sourcecode 1.68.0__py3-none-any.whl → 1.70.0__py3-none-any.whl

sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.68.0"
+__version__ = "1.70.0"

sourcecode/architecture_analyzer.py

@@ -38,7 +38,15 @@ _CODE_EXTENSIONS = {
 }
 _GENERIC_NAMES = {"utils", "helpers", "common", "shared", "misc", "core", "root", ""}
 
-_TEST_DIRS: frozenset[str] = frozenset({"tests", "test", "spec", "specs", "__tests__", "e2e"})
+_TEST_DIRS: frozenset[str] = frozenset({
+    "tests", "test", "spec", "specs", "__tests__", "e2e",
+    # Gradle/Maven test-fixture source roots are test code, not runtime architecture.
+    "testfixtures", "testfixture",
+})
+# Always-vendored asset trees — never a backend code layer at any depth.
+_ASSET_DIRS: frozenset[str] = frozenset({
+    "node_modules", "bower_components",
+})
 _BENCHMARK_DIRS: frozenset[str] = frozenset({
     "benchmark", "benchmarks", "bench",
     "example", "examples",
@@ -50,7 +58,7 @@ _BENCHMARK_DIRS: frozenset[str] = frozenset({
 _DOCS_DIRS: frozenset[str] = frozenset({"docs", "doc", "documentation", "wiki"})
 _TOOLING_DIRS: frozenset[str] = frozenset({"scripts", "script", "tools", "tool", "ci"})
 # All dirs that are not part of the runtime source architecture
-_NON_SOURCE_DIRS: frozenset[str] = _TEST_DIRS | _BENCHMARK_DIRS | _DOCS_DIRS | _TOOLING_DIRS
+_NON_SOURCE_DIRS: frozenset[str] = _TEST_DIRS | _BENCHMARK_DIRS | _DOCS_DIRS | _TOOLING_DIRS | _ASSET_DIRS
 
 # Exact file stems that signal a specific architectural layer
 _LAYER_STEM_EXACT: dict[str, str] = {
@@ -150,6 +158,15 @@ LAYER_PATTERNS: dict[str, dict[str, list[str]]] = {
     },
 }
 
+# Layer keys a pattern MUST match to qualify, regardless of score. BUG (JobRunr
+# field test): "mvc" was inferred from a controller-ish dir (`handlers`) plus a
+# `model` dir, with NO view layer — that is not MVC (a library with no templates/
+# pages/components is at most layered). MVC's defining trait is the View, so require
+# it; without it the pattern falls through to layered / a weaker match.
+_PATTERN_REQUIRED_KEYS: dict[str, frozenset[str]] = {
+    "mvc": frozenset({"view"}),
+}
+
 # Higher value = wins when score ties
 _PATTERN_PRIORITY: dict[str, int] = {
     "cqrs":               8,
@@ -245,8 +262,12 @@ class ArchitectureAnalyzer:
         # Step 2: domain clustering
         domains = self._cluster_domains(filtered)
 
-        # Step 3: layer detection
-        pattern, layers = self._detect_layers(filtered)
+        # Step 3: layer detection. Feed the FULL path list (not the code-extension
+        # `filtered` set): a View layer is template files (.html/.jinja/.ejs…) that
+        # `filtered` would drop, hiding the very layer that distinguishes MVC.
+        # _detect_layers applies its own non-source/asset/test dir filtering, so
+        # bundled frontend trees and test fixtures are still excluded.
+        pattern, layers = self._detect_layers(sm.file_paths)
         if pattern in (None, "flat", "unknown"):
             if pattern == "flat":
                 limitations.append("Layer pattern not detected: project has a flat directory structure")
@@ -518,10 +539,18 @@ class ArchitectureAnalyzer:
         return domains
 
     def _detect_layers(self, paths: list[str]) -> tuple[str, list[ArchitectureLayer]]:
-        # Exclude non-source paths (tests, benchmarks, docs, tooling) from layer scoring
+        # Exclude non-source paths (tests, benchmarks, docs, tooling, vendored assets)
+        # from layer scoring. Also exclude anything under a `resources/` segment: in
+        # Maven/Gradle layouts `src/main/resources/**` is bundled config/assets — e.g.
+        # JobRunr ships a React dashboard SPA at
+        # `core/src/main/resources/org/jobrunr/dashboard/frontend/src/components`, whose
+        # `components` dir would otherwise be miscounted as a backend MVC "view" layer.
         source_paths = [
             p for p in paths
-            if not any(part.lower() in _NON_SOURCE_DIRS for part in p.replace("\\", "/").split("/"))
+            if not any(
+                part.lower() in _NON_SOURCE_DIRS or part.lower() == "resources"
+                for part in p.replace("\\", "/").split("/")
+            )
         ]
         if not source_paths:
             return "unknown", []
@@ -544,6 +573,10 @@ class ArchitectureAnalyzer:
                 matched_dirs = [d for d in dir_names if d in keywords]
                 if matched_dirs:
                     matched[layer_key] = matched_dirs
+            # A pattern with unmet required keys cannot qualify (e.g. mvc needs a view).
+            required = _PATTERN_REQUIRED_KEYS.get(pattern_name)
+            if required and not required.issubset(matched.keys()):
+                continue
             score = len(matched)
             priority = _PATTERN_PRIORITY.get(pattern_name, 0)
             if (score, priority) > (best_score, best_priority):

sourcecode/architecture_summary.py

@@ -23,6 +23,14 @@ _JAVA_EXTENSIONS = {".java", ".kt", ".scala"}
 
 _CORE_DETECTION_MODULES = {"scanner", "detectors", "classifier", "workspace"}
 
+# BUG #4 (v1.70.0): the "REST API" project-type label is driven by HTTP-framework
+# PRESENCE (Spring MVC / JAX-RS on the classpath), not by an actual endpoint count.
+# The `--compact` summary is the first (often only) thing an agent reads, so it must
+# not assert "rest api" when the authoritative `endpoints` command finds almost no
+# high-confidence surface. Below this many high-confidence endpoints we degrade the
+# headline to a qualified, consistent phrasing instead of overclaiming.
+_MIN_REST_ENDPOINTS_FOR_LABEL = 5
+
 _OPTIONAL_LABEL_MAP: dict[str, str] = {
     "DependencyAnalyzer": "dependencias",
     "GraphAnalyzer": "grafo de módulos",
@@ -41,6 +49,7 @@ class ArchitectureSummarizer:
 
     def __init__(self, root: Path) -> None:
         self.root = root
+        self._endpoint_support_cache: tuple[int, int] | None = None
 
     def generate(self, sm: SourceMap) -> str | None:
         try:
@@ -185,9 +194,39 @@ class ArchitectureSummarizer:
 
         fw_str = f" using {', '.join(fw_names)}" if fw_names else ""
         if runtime:
+            # BUG #4: never assert "rest api" in the headline unless the endpoints
+            # command actually backs it (Java/Kotlin only — that is where we have an
+            # authoritative extractor). Degrade to a qualified, consistent phrasing.
+            if sm.project_type == "api" and primary.stack in {"java", "kotlin"}:
+                total, high = self._endpoint_support()
+                if high < _MIN_REST_ENDPOINTS_FOR_LABEL:
+                    plural = "s" if total != 1 else ""
+                    return (
+                        f"{stack_label} application{fw_str} "
+                        f"(HTTP framework present; only {total} endpoint{plural} "
+                        f"detected — see `endpoints`)."
+                    )
             return f"{stack_label} {runtime.lower()}{fw_str}."
         return f"{stack_label} project{fw_str}."
 
