all paths', () => {
+    const cfg = rb.cfgOf(
+      `def f\n  begin\n    body()\n  rescue StandardError => e\n    handle(e)\n  else\n    noerr()\n  ensure\n    cleanup()\n  end\n  after()\nend\n`,
+    );
+    const ensureB = block(cfg, 'cleanup()');
+    expect(reaches(cfg, block(cfg, 'body()'), ensureB)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'handle(e)'), ensureB)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'noerr()'), ensureB)).toBe(true);
+    expect(reaches(cfg, ensureB, block(cfg, 'after()'))).toBe(true);
+    // the protected body can throw to the handler.
+    expect(edgeKinds(cfg).has('throw')).toBe(true);
+    expect(reaches(cfg, block(cfg, 'body()'), block(cfg, 'handle(e)'))).toBe(true);
+    // the else runs only after the body (no exception).
+    expect(reaches(cfg, block(cfg, 'body()'), block(cfg, 'noerr()'))).toBe(true);
+    // `rescue ... => e` binds e (catch-kind).
+    expect(hasDef(cfg, bindingIdx(cfg, 'e'))).toBe(true);
+  });
+
+  it('method-level implicit begin: a bare def + rescue/ensure threads correctly', () => {
+    const cfg = rb.cfgOf(`def f\n  risky()\nrescue => e\n  handle()\nensure\n  done()\nend\n`);
+    const ensureB = block(cfg, 'done()');
+    expect(reaches(cfg, block(cfg, 'risky()'), block(cfg, 'handle()'))).toBe(true);
+    expect(reaches(cfg, block(cfg, 'handle()'), ensureB)).toBe(true);
+    expect(reaches(cfg, ensureB, cfg.exitIndex)).toBe(true);
+    expect(edgeKinds(cfg).has('throw')).toBe(true);
+  });
+
+  it('multiple rescue clauses are both reachable from the protected body', () => {
+    const cfg = rb.cfgOf(
+      `def f\n  begin\n    body()\n  rescue TypeError\n    handleT()\n  rescue KeyError\n    handleK()\n  end\nend\n`,
+    );
+    expect(reaches(cfg, block(cfg, 'body()'), block(cfg, 'handleT()'))).toBe(true);
+    expect(reaches(cfg, block(cfg, 'body()'), block(cfg, 'handleK()'))).toBe(true);
+  });
+
+  it('return inside begin threads through ensure (finally-return)', () => {
+    const cfg = rb.cfgOf(
+      `def f(x)\n  begin\n    return 1 if x\n    body()\n  ensure\n    cleanup()\n  end\nend\n`,
+    );
+    const ensureB = block(cfg, 'cleanup()');
+    expect(reaches(cfg, block(cfg, 'return 1'), ensureB)).toBe(true);
+    expect(edgeKinds(cfg).has('finally-return')).toBe(true);
+    expect(reaches(cfg, ensureB, cfg.exitIndex)).toBe(true);
+  });
+
+  it('retry re-enters the begin protected body (loop-back)', () => {
+    const cfg = rb.cfgOf(`def f\n  begin\n    risky()\n  rescue\n    retry\n  end\nend\n`);
+    expect(edgeKinds(cfg).has('loop-back')).toBe(true);
+    const retryB = block(cfg, 'retry');
+    const bodyB = block(cfg, 'risky()');
+    expect(hasEdge(cfg, retryB, bodyB, 'loop-back')).toBe(true);
+  });
+});
+
+describe('Ruby CfgVisitor — block jumps (next / break / redo)', () => {
+  it('next ≈ continue, break exits, redo re-enters the block body', () => {
+    // The block (`do … end`) is its own CFG; inspect it (index 1, after the method).
+    const cfgs = rb.cfgsOf(
+      `def f(xs)\n  xs.each do |n|\n    next if n == 1\n    break if n == 2\n    redo if n == 3\n    use(n)\n  end\nend\n`,
+    );
+    const blk = cfgs[1];
+    const kinds = new Set(blk.edges.map((e) => e.kind));
+    expect(kinds.has('continue')).toBe(true); // next
+    expect(kinds.has('break')).toBe(true); // break
+    expect(kinds.has('loop-back')).toBe(true); // redo re-enters the body
+    // block param |n| is a def.
+    expect(hasDef(blk, bindingIdx(blk, 'n'))).toBe(true);
+    // redo loops back to the block body entry, NOT to EXIT.
+    const redoB = blk.blocks.find((b) => b.text === 'redo')!.index;
+    expect(blk.edges.some((e) => e.from === redoB && e.kind === 'loop-back')).toBe(true);
+  });
+});
+
+describe('Ruby CfgVisitor — def/use harvest', () => {
+  it('x = 1 then use(x): def then use', () => {
+    const cfg = rb.cfgOf(`def f\n  x = 1\n  use(x)\nend\n`);
+    const x = bindingIdx(cfg, 'x');
+    expect(hasDef(cfg, x)).toBe(true);
+    expect(hasUse(cfg, x)).toBe(true);
+  });
+
+  it('multiple assignment a, b = f() defines BOTH a and b', () => {
+    const cfg = rb.cfgOf(`def f\n  a, b = load()\n  use(a, b)\nend\n`);
+    expect(hasDef(cfg, bindingIdx(cfg, 'a'))).toBe(true);
+    expect(hasDef(cfg, bindingIdx(cfg, 'b'))).toBe(true);
+    expect(hasUse(cfg, bindingIdx(cfg, 'a'))).toBe(true);
+    expect(hasUse(cfg, bindingIdx(cfg, 'b'))).toBe(true);
+  });
+
+  it('operator-assign x += 1 reads AND writes the lvalue', () => {
+    const cfg = rb.cfgOf(`def f\n  x = 1\n  x += 3\nend\n`);
+    const x = bindingIdx(cfg, 'x');
+    expect(hasDef(cfg, x)).toBe(true);
+    expect(hasUse(cfg, x)).toBe(true);
+  });
+
+  it('block param |x| defines x', () => {
+    const cfgs = rb.cfgsOf(`def f(xs)\n  xs.map { |item| item * 2 }\nend\n`);
+    const blk = cfgs[1];
+    expect(hasDef(blk, bindingIdx(blk, 'item'))).toBe(true);
+    expect(hasUse(blk, bindingIdx(blk, 'item'))).toBe(true);
+  });
+
+  it('method params (incl. defaults / *splat / **kwsplat / &block / keyword) define at ENTRY', () => {
+    const cfg = rb.cfgOf(
+      `def f(a, b = 1, *rest, key:, **opts, &blk)\n  use(a, b, rest, key, opts)\nend\n`,
+    );
+    for (const name of ['a', 'b', 'rest', 'key', 'opts', 'blk']) {
+      expect(hasDef(cfg, bindingIdx(cfg, name))).toBe(true);
+    }
+  });
+
+  it('an assignment in an && right operand is a may-def (conditional context)', () => {
+    const cfg = rb.cfgOf(`def f(a, b)\n  z = a && (w = b)\n  use(z)\nend\n`);
+    expect(hasMayDef(cfg, bindingIdx(cfg, 'w'))).toBe(true);
+    // not a must-def — the not-taken short-circuit path skips it.
+    expect(hasDef(cfg, bindingIdx(cfg, 'w'))).toBe(false);
+  });
+
+  it('instance/class/global var writes are NOT scalar local defs', () => {
+    const cfg = rb.cfgOf(`def f\n  @ivar = 1\n  @@cvar = 2\n  $g = 3\nend\n`);
+    for (const name of ['@ivar', '@@cvar', '$g']) {
+      expect((cfg.bindings ?? []).some((b) => b.name === name)).toBe(false);
+    }
+  });
+});
+
+describe('Ruby CfgVisitor — value-position branches (#2205)', () => {
+  it('x = if c then a else b end models both arms (cond-true/cond-false), binds x', () => {
+    const cfg = rb.cfgOf(`def f(c)\n  x = if c then a() else b() end\n  use(x)\nend\n`);
+    expect(edgeKinds(cfg).has('cond-true')).toBe(true);
+    expect(edgeKinds(cfg).has('cond-false')).toBe(true);
+    expect(computeControlDependence(cfg).edges.length).toBeGreaterThan(0);
+    expect(hasDef(cfg, bindingIdx(cfg, 'x'))).toBe(true);
+    expect(hasUse(cfg, bindingIdx(cfg, 'x'))).toBe(true);
+  });
+
+  it('x = case k when ... end models each arm (switch-case), binds x', () => {
+    const cfg = rb.cfgOf(
+      `def f(k)\n  x = case k\n  when 1 then a()\n  else b()\n  end\n  use(x)\nend\n`,
+    );
+    expect(edgeKinds(cfg).has('switch-case')).toBe(true);
+    expect(computeControlDependence(cfg).edges.length).toBeGreaterThan(0);
+    expect(hasDef(cfg, bindingIdx(cfg, 'x'))).toBe(true);
+  });
+
+  it('implicit return of a bare if (last expression) is modeled as a branch', () => {
+    // The idiomatic Ruby "return a conditional" — a bare if/case as the method's
+    // last expression — is statement position and already branches.
