gitnexus 1.6.10-rc.21 → 1.6.10-rc.211

package/dist/core/group/extractors/http-route-extractor.d.ts

@@ -26,6 +26,7 @@ import type { ExtractedContract, RepoHandle } from '../types.js';
 export declare const HANDLES_ROUTE_QUERY = "\nMATCH (handlerFile:File)-[r:CodeRelation {type: 'HANDLES_ROUTE'}]->(route:Route)\nRETURN handlerFile.id AS fileId, handlerFile.filePath AS filePath,\n       route.name AS routePath, route.id AS routeId,\n       route.method AS routeMethod,\n       route.handlerSymbolId AS handlerSymbolId,\n       route.responseKeys AS responseKeys,\n       r.reason AS routeSource";
 export declare const RESOLVE_BY_NAME_QUERY = "\nMATCH (n) WHERE labels(n) IN ['Function','Method','CodeElement']\n  AND n.name = $name AND n.filePath <> ''\nRETURN n.id AS uid, n.name AS name, n.filePath AS filePath\nLIMIT 2";
 export declare const RESOLVE_IN_MODULE_QUERY = "\nMATCH (n) WHERE labels(n) IN ['Function','Method','CodeElement']\n  AND n.name = $name AND (n.filePath STARTS WITH $fileDot OR n.filePath STARTS WITH $fileSlash)\nRETURN n.id AS uid, n.name AS name, n.filePath AS filePath\nLIMIT 2";
+export declare const RESOLVE_IN_EXACT_MODULE_QUERY = "\nMATCH (n) WHERE labels(n) IN ['Function','Method','CodeElement']\n  AND n.name = $name AND n.filePath IN $filePaths\nRETURN n.id AS uid, n.name AS name, n.filePath AS filePath\nLIMIT 2";
 /**
  * Canonicalize a provider-side HTTP path for contract-id generation:
  *   - strip query string

