swapnilpaliwal-sd · Oct 10, 2026 · Oct 9, 2026 · Oct 9, 2026 · Oct 9, 2026 · Oct 9, 2026
@@ -442,7 +442,7 @@ One row per place a call is written (or, for a synthesised edge, the construct t
 - **typescript** — end_line / end_column come from the expression row; the call-site row itself records only the start.
 - **javascript** — caller_id is the parser's enclosing method, or the module initializer for top-level code. end_line / end_column come from the expression row. `require()` is a module edge, not a call site.
 - **typescript** — PROPERTY_READ and PROPERTY_WRITE rows are accessor invocations with no written call: the site is the property-access expression that runs the getter or setter, positioned from the expressions table, and callee_name is NULL because nothing was written; the accessor's name is on the callee's methods row. Filter them out with kind NOT IN (…) when counting calls.
-- **python** — PROPERTY_READ, CONTEXT_MANAGER, ITERATION_PROTOCOL, METACLASS_CREATION and DYNAMIC_CALL rows are protocol or indirect edges with no written call: their site is the expression that triggers them, and callee_name is always NULL because nothing was written. SUBSCRIPT_CALL is NULL only when the subscript is not a written name (measured 206 of 337 rows on a Python subject). Filter them out with kind NOT IN (…) when counting calls.
+- **python** — PROPERTY_READ, PROPERTY_WRITE, CONTEXT_MANAGER, ITERATION_PROTOCOL, METACLASS_CREATION and DYNAMIC_CALL rows are protocol or indirect edges with no written call: their site is the expression that triggers them, and callee_name is always NULL because nothing was written. SUBSCRIPT_CALL is NULL only when the subscript is not a written name (measured 206 of 337 rows on a Python subject). Filter them out with kind NOT IN (…) when counting calls.
 - **python** — The id is an EXPRESSION hash for a written call; a DECORATOR hash (PY_DECORATOR_…) for DECORATOR_APPLICATION and DECORATOR_* sites, positioned at the decorator line; and the class's TYPE hash for METACLASS_CREATION, positioned at the class declaration.
 
 ### `call_edges`
@@ -467,6 +467,7 @@ THE GRAPH. One row per (site, resolved target). A site with N possible targets h
 | `new` | csharp | An object creation. The target is the constructed type's constructor, and it is never dispatched. |
 | `ctor_delegate` | csharp | `: this(...)` or `: base(...)`. No name is written, so the target is structural. |
 | `primary_ctor_base` | csharp | SYNTHESISED. A primary constructor's base invocation, written in the heritage clause: `class D(int a) : B(a)`. There is no call syntax anywhere in the body. FromExpr is the heritage type reference. |
+| `implicit_base_ctor` | csharp | SYNTHESISED. The base class's parameterless constructor that a constructor with no `: base(...)` / `: this(...)` runs before its body, or that the implicit constructor of a class declaring none runs at its `new`. FromExpr is the heritage type reference, or the `new` site. |
 | `delegate` | csharp | A call through a delegate value: `handler(x)` or `handler.Invoke(x)`. |
 | `operator` | csharp | A user-defined operator invoked by operator syntax. |
 | `conversion` | csharp | A user-defined conversion. An implicit one has no syntax at the call site. |
@@ -531,6 +532,7 @@ THE GRAPH. One row per (site, resolved target). A site with N possible targets h
 | `DECORATOR_*` | python | Applying an unparenthesised decorator; the suffix is the parser's decorator kind: BARE, ATTRIBUTE, SUBSCRIPT, EXPRESSION (and CALL/ATTRIBUTE_CALL when the factory expression is not itself a call site). The site is the decorator hash. |
 | `METACLASS_CREATION` | python | A class statement invokes its metaclass's `__new__` / `__init__` at import time, whether the metaclass is written on the statement (`class X(metaclass=M)`) or inherited from a base, and the nearest base's `__init_subclass__`. No written call; the site is the class's type hash. |
 | `PROPERTY_READ` | python | Reading `obj.attr` where `attr` is a `@property` runs the getter; reading `Cls.attr` where the METACLASS defines `attr` as a property runs that getter. No written call; the site is the attribute-access expression. |
+| `PROPERTY_WRITE` | python | Assigning `obj.attr = v` where `attr` is a `@property` with a setter runs the setter; `del obj.attr` runs its deleter. No written call; the site is the attribute-access expression. |
 | `CONTEXT_MANAGER` | python | `with expr:` runs `__enter__` / `__exit__` (or the async pair). No written call; the site is the context-manager expression. |
 | `ITERATION_PROTOCOL` | python | `for x in expr:` (and comprehensions) runs `__iter__` / `__next__` (or the async pair). No written call; the site is the iterated expression. |
 | `SUBSCRIPT_PROTOCOL` | python | `x[k]` runs `__getitem__` (and `x[k] = v` / `del x[k]` the setter and deleter) of the receiver's class. No written call; the site is the subscript expression. Its own kind so it is never counted as a written call. |

