progmune-runtime 3.7.21 → 3.7.22

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## [3.7.22] — 2026-09-06
+
+### Java 方法学三连——恢复率裁决 + 真实闭环 + 名碰撞消除
+
+- **提取器恢复率裁决**（tree-sitter-java AST 基准，spring-realworld）：修复三根因（参数注解实参括号 34、通配符泛型 3、构造器 2）+ 调用侧修复（泛型构造调用/注释剔除/多行点链/泛型静态调用）——方法 100%（178/178）、调用边 100%（1216/1216）、0 FP。**词法路线成立，无需 JavaParser 依赖**（与 C/Go 同级别裁决）
+- **真实语料协议行标注闭环**（`REALWORLD_JAVA_ANNOTATION_V1.md`）：3 注解 + 1 别名端到端——v1 token 合法流 0 违规 + 摘抽取步反证精确报出；**v2 捕获真实 TP**（spring-realworld `updateUser` 密码明文入库——1581★ 参考实现真实 bug，改密后无法登录；修复变异违规即消）；v3 语料无手工资源管理（MyBatis 托管）维持合成金标
+- **接收者限定名匹配（名碰撞根因修复）**：提取器 `className` 捕获（嵌套类感知类名栈）+ 完整点链调用输出；注册层 `Class.method` 限定键（裸名键仅项目内唯一时注册）；匹配层大小写不敏感限定精确匹配（带点调用跳过规范化/词段形态）；变量名≠类名（`jwtService.` vs `DefaultJwtService`）走项目别名（注解合并后重校验加载）——**1 真实 TP / 0 误报**（9 名碰撞消除）
+- **P4.6 内联深度恢复**：call-sequence 限定调用末段回退解析（同文件优先 + 接收者-类名双向后缀偏好；规则保留集大小写不敏感前置）——违规归因上移到入口（updateProfile），与 TS/Python「helper 违规归因到入口 flow」语义对齐
+- **Spring 现代方言真实语料验证**（`REALWORLD_SPRING_V2.md`，ali-bouali/spring-boot-3-jwt-security，Boot 3 教程标杆）：SecurityFilterChain bean + requestMatchers 静态导入 + **String[] 变量白名单展开**（原保守跳过致公开 mutation 被兜底掩盖漏报）+ auth 词段豁免修复（authenticate/refresh-token）——15 路由 0 issues、摘兜底反证 5 重现、V1 语料复扫无回归
+- **audit:realworld fastapi 考核入口修复**（模块名推导 py→fastapi，该框架自工具建立即不可用）+ 全框架语料复扫 14/14 零回归
+- 发布门：套件 255 green；Python 盲测 64 / TS 795 / C 应用金标 F1=95.7% 全部零漂移；check 免疫正常（.progmune_allowlist 存量补录）
+
+## [3.7.15 – 3.7.21] — 2026-09-04/05
+
+### 框架真实语料 12/12 收官 + Java/Spring 语言支持 + Java 协议行引擎化
+
+- **框架检测器真实语料全量收官（12/12）**：Fiber 真实生产语料考核（journalist 多层 Register 链传播引擎 12 FP→0 + 反证 9 重现；jiotv_go 能力令牌形态标注）——8 启发式 + 4 结构级全部真实语料验证到 0 协议级 FP + 敏感性反证；CLAUDE.md 转正待办清空
+- **audit:realworld 一键考核工具 + 证据档位制**：任意真实开源项目 clone/vendor → 扫描 → JSON 报告 → 金标标注模板（docs/REALWORLD_METHODOLOGY.md）
+- **Java/Spring 语言支持（3.7.17-18）**：`extract-ir-java.ts` 提取器（纯 TS 词法）+ Spring 路由覆盖模型（19 路由/12 mutation 全解析、0 issues、anyRequest 兜底翻转反证 10 重现）+ 调用图提取 + SSG 方向决策（`REALWORLD_SPRING_V1.md`）
+- **Java 协议行引擎化（3.7.19-21）**：协议行金标 v1 + Spring 方言扩展（requestMatchers/类级 @PreAuthorize）；token 生命周期 / auth-register 哈希先行 / resource 管理（invalidate + 泄漏端）三族引擎回归锁定（docs/java-language-status.md）
+
 ## [3.7.14] — 2026-09-02
 