package/dist/core/group/extractors/http-route-extractor.js

@@ -4,7 +4,9 @@ import Parser from 'tree-sitter';
 import { createIgnoreFilter } from '../../../config/ignore-service.js';
 import { readSafe } from './fs-utils.js';
 import { parseSourceSafe } from '../../tree-sitter/safe-parse.js';
+import { toZeroBasedLine } from '../../ingestion/utils/line-base.js';
 import { logger } from '../../logger.js';
+import { DATA_ROUTE_TABLE_SOURCE } from '../../ingestion/route-extractors/data-route-table.js';
 import { getPluginForFile, HTTP_SCAN_GLOB, } from './http-patterns/index.js';
 /**
  * Language-agnostic orchestrator for HTTP route (provider + consumer)
@@ -89,6 +91,10 @@ RETURN sym.id AS uid, sym.name AS name, sym.filePath AS filePath,
 // degenerate edge-less node NOR inflates the uniqueness count and masks the real
 // handler. `LIMIT 2` bounds materialization: distinguishing unique (1) from
 // ambiguous (>=2) never needs more than two rows (the count guard stays exact).
+//
+// determinism: probe — uniqueness discriminator, not a window. `toResolvedSymbol`
+// reads row 0 only when `rows.length === 1`; a 2-row result is discarded whole,
+// so WHICH two rows came back can never reach a caller.
 export const RESOLVE_BY_NAME_QUERY = `
 MATCH (n) WHERE labels(n) IN ['Function','Method','CodeElement']
   AND n.name = $name AND n.filePath <> ''
@@ -96,21 +102,33 @@ RETURN n.id AS uid, n.name AS name, n.filePath AS filePath
 LIMIT 2`;
 // Resolve an IMPORTED handler by pinning it to the import's target module: the
 // declared export `$name` whose file is the module the handler was imported from
-// (`$fileDot` matches `mod.ext`, `$fileSlash` matches `mod/index.ext`). This is
+// (`$filePaths` contains exact source-file and directory-index candidates). This is
 // the precise rung — it survives aliases and local same-name collisions that a
 // repo-wide name lookup cannot, and only resolves on a unique match within that
 // module. `LIMIT 2` keeps the uniqueness count exact (see RESOLVE_BY_NAME_QUERY).
+//
+// determinism: probe — uniqueness discriminator, not a window. Same consumer as
+// RESOLVE_BY_NAME_QUERY: `toResolvedSymbol` reads row 0 only when exactly one row
+// came back, and discards a 2-row result whole.
 export const RESOLVE_IN_MODULE_QUERY = `
 MATCH (n) WHERE labels(n) IN ['Function','Method','CodeElement']
   AND n.name = $name AND (n.filePath STARTS WITH $fileDot OR n.filePath STARTS WITH $fileSlash)
 RETURN n.id AS uid, n.name AS name, n.filePath AS filePath
 LIMIT 2`;
+// determinism: probe — uniqueness discriminator, not a window. The consumer
+// accepts exactly one row and rejects a 2-row result whole, so row identity
+// cannot affect the resolution decision.
+export const RESOLVE_IN_EXACT_MODULE_QUERY = `
+MATCH (n) WHERE labels(n) IN ['Function','Method','CodeElement']
+  AND n.name = $name AND n.filePath IN $filePaths
+RETURN n.id AS uid, n.name AS name, n.filePath AS filePath
+LIMIT 2`;
 // Source-file extensions an import specifier may resolve to (stripped before
 // building the module file-prefix so `./h/users` and `./h/users.ts` agree).
 const SOURCE_EXT_RE = /\.(?:m|c)?[jt]sx?$/;
 /**
  * Resolve an import specifier to a repo-relative FILE BASE (path without
- * extension) so the target module can be matched by `filePath STARTS WITH`.
+ * extension) so exact target-file candidates can be constructed.
  * Handles two relative-import dialects and returns null for bare/absolute
  * imports (which fall back to a repo-wide name lookup):
  *   - path-style (JS/TS): `./handlers/users`, `../x` → joined against the
@@ -137,6 +155,23 @@ function resolveModuleBase(fromFile, module) {
     }
     return null; // bare / absolute import — repo-wide fallback
 }
+const MODULE_SOURCE_EXTENSIONS = [
+    '.ts',
+    '.tsx',
+    '.mts',
+    '.cts',
+    '.js',
+    '.jsx',
+    '.mjs',
+    '.cjs',
+    '.py',
+];
+function moduleFileCandidates(base) {
+    return [
+        ...MODULE_SOURCE_EXTENSIONS.map((extension) => `${base}${extension}`),
+        ...MODULE_SOURCE_EXTENSIONS.map((extension) => extension === '.py' ? `${base}/__init__.py` : `${base}/index${extension}`),
+    ];
+}
 /**
  * The innermost Function/Method whose `[startLine, endLine]` span contains
  * `line` — i.e. the symbol the HTTP call lives inside. For a consumer this is
@@ -147,13 +182,17 @@ function resolveModuleBase(fromFile, module) {
  */
 function resolveContainingSymbol(rows, line) {
     const norm = (x) => String(x ?? '');
-    // Detection lines are 1-based; symbol spans are stored 0-based for the
-    // languages indexed today (parse-worker records `startPosition.row`). So the
-    // base-correct probe is `line - 1`. Pick the INNERMOST (smallest-span) symbol
-    // whose span contains the probe. Only if nothing contains `line - 1` do we
-    // retry with the raw `line` — a defensive fallback for any future language
-    // that stores 1-based spans. Probing `line - 1` first (rather than OR-ing both)
-    // avoids the +1 slack mis-picking a one-line sibling that sits on `line`.
+    // Detection lines are 1-based (`HttpDetection.line`); symbol spans are stored
+    // 0-based for the languages indexed today (parse-worker records
+    // `startPosition.row`). So the base-correct probe is `toZeroBasedLine(line)` —
+    // the same named 1-based→graph-space conversion the ingestion emitters use
+    // (#2377), rather than a bare literal. Pick the INNERMOST (smallest-span)
+    // symbol whose span contains the probe. Only if nothing contains the 0-based
+    // probe do we retry with the raw `line` — a defensive fallback for any future
+    // language that stores 1-based spans. Probing 0-based first (rather than
+    // OR-ing both) avoids the +1 slack mis-picking a one-line sibling that sits on
+    // `line`. The helper's `Math.max(0, …)` clamp is inert here: every plugin sets
+    // `line` from `startPosition.row + 1`, so it is always >= 1.
     const pick = (probe) => {
         let best = null;
         let bestSpan = Number.POSITIVE_INFINITY;
@@ -179,7 +218,7 @@ function resolveContainingSymbol(rows, line) {
         }
         return best && best.uid ? best : null;
     };
-    return pick(line - 1) ?? pick(line);
+    return pick(toZeroBasedLine(line)) ?? pick(line);
 }
 /** A Function/Method in the file matching `name` exactly (for named handlers). */
 function resolveSymbolByName(rows, name) {
@@ -196,6 +235,13 @@ function resolveSymbolByName(rows, name) {
     }
     return null;
 }
+function resolveFileSymbolByNameUnique(rows, name) {
+    const matches = rows
+        .map((row) => resolveSymbolByName([row], name))
+        .filter((match) => match !== null);
+    const byUid = new Map(matches.map((match) => [match.uid, match]));
+    return byUid.size === 1 ? (byUid.values().next().value ?? null) : null;
+}
 // ─── Path normalization (shared between provider / consumer paths) ──
 /**
  * Canonicalize a provider-side HTTP path for contract-id generation:
@@ -438,28 +484,25 @@ export class HttpRouteExtractor {
             globalNameCache.set(name, result);
             return result;
         };
-        // Resolve a handler imported from a RELATIVE module to the unique declared
-        // symbol of that name inside the import's target file. Returns null for
-        // non-relative (bare/aliased-path) imports — those fall back to the repo-wide
-        // name lookup. Cached by (target-file-prefix, declared name).
