ucn 5.1.1 → 5.2.1

package/core/callers.js

@@ -660,6 +660,35 @@ function findCallers(index, name, options = {}) {
                     continue;
                 }
 
+                if (fileEntry.language === 'cpp' && call.macroArguments) {
+                    const macroDisposition = _cppMacroTargetDisposition(
+                        index, filePath, call,
+                        options.targetDefinitions || definitions);
+                    if (macroDisposition?.kind === 'other') {
+                        recordExcluded(filePath, call.line,
+                            'macro-requalified');
+                        continue;
+                    }
+                    if (macroDisposition?.kind === 'uncertain') {
+                        if (collectAccount) {
+                            routeUnverified(
+                                filePath, fileEntry, call,
+                                'macro-expansion', calledAs, {
+                                    uncertaintyClass: 'compile-time-dispatch',
+                                    dispatchFamily:
+                                        `${call.name} macro expansion`,
+                                });
+                        }
+                        continue;
+                    }
+                    if (macroDisposition?.kind === 'qualified') {
+                        call = macroDisposition.qualifier === 'global'
+                            ? { ...call, globalQualified: true }
+                            : { ...call, isMethod: true, isPathCall: true,
+                                receiver: macroDisposition.qualifier };
+                    }
+                }
+
                 // Static member syntax carries two compiler symbols:
                 // `JValue.Compare(...)` calls Compare and references the
                 // JValue type. Class/type queries promise usages rather than
@@ -1180,8 +1209,10 @@ function findCallers(index, name, options = {}) {
                             } };
                         foldCtxCache.set(filePath, foldCtx);
                     }
-                    const flowEntry = _foldChainedReceiverType(
-                        index, fileEntry, filePath, call, foldCtx) ||
+                    const flowEntry = _goBuiltinChainedReceiverType(
+                        index, fileEntry, filePath, call) ||
+                        _foldChainedReceiverType(
+                            index, fileEntry, filePath, call, foldCtx) ||
                         _nominalChainedReceiverType(
                             index, call, fileEntry, filePath);
                     if (flowEntry && flowEntry.externalVia) {
@@ -1412,7 +1443,50 @@ function findCallers(index, name, options = {}) {
                             if (td.className) targetTypes.add(td.className);
                             if (td.receiver) targetTypes.add(td.receiver.replace(/^\*/, ''));
                         }
-                        if (targetTypes.size > 0 && call.receiver && call.receiverType &&
+                        // Qualified receiver types resolve their package FIRST
+                        // (fix #298 — the #273 gate's callback twin):
+                        // `netDial = (&net.Dialer{}).DialContext` is net's
+                        // Dialer; the bare name must never match a project
+                        // `Dialer` pin, and the external contract must carry
+                        // its label so consumers can defer the site.
+                        if (fileEntry.language === 'go' &&
+                            call.receiverType && call.receiverTypeQualifier) {
+                            const cbQualified = _goQualifiedReceiverType(
+                                index, fileEntry, call.receiverTypeQualifier,
+                                call.receiverType);
+                            if (cbQualified) {
+                                const cbIsContract = cbQualified.kind === 'project' &&
+                                    cbQualified.defs.some(d =>
+                                        d.type === 'interface' || d.type === 'trait');
+                                if (cbQualified.kind !== 'project' || cbIsContract) {
+                                    if (collectAccount) {
+                                        const cbPlatformConcrete = cbQualified.kind !== 'project' &&
+                                            getLanguageAdapter('go')?.isPlatformConcreteType?.(
+                                                call.receiverTypeQualifier, call.receiverType);
+                                        if (cbPlatformConcrete) {
+                                            recordExcluded(filePath, call.line, 'external-package');
+                                        } else {
+                                            routeUnverified(filePath, fileEntry, call, 'possible-dispatch', calledAs, {
+                                                dispatchVia: cbQualified.via,
+                                                dispatchCandidates: countDispatchCandidates(call.receiverType),
+                                                ...(cbQualified.kind !== 'project' && { externalContract: true }),
+                                            });
+                                        }
+                                    }
+                                    continue;
+                                }
+                            } else {
+                                // Unresolvable qualifier — the bare type name
+                                // must not match a project pin (#206c). Visible,
+                                // never validated, never excluded.
+                                if (collectAccount) {
+                                    routeUnverified(filePath, fileEntry, call, 'method-ambiguous', calledAs,
+                                        { dispatchCandidates: countDispatchCandidates(call.receiverType) });
+                                }
+                                continue;
+                            }
+                        }
+                        if (targetTypes.size > 0 && call.receiverType &&
                             !targetTypes.has(call.receiverType)) {
                             // Raw-set mismatch — check the CLOSED set (aliases +
                             // non-overriding subtypes incl. Go embedding) before
@@ -2461,15 +2535,27 @@ function findCallers(index, name, options = {}) {
                                 }
                                 const inherited = _isAncestorOfTargetClass(
                                     index, d.className, [boundDef]);
+                                const derivedApplicableSibling = definitions.some(candidate =>
+                                    candidate !== boundDef &&
+                                    !NON_CALLABLE_TYPES.has(candidate.type) &&
+                                    candidate.className === boundDef.className &&
+                                    candidate.file === boundDef.file &&
+                                    _overloadApplicable(index, call, candidate));
                                 // A derived same-name method hides inherited
                                 // overloads until it proves inapplicable.
                                 // Receiver-blind bindings may therefore be
                                 // overruled only when static argument evidence
                                 // accepts this inherited target and rejects the
-                                // derived declaration.
+                                // ENTIRE derived overload family. Looking only
+                                // at the first bound declaration let an
+                                // inapplicable one-arg sibling expose a hidden
+                                // base method even when another derived sibling
+                                // accepted the call (Newtonsoft's new static
+                                // JArray/JObject/JProperty.Load families).
                                 return inherited &&
                                     _overloadApplicable(index, call, d) &&
-                                    !_overloadApplicable(index, call, boundDef);
+                                    !_overloadApplicable(index, call, boundDef) &&
+                                    !derivedApplicableSibling;
                             })) ||
                             (fileEntry.language === 'cpp' &&
                              !boundDef.className && !boundDef.receiver &&
@@ -2854,15 +2940,32 @@ function findCallers(index, name, options = {}) {
                     const recvBindings = recvExportedNamespace
                         ? [] : _structuralModuleBindings(fileEntry, call);
                     const tFiles = targetDefinitionFiles;
-                    if ((recvBindings.length > 0 || recvExportedNamespace) && !tFiles.has(filePath)) {
+                    // Same-file targets get NO bypass (fix #294, flask-measured:
+                    // `import json as _json; _json.dump(...)` in the file
+                    // defining flask's own `dump` confirmed a self-recursive
+                    // caller — the module indirection REPLACES file scope, so
+                    // ownership adjudicates regardless of where the pin sits;
+                    // the Go twin already excludes same-file package-qualified
+                    // targets). A self-module import stays confirmable: a
+                    // binding resolving into a target file reaches immediately.
+                    if (recvBindings.length > 0 || recvExportedNamespace) {
                         let reaches = recvExportedNamespace?.verdict === 'yes';
                         let projectish = !!recvExportedNamespace;
                         let undetermined = recvExportedNamespace?.verdict === 'unknown';
                         let resolvedBindings = recvExportedNamespace ? 1 : 0;
                         let definitiveOtherBindings = recvExportedNamespace?.verdict === 'no' ? 1 : 0;
                         for (const b of recvBindings) {
-                            const rel = (fileEntry.moduleResolved && fileEntry.moduleResolved[b.module]) ||
-                                recvSubmoduleRel;
+                            // A #224-proven submodule receiver chases from the
+                            // SUBMODULE file, never the from-module (fix #294b,
+                            // flask fresh-arm-measured: `from . import cli;
+                            // cli.AppGroup()` chased flask/__init__.py — where
+                            // 'AppGroup' dead-ends — because moduleResolved['.']
+                            // shadowed the composed '.cli' spec, excluding a
+                            // compiler-true constructor edge other-definition-
+                            // import. Python binds the submodule OBJECT; its
+                            // attributes live in the submodule file.
+                            const rel = recvSubmoduleRel ||
+                                (fileEntry.moduleResolved && fileEntry.moduleResolved[b.module]);
                             if (!rel) {
                                 const mod = String(b.module);
                                 const firstSeg = mod.split(/[./]/).filter(Boolean)[0];
@@ -3084,7 +3187,8 @@ function findCallers(index, name, options = {}) {
                         }
                         if (knownType && !BUILTIN_RECEIVER_TYPES.has(knownType) &&
                             _isGenericParamReceiverType(index, filePath, call.line, knownType)) {
-                            knownType = null;
+                            knownType = _genericParamTraitTarget(
+                                index, filePath, call.line, knownType, targetDefs);
                         }
                         if (knownType) {
                             const explicitInterfaceTarget = fileEntry.language === 'csharp' &&
@@ -3183,7 +3287,14 @@ function findCallers(index, name, options = {}) {
                                         (call.receiverTypeQualifier && call.receiverTypeFlowFile)) {
                                         const identity = _resolveStructuralFlowTypeIdentity(
                                             index, call.receiverTypeFlowFile || filePath, knownType, targetDefs,
-                                            call.receiverTypeFlowFile ? undefined : call.receiverTypeQualifier);
+                                            call.receiverTypeFlowFile ? undefined : call.receiverTypeQualifier,
+                                            (call.receiverTypeFlowFile &&
+                                                call.receiverTypeFlowFile !== filePath) ? undefined : {
+                                                file: filePath,
+                                                line: call.line,
+                                                scopeStart: call.enclosingFunction?.startLine,
+                                                scopeEnd: call.enclosingFunction?.endLine,
+                                            });
                                         if (identity === 'other') {
                                             receiverTypeValidated = false;
                                         } else if (identity === 'unknown') {
@@ -3200,7 +3311,14 @@ function findCallers(index, name, options = {}) {
                                 // ancestry before treating it as unrelated.
                                 const identity = _resolveStructuralFlowTypeIdentity(
                                     index, call.receiverTypeFlowFile || filePath, knownType, targetDefs,
-                                    call.receiverTypeFlowFile ? undefined : call.receiverTypeQualifier);
+                                    call.receiverTypeFlowFile ? undefined : call.receiverTypeQualifier,
+                                    (call.receiverTypeFlowFile &&
+                                        call.receiverTypeFlowFile !== filePath) ? undefined : {
+                                        file: filePath,
+                                        line: call.line,
+                                        scopeStart: call.enclosingFunction?.startLine,
+                                        scopeEnd: call.enclosingFunction?.endLine,
+                                    });
                                 if (identity === 'target') {
                                     receiverTypeValidated = true;
                                 } else if (identity === 'unknown') {
@@ -3494,6 +3612,31 @@ function findCallers(index, name, options = {}) {
                                     // resolution above owns it.
                                     if (call.isPathCall && /^[A-Z]/.test(receiverSegment) &&
                                         receiverSegment !== 'Self') {
+                                        // Generic-param carve-out (fix #296 — the
+                                        // #222(2) single-def branch had this, the
+                                        // multi-def fallback didn't): `F::as_cast(x)`
+                                        // instantiates with ANY bound-satisfying
+                                        // type — visible, never excluded.
+                                        if (collectAccount &&
+                                            /^[A-Z][A-Z0-9]?$/.test(receiverSegment) &&
+                                            !(index.symbols.get(receiverSegment) || []).some(d => IDENTITY_TYPE_KINDS.has(d.type))) {
+                                            routeUnverified(filePath, fileEntry, call, 'method-ambiguous', calledAs, {
+                                                dispatchCandidates: methodOwnerKeys().size,
+                                            });
+                                            continue;
+                                        }
+                                        // Trait-declaration pin (fix #296): a
+                                        // concrete non-target receiver can
+                                        // implement the pinned trait — route
+                                        // visible, never exclude.
+                                        const traitVia = collectAccount &&
+                                            _traitDeclPinImplementorRoute(index, fileEntry, receiverSegment, targetDefs);
+                                        if (traitVia) {
+                                            routeUnverified(filePath, fileEntry, call, 'possible-dispatch', calledAs, {
+                                                dispatchVia: `${receiverSegment} — ${traitVia} implementor`,
+                                            });
+                                            continue;
+                                        }
                                         isUncertain = true;
                                         typeMismatch = true;
                                         if (collectAccount) {
@@ -3510,7 +3653,9 @@ function findCallers(index, name, options = {}) {
                                         const t = d.className || (d.receiver && d.receiver.replace(/^\*/, ''));
                                         if (t && !targetTypes.has(t)) nonTargetClasses.add(t);
                                     }
-                                    const matchesOther = [...nonTargetClasses].some(cn => cn.toLowerCase() === receiverLower);
+                                    const matchesOtherExact = [...nonTargetClasses].some(cn => cn === receiverSegment);
+                                    const matchesOther = matchesOtherExact ||
+                                        [...nonTargetClasses].some(cn => cn.toLowerCase() === receiverLower);
                                     if (matchesOther) {
                                         isUncertain = true;
                                         typeMismatch = true;
@@ -3530,6 +3675,21 @@ function findCallers(index, name, options = {}) {
                                                 });
                                                 continue;
                                             }
+                                            // fix #300: a CROSS-CASE receiver-name→class
+                                            // match is the naming-convention guess
+                                            // (`storage` ~ `Storage`) — a guess is never
+                                            // exclusion evidence (#266(2)). itertools-
+                                            // measured: a test-file `struct Iter` poisoned
+                                            // every `iter`-named receiver project-wide,
+                                            // excluding rust-analyzer-attested true edges.
+                                            // Exact-case matches keep excluding (grpc-go
+                                            // names builder structs and locals both `bb`).
+                                            if (!matchesOtherExact) {
+                                                routeUnverified(filePath, fileEntry, call, 'method-ambiguous', calledAs, {
+                                                    dispatchCandidates: methodOwnerKeys().size,
+                                                });
+                                                continue;
+                                            }
                                             recordExcluded(filePath, call.line, 'receiver-other-class');
                                             continue;
                                         }
@@ -3641,12 +3801,21 @@ function findCallers(index, name, options = {}) {
                 const targetDefs2 = options.targetDefinitions || definitions;
                 const targetFiles2 = new Set(targetDefs2.map(d => d.file).filter(Boolean));
                 const callerImports = index.importGraph.get(filePath);
-                let importEdgeLink = !!(callerImports && setSome(callerImports, imp => targetFiles2.has(imp)));
+                // The caller's OWN file never counts as an import-edge hit
+                // (fix #294): an import cycle (flask json/__init__ →
+                // wrappers → json/__init__) would launder same-file
+                // membership into "import edge" evidence, bypassing the
+                // same-file clause's receiver guard below. Same-file
+                // evidence is governed there, not here.
+                let importEdgeLink = !!(callerImports && setSome(callerImports,
+                    imp => imp !== filePath && targetFiles2.has(imp)));
                 // Check one level of re-exports (barrel files) for import evidence
                 if (!importEdgeLink && callerImports) {
                     for (const imp of callerImports) {
+                        if (imp === filePath) continue;
                         const transImports = index.importGraph.get(imp);
-                        if (transImports && setSome(transImports, ti => targetFiles2.has(ti))) {
+                        if (transImports && setSome(transImports,
+                            ti => ti !== filePath && targetFiles2.has(ti))) {
                             importEdgeLink = true;
                             break;
                         }
@@ -3842,6 +4011,21 @@ function findCallers(index, name, options = {}) {
                                 });
                                 continue;
                             }
+                            // Trait-declaration pin (fix #296, serde-as_cast-
+                            // measured): `u64::as_cast` / `Limb::as_cast` /
+                            // `Self::Unsigned::as_cast` under the trait's own
+                            // method pin dispatch through the pinned slot —
+                            // macro-generated impls are invisible to the
+                            // index, so the receiver not being a target type
+                            // proves nothing. Route visible, never exclude.
+                            const traitVia2 = _traitDeclPinImplementorRoute(
+                                index, fileEntry, pathReceiverSegment, targetDefs2);
+                            if (traitVia2) {
+                                routeUnverified(filePath, fileEntry, call, 'possible-dispatch', calledAs, {
+                                    dispatchVia: `${pathReceiverSegment} — ${traitVia2} implementor`,
+                                });
+                                continue;
+                            }
                             recordExcluded(filePath, call.line, 'path-type-mismatch');
                             continue;
                         }
@@ -4250,6 +4434,42 @@ function findCallers(index, name, options = {}) {
                             });
                             continue;
                         }
+                        // Module-rooted dotted receiver (fix #294, flask-
+                        // measured: `flask.json.load(out)` — receiverRoot
+                        // resolves to a MODULE import binding, so the call
+                        // dispatches through a module attribute the field-hop
+                        // machinery cannot type. Single project-wide ownership
+                        // of the method name is not evidence about a module
+                        // attribute's value: demote-only, visible, attributed
+                        // via the dotted path. A root the hop DID type is
+                        // handled above (knownDispatchType); a from-import
+                        // root counts only when the resolver PROVED it a
+                        // submodule (#224 — a from-import name may be a
+                        // plain symbol, never assume).
+                        if (!typeQualifiedReceiver && !knownDispatchType &&
+                            call.receiverRoot && !call.receiverRootType &&
+                            langTraits(fileEntry.language)?.typeSystem === 'structural') {
+                            const rootBinding = (fileEntry.importBindings || []).find(b =>
+                                b && b.name === call.receiverRoot);
+                            const rootIsModule = !!rootBinding && (
+                                rootBinding.kind === 'import' ||
+                                !!_submoduleReceiverModule(index, fileEntry, call.receiverRoot));
+                            if (rootIsModule) {
+                                const field = call.receiverField ? `.${call.receiverField}` : '';
+                                routeUnverified(filePath, fileEntry, call, 'possible-dispatch', calledAs, {
+                                    dispatchVia: `${call.receiverRoot}${field} — module attribute`,
+                                    // Structured marker (outcome-eval-measured,
+                                    // 2026-08-19): the site's name binds the
+                                    // module's export surface, not the pinned
+                                    // def — rename policies defer these like
+                                    // external contracts (renaming the line
+                                    // edits whatever the module exports under
+                                    // the name, which the engine could not pin).
+                                    moduleAttribute: true,
+                                });
+                                continue;
+                            }
+                        }
                         // Unshadowed builtin-global receiver (fix #232):
                         // JSON.parse/console.log resolve on the host object,
                         // never a same-named project method. A lexical binding
@@ -4926,7 +5146,7 @@ function findCallees(index, definition, options = {}) {
         };
 
