@optave/codegraph 3.13.0 → 3.15.0

package/src/domain/graph/builder/stages/native-orchestrator.ts

@@ -11,6 +11,7 @@
  * The orchestrator-selection strategy lives here so `pipeline.ts` stays a thin
  * top-level controller: detect changes, try native, fall back to JS stages.
  */
+import { execFileSync } from 'node:child_process';
 import path from 'node:path';
 import { performance } from 'node:perf_hooks';
 import {
@@ -24,12 +25,13 @@ import {
 import { debug, info, warn } from '../../../../infrastructure/logger.js';
 import { loadNative } from '../../../../infrastructure/native.js';
 import { semverCompare } from '../../../../infrastructure/update-check.js';
-import { normalizePath } from '../../../../shared/constants.js';
+import { normalizePath, TS_NATIVE_CONFIDENCE_FLOOR } from '../../../../shared/constants.js';
 import { toErrorMessage } from '../../../../shared/errors.js';
 import { CODEGRAPH_VERSION } from '../../../../shared/version.js';
 import type {
   BetterSqlite3Database,
   BuildResult,
+  DataflowResult,
   Definition,
   ExtractorOutput,
   SqliteStatement,
@@ -40,6 +42,7 @@ import {
   getInstalledWasmExtensions,
   NATIVE_SUPPORTED_EXTENSIONS,
   parseFilesWasmForBackfill,
+  patchDataflowResult,
 } from '../../../parser.js';
 import { computeConfidence } from '../../resolve.js';
 import type { CallNodeLookup } from '../call-resolver.js';
@@ -294,6 +297,257 @@ async function runPostNativeStructure(
   return performance.now() - structureStart;
 }
 
+/**
+ * P6: Build dataflow_vertices and inter-procedural edges after the Rust
+ * orchestrator completes.
+ *
+ * The Rust pipeline writes flows_to/returns/mutates edges directly to the DB
+ * but never writes to dataflow_vertices or dataflow_summary. This pass re-runs
+ * the Rust dataflow visitor (via extractDataflowAnalysis — fast, no re-parse)
+ * to get the DataflowResult and calls buildDataflowVerticesFromMap.
+ *
+ * Languages for which Rust has no dataflow rules return null from
+ * extractDataflowAnalysis and are silently skipped here. A follow-up issue
+ * (#1614 adjacent) will add WASM fallback for those languages.
+ */
+async function runDataflowVertexPass(
+  ctx: PipelineContext,
+  changedFiles: string[] | undefined,
+): Promise<void> {
+  if (ctx.opts.dataflow === false) return;
+
+  const native = loadNative();
+  if (!native?.extractDataflowAnalysis) return;
+
+  // Determine which files to process: changed files for incremental, all for full builds.
+  let filesToProcess: string[];
+  if (changedFiles && changedFiles.length > 0) {
+    filesToProcess = changedFiles;
+  } else {
+    // Full build: scope to files that need vertex extraction rather than scanning every
+    // file in the project. Two categories:
+    //   (a) Non-native language files — NATIVE_SUPPORTED_EXTENSIONS doesn't cover them,
+    //       so extractDataflowAnalysis returns null; the wasmStubs path calls buildDataflowEdges
+    //       which writes both edges AND vertices for those files.
+    //   (b) Native-language files with dataflow edges already written by the Rust orchestrator
+    //       (flows_to/returns/mutates) — those need vertex rows to connect them.
+    //
+    // Skipping native-language files with no dataflow edges is safe: extractDataflowAnalysis
+    // would return argFlows=[], assignments=[], mutations=[] for them, producing zero vertices
+    // and zero inter-procedural edges. Excluding them avoids O(n_total_files) re-analysis on
+    // every full build (codegraph itself: ~2000 files, ~50-80% with no dataflow edges).
+    const filesWithDataflow = new Set(
+      (
+        ctx.db
+          .prepare(
+            `SELECT DISTINCT n.file
+             FROM dataflow d
+             JOIN nodes n ON n.id = d.source_id
+             WHERE n.file IS NOT NULL`,
+          )
+          .all() as { file: string }[]
+      ).map((r) => r.file),
+    );
+
+    filesToProcess = (
+      ctx.db
+        .prepare(`SELECT DISTINCT file FROM nodes WHERE file IS NOT NULL AND kind != 'directory'`)
+        .all() as { file: string }[]
+    )
+      .map((r) => r.file)
+      .filter((f) => {
+        const ext = path.extname(f).toLowerCase();
+        // Non-native files: always include (WASM handles them via wasmStubs path).
+        if (!NATIVE_SUPPORTED_EXTENSIONS.has(ext)) return true;
+        // Native files: only include when Rust wrote dataflow edges for them.
+        return filesWithDataflow.has(f);
+      });
+  }
+
+  // Split files into two buckets:
+  //   nativeDataflow — Rust extracted data (vertex-only pass; edges already in DB)
+  //   wasmStubs      — Rust returned null (WASM will handle edges + vertices)
+  const nativeDataflow = new Map<string, DataflowResult>();
+  const wasmStubs = new Map<string, { definitions: []; _langId: null; _tree: null }>();
+
+  const absPaths = filesToProcess.map((relPath) => path.join(ctx.rootDir, relPath));
+
+  // Batch the per-file dataflow extraction into one NAPI call so the parses run
+  // across the rayon thread pool instead of serially on the event loop — this is
+  // the dominant cost of a native full build (#perf). Older addons predate the
+  // batch export, so fall back to the per-file path when it is unavailable.
+  let batchResults: (DataflowResult | null)[] | null = null;
+  if (typeof native.extractDataflowAnalysisBatch === 'function') {
+    try {
+      batchResults = native.extractDataflowAnalysisBatch(absPaths);
+    } catch {
+      batchResults = null; // fall through to per-file extraction below
+    }
+  }
+
+  for (let i = 0; i < filesToProcess.length; i++) {
+    const relPath = filesToProcess[i]!;
+    let result: DataflowResult | null = null;
+    if (batchResults) {
+      result = batchResults[i] ?? null;
+    } else {
+      let source: string;
+      try {
+        source = readFileSafe(absPaths[i]!);
+      } catch {
+        // Unreadable file — mirror batch-path behaviour and route to WASM.
+        wasmStubs.set(relPath, { definitions: [], _langId: null, _tree: null });
+        continue;
+      }
+      if (!source) {
+        // Empty file — same treatment as batch returning null.
+        wasmStubs.set(relPath, { definitions: [], _langId: null, _tree: null });
+        continue;
+      }
+      try {
+        result = native.extractDataflowAnalysis(source, absPaths[i]!);
+      } catch {
+        // Language-specific parse failure — fall through to WASM.
+      }
+    }
+    if (result) {
+      // Normalise the native DataflowResult: Rust emits `bindingType: string | null`
+      // (flat) while the TS dataflow layer expects `binding: { type, index? }` (object).
+      // patchNativeResult handles this via patchDataflow for the full parse path;
+      // extractDataflowAnalysis(Batch) is a vertex-only fast path that bypasses
+      // patchNativeResult, so we apply the same normalisation here.
+      patchDataflowResult(result);
+      nativeDataflow.set(relPath, result);
+    } else {
+      // Rust has no dataflow rules for this language; WASM fallback will handle
+      // both edge insertion and vertex extraction. Since Rust inserted 0 dataflow
+      // edges for these files, there is no risk of duplicates.
+      wasmStubs.set(relPath, { definitions: [], _langId: null, _tree: null });
+    }
+  }
+
+  const { buildExtToLangMap } = (await import('../../../../ast-analysis/shared.js')) as {
+    buildExtToLangMap: () => Map<string, string>;
+  };
+
+  const {
+    buildDataflowVerticesFromMap,
+    buildDataflowEdges,
+    collectCallerStitchCandidates,
+    collectFuncIdsForFiles,
+  } = (await import('../../../../features/dataflow.js')) as {
+    buildDataflowVerticesFromMap: (
+      db: BetterSqlite3Database,
+      dataflowMap: Map<string, DataflowResult>,
+      extraCandidates?: Array<{
+        callerFuncId: number;
+        calleeFuncId: number;
+        argIndex: number;
+        bindingType: string;
+        bindingIndex: number;
+        argName: string;
+        expression: string | null;
+        line: number;
+        confidence: number;
+      }>,
+      extraCaptures?: Array<{ callerFuncId: number; calleeFuncId: number; varName: string }>,
+    ) => number;
+    buildDataflowEdges: (
+      db: BetterSqlite3Database,
+      fileSymbols: Map<string, unknown>,
+      rootDir: string,
+      engineOpts?: unknown,
+    ) => Promise<void>;
+    collectCallerStitchCandidates: (
+      db: BetterSqlite3Database,
+      changedFuncIds: number[],
+      changedRelPaths: Set<string>,
+      rootDir: string,
+      extToLang: Map<string, string>,
+      parsers: unknown,
+      getParserFn: unknown,
+    ) => Promise<{
+      candidates: Array<{
+        callerFuncId: number;
+        calleeFuncId: number;
+        argIndex: number;
+        bindingType: string;
+        bindingIndex: number;
+        argName: string;
+        expression: string | null;
+        line: number;
+        confidence: number;
+      }>;
+      captures: Array<{ callerFuncId: number; calleeFuncId: number; varName: string }>;
+    }>;
+    collectFuncIdsForFiles: (db: BetterSqlite3Database, relPaths: Iterable<string>) => number[];
+  };
+
+  // Rust-supported languages: build vertices only (edges already written by Rust orchestrator).
+  if (nativeDataflow.size > 0) {
+    // P4: On incremental builds, unchanged caller files' arg_in edges were deleted when
+    // the changed files' param vertices were purged and recreated. Re-collect stitch
+    // candidates from those caller files so buildInterproceduralStitch can reconnect them.
+    // Skip on full builds (changedFiles absent/empty) — nativeDataflow covers all files.
+    let p4Candidates: Array<{
+      callerFuncId: number;
+      calleeFuncId: number;
+      argIndex: number;
+      bindingType: string;
+      bindingIndex: number;
+      argName: string;
+      expression: string | null;
+      line: number;
+      confidence: number;
+    }> = [];
+    let p4Captures: Array<{ callerFuncId: number; calleeFuncId: number; varName: string }> = [];
+
+    if (changedFiles && changedFiles.length > 0) {
+      const changedSet = new Set(changedFiles);
+      const totalFilesInDb = (
+        ctx.db.prepare(`SELECT COUNT(DISTINCT file) AS n FROM nodes`).get() as { n: number }
+      ).n;
+      // Only run P4 when this is a real incremental build (not all files changed).
+      if (nativeDataflow.size < totalFilesInDb) {
+        const changedFuncIds = collectFuncIdsForFiles(ctx.db, changedSet);
+        if (changedFuncIds.length > 0) {
+          const extra = await collectCallerStitchCandidates(
+            ctx.db,
+            changedFuncIds,
+            changedSet,
+            ctx.rootDir,
+            buildExtToLangMap(),
+            null, // parsers — lazily loaded inside collectCallerStitchCandidates
+            null, // getParserFn — lazily loaded inside collectCallerStitchCandidates
+          );
+          p4Candidates = extra.candidates as typeof p4Candidates;
+          p4Captures = extra.captures;
+        }
+      }
+    }
+
+    const interCount = buildDataflowVerticesFromMap(
+      ctx.db,
+      nativeDataflow,
+      p4Candidates.length > 0 ? p4Candidates : undefined,
+      p4Captures.length > 0 ? p4Captures : undefined,
+    );
+    if (interCount > 0) {
+      info(
+        `Dataflow (native orchestrator): ${interCount} inter-procedural edges inserted${p4Candidates.length > 0 ? ` (P4: ${p4Candidates.length} re-stitch candidate(s) from unchanged callers)` : ''}`,
+      );
+    }
+  }
+
+  // Rust-unsupported languages: run the full WASM extraction (edges + vertices).
+  // wasmStubs entries have no `.dataflow` property, so the native bulk-insert
+  // fast path in buildDataflowEdges is always skipped for them — WASM runs
+  // both edge insertion and vertex extraction end-to-end.
+  if (wasmStubs.size > 0) {
+    await buildDataflowEdges(ctx.db, wasmStubs, ctx.rootDir);
+  }
+}
+
 /**
  * JS fallback for AST/complexity/CFG/dataflow analysis after native orchestrator.
  * Used when the Rust addon doesn't include analysis persistence (older addon
@@ -389,53 +643,10 @@ async function runPostNativeAnalysis(
   return timing;
 }
 
