gitnexus 1.6.8-rc.31 → 1.6.8-rc.32

package/dist/_shared/graph/types.d.ts

@@ -79,7 +79,21 @@ export type RelationshipType = 'CONTAINS' | 'CALLS' | 'INHERITS' | 'METHOD_OVERR
  | 'SANITIZES'
 /** Materialized source→sink taint path. Working name — final name/representation
  *  is confirmed when M3/M4 emits it; no persisted edge exists before then. */
- | 'TAINT_PATH';
+ | 'TAINT_PATH'
+/** Control-dependence edge (PDG, issue #2085 M5): block `dependent` (target)
+ *  executes only because the branch at block `controller` (source) took a
+ *  given side. The branch sense (`'T'` | `'F'`) rides the relation's existing
+ *  `reason` column — mirroring how `CFG` stores its edge kind there — since
+ *  the single `CodeRelation` table has no dedicated label column. */
+ | 'CDG'
+/** Debug-only post-dominator-tree edge (#2085 M5): a block → its immediate
+ *  post-dominator, emitted behind the `GITNEXUS_PDG_EMIT_POST_DOMINATE` env
+ *  flag for inspection. Never emitted in a normal `--pdg` run. Note: as a
+ *  member of this exported union it is a forward-compatibility commitment —
+ *  removing it later is a breaking schema change — and it is deliberately
+ *  excluded from `VALID_RELATION_TYPES` so it never enters impact-style
+ *  symbol-space traversal (same posture as the taint substrate edges). */
+ | 'POST_DOMINATE';
 export interface GraphNode {
     id: string;
     label: NodeLabel;

package/dist/_shared/graph/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/graph/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,MAAM,MAAM,SAAS,GACjB,SAAS,GACT,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,MAAM,GACN,OAAO,GACP,UAAU,GACV,QAAQ,GACR,UAAU,GACV,WAAW,GACX,MAAM,GACN,WAAW,GACX,QAAQ,GACR,MAAM,GACN,aAAa,GACb,WAAW,GACX,SAAS,GAET,QAAQ,GACR,OAAO,GACP,SAAS,GACT,OAAO,GACP,WAAW,GACX,OAAO,GACP,MAAM,GACN,WAAW,GACX,OAAO,GACP,QAAQ,GACR,UAAU,GACV,QAAQ,GACR,UAAU,GACV,YAAY,GACZ,aAAa,GACb,UAAU,GACV,SAAS,GACT,OAAO,GACP,MAAM,GAGN,YAAY,CAAC;AAEjB,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC;IACvC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;IAEjC,WAAW,CAAC,EAAE,iBAAiB,GAAG,iBAAiB,CAAC;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAEtB,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GACxB,UAAU,GACV,OAAO,GACP,UAAU,GACV,kBAAkB,GAClB,mBAAmB,GACnB,SAAS,GACT,MAAM,GACN,SAAS,GACT,WAAW,GACX,YAAY,GACZ,SAAS,GACT,YAAY,GACZ,cAAc,GACd,UAAU,GACV,WAAW,GACX,iBAAiB,GACjB,eAAe,GACf,SAAS,GACT,cAAc,GACd,gBAAgB,GAChB,OAAO,GACP,SAAS;AACX;;;;;;qEAMqE;GACnE,qBAAqB;AACvB;;;;;;gEAMgE;GAC9D,aAAa;AAOf,6EAA6E;GAC3E,KAAK;AACP;;;;qCAIqC;GACnC,cAAc;AAChB,qDAAqD;GACnD,SAAS;AACX,6CAA6C;GAC3C,WAAW;AACb;8EAC8E;GAC5E,YAAY,CAAC;AAEjB,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,SAAS,CAAC;IACjB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,gBAAgB,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,SAAS;QAClB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;KACxB,EAAE,CAAC;CACL"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/graph/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,MAAM,MAAM,SAAS,GACjB,SAAS,GACT,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,MAAM,GACN,OAAO,GACP,UAAU,GACV,QAAQ,GACR,UAAU,GACV,WAAW,GACX,MAAM,GACN,WAAW,GACX,QAAQ,GACR,MAAM,GACN,aAAa,GACb,WAAW,GACX,SAAS,GAET,QAAQ,GACR,OAAO,GACP,SAAS,GACT,OAAO,GACP,WAAW,GACX,OAAO,GACP,MAAM,GACN,WAAW,GACX,OAAO,GACP,QAAQ,GACR,UAAU,GACV,QAAQ,GACR,UAAU,GACV,YAAY,GACZ,aAAa,GACb,UAAU,GACV,SAAS,GACT,OAAO,GACP,MAAM,GAGN,YAAY,CAAC;AAEjB,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC;IACvC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;IAEjC,WAAW,CAAC,EAAE,iBAAiB,GAAG,iBAAiB,CAAC;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAEtB,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GACxB,UAAU,GACV,OAAO,GACP,UAAU,GACV,kBAAkB,GAClB,mBAAmB,GACnB,SAAS,GACT,MAAM,GACN,SAAS,GACT,WAAW,GACX,YAAY,GACZ,SAAS,GACT,YAAY,GACZ,cAAc,GACd,UAAU,GACV,WAAW,GACX,iBAAiB,GACjB,eAAe,GACf,SAAS,GACT,cAAc,GACd,gBAAgB,GAChB,OAAO,GACP,SAAS;AACX;;;;;;qEAMqE;GACnE,qBAAqB;AACvB;;;;;;gEAMgE;GAC9D,aAAa;AAOf,6EAA6E;GAC3E,KAAK;AACP;;;;qCAIqC;GACnC,cAAc;AAChB,qDAAqD;GACnD,SAAS;AACX,6CAA6C;GAC3C,WAAW;AACb;8EAC8E;GAC5E,YAAY;AACd;;;;qEAIqE;GACnE,KAAK;AACP;;;;;;0EAM0E;GACxE,eAAe,CAAC;AAEpB,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,SAAS,CAAC;IACjB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,gBAAgB,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,SAAS;QAClB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;KACxB,EAAE,CAAC;CACL"}