+    const cfg = rb.cfgOf(`def f(c)\n  if c then a() else b() end\nend\n`);
+    expect(edgeKinds(cfg).has('cond-true')).toBe(true);
+    expect(edgeKinds(cfg).has('cond-false')).toBe(true);
+    expect(computeControlDependence(cfg).edges.length).toBeGreaterThan(0);
+  });
+
+  it('x = if c then a end (no else) still branches — the then is control-dependent on c', () => {
+    const cfg = rb.cfgOf(`def f(c)\n  x = if c then a() end\n  use(x)\nend\n`);
+    expect(edgeKinds(cfg).has('cond-true')).toBe(true);
+    expect(computeControlDependence(cfg).edges.length).toBeGreaterThan(0);
+  });
+
+  it('a plain assignment (no branch RHS) still coalesces — no branch edges', () => {
+    const cfg = rb.cfgOf(`def f\n  x = foo()\n  use(x)\nend\n`);
+    expect(edgeKinds(cfg).has('cond-true')).toBe(false);
+    expect(edgeKinds(cfg).has('switch-case')).toBe(false);
+  });
+});
+
+describe('Ruby CfgVisitor — functionStartColumn', () => {
+  it('two same-line blocks get distinct functionStartColumn', () => {
+    const cfgs = rb.cfgsOf(`a.map { |x| x() }; b.map { |y| y() }\n`);
+    const blocks = cfgs.filter((c) => c.functionStartLine === 1);
+    expect(blocks.length).toBeGreaterThanOrEqual(2);
+    expect(blocks[0].functionStartColumn).not.toBe(blocks[1].functionStartColumn);
+  });
+});
+
+describe('Ruby CfgVisitor — production CDG probe (plan-required)', () => {
+  it('while true / nested-if gives exitReachable=true and CDG edges > 0', () => {
+    const cfg = rb.cfgOf(`def f(x)\n  while true\n    g() if x\n  end\nend\n`);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+    expect(computeControlDependence(cfg).edges.length).toBeGreaterThan(0);
+  });
+});
+
+describe('Ruby CfgVisitor — no taint sites harvested (this unit)', () => {
+  it('statements carry NO sites key (taint substrate is a later step)', () => {
+    const cfg = rb.cfgOf(`def f(cmd)\n  exec(cmd)\n  x = escape(cmd)\n  use(x)\nend\n`);
+    const anySites = cfg.blocks.some((b) =>
+      (b.statements ?? []).some((s) => (s as { sites?: unknown }).sites !== undefined),
+    );
+    expect(anySites).toBe(false);
+  });
+});
diff --git a/gitnexus/test/unit/cfg/rust-visitor.test.ts b/gitnexus/test/unit/cfg/rust-visitor.test.ts
new file mode 100644
index 000000000..c260cb302
--- /dev/null
+++ b/gitnexus/test/unit/cfg/rust-visitor.test.ts
@@ -0,0 +1,388 @@
+import { describe, it, expect } from 'vitest';
+import { createRequire } from 'node:module';
+import { createRustCfgVisitor } from '../../../src/core/ingestion/cfg/visitors/rust.js';
+import type { FunctionCfg } from '../../../src/core/ingestion/cfg/types.js';
+import {
+  makeCfgHarness,
+  type CfgHarness,
+  block,
+  edgeKinds,
+  reaches,
+  bindingIdx,
+} from '../../helpers/cfg-harness.js';
+import { isExitReachableFromAllBlocks } from '../../../src/core/ingestion/cfg/post-dominators.js';
+import { computeControlDependence } from '../../../src/core/ingestion/cfg/control-dependence.js';
+
+// U7 — the Rust CfgVisitor, one hazard per test (real-parser regression, NOT
+// snapshot-pinning). Each fixture's distinctive statement text (step(), done(),
+// one(), …) lets us locate the block for a region by text and assert the
+// control-flow topology around it. Rust is the EXPRESSION-oriented target —
+// `loop {}` (the canonical infinite loop, NO condition) is the load-bearing
+// EXIT-reachability case, and the `?` operator is an early-return edge.
+
+const rustGrammar = createRequire(import.meta.url)('tree-sitter-rust') as Parameters<
+  typeof makeCfgHarness
+>[0];
+
+const rust: CfgHarness = makeCfgHarness(rustGrammar, createRustCfgVisitor(), 'fixture.rs');
+
+const hasDef = (cfg: FunctionCfg, idx: number): boolean =>
+  cfg.blocks.some((bl) => bl.statements?.some((s) => s.defs.includes(idx)));
+const hasUse = (cfg: FunctionCfg, idx: number): boolean =>
+  cfg.blocks.some((bl) => bl.statements?.some((s) => s.uses.includes(idx)));
+const hasMayDef = (cfg: FunctionCfg, idx: number): boolean =>
+  cfg.blocks.some((bl) => bl.statements?.some((s) => (s.mayDefs ?? []).includes(idx)));
+
+describe('Rust CfgVisitor — structure', () => {
+  it('straight-line body: ENTRY → block → EXIT (seq)', () => {
+    const cfg = rust.cfgOf(`fn f() { a(); b(); c(); }`);
+    expect(cfg.blocks.filter((b) => b.kind === 'normal')).toHaveLength(1);
+    const body = block(cfg, 'a()');
+    expect(cfg.edges).toContainEqual({ from: cfg.entryIndex, to: body, kind: 'seq' });
+    expect(reaches(cfg, body, cfg.exitIndex)).toBe(true);
+  });
+
+  it('empty body: ENTRY → EXIT', () => {
+    const cfg = rust.cfgOf(`fn f() {}`);
+    expect(cfg.blocks).toHaveLength(2);
+    expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+  });
+
+  it('fn, method (impl), and closure are all CFG-bearing', () => {
+    const cfgs = rust.cfgsOf(
+      `fn f() { x(); }\nstruct S;\nimpl S { fn m(&self) { y(); } }\nfn g() { let c = || { z(); }; use_it(c); }`,
+    );
+    expect(cfgs.length).toBeGreaterThanOrEqual(4); // f, m, g, the closure
+    for (const cfg of cfgs) expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+  });
+
+  it('trait method signature / no body → undefined, never throws', () => {
+    const root = rust.parse(`trait T { fn m(&self); }`);
+    const fns = rust.collectFunctions(root);
+    for (const fn of fns) {
+      expect(() => createRustCfgVisitor().buildFunctionCfg(fn, 'f.rs')).not.toThrow();
+    }
+  });
+
+  it('two same-line fns get distinct functionStartColumn', () => {
+    const cfgs = rust.cfgsOf(`fn a() { x(); } fn b() { y(); }`);
+    expect(cfgs).toHaveLength(2);
+    expect(cfgs[0].functionStartLine).toBe(cfgs[1].functionStartLine);
+    expect(cfgs[0].functionStartColumn).not.toBe(cfgs[1].functionStartColumn);
+  });
+});
+
+describe('Rust CfgVisitor — if / else / if let', () => {
+  it('if/else if/else: every arm reaches EXIT, both senses present', () => {
+    const cfg = rust.cfgOf(
+      `fn f(x: i32) { if x > 0 { a(); } else if x < 0 { b(); } else { c(); } }`,
+    );
+    const kinds = edgeKinds(cfg);
+    expect(kinds.has('cond-true')).toBe(true);
+    expect(kinds.has('cond-false')).toBe(true);
+    expect(reaches(cfg, block(cfg, 'a()'), cfg.exitIndex)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'b()'), cfg.exitIndex)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'c()'), cfg.exitIndex)).toBe(true);
+  });
+
+  it('both arms reach a common join after the if', () => {
+    const cfg = rust.cfgOf(`fn f(x: i32) { if x > 0 { a(); } else { b(); } c(); }`);
+    const join = block(cfg, 'c()');
+    expect(reaches(cfg, block(cfg, 'a()'), join)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'b()'), join)).toBe(true);
+  });
+
+  it('if let Some(n) = opt { … } defines n (cond-true), else reachable', () => {
+    const cfg = rust.cfgOf(
+      `fn f(opt: Option<i32>) { if let Some(n) = opt { use_n(n); } else { none(); } }`,
+    );
+    expect(edgeKinds(cfg).has('cond-true')).toBe(true);
+    expect(edgeKinds(cfg).has('cond-false')).toBe(true);
+    expect(hasDef(cfg, bindingIdx(cfg, 'n'))).toBe(true);
+    expect(hasUse(cfg, bindingIdx(cfg, 'opt'))).toBe(true);
+    expect(reaches(cfg, block(cfg, 'none()'), cfg.exitIndex)).toBe(true);
+  });
+
+  it('if let with a let-chain (let PAT = e && cond) still binds + branches', () => {
+    const cfg = rust.cfgOf(`fn f(opt: Option<i32>) { if let Some(n) = opt && n > 0 { both(); } }`);
+    expect(edgeKinds(cfg).has('cond-true')).toBe(true);
+    expect(hasDef(cfg, bindingIdx(cfg, 'n'))).toBe(true);
+    expect(reaches(cfg, block(cfg, 'both()'), cfg.exitIndex)).toBe(true);
+  });
+});
+
+describe('Rust CfgVisitor — loop {} (infinite, the EXIT-reachability hazard)', () => {
+  it('loop {} with no break keeps EXIT reverse-reachable AND emits CDG > 0', () => {
+    // The plan's load-bearing CDG probe: `loop {}` is the canonical Rust infinite
+    // loop with NO condition. A structural escape edge must keep EXIT
+    // reverse-reachable or the CDG pass is silently skipped for the function.
+    const cfg = rust.cfgOf(`fn f(x: bool) { loop { if x { g(); } } }`);
+    expect(edgeKinds(cfg).has('loop-back')).toBe(true);
+    expect(edgeKinds(cfg).has('cond-false')).toBe(true); // the structural escape edge
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+    // The inner `if` is a real control point — CDG is only computed when EXIT
+    // stays reverse-reachable, so a non-empty CDG proves the escape edge works.
