@holmes-lab/holmes-kit 0.4.1 → 0.6.0

package/CHANGELOG.md

@@ -4,6 +4,76 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+<!-- @implements A-SPEC-209 -->
+## [0.6.0] - 2026-09-02
+
+Three more languages earn corpus-validated control- and data-flow: Java, C#, and Rust join
+TypeScript, Python and Go. Six of seven official languages now build CFG/DDG/CDG with zero
+invariant violations over real open-source corpora. Every grade in the matrix is a measurement.
+
+### Added
+
+- **Java CFG/DDG/CDG** (REQ-520): rides the TS chassis (same probed shapes for if/while/for/do
+  and the try clauses) plus the four seams where Java's semantics live: ONE switch node carrying
+  two styles (old groups fall through, arrow rules never touch), try-with-resources with resource
+  defs, catch parameters inside catch_formal_parameter, and field/method names excluded from
+  uses (`this.x = x` reads x once). **Measured over gson+junit4: 8,376/8,376 functions, zero
+  refusals, zero violations, 19,818 REACHING_DEF + 7,622 CDG edges.** The corpus caught three
+  would-have-shipped defects — named comment nodes, empty bodies (`while (c()) ;` — latent for
+  TS too), and Java's wrapperless else that lowered an else-if CONDITION as a statement.
+- **C# CFG/DDG/CDG** (REQ-521): same face as Java, opposite semantics where it hurts — switch
+  fallthrough is a compile error (sections isolate), `yield` is the iterator protocol
+  (yield return continues, yield break exits), and `#if/#else` arms are ALTERNATIVES lowered as
+  branches. **Measured over Newtonsoft.Json+RestSharp: 9,184 functions, zero violations; the
+  only refusals are designed (preproc_elif 3, goto 1); 51 files (4.4%) refuse honestly at L1
+  where conditional compilation crosses syntax.** One sealed design was corrected mid-slice and
+  re-sealed: a declaration pattern binds at the switch HEADER, because a def on the point that
+  uses it can never reach.
+- **Rust CFG/DDG/CDG** (REQ-522): control flow is an EXPRESSION in Rust (measured: if 1,170 /
+  match 468 / for 307 all inside expression_statement), which creates a new failure mode — a
+  zero-violation but HOLLOW graph. The corpus gate therefore demands branch edges exist, not
+  just that invariants hold. Match is exhaustive (no phantom escape — rustc enforces it), `?` is
+  an implicit early return (both paths leave the point), bare `loop` is infinite, let-else's
+  else arm diverges, and pattern bindings follow the lowercase-initial convention (documented
+  heuristic). **Measured over ripgrep+serde: 5,247/5,247 functions, zero refusals, zero
+  violations, 4,786 branch edges (avg 5.6 blocks/function), 13,647 REACHING_DEF + 6,808 CDG
+  edges.**
+
+<!-- @implements A-SPEC-209 -->
+## [0.5.0] - 2026-09-02
+
+The seven-language goal (GOAL-7langs) starts shipping: the L1 substrate now parses every
+officially supported language, and Go becomes the third language with a full, corpus-validated
+control- and data-flow story. Grades in the language matrix are still measurements, not goals —
+a cell moves only when a real corpus proves it.
+
+### Added
+
+- **L1 AST for all seven languages** (REQ-518): five more grammars join the vendored wasm
+  substrate — go 0.25.0, rust 0.24.0, java 0.23.5, c-sharp 0.23.5, cpp 0.23.4 — each ABI-probed
+  against web-tree-sitter 0.27.0 before pinning (5/5 load+parse). The expansion is five pins and
+  five extension mappings; no code changed, which was the design claim being tested. All 30
+  language fixtures parse with zero span violations. `.h` maps to the C++ grammar (near-superset;
+  a mis-parse surfaces as errorCount>0 and every layer above refuses on it).
+- **Go CFG/DDG/CDG** (REQ-519): Go joins the shared lowering with its semantics pinned by intent,
+  written from a full statement census over two corpora (2,637 functions, 22 statement types)
+  rather than from the grammar docs. No implicit switch fallthrough (an explicit `fallthrough`
+  links to the next case); a bare `for {}` is INFINITE — no phantom exhaustion edge behind the
+  `for { select {…} }` daemon idiom; a `select` without `default` blocks; `defer` is a
+  registration-point statement (its arguments evaluate there, per the Go spec); `goto` refuses
+  the whole function, fail-closed. Receivers and NAMED RESULTS are parameters.
+  **Measured over gin+cobra: 2,637/2,637 functions lowered, zero refusals, zero dominator/DDG/CDG
+  invariant violations, 19,975 REACHING_DEF and 4,633 CDG edges (parse 337ms, build 1.5s).**
+
+### Fixed
+
+- **The language matrix could contradict itself** (REQ-517): the missing-edge list in a
+  relations cell was a hardcoded literal next to a derived present-list, so after REQ-511 the
+  generated doc read "calls, inherits (no imports/inherits)" — inherits present and absent in one
+  breath. Both the missing list and the full/partial judgement now derive from
+  EXTRACTABLE_RELATIONS by set difference, and a property test bans the contradiction SHAPE
+  itself (no edge may appear on both sides, any language, any future widening).
+
 <!-- @implements A-SPEC-209 -->
 ## [0.4.1] - 2026-09-02
 

package/dist/.build-id

@@ -1 +1 @@
-2b427b6-mtj2vv29
+814d021-mtjewubg

package/dist/holmes/cpg/foundation/ast-store.d.ts

@@ -1,7 +1,7 @@
 /** The honest language envelope: exactly what the vendored grammars cover — nothing more. */
 export declare const AST_LANGUAGES: ReadonlyArray<{
     ext: RegExp;
-    lang: 'typescript' | 'tsx' | 'python';
+    lang: 'typescript' | 'tsx' | 'python' | 'go' | 'rust' | 'java' | 'csharp' | 'cpp';
     wasm: string;
 }>;
 export interface AstNodeRow {

package/dist/holmes/cpg/foundation/ast-store.js

@@ -67,6 +67,14 @@ exports.AST_LANGUAGES = [
     { ext: /\.(ts|mts|cts)$/, lang: 'typescript', wasm: 'tree-sitter-typescript.wasm' },
     { ext: /\.(js|mjs|cjs|jsx)$/, lang: 'tsx', wasm: 'tree-sitter-tsx.wasm' }, // TS grammar family parses JS (decision 3: no separate JS grammar)
     { ext: /\.py$/, lang: 'python', wasm: 'tree-sitter-python.wasm' },
+    // @implements A-SPEC-518.1 — the five languages the goal opens. `.h` goes to the C++ grammar on
+    // purpose (H-SPEC-518): C++ is a near-superset of C and a mis-parse surfaces as errorCount>0,
+    // which every layer above refuses on — revisited against the P2-C++ corpus.
+    { ext: /\.go$/, lang: 'go', wasm: 'tree-sitter-go.wasm' },
+    { ext: /\.rs$/, lang: 'rust', wasm: 'tree-sitter-rust.wasm' },
+    { ext: /\.java$/, lang: 'java', wasm: 'tree-sitter-java.wasm' },
+    { ext: /\.cs$/, lang: 'csharp', wasm: 'tree-sitter-c_sharp.wasm' },
+    { ext: /\.(cpp|cc|cxx|hpp|h)$/, lang: 'cpp', wasm: 'tree-sitter-cpp.wasm' },
 ];
 const GRAMMARS_DIR = (() => {
     // src/holmes/cpg/foundation → three up is the package root; identical depth from dist.

