@optave/codegraph 3.12.0 → 3.15.0

package/src/features/dataflow.ts

@@ -184,6 +184,70 @@ interface Mutation {
   line: number;
 }
 
+// ── P1: Visitor internal shapes ───────────────────────────────────────────────
+// The visitor's finish() emits DataflowResultInternal with richer types than
+// the public DataflowResult in types.ts. We cast here to access paramName,
+// paramIndex, and referencedNames which the public type omits.
+
+interface VisitorParam {
+  funcName: string;
+  paramName: string;
+  paramIndex: number;
+  line: number;
+}
+
+interface VisitorReturn {
+  funcName: string;
+  expression: string;
+  referencedNames: string[];
+  line: number;
+}
+
+interface VisitorAssignment {
+  varName: string;
+  callerFunc: string;
+  sourceCallName: string;
+  line: number;
+}
+
+interface VisitorArgFlow {
+  callerFunc: string;
+  calleeName: string;
+  argIndex: number;
+  argName: string;
+  binding: { type: string; index?: number };
+  confidence: number;
+  expression: string;
+  line: number;
+}
+
+interface VisitorMutation {
+  funcName: string;
+  binding: { type: string; index?: number };
+}
+
+// ── P2: interprocedural stitch data collected during per-file processing ──
+
+/** A resolved argFlow candidate for the inter-procedural stitch post-pass. */
+interface StitchCandidate {
+  callerFuncId: number;
+  calleeFuncId: number;
+  argIndex: number;
+  bindingType: string;
+  bindingIndex?: number;
+  argName: string;
+  expression: string;
+  line: number;
+  confidence: number;
+}
+
+/** An assignment that captures a function's return value into a local. */
+interface ReturnCapture {
+  callerFuncId: number;
+  calleeFuncId: number;
+  varName: string;
+}
+
 function insertDataflowEdges(
   insert: { run(...params: unknown[]): unknown },
   data: DataflowResult,
@@ -236,8 +300,426 @@ function insertDataflowEdges(
   return edgeCount;
 }
 
+// ── P1: dataflow_vertices + intra def_use edges ───────────────────────────────
+
+function prepareVertexStmts(db: BetterSqlite3Database): {
+  insertVertex: ReturnType<BetterSqlite3Database['prepare']>;
+  insertIntraEdge: ReturnType<BetterSqlite3Database['prepare']>;
+  available: boolean;
+} {
+  try {
+    return {
+      insertVertex: db.prepare(
+        `INSERT INTO dataflow_vertices (func_id, kind, name, param_index, line, node_id)
+         VALUES (?, ?, ?, ?, ?, ?)`,
+      ),
+      insertIntraEdge: db.prepare(
+        `INSERT INTO dataflow
+           (source_id, target_id, kind, source_vertex, target_vertex, scope, expression, line, confidence)
+         VALUES (?, ?, 'def_use', ?, ?, 'intra', ?, ?, 1.0)`,
+      ),
+      available: true,
+    };
+  } catch {
+    return {
+      insertVertex: db.prepare('SELECT 1'),
+      insertIntraEdge: db.prepare('SELECT 1'),
+      available: false,
+    };
+  }
+}
+
+/**
+ * Build dataflow_vertices, intra def_use edges, and summaries for one file.
+ * Called alongside insertDataflowEdges in the same transaction.
+ *
+ * Returns stitch candidates and return captures for the P2 inter-procedural
+ * post-pass (run after all files are processed).