+        // Resolve a handler imported from a relative module to the unique declared
+        // symbol inside its target file. The caller decides whether a miss may use
+        // the historical unique repository-wide fallback.
         const importedSymbolCache = new Map();
-        const resolveImportedSymbol = async (fromFile, imp) => {
+        const resolveImportedSymbol = async (fromFile, imp, strict = false) => {
             if (!dbExecutor)
                 return null;
             const base = resolveModuleBase(fromFile, imp.module);
             if (base === null)
-                return null; // bare/absolute import → repo-wide fallback
-            const cacheKey = JSON.stringify([base, imp.name]);
+                return null;
+            const cacheKey = JSON.stringify([base, imp.name, strict]);
             const cached = importedSymbolCache.get(cacheKey);
             if (cached !== undefined)
                 return cached;
             let rows = [];
             try {
-                rows = await dbExecutor(RESOLVE_IN_MODULE_QUERY, {
-                    name: imp.name,
-                    fileDot: `${base}.`,
-                    fileSlash: `${base}/`,
-                });
+                rows = await dbExecutor(strict ? RESOLVE_IN_EXACT_MODULE_QUERY : RESOLVE_IN_MODULE_QUERY, strict
+                    ? { name: imp.name, filePaths: moduleFileCandidates(base) }
+                    : { name: imp.name, fileDot: `${base}.`, fileSlash: `${base}/` });
             }
             catch {
                 rows = [];
@@ -471,6 +514,8 @@ export class HttpRouteExtractor {
         const resolveDetectionSymbol = async (filePath, d) => {
             if (!dbExecutor)
                 return null;
+            if (d.role === 'provider' && d.unresolvedHandler)
+                return null;
             const syms = await loadFileSymbols(filePath);
             // Name resolution does NOT need a detection line — a named provider
             // handler (Spring/Go/etc. method name) resolves by name even when the
@@ -484,17 +529,20 @@ export class HttpRouteExtractor {
                 // its (declared) name would be wrong; on a miss go straight to a unique
                 // repo-wide match on the declared name, never file-scoped.
                 if (d.handlerImport) {
-                    const byImport = await resolveImportedSymbol(filePath, d.handlerImport);
+                    const byImport = await resolveImportedSymbol(filePath, d.handlerImport, d.strictHandlerResolution);
                     if (byImport)
                         return byImport;
-                    const byGlobal = await resolveSymbolByNameUnique(d.handlerImport.name);
-                    if (byGlobal)
-                        return byGlobal;
-                    return null;
+                    if (d.strictHandlerResolution)
+                        return null;
+                    return resolveSymbolByNameUnique(d.handlerImport.name);
                 }
-                const byName = resolveSymbolByName(syms, d.name);
+                const byName = d.strictHandlerResolution
+                    ? resolveFileSymbolByNameUnique(syms, d.name)
+                    : resolveSymbolByName(syms, d.name);
                 if (byName)
                     return byName;
+                if (d.strictHandlerResolution)
+                    return null;
                 const byGlobal = await resolveSymbolByNameUnique(d.name);
                 if (byGlobal)
                     return byGlobal;
@@ -707,7 +755,7 @@ export class HttpRouteExtractor {
     }
     // ─── Source-scan providers ─────────────────────────────────────────
     async extractProvidersSourceScan(files, getDetections, resolveSymbol) {
-        const out = [];
+        const candidates = [];
         for (const rel of files) {
             const detections = await getDetections(rel);
             const filePath = normalizeRepoRelPath(rel);
@@ -719,26 +767,52 @@ export class HttpRouteExtractor {
                 // arrow that encloses the registration line) so the contract carries a
                 // real symbolUid; fall back to the file + detection name otherwise.
                 const resolved = await resolveSymbol(filePath, d);
-                out.push({
-                    contractId: contractIdFor(d.method, pathNorm),
-                    type: 'http',
-                    role: 'provider',
-                    symbolUid: resolved?.uid ?? '',
-                    symbolRef: {
-                        filePath: resolved?.filePath || filePath,
-                        name: resolved?.name ?? d.name ?? 'handler',
-                    },
-                    symbolName: resolved?.name ?? d.name ?? 'handler',
-                    confidence: d.confidence,
-                    meta: {
-                        method: d.method,
-                        path: pathNorm,
-                        pathSegments: pathNorm.split('/').filter(Boolean),
-                        extractionStrategy: resolved ? 'source_scan_resolved' : 'source_scan',
-                        framework: d.framework,
-                    },
-                });
+                candidates.push({ detection: d, filePath, pathNorm, resolved });
+            }
+        }
+        const dataCandidatesByIdentity = new Map();
+        for (const candidate of candidates) {
+            if (candidate.detection.framework !== DATA_ROUTE_TABLE_SOURCE)
+                continue;
+            const identity = contractIdFor(candidate.detection.method, candidate.pathNorm);
+            const grouped = dataCandidatesByIdentity.get(identity) ?? [];
+            grouped.push(candidate);
+            dataCandidatesByIdentity.set(identity, grouped);
+        }
+        const ambiguousDataIdentities = new Set();
+        for (const [identity, grouped] of dataCandidatesByIdentity) {
+            if (grouped.length < 2)
+                continue;
+            const resolvedIds = new Set(grouped.flatMap((candidate) => candidate.resolved === null ? [] : [candidate.resolved.uid]));
+            if (grouped.some((candidate) => candidate.resolved === null) || resolvedIds.size !== 1) {
+                ambiguousDataIdentities.add(identity);
+            }
+        }
+        const out = [];
+        for (const { detection: d, filePath, pathNorm, resolved } of candidates) {
+            const contractId = contractIdFor(d.method, pathNorm);
+            if (d.framework === DATA_ROUTE_TABLE_SOURCE && ambiguousDataIdentities.has(contractId)) {
+                continue;
             }
+            out.push({
+                contractId,
+                type: 'http',
+                role: 'provider',
+                symbolUid: resolved?.uid ?? '',
+                symbolRef: {
+                    filePath: resolved?.filePath || filePath,
+                    name: resolved?.name ?? d.name ?? 'handler',
+                },
+                symbolName: resolved?.name ?? d.name ?? 'handler',
+                confidence: d.confidence,
+                meta: {
+                    method: d.method,
+                    path: pathNorm,
+                    pathSegments: pathNorm.split('/').filter(Boolean),
+                    extractionStrategy: resolved ? 'source_scan_resolved' : 'source_scan',
+                    framework: d.framework,
+                },
+            });
         }
         return this.dedupeContracts(out);
     }

