gitnexus 1.6.10-rc.21 → 1.6.10-rc.211

package/dist/core/index-freshness.d.ts

@@ -0,0 +1,80 @@
+import type { RepoMeta } from '../storage/repo-manager.js';
+export declare const INDEX_INCOMPLETE_REASONS: readonly ["incremental-in-progress", "embedding-checkpoint-pending", "embedding-count-unverified", "graph-write-collapsed"];
+export type IndexIncompleteReason = (typeof INDEX_INCOMPLETE_REASONS)[number];
+/**
+ * Fraction of the pipeline's relationship count that must survive into the DB
+ * before the write counts as collapsed. Deliberately generous: this detects
+ * "most of the graph did not persist" (the reported case lost ~91%), not a
+ * per-edge reconciliation.
+ */
+export declare const GRAPH_WRITE_COLLAPSE_RATIO = 0.5;
+/**
+ * Below this many relationships the ratio is meaningless — a handful of edges
+ * lost to legitimate filtering would trip it — so small repos are exempt.
+ */
+export declare const GRAPH_WRITE_COLLAPSE_MIN_EDGES = 100;
+/** Why {@link detectGraphWriteCollapse} could reach no verdict at all. */
+export type GraphWriteCollapseUnmeasurableReason = 
+/** The pipeline's own total was not a usable number (or was zero). */
+'expected-unavailable'
+/** The DB-side count could not be READ — a query that threw, no connection. */
+ | 'persisted-unreadable'
+/** Set by the CALLER: an incremental write persists only the changed
+ *  subgraph, so whole-scope counts are not comparable to it. */
+ | 'incremental-write';
+/**
+ * The three outcomes of the collapse check, kept APART because two of them used
+ * to share `undefined` and the conflation erased a stamp recording real,
+ * unrepaired edge loss.
+ *
+ * `'healthy'` is a POSITIVE all-clear — the counts were both taken and enough
+ * rows persisted — and is the only outcome that licenses clearing a previous
+ * `graph-write-collapsed` stamp. `'unmeasurable'` says the comparison never
+ * happened; the previous stamp must survive it, because nothing has repaired
+ * whatever it recorded.
+ */
+export type GraphWriteCollapseVerdict = {
+    verdict: 'collapsed';
+    expected: number;
+    persisted: number;
+} | {
+    verdict: 'healthy';
+} | {
+    verdict: 'unmeasurable';
+    reason: GraphWriteCollapseUnmeasurableReason;
+};
+/**
+ * Decide whether a finished write collapsed, comparing what the pipeline
+ * produced against what the DB hands back.
+ *
+ * A RATIO, not equality: some relationship types do not round-trip one-for-one
+ * and `--pdg` writes MORE rows into the same table, so demanding equality would
+ * fire on healthy runs. Only a collapse is a defect.
+ *
+ * FAIL-SAFE at `expected === 0`: an implementation that offloads relationships
+ * out of memory may not be able to report a total, and a false "your index is
+ * broken" is worse than a missed one. That case is `'unmeasurable'`, NOT
+ * `'healthy'` — nothing was compared, so nothing was cleared.
+ *
+ * Returns a THREE-WAY verdict rather than `{...} | undefined`. The absent value
+ * meant both "measured, fine" and "could not measure", and the caller — which
+ * decides whether to keep or erase the persisted `graph-write-collapsed` stamp —
+ * cannot tell those apart from a shared `undefined`. It guessed by write mode
+ * instead, so a full run whose structural count threw took the
+ * "no collapse ⇒ clear it" branch and deleted a stamp recording real loss.
+ */
+export declare function detectGraphWriteCollapse(expected: number, 
+/**
+ * Relationships readable from the DB, or `undefined` when the count could
+ * not be READ at all (no connection, a query that threw).
+ *
+ * The distinction is load-bearing and was got wrong once: `getLbugStats`
+ * reports `edges: 0` for "no connection", "query threw" AND "empty table"
+ * alike, so passing it straight in made every run without a readable DB look
+ * like a total collapse. An unmeasurable count is not a measured zero —
+ * accepting `undefined` here is what keeps this check from committing the
+ * same confident-zero error it exists to catch.
+ */
+persisted: number | undefined): GraphWriteCollapseVerdict;
+/** Stable machine-readable reasons an index cannot be certified complete. */
+export declare function getIndexIncompleteReasons(meta: Pick<RepoMeta, 'incrementalInProgress' | 'embeddingCheckpoint' | 'graphWriteCollapsed'> | null | undefined): IndexIncompleteReason[];