+ */
+function buildDataflowVerticesAndEdges(
+  db: BetterSqlite3Database,
+  vstmts: ReturnType<typeof prepareVertexStmts>,
+  data: DataflowResult,
+  resolveNode: (name: string) => { id: number } | null,
+): { candidates: StitchCandidate[]; captures: ReturnCapture[] } {
+  const empty: { candidates: StitchCandidate[]; captures: ReturnCapture[] } = {
+    candidates: [],
+    captures: [],
+  };
+  if (!vstmts.available) return empty;
+
+  const params = data.parameters as unknown as VisitorParam[];
+  const returns = data.returns as unknown as VisitorReturn[];
+  const assignments = data.assignments as unknown as VisitorAssignment[];
+  const argFlows = data.argFlows as unknown as VisitorArgFlow[];
+  const mutations = data.mutations as unknown as VisitorMutation[];
+
+  // 1. param vertices
+  const paramVertexIds = new Map<string, number>(); // "funcName:paramName" → vertex id
+  const paramIndexByFuncAndIndex = new Map<string, number>(); // "funcId:paramIndex" → vertex id
+  for (const p of params) {
+    const fn = resolveNode(p.funcName);
+    if (!fn) continue;
+    const result = vstmts.insertVertex.run(fn.id, 'param', p.paramName, p.paramIndex, p.line, null);
+    const vid = (result as { lastInsertRowid: number }).lastInsertRowid;
+    paramVertexIds.set(`${p.funcName}:${p.paramName}`, vid);
+    paramIndexByFuncAndIndex.set(`${fn.id}:${p.paramIndex}`, vid);
+  }
+
+  // 2. return vertices (one per function that has a return statement)
+  const returnVertexIds = new Map<string, number>(); // funcName → vertex id
+  const returnFuncsSeen = new Set<string>();
+  for (const r of returns) {
+    if (returnFuncsSeen.has(r.funcName)) continue;
+    returnFuncsSeen.add(r.funcName);
+    const fn = resolveNode(r.funcName);
+    if (!fn) continue;
+    const result = vstmts.insertVertex.run(fn.id, 'return', null, null, r.line, null);
+    returnVertexIds.set(r.funcName, (result as { lastInsertRowid: number }).lastInsertRowid);
+  }
+
+  // 3. local vertices (from call-return assignments)
+  const localVertexIds = new Map<string, number>(); // "funcName:varName" → vertex id
+  const localsSeen = new Set<string>();
+  for (const a of assignments) {
+    const key = `${a.callerFunc}:${a.varName}`;
+    if (localsSeen.has(key)) continue;
+    localsSeen.add(key);
+    const fn = resolveNode(a.callerFunc);
+    if (!fn) continue;
+    const result = vstmts.insertVertex.run(fn.id, 'local', a.varName, null, a.line, null);
+    localVertexIds.set(key, (result as { lastInsertRowid: number }).lastInsertRowid);
+  }
+
+  // 4. intra def_use edges: param/local → return
+  for (const r of returns) {
+    const fn = resolveNode(r.funcName);
+    if (!fn) continue;
+    const returnVid = returnVertexIds.get(r.funcName);
+    if (!returnVid) continue;
+    for (const name of r.referencedNames) {
+      const paramVid = paramVertexIds.get(`${r.funcName}:${name}`);
+      if (paramVid) {
+        vstmts.insertIntraEdge.run(fn.id, fn.id, paramVid, returnVid, r.expression, r.line);
+      }
+      const localVid = localVertexIds.get(`${r.funcName}:${name}`);
+      if (localVid) {
+        vstmts.insertIntraEdge.run(fn.id, fn.id, localVid, returnVid, r.expression, r.line);
+      }
+    }
+  }
+
+  // 5. summaries: flows_to_return = direct def_use from param to function's return
+  const checkDefUse = db.prepare(
+    `SELECT 1 FROM dataflow WHERE source_vertex = ? AND target_vertex = ? AND kind = 'def_use' LIMIT 1`,
+  );
+  const insertSummary = db.prepare(
+    `INSERT OR REPLACE INTO dataflow_summary (func_id, param_index, flows_to_return, is_mutated) VALUES (?, ?, ?, ?)`,
+  );
+
+  for (const p of params) {
+    const fn = resolveNode(p.funcName);
+    if (!fn) continue;
+    const paramVid = paramVertexIds.get(`${p.funcName}:${p.paramName}`);
+    if (!paramVid) continue;
+    const returnVid = returnVertexIds.get(p.funcName);
+    const flowsToReturn = returnVid ? (checkDefUse.get(paramVid, returnVid) ? 1 : 0) : 0;
+    const isMutated = mutations.some(
+      (m) =>
+        m.funcName === p.funcName &&
+        m.binding?.type === 'param' &&
+        m.binding?.index === p.paramIndex,
+    )
+      ? 1
+      : 0;
+    insertSummary.run(fn.id, p.paramIndex, flowsToReturn, isMutated);
+  }
+
+  // 6. collect stitch candidates for P2 inter-procedural post-pass
+  const candidates: StitchCandidate[] = [];
+  for (const af of argFlows) {
+    const callerFn = resolveNode(af.callerFunc);
+    const calleeFn = resolveNode(af.calleeName);
+    if (!callerFn || !calleeFn) continue;
+    candidates.push({
+      callerFuncId: callerFn.id,
+      calleeFuncId: calleeFn.id,
+      argIndex: af.argIndex,
+      bindingType: af.binding.type,
+      bindingIndex: af.binding.index,
+      argName: af.argName,
+      expression: af.expression,
+      line: af.line,
+      confidence: af.confidence,
+    });
+  }
+
+  // 7. collect return captures (locals that hold a callee's return value)
+  const captures: ReturnCapture[] = [];
+  for (const a of assignments) {
+    const callerFn = resolveNode(a.callerFunc);
+    const calleeFn = resolveNode(a.sourceCallName);
+    if (!callerFn || !calleeFn) continue;
+    captures.push({ callerFuncId: callerFn.id, calleeFuncId: calleeFn.id, varName: a.varName });
+  }
+
+  return { candidates, captures };
+}
+
+// ── P2: interprocedural stitching ─────────────────────────────────────────────
+
+/**
+ * Core stitch logic — must be called inside an already-open transaction.
