@optave/codegraph 3.12.0 → 3.15.0

package/src/domain/graph/builder/stages/native-orchestrator.ts

@@ -11,6 +11,7 @@
  * The orchestrator-selection strategy lives here so `pipeline.ts` stays a thin
  * top-level controller: detect changes, try native, fall back to JS stages.
  */
+import { execFileSync } from 'node:child_process';
 import path from 'node:path';
 import { performance } from 'node:perf_hooks';
 import {
@@ -24,12 +25,13 @@ import {
 import { debug, info, warn } from '../../../../infrastructure/logger.js';
 import { loadNative } from '../../../../infrastructure/native.js';
 import { semverCompare } from '../../../../infrastructure/update-check.js';
-import { normalizePath } from '../../../../shared/constants.js';
+import { normalizePath, TS_NATIVE_CONFIDENCE_FLOOR } from '../../../../shared/constants.js';
 import { toErrorMessage } from '../../../../shared/errors.js';
 import { CODEGRAPH_VERSION } from '../../../../shared/version.js';
 import type {
   BetterSqlite3Database,
   BuildResult,
+  DataflowResult,
   Definition,
   ExtractorOutput,
   SqliteStatement,
@@ -40,6 +42,7 @@ import {
   getInstalledWasmExtensions,
   NATIVE_SUPPORTED_EXTENSIONS,
   parseFilesWasmForBackfill,
+  patchDataflowResult,
 } from '../../../parser.js';
 import { computeConfidence } from '../../resolve.js';
 import type { CallNodeLookup } from '../call-resolver.js';
@@ -49,13 +52,14 @@ import type { PipelineContext } from '../context.js';
 import {
   batchInsertEdges,
   batchInsertNodes,
+  CHA_DISPATCH_PENALTY,
+  CHA_TYPED_DISPATCH_CONFIDENCE,
   collectFiles as collectFilesUtil,
   fileHash,
   fileStat,
   readFileSafe,
 } from '../helpers.js';
 import { NativeDbProxy } from '../native-db-proxy.js';
-import { CHA_DISPATCH_PENALTY } from './build-edges.js';
 import { closeNativeDb } from './native-db-lifecycle.js';
 
 // ── Native orchestrator types ──────────────────────────────────────────
@@ -293,6 +297,257 @@ async function runPostNativeStructure(
   return performance.now() - structureStart;
 }
 
+/**
+ * P6: Build dataflow_vertices and inter-procedural edges after the Rust
+ * orchestrator completes.
+ *
+ * The Rust pipeline writes flows_to/returns/mutates edges directly to the DB
+ * but never writes to dataflow_vertices or dataflow_summary. This pass re-runs
+ * the Rust dataflow visitor (via extractDataflowAnalysis — fast, no re-parse)
+ * to get the DataflowResult and calls buildDataflowVerticesFromMap.
+ *
+ * Languages for which Rust has no dataflow rules return null from
+ * extractDataflowAnalysis and are silently skipped here. A follow-up issue
+ * (#1614 adjacent) will add WASM fallback for those languages.
+ */
+async function runDataflowVertexPass(
+  ctx: PipelineContext,
+  changedFiles: string[] | undefined,
+): Promise<void> {
+  if (ctx.opts.dataflow === false) return;
+
+  const native = loadNative();
+  if (!native?.extractDataflowAnalysis) return;
+
+  // Determine which files to process: changed files for incremental, all for full builds.
+  let filesToProcess: string[];
+  if (changedFiles && changedFiles.length > 0) {
+    filesToProcess = changedFiles;
+  } else {
+    // Full build: scope to files that need vertex extraction rather than scanning every
+    // file in the project. Two categories:
+    //   (a) Non-native language files — NATIVE_SUPPORTED_EXTENSIONS doesn't cover them,
+    //       so extractDataflowAnalysis returns null; the wasmStubs path calls buildDataflowEdges
+    //       which writes both edges AND vertices for those files.
+    //   (b) Native-language files with dataflow edges already written by the Rust orchestrator
+    //       (flows_to/returns/mutates) — those need vertex rows to connect them.
+    //
+    // Skipping native-language files with no dataflow edges is safe: extractDataflowAnalysis
+    // would return argFlows=[], assignments=[], mutations=[] for them, producing zero vertices
+    // and zero inter-procedural edges. Excluding them avoids O(n_total_files) re-analysis on
+    // every full build (codegraph itself: ~2000 files, ~50-80% with no dataflow edges).
+    const filesWithDataflow = new Set(
+      (
+        ctx.db
+          .prepare(
+            `SELECT DISTINCT n.file
+             FROM dataflow d
+             JOIN nodes n ON n.id = d.source_id
+             WHERE n.file IS NOT NULL`,
+          )
+          .all() as { file: string }[]
+      ).map((r) => r.file),
+    );
+
+    filesToProcess = (
+      ctx.db
+        .prepare(`SELECT DISTINCT file FROM nodes WHERE file IS NOT NULL AND kind != 'directory'`)
+        .all() as { file: string }[]
+    )
+      .map((r) => r.file)
+      .filter((f) => {
+        const ext = path.extname(f).toLowerCase();
+        // Non-native files: always include (WASM handles them via wasmStubs path).
+        if (!NATIVE_SUPPORTED_EXTENSIONS.has(ext)) return true;
+        // Native files: only include when Rust wrote dataflow edges for them.
+        return filesWithDataflow.has(f);
+      });
+  }
+
+  // Split files into two buckets:
+  //   nativeDataflow — Rust extracted data (vertex-only pass; edges already in DB)
+  //   wasmStubs      — Rust returned null (WASM will handle edges + vertices)
+  const nativeDataflow = new Map<string, DataflowResult>();
+  const wasmStubs = new Map<string, { definitions: []; _langId: null; _tree: null }>();
+
+  const absPaths = filesToProcess.map((relPath) => path.join(ctx.rootDir, relPath));
+
+  // Batch the per-file dataflow extraction into one NAPI call so the parses run
+  // across the rayon thread pool instead of serially on the event loop — this is
+  // the dominant cost of a native full build (#perf). Older addons predate the
+  // batch export, so fall back to the per-file path when it is unavailable.
+  let batchResults: (DataflowResult | null)[] | null = null;
+  if (typeof native.extractDataflowAnalysisBatch === 'function') {
+    try {
+      batchResults = native.extractDataflowAnalysisBatch(absPaths);
+    } catch {
+      batchResults = null; // fall through to per-file extraction below
+    }
+  }
+
+  for (let i = 0; i < filesToProcess.length; i++) {
+    const relPath = filesToProcess[i]!;
+    let result: DataflowResult | null = null;
+    if (batchResults) {
+      result = batchResults[i] ?? null;
+    } else {
+      let source: string;
+      try {
+        source = readFileSafe(absPaths[i]!);
+      } catch {
+        // Unreadable file — mirror batch-path behaviour and route to WASM.
+        wasmStubs.set(relPath, { definitions: [], _langId: null, _tree: null });
+        continue;
+      }
+      if (!source) {
+        // Empty file — same treatment as batch returning null.
+        wasmStubs.set(relPath, { definitions: [], _langId: null, _tree: null });
+        continue;
+      }
+      try {
+        result = native.extractDataflowAnalysis(source, absPaths[i]!);
+      } catch {
+        // Language-specific parse failure — fall through to WASM.
+      }
+    }
+    if (result) {
+      // Normalise the native DataflowResult: Rust emits `bindingType: string | null`
+      // (flat) while the TS dataflow layer expects `binding: { type, index? }` (object).
+      // patchNativeResult handles this via patchDataflow for the full parse path;
+      // extractDataflowAnalysis(Batch) is a vertex-only fast path that bypasses
+      // patchNativeResult, so we apply the same normalisation here.
+      patchDataflowResult(result);
+      nativeDataflow.set(relPath, result);
+    } else {
+      // Rust has no dataflow rules for this language; WASM fallback will handle
+      // both edge insertion and vertex extraction. Since Rust inserted 0 dataflow
+      // edges for these files, there is no risk of duplicates.
+      wasmStubs.set(relPath, { definitions: [], _langId: null, _tree: null });
+    }
+  }
+
+  const { buildExtToLangMap } = (await import('../../../../ast-analysis/shared.js')) as {
+    buildExtToLangMap: () => Map<string, string>;
+  };
+
+  const {
+    buildDataflowVerticesFromMap,
+    buildDataflowEdges,
+    collectCallerStitchCandidates,
+    collectFuncIdsForFiles,
+  } = (await import('../../../../features/dataflow.js')) as {
+    buildDataflowVerticesFromMap: (
+      db: BetterSqlite3Database,
+      dataflowMap: Map<string, DataflowResult>,
+      extraCandidates?: Array<{
+        callerFuncId: number;
+        calleeFuncId: number;
+        argIndex: number;
+        bindingType: string;
+        bindingIndex: number;
+        argName: string;
+        expression: string | null;
+        line: number;
+        confidence: number;
+      }>,
+      extraCaptures?: Array<{ callerFuncId: number; calleeFuncId: number; varName: string }>,
+    ) => number;
+    buildDataflowEdges: (
+      db: BetterSqlite3Database,
+      fileSymbols: Map<string, unknown>,
+      rootDir: string,
+      engineOpts?: unknown,
+    ) => Promise<void>;
+    collectCallerStitchCandidates: (
+      db: BetterSqlite3Database,
+      changedFuncIds: number[],
+      changedRelPaths: Set<string>,
+      rootDir: string,
+      extToLang: Map<string, string>,
+      parsers: unknown,
+      getParserFn: unknown,
+    ) => Promise<{
+      candidates: Array<{
+        callerFuncId: number;
+        calleeFuncId: number;
+        argIndex: number;
+        bindingType: string;
+        bindingIndex: number;
+        argName: string;
+        expression: string | null;
+        line: number;
+        confidence: number;
+      }>;
+      captures: Array<{ callerFuncId: number; calleeFuncId: number; varName: string }>;
+    }>;
+    collectFuncIdsForFiles: (db: BetterSqlite3Database, relPaths: Iterable<string>) => number[];
+  };
+
+  // Rust-supported languages: build vertices only (edges already written by Rust orchestrator).
+  if (nativeDataflow.size > 0) {
+    // P4: On incremental builds, unchanged caller files' arg_in edges were deleted when
+    // the changed files' param vertices were purged and recreated. Re-collect stitch
+    // candidates from those caller files so buildInterproceduralStitch can reconnect them.
+    // Skip on full builds (changedFiles absent/empty) — nativeDataflow covers all files.
+    let p4Candidates: Array<{
+      callerFuncId: number;
+      calleeFuncId: number;
+      argIndex: number;
+      bindingType: string;
+      bindingIndex: number;
+      argName: string;
+      expression: string | null;
+      line: number;
+      confidence: number;
+    }> = [];
+    let p4Captures: Array<{ callerFuncId: number; calleeFuncId: number; varName: string }> = [];
+
+    if (changedFiles && changedFiles.length > 0) {
+      const changedSet = new Set(changedFiles);
+      const totalFilesInDb = (
+        ctx.db.prepare(`SELECT COUNT(DISTINCT file) AS n FROM nodes`).get() as { n: number }
+      ).n;
+      // Only run P4 when this is a real incremental build (not all files changed).
+      if (nativeDataflow.size < totalFilesInDb) {
+        const changedFuncIds = collectFuncIdsForFiles(ctx.db, changedSet);
+        if (changedFuncIds.length > 0) {
+          const extra = await collectCallerStitchCandidates(
+            ctx.db,
+            changedFuncIds,
+            changedSet,
+            ctx.rootDir,
+            buildExtToLangMap(),
+            null, // parsers — lazily loaded inside collectCallerStitchCandidates
+            null, // getParserFn — lazily loaded inside collectCallerStitchCandidates
+          );
+          p4Candidates = extra.candidates as typeof p4Candidates;
+          p4Captures = extra.captures;
+        }
+      }
+    }
+
+    const interCount = buildDataflowVerticesFromMap(
+      ctx.db,
+      nativeDataflow,
+      p4Candidates.length > 0 ? p4Candidates : undefined,
+      p4Captures.length > 0 ? p4Captures : undefined,
+    );
+    if (interCount > 0) {
+      info(
+        `Dataflow (native orchestrator): ${interCount} inter-procedural edges inserted${p4Candidates.length > 0 ? ` (P4: ${p4Candidates.length} re-stitch candidate(s) from unchanged callers)` : ''}`,
+      );
+    }
+  }
+
+  // Rust-unsupported languages: run the full WASM extraction (edges + vertices).
+  // wasmStubs entries have no `.dataflow` property, so the native bulk-insert
+  // fast path in buildDataflowEdges is always skipped for them — WASM runs
+  // both edge insertion and vertex extraction end-to-end.
+  if (wasmStubs.size > 0) {
+    await buildDataflowEdges(ctx.db, wasmStubs, ctx.rootDir);
+  }
+}
+
 /**
  * JS fallback for AST/complexity/CFG/dataflow analysis after native orchestrator.
  * Used when the Rust addon doesn't include analysis persistence (older addon
@@ -388,37 +643,10 @@ async function runPostNativeAnalysis(
   return timing;
 }
 
