graphite-code 0.4.0__tar.gz → 0.5.1__tar.gz

{graphite_code-0.4.0 → graphite_code-0.5.1}/CHANGELOG.md

@@ -12,6 +12,140 @@ machine-checkable identity; the version is for humans.
 
 [Keep a Changelog]: https://keepachangelog.com/en/1.1.0/
 
+## [0.5.1] — 2026-08-27
+
+### Fixed
+
+**A reader holding the graph open made the writer fail on Windows** (#59).
+`MoveFileEx` cannot replace a file another handle holds open without
+`FILE_SHARE_DELETE`, and neither `open()` nor `os.open()` grants that share
+mode — so graphite's own readers (`graph_io`, the MCP server, a hook running
+`query`) made `atomic_write_text`'s single `os.replace` raise `WinError 5` for
+the length of a read. Three occurrences in 1,585 daemon builds; the daemon
+masked each by rebuilding next cycle, while a hook- or agent-driven `build`
+exited 1 and left the previous graph in place. The rename is now retried with
+bounded backoff (2 s) on Windows only — on POSIX an EACCES from rename is the
+directory's permissions, which no wait changes. Reproduced by a test that holds
+the target open in a thread: red on the old writer, green now.
+
+The writer's cleanup path could also **mask the error that mattered**: a temp
+file held by an indexer made `unlink` raise inside `finally: raise`, so the one
+`WinError 32` in the log named only the temp file and nothing else. Cleanup
+failures are now suppressed and the original error propagates.
+
+The same retry now backs every temp-file-then-rename writer in graphite, not
+only the graph's: `activation._atomic_write` (the marker every hook refreshes
+and the daemon reads each discovery cycle — a lost refresh was silent, because
+`mark_active` is fail-open) and `overlays._atomic_write_secure`, through one
+public `io.replace_file`. Neither had been observed failing; both had the
+same single `os.replace`.
+
+## [0.5.0] — 2026-08-26
+
+### Fixed
+
+**Distinct definitions collapsed into one node id** (#57, #58). Two independent
+mechanisms, one silent symptom: the losing definition vanished from the graph
+entirely, every edge naming either landed on whichever survived, and nothing in
+the answer signalled it — a contaminated `callers` list grades exactly like a
+clean one, and an empty one for the vanished name reads as a trustworthy absence.
+
+`_make_id` had **five** lossy operations — `strip("_.")` per part, `[^\w]+ -> _`,
+`_+ -> _`, `casefold()` and truncation — so within one file `Path`, `path` and
+`_path` were one id. Measured on this repo: **5 collisions, 6 definitions absent**.
+`routing/storage.py` defines `initialize` (L950) and `_initialize` (L3965); the
+graph kept `initialize`, and `self._initialize()` was recorded as a call to it.
+
+Removing a normalisation does not fix this, which is worth knowing before trying:
+drop the strip and `path`/`_path` are *still* merged, because the `_+` collapse
+puts them back; drop both and `path`/`Path` remain merged by the casefold. An
+ambiguous input now gets a short **hex** discriminator — the one alphabet that
+survives both. A canonical input keeps its plain, readable id.
+
+`_file_node_id` built its id from `path.stem`, **discarding the extension**, so
+`index.ts` and `index.js`, or a component and its stylesheet, were one node — the
+shape that most affects the TypeScript consumers. It also inherited the
+sanitisation collisions: `src/graphite/init.py` (791 lines) and
+`src/graphite/__init__.py` (41) were one node, so the larger module had no file
+node at all and its 21 symbols hung off the smaller one. Both are fixed; file ids
+now carry the full filename.
+
+**Every node id in the graph changes.** Consumers re-extract on the engine
+fingerprint anyway, so the rebuild costs nothing extra — but any node id written
+down in a document or a script must be re-read from the new graph. Both
+docstrings on `_file_node_id` claimed the old scheme kept every file distinct;
+both were false and are rewritten rather than appended to.
+
+Known residual, measured at zero occurrences here: a path separator and a literal
+underscore are still indistinguishable, so `a/b.py` and `a_b.py` would collide.
