ucn 4.0.2 → 4.1.0

package/core/callers.js

@@ -10,7 +10,7 @@ const path = require('path');
 const crypto = require('crypto');
 const { detectLanguage, getParser, getLanguageModule, langTraits } = require('../languages');
 const { isTestFile } = require('./discovery');
-const { NON_CALLABLE_TYPES, isOverrideMarked } = require('./shared');
+const { NON_CALLABLE_TYPES, isOverrideMarked, codeUnitCompare, isTestPath } = require('./shared');
 const { scoreEdge, tierForResolution, TIER } = require('./confidence');
 const { findGoModule } = require('./imports');
 
@@ -460,6 +460,17 @@ function findCallers(index, name, options = {}) {
                     }
                 }
 
+                // Intra-class constructor mechanics are never caller edges
+                // (fix #238, jdtls-measured): an enum CONSTANT is part of the
+                // enum's own declaration (JsonToken's 10 constants confirmed
+                // 10 self-callers), and a `this(...)` delegation names the
+                // ENCLOSING class by construction. Both stay in the calls
+                // cache for deadcode/--unused reachability; `super(...)`
+                // names a DIFFERENT class and keeps its caller edge.
+                if (call.enumConstant || call.ctorDelegation === 'this') {
+                    continue;
+                }
+
                 // For potential callbacks (function passed as arg), validate against symbol table
                 // and skip complex binding resolution — just check the name exists
                 if (call.isPotentialCallback) {
@@ -623,7 +634,8 @@ function findCallers(index, name, options = {}) {
                     const cbSameFile = cbTargetFiles.has(filePath);
                     const cbSamePackage = !cbSameFile &&
                         langTraits(fileEntry.language)?.typeSystem === 'nominal' &&
-                        cbTargetDefs.some(d => d.file && path.dirname(d.file) === path.dirname(filePath));
+                        cbTargetDefs.some(d => d.file &&
+                            _sameNominalPackageDir(path.dirname(d.file), path.dirname(filePath), fileEntry.language));
                     let cbImportLink = false;
                     if (!cbSameFile && !cbSamePackage) {
                         const cbImports = index.importGraph.get(filePath);
@@ -701,10 +713,14 @@ function findCallers(index, name, options = {}) {
                 // e.g., analyzer.analyze_instrument() should NOT resolve to a local
                 // standalone function def `analyze_instrument` — they're different symbols.
                 // Also skip for Go package-qualified calls (isMethod:false but has receiver like 'cli')
-                const selfReceivers = new Set(['self', 'cls', 'this', 'super']);
+                // `super` skips too (fix #238): a super call targets the PARENT
+                // class's member by definition — the local binding of the name
+                // is the enclosing class's own member, provably the wrong def
+                // (super(config) bound to the subclass's OWN constructor).
+                // Super records resolve only through the parent-chain walk.
+                const selfReceivers = new Set(['self', 'cls', 'this']);
                 const skipLocalBinding = call.receiver && !selfReceivers.has(call.receiver);
                 if (!bindingId && !skipLocalBinding) {
-                    let bindings = (fileEntry.bindings || []).filter(b => b.name === call.name);
                     // A bare call cannot bind to a METHOD def where bare names
                     // never reach methods (fix #220, cobra-measured): Go's
                     // func (c *Command) MarkFlagDirname and func MarkFlagDirname
@@ -717,15 +733,24 @@ function findCallers(index, name, options = {}) {
                     // cells.cell_len, not Text.cell_len) and a JS class
                     // member is not a file binding either — the structural
                     // dispatch gates can't own this case because a matched
-                    // bindingId bypasses them.
-                    if (!call.isMethod && bindings.length > 0 &&
-                        !langTraits(fileEntry.language)?.bareCallReachesMethods) {
-                        const defsOfName = index.symbols.get(call.name) || [];
-                        bindings = bindings.filter(b => {
-                            const sym = defsOfName.find(s => s.file === filePath && s.startLine === b.startLine);
+                    // bindingId bypasses them. Fix #229: the filter applies
+                    // per source file — sibling-file bindings from Go's
+                    // package-scope concat below carry interface members and
+                    // methods too (`type Notifier interface { Notify() }`
+                    // next to `func Notify()` stole the bindingId and
+                    // excluded the true caller as other-definition).
+                    const bareNeverMethod = !call.isMethod &&
+                        !langTraits(fileEntry.language)?.bareCallReachesMethods;
+                    const defsOfName = bareNeverMethod ? (index.symbols.get(call.name) || []) : null;
+                    const dropMethodBindings = (list, file) => {
+                        if (!bareNeverMethod || list.length === 0) return list;
+                        return list.filter(b => {
+                            const sym = defsOfName.find(s => s.file === file && s.startLine === b.startLine);
                             return !(sym && (sym.className || sym.receiver));
                         });
-                    }
+                    };
+                    let bindings = dropMethodBindings(
+                        (fileEntry.bindings || []).filter(b => b.name === call.name), filePath);
                     // For Go, also check sibling files in same directory (same package scope)
                     if (bindings.length === 0 && langTraits(fileEntry.language)?.packageScope === 'directory') {
                         const dir = path.dirname(filePath);
@@ -734,7 +759,8 @@ function findCallers(index, name, options = {}) {
                             if (fp !== filePath) {
                                 const fe = index.files.get(fp);
                                 if (fe) {
-                                    const sibling = (fe.bindings || []).filter(b => b.name === call.name);
+                                    const sibling = dropMethodBindings(
+                                        (fe.bindings || []).filter(b => b.name === call.name), fp);
                                     bindings = bindings.concat(sibling);
                                 }
                             }
@@ -846,7 +872,7 @@ function findCallers(index, name, options = {}) {
                         const callerSymbol = index.findEnclosingFunction(filePath, call.line, true);
                         if (!callerSymbol?.className) {
                             // Can't resolve — include only if includeMethods requested
-                            if (!options.includeMethods) {
+                            if (options.collectAccount || !options.includeMethods) {
                                 routeUnverified(filePath, fileEntry, call, 'method-no-evidence', calledAs);
                                 continue;
                             }
@@ -876,16 +902,23 @@ function findCallers(index, name, options = {}) {
                                     continue;
                                 }
                                 resolvedBySameClass = true;
-                            } else if (!options.includeMethods) {
+                            } else if (options.collectAccount || !options.includeMethods) {
                                 routeUnverified(filePath, fileEntry, call, 'method-no-evidence', calledAs);
                                 continue;
                             }
                         }
-                    } else if (['self', 'cls', 'this', 'super'].includes(call.receiver)) {
-                        // self/this/super.method() — resolve to same-class or parent method
+                    } else if (['self', 'cls', 'this', 'super'].includes(call.receiver) ||
+                               (call.receiver === 'Self' && fileEntry.language === 'rust')) {
+                        // self/this/super.method() — resolve to same-class or parent method.
+                        // Rust `Self::method()` (fix #232) is the path-call same-class form:
+                        // Self IS the enclosing impl's type, so the #202b pinning check
+                        // confirms it for the impl's class and excludes it for a pinned
+                        // sibling — it must never reach the uppercase path-receiver
+                        // discipline below (which excluded it as path-type-mismatch
+                        // whenever the method name had several project-wide owners).
                         const callerSymbol = index.findEnclosingFunction(filePath, call.line, true);
                         if (!callerSymbol?.className) {
-                            if (!options.includeMethods) {
+                            if (options.collectAccount || !options.includeMethods) {
                                 routeUnverified(filePath, fileEntry, call, 'method-no-evidence', calledAs);
                                 continue;
                             }
@@ -937,10 +970,16 @@ function findCallers(index, name, options = {}) {
                                     fileEntry.language === 'python') {
                                     const tDefs = options.targetDefinitions || definitions;
                                     const targetClasses = new Set(tDefs.map(d => d.className).filter(Boolean));
+                                    // `super` dispatches statically UP the chain — the
+                                    // ancestor/descendant dynamic-dispatch exemptions
+                                    // are inverted for it: a super call can never bind
+                                    // a def below the matched parent (fix #238).
+                                    const superSkipsExemptions = call.receiver === 'super';
                                     if (!targetClasses.has(matchedClass) &&
-                                        !_isAncestorOfTargetClass(index, matchedClass, tDefs) &&
-                                        !(fileEntry.language === 'python' &&
-                                            _shareProjectDescendant(index, matchedClass, targetClasses))) {
+                                        (superSkipsExemptions ||
+                                         (!_isAncestorOfTargetClass(index, matchedClass, tDefs) &&
+                                          !(fileEntry.language === 'python' &&
+                                            _shareProjectDescendant(index, matchedClass, targetClasses))))) {
                                         recordExcluded(filePath, call.line, 'other-definition');
                                         continue;
                                     }
@@ -973,15 +1012,20 @@ function findCallers(index, name, options = {}) {
                                     // Legacy keeps confirming (drop-vs-route asymmetry).
                                     const tDefs = options.targetDefinitions || definitions;
                                     const targetClasses = new Set(tDefs.map(d => d.className).filter(Boolean));
+                                    // super: static upward dispatch — no ancestor/
+                                    // descendant exemptions (fix #238), routed visible
+                                    // like the rest of the #213 branch (TS declare-class
+                                    // merging can hide the true parent edge).
                                     if (!targetClasses.has(matchedClass) &&
-                                        !_isAncestorOfTargetClass(index, matchedClass, tDefs) &&
-                                        !_shareProjectDescendant(index, matchedClass, targetClasses)) {
+                                        (call.receiver === 'super' ||
+                                         (!_isAncestorOfTargetClass(index, matchedClass, tDefs) &&
+                                          !_shareProjectDescendant(index, matchedClass, targetClasses)))) {
                                         routeUnverified(filePath, fileEntry, call, 'method-ambiguous', calledAs);
                                         continue;
                                     }
                                 }
                                 resolvedBySameClass = true;
-                            } else if (!options.includeMethods) {
+                            } else if (options.collectAccount || !options.includeMethods) {
                                 routeUnverified(filePath, fileEntry, call, 'method-no-evidence', calledAs);
                                 continue;
                             }
@@ -1037,8 +1081,23 @@ function findCallers(index, name, options = {}) {
                     fieldDispatchType = _declaredFieldInterfaceType(index, fieldHopRootType, call.receiverField, fileEntry.language);
                 }
 