package/dist/core/index-freshness.js

@@ -0,0 +1,120 @@
+import { checkpointKind } from './embedding-checkpoint.js';
+export const INDEX_INCOMPLETE_REASONS = [
+    'incremental-in-progress',
+    'embedding-checkpoint-pending',
+    'embedding-count-unverified',
+    'graph-write-collapsed',
+];
+/**
+ * Fraction of the pipeline's relationship count that must survive into the DB
+ * before the write counts as collapsed. Deliberately generous: this detects
+ * "most of the graph did not persist" (the reported case lost ~91%), not a
+ * per-edge reconciliation.
+ */
+export const GRAPH_WRITE_COLLAPSE_RATIO = 0.5;
+/**
+ * Below this many relationships the ratio is meaningless — a handful of edges
+ * lost to legitimate filtering would trip it — so small repos are exempt.
+ */
+export const GRAPH_WRITE_COLLAPSE_MIN_EDGES = 100;
+/**
+ * Decide whether a finished write collapsed, comparing what the pipeline
+ * produced against what the DB hands back.
+ *
+ * A RATIO, not equality: some relationship types do not round-trip one-for-one
+ * and `--pdg` writes MORE rows into the same table, so demanding equality would
+ * fire on healthy runs. Only a collapse is a defect.
+ *
+ * FAIL-SAFE at `expected === 0`: an implementation that offloads relationships
+ * out of memory may not be able to report a total, and a false "your index is
+ * broken" is worse than a missed one. That case is `'unmeasurable'`, NOT
+ * `'healthy'` — nothing was compared, so nothing was cleared.
+ *
+ * Returns a THREE-WAY verdict rather than `{...} | undefined`. The absent value
+ * meant both "measured, fine" and "could not measure", and the caller — which
+ * decides whether to keep or erase the persisted `graph-write-collapsed` stamp —
+ * cannot tell those apart from a shared `undefined`. It guessed by write mode
+ * instead, so a full run whose structural count threw took the
+ * "no collapse ⇒ clear it" branch and deleted a stamp recording real loss.
+ */
+export function detectGraphWriteCollapse(expected, 
+/**
+ * Relationships readable from the DB, or `undefined` when the count could
+ * not be READ at all (no connection, a query that threw).
+ *
+ * The distinction is load-bearing and was got wrong once: `getLbugStats`
+ * reports `edges: 0` for "no connection", "query threw" AND "empty table"
+ * alike, so passing it straight in made every run without a readable DB look
+ * like a total collapse. An unmeasurable count is not a measured zero —
+ * accepting `undefined` here is what keeps this check from committing the
+ * same confident-zero error it exists to catch.
+ */
+persisted) {
+    // Both sides must be REAL NUMBERS before any comparison. A non-numeric
+    // `expected` (a graph implementation that reports no total, a lightweight
+    // pipeline result) does not merely skip the guards — it INVERTS them:
+    // `undefined < 100` is false, so the min-edges exemption never fires, and
+    // `0 >= undefined * 0.5` is `0 >= NaN`, also false, so the ratio check
+    // "passes" too and a healthy run is reported as a total collapse. Comparing
+    // against a non-number is the one way this check can manufacture the exact
+    // false certainty it was written to prevent.
+    if (!Number.isFinite(expected)) {
+        return { verdict: 'unmeasurable', reason: 'expected-unavailable' };
+    }
+    if (typeof persisted !== 'number' || !Number.isFinite(persisted)) {
+        return { verdict: 'unmeasurable', reason: 'persisted-unreadable' };
+    }
+    const expectedCount = expected;
+    const persistedCount = persisted;
+    // FAIL-SAFE, and `'unmeasurable'` rather than `'healthy'`: a zero expectation
+    // is the documented "could not report a total" case, not evidence the write
+    // went well. Reporting it as an all-clear would let a run that measured
+    // nothing erase a stamp recording a previous run's real loss.
+    if (expectedCount === 0) {
+        return { verdict: 'unmeasurable', reason: 'expected-unavailable' };
+    }
+    // A TOTAL loss is never small enough to excuse. The min-edges exemption
+    // exists for "a handful of edges lost to legitimate filtering", which its own
+    // docstring says — it does not describe a persisted count of zero. Evaluated
+    // before the exemption because the exemption looked only at `expected`:
+    // `expected = 99, persisted = 0` lost every single edge and still returned
+    // no verdict, leaving the metadata fresh and the CLI reporting success.
+    if (expectedCount > 0 && persistedCount === 0) {
+        return { verdict: 'collapsed', expected: expectedCount, persisted: persistedCount };
+    }
+    // The small-repo exemption and the cleared ratio are both `'healthy'`, not
+    // `'unmeasurable'`: both counts WERE taken, and the comparison ran. Calling
+    // the exemption a non-verdict would make a stamp unclearable on any repo that
+    // shrank below the threshold — a permanent forced-rebuild wedge, which is the
+    // failure this taxonomy exists to avoid rather than to relocate.
+    if (expectedCount < GRAPH_WRITE_COLLAPSE_MIN_EDGES)
+        return { verdict: 'healthy' };
+    if (persistedCount >= expectedCount * GRAPH_WRITE_COLLAPSE_RATIO)
+        return { verdict: 'healthy' };
+    return { verdict: 'collapsed', expected: expectedCount, persisted: persistedCount };
+}
+/** Stable machine-readable reasons an index cannot be certified complete. */
+export function getIndexIncompleteReasons(meta) {
+    const reasons = [];
+    if (meta?.incrementalInProgress)
+        reasons.push('incremental-in-progress');
+    // The run finished and wrote metadata, but far fewer edges reached the DB
+    // than the pipeline produced — the "refresh reported success, the index is
+    // unusable" failure. Without this the index reads as fresh and every tool
+    // answers from a graph missing most of its edges, which is indistinguishable
+    // from a codebase that genuinely has no such relationships.
+    if (meta?.graphWriteCollapsed)
+        reasons.push('graph-write-collapsed');
+    if (meta?.embeddingCheckpoint) {
+        // The three checkpoint kinds are not one operator-facing state. GUARDRAILS
+        // and the runbook document `embedding-checkpoint-pending` as "N node(s)
+        // lost their embeddings to endpoint failures" — true for 'interrupted' and
+        // 'partial', a lie for 'unverified-count', whose pending set is empty and
+        // whose only defect is a count nobody could measure (see the `kind` doc in
+        // repo-manager.ts).
+        reasons.push(checkpointKind(meta.embeddingCheckpoint) === 'unverified-count'
+            ? 'embedding-count-unverified'
+            : 'embedding-checkpoint-pending');
+    }
+    return reasons;
+}

