fix(resolution): label name-fallback guesses and refuse the impossible; bind exports and named imports to module-level declarations

The global unique-name call fallback emitted its edges as 'import-resolved' at
confidence 0.85 — byte-identical to a genuinely resolved edge, so nothing
downstream could tell a guess from a fact. Those edges now carry reason
'global-name-fallback' at 0.5; per-language visibility hooks refuse the edges a
language makes impossible (Go unexported names across packages, non-pub Rust
items, Swift private/fileprivate, Dart _private across libraries, Ruby class-owned
methods with no namespace evidence); Dart and Swift stay labeled where the parse
model cannot decide.

In the shared finalize pass, 'export *' fan-out and (for TS/JS/Vue, via a
ScopeResolver hook) named imports bind module-level declarations only — a class
method can no longer win a barrel name — and a star-vs-star collision is refused
and recorded as 'reexport-ambiguous' instead of first-wins. The reason now rides
on forEachRelationshipFields so consumers can gate on it.

Each run logs a census (guessed sites, distinct pairs, refused, ambiguous names)
and persists it as RepoMeta.nameFallbackEdges.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

gitnexus-shared/src/index.ts

@@ -137,6 +137,7 @@ export type {
   FinalizeOutput,
   FinalizedScc,
   FinalizeStats,
+  AmbiguousWildcardExport,
 } from './scope-resolution/finalize-algorithm.js';
 
 // Scope-aware registries + 7-step lookup (RFC §4; Ring 2 SHARED #917)

gitnexus-shared/src/scope-resolution/finalize-algorithm.ts

@@ -114,6 +114,34 @@ export interface FinalizeHooks {
    */
   expandsWildcardTo(targetModuleScope: ScopeId, workspaceIndex: WorkspaceIndex): readonly string[];
 
+  /**
+   * Does this language make two `wildcard` re-exports that both DECLARE the
+   * same name AMBIGUOUS (no winner), rather than overloads or redeclarations
+   * of one entity?
+   *
+   * True for ECMAScript modules: `export * from './a'; export * from './b'`
+   * with `collide` declared in both excludes the name from the module's
+   * exports, so binding either source is a guess. False (the default) for
+   * languages whose wildcard import is `#include`, `require`, or a package
+   * fan-out, where the same name declared in two files is an overload set
+   * (C++ `write_audit(int)` / `write_audit(int, int)` across two headers), a
+   * redeclaration of one function, or a per-file `init` — legal, and resolved
+   * downstream by arity or by definition. Only a language that opts in has
+   * its collisions refused and reported via `ambiguousWildcardExports`.
+   */
+  readonly wildcardCollisionIsAmbiguous?: boolean;
+
+  /**
+   * A named import / named re-export binds only to MODULE-LEVEL declarations
+   * of the target file. Opt-in for languages whose `import { x }` can never
+   * reach a class member: without it, a class method sharing a name with a
+   * top-level value — or standing alone — wins the callable preference in
+   * `findExportByName` and the import binds to a symbol the module cannot
+   * export (a confident wrong edge). Languages that bind module-level members
+   * by bare name (static members, module functions) leave it off.
+   */
+  readonly namedImportsBindTopLevelOnly?: boolean;
+
   /**
    * Merge `incoming` bindings into `existing` for a given name. Called
    * once per name at each scope. Typical rules:
@@ -164,6 +192,24 @@ export interface FinalizeStats {
   readonly unresolvedEdges: number;
   readonly sccCount: number;
   readonly largestSccSize: number;
+  /**
+   * Names a file re-exported through two or more `export *` sources that each
+   * DECLARE the name, so the language names no winner. The finalize pass
+   * refuses to bind them (they are absent from the file's re-export closure
+   * AND from its wildcard-expanded module-scope bindings) instead of taking the
+   * first-listed source and publishing the guess as `import-resolved`.
+   * Reported so the caller can record the refusal — an importer of that name
+   * stays unresolved, and the reason must be auditable rather than silent.
+   */
+  readonly ambiguousWildcardExports: readonly AmbiguousWildcardExport[];
+}
+
+/** One refused `export *` collision — see `FinalizeStats.ambiguousWildcardExports`. */
+export interface AmbiguousWildcardExport {
+  readonly filePath: string;
+  readonly name: string;
+  /** `nodeId`s of the colliding declarations, in `export *` declaration order. */
+  readonly candidateDefIds: readonly string[];
 }
 
 export interface FinalizeOutput {
@@ -223,7 +269,25 @@ export function finalize(input: FinalizeInput, hooks: FinalizeHooks): FinalizeOu
   // SCC-condensed). Eliminates the recursive crawl that the per-edge
   // `tryFinalize` call site used to do; lookups are O(1) afterwards.
   // See `buildReexportClosures` for the algorithm.
-  const reexportClosures = buildReexportClosures(input.files, byFilePath, edgeIndex);
+  const ambiguityByFile = collectAmbiguityByFile(
+    input.files,
+    byFilePath,
+    edgeIndex,
+    hooks.wildcardCollisionIsAmbiguous === true,
+    hooks.namedImportsBindTopLevelOnly === true,
+  );
+  const ambiguousByFile = new Map<string, ReadonlySet<string>>();
+  for (const [filePath, byName] of ambiguityByFile) {
+    ambiguousByFile.set(filePath, new Set(byName.keys()));
+  }
+  const topLevelOnly = hooks.namedImportsBindTopLevelOnly === true;
+  const reexportClosures = buildReexportClosures(
+    input.files,
+    byFilePath,
+    edgeIndex,
+    ambiguousByFile,
+    topLevelOnly,
+  );
 
   // ── Phase 3: process SCCs in reverse-topological order (leaves first).
   // Within each SCC, run a bounded fixpoint that resolves intra-SCC edges.
@@ -231,6 +295,17 @@ export function finalize(input: FinalizeInput, hooks: FinalizeHooks): FinalizeOu
   // already finalized); edges inside the SCC may need multiple passes.
   const linkedByScope = new Map<ScopeId, readonly ImportEdge[]>();
   let linkedEdges = 0;
+  // Every refused name, reported from the ambiguity map itself rather than from
+  // the edges phase 4 happens to drop: a language whose `expandsWildcardTo`
+  // returns nothing (TypeScript — `export *` never binds names locally) drops
+  // no expanded edge, yet its importers were refused through the closure just
+  // the same, and that refusal must still be visible.
+  const ambiguousWildcardExports: AmbiguousWildcardExport[] = [];
+  for (const [filePath, byName] of ambiguityByFile) {
+    for (const [name, candidateDefIds] of byName) {
+      ambiguousWildcardExports.push({ filePath, name, candidateDefIds });
+    }
+  }
 
   for (const scc of sccs) {
     const sccFiles = new Set(scc.files);
@@ -249,7 +324,7 @@ export function finalize(input: FinalizeInput, hooks: FinalizeHooks): FinalizeOu
         if (drafts === undefined) continue;
         for (const draft of drafts) {
           if (draft.finalized !== null) continue;
-          const finalized = tryFinalize(draft, byFilePath, reexportClosures);
+          const finalized = tryFinalize(draft, byFilePath, reexportClosures, topLevelOnly);
           if (finalized !== null) {
             draft.finalized = finalized;
             progressed = true;
@@ -278,6 +353,13 @@ export function finalize(input: FinalizeInput, hooks: FinalizeHooks): FinalizeOu
     const drafts = edgeIndex.get(file.filePath);
     if (drafts === undefined) continue;
     const finalized: ImportEdge[] = [];
+    // Names this file's `export *` sources collide on (see
+    // `collectAmbiguousWildcards`). Their expanded edges are dropped here, so
+    // the file's own module scope does not bind an arbitrary winner either —
+    // suppressing them only in the closure would leave this binding standing,
+    // and it was this binding, not the closure, that produced the published
+    // `import-resolved` guess.
+    const ambiguousHere = ambiguousByFile.get(file.filePath) ?? EMPTY_NAME_SET;
     for (const d of drafts) {
       const edge = d.finalized;
       if (edge === null) {
@@ -286,7 +368,10 @@ export function finalize(input: FinalizeInput, hooks: FinalizeHooks): FinalizeOu
       if (d.source.kind === 'wildcard' && edge.linkStatus !== 'unresolved') {
         // Produce one `wildcard-expanded` ImportEdge per exported name.
         const expanded = expandWildcard(edge, byFilePath, hooks, input.workspaceIndex);
-        for (const e of expanded) finalized.push(e);
+        for (const e of expanded) {
+          if (e.kind === 'wildcard-expanded' && ambiguousHere.has(e.localName)) continue;
+          finalized.push(e);
+        }
       } else {
         finalized.push(edge);
       }
@@ -312,6 +397,7 @@ export function finalize(input: FinalizeInput, hooks: FinalizeHooks): FinalizeOu
     unresolvedEdges: totalEdges - linkedEdges,
     sccCount,
     largestSccSize,
+    ambiguousWildcardExports: Object.freeze(ambiguousWildcardExports),
   };
 
   return Object.freeze({
@@ -529,6 +615,7 @@ function tryFinalize(
   draft: ImportEdgeDraft,
   byFilePath: Map<string, FinalizeFile>,
   reexportClosures: ReadonlyMap<string, FileReexportClosure>,
+  topLevelOnly: boolean,
 ): ImportEdge | null {
   const targetFile = draft.targetFile;
   if (targetFile === null) return draft.base; // already terminal
@@ -552,7 +639,11 @@ function tryFinalize(
   // so consumers can reach the module as a symbol — but its absence is not
   // a failure.
   if (draft.base.kind === 'namespace') {
-    const moduleDef = findExportByName(targetModule.localDefs, extractExportedName(draft.source));
+    const moduleDef = findExportByName(
+      targetModule.localDefs,
+      extractExportedName(draft.source),
+      topLevelOnly,
+    );
     return {
       ...draft.base,
       targetModuleScope: targetModule.moduleScope,
@@ -564,7 +655,7 @@ function tryFinalize(
   // local defs. Multi-hop re-export chains settle iteratively — each hop
   // resolves once its prior hop is finalized.
   const importedName = extractExportedName(draft.source);
-  const exported = findExportByName(targetModule.localDefs, importedName);
+  const exported = findExportByName(targetModule.localDefs, importedName, topLevelOnly);
 
   if (exported !== undefined) {
     const transitiveVia =
@@ -691,15 +782,18 @@ function buildReexportClosures(
   files: readonly FinalizeFile[],
   byFilePath: ReadonlyMap<string, FinalizeFile>,
   edgeIndex: ReadonlyMap<string, ImportEdgeDraft[]>,
+  ambiguous: ReadonlyMap<string, ReadonlySet<string>>,
+  topLevelOnly: boolean,
 ): ReadonlyMap<string, FileReexportClosure> {
   const closures = new Map<string, Map<string, ReexportClosureEntry>>();
   for (const file of files) closures.set(file.filePath, new Map());
 
   // ── Step 1: build the re-export sub-graph (only resolvable wildcard /
-  // reexport / flagged-named targets contribute edges), and collect the
-  // per-file ambiguous names in the same walk.
+  // reexport / flagged-named targets contribute edges). The per-file
+  // ambiguous-name sets arrive precomputed (`collectAmbiguityByFile`) because
+  // phase 4 consults the same sets when it expands wildcards into module
+  // scope — one source of truth for "this name has no winner".
   const subGraph = new Map<string, Set<string>>();
-  const ambiguous = new Map<string, ReadonlySet<string>>();
   for (const file of files) {
     const targets = new Set<string>();
     const drafts = edgeIndex.get(file.filePath);
@@ -710,7 +804,6 @@ function buildReexportClosures(
         if (!byFilePath.has(d.targetFile)) continue;
         targets.add(d.targetFile);
       }
-      ambiguous.set(file.filePath, collectAmbiguousReexports(drafts, byFilePath));
     }
     subGraph.set(file.filePath, targets);
   }
@@ -726,7 +819,7 @@ function buildReexportClosures(
     if (!scc.isCycle) {
       const filePath = scc.files[0];
       if (filePath !== undefined) {
-        populateFileClosure(filePath, byFilePath, edgeIndex, closures, ambiguous);
+        populateFileClosure(filePath, byFilePath, edgeIndex, closures, ambiguous, topLevelOnly);
       }
       continue;
     }
@@ -740,7 +833,9 @@ function buildReexportClosures(
       progressed = false;
       iter++;
       for (const filePath of scc.files) {
-        if (populateFileClosure(filePath, byFilePath, edgeIndex, closures, ambiguous)) {
+        if (
+          populateFileClosure(filePath, byFilePath, edgeIndex, closures, ambiguous, topLevelOnly)
+        ) {
           progressed = true;
         }
       }
@@ -820,6 +915,176 @@ function isNamedReexport(draft: ImportEdgeDraft): draft is ImportEdgeDraft & {
  * are still filling in, so detecting them needs a set that grows during the
  * fixpoint — the thing this pre-pass exists to avoid.
  */
+/**
+ * Per-file set of re-exported names that have NO decidable winner, from both
+ * detectors: `collectAmbiguousReexports` (flagged-named vs flagged-named) and
+ * `collectAmbiguousWildcards` (`export *` vs `export *`, direct declarations).
+ * Fixed for the whole run; consulted by the closure fixpoint AND by phase 4's
+ * wildcard expansion, so a refused name is absent from BOTH the exports an
+ * importer can reach and the module-scope bindings the file itself sees.
+ */
+function collectAmbiguityByFile(
+  files: readonly FinalizeFile[],
+  byFilePath: ReadonlyMap<string, FinalizeFile>,
+  edgeIndex: ReadonlyMap<string, ImportEdgeDraft[]>,
+  wildcardCollisionIsAmbiguous: boolean,
+  topLevelOnly: boolean,
+): ReadonlyMap<string, ReadonlyMap<string, readonly string[]>> {
+  const out = new Map<string, ReadonlyMap<string, readonly string[]>>();
+  for (const file of files) {
+    const drafts = edgeIndex.get(file.filePath);
+    if (drafts === undefined) continue;
+    const byName = new Map<string, readonly string[]>();
+    for (const name of collectAmbiguousReexports(drafts, byFilePath)) {
+      byName.set(name, namedReexportCandidates(drafts, byFilePath, name, topLevelOnly));
+    }
+    // Wildcard-vs-wildcard is a language rule (`FinalizeHooks.
+    // wildcardCollisionIsAmbiguous`): ECMAScript excludes the name, C++
+    // overloads it. Without the opt-in this half stays first-wins.
+    if (wildcardCollisionIsAmbiguous) {
+      for (const [name, ids] of collectAmbiguousWildcards(file, drafts, byFilePath)) {
+        if (!byName.has(name)) byName.set(name, ids);
+      }
+    }
+    if (byName.size === 0) continue;
+    out.set(file.filePath, byName);
+  }
+  return out;
+}
+
+/** The declarations a flagged-named collision on `localName` points at. */
+function namedReexportCandidates(
+  drafts: readonly ImportEdgeDraft[],
+  byFilePath: ReadonlyMap<string, FinalizeFile>,
+  localName: string,
+  topLevelOnly: boolean,
+): readonly string[] {
+  const ids: string[] = [];
+  for (const draft of drafts) {
+    if (!isNamedReexport(draft) || draft.source.localName !== localName) continue;
+    const targetFile = draft.targetFile;
+    if (targetFile === null) continue;
+    const target = byFilePath.get(targetFile);
+    if (target === undefined) continue;
+    const def = findExportByName(target.localDefs, draft.source.importedName, topLevelOnly);
+    if (def !== undefined && !ids.includes(def.nodeId)) ids.push(def.nodeId);
+  }
+  return Object.freeze(ids);
+}
+
+/**
+ * `export * from './a'; export * from './b'` where BOTH `a` and `b` declare
+ * `collide`: the language names no winner (ECMAScript excludes the name from
+ * the module's exports entirely; a direct `import { collide }` of it is a
+ * SyntaxError-class ambiguity). First-wins here published the `a` binding as
+ * `import-resolved` at full confidence — a definite target for a call that has
+ * none, which is the incorrect-context-over-missing-context failure in its
+ * purest form. The name is refused instead and reported.
+ *
+ * Decidable in this pre-pass because it reads only the targets' own
+ * `localDefs` — nothing that fills in during the closure fixpoint. Collisions
+ * that arrive TRANSITIVELY (two wildcards whose targets each re-export the
+ * name from somewhere else) are still first-wins; detecting them needs a set
+ * that grows mid-fixpoint, the thing this pre-pass exists to avoid.
+ *
+ * A name the file DECLARES itself, or re-exports by NAME, is excluded: an
+ * explicit export shadows every `export *`, so those collisions are legal and
+ * resolved by precedence, not ambiguous.
+ *
+ * Only MODULE-LEVEL, EXPORT-SHAPED declarations can collide. `localDefs` also
+ * carries class members, properties and parameters (a `Property:value` on two
+ * unrelated classes, an interface field named `move`), which no `export *`
+ * publishes. Counting those produced thousands of phantom collisions on a real
+ * monorepo (2,640 on grafana) and — the dangerous half — would have refused a
+ * genuinely exported `move()` because some class elsewhere had a `move`
+ * property. The wildcard closure loop tolerates the wider set because nobody
+ * imports a property by name; a refusal cannot afford the same tolerance.
+ *
+ * `Variable` is excluded too. `SymbolDefinition` carries no export marker, and
+ * the typical top-level `const` in a barrel's sources is module-private
+ * (`const category = ['Axis']` in fourteen option-builder files) — the closure
+ * would never be asked for it, so refusing it protects nothing and would refuse
+ * a real exported constant of the same name. Residual risk, accepted: a
+ * non-exported `function`/`class` sharing its name with an exported one behind
+ * the same barrel is counted as a collision and the export is refused — a
+ * missing edge, never a wrong one. `ownerId` is only set for class members, so
+ * a callable nested in an object literal (`showIf: (cfg) => …` across fourteen
+ * option-builder files) still counts as a provider; `SymbolDefinition` carries
+ * neither a scope nor an export marker to do better with. Measured after both
+ * exclusions: grafana@871af0720 refuses 52 names (from 2,640 before them),
+ * discourse@3f71fa15c 5.
+ */
+
+/** Labels that are never a module export, whatever their owner. */
+const NON_EXPORTABLE_MEMBER_LABELS: readonly string[] = [
+  'Property',
+  'Method',
+  'Constructor',
+  'Parameter',
+  'Field',
+];
+const NON_EXPORTABLE_LABELS: ReadonlySet<string> = new Set([
+  ...NON_EXPORTABLE_MEMBER_LABELS,
+  'Variable',
+]);
+/**
+ * Labels a module can never export by name: class/interface members and
+ * parameters. Filtered by LABEL, not `ownerId` — `ownerId` is populated in a
+ * later pass and is not reliable while the closure is built.
+ */
+const MEMBER_LABELS: ReadonlySet<string> = new Set(NON_EXPORTABLE_MEMBER_LABELS);
+
+/** A declaration `export *` could publish: top-level and of an exportable kind. */
+function isWildcardPublishable(def: SymbolDefinition): boolean {
+  return def.ownerId === undefined && !NON_EXPORTABLE_LABELS.has(def.type);
+}
+function collectAmbiguousWildcards(
+  file: FinalizeFile,
+  drafts: readonly ImportEdgeDraft[],
+  byFilePath: ReadonlyMap<string, FinalizeFile>,
+): ReadonlyMap<string, readonly string[]> {
+  const shadowed = new Set<string>();
+  for (const def of file.localDefs) {
+    const name = deriveSimpleName(def);
+    if (name !== null) shadowed.add(name);
+  }
+  for (const draft of drafts) {
+    if (isNamedReexport(draft)) shadowed.add(draft.source.localName);
+  }
+
+  // name → (target file → declaring def ids), in declaration order.
+  const providers = new Map<string, Map<string, string[]>>();
+  for (const draft of drafts) {
+    if (draft.source.kind !== 'wildcard') continue;
+    const targetFile = draft.targetFile;
+    if (targetFile === null) continue;
+    const target = byFilePath.get(targetFile);
+    if (target === undefined) continue;
+    for (const def of target.localDefs) {
+      if (!isWildcardPublishable(def)) continue;
+      const name = deriveSimpleName(def);
+      if (name === null || shadowed.has(name)) continue;
+      let byTarget = providers.get(name);
+      if (byTarget === undefined) {
+        byTarget = new Map<string, string[]>();
+        providers.set(name, byTarget);
+      }
+      const ids = byTarget.get(targetFile);
+      if (ids === undefined) byTarget.set(targetFile, [def.nodeId]);
+      else ids.push(def.nodeId);
+    }
+  }
+  const conflicting = new Map<string, readonly string[]>();
+  for (const [name, byTarget] of providers) {
+    // Two DIFFERENT source files declaring the name. The same file declaring
+    // it twice (overloads, a declaration merged with its namespace) is one
+    // provider and not a collision.
+    if (byTarget.size < 2) continue;
+    conflicting.set(name, Object.freeze([...byTarget.values()].flat()));
+  }
+  return conflicting;
+}
+
 function collectAmbiguousReexports(
   drafts: readonly ImportEdgeDraft[],
   byFilePath: ReadonlyMap<string, FinalizeFile>,
@@ -859,6 +1124,7 @@ function populateFileClosure(
   edgeIndex: ReadonlyMap<string, ImportEdgeDraft[]>,
   closures: Map<string, Map<string, ReexportClosureEntry>>,
   ambiguousByFile: ReadonlyMap<string, ReadonlySet<string>>,
+  topLevelOnly: boolean,
 ): boolean {
   const myClosure = closures.get(filePath);
   if (myClosure === undefined) return false;
@@ -883,7 +1149,7 @@ function populateFileClosure(
     if (ambiguous.has(localName) || myClosure.has(localName)) continue;
 
     const importedName = draft.source.importedName;
-    const direct = findExportByName(targetModule.localDefs, importedName);
+    const direct = findExportByName(targetModule.localDefs, importedName, topLevelOnly);
     if (direct !== undefined) {
       myClosure.set(localName, { def: direct, via: Object.freeze([targetFile]) });
       continue;
@@ -909,9 +1175,27 @@ function populateFileClosure(
     const targetModule = byFilePath.get(targetFile);
     if (targetModule === undefined) continue;
 
