sourcecode 5.4.2__tar.gz → 5.5.1__tar.gz

{sourcecode-5.4.2 → sourcecode-5.5.1}/CHANGELOG.md

@@ -2,6 +2,55 @@
 
 ## [Unreleased]
 
+## [5.5.1] — 2026-08-13
+
+**External audit corrections and command execution performance.**
+
+### Fixed
+- **Impact callers** now expand accessor and interface frontiers consistently,
+  with caller symbols remaining a refinement of caller classes.
+- **Endpoint and validation contracts** now expose test-surface policy, reuse
+  servlet declarations, and require real `Validator`/`setValidator` evidence.
+- **Modernization references** now recognize nested types used by their
+  enclosing class.
+- **Spring audit output** is bounded by default while explicit full output
+  remains available through `--output` and `--compact`.
+- **Repeated command execution** reuses the cached analysis context and reports
+  independent cache-layer states for context, parse, snapshot, and RIS.
+
+### Documentation
+- Closed the 2026-08-13 external audit backlog in the roadmap with fix hashes
+  and regression coverage.
+
+## [5.5.0] — 2026-08-12
+
+**Audit backlog resolved and performance signals made explicit.**
+This release folds in the latest external audit queue: programmatic Spring
+validation now contributes to `validation` gaps and confidence, servlet and
+endpoint publishing preserve extension mappings and `ANY` methods, reference
+classification distinguishes class literals from config wires, and the cache
+model now warns about large repositories against the correct scale. The roadmap
+also records the audit backlog, including the command-execution timing
+regression called out in the report.
+
+### Fixed
+- **Programmatic validation is now surfaced.** `Validator` and `@InitBinder`
+  evidence now affect `validation` gaps and overall confidence, and the payload
+  carries the non-coverage note for that limit.
+- **Servlet extension mappings stay visible.** Patterns such as `*.ftl` and
+  `*.vm` are preserved in the servlet surface instead of being dropped.
+- **Methodless request mappings publish as `ANY`.** `@RequestMapping` without a
+  declared method is no longer narrowed to `GET`.
+- **Class literals count as references.** `Foo.class` hits now promote the
+  type to `referenced` instead of `unknown_framework_dispatch`.
+- **Large-repository cache advice compares against the right scale.** The size
+  warning now tells the operator when the repository exceeds the measured
+  reference population.
+
+### Documentation
+- Added the external 2026-08-12 audit queue and its performance backlog to the
+  roadmap.
+
 ## [5.4.2] — 2026-08-12
 
 **External audit fixes and roadmap alignment.**

{sourcecode-5.4.2 → sourcecode-5.5.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 5.4.2
+Version: 5.5.1
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.4.2-blue)
+![Version](https://img.shields.io/badge/version-5.5.1-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -126,7 +126,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.4.2 — and, on a build that has aged,
+ask version                    # ask 5.5.1 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.4.2 → sourcecode-5.5.1}/README.md

@@ -4,7 +4,7 @@
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-5.4.2-blue)
+![Version](https://img.shields.io/badge/version-5.5.1-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -88,7 +88,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 5.4.2 — and, on a build that has aged,
+ask version                    # ask 5.5.1 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-5.4.2 → sourcecode-5.5.1}/docs/USER_GUIDE.md

@@ -136,7 +136,7 @@ pipx install sourcecode   # isolated install, no venv needed
 
 # Verify
 ask version
-# ask 5.4.2
+# ask 5.5.1
 ```
 
 Requires Python 3.9+.

{sourcecode-5.4.2 → sourcecode-5.5.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "5.4.2"
+version = "5.5.1"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-5.4.2 → sourcecode-5.5.1}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "5.4.2"
+__version__ = "5.5.1"

{sourcecode-5.4.2 → sourcecode-5.5.1}/src/sourcecode/cache_model.py

@@ -492,6 +492,7 @@ class Conditioning:
     scope: str                              # "3 342 Java files, cache cold"
     transfers: "Optional[bool]"             # do the reference figures apply here?
     per_command: "dict[str, str]"           # command → how it can be run here
+    java_files: "Optional[int]" = None      # measured scope size, if available
 
     def statement(self) -> str:
         """One sentence about whether the figures below transfer to this scope."""
