gitnexus 1.6.8-rc.8 → 1.6.8

package/dist/core/ingestion/scope-resolution/pipeline/run.d.ts

@@ -27,6 +27,9 @@ import type { KnowledgeGraph } from '../../../graph/types.js';
 import type { MutableSemanticModel } from '../../model/semantic-model.js';
 import { type ResolveStats } from '../../resolve-references.js';
 import { buildGraphNodeLookup } from '../graph-bridge/node-lookup.js';
+import { type FunctionNodeIndex } from '../../taint/summary-harvest-driver.js';
+import type { FunctionSummary } from '../../taint/summary-model.js';
+import type { CallSummary } from '../../taint/call-summary-model.js';
 import type { ScopeResolver } from '../contract/scope-resolver.js';
 import type { ResolutionOutcome, ResolutionOutcomeRecorder } from '../resolution-outcome.js';
 export type ScopeResolutionSubPhase = 'extracting' | 'analyzing types' | 'resolving references' | 'linking symbols';
@@ -58,6 +61,54 @@ interface RunScopeResolutionInput {
     readonly treeCache?: {
         get(filePath: string): unknown;
     };
+    /**
+     * CFG/PDG opt-in (#2081 M1). When true, emit BasicBlock nodes + CFG edges
+     * from each ParsedFile's worker-built `cfgSideChannel` during Phase-4 graph
+     * emission (while the disk store is still live). Default/false ⇒ no CFG
+     * nodes or edges and a byte-identical graph.
+     */
+    readonly pdg?: boolean;
+    /** Per-function CFG edge cap. `undefined` ⇒ {@link DEFAULT_MAX_CFG_EDGES_PER_FUNCTION};
+     *  `0` ⇒ no cap (unlimited). */
+    readonly pdgMaxEdgesPerFunction?: number;
+    /** Per-function REACHING_DEF edge cap (#2082 M2). `undefined` ⇒
+     *  {@link DEFAULT_PDG_MAX_REACHING_DEF_EDGES_PER_FUNCTION}; `0` ⇒ no cap. */
+    readonly pdgMaxReachingDefEdgesPerFunction?: number;
+    /** Per-function CDG (control-dependence) edge cap (#2085 M5). `undefined` ⇒
+     *  {@link DEFAULT_PDG_MAX_CDG_EDGES_PER_FUNCTION}; `0` ⇒ no cap. */
+    readonly pdgMaxCdgEdgesPerFunction?: number;
+    /** Per-function taint findings cap (#2083 M3, consumed by the U4 taint
+     *  emit step in the pdg window). `undefined` ⇒
+     *  `DEFAULT_PDG_MAX_TAINT_FINDINGS_PER_FUNCTION` (200); `0` ⇒ no cap. */
+    readonly pdgMaxTaintFindingsPerFunction?: number;
+    /** Per-finding taint hop cap (#2083 M3 KTD6 — bounds the hop-encoded
+     *  `reason`; consumed by the U4 taint emit step). `undefined` ⇒
+     *  `DEFAULT_PDG_MAX_TAINT_HOPS` (32); `0` ⇒ no cap. */
+    readonly pdgMaxTaintHops?: number;
+    /**
+     * Streaming PDG-emit sink (#2202). When present (streaming on, full rebuild),
+     * the `--pdg` emit routes BasicBlock nodes + intra-file PDG edges to THIS
+     * graph-shaped target instead of the in-memory `graph`, so the bulky PDG
+     * layer never accumulates in memory (peak RSS O(chunk)). Typed as a plain
+     * `KnowledgeGraph` so this module stays decoupled from the persistence layer;
+     * the caller (the scope-resolution phase) owns its lifecycle and finalizes it
+     * after the last language. Absent ⇒ the emit writes to `graph` as before
+     * (byte-identical default).
+     */
+    readonly pdgEmitSink?: KnowledgeGraph;
+    /**
+     * Cross-pass per-file dedup set for streaming PDG emit (#2202). Shared across
+     * every language pass (owned by the scope-resolution phase). A file imported
+     * by more than one language (e.g. a `.ts` module pulled into the Vue context
+     * pass) is PDG-emitted in each pass over the same `cfgSideChannel`, producing
+     * identical ids; the in-memory graph dedups that by id, but the streaming sink
+     * is dedup-free (to stay O(write buffer), not O(total ids)). So when present
+     * (streaming on), the emit loop skips a file whose PDG already streamed and
+     * records the rest — keeping the streamed set byte-identical to the
+     * Map-deduped whole-graph emit, for any language-pass order. Absent ⇒ no skip
+     * (the graph Map dedups), so the default path is unchanged.
+     */
+    readonly pdgEmittedFiles?: Set<string>;
     /**
      * Optional graph-node lookup built ONCE by the caller and shared across
      * every language pass. `buildGraphNodeLookup` scans the whole graph and is
@@ -70,6 +121,14 @@ interface RunScopeResolutionInput {
      * base is safe.
