@optave/codegraph 3.13.0 → 3.15.0

package/dist/features/dataflow.js

@@ -124,7 +124,331 @@ function insertDataflowEdges(insert, data, resolveNode) {
     }
     return edgeCount;
 }
+// ── P1: dataflow_vertices + intra def_use edges ───────────────────────────────
+function prepareVertexStmts(db) {
+    try {
+        return {
+            insertVertex: db.prepare(`INSERT INTO dataflow_vertices (func_id, kind, name, param_index, line, node_id)
+         VALUES (?, ?, ?, ?, ?, ?)`),
+            insertIntraEdge: db.prepare(`INSERT INTO dataflow
+           (source_id, target_id, kind, source_vertex, target_vertex, scope, expression, line, confidence)
+         VALUES (?, ?, 'def_use', ?, ?, 'intra', ?, ?, 1.0)`),
+            available: true,
+        };
+    }
+    catch {
+        return {
+            insertVertex: db.prepare('SELECT 1'),
+            insertIntraEdge: db.prepare('SELECT 1'),
+            available: false,
+        };
+    }
+}
+/**
+ * Build dataflow_vertices, intra def_use edges, and summaries for one file.
+ * Called alongside insertDataflowEdges in the same transaction.
+ *
+ * Returns stitch candidates and return captures for the P2 inter-procedural
+ * post-pass (run after all files are processed).
+ */
+function buildDataflowVerticesAndEdges(db, vstmts, data, resolveNode) {
+    const empty = {
+        candidates: [],
+        captures: [],
+    };
+    if (!vstmts.available)
+        return empty;
+    const params = data.parameters;
+    const returns = data.returns;
+    const assignments = data.assignments;
+    const argFlows = data.argFlows;
+    const mutations = data.mutations;
+    // 1. param vertices
+    const paramVertexIds = new Map(); // "funcName:paramName" → vertex id
+    const paramIndexByFuncAndIndex = new Map(); // "funcId:paramIndex" → vertex id
+    for (const p of params) {
+        const fn = resolveNode(p.funcName);
+        if (!fn)
+            continue;
+        const result = vstmts.insertVertex.run(fn.id, 'param', p.paramName, p.paramIndex, p.line, null);
+        const vid = result.lastInsertRowid;
+        paramVertexIds.set(`${p.funcName}:${p.paramName}`, vid);
+        paramIndexByFuncAndIndex.set(`${fn.id}:${p.paramIndex}`, vid);
+    }
+    // 2. return vertices (one per function that has a return statement)
+    const returnVertexIds = new Map(); // funcName → vertex id
+    const returnFuncsSeen = new Set();
+    for (const r of returns) {
+        if (returnFuncsSeen.has(r.funcName))
+            continue;
+        returnFuncsSeen.add(r.funcName);
+        const fn = resolveNode(r.funcName);
+        if (!fn)
+            continue;
+        const result = vstmts.insertVertex.run(fn.id, 'return', null, null, r.line, null);
+        returnVertexIds.set(r.funcName, result.lastInsertRowid);
+    }
+    // 3. local vertices (from call-return assignments)
+    const localVertexIds = new Map(); // "funcName:varName" → vertex id
+    const localsSeen = new Set();
+    for (const a of assignments) {
+        const key = `${a.callerFunc}:${a.varName}`;
+        if (localsSeen.has(key))
+            continue;
+        localsSeen.add(key);
+        const fn = resolveNode(a.callerFunc);
+        if (!fn)
+            continue;
+        const result = vstmts.insertVertex.run(fn.id, 'local', a.varName, null, a.line, null);
+        localVertexIds.set(key, result.lastInsertRowid);
+    }
+    // 4. intra def_use edges: param/local → return
+    for (const r of returns) {
+        const fn = resolveNode(r.funcName);
+        if (!fn)
+            continue;
+        const returnVid = returnVertexIds.get(r.funcName);
+        if (!returnVid)
+            continue;
+        for (const name of r.referencedNames) {
+            const paramVid = paramVertexIds.get(`${r.funcName}:${name}`);
+            if (paramVid) {
+                vstmts.insertIntraEdge.run(fn.id, fn.id, paramVid, returnVid, r.expression, r.line);
+            }