         let siteOrdinal = -1;
-        for (const call of calls) {
+        for (let call of calls) {
             siteOrdinal++;
             const siteId = siteOrdinal;
             // Filter to calls within this function's scope
@@ -4948,6 +5168,30 @@ function findCallees(index, definition, options = {}) {
                 continue;
             }
 
+            if (language === 'cpp' && call.macroArguments) {
+                const macroDisposition = _cppMacroTargetDisposition(
+                    index, def.file, call, index.symbols.get(call.name) || []);
+                if (macroDisposition?.kind === 'other') {
+                    noteSite(siteId, 'excluded', 'macro-requalified', call);
+                    continue;
+                }
+                if (macroDisposition?.kind === 'uncertain') {
+                    if (collectAccount) {
+                        noteUnverified(siteId, call, 'macro-expansion', {
+                            uncertaintyClass: 'compile-time-dispatch',
+                            dispatchFamily: `${call.name} macro expansion`,
+                        });
+                    }
+                    continue;
+                }
+                if (macroDisposition?.kind === 'qualified') {
+                    call = macroDisposition.qualifier === 'global'
+                        ? { ...call, globalQualified: true }
+                        : { ...call, isMethod: true, isPathCall: true,
+                            receiver: macroDisposition.qualifier };
+                }
+            }
+
             // C# extension methods are statically resolved compiler calls,
             // despite using instance-call syntax. Resolve them before the
             // ordinary receiver-owner path: the receiver type matches the
@@ -5027,6 +5271,18 @@ function findCallees(index, definition, options = {}) {
             const directReceiverFlow = mayNeedDirectReceiverFlow(call)
                 ? _lookupReturnTypeFlow(flowMap(), call)
                 : undefined;
+            // Callee-side twin of the structural caller gate (#222(4)).  A
+            // local receiver whose nearest producer was examined but could
+            // not be typed (`C2 = decorator(Base); value = C2()`) has unknown
+            // runtime identity.  Never let unique project-wide spelling turn
+            // that into an exact callee; keep the site visible and conserved.
+            if (collectAccount && mayNeedDirectReceiverFlow(call) &&
+                !directReceiverFlow && _receiverAssignedUntyped(flowMap(), call)) {
+                noteUnverified(siteId, call, 'possible-dispatch', {
+                    dispatchVia: 'local receiver',
+                });
+                continue;
+            }
 
             // Declared-field receiver hop (fix #231 — callee-side parity
             // with the caller side's #202/#219): `tm.service.Save()` /
@@ -5679,8 +5935,18 @@ function findCallees(index, definition, options = {}) {
             const shadowsBuiltin = !call.receiver && (
                 fileEntry?.importBindings?.some(b => b.name === call.name) ||
                 fileEntry?.bindings?.some(b => b.name === call.name));
-            if (!selfShaped && !call.receiverIsModule && !shadowsBuiltin &&
-                index.isKeyword(call.name, language)) {
+            // A method call on a receiver TYPED to a project class is
+            // evidence for a project method, not the builtin (fix #300,
+            // attrs callee arm: `c2.classmethod()` on constructor-typed
+            // C2Slots was routed external because `classmethod` sits in the
+            // Python builtin set — the #238 self-shaped exemption's typed-
+            // receiver twin). The receiver-type routing below decides.
+            const typedProjectReceiver = call.isMethod && call.receiverType &&
+                typeof call.receiverType === 'string' &&
+                (index.symbols.get(call.receiverType) || [])
+                    .some(d => IDENTITY_TYPE_KINDS.has(d.type));
+            if (!selfShaped && !typedProjectReceiver && !call.receiverIsModule &&
+                !shadowsBuiltin && index.isKeyword(call.name, language)) {
                 noteSite(siteId, 'external', null, call);
                 continue;
             }
@@ -5789,8 +6055,17 @@ function findCallees(index, definition, options = {}) {
             // name through the same #217 export-chain discipline used for
             // module receivers. Only intercept when an explicit binding of
             // this name exists; ordinary locals continue to lexical binding.
-            if (!call.isMethod && !call.receiver &&
-                langTraits(language)?.typeSystem === 'structural') {
+            // fix #300 (itertools-measured): the gate covers every language
+            // where a bare call cannot denote a method (#220(4)) — Rust
+            // `use itertools::free::merge_join_by;` owns the bare name, and
+            // canonical-order def selection was confirming the TRAIT METHOD
+            // (lib.rs Itertools::merge_join_by) instead of the imported free
+            // fn. Go item-level import bindings don't exist (package-
+            // qualified imports only), so the route is a structural+Rust
+            // change in practice; Java (bareCallReachesMethods) keeps its
+            // implicit-this/static-import machinery.
+            if (!call.isMethod && !call.receiver && !call.isConstructor &&
+                !langTraits(language)?.bareCallReachesMethods) {
                 const importRoute = _calleeStructuralImportedNameRoute(index, fileEntry, call, language);
                 if (importRoute) {
                     if (importRoute.matches?.length) {
@@ -5820,6 +6095,12 @@ function findCallees(index, definition, options = {}) {
             let isUncertain = call.uncertain;
             let uncertainReason = null; // account-mode reason for the unverified bucket
             let compilerResolvedBare = false;
+            // A bare call can never bind a METHOD def in languages without
+            // implicit-this (fix #300, #220(4) on the callee side) — drives
+            // the bindings filter below and the finalization kind rule.
+            const bareKindFiltered = !call.isMethod && !call.receiver &&
+                !call.isConstructor &&
+                !langTraits(language)?.bareCallReachesMethods;
             if (!call.bindingId && language === 'cpp' &&
                 !call.isMethod && !call.receiver && !call.isConstructor) {
                 // C++ namespace/free-function lookup is declaration-order
@@ -5892,6 +6173,16 @@ function findCallees(index, definition, options = {}) {
                 if (call.isConstructor) {
                     bindings = bindings.filter(binding => binding.type !== 'field');
                 }
+                // A bare call can never bind a METHOD def (fix #300, the
+                // caller side's #220(4)/#222(3) filter brought to the callee
+                // direction): inside Itertools::merge_join_by, the body's
+                // `merge_join_by(self, other, cmp_fn)` bound the ENCLOSING
+                // trait method through the file bindings table and confirmed
+                // a self-edge — the compiler's target is the free fn. Java
+                // (bareCallReachesMethods: implicit-this) keeps its bindings.
+                if (bareKindFiltered) {
+                    bindings = bindings.filter(binding => binding.type !== 'method');
+                }
                 // Method call with no binding for the method name:
                 // Different strategies by language family:
                 if (bindings.length === 0 && call.isMethod) {
@@ -5903,7 +6194,12 @@ function findCallees(index, definition, options = {}) {
                         // CacheService.set. Builtin-typed receivers are host calls;
                         // a receiver typed to a project class resolves to that class
                         // (or an ancestor defining the method), never by bare name.
-                        const route = _calleeReceiverTypeRoute(index, call, localTypes, language);
+                        const route = _calleeReceiverTypeRoute(index, call, localTypes, language, {
+                            file: def.file,
+                            line: call.line,
+                            scopeStart: def.startLine,
+                            scopeEnd: def.endLine,
+                        });
                         if (route?.external) {
                             noteSite(siteId, 'external', null, call);
                             continue;
@@ -6298,6 +6594,10 @@ function findCallees(index, definition, options = {}) {
                     name: effectiveName,
                     bindingId: bindingResolved,
                     count: 1,
+                    // Name-keyed entries from bare calls carry the #220(4)
+                    // kind rule into finalization (fix #300): the resolver
+                    // there must never select a method-kind def for them.
+                    ...(bareKindFiltered && !bindingResolved && { bareNonMethod: true }),
                     ...(call.isConstructor && { isConstructor: true }),
                     ...(collectAccount && {
                         sites: [call.line],
@@ -6484,14 +6784,24 @@ function findCallees(index, definition, options = {}) {
         const cFamilyVisibleFiles = ['c', 'cpp'].includes(language)
             ? _cppVisibleFiles(index, def.file) : null;
 