      */
     readonly prebuiltNodeLookup?: ReturnType<typeof buildGraphNodeLookup>;
+    /**
+     * Functionish-node index built ONCE by the caller and shared across every
+     * language pass (#2084 review P2-6). Like `prebuiltNodeLookup`,
+     * `buildFunctionNodeIndex` is a whole-graph scan and is language-agnostic, so
+     * rebuilding it per language wastes a full scan each time. When omitted
+     * (tests / isolated calls) it is built locally for the pdg-enabled language.
+     */
+    readonly prebuiltFunctionNodeIndex?: FunctionNodeIndex;
     /**
      * Opaque per-language import-resolution config (e.g. tsconfig path
      * aliases for TypeScript). Loaded once by the caller via
@@ -127,6 +186,22 @@ interface RunScopeResolutionStats {
     readonly referenceEdgesEmitted: number;
     readonly referenceSkipped: number;
     readonly resolutionOutcomes: readonly ResolutionOutcome[];
+    /**
+     * Per-function taint summaries harvested in the pdg window (#2084 M4 U1).
+     * Empty unless `input.pdg === true` and the language has a registered taint
+     * model. Keyed by resolved `Function`/`Method` node id; the cross-function
+     * fixpoint phase composes them over the complete `CALLS` graph.
+     */
+    readonly functionSummaries: readonly FunctionSummary[];
+    /**
+     * Per-function RETURN-VALUE ASCENT summaries harvested in the pdg window
+     * (PDG FU-C, U-C2). Empty unless `input.pdg === true`. Keyed by resolved
+     * `Function`/`Method`/`Constructor` node id; the whole-program CALL_SUMMARY
+     * emit phase materialises one self-loop edge per entry once the call graph is
+     * known. Unlike {@link functionSummaries} this needs NO taint model — it is
+     * pure data-dependence — so it is harvested for every `--pdg` language.
+     */
+    readonly callSummaries: readonly CallSummary[];
 }
 export declare function runScopeResolution(input: RunScopeResolutionInput, provider: ScopeResolver): RunScopeResolutionStats;
 export {};

package/dist/core/ingestion/scope-resolution/pipeline/run.js

@@ -30,12 +30,20 @@ import { extractParsedFile } from '../../scope-extractor-bridge.js';
 import { finalizeScopeModel } from '../../finalize-orchestrator.js';
 import { resolveReferenceSites } from '../../resolve-references.js';
 import { buildGraphNodeLookup } from '../graph-bridge/node-lookup.js';
+import { emitFileCfgs, emitFileReachingDefs, emitFileCdg, isEmitSafeCfg, DEFAULT_MAX_CFG_EDGES_PER_FUNCTION, DEFAULT_PDG_MAX_REACHING_DEF_EDGES_PER_FUNCTION, DEFAULT_PDG_MAX_REACHING_DEF_FACTS_PER_FUNCTION, DEFAULT_PDG_MAX_CDG_EDGES_PER_FUNCTION, REACHING_DEF_FACTS_PER_EDGE_CAP, } from '../../cfg/emit.js';
+import { createMemoizedReachingDefs } from '../../cfg/reaching-defs.js';
+import { emitFileTaint, DEFAULT_PDG_MAX_TAINT_FINDINGS_PER_FUNCTION, DEFAULT_PDG_MAX_TAINT_HOPS, } from '../../taint/emit.js';
+import { registerBuiltinTaintModels } from '../../taint/typescript-model.js';
+import { getSourceSinkConfig } from '../../taint/source-sink-registry.js';
+import { buildFunctionNodeIndex, harvestFileSummaries, } from '../../taint/summary-harvest-driver.js';
+import { harvestFileCallSummaries } from '../../taint/summary-harvest-driver.js';
 import { resolveDefGraphId } from '../graph-bridge/ids.js';
 import { buildPopulatedMethodDispatch } from '../graph-bridge/method-dispatch.js';
 import { propagateImportedReturnTypes } from '../passes/imported-return-types.js';
 import { emitReceiverBoundCalls } from '../passes/receiver-bound-calls.js';
 import { emitFreeCallFallback } from '../passes/free-call-fallback.js';
 import { emitReferencesViaLookup } from '../graph-bridge/references-to-edges.js';
+import { createCalleeIdAccumulator, } from '../graph-bridge/callee-id-sink.js';
 import { emitImportEdges } from '../graph-bridge/imports-to-edges.js';
 import { findEnclosingClassDef, resolveInheritanceBaseInScope } from '../scope/walkers.js';
 import { buildWorkspaceResolutionIndex } from '../workspace-index.js';
@@ -286,6 +294,8 @@ export function runScopeResolution(input, provider) {
             referenceEdgesEmitted: 0,
             referenceSkipped: 0,
             resolutionOutcomes,
+            functionSummaries: [],
+            callSummaries: [],
         };
     }
     const tExtract = PROF ? process.hrtime.bigint() : 0n;
@@ -427,8 +437,15 @@ export function runScopeResolution(input, provider) {
     // ── Phase 4: emit graph edges (LOAD-BEARING ORDER — see I1) ────────────
     input.onProgress?.('linking symbols', files.length, files.length);
     const handledSites = new Set(preEmittedInheritanceSites);
+    // Resolved-callee-id capture accumulator (#2227 U2). Created ONLY under
+    // `--pdg` — `undefined` otherwise so the three emitters do zero work and emit
+    // byte-identical output (R4). Populated below at all three CALLS emit paths
+    // (each before its dedup, KTD6/R8); consumed by the CFG-emit join (U3) at
+    // `emitFileCfgs` below to produce `BasicBlock.calleeIds`.