-/**
- * Phase 8.5: CHA expansion post-pass for the native orchestrator path.
- *
- * The Rust build pipeline resolves typed receiver calls (e.g. `worker.doWork()`
- * where `worker: IWorker`) to the interface method declaration only.  This
- * post-pass reads the class hierarchy (via `implements`/`extends` edges) and
- * instantiated types (via `calls` edges to class nodes) from the DB and expands
- * each call to an interface/abstract method to ALL RTA-filtered concrete
- * implementations.
- *
- * Note: `this`/`super` dispatch is handled separately by `runPostNativeThisDispatch`,
- * which WASM-re-parses JS/TS files to obtain raw call site receiver info.
- *
- * Returns the count of newly inserted CHA edges plus the set of files containing
- * the new edges' endpoints, so the caller can scope role re-classification to the
- * nodes whose fan-in/out actually changed. A zero count means no edges were added
- * and role re-classification is unnecessary.
- */
-function runPostNativeCha(db: BetterSqlite3Database): {
-  newEdgeCount: number;
-  affectedFiles: Set<string>;
-} {
-  const affectedFiles = new Set<string>();
-  const empty = { newEdgeCount: 0, affectedFiles };
-  // Fast guard: no hierarchy edges → no CHA work
-  const hasHierarchy = db
-    .prepare(`SELECT 1 FROM edges WHERE kind IN ('extends', 'implements') LIMIT 1`)
-    .get();
-  if (!hasHierarchy) return empty;
+// ── CHA post-pass helpers ────────────────────────────────────────────────────
 
-  // Build implementors map: parent/interface name → [child/implementing class names]
+/** Build implementors map: parent/interface name → [child/implementing class names]. */
+function buildChaImplementorsMap(db: BetterSqlite3Database): Map<string, string[]> {
   const hierarchyRows = db
     .prepare(`
       SELECT src.name AS child_name, tgt.name AS parent_name
@@ -438,12 +666,22 @@ function runPostNativeCha(db: BetterSqlite3Database): {
     }
     if (!list.includes(row.child_name)) list.push(row.child_name);
   }
-  if (implementors.size === 0) return empty;
+  return implementors;
+}
 
-  // RTA: collect class names that are actually instantiated via `new X()`.
-  // Primary query targets `class`-kind nodes (the canonical schema).
-  // Fallback also matches `constructor`/`function`-kind nodes because some native
-  // engine versions record constructor calls against those kinds instead of `class`.
+/**
+ * Build RTA set: class names actually instantiated via `new X()`.
+ * Primary query targets `class`-kind nodes (the canonical schema).
+ * Fallback also matches `constructor`/`function`-kind nodes because some native
+ * engine versions record constructor calls against those kinds instead of `class`.
+ * Returns `{ instantiated, noRtaEvidence }` where `noRtaEvidence` means no
+ * constructor-call evidence exists — skip RTA filtering so interface dispatch
+ * still produces edges.
+ */
+function buildChaRtaSet(db: BetterSqlite3Database): {
+  instantiated: Set<string>;
+  noRtaEvidence: boolean;
+} {
   let rtaRows = db
     .prepare(`
       SELECT DISTINCT tgt.name
@@ -465,28 +703,148 @@ function runPostNativeCha(db: BetterSqlite3Database): {
       .all() as Array<{ name: string }>;
   }
   const instantiated = new Set(rtaRows.map((r) => r.name));
-  // noRtaEvidence: true when no constructor-call evidence exists in the DB (e.g. graph
-  // built by an older native engine that doesn't emit constructor call edges at all).
-  // In that case we skip RTA filtering so interface dispatch still produces edges —
-  // all instantiated implementors are admitted rather than silently dropping everything.
   const noRtaEvidence = instantiated.size === 0;
   if (noRtaEvidence) {
     debug('runPostNativeCha: no constructor-call evidence found — proceeding without RTA filter');
   }
+  return { instantiated, noRtaEvidence };
+}
+
+/**
+ * Determine CHA candidate scope for incremental builds.
+ *
+ * Gate A: did a changed file add/change a class hierarchy node?
+ *   A new `extends`/`implements` edge means a previously-untracked implementor
+ *   is now in the hierarchy — unchanged call sites in OTHER files may gain new
+ *   valid expansions, so the full scan is required.
+ *   Note: *removed* class nodes are safe — Rust's `purge_changed_files` runs
+ *   before this post-pass and deletes stale nodes and their hierarchy edges, so
+ *   Gate A queries the post-purge DB. A deleted class returns no row here, which
+ *   is correct: its stale CHA edges were already cleaned up by the Rust purge.
+ *
+ * Gate B: did a changed file add new RTA evidence (`new ConcreteX()`)?
+ *   A new `calls` edge to a class/constructor/function-kind target means the
+ *   instantiated set grew — previously RTA-filtered expansions in unchanged
+ *   caller files become admissible, so the full scan is required.
+ *   (`constructor`/`function` cover the older native engine fallback schema.)
+ *
+ * Returns `true` when the scan should be scoped to changed-file sources only.
+ * Returns `false` (full scan) when changedFiles is null, empty, or either gate fires.
+ */
+function computeChaScope(db: BetterSqlite3Database, changedFiles: string[] | null): boolean {
+  if (changedFiles === null || changedFiles.length === 0) return false;
+
+  const CHUNK_SIZE = 500;
+  let gateAFired = false;
+  for (let i = 0; i < changedFiles.length && !gateAFired; i += CHUNK_SIZE) {
+    const chunk = changedFiles.slice(i, i + CHUNK_SIZE);
+    const ph = chunk.map(() => '?').join(',');
+    const row = db
+      .prepare(
+        `SELECT 1 FROM nodes
+         WHERE file IN (${ph})
+         AND kind IN ('class', 'interface', 'trait', 'struct', 'record')
+         LIMIT 1`,
+      )
+      .get(...chunk);
+    if (row) gateAFired = true;
+  }
+
+  let gateBFired = false;
+  if (!gateAFired) {
+    for (let i = 0; i < changedFiles.length && !gateBFired; i += CHUNK_SIZE) {
+      const chunk = changedFiles.slice(i, i + CHUNK_SIZE);
+      const ph = chunk.map(() => '?').join(',');
+      const row = db
+        .prepare(
+          `SELECT 1 FROM edges e
+           JOIN nodes src ON e.source_id = src.id
+           JOIN nodes tgt ON e.target_id = tgt.id
+           WHERE e.kind = 'calls'
+           AND tgt.kind IN ('class', 'interface', 'trait', 'struct', 'record', 'constructor', 'function')
+           AND src.file IN (${ph})
+           LIMIT 1`,
+        )
+        .get(...chunk);
+      if (row) gateBFired = true;
+    }
+  }
+
+  if (!gateAFired && !gateBFired) {
+    debug(
+      `runPostNativeCha: neither gate fired — scoping candidate scan to ${changedFiles.length} changed file(s)`,
+    );
+    return true;
+  }
+  debug(
+    `runPostNativeCha: ${gateAFired ? 'Gate A (hierarchy)' : 'Gate B (RTA)'} fired — running full scan`,
+  );
+  return false;
+}
 
-  // Find existing call edges targeting qualified methods (e.g., 'IWorker.doWork').
-  // Include the caller node's file so confidence can be computed file-pair-aware,
-  // matching the WASM path's computeConfidence(callerFile, targetFile, null) - CHA_DISPATCH_PENALTY formula.
-  const callToMethods = db
+type ChaCallRow = {
+  source_id: number;
+  caller_name: string;
+  method_name: string;
+  caller_file: string | null;
+};
+
+/**
+ * Fetch call→method rows that are candidates for CHA expansion.
+ * When `scopeToChangedFiles` is true, restricts to source nodes in `changedFiles`.
+ */
+function fetchChaCallToMethods(
+  db: BetterSqlite3Database,
+  changedFiles: string[] | null,
+  scopeToChangedFiles: boolean,
+): ChaCallRow[] {
+  if (scopeToChangedFiles && changedFiles && changedFiles.length > 0) {
+    const CHUNK_SIZE = 500;
+    const rows: ChaCallRow[] = [];
+    for (let i = 0; i < changedFiles.length; i += CHUNK_SIZE) {
+      const chunk = changedFiles.slice(i, i + CHUNK_SIZE);
+      const ph = chunk.map(() => '?').join(',');
+      const chunkRows = db
+        .prepare(
+          `SELECT e.source_id, src.name AS caller_name, tgt.name AS method_name, src.file AS caller_file
+           FROM edges e
+           JOIN nodes tgt ON e.target_id = tgt.id
+           JOIN nodes src ON e.source_id = src.id
+           WHERE e.kind = 'calls' AND tgt.kind = 'method'
+           AND INSTR(tgt.name, '.') > 0
+           AND (e.technique IS NULL OR e.technique != 'cha-expanded')
+           AND src.file IN (${ph})`,
+        )
+        .all(...chunk) as ChaCallRow[];
+      rows.push(...chunkRows);
+    }
+    return rows;
+  }
+  return db
     .prepare(`
-      SELECT e.source_id, tgt.name AS method_name, src.file AS caller_file
+      SELECT e.source_id, src.name AS caller_name, tgt.name AS method_name, src.file AS caller_file
       FROM edges e
       JOIN nodes tgt ON e.target_id = tgt.id
       JOIN nodes src ON e.source_id = src.id
       WHERE e.kind = 'calls' AND tgt.kind = 'method'
       AND INSTR(tgt.name, '.') > 0
+      AND (e.technique IS NULL OR e.technique != 'cha-expanded')
     `)
-    .all() as Array<{ source_id: number; method_name: string; caller_file: string | null }>;
+    .all() as ChaCallRow[];
+}
+
+/**
+ * BFS-expand CHA call edges and insert new edges into the DB.
+ * Returns `{ newEdgeCount, affectedFiles }` for role re-classification scoping.
+ */
+function expandChaEdges(
+  db: BetterSqlite3Database,
+  callToMethods: ChaCallRow[],
+  implementors: Map<string, string[]>,
+  instantiated: Set<string>,
+  noRtaEvidence: boolean,
+): { newEdgeCount: number; affectedFiles: Set<string> } {
+  const affectedFiles = new Set<string>();
 
