gitnexus 1.6.12-rc.2 → 1.6.12-rc.21

package/dist/core/ingestion/pipeline-phases/parse.d.ts

@@ -17,7 +17,7 @@
  */
 import type { PipelinePhase } from './types.js';
 import type { BindingAccumulator } from '../binding-accumulator.js';
-import type { ParsedFile } from '../../../_shared/index.js';
+import type { ParsedFile, SupportedLanguages } from '../../../_shared/index.js';
 import type { ExtractedFetchCall, ExtractedRoute, ExtractedDecoratorRoute, ExtractedToolDef, ExtractedORMQuery, FetchWrapperDef } from '../workers/parse-worker.js';
 import type { MutableSemanticModel } from '../model/index.js';
 import type { ModuleConstants } from '../route-extractors/constant-resolver.js';
@@ -71,6 +71,12 @@ export interface ParseOutput {
      * costing ~58s on a 1000-file repo).
      */
     readonly parsedFiles: readonly ParsedFile[];
+    /**
+     * Content-derived language decisions for files such as `.h` whose extension
+     * is ambiguous. Scope resolution reuses this result rather than rereading
+     * source solely to classify it.
+     */
+    readonly contentLanguageByPath: ReadonlyMap<string, SupportedLanguages | null>;
     /**
      * Repo-wide string constants harvested by the providers that declare
      * `extractModuleConstants`, keyed by file path and already through each

package/dist/core/ingestion/scope-extractor.js

@@ -625,6 +625,10 @@ function normalizeNodeLabel(kindStr) {
     switch (kindStr.toLowerCase()) {
         case 'class':
             return 'Class';
+        case 'protocol':
+            return 'Protocol';
+        case 'category':
+            return 'Category';
         case 'interface':
             return 'Interface';
         case 'enum':

package/dist/core/ingestion/scope-resolution/contract/scope-resolver.d.ts

@@ -615,6 +615,19 @@ export interface ScopeResolver {
     readonly populateWorkspaceOwners?: (parsedFiles: readonly ParsedFile[], ctx: {
         readonly fileContents: ReadonlyMap<string, string>;
     }) => void;
+    /**
+     * Optional workspace-wide enrichment of extracted reference sites. Runs
+     * after all files have been extracted and before reference finalization.
+     * Use this when a per-file capture needs conservative facts from an
+     * imported sibling (for example a compile-time branch constant).
+     */
+    readonly populateWorkspaceReferences?: (parsedFiles: ParsedFile[], ctx: {
+        readonly fileContents: ReadonlyMap<string, string>;
+        readonly treeCache?: {
+            get(filePath: string): unknown;
+        };
+        readonly resolutionConfig?: unknown;
+    }) => void;
     /**
      * Recognize a `super(...)`-style receiver text. Python returns
      * `/^super\s*\(/.test(t)`. Java returns `t === 'super'`. C++ may

package/dist/core/ingestion/scope-resolution/graph-bridge/ids.js

@@ -56,6 +56,8 @@ export const CALLER_ANCHOR_LABELS = new Set([
     'Constructor',
     'Module',
     'Class',
+    'Protocol',
+    'Category',
     'Interface',
     'Struct',
     'Enum',

package/dist/core/ingestion/scope-resolution/graph-bridge/node-lookup.js

@@ -238,6 +238,8 @@ export const LINKABLE_LABELS = new Set([
     // targets and need the same def→graph bridge.
     'Module',
     'Class',
+    'Protocol',
+    'Category',
     'Interface',
     'Struct',
     'Enum',