+    const calleeIdAccumulator = input.pdg === true ? createCalleeIdAccumulator() : undefined;
     const receiverExtras = emitReceiverBoundCalls(graph, indexes, emitParsedFiles, postHeritageNodeLookup, handledSites, provider, workspaceIndex, readonlyModel, {
         recordResolutionOutcome,
+        calleeIdSink: calleeIdAccumulator,
     });
     const unresolvedReceiverExtras = provider.emitUnresolvedReceiverEdges !== undefined
         ? provider.emitUnresolvedReceiverEdges(graph, indexes, emitParsedFiles, postHeritageNodeLookup, handledSites, readonlyModel)
@@ -440,10 +457,12 @@ export function runScopeResolution(input, provider) {
         isCallableVisibleFromCaller: provider.isCallableVisibleFromCaller,
         resolveAdlCandidates: provider.resolveAdlCandidates,
         conversionRankFn: provider.conversionRankFn,
+        conversionOnlyArgTypePrefixes: provider.conversionOnlyArgTypePrefixes,
         constraintCompatibility: provider.constraintCompatibility,
         recordResolutionOutcome,
+        calleeIdSink: calleeIdAccumulator,
     });
-    const { emitted, skipped } = emitReferencesViaLookup(graph, indexes, referenceIndex, postHeritageNodeLookup, handledSites);
+    const { emitted, skipped } = emitReferencesViaLookup(graph, indexes, referenceIndex, postHeritageNodeLookup, handledSites, calleeIdAccumulator);
     const importsEmitted = emitImportEdges(graph, indexes.imports, indexes.scopeTree, provider.importEdgeReason);
     // Language-specific supplementary edges (e.g. Vue template-derived
     // BINDS_EVENT_HANDLER / EMITS_EVENT / CALLS / ACCESSES edges).
@@ -454,6 +473,330 @@ export function runScopeResolution(input, provider) {
             resolutionConfig,
         });
     }
+    // ── CFG/PDG emission (#2081 M1, opt-in via `--pdg`) ──────────────────────
+    // Emit BasicBlock nodes + CFG edges from each ParsedFile's worker-built
+    // `cfgSideChannel`, HERE — the last point inside scope-resolution where the
+    // ParsedFiles are still loaded (`emitParsedFiles` carries the channel; the
+    // disk store is cleared right after this orchestrator returns, see phase.ts).
+    // A post-`mro` phase would read empty data (KTD1). Off by default ⇒ zero
+    // BasicBlock/CFG nodes/edges and a byte-identical graph.
+    // Accumulated M2 reaching-defs time (solve + dedup + REACHING_DEF emit),
+    // reported as the PROF `pdg=` segment. It is a SUBSET of `emit=` — the M1
+    // CFG emit and the M2 solve interleave per file, so a separate checkpoint
+    // pair can't bracket them; without this accumulator the M2 cost would
+    // silently disappear into `emit=` and field regressions would be invisible.
+    let pdgMs = 0;
+    // M4 (#2084 U1): per-function taint summaries harvested in the pdg window,
+    // returned on the stats for the cross-function fixpoint phase. Function-scoped
+    // so the return (below the pdg block) can read it; empty on non-pdg runs.
+    const harvestedSummaries = [];
+    let summaryUnresolved = 0;
+    // FU-C (U-C2): per-function RETURN-VALUE ASCENT summaries harvested in the
+    // pdg window for the whole-program CALL_SUMMARY emit phase. Function-scoped
+    // (read by the return below the pdg block); empty on non-pdg runs.
+    const harvestedCallSummaries = [];
+    let callSummaryUnresolved = 0;
+    // M3 (#2083 U4): accumulated taint time (match + taint-side solve +
+    // propagate + TAINTED/SANITIZES emit), a sibling of `pdgMs` for the same
+    // reason — it interleaves per file inside `emit=`, so only an accumulator
+    // can bracket it. Printed as the PROF `taint=` segment.
+    let taintMs = 0;
+    if (input.pdg === true) {
+        // Streaming target (#2202): when a sink is provided, BasicBlock nodes +
+        // intra-file PDG edges are routed to CSV-on-disk through it instead of
+        // accumulating in `graph`. The function-node index below is still built
+        // from the real `graph` (Function/Method nodes live there, never the sink).
