@optave/codegraph 3.13.0 → 3.15.0

package/dist/domain/graph/builder/stages/build-edges.js

@@ -11,6 +11,7 @@ import { setTypeMapEntry } from '../../../../extractors/helpers.js';
 import { PROPAGATION_HOP_PENALTY } from '../../../../extractors/javascript.js';
 import { debug } from '../../../../infrastructure/logger.js';
 import { loadNative } from '../../../../infrastructure/native.js';
+import { TS_NATIVE_CONFIDENCE_FLOOR } from '../../../../shared/constants.js';
 import { computeConfidence } from '../../resolve.js';
 import { buildPointsToMap, resolveViaPointsTo } from '../../resolver/points-to.js';
 import { enrichTypeMapWithTsc } from '../../resolver/ts-resolver.js';
@@ -70,7 +71,7 @@ function emitTypeOnlySymbolEdges(ctx, imp, resolvedPath, fileNodeId, allEdgeRows
         }
         const candidates = ctx.nodesByNameAndFile.get(`${cleanName}|${targetFile}`);
         if (candidates && candidates.length > 0) {
-            allEdgeRows.push([fileNodeId, candidates[0].id, 'imports-type', 1.0, 0, null]);
+            allEdgeRows.push([fileNodeId, candidates[0].id, 'imports-type', 1.0, 0, null, null]);
         }
     }
 }
@@ -84,7 +85,7 @@ function emitEdgesForImport(ctx, imp, fileNodeId, relPath, getNodeIdStmt, allEdg
     if (!targetRow)
         return;
     const edgeKind = importEdgeKind(imp);
-    allEdgeRows.push([fileNodeId, targetRow.id, edgeKind, 1.0, 0, null]);
+    allEdgeRows.push([fileNodeId, targetRow.id, edgeKind, 1.0, 0, null, null]);
     if (imp.typeOnly) {
         emitTypeOnlySymbolEdges(ctx, imp, resolvedPath, fileNodeId, allEdgeRows);
     }
@@ -122,7 +123,7 @@ function buildBarrelEdges(ctx, imp, resolvedPath, fileNodeId, edgeKind, getNodeI
                     : edgeKind === 'dynamic-imports'
                         ? 'dynamic-imports'
                         : 'imports';
-                edgeRows.push([fileNodeId, actualRow.id, kind, 0.9, 0, null]);
+                edgeRows.push([fileNodeId, actualRow.id, kind, 0.9, 0, null, null]);
             }
         }
     }
@@ -237,7 +238,7 @@ function buildImportEdgesNative(ctx, getNodeIdStmt, allEdgeRows, native) {
     const symbolNodes = collectSymbolNodes(ctx);
     const nativeEdges = native.buildImportEdges(files, resolvedImports, fileReexports, registry.ids, barrelFiles, ctx.rootDir, symbolNodes);
     for (const e of nativeEdges) {
-        allEdgeRows.push([e.sourceId, e.targetId, e.kind, e.confidence, e.dynamic, null]);
+        allEdgeRows.push([e.sourceId, e.targetId, e.kind, e.confidence, e.dynamic, null, null]);
     }
 }
 // ── Phase 8.2: Cross-file return-type propagation ───────────────────────
@@ -377,6 +378,7 @@ function buildCallEdgesNative(ctx, getNodeIdStmt, allEdgeRows, allNodes, native)
             e.confidence,
             e.dynamic,
             e.kind === 'calls' ? 'ts-native' : null,
+            e.dynamic_kind ?? null,
         ]);
     }
 }
@@ -443,7 +445,7 @@ function buildDefinePropertyPostPass(ctx, getNodeIdStmt, allEdgeRows, sharedLook
                     const conf = computeConfidence(relPath, t.file, null);
                     if (conf > 0) {
                         seenByPair.add(edgeKey);
-                        allEdgeRows.push([caller.id, t.id, 'calls', conf, 0, 'ts-native']);
+                        allEdgeRows.push([caller.id, t.id, 'calls', conf, 0, 'ts-native', null]);
                     }
                 }
             }
@@ -519,7 +521,7 @@ function buildChaPostPass(ctx, getNodeIdStmt, allEdgeRows, chaCtx) {
                         // Tag super-dispatch edges distinctly so runChaPostPass can exclude them
                         // from further CHA expansion (super calls are not virtual dispatch).
                         const technique = call.receiver === 'super' ? 'super-dispatch' : 'cha';
-                        allEdgeRows.push([caller.id, t.id, 'calls', conf, 0, technique]);
+                        allEdgeRows.push([caller.id, t.id, 'calls', conf, 0, technique, null]);
                     }
                 }
             }
@@ -594,7 +596,11 @@ function buildCallEdgesJS(ctx, getNodeIdStmt, allEdgeRows, chaCtx) {
         }
         const seenCallEdges = new Set();
         const ptsMap = buildPointsToMapForFile(symbols, importedNames);
-        buildFileCallEdges(relPath, symbols, fileNodeRow, importedNames, seenCallEdges, lookup, allEdgeRows, typeMap, ptsMap, chaCtx);
+        // Build the import-artifact name set: importedNames plus CJS require bindings.
+        // Used only by resolveReceiverEdge to distinguish local definitions from CJS
+        // import shadows — does NOT affect call-target resolution or DB edges (#1661).
+        const importArtifactNames = buildImportArtifactNames(importedNames, symbols, ctx, relPath, rootDir);
+        buildFileCallEdges(relPath, symbols, fileNodeRow, importedNames, seenCallEdges, lookup, allEdgeRows, typeMap, ptsMap, chaCtx, importArtifactNames);
         buildClassHierarchyEdges(ctx, relPath, symbols, allEdgeRows);
     }
 }
@@ -634,6 +640,33 @@ function buildImportedNamesMap(ctx, relPath, symbols, rootDir) {
     }
     return importedNames;
 }
+/**
+ * Build a map of all names that are import artifacts in this file — includes
+ * both ES module imports (already in importedNames) and CJS require destructuring
+ * bindings (`const { X } = require('./path')`). Used exclusively by resolveReceiverEdge
+ * to classify same-file function-kind nodes as import artifacts vs. local definitions.
+ * Does NOT affect call resolution or DB edge creation (#1661).