package/dist/core/ingestion/scope-resolution/passes/property-dispatch.d.ts

@@ -17,9 +17,11 @@
  * registries only consult pre-finalize local bindings — imported names live
  * in finalized bindings (the same reason free calls need
  * `emitFreeCallFallback`) — so `resolveReferenceSites` skips `value-ref`
- * sites and this pass resolves them post-finalize via
- * `findCallableBindingInScope` (Function/Method/Constructor only — the
- * callable gate that keeps `{ port: DEFAULT_PORT }` from emitting anything).
+ * sites and this pass resolves them post-finalize (see
+ * `resolveValueRefTarget` — Function/Method/Constructor only, the callable
+ * gate that keeps `{ port: DEFAULT_PORT }` from emitting anything, and
+ * receiver-aware so a qualified reference binds the owner it was written
+ * with).
  *
  * Precision posture (mirrors `emitInterfaceDispatchFor`):
  *   - reason `'property-dispatch'` keeps synthesized CALLS auditable;
@@ -35,11 +37,12 @@
  * Language-neutral: consumes only `value-ref` sites (any language that
  * emits the capture participates) and generic member-call sites.
  */
-import type { ParsedFile } from '../../../../_shared/index.js';
+import type { ParsedFile, ReferenceSite, SymbolDefinition } from '../../../../_shared/index.js';
 import type { KnowledgeGraph } from '../../../graph/types.js';
 import type { ScopeResolutionIndexes } from '../../model/scope-resolution-indexes.js';
 import type { GraphNodeLookup } from '../graph-bridge/node-lookup.js';
 import type { CalleeIdSink } from '../graph-bridge/callee-id-sink.js';
+import type { SemanticModel } from '../../model/semantic-model.js';
 /**
  * Keys registered by more than this many distinct functions are skipped —
  * dispatch through such a name says nothing about which function runs.
@@ -56,7 +59,77 @@ import type { CalleeIdSink } from '../graph-bridge/callee-id-sink.js';
 export declare const MAX_PROPERTY_DISPATCH_FANOUT: number;
 /** Below the 0.85 resolved baseline; same discount idea as interface-dispatch. */
 export declare const PROPERTY_DISPATCH_CONFIDENCE = 0.7;
-export declare function emitPropertyDispatchCalls(graph: KnowledgeGraph, scopes: ScopeResolutionIndexes, parsedFiles: readonly ParsedFile[], nodeLookup: GraphNodeLookup, calleeIdSink?: CalleeIdSink): {
+/**
+ * Resolve a `value-ref` site to the callable it names.
+ *
+ * Two shapes, and the difference matters:
+ *
+ *   - BARE (`{ handler: onClick }`, `register(onTick)`) — the name is resolved
+ *     up the lexical chain, which is what an unqualified name means. Be exact
+ *     about what that walk does, because it is not a plain lexical lookup:
+ *     `findCallableBindingInScope` applies the callable predicate WHILE walking,
+ *     so a scope binding the name to a parameter or a local contributes nothing
+ *     and the walk continues outward. A nearer non-callable binding is stepped
+ *     over — the same shape the qualified path guards against below, unguarded
+ *     here. Pre-existing (#2437) and out of scope for #3399; reachable in JS/TS
+ *     (`function outer(handler) { return { h: handler }; }` beside a top-level
+ *     `function handler`), and narrow in Zig, which rejects a local shadowing a
+ *     container declaration.
+ *
+ *   - QUALIFIED (`bridge.accessor(Element.getNamespaceUri, …)`) — the source
+ *     WROTE the owner, so the lexical chain is the wrong instrument. It gives
+ *     local bindings precedence (`walkScopeChain`), so a nested container
+ *     holding its own `getNamespaceUri` answers first and the registration is
+ *     attached to a DIFFERENT function than the one written. That is a wrong
+ *     edge, not a missing one — strictly worse for a tool whose value is that
+ *     its edges can be trusted — and it is reachable in any language that
+ *     allows a same-named callable in a nested container, Zig included.
+ *
+ * So a qualified site resolves through its receiver: name the owner, then take
+ * the member off that owner. An owner is either a MODULE or a CLASS-like
+ * container — `utils.compare` and `Element.getNamespaceUri` are the same shape
+ * written against the two kinds of namespace a language has, and the member-call
+ * path already resolves both (receiver-bound-calls Case 1 / Case 2). Both are
+ * tried here, MODULE FIRST: see `findNamespaceValueRefTarget` for why a module
+ * receiver cannot simply be declined, and the comment on the call below for why
+ * the container channel must not go first.
+ *
+ * If neither channel names the owner, or the owner is named but owns no such
+ * callable, this DECLINES rather than falling back to the lexical walk.
+ *
+ * Be precise about what declining costs, because it is more than one reference:
+ * a site that emits NO edge leaves no evidence for `impact`'s value-reference
+ * probe to read, so the target keeps `epistemic: "exact"` — silence, not a
+ * hedge. That is why the module channel above exists rather than being waved
+ * through as "just a decline". What remains declined is the case where the
+ * written receiver names nothing this index knows at all (a Zig `@This()` alias
+ * whose name differs from its container's, an owner from outside the workspace):
+ * there the alternative is not a hedge either, it is a confident edge to a
+ * lexically-nearer function that the source did not name, and a wrong edge is
+ * strictly worse than a missing one for a tool whose value is that its edges can
+ * be trusted.
+ *
+ * `CALL_TARGET_TYPES`, not a hand-rolled label set: `findOwnedMember` also
+ * answers with FIELDS, and a field named like the member would otherwise
+ * register as if it were the callable.
+ *
+ * Exported for `bench/value-ref-resolution/measure.mjs`, which gates both the
+ * resolved-target SET and the per-site cost of the four channels above across a
+ * 4x file-count step. It is the per-site half of the pass, so timing it in
+ * isolation is what makes a workspace-size dependency visible; timing
+ * `emitPropertyDispatchCalls` would fold that signal into edge emission, and
+ * re-implementing the channel order in the bench would pin the bench's idea of
+ * this function rather than this function.
+ */
+export declare function resolveValueRefTarget(site: ReferenceSite, filePath: string, scopes: ScopeResolutionIndexes, model: SemanticModel, publishesImportedNames: boolean): SymbolDefinition | undefined;
+export declare function emitPropertyDispatchCalls(graph: KnowledgeGraph, scopes: ScopeResolutionIndexes, parsedFiles: readonly ParsedFile[], nodeLookup: GraphNodeLookup, model: SemanticModel, calleeIdSink?: CalleeIdSink, 
+/**
+ * `ScopeResolver.namespaceExportsIncludeImportedNames`, forwarded rather than
+ * re-derived. The pass names no language; it asks the provider the same
+ * question `receiver-bound-calls` asks before resolving a namespace member,
+ * so the CALL and the REGISTRATION forms of `hub.fn` cannot disagree.
+ */
+publishesImportedNames?: boolean): {
     usesEmitted: number;
     callsEmitted: number;
     skippedKeys: number;

