ucn 5.3.2 → 5.3.4

package/.claude/skills/ucn/SKILL.md

@@ -39,7 +39,7 @@ answer, a notice stating the full size and limit, and the accounting/contract
 lines needed to interpret what remains; the requested limit includes all
 three. The text block is the whole response on every surface.
 
-Persistent indexes live in a per-user, project-keyed cache rather than the analyzed repository. Set `UCN_CACHE_DIR` to override the cache root; CLI `--no-cache` bypasses persistence and `--clear-cache` removes the current project's cache. Legacy `<project>/.ucn-cache` directories are migrated on first use.
+Persistent indexes live in a per-user, project-keyed cache rather than the analyzed repository. Set `UCN_CACHE_DIR` to override the cache root; CLI `--no-cache` bypasses persistence and `--clear-cache` removes the current project's cache. Legacy `<project>/.ucn-cache` directories are migrated on first use. Concurrent invocations on a cold cache share one build: the first process takes a build lock, the others wait for its cache (`Waiting for another ucn process building the index...` on stderr) instead of rebuilding; a lock left by a dead process is broken automatically.
 
 Supported source families are JavaScript/TypeScript/TSX, Python, Go, Rust, Java, C, C++, C#, and HTML inline JavaScript/event handlers. C/C++ uses `compile_commands.json` when available to classify headers and resolve include paths. Recoverable preprocessor branches contribute AST-proven source facts, so a single selected configuration does not silently erase definitions or calls; disagreeing conditional macro identities stay visible as unverified. C++ resolution uses namespace ownership, static overload shape (including arrays), and macro-parameter requalification. C# resolution uses declared property/field receiver types plus overload and hiding discipline. This is portable AST analysis, not a compiler build; macros, templates, generated code, reflection, and external dependency semantics can remain unverified.
 
@@ -161,7 +161,15 @@ Treat `deadcode` as a candidate generator. Before deletion, inspect `usages`, `i
 (JSX children, HTML markup and attributes) in an `OTHER TEXT` section unless
 `--code-only` is set, so it lists every line the `ACCOUNT` counts. This is a
 literal-name inventory, not exact target binding. Identifier boundaries are
-Unicode-aware: `hit` never matches inside `hitΔ`.
+Unicode-aware and match `grep -w`: `hit` never matches inside `hitΔ`, while
+`$` is a boundary (`buy${...}`, `$fail`, `ws$close()` all count).
+
+Aliased and qualified calls resolve in every language: Rust `use m::f as g; g()`
+is a caller of `f` (listed as a beyond-text caller, since the line holds no
+target token); Java `pkg.Type.method()` and C# `Ns.Type.Method()` /
+`using T = Ns.Type; T.Method()` pick the type the qualifier names when several
+same-name types exist. A qualifier the resolver cannot place stays visible as
+`method-ambiguous`, never confirmed by first-definition order.
 
 `endpoints` recognizes client receivers by evidence (a receiver typed to an
 HTTP client class, or bound to a pytest fixture that constructs one), not only

package/cli/index.js

@@ -766,8 +766,18 @@ function runProjectCommand(rootDir, command, arg) {
     // If cache was loaded but stale, force rebuild to avoid duplicates
     let needsCacheSave = false;
     if (!usedCache) {
-        index.build(null, { quiet: flags.quiet, forceRebuild: cacheWasLoaded, followSymlinks: flags.followSymlinks, maxFiles: flags.maxFiles, workers: flags.workers });
-        needsCacheSave = flags.cache;
+        const buildOpts = { quiet: flags.quiet, forceRebuild: cacheWasLoaded, followSymlinks: flags.followSymlinks, maxFiles: flags.maxFiles, workers: flags.workers };
+        if (flags.cache && !flags.maxFiles) {
+            // Cross-process build lock (fix #354): concurrent cold-cache
+            // invocations share one build instead of each rebuilding.
+            index.buildCached(buildOpts, {
+                onWait: () => { if (!flags.quiet) console.error('Waiting for another ucn process building the index...'); },
+            });
+            needsCacheSave = false; // buildCached saved (or loaded the other process's cache)
+        } else {
+            index.build(null, buildOpts);
+            needsCacheSave = flags.cache;
+        }
     }
 