@@ -500,6 +501,14 @@ class Conditioning:
                 f"This repository ({self.scope}) was not measured, so nothing below "
                 f"is claimed about it: the figures are the reference repository's."
             )
+        if self.java_files is not None and self.java_files > REFERENCE_JAVA_FILES:
+            return (
+                f"This repository ({self.scope}) is larger than the repository the "
+                f"figures below were measured on ({REFERENCE_JAVA_FILES} Java files), "
+                f"and what cost tracks here is the build rather than the file count: "
+                f"{FIELD_ANCHOR}. Read each figure as the reference's, not as yours; "
+                f"the `here:` lines say how each command can be run on this one."
+            )
         if self.transfers:
             return (
                 f"This repository ({self.scope}) is within the size the figures "

{sourcecode-5.4.2 → sourcecode-5.5.1}/src/sourcecode/cli.py

@@ -27,6 +27,7 @@ from sourcecode.phased_run import PhasedRun
 from sourcecode.partial_contract import PARTIAL_EXIT_CODE as _PARTIAL_EXIT
 from sourcecode.partial_contract import read_count as _read_count
 from sourcecode import perf
+from sourcecode.non_coverage import block as _non_coverage_block
 from sourcecode.caller_metrics import (
     CALLER_METRIC_RECONCILIATION,
     CYCLE_METRIC_RECONCILIATION,
@@ -3456,6 +3457,9 @@ def main(
     _core_hash = ""
     _core_flags_str = ""
     _view_flags_str = ""
+    # Reuse the freshness decision for cache metadata; otherwise the root
+    # command repeats a full Git status walk after the analysis completes.
+    _tree_is_dirty: Optional[bool] = None
 
     if not no_cache:
         try:
@@ -3505,6 +3509,8 @@ def main(
                 Path(_git_root_str) if _git_root_str else target,
                 scope=target,
             )
+            if _tree_sig and _git_sha:
+                _tree_is_dirty = _tree_sig != _git_sha
             if _tree_sig:
                 _core_key = f"{_tree_sig}-{_core_h}"
             else:
@@ -3820,7 +3826,11 @@ def main(
             if format == "json":
                 try:
                     from sourcecode.ris import _has_uncommitted_changes as _huc
-                    _uncommitted = _huc(target)
+                    _uncommitted = (
+                        _tree_is_dirty
+                        if _tree_is_dirty is not None
+                        else _huc(target)
+                    )
                 except Exception:
                     _uncommitted = False
                 _data_scope = "COMPACT" if compact else ("AGENT" if agent else "FULL")
@@ -4716,7 +4726,11 @@ def main(
     if format == "json":
         try:
             from sourcecode.ris import _has_uncommitted_changes as _huc_fresh
-            _uncommitted_fresh = _huc_fresh(target)
+            _uncommitted_fresh = (
+                _tree_is_dirty
+                if _tree_is_dirty is not None
+                else _huc_fresh(target)
+            )
