@optave/codegraph 3.11.2 → 3.12.0

package/src/domain/graph/builder/call-resolver.ts

@@ -23,6 +23,28 @@ export interface CallNodeLookup {
 
 export const RECEIVER_KINDS = new Set(['class', 'struct', 'interface', 'type', 'module']);
 
+/**
+ * Languages where bare `foo()` calls inside a class method are lexically scoped
+ * to the module, not the class — there is no implicit this/class binding.
+ * For these languages, the same-class fallback must not run for bare (no-receiver)
+ * calls that found no exact same-file match.
+ */
+const MODULE_SCOPED_BARE_CALL_EXTENSIONS = new Set([
+  '.js',
+  '.mjs',
+  '.cjs',
+  '.jsx',
+  '.ts',
+  '.tsx',
+  '.mts',
+  '.cts',
+]);
+
+export function isModuleScopedLanguage(relPath: string): boolean {
+  const ext = relPath.slice(relPath.lastIndexOf('.'));
+  return MODULE_SCOPED_BARE_CALL_EXTENSIONS.has(ext);
+}
+
 // ── Shared resolution functions ──────────────────────────────────────────
 
 export function findCaller(
@@ -36,8 +58,9 @@ export function findCaller(
   }>,
   relPath: string,
   fileNodeRow: { id: number },
-): { id: number } {
+): { id: number; callerName: string | null } {
   let caller: { id: number } | null = null;
+  let callerName: string | null = null;
   let callerSpan = Infinity;
   for (const def of definitions) {
     if (def.line <= call.line) {
@@ -48,13 +71,14 @@ export function findCaller(
           const row = lookup.nodeId(def.name, def.kind, relPath, def.line);
           if (row) {
             caller = row;
+            callerName = def.name;
             callerSpan = span;
           }
         }
       }
     }
   }
-  return caller ?? fileNodeRow;
+  return { ...(caller ?? fileNodeRow), callerName };
 }
 