@@ -358,6 +358,7 @@ export const VOCAB: readonly VocabSpec[] = [
   { table: 'call_edges', column: 'kind', value: 'new', languages: C, meaning: 'An object creation. The target is the constructed type\'s constructor, and it is never dispatched.' },
   { table: 'call_edges', column: 'kind', value: 'ctor_delegate', languages: C, meaning: '`: this(...)` or `: base(...)`. No name is written, so the target is structural.' },
   { table: 'call_edges', column: 'kind', value: 'primary_ctor_base', languages: C, meaning: 'SYNTHESISED. A primary constructor\'s base invocation, written in the heritage clause: `class D(int a) : B(a)`. There is no call syntax anywhere in the body. FromExpr is the heritage type reference.' },
+  { table: 'call_edges', column: 'kind', value: 'implicit_base_ctor', languages: C, meaning: 'SYNTHESISED. The base class\'s parameterless constructor that a constructor with no `: base(...)` / `: this(...)` runs before its body, or that the implicit constructor of a class declaring none runs at its `new`. FromExpr is the heritage type reference, or the `new` site.' },
   { table: 'call_edges', column: 'kind', value: 'delegate', languages: C, meaning: 'A call through a delegate value: `handler(x)` or `handler.Invoke(x)`.' },
   { table: 'call_edges', column: 'kind', value: 'operator', languages: C, meaning: 'A user-defined operator invoked by operator syntax.' },
   { table: 'call_edges', column: 'kind', value: 'conversion', languages: C, meaning: 'A user-defined conversion. An implicit one has no syntax at the call site.' },
@@ -667,6 +668,7 @@ export const VOCAB: readonly VocabSpec[] = [
   { table: 'call_edges', column: 'kind', value: 'DECORATOR_*', languages: P, meaning: 'Applying an unparenthesised decorator; the suffix is the parser\'s decorator kind: BARE, ATTRIBUTE, SUBSCRIPT, EXPRESSION (and CALL/ATTRIBUTE_CALL when the factory expression is not itself a call site). The site is the decorator hash.' },
   { table: 'call_edges', column: 'kind', value: 'METACLASS_CREATION', languages: P, meaning: 'A class statement invokes its metaclass\'s `__new__` / `__init__` at import time, whether the metaclass is written on the statement (`class X(metaclass=M)`) or inherited from a base, and the nearest base\'s `__init_subclass__`. No written call; the site is the class\'s type hash.' },
   { table: 'call_edges', column: 'kind', value: 'PROPERTY_READ', languages: P, meaning: 'Reading `obj.attr` where `attr` is a `@property` runs the getter; reading `Cls.attr` where the METACLASS defines `attr` as a property runs that getter. No written call; the site is the attribute-access expression.' },
+  { table: 'call_edges', column: 'kind', value: 'PROPERTY_WRITE', languages: P, meaning: 'Assigning `obj.attr = v` where `attr` is a `@property` with a setter runs the setter; `del obj.attr` runs its deleter. No written call; the site is the attribute-access expression.' },
   { table: 'call_edges', column: 'kind', value: 'CONTEXT_MANAGER', languages: P, meaning: '`with expr:` runs `__enter__` / `__exit__` (or the async pair). No written call; the site is the context-manager expression.' },
   { table: 'call_edges', column: 'kind', value: 'ITERATION_PROTOCOL', languages: P, meaning: '`for x in expr:` (and comprehensions) runs `__iter__` / `__next__` (or the async pair). No written call; the site is the iterated expression.' },