+ *
+ * All callers (buildDataflowVerticesFromMap, buildDataflowEdges,
+ * buildDataflowP4ForNative) manage their own outer transaction and call this
+ * directly to avoid nested transactions, which better-sqlite3 does not support.
+ */
+function runInterproceduralStitch(
+  db: BetterSqlite3Database,
+  candidates: StitchCandidate[],
+  captures: ReturnCapture[],
+): number {
+  if (candidates.length === 0) return 0;
+
+  const getParamVertex = db.prepare(
+    `SELECT id FROM dataflow_vertices WHERE func_id = ? AND kind = 'param' AND param_index = ? LIMIT 1`,
+  );
+  const getLocalVertex = db.prepare(
+    `SELECT id FROM dataflow_vertices WHERE func_id = ? AND kind = 'local' AND name = ? LIMIT 1`,
+  );
+  const getReturnVertex = db.prepare(
+    `SELECT id FROM dataflow_vertices WHERE func_id = ? AND kind = 'return' LIMIT 1`,
+  );
+  const getCallEdge = db.prepare(
+    `SELECT id FROM edges WHERE source_id = ? AND target_id = ? AND kind = 'calls' LIMIT 1`,
+  );
+  const getSummary = db.prepare(
+    `SELECT flows_to_return FROM dataflow_summary WHERE func_id = ? AND param_index = ?`,
+  );
+  const insertInterEdge = db.prepare(
+    `INSERT INTO dataflow
+       (source_id, target_id, kind, source_vertex, target_vertex, scope, call_edge_id, expression, line, confidence)
+     VALUES (?, ?, ?, ?, ?, 'inter', ?, ?, ?, ?)`,
+  );
+
+  // Build capture map: "callerFuncId:calleeFuncId" → varName (first match wins)
+  const captureMap = new Map<string, string>();
+  for (const cap of captures) {
+    const key = `${cap.callerFuncId}:${cap.calleeFuncId}`;
+    if (!captureMap.has(key)) captureMap.set(key, cap.varName);
+  }
+
+  let count = 0;
+  for (const cand of candidates) {
+    // Resolve call edge for this site
+    const callEdge = getCallEdge.get(cand.callerFuncId, cand.calleeFuncId) as {
+      id: number;
+    } | null;
+    const callEdgeId = callEdge?.id ?? null;
+
+    // Find source vertex x in caller
+    let srcVertexId: number | null = null;
+    if (cand.bindingType === 'param' && cand.bindingIndex != null) {
+      const v = getParamVertex.get(cand.callerFuncId, cand.bindingIndex) as { id: number } | null;
+      srcVertexId = v?.id ?? null;
+    } else if (cand.bindingType === 'local') {
+      const v = getLocalVertex.get(cand.callerFuncId, cand.argName) as { id: number } | null;
+      srcVertexId = v?.id ?? null;
+    }
+
+    if (!srcVertexId) continue;
+
+    // Find callee's param[argIndex] vertex
+    const calleeParam = getParamVertex.get(cand.calleeFuncId, cand.argIndex) as {
+      id: number;
+    } | null;
+    if (!calleeParam) continue;
+
+    // arg_in: A's source → B.param[j]
+    insertInterEdge.run(
+      cand.callerFuncId,
+      cand.calleeFuncId,
+      'arg_in',
+      srcVertexId,
+      calleeParam.id,
+      callEdgeId,
+      cand.expression,
+      cand.line,
+      cand.confidence,
+    );
+    count++;
+
+    // return_out: if B.param[j] reaches B's return, emit B.return → A's capture
+    const summary = getSummary.get(cand.calleeFuncId, cand.argIndex) as {
+      flows_to_return: number;
+    } | null;
+    if (summary?.flows_to_return) {
+      const calleeReturn = getReturnVertex.get(cand.calleeFuncId) as { id: number } | null;
+      if (calleeReturn) {
+        const captureVarName = captureMap.get(`${cand.callerFuncId}:${cand.calleeFuncId}`);
+        const captureVertex = captureVarName
+          ? (getLocalVertex.get(cand.callerFuncId, captureVarName) as { id: number } | null)