     try {
@@ -986,13 +996,10 @@ function runInteractive(rootDir) {
     if (flags.cache) {
         const loaded = !flags.clearCache && index.loadCache();
         iCacheFresh = loaded && !index.isCacheStale();
-        if (!iCacheFresh && loaded) {
-            index.build(null, { quiet: true, forceRebuild: true, workers: flags.workers });
-        } else if (!iCacheFresh) {
-            index.build(null, { quiet: true, workers: flags.workers });
-        }
         if (!iCacheFresh) {
-            try { index.saveCache(); } catch (_) { /* best-effort */ }
+            index.buildCached({ quiet: true, forceRebuild: !!loaded, workers: flags.workers }, {
+                onWait: () => console.log('Waiting for another ucn process building the index...'),
+            });
         }
     } else {
         index.build(null, { quiet: true, workers: flags.workers });
@@ -1113,15 +1120,19 @@ Flags can be added per-command: show myFunc --sections=source,callers
             // appeared in neighbouring answers (UCN5-044).
             if (index.isCacheStale()) {
                 console.log('Source changed; rebuilding index...');
-                index.build(null, {
+                const rebuildOpts = {
                     quiet: true,
                     forceRebuild: true,
                     followSymlinks: flags.followSymlinks,
                     maxFiles: flags.maxFiles,
                     workers: flags.workers,
-                });
-                if (flags.cache) {
-                    try { index.saveCache(); } catch (_) { /* best-effort */ }
+                };
+                if (flags.cache && !flags.maxFiles) {
+                    index.buildCached(rebuildOpts, {
+                        onWait: () => console.log('Waiting for another ucn process building the index...'),
+                    });
+                } else {
+                    index.build(null, rebuildOpts);
                 }
                 console.log(`Index ready: ${index.files.size} files, ${index.symbols.size} unique symbol names`);
             }

package/core/cache.js

@@ -256,6 +256,14 @@ function pruneUserCache({ force = false, now = Date.now() } = {}) {
             root = data.root || null;
             touched = Math.max(touched, Number(data.timestamp) || 0);
         } catch (_) { /* malformed/incomplete cache expires below */ }
+        // fix #354: a project whose FIRST build is in progress has no
+        // index.json yet, only a live build.lock — another process's prune
+        // must not delete the lock (or the dir) out from under the builder.
+        const lockPath = path.join(dir, BUILD_LOCK_FILE);
+        if (!root && fs.existsSync(lockPath) && !_lockIsStale(lockPath)) {
+            entries.push({ dir, touched: now, bytes: null });
+            continue;
+        }
         if (!root || !fs.existsSync(root) || now - touched > CACHE_TTL_MS) {
             try {
                 fs.rmSync(dir, { recursive: true, force: true });
@@ -699,7 +707,7 @@ function clearAllCaches() {
 // v212 (fix #342): extendsGraph/extendedByGraph no longer persisted (rebuilt on load).
 // v213 (fix #348): Python from-import records carry per-name `renames` so
 // import bindings pair each alias with its own module.
-const CACHE_FORMAT_VERSION = 213;
+const CACHE_FORMAT_VERSION = 214;
 const USAGE_CACHE_FILE = 'usage-results.json';
 
 /**
@@ -1494,7 +1502,101 @@ function _computeReachabilityFingerprint(index) {
     return `${fileCount}:${symbolCount}:${sample}`;
 }
 
