sourcecode 2.5.2__tar.gz → 2.5.3__tar.gz

{sourcecode-2.5.2 → sourcecode-2.5.3}/CHANGELOG.md

@@ -1,5 +1,70 @@
 # Changelog
 
+## [2.5.3] — 2026-07-16
+
+**impact-chain caller resolution — three false-confident zeros closed.** All three
+defects produced the same dangerous shape: a method-scoped query returning
+`0 callers, risk=low, confidence=high, "isolated"` for a method with real call sites
+in source. Continuation of the 12-repo adversarial audit that drove 2.5.2.
+
+### Fixed
+
+- **Ambiguous field types dropped receiver-typed edges (P1-A)** (`repository_ir.py`):
+  `_receiver_typed_call_edges` resolved a field's declared type by **simple name only**,
+  so when two in-repo classes shared that name the lookup was ambiguous and the edge was
+  dropped — even though the owning file's `import` said exactly which type it held.
+  Broadleaf declares two `AdminSecurityService`, so
+  `impact-chain AdminSecurityService#sendResetPasswordNotification` reported an isolated
+  low-risk change for a method reached from the public `POST /sendResetPassword` handler.
+  `_extract_field_types` now records the import-resolved FQN and `_resolve_declared_type`
+  finishes resolution per Java scoping (an explicit import shadows a same-package type,
+  JLS 6.4.1). A name that is neither stays unresolved rather than guessed. `field_types`
+  values are now an FQN when the declaring file imported the type, else a simple name as
+  before; both consumers accept either shape, so a cached CIR from an older version still
+  resolves. Verified: query above → `AdminLoginController` / `POST /sendResetPassword`,
+  risk=medium; Broadleaf +40 edges, 0 lost; openmrs −2 edges, both phantom
+  (`import java.util.Iterator` bound by simple name to an in-repo nested `Iterator`).
+
+- **Static calls never landed on the method node (P1-B2)** (`repository_ir.py`): the
+  per-file static-call scan discards the callee name and attributes the call to every
+  class in the file, so it could only emit `CallerClass --calls--> TargetClass`. No
+  method-scoped query on a static utility could ever resolve a caller, however many call
+  sites existed (`BroadleafCurrencyUtils#getNumberFormatFromCache` → 0 callers, 5+ real
+  static call sites). A repo-wide post-pass now joins facts already extracted (no new
+  parse): the invocation atom carries receiver/callee for `Type.method(...)`, the owner
+  file's imports resolve the receiver via P1-A's `_resolve_declared_type`, and the symbol
+  table supplies that type's methods. Field receivers, lower-case variables and library
+  types stay unresolved. Verified: the query above returns 4 callers (all 4 confirmed in
+  source), high confidence, risk=medium; Broadleaf +1265 edges, openmrs +1487, 0 edges
+  lost anywhere; class-level results unchanged (75 unique caller classes, risk critical);
+  build time flat.
+
+- **Method-scoped empty blast claimed high confidence (P1-B)** (`spring_impact.py`):
+  every blind-spot guard was gated on `class_level_seed`, so a `Class#method` query never
+  reached one and an empty method blast was always narrated as
+  *"No callers or endpoints found. Low-risk isolated change."* — making the tool
+  contradict itself across granularity, silently, with the narrower and more natural
+  query being the less trustworthy one. When a method-scoped blast is empty but the
+  declaring class has inbound injects/imports, the result is now marked
+  `blind_spots: ["method_scope_unproven"]`, confidence drops to low, and the explanation
+  points at the class-level re-query. The method may well be uncalled; what is unproven is
+  the *emptiness* — so this warns rather than inventing callers, and risk stays as
+  computed (CH-005/CH-003/G-2 precedent). The "Low-risk isolated change" sentence is also
+  suppressed whenever *any* blind spot fired, which it already contradicted for the three
+  pre-existing class-level guards. Broadleaf survey (300 sampled methods, 197 empty
+  blasts): the guard fires on 42% of empty results, spot-checked true — static utility
+  callers, annotation attribute uses, ORM/serialization setters.
+
+### Known limitations
+
+- P1-B2's method-level static edges are **added**, not substituted for the class-level
+  ones, so a static caller is reported at both granularities (`X` and `X#m`) — redundant,
+  though each statement is true. Superseding was implemented first and measured wrong:
+  body facts cover method bodies only, so a static call in a field initializer or static
+  block yields no atom, and dropping the class edge there erased real coupling
+  (`BroadleafCurrencyUtils` lost 1325→561 transitive reach and all 20 affected endpoints).
+  Report-level de-duplication is queued in the backlog; no reach is lost today.
+
 ## [2.5.2] — 2026-07-14
 