-    for (const def of targetModule.localDefs) {
-      const name = deriveSimpleName(def);
-      if (name === null || ambiguous.has(name) || myClosure.has(name)) continue;
+    // Fan out the WINNER per name, not every def. `export const alpha = () =>
+    // {}` emits both a `Variable` (the lexical declaration) and a `Function`
+    // (the arrow) under the same simple name; iterating `localDefs` raw let
+    // whichever came first — the `Variable` — claim the closure slot, and a
+    // call bound to a value shadow emits no CALLS edge. Named re-exports
+    // already go through `findExportByName`'s callable-preferred index; the
+    // wildcard hop is the same lookup and must apply the same preference.
+    // Measured: grafana `Button`/`clearButtonStyles` (arrow consts behind
+    // `export *`) resolved 8 of 475 ledger entries before this.
+    // Over TOP-LEVEL declarations only. `localDefs` also carries class members;
+    // `Foo.render` (label `Method`, callable) outranked the file's real
+    // `const render` in the callable-preferred index and `import { render }`
+    // bound to a symbol `export *` can never publish — a confident wrong edge
+    // where the value shadow used to yield none. Gated by the same hook as the
+    // named-import path: only a language that opted in (ECMAScript, where
+    // `export *` cannot publish a class member) narrows; every other language's
+    // wildcard keeps the wide index, whose members are legitimately reachable.
+    for (const [name, def] of (topLevelOnly ? indexTopLevelExportsByName : indexExportsByName)(
+      targetModule.localDefs,
+    )) {
+      if (ambiguous.has(name) || myClosure.has(name)) continue;
       myClosure.set(name, { def, via: Object.freeze([targetFile]) });
     }
     const targetClosure = closures.get(targetFile);
@@ -993,6 +1277,13 @@ function deriveSimpleName(def: SymbolDefinition): string | null {
 function findExportByName(
   defs: readonly SymbolDefinition[],
   name: string,
+  /**
+   * `true` (a `namedImportsBindTopLevelOnly` language): consult only
+   * module-level declarations, so a class member can neither outrank a
+   * top-level value nor bind on its own. Phase-4 wildcard expansion keeps
+   * the wide index — that is the path languages use to bind members.
+   */
+  topLevelOnly: boolean = false,
 ): SymbolDefinition | undefined {
   // GENERIC RULE (applies to every language using this finalize
   // algorithm): when MULTIPLE `SymbolDefinition`s share the same simple
@@ -1018,7 +1309,7 @@ function findExportByName(
   //
   // See `gitnexus/test/integration/resolvers/typescript-hof-callbacks.test.ts`
   // for the cross-file regression this rule prevents.
-  return indexExportsByName(defs).get(name);
+  return (topLevelOnly ? indexTopLevelExportsByName(defs) : indexExportsByName(defs)).get(name);
 }
 
 /**
@@ -1062,6 +1353,36 @@ function indexExportsByName(
   return index;
 }
 
+/**
+ * `indexExportsByName` restricted to declarations `export *` can publish:
+ * members (by LABEL — `ownerId` is stamped by a later reconcile pass and is not
+ * reliable while the closure is built) are skipped; `Variable` stays, since a
+ * barrel legitimately republishes a `const`. Same memoization contract.
+ */
+const TOP_LEVEL_EXPORTS_BY_NAME = new WeakMap<
+  readonly SymbolDefinition[],
+  ReadonlyMap<string, SymbolDefinition>
+>();
+
+function indexTopLevelExportsByName(
+  defs: readonly SymbolDefinition[],
+): ReadonlyMap<string, SymbolDefinition> {
+  const cached = TOP_LEVEL_EXPORTS_BY_NAME.get(defs);
+  if (cached !== undefined) return cached;
+  const index = new Map<string, SymbolDefinition>();
+  for (const d of defs) {
+    if (MEMBER_LABELS.has(d.type)) continue;
+    const name = deriveSimpleName(d);
+    if (name === null) continue;
+    const existing = index.get(name);
+    if (existing === undefined) index.set(name, d);
+    else if (!isCallableOrTypeLike(existing.type) && isCallableOrTypeLike(d.type))
+      index.set(name, d);
+  }
+  TOP_LEVEL_EXPORTS_BY_NAME.set(defs, index);
+  return index;
+}
+
 const EMPTY_NAME_SET: ReadonlySet<string> = new Set();
 
 const CALLABLE_OR_TYPE_LIKE: ReadonlySet<string> = new Set([

gitnexus/src/core/graph/edge-reasons.ts

@@ -0,0 +1,37 @@
+/**
+ * Edge `reason` values that mark a CALLS edge as a HEURISTIC GUESS rather than
+ * a resolution.
+ *
+ * The distinction exists because an edge's `confidence` number cannot carry it.
+ * `GLOBAL_NAME_FALLBACK_REASON` edges are emitted at exactly 0.5 — the same
+ * number as `process-processor`'s `MIN_TRACE_CONFIDENCE` and
+ * `community-processor`'s `MIN_CONFIDENCE_LARGE` — so a `confidence < 0.5`
+ * gate does NOT exclude them. Anything that must exclude guesses has to read
+ * the reason, which is why `KnowledgeGraph.forEachRelationshipFields` passes it
+ * and why `GraphEmitSink` retains a reason column.
+ */
+
+/**
+ * The target was chosen because its SIMPLE NAME is unique in the workspace —
+ * not because any import, scope chain, or type binding led to it.
+ *
+ * Emitted only by the `pickUniqueGlobalCallable` tier of the free-call
+ * fallback, and only for the languages that opt into
+ * `allowGlobalFreeCallFallback`. It is a name collision away from being wrong
+ * and must never be presented as an import-resolved edge: a reader who cannot
+ * tell the two apart has no way to discount the guess.
+ */
+export const GLOBAL_NAME_FALLBACK_REASON = 'global-name-fallback';
+
+/**
+ * Reasons excluded from process tracing and large-graph community detection.
+ *
+ * Both walks exist to describe how the program actually flows. Seeding a flow
+ * from a unique-name guess produces a confident-looking trace through code that
+ * may never call each other, which is worse than a shorter honest trace.
+ */
+const HEURISTIC_EDGE_REASONS: ReadonlySet<string> = new Set([GLOBAL_NAME_FALLBACK_REASON]);
+
+/** True when this edge's target was guessed by name rather than resolved. */
+export const isHeuristicEdgeReason = (reason: string): boolean =>
+  HEURISTIC_EDGE_REASONS.has(reason);

gitnexus/src/core/graph/graph.ts

@@ -163,9 +163,17 @@ export const createKnowledgeGraph = (): KnowledgeGraph => {
       relationshipMap.forEach(fn);
     },
     forEachRelationshipFields(
-      fn: (sourceId: string, targetId: string, type: RelationshipType, confidence: number) => void,
+      fn: (
+        sourceId: string,
+        targetId: string,
+        type: RelationshipType,
+        confidence: number,
+        reason: string,
+      ) => void,
     ) {
-      relationshipMap.forEach((rel) => fn(rel.sourceId, rel.targetId, rel.type, rel.confidence));
+      relationshipMap.forEach((rel) =>
+        fn(rel.sourceId, rel.targetId, rel.type, rel.confidence, rel.reason),
+      );
     },
     getNode: (id: string) => nodeMap.get(id),
 

gitnexus/src/core/graph/types.ts

@@ -31,14 +31,26 @@ export interface KnowledgeGraph {
    * Zero-allocation relationship scan: fields, not objects (#2680).
    *
    * The whole-graph scans (the local-symbol pruner, community detection,
-   * process extraction) read only these four fields, and materializing a
+   * process extraction) read only these five fields, and materializing a
    * `GraphRelationship` per edge just to read them dominates iteration cost once
    * relationships are held columnar — measured at ~90 ms per analyze on a
    * million-edge graph. Prefer this over `forEachRelationship` in any pass that
    * walks every edge and needs no other field.
+   *
+   * `reason` is passed because confidence alone cannot separate a heuristic
+   * name guess from a resolved edge that happens to sit at the same number:
+   * the global-name fallback emits at exactly the process/community threshold
+   * (0.5), so the walks that must exclude it have to read the reason. See
+   * `GraphEmitSink`'s reason column, added for this consumer.
    */
   forEachRelationshipFields: (
-    fn: (sourceId: string, targetId: string, type: RelationshipType, confidence: number) => void,
+    fn: (
+      sourceId: string,
+      targetId: string,
+      type: RelationshipType,
+      confidence: number,
+      reason: string,
+    ) => void,
   ) => void;
   getNode: (id: string) => GraphNode | undefined;
   nodeCount: number;

gitnexus/src/core/ingestion/finalize-orchestrator.ts

@@ -202,6 +202,8 @@ function withDefaultHooks(partial: Partial<FinalizeHooks>): FinalizeHooks {
   return {
     resolveImportTarget: partial.resolveImportTarget ?? (() => null),
     isNamespaceImport: partial.isNamespaceImport,
+    wildcardCollisionIsAmbiguous: partial.wildcardCollisionIsAmbiguous === true,
+    namedImportsBindTopLevelOnly: partial.namedImportsBindTopLevelOnly === true,
     expandsWildcardTo: partial.expandsWildcardTo ?? (() => []),
     mergeBindings:
       partial.mergeBindings ??

gitnexus/src/core/ingestion/languages/dart/name-fallback-visibility.ts

@@ -0,0 +1,70 @@
+/**
+ * Dart's veto on the global-name fallback — see
+ * `ScopeResolver.isGlobalNameFallbackPlausible`.
+ *
+ * Dart's privacy is LIBRARY-scoped and marked in the identifier itself: a name
+ * beginning with `_` is visible only inside its own library and cannot be
+ * imported by any spelling. So a `_`-prefixed candidate in another file is an
+ * impossible call, not an unlikely one.
+ *
+ * "Library" is approximated by "the same DIRECTORY". The exact boundary is
+ * `part` / `part of` — one library spanning several files, with `_` names
+ * shared between them — and the extractor does not surface `part` directives
+ * yet (nothing in `languages/dart/` reads them). Refusing on "same file" would
+ * therefore delete real edges on Flutter's dominant generated-code idiom:
+ * `factory Foo.fromJson(j) => _$FooFromJson(j)` calls into `foo.g.dart`, a
+ * `part` of the same library that sits beside it. Parts are, in practice,
+ * always siblings of their library file, so a same-directory `_` candidate is
+ * treated as plausible (and stays a LABELED edge); only a `_` candidate in
+ * another directory is refused, which no `part` layout can make legal. A caller
+ * that names the candidate's file in a directive is also accepted, for the day
+ * the extractor surfaces `part` as an import target.
+ *
+ * Public names are left to the labeled-edge path. Dart does require an import
+ * for a cross-library public name, but the fallback exists partly to recover
+ * edges where the import chain was not reconstructed, and refusing every
+ * cross-file public call would delete real edges to buy a rule the `_` marker
+ * already gives for free.
+ */
+
+import type { ParsedFile, SymbolDefinition } from 'gitnexus-shared';
+import {
+  directoryOf,
+  modulePathReaches,
+  stripExtension,
+} from '../../scope-resolution/utils/name-fallback-visibility.js';
+
+/** Dart privacy marker: a leading underscore on the declared identifier. Read
+ *  from the last `qualifiedName` segment, so `_Foo.bar` is public `bar` on a
+ *  private class and `Foo._bar` is the private member. */
+function isPrivateDartName(candidate: SymbolDefinition): boolean {
+  const qualified = candidate.qualifiedName ?? '';
+  const dot = qualified.lastIndexOf('.');
+  const simple = dot === -1 ? qualified : qualified.slice(dot + 1);
+  return simple.startsWith('_');
+}
+
+/**
+ * Are these two files parts of one library? True when the caller names the
+ * candidate's file in a `part` / `part of` directive, which the extractor
+ * surfaces as an ordinary import target.
+ */
+function sharesLibrary(callerParsed: ParsedFile, candidateFilePath: string): boolean {
+  const candidateModule = stripExtension(candidateFilePath);
+  for (const imp of callerParsed.parsedImports) {
+    if (modulePathReaches(stripExtension(imp.targetRaw), candidateModule)) return true;
+  }
+  return false;
+}
+
+export function dartIsGlobalNameFallbackPlausible(ctx: {
+  readonly callerParsed: ParsedFile;
+  readonly candidate: SymbolDefinition;
+}): boolean {
+  if (ctx.candidate.filePath === ctx.callerParsed.filePath) return true;
+  if (!isPrivateDartName(ctx.candidate)) return true;
+  // Sibling files may be `part`s of one library (see the header) — undecidable
+  // without `part` extraction, so allowed rather than refused.
+  if (directoryOf(ctx.candidate.filePath) === directoryOf(ctx.callerParsed.filePath)) return true;
+  return sharesLibrary(ctx.callerParsed, ctx.candidate.filePath);
+}

gitnexus/src/core/ingestion/languages/dart/scope-resolver.ts

@@ -41,6 +41,7 @@ import { decodeMarker } from '../../utils/heritage-marker.js';
 import { typeApplicationArguments } from '../../utils/template-arguments.js';
 import type { HeritageTypeArgumentSink } from '../../scope-resolution/utils/generic-instantiation.js';
 import { expandDartWildcardNames } from './expand-wildcards.js';
+import { dartIsGlobalNameFallbackPlausible } from './name-fallback-visibility.js';
 
 interface ClassDefRef {
   readonly graphId: string;
@@ -233,5 +234,6 @@ export const dartScopeResolver: ScopeResolver = {
   // No `new`: bare `Foo()` resolves to the type; with cross-file imports the
   // callee is reachable workspace-wide.
   allowGlobalFreeCallFallback: true,
+  isGlobalNameFallbackPlausible: dartIsGlobalNameFallbackPlausible,
   constructorCallTargetsClass: true,
 };

gitnexus/src/core/ingestion/languages/go/name-fallback-visibility.ts

@@ -0,0 +1,118 @@
+/**
+ * Go's veto on the global-name fallback — see
+ * `ScopeResolver.isGlobalNameFallbackPlausible`.
+ *
+ * Go's visibility rules are unusually decidable from a file path and an
+ * identifier, which is why this is the language the guard is most complete for:
+ *
+ *  1. A package IS a directory. Two files in the same directory see each
+ *     other's identifiers with no import and no qualification, so a same-
+ *     directory candidate is always plausible.
+ *  2. An identifier is exported iff it begins with an upper-case letter. An
+ *     UNEXPORTED identifier is invisible outside its own package — no import
+ *     makes it reachable, so a cross-directory candidate with a lower-case
+ *     initial is not unlikely, it is IMPOSSIBLE.
+ *  3. An exported identifier still requires the caller's file to import the
+ *     package. Go has no ambient namespace, so an exported name from a package
+ *     this file never imported cannot be called here either.
+ *
+ * Rule 2 is the one that matters most in practice: `uniqueHelperXyz` defined
+ * once in package `a` used to acquire a caller in package `b` purely because
+ * the name was unique in the repo, and the resulting edge was published as
+ * `import-resolved` — a caller Go itself would reject.
+ *
+ * Note this checks the CALL's legality, not the callee's identity, so it is
+ * safe against the aliasing and dot-import forms: both change the local handle,
+ * neither changes the imported package PATH, which is what rule 3 reads.
+ */
+
+import type { ParsedFile, SymbolDefinition } from 'gitnexus-shared';
+import {
+  anyImportReaches,
+  directoryOf,
+} from '../../scope-resolution/utils/name-fallback-visibility.js';
+import { inferGoPackageName } from './package-clause.js';
+
+/** `foo_test` → `foo`; mirrors `package-siblings.ts`. */
+function internalPackageOf(pkgName: string): string {
+  return pkgName.endsWith('_test') && pkgName.length > '_test'.length
+    ? pkgName.slice(0, -'_test'.length)
+    : pkgName;
+}
+
+/**
+ * The same three-way split `package-siblings.ts` derives for the confident
+ * tier: is this a `_test.go` file, and if so does it declare the EXTERNAL test
+ * package (`foo_test`)? `external` is `undefined` when the package clause is
+ * not available — an unanswered question the caller must treat as "cannot
+ * decide", never as "internal".
+ */
+function classifyGoFile(
+  filePath: string,
+  sourceTextOf: ((p: string) => string | undefined) | undefined,
+): { isTest: boolean; external: boolean | undefined } {
+  const isTest = filePath.endsWith('_test.go');
+  if (!isTest) return { isTest, external: false };
+  const text = sourceTextOf?.(filePath);
+  if (text === undefined) return { isTest, external: undefined };
+  const declared = inferGoPackageName(text);
+  if (declared === null) return { isTest, external: undefined };
+  return { isTest, external: declared !== internalPackageOf(declared) };
+}
+
+/** Go export rule: an upper-case initial, by Unicode letter case. */
+function isExportedGoName(name: string): boolean {
+  return /^\p{Lu}/u.test(name);
+}
+
+/**
+ * The simple identifier a Go declaration contributes to its package scope: the
+ * last segment of `qualifiedName`, which is `Type.method` for a method and the
+ * bare identifier for a function. Either way the LAST segment is the identifier
+ * whose case decides export.
+ */
+function goSimpleName(candidate: SymbolDefinition): string {
+  const qualified = candidate.qualifiedName ?? '';
+  const dot = qualified.lastIndexOf('.');
+  return dot === -1 ? qualified : qualified.slice(dot + 1);
+}
+
+export function goIsGlobalNameFallbackPlausible(ctx: {
+  readonly sourceTextOf?: (filePath: string) => string | undefined;
+  readonly callerParsed: ParsedFile;
+  readonly candidate: SymbolDefinition;
+}): boolean {
+  const callerDir = directoryOf(ctx.callerParsed.filePath);
+  const candidateDir = directoryOf(ctx.candidate.filePath);
+  // Same directory is NOT the same package (rule 1, refined): a `_test.go`
+  // file may declare `foo_test`, and test-only declarations are invisible to
+  // non-test files. Apply the split `package-siblings.ts` uses for the
+  // confident tier, so the heuristic tier cannot reopen what it closed.
+  if (callerDir === candidateDir) {
+    const caller = classifyGoFile(ctx.callerParsed.filePath, ctx.sourceTextOf);
+    const cand = classifyGoFile(ctx.candidate.filePath, ctx.sourceTextOf);
+    // Non-test files never see test-only declarations.
+    if (cand.isTest && !caller.isTest) return false;
+    // An external test package and its tested package are different packages:
+    // a BARE name cannot cross that boundary in either direction. Undecidable
+    // (no package clause available) → allow.
+    if (caller.external === true && cand.external === false) return false;
+    if (cand.external === true && caller.external === false) return false;
+    return true;
+  }
+
+  const simpleName = goSimpleName(ctx.candidate);
+  // No identifier to read the case of — an unanswered question, not a refusal.
+  if (simpleName === '') return true;
+  // Unexported across a package boundary (rule 2): no import can reach it.
+  if (!isExportedGoName(simpleName)) return false;
+
+  // Exported, so legal to reference — but only from a file that imports the
+  // package (rule 3). A candidate in the module ROOT package has an empty
+  // directory, which `modulePathReaches` cannot align against any import path
+  // (the root package is imported by the module path alone, which the repo-
+  // relative layout does not carry). That is an unanswered question, not a
+  // refusal — treat it as plausible.
+  if (candidateDir === '') return true;
+  return anyImportReaches(ctx.callerParsed, candidateDir);
+}

gitnexus/src/core/ingestion/languages/go/scope-resolver.ts

@@ -16,6 +16,7 @@ import { detectGoInterfaceImplementations } from './interface-impls.js';
 import { populateGoRangeBindings } from './range-binding.js';
 import { expandGoWildcardNames } from './expand-wildcards.js';
 import { goMapValueType } from './interpret.js';
+import { goIsGlobalNameFallbackPlausible } from './name-fallback-visibility.js';
 