+    expect(computeControlDependence(cfg).edges.length).toBeGreaterThan(0);
+  });
+
+  it('loop { … break; } reaches EXIT via the break', () => {
+    const cfg = rust.cfgOf(`fn f() { loop { work(); break; } done(); }`);
+    expect(edgeKinds(cfg).has('break')).toBe(true);
+    const brk = block(cfg, 'break');
+    expect(reaches(cfg, brk, block(cfg, 'done()'))).toBe(true);
+    expect(reaches(cfg, brk, cfg.exitIndex)).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+  });
+
+  it('let v = loop { break 42; }; (break with a value) is a break edge', () => {
+    const cfg = rust.cfgOf(`fn f() { let v = loop { break 42; }; use_v(v); }`);
+    expect(edgeKinds(cfg).has('break')).toBe(true);
+    // `break 42` still terminates the loop and reaches the post-loop continuation.
+    expect(reaches(cfg, block(cfg, 'break 42'), block(cfg, 'use_v(v)'))).toBe(true);
+  });
+});
+
+describe('Rust CfgVisitor — while / while let / for', () => {
+  it('while cond {}: header + back-edge + exit', () => {
+    const cfg = rust.cfgOf(`fn f(x: bool) { while x { step(); } done(); }`);
+    const header = block(cfg, 'x');
+    const body = block(cfg, 'step()');
+    expect(cfg.edges).toContainEqual({ from: body, to: header, kind: 'loop-back' });
+    expect(edgeKinds(cfg).has('cond-true')).toBe(true);
+    expect(edgeKinds(cfg).has('cond-false')).toBe(true);
+    expect(reaches(cfg, header, block(cfg, 'done()'))).toBe(true);
+  });
+
+  it('while let Some(n) = next() { … }: header binds n (may-def), uses next', () => {
+    const cfg = rust.cfgOf(`fn f() { while let Some(n) = next() { use_n(n); } done(); }`);
+    expect(edgeKinds(cfg).has('cond-true')).toBe(true);
+    expect(edgeKinds(cfg).has('loop-back')).toBe(true);
+    // `while let` re-tests, so the binding is a MAY-def (it doesn't bind on the
+    // exit iteration), not falsely killing a prior def.
+    expect(hasMayDef(cfg, bindingIdx(cfg, 'n'))).toBe(true);
+    expect(reaches(cfg, block(cfg, 'use_n(n)'), block(cfg, 'done()'))).toBe(true);
+  });
+
+  it('for item in xs {}: loop var is a def, source a use, back-edge present', () => {
+    const cfg = rust.cfgOf(`fn f(xs: Vec<i32>) { for item in xs { use_item(item); } done(); }`);
+    const body = block(cfg, 'use_item(item)');
+    expect(edgeKinds(cfg).has('cond-true')).toBe(true);
+    expect(edgeKinds(cfg).has('loop-back')).toBe(true);
+    expect(hasDef(cfg, bindingIdx(cfg, 'item'))).toBe(true);
+    expect(hasUse(cfg, bindingIdx(cfg, 'xs'))).toBe(true);
+    const header = cfg.edges.find((e) => e.kind === 'loop-back' && e.from === body)?.to;
+    expect(header).toBeDefined();
+    expect(reaches(cfg, header!, block(cfg, 'done()'))).toBe(true);
+  });
+
+  it('while true {} still emits the structural escape edge (EXIT reachable)', () => {
+    const cfg = rust.cfgOf(`fn f() { while true { if cond() { g(); } } }`);
+    expect(edgeKinds(cfg).has('cond-false')).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+    expect(computeControlDependence(cfg).edges.length).toBeGreaterThan(0);
+  });
+});
+
+describe('Rust CfgVisitor — match (no fallthrough) + guards', () => {
+  it('match arms do NOT fall through; each body rejoins after the match', () => {
+    const cfg = rust.cfgOf(
+      `fn f(x: i32) {
+        match x {
+          1 => one(),
+          2 => two(),
+          _ => other(),
+        }
+        after();
+      }`,
+    );
+    expect(edgeKinds(cfg).has('switch-case')).toBe(true);
+    expect(reaches(cfg, block(cfg, 'one()'), block(cfg, 'after()'))).toBe(true);
+    expect(reaches(cfg, block(cfg, 'two()'), block(cfg, 'after()'))).toBe(true);
+    // arm 1 does NOT fall into arm 2 (no fallthrough).
+    expect(reaches(cfg, block(cfg, 'one()'), block(cfg, 'two()'))).toBe(false);
+  });
+
+  it('a guarded arm (n if n > 0) harvests the guard onto the dispatch block', () => {
+    const cfg = rust.cfgOf(
+      `fn f(x: i32) {
+        match x {
+          n if n > 0 => pos(n),
+          _ => other(),
+        }
+        after();
+      }`,
+    );
+    expect(edgeKinds(cfg).has('switch-case')).toBe(true);
+    // the guard test `n > 0` is a use on the dispatch header (n binds in the arm).
+    expect(hasUse(cfg, bindingIdx(cfg, 'n'))).toBe(true);
+    expect(reaches(cfg, block(cfg, 'pos(n)'), block(cfg, 'after()'))).toBe(true);
+  });
+
+  it('a match-arm pattern binding is harvested as a (may-)def from the subject (#2206)', () => {
+    const cfg = rust.cfgOf(
+      `fn f(x: E) {
+        match x {
+          Some(n) => use_n(n),
+          _ => z(),
+        }
+      }`,
+    );
+    // `n` binds from the matched subject, so it must be a (may-)def, not only a
+    // use — else taint cannot propagate from the subject into the arm body.
+    expect(hasMayDef(cfg, bindingIdx(cfg, 'n'))).toBe(true);
+    expect(hasUse(cfg, bindingIdx(cfg, 'n'))).toBe(true);
+  });
+
+  it('a match with NO `_` arm keeps a no-match path to the exit', () => {
+    const cfg = rust.cfgOf(`fn f(x: i32) { match x { 1 => a(), 2 => b(), } after(); }`);
+    expect(reaches(cfg, cfg.entryIndex, block(cfg, 'after()'))).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+  });
+});
+
+describe('Rust CfgVisitor — labeled break / continue', () => {
+  it("break 'outer from a nested loop targets the OUTER loop", () => {
+    const cfg = rust.cfgOf(
+      `fn f() {
+        'outer: for i in 0..10 {
+          for j in 0..10 {
+            if cond() { break 'outer; }
+          }
+        }
+        done();
+      }`,
+    );
+    expect(edgeKinds(cfg).has('break')).toBe(true);
+    const brk = block(cfg, "break 'outer");
+    // the labeled break reaches the post-loop `done()`, skipping BOTH loops.
+    expect(reaches(cfg, brk, block(cfg, 'done()'))).toBe(true);
+  });
+
+  it("continue 'outer re-tests the OUTER loop", () => {
+    const cfg = rust.cfgOf(
+      `fn f() {
+        'outer: for i in 0..10 {
+          for j in 0..10 {
+            if cond() { continue 'outer; }
+          }
+        }
+      }`,
+    );
+    expect(edgeKinds(cfg).has('continue')).toBe(true);
+    const outerHeader = block(cfg, 'for i in 0..10');
+    expect(reaches(cfg, block(cfg, "continue 'outer"), outerHeader)).toBe(true);
+  });
+
+  it('a plain (unlabeled) break exits the INNER loop only', () => {
+    const cfg = rust.cfgOf(
+      `fn f() {
+        for i in 0..10 {
+          inner();
+          for j in 0..10 { if cond() { break; } }
+          tail();
+        }
+        done();
+      }`,
+    );
+    const brk = block(cfg, 'break');
+    // the unlabeled break lands AFTER the inner loop, so `tail()` is reachable.
+    expect(reaches(cfg, brk, block(cfg, 'tail()'))).toBe(true);
+  });
+});
+
+describe('Rust CfgVisitor — return and the ? operator', () => {
+  it('return Some(n) flows directly to EXIT (return edge)', () => {
+    const cfg = rust.cfgOf(`fn f(n: i32) -> Option<i32> { if n > 0 { return Some(n); } Some(0) }`);
+    expect(edgeKinds(cfg).has('return')).toBe(true);
+    expect(reaches(cfg, block(cfg, 'return Some(n)'), cfg.exitIndex)).toBe(true);
+  });
+
+  it('the ? operator emits an early-return (throw) edge to EXIT', () => {
+    const cfg = rust.cfgOf(
+      `fn f(opt: Option<i32>) -> Option<i32> { let n = opt?; use_n(n); Some(n) }`,
+    );
+    expect(edgeKinds(cfg).has('throw')).toBe(true);
+    // the `?`-bearing block has a direct early-exit edge to EXIT (Err/None path)...
+    const tryBlock = block(cfg, 'opt?');
+    expect(cfg.edges).toContainEqual({ from: tryBlock, to: cfg.exitIndex, kind: 'throw' });
+    // ...while the Ok path falls through to `use_n(n)`.
