sourcecode 2.5.2__py3-none-any.whl → 2.5.4__py3-none-any.whl

sourcecode/repository_ir.py

@@ -115,6 +115,11 @@ class EvidenceBundle:
 
 _PKG_RE = re.compile(r'^package\s+([\w.]+)\s*;', re.MULTILINE)
 _IMPORT_RE = re.compile(r'^import\s+(?:static\s+)?([\w.]+(?:\.\*)?)\s*;', re.MULTILINE)
+# Single-type imports only (`import a.b.Foo;`) — the declaration that binds a simple
+# name to exactly one type. Static imports bind a member, not a type, and wildcards
+# bind nothing resolvable; both fail to match ([\w.]+ cannot span the space before
+# a static FQN, and `*` is outside the class).
+_SINGLE_TYPE_IMPORT_RE = re.compile(r'^\s*import\s+([\w.]+)\s*;', re.MULTILINE)
 _ANN_RE = re.compile(r'^(@[\w.]+)')
 _ANN_WITH_ARGS_RE = re.compile(
     r'^(@[\w.]+)\s*'
@@ -125,9 +130,15 @@ _ANN_WITH_ARGS_RE = re.compile(
 
 _CLASS_DECL_RE = re.compile(
     r'(?:^|(?<=\s))'
-    r'(?P<kind>class|interface|enum|@interface)\s+'
+    r'(?P<kind>class|interface|enum|record|@interface)\s+'
     r'(?P<name>[A-Z]\w*)'
     r'(?:\s*<[^{;]*?(?=>|\{))?'
+    # P1-F: record component list `record Point(int x, int y)`. `[^{;]*` is greedy
+    # to the LAST ')' before the body brace, so annotated components with
+    # argument parens (`@JsonProperty("x") String name`) stay inside the group.
+    # `record` is a contextual keyword: requiring `Name(` + a terminal '{' keeps
+    # identifiers named record (variables, methods) from matching.
+    r'(?:\s*\((?P<components>[^{;]*)\))?'
     r'(?:\s+extends\s+(?P<extends>[\w.<>?,\s]+?))?'
     r'(?:\s+implements\s+(?P<implements>[\w.<>?,\s]+?))?'
     r'(?:\s+permits\s+[\w,\s]+?)?'
@@ -140,7 +151,7 @@ _CLASS_DECL_RE = re.compile(
 # edges the impact graph needs. `[^{;]*?` keeps the match within a single declaration
 # head (stops at the body `{` or a `;`), matching the precision of _CLASS_DECL_RE.
 _INHERIT_PRESCAN_RE = re.compile(
-    r'\b(?:class|interface)\s+[A-Z]\w*[^{;]*?\b(?:extends|implements)\b'
+    r'\b(?:class|interface|record)\s+[A-Z]\w*[^{;]*?\b(?:extends|implements)\b'
 )
 
 _METHOD_DECL_RE = re.compile(
@@ -192,6 +203,84 @@ _JAXRS_HTTP_ANNOTATIONS: frozenset[str] = frozenset({
 # Annotations whose args contain a path value and must be captured.
 _PATH_ANNOTATIONS: frozenset[str] = frozenset({"@Path"})
 