 export function resolveByMethodOrGlobal(
@@ -62,17 +86,101 @@ export function resolveByMethodOrGlobal(
   call: { name: string; receiver?: string | null },
   relPath: string,
   typeMap: Map<string, unknown>,
+  callerName?: string | null,
 ): ReadonlyArray<{ id: number; file: string }> {
   if (call.receiver) {
-    const typeEntry = typeMap.get(call.receiver);
-    const typeName = typeEntry
+    // Strip "this." so `this.repo.method()` resolves via typeMap["repo"]
+    // (or the "this.repo" key seeded directly by the TSC property-declaration enricher).
+    const effectiveReceiver = call.receiver.startsWith('this.')
+      ? call.receiver.slice('this.'.length)
+      : call.receiver;
+    // For this.prop receivers, also try the class-scoped key (ClassName.prop) seeded by
+    // handlePropWriteTypeMap — prevents false edges when multiple classes define the same
+    // property name (issue #1323).
+    let typeEntry =
+      typeMap.get(effectiveReceiver) ??
+      typeMap.get(call.receiver) ??
+      // Phase 8.3f: callee-scoped rest-param key (`callee::restName`) to avoid
+      // same-name rest-binding collision across functions in the same file (#1358).
+      (callerName ? typeMap.get(`${callerName}::${effectiveReceiver}`) : undefined);
+    if (!typeEntry && call.receiver.startsWith('this.') && callerName) {
+      const dotIdx = callerName.lastIndexOf('.');
+      if (dotIdx > -1) {
+        const callerClass = callerName.slice(0, dotIdx);
+        typeEntry = typeMap.get(`${callerClass}.${effectiveReceiver}`);
+      }
+    }
+    let typeName = typeEntry
       ? typeof typeEntry === 'string'
         ? typeEntry
         : (typeEntry as { type?: string }).type
       : null;
+
+    // Belt-and-suspenders fallback for inline new-expression receivers that
+    // extractReceiverName did not normalise (e.g. raw text leaked from an
+    // unhandled AST node type).  extractReceiverName already handles the common
+    // `new_expression` / `parenthesized_expression(new_expression)` shapes by
+    // returning the constructor name directly, so this branch is exercised only
+    // by future node types or constructs that fall through to the raw-text path.
+    // The uppercase-initial restriction ([A-Z_$]) is a heuristic to distinguish
+    // constructors (PascalCase) from regular functions and avoids false positives
+    // on `(new xmlParser()).parse()` style calls.
+    if (!typeName && call.receiver) {
+      const m = /^\(?\s*new\s+([A-Z_$][A-Za-z0-9_$]*)/.exec(call.receiver);
+      if (m?.[1]) typeName = m[1];
+    }
+
     if (typeName) {
-      const typed = lookup.byName(`${typeName}.${call.name}`).filter((n) => n.kind === 'method');
+      const typed = lookup
+        .byName(`${typeName}.${call.name}`)
+        .filter((n) => n.kind === 'method' && computeConfidence(relPath, n.file, null) >= 0.5);
       if (typed.length > 0) return typed;
+
+      // Prototype alias: `Foo.prototype.bar = identifier` seeds typeMap['Foo.bar'] = { type: identifier }.
+      // Checked after the symbol-DB lookup so an actual method definition always wins.
+      const protoEntry = typeMap.get(`${typeName}.${call.name}`);
+      const protoTarget = protoEntry
+        ? typeof protoEntry === 'string'
+          ? protoEntry
+          : (protoEntry as { type?: string }).type
+        : null;
+      if (protoTarget) {
+        const resolved = lookup
+          .byName(protoTarget)
+          .filter((t) => computeConfidence(relPath, t.file, null) >= 0.5);
+        if (resolved.length > 0) return resolved;
+      }
+    }
+
+    // Direct qualified method lookup: ClassName.staticMethod() or ClassName.instanceMethod()
+    // when the receiver is a class name with no typeMap entry. Handles static method calls
+    // like `C6.staticMethod()` or `D.d()` where the receiver IS the class.
+    // Matches both 'method' and 'function' kinds to cover field-initializer synthetic defs.
+    if (!typeName) {
+      const qualifiedName = `${effectiveReceiver}.${call.name}`;
+      const direct = lookup
+        .byName(qualifiedName)
+        .filter(
+          (n) =>
+            (n.kind === 'method' || n.kind === 'function') &&
+            computeConfidence(relPath, n.file, null) >= 0.5,
+        );
+      if (direct.length > 0) return direct;
+    }
+
+    // Phase 8.3d: composite pts key — `obj.prop = fn` seeds typeMap['obj.prop'] = { type: 'fn' }.
+    // When a call site references `obj.prop` as a callback, resolve directly to the target fn.
+    const compositeEntry = typeMap.get(`${call.receiver}.${call.name}`);
+    const ptsTarget = compositeEntry
