@aroman22/codegraph-vba-darwin-arm64 1.3.5 → 1.5.0

package/lib/dist/extraction/vba-extractor.js

@@ -431,21 +431,37 @@ class VbaExtractor {
             // See vba-form-extractor.ts:findControlName for the matching real
             // form-instance-control node emission.
             const handler = parseEventHandlerName(name);
-            const isFormCodeBehind = /Form_[^/\\]*\.cls$/i.test(this.filePath);
+            // Prefix-driven sibling binding (issue #41). Both `Form_*.cls` and
+            // `Report_*.cls` Dysflow code-behind files share the same code path;
+            // only the sibling extension differs (`.form.txt` vs `.report.txt`).
+            // The check is on the BASENAME prefix so a class called
+            // `FormularioVentas.cls` or `ReportingHelper.cls` (no trailing
+            // underscore) does not match — the trailing `_` is the discriminator.
+            // Any other `.cls` (e.g. `InformeRiesgoPDFServicio.cls` with methods
+            // like `GenerarHTML_Principal`) gets `codeBehindExt === null` and is
+            // skipped, preserving the original Form_-only guard's behaviour for
+            // non-form classes.
+            const basename = path.basename(this.filePath).toLowerCase();
+            const codeBehindExt = basename.startsWith('report_')
+                ? '.report.txt'
+                : basename.startsWith('form_')
+                    ? '.form.txt'
+                    : null;
+            const isFormCodeBehind = codeBehindExt !== null;
             if (handler && isFormCodeBehind) {
-                const formFilePath = this.filePath.replace(/\.cls$/i, '.form.txt');
-                const controlNodeId = (0, tree_sitter_helpers_1.generateNodeId)(formFilePath, 'form-instance-control', handler.controlName, 0);
+                const siblingPath = this.filePath.replace(/\.cls$/i, codeBehindExt);
+                const controlNodeId = (0, tree_sitter_helpers_1.generateNodeId)(siblingPath, 'form-instance-control', handler.controlName, 0);
                 // Stub form-instance-control: local so the per-file edge filter
                 // passes the event-handler edge. Overwritten by the real node
-                // emitted from the sibling .form.txt at index time (same id, same
-                // schema, INSERT OR REPLACE). No metadata.controlType here — the
-                // .form.txt side carries the real control type.
+                // emitted from the sibling .form.txt (or .report.txt) at index time
+                // (same id, same schema, INSERT OR REPLACE). No metadata.controlType
+                // here — the sibling side carries the real control type.
                 this.nodes.push({
                     id: controlNodeId,
                     kind: 'form-instance-control',
                     name: handler.controlName,
-                    qualifiedName: `${formFilePath}::${handler.controlName}`,
-                    filePath: formFilePath,
+                    qualifiedName: `${siblingPath}::${handler.controlName}`,
+                    filePath: siblingPath,
                     language: 'vba',
                     startLine: 0,
                     endLine: 0,
@@ -554,6 +570,7 @@ class VbaExtractor {
                     id: eventId,
                     kind: 'event',
                     name,
+                    signature: line.trim(),
                     qualifiedName: this.classNamePrefix ? `${this.classNamePrefix}.${name}` : name,
                     filePath: this.filePath,
                     language: 'vba',
@@ -620,6 +637,7 @@ class VbaExtractor {
                     endColumn: line.length,
                     visibility,
                     metadata: {
+                        isDeclare: true,
                         dll,
                         declareKind,
                         ptrSafe,
@@ -693,17 +711,56 @@ class VbaExtractor {
      * DIM_UNQUAL_RE pair with a prefix-check + global scan that handles
      * `As New <Type>`, multi-variable `Dim a As Foo, b As Bar`, and all
      * visibility keywords in one pass.
+     * Issue #47: now also accepts `Global` (module-level typed instance) and
+     * `Static` (procedure-local retention modifier) so they emit the same
+     * `references` edge and `localVarTypeMap` registration as their `Dim`
+     * siblings today. The negative lookahead is unchanged: `Const` is still
+     * routed to `sweepEnumsAndConsts`.
      */
-    static DIM_DECL_PREFIX_RE = /^\s*(?:Dim|Private|Public)\s+(?!(?:Function|Sub|Property|Const|WithEvents)\b)/i;
+    static DIM_DECL_PREFIX_RE = /^\s*(?:Dim|Private|Public|Global|Static)\s+(?!(?:Function|Sub|Property|Const|WithEvents)\b)/i;
     /**
      * Globally scan all `identifier As [New] TypePart1[.TypePart2]` on a
      * variable declaration line. Run with /g after confirming DIM_DECL_PREFIX_RE.
      *
-     * Groups: (1) variable name, (2) type outer part, (3) type inner part (if qualified).
+     * Groups: (1) variable name, (2) bracketed outer type, (3) unbracketed
+     * outer type, (4) bracketed inner type (if qualified), (5) unbracketed
+     * inner type. The variable name is always bare (`Dim` cannot declare a
+     * bracketed variable). The TYPE position accepts BOTH bracketed names
+     * with spaces (e.g. `[Clase Con Espacios]`) and bare identifiers — the
+     * bracketed capture wins when present. Only one of (2)/(3) and one of
+     * (4)/(5) is ever populated per match.
      * `(?:New\s+)?` consumes the VBA auto-instantiation keyword so it is
      * never captured as the type name (Fix 1).
+     *
+     * Issue #54: extends the type alternative to accept `[Name With Spaces]`
+     * so `Dim x As [Clase Con Espacios]` emits a `references` edge to
+     * `Clase Con Espacios` (brackets unwrapped). The unwrap is applied in
+     * the sweep loop by picking the bracketed capture group when present.
+     */
+    static DIM_ALL_VARS_RE = /\b(\p{L}[\p{L}\p{N}_]*)\s+As\s+(?:New\s+)?(?:\[([^\]]+)\]|(\p{L}[\p{L}\p{N}_]*))(?:\.(?:\[([^\]]+)\]|(\p{L}[\p{L}\p{N}_]*)))?/giu;
+    /**
+     * Bare-declared variable capture for the `Dim|Private|Public|Global|Static`
+     * prefix. Captures (1) the variable name. Used to register bare `Dim x`
+     * (no `As` clause) and explicit-primitive `Dim x As Long|String|...`
+     * declarations into `localVarTypeMap` so the type tracking is consistent
+     * across all three Dim shapes:
+     *
+     *   `Dim x`                → outer = 'variant' (VBA default)
+     *   `Dim x As Variant`     → outer = 'variant'  (PRIMITIVE_TYPES member)
+     *   `Dim x As Long`        → outer = 'long'     (PRIMITIVE_TYPES member)
+     *   `Dim x As Foo`         → outer = 'foo'      (project class — non-primitive)
+     *
+     * Antigravity audit Task 3: the previous `DIM_ALL_VARS_RE` only matched
+     * the `... As <Type>` form, so a bare `Dim x` was invisible to
+     * `isLocalProjectClassVar` / `scanCallSites` and `x.Method(1)` produced
+     * a dead-end `calls` edge to a stub named `x.Method` that no resolver
+     * could repoint. Registering bare Dim with `outer = 'variant'` closes
+     * the gate, so `scanCallSites` skips ONLY when the receiver is mapped
+     * as a primitive — leaving the "undeclared receiver → stub → resolver
+     * repoints" path intact for cross-module qualified calls like
+     * `modUtils.Foo(1)` (`modUtils` is not in `localVarTypeMap`).
      */
-    static DIM_ALL_VARS_RE = /\b(\p{L}[\p{L}\p{N}_]*)\s+As\s+(?:New\s+)?(\p{L}[\p{L}\p{N}_]*)(?:\.(\p{L}[\p{L}\p{N}_]*))?/giu;
+    static BARE_DIM_VAR_RE = /^\s*(?:Dim|Private|Public|Global|Static)\s+(\p{L}[\p{L}\p{N}_]*)\s*(?:,|$|\b)/iu;
     /**
      * VBA primitive type names — skipped when emitted as Dim targets so
      * we don't pollute the graph with `As Long` / `As String` references.
@@ -717,8 +774,8 @@ class VbaExtractor {
         'string', 'boolean', 'date', 'variant', 'object', 'error',
         'empty', 'null', 'longptr', 'longlong', 'new',
     ]);
-    /** `WithEvents m_X As Form_Foo` — Dim/Private/Public prefix is optional. */
-    static WITHEVENTS_RE = /^\s*(?:(?:Dim|Private|Public)\s+)?WithEvents\s+\p{L}[\p{L}\p{N}_]*\s+As\s+(\p{L}[\p{L}\p{N}_]*)/iu;
+    /** `WithEvents m_X As Form_Foo` — Dim/Private/Public/Global/Static prefix is optional. */
+    static WITHEVENTS_RE = /^\s*(?:(?:Dim|Private|Public|Global|Static)\s+)?WithEvents\s+\p{L}[\p{L}\p{N}_]*\s+As\s+(\p{L}[\p{L}\p{N}_]*)/iu;
     sweepDimsAndWithEvents(src) {
         const lines = src.split('\n');
         let count = 0;
@@ -734,8 +791,14 @@ class VbaExtractor {
                 let m;
                 while ((m = VbaExtractor.DIM_ALL_VARS_RE.exec(line)) !== null) {
                     const varName = m[1] ?? '';
-                    const outerType = m[2] ?? '';
-                    const innerType = m[3] ?? '';
+                    // Issue #54: DIM_ALL_VARS_RE groups (2) and (3) are alternative
+                    // captures for the same outer-type position — the bracketed
+                    // alternative wins when present, the bare one otherwise. The
+                    // captured value is already unwrapped (the `[...]` is consumed
+                    // by the regex, group (2) holds the inner content). Same shape
+                    // for the inner type at groups (4)/(5).
+                    const outerType = m[2] ?? m[3] ?? '';
+                    const innerType = m[4] ?? m[5] ?? '';
                     // Fix 2 (Issue #2): populate the local var type map so that
                     // `sweepCallsAndSql` can gate qualified statement-form calls.
                     if (varName && outerType) {
@@ -761,6 +824,37 @@ class VbaExtractor {
                         }
                     }
                 }
+                // Antigravity audit Task 3: bare `Dim x` (no `As` clause) and
+                // explicit-primitive `Dim x As <primitive>` declarations must
+                // still register `x` in `localVarTypeMap` so the qualified-call
+                // site scan in `scanCallSites` can gate the dead-end stub that
+                // no resolver could ever repoint.
+                //
+                // Captures the FIRST variable name only. Multi-variable bare
+                // Dim (e.g. `Dim a, b, c` without an `As` clause) is rare in
+                // real Dysflow fixtures and is intentionally NOT tracked here —
+                // those bare variables fall back to the undeclared-receiver
+                // path, which is the conservative choice. Skip if the typed-form
+                // loop already populated the entry.
+                const bm = VbaExtractor.BARE_DIM_VAR_RE.exec(line);
+                if (bm) {
+                    const varName = bm[1] ?? '';
+                    if (varName) {
+                        const key = varName.toLowerCase();
+                        if (!this.localVarTypeMap.has(key)) {
+                            // Look for an `As <Type>` continuation on the same line so the
+                            // outer type matches the existing typed-form behaviour. If
+                            // absent, the variable is implicit `Variant` per VBA semantics.
+                            const asRe = /\bAs\s+(\p{L}[\p{L}\p{N}_]*)/iu;
+                            const asMatch = asRe.exec(line);
+                            const outer = asMatch ? (asMatch[1] ?? '').toLowerCase() : 'variant';
+                            this.localVarTypeMap.set(key, {
+                                outer,
+                                qualified: false,
+                            });
+                        }
+                    }
+                }
             }
             // WithEvents declarations — handled by their own regex; also populate
             // the local var type map for completeness.
@@ -769,7 +863,7 @@ class VbaExtractor {
                 const formType = weMatch[1] ?? '';
                 if (formType) {
                     // Extract the variable name from the WithEvents line for the map.
