84 commits

Author	SHA1	Message	Date
Gergo Magyar	ca54ae35ef	test(bench): rebaseline python-scope for await/index chain emission (#2766) ... CI caught a bench this branch never ran. `bench/python-scope` is a SEPARATE gate from `bench/scope-capture`; when the receiver-chain work changed capture output I rebaselined the latter's 15 languages and did not know the former existed. My verification loop was two benches; CI runs eight. The drift is intended and has two causes, both from this branch: - `extractMixedChain` now walks THROUGH await and subscript nodes, which is language-agnostic, so Python mints chains where it previously minted none. Probed directly: `(await svc.get_async()).save()` now yields `2|svc|cget_async|a` and `repos[0].save()` yields `2|repos|i`, neither of which existed before. - The codec VERSION prefix moved 1 -> 2, so pre-existing Python chains changed text (`2|svc|cget`). Verified it is those and not something unintended by probing `emitPythonScopeCaptures` for the new name-free step sigils rather than assuming from the fingerprint alone. Checked every other bench CI runs while here — callable-value-flow, scope-emission, python-scope/import-target-fingerprint, cfg, emit-persistence — all PASS. python-scope/measure was the only one. Reproduced locally at the exact CI fingerprint (a0da3e7c…) before touching the baseline, so this is a deterministic capture change and not a CI-environment artifact. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-01 16:28:36 +00:00
Gergo Magyar	42cde0b359	feat(resolution): separate the program boundary from analysis uncertainty (#2766) ... `impact` reported `epistemic: lower-bound` for calls it could not resolve. Dumping all 102 call drops with source context shows the count was measuring two different things and reporting both as uncertainty: external 76 System.out.println, fetch(...), os.environ.setdefault, document.body.appendChild, .stream() — the callee is NOT IN THE GRAPH, so no node exists for an edge to point at and nothing was lost in-program 20 a real gap in principle unknown 6 casts, ternaries, globalThis.x ??= [] Three quarters of the hedge was the program boundary, not doubt about the program. A compiler resolves `System.out.println` against the JDK; lacking one, the honest statement is "this call leaves the analyzed program", NOT "this analysis is incomplete". Collapsing the two is what made the signal fire on essentially every real codebase, which is what teaches readers to ignore it. `ResolutionOutcome.receiverOrigin` records which applies, and `summarizeUnresolvedReceivers` skips `external`. `unknown` still counts — assuming a completeness we cannot demonstrate is the unsafe direction. ORIGIN IS DECIDED BY THE BASE'S DECLARED TYPE, NOT ITS NAME. A first cut asked whether the base was a local, which marked `inputs.stream()` in-program: `inputs` IS a local, but its type `List<String>` is JDK, so the target is external. Asking whether the base's TYPE is one this index contains moved 28 sites to the correct bucket. Measured end to end: `impact save` on a TypeScript repo went from `lower-bound` (2 dropped sites, both `fetch(...).then(...)`) to `impactedCount: 3, epistemic: exact`. WHAT THIS DOES NOT DO. The remaining 20 in-program drops are mostly not product defects either: `user.Address.Save()` resolves cleanly in isolation — the csharp-deep-field-chain fixture alone emits both expected edges with ZERO drops — and drops in the count arm only because the corpus is ~200 mini-projects in one directory and 55 files define `Address`, so the resolver correctly declines on ambiguity. The genuinely untypeable population is the 6 `unknown`, and those are the real targets for type resolution: a cast GIVES you the type, a ternary needs a join of its branch types. They were invisible under 76 stdlib calls until now. Full external-target resolution needs stdlib type stubs (JDK / BCL / lib.d.ts) so those callees exist as nodes at all. That is a program of work; this change makes the boundary measured rather than guessed. `callDropsByOrigin` joins the gated projection so the split cannot drift silently. Both benches pass; scope-capture unchanged (this is diagnostic + summary, not capture). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-01 16:28:35 +00:00
Gergo Magyar	a4002c3c43	fix(go): drop the phantom read site on a member call's callee (#2766) ... Found by a three-agent investigation into an A1 regression. The regression was the symptom; this is the disease, and it SHIPPED on this branch. Go's `@reference.read` pattern matches every `selector_expression` with no call-position exclusion, so `h.dep.Work()` minted THREE sites: call Work on the call_expression — the member call read Work on the outer `h.dep.Work` — PHANTOM, this is the callee read dep on the inner `h.dep` — the genuine field read The phantom resolves through `findOwnedMember`, which prefers methods over fields, and emits an ACCESSES edge to the METHOD duplicating the CALLS edge at the same position. MY U8 CLAIM WAS WRONG. I asserted that typing the base made the ACCESSES "correctly retarget to the property". It did not. The property edge was always a separate site, and the U8 test passed by ACCIDENT: the row it asserts on has a pointer receiver whose text-cascade lookup failed for an unrelated reason. The value-receiver twin was emitting the bad edge the whole time — verified on the pushed branch: ACCESSES RunFromValueReceiver -> DoWork:Method ACCESSES RunLocal -> DoWork:Method A selector in FUNCTION position is never a read. Dropped at the emitter. A method VALUE (`f := h.dep.Work`) is not in function position and is untouched. Deliberately NOT fixed by gating on `handledSites`: the three co-located Go sites share one site key, so that would suppress the correct `RunSamePackage -> dep` edge depending on match order. Nor by flipping `findOwnedMember` to prefer fields on reads — that is cross-language and would break legitimate method-value reads. The weak assertion is replaced by an exact-set check over the whole fixture, so a new phantom fails even on a row nobody wrote a targeted assertion for. My first attempt at that check compared `undefined === undefined` and would have passed against anything; caught and rewritten. Numbers: callDrops 102 -> 102 no call lost read drops 27 -> 22 five phantoms were being RECORDED AS DROPS chain-field 61 -> 60 one reclassified... chain-unwrap 0 -> 1 ...to the real call's shape, because the phantom and the call share a site key and the phantom's chain was the one being censused Baselines: go scope-capture fingerprint and the go capture golden rebaselined with reasons — fewer capture matches for Go, and go was the only fingerprint of 15 that moved, which is the check that this touches Go's emitter alone. 4369 tests green. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-01 16:28:34 +00:00
Gergo Magyar	10d872529e	fix(resolution): name-free steps were vetoed by the construction selector (#2766) ... A defect I introduced two commits earlier, not a pre-existing one. `foldReceiverChain` opens each step with: if (options.constructionSyntax?.selector === step.name) return undefined; Correct as written. It became wrong the moment name-free step kinds were added: `step.name` is `undefined` for `await` and `index`, and `constructionSyntax?.selector` is `undefined` for any language that declares none — so `undefined === undefined` matched EVERY name-free step and vetoed the whole fold before it ran. That is why subscript and await receivers minted a chain, fired the Case 0 gate, had a resolvable base binding, and still produced no edge. The fold logic downstream was fine; nothing downstream ever executed. Three reading passes missed it because the line looks obviously correct — you have to watch `step.name` be `undefined` at runtime. An instrumented run found it immediately, which is the lesson: when captures, plumbing, payload and gate all verify clean, stop reading and instrument. Guarded on `step.name !== undefined`. Load-bearing, not defensive. Shape matrix, RESOLVES 46 -> 55, VISIBLE-GAP 32 -> 23: awaitParen now resolves in typescript, python, csharp, kotlin, dart indexElement now resolves in typescript, cpp, go, python, rust, kotlin Every canonical TypeScript shape now resolves, which broke the #2744 drop-recorder test: it needs a receiver that FAILS to type, and its own comment records that `!` served until structural typing resolved it, then await-paren served until this fix. Both were shapes the resolver merely did not SUPPORT yet, so each improvement moved the goalposts. Re-fixtured to an UNANNOTATED parameter — no type information exists, so no resolver work can type it. Stable by construction rather than by not-yet-implemented. Verified: resolver integration + scope-resolution unit 4367 green, typescript resolver 270 green, scope-capture unchanged (this is resolution, not capture), callDrops unchanged at 102. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-01 16:28:32 +00:00
Gergo Magyar	aefb162280	docs(bench): no drop ratchet needed; correct a stale CI claim (#2766) ... Two findings, both negative, both worth recording so they are not re-litigated. NO RATCHET. The plan's R10 set a ZERO supported-shape drop target, and review correctly found it contradicts R12: a site whose normalized name matches more than one class MUST decline, a decline records a drop, and names like Service/Handler/Client collide routinely in large Go and Java codebases. The proposed repair was a ratchet — the count may not rise above the last measured value. Neither is needed. `measure.mjs --check` already asserts EXACT MATCH against the committed baseline, which is strictly stronger: the count cannot rise or fall without a deliberate `--update-baseline`, and that path prints an instruction to explain the movement. A ratchet would be a weakening, not a fix. The gate now also covers `callDropsByShape`, since the shape census joined the gated projection. STALE CI CLAIM. The gate's comment named `repos[0]` as a shape that "emits no edge AND no drop". That stopped being true in this series: Case 0's gate now accepts a minted receiver chain instead of testing the receiver's punctuation, so subscript receivers record a drop and are countable — 13 shapes moved INVISIBLE -> VISIBLE. `?.` and explicit type args are still invisible on some languages, so the shape arm still earns its keep, but the example was wrong and a wrong example in a gate comment is how the next person mis-reasons about what the gate covers. DEFERRED, explicitly: the `impact` risk-cutoff recalibration. Added edges push symbols toward the absolute cutoffs (`directCount >= 30`, `impacted.length >= 200`), so edits read HIGHER risk without being more dangerous. Real, but measuring it honestly needs a corpus large enough for those thresholds to bind, and the committed fixtures are nowhere near 200 impacted symbols. Recorded as owed rather than inventing a number from fixtures that cannot exercise it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-01 16:28:31 +00:00
Gergo Magyar	a4b75ffdb2	fix(resolution): decouple the wrapper peel bound; leave the chain cap at 3 (#2766) ... Two halves, and the headline one is a negative result. DECOUPLED (the real fix). `unwrapTransparentReceiver` used `MAX_CHAIN_DEPTH` as its iteration bound. The two answer unrelated questions — how many chain hops do we type, versus how many redundant parens might someone write — so raising the chain cap would silently widen the paren peel as a side effect, and the shared name reads as intentional enough to hide it. The coupling got worse when the await/subscript work added a peel call at loop entry. Now `MAX_TRANSPARENT_WRAPPER_DEPTH`, its own constant. The parse-worker comment that hardcoded "(3)" no longer restates the number. NOT RAISED, on measurement. The premise was that a chain deeper than the cap is discarded whole rather than truncated, so a 4-hop builder chain "contributes nothing at all". The first half is true. The second is not. `fourHopChain` was added to the TypeScript corpus as a declared extra to make the question answerable at all — without a chain longer than the cap, raising the cap measures nothing: cap 3: NO chain minted (confirmed by probing the emitter) -> RESOLVES cap 4: chain minted -> RESOLVES It resolves at both. At 3 the TEXT CASCADE answers, because it owns the fallback path and runs to its own `COMPOUND_RECEIVER_MAX_DEPTH` of 8. So the cap bounds which chains are typed STRUCTURALLY, not which calls resolve — raising it moves work from the cascade to the fold and changes no edge. Verified across the whole matrix: totals identical at 3 and 4, callDrops 102 at both. Left at 3. The fixture is committed so the next person to reach for this number inherits the measurement rather than the intuition. (An earlier version of that fixture was three steps, not four — `root.getSvc().getUser().address` counts hops in the source text, not steps in the receiver — so it fit inside the old cap and measured nothing. Corrected before drawing any conclusion.) Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-01 16:28:31 +00:00
Gergo Magyar	59c054338d	feat(mcp): split the epistemic hedge into its two producers (#2766) ... `impact` and `context` reported `epistemic: 'lower-bound'` for two independent reasons that the output could not tell apart: receiverTyping call sites dropped because the receiver could not be typed — a RESOLVER DEFECT, and the population this series targets dispatchBoundary the symbol sits behind an interface with real consumers or 2+ implementations, so callers binding through DI or dynamic dispatch are genuinely untraceable — NOT a defect; a compiler refuses here too One enum plus prose meant a consumer — especially a coding agent gating its own edits on the result — could tell THAT a count was short but not WHY, and could not branch on the difference. It also made "the hedge should stop appearing" unfalsifiable: with no way to see which producer fired, there was no way to check whether fixing receiver typing had achieved anything. Both surfaces now carry `causes: { receiverTyping, dispatchBoundary }` alongside the existing prose. `receiverTyping` counts dropped SITES, not boundary notes. The first cut counted notes and published `1` next to prose reading "2 call sites" — an agent branching on the number would have read a different magnitude than the human reading the text, which is precisely the failure a structured field exists to prevent. `unresolvedReceiverBoundaries` now returns `{ notes, sites }` so the count comes from the same place the prose does. Verified live. On the #2766 reproduction `WithTx` went from `impactedCount: 0` + `lower-bound` to `impactedCount: 1` + `exact` — the hedge is gone because its cause is gone, not because it was suppressed. On a TypeScript repo with dropped receivers, `causes` reports `{ receiverTyping: 2, dispatchBoundary: 0 }`, matching the prose exactly. NOT verified: the `dispatchBoundary` path end-to-end. Go's implicit interface satisfaction emits no IMPLEMENTS edges, so that producer structurally cannot fire on the Go fixture, and observing it needs a Java or TypeScript case. It is wired and typechecks; it is not claimed proven. Only the receiverTyping producer is addressed by this series. The dispatch boundary is untouched and will keep firing for interface-dispatched symbols, which is correct — and any claim that the hedge has stopped appearing must now be read per-producer. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-01 16:28:30 +00:00
Gergo Magyar	075ad0508d	feat(resolution): mint chains through await and subscript receivers (#2766) ... Two changes, one of which matters more than the shape work it was meant to enable. EMISSION. `extractMixedChain` stopped at await and subscript nodes — neither is a call or a field access — so `(await svc.getUserAsync()).save()` and `repos[0].save()` minted NO chain at all. Adds the node vocabularies for both, records them as the codec's name-free `await` / `index` steps, and peels transparent wrappers at LOOP ENTRY rather than only where a base is returned (an await receiver arrives wrapped in a `parenthesized_expression`, which matched no branch and fell straight through with an empty chain). Verified directly: the two shapes now mint `2|svc|cgetUserAsync|a` and `2|repos|i`. CASE 0's GATE. The bigger one. That case fired on `receiverName.includes('.') || includes('(')` — a C-family punctuation test. A subscript receiver contains neither, so the case never ran, the fold was never consulted, AND no drop was recorded: the call vanished with the instrument blind to it. The bench's own KNOWN BLIND SPOTS section names this. PHP `->` and `::` receivers are lost the same way. A minted chain answers the same question structurally — the capture layer walked the real AST and found the receiver is an expression, whatever punctuation it is spelled with. The gate now accepts that signal, which is the textual-shape-dispatch removal this whole line of work exists to make. Measured on the shape matrix: 13 cells move INVISIBLE-GAP -> VISIBLE-GAP, and kotlin `awaitParen` -> RESOLVES. RESOLVES 43 -> 45 VISIBLE-GAP 21 -> 32 INVISIBLE-GAP 31 -> 18 INCOMPLETE, deliberately stated: most subscript and await receivers still do not RESOLVE. The chain mints, the gate fires, and the base binding exists (`repos` -> `User[]`, confirmed) — the edge is still absent and I have not isolated why. Three attempts (identity step, collection-element hook, base carrying an unresolved container) did not produce it. The hook and the relaxed base are kept because both are correct in their own right and are needed by whatever the real fix turns out to be; they are not load-bearing for anything claimed here. `callDrops` 101 -> 102 on the fixture corpus. That is previously-invisible loss becoming countable, NOT a regression — and it means the drop ratchet must be baselined after this lands, or it would ratchet against a number that understated reality. Baselines: go and kotlin scope-capture fingerprints and the go capture golden rebaselined — more sites carry a chain; no existing chain changed shape. Only 2 of 15 languages drifted, the two whose fixtures contain such receivers. Unit 1402 green, resolver integration 2995 green. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-01 16:28:30 +00:00
Gergo Magyar	eb864e5ad9	feat(resolution): receiver-chain codec v2 with name-free step kinds (#2766) ... Await-wrapped and subscript receivers need step kinds the wire format cannot express. Both are NAME-FREE: an awaited call's method name already lives on its `c` step, and a subscript's key is a value rather than an identifier the resolver could look up. Adds `a` and `i` sigils encoding as a BARE sigil, and moves VERSION 1 -> 2. The encoder's non-empty-name guard is NOT relaxed. Name-free kinds skip it because they have no name to check; an empty-name `c` or `f` is still refused. The decoder rejects any trailing characters after `a` or `i`, which is what stops a corrupt payload smuggling a tail through the exemption — `2|svc|await` and `2|repos|i0` both refuse, and a bare `c` stays malformed rather than becoming an await. A v2 decoder refuses a v1 payload outright. That is the point rather than a limitation: a chain missing whichever hop v1 could not express decodes cleanly as a complete-but-different, shorter chain, and would type the receiver against the wrong member. Refusing is lossy but safe; the site falls back to the text cascade. SCHEMA_BUMP 34 -> 37, INCREMENTAL_SCHEMA_VERSION 28 -> 31. Both are required: every persisted chain string changed prefix, so a stale cache or index replays chains this build silently discards, degrading to the text cascade with no error anywhere. NUMBERED 37/31, NOT 35/29: `origin/main` had already reached 36/30 while this branch was in flight. That is the FIFTH time this collision has bitten the series, and it is invisible unless you diff against origin/main rather than the branch point. Re-check both immediately before merge, again. Baselines: 12 scope-capture fingerprints rebaselined with a documented reason. The VERSION prefix is part of every emitted `@reference.receiver-chain` capture, so a wire-format change moves the capture text for every chain-minting language while minting the same chains for the same sites. Exactly the 12 chain-minting languages drifted; c, cobol and dart did not — that boundary is the check that this is the prefix and not a capture regression. receiver-resolution states and call-drop counts are unchanged. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-01 16:28:23 +00:00
Gergo Magyar	0f98f16765	feat(resolution): census receiver drops by structural shape (#2766) ... `callDropsByExtension` was the finest split available, so a language's bucket said nothing about whether its drops were one defect or five. The suppressed `ResolutionOutcome` now carries `receiverShape`, set by the emitting case from the site's ENCODED CHAIN — the compact string the capture emitters mint by walking the real AST. Never re-derived from the source line. `resolution-outcome.ts` already rejects that for `siteKind`, and for the same reason: regex-classifying the number that gates this work is the textual-shape dispatch the structural-receiver line exists to remove. Diagnostic only, so the persisted `RepoMeta.unresolvedReceiverMembers` artifact is unchanged. Census of the 101 call drops on the committed corpus: chain-field 60 (59%) h.repo.save() chain-call 27 (27%) svc.getUser().save() no-chain 12 (12%) no nameable base survived the walk chain-mixed 2 (2%) svc.getUser().addr.save() Two questions the plan could not answer are now answered. The `.java` bucket is NOT one defect: its 49 drops split 30 field-chain / 14 call-chain / 5 no-chain — the same mix as everywhere else, just more of it. And field-receiver chains dominate at 59%, which is precisely the shape the pointer-receiver fix closed for Go (now down to 3). The same class remains in java (30), csharp (6), cpp (4), php (4), py (3), rust (3). Also records what the census CANNOT decide: await-wrapped and subscript receivers appear nowhere in it, because the committed fixtures contain no such sites — not because they are rare. `indexElement` is an INVISIBLE-GAP in all 14 languages in the shape arm, so that population is real but structurally invisible here. Funding those shapes has to be read off the shape arm; reading it off this census would confuse "absent from these fixtures" with "does not happen". Also closes the ACCESSES-vs-CALLS question as RESOLVED BY the pointer-receiver fix, diagnosed rather than assumed. Go `h.dep.Work()` previously emitted ACCESSES to the METHOD and no CALLS: the member-name path emitted the access while the CALLS leg needed the receiver's class, which failed to type. With the base typed, CALLS emits and the ACCESSES correctly retargets to the PROPERTY being read. Verified across the fixture that no Method target now carries ACCESSES without a matching CALLS. Locked by a same-package control asserting both directions. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-01 16:24:31 +00:00
Gergo Magyar	809d2eb63b	fix(resolution): type Go pointer-receiver bases at the class lookup (#2766) ... A Go method with a pointer receiver binds its receiver to the literal string `*Holder` — `synthesizeGoReceiverBinding` stores `typeNode.text` raw. `findClassBindingInScope` normalizes exactly one decoration, a dotted qualifier, so `*Holder` matched nothing: the scope walk missed, the qualified-name index missed, and the dotted-tail fallback never fired because there is no dot. Receiver typing declined at the BASE, so every `h.field.Method()` in a pointer-receiver method — the dominant Go idiom — emitted no CALLS edge. The reporter measured 178 handler and 585 service call sites lost on a 470k LOC codebase. The defect is the base ALONE. Go already normalizes field type bindings at capture through `normalizeGoTypeName`, so the step lookup was always sound. Isolating the two independently proves it: value receiver + value field resolves, value receiver + POINTER field resolves, pointer receiver + value field does not. Adds an OPT-IN decoration fallback to the class lookup, consulted only after every undecorated branch has failed: - `findAllClassBindingsInScope` enumerates every class-like candidate from both the scope chain and the qualified-name index. Needed because `walkScopeChain` returns the FIRST match and structurally cannot report a collision, so widening what a name matches without it would pick the nearest of several and mint a confident wrong edge. It stops at the first scope that binds the name, so an inner binding shadowing an outer one is not misreported as ambiguity. - The fallback strips one layer at a time and requires exactly ONE surviving nodeId, or it declines. - `stripTypePreservingDecoration` on the ScopeResolver contract carries the per-language vocabulary, so the core names no language (AGENTS.md R6). Go strips `*` only — `[]` and `map[…]` are CONTAINERS whose member set differs from the element's, and stripping one would let `repos: Repo[]` fold `repos.find(x)` to `Repo.find`. Those are unwrapped only by an index step that consumed a subscript. Opt-in rather than global because ~two dozen call sites are shaped `findClassBindingInScope(...) ?? otherResolver(...)`: turning a former `undefined` into a hit SUPPRESSES the fallback that used to answer, which would retarget inheritance edges and bypass generic-specialization selection. Only receiver-chain base and step resolution opts in. The stored `*T` binding is left decorated — `method-owners.ts` consumes the `*T` vs `T` distinction to model Go's value and pointer method sets, so this normalizes at LOOKUP, never by rewriting the binding. Verification: - bench cell `go.decoratedReceiverBase` VISIBLE-GAP -> RESOLVES, and it is the ONLY cell that moved of 164. - #2766's reproduction goes from 4 CALLS edges to 10; cross-package interface field, cross-package concrete field and same-package field all resolve. - Regression test proven to fail without the fix: with the stripper disabled the 3 pointer-receiver assertions fail while both controls (local-variable receiver, value receiver) still pass — so the test targets the changed line and the fix adds edges rather than moving one. - Full resolver suite green (2988 tests). Baseline movement, both fixture-corpus growth rather than code: receiver-resolution callDrops unchanged at 101; scope-capture go fingerprint rebaselined with a documented reason, and go was the only language of 15 that drifted. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-01 16:24:30 +00:00
Gergo Magyar	b442e04bf4	test(bench): canonical shape axis across all 14 languages (#2766) ... The shape arm was three languages with an ad-hoc shape list each, so "covers all supported languages" was an assertion rather than a measurement. Replace it with a canonical 10-shape axis every language must answer for, and add two states so a hole stops masquerading as a result: - `N/A` — the grammar does not admit the spelling. A reason is REQUIRED; an omitted cell and an inapplicable one are otherwise identical in a diff, which is how coverage rots. - `GRAMMAR-UNAVAILABLE` — the parser could not load, so nothing was measured. `drift` skips it on BOTH sides, so the gate cannot fail for the environment it ran in. Dart, Kotlin and Swift are vendored OPTIONAL grammars, absent under GITNEXUS_SKIP_OPTIONAL_GRAMMARS=1 or when no vendored prebuild matches the host. All 14 load on glibc linux-x64, so this state has no producer in the committed baseline — it guards the skip-flag and unsupported-host cases. `assertMatrixComplete` throws on a missing cell, an unknown id, or a reasonless N/A. It caught four real ids on its first run; those became declared `extraShapeIds`, because PHP's annotated/unannotated pair and C++'s pointer/value pair discriminate things the axis cannot express. 164 cells: 42 RESOLVES, 22 VISIBLE-GAP, 31 INVISIBLE-GAP, 69 N/A. Count arm unmoved at 101 call drops — shape fixtures build in temp directories and never touch the committed corpus. The measurement contradicts what was assumed about the decoration bug: - Go isolates it to ONE cell. Varying receiver and field decoration independently: value/value RESOLVES, value/pointer RESOLVES, pointer/value is a VISIBLE-GAP. Only the pointer receiver fails; field bindings already go through normalizeGoTypeName, so the step lookup is sound and the defect is entirely the base. - Go is the ONLY language whose receiver decoration defeats the lookup. Rust `&mut self` resolves. - The field-type gap is real in rust (Box<User>), typescript (User|null), csharp (User?), swift (User?) and cpp (User*) — but php, python, kotlin and dart already resolve theirs. - PHP's sigil hypothesis is dead: `$svc->getUser()->save()` (unannotated return) is an INVISIBLE-GAP while `$svc->getUserTyped()->save()` (annotated) RESOLVES. Same chain, same `->`, same base. Also surfaced, previously unknown: Swift resolves almost no chained receiver; Ruby's chains are VISIBLE-GAPs; C++ `this->` field receivers are INVISIBLE; `indexElement` is INVISIBLE-GAP in all 14; and Dart is the only language where `awaitParen` already resolves. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-01 16:24:29 +00:00
azizur100389	84f584449d	fix(python): resolve classes through module imports (#2770)	2026-08-01 06:02:47 +01:00
Gergő Magyar	27ab37c432	feat(resolution): type receiver chains from AST structure across all 14 languages (#2708) + epistemic lower-bound (#2744) (#2747)	2026-07-31 07:12:57 +01:00
Gergő Magyar	9c24e3459e	fix(rust): qualify items by their enclosing mod chain so same-named ones stay distinct (#2742) (#2745) ... * fix(rust): let the qualified-call filter see inline modules The negative filter added in #2741 builds its set of known module names from FILE PATHS, so an inline `mod x { … }` — which appears in no path — was absent from it. Every module-qualified call into an inline module was therefore rejected before any candidate channel ran, which is a hole in that optimisation rather than in the resolution logic it guards. The per-pass index now unions the file-derived names with inline module names taken from the scope model: a `mod` declaration binds a `Namespace` def locally in the declaring scope, and that binding is the only place an inline module's name exists. Collected in the same walk that already builds the module → scope map, so it costs no extra pass. Found while fixing #2742, where a correctly resolved call into `mod inner { … }` still could not reach its target. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J5nWP4BFeBSjbQ3uqAjtxV * fix(scope-resolution): try the namespace-prefixed node key before the bare one `resolveDefGraphId` looked up the plain `qualifiedName` key first and only retried with the `namespacePrefix`-qualified key afterwards. For the defs that carry a prefix the qualified name is a bare TAIL, so the plain key happily matched a same-named item at a different namespace depth in the same file and returned it before the more specific retry was ever reached. The namespace-prefixed key is strictly the more specific of the two, so it is now tried first. Where no such node exists the lookup falls through to exactly the previous order, which keeps the #1982 behaviour this retry was added for. Without this, a call into `mod inner { fn dispatch }` resolved to the correct definition and then mapped it onto the crate-root `fn dispatch` node — the self-loop #2742 describes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J5nWP4BFeBSjbQ3uqAjtxV * fix(rust): qualify items by their enclosing mod chain so same-named ones stay distinct (#2742) Node identity is `<label>:<file>:<qualifiedName>` and carried no module path, so an inline `mod inner { fn dispatch }` and a crate-root `fn dispatch` in the same file collapsed onto `Function:<file>:dispatch`, first-wins. Resolution already picked the right definition — the target simply was not representable, so a correct resolution still rendered as a self-loop and `impact` reported the real callee as unreached. The mechanism already existed: `qualifyRustImplTargetByModScope` has walked `mod_item` ancestors for impl targets since #1982. Generalised to `qualifyByEnclosingModScope` and applied to free items, so `mod inner { fn dispatch }` becomes `Function:<file>:inner.dispatch`. Keyed purely on the `mod_item` node type, exactly as the impl qualifier already was, so it is a no-op for every language whose grammar has no such node. Two constraints found by tests rather than by reading, both now encoded: - The helper normalised `::` to `.` unconditionally. With no enclosing `mod` that rewrote a top-level `impl a::Inner` from `a::Inner` to `a.Inner` and moved its node id away from the one the HAS_METHOD owner edge emits, breaking the #1975 scoped-impl ownership. It now returns raw text untouched when there are no mod segments, which also makes the change strictly additive for every id that has no enclosing module. - Qualification is scoped to items with no enclosing class/impl. A method already carries its owner's name, and that owner's id is mod-scoped by the impl qualifier, so qualifying the method again breaks the same byte-for-byte agreement. Same-named methods on same-named types in sibling modules therefore still collapse — a narrower residual than the free-item case fixed here, and one belonging to the owner edge rather than to this path. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J5nWP4BFeBSjbQ3uqAjtxV * fix(storage): bump schema versions for the mod-qualified Rust node ids (#2742) `INCREMENTAL_SCHEMA_VERSION` 24 -> 25 and `SCHEMA_BUMP` 31 -> 32. Node ids change for every Rust item inside any `mod` block, and `#[cfg(test)] mod tests` makes that close to every Rust repository. A pre-v25 index therefore holds ids an incremental top-up cannot reconcile — the old nodes would simply be stranded — so the reuse gate has to force a full re-analyze. The qualified name is computed in the parse worker, so a warm parse cache would likewise replay the old unqualified ids and keep the collapse. This branch originally claimed v24; #2708 took that number and merged first, so it is renumbered to v25 here. That is exactly the collision the v29 note in parse-cache.ts warns about, and re-checking against origin/main at rebase time rather than at branch time is what caught it. #2708 did not touch `SCHEMA_BUMP`, so 32 is free. The version-pin test moves with the bump by design, including the new pre-v25 row in the reuse-gate table. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J5nWP4BFeBSjbQ3uqAjtxV * fix(rust): stop mod-qualifying container ids while their owner edges stay bare (#2745 review) #2742 re-keyed Rust node ids by the enclosing `mod` chain. The mint moved; the owner-edge anchor did not. `findEnclosingClassInfo` mints a member's owner id from the container's BARE `nameNode.text` and only follows a qualified shape when the provider sets `classExtractor.qualifiedNodeId`, which Rust does not. So every `struct` / `trait` / `enum` / `impl` declared directly inside a `mod` got a node id that none of its member edges pointed at. Five lines of idiomatic Rust were enough: pub mod engine { pub struct Config { pub retries: usize } } NODE Struct:src/lib.rs:engine.Config DANGLING HAS_PROPERTY Struct:src/lib.rs:Config -> Property:src/lib.rs:Config.retries The rows are discarded by the IGNORE_ERRORS COPY retry, so the struct silently lost every field. A trait impl inside a `mod` additionally dropped its METHOD_IMPLEMENTS edge outright. The same gap put `impl a::Inner` inside a `mod` back on the #1975 rake that `qualifyByEnclosingModScope`'s own docblock warns about. The impl-target branch deliberately fires only for an UNSCOPED `type_identifier`; the new gate had no such restriction and picked up the scoped targets that branch had just excluded, minting `Impl:<file>:outer.a.Inner` against an anchor still reading `Impl:<file>🅰️:Inner`. The member side was already excluded via `!enclosingClassInfo`. This adds the owner side, gated on `MEMBER_OWNER_NODE_TYPES` — derived from `CLASS_CONTAINER_TYPES`, which is already the single source of "this node type owns member edges" and already carries an INVARIANT note binding it to `CONTAINER_TYPE_TO_LABEL`. A language adding a container therefore cannot gain a mismatched id shape here without also failing that invariant. Keyed purely on tree-sitter node types, so no language name enters shared ingestion. `union_item` is listed too: its fields are captured as Property but it is not a recognized owner, so they carry no HAS_PROPERTY edge and cannot dangle — it is here so a union's id keeps the same shape as the struct beside it. Containers still collapse across sibling modules, exactly as before this fix. That residual belongs to the owner edge, and is not worked around here. Regression tests use the UNFILTERED `findDanglingEdges(result)`. Every other dangling assertion in `rust.test.ts` passes `['HAS_METHOD']`, which is precisely why the HAS_PROPERTY breakage shipped with a green suite. They assert the NODE id rather than only the edge's anchor, because the anchor was already bare while the bug was live — an edge-only assertion passes in both builds. All four fail when the new gate clause alone is reverted. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019GvVxWt1ShhEP8CiMj3b6Z * fix(rust): resolve modules nested inside an inline mod (#2745 review) The #2730 self-loop survived one `mod` deeper: pub mod outer { pub mod tools { pub fn dispatch() {} } pub fn dispatch() { tools::dispatch(); } } CALLS outer.dispatch -> outer.dispatch <- the #2730 symptom NODE outer.tools.dispatch <- correct target, unlinked Two gates were blind to a nested inline module, so the hook refused and the shared lexical tier bound the call to the enclosing same-name `dispatch`: `knownModuleNames` was collected by walking `moduleScopeByFile`, which maps a file to its ROOT `Module` scope only. A `mod` nested inside an inline `mod` binds in the parent module's scope, so the walk saw depth-1 inline modules and missed every nested one — `tools` never entered the set and the negative filter rejected the qualifier before any candidate ran. `declaresSubmodule` had the same root-only assumption, so even with the name known the candidate `outer::tools` was never yielded. Both now read the def index. Names come from every `Namespace` def; inline module PATHS are derived from the members' `namespacePrefix` rather than from the `mod` defs, because a `mod` def carries no nesting information of its own — inside `mod outer { mod tools { … } }` the inner def is `qualifiedName: 'tools'` with NO `namespacePrefix`, while every def within it is stamped `outer.tools`. A `Namespace` scope also owns its OWN def rather than its children's, so the scope tree cannot answer this either: the `mod outer` scope lists `outer`, never `tools`. Restricted to non-empty prefixes, so this stays a DECLARATION check. Including file-derived modules would let an undeclared or `cfg`-gated file on disk outrank a real `use` binding — the regression #2741's review already fixed once. File-backed submodules therefore keep going through the binding check. A module with no defs at all is absent from the set, which is harmless: it has no member for a qualified call to resolve to. Cost is one pass over an already-resident def index, memoized per resolution pass on the existing WeakMap — the same order of work as the binding walk it replaces, and it subsumes it. `isLocalNamespaceBinding` was going to single-source the duplicated "locally declared submodule" predicate the review flagged; deriving paths from members removed the second copy outright instead. Regression fixture covers depth 2 and depth 3, so the fix is depth-agnostic rather than depth-2 special-cased. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019GvVxWt1ShhEP8CiMj3b6Z * fix(rust): let an imported type outrank a same-named module (#2745 review) Widening the negative filter to inline `mod` names let a type-qualified call through whenever a module happened to share the type's name. The crate-root-relative candidate then captured it: // src/lib.rs pub mod Buffer { pub fn with_capacity() -> usize { 111 } } // src/b.rs use crate::c::Buffer; // the real target lives in c.rs pub fn call() -> usize { Buffer::with_capacity() } base: (no CALLS edge — unresolved) PR: CALLS b::call -> Function:src/lib.rs:Buffer.with_capacity <- fabricated `ids.ts` states the doctrine this broke: a missing edge is the correct failure direction for a graph whose consumers include `impact`; a fabricated caller is not. The base produced the missing edge and the PR produced the fabricated one. That third candidate is the loosest of the three — a guess at a crate-root-relative path the caller never wrote, kept for 2015-edition style. In Rust 2018 a bare first segment resolves in the CALLER's module, so a local binding for that segment settles the question: it is now skipped when the head names anything non-module in the caller's own module. Candidates 1 and 2 are untouched, and they run first, so the legitimate `use crate::tools;` path is unaffected. The binding lookup goes through `lookupBindingsAt`. A first attempt read `Scope.bindings` directly and the guard never fired: a `use` binding is finalize OUTPUT and absent from the scope's own local table, which is exactly the imported-type case being guarded. Contract I8 in `contract/scope-resolver.ts` requires that channel anyway. The regression test asserts the forbidden TARGET rather than an empty edge set, and separately asserts the module member still exists as a node — otherwise the test would pass just as well if the call went unresolved for some unrelated reason, or if the module node disappeared entirely. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019GvVxWt1ShhEP8CiMj3b6Z * fix(scope-resolution): try the namespace-prefixed name on the TAGGED keys too (#2745 review) `resolveDefGraphId` gained a namespace-prefixed retry for the plain qualified key in this PR, but the five tagged keys above it — template constraints, parameter types, parameter shape, arity, template arguments — kept composing from the bare `qualifiedName`. For a namespace- or `mod`-qualified def those keys are simply dead: `node-lookup.ts` registers them under the QUALIFIED name (`inner.dispatch#0`) while this side built `dispatch#0`. The keys exist to separate overloads, so a mod-scoped overload set was relying on whichever later key happened to catch it. Verified as a miss rather than a mis-hit before changing anything — an end-to-end run with a crate-root decoy of the same name and arity binds correctly — so this is hygiene, not a live bug. Worth doing while the code is open rather than leaving five keys dead and the behaviour dependent on fallback order. Both name forms now go through one `lookupTagged` helper, most specific first, so a sixth tagged key cannot be added with the bare form only. That also removes the five hand-repeated `qualifiedKey(...)` / `nodeLookup.get(...)` pairs. Also pins the C++ `EXTENDS` retarget this PR's reorder produces. `cpp-two-phase-dependent-base-cross-ns-deep` declares a global `Inner` decoy alongside `ns:🅰️🅱️:Inner`; the base's `qualifiedName` is a bare `Inner` with the path on `namespacePrefix`, so only the prefixed key separates them, and only if it runs first. The improvement was riding unasserted in a Rust-scoped PR. The captures golden covers every `rust-*` fixture, so the three fixtures added by this review series drift it; regenerated with UPDATE_GOLDEN=1. Verified: 785 tests across cpp / csharp / rust resolvers and the callable-id-lockstep unit test. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019GvVxWt1ShhEP8CiMj3b6Z * fix(rust): keep a mod declared inside a fn from hoisting above the callable (#2745 review) `fn wrapper() { mod helper { fn dispatch } }` minted `Function:<file>:helper.wrapper.dispatch@2:8` — the mod segment composed OUTSIDE the enclosing-callable prefix, inverting the real nesting. Nothing dangled: the `@line:col` suffix already makes a function-local callable's id unique, which is also why the mod segment adds no identity in this position. The path simply read as a lie about the source. It is now skipped rather than reordered — interleaving two qualifier passes to fix the order would be real machinery for a shape whose ids are already unique. Also folds in the three documentation and structure findings from the same review: - The 4-clause gate is extracted to a named `qualifiesByEnclosingModScope`, matching the two conditions directly above it in the same function, which were already named consts. - `qualifyByEnclosingModScope`'s docblock documented only the impl-target contract even though the generalized name has had a second, looser caller since #2742. It now states both, and says which gate belongs to which — that gap is what let the #1975 scoped-impl regression through in the first place. - The "cheap rejection BEFORE any index work" comment was no longer true: `passIndexFor` walks the def index on its first call in a pass. Corrected rather than left to mislead the next reader into thinking the filter is free. What it still buys — skipping the per-site candidate search, the part that scales with the workspace — is stated instead. Verified: 279 tests across the Rust resolver suite and the Rust scope-resolution unit tests. Captures golden regenerated for the extended fixture. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019GvVxWt1ShhEP8CiMj3b6Z * test(storage): move main's SCHEMA_BUMP pin to 32 for the mod-qualified ids (#2745 review) `#2736` added a pin asserting `SCHEMA_BUMP === 31` on main, which arrived on this branch through the merge of main while `0062a5c2` had already bumped the constant to 32. Neither side conflicted textually — the pin and the constant live in different files — so the merge was clean and the test failed instead. That is the pin working as designed: it exists so a bump cannot ride along unnoticed, and this is the fifth time a SCHEMA_BUMP collision has been caught by a guard rather than by review. Updated to 32 with the reason recorded inline. `INCREMENTAL_SCHEMA_VERSION` needs no second bump: 25 was introduced by this unmerged branch, so no released index carries it, and its own pin in `call-summary-schema-version.test.ts` is already consistent. Verified: 119 tests across the parse-cache, schema-version, incremental-orchestration and the two identity suites that arrived with the merge. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019GvVxWt1ShhEP8CiMj3b6Z * test(bench): rebaseline the Rust capture fingerprint for the three new fixtures (#2745 review) CI caught what I missed: [scope-capture --check] FAIL: rust: capture fingerprint drift (got 05acbaca..., expected 90fda086...) fixture_count 202 `bench/scope-capture` fingerprints the whole `rust-*` fixture corpus, so the three fixtures added by this review series drift it. I rebaselined the `rust-captures-golden` snapshot and stopped there — a new fixture is a call site of BOTH, and updating only one is how this reached CI red. This is the same class as PR #2743's headline finding, from the other direction: an id-shape change makes every synthetic corpus a call site, and the author fixed the unit-test fixture and missed the bench. Here it is a fixture-count change rather than an id-shape change, and the review that flagged the #2743 lead as "REFUTED, bench/ has no Rust node-id corpus" was right about node ids and wrong about the corpus fingerprint. Noted for the next author in the baseline entry itself. Verified as pure corpus growth rather than a capture-logic shift: removing ONLY the three new fixture directories and re-running reproduces the prior fingerprint exactly (196 fixtures, capture_groups_fp 3432), and restoring them gives the new one (202, 3556). `emitRustScopeCaptures` is untouched by this series. Scaling 1.022 local / 1.057 CI, well inside the 1.5 budget. `bench/python-scope` globs `python-*` only and is unaffected; no other bench walks the Rust corpus. `--check` now PASSes for all 15 languages. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019GvVxWt1ShhEP8CiMj3b6Z --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-30 17:08:00 +01:00