+const BUILD_LOCK_FILE = 'build.lock';
+const BUILD_LOCK_STALE_MS = 15 * 60 * 1000;
+const BUILD_LOCK_WAIT_MS = 15 * 60 * 1000;
+const BUILD_LOCK_POLL_MS = 150;
+
+function _sleepSync(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
+function _pidAlive(pid) {
+    if (!Number.isInteger(pid) || pid <= 0) return false;
+    try { process.kill(pid, 0); return true; } catch (e) { return e.code === 'EPERM'; }
+}
+
+function _readLock(lockPath) {
+    try { return JSON.parse(fs.readFileSync(lockPath, 'utf8')); } catch (_) { return null; }
+}
+
+function _lockIsStale(lockPath) {
+    const info = _readLock(lockPath);
+    if (!info) {
+        // Unreadable or half-written: judge by mtime alone
+        try { return Date.now() - fs.statSync(lockPath).mtimeMs > BUILD_LOCK_STALE_MS; } catch (_) { return true; }
+    }
+    if (info.pid && !_pidAlive(info.pid)) return true;
+    return Date.now() - (info.startedAt || 0) > BUILD_LOCK_STALE_MS;
+}
+
+/**
+ * Cross-process build lock (fix #354): N concurrent cold-cache invocations
+ * used to rebuild the whole index N times at once (6 processes on a 474k-line
+ * repo: 9s each alone, 363s each together — the stampede fires after every
+ * version bump, because the bump invalidates every cache). One process takes
+ * the lock and builds; the others wait, then load the cache it saved. A lock
+ * whose holder is dead, or older than 15 minutes, is broken. Waiters give up
+ * after 15 minutes and build themselves (a wedged holder must never make the
+ * tool hang forever).
+ *
+ * @returns {{ built: boolean, waited: boolean }}
+ */
+function buildWithLock(index, buildOpts = {}, options = {}) {
+    const cacheDir = getProjectCacheDir(index.root);
+    const lockPath = path.join(cacheDir, BUILD_LOCK_FILE);
+    fs.mkdirSync(cacheDir, { recursive: true });
+    const deadline = Date.now() + BUILD_LOCK_WAIT_MS;
+    let announced = false;
+    for (;;) {
+        let fd = null;
+        try {
+            fd = fs.openSync(lockPath, 'wx');
+        } catch (e) {
+            if (e.code !== 'EEXIST') throw e;
+        }
+        if (fd !== null) {
+            try {
+                fs.writeSync(fd, JSON.stringify({ pid: process.pid, startedAt: Date.now() }));
+                fs.closeSync(fd);
+                index.build(null, buildOpts);
+                if (options.save !== false) {
+                    try { saveCache(index); } catch (_) { /* best-effort */ }
+                }
+                return { built: true, waited: announced };
+            } finally {
+                try { fs.unlinkSync(lockPath); } catch (_) { /* already gone */ }
+            }
+        }
+        if (_lockIsStale(lockPath)) {
+            try { fs.unlinkSync(lockPath); } catch (_) { /* raced */ }
+            continue;
+        }
+        if (Date.now() > deadline) {
+            index.build(null, buildOpts);
+            if (options.save !== false) {
+                try { saveCache(index); } catch (_) { /* best-effort */ }
+            }
+            return { built: true, waited: true };
+        }
+        if (!announced) {
+            announced = true;
+            if (typeof options.onWait === 'function') options.onWait(_readLock(lockPath));
+        }
+        _sleepSync(BUILD_LOCK_POLL_MS);
+        if (!fs.existsSync(lockPath)) {
+            // The holder finished: its cache is the answer unless it is
+            // already stale again (or it never saved one)
+            if (options.reload !== false && loadCache(index) && !isCacheStale(index)) {
+                return { built: false, waited: true };
+            }
+            // fall through: take the lock ourselves
+        }
+    }
+}
+
 module.exports = {
+    buildWithLock,
     saveCache, saveUsageCache, loadCache, loadCallsCache, isCacheStale, ensureCallsCacheLoaded,
     getUserCacheRoot, getProjectCacheDir, getProjectCachePath,
     getLegacyProjectCacheDir, migrateLegacyProjectCache, clearProjectCache,

package/core/callers.js

@@ -10,7 +10,8 @@ const path = require('path');
 const crypto = require('crypto');
 const { detectLanguage, getParser, getLanguageAdapter, langTraits } = require('../languages');
 const { isTestFile } = require('./discovery');
-const { NON_CALLABLE_TYPES, isOverrideMarked, codeUnitCompare, isTestPath } = require('./shared');
+const { NON_CALLABLE_TYPES, isOverrideMarked, codeUnitCompare, isTestPath, CALLABLE_SYMBOL_KINDS } = require('./shared');
+const { _resolveJavaPackageImport } = require('./graph-build');
 const { scoreEdge, tierForResolution, TIER } = require('./confidence');
 const { findGoModule, resolveRustImport } = require('./imports');
 
@@ -634,6 +635,17 @@ function findCallers(index, name, options = {}) {
                 langTraits(fileEntry.language)?.typeSystem === 'structural';
 