package/dist/holmes/cpg/foundation/cfg.js

@@ -10,6 +10,16 @@ exports.FUNCTION_TYPES = new Set([
     'generator_function', 'arrow_function', 'method_definition', 'function',
     // @implements A-SPEC-510.7 — Python's function node joins the same census.
     'function_definition', 'lambda',
+    // @implements A-SPEC-519.1 — Go: methods and function literals (closures/goroutine bodies).
+    'method_declaration', 'func_literal',
+    // @implements A-SPEC-520.1 — Java: constructors, lambdas and initializer blocks.
+    'constructor_declaration', 'lambda_expression', 'static_initializer',
+    'instance_initializer', 'compact_constructor_declaration',
+    // @implements A-SPEC-521.1 — C#: local functions, anonymous methods, operators, accessors.
+    'local_function_statement', 'anonymous_method_expression', 'destructor_declaration',
+    'operator_declaration', 'conversion_operator_declaration', 'accessor_declaration',
+    // @implements A-SPEC-522.1 — Rust: named functions and closures.
+    'function_item', 'closure_expression',
 ]);
 const TS_SIMPLE = new Set([
     'expression_statement', 'lexical_declaration', 'variable_declaration', 'debugger_statement',
@@ -46,8 +56,104 @@ const PY_RULES = {
     ]),
     block: 'block',
 };
+// @implements A-SPEC-519.1 — Go, classified from the FULL statement census over two corpora
+// (2,637 functions, 22 types — evidence REQ-519), not from reading the grammar's docs.
+// `defer`/`go` are pass-through statements (defer's args evaluate at registration per the Go
+// spec; goroutine bodies are func_literals that functionsIn owns separately). `goto` is absent
+// on purpose: zero corpus occurrences, and fail-closed refusal is the honest treatment.
+const GO_SIMPLE = new Set([
+    'expression_statement', 'short_var_declaration', 'assignment_statement', 'var_declaration',
+    'const_declaration', 'type_declaration', 'inc_statement', 'dec_statement', 'send_statement',
+    'defer_statement', 'go_statement', 'empty_statement',
+]);
+const GO_RULES = {
+    simple: GO_SIMPLE,
+    handled: new Set([
+        ...GO_SIMPLE,
+        'block', 'statement_list', 'if_statement', 'for_statement',
+        'expression_switch_statement', 'type_switch_statement', 'select_statement',
+        'labeled_statement', 'break_statement', 'continue_statement', 'return_statement',
+        'fallthrough_statement',
+    ]),
+    block: 'block',
+};
+// @implements A-SPEC-520.1 — Java, classified from the census over gson+junit4 (8,376
+// functions, 20 statement types). Java rides the TS chassis: if/while/for/do/labeled/break/
+// continue/return/throw and the try-clause names are the SAME probed shapes. What is Java's own:
+// one switch node carrying two styles, a try body spelled `block`, try-with-resources, and
+// synchronized as a body wrapper.
+const JAVA_SIMPLE = new Set([
+    'expression_statement', 'local_variable_declaration', 'class_declaration',
+    'record_declaration', 'assert_statement', 'empty_statement',
+]);
+const JAVA_RULES = {
+    simple: JAVA_SIMPLE,
+    handled: new Set([
+        ...JAVA_SIMPLE,
+        'block', 'if_statement', 'while_statement', 'do_statement', 'for_statement',
+        'enhanced_for_statement', 'switch_expression', 'try_statement',
+        'try_with_resources_statement', 'synchronized_statement', 'labeled_statement',
+        'break_statement', 'continue_statement', 'return_statement', 'throw_statement',
+        'yield_statement',
+    ]),
+    block: 'block',
+};
+// @implements A-SPEC-521.1 — C#, classified from the census over newtonsoft+restsharp (13,642
+// functions, 27 statement types). Same face as Java, opposite semantics in three places: switch
+// fallthrough is ILLEGAL (sections isolate), `yield` is the iterator protocol (return passes
+// through, break exits), and the preprocessor puts ALTERNATIVES in statement position. `goto`
+// refuses (one corpus occurrence). Files where conditional compilation crosses syntax refuse at
+// L1 (51 of 1,149 — the honest limit, recorded).
+const CSHARP_SIMPLE = new Set([
+    'expression_statement', 'local_declaration_statement', 'local_function_statement',
+    'empty_statement', 'preproc_region', 'preproc_endregion', 'preproc_pragma',
+]);
+const CSHARP_RULES = {
+    simple: CSHARP_SIMPLE,
+    handled: new Set([
+        ...CSHARP_SIMPLE,
+        'block', 'if_statement', 'while_statement', 'do_statement', 'for_statement',
+        'foreach_statement', 'switch_statement', 'try_statement', 'using_statement',
+        'lock_statement', 'checked_statement', 'preproc_if',
+        'break_statement', 'continue_statement', 'return_statement', 'throw_statement',
+        'yield_statement',
+    ]),
+    block: 'block',
+};
+// @implements A-SPEC-522.1 — Rust, where control flow is an EXPRESSION. The simple set
+// enumerates the value expressions and declarations the corpus census actually put in statement
+// or trailing position (36 kinds over ripgrep+serde); anything new refuses, keeping fail-closed
+// meaningful. Control expressions are lowered as control wherever they stand as a statement or a
+// trailing value — flattening them would produce the zero-violation HOLLOW graph this slice's
+// corpus gate (branch edges > 0) exists to catch.
+const RUST_SIMPLE = new Set([
+    'let_declaration', 'call_expression', 'macro_invocation', 'identifier', 'self',
+    'scoped_identifier', 'field_expression', 'reference_expression', 'binary_expression',
+    'unary_expression', 'assignment_expression', 'compound_assignment_expr', 'struct_expression',
+    'tuple_expression', 'array_expression', 'index_expression', 'await_expression',
+    'type_cast_expression', 'range_expression', 'closure_expression', 'parenthesized_expression',
+    'integer_literal', 'float_literal', 'string_literal', 'raw_string_literal', 'char_literal',
+    'boolean_literal', 'unit_expression', 'try_expression', 'method_call_expression',
+    'use_declaration', 'struct_item', 'enum_item', 'impl_item', 'function_item', 'const_item',
+    'static_item', 'type_item', 'mod_item', 'trait_item', 'macro_definition', 'attribute_item',
+    'inner_attribute_item', 'empty_statement', 'foreign_mod_item', 'extern_crate_declaration',
+    // expression_statement lands here when its inner is NOT a control expression (the unwrap
+    // check runs first), so a plain `g();` is one point.
+    'expression_statement',
+]);
+const RUST_RULES = {
+    simple: RUST_SIMPLE,
+    handled: new Set([
+        ...RUST_SIMPLE,
+        'block', 'expression_statement', 'if_expression', 'match_expression', 'for_expression',
+        'while_expression', 'loop_expression', 'return_expression', 'break_expression',
+        'continue_expression',
+    ]),
+    block: 'block',
+};
 const LANG_RULES = {
-    typescript: TS_RULES, tsx: TS_RULES, python: PY_RULES,
+    typescript: TS_RULES, tsx: TS_RULES, python: PY_RULES, go: GO_RULES, java: JAVA_RULES,
+    csharp: CSHARP_RULES, rust: RUST_RULES,
 };
 // @implements A-SPEC-510.6
 /**
@@ -91,6 +197,8 @@ function cfgOf(ast, fn, source) {
     }
     const rules = LANG_RULES[ast.lang];
     const isPython = ast.lang === 'python';
+    const isGo = ast.lang === 'go';
+    const isRust = ast.lang === 'rust';
     const kids = childrenIndex(ast);
     // Points: one per lowered statement (block ids after coalescing). 0=ENTRY, 1=EXIT.
     const stmtsOf = [[], []];
@@ -131,7 +239,9 @@ function cfgOf(ast, fn, source) {
             }
             return { entry, exits };
         };
-        const stmtChildren = (i) => kids.of(i).filter((k) => ast.nodes[k].named && ast.nodes[k].type !== 'comment');
+        const stmtChildren = (i) => 
+        // `comment` (TS/PY/Go) and Java's line_comment/block_comment are all named nodes.
+        kids.of(i).filter((k) => ast.nodes[k].named && !ast.nodes[k].type.includes('comment'));
         const wireException = (first, targetProvider) => {
             // Conservative: every point created inside [first, now) can throw into the handler.
             const target = targetProvider();
@@ -144,13 +254,54 @@ function cfgOf(ast, fn, source) {
                 throw new Unsupported(t);
             const label = ctx.pendingLabel;
             ctx.pendingLabel = null;
+            // @implements A-SPEC-522.1 — Rust control lives in expressions. A statement whose sole
+            // named child is a control expression lowers as that control (flattening it makes the
+            // hollow graph); a `?` anywhere in a point's subtree adds the implicit early-return edge;
+            // a let-else is a branch whose false arm is the (compiler-enforced) diverging else block.
+            const RUST_CONTROL = new Set(['if_expression', 'match_expression', 'for_expression', 'while_expression', 'loop_expression', 'return_expression', 'break_expression', 'continue_expression']);
+            if (isRust && t === 'expression_statement') {
+                const inner = stmtChildren(i);
+                if (inner.length === 1 && RUST_CONTROL.has(ast.nodes[inner[0]].type))
+                    return lowerStmt(inner[0], ctx);
+            }
+            const rustQuestion = (p, root) => {
+                if (!isRust)
+                    return;
+                const stack = [root];
+                while (stack.length) {
+                    const n = stack.pop();
+                    if (n !== root && exports.FUNCTION_TYPES.has(ast.nodes[n].type))
+                        continue; // closures own their `?`
+                    if (ast.nodes[n].type === 'try_expression') {
+                        link(p, ctx.catchT.at(-1) ?? EXIT, 'throw');
+                        return;
+                    }
+                    for (const c of kids.of(n))
+                        stack.push(c);
+                }
+            };
+            if (isRust && t === 'let_declaration') {
+                const elseBlock = kids.of(i).some((k) => !ast.nodes[k].named && source !== undefined
+                    && source.slice(ast.nodes[k].start, ast.nodes[k].end) === 'else')
+                    ? kids.of(i).filter((k) => ast.nodes[k].type === 'block').at(-1) : undefined;
+                if (elseBlock !== undefined) {
+                    const p = newPoint(i);
+                    rustQuestion(p, i);
+                    const ef = lowerStmt(elseBlock, ctx);
+                    link(p, ef.entry, 'false');
+                    return { entry: p, exits: [{ from: p, kind: 'true' }, ...ef.exits] };
+                }
+            }
             if (rules.simple.has(t)) {
                 const p = newPoint(i);
+                rustQuestion(p, i);
                 return { entry: p, exits: [{ from: p, kind: 'seq' }] };
             }
             switch (t) {
                 case 'statement_block':
                 case 'block':