 **impact-chain correctness + cold-scan performance.** Two fixes surfaced by an

{sourcecode-2.5.2 → sourcecode-2.5.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 2.5.2
+Version: 2.5.3
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm

{sourcecode-2.5.2 → sourcecode-2.5.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "2.5.2"
+version = "2.5.3"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-2.5.2 → sourcecode-2.5.3}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "2.5.2"
+__version__ = "2.5.3"

{sourcecode-2.5.2 → sourcecode-2.5.3}/src/sourcecode/canonical_ir.py

@@ -253,8 +253,9 @@ class CanonicalRepositoryIR:
 
     @property
     def field_types(self) -> dict[str, dict[str, str]]:
-        """{class_fqn -> {field_name -> declared_type_simple_name}} for every field
-        (annotated or plain). Binds an invocation receiver to a typed dependency —
+        """{class_fqn -> {field_name -> declared_type}} for every field (annotated or
+        plain); the type is import-resolved to an FQN when the declaring file imported
+        it, else a simple name. Binds an invocation receiver to a typed dependency —
         covers plain setter/XML-injected fields the injection graph cannot see. A
         projection over field declarations, no new symbols/edges. Present only when
         built via build_canonical_ir; not a cir_hash input."""

{sourcecode-2.5.2 → sourcecode-2.5.3}/src/sourcecode/repository_ir.py

@@ -115,6 +115,11 @@ class EvidenceBundle:
 
 _PKG_RE = re.compile(r'^package\s+([\w.]+)\s*;', re.MULTILINE)
 _IMPORT_RE = re.compile(r'^import\s+(?:static\s+)?([\w.]+(?:\.\*)?)\s*;', re.MULTILINE)
+# Single-type imports only (`import a.b.Foo;`) — the declaration that binds a simple
+# name to exactly one type. Static imports bind a member, not a type, and wildcards
+# bind nothing resolvable; both fail to match ([\w.]+ cannot span the space before
+# a static FQN, and `*` is outside the class).
+_SINGLE_TYPE_IMPORT_RE = re.compile(r'^\s*import\s+([\w.]+)\s*;', re.MULTILINE)
 _ANN_RE = re.compile(r'^(@[\w.]+)')
 _ANN_WITH_ARGS_RE = re.compile(
     r'^(@[\w.]+)\s*'
@@ -2000,19 +2005,39 @@ def _strip_leading_annotations(line: str) -> str:
     return line.strip()
 
 
-def _extract_field_types(source: str) -> dict[str, dict[str, str]]:
-    """{class_fqn -> {field_name -> declared_type_simple_name}} for EVERY field
-    (annotated or plain), the fact that binds an invocation receiver to a typed
-    dependency. Complements the injection graph, which only sees @-annotated /
+def _file_import_map(source: str) -> dict[str, str]:
+    """{simple name -> FQN} for the file's single-type imports — the per-file fact
+    that disambiguates a declared type whose simple name is not unique in the repo
+    (Broadleaf declares two `AdminSecurityService`; only the import says which)."""
+    out: dict[str, str] = {}
+    for fqn in _SINGLE_TYPE_IMPORT_RE.findall(source):
+        if "." in fqn:
+            out[fqn.rsplit(".", 1)[-1]] = fqn
+    return out
+
+
+def _extract_field_types(
+    source: str, *, imports: Optional[dict[str, str]] = None
+) -> dict[str, dict[str, str]]:
+    """{class_fqn -> {field_name -> declared_type}} for EVERY field (annotated or
+    plain), the fact that binds an invocation receiver to a typed dependency.
+    Complements the injection graph, which only sees @-annotated /
     constructor-injected fields — plain setter/XML-injected fields (e.g. openmrs
     `private TemplateDAO templateDAO;`) are invisible to it but common.
 