 ### Go 提取器修复 + 恢复率裁决 + 框架诚实分层 + 三语料实验

package/dist/call-sequence.js

@@ -68,6 +68,7 @@ function buildCallSequences(ir, keepNames, maxCalls = exports.MAX_SEQUENCE_CALLS
     // 跨文件函数指针分发仍不可见（L3 结论不变）。
     const fnMap = new Map();
     const fnMapByFile = new Map();
+    const fnMapAll = new Map(); // 裸名 → 全部定义（限定回退候选）
     for (const f of ir) {
         if (!isProjectFn(f))
             continue;
@@ -79,9 +80,55 @@ function buildCallSequences(ir, keepNames, maxCalls = exports.MAX_SEQUENCE_CALLS
         }
         if (!byFile.has(f.name))
             byFile.set(f.name, f);
+        const all = fnMapAll.get(f.name) || [];
+        all.push(f);
+        fnMapAll.set(f.name, all);
     }
-    /** 调用解析：同文件定义优先，全局按名回退（跨文件同名时每个文件绑自己的） */
-    const resolveCall = (fromFile, name) => fnMapByFile.get(fromFile)?.get(name) ?? fnMap.get(name);
+    // 保留集小写副本：限定调用名大小写不敏感命中（Java 规则键
+    // User.update vs 变量调用 user.update——大小写差异下的保留判定）
+    const keepNamesLower = keepNames ? new Set([...keepNames].map((k) => k.toLowerCase())) : undefined;
+    /** 限定名末段回退（Java 接收者限定输出）：同文件优先；全局候选
+     *  偏好 className 与接收者变量名大小写不敏感后缀匹配（user→User、
+     *  userRepository→MyBatisUserRepository、jwtService→DefaultJwtService
+     *  ——Java 字段名=类名 camelCase 的惯例）；无偏好时 last-wins 兜底 */
+    const resolveQualified = (fromFile, name) => {
+        const dot = name.lastIndexOf(".");
+        const seg = name.slice(dot + 1);
+        if (!seg)
+            return undefined;
+        const byFile = fnMapByFile.get(fromFile)?.get(seg);
+        if (byFile)
+            return byFile;
+        const all = fnMapAll.get(seg) || [];
+        if (all.length === 0)
+            return undefined;
+        if (all.length === 1)
+            return all[0];
+        const recv = name.slice(0, dot).toLowerCase();
+        // 双向后缀：变量名=类名去前缀（userRepository→MyBatisUserRepository、
+        // jwtService→DefaultJwtService——类名以接收者结尾）或变量名带类名
+        // （类名以接收者结尾的场景罕见，保留）
+        const hit = recv
+            ? all.find((f) => {
+                if (!f.className)
+                    return false;
+                const cn = f.className.toLowerCase();
+                return recv === cn || cn.endsWith(recv) || recv.endsWith(cn);
+            })
+            : undefined;
+        return hit ?? fnMap.get(seg);
+    };
+    /** 调用解析：同文件定义优先，全局按名回退（跨文件同名时每个文件绑自己的）；
+     *  限定名精确不中时末段回退——无注解项目 helper 的 P4.6 内联深度恢复
+     *  （Java 限定化前此类调用按裸名解析，限定化后曾退化为外部 token） */
+    const resolveCall = (fromFile, name) => {
+        const exact = fnMapByFile.get(fromFile)?.get(name) ?? fnMap.get(name);
+        if (exact)
+            return exact;
+        if (!name.includes("."))
+            return undefined;
+        return resolveQualified(fromFile, name);
+    };
     // 被项目函数调用过的函数不是入口（其片段并入调用方展开序列）——
     // 按 文件+名字 粒度判定，避免 A 文件的 static x 被 B 文件的调用误判非入口
     const fnKey = (file, name) => file + "::" + name;
@@ -119,9 +166,16 @@ function buildCallSequences(ir, keepNames, maxCalls = exports.MAX_SEQUENCE_CALLS
     const expandCall = (name, depth, visiting, fromFile) => {
         if (depth > MAX_DEPTH || visiting.has(name))
             return [];
+        // 规则函数保留优先（先于解析）：限定调用名大小写不敏感命中保留集
+        // → 保留 token 不解析不内联（解析会经末段回退内联掉规则 token，
+        // 且可能绑到同名异类定义）
+        if (keepNames && (keepNames.has(name) || (name.includes(".") && keepNamesLower.has(name.toLowerCase())))) {
+            budget.left--;
+            return [name];
+        }
         const fn = resolveCall(fromFile, name);
-        // 外部调用或规则函数：调用名保留给匹配层，不内联（记 1 个调用）
-        if (!fn || (keepNames && keepNames.has(name))) {
+        // 外部调用：调用名保留给匹配层，不内联（记 1 个调用）
+        if (!fn) {
             budget.left--;
             return [name];
         }

package/dist/call-sequence.test.js

@@ -137,3 +137,58 @@ function fn(name, file, calls) {
         (0, vitest_1.expect)((0, call_sequence_1.collectProjectFunctionNames)([external]).size).toBe(0);
     });
 });
+// ── 限定调用末段回退解析（Java 接收者限定输出，2026-09-06）──
+/** 带 className 的最小 FunctionInfo（Java 接收者限定语义） */
+function fnQ(name, file, calls, className) {
+    return { name, params: [], returnType: "void", file, calls, exported: true, external: false, className };
+}
+(0, vitest_1.describe)("buildCallSequences（限定调用回退解析）", () => {
+    (0, vitest_1.it)("限定调用末段回退：无注解项目 helper 经接收者解析后被内联（P4.6 深度恢复）", () => {
+        const ir = [
+            fnQ("save", "MyBatisUserRepository.java", ["insertUser"], "MyBatisUserRepository"),
+            fnQ("insertUser", "MyBatisUserRepository.java", ["db.execute"]),
+            fnQ("updateUser", "UserService.java", ["userRepository.save"]),
+        ];
+        const seqs = (0, call_sequence_1.buildCallSequences)(ir);
+        (0, vitest_1.expect)(seqs).toHaveLength(1);
+        (0, vitest_1.expect)(seqs[0].function).toBe("updateUser");
+        // save 被解析并内联 → insertUser（叶子）保留
+        (0, vitest_1.expect)(seqs[0].calls).toEqual(["insertUser"]);
+    });
+    (0, vitest_1.it)("限定调用命中保留集（大小写不敏感）：规则 token 不解析不内联", () => {
+        const ir = [
+            fnQ("update", "User.java", ["audit"], "User"),
+            fnQ("audit", "User.java", ["db.write"]),
+            fnQ("updateUser", "UserService.java", ["user.update"]),
+        ];
+        // 规则键 = 类限定（User.update）；调用 = 变量限定（user.update）——大小写差异
+        const seqs = (0, call_sequence_1.buildCallSequences)(ir, new Set(["User.update"]));
+        (0, vitest_1.expect)(seqs).toHaveLength(1);
+        (0, vitest_1.expect)(seqs[0].function).toBe("updateUser");
+        // 保留 token 而非内联（audit 不得出现）
+        (0, vitest_1.expect)(seqs[0].calls).toEqual(["user.update"]);
+    });
+    (0, vitest_1.it)("接收者-类名后缀偏好：同名 save 绑定到接收者对应类（userRepository → MyBatisUserRepository）", () => {
+        const ir = [
+            fnQ("save", "MyBatisUserRepository.java", ["insertUser"], "MyBatisUserRepository"),
+            fnQ("save", "MyBatisArticleRepository.java", ["insertArticle"], "MyBatisArticleRepository"),
+            fnQ("insertUser", "MyBatisUserRepository.java", ["db.execute"]),
+            fnQ("insertArticle", "MyBatisArticleRepository.java", ["db.execute"]),
+            fnQ("updateUser", "UserService.java", ["userRepository.save"]),
+            fnQ("updateArticle", "ArticleCommandService.java", ["articleRepository.save"]),
+        ];
+        const seqs = (0, call_sequence_1.buildCallSequences)(ir);
+        const byFn = new Map(seqs.map((s) => [s.function, s.calls]));
+        (0, vitest_1.expect)(byFn.get("updateUser")).toEqual(["insertUser"]);
+        (0, vitest_1.expect)(byFn.get("updateArticle")).toEqual(["insertArticle"]);
+    });
+    (0, vitest_1.it)("入口判定：仅被限定名调用的函数不是入口", () => {
+        const ir = [
+            fnQ("save", "MyBatisUserRepository.java", ["db.execute"]),
+            fnQ("updateUser", "UserService.java", ["userRepository.save"]),
+        ];
+        const seqs = (0, call_sequence_1.buildCallSequences)(ir);
+        (0, vitest_1.expect)(seqs.filter((s) => s.function === "save")).toHaveLength(0);
+        (0, vitest_1.expect)(seqs).toHaveLength(1);
+    });
+});