+                case 'statement_list':
+                    // Go's block carries one extra statement_list layer (probed shape) — both are containers.
                     return lowerSeq(stmtChildren(i), ctx);
                 case 'labeled_statement': {
                     const [labelNode, inner] = [kids.of(i)[0], stmtChildren(i).at(-1)];
@@ -164,9 +315,18 @@ function cfgOf(ast, fn, source) {
                     // @implements A-SPEC-510.7 — Python spells the arms as fields (`consequence`,
                     // `alternative` = elif_clause | else_clause), TS as positional children. Reading the
                     // fields where they exist keeps ONE lowering for both grammars.
-                    const cons = isPython ? (kids.of(i).find((k) => ast.nodes[k].type === 'block') ?? named[1]) : named[1];
+                    // @implements A-SPEC-519.1 — Go: consequence is the FIRST block child; the alternative
+                    // (an else block or an else-if chain's if_statement) is the last named child when it is
+                    // distinct from the consequence. The header point owns the init (:=) and condition.
+                    const goCons = isGo ? kids.of(i).find((k) => ast.nodes[k].type === 'block') : undefined;
+                    const cons = isGo ? goCons : isPython ? (kids.of(i).find((k) => ast.nodes[k].type === 'block') ?? named[1]) : named[1];
                     let alt;
-                    if (isPython) {
+                    if (isGo) {
+                        const last = named.at(-1);
+                        if (last !== goCons && ['block', 'if_statement'].includes(ast.nodes[last].type))
+                            alt = last;
+                    }
+                    else if (isPython) {
                         const clause = kids.of(i).find((k) => ['elif_clause', 'else_clause'].includes(ast.nodes[k].type));
                         if (clause !== undefined) {
                             alt = ast.nodes[clause].type === 'elif_clause'
@@ -174,9 +334,29 @@ function cfgOf(ast, fn, source) {
                                 : stmtChildren(clause).find((k) => ast.nodes[k].type === 'block');
                         }
                     }
+                    else if (ast.lang === 'java' || ast.lang === 'csharp') {
+                        // @implements A-SPEC-520.1 / A-SPEC-521.1 — Java and C# have NO else_clause
+                        // wrapper: named[2] IS the
+                        // alternative (a block, or the next if_statement of an else-if chain). Unwrapping it
+                        // like TS lowered an else-if's CONDITION as a statement — the corpus caught it.
+                        alt = named[2];
+                    }
                     else {
                         alt = named[2] !== undefined ? stmtChildren(named[2])[0] : undefined;
                     }
+                    if (cons === undefined || !rules.handled.has(ast.nodes[cons].type)) {
+                        // `if (c()) ;` — an empty then-arm: both edges leave the header directly.
+                        const exits0 = [{ from: p, kind: 'true' }];
+                        if (alt !== undefined && rules.handled.has(ast.nodes[alt].type)) {
+                            const af0 = lowerStmt(alt, ctx);
+                            link(p, af0.entry, 'false');
+                            exits0.push(...af0.exits);
+                        }
+                        else {
+                            exits0.push({ from: p, kind: 'false' });
+                        }
+                        return { entry: p, exits: exits0 };
+                    }
                     const cf = lowerStmt(cons, ctx);
                     link(p, cf.entry, 'true');
                     const exits = [...cf.exits];
@@ -202,9 +382,25 @@ function cfgOf(ast, fn, source) {
                         ? kids.of(i).filter((k) => ast.nodes[k].type === 'else_clause')
                             .flatMap((k) => stmtChildren(k)).find((k) => ast.nodes[k].type === 'block')
                         : undefined;
-                    const bodyIdx = isPython
+                    const bodyIdx = (isPython || isGo)
                         ? kids.of(i).filter((k) => ast.nodes[k].type === 'block').at(0)
                         : stmtChildren(i).at(-1);
+                    // Found by the Java corpus, latent for TS too: `for (; ; ) ;` has NO named children —
+                    // empty clauses and an empty-statement body. The loop is a bare spin: header with a
+                    // self loop-back and only the (over-approximate) exhaustion exit.
+                    if (bodyIdx === undefined || !rules.handled.has(ast.nodes[bodyIdx].type)) {
+                        // Latent for TS, found by the Java corpus: an EMPTY body (`while (c()) ;`,
+                        // `for (; ; ) ;`) leaves no statement child, so `.at(-1)` lands on the condition
+                        // itself. The loop is a bare spin: header with a self loop-back.
+                        const header = newPoint(i);
+                        link(header, header, 'loop-back');
+                        return { entry: header, exits: [{ from: header, kind: 'false' }] };
+                    }
+                    // @implements A-SPEC-519.1 — a bare Go `for {}` (no named non-block child) is INFINITE:
+                    // no exhaustion edge. `for { select {…} }` is the daemon idiom, and a phantom false edge
+                    // would hang spurious control dependence on everything after the loop. A for_clause with
+                    // an empty condition keeps the edge (documented over-approximation).
+                    const goInfinite = isGo && !kids.of(i).some((k) => ast.nodes[k].named && ast.nodes[k].type !== 'block' && ast.nodes[k].type !== 'comment');
                     const myBreak = { label, target: -1 }; // ONE owner: labeled and bare breaks share it
                     ctx.breakT.push({ label, owner: myBreak }, { label: null, owner: myBreak });
                     ctx.contT.push({ label, target: header }, { label: null, target: header });
@@ -220,7 +416,7 @@ function cfgOf(ast, fn, source) {
                         link(header, ef.entry, 'false'); // exhaustion path enters `else`
                         exits.push(...ef.exits);
                     }
-                    else {
+                    else if (!goInfinite) {
                         exits.push({ from: header, kind: 'false' });
                     }
                     // break targets resolved lazily: edges recorded with target -1 fixed by caller — instead
@@ -233,6 +429,10 @@ function cfgOf(ast, fn, source) {
                 case 'do_statement': {
                     const header = newPoint(i); // condition point (the `do` node)
                     const bodyIdx = stmtChildren(i)[0];
+                    if (bodyIdx === undefined || !rules.handled.has(ast.nodes[bodyIdx].type)) {
+                        link(header, header, 'loop-back');
+                        return { entry: header, exits: [{ from: header, kind: 'false' }] };
+                    }
                     const myBreak = { label, target: -1 };
                     ctx.breakT.push({ label, owner: myBreak }, { label: null, owner: myBreak });
                     ctx.contT.push({ label, target: header }, { label: null, target: header });
@@ -282,12 +482,364 @@ function cfgOf(ast, fn, source) {
                         throw new Unsupported('with_statement without a block');
                     return lowerStmt(body, ctx);
                 }
+                // @implements A-SPEC-519.1 — Go's two switch forms. NO implicit fallthrough (each case
+                // leaves the switch), an explicit fallthrough_statement links to the NEXT case's entry,
+                // and a missing default leaves a header escape (no case matched). The binding of a type
+                // switch (`switch v := x.(type)`) lives on the header point, where the DDG collects it.
+                case 'expression_switch_statement':
+                case 'type_switch_statement': {
+                    const p = newPoint(i);
+                    const myBreak = { label, target: -1 };
+                    ctx.breakT.push({ label, owner: myBreak }, { label: null, owner: myBreak });
+                    const caseNodes = kids.of(i).filter((k) => ['expression_case', 'type_case', 'default_case'].includes(ast.nodes[k].type));
+                    let sawDefault = false;
+                    const exits = [];
+                    let pendingFalls = [];
+                    caseNodes.forEach((c, ci) => {
+                        if (ast.nodes[c].type === 'default_case')
+                            sawDefault = true;
+                        const bodyList = kids.of(c).find((k) => ast.nodes[k].type === 'statement_list');
+                        const stmts = bodyList === undefined ? [] : stmtChildren(bodyList);
+                        const fallIdx = stmts.filter((k) => ast.nodes[k].type === 'fallthrough_statement');
+                        const rest = stmts.filter((k) => ast.nodes[k].type !== 'fallthrough_statement');
+                        const cf = lowerSeq(rest, ctx);
+                        link(p, cf.entry, ast.nodes[c].type === 'default_case' ? 'default' : 'case');
+                        for (const f of pendingFalls)
+                            link(f, cf.entry, 'seq');
+                        pendingFalls = [];
+                        if (fallIdx.length > 0) {
+                            // The census shows fallthrough only as a case's LAST statement; a next case must
+                            // exist (its absence is a Go compile error) — refuse honestly if it does not.
+                            if (ci === caseNodes.length - 1)
+                                throw new Unsupported('fallthrough in last case');
+                            const fp = newPoint(fallIdx[0]);
+                            for (const e of cf.exits)
+                                link(e.from, fp, e.kind);
+                            pendingFalls.push(fp);
+                        }
+                        else {
+                            exits.push(...cf.exits);
+                        }
+                    });
+                    if (!sawDefault)
+                        exits.push({ from: p, kind: 'default' });
+                    ctx.breakT.splice(-2);
+                    for (const b of claimBreaks(myBreak))
+                        exits.push({ from: b.point, kind: 'break' });
+                    return { entry: p, exits };
+                }
+                // @implements A-SPEC-520.1 — Java's enhanced for: the header owns the binding; body
+                // loops back; exhaustion exits false — same skeleton as Go's range.