+    The declared type is the file-import-resolved FQN when the owning file imports
+    it explicitly, else the bare simple name (wildcard import, same package, or
+    JDK-implicit). Consumers must accept both shapes — see `_resolve_declared_type`,
+    which finishes resolution against the repo symbol table.
+
     A hash-neutral side-stream (no new symbols/edges; not a cir_hash input),
     emitted only under emit_body_facts. Class-scope only: a field sits directly in
     a class body (depth == class-decl depth + 1), never inside a method body, so
     method locals are excluded. `_FIELD_DECL_RE` (name followed by ';'/'=') is
     disjoint from method decls (name followed by '(')."""
     out: dict[str, dict[str, str]] = {}
+    if imports is None:
+        imports = _file_import_map(source)
     depth = 0
     class_stack: list[tuple[str, int]] = []
     package = ""
@@ -2060,7 +2085,8 @@ def _extract_field_types(source: str) -> dict[str, dict[str, str]]:
                 fname = fld_m.group("name")
                 outer, _ = _type_tokens(fld_m.group("type").strip())
                 if fname and outer and fname not in _JAVA_KEYWORDS:
-                    out.setdefault(class_stack[-1][0], {}).setdefault(fname, outer)
+                    out.setdefault(class_stack[-1][0], {}).setdefault(
+                        fname, imports.get(outer, outer))
         depth += net
         _pop_closed(class_stack, depth)
     return out
@@ -4393,6 +4419,121 @@ def extract_file_ir(
     return _assemble(symbols, relations, changed_symbols, spring_summary, route_diffs)
 