package/dist/extract-ir-java.js

@@ -96,6 +96,116 @@ function collectPrecedingComment(code, matchIndex) {
     }
     return pieces.join("\n");
 }
+/**
+ * 类名栈扫描：逐字符维护括号深度（字符串/注释感知），产出按字符位置
+ * 索引的当前类名表（null = 匿名类/方法体/块内）。'{' 前回溯 token：
+ * class|interface|enum|record Name → 命名类；new X(...) { 匿名类等 → null。
+ * 方法声明位置取栈顶为 className（嵌套类感知——JacksonCustomizations
+ * 内 DateTimeSerializer 等方法归属正确的嵌套类）。
+ */
+function buildClassStack(code) {
+    const stack = [null]; // 文件顶层
+    const at = new Array(code.length).fill(null);
+    let i = 0;
+    while (i < code.length) {
+        at[i] = stack[stack.length - 1];
+        const ch = code[i];
+        const next = code[i + 1];
+        if (ch === "/" && next === "/") {
+            i += 2;
+            while (i < code.length && code[i] !== "\n")
+                i++;
+            continue;
+        }
+        if (ch === "/" && next === "*") {
+            i += 2;
+            while (i < code.length && !(code[i] === "*" && code[i + 1] === "/"))
+                i++;
+            i += 2;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            // 跳字符串/字符字面量（含转义）
+            const q = ch;
+            i++;
+            while (i < code.length) {
+                if (code[i] === "\\") {
+                    i += 2;
+                    continue;
+                }
+                if (code[i] === q) {
+                    i++;
+                    break;
+                }
+                i++;
+            }
+            continue;
+        }
+        if (ch === "{") {
+            // 判定 '{' 打开什么：回溯最近类声明（允许 record Name(...) 组件形态）
+            const before = code.slice(Math.max(0, i - 200), i);
+            const clsM = before.match(/\b(class|interface|enum|record)\s+([A-Za-z_$]\w*)[^{]*$/);
+            stack.push(clsM ? clsM[2] : null);
+            i++;
+            continue;
+        }
+        if (ch === "}") {
+            if (stack.length > 1)
+                stack.pop();
+            i++;
+            continue;
+        }
+        i++;
+    }
+    return at;
+}
+/** 剔除行注释与块注释（字符串感知）——注释里的标识符不是调用 */
+function stripJavaComments(code) {
+    let out = "";
+    let i = 0;
+    while (i < code.length) {
+        const ch = code[i];
+        const next = code[i + 1];
+        if (ch === "/" && next === "/") {
+            i += 2;
+            while (i < code.length && code[i] !== "\n")
+                i++;
+            out += "\n";
+            continue;
+        }
+        if (ch === "/" && next === "*") {
+            i += 2;
+            while (i < code.length && !(code[i] === "*" && code[i + 1] === "/"))
+                i++;
+            i += 2;
+            out += " ";
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            const q = ch;
+            out += ch;
+            i++;
+            while (i < code.length) {
+                out += code[i];
+                if (code[i] === "\\") {
+                    i++;
+                    out += code[i];
+                    i++;
+                    continue;
+                }
+                if (code[i] === q) {
+                    i++;
+                    break;
+                }
+                i++;
+            }
+            continue;
+        }
+        out += ch;
+        i++;
+    }
+    return out;
+}
 /** 单文件提取 */
 function extractJavaFile(filePath) {
     const out = [];
@@ -106,42 +216,85 @@ function extractJavaFile(filePath) {
     catch {
         return out;
     }
-    // 方法声明：修饰符 + 返回类型 名字(参数) [throws ...] {
-    const re = /(?:\b(?:public|protected|private)\s+)?(?:(?:static|final|synchronized|abstract|default)\s+)*(?:[\w$<>\[\],.\s]+?)\s+([A-Za-z_$][\w$]*)\s*\(([^)]*)\)\s*(?:throws\s+[^{]+?)?\{/g;
+    const classStack = buildClassStack(code);
+    // 方法声明：两分支——构造器（可见性 + Name(，无返回类型）与普通方法
+    // （修饰符 + 返回类型 Name(，返回类型含 '?' 通配符如 ResponseEntity<?>）。
+    // 匹配止于 '('；参数区用字符串感知平衡括号扫描（@PathVariable("slug")
+    // 等注解实参的内层括号不再截断参数列表）；throws 子句与 '{' 手扫确认。
+    const re = /(?:\b(public|protected|private)\s+([A-Za-z_$][\w$]*)\s*\(|(?:\b(?:public|protected|private)\s+)?(?:(?:static|final|synchronized|abstract|default)\s+)*(?:[\w$<>\[\],.?\s]+?)\s+([A-Za-z_$][\w$]*)\s*\()/g;
     let m;
     while ((m = re.exec(code)) !== null) {
-        const name = m[1];
+        const isCtor = m[1] !== undefined;
+        const name = isCtor ? m[2] : m[3];
         if (JAVA_KEYWORDS.has(name))
             continue;
+        const parenPos = m.index + m[0].length - 1; // 匹配止于 '('
         // 重叠守卫：匹配起点若早于参数 '(' 所在行（如从上一行注释/注解开吃
         // 吞掉真头）→ 从 '(' 行首重扫，避免方法被错配候选吞掉
-        const parenPos = code.indexOf("(", m.index + m[0].indexOf(name));
         const parenLineStart = code.lastIndexOf("\n", parenPos - 1) + 1;
         if (m.index < parenLineStart) {
             re.lastIndex = parenLineStart;
             continue;
         }
-        // 起点规则：'.' 前导 = 方法调用（如 adminService.act( 的 act）；
-        // 注解行起点（@RequestMapping…）非方法声明；容忍注释内起点——
-        // 其名字/参数/体边界本就正确（正则 type-part 可吞注释空白）
+        // 起点规则：'.' 前导 = 方法调用（如 adminService.act( 的 act）。
+        // 注：'@'/'='/'"' 不在 type-part 字符类内，注解文本本身不可能成为
+        // 匹配起点，无需旧版 @ 行守卫（@Autowired public UserService( 的
+        // 匹配起于 public，行首是 @——旧守卫会误杀同行注解构造器）
         const pre = code.slice(Math.max(0, m.index - 1), m.index);
         if (pre === ".")
             continue;
-        const lineStart = code.lastIndexOf("\n", m.index - 1) + 1;
-        const curLine = code.slice(lineStart, code.indexOf("\n", lineStart) === -1 ? code.length : code.indexOf("\n", lineStart)).trim();