package/dist/core/ingestion/scope-resolution/passes/property-dispatch.js

@@ -17,9 +17,11 @@
  * registries only consult pre-finalize local bindings — imported names live
  * in finalized bindings (the same reason free calls need
  * `emitFreeCallFallback`) — so `resolveReferenceSites` skips `value-ref`
- * sites and this pass resolves them post-finalize via
- * `findCallableBindingInScope` (Function/Method/Constructor only — the
- * callable gate that keeps `{ port: DEFAULT_PORT }` from emitting anything).
+ * sites and this pass resolves them post-finalize (see
+ * `resolveValueRefTarget` — Function/Method/Constructor only, the callable
+ * gate that keeps `{ port: DEFAULT_PORT }` from emitting anything, and
+ * receiver-aware so a qualified reference binds the owner it was written
+ * with).
  *
  * Precision posture (mirrors `emitInterfaceDispatchFor`):
  *   - reason `'property-dispatch'` keeps synthesized CALLS auditable;
@@ -36,7 +38,9 @@
  * emits the capture participates) and generic member-call sites.
  */
 import { tryEmitEdge } from '../graph-bridge/edges.js';
-import { findCallableBindingInScope } from '../scope/walkers.js';
+import { findCallableBindingInScope, findClassBindingInScope, findOwnedMember, isNamespaceNameShadowed, isOwnerNameShadowedBySomethingElse, lookupBindingsAt, } from '../scope/walkers.js';
+import { VALUE_REF_EDGE_REASON } from '../value-ref-edges.js';
+import { CALL_TARGET_TYPES } from '../../model/symbol-table.js';
 /**
  * Keys registered by more than this many distinct functions are skipped —
  * dispatch through such a name says nothing about which function runs.
@@ -56,7 +60,258 @@ export const MAX_PROPERTY_DISPATCH_FANOUT = (() => {
 })();
 /** Below the 0.85 resolved baseline; same discount idea as interface-dispatch. */
 export const PROPERTY_DISPATCH_CONFIDENCE = 0.7;
-export function emitPropertyDispatchCalls(graph, scopes, parsedFiles, nodeLookup, calleeIdSink) {
+/**
+ * Resolve a `value-ref` site to the callable it names.
+ *
+ * Two shapes, and the difference matters:
+ *
+ *   - BARE (`{ handler: onClick }`, `register(onTick)`) — the name is resolved
+ *     up the lexical chain, which is what an unqualified name means. Be exact
+ *     about what that walk does, because it is not a plain lexical lookup:
+ *     `findCallableBindingInScope` applies the callable predicate WHILE walking,
+ *     so a scope binding the name to a parameter or a local contributes nothing
+ *     and the walk continues outward. A nearer non-callable binding is stepped
+ *     over — the same shape the qualified path guards against below, unguarded
+ *     here. Pre-existing (#2437) and out of scope for #3399; reachable in JS/TS
+ *     (`function outer(handler) { return { h: handler }; }` beside a top-level
+ *     `function handler`), and narrow in Zig, which rejects a local shadowing a
+ *     container declaration.
+ *
+ *   - QUALIFIED (`bridge.accessor(Element.getNamespaceUri, …)`) — the source
+ *     WROTE the owner, so the lexical chain is the wrong instrument. It gives
+ *     local bindings precedence (`walkScopeChain`), so a nested container
+ *     holding its own `getNamespaceUri` answers first and the registration is
+ *     attached to a DIFFERENT function than the one written. That is a wrong
+ *     edge, not a missing one — strictly worse for a tool whose value is that
+ *     its edges can be trusted — and it is reachable in any language that
+ *     allows a same-named callable in a nested container, Zig included.
+ *
+ * So a qualified site resolves through its receiver: name the owner, then take
+ * the member off that owner. An owner is either a MODULE or a CLASS-like
+ * container — `utils.compare` and `Element.getNamespaceUri` are the same shape
+ * written against the two kinds of namespace a language has, and the member-call
+ * path already resolves both (receiver-bound-calls Case 1 / Case 2). Both are
+ * tried here, MODULE FIRST: see `findNamespaceValueRefTarget` for why a module
+ * receiver cannot simply be declined, and the comment on the call below for why
+ * the container channel must not go first.
+ *
+ * If neither channel names the owner, or the owner is named but owns no such
+ * callable, this DECLINES rather than falling back to the lexical walk.
+ *
+ * Be precise about what declining costs, because it is more than one reference:
+ * a site that emits NO edge leaves no evidence for `impact`'s value-reference
+ * probe to read, so the target keeps `epistemic: "exact"` — silence, not a
+ * hedge. That is why the module channel above exists rather than being waved
