ucn 5.3.1 → 5.3.3

package/.claude/skills/ucn/SKILL.md

@@ -157,9 +157,25 @@ definition, and `--raw` when the next step is an edit.
 
 Treat `deadcode` as a candidate generator. Before deletion, inspect `usages`, `impact`, `entrypoints`, `api`, and `repo --sections=health --deep`; then corroborate with the compiler/type checker and tests. Computed dispatch such as `handlers[key]()` is a reported blind spot; registry members reached by a modeled computed receiver are withheld. Statically named reflection such as `getattr(obj, "run")` is positive liveness evidence, so every matching member spelling is withheld; recognized dynamic reflection is counted and warned because it cannot be attributed to one member. Unknown decorators/annotations and member-assigned event handlers are also withheld by default because they can be the registration itself. All remaining candidates are still review-only. Never delete solely from `deadcode` or an observed-text-zero result.
 
-`usages` includes comment/string/docstring occurrences in an `OTHER TEXT` section unless
-`--code-only` is set. This is a literal-name inventory, not exact target
-binding. `search` treats its term literally by default; pass `--regex` only
+`usages` includes comment/string/docstring occurrences and non-code text
+(JSX children, HTML markup and attributes) in an `OTHER TEXT` section unless
+`--code-only` is set, so it lists every line the `ACCOUNT` counts. This is a
+literal-name inventory, not exact target binding. Identifier boundaries are
+Unicode-aware and match `grep -w`: `hit` never matches inside `hitΔ`, while
+`$` is a boundary (`buy${...}`, `$fail`, `ws$close()` all count).
+
+Aliased and qualified calls resolve in every language: Rust `use m::f as g; g()`
+is a caller of `f` (listed as a beyond-text caller, since the line holds no
+target token); Java `pkg.Type.method()` and C# `Ns.Type.Method()` /
+`using T = Ns.Type; T.Method()` pick the type the qualifier names when several
+same-name types exist. A qualifier the resolver cannot place stays visible as
+`method-ambiguous`, never confirmed by first-definition order.
+
+`endpoints` recognizes client receivers by evidence (a receiver typed to an
+HTTP client class, or bound to a pytest fixture that constructs one), not only
+by name. Request-shaped calls with a path literal on an unrecognized receiver
+are listed under `Possible client requests` (JSON `uncertainRequests`),
+counted in `meta`, never in the inventory. `search` treats its term literally by default; pass `--regex` only
 when regular-expression semantics are intended. Ordinary regex patterns run
 through an RE2-compatible linear-time engine; unsafe nested repetition is
 rejected, and unsupported advanced syntax should be handed to ripgrep.

package/core/account.js

@@ -52,7 +52,7 @@
 
 const fs = require('fs');
 const path = require('path');
-const { escapeRegExp, codeUnitCompare } = require('./shared');
+const { codeUnitCompare, literalNameRegex } = require('./shared');
 
 // Unsupported-language site listings are capped so a Rails-sized repo cannot
 // flood the account object; the counts always cover the full set.
@@ -83,7 +83,7 @@ function computeGroundSet(index, name) {
         index._groundSetCache.set(name, cached);
         return cached.result;
     }
-    const wordRe = new RegExp('\\b' + escapeRegExp(name) + '\\b');
+    const wordRe = literalNameRegex(name);
     const perFile = new Map();
     let total = 0;
     let fileCount = 0;
@@ -158,7 +158,7 @@ function scanFailedFiles(index, name) {
     if (!index.failedFiles || index.failedFiles.size === 0) {
         return { unparsed, unreadableFiles };
     }
-    const wordRe = new RegExp('\\b' + escapeRegExp(name) + '\\b');
+    const wordRe = literalNameRegex(name);
     for (const failedPath of index.failedFiles) {
         if (index.files.has(failedPath)) continue;
         let content;
@@ -204,7 +204,7 @@ function scanUnsupportedFiles(index, name, opts = {}) {
     if (!Array.isArray(index.unsupportedFiles) || index.unsupportedFiles.length === 0) {
         return unsupported;
     }
-    const wordRe = new RegExp('\\b' + escapeRegExp(name) + '\\b');
+    const wordRe = literalNameRegex(name);
     const languageCounts = new Map();
     for (const skipped of index.unsupportedFiles) {
         const absPath = path.join(index.root, skipped.relativePath);