 
+def _resolve_declared_type(
+    declared: str,
+    owner_cls: str,
+    type_simple_to_fqn: dict[str, list[str]],
+    known_types: set[str],
+) -> Optional[str]:
+    """The in-repo class FQN a field's declared type names, or None when it cannot
+    be pinned to exactly one.
+
+    `declared` is what `_extract_field_types` recorded: an import-resolved FQN when
+    the owning file imported the type explicitly, else a bare simple name. Resolution
+    follows Java scoping order — an explicit import shadows a same-package type
+    (JLS 6.4.1), which in turn beats a repo-wide simple-name guess. A simple name
+    that is neither same-package nor unique stays unresolved rather than guessed
+    (INV honesty): the wrong caller edge is worse than a missing one.
+    """
+    if not declared:
+        return None
+    if "." in declared:
+        return declared if declared in known_types else None
+    if "." in owner_cls:
+        scoped = f"{owner_cls.rsplit('.', 1)[0]}.{declared}"
+        if scoped in known_types:
+            return scoped
+    fqns = type_simple_to_fqn.get(declared)
+    return fqns[0] if fqns and len(fqns) == 1 else None
+
+
+def _type_indices(
+    symbols: list[SymbolRecord],
+) -> tuple[dict[str, list[str]], set[str], dict[str, dict[str, list[str]]]]:
+    """(type simple name → in-repo class FQN(s), all class FQNs, class FQN →
+    {method name → [method FQN]}) — the symbol-table views the call-edge post-passes
+    join against."""
+    type_simple_to_fqn: dict[str, list[str]] = {}
+    known_types: set[str] = set()
+    class_methods: dict[str, dict[str, list[str]]] = {}
+    for s in symbols:
+        if s.type in ("class", "interface", "enum", "record") and "#" not in s.symbol:
+            type_simple_to_fqn.setdefault(s.symbol.rsplit(".", 1)[-1], []).append(s.symbol)
+            known_types.add(s.symbol)
+        elif s.symbol_kind == "method" and "#" in s.symbol:
+            cls = _enclosing_class(s.symbol)
+            name = s.symbol.rsplit("#", 1)[1]
+            class_methods.setdefault(cls, {}).setdefault(name, []).append(s.symbol)
+    return type_simple_to_fqn, known_types, class_methods
+
+
+def _static_typed_call_edges(
+    body_facts: dict[str, list[dict]],
+    class_imports: dict[str, dict[str, str]],
+    field_types: dict[str, dict[str, str]],
+    symbols: list[SymbolRecord],
+) -> list[RelationEdge]:
+    """Method-level `calls` edges for a static invocation through a type receiver
+    (`Type.method(...)`).
+
+    The per-file static scan in `_build_relations` throws the callee name away and
+    attributes the call to every class in the file, so it can only say
+    `CallerClass --calls--> TargetClass`. Nothing ever lands on the method node, so
+    `impact-chain Utility#method` resolved 0 callers however many static call sites
+    existed: Broadleaf's `BroadleafCurrencyUtils#getNumberFormatFromCache` has 5+
+    in-repo callers and reported none, which P1-B could only flag as unproven
+    because the edge itself was missing.
+
+    Joins facts already extracted (no new parse — Prime Directive): the invocation
+    atom already carries `receiver`/`callee` for `Type.method(...)`, the owner file's
+    imports resolve the receiver to a type (`_resolve_declared_type`), and the symbol
+    table supplies that type's methods. A receiver that is a field, a lower-case
+    variable, or an unresolvable/library type yields nothing — unresolved stays
+    unresolved (INV honesty).
+
+    These edges add to the coarse class-level ones; see the call site for why
+    substituting them loses reach.
+    """
+    if not body_facts or not class_imports:
+        return []
+
+    type_simple_to_fqn, known_types, class_methods = _type_indices(symbols)
+    edges: list[RelationEdge] = []
+    for owner_fqn in sorted(body_facts):
+        owner_cls = _enclosing_class(owner_fqn)
+        imports = class_imports.get(owner_cls)
+        if imports is None:
+            continue
+        fields = field_types.get(owner_cls) or {}
+        for atom in body_facts[owner_fqn]:
+            if atom.get("fact") != "invocation":
+                continue
+            receiver, callee = atom.get("receiver"), atom.get("callee")
+            if not receiver or not callee or receiver == "this":
+                continue
+            if not receiver[0].isupper():
+                continue           # variable/field receiver — `_receiver_typed_call_edges`
+            if receiver in fields:
+                continue           # a field shadows the type name → the field pass owns it
+            target_cls = _resolve_declared_type(
+                imports.get(receiver, receiver), owner_cls, type_simple_to_fqn, known_types
+            )
+            if not target_cls or target_cls == owner_cls:
+                continue
+            target_methods = class_methods.get(target_cls, {}).get(callee)
+            if not target_methods:
+                continue           # callee not declared on the target type
+            for mfqn in target_methods:
+                edges.append(RelationEdge(
+                    from_symbol=owner_fqn,
+                    to_symbol=mfqn,
+                    type="calls",
+                    confidence="medium",
+                    evidence={"type": "method_call", "value": f"{receiver}.{callee}(...)"},
+                ))
+    return edges
+
+
 def _receiver_typed_call_edges(
     body_facts: dict[str, list[dict]],
     field_types: dict[str, dict[str, str]],
@@ -4412,30 +4553,22 @@ def _receiver_typed_call_edges(
     Joins facts already extracted (no new parse — Prime Directive):
       - invocation atom  (owner method → {receiver, callee})            [body_facts]
       - declared type of `receiver` on the owner's class                [field_types]
-      - target type resolved to a SINGLE in-repo class FQN              [symbols]
+      - target type resolved to a SINGLE in-repo class FQN, by the owner
+        file's import first and only then by simple name                [symbols]
       - callee resolved to that class's method(s) of that name          [symbols]
 
     Emits `owner_method --calls--> target_class#callee` (every overload of the name —
     arity is not resolved by name alone, matching `_intra_class_call_edges`). Anything
-    unresolved — a local variable (no field entry), a JDK/library type, an ambiguous
-    simple name, or a callee the target class does not declare — yields nothing: an
-    unresolved fact stays unresolved rather than being guessed (INV honesty). Runs as
-    a repo-wide post-pass because the target type + its methods live in other files.
+    unresolved — a local variable (no field entry), a JDK/library type, a simple name
+    that is still ambiguous after `_resolve_declared_type`, or a callee the target
+    class does not declare — yields nothing: an unresolved fact stays unresolved
+    rather than being guessed (INV honesty). Runs as a repo-wide post-pass because
+    the target type + its methods live in other files.
     """
     if not body_facts or not field_types:
         return []
 