+            const localVid = localVertexIds.get(`${r.funcName}:${name}`);
+            if (localVid) {
+                vstmts.insertIntraEdge.run(fn.id, fn.id, localVid, returnVid, r.expression, r.line);
+            }
+        }
+    }
+    // 5. summaries: flows_to_return = direct def_use from param to function's return
+    const checkDefUse = db.prepare(`SELECT 1 FROM dataflow WHERE source_vertex = ? AND target_vertex = ? AND kind = 'def_use' LIMIT 1`);
+    const insertSummary = db.prepare(`INSERT OR REPLACE INTO dataflow_summary (func_id, param_index, flows_to_return, is_mutated) VALUES (?, ?, ?, ?)`);
+    for (const p of params) {
+        const fn = resolveNode(p.funcName);
+        if (!fn)
+            continue;
+        const paramVid = paramVertexIds.get(`${p.funcName}:${p.paramName}`);
+        if (!paramVid)
+            continue;
+        const returnVid = returnVertexIds.get(p.funcName);
+        const flowsToReturn = returnVid ? (checkDefUse.get(paramVid, returnVid) ? 1 : 0) : 0;
+        const isMutated = mutations.some((m) => m.funcName === p.funcName &&
+            m.binding?.type === 'param' &&
+            m.binding?.index === p.paramIndex)
+            ? 1
+            : 0;
+        insertSummary.run(fn.id, p.paramIndex, flowsToReturn, isMutated);
+    }
+    // 6. collect stitch candidates for P2 inter-procedural post-pass
+    const candidates = [];
+    for (const af of argFlows) {
+        const callerFn = resolveNode(af.callerFunc);
+        const calleeFn = resolveNode(af.calleeName);
+        if (!callerFn || !calleeFn)
+            continue;
+        candidates.push({
+            callerFuncId: callerFn.id,
+            calleeFuncId: calleeFn.id,
+            argIndex: af.argIndex,
+            bindingType: af.binding.type,
+            bindingIndex: af.binding.index,
+            argName: af.argName,
+            expression: af.expression,
+            line: af.line,
+            confidence: af.confidence,
+        });
+    }
+    // 7. collect return captures (locals that hold a callee's return value)
+    const captures = [];
+    for (const a of assignments) {
+        const callerFn = resolveNode(a.callerFunc);
+        const calleeFn = resolveNode(a.sourceCallName);
+        if (!callerFn || !calleeFn)
+            continue;
+        captures.push({ callerFuncId: callerFn.id, calleeFuncId: calleeFn.id, varName: a.varName });
+    }
+    return { candidates, captures };
+}
+// ── P2: interprocedural stitching ─────────────────────────────────────────────
+/**
+ * Core stitch logic — must be called inside an already-open transaction.
+ *
+ * All callers (buildDataflowVerticesFromMap, buildDataflowEdges,
+ * buildDataflowP4ForNative) manage their own outer transaction and call this
+ * directly to avoid nested transactions, which better-sqlite3 does not support.
+ */
+function runInterproceduralStitch(db, candidates, captures) {
+    if (candidates.length === 0)
+        return 0;
+    const getParamVertex = db.prepare(`SELECT id FROM dataflow_vertices WHERE func_id = ? AND kind = 'param' AND param_index = ? LIMIT 1`);
+    const getLocalVertex = db.prepare(`SELECT id FROM dataflow_vertices WHERE func_id = ? AND kind = 'local' AND name = ? LIMIT 1`);
+    const getReturnVertex = db.prepare(`SELECT id FROM dataflow_vertices WHERE func_id = ? AND kind = 'return' LIMIT 1`);
+    const getCallEdge = db.prepare(`SELECT id FROM edges WHERE source_id = ? AND target_id = ? AND kind = 'calls' LIMIT 1`);
+    const getSummary = db.prepare(`SELECT flows_to_return FROM dataflow_summary WHERE func_id = ? AND param_index = ?`);
+    const insertInterEdge = db.prepare(`INSERT INTO dataflow
+       (source_id, target_id, kind, source_vertex, target_vertex, scope, call_edge_id, expression, line, confidence)
+     VALUES (?, ?, ?, ?, ?, 'inter', ?, ?, ?, ?)`);
+    // Build capture map: "callerFuncId:calleeFuncId" → varName (first match wins)
+    const captureMap = new Map();