azizur100389	e723f3c2ee	fix(scope-resolution): parse def coordinates after file paths (#2743) ... * fix(scope-resolution): parse def coordinates after file paths Anchor coordinate parsing to the known file path so coordinate-like path fragments and private symbol names cannot corrupt closure attribution. * fix(bench): use production definition ids	2026-07-30 07:34:32 +01:00
Gergő Magyar	bc76ba2f25	fix(resolution): type inline constructor receivers in every spelling (#2708) (#2737) ... * fix(resolution): resolve constructor-expression receivers (#2708) `Service(db).do_work()` emitted no CALLS edge, so the caller was missing from `impact(direction: "upstream")` and `context()` while the two-step spelling of the same call (`s = Service(db)` then `s.do_work()`) resolved. The receiver reaches `resolveCompoundReceiverClass` intact — Case 0 in `receiver-bound-calls` routes it there because the text contains `(`. The free-call branch then only knew one shape: a function whose return-type binding names a class. A class has no return-type binding, so `Service` resolved to nothing and the member call was dropped. Handle the constructor shape: in languages that construct without a `new` keyword (Python, Kotlin, Swift, Scala) a free call naming a class IS a constructor call, so the expression's type is that class. The existing return-type path still runs first and wins, keeping this strictly additive — `new`-keyword languages never reach the new line because their receiver text keeps the keyword (`new Service(db)`), which matches no class binding. Verified on the issue's 4-file repro: `route_inline` now emits `CALLS → Service.do_work` and `impactedCount` goes 1 → 2. Note the issue's second ask — degrading `epistemic` to `lower-bound` when a receiver goes unresolved — is NOT addressed here. `computeEpistemicBoundary` keys only on the target's own heritage edges and runs at query time against the index, while unresolved references live in an in-memory `resolutionOutcomes[]` that is never persisted. That needs unresolved-receiver counts in the index first, so it is left for a follow-up. Tests: new `python-inline-constructor-receiver` fixture plus three integration cases (inline resolves, two-step still resolves, no cross-class fan-out). Two of the three fail without the source change. Full `test/integration/resolvers` suite passes (2928 tests) — the fix is shared across every language, so no-regression coverage matters more than the new cases. Python captures golden regenerated: additions only, no existing digest changed, confirming capture output is untouched. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RqnsJK3Cnbu3bjdZbzgMMP * refactor(resolution): state the construction rule once, cover every spelling (#2708) The first commit fixed `Service(db).do_work()` by special-casing a bare class-name callee inside the free-call branch of the compound receiver resolver. That was the right rule in the wrong place: it covered one surface syntax out of three, and asserted rather than declared which languages it applied to. Probing the same shape across languages showed the bug is wider: | spelling | languages | dropped before? | |------------------------|--------------------|-----------------| | `Service(db).m()` | Python | yes | | `new Service(db).m()` | JS/TS, Java, C# | yes | | `Service.new.m()` | Ruby | yes | | both forms | PHP, Swift, Dart, | no — already | | | Kotlin | resolved | So the rule is stated once — "constructing a class yields an instance of that class" — and the per-language surface syntax is declared through a new `ScopeResolver.constructionSyntax` hook, matching how this file already gates language-varying behaviour (`stripReceiverCastExpressions`, `hoistTypeBindingsToModule`). Shared pipeline code names no language. - `bare: true` — Python - `keyword: 'new'` — JS/TS, Java, C# - `selector: 'new'` — Ruby, including the parenthesis-less `Service.new` spelling that reaches the chain walker rather than the call branch Opt-in is per-language for two reasons. Correctness: `bare` would mistype `stat(&st).field` in C, where a struct and a function may share a name. Evidence: PHP, Swift, Dart and Kotlin resolve this shape already, so they stay unwired instead of carrying a declaration that changes nothing — each verified by diffing analyzer output between builds with and without the change, not assumed. The keyword gate also keeps a bare factory call honest: in a `new` language, `makeOther(db).doWork()` still resolves through the factory's return type and is never read as constructing a same-named class. Tests: TypeScript fixture (inline `new`, a plain `.js` file for the javascript provider, two-step, and the factory guard) and a Ruby fixture (`Service.new` with and without an argument list, plus two-step). With the source change stashed, the inline cases fail and the factory/two-step cases still pass. The Python cases from the first commit are unchanged. No Kotlin fixture: its cases passed without the change, so they would document coverage this commit does not provide. Full `test/integration/resolvers` + `test/unit/scope-resolution`: 4234 passed, 1 skipped. Ruby captures golden regenerated — additions only, no existing digest changed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RqnsJK3Cnbu3bjdZbzgMMP * fix(resolution): only treat a construction selector as construction on the class itself (#2708) The `selector: 'new'` rule fired on any receiver whose type was class-like, which is true both when the receiver IS the class constant (`Factory.new`) and when it is a value of that class (`factory.new`). `isClassLike(...)` cannot tell those apart, so an instance receiver took the construction path too and skipped the member lookup that should have run. That replaced a CORRECT edge with a wrong one. Measured against the base build on a class defining an instance method `new` returning a `Product`: factory = Factory.new; factory.new.run before this PR: Product#run (correct) after this PR: Factory#run (wrong) Track whether resolution currently sits on the class constant or on a value of that class, and apply the selector rule only to the former. The head of a chain is a class constant only when it resolved straight to a class binding rather than through a typeBinding; every hop past it yields a value, so the flag clears. The `obj.method()` branch derives the same fact from whether `objExpr` is a bare name resolving to that class. `Factory.new.run` keeps the behaviour this PR introduced (Factory#run), which is itself a fix over the base build's Product#run. KNOWN LIMITATION, now documented on the contract field and asserted by a test so a future change to it is deliberate: a class-level override (`def self.new` returning another type) is still read as construction. The scope model records no staticness per member, so `def new` and `def self.new` are indistinguishable at this layer; separating them needs the language provider to record staticness first. An earlier attempt to use `TypeRef.source` as a proxy was abandoned after tracing showed Ruby records body-inferred return types as `return-annotation` too, so it does not discriminate. Tests: `ruby-construction-selector` fixture pins all three shapes — class constant, instance receiver, and the documented class-level-override limitation. Ruby resolver suites: 185 passed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RqnsJK3Cnbu3bjdZbzgMMP * fix(resolution): resolve generic construction receivers (#2708) `new Box<string>().unwrap()` reached the class lookup as `Box<string>`, which names no class binding, so the member edge was still dropped while the non-generic spelling resolved. `new Foo<T>()` is ordinary in all three keyword-wired languages, so the fix covered a materially narrower slice of real code than intended. Retry the lookup on the base name via `stripTemplateArguments` — the same normalization `resolveClassBindingForName` already applies to typed receivers in the sibling `receiver-bound-calls` pass. The exact-name lookup still runs first, so a class whose name legitimately contains `<` is unaffected. Measured on the probe that first showed the gap: before: | viaGeneric | Class:src/box.ts:Box | (construction edge only) after: | viaGeneric | Method:src/box.ts:Box.get#0 | (member edge resolved) Tests: `viaGenericCtor` added to the typescript-inline-constructor-receiver fixture, asserting both the target file and that the resolved id is `Box`. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RqnsJK3Cnbu3bjdZbzgMMP * fix(resolution): resolve construction in the chain-head position (#2708) `new Service(db).inner.deep()` emitted only the construction edge. The chain walker seeds its starting class from the head segment, which arrives as `new Service(db)` and reduces via `stripCallParens` to `new Service` — no binding and no class of that name, so the walk was never seeded and every segment after it resolved to nothing. Seed the head through the same construction rule the call branch already uses. A constructed value is an instance, so the class-constant flag from the previous commit correctly stays false — `new Factory().new` does not get the selector treatment. The gap was asymmetric across the languages this PR wires: Python's bare form strips to a plain `Service` and was already seeded, so only the keyword languages were affected. Tests: `viaChainHead` added to the typescript-inline-constructor-receiver fixture. Note the fixture annotates `readonly inner: Inner` explicitly — with an unannotated initializer the walk stops at the field, which is field-type inference and a separate concern from head seeding. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RqnsJK3Cnbu3bjdZbzgMMP * fix(resolution): match the construction keyword by token, not by one space (#2708) The keyword form was matched with `startsWith(`${keyword} `)`, so only a single space separated `new` from the type. Any other trivia the source used — a tab, a line break — failed the match and the member-call edge was lost. Match the keyword as a whole token followed by one or more whitespace characters instead. `newService()` still fails the match, which is the point: it is an ordinary call, not a construction, and must keep resolving through its own return type. The keyword is escaped before it enters the pattern. It comes from a language provider rather than from user input, but a keyword containing a regex metacharacter would otherwise build a silently wrong pattern. Tests: tab-separated and newline-separated `new` added to the typescript-inline-constructor-receiver fixture. Note these cases only survive because `gitnexus/test/fixtures/` is listed in the repo-root `.prettierignore` — running prettier from inside `gitnexus/` does not pick that file up and normalizes the tab away. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RqnsJK3Cnbu3bjdZbzgMMP * fix(resolution): resolve qualified construction callees (#2708) `new ns.Service().doWork()` emitted only the construction edge. The call branch splits the callee at its last `.` before construction is considered, so a qualified type name was routed into `obj.method()` resolution as if `ns` were a receiver and `Service` a member. A keyword-marked expression is never a member call, so resolve it as construction before the split. The callee lookup now also handles a dotted name: an unambiguous `qualifiedNames` match first, then the trailing simple name, mirroring how receiver resolution elsewhere in this pass degrades. Measured: before: | viaQualified | Class:src/svc.ts:Service | (construction only) after: | viaQualified | Method:src/svc.ts:Service.doWork#0 | Bare-form qualified construction (Python `models.User(db).save()`) is NOT addressed here: that shape currently emits no edges at all, including no construction edge, so it is a namespace-import resolution gap upstream of this pass rather than a construction-typing one. Tests: `viaQualifiedCtor` added to the typescript-inline-constructor-receiver fixture. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RqnsJK3Cnbu3bjdZbzgMMP * fix(java): drop the unreachable constructionSyntax declaration (#2708) Java was wired `{ keyword: 'new' }`, and the PR described it as one of the languages that needed the fix. Measuring both ways shows it never did: Java resolves `new Svc().doWork()` identically with and without the change, because `java/captures.ts` (#2564) already rewrites an `object_creation_expression` receiver to the constructed type's simple name, so the raw `new Svc()` text never reaches this resolver. The decisive evidence is generics: Java resolves `new Box<User>().doWork()`, which the keyword path could not do before the template-argument fix earlier in this series — the resolution demonstrably comes from the capture rewrite, not from here. Removing the declaration rather than leaving it as defensive configuration: an unreachable per-language opt-in reads as coverage that does not exist, and the contract now records why Java is excluded so the omission is not mistaken for an oversight. Verified after removal: the Java probe still resolves both the inline and two-step spellings, and the Java resolver suites pass (252 passed, 1 skipped). An earlier coordinator measurement in this review claimed Java WAS broken on base; that comparison was invalid (the "without fix" build had not been rebuilt). Corrected here. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RqnsJK3Cnbu3bjdZbzgMMP * refactor(resolution): state the selector rule once and derive its option type (#2708) Two follow-ups from review, no behaviour change (643 resolver tests pass unchanged before and after): The `Class.new` selector rule was written out twice — in the `obj.method()` branch and again in the chain walker — against differently named locals, while the construction helper's own doc comment claimed the rule was stated in exactly one place. Both sites ask the identical question, so they now call one `isConstructionSelectorHop` predicate, and the doc comment says what is actually true. `ResolveCompoundReceiverOptions.constructionSyntax` re-declared the contract's object shape by hand. It was the file's first object-shaped duplicate, and because the value arrives as a non-literal variable, TypeScript's excess property check would not fire: a sub-field added to the contract later would type-check and then be silently ignored here. It is now derived with `ScopeResolver['constructionSyntax']`. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RqnsJK3Cnbu3bjdZbzgMMP * test(resolution): cover the C# construction path and pin the wiring inventory (#2708) Three coverage gaps from review, no behaviour change. C# had no fixture despite being the only keyword-wired language whose behaviour genuinely depends on the construction rule — measured absent on base and present on head. `csharp-inline-constructor-receiver` covers the inline spelling, the two-step spelling, and a static factory that must keep resolving through its return type rather than being read as construction. The TypeScript two-step assertion checked only `toContain('Service')`, and the same fixture defines `LegacyService` — `'LegacyService'.includes('Service')` is true, so the assertion could not distinguish the two targets. It now pins `targetFilePath` the way its sibling assertions already do. Nothing guarded the deliberate opt-in set, so an accidental wiring of a language that already resolves the shape, or a silent loss of one that needs it, would pass the whole suite. `construction-syntax-wiring.test.ts` pins the inventory in both directions: exactly which languages declare `constructionSyntax` and with which spelling, and that java/php/swift/dart/ kotlin stay unwired. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RqnsJK3Cnbu3bjdZbzgMMP * chore(storage): bump INCREMENTAL_SCHEMA_VERSION to 23 for the #2708 edge changes This series changes which CALLS edges are emitted for source whose CONTENT has not changed — inline constructor receivers that previously emitted nothing now resolve, and the Ruby selector fix moves one edge back to the member it always belonged to. That is precisely the class of change the version-history block in this file requires a bump for, and the reuse gate is a strict equality on the persisted stamp. Without it, every existing v22 index passes the gate on the next `analyze` — or is served by the same-commit "already up to date" fast path — and keeps returning the pre-fix graph for unchanged files. `impact(direction: "upstream")` and `context()` would go on omitting the very callers #2708 is about, with no warning, until something unrelated forced a full re-analyze. The fix would have shipped without reaching anyone who already had an index. Precedent is unbroken across the recent resolution PRs: #2723 → v22, #2699 → v21, #2695 → v20, #2563 → v14, each with its own rationale paragraph. This adds v23 in the same form. The pinned assertion in call-summary-schema-version.test.ts moves with it, as that test documents it is designed to. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RqnsJK3Cnbu3bjdZbzgMMP * chore(bench): re-baseline the fixture-corpus fingerprints for #2708 Both bench harnesses fingerprint an entire fixture corpus by directory prefix (`bench/python-scope/measure.mjs:38`, `bench/scope-capture/measure.mjs:76`), so every fixture directory this series adds moves a committed baseline. Neither script writes the baseline itself — running without `--check` only prints, and the file is edited deliberately, which is what its own comment asks for. Regenerated, last in the series so the fixture set was final: bench/python-scope/baseline-fingerprint.txt 36e29abc… -> f120df92… bench/scope-capture/baselines.json ruby 070e4e11… -> fea3edf8… typescript 281e9548… -> cad25be9… csharp e05dc274… -> 05a85bae… CI only ever reported the python drift, because the benchmarks job runs the python step first and aborts there; the cross-language step never ran. Both were verified locally after the update: [measure --check] PASS (capture fingerprint + scaling) [import-target-fingerprint --check] PASS (resolver fingerprint) [scope-capture --check] PASS (15 languages) The `csharp` and `ruby` entries moved because of the fixtures added earlier in this series, not the original ones — a reminder that this baseline moves with any fixture addition, not just the one that first triggered it. Captures goldens regenerated alongside (csharp, ruby); both additive only, no existing digest changed. The python golden did not move: no `python-*` fixture was added after its last regeneration. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RqnsJK3Cnbu3bjdZbzgMMP * Update tests for passesReuseGate function --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-29 16:19:53 +01:00
Gergő Magyar	df06529950	fix(rust): resolve module-qualified calls against the module tree (#2730) (#2741) ... * fix(rust): resolve module-qualified calls against the module tree (#2730) A Rust call written with a path (`tools::dispatch(..)`) was captured with only its tail identifier, making it indistinguishable from a bare `dispatch(..)`. The scope-chain walk then resolved the bare name lexically and bound it to whatever `dispatch` was nearest — which, for the common wrapper idiom fn dispatch(..) -> ToolOutcome { tools::dispatch(..) } is the wrapper itself. The graph gained a self-loop, the real cross-module edge never existed, and `impact` reported the callee as unreached: the issue's repository showed its central tool dispatcher as `risk: LOW` with 0 affected processes and both "callers" being `#[cfg(test)]` functions, while still labelling the result `epistemic: "exact"`. Resolve paths the way rustc does, over the module tree rather than the filesystem: - `mod_item` now emits `@declaration.namespace`, so a Rust module is a named definition rather than an anonymous scope region. This mirrors the existing C++ `namespace_definition` capture and lets the shared `tagNamespacePrefixes` pass stamp members with their enclosing module path — that pass needed no changes to start working for Rust. - `module-path.ts` reconstructs the other half of the tree: crate roots are directories holding `main.rs`/`lib.rs`, and a file's module path is its location below that root. A definition's module is its file's module plus any enclosing `mod` blocks. - `crate::`, `self::` and `super::` are prefix transforms on the calling module, not reasons to stop resolving. - The final path segment is looked up as a member of the resolved module, including members it only re-exports. A `pub use` creates no binding on the re-exporting module's own scope, so re-exports are followed through that module's import edges. Resolution runs ahead of the implicit-`this` and scope-chain tiers, so an explicit path outranks a lexical shadow, and returns undefined on an unknown module, a missing member or a tie — leaving the existing chain untouched. The new `ScopeResolver.resolveQualifiedFreeCall` hook is optional and unset for every other language, so this is additive. Fixes the reported case (direct callers 2 -> 3, impacted 2 -> 6, the Agent module now visible) plus multi-segment paths, `super::` paths and `pub use` facades, each of which previously produced a wrong edge. Known limitation, pre-existing and unchanged by this commit: an inline `mod inner { fn dispatch }` and a crate-root `fn dispatch` in the same file collapse to one graph node, because node identity is `<file>:<qualifiedName>` and does not carry the module path. That is a separate defect requiring module-path-qualified node ids and an incremental-schema migration. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J5nWP4BFeBSjbQ3uqAjtxV * test(rust): rebaseline the scope-capture fingerprint for the module-tree captures `mod_item` now emits `@declaration.namespace` and scoped call sites carry `@reference.qualified-name`. Both are additive, so every bench fixture holding a `mod` block or a `Foo::bar()` call gains capture groups, and the corpus grew by the three `rust-2730-*` fixtures. Only the Rust fingerprint moves. The other 14 languages are byte-identical, which is the intended blast radius for a language-local capture change. Scaling stays linear at 1.043, well inside the 1.5 budget. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J5nWP4BFeBSjbQ3uqAjtxV * fix(rust): carry crate identity in qualified module paths (#2741 review H1) A module was identified by its path segments below a crate root, so `crates/alpha/src/tools.rs` and `crates/beta/src/tools.rs` were the same module. A cargo workspace routinely gives several members the same internal module name — `util`, `error`, `config`, `types` are near-universal — and that made qualified resolution do one of two wrong things: - where only one member defined the called name, the call bound ACROSS crates; - where both defined it, the lookup saw two candidates, refused, and handed the site back to the lexical walk that emits the same-name self-loop. The fix for #2730 therefore switched itself off in exactly the workspace layouts it was written for, and #2730's own reported reproduction repository is multi-crate. A module is now `{ crateRoot, segments }` and `sameModule` compares both. Rust has no implicit cross-crate paths — reaching another crate requires naming it — so two modules in different crates are never the same module. Anchored paths (`crate::`, `self::`, `super::`) resolve inside the caller's own crate and inherit its root. Covered by a two-member workspace fixture where both crates define `tools::dispatch` behind a same-name wrapper, plus unit tests for the path arithmetic itself, including the branches no fixture reaches (a file under no crate root, a `super::` chain walking above the crate root). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J5nWP4BFeBSjbQ3uqAjtxV * fix(rust): count only module members when resolving a qualified call (#2741 review H3) Module membership was inferred from the file path alone, so any callable in the right file counted as a member of the module. A `fn` nested inside another `fn` has the same `filePath`, the same bare `qualifiedName` and no owner, making it indistinguishable from a module-level item: pub fn dispatch() -> usize { 3 } // the real member pub fn wrapper() -> usize { fn dispatch() -> usize { 99 } // counted as a second member dispatch() } Two candidates tie, the lookup refuses, and the call falls back to the lexical walk that emits the same-name self-loop — so an unrelated local helper anywhere in a module silently reinstated #2730 for every qualified call into it. The scope model already draws the line exactly: a module-level item is bound with `origin: 'local'` in its module's own scope, a function-local item binds in the enclosing Block, and an `impl`/trait method binds in the Class scope. Membership is now that binding lookup rather than a path comparison. Inline-`mod` members bind in their Namespace scope rather than the file's Module scope, and reaching it would mean walking every child scope — faulting them back in from disk on the out-of-core path. They keep being identified by the `namespacePrefix` the shared tagging pass stamps on them, which a file-module member never carries. The documented residual is a `fn` nested inside a `fn` inside an inline `mod`, which inherits that prefix; that is strictly smaller than before and costs a refusal, never a wrong edge. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J5nWP4BFeBSjbQ3uqAjtxV * fix(rust): require a use-binding to name a module, not a type (#2741 review H2) Import resolution deliberately strips a trailing symbol segment when probing for a file — "the last segment might be a symbol (function, struct, etc.), not a module. Strip it and try again" (import-resolvers/rust.ts). So `use crate::client::ClientBuilder;` also resolves to `client/mod.rs`. The qualified-call resolver took that at face value and treated the imported TYPE as the module `client`. Rust impl methods carry a bare `qualifiedName`, so `ClientBuilder::new()` was then looked up among `client`'s module members and bound to an unrelated module-level `new` — turning an unresolved site into a false edge, which the module's own contract calls the worse outcome. A binding now has to name the module it resolved to. The edge's `targetExportedName` is the tail of the written path, so comparing it against the resolved module's own tail separates the cases exactly: use crate::tools; tail `tools` module ['tools'] accept use crate:🅰️:b as tools; tail `b` module ['a','b'] accept use crate::tools::{self, Ctx}; tail `tools` module ['tools'] accept use crate::client::ClientBuilder; tail `ClientBuilder` module ['client'] reject Covered by a fixture where `client/mod.rs` deliberately holds both `impl ClientBuilder { fn new }` and a module-level `fn new`, so a regression re-binds to the wrong one, plus a control asserting a genuine `client::new()` module qualifier still resolves. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J5nWP4BFeBSjbQ3uqAjtxV * fix(rust): give src/bin targets their own crate root (#2741 review) Cargo auto-discovers a binary target for every `src/bin/<name>.rs`. Each is a separate crate with its own `crate::` root, and its submodules live under `src/bin/<name>/`. Only `main.rs` and `lib.rs` established a crate root, so those entry files were folded into the surrounding library and given the invented module path `bin::<name>`. That made `crate::helper()` inside a binary resolve into the LIBRARY's `helper` — and unlike the other findings in this review, this one downgraded an edge the lexical walk had previously resolved correctly, so it made existing output worse rather than merely failing to improve it. `src/bin/<name>.rs` is now its own crate root (as is the `src/bin/<name>/main.rs` directory form), so a binary's modules and the library's modules of the same name are no longer the same module. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J5nWP4BFeBSjbQ3uqAjtxV * fix(rust): only try a submodule candidate the caller actually declares (#2741 review) The first candidate module was `callerModule ++ qualifier`, yielded before the `use` channel and never checked against anything. That let file layout outrank a real import: with `use crate::b;` in `src/a/mod.rs` and an undeclared — or `cfg`-gated — `src/a/b.rs` present on disk, `b::f()` bound to the sibling file, where rustc resolves it to `crate::b`. A `mod` declaration, inline or file-backed, emits a `Namespace` def bound locally in the declaring scope, so the candidate is now gated on that binding rather than assumed. When the caller does not declare the submodule the candidate is skipped and the `use` and crate-root channels still run, so this only removes guesses. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J5nWP4BFeBSjbQ3uqAjtxV * fix(rust): follow only real re-exports, and refuse on an ambiguous one (#2741 review) Two problems in the re-export channel. A private `use` was followed as though it re-exported. `use crate::tools::helper;` makes `helper` visible INSIDE the module; it does not put it on the module's public surface, so `facade::helper()` does not compile. Only `pub use` does, and finalize already distinguishes them — `reexport` for `pub use`, `named` for a private one. The `alias` kind is now accepted alongside `reexport`, because `pub use x::y as name` is a re-export that was previously ignored entirely. The lookup also took the first matching edge in file-iteration order, which is parse-pool order. Two `cfg`-exclusive facades re-exporting the same name are indistinguishable at this layer, so picking one baked a coin flip into the graph. It now refuses on a genuine tie, consistent with how member lookup already behaves. The pre-existing limitation that only FILE modules are reachable — a `pub use` inside an inline `mod facade { … }` has no `moduleScopeByFile` entry — is now stated in the code. Reaching those would mean walking every child scope and faulting the scope tree back in from disk, which is the cost that index exists to avoid; a miss falls through to the unchanged chain rather than guessing. The regression test deliberately makes the re-exported name globally ambiguous. Without that, the pre-existing unique-global free-call fallback resolves the call on its own and the assertion passes whatever this channel does. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J5nWP4BFeBSjbQ3uqAjtxV * perf(rust): stop type-qualified calls paying for module resolution (#2741 review) The capture carrying `rawQualifiedName` matches every `scoped_identifier` callee, so this hook was reached by `Vec::new()`, `String::from()`, `Self::method()` and every other type-qualified call — the overwhelming majority of `::` calls in real Rust, none of which name a module. Each one ran the full candidate search before returning undefined, and every candidate that missed then walked all of `workspaceIndex.moduleScopeByFile`. Total cost grew as `qualified-call-sites x files`; two independent measurements put per-site cost at 0.117 -> 0.428 ms across 301 -> 1201 files, i.e. linear in workspace size. Two changes: - The module index now carries a flat set of every module segment name in the workspace, and a qualifier whose head matches none of them is rejected before any candidate work. Measured at 0.02 us per rejected call and flat in file count (500 -> 8000 files), against a previously linear per-site cost. - Module scopes are indexed by module identity once per pass rather than rediscovered by scanning every file per candidate. On the out-of-core scope index that scan was worse than CPU: `moduleScopeByFile` fetches through `scopeTree.getScope`, so a full sweep could fault every module scope back in from disk — the pattern `workspace-index.ts` added `exportedCallableByName` to avoid. Given the #2649 and #1871 history this mattered before merge. The captures golden is regenerated for the fixture files added earlier in this series; `emitRustScopeCaptures` itself is unchanged by this commit. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J5nWP4BFeBSjbQ3uqAjtxV * fix(storage): bump schema versions so the #2730 fix reaches existing indexes Neither invalidation constant was bumped, so the fix did not reach the users who reported the bug. `INCREMENTAL_SCHEMA_VERSION` 22 -> 23. The incremental write set only covers CHANGED files, so a top-up against a pre-v23 index keeps the wrong self-loop — and keeps reporting the callee as unreached — for every unchanged Rust file. The constant's own doc block states this rule, and the precedent is exact: v11 is the same file (`rust/query.ts`) gaining a capture that changes CALLS edges, with the same "force a full re-analyze" contract, and v12 is a second Rust instance. `SCHEMA_BUMP` 30 -> 31. `@declaration.namespace` and `@reference.qualified-name` are parse-time captures, so a warm parse cache replays the old capture set verbatim: `rawQualifiedName` comes back undefined and no Namespace def exists to hang a module prefix on, turning the entire resolution tier into a no-op on unchanged files. `PARSE_CACHE_VERSION` folds in the package version, so a tagged release would have invalidated eventually — but source, dev and CI builds at the same version would not, and the v29 note already warns that relying on someone else's bump is how a change ships with no invalidation at all. Re-checked against origin/main at commit time, as that note instructs. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J5nWP4BFeBSjbQ3uqAjtxV * fix(scope-resolution): let a language opt out of the already-namespaced guard (#2741 review) `tagNamespacePrefixes` skips a def whose `qualifiedName` already equals, or is prefixed by, its enclosing namespace path. That is right for C++ and C#, where the qualified name genuinely carries the namespace. Rust qualified names never do, so the guard fired on a coincidence: in `mod a { pub fn a() }` the member's name equals its module's name, the prefix was skipped, and `moduleOfDef` then reported the member as belonging to the PARENT module. `crate:🅰️:a()` refused, and the def became indistinguishable from a crate-root `fn a` for the module matcher. The guard is now conditional on a `qualifiedNamesCarryNamespace` option that defaults to the existing behaviour, and Rust opts out. The shared pass stays language-neutral — the decision lives with the provider that knows what its own qualified names contain. C++ and C# resolver suites pass unchanged alongside the Rust ones (600 tests). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J5nWP4BFeBSjbQ3uqAjtxV * fix(rust): refuse a leading :: path instead of reading it as relative (#2741 review) A leading `::` anchors at the extern prelude: `::tools::dispatch()` names the CRATE `tools`, not a module of the current one. The path split filtered the empty leading segment away, which silently reinterpreted the path as relative and let it resolve against a local module that happens to share the name. Extern crates are outside the workspace module tree, so the qualified tier now refuses and leaves the site to the unchanged chain. The regression test asserts the tier does not bind into the local `tools` module, rather than asserting no edge at all: the lexical tier still resolves the bare tail on its own, and that behaviour is not what this change governs. Asserting an empty edge list would have been testing a different tier. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J5nWP4BFeBSjbQ3uqAjtxV * refactor(rust): reuse the canonical callable predicate and drop dead re-exports (#2741 review) `CALLABLE_TYPES` was a local copy of the set behind `isOverloadableCallable` in `utils/callable-labels.ts`. Two copies of the same set drift: extending the canonical one with a new callable kind would silently leave qualified calls of that kind unresolved here, with nothing to catch it. Use the shared predicate. The trailing `export { moduleOfFile, moduleOfDef }` and `export type { ScopeResolutionIndexes }` were commented as being "for the resolver's unit tests". No test imports them: the only importer of this module anywhere in src or test is `rust/scope-resolver.ts`, which takes just `resolveRustQualifiedFreeCall`. Both functions are already exported from `module-path.ts` (where the new unit tests take them from), and `ScopeResolutionIndexes` is canonically exported from `model/scope-resolution-indexes.ts`. Removed rather than left as surface that implies a contract it does not have. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J5nWP4BFeBSjbQ3uqAjtxV * test(rust): rebaseline the scope-capture fingerprint with the correct prior hash The rebaseline note added with the original fix cited `Prior 655aed01…`, which was two rebaselines stale — it predates both #2604 and #2714. The true pre-PR value on the base commit is `7f1240b3…`. CI could not catch it: the gate compares the live fingerprint against the stored one and never reads the prose, so the audit chain these notes exist to provide was broken with nothing to flag it. The note now carries the correct prior value, and the fingerprint is regenerated for the fixtures this review series added. Scaling 1.061, well inside the 1.5 budget; fixture_count 196; the other 14 languages remain byte-identical. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J5nWP4BFeBSjbQ3uqAjtxV * test: move the schema-version pin to 23 `call-summary-schema-version.test.ts` asserts the exact value of `INCREMENTAL_SCHEMA_VERSION` and enumerates which stamped versions the incremental reuse gate accepts. It moves with every bump by design — that pin is what stops an id- or edge-changing commit shipping without invalidation. Updated for the bump to 23, with the pre-v23 case added to the reuse-gate table: a v22 index predates Rust module-qualified call resolution, so every unchanged Rust file would keep the same-name self-loop and keep reporting the real callee as unreached. Caught by CI rather than locally, because the earlier sweeps in this series covered `test/integration/resolvers/` and `test/unit/scope-resolution/` only — the pin lives outside both. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J5nWP4BFeBSjbQ3uqAjtxV --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-29 13:41:47 +01:00