-                // Skip uncertain calls unless resolved by same-class matching or explicitly requested
-                if (isUncertain && !resolvedBySameClass && !options.includeUncertain) {
+                // Skip uncertain calls unless resolved by same-class matching or
+                // explicitly requested. A declared-field hop type (fix #219) or
+                // interface-field dispatch type IS receiver evidence — those
+                // calls flow to the receiver-class disambiguation below, which
+                // confirms (receiver-hint), excludes (mismatch), or attributes
+                // possible-dispatch. Before fix #229 this gate fired first
+                // whenever the method name had no same-file binding, so the
+                // tier of `this.logger.info()` depended on file LAYOUT (same
+                // file confirmed, cross-file routed method-no-evidence).
+                // A parser-typed receiver defers too (fix #232): `b?.ping()`
+                // carries the optionality `uncertain` flag AND receiverType 'A'
+                // — the ?. is a null guard, not evidence uncertainty, so the
+                // record gets plain-call physics (validated match confirms,
+                // trusted mismatch excludes). Bare `foo?.()` has no receiver
+                // evidence and keeps routing here.
+                if (isUncertain && !resolvedBySameClass && !options.includeUncertain &&
+                    !fieldHopType && !fieldDispatchType && !call.receiverType) {
                     if (stats) stats.uncertain = (stats.uncertain || 0) + 1;
                     routeUnverified(filePath, fileEntry, call,
                         call.isMethod ? 'method-no-evidence' : 'ambiguous-binding', calledAs);
@@ -1239,13 +1298,32 @@ function findCallers(index, name, options = {}) {
                         recordExcluded(filePath, call.line, 'method-kind-mismatch');
                         continue;
                     }
-                    if (!call.isMethod && targetHasClass) {
-                        // Non-method call but target is a class method — skip
+                    if (!call.isMethod && targetHasClass &&
+                        !(!call.receiver && langTraits(fileEntry.language)?.bareCallReachesMethods)) {
+                        // Non-method call but target is a class method — skip.
+                        // Bare-call direction honors bareCallReachesMethods
+                        // (fix #229, same as the callback-path twin): a Java
+                        // bare call CAN denote a method — static imports
+                        // (`import static app.U.twice; twice(21)`) and
+                        // inherited implicit this-calls. Package-qualified
+                        // calls (receiver set) keep the exclusion.
                         recordExcluded(filePath, call.line, 'method-kind-mismatch');
                         continue;
                     }
                 }
 
+                // From-import submodule receiver (fix #224): `from . import
+                // jobs` + `jobs.submit(...)` — the receiver resolves to a
+                // project module FILE (graph-build composed the submodule
+                // specifier), so it behaves as a module receiver below.
+                // Confirm/route-enabling only: the class-method exclusion
+                // branch keeps its parser-marked receiverIsModule condition
+                // (a rare package attribute/submodule name collision must not
+                // become exclusion evidence).
+                const recvSubmoduleRel = (!call.receiverIsModule && call.isMethod && call.receiver &&
+                    langTraits(fileEntry.language)?.typeSystem === 'structural')
+                    ? _submoduleReceiverModule(index, fileEntry, call.receiver) : null;
+
                 // Module receiver: httpx.get() / ns.helper() dispatches to a
                 // module export — it can never be a CLASS METHOD call. Applies
                 // only when every target is a class method; standalone-function
@@ -1275,7 +1353,8 @@ function findCallers(index, name, options = {}) {
                 // target (directly or one re-export hop) → visible, not
                 // excluded (deep barrel chains exceed the hop budget);
                 // unresolved-but-project-looking → visible (resolver gap).
-                if (!bindingId && !resolvedBySameClass && call.isMethod && call.receiverIsModule &&
+                if (!bindingId && !resolvedBySameClass && call.isMethod &&
+                    (call.receiverIsModule || recvSubmoduleRel) &&
                     call.receiver && langTraits(fileEntry.language)?.typeSystem === 'structural' &&
                     (fileEntry.importBindings || []).length > 0) {
                     const recvBindings = fileEntry.importBindings.filter(b => b.name === call.receiver);
@@ -1284,7 +1363,8 @@ function findCallers(index, name, options = {}) {
                         let reaches = false;
                         let projectish = false;
                         for (const b of recvBindings) {
-                            const rel = fileEntry.moduleResolved && fileEntry.moduleResolved[b.module];
+                            const rel = (fileEntry.moduleResolved && fileEntry.moduleResolved[b.module]) ||
+                                recvSubmoduleRel;
                             if (!rel) {
                                 const mod = String(b.module);
                                 const firstSeg = mod.split(/[./]/).filter(Boolean)[0];
@@ -1448,15 +1528,17 @@ function findCallers(index, name, options = {}) {
                     const targetTypes = dispatchTargetTypes(targetDefs);
                     if (targetTypes.size > 0) {
                         // Use inferred receiverType when available (Go/Java/Rust parameter type tracking)
-                        // Generic type parameters by convention are not type
-                        // identity in EITHER direction (fix #220): a receiver
-                        // typed 'T' neither validates against a blanket-impl
-                        // target named 'T' nor excludes a concrete target —
-                        // T may be instantiated with anything. A short-caps
-                        // name with a real project type def is a class.
+                        // Generic type parameters are not type identity in
+                        // EITHER direction (fix #220, made precise by #229):
+                        // a receiver typed 'T' or 'TStore' neither validates
+                        // against a blanket-impl target nor excludes a
+                        // concrete one — T may be instantiated with anything,
+                        // including the target class. Declared-in-enclosing-
+                        // scope check first (`fn f<TStore: Wipe>(t: &TStore)`
+                        // shadows even a same-named project type), 1-2-char
+                        // ALL-CAPS convention as fallback.
                         let knownType = call.receiverType || fieldHopType;
-                        if (knownType && /^[A-Z][A-Z0-9]?$/.test(knownType) &&
-                            !(index.symbols.get(knownType) || []).some(d => IDENTITY_TYPE_KINDS.has(d.type))) knownType = null;
+                        if (knownType && _isGenericParamReceiverType(index, filePath, call.line, knownType)) knownType = null;
                         if (knownType) {
                             const viaFieldHop = !call.receiverType; // declared-field hop (fix #202)
                             // Exclusion requires an UNRELATED type. A receiver typed
@@ -1575,7 +1657,14 @@ function findCallers(index, name, options = {}) {
                                         localTypeCache.set(cacheKey, localTypes);
                                     }
                                     if (localTypes) {
-                                        const inferredType = localTypes.get(call.receiver);
+                                        // The inference map re-derives receiver types
+                                        // from the calls cache — the same generic-param
+                                        // guard applies (fix #229: `t.wipe()` on
+                                        // `t: &T` used to re-infer 'T' here and
+                                        // exclude after the typed branch nulled it).
+                                        let inferredType = localTypes.get(call.receiver);
+                                        if (inferredType && _isGenericParamReceiverType(
+                                            index, filePath, call.line, inferredType)) inferredType = null;
                                         if (inferredType) {
                                             if (targetTypes.has(inferredType)) {
                                                 // Identity discipline (fix #206) — same as the
@@ -1661,8 +1750,11 @@ function findCallers(index, name, options = {}) {
                                 }
                                 if (!matchesTarget) {
                                     // Rust/Go path calls (Type::method() / pkg.Method()): receiver IS the type name
-                                    // If it doesn't match target, it's definitely a different type — filter it
-                                    if (call.isPathCall && /^[A-Z]/.test(call.receiver)) {
+                                    // If it doesn't match target, it's definitely a different type — filter it.
+                                    // `Self` exempt (fix #232, the #222(2) rule): Self names the
+                                    // enclosing impl's type, not a foreign one — same-class
+                                    // resolution above owns it.
+                                    if (call.isPathCall && /^[A-Z]/.test(call.receiver) && call.receiver !== 'Self') {
                                         isUncertain = true;
                                         typeMismatch = true;
                                         if (collectAccount) {
@@ -1724,12 +1816,35 @@ function findCallers(index, name, options = {}) {
                 // syntactic args is not evidence in Go — only too-many prunes.
                 // Binding/same-class evidence outranks the count (then a
                 // mismatch more likely means our param parse is wrong).
+                let arityNoFit = false;
                 if (collectAccount && !bindingId && !resolvedBySameClass &&
                     call.argCount != null && !call.argSpread &&
                     langTraits(fileEntry.language)?.typeSystem === 'nominal' &&
                     !_callArityCompatible(call, targetDefs, fileEntry.language)) {
-                    recordExcluded(filePath, call.line, 'arity-mismatch');
-                    continue;
+                    // Fits-elsewhere carve-out (fix #229): "binds a different
+                    // symbol" needs a different symbol the call COULD bind.
+                    // When the argument count also fits no OTHER callable def
+                    // of the name project-wide, a wrong-arity call at an
+                    // EVIDENCE-BACKED site is a BROKEN CALL SITE (or a parse
+                    // gap) — the thing verify/diff-impact exist to surface
+                    // after a signature change. Marked and allowed to flow:
+                    // receiver/type-qualified evidence confirms it into
+                    // verify's arg-check (mismatch band). The exclusion stays
+                    // when a sibling overload or another definition fits the
+                    // count (jdtls-measured), and the dispatch gate below
+                    // re-excludes marked calls that would only confirm via the
+                    // single-owner rule — that rule presumes no other
+                    // candidate, which the wrong arity disproves toward
+                    // EXTERNAL code (Arrays.asList(1,2,3) vs a project 0-param
+                    // asList: unique project ownership is not evidence here).
+                    const pinnedKeys = new Set(targetDefs.map(d => `${d.file}:${d.startLine}`));
+                    const otherDefs = definitions.filter(d =>
+                        !NON_CALLABLE_TYPES.has(d.type) && !pinnedKeys.has(`${d.file}:${d.startLine}`));
+                    if (otherDefs.length > 0 && _callArityCompatible(call, otherDefs, fileEntry.language)) {
+                        recordExcluded(filePath, call.line, 'arity-mismatch');
+                        continue;
+                    }
+                    arityNoFit = true;
                 }
 