+                case 'enhanced_for_statement':
+                case 'foreach_statement': {
+                    const header = newPoint(i);
+                    const bodyIdx = kids.of(i).find((k) => ast.nodes[k].type === 'block')
+                        ?? stmtChildren(i).at(-1);
+                    const myBreak = { label, target: -1 };
+                    ctx.breakT.push({ label, owner: myBreak }, { label: null, owner: myBreak });
+                    ctx.contT.push({ label, target: header }, { label: null, target: header });
+                    const bf = lowerStmt(bodyIdx, ctx);
+                    ctx.breakT.splice(-2);
+                    ctx.contT.splice(-2);
+                    link(header, bf.entry, 'true');
+                    for (const e of bf.exits)
+                        link(e.from, header, 'loop-back');
+                    const exits = [{ from: header, kind: 'false' }];
+                    for (const b of claimBreaks(myBreak))
+                        exits.push({ from: b.point, kind: 'break' });
+                    return { entry: header, exits };
+                }
+                // @implements A-SPEC-520.1 — synchronized: a body wrapper for control flow (the lock is
+                // a use the DDG reads off the header point); lock semantics are declared out of scope.
+                case 'synchronized_statement':
+                case 'lock_statement':
+                case 'checked_statement': {
+                    const p = newPoint(i);
+                    const body = kids.of(i).find((k) => ast.nodes[k].type === 'block');
+                    if (body === undefined)
+                        throw new Unsupported(t + ' without a block');
+                    const bf = lowerStmt(body, ctx);
+                    link(p, bf.entry, 'seq');
+                    return { entry: p, exits: bf.exits };
+                }
+                // @implements A-SPEC-521.1 — the preprocessor puts ALTERNATIVES in statement position.
+                // Sequencing the arms would fabricate flow no build configuration ever runs; each arm is
+                // a branch and both rejoin after #endif (a may-analysis over every configuration).
+                case 'preproc_if': {
+                    const p = newPoint(i);
+                    const named = stmtChildren(i);
+                    const elseArm = named.find((k) => ['preproc_else', 'preproc_elif'].includes(ast.nodes[k].type));
+                    const ifStmts = named.filter((k) => rules.handled.has(ast.nodes[k].type));
+                    const exits = [];
+                    const f1 = lowerSeq(ifStmts, ctx);
+                    link(p, f1.entry, 'true');
+                    exits.push(...f1.exits);
+                    if (elseArm !== undefined) {
+                        if (ast.nodes[elseArm].type === 'preproc_elif')
+                            throw new Unsupported('preproc_elif');
+                        const elseStmts = stmtChildren(elseArm).filter((k) => rules.handled.has(ast.nodes[k].type));
+                        const f2 = lowerSeq(elseStmts, ctx);
+                        link(p, f2.entry, 'false');
+                        exits.push(...f2.exits);
+                    }
+                    else {
+                        exits.push({ from: p, kind: 'false' });
+                    }
+                    return { entry: p, exits };
+                }
+                // @implements A-SPEC-521.1 — using: a wrapper whose header owns the resource defs
+                // (variable_declarator does the DDG work); the implicit Dispose is covered by the
+                // enclosing try wiring, same posture as Java's try-with-resources.
+                case 'using_statement': {
+                    const p = newPoint(i);
+                    const body = kids.of(i).find((k) => ast.nodes[k].type === 'block')
+                        ?? stmtChildren(i).filter((k) => rules.handled.has(ast.nodes[k].type)).at(-1);
+                    if (body === undefined)
+                        return { entry: p, exits: [{ from: p, kind: 'seq' }] };
+                    const bf = lowerStmt(body, ctx);
+                    link(p, bf.entry, 'seq');
+                    return { entry: p, exits: bf.exits };
+                }
+                // @implements A-SPEC-520.1 — ONE node, TWO styles. Old-style groups fall through into
+                // each other (TS switch semantics); arrow rules never touch (Go case semantics). A
+                // `yield` leaves the switch like a break-with-value. Statement position only — an
+                // expression-position switch stays inside its statement's point, like a ternary.
+                case 'switch_expression': {
+                    const p = newPoint(i);
+                    const myBreak = { label, target: -1 };
+                    ctx.breakT.push({ label, owner: myBreak }, { label: null, owner: myBreak });
+                    ctx.yieldT.push(myBreak);
+                    const swBlock = kids.of(i).find((k) => ast.nodes[k].type === 'switch_block');
+                    const members = swBlock === undefined ? [] : kids.of(swBlock).filter((k) => ['switch_block_statement_group', 'switch_rule'].includes(ast.nodes[k].type));
+                    let sawDefault = false;
+                    let prevFall = [];
+                    const exits = [];
+                    for (const m of members) {
+                        const labelNode = kids.of(m).find((k) => ast.nodes[k].type === 'switch_label');
+                        if (labelNode !== undefined && source !== undefined
+                            && source.slice(ast.nodes[labelNode].start, ast.nodes[labelNode].end).trim().startsWith('default'))
+                            sawDefault = true;
+                        const stmts = stmtChildren(m).filter((k) => ast.nodes[k].type !== 'switch_label');
+                        const cf = lowerSeq(stmts, ctx);
+                        link(p, cf.entry, 'case');
+                        if (ast.nodes[m].type === 'switch_block_statement_group') {
+                            for (const e of prevFall)
+                                link(e.from, cf.entry, 'seq'); // implicit fallthrough
+                            prevFall = cf.exits;
+                        }
+                        else {
+                            exits.push(...cf.exits); // arrow rule: isolated
+                        }
+                    }
+                    exits.push(...prevFall);
+                    if (!sawDefault)
+                        exits.push({ from: p, kind: 'default' });
+                    ctx.breakT.splice(-2);
+                    ctx.yieldT.pop();
+                    for (const b of claimBreaks(myBreak))
+                        exits.push({ from: b.point, kind: 'break' });
+                    return { entry: p, exits };
+                }
+                case 'yield_statement': {
+                    const p = newPoint(i);
+                    // @implements A-SPEC-521.1 — the SAME node name, two protocols. Java: a value-carrying
+                    // switch escape. C#: the iterator protocol — `yield return v` (has a named child)
+                    // CONTINUES executing; `yield break` (bare) leaves the function.
+                    if (ast.lang === 'csharp') {
+                        if (stmtChildren(i).length > 0)
+                            return { entry: p, exits: [{ from: p, kind: 'seq' }] };
+                        link(p, EXIT, 'return');
+                        return { entry: p, exits: [] };
+                    }
+                    const owner = ctx.yieldT.at(-1);
+                    if (owner === undefined)
+                        throw new Unsupported('yield outside switch');
+                    pendingBreaks.push({ point: p, owner });
+                    return { entry: p, exits: [] };
+                }
+                // @implements A-SPEC-522.1 — Rust's if EXPRESSION: [cond, block, else_clause?[block|if]].
+                case 'if_expression': {
+                    const p = newPoint(i);
+                    rustQuestion(p, i === undefined ? i : kids.of(i)[0] ?? i);
+                    const consR = kids.of(i).find((k) => ast.nodes[k].type === 'block');
+                    const elseClause = kids.of(i).find((k) => ast.nodes[k].type === 'else_clause');
+                    const altR = elseClause === undefined ? undefined
+                        : kids.of(elseClause).find((k) => ['block', 'if_expression'].includes(ast.nodes[k].type));
+                    const cf = lowerStmt(consR, ctx);
+                    link(p, cf.entry, 'true');
+                    const exits = [...cf.exits];
+                    if (altR !== undefined) {
+                        const af = lowerStmt(altR, ctx);
+                        link(p, af.entry, 'false');
+                        exits.push(...af.exits);
+                    }
+                    else {
+                        exits.push({ from: p, kind: 'false' });
+                    }
+                    return { entry: p, exits };
+                }
+                // @implements A-SPEC-522.1 — match: arms isolated, EXHAUSTIVE (rustc enforces it, so a
+                // "no arm matched" escape would be flow no execution takes — the opposite of Python's
+                // match, deliberately). Arm values may be blocks or bare expressions.
+                case 'match_expression': {
+                    const p = newPoint(i);
+                    const mb = kids.of(i).find((k) => ast.nodes[k].type === 'match_block');
+                    const exits = [];
+                    for (const arm of mb === undefined ? [] : kids.of(mb)) {
+                        if (ast.nodes[arm].type !== 'match_arm')
+                            continue;
+                        const val = kids.of(arm).filter((k) => ast.nodes[k].named && ast.nodes[k].type !== 'match_pattern').at(-1);
+                        if (val === undefined)
+                            continue;
+                        const vf = rules.handled.has(ast.nodes[val].type)
+                            ? lowerStmt(val, ctx)
+                            : (() => { const vp = newPoint(val); rustQuestion(vp, val); return { entry: vp, exits: [{ from: vp, kind: 'seq' }] }; })();
+                        link(p, vf.entry, 'case');
+                        exits.push(...vf.exits);
+                    }
+                    return { entry: p, exits };
+                }
+                // @implements A-SPEC-522.1 — for/while/loop expressions ride the loop skeleton; a bare
+                // `loop` is INFINITE (no exhaustion edge — Go's bare-for call, same reasoning).
+                case 'for_expression':
+                case 'while_expression':