+      ? typeof compositeEntry === 'string'
+        ? compositeEntry
+        : (compositeEntry as { type?: string }).type
+      : null;
+    if (ptsTarget) {
+      const resolved = lookup
+        .byName(ptsTarget)
+        .filter((t) => computeConfidence(relPath, t.file, null) >= 0.5);
+      if (resolved.length > 0) return resolved;
     }
   }
   if (
@@ -81,7 +189,68 @@ export function resolveByMethodOrGlobal(
     call.receiver === 'self' ||
     call.receiver === 'super'
   ) {
-    return lookup.byName(call.name).filter((t) => computeConfidence(relPath, t.file, null) >= 0.5);
+    // Phase 8.3f: accessor this-dispatch via Object.defineProperty.
+    // When a plain function (no class prefix) is registered as a get/set accessor for `obj`
+    // via Object.defineProperty, typeMap seeds 'callerName:this' = 'obj'.
+    // We then resolve this.method() → typeMap['obj.method'] → the concrete definition.
+    // This runs before the broad exact-name lookup to avoid false positives from
+    // unrelated same-file definitions.
+    if (call.receiver === 'this' && callerName && !callerName.includes('.')) {
+      const accessorThisEntry = typeMap.get(`${callerName}:this`);
+      const objName = accessorThisEntry
+        ? typeof accessorThisEntry === 'string'
+          ? accessorThisEntry
+          : (accessorThisEntry as { type?: string }).type
+        : null;
+      if (objName) {
+        const objMethodEntry = typeMap.get(`${objName}.${call.name}`);
+        const targetFn = objMethodEntry
+          ? typeof objMethodEntry === 'string'
+            ? objMethodEntry
+            : (objMethodEntry as { type?: string }).type
+          : null;
+        if (targetFn) {
+          const resolved = lookup
+            .byName(targetFn)
+            .filter((t) => computeConfidence(relPath, t.file, null) >= 0.5);
+          if (resolved.length > 0) return resolved;
+        }
+      }
+    }
+
+    const exact = lookup
+      .byName(call.name)
+      .filter((t) => computeConfidence(relPath, t.file, null) >= 0.5);
+    if (exact.length > 0) return exact;
+
+    // Try same-class method lookup via callerName.
+    // e.g. `this.area()` inside `Shape.describe` → try `Shape.area`.
+    // Also covers no-receiver calls inside class methods, e.g. `IsValidEmail(x)` inside
+    // `Validators.ValidateUser` → try `Validators.IsValidEmail` (C#/Java static siblings).
+    // This seeds the initial edge that runChaPostPass later expands to subclass overrides.
+    //
+    // For JS/TS, bare (no-receiver) calls are module-scoped — there is no implicit class
+    // binding. Skip the same-class fallback for bare calls in those languages to prevent
+    // false positives (e.g. `flush()` inside `Processor.run` must not resolve to
+    // `Processor.flush`). this.method() calls are unaffected: they still reach the fallback
+    // because `call.receiver === 'this'` is truthy, not a bare call.
+    const isBareCall = !call.receiver;
+    if (callerName && !(isBareCall && isModuleScopedLanguage(relPath))) {
+      const dotIdx = callerName.lastIndexOf('.');
+      if (dotIdx > -1) {
+        // Extract only the segment immediately before the method name so that
+        // 'Namespace.ClassName.method' yields 'ClassName', not 'Namespace.ClassName'.
+        // Symbols are stored under their bare class name, not their qualified path.
+        const prevDot = callerName.lastIndexOf('.', dotIdx - 1);
+        const callerClass = callerName.slice(prevDot + 1, dotIdx);
+        const qualifiedName = `${callerClass}.${call.name}`;
+        const sameClass = lookup
+          .byName(qualifiedName)
+          .filter((t) => t.kind === 'method' && computeConfidence(relPath, t.file, null) >= 0.5);
+        if (sameClass.length > 0) return sameClass;
+      }
+    }
+    return exact; // empty
   }
   return [];
 }
@@ -92,6 +261,7 @@ export function resolveCallTargets(
   relPath: string,
   importedNames: Map<string, string>,
   typeMap: Map<string, unknown>,
+  callerName?: string | null,
 ): { targets: Array<{ id: number; file: string }>; importedFrom: string | undefined } {
   const importedFrom = importedNames.get(call.name);
   let targets: ReadonlyArray<{ id: number; file: string }> | undefined;
@@ -109,7 +279,7 @@ export function resolveCallTargets(
   if (!targets || targets.length === 0) {
     targets = lookup.byNameAndFile(call.name, relPath);
     if (targets.length === 0) {
-      targets = resolveByMethodOrGlobal(lookup, call, relPath, typeMap);
+      targets = resolveByMethodOrGlobal(lookup, call, relPath, typeMap, callerName);
     }
   }
 