                 // Overload discipline (fix #205, languages with arity/type
@@ -1797,7 +1912,8 @@ function findCallers(index, name, options = {}) {
                 // evidence, not a bare name match.
                 const hasSamePackageEvidence = !hasImportLink &&
                     langTraits(fileEntry.language)?.typeSystem === 'nominal' &&
-                    targetDefs2.some(d => d.file && path.dirname(d.file) === path.dirname(filePath));
+                    targetDefs2.some(d => d.file &&
+                        _sameNominalPackageDir(path.dirname(d.file), path.dirname(filePath), fileEntry.language));
 
                 // Possible-dispatch tiering (nominal languages, contract surface
                 // only): methodCallInclusion='auto' confirms method calls with
@@ -1975,6 +2091,75 @@ function findCallers(index, name, options = {}) {
                             });
                             continue;
                         }
+                        // Wrong-arity call that fits no project def (fix #229
+                        // carve-out marker): the single-owner rule presumes no
+                        // other candidate exists, but the arity disproves the
+                        // project-side match — the call binds EXTERNAL code
+                        // (Arrays.asList(1,2,3)). Only receiver/type-qualified
+                        // evidence may carry a wrong-arity call to the
+                        // mismatch band; ownership alone re-excludes here.
+                        if (arityNoFit) {
+                            recordExcluded(filePath, call.line, 'arity-mismatch');
+                            continue;
+                        }
+                    }
+                }
+
+                // Bare-call name ownership, Java (fix #229): where
+                // bareCallReachesMethods a bare call CAN denote a method —
+                // via a static import or an inherited implicit this-call —
+                // but file-level scope evidence cannot CONFIRM one: a bare
+                // name in Java resolves through the class scope (own +
+                // inherited members) or a static import, never through
+                // package-mate visibility. Confirmed tier: the enclosing
+                // class is a dispatch-capable receiver type for the target
+                // (inherited this-call), or a static import of the name /
+                // wildcard static import resolves to a target file
+                // (compiler-grade name evidence, the #217 rule). A static
+                // import resolving to a DIFFERENT project file owns the name
+                // (other-definition-import); everything else routes VISIBLE
+                // (external static imports and unresolved ancestry are not
+                // exclusion evidence — JLS scope nesting also lets inherited
+                // members shadow imports, so 'unknown' never excludes).
+                if (collectAccount && !call.isMethod && !call.receiver && !bindingId &&
+                    !resolvedBySameClass &&
+                    langTraits(fileEntry.language)?.typeSystem === 'nominal' &&
+                    langTraits(fileEntry.language)?.bareCallReachesMethods &&
+                    targetDefs2.length > 0 && targetDefs2.every(d =>
+                        !NON_CALLABLE_TYPES.has(d.type) && (d.className || d.receiver))) {
+                    const tTypes = dispatchTargetTypes(targetDefs2);
+                    const enclosingClass = callerSymbol && callerSymbol.className;
+                    if (!(enclosingClass && tTypes.has(enclosingClass))) {
+                        const targetFiles = new Set(targetDefs2.map(d => d.file).filter(Boolean));
+                        let verdict = null; // 'target' | 'other' | 'unknown'
+                        for (const im of (fileEntry.importBindings || [])) {
+                            const mod = String(im.module || '');
+                            if (im.name === call.name && mod.endsWith('.' + call.name)) {
+                                const rel = fileEntry.moduleResolved && fileEntry.moduleResolved[mod];
+                                verdict = rel
+                                    ? (targetFiles.has(path.join(index.root, rel)) ? 'target' : 'other')
+                                    : 'unknown';
+                                break;
+                            }
+                        }
+                        if (verdict === null && fileEntry.moduleResolved) {
+                            for (const [mod, rel] of Object.entries(fileEntry.moduleResolved)) {
+                                if (mod.endsWith('.*') && targetFiles.has(path.join(index.root, rel))) {
+                                    verdict = 'target';
+                                    break;
+                                }
+                            }
+                        }
+                        if (verdict === 'other') {
+                            recordExcluded(filePath, call.line, 'other-definition-import');
+                            continue;
+                        }
+                        if (verdict !== 'target') {
+                            routeUnverified(filePath, fileEntry, call, 'method-ambiguous', calledAs, {
+                                dispatchCandidates: methodOwnerKeys().size,
+                            });
+                            continue;
+                        }
                     }
                 }
 
@@ -2046,8 +2231,9 @@ function findCallers(index, name, options = {}) {
                     // Module-qualified calls (z.string(), ns.helper()) are
                     // exempt: the module IS name-level evidence, and the
                     // module-ownership block above already routed the ones
-                    // whose module doesn't reach the target.
-                    if (call.isMethod && !call.receiverIsModule) {
+                    // whose module doesn't reach the target. Submodule
+                    // receivers (fix #224) are module receivers too.
+                    if (call.isMethod && !call.receiverIsModule && !recvSubmoduleRel) {
                         const tTypes = dispatchTargetTypes(targetDefs2);
                         const typeQualifiedReceiver = !!(call.receiver && tTypes.has(call.receiver));
                         // External-producer receiver (fix #222, httpx-measured
@@ -2064,6 +2250,27 @@ function findCallers(index, name, options = {}) {
                             });
                             continue;
                         }
+                        // Builtin-global receiver (fix #232, campaign-measured:
+                        // console.log() confirmed scope-match against a private
+                        // Logger.log — its single project-wide owner). console/
+                        // window/process/... name HOST objects, so unique
+                        // project ownership is not identity evidence for the
+                        // receiver. Shadowing keeps normal physics: a project
+                        // def, file binding, or parser-typed receiver of the
+                        // name wins. Demote-only (`window.fn = projectFn`
+                        // attachment is a real pattern — #222(4) name-knowledge
+                        // rule): visible possible-dispatch, never excluded.
+                        if (!typeQualifiedReceiver && call.receiver && !call.receiverType &&
+                            ['javascript', 'typescript', 'tsx', 'html'].includes(fileEntry.language) &&
+                            JS_GLOBAL_RECEIVERS.has(call.receiver) &&
+                            (index.symbols.get(call.receiver) || []).length === 0 &&
+                            !fileEntry.bindings?.some(b => b.name === call.receiver)) {
+                            routeUnverified(filePath, fileEntry, call, 'possible-dispatch', calledAs, {
+                                dispatchVia: `${call.receiver} — builtin global`,
+                                externalContract: true,
+                            });
+                            continue;
+                        }
                         // A method call cannot denote a standalone function
                         // (fix #218, rich-measured: `console.print(...)`
                         // confirmed scope-match against module-level print):
@@ -2072,12 +2279,28 @@ function findCallers(index, name, options = {}) {
                         // receivers are excluded above (#198); untyped ones
                         // route visible. Module receivers stay exempt
                         // (rich.print(...) IS the module function).
+                        // EXCEPTION (fix #254, W8 BUG-4 — verify's BUG-BX rule
+                        // in the engine, range-based): a receiver naming a
+                        // namespace/module block that CONTAINS the pinned def
+                        // is a qualified function call — containment is
+                        // identity evidence, and the #215 scope check ties
+                        // the receiver to the containing file. Falls through
+                        // to confirm with its import/scope evidence.
                         if (!typeQualifiedReceiver && targetDefs2.length > 0 &&
                             targetDefs2.every(d => !d.className && !d.receiver)) {
-                            routeUnverified(filePath, fileEntry, call, 'method-ambiguous', calledAs, {
-                                dispatchCandidates: methodOwnerKeys().size,
-                            });
-                            continue;
+                            if (!_namespaceContainedDef(index, fileEntry, filePath,
+                                call.receiver, call.name, targetDefs2)) {
+                                // Candidates here are the standalone defs the call
+                                // MIGHT reach through an unmodeled module receiver
+                                // (dynamic import) — methodOwnerKeys counts method
+                                // owners only and reported a contradictory 0
+                                // (fix #230).
+                                routeUnverified(filePath, fileEntry, call, 'method-ambiguous', calledAs, {
+                                    dispatchCandidates: methodOwnerKeys().size ||
+                                        targetDefs2.filter(d => !NON_CALLABLE_TYPES.has(d.type)).length,
+                                });
+                                continue;
+                            }
                         }
                         // External-contract single owner (fix #210): same
                         // physics as the nominal gate above — an override
@@ -2123,6 +2346,31 @@ function findCallers(index, name, options = {}) {
                     }
                 }
 