-    # type simple name → in-repo class FQN(s); class FQN → {method name → [method FQN]}
-    type_simple_to_fqn: dict[str, list[str]] = {}
-    class_methods: dict[str, dict[str, list[str]]] = {}
-    for s in symbols:
-        if s.type in ("class", "interface", "enum", "record") and "#" not in s.symbol:
-            type_simple_to_fqn.setdefault(s.symbol.rsplit(".", 1)[-1], []).append(s.symbol)
-        elif s.symbol_kind == "method" and "#" in s.symbol:
-            cls = _enclosing_class(s.symbol)
-            name = s.symbol.rsplit("#", 1)[1]
-            class_methods.setdefault(cls, {}).setdefault(name, []).append(s.symbol)
-
+    type_simple_to_fqn, known_types, class_methods = _type_indices(symbols)
     edges: list[RelationEdge] = []
     for owner_fqn in sorted(body_facts):
         owner_cls = _enclosing_class(owner_fqn)
@@ -4448,13 +4581,13 @@ def _receiver_typed_call_edges(
             receiver, callee = atom.get("receiver"), atom.get("callee")
             if not receiver or receiver == "this" or not callee:
                 continue
-            tsimple = fmap.get(receiver)
-            if not tsimple:
+            declared = fmap.get(receiver)
+            if not declared:
                 continue                       # not a typed field (local / unknown)
-            tfqns = type_simple_to_fqn.get(tsimple)
-            if not tfqns or len(tfqns) != 1:
+            target_cls = _resolve_declared_type(
+                declared, owner_cls, type_simple_to_fqn, known_types)
+            if not target_cls:
                 continue                       # unresolved / ambiguous type → skip (honest)
-            target_cls = tfqns[0]
             if target_cls == owner_cls:
                 continue                       # intra-class handled by _intra_class_call_edges
             target_methods = class_methods.get(target_cls, {}).get(callee)
@@ -4508,6 +4641,7 @@ def build_repo_ir(
     _all_class_type_refs: dict[str, list[dict]] = {}
     _all_annotation_arg_values: dict[str, dict[str, dict[str, str]]] = {}
     _all_field_types: dict[str, dict[str, str]] = {}
+    _all_class_imports: dict[str, dict[str, str]] = {}
 
     # H-04: prefetch changed-file list once; avoids O(n) `git show` calls.
     # _since_changed=None means git unavailable → fall back to per-file fetch.
@@ -4580,7 +4714,14 @@ def build_repo_ir(
             _all_guard_facts.update(_extract_guard_facts(symbols, source))
             _all_class_type_refs.update(_extract_class_type_refs(symbols))
             _all_annotation_arg_values.update(_parse_annotation_arg_values(symbols))
-            _all_field_types.update(_extract_field_types(source))
+            _f_imports = _file_import_map(source)
+            _all_field_types.update(_extract_field_types(source, imports=_f_imports))
+            # Every type declared in this file resolves simple names through this
+            # file's imports — the fact `_static_typed_call_edges` needs to bind a
+            # `Type.method(...)` receiver to a type (P1-A's rule, applied to statics).
+            for _s in symbols:
+                if _s.type in ("class", "interface", "enum", "record") and "#" not in _s.symbol:
+                    _all_class_imports[_s.symbol] = _f_imports
 
         old_source: Optional[str] = None
         if since:
@@ -4626,6 +4767,26 @@ def build_repo_ir(
             _receiver_typed_call_edges(_all_body_facts, _all_field_types, all_symbols)
         )
 