+    expect(reaches(cfg, tryBlock, block(cfg, 'use_n(n)'))).toBe(true);
+  });
+});
+
+describe('Rust CfgVisitor — def/use harvest (patterns)', () => {
+  it('let x = …; use(x) → def then use', () => {
+    const cfg = rust.cfgOf(`fn f(a: i32, b: i32) { let x = a + b; use_x(x); }`);
+    const x = bindingIdx(cfg, 'x');
+    expect(hasDef(cfg, x)).toBe(true);
+    expect(hasUse(cfg, x)).toBe(true);
+  });
+
+  it('let (a, b) = pair() defines BOTH a and b (tuple destructuring)', () => {
+    const cfg = rust.cfgOf(`fn f() { let (a, b) = pair(); use_ab(a, b); }`);
+    expect(hasDef(cfg, bindingIdx(cfg, 'a'))).toBe(true);
+    expect(hasDef(cfg, bindingIdx(cfg, 'b'))).toBe(true);
+    expect(hasUse(cfg, bindingIdx(cfg, 'a'))).toBe(true);
+    expect(hasUse(cfg, bindingIdx(cfg, 'b'))).toBe(true);
+  });
+
+  it('let Point { x, y } = pt() defines both struct fields', () => {
+    const cfg = rust.cfgOf(`fn f() { let Point { x, y } = pt(); use_xy(x, y); }`);
+    expect(hasDef(cfg, bindingIdx(cfg, 'x'))).toBe(true);
+    expect(hasDef(cfg, bindingIdx(cfg, 'y'))).toBe(true);
+  });
+
+  it('let Some(n) = opt() in a let_else defines n (the tuple-struct inner binds, not the path)', () => {
+    const cfg = rust.cfgOf(
+      `fn f(opt: Option<i32>) { let Some(n) = opt() else { return; }; use_n(n); }`,
+    );
+    expect(hasDef(cfg, bindingIdx(cfg, 'n'))).toBe(true);
+    expect(hasUse(cfg, bindingIdx(cfg, 'n'))).toBe(true);
+    // the let_else `else { return; }` jumps to EXIT.
+    expect(edgeKinds(cfg).has('return')).toBe(true);
+  });
+
+  it('compound assignment (x += 1) reads AND writes the lvalue', () => {
+    const cfg = rust.cfgOf(`fn f() { let mut x = 1; x += 3; use_x(x); }`);
+    const x = bindingIdx(cfg, 'x');
+    expect(hasDef(cfg, x)).toBe(true);
+    expect(hasUse(cfg, x)).toBe(true);
+  });
+
+  it('plain assignment (x = p) defines x; a field write (obj.f = …) is NOT a scalar def', () => {
+    const cfg = rust.cfgOf(
+      `fn f(p: i32, obj: T) { let mut x = 0; x = p; obj.field = 1; use_x(x); }`,
+    );
+    expect(hasDef(cfg, bindingIdx(cfg, 'x'))).toBe(true);
+    // `obj` is used (its field is written), never a scalar def for `field`.
+    expect(hasUse(cfg, bindingIdx(cfg, 'obj'))).toBe(true);
+  });
+
+  it('the wildcard `_` binds nothing', () => {
+    const cfg = rust.cfgOf(`fn f() { let _ = compute(); done(); }`);
+    expect((cfg.bindings ?? []).some((b) => b.name === '_')).toBe(false);
+  });
+
+  it('a closure body is opaque to the enclosing function harvest (own CFG)', () => {
+    const cfgs = rust.cfgsOf(
+      `fn f() { let cb = || { let inner = 1; use_inner(inner); }; call(cb); }`,
+    );
+    // The OUTER fn has a `cb` binding but NOT `inner` (the closure body is opaque).
+    const outer = cfgs.find((c) => (c.bindings ?? []).some((b) => b.name === 'cb'));
+    expect(outer).toBeDefined();
+    expect((outer!.bindings ?? []).some((b) => b.name === 'inner')).toBe(false);
+    // The closure has its OWN CFG where `inner` is a real def.
+    const inner = cfgs.find((c) => (c.bindings ?? []).some((b) => b.name === 'inner'));
+    expect(inner).toBeDefined();
+    expect(hasDef(inner!, bindingIdx(inner!, 'inner'))).toBe(true);
+  });
+});
+
+describe('Rust CfgVisitor — graceful degradation', () => {
+  it('an unmodeled / malformed shape never throws (returns a partial CFG)', () => {
+    // Macros are opaque token trees; any control flow they expand is invisible,
+    // but the visitor must still produce a valid partial CFG, never throw.
+    const cfg = rust.cfgOf(`fn f() { println!("{}", compute()); vec![1, 2, 3]; done(); }`);
+    expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+  });
+});
diff --git a/gitnexus/test/unit/cfg/swift-visitor.test.ts b/gitnexus/test/unit/cfg/swift-visitor.test.ts
new file mode 100644
index 000000000..023596afc
--- /dev/null
+++ b/gitnexus/test/unit/cfg/swift-visitor.test.ts
@@ -0,0 +1,345 @@
+import { describe, it, expect } from 'vitest';
+import { requireVendoredGrammar } from '../../../src/core/tree-sitter/vendored-grammars.js';
+import { createSwiftCfgVisitor } from '../../../src/core/ingestion/cfg/visitors/swift.js';
+import {
+  makeCfgHarness,
+  type CfgHarness,
+  block,
+  edgeKinds,
+  reaches,
+  reachable,
+  bindingIdx,
+} from '../../helpers/cfg-harness.js';
+import { isExitReachableFromAllBlocks } from '../../../src/core/ingestion/cfg/post-dominators.js';
+import { computeControlDependence } from '../../../src/core/ingestion/cfg/control-dependence.js';
+
+// The Swift CfgVisitor, one hazard per test (real-parser regression, NOT
+// snapshot-pinning). Swift's grammar is VENDORED (not an npm package): the
+// grammar loads from vendor/ via `requireVendoredGrammar('tree-sitter-swift')`,
+// exactly like the C/C++ test loads the vendored tree-sitter-c. Each fixture's
+// distinctive statement text (step(), done(), handle(e), …) lets us locate the
+// block for a region by text and assert the control-flow topology around it.
+
+const swiftGrammar = requireVendoredGrammar('tree-sitter-swift') as Parameters<
+  typeof makeCfgHarness
+>[0];
+
+const swift: CfgHarness = makeCfgHarness(swiftGrammar, createSwiftCfgVisitor(), 'fixture.swift');
+
+describe('Swift CfgVisitor — structure', () => {
+  it('straight-line body: ENTRY → block → EXIT (seq)', () => {
+    const cfg = swift.cfgOf(`func f() { a(); b(); c() }`);
+    expect(cfg.blocks.filter((b) => b.kind === 'normal')).toHaveLength(1);
+    const body = block(cfg, 'a()');
+    expect(cfg.edges).toContainEqual({ from: cfg.entryIndex, to: body, kind: 'seq' });
+    expect(reaches(cfg, body, cfg.exitIndex)).toBe(true);
+  });
+
+  it('empty body: ENTRY → EXIT', () => {
+    const cfg = swift.cfgOf(`func f() {}`);
+    expect(cfg.blocks).toHaveLength(2);
+    expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+  });
+
+  it('an unmodeled shape produces a graceful partial CFG (never throws)', () => {
+    // A protocol method requirement (`func f()`) has no body — buildFunctionCfg
+    // must return undefined rather than throw; a real function still builds.
+    const root = swift.parse(`protocol P { func f() }`);
+    const fns = swift.collectFunctions(root);
+    for (const fn of fns) {
+      expect(() => createSwiftCfgVisitor().buildFunctionCfg(fn, 'p.swift')).not.toThrow();
+    }
+    // A normal function still builds a well-formed CFG.
+    const cfg = swift.cfgOf(`func g() { x() }`);
+    expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+  });
+
+  it('init and deinit are CFG-bearing functions', () => {
+    const cfgs = swift.cfgsOf(`class C { init(x: Int) { self.x = x } ; deinit { cleanup() } }`);
+    expect(cfgs).toHaveLength(2);
+    for (const cfg of cfgs) expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+  });
+});
+
+describe('Swift CfgVisitor — branching', () => {
+  it('if/else: cond-true to then, cond-false to else, both reach the join', () => {
+    const cfg = swift.cfgOf(`func f(x: Int) { if x > 0 { a() } else { b() } ; c() }`);
+    const kinds = edgeKinds(cfg);
+    expect(kinds.has('cond-true')).toBe(true);
+    expect(kinds.has('cond-false')).toBe(true);
+    const join = block(cfg, 'c()');
+    expect(reaches(cfg, block(cfg, 'a()'), join)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'b()'), join)).toBe(true);
+  });
+
+  it('else-if chain branches each condition', () => {
+    const cfg = swift.cfgOf(
+      `func f(x: Int) { if x == 1 { a() } else if x == 2 { b() } else { c() } ; d() }`,
+    );
+    const join = block(cfg, 'd()');
+    expect(reaches(cfg, block(cfg, 'a()'), join)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'b()'), join)).toBe(true);
+    expect(reaches(cfg, block(cfg, 'c()'), join)).toBe(true);
+  });
+
+  it('if let binds the optional and reaches both arms', () => {
+    const cfg = swift.cfgOf(`func f(opt: Int?) { if let y = opt { use(y) } ; after() }`);
+    // `y` is a binding defined by the optional binding.
+    const y = bindingIdx(cfg, 'y');
+    const defined = cfg.blocks.some((bl) => bl.statements?.some((s) => s.defs.includes(y)));
+    expect(defined).toBe(true);
+    expect(edgeKinds(cfg).has('cond-true')).toBe(true);
+    expect(reachable(cfg, block(cfg, 'use(y)'))).toBe(true);
+    expect(reachable(cfg, block(cfg, 'after()'))).toBe(true);
+  });
+});
+
+describe('Swift CfgVisitor — guard', () => {
+  it('guard let ... else { return }: the else DIVERGES, the body CONTINUES', () => {
+    const cfg = swift.cfgOf(
+      `func f(opt: Int?) -> Int { guard let y = opt else { return 0 } ; use(y) ; return y }`,
+    );
+    const header = block(cfg, 'guard');
+    const elseBlk = block(cfg, 'return 0');
+    // The else is the cond-false (diverging) arm and returns.