+                // Receiver-less counterpart of the gate's arityNoFit guard
+                // (fix #229): a bare/package-qualified wrong-arity call may
+                // reach the mismatch band only on compiler-grade NAME evidence
+                // — an import binding of the name resolving to a target file
+                // (a `use`/static-import pins the name, so the wrong arity is
+                // a broken call site, not another target). Scope-match alone
+                // cannot carry it: the arity disproves the project-side match,
+                // so the call more likely binds code UCN cannot see.
+                if (arityNoFit && !call.isMethod) {
+                    let arityNameEvidence = false;
+                    const tFiles = new Set(targetDefs.map(d => d.file).filter(Boolean));
+                    for (const im of (fileEntry.importBindings || [])) {
+                        if (im.name !== call.name) continue;
+                        const rel = fileEntry.moduleResolved && fileEntry.moduleResolved[String(im.module || '')];
+                        if (rel && tFiles.has(path.join(index.root, rel))) {
+                            arityNameEvidence = true;
+                            break;
+                        }
+                    }
+                    if (!arityNameEvidence) {
+                        recordExcluded(filePath, call.line, 'arity-mismatch');
+                        continue;
+                    }
+                }
+
                 if (!pendingByFile.has(filePath)) pendingByFile.set(filePath, []);
                 pendingByFile.get(filePath).push({
                     call, fileEntry, callerSymbol,
@@ -2306,7 +2554,7 @@ function findCallers(index, name, options = {}) {
         // Retained unverified-tier entries, sorted (relativePath, line) per the
         // output ordering contract.
         unverifiedEntries.sort((a, b) => {
-            if (a.relativePath !== b.relativePath) return a.relativePath.localeCompare(b.relativePath);
+            if (a.relativePath !== b.relativePath) return codeUnitCompare(a.relativePath, b.relativePath);
             return (a.line || 0) - (b.line || 0);
         });
         Object.defineProperty(callers, 'unverifiedEntries', {
@@ -2435,6 +2683,14 @@ function findCallees(index, def, options = {}) {
             localTypes = _buildTypedLocalTypeMap(index, def, calls);
         }
 
+        // Return-type flow map (lazy — only built if a single-owner
+        // resolution needs the external-producer/typed-receiver defeater).
+        let _flowMap;
+        const flowMap = () => {
+            if (_flowMap === undefined) _flowMap = _buildReturnTypeFlowMap(index, def.file, calls);
+            return _flowMap;
+        };
+
         let siteOrdinal = -1;
         for (const call of calls) {
             siteOrdinal++;
@@ -2453,6 +2709,55 @@ function findCallees(index, def, options = {}) {
             if (!isDirectMatch && !isNestedCallback) continue;
             if (calleeAccount) calleeAccount.totalSites++;
 
+            // Declared-field receiver hop (fix #231 — callee-side parity
+            // with the caller side's #202/#219): `tm.service.Save()` /
+            // `this._map.has()` records carry receiverRoot/receiverField —
+            // resolve the field's DECLARED type and treat it exactly like a
+            // parser-inferred receiverType. this-rooted structural hops
+            // resolve the root at query time (the enclosing class — arrows
+            // keep lexical `this`; nested function declarations are their
+            // own symbols without className, so dynamic-this shapes resolve
+            // to nothing). _declaredFieldType's guards apply: interface/
+            // trait-typed and generic-param fields return null.
+            let fieldHopType = null;
+            if (call.isMethod && !call.receiverType && call.receiverField) {
+                let hopRoot = call.receiverRootType;
+                if (!hopRoot && call.receiverRoot === 'this' &&
+                    langTraits(language)?.typeSystem === 'structural') {
+                    hopRoot = index.findEnclosingFunction(def.file, call.line, true)?.className;
+                }
+                if (hopRoot) fieldHopType = _declaredFieldType(index, hopRoot, call.receiverField, language);
+            }
+
+            // Go package-qualified receiver: resolve the import module up
+            // front so the dispatch chain can tell package calls apart from
+            // type-qualified method expressions (fix #236 — a receiver that
+            // is neither stays eligible for type-qualified resolution below).
+            let goImportModule = null;
+            if (call.isMethod && call.receiver && langTraits(language)?.hasReceiverPackageCalls) {
+                const goImports = fileEntry?.imports || [];
+                // Handle Go version suffixes: k8s.io/klog/v2 → klog, not v2
+                goImportModule = goImports.find(mod => {
+                    const parts = mod.split('/');
+                    const last = parts[parts.length - 1];
+                    const pkgName = (/^v\d+$/.test(last) && parts.length > 1) ? parts[parts.length - 2] : last;
+                    return pkgName === call.receiver;
+                }) || null;
+            }
+
+            // Type-qualified receiver resolution (fix #236): the receiver
+            // NAMES a type — Foo::new() / Kit.make() / Helper.process().
+            // Only consulted when no stronger evidence (local type, parser
+            // receiverType, field hop, import package) claims the call.
+            let typeQual = null;
+            if (call.isMethod && !call.isConstructor && call.receiver &&
+                !call.receiverType && !fieldHopType && !goImportModule &&
+                !call.receiverIsModule && !call.selfAttribute &&
+                !['self', 'cls', 'this', 'super', 'Self'].includes(call.receiver) &&
+                !(localTypes && localTypes.has(call.receiver))) {
+                typeQual = _calleeTypeQualifiedReceiver(index, def, fileEntry, call, language);
+            }
+
             // Smart method call handling:
             // - Go: include all method calls (Go doesn't use this/self/cls)
             // - self/this.method(): resolve to same-class method (handled below)
@@ -2461,8 +2766,10 @@ function findCallees(index, def, options = {}) {
             if (call.isMethod) {
                 if (call.selfAttribute && language === 'python') {
                     // Will be resolved in second pass below
-                } else if (['self', 'cls', 'this'].includes(call.receiver)) {
+                } else if (['self', 'cls', 'this'].includes(call.receiver) ||
+                           (call.receiver === 'Self' && language === 'rust')) {
                     // self.method() / cls.method() / this.method() — resolve to same-class method below
+                    // Rust Self::method() resolves same-impl the same way (fix #236, the #232 callee analog)
                 } else if (call.receiver === 'super') {
                     // super().method() — resolve to parent class method below
                 } else if (localTypes && localTypes.has(call.receiver)) {
@@ -2500,18 +2807,29 @@ function findCallees(index, def, options = {}) {
                             callees.set(key, { name: call.name, bindingId: match.bindingId, count: 1,
                                 ...(collectAccount && { sites: [call.line], siteIds: [siteId] }) });
                         }
+                    } else if (_nonCallableFieldMember(index, typeName, call.name, language)) {
+                        // The known receiver type declares the name as its own
+                        // non-callable FIELD — a member reference, never a
+                        // callee (fix #231: `delete(cs.cache, key)` captured
+                        // cs.cache as a method-value callee; cache is
+                        // CacheService's map-typed field, which shadows any
+                        // same-named project function through this receiver).
+                        noteSite(siteId, 'excluded', 'member-reference', call);
                     } else if (collectAccount) {
                         // Locally-typed receiver, but the type defines no such
                         // method in the index — visible, never silently dropped.
                         noteUnverified(siteId, call, 'uncertain-receiver');
                     }
                     continue;
-                } else if (call.receiverType) {
+                } else if (call.receiverType || fieldHopType) {
                     // Use parser-inferred receiverType for method resolution
                     // Go/Java/Rust: from param/receiver type declarations
                     // JS/TS: from `new Foo()` assignments or TypeScript type annotations
                     // Python: from constructor calls or type annotations
-                    const typeName = call.receiverType;
+                    // fieldHopType: the declared type of a one-hop field
+                    // receiver (fix #231 — tm.service.Save() resolves Save
+                    // through the `service *DataService` declaration)
+                    const typeName = call.receiverType || fieldHopType;
                     const symbols = index.symbols.get(call.name);
                     const isCallableRT = (s) => !NON_CALLABLE_TYPES.has(s.type) ||
                         (s.type === 'field' && s.fieldType && /^func\b/.test(s.fieldType));
@@ -2544,20 +2862,26 @@ function findCallees(index, def, options = {}) {
                         }
                         continue;
                     }
+                    // No match on the typed receiver. A name the type declares
+                    // as its own non-callable FIELD is a member reference,
+                    // never a callee (fix #231); a builtin hop type with no
+                    // project match is an external call (this._map.has on
+                    // `_map: WeakMap<...>` — the #219 caller-side analog).
+                    if (_nonCallableFieldMember(index, typeName, call.name, language)) {
+                        noteSite(siteId, 'excluded', 'member-reference', call);
+                        continue;
+                    }
+                    if (fieldHopType && BUILTIN_RECEIVER_TYPES.has(typeName)) {
+                        noteSite(siteId, 'external', null, call);
+                        continue;
+                    }
                     // No match found with inferred type — fall through to include as unresolved
-                } else if (langTraits(language)?.hasReceiverPackageCalls && call.receiver) {
+                } else if (goImportModule) {
                     // Go package-qualified calls: klog.Infof(), wait.UntilWithContext()
-                    // Check if receiver is an import alias and resolve to correct package
-                    const goImports = fileEntry?.imports || [];
-                    // Find import whose package name matches the receiver
-                    // Handle Go version suffixes: k8s.io/klog/v2 → klog, not v2
-                    const importModule = goImports.find(mod => {
-                        const parts = mod.split('/');
-                        const last = parts[parts.length - 1];
-                        const pkgName = (/^v\d+$/.test(last) && parts.length > 1) ? parts[parts.length - 2] : last;
-                        return pkgName === call.receiver;
-                    });
-                    if (importModule) {
+                    // The receiver is an import alias (resolved above) — find
+                    // definitions from that package.
+                    const importModule = goImportModule;
+                    {
                         // Receiver is an import alias — resolve to definitions from that package
                         const symbols = index.symbols.get(call.name);
                         if (symbols) {
@@ -2600,14 +2924,47 @@ function findCallees(index, def, options = {}) {
                         noteSite(siteId, 'external', null, call);
                         continue;
                     }
+                } else if (typeQual) {
+                    // Type-qualified receiver (fix #236): the receiver NAMES a
+                    // type, so the type owns the call — Foo::new() is Foo's
+                    // new; String::new() / Math.max() are external and must
+                    // never confirm a project method through a bare name
+                    // binding (the caller side excludes the identical edges
+                    // as path-type-mismatch — the two directions now agree).
+                    if (typeQual.match) {
+                        const match = typeQual.match;
+                        const key = match.bindingId || `${typeQual.typeName}.${call.name}`;
+                        const existing = callees.get(key);
+                        if (existing) {
+                            existing.count += 1;
+                            if (collectAccount) { existing.sites.push(call.line); existing.siteIds.push(siteId); }
+                        } else {
+                            callees.set(key, { name: call.name, bindingId: match.bindingId, count: 1,
+                                ...(collectAccount && { sites: [call.line], siteIds: [siteId] }) });
+                        }
+                        continue;
+                    }
+                    if (typeQual.external) {
+                        noteSite(siteId, 'external', null, call);
+                        continue;
+                    }
+                    noteUnverified(siteId, call, typeQual.unverified);
+                    continue;
                 } else if (langTraits(language)?.methodCallInclusion === 'explicit' && !options.includeMethods) {
                     noteSite(siteId, 'filtered', 'method-calls-excluded', call);
                     continue;
                 }
             }
 