+    def _endpoint_support(self) -> tuple[int, int]:
+        """Return (total, high_confidence) endpoint counts from the canonical
+        Java endpoint extractor — the same source the `endpoints` command uses,
+        so the summary cannot diverge from it. Cached; failure degrades to (0, 0)."""
+        if self._endpoint_support_cache is not None:
+            return self._endpoint_support_cache
+        total, high = 0, 0
+        try:
+            from sourcecode.repository_ir import extract_java_endpoints
+            data = extract_java_endpoints(self.root)
+            eps = data.get("endpoints", [])
+            total = data.get("total", len(eps))
+            high = sum(1 for e in eps if (e.get("confidence") or "high") == "high")
+        except Exception:
+            total, high = 0, 0
+        self._endpoint_support_cache = (total, high)
+        return self._endpoint_support_cache
+
     def _describe_arch_pattern(self, arch: Any) -> str:
         pattern_labels = {
             "clean": "Clean Architecture",

sourcecode/classifier.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import re
 from collections.abc import Iterable, Sequence
 from dataclasses import replace
 from typing import Any, Literal
@@ -104,6 +105,21 @@ class TypeClassifier:
         stack_names = {stack.stack for stack in stacks}
         framework_names = {framework.name for stack in stacks for framework in stack.frameworks}
 
+        # BUG #4 (JobRunr field test): a framework present only in a small optional
+        # integration/adapter submodule must NOT label the whole repo as that
+        # framework's app type. JobRunr is a framework-agnostic background-job
+        # LIBRARY whose `core` module holds ~85% of the code; Quarkus/Micronaut/Spring
+        # appear only in tiny per-framework adapter modules — yet presence-based
+        # classification returned project_type="api"+Quarkus. We weight by code
+        # locality: if the DOMINANT source module (the one with the most source files)
+        # contains no evidence of the app-defining framework, the framework is an
+        # optional adapter and the repo is a library. A monolithic Spring app is
+        # unaffected — its dominant module *does* use the framework. Drop such
+        # localized frameworks from the set that drives the app-type decision below.
+        _app_frameworks = framework_names & (_WEB_FRAMEWORKS | _API_FRAMEWORKS)
+        _localized = self._localized_adapter_frameworks(file_tree, stacks, _app_frameworks)
+        framework_names = framework_names - _localized
+
         if len(stack_names) >= 2 and self._is_fullstack(stacks):
             return "fullstack"
 
@@ -129,9 +145,16 @@ class TypeClassifier:
         if framework_names & _API_FRAMEWORKS:
             return "api"
 
+        # All app-defining frameworks were localized to optional adapter submodules
+        # (multi-module library with per-framework integrations) — report library,
+        # never "unknown", when there is clearly source code present.
+        if _localized and not (framework_names & (_WEB_FRAMEWORKS | _API_FRAMEWORKS)):
+            return "library"
+
+        # Strong CLI signals: a CLI framework or an explicit cli entry point.
         if framework_names & _CLI_FRAMEWORKS or any(
             entry.kind == "cli" for entry in entry_points
-        ) or any(path.startswith("bin/") for path in flat_paths):
+        ):
             return "cli"
 
         if stack_names:
@@ -141,8 +164,105 @@ class TypeClassifier:
             if single in {"cpp", "dotnet"} and any(entry.kind == "cli" for entry in entry_points):
                 return "cli"
 
+        # BUG #4 (JobRunr field test): a multi-module JVM repo with no app-defining
+        # web/API framework is a library/toolkit, not an "unknown" — never let the
+        # first command of an audit emit a vacuous classification for a clearly
+        # structured codebase (e.g. JobRunr: core + per-framework adapter modules).
+        # This is checked BEFORE the weak `bin/`-directory CLI heuristic so a build
+        # output / wrapper `bin/` dir does not mislabel a library as a CLI.
+        if stack_names & {"java", "kotlin", "scala"} and self._is_multi_module(file_tree):
+            return "library"
+
+        # Weak CLI heuristic: a top-level bin/ directory (only when nothing stronger).
+        if any(path.startswith("bin/") for path in flat_paths):
+            return "cli"
+
         return "unknown" if stacks else None
 
+    def _is_multi_module(self, file_tree: dict[str, Any]) -> bool:
+        """True when the repo has >1 source module (distinct `*/src/...` roots)."""
+        _CODE_EXTS = (".java", ".kt", ".kts", ".scala", ".groovy")
+        modules = {
+            self._module_of(p)
+            for p in flatten_file_tree(file_tree)
+            if p.endswith(_CODE_EXTS)
+        }
+        modules.discard("")
+        return len(modules) >= 2
+
+    @staticmethod
+    def _module_of(path: str) -> str:
+        """Group a source path into its module root.
+
+        For Maven/Gradle layouts the module is everything before `/src/`
+        (e.g. `framework-support/jobrunr-quarkus/src/main/java/...` →
+        `framework-support/jobrunr-quarkus`). Otherwise the top-level directory.
+        """
+        norm = path.replace("\\", "/")
+        idx = norm.find("/src/")
+        if idx > 0:
+            return norm[:idx]
+        head, _, tail = norm.partition("/")
+        return head if tail else ""
+
+    _EVIDENCE_PATH_RE = re.compile(r"\(([^()]+)\)\s*$")
+
+    def _localized_adapter_frameworks(
+        self,
+        file_tree: dict[str, Any],
+        stacks: Sequence[StackDetection],
+        candidate_frameworks: set[str],
+    ) -> set[str]:
+        """Frameworks confined to a minority module while a framework-agnostic
+        module dominates the codebase (library + per-framework adapters).
+
+        Returns the subset of ``candidate_frameworks`` that should NOT drive the
+        project-type decision. A framework qualifies only when (a) the repo is
+        multi-module, (b) the framework's evidence files are all outside the
+        dominant source module, and (c) the framework has located evidence files
+        (a manifest-only/root detection applies repo-wide and never localizes).
+        """
+        if not candidate_frameworks:
+            return set()
+
+        _CODE_EXTS = (".java", ".kt", ".kts", ".scala", ".groovy")
+        module_file_counts: dict[str, int] = {}
+        for p in flatten_file_tree(file_tree):
+            if not p.endswith(_CODE_EXTS):
+                continue
+            mod = self._module_of(p)
+            module_file_counts[mod] = module_file_counts.get(mod, 0) + 1
+
+        # Need a genuine multi-module repo to reason about locality.
+        if len(module_file_counts) < 2:
+            return set()
+        dominant_module = max(module_file_counts, key=lambda m: module_file_counts[m])
+
+        # Collect evidence file paths per framework from detected_via.
+        evidence: dict[str, set[str]] = {}
+        for stack in stacks:
+            for fw in stack.frameworks:
+                if fw.name not in candidate_frameworks:
+                    continue
+                paths = evidence.setdefault(fw.name, set())
+                for ev in fw.detected_via:
+                    if ev.startswith("manifest:"):
+                        continue
+                    m = self._EVIDENCE_PATH_RE.search(ev)
+                    if m:
+                        paths.add(m.group(1).strip())
+
+        localized: set[str] = set()
+        for fw_name in candidate_frameworks:
+            files = evidence.get(fw_name) or set()
+            if not files:
+                # No locatable evidence (manifest-only) → applies repo-wide.
+                continue
+            modules = {self._module_of(f) for f in files}
+            if dominant_module not in modules:
+                localized.add(fw_name)
+        return localized
+
     def _is_fullstack(self, stacks: Sequence[StackDetection]) -> bool:
         has_web = False
         has_api = False

sourcecode/detectors/java.py

@@ -90,6 +90,19 @@ _GRADLE_JAVA_VERSION_RE = re.compile(
 _GRADLE_JAVA_ENUM_RE = re.compile(
     r"""(?:sourceCompatibility|targetCompatibility)\s*=\s*JavaVersion\.VERSION_(\d+)"""
 )
+# BUG #4: a gradle line that genuinely declares a dependency or plugin. Matches a
+# quoted Maven coordinate (group:artifact, requires the colon), a plugins-block
+# `id '...'`, an `apply plugin:`, or a `classpath`/`platform(`/`enforcedPlatform(`
+# declaration. Deliberately does NOT match `it.name.contains('quarkus')`-style
+# subproject filters (a bare quoted name with no colon and no plugin/dep keyword).
+_GRADLE_DEP_LINE_RE = re.compile(
+    r"""['"][\w.\-]+:[\w.\-]+"""          # maven coordinate "group:artifact..."
+    r"""|\bclasspath\b"""
+    r"""|\b(?:enforced)?platform\s*\("""
+    r"""|\bapply\s+plugin\s*:"""
+    r"""|\bid\s*[('"]""",
+    re.IGNORECASE,
+)
 