-/**
- * Phase 8.6: CHA expansion post-pass for the native orchestrator path.
- *
- * The Rust build pipeline resolves typed receiver calls (e.g. `worker.doWork()`
- * where `worker: IWorker`) to the interface method declaration only.  This
- * post-pass reads the class hierarchy (via `implements`/`extends` edges) and
- * instantiated types (via `calls` edges to class nodes) from the DB and expands
- * each call to an interface/abstract method to ALL RTA-filtered concrete
- * implementations.
- *
- * Note: `this`/`super` dispatch is handled separately by `runPostNativeThisDispatch`,
- * which WASM-re-parses JS/TS files to obtain raw call site receiver info.
- *
- * `changedFiles` controls candidate scoping on incremental builds:
- *   - null  → full build; scan all call→method edges (existing behaviour).
- *   - array → incremental; two cheap gate queries decide scope:
- *       Gate A: any class/interface/trait/struct/record nodes in changed files?
- *               If yes, a new implementor may have appeared — full scan required.
- *       Gate B: any `calls` edges from changed-file sources targeting
- *               class/constructor/function-kind nodes? If yes, the RTA set may
- *               have grown (also covers the older-schema fallback where
- *               constructor calls target `constructor`/`function` nodes instead
- *               of `class` nodes) — full scan required.
- *       If neither gate fires: scope `callToMethods` to `src.file IN changedFiles`
- *       (safe because no hierarchy or RTA evidence changed).
- *
- * Returns the count of newly inserted CHA edges plus the set of files containing
- * the new edges' endpoints, so the caller can scope role re-classification to the
- * nodes whose fan-in/out actually changed. A zero count means no edges were added
- * and role re-classification is unnecessary.
- */
-function runPostNativeCha(
-  db: BetterSqlite3Database,
-  changedFiles: string[] | null,
-): {
-  newEdgeCount: number;
-  affectedFiles: Set<string>;
-} {
-  const affectedFiles = new Set<string>();
-  const empty = { newEdgeCount: 0, affectedFiles };
-  // Fast guard: no hierarchy edges → no CHA work
-  const hasHierarchy = db
-    .prepare(`SELECT 1 FROM edges WHERE kind IN ('extends', 'implements') LIMIT 1`)
-    .get();
-  if (!hasHierarchy) return empty;
+// ── CHA post-pass helpers ────────────────────────────────────────────────────
 
-  // Build implementors map: parent/interface name → [child/implementing class names]
+/** Build implementors map: parent/interface name → [child/implementing class names]. */
+function buildChaImplementorsMap(db: BetterSqlite3Database): Map<string, string[]> {
   const hierarchyRows = db
     .prepare(`
       SELECT src.name AS child_name, tgt.name AS parent_name
@@ -455,12 +666,22 @@ function runPostNativeCha(
     }
     if (!list.includes(row.child_name)) list.push(row.child_name);
   }
-  if (implementors.size === 0) return empty;
+  return implementors;
+}
 
-  // RTA: collect class names that are actually instantiated via `new X()`.
-  // Primary query targets `class`-kind nodes (the canonical schema).
-  // Fallback also matches `constructor`/`function`-kind nodes because some native
-  // engine versions record constructor calls against those kinds instead of `class`.
+/**
+ * Build RTA set: class names actually instantiated via `new X()`.
+ * Primary query targets `class`-kind nodes (the canonical schema).
+ * Fallback also matches `constructor`/`function`-kind nodes because some native
+ * engine versions record constructor calls against those kinds instead of `class`.
+ * Returns `{ instantiated, noRtaEvidence }` where `noRtaEvidence` means no
+ * constructor-call evidence exists — skip RTA filtering so interface dispatch
+ * still produces edges.
+ */
+function buildChaRtaSet(db: BetterSqlite3Database): {
+  instantiated: Set<string>;
+  noRtaEvidence: boolean;
+} {
   let rtaRows = db
     .prepare(`
       SELECT DISTINCT tgt.name
@@ -482,110 +703,104 @@ function runPostNativeCha(
       .all() as Array<{ name: string }>;
   }
   const instantiated = new Set(rtaRows.map((r) => r.name));
-  // noRtaEvidence: true when no constructor-call evidence exists in the DB (e.g. graph
-  // built by an older native engine that doesn't emit constructor call edges at all).
-  // In that case we skip RTA filtering so interface dispatch still produces edges —
-  // all instantiated implementors are admitted rather than silently dropping everything.
   const noRtaEvidence = instantiated.size === 0;
   if (noRtaEvidence) {
     debug('runPostNativeCha: no constructor-call evidence found — proceeding without RTA filter');
   }
+  return { instantiated, noRtaEvidence };
+}
 
-  // ── Incremental candidate scoping ──────────────────────────────────────────
-  // On incremental builds, two gate queries decide whether to restrict the
-  // candidate scan to changed-file call sites or run the full graph scan.
-  //
-  // Gate A: did a changed file add/change a class hierarchy node?
-  //   A new `extends`/`implements` edge means a previously-untracked implementor
-  //   is now in the hierarchy — unchanged call sites in OTHER files may gain new
-  //   valid expansions, so the full scan is required.
-  //   Note: *removed* class nodes are safe — Rust's `purge_changed_files` runs
-  //   before this post-pass and deletes stale nodes and their hierarchy edges, so
-  //   Gate A queries the post-purge DB. A deleted class returns no row here, which
-  //   is correct: its stale CHA edges were already cleaned up by the Rust purge.
-  //
-  // Gate B: did a changed file add new RTA evidence (`new ConcreteX()`)?
-  //   A new `calls` edge to a class/constructor/function-kind target means the
-  //   instantiated set grew — previously RTA-filtered expansions in unchanged
-  //   caller files become admissible, so the full scan is required.
-  //   (`constructor`/`function` cover the older native engine fallback schema.)
-  //
-  // If neither gate fires, the hierarchy and RTA set are unchanged for all files
-  // outside changedFiles, so restricting to changed-file sources is safe.
-  let scopeToChangedFiles = false; // true → add WHERE src.file IN changedFiles
-  if (changedFiles !== null && changedFiles.length > 0) {
-    // Gate A: class/interface/trait/struct/record nodes in changed files?
-    const CHUNK_SIZE = 500;
-    let gateAFired = false;
-    for (let i = 0; i < changedFiles.length && !gateAFired; i += CHUNK_SIZE) {
+/**
+ * Determine CHA candidate scope for incremental builds.
+ *
+ * Gate A: did a changed file add/change a class hierarchy node?
+ *   A new `extends`/`implements` edge means a previously-untracked implementor
+ *   is now in the hierarchy — unchanged call sites in OTHER files may gain new
+ *   valid expansions, so the full scan is required.
+ *   Note: *removed* class nodes are safe — Rust's `purge_changed_files` runs
+ *   before this post-pass and deletes stale nodes and their hierarchy edges, so
+ *   Gate A queries the post-purge DB. A deleted class returns no row here, which
+ *   is correct: its stale CHA edges were already cleaned up by the Rust purge.
+ *
+ * Gate B: did a changed file add new RTA evidence (`new ConcreteX()`)?
+ *   A new `calls` edge to a class/constructor/function-kind target means the
+ *   instantiated set grew — previously RTA-filtered expansions in unchanged
+ *   caller files become admissible, so the full scan is required.
+ *   (`constructor`/`function` cover the older native engine fallback schema.)
+ *
+ * Returns `true` when the scan should be scoped to changed-file sources only.
+ * Returns `false` (full scan) when changedFiles is null, empty, or either gate fires.
+ */
+function computeChaScope(db: BetterSqlite3Database, changedFiles: string[] | null): boolean {
+  if (changedFiles === null || changedFiles.length === 0) return false;
+
+  const CHUNK_SIZE = 500;
+  let gateAFired = false;
+  for (let i = 0; i < changedFiles.length && !gateAFired; i += CHUNK_SIZE) {
+    const chunk = changedFiles.slice(i, i + CHUNK_SIZE);
+    const ph = chunk.map(() => '?').join(',');
+    const row = db
+      .prepare(
+        `SELECT 1 FROM nodes
+         WHERE file IN (${ph})
+         AND kind IN ('class', 'interface', 'trait', 'struct', 'record')
+         LIMIT 1`,
+      )
+      .get(...chunk);
+    if (row) gateAFired = true;
+  }
+
+  let gateBFired = false;
+  if (!gateAFired) {
+    for (let i = 0; i < changedFiles.length && !gateBFired; i += CHUNK_SIZE) {
       const chunk = changedFiles.slice(i, i + CHUNK_SIZE);
       const ph = chunk.map(() => '?').join(',');
       const row = db
         .prepare(
-          `SELECT 1 FROM nodes
-           WHERE file IN (${ph})
-           AND kind IN ('class', 'interface', 'trait', 'struct', 'record')
+          `SELECT 1 FROM edges e
+           JOIN nodes src ON e.source_id = src.id
+           JOIN nodes tgt ON e.target_id = tgt.id
+           WHERE e.kind = 'calls'
+           AND tgt.kind IN ('class', 'interface', 'trait', 'struct', 'record', 'constructor', 'function')
+           AND src.file IN (${ph})
            LIMIT 1`,
         )
         .get(...chunk);
-      if (row) gateAFired = true;
-    }
-
-    // Gate B: calls from changed-file sources to class/instantiable-kind targets
-    // (also covers older-schema fallback and future CHA extensions to struct/record).
-    // Includes class/interface/trait/struct/record (future CHA extension safety) and
-    // constructor/function (older native engine schema fallback).
-    let gateBFired = false;
-    if (!gateAFired) {
-      for (let i = 0; i < changedFiles.length && !gateBFired; i += CHUNK_SIZE) {
-        const chunk = changedFiles.slice(i, i + CHUNK_SIZE);
-        const ph = chunk.map(() => '?').join(',');
-        const row = db
-          .prepare(
-            `SELECT 1 FROM edges e
-             JOIN nodes src ON e.source_id = src.id
-             JOIN nodes tgt ON e.target_id = tgt.id
-             WHERE e.kind = 'calls'
-             AND tgt.kind IN ('class', 'interface', 'trait', 'struct', 'record', 'constructor', 'function')
-             AND src.file IN (${ph})
-             LIMIT 1`,
-          )
-          .get(...chunk);
-        if (row) gateBFired = true;
-      }
+      if (row) gateBFired = true;
     }
+  }
 
-    if (!gateAFired && !gateBFired) {
-      scopeToChangedFiles = true;
-      debug(
-        `runPostNativeCha: neither gate fired — scoping candidate scan to ${changedFiles.length} changed file(s)`,
-      );
-    } else {
-      debug(
-        `runPostNativeCha: ${gateAFired ? 'Gate A (hierarchy)' : 'Gate B (RTA)'} fired — running full scan`,
-      );
-    }
+  if (!gateAFired && !gateBFired) {
+    debug(
+      `runPostNativeCha: neither gate fired — scoping candidate scan to ${changedFiles.length} changed file(s)`,
+    );
+    return true;
   }
+  debug(
+    `runPostNativeCha: ${gateAFired ? 'Gate A (hierarchy)' : 'Gate B (RTA)'} fired — running full scan`,
+  );
+  return false;
+}
 