+ */
+function buildImportArtifactNames(importedNames, symbols, ctx, relPath, rootDir) {
+    if (!symbols.cjsRequireBindings?.length)
+        return importedNames;
+    const combined = new Map(importedNames);
+    const traceBarrel = (resolvedPath, cleanName) => {
+        if (!isBarrelFile(ctx, resolvedPath))
+            return resolvedPath;
+        const actual = resolveBarrelExportCached(ctx, resolvedPath, cleanName);
+        return actual ?? resolvedPath;
+    };
+    for (const binding of symbols.cjsRequireBindings) {
+        const resolvedPath = getResolved(ctx, path.join(rootDir, relPath), binding.source);
+        for (const name of binding.names) {
+            if (!combined.has(name)) {
+                combined.set(name, traceBarrel(resolvedPath, name));
+            }
+        }
+    }
+    return combined;
+}
 function makeContextLookup(ctx, getNodeIdStmt) {
     return {
         byNameAndFile: (name, file) => ctx.nodesByNameAndFile.get(`${name}|${file}`) ?? [],
@@ -702,209 +735,419 @@ function buildDefinitionParamsMap(definitions) {
     }
     return map;
 }
-function buildFileCallEdges(relPath, symbols, fileNodeRow, importedNames, seenCallEdges, lookup, allEdgeRows, typeMap, ptsMap, chaCtx) {
-    // Tracks edges that were inserted by the pts fallback (edgeKey → allEdgeRows index).
-    // Kept separate from seenCallEdges so that a subsequent direct-call edge for the same
-    // caller→target pair can upgrade the confidence in-place rather than being silently
-    // dropped by the dedup guard. Once upgraded, the key moves to seenCallEdges and is
-    // no longer tracked here.
-    const ptsEdgeRows = new Map();
-    // Pre-compute the set of names that appear as lhs in fnRefBindings so that
-    // case (c) of the pts gate below only fires for names that are genuine
-    // bind/alias entries, not for every locally-defined function or import that
-    // buildPointsToMap seeds with a self-pointing entry.
-    const fnRefBindingLhs = new Set(symbols.fnRefBindings?.map((b) => b.lhs) ?? []);
-    for (const call of symbols.calls) {
-        if (call.receiver && BUILTIN_RECEIVERS.has(call.receiver))
-            continue;
-        const caller = findCaller(lookup, call, symbols.definitions, relPath, fileNodeRow);
-        const isDynamic = call.dynamic ? 1 : 0;
-        let { targets, importedFrom } = resolveCallTargets(lookup, call, relPath, importedNames, typeMap, caller.callerName);
-        // Same-class `this.method()` fallback: when the call receiver is `this` and
-        // resolveCallTargets found nothing, derive the enclosing class name from the
-        // caller (e.g. `Logger.info` → class prefix `Logger`) and retry with the
-        // qualified method name `Logger._write`. This mirrors what the native Rust
-        // engine does implicitly via its class-scoped symbol table.
-        // NOTE: restricted to `this` only — `super.method()` targets a parent class,
-        // not the enclosing class, so qualifying with the child class name would
-        // produce a false edge when the child also defines a same-named method.
-        if (targets.length === 0 && call.receiver === 'this' && caller.callerName != null) {
+// ── Per-call resolution helpers ─────────────────────────────────────────
+/**
+ * Resolve targets for a single call site with all JS-path fallbacks applied.
+ *
+ * Runs in order:
+ *   1. Primary resolution via `resolveCallTargets` (importedNames + typeMap).
+ *   2. Same-class `this.method()` fallback (non-super receivers only).
+ *   3. Same-class bare-call fallback for non-JS/TS class-scoped languages.
+ *   4. Object.defineProperty accessor fallback (this-calls inside getter/setter).
+ *
+ * Returns the resolved targets array and the importedFrom hint for confidence scoring.
+ */
+function resolveFallbackTargets(call, caller, relPath, importedNames, lookup, typeMap, definePropertyReceivers) {
+    // RES-4: Kotlin member callable reference — `Greeter::greet` emits
+    // { name: 'greet', receiver: 'Greeter', dynamicKind: 'reflection' }.
+    // The receiver is the class qualifier (not a typeMap variable), so
+    // resolveCallTargets would find a same-named top-level function via
+    // byNameAndFile('greet', relPath) before the qualified form is tried.
+    // Prefer `Greeter.greet` in the same file first; fall through to the
+    // normal path only when no qualified match exists.
+    let preQualifiedTargets = [];
+    if (call.dynamicKind === 'reflection' &&
+        call.receiver &&
+        !call.keyExpr &&
+        !isModuleScopedLanguage(relPath)) {
+        preQualifiedTargets = lookup
+            .byNameAndFile(`${call.receiver}.${call.name}`, relPath)
+            .filter((n) => n.kind === 'method' || n.kind === 'function');
+    }
+    let { targets, importedFrom } = preQualifiedTargets.length > 0
+        ? {
+            targets: preQualifiedTargets,
+            importedFrom: undefined,
+        }
+        : resolveCallTargets(lookup, call, relPath, importedNames, typeMap, caller.callerName);
+    // Same-class `this.method()` fallback: when the call receiver is `this` and
+    // resolveCallTargets found nothing, derive the enclosing class name from the
+    // caller (e.g. `Logger.info` → class prefix `Logger`) and retry with the
+    // qualified method name `Logger._write`. This mirrors what the native Rust
+    // engine does implicitly via its class-scoped symbol table.
+    // NOTE: restricted to `this` only — `super.method()` targets a parent class,
+    // not the enclosing class, so qualifying with the child class name would
+    // produce a false edge when the child also defines a same-named method.
+    if (targets.length === 0 && call.receiver === 'this' && caller.callerName != null) {
+        const lastDot = caller.callerName.lastIndexOf('.');
+        if (lastDot > 0) {
+            const prevDot = caller.callerName.lastIndexOf('.', lastDot - 1);
+            const className = caller.callerName.slice(prevDot + 1, lastDot);
+            const qualified = lookup
+                .byNameAndFile(`${className}.${call.name}`, relPath)
+                .filter((n) => n.kind === 'method');
+            if (qualified.length > 0)
+                targets = qualified;
+        }
+    }
+    // Same-class bare-call fallback: when a no-receiver call can't be resolved
+    // globally, try the caller's own class as a qualifier. Handles C# static
+    // sibling calls: `IsValidEmail()` inside `Validators.ValidateUser` resolves
+    // to `Validators.IsValidEmail`. Skipped for JS/TS where bare calls are
+    // module-scoped, not class-scoped.
+    if (targets.length === 0 &&
+        !call.receiver &&
+        caller.callerName != null &&
+        !isModuleScopedLanguage(relPath)) {
+        const lastDot = caller.callerName.lastIndexOf('.');
+        if (lastDot > 0) {
+            const prevDot = caller.callerName.lastIndexOf('.', lastDot - 1);
+            const className = caller.callerName.slice(prevDot + 1, lastDot);
+            const qualified = lookup
+                .byNameAndFile(`${className}.${call.name}`, relPath)
+                .filter((n) => n.kind === 'method');
+            if (qualified.length > 0)
+                targets = qualified;
+        }
+    }
+    // RES-3: reflection with literal method name — JVM getMethod("name") / invokeMethod("name").