+# P1-E cheap pre-filter: only a zero-symbol file containing a type keyword
+# anywhere pays the linear mask + declaration check (reconciliation rule).
+_TYPE_DECL_KEYWORD_RE = re.compile(r"\b(?:class|interface|enum|record)\b")
+
+# P1-G: an inline-CLOSED block comment inside a declaration line.
+_INLINE_BLOCK_COMMENT_RE = re.compile(r"/\*.*?\*/")
+
+# SIM-1: `return new X(...)` inside a method body — the concrete type a locator
+# method instantiates when its DECLARED return type is unusable (`Object`).
+# Tolerates a package-qualified head (`return new org.x.Y(...)`).
+_RETURN_NEW_RE = re.compile(r"\breturn\s+new\s+(?:[a-z_]\w*\.)*([A-Z]\w*)\s*[(<]")
+
+
+def _note_return_new(annotation_values: dict, text: str) -> None:
+    """Accumulate distinct instantiated-return types on a method's annotation_values."""
+    for _rm in _RETURN_NEW_RE.finditer(text):
+        _t = _rm.group(1)
+        _prev = annotation_values.get("_returns_new", "")
+        _seen = _prev.split(",") if _prev else []
+        if _t not in _seen:
+            annotation_values["_returns_new"] = ",".join(_seen + [_t])
+
+
+def _scan_line_comments(line: str, in_block: bool) -> tuple[str, bool]:
+    """Remove block-comment spans from one line, STRING-LITERAL AWARE (P1-G).
+
+    Naive `"/*" in line` checks misread comment markers inside string literals
+    (`@Consumes("*/*")`, eureka DiscoveryJerseyProvider) and poison the block-
+    comment state for the rest of the file. This scanner tracks quotes so
+    markers inside strings/chars are code, drops `//` tails, and returns the
+    residual code text plus the new in-block state. Callers fast-path: only a
+    line containing a marker (or scanned while inside a block) pays this loop.
+    """
+    out: list[str] = []
+    i, n = 0, len(line)
+    in_str = in_chr = False
+    while i < n:
+        c = line[i]
+        if in_block:
+            if c == "*" and i + 1 < n and line[i + 1] == "/":
+                in_block = False
+                i += 2
+                continue
+            i += 1
+            continue
+        if in_str or in_chr:
+            out.append(c)
+            if c == "\\" and i + 1 < n:
+                out.append(line[i + 1])
+                i += 2
+                continue
+            if in_str and c == '"':
+                in_str = False
+            elif in_chr and c == "'":
+                in_chr = False
+            i += 1
+            continue
+        if c == '"':
+            in_str = True
+            out.append(c)
+            i += 1
+            continue
+        if c == "'":
+            in_chr = True
+            out.append(c)
+            i += 1
+            continue
+        if c == "/" and i + 1 < n:
+            if line[i + 1] == "/":
+                break  # line comment — rest of the line is not code
+            if line[i + 1] == "*":
+                in_block = True
+                i += 2
+                continue
+        out.append(c)
+        i += 1
+    return "".join(out), in_block
+
 # Security / authorization annotations whose args must be captured.
 # Includes standard Jakarta EE, JAX-RS, Quarkus/MicroProfile, and custom patterns.
 _PERMISSION_ANNOTATIONS: frozenset[str] = frozenset({
@@ -558,7 +647,7 @@ _ANN_PREFIX_RE = re.compile(r'^(?:@\w+\s*(?:\([^)]*\))?\s*)+')
 _STRING_LITERAL_RE = re.compile(r'"(?:[^"\\]|\\.)*"|\'(?:[^\'\\]|\\.)*\'')
 
 # Module-level cache for class-keyword detection (avoids recompilation per _extract_symbols call)
-_CLASS_KW_RE = re.compile(r'\b(?:class|interface|enum)\s+[A-Z]')
+_CLASS_KW_RE = re.compile(r'\b(?:class|interface|enum|record)\s+[A-Z]')
 
 
 # ---------------------------------------------------------------------------
@@ -769,6 +858,9 @@ def _extract_symbols(
     pending_anns: list[str] = []
     pending_ann_values: dict[str, str] = {}
     in_block_comment = False
+    # SIM-1: (symbol index, declaration-line depth) of the method whose body the
+    # scan is currently inside — target for `return new X(...)` attribution.
+    _ret_new_owner: Optional[tuple[int, int]] = None
 
     # BUG-PARSER-001: normalize multi-line class declarations where the opening brace
     # appears on a continuation line (e.g. "implements A,\n  B, C {").
@@ -832,14 +924,18 @@ def _extract_symbols(
         cur_line = _normalized_src_lines[_ni] if _ni < len(_normalized_src_lines) else None
         stripped = line.strip()
 
-        if in_block_comment:
-            if "*/" in stripped:
-                in_block_comment = False
-            continue
-        if "/*" in stripped:
-            if "*/" not in stripped:
-                in_block_comment = True
+        # P1-G: comment handling. Old code dropped ANY line containing a block-
+        # comment marker, silently erasing declarations glued to comments
+        # (`class Proc /* impl */{`, `*/public class X {`) — and a naive marker
+        # check misreads markers inside string literals (`@Consumes("*/*")`).
+        # Fast path: a line with no marker while outside a block skips the scan.
+        if in_block_comment and "*/" not in stripped:
             continue
+        if in_block_comment or "/*" in stripped:
+            stripped, in_block_comment = _scan_line_comments(stripped, in_block_comment)
+            stripped = stripped.strip()
+            if not stripped:
+                continue
         if stripped.startswith("//") or stripped.startswith("*"):
             continue
 
@@ -873,27 +969,38 @@ def _extract_symbols(
             modifiers = _extract_modifiers(stripped[:cls_m.start()])
             extends_str = (cls_m.group("extends") or "").strip()
             implements_str = (cls_m.group("implements") or "").strip()
+            # P1-F: record components carry the type's state — their types are
+            # real dependencies (imports_used) and the list belongs in the
+            # signature so consumers see the shape without re-reading source.
+            components_str = (cls_m.group("components") or "").strip()
 
             sig_types = ([extends_str] if extends_str else []) + (
                 [s.strip() for s in implements_str.split(",") if s.strip()]
                 if implements_str else []
             )
-            used = _resolve_types_from_text(" ".join(sig_types), import_map)
+            used = _resolve_types_from_text(
+                " ".join(sig_types) + (" " + components_str if components_str else ""),
+                import_map,
+            )
 
             sym_type = "interface" if kind_kw == "interface" else "class"
 