   // Seed seen-pairs only from the source_ids we'll be expanding — avoids loading every
   // call edge in the DB (which would be O(all edges)) for large codebases.
@@ -540,16 +898,12 @@ function runPostNativeCha(db: BetterSqlite3Database): {
             method_file: string | null;
           }>;
           for (const methodNode of methodNodes) {
+            if (methodNode.id === source_id) continue; // skip self-loops
             const key = `${source_id}|${methodNode.id}`;
             if (seen.has(key)) continue;
             seen.add(key);
-            // Compute confidence file-pair-aware (mirrors WASM path: computeConfidence - CHA_DISPATCH_PENALTY)
-            // Skip zero-confidence edges to match buildFileCallEdges / buildChaPostPass behaviour.
-            const conf =
-              computeConfidence(caller_file ?? '', methodNode.method_file ?? '', null) -
-              CHA_DISPATCH_PENALTY;
-            if (conf <= 0) continue;
-            newEdges.push([source_id, methodNode.id, 'calls', conf, 0, 'cha']);
+            const conf = CHA_TYPED_DISPATCH_CONFIDENCE;
+            newEdges.push([source_id, methodNode.id, 'calls', conf, 0, 'cha-expanded']);
             newEdgeCount++;
             if (caller_file) affectedFiles.add(caller_file);
             if (methodNode.method_file) affectedFiles.add(methodNode.method_file);
@@ -564,41 +918,85 @@ function runPostNativeCha(db: BetterSqlite3Database): {
 
   if (newEdges.length > 0) {
     db.transaction(() => batchInsertEdges(db, newEdges))();
+    // Account for post-pass edges excluded from the build summary line (#1452),
+    // mirroring the this/super dispatch post-pass insertion log.
+    debug(`CHA expansion post-pass: inserted ${newEdgeCount} edge(s)`);
   }
   return { newEdgeCount, affectedFiles };
 }
 
-// Extensions where `this`/`super` dispatch can occur (JS/TS family)
-const THIS_DISPATCH_EXTS = new Set(['.js', '.ts', '.tsx', '.jsx', '.mjs', '.cjs', '.mts', '.cts']);
-
 /**
- * Phase 8.5: this/super dispatch post-pass for the native orchestrator path.
+ * Phase 8.6: CHA expansion post-pass for the native orchestrator path.
  *
- * The Rust build pipeline resolves typed receiver calls but does NOT persist raw
- * unresolved call site receiver info (e.g. `this`, `super`) to the DB. This
- * hybrid post-pass re-parses JS/TS/TSX files via WASM to collect call sites with
- * `this`/`super` receivers, then resolves them through the class hierarchy stored
- * in DB `extends` edges — mirroring what `buildChaPostPass` does on the WASM path.
+ * The Rust build pipeline resolves typed receiver calls (e.g. `worker.doWork()`
+ * where `worker: IWorker`) to the interface method declaration only.  This
+ * post-pass reads the class hierarchy (via `implements`/`extends` edges) and
+ * instantiated types (via `calls` edges to class nodes) from the DB and expands
+ * each call to an interface/abstract method to ALL RTA-filtered concrete
+ * implementations.
  *
- * Only runs when `extends` edges exist in the DB; if there is no inheritance
- * hierarchy there is nothing to resolve via `this`/`super` dispatch.
+ * Note: `this`/`super` dispatch is handled separately by `runPostNativeThisDispatch`,
+ * which WASM-re-parses JS/TS files to obtain raw call site receiver info.
+ *
+ * `changedFiles` controls candidate scoping on incremental builds:
+ *   - null  → full build; scan all call→method edges (existing behaviour).
+ *   - array → incremental; two cheap gate queries decide scope:
+ *       Gate A: any class/interface/trait/struct/record nodes in changed files?
+ *               If yes, a new implementor may have appeared — full scan required.
+ *       Gate B: any `calls` edges from changed-file sources targeting
+ *               class/constructor/function-kind nodes? If yes, the RTA set may
+ *               have grown (also covers the older-schema fallback where
+ *               constructor calls target `constructor`/`function` nodes instead
+ *               of `class` nodes) — full scan required.
+ *       If neither gate fires: scope `callToMethods` to `src.file IN changedFiles`
+ *       (safe because no hierarchy or RTA evidence changed).
+ *
+ * Returns the count of newly inserted CHA edges plus the set of files containing
+ * the new edges' endpoints, so the caller can scope role re-classification to the
+ * nodes whose fan-in/out actually changed. A zero count means no edges were added
+ * and role re-classification is unnecessary.
  */
-async function runPostNativeThisDispatch(
+function runPostNativeCha(
   db: BetterSqlite3Database,
-  rootDir: string,
-  changedFiles: string[] | undefined,
-  isFullBuild: boolean,
-): Promise<{ elapsedMs: number; targetIds: Set<number>; affectedFiles: Set<string> }> {
-  const t0 = Date.now();
-  const targetIds = new Set<number>();
-  // Files containing endpoints of newly inserted edges — lets the caller scope
-  // role re-classification to the nodes whose fan-in/out actually changed.
+  changedFiles: string[] | null,
+): {
+  newEdgeCount: number;
+  affectedFiles: Set<string>;
+} {
   const affectedFiles = new Set<string>();
-  // Fast guard: need at least one extends edge for this/super to have meaning
-  const hasExtends = db.prepare(`SELECT 1 FROM edges WHERE kind = 'extends' LIMIT 1`).get();
-  if (!hasExtends) return { elapsedMs: 0, targetIds, affectedFiles };
+  const empty = { newEdgeCount: 0, affectedFiles };
+  // Fast guard: no hierarchy edges → no CHA work
+  const hasHierarchy = db
+    .prepare(`SELECT 1 FROM edges WHERE kind IN ('extends', 'implements') LIMIT 1`)
+    .get();
+  if (!hasHierarchy) return empty;
+
+  const implementors = buildChaImplementorsMap(db);
+  if (implementors.size === 0) return empty;
+
+  const { instantiated, noRtaEvidence } = buildChaRtaSet(db);
+  const scopeToChangedFiles = computeChaScope(db, changedFiles);
+  const callToMethods = fetchChaCallToMethods(db, changedFiles, scopeToChangedFiles);
+
+  return expandChaEdges(db, callToMethods, implementors, instantiated, noRtaEvidence);
+}
+
+// Extensions where `this`/`super` dispatch can occur (JS/TS family)
+const THIS_DISPATCH_EXTS = new Set(['.js', '.ts', '.tsx', '.jsx', '.mjs', '.cjs', '.mts', '.cts']);
 
-  // Build parents map: child class → direct parent class (from `extends` edges)
+// ── this/super dispatch post-pass helpers ───────────────────────────────────
+
+/**
+ * Build parents map: child class → direct parent class (from `extends` edges).
+ * May be empty when only func-prop methods exist (no class inheritance) —
+ * resolveThisDispatch handles that case via direct class-prefix lookup.
+ */
+function buildThisDispatchParentsMap(
+  db: BetterSqlite3Database,
+  hasExtends: unknown,
+): Map<string, string> {
+  const parents = new Map<string, string>();
+  if (!hasExtends) return parents;
   const parentRows = db
     .prepare(`
       SELECT src.name AS child_name, tgt.name AS parent_name
@@ -608,32 +1006,26 @@ async function runPostNativeThisDispatch(
       WHERE e.kind = 'extends'
     `)
     .all() as Array<{ child_name: string; parent_name: string }>;
-
-  const parents = new Map<string, string>();
   for (const row of parentRows) {
     if (!parents.has(row.child_name)) parents.set(row.child_name, row.parent_name);
   }
-  if (parents.size === 0) return { elapsedMs: 0, targetIds, affectedFiles };
-
-  const chaCtx: ChaContext = {
-    implementors: new Map(), // not needed for this/super resolution
-    parents,
-    instantiatedTypes: new Set(), // not needed for this/super resolution
-  };
+  return parents;
+}
 
-  // Determine which files to re-parse.
-  //
-  // On a full build we do NOT re-parse every JS/TS file — that would WASM-parse
-  // the entire project on top of the native pass, causing a massive regression
-  // (measured: +358% ms/file on codegraph itself). Instead we restrict to files
-  // that are part of the class inheritance hierarchy: both subclass files (which
-  // contain `super.X()` calls dispatching to a parent) and parent-class files
-  // (whose method bodies contain `this.X()` calls that CHA must resolve). Any
-  // file not in the hierarchy has no `extends` relationship, so `this`/`super`
-  // calls in it either resolve locally (same-class dispatch, already handled by
-  // the direct-call edge) or have no class context — and will be skipped by
-  // `resolveThisDispatch` anyway.
-  let relFiles: string[];
+/**
+ * Determine the set of relative file paths to re-parse for this/super dispatch.
+ *
+ * On a full build we do NOT re-parse every JS/TS file — that would WASM-parse
+ * the entire project on top of the native pass, causing a massive regression
+ * (measured: +358% ms/file on codegraph itself). Instead we restrict to files
+ * that are part of the class inheritance hierarchy OR that contain dot-named
+ * method nodes (func-prop assignments whose bodies may call `this.sibling()`).
+ */
+function selectThisDispatchFiles(
+  db: BetterSqlite3Database,
+  changedFiles: string[] | undefined,
+  isFullBuild: boolean,
+): string[] {
   if (isFullBuild || !changedFiles) {
     const rows = db
       .prepare(`
@@ -647,79 +1039,60 @@ async function runPostNativeThisDispatch(
           FROM edges e
           JOIN nodes tgt ON e.target_id = tgt.id
           WHERE e.kind = 'extends' AND tgt.file IS NOT NULL
+          UNION
+          -- Files with func-prop method definitions (e.g. f.h = function(){this.g()}).
+          -- Only include files where the method's owner prefix is NOT a known class name —
+          -- this keeps the re-parse set small (func-prop files only, not all class-method files).
+          -- AND name IS NOT NULL guards the NOT IN sub-select: if any class node had a NULL
+          -- name the entire NOT IN clause would silently return no rows (SQL NULL semantics).
+          SELECT n.file AS file
+          FROM nodes n
+          WHERE n.kind = 'method'
+          AND INSTR(n.name, '.') > 0
+          AND n.file IS NOT NULL
+          AND SUBSTR(n.name, 1, INSTR(n.name, '.') - 1) NOT IN (
+            SELECT name FROM nodes WHERE kind IN ('class', 'struct', 'interface', 'type')
+            AND name IS NOT NULL
+          )
         )
       `)
       .all() as Array<{ file: string }>;
-    relFiles = rows
+    return rows
       .map((r) => r.file)
       .filter((f) => THIS_DISPATCH_EXTS.has(path.extname(f).toLowerCase()));
-  } else {
-    // NOTE: Only files explicitly listed in changedFiles are re-parsed.
-    // If a parent-class method is replaced (new node ID) but the child file is
-    // unchanged, the stale super.method() edge is not refreshed here. A full
-    // rebuild (isFullBuild=true) is required to recover in that scenario.
-    relFiles = changedFiles.filter((f) => THIS_DISPATCH_EXTS.has(path.extname(f).toLowerCase()));
-  }
-  if (relFiles.length === 0) return { elapsedMs: 0, targetIds, affectedFiles };
-
-  // DB-backed CallNodeLookup — resolveThisDispatch only calls byName()
-  const findByNameStmt = db.prepare(`SELECT id, file, kind FROM nodes WHERE name = ?`);
-  const lookup: CallNodeLookup = {
-    byName: (name) => findByNameStmt.all(name) as Array<{ id: number; file: string; kind: string }>,
-    byNameAndFile: (name, file) =>
-      (findByNameStmt.all(name) as Array<{ id: number; file: string; kind: string }>).filter(
-        (n) => n.file === file,
-      ),
-    isBarrel: () => false,
-    resolveBarrel: () => null,
-    nodeId: () => undefined,
-  };
-
-  // Seed seen-pairs from existing call edges on source nodes in our file set
-  const seen = new Set<string>();
-  const CHUNK = 500;
-  for (let i = 0; i < relFiles.length; i += CHUNK) {
-    const chunk = relFiles.slice(i, i + CHUNK);
-    const ph = chunk.map(() => '?').join(',');
-    const rows = db
-      .prepare(
-        `SELECT e.source_id, e.target_id
-         FROM edges e
-         JOIN nodes n ON e.source_id = n.id
-         WHERE e.kind = 'calls' AND n.file IN (${ph})`,
-      )
-      .all(...chunk) as Array<{ source_id: number; target_id: number }>;
-    for (const r of rows) seen.add(`${r.source_id}|${r.target_id}`);
   }
+  // NOTE: Only files explicitly listed in changedFiles are re-parsed.
+  // If a parent-class method is replaced (new node ID) but the child file is
+  // unchanged, the stale super.method() edge is not refreshed here. A full
+  // rebuild (isFullBuild=true) is required to recover in that scenario.
+  return changedFiles.filter((f) => THIS_DISPATCH_EXTS.has(path.extname(f).toLowerCase()));
+}
 