             # _huc_fresh uses --untracked-files=no — it misses repos where all
             # files are untracked (no staged/unstaged changes to tracked files).
             # Promote to True when _allowed_changed_files contains untracked files.
@@ -6502,6 +6516,10 @@ def endpoints_cmd(
              "the endpoint count, and the endpoint total is carried across as one "
              "number rather than 3 500 rows.",
     ),
+    include_tests: bool = typer.Option(
+        False, "--include-tests",
+        help="Include endpoints from test source and test-fixture modules; excluded by default.",
+    ),
     client_usage: bool = typer.Option(
         False, "--client-usage",
         help="Join the routes against the HTTP calls written in the TypeScript/"
@@ -6562,7 +6580,7 @@ def endpoints_cmd(
     _prog = Progress()
     _prog.start("scanning endpoints")
     try:
-        data = _extract_java_endpoints(target)
+        data = _extract_java_endpoints(target, include_tests=include_tests)
     finally:
         _prog.finish()
 
@@ -7287,6 +7305,23 @@ def validation_cmd(
     except Exception:
         pass
 
+    if data.get("programmatic_validation", {}).get("detected"):
+        data.setdefault("non_coverage", _non_coverage_block("validation"))
+        _vc = data.get("validation_confidence")
+        if isinstance(_vc, dict):
+            _vc["overall"] = "Likely"
+            _vc["claim"] = (
+                "Declared constraints are present, but programmatic Spring "
+                "Validator wiring was detected outside this surface's model"
+            )
+            limits = _vc.setdefault("known_precision_limits", [])
+            note = (
+                "Programmatic Spring Validator / @InitBinder wiring is outside the "
+                "declared-constraint surface."
+            )
+            if note not in limits:
+                limits.append(note)
+
     if path_prefix:
         data["endpoints"] = [
             e for e in data.get("endpoints", [])
@@ -8971,9 +9006,26 @@ def spring_audit_cmd(
             # 9,53 s on a 1 303-file repository) and it is the same parse the other
             # knowledge commands share, so it is fetched rather than rebuilt — which
             # is what makes a warm worth anything here (cold == warm before C3-94).
-            cir = _ctxcache.shared_cir(
-                target, file_list, progress=_work_sink(_prog)
+            _repo_root = _ctxcache.repo_root_of(target)
+            cir, _cir_lookup = _ctxcache.get_or_build_cir(
+                _repo_root, target, file_list, progress=_work_sink(_prog)
             )
+            _cache_state = {
+                "context": "warm" if _cir_lookup.hit else "cold",
+                "parse": "warm" if _cir_lookup.hit else "cold",
+            }
+            try:
+                from sourcecode import cache as _cache_state_mod
+                _cache_status = _cache_state_mod.status(target)
+                _cache_state["snapshot"] = (
+                    "warm" if _cache_status.get("cached_cores") else "cold"
+                )
+                _cache_state["ris"] = (
+                    "warm" if _cache_status.get("ris_exists") else "cold"
+                )
+            except Exception:
+                _cache_state["snapshot"] = "unknown"
+                _cache_state["ris"] = "unknown"
             # C3-85: the stretch between the last `linking` tick and the first rule
             # tick reports nothing, and what stays on the line is `n/n` — a counter
             # that finished, reading as a stage still running. Measured on keycloak
@@ -9124,7 +9176,18 @@ def spring_audit_cmd(
                         "phase that never ran is not evidence there is none."
                     )
 
-            data = combined.to_compact_dict() if compact else combined.to_dict()
+            _bounded_default = (
+                not compact and output_path is None and format == "json" and not table
+            )
+            data = (
+                combined.to_compact_dict()
+                if compact or _bounded_default
+                else combined.to_dict()
+            )
+            if _bounded_default:
+                data.pop("mode", None)
+                data["default_output"] = "bounded"
+            data.setdefault("metadata", {})["cache_layers"] = _cache_state
             if _stopped_early:
                 # C3-87: the block is composed by `PhasedRun.status`, which is the
                 # authority `risk` is now bound to as well — one vocabulary for
@@ -14387,7 +14450,8 @@ def _cache_model_conditioning(path: Path) -> Any:
                 line += f" ({found.reference})"
             per_command[row.command] = line
         return _cmodel.Conditioning(
-            scope=scope.describe(), transfers=transfers, per_command=per_command
+            scope=scope.describe(), transfers=transfers, per_command=per_command,
+            java_files=scope.java_files,
         )
     except Exception:
         # A cost note is never worth failing a command that answers.

{sourcecode-5.4.2 → sourcecode-5.5.1}/src/sourcecode/non_coverage.py

@@ -321,6 +321,27 @@ NON_COVERAGE: tuple[NonCoverage, ...] = (
             "routes) is a measurement this command does not yet make."