+    for (const cap of captures) {
+        const key = `${cap.callerFuncId}:${cap.calleeFuncId}`;
+        if (!captureMap.has(key))
+            captureMap.set(key, cap.varName);
+    }
+    let count = 0;
+    for (const cand of candidates) {
+        // Resolve call edge for this site
+        const callEdge = getCallEdge.get(cand.callerFuncId, cand.calleeFuncId);
+        const callEdgeId = callEdge?.id ?? null;
+        // Find source vertex x in caller
+        let srcVertexId = null;
+        if (cand.bindingType === 'param' && cand.bindingIndex != null) {
+            const v = getParamVertex.get(cand.callerFuncId, cand.bindingIndex);
+            srcVertexId = v?.id ?? null;
+        }
+        else if (cand.bindingType === 'local') {
+            const v = getLocalVertex.get(cand.callerFuncId, cand.argName);
+            srcVertexId = v?.id ?? null;
+        }
+        if (!srcVertexId)
+            continue;
+        // Find callee's param[argIndex] vertex
+        const calleeParam = getParamVertex.get(cand.calleeFuncId, cand.argIndex);
+        if (!calleeParam)
+            continue;
+        // arg_in: A's source → B.param[j]
+        insertInterEdge.run(cand.callerFuncId, cand.calleeFuncId, 'arg_in', srcVertexId, calleeParam.id, callEdgeId, cand.expression, cand.line, cand.confidence);
+        count++;
+        // return_out: if B.param[j] reaches B's return, emit B.return → A's capture
+        const summary = getSummary.get(cand.calleeFuncId, cand.argIndex);
+        if (summary?.flows_to_return) {
+            const calleeReturn = getReturnVertex.get(cand.calleeFuncId);
+            if (calleeReturn) {
+                const captureVarName = captureMap.get(`${cand.callerFuncId}:${cand.calleeFuncId}`);
+                const captureVertex = captureVarName
+                    ? getLocalVertex.get(cand.callerFuncId, captureVarName)
+                    : null;
+                if (captureVertex) {
+                    insertInterEdge.run(cand.calleeFuncId, cand.callerFuncId, 'return_out', calleeReturn.id, captureVertex.id, callEdgeId, cand.expression, cand.line, cand.confidence);
+                    count++;
+                }
+            }
+        }
+    }
+    return count;
+}
 // ── buildDataflowEdges ──────────────────────────────────────────────────────
+// ── P4 helpers ───────────────────────────────────────────────────────────────
+/** Return IDs of all function/method nodes in the given relative file paths. */
+export function collectFuncIdsForFiles(db, relPaths) {
+    const stmt = db.prepare(`SELECT id FROM nodes WHERE file = ? AND kind IN ('function', 'method')`);
+    const ids = [];
+    for (const p of relPaths) {
+        for (const row of stmt.all(p))
+            ids.push(row.id);
+    }
+    return ids;
+}
+/**
+ * P4: Re-collect stitch candidates from caller files that were NOT in the
+ * changed set but contain calls to functions that WERE changed.
+ *
+ * During an incremental build the changed files' param vertices are purged
+ * and recreated, but the callers' files are never re-parsed — so their
+ * arg_in edges (pointing to the old param vertices) are deleted and never
+ * replaced. This function reads those caller files from disk and rebuilds
+ * the StitchCandidate list so runInterproceduralStitch can reconnect them.
+ */
+export async function collectCallerStitchCandidates(db, changedFuncIds, changedRelPaths, rootDir, extToLang, parsers, getParserFn) {
+    if (changedFuncIds.length === 0)
+        return { candidates: [], captures: [] };
+    // Find distinct caller files that have flows_to edges targeting any changed
+    // function and are NOT already in the changed file set (those are handled by
+    // the main per-file loop).
+    //
+    // Chunk the query to avoid exceeding SQLite's SQLITE_MAX_VARIABLE_NUMBER
+    // (999 on older builds, 32766 on SQLite ≥ 3.32).  500 is a safe batch size
+    // that works across all SQLite versions.