+        const pdgTarget = input.pdgEmitSink ?? graph;
+        let cfgBlocks = 0;
+        let cfgEdges = 0;
+        let cfgDroppedEdges = 0;
+        let rdEdges = 0;
+        let rdDropped = 0;
+        let rdFacts = 0;
+        let rdTruncated = 0;
+        let cdgEdges = 0;
+        let cdgDropped = 0;
+        let cdgSkippedUnsound = 0;
+        // ── M3 taint setup (#2083 U4) ────────────────────────────────────────
+        // Explicit model-registration seam (idempotent, cheap) — the registry
+        // stays empty on non-pdg runs, preserving default-run parity. The
+        // registry is keyed by `SupportedLanguages` enum VALUES ('typescript' /
+        // 'javascript'), and `ScopeResolver.language` IS a `SupportedLanguages`
+        // member registered under those same constants — the join is direct
+        // equality, no mapping table. A language without a registered spec
+        // (python, go, …) skips taint entirely: no work, no warn spam (KTD8).
+        registerBuiltinTaintModels();
+        const taintSpec = getSourceSinkConfig(provider.language);
+        // Taint-side solver fact cap: the SAME derivation emitFileReachingDefs
+        // uses for the RD projection (edge cap × headroom factor, 0 ⇒ unlimited),
+        // so taint coverage and RD coverage truncate together — a function is
+        // never a taint coverage gap while its RD projection computed, and the
+        // RD layer's per-function truncation warn already names it.
+        const rdEdgeCap = input.pdgMaxReachingDefEdgesPerFunction ?? DEFAULT_PDG_MAX_REACHING_DEF_EDGES_PER_FUNCTION;
+        const taintLimits = {
+            maxFindingsPerFunction: input.pdgMaxTaintFindingsPerFunction ?? DEFAULT_PDG_MAX_TAINT_FINDINGS_PER_FUNCTION,
+            maxHops: input.pdgMaxTaintHops ?? DEFAULT_PDG_MAX_TAINT_HOPS,
+            maxFacts: rdEdgeCap > 0 ? rdEdgeCap * REACHING_DEF_FACTS_PER_EDGE_CAP : 0,
+        };
+        // Cross-file aggregate of EVERY TaintEmitResult counter (the M2 emit
+        // result shipped with two fields dropped on the floor — R4 forbids that
+        // here; gaps/drops feed the unconditional warn below, volume feeds the
+        // per-language debug line).
+        const taintTotals = {
+            analyzed: 0,
+            noMatch: 0,
+            unsafeSites: 0,
+            gapTruncated: 0,
+            gapOverflow: 0,
+            gapNoFacts: 0,
+            findings: 0,
+            kills: 0,
+            dropped: 0,
+            hopsTruncated: 0,
+            gapExamples: [],
+            dropExamples: [],
+        };
+        // M4 (#2084 U1): per-function summary harvest. The functionish-node index
+        // is built ONCE (whole-graph scan) and reused across every file; summaries
+        // accumulate here and ride out on the stats for the cross-function fixpoint
+        // phase. Only built when the language has a registered taint model.
+        // Built whenever pdg is on (NOT gated on taintSpec): the FU-C call-summary
+        // harvest needs it for EVERY language (it is pure data-dependence, no taint
+        // model), and the taint summary harvest reuses it when taintSpec is present.
+        const fnNodeIndex = input.prebuiltFunctionNodeIndex ?? buildFunctionNodeIndex(graph);
+        for (const pf of emitParsedFiles) {
+            const cfgs = pf.cfgSideChannel;
+            // Defensive: cfgSideChannel is opaque (`unknown`) and crosses the cache /
+            // durable store. A stale or wrong-shape value (e.g. a pre-SCHEMA_BUMP
+            // shard that slipped the version gate) must skip emission, not throw a
+            // TypeError mid-graph-build and abort scope-resolution for the language.
+            if (!Array.isArray(cfgs) || cfgs.length === 0)
+                continue;
+            // Cross-pass per-file dedup (#2202): when streaming, a file whose PDG
+            // already streamed in a prior language pass (e.g. a `.ts` module pulled
+            // into the Vue context pass) would re-emit identical ids from the same
+            // cfgSideChannel — the dedup-free streaming sink would double the rows.
+            // Skip it here; the in-memory-graph path needs no skip (its Map dedups).
+            if (input.pdgEmittedFiles !== undefined) {
+                if (input.pdgEmittedFiles.has(pf.filePath))
+                    continue;
+                input.pdgEmittedFiles.add(pf.filePath);
+            }
+            try {
+                // Per-element emit-safety filter (mirrors the parsedfile-store
+                // reviver's POLICY: valid elements in a mixed array still emit; junk
+                // is warned and skipped). isEmitSafeCfg lives in cfg/emit.ts next to
+                // the id templating it defends — see its doc for why anchor-field and
+                // endpoint-membership checks are load-bearing. Runs INSIDE the try so
+                // even a predicate-time throw (e.g. a hostile getter) is isolated.