+          : null;
+        if (captureVertex) {
+          insertInterEdge.run(
+            cand.calleeFuncId,
+            cand.callerFuncId,
+            'return_out',
+            calleeReturn.id,
+            captureVertex.id,
+            callEdgeId,
+            cand.expression,
+            cand.line,
+            cand.confidence,
+          );
+          count++;
+        }
+      }
+    }
+  }
+
+  return count;
+}
+
 // ── buildDataflowEdges ──────────────────────────────────────────────────────
 
+// ── P4 helpers ───────────────────────────────────────────────────────────────
+
+/** Return IDs of all function/method nodes in the given relative file paths. */
+export function collectFuncIdsForFiles(
+  db: BetterSqlite3Database,
+  relPaths: Iterable<string>,
+): number[] {
+  const stmt = db.prepare(`SELECT id FROM nodes WHERE file = ? AND kind IN ('function', 'method')`);
+  const ids: number[] = [];
+  for (const p of relPaths) {
+    for (const row of stmt.all(p) as { id: number }[]) ids.push(row.id);
+  }
+  return ids;
+}
+
+/**
+ * P4: Re-collect stitch candidates from caller files that were NOT in the
+ * changed set but contain calls to functions that WERE changed.
+ *
+ * During an incremental build the changed files' param vertices are purged
+ * and recreated, but the callers' files are never re-parsed — so their
+ * arg_in edges (pointing to the old param vertices) are deleted and never
+ * replaced. This function reads those caller files from disk and rebuilds
+ * the StitchCandidate list so runInterproceduralStitch can reconnect them.
+ */
+export async function collectCallerStitchCandidates(
+  db: BetterSqlite3Database,
+  changedFuncIds: number[],
+  changedRelPaths: Set<string>,
+  rootDir: string,
+  extToLang: Map<string, string>,
+  parsers: unknown,
+  getParserFn: ((parsers: any, absPath: string) => any) | null,
+): Promise<{ candidates: StitchCandidate[]; captures: ReturnCapture[] }> {
+  if (changedFuncIds.length === 0) return { candidates: [], captures: [] };
+
+  // Find distinct caller files that have flows_to edges targeting any changed
+  // function and are NOT already in the changed file set (those are handled by
+  // the main per-file loop).
+  //
+  // Chunk the query to avoid exceeding SQLite's SQLITE_MAX_VARIABLE_NUMBER
+  // (999 on older builds, 32766 on SQLite ≥ 3.32).  500 is a safe batch size
+  // that works across all SQLite versions.
+  const CHUNK_SIZE = 500;
+  const callerFileSet = new Set<string>();
+  for (let i = 0; i < changedFuncIds.length; i += CHUNK_SIZE) {
+    const chunk = changedFuncIds.slice(i, i + CHUNK_SIZE);
+    const placeholders = chunk.map(() => '?').join(',');
+    const rows = db
+      .prepare(
+        `SELECT DISTINCT n.file AS caller_file
+         FROM dataflow d
+         JOIN nodes n ON n.id = d.source_id
+         WHERE d.target_id IN (${placeholders})
+           AND d.kind = 'flows_to'`,
+      )
+      .all(...chunk) as { caller_file: string }[];
+    for (const r of rows) callerFileSet.add(r.caller_file);
+  }
+  const callerFileRows = [...callerFileSet].map((f) => ({ caller_file: f }));
+
+  const callerFiles = callerFileRows
+    .map((r) => r.caller_file)
+    .filter((f) => !changedRelPaths.has(f));
+
+  if (callerFiles.length === 0) return { candidates: [], captures: [] };
+
+  // Ensure parsers are available — the main loop may have skipped loading them
+  // if all changed files came through the native bulk-insert path.