+    # Static calls through a type receiver (`Type.method(...)`). The per-file scan can
+    # only reach the target CLASS (it discards the callee), so no method-level query on
+    # a static utility ever resolved a caller.
+    #
+    # These edges are ADDED, never substituted for the class-level ones. Superseding the
+    # class edge was tried and measurably wrong: body facts cover method bodies only, so
+    # a static call in a field initializer or static block produces no invocation atom,
+    # and dropping the class edge there erased the coupling — Broadleaf's
+    # BroadleafCurrencyUtils lost transitive reach (1325 indirect callers → 561) and all
+    # 20 affected endpoints. The class-level edge is a coarse over-approximation (the
+    # scan attributes a call to every class in the file); this pass is precise but
+    # partial. Keeping both leaves a caller reported at both granularities (`X` and
+    # `X#m`) — redundant, but each statement is true, and no reach is lost.
+    if emit_body_facts:
+        all_relations.extend(
+            _static_typed_call_edges(
+                _all_body_facts, _all_class_imports, _all_field_types, all_symbols
+            )
+        )
+
     spring_summary = _build_spring_summary(all_symbols)
 
     # Deduplicate relations

{sourcecode-2.5.2 → sourcecode-2.5.3}/src/sourcecode/semantic_impact_engine.py

@@ -28,6 +28,7 @@ from __future__ import annotations
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, Optional
 
+from sourcecode.repository_ir import _resolve_declared_type
 from sourcecode.semantic_services import SemanticServices
 
 if TYPE_CHECKING:  # avoid import cycle
@@ -236,13 +237,15 @@ class SemanticImpactEngine:
         """(field_name, type_fqn) for fields whose declared type resolves to a role
         in `roles` — the plain setter/XML-injected dependencies the injection graph
         cannot see (e.g. openmrs `private TemplateDAO templateDAO;`). Uses field-type
-        facts (#10) resolved to a concrete type by simple name (unambiguous only)."""
+        facts (#10), which carry the owning file's import-resolved FQN when it had
+        one; a bare simple name still resolves only while unambiguous."""
         by_simple = self.s.types_by_simple()
+        known = {f for fqns in by_simple.values() for f in fqns}
         out: list[tuple[str, str]] = []
-        for fname, tsimple in sorted(self.s.field_types_of(owner_fqn).items()):
-            fqns = by_simple.get(tsimple, [])
-            if len(fqns) == 1 and self._role(fqns[0]) in roles:
-                out.append((fname, fqns[0]))
+        for fname, declared in sorted(self.s.field_types_of(owner_fqn).items()):
+            fqn = _resolve_declared_type(declared, owner_fqn, by_simple, known)
+            if fqn and self._role(fqn) in roles:
+                out.append((fname, fqn))
         return out
 
     def _called_via_receiver(self, owner_fqn: str, receiver: str) -> Optional[str]:

{sourcecode-2.5.2 → sourcecode-2.5.3}/src/sourcecode/semantic_services.py

@@ -209,9 +209,11 @@ class SemanticServices:
         return self._g.annotation_arg_values_in(fqn)
 
     def field_types_of(self, class_fqn: str) -> dict[str, str]:
-        """{field_name -> declared_type_simple_name} for a class's fields (annotated
-        or plain). Resolves a body invocation's receiver to its typed dependency —
-        the fact injection edges miss for plain setter/XML-injected fields."""
+        """{field_name -> declared_type} for a class's fields (annotated or plain).
+        Resolves a body invocation's receiver to its typed dependency — the fact
+        injection edges miss for plain setter/XML-injected fields. The type is the
+        FQN when the declaring file imported it explicitly, else a simple name;
+        `repository_ir._resolve_declared_type` handles both."""
         return self._g.field_types_in(class_fqn)
 
     def return_type_index(self) -> dict[str, set[str]]:

{sourcecode-2.5.2 → sourcecode-2.5.3}/src/sourcecode/spring_impact.py

@@ -744,10 +744,21 @@ def _build_chain_explanation(
     endpoints_affected: int,
     findings: int,
     confidence: str,
+    blind_spot: bool = False,
 ) -> str:
     """Human-readable rationale, phrased to match the `impact` command's
-    explanation so both surfaces read consistently."""
+    explanation so both surfaces read consistently.
+
+    `blind_spot` says a positively-detected gap explains the empty result, so it must
+    not be narrated as an isolated change: the warnings carry the diagnosis, and this
+    sentence is what an agent quotes."""
     if not direct_callers and not indirect_callers and not endpoints_affected:
+        if blind_spot:
+            return (
+                "No callers or endpoints resolved, but this analysis has a known blind "
+                "spot (see analysis_warnings) — an empty result here is NOT evidence of "
+                "an isolated or low-risk change."
+            )
         return "No callers or endpoints found in the impact chain. Low-risk isolated change."
     parts: list[str] = []
     if direct_callers:
@@ -1130,6 +1141,43 @@ class ImpactOrchestrator:
                     "proof this symbol is unused."
                 )
 