MyShining	ff86ccf1e7	feat(spring): model profiles, conditions, and auto-configuration (#2678) ... * feat(spring): model conditions and auto-configuration * fix(spring): align auto-configuration declarations * perf(spring): streamline auto-configuration indexing * test(spring): move timing benchmark out of vitest --------- Co-authored-by: Shining <xuenning@qiyi.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>	2026-07-28 07:05:41 +01:00
Gergő Magyar	e307286d52	fix(scope-resolution): a named receiver's member never resolves lexically, + two #2695 follow-ups (#2714) ... * fix(scope-resolution): a named receiver's member never resolves lexically (#2699) `lookupCore` Step 1 walked the lexical scope chain for every lookup, including explicit-receiver property reads. So `options.baseUrl` could bind to an unrelated function-local `const baseUrl` in the same file, and `config.extractVisibility(node)` to the enclosing class's own method. This is the residual half of the defect JS/TS block scopes narrowed in #2695. Blocks moved nested-block locals off the chain of a reference outside the block, which removed 114 false edges; a local declared directly in the function body stayed on it, and no amount of extra scopes reaches that case. Fixed at the cause instead: `recv.name` names a member of whatever `recv` denotes, so a binding of the bare tail name in an enclosing scope is never the right answer. Steps 2 and 3 (receiver type / owner members) are the legitimate routes. `this` and `self` are EXEMPT, and that exemption was measured, not assumed. Skipping Step 1 for every explicit receiver removed 711 edges on a 762-file corpus — but 2 of those were genuine: `self.srcIx` and `self.streamedAt(...)` after `const self = this`, reaching their own class's members through the class-body scope. For a self-receiver the members and the lexical chain legitimately overlap; for a named receiver they never do. Exempting the self names keeps both true edges and still removes 709 false ones, adding none. The removals were classified by reading source at the site, not by pattern- matching ids — an "is the target a member of the source's owner?" heuristic labelled 43 of them plausible and every one I then read was false: language = config.language; -> the class's own `language` dirMap.get(...) / exactMap.get(...) -> a sibling object-literal `get` return config.extractVisibility(n); -> the class's own method (self-edge) writer.close(); -> GraphEmitSink.close Residual, deliberately kept: a `this.x` read can still bind lexically to a same-named local. That is the price of the two true self-alias edges above. `INCREMENTAL_SCHEMA_VERSION` 19 -> 20: a v19 index holds these false CALLS/ACCESSES on every unchanged file and would keep serving them through the reuse gate. Test confirmed discriminating: it fails with the guard reverted. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184RmD24KFJidYqpM7v3XjR * fix(typescript,javascript): a generator expression binding is a Function node (#2693) `const g = function* () {}` matched none of the closure-binding definition rules — they covered `arrow_function` and `function_expression` only — so the binding emitted a `Const` node. `buildGraphTargetIndex` admits callable nodes only, so `g()` resolved to nothing. Same defect shape as the `var` case #2693 already fixed: a different grammar node for the same construct, and the resulting graph node was not callable. Adds the four variable-binding shapes in both languages: `const`/`let` and `var`, each plain and exported. Purely additive — no existing pattern is reordered or rewritten, because the #2687 pre-scan dedup is order-dependent and collapsing the value/callable pair depends on which match wins. Deliberately NOT covered, and the query comment says so: a generator in an object-literal pair or a HOC wrapper still falls through anonymous. Those are rarer, and each additional pattern is another chance to disturb the dedup. `SCHEMA_BUMP` 26 -> 27: definition captures are parse-time, so a warm parse cache would replay the old ones verbatim — `--force` does not clear it. Two tests confirmed discriminating (they fail with the patterns reverted), plus a guard that the already-working generator DECLARATION form is unaffected, since it shares the emit path these were inserted beside. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184RmD24KFJidYqpM7v3XjR * fix(ingestion): keep caller attribution in lockstep with definition ids (#2699) The definition phase appends `localIdentity` to a nested callable's own name segment (`run.save@3:2`); `findEnclosingFunctionId` did not, so the two phases derived different ids for the same callable. The failure mode is silent — the caller id names a node that does not exist, so the edge is dropped rather than reported — which is why the parse-worker docblock calls this pair a lockstep guarantee and asks that both phases derive the prefix from one place. The condition is now byte-identical to the definition phase's (`nestedPrefix !== undefined`), so the two cannot diverge again. Scope of the claim, stated plainly: no reproducing case was found, and this changes nothing measurable on a 762-file TypeScript corpus. TS/JS resolve callers through `resolveCallerGraphId` in the graph bridge, not this path; `findEnclosingFunctionId` serves the `callExtractor` languages, and the corpus does not exercise a nested callable there. The review that raised it (P3) observed zero dangling edges, and "zero dangling" is also what silently dropped edges look like — so this closes a documented contract rather than a demonstrated bug, and carries no test of its own. Rides the `SCHEMA_BUMP` 26 -> 27 in the preceding commit: caller attribution runs in the worker, so a warm parse cache would replay the old ids. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184RmD24KFJidYqpM7v3XjR * docs(test): correct the block-scope header that this PR made false (#2699) Review finding (MEDIUM). The file header still described `lookupCore` Step 1 as walking the lexical chain for EVERY lookup, and called the function-body-local case "unchanged and still mis-resolves ... pre-existing and tracked separately". Commit 59b892ca in this same PR falsified both, and the describe block added ~80 lines lower in this same file asserts the opposite — a reader scoping future work from the header would have concluded the case was still open. Rewritten to state what the code does: Step 1 is skipped for a NAMED explicit receiver, the function-body case is fixed here, and the surviving residual is that a `this`/`self` read can still bind lexically to a same-named local — with the reason those two names are exempt (they keep the genuine `const self = this; self.member` reads that Step 1 resolves correctly). Also corrects a PRE-EXISTING staleness inherited from #2695 in the same paragraph block: "the genuine bare read of that same local must still emit its edge" describes a test that no longer exists, because TypeScript emits no `@reference.read` for bare identifiers at all. Fixed here rather than left adjacent to a freshly corrected sentence. Comments only — `detect_changes` reports 0 changed symbols across 1 file. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184RmD24KFJidYqpM7v3XjR * refactor(ingestion): give the nested-callable id rule one definition (#2699) Review finding (LOW): the lockstep change in this PR shipped without a test. The plan called for a unit test asserting the two id-derivation phases agree. Two things changed that plan during execution, both recorded here. FIRST — there are THREE phases, not two. Re-verifying the plan's assumption (`grep -n localIdentity`) found a third call site: the worker-path node-id derivation in `processFileGroup` (parse-worker.ts:2316), whose own comment already acknowledged the coupling. `impact` on `localIdentity` corroborates: three direct dependents, all in the Workers module. So the invariant three phases must agree on is now ONE function, `nestedCallableQualifiedName`, and divergence requires deleting a call rather than editing a duplicated expression. SECOND — the planned `_forTest` alias seam does not work for this module. `parse-worker.ts` posts a `ready` message to `parentPort` at module scope, so value-importing it from a unit test throws before any test runs; the existing unit tests that reference it use `import type` only, which erases. The rules therefore move to a new pure module, `workers/callable-id.ts`. That is what makes them testable at all, rather than merely commented. Pure refactor — no id changes. Verified by the suites that assert exact node ids (`Function:svc.ts:run.save@7:2`, `Function:c.php:run.$save@3:2`): 74/74 green, and `detect_changes` reports only the three expected symbols and the two `processFileGroup` flows `impact` predicted. The test pins both halves: the rule's contract, and a structural assertion that no site has re-inlined `${prefix}.${localIdentity(...)}` — the unit assertions alone would still pass if a fourth phase spelled the rule out by hand, which is exactly how the divergence arose. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184RmD24KFJidYqpM7v3XjR * fix(scope-resolution): give PHP's `$this` the same self-receiver exemption (#2699) Review finding (LOW). The Step-1 skip added in this PR exempts `this`/`self`, but the receiver name arrives as the reference node's RAW SOURCE TEXT — `extractExplicitReceiver` returns `cap.text` verbatim — so PHP's `$this->x` presents as the string "$this" and matched neither entry. PHP was the one supported language whose self-receiver got no exemption at all. Measured, and the measurement is why this is framed as consistency rather than a bug fix: - Corpus delta ZERO. 762-file TypeScript corpus, CALLS+ACCESSES set diff: 13179 -> 13179, added 0, removed 0. So no INCREMENTAL_SCHEMA_VERSION bump (stays 20), per the plan's decision rule. - No PHP shape found that DISCRIMINATES. Both the simple `$this->prop` / `$this->helper()` shapes and a closure reading `$this->…` inside a method that also declares a same-named local produce byte-identical edge sets with `$this` present and absent — Step 2 resolves the receiver's type first. The added test is therefore labelled a COMPANION INVARIANT, exactly as the `this.baseUrl` case beside it is, and does not claim to prove the fix. It is still worth making: the exemption is protective, and the 709-removed / 0-true-lost measurement that justified the narrow guard was TypeScript-only, so PHP's safety was never established by evidence. This closes that by construction. Two corrections to what the plan assumed, both found by checking: - The plan (and my first draft of this comment) claimed the codebase had no precedent for handling a sigil'd receiver name. FALSE: `THIS_RECEIVERS` in `core/ingestion/type-env.ts:244` has always listed `$this`, and it is the ingestion-side twin of this very list. The precedent does not merely exist, it validates the approach chosen here — list the spelling as data, do not strip sigils. - That twin also lists `Me`. Deliberately NOT mirrored: no entry in `SupportedLanguages` is Visual Basic, so it could only ever exempt a variable that happens to be called `Me`. The two lists are otherwise the same set with nothing enforcing it — a fifth instance of the twin-list drift class this PR keeps meeting. A drift guard is the right fix and is out of scope here; noted for follow-up. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184RmD24KFJidYqpM7v3XjR * fix(rust): resolve `Self` in scope-resolution type bindings (#2699) CI regression, caught by `tests / ubuntu / coverage` on 13d5e738 and traced to the named-receiver Step-1 skip earlier in this PR (59b892ca), not to the three commits above it — verified by reverting those three and reproducing the failure unchanged. `test/integration/resolvers/rust.test.ts > resolves fresh.validate() inside impl User via Self {} inference` failed: 192/192 on main, 191/192 on this branch. The fixture calls `fresh.validate()` where `let fresh = Self { .. }` inside `impl User` — a genuine call to `User::validate`, and a TRUE edge that the skip deleted. Root cause is a twin-channel disagreement, not the skip: - `type-extractors/rust.ts:142` substitutes `Self` -> the enclosing impl type into the TYPE-ENV channel via `findEnclosingImplType`. - `languages/rust/interpret.ts` recorded `@type-binding.type` verbatim, so the SCOPE-RESOLUTION channel bound `fresh: Self` — a type that does not exist, leaving the receiver's type unknown and Step 2 unable to resolve. `main` passed only because Step 1 still walked the lexical chain for named receivers: the impl scope binds `validate` by name, so the call resolved BY ACCIDENT. Stopping that walk turned a latent gap into a lost edge. The fix closes the gap rather than restoring the accident — `Self` is now substituted at capture-emit time in `languages/rust/captures.ts`, where the impl node is reachable, reusing the `findEnclosingImpl` + `syntheticCapture` idiom already in that file. CORRECTION to this PR's central claim. "709 removed / 0 added / 0 true edges lost" was measured on a 762-file TYPESCRIPT corpus and stated without that qualifier. Rust lost one true edge. The measurement stands for TypeScript; it did not generalise, and the PR body is being updated to say so. Scope of the breakage, measured rather than assumed: 1 failure in 2927 tests across all 51 resolver files. Every other language — Go, Java, C#, Kotlin, Swift, Python, PHP, Ruby, Dart, C++ — passes, which is why this is a targeted fix and not a revert of the skip. Re-baselined `bench/scope-capture` for RUST ONLY (655aed01 -> 7f1240b3); the other 14 language fingerprints are byte-identical. The drift is the intended output change and the reason is recorded in the baseline entry, per that file's own "explain, never re-baseline to make CI green" rule. Verified: rust resolvers 192/192; all 51 resolver files 2926 passed / 1 skipped / 0 failed; the 8 targeted suites 96/96; all 8 CI bench gates PASS; `tsc --noEmit` clean; `detect_changes` reports one touched symbol (`emitRustScopeCaptures`) and no affected flows. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184RmD24KFJidYqpM7v3XjR * test(golden): refresh the Rust capture golden and the C# PDG snapshot (#2699) The two committed artifacts CI flagged after 5f55fe46. They drifted for OPPOSITE reasons, so each was inspected before regenerating rather than refreshed on sight. RUST GOLDEN — drifted because 5f55fe46 CORRECTS the output. A `Self` type binding now records the enclosing impl's type instead of the literal `Self`, in both the `let x = Self { .. }` and `fn new() -> Self` forms. Blast radius verified exact: 5 fixtures drifted, all 5 contain `Self`, and every `Self`-bearing rust fixture is among them (rust-self-struct-literal, rust-constructor-type-inference, rust-default-constructor, rust-method-enrichment, rust-scoped-multi-file). C# PDG SNAPSHOT — drifted because the named-receiver Step-1 skip (59b892ca) REMOVED A FALSE EDGE. CALLS 7 -> 6, and the edge that went is: Demo.Resolve.Parse@142:12#1 -> Demo.Resolve.Parse@142:12#1 a self-call, from `int Parse(string v) => int.Parse(v);`. `int.Parse(v)` is System.Int32.Parse; the lexical chain was binding it to the enclosing local function that happens to also be called `Parse`. Same defect class as `writer.close()` -> GraphEmitSink.close. The snapshot's own comment says it exists so "a future refactor that silently rewires the C-family graph trips this gate" — it tripped correctly, and the rewiring is an improvement. Both failures were PRE-EXISTING on this PR from 59b892ca, not from the three commits above it — verified by reverting those and reproducing unchanged. They went unseen because this PR's CI was never watched after its first push. Verified after regeneration, WITHOUT update flags so they must genuinely pass: rust-captures-golden 9/9; pipeline-pdg 31/31. The snapshot diff is 3 lines, all inside the C# entry — no other language's snapshot moved. `detect_changes` reports 0 changed symbols (test artifacts only). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184RmD24KFJidYqpM7v3XjR --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-27 17:56:38 +01:00
Gergő Magyar	4906daf27b	fix(scope-resolution): resolve calls through a closure-valued binding across languages (#2693) (#2695) ... * fix(scope-resolution): resolve calls through a closure-valued binding (#2693) `val f = { }; f()` emitted no CALLS edge in Kotlin or Swift, so `impact` on such a symbol under-reported to zero — the same false all-clear as #2687. The cause was not, as first suspected, that these languages fail to feed `callable-value-flow`. They do: `synthesizeCallableFlowCaptures` is called from 15 language capture modules, and Kotlin already resolves reassignment through the pass (`var f = ::a; if (c) f = ::b; f(1)` reaches both targets). Their captures are already exactly right — the seed names the binding as its own callable, per the anonymous-callable convention in callable-flow-captures.ts. They died one layer later, at the `buildGraphTargetIndex` gate: if (!isCallable(def) && providerTarget?.(def) !== true) continue; `isCallable` is Function/Method/Constructor, but the scope-resolution layer declares a closure binding with its VALUE label (Kotlin/Swift `Property`), and `isCallableValueTarget` is implemented by exactly one provider — COBOL. So the binding never entered `graphTargets`; `lexicalCallableLookup` then returned `shadowed: true` with no targets, which also suppressed the workspace-wide fallback, and the seed resolved to nothing. Only the graph knows a value binding holds a callable — since #2687 it emits a single `Function` node for one. So value bindings now resolve their graph id first and are admitted on the label of the node they actually reach. This is self-limiting: a genuine constant keeps its own Const/Property node, so `resolveDefGraphId`'s qualified key hits before the label-agnostic `simpleKey` fallback can reach a same-named callable. Only a binding whose own value node was replaced by a callable one gets through. No scope kind changes — Kotlin's `lambda_literal` stays `@scope.block`, so #1757 smart-cast semantics are untouched by construction. The fix is language-neutral: it discriminates on the graph node label, never on a language name. Dart is fixed separately; its root cause is independent. * fix(dart): resolve calls through a closure-valued binding (#2693) Dart needed more than the shared gate fix: neither of its closure-binding forms could resolve, for two different reasons, and the plan's one-line diagnosis turned out to be incomplete. TOP-LEVEL `var f = (x) => x;` A graph Function node already existed (#2687), but no `@declaration.*` matched the binding, so scope resolution had no SymbolDefinition to attach a flow seed to. Adding the declaration exposed a second problem: Dart's `initialized_identifier` is FIELDLESS, so the shared field-based assignment fallback (`left`/`name`/`value`/…) decomposed nothing and the binding still emitted no flow captures at all. Kotlin's fieldless `assignment` node hit exactly this and took the same remedy — a provider `extractAssignment`. FUNCTION-LOCAL `void m() { var f = (x) => x; }` Locals parse as `initialized_variable_definition`, which the top-level graph-node rules are deliberately anchored under (program) to avoid, so a local closure had no graph node at all — nothing for the widened `buildGraphTargetIndex` gate to admit. Both new rules are restricted to a `function_expression` value. Declaring every Dart variable would mint defs and nodes repo-wide for no resolution benefit; ordinary locals stay unindexed exactly as before. The top-level declaration reuses the (program) anchor the graph-node query already relies on, so class-body fields — which share `initialized_identifier_list` and are already `@declaration.property` — are never matched twice. Also drops the now-false note in tree-sitter-queries.ts claiming `f()` does not resolve for Dart. That node is now the evidence that makes it resolve. * docs(scope-resolution): document the callable-flow capture contract (#2693) The module is 1200+ lines behind a nine-line docblock, and the only worked example was C. Both root causes fixed in this series were "the contract was discoverable only by reading the emitter": - the anonymous-callable convention (a seed whose source is a closure takes its DESTINATION's name) is what makes closure bindings resolvable at all, and is the reason the widened target gate is correct; - a fieldless binding node silently decomposes to nothing under the shared assignment fallback, which cost Kotlin one debugging cycle in #2522 and Dart another here; - captures alone are never enough — the bound name also needs a `@declaration.*` or there is no cell to key the seed on. Records the cell/site model, both traps, and points at the fullest and smallest worked examples. Bumps INCREMENTAL_SCHEMA_VERSION 15 → 16 and the parse-cache SCHEMA_BUMP 22 → 23: this series emits NEW CALLS edges and new Dart Function nodes, and the incremental write set only covers changed files, so an existing index would keep reporting a zero blast radius for exactly the symbols the fix is about. * perf(scope-resolution): pre-filter value bindings in the callable target index (#2693) Widening the `buildGraphTargetIndex` gate to consider VALUE bindings put the hot loop on a much larger def population — value bindings outnumber callables in real source — and the naive version paid full price per binding. Measured on a synthetic 800-file corpus (8 value bindings per file, 1 of them a closure binding), the widening cost 2.50-2.82x the pre-#2693 callable-only build. Two wastes, both provable rather than guessed: 1. `definitionAnchorKey` ran for every def, including value bindings. The anchor index is keyed by callable LABEL and the key is built from `def.type`, so a value def can never hit it — and the key costs a regex per def. 2. Every value binding paid the whole `resolveDefGraphId` key chain only to be rejected. It need not: every qualified key that function tries embeds `def.type`, so for a VALUE def those can only ever reach a value-labelled node. Its one route to a callable is the label-agnostic `simpleKey(filePath, simpleName)` fallback, which by construction requires a callable node with the SAME file and simple name. So a value binding with no such node cannot resolve to a callable, and one Set lookup decides it. That set is derived in the graph walk the anchor index already performs, so it costs no extra pass. large_ms 7.79-8.37 -> 4.90-5.02 (1.61x faster) widening_overhead 2.50-2.82 -> 1.45-1.50 The resolved target-set fingerprint is byte-identical across both, which is the point: this is a cost change, not a behaviour change. Adds bench/callable-value-flow/ (fingerprint + scaling + widening-overhead gates) and wires it into ci-tests.yml beside the other build-free benches. The overhead budget of 1.9 sits between the measured with-filter and without-filter bands, so it cannot be met if the pre-filter is removed. Timings use the MIN of 15 warmed reps, not the median: the same build reported 1.65 idle and 2.03 under load, and a median-based gate would have to be loosened past the point of detecting the regression it exists to catch. `buildGraphTargetIndex` is exported for the bench; it is pure and not part of the pass's public contract. * test(scope-resolution): assert the declaration route does not double-emit (#2693) Go, Python, C++ and TS/JS already resolved a closure-binding call through their `@declaration.function` capture. The widened `buildGraphTargetIndex` gate gives the same call a SECOND possible route, so each must still produce exactly one edge. `tryEmitEdge` dedups by key, but a collapsed key and a site-anchored key are DIFFERENT keys — a real double-emit would show up as two ids for one call site, not be silently collapsed. Asserting on edge ids rather than target ids is what makes that visible. * fix(scope-resolution): join value bindings to their callable node by POSITION (#2693) Review found the first cut of this series minted FALSE CALLS edges. Admitting a value binding whose *resolved* graph node is callable let `resolveDefGraphId` fall through to its label-agnostic, first-write-wins `simpleKey(filePath, simpleName)` and bind the name to ANY same-named callable in the file. The safety argument in the previous commit — "a genuine constant keeps its own Const/Property node, so the qualified key hits first" — silently assumed `def.type === node.label`. It does not hold: - TypeScript declares `const` as `Variable` but emits a `Const` NODE, so the qualified key misses even though the value node exists; - Rust `let` bindings get no graph node at all, so the fallback is the only route. Reproduced, all previously emitting a fabricated caller: const save = (x: number) => x * 2; // next to an unrelated Svc.save -> Method:svc.ts:Svc.save#1 // Svc never instantiated const handler = other; // shadowing a top-level handler -> Function:app.ts:handler // unreachable from here let handler = cb; // Rust -> Function:main.rs:handler Worse in Dart, where the same collision INVERTED the feature: the only edge went to the class method and the closure's own node got none. The result was also declaration-order dependent — two files differing only in declaration order got different CALLS sets — and it propagated through argument-to-formal binding into functions whose source never mentions the name. A closure binding IS its callable node: same file, same line, same name. An aliasing local is not. So the join is positional now — a file/line/name index built in the graph walk `byAnchor` already performs — and value bindings never run the key chain at all. That is both correct and cheaper: large_ms 4.90-5.02 -> 4.37-4.63 widening_overhead 1.45-1.50 -> 1.43-1.58 (name-match design: 2.50-2.82) with a byte-identical target-set fingerprint on the bench corpus. Also from review: - `Static` dropped from VALUE_BINDING_DEF_TYPES: `normalizeNodeLabel` has no `static` case, so no def can carry that type — it was an entry no fixture could ever exercise. The remaining set now documents why it deliberately does NOT reuse `isOwnableValueLabel`, which is contracted to a different consumer. - Dart `final`/`const` top-level closures (static_final_declaration_list) and every declarator after the first in a multi-name local now resolve; both parse into shapes the earlier rules never reached. - The bench source carried a literal NUL byte, so git recorded it as BINARY and the only artifact pinning the target set was unreviewable in the PR diff. It is written as an escape now. Its corpus also modelled `startLine` as 1-based where graph nodes are 0-based, which would have stopped it exercising the value-binding path at all. - `call-summary-schema-version.test.ts` asserted `passesReuseGate(15)` is true; the 15 to 16 bump made that false and the test RED. It now pins 16 as current and 15 as rejected, matching the pattern every prior bump followed. - The v23 parse-cache comment is at the top of the list, not mid-list. Tests: the five collision cases above are new regression tests, each confirmed failing against the previous commit. Also added Kotlin class-body closures (the only case exercising the Method arm), Dart top-level `final`, Dart multi-name locals, and a warm-parse-cache replay for Kotlin and Dart — the #2693 captures are replayed verbatim, so a serialization change would surface only on a SECOND analyze and every other test here runs cold. The previous negative tests were vacuous: they paired names that did not collide (`maxSize` vs `size`), so the pre-filter rejected them before the guard they were named after could run. * docs(storage): fix the schema-version changelog blocks (#2693) Two problems, one mine and one not. MINE: the `INCREMENTAL_SCHEMA_VERSION` block is ASCENDING (v2 … v15), and I inserted v16 above v15 rather than at the end — I had just moved the parse-cache entry to the top of ITS block, which is descending, and applied the same habit to a list ordered the other way. Moved to the end; both blocks are now internally consistent. NOT MINE: the parse-cache block carries TWO v21 entries, with v20 wedged between them. Tracing it: #2632 (Spring DI facts) bumped 20 -> 21 and merged first; #2653 (Java JLS local-class identities) had branched at 20, also bumped to 21, and merged second — so it shipped with NO invalidation of its own. An index already stamped 21 by the first change was treated as current by the second and kept serving stale local-class identities from the warm cache. Numbers left alone: both genuinely shipped as 21, and renumbering them now would misstate what users' indexes actually contain. Instead the entry says so explicitly, and points at the process fix — re-check the constant against origin/main immediately before merging, not just when the branch is cut. The identical collision hit INCREMENTAL_SCHEMA_VERSION in #2653/#2654, so this is a recurring failure mode of concurrent PRs, not a one-off typo. Comment-only; no constant changes value. * feat(scope-resolution): resolve closure bindings in Ruby, Java, C#, PHP and JS/TS var (#2693) Ruby, Java, C# and PHP already emitted correct callable-flow seeds and invokes. What they lacked was the #2687 piece — a CALLABLE graph node at the binding, which is what buildGraphTargetIndex joins to by position. PHP additionally had no scope declaration for the bound name, so the flow pass had nothing to attach its seed to. ruby handler = ->(x) { x } handler.call(1) -> Function:a.rb:handler java Function<..> handler = x->x handler.apply(1) -> Function:A.java:A.handler csharp Func<int,int> handler = ... handler(1) -> Function:A.cs:A.handler php $handler = fn($x) => $x $handler(1) -> Function:a.php:handler Ruby and Java invoke through the callable-object protocol; C# and PHP call the binding directly. Locals work in all four, and a binding whose name collides with a same-named method resolves to the CLOSURE, not the method. Two things the sweep caught: JAVA TWIN. Anchoring the rule on the inner variable_declarator produced BOTH a Function and a Property node — the exact double-indexing #2687 removed. The parse-worker dedup keys on (definition node, name), and Java's value rule anchors on field_declaration, so the keys never matched. Re-anchored on field_declaration / local_variable_declaration. JS/TS `var`. `var f = (x) => x` kept a Variable label while const/let got Function, because `var` is a different grammar node (variable_declaration vs lexical_declaration) that no closure rule covered. A call through the binding still resolved via the declaration route, so the CALLS edge pointed at a NON-callable node. Now consistent across const/let/var. That last one flipped an existing assertion in const-function-twin.test.ts, which expected `Variable` for a var-bound function-expression. Its comment explained why — "var has no matching @definition.function pattern, so nothing claims the name" — i.e. it documented the gap rather than defending it. The property it was really protecting (an UNCLAIMED value node survives) now has its own case with a non-function initializer, and the var-closure case asserts the collapse to one node, which is also the twin guard for the new rule. Known limits, both pre-existing and both failing safe: - A PHP local closure whose name collides with a top-level function gets no edge: both want id Function:<file>:<name>, so the closure never gets its own node. This is the file-scoped node-identity convention — TypeScript, Python and Dart collapse identically at base. - TS/JS class-field arrows stay Property (Kotlin's equivalent emits Method). They already resolve; changing the label risks the HAS_PROPERTY ownership regression #2687 hit once. The invalidation constants already bumped in this PR (INCREMENTAL_SCHEMA_VERSION 16, SCHEMA_BUMP 23) cover these additional languages; their notes now say so. Tests: one case per newly-resolving language plus the PHP anonymous-function form and the JS var form, in closure-binding-labels.test.ts. The file now spins a worker pool per test across a dozen languages, so its timeout is raised file-wide — a case that takes ~7s alone was exceeding the 30s default under that contention. * fix(ingestion): class-field closures are callable members in TS/JS (#2693) A CALLS edge must target a callable node. `class A { handler = (x) => x }` emitted a Property, so calling it produced `CALLS -> Property:A.ts:A.handler` — an edge pointing at something the graph says is not callable. Same defect class as the JS/TS `var` binding fixed in the previous commit, and the last place a closure binding still carried a value label. Kotlin already models its class-body closure as Method + HAS_METHOD; TS/JS now match, so all three agree: class-field closure -> Method + HAS_METHOD (CALLS target is callable) plain class field -> Property + HAS_PROPERTY (unchanged, no CALLS) Anchored on public_field_definition / field_definition — the same nodes the property rules use — so the parse-worker dedup collapses the pair rather than leaving a Method/Property twin, the failure the Java rule hit in the previous commit. ON MATCHING THE COMPILERS. This deliberately diverges from tsc and SCIP. The TypeScript compiler classes `handler = () => {}` as a PropertyDeclaration ("a property declaration independently from what it's assigned to"), and SCIP gives it a `.` term descriptor, the same suffix as any field — both call it a property, and Kotlin's compiler likewise treats `val f = { }` as a property with a function type. The divergence is intentional: GitNexus's Function/Method label does not mean "tsc SymbolFlags", it means "this node can be the target of a CALLS edge", which is the convention #2687 set for closure bindings in every language. Modelling it the compiler's way would mean either dropping call resolution for these members or emitting a separate node for the lambda and flowing the property to it — the two-node shape #2687 removed. Recorded here so the next reader does not "fix" it back. Tests: TS and JS class-field arrows resolve to their Method node, plus a guard that a NON-closure class field stays a Property — the closure rule must key on the initializer, not on the field syntax. * fix(php): keep the $ sigil on closure-binding nodes so locals stop colliding (#2693) A PHP local closure whose name matched a file-level function got NO edge at all: function save($x) { return $x; } function run() { $save = fn($x) => $x * 2; return $save(1); // no CALLS edge } Both minted the id Function:<file>:save, so the closure's node was swallowed by the function's and the positional join found nothing at the binding's line. The fix is PHP's own semantics rather than a change to node identity across the graph. PHP holds variables and functions in SEPARATE namespaces — $save and save() cannot collide in the language — and the sigil is what separates them. Dropping it was the bug. The node rule now captures the whole variable_name, so the closure is Function:<file>:$save and the function stays Function:<file>:save. languages/php/query.ts already keeps the sigil on property declarations for the same reason, so this makes the two consistent. The positional join normalises a leading $/@ on both sides, matching what the scope layer and the callable-flow synthesizer already do, so the binding still matches its own declaration while its NODE stays distinct. local closure + same-named function -> Function:c.php:$save (the closure) calling the real function -> Function:f.php:save (unchanged) plain $max = 10 -> no node, no edge (unchanged) WHAT THIS DOES NOT FIX. The general problem is wider than PHP: GitNexus node ids are file-scoped, so a function-local symbol and a file-level one with the same name collapse in TypeScript, Python and Dart too, and Java/C# only escape by qualifying on the enclosing CLASS (so two same-named locals in different methods still collide). SCIP solves it with a separate `local <id>` keyspace that is document-scoped and never globally addressable. That is issue #2699 — it changes persisted ids for every function-local symbol and needs its own invalidation, so it is not bundled here. PHP is fixed on its own merits: the sigil belongs in the identity regardless of how locals are eventually scoped. * test(scope-resolution): pin the closure-binding caller-attribution limit (#2693) Review of this PR found the new callable nodes are call TARGETS but never call SOURCES: a call made INSIDE a closure binding is attributed to the enclosing scope, so `impact(handler, direction:"downstream")` reports nothing even though the closure calls out. Consistent across Kotlin, Dart, Ruby and PHP; TS/JS free bindings are the exception because their arrow carries a @scope.function whose range matches. Not fixed here — pinned, so the boundary is visible instead of surprising, and so a change in EITHER direction fails a test. The cause is precise: `pickCallerCallableDef` (graph-bridge/ids.ts) finds the caller by walking CHILD scopes whose range contains the call site, gated on `child.kind === 'Function'`. A closure literal is a BLOCK scope in these languages (Kotlin deliberately, #1757 smart casts), AND the binding's def is owned by the enclosing scope rather than by the closure's scope — so neither half of the link exists. Fixing it needs "callable boundary" decoupled from scope `kind` plus an association between the closure scope and its binding. That is a change to the caller anchor used by every call in the repo, which is not something to land at the tail of this PR. Also adds a unit suite for `buildGraphTargetIndex` itself, covering what the integration tier cannot isolate: a binding is admitted only on POSITIONAL evidence, a name-only match is rejected, a non-callable node at that position is rejected, an ambiguous position claimed by two callables is rejected, and the PHP dollar sigil normalises across the join while still not matching a same-named function on another line. That last one closes the review's LOW — the node/declaration name asymmetry now has an executable contract rather than resting on a comment. * docs(test): correct the per-language cause of the attribution limit (#2693) The comment on the pinned attribution tests claimed "a closure literal is a BLOCK scope in these languages". That is true for Kotlin (lambda_literal @scope.block, #1757) and Ruby (do_block/block @scope.block) and FALSE for PHP: anonymous_function and arrow_function are already @scope.function (php/query.ts:61-62). Dart is a third case again — it has no scope over a closure literal at all. So the four languages fail at three different points, not one: Kotlin, Ruby fail the `child.kind === 'Function'` gate PHP passes that gate; its closure scope owns no callable def, because the binding's def belongs to the enclosing scope Dart has no child scope for the walk to consider Worth correcting carefully rather than tidying: a follow-up plan re-stated this comment instead of re-deriving it, and inherited the misdiagnosis — it proposed "relax the kind gate" as required for all four, which is a no-op for PHP and unreachable for Dart. A review caught it. The comment now states each language's actual blocker and says why the distinction matters. Comment-only; the three pinned tests are unchanged and still pass. * fix(scope-resolution): an ordinary JS/TS `function` binds its own `this` (#2701) `this.m()` inside a nested `function` resolved to the lexically enclosing class, so it emitted a CALLS edge that does not exist at runtime — including the exact `forEach(function () { this.m(); })` shape arrow functions were introduced to avoid: class D { m() {} build() { const h = function () { this.m(); }; return h; } } // CALLS: Function:D.ts:D.h -> Method:D.ts:D.m#0 FALSE ECMA-262 gives an arrow `[[ThisMode]] = lexical`: it has no `this` binding in its environment record, so the lookup passes through to the enclosing environment. Every other function form binds `this` at call time. `tsc` draws the same line by resolving `this` through `getThisContainer` with `includeArrowFunctions = false`. That one rule is the whole fix. Languages declare it; shared code never learns a language. The query files — the one place that already names grammar nodes — tag every non-arrow function form with `@receiver-owner.this`, which becomes `Scope.ownsReceivers`. A receiver walk that reaches such a scope without finding the name stops there instead of borrowing an enclosing scope's binding. Every other language leaves the field unset and is bit-for-bit unchanged; a Kotlin lambda, which DOES capture the enclosing `this`, still resolves (pinned as a test). THREE GATES, ALL LOAD-BEARING. The false edge survived each one alone, which is why the tests assert on the emitted edge rather than any single walk: 1. `Scope.ownsReceivers` stops BOTH receiver-type walks — `findReceiver TypeBinding` here and its twin `lookupReceiverType` in gitnexus-shared's `lookup-core`, which was resolving the receiver independently. 2. `LanguageTypeConfig.thisBoundaryNodeTypes` stops the type-env AST walk that infers a receiver's type during capture. 3. `isReceiverOwnedButUnbound` makes `receiver-bound-calls` SUPPRESS the site. Without it the member still resolved by NAME through `lookupCore`'s lexical chain — the class-body scope binds `m` two scopes up — merely at lower confidence. An owned-but-unbound receiver is a definitive negative, not a miss, so it must not reach a receiver-blind fallback. Also fixed: `function*(){}` as an expression was not a `@scope.function` at all, so `this` inside one read as the enclosing method's. WHAT THIS GIVES UP. The fix REMOVES edges, and some were correct: `.bind(this)`, `.call(this)` and `forEach(fn, thisArg)` do make `this` the instance at runtime. Their correctness is fixed at the CALL SITE, which no scope-level rule can see, so the choice is between losing them and keeping every detached-callback false positive. All three are pinned as tests asserting the empty result, so changing the trade later is deliberate. `this` in a static method also stops resolving to the INSTANCE member — that edge was wrong in the other direction. INVALIDATION. Both constants move, and the parse-cache one is not optional: `ownsReceivers` lives on the cached `Scope`, and a warm cache replays scopes without it — verified by probe that `--force` alone does NOT re-derive it, so the fix silently did nothing until SCHEMA_BUMP moved. INCREMENTAL_SCHEMA_ VERSION 16 -> 17 (the incremental write set covers only changed files, so unchanged TS/JS files would keep their fabricated `this` edges); SCHEMA_BUMP 23 -> 24. Verified against a built index, not by reading: all three false edges from the issue gone, every correct edge kept, same result in JavaScript through its separate grammar. 