package/core/bridge.js

@@ -1066,11 +1066,60 @@ function extractNextjsRoutes(index) {
  * Detect HTTP client requests across the project.
  * Cached on `index._endpointsCache.clientRequests`.
  */
+// Python HTTP client types whose instances are receivers of request calls.
+// A receiver typed to one of these (with-binding, constructor assignment) or
+// bound to a pytest fixture that constructs one is a client by evidence, not
+// by name (fix #349: 145 of 625 real `tc.get("/api/...")` sites on one repo
+// were invisible because the receiver was not literally named `client`).
+const PY_CLIENT_TYPES = new Set([
+    'TestClient', 'Client', 'AsyncClient', 'Session', 'FlaskClient',
+    'ClientSession', 'AsyncSession', 'HTTPConnection', 'HTTPSConnection',
+]);
+const PY_CLIENT_FACTORIES = new Set(['test_client', 'Session', 'Client', 'AsyncClient']);
+const PY_REQUEST_METHODS = /^(get|post|put|delete|patch|options|head|request)$/;
+
+function _pythonClientFixtures(index) {
+    if (index._endpointsCache?.pyClientFixtures) return index._endpointsCache.pyClientFixtures;
+    const fixtures = new Set();
+    for (const [filePath, fileEntry] of index.files) {
+        if (fileEntry.language !== 'python') continue;
+        const fixtureDefs = (fileEntry.symbols || []).filter(s =>
+            (s.decorators || []).some(d => /(^|\.)fixture$/.test(String(d))));
+        if (fixtureDefs.length === 0) continue;
+        const calls = getCachedCalls(index, filePath) || [];
+        for (const def of fixtureDefs) {
+            const constructsClient = calls.some(c =>
+                c.enclosingFunction?.name === def.name &&
+                c.enclosingFunction?.startLine === def.startLine &&
+                (PY_CLIENT_TYPES.has(c.name) || (c.isMethod && PY_CLIENT_FACTORIES.has(c.name))));
+            if (constructsClient) fixtures.add(def.name);
+        }
+    }
+    if (!index._endpointsCache) index._endpointsCache = {};
+    index._endpointsCache.pyClientFixtures = fixtures;
+    return fixtures;
+}
+
+function _pythonClientReceiver(index, fileEntry, call, fixtures) {
+    if (!call.isMethod || !call.receiver || !PY_REQUEST_METHODS.test(call.name)) return null;
+    if (call.receiverType && PY_CLIENT_TYPES.has(String(call.receiverType).split('.').pop())) {
+        return 'python-client';
+    }
+    if (fixtures.size === 0 || !fixtures.has(call.receiver)) return null;
+    const fn = call.enclosingFunction;
+    if (!fn) return null;
+    const sym = (fileEntry.symbols || []).find(s => s.name === fn.name && s.startLine === fn.startLine);
+    const params = String(sym?.params || '').split(',').map(p => p.trim().split(/[:=]/)[0].trim());
+    return params.includes(call.receiver) ? 'pytest-client-fixture' : null;
+}
+
 function extractClientRequests(index) {
     if (index._endpointsCache && index._endpointsCache.clientRequests) {
         return index._endpointsCache.clientRequests;
     }
     const requests = [];
+    const uncertain = [];
+    const pyFixtures = _pythonClientFixtures(index);
 
     for (const [filePath, fileEntry] of index.files) {
         const lang = fileEntry.language;
@@ -1079,8 +1128,30 @@ function extractClientRequests(index) {
 
         for (const call of calls) {
             if (!call.firstStringArg) continue;
-            const r = matchClientRequest(call, lang, calls);
-            if (!r) continue;
+            let r = matchClientRequest(call, lang, calls);
+            if (!r && lang === 'python') {
+                const framework = _pythonClientReceiver(index, fileEntry, call, pyFixtures);
+                if (framework) {
+                    r = { method: call.name.toUpperCase() === 'REQUEST' ? 'ALL' : call.name.toUpperCase(),
+                        framework, methodInferred: call.name === 'request' };
+                }
+            }
+            if (!r) {
+                // Visible uncertainty: request-shaped call on an unrecognized
+                // receiver with a path-shaped literal. Listed, never counted.
+                const conf = CLIENT_PATTERNS[lang];
+                const pathShaped = call.firstStringArg.startsWith('/') || call.firstStringArg.includes('://');
+                if (conf && call.isMethod && call.receiver && pathShaped &&
+                    conf.receivers.some(p => p.methodPattern.test(call.name))) {
+                    uncertain.push({
+                        receiver: call.receiver, method: call.name, path: call.firstStringArg,
+                        file: fileEntry.relativePath || filePath, absoluteFile: filePath, line: call.line,
+                        callerName: call.enclosingFunction?.name || '<top-level>',
+                        reason: 'receiver-unrecognized',
+                    });
+                }
+                continue;
+            }
 
             // Python's common `session.get("key")` / `s.get("key")`
             // dictionary and ORM idioms are not HTTP requests.  Without
@@ -1114,6 +1185,9 @@ function extractClientRequests(index) {
     }
 
     // Stable sort
+    uncertain.sort((a, b) => a.file !== b.file ? codeUnitCompare(a.file, b.file) : a.line - b.line);
+    if (!index._endpointsCache) index._endpointsCache = {};
+    index._endpointsCache.uncertainRequests = uncertain;
     requests.sort((a, b) => {
         if (a.file !== b.file) return codeUnitCompare(a.file, b.file);
         if (a.line !== b.line) return a.line - b.line;
@@ -1418,6 +1492,13 @@ function endpoints(index, options = {}) {
 
     let routes = opts.clientOnly ? [] : extractServerRoutes(index);
     let requests = (opts.serverOnly ? [] : extractClientRequests(index));
+    let uncertainRequests = opts.serverOnly ? [] : (index._endpointsCache?.uncertainRequests || []);
+    if (uncertainRequests.length > 0) {
+        // A server route registration (`@app.get("/x")`, `router.get("/x", h)`)
+        // is request-shaped too; the route inventory already owns those lines.
+        const routeLines = new Set(extractServerRoutes(index).map(r => `${r.absoluteFile}:${r.line}`));
+        uncertainRequests = uncertainRequests.filter(r => !routeLines.has(`${r.absoluteFile}:${r.line}`));
+    }
 