+                const wellFormed = cfgs.filter(isEmitSafeCfg);
+                if (wellFormed.length < cfgs.length) {
+                    logger.warn(`[cfg] ${pf.filePath}: skipped ${cfgs.length - wellFormed.length} malformed ` +
+                        `cfgSideChannel element(s) (bad shape, missing id-anchor fields, or edge ` +
+                        `endpoints matching no block) — CFG for those functions omitted`);
+                }
+                if (wellFormed.length === 0)
+                    continue;
+                // U3 hook (#2227): the resolved-callee-id map for this file is
+                // `calleeIdAccumulator?.get(pf.filePath)` — joined here by exact
+                // call-site position to emit `BasicBlock.calleeIds`. Captured above at
+                // the three CALLS emit paths (U2); wired into `emitFileCfgs` by U3.
+                const emitted = emitFileCfgs(pdgTarget, wellFormed, input.pdgMaxEdgesPerFunction ?? DEFAULT_MAX_CFG_EDGES_PER_FUNCTION, 
+                // Log cap-overflow drops UNCONDITIONALLY (not via input.onWarn, which is
+                // gated behind the semantic-model validator and silent in production) so
+                // the per-function edge cap never truncates the CFG silently (R6/KTD6).
+                (message) => logger.warn(message), 
+                // U3 (#2227): the resolved-callee-id map for this file (captured at the
+                // three CALLS emit paths in U2), joined by exact call-site position to
+                // emit `BasicBlock.calleeIds`. `undefined` when pdg is off (the
+                // accumulator is only created under `input.pdg === true`).
+                calleeIdAccumulator?.get(pf.filePath));
+                cfgBlocks += emitted.blocks;
+                cfgEdges += emitted.edges;
+                cfgDroppedEdges += emitted.droppedEdges;
+                // R6 (#2227 tri-review-2): release this file's captured id map now that
+                // emitFileCfgs has consumed it — the CALLS passes fully precede this loop
+                // and each file is read exactly once, so this bounds the accumulator to one
+                // file's call sites instead of holding the whole repo's for the phase.
+                calleeIdAccumulator?.delete(pf.filePath);
+                // M2 (#2082 U4): reaching definitions over the same validated CFGs.
+                // In-memory facts are computed per function and dropped after the
+                // bounded (defBlock, useBlock, binding) projection is persisted —
+                // M3 recomputes via the same pure solver in-phase (KTD8). Timing is
+                // PROF-gated like every other checkpoint here (zero cost when off).
+                // U12: one memoized RD solver per file, shared by the RD-emit + call-
+                // summary + taint + summary passes, so the per-function fixpoint runs once
+                // per (limits) bucket instead of 3–4× (#2227 tri-review). File-scoped: it
+                // is re-created each iteration, so its per-function facts drop with the file.
+                const rdSolve = createMemoizedReachingDefs();
+                const t0 = PROF ? performance.now() : 0;
+                const rd = emitFileReachingDefs(pdgTarget, wellFormed, input.pdgMaxReachingDefEdgesPerFunction ??
+                    DEFAULT_PDG_MAX_REACHING_DEF_EDGES_PER_FUNCTION, (message) => logger.warn(message), // unconditional — R7, both layers
+                rdSolve);
+                if (PROF)
+                    pdgMs += performance.now() - t0;
+                rdEdges += rd.edges;
+                rdDropped += rd.droppedEdges;
+                rdFacts += rd.facts;
+                rdTruncated += rd.truncatedFunctions;
+                // M5 (#2085 U5): control dependence over the SAME validated CFGs.
+                // Independent of taint — runs for every `--pdg` language (post-dom +
+                // Ferrante are language-agnostic, no source/sink model needed). Pure
+                // compute; the bounded (controller, dependent, label) projection is
+                // persisted and its time folds into the `pdg=` PROF segment next to RD.
+                const tCdg = PROF ? performance.now() : 0;
+                const cdg = emitFileCdg(pdgTarget, wellFormed, input.pdgMaxCdgEdgesPerFunction ?? DEFAULT_PDG_MAX_CDG_EDGES_PER_FUNCTION, (message) => logger.warn(message));
+                if (PROF)
+                    pdgMs += performance.now() - tCdg;
+                cdgEdges += cdg.edges;
+                cdgDropped += cdg.droppedEdges;
+                cdgSkippedUnsound += cdg.skippedUnsoundFunctions;
+                // FU-C (U-C2): RETURN-VALUE ASCENT summaries over the SAME validated
+                // CFGs, inside the SAME per-file try. Independent of taint — runs for
+                // EVERY `--pdg` language (pure data-dependence, no source/sink model).
+                // Reuses the same RD fact cap the RD/taint solves use (coverage parity).
+                const callHarvest = harvestFileCallSummaries(fnNodeIndex, wellFormed, taintLimits.maxFacts && taintLimits.maxFacts > 0
+                    ? taintLimits.maxFacts
+                    : DEFAULT_PDG_MAX_REACHING_DEF_FACTS_PER_FUNCTION, rdSolve);
+                harvestedCallSummaries.push(...callHarvest.summaries);
+                callSummaryUnresolved += callHarvest.unresolved;
+                // M3 (#2083 U4): taint over the SAME validated CFGs, inside the SAME
+                // per-file try (a taint throw costs this file's taint layer only —
+                // its CFG/REACHING_DEF edges above are already in the graph). Skipped
+                // entirely when the language has no registered model.