-            # symbol_kind distinguishes enum/annotation from class/interface
+            # symbol_kind distinguishes enum/annotation/record from class/interface
             if kind_kw == "enum":
                 sym_kind = "enum"
             elif kind_kw == "@interface":
                 sym_kind = "annotation"
             elif kind_kw == "interface":
                 sym_kind = "interface"
+            elif kind_kw == "record":
+                sym_kind = "record"
             else:
                 sym_kind = "class"
 
             _stable_id = _compute_stable_id(package, name, sym_kind, name)
             _sig_parts = [kind_kw, name]
+            if components_str:
+                _sig_parts.append(f"({components_str})")
             if extends_str:
                 _sig_parts.append(f"extends {extends_str}")
             if implements_str:
@@ -1003,6 +1110,10 @@ def _extract_symbols(
                     ))
                     pending_anns = []
                     pending_ann_values = {}
+                    # SIM-1: remember this method as the enclosing body for
+                    # `return new X(...)` attribution (locator child binding).
+                    _ret_new_owner = (len(symbols) - 1, depth)
+                    _note_return_new(symbols[-1].annotation_values, stripped)
                     depth += net
                     _pop_closed(class_stack, depth)
                     continue
@@ -1084,6 +1195,15 @@ def _extract_symbols(
                         _pop_closed(class_stack, depth)
                         continue
 
+        # SIM-1: attribute `return new X(...)` body statements to the enclosing
+        # method. Owner is cleared as soon as a line at (or above) the method's
+        # declaration depth is seen — the method body has closed.
+        if _ret_new_owner is not None:
+            if depth <= _ret_new_owner[1]:
+                _ret_new_owner = None
+            elif "return new" in stripped:
+                _note_return_new(symbols[_ret_new_owner[0]].annotation_values, stripped)
+
         pending_anns = []
         pending_ann_values = {}
         depth += net
@@ -1238,7 +1358,7 @@ _ANN_REF_TOKEN_RE = re.compile(r'\b[A-Z]\w*(?:\.\w+)+')
 # the class whose body encloses them.
 _ANN_OR_DECL_OR_BRACE_RE = re.compile(
     r'@([A-Z]\w*)\s*\('
-    r'|\b(?:class|interface|enum)\s+([A-Z]\w*)'
+    r'|\b(?:class|interface|enum|record)\s+([A-Z]\w*)'
     r'|([{}])'
 )
 
@@ -2000,33 +2120,85 @@ def _strip_leading_annotations(line: str) -> str:
     return line.strip()
 
 
-def _extract_field_types(source: str) -> dict[str, dict[str, str]]:
-    """{class_fqn -> {field_name -> declared_type_simple_name}} for EVERY field
-    (annotated or plain), the fact that binds an invocation receiver to a typed
-    dependency. Complements the injection graph, which only sees @-annotated /
+def _file_import_map(source: str) -> dict[str, str]:
+    """{simple name -> FQN} for the file's single-type imports — the per-file fact
+    that disambiguates a declared type whose simple name is not unique in the repo
+    (Broadleaf declares two `AdminSecurityService`; only the import says which)."""
+    out: dict[str, str] = {}
+    for fqn in _SINGLE_TYPE_IMPORT_RE.findall(source):
+        if "." in fqn:
+            out[fqn.rsplit(".", 1)[-1]] = fqn
+    return out
+
+
+def _record_component_pairs(components: str) -> list[tuple[str, str]]:
+    """(name, declared_type) pairs from a record component list (P1-F).
+
+    Depth-aware comma split so generic commas (`Map<String, X> m`) and
+    annotation-argument parens don't break components apart; leading
+    annotations stripped; varargs normalized to arrays.
+    """
+    parts: list[str] = []
+    buf: list[str] = []
+    d = 0
+    for ch in components:
+        if ch in "<(":
+            d += 1
+        elif ch in ">)":
+            d -= 1
+        if ch == "," and d == 0:
+            parts.append("".join(buf))
+            buf = []
+        else:
+            buf.append(ch)
+    if buf:
+        parts.append("".join(buf))
+    out: list[tuple[str, str]] = []
+    for p in parts:
+        p = re.sub(r"@[\w.]+(?:\([^)]*\))?\s*", "", p).strip()
+        p = p.replace("...", "[] ")
+        toks = p.rsplit(None, 1)
+        if len(toks) == 2 and toks[1].isidentifier():
+            out.append((toks[1], toks[0].strip()))
+    return out
+
+
+def _extract_field_types(
+    source: str, *, imports: Optional[dict[str, str]] = None
+) -> dict[str, dict[str, str]]:
+    """{class_fqn -> {field_name -> declared_type}} for EVERY field (annotated or
+    plain), the fact that binds an invocation receiver to a typed dependency.
+    Complements the injection graph, which only sees @-annotated /
     constructor-injected fields — plain setter/XML-injected fields (e.g. openmrs
     `private TemplateDAO templateDAO;`) are invisible to it but common.
 