     // Apply filters
     if (opts.method) {
@@ -1427,6 +1508,10 @@ function endpoints(index, options = {}) {
     if (opts.prefix) {
         routes = routes.filter(r => r.path.startsWith(opts.prefix) || r.normalizedPath.startsWith(opts.prefix));
         requests = requests.filter(r => r.path.startsWith(opts.prefix) || r.normalizedPath.startsWith(opts.prefix));
+        uncertainRequests = uncertainRequests.filter(r => r.path.startsWith(opts.prefix));
+    }
+    if (opts.method) {
+        uncertainRequests = uncertainRequests.filter(r => r.method.toUpperCase() === opts.method || r.method === 'request');
     }
 
     let bridges = opts.bridge ? bridgeEndpoints(index) : [];
@@ -1472,12 +1557,14 @@ function endpoints(index, options = {}) {
             : 'incomplete-endpoint-inventory',
         routes,
         requests,
+        uncertainRequests,
         bridges,
         unmatchedRoutes,
         unmatchedRequests,
         meta: {
             totalRoutes: routes.length,
             totalRequests: requests.length,
+            uncertainRequests: uncertainRequests.length,
             totalBridges: bridges.length,
             unmatchedRoutes: unmatchedRoutes.length,
             unmatchedRequests: unmatchedRequests.length,

package/core/cache.js

@@ -697,7 +697,9 @@ function clearAllCaches() {
 // default/type imports and inline type re-exports preserve execution timing.
 // Python TYPE_CHECKING guards require typing ownership and no rebinding.
 // v212 (fix #342): extendsGraph/extendedByGraph no longer persisted (rebuilt on load).
-const CACHE_FORMAT_VERSION = 212;
+// v213 (fix #348): Python from-import records carry per-name `renames` so
+// import bindings pair each alias with its own module.
+const CACHE_FORMAT_VERSION = 214;
 const USAGE_CACHE_FILE = 'usage-results.json';
 
 /**

package/core/callers.js

@@ -10,7 +10,8 @@ const path = require('path');
 const crypto = require('crypto');
 const { detectLanguage, getParser, getLanguageAdapter, langTraits } = require('../languages');
 const { isTestFile } = require('./discovery');
-const { NON_CALLABLE_TYPES, isOverrideMarked, codeUnitCompare, isTestPath } = require('./shared');
+const { NON_CALLABLE_TYPES, isOverrideMarked, codeUnitCompare, isTestPath, CALLABLE_SYMBOL_KINDS } = require('./shared');
+const { _resolveJavaPackageImport } = require('./graph-build');
 const { scoreEdge, tierForResolution, TIER } = require('./confidence');
 const { findGoModule, resolveRustImport } = require('./imports');
 
@@ -634,6 +635,17 @@ function findCallers(index, name, options = {}) {
                 langTraits(fileEntry.language)?.typeSystem === 'structural';
 
             for (let call of calls) {
+                // fix #353: C# `Beta.Helper.Widget()` — the parser records a
+                // field hop rooted at `this` (Beta is no local). When the
+                // prefix names a project NAMESPACE that declares the last
+                // segment as a type, the receiver is that type, namespace-
+                // qualified; the hop shape would only ever fail the field
+                // walk and route method-ambiguous.
+                if (fileEntry.language === 'csharp') {
+                    const rewritten = _csharpNamespaceQualifiedReceiver(index, call,
+                        index.findEnclosingFunction(filePath, call.line, true));
+                    if (rewritten) call = rewritten;
+                }
                 // Skip if not matching our target name (also check alias resolution)
                 let calledAs = null; // surface name when matched via an import/export rename
                 const typeQualifierReference = targetIsTypeQuery &&
@@ -2802,10 +2814,22 @@ function findCallers(index, name, options = {}) {
                     // source name from DIFFERENT modules — the record's local
                     // alias (call.name) picks its own binding; source-name
                     // matching alone over-follows into the other module.
-                    if (call.resolvedName && nameBindings.some(b => b.alias)) {
+                    // Python records carry the alias as `calledAs` rather
+                    // than resolvedName; both name the paired binding.
+                    if ((call.resolvedName || calledAs) && nameBindings.some(b => b.alias)) {
                         const paired = nameBindings.filter(b => b.alias === call.name);
                         if (paired.length > 0) nameBindings = paired;
                     }
+                    // Scope-granular import bindings (fix #352): a
+                    // function-local `from x import name` binds the name for
+                    // ITS function only. Three such imports in one file used
+                    // to make three file-level bindings, so a bare call in any
+                    // of the functions scope-matched every pin (investment
+                    // run_validation: 6 defs, each claiming the others'
+                    // sites). The nearest enclosing binder owns the name; a
+                    // binding inside a function that does not enclose the
+                    // call is out of scope (#215 discipline, line-granular).
+                    nameBindings = _scopeImportBindings(fileEntry, nameBindings, call.line);
                     const tFiles = new Set(targetDefs.map(d => d.file).filter(Boolean));
                     // fix #215 (rich-measured: 225 builtin `print(...)` calls
                     // confirmed against rich's def via file-level import edges):
@@ -4073,12 +4097,17 @@ function findCallers(index, name, options = {}) {
                     if (call.isPathCall && receiverName) {
                         receiverName = String(receiverName).split('::').pop();
                     }
+                    let aliasResolvedFile = null;
                     if (receiverName && !tTypes.has(receiverName)) {
                         for (const im of (fileEntry.importBindings || [])) {
                             if (im.name !== receiverName) continue;
-                            const orig = String(im.module || '').split('::').pop();
+                            // fix #353: C# `using BH = Beta.Helper` (and Java
+                            // dotted paths) split on `.`; Rust paths on `::`.
+                            const orig = String(im.module || '').split(/::|\./).pop();
                             if (orig && orig !== receiverName && tTypes.has(orig)) {
                                 receiverName = orig;
+                                const rel = fileEntry.moduleResolved && fileEntry.moduleResolved[im.module];
+                                if (rel) aliasResolvedFile = path.join(index.root, rel);
                                 break;
                             }
                         }
@@ -4106,7 +4135,14 @@ function findCallers(index, name, options = {}) {
                     // name fallback above handles multi-definition names; this
                     // covers single-definition targets that skip it.
                     if (typeQualifiedReceiver) {
-                        const identity = _resolveReceiverTypeIdentity(index, filePath, receiverName, targetDefs2, call.line);
+                        // fix #353: an alias binding that RESOLVED to a file is
+                        // the type's identity (`using BH = Beta.Helper`); a
+                        // parser-recorded qualifier (`beta.Helper`, `Beta.Helper`)
+                        // is a namespace/package hint for the resolver.
+                        const identity = aliasResolvedFile
+                            ? (targetDefs2.some(d => d.file === aliasResolvedFile) ? 'target' : 'other')
+                            : _resolveReceiverTypeIdentity(index, filePath, receiverName, targetDefs2, call.line,
+                                call.receiverIsTypeQualified ? call.receiverTypeQualifier : undefined);
                         if (identity === 'other') {
                             recordExcluded(filePath, call.line, 'path-type-mismatch');
                             continue;
@@ -5342,6 +5378,12 @@ function findCallees(index, definition, options = {}) {
         for (let call of calls) {
             siteOrdinal++;
             const siteId = siteOrdinal;
+            if (language === 'csharp') {
+                // fix #353: `Beta.Helper.Widget()` — namespace-qualified type
+                // receiver (see the findCallers twin).
+                const rewritten = _csharpNamespaceQualifiedReceiver(index, call, def);
+                if (rewritten) call = rewritten;
+            }
             if (language === 'go' && call.isMethod &&
                 !call.receiverType && call.receiverIndexField) {
                 const indexedType = _goIndexedReceiverType(index, def.file, call);
@@ -9851,6 +9893,42 @@ function _projectTopLevelNames(index) {
     return names;
 }
 