             for (let call of calls) {
+                // fix #353: C# `Beta.Helper.Widget()` — the parser records a
+                // field hop rooted at `this` (Beta is no local). When the
+                // prefix names a project NAMESPACE that declares the last
+                // segment as a type, the receiver is that type, namespace-
+                // qualified; the hop shape would only ever fail the field
+                // walk and route method-ambiguous.
+                if (fileEntry.language === 'csharp') {
+                    const rewritten = _csharpNamespaceQualifiedReceiver(index, call,
+                        index.findEnclosingFunction(filePath, call.line, true));
+                    if (rewritten) call = rewritten;
+                }
                 // Skip if not matching our target name (also check alias resolution)
                 let calledAs = null; // surface name when matched via an import/export rename
                 const typeQualifierReference = targetIsTypeQuery &&
@@ -2808,6 +2820,16 @@ function findCallers(index, name, options = {}) {
                         const paired = nameBindings.filter(b => b.alias === call.name);
                         if (paired.length > 0) nameBindings = paired;
                     }
+                    // Scope-granular import bindings (fix #352): a
+                    // function-local `from x import name` binds the name for
+                    // ITS function only. Three such imports in one file used
+                    // to make three file-level bindings, so a bare call in any
+                    // of the functions scope-matched every pin (investment
+                    // run_validation: 6 defs, each claiming the others'
+                    // sites). The nearest enclosing binder owns the name; a
+                    // binding inside a function that does not enclose the
+                    // call is out of scope (#215 discipline, line-granular).
+                    nameBindings = _scopeImportBindings(fileEntry, nameBindings, call.line);
                     const tFiles = new Set(targetDefs.map(d => d.file).filter(Boolean));
                     // fix #215 (rich-measured: 225 builtin `print(...)` calls
                     // confirmed against rich's def via file-level import edges):
@@ -4075,12 +4097,17 @@ function findCallers(index, name, options = {}) {
                     if (call.isPathCall && receiverName) {
                         receiverName = String(receiverName).split('::').pop();
                     }
+                    let aliasResolvedFile = null;
                     if (receiverName && !tTypes.has(receiverName)) {
                         for (const im of (fileEntry.importBindings || [])) {
                             if (im.name !== receiverName) continue;
-                            const orig = String(im.module || '').split('::').pop();
+                            // fix #353: C# `using BH = Beta.Helper` (and Java
+                            // dotted paths) split on `.`; Rust paths on `::`.
+                            const orig = String(im.module || '').split(/::|\./).pop();
                             if (orig && orig !== receiverName && tTypes.has(orig)) {
                                 receiverName = orig;
+                                const rel = fileEntry.moduleResolved && fileEntry.moduleResolved[im.module];
+                                if (rel) aliasResolvedFile = path.join(index.root, rel);
                                 break;
                             }
                         }
@@ -4108,7 +4135,14 @@ function findCallers(index, name, options = {}) {
                     // name fallback above handles multi-definition names; this
                     // covers single-definition targets that skip it.
                     if (typeQualifiedReceiver) {
-                        const identity = _resolveReceiverTypeIdentity(index, filePath, receiverName, targetDefs2, call.line);
+                        // fix #353: an alias binding that RESOLVED to a file is
+                        // the type's identity (`using BH = Beta.Helper`); a
+                        // parser-recorded qualifier (`beta.Helper`, `Beta.Helper`)
+                        // is a namespace/package hint for the resolver.
+                        const identity = aliasResolvedFile
+                            ? (targetDefs2.some(d => d.file === aliasResolvedFile) ? 'target' : 'other')
+                            : _resolveReceiverTypeIdentity(index, filePath, receiverName, targetDefs2, call.line,
+                                call.receiverIsTypeQualified ? call.receiverTypeQualifier : undefined);
                         if (identity === 'other') {
                             recordExcluded(filePath, call.line, 'path-type-mismatch');
                             continue;
@@ -5344,6 +5378,12 @@ function findCallees(index, definition, options = {}) {
         for (let call of calls) {
             siteOrdinal++;
             const siteId = siteOrdinal;
+            if (language === 'csharp') {
+                // fix #353: `Beta.Helper.Widget()` — namespace-qualified type
+                // receiver (see the findCallers twin).
+                const rewritten = _csharpNamespaceQualifiedReceiver(index, call, def);
+                if (rewritten) call = rewritten;
+            }
             if (language === 'go' && call.isMethod &&
                 !call.receiverType && call.receiverIndexField) {
                 const indexedType = _goIndexedReceiverType(index, def.file, call);
@@ -9853,6 +9893,42 @@ function _projectTopLevelNames(index) {
     return names;
 }
 