-                    const weVarM = /^\s*(?:(?:Dim|Private|Public)\s+)?WithEvents\s+(\p{L}[\p{L}\p{N}_]*)/iu.exec(line);
+                    const weVarM = /^\s*(?:(?:Dim|Private|Public|Global|Static)\s+)?WithEvents\s+(\p{L}[\p{L}\p{N}_]*)/iu.exec(line);
                     const weVarName = weVarM?.[1] ?? '';
                     if (weVarName) {
                         this.localVarTypeMap.set(weVarName.toLowerCase(), {
@@ -816,6 +910,15 @@ class VbaExtractor {
     static ENUM_MEMBER_RE = /^\s*(\p{L}[\p{L}\p{N}_]*)\s*(?:=|$)/u;
     /** `[visibility] Const <decls>` — captures visibility (1) and the rest (2). */
     static CONST_DECL_RE = /^\s*(?:(Public|Private|Friend|Global)\s+)?Const\s+(.+)$/i;
+    /**
+     * Issue #52: shared `End Sub` / `End Function` / `End Property` marker.
+     * Promoted from a local regex in `sweepCallsAndSql` so `sweepEnumsAndConsts`
+     * can walk the same proc boundaries and decide Const scope per line.
+     * The `(?:^|:\s*)` prefix tolerates colon-separated single-line procs
+     * (`Public Sub X(): ... : End Sub`) so the proc stack pops on the same
+     * physical line.
+     */
+    static PROCEDURE_END_RE = /(?:^|:\s*)End\s+(?:Sub|Function|Property)\b/i;
     /**
      * Fold a VBA visibility keyword to the canonical lowercase enum, matching
      * the procedure convention: `Private` → 'private'; `Public`, `Global`,
@@ -842,9 +945,37 @@ class VbaExtractor {
         const lines = src.split('\n');
         let count = 0;
         let currentEnum = null;
+        // Issue #52: reset the shared scope stack + lookup key so leftover
+        // state from a previous extract() (impossible in production but
+        // possible in unit tests that construct a fresh extractor and run
+        // twice) never leaks across sweeps. The walk below updates both
+        // every iteration; `sweepCallsAndSql` resets again at its own
+        // start, before any OpenForm/OpenQuery reader consults them.
+        this.procStack.length = 0;
+        this.currentProcKey = 'module';
         for (let i = 0; i < lines.length; i++) {
             const line = lines[i] ?? '';
             const lineNum = i + 1;
+            // Issue #52: track proc scope so Const declarations on this line
+            // can decide whether they belong to the module (currentProcKey
+            // === 'module') or to the top-most procedure (write the per-proc
+            // bucket, skip the module-level `constant` node emission).
+            //
+            // PROC_RE cannot overlap with CONST_DECL_RE on the same physical
+            // line (different leading keywords), so it is safe to advance the
+            // stack here and then fall through to the rest of the body.
+            const procStart = VbaExtractor.PROC_RE.exec(line);
+            if (procStart) {
+                this.procStack.push(lineNum);
+                this.currentProcKey = String(lineNum);
+            }
+            else if (VbaExtractor.PROCEDURE_END_RE.test(line) && this.procStack.length > 0) {
+                this.procStack.pop();
+                this.currentProcKey =
+                    this.procStack.length > 0
+                        ? String(this.procStack[this.procStack.length - 1])
+                        : 'module';
+            }
             if (currentEnum) {
                 if (VbaExtractor.ENUM_END_RE.test(line)) {
                     currentEnum = null;
@@ -913,9 +1044,20 @@ class VbaExtractor {
                     const constName = declaration.name;
                     if (!constName)
                         continue;
+                    // Issue #52: every Const line (module-level or proc-local)
+                    // writes into a per-scope resolution bucket so
+                    // `DoCmd.OpenForm FORM_X` later resolves correctly; module-level
+                    // Consts additionally emit a `constant` graph node + the
+                    // module→constant `contains` edge. Proc-local Consts skip both
+                    // (the const is not a module symbol, so the wrong-containment
+                    // node + edge the pre-fix code emitted are gone), but the
+                    // per-proc bucket keeps OpenForm/OpenQuery argument
+                    // resolution working exactly as before.
                     if (declaration.value !== null) {
-                        this.localConstants.set(constName.toLowerCase(), declaration.value);
+                        this.setLocalConstInScope(this.currentProcKey, constName, declaration.value);
                     }
+                    if (this.procStack.length > 0)
+                        continue;
                     const constId = (0, tree_sitter_helpers_1.generateNodeId)(this.filePath, 'constant', constName, lineNum);
                     this.nodes.push({
                         id: constId,
@@ -965,11 +1107,20 @@ class VbaExtractor {
      *  - While inside a procedure, scan the line for call-site patterns and
      *    SQL-wrapper patterns.
      *
-     * Call-site regex: `(?<!\w)([A-Za-z_]\w*)(?:\.([A-Za-z_]\w*))?\s*\(` —
-     * captures either `Name(...)` (same-file candidate) or `Receiver.Member(...)`
-     * (qualified — emit a synthetic node + heuristic edge).
+     * Call-site regex captures either `Name(...)` (same-file candidate) or
+     * `Receiver.Member(...)` (qualified — emit a synthetic node + heuristic
+     * edge). The receiver AND member alternatives accept BOTH the bare form
+     * (`Foo`) and the VBA bracketed form (`[Foo Bar]`) — bracketed captures
+     * win when present. Only one of (1)/(2) and one of (3)/(4) is ever
+     * populated per match. Brackets are stripped by the regex itself (the
+     * capture groups hold the inner content), so callers receive unwrapped
+     * identifiers and the `${name}.${proc}` stub shape stays canonical.
+     *
+     * Issue #54: the bracketed alternative was previously absent, so
+     * `[FUNCIONES UTILES].FormatearFecha(fecha)` (a real Dysflow-exported
+     * idiom for modules with spaces in their names) was silently dropped.
      */
-    static CALL_RE = /(?<![\w.])(\p{L}[\p{L}\p{N}_]*)(?:\.(\p{L}[\p{L}\p{N}_]*))?\s*\(/gu;
+    static CALL_RE = /(?<![\w.])(?:\[([^\]]+)\]|(\p{L}[\p{L}\p{N}_]*))(?:\.(?:\[([^\]]+)\]|(\p{L}[\p{L}\p{N}_]*)))?\s*\(/gu;
     /** SQL wrapper helpers — order matters because `db.Execute` is a suffix of others. */
     static SQL_WRAPPERS = [
         { name: 'DoCmd.RunSQL', re: /\bDoCmd\.RunSQL\s+"((?:[^"]|"")*)"/g },
@@ -1002,37 +1153,279 @@ class VbaExtractor {
      * the `opens-form` edge instead — sharing no logic with CALL_RE.
      */
     static OPEN_FORM_ARG_RE = /\bDoCmd\.OpenForm\s+("(?:(?:[^"]|"")*)"|\p{L}[\p{L}\p{N}_]*)/gu;
+    /**
+     * Issue #48: `DoCmd.OpenReport "<ReportName>"` modelling regex — sibling
+     * of `OPEN_FORM_ARG_RE` (hueco 6 expanded). Same literal-or-bare-id argument
+     * capture (group 1) and same trailing positional-args drop. The dispatch
+     * table `DOCMD_OPEN_DISPATCH` (below) carries the per-method metadata so
+     * OpenForm and OpenReport share the same scan/emit pipeline while their
+     * edge kinds (`opens-form` vs `opens-report`), stub node kinds
+     * (`form-layout` vs `report-layout`), synthetic file-path prefixes, and
+     * qualifiedName prefixes (`Form_<Name>` vs `Report_<Name>`) stay
+     * distinct.
+     */
+    static OPEN_REPORT_ARG_RE = /\bDoCmd\.OpenReport\s+("(?:(?:[^"]|"")*)"|\p{L}[\p{L}\p{N}_]*)/gu;
+    /**
+     * Issue #48 dispatch table — shared literal-or-Const argument resolution
+     * for `DoCmd.OpenForm` and `DoCmd.OpenReport`. Each entry is everything
+     * `scanDoCmdOpenCalls` + `emitOpensStubEdge` need to share the pipeline
+     * between methods while keeping the per-method names distinct.
+     *
+     * OpenQuery is intentionally NOT in this dispatch — it emits an
+     * `UnresolvedReference` (not a stub + edge), resolution to the REAL
+     * `query` node emitted by `SqlQueryExtractor`. See
+     * `OPEN_QUERY_ARG_RE` + `scanDoCmdOpenQuery`.
+     *
+     * Why a separate dispatch: `DoCmd` is in `RUNTIME_RECEIVER_BLACKLIST`
+     * (R4 invariant), so ALL of these methods are intentionally SKIPPED by
+     * the generic `CALL_RE` path that would otherwise emit a junk `calls`
+     * edge to a synthetic `function` node for `DoCmd.OpenX`. This dispatch
+     * matches BEFORE the call-site scan and uses its own emission path.
+     */
+    static DOCMD_OPEN_DISPATCH = [
+        {
+            method: 'OpenForm',
+            re: VbaExtractor.OPEN_FORM_ARG_RE,
+            edgeKind: 'opens-form',
+            stubKind: 'form-layout',
+            syntheticPrefix: 'synthetic:opensFormStub',
+            syntheticExtension: '.form.txt',
+            moduleNamePrefix: 'Form_',
+            cacheKey: 'OpenForm',
+            metadataTargetKey: 'targetFormName',
+            synthesizedBy: 'vba-opens-form',
+        },
+        {
+            method: 'OpenReport',
+            re: VbaExtractor.OPEN_REPORT_ARG_RE,
+            edgeKind: 'opens-report',
+            stubKind: 'report-layout',
+            syntheticPrefix: 'synthetic:opensReportStub',
+            syntheticExtension: '.report.txt',
+            moduleNamePrefix: 'Report_',
+            cacheKey: 'OpenReport',
+            metadataTargetKey: 'targetReportName',
+            synthesizedBy: 'vba-opens-report',
+        },
+    ];
+    /**
+     * Issue #48: `DoCmd.OpenQuery "<QueryName>"` modelling regex. Emits an
+     * `UnresolvedReference` (NOT a stub + edge) so the resolver binds to the
+     * REAL `query` node `SqlQueryExtractor` emits for `queries/<Name>.sql`
+     * — the same shape as `vba-me-control` and `vba-forms-bang`. The query
+     * may not yet exist in the index when the .bas is parsed; the resolver
+     * does the binding when the .sql is later indexed.
+     *
+     * Argument shape: identical to OpenForm/OpenReport — literal `"..."` or
+     * bare identifier resolved against local `Const` declarations, falling
+     * back to the bare identifier when unknown.
+     */
+    static OPEN_QUERY_ARG_RE = /\bDoCmd\.OpenQuery\s+("(?:(?:[^"]|"")*)"|\p{L}[\p{L}\p{N}_]*)/gu;
     /** SQL assigned to a local variable, e.g. `m_SQL = "SELECT ..." & ...`. */
     static SQL_VAR_ASSIGN_RE = /^\s*(\p{L}[\p{L}\p{N}_]*)\s*=\s*(.*)$/iu;
     /** SQL wrapper called with a variable, e.g. `getdb().Execute m_SQL`. */
     static SQL_VAR_EXEC_RE = /\b(?:\p{L}[\p{L}\p{N}_]*)?db\b(?:\(\))?\.(?:OpenRecordset|Execute)\s*\(?\s*(\p{L}[\p{L}\p{N}_]*)\s*\)?/giu;
-    /** SQL table-name regex scoped to FROM / INTO / UPDATE. */
-    static SQL_TABLE_RE = /\b(?:FROM|INTO|UPDATE)\s+(\[?\p{L}[\p{L}\p{N}_]*\]?)/giu;
     /**
-     * `Me.<ControlName>` reference capture — hole 1 of VBA control-modeling.
+     * Issue #42: `DoCmd.RunSQL <identifier>` (variable form) — the dominant
+     * Access idiom for executing a dynamically-built SQL string. Today only
+     * the literal form `DoCmd.RunSQL "DELETE FROM X"` is tracked via the
+     * `SQL_WRAPPERS` regex at line 1108; the variable form silently dropped
+     * table impact for every procedure that builds SQL in a string and runs
+     * it through `DoCmd.RunSQL`.