+/**
+ * Fix #352: restrict import bindings of a name to those in scope at a call
+ * line. A binding whose import line sits inside a function body is local to
+ * that function (Python function-body imports, JS function-scoped require);
+ * the innermost enclosing binder wins, bindings in non-enclosing functions
+ * are dropped, module-level bindings survive only when no enclosing function
+ * binds the name. Bindings without a line (older records) are kept as-is.
+ */
+function _scopeImportBindings(fileEntry, bindings, callLine) {
+    if (!bindings || bindings.length < 2 || callLine == null) return bindings;
+    if (!bindings.some(b => b.line != null && b.deferred)) return bindings;
+    const scopes = (fileEntry.symbols || []).filter(s =>
+        s.startLine != null && s.endLine != null && s.endLine > s.startLine &&
+        CALLABLE_SYMBOL_KINDS.has(s.type));
+    const innermost = line => {
+        let best = null;
+        for (const s of scopes) {
+            if (line < s.startLine || line > s.endLine) continue;
+            if (!best || (s.endLine - s.startLine) < (best.endLine - best.startLine)) best = s;
+        }
+        return best;
+    };
+    const local = [];
+    const moduleLevel = [];
+    for (const b of bindings) {
+        if (b.line == null) { moduleLevel.push(b); continue; }
+        const scope = innermost(b.line);
+        if (!scope) { moduleLevel.push(b); continue; }
+        if (callLine < scope.startLine || callLine > scope.endLine) continue;
+        local.push({ b, size: scope.endLine - scope.startLine });
+    }
+    if (local.length === 0) return moduleLevel;
+    const nearest = Math.min(...local.map(l => l.size));
+    return local.filter(l => l.size === nearest).map(l => l.b);
+}
+
 /**
  * Is an UNRESOLVED module specifier a resolver gap rather than externality
  * evidence? (fix #337b) Relative specifiers and first segments naming a
@@ -9978,6 +10056,32 @@ function _isGenericParamReceiverType(index, filePath, line, typeName) {
     return _isEnclosingGenericParam(index, filePath, line, typeName);
 }
 
