gitnexus 1.6.8-rc.9 → 1.6.8

package/dist/core/ingestion/pipeline-phases/taint-summaries.js

@@ -0,0 +1,81 @@
+/**
+ * Phase: taintSummaries (#2084 M4 U3/U5)
+ *
+ * The interprocedural taint fixpoint. Runs AFTER scope-resolution (where the
+ * complete, resolved `CALLS` graph lives in `ctx.graph` and the per-function
+ * summaries were harvested in-phase) and composes those summaries to find
+ * source→sink flows that cross function and file boundaries.
+ *
+ * Opt-in: registered with `enabledWhen: (o) => o.pdg === true` (the first real
+ * pdg-gated phase). A default `analyze` run never includes it, so the graph is
+ * byte-identical. No always-on phase depends on it (a filtered-out dep would
+ * throw in `getPhaseOutput`).
+ *
+ * @deps    scopeResolution, pruneLocalSymbols
+ * @reads   graph (CALLS edges, Function/Method nodes), scopeResolution output
+ *          (functionSummaries)
+ * @writes  graph (TAINT_PATH edges)
+ */
+import { getPhaseOutput } from './types.js';
+import { solveInterprocTaint, DEFAULT_MAX_INTERPROC_HOPS, DEFAULT_PDG_MAX_INTERPROC_FINDINGS, } from '../taint/interproc-solver.js';
+import { emitInterprocTaint, DEFAULT_PDG_MAX_INTERPROC_EDGES } from '../taint/interproc-emit.js';
+import { logger } from '../../logger.js';
+const EMPTY = {
+    summaries: 0,
+    findings: 0,
+    edgesEmitted: 0,
+    unmatchedCallSites: 0,
+};
+export const taintSummariesPhase = {
+    name: 'taintSummaries',
+    deps: ['scopeResolution', 'pruneLocalSymbols'],
+    async execute(ctx, deps) {
+        const scope = getPhaseOutput(deps, 'scopeResolution');
+        const summaries = scope.functionSummaries;
+        if (summaries.length === 0)
+            return EMPTY;
+        // Index summaries by function node id.
+        const summaryMap = new Map(summaries.map((s) => [s.fnId, s]));
+        // Build the call-edge adjacency from resolved CALLS edges. The join to a
+        // summary's call-arg edge is by CALLEE NAME (base-independent — see the
+        // solver doc); recover it from the callee node's `name` property.
+        const callEdges = [];
+        for (const rel of ctx.graph.iterRelationshipsByType('CALLS')) {
+            const callee = ctx.graph.getNode(rel.targetId);
+            const calleeName = callee && typeof callee.properties.name === 'string' ? callee.properties.name : undefined;
+            if (calleeName === undefined)
+                continue;
+            callEdges.push({ callerId: rel.sourceId, calleeId: rel.targetId, calleeName });
+        }
+        // Arm the per-run caps (#2084 review P1-3) — every other pdg layer bounds
+        // its output via RepoMeta.pdg; without this the fixpoint state + TAINT_PATH
+        // edges grow unbounded on a fan-in-heavy repo (OOM). `0` ⇒ unlimited
+        // (preserved like the other pdg caps). The solver/emit already implement
+        // deterministic truncate-and-warn — this just hands them the budgets.
+        const maxFindings = ctx.options?.pdgMaxInterprocFindings ?? DEFAULT_PDG_MAX_INTERPROC_FINDINGS;
+        const maxHops = ctx.options?.pdgMaxInterprocHops ?? DEFAULT_MAX_INTERPROC_HOPS;
+        const maxEdges = ctx.options?.pdgMaxInterprocEdges ?? DEFAULT_PDG_MAX_INTERPROC_EDGES;
+        const solved = solveInterprocTaint(summaryMap, callEdges, { maxFindings, maxHops });
+        const emit = emitInterprocTaint(ctx.graph, solved.findings, { maxEdges }, (m) => logger.warn(m));
+        // Surface drops UNCONDITIONALLY (R4 — never silently truncate the layer).
+        if (solved.droppedFindings > 0 || emit.edgesDropped > 0) {
+            logger.warn(`[taint-interproc] capped: ${solved.droppedFindings} finding(s) dropped by the ` +
+                `per-run findings cap (${maxFindings}), ${emit.edgesDropped} edge(s) by the edge cap ` +
+                `(${maxEdges}) — raise pdgMaxInterprocFindings/pdgMaxInterprocEdges if intentional`);
+        }
+        if (solved.findings.length > 0 || emit.edgesEmitted > 0) {
+            logger.debug(`[taint-interproc] ${summaries.length} summaries, ${callEdges.length} CALLS edges → ` +
+                `${solved.findings.length} cross-function finding(s), ${emit.edgesEmitted} TAINT_PATH edge(s)` +
+                (emit.hopsTruncated > 0 ? `, ${emit.hopsTruncated} with truncated paths` : '') +
+                (solved.unmatchedCallSites > 0
+                    ? `, ${solved.unmatchedCallSites} unmatched call site(s)`
+                    : ''));
+        }
+        return {
+            summaries: summaries.length,
+            findings: solved.findings.length,
+            edgesEmitted: emit.edgesEmitted,
+            unmatchedCallSites: solved.unmatchedCallSites,
+        };
+    },
+};