package/src/domain/graph/builder/cha.ts

@@ -0,0 +1,175 @@
+/**
+ * Phase 8.5: Class Hierarchy Analysis (CHA) + Rapid Type Analysis (RTA)
+ *
+ * CHA resolves virtual/interface method dispatch to all known concrete
+ * implementations.  RTA refines the CHA set by filtering out types that are
+ * never instantiated in the program (no `new X()` anywhere in the codebase).
+ *
+ * Used by:
+ *   - buildFileCallEdges (WASM/JS path) — inline during per-file edge building
+ *   - buildChaPostPass (native path)    — JS post-pass on top of native edges
+ */
+
+import type { ExtractorOutput } from '../../../types.js';
+import type { CallNodeLookup } from './call-resolver.js';
+
+// ── CHA context ──────────────────────────────────────────────────────────────
+
+export interface ChaContext {
+  /** interface/class name → concrete classes that implement or extend it */
+  readonly implementors: ReadonlyMap<string, readonly string[]>;
+  /** class name → direct parent class name (from `extends`) */
+  readonly parents: ReadonlyMap<string, string>;
+  /** RTA: class names that appear in `new X()` anywhere in the project */
+  readonly instantiatedTypes: ReadonlySet<string>;
+}
+
+export const EMPTY_CHA_CONTEXT: ChaContext = {
+  implementors: new Map(),
+  parents: new Map(),
+  instantiatedTypes: new Set(),
+};
+
+/**
+ * Build the CHA context from all parsed file symbols.
+ *
+ * Must be called AFTER cross-file return-type propagation so that typeMap
+ * confidence values reflect propagated types (used for RTA seeding).
+ */
+export function buildChaContext(fileSymbols: ReadonlyMap<string, ExtractorOutput>): ChaContext {
+  const implementors = new Map<string, string[]>();
+  const parents = new Map<string, string>();
+  const instantiatedTypes = new Set<string>();
+
+  for (const symbols of fileSymbols.values()) {
+    for (const cls of symbols.classes) {
+      if (cls.implements) {
+        let list = implementors.get(cls.implements);
+        if (!list) {
+          list = [];
+          implementors.set(cls.implements, list);
+        }
+        if (!list.includes(cls.name)) list.push(cls.name);
+      }
+      if (cls.extends) {
+        // child → parent (for this/super hierarchy walking)
+        if (!parents.has(cls.name)) parents.set(cls.name, cls.extends);
+        // parent → children (for CHA dispatch expansion via extends)
+        let list = implementors.get(cls.extends);
+        if (!list) {
+          list = [];
+          implementors.set(cls.extends, list);
+        }
+        if (!list.includes(cls.name)) list.push(cls.name);
+      }
+    }
+
+    // RTA: Phase 8.5 dedicated newExpressions list (all `new X()` in the file)
+    if (symbols.newExpressions) {
+      for (const typeName of symbols.newExpressions) {
+        instantiatedTypes.add(typeName);
+      }
+    }
+    // RTA fallback: constructor-confidence typeMap entries (confidence >= 0.9)
+    // covers codebases that haven't been re-parsed since Phase 8.5 was added.
+    if (symbols.typeMap instanceof Map) {
+      for (const entry of symbols.typeMap.values()) {
+        if (typeof entry !== 'string' && entry.confidence >= 0.9) {
+          instantiatedTypes.add(entry.type);
+        }
+      }
+    }
+  }
+
+  return { implementors, parents, instantiatedTypes };
+}
+
+// ── this / self / super resolution ──────────────────────────────────────────
+
+/**
+ * Resolve `this.method()`, `self.method()`, or `super.method()` through the
+ * class hierarchy of the calling method.
+ *
+ * callerName must be a qualified method name ("ClassName.callerFn") for the
+ * class context to be determinable.  Returns [] for plain functions.
+ *
+ * For `super`, resolution starts from the parent of the caller's class.
+ * For `this`/`self`, resolution starts from the caller's own class and walks
+ * up the inheritance chain (supporting inherited method lookup).
+ */
+export function resolveThisDispatch(
+  methodName: string,
+  callerName: string | null,
+  receiver: 'this' | 'self' | 'super',
+  chaCtx: ChaContext,
+  lookup: CallNodeLookup,
+): ReadonlyArray<{ id: number; file: string }> {
+  if (!callerName) return [];
+  const dotIdx = callerName.indexOf('.');
+  if (dotIdx === -1) return [];
+
+  const callerClass = callerName.slice(0, dotIdx);
+  const startClass = receiver === 'super' ? chaCtx.parents.get(callerClass) : callerClass;
+  if (!startClass) return [];
+
+  // Walk up the hierarchy; the visited set guards against cycles in malformed data.
+  let current: string | undefined = startClass;
+  const visited = new Set<string>();
+  while (current && !visited.has(current)) {
+    visited.add(current);
+    const qualified = `${current}.${methodName}`;
+    const found = lookup.byName(qualified).filter((n) => n.kind === 'method');
+    if (found.length > 0) return found;
+    current = chaCtx.parents.get(current);
+  }
+  return [];
+}
+
+// ── CHA dispatch expansion ───────────────────────────────────────────────────
+
+/**
+ * CHA + RTA: given a receiver type (class or interface), return all concrete
+ * method implementations reachable via the class hierarchy.
+ *
+ * Only returns methods on types that are actually instantiated somewhere in
+ * the project (RTA filter).  Returns [] when no concrete instantiated type
+ * overrides the given method.
+ *
+ * BFS over the implementors map handles multi-level hierarchies (e.g.
+ * IFoo → AbstractFoo → ConcreteFoo) so that abstract intermediate classes
+ * are transparently skipped while their concrete subclasses are still reached.
+ */
+export function resolveChaTargets(
+  typeName: string,
+  methodName: string,
+  chaCtx: ChaContext,
+  lookup: CallNodeLookup,
+): ReadonlyArray<{ id: number; file: string }> {
+  const results: Array<{ id: number; file: string }> = [];
+
+  const queue: string[] = [typeName];
+  const visited = new Set<string>();
+  visited.add(typeName);
+
+  while (queue.length > 0) {
+    const current = queue.shift()!;
+    const children = chaCtx.implementors.get(current);
+    if (!children?.length) continue;
+
+    for (const cls of children) {
+      if (visited.has(cls)) continue;
+      visited.add(cls);
+
+      if (chaCtx.instantiatedTypes.has(cls)) {
+        const qualified = `${cls}.${methodName}`;
+        const found = lookup.byName(qualified).filter((n) => n.kind === 'method');
+        results.push(...found);
+      }
+
+      // Traverse even non-instantiated classes — they may have instantiated subclasses.
+      queue.push(cls);
+    }
+  }
+
+  return results;
+}