+    The declared type is the file-import-resolved FQN when the owning file imports
+    it explicitly, else the bare simple name (wildcard import, same package, or
+    JDK-implicit). Consumers must accept both shapes — see `_resolve_declared_type`,
+    which finishes resolution against the repo symbol table.
+
     A hash-neutral side-stream (no new symbols/edges; not a cir_hash input),
     emitted only under emit_body_facts. Class-scope only: a field sits directly in
     a class body (depth == class-decl depth + 1), never inside a method body, so
     method locals are excluded. `_FIELD_DECL_RE` (name followed by ';'/'=') is
     disjoint from method decls (name followed by '(')."""
     out: dict[str, dict[str, str]] = {}
+    if imports is None:
+        imports = _file_import_map(source)
     depth = 0
     class_stack: list[tuple[str, int]] = []
     package = ""
     in_block = False
     for raw in source.splitlines():
         stripped = raw.strip()
-        if in_block:
-            if "*/" in stripped:
-                in_block = False
-            continue
-        if stripped.startswith("/*"):
-            if "*/" not in stripped:
-                in_block = True
+        # P1-G: string-literal-aware comment handling (see _extract_symbols).
+        if in_block and "*/" not in stripped:
             continue
+        if in_block or "/*" in stripped:
+            stripped, in_block = _scan_line_comments(stripped, in_block)
+            stripped = stripped.strip()
+            if not stripped:
+                continue
         if not stripped or stripped.startswith("//") or stripped.startswith("*"):
             continue
         if stripped.startswith("@"):
@@ -2048,6 +2220,16 @@ def _extract_field_types(source: str) -> dict[str, dict[str, str]]:
             fqn = f"{class_stack[-1][0]}.{name}" if class_stack else (
                 f"{package}.{name}" if package else name)
             class_stack.append((fqn, depth))
+            # P1-F: record components are implicit final fields — register them
+            # so a `component.method()` receiver binds to its declared type the
+            # same way an ordinary injected field does.
+            _comps = (cls_m.group("components") or "").strip()
+            if cls_m.group("kind") == "record" and _comps:
+                for _cn, _ct in _record_component_pairs(_comps):
+                    _outer, _ = _type_tokens(_ct)
+                    if _cn and _outer and _cn not in _JAVA_KEYWORDS:
+                        out.setdefault(fqn, {}).setdefault(
+                            _cn, imports.get(_outer, _outer))
             depth += net
             _pop_closed(class_stack, depth)
             continue
@@ -2060,7 +2242,8 @@ def _extract_field_types(source: str) -> dict[str, dict[str, str]]:
                 fname = fld_m.group("name")
                 outer, _ = _type_tokens(fld_m.group("type").strip())
                 if fname and outer and fname not in _JAVA_KEYWORDS:
-                    out.setdefault(class_stack[-1][0], {}).setdefault(fname, outer)
+                    out.setdefault(class_stack[-1][0], {}).setdefault(
+                        fname, imports.get(outer, outer))
         depth += net
         _pop_closed(class_stack, depth)
     return out
@@ -2839,14 +3022,22 @@ def _build_jaxrs_locator_map(symbols: list["SymbolRecord"]) -> dict[str, list[tu
         locator_path = _parse_route_path(sym.annotation_values.get("@Path", ""))
 
         ret = sym.return_type.strip()
-        if not ret:
-            continue
         # Simplify: strip package prefix and generics
-        ret_simple = ret.split(".")[-1].split("<")[0].strip()
-        if not ret_simple or ret_simple in _LOCATOR_SKIP_RETURN_TYPES:
-            continue
-        if ret_simple[0].islower():  # lowercase → primitive/variable, not a class
-            continue
+        ret_simple = ret.split(".")[-1].split("<")[0].strip() if ret else ""
+        if (not ret_simple or ret_simple in _LOCATOR_SKIP_RETURN_TYPES
+                or ret_simple[0].islower()):
+            # SIM-1: JAX-RS locators commonly declare `Object` while the body
+            # instantiates the concrete sub-resource (keycloak
+            # `@Path("auth") public Object auth() { return new
+            # AuthorizationEndpoint(...); }`). When the declared type is
+            # unusable, bind through the instantiated type — but only when it
+            # is UNAMBIGUOUS (exactly one distinct `return new` type; a
+            # dynamic/multi-branch locator stays unresolved, honestly).
+            _rn = sym.annotation_values.get("_returns_new", "")
+            _cands = [t for t in _rn.split(",") if t] if _rn else []
+            if len(set(_cands)) != 1 or _cands[0] in _LOCATOR_SKIP_RETURN_TYPES:
+                continue
+            ret_simple = _cands[0]
 