+                case 'loop_expression': {
+                    const header = newPoint(i);
+                    rustQuestion(header, i);
+                    const bodyR = kids.of(i).find((k) => ast.nodes[k].type === 'block');
+                    const myBreak = { label, target: -1 };
+                    const loopLabel = (() => {
+                        const ln = kids.of(i).find((k) => ast.nodes[k].type === 'label');
+                        return ln !== undefined && source !== undefined
+                            ? source.slice(ast.nodes[ln].start, ast.nodes[ln].end) : label;
+                    })();
+                    const owner = { label: loopLabel, target: -1 };
+                    ctx.breakT.push({ label: loopLabel, owner }, { label: null, owner });
+                    ctx.contT.push({ label: loopLabel, target: header }, { label: null, target: header });
+                    const bf = lowerStmt(bodyR, ctx);
+                    ctx.breakT.splice(-2);
+                    ctx.contT.splice(-2);
+                    link(header, bf.entry, 'true');
+                    for (const e of bf.exits)
+                        link(e.from, header, 'loop-back');
+                    const exits = [];
+                    if (t !== 'loop_expression')
+                        exits.push({ from: header, kind: 'false' });
+                    for (const b of claimBreaks(owner))
+                        exits.push({ from: b.point, kind: 'break' });
+                    void myBreak;
+                    return { entry: header, exits };
+                }
+                case 'return_expression': {
+                    const p = newPoint(i);
+                    rustQuestion(p, i);
+                    link(p, EXIT, 'return');
+                    return { entry: p, exits: [] };
+                }
+                case 'break_expression': {
+                    const p = newPoint(i);
+                    const ln = kids.of(i).find((k) => ast.nodes[k].type === 'label');
+                    const lbl = ln !== undefined && source !== undefined
+                        ? source.slice(ast.nodes[ln].start, ast.nodes[ln].end) : null;
+                    const bentry = nearestBreak(ctx.breakT, lbl);
+                    if (!bentry)
+                        throw new Unsupported('break outside breakable');
+                    pendingBreaks.push({ point: p, owner: bentry.owner });
+                    return { entry: p, exits: [] };
+                }
+                case 'continue_expression': {
+                    const p = newPoint(i);
+                    const ln = kids.of(i).find((k) => ast.nodes[k].type === 'label');
+                    const lbl = ln !== undefined && source !== undefined
+                        ? source.slice(ast.nodes[ln].start, ast.nodes[ln].end) : null;
+                    const centry = nearestCont(ctx.contT, lbl);
+                    if (!centry || centry.target < 0)
+                        throw new Unsupported('continue outside loop');
+                    link(p, centry.target, 'continue');
+                    return { entry: p, exits: [] };
+                }
+                // @implements A-SPEC-519.1 — select: each communication case is a branch off the header;
+                // WITHOUT a default the statement BLOCKS until some case fires, so there is no "no arm
+                // matched" escape (the opposite of Python's match).
+                case 'select_statement': {
+                    const p = newPoint(i);
+                    const myBreak = { label, target: -1 };
+                    ctx.breakT.push({ label, owner: myBreak }, { label: null, owner: myBreak });
+                    let sawDefault = false;
+                    const exits = [];
+                    for (const c of kids.of(i)) {
+                        const cty = ast.nodes[c].type;
+                        if (cty !== 'communication_case' && cty !== 'default_case')
+                            continue;
+                        if (cty === 'default_case')
+                            sawDefault = true;
+                        const comm = kids.of(c).find((k) => ['receive_statement', 'send_statement', 'expression_statement'].includes(ast.nodes[k].type));
+                        const bodyList = kids.of(c).find((k) => ast.nodes[k].type === 'statement_list');
+                        const stmts = bodyList === undefined ? [] : stmtChildren(bodyList);
+                        let entry;
+                        let head;
+                        if (comm !== undefined) {
+                            const cp = newPoint(comm);
+                            entry = cp;
+                            head = { entry: cp, exits: [{ from: cp, kind: 'seq' }] };
+                        }
+                        else {
+                            head = undefined;
+                            entry = -1;
+                        }
+                        const bf = lowerSeq(stmts, ctx);
+                        if (head !== undefined) {
+                            for (const e of head.exits)
+                                link(e.from, bf.entry, e.kind);
+                        }
+                        else {
+                            entry = bf.entry;
+                        }
+                        link(p, entry, cty === 'default_case' ? 'default' : 'case');
+                        exits.push(...bf.exits);
+                    }
+                    if (sawDefault) { /* a ready default gives an immediate path — covered by its case edge */ }
+                    ctx.breakT.splice(-2);
+                    for (const b of claimBreaks(myBreak))
+                        exits.push({ from: b.point, kind: 'break' });
+                    return { entry: p, exits };
+                }
                 case 'raise_statement': {
                     const p = newPoint(i);
                     link(p, ctx.catchT.at(-1) ?? EXIT, 'throw');
                     return { entry: p, exits: [] };
                 }
                 case 'switch_statement': {
+                    // @implements A-SPEC-521.1 — C# shares the node NAME with TS and inverts the
+                    // semantics: implicit fallthrough is a compile error, so sections are ISOLATED.
+                    // (The suite caught the first attempt — a duplicate case label silently shadowed the
+                    // TS lowering and broke its fallthrough pin.)
+                    if (ast.lang === 'csharp') {
+                        const p = newPoint(i);
+                        const myBreak = { label, target: -1 };
+                        ctx.breakT.push({ label, owner: myBreak }, { label: null, owner: myBreak });
+                        const swBody = kids.of(i).find((k) => ast.nodes[k].type === 'switch_body');
+                        let sawDefault = false;
+                        const exits = [];
+                        for (const sec of swBody === undefined ? [] : kids.of(swBody)) {
+                            if (ast.nodes[sec].type !== 'switch_section')
+                                continue;
+                            const children = stmtChildren(sec);
+                            const stmts = children.filter((k) => rules.handled.has(ast.nodes[k].type));
+                            const hasPattern = children.some((k) => ast.nodes[k].type.includes('pattern'));
+                            if (!hasPattern)
+                                sawDefault = true; // a default section carries no pattern
+                            const cf = lowerSeq(stmts, ctx);
+                            link(p, cf.entry, hasPattern ? 'case' : 'default');
+                            exits.push(...cf.exits); // isolated: nothing flows to a sibling
+                        }
+                        if (!sawDefault)
+                            exits.push({ from: p, kind: 'default' });
+                        ctx.breakT.splice(-2);
+                        for (const b of claimBreaks(myBreak))
+                            exits.push({ from: b.point, kind: 'break' });
+                        return { entry: p, exits };
+                    }
                     const p = newPoint(i);
                     const body = stmtChildren(i).at(-1); // switch_body
                     const myBreak = { label, target: -1 };
@@ -346,13 +898,17 @@ function cfgOf(ast, fn, source) {
                     link(p, ctx.catchT.at(-1) ?? EXIT, 'throw');
                     return { entry: p, exits: [] };
                 }
+                // @implements A-SPEC-520.1 — try-with-resources joins the try case: same clause wiring,
+                // plus a point for the resource_specification so its defs (`var r = open()`) have a home.
+                case 'try_with_resources_statement':
                 case 'try_statement': {
                     const named = stmtChildren(i);
                     // @implements A-SPEC-510.7 — Python spells the same shape with `block` / `except_clause`
                     // / `finally_clause`, PLUS an `else_clause` that runs ONLY when no exception was raised.
+                    // @implements A-SPEC-520.1 — Java spells the try body `block`; TS `statement_block`.
                     const body = isPython
                         ? kids.of(i).find((k) => ast.nodes[k].type === 'block')
-                        : named.find((k) => ast.nodes[k].type === 'statement_block');
+                        : named.find((k) => ['statement_block', 'block'].includes(ast.nodes[k].type));
                     const handler = isPython
                         ? kids.of(i).find((k) => ast.nodes[k].type === 'except_clause')
                         : named.find((k) => ast.nodes[k].type === 'catch_clause');
@@ -406,6 +962,12 @@ function cfgOf(ast, fn, source) {
                     else {
                         exits.push(...after);
                     }
+                    const resSpec = kids.of(i).find((k) => ast.nodes[k].type === 'resource_specification');
+                    if (resSpec !== undefined) {
+                        const rp = newPoint(resSpec);
+                        link(rp, bf.entry, 'seq');
+                        return { entry: rp, exits };
+                    }
                     return { entry: bf.entry, exits };
                 }
                 default:
@@ -437,7 +999,7 @@ function cfgOf(ast, fn, source) {
             }
             return undefined;
         };
-        const ctx = { breakT: [], contT: [], catchT: [], pendingLabel: null };
+        const ctx = { breakT: [], contT: [], catchT: [], yieldT: [], pendingLabel: null };
         const bodyNode = ast.nodes[fn.bodyIndex];
         const flow = bodyNode.type === rules.block
             ? lowerSeq(stmtChildren(fn.bodyIndex), ctx)