64 tests green across the new suite plus the closure-binding and schema-version suites. The full suite's 36 failures are pre-existing load-flakes — confirmed by A/B: `skip-git-cli` fails FOUR tests on a clean HEAD versus three with this change, and `pipeline-pdg-streaming` passes in isolation either way. Refs #2701 * fix(ingestion): give function-local callables their own identity (#2699) Graph node ids were file-scoped, so a local callable and a same-named file-level one collapsed onto ONE node. That is a wrong answer, not a missing one — the local call was attributed to the file-level symbol: export function save(x) { return x; } export function run() { const save = x => x * 2; return save(1); } export function other() { const save = x => x * 3; return save(2); } // ONE node Function:a.ts:save, and BOTH run and other pointed at it, so // `impact` on the top-level save reported two callers that never call it. A local's identity is now its enclosing-callable chain plus its own position — `run.save@2:2`. The chain is for humans reading `impact`; the position is what makes it correct. Names alone cannot express what ECMAScript actually specifies, and the gap is the language's, not the grammar's: an environment record is created per function AND per block, so an anonymous function has no name to contribute and sibling blocks hold distinct bindings under the same name. One positional rule settles both, with no conditionals and no "disambiguate only when it looks ambiguous" heuristic — the ambiguity-flag class of bug that bit #2514. SCIP reaches the same place with its document-scoped `local <id>` keyspace. Top-level functions and class methods are NOT locals and keep their ids byte-for-byte. That is the bound on the churn: this touches only symbols that are unreachable from outside their own document anyway. RESOLUTION JOINS BY POSITION, NOT BY NAME. `resolveDefGraphId` matches a def to its node on (file, label, line, simple name). A def and its node are the same construct, so this needs no scope chain at all — which is the point: re-deriving the chain in the resolver would be a second implementation that could silently disagree with the first. A genuine tie (two callables on one line) stores an AMBIGUOUS_POSITION tombstone and falls through to the existing name keys rather than picking by source order. Without this the node ids were already correct and calls STILL resolved to the file-level symbol — the fix is only half a fix without it. JS/TS GAIN BLOCK SCOPES. They emitted no `@scope.block` at all, so the resolver could not tell two `const pick` in sibling branches apart. Giving them distinct ids made that visible as DUPLICATE edges — each call resolving to BOTH — which is worse than the collapse it replaced. `(statement_block) @scope.block` supplies the missing environment record. The other half of the ECMAScript rule was already implemented and waiting: `tsBindingScopeFor` hoists `var` past blocks to the enclosing Function/Module while `let`/`const` bind innermost, and its docblock already claimed "the innermost default covers these" for block scopes that did not exist. All 82 scope-resolution test files pass with blocks on. Verified by probe, per case: two locals in different functions, a local inside an ANONYMOUS function (`outer.fn@1:9.save@2:4`), sibling blocks resolving to their own binding, `var` still hoisting out of its block, a nested named `function` vs a file-level one, PHP composing with the `$` sigil from #2693, and Python. Top-level/method ids unchanged, asserted directly. Every assertion is on the EDGE, not on node existence. Ids are built twice and independently — definition phase and caller attribution — and a one-character disagreement makes the caller attach to a node that does not exist and the edge vanish, with nothing thrown and no test failing. An edge assertion can only pass if both phases agree. INVALIDATION. INCREMENTAL_SCHEMA_VERSION 17 -> 18 and SCHEMA_BUMP 24 -> 25: persisted node ids change for every function-local callable, and the cached scope tree lacks block scopes. A top-up would leave unchanged files on the old ids while changed files emit the new ones, splitting each symbol in two. Bench fingerprint unchanged and both timing budgets pass. The one full-suite failure (incremental-orchestration) passes in isolation — its log shows stale init locks and WAL reclaim, i.e. LadybugDB contention under the parallel run. Refs #2699 * perf(ingestion): emit block scopes only where they bind something (#2699) Block scopes make `let`/`const` in sibling blocks distinct bindings, which is what stopped a call in one branch resolving to both. Emitted naively — one scope per `statement_block` — they also cost ~10% of analyze wall time, because every scope-chain walk in every function then steps through levels that bind nothing. Two emit-side filters keep the semantics and drop the waste: 1. A block that IS a function body duplicates the enclosing Function scope. Nothing can be declared between a function and its own body, so a binding in either resolves identically — the inner scope is pure depth. 2. A block that declares no `let`/`const`/`class`/`function` binds nothing, so it is transparent: a lookup finds nothing in it and walks to the parent. `var` is deliberately excluded from that list — it hoists past the block to the function, so a block containing only `var` still binds nothing. MEASURED, on a 762-file / 228k-line TypeScript corpus (gitnexus/src), min of 6 warmed reps with the cold first rep discarded: block scopes emitted 19,389 -> 5,331 (-72%) total scopes 35,942 -> 21,884 (-39%) analyze wall time +9.8% -> +1.6-2.5% vs pre-#2699 peak RSS (whole tree) 2398MB -> 2434MB (+1.5%, inside run-to-run noise) The filters themselves are free: scope emission over the same corpus measured 12.6s naive vs 12.5s filtered. Wall-clock on a shared runner has a ±10% spread run to run, which is wider than the effect being optimised, so the durable gate added here counts scopes instead. `bench/scope-emission/measure.mjs --check` asserts an EXACT scope set over a synthetic corpus that mixes the shapes the filters discriminate between — function/method/arrow bodies, non-declaring if/else/for/while/try, blocks that declare `const`, and a `var`-only block. Baseline is 2 block scopes per module: only the two `if`/`else` branches that declare `const chosen`. If the filters regress that number jumps immediately, in a way wall-clock CI could never resolve from noise. Wired into the existing benchmarks job. Behaviour is unchanged: 86 scope-resolution and identity test files, 1371 tests, all green — including the sibling-block case this could plausibly have broken — and the callable-value-flow fingerprint is untouched. Refs #2699 * test(bench): re-baseline the TS/JS scope-capture fingerprints for #2701 `bench/scope-capture` fingerprints the full capture set per language, and #2701 added a `@receiver-owner.this` marker to every non-arrow function form so a scope that BINDS its own `this` can terminate the receiver walk. That is a capture-set change, so the TypeScript and JavaScript fingerprints moved and the benchmarks job has been failing since that commit — I pushed it without checking CI. A fingerprint is a correctness gate, so this does not simply adopt the new value. Verified first by diffing the capture-name HISTOGRAM over the same fixture corpus against 1d308817 (the commit before #2701), which says what a fingerprint cannot: WHICH names moved. typescript @receiver-owner.this 0 -> 143 javascript @receiver-owner.this 0 -> 32 Nothing else. Every other capture count is byte-identical, so no existing capture shifted and the drift is entirely the intended marker. Both languages' scaling ratios stay well inside their 1.5 budgets (0.976 / 1.025). Note `@scope.block` does not appear in the delta: the #2699 filters suppress a block that is a function body or that declares no binding, and no fixture in this corpus has a block that binds. Block-scope emission is guarded separately by `bench/scope-emission`, whose synthetic corpus exercises exactly those shapes. Refs #2701 * fix(ingestion): stop the callable-prefix walk at class bodies, not only declarations (#2699) An anonymous class owns its members, but `CLASS_CONTAINER_TYPES` lists only class DECLARATION nodes — and a Java anonymous class has none. It is object_creation_expression > class_body > method_declaration so `enclosingCallablePrefix` sailed straight through the anonymous body, reached the enclosing method, and re-keyed the member as a function-local of that method: Method:src/Worker.java:Worker$1.run#0 -> Method:src/Worker.java:Worker.makeHandler.run@7:12#0 That destroys the javac-compatible JLS identity #2550/#2555/#2562 exist to provide, and broke four existing Java tests that this PR never touched — anonymous-class instance identity, local-type identity, and enum-constant-body chaining. The design was right; the boundary was blind. `CALLABLE_PREFIX_BOUNDARY_TYPES` adds the body and anonymous-construction forms (`class_body`, `interface_body`, `annotation_type_body`, `enum_body`, `enum_body_declarations`, `enum_constant`, `object_creation_expression`, `object_literal`, `anonymous_object_creation_expression`). Over-inclusion is the SAFE direction here: an extra boundary only suppresses the nesting prefix, falling back to the pre-#2699 class qualification. This also falsifies the claim in the #2699 commit that "top-level functions and class methods keep their ids byte-for-byte" — an anonymous-class method IS a class method, and its id did change. The claim was true only for the shapes that were tested. Also removes the dead `NO_QUALIFIED_NAME` constant, which contained a literal NUL byte. That byte made `file(1)` report the source as `data` and made plain `grep` return zero matches for ANY pattern in the whole 2,928-line file — which is why several greps during development came back mysteriously empty. Two other files carry NULs; they are pre-existing and out of scope here. INVALIDATION. INCREMENTAL_SCHEMA_VERSION 18 -> 19 and SCHEMA_BUMP 25 -> 26. This is not defensive: an index stamped v18 holds the WRONG Java ids, and without the bump it passes the `=== INCREMENTAL_SCHEMA_VERSION` reuse gate and keeps them on every unchanged file. Found by the PR #2695 tri-review (review 4782134453) — independently by a Claude adversarial AST probe, by Codex's swarm, and by CI (`tests / ubuntu / coverage 2/3`). Verified: `resolvers/java.test.ts` 247/247 (was 243/247), plus this-boundary, function-local-identity and the schema-version suites. Refs #2699 * fix(scope-resolution): fail closed when a function-local shadows a same-named callable (#2699) The #2699 positional join failed OPEN. On a position miss `resolveDefGraphId` fell through to the label-agnostic, first-write-wins `simpleKey(filePath, simpleName)`, which aliases a def onto whichever same-named callable was registered first — the exact fabricated-caller mechanism this PR's own #2693 work already shipped once as a P0. It misses because the two id phases anchor on different nodes BY DESIGN: `tree-sitter-queries.ts` anchors the graph node on the outer `lexical_declaration`, while `languages/typescript/query.ts` anchors the scope def on the inner `arrow_function` so `anchor.range` lines up with `@scope.function` for auto-hoist. Split the declaration across lines and those land on different LINES: export function run() { const pick = (x) => x * 2; return pick(1); } export function other() { const pick = (x) => x * 3; return pick(2); } before: run -> run.pick@1:2 correct other -> other.pick@6:2 correct other -> run.pick@1:2 FABRICATED — other() never calls run's pick Every fixture in function-local-identity.test.ts kept the declaration and its initializer on ONE line, where the anchors coincide. That is why the suite stayed green while the bug shipped, and the new test deliberately splits them. WHY NOT A BLANKET FAIL-CLOSED. A position miss is not always a collision: it also happens where the anchors legitimately differ, e.g. a Vue SFC, whose graph nodes carry `+ lineOffset` while scope extraction does not. Failing closed on every miss would delete correct edges there. So the guard is keyed on evidence that the collision is REAL — `localNameKey` records that a function-local of this simple name exists in the file (local-identity nodes are recognisable by the `@<row>:<col>` on their last name segment). Only then is a miss treated as ambiguity. Files with no such local keep their previous fallback behaviour byte-for-byte. A missing edge is the correct failure direction here: `impact` can recover from an absent caller, but a fabricated one silently corrupts the answer. WHY NOT UNIFY THE ANCHORS. Considered and rejected: the split is deliberate and load-bearing for auto-hoist across every language (the `rangesEqual(anchor.range, innermost.range)` rule), so unifying it would fight that discipline far outside this fix. The regression test was verified to DISCRIMINATE: with the guard disabled it fails on exactly the fabricated edge (`+ "Function:m.ts:other -> Function:m.ts:run.pick@1:2"`). impact(resolveDefGraphId, upstream) is CRITICAL — 62 impacted, 23 direct, 6 flows — which is precisely why the guard is gated rather than broad. detect_changes: HIGH, 8 affected processes, all in EmitReceiverBoundCalls / EmitRubyMixinEdges. Verified: 85 test files / 1364 tests green, including every scope-resolution unit. Found by the PR #2695 tri-review (review 4782134453): raised by Codex's adversarial leg, mechanism source-confirmed during synthesis, then reproduced end-to-end. Refs #2699 * fix(typescript): stop the enclosing-type walk at nodes that rebind `this` (#2701) `findEnclosingType` walked `node.parent` to the top of the file with no boundary, so it happily synthesized a `this` binding from a type that does not own the member: class A { outer() { const o = { inner() { return this.x; } }; return o; } } `this` inside `o.inner` is `o`, never `A` — but the walk reached `A` and bound to it, so every `this.…` in such a method resolved against the wrong type. Only the module-level object literal escaped, because there was no enclosing class to reach. Applies to JavaScript too: `languages/javascript/captures.ts` calls the same function. Boundary set: object literals and the function forms that rebind `this` at call time. Arrows are deliberately absent — they inherit `this` lexically, which is what makes a class-field arrow `m = () => this.x` resolve. WHY THE MARKER WAS NOT ALSO REMOVED FROM METHOD FORMS. The review argued `@receiver-owner.this` over-suppresses: `synthesizeTsReceiverBinding` returns null for static members, object-literal methods and anonymous class expressions, so those scopes are "owned but unbound" and get suppressed, losing edges the base resolved. Removing the marker from the method forms was tried and MEASURED, and the result does not support shipping it: marker removed, probe of all five shapes: static -> static RESTORED (true) object literal (module) RESTORED (true) anonymous class expression RESTORED (true) static -> INSTANCE FALSE EDGE returned object literal in a class FALSE EDGE (Nested.outer.inner -> Nested.x) The last one is the point: this fix stops the false *synthesis*, but removing the marker re-enables receiver-blind *name* resolution in `lookupCore`'s lexical chain, which recreates the same wrong edge by another route. The restored edges and the false ones come from the SAME mechanism — a name walk — so they cannot be separated by toggling the marker. The real trade is 2 genuinely-new true edges for 2 false ones, not the 3-for-1 the plan assumed. Corpus evidence (762 real TypeScript files, edge SETS not counts, cold cache both arms): baseline vs marker-removed: net 0, REMOVED 0, ADDED 0 Neither the gains nor the losses occur in production code. Given a 1:1 true/false ratio on synthetic shapes and zero effect on real ones, the marker stays: for a graph feeding `impact`, a fabricated caller is worse than an absent one — the same principle applied in the fail-closed positional join. The three shapes remain UNRESOLVED rather than wrongly resolved; resolving them properly needs a typed binding for object literals, anonymous classes and static contexts, which is a feature, not this fix. Measured with an edge-SET diff harness, after both ce-doc-review passes established that an edge COUNT cannot decide this (it conflates edges gained with edges lost, so a near-zero net reads as "no regression"). The harness also had to wipe the index each arm — a warm parse cache initially reported an unchanged edge set across a real behavioural change, the same trap documented in the v24 SCHEMA_BUMP note. detect_changes: low risk, 3 symbols, no affected processes. 85 files / 1365 tests green. Refs #2701 * docs(test): correct the false "three load-bearing gates" claim (#2701) The header of `this-boundary.test.ts` asserted that all three gates were independently load-bearing because "the false edge survived removing any one of them alone". That was true DURING development, measured incrementally, and was carried into the shipped comment without being re-tested against the finished code. It is false: gate 3 (`isReceiverOwnedButUnbound` in `receiver-bound-calls`) runs FIRST and marks the site in `handledSites`, which `emitReferencesViaLookup` then skips — so for an explicit `this` receiver it subsumes gate 1. Removing gate 1's `ownsReceivers` check in `gitnexus-shared/.../lookup-core.ts` leaves all 10 tests in the file passing; verified by experiment. The gate is RETAINED, and the review's recommendation to delete it as "dead" is rejected on evidence. `receiver-bound-calls` only suppresses EXPLICIT receivers (`if (site.explicitReceiver === undefined) continue;`), whereas `lookup-core`'s gate is also reached for IMPLICIT ones through `IMPLICIT_RECEIVERS` in `resolveReceiverOwner` — a bare `m()` inside a nested `function` inside a method goes down that path. The experiment shows the gate is UNTESTED, not unreachable; those are different claims and only the first is supported. Deleting it on the strength of a green test run would have removed live code, which is the same reasoning error the corrected comment is about. This is a documentation-only change: no behaviour, no test expectations. The correction is recorded in place rather than silently rewritten, because the way the claim came to be wrong — measured on an intermediate tree, then asserted about the final one — is the reusable lesson. Refs #2701 * test(scope-resolution): pin the block-scope ACCESSES delta as false-edge removal (#2699) The tri-review flagged that enabling `(statement_block) @scope.block` for JS/TS drops 114 `ACCESSES -> Const` edges corpus-wide with `added: 0`, undocumented and untested. That was recorded as a suspected regression. It is not one. All 274 emitting reference sites behind those 114 edges were classified by re-reading the source at the site: 269 are member reads, the 5 others are classifier artifacts (the name recurs earlier on the line, as in `a.b.declLine` for `b`) and are member reads too. No edge was bare-identifier-only. Every dropped edge was a property read (`options.baseUrl`) mis-resolving to an unrelated function-local `const` of the same name in the same file. The cause is not block-specific: `lookupCore` Step 1 walks the lexical chain for every lookup, including explicit-receiver property reads. Block scopes do not fix that, they narrow it, by moving the local off the chain of any reference outside its block. A local declared directly in the function body still hijacks the read; that is pre-existing and left alone here. Two tests. The first discriminates: it fails with the block capture removed (the false edge reappears) and passes with it. The second is a companion invariant, identical in both arms, so that "the edge went away" cannot be satisfied by a change that dropped Block-kind bindings outright. Fixture notes, both of which defeated earlier attempts at this edge class: `pruneLocalSymbols` deletes ~94% of function-local value symbols, so the `const` under test must be kept via `keepLocalValueSymbols`; and the member read must sit outside the block, since inside it the block is on the reference's own chain and the false edge appears in both arms. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184RmD24KFJidYqpM7v3XjR * docs(ingestion): correct the SCIP citation on the function-local id (#2699) The comment justified the positional, name-bearing local id (`fn@12:9`) as "same reasoning as SCIP's document-scoped `local <id>` keyspace". SCIP is the wrong citation for this key shape: its `local <id>` is a per-document counter, and the spec states that locals do not encode the name. SCIP remains prior art for the document-scoped keyspace itself, which is the part the argument actually leans on, so the reference is corrected rather than dropped. clang's USR for a function-local (`name@offset`) and Kythe's C++ indexer are the accurate citations for a positional, name-bearing key. Comment only, no behavior change. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184RmD24KFJidYqpM7v3XjR * fix(typescript,javascript): sync the function node-type lists, and test it (#2701) Four hand-maintained lists answer "which node types are function-like": 1. `query.ts` — the `@scope.function` / `@receiver-owner.this` patterns 2. `captures.ts` — `FUNCTION_NODE_TYPES` (callable-flow synthesis + the body-block filter) 3. `receiver-binding.ts` — `THIS_REBINDING_BOUNDARY_TYPES` 4. `type-extractors/typescript.ts` — `THIS_BOUNDARY_NODE_TYPES`, whose docstring already claimed it was "kept in sync with `@receiver-owner.this`" with nothing enforcing it `generator_function` (the EXPRESSION form, `const g = function* () {}`) was added to both queries for #2701 and is present in lists 3 and 4, but was missing from both `FUNCTION_NODE_TYPES`. Added. That gap changes no graph output today, and the commit does not claim otherwise. Measured on `const g = function* (x) { yield x; }; g(1)`: node and edge sets are byte-identical with and without the entry. The `this` boundary was already correct via the query marker — `this-boundary.test.ts` has a passing generator case. A generator-expression binding still emits a `Const` node rather than a `Function` one, so its call resolves to nothing either way; that label comes from the definition rules, and closing it is a separate change NOT made here. So the entry is list consistency and the test is the real deliverable. It asserts lists 1 and 2 EQUAL, and lists 3 and 4 as subsets of the query markers with an explicit allowlist — the method forms bind their own `this` but the class is their `this`-owner, so neither walk may stop there. Verified discriminating: removing the `generator_function` entry fails both equality assertions. The lists are exported for the test; no other production surface changes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184RmD24KFJidYqpM7v3XjR * test(bench): gate scope emission per language, not TypeScript-only (#2699) The scope-emission gate ran the TypeScript emitter only, so a JavaScript-only regression shipped green. The two filters it guards are implemented twice — `FUNCTION_BODY_OWNER_TYPES` in `typescript/captures.ts` and `JS_FUNCTION_BODY_OWNER_TYPES` in `javascript/captures.ts`, each with its own `blockDeclaresBinding` and `BLOCK_BINDING_CHILD_TYPES` — so covering one said nothing about the other. Adds a structurally parallel JavaScript corpus (the same shapes with the TS-only syntax removed) and splits `baselines.json` per language. `--check` now also fails when a baselined language is not measured, which is how a gate goes quietly green. Verified the new arm bites: disabling the JS body-block filter alone takes JavaScript from 400 to 600 block scopes and fails `--check`, while TypeScript stays green — the exact regression the old gate would have passed. The two languages happen to agree exactly on this corpus (2 blocks per module, 2200 scopes). That is recorded as a measured result, not an invariant: each language is still gated against its own baseline. TypeScript's numbers are unchanged. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184RmD24KFJidYqpM7v3XjR --------- Co-authored-by: Gergo Magyar <abhigyan1.patwari@gmail.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-27 07:52:18 +01:00
Copilot	d3d4fa31bb	fix(scope-resolution): gate C#/Kotlin free calls by instance ownership (#2563) (#2654) ... * Initial plan * fix(scope-resolution): gate C# and Kotlin free calls * fix(scope-resolution): keep Kotlin ownership gate safe * Apply remaining changes * perf(scope-resolution): benchmark and cache ownership gates * test(scope-resolution): simplify benchmark scaling loop * refactor(scope-resolution): encapsulate ownership cache * test(scope-resolution): enforce subquadratic ownership scaling * fix(scope-resolution): address ownership review findings * test(csharp): regenerate capture golden for #2563 fixtures The committed expected-captures.json was missing the new NamespaceOwnerCollision.cs entry and carried a stale SameFileCases.cs digest/count (56 → 67), so csharp-captures-golden.test.ts was the sole red check on the PR. Regenerate with UPDATE_GOLDEN=1 to match the fixtures the bench fingerprint already reflects. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-24 13:31:56 +01:00
Copilot	450cebc268	fix(java): JLS binary-name identities for local classes, enums, records & interfaces (#2562) (#2653) ... * Initial plan * docs(plans): add Java local class naming plan * fix(java): model local class binary names * docs(java): clarify local class naming guards * fix(java): recognize local classes in compact constructors * chore: remove Java naming plan * fix(java): harden local type identities and scope * perf(java): linearize local type ordinal allocation * fix(java): harden ordinal benchmark follow-up * docs(java): clarify ordinal benchmark invariants * test(java): cover local type ownership paths --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>	2026-07-24 11:58:53 +01:00
Gergő Magyar	170805647c	fix(rust): keep duplicate type names ambiguous in range binding (#2514) (#2652) ... * fix(rust): latch duplicate type-name ambiguity in range binding (#2514) The range-binding prepass tracked cross-file return and field types in two maps and used map presence itself as the ambiguity flag: the second definition of a name deleted it, but a third definition found it absent and re-inserted the last-scanned file's type. Odd duplicate counts (3, 5, ...) therefore resolved a genuinely ambiguous name to whichever file was scanned last, while even counts stayed ambiguous. Latch ambiguity in a dedicated Set per registry (ambiguousReturnTypes, ambiguousFieldTypes): once a name has two or more workspace definitions it never resolves again, regardless of duplicate count or file order. Adds integration coverage for two/three-duplicate functions and structs, permuted file order, and a unique-name over-suppression guard. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(rust): bump INCREMENTAL_SCHEMA_VERSION to 12 for the #2514 range-binding fix The duplicate-name ambiguity latch changes which cross-file Rust CALLS edges the range-binding prepass emits. The incremental writeback persists only changed-file nodes, so an incremental top-up against a pre-v12 index would keep the old spurious edges on every unchanged Rust file. Bump the schema version to force a one-time full re-analyze, matching the v7/v11 contract for edge-affecting resolver changes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(rust): resolve import-disambiguated duplicate types in for-loops & destructuring Follow-up to the #2514 ambiguity latch. When several modules define the same function/struct name and a call site disambiguates it with a `use` import (including aliases and `use x::*` globs), range-binding now resolves the for-loop element type and the destructured field type to that specific imported definition, instead of leaving it unresolved. The bare-name return/field maps are (correctly) ambiguous for duplicates, but the call site's import pins a definition. range-binding records the full, untruncated return/field type per defining file, and resolveImportedDef() resolves a name to the single in-scope definition, mirroring Rust name resolution: - tier 1: explicit `use`/re-export imports and local defs (lookupBindingsAt); these shadow globs, so if any exist we decide within them alone; - tier 2: glob imports, consulted only when tier 1 is empty; a `wildcard-expanded` ImportEdge names the target module, so we resolve only when exactly one glob-target file actually defines the name. Two or more visible definitions stay unresolved, preserving the #2514 latch. normalizeRustReturnType is untouched (its Vec<T> -> Vec truncation is load-bearing for receiver resolution), so the full generic is read from the per-file map instead. Covered by integration tests: explicit / aliased / single-glob imports resolve to the imported definition; two globs that both export the name stay ambiguous; a local definition shadows a glob; no-import duplicates stay unresolved (#2514). INCREMENTAL_SCHEMA_VERSION stays at 12 (bumped by the #2514 commit in this PR); its note now also covers these added resolution edges. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * perf(rust): parse each file once in range-binding when the workspace fits a budget populateRustRangeBindings makes two passes over every file and, because the shared treeCache is empty in the analyze flow, re-parsed each file in both — a workspace of N files paid 2N parses. It now parses each file once and reuses the tree across both passes via an in-function store, gated by a source-byte budget: workspaces up to 16 MiB of Rust source (essentially every real repo) reuse trees; larger ones fall back to per-pass re-parsing so peak RSS stays bounded on huge repos (the memory-sensitive case keeps its current profile). Also collapses the parse+timeout boilerplate that was copy-pasted in both loops into one getOrParseTree helper, and adds a PROF-gated `rangeBind=` segment to the scope-resolution profiler for phase-level observability. Measured on a 500-file synthetic Rust workspace (PROF_SCOPE_RESOLUTION=1): the range-binding phase drops ~370ms -> ~320ms (~14%), parses 1000 -> 500. Behavior is unchanged (199 rust + range-binding-order + parse-timeout tests green); repos above the budget are unaffected. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(rust): update schema-version gate to v12; regenerate golden + bench baseline for new fixtures CI surfaced three deterministic-artifact failures, all from this PR's own additions: - call-summary-schema-version.test.ts hardcoded INCREMENTAL_SCHEMA_VERSION === 11 (the #2604 window); #2514 bumped it to 12. Update the gate and extend the reuse-gate version history so a v11 stamp now forces a full re-analyze. - rust-captures-golden expected-captures.json drifted (130 -> 174 entries) because the new rust-import-* / rust-dup-* fixtures joined the rust-* corpus. Regenerated (UPDATE_GOLDEN=1): additions only, no existing captures changed — emitRustScopeCaptures is untouched. - bench/scope-capture/baselines.json rust fingerprint drifted for the same reason. Rebaselined with a provenance note; scaling 1.06 < 1.5 budget. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude <claude@anthropic.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-23 13:43:24 +01:00
Abhigyan Patwari	0eeecb37f3	fix(python): resolve calls through constructor-injected fields (#2628) ... * fix(python): resolve calls through injected fields * fix(ci): update python capture benchmark fingerprint * fix(python): make constructor field inference conservative --------- Co-authored-by: Gergo Magyar <gergomagyar@icloud.com>	2026-07-22 16:32:53 +01:00
Gergo Magyar	00141d0da2	test(bench): rebaseline rust scope-capture fingerprint for #2604 ... RUST_SCOPE_QUERY gained a function_signature_item capture, shifting the capture fingerprint for every bench fixture with a required trait method. Verified: node --import tsx bench/scope-capture/measure.mjs --check now passes across all 14 languages (rust scaling 1.036 < 1.5 budget).	2026-07-21 15:32:11 +00:00
Claude	70e0a7766c	fix(java): address #2561 review — inherited-dispatch test + bodied fail-safe ... Two gitnexus-review-agent findings on PR #2602: - MEDIUM: the bodied-constant MRO-to-host-enum path (a qualified call to an inherited, non-overridden enum method) was claimed in a comment but never tested. Add EnumConst.A.log() -> EnumConst.log#0, exercising E$N's @reference.inherits MRO arm end to end. - LOW: `bodiedName ?? hostEnum` conflated "body-less" with "name synthesis failed on a bodied constant" (reachable only on malformed/error-recovery trees), silently binding an overriding constant's receiver to the host enum — a wrong edge instead of no edge. Switch to `isBodied ? bodiedName : hostEnum` so a bodied constant binds ONLY to its E$N class, mirroring the object_creation_expression branch's skip-on-synthesis-failure. Verified output-neutral on the well-formed bench corpus. Rebaseline the java scope-capture fingerprint (a822cef9 -> d04298a9): the bench corpus IS test/fixtures/lang-resolution, so the new dispatchInherited fixture method shifts it (+6 capture groups); the logic change contributes nothing (confirmed by isolating the fixture-only fingerprint). java.test.ts 242 passed; measure.mjs --check PASS (14 languages); tsc/prettier/eslint clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-21 13:52:27 +00:00
Claude	d9437e6d74	test(bench): rebaseline java scope-capture fingerprint for #2561 ... The enum-constant receiver-dispatch fix adds one @type-binding.* capture per enum constant, so the java scope-capture fingerprint shifts (85fc7af9 -> a822cef9). Pure capture-additive drift; no bench fixtures added; scaling 1.024 < 1.5 budget. Verified `measure.mjs --check` passes for all 14 languages. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-21 12:19:51 +00:00
Gergo Magyar	5099e8ff1e	test(bench): rebaseline java scope-capture fingerprint for record support (#2564) ... CI caught this: adding the record_declaration capture legitimately changes the pinned java capture fingerprint, same as every prior capture-behavior change to this language (#2550, #2555). Rebaselined following the established _rebaselined_* precedent; scaling ratio 1.059 stays well within the 1.5 budget.	2026-07-21 07:18:38 +00:00
FAll	2cfbc4a259	feat(spring): build bean candidate inventory (#2494) ... * feat(java): inventory Spring bean candidates * fix(java): fail closed on Spring annotation shadowing * fix(java): resolve Spring beans after imports * fix(java): remove stale bean extraction path * style: satisfy locked Prettier version * fix(spring): address PR review findings * feat(spring): share bean inventory across Java and Kotlin * fix(spring): gate bean inventory analysis completeness * fix(kotlin): avoid reloading cached scope source * chore(autofix): apply prettier + eslint fixes via /autofix command --------- Co-authored-by: Gergő Magyar <gergomagyar@icloud.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-07-20 09:28:23 +01:00
Gergő Magyar	12600000e3	feat(java): model enum constant bodies as first-class instances; JLS 13.1 anonymous naming (#2558) ... * feat(java): JLS 13.1 immediate-host naming for anonymous bodies + v9 schema window (#2555, step 1) `synthesizeJavaAnonymousClassName` generalizes to both anonymous-body shapes (`object_creation_expression` with a `class_body`; `enum_constant` with a `body:` field) and switches from topmost-host naming to JLS 13.1 binary names: the `$`-joined chain of enclosing host types (`EnumWrap$Mode$1`), numbered per IMMEDIATE host in source order across both shapes (javac's shared counter). Every existing fixture's immediate host is its top-level type, so existing names are unchanged — proven by the 11 #2550 tests passing untouched, not assumed. The owner walk's anonymous branch also fires on `enum_constant` now (the synthesis returns undefined for body-less constants, so the walk continues to `enum_declaration` as before). Identity window: INCREMENTAL_SCHEMA_VERSION 8→9, parse-cache SCHEMA_BUMP 18→19, U-C5 pin extended with the v8-stamp rejection (enum-constant methods re-key `E.hook`→`E$1.hook`; nested-host anons re-key `EnumWrap$1`→`EnumWrap$Mode$1`). Enum-constant Class-node emission and scope-side ownership land in the next commits per docs/plans/2026-07-18-gitnexus-plan-enum-constant-bodies.md (plan is local — docs/ gitignored). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(java): model enum constant bodies as first-class instances (#2555, steps 2-4) `enum E { A { void hook(){} } }` — javac's other anonymous-class shape — joins the #2550 instance model: - Structure: `(enum_constant body: (class_body)) @definition.class` in JAVA_QUERIES; `enum_constant` in javaClassConfig.typeDeclarationNodes with extractName synthesis. The shouldSkipClassCapture guard now also covers enum_constant — without it, extract()'s name fallback would fabricate a Class node from the constant's own identifier (`A`). - Scope: `(enum_constant body: (class_body) @scope.class)` + synthesized `@declaration.class`/`@declaration.name` anchored on the body, so the constant's methods are owned (`ownerId`) and re-keyed (`Method:...:EnumConst$1.hook#0`). - Inheritance: a body-anchored `@reference.inherits` naming the HOST ENUM (javac semantics: E$N extends E) — `mroFor(E$N) ∋ E`, so bare calls from the body to enum helpers pass the ownership gate's MRO arm while the same-file bare-call leak for constant-body method names is closed (discrimination evidence: the #2549 review's archived S1b probe showed the identical shape resolving `local-call` pre-fix). - Nested-host JLS naming verified end-to-end: `EnumWrap$Mode$1` (not `EnumWrap$1`). - Bench: java scope-capture fingerprint rebaselined (new captures + two fixtures), `measure.mjs --check` PASS across all 14 languages. Verified: full java.test.ts 230/230 twice sequentially; TS 254 + JS/ Kotlin 289 (shared-file spot set); schema/scope/owner unit suites 90. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(java): exempt $-chain anonymous class defs from nested-class qualification (#2555 review) Review lens probe caught a HIGH collapse: same-named methods across sibling enum constant bodies attributed to the FIRST body's Method node (`M3$1.hook -> M3.log` where the log() call lives in C's body; the same-target sibling edge vanished entirely under dedup). Root cause: `populateClassOwnedMembers`'s qualifier chains a constant-body class def to `M3.M3$2` — its Class scope's parent is the enum's Class scope, unlike OCE anons whose parent is a Function scope — and its methods to `M3.M3$2.hook`. The structure-phase node id encodes `M3$2.hook`, so the graph-bridge's qualified key misses and falls to the file-wide simple-name lookup: first-write-wins. Fix: `qualify()` now skips CLASS-LIKE defs whose name already carries a `$` chain — a synthesized anonymous binary name is complete by construction (JLS 13.1). Narrowly scoped: `$`-named MEMBERS (legal and real in JS/TS) still qualify against their class, and named nested classes (`Outer.Inner`, #1978) are untouched. Discriminating regression test: same-name/distinct-target sibling bodies must each own their edge, and the misattributed cross-edge must not exist. Verified: full java.test.ts 231/231; Python+Kotlin 459 (heaviest populateClassOwnedMembers consumers) — zero assertion failures. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(ci): prettier formatting + java bench rebaseline at the final corpus (#2555) Two CI reds from the review-fix commit landing AFTER the bench rebaseline: (1) prettier reformat of the new java.test.ts describe; (2) the java scope-capture fingerprint drifted again because the review fix added the java-enum-constant-same-name fixture to the corpus — rebaselined at the true final corpus (196 fixtures, ce104a76…, scaling 1.05 < 1.5), local `measure.mjs --check` PASS across all 14 languages. Lesson honored going forward: the bench rebaseline is the LAST artifact step — any post-review fixture addition reopens it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(java): strict JLS 13.1 chaining through anonymous enclosing types (#2555) Per review discussion: anonymous enclosing types now chain into the binary name instead of flattening to the nearest NAMED host — the immediately enclosing type per JLS 13.1 may itself be anonymous: - anon inside an anon: NestHost$1$1 (was NestHost$2) - anon inside an enum constant: N$1$1 (was N$2) - named nested hosts (unchanged): EnumWrap$Mode$1 `nearestJavaAnonHost` becomes `nearestJavaEnclosingType` (named hosts OR anonymous bodies); an anonymous enclosing type's prefix is its own synthesized name (memo-bounded recursion); numbering is per immediately enclosing type in source order. Top-level-hosted names are untouched — the full existing suite passes unchanged. New coverage: anon-in-anon chain, anon-in-constant-body chain (with ownership), and a bodied constant in a NESTED enum (EnumWrap2$Mode$1 — the one host combination previously untested). Rides the unreleased v9 identity window (doc wording tightened); java bench fingerprint rebaselined at the final corpus, `--check` PASS across 14 languages; prettier clean. Verified: full java.test.ts 234/234 (one worker-crash flake rerun green in isolation). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-07-18 23:11:45 +01:00
azizur100389	196095b7d1	fix(dart): extract extension type symbols (#2539) ... * fix(dart): extract extension type symbols * test(dart): update extension type benchmark baseline * fix(dart): emit extension type implements heritage * fix(dart): handle generic extension type implements --------- Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>	2026-07-18 22:57:26 +01:00