+  let activeParsers = parsers;
+  let activeGetParserFn = getParserFn;
+  if (!activeGetParserFn) {
+    const { createParsers, getParser } = await import('../domain/parser.js');
+    activeParsers = await createParsers();
+    activeGetParserFn = getParser;
+  }
+
+  const changedFuncIdSet = new Set(changedFuncIds);
+  const stmts = prepareNodeResolvers(db);
+  const candidates: StitchCandidate[] = [];
+  const captures: ReturnCapture[] = [];
+
+  for (const callerFile of callerFiles) {
+    // Read the caller file from disk without touching its existing DB rows.
+    // definitions: [] is an intentional stub — P4 only needs argFlow/assignment
+    // data from the visitor, not pre-loaded symbol definitions.  extractDataflow
+    // does not currently use _definitions, so this is safe.  If that changes,
+    // the stub must be replaced with the actual symbol list for the caller file.
+    const stub: FileSymbolsDataflow = { definitions: [], _langId: null, _tree: null };
+    const data = getDataflowForFile(
+      stub,
+      callerFile,
+      rootDir,
+      extToLang,
+      activeParsers,
+      activeGetParserFn,
+    );
+    if (!data) continue;
+
+    const resolver = makeNodeResolver(stmts, callerFile);
+    const argFlows = data.argFlows as unknown as VisitorArgFlow[];
+    const assignments = data.assignments as unknown as VisitorAssignment[];
+
+    for (const af of argFlows) {
+      const callerFn = resolver(af.callerFunc);
+      const calleeFn = resolver(af.calleeName);
+      if (!callerFn || !calleeFn) continue;
+      if (!changedFuncIdSet.has(calleeFn.id)) continue; // only re-stitch calls to changed callees
+      candidates.push({
+        callerFuncId: callerFn.id,
+        calleeFuncId: calleeFn.id,
+        argIndex: af.argIndex,
+        bindingType: af.binding.type,
+        bindingIndex: af.binding.index,
+        argName: af.argName,
+        expression: af.expression,
+        line: af.line,
+        confidence: af.confidence,
+      });
+    }
+
+    for (const a of assignments) {
+      const callerFn = resolver(a.callerFunc);
+      const calleeFn = resolver(a.sourceCallName);
+      if (!callerFn || !calleeFn) continue;
+      if (!changedFuncIdSet.has(calleeFn.id)) continue;
+      captures.push({ callerFuncId: callerFn.id, calleeFuncId: calleeFn.id, varName: a.varName });
+    }
+  }
+
+  debug(
+    `Dataflow P4: re-stitched ${candidates.length} candidate(s) from ${callerFiles.length} caller file(s)`,
+  );
+  return { candidates, captures };
+}
+
 function prepareNodeResolvers(db: BetterSqlite3Database): {
   getNodeByNameAndFile: ReturnType<BetterSqlite3Database['prepare']>;
   getNodeByName: ReturnType<BetterSqlite3Database['prepare']>;
@@ -259,11 +741,24 @@ function makeNodeResolver(
   stmts: ReturnType<typeof prepareNodeResolvers>,
   relPath: string,
 ): (funcName: string) => { id: number } | null {
+  // Memoise per (relPath, funcName). buildDataflowVerticesAndEdges resolves the
+  // same handful of function names many times per file — once per param, return,
+  // assignment, argFlow, summary row, and capture — and each miss costs one or
+  // two `nodes` table queries. The nodes table is never mutated during the P6
+  // vertex pass (only dataflow* tables are written), so the lookup is stable for
+  // the lifetime of the resolver; caching collapses tens of thousands of
+  // redundant queries on a full build into one per distinct name (#perf).
+  const cache = new Map<string, { id: number } | null>();
   return (funcName: string): { id: number } | null => {
+    const cached = cache.get(funcName);
+    if (cached !== undefined) return cached;
     const local = stmts.getNodeByNameAndFile.all(funcName, relPath) as { id: number }[];
-    if (local.length > 0) return local[0]!;
-    const global = stmts.getNodeByName.all(funcName) as { id: number }[];
-    return global.length > 0 ? global[0]! : null;
+    const resolved =
+      local.length > 0
+        ? local[0]!