package/dist/holmes/cpg/foundation/ddg.js

@@ -6,20 +6,32 @@ exports.ddgViolations = ddgViolations;
 const cfg_1 = require("./cfg");
 /** Identifier positions that are DEF sites, keyed by the parent node type. */
 const PATTERN_TYPES = new Set(['object_pattern', 'array_pattern', 'shorthand_property_identifier_pattern',
-    'pair_pattern', 'rest_pattern', 'assignment_pattern']);
+    'pair_pattern', 'rest_pattern', 'assignment_pattern',
+    // @implements A-SPEC-519.1 — Go: an expression_list on a binding LHS carries the def context
+    // through to each identifier (`a, b := …`, `for i, v := range …`).
+    'expression_list']);
 function defUseOf(ast, cfg, fn, source) {
     const kids = (0, cfg_1.childrenIndex)(ast);
     const text = (i) => source.slice(ast.nodes[i].start, ast.nodes[i].end);
     // ── parameters: ENTRY defs (and part of the local namespace).
     const isPython = ast.lang === 'python';
+    const isGo = ast.lang === 'go';
     const params = new Map();
-    const bareArrow = ast.nodes[fn.nodeIndex].type === 'arrow_function'
+    const bareArrow = (ast.nodes[fn.nodeIndex].type === 'arrow_function'
+        // @implements A-SPEC-520.1 — Java's single-parameter lambda (`z -> …`) has the same shape.
+        || ast.nodes[fn.nodeIndex].type === 'lambda_expression')
         && !kids.of(fn.nodeIndex).some((k) => ast.nodes[k].type === 'formal_parameters');
     for (const k of kids.of(fn.nodeIndex)) {
         // Only formal_parameters — a declaration's NAME identifier is not a parameter (measured: the
         // early break on the name swallowed every real parameter of named functions).
         // @implements A-SPEC-510.7 — Python's parameter list node is `parameters`.
-        const isParamList = ast.nodes[k].type === 'formal_parameters' || ast.nodes[k].type === 'parameters';
+        // @implements A-SPEC-519.1 — Go's list node is `parameter_list`, and it appears up to THREE
+        // times on one declaration: receiver, parameters, NAMED RESULTS. All of them bind names at
+        // ENTRY, so Go must not break after the first (the probe pinned the second-list shape).
+        const isParamList = ast.nodes[k].type === 'formal_parameters' || ast.nodes[k].type === 'parameters'
+            || ast.nodes[k].type === 'parameter_list'
+            // @implements A-SPEC-522.1 — Rust: fn parameters and closure |x| parameters.
+            || ast.nodes[k].type === 'parameters' || ast.nodes[k].type === 'closure_parameters';
         if (!isParamList && !(bareArrow && ast.nodes[k].type === 'identifier'))
             continue;
         const collect = (n) => {
@@ -32,7 +44,7 @@ function defUseOf(ast, cfg, fn, source) {
                 collect(c);
         };
         collect(k);
-        if (isParamList)
+        if (isParamList && !isGo)
             break;
     }
     const defs = new Map();
@@ -47,6 +59,21 @@ function defUseOf(ast, cfg, fn, source) {
     for (const b of cfg.blocks)
         for (const s of b.stmts)
             stmtSet.add(s);
+    // @implements A-SPEC-522.1 — walk a Rust PATTERN: lowercase-initial identifiers bind (defs),
+    // capitalized ones are constructors/types (skipped). Everything else recurses.
+    const walkRustPattern = (n, stmt) => {
+        const ty = ast.nodes[n].type;
+        if (ty === 'identifier') {
+            const t = text(n);
+            if (/^[a-z_]/.test(t) && t !== '_')
+                add(defs, stmt, t);
+            return;
+        }
+        if (ty.includes('literal') || ty === 'type_identifier')
+            return;
+        for (const c of kids.of(n))
+            walkRustPattern(c, stmt);
+    };
     const classify = (stmt) => {
         const walk = (n, defCtx) => {
             const ty = ast.nodes[n].type;
@@ -54,7 +81,7 @@ function defUseOf(ast, cfg, fn, source) {
                 return; // nested function boundary
             if (n !== stmt && stmtSet.has(n))
                 return; // nested statements are their own rows
-            if (ty === 'type_annotation' || ty === 'type_arguments' || ty === 'comment')
+            if (ty === 'type_annotation' || ty === 'type_arguments' || ty.includes('comment'))
                 return;
             if (ty === 'identifier' || ty === 'shorthand_property_identifier_pattern') {
                 if (defCtx)
@@ -65,7 +92,196 @@ function defUseOf(ast, cfg, fn, source) {
             }
             if (ty === 'property_identifier' || ty === 'statement_identifier' || ty === 'type_identifier')
                 return;
+            // @implements A-SPEC-519.1 — Go: a selector's field, a package qualifier and a label are
+            // names in other namespaces, never local value reads.
+            if (ty === 'field_identifier' || ty === 'package_identifier' || ty === 'label_name')
+                return;
             switch (ty) {
+                // @implements A-SPEC-522.1 — Rust's binding shapes. Pattern identifiers bind by the
+                // LOWERCASE-INITIAL convention (rustc warns on violations): `Some(x)` binds x, skips the
+                // constructor Some — a documented heuristic, not a guess about arbitrary code.
+                case 'let_declaration': {
+                    const named = kids.of(n).filter((c) => ast.nodes[c].named);
+                    if (named[0] !== undefined)
+                        walkRustPattern(named[0], stmt);
+                    for (const r of named.slice(1))
+                        walk(r, false);
+                    return;
+                }
+                case 'compound_assignment_expr': {
+                    const [lhs, ...rest] = kids.of(n).filter((c) => ast.nodes[c].named);
+                    if (lhs !== undefined && ast.nodes[lhs].type === 'identifier') {
+                        add(defs, stmt, text(lhs));
+                        add(uses, stmt, text(lhs));
+                    }
+                    else if (lhs !== undefined)
+                        walk(lhs, false);
+                    for (const r of rest)
+                        walk(r, false);
+                    return;
+                }
+                case 'for_expression': {
+                    // `for PAT in ITER { .. }` — the pattern binds fresh; iterable is a use.
+                    const named = kids.of(n).filter((c) => ast.nodes[c].named);
+                    if (named[0] !== undefined)
+                        walkRustPattern(named[0], stmt);
+                    for (const r of named.slice(1))
+                        walk(r, false);
+                    return;
+                }
+                case 'let_condition': {
+                    // `while let Some(x) = e` / `if let ...` — pattern binds at the header point.
+                    const named = kids.of(n).filter((c) => ast.nodes[c].named);
+                    if (named[0] !== undefined)
+                        walkRustPattern(named[0], stmt);
+                    for (const r of named.slice(1))
+                        walk(r, false);
+                    return;
+                }
+                case 'scoped_identifier': {
+                    // a::b::c — path segments are module/type names, not local reads.
+                    return;
+                }
+                // @implements A-SPEC-520.1 — Java's shapes. A field's name and a method's name are plain
+                // `identifier` nodes in this grammar, so an unguarded walk would read `this.x = x` as TWO
+                // uses of x and every call as a use of its method name — with a same-named local, that is
+                // a fabricated reaching edge, not just noise.
+                // @implements A-SPEC-521.1 — C#: the LAST named child of a member access is the member's
+                // NAME (`this` is unnamed, so `this.x` has exactly one — the name). Walking it would read
+                // `this.x = x` as two uses of x. Delegates held in FIELDS lose their use through this
+                // (declared); a bare local delegate call (`a()`) keeps its use — the callee is walked.
+                case 'member_access_expression': {
+                    const named = kids.of(n).filter((c) => ast.nodes[c].named);
+                    for (let ix = 0; ix < named.length - 1; ix++)
+                        walk(named[ix], false);
+                    return;
+                }
+                case 'field_access': {
+                    const named = kids.of(n).filter((c) => ast.nodes[c].named);
+                    if (named.length > 0)
+                        walk(named[0], false); // the object; the field name is skipped
+                    return;
+                }
+                case 'method_invocation': {
+                    const named = kids.of(n).filter((c) => ast.nodes[c].named);
+                    const argsAt = named.findIndex((c) => ast.nodes[c].type === 'argument_list');
+                    named.forEach((c, ix) => {
+                        if (ix === (argsAt > 0 ? argsAt - 1 : -1) && ast.nodes[c].type === 'identifier')
+                            return; // the name
+                        if (ast.nodes[c].type === 'type_arguments')
+                            return;
+                        walk(c, false);
+                    });
+                    return;
+                }
+                case 'enhanced_for_statement':
+                case 'foreach_statement': {
+                    // `for (T s : xs)` — the binding is a def; the iterable and body-side reads are uses.
+                    const named = kids.of(n).filter((c) => ast.nodes[c].named);