package/dist/core/ingestion/pipeline.d.ts

@@ -25,6 +25,98 @@ export interface PipelineOptions {
      * to retain those nodes under `skipGraphPhases`.
      */
     skipGraphPhases?: boolean;
+    /**
+     * Build the control-flow-graph / PDG substrate (#2081 M1, opt-in via `--pdg`).
+     * Off by default: workers skip all CFG work and emit no `cfgSideChannel`, and
+     * scope-resolution emits no BasicBlock nodes or CFG edges — so the default
+     * graph is byte-identical to a pre-#2081 run. Folded into the parse-cache key
+     * so a pdg-off warm cache is not reused on a `--pdg` run.
+     */
+    pdg?: boolean;
+    /**
+     * Per-function source-line cap for worker-side CFG construction.
+     * `undefined` ⇒ the worker applies `DEFAULT_PDG_MAX_FUNCTION_LINES`; `0` ⇒ no
+     * cap (unlimited). Bounds the cost of a pathological mega-function; over-cap
+     * functions are skipped (no CFG emitted for them). No CLI flag in M1 —
+     * programmatic / server analyze-worker path only.
+     */
+    pdgMaxFunctionLines?: number;
+    /**
+     * Per-function CFG edge cap for the scope-resolution emit step.
+     * `undefined` ⇒ `DEFAULT_MAX_CFG_EDGES_PER_FUNCTION`; `0` ⇒ no cap (unlimited).
+     * Over-cap functions stop at the cap and log a structured drop warning (no
+     * silent truncation). No CLI flag in M1 — programmatic / server path only.
+     */
+    pdgMaxEdgesPerFunction?: number;
+    /**
+     * Per-function REACHING_DEF edge cap for the scope-resolution emit step
+     * (#2082 M2). `undefined` ⇒ `DEFAULT_PDG_MAX_REACHING_DEF_EDGES_PER_FUNCTION`
+     * (4000); `0` ⇒ no cap (unlimited). Emit-time-only — NOT folded into the
+     * parse-cache chunk key (the worker never sees it); recorded in
+     * `RepoMeta.pdg` so a cap change forces a full writeback. No CLI flag —
+     * programmatic / server path only, like the M1 caps.
+     */
+    pdgMaxReachingDefEdgesPerFunction?: number;
+    /**
+     * Per-function CDG (control-dependence) edge cap for the scope-resolution
+     * emit step (#2085 M5). `undefined` ⇒ `DEFAULT_PDG_MAX_CDG_EDGES_PER_FUNCTION`
+     * (5000); `0` ⇒ no cap (unlimited). Emit-time-only — NOT folded into the
+     * parse-cache chunk key; recorded resolved in `RepoMeta.pdg` so introducing
+     * CDG (an absent stamp key) forces a full writeback for pre-CDG `--pdg`
+     * indexes. No CLI flag — programmatic / server path only.
+     */
+    pdgMaxCdgEdgesPerFunction?: number;
+    /**
+     * Per-function taint findings cap for the scope-resolution taint pass
+     * (#2083 M3). `undefined` ⇒ `DEFAULT_PDG_MAX_TAINT_FINDINGS_PER_FUNCTION`
+     * (200); `0` ⇒ no cap (unlimited). Emit-time-only — NOT folded into the
+     * parse-cache chunk key; recorded resolved in `RepoMeta.pdg` so a cap
+     * change forces a full writeback. No CLI flag or rc key (KTD8) —
+     * programmatic / server path only, like the other pdg caps.
+     */
+    pdgMaxTaintFindingsPerFunction?: number;
+    /**
+     * Per-finding taint hop cap (#2083 M3, KTD6 — bounds the persisted
+     * hop-encoded `reason`). `undefined` ⇒ `DEFAULT_PDG_MAX_TAINT_HOPS` (32);
+     * `0` ⇒ no cap (unlimited). Same emit-time-only / RepoMeta-stamped /
+     * no-CLI-flag discipline as `pdgMaxTaintFindingsPerFunction`.
+     */
+    pdgMaxTaintHops?: number;
+    /**
+     * Per-run cross-function findings cap (#2084 M4 review P1-3). `undefined` ⇒
+     * `DEFAULT_PDG_MAX_INTERPROC_FINDINGS` (2000); `0` ⇒ no cap. Consumed by the
+     * `taintSummaries` phase; RepoMeta-stamped, no CLI flag (KTD8) — same
+     * discipline as the per-function taint caps.
+     */
+    pdgMaxInterprocFindings?: number;
+    /** Per-finding cross-function hop cap (#2084 review P1-3). `undefined` ⇒
+     *  `DEFAULT_MAX_INTERPROC_HOPS` (32); `0` ⇒ no cap. */
+    pdgMaxInterprocHops?: number;
+    /** Per-run `TAINT_PATH` edge cap (#2084 review P1-3). `undefined` ⇒
+     *  `DEFAULT_PDG_MAX_INTERPROC_EDGES` (1000); `0` ⇒ no cap. */
+    pdgMaxInterprocEdges?: number;
+    /** Per-run `CALL_SUMMARY` edge cap (PDG FU-C, U-C3). `undefined` ⇒
+     *  `DEFAULT_PDG_MAX_CALL_SUMMARY_EDGES` (0 = unlimited); `0` ⇒ no cap.
+     *  Programmatic only, no CLI flag (KTD8) — same discipline as the other
+     *  pdg caps. */
+    pdgMaxCallSummaryEdges?: number;
+    /**
+     * Streaming/chunked PDG graph emit (#2202). When true, the BasicBlock +
+     * intra-file PDG-edge layer (CFG / REACHING_DEF / CDG / POST_DOMINATE /
+     * TAINTED / SANITIZES) is streamed to CSV-on-disk during the scope-resolution
+     * emit loop instead of being materialized in the in-memory graph, bounding
+     * peak RSS to O(chunk) rather than O(graph) at full-kernel scale. Already
+     * gated by the caller to full-rebuild runs only (the incremental writeback
+     * reads BasicBlocks back from the in-memory graph). Memory-only — produces a
+     * byte-identical persisted graph and is NOT part of `RepoMeta.pdg`, so
+     * toggling it never trips `pdgModeMismatch`. Default/false ⇒ today's
+     * whole-graph emit.
+     */
+    streamPdgEmit?: boolean;
+    /** Streamed PDG-emit write buffer (rows) when `streamPdgEmit` is on (#2202).
+     *  `undefined` ⇒ `DEFAULT_PDG_EMIT_CHUNK_ROWS`. Memory-only; does not affect
+     *  emitted bytes. */
+    pdgEmitChunkSize?: number;
     /**
      * Request parsing with the worker pool disabled. The sequential parser was
      * removed — the worker pool is the sole parse path — so setting this now
@@ -33,16 +125,6 @@ export interface PipelineOptions {
      * silently-different result.
      */
     skipWorkers?: boolean;
-    /**
-     * @internal Test-only override for the worker script URL the pool
-     * spawns. When unset, parse-impl resolves `parse-worker.js` from the
-     * adjacent `workers/` directory (or the compiled `dist/` fallback
-     * under vitest). Integration tests use this to inject a custom
-     * worker script that deterministically triggers worker-pool
-     * resilience paths (e.g., crash-on-poison-file). Do not use from production
-     * call sites.
-     */
-    workerUrlForTest?: URL;
     /**
      * Incremental-indexing parse cache. When provided:
      *   - The parse phase looks up each chunk's content hash in