-        for (const { name: calleeName, bindingId, count, isConstructor, sites, siteIds, isFunctionReference } of callees.values()) {
+        for (const { name: calleeName, bindingId, count, isConstructor, sites, siteIds, isFunctionReference, bareNonMethod } of callees.values()) {
             const claimSites = (bucket, reason) => {
                 if (!collectAccount || !siteIds) return;
                 for (let i = 0; i < siteIds.length; i++) {
                     noteSite(siteIds[i], bucket, reason, { name: calleeName, line: sites[i] });
                 }
             };
-            const symbols = index.symbols.get(calleeName);
+            let symbols = index.symbols.get(calleeName);
+            if (symbols && symbols.length > 0 && bareNonMethod) {
+                // fix #300 (#220(4), callee finalization): a bare call's
+                // candidate set never includes METHOD defs — without this the
+                // same-file priority selected the enclosing trait method for
+                // `merge_join_by(self, other, cmp_fn)` inside its own trait
+                // wrapper, fabricating a self-edge over the imported free fn.
+                const nonMethod = symbols.filter(s =>
+                    !(s.className || s.receiver) || NON_CALLABLE_TYPES.has(s.type));
+                if (nonMethod.length > 0) symbols = nonMethod;
+            }
             if (!symbols || symbols.length === 0) {
                 // Name not in the symbol table — external library, builtin, or
                 // unindexed code. Visible in the callee account, not an edge.
@@ -6921,6 +7231,22 @@ function _buildReturnTypeFlowMap(index, filePath, calls) {
     };
     for (const call of calls) {
         if (!call.assignedTo) continue;
+        // For-loop iteration provenance (fix #294, flask-measured: `for ep in
+        // importlib.metadata.entry_points(...)` — ep.load() confirmed
+        // JSONProvider.load via single-owner while ep is an external
+        // EntryPoint). The loop variable holds an ELEMENT of the producer's
+        // result — the return annotation types the container, never the
+        // element, so assignedIter records NEVER type positively. External
+        // module-qualified producers stamp external provenance (the
+        // #220(6)/#222(4) demote-only rail: blocks single-owner confirmation,
+        // never excludes). Bare-call and untyped producers add nothing —
+        // sorted()/filter() wrappers routinely yield project values, and
+        // demoting those has no measured evidence.
+        if (call.assignedIter) {
+            const via = _iterExternalProducerVia(index, fileEntry, call);
+            if (via) routeUnknownAssignment(call, via);
+            continue;
+        }
         const delegatedUnwrapAssignment = language === 'rust' &&
             call.receiverCall && calls.some(candidate =>
                 candidate !== call &&
@@ -7017,7 +7343,13 @@ function _buildReturnTypeFlowMap(index, filePath, calls) {
         let returnType, fromFile, selfClass, returnedFunctionResult, returnDefinition;
         const builtinCallReturn = !nominal && language === 'python'
             ? _pythonBuiltinCallReturnType(index, fileEntry, call) : null;
-        if (builtinCallReturn) {
+        if (call.localValueCall && call.returnTypeHint) {
+            // Lexical function values are deliberately absent from the
+            // project symbol table, but their declared result remains exact
+            // local compiler evidence (Go: `f := func() (*A, *B)`).
+            returnType = call.returnTypeHint;
+            fromFile = filePath;
+        } else if (builtinCallReturn) {
             returnType = builtinCallReturn;
         } else if (!nominal && language === 'python' && !call.isMethod &&
             !call.receiver && call.name === 'open' && !call.localShadow &&
@@ -7486,11 +7818,63 @@ function _buildReturnTypeFlowMap(index, filePath, calls) {
             });
             continue;
         }
+        // Go multi-return assignments have one compiler-declared type per
+        // LHS position. Record every named target, including assignments
+        // whose first position is `_`; treating only element zero left later
+        // receivers permanently ambiguous (`route, router := split(...)`).
+        if (language === 'go' && call.assignedTuple &&
+            Array.isArray(call.assignedTupleTargets) &&
+            call.assignedTupleTargets.length > 0) {
+            const scope = call.enclosingFunction
+                ? `${call.enclosingFunction.startLine}` : '';
+            if (!map) map = new Map();
+            for (const target of call.assignedTupleTargets) {
+                const key = `${scope}:${target.name}`;
+                if (!map.has(key)) map.set(key, []);
+                const base = { line: call.line, start: call.callStart };
+                const parsed = _returnTypeNameNominal(returnType, language, {
+                    tuple: true,
+                    tupleIndex: target.index,
+                    selfClass,
+                    index,
+                    originFile: fromFile || filePath,
+                });
+                if (!parsed) {
+                    const uncertainVia = _rejectedNominalFlowVia(
+                        returnType, language, {
+                            tuple: true,
+                            tupleIndex: target.index,
+                        });
+                    map.get(key).push(uncertainVia
+                        ? { ...base, externalVia: uncertainVia }
+                        : { ...base, invalidated: true });
+                    continue;
+                }
+                if (parsed.qualifier) {
+                    const producerEntry =
+                        index.files.get(fromFile || filePath) || fileEntry;
+                    const qualified = _goQualifiedReceiverType(
+                        index, producerEntry, parsed.qualifier, parsed.name);
+                    if (qualified && qualified.kind !== 'project') {
+                        map.get(key).push({ ...base, externalVia: qualified.via });
+                        continue;
+                    }
+                }
+                const origin = _resolveFlowTypeOrigin(
+                    index, fromFile || filePath, parsed.name, parsed.qualifier);
+                map.get(key).push(origin?.fromFile
+                    ? { ...base, type: parsed.name, fromFile: origin.fromFile }
+                    : { ...base, invalidated: true });
+            }
+            continue;
+        }
+
         let typeName, entryFromFile;
         if (nominal) {
             const parsed = _returnTypeNameNominal(returnType, language, {
                 unwrapped: call.assignedUnwrap,
                 tuple: call.assignedTuple,
+                tupleIndex: call.assignedTupleIndex,
                 selfClass,
                 index,
                 originFile: fromFile || filePath,
@@ -7804,8 +8188,11 @@ function _returnTypeNameNominal(text, language, opts = {}) {
             if (!opts.tuple) return undefined;
             const inner = t.slice(1, -1);
             if (inner.includes('func(') || inner.includes('func (')) return undefined;
-            const first = inner.split(',')[0].trim();
-            const parts = first.split(/\s+/);
+            const position = Number.isInteger(opts.tupleIndex)
+                ? opts.tupleIndex : 0;
+            const item = _splitTopLevelGenericArgs(inner)[position]?.trim();
+            if (!item) return undefined;
+            const parts = item.split(/\s+/);
             t = parts[parts.length - 1]; // named return `n int` → int
         } else if (opts.tuple) {
             return undefined; // v, err := f() needs a multi-return producer
@@ -7896,8 +8283,10 @@ function _rejectedNominalFlowVia(text, language, opts = {}) {
     let raw = text.trim();
     if (language === 'go' && raw.startsWith('(')) {
         if (!opts.tuple) return null;
-        const first = raw.slice(1, -1).split(',')[0]?.trim();
-        raw = first ? first.split(/\s+/).pop() : '';
+        const position = Number.isInteger(opts.tupleIndex)
+            ? opts.tupleIndex : 0;
+        const item = _splitTopLevelGenericArgs(raw.slice(1, -1))[position]?.trim();
+        raw = item ? item.split(/\s+/).pop() : '';
     }
     const norm = _normalizeFieldTypeName(raw, language);
     if (!norm) return null;
@@ -7948,6 +8337,51 @@ function _rustBindingResolvedFiles(index, fileEntry, filePath, binding) {
     return resolvedFiles;
 }
 
+/**
+ * Resolve a Rust `use path::Type as LocalType` alias to the indexed type it
+ * names. Import aliases are value/type names, not Rust `type` declarations,
+ * so they do not appear in the symbol table and cannot use `_pureAliasBase`.
+ * Require every same-local-name binding to resolve to one identical type/file;
+ * a resolver gap or scope collision remains unknown rather than guessed.
+ */
+function _rustImportedTypeIdentity(index, filePath, localName) {
+    const fileEntry = index.files.get(filePath);
+    if (fileEntry?.language !== 'rust') return null;
+    const bindings = (fileEntry.importBindings || []).filter(binding =>
+        (binding.name === localName || binding.alias === localName) &&
+        String(binding.module || '').includes('::'));
+    if (bindings.length === 0) return null;
+    const identities = [];
+    for (const binding of bindings) {
+        const parts = String(binding.module).split('::').filter(Boolean);
+        const original = parts[parts.length - 1];
+        if (!original || original === localName) return null;
+        const definitions = (index.symbols.get(original) || []).filter(definition =>
+            IDENTITY_TYPE_KINDS.has(definition.type) && definition.file);
+        if (definitions.length === 0) return null;
+        const starts = _rustBindingResolvedFiles(
+            index, fileEntry, filePath, binding);
+        if (starts.size === 0) return null;
+        let reachable = definitions.filter(definition => [...starts].some(start =>
+            definition.file === start ||
+            _nameBindingReaches(
+                index, start, original, new Set([definition.file])) === 'yes'));
+        if (reachable.length === 0) {
+            reachable = definitions.filter(definition => [...starts].some(start =>
+                definition.file === start ||
+                _importReaches(index, start, new Set([definition.file]))));
+        }
+        const files = new Set(reachable.map(definition => definition.file));
+        if (files.size !== 1) return null;
+        identities.push({ type: original, fromFile: [...files][0] });
+    }
+    if (new Set(identities.map(identity => identity.type)).size !== 1 ||
+        new Set(identities.map(identity => identity.fromFile)).size !== 1) {
+        return null;
+    }
+    return identities[0];
+}
+
 /**
  * Pin a flow type name to its defining file from the PRODUCER's scope
  * (fix #207 — the #206 identity lesson applied to annotations: `Builder` in
@@ -8785,6 +9219,58 @@ function _submoduleReceiverModule(index, fileEntry, receiverName) {
     return null;
 }
 