package/dist/core/ingestion/call-processor.d.ts

@@ -16,11 +16,22 @@
  */
 import { KnowledgeGraph } from '../graph/types.js';
 import type { SemanticModel, SymbolTableReader } from './model/index.js';
+import type { ParsedImport, SymbolDefinition } from '../../_shared/index.js';
 import type { ExtractedRoute, ExtractedFetchCall } from './workers/parse-worker.js';
 import type { ExtractedDecoratorRoute } from './workers/parse-worker.js';
 /** Per-file resolved type bindings for exported symbols.
  *  Consumed by the cross-file re-resolution / enrichment pass. */
 export type ExportedTypeMap = Map<string, Map<string, string>>;
+interface RouteResolutionFile {
+    readonly filePath: string;
+    readonly parsedImports: readonly ParsedImport[];
+    readonly localDefs: readonly SymbolDefinition[];
+}
+interface RouteHandlerResolutionContext {
+    readonly files: readonly RouteResolutionFile[];
+    readonly resolveImportTarget: (parsedImport: ParsedImport, fromFile: string) => string | null;
+    readonly isExportedSymbol: (nodeId: string) => boolean;
+}
 /** Record one exported graph node into the incremental ExportedTypeMap. */
 export declare const accumulateExportedTypesFromParsedNode: (result: ExportedTypeMap, node: {
     id: string;
@@ -86,7 +97,7 @@ export declare const processRoutesFromExtracted: (graph: KnowledgeGraph, extract
  * `handlerSymbolId`; the extractor then falls back to source scan for that route
  * (fail-open, no regression, never a wrong handler).
  */
-export declare function resolveRouteHandlerSymbols(model: SemanticModel, extractedRoutes: readonly ExtractedRoute[], decoratorRoutes: readonly ExtractedDecoratorRoute[]): Map<string, string>;
+export declare function resolveRouteHandlerSymbols(model: SemanticModel, extractedRoutes: readonly ExtractedRoute[], decoratorRoutes: readonly ExtractedDecoratorRoute[], routeContext?: RouteHandlerResolutionContext): Map<string, string>;
 /**
  * Extract property access keys from a consumer file's source code near fetch calls.
  *
@@ -112,3 +123,4 @@ export declare const extractConsumerAccessedKeys: (content: string) => string[];
  */
 export declare const processNextjsFetchRoutes: (graph: KnowledgeGraph, fetchCalls: ExtractedFetchCall[], routeUrlToKeys: Map<string, string[]>, // routeURL → route node keys at that URL
 consumerContents?: Map<string, string>) => void;
+export {};