+                if (taintSpec !== undefined) {
+                    const t1 = PROF ? performance.now() : 0;
+                    const taint = emitFileTaint(pdgTarget, wellFormed, pf.parsedImports, taintSpec, taintLimits, (message) => logger.warn(message), // unconditional — R4/R6
+                    rdSolve);
+                    if (PROF)
+                        taintMs += performance.now() - t1;
+                    taintTotals.analyzed += taint.functionsAnalyzed;
+                    taintTotals.noMatch += taint.functionsSkippedNoMatch;
+                    taintTotals.unsafeSites += taint.functionsSkippedUnsafeSites;
+                    taintTotals.gapTruncated += taint.functionsCoverageGap.truncated;
+                    taintTotals.gapOverflow += taint.functionsCoverageGap.overflow;
+                    taintTotals.gapNoFacts += taint.functionsCoverageGap['no-facts'];
+                    taintTotals.findings += taint.findingsEmitted;
+                    taintTotals.kills += taint.killsEmitted;
+                    taintTotals.dropped += taint.findingsDropped;
+                    taintTotals.hopsTruncated += taint.hopsTruncatedFindings;
+                    for (const ex of taint.coverageGapExamples) {
+                        if (taintTotals.gapExamples.length < 5)
+                            taintTotals.gapExamples.push(ex);
+                    }
+                    for (const ex of taint.droppedExamples) {
+                        if (taintTotals.dropExamples.length < 5)
+                            taintTotals.dropExamples.push(ex);
+                    }
+                    // M4 (#2084 U1): harvest per-function summaries over the SAME
+                    // emit-safe CFGs, inside the SAME per-file try. Pure aside from the
+                    // read-only node-index lookup; the cross-function fixpoint phase
+                    // consumes `harvestedSummaries` once the whole call graph is built.
+                    if (fnNodeIndex !== undefined) {
+                        const harvest = harvestFileSummaries(fnNodeIndex, wellFormed, pf.parsedImports, taintSpec, 
+                        // Same fact cap the taint-side RD solve uses (coverage parity).
+                        taintLimits.maxFacts && taintLimits.maxFacts > 0
+                            ? taintLimits.maxFacts
+                            : DEFAULT_PDG_MAX_REACHING_DEF_FACTS_PER_FUNCTION, rdSolve);
+                        harvestedSummaries.push(...harvest.summaries);
+                        summaryUnresolved += harvest.unresolved;
+                    }
+                }
+            }
+            catch (err) {
+                // Last-resort isolation, mirroring the worker-side per-file try/catch:
+                // a shape the predicate misses must cost this one file's CFG, not
+                // abort the language's whole scope-resolution pass mid-graph-build.
+                // NOTE a mid-emit throw can leave this file's already-inserted
+                // BasicBlock nodes in the graph (addNode is not transactional) —
+                // orphaned but inert; the predicate keeps every JSON-representable
+                // bad shape from reaching this path at all.
+                logger.warn(`[cfg] ${pf.filePath}: CFG emission failed (${err instanceof Error ? err.message : String(err)}) — ` +
+                    `this file's CFG is partial or absent`);
+            }
+        }
+        if (cfgBlocks > 0) {
+            logger.debug(`[scope-resolution] CFG emit (lang=${provider.language}): ` +
+                `${cfgBlocks} BasicBlock nodes, ${cfgEdges} CFG edges` +
+                (cfgDroppedEdges > 0 ? `, ${cfgDroppedEdges} edges dropped (per-function cap)` : '') +
+                `; ${rdEdges} REACHING_DEF edges (${rdFacts} facts)` +
+                (rdDropped > 0 ? `, ${rdDropped} REACHING_DEF edges dropped (per-function cap)` : '') +
+                (rdTruncated > 0 ? `, ${rdTruncated} function(s) hit the fact limit` : '') +
+                `; ${cdgEdges} CDG edges` +
+                (cdgDropped > 0 ? `, ${cdgDropped} CDG edges dropped (per-function cap)` : '') +
+                (cdgSkippedUnsound > 0
+                    ? `, ${cdgSkippedUnsound} function(s) CDG-skipped (EXIT not reachable from all blocks)`
+                    : '') +
+                // M3 volume telemetry — only for languages with a registered model.
+                (taintSpec !== undefined
+                    ? `; taint: ${taintTotals.findings} TAINTED, ${taintTotals.kills} SANITIZES ` +
+                        `(${taintTotals.analyzed} function(s) analyzed, ` +
+                        `${taintTotals.noMatch} skipped: no source/sink match` +
+                        (taintTotals.hopsTruncated > 0
+                            ? `, ${taintTotals.hopsTruncated} finding(s) with truncated hop paths`
+                            : '') +
+                        `)`
+                    : ''));
+        }
+        // R8 (#2195): CDG soundness skips surface UNCONDITIONALLY (parity with the
+        // taint/RD gap warns) — not buried in the logger.debug stats line above. A
+        // function whose EXIT is not reverse-reachable from every block gets NO
+        // control dependence (an unmodeled non-terminating / multi-terminal CFG
+        // shape the synthetic-escape pass could not bridge). Withholding CDG
+        // silently would let a language's control dependence erode unnoticed; CFG
+        // and REACHING_DEF do not depend on post-dominance and are unaffected.