+        : ((stmts.getNodeByName.all(funcName) as { id: number }[])[0] ?? null);
+    cache.set(funcName, resolved);
+    return resolved;
   };
 }
 
@@ -318,6 +813,128 @@ function collectNativeEdges(
   }
 }
 
+/**
+ * P6 vertex-only pass for the native orchestrator path.
+ *
+ * When the Rust orchestrator runs with analysisComplete=true it inserts
+ * flows_to/returns/mutates edges directly into the DB but never writes to
+ * dataflow_vertices or dataflow_summary. This function takes pre-extracted
+ * DataflowResult objects (from native.extractDataflowAnalysis) and builds
+ * the missing vertex rows and inter-procedural edges — without touching the
+ * already-correct function-level edges.
+ */
+export function buildDataflowVerticesFromMap(
+  db: BetterSqlite3Database,
+  dataflowMap: Map<string, DataflowResult>,
+  extraCandidates?: StitchCandidate[],
+  extraCaptures?: ReturnCapture[],
+): number {
+  const vstmts = prepareVertexStmts(db);
+  if (!vstmts.available || dataflowMap.size === 0) return 0;
+
+  const stmts = prepareNodeResolvers(db);
+
+  // Vertex writes and inter-procedural stitch are a single atomic unit: if the
+  // stitch throws or the process is killed between the two, the DB would be left
+  // with dataflow_vertices rows but no arg_in/return_out edges.  Wrapping both
+  // under one transaction boundary prevents that half-written state.
+  let stitchCount = 0;
+  const tx = db.transaction(() => {
+    const allCandidates: StitchCandidate[] = [];
+    const allCaptures: ReturnCapture[] = [];
+
+    for (const [relPath, data] of dataflowMap) {
+      const resolver = makeNodeResolver(stmts, relPath);
+      const { candidates, captures } = buildDataflowVerticesAndEdges(db, vstmts, data, resolver);
+      allCandidates.push(...candidates);
+      allCaptures.push(...captures);
+    }
+
+    // P4: merge in stitch candidates from unchanged caller files if provided.
+    if (extraCandidates && extraCandidates.length > 0) allCandidates.push(...extraCandidates);
+    if (extraCaptures && extraCaptures.length > 0) allCaptures.push(...extraCaptures);
+
+    stitchCount = runInterproceduralStitch(db, allCandidates, allCaptures);
+  });
+  tx();
+
+  return stitchCount;
+}
+
+/**
+ * P4 re-stitch pass for the native engine path.
+ *
+ * On incremental builds the changed files' param vertices are purged and
+ * recreated by the P6 vertex pass, but unchanged caller files are never
+ * re-parsed — so their arg_in edges (which pointed to the old param vertex
+ * IDs) are deleted and not replaced. This function re-parses those caller
+ * files and rebuilds the arg_in edges for any call that targets a function
+ * in one of the changed callee files.
+ *
+ * Called by the native orchestrator after buildDataflowVerticesFromMap.
+ * Safe to call on full builds — the guard below exits early when
+ * changedFiles covers all distinct files in the DB.
+ */
+export async function buildDataflowP4ForNative(
+  db: BetterSqlite3Database,
+  changedFiles: string[],
+  rootDir: string,
+): Promise<void> {
+  if (changedFiles.length === 0) return;
+
+  // Deduplicate upfront so the full-build guard uses unique-file count, not
+  // raw array length (the orchestrator may emit the same path more than once).
+  const changedRelPaths = new Set(changedFiles);
+
+  // Skip on full builds — all files were in the changed set, so there are no
+  // unchanged callers to re-stitch.
+  const totalFilesInDb = (
+    db.prepare(`SELECT COUNT(DISTINCT file) AS n FROM nodes`).get() as { n: number }
+  ).n;
+  if (changedRelPaths.size >= totalFilesInDb) return;
+
+  const extToLang = buildExtToLangMap();
+  const changedFuncIds = collectFuncIdsForFiles(db, changedRelPaths);
+  if (changedFuncIds.length === 0) return;
+
+  // parsers=null, getParserFn=null → collectCallerStitchCandidates initialises
+  // WASM parsers lazily for the caller files it needs to re-parse.