+    // Java/Scala/Groovy methods are stored as class-qualified names (e.g. Reflection.greet),
+    // so lookup.byNameAndFile('greet', relPath) finds nothing. When dynamicKind='reflection'
+    // and keyExpr is set (a string-literal method name was captured), try the qualified form:
+    //   1. typeMap[receiver] → resolvedType → lookup `resolvedType.keyExpr` (type-annotated local)
+    //   2. callerName class prefix → `CallerClass.keyExpr` (same-class sibling, e.g. Groovy obj)
+    // Scoped to non-JS/TS files to avoid interfering with the JS reflection path.
+    if (targets.length === 0 &&
+        call.dynamicKind === 'reflection' &&
+        call.keyExpr &&
+        call.receiver &&
+        !isModuleScopedLanguage(relPath)) {
+        const typeEntry = typeMap.get(call.receiver);
+        const resolvedType = typeEntry
+            ? typeof typeEntry === 'string'
+                ? typeEntry
+                : typeEntry.type
+            : null;
+        if (resolvedType) {
+            const qualified = lookup
+                .byNameAndFile(`${resolvedType}.${call.keyExpr}`, relPath)
+                .filter((n) => n.kind === 'method' || n.kind === 'function');
+            if (qualified.length > 0)
+                targets = qualified;
+        }
+        if (targets.length === 0 && caller.callerName != null) {
             const lastDot = caller.callerName.lastIndexOf('.');
             if (lastDot > 0) {
                 const prevDot = caller.callerName.lastIndexOf('.', lastDot - 1);
-                const className = caller.callerName.slice(prevDot + 1, lastDot);
-                const qualifiedName = `${className}.${call.name}`;
+                const callerClass = caller.callerName.slice(prevDot + 1, lastDot);
                 const qualified = lookup
-                    .byNameAndFile(qualifiedName, relPath)
-                    .filter((n) => n.kind === 'method');
-                if (qualified.length > 0) {
+                    .byNameAndFile(`${callerClass}.${call.keyExpr}`, relPath)
+                    .filter((n) => n.kind === 'method' || n.kind === 'function');
+                if (qualified.length > 0)
                     targets = qualified;
-                }
             }
         }
-        // Same-class bare-call fallback: when a no-receiver call can't be resolved
-        // globally, try the caller's own class as a qualifier. Handles C# static
-        // sibling calls: `IsValidEmail()` inside `Validators.ValidateUser` resolves
-        // to `Validators.IsValidEmail`. Skipped for JS/TS where bare calls are
-        // module-scoped, not class-scoped.
-        if (targets.length === 0 &&
-            !call.receiver &&
-            caller.callerName != null &&
-            !isModuleScopedLanguage(relPath)) {
-            const lastDot = caller.callerName.lastIndexOf('.');
-            if (lastDot > 0) {
-                const prevDot = caller.callerName.lastIndexOf('.', lastDot - 1);
-                const className = caller.callerName.slice(prevDot + 1, lastDot);
-                const qualifiedName = `${className}.${call.name}`;
-                const qualified = lookup
-                    .byNameAndFile(qualifiedName, relPath)
-                    .filter((n) => n.kind === 'method');
-                if (qualified.length > 0) {
-                    targets = qualified;
-                }
+    }
+    // Object.defineProperty accessor fallback: when a function is registered as
+    // a getter/setter via `Object.defineProperty(obj, "bar", { get: getter })`,
+    // calls to `this.X()` inside `getter` resolve against `obj` (this === obj
+    // when the accessor is invoked). If the same-class fallback above found
+    // nothing, try treating `obj` as the receiver and look up `obj.X` in the
+    // typeMap, or fall back to a same-file lookup of any definition named X
+    // that belongs to the object literal or its type.
+    if (targets.length === 0 &&
+        call.receiver === 'this' &&
+        caller.callerName != null &&
+        definePropertyReceivers) {
+        const receiverVarName = definePropertyReceivers.get(caller.callerName);
+        if (receiverVarName) {
+            const typeEntry = typeMap.get(receiverVarName);
+            const typeName = typeEntry
+                ? typeof typeEntry === 'string'
+                    ? typeEntry
+                    : typeEntry.type
+                : null;
+            if (typeName) {
+                const qualified = lookup.byNameAndFile(`${typeName}.${call.name}`, relPath);
+                if (qualified.length > 0)
+                    targets = [...qualified];
+            }
+            // If still no targets, search for any definition named `call.name` in
+            // the same file — handles plain object literals where the method isn't
+            // qualified (e.g. `const obj = { baz() {} }` defines `baz` directly).
+            // Note: this is intentionally broad — it matches any same-file definition
+            // with the called name, not just members of the receiver object. This is
+            // the same behaviour used by the native post-pass path (buildDefinePropertyPostPass).
+            if (targets.length === 0) {
+                const sameFile = lookup.byNameAndFile(call.name, relPath);
+                if (sameFile.length > 0)
+                    targets = [...sameFile];
             }
         }
-        // Object.defineProperty accessor fallback: when a function is registered as
-        // a getter/setter via `Object.defineProperty(obj, "bar", { get: getter })`,
-        // calls to `this.X()` inside `getter` resolve against `obj` (this === obj
-        // when the accessor is invoked). If the same-class fallback above found
-        // nothing, try treating `obj` as the receiver and look up `obj.X` in the
-        // typeMap, or fall back to a same-file lookup of any definition named X
-        // that belongs to the object literal or its type.
-        if (targets.length === 0 &&
-            call.receiver === 'this' &&
-            caller.callerName != null &&
-            symbols.definePropertyReceivers) {
-            const receiverVarName = symbols.definePropertyReceivers.get(caller.callerName);
-            if (receiverVarName) {
-                // Try typeMap lookup for receiver.methodName
-                const typeEntry = typeMap.get(receiverVarName);
-                const typeName = typeEntry
-                    ? typeof typeEntry === 'string'
-                        ? typeEntry
-                        : typeEntry.type
-                    : null;
-                if (typeName) {
-                    const qualifiedName = `${typeName}.${call.name}`;
-                    const qualified = lookup.byNameAndFile(qualifiedName, relPath);
-                    if (qualified.length > 0) {
-                        targets = [...qualified];
-                    }
-                }
-                // If still no targets, search for any definition named `call.name` in
-                // the same file — handles plain object literals where the method isn't
-                // qualified (e.g. `const obj = { baz() {} }` defines `baz` directly).
-                // Note: this is intentionally broad — it matches any same-file definition
-                // with the called name, not just members of the receiver object. This is
-                // the same behaviour used by the native post-pass path (buildDefinePropertyPostPass).
-                if (targets.length === 0) {
-                    const sameFile = lookup.byNameAndFile(call.name, relPath);
-                    if (sameFile.length > 0) {
-                        targets = [...sameFile];
-                    }
+    }
+    return { targets, importedFrom };
+}
+/**
+ * Emit direct-call edges for the resolved targets of a single call site.