+Closing it would mean discriminating every path containing an underscore.
+
+
+**Method dispatch overruled the call classifier, in every language** (#56).
+`_call_confidence` tags an edge `EXTERNAL_CALL` only when the call *provably*
+leaves the repo — an attributable receiver root bound by an import that did not
+resolve in-repo, or an `_EXTERNAL_GLOBALS` name no in-repo binding shadows.
+`_resolve_method_dispatch` then re-pointed that same edge to an in-repo definition
+by bare method name alone, producing an edge whose `confidence` said the call left
+the repo and whose `target` was a function inside it.
+
+The #54 reachability gate cannot catch these: the import that makes the definition
+"reachable" is real and irrelevant, because the receiver is `os`. Externality is
+evidence that gate never consults.
+
+Measured on this repo, two builds through one interpreter differing only in this
+pass: **42 `calls` edges removed, every one `EXTERNAL_CALL`, none `LOCAL_CALL`.**
+Every removed edge read at its source line is a standard-library call —
+`os.close`/`os.open`/`os.write`/`os.kill` (24), `subprocess.run` (8),
+`threading.Event` (4), Node's `path.resolve` (2), `sys.stdin.read` (1).
+`os.kill(pid, 0)` in one test was bound to **three** different in-repo `kill`s.
+
+    callers resolve   5 decision_grade → 3 decision_grade
+    callers kill      4 decision_grade → 1 decision_grade
+    callers event     6 decision_grade → 2 decision_grade
+    callers run       3 decision_grade → 0 ADVISORY
+
+The last line is the honest-answer contract working: the answer is now empty *and
+says so*, rather than confidently naming three wrong callers.
+
+It is a **refusal to re-point, not a deletion**. The edge stays where it already
+pointed, so `health.py` can go on excluding it from the resolution denominator —
+it can only exclude what is present. **The ratio therefore does not move**
+(`calls.python` 0.977 → 0.977, total 9427 → 9387, external 3044 → 3076): under
+schema 3 these edges were already excluded as external, so the fix shifts them
+from `total` to `external` in the same step. Grading this on health would have
+read as "no effect" — the trap #54's first acceptance criterion fell into,
+arriving from the other direction.
+
+**Dispatch could cross a language boundary** (#56). No FFI is modelled, so a
+JavaScript call site cannot reach a Python `def` — but the name match ran across
+the whole node set with no notion of language, and did:
+`path.resolve(input.root)` in `src/graphite/ts_resolver.mjs` bound to a `resolve`
+defined in `tests/test_git_security.py`, at `decision_grade`. Dispatch is now
+confined to one interop **family** (`javascript`/`typescript`/`jsx`/`tsx` together;
+every other language its own), never to the raw `LANGUAGE_BY_EXT` label — `.ts`
+and `.tsx` are different labels and one ecosystem. Unlike the #54 gate this is an
+exact invariant rather than a proxy, so it needs no per-language census: it removes
+only bindings that are impossible. **Zero marginal effect on this repo** — both
+crossings here were also `EXTERNAL_CALL` and already gone — which is why its
+fixture makes the crossing a `LOCAL_CALL`.
+
+**A Rust call on an unnameable receiver was a false external** (#56).
+`_simple_rust_value` returns `None` for anything but an identifier or `self`, so
+`build().format()` reached `_call_confidence` as the bare name `format`, which is
+in `_EXTERNAL_GLOBALS`. The Rust site passed no `attributable=`, so the edge came
+out `EXTERNAL_CALL` — excused from the health denominator without ever being shown
+to leave the repo. That is #14 mechanism A, which Python and TS/JS were threaded
+for and Rust was not. Go is deliberately unchanged: its `selector_expression`
+branch builds the call name from the operand's raw source text, so nothing here
+reaches its bare-name fallback, and a guard nothing can trip is not a guard.
+
+### Still open
+
+The #54 reachability gate remains Python-only. That is a separate, weaker
+question — bindings that are *possible but unlikely* in duck-typed code — and it
+still owes the per-language measurement `_dispatch_is_gated` describes.
+
 ## [0.4.0] — 2026-08-14
 