 
 class JavaDetector(AbstractDetector):
@@ -279,7 +292,29 @@ class JavaDetector(AbstractDetector):
         original = "\n".join(read_text_lines(path))
         content = original.lower()
         sb_version = self._extract_gradle_sb_version(original)
-        return self._detect_jvm_frameworks(content, "build.gradle", sb_version=sb_version)
+        # BUG #4 (JobRunr field test): framework tokens must be matched only inside
+        # genuine dependency / plugin declarations, never anywhere in the file. A
+        # multi-module root build.gradle that EXCLUDES a subproject by name —
+        # `configure(subprojects.findAll { !it.name.contains('quarkus') })` — must
+        # not be read as "this project uses Quarkus". Restrict the scan to lines
+        # carrying a Maven coordinate / plugin id; the exclusion filter has neither.
+        dep_text = self._gradle_dependency_text(content)
+        return self._detect_jvm_frameworks(dep_text, "build.gradle", sb_version=sb_version)
+
+    @staticmethod
+    def _gradle_dependency_text(content: str) -> str:
+        """Keep only gradle lines that declare a dependency or plugin.
+
+        A real dependency carries a Maven coordinate (`group:artifact`...) and a
+        plugin carries an `id`/`plugin`/`classpath` token. Subproject-name filters
+        and arbitrary prose are dropped, so a framework substring there cannot
+        manufacture a phantom framework detection.
+        """
+        kept: list[str] = []
+        for line in content.splitlines():
+            if _GRADLE_DEP_LINE_RE.search(line):
+                kept.append(line)
+        return "\n".join(kept)
 
     def _extract_gradle_sb_version(self, content: str) -> str | None:
         m = _GRADLE_SB_PLUGIN_RE.search(content)

sourcecode/explain.py

@@ -223,7 +223,89 @@ def _build_purpose(
         if role_anns:
             desc = f"{role_anns[0]} bean"
 
-    return desc or "No stereotype detected — may be a plain class or utility."
+    if desc:
+        return desc
+
+    # BUG #4 (JobRunr field test): with no recognized framework annotation, the old
+    # fallback returned "No stereotype detected — may be a plain class or utility",
+    # which is actively misleading for a central domain class. Libraries and clean/
+    # hexagonal architectures model rich roles WITHOUT DI annotations. Infer a
+    # low-confidence structural role from signals the tool already computes:
+    # in-degree (coupling), lifecycle methods, and naming convention.
+    structural = _structural_purpose(class_fqn, raw_nodes, cir)
+    if structural:
+        return structural
+    return "No stereotype detected — may be a plain class or utility."
+
+
+# Lifecycle method names that signal an orchestrator/component managing state.
+_LIFECYCLE_METHODS = frozenset({
+    "start", "stop", "init", "initialize", "shutdown", "close",
+    "pause", "resume", "run", "destroy", "open", "restart",
+})
+
+# Class-name suffix → inferred role (no annotation required).
+_NAME_ROLE_SUFFIXES: tuple[tuple[str, str], ...] = (
+    ("Server", "server/orchestrator"),
+    ("Manager", "manager/coordinator"),
+    ("Controller", "controller"),
+    ("Service", "service"),
+    ("Repository", "repository/data access"),
+    ("Factory", "factory"),
+    ("Builder", "builder"),
+    ("Handler", "handler"),
+    ("Listener", "listener"),
+    ("Provider", "provider"),
+    ("Registry", "registry"),
+    ("Scheduler", "scheduler"),
+    ("Dispatcher", "dispatcher"),
+    ("Processor", "processor"),
+    ("Filter", "filter"),
+    ("Interceptor", "interceptor"),
+)
+
+
+def _structural_purpose(
+    class_fqn: str,
+    raw_nodes: list[dict],
+    cir: "CanonicalRepositoryIR",
+) -> str:
+    """Infer a low-confidence stereotype from structural signals (no annotations)."""
+    try:
+        in_degree = len(_build_callers(class_fqn, cir))
+    except Exception:
+        in_degree = 0
+
+    try:
+        method_names = {m.split("(")[0].lower() for m in _build_public_methods(class_fqn, raw_nodes)}
+    except Exception:
+        method_names = set()
+    lifecycle = sorted(method_names & _LIFECYCLE_METHODS)
+
+    simple = _simple(class_fqn)
+    role = ""
+    for suffix, label in _NAME_ROLE_SUFFIXES:
+        if simple.endswith(suffix):
+            role = label
+            break
+    if not role and lifecycle:
+        role = "orchestrator/lifecycle component"
+
+    # Require at least one real signal — otherwise stay honestly silent.
+    if not role and in_degree < 3:
+        return ""
+
+    head = f"Likely {role} (no DI annotations found)" if role else \
+        "Likely a structurally significant class (no DI annotations found)"
+    signals: list[str] = []
+    if in_degree >= 3:
+        signals.append(f"high in-degree ({in_degree})")
+    elif in_degree:
+        signals.append(f"in-degree {in_degree}")
+    if lifecycle:
+        signals.append(f"lifecycle methods detected ({'/'.join(lifecycle)})")
+    suffix = f" — {', '.join(signals)}" if signals else ""
+    return f"{head}{suffix} — inferred from structure, not annotations (low confidence)."
 
 
 def _build_public_methods(class_fqn: str, raw_nodes: list[dict]) -> list[str]:

sourcecode/hibernate_strat.py

@@ -262,15 +262,33 @@ def _scan_build_dependency(root: Path) -> tuple[bool, list[str]]:
 # ≥ 6 the 5→6 axis does NOT apply (the migration is already done). When it cannot
 # be resolved the axis degrades to a low-confidence hypothesis (no headline).
 _HIB_VER = r"(\d+\.\d+(?:\.\d+)?(?:[.\-][\w]+)*)"  # 6.2.13.Final, 5.6.15, 6.2
+_HIB_VER_ANCHORED = re.compile(r"^" + _HIB_VER + r"$")
 _HIB_PROP_RE = re.compile(
     r"<((?:[\w.\-]*hibernate[\w.\-]*?)\.?version)>\s*" + _HIB_VER + r"\s*</\1>",
     re.IGNORECASE,
 )
-_HIB_COORD_VERSION_RE = re.compile(
-    r"<artifactId>\s*hibernate-(?:core|orm)\s*</artifactId>\s*"
-    r"(?:<[^>]+>[^<]*</[^>]+>\s*)*?<version>\s*" + _HIB_VER,
+# A Hibernate property is ONLY a proxy for the ORM version when it is not the
+# version of a sibling Hibernate artifact (Search, Validator, Envers, OGM, …).
+# Those ship on their own version line (e.g. hibernate-search 6.x on a
+# hibernate-core 5.x project) and must never be mistaken for the ORM version.
+# BUG #1 (v1.70.0): openmrs pinned hibernate-core to 5.6.15 via ${hibernateVersion}
+# while ${hibernateSearchVersion}=6.2.4 — the old "newest wins" scan picked the
+# Search version and declared the project already on Hibernate 6.
+_HIB_NON_CORE_PROP_RE = re.compile(
+    r"search|validator|envers|ogm|reactive|spatial|jpamodelgen|"
+    r"jpa-?model|gradle|tool|commons|metamodel",
+    re.IGNORECASE,
+)
+# Anchor: capture the <version> declared inside the hibernate-core/orm
+# <dependency> block (the value may be a literal or a ${property} reference).
+_HIB_CORE_DEP_RE = re.compile(
+    r"<dependency>(?P<body>(?:(?!</dependency>).)*?"
+    r"<artifactId>\s*hibernate-(?:core|orm)\s*</artifactId>"
+    r"(?:(?!</dependency>).)*?)</dependency>",
     re.IGNORECASE | re.DOTALL,
 )
+_VERSION_TAG_RE = re.compile(r"<version>\s*([^<]+?)\s*</version>", re.IGNORECASE)
+_PROP_REF_RE = re.compile(r"^\$\{([^}]+)\}$")
 _HIB_GRADLE_VERSION_RE = re.compile(
     r"org\.hibernate(?:\.orm)?:hibernate-(?:core|orm):" + _HIB_VER,
     re.IGNORECASE,
@@ -290,37 +308,88 @@ def _ver_key(full: str) -> tuple[int, int]:
     return (major, minor)
 
 
+def _lookup_maven_property(texts: list[str], name: str) -> Optional[str]:
+    """Resolve a single Maven property by exact tag name across build files."""
+    pat = re.compile(
+        r"<" + re.escape(name) + r">\s*([^<]+?)\s*</" + re.escape(name) + r">",
+        re.IGNORECASE,
+    )
+    for t in texts:
+        m = pat.search(t)
+        if m:
+            return m.group(1).strip()
+    return None
+
+
+def _resolve_version_expr(texts: list[str], expr: str, depth: int = 0) -> Optional[str]:
+    """Resolve a <version> value that may be a literal or a ${property} chain."""
+    expr = expr.strip()
+    ref = _PROP_REF_RE.match(expr)
+    if ref:
+        if depth > 5:
+            return None
+        val = _lookup_maven_property(texts, ref.group(1))
+        if val is None:
+            return None
+        return _resolve_version_expr(texts, val, depth + 1)
+    return expr if _HIB_VER_ANCHORED.match(expr) else None
+
+
 def _resolve_hibernate_version(root: Path) -> tuple[Optional[str], Optional[int], str]:
     """Return (full_version_string, major, confidence) for the effective Hibernate.
 