+ *
+ * Sorts targets by confidence descending first, then for each target:
+ *   - Skips self-edges and already-seen edges.
+ *   - If a pts edge already exists for this pair, upgrades it in-place to
+ *     direct-call confidence and promotes to seenCallEdges.
+ *   - If a dyn=0 edge already exists and the incoming call has an explicit
+ *     dynamicKind (e.g. 'reflection' for bare decorators), upgrades the
+ *     existing row to dyn=1 in-place so the semantic classification wins.
+ *   - Otherwise records a new `calls` edge with `ts-native` technique.
+ */
+function emitDirectCallEdgesForCall(caller, targets, importedFrom, isDynamic, hasDynamicKind, relPath, seenCallEdges, ptsEdgeRows, allEdgeRows, dynZeroEdgeRows) {
+    // Sort targets by confidence descending before emitting edges.
+    // For multi-target calls with duplicate (source_id, target_id) pairs the
+    // stored confidence depends on which duplicate is processed last — sorting
+    // here guarantees the highest-confidence target wins on dedup, matching the
+    // native engine's sort_targets_by_confidence call in build_edges.rs.
+    const sorted = targets.length > 1
+        ? [...targets].sort((a, b) => computeConfidence(relPath, b.file, importedFrom ?? null) -
+            computeConfidence(relPath, a.file, importedFrom ?? null))
+        : targets;
+    for (const t of sorted) {
+        const edgeKey = `${caller.id}|${t.id}`;
+        if (t.id === caller.id)
+            continue;
+        const confidence = computeConfidence(relPath, t.file, importedFrom ?? null);
+        if (seenCallEdges.has(edgeKey)) {
+            // Edge already emitted. If the incoming call carries an explicit semantic
+            // dynamic classification (dynamicKind set — e.g. 'reflection' for bare
+            // decorators) and the existing edge was recorded with dyn=0, upgrade it
+            // in-place so the more specific classification wins.
+            // Generic dynamic=true without dynamicKind (alias/callback calls) does
+            // NOT override dyn=0 to avoid false positives on f.call/f.bind patterns.
+            if (isDynamic === 1 && hasDynamicKind && dynZeroEdgeRows) {
+                const dynZeroIdx = dynZeroEdgeRows.get(edgeKey);
+                if (dynZeroIdx !== undefined) {
+                    const row = allEdgeRows[dynZeroIdx];
+                    if (row)
+                        row[4] = 1;
+                    dynZeroEdgeRows.delete(edgeKey);
                 }
             }
+            continue;
         }
-        // Sort targets by confidence descending before emitting edges.
-        // For multi-target calls with duplicate (source_id, target_id) pairs the
-        // stored confidence depends on which duplicate is processed last — sorting
-        // here guarantees the highest-confidence target wins on dedup, matching the
-        // native engine's sort_targets_by_confidence call in build_edges.rs.
-        if (targets.length > 1) {
-            targets = [...targets].sort((a, b) => computeConfidence(relPath, b.file, importedFrom ?? null) -
-                computeConfidence(relPath, a.file, importedFrom ?? null));
+        const ptsIdx = ptsEdgeRows.get(edgeKey);
+        if (ptsIdx !== undefined) {
+            // A pts-resolved edge already exists for this caller→target pair with a
+            // penalised confidence. Upgrade it to the direct-call confidence in-place,
+            // then promote to seenCallEdges so no further processing is needed.
+            const ptsRow = allEdgeRows[ptsIdx];
+            if (ptsRow) {
+                ptsRow[3] = confidence;
+                ptsRow[4] = isDynamic; // upgrade is_dynamic: direct call overrides the pts-alias dynamic flag
+                ptsRow[5] = 'ts-native'; // promoted from pts to direct-call resolution
+            }
+            ptsEdgeRows.delete(edgeKey);
+            seenCallEdges.add(edgeKey);
         }
-        for (const t of targets) {
+        else {
+            seenCallEdges.add(edgeKey);
+            const newIdx = allEdgeRows.length;
+            allEdgeRows.push([caller.id, t.id, 'calls', confidence, isDynamic, 'ts-native', null]);
+            // Track dyn=0 edges so a later dyn=1+dynamicKind call for the same pair
+            // can upgrade them (e.g. bare decorator after call-expression decorator).
+            if (isDynamic === 0 && dynZeroEdgeRows) {
+                dynZeroEdgeRows.set(edgeKey, newIdx);
+            }
+        }
+    }
+}
+/**
+ * Phase 8.3 / 8.3c / bind: emit pts-resolved edges for unresolved no-receiver calls.
+ *
+ * Fires for three cases:
+ *   (a) dynamic=true: alias calls emitted by extractCallbackReferenceCalls.
+ *       Looks up `call.name` directly (alias entries are flat-keyed).
+ *   (b) non-dynamic: parameter variable calls (fn() where fn is a param).
+ *       Looks up the scoped key `callerName::call.name` to avoid spurious
+ *       edges from same-named parameters across different functions.
+ *   (c) non-dynamic: module-level alias bindings — `f = fn.bind(ctx)` or
+ *       `const f = handler` — where pts('f') was seeded by fnRefBindings.
+ *       Checked against fnRefBindingLhs so case (c) only fires for genuine
+ *       bind/alias entries and never for self-seeded local definitions.
+ *
+ * Pts edges are added to ptsEdgeRows (not seenCallEdges) so that a later
+ * direct call to the same target can upgrade confidence rather than being
+ * silently dropped by the dedup guard.
+ */
+function emitPtsNoReceiverEdges(call, caller, isDynamic, relPath, importedNames, lookup, typeMap, ptsMap, fnRefBindingLhs, seenCallEdges, ptsEdgeRows, allEdgeRows) {
+    const scopedPtsKey = caller.callerName != null ? `${caller.callerName}::${call.name}` : null;
+    // Module-level calls (callerName === null) use the '<module>' sentinel emitted by
+    // extractSpreadForOfWalk for top-level for-of loops. Look it up as a fallback so
+    // that `for (const f of arr) { f(); }` at module scope resolves correctly.
+    const modulePtsKey = caller.callerName === null && ptsMap.has(`<module>::${call.name}`)
+        ? `<module>::${call.name}`
+        : null;
+    const flatPtsKey = !call.dynamic && fnRefBindingLhs.has(call.name) && ptsMap.has(call.name) ? call.name : null;
+    if (!(call.dynamic ||
+        (scopedPtsKey != null && ptsMap.has(scopedPtsKey)) ||
+        modulePtsKey != null ||
+        flatPtsKey != null))
+        return;
+    const ptsLookupName = call.dynamic
+        ? call.name
+        : scopedPtsKey != null && ptsMap.has(scopedPtsKey)
+            ? scopedPtsKey
+            : modulePtsKey != null
+                ? modulePtsKey
+                : // flatPtsKey != null is guaranteed: if neither call.dynamic nor scopedPtsKey
+                    // nor modulePtsKey matched, flatPtsKey must be non-null.