+/**
+ * Does a module-qualified member reference (`pkg.name`) reach the pinned
+ * definition files? This is the value-position counterpart of structural
+ * module-call routing. It deliberately accepts only parser-proven module
+ * imports (or Python from-imports resolved as actual submodules), so an
+ * imported class/value named `pkg` cannot borrow a module's exports.
+ *
+ * Returns `yes`, `no`, `unknown`, or null when the receiver is not a modeled
+ * module binding.
+ */
+function _moduleAttributeBindingReaches(index, filePath, receiverName, name,
+    targetFiles, maxDepth = 8) {
+    const fileEntry = index.files.get(filePath);
+    if (!fileEntry || !receiverName || !name ||
+        langTraits(fileEntry.language)?.typeSystem !== 'structural') return null;
+
+    const starts = new Set();
+    let matchedBinding = false;
+    let unknown = false;
+    const submoduleRel = _submoduleReceiverModule(index, fileEntry, receiverName);
+    if (submoduleRel) {
+        matchedBinding = true;
+        starts.add(path.isAbsolute(submoduleRel)
+            ? submoduleRel : path.join(index.root, submoduleRel));
+    }
+
+    for (const binding of (fileEntry.importBindings || [])) {
+        if (binding.name !== receiverName && binding.alias !== receiverName) continue;
+        // Python `import pkg [as p]` is a module binding. A `from pkg import
+        // Value` binding is not, unless _submoduleReceiverModule proved that
+        // Value is itself a project submodule above.
+        if (fileEntry.language === 'python' && binding.kind !== 'import') continue;
+        matchedBinding = true;
+        const rel = fileEntry.moduleResolved?.[binding.module];
+        if (!rel) {
+            unknown = true;
+            continue;
+        }
+        starts.add(path.isAbsolute(rel) ? rel : path.join(index.root, rel));
+    }
+
+    if (!matchedBinding) return null;
+    for (const start of starts) {
+        const verdict = _nameBindingReaches(
+            index, start, name, targetFiles, maxDepth);
+        if (verdict === 'yes') return 'yes';
+        if (verdict === 'unknown') unknown = true;
+    }
+    if (unknown || starts.size === 0) return 'unknown';
+    return 'no';
+}
+
 /**
  * Bounded-depth reachability over the import graph: can `fromAbs` reach any
  * target file through re-export/import chains? Barrel hierarchies routinely
@@ -8912,6 +9398,30 @@ function _isEnclosingGenericParam(index, filePath, line, typeName) {
     return false;
 }
 
+/**
+ * Generic receivers normally have runtime-unknown ownership. For a trait
+ * declaration pin, an explicit `F: Float` bound is nevertheless exact
+ * compiler evidence that `f.exponent()` invokes Float's method slot (not any
+ * one concrete implementation). Resolve the bound to the pinned trait file;
+ * a same-named external or sibling trait remains unknown.
+ */
+function _genericParamTraitTarget(index, filePath, line, typeName, targetDefs) {
+    const enclosing = index.findEnclosingFunction(filePath, line, true);
+    const bounds = enclosing?.genericBounds?.[typeName];
+    if (!Array.isArray(bounds) || bounds.length === 0) return null;
+    for (const target of targetDefs) {
+        const owner = target.className ||
+            (target.receiver || '').replace(/^[*&]\s*/, '');
+        if (!owner || !bounds.includes(owner)) continue;
+        const ownsTraitDeclaration = (index.symbols.get(owner) || []).some(definition =>
+            definition.type === 'trait' && definition.file === target.file);
+        if (!ownsTraitDeclaration) continue;
+        const origin = _resolveFlowTypeOrigin(index, filePath, owner);
+        if (origin?.fromFile === target.file) return owner;
+    }
+    return null;
+}
+
 /**
  * Receiver-type identity guard shared by the parser-typed branch and the
  * local-inference fallback: a name is NOT usable as type identity when it is
@@ -9108,7 +9618,29 @@ function _resolveReceiverTypeIdentity(index, filePath, knownType, targetDefs, li
  * CustomCommand extends click.Command), while parallel package versions may
  * reuse every class name (zod v3/v4 ZodArray -> ZodType).
  */
-function _resolveStructuralFlowTypeIdentity(index, originFile, knownType, targetDefs, qualifier) {
+/**
+ * Scope-correct same-file type-def selection (fix #300, attrs-measured):
+ * when a type name has SEVERAL class-kind defs in one file (each test
+ * function defining its own local `class C2Slots(...)`), the def the call
+ * site actually sees is the one declared inside the call's own enclosing
+ * function before the call line — Python/JS lexical scoping. Returns that
+ * def, or null when the shape doesn't apply (single def, no scope info, no
+ * local declaration in range) — null means "keep existing behavior".
+ */
+function _scopedSameFileTypeDef(index, name, file, site) {
+    if (!site || site.line == null ||
+        site.scopeStart == null || site.scopeEnd == null) return null;
+    const defs = (index.symbols.get(name) || []).filter(d =>
+        IDENTITY_TYPE_KINDS.has(d.type) && d.file === file);
+    if (defs.length <= 1) return null;
+    const scoped = defs.filter(d =>
+        d.startLine >= site.scopeStart && d.startLine <= site.scopeEnd &&
+        d.startLine <= site.line);
+    if (scoped.length === 0) return null;
+    return scoped.reduce((a, b) => (b.startLine > a.startLine ? b : a));
+}
+
+function _resolveStructuralFlowTypeIdentity(index, originFile, knownType, targetDefs, qualifier, site) {
     const origin = _resolveFlowTypeOrigin(index, originFile, knownType, qualifier);
     if (!origin?.fromFile) return 'unknown';
     const targetOwners = new Set(targetDefs
@@ -9181,7 +9713,16 @@ function _resolveStructuralFlowTypeIdentity(index, originFile, knownType, target
         return { name: parent, file: parentFile };
     };
 
-    const queue = [{ name: knownType, file: origin.fromFile }];
+    // Scope-correct first hop (fix #300): when the receiver's type name has
+    // several same-file class defs, seed the walk with the def the call site
+    // lexically sees — its per-def extends entry, never a sibling def's.
+    // Guard: the site's line ranges describe the CALL file — they only
+    // select defs when the type actually resolves there (an imported type's
+    // defining file has unrelated line geometry).
+    const scopedFirst = (site && site.file === origin.fromFile)
+        ? _scopedSameFileTypeDef(index, knownType, origin.fromFile, site) : null;
+    const queue = [{ name: knownType, file: origin.fromFile,
+        defStartLine: scopedFirst?.startLine }];
     const visited = new Set();
     let sawUnresolved = direct === 'unknown';
     while (queue.length > 0 && visited.size < 128) {
@@ -9193,7 +9734,9 @@ function _resolveStructuralFlowTypeIdentity(index, originFile, knownType, target
         // ancestor slot. In that case ancestry is evidence for the other
         // definition, not the pinned one.
         if (overridesPinnedSlot(cur.name, cur.file)) continue;
-        const parents = index._getInheritanceParents(cur.name, cur.file) || [];
+        const parents = cur.defStartLine != null
+            ? (index._getInheritanceParentsAt?.(cur.name, cur.file, cur.defStartLine) || [])
+            : (index._getInheritanceParents(cur.name, cur.file) || []);
         for (const parent of parents) {
             const edge = parentOrigin(parent, cur.file);
             const verdict = ownerIdentity(edge.name, edge.file);
@@ -9206,6 +9749,50 @@ function _resolveStructuralFlowTypeIdentity(index, originFile, knownType, target
     return sawUnresolved ? 'unknown' : 'other';
 }
 
+/**
+ * Trait-declaration pin gate (fix #296, serde-as_cast-measured): when the
+ * pinned target is a TRAIT's own method declaration, a path call on a
+ * concrete NON-target receiver (`u64::as_cast`, `Limb::as_cast`,
+ * `Self::Unsigned::as_cast`) is not evidence against the edge — any type
+ * (external primitives, macro-generated impls UCN cannot index, aliases)
+ * can implement a project trait, and the call dispatches through the pinned
+ * slot. Returns the trait's name when the gate applies: the caller routes
+ * possible-dispatch "via <Recv> — trait implementor" instead of excluding
+ * path-type-mismatch. Two refusals keep the exclusion sound elsewhere:
+ * impl-member pins (a foreign-type path call binds a DIFFERENT slot member
+ * — static dispatch, exclusion correct), and receivers resolving to a
+ * project type whose only same-name members provably belong to another
+ * surface (inherent members / other traits — Rust resolves inherent first).
+ */
+function _traitDeclPinImplementorRoute(index, fileEntry, receiverSegment, targetDefs) {
+    if (langTraits(fileEntry.language)?.typeQualifiedCallStyle !== 'path') return null;
+    let traitName = null;
+    for (const td of targetDefs || []) {
+        if (!td.className || td.traitName) continue;
+        const classDefs = index.symbols.get(td.className) || [];
+        if (classDefs.some(d => d.type === 'trait' && d.file === td.file)) {
+            traitName = td.className;
+            break;
+        }
+    }
+    if (!traitName) return null;
+    // Receiver resolving to a project type: its indexed same-name members
+    // decide. An inherent member or a different trait's impl owns the call
+    // (keep the exclusion); a member implementing THIS trait — or no indexed
+    // member at all (macro-generated impls are invisible) — routes visible.
+    const recvTypeDefs = (index.symbols.get(receiverSegment) || [])
+        .filter(d => IDENTITY_TYPE_KINDS.has(d.type));
+    if (recvTypeDefs.length > 0) {
+        const targetName = targetDefs[0] && targetDefs[0].name;
+        const members = (index.symbols.get(targetName) || [])
+            .filter(d => d.className === receiverSegment);
+        if (members.length > 0 && members.every(m => m.traitName !== traitName)) {
+            return null;
+        }
+    }
+    return traitName;
+}
+
 /**
  * Is typeName an ancestor (transitively) of any target definition's class?
  * Used by receiver-class disambiguation: a receiver typed as a SUPERTYPE of
@@ -9437,6 +10024,38 @@ function _closeCallableIdentityGroup(index, targetDefs, definitions) {
             expanded.push(candidate);
         }
     }
+
+    // C++ full specializations (`template <> bool f<bool>(...)`) are the SAME
+    // compiler symbol as their primary template: name lookup finds the
+    // template, and the specialization is selected by substitution, never by
+    // overload resolution (fix #299). Closure requires exactly ONE primary
+    // template with the owner identity — with several primaries the compiler
+    // matches the specialization by signature substitution, which is not
+    // grep-reliability evidence, so the group refuses and sites stay visible.
+    for (const target of targetDefs) {
+        if (cFamilyLanguage(target) !== 'cpp') continue;
+        if (!target.isSpecialization && !target.templateDependent) continue;
+        const related = definitions.filter(d =>
+            !NON_CALLABLE_TYPES.has(d.type) &&
+            cFamilyLanguage(d) === 'cpp' && sameOwner(target, d) &&
+            (d.isSpecialization || (d.templateDependent && !d.isSignature)));
+        const primaries = related.filter(d => !d.isSpecialization);
+        const specializations = related.filter(d => d.isSpecialization);
+        if (primaries.length !== 1 || specializations.length === 0) continue;
+        if (!related.some(d => d === target ||
+            (d.file === target.file && d.startLine === target.startLine))) {
+            continue;
+        }
+        const primary = primaries[0];
+        for (const candidate of related) {
+            if (candidate !== primary &&
+                !includesDeclaration(candidate, primary)) continue;
+            if (targetDefs.includes(candidate) ||
+                (expanded && expanded.includes(candidate))) continue;
+            if (!expanded) expanded = [...targetDefs];
+            expanded.push(candidate);
+        }
+    }
     return expanded || targetDefs;
 }
 