package/dist/_shared/lbug/schema-constants.d.ts

@@ -10,7 +10,7 @@
 export declare const NODE_TABLES: readonly ["File", "Folder", "Function", "Class", "Interface", "Method", "CodeElement", "Community", "Process", "Section", "Struct", "Enum", "Macro", "Typedef", "Union", "Namespace", "Trait", "Impl", "TypeAlias", "Const", "Static", "Variable", "Property", "Record", "Delegate", "Annotation", "Constructor", "Template", "Module", "Route", "Tool", "BasicBlock"];
 export type NodeTableName = (typeof NODE_TABLES)[number];
 export declare const REL_TABLE_NAME = "CodeRelation";
-export declare const REL_TYPES: readonly ["CONTAINS", "DEFINES", "IMPORTS", "CALLS", "EXTENDS", "IMPLEMENTS", "HAS_METHOD", "HAS_PROPERTY", "ACCESSES", "METHOD_OVERRIDES", "OVERRIDES", "METHOD_IMPLEMENTS", "MEMBER_OF", "STEP_IN_PROCESS", "HANDLES_ROUTE", "FETCHES", "HANDLES_TOOL", "ENTRY_POINT_OF", "WRAPS", "QUERIES", "CFG", "REACHING_DEF", "TAINTED", "SANITIZES", "TAINT_PATH"];
+export declare const REL_TYPES: readonly ["CONTAINS", "DEFINES", "IMPORTS", "CALLS", "EXTENDS", "IMPLEMENTS", "HAS_METHOD", "HAS_PROPERTY", "ACCESSES", "METHOD_OVERRIDES", "OVERRIDES", "METHOD_IMPLEMENTS", "MEMBER_OF", "STEP_IN_PROCESS", "HANDLES_ROUTE", "FETCHES", "HANDLES_TOOL", "ENTRY_POINT_OF", "WRAPS", "QUERIES", "CFG", "REACHING_DEF", "TAINTED", "SANITIZES", "TAINT_PATH", "CDG", "POST_DOMINATE"];
 export type RelType = (typeof REL_TYPES)[number];
 export declare const EMBEDDING_TABLE_NAME = "CodeEmbedding";
 //# sourceMappingURL=schema-constants.d.ts.map

package/dist/_shared/lbug/schema-constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-constants.d.ts","sourceRoot":"","sources":["../../src/lbug/schema-constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,eAAO,MAAM,WAAW,wWAkCd,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD,eAAO,MAAM,cAAc,iBAAiB,CAAC;AAE7C,eAAO,MAAM,SAAS,8VA6BZ,CAAC;AAEX,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjD,eAAO,MAAM,oBAAoB,kBAAkB,CAAC"}
+{"version":3,"file":"schema-constants.d.ts","sourceRoot":"","sources":["../../src/lbug/schema-constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,eAAO,MAAM,WAAW,wWAkCd,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD,eAAO,MAAM,cAAc,iBAAiB,CAAC;AAE7C,eAAO,MAAM,SAAS,sXAmCZ,CAAC;AAEX,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjD,eAAO,MAAM,oBAAoB,kBAAkB,CAAC"}

package/dist/_shared/lbug/schema-constants.js

@@ -72,6 +72,12 @@ export const REL_TYPES = [
     'TAINTED',
     'SANITIZES',
     'TAINT_PATH',
+    // Control dependence (PDG, issue #2085 M5) — CDG carries its 'T'|'F' branch
+    // label in the relation's `reason` column; POST_DOMINATE is debug-only
+    // (behind GITNEXUS_PDG_EMIT_POST_DOMINATE). Both are BasicBlock→BasicBlock,
+    // reusing the existing FROM BasicBlock TO BasicBlock pair in RELATION_SCHEMA.
+    'CDG',
+    'POST_DOMINATE',
 ];
 export const EMBEDDING_TABLE_NAME = 'CodeEmbedding';
 //# sourceMappingURL=schema-constants.js.map

package/dist/_shared/lbug/schema-constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema-constants.js","sourceRoot":"","sources":["../../src/lbug/schema-constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,MAAM;IACN,QAAQ;IACR,UAAU;IACV,OAAO;IACP,WAAW;IACX,QAAQ;IACR,aAAa;IACb,WAAW;IACX,SAAS;IACT,SAAS;IACT,QAAQ;IACR,MAAM;IACN,OAAO;IACP,SAAS;IACT,OAAO;IACP,WAAW;IACX,OAAO;IACP,MAAM;IACN,WAAW;IACX,OAAO;IACP,QAAQ;IACR,UAAU;IACV,UAAU;IACV,QAAQ;IACR,UAAU;IACV,YAAY;IACZ,aAAa;IACb,UAAU;IACV,QAAQ;IACR,OAAO;IACP,MAAM;IACN,2EAA2E;IAC3E,YAAY;CACJ,CAAC;AAIX,MAAM,CAAC,MAAM,cAAc,GAAG,cAAc,CAAC;AAE7C,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,UAAU;IACV,SAAS;IACT,SAAS;IACT,OAAO;IACP,SAAS;IACT,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,UAAU;IACV,kBAAkB;IAClB,WAAW,EAAE,mEAAmE;IAChF,mBAAmB;IACnB,WAAW;IACX,iBAAiB;IACjB,eAAe;IACf,SAAS;IACT,cAAc;IACd,gBAAgB;IAChB,OAAO;IACP,SAAS;IACT,yEAAyE;IACzE,yEAAyE;IACzE,6EAA6E;IAC7E,KAAK;IACL,cAAc;IACd,SAAS;IACT,WAAW;IACX,YAAY;CACJ,CAAC;AAIX,MAAM,CAAC,MAAM,oBAAoB,GAAG,eAAe,CAAC"}
+{"version":3,"file":"schema-constants.js","sourceRoot":"","sources":["../../src/lbug/schema-constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,MAAM;IACN,QAAQ;IACR,UAAU;IACV,OAAO;IACP,WAAW;IACX,QAAQ;IACR,aAAa;IACb,WAAW;IACX,SAAS;IACT,SAAS;IACT,QAAQ;IACR,MAAM;IACN,OAAO;IACP,SAAS;IACT,OAAO;IACP,WAAW;IACX,OAAO;IACP,MAAM;IACN,WAAW;IACX,OAAO;IACP,QAAQ;IACR,UAAU;IACV,UAAU;IACV,QAAQ;IACR,UAAU;IACV,YAAY;IACZ,aAAa;IACb,UAAU;IACV,QAAQ;IACR,OAAO;IACP,MAAM;IACN,2EAA2E;IAC3E,YAAY;CACJ,CAAC;AAIX,MAAM,CAAC,MAAM,cAAc,GAAG,cAAc,CAAC;AAE7C,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,UAAU;IACV,SAAS;IACT,SAAS;IACT,OAAO;IACP,SAAS;IACT,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,UAAU;IACV,kBAAkB;IAClB,WAAW,EAAE,mEAAmE;IAChF,mBAAmB;IACnB,WAAW;IACX,iBAAiB;IACjB,eAAe;IACf,SAAS;IACT,cAAc;IACd,gBAAgB;IAChB,OAAO;IACP,SAAS;IACT,yEAAyE;IACzE,yEAAyE;IACzE,6EAA6E;IAC7E,KAAK;IACL,cAAc;IACd,SAAS;IACT,WAAW;IACX,YAAY;IACZ,4EAA4E;IAC5E,uEAAuE;IACvE,4EAA4E;IAC5E,8EAA8E;IAC9E,KAAK;IACL,eAAe;CACP,CAAC;AAIX,MAAM,CAAC,MAAM,oBAAoB,GAAG,eAAe,CAAC"}