package/src/domain/graph/builder/context.ts

@@ -68,6 +68,8 @@ export class PipelineContext {
   batchResolved!: Map<string, string> | null;
   reexportMap!: Map<string, unknown[]>;
   barrelOnlyFiles!: Set<string>;
+  /** Phase 8.4: cache for resolveBarrelExport results keyed as "barrelPath|symbolName". */
+  barrelExportCache: Map<string, string | null> = new Map();
 
   // ── Node lookup (set by insertNodes / buildEdges stages) ───────────
   nodesByName!: Map<string, NodeRow[]>;
@@ -88,6 +90,7 @@ export class PipelineContext {
     edgeKind: string;
     confidence: number;
     dynamic: number;
+    technique: string | null;
   }> = [];
 
   // ── Misc state ─────────────────────────────────────────────────────

package/src/domain/graph/builder/helpers.ts

@@ -7,7 +7,7 @@ import { createHash } from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 import { purgeFilesData } from '../../../db/index.js';
-import { warn } from '../../../infrastructure/logger.js';
+import { debug, warn } from '../../../infrastructure/logger.js';
 import { EXTENSIONS, IGNORE_DIRS, normalizePath } from '../../../shared/constants.js';
 import { compileGlobs, matchesAny } from '../../../shared/globs.js';
 import type {
@@ -313,9 +313,9 @@ function getEdgeStmt(db: BetterSqlite3Database, chunkSize: number): SqliteStatem
   }
   let stmt = cache.get(chunkSize);
   if (!stmt) {
-    const ph = '(?,?,?,?,?)';
+    const ph = '(?,?,?,?,?,?)';
     stmt = db.prepare(
-      'INSERT INTO edges (source_id,target_id,kind,confidence,dynamic) VALUES ' +
+      'INSERT INTO edges (source_id,target_id,kind,confidence,dynamic,technique) VALUES ' +
         Array.from({ length: chunkSize }, () => ph).join(','),
     );
     cache.set(chunkSize, stmt);
@@ -344,7 +344,7 @@ export function batchInsertNodes(db: BetterSqlite3Database, rows: unknown[][]):
 