Gergő Magyar	1abcac9c16	fix(scope-resolution): stop platform builtins resolving to unrelated same-file symbols (#2549) ... * fix(scope-resolution): stop platform builtins resolving to unrelated same-file symbols (#2545) An unqualified call to a platform/language builtin (e.g. TypeScript's global fetch()) could resolve to an unrelated same-file declaration sharing that name, most visibly a Cloudflare Worker's `export default { async fetch(req) {...} }` handler. Two contributing gaps, both fixed: - Object literals had no scope boundary in the TS/JS grammar queries, so a method's/property-arrow's name auto-hoisted past the literal into whatever lexically enclosed it (scope-extractor.ts's auto-hoist logic had nowhere to stop). Give object literals a Block scope, like 6 other languages already do for lexical blocks. - Independently, finalize's per-file bindings bucket (materializeBindings in gitnexus-shared) flattens every local declaration in a file onto its module scope for cross-file import resolution, regardless of true nesting -- so free-call-fallback's scope-chain walk could still hit the leaked binding at module scope. Guard free-call resolution: when a match for a known builtin name (LanguageProvider.isBuiltInName, already populated for TS/JS but never consulted by this pass) has no binding reachable via the true lexical scope chain, leave the call unresolved instead of emitting a false CALLS edge. Verified against the full TS/JS resolver suites plus every other language populating builtInNames (Python, Go, C/C++, C#, Dart, Kotlin, PHP, Ruby, Rust, Swift, Vue) -- 2333 tests, no regressions. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(scope-resolution): extend the #2545 scope-leak fix to Kotlin and Java Anonymous object-expressions (Kotlin `object { ... }`) and anonymous class bodies (Java `new Runnable() { ... }`) have the same missing scope-boundary gap that caused #2545 in TypeScript/JavaScript: a method declared inside has no scope of its own to stop the auto-hoist at, so its name leaks past the container into the enclosing scope. - Kotlin: `(object_literal) @scope.class` (distinct from the already- scoped named `object_declaration`/`companion_object`). Kotlin already populates `builtInNames`, so free-call-fallback's isBuiltInName guard (added for #2545) fully closes the equivalent leak here too -- verified with a `println`-shadowing regression test. - Java: `(object_creation_expression (class_body) @scope.class)`, matching PHP's existing `anonymous_class` handling. Java has no `builtInNames` list, so the isBuiltInName guard doesn't engage -- the scope-tree fix is still correct and necessary (the anonymous class's own methods are now owned by the right scope), but an unqualified call to an unrelated same-file method sharing the anonymous class's method name can still resolve via finalize's per-file module-scope bucket (materializeBindings, shared/ language-agnostic, intentionally not touched by this PR). Documented in the test as a known residual gap, same as TS/JS/Kotlin's own non-builtin-name collisions. Audited every other language for the same shape (a value/container node with no @scope.* capture hosting a would-be-auto-hoisted named declaration): PHP and Vue already handle it correctly (PHP scopes anonymous_class; Vue's <script> delegates to the now-fixed TS/JS query). Ruby, Python, Dart, C#, Swift, Go, Rust, and C/C++ have no query pattern that treats a literal/container value position as a named declaration in the first place, so the bug shape can't occur there. Verified: full Kotlin + Java resolver suites, 468 tests, no regressions. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(scope-resolution): dedicated Object scope kind for object literals (#2545, #2551) Review of the #2545 fix surfaced two defects, both fixed here: 1. The isBuiltInName guard suppressed genuine cross-file imports whose name matches a builtin (`import { fetch } from './fetch-polyfill'` silently stopped resolving -- verified regression vs. main). The leak the guard targets is inherently same-file (finalize's flat bucket is per-file), so the guard now also requires `fnDef.filePath === parsed.filePath`. New regression test covers the polyfill-import shape. 2. The sibling-property case of the reported bug was still broken and masked by a tautological assertion (`c.reason` -- a property that doesn't exist; the real path is `c.rel.reason` -- so the test passed regardless of behavior). In `export default { fetch() {...}, handler: () => fetch(...) }`, `handler`'s bare `fetch()` still resolved to its sibling. Reusing the `Block` scope kind was the root cause: correct for a real lexical block (a nested closure legitimately sees a sibling `let`/`const` from an enclosing `if`/`for`), wrong for object literals, whose members are reachable only via property access -- never as bare identifiers, not even by sibling property bodies. Fix: a dedicated `Object` ScopeKind (gitnexus-shared) -- a hoist boundary whose own bindings scope-chain walkers never consult while still traversing past it to the parent. TS/JS object literals now emit `@scope.object`; the four chain walkers in scope-resolution/scope/walkers.ts (walkScopeChain, findAllCallableBindingsInScope, findCallableBindingsAndAdlBlocker, findExportedDefByName) and free-call-fallback's hasGenuineLexicalBinding skip Object scopes' bindings. Kotlin's anonymous `object {}` keeps `@scope.class` -- unlike JS object literals it has real implicit-this sibling dispatch. Verified with the full resolver matrix run sequentially (TS 254, JS/ Kotlin/Java/Python/Go + TS variants 960, C/C++/C#/Dart/PHP/Ruby 1049, Rust/Swift/Vue/Cobol + route/flow/unit suites 828, scope-extractor/ scope-tree units 51). Worker-pool crashes under parallel suite load reproduced on unrelated files and pass in isolation (known flake, not caused by this change). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(autofix): apply prettier + eslint fixes via /autofix command * feat(java): model anonymous class bodies as first-class Class nodes (#2550, step 1) `new Runnable() { public void run() {} }` now emits a synthesized javac-style `Class` node (`Worker$1`, `$N` = source order within the top-level class) and owns its methods: the enclosing-owner walk attributes `run` to `Worker$1` (re-keyed `Method:...:Worker$1.run#0`, HAS_METHOD from the anonymous class) instead of the lexically enclosing named class. - `synthesizeJavaAnonymousClassName` (ast-helpers): single naming authority for every layer that keys the anonymous class; returns undefined for `object_creation_expression` without a `class_body` child, which also keeps it a no-op for C#'s same-named node type. - `findEnclosingClassInfo`: anonymous-body branch before the generic container walk. - JAVA_QUERIES: `(object_creation_expression (class_body)) @definition.class` (no @name); `getLabelFromCaptures` now lets a nameless `definition.class` through — the parse-worker's existing `!nameNode && !extractedClassSymbol` gate still drops any nameless class the extractor cannot name, so other languages are unaffected. - `javaClassConfig.extractName` synthesizes the name on the extractor path (worker node emission). - Node identities move on unchanged files: INCREMENTAL_SCHEMA_VERSION 7→8 and parse-cache SCHEMA_BUMP 17→18 (the v5 Route-identity precedent) force full re-analyze / cache invalidation. Verified: new #2550 identity tests + resolve-enclosing-owner and has-method suites (53 tests) green. Prep for step 2/3 (scope-side ownership + receiver typeBinding) and the free-call instance-ownership gate per docs/plans/2026-07-18-gitnexus-plan-java-instance-scoped-freecalls.md (plan file is local — docs/ is gitignored by repo policy). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(java): instance-scoped free-call resolution for anonymous-class methods (#2550, steps 2-4) Completes the #2550 instance model on top of the Worker$N identity commit: - Scope-side ownership (java/captures.ts): synthesize `@declaration.class` + `@declaration.name` (`Worker$N`) anchored on the anonymous `class_body` — same range as its `@scope.class`, so the def lands in that Class scope's ownedDefs, `populateClassOwnedMembers` stamps `ownerId` on the anonymous class's methods, and the name auto-hoists exactly like a named class declaration. - Receiver typeBinding (java/captures.ts + type-extractors/jvm.ts): `Runnable handler = new Runnable() { ... }` binds `handler` to the ANONYMOUS class (`Worker$1`), not the declared JDK interface — in both the scope-side TypeRef channel (receiver-bound Case 4) and the worker typeEnv. `handler.run()` now resolves through the receiver path (reason 'global', target `Worker$1.run#0`) instead of depending on the free-call finalize-bucket leak — which is why the prior gate attempt broke it (the #2550 landmine, now explained and structurally removed). - Instance-ownership gate (free-call-fallback.ts + contract + run.ts + java opt-in): with `ScopeResolver.freeCallsRequireInstanceOwnership`, a free call may resolve to a `Method` only when the caller's enclosing class chain (self + MRO via `scopes.methodDispatch.mroFor`) contains the method's owner. Same-file matches only — the `materializeBindings` leak is per-file; cross-file Method matches come through genuine import channels (suppressing them broke the arity-narrowing parity suite, verified). Suppressions recorded as `'free-call-instance-ownership'` outcomes. Java opts in; every other language is byte-identical (flag off). Result on the #2545 fixture: `process()`'s bare `run()` emits NO edge to the unrelated anonymous method (the #2550 bug, closed), while `handler.run()`, same-class implicit-this dispatch, and bare inherited calls (MRO arm) all keep resolving. Verified: full java.test.ts 223/223 twice sequentially (landmine gate); cross-language matrix (TS/JS/Kotlin/Python/Go/C/C++/C#/Dart/PHP/Ruby/ Rust/Swift/Vue/Cobol + callable-value-flow + java-class-impact + core units) — zero assertion failures; worker-crash flakes re-verified green in single-file isolation. Known deferral (documented): EXTENDS/IMPLEMENTS edges from the anonymous class to its constructed type are not yet emitted, so a same-file inherited-but-not-overridden member called ON the anonymous instance does not resolve through the anon MRO; tracked as the follow-up in #2550. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(autofix): apply prettier + eslint fixes via /autofix command * fix(java): anonymous-class inheritance, host coverage, and phantom-node guard (#2550 review) Self-review of the instance model (gitnexus-review with empirical lens probes) surfaced three defects, all fixed: 1. HIGH — the ownership gate suppressed TRUE bare calls to inherited methods inside an anonymous body extending a same-file class (`new Base() { void extra() { work(); } }` lost `extra -> work`): the anon class had no inheritance edge, so `mroFor(Worker$N)` was empty and the MRO arm could never pass. The synthesis now emits an `@reference.inherits` for the constructed type, anchored on the `class_body` so the reference's enclosing class resolves to the SYNTHESIZED def (anchoring on the type node would sit outside the anonymous scope and attribute the edge to the wrong class). Anon classes now get real EXTENDS/IMPLEMENTS edges and inherited bare calls pass the gate. 2. MEDIUM — hostless anonymous bodies materialized a phantom Class node named after the CONSTRUCTED type (`Class:...:Runnable`) via extract()'s extractTypeNameFromNode fallback. New `shouldSkipClassCapture` in javaClassConfig drops the capture when no name can be synthesized. 3. MEDIUM — enum/interface/record-hosted anonymous bodies silently fell back to the pre-#2550 model (mis-attribution + open leak). The topmost-host walk now accepts all four host type declarations (JAVA_ANON_HOST_TYPES), so `EnumHost$1` etc. are modeled; the phantom-node shape disappears for those hosts as a side effect. Also: per-parse-tree WeakMap memo for the `$N` numbering — the helper is called from four independent layers per anonymous body and each call re-scanned the host subtree (`descendantsOfType`), quadratic on anon-heavy files (old-style listener-per-widget Java); and the scope-capture bench fingerprints rebaselined for java/typescript/ javascript/kotlin (`measure.mjs --check` now passes all 14 languages — it failed for every scope query this PR touched; drift notes added per the file's convention). Verified: full java.test.ts 225/225; all 11 #2550 tests including the new anon-extends-base and enum-host scenarios; bench --check PASS. Known remaining (documented, unchanged-old behavior): enum CONSTANT bodies (`A { ... }`) stay unmodeled; nested-host naming is top-level- anchored (`EnumWrap$1`, not javac's `EnumWrap$Mode$1`). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(autofix): apply prettier + eslint fixes via /autofix command * test(storage): update the INCREMENTAL_SCHEMA_VERSION pin to v8 (#2550) The U-C5 reuse-gate test deliberately pins the exact schema version so a bump cannot land without consciously extending the gate expectations. Extend for v8 (Java anonymous-class node identities, #2550): a v7 stamp now fails the strict-equality reuse gate — a pre-v8 index would strand old `Worker.run`-keyed Method nodes alongside the re-keyed `Worker$N.run` ones on unchanged files — and v8 passes. Caught by CI (tests/ubuntu coverage shard 2/3 on PR #2549); the local matrix had not included this unit file. All 7 schema-referencing unit suites verified green (109 tests). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-07-18 14:30:37 +01:00
Gergő Magyar	ed8ab1c246	fix(scope-resolution): resolve callable reference flows (#2437) (#2522) ... * docs(plans): add provider-hook value-refs plan (#2437) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(plans): deepen #2437 plan to USES + property-dispatch design Design revised after prior-art research (Kythe ref vs ref/call, Joern METHOD_REF, Feldthaus field-based call graphs, CodeQL impliedReceiverStep): registration sites emit reference-class USES, invocation is recovered by a field-based property-dispatch pass synthesizing CALLS at member-call sites. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(scope-resolution): model provider-hook value references (#2437) Functions referenced as object-literal property values (provider hooks like emitScopeCaptures: emitCppScopeCaptures) previously produced no edge at all, so impact/context reported a false-safe 0 upstream dependents. Two coordinated halves, per prior art (Kythe ref vs ref/call, Joern METHOD_REF, Feldthaus ICSE'13 field-based call graphs, CodeQL impliedReceiverStep): - Registration -> USES: new ReferenceKind 'value-ref'; TS/JS queries capture pair values and shorthand properties (with @reference.property-key); emitted as a reference-class USES edge, reason 'scope-resolution: value-ref'. Resolution is callable-gated so plain values emit nothing. - Dispatch -> CALLS: new shared pass emitPropertyDispatchCalls synthesizes CALLS (reason 'property-dispatch', confidence 0.7, per-key fan-out cap 32 calibrated on this repo's 16-provider hook tables) from member-call sites to every function registered under the same property key. Deviation from plan: the pass owns value-ref resolution entirely via the post-finalize findCallableBindingInScope walker — the shared registries only see pre-finalize local bindings, so imported hooks (the c-cpp.ts case) were unresolvable through lookupForSite; Reference.propertyKey passthrough dropped as unnecessary. SCHEMA_BUMP 13 -> 14: ParsedFile gains value-ref sites + propertyKey. Verified end-to-end: impact(emitCppScopeCaptures, upstream) now reports 8 impacted / HIGH with extractParsedFile (true dispatch caller) at d=1 via property-dispatch and the c-cpp.ts registration via USES. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(scope-resolution): cover value-ref registration and property dispatch (#2437) Integration: same-file/cross-file/aliased/shorthand registrations emit USES; non-callable and destructuring values emit nothing; dispatch sites gain property-dispatch CALLS (incl. JS twins and per-language partitioning); fan-out-capped keys are dropped entirely; factory-call values unchanged. Unit: capture-shape pins for @reference.value-ref + @reference.property-key. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(scope-resolution): surface dropped property-dispatch keys in stats (#2437) Review finding: skippedKeys was returned but discarded — a hook table larger than the fan-out cap silently reopened the #2437 gap for those keys. Log dropped keys and fold value-ref USES + dispatch CALLS into referenceEdgesEmitted. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(plans): add callable reference-flow implementation plan * fix(scope-resolution): close property-dispatch review gaps * feat(scope-resolution): add callable flow facts * feat(scope-resolution): resolve callable value flow * feat(scope-resolution): resolve callable references across providers * fix: harden callable reference flow resolution * fix(scope-resolution): preserve callable binding semantics * docs(plans): add pr-2522-review-fixes plan Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(storage): bump INCREMENTAL_SCHEMA_VERSION for callable-value-flow edges Callable-value-flow CALLS/USES edges (#2437) can connect two files whose content did not change, but the incremental write set only covers changed files — a top-up against a pre-v7 index would silently omit the new edges for every unchanged file pair, indefinitely. Force the one-time full re-analyze (review finding 1, #2522). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(storage): sanitize callable-flow sites per-site at load, log drops The load-time validator rejected the WHOLE ParsedFile when one site was malformed or over-bound, with no logging — and C++ legitimately emits empty-string parameterTypes entries ('' = unknown, the ReferenceSite.argumentTypes convention) for cv-only/ERROR-recovered types, so real repos fell into a permanent, silent warm-cache-miss reparse loop through the #1983-sensitive main-thread path (review finding 7, #2522). Now: '' entries are valid in type arrays; a malformed/over-bound site drops only itself (counted, warned once per load); only non-array garbage — evidence the serialization itself is untrustworthy — rejects the file. Deviation from plan §6 wording: validator-side tolerance replaces emit-side clamps — smaller diff, same asymmetry closed at the single chokepoint. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(scope-resolution): keep declarations in the union for reassigned callable cells The binding-lookup suppression for fact-constrained cells was wholesale: reassigning a declared function through its own name (greet = other; greet()) deferred the call to the solver, which then refused the lexical lookup that resolves the declaration — an unresolvable RHS yielded zero CALLS for a call that resolved pre-flow (review finding 8, #2522). Suppression now applies only to cells bound by FORMAL facts — its actual purpose (a parameter whose grammar emits no declaration binding must not adopt a same-named outer function). Copy/alias/store/load destinations keep their declaration as an inclusion seed (Andersen-style union). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(scope-resolution): count forfeited deferred sites in the budget-bailout warning On work-budget exhaustion the deferred invoke sites end the run with zero CALLS — free-call fallback and reference emission already skipped them — but the warning said 'ordinary graph emission remains untouched', which is false for exactly those sites. The warning context now carries the unresolved deferred-site count and the comment states the real cost (review finding: budget-bailout honesty, #2522). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(scope-resolution): surface dropped property-dispatch keys in stats and warn payload The over-cap warning carried only a count; the dropped key NAMES were discarded and RunScopeResolutionStats had no field, so the PR-body claim 'includes them in resolver statistics' was unimplemented (review finding, #2522; reviewer ask on the fan-out cap). The warn payload now names up to 20 dropped keys and the stats carry propertyDispatchSkippedKeys. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(scope-resolution): drop producer-less ownerQualifiedName from formal sites No capture emitter anywhere produces @callable-flow.owner-qualified-name — the solver branch consuming it was unreachable in production, yet the field was typed, parsed, validated, and unit-tested with hand-built input (review finding 16, #2522; YAGNI). Re-add with a real producer if C++ qualified member declarators ever need it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(scope-resolution): drop dead callable-flow knobs CallableFlowPassingMode 'callable-object' had no producer and no consumer distinguishing it, and CallableFlowCaptureOptions.extractCallArguments had no language providing it (unlike its live sibling extractCallCallee) — review finding 17, #2522 (YAGNI). The invocation-kind 'callable-object' is a different, live concept and stays. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ingestion): bind subscripted callable cells to the container, not the index terminalIdentifier iterates children in reverse, so tbl[i] = handler seeded the INDEX variable's cell (polluting a same-named formal) and tbl[i](7) looked up the callee under i in a different scope — no join, no CALLS edge for the classic function-pointer-array dispatch (review finding 12, #2522). Subscript nodes now recurse into their container field only, in both bindingIdentifier and terminalIdentifier, across the fielded grammars (C/C++/JS/TS/Python/Go/Java). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ingestion): make cross-function file-scope callable bindings resolvable Two stacked gaps killed the canonical C callback-registration pattern (fp assigned in init(), called in run()) — the exact #2437 false-safe this PR exists to fix (review finding H1, #2522): 1. isVisibleValueBinding only consulted assignment regions and formals, so a call in a function OTHER than the assigning one emitted no invoke fact. A declared callable-typed binding is now a value binding wherever its declaration is visible (visibleCallableSignature). 2. The C scope query had no @declaration.variable pattern for function- pointer declarators — void (*fp)(int); created no scope-tree binding, so the seed (init) and invoke (run) cells canonicalized to different keys and never joined. Both bare and initialized forms now bind. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(c): detect variadic parameters via the named variadic_parameter node tree-sitter-c materializes '...' as a named variadic_parameter node; the anonymous-token checks never matched, so variadic function-pointer signatures were emitted with a wrong fixed arity and no '...' sentinel (review finding, #2522). C++ is unaffected ('...' stays an anonymous token there); the token checks remain for such grammars. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ingestion): emit invoke facts for field-stored callable member calls The C ops-vtable pattern (o->run = handler; o->run(1)) captured the store but never the call — the member path in emitCallFacts bailed for languages without protocol methods, and the value-binding index recorded the member store under the OBJECT's name ('o'), not the member's ('run') (review finding 11/M3, #2522). Member destinations now also record their terminal member name, and a member call whose name-cell has a visible store emits an indirect invoke — gated on the store so plain accessor calls (map.get) stay inert. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(cpp): disambiguate (obj->*ptr)() ERROR recovery by token order tree-sitter-cpp groups the recovered '->*' two ways depending on error-recovery cost (identifier lengths): [identifier, ERROR '->*m'] or [ERROR 'obj->*', identifier]. The recovery assumed the first shape, so the second silently swapped receiver/member and dropped the call site — the committed test passed only by name luck (review finding H2, #2522). The identifier's position relative to '->*' inside the ERROR now decides roles. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(cpp): class members are never file-local in hasFileLocalCallableLinkage The name-keyed file-local set is populated from every static declaration, so an in-class 'static void make();' (external linkage — in-class static means no-instance) and any member sharing a name with a static free function were over-marked, refusing legitimate cross-file declaration/definition joins (review finding 13/M2, #2522). Method and Constructor defs now bypass the name-set, per the hook's own linkage-only contract. Deviation from plan step 13: the regression is a unit-level contract pin rather than an end-to-end join test — C++ merges out-of-line member definitions onto the member node by qualified identity, so the graph shape cannot discriminate the join refusal for members. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(cpp): classify parameter passing mode from the declarator chain only A whole-subtree scan for reference_declarator inverted copy vs alias: void reg(void (*cb)(int& out)) marked the by-value pointer cb as 'reference' because of the NESTED parameter's int&, making the solver back-propagate formal targets into every caller's argument cell — alias semantics for a copy (review finding 14/M5, #2522). The chain walk never descends into nested parameter lists; a reference anywhere ON the chain (int& x, void (*&cb)(int)) still aliases. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ruby): bare identifiers are calls, not callable references Ruby parses a receiver-less zero-arg method call identically to a variable read, so 'action = process' — which CALLS process and stores its return — seeded action with the callable and minted a wrong CALLS edge from any dispatch through it, confirmed end-to-end (review finding 15/HIGH, #2522). New provider knob bareNamesAreCalls: a bare name that is not a provably local value binding and not an explicit reference form (method(:x), lambda/proc) emits no flow fact, on both the assignment and argument paths. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(go): pair multi-value := positionally instead of cross-wiring The shared field fallback took the FIRST LHS identifier and the LAST RHS identifier of Go's expression_list pair, cross-wiring 'a, b := f, g' and synthesizing a garbage comma-joined qualified name — the real relationships were silently dropped (review finding 16, #2522). extractAssignment may now return multiple pairs; Go pairs list entries positionally and emits nothing for a length mismatch (multi-return call RHS). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(java): drop get/test from callableProtocolMethods 'get' and 'test' collide with ubiquitous non-functional-interface APIs (Map/List/Optional/Future.get), so every ordinary container access emitted a spurious callable-object invoke fact — high-volume misleading graph facts with a cross-wiring risk on receiver-name reuse (review finding 17, #2522). Supplier.get/Predicate.test dispatch is deliberately traded away until the check can gate on the receiver's declared type. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(rust): pin the qualified-name no-degrade guard as a hard invariant Rust's scoped_identifier callable-reference capture over-includes unit enum variants and associated constants (Shape::Square seeds as if callable); they stay edge-free only because resolveSeedCandidates refuses to degrade an unresolved qualified name to a simple-name lookup (review finding 18, #2522). Capture-side type filtering would false-negative on tuple-variant constructors, so the guard IS the contract: documented as a hard invariant (Go's mis-shaped multi-value forms also rely on it) and pinned end-to-end. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(php): remove nonexistent optional_parameter node type tree-sitter-php has no 'optional_parameter' — defaults ride on simple_parameter — so the entry was dead weight the #1920 literal gate does not cover for capture-option Sets (review finding 19, #2522). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(cobol): detect procedure pointers on fixed-format sources Two stacked defects made the feature a no-op on classic sequence-numbered fixed format (review finding 20/H3, #2522): 1. parseDataItemClauses' USAGE alternation knew POINTER but not PROCEDURE-POINTER/FUNCTION-POINTER, so the dataItems filter was dead. 2. The raw-line fallback scanned UNCLEANED text, where the sequence number satisfied the leading digits and the LEVEL NUMBER got captured as the pointer name. It now scans preprocessed lines and requires a letter- initial name (COBOL data names must contain a letter). 161 COBOL preprocessor/copy-expander tests stay green; free-format matrix case unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(cobol): skip comment lines in SET seed/copy scans A commented-out SET (indicator-column '*'/'/' or free-format '*>') produced a live seed and a false CALLS edge from dead code (review finding 21/M1, #2522). The scan now skips indicator-column comment lines and strips inline '*>' tails before matching. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(architecture): document callable-flow-only mode and skipped-key reporting The Callable-value flow section omitted scopeResolutionEdgeMode: 'callable-flow-only' — a real emit-pipeline branch that suppresses all ordinary emission for standalone providers (review finding 22, #2522) — and predated the skipped-key names/stats surfacing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(scope-resolution): correct value-ref resolution attribution and stale pdg-gating comments The value-ref contract comment claimed MethodRegistry resolution — the mechanism is the post-finalize findCallableBindingInScope walker owned by emitPropertyDispatchCalls (resolveReferenceSites skips these sites). Three 'only under --pdg' calleeIdSink comments were falsified by the #2437 gating change (callee-id-sink.ts's header was updated; these copies were missed). Review finding 23, #2522. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(ingestion): direct unit coverage for synthesizeCallableFlowCaptures The 1,100-line shared synthesizer had no test naming it — only downstream consumers were covered (review finding 24, #2522). Pins seed/invoke/ formal/argument emission, subscript container binding, store-gated member invokes, produced-value guards, and the bareNamesAreCalls knob over a minimal options object so assertions target the synthesizer's own semantics. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(resolvers): deepen shallow-language coverage; fix Kotlin/Swift reassignment gaps it exposed Adds the COBOL SET x TO y copy-branch scenario and conditional-assignment scenarios for Kotlin, C#, Swift, and Dart (10 languages previously had one generic case each — review finding 25, #2522). The new scenarios exposed two real capture gaps, fixed here: - tree-sitter-kotlin's 'assignment' node is fieldless, so nested reassignments (chosen = ::target inside a block) produced no flow facts; Kotlin's extractAssignment now decomposes it positionally. - tree-sitter-swift fields its assignment as target:/result:, neither in the shared fallback's field lists; both added. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(infra): literal-validation gate for callable-capture option Sets The #1920 gate validates query literals and exported configs but not the module-private *_CALLABLE_CAPTURE_OPTIONS Sets consumed by the shared synthesizer — a typo'd node type silently captures nothing (PHP shipped a dead 'optional_parameter'; review finding 26, #2522). Every <key>NodeTypes Set literal is now validated against its language's grammar; name-carrying sets (callableProtocolMethods, memberPointerOperators) are deliberately outside the contract. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(storage): centralize corrupt-fixture casts into makeStoreEntry The callable-flow store tests scattered 'as unknown as' double-casts per fixture (review finding 27, #2522; standing no-as-any rule). One typed helper now owns the single controlled escape hatch for building malformed serialization-boundary payloads. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(bench): refresh capture fingerprints after review fixes python-scope: the committed baseline (8d5c3699) never matched this branch's code — CI's benchmarks arm was red on the PR head (review finding 2/HIGH, #2522); regenerated (a99e69ab), scaling 1.04 in budget. scope-capture: ruby/cpp/swift/java/kotlin drifted from the review-fix commits (bare-name suppression, passing modes + ->* recovery, assignment fields, protocol narrowing, positional assignment); all 14 languages re-verified PASS with ratios <= 1.18 against the 1.5 budget. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(docs): untrack docs/plans working documents docs/ is gitignored (local working docs); the plan files were force-added past the ignore. Untracked from the index only — they stay on disk. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(golden): regenerate captures goldens after callable-flow review fixes The per-language digest guards (csharp/go/php/python/ruby/rust/swift) locked the pre-fix capture output; the review-fix series intentionally changed it — store-gated member invokes, subscript container binding, Ruby bare-name suppression, Swift assignment fields, positional pairing. Regenerated with UPDATE_GOLDEN=1; clean verification run 59/59; all other parity/golden guards (pipeline-graph, spring-route, python parity) pass untouched at 33/33. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ingestion): prototypes are callees, not callable value cells The cross-function visibility fix indexed EVERY signature-bearing declaration as a value binding — including plain function/method prototypes (void f(int);). Every call to a declared function then became an indirect invoke, and with emitCanonicalInvokeReference (C/C++) minted a free-call reference that resolved through the registry, bypassing the precise passes' two-phase/ambiguity/subobject suppression — eight phantom CALLS edges in the cpp resolver suite on CI. Only declarations whose binding identifier sits under a pointer/ parenthesized declarator (callable-typed variables like void (*fp)(int);) create value cells now. cpp resolver suite 331/331; callable-value-flow + C/C++ suites 181/181 (the cross-function fp regression still passes); cpp fingerprint rebaselined, both bench gates PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 17:20:02 +01:00
Gergo Magyar	6b013e7d30	fix(scan): lock in Rust publish order and guard PHP suffix roots ... Adds the missing #2481 Rust regression test (importer before definer), fails closed when a PHP namespace suffix matches directories under different roots, and points the baselines note at #2481/#2482. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-16 08:42:07 +00:00
Eva	99312dfff2	test(bench): rebaseline PHP import capture shape	2026-07-14 12:51:47 +07:00
Gergő Magyar	fa8ebf672e	fix: Java cast-wrapped and this.method() call edges (#2357) ... * fix: resolve Java cast-wrapped and this.method() call edges Two fixes for missing call edges in Java method resolution: 1. compound-receiver.ts — cast expression handling: - Strip (Type) cast wrappers from receiver text, tracking the outermost meaningful cast type - Resolve directly to the cast type class (not the field's declared type), since the cast narrows the receiver type - Add this.field chain walker for field-access receivers - Replace text → workingText throughout the function body 2. scope-resolver.ts: - Enable resolveThisViaEnclosingClass: true for Java (activates Case 0.5 in receiver-bound-calls.ts) Verified on a large-scale Java codebase with no regressions. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(scope-resolution): format compound-receiver.ts with prettier (#2353 review F10) Mechanical prettier --write from repo root — 6 brace-expansion sites and one ternary re-join, zero logic changes. Clears the quality/format CI failure that was blocking CI Gate on PR #2353. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(scope-resolution): pin working Java cast-receiver shapes (#2353 review F3) Fixture-backs the cast resolutions PR #2353 gets right — simple cast, nested/CFR cast, cast over this.field, and the deliberate declared-type fallback for a resolvable-shape cast to an unindexed type — each with a same-named decoy method on the receiver's declared type so later refactors cannot silently regress them. No resolver changes; tests are green as-is. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(scope-resolution): resolve nothing for unparseable cast types (#2353 review F1) A receiver paren-group that is type-shaped but unparseable — generic (List<String>), array (Foo[]), fully-qualified (com.example.Foo) — is a cast whose type cannot be looked up. Stripping it and falling through resolved the pre-cast expression's own declared type, emitting a confident wrong CALLS edge. Classification is now three-way per peel: simple identifier → capture (outermost wins), type-shaped-unparseable → resolve nothing (pre-#2353 behavior; noise casts after a captured type still win), anything else → not a cast, text left untouched. Cast candidates require a non-empty trailing expression, so plain parenthesized receivers never capture a cast type. Red-first: all four shapes reproduced the wrong edge before the fix; golden digest byte-stable after. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(scope-resolution): delete duplicate this.field walker, seed literal-this chain heads (#2353 review F4/F5/F7) A/B against the fixture corpus confirmed the generic per-segment walker (head resolved via the synthesized this typeBinding) already covers every method-body this.field chain — only initializer contexts (instance initializer block, field initializer) were walker-dependent, since no function scope exists there to carry a this binding. Deleting the duplicate walker removes the naive chainRest.split('.') (F5) and the widened fieldFallback use (F7) with it; the findEnclosingClassDef head seed is the deliberate residue covering initializer contexts — head-resolution only, the per-segment walk stays the single shared implementation. Post-seed edge set is byte-identical to pre-deletion. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(scope-resolution): gate cast stripping behind opt-in stripReceiverCastExpressions (#2353 review F2) Cast handling in resolveCompoundReceiverClass now runs only for languages that opt in via the new ScopeResolver toggle (default off); Java is the sole opt-in. The peel loop is extracted into the pure, exported stripCastWrappers helper (placed with the file's other pure string helpers) so it can be unit-tested directly. Non-opting languages see receiver text untouched — pre-#2353 behavior by construction (golden digest unchanged, TS/C++/C# suites green, 796/796). Shared-code comments are language-neutral per AGENTS.md; the contract JSDoc carries the classifier grammar, the second-language escalation rule, and the Case 3b/Case 4 pass-through non-goal. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(scope-resolution): cap cast-peel iterations in stripCastWrappers (#2353 review F8) MAX_CAST_PEEL = 16 (each cast level costs at most two peels, so this covers 8-level nesting with headroom — real cast nesting, including decompiler output, is a handful of levels). Each peel rescans the working text for its matching close paren, so pathological nested-paren input was O(N²); the cap bounds it at O(N·16). Exceeding the cap bails all-or-nothing with the original text (not-a-cast outcome). Adds the helper's first unit tests: 14 scenarios covering capture, unparseable shapes, redundant-paren unwrap, captured-type precedence, rawName no-op, over/under-cap, and unbalanced-paren termination. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(scope-resolution): revert Java resolveThisViaEnclosingClass, pin Case 4 bare-this dispatch (#2353 review F6/F9) Remove resolveThisViaEnclosingClass from the Java scope resolver: the toggle's own contract doc prescribes keeping it disabled where Case 4 (the synthesized this typeBinding) already handles this, and Case 0.5's C++-authored semantics (hiddenByName arity-hiding, method-before-field) provably bypass the interface-dispatch fan-out only Case 4 emits. A/B gate (new java-this-dispatch pinning fixtures): flag-off 7/7 green; flag-on 2/7 red (hiddenByName drops the this.greet overload site — masked by a free-call-fallback 'local-call' edge — and the interface-dispatch fan-out is missing). Corpus A/B over all 54 java-* fixtures: 2 fixtures differ — java-this-dispatch (reason 'local-call'→'global' on the bare-this overload site; +2 interface-dispatch fan-out edges flag-off) and java-this-field-chain (2 initializer-context bare-this ACCESSES reads emitted only by Case 0.5, which Case 4 cannot resolve — no synthesized this binding without a Function scope; the corresponding CALLS edges are unaffected via the F4 commit's literal-this head seed). Also (F9): insert Case 0.5 into the I4 case-order listings (contract + receiver-bound-calls header, now 8-case, marked gated) so the next flag flip is visible at review time; the two 'sole C++ language' comments are accurate again unedited. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(scope-resolution): restrict literal-this head seed to initializer contexts (#2353 review follow-up) Final-review finding (two independent reviewer angles): the literal-this chain-head seed landed ungated in shared code, so any language's this-headed chain in a scope without a synthesized this typeBinding — including contexts where the language DELIBERATELY leaves this unbound (object-literal methods, nested plain functions) — would seed from the lexically enclosing class. isInitializerContext now permits the seed only when no Function scope sits between the site and its class, which is precisely the field-initializer / instance-initializer shape the seed exists for. Adds a TS guard fixture pinning that an object-literal method's this.field.method() chain emits no fabricated edge (mechanism did not empirically reproduce even ungated — the restriction is conservative hardening, and the pin keeps it that way). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(scope-resolution): attach stripCastWrappers JSDoc, fast-path non-paren receivers (#2353 review nits) Two final-review nits: a blank line detached the helper's 30-line classification-contract JSDoc from the declaration (IDE hover showed nothing at call sites); and the gate now skips the helper call plus result allocation for the majority of receivers that cannot be casts because they do not start with '(' — the helper's own check stays as the safety net. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * bench(scope-capture): rebaseline Java fingerprint for new #2357 fixtures The scope-capture correctness fingerprint hashes captures over the java-* fixture corpus; the three fixture dirs added by this PR (java-cast-receiver, java-this-field-chain, java-this-dispatch) extend that corpus, so the fingerprint moves. Verified purely additive: with the three new dirs parked, the fingerprint reproduces the prior baseline byte-identically — no emit/capture behavior changed. --check now passes for all 14 languages. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: ww <ww@wwdeMacBook-Pro.local> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-02 17:19:33 +01:00