         ),
     ),
+    NonCoverage(
+        id="NC-011",
+        surface="validation",
+        not_covered=(
+            "Programmatic Spring request-body validation wired with "
+            "`org.springframework.validation.Validator` or `@InitBinder`."
+        ),
+        why=(
+            "This surface reads declared bean-validation constraints recovered from "
+            "OpenAPI or DTO annotations. A validator registered in controller code "
+            "can enforce body rules without any declarative constraint on the "
+            "payload, so treating the result as fully verified would overstate what "
+            "the declared-constraint scan proves."
+        ),
+        instead=(
+            "`@InitBinder` / `setValidator(...)` wiring, or a Spring `Validator` "
+            "implementation, which this surface reports only as a coverage "
+            "boundary. `validation` still shows the declared rules; the programmatic "
+            "validator remains outside that model."
+        ),
+    ),
 )
 
 

{sourcecode-5.4.2 → sourcecode-5.5.1}/src/sourcecode/reference_facts.py

@@ -162,7 +162,7 @@ _QUALIFIED_TYPE_RE = re.compile(r"\b[A-Z][A-Za-z0-9_$]*\.[A-Z][A-Za-z0-9_$]*")
 
 def _scan_repository(
     root: Path, simple_names: "set[str]", nested: "dict[str, tuple[str, str]]"
-) -> "tuple[dict[str, str], dict[str, str]]":
+) -> "tuple[dict[str, str], dict[str, str], dict[str, str]]":
     """One walk, two questions — `(config-wired names, nested types other code names)`.
 
     Both scans need the whole tree, and walking it twice doubled the cost of the
@@ -175,6 +175,7 @@ def _scan_repository(
     """
     config_hits: dict[str, str] = {}
     nested_hits: dict[str, str] = {}
+    literal_hits: dict[str, str] = {}
     pending = set(simple_names)
     by_qualified: dict[str, list[str]] = {}
     for fqn, (qualified, _own) in nested.items():
@@ -183,7 +184,7 @@ def _scan_repository(
     scan_config = bool(pending)
     scan_java = bool(by_qualified)
     if not scan_config and not scan_java:
-        return config_hits, nested_hits
+        return config_hits, nested_hits, literal_hits
 
     scanned = 0
     for dirpath, dirnames, filenames in os.walk(root):
@@ -191,7 +192,7 @@ def _scan_repository(
         for filename in filenames:
             is_java = filename.endswith(".java")
             is_config = os.path.splitext(filename)[1].lower() in _CONFIG_REF_EXTS
-            if not ((is_java and scan_java) or (is_config and scan_config)):
+            if not ((is_java and (scan_java or scan_config)) or (is_config and scan_config)):
                 continue
             if scanned >= _SCAN_MAX_FILES:
                 break
@@ -206,17 +207,40 @@ def _scan_repository(
                     pending.discard(hit)
                     config_hits[hit] = rel
                 scan_config = bool(pending)
+            if is_java and scan_config:
+                # A `Foo.class` literal is a real static reference, and the
+                # field audit found one of these on the annotation-dispatch path.
+                class_hits = {
+                    hit for hit in pending
+                    if f"{hit}.class" in text
+                }
+                for hit in class_hits:
+                    pending.discard(hit)
+                    literal_hits[hit] = rel
+                scan_config = bool(pending)
             if is_java and scan_java:
                 for hit in set(_QUALIFIED_TYPE_RE.findall(text)) & set(by_qualified):
                     for fqn in by_qualified[hit]:
                         if fqn not in nested_hits and nested[fqn][1] != rel:
                             nested_hits[fqn] = rel
+                # Nested types are often used unqualified by their enclosing
+                # class (`private Operation operation` or `Map<String, DATATYPE>`).
+                # The declaration is not a reference; a second occurrence is.