@@ -9578,6 +10197,40 @@ function _goQualifierNamesImport(index, fieldFile, qualifier) {
 // wins so import "k8s.io/client-go/kubernetes/scheme" prefers a def in
 // .../kubernetes/scheme/ over .../kubeadm/scheme/). Extracted for reuse:
 // the parser marks some package calls isMethod:false (fix #268).
+/**
+ * External-producer attribution for a for-loop iterable call (fix #294).
+ * Only module-qualified producers count: the module boundary is the
+ * externality evidence (`importlib.metadata.entry_points(...)`,
+ * `os.walk(...)`). Same externality test as #209/#222 — relative or
+ * project-ish modules are resolver gaps, never externality evidence.
+ * Returns the attribution string or null.
+ */
+function _iterExternalProducerVia(index, fileEntry, call) {
+    if (!fileEntry || langTraits(fileEntry.language)?.typeSystem === 'nominal') return null;
+    const externalModule = (mod) => {
+        if (!mod || mod.startsWith('.')) return false;
+        if (fileEntry.moduleResolved?.[mod]) return false;
+        const firstSeg = mod.split(/[./]/).filter(Boolean)[0];
+        return !(firstSeg && _projectTopLevelNames(index).has(firstSeg));
+    };
+    if (call.isMethod && call.receiverIsModule && call.receiver) {
+        const binding = _structuralModuleBindings(fileEntry, call)[0];
+        if (binding && externalModule(String(binding.module))) {
+            return `${call.receiver}.${call.name}`;
+        }
+        return null;
+    }
+    if (call.receiverRoot && !call.receiverRootType) {
+        const binding = (fileEntry.importBindings || []).find(b =>
+            b && b.name === call.receiverRoot && b.kind === 'import');
+        if (binding && externalModule(String(binding.module))) {
+            const field = call.receiverField ? `.${call.receiverField}` : '';
+            return `${call.receiverRoot}${field}.${call.name}`;
+        }
+    }
+    return null;
+}
+
 function _structuralModuleBindings(fileEntry, call) {
     if (call?.receiverModuleSpecifier) {
         return [{
@@ -9904,7 +10557,8 @@ function _calleeOverloadSelect(index, call, matches, language) {
         applicable = _preferFixedArityOverloads(
             index, call, applicable, language);
         if (applicable.length > 1) {
-            const mostSpecific = _javaMostSpecificOverload(index, applicable, call);
+            const mostSpecific = _javaMostSpecificOverload(
+                index, applicable, call, language);
             if (mostSpecific) return { match: mostSpecific };
         }
     }
@@ -10054,7 +10708,7 @@ function _declaredFieldType(index, rootType, fieldName, language, info, rootName
         d.type === 'property' || d.memberType === 'property';
     const fields = defs.filter(d =>
         ((d.type === 'field' || d.memberType === 'field' || d.memberType === 'private field') && d.fieldType) ||
-        (isAccessor(d) && d.returnType));
+        (isAccessor(d) && (d.returnType || d.fieldType)));
     let onType = fields.filter(d => d.className === rootType &&
         (language !== 'csharp' || !rootNamespace ||
             (d.namespace || null) === rootNamespace));
@@ -10113,7 +10767,7 @@ function _declaredFieldType(index, rootType, fieldName, language, info, rootName
     if (onType.length === 0) return null;
     const normalized = new Set();
     for (const f of onType) {
-        const rawText = isAccessor(f) ? f.returnType : f.fieldType;
+        const rawText = isAccessor(f) ? (f.returnType || f.fieldType) : f.fieldType;
         // Qualified declared types resolve through the FIELD-DECLARING file's
         // imports or not at all (fix #268, chi-measured — the #206 identity
         // discipline): `inner http.Handler` is net/http's Handler, never a
@@ -10145,7 +10799,10 @@ function _declaredFieldType(index, rootType, fieldName, language, info, rootName
                 return null;
             }
         }
-        const t = _normalizeFieldTypeName(rawText, language);
+        const localType = _normalizeFieldTypeName(rawText, language);
+        const importedIdentity = language === 'rust' && f.file && localType
+            ? _rustImportedTypeIdentity(index, f.file, localType) : null;
+        const t = importedIdentity?.type || localType;
         if (t) normalized.add(t);
         else return null; // any un-normalizable declaration → no evidence
     }
@@ -10167,12 +10824,18 @@ function _declaredFieldType(index, rootType, fieldName, language, info, rootName
                 complete = false;
                 break;
             }
-            const rawText = isAccessor(field) ? field.returnType : field.fieldType;
+            const rawText = isAccessor(field)
+                ? (field.returnType || field.fieldType) : field.fieldType;
             const qualifier = language === 'java'
                 ? _javaNestedTypeQualifier(rawText) : undefined;
             if (qualifier) namespaces.add(qualifier);
-            const origin = _resolveFlowTypeOrigin(
-                index, field.file, typeName, qualifier);
+            const localType = _normalizeFieldTypeName(rawText, language);
+            const importedIdentity = language === 'rust' && localType
+                ? _rustImportedTypeIdentity(index, field.file, localType) : null;
+            const origin = importedIdentity?.type === typeName
+                ? importedIdentity
+                : _resolveFlowTypeOrigin(
+                    index, field.file, typeName, qualifier);
             if (!origin?.fromFile) {
                 complete = false;
                 break;
@@ -10321,10 +10984,14 @@ function _nonCallableFieldMember(index, typeName, name, language) {
         (d.receiver && d.receiver.replace(/^\*/, '') === typeName));
     if (onType.length === 0) return false;
     for (const d of onType) {
-        if (d.type !== 'field' && d.memberType !== 'field' && d.memberType !== 'private field') return false;
-        if (!d.fieldType) return false;
+        const valueMember = d.type === 'field' || d.memberType === 'field' ||
+            d.memberType === 'private field' || d.type === 'property' ||
+            d.memberType === 'property';
+        if (!valueMember) return false;
+        const declaredType = d.fieldType || d.returnType;
+        if (!declaredType) return false;
         if (_callableFieldDef(index, d)) return false;
-        const raw = String(d.fieldType).trim();
+        const raw = String(declaredType).trim();
         if (/^func\b/.test(raw)) return false;
         if (/\bfn\s*\(|\b(?:Fn|FnMut|FnOnce)\s*[(<]/.test(raw)) return false;
         if (langTraits(language)?.typeSystem === 'structural') {
@@ -10381,7 +11048,14 @@ function _namespaceContainedDef(index, fileEntry, callFileAbs, receiverName, cal
     if (nsDefs.length === 0) return null;
     const candidates = restrictDefs ||
         (index.symbols.get(calleeName) || []).filter(s => !NON_CALLABLE_TYPES.has(s.type));
+    // Self-containment guard (fix #300, itertools-measured): when receiver
+    // and callee share one name (`powerset::powerset`), the candidate list IS
+    // the nsDefs list — a body-less `mod powerset;` declaration (range 1..1)
+    // "contains" itself and was returned as the "other definition", excluding
+    // the compiler-true module-qualified call. A container is never its own
+    // contained member.
     const contained = candidates.filter(d => nsDefs.some(ns =>
+        ns !== d &&
         ns.file === d.file && ns.startLine <= d.startLine &&
         (ns.endLine ?? Infinity) >= (d.endLine ?? d.startLine)));
     if (contained.length === 0) return null;
@@ -10596,9 +11270,28 @@ function _calleeLanguageCompatible(index, def, callerLanguage) {
  * receiver typed Child legitimately reaches methods defined on Base (the
  * #198 ancestor rule, callee direction). Includes the type itself.
  */
-function _receiverTypeAncestors(index, typeName, maxHops = 6) {
+function _receiverTypeAncestors(index, typeName, maxHops = 6, scopeRef = null) {
     const seen = new Set([typeName]);
     let frontier = [typeName];
+    // Scope-correct FIRST hop (fix #300, attrs callee arm): with several
+    // same-file same-name class defs (function-local test subclasses), the
+    // name-granular parent lookup returns the first def's parents for all of
+    // them — the callee walk then lands on the WRONG base's method. Seed
+    // hop 0 from the def the call site lexically sees.
+    if (scopeRef?.file) {
+        const scoped = _scopedSameFileTypeDef(index, typeName, scopeRef.file, scopeRef);
+        if (scoped) {
+            const parents = index._getInheritanceParentsAt?.(
+                typeName, scopeRef.file, scoped.startLine) || [];
+            const next = [];
+            for (const p of parents) {
+                const pName = typeof p === 'string' ? p : p?.name;
+                if (pName && !seen.has(pName)) { seen.add(pName); next.push(pName); }
+            }
+            frontier = next;
+            maxHops -= 1;
+        }
+    }
     for (let hop = 0; hop < maxHops && frontier.length; hop++) {
         const next = [];
         for (const cls of frontier) {
@@ -10624,7 +11317,7 @@ function _receiverTypeAncestors(index, typeName, maxHops = 6) {
  *                      never confirmed by bare-name resolution
  *   null             — receiver type unknown; existing heuristics decide
  */
-function _calleeReceiverTypeRoute(index, call, localTypes, language) {
+function _calleeReceiverTypeRoute(index, call, localTypes, language, scopeRef = null) {
     const raw = call.receiverType || localTypes?.get(call.receiver);
     if (!raw || typeof raw !== 'string') return null;
     const head = _structuralTypeHead(raw, { index, language }) || raw;
@@ -10634,7 +11327,7 @@ function _calleeReceiverTypeRoute(index, call, localTypes, language) {
         _calleeLanguageCompatible(index, d, language));
     let matches = defs.filter(d => d.className === head || d.className === norm);
     if (matches.length === 0 && defs.length > 0) {
-        const ancestors = _receiverTypeAncestors(index, head);
+        const ancestors = _receiverTypeAncestors(index, head, 6, scopeRef);
         matches = defs.filter(d => ancestors.has(d.className));
     }
     if (matches.length === 1) return { resolve: matches[0] };
@@ -10710,7 +11403,12 @@ function _calleeSingleOwnerMatch(index, def, fileEntry, call, name, language, fl
         const head = _structuralTypeHead(call.receiverType, { index, language }) || call.receiverType;
         const norm = head;
         if (head !== owner && norm !== owner &&
-            !_receiverTypeAncestors(index, head).has(owner)) return null;
+            !_receiverTypeAncestors(index, head, 6, {
+                file: def.file,
+                line: call.line,
+                scopeStart: def.startLine,
+                scopeEnd: def.endLine,
+            }).has(owner)) return null;
     }
     if (traits?.typeSystem === 'nominal' && call.argCount != null &&
         !_callArityCompatible(call, ownerDefs, language)) return null;
@@ -10925,6 +11623,28 @@ const JAVA_FINAL_REFERENCE_TYPES = new Set([
     'Integer', 'Long', 'Float', 'Double', 'Void',
 ]);
 