-        if (curLine.startsWith("@") && !curLine.startsWith("@protocol") && !curLine.startsWith("@progmune"))
-            continue;
+        // 参数区：字符串感知平衡括号扫描
+        let pDepth = 1;
+        let k = parenPos + 1;
+        let quote = null;
+        while (k < code.length && pDepth > 0) {
+            const ch = code[k];
+            if (quote) {
+                if (ch === quote && code[k - 1] !== "\\")
+                    quote = null;
+            }
+            else if (ch === '"' || ch === "'") {
+                quote = ch;
+            }
+            else if (ch === "(") {
+                pDepth++;
+            }
+            else if (ch === ")") {
+                pDepth--;
+            }
+            k++;
+        }
+        if (pDepth !== 0)
+            continue; // 括号不闭合
+        const rawParams = code.slice(parenPos + 1, k - 1);
+        // throws 子句 + '{' 手扫确认（候选非方法声明时在此丢弃）
+        let t = k;
+        while (t < code.length && /\s/.test(code[t]))
+            t++;
+        let bodyStart;
+        if (code.slice(t, t + 6) === "throws" && !/[\w$]/.test(code[t + 6] || "")) {
+            const brace = code.indexOf("{", t);
+            if (brace === -1)
+                continue;
+            if (/;/.test(code.slice(t, brace)))
+                continue; // throws 到 { 之间有 ; = 调用行
+            bodyStart = brace + 1;
+        }
+        else {
+            if (code[t] !== "{")
+                continue;
+            bodyStart = t + 1;
+        }
         const head = code.slice(m.index, m.index + 40);
         const visM = head.match(/\b(public|protected|private)\b/);
         const exported = visM ? visM[1] !== "private" : /^interface\s/.test(code.slice(0, m.index).split("\n").pop() || "") ? true : undefined;
         const params = [];
-        const rawParams = m[2].trim();
-        if (rawParams.length > 0) {
+        if (rawParams.trim().length > 0) {
             for (const raw of rawParams.split(",")) {
-                const t = raw.trim();
-                if (!t)
+                const t2 = raw.trim();
+                if (!t2)
                     continue;
-                const parts = t.split(/\s+/);
+                const parts = t2.split(/\s+/);
                 const pname = parts.pop() || "";
                 const ptype = parts.join(" ") || "?";
                 if (/^[A-Za-z_$][\w$]*$/.test(pname) && pname !== "final") {
@@ -155,16 +308,14 @@ function extractJavaFile(filePath) {
         // '(' 位置定真实 header 行，避免注释归属串位）
         let protocol;
         {
-            const parenIdx = code.indexOf("(", m.index);
-            const joined = parenIdx === -1 ? "" : collectPrecedingComment(code, parenIdx);
+            const joined = collectPrecedingComment(code, parenPos);
             const lastAt = Math.max(joined.lastIndexOf("@protocol"), joined.lastIndexOf("@progmune"));
             if (lastAt !== -1) {
                 protocol = parseJavaProtocol(joined.slice(lastAt, Math.min(joined.length, lastAt + 300)));
             }
         }
-        // calls：方法体（自头正则消费的 '{' 起平衡到 '}'）内的方法调用
+        // calls：方法体（'{' 起平衡到 '}'）内的方法调用
         const calls = [];
-        const bodyStart = m.index + m[0].length; // 正则已含 '{'
         let depth = 1;
         let bodyEnd = bodyStart;
         while (bodyEnd < code.length && depth > 0) {
@@ -176,17 +327,28 @@ function extractJavaFile(filePath) {
             bodyEnd++;
         }
         const body = code.slice(bodyStart, Math.min(bodyEnd, bodyStart + 8000));
-        // 零宽后视：前导 '(' 等不被上一匹配吞掉（if (verifyToken(…) 中能收到 verifyToken）
-        const callRe = /(?<=^|[^\w$])([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*)\s*\(/g;
+        // 注释剔除：// 注释里的 setAllowCredentials(true) 不是调用（限定化后
+        // 与真实调用分流，注释噪声显形——REALWORLD 恢复率复测发现）
+        const cleanBody = stripJavaComments(body);
+        // 零宽后视：前导 '(' 等不被上一匹配吞掉（if (verifyToken(…) 中能收到 verifyToken）；
+        // <…> 可选类型实参：new HashMap<String, Object>() 的 HashMap 可见；
+        // 链原子容忍点两侧空白 + 泛型静态调用（DataFetcherResult.<T>newResult()）：
+        // 接收者限定匹配的前提——REALWORLD 恢复率复测 96.6%→100%
+        const callRe = /(?<=^|[^\w$])([A-Za-z_$][\w$]*(?:\s*\.\s*(?:<[^<>;]*>)?\s*[A-Za-z_$][\w$]*)*)\s*(?:<[^<>;]*(?:<[^<>;]*>[^<>;]*)*>)?\s*\(/g;
         let cm;
-        while ((cm = callRe.exec(body)) !== null) {
-            const seg = cm[1].split(".").pop() || "";
+        while ((cm = callRe.exec(cleanBody)) !== null) {
+            // 接收者限定输出（Class.method 匹配前提）：带点链保留完整、剥空白/
+            // 泛型实参与 this.
+            let full = cm[1].replace(/\s+/g, "").replace(/<[^<>]*>/g, "");
+            if (full.startsWith("this."))
+                full = full.slice(5);
+            const seg = full.split(".").pop() || "";
             if (JAVA_KEYWORDS.has(seg))
                 continue;
-            if (/^(if|for|while|switch|catch|new|return|case|do)$/.test(seg))
+            if (/^(if|for|while|switch|catch|new|return|case|do|super|this)$/.test(seg))
                 continue;
-            if (calls.length < 400 && !calls.includes(seg))
-                calls.push(seg);
+            if (calls.length < 400 && !calls.includes(full))
+                calls.push(full);
         }
         out.push({
             name,
@@ -196,6 +358,7 @@ function extractJavaFile(filePath) {
             exported,
             calls,
             protocol,
+            className: classStack[m.index] || undefined,
         });
     }
     return out;