package/dist/core/group/extractors/include-extractor.js

@@ -397,19 +397,37 @@ export class IncludeExtractor {
             const rows = await db(`MATCH (f:File)
          WHERE f.filePath =~ '.*\\\\.(h|hpp|hxx|hh|cuh)$'
          RETURN f.filePath AS filePath, f.id AS fileId`);
-            // gitnexus analyze stores absolute paths in the File.filePath column.
             // Provider contract IDs MUST be repo-relative — otherwise the consumer
             // emits `include::map/base/view.h` and the provider emits
             // `include::/abs/path/to/repo/map/base/view.h`, which never match
             // through runExactMatch and the cross-link silently disappears.
             // (PR #1156 follow-up review: graph provider absolute-path bug.)
+            //
+            // Current `gitnexus analyze` does NOT store absolute paths here, contrary
+            // to what this comment used to claim: File.filePath is built from the
+            // walker's repo-relative, forward-slash paths (filesystem-walker.ts →
+            // processStructure), and a full self-index at 89bbdcf5 had 0 of 239,070
+            // nodes with an absolute or backslash-bearing filePath (#2667). The
+            // relativisation below therefore stays as a guard against rows this
+            // process did not write — an index built by an older version, or one
+            // carried over from another machine — not as a description of what
+            // analyze currently emits.
             const normalizedRepoPath = path.resolve(repoPath);
             const out = [];
             for (const r of rows) {
                 if (typeof r.filePath !== 'string' || !r.filePath)
                     continue;
                 const absolute = r.filePath;
-                const rel = path.relative(normalizedRepoPath, absolute);
+                // Only relativise a row that is actually absolute. Current analyze writes
+                // repo-relative paths (above), and `path.relative(repoRoot, 'src/a.h')`
+                // resolves the second argument against the PROCESS CWD — so from any cwd
+                // other than the repo root every relative row came back `..`-prefixed and
+                // was dropped by the guard below, silently emptying this strategy (#2667
+                // review). Absolute rows still go through `path.relative` so the
+                // containment check keeps rejecting foreign and escaping paths.
+                const rel = path.isAbsolute(absolute)
+                    ? path.relative(normalizedRepoPath, absolute)
+                    : absolute;
                 // Skip rows that resolve outside the repo (e.g., system headers
                 // somehow indexed, or stale absolute paths from a different machine).
                 // path.relative returns a `..`-prefixed path or an absolute path