-            // Skip keywords and built-ins
-            if (index.isKeyword(call.name, language)) {
+            // Skip keywords and built-ins — EXCEPT self/super-received method
+            // calls, which the same-class/super passes below resolve to real
+            // definitions (fix #238: `super().__init__(x)` and the JS/TS
+            // `super(...)` 'constructor' record were routed external here
+            // because __init__/constructor sit in the builtin name sets).
+            const selfShaped = call.isMethod &&
+                (['self', 'cls', 'this', 'super'].includes(call.receiver) ||
+                 (call.receiver === 'Self' && language === 'rust'));
+            if (!selfShaped && index.isKeyword(call.name, language)) {
                 noteSite(siteId, 'external', null, call);
                 continue;
             }
@@ -2651,7 +3008,9 @@ function findCallees(index, def, options = {}) {
             }
 
             // Collect self/this.method() calls for same-class resolution
-            if (call.isMethod && ['self', 'cls', 'this'].includes(call.receiver)) {
+            // (Rust Self::method() resolves the same way — fix #236)
+            if (call.isMethod && (['self', 'cls', 'this'].includes(call.receiver) ||
+                (call.receiver === 'Self' && language === 'rust'))) {
                 if (!selfMethodCalls) selfMethodCalls = [];
                 selfMethodCalls.push({ call, siteId });
                 continue;
@@ -2685,6 +3044,25 @@ function findCallees(index, def, options = {}) {
                 // Different strategies by language family:
                 if (bindings.length === 0 && call.isMethod) {
                     if (langTraits(language)?.typeSystem === 'structural') {
+                        // A KNOWN receiver type routes before any name heuristic
+                        // (fix #257 — the caller side's #198 trust rule brought to
+                        // findCallees): `canonicalSymbols.set(...)` on a `new Map()`
+                        // local resolved exact-binding into a test fixture's
+                        // CacheService.set. Builtin-typed receivers are host calls;
+                        // a receiver typed to a project class resolves to that class
+                        // (or an ancestor defining the method), never by bare name.
+                        const route = _calleeReceiverTypeRoute(index, call, localTypes, language);
+                        if (route?.external) {
+                            noteSite(siteId, 'external', null, call);
+                            continue;
+                        } else if (route?.resolve) {
+                            bindingResolved = route.resolve.bindingId;
+                            calleeKey = bindingResolved ||
+                                `${route.resolve.className}.${effectiveName}`;
+                        } else if (route?.uncertain) {
+                            isUncertain = true;
+                            uncertainReason = 'uncertain-receiver';
+                        } else {
                         // JS/TS/Python: mark uncertain unless receiver has import/binding
                         // evidence in file scope AND that binding can plausibly have this method.
                         // Prevents false positives like m.get() → repository.get() when m is
@@ -2700,6 +3078,7 @@ function findCallees(index, def, options = {}) {
                             // Functions don't have user-defined methods (return value is unknown)
                             isUncertain = true;
                         }
+                        }
                     } else {
                         // Go/Java/Rust: nominal type systems make single-def method links
                         // reliable. Only mark uncertain when multiple definitions exist
@@ -2708,11 +3087,12 @@ function findCallees(index, def, options = {}) {
                         if (defs && defs.length > 1) {
                             // Go: if receiverType is known, check if it matches exactly one def
                             // This resolves ambiguity like Framework.Run vs Scheduler.Run
-                            const rType = call.receiverType || localTypes?.get(call.receiver);
+                            const rType = call.receiverType || fieldHopType || localTypes?.get(call.receiver);
                             if (rType && langTraits(language)?.typeSystem === 'nominal') {
                                 const matchingDef = defs.find(d =>
-                                    d.className === rType ||
-                                    (d.receiver && d.receiver.replace(/^\*/, '') === rType));
+                                    (d.className === rType ||
+                                    (d.receiver && d.receiver.replace(/^\*/, '') === rType)) &&
+                                    _calleeLanguageCompatible(index, d, language));
                                 if (matchingDef) {
                                     // Resolved to specific type — not uncertain
                                     calleeKey = matchingDef.bindingId || `${rType}.${call.name}`;
@@ -2757,14 +3137,13 @@ function findCallees(index, def, options = {}) {
                         // spraying every same-name def (#223, ripgrep-measured
                         // on the callee eval arm: HiArgs::from_low_args calls
                         // three sibling types' from_low_args — every def was
-                        // claimed at all three sites). Variable receivers match
-                        // no class → unchanged full fan-out; bare calls (Java
+                        // claimed at all three sites). Bare calls (Java
                         // implicit-this overloads) keep fanning out.
                         let otherBindings = bindings.filter(b =>
                             b.startLine !== def.startLine
                         );
                         const fanReceiver = call.receiver || call.receiverType;
-                        if (fanReceiver && otherBindings.length > 1) {
+                        if (fanReceiver && otherBindings.length > 0) {
                             const symsForName = index.symbols.get(call.name) || [];
                             const classMatched = otherBindings.filter(b => {
                                 const bSym = symsForName.find(s => s.bindingId === b.id);
@@ -2772,8 +3151,24 @@ function findCallees(index, def, options = {}) {
                                     (bSym.receiver && bSym.receiver.replace(/^\*/, '')));
                                 return cls === fanReceiver;
                             });
-                            if (classMatched.length > 0) otherBindings = classMatched;
+                            if (classMatched.length > 0) {
+                                otherBindings = classMatched;
+                            } else if (call.isMethod && call.receiver) {
+                                // Untyped-receiver same-name method call:
+                                // name-equality with the enclosing def is not
+                                // receiver evidence (fix #237 — CacheService
+                                // .get's `cache.get(key)` sprayed a confirmed
+                                // edge onto ApiClient.get, leaking reachability
+                                // credit across classes). Route through the
+                                // uncertain machinery: multi-owner names stay
+                                // visible method-ambiguous; the single-owner
+                                // rule (with its defeaters) may still confirm.
+                                isUncertain = true;
+                                uncertainReason = 'method-ambiguous';
+                                otherBindings = null;
+                            }
                         }
+                        if (otherBindings) {
                         for (const ob of otherBindings) {
                             const existing = callees.get(ob.id);
                             if (existing) {
@@ -2794,6 +3189,9 @@ function findCallees(index, def, options = {}) {
                             noteSite(siteId, 'excluded', 'self-recursion', call);
                         }
                         continue; // Already added all overloads, skip normal add
+                        }
+                        // otherBindings === null: fall through to the
+                        // single-owner check + uncertain handling below.
                     } else if (def.className && !call.isMethod) {
                         // Implicit same-class call (Java: execute() means this.execute())
                         // Try to resolve to a binding in the same class via symbol lookup
@@ -2835,6 +3233,24 @@ function findCallees(index, def, options = {}) {
                 }
             }
 