+                    for (const c of named) {
+                        if (ast.nodes[c].type === 'identifier')
+                            add(defs, stmt, text(c));
+                        else
+                            walk(c, false);
+                    }
+                    return;
+                }
+                case 'resource': {
+                    // try-with-resources: `var r = open()` — r defs at the resource point, the init is a use.
+                    for (const c of kids.of(n)) {
+                        if (ast.nodes[c].type === 'identifier')
+                            add(defs, stmt, text(c));
+                        else
+                            walk(c, false);
+                    }
+                    return;
+                }
+                // @implements A-SPEC-519.1 — Go's binding shapes, written from the probed grammar.
+                case 'short_var_declaration': {
+                    // `a, b := e1, e2` — every LHS identifier is a def; the RHS list is uses.
+                    const named = kids.of(n).filter((c) => ast.nodes[c].named);
+                    if (named[0] !== undefined)
+                        walk(named[0], true);
+                    for (const r of named.slice(1))
+                        walk(r, false);
+                    return;
+                }
+                case 'assignment_statement': {
+                    // `x = e` defs x; `x += e` defs AND uses it. No fields survive persistence, so the
+                    // operator is read from the unnamed token between the two expression_lists.
+                    const all = kids.of(n);
+                    const named = all.filter((c) => ast.nodes[c].named);
+                    const op = all.find((c) => !ast.nodes[c].named && text(c).endsWith('='));
+                    const compound = op !== undefined && text(op) !== '=';
+                    const lhs = named[0];
+                    if (lhs !== undefined) {
+                        for (const el of ast.nodes[lhs].type === 'expression_list' ? kids.of(lhs).filter((c) => ast.nodes[c].named) : [lhs]) {
+                            if (ast.nodes[el].type === 'identifier') {
+                                add(defs, stmt, text(el));
+                                if (compound)
+                                    add(uses, stmt, text(el));
+                            }
+                            else
+                                walk(el, false); // a.b / a[i] mutation: uses only
+                        }
+                    }
+                    for (const r of named.slice(1))
+                        walk(r, false);
+                    return;
+                }
+                case 'var_spec':
+                case 'const_spec': {
+                    // `var x, y T = e1, e2` — identifier children are defs, the value list is uses.
+                    for (const c of kids.of(n)) {
+                        if (ast.nodes[c].type === 'identifier')
+                            add(defs, stmt, text(c));
+                        else
+                            walk(c, false);
+                    }
+                    return;
+                }
+                case 'inc_statement':
+                case 'dec_statement': {
+                    const arg = kids.of(n).find((c) => ast.nodes[c].named);
+                    if (arg !== undefined && ast.nodes[arg].type === 'identifier') {
+                        add(defs, stmt, text(arg));
+                        add(uses, stmt, text(arg));
+                    }
+                    else if (arg !== undefined)
+                        walk(arg, false);
+                    return;
+                }
+                case 'range_clause':
+                case 'receive_statement': {
+                    // `for i, v := range xs` / `case v := <-ch` — LHS binds, RHS is read. With `=` instead
+                    // of `:=` the LHS identifiers are still (re)defined; the same treatment holds.
+                    const named = kids.of(n).filter((c) => ast.nodes[c].named);
+                    if (named.length >= 2) {
+                        walk(named[0], true);
+                        for (const r of named.slice(1))
+                            walk(r, false);
+                    }
+                    else {
+                        for (const r of named)
+                            walk(r, false); // bare `for range xs` / `<-ch`
+                    }
+                    return;
+                }
+                case 'type_switch_statement': {
+                    // `switch v := x.(type)` — v defs at the header; everything else is uses.
+                    const named = kids.of(n).filter((c) => ast.nodes[c].named);
+                    const hasBind = kids.of(n).some((c) => !ast.nodes[c].named && text(c) === ':=');
+                    if (hasBind && named[0] !== undefined && ast.nodes[named[0]].type === 'expression_list') {
+                        walk(named[0], true);
+                        for (const r of named.slice(1))
+                            walk(r, false);
+                    }
+                    else {
+                        for (const r of named)
+                            walk(r, false);
+                    }
+                    return;
+                }
                 // @implements A-SPEC-510.7 — Python's assignment shapes.
                 case 'assignment': {
                     const named = kids.of(n).filter((c) => ast.nodes[c].named);
@@ -187,13 +403,69 @@ function defUseOf(ast, cfg, fn, source) {
     };
     for (const s of stmtSet)
         classify(s);
+    // @implements A-SPEC-522.1 — Rust match patterns bind at the MATCH HEADER point (the same
+    // posture as C#'s declaration pattern, for the same measured reason: a def on the point that
+    // uses it can never reach). Guards (`n if g(n)`) read at the header too.
+    if (ast.lang === 'rust') {
+        ast.nodes.forEach((n, i) => {
+            if (n.type !== 'match_expression' || !stmtSet.has(i))
+                return;
+            const mb = kids.of(i).find((k) => ast.nodes[k].type === 'match_block');
+            for (const arm of mb === undefined ? [] : kids.of(mb)) {
+                if (ast.nodes[arm].type !== 'match_arm')
+                    continue;
+                const pat = kids.of(arm).find((k) => ast.nodes[k].type === 'match_pattern');
+                if (pat !== undefined) {
+                    walkRustPattern(pat, i);
+                    // a guard inside the pattern (`n if g(n)`) reads its names at dispatch time
+                    for (const g of kids.of(pat)) {
+                        if (ast.nodes[g].type !== 'match_pattern' && ast.nodes[g].named) {
+                            const collect = (m) => {
+                                if (ast.nodes[m].type === 'identifier' && /^[a-z_]/.test(text(m)))
+                                    add(uses, i, text(m));
+                                for (const c of kids.of(m))
+                                    collect(c);
+                            };
+                            collect(g);
+                        }
+                    }
+                }
+            }
+        });
+    }
+    // @implements A-SPEC-521.1 — a C# declaration pattern (`case string f:`) binds at the SWITCH
+    // HEADER point, the same posture as Go's type-switch binding. Attaching it to the section's
+    // first statement was the first design and measurably wrong: reaching definitions read a use
+    // against the statement's IN set, so a def on the same point can never reach `case string f:
+    // Use(f);` — and that first statement usually IS the use. (Design corrected mid-slice, re-sealed.)
+    ast.nodes.forEach((n, i) => {
+        if (n.type !== 'switch_section')
+            return;
+        const pat = kids.of(i).find((k) => ast.nodes[k].type === 'declaration_pattern');
+        if (pat === undefined)
+            return;
+        const bind = kids.of(pat).filter((k) => ast.nodes[k].named).at(-1);
+        if (bind === undefined || ast.nodes[bind].type !== 'identifier')
+            return;
+        let sw = ast.nodes[i].parent; // switch_body
+        while (sw >= 0 && ast.nodes[sw].type !== 'switch_statement')
+            sw = ast.nodes[sw].parent;
+        if (sw >= 0 && stmtSet.has(sw))
+            add(defs, sw, text(bind));
+    });
     // catch parameters: a def at the head of the handler body's first statement.
     ast.nodes.forEach((n, i) => {
         if (n.type !== 'catch_clause')
             return;
         const named = kids.of(i).filter((k) => ast.nodes[k].named);
-        const param = named.find((k) => ast.nodes[k].type === 'identifier');
-        const block = named.find((k) => ast.nodes[k].type === 'statement_block');
+        // @implements A-SPEC-520.1 — Java wraps the parameter in catch_formal_parameter; TS puts the
+        // identifier directly under the clause. One lookup serves both.
+        const formal = named.find((k) => ast.nodes[k].type === 'catch_formal_parameter');
+        const param = named.find((k) => ast.nodes[k].type === 'identifier')
+            ?? (formal !== undefined
+                ? kids.of(formal).find((k) => ast.nodes[k].type === 'identifier')
+                : undefined);
+        const block = named.find((k) => ['statement_block', 'block'].includes(ast.nodes[k].type));
         if (param === undefined || block === undefined)
             return;
         const first = kids.of(block).find((k) => stmtSet.has(k));