+     *
+     * This regex is the DoCmd.RunSQL analogue of `SQL_VAR_EXEC_RE` above and
+     * is iterated by `scanSqlInLine` (lines 2051+). When a match is found,
+     * the captured identifier is resolved against `sqlVariables` (populated
+     * by `trackSqlVariableAssignment` with `&`-accumulate semantics — Issue
+     * #13) and the resulting SQL string drives `emitSqlTableReferences`.
+     *
+     * The optional `(?:\(\))?` + `\s*\(?` shape lets the regex match both
+     * the parenthesised form `DoCmd.RunSQL(strSQL)` and the no-paren form
+     * `DoCmd.RunSQL strSQL` that the existing SQL_WRAPPERS literal regex
+     * does not cover. The captured identifier is the only thing we need —
+     * we DO NOT try to parse what the variable points at; that's the
+     * existing `sqlVariables` map's job.
+     */
+    static SQL_VAR_DOCMD_RUNSQL_RE = /\bDoCmd\.RunSQL\s*\(?\s*(\p{L}[\p{L}\p{N}_]*)\s*\)?/giu;
+    /**
+     * SQL table-name regex scoped to the clauses that introduce a table
+     * reference: `FROM <t>`, `JOIN <t>`, `INTO <t>`, `UPDATE <t>`. Adding
+     * `JOIN` lets the scanner pick up tables from joined fragments that
+     * arrive via `&`-concatenated wrapper literals (e.g.
+     * `db.Execute "FROM A" & " JOIN B"`); without it the second literal's
+     * table was silently dropped even though the wrapper regex now matches
+     * the chain.
+     *
+     * The captured table name is an optional bracketed/unbracketed schema
+     * prefix followed by a `.`, then a bracketed-or-bare identifier — so
+     * `FROM dbo.tblCustomers` and `FROM [My Schema].[My Table]` come
+     * through as one composite reference. Without the prefix the regex
+     * still matches a single identifier byte-identical to the old shape.
+     * Brackets in the captured composite are stripped by
+     * `emitSqlTableReferences` (`replace(/[\[\]]/g, '')`), so the public
+     * node name is the unwrapped form `dbo.tblCustomers` /
+     * `My Schema.My Table` — matching how plain `[Order Details]` is also
+     * unwrapped to `Order Details`. The identifier class
+     * `\[[^\]]+\]|\p{L}[\p{L}\p{N}_]*` (same as the saved-queries
+     * `TABLE_RE` in `sql-query-extractor.ts`) ensures bracketed names
+     * with spaces — `[Order Details]`, `[My Schema]`, `[My Table]` —
+     * are captured whole.
+     */
+    static SQL_TABLE_RE = /\b(?:FROM|JOIN|INTO|UPDATE)\s+((?:(?:\[[^\]]+\]|\p{L}[\p{L}\p{N}_]*)\.)?(?:\[[^\]]+\]|\p{L}[\p{L}\p{N}_]*))/giu;
+    /**
+     * Issue #50: TempVars — Access's global key-value store for cross-form
+     * state. We model each STATIC-LITERAL key as a synthetic `class` placeholder
+     * (same NodeKind as SQL table refs, see `emitReference`) and emit one
+     * `references` edge per reading/writing procedure with
+     * `metadata.synthesizedBy: 'vba-tempvar'` and `metadata.access` ∈
+     * `{'read','write'}` (the user-facing enum; lowercase single-tokens).
+     *
+     * Three scanner surfaces cover the four real idioms:
+     *   - `TEMP_VAR_BANG_RE`  — `TempVars!clave`         (no parens; write or read)
+     *   - `TEMP_VAR_PAREN_RE` — `TempVars("clave")`      (parens; write or read)
+     *   - `TEMP_VAR_ADD_RE`   — `TempVars.Add "clave", v` (always a write)
+     *
+     * Bang vs paren split by line-source: the bang form has no string literals
+     * in scope, so we scan the MASKED line (`maskStringContent` replaces
+     * `"…"` content with spaces — same line source the call-site / With
+     * event scanners consume). The paren and Add forms have their key INSIDE
+     * a `"…"` literal that gets blanked by the masker, so those regexes scan
+     * the ORIGINAL (unmasked) line — same split the SQL_TABLE_RE/OpenForm
+     * literal scanners already use.
+     *
+     * Dynamic-key forms — `TempVars(strNombre)`,
+     * `TempVars("clave" & suffix)` — are silently unmatched by all three
+     * regexes (none of them tolerate a function-call or `&` arg). REQ-CODE-4
+     * "unresolvable is silent" applies: these stay silent by design to
+     * prevent placeholder-node explosion.
+     */
+    static TEMP_VAR_BANG_RE = /\bTempVars!\s*(\p{L}[\p{L}\p{N}_]*)/gu;
+    /**
+     * Issue #50 (cont.):
+     * `TempVars("clave")` / `TempVars(  "clave"  )` capture. Scanned
+     * over the original (unmasked) line — the literal lives INSIDE a
+     * string and would be stripped by `maskStringContent`.
+     */
+    static TEMP_VAR_PAREN_RE = /\bTempVars\s*\(\s*"([^"]+)"\s*\)/gu;
+    /**
+     * Issue #50 (cont.):
+     * `TempVars.Add "clave", value` capture. Always a write (the
+     * `.Add` method inserts/updates the entry). Scanned over the
+     * original (unmasked) line for the same string-literal reason as
+     * `TEMP_VAR_PAREN_RE`.
+     */
+    static TEMP_VAR_ADD_RE = /\bTempVars\.Add\s+"([^"]+)"\s*,/gi;
+    /**
+     * `Me.<ControlName>` / `Me!<ControlName>` reference capture — hole 1
+     * of VBA control-modeling. Extended by Issue #44 to accept the bang
+     * form (the default-collection shortcut Access VBA inherits from VB).
      *
-     * Real VBA idiom:
-     *   `Me.lblTitulo.Caption = "Hello"`            ← property assignment
-     *   `Me.txtDescripcion.Value = "World"`          ← property assignment
-     *   `Me.ComandoGrabar.Enabled = True`           ← property assignment
+     * Real VBA idioms:
+     *   `Me.lblTitulo.Caption = "Hello"`            ← dot form, property assignment
+     *   `Me.txtDescripcion.Value = "World"`          ← dot form, property assignment
+     *   `Me.ComandoGrabar.Enabled = True`           ← dot form, property assignment
+     *   `Me!txtNombre = "Hello"`                    ← BANG form (default collection)
+     *   `Me!txtEstado.Value = 1`                    ← BANG form, then property
      *   `If Nz(Me.MotivoBorrado, "") = "" Then`      ← read in expression
      *
      * The existing call-site scanner (CALL_RE) only fires on `Name(`
      * (paren form) and `Me` is in its keyword blacklist anyway, so
      * `Me.<Control>` references are silently invisible. This regex matches
-     * the FIRST identifier after `Me.` regardless of what follows (a
-     * property, an index, an assignment, a call argument, etc.) so the
+     * the FIRST identifier after `Me.` or `Me!` regardless of what follows
+     * (a property, an index, an assignment, a call argument, etc.) so the
      * form → control binding is surfaced as an UnresolvedReference for the
      * resolver to pick up later. Subsequent segments (`.Caption`, `.Value`,
      * `.Enabled`) are intentionally NOT captured — they are properties of
-     * the control, not new symbols.
+     * the control, not new symbols. The bang (`!`) is the default-collection
+     * shortcut: `Me!txtFoo` is semantically identical to `Me.txtFoo` and
+     * produces a byte-identical UnresolvedReference (same `referenceName`,
+     * `referenceKind`, and `metadata.synthesizedBy`) — the regression test
+     * in `__tests__/extraction-vba.test.ts` pins this parity.
      *
      * Provenance: `metadata.synthesizedBy = 'vba-me-control'`. Mirrors the
      * `vba-form-binding` (form→sibling-`.cls`) and `vba-name-resolution`
      * (qualified Dim) patterns already documented on `UnresolvedReference.metadata`
      * in `src/types.ts`.
      */
-    static ME_CONTROL_RE = /\bMe\.(\p{L}[\p{L}\p{N}_]*)/gu;
+    static ME_CONTROL_RE = /\bMe[.!](\p{L}[\p{L}\p{N}_]*)/gu;
+    /**
+     * Issue #44: `Forms!<FormName>` / `Forms("<FormName>")!<Ctl>` cross-form
+     * reference capture — companion to `ME_CONTROL_RE` above. Access VBA's
+     * default-collection shortcut for cross-form control access, captured
+     * BEFORE the generic call-site scan and emitted as its own
+     * `UnresolvedReference` family.
+     *
+     * Real VBA idioms:
+     *   `Forms!FormX!txtY.Value = 1`         — bang form, with control segment
+     *   `Forms!FormX.Recordsource = "..."`   — bang form, trailing property access
+     *   `Set f = Forms!FormX`                — bang form, no control segment
+     *   `Forms("FormX")!txtY.Value = 1`      — paren form, with control
+     *   `Forms![Mi Formulario]!txtY`         — bracketed form name (#54 mirror)
+     *
+     * Why a dedicated scanner (mirroring `OPEN_FORM_ARG_RE` / B4 / DoCmd.OpenForm):
+     *   `Forms` is in `RUNTIME_RECEIVER_BLACKLIST`, so the generic CALL_RE
+     *   path silently skips both `Forms!X` and `Forms("X")!Y`. Without this
+     *   scanner, cross-form UI traffic from `Forms!FormX!txtY.Value` would
+     *   never surface the form → control binding that the resolver needs to
+     *   glue form `form-layout` nodes to control `form-instance-control`
+     *   nodes. The dedicated dispatch fires BEFORE the call-site scan and
+     *   uses its own emission path; the runtime-blacklist constraint is
+     *   preserved (we intentionally do not rewrite CALL_RE).
+     *
+     * What this scanner emits per match:
+     *   - ONE `UnresolvedReference` whose `referenceName` is the form's
+     *     identifier (stripped of any surrounding quote or bracket
+     *     decoration), tagged `metadata.synthesizedBy = 'vba-forms-bang'`
+     *     and `referenceKind = 'references'`. The control segment (if
+     *     present) is consumed by the regex so `Forms!FormX!txtY.Value` is
+     *     captured as a single match, but the control name is NOT emitted
+     *     as its own reference — control emission is the form's
+     *     responsibility downstream.
+     *   - NO synthetic `function` node (W4 graph-pollution invariant — the
+     *     form is a real `.cls` / `.form.txt` pair the resolver already
+     *     picks up via the `vba-form-binding` path). Without this guard the
+     *     bang form would synthesize one stub per cross-form reference
+     *     site, identical to what `bumpShapes` from #43 audited out.
+     *
+     * What this scanner does NOT match (intentional, pinned by tests):
+     *   - `Forms!FormX.Foo`           — the trailing `.Foo` IS a property
+     *     access on the form (e.g. `Recordsource`), NOT a control access.
+     *     The bang alternative carries a `(?![.\w])` negative-lookahead
+     *     after the form identifier to drop this shape. The "W4
+     *     no-synthetic-fn" test pins both halves of this contract.
+     *   - `rs!Campo`                  — recordset field access (DAO/ADO
+     *     default-member field read) is explicitly out of scope for the
+     *     current change. The runtime-receiver blacklist plus the absence
+     *     of any `Forms`/`Me` prefix means the existing scanners already
+     *     skip it cleanly; the "STRETCH SCOPE" test pins that behaviour
+     *     so a future change to bring recordset bangs in is reviewed
+     *     explicitly against the bang-form scope decision.
+     *
+     * Operates on the ORIGINAL (unmasked) line — the paren form
+     * `Forms("FormX")!txtY` has the form name INSIDE a string literal, so
+     * masking string content would destroy the form identifier. Same
+     * unmasked-line constraint as `scanOpenFormCalls`.