Gergő Magyar	49ffd8e316	feat(group): resolve cross-file named HTTP handlers (#2275) (#2277) ... * feat(group): resolve cross-file named HTTP handlers via unique repo-wide lookup U1 of #2275. When a provider's named handler is defined in a file other than its route registration (e.g. router.get('/x', listUsers) with listUsers imported), the registration file's symbols don't contain it, so resolution fell back to the file-level boundary. Add a repo-wide name query (RESOLVE_BY_NAME_QUERY, the label-union pattern from manifest-extractor) consulted only after the file-scoped lookup misses, and honored ONLY when exactly one Function/Method/CodeElement carries that name (zero/many → keep the file fallback, no wrong-symbol attribution). Provider-only, cached by name. 4 unit tests; 743 group tests pass. * test(bench): cross-file named handler scenario (end-to-end proof of #2275) U2 of #2275. Adds a fifth bench scenario: a backend route whose handler (listUsers) is imported from another file than its registration, with a frontend consumer. Asserts the provider resolves to the handler via the repo-wide unique name lookup (sym=listUsers, uid set) and that the cross-repo trace is symbol- precise (no file-level fallback). verify.mjs now 12/12 on the real pipeline. * fix(review): apply autofix feedback ce-code-review (autofix) — no correctness/security findings; applied test-coverage + robustness fixes: repo-wide query throw -> empty (no exception); by-name lookup cache fires once across same-named handlers; consumers never consult the repo-wide lookup; same-file-wins now asserts the global path is bypassed; bench provider find scoped by contractId; clarified the uniqueness-guard comment. 167 extractor tests. * fix(group): tri-review fixes for cross-file handler resolution Two-engine PR tri-review (Claude swarm+ce, Codex gpt-5.5 swarm+ce+adversarial) on #2277. Correctness/security clean (injection refuted, bind-param). Fixes: - Named-provider wrapper-attach (Codex swarm P1 + Claude ce-adversarial, cross-engine): a named handler that fails both name lookups no longer falls through to line-span containment, which attached the route to the enclosing registrar (e.g. a setupRoutes() wrapper) instead of leaving it empty. Containment now applies only to consumers and inline-arrow providers. - CodeElement/ORM empty-file nodes (Claude ce-adversarial reproduced + ce-maintainability): RESOLVE_BY_NAME_QUERY gains 'AND n.filePath <> ""' so a handler name colliding with a synthetic ORM model node (orm.ts emits filePath:'') neither resolves to an edge-less node nor inflates the uniqueness count and masks the real handler; + a defensive empty-filePath guard in resolveSymbolByNameUnique. Added LIMIT 2 (Codex swarm P3 + ce-maintainability) to bound homonym materialization (count guard stays exact). - Documented the aliased-import limitation (Codex adversarial): the route-site identifier is the local alias, fix deferred to #2275 import narrowing. - README expected verdict 9/9 -> 12/12 (Codex swarm+ce P3). Tests: +3 (wrapper-no-attach, empty-filePath reject, empty-registration-file resolves) covering the cross-engine gaps. 170 extractor / 748 group+integration pass; bench 12/12 end-to-end. * feat(group): import-pinned handler resolution (fixes deferred alias case) Resolves the tri-review's deferred item: cross-file named handlers are now pinned to their import's target module instead of resolved by name alone, so aliases and names that collide with a local symbol resolve correctly. - node.ts builds a local-binding -> {declared name, module} map from the file's named imports; the express handler emits the DECLARED name + a handlerImport {name, module} (HttpDetection gains the optional field). - resolveDetectionSymbol gains an imported-handler rung: resolveImportedSymbol pins to the import's target file via RESOLVE_IN_MODULE_QUERY (n.name= AND filePath STARTS WITH the resolved module path), unique-match only. An imported handler never uses file-scoped lookup (it is defined elsewhere); on a module miss it falls back to a unique repo-wide name match on the DECLARED name, then null. Relative imports only; bare/non-relative imports keep the repo-wide fallback. Cached by (module-prefix, name). - Closes the Codex-adversarial alias finding: import { listUsers as handleUsers } + an unrelated handleUsers no longer mis-resolves — the route resolves to the imported listUsers in its module, and the alias is never looked up. - Shared toResolvedSymbol helper (dedups the row->symbol + empty-filePath guard). Tests: alias-resolves-to-declared-name + module-pin-resolves-ambiguous-name unit tests; same-file-wins reworked to a genuinely LOCAL handler. Bench scenario 6 (aliased import with a decoy) proves it end-to-end. 172 extractor / 751 group+integration pass; bench 14/14. * feat(group): import-pinned resolution for Python aliased handlers Extends the JS/TS import-pinning to Python. The Python analog of express router.get(path, handler) is Flask's imperative add_url_rule(view_func=...), whose view is often an imported (aliased) symbol. - New Flask add_url_rule provider pattern (path + view_func handler + methods; default GET, methods=[...] honored). High Flask-specificity keeps false positives low — unlike bare path()/Route(), which the plugin deliberately leaves to graph Route nodes. - buildPythonImportMap resolves 'from .mod import name as alias' (and plain 'from mod import name') to the declared name + raw module spec. - resolveModuleBase generalized to two relative-import dialects: path-style (JS './h/users') and dotted (Python '.handlers.users', '..pkg.users' — leading dots are package levels). Bare/absolute imports keep the repo-wide fallback. - Django stays graph-resolved (handlerSymbolId); FastAPI/Flask decorators stay same-file (decorated function). This only adds the imperative imported-view case Python lacked. Tests: Flask aliased add_url_rule unit test (relative dotted module pinned, alias never queried) + bench scenario 7 (end-to-end, 16/16). 173 extractor / 752 group+integration pass.	2026-06-23 12:12:49 +01:00
glier	d27fd11c4b	fix(lang-kotlin): support fun interface extraction via tree-sitter-kotlin re-vendor (#2271) ... * fix(lang-kotlin): support `fun interface` extraction via tree-sitter-kotlin re-vendor Vendored tree-sitter-kotlin@0.3.8 (fwcd) parsed `fun interface Foo` as an ERROR node and dropped the declaration plus its abstract method, so functional (SAM) interfaces were never extracted. The fix landed upstream in fwcd/tree-sitter-kotlin#169 (closes #87), merged to main 2025-04-25, but is not in any npm release (latest tag 0.3.8; main is the unreleased 0.4.0). Re-vendor the grammar from the unreleased fwcd main commit c8ac3d26: - refresh src/{parser.c,scanner.c,node-types.json,tree_sitter/*.h} and bindings/node/index.js; bump the vendor version 0.3.8 -> 0.4.0; record the pinned SHA + rationale in _vendoredBy and the vendor README. - switch the prebuild workflow's kotlin registry kind 'npm' -> 'vendored' (the fix is unreleased on npm, so prebuilds must build from the vendored C source, like swift/dart/proto). - add a hold to .github/vendored-grammars.json so the weekly auto-update monitor does not strict-inequality-revert the pin to the broken npm 0.3.8 (isNewer compares 0.3.8 != 0.4.0). - add 3 regression tests + a fixture asserting fun interfaces extract as Interface nodes with their abstract methods, and that plain-interface heritage still resolves. Existing KOTLIN_QUERIES need no change: the new grammar models `fun interface` as a class_declaration with an "interface" keyword child (plus an extra "fun" modifier child), which the existing interface rule already matches. Full Kotlin suite green against the new grammar (300 unit/cfg/resolver + 233 integration). NOTE: prebuilds/ are intentionally not in this commit. The version bump auto-triggers .github/workflows/build-tree-sitter-prebuilds.yml, which regenerates all 6 platform binaries from the vendored source in a separate PR. Until that lands, CI loads the committed 0.3.8 prebuild, so the new kotlin tests are red and the grammar change is inert at runtime. Merge the prebuild PR first or together. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(ci): count kotlin's vendored hold as a 0.25-readiness blocker The kotlin `hold` added in the previous commit makes the tree-sitter upgrade-readiness report count it as a blocker — the report treats every held vendored grammar as frozen below a runtime upgrade (same as the intentionally-pinned tree-sitter-cpp and the ABI-held tree-sitter-c), "in-range ABI or not". So the report's blocker count goes 2 -> 3. Update the hardcoded count in test_issue_update_summary_regex_matches_current_report (and the _render_report docstring) accordingly — exactly as that test instructs: "if a grammar is added/removed or a pin/hold changes, update the expected counts". kotlin's ABI (14) is in range; the hold is what flags it, with the reason recorded in .github/vendored-grammars.json. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(ci): refresh kotlin baselines for the grammar bump Two committed baselines pinned the pre-bump kotlin state and broke when the grammar was re-vendored (0.3.8 -> 0.4.0): - cli-commands.test.ts pinned the vendored kotlin package version at 0.3.8 -> update to 0.4.0. - bench/scope-capture/baselines.json: the new kotlin-fun-interface fixture joins the lang-resolution/kotlin-* corpus AND the new grammar parses `fun interface` as a class_declaration (not an ERROR node), so the capture fingerprint drifts. Rebaselined to the NEW grammar's fingerprint (verified by building the vendored parser.c against tree-sitter@0.21.1 and running measure.mjs --check); scaling ~0.83 (linear). Like the fun-interface integration tests, the scope-capture --check passes only once the regenerated prebuilds land; until then CI loads the committed 0.3.8 binary, so it stays red. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * ci(prebuilds): rebuild + commit grammar prebuilds into the PR on vendored-source change build-tree-sitter-prebuilds.yml previously rebuilt a grammar's native prebuilds only when its package.json VERSION bumped, and delivered them via a separate bot PR. Now any change to the vendored grammar source re-cuts the prebuilds and they ride into the same PR. - Trigger on any build-affecting change under gitnexus/vendor/tree-sitter-*/** (parser.c, grammar.js, binding.gyp, scanner, bindings), not just version bumps. The prebuilds/ subtree is negated in the paths filter AND excluded from the guard's source diff, so the bot's own prebuild commit can never retrigger the workflow (no build -> commit -> build loop). - The guard builds a grammar when its recorded version changed OR its vendored source changed vs the PR base. - Same-repo PRs get the rebuilt prebuilds committed straight onto their own head branch (included in the SAME PR) via a non-force push that only adds a commit on top of head. Manual dispatch still opens a fresh chore/ PR; fork PRs stay artifacts-only (a bot cannot push into a fork branch). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * ci(prebuilds): deliver rebuilt prebuilds to fork PRs via a trusted workflow_run stage A fork PR's producer run has a read-only token and no secrets, so it can build and validate the prebuilds but can't commit them. Add the safe two-stage handoff that mirrors the pr-autofix producer/publish split. - build-tree-sitter-prebuilds.yml (untrusted producer): on a fork PR, upload a pr-meta artifact (schema, pr_number, head_sha, head_ref, head_repo, base_repo) alongside the prebuild artifacts. Values flow through env + jq, never interpolated into a shell. - commit-fork-prebuilds.yml (trusted, workflow_run): downloads ONLY the artifacts (never executes fork code — it checks out the pinned HEAD SHA solely to add files), allowlist-validates every metadata field, cross-checks identity against the workflow_run authority (head_sha / head_repo / pr_number, via commits/{sha}/pulls for forks), then pushes the prebuilds onto the fork head branch with --force-with-lease + http.extraheader auth. No PAT: this works when the contributor left "Allow edits by maintainers" on; on push failure it posts a sticky comment telling them to enable it or commit the downloaded artifacts. zizmor: allowlist commit-fork-prebuilds.yml's workflow_run dangerous-trigger with the documented mitigation, matching the existing ci-report / pr-autofix entries. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(vendor): rebuild tree-sitter-kotlin prebuilds for the re-vendored fun-interface grammar The fun-interface re-vendor changed vendor/tree-sitter-kotlin source but left main's old (0.3.8) prebuilds in place, so all 6 platform binaries were stale relative to the new parser. Replace them with the freshly cross-built + ABI-validated binaries from build-tree-sitter-prebuilds run 28010841458 — each .node was require()-loaded and parsed a snippet on its target platform-arch before upload. This is the manual equivalent of the commit-fork-prebuilds.yml delivery, which can't run for this fork PR until it lands on main. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(lang-kotlin): read extension-function receiverType from the re-vendored grammar's `receiver` field The fun-interface re-vendor changed the kotlin AST: an extension function's receiver is now a `receiver_type` exposed via a named `receiver` field, where the old grammar emitted a bare user_type before the name. extractReceiverType only matched the old shape, so receiverType came back null (method-extraction.test.ts > Kotlin MethodExtractor > extracts receiverType). Prefer the `receiver` field (unwrapping it), and keep the old child-scan — now also recognizing `receiver_type` — as a fallback. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>	2026-06-23 10:01:28 +01:00
Gergő Magyar	1a03c8527a	feat(group): cross-repo call trace using PDG (#2269) ... * refactor(group): extract shared resolveBridgeNeighbors from cross-impact Lift the uid-filtered consumer<->provider ContractLink join (direction + queryBridge + row normalization + confidence sort) out of runGroupImpact's inline Phase-2 block into an exported resolveBridgeNeighbors helper. Behavior is unchanged for impact; the helper becomes the single shared bridge join so the upcoming cross-repo trace path never forks its own copy of the neighbor Cypher. Empty uid sets short-circuit without a DB round-trip. Adds direct coverage (real bridge via writeBridge/openBridgeDbReadOnly) for both directions plus the empty-set and unknown-uid edges. * feat(group): cross-repo trace stitching (groupTrace + runGroupTrace) Add GroupService.groupTrace and the pure runGroupTrace engine that stitches per-repo CALLS/HAS_METHOD trace segments across one ContractLink boundary in the group bridge: from --(local trace)--> consumer --(ContractLink)--> provider --(local trace)--> to - Resolves from/to across all members (symbol node id == bridge symbolUid); same-repo endpoints delegate to a single local trace with no crossing. - Single boundary crossing (MAX_SUPPORTED_CROSS_DEPTH); deeper crossDepth is clamped with a note, mirroring cross-impact. - Discriminated GroupTraceResult union (ok|not_found|ambiguous|error) with per-hop repo tags, a typed crossings[] entry, and centralized degraded-state note constants (TRACE_NOTES). No . - Trace-specific pair query (keeps BOTH crossing endpoints) lives in this module; the uid-filtered neighbor join (resolveBridgeNeighbors) is reused where it fits. ensureBridgeReady exported for reuse. - New GroupToolPort methods (trace/resolveSymbol/pdgFlows) are optional so existing port mocks keep type-checking; runGroupTrace guards on presence. PDG enrichment is wired as an opt-in hook (enrichSegment) — the port method is stubbed until U4. Covered by unit tests over a real bridge + mocked port. * feat(group): route trace tool to groupTrace on @group syntax Wire the cross-repo trace through the existing @group dispatch: - callTool routes trace with an @-prefixed repo to callToolAtGroupRepo, which forwards from/to/uid/file/maxDepth/includeTests plus the experimental pdg/crossDepth flags to GroupService.groupTrace. Member path in @group/path is advisory for trace (resolution is whole-group). - Port gains trace/resolveSymbol/pdgFlows adapters. resolveSymbolForGroup wraps the shared resolveSymbolCandidates so groupTrace can locate the member repo and recover each endpoint node id (== bridge symbolUid). pdgFlowsForGroup is a degraded stub here (call-level only); U4 implements the REACHING_DEF walk. - trace tool schema documents the @group entry point, pdg, and crossDepth. Single-repo trace is untouched. Covered by dispatch-routing tests (@group -> groupTrace, non-group stays local) and tool-schema assertions. * feat(group): opt-in PDG data-flow enrichment for cross-repo trace Implement _pdgFlowsForGroupImpl: the real REACHING_DEF anchor walk that backs the port pdgFlows adapter (replacing the U3 call-level stub). When pdg:true and the segment repo has a flows PDG layer, the boundary-adjacent segments carry their intra-procedural def->use hops: - Anchors by the boundary symbol UID (precise; avoids the by-name ambiguity the resolveBlockAnchor path can hit), then reuses the same span-anchored, bind-param-only flows query as pdg_query (BasicBlock id-prefix + [start+1, end+1] line window; no rel-property index, so the anchor IS the bound). - Stays intra-procedural: data flow never crosses the repo boundary. - pdgStampForMode probe: false -> available:false (degrade with note); the trace stays ok. Any query failure is swallowed (enrichment is auxiliary). Covered by runGroupTrace enrichment tests: dataFlow attached on opt-in, degraded note when no layer, and no pdgFlows call when pdg is omitted. * test(group): evaluation-first cross-repo trace e2e (two real indexes) End-to-end gate for the cross-repo trace: stands up two real LadybugDB indexes (consumer 'frontend' + provider 'backend'), a real ContractLink bridge, and a real LocalBackend with both repos registered, then drives the public callTool('trace', { repo: '@grp', pdg: true }) and asserts: - the stitched checkout -> callUsers -(CONTRACT_LINK)-> handleUsers -> getUsers path, each hop tagged with its member repo - real REACHING_DEF data-flow enrichment of the consumer segment (userId) - a degraded 'No PDG layer in app/backend' note (provider has no PDG layer) - single-repo trace against one member is unchanged (no crossings) Hand-persists the minimal real graph (deterministic; a full two-repo analyze is heavier than this gate needs) and exercises real Cypher across resolveSymbolCandidates, _traceImpl, the bridge pair query, and _pdgFlowsForGroupImpl. Windows-skipped (describeReopen) and registered in the cross-platform native-lbug set. Scoped to a single @group call: opening bridge.lbug read-only a SECOND time in one process currently fails (shared bridge open/close lifecycle, also affects impact @group) — the pdg-omitted/clamp variants are unit-covered. * docs(group): document cross-repo trace + PDG enrichment ARCHITECTURE.md: trace is now group-aware; describe the @group cross-repo stitch over a single ContractLink boundary (CONTRACT_LINK hop, crossings[], crossDepth clamp), the opt-in experimental PDG REACHING_DEF enrichment of boundary-adjacent segments, the symbolUid-grain join between the two stores, and the deferred full cross-program (SDG-like) data flow. PIPELINE.md: add the cross-trace consumer of the bridge with its pair-query rationale. Does not touch gitnexus/CHANGELOG.md (release-owned). * fix(review): apply autofix feedback Apply safe_auto findings from ce-code-review (run 20260622-094243): - local-backend.ts: drop (r: any) in _pdgFlowsForGroupImpl row map; coerce hop line via Number() so a nullish LadybugDB cell can't surface NaN. - tools.ts: advertise the forwarded param in the trace schema and add crossDepth maximum:10 (schema now matches what groupTrace reads). - cross-trace.ts: parallelize per-member resolveSymbol/resolveRepo with order-preserving Promise.all (matches groupContext/groupQuery); add a note when pdg:true is passed to a same-repo trace (PDG only enriches at a cross-repo boundary). - tests: remove / tighten (no-any rule). Residual gated_auto/manual findings (unbounded crossing query + loop, whole-file PDG widening on absent span, error-vs-no_path masking, top-level try/catch parity, helper dedupe, branch-coverage gaps) are recorded in the run artifact for the PR body. * fix(group): skip CHECKPOINT on read-only bridge close so it can reopen Root cause of the in-process bridge.lbug reopen failure (which broke repeated @group impact/trace calls in a long-lived MCP server): closeBridgeDb issued CHECKPOINT on EVERY handle, including read-only ones. A CHECKPOINT on a read-only connection has nothing to flush but leaves a WAL/shadow lock artifact that makes the next read-only open of the same path fail (openBridgeDbReadOnly returns null -> 'Could not open bridge.lbug read-only'). Reproduced: open -> query -> closeBridgeDb -> open again returned null only when the close ran CHECKPOINT; a non-checkpoint close reopened fine, and the raw native open/close cycle was never the problem. Fix: tag read-only handles (BridgeHandle._readOnly, set by openBridgeDbReadOnly) and skip CHECKPOINT for them in closeBridgeDb. Writable handles are unchanged (they still flush before close). This is the shared bridge-db close path, so impact @group benefits identically. - Regression test in bridge-db.test.ts: open/query/close/open/query/open in one process now succeeds. - Re-enabled the second @group call in cross-trace-e2e.test.ts (was scoped to a single call for this very limitation). * fix(group): bring bridge-db close to parity with the core adapter safeClose The bridge open/close cycle was less robust than the main graph DB's: closeBridgeDb closed the connection/database but skipped the post-close steps the core adapter's safeClose performs, so a rapid in-process reopen could race the OS handle release (Windows) or an orphaned WAL sidecar. That gap is why the close-then-reopen tests had to skip Windows. closeBridgeDb now mirrors safeClose after closing the handle: - waitForWindowsHandleRelease(dbPath): probe the file (+ .wal) until the residual Windows lock clears, so the next open does not race (warns if the budget is exhausted, matching the core adapter). - finalizeLbugSidecarsAfterClose(dbPath): quarantine an orphaned WAL (shadow missing) so the next open replays a consistent file. Both helpers are the same ones safeClose uses (Windows-proven via the core adapter CI), and the bridge read open already retries transient locks. Combined with the read-only CHECKPOINT skip, the bridge reopen is now robust on every platform, so the close-then-reopen tests run on all platforms (Windows CI exercises them via the cross-platform subset). No write-path behavior change; Linux/macOS unaffected. * fix(group): bound cross-repo crossing fan-out (LIMIT + segment memoization) Address the top review residual: the bridge crossing query was unbounded and the crossing-selection loop could run an O(2*N) sequential trace-BFS over every ContractLink between a repo pair. - CY_CROSSINGS_BETWEEN now ORDERs BY confidence DESC and LIMITs to MAX_CROSSINGS_TO_TRY + 1; listCrossingsBetween slices to the cap and reports truncation. Exceeding the cap surfaces a note (no silent truncation), keeping the highest-confidence crossings. Aligns with the repo's anchored+LIMIT-bounded query discipline (LadybugDB has no rel-property index). - The home-repo segment (from -> consumer) depends only on the consumer uid and the target-repo segment (provider -> to) only on the provider uid, so each is memoized by that uid. Many crossings sharing a consumer/provider (one client call linked to several providers) now cost one trace per distinct endpoint instead of one per crossing. A consumer whose segment already failed is skipped for every later crossing that shares it. Test: two links sharing a consumer (first provider unreachable, second reachable) assert the from->consumer segment is traced exactly once and the second crossing wins. * fix(group): restore Windows skip for bridge reopen tests; drop ineffective close-side probe The previous commit flipped the bridge close-then-reopen tests to run on Windows, betting that a close-side waitForWindowsHandleRelease + finalizeLbugSidecarsAfterClose probe (mirroring the core adapter safeClose) would make the in-process reopen work there. Windows CI proved otherwise: 4 writeBridge->openBridgeDbReadOnly tests fail ('expected null not to be null' — the read open returns null). The writable-close -> read-open handoff plus writeBridge's atomic sidecar rename does not release the OS file handle before the read open races, and the existing open-side LBUG_OPEN_RETRY only retries lock-pattern errors, not the post-rename sidecar database-id mismatch. macOS passes; the core adapter's own reopen also passes — this is bridge+Windows specific. - Revert itLbugReopen to the Windows skip (the pre-existing, correct state). - Remove the close-side probe + finalize from closeBridgeDb: it did NOT close the Windows gap, and reviewers flagged it for hot-path latency (finalize ran on every close, all platforms) and safeClose duplication. - KEEP the load-bearing fix — skipping CHECKPOINT on read-only handles — which fixed the reproduced Linux/macOS in-process reopen artifact (the real bug). Net: Linux/macOS repeated @group impact/trace works in-process; Windows in-process bridge reopen remains a documented limitation (unchanged from before this PR). * fix(group): surface degraded members + cap truncation; honest crossDepth schema Address the cross-engine-corroborated tri-review findings (Codex + Claude): - resolveAcrossMembers / runGroupTrace now track member repos that could NOT be queried (resolveRepo or resolveSymbol threw) and, when the result is not_found, attach a degraded-member note. A transient/corrupt member DB is no longer silently reported as a clean 'symbol absent' not_found. (Codex B1+B3 + ce-reliability.) - The cross-repo not_found now carries a programmatic truncated:true flag (and a clearer suggestion) when the MAX_CROSSINGS_TO_TRY cap was hit, so a consumer can distinguish 'no path' from 'cap may have hidden a connecting ContractLink'. (Codex B3 + ce-adversarial + ce-api-contract.) - trace tool schema: crossDepth maximum 10 -> 1 to match the implementation's single-hop clamp (the schema previously advertised an unsupported 2-10 range). (ce-api-contract, conf 100.) Test: a member whose resolveSymbol throws yields not_found WITH a degraded note naming the unreachable repo (if-free responder map). * docs(group): clarify trace @group/memberPath is advisory (resolves all members) Tri-review (Codex ce, conf 100) caught a doc/impl inconsistency: ARCHITECTURE.md lumped trace with query/context/impact as honoring @group/memberPath member scoping, but cross-repo trace resolves from/to across ALL members (the member path is advisory). Clarify the behavior and point to from_uid/to_uid for disambiguating same-named symbols across members. * feat(group): file-level boundary fallback so cross-repo trace works on HTTP contracts Benchmark (bench/cross-repo-trace/) running the REAL pipeline (runFullAnalysis --pdg -> real syncGroup -> trace @group) found that cross-repo trace returned not_found for real HTTP links even though sync built the correct ContractLinks: HTTP (and other source-scan) contracts hardcode symbolUid:'' (http-route-extractor), and both cross-trace AND cross-impact join crossings by Contract.symbolUid, which never matches an empty uid. (Pre-existing — impact @group has the same gap.) Fix: when a crossing's symbolUid is empty, fall back to the contract's FILE — if the user's from/to resolves into the contract file, that endpoint anchors the boundary. CY_CROSSINGS_BETWEEN now returns consumer/provider filePath; a crossing is kept if it can be anchored by uid OR file on each side; a fileBoundaryFallback note flags that the boundary is file-level, not symbol-precise. This makes the common 'trace from=<calling fn> to=<handler fn>' case work end-to-end (verified: fetchUsers -> listUsers stitches with a CONTRACT_LINK hop + PDG enrichment, 2/2). Limits (documented in the bench README + the note): anonymous handlers have no named target; when several contracts share files the file fallback may attach the wrong contractId to a correct path. The proper upstream fix is to populate symbolUid in the HTTP extraction (benefits impact too) — the bench is its gate. Adds a unit test pinning the empty-symbolUid file-fallback stitch. * fix(group): resolve HTTP contract symbolUid by containment (fixes cross-repo trace + impact) Addresses the root cause behind the cross-repo trace file-fallback: HTTP contracts hardcoded symbolUid:'' (http-route-extractor), so both cross-trace and cross-impact — which join crossings on Contract.symbolUid — could not traverse HTTP links. (Also found: the pre-existing graph-assisted resolution queried the wrong edge, CONTAINS instead of DEFINES, so it never resolved a uid either.) Now the extractor resolves each detection to a real symbol: - HttpDetection carries the call-site line (node.ts sets it on every express/ fetch/axios/jquery/nest detection; express also captures the handler arg). - resolveDetectionSymbol resolves the named handler first, else the innermost Function/Method whose line span encloses the call (consumer = the function containing the fetch; provider = the named/inline handler), over the correct File-[DEFINES]->symbol edge. Base-tolerant (0- vs 1-based startLine). - Wired into both source-scan and graph-assisted provider/consumer paths. Verified end-to-end (bench/cross-repo-trace): all 4 contracts now carry real uids, trace is symbol-precise (GET pair -> http::GET, POST -> http::POST, no file-fallback note), and impact @group fans out (cross_repo_hits 0 -> 1). The cross-trace file-level fallback remains as the secondary path for truly anonymous handlers. Adds 2 containment unit tests; 738 group/integration pass. Languages other than JS/TS still resolve providers by handler name; their consumers fall through to the file fallback until their plugins set the line. * fix(group): extend HTTP symbolUid containment to all languages + nested methods Completes the symbolUid resolution across every bundled HTTP plugin: Python, Go, PHP, Kotlin and Java now set the call-site line on their consumer (and Feign/ named) detections, so their HTTP contracts resolve to the containing function the same way Node/TS already did. Also generalizes the containment query: it now matches Function/Method/CodeElement by filePath (UNION ALL) instead of File-[DEFINES]->symbol. The DEFINES edge only reaches a file's TOP-LEVEL symbols, so methods nested in classes (Java/Kotlin — File defines the class, the class defines the method) were invisible; matching by filePath reaches them. Verified against a real index (LadybugDB supports the UNION); JS/TS still fully symbol-precise (bench 2/2), 709 group tests pass. Residual is now only the inherent case — a fully anonymous handler with no named callee — which keeps the cross-trace file-level fallback. * feat(group): destination trace — follow a consumer to an anonymous handler Handles the one inherent residual: an anonymous route handler (`router.get('/x', (req,res) => …)`) has no symbol node at all (the file holds only a Const + PDG BasicBlocks), so it can never be named as a trace `to`. Adds a DESTINATION TRACE: omit to/to_uid/to_file on an @group trace and `trace from=<consumer>` follows the consumer's outgoing HTTP call across the bridge and reports where it lands — by route + file:line, with a notes[] entry flagging the handler as anonymous. Implemented as a new branch in runGroupTrace (p.destination) backed by CY_CROSSINGS_FROM (all ContractLinks leaving the consumer repo) + stitchToDestination; the provider endpoint is labelled '<METHOD /path handler>' when its symbolName is a generic token/file basename. The MCP routing already omitted an absent `to`, so only the schema docs changed. parseTraceParams now treats a missing `to` as a destination trace instead of an error. Verified end-to-end: anonymous fixture reports 'app/frontend:fetchUsers -> app/backend:<http::GET::/api/users handler>'; named fixture lands at the real function. Adds 2 unit tests; 915 group tests pass. * fix(group): tri-review fixes for cross-repo trace + symbolUid resolution Two-engine tri-review (Claude swarm+ce + Codex GPT-5.5 swarm+ce+adversarial) surfaced these; cross-engine-corroborated unless noted. Correctness (P1, all four lanes): destination trace reported the WRONG endpoint — an empty-uid consumer made trace(from->from) trivially succeed, so the highest- confidence same-file crossing won regardless of which call `from` makes. stitchToDestination now collects ALL connecting crossings, prefers symbol-precise hits, and returns `ambiguous` (with candidates) when it cannot disambiguate. Correctness (P1, Codex): resolveDetectionSymbol early-returned null when d.line==null, blocking NAME resolution for named providers that set no line (Spring/Go/etc.). Name resolution now runs first; only containment needs a line. Correctness (P2): resolveContainingSymbol OR-ed `line` and `line-1`, which could mis-pick a one-line sibling. It now probes the base-correct `line-1` first and falls back to `line` only if nothing matches. Correctness (Codex): anonymous Express handlers emitted name:'handler' and could attach to an unrelated fn literally named `handler`. node.ts now emits name:null for non-identifier handlers (containment-only). Robustness: drop the first-symbol-in-file pickSymbolUid guess from the graph consumer/provider paths (a wrong uid would win the contractId merge); remove the dead CONTAINS_QUERY fallback (CONTAINS is File->Folder, never a symbol) + the now -unused pickSymbolUid/handlerName; seed destination notes with degraded-member notes so a successful trace still surfaces them; providerLabel takes providerUid so a resolved fn named `handler` is not mislabeled anonymous, and only true file basenames (known extensions) — not any dotted name — count as anonymous. API contract: a single-repo trace with no `to` now returns an actionable error (destination trace is @group-only) instead of "symbol 'undefined' not found". Maintainability/tests: narrow asLocalTrace per-field (drop as-unknown-as); fix the PR's lone as-any (vi.mocked); if-free e2e teardown; qualify the bench README. Adds ambiguous-destination, anonymous-handler-no-false-name, and single-repo-no-to tests; redirects graph mocks CONTAINS->UNION ALL. 918 group/integration pass. * fix(group): carry degraded-member notes through SUCCESSFUL group traces A reviewer (koriyoshi2041, PR #2269) correctly flagged that degraded-member resolution was surfaced only on not_found, not on a successful ok result. Group trace resolves names across ALL members, so an ok is 'unique among the members we could query' — if a member that threw during resolveSymbol also holds from/to, the real answer could be ambiguous. The destination path already seeded the note (prior commit); this extends it to the same-repo and cross-repo success paths by seeding the dispatch notes with degradedNotes([...fromRes.degraded, ...toRes.degraded]). Adds a regression test: reg-be throws while a same-repo trace succeeds in reg-fe; the ok result now carries the 'could not be queried' degraded note (app/backend). * test(bench): cover all implemented cross-repo trace cases in one runner Replace the single named-handler script with a self-contained verify.mjs that generates each fixture inline and exercises every implemented end-to-end case against the real analyze -> sync -> trace/impact pipeline, asserting PASS/FAIL (exit non-zero on failure). 10 checks across 4 scenarios: - named handlers: 4/4 symbolUid resolved; symbol-precise GET vs POST crossing selection; destination trace lands at the named handler. - anonymous handler: empty symbolUid; destination trace reports it by route with the anonymous note. - impact @group fan-out (cross_repo_hits >= 1). - multi-language (Python Flask + requests): link built, cross-repo trace stitches, and the file-level boundary fallback is exercised when the provider has no uid. Ambiguous-destination and degraded-member paths need synthetic inputs the real analyzer cannot produce, so they stay in the unit suite (documented in the README + script header). Removes verify-named.mjs + fixtures-named/ (folded inline). * test(group): pin destination degraded-success + precise-tier ambiguity Adds the two regression guards koriyoshi2041 requested on PR #2269 after the degraded-on-success fix: - destination trace success with a degraded member: reg-fe resolves from and follows the link to an anonymous handler while reg-be throws; the ok result carries the anonymous endpoint AND the 'could not be queried' degraded note, so the no-to path stays aligned with explicit to traces. - multiple PRECISE destination hits: one from reaches two consumers with resolved uids linked to different routes; the result is ambiguous (role: to) with both route candidates. Distinct from the existing file-level ambiguous test, this pins the stronger precise tier against a future change silently picking the highest-confidence destination. Both already pass against current behavior; 716 group tests pass.	2026-06-23 07:54:13 +01:00
henry201605	b16ec344f7	perf(group/http): skip source parse for graph-covered route files (#2138 Part 2) (#2265) ... * feat(routes): resolve + persist handler symbol on Route nodes (#2138 part 2, WIP) Part 2 groundwork for #2138: give the graph-assisted HTTP provider path the handler symbol directly, so it no longer re-parses source to recover the handler name. (The remaining parse-skip in extract() + a call-count benchmark land in a follow-up commit.) - ExtractedDecoratorRoute gains `handlerName`; the Spring extractor captures the decorated method's name (the method_declaration node is in hand). - New `resolveRouteHandlerSymbols` (call-processor) resolves each route's handler to a real symbol UID, keyed by normalized route URL — Laravel framework routes (controller + method) and decorator routes (Spring/FastAPI) both reduce to `(filePath, name) -> nodeId`. Threaded through the parse phase onto `ParseOutput.routeHandlerSymbols`. - routes phase stamps `Route.handlerSymbolId`; persisted end-to-end (schema + Route CSV row + getCopyQuery COPY columns), mirroring Part 1's `method`. - HttpRouteExtractor: `HANDLES_ROUTE_QUERY` returns `handlerSymbolId`; `extractProvidersGraph` uses it as the authoritative symbol and SKIPS `getDetections()` for resolved rows (CONTAINS is a cheap graph lookup for the display name only — no tree-sitter parse). Fully backward compatible: an unresolved/old-index route with no `handlerSymbolId` keeps the source-scan fallback. - Extracted `normalizeExtractedRoutePath` to `route-extractors/route-path.ts` (shared by routes phase + resolver without an import cycle). - SCHEMA_BUMP 6->7 (ParseWorkerResult gained `handlerName`); regenerated the emit-persistence byte-identity baseline (route.csv header gained two columns). - Tests: Spring pipeline asserts the Route node carries a handlerSymbolId resolving to the handler method; extractor fast-path test proves the handler resolves with zero source detections. Refs #2138 * perf(group/http): skip source parse for graph-covered route files (#2138 Part 2) Builds on the persisted Route.handlerSymbolId (U0–U3a). When a file's HANDLES_ROUTE rows all resolve a handler symbol AND its language plugin declares routeCoverage: 'complete' (Java/Python/PHP), the graph is authoritative for that file's providers, so the source scan + tree-sitter parse can be skipped — the scan would only re-discover routes the graph already has. This is the measurable parse reduction #2167 could not show. Consumer safety: routeCoverage: 'complete' asserts *provider* Route-node completeness only. The scan() of those same languages also emits consumer detections (RestTemplate/WebClient/OkHttp/Feign, Guzzle/Http::, requests/httpx), and ingestion's FETCHES edges are JS/TS-only — so the graph cannot back up server-side consumers. A provider-covered controller that also calls out would otherwise lose its consumer contract. Guarded by a cheap, parse-free text gate. - types: HttpLanguagePlugin gains - routeCoverage?: 'complete' | 'partial' (default 'partial') - hasConsumerSignals?(content): false only when the raw source provably has no outbound-HTTP call this plugin detects (conservative). - java/python/php: mark routeCoverage 'complete' + implement hasConsumerSignals with a token regex over their consumer idioms. - http-route-extractor: run the graph provider pass first to build a coveredFiles set; then keep a file covered only when hasConsumerSignals(content) === false (read via readSafe, no parse). scanFiles = files not covered → drives collectProjectDetections + both source scans. Fail-open per file: any unresolved row, a 'partial' language, a positive consumer signal, a missing hook, or an unreadable file leaves the file in the scan set. The orchestrator names no languages — token knowledge stays in the plugins. Net: pure-provider controllers skip the parse (the win); controllers that also call out are still parsed (no consumer loss); partial-coverage languages and graph-less runs are unchanged. - test: route-parse-skip integration test spies the real parseSourceSafe to COUNT parses over a temp repo of Spring controllers with a mock DB — baseline (every file parsed), fully-covered (0 parses), mixed (unresolved file falls back, resolved stays skipped), and provider+consumer (a covered controller that also calls restTemplate is parsed; its consumer contract survives). * fix(group/http): cover Spring HTTP Interface @*Exchange in Java consumer-signal gate #2254 (merged) added Spring 6 HTTP Interface `@(Get|...)Exchange` / `@HttpExchange` as a new Java *consumer* idiom. The #2138 parse-skip consumer-safety gate must recognize it, or a provider-covered file carrying an `@GetExchange` could be parse-skipped and lose that consumer contract. Add `Exchange` to JAVA_HTTP_PLUGIN.hasConsumerSignals (conservative; also matches `restTemplate.exchange(`). * style(group/http): prettier formatting for #2138 Part 2 files * style(ingestion): prettier formatting for call-processor.ts (#2138 Part 2) * fix(group/http): P1 (Java over-claim) + P2 (handler mis-attribution) on top of #2268 (#2138 Part 2) Re-applied on the maintainer's #2268 (expanded Java/Kotlin consumer extraction) base. P1 — `routeCoverage: 'complete'` over-claimed for Java: the graph provider set is a strict subset of the group scan (array-form `@GetMapping({...})`, interface-inherited routes, same-URL multi-verb have no graph Route node), so parse-skip could drop those group-only providers. - java/python → default 'partial' (always source-scanned). Java flips to 'complete' only once ingestion provider extraction matches the group scan (a separate follow-up). Python was a no-op anyway (no handlerName resolved); 'complete' was a latent trap. PHP stays 'complete' (Laravel ingestion ⊇ the group scan, the one language the skip engages for). - python hasConsumerSignals widened to a true superset of scan() (uri=/url= wrapper, aiohttp, urllib). Java's gate already covers #2268's consumer set (same receivers; the @*Exchange token is present). P2 — resolveRouteHandlerSymbols: reserve the URL slot on first encounter even when unresolved (mirrors addRoute first-writer-wins, so a later same-URL route can't stamp the node-winner's slot); refuse to guess on an ambiguous same-name lookup (exactly one match → use it; zero/many → fail-open, never a wrong handler). The cross-source case (filesystem route winning a URL a framework route also normalizes to) is unchanged — the resolver never receives filesystem routes — and stays fail-open. Tests: - route-parse-skip rewritten: the parse-skip win is proven on PHP (fully covered → 0 parses; mixed fallback; consumer-covered file still parsed), plus three Java P1 regression guards (array-form / interface-inherited / multi-verb) asserting the group-only routes survive — verified they go red if Java is flipped back to 'complete'. - resolve-route-handler-symbols: direct unit tests (the fn had none) — unique resolve, ambiguous/unknown fail-open, same-URL reservation, first-writer-wins. - http-consumer-signals: each plugin's hasConsumerSignals is a superset of its scan() consumer idioms; pure providers return false. - route-handler-symbol-roundtrip: real-LadybugDB CSV→COPY→query for Route.handlerSymbolId. --------- Co-authored-by: henry <zhangwei2017@unipus.cn> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>	2026-06-23 07:22:43 +01:00