package/dist/core/group/extractors/manifest-extractor.d.ts

@@ -4,7 +4,7 @@ export interface ManifestExtractResult {
     contracts: StoredContract[];
     crossLinks: CrossLink[];
 }
-export declare const CUSTOM_CONTRACT_RESOLVE_QUERY = "MATCH (n)\n   WHERE labels(n) IN ['Function','Method','Class','Interface','Struct','Enum','Trait','Constructor','TypeAlias','Impl','Macro','Union','Typedef','Property','Record','Delegate','Annotation','Template','Const','Static','CodeElement']\n     AND n.name = $symbolName\n   RETURN n.id AS uid, n.name AS name, n.filePath AS filePath\n   ORDER BY n.filePath ASC\n   LIMIT 1";
+export declare const CUSTOM_CONTRACT_RESOLVE_QUERY = "MATCH (n)\n   WHERE labels(n) IN ['Function','Method','Class','Interface','Struct','Enum','Trait','Constructor','TypeAlias','Impl','Macro','Union','Typedef','Property','Record','Delegate','Annotation','Template','Const','Static','CodeElement']\n     AND n.name = $symbolName\n   RETURN n.id AS uid, n.name AS name, n.filePath AS filePath\n   ORDER BY n.filePath ASC, n.id ASC\n   LIMIT 1";
 /**
  * Stable synthetic symbolUid for a manifest-declared contract whose target
  * symbol could not be resolved against the per-repo graph (resolveSymbol

package/dist/core/group/extractors/manifest-extractor.js

@@ -15,7 +15,7 @@ export const CUSTOM_CONTRACT_RESOLVE_QUERY = `MATCH (n)
    WHERE labels(n) IN ['Function','Method','Class','Interface','Struct','Enum','Trait','Constructor','TypeAlias','Impl','Macro','Union','Typedef','Property','Record','Delegate','Annotation','Template','Const','Static','CodeElement']
      AND n.name = $symbolName
    RETURN n.id AS uid, n.name AS name, n.filePath AS filePath
-   ORDER BY n.filePath ASC
+   ORDER BY n.filePath ASC, n.id ASC
    LIMIT 1`;
 /**
  * Canonicalize an HTTP path for matching against Route.name in the graph.
@@ -199,7 +199,7 @@ export class ManifestExtractor {
                 rows = await executor(`MATCH (handler)-[r:CodeRelation {type: 'HANDLES_ROUTE'}]->(route:Route)
            WHERE route.name = $normalized
            RETURN handler.id AS uid, handler.name AS name, handler.filePath AS filePath
-           ORDER BY handler.filePath ASC
+           ORDER BY handler.filePath ASC, handler.id ASC
            LIMIT 1`, { normalized });
             }
             else if (link.type === 'topic') {
@@ -210,7 +210,7 @@ export class ManifestExtractor {
                 // share the topic name.
                 rows = await executor(`MATCH (n) WHERE labels(n) IN ['Function','Method','Class','Interface'] AND n.name = $contract
            RETURN n.id AS uid, n.name AS name, n.filePath AS filePath
-           ORDER BY n.filePath ASC
+           ORDER BY n.filePath ASC, n.id ASC
            LIMIT 1`, { contract: link.contract });
             }
             else if (link.type === 'grpc' || link.type === 'thrift') {
@@ -231,13 +231,13 @@ export class ManifestExtractor {
                 if (methodName) {
                     rows = await executor(`MATCH (n) WHERE labels(n) IN ['Function','Method'] AND n.name = $methodName
              RETURN n.id AS uid, n.name AS name, n.filePath AS filePath
-             ORDER BY n.filePath ASC
+             ORDER BY n.filePath ASC, n.id ASC
              LIMIT 1`, { methodName });
                 }
                 else if (serviceName) {
                     rows = await executor(`MATCH (n) WHERE labels(n) IN ['Class','Interface'] AND n.name = $serviceName
              RETURN n.id AS uid, n.name AS name, n.filePath AS filePath
-             ORDER BY n.filePath ASC
+             ORDER BY n.filePath ASC, n.id ASC
              LIMIT 1`, { serviceName });
                 }
                 else {
@@ -253,13 +253,13 @@ export class ManifestExtractor {
                 // NODE_TABLES — so a `Package` entry only ever matched nothing.)
                 rows = await executor(`MATCH (n) WHERE labels(n) IN ['Module'] AND n.name = $contract
            RETURN n.id AS uid, n.name AS name, n.filePath AS filePath
-           ORDER BY n.filePath ASC
+           ORDER BY n.filePath ASC, n.id ASC
            LIMIT 1`, { contract: link.contract });
             }
             else if (link.type === 'include') {
                 rows = await executor(`MATCH (f:File) WHERE f.filePath = $contract
            RETURN f.id AS uid, f.name AS name, f.filePath AS filePath
-           ORDER BY f.filePath ASC
+           ORDER BY f.filePath ASC, f.id ASC
            LIMIT 1`, { contract: link.contract });
             }
             else if (link.type === 'custom') {