+/**
+ * Fix #352: restrict import bindings of a name to those in scope at a call
+ * line. A binding whose import line sits inside a function body is local to
+ * that function (Python function-body imports, JS function-scoped require);
+ * the innermost enclosing binder wins, bindings in non-enclosing functions
+ * are dropped, module-level bindings survive only when no enclosing function
+ * binds the name. Bindings without a line (older records) are kept as-is.
+ */
+function _scopeImportBindings(fileEntry, bindings, callLine) {
+    if (!bindings || bindings.length < 2 || callLine == null) return bindings;
+    if (!bindings.some(b => b.line != null && b.deferred)) return bindings;
+    const scopes = (fileEntry.symbols || []).filter(s =>
+        s.startLine != null && s.endLine != null && s.endLine > s.startLine &&
+        CALLABLE_SYMBOL_KINDS.has(s.type));
+    const innermost = line => {
+        let best = null;
+        for (const s of scopes) {
+            if (line < s.startLine || line > s.endLine) continue;
+            if (!best || (s.endLine - s.startLine) < (best.endLine - best.startLine)) best = s;
+        }
+        return best;
+    };
+    const local = [];
+    const moduleLevel = [];
+    for (const b of bindings) {
+        if (b.line == null) { moduleLevel.push(b); continue; }
+        const scope = innermost(b.line);
+        if (!scope) { moduleLevel.push(b); continue; }
+        if (callLine < scope.startLine || callLine > scope.endLine) continue;
+        local.push({ b, size: scope.endLine - scope.startLine });
+    }
+    if (local.length === 0) return moduleLevel;
+    const nearest = Math.min(...local.map(l => l.size));
+    return local.filter(l => l.size === nearest).map(l => l.b);
+}
+
 /**
  * Is an UNRESOLVED module specifier a resolver gap rather than externality
  * evidence? (fix #337b) Relative specifiers and first segments naming a
@@ -9980,6 +10056,32 @@ function _isGenericParamReceiverType(index, filePath, line, typeName) {
     return _isEnclosingGenericParam(index, filePath, line, typeName);
 }
 