+// Complete reference-supertype sets for JDK value types (fix #299D): these
+// types are final (or effectively closed) with a fixed, fully-known
+// ancestry, so an argument statically typed as one of them can bind ONLY a
+// parameter type in this list (plus Object/generics, handled earlier). A
+// project class shadowing one of these simple names disables the denial —
+// the guard is tDefs.length === 0 at the use site. Modern-JDK marker
+// interfaces (Constable, ConstantDesc) are included so their params never
+// get falsely denied.
+const JAVA_PLATFORM_VALUE_ANCESTRY = new Map([
+    ['Integer', ['Number', 'Comparable', 'Serializable', 'Constable', 'ConstantDesc']],
+    ['Long', ['Number', 'Comparable', 'Serializable', 'Constable', 'ConstantDesc']],
+    ['Short', ['Number', 'Comparable', 'Serializable', 'Constable', 'ConstantDesc']],
+    ['Byte', ['Number', 'Comparable', 'Serializable', 'Constable', 'ConstantDesc']],
+    ['Float', ['Number', 'Comparable', 'Serializable', 'Constable', 'ConstantDesc']],
+    ['Double', ['Number', 'Comparable', 'Serializable', 'Constable', 'ConstantDesc']],
+    ['Character', ['Comparable', 'Serializable', 'Constable']],
+    ['Boolean', ['Comparable', 'Serializable', 'Constable']],
+    ['String', ['CharSequence', 'Comparable', 'Serializable', 'Constable', 'ConstantDesc']],
+    ['BigInteger', ['Number', 'Comparable', 'Serializable']],
+    ['BigDecimal', ['Number', 'Comparable', 'Serializable']],
+]);
+
 // Which parameter types a call-site literal kind can bind (Java overload
 // resolution: identity, widening, boxing — plus the boxed types' interfaces).
 // Anything not provably incompatible MATCHES: only certainty excludes.
@@ -10936,8 +11656,37 @@ const JAVA_KIND_TYPES = {
     float: ['float', 'double', 'Float', 'Number', 'Comparable', 'Serializable'],
     double: ['double', 'Double', 'Number', 'Comparable', 'Serializable'],
     boolean: ['boolean', 'Boolean', 'Comparable', 'Serializable'],
+    // Not literal kinds (no short/byte literals in Java) — these entries
+    // serve the value-typed conversion checks (fix #299D).
+    short: ['short', 'int', 'long', 'float', 'double', 'Short', 'Number', 'Comparable', 'Serializable'],
+    byte: ['byte', 'short', 'int', 'long', 'float', 'double', 'Byte', 'Number', 'Comparable', 'Serializable'],
 };
 
+// Unboxing is defined for exactly these wrapper types (JLS 5.1.8).
+const JAVA_WRAPPER_PRIMITIVES = new Map([
+    ['Integer', 'int'], ['Long', 'long'], ['Short', 'short'], ['Byte', 'byte'],
+    ['Character', 'char'], ['Boolean', 'boolean'],
+    ['Float', 'float'], ['Double', 'double'],
+]);
+
+// Declared types of the JDK numeric-constant fields (fix #299D): exact
+// compiler contracts, consulted only when no project field shadows the
+// owner/field pair.
+const JAVA_PLATFORM_FIELD_TYPES = new Map([
+    ['Float.NaN', 'float'], ['Float.POSITIVE_INFINITY', 'float'],
+    ['Float.NEGATIVE_INFINITY', 'float'], ['Float.MIN_VALUE', 'float'],
+    ['Float.MAX_VALUE', 'float'], ['Float.MIN_NORMAL', 'float'],
+    ['Double.NaN', 'double'], ['Double.POSITIVE_INFINITY', 'double'],
+    ['Double.NEGATIVE_INFINITY', 'double'], ['Double.MIN_VALUE', 'double'],
+    ['Double.MAX_VALUE', 'double'], ['Double.MIN_NORMAL', 'double'],
+    ['Integer.MAX_VALUE', 'int'], ['Integer.MIN_VALUE', 'int'],
+    ['Long.MAX_VALUE', 'long'], ['Long.MIN_VALUE', 'long'],
+    ['Short.MAX_VALUE', 'short'], ['Short.MIN_VALUE', 'short'],
+    ['Byte.MAX_VALUE', 'byte'], ['Byte.MIN_VALUE', 'byte'],
+    ['Character.MAX_VALUE', 'char'], ['Character.MIN_VALUE', 'char'],
+    ['Boolean.TRUE', 'Boolean'], ['Boolean.FALSE', 'Boolean'],
+]);
+
 // Exact subset of C# implicit conversions for compiler-owned closed types.
 // Returns null when user-defined conversions or external ancestry could
 // matter. A false verdict is therefore exclusion-grade evidence.
@@ -10995,6 +11744,19 @@ function _csharpKnownTypeAssignable(actualRaw, expectedRaw) {
 // name-based guesses. They close the common portable-AST gap where overload
 // resolution depends on the return type of a library call.
 const JAVA_PLATFORM_METHOD_RETURNS = new Map([
+    // Exact JDK factory contracts (fix #299D): valueOf on the boxed and
+    // arbitrary-precision types returns the owner type itself.
+    ['java.math.BigInteger#valueOf', 'java.math.BigInteger'],
+    ['java.math.BigDecimal#valueOf', 'java.math.BigDecimal'],
+    ['java.lang.Integer#valueOf', 'java.lang.Integer'],
+    ['java.lang.Long#valueOf', 'java.lang.Long'],
+    ['java.lang.Short#valueOf', 'java.lang.Short'],
+    ['java.lang.Byte#valueOf', 'java.lang.Byte'],
+    ['java.lang.Float#valueOf', 'java.lang.Float'],
+    ['java.lang.Double#valueOf', 'java.lang.Double'],
+    ['java.lang.Boolean#valueOf', 'java.lang.Boolean'],
+    ['java.lang.Character#valueOf', 'java.lang.Character'],
+    ['java.lang.String#valueOf', 'java.lang.String'],
     ['java.lang.Object#getClass', 'java.lang.Class'],
     ['java.lang.Class#getEnclosingClass', 'java.lang.Class'],
     ['java.lang.Class#getDeclaringClass', 'java.lang.Class'],
@@ -11244,7 +12006,13 @@ function _javaOwnerFieldType(index, owner, fieldName) {
         definition.className === ownerSimple &&
         (definition.type === 'field' || definition.memberType === 'field') &&
         definition.fieldType);
-    if (fields.length === 0) return null;
+    if (fields.length === 0) {
+        // JDK constant-field contracts (fix #299D): Float.NaN is a float,
+        // Boolean.TRUE a Boolean. Project fields, checked above, always
+        // outrank the platform table.
+        return JAVA_PLATFORM_FIELD_TYPES.get(`${ownerSimple}.${fieldName}`) ||
+            null;
+    }
 
     const types = new Set();
     for (const field of fields) {
@@ -11359,6 +12127,27 @@ function _javaArgKindMatches(index, kind, paramType, language) {
         if (tSimple === bare) return true;
         const platformAssignable = _javaPlatformAssignable(t, bare);
         if (platformAssignable !== null) return platformAssignable;
+        // A primitive argument type has closed conversion targets (fix
+        // #299D): identity, widening, its own box, and the box's interfaces
+        // — exactly the literal-kind table. This must precede the
+        // final-reference denial below, which is boxing-blind (char DOES
+        // bind a Character parameter). No project class can shadow a
+        // primitive name, so no tDefs guard is needed.
+        if (language === 'java' && JAVA_PRIMITIVES.has(tSimple) &&
+            JAVA_KIND_TYPES[tSimple]) {
+            return JAVA_KIND_TYPES[tSimple].includes(bare);
+        }
+        // A reference-typed argument reaches a primitive parameter only
+        // through unboxing, defined for exactly the eight wrapper types
+        // (then widening). Any other reference type — project, JDK, or
+        // unknown — provably cannot bind a primitive parameter (fix #299D).
+        if (language === 'java' && JAVA_PRIMITIVES.has(bare) &&
+            !JAVA_PRIMITIVES.has(tSimple) && !/^[A-Z][0-9]?$/.test(tSimple)) {
+            const unboxed = JAVA_WRAPPER_PRIMITIVES.get(tSimple);
+            return unboxed != null &&
+                (unboxed === bare ||
+                 JAVA_KIND_TYPES[unboxed]?.includes(bare) === true);
+        }
         // These java.lang types are final. A statically known different type
         // can never bind their overload, even when the argument type's own
         // ancestry ends in external Object and is therefore incomplete.
@@ -11381,6 +12170,14 @@ function _javaArgKindMatches(index, kind, paramType, language) {
             d.modifiers?.includes('sealed'))) {
             return false;
         }
+        if (language === 'java' && tDefs.length === 0) {
+            // JDK value types have a complete, closed ancestry (fix #299D):
+            // an Integer-typed argument can never bind add(JsonElement).
+            // The no-project-def guard keeps a project class shadowing the
+            // simple name in normal resolution.
+            const valueAncestry = JAVA_PLATFORM_VALUE_ANCESTRY.get(tSimple);
+            if (valueAncestry) return valueAncestry.includes(bare);
+        }
         if (tDefs.length === 0) return true; // external arg type — unknowable
         const asTarget = [{ className: tSimple, file: tDefs[0].file }];
         if (_isDispatchAncestor(index, bare, asTarget)) return true;
@@ -11400,6 +12197,7 @@ function _cppTypeCategory(type) {
     const unqualified = original
         .replace(/\b(const|volatile|constexpr|typename|struct|class)\b/g, ' ')
         .replace(/&&|\.\.\.|[&*]/g, ' ')
+        .replace(/\[[^\]]*\]/g, ' ')
         .replace(/\s+/g, ' ')
         .trim();
     const headText = unqualified.split('<')[0].trim();
@@ -11519,7 +12317,8 @@ function _cppArgKindMatches(kind, paramType) {
     if (kind === 'null') {
         return !['number', 'bool', 'character'].includes(expected.kind);
     }
-    if (kind.startsWith('type:') || kind.startsWith('call:')) {
+    if (kind.startsWith('type:') || kind.startsWith('call:') ||
+        kind.startsWith('bcall:')) {
         const actualType = kind.slice(kind.indexOf(':') + 1);
         const actual = _cppTypeCategory(actualType);
         if (actual.head && expected.head && actual.head === expected.head) return true;
@@ -11634,7 +12433,7 @@ function _javaTypeAtLeastAsSpecific(index, subType, superType, subDef) {
 // when every argument position is at least as specific as every competing
 // candidate and at least one position is strictly more specific. Unknown
 // relationships stay ambiguous.
-function _javaMostSpecificOverload(index, applicable, call) {
+function _javaMostSpecificOverload(index, applicable, call, language) {
     const argCount = call.argCount;
     if (!Number.isInteger(argCount) || applicable.length < 2) return null;
     // Compiler-visible exact static types outrank candidates whose external
@@ -11670,6 +12469,64 @@ function _javaMostSpecificOverload(index, applicable, call) {
             if (winners.length === 1) return winners[0].definition;
         }
     }
+    // JLS 15.12.2 phase discipline (fix #299D): when EVERY argument's static
+    // type is a known primitive, strict-invocation candidates (identity or
+    // primitive widening, fixed arity — phase 1) exclude boxing candidates
+    // (phase 2) from the race entirely; among widening targets the narrowest
+    // is most specific (an int literal binds value(long), not value(float)/
+    // value(double)/value(Number)). Varargs params are phase 3 and never
+    // count as strict. Any non-primitive or unknown position refuses — phase
+    // membership must be provable for every argument.
+    if (language === 'java' && Array.isArray(call.argKinds) &&
+        call.argKinds.length >= argCount && argCount > 0) {
+        const primOf = (kind) => {
+            if (!kind || typeof kind !== 'string') return null;
+            if (JAVA_PRIMITIVES.has(kind)) return kind; // literal kinds
+            const staticType = _javaStaticTypeForKind(index, kind);
+            const simple = staticType ? staticType.split('.').pop() : null;
+            return simple && JAVA_PRIMITIVES.has(simple) ? simple : null;
+        };
+        const prims = [];
+        for (let i = 0; i < argCount; i++) prims.push(primOf(call.argKinds[i]));
+        if (prims.every(Boolean)) {
+            const strictAt = (prim, definition, i) => {
+                const param = _javaParamAt(definition, i, call);
+                if (!param || param.rest) return false;
+                const bare = _javaBareParamType(param);
+                return bare !== null && JAVA_PRIMITIVES.has(bare) &&
+                    (prim === bare ||
+                     JAVA_KIND_TYPES[prim]?.includes(bare) === true);
+            };
+            const strict = applicable.filter(definition => {
+                for (let i = 0; i < argCount; i++) {
+                    if (!strictAt(prims[i], definition, i)) return false;
+                }
+                return true;
+            });
+            if (strict.length === 1) return strict[0];
+            if (strict.length > 1) {
+                const dominatesPrim = (a, b) => {
+                    let strictly = false;
+                    for (let i = 0; i < argCount; i++) {
+                        const at = _javaBareParamType(_javaParamAt(a, i, call));
+                        const bt = _javaBareParamType(_javaParamAt(b, i, call));
+                        if (at === bt) continue;
+                        if (!JAVA_PRIMITIVES.has(bt) ||
+                            JAVA_KIND_TYPES[at]?.includes(bt) !== true) {
+                            return false;
+                        }
+                        strictly = true;
+                    }
+                    return strictly;
+                };
+                const winners = strict.filter(a =>
+                    strict.every(b => a === b || dominatesPrim(a, b)));
+                if (winners.length === 1) return winners[0];
+                return null; // strict phase engaged but unranked — visible
+            }
+            // no strict candidate: boxing phase — general ranking decides
+        }
+    }
     const dominates = (a, b) => {
         let strict = false;
         for (let i = 0; i < argCount; i++) {
@@ -11831,16 +12688,142 @@ function _cppQualifiedPathOwnsTarget(index, callerFile, call, targetDefs) {
     return targetDefs.some(definition => {
         if (!definition.file) return false;
         const namespace = String(definition.namespace || '');
-        if (namespace === call.receiver ||
-            namespace.startsWith(`${call.receiver}::`) ||
-            namespace.endsWith(`::${call.receiver}`)) {
-            return true;
+        if (namespace) {
+            // An AST-recorded namespace is stronger than the portable-header
+            // path heuristic. `fmt::vformat_to` cannot name
+            // `detail::vformat_to`; only the exact namespace (or the same
+            // namespace expressed relative to an enclosing scope) owns it.
+            return namespace === call.receiver ||
+                String(call.receiver).endsWith(`::${namespace}`) ||
+                namespace.endsWith(`::${call.receiver}`);
         }
         const relative = path.relative(index.root, definition.file);
         return relative.split(path.sep).includes(namespaceRoot);
     });
 }
 