+                    flatPtsKey;
+    for (const alias of resolveViaPointsTo(ptsLookupName, ptsMap)) {
+        // Resolve the concrete alias target. Only `name` is needed here — receiver
+        // and line are not relevant for alias resolution (we are looking up the
+        // aliased function by name, not dispatching a method call).
+        const { targets: aliasTargets, importedFrom: aliasFrom } = resolveCallTargets(lookup, { name: alias }, relPath, importedNames, typeMap);
+        const sortedAliasTargets = aliasTargets.length > 1
+            ? [...aliasTargets].sort((a, b) => computeConfidence(relPath, b.file, aliasFrom ?? null) -
+                computeConfidence(relPath, a.file, aliasFrom ?? null))
+            : aliasTargets;
+        for (const t of sortedAliasTargets) {
             const edgeKey = `${caller.id}|${t.id}`;
-            if (t.id !== caller.id) {
-                const confidence = computeConfidence(relPath, t.file, importedFrom ?? null);
-                if (seenCallEdges.has(edgeKey))
-                    continue;
-                const ptsIdx = ptsEdgeRows.get(edgeKey);
-                if (ptsIdx !== undefined) {
-                    // A pts-resolved edge already exists for this caller→target pair with a
-                    // penalised confidence. Upgrade it to the direct-call confidence in-place,
-                    // then promote to seenCallEdges so no further processing is needed.
-                    const ptsRow = allEdgeRows[ptsIdx];
-                    if (ptsRow) {
-                        ptsRow[3] = confidence;
-                        ptsRow[4] = isDynamic; // upgrade is_dynamic: direct call overrides the pts-alias dynamic flag
-                        ptsRow[5] = 'ts-native'; // promoted from pts to direct-call resolution
-                    }
-                    ptsEdgeRows.delete(edgeKey);
-                    seenCallEdges.add(edgeKey);
+            if (t.id !== caller.id && !seenCallEdges.has(edgeKey) && !ptsEdgeRows.has(edgeKey)) {
+                const conf = computeConfidence(relPath, t.file, aliasFrom ?? null) - PROPAGATION_HOP_PENALTY;
+                if (conf > 0) {
+                    ptsEdgeRows.set(edgeKey, allEdgeRows.length);
+                    allEdgeRows.push([caller.id, t.id, 'calls', conf, isDynamic, 'points-to', null]);
                 }
-                else {
-                    seenCallEdges.add(edgeKey);
-                    allEdgeRows.push([caller.id, t.id, 'calls', confidence, isDynamic, 'ts-native']);
+            }
+        }
+    }
+}
+/**
+ * Phase 8.3f: emit pts-resolved edges for unresolved receiver calls via
+ * object-rest param bindings.
+ *
+ * Fires when `rest.prop()` is encountered and `rest` was seeded as
+ * `pts["rest.prop"]` by the object-rest dispatch chain
+ * (ObjectRestParamBinding + paramBinding + ObjectPropBinding).
+ */
+function emitPtsReceiverEdges(call, caller, isDynamic, relPath, importedNames, lookup, typeMap, ptsMap, seenCallEdges, ptsEdgeRows, allEdgeRows) {
+    const receiverKey = `${call.receiver}.${call.name}`;
+    if (!ptsMap.has(receiverKey))
+        return;
+    for (const alias of resolveViaPointsTo(receiverKey, ptsMap)) {
+        const { targets: aliasTargets, importedFrom: aliasFrom } = resolveCallTargets(lookup, { name: alias }, relPath, importedNames, typeMap);
+        const sortedAliasTargets = aliasTargets.length > 1
+            ? [...aliasTargets].sort((a, b) => computeConfidence(relPath, b.file, aliasFrom ?? null) -
+                computeConfidence(relPath, a.file, aliasFrom ?? null))
+            : aliasTargets;
+        for (const t of sortedAliasTargets) {
+            const edgeKey = `${caller.id}|${t.id}`;
+            if (t.id !== caller.id && !seenCallEdges.has(edgeKey) && !ptsEdgeRows.has(edgeKey)) {
+                const conf = computeConfidence(relPath, t.file, aliasFrom ?? null) - PROPAGATION_HOP_PENALTY;
+                if (conf > 0) {
+                    ptsEdgeRows.set(edgeKey, allEdgeRows.length);
+                    allEdgeRows.push([caller.id, t.id, 'calls', conf, isDynamic, 'points-to', null]);
                 }
             }
         }
-        // Phase 8.3 / 8.3c / bind: points-to fallback for unresolved calls.
-        // Fires for three cases:
-        //   (a) dynamic=true: alias calls emitted by extractCallbackReferenceCalls.
-        //       Looks up `call.name` directly (alias entries are flat-keyed).
-        //   (b) non-dynamic: parameter variable calls (fn() where fn is a param).
-        //       Looks up the scoped key `callerName::call.name` to avoid spurious
-        //       edges from same-named parameters across different functions.
-        //   (c) non-dynamic: module-level alias bindings — `f = fn.bind(ctx)` or
-        //       `const f = handler` — where pts('f') was seeded by fnRefBindings.
-        //       Checked against fnRefBindingLhs (the pre-computed set of lhs names from
-        //       fnRefBindings) rather than the full ptsMap, so case (c) only fires for
-        //       genuine bind/alias entries and never for self-seeded local definitions.
-        // Confidence is penalised by one hop to reflect the extra indirection.
-        //
-        // Note: pts edges are added to ptsEdgeRows (not seenCallEdges) so that a later
-        // direct call to the same target in the same function body can upgrade confidence
-        // rather than being silently dropped by the dedup guard.
-        const scopedPtsKey = caller.callerName != null ? `${caller.callerName}::${call.name}` : null;
-        // Module-level calls (callerName === null) use the '<module>' sentinel emitted by
-        // extractSpreadForOfWalk for top-level for-of loops. Look it up as a fallback so
-        // that `for (const f of arr) { f(); }` at module scope resolves correctly.
-        const modulePtsKey = caller.callerName === null && ptsMap?.has(`<module>::${call.name}`)
-            ? `<module>::${call.name}`
+    }
+}
+/**
+ * Phase 8.5: emit CHA + RTA dispatch edges for a single call site.
+ *
+ * For `this`/`self`/`super` calls: resolve through the class hierarchy.
+ * For typed receiver calls: expand to all instantiated concrete implementations.