package/dist/core/ingestion/pipeline.js

@@ -15,7 +15,7 @@
  * See ARCHITECTURE.md for the full phase dependency diagram.
  */
 import { createKnowledgeGraph } from '../graph/graph.js';
-import { runPipeline, getPhaseOutput, scanPhase, structurePhase, markdownPhase, cobolPhase, parsePhase, routesPhase, toolsPhase, ormPhase, crossFilePhase, scopeResolutionPhase, pruneLocalSymbolsPhase, mroPhase, communitiesPhase, processesPhase, PhaseRegistry, } from './pipeline-phases/index.js';
+import { runPipeline, getPhaseOutput, scanPhase, structurePhase, markdownPhase, cobolPhase, parsePhase, routesPhase, toolsPhase, ormPhase, crossFilePhase, scopeResolutionPhase, pruneLocalSymbolsPhase, taintSummariesPhase, callSummariesPhase, mroPhase, communitiesPhase, processesPhase, PhaseRegistry, } from './pipeline-phases/index.js';
 // ── Phase registry ─────────────────────────────────────────────────────────
 /**
  * All pipeline phases with their dependency relationships.
@@ -49,6 +49,11 @@ export function buildPhaseList(options) {
         .register(crossFilePhase)
         .register(scopeResolutionPhase)
         .register(pruneLocalSymbolsPhase)
+        // M4 (#2084): interprocedural taint fixpoint — the first real opt-in
+        // pdg-gated phase. Off ⇒ absent ⇒ byte-identical graph. No always-on
+        // phase depends on it (a filtered-out dep would throw in getPhaseOutput).
+        .register(taintSummariesPhase, { enabledWhen: (o) => o.pdg === true })
+        .register(callSummariesPhase, { enabledWhen: (o) => o.pdg === true })
         .register(mroPhase, { enabledWhen: (o) => !o.skipGraphPhases })
         .register(communitiesPhase, { enabledWhen: (o) => !o.skipGraphPhases })
         .register(processesPhase, { enabledWhen: (o) => !o.skipGraphPhases })
@@ -72,7 +77,10 @@ export const runPipelineFromRepo = async (repoPath, onProgress, options) => {
     const { totalFiles, usedWorkerPool } = getPhaseOutput(results, 'parse');
     let communityResult;
     let processResult;
-    const resolutionOutcomes = getPhaseOutput(results, 'scopeResolution').resolutionOutcomes;
+    const scopeResolutionOutput = getPhaseOutput(results, 'scopeResolution');
+    const resolutionOutcomes = scopeResolutionOutput.resolutionOutcomes;
+    // Streamed PDG-emit manifest (#2202): present only when streaming was on.
+    const pdgEmitManifest = scopeResolutionOutput.pdgEmitManifest;
     if (!options?.skipGraphPhases) {
         communityResult = getPhaseOutput(results, 'communities').communityResult;
         processResult = getPhaseOutput(results, 'processes').processResult;
@@ -97,5 +105,6 @@ export const runPipelineFromRepo = async (repoPath, onProgress, options) => {
         processResult,
         resolutionOutcomes,
         usedWorkerPool,
+        pdgEmitManifest,
     };
 };