+    const CHUNK_SIZE = 500;
+    const callerFileSet = new Set();
+    for (let i = 0; i < changedFuncIds.length; i += CHUNK_SIZE) {
+        const chunk = changedFuncIds.slice(i, i + CHUNK_SIZE);
+        const placeholders = chunk.map(() => '?').join(',');
+        const rows = db
+            .prepare(`SELECT DISTINCT n.file AS caller_file
+         FROM dataflow d
+         JOIN nodes n ON n.id = d.source_id
+         WHERE d.target_id IN (${placeholders})
+           AND d.kind = 'flows_to'`)
+            .all(...chunk);
+        for (const r of rows)
+            callerFileSet.add(r.caller_file);
+    }
+    const callerFileRows = [...callerFileSet].map((f) => ({ caller_file: f }));
+    const callerFiles = callerFileRows
+        .map((r) => r.caller_file)
+        .filter((f) => !changedRelPaths.has(f));
+    if (callerFiles.length === 0)
+        return { candidates: [], captures: [] };
+    // Ensure parsers are available — the main loop may have skipped loading them
+    // if all changed files came through the native bulk-insert path.
+    let activeParsers = parsers;
+    let activeGetParserFn = getParserFn;
+    if (!activeGetParserFn) {
+        const { createParsers, getParser } = await import('../domain/parser.js');
+        activeParsers = await createParsers();
+        activeGetParserFn = getParser;
+    }
+    const changedFuncIdSet = new Set(changedFuncIds);
+    const stmts = prepareNodeResolvers(db);
+    const candidates = [];
+    const captures = [];
+    for (const callerFile of callerFiles) {
+        // Read the caller file from disk without touching its existing DB rows.
+        // definitions: [] is an intentional stub — P4 only needs argFlow/assignment
+        // data from the visitor, not pre-loaded symbol definitions.  extractDataflow
+        // does not currently use _definitions, so this is safe.  If that changes,
+        // the stub must be replaced with the actual symbol list for the caller file.
+        const stub = { definitions: [], _langId: null, _tree: null };
+        const data = getDataflowForFile(stub, callerFile, rootDir, extToLang, activeParsers, activeGetParserFn);
+        if (!data)
+            continue;
+        const resolver = makeNodeResolver(stmts, callerFile);
+        const argFlows = data.argFlows;
+        const assignments = data.assignments;
+        for (const af of argFlows) {
+            const callerFn = resolver(af.callerFunc);
+            const calleeFn = resolver(af.calleeName);
+            if (!callerFn || !calleeFn)
+                continue;
+            if (!changedFuncIdSet.has(calleeFn.id))
+                continue; // only re-stitch calls to changed callees
+            candidates.push({
+                callerFuncId: callerFn.id,
+                calleeFuncId: calleeFn.id,
+                argIndex: af.argIndex,
+                bindingType: af.binding.type,
+                bindingIndex: af.binding.index,
+                argName: af.argName,
+                expression: af.expression,
+                line: af.line,
+                confidence: af.confidence,
+            });
+        }
+        for (const a of assignments) {
+            const callerFn = resolver(a.callerFunc);
+            const calleeFn = resolver(a.sourceCallName);
+            if (!callerFn || !calleeFn)
+                continue;
+            if (!changedFuncIdSet.has(calleeFn.id))
+                continue;
+            captures.push({ callerFuncId: callerFn.id, calleeFuncId: calleeFn.id, varName: a.varName });
+        }
+    }
+    debug(`Dataflow P4: re-stitched ${candidates.length} candidate(s) from ${callerFiles.length} caller file(s)`);
+    return { candidates, captures };
+}
 function prepareNodeResolvers(db) {
     return {
         getNodeByNameAndFile: db.prepare(`SELECT id, name, kind, file, line FROM nodes
@@ -135,12 +459,24 @@ function prepareNodeResolvers(db) {
     };
 }
 function makeNodeResolver(stmts, relPath) {
+    // Memoise per (relPath, funcName). buildDataflowVerticesAndEdges resolves the
+    // same handful of function names many times per file — once per param, return,
+    // assignment, argFlow, summary row, and capture — and each miss costs one or
+    // two `nodes` table queries. The nodes table is never mutated during the P6
+    // vertex pass (only dataflow* tables are written), so the lookup is stable for
+    // the lifetime of the resolver; caching collapses tens of thousands of
+    // redundant queries on a full build into one per distinct name (#perf).