 **A minor bump because consumer graphs change, not because an API did.** Both fixes

{graphite_code-0.4.0 → graphite_code-0.5.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: graphite-code
-Version: 0.4.0
+Version: 0.5.1
 Summary: Local-first, zero-LLM knowledge graph extraction for codebases.
 Project-URL: Homepage, https://github.com/jared0565/graphite
 Project-URL: Repository, https://github.com/jared0565/graphite

{graphite_code-0.4.0 → graphite_code-0.5.1}/src/graphite/__init__.py

@@ -1,41 +1,41 @@
-"""Graphite — local-first, zero-LLM knowledge graph extraction.
-
-**The supported surface is the CLI, the MCP server, and the published JSON
-schemas — not this package's Python API.**
-
-That is a deliberate boundary, not an omission. `docs/agent-integration.md` is
-the consumer contract and every example in it is `graphite <command> --json`;
-the payload shapes are pinned in `docs/schemas/` and held in lockstep with live
-output by tests. Nothing documented asks a consumer to import anything from
-here, so `__all__` stays at the one name that is genuinely public.
-
-Importing internals (`graphite.query`, `graphite.routing.*`, …) is therefore
-supported by nobody: those move without notice, and an editable install means
-they move the moment a file is saved.
-
-The other half of the surface is a set of MODULE PATHS rather than objects.
-`graphite.mcp` is written into every onboarded repo's `.mcp.json` and
-`graphite.hook_entry` into its `.githooks/` trampolines, so renaming either
-breaks consumers that will never see the change — and because those artifacts
-are already on disk, fixing the generator afterwards does not repair them. They
-are pinned by `tests/test_public_surface.py` for that reason.
-"""
-from __future__ import annotations
-
-#: The only object this package promises. See the module docstring for why.
-__all__ = ["__version__"]
-
-#: THE version. `pyproject.toml` reads this file rather than the other way
-#: round (`[tool.hatch.version]`), so there is exactly one place to set it.
-#:
-#: Through 0.2.1 this was doubly load-bearing: every consumer on this machine
-#: ran graphite from one shared editable install, so the source tree WAS the
-#: deployment and a saved file was live everywhere with no build and no
-#: boundary. 0.3.0 is the first version consumers install as a built wheel, so
-#: this string and the installed metadata are now set together by a release
-#: rather than drifting apart between them.
-#:
-#: Coarse and hand-maintained by construction. It is a release label, not
-#: evidence that a given fix is present -- to answer that, survey for the marker
-#: the fix introduced, or compare `graphite --version` fingerprints.
-__version__ = "0.4.0"
+"""Graphite — local-first, zero-LLM knowledge graph extraction.
+
+**The supported surface is the CLI, the MCP server, and the published JSON
+schemas — not this package's Python API.**
+
+That is a deliberate boundary, not an omission. `docs/agent-integration.md` is
+the consumer contract and every example in it is `graphite <command> --json`;
+the payload shapes are pinned in `docs/schemas/` and held in lockstep with live
+output by tests. Nothing documented asks a consumer to import anything from
+here, so `__all__` stays at the one name that is genuinely public.
+
+Importing internals (`graphite.query`, `graphite.routing.*`, …) is therefore
+supported by nobody: those move without notice, and an editable install means
+they move the moment a file is saved.
+
+The other half of the surface is a set of MODULE PATHS rather than objects.
+`graphite.mcp` is written into every onboarded repo's `.mcp.json` and
+`graphite.hook_entry` into its `.githooks/` trampolines, so renaming either
+breaks consumers that will never see the change — and because those artifacts
+are already on disk, fixing the generator afterwards does not repair them. They
+are pinned by `tests/test_public_surface.py` for that reason.
+"""
+from __future__ import annotations
+
+#: The only object this package promises. See the module docstring for why.
+__all__ = ["__version__"]
+
+#: THE version. `pyproject.toml` reads this file rather than the other way
+#: round (`[tool.hatch.version]`), so there is exactly one place to set it.
+#:
+#: Through 0.2.1 this was doubly load-bearing: every consumer on this machine
+#: ran graphite from one shared editable install, so the source tree WAS the
+#: deployment and a saved file was live everywhere with no build and no
+#: boundary. 0.3.0 is the first version consumers install as a built wheel, so
+#: this string and the installed metadata are now set together by a release
+#: rather than drifting apart between them.
+#:
+#: Coarse and hand-maintained by construction. It is a release label, not
+#: evidence that a given fix is present -- to answer that, survey for the marker
+#: the fix introduced, or compare `graphite --version` fingerprints.
+__version__ = "0.5.1"

{graphite_code-0.4.0 → graphite_code-0.5.1}/src/graphite/activation.py

@@ -21,6 +21,8 @@ from dataclasses import dataclass
 from pathlib import Path
 from typing import Any
 