-  // Find the innermost containing method/function for a call at `line` in `file`.
-  // COALESCE maps NULL end_line to a large sentinel so unbounded nodes sort last
-  // (SQLite ASC orders NULLs first, so a raw `end_line - line` would pick them first).
-  const findCallerByLineStmt = db.prepare(`
-    SELECT id, name FROM nodes
-    WHERE file = ? AND kind IN ('method', 'function')
-    AND line <= ? AND (end_line IS NULL OR end_line >= ?)
-    ORDER BY COALESCE(end_line - line, 999999999) ASC
-    LIMIT 1
-  `);
-
-  // Re-parse the files to obtain raw call sites with receiver info. Only
-  // `calls` (with receivers) are consumed here.
-  //
-  // The native engine is preferred: this pass only runs after a native
-  // orchestrator build, so the addon is already loaded and re-parses the
-  // hierarchy file set in single-digit milliseconds with the same
-  // receiver-annotated call sites as the WASM extractor. Booting the WASM
-  // runtime here instead cost ~40–110ms per full build (in-process
-  // web-tree-sitter + grammar init dominated) — part of the v3.12.0
-  // publish-gate regression. Files the native engine cannot parse (extension
-  // outside NATIVE_SUPPORTED_EXTENSIONS, e.g. .mts/.cts) and native parse
-  // failures fall back to the WASM backfill path so the sweep stays complete.
-  const absFiles = relFiles.map((f) => path.join(rootDir, f));
+/**
+ * Re-parse files via native (preferred) + WASM fallback to obtain call sites
+ * with receiver info. Returns a map of relPath → calls array.
+ *
+ * The native engine is preferred: this pass only runs after a native
+ * orchestrator build, so the addon is already loaded and re-parses the
+ * hierarchy file set in single-digit milliseconds with the same
+ * receiver-annotated call sites as the WASM extractor. Booting the WASM
+ * runtime here instead cost ~40–110ms per full build (in-process
+ * web-tree-sitter + grammar init dominated) — part of the v3.12.0
+ * publish-gate regression. Files the native engine cannot parse (extension
+ * outside NATIVE_SUPPORTED_EXTENSIONS, e.g. .mts/.cts) and native parse
+ * failures fall back to the WASM backfill path so the sweep stays complete.
+ */
+async function parseFilesForThisDispatch(
+  absFiles: string[],
+  rootDir: string,
+): Promise<{
+  callsByRel: Map<string, { name: string; receiver?: string; line: number }[]>;
+  wasmResults: Map<string, ExtractorOutput>;
+}> {
+  const callsByRel = new Map<string, { name: string; receiver?: string; line: number }[]>();
   const nativeAbs = absFiles.filter((f) =>
     NATIVE_SUPPORTED_EXTENSIONS.has(path.extname(f).toLowerCase()),
   );
-  const callsByRel = new Map<string, { name: string; receiver?: string; line: number }[]>();
   // Track native-supported files that returned null (per-file parse error) so
   // they can be included in the WASM fallback set below, ensuring no file's
   // this/super call sites are silently discarded.
@@ -765,13 +1138,40 @@ async function runPostNativeThisDispatch(
   for (const [relPath, symbols] of wasmResults) {
     callsByRel.set(relPath, symbols.calls ?? []);
   }
+  return { callsByRel, wasmResults };
+}
 
-  const newEdges: Array<[number, number, string, number, number, string]> = [];
-
-  for (const [relPath, calls] of callsByRel) {
-    for (const call of calls) {
-      // Only 'this' and 'super' are class-instance receivers in JS/TS.
-      // 'self' refers to WindowOrWorkerGlobalScope — not a class instance — so
+/** Emit this/super dispatch edges from re-parsed call sites. */
+function emitThisDispatchEdges(
+  db: BetterSqlite3Database,
+  callsByRel: Map<string, { name: string; receiver?: string; line: number }[]>,
+  chaCtx: ChaContext,
+  lookup: CallNodeLookup,
+  seen: Set<string>,
+): {
+  newEdges: Array<[number, number, string, number, number, string]>;
+  targetIds: Set<number>;
+  affectedFiles: Set<string>;
+} {
+  // Find the innermost containing method/function for a call at `line` in `file`.
+  // COALESCE maps NULL end_line to a large sentinel so unbounded nodes sort last
+  // (SQLite ASC orders NULLs first, so a raw `end_line - line` would pick them first).
+  const findCallerByLineStmt = db.prepare(`
+    SELECT id, name FROM nodes
+    WHERE file = ? AND kind IN ('method', 'function')
+    AND line <= ? AND (end_line IS NULL OR end_line >= ?)
+    ORDER BY COALESCE(end_line - line, 999999999) ASC
+    LIMIT 1
+  `);
+
+  const newEdges: Array<[number, number, string, number, number, string]> = [];
+  const targetIds = new Set<number>();
+  const affectedFiles = new Set<string>();
+
+  for (const [relPath, calls] of callsByRel) {
+    for (const call of calls) {
+      // Only 'this' and 'super' are class-instance receivers in JS/TS.
+      // 'self' refers to WindowOrWorkerGlobalScope — not a class instance — so
       // filtering it here prevents spurious dispatch edges from Worker call sites.
       if (call.receiver !== 'this' && call.receiver !== 'super') continue;
 
@@ -786,28 +1186,31 @@ async function runPostNativeThisDispatch(
         call.receiver as 'this' | 'super',
         chaCtx,
         lookup,
+        relPath,
       );
 
       for (const t of targets) {
+        if (t.id === callerRow.id) continue; // skip self-loops
         const key = `${callerRow.id}|${t.id}`;
         if (seen.has(key)) continue;
         seen.add(key);
         const conf = computeConfidence(relPath, t.file, null) - CHA_DISPATCH_PENALTY;
         if (conf <= 0) continue;
-        newEdges.push([callerRow.id, t.id, 'calls', conf, 0, 'cha']);
+        // Tag super-dispatch edges distinctly so runPostNativeCha can exclude them
+        // from further CHA expansion (super calls are not virtual dispatch).
+        const technique = call.receiver === 'super' ? 'super-dispatch' : 'cha';
+        newEdges.push([callerRow.id, t.id, 'calls', conf, 0, technique]);
         targetIds.add(t.id);
         affectedFiles.add(relPath);
         if (t.file) affectedFiles.add(t.file);
       }
     }
   }
+  return { newEdges, targetIds, affectedFiles };
+}
 
-  if (newEdges.length > 0) {
-    db.transaction(() => batchInsertEdges(db, newEdges))();
-    debug(`this/super dispatch post-pass: inserted ${newEdges.length} edge(s)`);
-  }
-
-  // Free WASM parse trees — mirrors the cleanup in backfillNativeDroppedFiles
+/** Free WASM parse trees after this-dispatch post-pass to prevent memory leaks. */
+function cleanupThisDispatchWasmTrees(wasmResults: Map<string, ExtractorOutput>): void {
   for (const [, symbols] of wasmResults) {
     const tree = (symbols as { _tree?: { delete?: () => void } })._tree;
     if (tree && typeof tree.delete === 'function') {
@@ -820,8 +1223,119 @@ async function runPostNativeThisDispatch(
     (symbols as { _tree?: unknown; _langId?: unknown })._tree = undefined;
     (symbols as { _tree?: unknown; _langId?: unknown })._langId = undefined;
   }
+}
+
+/**
+ * Phase 8.5: this/super dispatch post-pass for the native orchestrator path.
+ *
+ * The Rust build pipeline resolves typed receiver calls but does NOT persist raw
+ * unresolved call site receiver info (e.g. `this`, `super`) to the DB. This
+ * hybrid post-pass re-parses JS/TS/TSX files via WASM to collect call sites with
+ * `this`/`super` receivers, then resolves them through the class hierarchy stored
+ * in DB `extends` edges — mirroring what `buildChaPostPass` does on the WASM path.
+ *
+ * Also handles function-as-object-property methods (`f.h = function() { this.g() }`):
+ * these use `this` to reference sibling properties on the same object (`f`), so
+ * `resolveThisDispatch` resolves them by treating the dot-prefix of the caller name
+ * (`f` from `f.h`) as the class and looking up `f.g` directly — no `extends` edge needed.
+ *
+ * Runs when either `extends` edges exist (class inheritance) OR dot-named `method`
+ * nodes exist (func-prop assignments); skips only when neither is present.
+ */
+async function runPostNativeThisDispatch(
+  db: BetterSqlite3Database,
+  rootDir: string,
+  changedFiles: string[] | undefined,
+  isFullBuild: boolean,
+): Promise<{ elapsedMs: number; targetIds: Set<number>; affectedFiles: Set<string> }> {
+  const t0 = performance.now();
+
+  // Fast guard: need at least one extends edge (class inheritance) OR a dot-named
+  // method node (func-prop assignment: `f.h = function() { this.g() }`) for
+  // this/super dispatch to produce any edges.
+  const hasExtends = db.prepare(`SELECT 1 FROM edges WHERE kind = 'extends' LIMIT 1`).get();
+  const hasFuncPropMethod = db
+    .prepare(`SELECT 1 FROM nodes WHERE kind = 'method' AND INSTR(name, '.') > 0 LIMIT 1`)
+    .get();
+  const emptyResult = {
+    elapsedMs: 0,
+    targetIds: new Set<number>(),
+    affectedFiles: new Set<string>(),
+  };
+  if (!hasExtends && !hasFuncPropMethod) return emptyResult;
+
+  const parents = buildThisDispatchParentsMap(db, hasExtends);
+  // Note: parents may be empty when hasFuncPropMethod but !hasExtends — that is
+  // intentional. resolveThisDispatch still resolves `this.g()` inside `f.h` by
+  // treating `f` (the dot-prefix of callerName `f.h`) as the class and looking
+  // up `f.g` directly via lookup.byName(), without traversing the parents chain.
 