+    expect(cfg.edges).toContainEqual({ from: header, to: elseBlk, kind: 'cond-false' });
+    expect(reaches(cfg, elseBlk, cfg.exitIndex)).toBe(true);
+    // The guarded body continues straight-line on the success path.
+    expect(reaches(cfg, header, block(cfg, 'use(y)'))).toBe(true);
+    // `y` is bound by the guard and used after it.
+    const y = bindingIdx(cfg, 'y');
+    expect(cfg.blocks.some((bl) => bl.statements?.some((s) => s.defs.includes(y)))).toBe(true);
+    expect(cfg.blocks.some((bl) => bl.statements?.some((s) => s.uses.includes(y)))).toBe(true);
+  });
+
+  it('guard case .some(let v) binds v as a real local def, not a synthetic global (#2206)', () => {
+    const cfg = swift.cfgOf(
+      `func f(e: E) { guard case .some(let v) = e else { return } ; use(v) }`,
+    );
+    const v = bindingIdx(cfg, 'v');
+    // The case-pattern binder must be a real local with a def (or may-def) from
+    // the matched subject — previously it resolved to a synthetic global with only
+    // a use, which silently breaks taint propagation from the subject.
+    const defined = cfg.blocks.some((bl) =>
+      bl.statements?.some((s) => s.defs.includes(v) || (s.mayDefs ?? []).includes(v)),
+    );
+    expect(defined).toBe(true);
+    expect(cfg.blocks.some((bl) => bl.statements?.some((s) => s.uses.includes(v)))).toBe(true);
+  });
+});
+
+describe('Swift CfgVisitor — loops', () => {
+  it('for-in: header + body + loop-back + exit', () => {
+    const cfg = swift.cfgOf(`func f() { for item in items { step() } ; done() }`);
+    const header = block(cfg, 'for item in items');
+    const body = block(cfg, 'step()');
+    expect(cfg.edges).toContainEqual({ from: body, to: header, kind: 'loop-back' });
+    expect(edgeKinds(cfg).has('cond-true')).toBe(true);
+    expect(reaches(cfg, header, block(cfg, 'done()'))).toBe(true);
+    // The loop pattern binds `item`.
+    const item = bindingIdx(cfg, 'item');
+    expect(cfg.blocks.some((bl) => bl.statements?.some((s) => s.defs.includes(item)))).toBe(true);
+  });
+
+  it('while: header tests first, body loops back', () => {
+    const cfg = swift.cfgOf(`func f() { while cond() { step() } ; done() }`);
+    const header = block(cfg, 'while cond()');
+    const body = block(cfg, 'step()');
+    expect(cfg.edges).toContainEqual({ from: body, to: header, kind: 'loop-back' });
+    expect(edgeKinds(cfg).has('cond-true')).toBe(true);
+    expect(reaches(cfg, header, block(cfg, 'done()'))).toBe(true);
+  });
+
+  it('repeat-while runs the body BEFORE testing, then loops back from the bottom', () => {
+    const cfg = swift.cfgOf(`func f() { repeat { step() } while cond() ; done() }`);
+    const body = block(cfg, 'step()');
+    const cond = block(cfg, 'while cond()');
+    expect(reaches(cfg, cfg.entryIndex, body)).toBe(true); // body runs first
+    expect(reaches(cfg, body, cond)).toBe(true); // condition tests at the bottom
+    expect(cfg.edges).toContainEqual({ from: cond, to: body, kind: 'loop-back' });
+    expect(reaches(cfg, cond, block(cfg, 'done()'))).toBe(true);
+  });
+
+  it('while true {} keeps EXIT reverse-reachable AND emits CDG > 0', () => {
+    // The inner `if` is a real control point; assert through the production
+    // post-dom/CDG passes (matching go/python/ruby/rust/vue) — CDG is only
+    // computed when EXIT stays reverse-reachable, so a non-empty CDG proves the
+    // structural exit-escape edge keeps the function CDG-bearing.
+    const cfg = swift.cfgOf(`func f(x: Bool) { while true { if x { g() } } }`);
+    expect(edgeKinds(cfg).has('cond-false')).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+    expect(computeControlDependence(cfg).edges.length).toBeGreaterThan(0);
+  });
+
+  it('repeat {} while true keeps EXIT reverse-reachable', () => {
+    const cfg = swift.cfgOf(`func f() { repeat { work() } while true }`);
+    expect(edgeKinds(cfg).has('cond-false')).toBe(true);
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(true);
+    expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+  });
+});
+
+describe('Swift CfgVisitor — switch (no implicit fallthrough)', () => {
+  it('a case without fallthrough rejoins after the switch (no fall into next case)', () => {
+    const cfg = swift.cfgOf(`func f(x: Int) {
+      switch x {
+      case 1: one()
+      case 2: two()
+      default: other()
+      }
+      after()
+    }`);
+    expect(edgeKinds(cfg).has('switch-case')).toBe(true);
+    // case 1 does NOT fall into case 2 (Swift has no implicit fallthrough).
+    expect(reaches(cfg, block(cfg, 'one()'), block(cfg, 'two()'))).toBe(false);
+    // every case reaches the post-switch continuation.
+    expect(reaches(cfg, block(cfg, 'one()'), block(cfg, 'after()'))).toBe(true);
+    expect(reaches(cfg, block(cfg, 'two()'), block(cfg, 'after()'))).toBe(true);
+  });
+
+  it('an explicit `fallthrough` spills into the next case', () => {
+    const cfg = swift.cfgOf(`func f(x: Int) {
+      switch x {
+      case 1:
+        one()
+        fallthrough
+      case 2:
+        two()
+      default:
+        other()
+      }
+      after()
+    }`);
+    expect(edgeKinds(cfg).has('fallthrough')).toBe(true);
+    // case 1 (explicit fallthrough) FALLS THROUGH into case 2.
+    expect(reaches(cfg, block(cfg, 'one()'), block(cfg, 'two()'))).toBe(true);
+  });
+
+  it('a `where` guard on a case is harvested onto the dispatch block', () => {
+    const cfg = swift.cfgOf(`func f(x: Int) {
+      switch x {
+      case let n where n > 0: pos()
+      default: other()
+      }
+    }`);
+    // `x` (the subject) is used at the dispatch; the where guard uses are harvested.
+    expect(edgeKinds(cfg).has('switch-case')).toBe(true);
+    expect(reachable(cfg, block(cfg, 'pos()'))).toBe(true);
+    expect(reachable(cfg, block(cfg, 'other()'))).toBe(true);
+  });
+});
+
+describe('Swift CfgVisitor — do/catch (error handling)', () => {
+  it('do/catch: a throw edge runs from each protected block to the handler', () => {
+    const cfg = swift.cfgOf(`func f() {
+      do { try risky() ; deeper() } catch let e { handle(e) }
+      after()
+    }`);
+    expect(edgeKinds(cfg).has('throw')).toBe(true);
+    const handler = block(cfg, 'handle(e)');
+    expect(reaches(cfg, block(cfg, 'try risky()'), handler)).toBe(true);
+    // after() is still reachable (handler completion rejoins).
+    expect(reachable(cfg, block(cfg, 'after()'))).toBe(true);
+    // the catch binds the error `e`.
+    const e = bindingIdx(cfg, 'e');
+    expect(cfg.blocks.some((bl) => bl.statements?.some((s) => s.defs.includes(e)))).toBe(true);
+  });
+
+  it('a throw with NO enclosing do/catch routes to EXIT and ends its block', () => {
+    const cfg = swift.cfgOf(`func f(x: Bool) throws { if x { throw E.bad } ; done() }`);
+    const thr = block(cfg, 'throw E.bad');
+    expect(cfg.edges).toContainEqual({ from: thr, to: cfg.exitIndex, kind: 'throw' });
+    // throw terminates its block — control does not fall into done() from it.
+    expect(reaches(cfg, thr, block(cfg, 'done()'))).toBe(false);
+    expect(reachable(cfg, block(cfg, 'done()'))).toBe(true); // via the if false branch
+  });
+
+  it('multi-catch: EVERY catch handler is reachable from ENTRY (#2195)', () => {
+    // The protected body can throw an error matching ANY clause, so the 2nd..Nth
+    // catch must not be orphaned — the bug routed the throw edge only to the
+    // first handler, leaving later handlers unreachable from ENTRY.
+    const cfg = swift.cfgOf(`func f() { do { try r() } catch A { ha() } catch { hb() } }`);
+    expect(reachable(cfg, block(cfg, 'ha()'))).toBe(true);
+    expect(reachable(cfg, block(cfg, 'hb()'))).toBe(true);
+    // the protected `try r()` reaches both handlers.
+    expect(reaches(cfg, block(cfg, 'try r()'), block(cfg, 'hb()'))).toBe(true);
+  });
+});
+
+describe('Swift CfgVisitor — defer (LIFO scope-exit)', () => {
+  it('a defer runs at scope exit: the return threads through the deferred block', () => {
+    const cfg = swift.cfgOf(`func f() { defer { cleanup() } ; work() ; return }`);
+    const kinds = edgeKinds(cfg);
+    // The deferred completion threads as return + finally-return.
+    expect(kinds.has('return')).toBe(true);
+    const deferBlk = block(cfg, 'defer { cleanup() }');
+    // The deferred block reaches EXIT (it runs on scope exit).
+    expect(reaches(cfg, deferBlk, cfg.exitIndex)).toBe(true);
+    // The explicit return reaches the deferred block.