+            // Single project-wide owner (fix #236 — the caller side's
+            // #204/#209 rule on the callee side): an untyped-receiver method
+            // call whose name has exactly ONE owner type resolves to that
+            // owner's method — `k.run()` where only Kit defines run. Without
+            // it, trace trees stopped expanding at statically-resolvable
+            // calls the caller direction confirms.
+            if (isUncertain && call.isMethod && call.receiver && !bindingResolved) {
+                const fm = flowMap();
+                const flowEntry = fm ? _lookupReturnTypeFlow(fm, call) : undefined;
+                const owner = _calleeSingleOwnerMatch(index, def, fileEntry, call, effectiveName, language, flowEntry);
+                if (owner) {
+                    isUncertain = false;
+                    bindingResolved = owner.bindingId;
+                    calleeKey = owner.bindingId ||
+                        `${owner.className || (owner.receiver || '').replace(/^\*/, '')}.${effectiveName}`;
+                }
+            }
+
             if (isUncertain) {
                 if (collectAccount) {
                     // Contract mode: uncertain callee edges are never silently
@@ -3155,7 +3571,7 @@ function findCallees(index, def, options = {}) {
             // Stable ordering (output contract): by name, then reason.
             const unverifiedList = [...unverifiedCallees.values()]
                 .map(e => ({ ...e, sites: [...e.sites].sort((a, b) => a - b) }))
-                .sort((a, b) => a.name.localeCompare(b.name) || a.reason.localeCompare(b.reason));
+                .sort((a, b) => codeUnitCompare(a.name, b.name) || codeUnitCompare(a.reason, b.reason));
             Object.defineProperty(result, 'calleeAccount', {
                 value: calleeAccount, enumerable: false, writable: true, configurable: true,
             });
@@ -3702,6 +4118,16 @@ function _qualifiedProducerDefs(index, fileEntry, receiver, defs) {
 // Builtin receiver types from literal/annotation inference (Python builtins,
 // JS globals, TS predefined types). Definitionally not project classes, so a
 // mismatch against a project class target is always positive evidence.
+// ECMAScript host/ambient OBJECT globals (fix #232): a method call on one of
+// these names — unshadowed by any project def or file binding — reaches host
+// code, not a project method. Name-knowledge only, so demote-only: routes
+// possible-dispatch, never excludes (window.fn = projectFn is a real pattern).
+const JS_GLOBAL_RECEIVERS = new Set([
+    'console', 'window', 'document', 'globalThis', 'process', 'navigator',
+    'Math', 'JSON', 'Reflect', 'Intl', 'localStorage', 'sessionStorage',
+    'crypto', 'performance', 'history', 'location', 'screen',
+]);
+
 const BUILTIN_RECEIVER_TYPES = new Set([
     'dict', 'list', 'set', 'tuple', 'str', 'int', 'float', 'bool', 'bytes', 'frozenset',
     'Array', 'String', 'Object', 'RegExp', 'Number', 'Boolean', 'Map', 'Set', 'Promise',
@@ -3902,6 +4328,28 @@ function _nameBindingReaches(index, startAbs, name, targetFiles, maxDepth = 4) {
     return unknown ? 'unknown' : 'no';
 }
 
+/**
+ * From-import submodule receivers (fix #224): `from . import jobs` binds
+ * jobs.py as a plain NAME — the parser can't mark it a module alias (a
+ * from-import name may be a symbol), but the resolver proved it at build
+ * time: graph-build records the composed submodule specifier ('.jobs') in
+ * fileEntry.moduleResolved when it resolves to a project file. A hit makes
+ * the receiver a MODULE receiver at query time. Returns the ROOT-RELATIVE
+ * module file or null. Trait-gated (`submoduleImports` — Python only).
+ */
+function _submoduleReceiverModule(index, fileEntry, receiverName) {
+    if (!receiverName || !fileEntry || !fileEntry.moduleResolved) return null;
+    if (!langTraits(fileEntry.language)?.submoduleImports) return null;
+    for (const b of (fileEntry.importBindings || [])) {
+        if (!b || b.name !== receiverName || b.module == null) continue;
+        const mod = String(b.module);
+        const spec = mod.endsWith('.') ? mod + receiverName : mod + '.' + receiverName;
+        const rel = fileEntry.moduleResolved[spec];
+        if (rel) return rel;
+    }
+    return null;
+}
+
 /**
  * Bounded-depth reachability over the import graph: can `fromAbs` reach any
  * target file through re-export/import chains? Barrel hierarchies routinely
@@ -3951,6 +4399,96 @@ function _projectTopLevelNames(index) {
 }
 
 const IDENTITY_TYPE_KINDS = new Set(['class', 'struct', 'interface', 'trait', 'enum']);
+
+/**
+ * Parse a generics/type-parameter list text (`<T: Wipe, U>`, `<T extends X>`,
+ * Go `[T any, U comparable]`) into the set of declared type-parameter NAMES.
+ * Rust lifetimes (`'a`) and const params (`const N: usize`) are not receiver
+ * types and are skipped.
+ */
+function _genericParamNames(genericsText) {
+    if (!genericsText || typeof genericsText !== 'string') return null;
+    const inner = genericsText.trim().replace(/^[<[]/, '').replace(/[>\]]$/, '');
+    const names = new Set();
+    let depth = 0, start = 0;
+    const parts = [];
+    for (let i = 0; i < inner.length; i++) {
+        const ch = inner[i];
+        if (ch === '<' || ch === '[' || ch === '(') depth++;
+        else if (ch === '>' || ch === ']' || ch === ')') depth--;
+        else if (ch === ',' && depth === 0) { parts.push(inner.slice(start, i)); start = i + 1; }
+    }
+    parts.push(inner.slice(start));
+    for (let p of parts) {
+        p = p.trim();
+        if (!p || p.startsWith("'") || p.startsWith('const ')) continue;
+        const m = p.match(/^([A-Za-z_][A-Za-z0-9_]*)/);
+        if (m) names.add(m[1]);
+    }
+    return names.size > 0 ? names : null;
+}
+
+/**
+ * Is typeName a declared GENERIC TYPE PARAMETER in scope at this call site —
+ * on the enclosing function itself (`fn f<TStore: Wipe>(t: &TStore)`) or on
+ * its class/struct (`impl<T> Processor<T>` methods see the struct's `<T>`)?
+ * A generic param is never type identity in either direction (fix #229, the
+ * #220(1) convention rule made precise): it may be instantiated with the
+ * target class, so it neither validates nor excludes — and the declaration
+ * shadows any same-named project type inside the function.
+ */
+function _isEnclosingGenericParam(index, filePath, line, typeName) {
+    const enclosing = index.findEnclosingFunction(filePath, line, true);
+    if (!enclosing) return false;
+    const own = _genericParamNames(enclosing.generics);
+    if (own && own.has(typeName)) return true;
+    if (enclosing.className) {
+        const classDefs = (index.symbols.get(enclosing.className) || []).filter(d =>
+            IDENTITY_TYPE_KINDS.has(d.type) && d.file === filePath);
+        for (const cd of classDefs) {
+            const cg = _genericParamNames(cd.generics);
+            if (cg && cg.has(typeName)) return true;
+        }
+    }
+    return false;
+}
+
+/**
+ * Receiver-type identity guard shared by the parser-typed branch and the
+ * local-inference fallback: a name is NOT usable as type identity when it is
+ * a generic type param — declared in the enclosing scope, or matching the
+ * 1-2-char ALL-CAPS convention (T, K, V, T1) with no project type def (the
+ * declaring scope may be outside what UCN parsed).
+ */
+function _isGenericParamReceiverType(index, filePath, line, typeName) {
+    if (!typeName) return false;
+    if (/^[A-Z][A-Z0-9]?$/.test(typeName) &&
+        !(index.symbols.get(typeName) || []).some(d => IDENTITY_TYPE_KINDS.has(d.type))) return true;
+    return _isEnclosingGenericParam(index, filePath, line, typeName);
+}
+
+/**
+ * Java same-package check across Maven/Gradle source roots (fix #246):
+ * src/main/java/<pkg> and src/test/java/<pkg> hold the SAME package —
+ * javac compiles both source sets onto one classpath, so a test file sees
+ * the main tree's package members without an import. Two dirs are
+ * same-package when equal, or (Java only) when both sit under a
+ * `src/<set>/java/` source root with the same module prefix and the same
+ * package-relative path. Different modules keep distinct prefixes, so
+ * same-named packages across a monorepo stay separate.
+ */
+function _sameNominalPackageDir(dirA, dirB, language) {
+    if (dirA === dirB) return true;
+    if (language !== 'java') return false;
+    const norm = (d) => {
+        const m = d.match(/^(.*?)[\/\\]src[\/\\][^\/\\]+[\/\\]java(?:[\/\\](.*))?$/);
+        return m ? `${m[1]}${m[2] || ''}` : null;
+    };
+    const a = norm(dirA);
+    if (a === null) return false;
+    return a === norm(dirB);
+}
+
 function _resolveReceiverTypeIdentity(index, filePath, knownType, targetDefs) {
     const typeDefs = (index.symbols.get(knownType) || []).filter(d => IDENTITY_TYPE_KINDS.has(d.type));
     if (typeDefs.length <= 1) return 'target';
@@ -4079,6 +4617,360 @@ function _declaredFieldType(index, rootType, fieldName, language) {
     return typeName;
 }
 