package/dist/holmes/cpg/foundation/language-matrix.js

@@ -43,9 +43,16 @@ function relationsCell(ext) {
     if (resolved.length === 0)
         return { support: 'none', basis: 'nothing reaches the graph' };
     // A-SPEC-286: the claim is made in the graph-resolved column, never the scanner's raw output.
-    return resolved.length >= 3
+    // @implements A-SPEC-517.1 — the MISSING list is derived from the same authority as the present
+    // list. It used to be the literal `(no imports/inherits)` next to a derived present-list, so when
+    // REQ-511 widened graphResolved the doc read "calls, inherits (no imports/inherits)" — inherits
+    // present and absent in one breath. The `>= 3` magic number was the same sin (a hardcoded "the
+    // full set has three kinds"); judging by set difference keeps both halves true if
+    // EXTRACTABLE_RELATIONS ever widens.
+    const missing = language_capability_1.EXTRACTABLE_RELATIONS.filter((r) => !resolved.includes(r));
+    return missing.length === 0
         ? { support: 'full', basis: `graph edges: ${resolved.join(', ')}` }
-        : { support: 'partial', basis: `graph edges: ${resolved.join(', ')} (no imports/inherits)` };
+        : { support: 'partial', basis: `graph edges: ${resolved.join(', ')} (no ${missing.join('/')})` };
 }
 function astCell(astLang) {
     // The TS grammar family covers tsx/js too — AST_LANGUAGES is the authority on which wasm applies.

package/grammars/manifest.json

@@ -18,6 +18,36 @@
       "package": "tree-sitter-python",
       "packageVersion": "0.25.0",
       "sha256": "16108b50df4ee9a30168794252ab55e7c93bfc5765d7fa0aa3e335752c515f47"
+    },
+    {
+      "file": "tree-sitter-go.wasm",
+      "package": "tree-sitter-go",
+      "packageVersion": "0.25.0",
+      "sha256": "9504573f352b20be7f2f1911754d710622aedc15afff16d5ed8fb5645681aee7"
+    },
+    {
+      "file": "tree-sitter-rust.wasm",
+      "package": "tree-sitter-rust",
+      "packageVersion": "0.24.0",
+      "sha256": "f65f354215611fd94ad34134b3427eb3d58cbb745df7b6509ba722184db73d57"
+    },
+    {
+      "file": "tree-sitter-java.wasm",
+      "package": "tree-sitter-java",
+      "packageVersion": "0.23.5",
+      "sha256": "4fdeac4ca6ca089f06c6f7e562abcac1733cd465728cc7031ebb73c2019122c4"
+    },
+    {
+      "file": "tree-sitter-c_sharp.wasm",
+      "package": "tree-sitter-c-sharp",
+      "packageVersion": "0.23.5",
+      "sha256": "6f69e1cae44e1c32c1eccc170dc5a9778fb94ff716f71113fe1f8c4299aa2f40"
+    },
+    {
+      "file": "tree-sitter-cpp.wasm",
+      "package": "tree-sitter-cpp",
+      "packageVersion": "0.23.4",
+      "sha256": "174eb0deb75b2ec7881bcacda9f995648d8e683956e5c2267e69ab6dc503fcbf"
     }
   ]
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "@implements A-SPEC-209",
   "name": "@holmes-lab/holmes-kit",
-  "version": "0.4.1",
+  "version": "0.6.0",
   "description": "Holmes-Kit — deterministic Agentic Software Engineering (ASE) harness with causal traceability (spec chain + D-CPG + RTM + phase guardrail)",
   "main": "dist/holmes/mcp/server.js",
   "types": "dist/holmes/mcp/server.d.ts",