package/dist/core/ingestion/call-processor.js

@@ -19,6 +19,7 @@ import { yieldToEventLoop } from './utils/event-loop.js';
 import { normalizeFetchURL, routeMatches } from './route-extractors/nextjs.js';
 import { normalizeExtractedRoutePath, normalizeRouteMethod, routeNodeKey, } from './route-extractors/route-path.js';
 import { extractReturnTypeName } from './type-extractors/shared.js';
+import { DATA_ROUTE_TABLE_SOURCE } from './route-extractors/data-route-table.js';
 const MAX_EXPORTS_PER_FILE = 500;
 const MAX_TYPE_NAME_LENGTH = 256;
 /** Record one exported graph node into the incremental ExportedTypeMap. */
@@ -242,7 +243,7 @@ export const processRoutesFromExtracted = async (graph, extractedRoutes, model,
  * `handlerSymbolId`; the extractor then falls back to source scan for that route
  * (fail-open, no regression, never a wrong handler).
  */
-export function resolveRouteHandlerSymbols(model, extractedRoutes, decoratorRoutes) {
+export function resolveRouteHandlerSymbols(model, extractedRoutes, decoratorRoutes, routeContext) {
     const out = new Map();
     // Route identities already claimed by an earlier route (resolved or not).
     // Mirrors the routes phase `addRoute` first-writer-wins so the handler we
@@ -254,6 +255,74 @@ export function resolveRouteHandlerSymbols(model, extractedRoutes, decoratorRout
         const defs = model.symbols.lookupExactAll(filePath, name);
         return defs.length === 1 ? defs[0]?.nodeId : undefined;
     };
+    const uniqueById = (defs) => {
+        const byId = new Map(defs.map((def) => [def.nodeId, def]));
+        return byId.size === 1 ? byId.values().next().value : undefined;
+    };
+    const routeCallables = (defs) => defs.filter((def) => def.type === 'Function' || def.type === 'Method');
+    const exportedRouteCallables = (defs) => routeContext === undefined
+        ? []
+        : routeCallables(defs).filter((def) => routeContext.isExportedSymbol(def.nodeId));
+    const filesByPath = new Map(routeContext?.files.map((file) => [file.filePath, file]) ?? []);
+    const uniqueImport = (filePath, localName) => {
+        const matches = (filesByPath.get(filePath)?.parsedImports ?? []).filter((parsedImport) => 'localName' in parsedImport &&
+            parsedImport.localName === localName &&
+            parsedImport.kind !== 'dynamic-unresolved');
+        return matches.length === 1 ? matches[0] : undefined;
+    };
+    const importedTarget = (filePath, localName) => {
+        if (routeContext === undefined)
+            return undefined;
+        const parsedImport = uniqueImport(filePath, localName);
+        if (parsedImport === undefined)
+            return undefined;
+        const targetFile = routeContext.resolveImportTarget(parsedImport, filePath);
+        return targetFile === null ? undefined : { parsedImport, targetFile };
+    };
+    const resolveDataRouteHandler = (filePath, designator) => {
+        const parts = designator.split('.');
+        if (parts.length === 1) {
+            const local = uniqueById(routeCallables(model.symbols.lookupExactAll(filePath, designator)));
+            if (local !== undefined)
+                return local.nodeId;
+            const imported = importedTarget(filePath, designator);
+            if (imported === undefined ||
+                imported.parsedImport.kind === 'namespace' ||
+                imported.parsedImport.kind === 'wildcard' ||
+                !('importedName' in imported.parsedImport)) {
+                return undefined;
+            }
+            if (imported.parsedImport.importedName === 'default') {
+                // ParsedFile does not carry explicit default-export provenance. Fail
+                // closed rather than infer an unrelated named export from the module.
+                return undefined;
+            }
+            return uniqueById(exportedRouteCallables(model.symbols.lookupExactAll(imported.targetFile, imported.parsedImport.importedName)))?.nodeId;
+        }
+        if (parts.length !== 2)
+            return undefined;
+        const [receiver, member] = parts;
+        const localOwner = uniqueById(model.symbols.lookupExactAll(filePath, receiver));
+        if (localOwner !== undefined) {
+            return uniqueById(model.methods.lookupAllByOwner(localOwner.nodeId, member))?.nodeId;
+        }
+        const imported = importedTarget(filePath, receiver);
+        if (imported === undefined || imported.parsedImport.kind === 'wildcard')
+            return undefined;
+        if (imported.parsedImport.kind === 'namespace') {
+            return uniqueById(exportedRouteCallables(model.symbols.lookupExactAll(imported.targetFile, member)))?.nodeId;
+        }
+        if (!('importedName' in imported.parsedImport))
+            return undefined;
+        if (imported.parsedImport.importedName === 'default')
+            return undefined;
+        const owner = uniqueById(model.symbols
+            .lookupExactAll(imported.targetFile, imported.parsedImport.importedName)
+            .filter((def) => routeContext?.isExportedSymbol(def.nodeId) === true));
+        return owner === undefined
+            ? undefined
+            : uniqueById(model.methods.lookupAllByOwner(owner.nodeId, member))?.nodeId;
+    };
     const claim = (routePath, prefix, httpMethod, symbolId) => {
         if (!routePath)
             return;
@@ -283,10 +352,48 @@ export function resolveRouteHandlerSymbols(model, extractedRoutes, decoratorRout
         }
         claim(route.routePath, route.prefix ?? null, route.httpMethod, methodId);
     }
+    const dataHandlerByRoute = new Map();
+    const dataHandlersByIdentity = new Map();
+    for (const dr of decoratorRoutes) {
+        if (dr.source !== DATA_ROUTE_TABLE_SOURCE || !dr.handlerName || !dr.routePath)
+            continue;
+        const handlerId = resolveDataRouteHandler(dr.filePath, dr.handlerName);
+        const url = normalizeExtractedRoutePath(dr.routePath, dr.prefix ?? null);
+        const key = routeNodeKey(normalizeRouteMethod(dr.httpMethod), url);
+        const state = dataHandlersByIdentity.get(key) ?? {
+            handlers: new Set(),
+            hasUnresolved: false,
+        };
+        if (handlerId === undefined) {
+            state.hasUnresolved = true;
+        }
+        else {
+            dataHandlerByRoute.set(dr, handlerId);
+            state.handlers.add(handlerId);
+        }
+        dataHandlersByIdentity.set(key, state);
+    }
     // Decorator routes (Spring / FastAPI / generic) — the decorated handler in
-    // the route's own file.
+    // the route's own file. Data tables additionally suppress an identity when
+    // duplicate entries resolve to different handlers: recording either one
+    // would invent a single-winner dispatch that the loop does not prove.
     for (const dr of decoratorRoutes) {
-        const handlerId = dr.handlerName ? uniqueSymbolId(dr.filePath, dr.handlerName) : undefined;
+        const handlerId = dr.source === DATA_ROUTE_TABLE_SOURCE
+            ? dataHandlerByRoute.get(dr)
+            : dr.handlerName
+                ? uniqueSymbolId(dr.filePath, dr.handlerName)
+                : undefined;
+        // An unproven data-table entry never becomes a Route node, so it must not
+        // reserve the identity and suppress a later, valid framework declaration.
+        if (dr.source === DATA_ROUTE_TABLE_SOURCE && handlerId === undefined)
+            continue;
+        if (dr.source === DATA_ROUTE_TABLE_SOURCE && dr.routePath) {
+            const url = normalizeExtractedRoutePath(dr.routePath, dr.prefix ?? null);
+            const key = routeNodeKey(normalizeRouteMethod(dr.httpMethod), url);
+            const state = dataHandlersByIdentity.get(key);
+            if (state === undefined || state.hasUnresolved || state.handlers.size !== 1)
+                continue;
+        }
         claim(dr.routePath, dr.prefix ?? null, dr.httpMethod, handlerId);
     }
     return out;