+     */
+    static FORMS_BANG_RE = /\b(?:Forms!(\p{L}[\p{L}\p{N}_]*|\[[^\]]+\])(?![.\w])|Forms\(\s*(?:"((?:[^"]|"")*)"|(\p{L}[\p{L}\p{N}_]*|\[[^\]]+\]))\s*\)\s*!\s*(?:\p{L}[\p{L}\p{N}_]*|\[[^\]]+\]))/gu;
+    /**
+     * Issue #46: scan `Set <var> = New <Type>[.<Inner>]` lines — the dominant
+     * VBA late-instantiation idiom. Run inside `sweepCallsAndSql`'s proc-stack
+     * loop so the surrounding procedure is known. For each match:
+     *   - register `<var>` in `localVarTypeMap` with `outer=<Type>`,
+     *     `qualified=<hasInner>`, `assignedWithSet=true` so the PR #61 refined
+     *     gate lets subsequent `<var>.Member ...` qualified calls resolve via
+     *     the resolved class name;
+     *   - emit a `references` edge from the module/class node to a synthetic
+     *     node named `<Type>`, tagged `synthesizedBy: 'vba-set-new'`.
+     *
+     * Groups: (1) variable name, (2) outer type, (3) optional inner type.
+     * Operates on the MASKED line (string-literal content already replaced
+     * with spaces) so `Set x = New Foo` inside a string literal never matches.
+     */
+    static SET_NEW_RE = /\bSet\s+(\p{L}[\p{L}\p{N}_]*)\s*=\s*New\s+(\p{L}[\p{L}\p{N}_]*)(?:\.(\p{L}[\p{L}\p{N}_]*))?/iu;
+    /** Issue #43: track the receiver for `With <expr>` / `End With` blocks. */
+    static WITH_START_RE = /^\s*With\b\s+(.+?)\s*$/iu;
+    static WITH_END_RE = /^\s*End\s+With\b/iu;
     /** Keywords we never want to match as call receivers. */
     static CALL_KEYWORD_BLACKLIST = new Set([
         'If',
@@ -1156,9 +1549,20 @@ class VbaExtractor {
      * qualified, non-primitive) identifier — a candidate project-defined class.
      * Qualified types (e.g. `DAO.Recordset`) and primitives (`String`, `Long`)
      * return false so runtime/DAO calls are suppressed.
+     *
+     * Issue #54 (defensive): brackets are stripped from the lookup key, so a
+     * caller that forgets to unwrap a bracketed name still finds the
+     * corresponding entry. This is a no-op when the name is already bare —
+     * the unwrap pattern only matches an opening `[` at the start and a
+     * closing `]` at the end. Today's call sites (`scanCallSites`,
+     * `detectQualifiedStatementCall`) already unwrap in the regex captures,
+     * so this defensive strip is a belt-and-braces guard for any future
+     * caller that forgets.
      */
     isLocalProjectClassVar(receiverName) {
-        const entry = this.localVarTypeMap.get(receiverName.toLowerCase());
+        // Issue #54: strip a single leading `[` and/or trailing `]` if present.
+        const key = receiverName.replace(/^\[|\]$/g, '').toLowerCase();
+        const entry = this.localVarTypeMap.get(key);
         if (!entry)
             return false; // not declared in this file → silent
         if (entry.qualified)
@@ -1181,28 +1585,88 @@ class VbaExtractor {
      */
     resolveReceiverType(receiverName) {
         if (this.isLocalProjectClassVar(receiverName)) {
-            const entry = this.localVarTypeMap.get(receiverName.toLowerCase());
+            const key = receiverName.replace(/^\[|\]$/g, '').toLowerCase();
+            const entry = this.localVarTypeMap.get(key);
             if (entry)
                 return entry.outer;
         }
         return receiverName;
     }
+    normalizeWithReceiver(expr) {
+        let receiver = expr.trim();
+        if (!receiver)
+            return null;
+        if (/^Call\s/i.test(receiver))
+            receiver = receiver.replace(/^Call\s+/i, '').trimStart();
+        if (receiver.startsWith('[')) {
+            const m = /^\[([^\]]+)\]/u.exec(receiver);
+            if (!m)
+                return null;
+            receiver = m[1] ?? '';
+        }
+        else {
+            const m = /^(\p{L}[\p{L}\p{N}_]*)/u.exec(receiver);
+            if (!m)
+                return null;
+            receiver = m[1] ?? '';
+        }
+        if (!receiver)
+            return null;
+        if (VbaExtractor.CALL_KEYWORD_BLACKLIST.has(receiver))
+            return null;
+        if (VbaExtractor.RUNTIME_RECEIVER_BLACKLIST.has(receiver))
+            return null;
+        return receiver;
+    }
+    detectWithMemberCall(line) {
+        let trimmed = line.trimStart();
+        if (!trimmed)
+            return null;
+        if (/^Call\s/i.test(trimmed))
+            trimmed = trimmed.replace(/^Call\s+/i, '').trimStart();
+        if (trimmed.startsWith("'") || /^Rem(\s|$)/i.test(trimmed))
+            return null;
+        if (!trimmed.startsWith('.'))
+            return null;
+        const memberRest = trimmed.slice(1);
+        const memberM = /^(\p{L}[\p{L}\p{N}_]*)/u.exec(memberRest);
+        if (!memberM)
+            return null;
+        const member = memberM[1] ?? '';
+        const afterMember = memberRest.slice(member.length);
+        if (afterMember.length > 0) {
+            const ch = afterMember.charAt(0);
+            if (ch !== '(' && ch !== ' ' && ch !== '\t')
+                return null;
+            const argsText = afterMember.trimStart();
+            if (argsText.startsWith('='))
+                return null;
+        }
+        if (VbaExtractor.CALL_KEYWORD_BLACKLIST.has(member))
+            return null;
+        if (VbaExtractor.RUNTIME_RECEIVER_BLACKLIST.has(member))
+            return null;
+        return { member };
+    }
     sweepCallsAndSql(src) {
         const lines = src.split('\n');
         const procedureStartLines = new Set();
-        // S5 fix: also match `End Sub`/`End Function`/`End Property` after a
-        // colon (`:`), so single-line `Public Sub X(): End Sub` is recognized
-        // as ending the procedure. The previous `/^\s*End...` only matched at
-        // line start, so the proc stack never popped for colon-separated
-        // single-line declarations.
-        const procedureEndRe = /(?:^|:\s*)End\s+(?:Sub|Function|Property)\b/i;
         const sqlTargetsThisFile = new Set();
+        // Issue #52: reset the shared scope state before the per-line walk
+        // begins. `sweepEnumsAndConsts` already populated `procStack` /
+        // `currentProcKey` during its own walk; clearing here guarantees the
+        // `scanDoCmdOpenCalls` / `scanDoCmdOpenQuery` reads (which consult
+        // `currentProcKey` per call-site) start in module scope and follow
+        // the same push/pop discipline as the existing `stack` array below.
+        this.procStack.length = 0;
+        this.currentProcKey = 'module';
         // Walk the source once, emitting call edges and SQL edges per line and
         // tracking the current procedure stack. The previous implementation
         // did this in two passes; audit S1 (June 2026) flagged the first pass
         // as dead code (its `procStack` was never read after the loop). One
         // pass suffices.
         const stack = [];
+        const withReceiverStack = [];
         const sqlVariables = new Map();
         // C2 fix: track each procedure's `endLine` (the line containing the
         // matching `End Sub`/`End Function`/`End Property`) keyed by its
@@ -1215,6 +1679,14 @@ class VbaExtractor {
             const lineNum = i + 1;
             const procStart = VbaExtractor.PROC_RE.exec(line);
             if (procStart) {
+                // Issue #52: mirror the proc push into the shared
+                // `procStack` + `currentProcKey` so Const reads in this same
+                // sweep see the same scope as the const writes did (during
+                // `sweepEnumsAndConsts`). Uses the same `startLine` key used
+                // for the `localConstants` bucket.
+                const procStartLine = lineNum;
+                this.procStack.push(procStartLine);
+                this.currentProcKey = String(procStartLine);
                 const name = procStart[3] ?? '';
                 const bucket = this.localProcs.get(name);
                 if (bucket) {
@@ -1229,8 +1701,14 @@ class VbaExtractor {
                 }
                 procedureStartLines.add(lineNum);
             }
-            else if (procedureEndRe.test(line) && stack.length > 0) {
+            else if (VbaExtractor.PROCEDURE_END_RE.test(line) && stack.length > 0) {
                 const ending = stack.pop();
+                // Issue #52: mirror the pop into the shared scope state.
+                this.procStack.pop();
+                this.currentProcKey =
+                    this.procStack.length > 0
+                        ? String(this.procStack[this.procStack.length - 1])
+                        : 'module';
                 procEndLines.set(ending.startLine, lineNum);
                 continue;
             }
@@ -1239,6 +1717,19 @@ class VbaExtractor {
             // mistakenly treated as call sites.  SQL scanning still uses the original
             // line because SQL lives INSIDE string literals.
             const callScanLine = VbaExtractor.maskStringContent(line);
+            if (stack.length > 0 && VbaExtractor.WITH_END_RE.test(callScanLine)) {
+                withReceiverStack.pop();
+                continue;
+            }
+            if (stack.length > 0 && !procedureStartLines.has(lineNum)) {
+                const withStart = VbaExtractor.WITH_START_RE.exec(callScanLine);
+                if (withStart) {
+                    const receiver = this.normalizeWithReceiver(withStart[1] ?? '');
+                    if (receiver)
+                        withReceiverStack.push(receiver);
+                    continue;
+                }
+            }
             // Don't scan call sites on the line that declares the procedure — it
             // would match the proc name itself in `Sub Outer()`.
             if (!procedureStartLines.has(lineNum) && stack.length > 0) {
@@ -1267,23 +1758,76 @@ class VbaExtractor {
             // Form_FormNCAuditoriaMotivoEliminado.cls fixture contributed
             // nothing to the call graph. Walked here so we share the proc stack
             // already maintained by this loop.
+            //
+            // Issue #45: the statement-call detector used to inspect only the
+            // FIRST identifier of the line, so for `If x Then Foo` it returned
+            // the keyword `If` (which is then dropped by
+            // `emitStatementCallEdge`'s BLACKLIST check) — the actual `Foo` call
+            // after `Then` was silently invisible. Same gap existed on the
+            // `Else`/multi-statement (`:`) and qualified paths. The fix is to
+            // split the line into one or more statement clauses via
+            // `splitSingleLineIfClauses` (which handles `If … Then <body>`,
+            // `Else <body>`, and colon-separated multi-statements) and run the
+            // detectors per clause. Lines that don't match the single-line If
+            // shape pass through unchanged as `[<line>]` so block-form `If`
+            // (where the body lives on subsequent lines) keeps working through
+            // the existing per-line scan that picks up the body line.
             if (stack.length > 0 && !procedureStartLines.has(lineNum)) {
-                const stmtCall = this.detectStatementCall(callScanLine);
-                if (stmtCall) {
-                    const caller = stack[stack.length - 1];
-                    this.emitStatementCallEdge(caller, stmtCall, lineNum);
+                // Issue #46: `Set x = New <Type>[.<Inner>]` late-instantiation.
+                // Run BEFORE the call-site scan so a later `<x>.Member ...` line
+                // finds `x` already registered in `localVarTypeMap` and the PR #61
+                // refined gate lets the qualified call resolve to `<Type>.Member`.
+                const setNew = VbaExtractor.SET_NEW_RE.exec(callScanLine);
+                if (setNew) {
+                    const varName = setNew[1] ?? '';
+                    const outerType = setNew[2] ?? '';
+                    const innerType = setNew[3] ?? '';
+                    if (varName && outerType) {
+                        // Skip primitives defensively — `Set x = New Long` is nonsense
+                        // in practice but the gate is cheap and consistent with the
+                        // Dim sweep's PRIMITIVE_TYPES guard.
+                        if (!VbaExtractor.PRIMITIVE_TYPES.has(outerType.toLowerCase())) {
+                            this.localVarTypeMap.set(varName.toLowerCase(), {
+                                outer: outerType,
+                                // Mirror `Dim x As Foo.Bar`: qualified `Set rs = New
+                                // DAO.Recordset` registers `qualified: true` so the PR #61
+                                // gate keeps downstream `rs.Method` calls silent (DAO is
+                                // a runtime / external library, not a project class).