 /** Slice `[]T` and array `[N]T` / `[...]T` → the element spelling. Hoisted —
  *  a literal inside the hook would mint a fresh RegExp per folded subscript. */
@@ -85,6 +86,7 @@ export const goScopeResolver: ScopeResolver = {
   hoistTypeBindingsToModule: true,
   propagatesReturnTypesAcrossImports: true,
   allowGlobalFreeCallFallback: true,
+  isGlobalNameFallbackPlausible: goIsGlobalNameFallbackPlausible,
 
   populateNamespaceSiblings: populateGoPackageSiblings,
   mirrorNamespaceTypeBindings: mirrorGoNamespaceTypeBindings,

gitnexus/src/core/ingestion/languages/javascript/scope-resolver.ts

@@ -97,6 +97,12 @@ const javascriptScopeResolver: ScopeResolver = {
   // explicit imports at the call site. Workspace-wide unique-name fallback
   // recovers these edges.
   allowGlobalFreeCallFallback: true,
+
+  // Same ECMAScript `export *` exclusivity as TypeScript: a name declared by
+  // two wildcard sources is refused, not guessed.
+  exclusiveWildcardReexports: true,
+  // Same ECMAScript rule as TypeScript: named imports bind module-level declarations only.
+  namedImportsBindTopLevelOnly: true,
 };
 
 export { javascriptScopeResolver };

gitnexus/src/core/ingestion/languages/ruby/name-fallback-visibility.ts

@@ -0,0 +1,161 @@
+/**
+ * Ruby's veto on the global-name fallback — see
+ * `ScopeResolver.isGlobalNameFallbackPlausible`.
+ *
+ * Ruby keeps the labeled fallback deliberately: with autoload (Rails' zeitwerk,
+ * `ActiveSupport::Dependencies`) a file genuinely can call a method whose
+ * defining file it never requires, so "no require" is NOT evidence of
+ * impossibility the way it is in Go or Rust.
+ *
+ * What IS decidable is namespacing — but only for CLASS bodies. A method
+ * defined inside a `class` is not callable as a bare `helper()` from another
+ * file unless that file names the class somehow (a receiver `Ns.helper`, a
+ * subclass declaration, an `include`, a `require`). A method defined inside a
+ * `module` body is different in kind: modules exist to be mixed in, and Rails
+ * mixes them in for you — every `*Helper` module is included into views and
+ * controllers by the framework, and concerns arrive through `included do`
+ * hooks — so a bare `format_money()` in a view legitimately reaches
+ * `module ApplicationHelper` with no `include`, `require`, or constant
+ * anywhere in the caller. Refusing that would delete real edges on exactly the
+ * codebase shape Ruby's fallback exists to serve. So module-owned methods stay
+ * a LABELED guess, and the refusal targets CLASS-owned methods whose class the
+ * caller never names. A top-level method (`ownerId === undefined`) is left
+ * alone, since that is the shape autoload actually delivers. When the owner
+ * cannot be found or typed (no `parsedFileOf`, owner outside the file set),
+ * the question is unanswered and the edge is allowed.
+ *
+ * "Never names" is read from the caller's own text-visible signals — its
+ * `require`/`include`/`extend` targets, and any reference site spelling the
+ * namespace's constant. If any of them mentions the namespace, the call is
+ * plausible and the labeled edge stands. `require` paths are snake_case
+ * (`billing/invoice_service`) while constants are CamelCase
+ * (`Billing::InvoiceService`), so the comparison normalizes both sides —
+ * without that the `require` branch never matched anything.
+ *
+ * One more thing a caller file can do without naming the class: INHERIT its
+ * way to it. `class UsersController < AdminController` reaches every method
+ * `ApplicationController` defines while naming only `AdminController`, and an
+ * `include Concern` reaches whatever that concern includes in turn. Neither
+ * chain is decidable from one file, so a caller with ANY inheritance or mixin
+ * surface (an `inherits` site, an `include`/`extend`/`prepend` marker) is
+ * treated as plausible. So is a caller file that DEFINES a module: a module's
+ * methods run against whatever class includes the module, and call that class's
+ * methods bare — `module PostGuardian; def can_see?; is_staff? ...` reaches
+ * `class Guardian#is_staff?` because Guardian includes PostGuardian, a fact the
+ * module file never states. What remains refused is the shape Ruby itself
+ * rejects: a bare call to a class's method from a file that inherits nothing,
+ * mixes in nothing, defines no module, and never spells the class. Measured on
+ * discourse@3f71fa15c that is ~1000 refusals, and the sample is what the rule
+ * promises: RSpec `before`/`after`/`subject` guessed to serializer methods of
+ * the same name, `Gemfile`'s `gem` to `Plugin::Instance#gem`, `routes.rb`'s
+ * `get` to `Draft#get` — fabricated callers, every one.
+ */
+
+import type { ParsedFile, SymbolDefinition } from 'gitnexus-shared';
+import { moduleSegments } from '../../scope-resolution/utils/name-fallback-visibility.js';
+import { HERITAGE_MARKER_PREFIX } from '../../utils/heritage-marker.js';
+
+/**
+ * The namespace segments a candidate's qualified name declares, minus the
+ * method itself. `Billing::Invoice#total` / `Billing.Invoice.total` → the
+ * `Billing`, `Invoice` constants a caller would have to name.
+ */
+function namespaceConstantsOf(candidate: SymbolDefinition): readonly string[] {
+  const qualified = candidate.qualifiedName;
+  if (qualified === undefined || qualified === '') return [];
+  const segments = qualified
+    .split(/::|\.|#/)
+    .map((s) => s.trim())
+    .filter((s) => s !== '');
+  // Drop the trailing method name; what remains is the namespace chain.
+  const namespace = segments.slice(0, -1);
+  // Only CONSTANTS name a Ruby namespace (upper-case initial). A lower-case
+  // segment is a receiver expression, not a namespace a caller can mention.
+  return namespace.filter((s) => /^[A-Z]/.test(s));
+}
+
+/**
+ * `billing/invoice_service` vs `InvoiceService`: a path segment names a
+ * constant when, with underscores removed, the two are equal case-insensitively.
+ * Zeitwerk's own inflection rule, minus acronym overrides — over-matching here
+ * only loses a refusal (the edge stays, labeled), which is the safe direction.
+ */
+function pathSegmentNamesConstant(segment: string, constant: string): boolean {
+  return segment.replace(/_/g, '').toLowerCase() === constant.toLowerCase();
+}
+
+function requireReachesConstant(targetRaw: string, constant: string): boolean {
+  for (const segment of moduleSegments(targetRaw)) {
+    if (pathSegmentNamesConstant(segment, constant)) return true;
+  }
+  return false;
+}
+
+/**
+ * The declared kind of the candidate's owner, read from the candidate's own
+ * file. Ruby labels `class` bodies `Class` and `module` bodies `Trait`
+ * (`query.ts`: "module (labeled Trait for class-like registry lookup)").
+ * `undefined` when the owner cannot be found — an unanswered question.
+ */
+function ownerLabelOf(
+  candidate: SymbolDefinition,
+  parsedFileOf: ((filePath: string) => ParsedFile | undefined) | undefined,
+): string | undefined {
+  const ownerId = candidate.ownerId;
+  if (ownerId === undefined || parsedFileOf === undefined) return undefined;
+  const owner = parsedFileOf(candidate.filePath)?.localDefs.find((d) => d.nodeId === ownerId);
+  return owner?.type;
+}
+
+export function rubyIsGlobalNameFallbackPlausible(ctx: {
+  readonly callerParsed: ParsedFile;
+  readonly candidate: SymbolDefinition;
+  readonly parsedFileOf?: (filePath: string) => ParsedFile | undefined;
+}): boolean {
+  if (ctx.candidate.filePath === ctx.callerParsed.filePath) return true;
+  // Top-level method — the autoload shape the fallback exists for.
+  if (ctx.candidate.ownerId === undefined) return true;
+  // Only a CLASS body makes a bare cross-file call impossible without naming
+  // it (see the header). A module owner, or an owner we cannot type, is not a
+  // refusal.
+  if (ownerLabelOf(ctx.candidate, ctx.parsedFileOf) !== 'Class') return true;
+
+  const constants = namespaceConstantsOf(ctx.candidate);
+  // Owned but with no nameable namespace (an anonymous or lower-cased owner):
+  // nothing to check, so do not refuse on an unanswered question.
+  if (constants.length === 0) return true;
+
+  // Any inheritance or mixin surface in the caller can reach the class
+  // transitively (see the header) — not decidable here, so not refused.
+  for (const site of ctx.callerParsed.referenceSites) {
+    if (site.kind === 'inherits') return true;
+  }
+  for (const imp of ctx.callerParsed.parsedImports) {
+    if (imp.targetRaw.startsWith(HERITAGE_MARKER_PREFIX)) return true;
+  }
+  // A file that defines a module is a mixin whose methods run inside some
+  // including class (see the header). Ruby labels `module` bodies `Trait`.
+  for (const def of ctx.callerParsed.localDefs) {
+    if (def.type === 'Trait') return true;
+  }
+
+  for (const imp of ctx.callerParsed.parsedImports) {
+    for (const constant of constants) {
+      if (requireReachesConstant(imp.targetRaw, constant)) return true;
+      // `include Billing::Invoice` arrives as an import whose LOCAL name is the
+      // constant rather than a path. Not every variant carries one.
+      if ('localName' in imp && imp.localName === constant) return true;
+    }
+  }
+  // A bare mention of the constant anywhere in the caller (`Billing::Invoice`,
+  // `Invoice.new`) is enough to make the namespace present in this file.
+  for (const site of ctx.callerParsed.referenceSites) {
+    for (const constant of constants) {
+      if (site.name === constant) return true;
+      if (site.rawQualifiedName !== undefined && site.rawQualifiedName.includes(constant)) {
+        return true;
+      }
+    }
+  }
+  return false;
+}

gitnexus/src/core/ingestion/languages/ruby/scope-resolver.ts

@@ -10,6 +10,7 @@ import type { GraphNodeLookup } from '../../scope-resolution/graph-bridge/node-l
 import type { KnowledgeGraph } from '../../../graph/types.js';
 import { generateId } from '../../../../lib/utils.js';
 import { decodeMarker } from '../../utils/heritage-marker.js';
+import { rubyIsGlobalNameFallbackPlausible } from './name-fallback-visibility.js';
 
 /**
  * #1991: resolve a BARE mixin reference (`include Loggable`) to a nested module by
@@ -287,4 +288,5 @@ export const rubyScopeResolver: ScopeResolver = {
   fieldFallbackOnMethodLookup: true,
   propagatesReturnTypesAcrossImports: true,
   allowGlobalFreeCallFallback: true,
+  isGlobalNameFallbackPlausible: rubyIsGlobalNameFallbackPlausible,
 };

gitnexus/src/core/ingestion/languages/rust/name-fallback-visibility.ts

@@ -0,0 +1,95 @@
+/**
+ * Rust's veto on the global-name fallback — see
+ * `ScopeResolver.isGlobalNameFallbackPlausible`.
+ *
+ * Rust has NO ambient namespace. A bare `helper()` resolves only against names
+ * in scope, and for an item declared in another module the only way in is a
+ * `use` path (or a fully-qualified `crate::a::b::helper()` call, which is not a
+ * bare free call and never reaches this tier — it carries a qualified name and
+ * is resolved earlier by `resolveQualifiedFreeCall`).
+ *
+ * One rule therefore covers both halves the visibility question splits into:
+ *
+ *  - A non-`pub` item cannot be `use`d from outside its module at all, so the
+ *    absence of a covering `use` correctly refuses it.
+ *  - A `pub` item is reachable, but only from a file that actually wrote the
+ *    `use`, which is the same check.
+ *
+ * That is why this does not need to read the `pub` marker, which
+ * `SymbolDefinition` does not carry. It asks the decidable question — "did this
+ * file bring the name's module into scope?" — instead of the undecidable one.
+ *
+ * Module paths are matched against the candidate's FILE path (extension
+ * stripped, and `mod`/`lib`/`main` stem dropped, since `a/b/mod.rs` IS module
+ * `a::b`). `use` targets are `::`-separated and `crate::`/`super::` prefixes
+ * contribute no segments, so suffix matching lines the two up.
+ */
+
+import type { ParsedFile, SymbolDefinition } from 'gitnexus-shared';
+import {
+  modulePathReaches,
+  stripExtension,
+} from '../../scope-resolution/utils/name-fallback-visibility.js';
+
+/** File-stems that name their PARENT directory as the module, not themselves. */
+const RUST_DIRECTORY_MODULE_STEMS: ReadonlySet<string> = new Set(['mod', 'lib', 'main']);
+
+/** Directories that hold a crate's root and contribute no module segment, so
+ *  `src/net/http.rs` is module `net::http` and not `src::net::http`. */
+const RUST_CRATE_ROOT_DIRS: ReadonlySet<string> = new Set(['src', 'tests', 'benches', 'examples']);
+
+/** Path prefixes of a `use` that name a root rather than a module segment. */
+const RUST_USE_ROOT_PREFIXES: ReadonlySet<string> = new Set(['crate', 'self', 'super', '$crate']);
+
+/**
+ * The module path a Rust file provides, as a `/`-joined path.
+ *
+ * Two normalizations, both needed for a file path and a `use` path to line up
+ * on their trailing segments: the `mod`/`lib`/`main` stem names its parent
+ * directory, and a leading crate-root directory (`src/`) is not a module.
+ */
+function rustModulePathOf(filePath: string): string {
+  const withoutExtension = stripExtension(filePath);
+  const segments = withoutExtension.split('/').filter((s) => s !== '');
+  const stem = segments[segments.length - 1];
+  if (stem !== undefined && RUST_DIRECTORY_MODULE_STEMS.has(stem)) segments.pop();
+  while (segments.length > 0 && RUST_CRATE_ROOT_DIRS.has(segments[0]!)) segments.shift();
+  return segments.join('/');
+}
+
+/** A `use` target with its root prefix dropped: `crate::a::b` → `a::b`. */
+function rustUsePathOf(targetRaw: string): string {
+  const segments = targetRaw.split('::').filter((s) => s !== '');
+  while (segments.length > 0 && RUST_USE_ROOT_PREFIXES.has(segments[0]!)) segments.shift();
+  return segments.join('::');
+}
+
+export function rustIsGlobalNameFallbackPlausible(ctx: {
+  readonly callerParsed: ParsedFile;
+  readonly candidate: SymbolDefinition;
+  readonly site: { readonly rawQualifiedName?: string };
+}): boolean {
+  if (ctx.candidate.filePath === ctx.callerParsed.filePath) return true;
+  // A PATH-QUALIFIED call (`User::new(...)`, `crate::a::helper()`) reaches this
+  // tier when the qualifier could not be followed, carrying only its tail name.
+  // It is not a bare-name guess: the source named the path, so the module rule
+  // below would refuse an edge the code spells out.
+  if (ctx.site.rawQualifiedName !== undefined) return true;
+
+  const candidateModule = rustModulePathOf(ctx.candidate.filePath);
+  // A candidate whose file maps to no module path (a crate root reduced to '')
+  // is not something this rule can speak about; allow the labeled edge rather
+  // than refuse on an unanswered question.
+  if (candidateModule === '') return true;
+
+  for (const imp of ctx.callerParsed.parsedImports) {
+    const usePath = rustUsePathOf(imp.targetRaw);
+    if (modulePathReaches(usePath, candidateModule)) return true;
+    // A `use` names an ITEM as often as a module (`use crate::user::User`), and
+    // whether `targetRaw` includes that final name varies by import form. Try
+    // the parent path too, or a module-only match would be missed.
+    const parent = usePath.slice(0, Math.max(0, usePath.lastIndexOf('::')));
+    if (parent !== '' && modulePathReaches(parent, candidateModule)) return true;
+  }
+  return false;
+}

gitnexus/src/core/ingestion/languages/rust/scope-resolver.ts

@@ -19,6 +19,7 @@ import type { GraphNodeLookup } from '../../scope-resolution/graph-bridge/node-l
 import type { HeritageTypeArgumentSink } from '../../scope-resolution/utils/generic-instantiation.js';
 import type { KnowledgeGraph } from '../../../graph/types.js';
 import { generateId } from '../../../../lib/utils.js';
+import { rustIsGlobalNameFallbackPlausible } from './name-fallback-visibility.js';
 
 /**
  * Emit Rust `S IMPLEMENTS T` edges from `impl T for S` trait implementations.
@@ -192,4 +193,5 @@ export const rustScopeResolver: ScopeResolver = {
   hoistTypeBindingsToModule: true,
   propagatesReturnTypesAcrossImports: true,
   allowGlobalFreeCallFallback: true,
+  isGlobalNameFallbackPlausible: rustIsGlobalNameFallbackPlausible,
 };

gitnexus/src/core/ingestion/languages/swift/name-fallback-visibility.ts

@@ -0,0 +1,62 @@
+/**
+ * Swift's veto on the global-name fallback — see
+ * `ScopeResolver.isGlobalNameFallbackPlausible`.
+ *
+ * Swift's default access level is `internal`: visible throughout the MODULE and
+ * nowhere else. Swift needs no per-file import inside a module, which is why
+ * the global fallback is enabled for it at all — but that whole-module
+ * visibility stops hard at the module boundary. A candidate in a DIFFERENT
+ * module is reachable only if the caller wrote `import <ThatModule>`, and even
+ * then only if the declaration is `public`.
+ *
+ * A module is approximated by its source directory, the layout every Swift
+ * package manifest produces: `Sources/<Target>/…` and `Tests/<Target>/…`. Files
+ * outside that layout fall back to their top-level directory.
+ *
+ * The `private` / `fileprivate` half of the rule is NOT implemented, because
+ * neither marker is recoverable from the parse model this hook sees —
+ * `SymbolDefinition` carries no access level and `ParsedFile` no modifiers.
+ * Those candidates keep the labeled low-confidence edge, which is the
+ * "cannot decide, so do not refuse" direction the hook contract asks for.
+ */
+
+import type { ParsedFile, SymbolDefinition } from 'gitnexus-shared';
+import { modulePathReaches } from '../../scope-resolution/utils/name-fallback-visibility.js';
+
+/** Directory names that hold one subdirectory PER TARGET rather than sources. */
+const SWIFT_TARGET_ROOTS: ReadonlySet<string> = new Set(['Sources', 'Tests', 'sources', 'tests']);
+
+/**
+ * The module (target) a Swift file belongs to.
+ *
+ * `Sources/Core/User.swift` → `Core`. A path with no target root returns its
+ * first segment, so a flat repository still groups its files together instead
+ * of putting every file in its own module.
+ */
+function swiftModuleOf(filePath: string): string {
+  const segments = filePath.split('/').filter((s) => s !== '');
+  for (let i = 0; i < segments.length - 1; i++) {
+    if (SWIFT_TARGET_ROOTS.has(segments[i]!)) return segments[i + 1]!;
+  }
+  return segments.length > 1 ? segments[0]! : '';
+}
+
+export function swiftIsGlobalNameFallbackPlausible(ctx: {
+  readonly callerParsed: ParsedFile;
+  readonly candidate: SymbolDefinition;
+}): boolean {
+  if (ctx.candidate.filePath === ctx.callerParsed.filePath) return true;
+
+  const callerModule = swiftModuleOf(ctx.callerParsed.filePath);
+  const candidateModule = swiftModuleOf(ctx.candidate.filePath);
+  // Same module: whole-module `internal` visibility, no import needed.
+  if (callerModule === candidateModule) return true;
+  // A file the layout heuristic cannot place is not something this rule can
+  // speak about — allow rather than refuse on an unanswered question.
+  if (callerModule === '' || candidateModule === '') return true;
+
+  for (const imp of ctx.callerParsed.parsedImports) {
+    if (modulePathReaches(imp.targetRaw, candidateModule)) return true;
+  }
+  return false;
+}

gitnexus/src/core/ingestion/languages/swift/scope-resolver.ts

@@ -66,6 +66,7 @@ import {
   mirrorSwiftSiblingTypeBindings,
   type SwiftResolveContext,
 } from './index.js';
+import { swiftIsGlobalNameFallbackPlausible } from './name-fallback-visibility.js';
 
 const ZERO_RANGE = { startLine: 0, startCol: 0, endLine: 0, endCol: 0 } as const;
 
@@ -136,6 +137,7 @@ const swiftScopeResolver: ScopeResolver = {
   // global free-call fallback (as Python/Go/Ruby/COBOL do for the same
   // no-`new` constructor + cross-file free-call shape).
   allowGlobalFreeCallFallback: true,
+  isGlobalNameFallbackPlausible: swiftIsGlobalNameFallbackPlausible,
 
   // Swift's call graph models `Type(...)` as a reference to the type
   // itself, not its `init` — both the legacy DAG and this test suite link

gitnexus/src/core/ingestion/languages/typescript/scope-resolver.ts

@@ -132,6 +132,15 @@ const typescriptScopeResolver: ScopeResolver = {
   fieldFallbackOnMethodLookup: false,
   propagatesReturnTypesAcrossImports: true,
 