+        # P1-B: every guard above needs a class-level seed, so a `Class#method` query
+        # never reached one — an empty method blast was reported as a high-confidence
+        # "low-risk isolated change" no matter what was known about the class. When the
+        # declaring class has inbound DI/import edges, the class-level query resolves
+        # those callers correctly (they land on the class node), so the tool used to
+        # contradict itself across granularity — "isolated" for the method, "critical"
+        # for its class — with no signal that the narrower, more natural query was the
+        # less trustworthy one. The method may still be genuinely uncalled; what is
+        # unproven is the *emptiness*, so this downgrades confidence and warns rather
+        # than inventing callers.
+        method_scope_blind_spot = False
+        if empty_blast and not class_level_seed and resolution != "not_found":
+            _crev = cir.reverse_graph.get(_class_of(resolved_symbol)) or {}
+            method_scope_inbound = sorted(
+                {c for et in ("injects", "imports") for c in (_crev.get(et) or [])}
+            )
+            if method_scope_inbound:
+                method_scope_blind_spot = True
+                warnings.append(
+                    f"Method-scoped empty blast radius is unproven (P1-B): no call edge "
+                    f"resolves to this method, but {len(method_scope_inbound)} in-repo "
+                    f"class(es) inject or import the declaring class "
+                    f"{_class_of(resolved_symbol)}. The call may travel an edge the "
+                    "graph does not model (wildcard-imported or generic receiver, "
+                    "reflection, method reference, framework callback). 0 callers is "
+                    "NOT proof this method is unused — re-query at class level (drop "
+                    "the '#method') to see the declaring class's callers."
+                )
+
+        blind_spots = (
+            # framework_di stops being a blind spot once CH-007 recovers callers
+            (["framework_di"] if framework_di_blind_spot and not di_recovered else [])
+            + (["value_type"] if value_type_blind_spot else [])
+            + (["unresolved_refs"] if unresolved_ref_blind_spot else [])
+            + (["method_scope_unproven"] if method_scope_blind_spot else [])
+        )
+
         confidence: str
         if resolution == "not_found":
             confidence = "low"
@@ -1137,7 +1185,12 @@ class ImpactOrchestrator:
             # Callers recovered structurally via the external-interface DI bridge.
             # Unambiguous binding (single in-repo impl) → medium; ambiguous → low.
             confidence = "low" if di_binding_ambiguous else "medium"
-        elif framework_di_blind_spot or value_type_blind_spot or unresolved_ref_blind_spot:
+        elif (
+            framework_di_blind_spot
+            or value_type_blind_spot
+            or unresolved_ref_blind_spot
+            or method_scope_blind_spot
+        ):
             confidence = "low"
         elif resolution == "partial" or confidence_reducing:
             confidence = "medium"
@@ -1168,6 +1221,7 @@ class ImpactOrchestrator:
                 len(endpoints_affected),
                 len(impact_findings),
                 confidence,
+                blind_spot=bool(blind_spots),
             ),
             metadata={
                 "analysis_depth": depth,
@@ -1177,12 +1231,7 @@ class ImpactOrchestrator:
                 "risk_score": risk_score,
                 "model_build_time_ms": model.build_time_ms,
                 "query_time_ms": elapsed_ms,
-                "blind_spots": (
-                    # framework_di stops being a blind spot once CH-007 recovers callers
-                    (["framework_di"] if framework_di_blind_spot and not di_recovered else [])
-                    + (["value_type"] if value_type_blind_spot else [])
-                    + (["unresolved_refs"] if unresolved_ref_blind_spot else [])
-                ),
+                "blind_spots": blind_spots,
                 "external_supertypes": external_supertypes,
                 "external_iface_callers_recovered": len(di_recovered_callers),
                 "external_iface_binding_ambiguous": di_binding_ambiguous,