package/dist/cli/ai-context.d.ts

@@ -24,6 +24,12 @@ export interface AIContextOptions {
      * plain caller that omits it gets "main", preserving prior behavior.
      */
     defaultBranch?: string;
+    /**
+     * Whether the index was built with `--pdg` (#2086 M6). Gates the `pdg_query`
+     * line in the generated block — without the PDG layer the tool only returns a
+     * "no PDG layer" note, so advertising it on a non-`--pdg` index is noise.
+     */
+    hasPdg?: boolean;
 }
 /**
  * Strip backticks from a branch name before it is embedded in a Markdown
@@ -32,7 +38,31 @@ export interface AIContextOptions {
  * the generation sink so the embedding is provably safe regardless of caller.
  */
 export declare function markdownSafeBranch(branch: string): string;
-export declare function generateGitNexusContent(projectName: string, stats: RepoStats, generatedSkills?: GeneratedSkillInfo[], groupNames?: string[], noStats?: boolean, skipSkills?: boolean, runnerPath?: string, defaultBranch?: string): string;
+/** Options for {@link generateGitNexusContent} (collapsed from positional
+ *  params, #2188 review — six `undefined`s to reach `hasPdg` was the smell). */
+export interface GitNexusContentOptions {
+    generatedSkills?: GeneratedSkillInfo[];
+    groupNames?: string[];
+    noStats?: boolean;
+    skipSkills?: boolean;
+    /** Project-relative path to the runner `gitnexus analyze` drops next to the
+     *  index (#1945). Referenced by docs so a single CLI-neutral command resolves
+     *  the available runner (global `gitnexus` → `pnpm dlx` → `npx`) at call time. */
+    runnerPath?: string;
+    /** Default branch for the regression-compare example (#243). Configurable so
+     *  projects on `develop`/`master`/etc. don't get `base_ref: "main"` rewritten
+     *  back over their fix on every analyze. The value is embedded inside a
+     *  Markdown inline-code span: validateBranchName rejects backticks upstream,
+     *  and `markdownSafeBranch` strips any remaining backtick here as defense in
+     *  depth, so JSON.stringify's quote/escape handling is sufficient and the
+     *  branch cannot break out of the span (#1996 tri-review P1). */
+    defaultBranch?: string;
+    /** Whether the index was built with `--pdg` (#2086 M6). Gates the pdg_query
+     *  line below — false (default) omits it, so a non-pdg index doesn't advertise
+     *  a tool that only returns a "no PDG layer" note. */
+    hasPdg?: boolean;
+}
+export declare function generateGitNexusContent(projectName: string, stats: RepoStats, opts?: GitNexusContentOptions): string;
 /**
  * Generate AI context files after indexing
  */