+  // ECMAScript: `export * from './a'; export * from './b'` with a name declared
+  // in both exports NEITHER — the finalize pass refuses the binding instead of
+  // taking the first-listed source (see `exclusiveWildcardReexports`).
+  exclusiveWildcardReexports: true,
+  // `import { x }` never reaches a class member: named imports and named
+  // re-exports bind to module-level declarations only (a class method sharing
+  // a name with a top-level value must not win the callable preference).
+  namedImportsBindTopLevelOnly: true,
+
   // TypeScript uses `.values()` / `.keys()` method-call syntax for collection
   // views -- no property-style accessors like C#'s `Dictionary<K,V>.Values` --
   // so `elementTypeOf` answers only the `index` route and lets the regular

gitnexus/src/core/ingestion/languages/vue/scope-resolver.ts

@@ -117,6 +117,9 @@ const vueScopeResolver: ScopeResolver = {
   // Vue uses explicit imports for all external symbols; no global free-
   // call fallback needed (would produce spurious edges for built-ins).
   allowGlobalFreeCallFallback: false,
+  // Vue SFC scripts are TypeScript/JavaScript: a named import binds a module-level
+  // declaration, never a class member (see the TS resolver).
+  namedImportsBindTopLevelOnly: true,
 
   /**
    * Expand the scope-resolution file universe for Vue by performing a

gitnexus/src/core/ingestion/scope-resolution/contract/scope-resolver.ts

@@ -262,7 +262,8 @@
  *   - Node identity: same `generateId(...)` helper, same qualified-name
  *     keyspace, same File/Folder/Method/Class node labels.
  *   - Edge vocabulary: `'import-resolved' | 'global' | 'local-call' |
- *     'same-file' | 'interface-dispatch' | 'read' | 'write'` — both
+ *     'same-file' | 'interface-dispatch' | 'read' | 'write' |
+ *     'global-name-fallback'` — both
  *     paths emit the same reasons (see
  *     `gitnexus/src/core/ingestion/call-processor.ts` for the legacy
  *     emitter and `passes/receiver-bound-calls.ts` /
@@ -850,6 +851,80 @@ export interface ScopeResolver {
    */
   readonly allowGlobalFreeCallFallback?: boolean;
 
+  /**
+   * Two `wildcard` re-exports that both DECLARE a name make it AMBIGUOUS in
+   * this language — ECMAScript `export *` semantics, where the module simply
+   * does not export the name and any binding is a guess. Opt-in: for a
+   * language whose wildcard import is `#include`, `require` or a package
+   * fan-out, the same name in two files is an overload set or a redeclaration,
+   * and refusing it would delete real edges (C++ arity-narrowed overloads
+   * across two headers). Forwarded to `FinalizeHooks.wildcardCollisionIsAmbiguous`.
+   */
+  readonly exclusiveWildcardReexports?: boolean;
+
+  /**
+   * A named import or named re-export can only bind to a MODULE-LEVEL
+   * declaration of the target file — ECMAScript semantics, where
+   * `import { x }` never reaches a class member. Opt-in: languages that bind
+   * module-level members by bare name (static members, module functions)
+   * leave it off. Forwarded to `FinalizeHooks.namedImportsBindTopLevelOnly`.
+   */
+  readonly namedImportsBindTopLevelOnly?: boolean;
+
+  /**
+   * Veto for a single `allowGlobalFreeCallFallback` guess.
+   *
+   * The fallback picks a callable because its SIMPLE NAME is unique in the
+   * workspace — it consults no import and no scope chain. For most languages a
+   * large share of those guesses are not merely unlikely but IMPOSSIBLE: Go
+   * cannot call an unexported identifier from another package, ESM cannot see a
+   * name it did not import, Rust cannot reach an item with no `use` path. This
+   * hook is where a language states those rules, so the shared pass can drop
+   * the edge instead of publishing a guess that the language forbids.
+   *
+   * Return `false` to REFUSE (no edge, recorded as `fallback-refused`). Return
+   * `true`, or leave the hook undefined, to emit the labeled
+   * `global-name-fallback` edge. **Only answer `false` when the call is
+   * impossible, not when it is merely unproven** — a wrongly-refused candidate
+   * is a lost real edge, whereas a wrongly-allowed one is at least labeled and
+   * excluded from flows.
+   *
+   * Deliberately NOT folded into `isCallableVisibleFromCaller`: that hook also
+   * gates precise dispatch paths (implicit-this, member calls), so a rule
+   * written for the name-guess tier would silently suppress resolved edges too.
+   *
+   * `parsedFileOf` reaches the CANDIDATE's parse result — a language whose rule
+   * depends on the declaration side (an `export` marker, a `pub` marker) needs
+   * it, because `SymbolDefinition` carries no visibility field. It returns
+   * `undefined` for a path outside this pass's file set; treat that as
+   * "cannot decide" and allow.
+   */
+  readonly isGlobalNameFallbackPlausible?: (ctx: {
+    readonly callerParsed: ParsedFile;
+    readonly candidate: SymbolDefinition;
+    readonly parsedFileOf: (filePath: string) => ParsedFile | undefined;
+    /**
+     * Raw source of any parsed file, for languages whose visibility rule needs
+     * a declaration the parse does not carry (Go's package clause: a test file's
+     * `package foo_test` is a different package from its directory's `foo`).
+     * Absent when the pipeline has no contents at hand; hooks must then answer
+     * from paths alone and, when undecidable, allow.
+     */
+    readonly sourceTextOf?: (filePath: string) => string | undefined;
+    /**
+     * The call site, so a language can tell a BARE name from a PATH-QUALIFIED
+     * one. Both reach this tier — a qualified call whose qualifier the resolver
+     * could not follow falls through to the bare-name search with only its tail
+     * name — but they are not the same claim. Rust's `User::new(...)` named its
+     * type in source, so refusing it for lacking a `use` of the module would
+     * delete an edge the source spells out.
+     */
+    readonly site: {
+      readonly name: string;
+      readonly rawQualifiedName?: string;
+    };
+  }) => boolean;
+
   /**
    * In this language every `Method` belongs to a class instance, so a
    * FREE (receiver-less) call may resolve to a `Method` only when the

gitnexus/src/core/ingestion/scope-resolution/name-fallback-summary.ts

@@ -0,0 +1,201 @@
+/**
+ * Per-language census of the global-name fallback: how many CALLS edges rest on
+ * a unique-name guess, and how many guesses each language's visibility rules
+ * refused.
+ *
+ * Both halves are needed and neither is meaningful alone. A guess count with no
+ * refusal count cannot distinguish a language with genuinely few impossible
+ * candidates from one whose hook is missing; a refusal count with no guess count
+ * cannot distinguish a working guard from one that rejects everything. The pair
+ * is what makes the guard auditable on a real repository, which is the whole
+ * point of recording it — before this, guessed edges were emitted with the same
+ * reason and confidence as import-resolved ones and the number was unknowable.
+ *
+ * Structural sibling of `unresolved-receivers.ts`'s summary, and persisted the
+ * same way (`RepoMeta.nameFallbackEdges`).
+ */
+
+import { getLanguageFromFilename } from 'gitnexus-shared';
+import { logger } from '../../logger.js';
+import type { ResolutionOutcome } from './resolution-outcome.js';
+
+/**
+ * CALLS edges per language, from the caller→callee-name index the pipeline
+ * builds while its streaming sink is live (so it is complete under `--force`),
+ * bucketed by the CALLER's file language. Gives `NameFallbackSummary.byLanguage`
+ * its denominator: a guess count is only readable as a share of the calls.
+ */
+export function countCallsByLanguage(
+  index: ReadonlyMap<string, ReadonlySet<string>> | undefined,
+  nodes: { getNode(id: string): { properties: Record<string, unknown> } | undefined } | undefined,
+): Readonly<Record<string, number>> | undefined {
+  if (index === undefined || nodes === undefined) return undefined;
+  const counts = new Map<string, number>();
+  for (const [callerId, callees] of index) {
+    const filePath = nodes.getNode(callerId)?.properties?.filePath;
+    if (typeof filePath !== 'string') continue;
+    const language = getLanguageFromFilename(filePath) ?? 'unknown';
+    counts.set(language, (counts.get(language) ?? 0) + callees.size);
+  }
+  if (counts.size === 0) return undefined;
+  const out: Record<string, number> = {};
+  for (const [language, count] of [...counts.entries()].sort(([a], [b]) =>
+    a < b ? -1 : a > b ? 1 : 0,
+  )) {
+    out[language] = count;
+  }
+  return out;
+}
+
+/** Unattributed bucket for a pass that recorded no language. */
+const UNKNOWN_LANGUAGE = 'unknown';
+
+export interface NameFallbackLanguageCounts {
+  /** Labeled `global-name-fallback` edges emitted for this language — CALL SITES. */
+  readonly guessed: number;
+  /**
+   * Distinct (caller file, callee name) pairs among those sites — the unit
+   * `callsByLanguage` counts in, so `guessedPairs / callsByLanguage[lang]` is a
+   * ratio bounded by 1. Absent on a summary persisted before this field existed.
+   */
+  readonly guessedPairs?: number;
+  /** Candidates this language's `isGlobalNameFallbackPlausible` hook refused. */
+  readonly refused: number;
+}
+
+export interface NameFallbackSummary {
+  /** Language → guessed/refused counts. Languages with neither are absent. */
+  readonly byLanguage: Readonly<Record<string, NameFallbackLanguageCounts>>;
+  /** Guessed call sites, repo-wide. */
+  readonly totalGuessed: number;
+  /** Distinct (caller file, callee name) pairs among the guessed sites. */
+  readonly distinctGuessedPairs?: number;
+  readonly totalRefused: number;
+  /**
+   * Barrel names refused because two `export *` sources both declared them
+   * (`reexport-ambiguous`). Not a guess and not per-language — a name the
+   * finalize pass declined to bind at all — but it belongs in the same census:
+   * it is the other place the resolver used to publish an arbitrary winner as
+   * `import-resolved`.
+   */
+  readonly totalAmbiguousReexports: number;
+  /**
+   * The refused barrel names themselves (`file:name`), sorted, capped at
+   * `MAX_AMBIGUOUS_NAMES`. A count alone cannot say whether a refusal landed on
+   * a name anyone calls; the list can be joined against the ledger's `byName`.
+   */
+  readonly ambiguousReexportNames?: readonly string[];
+  /**
+   * CALLS edges per language (resolved through any path), so `guessed` can be
+   * read as a SHARE of a language's call graph rather than a bare count. Absent
+   * when the caller did not supply the totals.
+   */
+  readonly callsByLanguage?: Readonly<Record<string, number>>;
+}
+
+/** Bound on the persisted ambiguous-name list; the total beside it stays exact. */
+export const MAX_AMBIGUOUS_NAMES = 200;
+
+/**
+ * Build the summary, or `undefined` when the run neither guessed nor refused —
+ * a repository with no opt-in language stores no key at all, so the artifact
+ * stays absent rather than recording a row of zeroes.
+ */
+export function summarizeNameFallback(
+  outcomes: readonly ResolutionOutcome[],
+  callsByLanguage?: Readonly<Record<string, number>>,
+): NameFallbackSummary | undefined {
+  const guessed = new Map<string, number>();
+  const guessedPairsByLanguage = new Map<string, number>();
+  const refused = new Map<string, number>();
+  const ambiguousNames = new Set<string>();
+  // Two units, both kept. `guessed` counts call SITES — the number of emitted
+  // guessed edges, which is what the log line has always reported and what
+  // earlier persisted summaries hold. `guessedPairs` dedupes by (caller file,
+  // callee name), the unit `callsByLanguage` is counted in: ten guessed `foo()`
+  // calls in one file are one pair against a denominator that counts `foo`
+  // once, so the guessy RATIO uses pairs and is bounded by 1. Changing the unit
+  // of `guessed` itself silently read as a large improvement across engines.
+  const guessedPairs = new Set<string>();
+  let totalGuessed = 0;
+  let totalRefused = 0;
+  let totalAmbiguousReexports = 0;
+
+  for (const outcome of outcomes) {
+    if (outcome.kind === 'fallback-guessed') {
+      const language = outcome.language ?? UNKNOWN_LANGUAGE;
+      guessed.set(language, (guessed.get(language) ?? 0) + 1);
+      totalGuessed++;
+      const pair = `${outcome.filePath}\u0000${outcome.name}`;
+      if (!guessedPairs.has(pair)) {
+        guessedPairs.add(pair);
+        guessedPairsByLanguage.set(language, (guessedPairsByLanguage.get(language) ?? 0) + 1);
+      }
+    } else if (outcome.kind === 'fallback-refused') {
+      const language = outcome.language ?? UNKNOWN_LANGUAGE;
+      refused.set(language, (refused.get(language) ?? 0) + 1);
+      totalRefused++;
+    } else if (outcome.kind === 'reexport-ambiguous') {
+      totalAmbiguousReexports++;
+      ambiguousNames.add(`${outcome.filePath}:${outcome.name}`);
+    }
+  }
+  if (totalGuessed === 0 && totalRefused === 0 && totalAmbiguousReexports === 0) return undefined;
+
+  const byLanguage: Record<string, NameFallbackLanguageCounts> = {};
+  for (const language of new Set([...guessed.keys(), ...refused.keys()])) {
+    byLanguage[language] = {
+      guessed: guessed.get(language) ?? 0,
+      guessedPairs: guessedPairsByLanguage.get(language) ?? 0,
+      refused: refused.get(language) ?? 0,
+    };
+  }
+  const sortedNames = [...ambiguousNames].sort();
+  return {
+    byLanguage,
+    totalGuessed,
+    distinctGuessedPairs: guessedPairs.size,
+    totalRefused,
+    totalAmbiguousReexports,
+    ...(sortedNames.length > 0
+      ? { ambiguousReexportNames: sortedNames.slice(0, MAX_AMBIGUOUS_NAMES) }
+      : {}),
+    ...(callsByLanguage !== undefined ? { callsByLanguage } : {}),
+  };
+}
+
+/**
+ * One-line readout for the analyze summary. `undefined` when there is nothing to
+ * report, so a run on a repository with no opt-in language prints no line.
+ */
+export function formatNameFallbackSummary(
+  summary: NameFallbackSummary | undefined,
+): string | undefined {
+  if (summary === undefined) return undefined;
+  const perLanguage = Object.entries(summary.byLanguage)
+    .sort(([, a], [, b]) => b.guessed + b.refused - (a.guessed + a.refused))
+    .map(([language, counts]) => `${language} ${counts.guessed}/${counts.refused}`)
+    .join(', ');
+  const ambiguous =
+    summary.totalAmbiguousReexports > 0
+      ? `; ${summary.totalAmbiguousReexports} barrel name(s) refused as ambiguous \`export *\``
+      : '';
+  const languages = perLanguage === '' ? 'none' : perLanguage;
+  const pairs =
+    summary.distinctGuessedPairs !== undefined
+      ? ` (${summary.distinctGuessedPairs} distinct caller-file/name pairs)`
+      : '';
+  return `name-guessed CALLS edges: ${summary.totalGuessed} call sites${pairs}, ${summary.totalRefused} refused as impossible (guessed/refused by language: ${languages})${ambiguous}`;
+}
+
+/**
+ * Print the readout as part of the analyze summary. Unconditional (not behind a
+ * debug env var, unlike the receiver-drop diagnostic): a reader deciding how far
+ * to trust this index's call graph needs to know how much of it is guessed, and
+ * a number nobody sees is the state this work exists to end.
+ */
+export function logNameFallbackSummary(summary: NameFallbackSummary | undefined): void {
+  const line = formatNameFallbackSummary(summary);
+  if (line === undefined) return;
+  logger.info(line);
+}

gitnexus/src/core/ingestion/scope-resolution/passes/free-call-fallback.ts

@@ -36,6 +36,7 @@ import type {
   ResolutionOutcomeRecorder,
   ResolutionSuppressionReason,
 } from '../resolution-outcome.js';
+import { GLOBAL_NAME_FALLBACK_REASON } from '../../../graph/edge-reasons.js';
 import { resolveCallerGraphId, resolveDefGraphId } from '../graph-bridge/ids.js';
 import type { CalleeIdSink } from '../graph-bridge/callee-id-sink.js';
 import {
@@ -64,6 +65,15 @@ export function emitFreeCallFallback(
   workspaceIndex: WorkspaceResolutionIndex,
   options: {
     readonly allowGlobalFallback?: boolean;
+    /** Language whose pass this is, carried onto the fallback outcome records
+     *  so the analyze summary can report guesses/refusals PER LANGUAGE. A
+     *  repo-wide total hides which language's rules are the loose ones. */
+    readonly language?: string;
+    /** Per-language veto on a name guess — see
+     *  `ScopeResolver.isGlobalNameFallbackPlausible`. */
+    readonly isGlobalNameFallbackPlausible?: ScopeResolver['isGlobalNameFallbackPlausible'];
+    /** Raw source lookup handed to `isGlobalNameFallbackPlausible` (optional). */
+    readonly sourceTextOf?: (filePath: string) => string | undefined;
     /** When true, `Type(...)` constructor calls link to the Class def
      *  itself rather than its explicit Constructor. Swift opts in. */
     readonly constructorCallTargetsClass?: boolean;
@@ -138,6 +148,14 @@ export function emitFreeCallFallback(
   let allFilePathsMemo: ReadonlySet<string> | undefined;
   const allFilePaths = (): ReadonlySet<string> =>
     (allFilePathsMemo ??= new Set(parsedFiles.map((p) => p.filePath)));
+  // Candidate-side parse lookup for `isGlobalNameFallbackPlausible`. Built
+  // lazily and once, on the same terms as `allFilePaths` above: a language
+  // without the hook never pays for the index.
+  let parsedByPathMemo: ReadonlyMap<string, ParsedFile> | undefined;
+  const parsedFileByPath = (): ((filePath: string) => ParsedFile | undefined) => {
+    parsedByPathMemo ??= new Map(parsedFiles.map((p) => [p.filePath, p]));
+    return (filePath) => parsedByPathMemo!.get(filePath);
+  };
   // Per-pass memo of pickUniqueGlobalCallable's post-filter candidate list,
   // keyed (simpleName, callerFilePath). Only created when no per-caller
   // visibility filter applies (the list is then a pure function of name+file —
@@ -543,10 +561,18 @@ export function emitFreeCallFallback(
           }
         }
       }
-      // V1: pickUniqueGlobalCallable ignores import context — resolves to any
-      // globally-unique callable. False cross-package edges are possible when
-      // the caller does not import the target package. Same-package calls are
-      // usually caught by nearest-scope lookup before reaching here.
+      // Name-guess tier: pickUniqueGlobalCallable consults no import context —
+      // it resolves to any globally-unique callable. Same-package calls are
+      // usually caught by nearest-scope lookup before reaching here, so what
+      // lands in this tier is disproportionately cross-module, and a
+      // cross-module name match is a guess.
+      //
+      // Two things make that honest rather than a lie. The language's
+      // `isGlobalNameFallbackPlausible` hook refuses candidates its own
+      // visibility rules forbid (below), and every edge that survives is
+      // emitted with `GLOBAL_NAME_FALLBACK_REASON` at 0.5 rather than
+      // masquerading as `import-resolved` at 0.85 (see the emit site).
+      let fnDefFromGlobalNameFallback = false;
       if (fnDef === undefined && options.allowGlobalFallback === true) {
         fnDef = pickUniqueGlobalCallable(
           site.name,
@@ -570,6 +596,33 @@ export function emitFreeCallFallback(
           scopeDefsCache,
           options.conversionOnlyArgTypePrefixes,
         );
+        fnDefFromGlobalNameFallback = fnDef !== undefined;
+      }
+      if (fnDefFromGlobalNameFallback && fnDef !== undefined) {
+        if (
+          options.isGlobalNameFallbackPlausible?.({
+            callerParsed: parsed,
+            candidate: fnDef,
+            parsedFileOf: parsedFileByPath(),
+            sourceTextOf: options.sourceTextOf,
+            site: { name: site.name, rawQualifiedName: site.rawQualifiedName },
+          }) === false
+        ) {
+          // The language proved this call impossible. Mark the site handled so
+          // `emit-references` does not substitute its own looser guess for the
+          // edge we just refused — the point is no edge, not a different one.
+          options.recordResolutionOutcome?.({
+            kind: 'fallback-refused',
+            candidateId: fnDef.nodeId,
+            language: options.language,
+            phase: 'free-call-fallback',
+            filePath: parsed.filePath,
+            name: site.name,
+            range: site.atRange,
+          });
+          handledSites.add(siteKey(parsed.filePath, site));
+          continue;
+        }
       }
       if (fnDef === undefined) continue;
       if (fnDef.isDeleted === true) {
@@ -617,6 +670,17 @@ export function emitFreeCallFallback(
         site.atRange.startCol,
         tgtGraphId,
       );
+      if (fnDefFromGlobalNameFallback) {
+        options.recordResolutionOutcome?.({
+          kind: 'fallback-guessed',
+          targetId: fnDef.nodeId,
+          language: options.language,
+          phase: 'free-call-fallback',
+          filePath: parsed.filePath,
+          name: site.name,
+          range: site.atRange,
+        });
+      }
       const relId = `rel:CALLS:${callerGraphId}->${tgtGraphId}`;
       // One edge per (caller, callee): `staticGated` is the AND over every site
       // that collapses into it, so a callee reached from one live site and one
@@ -636,15 +700,24 @@ export function emitFreeCallFallback(
           sourceId: callerGraphId,
           targetId: tgtGraphId,
           type: 'CALLS',
-          confidence: 0.85,
-          // Match legacy DAG's reason convention so consumers that
-          // assert `reason === 'import-resolved'` keep working. The
-          // construction-site marker is opt-in for the same reason.
-          reason: constructionSiteReason(
-            fnDef.filePath !== parsed.filePath ? 'import-resolved' : 'local-call',
-            site,
-            options.markConstructionSites,
-          ),
+          // A name guess is not an import resolution and must not be spelled like
+          // one. It used to be emitted at 0.85 / `'import-resolved'`, which made
+          // it indistinguishable from an edge a real import produced — so every
+          // consumer that wanted to discount guesses had no field to do it with.
+          // 0.5 is the deliberate "coin flip" value, and the reason is what the
+          // process/community walks and the MCP tools actually key on, because
+          // 0.5 sits exactly ON their thresholds (see graph/edge-reasons.ts).
+          confidence: fnDefFromGlobalNameFallback ? 0.5 : 0.85,
+          reason: fnDefFromGlobalNameFallback
+            ? GLOBAL_NAME_FALLBACK_REASON
+            : // Match legacy DAG's reason convention so consumers that
+              // assert `reason === 'import-resolved'` keep working. The
+              // construction-site marker is opt-in for the same reason.
+              constructionSiteReason(
+                fnDef.filePath !== parsed.filePath ? 'import-resolved' : 'local-call',
+                site,
+                options.markConstructionSites,
+              ),
         },
       });
       emitted++;