package/dist/core/ingestion/cfg/callee-cell-format.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Wire format of the `BasicBlock.callees` / `BasicBlock.calleeIds` cells.
+ *
+ * A LEAF module on purpose: it declares two string constants and imports
+ * nothing. `cfg/emit.ts` produces those cells and `mcp/local/pdg-impact.ts`
+ * parses them, but `emit.ts` is analyze-only and drags the whole CFG closure
+ * (reaching-defs, control-dependence, post-dominators, synthetic-escape,
+ * call-site-harvest) behind it — 8 modules evaluated at every MCP server start
+ * just to read two strings, since ESM evaluates a module to import any binding
+ * from it (#2802 review). Splitting the format constants out deletes that cost
+ * rather than deferring it, which is the same bar #2802 held its own proposals
+ * to.
+ *
+ * `emit.ts` RE-EXPORTS both names, so every existing importer keeps working and
+ * the producer/consumer pair still resolves to one definition — the drift this
+ * shared constant exists to prevent stays impossible.
+ */
+/**
+ * Reserved token placed in `BasicBlock.callees` when a statement's call sites
+ * were truncated at the per-statement site cap: the recorded callee list is then
+ * INCOMPLETE, so over-cap callees are absent. `*` is not a valid identifier
+ * leaf, so it cannot collide with a real callee name. The impact bridge treats a
+ * slice containing this sentinel as "callees unknown" and keeps reach
+ * callgraph-equal (proven), rather than falsely labeling an absent-but-real
+ * callee `unproven-bridge`.
+ */
+export declare const CALLEES_TRUNCATED_SENTINEL = "*";
+/**
+ * Inner separator for the `BasicBlock.calleeIds` cell (resolved callee symbol
+ * ids). A TAB is used — NOT a space — because resolved ids embed `filePath` and
+ * C++ overload shape tags with multi-word primitive types (e.g. `unsigned char`,
+ * `long double`), so an id can legitimately contain a space; a space-joined cell
+ * then fragments on read and silently drops inter-procedural reach to that
+ * callee (#2227 tri-review). A tab cannot appear in a tree-sitter-derived id
+ * token (paths/identifiers/type tokens are tab-free) and round-trips intact
+ * through `escapeCSVField` (tab is in its preserved set) and the RFC-4180 COPY
+ * reader (every cell is quoted). Producer (`calleeIdsOfBlock`) and consumer
+ * (`splitCalleeIds`) both resolve to this single constant so they cannot drift.
+ * The sibling `callees` (leaf-name) cell stays space-joined — leaf names are
+ * bare identifiers and never contain a space.
+ */
+export declare const CALLEE_ID_SEP = "\t";