-    confidence is "high" when a version was resolved from a build descriptor,
-    "none" when none could be determined (degrade to hypothesis). The newest
-    declared Hibernate wins in a multi-module build.
+    Resolution order (BUG #1 — never trust a same-named-but-different artifact):
+      1. The <version> anchored to the hibernate-core / hibernate-orm dependency
+         (literal, or a ${property} resolved to that specific property), and the
+         Gradle org.hibernate(.orm):hibernate-(core|orm) coordinate. HIGH conf.
+      2. Fallback: a <hibernate*version> property that is NOT a sibling-artifact
+         version (Search/Validator/Envers/…). HIGH conf.
+      3. None resolvable → degrade to hypothesis (confidence "none").
+    The newest qualifying version wins in a multi-module build.
     """
     import os
-    best_full: Optional[str] = None
+    texts: list[str] = []
     for dirpath, dirnames, filenames in os.walk(root):
         dirnames[:] = [d for d in dirnames if d not in _SKIP_BUILD_SCAN_DIRS]
         for fname in filenames:
             if fname not in _BUILD_FILE_NAMES:
                 continue
             try:
-                text = (Path(dirpath) / fname).read_text(encoding="utf-8", errors="replace")
+                texts.append(
+                    (Path(dirpath) / fname).read_text(encoding="utf-8", errors="replace")
+                )
             except OSError:
                 continue
-            fulls: list[str] = []
-            for m in _HIB_PROP_RE.finditer(text):
-                fulls.append(m.group(2))
-            for m in _HIB_COORD_VERSION_RE.finditer(text):
-                fulls.append(m.group(1))
-            for m in _HIB_GRADLE_VERSION_RE.finditer(text):
-                fulls.append(m.group(1))
-            for full in fulls:
-                if best_full is None or _ver_key(full) > _ver_key(best_full):
-                    best_full = full
-    if best_full is None:
+    if not texts:
         return None, None, "none"
-    return best_full, _ver_key(best_full)[0], "high"
+
+    # 1. Anchored to the hibernate-core / hibernate-orm coordinate.
+    anchored: list[str] = []
+    for text in texts:
+        for dep in _HIB_CORE_DEP_RE.finditer(text):
+            vm = _VERSION_TAG_RE.search(dep.group("body"))
+            if vm:
+                resolved = _resolve_version_expr(texts, vm.group(1))
+                if resolved:
+                    anchored.append(resolved)
+        for m in _HIB_GRADLE_VERSION_RE.finditer(text):
+            anchored.append(m.group(1))
+    if anchored:
+        best = max(anchored, key=_ver_key)
+        return best, _ver_key(best)[0], "high"
+
+    # 2. Fallback: a Hibernate *property* that is not a sibling-artifact version.
+    prop_cands: list[str] = []
+    for text in texts:
+        for m in _HIB_PROP_RE.finditer(text):
+            if _HIB_NON_CORE_PROP_RE.search(m.group(1)):
+                continue
+            prop_cands.append(m.group(2))
+    if prop_cands:
+        best = max(prop_cands, key=_ver_key)
+        return best, _ver_key(best)[0], "high"
+
+    return None, None, "none"
 
 # Escalation markers — dynamic / reflection-based persistence construction.
 _ABSTRACTION_CLASS_RE = re.compile(
@@ -495,7 +564,13 @@ class HibernateStratification:
             "classification": self.classification,
             "classification_label": self.classification_label,
             "stratified": True,
-            "hibernate_readiness": self.readiness,
+            # BUG #1 (v1.70.0): renamed from "hibernate_readiness" to avoid a
+            # same-name contradiction with the document-level migrate-check field.
+            # This is the RAW 5→6 rewrite-zone readiness (independent of whether the
+            # axis applies). The authoritative, applicability-gated migration score
+            # lives at the document root as "hibernate_readiness"; consult that one
+            # for decisions. They diverge by design when the axis is N/A.
+            "rewrite_zone_readiness": self.readiness,
             "risk_matrix": [r.to_dict() for r in self.risk_matrix],
             "module_exposure_map": self.module_exposure,
             "incompatible_patterns": self.incompatible_patterns,

sourcecode/integration_detector.py

@@ -200,6 +200,27 @@ def detect_integrations(file_paths: "list[str]", root: Path) -> dict:
         has_mail_import = bool(_MAIL_IMPORT_RE.search(text))
         naming_factory = _classify_naming_factory(text)
 
+        # BUG #3 (v1.70.0): "HttpClient" is a simple name that collides with
+        # user-defined classes (e.g. org.openmrs.util.HttpClient, a thin wrapper over
+        # java.net.HttpURLConnection — a completely different API from the JDK 11+
+        # java.net.http.HttpClient). Resolve the JDK client by its FULLY-QUALIFIED
+        # import, never by the bare class name. When the file imports/declares a
+        # different HttpClient (or none can be resolved), degrade to a low-confidence
+        # "custom-http-wrapper" rather than asserting a JDK client that isn't there.
+        import_fqns = set(
+            re.findall(r"^\s*import\s+(?:static\s+)?([\w.]+)\s*;", text, re.MULTILINE)
+        )
+        http_jdk_imported = (
+            "java.net.http.HttpClient" in import_fqns or "java.net.http.*" in import_fqns
+        )
+        declares_own_httpclient = bool(
+            re.search(r"\b(?:class|interface|enum)\s+HttpClient\b", text)
+        )
+        http_other_import = any(
+            fqn.endswith(".HttpClient") and not fqn.startswith("java.net.http.")
+            for fqn in import_fqns
+        )
+
         # Token clients — per line, skipping imports/package/comment noise.
         # First pass records the declaration site and any variable name bound to
         # the client, so a later call site (where the URL literal usually lives)
@@ -241,6 +262,27 @@ def detect_integrations(file_paths: "list[str]", root: Path) -> dict:
                         kind, client, confidence = (
                             "naming-directory-unknown", "jndi-dircontext", "low",
                         )
+                # BUG #3: resolve the ambiguous bare "HttpClient" by its import, and
+                # suppress pure type-declaration sites (field / parameter / return
+                # type) — only a construction or static call is a real network site.
+                if client == "jdk-httpclient":
+                    if not (http_jdk_imported and not declares_own_httpclient):
+                        # Not the JDK client (own class, third-party, or unresolvable).
+                        client, confidence = "custom-http-wrapper", "low"
+                        if declares_own_httpclient or http_other_import:
+                            confidence = "low"
+                    is_construction = bool(
+                        re.search(r"\bnew\s+HttpClient\b", line)
+                    ) or bool(re.search(r"\bHttpClient\s*\.", line))
+                    if not is_construction:
+                        # Type-declaration only (e.g. `HttpClient field;`,
+                        # `void setX(HttpClient c)`): track the var for the URL
+                        # second pass but do NOT emit it as an invocation site.
+                        tok = m.group(0)
+                        decl = re.search(re.escape(tok) + r"\s+(\w+)\b", line)
+                        if decl:
+                            var_to_client[decl.group(1)] = (kind, client)
+                        continue
                 _add(kind, client, _extract_target(line), rel, lineno, confidence)
                 tok = m.group(0)
                 # `Type name` (field/local decl) and `name = new Type(` forms.