+    const cache = new Map();
     return (funcName) => {
+        const cached = cache.get(funcName);
+        if (cached !== undefined)
+            return cached;
         const local = stmts.getNodeByNameAndFile.all(funcName, relPath);
-        if (local.length > 0)
-            return local[0];
-        const global = stmts.getNodeByName.all(funcName);
-        return global.length > 0 ? global[0] : null;
+        const resolved = local.length > 0
+            ? local[0]
+            : (stmts.getNodeByName.all(funcName)[0] ?? null);
+        cache.set(funcName, resolved);
+        return resolved;
     };
 }
 function collectNativeEdges(data, resolveNode, edges) {
@@ -189,6 +525,99 @@ function collectNativeEdges(data, resolveNode, edges) {
         }
     }
 }
+/**
+ * P6 vertex-only pass for the native orchestrator path.
+ *
+ * When the Rust orchestrator runs with analysisComplete=true it inserts
+ * flows_to/returns/mutates edges directly into the DB but never writes to
+ * dataflow_vertices or dataflow_summary. This function takes pre-extracted
+ * DataflowResult objects (from native.extractDataflowAnalysis) and builds
+ * the missing vertex rows and inter-procedural edges — without touching the
+ * already-correct function-level edges.
+ */
+export function buildDataflowVerticesFromMap(db, dataflowMap, extraCandidates, extraCaptures) {
+    const vstmts = prepareVertexStmts(db);
+    if (!vstmts.available || dataflowMap.size === 0)
+        return 0;
+    const stmts = prepareNodeResolvers(db);
+    // Vertex writes and inter-procedural stitch are a single atomic unit: if the
+    // stitch throws or the process is killed between the two, the DB would be left
+    // with dataflow_vertices rows but no arg_in/return_out edges.  Wrapping both
+    // under one transaction boundary prevents that half-written state.
+    let stitchCount = 0;
+    const tx = db.transaction(() => {
+        const allCandidates = [];
+        const allCaptures = [];
+        for (const [relPath, data] of dataflowMap) {
+            const resolver = makeNodeResolver(stmts, relPath);
+            const { candidates, captures } = buildDataflowVerticesAndEdges(db, vstmts, data, resolver);
+            allCandidates.push(...candidates);
+            allCaptures.push(...captures);
+        }
+        // P4: merge in stitch candidates from unchanged caller files if provided.
+        if (extraCandidates && extraCandidates.length > 0)
+            allCandidates.push(...extraCandidates);
+        if (extraCaptures && extraCaptures.length > 0)
+            allCaptures.push(...extraCaptures);
+        stitchCount = runInterproceduralStitch(db, allCandidates, allCaptures);
+    });
+    tx();
+    return stitchCount;
+}
+/**
+ * P4 re-stitch pass for the native engine path.
+ *
+ * On incremental builds the changed files' param vertices are purged and
+ * recreated by the P6 vertex pass, but unchanged caller files are never
+ * re-parsed — so their arg_in edges (which pointed to the old param vertex
+ * IDs) are deleted and not replaced. This function re-parses those caller
+ * files and rebuilds the arg_in edges for any call that targets a function
+ * in one of the changed callee files.
+ *
+ * Called by the native orchestrator after buildDataflowVerticesFromMap.
+ * Safe to call on full builds — the guard below exits early when
+ * changedFiles covers all distinct files in the DB.
+ */
+export async function buildDataflowP4ForNative(db, changedFiles, rootDir) {
+    if (changedFiles.length === 0)
+        return;
+    // Deduplicate upfront so the full-build guard uses unique-file count, not
+    // raw array length (the orchestrator may emit the same path more than once).
+    const changedRelPaths = new Set(changedFiles);
+    // Skip on full builds — all files were in the changed set, so there are no
+    // unchanged callers to re-stitch.
+    const totalFilesInDb = db.prepare(`SELECT COUNT(DISTINCT file) AS n FROM nodes`).get().n;
+    if (changedRelPaths.size >= totalFilesInDb)
+        return;
+    const extToLang = buildExtToLangMap();
+    const changedFuncIds = collectFuncIdsForFiles(db, changedRelPaths);
+    if (changedFuncIds.length === 0)
+        return;
+    // parsers=null, getParserFn=null → collectCallerStitchCandidates initialises
+    // WASM parsers lazily for the caller files it needs to re-parse.