+/**
+ * fix #353: C# namespace-qualified type receivers. `Beta.Helper.Widget()` is
+ * recorded by the parser as a this-rooted field hop (Beta is not a local);
+ * when the dotted prefix names a project namespace (exactly, or relative to
+ * the call's own namespace) that declares the last segment as a type, the
+ * call is a type-qualified static call on that type. Returns a rewritten
+ * record or null (unknown prefixes keep the parser's shape).
+ */
+function _csharpNamespaceQualifiedReceiver(index, call, enclosing) {
+    if (!call.isMethod || call.receiverType || !Array.isArray(call.receiverFields) ||
+        call.receiverFields.length < 2 || call.receiverRoot !== 'this') return null;
+    const typeName = call.receiverFields[call.receiverFields.length - 1];
+    if (!/^[A-Z]/.test(typeName)) return null;
+    const prefix = call.receiverFields.slice(0, -1).join('.');
+    const typeDefs = (index.symbols.get(typeName) || []).filter(d =>
+        IDENTITY_TYPE_KINDS.has(d.type) && d.namespace);
+    if (typeDefs.length === 0) return null;
+    const enclosingNs = enclosing?.namespace || null;
+    const candidates = enclosingNs ? [prefix, `${enclosingNs}.${prefix}`] : [prefix];
+    const ns = candidates.find(c => typeDefs.some(d => d.namespace === c));
+    if (!ns) return null;
+    const { receiverRoot, receiverField, receiverFields, receiverRootType, receiverRootNamespace, ...rest } = call;
+    void receiverRoot; void receiverField; void receiverFields; void receiverRootType; void receiverRootNamespace;
+    return { ...rest, receiver: typeName, receiverIsTypeQualified: true, receiverTypeQualifier: ns };
+}
+
 /**
  * Java same-package check across Maven/Gradle source roots (fix #246):
  * src/main/java/<pkg> and src/test/java/<pkg> hold the SAME package —
@@ -10017,6 +10121,16 @@ function _resolveReceiverTypeIdentity(index, filePath, knownType, targetDefs, li
         // cannot resolve it. That is not exclusion evidence.
         return 'unknown';
     }
+    if (language === 'java' && namespaceHint && /^[a-z_]/.test(namespaceHint)) {
+        // fix #353: a lowercase dotted qualifier is a PACKAGE
+        // (`beta.Helper.widget()`); the package + type name resolve to one
+        // file exactly like an import of `beta.Helper` would. Unresolvable
+        // packages (external, resolver gap) are never exclusion evidence.
+        const resolved = _resolveJavaPackageImport(index, `${namespaceHint}.${knownType}`, null);
+        if (!resolved) return 'unknown';
+        return targetDefs.some(d => d.className === knownType && d.file === resolved)
+            ? 'target' : 'other';
+    }
     if (language === 'java' && line == null) {
         // Return-flow annotations are interpreted in the PRODUCER definition's
         // file. That origin is stronger than same-package lookup and is
@@ -10963,6 +11077,23 @@ function _calleeStructuralBindingRoute(index, fileEntry, call, language, binding
     let sawProjectish = false;
     let sawUnknown = false;
     for (const binding of bindings) {
+        // fix #353 (Rust): `use alpha::widget as renamed; renamed()` — the
+        // binding's module is the ITEM path; the item is its last segment
+        // and the owning module file resolves through the Rust resolver.
+        if (language === 'rust') {
+            const segs = String(binding.module || '').split('::').filter(Boolean);
+            const item = segs[segs.length - 1];
+            const owners = _rustBindingResolvedFiles(index, fileEntry, fileEntry.path, binding);
+            if (item && owners.size > 0) {
+                sawProjectish = true;
+                for (const moduleFile of owners) {
+                    const routed = _calleeExportDefinitions(index, moduleFile, item, language, call, {});
+                    for (const d of routed.matches) matches.set(`${d.file}:${d.startLine}`, d);
+                    if (routed.unknown) sawUnknown = true;
+                }
+                continue;
+            }
+        }
         const rel = fileEntry.moduleResolved && fileEntry.moduleResolved[binding.module];
         if (!rel) {
             if (_unresolvedModuleIsGap(index, binding.module, binding)) {
@@ -11720,6 +11851,42 @@ function _nonCallableFieldMember(index, typeName, name, language) {
  * (#215): the class defined in this file or a file binding of the name —
  * an unbound capitalized receiver may be a parameter or local.
  */
+/**
+ * fix #353: resolve the files that OWN a type-qualified static receiver from
+ * the qualifier in the call (Java package / C# namespace), the file's alias
+ * or name import binding of the receiver, or the caller's own namespace.
+ * Returns a Set of absolute files, or null when nothing pins the owner.
+ */
+function _qualifiedStaticOwnerFiles(index, fileEntry, call, typeName, language, def) {
+    const files = new Set();
+    const typeDefs = (index.symbols.get(typeName) || []).filter(d =>
+        IDENTITY_TYPE_KINDS.has(d.type) && d.file);
+    const qual = call.receiverIsTypeQualified ? call.receiverTypeQualifier : null;
+    if (qual) {
+        if (language === 'java' && /^[a-z_]/.test(qual)) {
+            const resolved = _resolveJavaPackageImport(index, `${qual}.${typeName}`, null);
+            if (resolved) files.add(resolved);
+            return files.size > 0 ? files : null;
+        }
+        if (language === 'csharp') {
+            const enclosingNs = def?.namespace || null;
+            const candidates = enclosingNs ? [qual, `${enclosingNs}.${qual}`] : [qual];
+            for (const d of typeDefs) {
+                if (candidates.includes(d.namespace)) files.add(d.file);
+            }
+            return files.size > 0 ? files : null;
+        }
+    }
+    for (const b of (fileEntry?.importBindings || [])) {
+        const bindsReceiver = b.name === call.receiver || b.alias === call.receiver ||
+            (b.name === typeName && !b.alias);
+        if (!bindsReceiver) continue;
+        const rel = fileEntry.moduleResolved && fileEntry.moduleResolved[b.module];
+        if (rel) files.add(path.join(index.root, rel));
+    }
+    return files.size > 0 ? files : null;
+}
+
 /**
  * Namespace/module-container resolution (fix #254, W8 BUG-4 — verify's
  * BUG-BX rule brought into the engine, range-based): `Utils.slug()` where a
@@ -11833,7 +12000,8 @@ function _calleeTypeQualifiedReceiver(index, def, fileEntry, call, language) {
     if (typeDefs.length === 0) {
         for (const im of (fileEntry?.importBindings || [])) {
             if (im.name !== receiver) continue;
-            const orig = String(im.module || '').split('::').pop();
+            // fix #353: C# `using BH = Beta.Helper` splits on `.`
+            const orig = String(im.module || '').split(/::|\./).pop();
             if (orig && orig !== receiver && typeKindsOf(orig).length > 0) {
                 receiver = orig;
                 typeDefs = typeKindsOf(orig);
@@ -11875,9 +12043,30 @@ function _calleeTypeQualifiedReceiver(index, def, fileEntry, call, language) {
             _normalizedAliasBase(index, d)));
         if (bases.size === 1) candidateTypes.push(bases.values().next().value);
     }
-    const symbols = index.symbols.get(call.name) || [];
+    const allSymbols = index.symbols.get(call.name) || [];
     const isCallable = (s) => !NON_CALLABLE_TYPES.has(s.type) ||
         (s.type === 'field' && s.fieldType && /^func\b/.test(s.fieldType));
+    // fix #353: the qualifier that is right there in the call owns the type —
+    // `beta.Helper.widget()` (package), `Beta.Helper.Widget()` (namespace),
+    // `using BH = Beta.Helper; BH.Widget()` (alias binding), `import
+    // beta.Helper;` (name binding). Same-name types in other packages/
+    // namespaces leave the candidate set BEFORE member-group construction
+    // (the group dedupes identical signatures, so the first same-name type
+    // used to swallow the second). An unresolvable qualifier keeps them all.
+    const ownerFiles = (language === 'java' || language === 'csharp')
+        ? _qualifiedStaticOwnerFiles(index, fileEntry, call, receiver, language, def)
+        : null;
+    // A package qualifier the resolver cannot place (`org.external.Helper`)
+    // over a project type of the same name: unpinnable — visible, never
+    // confirmed by first-definition selection (#206 discipline).
+    if (language === 'java' && call.receiverIsTypeQualified &&
+        call.receiverTypeQualifier && /^[a-z_]/.test(call.receiverTypeQualifier) &&
+        !ownerFiles) {
+        return { unverified: 'method-ambiguous' };
+    }
+    const symbols = ownerFiles
+        ? allSymbols.filter(s => !candidateTypes.includes(s.className) || ownerFiles.has(s.file))
+        : allSymbols;
     if (language === 'java' || language === 'csharp') {
         // Class-qualified Java/C# calls see the compiler member group on the
         // qualifier. The helper handles inherited slots and C# name hiding.