+from .io import replace_file
+
 ACTIVATION_TTL_SECONDS: float = 3600.0
 ENV_STATE_DIR = "GRAPHITE_STATE_DIR"
 ENV_DAEMON_CHILD = "GRAPHITE_DAEMON_CHILD"
@@ -148,7 +150,7 @@ def _atomic_write(path: Path, payload: dict[str, Any]) -> None:
     try:
         with os.fdopen(handle, "w", encoding="utf-8") as fh:
             json.dump(payload, fh)
-        os.replace(tmp, path)
+        replace_file(tmp, path)
     except Exception:
         try:
             tmp.unlink(missing_ok=True)

{graphite_code-0.4.0 → graphite_code-0.5.1}/src/graphite/extract/ast.py

@@ -1,13 +1,14 @@
 """Deterministic structural extraction via tree-sitter."""
 from __future__ import annotations
 
+import hashlib
 import importlib
 import re
 import sys
 import unicodedata
 from dataclasses import dataclass, field
 from pathlib import Path
-from typing import Any, Collection, Final
+from typing import Any, Collection, Final, Sequence
 
 from ..cache import Cache
 from ..config import Config
@@ -153,28 +154,100 @@ _RESOLVER_LANGUAGES: Final = frozenset({"python", "javascript", "typescript", "t
 _MAX_ID_LEN = 120
 
 
+#: Length, in hex characters, of the ambiguity discriminator appended by
+#: `_make_id`. Hex is the only alphabet that survives BOTH normalisations that
+#: caused #57: `_+ -> _` cannot collapse it (it holds no underscores) and
+#: `casefold()` cannot flatten it (it holds no case). A marker built from
+#: anything else would be eaten by the very code it exists to defeat.
+_ID_DISCRIMINATOR_LEN: Final = 6
+
+
+def _identity_preserving_form(parts: Sequence[str]) -> str:
+    """The id these parts would produce if the only loss were separator identity.
+
+    Applies `[^\\w] -> _` one character at a time — deliberately NOT per run, so
+    `a.b` and `a..b` stay distinct here even though the real pipeline collapses
+    both. Everything else the sanitiser does is skipped.
+
+    Comparing the real id against this answers the only question that matters:
+    did the sanitiser throw away something that distinguished this input from a
+    different one? If it did, the id is ambiguous and needs a discriminator.
+    """
+    return "_".join(
+        re.sub(r"[^\w]", "_", unicodedata.normalize("NFKC", p), flags=re.UNICODE)
+        for p in parts
+    )
+
+
 def _make_id(*parts: str) -> str:
-    combined = "_".join(p.strip("_.") for p in parts if p)
-    combined = unicodedata.normalize("NFKC", combined)
+    """Node id for a file or a symbol, ambiguous inputs discriminated (#57).
+
+    The sanitiser has FIVE lossy operations — `strip("_.")` per part,
+    `[^\\w]+ -> _`, `_+ -> _`, `casefold()` and truncation — and each of them
+    merged real definitions. Measured on this repo before the fix: 5 same-file
+    collisions and 6 definitions absent from the graph, including
+    `routing/storage.py`'s `initialize` (L950) swallowing `_initialize` (L3965),
+    so `self._initialize()` was recorded as a call to an unrelated method.
+
+    Removing a normalisation does not fix this, which is worth knowing before
+    trying: drop the strip and `path`/`_path` are STILL merged, because the
+    `_+` collapse two lines down puts them back together; drop both and
+    `path`/`Path` remain merged by the casefold. Only an appended discriminator
+    works, and only one made of hex.
+
+    A canonical input keeps its plain, readable id — the discriminator is for
+    ambiguity, not decoration, and hashing everything would cost a far larger
+    migration for no extra correctness.
+
+    Known residual: two DIFFERENT part tuples can still produce one id when the
+    only difference is a separator versus a literal underscore — `a/b.py` and
+    `a_b.py` both reach `a_b_py`, and both are ambiguity-free by this test.
+    Closing it would mean discriminating every path containing an underscore,
+    which is most of `tests/`. Measured occurrences in this repo: zero.
+    """
+    kept = [p for p in parts if p]
+    combined = unicodedata.normalize("NFKC", "_".join(p.strip("_.") for p in kept))
     cleaned = re.sub(r"[^\w]+", "_", combined, flags=re.UNICODE)
     cleaned = re.sub(r"_+", "_", cleaned)
     cleaned = cleaned.strip("_").casefold()
-    if len(cleaned) > _MAX_ID_LEN:
-        cleaned = cleaned[:_MAX_ID_LEN]
-    return cleaned
+    if cleaned == _identity_preserving_form(kept) and len(cleaned) <= _MAX_ID_LEN:
+        return cleaned
+    # Hashed over the exact input with a separator no name can contain, so the
+    # marker distinguishes ("a_b", "c") from ("a", "b_c") even though both
+    # sanitise alike.
+    marker = hashlib.blake2s(
+        "\x00".join(kept).encode("utf-8"), digest_size=_ID_DISCRIMINATOR_LEN // 2
+    ).hexdigest()
+    return f"{cleaned[: _MAX_ID_LEN - len(marker) - 1].rstrip('_')}_{marker}"
 