package/dist/core/group/service.js

@@ -9,7 +9,10 @@ import { loadMeta } from '../../storage/repo-manager.js';
 import { GroupNotFoundError, loadGroupConfig } from './config-parser.js';
 import { fileMatchesServicePrefix, normalizeServicePrefix, repoInSubgroup, } from './group-path-utils.js';
 import { getDefaultGitnexusDir, getGroupDir, listGroups, readContractRegistry } from './storage.js';
-import { syncGroup } from './sync.js';
+// `./sync.js` is imported LAZILY in `groupSync` — see the comment at its call
+// site. It statically pulls the six contract extractors and, through them, the
+// native tree-sitter binding; a static import here puts all of that on MCP
+// server startup, which never syncs.
 import { logger } from '../logger.js';
 function isStoredContract(raw) {
     if (!raw || typeof raw !== 'object')
@@ -166,6 +169,12 @@ export class GroupService {
                 return { error: `Group "${name}" not found. Run group_list to see configured groups.` };
             throw err;
         }
+        // Lazy: `sync.js` reaches the six contract extractors and the native
+        // tree-sitter binding. `groupSync` is the ONLY consumer — the other seven
+        // group tools never need it — so deferring it here keeps that closure off
+        // MCP server startup entirely and off every non-sync group call. The CLI
+        // already does exactly this at `cli/group.ts`'s sync command.
+        const { syncGroup } = await import('./sync.js');
         const result = await syncGroup(config, {
             groupDir,
             exactOnly: Boolean(params.exactOnly),

package/dist/core/group/storage.js

@@ -2,16 +2,7 @@ import * as fs from 'node:fs';
 import * as fsp from 'node:fs/promises';
 import * as path from 'node:path';
 import * as os from 'node:os';
-import { randomBytes } from 'node:crypto';
-import { retryRename } from '../../storage/fs-atomic.js';
-/**
- * Build an unpredictable suffix for atomic-write tmp files. Replaces the
- * previous `Date.now()` pattern which CodeQL flagged as
- * js/insecure-temporary-file: a guessable suffix in a writable directory
- * lets a co-located attacker pre-create or symlink the tmp path before the
- * write lands.
- */
-const tmpSuffix = () => randomBytes(8).toString('hex');
+import { writeFileAtomic } from '../../storage/fs-atomic.js';
 const CONTRACTS_FILE = 'contracts.json';
 export function getDefaultGitnexusDir() {
     return process.env.GITNEXUS_HOME || path.join(os.homedir(), '.gitnexus');
@@ -30,29 +21,7 @@ export function getGroupDir(gitnexusDir, groupName) {
     return path.join(gitnexusDir, 'groups', groupName);
 }
 export async function writeContractRegistry(groupDir, registry) {
-    const targetPath = path.join(groupDir, CONTRACTS_FILE);
-    const tmpPath = `${targetPath}.tmp.${tmpSuffix()}`;
-    // O_EXCL via `'wx'` flag + explicit `0o600` mode — closes both halves
-    // of the CodeQL js/insecure-temporary-file finding: `'wx'` rejects a
-    // pre-planted symlink at the path, and `0o600` (user-only) prevents
-    // the file from being created group/world readable while it briefly
-    // contains contract data en route to the rename. The query's
-    // `isSecureMode` predicate inspects ONLY the mode argument, not the
-    // flags, so the explicit mode is what credits the fix.
-    const handle = await fsp.open(tmpPath, 'wx', 0o600);
-    try {
-        await handle.writeFile(JSON.stringify(registry, null, 2), 'utf-8');
-    }
-    finally {
-        await handle.close();
-    }
-    // retryRename absorbs the documented Windows EPERM/EBUSY/EACCES race that
-    // fires when AV scanners or another concurrent rename briefly hold the
-    // destination handle between rename calls. Same helper bridge-db.ts uses
-    // (lines 304, 583, 587, 595, 605, 677) for the bridge.lbug atomic swap —
-    // single source of truth for the Windows-rename pattern across the group
-    // package.
-    await retryRename(tmpPath, targetPath);
+    await writeFileAtomic(path.join(groupDir, CONTRACTS_FILE), JSON.stringify(registry, null, 2));
 }
 export async function readContractRegistry(groupDir) {
     const filePath = path.join(groupDir, CONTRACTS_FILE);