+                                qualified: !!innerType,
+                                assignedWithSet: true,
+                                variableName: varName,
+                            });
+                            this.emitReference(outerType, lineNum, 0, 'vba-set-new');
+                        }
+                    }
                 }
-                // Fix 7 + Fix 2: qualified statement-form calls (`Receiver.Member args`) —
-                // the dominant cross-object call shape in real Dysflow fixtures.
-                // `CALL_RE` only matches the paren form; this path covers the no-paren
-                // statement form and emits a heuristic `calls` edge ONLY when the
-                // receiver is a file-local variable typed as a candidate project class
-                // (Fix 2: REQ-CODE-4 "unresolvable call is silent").
-                const qualStmt = this.detectQualifiedStatementCall(callScanLine);
-                if (qualStmt) {
-                    const caller = stack[stack.length - 1];
-                    if (this.isLocalProjectClassVar(qualStmt.receiver)) {
-                        this.emitQualifiedStatementCallEdge(caller, qualStmt.receiver, qualStmt.member, lineNum);
+                const clauseLines = this.splitSingleLineIfClauses(callScanLine);
+                for (const clauseLine of clauseLines) {
+                    const stmtCall = this.detectStatementCall(clauseLine);
+                    if (stmtCall) {
+                        const caller = stack[stack.length - 1];
+                        this.emitStatementCallEdge(caller, stmtCall, lineNum);
+                    }
+                    // Fix 7 + Fix 2: qualified statement-form calls (`Receiver.Member args`) —
+                    // the dominant cross-object call shape in real Dysflow fixtures.
+                    // `CALL_RE` only matches the paren form; this path covers the no-paren
+                    // statement form and emits a heuristic `calls` edge ONLY when the
+                    // receiver is a file-local variable typed as a candidate project class
+                    // (Fix 2: REQ-CODE-4 "unresolvable call is silent").
+                    const qualStmt = this.detectQualifiedStatementCall(clauseLine);
+                    if (qualStmt) {
+                        const caller = stack[stack.length - 1];
+                        if (this.isLocalProjectClassVar(qualStmt.receiver)) {
+                            this.emitQualifiedStatementCallEdge(caller, qualStmt.receiver, qualStmt.member, lineNum);
+                        }
+                    }
+                    const withReceiver = withReceiverStack[withReceiverStack.length - 1];
+                    if (withReceiver) {
+                        const withCall = this.detectWithMemberCall(clauseLine);
+                        if (withCall && this.isLocalProjectClassVar(withReceiver)) {
+                            const caller = stack[stack.length - 1];
+                            this.emitQualifiedStatementCallEdge(caller, withReceiver, withCall.member, lineNum);
+                        }
                     }
                 }
                 // B4 (hueco 6): `DoCmd.OpenForm "FormName"` modelling.
@@ -1307,7 +1851,30 @@ class VbaExtractor {
                 // node id (the same pattern the cross-file incoming-edges
                 // snapshot already uses at `index.ts:getCrossFileIncomingEdges`).
                 const caller2 = stack[stack.length - 1];
-                this.scanOpenFormCalls(line, caller2, lineNum);
+                // Issue #48: shared OpenForm/OpenReport dispatch via
+                // `scanDoCmdOpenCalls` (formerly `scanOpenFormCalls`, refactored to
+                // iterate the `DOCMD_OPEN_DISPATCH` table — OpenForm behavior is
+                // byte-identical to pre-#48). The OpenQuery scanner emits an
+                // `UnresolvedReference` and stays separate from the dispatch since
+                // its emission shape (no stub + edge) differs.
+                this.scanDoCmdOpenCalls(line, caller2, lineNum);
+                this.scanDoCmdOpenQuery(line, caller2, lineNum);
+                // Issue #44: cross-form bang references (`Forms!X` / `Forms("X")!Y`).
+                // Same line context as `scanDoCmdOpenCalls` — the form name lives in
+                // a string literal in the paren form, so we MUST scan the unmasked
+                // line. The scanner is independent of `scanCallSites` because
+                // `Forms` is in `RUNTIME_RECEIVER_BLACKLIST` and would otherwise be
+                // dropped by the generic path.
+                this.scanFormsBang(line, caller2, lineNum);
+                // Issue #50: cross-form TempVars key accesses.
+                // Sibling of `scanFormsBang` — TempVars is Access's second global
+                // cross-form state surface (alongside Forms/DoCmd.OpenForm). Each
+                // static-literal key reference emits one `references` edge to a
+                // synthetic `class` placeholder, tagged `synthesizedBy: 'vba-tempvar'`
+                // and `access: 'read' | 'write'`. We need BOTH line sources: bang
+                // form scans the masked line, paren + Add forms scan the original
+                // (literal lives inside `"…"`).
+                this.sweepTempVars(callScanLine, line, lineNum, caller2);
             }
         }
         // Apply endLine to every emitted function node keyed by its startLine.
@@ -1346,8 +1913,15 @@ class VbaExtractor {
         VbaExtractor.CALL_RE.lastIndex = 0;
         let m;
         while ((m = VbaExtractor.CALL_RE.exec(line)) !== null) {
-            const receiver = m[1] ?? '';
-            const member = m[2] ?? '';
+            // Issue #54: CALL_RE groups (1)/(2) are alternative captures for the
+            // receiver position, (3)/(4) for the member position. The bracketed
+            // alternative wins when present; the captured value is already
+            // unwrapped by the regex (it captures only the inner content, not
+            // the surrounding `[...]`). Result: a `[FUNCIONES UTILES]` receiver
+            // surfaces here as `FUNCIONES UTILES` so the downstream blacklist
+            // checks and `resolveReceiverType` lookup see the bare identifier.
+            const receiver = m[1] ?? m[2] ?? '';
+            const member = m[3] ?? m[4] ?? '';
             if (!receiver)
                 continue;
             // Skip VBA control-flow keywords.
@@ -1386,6 +1960,26 @@ class VbaExtractor {
                 // `.cls` method's `${className}.${proc}` qualifiedName shape so the
                 // #12b resolver can find it by exact match); otherwise it's the raw
                 // `receiver` text unchanged (e.g. `.bas`-qualified module calls).
+                //
+                // Antigravity audit Task 3 (refined gate): if `receiver` is a
+                // file-local variable declared as a PRIMITIVE (Variant, Object,
+                // Empty, Null, LongPtr, LongLong, New, Long, String, ...), skip
+                // emission. The previous behaviour emitted a heuristic `calls`
+                // edge to a stub named `<receiver>.<member>` that no resolver
+                // could ever repoint (Variant can hold anything, including
+                // runtime singletons; the stub is dead-end graph pollution).
+                //
+                // This refined gate does NOT regress cross-module qualified
+                // calls like `modUtils.Foo(1)` because `modUtils` is never
+                // declared as a file-local variable and therefore is NOT in
+                // `localVarTypeMap` — `localVarTypeMap.has(receiver.toLowerCase())`
+                // returns false and the gate is skipped. The "stub emitted for
+                // undeclared receivers → resolver repoints if a real module
+                // exists" behaviour is preserved.
+                const recvEntry = this.localVarTypeMap.get(receiver.toLowerCase());
+                if (recvEntry && VbaExtractor.PRIMITIVE_TYPES.has(recvEntry.outer.toLowerCase())) {
+                    continue;
+                }
                 const receiverType = this.resolveReceiverType(receiver);
                 const qualified = `${receiverType}.${member}`;
                 // Avoid emitting duplicate edges for the same call (within a line).
@@ -1438,16 +2032,21 @@ class VbaExtractor {
     callDedupe = new Set();
     synthFunctionNodeIds = new Set();
     /**
-     * B4 (hueco 6): cache of stub `form-layout` node ids we've already emitted
-     * for a given target form name in this file. Avoids emitting duplicate
-     * stubs when `DoCmd.OpenForm "FormTest"` shows up N times across N calls.
-     * Keyed by the lowercased form name so `FormTest` / `formtest` collapse.
+     * B4 (hueco 6) extended by Issue #48: cache of stub node ids we've already
+     * emitted for a given (method, target name) pair in this file. Avoids
+     * emitting duplicate stubs when `DoCmd.OpenForm "FormTest"` or
+     * `DoCmd.OpenReport "InformeMensual"` shows up N times across N calls.
+     * Keyed by `${cacheKey}:${lowerName}` so the OpenForm and OpenReport
+     * de-dup buckets stay disjoint — `OpenForm:Form1` ≠ `OpenReport:Form1`.
+     * The name part is lowercased so `FormTest` / `formtest` collapse.
      */
-    opensFormStubIdsByName = new Map();
+    opensStubIdsByKey = new Map();
     /**
-     * Hueco 1: scan a line for `Me.<ControlName>` patterns and emit one
-     * UnresolvedReference per occurrence, tagged
-     * `metadata.synthesizedBy: 'vba-me-control'`.
+     * Hueco 1: scan a line for `Me.<ControlName>` / `Me!<ControlName>`
+     * patterns and emit one UnresolvedReference per occurrence, tagged
+     * `metadata.synthesizedBy: 'vba-me-control'`. Issue #44 extended
+     * `ME_CONTROL_RE` from `Me\.` to `Me[.!]` so the bang form (default-
+     * collection shortcut) is captured byte-identically to the dot form.
      *
      * Operates on the masked `callScanLine` (string-literal content already
      * replaced with spaces) so `Me.X` inside a string literal is not falsely
@@ -1458,6 +2057,8 @@ class VbaExtractor {
      *
      * `fromNodeId` is the current procedure's function node — that's the
      * "owner" of the reference (the Sub body that wrote `Me.lblTitulo = …`).
+     * The +3 column offset remains correct under Issue #44's regex change
+     * because both `Me.` and `Me!` are 3-character prefixes.
      */
     scanMeControlReferences(line, from, lineNum) {
         VbaExtractor.ME_CONTROL_RE.lastIndex = 0;
@@ -1471,13 +2072,70 @@ class VbaExtractor {
                 referenceName: controlName,
                 referenceKind: 'references',
                 line: lineNum,
-                column: m.index + 3, // +3 to skip the `Me.` prefix
+                column: m.index + 3, // +3 to skip the `Me.` / `Me!` prefix
                 filePath: this.filePath,
                 language: 'vba',
                 metadata: { synthesizedBy: 'vba-me-control' },
             });
         }
     }
+    /**
+     * Issue #44: scan a line for cross-form bang references
+     * (`Forms!<FormName>[!<Ctl>]` and `Forms("<FormName>")!<Ctl>`) and
+     * emit ONE UnresolvedReference per match with `metadata.synthesizedBy
+     * = 'vba-forms-bang'`. Companion to `scanMeControlReferences` above;
+     * shares the emission shape (a single `UnresolvedReference` per match,
+     * `referenceKind: 'references'`), keeping the W4 invariant that we
+     * synthesize NO `function` node for forms.
+     *
+     * Operates on the ORIGINAL (unmasked) line — the paren form
+     * `Forms("FormX")!txtY` carries the form name INSIDE a string literal
+     * and would be destroyed by `maskStringContent`. Mirrors
+     * `scanOpenFormCalls`'s unmasked-line constraint.
+     *
+     * Regex alternatives (see `FORMS_BANG_RE`):
+     *   1. `Forms!<FormName>` (bare or `[bracketed]`, NOT followed by `.X`)
+     *      — bang form, may have a trailing `!<Ctl>[.<Prop>]` that is
+     *      consumed but NOT emitted.
+     *   2. `Forms("<FormName>")!<Ctl>` (quoted or bare/bracketed form arg)
+     *      — paren form, ALWAYS with a control segment.
+     *
+     * Stripping: the form's identifier is unwrapped of `"` quotes (string
+     * literals) and `[…]` brackets (Issue #54 reserved-identifier shape) so
+     * the public `referenceName` is the bare form name. Bracketed forms
+     * (`Forms![Mi Formulario]`) follow the same strip rules as the paren
+     * form so the resolver sees `Mi Formulario` either way.