+ * through as "just a decline". What remains declined is the case where the
+ * written receiver names nothing this index knows at all (a Zig `@This()` alias
+ * whose name differs from its container's, an owner from outside the workspace):
+ * there the alternative is not a hedge either, it is a confident edge to a
+ * lexically-nearer function that the source did not name, and a wrong edge is
+ * strictly worse than a missing one for a tool whose value is that its edges can
+ * be trusted.
+ *
+ * `CALL_TARGET_TYPES`, not a hand-rolled label set: `findOwnedMember` also
+ * answers with FIELDS, and a field named like the member would otherwise
+ * register as if it were the callable.
+ *
+ * Exported for `bench/value-ref-resolution/measure.mjs`, which gates both the
+ * resolved-target SET and the per-site cost of the four channels above across a
+ * 4x file-count step. It is the per-site half of the pass, so timing it in
+ * isolation is what makes a workspace-size dependency visible; timing
+ * `emitPropertyDispatchCalls` would fold that signal into edge emission, and
+ * re-implementing the channel order in the bench would pin the bench's idea of
+ * this function rather than this function.
+ */
+export function resolveValueRefTarget(site, filePath, scopes, model, publishesImportedNames) {
+    const receiverName = site.explicitReceiver?.name;
+    if (receiverName === undefined) {
+        return findCallableBindingInScope(site.inScope, site.name, scopes);
+    }
+    // NAMESPACE FIRST, and the order is load-bearing. `findClassBindingInScope`
+    // does not stop at the scope chain: when its `isClassLike` walk misses — and a
+    // namespace handle binds a Module, so it always misses — it falls back to
+    // `scopes.qualifiedNames`, a WORKSPACE-wide index, and answers with the unique
+    // def of that name anywhere in the repo. Trying it first therefore lets a
+    // same-named container in a file this one never imported preempt the `@import`
+    // this file actually wrote:
+    //
+    //     const dom_utils = @import("dom_utils.zig");   // namespace-only module
+    //     … bridge.accessor(dom_utils.compare, …)       // → decoy.zig's compare
+    //
+    // The shadow guard below cannot catch it: the import binds at MODULE scope,
+    // which the guard treats as the floor. An import written in this file is the
+    // strongest statement about what the name means here, so it outranks a global
+    // guess — and when the handle is not an import of this file, this answers
+    // nothing and the container channel runs exactly as before.
+    const viaNamespace = findNamespaceValueRefTarget(site, filePath, receiverName, scopes, publishesImportedNames);
+    if (viaNamespace !== undefined) {
+        // `'owned'` is NOT "no answer" — it is "this receiver is a namespace handle
+        // this file wrote, and it names no callable member". The two must not be
+        // conflated, because falling through from the second one reaches
+        // `findClassBindingInScope`, whose miss path answers from the WORKSPACE-wide
+        // qualified-name index: a same-named container in a file this one never
+        // imported then supplies the member the written module does not have. That
+        // is a confident edge into an unrelated file, and the owner-shadow guard
+        // below does not stop it — a plain `const utils = @import("utils.zig");`
+        // records a namespace IMPORT EDGE, not a module-scope binding, so the guard
+        // sees nothing bound under the name and reads the container as unshadowed.
+        // Verified with a fixture rather than argued: `dom_utils.onlyOnDecoy`, where
+        // `dom_utils.zig` has no such member and `decoy.zig` declares a same-named
+        // struct that does, minted `JsApi → onlyOnDecoy` before this line existed.
+        //
+        // The file said which module it meant. If that module does not expose the
+        // name as a callable, the honest answer is no edge.
+        return viaNamespace === 'owned' ? undefined : viaNamespace;
+    }
+    const owner = findClassBindingInScope(site.inScope, receiverName, scopes);
+    if (owner !== undefined) {
+        // The container lookup is a CLASS-ONLY walk: `walkScopeChain` filters by
+        // `isClassLike`, so it steps over a nearer binding that is a value and keeps
+        // climbing — and past the scope chain entirely, into a qualified-name
+        // fallback that answers with the unique workspace definition of the name.
+        // `fn f(Ticker: u8) { register(Ticker.fire) }` in a file that neither