 /**
  * Batch-insert edge rows via multi-value INSERT statements.
- * Each row: [source_id, target_id, kind, confidence, dynamic]
+ * Each row: [source_id, target_id, kind, confidence, dynamic, technique]
  */
 export function batchInsertEdges(db: BetterSqlite3Database, rows: unknown[][]): void {
   if (!rows.length) return;
@@ -355,8 +355,178 @@ export function batchInsertEdges(db: BetterSqlite3Database, rows: unknown[][]):
     const vals: unknown[] = [];
     for (let j = i; j < end; j++) {
       const r = rows[j] as unknown[];
-      vals.push(r[0], r[1], r[2], r[3], r[4]);
+      vals.push(r[0], r[1], r[2], r[3], r[4], r[5] ?? null);
     }
     stmt.run(...vals);
   }
 }
+
+/**
+ * CHA (Class Hierarchy Analysis) post-pass.
+ *
+ * Expands virtual-dispatch call edges for class hierarchies and interface
+ * implementations already present in the DB:
+ *
+ *  1. Build implementors map: parent/interface → [child/implementing class] from
+ *     `extends` and `implements` edges.
+ *  2. Collect RTA evidence: class nodes that appear as `calls` targets (new X()).
+ *  3. Find all `calls` edges to qualified method nodes (name contains '.').
+ *  4. For each such call, expand to concrete overrides via the implementors map,
+ *     filtered by RTA when evidence exists.
+ *
+ * Used by both the native orchestrator post-pass and the WASM build-edges pass.
+ */
+export function runChaPostPass(db: BetterSqlite3Database): number {
+  const hasHierarchy = db
+    .prepare(`SELECT 1 FROM edges WHERE kind IN ('extends', 'implements') LIMIT 1`)
+    .get();
+  if (!hasHierarchy) return 0;
+
+  const hierarchyRows = db
+    .prepare(
+      `SELECT src.name AS child_name, tgt.name AS parent_name
+       FROM edges e
+       JOIN nodes src ON e.source_id = src.id
+       JOIN nodes tgt ON e.target_id = tgt.id
+       WHERE e.kind IN ('extends', 'implements')`,
+    )
+    .all() as Array<{ child_name: string; parent_name: string }>;
+
+  const implementorSets = new Map<string, Set<string>>();
+  for (const row of hierarchyRows) {
+    let set = implementorSets.get(row.parent_name);
+    if (!set) {
+      set = new Set<string>();
+      implementorSets.set(row.parent_name, set);
+    }
+    set.add(row.child_name);
+  }
+  if (implementorSets.size === 0) return 0;
+  // Convert to arrays for iteration compatibility with the rest of the function
+  const implementors = new Map([...implementorSets.entries()].map(([k, v]) => [k, [...v]]));
+
+  // RTA: collect class names instantiated via constructor calls (`new X()`).
+  let rtaRows = db
+    .prepare(
+      `SELECT DISTINCT tgt.name
+       FROM edges e
+       JOIN nodes tgt ON e.target_id = tgt.id
+       WHERE e.kind = 'calls' AND tgt.kind = 'class'`,
+    )
+    .all() as Array<{ name: string }>;
+  if (rtaRows.length === 0) {
+    // Fallback: some languages (e.g. TypeScript via WASM) record constructor calls as
+    // 'function' or 'constructor' kind rather than 'class'. Restrict to names that are
+    // actually known class names to avoid treating unrelated function calls like `logger()`
+    // as class-instantiation evidence.
+    // Include both parent/interface names AND implementor (child) names so that
+    // `new UserRepository()` (a child class) is correctly detected as RTA evidence.
+    const knownClassNames = [
+      ...new Set([
+        ...implementorSets.keys(),
+        ...[...implementorSets.values()].flatMap((s) => [...s]),
+      ]),
+    ];
+    if (knownClassNames.length > 0) {
+      // Chunk to stay within SQLite SQLITE_MAX_VARIABLE_NUMBER (999 in many builds).
+      const CHUNK = 999;
+      for (let i = 0; i < knownClassNames.length; i += CHUNK) {
+        const chunk = knownClassNames.slice(i, i + CHUNK);
+        const placeholders = chunk.map(() => '?').join(',');
+        const chunkRows = db
+          .prepare(
+            `SELECT DISTINCT tgt.name
+             FROM edges e