package/dist/cli/ai-context.js

@@ -77,19 +77,8 @@ async function findGroupsContainingRegistryName(registryName) {
 export function markdownSafeBranch(branch) {
     return branch.replace(/`/g, '');
 }
-export function generateGitNexusContent(projectName, stats, generatedSkills, groupNames, noStats, skipSkills, 
-// Project-relative path to the runner `gitnexus analyze` drops next to the
-// index (#1945). Referenced by docs so a single CLI-neutral command resolves
-// the available runner (global `gitnexus` → `pnpm dlx` → `npx`) at call time.
-runnerPath = '.gitnexus/run.cjs', 
-// Default branch for the regression-compare example (#243). Configurable so
-// projects on `develop`/`master`/etc. don't get `base_ref: "main"` rewritten
-// back over their fix on every analyze. The value is embedded inside a
-// Markdown inline-code span: validateBranchName rejects backticks upstream,
-// and `markdownSafeBranch` strips any remaining backtick here as defense in
-// depth, so JSON.stringify's quote/escape handling is sufficient and the
-// branch cannot break out of the span (#1996 tri-review P1).
-defaultBranch = 'main') {
+export function generateGitNexusContent(projectName, stats, opts = {}) {
+    const { generatedSkills, groupNames, noStats, skipSkills, runnerPath = '.gitnexus/run.cjs', defaultBranch = 'main', hasPdg = false, } = opts;
     const generatedRows = generatedSkills && generatedSkills.length > 0
         ? generatedSkills
             .map((s) => `| Work in the ${s.label} area (${s.symbolCount} symbols) | \`.claude/skills/generated/${s.name}/SKILL.md\` |`)
@@ -136,7 +125,9 @@ This project is indexed by GitNexus as **${projectName}**${noStats ? '' : ` (${s
 - **MUST warn the user** if impact analysis returns HIGH or CRITICAL risk before proceeding with edits.
 - When exploring unfamiliar code, use \`query({search_query: "concept"})\` to find execution flows instead of grepping. It returns process-grouped results ranked by relevance.
 - When you need full context on a specific symbol — callers, callees, which execution flows it participates in — use \`context({name: "symbolName"})\`.
-- For security review, \`explain({target: "fileOrSymbol"})\` lists taint findings (source→sink flows; needs \`analyze --pdg\`).
+- For security review, \`explain({target: "fileOrSymbol"})\` lists taint findings (source→sink flows; needs \`analyze --pdg\`).${hasPdg
+        ? `\n- For control/data dependence, \`pdg_query({mode: "controls", target: "fileOrSymbol"})\` answers "under what condition does X run?" (CDG, incl. guard clauses) and \`pdg_query({mode: "flows", target, variable})\` traces "where does variable Y flow?" (REACHING_DEF). \`--pdg\` layer.`
+        : ''}
 
 ## Never Do
 
@@ -349,7 +340,15 @@ export async function generateAIContextFiles(repoPath, storagePath, projectName,
     catch (err) {
         logger.warn(`Could not write GitNexus runner to ${runnerPath}: ${String(err)}`);
     }
-    const content = generateGitNexusContent(projectName, stats, generatedSkills, groupNames, options?.noStats, options?.skipSkills, runnerPath, options?.defaultBranch ?? 'main');
+    const content = generateGitNexusContent(projectName, stats, {
+        generatedSkills,
+        groupNames,
+        noStats: options?.noStats,
+        skipSkills: options?.skipSkills,
+        runnerPath,
+        defaultBranch: options?.defaultBranch ?? 'main',
+        hasPdg: options?.hasPdg ?? false,
+    });
     const createdFiles = [];
     if (!options?.skipAgentsMd) {
         // Create AGENTS.md (standard for Cursor, Windsurf, OpenCode, Cline, etc.)

package/dist/cli/analyze.js

@@ -1073,6 +1073,7 @@ const analyzeCommandImpl = async (inputPath, cliOptions) => {
                         // Mirror runFullAnalysis `noStats` bridge (#1477) — same expression;
                         // exercised on the `--skills` path by analyze-no-stats-bridge.test.ts.
                         noStats: options.stats === false,
+                        hasPdg: options.pdg === true,
                     });
                 }
             }

package/dist/core/ingestion/cfg/control-dependence.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Control dependence (#2085 M5 U3) — Ferrante, Ottenstein & Warren §3.1.1 over
+ * the post-dominator tree. A block `dependent` is control-dependent on a branch
+ * block `controller` when `controller` decides whether `dependent` executes:
+ * formally, there is a CFG edge `controller → B` such that `dependent`
+ * post-dominates `B` but does NOT strictly post-dominate `controller`.
+ *
+ * Construction (§3.1.1): for each CFG edge `(A, B)` where `B` does NOT
+ * post-dominate `A`, walk UP the post-dom tree from `B` to (but not including)
+ * `ipdom(A)`; every block on that path is control-dependent on `A`. The branch
+ * SENSE of the edge ('T' | 'F') becomes the edge label (KTD4 / KTD3 — it rides
+ * the persisted relation's `reason` column).
+ *
+ * PURE AND DETERMINISTIC (mirrors post-dominators.ts / reaching-defs.ts): no
+ * graph, no logger, importable outside the worker; output is deduped per
+ * (controller, dependent, label) and sorted, so snapshot tests and
+ * content-derived edge ids are stable. The loop header legitimately appears as
+ * control-dependent on ITSELF (`controller === dependent`) — the loop predicate
+ * gates its own re-execution; this is standard PDG behavior, not a bug.
+ */
+import { type PostDomTree } from './post-dominators.js';
+import type { FunctionCfg } from './types.js';
+export type CdgLabel = 'T' | 'F';
+export interface ControlDepEdge {
+    /** The branch block whose outcome controls `dependentBlock`. */
+    readonly controllerBlock: number;
+    /** The block that executes only because `controllerBlock` took `label`. */
+    readonly dependentBlock: number;
+    /** Branch sense of the controlling CFG edge — see {@link branchSense}. */
+    readonly label: CdgLabel;
+}
+export interface ControlDepResult {
+    /** Deduped, sorted (controller, dependent, label) control-dependence edges. */
+    readonly edges: readonly ControlDepEdge[];
+    /**
+     * True when the `maxEdges` ceiling was reached; `edges` is then a
+     * deterministic prefix (CFG-edge iteration order, sorted), never a silent
+     * drop. Mirrors {@link computeReachingDefs}'s `truncated`.
+     */
+    readonly truncated: boolean;
+}
+/**
+ * Compute control-dependence edges for one function's CFG. `postDom` may be
+ * supplied to reuse an already-built tree; otherwise it is computed. See the
+ * module doc for the purity/determinism contract.
+ */
+export declare function computeControlDependence(cfg: FunctionCfg, postDom?: PostDomTree, maxEdges?: number): ControlDepResult;