package/dist/core/ingestion/cfg/callee-cell-format.js

@@ -0,0 +1,42 @@
+/**
+ * Wire format of the `BasicBlock.callees` / `BasicBlock.calleeIds` cells.
+ *
+ * A LEAF module on purpose: it declares two string constants and imports
+ * nothing. `cfg/emit.ts` produces those cells and `mcp/local/pdg-impact.ts`
+ * parses them, but `emit.ts` is analyze-only and drags the whole CFG closure
+ * (reaching-defs, control-dependence, post-dominators, synthetic-escape,
+ * call-site-harvest) behind it — 8 modules evaluated at every MCP server start
+ * just to read two strings, since ESM evaluates a module to import any binding
+ * from it (#2802 review). Splitting the format constants out deletes that cost
+ * rather than deferring it, which is the same bar #2802 held its own proposals
+ * to.
+ *
+ * `emit.ts` RE-EXPORTS both names, so every existing importer keeps working and
+ * the producer/consumer pair still resolves to one definition — the drift this
+ * shared constant exists to prevent stays impossible.
+ */
+/**
+ * Reserved token placed in `BasicBlock.callees` when a statement's call sites
+ * were truncated at the per-statement site cap: the recorded callee list is then
+ * INCOMPLETE, so over-cap callees are absent. `*` is not a valid identifier
+ * leaf, so it cannot collide with a real callee name. The impact bridge treats a
+ * slice containing this sentinel as "callees unknown" and keeps reach
+ * callgraph-equal (proven), rather than falsely labeling an absent-but-real
+ * callee `unproven-bridge`.
+ */
+export const CALLEES_TRUNCATED_SENTINEL = '*';
+/**
+ * Inner separator for the `BasicBlock.calleeIds` cell (resolved callee symbol
+ * ids). A TAB is used — NOT a space — because resolved ids embed `filePath` and
+ * C++ overload shape tags with multi-word primitive types (e.g. `unsigned char`,
+ * `long double`), so an id can legitimately contain a space; a space-joined cell
+ * then fragments on read and silently drops inter-procedural reach to that
+ * callee (#2227 tri-review). A tab cannot appear in a tree-sitter-derived id
+ * token (paths/identifiers/type tokens are tab-free) and round-trips intact
+ * through `escapeCSVField` (tab is in its preserved set) and the RFC-4180 COPY
+ * reader (every cell is quoted). Producer (`calleeIdsOfBlock`) and consumer
+ * (`splitCalleeIds`) both resolve to this single constant so they cannot drift.
+ * The sibling `callees` (leaf-name) cell stays space-joined — leaf names are
+ * bare identifiers and never contain a space.
+ */
+export const CALLEE_ID_SEP = '\t';