+     */
+    scanFormsBang(line, from, lineNum) {
+        VbaExtractor.FORMS_BANG_RE.lastIndex = 0;
+        let m;
+        while ((m = VbaExtractor.FORMS_BANG_RE.exec(line)) !== null) {
+            // Group 1: bang form name (bare or `[bracketed]`); group 2: paren
+            // form name in `"quotes"`; group 3: paren form name bare or
+            // `[bracketed]`. Take whichever the regex alternative produced and
+            // strip the surrounding decoration so the public referenceName is
+            // the bare form identifier the resolver will compare against the
+            // form's `form-layout` node name.
+            const raw = m[1] ?? m[2] ?? m[3] ?? '';
+            if (!raw)
+                continue;
+            const formName = raw
+                .replace(/^"|"$/g, '') // strip surrounding string-literal quotes
+                .replace(/^\[|\]$/g, ''); // strip surrounding bracket decoration (#54)
+            if (!formName)
+                continue;
+            this.unresolvedReferences.push({
+                fromNodeId: this.findOrCreateFunctionNodeId(from),
+                referenceName: formName,
+                referenceKind: 'references',
+                line: lineNum,
+                column: m.index, // start of the `Forms` keyword; the form name's column can be reconstructed by the UI if it cares
+                filePath: this.filePath,
+                language: 'vba',
+                metadata: { synthesizedBy: 'vba-forms-bang' },
+            });
+        }
+    }
     findOrCreateFunctionNodeId(proc) {
         // Fix 1: key the cache by `name:startLine` so Property Get/Let/Set
         // accessors with the same name each resolve to their own node.
@@ -1506,6 +2164,85 @@ class VbaExtractor {
         // meaningful on real .cls files with hundreds of procedures.
         return this.functionNodeByName.get(name);
     }
+    /**
+     * Issue #45: split a single-line VBA `If <cond> Then <body>` into one or
+     * more statement-clause fragments that the existing `detectStatementCall`
+     * and `detectQualifiedStatementCall` detectors can process. Handles:
+     *
+     *   - `If x Then Foo`             → `['Foo']`
+     *   - `If x Then Foo Else Bar`    → `['Foo', 'Bar']`
+     *   - `If x Then DoA: DoB`        → `['DoA', 'DoB']` (colon-separated multi-statement)
+     *   - `If x Then Foo Else A: B`   → `['Foo', 'A', 'B']`
+     *   - `If x Then GoTo fin`        → `[]` (GoTo clause filtered out)
+     *   - `If x Then Exit Sub`        → `[]` (Exit clause filtered out)
+     *
+     * When the line does NOT match a single-line `If … Then` shape — for
+     * instance a block-form `If x Then` whose body lives on subsequent
+     * lines — the splitter returns `[<line>]` (the original input) so
+     * callers can use this method unconditionally and let the existing
+     * per-line scan pick up the body on a separate line.
+     *
+     * `GoTo`, `Exit`, and `Resume` clauses are filtered at the fragment
+     * level (defense in depth): even though `emitStatementCallEdge` already
+     * drops these via the `CALL_KEYWORD_BLACKLIST`, filtering here prevents
+     * any chance of `detectStatementCall`'s generic identifier extractor
+     * matching a substring (e.g. an identifier like `GoToFinishingTouches`)
+     * as a side effect of a richer clause where the keyword happens to be
+     * the leading token.
+     *
+     * `line` is the string-literal-masked scan line. The mask makes global
+     * `:` splitting safe: real VBA colons never appear inside string
+     * literals (already masked to spaces) and never inside expressions
+     * inside parens at the source level (a colon ends a statement in VBA,
+     * so it cannot appear inside a parenthesised argument list either).
+     * The `Else` keyword is a VBA statement-level separator and is
+     * forbidden inside parens or expressions, so splitting on
+     * `\s+Else\s+` does not need paren tracking either.
+     */
+    splitSingleLineIfClauses(line) {
+        const trimmed = line.trimStart();
+        if (!trimmed)
+            return [];
+        // Match `If <cond> Then <body>` with a non-greedy condition. Requiring
+        // at least one whitespace character after `Then` ensures the block
+        // form `If x Then` (with the body on subsequent lines) is left alone
+        // for the existing per-line call-site scan to handle on the body line.
+        const ifThenRe = /^If\s[\s\S]+?\bThen\b\s+/i;
+        const m = ifThenRe.exec(trimmed);
+        if (!m) {
+            // Not a single-line `If … Then` — preserve the original line so the
+            // existing detection path picks it up unchanged.
+            return [line];
+        }
+        const body = trimmed.slice(m[0].length);
+        // Split on top-level `Else` (case-insensitive; word-bounded). The
+        // statement-level-only nature of `Else` in VBA means the regex split
+        // is safe without paren tracking on the masked-line invariant.
+        const elseClauses = body.split(/\s+Else\s+/i);
+        const clauses = [];
+        for (const elseClause of elseClauses) {
+            // Split each Else-clause on `:` for multi-statement single-line
+            // `If` bodies. VBA expressions never contain `:`, so a global
+            // split is correct on a masked line.
+            const subStatements = elseClause.split(':');
+            for (const sub of subStatements) {
+                const t = sub.trim();
+                if (!t)
+                    continue;
+                // Defense in depth: GoTo / Exit / Resume are VBA control-flow
+                // statements, not Sub calls — drop them before they reach the
+                // statement-call detectors. (The existing
+                // `CALL_KEYWORD_BLACKLIST` check in `emitStatementCallEdge`
+                // also covers this; the fragment-level filter keeps the two
+                // intent statements aligned and protects against any future
+                // detector refactor that might relax the BLACKLIST check.)
+                if (/^(?:GoTo|Exit|Resume)\b/i.test(t))
+                    continue;
+                clauses.push(t);
+            }
+        }
+        return clauses;
+    }
     /**
      * H1: detect a statement-form Sub call.
      *
@@ -1616,22 +2353,26 @@ class VbaExtractor {
         // Skip declarations.
         if (/^(Dim|Private|Public|Static|Global|Const|ReDim)\s/i.test(trimmed))
             return null;
-        // Extract receiver identifier.
-        const receiverM = /^(\p{L}[\p{L}\p{N}_]*)/u.exec(trimmed);
+        // Issue #54: the receiver alternative accepts BOTH the bare form
+        // (`Foo`) and the VBA bracketed form (`[Foo Bar]`). The bracketed
+        // alternative wins when present; the captured value is already
+        // unwrapped by the regex (it captures only the inner content, not
+        // the surrounding `[...]`). The same shape applies to the member.
+        const receiverM = /^(?:\[([^\]]+)\]|(\p{L}[\p{L}\p{N}_]*))/u.exec(trimmed);
         if (!receiverM)
             return null;
-        const receiver = receiverM[1] ?? '';
-        const rest = trimmed.slice(receiver.length);
+        const receiver = receiverM[1] ?? receiverM[2] ?? '';
+        const rest = trimmed.slice(receiverM[0].length);
         // Must have a dot separator.
         if (!rest.startsWith('.'))
             return null;
         // Extract member identifier.
         const memberRest = rest.slice(1); // skip the dot
-        const memberM = /^(\p{L}[\p{L}\p{N}_]*)/u.exec(memberRest);
+        const memberM = /^(?:\[([^\]]+)\]|(\p{L}[\p{L}\p{N}_]*))/u.exec(memberRest);
         if (!memberM)
             return null;
-        const member = memberM[1] ?? '';
-        const afterMember = memberRest.slice(member.length);
+        const member = memberM[1] ?? memberM[2] ?? '';
+        const afterMember = memberRest.slice(memberM[0].length);
         // Must NOT be followed by `(` — the paren form is handled by CALL_RE.
         if (afterMember.startsWith('('))
             return null;
@@ -1711,83 +2452,108 @@ class VbaExtractor {
         });
     }
     /**
-     * B4 (hueco 6): scan one line of VBA source for `DoCmd.OpenForm "X"`
-     * calls. For each match, emit:
-     *  - a stub `form-layout` node for the target form (cached by name so
-     *    the same form referenced from N sites emits exactly ONE stub),
-     *  - an `opens-form` heuristic edge from the calling Sub to that stub.
+     * B4 (hueco 6) extended by Issue #48: scan one line of VBA source for
+     * `DoCmd.OpenX "Target"` calls where X ∈ {Form, Report} (see the
+     * `DOCMD_OPEN_DISPATCH` table). For each match, emit:
+     *  - a stub node (form-layout / report-layout) for the target, cached
+     *    per-(method, name) so the same target referenced from N sites
+     *    emits exactly ONE stub,
+     *  - an `opens-form` / `opens-report` heuristic edge from the calling
+     *    Sub to that stub.
      *
      * Both endpoints are pushed into `this.nodes` / `this.edges`, so the
      * per-file edge filter at `index.ts:insertedIds.has(source) &&
      * insertedIds.has(target)` passes the edge naturally without any
      * exemption to the filter.
      *
-     * Why a stub and not a direct lookup: the target form lives in a
-     * DIFFERENT file (its own `.form.txt`), and the extractor doesn't have
-     * DB access at parse time. The stub's synthetic file path
-     * (`synthetic:opensFormStub/<FormName>.form.txt`) guarantees a
-     * deterministic node id so re-indexes collapse to the same stub.
-     * When the consumer's `.form.txt` is later indexed, the real
-     * `form-layout` node carries a different id (it uses the real file
-     * path); the stub and the real coexist harmlessly. The orchestrator
-     * flagged this as acceptable for B4 — only `OpenForm` is in scope.
-     * `OpenReport`, `OpenQuery`, `OpenTable`, … are follow-up work.
+     * Why a stub and not a direct lookup: the target form/report lives in a
+     * DIFFERENT file (its own `.form.txt` / `.report.txt`), and the extractor
+     * doesn't have DB access at parse time. The stub's synthetic file path
+     * (`synthetic:opensFormStub/<Name>.form.txt` /
+     * `synthetic:opensReportStub/<Name>.form.txt`) guarantees a deterministic
+     * node id so re-indexes collapse to the same stub. When the consumer's
+     * `.form.txt` / `.report.txt` is later indexed, the real
+     * `form-layout` / `report-layout` node carries a different id (it uses
+     * the real file path); the stub and the real coexist harmlessly.
      *
-     * Scope note: this regex matches literal-string and bare-identifier forms.
-     * Bare identifiers are resolved only through local `Const` declarations;
-     * arbitrary variable data-flow remains intentionally out of scope.
+     * Why a separate dispatch from CALL_RE: `DoCmd` is in
+     * `RUNTIME_RECEIVER_BLACKLIST` (R4 invariant), so `DoCmd.OpenForm` /
+     * `DoCmd.OpenReport` are intentionally SKIPPED by the generic CALL_RE
+     * path that would otherwise emit a junk `calls` edge to a synthetic
+     * `function` node for `DoCmd.OpenX`. The dispatch below matches BEFORE
+     * the call-site scan and uses its own emission path.
+     *
+     * Scope note: literal-string and bare-identifier argument forms are
+     * supported. Bare identifiers resolve only through local `Const`
+     * declarations; arbitrary variable data-flow remains intentionally
+     * out of scope.
      */
-    scanOpenFormCalls(line, caller, lineNum) {
-        // Each regex has /g so we MUST reset `lastIndex` before use; cloning
-        // the regex is the simplest way to avoid leaking state across lines.
-        const localRe = new RegExp(VbaExtractor.OPEN_FORM_ARG_RE.source, VbaExtractor.OPEN_FORM_ARG_RE.flags);
-        let m;
-        while ((m = localRe.exec(line)) !== null) {
-            const rawArg = (m[1] ?? '').trim();
-            const targetFormName = rawArg.startsWith('"')
-                ? unwrapVbaStringLiteral(rawArg)
-                : (this.localConstants.get(rawArg.toLowerCase()) ?? rawArg);
-            if (!targetFormName)
-                continue;
-            this.emitOpensFormEdge(caller, targetFormName, lineNum, m.index);
+    scanDoCmdOpenCalls(line, caller, lineNum) {
+        for (const dispatch of VbaExtractor.DOCMD_OPEN_DISPATCH) {
+            // Each regex has /g so we MUST reset `lastIndex` before use; cloning
+            // the regex is the simplest way to avoid leaking state across lines
+            // AND across dispatch iterations.