-  // Find existing call edges targeting qualified methods (e.g., 'IWorker.doWork').
-  // Include caller_file and method_file so affectedFiles can be populated for
-  // incremental role reclassification; confidence uses CHA_TYPED_DISPATCH_CONFIDENCE matching runChaPostPass.
-  // When scopeToChangedFiles is true, restrict to call sites in the changed files
-  // (safe because no hierarchy or RTA evidence changed outside those files).
-  let callToMethods: Array<{
-    source_id: number;
-    caller_name: string;
-    method_name: string;
-    caller_file: string | null;
-  }>;
+type ChaCallRow = {
+  source_id: number;
+  caller_name: string;
+  method_name: string;
+  caller_file: string | null;
+};
+
+/**
+ * Fetch call→method rows that are candidates for CHA expansion.
+ * When `scopeToChangedFiles` is true, restricts to source nodes in `changedFiles`.
+ */
+function fetchChaCallToMethods(
+  db: BetterSqlite3Database,
+  changedFiles: string[] | null,
+  scopeToChangedFiles: boolean,
+): ChaCallRow[] {
   if (scopeToChangedFiles && changedFiles && changedFiles.length > 0) {
     const CHUNK_SIZE = 500;
-    const rows: Array<{
-      source_id: number;
-      caller_name: string;
-      method_name: string;
-      caller_file: string | null;
-    }> = [];
+    const rows: ChaCallRow[] = [];
     for (let i = 0; i < changedFiles.length; i += CHUNK_SIZE) {
       const chunk = changedFiles.slice(i, i + CHUNK_SIZE);
       const ph = chunk.map(() => '?').join(',');
@@ -600,33 +815,36 @@ function runPostNativeCha(
            AND (e.technique IS NULL OR e.technique != 'cha-expanded')
            AND src.file IN (${ph})`,
         )
-        .all(...chunk) as Array<{
-        source_id: number;
-        caller_name: string;
-        method_name: string;
-        caller_file: string | null;
-      }>;
+        .all(...chunk) as ChaCallRow[];
       rows.push(...chunkRows);
     }
-    callToMethods = rows;
-  } else {
-    callToMethods = db
-      .prepare(`
-        SELECT e.source_id, src.name AS caller_name, tgt.name AS method_name, src.file AS caller_file
-        FROM edges e
-        JOIN nodes tgt ON e.target_id = tgt.id
-        JOIN nodes src ON e.source_id = src.id
-        WHERE e.kind = 'calls' AND tgt.kind = 'method'
-        AND INSTR(tgt.name, '.') > 0
-        AND (e.technique IS NULL OR e.technique != 'cha-expanded')
-      `)
-      .all() as Array<{
-      source_id: number;
-      caller_name: string;
-      method_name: string;
-      caller_file: string | null;
-    }>;
+    return rows;
   }
+  return db
+    .prepare(`
+      SELECT e.source_id, src.name AS caller_name, tgt.name AS method_name, src.file AS caller_file
+      FROM edges e
+      JOIN nodes tgt ON e.target_id = tgt.id
+      JOIN nodes src ON e.source_id = src.id
+      WHERE e.kind = 'calls' AND tgt.kind = 'method'
+      AND INSTR(tgt.name, '.') > 0
+      AND (e.technique IS NULL OR e.technique != 'cha-expanded')
+    `)
+    .all() as ChaCallRow[];
+}
+
+/**
+ * BFS-expand CHA call edges and insert new edges into the DB.
+ * Returns `{ newEdgeCount, affectedFiles }` for role re-classification scoping.
+ */
+function expandChaEdges(
+  db: BetterSqlite3Database,
+  callToMethods: ChaCallRow[],
+  implementors: Map<string, string[]>,
+  instantiated: Set<string>,
+  noRtaEvidence: boolean,
+): { newEdgeCount: number; affectedFiles: Set<string> } {
+  const affectedFiles = new Set<string>();
 
   // Seed seen-pairs only from the source_ids we'll be expanding — avoids loading every
   // call edge in the DB (which would be O(all edges)) for large codebases.
@@ -707,88 +925,107 @@ function runPostNativeCha(
   return { newEdgeCount, affectedFiles };
 }
 
-// Extensions where `this`/`super` dispatch can occur (JS/TS family)
-const THIS_DISPATCH_EXTS = new Set(['.js', '.ts', '.tsx', '.jsx', '.mjs', '.cjs', '.mts', '.cts']);
-
 /**
- * Phase 8.5: this/super dispatch post-pass for the native orchestrator path.
+ * Phase 8.6: CHA expansion post-pass for the native orchestrator path.
  *
- * The Rust build pipeline resolves typed receiver calls but does NOT persist raw
- * unresolved call site receiver info (e.g. `this`, `super`) to the DB. This
- * hybrid post-pass re-parses JS/TS/TSX files via WASM to collect call sites with
- * `this`/`super` receivers, then resolves them through the class hierarchy stored
- * in DB `extends` edges — mirroring what `buildChaPostPass` does on the WASM path.
+ * The Rust build pipeline resolves typed receiver calls (e.g. `worker.doWork()`
+ * where `worker: IWorker`) to the interface method declaration only.  This
+ * post-pass reads the class hierarchy (via `implements`/`extends` edges) and
+ * instantiated types (via `calls` edges to class nodes) from the DB and expands
+ * each call to an interface/abstract method to ALL RTA-filtered concrete
+ * implementations.
  *
- * Also handles function-as-object-property methods (`f.h = function() { this.g() }`):
- * these use `this` to reference sibling properties on the same object (`f`), so
- * `resolveThisDispatch` resolves them by treating the dot-prefix of the caller name
- * (`f` from `f.h`) as the class and looking up `f.g` directly — no `extends` edge needed.
+ * Note: `this`/`super` dispatch is handled separately by `runPostNativeThisDispatch`,
+ * which WASM-re-parses JS/TS files to obtain raw call site receiver info.
  *
- * Runs when either `extends` edges exist (class inheritance) OR dot-named `method`
- * nodes exist (func-prop assignments); skips only when neither is present.
+ * `changedFiles` controls candidate scoping on incremental builds:
+ *   - null  → full build; scan all call→method edges (existing behaviour).
+ *   - array → incremental; two cheap gate queries decide scope:
+ *       Gate A: any class/interface/trait/struct/record nodes in changed files?
+ *               If yes, a new implementor may have appeared — full scan required.
+ *       Gate B: any `calls` edges from changed-file sources targeting
+ *               class/constructor/function-kind nodes? If yes, the RTA set may
+ *               have grown (also covers the older-schema fallback where
+ *               constructor calls target `constructor`/`function` nodes instead
+ *               of `class` nodes) — full scan required.
+ *       If neither gate fires: scope `callToMethods` to `src.file IN changedFiles`
+ *       (safe because no hierarchy or RTA evidence changed).
+ *
+ * Returns the count of newly inserted CHA edges plus the set of files containing
+ * the new edges' endpoints, so the caller can scope role re-classification to the
+ * nodes whose fan-in/out actually changed. A zero count means no edges were added
+ * and role re-classification is unnecessary.
  */
-async function runPostNativeThisDispatch(
+function runPostNativeCha(
   db: BetterSqlite3Database,
-  rootDir: string,
-  changedFiles: string[] | undefined,
-  isFullBuild: boolean,
-): Promise<{ elapsedMs: number; targetIds: Set<number>; affectedFiles: Set<string> }> {
-  const t0 = performance.now();
-  const targetIds = new Set<number>();
-  // Files containing endpoints of newly inserted edges — lets the caller scope
-  // role re-classification to the nodes whose fan-in/out actually changed.
+  changedFiles: string[] | null,
+): {
+  newEdgeCount: number;
+  affectedFiles: Set<string>;
+} {
   const affectedFiles = new Set<string>();
-
-  // Fast guard: need at least one extends edge (class inheritance) OR a dot-named
-  // method node (func-prop assignment: `f.h = function() { this.g() }`) for
-  // this/super dispatch to produce any edges.
-  const hasExtends = db.prepare(`SELECT 1 FROM edges WHERE kind = 'extends' LIMIT 1`).get();
-  const hasFuncPropMethod = db
-    .prepare(`SELECT 1 FROM nodes WHERE kind = 'method' AND INSTR(name, '.') > 0 LIMIT 1`)
+  const empty = { newEdgeCount: 0, affectedFiles };
+  // Fast guard: no hierarchy edges → no CHA work
+  const hasHierarchy = db
+    .prepare(`SELECT 1 FROM edges WHERE kind IN ('extends', 'implements') LIMIT 1`)
     .get();
-  if (!hasExtends && !hasFuncPropMethod) return { elapsedMs: 0, targetIds, affectedFiles };
-
-  // Build parents map: child class → direct parent class (from `extends` edges).
-  // May be empty when only func-prop methods exist (no class inheritance) —
-  // resolveThisDispatch handles that case via direct class-prefix lookup.
-  const parentRows = hasExtends
-    ? (db
-        .prepare(`
-          SELECT src.name AS child_name, tgt.name AS parent_name
-          FROM edges e
-          JOIN nodes src ON e.source_id = src.id
-          JOIN nodes tgt ON e.target_id = tgt.id
-          WHERE e.kind = 'extends'
-        `)
-        .all() as Array<{ child_name: string; parent_name: string }>)
-    : [];
+  if (!hasHierarchy) return empty;
 
-  const parents = new Map<string, string>();
-  for (const row of parentRows) {
-    if (!parents.has(row.child_name)) parents.set(row.child_name, row.parent_name);
-  }
-  // Note: parents may be empty when hasFuncPropMethod but !hasExtends — that is
-  // intentional. resolveThisDispatch still resolves `this.g()` inside `f.h` by
-  // treating `f` (the dot-prefix of callerName `f.h`) as the class and looking
-  // up `f.g` directly via lookup.byName(), without traversing the parents chain.
+  const implementors = buildChaImplementorsMap(db);
+  if (implementors.size === 0) return empty;
 
-  const chaCtx: ChaContext = {
-    implementors: new Map(), // not needed for this/super resolution
-    parents,
-    instantiatedTypes: new Set(), // not needed for this/super resolution
-  };
+  const { instantiated, noRtaEvidence } = buildChaRtaSet(db);
+  const scopeToChangedFiles = computeChaScope(db, changedFiles);
+  const callToMethods = fetchChaCallToMethods(db, changedFiles, scopeToChangedFiles);
 