         parent_fqn = _enclosing_class(sym.symbol)
         parent_simple = parent_fqn.split(".")[-1]
@@ -2878,27 +3069,40 @@ def _resolve_jaxrs_prefixes(
         return own_prefixes
 
     new_visited = visited | {cls_simple}
-    full_prefixes: list[str] = []
+    # Rooted = composed through a parent that has a resolvable prefix (or a
+    # class-level @Path). Unrooted = the parent chain dead-ends in a class with
+    # no static mount point (keycloak: OIDCLoginProtocolService is mounted via a
+    # fully dynamic `getProtocol` SPI locator).
+    rooted_prefixes: list[str] = []
+    unrooted_prefixes: list[str] = []
 
     for parent_simple, locator_path in locator_map[cls_simple]:
         parent_full = _resolve_jaxrs_prefixes(parent_simple, class_info, locator_map, new_visited)
-        # Skip implementation/unrooted parents: if the parent resolves to only empty
-        # prefixes AND has no class-level @Path annotation, it is a concrete impl class
-        # (e.g. DefaultClientsApi implements ClientsApi) that duplicates a locator method
-        # from its interface. Including it would produce spurious short paths like /{id}
-        # alongside the correctly-resolved full path. The interface version is already
-        # in the locator_map and will produce the correct full path.
+        # Impl/unrooted parent split: a parent resolving to only empty prefixes
+        # with no class-level @Path is either a concrete impl class duplicating
+        # its interface's locator (e.g. DefaultClientsApi implements ClientsApi)
+        # or a genuinely unrooted chain. When ANY rooted composition exists it
+        # wins and the unrooted ones are dropped (the impl-duplicate case, as
+        # before). When NONE exists, the RELATIVE composition is still far more
+        # truthful than collapsing 39 endpoints to path "/" (SIM-1): emit
+        # locator_path + own path with the unresolved head simply absent.
         _parent_has_path_ann = class_info.get(parent_simple, {}).get("has_path_ann", False)
         _non_empty_parent = [p for p in parent_full if p]
-        if not _non_empty_parent and not _parent_has_path_ann:
-            continue
         use_parent_paths = _non_empty_parent if _non_empty_parent else parent_full
+        _bucket = (
+            rooted_prefixes if (_non_empty_parent or _parent_has_path_ann)
+            else unrooted_prefixes
+        )
         for pp in use_parent_paths:
             for op in own_prefixes:
                 combined = _join_path_segments(pp, locator_path, op)
-                full_prefixes.append(combined)
+                _bucket.append(combined)
 
-    return full_prefixes if full_prefixes else own_prefixes
+    if rooted_prefixes:
+        return rooted_prefixes
+    if unrooted_prefixes:
+        return unrooted_prefixes
+    return own_prefixes
 
 
 # ---------------------------------------------------------------------------
@@ -3624,6 +3828,7 @@ def _compute_analysis_gaps(
     spring_summary: dict,
     route_surface: list[dict],
     relations: list[RelationEdge],
+    unparsed_type_files: Optional[list[str]] = None,
 ) -> list[dict]:
     """Compute structural analysis gaps — real system failures, not cosmetic issues."""
     gaps: list[dict] = []
@@ -3636,6 +3841,26 @@ def _compute_analysis_gaps(
         })
         return gaps
 
+    # P1-E: parse-coverage reconciliation (file inventory × symbol index). A file
+    # that declares a type but produced zero symbols is silently invisible to the
+    # graph, callers and endpoints — an agent reading "0 callers" cannot know the
+    # defining or calling code was never modeled unless this gap says so.
+    if unparsed_type_files:
+        from sourcecode.reconciliation import reconcile_extraction_evidence
+        extracted = frozenset(s.declaring_file for s in symbols)
+        for rf in reconcile_extraction_evidence(
+            type_decl_files=frozenset(unparsed_type_files),
+            extracted_files=extracted,
+        ):
+            _sample = list(rf.symbols[:5])
+            gaps.append({
+                "area": rf.rule,
+                "reason": rf.detail + " Files: " + ", ".join(_sample)
+                + (", …" if len(rf.symbols) > 5 else ""),
+                "impact": "high",
+                "files": list(rf.symbols),
+            })
+
     controllers = spring_summary.get("controllers", [])
     if controllers and not route_surface:
         gaps.append({
@@ -3686,6 +3911,7 @@ def _assemble(
     spring_summary: dict,  # noqa: ARG001 — used internally via _spring_role on symbols
     route_diffs: list[dict] | None = None,
     custom_security: "tuple[CustomSecuritySpec, ...]" = (),
+    unparsed_type_files: Optional[list[str]] = None,
 ) -> dict:
     """Phase 5: Final assembly — single deterministic output contract."""
     sorted_syms = sorted(symbols, key=lambda s: s.symbol)
@@ -3950,7 +4176,10 @@ def _assemble(
     _route_surface = _build_route_surface(
         sorted_syms, route_diffs, extends_map=_extends_map, custom_security=custom_security
     )
-    _analysis_gaps = _compute_analysis_gaps(sorted_syms, spring_summary, _route_surface, sorted_rels)
+    _analysis_gaps = _compute_analysis_gaps(
+        sorted_syms, spring_summary, _route_surface, sorted_rels,
+        unparsed_type_files=unparsed_type_files,
+    )
 