+function _cppMacroParamOutcomes(index, callerFile, macroName, argIndex,
+    depth = 0, seen = new Set()) {
+    if (!macroName || depth > 8) return new Set(['unknown']);
+    let cache;
+    let cacheKey;
+    if (depth === 0) {
+        if (!index._cppMacroParamOutcomesCache) {
+            Object.defineProperty(index, '_cppMacroParamOutcomesCache', {
+                value: new Map(),
+                configurable: true,
+            });
+        }
+        cache = index._cppMacroParamOutcomesCache;
+        cacheKey = `${callerFile}\0${macroName}\0${argIndex}`;
+        if (cache.has(cacheKey)) return cache.get(cacheKey);
+    }
+    const key = `${macroName}:${argIndex}`;
+    if (seen.has(key)) return new Set(['unknown']);
+    const nextSeen = new Set(seen);
+    nextSeen.add(key);
+    const visible = _cppVisibleFiles(index, callerFile);
+    const definitions = (index.symbols.get(macroName) || []).filter(definition =>
+        definition.type === 'macro' && definition.functionLike !== false &&
+        definition.file && visible.has(definition.file));
+    if (definitions.length === 0) {
+        const result = new Set(['unknown']);
+        if (cache) cache.set(cacheKey, result);
+        return result;
+    }
+    const outcomes = new Set();
+    for (const definition of definitions) {
+        const effects = (definition.macroParamEffects || [])
+            .filter(effect => effect.paramIndex === argIndex);
+        if (effects.length === 0) {
+            outcomes.add('preserve');
+            continue;
+        }
+        for (const effect of effects) {
+            if (effect.kind === 'qualified' && effect.qualifier) {
+                outcomes.add(`qualified:${effect.qualifier}`);
+            } else if (effect.kind === 'forwarded' && effect.macro &&
+                Number.isInteger(effect.argIndex)) {
+                for (const outcome of _cppMacroParamOutcomes(
+                    index, callerFile, effect.macro, effect.argIndex,
+                    depth + 1, nextSeen)) {
+                    outcomes.add(outcome);
+                }
+            } else {
+                outcomes.add('unknown');
+            }
+        }
+    }
+    const result = outcomes.size > 0 ? outcomes : new Set(['unknown']);
+    if (cache) cache.set(cacheKey, result);
+    return result;
+}
+
+function _cppMacroQualifierCanNameTarget(qualifier, targetDefs) {
+    if (!qualifier || !Array.isArray(targetDefs) || targetDefs.length === 0) {
+        return false;
+    }
+    if (qualifier === 'global') {
+        return targetDefs.some(definition =>
+            !definition.className && !definition.receiver && !definition.namespace);
+    }
+    return targetDefs.some(definition => {
+        const owner = definition.className || definition.receiver;
+        const namespace = definition.namespace;
+        return owner === qualifier || namespace === qualifier ||
+            String(owner || '').endsWith(`::${qualifier}`) ||
+            String(namespace || '').endsWith(`::${qualifier}`);
+    });
+}
+
+/**
+ * Whether a macro transforms this source call's argument into a qualified
+ * callable. Replacement-list effects are parser-derived and followed through
+ * forwarding macros; conditional definitions are unioned, so disagreement
+ * routes visible rather than becoming false exclusion evidence.
+ */
+function _cppMacroTargetDisposition(index, callerFile, call, targetDefs) {
+    if (!Array.isArray(call?.macroArguments) ||
+        call.macroArguments.length === 0) return null;
+    let uncertain = false;
+    let qualified = null;
+    let qualifiedAway = false;
+    for (const wrapper of call.macroArguments) {
+        const outcomes = _cppMacroParamOutcomes(
+            index, callerFile, wrapper.name, wrapper.argIndex);
+        const qualifiers = [...outcomes]
+            .filter(outcome => outcome.startsWith('qualified:'))
+            .map(outcome => outcome.slice('qualified:'.length));
+        if (qualifiers.length === 0) continue;
+        const targetMatches = qualifiers.map(qualifier =>
+            _cppMacroQualifierCanNameTarget(qualifier, targetDefs));
+        const canNameTarget = targetMatches.some(Boolean);
+        const allNameTarget = targetMatches.every(Boolean);
+        const hasUnknown = outcomes.has('unknown') || outcomes.has('preserve');
+        if (canNameTarget) {
+            const unique = new Set(qualifiers);
+            if (!hasUnknown && allNameTarget && unique.size === 1) {
+                const qualifier = [...unique][0];
+                if (qualified && qualified !== qualifier) uncertain = true;
+                else qualified = qualifier;
+            } else {
+                // Multiple conditional definitions, a preserve path, or a
+                // mixture of target and non-target qualifiers means the
+                // preprocessor can change identity by build configuration.
+                uncertain = true;
+            }
+            continue;
+        }
+        if (!hasUnknown) qualifiedAway = true;
+        else uncertain = true;
+    }
+    if (uncertain || (qualified && qualifiedAway)) {
+        return { kind: 'uncertain' };
+    }
+    if (qualifiedAway) return { kind: 'other' };
+    return qualified ? { kind: 'qualified', qualifier: qualified } : null;
+}
+
 function _overloadDiscipline(index, call, targetDefs, definitions, callerFile) {
     const targetOwners = new Set(targetDefs.map(d => d.className).filter(Boolean));
     const targetLanguage = targetDefs[0]?.file && index.files.get(targetDefs[0].file)?.language;
@@ -11867,12 +12850,22 @@ function _overloadDiscipline(index, call, targetDefs, definitions, callerFile) {
         targetDefs.every(d => !d.className && !d.receiver) &&
         _cppTargetVisibleFrom(index, callerFile, targetDefs)) {
         const visible = _cppVisibleFiles(index, callerFile);
-        const callerHostsPin = targetDefs.some(d => d.file === callerFile);
+        const pathCanName = definition => {
+            if (!call.isPathCall || !call.receiver) return true;
+            const namespace = String(definition.namespace || '');
+            // Missing namespace metadata is not negative evidence: namespace
+            // macros (FMT_BEGIN_NAMESPACE and peers) are intentionally opaque
+            // to the portable tree. A recorded namespace, however, must match
+            // the qualifier's exact/relative namespace identity.
+            if (!namespace) return true;
+            return namespace === call.receiver ||
+                String(call.receiver).endsWith(`::${namespace}`) ||
+                namespace.endsWith(`::${call.receiver}`);
+        };
         family = definitions.filter(d =>
             !NON_CALLABLE_TYPES.has(d.type) &&
             !d.className && !d.receiver &&
-            (!call.isPathCall || d.file !== callerFile || callerHostsPin ||
-             pinnedKeys.has(`${d.file}:${d.startLine}`)) &&
+            pathCanName(d) &&
             (visible.has(d.file) ||
              pinnedKeys.has(`${d.file}:${d.startLine}`)));
     } else {
@@ -11908,6 +12901,17 @@ function _overloadDiscipline(index, call, targetDefs, definitions, callerFile) {
     // constrained templates can share an identical function signature while
     // remaining distinct compiler overloads.
     const pinSigs = new Set(targetDefs.map(typeSig).filter(s => s !== null));
+    // Occupied dispatch slots (fix #299D): an ancestor def whose signature
+    // matches ANY family member of the descendant class is that member's
+    // override/hiding slot — the same bindable method, never an extra
+    // sibling. Without this, JsonTreeWriter's fully-overridden value(...)
+    // family double-counted every JsonWriter overload and the exact-type
+    // winner was never unique (two value(String) "candidates").
+    const familySigs = new Set(pinSigs);
+    for (const d of family) {
+        const sig = typeSig(d);
+        if (sig !== null) familySigs.add(sig);
+    }
     const pinFile = targetDefs.find(d => d.file)?.file;
     const seenCls = new Set(targetOwners);
     const queue = [...targetOwners];
@@ -11924,13 +12928,42 @@ function _overloadDiscipline(index, call, targetDefs, definitions, callerFile) {
             for (const d of definitions) {
                 if (NON_CALLABLE_TYPES.has(d.type) || d.className !== pName) continue;
                 const sig = typeSig(d);
-                if (sig !== null && pinSigs.has(sig)) continue; // override slot
+                if (sig !== null && familySigs.has(sig)) continue; // occupied slot
+                if (sig !== null) familySigs.add(sig);
                 family.push(d);
             }
         }
     }
+    if (targetLanguage === 'cpp' && call.isPathCall && family.length > 0 &&
+        !family.some(definition =>
+            pinnedKeys.has(`${definition.file}:${definition.startLine}`))) {
+        // The qualifier selects a modeled namespace family that does not
+        // contain the pin (`fmt::vformat_to` versus
+        // `detail::vformat_to`). This is exact negative identity evidence
+        // even when that family has only one overload.
+        return 'other-overload';
+    }
     if (family.length <= 1) return null;
     if (family.every(d => pinnedKeys.has(`${d.file}:${d.startLine}`))) return null;
+    // Producer-return argument typing (fix #299B): a bare-identifier
+    // producer (`paint(tint(3))`) types its argument position from the
+    // project's declared return type — the #199/#207 return-type-flow rail
+    // at the argument site. Resolution demands a unique project identity
+    // with full return-text agreement; anything less keeps the opaque
+    // `bcall:` kind (matches everything, no decision either way).
+    if (targetLanguage === 'cpp' && Array.isArray(call.argKinds) &&
+        call.argKinds.some(kind => typeof kind === 'string' &&
+            kind.startsWith('bcall:'))) {
+        const resolvedKinds = call.argKinds.map(kind => {
+            if (typeof kind !== 'string' || !kind.startsWith('bcall:')) return kind;
+            const producerReturn = _cppBareProducerReturnType(
+                index, kind.slice('bcall:'.length));
+            return producerReturn ? `type:${producerReturn}` : kind;
+        });
+        if (resolvedKinds.some((kind, i) => kind !== call.argKinds[i])) {
+            call = { ...call, argKinds: resolvedKinds };
+        }
+    }
     let applicable = family.filter(d => _overloadApplicable(index, call, d));
     if (applicable.length === 0) return null; // shape fits nothing we model — no claim
     if (targetLanguage === 'java' || targetLanguage === 'csharp') {
@@ -11939,7 +12972,8 @@ function _overloadDiscipline(index, call, targetDefs, definitions, callerFile) {
     }
     const mostSpecific = (targetLanguage === 'java' ||
         targetLanguage === 'csharp')
-        ? _javaMostSpecificOverload(index, applicable, call) : null;
+        ? _javaMostSpecificOverload(index, applicable, call, targetLanguage)
+        : null;
     if (mostSpecific) {
         return pinnedKeys.has(`${mostSpecific.file}:${mostSpecific.startLine}`)
             ? null : 'other-overload';
@@ -11951,6 +12985,13 @@ function _overloadDiscipline(index, call, targetDefs, definitions, callerFile) {
         return null;
     }
     if (applicable.length === 1) return null; // uniquely the pinned overload
+    if (targetLanguage === 'cpp') {
+        const winner = _cppExactOverloadWinner(call, applicable);
+        if (winner) {
+            return pinnedKeys.has(`${winner.file}:${winner.startLine}`)
+                ? null : 'other-overload';
+        }
+    }
     const compileTimeDispatch = targetLanguage === 'cpp';
     const templateOnly = compileTimeDispatch &&
         applicable.every(definition => definition.templateDependent);
@@ -11966,6 +13007,121 @@ function _overloadDiscipline(index, call, targetDefs, definitions, callerFile) {
     };
 }
 