gitnexus/src/core/ingestion/scope-resolution/pipeline/run.ts

@@ -732,9 +732,23 @@ export function runScopeResolution(
         provider.expandsWildcardTo?.(targetModuleScope, parsedFiles) ?? [],
       mergeBindings: (existing, incoming, scopeId) =>
         provider.mergeBindings(existing, incoming, scopeId),
+      wildcardCollisionIsAmbiguous: provider.exclusiveWildcardReexports === true,
+      namedImportsBindTopLevelOnly: provider.namedImportsBindTopLevelOnly === true,
     },
   });
   logHeapProbe('sr-post-finalize', `lang=${provider.language}`);
+  // `export *` collisions the shared finalize refused to bind (WS1 C2). Recorded
+  // as outcomes so the refusal is auditable next to the name-fallback census —
+  // a silently unresolved importer is indistinguishable from a resolver gap.
+  for (const refused of finalized.stats.ambiguousWildcardExports) {
+    recordResolutionOutcome({
+      kind: 'reexport-ambiguous',
+      candidateIds: refused.candidateDefIds,
+      phase: 'finalize',
+      filePath: refused.filePath,
+      name: refused.name,
+    });
+  }
   // One store and ONE writer rule for heritage instantiations (#2912), shared by
   // the pre-pass below and by the language hook further down — a heritage shape
   // the pre-pass cannot express (Rust `impl T for S`, Dart `implements`) records
@@ -1080,6 +1094,12 @@ export function runScopeResolution(
         workspaceIndex,
         {
           allowGlobalFallback: provider.allowGlobalFreeCallFallback === true,
+          language: provider.language,
+          isGlobalNameFallbackPlausible: provider.isGlobalNameFallbackPlausible,
+          sourceTextOf:
+            provider.isGlobalNameFallbackPlausible !== undefined
+              ? (filePath: string) => getFileContents().get(filePath)
+              : undefined,
           constructorCallTargetsClass: provider.constructorCallTargetsClass === true,
           markConstructionSites: provider.markConstructionSites === true,
           isFileLocalDef: provider.isFileLocalDef,

gitnexus/src/core/ingestion/scope-resolution/resolution-outcome.ts

@@ -108,6 +108,60 @@ export type ResolutionOutcome =
        * every real codebase and taught readers to ignore it.
        */
       readonly receiverOrigin?: ReceiverOrigin;
+    }
+  /**
+   * The global-name fallback fired: a callable was chosen because its SIMPLE
+   * NAME is unique in the workspace, with no import or scope chain leading to
+   * it. A labeled low-confidence edge WAS emitted.
+   *
+   * Separate from `resolved` because it is not a resolution, and separate from
+   * `suppressed` because an edge exists. Counting it is the only way a reader
+   * can tell how much of a language's call graph rests on name uniqueness — the
+   * number that was previously invisible because these edges were emitted with
+   * the same reason and confidence as import-resolved ones.
+   */
+  | {
+      readonly kind: 'fallback-guessed';
+      readonly targetId: string;
+      readonly language?: string;
+      readonly phase: string;
+      readonly filePath: string;
+      readonly name: string;
+      readonly range: Range;
+    }
+  /**
+   * A global-name-fallback candidate was REFUSED by the language's plausibility
+   * hook: the language's own visibility rules make that call impossible, so no
+   * edge was emitted.
+   *
+   * The counterpart of `fallback-guessed`, and the pair is what makes the
+   * refusal auditable — a refusal count with no guess count cannot distinguish
+   * "the guard works" from "the guard rejects everything".
+   */
+  | {
+      readonly kind: 'fallback-refused';
+      readonly candidateId: string;
+      readonly language?: string;
+      readonly phase: string;
+      readonly filePath: string;
+      readonly name: string;
+      readonly range: Range;
+    }
+  /**
+   * A barrel re-exported `name` through two or more `export *` sources that
+   * each declare it, so the language names no winner. The shared finalize pass
+   * REFUSED the binding (see `FinalizeStats.ambiguousWildcardExports`) instead
+   * of publishing the first-listed source as `import-resolved`; every importer
+   * of `name` through `filePath` stays unresolved. No `range`: the collision
+   * belongs to the file's export surface, not to one statement.
+   */
+  | {
+      readonly kind: 'reexport-ambiguous';
+      readonly candidateIds: readonly string[];
+      readonly phase: string;
+      /** The barrel file whose `export *` sources collide. */
+      readonly filePath: string;
+      readonly name: string;
     };
 
 /**

gitnexus/src/core/ingestion/scope-resolution/utils/name-fallback-visibility.ts

@@ -0,0 +1,95 @@
+/**
+ * Language-agnostic primitives for `ScopeResolver.isGlobalNameFallbackPlausible`
+ * implementations.
+ *
+ * The hook itself is per-language — the RULES here are not. What every
+ * implementation needs is the same small set of path arithmetic: which
+ * directory a file sits in, and whether a module path a caller wrote can name
+ * a given file or directory. Those questions are about paths, not about any
+ * language, so they live in shared code (see AGENTS.md: shared ingestion must
+ * not name languages) and the language files supply only the semantics.
+ */
+
+import type { ParsedFile } from 'gitnexus-shared';
+
+/** POSIX-style parent directory. `''` for a file at the repo root. */
+export function directoryOf(filePath: string): string {
+  const slash = filePath.lastIndexOf('/');
+  return slash === -1 ? '' : filePath.slice(0, slash);
+}
+
+/**
+ * Split a module path into segments, accepting the three separators languages
+ * spell module nesting with: `/` (Go, Node), `::` (Rust, C++) and `.` (JVM,
+ * Python). Empty segments are dropped, so a leading `./` or `crate::` prefix
+ * contributes nothing.
+ *
+ * `.` is only treated as a separator when the path contains no `/`: a Node
+ * specifier like `./util/parse.js` must not split on the extension dot.
+ */
+export function moduleSegments(modulePath: string): readonly string[] {
+  const bySlashOrColon = modulePath.split(/\/|::/).filter((s) => s !== '' && s !== '.');
+  if (modulePath.includes('/')) return bySlashOrColon;
+  return bySlashOrColon.flatMap((s) => s.split('.').filter((p) => p !== ''));
+}
+
+/**
+ * Does a module path a caller wrote reach `targetPath`?
+ *
+ * True when either side's segments are a SUFFIX of the other's. Both directions
+ * are needed and neither alone is sufficient:
+ *
+ *  - The written path is usually longer than the repo-relative one, because it
+ *    carries a module/package prefix that is not a directory
+ *    (`github.com/org/svc/internal/models` → `internal/models`).
+ *  - The repo-relative path is longer when the manifest that defines the module
+ *    root sits in a subdirectory of the analyzed tree (`svc/go.mod`, so
+ *    `svc/internal/models` is written `mod/internal/models`).
+ *
+ * So the match is on ALIGNED TRAILING SEGMENTS, and it succeeds when either the
+ * shorter side is fully contained in the longer, or at least two segments align.
+ * Both conditions are needed: full containment covers a one-segment package
+ * (`mod/models` reaching `models`), while the two-segment floor covers the case
+ * where neither side contains the other because each carries a different root
+ * (`mod/internal/models` vs `svc/internal/models`). A SINGLE aligned segment
+ * with neither side contained is not enough — `handlers` appearing at the end of
+ * two unrelated trees says nothing.
+ *
+ * Tolerance is the SAFE direction here: this predicate is consulted to decide
+ * whether to REFUSE an edge, so over-matching loses a refusal (the edge stays,
+ * labeled and excluded from flows) while under-matching loses a real edge.
+ */
+export function modulePathReaches(writtenPath: string, targetPath: string): boolean {
+  const written = moduleSegments(writtenPath);
+  const target = moduleSegments(targetPath);
+  if (written.length === 0 || target.length === 0) return false;
+  const shorter = Math.min(written.length, target.length);
+  let aligned = 0;
+  while (
+    aligned < shorter &&
+    written[written.length - 1 - aligned] === target[target.length - 1 - aligned]
+  ) {
+    aligned++;
+  }
+  return aligned === shorter || aligned >= 2;
+}
+
+/** Every module path this file's import statements named, in source order. */
+function importedModulePaths(parsed: ParsedFile): readonly string[] {
+  return parsed.parsedImports.map((imp) => imp.targetRaw);
+}
+
+/** True when any of the caller's imports reaches `targetPath`. */
+export function anyImportReaches(parsed: ParsedFile, targetPath: string): boolean {
+  for (const written of importedModulePaths(parsed)) {
+    if (modulePathReaches(written, targetPath)) return true;
+  }
+  return false;
+}
+
+/** Strip a trailing file extension. `a/b.rs` → `a/b`; `a/b` → `a/b`. */
+export function stripExtension(filePath: string): string {
+  const slash = filePath.lastIndexOf('/');
+  const dot = filePath.lastIndexOf('.');
+  return dot > slash ? filePath.slice(0, dot) : filePath;
+}

gitnexus/src/core/lbug/graph-emit-sink.ts

@@ -70,7 +70,7 @@
  *    replaced, so the obvious rewrite is not the one that shipped.
  * 3. The remaining ~90 ms was object allocation itself, irreducible while the
  *    read API returns objects — so the five whole-graph scans moved to
- *    `forEachRelationshipFields`, which passes the four fields they actually
+ *    `forEachRelationshipFields`, which passes the five fields they actually
  *    read as primitives and allocates nothing. See
  *    {@link GraphEmitSink.forEachRelationshipFields}.
  *
@@ -282,14 +282,19 @@ export class GraphEmitSink implements KnowledgeGraph, GraphEmitControl {
    * safe because `buildRelRow` never persists `rel.id` and no consumer keys on
    * it (audited).
    *
-   * The dropped `reason`/`step` are safe too, but for a different reason worth
-   * stating: the PERSISTED row keeps their true values, because `buildRelRow` is
-   * handed the original relationship on the way through. Only in-memory reads
-   * see the `'streamed'` placeholder, and the in-pipeline consumers of streamed
-   * edges read neither field. So e.g. the `ACCESSES reason: 'read'|'write'`
-   * distinction that MCP queries rely on survives in the database. A future
-   * in-pipeline consumer needing `reason` or `step` on a streamed edge must add
-   * the column, not trust the placeholder.
+   * `reason` IS now retained, as an interned index — the in-pipeline consumer
+   * this JSDoc anticipated arrived. Process tracing and large-graph community
+   * detection must exclude global-name-fallback edges, which are emitted at
+   * exactly their confidence threshold (0.5) and so cannot be separated by
+   * confidence alone. Interning keeps the cost at one small integer per edge
+   * (the reason vocabulary is a fixed set of literals), not one string.
+   *
+   * `id` and `step` remain dropped. The PERSISTED row keeps `step`'s true value,
+   * because `buildRelRow` is handed the original relationship on the way
+   * through; only in-memory OBJECT reads see the `'streamed'`-era placeholder,
+   * and no in-pipeline consumer of streamed edges reads `step`. A future
+   * in-pipeline consumer needing `step` must add the column, not trust the
+   * placeholder.
    *
    * Node ids are interned; the strings are shared by reference with the node
    * map's, so interning adds bookkeeping, not new text.
@@ -300,6 +305,12 @@ export class GraphEmitSink implements KnowledgeGraph, GraphEmitControl {
   private readonly tgtIx: number[] = [];
   private readonly relTypes: RelationshipType[] = [];
   private readonly confidences: number[] = [];
+  /** Interned reason strings, and the per-edge index into them. The vocabulary
+   *  is a fixed set of emitter literals, so this is O(vocabulary) text plus one
+   *  small integer per edge. */
+  private readonly reasonIds = new Map<string, number>();
+  private readonly reasonByIx: string[] = [];
+  private readonly reasonIx: number[] = [];
   private finalized = false;
   /**
    * Streaming is OFF until {@link beginStreaming} is called by `parse`.
@@ -472,6 +483,16 @@ export class GraphEmitSink implements KnowledgeGraph, GraphEmitControl {
     this.tgtIx.push(tgtIx);
     this.relTypes.push(relationship.type);
     this.confidences.push(relationship.confidence);
+    this.reasonIx.push(this.internReason(relationship.reason));
+  }
+
+  private internReason(reason: string): number {
+    const existing = this.reasonIds.get(reason);
+    if (existing !== undefined) return existing;
+    const ix = this.reasonByIx.length;
+    this.reasonByIx.push(reason);
+    this.reasonIds.set(reason, ix);
+    return ix;
   }
 
   /** Flush + close every writer and return the COPY manifest. Every fd is
@@ -599,7 +620,13 @@ export class GraphEmitSink implements KnowledgeGraph, GraphEmitControl {
    * with the object-based graph despite holding relationships columnar.
    */
   forEachRelationshipFields(
-    fn: (sourceId: string, targetId: string, type: RelationshipType, confidence: number) => void,
+    fn: (
+      sourceId: string,
+      targetId: string,
+      type: RelationshipType,
+      confidence: number,
+      reason: string,
+    ) => void,
   ): void {
     this.real.forEachRelationshipFields(fn);
     for (let ix = 0; ix < this.srcIx.length; ix++) {
@@ -608,6 +635,7 @@ export class GraphEmitSink implements KnowledgeGraph, GraphEmitControl {
         this.nodeIdByIx[this.tgtIx[ix]],
         this.relTypes[ix],
         this.confidences[ix],
+        this.reasonByIx[this.reasonIx[ix]],
       );
     }
   }

gitnexus/src/core/lbug/pdg-emit-sink.ts

@@ -299,7 +299,13 @@ export class PdgEmitSink implements KnowledgeGraph {
     this.real.forEachRelationship(fn);
   }
   forEachRelationshipFields(
-    fn: (sourceId: string, targetId: string, type: RelationshipType, confidence: number) => void,
+    fn: (
+      sourceId: string,
+      targetId: string,
+      type: RelationshipType,
+      confidence: number,
+      reason: string,
+    ) => void,
   ): void {
     this.real.forEachRelationshipFields(fn);
   }

gitnexus/src/core/run-analyze.ts

@@ -17,6 +17,11 @@ import { constants as fsConstants } from 'node:fs';
 import { randomUUID } from 'node:crypto';
 import { retryRename } from '../storage/fs-atomic.js';
 import { acquireIndexLock } from '../storage/index-lock.js';
+import { invalidateNodeWorkspacePackages } from './ingestion/import-resolvers/node-workspace-packages.js';
+import {
+  logNameFallbackSummary,
+  summarizeNameFallback,
+} from './ingestion/scope-resolution/name-fallback-summary.js';
 import { runPipelineFromRepo } from './ingestion/pipeline.js';
 import {
   logUnresolvedReceiverFiles,
@@ -1076,6 +1081,9 @@ export async function runFullAnalysis(
   // Scope the degraded-parse log throttle to this run (module-level counter
   // would otherwise stay saturated on a reused process).
   resetDegradedParseCounter();
+  // The workspace-package memo is per process: this run must see the tree as it
+  // is now, not as the previous run in a long-lived watch/server process saw it.
+  invalidateNodeWorkspacePackages(repoPath);
 
   const log = (msg: string) => callbacks.onLog?.(stripControlCharacters(msg));
   const acquireOpts = {
@@ -3861,6 +3869,11 @@ async function runFullAnalysisInner(
 
     const resolutionOutcomes = pipelineResult.resolutionOutcomes ?? [];
     logUnresolvedReceiverFiles(resolutionOutcomes);
+    // Census of name-guessed CALLS edges (labeled `global-name-fallback`), refused
+    // impossibles and ambiguous `export *` names — the honesty readout for this
+    // run's resolution. Logged, and persisted below as `nameFallbackEdges`.
+    const nameFallbackSummary = summarizeNameFallback(resolutionOutcomes);
+    logNameFallbackSummary(nameFallbackSummary);
 
     // Annotated so the capabilities stamp below is compile-checked against
     // RepoMeta's status unions (tri-review 4669518496 P1/U3) — an unannotated
@@ -3977,6 +3990,7 @@ async function runFullAnalysisInner(
       // Git-only: non-git repos never take the incremental path.
       schemaFingerprint: hasGitDir(repoPath) ? SCHEMA_FINGERPRINT : undefined,
       unresolvedReceiverMembers: summarizeUnresolvedReceivers(resolutionOutcomes),
+      nameFallbackEdges: nameFallbackSummary,
       scopeExtractionFailures: summarizeScopeExtractionFailures(
         pipelineResult.scopeExtractionFailures,
       ),

gitnexus/src/storage/repo-meta.ts

@@ -28,6 +28,7 @@
 import fs from 'fs/promises';
 import path from 'path';
 import type { UnresolvedReceiverSummary } from '../core/ingestion/scope-resolution/unresolved-receivers.js';
+import type { NameFallbackSummary } from '../core/ingestion/scope-resolution/name-fallback-summary.js';
 import type { UndecidedSatisfactionSummary } from '../core/ingestion/scope-resolution/undecided-satisfaction.js';
 import type { ScopeExtractionFailureSummary } from '../core/ingestion/scope-resolution/scope-extraction-failures.js';
 