   { table: 'call_edges', column: 'kind', value: 'SUBSCRIPT_PROTOCOL', languages: P, meaning: '`x[k]` runs `__getitem__` (and `x[k] = v` / `del x[k]` the setter and deleter) of the receiver\'s class. No written call; the site is the subscript expression. Its own kind so it is never counted as a written call.' },
@@ -748,7 +750,7 @@ export const NOTES: readonly NoteSpec[] = [
   { language: 'typescript', table: 'overrides', note: 'EMPTY — this table is Java-shaped. The TypeScript dispatch envelope is in dispatch_candidates, with basis `nominal` or `structural`.' },
   { language: 'typescript', table: 'type_instantiated', note: 'Every row has how = `new`. Not restricted to client provenance: a type the library constructs is still a type that exists at run time, and dropping it would narrow the envelope unsoundly.' },
   { language: 'typescript', table: 'call_sites', note: 'PROPERTY_READ and PROPERTY_WRITE rows are accessor invocations with no written call: the site is the property-access expression that runs the getter or setter, positioned from the expressions table, and callee_name is NULL because nothing was written; the accessor\'s name is on the callee\'s methods row. Filter them out with kind NOT IN (…) when counting calls.' },
-  { language: 'python', table: 'call_sites', note: 'PROPERTY_READ, CONTEXT_MANAGER, ITERATION_PROTOCOL, METACLASS_CREATION and DYNAMIC_CALL rows are protocol or indirect edges with no written call: their site is the expression that triggers them, and callee_name is always NULL because nothing was written. SUBSCRIPT_CALL is NULL only when the subscript is not a written name (measured 206 of 337 rows on a Python subject). Filter them out with kind NOT IN (…) when counting calls.' },
+  { language: 'python', table: 'call_sites', note: 'PROPERTY_READ, PROPERTY_WRITE, CONTEXT_MANAGER, ITERATION_PROTOCOL, METACLASS_CREATION and DYNAMIC_CALL rows are protocol or indirect edges with no written call: their site is the expression that triggers them, and callee_name is always NULL because nothing was written. SUBSCRIPT_CALL is NULL only when the subscript is not a written name (measured 206 of 337 rows on a Python subject). Filter them out with kind NOT IN (…) when counting calls.' },
   { language: 'python', table: 'call_sites', note: 'The id is an EXPRESSION hash for a written call; a DECORATOR hash (PY_DECORATOR_…) for DECORATOR_APPLICATION and DECORATOR_* sites, positioned at the decorator line; and the class\'s TYPE hash for METACLASS_CREATION, positioned at the class declaration.' },
   { language: 'python', table: 'call_edges', note: 'A `boundary_lib` edge may point at a builtin (callee_provenance builtin, callee_label `builtin:NAME`) or at an unstaged import path (callee_provenance external) — neither has a methods row.' },
   { language: 'java', table: 'call_edges', note: 'A `boundary_lib` edge with callee_provenance external names a method of an ancestor type no staged IR declares (callee_label `external:<type>.<name>`, no methods row). A site whose receiver is declared as such a type is multi_inferred even with one client override: the platform method itself, and the platform\'s own subclasses, are the other possible targets. Stage the library to replace the label with the real method.' },