+        // declares nor imports `Ticker` therefore resolves to some other file's
+        // `Ticker` container. That is the wrong-edge failure R1-2 exists to prevent,
+        // arriving through the class channel instead of the lexical one, and a
+        // registration pointing at a function the source never named is worse than
+        // no registration at all.
+        //
+        // So the name has to still MEAN that container at this site. The namespace
+        // channel below asks the same question through `isNamespaceNameShadowed`;
+        // a container needs the variant that exempts the container ITSELF, because
+        // `fn make() { const Local = struct {…}; register(Local.go); }` binds the
+        // name locally to the very def we resolved, and reading that as its own
+        // shadow would suppress the resolutions this path exists to make.
+        if (isOwnerNameShadowedBySomethingElse(receiverName, owner, site.inScope, scopes))
+            return undefined;
+        const member = findOwnedMember(owner.nodeId, site.name, model);
+        if (member === undefined || !CALL_TARGET_TYPES.has(member.type))
+            return undefined;
+        return member;
+    }
+    return undefined;
+}
+/**
+ * The second kind of owner: a namespace handle.
+ *
+ * `const utils = @import("utils.zig"); register(utils.compare);` — `utils` is a
+ * MODULE, not a class, so `findClassBindingInScope` answers nothing and the
+ * class path above declines. Declining here would be a silent hole rather than
+ * a conservative one: no USES edge is emitted, so
+ * `callableValueReferenceBoundaries` measures a real zero and `impact` on
+ * `compare` republishes `exact` — the very claim this feature exists to stop
+ * making. Nothing downstream can hedge on evidence that was never recorded.
+ *
+ * So resolve it, through the SAME channel the member-CALL path already trusts
+ * for `utils.compare()` (receiver-bound-calls Case 1): the file's namespace
+ * import edges name the target module, and the target module's own local
+ * module-scope bindings name its members. `utils.compare` and `utils.compare()`
+ * disagreeing about what `utils` is would be the anomaly.
+ *
+ * The same three guards Case 1 applies, for the same reasons:
+ *   - a LOCAL declaration shadowing the handle suppresses the resolution
+ *     (`isNamespaceNameShadowed`) — `fn f(utils: Decoy) { register(utils.compare) }`
+ *     names the parameter's member, and resolving through the import would be a
+ *     wrong edge rather than a missing one;
+ *   - a locally declared member wins, and a name the target file merely IMPORTED
+ *     counts only when the provider says its imports ARE its exports
+ *     (`ScopeResolver.namespaceExportsIncludeImportedNames`). That opt-in is not
+ *     a detail to skip: a Zig HUB — a file made only of re-exports, ghostty's
+ *     `src/terminal/`, tigerbeetle's `stdx` — declares nothing, so requiring a
+ *     local declaration declines every member reached through one. `hub.fn()`
+ *     resolves and `register(hub.fn)` would not, and one name would mean two
+ *     things depending on whether a `(` followed it. In languages that do not
+ *     opt in, a module's imports are not its exports and this stays closed;
+ *   - two distinct defs under one name resolve NOTHING. Never guess a namespace
+ *     member — the whole point of reading the written receiver is precision.
+ *
+ * `CALL_TARGET_TYPES` gates the answer for the same reason the class path needs
+ * it: `utils.DEFAULT_PORT` is a module-scope binding too, and a registration
+ * table full of constants must keep emitting nothing.
+ */
+function findNamespaceValueRefTarget(site, filePath, receiverName, scopes, publishesImportedNames) {
+    const moduleScopeId = scopes.moduleScopes.get(filePath);
+    if (moduleScopeId === undefined)
+        return undefined;
+    const targetFiles = [];
+    for (const edge of scopes.imports.get(moduleScopeId) ?? []) {
+        if (edge.kind !== 'namespace' || edge.localName !== receiverName)
+            continue;
+        if (edge.targetFile === null)
+            continue;
+        if (!targetFiles.includes(edge.targetFile))
+            targetFiles.push(edge.targetFile);
+    }
+    if (targetFiles.length === 0)
+        return undefined;
+    if (isNamespaceNameShadowed(receiverName, site.inScope, scopes))
+        return undefined;
+    /** The unique callable `select` finds across every target file, or nothing. */
+    const uniqueMember = (select) => {
+        let picked;