+/**
+ * Is a member reference `<recv>.name` on a KNOWN receiver type provably a
+ * non-callable FIELD — never an edge to any project callable? (fix #231:
+ * `delete(cs.cache, key)` captures cs.cache as a potential method-value
+ * callee, but `cache` is CacheService's own map-typed field.) The member
+ * access resolves to the MEMBER — a same-named function elsewhere in the
+ * project is unreachable through this receiver (Go field names shadow
+ * promoted methods; Java field/method namespaces are separate but a
+ * paren-less member access is always the field). Only certainty excludes:
+ * every same-type member of the name must be a field whose declared type is
+ * present, not a function type (Go `func(...)`, Rust fn/Fn*, structural
+ * arrow/Callable/Function — the #219 callable-owner shapes), and — for
+ * structural languages — trusted for exclusion (#198: builtin or project
+ * class; `any`/alias/interface heads prove nothing, and an untyped JS field
+ * could hold a same-named function via `this.cb = cb`, the #218c
+ * member-alias family).
+ */
+function _nonCallableFieldMember(index, typeName, name, language) {
+    const defs = index.symbols.get(name);
+    if (!defs || defs.length === 0) return false;
+    const onType = defs.filter(d => d.className === typeName ||
+        (d.receiver && d.receiver.replace(/^\*/, '') === typeName));
+    if (onType.length === 0) return false;
+    for (const d of onType) {
+        if (d.type !== 'field' && d.memberType !== 'field' && d.memberType !== 'private field') return false;
+        if (!d.fieldType) return false;
+        if (_callableFieldDef(index, d)) return false;
+        const raw = String(d.fieldType).trim();
+        if (/^func\b/.test(raw)) return false;
+        if (/\bfn\s*\(|\b(?:Fn|FnMut|FnOnce)\s*[(<]/.test(raw)) return false;
+        if (langTraits(language)?.typeSystem === 'structural') {
+            const head = _normalizeFieldTypeName(raw, language);
+            if (!head || _STRUCTURAL_FLOW_REJECT.has(head) ||
+                !_receiverTypeTrustedForExclusion(index, head)) return false;
+        }
+    }
+    return true;
+}
+
+/**
+ * Callee-side type-qualified receiver resolution (fix #236 — the caller
+ * side's #206/#208/#220/#222 identity discipline brought to findCallees).
+ * A receiver that NAMES a type owns the call: `Foo::new()` is Foo's new and
+ * nothing else's, `String::new()` can never be a project method, `Kit.make()`
+ * through an imported class binding is Kit's make. Returns:
+ *   { match, typeName }    — confirm this definition
+ *   { external: true }     — type-qualified call on a builtin/external type
+ *   { unverified: reason } — visible, never confirmed through a name binding
+ *   null                   — receiver is not provably a type; no opinion
+ * Shape gates follow typeQualifiedCallStyle (#206): Rust requires the path
+ * form (a dot-call receiver matching a type name is a variable); Go method
+ * expressions pass the receiver instance as the first argument, so zero-arg
+ * calls on type-named receivers are variables. `use X as Y` aliases are
+ * judged by the original name (#222b); pure type-alias sets close over their
+ * base (#208). Structural class receivers additionally need scope evidence
+ * (#215): the class defined in this file or a file binding of the name —
+ * an unbound capitalized receiver may be a parameter or local.
+ */
+/**
+ * Namespace/module-container resolution (fix #254, W8 BUG-4 — verify's
+ * BUG-BX rule brought into the engine, range-based): `Utils.slug()` where a
+ * `namespace Utils` block CONTAINS a definition of `slug` is a qualified
+ * FUNCTION call, not a method call — containment is identity evidence, not
+ * a naming heuristic. Requires #215 scope evidence tying the receiver to
+ * the containing file: the call site sits in that file, or an import
+ * binding of the receiver name resolves toward it (_importReaches — barrel
+ * chains). Structural languages only; Rust `mod` paths keep the path
+ * machinery.
+ * @param {object} index - ProjectIndex instance
+ * @param {object} fileEntry - The CALL SITE's file entry
+ * @param {string} callFileAbs - The call site's absolute file path
+ * @param {string} receiverName - The call's receiver text
+ * @param {string} calleeName - The called name
+ * @param {Array|null} restrictDefs - Candidate defs to test containment on
+ *        (the pinned targets on the caller side); null = all callable defs
+ * @returns {object|null} The contained definition, or null
+ */
+function _namespaceContainedDef(index, fileEntry, callFileAbs, receiverName, calleeName, restrictDefs) {
+    if (!receiverName || receiverName.includes('.') || receiverName.includes('::')) return null;
+    const nsDefs = (index.symbols.get(receiverName) || []).filter(s =>
+        s.type === 'namespace' || s.type === 'module');
+    if (nsDefs.length === 0) return null;
+    const candidates = restrictDefs ||
+        (index.symbols.get(calleeName) || []).filter(s => !NON_CALLABLE_TYPES.has(s.type));
+    const contained = candidates.filter(d => nsDefs.some(ns =>
+        ns.file === d.file && ns.startLine <= d.startLine &&
+        (ns.endLine ?? Infinity) >= (d.endLine ?? d.startLine)));
+    if (contained.length === 0) return null;
+    const targetAbs = new Set(contained.map(d => d.file));
+    if (targetAbs.has(callFileAbs)) return contained[0];
+    for (const im of (fileEntry?.importBindings || [])) {
+        if (im.name !== receiverName) continue;
+        const rel = fileEntry.moduleResolved && fileEntry.moduleResolved[String(im.module || '')];
+        if (!rel) continue;
+        const abs = path.join(index.root, rel);
+        if (targetAbs.has(abs) || _importReaches(index, abs, targetAbs)) {
+            return contained.find(d => d.file === abs) || contained[0];
+        }
+    }
+    return null;
+}
+
+function _calleeTypeQualifiedReceiver(index, def, fileEntry, call, language) {
+    let receiver = call.receiver;
+    if (!receiver) return null;
+    const traits = langTraits(language);
+    const style = traits?.typeQualifiedCallStyle;
+    if (style === 'path' && !call.isPathCall) return null;
+    if (style === 'method-expr' && call.argCount != null && call.argCount < 1) return null;
+
+    // Namespace/module container (fix #254): checked before the
+    // capitalization gate — namespaces resolve by symbol lookup, not case
+    // convention. A hit is a qualified function call, exempt from the
+    // method filter downstream.
+    if (traits?.typeSystem === 'structural') {
+        const nsDef = _namespaceContainedDef(index, fileEntry, def.file, receiver, call.name, null);
+        if (nsDef) return { match: nsDef, typeName: receiver };
+    }
+
+    const typeKindsOf = (name) => (index.symbols.get(name) || [])
+        .filter(d => IDENTITY_TYPE_KINDS.has(d.type) || (d.type === 'type' && d.aliasOf));
+
+    // Multi-segment path receivers (std::sync::Arc::new): the LAST segment
+    // is the type; the qualifier owns it (#206). A crate-internal qualifier
+    // (crate/self/super) resolves by name below; std/core/alloc paths are
+    // provably external even when a project type shares the name; any other
+    // qualified name is unpinnable without a module resolver — visible when
+    // a project type shares the name, external when none does.
+    if (style === 'path' && receiver.includes('::')) {
+        const segs = receiver.split('::');
+        const lastSeg = segs[segs.length - 1];
+        if (!/^[A-Z]/.test(lastSeg)) return null; // module-path function call
+        if (['crate', 'self', 'super'].includes(segs[0])) {
+            receiver = lastSeg;
+        } else if (typeKindsOf(lastSeg).length === 0) {
+            return { external: true };
+        } else if (['std', 'core', 'alloc'].includes(segs[0])) {
+            return { external: true };
+        } else {
+            return { unverified: 'method-ambiguous' };
+        }
+    }
+    if (!/^[A-Z]/.test(receiver)) return null;
+    let typeDefs = typeKindsOf(receiver);
+    if (typeDefs.length === 0) {
+        for (const im of (fileEntry?.importBindings || [])) {
+            if (im.name !== receiver) continue;
+            const orig = String(im.module || '').split('::').pop();
+            if (orig && orig !== receiver && typeKindsOf(orig).length > 0) {
+                receiver = orig;
+                typeDefs = typeKindsOf(orig);
+                break;
+            }
+        }
+    }
+    if (typeDefs.length === 0) {
+        // No project type of this name. Rust path receivers are provably
+        // types (modules are lowercase, variables cannot be path-qualified):
+        // a generic-param name stays visible — its instantiation could be
+        // any project type — everything else (String::new, Arc::new) is
+        // external. Java CamelCase receivers are classes (Math.max) —
+        // external; ALL_CAPS receivers are constants (variables) and keep
+        // normal resolution. Go capitalizes exported package-level VARIABLES
+        // too, and a structural capitalized receiver may be a parameter or
+        // local — neither acts without a project type def.
+        if (style === 'path') {
+            if (_isGenericParamReceiverType(index, def.file, call.line, receiver)) {
+                return { unverified: 'method-ambiguous' };
+            }
+            return { external: true };
+        }
+        if (language === 'java' && /[a-z]/.test(receiver) &&
+            !_isGenericParamReceiverType(index, def.file, call.line, receiver)) {
+            return { external: true };
+        }
+        return null;
+    }
+    if (traits?.typeSystem === 'structural') {