@@ -311,6 +312,13 @@ export interface RepoMeta {
    * reads as absent, and both correctly mean "no hedge available from here".
    */
   undecidedInterfaceSatisfaction?: UndecidedSatisfactionSummary;
+  /**
+   * Census of the name-guessed CALLS edges the run emitted (labeled
+   * `global-name-fallback`), the impossible ones it refused, and the ambiguous
+   * `export *` names it declined to publish. Absent on indexes built before the
+   * census existed. See `scope-resolution/name-fallback-summary.ts`.
+   */
+  nameFallbackEdges?: NameFallbackSummary;
   /**
    * SHA-256 of every file's content at the time of the last successful
    * indexing run. The next run computes current hashes and diffs against

gitnexus/test/integration/resolvers/barrel-dir-index-wildcard.test.ts

@@ -0,0 +1,135 @@
+/**
+ * C2 — the grafana `Button` shape: a workspace barrel `export *`s a components
+ * index, which re-exports NAMED bindings (with inline `type` modifiers) from a
+ * DIRECTORY index, which `export *`s the real file, whose `Button` is a
+ * `React.forwardRef` const. Measured on grafana@871af0720: `Button` resolved 8
+ * of 475 ledger entries while siblings through plain hops resolved at scale.
+ */
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import path from 'path';
+import fs from 'node:fs';
+import os from 'node:os';
+import {
+  getRelationships,
+  getResolutionOutcomes,
+  runPipelineFromRepo,
+  writeFixtureRepo,
+  type PipelineResult,
+} from './helpers.js';
+
+describe('named re-export through a directory index that wildcards (grafana Button shape)', () => {
+  let result: PipelineResult;
+  let repoDir: string | undefined;
+
+  beforeAll(async () => {
+    repoDir = fs.mkdtempSync(path.join(os.tmpdir(), 'gn-c2-dir-index-'));
+    writeFixtureRepo(repoDir, {
+      'package.json': '{ "name": "root", "private": true, "workspaces": ["packages/*"] }\n',
+      'packages/ui/package.json':
+        '{ "name": "@x/ui", "version": "1.0.0", "main": "src/index.ts" }\n',
+      'packages/ui/src/index.ts': `export * from './components';\nexport * from './themes';\n`,
+      // Inline `type` modifiers on the same statement as value re-exports.
+      'packages/ui/src/components/index.ts': `export { Stack } from './Layout/Stack';
+export { Button, LinkButton, type ButtonVariant, ButtonGroup, type ButtonProps, clearButtonStyles } from './Button';
+`,
+      // Directory index: wildcard + one named re-export.
+      'packages/ui/src/components/Button/index.ts': `export * from './Button';\nexport { ButtonGroup } from './ButtonGroup';\n`,
+      'packages/ui/src/components/Button/Button.tsx': `import React from 'react';
+export type ButtonVariant = 'primary' | 'secondary';
+export interface ButtonProps { variant?: ButtonVariant; label: string }
+export const Button = React.forwardRef<HTMLButtonElement, ButtonProps>((props, ref) => {
+  return null;
+});
+export const LinkButton = React.forwardRef<HTMLAnchorElement, ButtonProps>((props, ref) => {
+  return null;
+});
+export const clearButtonStyles = (theme: string) => {
+  return theme;
+};
+`,
+      'packages/ui/src/components/Button/ButtonGroup.tsx': `export function ButtonGroup(children: string) {
+  return children;
+}
+`,
+      'packages/ui/src/components/Layout/Stack.tsx': `export function Stack(children: string) {
+  return children;
+}
+`,
+      'packages/ui/src/themes/index.ts': `export * from './hooks';\n`,
+      'packages/ui/src/themes/hooks/index.ts': `export * from './useStyles2';\n`,
+      'packages/ui/src/themes/hooks/useStyles2.ts': `export function useStyles2(fn: (t: string) => string) {
+  return fn('theme');
+}
+`,
+      'packages/app/package.json':
+        '{ "name": "@x/app", "version": "1.0.0", "main": "src/main.tsx", "dependencies": { "@x/ui": "1.0.0" } }\n',
+      'packages/app/tsconfig.json': `{ "compilerOptions": { "jsx": "react-jsx" } }\n`,
+      'packages/app/src/main.tsx': `import { Button, LinkButton, ButtonGroup, clearButtonStyles, Stack, useStyles2 } from '@x/ui';
+
+export function render() {
+  const styles = useStyles2((t) => t);
+  clearButtonStyles(styles);
+  ButtonGroup('x');
+  Stack('y');
+  const a = <Button label="a" />;
+  const b = <LinkButton label="b" />;
+  return [a, b];
+}
+`,
+    });
+    result = await runPipelineFromRepo(repoDir, () => {});
+  }, 120_000);
+
+  afterAll(() => {
+    if (repoDir !== undefined)
+      fs.rmSync(repoDir, { recursive: true, force: true, maxRetries: 5, retryDelay: 50 });
+  });
+
+  const callsFromMain = () =>
+    getRelationships(result, 'CALLS').filter((e) =>
+      e.sourceFilePath.includes('packages/app/src/main.tsx'),
+    );
+
+  it('resolves the plain named hop (Stack) and the deep wildcard chain (useStyles2)', () => {
+    const targets = callsFromMain().map((e) => e.target);
+    expect(targets.some((t) => t.includes('Stack'))).toBe(true);
+    expect(targets.some((t) => t.includes('useStyles2'))).toBe(true);
+  });
+
+  it('resolves value names on a statement that also carries inline `type` modifiers', () => {
+    const targets = callsFromMain().map((e) => e.target);
+    expect(targets.some((t) => t.includes('clearButtonStyles'))).toBe(true);
+    expect(targets.some((t) => t.includes('ButtonGroup'))).toBe(true);
+  });
+
+  it('resolves a forwardRef const component used as JSX through the dir-index wildcard', () => {
+    const targets = callsFromMain().map((e) => e.target);
+    // Exact name — `/Button$/` also matched `LinkButton`, which made the
+    // assertion below imply this one and would have let zero `Button` edges pass.
+    expect(targets).toContain('Button');
+    expect(targets.some((t) => t.includes('LinkButton'))).toBe(true);
+  });
+
+  it('refuses nothing on this shape (no ambiguity, no fallback)', () => {
+    const outcomes = getResolutionOutcomes(result);
+    expect(outcomes.filter((o) => o.kind === 'reexport-ambiguous')).toEqual([]);
+    expect(outcomes.filter((o) => o.kind === 'fallback-guessed')).toEqual([]);
+  });
+
+  // The bug this fixture regresses against wasn't "no edge" — it was an edge
+  // to the WRONG node. `export const Button = React.forwardRef(...)` emits a
+  // `Variable` def for the lexical declaration alongside the `Function` def
+  // for the arrow; before the wildcard fan-out used the same
+  // callable-preferred index the named-reexport path already used, whichever
+  // def `localDefs` happened to iterate first could win the closure slot. An
+  // edge landing on `Variable` would still show up in a `target` name match
+  // (both defs share the simple name) while pointing at the wrong graph node
+  // — so the label, not just the name, is the assertion that actually catches
+  // a regression here.
+  it('every arrow-const winner through the wildcard chain is the Function def, not the Variable shadow', () => {
+    const byTarget = new Map(callsFromMain().map((e) => [e.target, e.targetLabel]));
+    expect(byTarget.get('Button')).toBe('Function');
+    expect(byTarget.get('LinkButton')).toBe('Function');
+    expect(byTarget.get('clearButtonStyles')).toBe('Function');
+  });
+});

gitnexus/test/integration/resolvers/barrel-named-import-class-method.test.ts

@@ -0,0 +1,68 @@
+import { describe, it, expect } from 'vitest';
+import path from 'path';
+import fs from 'node:fs';
+import os from 'node:os';
+import { getRelationships, runPipelineFromRepo, writeFixtureRepo } from './helpers.js';
+
+/**
+ * `namedImportsBindTopLevelOnly` (ECMAScript): `import { beta }` can never reach a
+ * class member. Before the hook, `findExportByName`'s callable preference let
+ * `Foo.beta()` outrank the top-level `const beta = 42` — or bind on its own when no
+ * top-level `beta` existed — and the import produced a confident CALLS edge to a
+ * symbol the module cannot export. Incorrect context is worse than missing: the
+ * Variable shadow must win and emit no edge; the member must never bind.
+ */
+const impl = `export const beta = 42;\nexport function alpha(s: string) { return s; }\nexport class Foo { beta() { return 1; } }\n`;
+const memberOnly = `export function alpha(s: string) { return s; }\nexport class Foo { beta() { return 1; } }\n`;
+
+async function run(name: string, files: Record<string, string>) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), `gn-named-member-${name}-`));
+  writeFixtureRepo(dir, files);
+  const result = await runPipelineFromRepo(dir, () => {});
+  const targets = getRelationships(result, 'CALLS')
+    .filter((e) => e.sourceFilePath.includes('src/main'))
+    .map((e) => e.target)
+    .sort();
+  fs.rmSync(dir, { recursive: true, force: true, maxRetries: 5, retryDelay: 50 });
+  return targets;
+}
+
+describe('named imports bind module-level declarations only (TS/JS)', () => {
+  it('direct named import: a class method sharing a top-level value name emits no edge', async () => {
+    const targets = await run('direct', {
+      'package.json': '{ "name": "root", "private": true }\n',
+      'src/Impl.ts': impl,
+      'src/main.ts': `import { alpha, beta } from './Impl';\nexport function render() { alpha('a'); beta(); }\n`,
+    });
+    expect(targets).toEqual(['alpha']);
+  }, 60000);
+
+  it('direct named import: a class method with NO top-level declaration does not bind', async () => {
+    const targets = await run('member-only', {
+      'package.json': '{ "name": "root", "private": true }\n',
+      'src/Impl.ts': memberOnly,
+      'src/main.ts': `import { alpha, beta } from './Impl';\nexport function render() { alpha('a'); beta(); }\n`,
+    });
+    expect(targets).toEqual(['alpha']);
+  }, 60000);
+
+  it('named re-export through a barrel: same rule', async () => {
+    const targets = await run('barrel', {
+      'package.json': '{ "name": "root", "private": true }\n',
+      'src/Impl.ts': impl,
+      'src/index.ts': `export { alpha, beta } from './Impl';\n`,
+      'src/main.ts': `import { alpha, beta } from './index';\nexport function render() { alpha('a'); beta(); }\n`,
+    });
+    expect(targets).toEqual(['alpha']);
+  }, 60000);
+
+  it('control: a top-level arrow-const behind the same barrel still binds', async () => {
+    const targets = await run('control', {
+      'package.json': '{ "name": "root", "private": true }\n',
+      'src/Impl.ts': `export const beta = () => 1;\nexport function alpha(s: string) { return s; }\n`,
+      'src/index.ts': `export { alpha, beta } from './Impl';\n`,
+      'src/main.ts': `import { alpha, beta } from './index';\nexport function render() { alpha('a'); beta(); }\n`,
+    });
+    expect(targets).toEqual(['alpha', 'beta']);
+  }, 60000);
+});

gitnexus/test/integration/resolvers/barrel-named-over-star-precedence.test.ts

@@ -0,0 +1,56 @@
+/**
+ * C6 — ECMAScript precedence: an explicit named export shadows a star
+ * collision. Only star-vs-star is ambiguous; `export { collide } from './a'`
+ * next to `export * from './a'; export * from './b'` binds `a`'s `collide`
+ * and must NOT be refused.
+ */
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import path from 'path';
+import fs from 'node:fs';
+import os from 'node:os';
+import {
+  getRelationships,
+  getResolutionOutcomes,
+  runPipelineFromRepo,
+  writeFixtureRepo,
+  type PipelineResult,
+} from './helpers.js';
+
+describe('named export shadows a star collision', () => {
+  let result: PipelineResult;
+  let dir: string;
+  beforeAll(async () => {
+    dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gn-c6-prec-'));
+    writeFixtureRepo(dir, {
+      'package.json': '{ "name": "root", "private": true, "workspaces": ["packages/*"] }\n',
+      'packages/ui/package.json':
+        '{ "name": "@x/ui", "version": "1.0.0", "main": "src/index.ts" }\n',
+      'packages/ui/src/index.ts': `export { collide } from './a';\nexport * from './a';\nexport * from './b';\n`,
+      'packages/ui/src/a.ts': `export function collide() { return 'a'; }\nexport function onlyA() { return 1; }\n`,
+      'packages/ui/src/b.ts': `export function collide() { return 'b'; }\nexport function onlyB() { return 2; }\n`,
+      'packages/app/package.json':
+        '{ "name": "@x/app", "version": "1.0.0", "main": "src/main.ts", "dependencies": { "@x/ui": "1.0.0" } }\n',
+      'packages/app/src/main.ts': `import { collide, onlyA, onlyB } from '@x/ui';\nexport function run() { collide(); onlyA(); onlyB(); }\n`,
+    });
+    result = await runPipelineFromRepo(dir, () => {});
+  }, 120_000);
+  afterAll(() => fs.rmSync(dir, { recursive: true, force: true, maxRetries: 5, retryDelay: 50 }));
+
+  it('binds the named export (a.ts) and does not refuse it', () => {
+    const edges = getRelationships(result, 'CALLS').filter(
+      (e) => e.sourceFilePath.includes('main.ts') && e.target === 'collide',
+    );
+    expect(edges.length).toBe(1);
+    expect(edges[0]!.targetFilePath).toContain('packages/ui/src/a.ts');
+    expect(getResolutionOutcomes(result).filter((o) => o.kind === 'reexport-ambiguous')).toEqual(
+      [],
+    );
+  });
+  it('still resolves the non-colliding star names', () => {
+    const targets = getRelationships(result, 'CALLS')
+      .filter((e) => e.sourceFilePath.includes('main.ts'))
+      .map((e) => e.target)
+      .sort();
+    expect(targets).toEqual(['collide', 'onlyA', 'onlyB']);
+  });
+});

gitnexus/test/integration/resolvers/barrel-wildcard-arrow-const.test.ts

@@ -0,0 +1,92 @@
+import { describe, it, expect } from 'vitest';
+import path from 'path';
+import fs from 'node:fs';
+import os from 'node:os';
+import { getRelationships, runPipelineFromRepo, writeFixtureRepo } from './helpers.js';
+
+const base = {
+  'package.json': '{ "name": "root", "private": true, "workspaces": ["packages/*"] }\n',
+  'packages/ui/package.json': '{ "name": "@x/ui", "version": "1.0.0", "main": "src/index.ts" }\n',
+  'packages/ui/src/index.ts': `export * from './components';\n`,
+  'packages/ui/src/components/index.ts': `export { alpha, beta } from './Impl';\n`,
+  'packages/ui/src/components/Impl/index.ts': `export * from './Impl';\n`,
+  'packages/app/package.json':
+    '{ "name": "@x/app", "version": "1.0.0", "main": "src/main.ts", "dependencies": { "@x/ui": "1.0.0" } }\n',
+  'packages/app/src/main.ts': `import { alpha, beta } from '@x/ui';\nexport function render() { alpha('a'); beta('b'); }\n`,
+};
+async function run(name: string, extra: Record<string, string>, remove: string[] = []) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), `gn-c2b-${name}-`));
+  const files: Record<string, string> = { ...base, ...extra };
+  for (const r of remove) delete files[r];
+  writeFixtureRepo(dir, files);
+  const result = await runPipelineFromRepo(dir, () => {});
+  const targets = getRelationships(result, 'CALLS')
+    .filter((e) => e.sourceFilePath.includes('packages/app/src/main'))
+    .map((e) => e.target)
+    .sort();
+  fs.rmSync(dir, { recursive: true, force: true, maxRetries: 5, retryDelay: 50 });
+  return targets;
+}
+describe('C2 probe 2', () => {
+  it('E: impl is a .tsx file with plain function exports', async () => {
+    expect(
+      await run('e', {
+        'packages/ui/src/components/Impl/Impl.tsx': `export function alpha(s: string) { return s; }\nexport function beta(s: string) { return s; }\n`,
+      }),
+    ).toEqual(['alpha', 'beta']);
+  }, 60000);
+  it('F: impl is .ts with ARROW CONST exports', async () => {
+    expect(
+      await run('f', {
+        'packages/ui/src/components/Impl/Impl.ts': `export const alpha = (s: string) => { return s; };\nexport const beta = (s: string) => { return s; };\n`,
+      }),
+    ).toEqual(['alpha', 'beta']);
+  }, 60000);
+  it('G: impl is .ts with a React import + forwardRef generic const alongside plain fns', async () => {
+    expect(
+      await run('g', {
+        'packages/ui/src/components/Impl/Impl.ts': `import React from 'react';\nexport const Widget = React.forwardRef<HTMLButtonElement, { label: string }>((props, ref) => { return null; });\nexport function alpha(s: string) { return s; }\nexport function beta(s: string) { return s; }\n`,
+      }),
+    ).toEqual(['alpha', 'beta']);
+  }, 60000);
+  it('H: main is .tsx and ALSO uses a JSX element', async () => {
+    expect(
+      await run(
+        'h',
+        {
+          'packages/ui/src/components/Impl/Impl.ts': `export function alpha(s: string) { return s; }\nexport function beta(s: string) { return s; }\nexport function Widget(p: { label: string }) { return null; }\n`,
+          'packages/ui/src/components/index.ts': `export { alpha, beta, Widget } from './Impl';\n`,
+          'packages/app/src/main.tsx': `import { alpha, beta, Widget } from '@x/ui';\nexport function render() { alpha('a'); beta('b'); return <Widget label="x" />; }\n`,
+        },
+        ['packages/app/src/main.ts'],
+      ),
+    ).toEqual(['Widget', 'alpha', 'beta']);
+  }, 60000);
+  it('B1: a class METHOD sharing a top-level const name never wins the wildcard fan-out', async () => {
+    // `export *` can only publish module-level declarations. `Foo.render` is
+    // callable and outranked the value shadow in the callable-preferred index,
+    // binding `import { render }` to a symbol it can never reach. The safe
+    // outcome is the pre-existing one: a value shadow yields NO CALLS edge.
+    expect(
+      await run('b1', {
+        'packages/ui/src/components/Impl/Impl.ts': `export const alpha = (s: string) => { return s; };\nexport const beta = 42;\nexport class Foo { beta() { return 1; } }\n`,
+      }),
+    ).toEqual(['alpha']);
+  }, 60000);
+  it('B1 control: the arrow const still wins over its own Variable shadow', async () => {
+    expect(
+      await run('b1c', {
+        'packages/ui/src/components/Impl/Impl.ts': `export const alpha = (s: string) => { return s; };\nexport const beta = (s: string) => { return s; };\nexport class Foo { alpha() { return 1; } }\n`,
+      }),
+    ).toEqual(['alpha', 'beta']);
+  }, 60000);
+  it('I: dir index has wildcard AND a named re-export from a sibling', async () => {
+    expect(
+      await run('i', {
+        'packages/ui/src/components/Impl/index.ts': `export * from './Impl';\nexport { beta } from './Beta';\n`,
+        'packages/ui/src/components/Impl/Impl.ts': `export function alpha(s: string) { return s; }\n`,
+        'packages/ui/src/components/Impl/Beta.ts': `export function beta(s: string) { return s; }\n`,
+      }),
+    ).toEqual(['alpha', 'beta']);
+  }, 60000);
+});

gitnexus/test/integration/resolvers/name-fallback-edges.test.ts

@@ -0,0 +1,156 @@
+/**
+ * End-to-end behaviour of the global-name fallback after WS1-A.
+ *
+ * Two things used to be true at once and both were wrong:
+ *
+ *  1. A call to a name that happens to be unique in the repository acquired a
+ *     CALLS edge even when the language forbids the call outright — Go's
+ *     unexported identifiers being the clearest case.
+ *  2. Every such edge was emitted with `confidence: 0.85` and
+ *     `reason: 'import-resolved'`, i.e. spelled exactly like an edge a real
+ *     import produced, so no consumer could discount it.
+ *
+ * These tests pin both. The Go arm proves the impossible edge is now REFUSED,
+ * with the same-package call kept as the control that shows the refusal is
+ * targeted rather than a blanket disabling of the tier. The Ruby arm proves a
+ * surviving guess is LABELED, since Ruby deliberately keeps the tier for
+ * autoload. The last test is the regression that matters most: no edge from
+ * this tier may ever again carry `import-resolved`.
+ */
+
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import path from 'path';
+import fs from 'node:fs';
+import os from 'node:os';
+import {
+  getRelationships,
+  getResolutionOutcomes,
+  runPipelineFromRepo,
+  writeFixtureRepo,
+  type PipelineResult,
+} from './helpers.js';
+import { GLOBAL_NAME_FALLBACK_REASON } from '../../../src/core/graph/edge-reasons.js';
+
+const rmRepo = (dir: string | undefined): void => {
+  if (dir !== undefined) {
+    fs.rmSync(dir, { recursive: true, force: true, maxRetries: 5, retryDelay: 50 });
+  }
+};
+
+describe('Go: an unexported identifier is not callable from another package', () => {
+  let result: PipelineResult;
+  let repoDir: string | undefined;
+
+  beforeAll(async () => {
+    repoDir = fs.mkdtempSync(path.join(os.tmpdir(), 'gn-ws1-go-fallback-'));
+    writeFixtureRepo(repoDir, {
+      'go.mod': 'module example.com/mod\n\ngo 1.22\n',
+      // Package `a` owns `uniqueHelperXyz`. The name is unique repo-wide, which
+      // is the ONLY reason the old fallback matched it from package `b`.
+      'a/helper.go': `package a
+
+func uniqueHelperXyz() int {
+	return 41
+}
+
+func UseItLocally() int {
+	return uniqueHelperXyz() + 1
+}
+`,
+      // Package `b` cannot see `uniqueHelperXyz` under any spelling: Go's
+      // lower-case initial makes it package-private, so no import helps.
+      'b/caller.go': `package b
+
+func CallItRemotely() int {
+	return uniqueHelperXyz() + 1
+}
+`,
+    });
+    result = await runPipelineFromRepo(repoDir, () => {});
+  }, 120000);
+
+  afterAll(() => rmRepo(repoDir));
+
+  it('keeps the same-package call (control: the tier still works)', () => {
+    const calls = getRelationships(result, 'CALLS');
+    const local = calls.find((c) => c.source === 'UseItLocally' && c.target === 'uniqueHelperXyz');
+    expect(local).toBeDefined();
+  });
+
+  it('emits NO caller edge from the other package', () => {
+    const calls = getRelationships(result, 'CALLS');
+    const crossPackage = calls.filter(
+      (c) => c.source === 'CallItRemotely' && c.target === 'uniqueHelperXyz',
+    );
+    expect(crossPackage).toEqual([]);
+  });
+
+  it('records the drop as a refusal rather than losing it silently', () => {
+    const refusals = getResolutionOutcomes(result).filter(
+      (o) => o.kind === 'fallback-refused' && o.name === 'uniqueHelperXyz',
+    );
+    expect(refusals.length).toBeGreaterThan(0);
+    expect(refusals.every((o) => o.kind === 'fallback-refused' && o.language === 'go')).toBe(true);
+  });
+
+  it('lists no cross-package caller for the unexported helper at all', () => {
+    // The shape an `impact --direction upstream` answer is built from: every
+    // CALLS edge whose target is the helper. Package `b` must not appear.
+    const callers = getRelationships(result, 'CALLS')
+      .filter((c) => c.target === 'uniqueHelperXyz')
+      .map((c) => c.sourceFilePath);
+    expect(callers.some((filePath) => filePath.includes('b/caller.go'))).toBe(false);
+    expect(callers.some((filePath) => filePath.includes('a/helper.go'))).toBe(true);
+  });
+});
+
+describe('Ruby: a surviving name guess is labeled as a guess', () => {
+  let result: PipelineResult;
+  let repoDir: string | undefined;
+
+  beforeAll(async () => {
+    repoDir = fs.mkdtempSync(path.join(os.tmpdir(), 'gn-ws1-ruby-fallback-'));
+    writeFixtureRepo(repoDir, {
+      // A top-level method in one file, called from another with no `require` —
+      // the autoload shape Ruby keeps the fallback for. The edge is a guess and
+      // is allowed to exist, but it must say so.
+      'app/a.rb': `def unique_helper_xyz
+  41
+end
+`,
+      'app/b.rb': `def call_it
+  unique_helper_xyz()
+end
+`,
+    });
+    result = await runPipelineFromRepo(repoDir, () => {});
+  }, 120000);
+
+  afterAll(() => rmRepo(repoDir));
+
+  it('emits the edge with the guess reason and 0.5 confidence', () => {
+    const edge = getRelationships(result, 'CALLS').find(
+      (c) => c.source === 'call_it' && c.target === 'unique_helper_xyz',
+    );
+    expect(edge).toBeDefined();
+    expect(edge!.rel.reason).toBe(GLOBAL_NAME_FALLBACK_REASON);
+    expect(edge!.rel.confidence).toBe(0.5);
+  });
+
+  it('counts the guess so a reader can see how much of the graph is guessed', () => {
+    const guesses = getResolutionOutcomes(result).filter(
+      (o) => o.kind === 'fallback-guessed' && o.name === 'unique_helper_xyz',
+    );
+    expect(guesses.length).toBeGreaterThan(0);
+    expect(guesses.every((o) => o.kind === 'fallback-guessed' && o.language === 'ruby')).toBe(true);
+  });
+
+  it('REGRESSION: no guessed edge is spelled like an import-resolved one', () => {
+    // The specific lie this work removed. Asserted over the whole graph, not
+    // just the one edge, so a future emitter cannot reintroduce it elsewhere.
+    const mislabeled = getRelationships(result, 'CALLS').filter(
+      (c) => c.rel.confidence === 0.5 && c.rel.reason === 'import-resolved',
+    );
+    expect(mislabeled).toEqual([]);
+  });
+});