+ */
+function emitChaCallEdgesForCall(call, caller, relPath, typeMap, lookup, chaCtx, seenCallEdges, ptsEdgeRows, allEdgeRows) {
+    let chaTargets = [];
+    let isTypedReceiverDispatch = false;
+    if (call.receiver === 'this' || call.receiver === 'self' || call.receiver === 'super') {
+        chaTargets = resolveThisDispatch(call.name, caller.callerName, call.receiver, chaCtx, lookup, relPath);
+    }
+    else if (!BUILTIN_RECEIVERS.has(call.receiver)) {
+        const typeEntry = typeMap.get(call.receiver);
+        const typeName = typeEntry
+            ? typeof typeEntry === 'string'
+                ? typeEntry
+                : typeEntry.type
             : null;
-        const flatPtsKey = !call.dynamic && fnRefBindingLhs.has(call.name) && ptsMap?.has(call.name) ? call.name : null;
-        if (targets.length === 0 &&
-            !call.receiver &&
-            ptsMap &&
-            (call.dynamic ||
-                (scopedPtsKey != null && ptsMap.has(scopedPtsKey)) ||
-                modulePtsKey != null ||
-                flatPtsKey != null)) {
-            const ptsLookupName = call.dynamic
-                ? call.name
-                : scopedPtsKey != null && ptsMap.has(scopedPtsKey)
-                    ? scopedPtsKey
-                    : modulePtsKey != null
-                        ? modulePtsKey
-                        : // flatPtsKey != null is guaranteed by the outer if condition: if neither
-                            // call.dynamic nor scopedPtsKey nor modulePtsKey matched, flatPtsKey must be non-null.
-                            flatPtsKey;
-            for (const alias of resolveViaPointsTo(ptsLookupName, ptsMap)) {
-                // Resolve the concrete alias target. Only `name` is needed here — receiver
-                // and line are not relevant for alias resolution (we are looking up the
-                // aliased function by name, not dispatching a method call).
-                const { targets: aliasTargets, importedFrom: aliasFrom } = resolveCallTargets(lookup, { name: alias }, relPath, importedNames, typeMap);
-                const sortedAliasTargets = aliasTargets.length > 1
-                    ? [...aliasTargets].sort((a, b) => computeConfidence(relPath, b.file, aliasFrom ?? null) -
-                        computeConfidence(relPath, a.file, aliasFrom ?? null))
-                    : aliasTargets;
-                for (const t of sortedAliasTargets) {
-                    const edgeKey = `${caller.id}|${t.id}`;
-                    if (t.id !== caller.id && !seenCallEdges.has(edgeKey) && !ptsEdgeRows.has(edgeKey)) {
-                        const conf = computeConfidence(relPath, t.file, aliasFrom ?? null) - PROPAGATION_HOP_PENALTY;
-                        if (conf > 0) {
-                            ptsEdgeRows.set(edgeKey, allEdgeRows.length);
-                            allEdgeRows.push([caller.id, t.id, 'calls', conf, isDynamic, 'points-to']);
-                        }
-                    }
-                }
+        if (typeName) {
+            chaTargets = resolveChaTargets(typeName, call.name, chaCtx, lookup);
+            isTypedReceiverDispatch = true;
+        }
+    }
+    for (const t of chaTargets) {
+        const edgeKey = `${caller.id}|${t.id}`;
+        if (t.id !== caller.id && !seenCallEdges.has(edgeKey) && !ptsEdgeRows.has(edgeKey)) {
+            // Typed-receiver (interface/CHA) dispatch: use CHA_TYPED_DISPATCH_CONFIDENCE
+            // — file proximity is not meaningful for virtual dispatch confidence.
+            // this/super dispatch keeps computeConfidence-based proximity scoring to
+            // match runPostNativeThisDispatch (native-orchestrator.ts).
+            const conf = isTypedReceiverDispatch
+                ? CHA_TYPED_DISPATCH_CONFIDENCE
+                : computeConfidence(relPath, t.file, null) - CHA_DISPATCH_PENALTY;
+            if (conf > 0) {
+                seenCallEdges.add(edgeKey);
+                allEdgeRows.push([caller.id, t.id, 'calls', conf, 0, 'cha', null]);
             }
         }
-        // Phase 8.3f: pts fallback for receiver calls via object-rest param bindings.
-        // Fires when `rest.prop()` is encountered and `rest` was seeded as `pts["rest.prop"]`
-        // by the object-rest dispatch chain (ObjectRestParamBinding + paramBinding + ObjectPropBinding).
+    }
+}
+/**
+ * Dynamic kinds that cannot be resolved statically — emit a sink edge to the
+ * file node instead of silently dropping the call site.  confidence=0.0 keeps
+ * these below DEFAULT_MIN_CONFIDENCE so they never appear in normal query results.
+ * Includes reflection so that Reflect.apply/getMethod/callable-ref calls whose
+ * target is not found in the codebase still produce a visible sink edge.
+ */
+const FLAG_ONLY_KINDS = new Set([
+    'eval',
+    'computed-key',
+    'reflection',
+    'unresolved-dynamic',
+]);
+/**
+ * Build call edges for all calls in a single file (WASM/JS engine path).
+ *
+ * Iterates over `symbols.calls` and dispatches each call through the full
+ * JS resolution cascade:
+ *   1. `resolveFallbackTargets`  — primary + class-fallback + defineProperty fallback
+ *   2. `emitDirectCallEdgesForCall` — emit direct-call edges (upgrading any pts pair)
+ *   3. `emitPtsNoReceiverEdges`  — Phase 8.3/8.3c pts fallback for no-receiver calls
+ *   4. `emitPtsReceiverEdges`    — Phase 8.3f pts fallback for rest-param receiver calls
+ *   5. Inline `resolveReceiverEdge` — emit `receiver` edge for external receivers
+ *   6. `emitChaCallEdgesForCall` — Phase 8.5 CHA + RTA dispatch expansion
+ *   7. Sink edge for flag-only dynamic kinds (eval, computed-key, reflection, unresolved-dynamic)
+ */
+function buildFileCallEdges(relPath, symbols, fileNodeRow, importedNames, seenCallEdges, lookup, allEdgeRows, typeMap, ptsMap, chaCtx, importArtifactNames) {
+    // Tracks edges that were inserted by the pts fallback (edgeKey → allEdgeRows index).
+    // Kept separate from seenCallEdges so that a subsequent direct-call edge for the same
+    // caller→target pair can upgrade the confidence in-place rather than being silently
+    // dropped by the dedup guard. Once upgraded, the key moves to seenCallEdges and is
+    // no longer tracked here.
+    const ptsEdgeRows = new Map();
+    // Tracks direct-call edges emitted with dyn=0 (edgeKey → allEdgeRows index).
+    // When a later call to the same target has dyn=1 (e.g. a bare decorator `@Log`
+    // processed after the call-expression `@Log()` in the query path), the existing
+    // dyn=0 row is upgraded in-place so the more specific dynamic classification wins.
+    const dynZeroEdgeRows = new Map();
+    // Pre-compute the set of names that appear as lhs in fnRefBindings so that
+    // case (c) of the pts gate below only fires for names that are genuine
+    // bind/alias entries, not for every locally-defined function or import that
+    // buildPointsToMap seeds with a self-pointing entry.