package/dist/core/ingestion/scope-extractor.js

@@ -399,6 +399,7 @@ function buildDefFromDeclarationMatch(match, anchor, filePath) {
     const returnType = match['@declaration.return-type']?.text;
     const templateConstraints = parseJsonCapture(match['@declaration.template-constraints']);
     const isExplicit = parseBooleanCapture(match['@declaration.is-explicit']);
+    const isDeleted = parseBooleanCapture(match['@declaration.is-deleted']);
     return {
         nodeId: makeDefId(filePath, anchor.range, type, nameCap.text),
         filePath,
@@ -413,6 +414,7 @@ function buildDefFromDeclarationMatch(match, anchor, filePath) {
         ...(templateArguments !== undefined ? { templateArguments } : {}),
         ...(templateConstraints !== undefined ? { templateConstraints } : {}),
         ...(isExplicit === true ? { isExplicit: true } : {}),
+        ...(isDeleted === true ? { isDeleted: true } : {}),
     };
 }
 /** Parse an opaque JSON payload synthesized by per-language captures
@@ -475,12 +477,19 @@ function parseJsonParameterTypeClassesCapture(cap) {
             if (typeof o.pointerDepth !== 'number' || !Number.isFinite(o.pointerDepth)) {
                 return undefined;
             }
-            out.push({
+            const shape = {
                 base: o.base,
                 cv: o.cv,
                 indirection: o.indirection,
                 pointerDepth: o.pointerDepth,
-            });
+            };
+            if (Array.isArray(o.templateArguments)) {
+                if (!o.templateArguments.every((x) => typeof x === 'string')) {
+                    return undefined;
+                }
+                shape.templateArguments = [...o.templateArguments];
+            }
+            out.push(shape);
         }
         return out;
     }
@@ -922,6 +931,7 @@ const KNOWN_SUB_TAGS = new Set([
     '@declaration.return-type',
     '@declaration.template-constraints',
     '@declaration.is-explicit',
+    '@declaration.is-deleted',
 ]);
 /**
  * Return the anchor capture for a match — the one whose name begins with

package/dist/core/ingestion/scope-resolution/contract/scope-resolver.d.ts

@@ -618,6 +618,15 @@ export interface ScopeResolver {
      * `cppConversionRank`; other languages define their own if needed.
      */
     readonly conversionRankFn?: ConversionRankFn;
+    /**
+     * Optional per-language argument-type prefixes for conversion-only
+     * argument sentinels. When ranking cannot find any viable candidate
+     * for a multi-overload set containing one of these sentinels, shared
+     * narrowing suppresses the ambiguous set instead of falling back to
+     * arity-only candidates. Languages without such sentinels leave this
+     * undefined.
+     */
+    readonly conversionOnlyArgTypePrefixes?: readonly string[];
     /**
      * Optional predicate to identify definitions with file-local linkage
      * (e.g. C `static` functions). When provided, `pickUniqueGlobalCallable`