+        for (const targetFile of targetFiles) {
+            const targetScopeId = scopes.moduleScopes.get(targetFile);
+            if (targetScopeId === undefined)
+                continue;
+            for (const ref of select(targetScopeId)) {
+                if (!CALL_TARGET_TYPES.has(ref.def.type))
+                    continue;
+                if (picked !== undefined && picked.nodeId !== ref.def.nodeId)
+                    return 'ambiguous';
+                picked = ref.def;
+            }
+        }
+        return picked;
+    };
+    // A locally declared member first — same precedence `findExportedDef` states
+    // and `walkScopeChain` applies: what the target file DECLARED beats what it
+    // merely re-published.
+    const localRefs = (scope) => (scopes.bindings.get(scope)?.get(site.name) ?? []).filter((ref) => ref.origin === 'local');
+    const local = uniqueMember(localRefs);
+    if (local === 'ambiguous')
+        return 'owned';
+    if (local !== undefined)
+        return local;
+    if (!publishesImportedNames)
+        return 'owned';
+    // PRECEDENCE IS DECIDED BEFORE THE TYPE GATE, not by it. `uniqueMember`
+    // applies `CALL_TARGET_TYPES` while it selects, so a target file declaring a
+    // NON-callable under this name answers `undefined` above and would otherwise
+    // fall through to the published channel — publishing a re-exported callable
+    // under a name the module's own declaration owns. `findExportedDef` does not
+    // do that: it returns any local def it finds and lets its caller's type gate
+    // reject it, so `findExportedDefIncludingImportedNames` never reaches the
+    // imported names for a name the file declares. Same rule here, so `x.f` and
+    // `x.f()` cannot disagree about which module owns the name.
+    //
+    // Not reachable through valid Zig today — a container cannot declare a name
+    // twice, so one target file cannot hold both spellings, and Zig is the only
+    // provider that sets `namespaceExportsIncludeImportedNames`. It becomes
+    // reachable the moment a second provider opts in, or a receiver binds more
+    // than one target file; the guard is one `some` and the alternative failure
+    // is a confident edge into the wrong module.
+    const declaredLocally = targetFiles.some((targetFile) => {
+        const targetScopeId = scopes.moduleScopes.get(targetFile);
+        return targetScopeId !== undefined && localRefs(targetScopeId).length > 0;
+    });
+    if (declaredLocally)
+        return 'owned';
+    // Then a name the target file publishes but did not declare — the hub case.
+    // `lookupBindingsAt`, not `scopes.bindings`, because a hub's module scope owns
+    // no local binding for these names and the finalized/augmented channel is the
+    // only place they exist; the same read `findExportedDefIncludingImportedNames`
+    // does for the CALL form.
+    const published = uniqueMember((scope) => lookupBindingsAt(scope, site.name, scopes).filter((ref) => ref.origin === 'import' || ref.origin === 'namespace' || ref.origin === 'reexport'));
+    return published === 'ambiguous' || published === undefined ? 'owned' : published;
+}
+export function emitPropertyDispatchCalls(graph, scopes, parsedFiles, nodeLookup, model, calleeIdSink, 
+/**
+ * `ScopeResolver.namespaceExportsIncludeImportedNames`, forwarded rather than
+ * re-derived. The pass names no language; it asks the provider the same
+ * question `receiver-bound-calls` asks before resolving a namespace member,
+ * so the CALL and the REGISTRATION forms of `hub.fn` cannot disagree.
+ */
+publishesImportedNames = false) {
     const seen = new Set();
     let usesEmitted = 0;
     // Sweep 1 — resolve every value-ref site: emit the USES registration edge
@@ -66,10 +321,10 @@ export function emitPropertyDispatchCalls(graph, scopes, parsedFiles, nodeLookup
         for (const site of parsed.referenceSites) {
             if (site.kind !== 'value-ref')
                 continue;
-            const def = findCallableBindingInScope(site.inScope, site.name, scopes);
+            const def = resolveValueRefTarget(site, parsed.filePath, scopes, model, publishesImportedNames);
             if (def === undefined)
                 continue;
-            const ok = tryEmitEdge(graph, scopes, nodeLookup, site, def, 'scope-resolution: value-ref', seen);
+            const ok = tryEmitEdge(graph, scopes, nodeLookup, site, def, VALUE_REF_EDGE_REASON, seen);
             if (ok)
                 usesEmitted++;
             if (site.propertyKey === undefined)