package/dist/core/ingestion/cfg/control-dependence.js

@@ -0,0 +1,120 @@
+/**
+ * Control dependence (#2085 M5 U3) — Ferrante, Ottenstein & Warren §3.1.1 over
+ * the post-dominator tree. A block `dependent` is control-dependent on a branch
+ * block `controller` when `controller` decides whether `dependent` executes:
+ * formally, there is a CFG edge `controller → B` such that `dependent`
+ * post-dominates `B` but does NOT strictly post-dominate `controller`.
+ *
+ * Construction (§3.1.1): for each CFG edge `(A, B)` where `B` does NOT
+ * post-dominate `A`, walk UP the post-dom tree from `B` to (but not including)
+ * `ipdom(A)`; every block on that path is control-dependent on `A`. The branch
+ * SENSE of the edge ('T' | 'F') becomes the edge label (KTD4 / KTD3 — it rides
+ * the persisted relation's `reason` column).
+ *
+ * PURE AND DETERMINISTIC (mirrors post-dominators.ts / reaching-defs.ts): no
+ * graph, no logger, importable outside the worker; output is deduped per
+ * (controller, dependent, label) and sorted, so snapshot tests and
+ * content-derived edge ids are stable. The loop header legitimately appears as
+ * control-dependent on ITSELF (`controller === dependent`) — the loop predicate
+ * gates its own re-execution; this is standard PDG behavior, not a bug.
+ */
+import { computePostDominators, postDominates, NO_IPDOM, } from './post-dominators.js';
+function buildArmSenses(cfg) {
+    const n = cfg.blocks.length;
+    const senses = Array.from({ length: n }, () => ({
+        hasTrueArm: false,
+        hasFalseArm: false,
+    }));
+    for (const e of cfg.edges) {
+        if (e.from < 0 || e.from >= n)
+            continue;
+        if (e.kind === 'cond-true' || e.kind === 'switch-case')
+            senses[e.from].hasTrueArm = true;
+        else if (e.kind === 'cond-false')
+            senses[e.from].hasFalseArm = true;
+    }
+    return senses;
+}
+/**
+ * The CDG label ('T'|'F') for a control-dependence edge, given the controlling
+ * block's arm senses. An explicitly-sensed edge is taken at face value; an
+ * ambiguous fall-through edge (`seq`/`loop-back`/`fallthrough`/jump) is the
+ * COMPLEMENT of the controller's explicit sibling arm. Per-case `switch` value
+ * labels are deferred to #2086 — every `switch-case` is 'T' in M5.
+ */
+function labelFor(kind, controller) {
+    if (kind === 'cond-true' || kind === 'switch-case')
+        return 'T';
+    if (kind === 'cond-false')
+        return 'F';
+    // Ambiguous structural kind: take the complement of the controller's explicit
+    // arm. A block with a true arm reaches here via its false fall-through; a
+    // do/while bottom-test (false arm = cond-false) reaches here via its true
+    // loop-back. With neither explicit arm (a degenerate / exit-unreachable
+    // region — see #2188 F2, where the dependence itself is unsound) the sense is
+    // indeterminate; default 'F' since fall-through is the common case.
+    if (controller.hasTrueArm)
+        return 'F';
+    if (controller.hasFalseArm)
+        return 'T';
+    return 'F';
+}
+/**
+ * Compute control-dependence edges for one function's CFG. `postDom` may be
+ * supplied to reuse an already-built tree; otherwise it is computed. See the
+ * module doc for the purity/determinism contract.
+ */
+export function computeControlDependence(cfg, postDom, 
+// Heap-safety ceiling on materialized edges, mirroring computeReachingDefs'
+// `maxFacts` (#2188 review): the pre-dedup walk is O(edges × post-dom depth),
+// so bound it before it can spike. `0` ⇒ unbounded. On overflow `edges` is a
+// deterministic prefix and `truncated` is set — never a silent drop.
+maxEdges = 0) {
+    const tree = postDom ?? computePostDominators(cfg);
+    const { ipdom } = tree;
+    const n = cfg.blocks.length;
+    const armSenses = buildArmSenses(cfg);
+    const cap = maxEdges > 0 ? maxEdges : Infinity;
+    const out = [];
+    const seen = new Set();
+    let truncated = false;
+    scan: for (const e of cfg.edges) {
+        const a = e.from;
+        const b = e.to;
+        if (a < 0 || a >= n || b < 0 || b >= n)
+            continue;
+        // No control dependence when B post-dominates A — every path leaving A
+        // through this edge still reaches B, so A does not decide B's execution.
+        // This guard is exactly AC2: a dependence exists IFF post-dominance fails.
+        if (postDominates(tree, b, a))
+            continue;
+        // Sense is read from the CONTROLLER's arms, not this edge's kind alone —
+        // seq/loop-back fall-through false arms would otherwise mislabel as 'T'
+        // (#2188 F1).
+        const label = labelFor(e.kind, armSenses[a]);
+        const stop = ipdom[a]; // walk up to ipdom(A), EXCLUSIVE (NO_IPDOM ⇒ to root)
+        let cur = b;
+        let steps = 0;
+        // `steps <= n` is defensive — the ipdom chain is a finite tree.
+        while (cur !== NO_IPDOM && cur !== stop && steps <= n) {
+            const key = `${a}:${cur}:${label}`;
+            if (!seen.has(key)) {
+                // Check BEFORE pushing so `truncated` means a genuine overflow (a new
+                // unique edge had to be dropped), not merely "reached the ceiling" —
+                // exactly `cap` edges is a full, non-truncated result.
+                if (out.length >= cap) {
+                    truncated = true;
+                    break scan;
+                }
+                seen.add(key);
+                out.push({ controllerBlock: a, dependentBlock: cur, label });
+            }
+            cur = ipdom[cur];
+            steps += 1;
+        }
+    }
+    out.sort((x, y) => x.controllerBlock - y.controllerBlock ||
+        x.dependentBlock - y.dependentBlock ||
+        (x.label < y.label ? -1 : x.label > y.label ? 1 : 0));
+    return { edges: out, truncated };
+}