+    const ret = block(cfg, 'return');
+    expect(reaches(cfg, ret, deferBlk)).toBe(true);
+  });
+});
+
+describe('Swift CfgVisitor — labeled break/continue', () => {
+  it('labeled break targets the OUTER loop, not the inner one', () => {
+    const cfg = swift.cfgOf(`func f() {
+      outer: for i in xs {
+        for j in ys { break outer }
+      }
+      done()
+    }`);
+    const brk = block(cfg, 'break outer');
+    expect(edgeKinds(cfg).has('break')).toBe(true);
+    // the labeled break escapes BOTH loops and reaches done().
+    expect(reaches(cfg, brk, block(cfg, 'done()'))).toBe(true);
+  });
+});
+
+describe('Swift CfgVisitor — def/use harvest', () => {
+  it('let x = compute(); use(x) produces a def of x and a use in the consumer', () => {
+    const cfg = swift.cfgOf(`func f() { let x = compute() ; use(x) }`);
+    const x = bindingIdx(cfg, 'x');
+    expect(cfg.blocks.some((bl) => bl.statements?.some((s) => s.defs.includes(x)))).toBe(true);
+    expect(cfg.blocks.some((bl) => bl.statements?.some((s) => s.uses.includes(x)))).toBe(true);
+  });
+
+  it('tuple destructuring `let (a, b) = pair` defines both names', () => {
+    const cfg = swift.cfgOf(`func f(pair: (Int, Int)) { let (a, b) = pair ; use(a) ; use(b) }`);
+    for (const name of ['a', 'b']) {
+      const idx = bindingIdx(cfg, name);
+      expect(cfg.blocks.some((bl) => bl.statements?.some((s) => s.defs.includes(idx)))).toBe(true);
+    }
+  });
+
+  it('closures are collected as their own CFG (opaque in the enclosing function)', () => {
+    const cfgs = swift.cfgsOf(`func f() { items.forEach { item in if item > 0 { use(item) } } }`);
+    // f and the closure are both CFG-bearing.
+    expect(cfgs.length).toBeGreaterThanOrEqual(2);
+    for (const cfg of cfgs) expect(reaches(cfg, cfg.entryIndex, cfg.exitIndex)).toBe(true);
+  });
+
+  it('switch `case let n` binds n as a (may-)def, not a synthetic global (#2195 P2)', () => {
+    const cfg = swift.cfgOf(
+      `func f(x: Int) { switch x { case let n where n > 0: use(n); default: break } }`,
+    );
+    const n = bindingIdx(cfg, 'n');
+    // The case value-binding defines n (a may-def — the case may not match);
+    // the bug left n a synthetic module binding with no def at all.
+    const defined = cfg.blocks.some((bl) =>
+      bl.statements?.some((s) => s.defs.includes(n) || (s.mayDefs ?? []).includes(n)),
+    );
+    expect(defined).toBe(true);
+    // use(n) (and the `where n > 0` guard) read n.
+    expect(cfg.blocks.some((bl) => bl.statements?.some((s) => s.uses.includes(n)))).toBe(true);
+  });
+});
+
+describe('Swift CfgVisitor — functionStartColumn', () => {
+  it('two same-line functions get distinct functionStartColumn', () => {
+    const cfgs = swift.cfgsOf(`func a() { x() }; func b() { y() }`);
+    expect(cfgs).toHaveLength(2);
+    expect(cfgs[0].functionStartLine).toBe(cfgs[1].functionStartLine); // same line
+    expect(cfgs[0].functionStartColumn).not.toBe(cfgs[1].functionStartColumn); // distinct column
+  });
+});
diff --git a/gitnexus/test/unit/cfg/synthetic-escape.test.ts b/gitnexus/test/unit/cfg/synthetic-escape.test.ts
new file mode 100644
index 000000000..ee02e01c0
--- /dev/null
+++ b/gitnexus/test/unit/cfg/synthetic-escape.test.ts
@@ -0,0 +1,357 @@
+import { describe, it, expect } from 'vitest';
+import {
+  augmentForPostDom,
+  computeScc,
+  wasAugmented,
+} from '../../../src/core/ingestion/cfg/synthetic-escape.js';
+import {
+  computePostDominators,
+  isExitReachableFromAllBlocks,
+} from '../../../src/core/ingestion/cfg/post-dominators.js';
+import { computeControlDependence } from '../../../src/core/ingestion/cfg/control-dependence.js';
+import type {
+  BasicBlockData,
+  CfgEdgeData,
+  CfgEdgeKind,
+  FunctionCfg,
+} from '../../../src/core/ingestion/cfg/types.js';
+
+// #2197 U1 — the synthetic-escape pass for CDG soundness. Hand-built CFGs (no
+// tree-sitter). The pass restores EXIT reverse-reachability for a genuine
+// exit-unreachable CYCLE (an unconditional `goto`-cycle / infinite loop) so the
+// post-dom / CDG pass runs, WITHOUT masking construction errors (a branch-less
+// trapping spin / a dangling dead-end block stays skipped) or perturbing sound
+// functions (a no-op referential identity for terminating fns + escaped loops).
+//
+// The exact-edge-set pin is load-bearing: a WRONG escape representative still
+// yields `CDG>0` and still passes the AC2 post-dominance property test, so each
+// regression asserts the EXACT control-dependence set, not merely a non-empty one.
+
+// ── hand-built CFG helper (edges carry a kind so CDG labels can be asserted) ──
+
+function mkCfg(
+  blockCount: number,
+  edges: [number, number, CfgEdgeKind?][],
+  opts: { entry?: number; exit?: number } = {},
+): FunctionCfg {
+  const entry = opts.entry ?? 0;
+  const exit = opts.exit ?? blockCount - 1;
+  const blocks: BasicBlockData[] = Array.from({ length: blockCount }, (_, i) => ({
+    index: i,
+    startLine: i + 1,
+    endLine: i + 1,
+    text: '',
+    kind: i === entry ? 'entry' : i === exit ? 'exit' : 'normal',
+  }));
+  const cfgEdges: CfgEdgeData[] = edges.map(([from, to, kind]) => ({
+    from,
+    to,
+    kind: kind ?? 'seq',
+  }));
+  return {
+    filePath: 't.ts',
+    functionStartLine: 1,
+    functionStartColumn: 0,
+    entryIndex: entry,
+    exitIndex: exit,
+    blocks,
+    edges: cfgEdges,
+  };
+}
+
+const cdgSet = (cfg: FunctionCfg): string[] =>
+  computeControlDependence(cfg)
+    .edges.map((e) => `${e.controllerBlock}->${e.dependentBlock}:${e.label}`)
+    .sort();
+
+const syntheticEdges = (cfg: FunctionCfg, view: FunctionCfg): string[] =>
+  view === cfg ? [] : view.edges.slice(cfg.edges.length).map((e) => `${e.from}->${e.to}`);
+
+/**
+ * The repro CFG, identical across C / C++ / C# / Go (verified by probe):
+ *
+ *   void handler(int a){ start: if (a > 0) { work(); } goto start; }
+ *
+ *   ENTRY=0  EXIT=1  b2 = `(a>0)` predicate  b3 = `work()`  b4 = `goto start`
+ *   0→2 seq | 2→3 cond-true | 2→4 seq (false arm skips work) | 3→4 seq | 4→2 seq
+ *
+ * EXIT(1) has no predecessor — the back-edge 4→2 traps blocks 2,3,4 in a cycle
+ * and EXIT is non-reverse-reachable, so without the pass `emitFileCdg` withholds
+ * ALL control dependence for the whole function.
+ */
+const reproGotoCycle = (): FunctionCfg =>
+  mkCfg(
+    5,
+    [
+      [0, 2, 'seq'],
+      [2, 3, 'cond-true'],
+      [2, 4, 'seq'],
+      [3, 4, 'seq'],
+      [4, 2, 'seq'],
+    ],
+    { entry: 0, exit: 1 },
+  );
+
+describe('computeScc — pure deterministic SCC routine', () => {
+  it('partitions a simple cycle and singletons; member lists are ascending', () => {
+    // 0 → 1 ⇄ 2 → 3 ; SCCs: {0}, {1,2}, {3}
+    const succ = [[1], [2], [1, 3], []];
+    const { compOf, members } = computeScc(succ, 4);
+    expect(compOf[1]).toBe(compOf[2]); // 1 and 2 share a component
+    expect(compOf[0]).not.toBe(compOf[1]);
+    expect(compOf[3]).not.toBe(compOf[1]);
+    // the {1,2} component lists members ascending
+    const cyc = members[compOf[1]];
+    expect([...cyc]).toEqual([1, 2]);
+  });
+
+  it('is deterministic across runs (sorted adjacency)', () => {
+    const succ = [[2, 1], [2], [1, 3], [4], []];
+    const a = computeScc(succ, 5);
+    const b = computeScc(succ, 5);
+    expect(a.compOf).toEqual(b.compOf);
+    expect(a.members.map((m) => [...m])).toEqual(b.members.map((m) => [...m]));
+  });
+
+  it('handles a self-loop as a singleton component', () => {
+    const succ = [[1], [1], []]; // 1 self-loops
+    const { members } = computeScc(succ, 3);
+    expect(members.some((m) => m.length === 1 && m[0] === 1)).toBe(true);
+  });
+});
+
+describe('augmentForPostDom — the goto-cycle repro (exact CDG edge set)', () => {
+  it('bridges the cycle so EXIT is reachable and the EXACT CDG set is emitted', () => {
+    const cfg = reproGotoCycle();
+    // Before the pass: EXIT is unreachable from the trapped blocks.