 
 def _file_node_id(rel_path: str) -> str:
-    """Stable node id for a file: a slug of the FULL repo-relative path.
-
-    Using only the parent dir + stem (the pre-v4 scheme) silently merged any
-    two files sharing that tail — a monorepo with `apps/worker/src/db/queries.ts`
-    and `apps/workers/booking/src/db/queries.ts` got ONE `db_queries` node and
-    every symbol in both files collided. Full-path ids keep every file (and
-    therefore every symbol id derived from the file id) distinct.
+    """Stable node id for a file: a slug of the FULL repo-relative path AND name.
+
+    Two claims this docstring used to make were false, and both were disproved
+    on graphite's own source rather than in theory.
+
+    It said full-path ids "keep every file distinct". They did not. `ARAMID.md`
+    and `aramid.toml` both reached `aramid` (case), and `src/graphite/init.py`
+    and `src/graphite/__init__.py` both reached `src_graphite_init` (underscore
+    strip plus collapse) — so a 791-line module had NO file node of its own and
+    its 21 symbols hung off a 41-line `__init__.py`. `_make_id`'s discriminator
+    is what fixes that half.
+
+    It also built the id from `path.stem`, silently DISCARDING the extension, so
+    `index.ts` and `index.js`, or `Button.tsx` and its `Button.css`, were one
+    node (#58). That is not a sanitisation loss and no discriminator could fix
+    it — the two inputs were already identical by the time `_make_id` saw them.
+    The extension is part of a file's identity and is now kept.
+
+    The original reason for full-path ids stands: parent-dir + stem merged any
+    two files sharing that tail, so a monorepo with `apps/worker/src/db/queries.ts`
+    and `apps/workers/booking/src/db/queries.ts` got ONE `db_queries` node.
     """
     path = Path(rel_path)
-    parts = [*path.parts[:-1], path.stem]
+    # `path.parts` already ends in the full filename; the old scheme replaced
+    # that last element with `path.stem` and lost the suffix with it.
+    parts = list(path.parts)
     return _make_id(".".join(p for p in parts if p not in (".", "")))
 
 
@@ -1675,9 +1748,17 @@ def _extract_rust(
             if func is not None:
                 called: str | None
                 member: str | None = None
+                # False when `called` degrades to the bare method name because the
+                # receiver could not be named -- `build().format()`, `(a + b).test()`.
+                # Such a name says nothing about where the call goes, so classifying
+                # it against _EXTERNAL_GLOBALS produces a false external (#14
+                # mechanism A, threaded for Python at :1414 and TS/JS at :474 and
+                # missed here until #56).
+                attributable = True
                 if func.type == "field_expression":
                     value = _simple_rust_value(func.child_by_field_name("value"), _text)
                     field = _text(func.child_by_field_name("field"))
+                    attributable = bool(value and field)
                     called = _short_name(f"{value}.{field}" if value and field else field)
                     member = field
                 elif func.type == "scoped_identifier":
@@ -1691,7 +1772,10 @@ def _extract_rust(
                 else:
                     called = _call_target_name(func, source)
                 if called and called not in _LANGUAGE_BUILTIN_GLOBALS and should_keep_call_target(called):
-                    edge = _edge(scope_id, _resolve_call(file_id, called), "calls", rel_path, _line(node), confidence=_call_confidence(called))
+                    edge = _edge(
+                        scope_id, _resolve_call(file_id, called), "calls", rel_path, _line(node),
+                        confidence=_call_confidence(called, attributable=attributable),
+                    )
                     if member:
                         edge["_member"] = member
                     result.edges.append(edge)
@@ -1887,10 +1971,58 @@ _MAX_METHOD_DISPATCH_CANDIDATES = 3
 # whose imports bind to a file node".
 _DISPATCH_GATED_LANGUAGES = frozenset({"python"})
 
