[DeusData]

What this does

IMPORTS, CALLS, CALL_REFERENCE, USAGE, READS, WRITES and USES_TYPE edges are now published only when a language's own static rules prove the target. cbm_shared_resolver_project deletes those edges and re-inserts only admitted proofs. Unique names, suffix matches, confidence numbers and lsp_ prefixes no longer count as proof. A false edge is a bug; a missing edge is debt; the resolver abstains rather than guess. DEPLOYS and INHERITS behaviour is unchanged. CALLS means the declaration static rules select, not runtime dispatch.

Language rules added:

Languages	Rules
Go	Package scope, embedding and method sets, type aliases, bare results, literals, conversions
Rust	Cargo crates, module trees, use trees, re-exports, globs, trait and inherent method selection, autoderef
Python	Scopes, C3 member order, decorators that keep identity, closed star imports, search paths
JS, TS, Vue, Svelte	ES modules, CommonJS, export surfaces, lexical and type scopes, declared receivers
C, C++	Translation-unit visibility, include resolution, prototypes, attribute macros, members, namespaces
Java, Kotlin, C#	Lexical scopes, imports, inherited members, arity and known-type overload selection
PHP, Elixir, Erlang, Perl, Ruby, Zig, Haskell, OCaml, Dart, Swift, Scala	Per-occurrence source adapters in internal/cbm/resolve/adapter_*.c

Resolver evidence is stored as integer rows behind read-only views. The semantic index version moves to 13, so existing indexes rebuild once.

Read this first: what gets worse

1. Raw edge counts fall in most repositories. Baseline counts include edges bound by name alone, so a lower count is not simply a loss, but real recall is lost too: USAGE on Elixir, Erlang and Ruby goes to zero because those adapters decide calls only. Full table below.

2. One changed file now costs a full rebuild. Design stage 5 (incremental optimization) is not implemented. cbm_store_resolver_requires_full forces a full index on any change, because a change can invalidate another file's negative proof. An unchanged tree is still a cheap no-op. Measured, seconds, under load:

Repo	Full, base → new	One file changed, base → new	Unchanged, base → new
expressjs/express	1.2 → 3.3	1.2 → 3.2	1.2 → 2.0
meilisearch	3.8 → 10.1	2.2 → 10.8	1.0 → 0.9
redis	6.0 → 16.1	2.7 → 15.5	0.9 → 0.6
django	9.3 → 65.4	9.3 → 91.7	1.2 → 1.2

3. Indexing is slower and databases are larger, typically 2 to 3 times on both, and up to 9 times the time on kilocode. Tables below.

4. This changes the global shape. The maintainer's standing rule keeps suppressors per language. This deletes and re-proves globally. That was a deliberate decision for this change, with the recall loss disclosed here.

Quality

Frozen oracle

291 positive and 42 negative hand-checked sites across 24 pinned repositories, frozen before the language rules were written. The oracle is not fully blind: an earlier Go review exposed part of it. Scored on the repositories both legs indexed, reported as aggregates only.

Binary 4a514ea9; the only production change after it is one assignment.

Leg, 23 repositories	Found	Wrong target	Miss	Indeterminate	Precision	Recall on indexed sites	Negative sites held
Baseline main a6d0d6c	102	27	130	20	79.1%	36.6%	30 of 40, 8 violated
This branch	174	1	99	5	99.4%	62.4%	38 of 40, 2 violated

Relation	Sites	Found, base → new	Wrong, base → new
IMPORTS	81	47 → 57	10 → 1
CALLS	98	47 → 75	11 → 0
USAGE	41	7 → 21	4 → 0
USES_TYPE	59	0 → 15	0
CALL_REFERENCE	3	0 → 2	0
WRITES	7	1 → 4	2 → 0
READS	2	0	0

The site is the unit here, so this measures exact occurrences, which the raw counts below cannot. Linux is not in either row; see Evidence limits. I did not open the one wrong site or the two violated negatives, so the oracle stays usable for the next measurement. They should be looked at.

Found per repository, base → new. Four repositories got worse or stayed at zero, and they are real gaps: Alamofire 1 → 0, bloc 5 → 2, llvm 7 → 6, neovim 1 → 0. Swift and Dart misses are mostly unproven imports.

Kilo 11 → 14 of 14	TypeScript 7 → 13 of 13	django 4 → 14 of 15	kubernetes 4 → 12 of 14
elasticsearch 5 → 11 of 13	redis 10 → 11 of 12	express 8 → 11 of 14	meilisearch 3 → 9 of 12
plug 4 → 9 of 12	koel 7 → 9 of 15	Exposed 5 → 8 of 14	mojo 2 → 8 of 11
cowboy 0 → 8 of 10	dune 0 → 6 of 10	PostgREST 3 → 5 of 12	play 1 → 3 of 10
sinatra 2 → 3 of 9	zls 10 → 10 of 12	dotnet/runtime 2 → 2 of 13