package/dist/extract-ir-java.test.js

@@ -71,12 +71,15 @@ public class JwtTokenFilter extends OncePerRequestFilter {
         (0, vitest_1.expect)(fns.some((f) => f.name === "doFilterInternal")).toBe(true);
         (0, vitest_1.expect)(fns.some((f) => f.name === "getTokenString")).toBe(true);
     });
-    (0, vitest_1.it)("方法调用边（calls）被提取——JWT 认证链可见", () => {
+    (0, vitest_1.it)("方法调用边（calls）被提取——JWT 认证链可见（带接收者输出完整链）", () => {
         const fp = path.join(dir, "JwtTokenFilter.java");
         fs.writeFileSync(fp, SAMPLE);
         const fns = (0, extract_ir_java_1.extractJavaFile)(fp);
         const filter = fns.find((f) => f.name === "doFilterInternal");
-        (0, vitest_1.expect)(filter.calls).toContain("getSubFromToken");
+        (0, vitest_1.expect)(filter.calls).toContain("jwtService.getSubFromToken");
+        // 链式调用按段输出：SecurityContextHolder.getContext() 输出第一段，
+        // 其返回值的 getAuthentication() 无文本接收者 → 裸名
+        (0, vitest_1.expect)(filter.calls).toContain("SecurityContextHolder.getContext");
         (0, vitest_1.expect)(filter.calls).toContain("getAuthentication");
         (0, vitest_1.expect)(filter.calls).toContain("setAuthentication");
         // 关键字不算调用
@@ -145,3 +148,161 @@ const MUT_FILTER = REAL_FILTER.replace("        .flatMap(token -> jwtService.get
         (0, vitest_1.expect)(tokenVerifyBeforeUse(calls).why).toContain("无 verify");
     });
 });
+// ── 恢复率裁决修复回归（spring-realworld AST 基准实测根因，2026-09-05）──
+(0, vitest_1.describe)("恢复率裁决修复回归（spring-realworld 实测三根因）", () => {
+    (0, vitest_1.it)("参数注解实参括号：@PathVariable(\"slug\") 不截断参数列表", () => {
+        const fp = path.join(dir, "ArticleApi.java");
+        fs.writeFileSync(fp, `package app;
+public class ArticleApi {
+  @DeleteMapping
+  public ResponseEntity deleteArticle(
+      @PathVariable("slug") String slug, @AuthenticationPrincipal User user) {
+    return articleRepository.findBySlug(slug);
+  }
+}`);
+        const fns = (0, extract_ir_java_1.extractJavaFile)(fp);
+        const fn = fns.find((f) => f.name === "deleteArticle");
+        (0, vitest_1.expect)(fn).toBeTruthy();
+        (0, vitest_1.expect)(fn.params.map((p) => p.name)).toEqual(["slug", "user"]);
+    });
+    (0, vitest_1.it)("通配符泛型返回类型：ResponseEntity<?> 方法被提取", () => {
+        const fp = path.join(dir, "Wildcard.java");
+        fs.writeFileSync(fp, `package app;
+public class Wildcard {
+  public ResponseEntity<?> article(String slug) {
+    return ResponseEntity.ok(slug);
+  }
+}`);
+        const fns = (0, extract_ir_java_1.extractJavaFile)(fp);
+        (0, vitest_1.expect)(fns.some((f) => f.name === "article")).toBe(true);
+    });
+    (0, vitest_1.it)("构造器（无返回类型）：public Name(…) 被提取（含同行 @Autowired）", () => {
+        const fp = path.join(dir, "UserService.java");
+        fs.writeFileSync(fp, `package app;
+public class UserService {
+  @Autowired
+  public UserService(
+      UserRepository userRepository,
+      @Value("\${image.default}") String defaultImage) {
+    this.userRepository = userRepository;
+  }
+}`);
+        const fns = (0, extract_ir_java_1.extractJavaFile)(fp);
+        (0, vitest_1.expect)(fns.some((f) => f.name === "UserService")).toBe(true);
+    });
+    (0, vitest_1.it)("泛型对象构造调用：new HashMap<String, Object>() 的 HashMap 可见", () => {
+        const fp = path.join(dir, "Resp.java");
+        fs.writeFileSync(fp, `package app;
+public class Resp {
+  public Map<?, ?> build() {
+    Map<String, Object> m = new HashMap<String, Object>();
+    return m;
+  }
+}`);
+        const fns = (0, extract_ir_java_1.extractJavaFile)(fp);
+        const calls = fns.find((f) => f.name === "build").calls;
+        (0, vitest_1.expect)(calls).toContain("HashMap");
+    });
+    (0, vitest_1.it)("super/this 构造调用不算调用边", () => {
+        const fp = path.join(dir, "Base.java");
+        fs.writeFileSync(fp, `package app;
+public class Base {
+  public Base(int config) {
+    super(config);
+  }
+}`);
+        const fns = (0, extract_ir_java_1.extractJavaFile)(fp);
+        const ctor = fns.find((f) => f.name === "Base");
+        (0, vitest_1.expect)(ctor).toBeTruthy();
+        (0, vitest_1.expect)(ctor.calls).not.toContain("super");
+    });
+});
+// ── 接收者限定名匹配（名碰撞根因修复，2026-09-06）──
+(0, vitest_1.describe)("接收者限定名匹配（className 捕获 + 限定调用输出）", () => {
+    (0, vitest_1.it)("className 捕获：顶层类与嵌套类归属正确", () => {
+        const fp = path.join(dir, "JacksonCustomizations.java");
+        fs.writeFileSync(fp, `package app;
+public class JacksonCustomizations {
+  public void outer() {}
+  public static class DateTimeSerializer {
+    public void serialize() {}
+    public static class Inner {
+      public void innermost() {}
+    }
+  }
+  public interface NestedIface {
+    default void ifaceMethod() {}
+  }
+}`);
+        const fns = (0, extract_ir_java_1.extractJavaFile)(fp);
+        const byName = new Map(fns.map((f) => [f.name, f]));
+        (0, vitest_1.expect)(byName.get("outer").className).toBe("JacksonCustomizations");
+        (0, vitest_1.expect)(byName.get("serialize").className).toBe("DateTimeSerializer");
+        (0, vitest_1.expect)(byName.get("innermost").className).toBe("Inner");
+        (0, vitest_1.expect)(byName.get("ifaceMethod").className).toBe("NestedIface");
+    });
+    (0, vitest_1.it)("匿名类内方法 className 为 undefined（按无类名处理）", () => {
+        const fp = path.join(dir, "Anon.java");
+        fs.writeFileSync(fp, `package app;
+public class Anon {
+  public void setup() {
+    Runnable r = new Runnable() {
+      public void run() {
+        doWork();
+      }
+    };
+  }
+}`);
+        const fns = (0, extract_ir_java_1.extractJavaFile)(fp);
+        (0, vitest_1.expect)(fns.find((f) => f.name === "run").className).toBeUndefined();
+        (0, vitest_1.expect)(fns.find((f) => f.name === "setup").className).toBe("Anon");
+    });
+    (0, vitest_1.it)("record 声明形态：record Name(...) { 的类名被捕获", () => {
+        const fp = path.join(dir, "Point.java");
+        fs.writeFileSync(fp, `package app;
+public record Point(int x, int y) {
+  public int sum() { return x + y; }
+}`);
+        const fns = (0, extract_ir_java_1.extractJavaFile)(fp);
+        (0, vitest_1.expect)(fns.find((f) => f.name === "sum").className).toBe("Point");
+    });
+    (0, vitest_1.it)("this. 前缀剥离：this.foo() 输出裸名", () => {
+        const fp = path.join(dir, "Self.java");
+        fs.writeFileSync(fp, `package app;
+public class Self {
+  public void outer() {
+    this.inner();
+  }
+  public void inner() {}
+}`);
+        const fns = (0, extract_ir_java_1.extractJavaFile)(fp);
+        (0, vitest_1.expect)(fns.find((f) => f.name === "outer").calls).toContain("inner");
+        (0, vitest_1.expect)(fns.find((f) => f.name === "outer").calls).not.toContain("this.inner");
+    });
+    (0, vitest_1.it)("限定串去重：a.open() 与 b.open() 是两条不同调用边", () => {
+        const fp = path.join(dir, "Multi.java");
+        fs.writeFileSync(fp, `package app;
+public class Multi {
+  public void go(A a, B b) {
+    a.open();
+    b.open();
+  }
+}`);
+        const fns = (0, extract_ir_java_1.extractJavaFile)(fp);
+        const calls = fns.find((f) => f.name === "go").calls;
+        (0, vitest_1.expect)(calls).toContain("a.open");
+        (0, vitest_1.expect)(calls).toContain("b.open");
+    });
+    (0, vitest_1.it)("无接收者调用保持裸名（protocol 金标 exact-match 锁）", () => {
+        const fp = path.join(dir, "Bare.java");
+        fs.writeFileSync(fp, `package app;
+public class Bare {
+  public void caller() {
+    setAuthentication(id, request);
+  }
+  public void setAuthentication(String id, Object r) {}
+}`);
+        const fns = (0, extract_ir_java_1.extractJavaFile)(fp);
+        (0, vitest_1.expect)(fns.find((f) => f.name === "caller").calls).toContain("setAuthentication");
+    });
+});