package/dist/core/ingestion/scope-resolution/pipeline/phase.js

@@ -55,6 +55,7 @@ const NOOP_OUTPUT = Object.freeze({
 /** Select source files that must be materialized for one resolver pass. */
 export function selectScopeSourcePathsToRead(provider, primaryFilePaths, preExtractedByPath) {
     const hasPostExtractHooks = provider.populateWorkspaceOwners !== undefined ||
+        provider.populateWorkspaceReferences !== undefined ||
         provider.populateNamespaceSiblings !== undefined ||
         provider.populateRangeBindings !== undefined ||
         provider.emitPostResolutionEdges !== undefined;
@@ -80,7 +81,7 @@ export const scopeResolutionPhase = {
         logHeapProbe('scopeResolution-enter');
         const { scannedFiles } = getPhaseOutput(deps, 'structure');
         const parseOutput = getPhaseOutput(deps, 'parse');
-        const { model, parsedFiles: workerParsedFiles } = parseOutput;
+        const { model, parsedFiles: workerParsedFiles, contentLanguageByPath } = parseOutput;
         const scopeExtractionFailures = new Set(parseOutput.scopeExtractionFailures);
         // SemanticModel populated during `parse`: scope-resolution consumes
         // TypeRegistry / MethodRegistry / SymbolTable lookups instead of
@@ -146,7 +147,9 @@ export const scopeResolutionPhase = {
         // Language-agnostic: keyed by the provider-supplied SupportedLanguages value.
         const filesByLang = new Map();
         for (const f of scannedFiles) {
-            const fileLang = getLanguageFromFilename(f.path);
+            const fileLang = contentLanguageByPath.has(f.path)
+                ? (contentLanguageByPath.get(f.path) ?? null)
+                : getLanguageFromFilename(f.path);
             if (fileLang === null)
                 continue;
             // Tree-sitter providers require an available grammar. Standalone regex

package/dist/core/ingestion/scope-resolution/pipeline/registry.js

@@ -26,6 +26,7 @@ import { swiftScopeResolver } from '../../languages/swift/scope-resolver.js';
 import { dartScopeResolver } from '../../languages/dart/scope-resolver.js';
 import { vueScopeResolver } from '../../languages/vue/scope-resolver.js';
 import { zigScopeResolver } from '../../languages/zig/scope-resolver.js';
+import { objectiveCScopeResolver } from '../../languages/objective-c/scope-resolver.js';
 /** Map of `SupportedLanguages` → `ScopeResolver`. The scope-resolution phase
  *  iterates this map directly — every registered resolver runs. This is the
  *  single source of truth for which languages resolve via scope-resolution. */
@@ -47,4 +48,5 @@ export const SCOPE_RESOLVERS = new Map([
     [SupportedLanguages.Dart, dartScopeResolver],
     [SupportedLanguages.Vue, vueScopeResolver],
     [SupportedLanguages.Zig, zigScopeResolver],
+    [SupportedLanguages.ObjectiveC, objectiveCScopeResolver],
 ]);