+            const localRe = new RegExp(dispatch.re.source, dispatch.re.flags);
+            let m;
+            while ((m = localRe.exec(line)) !== null) {
+                const rawArg = (m[1] ?? '').trim();
+                // Issue #52: const lookup is now per-proc-bucket with module
+                // fallback (see `resolveLocalConst`). Two procs declaring the
+                // same Const name with different values no longer collide —
+                // each call site uses the value visible at its own scope.
+                const targetName = rawArg.startsWith('"')
+                    ? unwrapVbaStringLiteral(rawArg)
+                    : (this.resolveLocalConst(rawArg) ?? rawArg);
+                if (!targetName)
+                    continue;
+                this.emitOpensStubEdge(dispatch, caller, targetName, lineNum, m.index);
+            }
         }
     }
     /**
-     * B4 (hueco 6): emit a stub `form-layout` node for `targetFormName`
-     * (cached so duplicates collapse) and an `opens-form` heuristic edge
+     * B4 (hueco 6) extended by Issue #48: emit a stub `form-layout` /
+     * `report-layout` node for `targetName` (cached per dispatch entry so
+     * duplicates collapse and OpenForm/OpenReport de-dup buckets stay
+     * disjoint) and a single `opens-form` / `opens-report` heuristic edge
      * from `caller` to that stub.
      *
      * The edge carries:
-     *  - `kind: 'opens-form'`                — new cross-file edge kind
-     *  - `provenance: 'heuristic'`           — synthesized, not parsed
-     *  - `metadata.targetFormName`           — the captured literal
-     *  - `metadata.synthesizedBy: 'vba-opens-form'` — distinguishes this
-     *    synthesis from the dim/sql/event-handler families
+     *  - `kind` — dispatch-specific (`opens-form` / `opens-report`)
+     *  - `provenance: 'heuristic'` — synthesized, not parsed
+     *  - `metadata.<dispatchTargetKey>` (e.g. `targetFormName`) — the resolved name
+     *  - `metadata.synthesizedBy` — dispatch-specific (`vba-opens-form` /
+     *    `vba-opens-report`); distinguishes this synthesis from the
+     *    dim/sql/event-handler families
      *
      * The stub's `metadata.stub: true` flag lets downstream UI render
-     * unresolved references distinctly (e.g. with a dashed border) and
-     * gives later re-resolution pass a hook for collapse. The stub is
+     * stubs distinctly (e.g. with a dashed border) and gives later
+     * re-resolution pass a hook for collapse. The stub is
      * line-independent (`line = 0`) so re-indexes produce identical ids.
      */
-    emitOpensFormEdge(caller, targetFormName, lineNum, column) {
-        const key = targetFormName.toLowerCase();
-        let stubId = this.opensFormStubIdsByName.get(key);
+    emitOpensStubEdge(dispatch, caller, targetName, lineNum, column) {
+        const key = `${dispatch.cacheKey}:${targetName.toLowerCase()}`;
+        let stubId = this.opensStubIdsByKey.get(key);
         if (!stubId) {
             // Synthetic file path keeps the stub's id deterministic AND
-            // disambiguates it from any real `.form.txt` indexed later.
-            // The directory prefix (`synthetic:opensFormStub/`) is intentionally
-            // not a real filesystem path — it just namespaces the id space.
-            const syntheticFilePath = `synthetic:opensFormStub/${targetFormName}.form.txt`;
-            stubId = (0, tree_sitter_helpers_1.generateNodeId)(syntheticFilePath, 'form-layout', targetFormName, 0);
-            this.opensFormStubIdsByName.set(key, stubId);
+            // disambiguates it from any real `.form.txt` / `.report.txt`
+            // indexed later. The directory prefix (`synthetic:opensFormStub/`
+            // or `synthetic:opensReportStub/`) is intentionally not a real
+            // filesystem path — it just namespaces the id space. The file
+            // extension (`syntheticExtension`) DOES mirror the real form/report
+            // file extension so a reader of the synthetic path can tell the
+            // stub's intent at a glance.
+            const syntheticFilePath = `${dispatch.syntheticPrefix}/${targetName}${dispatch.syntheticExtension}`;
+            stubId = (0, tree_sitter_helpers_1.generateNodeId)(syntheticFilePath, dispatch.stubKind, targetName, 0);
+            this.opensStubIdsByKey.set(key, stubId);
             this.nodes.push({
                 id: stubId,
-                kind: 'form-layout',
-                name: targetFormName,
-                // Convention: form module names in Access are `Form_<Name>`.
-                // We follow the same convention in the synthetic stub's
-                // qualifiedName so cross-file lookups can find it consistently.
-                qualifiedName: `Form_${targetFormName}`,
+                kind: dispatch.stubKind,
+                name: targetName,
+                // Convention: form module names in Access are `Form_<Name>` and
+                // report module names are `Report_<Name>`. We follow the same
+                // convention in the synthetic stub's qualifiedName so cross-file
+                // lookups can find it consistently.
+                qualifiedName: `${dispatch.moduleNamePrefix}${targetName}`,
                 filePath: syntheticFilePath,
                 language: 'vba',
                 startLine: lineNum,
@@ -1801,23 +2567,115 @@ class VbaExtractor {
         this.edges.push({
             source: this.findOrCreateFunctionNodeId(caller),
             target: stubId,
-            kind: 'opens-form',
+            kind: dispatch.edgeKind,
             provenance: 'heuristic',
             metadata: {
-                synthesizedBy: 'vba-opens-form',
-                targetFormName,
+                synthesizedBy: dispatch.synthesizedBy,
+                [dispatch.metadataTargetKey]: targetName,
             },
             line: lineNum,
             column,
         });
     }
+    /**
+     * Issue #48: scan one line of VBA source for `DoCmd.OpenQuery "X"` calls.
+     * Each match emits ONE `UnresolvedReference` (NOT a stub + edge) so the
+     * resolver binds to the REAL `query` node that `SqlQueryExtractor`
+     * produces for `queries/<Name>.sql` (dysflow exports every saved QueryDef
+     * + `queries.json` manifest). Falls back to silent when the .sql is not
+     * yet in the index — the resolver does the binding when it's later
+     * indexed, exactly like `vba-me-control` and `vba-forms-bang`.
+     *
+     * Companion to `scanDoCmdOpenCalls` but intentionally NOT in the
+     * dispatch table — OpenQuery's emission shape (`UnresolvedReference`)
+     * is structurally different from OpenForm/OpenReport's (synthetic node
+     * + heuristic edge). The two pipelines share the literal-vs-Const
+     * argument resolution pattern via `localConstants.get(...)` but emit
+     * via two different branches of `unresolvedReferences` vs
+     * `nodes`/`edges`.
+     *
+     * UnresolvedReference shape (per Issue #48 spec — must match
+     * SqlQueryExtractor's query node name exactly):
+     *   - `referenceName`                 = resolved query name
+     *   - `referenceKind: 'references'`    = same kind the resolver binds
+     *   - `metadata.synthesizedBy: 'vba-opens-query'`
+     *   - NO synthetic `function` node (W4 graph-pollution invariant — the
+     *     real `query` node already exists in the index once `.sql` is
+     *     processed, and creating stubs would compete with the binding).
+     */
+    scanDoCmdOpenQuery(line, caller, lineNum) {
+        const localRe = new RegExp(VbaExtractor.OPEN_QUERY_ARG_RE.source, VbaExtractor.OPEN_QUERY_ARG_RE.flags);
+        let m;
+        while ((m = localRe.exec(line)) !== null) {
+            const rawArg = (m[1] ?? '').trim();
+            // Issue #52: same per-proc-with-module-fallback lookup as
+            // `scanDoCmdOpenCalls` — proc-local consts resolve to their own
+            // values, so a `DoCmd.OpenQuery LOCAL_QUERY` inside `Sub X()`
+            // points at the correct query even when another proc declares a
+            // different `LOCAL_QUERY` (pre-fix this was whichever wrote
+            // the file-wide map last).
+            const targetName = rawArg.startsWith('"')
+                ? unwrapVbaStringLiteral(rawArg)
+                : (this.resolveLocalConst(rawArg) ?? rawArg);
+            if (!targetName)
+                continue;
+            this.unresolvedReferences.push({
+                fromNodeId: this.findOrCreateFunctionNodeId(caller),
+                referenceName: targetName,
+                referenceKind: 'references',
+                line: lineNum,
+                column: m.index,
+                filePath: this.filePath,
+                language: 'vba',
+                metadata: { synthesizedBy: 'vba-opens-query' },
+            });
+        }
+    }
+    /**
+     * Regex matching the chained `& "..."` literals that may follow a
+     * wrapper's first literal on the same physical line. Captures the
+     * literal CONTENT (group 1); the surrounding `&` and quotes are
+     * structural, not data. VBA allows whitespace around `&` and around
+     * the inner quotes — handled with `\s*`. The `((?:[^"]|"")*)` body
+     * mirrors the wrapper regex so a `""` inside a chained literal still
+     * decodes to a single `"`.
+     *
+     * Cross-physical-line concat via `_` continuation is OUT OF SCOPE for
+     * v1 (deferred; see commit message).
+     */
+    static SQL_WRAPPER_CHAIN_RE = /&\s*"((?:[^"]|"")*)"/g;
+    /**
+     * Given the text that follows a SQL wrapper's first literal on the same
+     * physical line, return the contents of every `& "..."` chained literal
+     * in source order. Operates per-physical-line only — VBA `_` line
+     * continuation across physical lines is handled separately by
+     * `collectStringLiteralText` for the variable-assignment path.
+     */
+    collectSqlWrapperChain(rest) {
+        const out = [];
+        const re = new RegExp(VbaExtractor.SQL_WRAPPER_CHAIN_RE.source, VbaExtractor.SQL_WRAPPER_CHAIN_RE.flags);
+        let m;
+        while ((m = re.exec(rest)) !== null) {
+            out.push(m[1] ?? '');
+        }
+        return out;
+    }
     scanSqlInLine(line, lineNum, dedupe, sqlVariables) {
         for (const { re } of VbaExtractor.SQL_WRAPPERS) {
             // Each wrapper regex is stateful (has /g); reset before use.
             const localRe = new RegExp(re.source, re.flags);
             let m;
             while ((m = localRe.exec(line)) !== null) {
-                this.emitSqlTableReferences(m[1] ?? '', lineNum, dedupe);
+                const firstLiteral = m[1] ?? '';
+                // After the wrapper regex consumes up to and including the closing
+                // `"` of the first literal, walk the rest of the line for any
+                // `& "..."` chains and concatenate every literal's content. Joining
+                // with a space (mirrors `collectStringLiteralText`) keeps adjacent
+                // `FROM tblA` & `FROM tblB` separated so `SQL_TABLE_RE` finds both.
+                const rest = line.slice(m.index + m[0].length);
+                const chain = this.collectSqlWrapperChain(rest);
+                const joined = [firstLiteral, ...chain].join(' ');
+                this.emitSqlTableReferences(joined, lineNum, dedupe);
             }
         }
         const localRe = new RegExp(VbaExtractor.SQL_VAR_EXEC_RE.source, VbaExtractor.SQL_VAR_EXEC_RE.flags);
@@ -1829,6 +2687,23 @@ class VbaExtractor {
                 continue;
             this.emitSqlTableReferences(sqlString, lineNum, dedupe);
         }
+        // Issue #42: `DoCmd.RunSQL <identifier>` (variable form). Mirrors the
+        // SQL_VAR_EXEC_RE path above but for the Access-style `DoCmd.RunSQL`
+        // idiom — the dominant pattern in real-world VBA modules. Resolve the
+        // captured identifier against `sqlVariables` (populated by
+        // `trackSqlVariableAssignment` with `&`-accumulate semantics, Issue
+        // #13) and feed the resolved SQL string into `emitSqlTableReferences`.
+        // Unresolved identifiers (no row in the map) are silently skipped —
+        // same graceful-no-op contract as SQL_VAR_EXEC_RE.