+             JOIN nodes tgt ON e.target_id = tgt.id
+             WHERE e.kind = 'calls' AND tgt.kind IN ('constructor', 'function')
+             AND tgt.name IN (${placeholders})`,
+          )
+          .all(...chunk) as Array<{ name: string }>;
+        rtaRows = rtaRows.concat(chunkRows);
+      }
+    }
+  }
+  const instantiated = new Set(rtaRows.map((r) => r.name));
+  const noRtaEvidence = instantiated.size === 0;
+  if (noRtaEvidence) {
+    debug('runChaPostPass: no constructor-call evidence — proceeding without RTA filter');
+  }
+
+  const callToMethods = db
+    .prepare(
+      `SELECT e.source_id, tgt.name AS method_name
+       FROM edges e
+       JOIN nodes tgt ON e.target_id = tgt.id
+       WHERE e.kind = 'calls' AND tgt.kind = 'method'
+       AND INSTR(tgt.name, '.') > 0`,
+    )
+    .all() as Array<{ source_id: number; method_name: string }>;
+
+  const seen = new Set<string>();
+  // Scope deduplication to only the source_ids we are about to expand, avoiding
+  // a full-table scan. CHA only inserts edges FROM callers that already call a
+  // qualified method (the source_ids in callToMethods), so we only need to
+  // check existing edges for those specific callers.
+  const callerIds = [...new Set(callToMethods.map((r) => r.source_id))];
+  if (callerIds.length > 0) {
+    // Chunk to stay within SQLite SQLITE_MAX_VARIABLE_NUMBER (999 in many builds).
+    const CHUNK = 999;
+    for (let i = 0; i < callerIds.length; i += CHUNK) {
+      const chunk = callerIds.slice(i, i + CHUNK);
+      const placeholders = chunk.map(() => '?').join(',');
+      const existingPairs = db
+        .prepare(
+          `SELECT source_id, target_id FROM edges WHERE kind = 'calls' AND source_id IN (${placeholders})`,
+        )
+        .all(...chunk) as Array<{ source_id: number; target_id: number }>;
+      for (const e of existingPairs) seen.add(`${e.source_id}|${e.target_id}`);
+    }
+  }
+
+  // No LIMIT: multiple files can define the same qualified name in a monorepo.
+  const findMethodStmt = db.prepare(`SELECT id FROM nodes WHERE name = ? AND kind = 'method'`);
+  const newEdges: Array<[number, number, string, number, number, string]> = [];
+
+  for (const { source_id, method_name } of callToMethods) {
+    const dotIdx = method_name.indexOf('.');
+    if (dotIdx === -1) continue;
+    const typeName = method_name.slice(0, dotIdx);
+    const methodSuffix = method_name.slice(dotIdx + 1);
+
+    // BFS over the implementors map — handles multi-level hierarchies where
+    // abstract/non-instantiated classes sit between the call-site type and
+    // the concrete leaf implementations (matches runPostNativeCha, issue #1311).
+    const bfsQueue: string[] = [typeName];
+    const bfsVisited = new Set<string>([typeName]);
+    while (bfsQueue.length > 0) {
+      const current = bfsQueue.shift()!;
+      const children = implementors.get(current);
+      if (!children?.length) continue;
+
+      for (const cls of children) {
+        if (bfsVisited.has(cls)) continue;
+        bfsVisited.add(cls);
+
+        if (noRtaEvidence || instantiated.has(cls)) {
+          const qualifiedName = `${cls}.${methodSuffix}`;
+          const methodNodes = findMethodStmt.all(qualifiedName) as Array<{ id: number }>;
+          for (const methodNode of methodNodes) {
+            const key = `${source_id}|${methodNode.id}`;
+            if (seen.has(key)) continue;
+            seen.add(key);
+            newEdges.push([source_id, methodNode.id, 'calls', 0.8, 0, 'cha']);
+          }
+        }
+
+        // Always traverse children — non-instantiated classes may have instantiated subclasses.
+        bfsQueue.push(cls);
+      }
+    }
+  }
+
+  if (newEdges.length > 0) {
+    db.transaction(() => batchInsertEdges(db, newEdges))();
+    debug(`runChaPostPass: inserted ${newEdges.length} CHA dispatch edge(s)`);
+  }
+  return newEdges.length;
+}