-  return { elapsedMs: Date.now() - t0, targetIds, affectedFiles };
+  const chaCtx: ChaContext = {
+    implementors: new Map(), // not needed for this/super resolution
+    parents,
+    instantiatedTypes: new Set(), // not needed for this/super resolution
+  };
+
+  const relFiles = selectThisDispatchFiles(db, changedFiles, isFullBuild);
+  if (relFiles.length === 0) return emptyResult;
+
+  // DB-backed CallNodeLookup — resolveThisDispatch only calls byName()
+  const findByNameStmt = db.prepare(`SELECT id, file, kind FROM nodes WHERE name = ?`);
+  const lookup: CallNodeLookup = {
+    byName: (name) => findByNameStmt.all(name) as Array<{ id: number; file: string; kind: string }>,
+    byNameAndFile: (name, file) =>
+      (findByNameStmt.all(name) as Array<{ id: number; file: string; kind: string }>).filter(
+        (n) => n.file === file,
+      ),
+    isBarrel: () => false,
+    resolveBarrel: () => null,
+    nodeId: () => undefined,
+  };
+
+  // Seed seen-pairs from existing call edges on source nodes in our file set
+  const seen = new Set<string>();
+  const CHUNK = 500;
+  for (let i = 0; i < relFiles.length; i += CHUNK) {
+    const chunk = relFiles.slice(i, i + CHUNK);
+    const ph = chunk.map(() => '?').join(',');
+    const rows = db
+      .prepare(
+        `SELECT e.source_id, e.target_id
+         FROM edges e
+         JOIN nodes n ON e.source_id = n.id
+         WHERE e.kind = 'calls' AND n.file IN (${ph})`,
+      )
+      .all(...chunk) as Array<{ source_id: number; target_id: number }>;
+    for (const r of rows) seen.add(`${r.source_id}|${r.target_id}`);
+  }
+
+  const absFiles = relFiles.map((f) => path.join(rootDir, f));
+  const { callsByRel, wasmResults } = await parseFilesForThisDispatch(absFiles, rootDir);
+
+  const { newEdges, targetIds, affectedFiles } = emitThisDispatchEdges(
+    db,
+    callsByRel,
+    chaCtx,
+    lookup,
+    seen,
+  );
+
+  if (newEdges.length > 0) {
+    db.transaction(() => batchInsertEdges(db, newEdges))();
+    debug(`this/super dispatch post-pass: inserted ${newEdges.length} edge(s)`);
+  }
+
+  cleanupThisDispatchWasmTrees(wasmResults);
+
+  return { elapsedMs: performance.now() - t0, targetIds, affectedFiles };
+}
+
+interface PostPassTimings {
+  gapDetectMs: number;
+  chaMs: number;
+  thisDispatchMs: number;
+  reclassifyMs: number;
+  techniqueBackfillMs: number;
 }
 
 /** Format timing result from native orchestrator phases + JS post-processing. */
@@ -829,7 +1343,7 @@ function formatNativeTimingResult(
   p: Record<string, number>,
   structurePatchMs: number,
   analysisTiming: { astMs: number; complexityMs: number; cfgMs: number; dataflowMs: number },
-  thisDispatchMs: number,
+  postPass: PostPassTimings,
 ): BuildResult {
   return {
     phases: {
@@ -842,7 +1356,11 @@ function formatNativeTimingResult(
       edgesMs: +(p.edgesMs ?? 0).toFixed(1),
       structureMs: +((p.structureMs ?? 0) + structurePatchMs).toFixed(1),
       rolesMs: +(p.rolesMs ?? 0).toFixed(1),
-      thisDispatchMs: +thisDispatchMs.toFixed(1),
+      gapDetectMs: +postPass.gapDetectMs.toFixed(1),
+      chaMs: +postPass.chaMs.toFixed(1),
+      thisDispatchMs: +postPass.thisDispatchMs.toFixed(1),
+      reclassifyMs: +postPass.reclassifyMs.toFixed(1),
+      techniqueBackfillMs: +postPass.techniqueBackfillMs.toFixed(1),
       astMs: +(analysisTiming.astMs ?? 0).toFixed(1),
       complexityMs: +(analysisTiming.complexityMs ?? 0).toFixed(1),
       cfgMs: +(analysisTiming.cfgMs ?? 0).toFixed(1),
@@ -923,6 +1441,55 @@ function groupByExtension(relPaths: Iterable<string>): Map<string, string[]> {
   return buckets;
 }
 
+/**
+ * Return the subset of relative paths that are gitignored in `rootDir`.
+ *
+ * Runs `git check-ignore --stdin` with all candidate paths piped in. Any
+ * path that git echoes back is gitignored. Fails silently (returns an empty
+ * set) when git is unavailable, the directory is not a git repo, or the
+ * check-ignore call throws — the gap-detection logic handles those cases
+ * gracefully without this filter.
+ *
+ * Uses relative paths (forward-slash separated) as both input and output so
+ * the result set can be matched directly against the `expected` set in
+ * `detectDroppedLanguageGap` without any further path manipulation.
+ */
+function queryGitIgnoredFiles(rootDir: string, relPaths: Iterable<string>): Set<string> {
+  const ignored = new Set<string>();
+  const paths = [...relPaths];
+  if (paths.length === 0) return ignored;
+  try {
+    const stdin = paths.join('\n');
+    const output = execFileSync('git', ['check-ignore', '--stdin'], {
+      cwd: rootDir,
+      input: stdin,
+      encoding: 'utf-8',
+      maxBuffer: 100 * 1024 * 1024,
+      // git check-ignore exits with 1 when none of the paths are ignored —
+      // that is not an error for our purposes. stdio: 'pipe' lets us capture
+      // stdout without swallowing stderr, and the try/catch handles the
+      // non-zero exit from execFileSync when ALL paths are non-ignored
+      // (exit code 1 from git check-ignore means "no matches").
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    for (const line of output.split('\n')) {
+      const trimmed = normalizePath(line.trim());
+      if (trimmed) ignored.add(trimmed);
+    }
+  } catch (e: unknown) {
+    // Exit code 1 means no paths were ignored — not an error. Any other
+    // failure (git unavailable, not a repo, etc.) is silently swallowed
+    // so the caller proceeds with the unfiltered set.
+    const exitCode = (e as { status?: number }).status;
+    if (exitCode !== 1) {
+      debug(`queryGitIgnoredFiles: git check-ignore failed: ${toErrorMessage(e)}`);
+    }
+    // On exit code 1, output is empty so ignored stays empty — correct.
+    // On other errors we also proceed with the empty set (safe degradation).
+  }
+  return ignored;
+}
+
 /**
  * Detect files the native orchestrator silently dropped.
  *
@@ -952,8 +1519,17 @@ function groupByExtension(relPaths: Iterable<string>): Map<string, string[]> {
  */
 function detectDroppedLanguageGap(ctx: PipelineContext): DroppedLanguageGap {
   const collected = collectFilesUtil(ctx.rootDir, [], ctx.config, new Set<string>());
+  const expectedRaw = collected.files.map((f) => normalizePath(path.relative(ctx.rootDir, f)));
+
+  // The native Rust engine uses the `ignore` crate with git_ignore(true), so it
+  // respects .gitignore and never processes gitignored files. The JS collectFiles
+  // walker has no gitignore awareness, so without this filter gitignored files
+  // (e.g. NAPI-RS generated crates/codegraph-core/index.js / index.d.ts) appear
+  // in `expected` but not in the DB, causing a spurious "native extractor bug"
+  // WARN and triggering an unnecessary WASM backfill (#1626).
+  const gitIgnored = queryGitIgnoredFiles(ctx.rootDir, expectedRaw);
   const expected = new Set(
-    collected.files.map((f) => normalizePath(path.relative(ctx.rootDir, f))),
+    gitIgnored.size > 0 ? expectedRaw.filter((r) => !gitIgnored.has(r)) : expectedRaw,
   );
 
   const existingNodeRows = ctx.db
@@ -997,56 +1573,33 @@ function detectDroppedLanguageGap(ctx: PipelineContext): DroppedLanguageGap {
   return { missingRel, missingAbs, staleRel };
 }
 
-/**
- * Backfill files that the native orchestrator silently dropped during parse.
- * Falls back to WASM + inserts file/symbol nodes so engine counts match (#967).
- *
- * Also purges stale rows for WASM-only files deleted from disk (#1073), which
- * Rust's `detect_removed_files` filter (#1070) skips.
- *
- * Accepts a pre-computed `gap` from `detectDroppedLanguageGap` so the caller
- * can use the same scan for both gating and the actual backfill — avoiding
- * a redundant fs walk when the orchestrator's signals already triggered.
- */
-async function backfillNativeDroppedFiles(
-  ctx: PipelineContext,
-  gap: DroppedLanguageGap,
-): Promise<void> {
-  const { missingRel, missingAbs, staleRel } = gap;
-  if (missingAbs.length === 0 && staleRel.length === 0) return;
+// ── backfillNativeDroppedFiles helpers ───────────────────────────────────────
 
-  // Now that we know there's work to do, hand off to better-sqlite3 (needed
-  // for the INSERT path below).
-  if (ctx.nativeFirstProxy) {
-    closeNativeDb(ctx, 'pre-parity-backfill');
-    ctx.db = openDb(ctx.dbPath);
-    ctx.nativeFirstProxy = false;
-  }
-
-  const dbConn = ctx.db as unknown as BetterSqlite3Database;
-
-  // Purge WASM-only files that were deleted from disk (#1073). Rust's
-  // detect_removed_files skips them and the insert path below never visits
-  // them, so without this their rows would persist across rebuilds until the
-  // next full rebuild reset the DB.
-  if (staleRel.length > 0) {
-    // `computeWasmOnlyStaleFiles` guarantees every path here has an extension
-    // outside NATIVE_SUPPORTED_EXTENSIONS, so `classifyNativeDrops` would
-    // always bucket 100% into `unsupported-by-native`. Build the extension
-    // summary directly to avoid a redundant classification pass.
-    const staleByExt = groupByExtension(staleRel);
-    info(
-      `Detected ${staleRel.length} deleted WASM-only file(s) across ${staleByExt.size} extension(s) the native orchestrator skipped; purging stale rows:${formatDropExtensionSummary(staleByExt)}`,
-    );
-    purgeFilesData(dbConn, staleRel);
-  }
-
-  if (missingAbs.length === 0) return;
+/** Purge stale WASM-only files deleted from disk (#1073). */
+function purgeStaleWasmOnlyFiles(db: BetterSqlite3Database, staleRel: string[]): void {
+  // `computeWasmOnlyStaleFiles` guarantees every path here has an extension
+  // outside NATIVE_SUPPORTED_EXTENSIONS, so `classifyNativeDrops` would
+  // always bucket 100% into `unsupported-by-native`. Build the extension
+  // summary directly to avoid a redundant classification pass.
+  const staleByExt = groupByExtension(staleRel);
+  info(
+    `Detected ${staleRel.length} deleted WASM-only file(s) across ${staleByExt.size} extension(s) the native orchestrator skipped; purging stale rows:${formatDropExtensionSummary(staleByExt)}`,
+  );
+  purgeFilesData(db, staleRel);
+}
 