Real repositories, baseline main a6d0d6c vs this branch

Repo	CALLS	USAGE	IMPORTS	USES_TYPE	Index s	DB MB
Alamofire (Swift)	5,453 → 1,586	9,534 → 715	52,810 → 0	0 → 33	2.2 → 6.7	70 → 89
Exposed (Kotlin)	27,625 → 20,357	41,493 → 19,195	137,124 → 5,404	0	6.6 → 23.2	236 → 510
PostgREST (Haskell)	1,436 → 1,017	3,341 → 503	496 → 78	0	1.1 → 1.7	18 → 33
django (Python)	63,691 → 48,172	40,215 → 30,064	15,562 → 15,447	0 → 5	6.5 → 44.5	374 → 922
plug (Elixir)	971 → 861	472 → 0	42 → 81	0	0.9 → 3.1	7 → 13
express (JS)	600 → 198	312 → 167	177 → 160	0	0.9 → 2.2	6 → 25
bloc (Dart)	2,068 → 1,926	4,129 → 1,361	967 → 860	0 → 29	1.4 → 3.7	41 → 75
koel (PHP)	10,546 → 5,076	15,720 → 6,944	7,843 → 6,106	0 → 1,508	1.9 → 6.8	74 → 142
meilisearch (Rust)	25,112 → 16,579	37,804 → 23,346	3,314 → 6,814	0 → 7,863	2.7 → 7.1	122 → 198
mojo (Perl)	1,967 → 1,425	84 → 27	4 → 435	0	1.1 → 1.9	15 → 29
neovim (C)	55,227 → 29,608	95,509 → 53,792	8,450 → 6,660	0	8.1 → 23.1	247 → 647
cowboy (Erlang)	4,771 → 5,691	4,975 → 0	204 → 55	0	1.2 → 1.7	32 → 43
dune (OCaml)	15,524 → 5,239	19,282 → 2,048	91 → 14	0	3.2 → 4.5	94 → 112
play (Java, Scala)	24,686 → 11,069	30,444 → 10,428	4,018 → 2,121	0 → 4,224	3.8 → 8.6	152 → 237
redis (C)	34,995 → 28,732	49,206 → 42,224	2,302 → 1,715	0 → 4	4.0 → 12.7	181 → 398
sinatra (Ruby)	2,106 → 555	359 → 0	126 → 108	0	0.9 → 1.1	11 → 14
zls (Zig)	4,898 → 2,401	8,728 → 2,783	259 → 229	0 → 8	0.9 → 1.7	22 → 36

Huge repositories

Repo	CALLS	USAGE	IMPORTS	USES_TYPE	Index s	DB GB
kubernetes	221,251 → 257,502	576,608 → 534,811	57,334 → 57,197	0 → 210,425	43 → 140	2.2 → 4.2
elasticsearch	1,457,475 → 1,308,131	1,585,096 → 1,049,503	438,469 → 321,329	0 → 404,949	180 → 301	5.3 → 9.6
dotnet/runtime	1,035,361 → 392,440	2,368,274 → 709,951	124,504 → 117,615	0 → 40,463	200 → 511	6.3 → 10.8
llvm-project	969,997 → 432,362	1,669,132 → 586,127	166,332 → 128,093	0 → 789	242 → 508	6.9 → 11.5
TypeScript	80,732 → 47,952	372,439 → 16,004	26,166 → 19,156	0 → 20,724	62 → 151	1.1 → 3.6
kilocode	110,797 → 74,589	240,939 → 51,675	59,050 → 31,936	0 → 23,491	14 → 126	0.7 → 2.0

Times are under varying load, so read them as orders of magnitude.

Precision sampling

Each language lane read emitted edges from real repositories and adjudicated them against source, for example kubernetes 208 read, 0 wrong; django 229 and 76 read, 0 wrong; express 165 read, 0 wrong. Those samples predate the final merge. The oracle above is the check on the final binary. See its results above.

Verification

All results are on f6556b7b unless a row says otherwise. The one later commit, d26e6463, stops writing an unread property on C file nodes. It was verified with the affected suites (1,425 passed) and leaves edge counts on redis and neovim identical; hosted CI runs the whole matrix on it.

Gate	Result
macOS ASan + UBSan, whole suite	10,893 passed, 0 failed, 12 skipped, 0 sanitizer reports
Linux arm64 GCC ASan + LeakSanitizer	10,731 passed, 0 failed, 11 skipped, 220 suites
Linux arm64 TSan	1,569 passed, 8 skipped, no reports, at e821b3e0. The only later commit touches tests.
Windows native ARM64, every suite, sequential, one process	10,705 passed, 1 failed, 99 skipped. The failure, mem_map_attributes_a_known_allocation, measures committed-memory growth; 200 suites into one process that memory is reused. The mem suite alone passes 73 of 73.
Forced spill, CBM_MEM_SPILL=1, 62 resolver suites, ASan per suite	3,310 passed, 0 failed, at 415d9af2. Later production edits are one local rename and one assignment.
Linux lint: cppcheck 2.20.0, clang-format 20, NOLINT, memory core	Passed
Security audit, scripts/security-audit.sh	Passed
Linux amd64	Not run locally. Hosted CI covers it, and any red there gets fixed before merge.
Windows guards, win.sh guards	Not run locally. Hosted CI covers it.