+        const docmdLocalRe = new RegExp(VbaExtractor.SQL_VAR_DOCMD_RUNSQL_RE.source, VbaExtractor.SQL_VAR_DOCMD_RUNSQL_RE.flags);
+        let dm;
+        while ((dm = docmdLocalRe.exec(line)) !== null) {
+            const varName = (dm[1] ?? '').toLowerCase();
+            const sqlString = sqlVariables.get(varName);
+            if (!sqlString)
+                continue;
+            this.emitSqlTableReferences(sqlString, lineNum, dedupe);
+        }
     }
     /**
      * #13 fix: `sql = sql & "..."` (self-referential concatenation) must
@@ -1936,6 +2811,135 @@ class VbaExtractor {
         this.pendingModuleOrClassSource.push(edge);
     }
     synthClassNodeIds = new Set();
+    /**
+     * Issue #50: TempVars placeholder-node de-dup cache. Keys are the
+     * deterministic node ids produced by `emitTempVarReference` — those
+     * ids intentionally ignore `this.filePath` (use a synthetic
+     * `synthetic:tempvar/<key>` path instead) so the SAME key referenced
+     * from Form_A.cls AND Form_B.cls collapses to ONE placeholder node.
+     * Cross-file id stability is the cross-form state premise that makes
+     * `codegraph_explore` connect producer ⇄ consumer in one hop.
+     */
+    synthTempVarNodeIds = new Set();
+    /**
+     * Issue #50: emit one TempVar reading/writing site. Per call:
+     *   - placeholder `class` node keyed on the synthetic
+     *     `synthetic:tempvar/<key>` file path so cross-file extraction
+     *     calls collapse to one node per key,
+     *   - `references` edge from the calling `function` node
+     *     (via `findOrCreateFunctionNodeId` — same access pattern as
+     *     `scanDoCmdOpenCalls` / `scanDoCmdOpenQuery`) carrying
+     *     `metadata.synthesizedBy: 'vba-tempvar'` AND
+     *     `metadata.access: 'read' | 'write'`.
+     *
+     * Reuses the synthetic-`class`-placeholder shape established by
+     * `emitReference` for SQL tables, events, Dim types, etc. — so every
+     * synthesized `references` edge in the file already carries the same
+     * `kind: 'class'` target, and downstream consumers (UI, resolvers,
+     * search queries) filter on `metadata.synthesizedBy` rather than
+     * NodeKind anyway. The `metadata.synthesizedBy` tag cleanly distinguishes
+     * TempVars refs from SQL-table refs inside the same NodeKind bucket.
+     *
+     * Skips when stack is empty (the writer/reader is module-level code
+     * — REQ-CODE-4 "unresolvable/runtime reference is silent"). The
+     * spec wires this per-proc only; the module-level shape would need
+     * a different emission (no procedure source) and is out of scope.
+     */
+    emitTempVarReference(caller, key, lineNum, column, access) {
+        if (!caller)
+            return;
+        if (!key)
+            return;
+        const syntheticFilePath = `synthetic:tempvar/${key}`;
+        const targetId = (0, tree_sitter_helpers_1.generateNodeId)(syntheticFilePath, 'class', // placeholder kind — see SQL_TABLE_RE emitReference for precedent
+        key, 0);
+        if (!this.synthTempVarNodeIds.has(targetId)) {
+            this.synthTempVarNodeIds.add(targetId);
+            this.nodes.push({
+                id: targetId,
+                kind: 'class',
+                name: key,
+                qualifiedName: key,
+                filePath: syntheticFilePath,
+                language: 'vba',
+                startLine: lineNum,
+                endLine: lineNum,
+                startColumn: column,
+                endColumn: column + key.length,
+                updatedAt: Date.now(),
+            });
+        }
+        this.edges.push({
+            source: this.findOrCreateFunctionNodeId(caller),
+            target: targetId,
+            kind: 'references',
+            provenance: 'heuristic',
+            metadata: {
+                synthesizedBy: 'vba-tempvar',
+                // User-facing enum: lowercase single-token string values.
+                access,
+            },
+            line: lineNum,
+            column,
+        });
+    }
+    /**
+     * Issue #50: scan one line of VBA source for TempVars access sites and
+     * emit one `references` edge per site. Three regex runs:
+     *   - bang form `TempVars!x` over the MASKED line (`!` itself never
+     *     lives inside a string literal, so masked == unmasked here — using
+     *     the masked line is conservative against false positives in
+     *     concatenated string content),
+     *   - paren form `TempVars("x")` over the ORIGINAL line (the literal is
+     *     inside a string — masked would strip the key),
+     *   - Add form `TempVars.Add "x", v` over the ORIGINAL line (same reason),
+     *     always classified as a write.
+     *
+     * Each match classifies access by looking at the LINE SUFFIX (after the
+     * closing paren / bang-key) on the SAME line: if `=` (and not the
+     * nonexistent `==`) is the next non-whitespace character, it's a write.
+     * VBA has no `==` so a bare `=` suffix check is safe.
+     *
+     * The caller parameter comes from `stack[stack.length - 1]` in
+     * `sweepCallsAndSql`. Pass `undefined` for module-level access — we
+     * drop the edge (per REQ-CODE-4 spirit, runtime references have no
+     * static source to anchor against).
+     */
+    sweepTempVars(maskedLine, originalLine, lineNum, caller) {
+        // 1) Bang form — masked line. No string-literal interaction.
+        const bangRe = new RegExp(VbaExtractor.TEMP_VAR_BANG_RE.source, VbaExtractor.TEMP_VAR_BANG_RE.flags);
+        let bm;
+        while ((bm = bangRe.exec(maskedLine)) !== null) {
+            const key = bm[1] ?? '';
+            if (!key)
+                continue;
+            const access = detectAssignmentSuffix(maskedLine, bm.index + bm[0].length)
+                ? 'write'
+                : 'read';
+            this.emitTempVarReference(caller, key, lineNum, bm.index, access);
+        }
+        // 2) Paren form — original line. The literal survives only here.
+        const parenRe = new RegExp(VbaExtractor.TEMP_VAR_PAREN_RE.source, VbaExtractor.TEMP_VAR_PAREN_RE.flags);
+        let pm;
+        while ((pm = parenRe.exec(originalLine)) !== null) {
+            const key = pm[1] ?? '';
+            if (!key)
+                continue;
+            const access = detectAssignmentSuffix(originalLine, pm.index + pm[0].length)
+                ? 'write'
+                : 'read';
+            this.emitTempVarReference(caller, key, lineNum, pm.index, access);
+        }
+        // 3) Add form — original line. Always a write.
+        const addRe = new RegExp(VbaExtractor.TEMP_VAR_ADD_RE.source, VbaExtractor.TEMP_VAR_ADD_RE.flags);
+        let am;
+        while ((am = addRe.exec(originalLine)) !== null) {
+            const key = am[1] ?? '';
+            if (!key)
+                continue;
+            this.emitTempVarReference(caller, key, lineNum, am.index, 'write');
+        }
+    }
     /**
      * Fix 2 (Issue #2): maps `variableName.toLowerCase()` → declared type info.
      * Built by `sweepDimsAndWithEvents`; consulted by `sweepCallsAndSql` to gate
@@ -1943,8 +2947,71 @@ class VbaExtractor {
      * typed as a SIMPLE (non-qualified, non-primitive) identifier emit edges.
      */
     localVarTypeMap = new Map();
-    /** Local constant name (lowercase) → simple literal value for OpenForm resolution. */
+    /**
+     * Issue #52: Const resolution buckets, scoped per procedure. Key is
+     * `'module'` for module-level Consts, or the procedure's `startLine`
+     * (stringified) for proc-local Consts. Each bucket maps the lowercase
+     * constant name to its simple-literal value (used by `DoCmd.OpenForm` /
+     * `OpenReport` / `OpenQuery` argument resolution via `resolveLocalConst`).
+     *
+     * Two procs declaring the same Const name with different values stay
+     * isolated (each in its own bucket); reads look up the current proc's
+     * bucket first and fall back to the module bucket. The bucket-per-proc
+     * model was chosen over a single file-wide Map (the pre-fix shape) so
+     * `DoCmd.OpenForm FORM_DESTINO` resolves to the proc-local value, not
+     * whichever was written last.
+     */
     localConstants = new Map();
+    /**
+     * Issue #52: shared lookup helper for `scanDoCmdOpenCalls` and
+     * `scanDoCmdOpenQuery`. The current scope is the procedure whose
+     * `startLine` is on top of `procStack` (or `'module'` when the stack is
+     * empty). Per-proc bucket first; module bucket is the fallback.
+     */
+    resolveLocalConst(name) {
+        const lower = name.toLowerCase();
+        const procBucket = this.localConstants.get(this.currentProcKey);
+        if (procBucket) {
+            const v = procBucket.get(lower);
+            if (v !== undefined)
+                return v;
+        }
+        const moduleBucket = this.localConstants.get('module');
+        return moduleBucket?.get(lower);
+    }
+    /**
+     * Issue #52: shared writer. `scopeKey` is `'module'` or the procedure's
+     * startLine-as-string. Creates the bucket lazily so callers do not have
+     * to pre-allocate per proc. Returns the bucket the value was written to
+     * (mostly useful for tests; production code ignores it).
+     */
+    setLocalConstInScope(scopeKey, name, value) {
+        let bucket = this.localConstants.get(scopeKey);
+        if (!bucket) {
+            bucket = new Map();
+            this.localConstants.set(scopeKey, bucket);
+        }
+        bucket.set(name.toLowerCase(), value);
+        return bucket;
+    }
+    /**
+     * Issue #52: the current Const-lookup scope. `'module'` when no procedure
+     * is open, otherwise the top-of-stack proc's `startLine` as a string.
+     * Both `sweepEnumsAndConsts` (to decide whether to emit a `constant`
+     * node) and `sweepCallsAndSql` (to drive OpenForm/OpenQuery resolution)
+     * keep this in sync with their per-line stack walk by pushing/popping
+     * `procStack` and writing the new top's key here.
+     */
+    currentProcKey = 'module';
+    /**
+     * Issue #52: per-extraction proc-stack shared between `sweepEnumsAndConsts`
+     * and `sweepCallsAndSql`. Each sweep clears it at the start so the file's
+     * mid-proc structural state never leaks across sweeps. Holds the
+     * `startLine` (1-based, matches `ProcInfo.startLine`) of every procedure
+     * whose body the sweep has not yet emitted `End Sub`/`End Function`/
+     * `End Property` for.
+     */
+    procStack = [];
     /** Local event name (lowercase) → event node for `RaiseEvent` edge emission. */
     localEvents = new Map();
 }
@@ -2001,6 +3068,37 @@ function splitOutsideVbaStrings(value, separator) {
     parts.push(current);
     return parts;
 }
+/**
+ * Issue #50 helper: return true iff `line.charAt(fromIndex..)` (after the
+ * matched TempVars site, including any trailing whitespace) holds an `=`
+ * (write-assignment) and not a `==` (VBA has no `==` operator, so a bare
+ * check for `=` is safe). Used by `sweepTempVars` to classify a `TempVars`
+ * access as read vs write from the local line context.
+ *
+ * We skip over trailing whitespace only — `.`, `(`, `<`, `>`, `*`, `+`
+ * etc. all mean "this isn't an assignment target", and bare `=`
+ * is the only access-suffix shape VBA syntax allows here. A line like
+ * `TempVars!x = 1` (write) or `Debug.Print TempVars!x` (read) land in
+ * the right bucket without further analysis.
+ *
+ * Strings should already be masked out of `line` (`maskStringContent`)
+ * when this is called for the bang form (no string in scope anyway);
+ * the paren form passes the ORIGINAL line — but for THAT form the
+ * captured match ends at the closing `"` of the literal, so any `=`
+ * that follows is unambiguously outside the string.
+ */
+function detectAssignmentSuffix(line, fromIndex) {
+    let i = fromIndex;
+    while (i < line.length) {
+        const ch = line[i];
+        if (ch === ' ' || ch === '\t') {
+            i++;
+            continue;
+        }
+        return ch === '=';
+    }
+    return false;
+}
 function unwrapVbaStringLiteral(raw) {
     const trimmed = raw.trim();
     if (!trimmed.startsWith('"'))