-  // Classify drops so users see per-extension reasons instead of just a count
-  // (#1011). `unsupported-by-native` is a legitimate parser limit (no Rust
-  // extractor); `native-extractor-failure` indicates a real native bug since
-  // the language IS supported by the addon yet the file was dropped anyway.
+/**
+ * Classify and log dropped file buckets.
+ * Three-way split of native-extractor-failure files:
+ *   realFailureBuckets  — WASM found symbols → real Rust extractor bug (WARN)
+ *   emptyFileBuckets    — WASM parsed but found 0 symbols → gitignored/empty (debug)
+ *   wasmSkipBuckets     — WASM skipped entirely → no file-node insert (debug)
+ */
+function classifyAndLogDroppedFiles(
+  missingRel: string[],
+  wasmParsedFiles: Set<string>,
+  wasmFoundSymbols: Set<string>,
+): void {
   const { byReason, totals } = classifyNativeDrops(missingRel);
   if (totals['unsupported-by-native'] > 0) {
     const buckets = byReason['unsupported-by-native'];
@@ -1055,13 +1608,54 @@ async function backfillNativeDroppedFiles(
     );
   }
   if (totals['native-extractor-failure'] > 0) {
-    const buckets = byReason['native-extractor-failure'];
-    warn(
-      `Native orchestrator dropped ${totals['native-extractor-failure']} file(s) across ${buckets.size} extension(s) in natively-supported languages — likely a Rust extractor bug. Backfilling via WASM:${formatDropExtensionSummary(buckets)}`,
-    );
+    const allFailurePaths = byReason['native-extractor-failure'];
+    const realFailureBuckets = new Map<string, string[]>();
+    const emptyFileBuckets = new Map<string, string[]>();
+    const wasmSkipBuckets = new Map<string, string[]>();
+    for (const [ext, paths] of allFailurePaths) {
+      for (const relPath of paths) {
+        let bucket: Map<string, string[]>;
+        if (wasmFoundSymbols.has(relPath)) {
+          bucket = realFailureBuckets;
+        } else if (wasmParsedFiles.has(relPath)) {
+          bucket = emptyFileBuckets;
+        } else {
+          bucket = wasmSkipBuckets;
+        }
+        let list = bucket.get(ext);
+        if (!list) {
+          list = [];
+          bucket.set(ext, list);
+        }
+        list.push(relPath);
+      }
+    }
+    if (realFailureBuckets.size > 0) {
+      const realCount = [...realFailureBuckets.values()].reduce((s, a) => s + a.length, 0);
+      warn(
+        `Native orchestrator dropped ${realCount} file(s) across ${realFailureBuckets.size} extension(s) in natively-supported languages — likely a Rust extractor bug. Backfilling via WASM:${formatDropExtensionSummary(realFailureBuckets)}`,
+      );
+    }
+    if (emptyFileBuckets.size > 0) {
+      const emptyCount = [...emptyFileBuckets.values()].reduce((s, a) => s + a.length, 0);
+      debug(
+        `Native orchestrator skipped ${emptyCount} file(s) in natively-supported languages that also produced 0 symbols via WASM (likely gitignored or empty); backfilling file nodes:${formatDropExtensionSummary(emptyFileBuckets)}`,
+      );
+    }
+    if (wasmSkipBuckets.size > 0) {
+      const skipCount = [...wasmSkipBuckets.values()].reduce((s, a) => s + a.length, 0);
+      debug(
+        `Native orchestrator skipped ${skipCount} file(s) in natively-supported languages that WASM also could not parse (unregistered extension or parse error); no file-node inserted:${formatDropExtensionSummary(wasmSkipBuckets)}`,
+      );
+    }
   }
-  const wasmResults = await parseFilesWasmForBackfill(missingAbs, ctx.rootDir);
+}
 
+/** Insert node rows for all backfilled files and mark exported symbols. */
+function insertBackfilledNodes(
+  db: BetterSqlite3Database,
+  wasmResults: Map<string, ExtractorOutput>,
+): void {
   const rows: unknown[][] = [];
   const exportKeys: unknown[][] = [];
   for (const [relPath, symbols] of wasmResults) {
@@ -1093,7 +1687,6 @@ async function backfillNativeDroppedFiles(
       exportKeys.push([exp.name, exp.kind, relPath, exp.line]);
     }
   }
-  const db = dbConn;
   batchInsertNodes(db, rows);
 
   // Mark exported symbols in batches — mirrors insertDefinitionsAndExports.
@@ -1120,18 +1713,26 @@ async function backfillNativeDroppedFiles(
       updateStmt.run(...vals);
     }
   }
+}
 
-  // Persist file_hashes rows for every backfilled file. The Rust orchestrator
-  // only hashes files it parsed itself, so without this step files in
-  // optional-language extensions (e.g. .clj when no Rust extractor exists)
-  // would be missing from `file_hashes` — permanently breaking the JS-side
-  // fast-skip pre-flight (#1054), which rejects on `collected file missing
-  // from file_hashes` and forces every no-op rebuild back through the full
-  // ~2s native pipeline (#1068).
-  //
-  // Iterates `missingRel` (every collected file the Rust orchestrator
-  // dropped), not `wasmResults`, so files that produced zero symbols still
-  // get a row.
+/**
+ * Persist file_hashes rows for every backfilled file.
+ *
+ * The Rust orchestrator only hashes files it parsed itself, so without this
+ * step files in optional-language extensions (e.g. .clj when no Rust extractor
+ * exists) would be missing from `file_hashes` — permanently breaking the JS-side
+ * fast-skip pre-flight (#1054), which rejects on `collected file missing
+ * from file_hashes` and forces every no-op rebuild back through the full
+ * ~2s native pipeline (#1068).
+ *
+ * Iterates `missingRel` (every collected file the Rust orchestrator dropped),
+ * not `wasmResults`, so files that produced zero symbols still get a row.
+ */
+function backfillFileHashes(
+  db: BetterSqlite3Database,
+  missingRel: string[],
+  missingAbs: string[],
+): void {
   try {
     const upsertHash = db.prepare(
       'INSERT OR REPLACE INTO file_hashes (file, hash, mtime, size) VALUES (?, ?, ?, ?)',
@@ -1161,6 +1762,79 @@ async function backfillNativeDroppedFiles(
       `backfillNativeDroppedFiles: file_hashes write failed (table may not exist): ${toErrorMessage(e)}`,
     );
   }
+}
+
+/**
+ * Backfill files that the native orchestrator silently dropped during parse.
+ * Falls back to WASM + inserts file/symbol nodes so engine counts match (#967).
+ *
+ * Also purges stale rows for WASM-only files deleted from disk (#1073), which
+ * Rust's `detect_removed_files` filter (#1070) skips.
+ *
+ * Accepts a pre-computed `gap` from `detectDroppedLanguageGap` so the caller
+ * can use the same scan for both gating and the actual backfill — avoiding
+ * a redundant fs walk when the orchestrator's signals already triggered.
+ */
+async function backfillNativeDroppedFiles(
+  ctx: PipelineContext,
+  gap: DroppedLanguageGap,
+): Promise<void> {
+  const { missingRel, missingAbs, staleRel } = gap;
+  if (missingAbs.length === 0 && staleRel.length === 0) return;
+
+  // Now that we know there's work to do, hand off to better-sqlite3 (needed
+  // for the INSERT path below).
+  if (ctx.nativeFirstProxy) {
+    closeNativeDb(ctx, 'pre-parity-backfill');
+    ctx.db = openDb(ctx.dbPath);
+    ctx.nativeFirstProxy = false;
+  }
+
+  const dbConn = ctx.db as unknown as BetterSqlite3Database;
+
+  // Purge WASM-only files that were deleted from disk (#1073). Rust's
+  // detect_removed_files skips them and the insert path below never visits
+  // them, so without this their rows would persist across rebuilds until the
+  // next full rebuild reset the DB.
+  if (staleRel.length > 0) {
+    purgeStaleWasmOnlyFiles(dbConn, staleRel);
+  }
+
+  if (missingAbs.length === 0) return;
+
+  // Parse all missing files via WASM first so we can distinguish real native
+  // extractor failures (WASM finds symbols but native didn't) from files the
+  // Rust engine legitimately skipped (gitignored artifacts, empty declaration
+  // files, etc. where WASM also produces 0 symbols). Both categories are
+  // backfilled — only the former triggers a WARN (#1566).
+  const wasmResults = await parseFilesWasmForBackfill(missingAbs, ctx.rootDir);
+
+  // Build two sets from wasmResults:
+  //   wasmParsedFiles  — rel-paths present in wasmResults (WASM succeeded, even 0 symbols)
+  //   wasmFoundSymbols — subset where WASM found ≥1 symbol
+  // Files absent from wasmParsedFiles were skipped by WASM entirely (extension
+  // not in _extToLang, wasmExtractSymbols returned null, or a read error).
+  // Those files do NOT end up in the batchInsertNodes loop below.
+  const wasmParsedFiles = new Set<string>();
+  const wasmFoundSymbols = new Set<string>();
+  for (const [relPath, symbols] of wasmResults) {
+    wasmParsedFiles.add(relPath);
+    if ((symbols.definitions?.length ?? 0) > 0 || (symbols.exports?.length ?? 0) > 0) {
+      wasmFoundSymbols.add(relPath);
+    }
+  }
+
+  // Classify drops so users see per-extension reasons instead of just a count
+  // (#1011). `unsupported-by-native` is a legitimate parser limit (no Rust
+  // extractor); `native-extractor-failure` indicates a real native bug since
+  // the language IS supported by the addon yet WASM found symbols the native
+  // engine should have extracted. Files where both engines produce 0 symbols
+  // are legitimately empty (e.g. gitignored napi-generated declaration stubs)
+  // and logged at debug level only.
+  classifyAndLogDroppedFiles(missingRel, wasmParsedFiles, wasmFoundSymbols);
+
+  insertBackfilledNodes(dbConn, wasmResults);
+  backfillFileHashes(dbConn, missingRel, missingAbs);
 
   // Free WASM parse trees from the inline backfill path (#1058).
   // `parseFilesWasmInline` sets `symbols._tree` (a live web-tree-sitter Tree
@@ -1170,23 +1844,15 @@ async function backfillNativeDroppedFiles(
   // sees them. Without this, trees leak WASM memory until process exit —
   // bounded per run but cumulative across in-process integration tests.
   // Mirrors the cleanup discipline established for #931.
-  for (const [, symbols] of wasmResults) {
-    const tree = (symbols as { _tree?: { delete?: () => void } })._tree;
-    if (tree && typeof tree.delete === 'function') {
-      try {
-        tree.delete();
-      } catch {
-        /* ignore cleanup errors */
-      }
-    }
-    (symbols as { _tree?: unknown; _langId?: unknown })._tree = undefined;
-    (symbols as { _tree?: unknown; _langId?: unknown })._langId = undefined;
-  }
+  cleanupThisDispatchWasmTrees(wasmResults);
 }
 
 /**
  * Backfill the `technique` column on `calls` edges written by the native Rust
- * orchestrator, which does not write the column itself.
+ * orchestrator, which does not write the column itself.  Also lifts any
+ * resolved ts-native edge whose confidence is below TS_NATIVE_CONFIDENCE_FLOOR
+ * to that floor value so that the name-lookup quality of the native resolver is
+ * reflected in the call-confidence metric.
  *
  * For full builds, all `calls` edges in the DB are new so a global UPDATE is
  * correct.  For incremental builds, only changed-file source nodes are updated
@@ -1207,6 +1873,12 @@ function backfillEdgeTechniquesAfterNativeOrchestrator(
     db.prepare(
       "UPDATE edges SET technique = 'ts-native' WHERE kind = 'calls' AND technique IS NULL",
     ).run();
+    // Lift resolved ts-native edges below the confidence floor.
+    db.prepare(
+      `UPDATE edges SET confidence = ?
+       WHERE kind = 'calls' AND technique = 'ts-native'
+         AND confidence > 0 AND confidence < ?`,
+    ).run(TS_NATIVE_CONFIDENCE_FLOOR, TS_NATIVE_CONFIDENCE_FLOOR);
     return;
   }
   // Incremental: scope to source nodes whose file is one of the changed files.
@@ -1223,11 +1895,235 @@ function backfillEdgeTechniquesAfterNativeOrchestrator(
            SELECT id FROM nodes WHERE file IN (${placeholders})
          )`,
       ).run(...chunk);
+      // Lift resolved ts-native edges below the confidence floor for this chunk.
+      db.prepare(
+        `UPDATE edges SET confidence = ?
+         WHERE kind = 'calls' AND technique = 'ts-native'
+           AND confidence > 0 AND confidence < ?
+           AND source_id IN (
+             SELECT id FROM nodes WHERE file IN (${placeholders})
+           )`,
+      ).run(TS_NATIVE_CONFIDENCE_FLOOR, TS_NATIVE_CONFIDENCE_FLOOR, ...chunk);
     }
   });
   tx();
 }
 