+        if (cdgSkippedUnsound > 0) {
+            logger.warn(`[cfg] lang=${provider.language}: ${cdgSkippedUnsound} function(s) had control ` +
+                `dependence skipped (EXIT not reverse-reachable from all blocks); ` +
+                `CFG and REACHING_DEF are unaffected`);
+        }
+        // R4: taint coverage gaps and cap drops surface UNCONDITIONALLY (never
+        // logger.debug, never input.onWarn) at the per-language aggregate, with
+        // counts and up to 5 example functions. Per-function warns above cover
+        // the rare/actionable cases (unsafe sites, cap drops); solver-status gaps
+        // were already per-function-warned by the RD layer (same solver, same
+        // fact cap), so this aggregate is their single taint-side surface.
+        if (taintSpec !== undefined) {
+            const gapCount = taintTotals.unsafeSites +
+                taintTotals.gapTruncated +
+                taintTotals.gapOverflow +
+                taintTotals.gapNoFacts;
+            if (gapCount > 0 || taintTotals.dropped > 0) {
+                const parts = [];
+                if (gapCount > 0) {
+                    parts.push(`${gapCount} function(s) skipped for taint ` +
+                        `(${taintTotals.gapTruncated} fact-limit, ${taintTotals.gapOverflow} overflow, ` +
+                        `${taintTotals.gapNoFacts} no-facts, ${taintTotals.unsafeSites} malformed sites)` +
+                        (taintTotals.gapExamples.length > 0
+                            ? ` — e.g. ${taintTotals.gapExamples.join(', ')}`
+                            : ''));
+                }
+                if (taintTotals.dropped > 0) {
+                    parts.push(`${taintTotals.dropped} finding(s) dropped by the per-function cap` +
+                        (taintTotals.dropExamples.length > 0
+                            ? ` — e.g. ${taintTotals.dropExamples.join(', ')}`
+                            : ''));
+                }
+                logger.warn(`[taint] lang=${provider.language}: ${parts.join('; ')}`);
+            }
+        }
+        // M4 (#2084 U1): summary harvest volume + anchor-resolution diagnostics.
+        if (harvestedSummaries.length > 0 || summaryUnresolved > 0) {
+            logger.debug(`[taint-summary] lang=${provider.language}: ${harvestedSummaries.length} function ` +
+                `summary/summaries harvested` +
+                (summaryUnresolved > 0
+                    ? `, ${summaryUnresolved} CFG anchor(s) unresolved (same-line collision or missing node)`
+                    : ''));
+        }
+        // FU-C (U-C2): call-summary harvest volume + anchor-resolution diagnostics.
+        if (harvestedCallSummaries.length > 0 || callSummaryUnresolved > 0) {
+            logger.debug(`[call-summary] lang=${provider.language}: ${harvestedCallSummaries.length} function ` +
+                `return-ascent summary/summaries harvested` +
+                (callSummaryUnresolved > 0
+                    ? `, ${callSummaryUnresolved} CFG anchor(s) unresolved (same-line collision or missing node)`
+                    : ''));
+        }
+    }
     if (PROF) {
         const tEnd = process.hrtime.bigint();
         const ns = (a, b) => Number(b - a) / 1_000_000;
@@ -462,6 +805,9 @@ export function runScopeResolution(input, provider) {
             ` propagate=${ns(tFinalize, tPropagate).toFixed(0)}ms` +
             ` resolve=${ns(tPropagate, tResolve).toFixed(0)}ms` +
             ` emit=${ns(tResolve, tEnd).toFixed(0)}ms` +
+            // pdg ⊆ emit: the M2 reaching-defs share of the emit bucket (#2082 U4).
+            // taint ⊆ emit likewise: the M3 match+solve+propagate+emit share (#2083 U4).