-  // Determine which files to re-parse.
-  //
-  // On a full build we do NOT re-parse every JS/TS file — that would WASM-parse
-  // the entire project on top of the native pass, causing a massive regression
-  // (measured: +358% ms/file on codegraph itself). Instead we restrict to files
-  // that are part of the class inheritance hierarchy (both subclass files with
-  // `super.X()` calls and parent-class files with `this.X()` calls) OR that
-  // contain dot-named method nodes (func-prop assignments whose bodies may call
-  // `this.sibling()`). Any file not in either set has no class or object context
-  // where `this`/`super` dispatch would produce new edges.
-  let relFiles: string[];
+  return expandChaEdges(db, callToMethods, implementors, instantiated, noRtaEvidence);
+}
+
+// Extensions where `this`/`super` dispatch can occur (JS/TS family)
+const THIS_DISPATCH_EXTS = new Set(['.js', '.ts', '.tsx', '.jsx', '.mjs', '.cjs', '.mts', '.cts']);
+
+// ── this/super dispatch post-pass helpers ───────────────────────────────────
+
+/**
+ * Build parents map: child class → direct parent class (from `extends` edges).
+ * May be empty when only func-prop methods exist (no class inheritance) —
+ * resolveThisDispatch handles that case via direct class-prefix lookup.
+ */
+function buildThisDispatchParentsMap(
+  db: BetterSqlite3Database,
+  hasExtends: unknown,
+): Map<string, string> {
+  const parents = new Map<string, string>();
+  if (!hasExtends) return parents;
+  const parentRows = db
+    .prepare(`
+      SELECT src.name AS child_name, tgt.name AS parent_name
+      FROM edges e
+      JOIN nodes src ON e.source_id = src.id
+      JOIN nodes tgt ON e.target_id = tgt.id
+      WHERE e.kind = 'extends'
+    `)
+    .all() as Array<{ child_name: string; parent_name: string }>;
+  for (const row of parentRows) {
+    if (!parents.has(row.child_name)) parents.set(row.child_name, row.parent_name);
+  }
+  return parents;
+}
+
+/**
+ * Determine the set of relative file paths to re-parse for this/super dispatch.
+ *
+ * On a full build we do NOT re-parse every JS/TS file — that would WASM-parse
+ * the entire project on top of the native pass, causing a massive regression
+ * (measured: +358% ms/file on codegraph itself). Instead we restrict to files
+ * that are part of the class inheritance hierarchy OR that contain dot-named
+ * method nodes (func-prop assignments whose bodies may call `this.sibling()`).
+ */
+function selectThisDispatchFiles(
+  db: BetterSqlite3Database,
+  changedFiles: string[] | undefined,
+  isFullBuild: boolean,
+): string[] {
   if (isFullBuild || !changedFiles) {
     const rows = db
       .prepare(`
@@ -820,76 +1057,42 @@ async function runPostNativeThisDispatch(
         )
       `)
       .all() as Array<{ file: string }>;
-    relFiles = rows
+    return rows
       .map((r) => r.file)
       .filter((f) => THIS_DISPATCH_EXTS.has(path.extname(f).toLowerCase()));
-  } else {
-    // NOTE: Only files explicitly listed in changedFiles are re-parsed.
-    // If a parent-class method is replaced (new node ID) but the child file is
-    // unchanged, the stale super.method() edge is not refreshed here. A full
-    // rebuild (isFullBuild=true) is required to recover in that scenario.
-    relFiles = changedFiles.filter((f) => THIS_DISPATCH_EXTS.has(path.extname(f).toLowerCase()));
-  }
-  if (relFiles.length === 0) return { elapsedMs: 0, targetIds, affectedFiles };
-
-  // DB-backed CallNodeLookup — resolveThisDispatch only calls byName()
-  const findByNameStmt = db.prepare(`SELECT id, file, kind FROM nodes WHERE name = ?`);
-  const lookup: CallNodeLookup = {
-    byName: (name) => findByNameStmt.all(name) as Array<{ id: number; file: string; kind: string }>,
-    byNameAndFile: (name, file) =>
-      (findByNameStmt.all(name) as Array<{ id: number; file: string; kind: string }>).filter(
-        (n) => n.file === file,
-      ),
-    isBarrel: () => false,
-    resolveBarrel: () => null,
-    nodeId: () => undefined,
-  };
-
-  // Seed seen-pairs from existing call edges on source nodes in our file set
-  const seen = new Set<string>();
-  const CHUNK = 500;
-  for (let i = 0; i < relFiles.length; i += CHUNK) {
-    const chunk = relFiles.slice(i, i + CHUNK);
-    const ph = chunk.map(() => '?').join(',');
-    const rows = db
-      .prepare(
-        `SELECT e.source_id, e.target_id
-         FROM edges e
-         JOIN nodes n ON e.source_id = n.id
-         WHERE e.kind = 'calls' AND n.file IN (${ph})`,
-      )
-      .all(...chunk) as Array<{ source_id: number; target_id: number }>;
-    for (const r of rows) seen.add(`${r.source_id}|${r.target_id}`);
   }
+  // NOTE: Only files explicitly listed in changedFiles are re-parsed.
+  // If a parent-class method is replaced (new node ID) but the child file is
+  // unchanged, the stale super.method() edge is not refreshed here. A full
+  // rebuild (isFullBuild=true) is required to recover in that scenario.
+  return changedFiles.filter((f) => THIS_DISPATCH_EXTS.has(path.extname(f).toLowerCase()));
+}
 
-  // Find the innermost containing method/function for a call at `line` in `file`.
-  // COALESCE maps NULL end_line to a large sentinel so unbounded nodes sort last
-  // (SQLite ASC orders NULLs first, so a raw `end_line - line` would pick them first).
-  const findCallerByLineStmt = db.prepare(`
-    SELECT id, name FROM nodes
-    WHERE file = ? AND kind IN ('method', 'function')
-    AND line <= ? AND (end_line IS NULL OR end_line >= ?)
-    ORDER BY COALESCE(end_line - line, 999999999) ASC
-    LIMIT 1
-  `);
-
-  // Re-parse the files to obtain raw call sites with receiver info. Only
-  // `calls` (with receivers) are consumed here.
-  //
-  // The native engine is preferred: this pass only runs after a native
-  // orchestrator build, so the addon is already loaded and re-parses the
-  // hierarchy file set in single-digit milliseconds with the same
-  // receiver-annotated call sites as the WASM extractor. Booting the WASM
-  // runtime here instead cost ~40–110ms per full build (in-process
-  // web-tree-sitter + grammar init dominated) — part of the v3.12.0
-  // publish-gate regression. Files the native engine cannot parse (extension
-  // outside NATIVE_SUPPORTED_EXTENSIONS, e.g. .mts/.cts) and native parse
-  // failures fall back to the WASM backfill path so the sweep stays complete.
-  const absFiles = relFiles.map((f) => path.join(rootDir, f));
+/**
+ * Re-parse files via native (preferred) + WASM fallback to obtain call sites
+ * with receiver info. Returns a map of relPath → calls array.
+ *
+ * The native engine is preferred: this pass only runs after a native
+ * orchestrator build, so the addon is already loaded and re-parses the
+ * hierarchy file set in single-digit milliseconds with the same
+ * receiver-annotated call sites as the WASM extractor. Booting the WASM
+ * runtime here instead cost ~40–110ms per full build (in-process
+ * web-tree-sitter + grammar init dominated) — part of the v3.12.0
+ * publish-gate regression. Files the native engine cannot parse (extension
+ * outside NATIVE_SUPPORTED_EXTENSIONS, e.g. .mts/.cts) and native parse
+ * failures fall back to the WASM backfill path so the sweep stays complete.
+ */
+async function parseFilesForThisDispatch(
+  absFiles: string[],
+  rootDir: string,
+): Promise<{
+  callsByRel: Map<string, { name: string; receiver?: string; line: number }[]>;
+  wasmResults: Map<string, ExtractorOutput>;
+}> {
+  const callsByRel = new Map<string, { name: string; receiver?: string; line: number }[]>();
   const nativeAbs = absFiles.filter((f) =>
     NATIVE_SUPPORTED_EXTENSIONS.has(path.extname(f).toLowerCase()),
   );
-  const callsByRel = new Map<string, { name: string; receiver?: string; line: number }[]>();
   // Track native-supported files that returned null (per-file parse error) so
   // they can be included in the WASM fallback set below, ensuring no file's
   // this/super call sites are silently discarded.
@@ -935,8 +1138,35 @@ async function runPostNativeThisDispatch(
   for (const [relPath, symbols] of wasmResults) {
     callsByRel.set(relPath, symbols.calls ?? []);
   }
+  return { callsByRel, wasmResults };
+}
+
+/** Emit this/super dispatch edges from re-parsed call sites. */
+function emitThisDispatchEdges(
+  db: BetterSqlite3Database,
+  callsByRel: Map<string, { name: string; receiver?: string; line: number }[]>,
+  chaCtx: ChaContext,
+  lookup: CallNodeLookup,
+  seen: Set<string>,
+): {
+  newEdges: Array<[number, number, string, number, number, string]>;
+  targetIds: Set<number>;
+  affectedFiles: Set<string>;
+} {
+  // Find the innermost containing method/function for a call at `line` in `file`.
+  // COALESCE maps NULL end_line to a large sentinel so unbounded nodes sort last
+  // (SQLite ASC orders NULLs first, so a raw `end_line - line` would pick them first).
+  const findCallerByLineStmt = db.prepare(`
+    SELECT id, name FROM nodes
+    WHERE file = ? AND kind IN ('method', 'function')
+    AND line <= ? AND (end_line IS NULL OR end_line >= ?)
+    ORDER BY COALESCE(end_line - line, 999999999) ASC
+    LIMIT 1
+  `);
 
   const newEdges: Array<[number, number, string, number, number, string]> = [];
+  const targetIds = new Set<number>();
+  const affectedFiles = new Set<string>();
 
   for (const [relPath, calls] of callsByRel) {
     for (const call of calls) {
@@ -976,13 +1206,11 @@ async function runPostNativeThisDispatch(
       }
     }
   }
+  return { newEdges, targetIds, affectedFiles };
+}
 