package/dist/core/group/types.d.ts

@@ -120,6 +120,18 @@ export interface GroupImpactResult {
         cross_repo_hits: number;
     };
     risk: string;
+    /**
+     * `'lower-bound'` when the fan-out was cut short, so `risk` is a FLOOR, not a
+     * verdict. Same vocabulary as single-repo `impact`'s `epistemic` field.
+     *
+     * `mergeRisk` is monotone increasing in the number of traversed crossings, so
+     * dropping a crossing can only move the reported risk DOWN — a fully
+     * truncated fan-out returns bare `localRisk`, making a symbol whose blast
+     * radius crosses a repo boundary indistinguishable from one with no
+     * cross-repo consumers. Absent this marker a truncated run emits a
+     * confident-looking `risk` byte-identical to a complete one.
+     */
+    riskEpistemic?: 'lower-bound';
     /**
      * Milliseconds budget applied to the **Phase 1 local impact** leg (`safeLocalImpact`).
      * If the walk hits this wall first, expect `truncationReason: 'timeout'` and a partial `local` payload.
@@ -160,6 +172,12 @@ export interface CrossRepoImpact {
     };
     by_depth: Record<string, unknown[]>;
     affected_processes: string[];
+    /**
+     * Present when the bridge proves a repository boundary but the far endpoint
+     * has no graph symbol, so local fan-out cannot be attempted. Omitted for
+     * completed fan-out to preserve the existing serialized result shape.
+     */
+    fanout_status?: 'not_attempted';
 }
 export interface OutOfScopeLink {
     from: string;

package/dist/core/incremental/subgraph-extract.d.ts

@@ -6,8 +6,8 @@
  * replaced, produce a smaller KnowledgeGraph that contains:
  *
  *   - Every node whose `properties.filePath` is in `toWriteSet`.
- *   - Every graph-wide node (Community, Process) — these are regenerated
- *     each run by the communities/processes phases and must be fully
+ *   - Every graph-wide node (Community, Process, and Spring metadata
+ *     placeholders) — these are regenerated each run and must be fully
  *     rewritten.
  *   - Every relationship where AT LEAST ONE endpoint is in the writable
  *     set above. Relationships entirely between unchanged-file nodes
@@ -51,10 +51,13 @@ import type { KnowledgeGraph } from '../graph/types.js';
 export declare const extractChangedSubgraph: (fullGraph: KnowledgeGraph, toWriteSet: ReadonlySet<string>) => KnowledgeGraph;
 /**
  * Public — derive the EFFECTIVE write-set: `toWriteSet` expanded by one
- * hop along every edge in the new graph that crosses the writable
- * boundary (one endpoint in a writable file, the other in an unchanged
- * file). The unchanged-side file is pulled in so its stale rows are
- * deleted + rewritten in lockstep with the changed side.
+ * hop along every file-owned edge in the new graph that crosses the
+ * writable boundary (one endpoint in a writable file, the other in an
+ * unchanged file). Graph-wide relationships are excluded: their owner
+ * phase delete-alls and re-extracts them independently, so following them
+ * here would turn high-fan-out metadata into a near-full-repository write.
+ * For ordinary edges, the unchanged-side file is pulled in so its stale
+ * rows are deleted + rewritten in lockstep with the changed side.
  *
  * Single pass over the edge list. Does NOT mutate `toWriteSet`. The
  * orchestrator MUST feed the returned set to both `deleteNodesForFiles`