+  const { candidates, captures } = await collectCallerStitchCandidates(
+    db,
+    changedFuncIds,
+    changedRelPaths,
+    rootDir,
+    extToLang,
+    null,
+    null,
+  );
+
+  if (candidates.length > 0) {
+    let count = 0;
+    // Wrap the DELETE + stitch in a single transaction so that a crash between
+    // the purge and the re-insert cannot leave arg_in edges permanently removed
+    // but never replaced.
+    db.transaction(() => {
+      // Purge any existing arg_in edges targeting the changed callees from unchanged
+      // caller files. These edges were inserted by a previous P4 pass. Without this
+      // guard, repeated calls to buildDataflowP4ForNative insert duplicates because
+      // the dataflow table has no UNIQUE constraint on (source_vertex, target_vertex).
+      const placeholders = changedFuncIds.map(() => '?').join(',');
+      db.prepare(
+        `DELETE FROM dataflow
+         WHERE kind = 'arg_in'
+           AND target_id IN (${placeholders})
+           AND source_id NOT IN (${placeholders})`,
+      ).run(...changedFuncIds, ...changedFuncIds);
+
+      count = runInterproceduralStitch(db, candidates, captures);
+    })();
+    if (count > 0) {
+      info(`Dataflow (native P4): ${count} inter-procedural edges re-stitched`);
+    }
+  }
+}
+
 export async function buildDataflowEdges(
   db: BetterSqlite3Database,
   fileSymbols: Map<string, FileSymbolsDataflow>,
@@ -359,6 +976,83 @@ export async function buildDataflowEdges(
         }
         info(`Dataflow (native bulk): ${inserted} edges inserted`);
       }
+
+      // P6: vertex extraction on the native path.
+      // Rust DataflowResult already contains parameters/returns — no re-parse needed.
+      const vstmts = prepareVertexStmts(db);
+      if (vstmts.available) {
+        // P4: Incremental re-stitch — unchanged caller files are not in
+        // fileSymbols so their arg_in edges to the old param vertices were
+        // deleted by the purge and never recreated. Re-collect stitch
+        // candidates from those caller files by parsing them from disk.
+        //
+        // Skip on full builds: fileSymbols covers every file in the DB, so
+        // there are no unchanged callers to re-stitch.
+        //
+        // This async disk-read step must happen BEFORE the transaction opens
+        // (SQLite transactions are synchronous; async work inside them is not
+        // supported by better-sqlite3).
+        const totalFilesInDb = (
+          db.prepare(`SELECT COUNT(DISTINCT file) AS n FROM nodes`).get() as { n: number }
+        ).n;
+        let p4CallerCount = 0;
+        const p4Candidates: StitchCandidate[] = [];
+        const p4Captures: ReturnCapture[] = [];
+        if (fileSymbols.size < totalFilesInDb) {
+          const changedRelPaths = new Set<string>(fileSymbols.keys());
+          const changedFuncIds = collectFuncIdsForFiles(db, changedRelPaths);
+          const extra = await collectCallerStitchCandidates(
+            db,
+            changedFuncIds,
+            changedRelPaths,
+            rootDir,
+            extToLang,
+            null,
+            null,
+          );
+          p4Candidates.push(...extra.candidates);
+          p4Captures.push(...extra.captures);
+          p4CallerCount = extra.candidates.length;
+        }
+
+        // Vertex writes and inter-procedural stitch are a single atomic unit:
+        // if the stitch throws or the process is killed between the two, the DB
+        // would be left with dataflow_vertices rows but no arg_in/return_out
+        // edges.  Wrapping both under one transaction boundary prevents that
+        // half-written state.
+        let interCount = 0;
+        const txVertex = db.transaction(() => {
+          const allCandidates: StitchCandidate[] = [];
+          const allCaptures: ReturnCapture[] = [];
+
+          for (const [relPath, symbols] of fileSymbols) {
+            if (!symbols.dataflow) continue;
+            const ext = path.extname(relPath).toLowerCase();
+            if (!DATAFLOW_EXTENSIONS.has(ext)) continue;
+            const resolver = makeNodeResolver(stmts, relPath);
+            const { candidates, captures } = buildDataflowVerticesAndEdges(
+              db,
+              vstmts,
+              symbols.dataflow,
+              resolver,
+            );
+            allCandidates.push(...candidates);
+            allCaptures.push(...captures);
+          }
+
+          // Merge in the P4 candidates collected above before opening the tx.