-  if (newEdges.length > 0) {
-    db.transaction(() => batchInsertEdges(db, newEdges))();
-    debug(`this/super dispatch post-pass: inserted ${newEdges.length} edge(s)`);
-  }
-
-  // Free WASM parse trees — mirrors the cleanup in backfillNativeDroppedFiles
+/** Free WASM parse trees after this-dispatch post-pass to prevent memory leaks. */
+function cleanupThisDispatchWasmTrees(wasmResults: Map<string, ExtractorOutput>): void {
   for (const [, symbols] of wasmResults) {
     const tree = (symbols as { _tree?: { delete?: () => void } })._tree;
     if (tree && typeof tree.delete === 'function') {
@@ -995,6 +1223,109 @@ async function runPostNativeThisDispatch(
     (symbols as { _tree?: unknown; _langId?: unknown })._tree = undefined;
     (symbols as { _tree?: unknown; _langId?: unknown })._langId = undefined;
   }
+}
+
+/**
+ * Phase 8.5: this/super dispatch post-pass for the native orchestrator path.
+ *
+ * The Rust build pipeline resolves typed receiver calls but does NOT persist raw
+ * unresolved call site receiver info (e.g. `this`, `super`) to the DB. This
+ * hybrid post-pass re-parses JS/TS/TSX files via WASM to collect call sites with
+ * `this`/`super` receivers, then resolves them through the class hierarchy stored
+ * in DB `extends` edges — mirroring what `buildChaPostPass` does on the WASM path.
+ *
+ * Also handles function-as-object-property methods (`f.h = function() { this.g() }`):
+ * these use `this` to reference sibling properties on the same object (`f`), so
+ * `resolveThisDispatch` resolves them by treating the dot-prefix of the caller name
+ * (`f` from `f.h`) as the class and looking up `f.g` directly — no `extends` edge needed.
+ *
+ * Runs when either `extends` edges exist (class inheritance) OR dot-named `method`
+ * nodes exist (func-prop assignments); skips only when neither is present.
+ */
+async function runPostNativeThisDispatch(
+  db: BetterSqlite3Database,
+  rootDir: string,
+  changedFiles: string[] | undefined,
+  isFullBuild: boolean,
+): Promise<{ elapsedMs: number; targetIds: Set<number>; affectedFiles: Set<string> }> {
+  const t0 = performance.now();
+
+  // Fast guard: need at least one extends edge (class inheritance) OR a dot-named
+  // method node (func-prop assignment: `f.h = function() { this.g() }`) for
+  // this/super dispatch to produce any edges.
+  const hasExtends = db.prepare(`SELECT 1 FROM edges WHERE kind = 'extends' LIMIT 1`).get();
+  const hasFuncPropMethod = db
+    .prepare(`SELECT 1 FROM nodes WHERE kind = 'method' AND INSTR(name, '.') > 0 LIMIT 1`)
+    .get();
+  const emptyResult = {
+    elapsedMs: 0,
+    targetIds: new Set<number>(),
+    affectedFiles: new Set<string>(),
+  };
+  if (!hasExtends && !hasFuncPropMethod) return emptyResult;
+
+  const parents = buildThisDispatchParentsMap(db, hasExtends);
+  // Note: parents may be empty when hasFuncPropMethod but !hasExtends — that is
+  // intentional. resolveThisDispatch still resolves `this.g()` inside `f.h` by
+  // treating `f` (the dot-prefix of callerName `f.h`) as the class and looking
+  // up `f.g` directly via lookup.byName(), without traversing the parents chain.
+
+  const chaCtx: ChaContext = {
+    implementors: new Map(), // not needed for this/super resolution
+    parents,
+    instantiatedTypes: new Set(), // not needed for this/super resolution
+  };
+
+  const relFiles = selectThisDispatchFiles(db, changedFiles, isFullBuild);
+  if (relFiles.length === 0) return emptyResult;
+
+  // DB-backed CallNodeLookup — resolveThisDispatch only calls byName()
+  const findByNameStmt = db.prepare(`SELECT id, file, kind FROM nodes WHERE name = ?`);
+  const lookup: CallNodeLookup = {
+    byName: (name) => findByNameStmt.all(name) as Array<{ id: number; file: string; kind: string }>,
+    byNameAndFile: (name, file) =>
+      (findByNameStmt.all(name) as Array<{ id: number; file: string; kind: string }>).filter(
+        (n) => n.file === file,
+      ),
+    isBarrel: () => false,
+    resolveBarrel: () => null,
+    nodeId: () => undefined,
+  };
+
+  // Seed seen-pairs from existing call edges on source nodes in our file set
+  const seen = new Set<string>();
+  const CHUNK = 500;
+  for (let i = 0; i < relFiles.length; i += CHUNK) {
+    const chunk = relFiles.slice(i, i + CHUNK);
+    const ph = chunk.map(() => '?').join(',');
+    const rows = db
+      .prepare(
+        `SELECT e.source_id, e.target_id
+         FROM edges e
+         JOIN nodes n ON e.source_id = n.id
+         WHERE e.kind = 'calls' AND n.file IN (${ph})`,
+      )
+      .all(...chunk) as Array<{ source_id: number; target_id: number }>;
+    for (const r of rows) seen.add(`${r.source_id}|${r.target_id}`);
+  }
+
+  const absFiles = relFiles.map((f) => path.join(rootDir, f));
+  const { callsByRel, wasmResults } = await parseFilesForThisDispatch(absFiles, rootDir);
+
+  const { newEdges, targetIds, affectedFiles } = emitThisDispatchEdges(
+    db,
+    callsByRel,
+    chaCtx,
+    lookup,
+    seen,
+  );
+
+  if (newEdges.length > 0) {
+    db.transaction(() => batchInsertEdges(db, newEdges))();
+    debug(`this/super dispatch post-pass: inserted ${newEdges.length} edge(s)`);
+  }
+
+  cleanupThisDispatchWasmTrees(wasmResults);
 
   return { elapsedMs: performance.now() - t0, targetIds, affectedFiles };
 }
@@ -1110,6 +1441,55 @@ function groupByExtension(relPaths: Iterable<string>): Map<string, string[]> {
   return buckets;
 }
 
+/**
+ * Return the subset of relative paths that are gitignored in `rootDir`.
+ *
+ * Runs `git check-ignore --stdin` with all candidate paths piped in. Any
+ * path that git echoes back is gitignored. Fails silently (returns an empty
+ * set) when git is unavailable, the directory is not a git repo, or the
+ * check-ignore call throws — the gap-detection logic handles those cases
+ * gracefully without this filter.
+ *
+ * Uses relative paths (forward-slash separated) as both input and output so
+ * the result set can be matched directly against the `expected` set in
+ * `detectDroppedLanguageGap` without any further path manipulation.
+ */
+function queryGitIgnoredFiles(rootDir: string, relPaths: Iterable<string>): Set<string> {
+  const ignored = new Set<string>();
+  const paths = [...relPaths];
+  if (paths.length === 0) return ignored;
+  try {
+    const stdin = paths.join('\n');
+    const output = execFileSync('git', ['check-ignore', '--stdin'], {
+      cwd: rootDir,
+      input: stdin,
+      encoding: 'utf-8',
+      maxBuffer: 100 * 1024 * 1024,
+      // git check-ignore exits with 1 when none of the paths are ignored —
+      // that is not an error for our purposes. stdio: 'pipe' lets us capture
+      // stdout without swallowing stderr, and the try/catch handles the
+      // non-zero exit from execFileSync when ALL paths are non-ignored
+      // (exit code 1 from git check-ignore means "no matches").
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    for (const line of output.split('\n')) {
+      const trimmed = normalizePath(line.trim());
+      if (trimmed) ignored.add(trimmed);
+    }
+  } catch (e: unknown) {
+    // Exit code 1 means no paths were ignored — not an error. Any other
+    // failure (git unavailable, not a repo, etc.) is silently swallowed
+    // so the caller proceeds with the unfiltered set.
+    const exitCode = (e as { status?: number }).status;
+    if (exitCode !== 1) {
+      debug(`queryGitIgnoredFiles: git check-ignore failed: ${toErrorMessage(e)}`);
+    }
+    // On exit code 1, output is empty so ignored stays empty — correct.
+    // On other errors we also proceed with the empty set (safe degradation).
+  }
+  return ignored;
+}
+
 /**
  * Detect files the native orchestrator silently dropped.
  *
@@ -1139,8 +1519,17 @@ function groupByExtension(relPaths: Iterable<string>): Map<string, string[]> {
  */
 function detectDroppedLanguageGap(ctx: PipelineContext): DroppedLanguageGap {
   const collected = collectFilesUtil(ctx.rootDir, [], ctx.config, new Set<string>());
+  const expectedRaw = collected.files.map((f) => normalizePath(path.relative(ctx.rootDir, f)));
+
+  // The native Rust engine uses the `ignore` crate with git_ignore(true), so it
+  // respects .gitignore and never processes gitignored files. The JS collectFiles
+  // walker has no gitignore awareness, so without this filter gitignored files
+  // (e.g. NAPI-RS generated crates/codegraph-core/index.js / index.d.ts) appear
+  // in `expected` but not in the DB, causing a spurious "native extractor bug"
+  // WARN and triggering an unnecessary WASM backfill (#1626).
+  const gitIgnored = queryGitIgnoredFiles(ctx.rootDir, expectedRaw);
   const expected = new Set(
-    collected.files.map((f) => normalizePath(path.relative(ctx.rootDir, f))),
+    gitIgnored.size > 0 ? expectedRaw.filter((r) => !gitIgnored.has(r)) : expectedRaw,
   );
 
   const existingNodeRows = ctx.db
@@ -1184,96 +1573,41 @@ function detectDroppedLanguageGap(ctx: PipelineContext): DroppedLanguageGap {
   return { missingRel, missingAbs, staleRel };
 }
 
-/**
- * Backfill files that the native orchestrator silently dropped during parse.
- * Falls back to WASM + inserts file/symbol nodes so engine counts match (#967).
- *
- * Also purges stale rows for WASM-only files deleted from disk (#1073), which
- * Rust's `detect_removed_files` filter (#1070) skips.
- *
- * Accepts a pre-computed `gap` from `detectDroppedLanguageGap` so the caller
- * can use the same scan for both gating and the actual backfill — avoiding
- * a redundant fs walk when the orchestrator's signals already triggered.
- */
-async function backfillNativeDroppedFiles(
-  ctx: PipelineContext,
-  gap: DroppedLanguageGap,
-): Promise<void> {
-  const { missingRel, missingAbs, staleRel } = gap;
-  if (missingAbs.length === 0 && staleRel.length === 0) return;
-
-  // Now that we know there's work to do, hand off to better-sqlite3 (needed
-  // for the INSERT path below).
-  if (ctx.nativeFirstProxy) {
-    closeNativeDb(ctx, 'pre-parity-backfill');
-    ctx.db = openDb(ctx.dbPath);
-    ctx.nativeFirstProxy = false;
-  }
+// ── backfillNativeDroppedFiles helpers ───────────────────────────────────────
 
-  const dbConn = ctx.db as unknown as BetterSqlite3Database;
+/** Purge stale WASM-only files deleted from disk (#1073). */
+function purgeStaleWasmOnlyFiles(db: BetterSqlite3Database, staleRel: string[]): void {
+  // `computeWasmOnlyStaleFiles` guarantees every path here has an extension
+  // outside NATIVE_SUPPORTED_EXTENSIONS, so `classifyNativeDrops` would
+  // always bucket 100% into `unsupported-by-native`. Build the extension
+  // summary directly to avoid a redundant classification pass.
+  const staleByExt = groupByExtension(staleRel);
+  info(
+    `Detected ${staleRel.length} deleted WASM-only file(s) across ${staleByExt.size} extension(s) the native orchestrator skipped; purging stale rows:${formatDropExtensionSummary(staleByExt)}`,
+  );
+  purgeFilesData(db, staleRel);
+}
 
-  // Purge WASM-only files that were deleted from disk (#1073). Rust's
-  // detect_removed_files skips them and the insert path below never visits
-  // them, so without this their rows would persist across rebuilds until the
-  // next full rebuild reset the DB.
-  if (staleRel.length > 0) {
-    // `computeWasmOnlyStaleFiles` guarantees every path here has an extension
-    // outside NATIVE_SUPPORTED_EXTENSIONS, so `classifyNativeDrops` would
-    // always bucket 100% into `unsupported-by-native`. Build the extension
-    // summary directly to avoid a redundant classification pass.
-    const staleByExt = groupByExtension(staleRel);
+/**
+ * Classify and log dropped file buckets.
+ * Three-way split of native-extractor-failure files:
+ *   realFailureBuckets  — WASM found symbols → real Rust extractor bug (WARN)
+ *   emptyFileBuckets    — WASM parsed but found 0 symbols → gitignored/empty (debug)
+ *   wasmSkipBuckets     — WASM skipped entirely → no file-node insert (debug)
+ */
+function classifyAndLogDroppedFiles(
+  missingRel: string[],
+  wasmParsedFiles: Set<string>,
+  wasmFoundSymbols: Set<string>,
+): void {
+  const { byReason, totals } = classifyNativeDrops(missingRel);
+  if (totals['unsupported-by-native'] > 0) {
+    const buckets = byReason['unsupported-by-native'];
     info(
-      `Detected ${staleRel.length} deleted WASM-only file(s) across ${staleByExt.size} extension(s) the native orchestrator skipped; purging stale rows:${formatDropExtensionSummary(staleByExt)}`,
-    );
-    purgeFilesData(dbConn, staleRel);
-  }
-
-  if (missingAbs.length === 0) return;
-
-  // Parse all missing files via WASM first so we can distinguish real native
-  // extractor failures (WASM finds symbols but native didn't) from files the
-  // Rust engine legitimately skipped (gitignored artifacts, empty declaration
-  // files, etc. where WASM also produces 0 symbols). Both categories are
-  // backfilled — only the former triggers a WARN (#1566).
-  const wasmResults = await parseFilesWasmForBackfill(missingAbs, ctx.rootDir);
-
-  // Build two sets from wasmResults:
-  //   wasmParsedFiles  — rel-paths present in wasmResults (WASM succeeded, even 0 symbols)
-  //   wasmFoundSymbols — subset where WASM found ≥1 symbol
-  // Files absent from wasmParsedFiles were skipped by WASM entirely (extension
-  // not in _extToLang, wasmExtractSymbols returned null, or a read error).
-  // Those files do NOT end up in the batchInsertNodes loop below.
-  const wasmParsedFiles = new Set<string>();
-  const wasmFoundSymbols = new Set<string>();
-  for (const [relPath, symbols] of wasmResults) {
-    wasmParsedFiles.add(relPath);
-    if ((symbols.definitions?.length ?? 0) > 0 || (symbols.exports?.length ?? 0) > 0) {
-      wasmFoundSymbols.add(relPath);
-    }
-  }
-
-  // Classify drops so users see per-extension reasons instead of just a count
-  // (#1011). `unsupported-by-native` is a legitimate parser limit (no Rust
-  // extractor); `native-extractor-failure` indicates a real native bug since
-  // the language IS supported by the addon yet WASM found symbols the native
-  // engine should have extracted. Files where both engines produce 0 symbols
-  // are legitimately empty (e.g. gitignored napi-generated declaration stubs)
-  // and logged at debug level only.
-  const { byReason, totals } = classifyNativeDrops(missingRel);
-  if (totals['unsupported-by-native'] > 0) {
-    const buckets = byReason['unsupported-by-native'];
-    info(
-      `Native orchestrator skipped ${totals['unsupported-by-native']} file(s) across ${buckets.size} extension(s) in languages without a Rust extractor; backfilling via WASM:${formatDropExtensionSummary(buckets)}`,
+      `Native orchestrator skipped ${totals['unsupported-by-native']} file(s) across ${buckets.size} extension(s) in languages without a Rust extractor; backfilling via WASM:${formatDropExtensionSummary(buckets)}`,
     );
   }
   if (totals['native-extractor-failure'] > 0) {
-    // Three-way split of native-extractor-failure files:
-    //   realFailureBuckets  — WASM found symbols → real Rust extractor bug (WARN)
-    //   emptyFileBuckets    — WASM parsed but found 0 symbols → gitignored/empty (debug)
-    //                         These DO receive a file-node insert in the loop below.
-    //   wasmSkipBuckets     — WASM skipped entirely (ext unknown or parse error) →
-    //                         no file-node insert, and no WARN (debug only, distinct
-    //                         message to avoid overstating backfill coverage).
     const allFailurePaths = byReason['native-extractor-failure'];
     const realFailureBuckets = new Map<string, string[]>();
     const emptyFileBuckets = new Map<string, string[]>();
@@ -1315,7 +1649,13 @@ async function backfillNativeDroppedFiles(
       );
     }
   }
+}
 