sourcecode/jdk_exports.py

@@ -0,0 +1,26 @@
+"""GENERATED FILE — do not edit by hand.
+
+Allowlist of sun.* / com.sun.* packages exported UNCONDITIONALLY by the
+JDK (no `--add-exports` / `--add-opens` required on classpath or module
+path). Consumed by migrate-check MIG-011 to suppress false positives.
+
+Regenerate with:  python scripts/generate_jdk_exports.py > src/sourcecode/jdk_exports.py
+Generated from:   java version "21.0.10" 2026-01-20 LTS
+"""
+from __future__ import annotations
+
+
+JDK_UNCONDITIONAL_EXPORTS: frozenset[str] = frozenset(
+    {
+        "com.sun.java.accessibility.util",
+        "com.sun.management",
+        "com.sun.net.httpserver",
+        "com.sun.net.httpserver.spi",
+        "com.sun.nio.sctp",
+        "com.sun.security.auth",
+        "com.sun.security.auth.callback",
+        "com.sun.security.auth.login",
+        "com.sun.security.auth.module",
+        "com.sun.security.jgss",
+    }
+)

sourcecode/migrate_check.py

@@ -23,6 +23,7 @@ from pathlib import Path
 from typing import Optional, TYPE_CHECKING
 
 from sourcecode.path_filters import is_test_or_fixture_path
+from sourcecode.jdk_exports import JDK_UNCONDITIONAL_EXPORTS
 
 if TYPE_CHECKING:
     from sourcecode.hibernate_strat import HibernateStratification
@@ -381,15 +382,22 @@ _JAVA_9_RULES: list[_Rule] = [
         severity="high",
         title="JDK internal API imports (sun.* / com.sun.net.*) — strong encapsulation since Java 9",
         explanation=(
-            "Imports from sun.* and com.sun.net.* reference JDK-internal APIs that are "
-            "not part of the public specification. Since Java 9 (JPMS), these packages are "
-            "strongly encapsulated and require --add-exports / --add-opens JVM flags, "
-            "which are cumbersome and may be removed in future Java releases."
+            "Imports from sun.* and com.sun.* (tools/jdi/source internals) reference "
+            "JDK-internal APIs that are not part of the public specification. Since Java 9 "
+            "(JPMS), these packages are strongly encapsulated and require --add-exports / "
+            "--add-opens JVM flags, which are cumbersome and may be removed in future Java "
+            "releases. Packages the JDK exports UNCONDITIONALLY (e.g. com.sun.net.httpserver "
+            "in jdk.httpserver, com.sun.management in jdk.management) are NOT flagged: they "
+            "need no JVM flags on any classpath or module path."
         ),
         fix_hint=(
             "Replace internal API usage with public equivalents. "
-            "For com.sun.net.httpserver, migrate to java.net.http.HttpServer or a framework. "
-            "Add '--add-exports java.base/sun.misc=ALL-UNNAMED' only as a last resort."
+            "For sun.misc.Unsafe migrate to java.lang.invoke.VarHandle; for com.sun.tools.* "
+            "use the public javax.tools / java.compiler API. "
+            "Add '--add-exports java.base/sun.misc=ALL-UNNAMED' only as a last resort. "
+            "Note: unconditionally-exported packages (com.sun.net.httpserver, "
+            "com.sun.management, com.sun.security.auth, ...) are auto-excluded — they are "
+            "public, stable, and require no migration."
         ),
         migration_target="java_9_plus",
         openrewrite_recipe=None,
@@ -585,6 +593,45 @@ def _is_no_migrate_javax(fqn: str) -> bool:
     return any(fqn.startswith(p) for p in _JAKARTA_NO_MIGRATE_PREFIXES)
 
 
+# BUG #1 (JobRunr field test): MIG-011 flags `sun.*` / `com.sun.*` imports as
+# strongly-encapsulated JDK internals on a pure PREFIX heuristic. That is wrong
+# for packages the JDK exports UNCONDITIONALLY (no `to` clause) — e.g.
+# `com.sun.net.httpserver` (module jdk.httpserver, public since Java 6, the basis
+# of JEP 408) or `com.sun.management` (jdk.management, JMX/diagnostics). These
+# need NO `--add-exports` / `--add-opens` on any classpath or module path, so they
+# must not be flagged `high` / `manual_migration`. The allowlist is generated from
+# the running JDK by scripts/generate_jdk_exports.py (see sourcecode/jdk_exports.py),
+# never hand-maintained. Genuinely-internal packages (sun.misc.Unsafe, com.sun.tools.*,
+# com.sun.jdi.*, com.sun.source.*) are NOT in the allowlist and keep `high` severity.
+
+
+def _import_package(fqn: str) -> str:
+    """Extract the Java package of an import FQN.
+
+    Packages are lowercase by convention and types are Capitalized, so the
+    package is the maximal prefix of non-type segments. Handles wildcard
+    (`a.b.*`) and `static` imports. Conservative: an unrecognized shape yields
+    the leading lowercase run, never a broader prefix — so a sub-package like
+    `com.sun.management.internal` is never confused with `com.sun.management`.
+    """
+    fqn = fqn.strip().rstrip(";").strip()
+    if fqn.startswith("static "):
+        fqn = fqn[len("static "):].strip()
+    if fqn.endswith(".*"):
+        return fqn[:-2]
+    pkg_parts: list[str] = []
+    for seg in fqn.split("."):
+        if seg[:1].isupper():  # first type segment — package ends here
+            break
+        pkg_parts.append(seg)
+    return ".".join(pkg_parts)
+
+
+def _is_jdk_unconditional_export(fqn: str) -> bool:
+    """True if an import targets a package the JDK exports unconditionally."""
+    return _import_package(fqn) in JDK_UNCONDITIONAL_EXPORTS
+
+
 # BUG #8: autogenerated source markers — path fragments and the JSR-250 marker.
 _GENERATED_PATH_FRAGMENTS: tuple[str, ...] = (
     "/generated-sources/", "/generated/", "/target/generated",
@@ -1240,6 +1287,7 @@ class MigrationReport:
     readiness_aggregate: dict = field(default_factory=dict)
     blocking_count: int = 0
     estimated_effort_days: float = 0.0
+    effort_breakdown: dict = field(default_factory=dict)
     # Tri-state: True = Boot 2 confirmed, False = Boot 3+ confirmed,
     # None = could not determine. Absence of evidence is never reported as True.
     spring_boot_2_detected: Optional[bool] = None
@@ -1452,13 +1500,32 @@ class MigrationReport:
 
         # BUG #5: effort over MAIN findings only — N/A axes (Hibernate-6 phantom,
         # test fixtures) no longer pad the estimate.
-        self.estimated_effort_days = round(
+        _file_effort = (
             len(critical_files) * 0.5
             + len(high_files) * 0.25
             + len(medium_files) * 0.1
-            + len(low_files) * 0.05,
-            1,
+            + len(low_files) * 0.05
         )
+        # BUG #1 (v1.70.0): when the Hibernate 5→6 axis APPLIES, fold its measured
+        # rewrite effort (risk_matrix → total_effort_range_days) into the headline
+        # estimate. Previously a Hibernate-5 project whose ${hibernateVersion} was
+        # misread as 6 set migration_applicable=False, which silently DROPPED this
+        # 28.9–95.6 person-day range from estimated_effort_days, under-reporting the
+        # real cost 1.5–2.6×. We add the range midpoint and expose the breakdown.
+        _hib_effort = 0.0
+        if _hibernate_applies and hib is not None:
+            _r = hib.total_effort_range_days or {}
+            _lo, _hi = _r.get("low"), _r.get("high")
+            if isinstance(_lo, (int, float)) and isinstance(_hi, (int, float)):
+                _hib_effort = (float(_lo) + float(_hi)) / 2.0
+        self.estimated_effort_days = round(_file_effort + _hib_effort, 1)
+        self.effort_breakdown = {
+            "findings_effort_days": round(_file_effort, 1),
+            "hibernate_rewrite_effort_days": round(_hib_effort, 1),
+            "hibernate_rewrite_range": (
+                hib.total_effort_range_days if (_hibernate_applies and hib is not None) else None
+            ),
+        }
 