+// ── tryNativeOrchestrator helpers ────────────────────────────────────────────
+
+/**
+ * Open NativeDatabase on demand — deferred from setupPipeline to skip the
+ * ~60ms cost on no-op/early-exit builds.
+ *
+ * Closes the better-sqlite3 connection first to avoid dual-connection WAL
+ * corruption. On setup failure, falls back to reopening better-sqlite3 and
+ * leaves ctx.nativeDb undefined so the caller falls through to the JS pipeline.
+ */
+function openNativeDatabase(ctx: PipelineContext): void {
+  if (ctx.nativeDb || !ctx.nativeAvailable) return;
+  const native = loadNative();
+  if (!native?.NativeDatabase) return;
+  try {
+    // Close better-sqlite3 before opening rusqlite to avoid WAL conflicts.
+    // Uses raw close() instead of closeDb() intentionally — the advisory lock
+    // is kept and transferred to the NativeDbProxy below, not released here.
+    ctx.db.close();
+    acquireAdvisoryLock(ctx.dbPath);
+    ctx.nativeDb = native.NativeDatabase.openReadWrite(ctx.dbPath);
+    ctx.nativeDb.initSchema();
+    // Replace ctx.db with a NativeDbProxy so post-native JS fallback
+    // (structure, analysis) can use it without reopening better-sqlite3.
+    const proxy = new NativeDbProxy(ctx.nativeDb);
+    proxy.__lockPath = `${ctx.dbPath}.lock`;
+    ctx.db = proxy as unknown as typeof ctx.db;
+    ctx.nativeFirstProxy = true;
+  } catch (err) {
+    warn(`NativeDatabase setup failed, falling back to JS: ${toErrorMessage(err)}`);
+    try {
+      ctx.nativeDb?.close();
+    } catch (e) {
+      debug(`tryNativeOrchestrator: close failed during fallback: ${toErrorMessage(e)}`);
+    }
+    ctx.nativeDb = undefined;
+    ctx.nativeFirstProxy = false; // defensive: reset in case future refactors move the assignment above throwing lines
+    releaseAdvisoryLock(`${ctx.dbPath}.lock`);
+    // Reopen better-sqlite3 for JS pipeline fallback
+    ctx.db = openDb(ctx.dbPath);
+  }
+}
+
+/**
+ * Coordinate all post-native edge-writing post-passes, role re-classification,
+ * and technique backfill. Returns timing data for the build result.
+ *
+ * Post-passes run before structure/analysis so role classification sees the
+ * complete graph including CHA + this/super dispatch edges.
+ */
+async function runPostNativePasses(
+  ctx: PipelineContext,
+  result: NativeOrchestratorResult,
+): Promise<PostPassTimings & { backfillHappened: boolean }> {
+  // Engine parity: the native orchestrator silently drops files whose
+  // Rust extractor/grammar is missing or fails (e.g. HCL, Scala, Swift on
+  // stale native binaries). WASM handles those — backfill via WASM so both
+  // engines process the same file set (#967).
+  //
+  // Detect the gap once (fs walk + 2 DB queries) and use it for both gating
+  // and the backfill itself. On quiet incrementals we still pay the walk so
+  // we can detect brand-new files in dropped-language extensions — a gap that
+  // the orchestrator's `detect_removed_files` filter (#1070) leaves open
+  // (#1083, #1091). The pre-check is cheap because the expensive part (WASM
+  // re-parse of the missing set) is gated below.
+  const gapDetectStart = performance.now();
+  const gap = detectDroppedLanguageGap(ctx);
+  const backfillHappened = gap.missingAbs.length > 0 || gap.staleRel.length > 0;
+  if (backfillHappened) {
+    await backfillNativeDroppedFiles(ctx, gap);
+  }
+  const gapDetectMs = performance.now() - gapDetectStart;
+
+  // Phase 8.5: this/super dispatch — hybrid WASM re-parse to resolve call sites
+  // whose raw receiver info the Rust pipeline does not persist to DB.
+  // Runs BEFORE the CHA expansion pass so that super.method() → Parent.method edges
+  // (technique='cha') are in the DB when runPostNativeCha expands them to sibling
+  // class overrides (e.g. PostMixin.m → B.m when PostMixin and B both extend A).
+  const {
+    elapsedMs: thisDispatchMs,
+    targetIds: thisDispatchTargetIds,
+    affectedFiles: thisDispatchAffectedFiles,
+  } = await runPostNativeThisDispatch(
+    ctx.db as unknown as BetterSqlite3Database,
+    ctx.rootDir,
+    result.changedFiles,
+    !!result.isFullBuild,
+  );
+
+  // Phase 8.6: expand CHA call edges (interface dispatch → concrete implementations).
+  // Returns the affected files so role re-classification below can be scoped to
+  // the nodes whose fan-in/out actually changed.
+  //
+  // Runs AFTER this/super dispatch so super.method() edges are already in the DB.
+  // The 'cha-expanded' technique tag on this pass's own output prevents re-expansion
+  // of those edges in subsequent incremental builds, while 'cha'-tagged edges from
+  // this/super dispatch remain eligible for expansion here.
+  //
+  // Function-as-object-property methods (`fn.method = function() {}`) are extracted
+  // natively by the Rust engine (#1432) and resolved in-build by its edge builder, so
+  // no WASM re-parse post-pass is needed for them. `Foo.prototype.bar = fn` likewise.
+  const chaStart = performance.now();
+  const { newEdgeCount: chaEdgeCount, affectedFiles: chaAffectedFiles } = runPostNativeCha(
+    ctx.db as unknown as BetterSqlite3Database,
+    // null = full build (scan all call→method edges); array = incremental (gate queries decide scope)
+    result.isFullBuild ? null : (result.changedFiles ?? null),
+  );
+  const chaMs = performance.now() - chaStart;
+
+  // Role re-classification after the Rust orchestrator build.
+  //
+  // Two reasons to re-classify:
+  //
+  // 1. Post-pass edges (CHA, this-dispatch): the Rust orchestrator classifies
+  //    roles before these passes add edges, so fan-in/out for their endpoints
+  //    is stale. On incremental builds, scope to the affected files for speed.
+  //
+  // 2. hasActiveFileSiblings parity: the Rust classifier does not implement the
+  //    JS hasActiveFileSiblings heuristic. That heuristic promotes functions with
+  //    fan_in=0 but fan_out>0 to 'leaf' when their file has other connected
+  //    callables — preventing false dead-unresolved classifications for functions
+  //    like `main` or `square` that call others but are never called themselves.
+  //    On full builds, always run a full JS re-classification so the Rust roles
+  //    are replaced by the canonical JS classifier output (#1659).
+  //
+  // Strategy:
+  //   - Full build: always run full JS classifyNodeRoles(db, null).
+  //   - Incremental build with post-pass edges: run scoped re-classification
+  //     for the affected files (same as before). The full-build pass already
+  //     produced correct JS roles for all unchanged files on the previous build.
+  //   - Incremental build with no post-pass edges: skip re-classification
+  //     (Rust roles on unchanged files are not stale, and the heuristic gap
+  //     was corrected on the last full build).
+  let reclassifyMs = 0;
+  const needsFullReclassify = !!result.isFullBuild;
+  const needsScopedReclassify =
+    !needsFullReclassify && (chaEdgeCount > 0 || thisDispatchTargetIds.size > 0);
+  if (needsFullReclassify || needsScopedReclassify) {
+    let scopedFiles: string[] | null = null;
+    if (needsScopedReclassify) {
+      const affectedFiles = [...new Set([...chaAffectedFiles, ...thisDispatchAffectedFiles])];
+      // When edges were inserted but all their endpoint nodes have null `file`
+      // columns (rare but possible), affectedFiles stays empty even though
+      // fan-in/out changed. Fall back to full-graph re-classification in that
+      // case — scoped classification with an empty set would be a no-op, leaving
+      // roles stale for those nodes.
+      scopedFiles = affectedFiles.length > 0 ? affectedFiles : null;
+    }
+    const reclassifyStart = performance.now();
+    try {
+      const { classifyNodeRoles } = (await import('../../../../features/structure.js')) as {
+        classifyNodeRoles: (
+          db: BetterSqlite3Database,
+          changedFiles?: string[] | null,
+        ) => Record<string, number>;
+      };
+      classifyNodeRoles(ctx.db as unknown as BetterSqlite3Database, scopedFiles);
+      debug(
+        scopedFiles
+          ? `Post-pass role re-classification complete (${scopedFiles.length} file(s))`
+          : 'Post-pass role re-classification complete (full graph)',
+      );
+    } catch (err) {
+      debug(`Post-pass role re-classification failed: ${toErrorMessage(err)}`);
+    }
+    reclassifyMs = performance.now() - reclassifyStart;
+  }
+
+  // Backfill the `technique` column on `calls` edges written by the Rust
+  // orchestrator, which does not write the column. Runs after all edge-writing
+  // phases (including the WASM dropped-language backfill, CHA post-pass, and
+  // this/super dispatch) so every new edge in this build cycle gets a label.
+  const techniqueBackfillStart = performance.now();
+  backfillEdgeTechniquesAfterNativeOrchestrator(ctx.db, !!result.isFullBuild, result.changedFiles);
+  const techniqueBackfillMs = performance.now() - techniqueBackfillStart;
+
+  // Re-count nodes/edges now that all edge-writing post-passes have run: the
+  // Rust orchestrator captured its counts before the JS post-passes added
+  // edges, so both its summary and build_meta under-report (#1452).
+  //
+  // Fast path: skip the COUNT(*) scan when no post-pass wrote any edges.
+  // COUNT(*) on large tables (50K+ edges) is non-trivial, especially via the
+  // NativeDbProxy napi-rs round-trip. When all post-passes were no-ops, the
+  // Rust orchestrator's counts are still accurate — no re-count needed.
+  let finalNodeCount = result.nodeCount ?? 0;
+  let finalEdgeCount = result.edgeCount ?? 0;
+  const postPassWroteData = backfillHappened || chaEdgeCount > 0 || thisDispatchTargetIds.size > 0;
+  if (postPassWroteData) {
+    try {
+      const counts = (ctx.db as unknown as BetterSqlite3Database)
+        .prepare('SELECT (SELECT COUNT(*) FROM nodes) AS n, (SELECT COUNT(*) FROM edges) AS e')
+        .get() as { n: number; e: number };
+      if (counts.n !== finalNodeCount || counts.e !== finalEdgeCount) {
+        finalNodeCount = counts.n;
+        finalEdgeCount = counts.e;
+        setBuildMeta(ctx.db, { node_count: finalNodeCount, edge_count: finalEdgeCount });
+      }
+    } catch (err) {
+      debug(`Post-pass node/edge re-count failed: ${toErrorMessage(err)}`);
+    }
+  }
+  info(
+    `Native build orchestrator completed: ${finalNodeCount} nodes, ${finalEdgeCount} edges, ${result.fileCount ?? 0} files`,
+  );
+
+  return {
+    gapDetectMs,
+    chaMs,
+    thisDispatchMs,
+    reclassifyMs,
+    techniqueBackfillMs,
+    backfillHappened,
+  };
+}
+
 /**
  * Try the native build orchestrator.
  *
@@ -1251,50 +2147,44 @@ export async function tryNativeOrchestrator(
     return undefined;
   }
 