@@ -286,6 +286,52 @@ call_chain_edge(tr, caller, "-", ctor, "lib", "boundary_lib", "primary_ctor_base
     method_decl("lib", _, _, _, ctor),
     type_ctor("client", gk, caller).
 
+// ── SYNTHESISED EDGES: THE IMPLICIT `base()` ────────────────────────────────
+// A constructor that writes neither `: base(..)` nor `: this(..)` runs its base
+// class's parameterless constructor before its own body, and a class that declares
+// no constructor at all gets one that does the same. Neither is written anywhere, so
+// without these edges a base constructor that every derived class runs has no caller.
+//
+// implicit_base_ctor(TypeGroup, Ctor): the constructor `base()` runs for a type --
+// its base class's constructor that takes no argument, or, where the base declares
+// no constructor either, the one the base's own implicit constructor runs.
+implicit_base_ctor(gk, ctor) :-
+    type_extends("client", gk, bgk),
+    type_ctor("client", bgk, ctor), ctor_accepts_argc("client", ctor, "0").
+implicit_base_ctor(gk, ctor) :-
+    type_extends("client", gk, bgk),
+    !type_ctor("client", bgk, _), type_group("client", _, bgk),
+    implicit_base_ctor(bgk, ctor).
+
+// A constructor that hands off with `: this(..)` or `: base(..)`, or a primary
+// constructor whose heritage passes arguments: the base constructor it runs is the
+// one written there, already an edge.
+ctor_has_initializer(m) :- call_is_base_ctor("client", e), expr_ultimate_method("client", e, m).
+ctor_has_initializer(m) :- call_is_this_ctor("client", e), expr_ultimate_method("client", e, m).
+ctor_has_initializer(m) :-
+    heritage_has_ctor_args("client", t, _), type_group("client", t, gk), type_ctor("client", gk, m).
+
+// The FromExpr is the base class's entry in the heritage clause, as for a primary
+// constructor's base invocation: the closest thing to where the call is written.
+implicit_base_site(gk, tr) :-
+    type_extends("client", gk, bgk),
+    heritage_resolves("client", gk, pos, bgk),
+    heritage_of_entity("client", gk, pos, _, _, tr), tr != "".
+
+// (1) A declared constructor with no initializer.
+call_chain_edge(tr, m, "-", ctor, "client", "known_edge", "implicit_base_ctor") :-
+    type_ctor("client", gk, m), method_decl("client", _, _, _, m),
+    !ctor_has_initializer(m),
+    implicit_base_ctor(gk, ctor),
+    implicit_base_site(gk, tr).
+
+// (2) `new T()` where T declares no constructor: the implicit one runs T's base's.
+// The edge sits on the `new` site itself, beside its known_implicit_ctor row.
+call_chain_edge(e, caller, "-", ctor, "client", "known_edge", "implicit_base_ctor") :-
+    call_ctor_implicit("client", e, gk),
+    implicit_base_ctor(gk, ctor),
+    call_from_expr("client", e, caller).
+
 // ── ACCESSOR EDGES: A PROPERTY READ IS A CALL ───────────────────────────────
 // `x.Name` invokes get_Name, `a[i]` an indexer accessor, `e += h` an add accessor.
 // These have no cs_call_site row -- the parser cannot know whether `x.Name` is a

@@ -149,3 +149,27 @@ module_in_scope(prov, mod, outer) :-
 
 // The GLOBAL namespace ("") is always in scope.
 module_in_scope(prov, mod, "") :- module_decl(prov, _, _, _, mod).
+
+// module_ns_chain(Prov, ModuleHash, Namespace) -- the namespaces a name written in this
+// file is read from: the file's own namespaces and every dotted prefix of them, as
+// text. A prefix that holds no type of its own (`Acme` over `Acme.Shop`) still
+// qualifies a name written below it, so this is not ns_encloses, which needs one.
+module_ns_chain(prov, mod, ns) :- module_namespace_own(prov, mod, ns), ns != "".
+module_ns_chain(prov, mod, p) :- module_namespace_own(prov, mod, inner), ns_prefix(prov, inner, p).
+
+// ── A USING WRITTEN INSIDE A NAMESPACE ─────────────────────────────────────
+// `namespace Shop.Tests; using Results;` imports Shop.Results. C# reads the name in
+// a using directive from the namespace the directive sits in, innermost outward,
+// exactly as it reads any other name there. Taken as written it names a namespace
+// that does not exist, and every type the file names through it reads as a library
+// type.
+//
+// The IR does not record whether a using sits inside the namespace or above it.
+// The language decides it instead: a using whose name is no namespace at all only
+// compiles inside a namespace that has it as a child. So the relative reading is
+// taken only when the name as written names nothing, and only for a child that
+// exists -- a file whose namespaces have no such child gains nothing.
+module_in_scope(prov, mod, full) :-
+    using_namespace(prov, mod, n), !ns_exists(prov, n),
+    module_ns_chain(prov, mod, e), full = cat(e, cat(".", n)),
+    ns_exists(prov, full).
@@ -459,6 +459,25 @@ expr_type(prov, e, gk) :-
     expr_type(prov, q, qgk),
     member_lookup(prov, qgk, n, "field", f), field_type(prov, f, gk).
 