package/dist/core/ingestion/scope-resolution/graph-bridge/callee-id-sink.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Resolved-callee-id capture sink (#2227 follow-up plan U2).
+ *
+ * During Phase-4 scope-resolution CALLS-edge emission, each resolved call
+ * site's `(callSiteLine, callSiteCol) → resolvedCalleeId` mapping is
+ * accumulated here — across ALL THREE CALLS emit paths
+ * (`emitReceiverBoundCalls` via `tryEmitEdge`/`tryEmitEdgeWithExplicitTargetId`,
+ * and the inline `graph.addRelationship` in `emitFreeCallFallback` and
+ * `emitReferencesViaLookup`), each BEFORE its dedup (KTD6/R8). A later unit
+ * (U3) joins this map to CFG `BasicBlock`s by exact call-site position and
+ * emits a `BasicBlock.calleeIds` set.
+ *
+ * KEY ALIGNMENT (plan KTD7 — load-bearing): the key is the call/new
+ * expression node's start position — `line` 1-based (`startPosition.row + 1`),
+ * `col` 0-based (`startPosition.column`). This MUST equal the U1
+ * `SiteRecord.at` so the U3 position join lands. The CALLS resolution exposes
+ * the same node's range via `site.atRange` (`atRange: anchor.range`,
+ * scope-extractor.ts:1030), whose `startLine`/`startCol` are built by
+ * `nodeToCapture` as `row + 1` / `column` (1-based line, 0-based col — see the
+ * `Range` doc in gitnexus-shared). So a capture keyed on
+ * `(atRange.startLine, atRange.startCol)` is byte-equal to U1's `at` — no
+ * normalization needed.
+ *
+ * Gating (R4): the concrete sink is created in `run.ts` only when
+ * `input.pdg === true`; otherwise `undefined` is threaded through, so off-mode
+ * does zero work and emits byte-identical output.
+ *
+ * Multi-target dispatch (R2/KTD8): one site → multiple emit calls → the `Set`
+ * accumulates every resolved target. Capture is per-emit-call, so the
+ * candidate set is complete and a real target is never dropped.
+ */
+/** Encoded position key: `${line}:${col}` (1-based line, 0-based col). */
+export type CalleeIdPosKey = string;
+/** Build the position key from a call-site anchor. Single source of truth so
+ *  producer (this sink) and consumer (U3's CFG join) encode positions
+ *  identically. */
+export declare function calleeIdPosKey(line: number, col: number): CalleeIdPosKey;
+/**
+ * Write-side contract handed to the three CALLS emitters. Each resolved CALLS
+ * edge feeds one `add` BEFORE its dedup, keyed on the call-site anchor.
+ */
+export interface CalleeIdSink {
+    /**
+     * Record that the call site at `(line, col)` in `filePath` resolved to
+     * `calleeId`. Idempotent per `(filePath, line, col, calleeId)` — the
+     * underlying value is a `Set`, so repeat targets collapse.
+     */
+    add(filePath: string, line: number, col: number, calleeId: string): void;
+}
+/**
+ * Read-side accessor consumed by U3's CFG-emit join. Returns the per-file
+ * `posKey → Set<calleeId>` map (or `undefined` when the file produced no
+ * captures). Kept separate from the write interface so the emitters only see
+ * the narrow `add` surface.
+ */
+export interface CalleeIdMapView {
+    /** Per-file position→ids map, or `undefined` if nothing was captured for it. */
+    get(filePath: string): ReadonlyMap<CalleeIdPosKey, ReadonlySet<string>> | undefined;
+    /**
+     * Release a file's captured map once its CFG emit has consumed it (R6). The
+     * three CALLS passes fully precede the CFG-emit loop and each file is read
+     * exactly once, so releasing after consumption bounds the accumulator to one
+     * file's call sites instead of holding the whole repo's for the full phase.
+     */
+    delete(filePath: string): void;
+}
+/** The concrete accumulator: a write sink that also exposes the read view. */
+export interface CalleeIdAccumulator extends CalleeIdSink, CalleeIdMapView {
+}
+/**
+ * Create the concrete nested-`Map` accumulator. Call ONLY when
+ * `input.pdg === true` (else thread `undefined` for byte-identity / zero
+ * overhead — R4).
+ */
+export declare function createCalleeIdAccumulator(): CalleeIdAccumulator;

package/dist/core/ingestion/scope-resolution/graph-bridge/callee-id-sink.js

@@ -0,0 +1,67 @@
+/**
+ * Resolved-callee-id capture sink (#2227 follow-up plan U2).
+ *
+ * During Phase-4 scope-resolution CALLS-edge emission, each resolved call
+ * site's `(callSiteLine, callSiteCol) → resolvedCalleeId` mapping is
+ * accumulated here — across ALL THREE CALLS emit paths
+ * (`emitReceiverBoundCalls` via `tryEmitEdge`/`tryEmitEdgeWithExplicitTargetId`,
+ * and the inline `graph.addRelationship` in `emitFreeCallFallback` and
+ * `emitReferencesViaLookup`), each BEFORE its dedup (KTD6/R8). A later unit
+ * (U3) joins this map to CFG `BasicBlock`s by exact call-site position and
+ * emits a `BasicBlock.calleeIds` set.
+ *
+ * KEY ALIGNMENT (plan KTD7 — load-bearing): the key is the call/new
+ * expression node's start position — `line` 1-based (`startPosition.row + 1`),
+ * `col` 0-based (`startPosition.column`). This MUST equal the U1
+ * `SiteRecord.at` so the U3 position join lands. The CALLS resolution exposes
+ * the same node's range via `site.atRange` (`atRange: anchor.range`,
+ * scope-extractor.ts:1030), whose `startLine`/`startCol` are built by
+ * `nodeToCapture` as `row + 1` / `column` (1-based line, 0-based col — see the
+ * `Range` doc in gitnexus-shared). So a capture keyed on
+ * `(atRange.startLine, atRange.startCol)` is byte-equal to U1's `at` — no
+ * normalization needed.
+ *
+ * Gating (R4): the concrete sink is created in `run.ts` only when
+ * `input.pdg === true`; otherwise `undefined` is threaded through, so off-mode
+ * does zero work and emits byte-identical output.
+ *
+ * Multi-target dispatch (R2/KTD8): one site → multiple emit calls → the `Set`
+ * accumulates every resolved target. Capture is per-emit-call, so the
+ * candidate set is complete and a real target is never dropped.
+ */
+/** Build the position key from a call-site anchor. Single source of truth so
+ *  producer (this sink) and consumer (U3's CFG join) encode positions
+ *  identically. */
+export function calleeIdPosKey(line, col) {
+    return `${line}:${col}`;
+}
+/**
+ * Create the concrete nested-`Map` accumulator. Call ONLY when
+ * `input.pdg === true` (else thread `undefined` for byte-identity / zero
+ * overhead — R4).
+ */
+export function createCalleeIdAccumulator() {
+    const byFile = new Map();
+    return {
+        add(filePath, line, col, calleeId) {
+            let byPos = byFile.get(filePath);
+            if (byPos === undefined) {
+                byPos = new Map();
+                byFile.set(filePath, byPos);
+            }
+            const key = calleeIdPosKey(line, col);
+            let ids = byPos.get(key);
+            if (ids === undefined) {
+                ids = new Set();
+                byPos.set(key, ids);
+            }
+            ids.add(calleeId);
+        },
+        get(filePath) {
+            return byFile.get(filePath);
+        },
+        delete(filePath) {
+            byFile.delete(filePath);
+        },
+    };
+}