+            (input.pdg === true ? ` pdg=${pdgMs.toFixed(0)}ms taint=${taintMs.toFixed(0)}ms` : '') +
             ` total=${ns(tStart, tEnd).toFixed(0)}ms` +
             ` (${parsedFiles.length} files)`);
     }
@@ -474,5 +820,7 @@ export function runScopeResolution(input, provider) {
         referenceEdgesEmitted: emitted + receiverExtras + unresolvedReceiverExtras + freeCallExtras,
         referenceSkipped: skipped,
         resolutionOutcomes,
+        functionSummaries: harvestedSummaries,
+        callSummaries: harvestedCallSummaries,
     };
 }

package/dist/core/ingestion/scope-resolution/resolution-outcome.d.ts

@@ -1,5 +1,5 @@
 import type { Range } from '../../../_shared/index.js';
-export type ResolutionSuppressionReason = 'adl-ordinary-lookup-blocked' | 'conversion-rank-tied' | 'inline-ns-ambiguous' | 'member-lookup-ambiguous' | 'overload-ambiguous' | 'overload-ambiguous-normalization';
+export type ResolutionSuppressionReason = 'adl-ordinary-lookup-blocked' | 'conversion-rank-tied' | 'inline-ns-ambiguous' | 'member-lookup-ambiguous' | 'selected-callable-deleted' | 'overload-ambiguous' | 'overload-ambiguous-normalization';
 export type ResolutionOutcome = {
     readonly kind: 'resolved';
     readonly targetId: string;

package/dist/core/ingestion/taint/call-summary-codec.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Call-summary reason codec (PDG FU-C, U-C2) — the ONE shared encoder/decoder
+ * for the bitset carried on persisted `CALL_SUMMARY` edges.
+ *
+ * A `CALL_SUMMARY` edge is a self-loop on a Function/Method/Constructor node
+ * recording that callee's RETURN-VALUE ASCENT: for each formal-parameter index,
+ * whether that parameter flows to the function's return value. The producer
+ * (the whole-program emit phase) writes this; a later consumer phase reads it to
+ * ascend a callee's return effect into the caller continuation. Two hand-rolled
+ * copies of a wire format drift — both sides MUST import from here (the same
+ * discipline `path-codec.ts` documents).
+ *
+ * ## Wire format (version `1`)
+ *
+ * ```
+ * 1|r:<hexbitset>[|<reserved-segment>…]
+ * ```
+ *
+ * - One-character version prefix ({@link CALL_SUMMARY_CODEC_VERSION}), then `|`,
+ *   then a `r:` (return) segment whose payload is the param→return bitset as a
+ *   lowercase hex string (LSB = formal index 0). Bit `i` set ⇒ formal parameter
+ *   `i` flows to the return value. An empty/zero bitset is the absence of any
+ *   return-flow (a sound EMPTY summary — never a false claim).
+ * - FORWARD COMPATIBILITY: the format reserves space for future facts via
+ *   additional trailing `|<tag>:<payload>` segments (planned: `o:` out-params,
+ *   `e:` exception ascent — both deferred: out-params need an alias model,
+ *   exception ascent needs try/catch CDG). The decoder accepts and ignores any
+ *   trailing segment whose tag it does not understand, so a future writer's
+ *   output stays decodable by today's reader (and vice-versa: today's reader
+ *   only requires the `r:` segment). Reserved tags MUST stay disjoint from `r`.
+ *
+ * ## Delimiter / round-trip discipline (mirrors path-codec KTD6)
+ *
+ * Every structural character (`|`, `:`, the version digit, hex digits `[0-9a-f]`)
+ * is printable ASCII, so the encoding survives `escapeCSVField ∘ sanitizeUTF8`
+ * (csv-generator.ts) byte-exact (pinned by the round-trip test). The hex payload
+ * is a non-negative integer rendered via BigInt, so the codec handles functions
+ * with arbitrarily many formal parameters without overflow.
+ *
+ * The decoder NEVER throws — anything malformed yields a typed failure, exactly
+ * like `decodeTaintPath`. A decode failure on the consumer side means "no usable
+ * ascent fact", which is the sound default (never claim a false return-flow).
+ */
+/** One-character format version prefix. Bump on any wire-format change. */
+export declare const CALL_SUMMARY_CODEC_VERSION = "1";
+/** A decoded call summary's facts. Forward-compatible: future facts add fields. */
+export interface DecodedCallSummary {
+    readonly ok: true;
+    readonly version: string;
+    /**
+     * Sorted, de-duplicated formal-parameter indices that flow to the return
+     * value (ascending). Empty ⇒ no return-flow recorded (sound EMPTY summary).
+     */
+    readonly returnFlowParams: readonly number[];
+}
+/** Typed parse failure — the decoder never throws. */
+export interface CallSummaryDecodeFailure {
+    readonly ok: false;
+    readonly error: string;
+}
+export type CallSummaryDecodeResult = DecodedCallSummary | CallSummaryDecodeFailure;
+/**
+ * Encode the param→return ascent into the versioned `reason` wire string.
+ * Deterministic; never throws. `returnFlowParams` is the set of formal indices
+ * that flow to the return value (order/duplication irrelevant — the bitset
+ * canonicalises). An empty set encodes as `r:0` (an explicit empty summary).
+ */
+export declare function encodeCallSummary(returnFlowParams: Iterable<number>): string;
+/**
+ * Decode a `CALL_SUMMARY` reason wire string into its ascent facts. Returns a
+ * typed failure for anything that is not a well-formed version-`1` summary —
+ * never throws. Unknown trailing segments (future facts) are accepted and
+ * ignored (forward compatibility).
+ */
+export declare function decodeCallSummary(reason: unknown): CallSummaryDecodeResult;