package/core/execute.js

@@ -1836,6 +1836,7 @@ const HANDLERS = {
         result.meta = {
             totalRoutes: result.routes.length,
             totalRequests: result.requests.length,
+            uncertainRequests: (result.uncertainRequests || []).length,
             totalBridges: result.bridges.length,
             unmatchedRoutes: result.unmatchedRoutes.length,
             unmatchedRequests: result.unmatchedRequests.length,

package/core/output/endpoints.js

@@ -26,7 +26,7 @@ function formatEndpoints(result, options = {}) {
     const showBridge = options.bridge;
 
     if (!showBridge) {
-        return formatRoutesAndRequests(routes, requests, meta, options, result.advisory);
+        return formatRoutesAndRequests(routes, requests, meta, options, result.advisory, result);
     }
     return formatBridges(bridges, unmatchedRoutes, unmatchedRequests, meta, options, result.advisory);
 }
@@ -48,7 +48,20 @@ function uniqueMatchPercent(bridges, totalRequests) {
     return Math.min(100, Math.max(0, pct));
 }
 
-function formatRoutesAndRequests(routes, requests, meta, options, advisory = null) {
+function formatUncertainRequests(result, options) {
+    const list = result?.uncertainRequests || [];
+    if (list.length === 0) return [];
+    const lines = [];
+    lines.push(`Possible client requests (${list.length}) — request-shaped call with a path literal, receiver not recognized as an HTTP client:`);
+    const cap = options.all ? Infinity : 10;
+    for (const r of list.slice(0, cap)) {
+        lines.push(`  ${r.file}:${r.line} ${r.receiver}.${r.method}(${JSON.stringify(r.path)}) in ${r.callerName}`);
+    }
+    if (list.length > cap) lines.push(`  (+${list.length - cap} more — use --all)`);
+    return lines;
+}
+
+function formatRoutesAndRequests(routes, requests, meta, options, advisory = null, result = null) {
     const lines = [];
     const showServer = !options.clientOnly;
     const showClient = !options.serverOnly;
@@ -109,6 +122,10 @@ function formatRoutesAndRequests(routes, requests, meta, options, advisory = nul
         }
     }
 