package/dist/core/ingestion/scope-resolution/graph-bridge/edges.d.ts

@@ -18,6 +18,16 @@ import type { Reference, ScopeId, SymbolDefinition } from '../../../../_shared/i
 import type { KnowledgeGraph } from '../../../graph/types.js';
 import type { ScopeResolutionIndexes } from '../../model/scope-resolution-indexes.js';
 import type { GraphNodeLookup } from '../graph-bridge/node-lookup.js';
+import type { CalleeIdSink } from './callee-id-sink.js';
+/**
+ * Optional resolved-callee-id capture context (#2227 follow-up U2). Threaded
+ * in only under `--pdg` (else `undefined` → zero overhead, byte-identity R4).
+ * `filePath` is NOT on the `site` param, so it rides here alongside the sink.
+ */
+export interface CalleeIdCaptureCtx {
+    readonly sink: CalleeIdSink;
+    readonly filePath: string;
+}
 /**
  * Map a `Reference.kind` to a graph edge type. `import-use` is dropped
  * (no edge type today — provenance lives on the IMPORTS edge emitted
@@ -40,7 +50,7 @@ export declare function tryEmitEdge(graph: KnowledgeGraph, scopes: ScopeResoluti
         startCol: number;
     };
     readonly kind: string;
-}, targetDef: SymbolDefinition, reason: string, seen: Set<string>, confidence?: number, collapseByCallerTarget?: boolean): boolean;
+}, targetDef: SymbolDefinition, reason: string, seen: Set<string>, confidence?: number, collapseByCallerTarget?: boolean, calleeCapture?: CalleeIdCaptureCtx): boolean;
 /**
  * Variant of `tryEmitEdge` that takes a pre-resolved target graph id
  * instead of resolving it from a `SymbolDefinition`. Used by the
@@ -61,4 +71,4 @@ export declare function tryEmitEdgeWithExplicitTargetId(graph: KnowledgeGraph, s
         startCol: number;
     };
     readonly kind: string;
-}, targetGraphId: string, reason: string, seen: Set<string>, confidence?: number, collapseByCallerTarget?: boolean): boolean;
+}, targetGraphId: string, reason: string, seen: Set<string>, confidence?: number, collapseByCallerTarget?: boolean, calleeCapture?: CalleeIdCaptureCtx): boolean;