-  // Open NativeDatabase on demand — deferred from setupPipeline to skip the
-  // ~60ms cost on no-op/early-exit builds. Close the better-sqlite3 connection
-  // first to avoid dual-connection WAL corruption.
-  if (!ctx.nativeDb && ctx.nativeAvailable) {
-    const native = loadNative();
-    if (native?.NativeDatabase) {
-      try {
-        // Close better-sqlite3 before opening rusqlite to avoid WAL conflicts.
-        // Uses raw close() instead of closeDb() intentionally — the advisory lock
-        // is kept and transferred to the NativeDbProxy below, not released here.
-        ctx.db.close();
-        acquireAdvisoryLock(ctx.dbPath);
-        ctx.nativeDb = native.NativeDatabase.openReadWrite(ctx.dbPath);
-        ctx.nativeDb.initSchema();
-        // Replace ctx.db with a NativeDbProxy so post-native JS fallback
-        // (structure, analysis) can use it without reopening better-sqlite3.
-        const proxy = new NativeDbProxy(ctx.nativeDb);
-        proxy.__lockPath = `${ctx.dbPath}.lock`;
-        ctx.db = proxy as unknown as typeof ctx.db;
-        ctx.nativeFirstProxy = true;
-      } catch (err) {
-        warn(`NativeDatabase setup failed, falling back to JS: ${toErrorMessage(err)}`);
-        try {
-          ctx.nativeDb?.close();
-        } catch (e) {
-          debug(`tryNativeOrchestrator: close failed during fallback: ${toErrorMessage(e)}`);
-        }
-        ctx.nativeDb = undefined;
-        ctx.nativeFirstProxy = false; // defensive: reset in case future refactors move the assignment above throwing lines
-        releaseAdvisoryLock(`${ctx.dbPath}.lock`);
-        // Reopen better-sqlite3 for JS pipeline fallback
-        ctx.db = openDb(ctx.dbPath);
-      }
-    }
-  }
+  openNativeDatabase(ctx);
 
   if (!ctx.nativeDb?.buildGraph) return undefined;
 
-  const resultJson = ctx.nativeDb.buildGraph(
-    ctx.rootDir,
-    JSON.stringify(ctx.config),
-    JSON.stringify(ctx.aliases),
-    JSON.stringify(ctx.opts),
-  );
+  // The previous full build's clear_all_graph_data() sets PRAGMA foreign_keys = ON
+  // on the native connection. Older native binaries (< v3.14) do not delete
+  // dataflow_vertices / dataflow_summary / call_edge_id rows before purging
+  // nodes/edges during incremental builds, so FK enforcement causes the purge
+  // statements to fail silently — leaving stale nodes and edges that then get
+  // duplicated when the barrel-candidate re-parse re-inserts them (issue #1644).
+  // Disabling FK before buildGraph() lets the purge succeed; FK is restored in
+  // a finally block so post-passes (gap-repair, structure patch) retain FK protection
+  // even if buildGraph() throws.
+  try {
+    ctx.nativeDb.exec('PRAGMA foreign_keys = OFF');
+  } catch {
+    // exec may not exist on very old addon versions — safe to ignore
+  }
+
+  let resultJson: string;
+  try {
+    resultJson = ctx.nativeDb.buildGraph(
+      ctx.rootDir,
+      JSON.stringify(ctx.config),
+      JSON.stringify(ctx.aliases),
+      JSON.stringify(ctx.opts),
+    );
+  } finally {
+    // Restore FK enforcement so any subsequent writes to this connection
+    // (gap-repair, structure patch) retain FK protection — even if buildGraph()
+    // throws.
+    try {
+      ctx.nativeDb.exec('PRAGMA foreign_keys = ON');
+    } catch {
+      // safe to ignore on very old addon versions
+    }
+  }
+
   const result = JSON.parse(resultJson) as NativeOrchestratorResult;
 
   if (result.earlyExit) {
@@ -1302,7 +2192,7 @@ export async function tryNativeOrchestrator(
     // Even on no-op rebuilds, dropped-language files added since the last
     // full build are still missing from `nodes`/`file_hashes` (#1083), and
     // WASM-only files deleted from disk leave stale rows behind (#1073).
-    // The orchestrator's file_collector skipped them, so its earlyExit
+    // The orchestrator's collect_files skipped them, so its earlyExit
     // doesn't imply DB consistency. Run the gap repair before returning.
     const gap = detectDroppedLanguageGap(ctx);
     if (gap.missingAbs.length > 0 || gap.staleRel.length > 0) {
@@ -1344,9 +2234,9 @@ export async function tryNativeOrchestrator(
     built_at: new Date().toISOString(),
   });
 
-  info(
-    `Native build orchestrator completed: ${result.nodeCount ?? 0} nodes, ${result.edgeCount ?? 0} edges, ${result.fileCount ?? 0} files`,
-  );
+  // The build summary is logged after the JS edge-writing post-passes below
+  // (dropped-language backfill, CHA, this/super dispatch) so the reported
+  // counts include their edges (#1452).
 
   // ── Post-native structure + analysis ──────────────────────────────
   let analysisTiming = {
@@ -1381,103 +2271,18 @@ export async function tryNativeOrchestrator(
       ctx.db = openDb(ctx.dbPath);
       ctx.nativeFirstProxy = false;
     } else if (!ctx.nativeFirstProxy && !handoffWalAfterNativeBuild(ctx)) {
-      // DB reopen failed — return partial result
-      return formatNativeTimingResult(p, 0, analysisTiming, 0);
-    }
-  }
-
-  // ── Edge-writing post-passes (run before structure so roles see full graph) ──
-
-  // Engine parity: the native orchestrator silently drops files whose
-  // Rust extractor/grammar is missing or fails (e.g. HCL, Scala, Swift on
-  // stale native binaries). WASM handles those — backfill via WASM so both
-  // engines process the same file set (#967).
-  //
-  // Detect the gap once (fs walk + 2 DB queries, ~20–30ms) and use it for
-  // both gating and the backfill itself. On dirty incrementals/full builds
-  // the orchestrator signals trigger backfill, so the walk happens once
-  // (instead of redundantly inside backfill). On quiet incrementals we
-  // still pay the walk so we can detect brand-new files in dropped-language
-  // extensions — a gap that the orchestrator's `detect_removed_files`
-  // filter (#1070) leaves open (#1083, #1091). The pre-check is cheap
-  // because the expensive part (WASM re-parse of the missing set) is
-  // gated below.
-  const removedCount = result.removedCount ?? 0;
-  const changedCount = result.changedCount ?? 0;
-  const gap = detectDroppedLanguageGap(ctx);
-  if (
-    result.isFullBuild ||
-    removedCount > 0 ||
-    changedCount > 0 ||
-    gap.missingAbs.length > 0 ||
-    gap.staleRel.length > 0
-  ) {
-    await backfillNativeDroppedFiles(ctx, gap);
-  }
-
-  // Phase 8.5: expand CHA call edges (interface dispatch → concrete implementations).
-  // Returns the affected files so role re-classification below can be scoped to
-  // the nodes whose fan-in/out actually changed.
-  //
-  // Function-as-object-property methods (`fn.method = function() {}`) are extracted
-  // natively by the Rust engine (#1432) and resolved in-build by its edge builder, so
-  // no WASM re-parse post-pass is needed for them. `Foo.prototype.bar = fn` likewise.
-  const { newEdgeCount: chaEdgeCount, affectedFiles: chaAffectedFiles } = runPostNativeCha(
-    ctx.db as unknown as BetterSqlite3Database,
-  );
-
-  // Phase 8.5: this/super dispatch — hybrid WASM re-parse to resolve call sites
-  // whose raw receiver info the Rust pipeline does not persist to DB.
-  const {
-    elapsedMs: thisDispatchMs,
-    targetIds: thisDispatchTargetIds,
-    affectedFiles: thisDispatchAffectedFiles,
-  } = await runPostNativeThisDispatch(
-    ctx.db as unknown as BetterSqlite3Database,
-    ctx.rootDir,
-    result.changedFiles,
-    !!result.isFullBuild,
-  );
-
-  // Role re-classification after JS edge-writing post-passes.
-  // The Rust orchestrator classifies roles before these post-passes (CHA,
-  // this-dispatch) add edges, so roles for the edge endpoints are stale.
-  // Scoped to the files containing those endpoints: a new edge only changes
-  // fan-in/out for its own source and target nodes, so re-classifying their
-  // files restores correctness without re-running the classifier over the
-  // whole graph (which cost ~130ms per build on codegraph itself and was a
-  // major part of the v3.12.0 native full-build benchmark regression).
-  if (chaEdgeCount > 0 || thisDispatchTargetIds.size > 0) {
-    const affectedFiles = [...new Set([...chaAffectedFiles, ...thisDispatchAffectedFiles])];
-    // When edges were inserted but all their endpoint nodes have null `file`
-    // columns (rare but possible), affectedFiles stays empty even though
-    // fan-in/out changed. Fall back to full-graph re-classification in that
-    // case — scoped classification with an empty set would be a no-op, leaving
-    // roles stale for those nodes.
-    const scopedFiles = affectedFiles.length > 0 ? affectedFiles : null;
-    try {
-      const { classifyNodeRoles } = (await import('../../../../features/structure.js')) as {
-        classifyNodeRoles: (
-          db: BetterSqlite3Database,
-          changedFiles?: string[] | null,
-        ) => Record<string, number>;
-      };
-      classifyNodeRoles(ctx.db as unknown as BetterSqlite3Database, scopedFiles);
-      debug(
-        scopedFiles
-          ? `Post-pass role re-classification complete (${scopedFiles.length} file(s))`
-          : 'Post-pass role re-classification complete (full graph — null-file endpoints)',
-      );
-    } catch (err) {
-      debug(`Post-pass role re-classification failed: ${toErrorMessage(err)}`);
+      // DB reopen failed — return partial result (no post-pass phases completed)
+      return formatNativeTimingResult(p, 0, analysisTiming, {
+        gapDetectMs: 0,
+        chaMs: 0,
+        thisDispatchMs: 0,
+        reclassifyMs: 0,
+        techniqueBackfillMs: 0,
+      });
     }
   }
 
-  // Backfill the `technique` column on `calls` edges written by the Rust
-  // orchestrator, which does not write the column. Runs after all edge-writing
-  // phases (including the WASM dropped-language backfill, CHA post-pass, and
-  // this/super dispatch) so every new edge in this build cycle gets a label.
-  backfillEdgeTechniquesAfterNativeOrchestrator(ctx.db, !!result.isFullBuild, result.changedFiles);
+  const postPassTimings = await runPostNativePasses(ctx, result);
 
   // ── Structure and analysis fallback (run after edge-writing so roles see full graph) ──
   // Reconstruct fileSymbols once for both structure and analysis to avoid two
@@ -1500,6 +2305,17 @@ export async function tryNativeOrchestrator(
     }
   }
 
+  // P6: Vertex extraction for the analysisComplete=true path.
+  // When needsAnalysisFallback=false (the normal native case), runPostNativeAnalysis
+  // was skipped, so buildDataflowEdges never ran and dataflow_vertices were never
+  // populated. Re-run the Rust dataflow visitor per file (fast — no re-parse) to
+  // get the DataflowResult, then build vertices and inter-procedural edges.
+  // Languages where Rust has no dataflow rules are silently skipped; a WASM
+  // fallback for those is tracked in issue #1614.
+  if (ctx.opts.dataflow !== false && !needsAnalysisFallback) {
+    await runDataflowVertexPass(ctx, result.changedFiles);
+  }
+
   closeDbPair({ db: ctx.db, nativeDb: ctx.nativeDb });
-  return formatNativeTimingResult(p, structurePatchMs, analysisTiming, thisDispatchMs);
+  return formatNativeTimingResult(p, structurePatchMs, analysisTiming, postPassTimings);
 }