Gergő Magyar	239967116f	fix(impact-pdg): make the Impact PDG Mutation Report workflow pass (3 latent oracle bugs) (#2258) ... * fix(impact-pdg): run mutation oracle's analyze child from built dist, not tsx-over-src The nightly Impact PDG Mutation Report workflow failed at the first fixture with ERR_MODULE_NOT_FOUND for src/cli/lazy-action.js. The harness shelled the real CLI out as `node --import tsx src/cli/index.ts analyze …`; on the CI runner's Node 22.22.3, native TypeScript type-stripping is enabled by default and handles the .ts entry instead of tsx, and native stripping does NOT remap the `./lazy-action.js` import specifier to lazy-action.ts the way tsx does — so CLI startup crashes before analyze even runs. The workflow already builds dist/ (build: 'true'). Prefer the shipped dist/cli/index.js (plain compiled JS — no tsx, no strip-types, and the parse workers it spawns also resolve from dist/) for the analyze child, falling back to tsx's own CLI over src only for build-free local runs. Production-faithful and version-agnostic across the engines range (node >=22.0). Verified on a real Node 22.22.3: the dist child starts cleanly with no lazy-action resolution error; the full `--mutation --only=inter-dispatcher-thin` run scores realized recall 1.0 and gate-mutation-recall passes. Workers are independently confirmed green on 22.22.3 in CI (run 27874383902). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(impact-pdg): declare the mutation oracle's @babel/* deps `bench/impact-pdg/mutation-oracle.mjs` imports @babel/parser, @babel/traverse, @babel/generator and @babel/types to instrument + value-diff the fixture AST, but none were declared in package.json. @babel/parser and @babel/types happen to be hoisted into gitnexus/node_modules transitively, but @babel/traverse and @babel/generator are only present at the monorepo root — so a fresh `npm ci` in gitnexus/ (CI) can't resolve them and the oracle dies at module load with `Cannot find package '@babel/traverse'` right after analyze succeeds. Declare all four as devDependencies (they're already lazily imported only on the --mutation path, so they stay out of the unit-test module graph). Verified the oracle resolves them from gitnexus/node_modules and scores recall 1.0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(impact-pdg): gate only recall-gated mutation checks (honor recallGated) The recall gate filtered checks by `typeof c.recall === 'number'`, which includes the UPSTREAM fixtures. The mutation oracle is a FORWARD value-diff: it mutates the criterion line and observes which downstream lines' values change, so its behavioral AIS can never intersect a reverse (upstream) PDG slice — recall is 0 by construction. measure.mjs already marks these `recallGated: false` (alongside id-discrimination corroboration cases) and excludes them from its own internal gate; the standalone gate just didn't honor that flag, so `intra-control-loop` (direction: upstream, recall 0) tripped the floor even though the oracle ran the full suite cleanly (mean recall 0.923). Filter on `c.recallGated === true` so the floor applies only to the downstream cases the forward oracle can fairly validate. Verified locally: an upstream+downstream report now scores 1 of 2 and the gate passes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(impact-pdg): fail the mutation gate when it has no recall signal + fix README drift Tri-review hardening of this PR's own changes: - gate-mutation-recall.mjs: the floor check passed vacuously when `scored` was empty (`min === null` short-circuits `min !== null && min < floor`). Narrowing the filter to `recallGated === true` made an empty `scored` set reachable in more inputs (a degenerate corpus, or a harvest that silently emptied every behavioral AIS). Now fail loudly when checks exist but none are recall-gated, so a hollow gate is red rather than a green "scored cases: 0 of N". A genuinely empty report (0 checks) still passes — it's not a degenerate-corpus signal. - README.md: the harness substrate section still documented the old `node --import tsx src/cli/index.ts …` child invocation this PR replaced; update it to the dist-preferred form to match `cliChildArgs`. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-20 20:40:28 +01:00
Gergő Magyar	78b4077d8a	feat(impact): opt-in PDG-backed impact mode - statement + inter-procedural slicing, resolved-callee-id soundness, mutation-oracle validated (#2227)	2026-06-20 12:04:32 +01:00
henry201605	a691dcb320	feat(routes): persist HTTP method on Route nodes (#2138 part 1/2) (#2234) ... * feat(routes): persist HTTP method on Route nodes Part 1 of 2 for issue #2138 (skip redundant HTTP provider source-scan). The ingestion routes phase already knows each route's HTTP verb — `ExtractedRoute.httpMethod` (Spring/Laravel framework routes) and `ExtractedDecoratorRoute.httpMethod` (decorator routes) — but dropped it when creating the Route graph node. As a result `HttpRouteExtractor`'s graph-assisted path could not recover the verb for `framework-route` sources (whose edge `reason` is undecodable by `methodFromRouteReason`) and had to fall back to re-scanning the handler source. Changes: - routes phase: carry `httpMethod` into `RouteEntry` and persist it as `Route.method` (filesystem-derived Next.js/Expo/PHP routes have no structural verb, so they stay method-less). - HttpRouteExtractor: HANDLES_ROUTE query now returns `route.method`; `extractProvidersGraph` prefers it and falls back to the edge reason for older indexes / method-less routes (fail-open, fully backward compatible). - tests: graph-method precedence, multi-verb handler disambiguation via the persisted verb, case normalization, and old-index fallback. This change is intentionally NOT a performance optimization on its own: the graph path still parses handler files to recover the handler *name*. Eliminating that parse (and thus the redundant source-scan #2138 targets) requires linking HANDLES_ROUTE to the handler symbol, which lands in Part 2. This PR is the data-completeness groundwork for that. Refs #2138 * test: account for new Route.method in blade route-registry assertion The routes phase now persists httpMethod onto RouteEntry/Route nodes, so the strict toEqual on the framework-route registry entry must include the new method field. * fix(routes): persist Route.method end-to-end + real-lbug round-trip test Addresses review on #2234 (magyargergo + tri-review): the prior commit read `route.method` in HANDLES_ROUTE_QUERY but never added the column to the schema/persistence path, so against a real LadybugDB the query failed to bind (`Cannot find property method for r.`) and the `catch { return [] }` silently swallowed it — regressing the graph-assisted HTTP provider path. - schema: add `method STRING` to ROUTE_SCHEMA. - csv-generator: write `method` in the Route CSV row (header + row, column order aligned with the COPY statement). - lbug-adapter: add `method` to getCopyQuery('Route'). - routes phase: normalizeRouteMethod() canonicalizes the verb to upper-case and skips non-verbs — Laravel resource/apiResource carry httpMethod values like `resource`/`apiResource`, which must not land a junk method. - http-route-extractor: log at debug when the HANDLES_ROUTE / FETCHES graph query throws, so a total graph-provider outage is observable instead of silently swallowed. Export HANDLES_ROUTE_QUERY for the round-trip test. - tests: add a real-lbug round-trip (graph -> CSV -> COPY -> HANDLES_ROUTE_QUERY) asserting the verb persists and reads back; update the blade registry assertion for the normalized (upper-case) method. Refs #2138 * fix(csv): coerce Route.method to string for escapeCSVField typecheck node.properties.method is typed unknown (not a declared property), so `x || ''` stayed unknown and failed tsc against escapeCSVField's string|number param. Coerce explicitly with String(... ?? ''). * test(bench): regenerate emit-persistence fingerprint for Route.method column Adding the method column to route.csv changes the byte-identity fingerprint of the emit-persistence benchmark (the synthetic graph's route.csv header now includes 'method'). scaling_ratio unchanged (~0.9, linear); this is the documented regenerate-on-legitimate-emit-change path. Streaming baseline (BasicBlock/PDG) is unaffected. --------- Co-authored-by: henry <zhangwei2017@unipus.cn> Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>	2026-06-20 06:30:16 +01:00
azizur100389	fff01189b1	fix(cpp-hooks): handle pack-base comments and missing hook overrides (#2247)	2026-06-18 21:55:46 +01:00
azizur100389	72876ab69a	fix(cpp): rank homogeneous braced-init overloads (#2214)	2026-06-16 18:29:28 +01:00
Gergő Magyar	3c82361b66	perf(cfg): streaming/chunked PDG graph emit for full-kernel-scale repos (#2202) (#2216)	2026-06-16 05:04:10 +01:00
Gergő Magyar	df08ecc397	perf(lbug): cut graph-DB emit/persistence wall time (#2203) (#2215) ... * perf(lbug): add PROF_LBUG_LOAD persistence-path timing breakdown (#2203 U1) loadGraphToLbug is un-timed today; the analyze 'emit' number is the scope-resolution emit bucket, not the CSV->COPY persistence path. Add a zero-cost-when-off per-stage breakdown (csv-emit/copy-nodes/rel-split/ copy-rels/fallback/total + node/rel counts) gated by PROF_LBUG_LOAD=1, mirroring the PROF_SCOPE_RESOLUTION pattern. Document the flag in README. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * perf(lbug): route relationships to per-pair CSVs in the emit pass (#2203 U2) Relationships were written once to a monolithic relations.csv, then re-read line-by-line (regex per edge) and re-split into per-FROM->TO-label-pair files before COPY — writing and reading the entire ~1M-edge set twice. Route each edge to its pair file directly during the single emit pass via a shared RelPairRouter, eliminating the monolithic write + re-read + per-edge regex. The router applies the SAME getNodeLabel + validTables filter as the legacy splitRelCsvByLabelPair, which is retained as a differential oracle. A new differential test asserts the direct-emit per-pair files are byte-for-byte identical to the oracle's, with identical skip/total accounting. The prof line (U1) drops its rel-split stage (routing now folds into csv-emit). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * perf(lbug): skip per-row microtask tick in BufferedCSVWriter (#2203 U3) addRow awaited an already-resolved promise on every buffered row, scheduling a microtask per node even when nothing flushed (millions at scale). It now returns a promise ONLY when it flushes; the node-emit loop awaits once per iteration after the switch. Flush/drain semantics are unchanged, so backpressure on the rows that actually write is preserved and the emitted CSV bytes are byte-identical (covered by the determinism + differential tests). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * bench(lbug): emit throughput + byte-identity gate for the persistence path (#2203 U4) Build-free bench (bench/emit-persistence/measure.mjs) times streamAllCSVsToDisk on a synthetic graph at two scales and gates: (1) an order-independent sha256 fingerprint over every emitted CSV line — the byte-identity guard for the U2/U3 emit optimisations — and (2) a scaling-ratio budget catching an O(n^2) emit re-regression. Wired into ci-tests.yml alongside the cfg/scope-capture benches. The LadybugDB COPY half needs a real DB, so its timing stays in PROF_LBUG_LOAD + the integration round-trip tests (documented in the bench README, with the deferred COPY-parallelism follow-up). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(review): apply autofix feedback (#2203) - P1: router backpressure drain-await rejected with a generic AbortError, masking the real EMFILE/disk-full error. Expose RelPairRouter.lastError and rethrow it in the emit catch — mirrors the oracle's throw streamError ?? err. - P1: cover RelPairRouter error + backpressure + teardown paths with a new unit test (test/unit/rel-pair-routing.test.ts) using an injected mock stream. - P2: wrap streamAllCSVsToDisk body in try/finally so the setMaxListeners bump is always restored (the U2 rel-routing throw path could leak it). - P2: dedup WriteStreamFactory — re-export the canonical type from rel-pair-routing instead of a second identical declaration. - P2: annotate splitRelCsvByLabelPair @internal as the retained differential oracle so a future dead-code sweep doesn't delete the byte-identity guard. - P3: differential test now covers the proc_ prefix + clears GITNEXUS_SORT_GRAPH_OUTPUT to prevent env-leak desync. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(lbug): scope byte-identity to quote-free ids + lock the quote-in-id divergence (#2215 review) The 'byte-identical' claim was unconditional, but the router derives labels from the raw id while the retained splitRelCsvByLabelPair oracle re-derives them via a regex over the escaped row — so for an id containing a double-quote they diverge (the router is the more-correct path). Soften the wording in rel-pair-routing.ts, the bench README, and the differential-test comment to document the exception, and add a differential test asserting the intended divergence (router routes the quote-in-id edge; oracle drops it) so a future change can't silently revert to the buggy regex semantics. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * bench(lbug): per-file fingerprint so the gate catches pair-file mis-routing (#2215 review) fingerprintEmit flattened every line of every per-pair file into one array, sorted globally, and hashed — losing file boundaries, so a row routed to the WRONG pair file produced an identical fingerprint. Hash a per-file digest (filename + sha256(file bytes)) and combine the sorted entry list, so mis-routing (and within-file row reordering) now changes the fingerprint. Baseline regenerated; the new scheme yields a different hash on byte-identical emit, confirming it is sensitive to file structure the old flatten ignored. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * bench(lbug): add absolute large-scale wall-time backstop to the emit gate (#2215 review) The scaling-ratio gate only compares large/small, so a uniform Nx slowdown at both scales passes with ratio ~1.0. Add an opt-in max_ms_large ceiling (1000ms vs observed ~200ms — generous, host-noise-tolerant) that --check enforces alongside the ratio, catching a gross absolute regression the ratio misses. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(lbug): cover the sorted-output path in the byte-identity differential (#2215 review) The differential test only exercised the default insertion-order emit path. Add a case under GITNEXUS_SORT_GRAPH_OUTPUT=1 that feeds the oracle the same id-sorted order orderedRelationships() uses and asserts per-pair byte-identity, so within-pair row reordering on the sorted path can't slip past the gate. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(lbug): cover the invalid-TO-label skip branch (#2215 review) Only an invalid-FROM label was exercised; the validTables skip is an OR over both endpoints, so the invalid-TO branch was untested (an inverted && would have slipped through). Add a valid-FROM/invalid-TO edge to the differential test and the router unit test, asserting it's skipped identically by router and oracle. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(lbug): exercise the BufferedCSVWriter FLUSH_EVERY boundary in vitest (#2215 review) The U3 addRow change (returns a flush promise only on flush; undefined when buffered) and the loop's `if (pending) await pending` were only crossed by the bench, never vitest (all fixtures are <500 nodes). Add a 600-node graph through streamAllCSVsToDisk asserting all rows land exactly once across the 500-row flush boundary — no drops, dups, or corruption. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(lbug): drop redundant step cast in buildRelRow (#2215 review) GraphRelationship.step is already typed number?, so (rel as { step?: number }).step was a no-op structural cast that obscured the shared-type coupling. Use rel.step directly. Byte-identical — bench fingerprint unchanged, differential test green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(lbug): make the unknown-label node drop explicit (#2215 review) With the U3 `let pending` switch idiom, a node whose label matches neither codeWriterMap nor multiLangWriters left `pending` undefined and was silently dropped — a footgun for a future node type. Add an explicit else with a comment documenting that unknown labels are intentionally not persisted and that a new type must be wired into a writer map. No behavior change (byte-identity + tests unchanged). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(lbug): drop the unused WriteStreamFactory re-export (#2215 review) The type was re-exported from lbug-adapter 'to preserve this module's surface,' but no external code imports it by name from here (the only test reference is a comment). Keep the import from rel-pair-routing.ts (its canonical home, still used by splitRelCsvByLabelPair's signature) and drop the dead re-export. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-15 19:40:59 +01:00
Gergő Magyar	cdb07289a4	perf(cfg): SSA-sparse reaching-defs to replace the dense-set worklist (#2201) (#2212) ... * test(cfg): retain dense reaching-defs as differential oracle + fuzz harness (#2201 U1) * refactor(cfg): extract shared harvest/adjacency/sweep + swappable in-set computer (#2201 U2) * perf(cfg): sparse change-driven reaching-defs solver + canonical truncation (#2201 U3,U4) * perf(cfg): switch production reaching-defs to the sparse solver (#2201 U5) * perf(cfg): true SSA-sparse reaching-defs solver with auto-dispatch (#2201 U3) Replace the per-variable worklist (correct but no faster — it still walks pass-through blocks per binding) with Cytron SSA: CHK dominators + dominance frontiers + phi-placement + stack renaming over a synthetic entry, answering block-entry reaching queries by walking the SSA def-use graph (SCC-condensed, cycle-safe). Pass-through blocks carry the dominating def via the rename stack and phi-nodes statically capture loop merges, so dense-bindings drops from O(n^2) to O(n) (5-23x faster, asymptotic) and deep nests are depth-independent. The sweep now queries a lazy reachingAt accessor with a sparse intra-block overlay (no full per-block lattice copy). Production auto-dispatches: SSA for looping functions >=16 blocks (where it pays off, incl. the deep nests the dense ceiling used to truncate -> ceiling stops firing), dense elsewhere (small / loop-free functions, 1.0x — no regression). Throw-edge and unreachable-block functions fall back to dense (byte-identical). Held byte-identical to the dense oracle across a 300k-CFG (~1.2M-comparison) differential fuzz. * test(cfg): R5 contrast — dense ceiling fires, SSA solver converges (#2201 U6) * bench(cfg): deep-nest scenario + tighten dense-bindings rd budget 10->2 (#2201 U7) dense-bindings rd_scaling drops 5.2->0.86 (SSA linear); budget tightened to 2.0. New deep-nest scenario (N nested loops, one carried var) measures rd under the production blocks×64 ceiling and asserts the SSA solver still COMPUTES full facts (facts_large_min) where the dense worklist would truncate — the ceiling-stops-firing acceptance. CFG fingerprints unchanged. * docs(cfg): document SSA-sparse solver + resolve the WTO no-go note (#2201 U8) * fix(review): apply autofix feedback (#2201) - Close the production SSA-dispatcher fuzz-coverage gap: the generator's maxBlocks=14 was below SSA_MIN_BLOCKS=16, so the auto-dispatcher's SSA branch was never differentially fuzzed. Raise to 36, add a hadLargeLoop coverage assertion + a back-edge-into-entry canonical CFG. Validated byte-identical on 100k random CFGs incl. >=16-block looping shapes via both entry points. - Correct stale function JSDocs + @internal annotations (dispatch/fallback roles). - Add an independent rd_all_computed bench gate (catches partial truncation). - maxBlockVisits comment, SSA_MIN_BLOCKS calibration note, nx->next rename. * fix(cfg): gate out-of-range binding indices to the dense fallback (#2201 review) Tri-review (adversarial lane, reproduced) found the SSA path less tolerant than the dense oracle it replaced: an out-of-range binding index in defs/uses/mayDefs (a corrupted/stale durable store) crashed the nBindings-sized arrays (defBlocks[v]/stacks[u]), where dense tolerated it as a Map key. The throw escaped the unguarded taint/harvest call sites and lost a whole file's taint layer. Add a malformed-input gate that falls back to the dense solver (which handles any index), preserving byte-identity AND the graceful per-function degradation. Add an OOB canonical CFG to the differential fuzz + a production- entry no-throw unit test (the generator only ever emitted in-range indices, so this divergent input was structurally invisible). * perf(cfg): bound the SSA value-graph, fall back to dense when oversized (#2201 review R1) maxFacts bounds fact materialization in sweepFacts, but nothing bounded the SSA-sparse solver's φ/value-graph construction. A high-binding-density deep loop routed to SSA (≥16 blocks + a reachable loop) builds an O(blocks×bindings) value graph the dense path would have truncated at its maxBlockVisits ceiling (~1.5 GB measured on a 3000-block × 300-binding function). Cap the value graph: after φ-placement (where nodeKeys.length == the φ count, the input-superlinear term) plus a 2×Σgen bound on the renaming nodes, fall back to computeInSetsDense before paying for renaming + Tarjan SCC. The fallback is byte-identical (dense is the equivalence oracle) and bounded (dense honors maxBlockVisits). Mirrors the existing throw/unreachable/OOB-binding gates. The ceiling is DEFAULT_MAX_SSA_VALUE_GRAPH_NODES (1e6 — far above any real or benchmarked function; dense-bindings/deep-nest build <1e4), overridable per call via ReachingDefsLimits.maxSsaValueGraphNodes. The new unit test makes the otherwise-invisible routing flip observable by pairing the cap with a tight maxBlockVisits (dense truncates, SSA computes). Equivalence fuzz unchanged (byte-identical, 20k CFGs green); tsc clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * perf(cfg): alias single-source SCC reaching-sets in reachByScc (#2201 review R2) The SCC-condensation pass built a fresh Set for every SCC and copied each cross-SCC operand's reaching-set element-by-element — O(defs²) at wide-fan-in φ merges (a φ over many predecessors, each carrying a large reaching-set). Add an alias fast path: an SCC with no own leaf keys whose cross-SCC operands all resolve to ONE source SCC has exactly that source's reaching-set, so share it by reference instead of copying. This is the common shape (pass-through φ / single-operand value node). The full union is still built when an SCC has own keys or genuinely merges ≥2 distinct sources. Safe to share: reachByScc sets are read-only after construction (operand SCCs are numbered before s in Tarjan's reverse-topological order and are only iterated), and contents are identical — set iteration order is irrelevant because sweepFacts sorts each use's keys before emission (KTD6). Byte-identical to the dense oracle (30k-CFG fuzz green); tsc clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * perf(cfg): fold the SSA reachability gate into the RPO pass (#2201 review R8) computeInSetsSparse ran a standalone reachability BFS to gate unreachable-block functions to the dense oracle, then immediately computed a reverse-post-order over the synthetic-entry graph — two traversals of the same successor structure. reversePostOrder now returns the reachability bitmap its DFS already builds, and the sparse path reuses it for the unreachable-block gate (S→entry is S's only edge, so reachX[b] for b<n is exactly "reachable from entry" — identical to the removed BFS). One traversal instead of two on every SSA-dispatched function. The dispatcher's hasReachableLoop pass is left in place: it decides SSA-vs-dense BEFORE the solver is entered, and computeInSetsSparse must stay self-contained (the equivalence fuzz drives it directly, bypassing the dispatcher), so the two cannot share a traversal without coupling the InSetsComputer contract. Routing and facts unchanged — byte-identical to the dense oracle (30k-CFG fuzz, including unreachable-block shapes, green); tsc clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * perf(cfg): trim per-statement/per-use/per-block allocations (#2201 review R9) Three transient allocations in the hot paths, all behavior-preserving: - sweepFacts: replace the per-statement `new Set([...defs, ...mayDefs])` with a direct `includes()` scan over the (1–3 element) def/mayDef arrays, guarded by a cheap hasSelfDefs flag that short-circuits pure-use statements. - sweepFacts: reuse a single scratch array for each use's reaching def-keys instead of spreading a fresh array per use. The KTD6 pre-sort still runs in place (load-bearing for truncated byte-identity). - computeInSetsSparse: build dPredsX by skipping consecutive-equal `from` values (preds[b] is pre-sorted by buildAdjacency, so duplicates are adjacent) instead of a per-block Set + spread + sort; the synthetic entry S = n exceeds every block index so it appends in order. The sweep is shared with the dense oracle, so these stay byte-identical on both paths — 50k-CFG fuzz (incl. maxFacts truncation, the order-sensitive case) green; tsc clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(cfg): correct the sweepFacts truncation byte-identity mechanism (#2201 review R6) The outer sweepFacts JSDoc attributed a truncated result's cross-solver byte-identity to the two solvers producing "identical inSets — insertion order included". That is wrong: the dense (RPO fixpoint) and SSA (renaming/SCC) solvers deliberately build a loop-carried use's reaching set in DIFFERENT insertion orders — same set, different order. The actual mechanism is the KTD6 per-use sort that canonicalizes each use's keys by defKey BEFORE the maxFacts cutoff (already documented correctly on the inner comment). Rewrite the outer doc to say so. Documentation only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(cfg): extract pure graph sub-stages to reaching-defs-graph.ts (#2201 review R4) reaching-defs.ts had grown to ~1190 lines with the #2201 SSA rewrite. Move the self-contained, pure (plain-array) algorithms into a sibling module: - reversePostOrder - buildDominators (Cooper-Harvey-Kennedy) - buildDominanceFrontiers (Cytron) - tarjanScc + condenseReachingSets (SCC condensation, alias fast path) - hasReachableLoop (dispatcher loop check) - unionSets / latticeEquals (def-set / lattice primitives) The new module has a STRICT one-way dependency (it imports nothing from reaching-defs.ts — every helper is parameterized over plain arrays/Sets), so there is no import cycle and each stage is independently testable. reaching-defs.ts now holds the orchestrator, the two solver bodies, harvest, adjacency, the statement sweep, and the dispatcher: 1190 → 988 lines. Pure mechanical extraction — behavior is preserved by the differential equivalence fuzz (40k CFGs byte-identical) + the reaching-defs unit/snapshot suites; tsc clean. The helpers are @internal (kept out of the shipped .d.ts by the stripInternal change). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(pdg): stamp the reaching-defs solver identity for incremental re-analysis (#2201 review R3) The SSA-sparse rewrite computes full REACHING_DEF facts for deep-loop functions the old dense worklist truncated to empty at the blocks×64 ceiling. But an existing `--pdg` index carries those stale-truncated rows, and nothing forced a re-analysis: RepoMeta.pdg had no solver-identity key, so an upgraded run over an unchanged file kept the incremental fast path and never recomputed. Add a constant `reachingDefSolver: 'ssa-sparse-v1'` to the resolved pdg stamp (and to the RepoMeta['pdg'] type). It rides the existing key-union pdgModeMismatch comparator: a pre-#2201 stamp lacks the key, so 'ssa-sparse-v1' !== undefined trips one full writeback that recomputes the fuller coverage — no `--force` needed — exactly like the M2 REACHING_DEF cap and M5 CDG cap upgrade paths. A matching post-#2201 stamp compares equal, so there is no spurious re-analysis churn on steady-state re-runs. Tests: new pre-#2201→SSA upgrade block in pdg-mode-flip.test.ts (stamp present, absent-key mismatch, identical-stamp no-churn) + the persisted-stamp shape assertions and resolvePdgConfig DEFAULTS updated for the new key. tsc clean; pdg-mode-flip + run-analyze suites green (55/55). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * build(ts): stripInternal so @internal test-only exports stay out of the shipped .d.ts (#2201 review R5) computeReachingDefsDense/computeReachingDefsSparse are exported only for the equivalence fuzz and tagged @internal, but `declaration: true` emitted them into the public dist/**/*.d.ts. stripInternal removes any @internal-tagged export from the declaration output. This is repo-wide, which is the intended behavior: the same applies to every other test-only @internal export (hf-env's withDownloadTimeout etc., worker-pool's buildDispatchMessage/crashSignature, parse-impl's handleWorkerStartupFailure, the logger/safe-parse test resets, and the new reaching-defs-graph SSA helpers) — all of which are documented as not-public. Verified: - declaration emit succeeds with no TS4094/TS9006 ("cannot be named") errors; - the @internal functions are gone from the emitted .d.ts (reaching-defs-graph.d.ts is now `export {};`), while public symbols (computeReachingDefs) remain; - gitnexus-web — the only cross-package consumer — typechecks clean and imports only from gitnexus-shared, never from gitnexus internals; - runtime .js and the vitest/tsx tests are source-based, so unaffected. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(bench): add wide-merge scenario + tighten deep-nest facts floor (#2201 review R7) wide-merge: N bindings, each assigned in a 3-way branch (a wide multi-operand φ per binding) inside a loop, then all used after the merge. Unlike dense-bindings (one chained redef per `if`), every binding fans into its own wide φ, so the scenario exercises φ-placement + renaming + the reachByScc condensation across many independent wide merges. N bindings × constant arms ⇒ O(N) facts, so the gate is rd_scaling LINEARITY (measured ~1.07; budget 2.0 catches a regression to the per-binding-rescan O(N²) class the reachByScc alias path guards against). It runs the production SSA path (10007 blocks + a loop) and computes all facts under the blocks×64 budget (facts_large_min 24000 of a measured 26008 + the rd_all_computed gate). deep-nest: tighten facts_large_min 100 → 150 (measured 164) so a partial- truncation regression that still cleared 100 — but lost facts — now fails, with ~9% headroom for noise. bench --check PASS (9 scenarios) under --expose-gc; all existing CFG fingerprints unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * style(cfg): drop trailing blank line in reaching-defs.ts (prettier) Whitespace-only — a stray trailing newline left by the U4 extraction. `prettier --check` (the root format CI gate) now passes on every changed file. No behavior change. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-15 19:16:53 +01:00
Gergő Magyar	6932e7a9fd	feat(cfg): PDG/CFG visitors for all supported languages (#2195) (#2197) ... * test(cfg): validate cfg/visitors literals + drop 3 dead TS node types Extend the grammar-literal CI gate (test/helpers/literal-collectors.ts) to scan cfg/visitors/*.ts, mapping each visitor file to its grammar via the existing basename rule (c-cpp -> C/C++, csharp -> C#, java -> Java, go -> Go, typescript -> TS). Closes the gap where the gate never validated CFG visitor node-type literals -- the prerequisite for adding C-family visitors safely (#2195 U1). The newly-scanned TS visitor surfaced 3 dead literals absent from every grammar it serves (typescript/javascript/tsx all = 0): for_of_statement (for-of parses as for_in_statement), async_function_declaration and async_arrow_function (async functions are function_declaration / arrow_function + an async child). Removed them; behavior-preserving -- the cases never matched, bench --check fingerprints unchanged, TS visitor unit tests green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(cfg): language-agnostic CFG unit-test harness (#2195 U1) Extract the grammar-agnostic engine from ts-cfg-harness into makeCfgHarness(grammar, visitor, filePath) at test/helpers/cfg-harness.ts. Function discovery delegates to visitor.isFunction, so the harness carries no language-specific node-type knowledge -- each C-family visitor's unit tests can drive the real worker-side builder against real source. ts-cfg-harness becomes a thin TS binding re-exporting the same parse/collectFunctions/cfgOf/cfgsOf (behavior-preserving: all 5 existing consumers -- taint propagate/model-match/summary-harvest/taint-emit + cfg harvest -- pass unchanged, 223 tests green). New harness.test.ts proves TS-faithfulness and isFunction-delegation via a stub visitor. The bench parameterization (measure.mjs) is sequenced into U7, where the first C-family scaling scenario makes the {grammar, visitorFactory} seam validatable against a real non-TS language. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(cfg): C and C++ CFG visitor + def/use harvest (#2195 U2) Add createCCfgVisitor/createCppCfgVisitor over a shared CCfgWalk core. Grammar introspection confirmed tree-sitter-c and tree-sitter-cpp share every control-flow node type/field, so CppCfgWalk extends CCfgWalk with only the C++-only nodes (try/catch/throw/for_range_loop/lambda) via a visitExtra hook -- no language conditionals (AGENTS no-language-naming). Wire both into c-cpp.ts providers. Harvest (c-cpp-harvest.ts): two-phase binding table + per-statement defs/uses/mayDefs (no sites[] yet -- U6). Edge kinds match the TS contract; functionStartColumn populated; non-terminating loops (for(;;), while(1)) emit the structural exit-escape edge so EXIT stays reverse-reachable and CDG is not silently skipped -- verified against the production post-dominator + control-dependence solvers (for(;;) -> 3 CDG edges). buildFunctionCfg returns undefined rather than throwing. 23 real-parser regression tests; grammar-literal gate green (literals validated against both grammars). Documented gaps: C++ RAII destructors, setjmp/longjmp, computed goto (route to EXIT + warn). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(cfg): C# CFG visitor + def/use harvest (#2195 U3) Add createCsharpCfgVisitor + csharp-harvest over the shared CfgBuilder / ControlFlowContext, modeling the C# statement taxonomy: if/else, for/foreach/while/do, switch_section (+ switch_expression arms), try/catch/catch_filter/finally, using + lock (deterministic finalizers -- dispose/release runs on normal AND exception exit, finally-* completion edges on crossing jumps), goto/labeled, yield (surface only), return/ throw/break/continue. Wire into csharpProvider. Every literal validated against tree-sitter-c-sharp via the introspection probe (record_declaration, no else_clause, switch_section, positional access where no field exists). Edge kinds match the contract; functionStartColumn populated; while(true) keeps EXIT reverse-reachable (production CDG probe: 3 edges). buildFunctionCfg returns undefined rather than throwing. 34 real-parser regression tests; grammar-literal gate green; no regression (cfg unit dir 256/256, tsc clean). Documented gaps: yield iterator state machine, goto case/default, async suspension points. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(cfg): Java CFG visitor + def/use harvest (#2195 U4) Add createJavaCfgVisitor + java-harvest over the shared CfgBuilder / ControlFlowContext: if/else, classic for, enhanced-for, while, do-while, classic-vs-arrow switch (switch_block_statement_group fallthrough vs switch_rule no-fallthrough), try/catch/finally + try-with-resources (auto-close synthesized as a finalizer, closes on normal AND exception exit) + synchronized (monitor-release finalizer), labeled break/continue to the labeled frame, yield, return/throw/break/continue. Wire into javaProvider. Every literal validated against tree-sitter-java via the probe (switch_expression covers both switch forms, generic_type, line_comment, for init field). Edge kinds match the contract; functionStartColumn populated; while(true)/for(;;) keep EXIT reverse-reachable (production CDG probe: 3 edges; hazard fixture: 34 CDG edges). buildFunctionCfg returns undefined rather than throwing. 43 real-parser regression tests; grammar-literal gate green; no regression (cfg unit suite 304, tsc clean). Documented gaps: switch-as- expression-value inline, yield state machine, async/field-write defs. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(cfg): Go CFG visitor + def/use harvest (#2195 U5) Add createGoCfgVisitor + go-harvest, the highest-divergence target: for_statement (all four shapes -- for_clause C-style, while-style, range_clause, bare for{}), expression/type switch (no implicit fallthrough) + explicit fallthrough_statement, select_statement, defer (LIFO finalizer legs at function exit), go (call is straight-line; the closure body is its own CFG via isFunction), labeled break/continue/goto, multiple-return assigns (a, b := f() defines each LHS). Wire into goProvider. CRITICAL (review A2): every non-terminating shape -- for{}, for cond{}, select{} with no default -- emits a structural exit-escape edge so EXIT stays reverse-reachable and the production CDG is not silently skipped. Verified: for{} -> CDG=3, select{} -> CDG=1, for-range -> CDG=2, all exitReachable=true. Every literal validated against tree-sitter-go via the probe. 32 real-parser regression tests; grammar-literal gate green; no regression (186 across all 5 visitors + gate, full cfg unit 331, tsc clean). Documented gaps: panic/recover unwind, goroutine happens-before. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(cfg): call-site sites[] taint substrate for C-family (#2195 U6) Extend the C/C++/C#/Java/Go harvests with the call-site sites[] taint substrate (SiteRecord/SiteArgOccurrence), mirroring the TS shape so the shared taint matcher consumes all languages uniformly. Extract the grammar-agnostic site machinery into cfg/visitors/call-site-harvest.ts (CallSiteFactAccumulator -- names no language); each harvest adds only its per-grammar visitCall/walkChain over its call node (C/C++ call_expression, C# invocation_expression, Java method_invocation, Go call_expression). INERT BY DESIGN: no C-family taint model exists (registerBuiltinTaintModels is TS/JS only), so getSourceSinkConfig returns undefined for these languages and the harvested sites produce ZERO TAINTED edges -- the positive source->sink->TAINTED path is deferred with the model authoring. sites emitted only when non-empty; facts-only attachment, block/edge topology unchanged (pre-existing topology + def/use tests byte-identical). 23 new substrate tests; 574 green across the cfg/taint/emit suites; gate green; tsc clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(cfg): worker-mode PDG integration + bench parameterization (#2195 U7) Prove the five C-family visitors build PDG through the REAL worker pipeline. pipeline-pdg.test.ts: per-language (C/C++/C#/Java/Go) temp repo run with pdg:true asserts BasicBlock+CFG+REACHING_DEF+CDG all > 0 (CDG>0 proves EXIT stays reverse-reachable end-to-end through the worker, incl. each fixture's non-terminating loop/select); a paired run with pdg off asserts == 0, the two flag-off graphs byte-identical (R3), no PDG types leak, pinned by a golden snapshot. Counts e.g. Go 151 BB / 56 CDG. Parameterize bench/cfg/measure.mjs by a per-language LANGS registry resolved generically via getLanguageGrammar + getProvider(X).cfgVisitor (no static import table). Default TS byte-identical -- all 6 TS fingerprints unchanged under --check; taint-dense stays TS-only (TS_JS_TAINT_MODEL never runs against model-less C-family CFGs). Add a go:branchy scenario+baseline (namespaced) -- its fingerprint shape (32 blocks/46 edges) matches TS branchy, cross-validating the Go visitor. 15 pipeline tests + bench --check PASS (7 scenarios); 354 unit cfg green; dist rebuilt clean. Absorbs the bench parameterization deferred from U1. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(cfg): Python CFG visitor + def/use harvest (#2195 U8) Add createPythonCfgVisitor + python-harvest -- the most structurally divergent target (indentation blocks, elif, for/while-else, with, try/ except/except-group/else/finally, match/case, comprehensions, walrus), confirming the shared CfgBuilder/ControlFlowContext core carries no brace-family assumptions. for/while else-clause sits on the normal- completion edge (not break); with modeled as try/finally dispose; match has no fallthrough. Wire into pythonProvider. Every literal validated against tree-sitter-python via the probe. while True: keeps EXIT reverse-reachable (production CDG probe: 3 edges; fixture: 42 CDG edges). 37 real-parser tests; gate green; no regression (cfg unit 391, tsc clean). Gaps: async/generator suspension, comprehension scope over-approximation. No sites[] (taint substrate, separate). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(cfg): PHP CFG visitor + def/use harvest (#2195 U9) Add createPhpCfgVisitor + php-harvest: if/elseif/else (+ alt colon syntax), for/foreach/while/do-while, switch (fallthrough) + match (no fallthrough), try/catch/finally, break N/continue N (N-th enclosing loop), goto, return/throw. Wire into phpProvider. Every literal validated against tree-sitter-php (php_only) via the probe (for_statement initialize/condition/update; throw_expression not throw_statement; break/continue integer child). while(true) keeps EXIT reverse-reachable (production CDG probe: 3 edges; break 2 escapes the outer loop). 