+                for fqn, (qualified, owner_file) in nested.items():
+                    if owner_file != rel or fqn in nested_hits:
+                        continue
+                    nested_name = qualified.rsplit(".", 1)[-1]
+                    unqualified = re.findall(
+                        rf"(?<!\.)\b{re.escape(nested_name)}\b", text
+                    )
+                    if len(unqualified) > 1:
+                        nested_hits[fqn] = rel
                 scan_java = len(nested_hits) < len(nested)
             if not scan_config and not scan_java:
-                return config_hits, nested_hits
+                return config_hits, nested_hits, literal_hits
         if scanned >= _SCAN_MAX_FILES:
             break
-    return config_hits, nested_hits
+    return config_hits, nested_hits, literal_hits
 
 
 def analyze_type_references(nodes: "list[dict]", root: Path) -> ReferenceFacts:
@@ -226,7 +250,15 @@ def analyze_type_references(nodes: "list[dict]", root: Path) -> ReferenceFacts:
     examined, because a method with no callers is a different question.
     """
     root = Path(root)
-    types = [n for n in nodes or [] if n.get("type") in ("class", "interface") and n.get("fqn")]
+    def _node_kind(node: dict) -> str:
+        kind = str(node.get("symbol_kind") or node.get("kind") or node.get("type") or "")
+        if kind in ("class", "interface", "enum", "annotation", "record"):
+            return kind
+        if kind == "@interface":
+            return "annotation"
+        return str(node.get("type") or "")
+
+    types = [n for n in nodes or [] if _node_kind(n) in ("class", "interface", "enum", "annotation", "record") and n.get("fqn")]
     if not types:
         return ReferenceFacts(0, {s: 0 for s in STATUSES}, ())
 
@@ -237,7 +269,7 @@ def analyze_type_references(nodes: "list[dict]", root: Path) -> ReferenceFacts:
             entries.append(TypeReference(
                 fqn=str(node["fqn"]), status=REFERENCED,
                 basis="incoming edge in the call-graph",
-                type=str(node.get("type") or ""), role=str(node.get("role") or "other"),
+                type=_node_kind(node), role=str(node.get("role") or "other"),
             ))
         else:
             candidates.append(node)
@@ -271,22 +303,30 @@ def analyze_type_references(nodes: "list[dict]", root: Path) -> ReferenceFacts:
                 f"{parts[-2]}.{parts[-1]}",
                 str(node.get("source_file") or "").replace("\\", "/"),
             )
-    config_hits, nested_hits = _scan_repository(root, set(by_simple), nested_candidates)
+    config_hits, nested_hits, literal_hits = _scan_repository(root, set(by_simple), nested_candidates)
+    literal_refs: dict[str, str] = {}
     for simple, config_file in config_hits.items():
         for node in by_simple.get(simple, []):
             dispatch_basis[str(node["fqn"])] = f"named in {config_file}"
+    for simple, literal_file in literal_hits.items():
+        for node in by_simple.get(simple, []):
+            literal_refs[str(node["fqn"])] = literal_file
 
     for node in candidates:
         fqn = str(node["fqn"])
         common = {
             "fqn": fqn,
-            "type": str(node.get("type") or ""),
+            "type": _node_kind(node),
             "role": str(node.get("role") or "other"),
         }
-        if fqn in nested_hits:
+        if fqn in nested_hits or fqn in literal_refs:
             entries.append(TypeReference(
                 status=REFERENCED,
-                basis=f"named as a qualified nested type in {nested_hits[fqn]}",
+                basis=(
+                    f"referenced by its enclosing source in {nested_hits[fqn]}"
+                    if fqn in nested_hits
+                    else f"referenced by a class literal in {literal_refs[fqn]}"
+                ),
                 **common,
             ))
         elif fqn in dispatch_basis:

{sourcecode-5.4.2 → sourcecode-5.5.1}/src/sourcecode/release_info.py

@@ -27,7 +27,7 @@ from typing import Any, Optional
 #: The date `__version__` was released, from that version's CHANGELOG entry.