package/dist/core/ingestion/scope-resolution/pipeline/run.js

@@ -312,6 +312,11 @@ export function runScopeResolution(input, provider) {
     }
     logHeapProbe('sr-extract-end', `lang=${provider.language} parsedFiles=${parsedFiles.length} preExtractedHits=${preExtractedHits} skipped=${filesSkipped}`);
     provider.populateWorkspaceOwners?.(parsedFiles, { fileContents: getFileContents() });
+    provider.populateWorkspaceReferences?.(parsedFiles, {
+        fileContents: getFileContents(),
+        treeCache,
+        resolutionConfig: input.resolutionConfig,
+    });
     // A callable-flow-only provider has no reason to build the whole-graph
     // lookup or finalize ordinary references when none of its files emitted a
     // callable fact. This keeps the opt-in path proportional to source scanning
@@ -760,7 +765,11 @@ export function runScopeResolution(input, provider) {
     // edges already emitted for a site retain ownership.
     const propertyDispatch = callableFlowOnly
         ? { usesEmitted: 0, callsEmitted: 0, skippedKeys: 0, skippedKeyNames: [] }
-        : emitPropertyDispatchCalls(graph, indexes, emitParsedFiles, postHeritageNodeLookup, calleeIdAccumulator);
+        : emitPropertyDispatchCalls(graph, indexes, emitParsedFiles, postHeritageNodeLookup, readonlyModel, calleeIdAccumulator, 
+        // Same provider hook the receiver-bound pass consults for a namespace
+        // member (Case 1). Without it a hub module's re-exported callable
+        // resolves when CALLED and declines when REGISTERED.
+        provider.namespaceExportsIncludeImportedNames === true);
     if (propertyDispatch.skippedKeys > 0) {
         // Never drop dispatch coverage silently: a hook table larger than the
         // fan-out cap means member calls through those keys get no synthesized

package/dist/core/ingestion/scope-resolution/scope/walkers.d.ts

@@ -176,6 +176,41 @@ export declare function isReceiverOwnedButUnbound(startScope: ScopeId, receiverN
  * this walk wants.
  */
 export declare function isNamespaceNameShadowed(namespaceName: string, inScope: ScopeId, scopes: ScopeResolutionIndexes): boolean;
+/**
+ * Does something between `inScope` and its module scope bind `name` to
+ * ANYTHING other than `def`?
+ *
+ * `isNamespaceNameShadowed` asks the same question for a namespace handle,
+ * where any local binding of the name is by definition not the import. A
+ * CONTAINER receiver needs the extra clause: the container may itself be the
+ * local declaration (`fn make() { const Local = struct {…}; … Local.go … }`),
+ * and reading that as its own shadow would suppress exactly the resolutions it
+ * is meant to permit — the #2723 mistake, one channel over.
+ *
+ * So a scope that binds the name answers immediately, and the answer is "not
+ * shadowed" only when one of that scope's bindings IS `def`. A name bound in a
+ * nearer scope to something else — a parameter, a local, a type binding — wins
+ * the lexical race, which is the whole point: `findClassBindingInScope` filters
+ * the chain by `isClassLike` and therefore cannot see that it lost it.
+ *
+ * The MODULE scope is inspected too, unlike `isNamespaceNameShadowed`, and the
+ * exemption is what makes that safe. That guard stops one rung short because a
+ * namespace import writes its own name into the module scope and would read as
+ * its own shadow (#2723); here the owner is compared by identity, so the binding
+ * that IS the owner exempts itself and only a binding to something ELSE answers
+ * `true`. Stopping short would leave the exact hole this walk exists to close:
+ * `findClassBindingInScope` steps over a module-scope binding that is not
+ * class-like and then answers from a WORKSPACE-wide qualified-name index, so
+ * `const Gauge = @import("other.zig").SOME_CONST;` in a file that never imports
+ * `Gauge.zig` would still resolve `Gauge.read` to that file's container.
+ * `lookupBindingsAt` is used at that scope and only there, because an imported
+ * alias lives in the finalized channel rather than in `scope.bindings`.
+ *
+ * Fail-closed like its sibling: a missing scope or a parent cycle answers
+ * `true`, because suppressing a resolution costs a missing edge while trusting a
+ * corrupt chain costs a wrong one.
+ */
+export declare function isOwnerNameShadowedBySomethingElse(name: string, def: SymbolDefinition, inScope: ScopeId, scopes: ScopeResolutionIndexes): boolean;
 export declare function findReceiverTypeBinding(startScope: ScopeId, receiverName: string, scopes: ScopeResolutionIndexes): TypeRef | undefined;
 /**
  * Resolve a typeBinding for `name` from the per-namespace channel
@@ -195,9 +230,10 @@ export declare function moduleScopeIdOf(startScope: ScopeId, scopes: ScopeResolu
 /**
  * Look up a class-like binding by name in the given scope's chain.
  *
- * "Class-like" covers `Class | Interface | Struct | Record | Enum |
- * Trait` via the shared `isClassLike` predicate — every kind that
- * collapses to `@scope.class` in the scope-extractor query contract.
+ * "Class-like" covers `Class | Interface | Struct | Record | Enum | Trait |
+ * Protocol | Category` via the shared `isClassLike` predicate. Objective-C
+ * protocol and category definitions are graph-side containers rather than
+ * `@scope.class` captures.
  *
  * Walks the scope chain upward and consults TWO sources at each step:
  *   1. `scope.bindings` — populated during scope-extraction Pass 2 with