+    const { candidates, captures } = await collectCallerStitchCandidates(db, changedFuncIds, changedRelPaths, rootDir, extToLang, null, null);
+    if (candidates.length > 0) {
+        let count = 0;
+        // Wrap the DELETE + stitch in a single transaction so that a crash between
+        // the purge and the re-insert cannot leave arg_in edges permanently removed
+        // but never replaced.
+        db.transaction(() => {
+            // Purge any existing arg_in edges targeting the changed callees from unchanged
+            // caller files. These edges were inserted by a previous P4 pass. Without this
+            // guard, repeated calls to buildDataflowP4ForNative insert duplicates because
+            // the dataflow table has no UNIQUE constraint on (source_vertex, target_vertex).
+            const placeholders = changedFuncIds.map(() => '?').join(',');
+            db.prepare(`DELETE FROM dataflow
+         WHERE kind = 'arg_in'
+           AND target_id IN (${placeholders})
+           AND source_id NOT IN (${placeholders})`).run(...changedFuncIds, ...changedFuncIds);
+            count = runInterproceduralStitch(db, candidates, captures);
+        })();
+        if (count > 0) {
+            info(`Dataflow (native P4): ${count} inter-procedural edges re-stitched`);
+        }
+    }
+}
 export async function buildDataflowEdges(db, fileSymbols, rootDir, engineOpts) {
     const extToLang = buildExtToLangMap();
     // ── Native bulk-insert fast path ──────────────────────────────────────
@@ -219,6 +648,61 @@ export async function buildDataflowEdges(db, fileSymbols, rootDir, engineOpts) {
                 }
                 info(`Dataflow (native bulk): ${inserted} edges inserted`);
             }
+            // P6: vertex extraction on the native path.
+            // Rust DataflowResult already contains parameters/returns — no re-parse needed.
+            const vstmts = prepareVertexStmts(db);
+            if (vstmts.available) {
+                // P4: Incremental re-stitch — unchanged caller files are not in
+                // fileSymbols so their arg_in edges to the old param vertices were
+                // deleted by the purge and never recreated. Re-collect stitch
+                // candidates from those caller files by parsing them from disk.
+                //
+                // Skip on full builds: fileSymbols covers every file in the DB, so
+                // there are no unchanged callers to re-stitch.
+                //
+                // This async disk-read step must happen BEFORE the transaction opens
+                // (SQLite transactions are synchronous; async work inside them is not
+                // supported by better-sqlite3).
+                const totalFilesInDb = db.prepare(`SELECT COUNT(DISTINCT file) AS n FROM nodes`).get().n;
+                let p4CallerCount = 0;
+                const p4Candidates = [];
+                const p4Captures = [];
+                if (fileSymbols.size < totalFilesInDb) {
+                    const changedRelPaths = new Set(fileSymbols.keys());
+                    const changedFuncIds = collectFuncIdsForFiles(db, changedRelPaths);
+                    const extra = await collectCallerStitchCandidates(db, changedFuncIds, changedRelPaths, rootDir, extToLang, null, null);
+                    p4Candidates.push(...extra.candidates);
+                    p4Captures.push(...extra.captures);
+                    p4CallerCount = extra.candidates.length;
+                }
+                // Vertex writes and inter-procedural stitch are a single atomic unit:
+                // if the stitch throws or the process is killed between the two, the DB
+                // would be left with dataflow_vertices rows but no arg_in/return_out
+                // edges.  Wrapping both under one transaction boundary prevents that
+                // half-written state.
+                let interCount = 0;
+                const txVertex = db.transaction(() => {
+                    const allCandidates = [];
+                    const allCaptures = [];
+                    for (const [relPath, symbols] of fileSymbols) {
+                        if (!symbols.dataflow)
+                            continue;
+                        const ext = path.extname(relPath).toLowerCase();
+                        if (!DATAFLOW_EXTENSIONS.has(ext))
+                            continue;
+                        const resolver = makeNodeResolver(stmts, relPath);
+                        const { candidates, captures } = buildDataflowVerticesAndEdges(db, vstmts, symbols.dataflow, resolver);
+                        allCandidates.push(...candidates);
+                        allCaptures.push(...captures);
+                    }
+                    // Merge in the P4 candidates collected above before opening the tx.