package/dist/core/ingestion/scope-resolution/graph-bridge/edges.js

@@ -51,7 +51,7 @@ export function mapReferenceKindToEdgeType(kind) {
  * multiple language-specific post-passes can share it and never
  * double-emit a resolution one of them already produced.
  */
-export function tryEmitEdge(graph, scopes, nodeLookup, site, targetDef, reason, seen, confidence = 0.85, collapseByCallerTarget = false) {
+export function tryEmitEdge(graph, scopes, nodeLookup, site, targetDef, reason, seen, confidence = 0.85, collapseByCallerTarget = false, calleeCapture) {
     // Inheritance edges are emitted directly by `preEmitInheritanceEdges` (which
     // owns the enclosing-class caller and the EXTENDS-vs-IMPLEMENTS type), so this
     // generic bridge derives caller + edge type purely from the site.
@@ -64,6 +64,13 @@ export function tryEmitEdge(graph, scopes, nodeLookup, site, targetDef, reason,
         return false;
     if (edgeType === undefined)
         return false;
+    // Resolved-callee-id capture (#2227 U2/KTD6/R8): record this CALLS site's
+    // resolved target BEFORE the dedup `seen` check, so collapsed same-target
+    // multi-line calls are still captured per site. Keyed on `site.atRange`
+    // (1-based line / 0-based col — byte-equal to U1's SiteRecord.at).
+    if (calleeCapture !== undefined && edgeType === 'CALLS') {
+        calleeCapture.sink.add(calleeCapture.filePath, site.atRange.startLine, site.atRange.startCol, targetGraphId);
+    }
     // CALLS edges may collapse to `(caller, target)` granularity when
     // the provider opts in (C# matches legacy DAG behavior this way).
     // Write/read ACCESSES keep per-site dedup so multiple writes to the
@@ -98,13 +105,18 @@ export function tryEmitEdge(graph, scopes, nodeLookup, site, targetDef, reason,
  * All other invariants of `tryEmitEdge` apply: dedup key shape, collapse
  * flag honoring, edge-type mapping, caller-id resolution.
  */
-export function tryEmitEdgeWithExplicitTargetId(graph, scopes, nodeLookup, site, targetGraphId, reason, seen, confidence = 0.85, collapseByCallerTarget = false) {
+export function tryEmitEdgeWithExplicitTargetId(graph, scopes, nodeLookup, site, targetGraphId, reason, seen, confidence = 0.85, collapseByCallerTarget = false, calleeCapture) {
     const callerGraphId = resolveCallerGraphId(site.inScope, scopes, nodeLookup, site.atRange);
     const edgeType = mapReferenceKindToEdgeType(site.kind);
     if (callerGraphId === undefined)
         return false;
     if (edgeType === undefined)
         return false;
+    // Resolved-callee-id capture (#2227 U2/KTD6/R8) — before dedup, see
+    // `tryEmitEdge`. The explicit target id IS the resolved callee id.
+    if (calleeCapture !== undefined && edgeType === 'CALLS') {
+        calleeCapture.sink.add(calleeCapture.filePath, site.atRange.startLine, site.atRange.startCol, targetGraphId);
+    }
     const useCollapsed = collapseByCallerTarget && edgeType === 'CALLS';
     const dedupKey = useCollapsed
         ? `${edgeType}:${callerGraphId}->${targetGraphId}`

package/dist/core/ingestion/scope-resolution/graph-bridge/references-to-edges.d.ts

@@ -21,6 +21,7 @@ import type { Reference, ScopeId } from '../../../../_shared/index.js';
 import type { KnowledgeGraph } from '../../../graph/types.js';
 import type { ScopeResolutionIndexes } from '../../model/scope-resolution-indexes.js';
 import type { GraphNodeLookup } from '../graph-bridge/node-lookup.js';
+import type { CalleeIdSink } from '../graph-bridge/callee-id-sink.js';
 /**
  * Optional opaque skip key — providers may pre-emit edges (e.g. via
  * receiver-bound post-passes) and want this loop to skip references at
@@ -31,7 +32,11 @@ import type { GraphNodeLookup } from '../graph-bridge/node-lookup.js';
 type ReferenceSiteSkipSet = ReadonlySet<string>;
 export declare function emitReferencesViaLookup(graph: KnowledgeGraph, scopes: ScopeResolutionIndexes, referenceIndex: {
     readonly bySourceScope: ReadonlyMap<ScopeId, readonly Reference[]>;
-}, nodeLookup: GraphNodeLookup, skipSites?: ReferenceSiteSkipSet): {
+}, nodeLookup: GraphNodeLookup, skipSites?: ReferenceSiteSkipSet, 
+/** Resolved-callee-id capture sink (#2227 U2). Threaded in only under
+ *  `--pdg`; `undefined` ⇒ zero overhead, byte-identity (R4). Captured at the
+ *  CALLS emit below BEFORE this loop's `seen` dedup (KTD6/R8). */
+calleeIdSink?: CalleeIdSink): {
     emitted: number;
     skipped: number;
 };

package/dist/core/ingestion/scope-resolution/graph-bridge/references-to-edges.js

@@ -19,7 +19,11 @@
  */
 import { resolveCallerGraphId, resolveDefGraphId } from '../graph-bridge/ids.js';
 import { mapReferenceKindToEdgeType } from '../graph-bridge/edges.js';
-export function emitReferencesViaLookup(graph, scopes, referenceIndex, nodeLookup, skipSites) {
+export function emitReferencesViaLookup(graph, scopes, referenceIndex, nodeLookup, skipSites, 
+/** Resolved-callee-id capture sink (#2227 U2). Threaded in only under
+ *  `--pdg`; `undefined` ⇒ zero overhead, byte-identity (R4). Captured at the
+ *  CALLS emit below BEFORE this loop's `seen` dedup (KTD6/R8). */
+calleeIdSink) {
     let emitted = 0;
     let skipped = 0;
     const seen = new Set();
@@ -54,6 +58,14 @@ export function emitReferencesViaLookup(graph, scopes, referenceIndex, nodeLooku
                 skipped++;
                 continue;
             }
+            // Resolved-callee-id capture (#2227 U2/KTD6/R8): record this CALLS site's
+            // resolved target BEFORE the `seen` dedup, keyed on `ref.atRange`
+            // (byte-equal to U1's SiteRecord.at: 1-based line / 0-based col). Only
+            // CALLS feeds the bridge; ACCESSES/USES/EXTENDS are skipped. `fromFilePath`
+            // is the call-site (caller) file — the same file U1 stamps the site on.
+            if (calleeIdSink !== undefined && edgeType === 'CALLS' && fromFilePath !== undefined) {
+                calleeIdSink.add(fromFilePath, ref.atRange.startLine, ref.atRange.startCol, targetGraphId);
+            }
             const dedupKey = `${edgeType}:${callerGraphId}->${targetGraphId}:${ref.atRange.startLine}:${ref.atRange.startCol}`;
             if (seen.has(dedupKey))
                 continue;