+# Languages that share one runtime and can therefore hold one another's objects.
+# Dispatch may cross freely INSIDE a family and never BETWEEN two of them.
+#
+# Only entries that MERGE distinct `LANGUAGE_BY_EXT` labels belong here; anything
+# absent is its own family (see `_interop_family`), so a new extractor is isolated
+# by default rather than silently pooled with an existing ecosystem.
+_INTEROP_FAMILY_BY_LANGUAGE: Final = {
+    "javascript": "ecmascript",
+    "typescript": "ecmascript",
+    "jsx": "ecmascript",
+    "tsx": "ecmascript",
+}
+
+
+def _interop_family(source_file: str | None) -> str | None:
+    """Which call-compatible ecosystem this file belongs to, or None if unknown.
+
+    An EXACT invariant, unlike the reachability proxy in `_dispatch_is_gated`:
+    graphite models no FFI, so a JavaScript call site cannot reach a Python `def`
+    under any typing discipline. That is why this gate needs no per-language
+    measurement before being applied everywhere -- it removes only bindings that
+    are impossible, never ones that are merely unlikely.
+
+    Scoped to a FAMILY rather than to the raw language label because
+    `LANGUAGE_BY_EXT` maps `.ts -> typescript` and `.tsx -> tsx`: a plain label
+    comparison would delete every call from a `.ts` module into a `.tsx`
+    component, which is ordinary code in every React repo graphite is pointed at.
+
+    Resolved through `LANGUAGE_BY_EXT` for the same reason `_dispatch_is_gated` is
+    -- a private suffix list would agree with the extractor only by coincidence.
+
+    FAILS OPEN on `None`: a file whose extension the extractor does not classify
+    has no family, and dispatch from or to it is left exactly as it was.
+    """
+    if not source_file:
+        return None
+    language = LANGUAGE_BY_EXT.get(Path(source_file).suffix.casefold())
+    if language is None:
+        return None
+    return _INTEROP_FAMILY_BY_LANGUAGE.get(language, language)
+
 
 def _dispatch_is_gated(source_file: str | None) -> bool:
     """Whether method dispatch from this file is restricted to reachable definitions.
 
+    ONE OF THREE FILTERS, and the only optional one. Do not read "not gated here"
+    as "dispatch from this file is unconstrained": the evidence gate (never
+    re-point a proven-EXTERNAL_CALL) and the interop-family gate (never re-point
+    across `_interop_family`) both apply in EVERY language, gated or not. They are
+    exact -- an externality proof and a "no FFI is modelled" invariant -- so they
+    needed no per-language measurement. This one is a proxy, which is why it does.
+
     Resolved through `LANGUAGE_BY_EXT` -- the same table `collect_files` uses to pick
     an extractor -- so the gate cannot disagree with the walk that produced the edge.
     A private suffix list here would agree with that table only by coincidence: `.py`
@@ -1908,12 +2040,14 @@ def _dispatch_is_gated(source_file: str | None) -> bool:
     every sampled member was a false binding, and added back ~350 real ones that the
     ambiguity cap had been abandoning.
 
-    TypeScript/JavaScript are NOT gated, on evidence rather than caution.
-    `test_member_call_ambiguous_small_set_links_to_all` pins the documented
+    TypeScript/JavaScript are NOT gated BY THIS FILTER, on evidence rather than
+    caution. `test_member_call_ambiguous_small_set_links_to_all` pins the documented
     small-ambiguous-set fan-out using `x: any` and no import at all -- a shape that
     is idiomatic in TS and that this gate would delete. Rust is ungated for the
     duller reason that this repo contains none, so nothing here could measure it.
     Extending the allowlist is a per-language measurement, not a one-line edit.
+    (The two exact filters above still constrain TS/JS dispatch -- #56 removed a
+    `.mjs` call bound to a Python `def` without any help from this gate.)
 