+        const inFile = typeDefs.some(d => d.file === def.file);
+        const bound = (fileEntry?.bindings || []).some(b => b.name === receiver);
+        if (!inFile && !bound) return null;
+    }
+    // Alias closure (#208): a pure alias set agreeing on one base is the
+    // SAME type — the method may live on the base's inherent impl.
+    const candidateTypes = [receiver];
+    if (typeDefs.every(d => d.type === 'type' && d.aliasOf)) {
+        const bases = new Set(typeDefs.map(d => d.aliasOf));
+        if (bases.size === 1) candidateTypes.push(bases.values().next().value);
+    }
+    const symbols = index.symbols.get(call.name) || [];
+    const isCallable = (s) => !NON_CALLABLE_TYPES.has(s.type) ||
+        (s.type === 'field' && s.fieldType && /^func\b/.test(s.fieldType));
+    const matchOn = (tn) => symbols.find(s => isCallable(s) &&
+        (s.className === tn || (s.receiver && s.receiver.replace(/^\*/, '') === tn)));
+    let match = null;
+    let matchedType = null;
+    for (const tn of candidateTypes) {
+        match = matchOn(tn);
+        if (match) { matchedType = tn; break; }
+    }
+    if (!match && traits?.typeSystem === 'nominal') {
+        for (const tn of candidateTypes) {
+            const parentNames = index._getInheritanceParents?.(tn, def.file);
+            if (!parentNames) continue;
+            for (const pName of parentNames) {
+                match = matchOn(pName);
+                if (match) { matchedType = pName; break; }
+            }
+            if (match) break;
+        }
+    }
+    if (match) return { match, typeName: matchedType };
+    // A project type that does not define the method: a trait/interface
+    // receiver dispatches across N impls; otherwise the method comes from a
+    // derive/trait impl/external contract the index cannot pin. Visible —
+    // never confirmed through an unrelated name binding.
+    const dispatchy = typeDefs.some(d => d.type === 'trait' || d.type === 'interface');
+    return { unverified: dispatchy ? 'method-ambiguous' : 'uncertain-receiver' };
+}
+
+/**
+ * Single project-wide owner resolution for an untyped-receiver method call
+ * (fix #236 — the caller side's #204/#209 rule on the callee side): when
+ * every callable definition of the name lives on ONE owner type, `k.run()`
+ * can only be that owner's method. Defeaters mirror the caller contract:
+ * builtin-global receivers (#232 — name knowledge, not evidence), module
+ * receivers (#209/#224 — module attribute lookup, not instance dispatch),
+ * a standalone function sharing the name (rebinding can route the call
+ * there, #218b), callable fields as second owners (#219), external-contract
+ * override markers (#210 — the overridden definition lives OUTSIDE the
+ * project), receivers typed by the flow map to something other than the
+ * owner (#199/#207/#222(4)), nominal arity mismatch (#205), and a test-file
+ * owner for a production caller. Returns the owner's definition or null.
+ */
+// Languages whose symbols are mutually callable — a JS/TS call site can bind
+// a symbol defined in any of these; every other language only binds its own
+// (fix #257: java/python/rust fixture defs of CacheService.set counted as ONE
+// owner for a JavaScript call — cross-language edges are never callable).
+const _JS_CALLABLE_FAMILY = new Set(['javascript', 'typescript', 'tsx', 'html']);
+
+function _calleeLanguageCompatible(index, def, callerLanguage) {
+    if (!callerLanguage) return true;
+    const defLang = index.files.get(def.file)?.language;
+    if (!defLang || defLang === callerLanguage) return true;
+    return _JS_CALLABLE_FAMILY.has(defLang) && _JS_CALLABLE_FAMILY.has(callerLanguage);
+}
+
+/**
+ * Ancestor-name closure of a type via the extends graph (bounded BFS) — a
+ * receiver typed Child legitimately reaches methods defined on Base (the
+ * #198 ancestor rule, callee direction). Includes the type itself.
+ */
+function _receiverTypeAncestors(index, typeName, maxHops = 6) {
+    const seen = new Set([typeName]);
+    let frontier = [typeName];
+    for (let hop = 0; hop < maxHops && frontier.length; hop++) {
+        const next = [];
+        for (const cls of frontier) {
+            const parents = index._getInheritanceParents?.(cls) || [];
+            for (const p of parents) {
+                const pName = typeof p === 'string' ? p : p?.name;
+                if (pName && !seen.has(pName)) { seen.add(pName); next.push(pName); }
+            }
+        }
+        frontier = next;
+    }
+    return seen;
+}
+
+/**
+ * Route a structural method call by its KNOWN receiver type (fix #257).
+ * Returns:
+ *   { resolve: def } — exactly one language-compatible project class (the
+ *                      type itself or an ancestor) defines the method
+ *   { external }     — builtin receiver type with no project match
+ *                      (Map.set is host code)
+ *   { uncertain }    — known type matching nothing or ambiguously: visible,
+ *                      never confirmed by bare-name resolution
+ *   null             — receiver type unknown; existing heuristics decide
+ */
+function _calleeReceiverTypeRoute(index, call, localTypes, language) {
+    const raw = call.receiverType || localTypes?.get(call.receiver);
+    if (!raw || typeof raw !== 'string') return null;
+    const head = _structuralTypeHead(raw) || raw;
+    const norm = _PY_TYPING_BUILTINS[head] || head;
+    const defs = (index.symbols.get(call.name) || []).filter(d =>
+        !NON_CALLABLE_TYPES.has(d.type) && d.className &&
+        _calleeLanguageCompatible(index, d, language));
+    let matches = defs.filter(d => d.className === head || d.className === norm);
+    if (matches.length === 0 && defs.length > 0) {
+        const ancestors = _receiverTypeAncestors(index, head);
+        matches = defs.filter(d => ancestors.has(d.className));
+    }
+    if (matches.length === 1) return { resolve: matches[0] };
+    if (matches.length > 1) return { uncertain: true }; // same-name classes — identity unresolvable (#206)
+    if (BUILTIN_RECEIVER_TYPES.has(norm)) return { external: true };
+    return { uncertain: true }; // known non-builtin type with no project method
+}
+
+function _calleeSingleOwnerMatch(index, def, fileEntry, call, name, language, flowEntry) {
+    if (JS_GLOBAL_RECEIVERS.has(call.receiver)) return null;
+    if (call.receiverIsModule) return null;
+    const traits = langTraits(language);
+    if (traits?.typeSystem === 'structural' &&
+        _submoduleReceiverModule(index, fileEntry, call.receiver)) return null;
+    const defs = index.symbols.get(name) || [];
+    const ownerKeys = new Set();
+    const ownerDefs = [];
+    for (const d of defs) {
+        if (!_calleeLanguageCompatible(index, d, language)) continue; // fix #257
+        if (NON_CALLABLE_TYPES.has(d.type)) {
+            if (d.type === 'field' && d.className && _callableFieldDef(index, d)) {
+                ownerKeys.add(d.className);
+            }
+            continue;
+        }
+        const o = d.className || (d.receiver && d.receiver.replace(/^\*/, ''));
+        if (!o) return null;
+        ownerKeys.add(o);
+        ownerDefs.push(d);
+    }
+    if (ownerKeys.size !== 1 || ownerDefs.length === 0) return null;
+    if (ownerDefs.length > 1 && traits?.hasArityOverloads) return null;
+    if (ownerDefs.some(d => isOverrideMarked(d))) return null;
+    if (flowEntry) {
+        const owner = ownerKeys.values().next().value;
+        if (flowEntry.externalVia || (flowEntry.type && flowEntry.type !== owner)) return null;
+    }
+    // Parser-typed receiver disagreeing with the owner defeats the match
+    // unless the owner is an ancestor of the receiver's type (fix #257 —
+    // the flow-map defeater above, extended to #198 parser-typed receivers:
+    // a `new Map()` local can never single-owner-confirm a project method).
+    if (call.receiverType && typeof call.receiverType === 'string') {
+        const owner = ownerKeys.values().next().value;
+        const head = _structuralTypeHead(call.receiverType) || call.receiverType;
+        const norm = _PY_TYPING_BUILTINS[head] || head;
+        if (head !== owner && norm !== owner &&
+            !_receiverTypeAncestors(index, head).has(owner)) return null;
+    }
+    if (traits?.typeSystem === 'nominal' && call.argCount != null &&
+        !_callArityCompatible(call, ownerDefs, language)) return null;
+    const match = ownerDefs[0];
+    // The owner's def IS the querying def: an untyped-receiver call cannot
+    // prove self-recursion (a true one resolves via self/this/Self) — the
+    // receiver is more likely an external value (fix #237).
+    if (match.file === def.file && match.startLine === def.startLine) return null;
+    const callerFe = index.files.get(def.file);
+    const matchFe = index.files.get(match.file);
+    if (matchFe && callerFe &&
+        (isTestFile(matchFe.relativePath, matchFe.language) || isTestPath(matchFe.relativePath)) &&
+        !(isTestFile(callerFe.relativePath, callerFe.language) || isTestPath(callerFe.relativePath))) return null;
+    return match;
+}
+
 /**
  * Can this call's argument count fit any target definition's parameter
  * range? (Nominal languages only — their compilers enforce arity, so a
@@ -4833,4 +5725,4 @@ function findCallbackUsages(index, name) {
     return usages;
 }
 
-module.exports = { getCachedCalls, findCallers, findCallees, getInstanceAttributeTypes, findCallbackUsages };
+module.exports = { getCachedCalls, findCallers, findCallees, getInstanceAttributeTypes, findCallbackUsages, _nameBindingReaches, _declaredFieldType, _projectTopLevelNames };