     # Detect filter-based security model for the assembled IR.
     # Stored here so CIR projections (project_endpoint_surface) can read it without
@@ -4393,6 +4622,121 @@ def extract_file_ir(
     return _assemble(symbols, relations, changed_symbols, spring_summary, route_diffs)
 
 
+def _resolve_declared_type(
+    declared: str,
+    owner_cls: str,
+    type_simple_to_fqn: dict[str, list[str]],
+    known_types: set[str],
+) -> Optional[str]:
+    """The in-repo class FQN a field's declared type names, or None when it cannot
+    be pinned to exactly one.
+
+    `declared` is what `_extract_field_types` recorded: an import-resolved FQN when
+    the owning file imported the type explicitly, else a bare simple name. Resolution
+    follows Java scoping order — an explicit import shadows a same-package type
+    (JLS 6.4.1), which in turn beats a repo-wide simple-name guess. A simple name
+    that is neither same-package nor unique stays unresolved rather than guessed
+    (INV honesty): the wrong caller edge is worse than a missing one.
+    """
+    if not declared:
+        return None
+    if "." in declared:
+        return declared if declared in known_types else None
+    if "." in owner_cls:
+        scoped = f"{owner_cls.rsplit('.', 1)[0]}.{declared}"
+        if scoped in known_types:
+            return scoped
+    fqns = type_simple_to_fqn.get(declared)
+    return fqns[0] if fqns and len(fqns) == 1 else None
+
+
+def _type_indices(
+    symbols: list[SymbolRecord],
+) -> tuple[dict[str, list[str]], set[str], dict[str, dict[str, list[str]]]]:
+    """(type simple name → in-repo class FQN(s), all class FQNs, class FQN →
+    {method name → [method FQN]}) — the symbol-table views the call-edge post-passes
+    join against."""
+    type_simple_to_fqn: dict[str, list[str]] = {}
+    known_types: set[str] = set()
+    class_methods: dict[str, dict[str, list[str]]] = {}
+    for s in symbols:
+        if s.type in ("class", "interface", "enum", "record") and "#" not in s.symbol:
+            type_simple_to_fqn.setdefault(s.symbol.rsplit(".", 1)[-1], []).append(s.symbol)
+            known_types.add(s.symbol)
+        elif s.symbol_kind == "method" and "#" in s.symbol:
+            cls = _enclosing_class(s.symbol)
+            name = s.symbol.rsplit("#", 1)[1]
+            class_methods.setdefault(cls, {}).setdefault(name, []).append(s.symbol)
+    return type_simple_to_fqn, known_types, class_methods
+
+
+def _static_typed_call_edges(
+    body_facts: dict[str, list[dict]],
+    class_imports: dict[str, dict[str, str]],
+    field_types: dict[str, dict[str, str]],
+    symbols: list[SymbolRecord],
+) -> list[RelationEdge]:
+    """Method-level `calls` edges for a static invocation through a type receiver
+    (`Type.method(...)`).
+
+    The per-file static scan in `_build_relations` throws the callee name away and
+    attributes the call to every class in the file, so it can only say
+    `CallerClass --calls--> TargetClass`. Nothing ever lands on the method node, so
+    `impact-chain Utility#method` resolved 0 callers however many static call sites
+    existed: Broadleaf's `BroadleafCurrencyUtils#getNumberFormatFromCache` has 5+
+    in-repo callers and reported none, which P1-B could only flag as unproven
+    because the edge itself was missing.
+
+    Joins facts already extracted (no new parse — Prime Directive): the invocation
+    atom already carries `receiver`/`callee` for `Type.method(...)`, the owner file's
+    imports resolve the receiver to a type (`_resolve_declared_type`), and the symbol
+    table supplies that type's methods. A receiver that is a field, a lower-case
+    variable, or an unresolvable/library type yields nothing — unresolved stays
+    unresolved (INV honesty).
+
+    These edges add to the coarse class-level ones; see the call site for why
+    substituting them loses reach.
+    """
+    if not body_facts or not class_imports:
+        return []
+
+    type_simple_to_fqn, known_types, class_methods = _type_indices(symbols)
+    edges: list[RelationEdge] = []
+    for owner_fqn in sorted(body_facts):
+        owner_cls = _enclosing_class(owner_fqn)
+        imports = class_imports.get(owner_cls)
+        if imports is None:
+            continue
+        fields = field_types.get(owner_cls) or {}
+        for atom in body_facts[owner_fqn]:
+            if atom.get("fact") != "invocation":
+                continue
+            receiver, callee = atom.get("receiver"), atom.get("callee")
+            if not receiver or not callee or receiver == "this":
+                continue
+            if not receiver[0].isupper():
+                continue           # variable/field receiver — `_receiver_typed_call_edges`
+            if receiver in fields:
+                continue           # a field shadows the type name → the field pass owns it
+            target_cls = _resolve_declared_type(
+                imports.get(receiver, receiver), owner_cls, type_simple_to_fqn, known_types
+            )
+            if not target_cls or target_cls == owner_cls:
+                continue
+            target_methods = class_methods.get(target_cls, {}).get(callee)
+            if not target_methods:
+                continue           # callee not declared on the target type
+            for mfqn in target_methods:
+                edges.append(RelationEdge(
+                    from_symbol=owner_fqn,
+                    to_symbol=mfqn,
+                    type="calls",
+                    confidence="medium",
+                    evidence={"type": "method_call", "value": f"{receiver}.{callee}(...)"},
+                ))
+    return edges
+
+
 def _receiver_typed_call_edges(
     body_facts: dict[str, list[dict]],
     field_types: dict[str, dict[str, str]],
@@ -4412,30 +4756,22 @@ def _receiver_typed_call_edges(
     Joins facts already extracted (no new parse — Prime Directive):
       - invocation atom  (owner method → {receiver, callee})            [body_facts]
       - declared type of `receiver` on the owner's class                [field_types]
-      - target type resolved to a SINGLE in-repo class FQN              [symbols]
+      - target type resolved to a SINGLE in-repo class FQN, by the owner
+        file's import first and only then by simple name                [symbols]
       - callee resolved to that class's method(s) of that name          [symbols]
 