gitnexus/test/unit/scope-resolution/name-fallback-summary.test.ts

@@ -0,0 +1,222 @@
+/**
+ * The per-language guessed/refused census persisted as
+ * `RepoMeta.nameFallbackEdges` and printed in the analyze summary.
+ *
+ * The pair of counts is the point. A guess count alone cannot distinguish a
+ * language with few impossible candidates from one whose visibility hook is
+ * missing, and a refusal count alone cannot distinguish a working guard from
+ * one that rejects everything — so both are asserted to survive per language
+ * rather than being folded into a repo-wide total.
+ */
+
+import { describe, it, expect } from 'vitest';
+import type { ResolutionOutcome } from '../../../src/core/ingestion/scope-resolution/resolution-outcome.js';
+import {
+  countCallsByLanguage,
+  formatNameFallbackSummary,
+  MAX_AMBIGUOUS_NAMES,
+  summarizeNameFallback,
+} from '../../../src/core/ingestion/scope-resolution/name-fallback-summary.js';
+
+const range = { startLine: 1, startCol: 0, endLine: 1, endCol: 5 };
+
+const guessed = (language: string | undefined, name = 'helper'): ResolutionOutcome => ({
+  kind: 'fallback-guessed',
+  targetId: `def:${name}`,
+  language,
+  phase: 'free-call-fallback',
+  filePath: 'a',
+  name,
+  range,
+});
+
+const refused = (language: string | undefined, name = 'helper'): ResolutionOutcome => ({
+  kind: 'fallback-refused',
+  candidateId: `def:${name}`,
+  language,
+  phase: 'free-call-fallback',
+  filePath: 'a',
+  name,
+  range,
+});
+
+describe('summarizeNameFallback', () => {
+  it('returns undefined when a run neither guessed nor refused', () => {
+    // A repository with no opt-in language must store no key at all, rather
+    // than a row of zeroes that reads as a measured result.
+    expect(summarizeNameFallback([])).toBeUndefined();
+  });
+
+  it('ignores unrelated outcomes', () => {
+    const unrelated: ResolutionOutcome = {
+      kind: 'resolved',
+      targetId: 'def:x',
+      phase: 'free-call-fallback',
+      filePath: 'a',
+      name: 'x',
+      range,
+    };
+    expect(summarizeNameFallback([unrelated])).toBeUndefined();
+  });
+
+  it('keeps guesses and refusals separated per language', () => {
+    const summary = summarizeNameFallback([
+      guessed('go'),
+      guessed('go', 'other'),
+      refused('go'),
+      refused('rust'),
+      refused('rust'),
+      refused('rust'),
+    ]);
+    expect(summary).toEqual({
+      byLanguage: {
+        go: { guessed: 2, guessedPairs: 2, refused: 1 },
+        rust: { guessed: 0, guessedPairs: 0, refused: 3 },
+      },
+      totalGuessed: 2,
+      distinctGuessedPairs: 2,
+      totalRefused: 4,
+      totalAmbiguousReexports: 0,
+    });
+  });
+
+  it('keeps call SITES in `guessed` and distinct (caller file, callee name) pairs in `guessedPairs`', () => {
+    // Three guessed `helper()` sites plus one `other()` in one file: 4 sites,
+    // 2 distinct pairs. `callsByLanguage` counts distinct callee names, so the
+    // guessy RATIO is pairs/calls and stays bounded by 1 (M5); the site count
+    // keeps its historical unit so persisted summaries stay comparable (M13).
+    const summary = summarizeNameFallback(
+      [guessed('go'), guessed('go'), guessed('go'), guessed('go', 'other')],
+      { go: 2 },
+    );
+    expect(summary?.byLanguage.go).toEqual({ guessed: 4, guessedPairs: 2, refused: 0 });
+    expect(summary?.totalGuessed).toBe(4);
+    expect(summary?.distinctGuessedPairs).toBe(2);
+    expect(
+      summary!.byLanguage.go!.guessedPairs! / summary!.callsByLanguage!.go!,
+    ).toBeLessThanOrEqual(1);
+  });
+
+  it('counts refused `export *` collisions in the same census, outside the language table', () => {
+    const summary = summarizeNameFallback([
+      {
+        kind: 'reexport-ambiguous',
+        candidateIds: ['def:a', 'def:b'],
+        phase: 'finalize',
+        filePath: 'packages/ui/src/index.ts',
+        name: 'collide',
+      },
+    ]);
+    expect(summary).toEqual({
+      byLanguage: {},
+      totalGuessed: 0,
+      distinctGuessedPairs: 0,
+      totalRefused: 0,
+      totalAmbiguousReexports: 1,
+      ambiguousReexportNames: ['packages/ui/src/index.ts:collide'],
+    });
+    expect(formatNameFallbackSummary(summary)).toContain('1 barrel name(s) refused as ambiguous');
+  });
+
+  it('buckets an unattributed pass rather than dropping it', () => {
+    const summary = summarizeNameFallback([guessed(undefined)]);
+    expect(summary?.byLanguage).toEqual({ unknown: { guessed: 1, guessedPairs: 1, refused: 0 } });
+    expect(summary?.totalGuessed).toBe(1);
+  });
+
+  it('caps the persisted ambiguous-name list at MAX_AMBIGUOUS_NAMES while keeping the total exact', () => {
+    const ambiguous = (name: string): ResolutionOutcome => ({
+      kind: 'reexport-ambiguous',
+      candidateIds: ['def:a', 'def:b'],
+      phase: 'finalize',
+      filePath: 'x.ts',
+      name,
+    });
+    // 250 distinct fixed-width names, well over the 200 cap, generated in
+    // DESCENDING order so a bug that capped BEFORE sorting (first 200 seen,
+    // not first 200 alphabetically) would be caught.
+    const names = Array.from({ length: 250 }, (_, i) => `n${String(249 - i).padStart(3, '0')}`);
+    const summary = summarizeNameFallback(names.map(ambiguous));
+    expect(summary?.totalAmbiguousReexports).toBe(250);
+    expect(summary?.ambiguousReexportNames).toHaveLength(MAX_AMBIGUOUS_NAMES);
+    const expectedSorted = [...new Set(names.map((n) => `x.ts:${n}`))].sort().slice(0, 200);
+    expect(summary?.ambiguousReexportNames).toEqual(expectedSorted);
+  });
+
+  it('does not cap when the list is at or under the bound', () => {
+    const ambiguous = (name: string): ResolutionOutcome => ({
+      kind: 'reexport-ambiguous',
+      candidateIds: ['def:a', 'def:b'],
+      phase: 'finalize',
+      filePath: 'x.ts',
+      name,
+    });
+    const names = Array.from({ length: MAX_AMBIGUOUS_NAMES }, (_, i) => `n${i}`);
+    const summary = summarizeNameFallback(names.map(ambiguous));
+    expect(summary?.ambiguousReexportNames).toHaveLength(MAX_AMBIGUOUS_NAMES);
+  });
+});
+
+describe('countCallsByLanguage', () => {
+  const nodesOf = (byId: Record<string, string>) => ({
+    getNode: (id: string) =>
+      byId[id] === undefined ? undefined : { properties: { filePath: byId[id] } },
+  });
+
+  it('buckets CALLS totals by the CALLER file language, summed across callers', () => {
+    const index = new Map<string, ReadonlySet<string>>([
+      ['caller-go-1', new Set(['A', 'B'])],
+      ['caller-go-2', new Set(['C'])],
+      ['caller-ts-1', new Set(['D', 'E', 'F'])],
+    ]);
+    const nodes = nodesOf({
+      'caller-go-1': 'pkg/a.go',
+      'caller-go-2': 'pkg/b.go',
+      'caller-ts-1': 'src/x.ts',
+    });
+    expect(countCallsByLanguage(index, nodes)).toEqual({ go: 3, typescript: 3 });
+  });
+
+  it('falls back to "unknown" for a caller whose language cannot be detected', () => {
+    const index = new Map<string, ReadonlySet<string>>([['caller-1', new Set(['A'])]]);
+    const nodes = nodesOf({ 'caller-1': 'README' });
+    expect(countCallsByLanguage(index, nodes)).toEqual({ unknown: 1 });
+  });
+
+  it('skips a caller id absent from the node table rather than throwing', () => {
+    const index = new Map<string, ReadonlySet<string>>([
+      ['missing', new Set(['A'])],
+      ['present', new Set(['B', 'C'])],
+    ]);
+    const nodes = nodesOf({ present: 'a.py' });
+    expect(countCallsByLanguage(index, nodes)).toEqual({ python: 2 });
+  });
+
+  it('returns undefined when either input is missing (no denominator available)', () => {
+    const nodes = nodesOf({ a: 'a.go' });
+    expect(countCallsByLanguage(undefined, nodes)).toBeUndefined();
+    expect(countCallsByLanguage(new Map(), undefined)).toBeUndefined();
+  });
+
+  it('returns undefined rather than an empty object when the index has entries but nothing attributes', () => {
+    const index = new Map<string, ReadonlySet<string>>([['caller-1', new Set(['A'])]]);
+    const nodes = nodesOf({}); // caller-1 not in the node table
+    expect(countCallsByLanguage(index, nodes)).toBeUndefined();
+  });
+});
+
+describe('formatNameFallbackSummary', () => {
+  it('prints nothing when there is nothing to report', () => {
+    expect(formatNameFallbackSummary(undefined)).toBeUndefined();
+  });
+
+  it('reports both totals and the per-language split, busiest first', () => {
+    const line = formatNameFallbackSummary(
+      summarizeNameFallback([guessed('ruby'), refused('go'), refused('go'), refused('go')]),
+    );
+    expect(line).toContain('1 call sites (1 distinct caller-file/name pairs)');
+    expect(line).toContain('3 refused as impossible');
+    // `go` has more total activity, so it leads.
+    expect(line).toMatch(/go 0\/3.*ruby 1\/0/);
+  });
+});