package/dist/frameworks/spring-detector.js

@@ -65,7 +65,10 @@ const ACCESS_AUTH = new Set([
     "hasAuthority", "hasAnyAuthority", "rememberMe", "denyAll",
 ]);
 function isAuthEntryPath(p) {
-    return /\/?(login|signin|signup|sign_in|register|refresh)(\/|$)/i.test(p);
+    // 词段前缀 + [-/] 边界：refresh-token、authenticate、token 家族均豁免
+    // （ali-bouali 现代语料实测：/auth/authenticate、/auth/refresh-token
+    // 被白名单 permitAll 命中后误报——真实登录/刷新入口，词表缺口修复）
+    return /\/(login|signin|signup|sign_in|register|refresh|authenticate|token)([-/]|$)/i.test(p);
 }
 /** Spring ant 模式 → 正则（** → 任意段，* → 单段） */
 function antToRegex(pattern) {
@@ -76,6 +79,22 @@ function antToRegex(pattern) {
 function parseSecurityConfig(code) {
     const rules = [];
     let catchAll = null;
+    // String[] 常量数组声明（现代方言标配：private static final String[]
+    // WHITE_LIST_URL = {...}）——requestMatchers(NAME) 变量引用展开为字面量。
+    // 仅覆盖本文件内 String[] 形态；List.of/Set.of/跨文件常量待语料补充。
+    const arrayVars = new Map();
+    {
+        const arrRe = /(?:private\s+|public\s+|protected\s+)?static\s+final\s+String\[\]\s+([A-Za-z_]\w*)\s*=\s*\{/g;
+        let am;
+        while ((am = arrRe.exec(code)) !== null) {
+            const name = am[1];
+            const end = code.indexOf("};", am.index + am[0].length);
+            if (end === -1)
+                continue;
+            const literals = [...code.slice(am.index, end).matchAll(/"([^"]+)"/g)].map((x) => x[1]);
+            arrayVars.set(name, literals);
+        }
+    }
     // 逐个 .antMatchers/.requestMatchers(...) 与其后 .access() 配对
     // （旧 DSL antMatchers + 新式 SecurityFilterChain authorizeHttpRequests
     //   requestMatchers——2026-09-02 Spring 方言扩展）
@@ -98,8 +117,13 @@ function parseSecurityConfig(code) {
         for (const pm of rest.matchAll(/"([^"]+)"/g))
             patterns.push(pm[1]);
         if (patterns.length === 0) {
-            // 无引号模式（变量引用）→ 宽匹配不了，跳过（保守：不豁免）
-            continue;
+            // 无引号模式（变量引用）→ String[] 常量数组展开；
+            // 未知变量保守跳过（不豁免）
+            const varName = rest.match(/^([A-Za-z_]\w*)$/);
+            const arr = varName ? arrayVars.get(varName[1]) : undefined;
+            if (!arr)
+                continue;
+            patterns.push(...arr);
         }
         rules.push({ method, patterns, access: m[2] });
     }