package/dist/core/incremental/subgraph-extract.js

@@ -6,8 +6,8 @@
  * replaced, produce a smaller KnowledgeGraph that contains:
  *
  *   - Every node whose `properties.filePath` is in `toWriteSet`.
- *   - Every graph-wide node (Community, Process) — these are regenerated
- *     each run by the communities/processes phases and must be fully
+ *   - Every graph-wide node (Community, Process, and Spring metadata
+ *     placeholders) — these are regenerated each run and must be fully
  *     rewritten.
  *   - Every relationship where AT LEAST ONE endpoint is in the writable
  *     set above. Relationships entirely between unchanged-file nodes
@@ -48,7 +48,12 @@
  * IMPORTS from the pre-pipeline DB) covers that case instead.
  */
 import { createKnowledgeGraph } from '../graph/graph.js';
-const isGraphWide = (label) => label === 'Community' || label === 'Process';
+import { isSpringAutoConfigurationDeclaration, isSpringAutoConfigurationSyntheticClass, } from '../ingestion/frameworks/spring/auto-configuration.js';
+import { isSpringAopEvidenceNode } from '../ingestion/frameworks/spring/aop.js';
+const isGraphWideNode = (node) => node.label === 'Community' ||
+    node.label === 'Process' ||
+    isSpringAopEvidenceNode(node) ||
+    isSpringAutoConfigurationSyntheticClass(node);
 /**
  * Relationship types whose VALIDITY is a whole-program property, not a
  * function of their endpoints' files (#2084 M4 U6). `TAINT_PATH` (cross-
@@ -76,7 +81,20 @@ const isGraphWide = (label) => label === 'Community' || label === 'Process';
 // analyze, and the `incrementalInProgress` dirty flag (saved before any
 // delete) forces a full rebuild on the next run. Temporary absence is
 // possible; duplicates are not.
-const isGraphWideRelType = (type) => type === 'TAINT_PATH' || type === 'CALL_SUMMARY' || type === 'INJECTS';
+//
+// Spring auto-configuration DECLARES edges (#2415) are also recomputed from
+// repository-wide metadata. A third-file class addition/removal can retarget
+// an unchanged declaration, so they need the same global re-extract contract.
+// DECLARES itself is generic, however: only the two Spring-owned reasons are
+// graph-wide, leaving future metadata systems under their own lifecycle.
+const isGraphWideRelationship = (relationship) => relationship.type === 'TAINT_PATH' ||
+    relationship.type === 'CALL_SUMMARY' ||
+    relationship.type === 'INJECTS' ||
+    // Spring pointcut matching (#2416) is repository-wide. A third-file change
+    // can alter annotation-name visibility or the set matched by a wildcard,
+    // even when neither endpoint file changed.
+    relationship.type === 'ADVISED_BY' ||
+    isSpringAutoConfigurationDeclaration(relationship);
 /**
  * Build a Map<nodeId, filePath> for every File-bound node in the graph.
  * Graph-wide nodes (Community/Process) have no filePath and are filtered.
@@ -95,7 +113,7 @@ export const extractChangedSubgraph = (fullGraph, toWriteSet) => {
     const writableNodeIds = new Set();
     fullGraph.forEachNode((n) => {
         const filePath = n.properties?.filePath;
-        const include = (filePath && toWriteSet.has(filePath)) || isGraphWide(n.label);
+        const include = (filePath && toWriteSet.has(filePath)) || isGraphWideNode(n);
         if (include) {
             sub.addNode(n);
             writableNodeIds.add(n.id);
@@ -104,7 +122,7 @@ export const extractChangedSubgraph = (fullGraph, toWriteSet) => {
     fullGraph.forEachRelationship((r) => {
         if (writableNodeIds.has(r.sourceId) ||
             writableNodeIds.has(r.targetId) ||
-            isGraphWideRelType(r.type)) {
+            isGraphWideRelationship(r)) {
             sub.addRelationship(r);
         }
     });
@@ -112,10 +130,13 @@ export const extractChangedSubgraph = (fullGraph, toWriteSet) => {
 };
 /**
  * Public — derive the EFFECTIVE write-set: `toWriteSet` expanded by one
- * hop along every edge in the new graph that crosses the writable
- * boundary (one endpoint in a writable file, the other in an unchanged
- * file). The unchanged-side file is pulled in so its stale rows are
- * deleted + rewritten in lockstep with the changed side.
+ * hop along every file-owned edge in the new graph that crosses the
+ * writable boundary (one endpoint in a writable file, the other in an
+ * unchanged file). Graph-wide relationships are excluded: their owner
+ * phase delete-alls and re-extracts them independently, so following them
+ * here would turn high-fan-out metadata into a near-full-repository write.
+ * For ordinary edges, the unchanged-side file is pulled in so its stale
+ * rows are deleted + rewritten in lockstep with the changed side.
  *
  * Single pass over the edge list. Does NOT mutate `toWriteSet`. The
  * orchestrator MUST feed the returned set to both `deleteNodesForFiles`
@@ -126,6 +147,8 @@ export const computeEffectiveWriteSet = (fullGraph, toWriteSet) => {
     const nodeFilePaths = indexNodeFilePaths(fullGraph);
     const expanded = new Set(toWriteSet);
     fullGraph.forEachRelationship((r) => {
+        if (isGraphWideRelationship(r))
+            return;
         const sourcePath = nodeFilePaths.get(r.sourceId);
         const targetPath = nodeFilePaths.get(r.targetId);
         if (!sourcePath || !targetPath)