+/**
+ * fix #353: C# namespace-qualified type receivers. `Beta.Helper.Widget()` is
+ * recorded by the parser as a this-rooted field hop (Beta is not a local);
+ * when the dotted prefix names a project namespace (exactly, or relative to
+ * the call's own namespace) that declares the last segment as a type, the
+ * call is a type-qualified static call on that type. Returns a rewritten
+ * record or null (unknown prefixes keep the parser's shape).
+ */
+function _csharpNamespaceQualifiedReceiver(index, call, enclosing) {
+    if (!call.isMethod || call.receiverType || !Array.isArray(call.receiverFields) ||
+        call.receiverFields.length < 2 || call.receiverRoot !== 'this') return null;
+    const typeName = call.receiverFields[call.receiverFields.length - 1];
+    if (!/^[A-Z]/.test(typeName)) return null;
+    const prefix = call.receiverFields.slice(0, -1).join('.');
+    const typeDefs = (index.symbols.get(typeName) || []).filter(d =>
+        IDENTITY_TYPE_KINDS.has(d.type) && d.namespace);
+    if (typeDefs.length === 0) return null;
+    const enclosingNs = enclosing?.namespace || null;
+    const candidates = enclosingNs ? [prefix, `${enclosingNs}.${prefix}`] : [prefix];
+    const ns = candidates.find(c => typeDefs.some(d => d.namespace === c));
+    if (!ns) return null;
+    const { receiverRoot, receiverField, receiverFields, receiverRootType, receiverRootNamespace, ...rest } = call;
+    void receiverRoot; void receiverField; void receiverFields; void receiverRootType; void receiverRootNamespace;
+    return { ...rest, receiver: typeName, receiverIsTypeQualified: true, receiverTypeQualifier: ns };
+}
+
 /**
  * Java same-package check across Maven/Gradle source roots (fix #246):
  * src/main/java/<pkg> and src/test/java/<pkg> hold the SAME package —
@@ -10019,6 +10121,16 @@ function _resolveReceiverTypeIdentity(index, filePath, knownType, targetDefs, li
         // cannot resolve it. That is not exclusion evidence.
         return 'unknown';
     }
+    if (language === 'java' && namespaceHint && /^[a-z_]/.test(namespaceHint)) {
+        // fix #353: a lowercase dotted qualifier is a PACKAGE
+        // (`beta.Helper.widget()`); the package + type name resolve to one
+        // file exactly like an import of `beta.Helper` would. Unresolvable
+        // packages (external, resolver gap) are never exclusion evidence.
+        const resolved = _resolveJavaPackageImport(index, `${namespaceHint}.${knownType}`, null);
+        if (!resolved) return 'unknown';
+        return targetDefs.some(d => d.className === knownType && d.file === resolved)
+            ? 'target' : 'other';
+    }
     if (language === 'java' && line == null) {
         // Return-flow annotations are interpreted in the PRODUCER definition's
         // file. That origin is stronger than same-package lookup and is
@@ -10965,6 +11077,23 @@ function _calleeStructuralBindingRoute(index, fileEntry, call, language, binding
     let sawProjectish = false;
     let sawUnknown = false;
     for (const binding of bindings) {
+        // fix #353 (Rust): `use alpha::widget as renamed; renamed()` — the
+        // binding's module is the ITEM path; the item is its last segment
+        // and the owning module file resolves through the Rust resolver.
+        if (language === 'rust') {
+            const segs = String(binding.module || '').split('::').filter(Boolean);
+            const item = segs[segs.length - 1];
+            const owners = _rustBindingResolvedFiles(index, fileEntry, fileEntry.path, binding);
+            if (item && owners.size > 0) {
+                sawProjectish = true;
+                for (const moduleFile of owners) {
+                    const routed = _calleeExportDefinitions(index, moduleFile, item, language, call, {});
+                    for (const d of routed.matches) matches.set(`${d.file}:${d.startLine}`, d);
+                    if (routed.unknown) sawUnknown = true;
+                }
+                continue;
+            }
+        }
         const rel = fileEntry.moduleResolved && fileEntry.moduleResolved[binding.module];
         if (!rel) {
             if (_unresolvedModuleIsGap(index, binding.module, binding)) {
@@ -11722,6 +11851,42 @@ function _nonCallableFieldMember(index, typeName, name, language) {
  * (#215): the class defined in this file or a file binding of the name —
  * an unbound capitalized receiver may be a parameter or local.
  */
+/**
+ * fix #353: resolve the files that OWN a type-qualified static receiver from
+ * the qualifier in the call (Java package / C# namespace), the file's alias
+ * or name import binding of the receiver, or the caller's own namespace.
+ * Returns a Set of absolute files, or null when nothing pins the owner.
+ */
+function _qualifiedStaticOwnerFiles(index, fileEntry, call, typeName, language, def) {
+    const files = new Set();
+    const typeDefs = (index.symbols.get(typeName) || []).filter(d =>
+        IDENTITY_TYPE_KINDS.has(d.type) && d.file);
+    const qual = call.receiverIsTypeQualified ? call.receiverTypeQualifier : null;
+    if (qual) {
+        if (language === 'java' && /^[a-z_]/.test(qual)) {
+            const resolved = _resolveJavaPackageImport(index, `${qual}.${typeName}`, null);
+            if (resolved) files.add(resolved);
+            return files.size > 0 ? files : null;
+        }
+        if (language === 'csharp') {
+            const enclosingNs = def?.namespace || null;
+            const candidates = enclosingNs ? [qual, `${enclosingNs}.${qual}`] : [qual];
+            for (const d of typeDefs) {
+                if (candidates.includes(d.namespace)) files.add(d.file);
+            }
+            return files.size > 0 ? files : null;
+        }
+    }
+    for (const b of (fileEntry?.importBindings || [])) {
+        const bindsReceiver = b.name === call.receiver || b.alias === call.receiver ||
+            (b.name === typeName && !b.alias);
+        if (!bindsReceiver) continue;
+        const rel = fileEntry.moduleResolved && fileEntry.moduleResolved[b.module];
+        if (rel) files.add(path.join(index.root, rel));
+    }
+    return files.size > 0 ? files : null;
+}
+
 /**
  * Namespace/module-container resolution (fix #254, W8 BUG-4 — verify's
  * BUG-BX rule brought into the engine, range-based): `Utils.slug()` where a
@@ -11835,7 +12000,8 @@ function _calleeTypeQualifiedReceiver(index, def, fileEntry, call, language) {
     if (typeDefs.length === 0) {
         for (const im of (fileEntry?.importBindings || [])) {
             if (im.name !== receiver) continue;
-            const orig = String(im.module || '').split('::').pop();
+            // fix #353: C# `using BH = Beta.Helper` splits on `.`
+            const orig = String(im.module || '').split(/::|\./).pop();
             if (orig && orig !== receiver && typeKindsOf(orig).length > 0) {
                 receiver = orig;
                 typeDefs = typeKindsOf(orig);
@@ -11877,9 +12043,30 @@ function _calleeTypeQualifiedReceiver(index, def, fileEntry, call, language) {
             _normalizedAliasBase(index, d)));
         if (bases.size === 1) candidateTypes.push(bases.values().next().value);
     }
-    const symbols = index.symbols.get(call.name) || [];
+    const allSymbols = index.symbols.get(call.name) || [];
     const isCallable = (s) => !NON_CALLABLE_TYPES.has(s.type) ||
         (s.type === 'field' && s.fieldType && /^func\b/.test(s.fieldType));
+    // fix #353: the qualifier that is right there in the call owns the type —
+    // `beta.Helper.widget()` (package), `Beta.Helper.Widget()` (namespace),
+    // `using BH = Beta.Helper; BH.Widget()` (alias binding), `import
+    // beta.Helper;` (name binding). Same-name types in other packages/
+    // namespaces leave the candidate set BEFORE member-group construction
+    // (the group dedupes identical signatures, so the first same-name type
+    // used to swallow the second). An unresolvable qualifier keeps them all.
+    const ownerFiles = (language === 'java' || language === 'csharp')
+        ? _qualifiedStaticOwnerFiles(index, fileEntry, call, receiver, language, def)
+        : null;
+    // A package qualifier the resolver cannot place (`org.external.Helper`)
+    // over a project type of the same name: unpinnable — visible, never
+    // confirmed by first-definition selection (#206 discipline).
+    if (language === 'java' && call.receiverIsTypeQualified &&
+        call.receiverTypeQualifier && /^[a-z_]/.test(call.receiverTypeQualifier) &&
+        !ownerFiles) {
+        return { unverified: 'method-ambiguous' };
+    }
+    const symbols = ownerFiles
+        ? allSymbols.filter(s => !candidateTypes.includes(s.className) || ownerFiles.has(s.file))
+        : allSymbols;
     if (language === 'java' || language === 'csharp') {
         // Class-qualified Java/C# calls see the compiler member group on the
         // qualifier. The helper handles inherited slots and C# name hiding.