+/** Insert node rows for all backfilled files and mark exported symbols. */
+function insertBackfilledNodes(
+  db: BetterSqlite3Database,
+  wasmResults: Map<string, ExtractorOutput>,
+): void {
   const rows: unknown[][] = [];
   const exportKeys: unknown[][] = [];
   for (const [relPath, symbols] of wasmResults) {
@@ -1347,7 +1687,6 @@ async function backfillNativeDroppedFiles(
       exportKeys.push([exp.name, exp.kind, relPath, exp.line]);
     }
   }
-  const db = dbConn;
   batchInsertNodes(db, rows);
 
   // Mark exported symbols in batches — mirrors insertDefinitionsAndExports.
@@ -1374,18 +1713,26 @@ async function backfillNativeDroppedFiles(
       updateStmt.run(...vals);
     }
   }
+}
 
-  // Persist file_hashes rows for every backfilled file. The Rust orchestrator
-  // only hashes files it parsed itself, so without this step files in
-  // optional-language extensions (e.g. .clj when no Rust extractor exists)
-  // would be missing from `file_hashes` — permanently breaking the JS-side
-  // fast-skip pre-flight (#1054), which rejects on `collected file missing
-  // from file_hashes` and forces every no-op rebuild back through the full
-  // ~2s native pipeline (#1068).
-  //
-  // Iterates `missingRel` (every collected file the Rust orchestrator
-  // dropped), not `wasmResults`, so files that produced zero symbols still
-  // get a row.
+/**
+ * Persist file_hashes rows for every backfilled file.
+ *
+ * The Rust orchestrator only hashes files it parsed itself, so without this
+ * step files in optional-language extensions (e.g. .clj when no Rust extractor
+ * exists) would be missing from `file_hashes` — permanently breaking the JS-side
+ * fast-skip pre-flight (#1054), which rejects on `collected file missing
+ * from file_hashes` and forces every no-op rebuild back through the full
+ * ~2s native pipeline (#1068).
+ *
+ * Iterates `missingRel` (every collected file the Rust orchestrator dropped),
+ * not `wasmResults`, so files that produced zero symbols still get a row.
+ */
+function backfillFileHashes(
+  db: BetterSqlite3Database,
+  missingRel: string[],
+  missingAbs: string[],
+): void {
   try {
     const upsertHash = db.prepare(
       'INSERT OR REPLACE INTO file_hashes (file, hash, mtime, size) VALUES (?, ?, ?, ?)',
@@ -1415,6 +1762,79 @@ async function backfillNativeDroppedFiles(
       `backfillNativeDroppedFiles: file_hashes write failed (table may not exist): ${toErrorMessage(e)}`,
     );
   }
+}
+
+/**
+ * Backfill files that the native orchestrator silently dropped during parse.
+ * Falls back to WASM + inserts file/symbol nodes so engine counts match (#967).
+ *
+ * Also purges stale rows for WASM-only files deleted from disk (#1073), which
+ * Rust's `detect_removed_files` filter (#1070) skips.
+ *
+ * Accepts a pre-computed `gap` from `detectDroppedLanguageGap` so the caller
+ * can use the same scan for both gating and the actual backfill — avoiding
+ * a redundant fs walk when the orchestrator's signals already triggered.
+ */
+async function backfillNativeDroppedFiles(
+  ctx: PipelineContext,
+  gap: DroppedLanguageGap,
+): Promise<void> {
+  const { missingRel, missingAbs, staleRel } = gap;
+  if (missingAbs.length === 0 && staleRel.length === 0) return;
+
+  // Now that we know there's work to do, hand off to better-sqlite3 (needed
+  // for the INSERT path below).
+  if (ctx.nativeFirstProxy) {
+    closeNativeDb(ctx, 'pre-parity-backfill');
+    ctx.db = openDb(ctx.dbPath);
+    ctx.nativeFirstProxy = false;
+  }
+
+  const dbConn = ctx.db as unknown as BetterSqlite3Database;
+
+  // Purge WASM-only files that were deleted from disk (#1073). Rust's
+  // detect_removed_files skips them and the insert path below never visits
+  // them, so without this their rows would persist across rebuilds until the
+  // next full rebuild reset the DB.
+  if (staleRel.length > 0) {
+    purgeStaleWasmOnlyFiles(dbConn, staleRel);
+  }
+
+  if (missingAbs.length === 0) return;
+
+  // Parse all missing files via WASM first so we can distinguish real native
+  // extractor failures (WASM finds symbols but native didn't) from files the
+  // Rust engine legitimately skipped (gitignored artifacts, empty declaration
+  // files, etc. where WASM also produces 0 symbols). Both categories are
+  // backfilled — only the former triggers a WARN (#1566).
+  const wasmResults = await parseFilesWasmForBackfill(missingAbs, ctx.rootDir);
+
+  // Build two sets from wasmResults:
+  //   wasmParsedFiles  — rel-paths present in wasmResults (WASM succeeded, even 0 symbols)
+  //   wasmFoundSymbols — subset where WASM found ≥1 symbol
+  // Files absent from wasmParsedFiles were skipped by WASM entirely (extension
+  // not in _extToLang, wasmExtractSymbols returned null, or a read error).
+  // Those files do NOT end up in the batchInsertNodes loop below.
+  const wasmParsedFiles = new Set<string>();
+  const wasmFoundSymbols = new Set<string>();
+  for (const [relPath, symbols] of wasmResults) {
+    wasmParsedFiles.add(relPath);
+    if ((symbols.definitions?.length ?? 0) > 0 || (symbols.exports?.length ?? 0) > 0) {
+      wasmFoundSymbols.add(relPath);
+    }
+  }
+
+  // Classify drops so users see per-extension reasons instead of just a count
+  // (#1011). `unsupported-by-native` is a legitimate parser limit (no Rust
+  // extractor); `native-extractor-failure` indicates a real native bug since
+  // the language IS supported by the addon yet WASM found symbols the native
+  // engine should have extracted. Files where both engines produce 0 symbols
+  // are legitimately empty (e.g. gitignored napi-generated declaration stubs)
+  // and logged at debug level only.
+  classifyAndLogDroppedFiles(missingRel, wasmParsedFiles, wasmFoundSymbols);
+
+  insertBackfilledNodes(dbConn, wasmResults);
+  backfillFileHashes(dbConn, missingRel, missingAbs);
 
   // Free WASM parse trees from the inline backfill path (#1058).
   // `parseFilesWasmInline` sets `symbols._tree` (a live web-tree-sitter Tree
@@ -1424,23 +1844,15 @@ async function backfillNativeDroppedFiles(
   // sees them. Without this, trees leak WASM memory until process exit —
   // bounded per run but cumulative across in-process integration tests.
   // Mirrors the cleanup discipline established for #931.
-  for (const [, symbols] of wasmResults) {
-    const tree = (symbols as { _tree?: { delete?: () => void } })._tree;
-    if (tree && typeof tree.delete === 'function') {
-      try {
-        tree.delete();
-      } catch {
-        /* ignore cleanup errors */
-      }
-    }
-    (symbols as { _tree?: unknown; _langId?: unknown })._tree = undefined;
-    (symbols as { _tree?: unknown; _langId?: unknown })._langId = undefined;
-  }
+  cleanupThisDispatchWasmTrees(wasmResults);
 }
 
 /**
  * Backfill the `technique` column on `calls` edges written by the native Rust
- * orchestrator, which does not write the column itself.
+ * orchestrator, which does not write the column itself.  Also lifts any
+ * resolved ts-native edge whose confidence is below TS_NATIVE_CONFIDENCE_FLOOR
+ * to that floor value so that the name-lookup quality of the native resolver is
+ * reflected in the call-confidence metric.
  *
  * For full builds, all `calls` edges in the DB are new so a global UPDATE is
  * correct.  For incremental builds, only changed-file source nodes are updated
@@ -1461,6 +1873,12 @@ function backfillEdgeTechniquesAfterNativeOrchestrator(
     db.prepare(
       "UPDATE edges SET technique = 'ts-native' WHERE kind = 'calls' AND technique IS NULL",
     ).run();
+    // Lift resolved ts-native edges below the confidence floor.
+    db.prepare(
+      `UPDATE edges SET confidence = ?
+       WHERE kind = 'calls' AND technique = 'ts-native'
+         AND confidence > 0 AND confidence < ?`,
+    ).run(TS_NATIVE_CONFIDENCE_FLOOR, TS_NATIVE_CONFIDENCE_FLOOR);
     return;
   }
   // Incremental: scope to source nodes whose file is one of the changed files.
@@ -1477,11 +1895,235 @@ function backfillEdgeTechniquesAfterNativeOrchestrator(
            SELECT id FROM nodes WHERE file IN (${placeholders})
          )`,
       ).run(...chunk);
+      // Lift resolved ts-native edges below the confidence floor for this chunk.
+      db.prepare(
+        `UPDATE edges SET confidence = ?
+         WHERE kind = 'calls' AND technique = 'ts-native'
+           AND confidence > 0 AND confidence < ?
+           AND source_id IN (
+             SELECT id FROM nodes WHERE file IN (${placeholders})
+           )`,
+      ).run(TS_NATIVE_CONFIDENCE_FLOOR, TS_NATIVE_CONFIDENCE_FLOOR, ...chunk);
     }
   });
   tx();
 }
 