package/dist/frameworks/spring-detector.test.js

@@ -168,4 +168,77 @@ public class AdminApi {
         const a = (0, spring_detector_1.analyzeSpringProject)(dir);
         (0, vitest_1.expect)(a.issues.some((i) => i.route === "POST /articles")).toBe(true);
     });
+    (0, vitest_1.it)("String[] 白名单变量展开：非 auth 词路径 permitAll mutation 被看见（修复前被兜底掩盖）", () => {
+        // 现代 Boot 3 教程标配形态：变量数组白名单（ali-bouali/spring-boot-3-jwt-security）。
+        // 展开后 /public/** 命中 permitAll 规则 → POST /public/files 公开 mutation 被报；
+        // 未展开时该规则被跳过、路由落到兜底 authenticated → 漏报（保守方向错误）。
+        const cfg = `${PKG}
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+@Configuration @EnableWebSecurity
+public class WebSecurityConfig {
+  private static final String[] WHITE_LIST_URL = {"/api/v1/auth/**", "/v3/api-docs", "/public/**"};
+  @Bean
+  public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
+    http.authorizeHttpRequests(req -> req
+      .requestMatchers(WHITE_LIST_URL).permitAll()
+      .anyRequest().authenticated());
+    return http.build();
+  }
+}`;
+        writeJava("sec/WebSecurityConfig.java", cfg);
+        writeJava("api/PublicApi.java", `${PKG}
+@RestController @RequestMapping("/public")
+public class PublicApi {
+  @PostMapping("/files") public Object up() { return null; }
+}`);
+        const a = (0, spring_detector_1.analyzeSpringProject)(dir);
+        (0, vitest_1.expect)(a.issues.some((i) => i.route === "POST /public/files")).toBe(true);
+    });
+    (0, vitest_1.it)("auth 词段豁免：/auth/authenticate 与 /auth/refresh-token 公开 mutation 不报（词表缺口修复）", () => {
+        const cfg = `${PKG}
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+@Configuration @EnableWebSecurity
+public class WebSecurityConfig {
+  private static final String[] WHITE_LIST_URL = {"/api/v1/auth/**"};
+  @Bean
+  public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
+    http.authorizeHttpRequests(req -> req
+      .requestMatchers(WHITE_LIST_URL).permitAll()
+      .anyRequest().authenticated());
+    return http.build();
+  }
+}`;
+        writeJava("sec/WebSecurityConfig.java", cfg);
+        writeJava("api/AuthApi.java", `${PKG}
+@RestController @RequestMapping("/api/v1/auth")
+public class AuthApi {
+  @PostMapping("/authenticate") public Object login() { return null; }
+  @PostMapping("/refresh-token") public Object refresh() { return null; }
+}`);
+        const a = (0, spring_detector_1.analyzeSpringProject)(dir);
+        (0, vitest_1.expect)(a.issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("反证：白名单变量改名（展开失明）→ 路由落到兜底 authenticated，公开 mutation 漏报", () => {
+        const cfg = `${PKG}
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+@Configuration @EnableWebSecurity
+public class WebSecurityConfig {
+  private static final String[] RENAMED = {"/public/**"};
+  @Bean
+  public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
+    http.authorizeHttpRequests(req -> req
+      .requestMatchers(WHITE_LIST_URL).permitAll()
+      .anyRequest().authenticated());
+    return http.build();
+  }
+}`;
+        writeJava("sec/WebSecurityConfig.java", cfg);
+        writeJava("api/PublicApi.java", `${PKG}
+@RestController @RequestMapping("/public")
+public class PublicApi {
+  @PostMapping("/files") public Object up() { return null; }
+}`);
+        const a = (0, spring_detector_1.analyzeSpringProject)(dir);
+        (0, vitest_1.expect)(a.issues).toHaveLength(0);
+    });
 });

package/dist/sdk.js

@@ -20,7 +20,7 @@ const risk_model_1 = require("./risk-model");
 const protocol_knowledge_1 = require("./protocol-knowledge");
 const evidence_repository_1 = require("./evidence-repository");
 /** Runtime version — stable public identifier. Internal layers evolve underneath. */
-exports.RUNTIME_VERSION = "3.7.21";
+exports.RUNTIME_VERSION = "3.7.22";
 function verify(filePath) {
     const cert = (0, certify_1.certify)(filePath);
     const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();

package/dist/trust/engine.js

@@ -1248,23 +1248,42 @@ async function collectProtocolViolations(ctx, callGraph) {
                     // ir.json 两种形态：extractIR/extractIRPython 的裸数组、extractProjectIR
                     // 的 { typeMap, functions } 合并对象（execute/MCP 写盘）——统一取函数列表。
                     const functions = Array.isArray(ir) ? ir : (ir.functions || []);
+                    // 裸名出现次数（Java 接收者限定匹配：碰撞名不注册裸键——
+                    // User.update 与 Article.update 同名时裸键 "update" 会命中所有
+                    // .update( 调用点，REALWORLD_JAVA_ANNOTATION_V1 名碰撞 9 FP 根因）
+                    const nameCounts = new Map();
+                    for (const f of functions) {
+                        const n = String(f.name);
+                        nameCounts.set(n, (nameCounts.get(n) || 0) + 1);
+                    }
                     for (const f of functions) {
                         if (!f.protocol)
                             continue;
                         const protocol = { ...f.protocol };
-                        const existing = protocolRulesData.rules.get(String(f.name));
+                        const fname = String(f.name);
+                        const existing = protocolRulesData.rules.get(fname);
                         if (existing?.namespace && !protocol.namespace) {
                             protocol.namespace = existing.namespace;
                         }
                         // 修复路径渲染真实函数名（fixPath 输出项目原语而非通用规则名）
-                        protocol.displayName = String(f.name);
-                        protocolRulesData.rules.set(String(f.name), protocol);
+                        protocol.displayName = fname;
+                        // Java（className 存在且 name 无点）：总是注册 Class.method 限定键；
+                        // 裸键仅在项目内唯一时注册（碰撞名只留限定键，匹配走限定调用）
+                        const qualified = f.className && !fname.includes(".")
+                            ? `${f.className}.${fname}` : undefined;
+                        const nameUnique = (nameCounts.get(fname) || 0) === 1;
+                        if (qualified) {
+                            protocolRulesData.rules.set(qualified, protocol);
+                        }
+                        if (!f.className || nameUnique) {
+                            protocolRulesData.rules.set(fname, protocol);
+                        }
                         // CamelCase 真实命名（C 代码普遍，如 ACLCheckAllPerm）注册的规则
                         // 原样无法被任何匹配策略触达（normalize 只作用于调用名；词段匹配
                         // 要求 ≥2 个下划线词段）——同步注册规范化形态使注解原语可被按名命中。
                         // 加性改动：snake_case 注解（TS/Python 惯例）normalized === 原名，无变化。
-                        const normalized = (0, ssg_bridge_1.normalizeName)(String(f.name));
-                        if (normalized !== String(f.name)) {
+                        const normalized = (0, ssg_bridge_1.normalizeName)(fname);
+                        if (normalized !== fname && (!f.className || nameUnique)) {
                             protocolRulesData.rules.set(normalized, protocol);
                         }
                     }
@@ -1272,6 +1291,24 @@ async function collectProtocolViolations(ctx, callGraph) {
             }
             catch { /* best-effort */ }
         }
+        // ── 项目别名重校验（注解合并后）──
+        // 注解合并注册的限定键（Java Class.method）在 loadProtocolRules 时还不
+        // 存在，指向它们的别名当时被「规则不存在」校验拒绝——合并后重跑一次，
+        // 把「变量名→限定规则」映射补进 aliasIndex（如 jwtservice.getsubfromtoken
+        // → DefaultJwtService.getSubFromToken；变量名≠类名的文档化桥接通道）
+        if (protocolRulesData) {
+            try {
+                const pa = (0, ssg_bridge_1.loadProjectAliases)(ctx.projectPath, new Set(protocolRulesData.rules.keys()));
+                if (pa) {
+                    for (const [callName, ruleName] of Object.entries(pa.aliases)) {
+                        if (!protocolRulesData.aliasIndex.has(callName)) {
+                            protocolRulesData.aliasIndex.set(callName, ruleName);
+                        }
+                    }
+                }
+            }
+            catch { /* best-effort */ }
+        }
         // ── Phase 1-5 Semantic Pipeline ──
         // 规则名集合作为展开的保留单元：规则函数不内联（调用名保留给匹配层）
         const callSequences = extractCallSequencesFromProject(ctx.projectPath, ctx.language, protocolRulesData ? new Set(protocolRulesData.rules.keys()) : undefined);