package/core/project.js

@@ -1946,7 +1946,7 @@ class ProjectIndex {
      * the usage scan saw (and may have deliberately dropped), as opposed to
      * JSX children, HTML markup, or other non-code text (fix #350).
      */
-    isIdentifierAtPosition(content, lineNum, column, filePath) {
+    isIdentifierAtPosition(content, lineNum, column, filePath, name) {
         const language = detectLanguage(filePath, this.root);
         if (!language) return false;
         try {
@@ -1954,7 +1954,12 @@ class ProjectIndex {
                 safeParse(getParser(language), content);
             if (!tree) return false;
             const node = tree.rootNode.descendantForPosition({ row: lineNum - 1, column });
-            return !!node && /identifier|^name$|^word$/.test(node.type);
+            if (!node || !/identifier|^name$|^word$/.test(node.type)) return false;
+            // fix #352: the identifier node must BE the name — a hyphenated JSX
+            // attribute (`data-cell-state`) is one property_identifier whose
+            // text merely contains `cell`; the ACCOUNT counts that line as
+            // other-text, so usages must list it (the #350 equality).
+            return node.text === name;
         } catch (e) {
             return false;
         }
@@ -2524,6 +2529,15 @@ class ProjectIndex {
     saveCache(cachePath) { return indexCache.saveCache(this, cachePath); }
 
     /** Load index from cache file */
+    /**
+     * Build under the cross-process build lock (fix #354) and save the cache.
+     * Returns { built, waited }; when another process built meanwhile and its
+     * cache is fresh, that cache is loaded instead of rebuilding.
+     */
+    buildCached(buildOpts = {}, options = {}) {
+        return indexCache.buildWithLock(this, buildOpts, options);
+    }
+
     loadCache(cachePath) { return indexCache.loadCache(this, cachePath); }
 
     /** Persist the bounded, content-hash-keyed usage-query cache. */

package/core/search.js

@@ -84,7 +84,7 @@ function appendTextComplements(index, {
         // the AST scan classified and then deliberately dropped (Rust enum
         // variants against a struct pin, #234) is code, not text: skip it.
         if (!commentOrString &&
-            index.isIdentifierAtPosition(content, lineNum, match.index, filePath)) continue;
+            index.isIdentifierAtPosition(content, lineNum, match.index, filePath, name)) continue;
         const usage = {
             file: filePath,
             relativePath: fileEntry.relativePath,

package/core/shared.js

@@ -126,7 +126,7 @@ function addTestExclusions(exclude) {
  */
 function literalNameRegex(name, flags = '') {
     return new RegExp(
-        `(?<![\\p{L}\\p{N}_$])${escapeRegExp(name)}(?![\\p{L}\\p{N}_$])`,
+        `(?<![\\p{L}\\p{N}_])${escapeRegExp(name)}(?![\\p{L}\\p{N}_])`,
         flags.includes('u') ? flags : flags + 'u');
 }
 