+    const fnRefBindingLhs = new Set(symbols.fnRefBindings?.map((b) => b.lhs) ?? []);
+    for (const call of symbols.calls) {
+        if (call.receiver && BUILTIN_RECEIVERS.has(call.receiver))
+            continue;
+        const caller = findCaller(lookup, call, symbols.definitions, relPath, fileNodeRow);
+        const isDynamic = call.dynamic ? 1 : 0;
+        // Step 1: Resolve targets with all JS-path fallbacks.
+        const { targets, importedFrom } = resolveFallbackTargets(call, caller, relPath, importedNames, lookup, typeMap, symbols.definePropertyReceivers);
+        // Step 2: Emit direct-call edges (upgrades any pending pts edge in-place).
+        emitDirectCallEdgesForCall(caller, targets, importedFrom, isDynamic, !!call.dynamicKind, relPath, seenCallEdges, ptsEdgeRows, allEdgeRows, dynZeroEdgeRows);
+        // Step 3: Phase 8.3/8.3c pts fallback for unresolved no-receiver calls.
+        if (targets.length === 0 && !call.receiver && ptsMap) {
+            emitPtsNoReceiverEdges(call, caller, isDynamic, relPath, importedNames, lookup, typeMap, ptsMap, fnRefBindingLhs, seenCallEdges, ptsEdgeRows, allEdgeRows);
+        }
+        // Step 4: Phase 8.3f pts fallback for unresolved receiver calls (rest params).
         if (targets.length === 0 &&
             call.receiver &&
             !BUILTIN_RECEIVERS.has(call.receiver) &&
@@ -912,74 +1155,40 @@ function buildFileCallEdges(relPath, symbols, fileNodeRow, importedNames, seenCa
             call.receiver !== 'self' &&
             call.receiver !== 'super' &&
             ptsMap) {
-            const receiverKey = `${call.receiver}.${call.name}`;
-            if (ptsMap.has(receiverKey)) {
-                for (const alias of resolveViaPointsTo(receiverKey, ptsMap)) {
-                    const { targets: aliasTargets, importedFrom: aliasFrom } = resolveCallTargets(lookup, { name: alias }, relPath, importedNames, typeMap);
-                    const sortedAliasTargets = aliasTargets.length > 1
-                        ? [...aliasTargets].sort((a, b) => computeConfidence(relPath, b.file, aliasFrom ?? null) -
-                            computeConfidence(relPath, a.file, aliasFrom ?? null))
-                        : aliasTargets;
-                    for (const t of sortedAliasTargets) {
-                        const edgeKey = `${caller.id}|${t.id}`;
-                        if (t.id !== caller.id && !seenCallEdges.has(edgeKey) && !ptsEdgeRows.has(edgeKey)) {
-                            const conf = computeConfidence(relPath, t.file, aliasFrom ?? null) - PROPAGATION_HOP_PENALTY;
-                            if (conf > 0) {
-                                ptsEdgeRows.set(edgeKey, allEdgeRows.length);
-                                allEdgeRows.push([caller.id, t.id, 'calls', conf, isDynamic, 'points-to']);
-                            }
-                        }
-                    }
-                }
-            }
+            emitPtsReceiverEdges(call, caller, isDynamic, relPath, importedNames, lookup, typeMap, ptsMap, seenCallEdges, ptsEdgeRows, allEdgeRows);
         }
+        // Step 5: Emit receiver edge for external (non-this/self/super) receivers.
         if (call.receiver &&
             !BUILTIN_RECEIVERS.has(call.receiver) &&
             call.receiver !== 'this' &&
             call.receiver !== 'self' &&
             call.receiver !== 'super') {
-            const recv = resolveReceiverEdge(lookup, { name: call.name, receiver: call.receiver }, caller, relPath, typeMap, seenCallEdges, importedNames);
+            const recv = resolveReceiverEdge(lookup, { name: call.name, receiver: call.receiver }, caller, relPath, typeMap, seenCallEdges, importArtifactNames ?? importedNames);
             if (recv) {
-                allEdgeRows.push([recv.callerId, recv.receiverId, 'receiver', recv.confidence, 0, null]);
+                allEdgeRows.push([
+                    recv.callerId,
+                    recv.receiverId,
+                    'receiver',
+                    recv.confidence,
+                    0,
+                    null,
+                    null,
+                ]);
             }
         }
-        // Phase 8.5: CHA + RTA dispatch expansion.
-        // For `this`/`self`/`super` calls: resolve through the class hierarchy instead
-        // of relying solely on global name matching.
-        // For typed receiver calls: expand to all instantiated concrete implementations.
+        // Step 6: Phase 8.5 CHA + RTA dispatch expansion.
         if (chaCtx && call.receiver) {
-            let chaTargets = [];
-            let isTypedReceiverDispatch = false;
-            if (call.receiver === 'this' || call.receiver === 'self' || call.receiver === 'super') {
-                chaTargets = resolveThisDispatch(call.name, caller.callerName, call.receiver, chaCtx, lookup, relPath);
-            }
-            else if (!BUILTIN_RECEIVERS.has(call.receiver)) {
-                const typeEntry = typeMap.get(call.receiver);
-                const typeName = typeEntry
-                    ? typeof typeEntry === 'string'
-                        ? typeEntry
-                        : typeEntry.type
-                    : null;
-                if (typeName) {
-                    chaTargets = resolveChaTargets(typeName, call.name, chaCtx, lookup);
-                    isTypedReceiverDispatch = true;
-                }
-            }
-            for (const t of chaTargets) {
-                const edgeKey = `${caller.id}|${t.id}`;
-                if (t.id !== caller.id && !seenCallEdges.has(edgeKey) && !ptsEdgeRows.has(edgeKey)) {
-                    // Typed-receiver (interface/CHA) dispatch: use CHA_TYPED_DISPATCH_CONFIDENCE
-                    // — file proximity is not meaningful for virtual dispatch confidence.
-                    // this/super dispatch keeps computeConfidence-based proximity scoring to
-                    // match runPostNativeThisDispatch (native-orchestrator.ts).
-                    const conf = isTypedReceiverDispatch
-                        ? CHA_TYPED_DISPATCH_CONFIDENCE
-                        : computeConfidence(relPath, t.file, null) - CHA_DISPATCH_PENALTY;
-                    if (conf > 0) {
-                        seenCallEdges.add(edgeKey);
-                        allEdgeRows.push([caller.id, t.id, 'calls', conf, 0, 'cha']);
-                    }
-                }
+            emitChaCallEdgesForCall(call, caller, relPath, typeMap, lookup, chaCtx, seenCallEdges, ptsEdgeRows, allEdgeRows);
+        }
+        // Step 7: Flag-only dynamic kinds with no resolved target → sink edge to the
+        // file node.  confidence=0.0 keeps it below DEFAULT_MIN_CONFIDENCE so it never
+        // appears in normal query results, but is queryable via `codegraph roles --dynamic`.