     Emits `owner_method --calls--> target_class#callee` (every overload of the name —
     arity is not resolved by name alone, matching `_intra_class_call_edges`). Anything
-    unresolved — a local variable (no field entry), a JDK/library type, an ambiguous
-    simple name, or a callee the target class does not declare — yields nothing: an
-    unresolved fact stays unresolved rather than being guessed (INV honesty). Runs as
-    a repo-wide post-pass because the target type + its methods live in other files.
+    unresolved — a local variable (no field entry), a JDK/library type, a simple name
+    that is still ambiguous after `_resolve_declared_type`, or a callee the target
+    class does not declare — yields nothing: an unresolved fact stays unresolved
+    rather than being guessed (INV honesty). Runs as a repo-wide post-pass because
+    the target type + its methods live in other files.
     """
     if not body_facts or not field_types:
         return []
 
-    # type simple name → in-repo class FQN(s); class FQN → {method name → [method FQN]}
-    type_simple_to_fqn: dict[str, list[str]] = {}
-    class_methods: dict[str, dict[str, list[str]]] = {}
-    for s in symbols:
-        if s.type in ("class", "interface", "enum", "record") and "#" not in s.symbol:
-            type_simple_to_fqn.setdefault(s.symbol.rsplit(".", 1)[-1], []).append(s.symbol)
-        elif s.symbol_kind == "method" and "#" in s.symbol:
-            cls = _enclosing_class(s.symbol)
-            name = s.symbol.rsplit("#", 1)[1]
-            class_methods.setdefault(cls, {}).setdefault(name, []).append(s.symbol)
-
+    type_simple_to_fqn, known_types, class_methods = _type_indices(symbols)
     edges: list[RelationEdge] = []
     for owner_fqn in sorted(body_facts):
         owner_cls = _enclosing_class(owner_fqn)
@@ -4448,13 +4784,13 @@ def _receiver_typed_call_edges(
             receiver, callee = atom.get("receiver"), atom.get("callee")
             if not receiver or receiver == "this" or not callee:
                 continue
-            tsimple = fmap.get(receiver)
-            if not tsimple:
+            declared = fmap.get(receiver)
+            if not declared:
                 continue                       # not a typed field (local / unknown)
-            tfqns = type_simple_to_fqn.get(tsimple)
-            if not tfqns or len(tfqns) != 1:
+            target_cls = _resolve_declared_type(
+                declared, owner_cls, type_simple_to_fqn, known_types)
+            if not target_cls:
                 continue                       # unresolved / ambiguous type → skip (honest)
-            target_cls = tfqns[0]
             if target_cls == owner_cls:
                 continue                       # intra-class handled by _intra_class_call_edges
             target_methods = class_methods.get(target_cls, {}).get(callee)
@@ -4508,6 +4844,7 @@ def build_repo_ir(
     _all_class_type_refs: dict[str, list[dict]] = {}
     _all_annotation_arg_values: dict[str, dict[str, dict[str, str]]] = {}
     _all_field_types: dict[str, dict[str, str]] = {}
+    _all_class_imports: dict[str, dict[str, str]] = {}
 