         # BUG #6 / #8: hygiene + non-blocking buckets, surfaced separately.
         self.hygiene_findings = sum(
@@ -1514,6 +1581,7 @@ class MigrationReport:
             "headline_blocker": self.headline_blocker,
             "blocking_count": self.blocking_count,
             "estimated_effort_days": self.estimated_effort_days,
+            "effort_breakdown": self.effort_breakdown,
             "hygiene_findings": self.hygiene_findings,
             "non_blocking": self.non_blocking,
             "spring_present": self.spring_present,
@@ -1698,6 +1766,16 @@ def _scan_file(
             # javax.annotation.processing.*, ...). These do NOT migrate to jakarta.
             if matches and rule.migration_target == "jakarta":
                 matches = [m for m in matches if not _is_no_migrate_javax(m.group(1).strip())]
+            # BUG #1: MIG-011 prefix heuristic must not flag sun.*/com.sun.* packages
+            # the JDK exports unconditionally (no --add-exports/--add-opens needed).
+            # Drop those imports; if none remain, the file produces no MIG-011 finding
+            # (so it never inflates blocking_count / effort). Genuinely-internal
+            # packages are absent from the allowlist and survive as `high`.
+            if matches and rule.id == "MIG-011":
+                matches = [
+                    m for m in matches
+                    if not _is_jdk_unconditional_export(m.group(1).strip())
+                ]
             if matches:
                 import_first_line = source[: matches[0].start()].count("\n") + 1
                 matched_imports = [m.group(1) for m in matches]

sourcecode/repository_ir.py

@@ -3366,9 +3366,20 @@ def build_repo_ir(
                 and not _INHERIT_PRESCAN_RE.search(source):
             pkg_m = _PKG_RE.search(source)
             _pkg = pkg_m.group(1) if pkg_m else ""
-            # Minimal class-name symbols for same-package map (no methods/fields)
+            # Minimal class-name symbols for same-package map (no methods/fields).
+            # BUG #2 (JobRunr field test): this fast-path regex previously ran over RAW
+            # source, so prose inside Javadoc/comments and string literals (e.g.
+            # "This class provides the entry point", "...the interface is Serializable
+            # ...instead.") was tokenized into phantom type symbols like
+            # `org.jobrunr.configuration.provides`. Those leaked into the symbol graph
+            # and every consumer of it (modernize statically_unreferenced /
+            # framework_dispatched, impact, export --c4). Strip comments AND string
+            # literals before scanning so only real declarations are captured. The name
+            # must also start uppercase ([A-Z]) — Java type convention, matching the
+            # precision of the full _CLASS_DECL_RE used on annotated files.
+            _decl_source = _STRING_LITERAL_RE.sub('', _strip_java_comments(source))
             _min_syms: list[SymbolRecord] = []
-            for _cm in re.finditer(r'(?:class|interface|enum)\s+(\w+)', source):
+            for _cm in re.finditer(r'\b(?:class|interface|enum)\s+([A-Z]\w*)', _decl_source):
                 _cls_name = _cm.group(1)
                 _fqn = f"{_pkg}.{_cls_name}" if _pkg else _cls_name
                 _min_syms.append(SymbolRecord(
@@ -4023,6 +4034,27 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
     _SERVLET_RE = _re.compile(r"\bextends\s+\w*HttpServlet\b")
     _nonspring: dict[str, int] = {"webscripts": 0, "jax_rs": 0, "servlets": 0}
 
+    # BUG #3 (JobRunr field test): imperative router-DSL routes. Lightweight HTTP
+    # frameworks that deliberately avoid Spring/JAX-RS (JobRunr's own dashboard
+    # handler, Javalin, Spark Java, hand-rolled routers) register routes as method
+    # calls `get("/path", handler)` / `post(...)` instead of annotations, so the
+    # annotation surface above never sees them and `endpoints` returns 0 — a silent
+    # total false negative that also disables the `validation` command downstream.
+    # Detection is by SYNTACTIC SHAPE (no framework knowledge): an HTTP-verb method
+    # name, a first argument that is a string literal looking like a path (starts
+    # with "/", may contain :param / {param}), AND a second argument (the trailing
+    # comma) — the comma is what distinguishes a route registration from a 1-arg
+    # getter such as Map.get("/k"). Matches both bare `get(...)` (static-import /
+    # Spark style) and `app.get(...)` (Javalin style); the lookbehind only rejects
+    # an identifier char so `forget(` is not mistaken for `get(`. Reported at
+    # confidence "medium" — an occasional flagged false positive beats a total
+    # silent false negative.
+    _DSL_ROUTE_RE = _re.compile(
+        r'(?<![A-Za-z0-9_])(get|post|put|delete|patch|head|options)\s*\(\s*'
+        r'"(/[^"\s]*)"\s*,'
+    )
+    _dsl_routes: list[dict] = []
+
     for jf in java_files:
         try:
             source = jf.read_text(encoding="utf-8", errors="replace")
@@ -4051,6 +4083,27 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
                 if m:
                     extends_map[sym.symbol] = m.group(1)
 
+        # BUG #3: scan for imperative router-DSL route registrations. Strip comments
+        # first so commented-out / example routes don't leak in. The enclosing class
+        # is the first class/interface symbol in the file (route DSLs live in one
+        # handler class); fall back to the file stem when none was extracted.
+        _dsl_src = _strip_java_comments(source)
+        _dsl_matches = list(_DSL_ROUTE_RE.finditer(_dsl_src))
+        if _dsl_matches:
+            _cls_fqn = next(
+                (s.symbol for s in symbols if s.type in ("class", "interface")), None
+            )
+            _cls_simple = (
+                _cls_fqn.split(".")[-1] if _cls_fqn else Path(rel).stem
+            )
+            for _m in _dsl_matches:
+                _dsl_routes.append({
+                    "method": _m.group(1).upper(),
+                    "path": _m.group(2),
+                    "controller": _cls_simple,
+                    "effective_class": _cls_fqn or _cls_simple,
+                })
+
     routes = _build_route_surface(
         all_symbols, route_diffs=None, extends_map=extends_map,
         custom_security=_custom_sec_tuple,
@@ -4226,6 +4279,32 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
             if e.get("security", {}).get("policy") == "none_detected"
         )
 
+    # BUG #3: merge imperative router-DSL endpoints. Dedup against the annotation
+    # surface (method+path) in case a handler is both annotated and DSL-registered.
+    # These carry confidence "medium" (no unambiguous annotation) and explicit
+    # provenance so a consumer can tell shape-detected routes from annotated ones.
+    if _dsl_routes:
+        _seen_mp = {(e.get("method"), e.get("path")) for e in endpoints}
+        for _r in _dsl_routes:
+            _key = (_r["method"], _r["path"])
+            if _key in _seen_mp:
+                continue
+            _seen_mp.add(_key)
+            endpoints.append({
+                "method": _r["method"],
+                "path": _r["path"],
+                "controller": _r["controller"],
+                "handler": _r["controller"],
+                "return_type": "unknown",
+                "security": {"policy": "none_detected"},
+                "confidence": "medium",
+                "source": "router_dsl",
+            })
+        no_security_signal = sum(
+            1 for e in endpoints
+            if e.get("security", {}).get("policy") == "none_detected"
+        )
+
     # Append spec-recovered endpoints AFTER the security-model heuristics (which
     # are about annotation/filter/XML coverage of scanned source) so spec-sourced
     # entries don't skew those signals. They carry their own source provenance.