package/dist/trust/ssg-bridge.js

@@ -265,12 +265,16 @@ function inferRuleName(apiName, domain, description, ruleNames, namespace, alias
     // 仅项目函数适用——真实 C 语料验证中 ReadFile/WriteFile/DeleteFile 经
     // normalized 撞上 read_file/write_file/delete_file 是 11/24 FP 的主导源，
     // 而注解桥接（ACLCheckAllPerm → acl_check_all_perm）全是项目函数，不受影响。
+    // Java 限定键（Class.method）与限定调用（user.update）大小写不敏感精确
+    // 匹配（变量名 user vs 类名 User）；带点调用不参与规范化/词段形态匹配——
+    // 末段回退会重造名碰撞（article.update 撞 User.update 的裸键/词段）。
+    const isDotted = dotIdx >= 0;
     for (const ruleName of ruleNames) {
-        if (lowerApi === ruleName) {
+        if (lowerApi === ruleName.toLowerCase()) {
             return ruleName;
         }
     }
-    if (isProjectFn) {
+    if (isProjectFn && !(projectFunctions && isDotted)) {
         for (const ruleName of ruleNames) {
             if (normalized === ruleName) {
                 return ruleName;
@@ -280,6 +284,8 @@ function inferRuleName(apiName, domain, description, ruleNames, namespace, alias
     for (const ruleName of ruleNames) {
         if (projectFunctions && !isProjectFn)
             continue;
+        if (projectFunctions && isDotted)
+            continue; // 带点调用只走限定精确匹配（+别名/域提示）
         const ruleWords = ruleName.split("_");
         const callWords = normalized.split("_");
         // Rule must have at least 2 words for this strategy (single-word rules

package/dist/trust/ssg-bridge.test.js

@@ -113,6 +113,52 @@ function step(api, domain, description = "") {
             (0, vitest_1.expect)(result.stats.unmatchedCalls).toBe(steps.length);
         });
     });
+    // ── 接收者限定名匹配（Java 名碰撞根因修复，2026-09-06）──
+    (0, vitest_1.describe)("qualified call → rule inference", () => {
+        (0, vitest_1.it)("限定调用精确匹配限定规则（大小写不敏感：user.update → User.update）", () => {
+            const prev = rules.get("User.update");
+            rules.set("User.update", {
+                pre_states: ["PASSWORD_HASHED"],
+                post_states: ["PASSWORD_UPDATED"],
+                namespace: "registration",
+            });
+            try {
+                const result = (0, ssg_bridge_1.validateSequenceWithSSG)([step("user.update", "registration", "Update user data")], rules, nsInit, "test.java", aliasIndex, undefined, new Set(["user.update", "update"]));
+                (0, vitest_1.expect)(result.stats.matchedCalls).toBeGreaterThanOrEqual(1);
+            }
+            finally {
+                if (prev)
+                    rules.set("User.update", prev);
+                else
+                    rules.delete("User.update");
+            }
+        });
+        (0, vitest_1.it)("不同类限定调用不误配（article.update 不命中 User.update 规则）", () => {
+            const prev = rules.get("User.update");
+            rules.set("User.update", {
+                pre_states: ["PASSWORD_HASHED"],
+                post_states: ["PASSWORD_UPDATED"],
+                namespace: "registration",
+            });
+            try {
+                const result = (0, ssg_bridge_1.validateSequenceWithSSG)([step("article.update", "registration", "Update article content")], rules, nsInit, "test.java", aliasIndex, undefined, new Set(["article.update", "update"]));
+                (0, vitest_1.expect)(result.stats.matchedCalls).toBe(0);
+                (0, vitest_1.expect)(result.stats.unmatchedCalls).toBe(1);
+            }
+            finally {
+                if (prev)
+                    rules.set("User.update", prev);
+                else
+                    rules.delete("User.update");
+            }
+        });
+        (0, vitest_1.it)("带点调用不参与词段匹配（helper.verify_hash 不命中 verify_hash）", () => {
+            // 无 projectFunctions 时不限制（回退路径旧行为）；提供后带点调用
+            // 只走限定精确匹配 + 别名——末段词段回退会重造名碰撞
+            const result = (0, ssg_bridge_1.validateSequenceWithSSG)([step("helper.verify_hash", "auth", "Verify something")], rules, nsInit, "test.java", aliasIndex, undefined, new Set(["helper.verify_hash", "verify_hash"]));
+            (0, vitest_1.expect)(result.stats.matchedCalls).toBe(0);
+        });
+    });
     (0, vitest_1.describe)("alias-based matching (exact)", () => {
         (0, vitest_1.it)("matches bcrypt.compare to verify_hash via alias", () => {
             (0, vitest_1.expect)(aliasIndex.get("bcrypt.compare")).toBe("verify_hash");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "3.7.21",
+  "version": "3.7.22",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",