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(false);
+
+    const view = augmentForPostDom(cfg);
+    expect(wasAugmented(cfg, view)).toBe(true);
+    // ONE synthetic escape, from the loop's controlling predicate (block 2) to
+    // EXIT (block 1) — the `if (a>0)` branch is the only control point.
+    expect(syntheticEdges(cfg, view)).toEqual(['2->1']);
+    expect(isExitReachableFromAllBlocks(view)).toBe(true);
+
+    // EXACT source-faithful CDG set — NOT merely `CDG>0` (a wrong representative
+    // would still give a non-empty set). The `if` predicate (block 2) controls:
+    //   work() (b3) on its TRUE arm;
+    //   the goto (b4), reached on BOTH arms (2→3→4 and 2→4) → T and F;
+    //   its OWN re-execution (b2), reached on both arms via the back-edge → T,F.
+    expect(cdgSet(view)).toEqual(['2->2:F', '2->2:T', '2->3:T', '2->4:F', '2->4:T']);
+  });
+
+  it('the controller is the branch predicate, not an arbitrary cycle member', () => {
+    const view = augmentForPostDom(reproGotoCycle());
+    const synth = view.edges.slice(reproGotoCycle().edges.length);
+    expect(synth).toHaveLength(1);
+    // block 2 is the only block with ≥2 successors (the if-branch) — it must be
+    // the escape source, not b3/b4 (the straight-line body / goto).
+    expect(synth[0].from).toBe(2);
+    expect(synth[0].to).toBe(1); // EXIT
+  });
+});
+
+describe('augmentForPostDom — no-op for sound functions (referential identity)', () => {
+  it('a terminating straight-line function is returned UNCHANGED (zero synthetic edges)', () => {
+    const cfg = mkCfg(3, [
+      [0, 1, 'seq'],
+      [1, 2, 'seq'],
+    ]);
+    const view = augmentForPostDom(cfg);
+    expect(view).toBe(cfg); // referential no-op
+    expect(wasAugmented(cfg, view)).toBe(false);
+  });
+
+  it('an ordinary escaped while-loop is returned UNCHANGED', () => {
+    // 0(entry) → 1(header); 1 → 2(body, T); 2 → 1 (back); 1 → 3(exit, F escape)
+    const cfg = mkCfg(
+      4,
+      [
+        [0, 1, 'seq'],
+        [1, 2, 'cond-true'],
+        [2, 1, 'loop-back'],
+        [1, 3, 'cond-false'],
+      ],
+      { entry: 0, exit: 3 },
+    );
+    const view = augmentForPostDom(cfg);
+    expect(view).toBe(cfg);
+    // post-dom + CDG identical with and without the pass (the pass did nothing).
+    expect(computePostDominators(view).ipdom).toEqual(computePostDominators(cfg).ipdom);
+    expect(cdgSet(view)).toEqual(cdgSet(cfg));
+  });
+
+  it('a for-loop with a body branch is returned UNCHANGED', () => {
+    // header(1) → body(2) → if(3) → {then(4)|else(5)} → back to header; 1→6 exit
+    const cfg = mkCfg(
+      7,
+      [
+        [0, 1, 'seq'],
+        [1, 2, 'cond-true'],
+        [2, 3, 'seq'],
+        [3, 4, 'cond-true'],
+        [3, 5, 'cond-false'],
+        [4, 1, 'loop-back'],
+        [5, 1, 'loop-back'],
+        [1, 6, 'cond-false'],
+      ],
+      { entry: 0, exit: 6 },
+    );
+    expect(augmentForPostDom(cfg)).toBe(cfg);
+  });
+});
+
+describe('augmentForPostDom — multi-SCC diverging switch (batch bridge)', () => {
+  it('bridges BOTH exit-less SCCs in one batch → exit-reachable, CDG emitted', () => {
+    // dispatch(2) → arm A goto-loop {3,4,5} | arm B goto-loop {6,7,8}; EXIT=1.
+    // Each arm is a separate exit-less SCC with its own `if` branch (3 and 6).
+    const cfg = mkCfg(
+      9,
+      [
+        [0, 2, 'seq'],
+        [2, 3, 'switch-case'],
+        [2, 6, 'switch-case'],
+        [3, 4, 'cond-true'],
+        [3, 5, 'seq'],
+        [4, 5, 'seq'],
+        [5, 3, 'seq'],
+        [6, 7, 'cond-true'],
+        [6, 8, 'seq'],
+        [7, 8, 'seq'],
+        [8, 6, 'seq'],
+      ],
+      { entry: 0, exit: 1 },
+    );
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(false);
+    const view = augmentForPostDom(cfg);
+    // both arm predicates (3 and 6) escape to EXIT — neither arm left trapped.
+    expect(syntheticEdges(cfg, view).sort()).toEqual(['3->1', '6->1']);
+    expect(isExitReachableFromAllBlocks(view)).toBe(true);
+    expect(computeControlDependence(view).edges.length).toBeGreaterThan(0);
+  });
+});
+
+describe('augmentForPostDom — spine/ENTRY in the unreachable closure is not mis-skipped', () => {
+  it('straight-line statements before the goto label still reach EXIT after the pass', () => {
+    // ENTRY 0 → stmtA(2) → stmtB(3) → predicate(4) → {work(5)|goto(6)} → back(4)
+    // The spine {0,2,3} is exit-unreachable too (it feeds the trap), but it must
+    // NOT be flagged an anomaly — it reaches EXIT for free through the bridge.
+    const cfg = mkCfg(
+      7,
+      [
+        [0, 2, 'seq'],
+        [2, 3, 'seq'],
+        [3, 4, 'seq'],
+        [4, 5, 'cond-true'],
+        [4, 6, 'seq'],
+        [5, 6, 'seq'],
+        [6, 4, 'seq'],
+      ],
+      { entry: 0, exit: 1 },
+    );
+    const view = augmentForPostDom(cfg);
+    expect(syntheticEdges(cfg, view)).toEqual(['4->1']); // bridge at the predicate
+    expect(isExitReachableFromAllBlocks(view)).toBe(true); // spine + ENTRY all reach EXIT
+  });
+});
+
+describe('augmentForPostDom — anti-masking (R2): construction anomalies stay skipped', () => {
+  it('a dangling dead-end block (not in a cycle, no control point) is NOT bridged', () => {
+    // ENTRY 0 → dead-end(1) with no out-edge; EXIT 2 unreachable from ENTRY.
+    // No control point in the trapped region → not bridged → still unsound.
+    const cfg = mkCfg(3, [[0, 1, 'seq']], { entry: 0, exit: 2 });
+    const view = augmentForPostDom(cfg);
+    expect(view).toBe(cfg); // refused to bridge
+    expect(isExitReachableFromAllBlocks(view)).toBe(false); // skip path stays correct
+  });
+
+  it('a branch-less infinite spin (the disconnected-EXIT fixture shape) is NOT bridged', () => {
+    // ENTRY 0 → 1 ⇄ 2 (branch-less spin); EXIT 3 disconnected. No control point
+    // anywhere in the trap → refuse to bridge (indistinguishable from a real
+    // construction error) → the existing soundness gate skips it.
+    const cfg = mkCfg(
+      4,
+      [
+        [0, 1, 'seq'],
+        [1, 2, 'seq'],
+        [2, 1, 'seq'],
+      ],
+      { entry: 0, exit: 3 },
+    );
+    const view = augmentForPostDom(cfg);
+    expect(view).toBe(cfg);
+    expect(isExitReachableFromAllBlocks(view)).toBe(false);
+  });
+
+  it('a MIXED cycle + separate dead-end: cycle bridged, residual dead-end keeps the whole fn skipped', () => {
+    // ENTRY 0 branches to a recoverable goto-cycle {2,3,4} (branch at 2) AND to a
+    // separate dead-end block 5. The cycle is bridged, but block 5 stays
+    // exit-unreachable → the all-or-nothing gate skips the whole function (the
+    // documented granularity decision: recover the cycle, surface the residual).
+    const cfg = mkCfg(
+      6,
+      [
+        [0, 2, 'cond-true'],
+        [0, 5, 'cond-false'],
+        [2, 3, 'cond-true'],
+        [2, 4, 'seq'],
+        [3, 4, 'seq'],
+        [4, 2, 'seq'],
+      ],
+      { entry: 0, exit: 1 },
+    );
+    const view = augmentForPostDom(cfg);
+    // the cycle WAS bridged (block 2 → EXIT)...
+    expect(syntheticEdges(cfg, view)).toEqual(['2->1']);
+    // ...but block 5 is still exit-unreachable → the whole function is skipped.
+    expect(isExitReachableFromAllBlocks(view)).toBe(false);
+  });
+});
+
+describe('augmentForPostDom — irreducible 2-entry loop (characterization)', () => {
+  it('bridges the irreducible cycle reachability-sound (control point feeds it from outside)', () => {
+    // ENTRY 0 → branch(2) → {3 | 4}; 3 ⇄ 4 form an irreducible 2-entry cycle with
+    // NO internal branch. The control point (block 2) sits OUTSIDE the cycle, so
+    // the escape attaches to the lowest-index cycle member (block 3). EXIT=1.