package/languages/java.js

@@ -1502,14 +1502,34 @@ function findCallsInCode(code, parser) {
                     const valueNode = receiverNode.childForFieldName('value');
                     if (valueNode?.type === 'identifier') castReceiverName = valueNode.text;
                 }
-                const receiver = castReceiverName ||
+                let receiver = castReceiverName ||
                     ((receiverNode?.type === 'identifier' || receiverNode?.type === 'this')
                         ? receiverNode.text : undefined);
+                // fix #353: `beta.Helper.widget()` — a lowercase dotted root
+                // under a capitalized member is a PACKAGE-qualified type
+                // (Java packages are lowercase by convention, types
+                // capitalized); the receiver is the type and the package is
+                // its qualifier, so same-name static methods in two packages
+                // resolve by the qualifier that is right there in the call.
+                let packageQualifier;
+                if (!receiver && receiverNode?.type === 'field_access') {
+                    const rootNode = receiverNode.childForFieldName('object');
+                    const fldNode = receiverNode.childForFieldName('field');
+                    const rootText = rootNode?.text || '';
+                    const rootHead = rootText.split('.')[0];
+                    if (fldNode?.type === 'identifier' && /^[A-Z]/.test(fldNode.text) &&
+                        /^[a-z_][\w]*(\.[a-z_][\w]*)*$/.test(rootText) &&
+                        !getReceiverType(rootHead) && !isDeclaredLocal(rootHead) &&
+                        !hasEnclosingField(node, rootHead)) {
+                        receiver = fldNode.text;
+                        packageQualifier = rootText;
+                    }
+                }
                 const receiverType = castReceiverType ||
                     ((receiver && receiver !== 'this') ? getReceiverType(receiver) : undefined);
-                const receiverTypeQualifier = !castReceiverType && receiver
-                    ? getReceiverTypeQualifier(receiver) : undefined;
-                const receiverIsTypeQualified = !!(receiverNode?.type === 'identifier' &&
+                const receiverTypeQualifier = packageQualifier ||
+                    (!castReceiverType && receiver ? getReceiverTypeQualifier(receiver) : undefined);
+                const receiverIsTypeQualified = !!((receiverNode?.type === 'identifier' || packageQualifier) &&
                     receiver && /^[A-Z]/.test(receiver) && !receiverType &&
                     !isDeclaredLocal(receiver) && !hasEnclosingField(node, receiver));
                 // fix #202: one-hop declared-field receivers —

package/languages/rust.js

@@ -3152,6 +3152,14 @@ function findImportsInCode(code, parser) {
             if (pathNode && aliasNode) {
                 addLeaf(joinUsePath(prefix, pathNode.text), aliasNode.text,
                     'use', false, line);
+                // fix #353: `use alpha::widget as renamed; renamed()` — the
+                // alias pairing feeds findCallers' import-rename surface
+                // (calledAs), exactly like Python/JS `import x as y`.
+                const original = String(pathNode.text).split('::').pop();
+                if (original && original !== aliasNode.text && original !== 'self') {
+                    if (!imports.aliases) imports.aliases = [];
+                    imports.aliases.push({ original, local: aliasNode.text });
+                }
             }
             return;
         }

package/mcp/server.js

@@ -71,8 +71,13 @@ function getIndex(projectDir, options) {
         // Disk cache is fresh (skip when maxFiles is set — cached index may have different file count)
     } else {
         buildOpts.forceRebuild = !!loaded;
-        index.build(null, buildOpts);
-        if (!maxFiles) index.saveCache(); // Don't pollute disk cache with partial indexes
+        if (maxFiles) {
+            index.build(null, buildOpts); // Don't pollute disk cache with partial indexes
+        } else {
+            // Cross-process build lock (fix #354): a CLI or another MCP
+            // server building the same repo at the same moment shares one build
+            index.buildCached(buildOpts);
+        }
     }
 
     // LRU eviction

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ucn",
-  "version": "5.3.2",
+  "version": "5.3.4",
   "mcpName": "io.github.mleoca/ucn",
   "description": "Auditable AST code intelligence for AI agents: 18 task-oriented commands through one MCP tool, CLI, or agent skill. Supports JS/TS, Python, Go, Rust, Java, C, C++, C#, and HTML.",
   "main": "index.js",