+          allCandidates.push(...p4Candidates);
+          allCaptures.push(...p4Captures);
+
+          interCount = runInterproceduralStitch(db, allCandidates, allCaptures);
+        });
+        txVertex();
+
+        info(
+          `Dataflow (native): ${interCount} inter-procedural edges inserted${p4CallerCount > 0 ? ` (P4: ${p4CallerCount} re-stitch candidate(s) from unchanged callers)` : ''}`,
+        );
+      }
+
       return;
     }
     debug('Dataflow: some files lack pre-computed data — falling back to JS');
@@ -373,9 +1067,52 @@ export async function buildDataflowEdges(
   );
 
   const stmts = prepareNodeResolvers(db);
-  let totalEdges = 0;
+  const vstmts = prepareVertexStmts(db);
+
+  // P4: Incremental re-stitch — if only a subset of files changed, callers of
+  // the changed functions were not in fileSymbols, so their arg_in edges were
+  // deleted by the purge but never reconstructed. Re-collect stitch candidates
+  // from those caller files now (read from disk, no DB writes).
+  //
+  // Skip P4 on full builds: when fileSymbols covers every file in the DB there
+  // are no unchanged callers, and collectFuncIdsForFiles would issue one SELECT
+  // per file for nothing.  A single COUNT query is cheaper than N per-file SELECTs.
+  //
+  // This async disk-read step must happen BEFORE the transaction opens
+  // (SQLite transactions are synchronous; async work inside them is not
+  // supported by better-sqlite3).
+  const totalFilesInDb = (
+    db.prepare(`SELECT COUNT(DISTINCT file) AS n FROM nodes`).get() as { n: number }
+  ).n;
+  const p4Candidates: StitchCandidate[] = [];
+  const p4Captures: ReturnCapture[] = [];
+  if (vstmts.available && fileSymbols.size < totalFilesInDb) {
+    const changedRelPaths = new Set<string>(fileSymbols.keys());
+    const changedFuncIds = collectFuncIdsForFiles(db, changedRelPaths);
+    const extra = await collectCallerStitchCandidates(
+      db,
+      changedFuncIds,
+      changedRelPaths,
+      rootDir,
+      extToLang,
+      parsers,
+      getParserFn,
+    );
+    p4Candidates.push(...extra.candidates);
+    p4Captures.push(...extra.captures);
+  }
 
+  // Edge writes, vertex writes, and inter-procedural stitch are a single
+  // atomic unit: if the stitch throws or the process is killed between vertex
+  // writes and the stitch, the DB would be left with dataflow_vertices rows
+  // but no arg_in/return_out edges.  Wrapping all three under one transaction
+  // boundary prevents that half-written state.
+  let totalEdges = 0;
+  let interCount = 0;
   const tx = db.transaction(() => {
+    const allCandidates: StitchCandidate[] = [];
+    const allCaptures: ReturnCapture[] = [];
+
     for (const [relPath, symbols] of fileSymbols) {
       const ext = path.extname(relPath).toLowerCase();
       if (!DATAFLOW_EXTENSIONS.has(ext)) continue;
@@ -383,12 +1120,24 @@ export async function buildDataflowEdges(
       const data = getDataflowForFile(symbols, relPath, rootDir, extToLang, parsers, getParserFn);
       if (!data) continue;
 
-      totalEdges += insertDataflowEdges(insert, data, makeNodeResolver(stmts, relPath));
+      const resolver = makeNodeResolver(stmts, relPath);
+      totalEdges += insertDataflowEdges(insert, data, resolver);
+      const { candidates, captures } = buildDataflowVerticesAndEdges(db, vstmts, data, resolver);
+      allCandidates.push(...candidates);
+      allCaptures.push(...captures);
     }
+
+    // Merge in the P4 candidates collected above before opening the tx.
+    allCandidates.push(...p4Candidates);
+    allCaptures.push(...p4Captures);
+
+    // P2: inter-procedural stitch — runs after all per-file vertices + summaries written
+    interCount = vstmts.available ? runInterproceduralStitch(db, allCandidates, allCaptures) : 0;
   });
 
   tx();
-  info(`Dataflow: ${totalEdges} edges inserted`);
+
+  info(`Dataflow: ${totalEdges} fn-level edges, ${interCount} inter-procedural edges inserted`);
 }
 
 // ── Query functions ─────────────────────────────────────────────────────────