+// ── tryNativeOrchestrator helpers ────────────────────────────────────────────
+
+/**
+ * Open NativeDatabase on demand — deferred from setupPipeline to skip the
+ * ~60ms cost on no-op/early-exit builds.
+ *
+ * Closes the better-sqlite3 connection first to avoid dual-connection WAL
+ * corruption. On setup failure, falls back to reopening better-sqlite3 and
+ * leaves ctx.nativeDb undefined so the caller falls through to the JS pipeline.
+ */
+function openNativeDatabase(ctx: PipelineContext): void {
+  if (ctx.nativeDb || !ctx.nativeAvailable) return;
+  const native = loadNative();
+  if (!native?.NativeDatabase) return;
+  try {
+    // Close better-sqlite3 before opening rusqlite to avoid WAL conflicts.
+    // Uses raw close() instead of closeDb() intentionally — the advisory lock
+    // is kept and transferred to the NativeDbProxy below, not released here.
+    ctx.db.close();
+    acquireAdvisoryLock(ctx.dbPath);
+    ctx.nativeDb = native.NativeDatabase.openReadWrite(ctx.dbPath);
+    ctx.nativeDb.initSchema();
+    // Replace ctx.db with a NativeDbProxy so post-native JS fallback
+    // (structure, analysis) can use it without reopening better-sqlite3.
+    const proxy = new NativeDbProxy(ctx.nativeDb);
+    proxy.__lockPath = `${ctx.dbPath}.lock`;
+    ctx.db = proxy as unknown as typeof ctx.db;
+    ctx.nativeFirstProxy = true;
+  } catch (err) {
+    warn(`NativeDatabase setup failed, falling back to JS: ${toErrorMessage(err)}`);
+    try {
+      ctx.nativeDb?.close();
+    } catch (e) {
+      debug(`tryNativeOrchestrator: close failed during fallback: ${toErrorMessage(e)}`);
+    }
+    ctx.nativeDb = undefined;
+    ctx.nativeFirstProxy = false; // defensive: reset in case future refactors move the assignment above throwing lines
+    releaseAdvisoryLock(`${ctx.dbPath}.lock`);
+    // Reopen better-sqlite3 for JS pipeline fallback
+    ctx.db = openDb(ctx.dbPath);
+  }
+}
+
+/**
+ * Coordinate all post-native edge-writing post-passes, role re-classification,
+ * and technique backfill. Returns timing data for the build result.
+ *
+ * Post-passes run before structure/analysis so role classification sees the
+ * complete graph including CHA + this/super dispatch edges.
+ */
+async function runPostNativePasses(
+  ctx: PipelineContext,
+  result: NativeOrchestratorResult,
+): Promise<PostPassTimings & { backfillHappened: boolean }> {
+  // Engine parity: the native orchestrator silently drops files whose
+  // Rust extractor/grammar is missing or fails (e.g. HCL, Scala, Swift on
+  // stale native binaries). WASM handles those — backfill via WASM so both
+  // engines process the same file set (#967).
+  //
+  // Detect the gap once (fs walk + 2 DB queries) and use it for both gating
+  // and the backfill itself. On quiet incrementals we still pay the walk so
+  // we can detect brand-new files in dropped-language extensions — a gap that
+  // the orchestrator's `detect_removed_files` filter (#1070) leaves open
+  // (#1083, #1091). The pre-check is cheap because the expensive part (WASM
+  // re-parse of the missing set) is gated below.
+  const gapDetectStart = performance.now();
+  const gap = detectDroppedLanguageGap(ctx);
+  const backfillHappened = gap.missingAbs.length > 0 || gap.staleRel.length > 0;
+  if (backfillHappened) {
+    await backfillNativeDroppedFiles(ctx, gap);
+  }
+  const gapDetectMs = performance.now() - gapDetectStart;
+
+  // Phase 8.5: this/super dispatch — hybrid WASM re-parse to resolve call sites
+  // whose raw receiver info the Rust pipeline does not persist to DB.
+  // Runs BEFORE the CHA expansion pass so that super.method() → Parent.method edges
+  // (technique='cha') are in the DB when runPostNativeCha expands them to sibling
+  // class overrides (e.g. PostMixin.m → B.m when PostMixin and B both extend A).
+  const {
+    elapsedMs: thisDispatchMs,
+    targetIds: thisDispatchTargetIds,
+    affectedFiles: thisDispatchAffectedFiles,
+  } = await runPostNativeThisDispatch(
+    ctx.db as unknown as BetterSqlite3Database,
+    ctx.rootDir,
+    result.changedFiles,
+    !!result.isFullBuild,
+  );
+
+  // Phase 8.6: expand CHA call edges (interface dispatch → concrete implementations).
+  // Returns the affected files so role re-classification below can be scoped to
+  // the nodes whose fan-in/out actually changed.
+  //
+  // Runs AFTER this/super dispatch so super.method() edges are already in the DB.
+  // The 'cha-expanded' technique tag on this pass's own output prevents re-expansion
+  // of those edges in subsequent incremental builds, while 'cha'-tagged edges from
+  // this/super dispatch remain eligible for expansion here.
+  //
+  // Function-as-object-property methods (`fn.method = function() {}`) are extracted
+  // natively by the Rust engine (#1432) and resolved in-build by its edge builder, so
+  // no WASM re-parse post-pass is needed for them. `Foo.prototype.bar = fn` likewise.
+  const chaStart = performance.now();
+  const { newEdgeCount: chaEdgeCount, affectedFiles: chaAffectedFiles } = runPostNativeCha(
+    ctx.db as unknown as BetterSqlite3Database,
+    // null = full build (scan all call→method edges); array = incremental (gate queries decide scope)
+    result.isFullBuild ? null : (result.changedFiles ?? null),
+  );
+  const chaMs = performance.now() - chaStart;
+
+  // Role re-classification after the Rust orchestrator build.
+  //
+  // Two reasons to re-classify:
+  //
+  // 1. Post-pass edges (CHA, this-dispatch): the Rust orchestrator classifies
+  //    roles before these passes add edges, so fan-in/out for their endpoints
+  //    is stale. On incremental builds, scope to the affected files for speed.
+  //
+  // 2. hasActiveFileSiblings parity: the Rust classifier does not implement the
+  //    JS hasActiveFileSiblings heuristic. That heuristic promotes functions with
+  //    fan_in=0 but fan_out>0 to 'leaf' when their file has other connected
+  //    callables — preventing false dead-unresolved classifications for functions
+  //    like `main` or `square` that call others but are never called themselves.
+  //    On full builds, always run a full JS re-classification so the Rust roles
+  //    are replaced by the canonical JS classifier output (#1659).
+  //
+  // Strategy:
+  //   - Full build: always run full JS classifyNodeRoles(db, null).
+  //   - Incremental build with post-pass edges: run scoped re-classification
+  //     for the affected files (same as before). The full-build pass already
+  //     produced correct JS roles for all unchanged files on the previous build.
+  //   - Incremental build with no post-pass edges: skip re-classification
+  //     (Rust roles on unchanged files are not stale, and the heuristic gap
+  //     was corrected on the last full build).
+  let reclassifyMs = 0;
+  const needsFullReclassify = !!result.isFullBuild;
+  const needsScopedReclassify =
+    !needsFullReclassify && (chaEdgeCount > 0 || thisDispatchTargetIds.size > 0);
+  if (needsFullReclassify || needsScopedReclassify) {
+    let scopedFiles: string[] | null = null;
+    if (needsScopedReclassify) {
+      const affectedFiles = [...new Set([...chaAffectedFiles, ...thisDispatchAffectedFiles])];
+      // When edges were inserted but all their endpoint nodes have null `file`
+      // columns (rare but possible), affectedFiles stays empty even though
+      // fan-in/out changed. Fall back to full-graph re-classification in that
+      // case — scoped classification with an empty set would be a no-op, leaving
+      // roles stale for those nodes.
+      scopedFiles = affectedFiles.length > 0 ? affectedFiles : null;
+    }
+    const reclassifyStart = performance.now();
+    try {
+      const { classifyNodeRoles } = (await import('../../../../features/structure.js')) as {
+        classifyNodeRoles: (
+          db: BetterSqlite3Database,
+          changedFiles?: string[] | null,
+        ) => Record<string, number>;
+      };
+      classifyNodeRoles(ctx.db as unknown as BetterSqlite3Database, scopedFiles);
+      debug(
+        scopedFiles
+          ? `Post-pass role re-classification complete (${scopedFiles.length} file(s))`
+          : 'Post-pass role re-classification complete (full graph)',
+      );
+    } catch (err) {
+      debug(`Post-pass role re-classification failed: ${toErrorMessage(err)}`);
+    }
+    reclassifyMs = performance.now() - reclassifyStart;
+  }
+
+  // Backfill the `technique` column on `calls` edges written by the Rust
+  // orchestrator, which does not write the column. Runs after all edge-writing
+  // phases (including the WASM dropped-language backfill, CHA post-pass, and
+  // this/super dispatch) so every new edge in this build cycle gets a label.
+  const techniqueBackfillStart = performance.now();
+  backfillEdgeTechniquesAfterNativeOrchestrator(ctx.db, !!result.isFullBuild, result.changedFiles);
+  const techniqueBackfillMs = performance.now() - techniqueBackfillStart;
+
+  // Re-count nodes/edges now that all edge-writing post-passes have run: the
+  // Rust orchestrator captured its counts before the JS post-passes added
+  // edges, so both its summary and build_meta under-report (#1452).
+  //
+  // Fast path: skip the COUNT(*) scan when no post-pass wrote any edges.
+  // COUNT(*) on large tables (50K+ edges) is non-trivial, especially via the
+  // NativeDbProxy napi-rs round-trip. When all post-passes were no-ops, the
+  // Rust orchestrator's counts are still accurate — no re-count needed.
+  let finalNodeCount = result.nodeCount ?? 0;
+  let finalEdgeCount = result.edgeCount ?? 0;
+  const postPassWroteData = backfillHappened || chaEdgeCount > 0 || thisDispatchTargetIds.size > 0;
+  if (postPassWroteData) {
+    try {
+      const counts = (ctx.db as unknown as BetterSqlite3Database)
+        .prepare('SELECT (SELECT COUNT(*) FROM nodes) AS n, (SELECT COUNT(*) FROM edges) AS e')
+        .get() as { n: number; e: number };
+      if (counts.n !== finalNodeCount || counts.e !== finalEdgeCount) {
+        finalNodeCount = counts.n;
+        finalEdgeCount = counts.e;
+        setBuildMeta(ctx.db, { node_count: finalNodeCount, edge_count: finalEdgeCount });
+      }
+    } catch (err) {
+      debug(`Post-pass node/edge re-count failed: ${toErrorMessage(err)}`);
+    }
+  }
+  info(
+    `Native build orchestrator completed: ${finalNodeCount} nodes, ${finalEdgeCount} edges, ${result.fileCount ?? 0} files`,
+  );
+
+  return {
+    gapDetectMs,
+    chaMs,
+    thisDispatchMs,
+    reclassifyMs,
+    techniqueBackfillMs,
+    backfillHappened,
+  };
+}
+
 /**
  * Try the native build orchestrator.
  *
@@ -1505,50 +2147,44 @@ export async function tryNativeOrchestrator(
     return undefined;
   }
 