gitnexus/test/unit/scope-resolution/name-fallback-visibility.test.ts

@@ -0,0 +1,539 @@
+/**
+ * Unit tests for the per-language `isGlobalNameFallbackPlausible` hooks and the
+ * shared path arithmetic they are built on.
+ *
+ * These hooks decide whether a UNIQUE-NAME GUESS is allowed to become a labeled
+ * CALLS edge or must be dropped as impossible. The asymmetry matters for how
+ * these tests are written: a wrong `false` deletes a real edge, so every case
+ * that the language cannot decide is asserted to return `true`. "Refuses when
+ * impossible" and "does not refuse when merely unproven" are therefore BOTH
+ * requirements, and both are tested per language.
+ *
+ * Pure functions over synthetic stubs — no pipeline, no fixtures.
+ */
+
+import { describe, it, expect } from 'vitest';
+import type { ParsedFile, ParsedImport, SymbolDefinition } from 'gitnexus-shared';
+import { goIsGlobalNameFallbackPlausible } from '../../../src/core/ingestion/languages/go/name-fallback-visibility.js';
+import { dartIsGlobalNameFallbackPlausible } from '../../../src/core/ingestion/languages/dart/name-fallback-visibility.js';
+import { rustIsGlobalNameFallbackPlausible } from '../../../src/core/ingestion/languages/rust/name-fallback-visibility.js';
+import { swiftIsGlobalNameFallbackPlausible } from '../../../src/core/ingestion/languages/swift/name-fallback-visibility.js';
+import { rubyIsGlobalNameFallbackPlausible } from '../../../src/core/ingestion/languages/ruby/name-fallback-visibility.js';
+import {
+  directoryOf,
+  modulePathReaches,
+  moduleSegments,
+  stripExtension,
+} from '../../../src/core/ingestion/scope-resolution/utils/name-fallback-visibility.js';
+
+const namedImport = (targetRaw: string, localName = 'x'): ParsedImport => ({
+  kind: 'named',
+  localName,
+  importedName: localName,
+  targetRaw,
+});
+
+const mkCaller = (
+  filePath: string,
+  imports: readonly ParsedImport[] = [],
+  referenceSites: ParsedFile['referenceSites'] = [],
+  localDefs: readonly SymbolDefinition[] = [],
+): ParsedFile =>
+  ({
+    filePath,
+    parsedImports: imports,
+    referenceSites,
+    localDefs,
+  }) as unknown as ParsedFile;
+
+/** A bare (unqualified) call site — the shape the name-guess tier exists for. */
+const BARE_SITE = { name: 'unique_helper_xyz' } as const;
+
+const mkCandidate = (filePath: string, qualifiedName: string, ownerId?: string): SymbolDefinition =>
+  ({
+    nodeId: `def:${filePath}:${qualifiedName}`,
+    filePath,
+    type: 'Function',
+    qualifiedName,
+    ownerId,
+  }) as unknown as SymbolDefinition;
+
+describe('shared path arithmetic', () => {
+  it('splits module paths on /, :: and .', () => {
+    expect(moduleSegments('a/b/c')).toEqual(['a', 'b', 'c']);
+    expect(moduleSegments('crate::a::b')).toEqual(['crate', 'a', 'b']);
+    expect(moduleSegments('com.example.Thing')).toEqual(['com', 'example', 'Thing']);
+  });
+
+  it('does not split a path-bearing specifier on its extension dot', () => {
+    expect(moduleSegments('./util/parse.js')).toEqual(['util', 'parse.js']);
+  });
+
+  it('matches a written module prefix against a repo-relative directory', () => {
+    // The written import carries a module prefix that is not a directory.
+    expect(modulePathReaches('github.com/org/svc/internal/models', 'internal/models')).toBe(true);
+    // ...and the reverse, when the module manifest sits in a subdirectory.
+    expect(modulePathReaches('mod/internal/models', 'svc/internal/models')).toBe(true);
+  });
+
+  it('does not match unrelated paths that merely share a middle segment', () => {
+    expect(modulePathReaches('github.com/org/svc/internal/models', 'internal/handlers')).toBe(
+      false,
+    );
+    expect(modulePathReaches('a/b', 'c/d')).toBe(false);
+  });
+
+  it('reports no match for an empty path on either side', () => {
+    expect(modulePathReaches('', 'a/b')).toBe(false);
+    expect(modulePathReaches('a/b', '')).toBe(false);
+  });
+
+  it('derives directories and strips extensions', () => {
+    expect(directoryOf('a/b/c.go')).toBe('a/b');
+    expect(directoryOf('main.go')).toBe('');
+    expect(stripExtension('a/b.rs')).toBe('a/b');
+    expect(stripExtension('a/b')).toBe('a/b');
+  });
+});
+
+describe('Go: isGlobalNameFallbackPlausible', () => {
+  it('REFUSES an unexported identifier from another package', () => {
+    // The headline case: `a.uniqueHelperXyz` is invisible to package `b`, and no
+    // import can make it visible, so the guess is impossible rather than weak.
+    expect(
+      goIsGlobalNameFallbackPlausible({
+        callerParsed: mkCaller('b/caller.go'),
+        candidate: mkCandidate('a/helper.go', 'uniqueHelperXyz'),
+      }),
+    ).toBe(false);
+  });
+
+  it('REFUSES an unexported identifier even when the package IS imported', () => {
+    expect(
+      goIsGlobalNameFallbackPlausible({
+        callerParsed: mkCaller('b/caller.go', [namedImport('example.com/mod/a')]),
+        candidate: mkCandidate('a/helper.go', 'uniqueHelperXyz'),
+      }),
+    ).toBe(false);
+  });
+
+  it('allows an unexported identifier inside the SAME package directory', () => {
+    expect(
+      goIsGlobalNameFallbackPlausible({
+        callerParsed: mkCaller('a/caller.go'),
+        candidate: mkCandidate('a/helper.go', 'uniqueHelperXyz'),
+      }),
+    ).toBe(true);
+  });
+
+  it('REFUSES an exported identifier when the caller never imports its package', () => {
+    expect(
+      goIsGlobalNameFallbackPlausible({
+        callerParsed: mkCaller('b/caller.go', [namedImport('example.com/mod/unrelated')]),
+        candidate: mkCandidate('a/helper.go', 'UniqueHelperXyz'),
+      }),
+    ).toBe(false);
+  });
+
+  it('allows an exported identifier whose package the caller imports', () => {
+    expect(
+      goIsGlobalNameFallbackPlausible({
+        callerParsed: mkCaller('b/caller.go', [namedImport('example.com/mod/a')]),
+        candidate: mkCandidate('a/helper.go', 'UniqueHelperXyz'),
+      }),
+    ).toBe(true);
+  });
+
+  it('reads export case from the last segment of a method qualified name', () => {
+    expect(
+      goIsGlobalNameFallbackPlausible({
+        callerParsed: mkCaller('b/caller.go'),
+        candidate: mkCandidate('a/helper.go', 'Host.doThing'),
+      }),
+    ).toBe(false);
+    expect(
+      goIsGlobalNameFallbackPlausible({
+        callerParsed: mkCaller('b/caller.go', [namedImport('mod/a')]),
+        candidate: mkCandidate('a/helper.go', 'Host.DoThing'),
+      }),
+    ).toBe(true);
+  });
+
+  it('does not refuse when there is no identifier to judge', () => {
+    expect(
+      goIsGlobalNameFallbackPlausible({
+        callerParsed: mkCaller('b/caller.go'),
+        candidate: mkCandidate('a/helper.go', ''),
+      }),
+    ).toBe(true);
+  });
+
+  it('does not refuse an exported identifier in the module ROOT package', () => {
+    // The root package is imported by the module path alone, which the
+    // repo-relative layout cannot align against — undecidable, so allowed.
+    expect(
+      goIsGlobalNameFallbackPlausible({
+        callerParsed: mkCaller('internal/svc/caller.go', [namedImport('github.com/org/mod')]),
+        candidate: mkCandidate('root.go', 'ExportedHelper'),
+      }),
+    ).toBe(true);
+    expect(
+      goIsGlobalNameFallbackPlausible({
+        callerParsed: mkCaller('internal/svc/caller.go'),
+        candidate: mkCandidate('root.go', 'ExportedHelper'),
+      }),
+    ).toBe(true);
+  });
+});
+
+describe('Dart: isGlobalNameFallbackPlausible', () => {
+  it('REFUSES a library-private name from another directory', () => {
+    // No `part` layout can span directories in practice, so a `_` name across
+    // one is impossible, not merely unproven.
+    expect(
+      dartIsGlobalNameFallbackPlausible({
+        callerParsed: mkCaller('lib/widgets/b.dart'),
+        candidate: mkCandidate('lib/models/a.dart', '_privateHelper'),
+      }),
+    ).toBe(false);
+  });
+
+  it('allows a library-private name in a SIBLING file (possible `part`)', () => {
+    // `part` directives are not extracted yet, and parts are siblings of their
+    // library file — refusing here would delete the Flutter `foo.g.dart` edge.
+    expect(
+      dartIsGlobalNameFallbackPlausible({
+        callerParsed: mkCaller('lib/b.dart'),
+        candidate: mkCandidate('lib/a.dart', '_privateHelper'),
+      }),
+    ).toBe(true);
+  });
+
+  it('allows the generated-part idiom: `_$FooFromJson` in `foo.g.dart` beside `foo.dart`', () => {
+    expect(
+      dartIsGlobalNameFallbackPlausible({
+        callerParsed: mkCaller('lib/models/foo.dart'),
+        candidate: mkCandidate('lib/models/foo.g.dart', '_$FooFromJson'),
+      }),
+    ).toBe(true);
+  });
+
+  it('allows a library-private name in the same file', () => {
+    expect(
+      dartIsGlobalNameFallbackPlausible({
+        callerParsed: mkCaller('lib/a.dart'),
+        candidate: mkCandidate('lib/a.dart', '_privateHelper'),
+      }),
+    ).toBe(true);
+  });
+
+  it('allows a library-private name across directories when the caller names the file', () => {
+    // The `part` / `part of` direction, once the extractor surfaces it as an
+    // import target: an explicit directive against the candidate's file wins.
+    expect(
+      dartIsGlobalNameFallbackPlausible({
+        callerParsed: mkCaller('lib/widgets/b.dart', [namedImport('lib/models/a.dart')]),
+        candidate: mkCandidate('lib/models/a.dart', '_privateHelper'),
+      }),
+    ).toBe(true);
+  });
+
+  it('allows a public name across files', () => {
+    expect(
+      dartIsGlobalNameFallbackPlausible({
+        callerParsed: mkCaller('lib/b.dart'),
+        candidate: mkCandidate('lib/a.dart', 'publicHelper'),
+      }),
+    ).toBe(true);
+  });
+
+  it('judges privacy on the member, not its owner', () => {
+    // `_Foo.bar` is a public member of a private class — the member name is what
+    // a bare call would name, so it is not refused on the owner's underscore.
+    expect(
+      dartIsGlobalNameFallbackPlausible({
+        callerParsed: mkCaller('lib/b.dart'),
+        candidate: mkCandidate('lib/a.dart', '_Foo.bar'),
+      }),
+    ).toBe(true);
+  });
+});
+
+describe('Rust: isGlobalNameFallbackPlausible', () => {
+  it('REFUSES a cross-module item with no covering `use`', () => {
+    expect(
+      rustIsGlobalNameFallbackPlausible({
+        site: BARE_SITE,
+        callerParsed: mkCaller('src/b.rs', [namedImport('crate::unrelated')]),
+        candidate: mkCandidate('src/a.rs', 'unique_helper_xyz'),
+      }),
+    ).toBe(false);
+  });
+
+  it('allows a same-file item', () => {
+    expect(
+      rustIsGlobalNameFallbackPlausible({
+        site: BARE_SITE,
+        callerParsed: mkCaller('src/a.rs'),
+        candidate: mkCandidate('src/a.rs', 'unique_helper_xyz'),
+      }),
+    ).toBe(true);
+  });
+
+  it('allows an item whose module the caller brought into scope', () => {
+    expect(
+      rustIsGlobalNameFallbackPlausible({
+        site: BARE_SITE,
+        callerParsed: mkCaller('src/b.rs', [namedImport('crate::a')]),
+        candidate: mkCandidate('src/a.rs', 'unique_helper_xyz'),
+      }),
+    ).toBe(true);
+  });
+
+  it('treats `mod.rs` as its parent directory module', () => {
+    expect(
+      rustIsGlobalNameFallbackPlausible({
+        site: BARE_SITE,
+        callerParsed: mkCaller('src/b.rs', [namedImport('crate::net::http')]),
+        candidate: mkCandidate('src/net/http/mod.rs', 'unique_helper_xyz'),
+      }),
+    ).toBe(true);
+  });
+
+  it('does not refuse when the candidate file maps to no module path', () => {
+    expect(
+      rustIsGlobalNameFallbackPlausible({
+        site: BARE_SITE,
+        callerParsed: mkCaller('src/b.rs'),
+        candidate: mkCandidate('lib.rs', 'unique_helper_xyz'),
+      }),
+    ).toBe(true);
+  });
+
+  it('allows an item whose `use` names the ITEM rather than only its module', () => {
+    // `use crate::user::User` may arrive with the item name still on the path.
+    // Matching only the full path missed the module and refused `User::new`.
+    expect(
+      rustIsGlobalNameFallbackPlausible({
+        site: BARE_SITE,
+        callerParsed: mkCaller('src/main.rs', [namedImport('crate::user::User', 'User')]),
+        candidate: mkCandidate('src/user.rs', 'User.new'),
+      }),
+    ).toBe(true);
+  });
+
+  it('does not judge a PATH-QUALIFIED call site', () => {
+    // `User::new(...)` names its path in source. Refusing it for lacking a
+    // `use` of the module would delete an edge the code spells out — the
+    // regression this carve-out exists for (rust-scope.test.ts).
+    expect(
+      rustIsGlobalNameFallbackPlausible({
+        site: { name: 'new', rawQualifiedName: 'User::new' },
+        callerParsed: mkCaller('src/main.rs'),
+        candidate: mkCandidate('src/user.rs', 'User.new'),
+      }),
+    ).toBe(true);
+  });
+});
+
+describe('Swift: isGlobalNameFallbackPlausible', () => {
+  it('allows a cross-file candidate in the same target (whole-module internal)', () => {
+    expect(
+      swiftIsGlobalNameFallbackPlausible({
+        callerParsed: mkCaller('Sources/Core/Caller.swift'),
+        candidate: mkCandidate('Sources/Core/Helper.swift', 'uniqueHelperXyz'),
+      }),
+    ).toBe(true);
+  });
+
+  it('REFUSES a candidate in another target the caller never imports', () => {
+    expect(
+      swiftIsGlobalNameFallbackPlausible({
+        callerParsed: mkCaller('Sources/App/Caller.swift'),
+        candidate: mkCandidate('Sources/Core/Helper.swift', 'uniqueHelperXyz'),
+      }),
+    ).toBe(false);
+  });
+
+  it('allows a candidate in another target the caller imports', () => {
+    expect(
+      swiftIsGlobalNameFallbackPlausible({
+        callerParsed: mkCaller('Sources/App/Caller.swift', [namedImport('Core')]),
+        candidate: mkCandidate('Sources/Core/Helper.swift', 'uniqueHelperXyz'),
+      }),
+    ).toBe(true);
+  });
+
+  it('does not refuse when the layout heuristic cannot place a file', () => {
+    expect(
+      swiftIsGlobalNameFallbackPlausible({
+        callerParsed: mkCaller('Caller.swift'),
+        candidate: mkCandidate('Sources/Core/Helper.swift', 'uniqueHelperXyz'),
+      }),
+    ).toBe(true);
+  });
+});
+
+describe('Ruby: isGlobalNameFallbackPlausible', () => {
+  /** A candidate file whose `localDefs` carry the owner with the given label. */
+  const ownerFile =
+    (ownerId: string, label: 'Class' | 'Trait') =>
+    (filePath: string): ParsedFile | undefined =>
+      ({
+        filePath,
+        parsedImports: [],
+        referenceSites: [],
+        localDefs: [{ nodeId: ownerId, filePath, type: label, qualifiedName: 'Billing' }],
+      }) as unknown as ParsedFile;
+
+  it('allows a TOP-LEVEL method across files (the autoload shape)', () => {
+    // Ruby keeps this guess on purpose: with zeitwerk a file really can call a
+    // method whose defining file it never requires.
+    expect(
+      rubyIsGlobalNameFallbackPlausible({
+        callerParsed: mkCaller('app/b.rb'),
+        candidate: mkCandidate('app/a.rb', 'unique_helper_xyz'),
+      }),
+    ).toBe(true);
+  });
+
+  it('REFUSES a CLASS-owned method whose class the caller never names', () => {
+    expect(
+      rubyIsGlobalNameFallbackPlausible({
+        callerParsed: mkCaller('app/b.rb', [namedImport('app/unrelated')]),
+        candidate: mkCandidate('app/a.rb', 'Billing.unique_helper_xyz', 'def:Billing'),
+        parsedFileOf: ownerFile('def:Billing', 'Class'),
+      }),
+    ).toBe(false);
+  });
+
+  it('allows a MODULE-owned method with no mention — Rails mixes modules in for you', () => {
+    // `module ApplicationHelper` is included into every view by the framework;
+    // a bare `format_money()` there is legal with no include/require/constant.
+    expect(
+      rubyIsGlobalNameFallbackPlausible({
+        callerParsed: mkCaller('app/views/show.html.erb'),
+        candidate: mkCandidate('app/helpers/a.rb', 'Billing.unique_helper_xyz', 'def:Billing'),
+        parsedFileOf: ownerFile('def:Billing', 'Trait'),
+      }),
+    ).toBe(true);
+  });
+
+  it('allows a class-owned method when the caller INHERITS from anything (transitive chains)', () => {
+    // `class UsersController < AdminController` reaches ApplicationController's
+    // methods while naming only AdminController — undecidable from one file.
+    const inherits = {
+      kind: 'inherits',
+      name: 'AdminController',
+    } as unknown as ParsedFile['referenceSites'][number];
+    expect(
+      rubyIsGlobalNameFallbackPlausible({
+        callerParsed: mkCaller('app/controllers/users_controller.rb', [], [inherits]),
+        candidate: mkCandidate(
+          'app/controllers/application_controller.rb',
+          'ApplicationController#unique_helper_xyz',
+          'def:ApplicationController',
+        ),
+        parsedFileOf: ownerFile('def:ApplicationController', 'Class'),
+      }),
+    ).toBe(true);
+  });
+
+  it('allows a class-owned method when the caller mixes anything in (include/extend marker)', () => {
+    const mixin = {
+      kind: 'namespace',
+      localName: 'Auditable',
+      importedName: 'Auditable',
+      targetRaw: '__heritage__:include:Auditable:Report',
+    } as unknown as ParsedImport;
+    expect(
+      rubyIsGlobalNameFallbackPlausible({
+        callerParsed: mkCaller('app/models/report.rb', [mixin]),
+        candidate: mkCandidate('app/a.rb', 'Billing.unique_helper_xyz', 'def:Billing'),
+        parsedFileOf: ownerFile('def:Billing', 'Class'),
+      }),
+    ).toBe(true);
+  });
+
+  it('allows a class-owned method when the caller file DEFINES a module (a mixin body)', () => {
+    // `module PostGuardian; def can_see?(post); is_staff? ...` — the module's
+    // methods run inside `class Guardian`, which includes it; the module file
+    // never names Guardian.
+    const moduleDef = {
+      nodeId: 'def:PostGuardian',
+      filePath: 'lib/guardian/post_guardian.rb',
+      type: 'Trait',
+      qualifiedName: 'PostGuardian',
+    } as unknown as SymbolDefinition;
+    expect(
+      rubyIsGlobalNameFallbackPlausible({
+        callerParsed: mkCaller('lib/guardian/post_guardian.rb', [], [], [moduleDef]),
+        candidate: mkCandidate('lib/guardian.rb', 'Guardian#is_staff?', 'def:Guardian'),
+        parsedFileOf: ownerFile('def:Guardian', 'Class'),
+      }),
+    ).toBe(true);
+  });
+
+  it('does not refuse when the owner cannot be typed (no file lookup)', () => {
+    expect(
+      rubyIsGlobalNameFallbackPlausible({
+        callerParsed: mkCaller('app/b.rb'),
+        candidate: mkCandidate('app/a.rb', 'Billing.unique_helper_xyz', 'def:Billing'),
+      }),
+    ).toBe(true);
+    expect(
+      rubyIsGlobalNameFallbackPlausible({
+        callerParsed: mkCaller('app/b.rb'),
+        candidate: mkCandidate('app/a.rb', 'Billing.unique_helper_xyz', 'def:Billing'),
+        parsedFileOf: () => undefined,
+      }),
+    ).toBe(true);
+  });
+
+  it('allows a class-owned method when the caller requires its namespace (snake_case path)', () => {
+    // `require 'billing/invoice_service'` names `Billing::InvoiceService` — the
+    // path is snake_case and the constant CamelCase, so the match normalizes.
+    expect(
+      rubyIsGlobalNameFallbackPlausible({
+        callerParsed: mkCaller('app/b.rb', [namedImport('billing/invoice_service')]),
+        candidate: mkCandidate(
+          'app/a.rb',
+          'Billing::InvoiceService#unique_helper_xyz',
+          'def:InvoiceService',
+        ),
+        parsedFileOf: ownerFile('def:InvoiceService', 'Class'),
+      }),
+    ).toBe(true);
+  });
+
+  it('allows a class-owned method when the caller includes the constant by name', () => {
+    expect(
+      rubyIsGlobalNameFallbackPlausible({
+        callerParsed: mkCaller('app/b.rb', [namedImport('Billing', 'Billing')]),
+        candidate: mkCandidate('app/a.rb', 'Billing.unique_helper_xyz', 'def:Billing'),
+        parsedFileOf: ownerFile('def:Billing', 'Class'),
+      }),
+    ).toBe(true);
+  });
+
+  it('allows a class-owned method when the caller mentions the constant', () => {
+    const site = { name: 'Billing' } as unknown as ParsedFile['referenceSites'][number];
+    expect(
+      rubyIsGlobalNameFallbackPlausible({
+        callerParsed: mkCaller('app/b.rb', [], [site]),
+        candidate: mkCandidate('app/a.rb', 'Billing.unique_helper_xyz', 'def:Billing'),
+        parsedFileOf: ownerFile('def:Billing', 'Class'),
+      }),
+    ).toBe(true);
+  });
+
+  it('does not refuse an owned method with no nameable namespace', () => {
+    expect(
+      rubyIsGlobalNameFallbackPlausible({
+        callerParsed: mkCaller('app/b.rb'),
+        candidate: mkCandidate('app/a.rb', 'unique_helper_xyz', 'def:anon'),
+        parsedFileOf: ownerFile('def:anon', 'Class'),
+      }),
+    ).toBe(true);
+  });
+});

gitnexus/test/unit/scope-resolution/wildcard-topLevelOnly-gate.test.ts

@@ -0,0 +1,152 @@
+/**
+ * M17 — the `export *` wildcard fan-out in `populateFileClosure`
+ * (gitnexus-shared/src/scope-resolution/finalize-algorithm.ts) is gated by the
+ * SAME `namedImportsBindTopLevelOnly` hook as the named-import path:
+ *
+ *   for (const [name, def] of (topLevelOnly ? indexTopLevelExportsByName : indexExportsByName)(...))
+ *
+ * Before this fix, the wildcard fan-out ALWAYS used the narrow (top-level-only)
+ * index, regardless of the hook — silently adopting ECMAScript's `export *`
+ * semantics (a class member can never be published by a bare wildcard
+ * re-export) for every language, including ones (Python, Java, ...) whose
+ * wildcard/star import legitimately republishes class members by name.
+ *
+ * This is below the extraction layer (RFC #909 Ring 2 PKG #921) — synthetic
+ * `ParsedFile` input against `finalizeScopeModel` with a FAKE resolver
+ * (`namedImportsBindTopLevelOnly` toggled directly), same technique as
+ * `finalize-orchestrator.test.ts`. No real language parser involved; the
+ * fixture below is deliberately language-agnostic (Vue is the one migrated
+ * resolver that opts in for real — see `languages/vue/scope-resolver.ts`).
+ *
+ * Fixture shape, held constant across both hook settings:
+ *   B.ts:  class Foo with method `beta` — NO top-level `beta` declaration.
+ *   A.ts:  `export * from './B'` (wildcard re-export; populates A's closure).
+ *   C.ts:  `import { beta } from './A'` — resolves through A's closure, which
+ *          the direct check on A's own (empty) localDefs never satisfies.
+ */
+import { describe, it, expect } from 'vitest';
+import type { ParsedFile, ParsedImport, Scope, ScopeId, SymbolDefinition } from 'gitnexus-shared';
+import { finalizeScopeModel } from '../../../src/core/ingestion/finalize-orchestrator.js';
+import { vueScopeResolver } from '../../../src/core/ingestion/languages/vue/scope-resolver.js';
+import { typescriptScopeResolver } from '../../../src/core/ingestion/languages/typescript/scope-resolver.js';
+import { javascriptScopeResolver } from '../../../src/core/ingestion/languages/javascript/scope-resolver.js';
+
+const mkScope = (id: ScopeId, filePath: string): Scope => ({
+  id,
+  parent: null,
+  kind: 'Module',
+  range: { startLine: 1, startCol: 0, endLine: 100, endCol: 0 },
+  filePath,
+  bindings: new Map(),
+  ownedDefs: [],
+  imports: [],
+  typeBindings: new Map(),
+});
+
+const mkFile = (filePath: string, overrides: Partial<ParsedFile> = {}): ParsedFile => ({
+  filePath,
+  moduleScope: `scope:${filePath}#module`,
+  scopes: overrides.scopes ?? [mkScope(`scope:${filePath}#module`, filePath)],
+  parsedImports: overrides.parsedImports ?? [],
+  localDefs: overrides.localDefs ?? [],
+  referenceSites: overrides.referenceSites ?? [],
+});
+
+function buildFixture(topLevelOnly: boolean) {
+  // B.ts: a class with a method `beta`, and NO top-level `beta` of any kind.
+  const fooClass: SymbolDefinition = {
+    nodeId: 'def:Foo',
+    filePath: 'B.ts',
+    type: 'Class',
+    qualifiedName: 'B.Foo',
+  };
+  const fooBetaMethod: SymbolDefinition = {
+    nodeId: 'def:Foo.beta',
+    filePath: 'B.ts',
+    type: 'Method',
+    ownerId: 'def:Foo',
+    qualifiedName: 'B.Foo.beta',
+  };
+  const fileB = mkFile('B.ts', { localDefs: [fooClass, fooBetaMethod] });
+
+  // A.ts: `export * from './B'` — a wildcard re-export, no local defs of its own.
+  const wildcardImport: ParsedImport = { kind: 'wildcard', targetRaw: 'B.ts' };
+  const fileA = mkFile('A.ts', { parsedImports: [wildcardImport] });
+
+  // C.ts: `import { beta } from './A'`.
+  const namedImport: ParsedImport = {
+    kind: 'named',
+    localName: 'beta',
+    importedName: 'beta',
+    targetRaw: 'A.ts',
+  };
+  const fileC = mkFile('C.ts', { parsedImports: [namedImport] });
+
+  const out = finalizeScopeModel([fileB, fileA, fileC], {
+    hooks: {
+      resolveImportTarget: (targetRaw) => targetRaw,
+      namedImportsBindTopLevelOnly: topLevelOnly,
+    },
+  });
+
+  const cImports = out.imports.get(fileC.moduleScope) ?? [];
+  return { out, fileC, fooBetaMethod, betaImport: cImports[0] };
+}
+
+describe('M17 — export * wildcard fan-out gated by namedImportsBindTopLevelOnly', () => {
+  it('a language that does NOT opt in (Python/Java-shaped: hook false) publishes the class method through the wildcard — wide index preserved', () => {
+    const { betaImport, fooBetaMethod } = buildFixture(false);
+    expect(betaImport).toBeDefined();
+    expect(betaImport!.linkStatus).toBeUndefined();
+    expect(betaImport!.targetFile).toBe('A.ts');
+    expect(betaImport!.targetDefId).toBe(fooBetaMethod.nodeId);
+  });
+
+  it('a language that DOES opt in (ECMAScript-shaped: hook true) refuses — the wildcard fan-out narrows to module-level declarations only', () => {
+    const { betaImport } = buildFixture(true);
+    expect(betaImport).toBeDefined();
+    // Neither A's own (empty) localDefs nor A's wildcard-populated closure
+    // (narrowed to MEMBER_LABELS-excluded defs) ever publish `beta` — the
+    // import stays unresolved rather than binding a class member no
+    // top-level name legitimizes.
+    expect(betaImport!.linkStatus).toBe('unresolved');
+    expect(betaImport!.targetDefId).toBeUndefined();
+  });
+
+  it('mutation check: a top-level (non-member) def behind the same wildcard still binds under EITHER setting', () => {
+    // Control — proves the gate narrows MEMBER labels specifically, not
+    // wildcard re-exports wholesale.
+    for (const topLevelOnly of [false, true]) {
+      const alphaVar: SymbolDefinition = {
+        nodeId: 'def:alpha',
+        filePath: 'B.ts',
+        type: 'Variable',
+        qualifiedName: 'B.alpha',
+      };
+      const fileB = mkFile('B.ts', { localDefs: [alphaVar] });
+      const fileA = mkFile('A.ts', {
+        parsedImports: [{ kind: 'wildcard', targetRaw: 'B.ts' }],
+      });
+      const fileC = mkFile('C.ts', {
+        parsedImports: [
+          { kind: 'named', localName: 'alpha', importedName: 'alpha', targetRaw: 'A.ts' },
+        ],
+      });
+      const out = finalizeScopeModel([fileB, fileA, fileC], {
+        hooks: {
+          resolveImportTarget: (targetRaw) => targetRaw,
+          namedImportsBindTopLevelOnly: topLevelOnly,
+        },
+      });
+      const edge = out.imports.get(fileC.moduleScope)?.[0];
+      expect(edge?.linkStatus, `topLevelOnly=${topLevelOnly}`).toBeUndefined();
+      expect(edge?.targetDefId, `topLevelOnly=${topLevelOnly}`).toBe('def:alpha');
+    }
+  });
+
+  it('Vue opts in (TS semantics); JS/TS themselves already do — every migrated resolver that sets the hook does so as `true`', () => {
+    expect(vueScopeResolver.namedImportsBindTopLevelOnly).toBe(true);
+    expect(typescriptScopeResolver.namedImportsBindTopLevelOnly).toBe(true);
+    expect(javascriptScopeResolver.namedImportsBindTopLevelOnly).toBe(true);
+  });
+});