     # H-04: prefetch changed-file list once; avoids O(n) `git show` calls.
     # _since_changed=None means git unavailable → fall back to per-file fetch.
@@ -4542,6 +4879,9 @@ def build_repo_ir(
     # (package, imports, annotation-ref-pairs) for the reference-graph post-pass,
     # collected from BOTH fully-parsed and pre-scan-skipped files (BUG #2).
     _ann_ref_sources: list[tuple[str, list[str], list[tuple[str, str]]]] = []
+    # P1-E: files whose masked source declares a type but extraction yielded
+    # zero symbols — fed to the parse_coverage reconciliation rule at assembly.
+    _unparsed_type_files: list[str] = []
     for rel_path in sorted(file_paths):
         abs_path = root / rel_path
         try:
@@ -4555,6 +4895,15 @@ def build_repo_ir(
             source, rel_path, extra_capture=_extra_capture
         )
         all_symbols.extend(symbols)
+        # P1-E (parse-coverage reconciliation): a file that declares a type but
+        # yielded zero symbols is silently invisible to the graph. Record the
+        # candidate here (source is already in memory; masking only runs for the
+        # rare zero-symbol file) — the reconciliation rule turns the set into an
+        # analysis_gaps entry at assembly.
+        if not symbols and _TYPE_DECL_KEYWORD_RE.search(source):
+            from sourcecode.reconciliation import declares_java_type
+            if declares_java_type(_mask_java(source)):
+                _unparsed_type_files.append(rel_path)
         _per_file.append((rel_path, source, package, raw_imports, symbols))
         if "@" in source:
             _parsed_refs = _extract_annotation_type_refs(source, package)
@@ -4580,7 +4929,14 @@ def build_repo_ir(
             _all_guard_facts.update(_extract_guard_facts(symbols, source))
             _all_class_type_refs.update(_extract_class_type_refs(symbols))
             _all_annotation_arg_values.update(_parse_annotation_arg_values(symbols))
-            _all_field_types.update(_extract_field_types(source))
+            _f_imports = _file_import_map(source)
+            _all_field_types.update(_extract_field_types(source, imports=_f_imports))
+            # Every type declared in this file resolves simple names through this
+            # file's imports — the fact `_static_typed_call_edges` needs to bind a
+            # `Type.method(...)` receiver to a type (P1-A's rule, applied to statics).
+            for _s in symbols:
+                if _s.type in ("class", "interface", "enum", "record") and "#" not in _s.symbol:
+                    _all_class_imports[_s.symbol] = _f_imports
 
         old_source: Optional[str] = None
         if since:
@@ -4626,6 +4982,26 @@ def build_repo_ir(
             _receiver_typed_call_edges(_all_body_facts, _all_field_types, all_symbols)
         )
 
+    # Static calls through a type receiver (`Type.method(...)`). The per-file scan can
+    # only reach the target CLASS (it discards the callee), so no method-level query on
+    # a static utility ever resolved a caller.
+    #
+    # These edges are ADDED, never substituted for the class-level ones. Superseding the
+    # class edge was tried and measurably wrong: body facts cover method bodies only, so
+    # a static call in a field initializer or static block produces no invocation atom,
+    # and dropping the class edge there erased the coupling — Broadleaf's
+    # BroadleafCurrencyUtils lost transitive reach (1325 indirect callers → 561) and all
+    # 20 affected endpoints. The class-level edge is a coarse over-approximation (the
+    # scan attributes a call to every class in the file); this pass is precise but
+    # partial. Keeping both leaves a caller reported at both granularities (`X` and
+    # `X#m`) — redundant, but each statement is true, and no reach is lost.
+    if emit_body_facts:
+        all_relations.extend(
+            _static_typed_call_edges(
+                _all_body_facts, _all_class_imports, _all_field_types, all_symbols
+            )
+        )
+
     spring_summary = _build_spring_summary(all_symbols)
 
     # Deduplicate relations
@@ -4645,6 +5021,7 @@ def build_repo_ir(
     ir = _assemble(
         all_symbols, unique_relations, all_changed, spring_summary, route_diffs_arg,
         custom_security=_custom_sec_tuple,
+        unparsed_type_files=_unparsed_type_files,
     )
 
     # Fase 21: merge OpenAPI-spec-recovered routes for interface-defined controllers