-  // Open NativeDatabase on demand — deferred from setupPipeline to skip the
-  // ~60ms cost on no-op/early-exit builds. Close the better-sqlite3 connection
-  // first to avoid dual-connection WAL corruption.
-  if (!ctx.nativeDb && ctx.nativeAvailable) {
-    const native = loadNative();
-    if (native?.NativeDatabase) {
-      try {
-        // Close better-sqlite3 before opening rusqlite to avoid WAL conflicts.
-        // Uses raw close() instead of closeDb() intentionally — the advisory lock
-        // is kept and transferred to the NativeDbProxy below, not released here.
-        ctx.db.close();
-        acquireAdvisoryLock(ctx.dbPath);
-        ctx.nativeDb = native.NativeDatabase.openReadWrite(ctx.dbPath);
-        ctx.nativeDb.initSchema();
-        // Replace ctx.db with a NativeDbProxy so post-native JS fallback
-        // (structure, analysis) can use it without reopening better-sqlite3.
-        const proxy = new NativeDbProxy(ctx.nativeDb);
-        proxy.__lockPath = `${ctx.dbPath}.lock`;
-        ctx.db = proxy as unknown as typeof ctx.db;
-        ctx.nativeFirstProxy = true;
-      } catch (err) {
-        warn(`NativeDatabase setup failed, falling back to JS: ${toErrorMessage(err)}`);
-        try {
-          ctx.nativeDb?.close();
-        } catch (e) {
-          debug(`tryNativeOrchestrator: close failed during fallback: ${toErrorMessage(e)}`);
-        }
-        ctx.nativeDb = undefined;
-        ctx.nativeFirstProxy = false; // defensive: reset in case future refactors move the assignment above throwing lines
-        releaseAdvisoryLock(`${ctx.dbPath}.lock`);
-        // Reopen better-sqlite3 for JS pipeline fallback
-        ctx.db = openDb(ctx.dbPath);
-      }
-    }
-  }
+  openNativeDatabase(ctx);
 
   if (!ctx.nativeDb?.buildGraph) return undefined;
 
-  const resultJson = ctx.nativeDb.buildGraph(
-    ctx.rootDir,
-    JSON.stringify(ctx.config),
-    JSON.stringify(ctx.aliases),
-    JSON.stringify(ctx.opts),
-  );
+  // The previous full build's clear_all_graph_data() sets PRAGMA foreign_keys = ON
+  // on the native connection. Older native binaries (< v3.14) do not delete
+  // dataflow_vertices / dataflow_summary / call_edge_id rows before purging
+  // nodes/edges during incremental builds, so FK enforcement causes the purge
+  // statements to fail silently — leaving stale nodes and edges that then get
+  // duplicated when the barrel-candidate re-parse re-inserts them (issue #1644).
+  // Disabling FK before buildGraph() lets the purge succeed; FK is restored in
+  // a finally block so post-passes (gap-repair, structure patch) retain FK protection
+  // even if buildGraph() throws.
+  try {
+    ctx.nativeDb.exec('PRAGMA foreign_keys = OFF');
+  } catch {
+    // exec may not exist on very old addon versions — safe to ignore
+  }
+
+  let resultJson: string;
+  try {
+    resultJson = ctx.nativeDb.buildGraph(
+      ctx.rootDir,
+      JSON.stringify(ctx.config),
+      JSON.stringify(ctx.aliases),
+      JSON.stringify(ctx.opts),
+    );
+  } finally {
+    // Restore FK enforcement so any subsequent writes to this connection
+    // (gap-repair, structure patch) retain FK protection — even if buildGraph()
+    // throws.
+    try {
+      ctx.nativeDb.exec('PRAGMA foreign_keys = ON');
+    } catch {
+      // safe to ignore on very old addon versions
+    }
+  }
+
   const result = JSON.parse(resultJson) as NativeOrchestratorResult;
 
   if (result.earlyExit) {
@@ -1646,136 +2282,7 @@ export async function tryNativeOrchestrator(
     }
   }
 
-  // ── Edge-writing post-passes (run before structure so roles see full graph) ──
-
-  // Engine parity: the native orchestrator silently drops files whose
-  // Rust extractor/grammar is missing or fails (e.g. HCL, Scala, Swift on
-  // stale native binaries). WASM handles those — backfill via WASM so both
-  // engines process the same file set (#967).
-  //
-  // Detect the gap once (fs walk + 2 DB queries) and use it for both gating
-  // and the backfill itself. On quiet incrementals we still pay the walk so
-  // we can detect brand-new files in dropped-language extensions — a gap that
-  // the orchestrator's `detect_removed_files` filter (#1070) leaves open
-  // (#1083, #1091). The pre-check is cheap because the expensive part (WASM
-  // re-parse of the missing set) is gated below.
-  const gapDetectStart = performance.now();
-  const gap = detectDroppedLanguageGap(ctx);
-  const backfillHappened = gap.missingAbs.length > 0 || gap.staleRel.length > 0;
-  if (backfillHappened) {
-    await backfillNativeDroppedFiles(ctx, gap);
-  }
-  const gapDetectMs = performance.now() - gapDetectStart;
-
-  // Phase 8.5: this/super dispatch — hybrid WASM re-parse to resolve call sites
-  // whose raw receiver info the Rust pipeline does not persist to DB.
-  // Runs BEFORE the CHA expansion pass so that super.method() → Parent.method edges
-  // (technique='cha') are in the DB when runPostNativeCha expands them to sibling
-  // class overrides (e.g. PostMixin.m → B.m when PostMixin and B both extend A).
-  const {
-    elapsedMs: thisDispatchMs,
-    targetIds: thisDispatchTargetIds,
-    affectedFiles: thisDispatchAffectedFiles,
-  } = await runPostNativeThisDispatch(
-    ctx.db as unknown as BetterSqlite3Database,
-    ctx.rootDir,
-    result.changedFiles,
-    !!result.isFullBuild,
-  );
-
-  // Phase 8.6: expand CHA call edges (interface dispatch → concrete implementations).
-  // Returns the affected files so role re-classification below can be scoped to
-  // the nodes whose fan-in/out actually changed.
-  //
-  // Runs AFTER this/super dispatch so super.method() edges are already in the DB.
-  // The 'cha-expanded' technique tag on this pass's own output prevents re-expansion
-  // of those edges in subsequent incremental builds, while 'cha'-tagged edges from
-  // this/super dispatch remain eligible for expansion here.
-  //
-  // Function-as-object-property methods (`fn.method = function() {}`) are extracted
-  // natively by the Rust engine (#1432) and resolved in-build by its edge builder, so
-  // no WASM re-parse post-pass is needed for them. `Foo.prototype.bar = fn` likewise.
-  const chaStart = performance.now();
-  const { newEdgeCount: chaEdgeCount, affectedFiles: chaAffectedFiles } = runPostNativeCha(
-    ctx.db as unknown as BetterSqlite3Database,
-    // null = full build (scan all call→method edges); array = incremental (gate queries decide scope)
-    result.isFullBuild ? null : (result.changedFiles ?? null),
-  );
-  const chaMs = performance.now() - chaStart;
-
-  // Role re-classification after JS edge-writing post-passes.
-  // The Rust orchestrator classifies roles before these post-passes (CHA,
-  // this-dispatch) add edges, so roles for the edge endpoints are stale.
-  // Scoped to the files containing those endpoints: a new edge only changes
-  // fan-in/out for its own source and target nodes, so re-classifying their
-  // files restores correctness without re-running the classifier over the
-  // whole graph (which cost ~130ms per build on codegraph itself and was a
-  // major part of the v3.12.0 native full-build benchmark regression).
-  let reclassifyMs = 0;
-  if (chaEdgeCount > 0 || thisDispatchTargetIds.size > 0) {
-    const affectedFiles = [...new Set([...chaAffectedFiles, ...thisDispatchAffectedFiles])];
-    // When edges were inserted but all their endpoint nodes have null `file`
-    // columns (rare but possible), affectedFiles stays empty even though
-    // fan-in/out changed. Fall back to full-graph re-classification in that
-    // case — scoped classification with an empty set would be a no-op, leaving
-    // roles stale for those nodes.
-    const scopedFiles = affectedFiles.length > 0 ? affectedFiles : null;
-    const reclassifyStart = performance.now();
-    try {
-      const { classifyNodeRoles } = (await import('../../../../features/structure.js')) as {
-        classifyNodeRoles: (
-          db: BetterSqlite3Database,
-          changedFiles?: string[] | null,
-        ) => Record<string, number>;
-      };
-      classifyNodeRoles(ctx.db as unknown as BetterSqlite3Database, scopedFiles);
-      debug(
-        scopedFiles
-          ? `Post-pass role re-classification complete (${scopedFiles.length} file(s))`
-          : 'Post-pass role re-classification complete (full graph — null-file endpoints)',
-      );
-    } catch (err) {
-      debug(`Post-pass role re-classification failed: ${toErrorMessage(err)}`);
-    }
-    reclassifyMs = performance.now() - reclassifyStart;
-  }
-
-  // Backfill the `technique` column on `calls` edges written by the Rust
-  // orchestrator, which does not write the column. Runs after all edge-writing
-  // phases (including the WASM dropped-language backfill, CHA post-pass, and
-  // this/super dispatch) so every new edge in this build cycle gets a label.
-  const techniqueBackfillStart = performance.now();
-  backfillEdgeTechniquesAfterNativeOrchestrator(ctx.db, !!result.isFullBuild, result.changedFiles);
-  const techniqueBackfillMs = performance.now() - techniqueBackfillStart;
-
-  // Re-count nodes/edges now that all edge-writing post-passes have run: the
-  // Rust orchestrator captured its counts before the JS post-passes added
-  // edges, so both its summary and build_meta under-report (#1452).
-  //
-  // Fast path: skip the COUNT(*) scan when no post-pass wrote any edges.
-  // COUNT(*) on large tables (50K+ edges) is non-trivial, especially via the
-  // NativeDbProxy napi-rs round-trip. When all post-passes were no-ops, the
-  // Rust orchestrator's counts are still accurate — no re-count needed.
-  let finalNodeCount = result.nodeCount ?? 0;
-  let finalEdgeCount = result.edgeCount ?? 0;
-  const postPassWroteData = backfillHappened || chaEdgeCount > 0 || thisDispatchTargetIds.size > 0;
-  if (postPassWroteData) {
-    try {
-      const counts = (ctx.db as unknown as BetterSqlite3Database)
-        .prepare('SELECT (SELECT COUNT(*) FROM nodes) AS n, (SELECT COUNT(*) FROM edges) AS e')
-        .get() as { n: number; e: number };
-      if (counts.n !== finalNodeCount || counts.e !== finalEdgeCount) {
-        finalNodeCount = counts.n;
-        finalEdgeCount = counts.e;
-        setBuildMeta(ctx.db, { node_count: finalNodeCount, edge_count: finalEdgeCount });
-      }
-    } catch (err) {
-      debug(`Post-pass node/edge re-count failed: ${toErrorMessage(err)}`);
-    }
-  }
-  info(
-    `Native build orchestrator completed: ${finalNodeCount} nodes, ${finalEdgeCount} edges, ${result.fileCount ?? 0} files`,
-  );
+  const postPassTimings = await runPostNativePasses(ctx, result);
 
   // ── Structure and analysis fallback (run after edge-writing so roles see full graph) ──
   // Reconstruct fileSymbols once for both structure and analysis to avoid two
@@ -1798,12 +2305,17 @@ export async function tryNativeOrchestrator(
     }
   }
 
+  // P6: Vertex extraction for the analysisComplete=true path.
+  // When needsAnalysisFallback=false (the normal native case), runPostNativeAnalysis
+  // was skipped, so buildDataflowEdges never ran and dataflow_vertices were never
+  // populated. Re-run the Rust dataflow visitor per file (fast — no re-parse) to
+  // get the DataflowResult, then build vertices and inter-procedural edges.
+  // Languages where Rust has no dataflow rules are silently skipped; a WASM
+  // fallback for those is tracked in issue #1614.
+  if (ctx.opts.dataflow !== false && !needsAnalysisFallback) {
+    await runDataflowVertexPass(ctx, result.changedFiles);
+  }
+
   closeDbPair({ db: ctx.db, nativeDb: ctx.nativeDb });
-  return formatNativeTimingResult(p, structurePatchMs, analysisTiming, {
-    gapDetectMs,
-    chaMs,
-    thisDispatchMs,
-    reclassifyMs,
-    techniqueBackfillMs,
-  });
+  return formatNativeTimingResult(p, structurePatchMs, analysisTiming, postPassTimings);
 }