On this VM the parallel Windows runner oversubscribes: heavy suites hit the 900 s cap, and it then stops before finishing. pipeline and test_impact_git, the two it capped most recently, pass together when run alone (503 passed, about 8 minutes). The sequential run above is the established Windows leg here. test_impact_tree failed once in that parallel run, with its log lost to cleanup; it passed in the sequential run.

RED on revert was run on the final tree for the spill lifetime fix (the same stack as the crash), the four Go rules (8 tests fail), and PHP, the source adapters and Python members together (22 tests fail). RED runs for the other rules happened during development and were not repeated on the final tree.

Bugs found only by running everything together

Each language lane was green alone. These appeared after integration, and each has a test:

• A Python class header read a sibling declared below it, giving a false INHERITS.
• Two nested same-named TypeScript consts bound through the Go variant rule, giving a false CALLS.
• Over the memory budget, the Java, Kotlin and C# declaration index read qualified names from a freed result. TypeScript's merged label did the same. This is use-after-free in production on a large repository under pressure.
• The HTTP default audit was quadratic in top-level statements and ran serially. TypeScript took over 28 minutes; it now takes about 150 s.
• The parallel route skipped the Java, Kotlin and C# walk on files with no calls, and lost their field and type rows.
• Calls inside a C# operator were attributed to the file. Operators now have nodes.
• Go cache[k] = v emitted WRITES for cache.
• A generated header with 70,000 includes gave one File node a 9 MB property nothing read, and a database 13 times the baseline's. Found by the hosted diagnostic lane, whose strict_string_checks made the FTS backfill quadratic on it.
• A C# doc scope read the repaired parse view's tree, so a reference valid in another #if branch read as missing.

Decisions a reviewer may want to overrule

• Go annotation tokens are USES_TYPE only, like TypeScript. On kubernetes pkg/kubelet this removes at most 3,596 of 18,570 Go USAGE edges (19%); USES_TYPE keeps those pairs. To flip: remove the two is_go_annotation_type calls in extract_usages.c and adjust es_usage_crossfile_go.
• Kotlin ::x inside if, when, ?: or a to pair is USAGE; direct forms are CALL_REFERENCE. This matches the Java ternary and the extractor's documented rule.
• A constructor call with no constructor node targets the class for Java, Kotlin, C#, Scala and Swift. For Swift Widget(name:) this is the weakest edge here: init is a real declaration with no node, so calls inside an init body likely go to the file too.
• Kotlin nested class QNs changed to include the outer class, and unnamed companions now have nodes. A nested class sharing a name with a member function now collides: on Exposed, 1 doc target lost and 66 gained.
• Java, Kotlin and C# judgement calls: an unknown-type argument keeps the only candidate of that arity; a type-shaped name is assumed not to be a field of an unindexed supertype; external tables are closed.
• C# reference assemblies abstain. A ref/ type beside its implementation shares a QN, and nothing says which one a caller compiles against. This is likely the largest C# recall loss on dotnet/runtime.

Known limits

• USAGE on a type name is inconsistent across languages: JS and TS enforce value-only, others emit it on signatures.
• Field initializer edges have a File source in Java and a Module source in Kotlin and C#.
• Go arr[i] = x reads as USAGE, a missing write rather than a false edge.
• C# conversion operators, property accessors and indexers still have no node.
• Haskell writes one occurrence row per branch view; the graph edge is unaffected.
• Over-budget indexing aborts by design. Running a huge index beside an in-process test runner shrinks the budget enough to fail it.

Removed tests

29 test names on main no longer exist on this branch. A ledger recorded at an earlier tree classifies them: 5 covered elsewhere, 16 that dropped a genuine positive edge, 8 that dropped none, plus 2 partial holes and 3 weakened tests. Most are name-fallback tests in tests/test_registry.c. I have not re-checked how many of the 16 the language rules have since restored.

Evidence limits

• The sealed Linux tree has 13 case-collapsed paths on APFS, all with identical content, and one local modification, arch/alpha/boot/bootp.c.
• torvalds/linux has not been indexed with this branch's final binary. Its database is estimated near 23 GB and the laptop did not have room to do it safely alongside everything else; an earlier attempt was stopped by the swap guard. The largest completed run is llvm-project.
• The formal controller run prepared for this change was not executed, because it needs a session able to run git against its build roots. The census and oracle above are the evidence.
• Some commit messages are inaccurate: d38554e is labelled WIP but is final; 4b4b77a carries older text; 456bdbb says about 16 and the true number is 11; ad60078 names the wrong rename commit, corrected in 9a5f62e.

Open questions

• Extend #field QNs to Rust?
• Should enum variants get nodes?
• Should framework knowledge such as Django's X.objects.y be modelled?
• Should design stage 5 land before this ships, given the one-file rebuild cost?