+    if (showClient) {
+        const uncertain = formatUncertainRequests(result, options);
+        if (uncertain.length > 0) lines.push('', ...uncertain);
+    }
     const routeAdvisory = advisoryLine(advisory);
     if (routeAdvisory) lines.push('', routeAdvisory);
     return lines.join('\n').trimEnd();
@@ -230,6 +247,10 @@ function formatEndpointsJson(result, options = {}) {
         data: {
             routes: routes.map(trimRoute),
             requests: requests.map(trimReq),
+            uncertainRequests: (result.uncertainRequests || []).map(r => ({
+                receiver: r.receiver, method: r.method, path: r.path,
+                file: r.file, line: r.line, callerName: r.callerName, reason: r.reason,
+            })),
             // In unmatched-only mode, the matched bridges array is suppressed
             // — consumers that want both should not pass --unmatched.
             bridges: unmatchedOnly ? [] : bridges.map(trimBridge),

package/core/project.js

@@ -17,7 +17,7 @@ const { detectLanguage, getParser, getLanguageAdapter, safeParse, langTraits, PA
 const { validateFileIR } = require('./ir');
 const { createFileEntryFromIR, populateFileEntryFromIR } = require('./index-ir');
 const { getTokenTypeAtPosition } = require('../languages/utils');
-const { escapeRegExp, NON_CALLABLE_TYPES, codeUnitCompare } = require('./shared');
+const { escapeRegExp, NON_CALLABLE_TYPES, codeUnitCompare, literalNameRegex } = require('./shared');
 const stacktrace = require('./stacktrace');
 const indexCache = require('./cache');
 const deadcodeModule = require('./deadcode');
@@ -1523,7 +1523,7 @@ class ProjectIndex {
 
         // Detailed path: full AST-based counting (original algorithm)
         // Note: no 'g' flag - we only need to test for presence per line
-        const regex = new RegExp('\\b' + escapeRegExp(name) + '\\b');
+        const regex = literalNameRegex(name);
 
         // Get files that could reference this symbol:
         // 1. The file where it's defined
@@ -1941,6 +1941,30 @@ class ProjectIndex {
         }
     }
 
+    /**
+     * True when the AST node at (line, column) is an identifier token — code
+     * the usage scan saw (and may have deliberately dropped), as opposed to
+     * JSX children, HTML markup, or other non-code text (fix #350).
+     */
+    isIdentifierAtPosition(content, lineNum, column, filePath, name) {
+        const language = detectLanguage(filePath, this.root);
+        if (!language) return false;
+        try {
+            const tree = this._getParsedTree(filePath, content, language) ||
+                safeParse(getParser(language), content);
+            if (!tree) return false;
+            const node = tree.rootNode.descendantForPosition({ row: lineNum - 1, column });
+            if (!node || !/identifier|^name$|^word$/.test(node.type)) return false;
+            // fix #352: the identifier node must BE the name — a hyphenated JSX
+            // attribute (`data-cell-state`) is one property_identifier whose
+            // text merely contains `cell`; the ACCOUNT counts that line as
+            // other-text, so usages must list it (the #350 equality).
+            return node.text === name;
+        } catch (e) {
+            return false;
+        }
+    }
+
     /**
      * Check if a position in code is inside a comment or string using AST
      * @param {string} content - File content

package/core/search.js

@@ -8,7 +8,7 @@
 'use strict';
 
 const path = require('path');
-const { escapeRegExp, codeUnitCompare, inlineTestRanges, lineInRanges, classDispatchNames, CALLABLE_SYMBOL_KINDS } = require('./shared');
+const { escapeRegExp, codeUnitCompare, inlineTestRanges, lineInRanges, classDispatchNames, CALLABLE_SYMBOL_KINDS, literalNameRegex } = require('./shared');
 const { isTestFile } = require('./discovery');
 const { detectLanguage, getParser, getLanguageAdapter, langTraits } = require('../languages');
 const { getCachedCalls } = require('./callers');
@@ -49,11 +49,6 @@ function matchesSubstring(text, pattern, caseSensitive) {
     return text.toLowerCase().includes(pattern.toLowerCase());
 }
 
-function literalNameRegex(name) {
-    return new RegExp(
-        `(?<![A-Za-z0-9_$])${escapeRegExp(name)}(?![A-Za-z0-9_$])`,
-    );
-}
 
 /**
  * Complete the AST-classified usage inventory with literal-name lines that
@@ -82,14 +77,21 @@ function appendTextComplements(index, {
         const lineNum = idx + 1;
         const commentOrString = index.isCommentOrStringAtPosition(
             content, lineNum, match.index, filePath);
-        if (!commentOrString) continue;
+        // A literal match that no AST identifier record claimed and that is
+        // not inside a comment or string is non-code text: JSX children,
+        // HTML markup and attributes, regex bodies. The ACCOUNT counts these
+        // lines as other-text; the escape hatch must list them too. A line
+        // the AST scan classified and then deliberately dropped (Rust enum
+        // variants against a struct pin, #234) is code, not text: skip it.
+        if (!commentOrString &&
+            index.isIdentifierAtPosition(content, lineNum, match.index, filePath, name)) continue;
         const usage = {
             file: filePath,
             relativePath: fileEntry.relativePath,
             line: lineNum,
             content: line,
             usageType: 'text',
-            textKind: 'comment-or-string',
+            textKind: commentOrString ? 'comment-or-string' : 'markup-or-text',
             isDefinition: false,
         };
         if (context > 0) {
@@ -397,7 +399,7 @@ function usages(index, name, options = {}) {
             }
 