package/dist/core/ingestion/scope-resolution/passes/free-call-fallback.d.ts

@@ -24,6 +24,7 @@ import type { WorkspaceResolutionIndex } from '../workspace-index.js';
 import type { GraphNodeLookup } from '../graph-bridge/node-lookup.js';
 import type { ScopeResolver } from '../contract/scope-resolver.js';
 import type { ResolutionOutcomeRecorder } from '../resolution-outcome.js';
+import type { CalleeIdSink } from '../graph-bridge/callee-id-sink.js';
 import { type ConversionRankFn } from './overload-narrowing.js';
 export declare function emitFreeCallFallback(graph: KnowledgeGraph, scopes: ScopeResolutionIndexes, parsedFiles: readonly ParsedFile[], nodeLookup: GraphNodeLookup, _referenceIndex: {
     readonly bySourceScope: ReadonlyMap<ScopeId, readonly Reference[]>;
@@ -49,6 +50,7 @@ export declare function emitFreeCallFallback(graph: KnowledgeGraph, scopes: Scop
         };
     }, callerParsed: ParsedFile, scopes: ScopeResolutionIndexes, parsedFiles: readonly ParsedFile[]) => readonly SymbolDefinition[] | undefined;
     readonly conversionRankFn?: ConversionRankFn;
+    readonly conversionOnlyArgTypePrefixes?: readonly string[];
     /** Optional per-language constraint hook threaded into
      *  `narrowOverloadCandidates`. Drops candidates whose template
      *  constraints (e.g. C++ `enable_if_t`, C++20 `requires`) provably
@@ -56,6 +58,11 @@ export declare function emitFreeCallFallback(graph: KnowledgeGraph, scopes: Scop
      *  candidate (monotonicity). */
     readonly constraintCompatibility?: ScopeResolver['constraintCompatibility'];
     readonly recordResolutionOutcome?: ResolutionOutcomeRecorder;
+    /** Resolved-callee-id capture sink (#2227 U2). Threaded in only under
+     *  `--pdg`; `undefined` ⇒ zero overhead, byte-identity (R4). Captured at
+     *  the CALLS emit below BEFORE the collapsed `seen` dedup (KTD6) so
+     *  same-target multi-line calls are still recorded per site. */
+    readonly calleeIdSink?: CalleeIdSink;
 }): number;
 /**
  * Build a `simpleName -> callable defs` index from `scopes.defs` once per
@@ -99,7 +106,7 @@ export declare function buildGlobalClassIndex(scopes: ScopeResolutionIndexes): R
  * order. Exported for unit testing — the `scopeDefsCache` equivalence is
  * exercised via synthetic stubs in `pick-unique-global-callable.test.ts`.
  */
-export declare function pickUniqueGlobalCallable(name: string, model: SemanticModel, globalCallablesBySimpleName: ReadonlyMap<string, readonly SymbolDefinition[]>, callerFilePath: string, isFileLocalDef?: (def: SymbolDefinition) => boolean, callArity?: number, isCallerVisible?: (candidate: SymbolDefinition) => boolean, callArgTypes?: readonly string[], callArgTypeClasses?: readonly ParameterTypeClass[], conversionRankFn?: ConversionRankFn, scopeDefsCache?: Map<string, readonly SymbolDefinition[]>): SymbolDefinition | undefined;
+export declare function pickUniqueGlobalCallable(name: string, model: SemanticModel, globalCallablesBySimpleName: ReadonlyMap<string, readonly SymbolDefinition[]>, callerFilePath: string, isFileLocalDef?: (def: SymbolDefinition) => boolean, callArity?: number, isCallerVisible?: (candidate: SymbolDefinition) => boolean, callArgTypes?: readonly string[], callArgTypeClasses?: readonly ParameterTypeClass[], conversionRankFn?: ConversionRankFn, scopeDefsCache?: Map<string, readonly SymbolDefinition[]>, conversionOnlyArgTypePrefixes?: readonly string[]): SymbolDefinition | undefined;
 /** Find a unique workspace-wide class-like def by simple name, for a
  *  constructor-form call `Type(...)` whose type lives outside the call
  *  site's lexical bindings (a sibling/imported file). Returns the def
@@ -142,5 +149,6 @@ export declare function pickImplicitThisOverload(site: {
     readonly argumentTypeClasses?: readonly import('../../../../_shared/index.js').ParameterTypeClass[];
 }, scopes: ScopeResolutionIndexes, workspaceIndex: WorkspaceResolutionIndex, model: SemanticModel, hookCtx?: {
     readonly conversionRankFn?: ConversionRankFn;
+    readonly conversionOnlyArgTypePrefixes?: readonly string[];
     readonly constraintCompatibility?: ScopeResolver['constraintCompatibility'];
 }): SymbolDefinition | undefined;