package/dist/core/ingestion/cfg/emit.d.ts

@@ -36,6 +36,34 @@ export declare const DEFAULT_MAX_CFG_EDGES_PER_FUNCTION = 5000;
  * facts. `0` ⇒ unlimited; `undefined` ⇒ this default.
  */
 export declare const DEFAULT_PDG_MAX_REACHING_DEF_EDGES_PER_FUNCTION = 4000;
+/**
+ * Default per-function CDG edge cap (#2085 M5). CDG edge count is bounded by
+ * (blocks × control-nesting-depth) — comparable to the CFG edge count — so it
+ * reuses the CFG default of 5000. Counts DEDUPED (controller, dependent, label)
+ * edges (the pure {@link computeControlDependence} already dedups). `0` ⇒
+ * unlimited; `undefined` ⇒ this default. Folded into the `RepoMeta.pdg` stamp
+ * (U5) so introducing CDG forces a full writeback for pre-CDG `--pdg` indexes.
+ */
+export declare const DEFAULT_PDG_MAX_CDG_EDGES_PER_FUNCTION = 5000;
+/**
+ * Heap-safety ceiling on {@link computeControlDependence}'s pre-dedup
+ * materialization (#2188 review). The walk is O(edges × post-dom depth), and its
+ * `out` IS the deduped-edge quantity the per-function cap trims — so, UNLIKE
+ * REACHING_DEF's facts ceiling, this is deliberately NOT derived from the
+ * runtime edge cap (doing so would pre-truncate the very set the cap reports on,
+ * losing the exact dropped count). A fixed, generous multiple of the default
+ * edge cap: far above any real function — a catastrophe backstop only. When hit,
+ * the per-function cap reporting plus the `truncated` flag keep it observable
+ * (never a silent drop).
+ */
+export declare const DEFAULT_PDG_MAX_CDG_MATERIALIZATION_PER_FUNCTION: number;
+/**
+ * Env flag that additionally emits diagnostic `POST_DOMINATE` edges
+ * (block → its immediate post-dominator) alongside CDG (#2085 M5 KTD8). Off in
+ * every normal `--pdg` run — these are for inspecting the post-dom tree, not a
+ * queryable product surface. Accepts `1`/`true` (case-insensitive).
+ */
+export declare const POST_DOMINATE_DEBUG_ENV = "GITNEXUS_PDG_EMIT_POST_DOMINATE";
 /**
  * Fact-materialization headroom over the edge cap (#2082 M2 U3/F3): facts are
  * O(defs×uses) BY SPEC in merge-heavy code, and the edge cap alone bounds the
@@ -142,3 +170,34 @@ export declare const bindingKey: (b: BindingEntry) => string;
  * M3 tuning wants.
  */
 export declare function emitFileReachingDefs(graph: KnowledgeGraph, cfgs: readonly FunctionCfg[], maxEdgesPerFunction?: number, onWarn?: (message: string) => void): ReachingDefEmitResult;
+export interface CdgEmitResult {
+    /** Deduped (controller, dependent, label) CDG edges persisted. */
+    edges: number;
+    /** CDG edges dropped by the per-function edge cap. */
+    droppedEdges: number;
+    /** Functions that hit the CDG edge cap. */
+    cappedFunctions: number;
+    /** Diagnostic POST_DOMINATE edges emitted (0 unless the debug env is set). */
+    postDominateEdges: number;
+    /**
+     * Functions skipped because EXIT was not reachable from every entry-reachable
+     * block — post-dominance would be unsound (#2188 review). CFG/REACHING_DEF for
+     * those functions are kept; only their CDG projection is omitted.
+     */
+    skippedUnsoundFunctions: number;
+}
+/**
+ * Compute control dependence per function and persist the bounded CDG
+ * projection (#2085 M5 U4). Mirrors {@link emitFileReachingDefs}: the pure
+ * {@link computeControlDependence} already dedups to (controller, dependent,
+ * label), so the per-function cap applies to deduped edges and overflow logs
+ * one unconditional `onWarn` naming the dropped count — no silent truncation
+ * (R6/R7). The branch label ('T'|'F') rides the `reason` column (KTD3),
+ * mirroring how CFG stores its edge kind.
+ *
+ * When {@link POST_DOMINATE_DEBUG_ENV} is set, also emits diagnostic
+ * `POST_DOMINATE` edges (block → its immediate post-dominator). These are NOT
+ * capped or counted against the CDG budget — they exist only for inspecting the
+ * post-dom tree and never appear in a normal run.
+ */
+export declare function emitFileCdg(graph: KnowledgeGraph, cfgs: readonly FunctionCfg[], maxEdgesPerFunction?: number, onWarn?: (message: string) => void): CdgEmitResult;