+                    allCandidates.push(...p4Candidates);
+                    allCaptures.push(...p4Captures);
+                    interCount = runInterproceduralStitch(db, allCandidates, allCaptures);
+                });
+                txVertex();
+                info(`Dataflow (native): ${interCount} inter-procedural edges inserted${p4CallerCount > 0 ? ` (P4: ${p4CallerCount} re-stitch candidate(s) from unchanged callers)` : ''}`);
+            }
             return;
         }
         debug('Dataflow: some files lack pre-computed data — falling back to JS');
@@ -228,8 +712,39 @@ export async function buildDataflowEdges(db, fileSymbols, rootDir, engineOpts) {
     const insert = db.prepare(`INSERT INTO dataflow (source_id, target_id, kind, param_index, expression, line, confidence)
      VALUES (?, ?, ?, ?, ?, ?, ?)`);
     const stmts = prepareNodeResolvers(db);
+    const vstmts = prepareVertexStmts(db);
+    // P4: Incremental re-stitch — if only a subset of files changed, callers of
+    // the changed functions were not in fileSymbols, so their arg_in edges were
+    // deleted by the purge but never reconstructed. Re-collect stitch candidates
+    // from those caller files now (read from disk, no DB writes).
+    //
+    // Skip P4 on full builds: when fileSymbols covers every file in the DB there
+    // are no unchanged callers, and collectFuncIdsForFiles would issue one SELECT
+    // per file for nothing.  A single COUNT query is cheaper than N per-file SELECTs.
+    //
+    // This async disk-read step must happen BEFORE the transaction opens
+    // (SQLite transactions are synchronous; async work inside them is not
+    // supported by better-sqlite3).
+    const totalFilesInDb = db.prepare(`SELECT COUNT(DISTINCT file) AS n FROM nodes`).get().n;
+    const p4Candidates = [];
+    const p4Captures = [];
+    if (vstmts.available && fileSymbols.size < totalFilesInDb) {
+        const changedRelPaths = new Set(fileSymbols.keys());
+        const changedFuncIds = collectFuncIdsForFiles(db, changedRelPaths);
+        const extra = await collectCallerStitchCandidates(db, changedFuncIds, changedRelPaths, rootDir, extToLang, parsers, getParserFn);
+        p4Candidates.push(...extra.candidates);
+        p4Captures.push(...extra.captures);
+    }
+    // Edge writes, vertex writes, and inter-procedural stitch are a single
+    // atomic unit: if the stitch throws or the process is killed between vertex
+    // writes and the stitch, the DB would be left with dataflow_vertices rows
+    // but no arg_in/return_out edges.  Wrapping all three under one transaction
+    // boundary prevents that half-written state.
     let totalEdges = 0;
+    let interCount = 0;
     const tx = db.transaction(() => {
+        const allCandidates = [];
+        const allCaptures = [];
         for (const [relPath, symbols] of fileSymbols) {
             const ext = path.extname(relPath).toLowerCase();
             if (!DATAFLOW_EXTENSIONS.has(ext))
@@ -237,11 +752,20 @@ export async function buildDataflowEdges(db, fileSymbols, rootDir, engineOpts) {
             const data = getDataflowForFile(symbols, relPath, rootDir, extToLang, parsers, getParserFn);
             if (!data)
                 continue;
-            totalEdges += insertDataflowEdges(insert, data, makeNodeResolver(stmts, relPath));
+            const resolver = makeNodeResolver(stmts, relPath);
+            totalEdges += insertDataflowEdges(insert, data, resolver);
+            const { candidates, captures } = buildDataflowVerticesAndEdges(db, vstmts, data, resolver);
+            allCandidates.push(...candidates);
+            allCaptures.push(...captures);
         }
+        // Merge in the P4 candidates collected above before opening the tx.
+        allCandidates.push(...p4Candidates);
+        allCaptures.push(...p4Captures);
+        // P2: inter-procedural stitch — runs after all per-file vertices + summaries written
+        interCount = vstmts.available ? runInterproceduralStitch(db, allCandidates, allCaptures) : 0;
     });
     tx();
-    info(`Dataflow: ${totalEdges} edges inserted`);
+    info(`Dataflow: ${totalEdges} fn-level edges, ${interCount} inter-procedural edges inserted`);
 }
 function prepareDataflowStmts(db) {
     return {