+        if (targets.length === 0 && call.dynamicKind && FLAG_ONLY_KINDS.has(call.dynamicKind)) {
+            // Key per (caller, file, kind) so each kind gets at most one sink edge per caller.
+            const sinkKey = `${caller.id}:${fileNodeRow.id}:${call.dynamicKind}`;
+            if (!seenCallEdges.has(sinkKey)) {
+                seenCallEdges.add(sinkKey);
+                allEdgeRows.push([caller.id, fileNodeRow.id, 'calls', 0.0, 1, null, call.dynamicKind]);
             }
         }
     }
@@ -995,7 +1204,7 @@ function buildClassHierarchyEdges(ctx, relPath, symbols, allEdgeRows) {
             const targetRows = (ctx.nodesByName.get(cls.extends) || []).filter((n) => EXTENDS_TARGET_KINDS.has(n.kind));
             if (sourceRow) {
                 for (const t of targetRows) {
-                    allEdgeRows.push([sourceRow.id, t.id, 'extends', 1.0, 0, null]);
+                    allEdgeRows.push([sourceRow.id, t.id, 'extends', 1.0, 0, null, null]);
                 }
             }
         }
@@ -1004,7 +1213,7 @@ function buildClassHierarchyEdges(ctx, relPath, symbols, allEdgeRows) {
             const targetRows = (ctx.nodesByName.get(cls.implements) || []).filter((n) => IMPLEMENTS_TARGET_KINDS.has(n.kind));
             if (sourceRow) {
                 for (const t of targetRows) {
-                    allEdgeRows.push([sourceRow.id, t.id, 'implements', 1.0, 0, null]);
+                    allEdgeRows.push([sourceRow.id, t.id, 'implements', 1.0, 0, null, null]);
                 }
             }
         }
@@ -1013,7 +1222,8 @@ function buildClassHierarchyEdges(ctx, relPath, symbols, allEdgeRows) {
 // ── Native bulk-insert technique back-fill ──────────────────────────────
 /**
  * After native bulkInsertEdges (which does not write the technique column),
- * apply technique values from the in-memory row array back to the DB.
+ * apply technique values from the in-memory row array back to the DB, and lift
+ * any resolved ts-native edge below TS_NATIVE_CONFIDENCE_FLOOR to that floor.
  *
  * Rows with an explicit technique get a targeted UPDATE by (source_id, target_id).
  * The catch-all 'ts-native' tag is scoped to only the source_ids present in this
@@ -1030,6 +1240,8 @@ function applyEdgeTechniquesAfterNativeInsert(db, rows) {
     const sourceIds = [...new Set(callRows.map((r) => r[0]))];
     // Chunk to stay within SQLite's SQLITE_LIMIT_VARIABLE_NUMBER (999 on older builds).
     const CHUNK_SIZE = 500;
+    // Rows that carry an explicit dynamic_kind (sink edges for flagged dynamic calls).
+    const dynamicKindRows = callRows.filter((r) => r[6] != null);
     const tx = db.transaction(() => {
         if (taggedRows.length > 0) {
             const stmt = db.prepare("UPDATE edges SET technique = ? WHERE kind = 'calls' AND source_id = ? AND target_id = ? AND technique IS NULL");
@@ -1040,6 +1252,24 @@ function applyEdgeTechniquesAfterNativeInsert(db, rows) {
             const chunk = sourceIds.slice(i, i + CHUNK_SIZE);
             const placeholders = chunk.map(() => '?').join(',');
             db.prepare(`UPDATE edges SET technique = 'ts-native' WHERE kind = 'calls' AND technique IS NULL AND source_id IN (${placeholders})`).run(...chunk);
+            // Lift resolved ts-native edges below the confidence floor for this chunk.
+            db.prepare(`UPDATE edges SET confidence = ?
+         WHERE kind = 'calls' AND technique = 'ts-native'
+           AND confidence > 0 AND confidence < ?
+           AND source_id IN (${placeholders})`).run(TS_NATIVE_CONFIDENCE_FLOOR, TS_NATIVE_CONFIDENCE_FLOOR, ...chunk);
+        }
+        // Back-fill dynamic_kind for flagged sink edges emitted by the native engine.
+        // Native bulkInsertEdges uses INSERT OR IGNORE and does not write dynamic_kind, so
+        // this UPDATE is the only way to set it for natively-inserted sink edges.
+        //
+        // Scope to confidence=0.0 AND dynamic=1 so we only touch sink edges (never normal
+        // call edges that happen to share the same (source_id, target_id) pair).
+        // Include dynamic_kind in the WHERE so two sink edges from the same caller to the
+        // same file with different kinds don't clobber each other across incremental runs.
+        if (dynamicKindRows.length > 0) {
+            const stmt = db.prepare("UPDATE edges SET dynamic_kind = ? WHERE kind = 'calls' AND source_id = ? AND target_id = ? AND confidence = 0.0 AND dynamic = 1 AND (dynamic_kind IS NULL OR dynamic_kind = ?)");
+            for (const r of dynamicKindRows)
+                stmt.run(r[6], r[0], r[1], r[6]);
         }
     });
     tx();
@@ -1068,6 +1298,7 @@ function reconnectReverseDepEdges(ctx) {
                 saved.confidence,
                 saved.dynamic,
                 saved.technique,
+                saved.dynamicKind ?? null,
             ]);
         }
         else {
@@ -1255,6 +1486,21 @@ export async function buildEdges(ctx) {
         else {
             buildCallEdgesJS(ctx, getNodeIdStmt, allEdgeRows, chaCtx);
         }
+        // Apply ts-native confidence floor to allEdgeRows in-memory.  The proximity
+        // heuristic returns 0.3 for cross-module calls with no import-path evidence,
+        // but both WASM and native engines perform actual name-based symbol lookup,
+        // which is stronger evidence than pure proximity.  Clamping to
+        // TS_NATIVE_CONFIDENCE_FLOOR (0.5) avoids unfairly dragging down the
+        // call-confidence metric.  Sink edges (confidence = 0.0) are excluded so
+        // they remain below DEFAULT_MIN_CONFIDENCE.
+        for (const r of allEdgeRows) {
+            if (r[2] === 'calls' &&
+                r[5] === 'ts-native' &&
+                r[3] > 0 &&
+                r[3] < TS_NATIVE_CONFIDENCE_FLOOR) {
+                r[3] = TS_NATIVE_CONFIDENCE_FLOOR;
+            }
+        }
         // When using native edge insert, skip JS insert here — do it after tx commits.
         // Otherwise insert edges within this transaction for atomicity.
         const useNativeEdgeInsert = ctx.engineName === 'native' && !!ctx.nativeDb?.bulkInsertEdges;