package/dist/core/ingestion/cfg/emit.js

@@ -1,5 +1,7 @@
 import { generateId } from '../../../lib/utils.js';
 import { computeReachingDefs } from './reaching-defs.js';
+import { computeControlDependence } from './control-dependence.js';
+import { computePostDominators, isExitReachableFromAllBlocks, NO_IPDOM, } from './post-dominators.js';
 /**
  * Default per-function CFG edge cap. A pathological generated function could
  * otherwise emit an unbounded edge set; the cap bounds graph growth and is
@@ -16,6 +18,34 @@ export const DEFAULT_MAX_CFG_EDGES_PER_FUNCTION = 5000;
  * facts. `0` ⇒ unlimited; `undefined` ⇒ this default.
  */
 export const DEFAULT_PDG_MAX_REACHING_DEF_EDGES_PER_FUNCTION = 4000;
+/**
+ * Default per-function CDG edge cap (#2085 M5). CDG edge count is bounded by
+ * (blocks × control-nesting-depth) — comparable to the CFG edge count — so it
+ * reuses the CFG default of 5000. Counts DEDUPED (controller, dependent, label)
+ * edges (the pure {@link computeControlDependence} already dedups). `0` ⇒
+ * unlimited; `undefined` ⇒ this default. Folded into the `RepoMeta.pdg` stamp
+ * (U5) so introducing CDG forces a full writeback for pre-CDG `--pdg` indexes.
+ */
+export const DEFAULT_PDG_MAX_CDG_EDGES_PER_FUNCTION = 5000;
+/**
+ * Heap-safety ceiling on {@link computeControlDependence}'s pre-dedup
+ * materialization (#2188 review). The walk is O(edges × post-dom depth), and its
+ * `out` IS the deduped-edge quantity the per-function cap trims — so, UNLIKE
+ * REACHING_DEF's facts ceiling, this is deliberately NOT derived from the
+ * runtime edge cap (doing so would pre-truncate the very set the cap reports on,
+ * losing the exact dropped count). A fixed, generous multiple of the default
+ * edge cap: far above any real function — a catastrophe backstop only. When hit,
+ * the per-function cap reporting plus the `truncated` flag keep it observable
+ * (never a silent drop).
+ */
+export const DEFAULT_PDG_MAX_CDG_MATERIALIZATION_PER_FUNCTION = 8 * DEFAULT_PDG_MAX_CDG_EDGES_PER_FUNCTION;
+/**
+ * Env flag that additionally emits diagnostic `POST_DOMINATE` edges
+ * (block → its immediate post-dominator) alongside CDG (#2085 M5 KTD8). Off in
+ * every normal `--pdg` run — these are for inspecting the post-dom tree, not a
+ * queryable product surface. Accepts `1`/`true` (case-insensitive).
+ */
+export const POST_DOMINATE_DEBUG_ENV = 'GITNEXUS_PDG_EMIT_POST_DOMINATE';
 /**
  * Fact-materialization headroom over the edge cap (#2082 M2 U3/F3): facts are
  * O(defs×uses) BY SPEC in merge-heavy code, and the edge cap alone bounds the
@@ -313,3 +343,100 @@ export function emitFileReachingDefs(graph, cfgs, maxEdgesPerFunction = DEFAULT_
     }
     return result;
 }
+/** Whether the POST_DOMINATE debug env flag is enabled (`1`/`true`). */
+const postDominateDebugEnabled = () => {
+    const v = process.env[POST_DOMINATE_DEBUG_ENV];
+    return v === '1' || v?.toLowerCase() === 'true';
+};
+/**
+ * Compute control dependence per function and persist the bounded CDG
+ * projection (#2085 M5 U4). Mirrors {@link emitFileReachingDefs}: the pure
+ * {@link computeControlDependence} already dedups to (controller, dependent,
+ * label), so the per-function cap applies to deduped edges and overflow logs
+ * one unconditional `onWarn` naming the dropped count — no silent truncation
+ * (R6/R7). The branch label ('T'|'F') rides the `reason` column (KTD3),
+ * mirroring how CFG stores its edge kind.
+ *
+ * When {@link POST_DOMINATE_DEBUG_ENV} is set, also emits diagnostic
+ * `POST_DOMINATE` edges (block → its immediate post-dominator). These are NOT
+ * capped or counted against the CDG budget — they exist only for inspecting the
+ * post-dom tree and never appear in a normal run.
+ */
+export function emitFileCdg(graph, cfgs, maxEdgesPerFunction = DEFAULT_PDG_MAX_CDG_EDGES_PER_FUNCTION, onWarn) {
+    const result = {
+        edges: 0,
+        droppedEdges: 0,
+        cappedFunctions: 0,
+        postDominateEdges: 0,
+        skippedUnsoundFunctions: 0,
+    };
+    const cap = maxEdgesPerFunction > 0 ? maxEdgesPerFunction : Infinity;
+    const emitPostDom = postDominateDebugEnabled();
+    for (const cfg of cfgs) {
+        const { filePath, functionStartLine, functionStartColumn } = cfg;
+        // Sound post-dominance requires EXIT reachable from every entry-reachable
+        // block (#2188 review). A CFG that violates it — a future visitor's
+        // multi-terminal / non-terminating shape — would yield a CDG that both
+        // drops real and invents spurious dependences, so skip CDG for it. CFG and
+        // REACHING_DEF (emitted elsewhere, independent of post-dominance) are kept.
+        if (!isExitReachableFromAllBlocks(cfg)) {
+            result.skippedUnsoundFunctions++;
+            onWarn?.(`[cdg] ${filePath}:${functionStartLine}: EXIT not reachable from all ` +
+                `blocks — CDG skipped for this function (CFG/REACHING_DEF unaffected)`);
+            continue;
+        }
+        // Compute the post-dom tree once and feed it to the control-dependence
+        // pass (avoids recomputing it) and to the optional POST_DOMINATE emit.
+        const tree = computePostDominators(cfg);
+        // Bound the pre-dedup materialization (heap parity with REACHING_DEF). The
+        // fixed ceiling is a catastrophe backstop; the per-function edge cap below
+        // remains the reporting authority. A ceiling hit is surfaced, not silent.
+        const { edges: cdgEdges, truncated } = computeControlDependence(cfg, tree, DEFAULT_PDG_MAX_CDG_MATERIALIZATION_PER_FUNCTION);
+        if (truncated) {
+            onWarn?.(`[cdg] ${filePath}:${functionStartLine}: control-dependence materialization ` +
+                `ceiling (${DEFAULT_PDG_MAX_CDG_MATERIALIZATION_PER_FUNCTION}) reached — ` +
+                `edge counts for this function are a floor`);
+        }
+        let emittedForFn = 0;
+        for (const edge of cdgEdges) {
+            if (emittedForFn >= cap) {
+                const dropped = cdgEdges.length - emittedForFn;
+                result.droppedEdges += dropped;
+                result.cappedFunctions++;
+                onWarn?.(`[cdg] ${filePath}:${functionStartLine}: per-function CDG edge cap ` +
+                    `(${maxEdgesPerFunction}) reached — dropped ${dropped} of ${cdgEdges.length} edges`);
+                break;
+            }
+            const sourceId = basicBlockId(filePath, functionStartLine, functionStartColumn, edge.controllerBlock);
+            const targetId = basicBlockId(filePath, functionStartLine, functionStartColumn, edge.dependentBlock);
+            graph.addRelationship({
+                id: generateId('CDG', `${filePath}:${functionStartLine}:${functionStartColumn}:` +
+                    `${edge.controllerBlock}->${edge.dependentBlock}:${edge.label}`),
+                type: 'CDG',
+                sourceId,
+                targetId,
+                confidence: 1.0,
+                reason: edge.label, // 'T' | 'F' — queryable, mirrors CFG's kind-in-reason
+            });
+            result.edges++;
+            emittedForFn++;
+        }
+        if (emitPostDom) {
+            for (let b = 0; b < tree.ipdom.length; b++) {
+                const ip = tree.ipdom[b];
+                if (ip === NO_IPDOM)
+                    continue;
+                graph.addRelationship({
+                    id: generateId('POST_DOMINATE', `${filePath}:${functionStartLine}:${functionStartColumn}:${b}->${ip}`),
+                    type: 'POST_DOMINATE',
+                    sourceId: basicBlockId(filePath, functionStartLine, functionStartColumn, b),
+                    targetId: basicBlockId(filePath, functionStartLine, functionStartColumn, ip),
+                    confidence: 1.0,
+                    reason: '',
+                });
+                result.postDominateEdges++;
+            }
+        }
+    }
+    return result;
+}