     Go could not be gated even with evidence: its in-repo imports target a
     synthesized PACKAGE id (`example_com_repo_store`) that never equals the file
@@ -1963,6 +2097,10 @@ def _resolve_method_dispatch(
     file_of_node: dict[str, str] = {
         n["id"]: _file_node_id(n["source_file"]) for n in nodes if n.get("source_file")
     }
+    # Which interop family each definition belongs to, for the family gate below.
+    family_of_node: dict[str, str | None] = {
+        n["id"]: _interop_family(n["source_file"]) for n in nodes if n.get("source_file")
+    }
     imports_by_file: dict[str, set[str]] = {}
     for e in edges:
         if e.get("relation") == "imports" and e.get("source") and e.get("target"):
@@ -1983,7 +2121,43 @@ def _resolve_method_dispatch(
         if not method or e.get("relation") != "calls":
             out.append(e)
             continue
-        candidates = methods_by_name.get(method.casefold())
+        # Evidence gate (#56), applied BEFORE the name lookup and in every language.
+        # `_call_confidence` tags EXTERNAL_CALL only when the call PROVABLY leaves
+        # the repo: an attributable receiver root bound by an import that did not
+        # resolve in-repo, or an `_EXTERNAL_GLOBALS` name no in-repo binding shadows.
+        # An unnameable receiver returns LOCAL_CALL precisely so a bare method name
+        # can never be classified external (#14 mechanism A). Re-pointing such an
+        # edge by bare method name overrules evidence with a guess -- and did, 52
+        # times on graphite's own graph: `os.close(fd)` bound to an in-repo `close`,
+        # `sys.stdin.read()` to `cache.py::read`, `os.kill(pid, 0)` to three
+        # different in-repo `kill`s, `path.resolve()` in a .mjs file to a `resolve`
+        # defined in a PYTHON test.
+        #
+        # The #54 gate below cannot catch these: the import that makes the
+        # definition "reachable" is real and irrelevant, because the receiver is
+        # `os`. Externality is evidence that gate never consults.
+        if e.get("confidence") == "EXTERNAL_CALL":
+            candidates: set[str] | None = None
+        else:
+            candidates = methods_by_name.get(method.casefold())
+        # Interop-family gate (#56). An EXACT invariant rather than a proxy:
+        # graphite models no FFI, so a JavaScript call site cannot reach a Python
+        # `def` under any typing discipline. Measured live before this existed --
+        # `path.resolve(input.root)` in `src/graphite/ts_resolver.mjs` bound to a
+        # `resolve` defined in `tests/test_git_security.py`, and reported at
+        # decision_grade.
+        #
+        # Applies in EVERY language, gated or not, because it removes only bindings
+        # that are impossible; the per-language census the reachability gate below
+        # still waits on is about bindings that are merely unlikely. Fails open on
+        # either side: an unclassified extension has no family and is left alone.
+        if candidates:
+            caller_family = _interop_family(e.get("source_file"))
+            if caller_family is not None:
+                candidates = {
+                    c for c in candidates
+                    if family_of_node.get(c) in (None, caller_family)
+                }
         # Reachability gate (#54). A name-only match let `Path(...).resolve()` bind
         # to a test double's `resolve`, and `f.write(text)` to a `write` defined in
         # a test file -- 232 and 30 false callers respectively, graded
@@ -2002,17 +2176,20 @@ def _resolve_method_dispatch(
                 if file_of_node.get(c) == caller_file or file_of_node.get(c) in reachable
             }
         if not candidates or len(candidates) > _MAX_METHOD_DISPATCH_CANDIDATES:
-            # Member call that resolves to no known definition. Keep it when
-            # the target is a real node, or when the call was already
-            # classified EXTERNAL_CALL. That classification does NOT require
-            # an attributable receiver: _call_confidence tests the call's
-            # classified root, and _call_target_name (:603-619) falls back to
-            # the bare method name whenever _simple_object_name (:585-600)
-            # can't stringify the receiver -- so a member call with an
-            # unresolvable receiver is ALSO kept when its bare method name
-            # alone collides with _EXTERNAL_GLOBALS (e.g. `/re/.test(x)`,
-            # `"{}".format(x)`), even though the receiver was never proven
-            # external.
+            # Member call that resolves to no known definition -- or one the
+            # evidence gate above refused to resolve. Keep it when the target
+            # is a real node, or when the call was classified EXTERNAL_CALL.
+            #
+            # The EXTERNAL_CALL arm is what makes the evidence gate a REFUSAL TO
+            # RE-POINT rather than a deletion: the edge stays, pointing where it
+            # already pointed, so health.py can go on excluding it from the
+            # resolution denominator. It can only exclude what is present.
+            #
+            # (This comment used to justify that arm by saying EXTERNAL_CALL "does
+            # NOT require an attributable receiver". That was already false when it
+            # was written: _call_confidence:139 returns LOCAL_CALL when
+            # `attributable` is False, which is #14 mechanism A. The Rust site was
+            # the one place the argument still held, and it was threaded in fefe350.)
             #
             # Everything else still DROPS: `c.json()`, `db.prepare()`,
             # `stmt.bind()` -- unattributable receivers whose bare method name