package/dist/core/ingestion/cfg/emit.d.ts

@@ -22,30 +22,15 @@ import type { KnowledgeGraph } from '../../graph/types.js';
 import { type ReachingDefsSolver } from './reaching-defs.js';
 import type { BasicBlockData, BindingEntry, FunctionCfg } from './types.js';
 /**
- * Reserved token placed in `BasicBlock.callees` when a statement's call sites
- * were truncated at {@link DEFAULT_PDG_MAX_SITES_PER_STATEMENT}: the recorded
- * callee list is then INCOMPLETE, so over-cap callees are absent. `*` is not a
- * valid identifier leaf, so it cannot collide with a real callee name. The
- * impact bridge treats a slice containing this sentinel as "callees unknown" and
- * keeps reach callgraph-equal (proven), rather than falsely labeling an
- * absent-but-real callee `unproven-bridge`.
+ * Cell-format constants live in the LEAF module `callee-cell-format.ts` and are
+ * re-exported here so every existing importer keeps working. The consumer side
+ * (`mcp/local/pdg-impact.ts`) imports them from the leaf directly: importing any
+ * binding from THIS module evaluates it, and with it the whole analyze-only CFG
+ * closure — 8 modules on every MCP server start to read two strings (#2802
+ * review). Producer and consumer still resolve to one definition, so the drift
+ * these shared constants exist to prevent stays impossible.
  */
-export declare const CALLEES_TRUNCATED_SENTINEL = "*";
-/**
- * Inner separator for the `BasicBlock.calleeIds` cell (resolved callee symbol
- * ids). A TAB is used — NOT a space — because resolved ids embed `filePath` and
- * C++ overload shape tags with multi-word primitive types (e.g. `unsigned char`,
- * `long double`), so an id can legitimately contain a space; a space-joined cell
- * then fragments on read and silently drops inter-procedural reach to that
- * callee (#2227 tri-review). A tab cannot appear in a tree-sitter-derived id
- * token (paths/identifiers/type tokens are tab-free) and round-trips intact
- * through `escapeCSVField` (tab is in its preserved set) and the RFC-4180 COPY
- * reader (every cell is quoted). Producer ({@link calleeIdsOfBlock}) and
- * consumer (`splitCalleeIds`) import this single constant so they cannot drift.
- * The sibling `callees` (leaf-name) cell stays space-joined — leaf names are
- * bare identifiers and never contain a space.
- */
-export declare const CALLEE_ID_SEP = "\t";
+export { CALLEES_TRUNCATED_SENTINEL, CALLEE_ID_SEP } from './callee-cell-format.js';
 /**
  * Default per-function CFG edge cap. A pathological generated function could
  * otherwise emit an unbounded edge set; the cap bounds graph growth and is

package/dist/core/ingestion/cfg/emit.js

@@ -6,31 +6,17 @@ import { augmentForPostDom } from './synthetic-escape.js';
 import { DEFAULT_PDG_MAX_SITES_PER_STATEMENT } from './visitors/call-site-harvest.js';
 import { calleeIdPosKey } from '../scope-resolution/graph-bridge/callee-id-sink.js';
 import { encodeReachingDefReasonPairs } from './reaching-def-reason-codec.js';
+import { CALLEES_TRUNCATED_SENTINEL, CALLEE_ID_SEP } from './callee-cell-format.js';
 /**
- * Reserved token placed in `BasicBlock.callees` when a statement's call sites
- * were truncated at {@link DEFAULT_PDG_MAX_SITES_PER_STATEMENT}: the recorded
- * callee list is then INCOMPLETE, so over-cap callees are absent. `*` is not a
- * valid identifier leaf, so it cannot collide with a real callee name. The
- * impact bridge treats a slice containing this sentinel as "callees unknown" and
- * keeps reach callgraph-equal (proven), rather than falsely labeling an
- * absent-but-real callee `unproven-bridge`.
+ * Cell-format constants live in the LEAF module `callee-cell-format.ts` and are
+ * re-exported here so every existing importer keeps working. The consumer side
+ * (`mcp/local/pdg-impact.ts`) imports them from the leaf directly: importing any
+ * binding from THIS module evaluates it, and with it the whole analyze-only CFG
+ * closure — 8 modules on every MCP server start to read two strings (#2802
+ * review). Producer and consumer still resolve to one definition, so the drift
+ * these shared constants exist to prevent stays impossible.
  */
-export const CALLEES_TRUNCATED_SENTINEL = '*';
-/**
- * Inner separator for the `BasicBlock.calleeIds` cell (resolved callee symbol
- * ids). A TAB is used — NOT a space — because resolved ids embed `filePath` and
- * C++ overload shape tags with multi-word primitive types (e.g. `unsigned char`,
- * `long double`), so an id can legitimately contain a space; a space-joined cell
- * then fragments on read and silently drops inter-procedural reach to that
- * callee (#2227 tri-review). A tab cannot appear in a tree-sitter-derived id
- * token (paths/identifiers/type tokens are tab-free) and round-trips intact
- * through `escapeCSVField` (tab is in its preserved set) and the RFC-4180 COPY
- * reader (every cell is quoted). Producer ({@link calleeIdsOfBlock}) and
- * consumer (`splitCalleeIds`) import this single constant so they cannot drift.
- * The sibling `callees` (leaf-name) cell stays space-joined — leaf names are
- * bare identifiers and never contain a space.
- */
-export const CALLEE_ID_SEP = '\t';
+export { CALLEES_TRUNCATED_SENTINEL, CALLEE_ID_SEP } from './callee-cell-format.js';
 /**
  * Default per-function CFG edge cap. A pathological generated function could
  * otherwise emit an unbounded edge set; the cap bounds graph growth and is