+// C++ exact-static-type overload selection (fix #299C): when every argument
+// position carries a concrete static type (`type:X` from declared locals or
+// casts) and exactly one NON-template candidate matches every position at
+// Exact Match rank, the compiler selects it — identity conversion outranks
+// every other conversion sequence, and non-template beats template on the
+// tie-break. Template winners are refused (their param text can name their
+// own template parameters, and SFINAE can disable them invisibly); literal
+// and `expr` kinds refuse the whole selection (integer literals rank equally
+// against sibling integer widths). Exactness is deliberately narrower than
+// the compiler's Exact Match class: by-value top-level const is ignored and
+// `const X&` binding accepted, but non-const refs (cast rvalues can't bind),
+// rvalue refs, and pointer-pointee qualification changes all refuse — a
+// missed exact match keeps the site visible, a wrong one would exclude a
+// true caller.
+function _cppNormalizeTypeText(text) {
+    if (!text) return null;
+    return String(text).replace(/\s+/g, ' ')
+        .replace(/\s*([*&])\s*/g, ' $1').trim() || null;
+}
+
+function _cppStripTopLevelConst(text) {
+    if (!text || /[*&]$/.test(text)) return text;
+    return text.replace(/^const /, '').replace(/^volatile /, '');
+}
+
+function _cppExactParamMatch(paramType, argType) {
+    const param = _cppNormalizeTypeText(paramType);
+    const arg = _cppStripTopLevelConst(_cppNormalizeTypeText(argType));
+    if (!param || !arg) return false;
+    return param === arg ||
+        _cppStripTopLevelConst(param) === arg ||
+        param === `const ${arg} &`;
+}
+
+// Resolve a bare-identifier producer name to its declared return type
+// (fix #299B). Discipline mirrors the #199/#207 return-type-flow rails:
+// every callable def of the name project-wide must live in a C-family file
+// and agree on ONE full normalized return text. Type defs sharing the name
+// refuse (the bare call may be a constructor), template producers refuse
+// (their substituted return is instantiation-dependent), `auto` without a
+// recorded trailing type refuses, and return-less defs are ignored only
+// when they are declarations whose parameter shape matches a return-bearing
+// def — a C++ declaration's return type must match its definition, so a
+// ret-less signature there is a parse gap on the SAME entity, never a
+// hidden disagreeing overload.
+function _cppBareProducerReturnType(index, producerName) {
+    if (!producerName) return null;
+    const defs = (index.symbols.get(producerName) || []);
+    if (defs.length === 0) return null;
+    const paramKey = (def) => Array.isArray(def.paramsStructured)
+        ? def.paramsStructured.map(param =>
+            _cppNormalizeTypeText(param?.type) || '?').join('\0')
+        : null;
+    const returnBearing = [];
+    const returnLess = [];
+    for (const def of defs) {
+        const language = index.files.get(def.file)?.language;
+        if (language !== 'c' && language !== 'cpp') return null;
+        if (NON_CALLABLE_TYPES.has(def.type)) return null; // constructor risk
+        if (def.isSpecialization) continue; // same entity as its primary
+        if (def.returnType) returnBearing.push(def);
+        else returnLess.push(def);
+    }
+    if (returnBearing.length === 0) return null;
+    for (const def of returnLess) {
+        if (!def.isSignature) return null;
+        const key = paramKey(def);
+        if (key === null ||
+            !returnBearing.some(other => paramKey(other) === key)) {
+            return null;
+        }
+    }
+    let agreed = null;
+    for (const def of returnBearing) {
+        if (def.templateDependent) return null;
+        const returnText = _cppNormalizeTypeText(def.returnType);
+        if (!returnText || /^auto\b/.test(returnText)) return null;
+        if (agreed === null) agreed = returnText;
+        else if (agreed !== returnText) return null;
+    }
+    return agreed;
+}
+
+function _cppExactOverloadWinner(call, applicable) {
+    const kinds = call.argKinds;
+    if (!Array.isArray(kinds) || !Number.isInteger(call.argCount) ||
+        call.argCount === 0 || kinds.length < call.argCount) return null;
+    const argTypes = [];
+    for (let i = 0; i < call.argCount; i++) {
+        const kind = kinds[i];
+        if (typeof kind !== 'string' || !kind.startsWith('type:')) return null;
+        const argType = kind.slice('type:'.length);
+        if (!argType) return null;
+        argTypes.push(argType);
+    }
+    let winner = null;
+    for (const def of applicable) {
+        if (def.templateDependent || def.isSpecialization) continue;
+        const ps = def.paramsStructured;
+        if (!Array.isArray(ps) || ps.length < call.argCount) continue;
+        if (ps.some(param => param && (param.rest || param.variadic))) continue;
+        let exact = true;
+        for (let i = 0; i < call.argCount; i++) {
+            if (!_cppExactParamMatch(ps[i]?.type, argTypes[i])) {
+                exact = false;
+                break;
+            }
+        }
+        if (!exact) continue;
+        if (winner) return null; // two exact candidates — refuse
+        winner = def;
+    }
+    return winner;
+}
+
 /**
  * Build the target type set for receiver-class disambiguation: target
  * classes/receivers + their non-overriding subtypes (transitively). A Child
@@ -12304,7 +13460,8 @@ function _declaredFieldInterfaceType(index, rootType, fieldName, language, rootN
     const defs = index.symbols.get(fieldName);
     if (!defs) return null;
     const fields = defs.filter(d =>
-        (d.type === 'field' || d.memberType === 'field') &&
+        (d.type === 'field' || d.memberType === 'field' ||
+         d.type === 'property' || d.memberType === 'property') &&
         d.className === rootType && d.fieldType &&
         (language !== 'csharp' || !rootNamespace ||
             (d.namespace || null) === rootNamespace));
@@ -12611,6 +13768,31 @@ function _builtinMethodReturnType(language, receiverType, methodName) {
  * the PRODUCER's scope (_resolveFlowTypeOrigin). External producer packages
  * and reject-set returns stay untyped — no evidence either way.
  */
+function _goBuiltinChainedReceiverType(index, fileEntry, filePath, call) {
+    if (fileEntry?.language !== 'go' || !call.receiverCallResultType) return null;
+    const type = call.receiverCallResultType;
+    const qualifier = call.receiverCallResultTypeQualifier;
+    if (qualifier) {
+        const qualified = _goQualifiedReceiverType(
+            index, fileEntry, qualifier, type);
+        if (!qualified) return null;
+        if (qualified.kind !== 'project') {
+            return {
+                externalVia: qualified.via,
+                externalConcrete: true,
+            };
+        }
+        if (qualified.defs.length === 0 ||
+            new Set(qualified.defs.map(definition => definition.file)).size !== 1) {
+            return null;
+        }
+        return { type, fromFile: qualified.defs[0].file };
+    }
+    const origin = _resolveFlowTypeOrigin(index, filePath, type);
+    if (!origin?.fromFile) return null;
+    return { type, fromFile: origin.fromFile };
+}
+
 function _nominalChainedReceiverType(index, call, fileEntry, filePath) {
     const language = fileEntry.language;
     const defs = (index.symbols.get(call.receiverCall) || [])
@@ -13296,18 +14478,26 @@ function _rustClosureReceiverType(index, fileEntry, filePath, call, ctx) {
 function _typeOfCallResultFold(index, fileEntry, filePath, record, ctx, consumerAwaited) {
     if (ctx.memo.has(record)) return ctx.memo.get(record);
     // Real builder APIs routinely exceed 64 hops (clap's benchmark command
-    // has ~160). Keep a generous hard safety bound; failed results are not
-    // memoized because a depth-budget failure is contextual — caching it
-    // poisoned shorter suffix queries later in the same operation.
-    if (ctx.visiting.has(record) || ctx.visiting.size > 256) return null;
+    // has ~160). Keep a generous hard safety bound. A cycle/depth refusal is
+    // CONTEXTUAL (it depends on the visiting path), so any null whose subtree
+    // tripped the bound must not be cached — caching it poisoned shorter
+    // suffix queries later in the same operation. A null with NO trip in its
+    // subtree is universal (the producer shape is untypeable regardless of
+    // path) and IS cached: without that, an untypeable chain re-walks its
+    // whole producer prefix per consumer (clap `unwrap`: 76s -> linear).
+    if (ctx.visiting.has(record) || ctx.visiting.size > 256) {
+        ctx.foldTrips = (ctx.foldTrips || 0) + 1;
+        return null;
+    }
     ctx.visiting.add(record);
+    const tripsBefore = ctx.foldTrips || 0;
     let out;
     try {
         out = _typeOfCallResultFoldInner(index, fileEntry, filePath, record, ctx, consumerAwaited);
     } finally {
         ctx.visiting.delete(record);
     }
-    if (out) ctx.memo.set(record, out);
+    if (out || (ctx.foldTrips || 0) === tripsBefore) ctx.memo.set(record, out ?? null);
     return out;
 }
 
@@ -13469,7 +14659,8 @@ function _typeOfCallResultFoldInner(index, fileEntry, filePath, record, ctx, con
     // to the one-hop project-wide agreement rule when the receiver stays
     // untyped.
     if (record.isMethod) {
-        let rt = null;
+        let rt = _goBuiltinChainedReceiverType(
+            index, fileEntry, filePath, record);
         if (record.receiverType && !record.receiverIsChainRoot) {
             const origin = nominal
                 ? _resolveFlowTypeOrigin(index, filePath, record.receiverType,
@@ -13870,4 +15061,4 @@ function findCallbackUsages(index, name) {
     return usages;
 }
 
-module.exports = { getCachedCalls, findCallers, findCallees, getInstanceAttributeTypes, findCallbackUsages, _nameBindingReaches, _declaredFieldType, _projectTopLevelNames, _callArityCompatible, _closeCallableIdentityGroup };
+module.exports = { getCachedCalls, findCallers, findCallees, getInstanceAttributeTypes, findCallbackUsages, _nameBindingReaches, _moduleAttributeBindingReaches, _declaredFieldType, _projectTopLevelNames, _callArityCompatible, _closeCallableIdentityGroup, _overloadDiscipline, _overloadApplicable };