graphite_code-0.5.1/src/graphite/io.py

@@ -0,0 +1,76 @@
+"""Safe file-writing helpers for Graphite artifacts."""
+from __future__ import annotations
+
+import contextlib
+import json
+import os
+import tempfile
+import time
+from pathlib import Path
+from typing import Any
+
+# `MoveFileEx` cannot replace a file that another handle holds open without
+# FILE_SHARE_DELETE, and neither `open()` nor `os.open()` grants that share
+# mode. So on Windows every graphite reader -- graph_io, the MCP server, a hook
+# running `query` -- makes `os.replace` fail with WinError 5 for the length of
+# its read. Seen three times in the daemon log; the daemon masks it by retrying
+# next cycle, a hook- or agent-driven `build` fails outright. Readers hold the
+# file for milliseconds: wait them out, bounded. On POSIX an EACCES from rename
+# is the directory's permissions, which no wait will change, so the retry is
+# gated there rather than merely harmless.
+_RETRY_REPLACE_ON_ACCESS_DENIED = os.name == "nt"
+_REPLACE_RETRY_SECONDS = 2.0
+_REPLACE_RETRY_INITIAL_DELAY = 0.01
+_REPLACE_RETRY_MAX_DELAY = 0.2
+# Module-local aliases so tests can drive the loop without freezing the
+# process-wide clock (#45).
+_monotonic = time.monotonic
+_sleep = time.sleep
+
+
+def replace_file(src: Path, dst: Path) -> None:
+    """`os.replace`, waiting out a reader that holds `dst` open on Windows.
+
+    Every temp-file-then-rename writer in graphite goes through here so the
+    retry lives in one place; see the module comment for why it exists.
+    """
+    if not _RETRY_REPLACE_ON_ACCESS_DENIED:
+        os.replace(src, dst)
+        return
+    deadline = _monotonic() + _REPLACE_RETRY_SECONDS
+    delay = _REPLACE_RETRY_INITIAL_DELAY
+    while True:
+        try:
+            os.replace(src, dst)
+            return
+        except PermissionError:
+            if _monotonic() >= deadline:
+                raise
+            _sleep(delay)
+            delay = min(delay * 2, _REPLACE_RETRY_MAX_DELAY)
+
+
+def atomic_write_text(path: Path, text: str) -> None:
+    """Atomically replace a text file after fsyncing the temporary file."""
+    path.parent.mkdir(parents=True, exist_ok=True)
+    fd, tmp_name = tempfile.mkstemp(prefix=f".{path.name}.", suffix=".tmp", dir=str(path.parent))
+    tmp_path = Path(tmp_name)
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8", newline="") as f:
+            f.write(text)
+            f.flush()
+            os.fsync(f.fileno())
+        replace_file(tmp_path, path)
+    except Exception:
+        # The cleanup's own failure must not replace the error that matters:
+        # a WinError 32 on the temp file once stood in for whatever the
+        # replace raised, and the log line named only the temp file.
+        with contextlib.suppress(OSError):
+            tmp_path.unlink(missing_ok=True)
+        raise
+
+
+def atomic_write_json(path: Path, data: Any, *, indent: int | None = 2) -> None:
+    """Atomically write JSON with deterministic UTF-8 encoding."""
+    text = json.dumps(data, ensure_ascii=False, indent=indent)
+    atomic_write_text(path, text)