35 real-parser tests. Also repoint worker-roundtrip's "non-CFG language" gate test from Python (which now has a cfgVisitor) to COBOL (the permanent non-goal of the rollout) -- a stale assertion the Python commit invalidated. Full in-process sweep green (452 across 18 files). Gaps: match inline value, goto plain-block. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(cfg): Ruby CFG visitor + def/use harvest (#2195 U10) Add createRubyCfgVisitor + ruby-harvest: if/unless/elsif/else + statement-modifier forms (x if c, x while c), while/until/for (until inverts the sense), case/when + case/in (pattern, no fallthrough), begin/rescue/else/ensure (ensure=finally, rescue=catch) + retry (loop-back into begin), return/break/next/redo, blocks/lambdas as their own closure CFGs. Wire into rubyProvider. Every literal validated against tree-sitter-ruby via the probe (case vs case_match, modifier nodes, typed rescue/ensure children). loop do / while true keep EXIT reverse-reachable (production CDG probe: 3 edges). 34 real-parser tests; comprehensive sweep green (486). Gaps: yield, expression-position if/case/begin inline, ivar/gvar non-local defs. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(cfg): Rust CFG visitor + def/use harvest (#2195 U11) Add createRustCfgVisitor + rust-harvest for the expression-oriented Rust: if/else + if-let, loop (infinite -- structural escape edge), while/ while-let/for, match (no fallthrough) + guards, labeled break/continue ('outer), break-with-value, ? operator (try_expression) as an early-return throw edge to EXIT, let-else (diverging else). visitLet handles control-flow in value position (let x = loop/if/match). Wire into rustProvider. Every literal validated against tree-sitter-rust via the probe (label is a named child not a field; line_comment; _ pattern). loop {} keeps EXIT reverse-reachable (production CDG probe: 3 edges). 33 real-parser tests; comprehensive sweep green (519). Gaps: panic, async/.await, macro bodies. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(cfg): Swift CFG visitor + def/use harvest (#2195 U12) Add createSwiftCfgVisitor + swift-harvest (vendored tree-sitter-swift via requireVendoredGrammar): if/else + optional binding (if let), guard...else (diverging early exit), for-in/while/repeat-while (bottom-test), switch (no implicit fallthrough; explicit fallthrough keyword; where guards), do/catch + try/try?/try!, defer (LIFO finalizer at scope exit), labeled break/continue, control_transfer_statement (one node for break/continue/ return/throw). Wire into swiftProvider. Every literal validated against the vendored grammar via the probe (no block node; if-let folds into condition+bound_identifier; defer parses as a call_expression with trailing closure). while true keeps EXIT reverse-reachable (production CDG probe: 3 edges). 24 real-parser tests; comprehensive sweep green (543). Gaps: computed properties, defer block-scope approx, fatalError traps. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(cfg): Kotlin CFG visitor + def/use harvest (#2195 U13) Add createKotlinCfgVisitor + kotlin-harvest (vendored tree-sitter-kotlin): if/else, when (subject + subjectless, no fallthrough), for/while/do-while, try/catch/finally, jump_expression (return/return@/break/break@/continue/ continue@/throw), labeled loops, control_structure_body unwrapping, expression-body functions. The grammar is field-less for control flow, so the visitor navigates by child type+position. Wire into kotlinProvider. Every literal validated against the vendored grammar via the probe (line_comment/multiline_comment, not comment). while (true) keeps EXIT reverse-reachable (production CDG probe: 3 edges; worker-mode fixture: BB=82, CDG=41). 28 real-parser tests; comprehensive sweep green (571). Gaps: value-position if/when/try inline, inline-fun non-local return, getters/setters. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(cfg): Dart CFG visitor + def/use harvest (#2195 U14) Add createDartCfgVisitor + dart-harvest (vendored tree-sitter-dart): if/else, C-for/for-in/while/do-while, switch (empty-case fallthrough + explicit continue-label) + switch_expression, try/on/catch/finally + rethrow + assert (throw edges), return/break/continue/throw, labeled loops, arrow bodies, closures. Dart splits a function into sibling signature + function_body nodes, so the body (or function_expression) is the CFG-bearing node. Wire into dartProvider. Every literal validated against the vendored grammar via the probe (only constant_pattern exists; removed speculative relational/logical pattern names). while (true) keeps EXIT reverse-reachable (production CDG probe: 3 edges). 34 real-parser tests; comprehensive sweep green (605). Gaps: labeled-loop grammar quirk (read via ERROR sibling), async straight-line, value-position if/switch inline. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(cfg): Vue (reuse TS visitor) + worker-mode proof for all langs (#2195 U15) Vue SFC <script> blocks are extracted and parsed with the TS grammar (parse-worker languageMap[Vue] = TypeScript.typescript), so wire vueProvider.cfgVisitor = createTypeScriptCfgVisitor() -- pure reuse, no Vue-specific visitor. vue-visitor.test.ts replicates the worker path (extractVueScript -> TS parse -> CFG) and confirms branch edges + EXIT reverse-reachable + CDG>0. Extend pipeline-pdg.test.ts with a worker-mode block covering all eight remaining languages (Python/PHP/Ruby/Rust/Swift/Kotlin/Dart/Vue): per- language temp repo, real worker pool, BasicBlock+CFG+REACHING_DEF+CDG all > 0 with --pdg (CDG>0 proves EXIT reverse-reachable end-to-end through the worker despite each fixture's non-terminating loop), == 0 without. Counts e.g. Ruby 122 BB/45 CDG, Vue 49 BB/11 CDG. 30 pipeline tests green. COBOL: documented as the deliberate PDG non-goal (no grammar, exotic PERFORM/GO-TO control flow) in cobol.ts + the worker-roundtrip gate. This completes PDG language coverage: every supported language except COBOL now builds CFG/REACHING_DEF/CDG under --pdg. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cfg): surface skippedUnsoundFunctions in per-language stats (#2195 U2) emitFileCdg computes skippedUnsoundFunctions (functions whose CDG is withheld because EXIT isn't reverse-reachable from all blocks) but run.ts dropped it on the floor — only cdgEdges/cdgDropped were aggregated. Add the aggregation + a stats-line segment so CDG coverage gaps are an explicit signal, not silent. Establishes the baseline skip count that makes the U1 synthetic-escape pass's effect (the drop to genuine anomalies only) measurable. Additive; no emit-logic change. The emit-side field is covered by cfg-emit.test.ts (asserts skippedUnsoundFunctions===1 + the warn on a disconnected-block CFG); the run.ts aggregation is a thin pass-through. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cfg): synthetic-escape pass restores CDG for exit-unreachable cycles (#2195 U1) Unconditional goto-cycles (C/C++/C#/Go) wire a backward seq edge with no structural exit-escape edge, so EXIT becomes non-reverse-reachable and emitFileCdg silently skipped ALL control-dependence for the function. New cfg/synthetic-escape.ts: a pure deterministic SCC routine (iterative Tarjan, sorted adjacency) + augmentForPostDom(cfg). No-op when EXIT is already reverse-reachable (terminating fns + visitor-escaped loops are byte-identical — returns the same object). Otherwise it batch-bridges every exit-less SCC by adding an ANALYSIS-ONLY escape edge from the SCC's controlling block (highest out-degree branch; lowest-index tie-break) to EXIT, on a shallow-cloned FunctionCfg — never mutating persisted cfg.edges. emitFileCdg threads that augmented view through BOTH isExitReachableFromAllBlocks AND computeControlDependence (the Ferrante walk re-reads cfg.edges, so a tree-only augmentation would be wrong). Precision (anti-masking): only a trapped region containing a control point (>=2-successor block) is bridged — a branch-less trapped region carries no recoverable control-dependence and is indistinguishable from a genuine construction anomaly, so it stays on the skip path (the existing disconnected-block skip test still skips, skippedUnsoundFunctions===1). A residual non-cycle dangling block is never bridged. repro `void handler(int a){ start: if(a>0){work();} goto start; }`: before exitReachable=false/CDG=0 → after one synthetic 2->1 edge, exitReachable=true, exact CDG = {2->2:T,2->2:F,2->3:T,2->4:T,2->4:F} (pinned exactly, not CDG>0 — catches a wrong representative). AC2 property test extended to the augmented graph; per-language goto-cycle regressions (C/C++/C#/Go). 199 cfg tests green; bench --check fingerprints unchanged (analysis-only, zero persisted drift). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(cfg): isolate the non-terminating-loop hazard in worker CDG asserts (#2195 U3) The pipeline-pdg worker-mode blocks asserted a whole-fixture cdg>0 aggregate (satisfied by any branching fn) while the comment claimed it proved the non-terminating-loop EXIT-reachability end-to-end. Add a per- language `hazard` marker + isolate the assertion: locate the hazard function's BasicBlocks by its anchor and assert >=1 CDG edge is sourced within it (a marker mutation now fails the test — non-vacuous). C# keeps the aggregate (its fixture has no infinite loop). Comments corrected. Switch the 7 visitor unit tests (java/csharp/dart/kotlin/php/swift/c-cpp) from the local exitReachableFromAll CFG-shape helper to the production isExitReachableFromAllBlocks + computeControlDependence on the hazard function, matching go/python/ruby/rust/vue. 241 unit + 30 pipeline green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(cfg): gate vendored-grammar worker assertions on isLanguageAvailable (#2195 U4) The Swift/Kotlin/Dart worker-mode pipeline-pdg cases require a vendored grammar prebuild that may be absent on a CI platform — they'd go red there. Mark those three REMAINING_LANGS entries `vendored` and gate both the --pdg-on and --pdg-off `it`s on isLanguageAvailable(SupportedLanguages [lang]) → it.skip when the grammar can't load. Installed-grammar languages stay unconditional. Grammars present here, so all 30 run green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(cfg): remove dead useCount() from swift + rust harvests (#2195 U5) useCount() was declared on the local FactAccumulator in swift-harvest.ts and rust-harvest.ts but never called (a copy-paste artifact; ruby's copy IS used in an emit guard, so it stays). Pure deletion — the swift/rust visitor suites stay green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(cfg): standardize harvester API table()->bindingTable() (#2195 U9) The binding-table accessor was named table() in the C/C++/C#/Go harvests but bindingTable() in the other 7. Rename the 4 (definitions + their visitor call sites) to the majority name bindingTable(). Pure rename; the 4 visitor suites stay green and tsc confirms no call site was missed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(cfg): consolidate scope-tree substrate into ScopeTreeHarvester (#2195 U6) The Go/Java/C#/C-C++ def/use harvesters each carried a byte-identical copy of the lexical scope-tree machinery (Scope record, two-phase resolution cache, openScope/nearestScopeOf/resolve/def/use/conditional/bindingTable, ~270 lines total). Extract it into an abstract ScopeTreeHarvester base; the four harvesters now extend it and supply only their genuine per-language variation (the prescan switch, plus Go's _-blank-identifier overrides of declare/def/use). Net -422 lines. Mechanical and byte-equivalent: cfg unit suite 613 passed, bench --check fingerprints unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(cfg): consolidate no-site def/use accumulator into DefUseAccumulator (#2195 U7) The Kotlin/Python/Ruby/Rust/Dart/Swift harvesters each carried a byte-identical copy of the no-site def/use accumulator (~270 lines total; only Ruby's adds the live useCount() emit-guard helper). Extract it as an exported DefUseAccumulator beside CallSiteFactAccumulator in call-site-harvest.ts (the PR's own model for the with-site superset); the six harvesters import it under their existing local FactAccumulator name. Pure byte-equivalent move, no logic change: cfg unit suite 613 passed, tsc clean, bench --check fingerprints unchanged (TS/Go paths untouched). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(cfg): consolidate copied visitor-test helpers into cfg-harness (#2195 U8) The 13 *-visitor.test.ts files each copied a byte-identical set of CFG-shape helpers (edgeKinds/block/reaches/reachable/bindingIdx/allSites/hasAnySites, ~380 lines total). Export them once from test/helpers/cfg-harness.ts and import per file (only the subset each references). Also drop each file's local exitReachableFromAll — a re-implementation of the production isExitReachableFromAllBlocks (semantically identical: false iff some entry-reachable non-EXIT block can't reach EXIT) — and point its live call sites at the already-imported production function. Pure test-only mechanical move, behavior-preserving: tsc clean, test/unit/cfg/ 613 passed unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(cfg): pin *-harvest.ts literals to their own grammar in the gate (#2195 U10) The grammar-literal validation gate scans cfg/visitors/, but a <lang>-harvest.ts basename was not in BASENAME_LANGS, so fileLanguages() fell it through to the weak ALL_LANGS valid-if-any bucket — a node-type literal dead in its own grammar but valid in some other grammar would pass undetected. Strip the -harvest suffix and reuse the visitor basename map so go-harvest -> Go, c-cpp-harvest -> C+C++, typescript-harvest -> TS, etc. The two language-agnostic harvesters (call-site-harvest, scope-tree-harvest) name no grammar and stay valid-if-any. Also corrects the now-inaccurate mode2Files comment. Adds a fileLanguages unit test; the existing gate stays green (no harvest file has a dead literal), and a scratch probe confirmed a bogus go-harvest literal is now caught. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(cfg): defensive per-statement cap on harvested taint sites (#2195 U11) A statement's harvested sites[] had no explicit bound — a pathological or machine-generated statement (hundreds of nested calls) could grow it without limit. Add DEFAULT_PDG_MAX_SITES_PER_STATEMENT (512, mirroring the PDG edge/fact cap style): openCallSite/addMemberRead check-before-push and stop at the cap, keeping the first 512 sites fully intact and setting an observable sitesTruncated flag. A cap-dropped openCallSite returns a -1 sentinel that pushFrame/setSite*/the occurrence fan-out all tolerate (no dangling parent/via, no clobber of kept sites). Generous enough that no real statement is affected: bench --check fingerprints unchanged, cfg unit suite 617 passed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * ci(codeql): exclude nested test fixtures from the CodeQL gate (#2195) The CodeQL results gate failed on test/integration/cfg/fixtures/python-hazards.py ('total' may be used before init, unused vars) — but that file is an intentional CFG/PDG hazard fixture, exactly the synthetic broken-code the existing '**/test/fixtures/**' exclusion is meant to skip. That glob does not match the deeper test/integration/cfg/fixtures/ path, so the hazard fixtures leaked into the scan. Add '**/test/**/fixtures/**' to cover fixtures nested anywhere under a test tree. Analyze (python) and Analyze (javascript-typescript) both already pass — production code is clean; this only silences fixture noise. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * style(cfg): apply prettier + drop unused imports across the PDG files (#2195) The merge of main into this branch pulled in the stricter quality gates (prettier --check . and eslint .), which surfaced pre-existing formatting in the PDG/CFG rollout (line-width wrapping across the visitor + harvest files, bench, tests) plus 9 no-unused-imports errors. Mechanical autofix only — npm run format + lint:fix equivalent, scoped to gitnexus/: removes unused FunctionCfg/ SiteRecord type imports left by the U8 helper consolidation and stale FinalizerFrame imports in python.ts/ruby.ts. No behavior change: tsc clean, cfg unit suite 617 passed, eslint 0 errors. (gitnexus-web class-order noise is a local tailwind-plugin artifact CI does not flag — left untouched.) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cfg): harvest C++ structured-binding defs (auto [a,b]=e) (#2195) The C++ def/use harvester only recorded a def when an init_declarator's declarator was a plain identifier, so a structured binding (auto [a,b] = mk(), incl. the auto& reference form whose binding sits under a reference_declarator) declared only the first name in phase 1 and emitted ZERO defs in phase 2 — a,b were walked as spurious uses and later use(a)/use(b) resolved to a synthetic module binding, silently corrupting REACHING_DEF/taint for an idiomatic C++17 shape. Unwrap the structured_binding_declarator in both phases and def every identifier leaf; result-of-initializer flows to the whole list. Inert for C (no structured bindings). Characterization tests added (plain + reference form). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cfg): model C++ co_return as a return terminator to EXIT (#2195) co_return_statement was neither in CPP_CONTROL_FLOW_TYPES nor dispatched, so a coroutine's co_return coalesced into a straight-line block and emitted a spurious seq fallthrough to the following statement instead of an edge to EXIT — statements after co_return looked reachable and the terminator edge was missing, corrupting CFG/CDG for coroutines. Add the node type to the C++ control-flow set and dispatch it through visitReturn (block -> EXIT 'return', no fallthrough). C path untouched; co_await/co_yield remain plain expressions. Characterization test added; c-cpp suite + grammar-literal gate green, bench --check unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cfg): harvest C# out-var and deconstruction-declaration defs (#2195) Two idiomatic C# write shapes recorded ZERO defs, silently breaking REACHING_DEF/taint: - out-var (G(out var n) / G(out int n)) parses as a declaration_expression; it was neither declared (phase 1) nor def'd (phase 2), so n resolved to a synthetic module binding and the callee-written value had no reaching def. - deconstruction declaration (var (a, b) = T()) has a variable_declarator whose name slot is a tuple_pattern (null name field), so declareVariableDeclaration + the variable_declaration walk skipped it entirely (only the assignment form (a,b)=T() was handled). Both a and b were dropped. Declare + def the declaration_expression's identifier (must-def: out params are definitely-assigned), and route a null-name variable_declarator through the tuple_pattern via the existing declareForeachTarget/defTupleTargets helpers. Characterization tests added; csharp suite 42 passed, grammar gate + bench --check green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cfg): put embedded-script CFGs in file coordinates via lineOffset (#2195) A Vue SFC <script> block parses at row 0 but lives at lineOffset in the .vue file. Every other worker-emitted graph node adds lineOffset to reach file coordinates, but collectFunctionCfgs built FunctionCfgs from the extracted script's raw rows and never offset them. Two consequences for .vue files: - inter-procedural taint silently resolved NOTHING — the summary-harvest join keys graph Function/Method nodes by their (offset) startLine but looked up the CFG's (unoffset) functionStartLine, missing by exactly lineOffset, so no FunctionSummary was ever produced; - persisted BasicBlock startLine/endLine (and the id's functionStartLine segment) pointed at the wrong .vue line, breaking source mapping. Thread lineOffset into collectFunctionCfgs and shift every CFG source-line field (functionStartLine/End, block start/end, statement + non-synthetic binding lines) into file coordinates at the one production chokepoint. A 0 offset returns the CFG unchanged, so .ts/.js/etc. stay byte-identical (bench --check fingerprints unchanged; worker-roundtrip + pipeline-pdg green). Unit tests for the shift + the 0-offset no-op added. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(cfg): surface CDG soundness skips at warn, not just debug (#2195) skippedUnsoundFunctions (a function whose EXIT is not reverse-reachable from all blocks, so control dependence is withheld) was only reported inside the per-language logger.debug stats line — while the taint/RD coverage-gap and cap-drop counts surface unconditionally at warn. A language that systematically trapped EXIT (an unmodeled non-terminating / multi-terminal shape the synthetic-escape pass can't bridge) would silently lose all CDG. Add a parallel unconditional warn (R8) alongside the R4 taint-gap warn. Observability only — no graph change; emit-layer skip counting stays covered by cfg-emit's skippedUnsoundFunctions test. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cfg): harvest Kotlin x++/--x as a def (#2195) The Kotlin harvester had no postfix_expression/prefix_expression case, so an increment/decrement fell to the default descent and recorded its operand as a use only — never a def. Every sibling harvester (Java/C#/C++/Dart/TS/PHP) models inc/dec, so a Kotlin counting loop (while/for using i++) silently dropped the loop-carried reaching-def of the counter. Add the case: def AND use the operand when it is a plain simple_identifier and the operator is ++/-- (other pre/postfix forms — -x, !x, x!!, x? — stay pure reads, byte-identical to the old descent). Characterization tests for postfix + prefix added; kotlin suite 30 passed, grammar gate + bench --check green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cfg): harvest Go select channel-receive binding as a def (#2195) walkValue had no receive_statement case, so a select receive (case v := <-ch:) fell to the default descent: v was recorded as a USE of an uninitialized var and the channel-sourced definition was invisible to REACHING_DEF/taint — channels are a primary taint source in Go. Add the case mirroring short_var_declaration: def each left identifier, use the <-ch right, attach resultDefs for the := short form. prescan already declared the binding; this completes the phase-2 fact. go:branchy bench fingerprint unchanged; go suite 40 passed, grammar gate green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cfg): harvest all names of a Dart multi-variable declaration (#2195) `var a = 1, b = 2;` is one initialized_variable_definition whose first binding is the name/value field pair and whose subsequent bindings are trailing initialized_identifier children. Both prescan (declareInitializedVar) and the walkValue case read only the name/value fields, so every name after the first was never declared or def'd — `b` resolved to a synthetic module binding and its REACHING_DEF/taint flow was lost. Iterate the trailing initialized_identifier nodes in both phases. (Dart-3 record/list pattern declarations `var (a,b)=pair` remain a separate follow-up.) dart suite 35 passed, tsc + grammar gate green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cfg): bind Swift switch-case value patterns (case let n) (#2195) A switch value-binding (case let n where …, case .some(let v)) was never declared in prescan, so n/v resolved to a synthetic module binding and a body use(n) did not link to any def — a very common Swift idiom silently lost its data dependence. Declare the switch_pattern's bindings (prescan, reusing declarePattern) and emit them as MAY-defs on the dispatch block (a case may not match) via a new switchPatternFacts, propagated into the case body. swift suite 25 passed, tsc + grammar gate green. (The rare ?? / ternary-arm may-def — Swift assignment-as-expression — remains a separate follow-up.) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cfg): wire Swift multi-catch throw edges to every handler (#2195) visitDo routed the protected body's throw edge only to handlerEntries[0], so a do { try r() } catch A {} catch {} left the 2nd..Nth catch handlers UNREACHABLE from ENTRY — orphaned blocks whose error bindings + def/use facts were stranded in a dead component (a soundness gap for idiomatic Swift typed multi-catch). Swift tries the catch clauses in order and the thrown type is unknown at CFG time, so every protected block may reach ANY clause: edge each protected block to every handlerEntry. Found by the per-language CFG/CDG verification swarm (reproduced: 2-catch=1, 3-catch=3 unreachable blocks). swift suite 26 passed, tsc clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cfg): synthesize a protected block for an empty Kotlin try {} (#2195) An empty `try {}` body produced zero protected blocks, so visitTry's throw-edge loop wired nothing to the catch and the try's entry fell through to the finally — leaving the catch handler block + its error binding orphaned (unreachable from ENTRY), a malformed CFG with stranded def/use facts. Mirror the existing empty-`catch` synthesis: when the try body is empty and there is a catch or finally, synthesize one protected block so the catch handler(s) are wired and the try entry is the body, not the finally. Found by the per-language CFG verification swarm. Non-empty try is byte-identical; kotlin suite 31 passed, tsc clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * perf(cfg): bound the reaching-defs fixpoint with a per-block visit ceiling (#2195) The per-language verification swarm reproduced, AT PRODUCTION DEFAULTS, a reaching-defs blow-up: a machine-generated ~2000-line all-loops function (under DEFAULT_PDG_MAX_FUNCTION_LINES) reaches ~10k basic blocks because loops emit ~5 blocks/line, and the dataflow fixpoint is O(blocks^2.3) on deep loop nests — measured 62s (C/C++) and 2.05s + 810MB (Go) for ONE function. maxFacts does not help: the fact count stays LINEAR, so it never fires. Iterative reaching-defs on a reducible CFG converges in O(loop-nesting-depth) passes, so a worklist re-visits each block a small multiple of times for real code. Add a maxBlockVisits ceiling (emit passes blocks.length × 64 — far beyond any hand-written nesting depth, ~15) that bails when the fixpoint has not converged. An unconverged fixpoint's in/out sets are not sound, so it returns NO facts (status 'truncated', like the existing 'overflow' guard) — a per- function coverage gap, never wrong facts. Real code is byte-identical: full cfg suites 725 passed, bench --check fingerprints unchanged. NOTE: computeControlDependence's O(N²) up-walk on deep post-dom chains is the sibling concern but stays ~13ms in production (bounded by the line cap + the CDG materialization cap); a CDG work-budget is a documented follow-up. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cfg): raise the parse-worker stack limit for deep CFG recursion (#2195) The CFG visitors build per-function control-flow graphs by recursive descent over the tree-sitter AST, so deeply-nested source overflows the worker thread's call stack (~1.5k nesting levels) — caught per-function (R4 try/catch) but the function silently gets no PDG. A worker thread's stack is governed by resourceLimits.stackSizeMb (Node default 4 MB); the main process's --stack-size=4096 flag does NOT propagate to worker threads (confirmed by prior- art research on Node worker_threads). Raise it to 16 MB, pushing the overflow threshold to several-thousand nesting levels — far beyond any hand-written code, so only machine-generated/obfuscated nesting can still hit it (and that stays a caught per-function skip, never a crash). Complements a future proactive depth guard. pipeline-pdg worker tests 30 passed, tsc clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * perf(cfg): compute control dependence as a reverse-CFG dominance frontier (#2195) The Ferrante §3.1.1 up-walk re-climbed the ipdom chain once per CFG edge, which is Θ(N²) on a deep post-dom chain (a single branch fanning into a shared spine took ~7.1s at 16k blocks). Replace it with the reverse-CFG post-dominance-frontier formulation (Cytron, Ferrante, Rosen, Wegman & Zadeck 1991): control dependence IS the dominance frontier of the reverse CFG, computed bottom-up over the post-dom tree (PDF_local from a node's CFG in-edges + PDF_up from its post-dom-tree children) in O(N + E + output). LLVM (ReverseIDFCalculator), Joern (CdgPass) and WALA use the same form. Output is the IDENTICAL deduped/sorted (controller, dependent, label) set: verified byte-identical across all cfg unit+integration suites, the cdg-snapshot oracle, and bench --check fingerprints (unchanged). The PDF unions a label SET per (controller, dependent) pair, preserving the multi-label rows the old per-row dedup kept on opposite-sense (goto-cycle) arms. buildArmSenses, labelFor, the final sort and the maxEdges truncation cap are kept verbatim; the post-order walk is iterative so a chain-deep post-dom forest cannot overflow the stack. Adds three regressions: multi-label-per-pair preservation, the literal self-edge / NO_IPDOM seed guard (a !== x), and a fan-into-chain perf tripwire (linear vs the former quadratic up-walk). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(cfg): record the reaching-defs WTO no-go decision (#2195) Weak-topological-order / loop-aware iteration (Bourdoncle 1993) was evaluated as the fix for the O(blocks²) deep-loop-nest blow-up and rejected: a faithful WTO solver was 104/104 byte-identical to the RPO worklist but 0% faster — the cost is inherent dense-set propagation + lattice merges, not visitation order, and the loop-body-skip shortcut is unsound on irreducible (goto) CFGs. Document this at the RPO-order site and the emit.ts revisit-ceiling constant so the shipped blocks×64 bound reads as the sound backstop it is, with SSA-sparse reaching-defs named as the deferred real fix. Comment-only; no behavior change. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(cfg): proactive visitor nesting-depth guard + observable CFG skips (#2195) The CFG visitors are recursive-descent with no shared base, so a pathologically nested function (machine-generated / adversarial) could overflow the worker's native stack — a nondeterministic RangeError that escaped to the language-group catch and silently dropped EVERY remaining file's CFG. Guard it proactively: CfgBuilder tracks live recursive-descent nesting depth via enterNesting/exitNesting, called at each visitor's visitBody and visitSeq choke points (visitBody covers nested control constructs incl. else-if ladders; visitSeq covers deeply-nested bare blocks). Exceeding MAX_CFG_NESTING_DEPTH (500, far below the ~1.2k+ native limit and far above real code's ≤~50) throws a typed, DETERMINISTIC CfgNestingDepthError instead of waiting for the engine's nondeterministic overflow. collectFunctionCfgs now isolates the build PER FUNCTION: the depth bail or any other throw is caught, counted, and skipped — one bad function no longer loses the whole file's CFGs. CollectedCfgs.skipped widens from a bare number to reason-counted buckets (tooManyLines / tooDeeplyNested / buildError). The worker stops discarding that count (parse-worker.ts), aggregates it per-language onto ParseWorkerResult.cfgSkipped (survives the parse cache via slim's `...result`), and mergeChunkResults merges + warns per-language so a CFG coverage gap is observable, not silent. Behavior-preserving on normal code: the guard never fires below 500 nesting, so the cfg unit+integration suites (731), the CDG/RD/CFG snapshots and the bench --check fingerprints are all byte-identical. The worker stackSizeMb 4→16MB bump shipped earlier (de4c43a4). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(cfg): unify the nesting guard behind CfgBuilder.withNesting (#2195) Tri-review flagged the visitBody/visitSeq guard asymmetry (visitBody used try/finally; visitSeq placed a bare exitNesting before its tail return). It is not a bug today — the CfgBuilder is per-function and discarded on a bail, so a leaked counter is never read — but a future mid-loop return in visitSeq would silently corrupt the depth count. Replace both hand-paired sites in all 12 visitors with a single `CfgBuilder.withNesting(fn)` helper that enters on the way in and exits in a finally, so the pair can never drift. Also document that block-bodied constructs pass through BOTH choke points, so the effective lexical ceiling is ~MAX_CFG_NESTING_DEPTH/2 (~250). Behavior-preserving: 733 cfg tests + bench --check fingerprints byte-identical. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cfg): include cfgSkipped in all parse-worker result initializers (#2195) Tri-review found cfgSkipped omitted from the two reset/fallback ParseWorkerResult initializers (only the main one carried it). The field is optional with `?? {}` reads so there is no runtime bug, but the zero-state initializers should be complete and consistent. Also correct the field's doc-comment: the per-language merge + warn lives in `dispatchChunkParse` (alongside skippedLanguages), not `mergeChunkResults` — and, like that sibling telemetry, the warn fires for freshly-parsed chunks, not on a warm cache hit. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(cfg): scope the CDG byte-identical claim to the untruncated output (#2195) Tri-review noted the rewrite's `maxEdges` truncation now trims the SORTED edge set, whereas the old up-walk broke mid-walk in CFG-edge-iteration order — so a truncated PREFIX can differ at the cap boundary (only when a single function exceeds maxEdges; the FULL untruncated set is byte-identical, now also confirmed by ~1M-case differential fuzz). Clarify the module doc and the maxEdges param doc: the cap bounds OUTPUT count (peak working set ≈ output in the DF formulation, not the old pre-dedup spike), and the byte-identical guarantee is scoped to the untruncated output. Comments only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(cfg): strengthen depth-guard, perf-tripwire and buildError coverage (#2195) Tri-review test-quality findings: - cfg-builder: capture the thrown CfgNestingDepthError unconditionally (a catch-only assertion silently passes if a future change stops throwing); add a withNesting test that the counter balances on the THROW path too. - control-dependence perf tripwire: assert controller IDENTITY (every edge controlled by block 0, distinct dependents in range), not just length, so a fast-but-wrong reimplementation can't pass on the M-1 count alone. - worker-roundtrip: add the missing buildError test — a generic (non-depth) buildFunctionCfg throw is caught per function, counted under buildError, and does NOT drop the file's sibling CFGs. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cfg): model Kotlin value-position when/if as control dependence (#2205) Idiomatic Kotlin uses `if`/`when` as EXPRESSIONS (`val x = when (k) { … }`, `return if (c) a else b`, `fun f() = when (k) { … }`), but the visitor only modeled them as control flow in statement position (the `isStatementPosition` gate) — value-position branches collapsed into one straight-line block, so their arms emitted no control dependence. Cross-language PDG validation (#2195, PR #2197) measured the result: two Kotlin repos at 3% / 6% CDG per BasicBlock vs 18–76% for every other language (incl. the other expression-conditional languages, Rust 30% / Swift 24%). Model value-position `when` (≥2 arms) and `if`/`else` as control flow in the three dominant carriers — `property_declaration` (rejoin the arms at a binding continuation carrying the bound name's def), `return`, and the `fun f() = …` expression body (each arm returns) — mirroring the Rust visitor's value-position `let` handling. `visitWhen`/`visitIf` are reused unchanged; `isControlFlow` now routes a value-branch `val`/`var` decl to the branch handler instead of coalescing it. Measured: Exposed CDG 3636→5644 (+55%, 6%→9% of BasicBlocks), turbine 67→82 (+22%). Argument-position branches, assignment RHS, and value-position `try` are left inline — a remaining gap tracked on #2205. Behavior-preserving for non-Kotlin (bench --check byte-identical; 739 cfg tests incl. 6 new value-position regressions). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cfg): model Ruby value-position if/case on assignment RHS as control dependence (#2195) `if`/`case` are expressions in Ruby; as an `assignment` RHS (`x = if c then a else b end`, `x = case k … end`) the visitor previously left the arms INLINE in one coalesced block (a gap documented at ruby.ts §"if/case/begin are EXPRESSIONS"), emitting no control dependence. Model the RHS branch as control flow and bind the LHS at the rejoin: `assignmentBranch` detects the carrier, `visitSeq` routes it out of the coalescing path, and `visitBindBranch` reuses `visitIf`/`visitCase` + a facts-only continuation carrying the LHS def (new `harvest.assignmentDefFacts`). Mirrors the Kotlin (#2205) and Rust value-position handling. Honest impact: SMALL in practice — rack CDG 1269→1303, sinatra 1212→1232 (~+2–3%). `x = if/case` is far rarer in idiomatic Ruby than the Kotlin analog (Ruby favors ternary / `||=` / guard modifiers), and Ruby's low CDG/BB is mostly structural (micro-branches `&&`/`||`/`?:`/`&.` excluded by design, plus many straight-line `.each`/`.map` block CFGs). This closes the documented gap correctly; it is not a large ratio mover. Explicit `return if … end` is NOT a carrier — tree-sitter-ruby drops that value; the idiomatic implicit-last-expression conditional was already modeled. Behavior-preserving for non-Ruby (bench --check byte-identical; 744 cfg tests incl. 5 new value-position regressions). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cfg): keep an empty-arm Kotlin when wired to the join (#2195) An all-empty-arm `when` with an `else` — `when(k){0->{};else->{}}`, idiomatic `else -> {}` "do nothing" — left the dispatch block with ZERO successors: empty arms got no `switch-case` edge, and the `else` suppressed the no-match edge. The dispatch and its join then became orphaned, so isExitReachableFromAllBlocks returned false and emitFileCdg silently dropped the ENTIRE function's control dependence (counted cdgSkippedUnsound). The #2205 value-position fix newly routes `val x = when(…)` / `return when(…)` / `fun f() = when(…)` through visitWhen, exposing it in those carriers too. Wire every arm (empty or not) to the join, so the dispatch always has a successor. Found by the per-language CFG verification swarm. Behavior- preserving elsewhere (bench --check byte-identical; cfg suite green). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cfg): wire C/C++ throw edges to every catch handler, not just the first (#2195) `visitTry` edged every protected-region block only to `handlerEntries[0]`, so in a multi-`catch` (`catch(int e){…} catch(double d){…} catch(...){…}`) the 2nd..Nth handlers were orphaned — unreachable from ENTRY, their catch-param binding and body control/data flow silently lost. The runtime catch that matches a thrown type is not statically known, so over-approximate: edge each protected block to EVERY handler entry (mirrors the Swift multi-catch handling). Found by the per-language CFG verification swarm; the two existing exception tests both used a single catch, so it was never exercised. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cfg): keep a bare continue in a Dart switch case — it targets the loop (#2195) `caseStatements` stripped EVERY `continue_statement` from a case body, but only a LABELED `continue LABEL;` is a switch fallthrough-spill (handled via caseContinueLabel). A bare `continue;` targets the ENCLOSING LOOP (valid Dart); dropping it removed the jump and fabricated a false case → next-statement fall-through edge (e.g. `case 1: tainted(); continue; default: sink();` made tainted() flow directly into sink()). Only strip the labeled form; a bare `continue;` stays in the body and routes to the loop. Found by the per-language CFG verification swarm. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cfg): harvest Rust match-arm pattern bindings as defs (taint propagation) (#2206) `visitMatch` visited arm bodies but never harvested the arm PATTERN's bindings, so `match x { Some(n) => sink(n) }` left `n` with a use and no def/may-def — taint from the matched subject could not propagate into the arm. Add `matchArmPatternFacts` (the binders as MAY-defs, since only the matching arm binds) and attach it to the dispatch block, co-located with the subject's use. Found by the per-language CFG verification swarm; the match tests asserted `hasUse` but never `hasDef`. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cfg): harvest Swift guard case / if case enum-pattern bindings as locals (#2206) `guard case .some(let v) = e` / `if case let .x(n) = e` nest the binder inside a `pattern` condition child, not a direct `bound_identifier`. Both the declaration (declareOptionalBindings) and the def-facts (conditionFacts, which ran walkValue = a USE on the pattern) missed it, so the binding resolved to a synthetic `@module` global with a use and no def — breaking taint propagation from the subject. Declare the `pattern` child and def its leaves (may-def when conditional). Found by the per-language CFG verification swarm. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cfg): treat Dart switch-expression arm writes as may-defs, not hard kills (#2206) `DartHarvester.walkValue` had no `switch_expression` case, so an assignment in an arm value — `var y = switch(x){ 1 => z = 10, _ => z = 20 }` — became an unconditional def that KILLED the prior `z`, even though only one arm runs (the module docstring claimed it was a may-def, but the code didn't implement it). Walk the subject always and each `switch_expression_case` under `conditional(…)`, so arm writes are may-defs — mirroring `conditional_expression`. Found by the per-language CFG verification swarm. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(cfg): model the C# `using var` declaration-form dispose finalizer (#2206) `using var f = Open();` (C# 8) parses as a `local_declaration_statement` with a leading `using` keyword, not a `using_statement`, so visitUsing never ran — no dispose block, and a `return`/`break`/`continue` in its scope got no `finally-*` completion edge. Unlike the delimited block form, its dispose runs at ENCLOSING-SCOPE exit, so visitSeq now treats the REST of the sequence as the protected body: the acquisition (`var f = e`) is a normal block outside the dispose region (a throw there means the resource was never acquired), and `buildUsingDeclScope` wraps the remainder in a synthetic dispose finalizer (normal + exception exit, early exits thread through) — mirroring buildProtectedSynthetic. Closes the last #2206 item. Found by the per-language CFG verification swarm. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-15 12:31:04 +01:00