sourcecode/spring_impact.py

@@ -121,6 +121,8 @@ class ImpactChainResult:
     resolution: str = "not_found"              # "exact" | "class_expanded" | "partial" | "not_found"
     direct_callers: list[str] = field(default_factory=list)
     indirect_callers: list[str] = field(default_factory=list)
+    # BUG #2: count of own-class members dropped from callers (members, not callers).
+    self_referential_excluded: int = 0
     implementations: list[str] = field(default_factory=list)  # in-repo subtypes of queried interface/base
     endpoints_affected: list[AffectedEndpoint] = field(default_factory=list)
     transaction_boundary: Optional[dict] = None   # TransactionBoundary.to_dict() or None
@@ -144,6 +146,7 @@ class ImpactChainResult:
             "resolution": self.resolution,
             "direct_callers": self.direct_callers,
             "indirect_callers": self.indirect_callers,
+            "self_referential_excluded": self.self_referential_excluded,
             "implementations": self.implementations,
             "endpoints_affected": [ep.to_dict() for ep in self.endpoints_affected],
             "transaction_boundary": self.transaction_boundary,
@@ -471,6 +474,15 @@ def _bfs_callers(
     indirect: list[str] = []
     was_truncated = False
 
+    # BUG #2 (v1.70.0): a class's OWN members are not "callers" of that class — they
+    # are members. When the seed is a class node, _edges_for folds in every method
+    # key of that class, so internal method→method calls (e.g.
+    # ConceptServiceImpl#purgeConcept → ConceptServiceImpl#saveConcept) were leaking
+    # into direct_callers and inflating the blast radius ~12×. Exclude any caller
+    # whose owning class is one of the seed classes.
+    seed_classes: set[str] = {normalize_owner_fqn(s) for s in seed_fqns}
+    self_excluded: int = 0
+
     # BUG-004: index class FQN → list of method-level keys in reverse_graph.
     # Callers of Foo#doWork are stored under reverse_graph["Foo#doWork"], never
     # under reverse_graph["Foo"].  Without this index, BFS silently terminates
@@ -506,7 +518,9 @@ def _bfs_callers(
     for seed in seed_fqns:
         for etype, fqn_list in _edges_for(seed):
             if etype not in _SKIP_EDGE_TYPES:
-                unique_direct_callers.update(fqn_list)
+                unique_direct_callers.update(
+                    c for c in fqn_list if normalize_owner_fqn(c) not in seed_classes
+                )
 
     effective_depth = 1 if len(unique_direct_callers) > _BFS_CALLER_CAP else max_depth
     if effective_depth < max_depth:
@@ -516,8 +530,14 @@ def _bfs_callers(
     queue: list[tuple[str, int]] = [(s, 0) for s in seed_fqns]
 
     def _add_caller(caller: str, depth: int) -> None:
+        nonlocal self_excluded
         if caller in visited:
             return
+        # BUG #2: a member of a seed class is not an external caller — drop it.
+        if normalize_owner_fqn(caller) in seed_classes:
+            visited.add(caller)
+            self_excluded += 1
+            return
         visited.add(caller)
         if depth == 0:
             direct.append(caller)
@@ -542,7 +562,7 @@ def _bfs_callers(
                 else:
                     _add_caller(caller, depth)
 
-    return direct, indirect, was_truncated
+    return direct, indirect, was_truncated, self_excluded
 
 
 # ---------------------------------------------------------------------------
@@ -888,9 +908,15 @@ class ImpactOrchestrator:
                 )
 
         # ── 2. BFS through reverse graph ─────────────────────────────────
-        direct_callers, indirect_callers, truncated = _bfs_callers(
+        direct_callers, indirect_callers, truncated, self_excluded = _bfs_callers(
             seed_fqns, cir.reverse_graph, depth, impl_graph=impl_graph
         )
+        if self_excluded:
+            warnings.append(
+                f"Self-referential exclusion (BUG #2): {self_excluded} member(s) of the "
+                f"analyzed class were dropped from callers — a class's own methods are "
+                f"members, not external callers (they do not count toward blast radius)."
+            )
         if truncated:
             warnings.append(
                 "Hub-class guard active: symbol has > 500 direct callers — "
@@ -1083,6 +1109,7 @@ class ImpactOrchestrator:
             resolution=resolution,
             direct_callers=direct_callers,
             indirect_callers=indirect_callers,
+            self_referential_excluded=self_excluded,
             implementations=sorted(subtype_classes_added),
             endpoints_affected=endpoints_affected,
             transaction_boundary=tx_boundary,

{sourcecode-1.68.0.dist-info → sourcecode-1.70.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.68.0
+Version: 1.70.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm

{sourcecode-1.68.0.dist-info → sourcecode-1.70.0.dist-info}/RECORD

@@ -1,12 +1,12 @@
-sourcecode/__init__.py,sha256=gp3XLYiUZaatdehs90NAezSd-3vDxmo0g-OIVUqEBmg,103
+sourcecode/__init__.py,sha256=Carzg_e30MI_EAuPeCeJOnrSKumFIJRAPHiKk6kpPak,103
 sourcecode/adaptive_scanner.py,sha256=XffluXKzJUXrMtjEiAOnSNPZnztdIcts17T9ouHeID0,10521
-sourcecode/architecture_analyzer.py,sha256=liCwQmLgb5vplohy8arjYxs_HOIv5C9MjLh_gY6bc5Q,44115
-sourcecode/architecture_summary.py,sha256=z34_6v7cSwy98cof2UVciGho7SCrZ93tiqMmq5WNzRQ,20405
+sourcecode/architecture_analyzer.py,sha256=r_xf-SWXwUm3nVQMCSXHJ3M8zKsQP7Ze8Nqf6TVLRq8,45998
+sourcecode/architecture_summary.py,sha256=UbfVpFRk7dqtX_o-B5VFXlzcx9cr1JmMl-cAm3tmHYw,22650
 sourcecode/ast_extractor.py,sha256=sa6CmLpn-k5G3_Hzxn8hAlZ5-TS-EVzXDD0Gvxd2jzs,50613
 sourcecode/cache.py,sha256=1V3vsaODAa2UBJAC0xpvxpmRdriCezQx5Q8JCcfgziE,31892
 sourcecode/canonical_ir.py,sha256=DEwucOPJguLsVtg5cV8mWXNi112l5jmBhv73KGGebVk,24849
 sourcecode/cir_graphs.py,sha256=9G0HHj1kw2325IDyzo2OpX73BNswEckecf4MZUXB4JM,12078
-sourcecode/classifier.py,sha256=hKzg-nQ47htqqIUzSGvYxv15cXrA3KgICTwJmdqal0o,8095
+sourcecode/classifier.py,sha256=YTTCoRdcLEFRVcql9Ow1dE7eYQj0jq2rgx32bRDnb1k,13852
 sourcecode/cli.py,sha256=VqAiGRauTO-s8yBJh2JMldha3VKx0jTXC0tOvRpWQkI,283297
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/confidence_analyzer.py,sha256=_jckZSxksV-OU38vbkxfVNBnWCtlCq8Vwfg23x1uspA,19054
@@ -20,7 +20,7 @@ sourcecode/doc_analyzer.py,sha256=05bjTUbDbmnbajD_cgRnACzS8T7xxBKVX4CjkJlhZg8,24
 sourcecode/entrypoint_classifier.py,sha256=jhTYlyqDJH2AtdEcLVaRU3lYRTJuF8DkxVzl4-W3zWE,5322
 sourcecode/env_analyzer.py,sha256=aNTyYgQk5noJDfJU6FmasmESOHfiomyJw5EvZqjy6qc,22213
 sourcecode/error_schema.py,sha256=uwosfNaSujtYm11_732Hu92z5ITV040fQDaIyefSvR4,1683
-sourcecode/explain.py,sha256=dVG35YBlpRmbtOXSmspEhoIwDMVApPmLISBy3iigUSc,16913
+sourcecode/explain.py,sha256=GbcruAyzlmseV3o2rjeyxGQxToCfSYHJjKG3N05NVbQ,19897
 sourcecode/file_chunker.py,sha256=3vkM3mDQ5eE_yTPvUgjyjpGFBIjkW6_mrBmIbrylnA8,16444
 sourcecode/file_classifier.py,sha256=A0fEABqtfVu1MfoaxnPAvGpZgneGgVXlJDhT74NYXxE,15314
 sourcecode/flow_analyzer.py,sha256=dSiuY4w49k29jW_EPXUOND9B5uVbuCA7kjnuHi-pIWA,28781
@@ -28,12 +28,13 @@ sourcecode/format_contract.py,sha256=1cTNqwP8geA2hbQoBHUPgX3_vSh3l8guJT_jmgEnFF8
 sourcecode/fqn_utils.py,sha256=XLU7zDkNBXz_RZkIUNfpPmp1nekWtqP-fxV92tDV1vg,2158
 sourcecode/git_analyzer.py,sha256=JStxTQXNjBWi_wLdwhsZs9mT-v50cSJIz4Agzn6Kh9I,13362
 sourcecode/graph_analyzer.py,sha256=DHR8fY69oU_Pi4SYaWboX6EoEFrctQKB9dsjpqwGMzw,62403
-sourcecode/hibernate_strat.py,sha256=ZyI0sikxh7IemU8uqn1Z73z-tHeFeCJuYhJnyQL8pzU,57765
-sourcecode/integration_detector.py,sha256=ygZwXHJXJ4QM6oiqKb5S6WIfElByDYdz9moyuFlZpYI,12997
+sourcecode/hibernate_strat.py,sha256=h0leIhlWvSjYq3F99LxvLIDLrJ-xPYxWAREG4LkqZ-4,61190
+sourcecode/integration_detector.py,sha256=PibFXxwFHRNQ3twJFVkqzHTfNLRtEf94DK9fPDnAtfQ,15499
+sourcecode/jdk_exports.py,sha256=fCrlwNAXUT9gge_joq6kMnY3zJxYB2pxqy-0w3o3MJI,874
 sourcecode/license.py,sha256=wckiLuiwaE35KMCStUf1gYzleJuFe6qsSyxUQJvit3s,23500
 sourcecode/mcp_nudge.py,sha256=5ELU_ixzh6uA83NXLOZT8h00OhL53okfQdji3jyKOjg,2917
 sourcecode/metrics_analyzer.py,sha256=m0ENgtqKeBL17kUIK3fmGkgo7UfXBNHxCMj0H_Y5K7c,22750
-sourcecode/migrate_check.py,sha256=Z0AZhWuZWfGuG3dsQugJn92FRpId5-SFAoyMc1RBZHk,91908
+sourcecode/migrate_check.py,sha256=6Bp57IhQNqGhgL2hfqFasq3PHzsEWFa7abAQDv9t5MI,96348
 sourcecode/openapi_surface.py,sha256=BTt0K-woZbkbWTN77IkqeBm_Okag9owR0848fmot8sk,16207
 sourcecode/output_budget.py,sha256=Js9yUlfQtPhqBl9R6wn_9UHVjjJc3GtLcqyfjf5t50Q,9869
 sourcecode/path_filters.py,sha256=VnaD9jxZVNzluackNSTCdIddwzAqIseuSCs_A-gpCDM,6898
@@ -46,7 +47,7 @@ sourcecode/redactor.py,sha256=SB4hwIvg8h-hvcqKcDWaZvA-aSyn-at-BIRwa0tUv5E,3227
 sourcecode/relevance_scorer.py,sha256=0AgEt4KrV73nioMqBgjhGjtY7L2C7L7cSyKtj3IKcrw,9408
 sourcecode/rename_refactor.py,sha256=h6dNFlB9aZ_3q6heeHBkgXQeXaT03nvPSsYH6P8qxFg,12965
 sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ,22681
-sourcecode/repository_ir.py,sha256=Blo4rTCkY7EppwunxqlvI-1b9wU3EPLuHlZik3Ksz7c,224908
+sourcecode/repository_ir.py,sha256=tP9L8v9K2xg-xb93N1aELJP-pHHxww8537GZ7Sf0_94,229324
 sourcecode/ris.py,sha256=RcqLVwC-doFcKKViYDkCjZLBqf_wzLES7-F6vHEeWzE,20419
 sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_Xx58,18432
 sourcecode/scanner.py,sha256=WdOQ78mMzjR1NjmKTlbxdgwinnCTfAhxCVLBEFQiFHU,8899
@@ -56,7 +57,7 @@ sourcecode/semantic_analyzer.py,sha256=4OdG6tTSnTvq3_dSWMbQu8Ad1ndSCKeG-b9qM4hIx
 sourcecode/serializer.py,sha256=MSxYZ-_UYDPKMvg-hVk-MnKN-TfrmxXL202siCssa9U,129110
 sourcecode/spring_event_topology.py,sha256=5_ON_21Le5zbG-1GRc5GLIi5HJfy_QjcXLVPC5WeUGQ,18055
 sourcecode/spring_findings.py,sha256=G7Or2lKBUQbcTDqudLvSs9XvNg_YoAa-_lBOG_ULs8E,5457
-sourcecode/spring_impact.py,sha256=qLwLfItX_o9LU-k_qjhD2hFpTX3PpEQ85TsYTAArzvg,56016
+sourcecode/spring_impact.py,sha256=1Eu1vkdwTVsw92iBEJDe_i_FaSf4uGH9Rb0eSgIAAZc,57542
 sourcecode/spring_model.py,sha256=zOAgFmrRbG4a6KLm1TJl55aWMyPNsz3OS3FSczqPG6A,16594
 sourcecode/spring_security_audit.py,sha256=XtPJ1SXlZJ8k6VYmaWuAp7Bbir4UmreAL7doIGQ5I7o,20595
 sourcecode/spring_semantic.py,sha256=O1nKSGVzlukuxLHQVuCPxc-XrcrMFxwlHA20_dmEGgM,13307
@@ -75,7 +76,7 @@ sourcecode/detectors/elixir.py,sha256=jCpvt5Yi6jvplc80ovRtWh17q-11ZGo9qX7o8b57TJ
 sourcecode/detectors/go.py,sha256=2r66uRQfeTWsqxr4HDhT6vExZErby0t46QXLHVBRv9w,2782
 sourcecode/detectors/heuristic.py,sha256=7cRxrip4yIaggYzZJB6ef8yHKh-gHgiH_pXMFcjlyFU,3723
 sourcecode/detectors/hybrid.py,sha256=IGFRUVsAZ1ooRlFdznCeJAV6vy1yVDx-VyghvLtddXc,9101
-sourcecode/detectors/java.py,sha256=HZcK94A3FzhTMXveicKSSDJBvRbgeqnflEP_mPgaOpo,30438
+sourcecode/detectors/java.py,sha256=V9Eb2EMqEdonIhoegvFN2-z95R4Nu9q2y9G54baWShc,32298
 sourcecode/detectors/jvm_ext.py,sha256=EgHJ5W8EE-ZTN9V607mVzohyKgZE8Mc2jCi-DF8RAZU,2616
 sourcecode/detectors/nodejs.py,sha256=Hg3Gmr7yIMJFiLoDwOTk2wtu00wxIs6kZf-oQujTFUA,13187
 sourcecode/detectors/parsers.py,sha256=ugPg8yNUf0Ai1gA7Fnn6wAkYGFjTxRodSP3IeViYJJ4,2290
@@ -103,8 +104,8 @@ sourcecode/telemetry/consent.py,sha256=H5z2Wu63pZqbaKucRPoJQJ0zCo4cke9ZlBrJC-MaW
 sourcecode/telemetry/events.py,sha256=LtzYfaX9Ilckj5PTvAcTpDa9mLqDsYPDUiDkRa58piY,2580
 sourcecode/telemetry/filters.py,sha256=NHa5T-6DaZduQPFuC34jOqHWQgSizM-Ygq8aZ4j19ng,5834
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode-1.68.0.dist-info/METADATA,sha256=_4nRHRSnFFBpmv9OJqSFf30pGcWo7XpOC0gyAJgoT4c,47341
-sourcecode-1.68.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-1.68.0.dist-info/entry_points.txt,sha256=ex3F9rmbXeyDIoFQHtkEqTsKSaJow8F0LrVu8XfIktQ,57
-sourcecode-1.68.0.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-1.68.0.dist-info/RECORD,,
+sourcecode-1.70.0.dist-info/METADATA,sha256=JvldKhPtPefiKgs9lS0IJcWer4MmSHnXBL7NKW_PQS4,47341
+sourcecode-1.70.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-1.70.0.dist-info/entry_points.txt,sha256=ex3F9rmbXeyDIoFQHtkEqTsKSaJow8F0LrVu8XfIktQ,57
+sourcecode-1.70.0.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-1.70.0.dist-info/RECORD,,