package/dist/core/ingestion/cfg/post-dominators.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Post-dominators (#2085 M5 U2) — the immediate-post-dominator tree of one
+ * function's CFG, the substrate the Ferrante control-dependence pass walks.
+ *
+ * A block `p` post-dominates a block `b` iff every path from `b` to the
+ * function EXIT passes through `p`. Post-dominators are exactly the DOMINATORS
+ * of the REVERSE CFG rooted at EXIT, so this is the Cooper–Harvey–Kennedy
+ * "A Simple, Fast Dominance Algorithm" run over reversed edges. KTD2 of the M5
+ * plan picks CHK over Lengauer–Tarjan: per-function CFGs are small and
+ * line-capped, CHK is near-linear in practice, and its iterative shape matches
+ * the reaching-defs fixpoint already in this module.
+ *
+ * PURE AND DETERMINISTIC (load-bearing, mirrors reaching-defs.ts): no graph, no
+ * logger, importable outside the worker; predecessors/successors are sorted and
+ * iteration is reverse-postorder so the `ipdom` array is identical across runs
+ * (snapshot tests and content-derived edge ids depend on it).
+ *
+ * The single-EXIT invariant the M1 TS visitor preserves (visitors/typescript.ts)
+ * makes EXIT the unique reverse-CFG root. Blocks that cannot reach EXIT in the
+ * forward CFG (an exit-less infinite loop) are not reverse-reachable from it and
+ * have NO post-dominator: their `ipdom` is {@link NO_IPDOM}. The control-
+ * dependence pass treats "no post-dominator" as "does not post-dominate" (KTD5).
+ *
+ * NOTE (issue #2188 F2): this is NOT a fully sound over-approximation. Inside a
+ * region where NO block reaches EXIT, every `ipdom` is `NO_IPDOM`, so the
+ * Ferrante walk degenerates to one edge per control point — it can both DROP a
+ * real control dependence and INVENT a spurious one. This does not arise for the
+ * current TS visitor (every loop is given a structural `header → loopExit`
+ * `cond-false` edge, so EXIT stays reverse-reachable), but it is unsound for
+ * hand-built CFGs and any future language visitor lacking that exit edge.
+ * Nontermination-sensitive post-dominance (a virtual root over the
+ * non-terminating SCCs) would be the correct treatment — tracked for follow-up.
+ */
+import type { FunctionCfg } from './types.js';
+/**
+ * Sentinel `ipdom` value: the block has no immediate post-dominator. True for
+ * the EXIT block itself (the reverse-CFG root) and for any block that cannot
+ * reach EXIT. Chosen as -1 so the {@link postDominates} climb terminates
+ * naturally instead of self-looping on the root.
+ */
+export declare const NO_IPDOM = -1;
+export interface PostDomTree {
+    /**
+     * `ipdom[b]` = the index of `b`'s immediate post-dominator, or
+     * {@link NO_IPDOM} when `b` has none (EXIT, or a block that cannot reach EXIT).
+     */
+    readonly ipdom: readonly number[];
+}
+/**
+ * Compute the immediate-post-dominator tree for one function's CFG. See the
+ * module doc for the purity/determinism contract and EXIT-root assumptions.
+ */
+export declare function computePostDominators(cfg: FunctionCfg): PostDomTree;
+/**
+ * Does block `p` post-dominate block `b`? Climbs the post-dom tree from `b`
+ * toward EXIT and tests membership of `p`. Reflexive: a block post-dominates
+ * itself. A block with no post-dominator (EXIT, or one that cannot reach EXIT)
+ * is post-dominated only by itself. The step guard is purely defensive — the
+ * `ipdom` chain is a tree and always terminates at {@link NO_IPDOM}.
+ */
+export declare function postDominates(tree: PostDomTree, p: number, b: number): boolean;
+/**
+ * Precondition for SOUND post-dominance (#2188 review): EXIT must be reachable
+ * (forward) from every block that is itself reachable from ENTRY. When it
+ * fails — an entry-reachable region that cannot reach EXIT, e.g. a
+ * non-terminating loop or a multi-terminal CFG a future language visitor might
+ * emit — the EXIT-rooted reverse walk degenerates (every such block gets
+ * {@link NO_IPDOM}), which both DROPS real control dependences and INVENTS
+ * spurious ones (the unsoundness documented in the module header). Consumers
+ * ({@link emitFileCdg}) check this and skip CDG for the function rather than
+ * persist an unsound projection — CFG and REACHING_DEF, which do not depend on
+ * post-dominance, are unaffected.
+ *
+ * The current TS visitor always satisfies this (every loop is given a
+ * structural `header → loopExit` edge, keeping EXIT reverse-reachable), so this
+ * is a guard for future visitors and hand-built CFGs, not a behavior change
+ * today. Pure and O(V+E).
+ */
+export declare function isExitReachableFromAllBlocks(cfg: FunctionCfg): boolean;