 #: `tests/test_release_info.py` fails the build if the two disagree, so this is
 #: a copy of a fact rather than a second authority for it.
-RELEASE_DATE = "2026-08-12"
+RELEASE_DATE = "2026-08-13"
 
 #: Releases per day, measured over the 30 releases before this one (the same
 #: computation the test re-runs against the CHANGELOG). Stable across window

{sourcecode-5.4.2 → sourcecode-5.5.1}/src/sourcecode/repository_ir.py

@@ -3778,7 +3778,11 @@ def _parse_route_http_method(ann_name: str, args_str: str) -> str:
     if explicit:
         return explicit
     m = re.search(r'method\s*=\s*(?:RequestMethod\.)?(\w+)', args_str or "")
-    return m.group(1).upper() if m else ""
+    if m:
+        return m.group(1).upper()
+    if ann_name == "@RequestMapping":
+        return "ANY"
+    return ""
 
 
 def _parse_route_extras(args_str: str) -> dict:
@@ -6358,10 +6362,13 @@ def is_test_source_file(rel_path: str) -> bool:
 # Convenience: find Java files in a repo
 # ---------------------------------------------------------------------------
 
-def extract_java_endpoints(root: Path) -> "dict[str, Any]":
+def extract_java_endpoints(
+    root: Path, *, include_tests: bool = False
+) -> "dict[str, Any]":
     """Extract REST endpoint surface from Java source files.
 
     Canonical endpoint extractor — uses IR symbol extraction + _build_route_surface().
+    Test-fixture modules remain auditable by default and can be included explicitly.
     Security extraction delegated to _route_security_from_sym (single source of truth);
     results stored in route["security_annotations"] by _build_route_surface.
 
@@ -6670,7 +6677,8 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
     # counted with, the real API surface — but they are preserved in their own bucket
     # so nothing is silently dropped and the exclusion is auditable.
     _test_util_endpoints = [e for e in endpoints if e.get("scope") == "test_util"]
-    endpoints = [e for e in endpoints if e.get("scope") != "test_util"]
+    if not include_tests:
+        endpoints = [e for e in endpoints if e.get("scope") != "test_util"]
 
     # "no_security_signal" = no recognized security annotation at method OR class level.
     # Note: repos may use framework-level security (e.g. Keycloak itself) with no
@@ -6894,7 +6902,7 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
         pass
     # Surface test-fixture endpoints excluded from the production surface above.
     # Reported separately (not hidden) so the exclusion is transparent and auditable.
-    if _test_util_endpoints:
+    if _test_util_endpoints and not include_tests:
         result["test_util_endpoints"] = _test_util_endpoints
         result["test_util_excluded"] = len(_test_util_endpoints)
         result.setdefault("notes", []).append(
@@ -6902,6 +6910,8 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
             f"module(s) under src/main were excluded from the production surface "
             f"(see test_util_endpoints)."
         )
+    elif _test_util_endpoints:
+        result["test_util_included"] = len(_test_util_endpoints)
     # Surface incomplete-endpoint warnings (interface-defined controllers) only when
     # present, to keep output backward-compatible for the common case.
     if endpoint_warnings:
@@ -6960,6 +6970,17 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
     if any(r.get("framework") == "jax_rs" for r in routes):
         _nonspring.pop("jax_rs", None)
 
+    # Servlet mappings are a URL declaration population, not a count of
+    # HttpServlet classes. Reuse the servlet extractor so `endpoints` and
+    # `endpoints --servlets` publish the same authoritative census.
+    try:
+        from sourcecode.servlet_surface import build_servlet_surface
+
+        _nonspring["servlets"] = int(
+            build_servlet_surface(root).get("declarations", 0)
+        )
+    except Exception:
+        pass
     _nonspring_total = sum(_nonspring.values())
     if _nonspring_total:
         _frameworks = [k for k, v in _nonspring.items() if v]
@@ -7260,6 +7281,23 @@ def compute_blast_radius(
     # class-level node traversable at all (C1-16), and rebuilding it per node
     # would make the walk quadratic in the graph.
     _rg_index = _class_method_index(reverse_graph)
+
+    def _walk_callers(_node: str) -> list[str]:
+        """Expand method frontiers through their owning class as well.