+    const cfg = mkCfg(
+      5,
+      [
+        [0, 2, 'seq'],
+        [2, 3, 'cond-true'],
+        [2, 4, 'seq'],
+        [3, 4, 'seq'],
+        [4, 3, 'seq'],
+      ],
+      { entry: 0, exit: 1 },
+    );
+    expect(isExitReachableFromAllBlocks(cfg)).toBe(false);
+    const view = augmentForPostDom(cfg);
+    expect(syntheticEdges(cfg, view)).toEqual(['3->1']); // lowest-index member
+    expect(isExitReachableFromAllBlocks(view)).toBe(true);
+  });
+});
+
+describe('augmentForPostDom — persistence (analysis-only, never mutates input)', () => {
+  it('does not mutate the input cfg.edges', () => {
+    const cfg = reproGotoCycle();
+    const before = cfg.edges.map((e) => `${e.from}->${e.to}:${e.kind}`);
+    const beforeLen = cfg.edges.length;
+    const view = augmentForPostDom(cfg);
+    // the view carries the extra edge...
+    expect(view.edges.length).toBe(beforeLen + 1);
+    // ...but the ORIGINAL edges array is byte-identical (length + contents).
+    expect(cfg.edges.length).toBe(beforeLen);
+    expect(cfg.edges.map((e) => `${e.from}->${e.to}:${e.kind}`)).toEqual(before);
+    // and the view is a distinct array (not aliasing the input).
+    expect(view.edges).not.toBe(cfg.edges);
+  });
+
+  it('the no-op path returns the SAME object (no clone allocated)', () => {
+    const cfg = mkCfg(3, [
+      [0, 1, 'seq'],
+      [1, 2, 'seq'],
+    ]);
+    expect(augmentForPostDom(cfg)).toBe(cfg);
+  });
+});
diff --git a/gitnexus/test/unit/cfg/typescript-visitor.test.ts b/gitnexus/test/unit/cfg/typescript-visitor.test.ts
index 7dc7711a5..ef77f0556 100644
--- a/gitnexus/test/unit/cfg/typescript-visitor.test.ts
+++ b/gitnexus/test/unit/cfg/typescript-visitor.test.ts
@@ -7,6 +7,7 @@ import {
   TS_FUNCTION_TYPES,
 } from '../../../src/core/ingestion/cfg/visitors/typescript.js';
 import type { FunctionCfg } from '../../../src/core/ingestion/cfg/types.js';
+import { block, edgeKinds, reaches, reachable } from '../../helpers/cfg-harness.js';
 
 // U2 — the TS/JS CfgVisitor, one hazard per test. Each fixture's distinctive
 // statement text (markerWork(), handleErr(), cleanup(), …) lets us find the
@@ -46,30 +47,6 @@ function cfgOf(code: string, index = 0): FunctionCfg {
   return cfg;
 }
 
-const block = (cfg: FunctionCfg, substr: string): number => {
-  const b = cfg.blocks.find((bl) => bl.text.includes(substr));
-  if (!b) throw new Error(`no block containing ${JSON.stringify(substr)}`);
-  return b.index;
-};
-
-const edgeKinds = (cfg: FunctionCfg): Set<string> => new Set(cfg.edges.map((e) => e.kind));
-
-/** Does control reach `to` from `from` following edges? */
-function reaches(cfg: FunctionCfg, from: number, to: number): boolean {
-  const adj = new Map<number, number[]>();
-  for (const e of cfg.edges) (adj.get(e.from) ?? adj.set(e.from, []).get(e.from)!).push(e.to);
-  const seen = new Set([from]);
-  const stack = [from];
-  while (stack.length) {
-    const n = stack.pop() as number;
-    if (n === to) return true;
-    for (const nx of adj.get(n) ?? []) if (!seen.has(nx)) (seen.add(nx), stack.push(nx));
-  }
-  return seen.has(to);
-}
-
-const reachable = (cfg: FunctionCfg, idx: number): boolean => reaches(cfg, cfg.entryIndex, idx);
-
 describe('TS/JS CfgVisitor — structure', () => {
   it('straight-line body: ENTRY → block → EXIT', () => {
     const cfg = cfgOf(`function f() { a(); b(); c(); }`);
diff --git a/gitnexus/test/unit/cfg/vue-visitor.test.ts b/gitnexus/test/unit/cfg/vue-visitor.test.ts
new file mode 100644
index 000000000..9301b7f96
--- /dev/null
+++ b/gitnexus/test/unit/cfg/vue-visitor.test.ts
@@ -0,0 +1,104 @@
+import { describe, it, expect } from 'vitest';
+import fs from 'fs';
+import path from 'path';
+import TypeScript from 'tree-sitter-typescript';
+import type { FunctionCfg } from '../../../src/core/ingestion/cfg/types.js';
+import { makeCfgHarness, block, edgeKinds, reaches } from '../../helpers/cfg-harness.js';
+import { extractVueScript } from '../../../src/core/ingestion/vue-sfc-extractor.js';
+import { getProvider } from '../../../src/core/ingestion/languages/index.js';
+import { SupportedLanguages } from '../../../src/config/supported-languages.js';
+import { computeControlDependence } from '../../../src/core/ingestion/cfg/control-dependence.js';
+import { isExitReachableFromAllBlocks } from '../../../src/core/ingestion/cfg/post-dominators.js';
+
+// #2195 capstone — Vue reuses the TypeScript CfgVisitor (vue.ts wires
+// `createTypeScriptCfgVisitor()`). This unit test replicates the worker's Vue
+// path WITHOUT the worker: the SFC <script> block is extracted by
+// `extractVueScript`, then parsed with the TypeScript grammar and fed through
+// the Vue provider's `cfgVisitor` — exactly the worker's Vue→TypeScript grammar
+// mapping. Proving the visitor reuse here means the worker-mode pipeline test
+// (pipeline-pdg.test.ts) is exercising the same builder end-to-end.
+
+const vueVisitor = getProvider(SupportedLanguages.Vue).cfgVisitor;
+if (!vueVisitor) throw new Error('Vue provider has no cfgVisitor');
+
+// The worker maps SupportedLanguages.Vue → TypeScript.typescript (parse-worker
+// languageMap); mirror that grammar here so the harness parses the same way.
+const harness = makeCfgHarness(TypeScript.typescript, vueVisitor, 'C.vue');
+
+/** Extract the SFC script content the way the worker does, then CFG it. */
+function cfgsOfSfc(sfc: string): FunctionCfg[] {
+  const extraction = extractVueScript(sfc);
+  if (!extraction) throw new Error('extractVueScript returned null');
+  return harness.cfgsOf(extraction.scriptContent);
+}
+
+const FIXTURE = path.join(__dirname, '../../integration/cfg/fixtures/vue-hazards.vue');
+
+describe('Vue CfgVisitor reuse — SFC <script> → TypeScript CFG', () => {
+  it('extracts the <script setup> block and builds one CFG per script function', () => {
+    const sfc = fs.readFileSync(FIXTURE, 'utf8');
+    const extraction = extractVueScript(sfc);
+    expect(extraction).not.toBeNull();
+    // `lang="ts"` ⇒ TypeScript grammar wins (the worker's mapping).
+    expect(extraction?.lang).toBe('');
+    expect(extraction?.isSetup).toBe(true);
+
+    const cfgs = cfgsOfSfc(sfc);
+    // classify, eventLoop, onClick, plus the small helpers — many CFG-bearing fns.
+    expect(cfgs.length).toBeGreaterThanOrEqual(1);
+    for (const cfg of cfgs) {
+      expect(cfg.blocks[cfg.entryIndex].kind).toBe('entry');
+      expect(cfg.blocks[cfg.exitIndex].kind).toBe('exit');
+    }
+  });
+
+  it('if/else-if/else in the script produces a branching CFG (cond-true + cond-false)', () => {
+    const cfgs = cfgsOfSfc(fs.readFileSync(FIXTURE, 'utf8'));
+    // Locate the `classify` function's CFG by its distinctive arm text.
+    const classify = cfgs.find((c) => c.blocks.some((b) => b.text.includes('positive()')));
+    expect(classify).toBeDefined();
+    if (!classify) return;
+    const kinds = edgeKinds(classify);
+    expect(kinds.has('cond-true')).toBe(true);
+    expect(kinds.has('cond-false')).toBe(true);
+    // each arm rejoins and reaches EXIT
+    for (const arm of ['positive()', 'negative()', 'zero()']) {
+      expect(reaches(classify, classify.entryIndex, block(classify, arm))).toBe(true);
+      expect(reaches(classify, block(classify, arm), classify.exitIndex)).toBe(true);
+    }
+  });
+
+  it('a `while (true)` script keeps EXIT reverse-reachable and yields CDG > 0', () => {
+    // The smallest reproduction of the silent-zero hazard, through the SFC path.
+    const sfc = `
+<script setup lang="ts">
+function loopForever(x: number): number {
+  let sum = 0;
+  while (true) {
+    if (shouldStop(x)) {
+      return sum;
+    }
+    sum = sum + x;
+  }
+}
+</script>
+`;
+    const cfgs = cfgsOfSfc(sfc);
+    const loop = cfgs.find((c) => c.blocks.some((b) => b.text.includes('sum = sum + x')));
+    expect(loop).toBeDefined();
+    if (!loop) return;
+
+    // The non-terminating loop has a back-edge but EXIT must still be reachable
+    // from EVERY block (the structural escape edge feeds the post-dom pass).
+    expect(edgeKinds(loop).has('loop-back')).toBe(true);
+    expect(isExitReachableFromAllBlocks(loop)).toBe(true);
+
+    // Control dependence is computable and non-empty — the worker's CDG pass
+    // would emit > 0 edges for this function (matches the pipeline assertion).
+    const cd = computeControlDependence(loop);
+    expect(cd.edges.length).toBeGreaterThan(0);
+    for (const e of cd.edges) {
+      expect(['T', 'F']).toContain(e.label);
+    }
+  });
+});