             // Fallback to regex-based detection
-            const regex = new RegExp('\\b' + escapeRegExp(name) + '\\b');
+            const regex = literalNameRegex(name);
             lines.forEach((line, idx) => {
                 const lineNum = idx + 1;
 

package/core/shared.js

@@ -118,6 +118,18 @@ function addTestExclusions(exclude) {
 /**
  * Escape special regex characters
  */
+/**
+ * Whole-identifier match for a symbol name. `\b` is ASCII-only in JS, so
+ * `hit` matched inside `hitΔ` while every compiler and ripgrep treat Δ as an
+ * identifier character. Letters, digits, `_` and `$` on either side break a
+ * match; anything else (punctuation, whitespace, line edges) is a boundary.
+ */
+function literalNameRegex(name, flags = '') {
+    return new RegExp(
+        `(?<![\\p{L}\\p{N}_])${escapeRegExp(name)}(?![\\p{L}\\p{N}_])`,
+        flags.includes('u') ? flags : flags + 'u');
+}
+
 function escapeRegExp(text) {
     return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
@@ -463,7 +475,7 @@ function maskBlockComments(content, language) {
     return out.join('');
 }
 
-module.exports = {
+module.exports = { literalNameRegex,
     pickBestDefinition,
     addTestExclusions,
     escapeRegExp,

package/languages/java.js

@@ -1502,14 +1502,34 @@ function findCallsInCode(code, parser) {
                     const valueNode = receiverNode.childForFieldName('value');
                     if (valueNode?.type === 'identifier') castReceiverName = valueNode.text;
                 }
-                const receiver = castReceiverName ||
+                let receiver = castReceiverName ||
                     ((receiverNode?.type === 'identifier' || receiverNode?.type === 'this')
                         ? receiverNode.text : undefined);
+                // fix #353: `beta.Helper.widget()` — a lowercase dotted root
+                // under a capitalized member is a PACKAGE-qualified type
+                // (Java packages are lowercase by convention, types
+                // capitalized); the receiver is the type and the package is
+                // its qualifier, so same-name static methods in two packages
+                // resolve by the qualifier that is right there in the call.
+                let packageQualifier;
+                if (!receiver && receiverNode?.type === 'field_access') {
+                    const rootNode = receiverNode.childForFieldName('object');
+                    const fldNode = receiverNode.childForFieldName('field');
+                    const rootText = rootNode?.text || '';
+                    const rootHead = rootText.split('.')[0];
+                    if (fldNode?.type === 'identifier' && /^[A-Z]/.test(fldNode.text) &&
+                        /^[a-z_][\w]*(\.[a-z_][\w]*)*$/.test(rootText) &&
+                        !getReceiverType(rootHead) && !isDeclaredLocal(rootHead) &&
+                        !hasEnclosingField(node, rootHead)) {
+                        receiver = fldNode.text;
+                        packageQualifier = rootText;
+                    }
+                }
                 const receiverType = castReceiverType ||
                     ((receiver && receiver !== 'this') ? getReceiverType(receiver) : undefined);
-                const receiverTypeQualifier = !castReceiverType && receiver
-                    ? getReceiverTypeQualifier(receiver) : undefined;
-                const receiverIsTypeQualified = !!(receiverNode?.type === 'identifier' &&
+                const receiverTypeQualifier = packageQualifier ||
+                    (!castReceiverType && receiver ? getReceiverTypeQualifier(receiver) : undefined);
+                const receiverIsTypeQualified = !!((receiverNode?.type === 'identifier' || packageQualifier) &&
                     receiver && /^[A-Z]/.test(receiver) && !receiverType &&
                     !isDeclaredLocal(receiver) && !hasEnclosingField(node, receiver));
                 // fix #202: one-hop declared-field receivers —

package/languages/python.js

@@ -3140,6 +3140,7 @@ function findImportsInCode(code, parser) {
             const deferral = importDeferral(node);
             let modulePath = '';
             const names = [];
+            const renames = [];
 
             for (let i = 0; i < node.namedChildCount; i++) {
                 const child = node.namedChild(i);
@@ -3158,6 +3159,7 @@ function findImportsInCode(code, parser) {
                     if (nameNode && aliasNode && aliasNode.text !== nameNode.text) {
                         if (!importAliases) importAliases = [];
                         importAliases.push({ original: nameNode.text, local: aliasNode.text });
+                        renames.push({ original: nameNode.text, local: aliasNode.text });
                     }
                 } else if (child.type === 'wildcard_import') {
                     names.push('*');
@@ -3171,6 +3173,7 @@ function findImportsInCode(code, parser) {
                     names,
                     type: isRelative ? 'relative' : 'from',
                     line,
+                    ...(renames.length > 0 && { renames }),
                     ...(deferral && { deferred: true, deferredReason: deferral })
                 });
             }

package/languages/rust.js

@@ -3152,6 +3152,14 @@ function findImportsInCode(code, parser) {
             if (pathNode && aliasNode) {
                 addLeaf(joinUsePath(prefix, pathNode.text), aliasNode.text,
                     'use', false, line);
+                // fix #353: `use alpha::widget as renamed; renamed()` — the
+                // alias pairing feeds findCallers' import-rename surface
+                // (calledAs), exactly like Python/JS `import x as y`.
+                const original = String(pathNode.text).split('::').pop();
+                if (original && original !== aliasNode.text && original !== 'self') {
+                    if (!imports.aliases) imports.aliases = [];
+                    imports.aliases.push({ original, local: aliasNode.text });
+                }
             }
             return;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ucn",
-  "version": "5.3.1",
+  "version": "5.3.3",
   "mcpName": "io.github.mleoca/ucn",
   "description": "Auditable AST code intelligence for AI agents: 18 task-oriented commands through one MCP tool, CLI, or agent skill. Supports JS/TS, Python, Go, Rust, Java, C, C++, C#, and HTML.",
   "main": "index.js",