+
+        Service-locator accessors enter the frontier as ``Class#accessor`` while
+        callers of the class are indexed under its method keys. Keeping the
+        exact lookup preserves method-level reach; adding the enclosing class
+        lookup prevents that frontier from becoming a false terminal node.
+        """
+        candidates = list(_all_callers_from_rg(
+            _node, reverse_graph, _rg_index, _impl_graph
+        ))
+        if "#" in _node:
+            candidates.extend(_all_callers_from_rg(
+                _enclosing_class(_node), reverse_graph, _rg_index, _impl_graph
+            ))
+        return list(dict.fromkeys(candidates))
     # Callers inject the interface, not the implementation, so a walk that does not
     # know the implements relation stops one hop short of every DI consumer. Without
     # it this traversal reached 200 classes and **no controller at all** for
@@ -7294,14 +7332,14 @@ def compute_blast_radius(
                     _expanded.add(_sym)
         matched_fqns = _expanded
     for seed in matched_fqns:
-        _seed_callers = _all_callers_from_rg(seed, reverse_graph, _rg_index, _impl_graph)
+        _seed_callers = _walk_callers(seed)
         if len(_seed_callers) > _HUB_CALLER_THRESHOLD and max_depth > 1:
             _effective_depth = 1
             _hub_class_guard = True
             break
 
     for seed in matched_fqns:
-        callers = _all_callers_from_rg(seed, reverse_graph, _rg_index, _impl_graph)
+        callers = _walk_callers(seed)
         for c in callers:
             if c not in all_affected:
                 all_affected[c] = 1
@@ -7387,7 +7425,7 @@ def compute_blast_radius(
         node, depth = queue.pop(0)
         if depth >= _effective_depth:
             continue
-        for caller in _all_callers_from_rg(node, reverse_graph, _rg_index, _impl_graph):
+        for caller in _walk_callers(node):
             if caller not in visited:
                 visited.add(caller)
                 all_affected[caller] = depth + 1
@@ -7410,7 +7448,7 @@ def compute_blast_radius(
             _snode, _sdepth = _sample_queue.pop(0)
             if _sdepth >= _HUB_SAMPLE_DEPTH:
                 continue
-            for _scaller in _all_callers_from_rg(_snode, reverse_graph, _rg_index, _impl_graph):
+            for _scaller in _walk_callers(_snode):
                 if _scaller not in _sample_visited:
                     _sample_visited.add(_scaller)
                     all_affected[_scaller] = _sdepth + 1
@@ -7611,7 +7649,12 @@ def compute_blast_radius(
     _direct_caller_classes = sorted(
         caller_classes(direct_callers, exclude=matched_fqns)
     )
-    n_direct_symbols = len(direct_callers)
+    _direct_class_set = set(_direct_caller_classes)
+    _direct_caller_symbols = sorted(
+        symbol for symbol in direct_callers
+        if _enclosing_class(symbol) in _direct_class_set
+    )
+    n_direct_symbols = len(_direct_caller_symbols)
     n_direct_classes = len(_direct_caller_classes)
     n_direct   = n_direct_symbols
     n_indirect = len(indirect_callers)
@@ -7823,8 +7866,8 @@ def compute_blast_radius(
             else _direct_caller_classes[:_direct_cap]
         ),
         "direct_caller_symbols": (
-            sorted(direct_callers) if _direct_cap is None
-            else sorted(direct_callers)[:_direct_cap]
+            _direct_caller_symbols if _direct_cap is None
+            else _direct_caller_symbols[:_direct_cap]
         ),
         "indirect_callers": _indirect_summary,
         "container_wired": [w.to_dict() for w in _container_wired],