+// A STATIC member read through its TYPE NAME: `Context.Current.Factory.Create()`.
+// The qualifier `Context` names a type, not a value, so it has no expr_type and the
+// two clauses above cannot start from it: the getter of `Current` is an edge
+// (properties.dl reads the type name), and these give its RESULT a type, so that
+// `.Factory` and every call after it resolve. ref_names_type already refuses a name
+// that also binds a value, which is the language's member-over-type rule.
+expr_type(prov, e, gk) :-
+    expr_kind(prov, e, "MEMBER_ACCESS"),
+    expr_qualifier_child(prov, e, q), expr_member_name_child(prov, e, nameExpr),
+    expr_written_name(prov, nameExpr, n),
+    ref_names_type(prov, q, qgk),
+    member_lookup(prov, qgk, n, "property", p), property_type(prov, p, gk).
+expr_type(prov, e, gk) :-
+    expr_kind(prov, e, "MEMBER_ACCESS"),
+    expr_qualifier_child(prov, e, q), expr_member_name_child(prov, e, nameExpr),
+    expr_written_name(prov, nameExpr, n),
+    ref_names_type(prov, q, qgk),
+    member_lookup(prov, qgk, n, "field", f), field_type(prov, f, gk).
+
 // ── A GENERIC ARGUMENT, SUBSTITUTED FOR THE PARAMETER IT FILLS ──────────────
 // `IWrap<Settings> w; w.Value.Flag` -- `Value` is declared `T`, and without binding
 // T to Settings the access resolves and the type of the RESULT is the type parameter,

@@ -117,6 +117,15 @@ expr_written_name("lib", e, n) :-
     lib_cs_expression(_, _, _, _, _, _, _, _, _, _, _, _, _, _, _, _, _, _, n, _, _, _, _, _, _, _, _, _, _, _, _, _, _, _, e),
     n != "".
 
+// ── expr_type_argc(Prov, ExprHash, TypeArgumentCount) ──────────────────────
+// The type arguments written on a name: `Cache<int>` is the name `Cache` at arity 1.
+// A generic name used as a receiver or qualifier is resolved at this arity, since
+// `Cache` and `Cache<T>` are two types.
+expr_type_argc("client", e, tac) :-
+    cs_expression(_, _, _, _, _, _, _, _, _, _, _, _, _, _, _, _, _, _, _, _, _, tac, _, _, _, _, _, _, _, _, _, _, _, _, e).
+expr_type_argc("lib", e, tac) :-
+    lib_cs_expression(_, _, _, _, _, _, _, _, _, _, _, _, _, _, _, _, _, _, _, _, _, tac, _, _, _, _, _, _, _, _, _, _, _, _, e).
+
 // ── expr_literal(Prov, ExprHash, LiteralKind, LiteralValue) ─────────────────
 expr_literal("client", e, lk, lv) :-
     cs_expression(_, _, _, _, _, _, _, _, _, _, lk, lv, _, _, _, _, _, _, _, _, _, _, _, _, _, _, _, _, _, _, _, _, _, _, e),

@@ -61,6 +61,10 @@ var_initializer("lib", v, e) :-
 // The initializer IS a value of the variable's type.
 var_value_initializer(prov, v, e) :- var_initializer(prov, v, e), var_decl(prov, _, "LOCAL", _, v).
 var_value_initializer(prov, v, e) :- var_initializer(prov, v, e), var_decl(prov, _, "CONST", _, v).
+// A `using` resource -- `using (var w = new Writer())` and `using var w = ...;` -- is
+// the disposable itself, so its initializer is a value of its type exactly as a
+// local's is. Without it every call on such a resource has an untyped receiver.
+var_value_initializer(prov, v, e) :- var_initializer(prov, v, e), var_decl(prov, _, "USING", _, v).
 // The initializer is a COLLECTION and the variable takes its element type.
 var_iterated_initializer(prov, v, e) :- var_initializer(prov, v, e), var_decl(prov, _, "FOREACH", _, v).