package/dist/core/ingestion/class-extractors/configs/go.js

@@ -2,15 +2,20 @@
 import { SupportedLanguages } from '../../../../_shared/index.js';
 export const goClassConfig = {
     language: SupportedLanguages.Go,
-    typeDeclarationNodes: ['type_declaration'],
+    // `type_spec`, not the enclosing `type_declaration` (#2837): one node per
+    // DECLARED TYPE, so a grouped `type ( A struct{…}; B struct{…} )` yields one
+    // each instead of one for the whole block. Every Go capture that reaches this
+    // extractor is anchored the same way, so the wrapper is never handed over —
+    // and accepting it would be worse than rejecting it, because picking one spec
+    // out of several with no reference point silently returns the FIRST type's
+    // name. A `null` here is loud; the wrong name is not.
+    typeDeclarationNodes: ['type_spec'],
     fileScopeNodeTypes: ['package_clause'],
     extractName(node) {
-        const typeSpec = node.namedChildren.find((child) => child.type === 'type_spec');
-        return typeSpec?.childForFieldName('name')?.text;
+        return node.childForFieldName('name')?.text;
     },
     extractType(node) {
-        const typeSpec = node.namedChildren.find((child) => child.type === 'type_spec');
-        const typeNode = typeSpec?.childForFieldName('type');
+        const typeNode = node.childForFieldName('type');
         if (typeNode?.type === 'struct_type')
             return 'Struct';
         if (typeNode?.type === 'interface_type')

package/dist/core/ingestion/class-extractors/configs/jvm.js

@@ -1,5 +1,6 @@
 // gitnexus/src/core/ingestion/class-extractors/configs/jvm.ts
 import { SupportedLanguages } from '../../../../_shared/index.js';
+import { synthesizeJavaTypeIdentity } from '../../utils/ast-helpers.js';
 // ---------------------------------------------------------------------------
 // Java
 // ---------------------------------------------------------------------------
@@ -10,6 +11,15 @@ export const javaClassConfig = {
         'interface_declaration',
         'enum_declaration',
         'record_declaration',
+        // Anonymous class bodies (`new Runnable() { ... }`) — the matching
+        // JAVA_QUERIES pattern only captures `object_creation_expression`
+        // WITH a `class_body`, and `extractName` below returns undefined for
+        // any other shape, so plain `new Foo()` constructor calls never
+        // produce a Class node (#2550).
+        'object_creation_expression',
+        // Enum constant bodies (`enum E { A { ... } }`) — javac's other
+        // anonymous shape, named E$N by the same authority (#2555).
+        'enum_constant',
     ],
     fileScopeNodeTypes: ['package_declaration'],
     ancestorScopeNodeTypes: [
@@ -18,6 +28,25 @@ export const javaClassConfig = {
         'enum_declaration',
         'record_declaration',
     ],
+    extractName(node) {
+        return synthesizeJavaTypeIdentity(node)?.name;
+    },
+    extractType(node) {
+        return synthesizeJavaTypeIdentity(node)?.label;
+    },
+    // An anonymous body whose name CANNOT be synthesized must not become a
+    // Class node at all. Without this skip, `extract()`'s
+    // `extractTypeNameFromNode` fallback fabricates a name — the CONSTRUCTED
+    // type for `new Runnable() { ... }` (phantom `Class:...:Runnable`,
+    // empirically caught in review) or the constant's own identifier for an
+    // `enum_constant` (`Class:...:A`).
+    shouldSkipClassCapture({ definitionNode }) {
+        return (definitionNode !== null &&
+            definitionNode !== undefined &&
+            (definitionNode.type === 'object_creation_expression' ||
+                definitionNode.type === 'enum_constant') &&
+            synthesizeJavaTypeIdentity(definitionNode) === undefined);
+    },
 };
 // ---------------------------------------------------------------------------
 // Kotlin