diff --git a/__tests__/commonjs-eval-facts.test.ts b/__tests__/commonjs-eval-facts.test.ts
new file mode 100644
index 0000000000..4aaf03690b
--- /dev/null
+++ b/__tests__/commonjs-eval-facts.test.ts
@@ -0,0 +1,58 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { DatabaseConnection } from '../src/db';
+import { QueryBuilder } from '../src/db/queries';
+import type { FileRecord } from '../src/types';
+
+describe('stored CommonJS eval facts', () => {
+  let root: string;
+  let db: DatabaseConnection;
+  let queries: QueryBuilder;
+  const file = (contentHash: string, value?: boolean | null): FileRecord => ({
+    path: 'm.js', contentHash, language: 'javascript', size: 1,
+    modifiedAt: 1, indexedAt: 1, nodeCount: 0, commonJsEvalCall: value,
+  });
+  beforeEach(() => {
+    root = fs.mkdtempSync(path.join(os.tmpdir(), 'cg-eval-facts-'));
+    db = DatabaseConnection.initialize(path.join(root, 'graph.db'));
+    queries = new QueryBuilder(db.getDb());
+  });
+  afterEach(() => { db.close(); fs.rmSync(root, { recursive: true, force: true }); });
+
+  it('does not prove absence from missing, malformed, or inconclusive facts', () => {
+    expect(queries.getCommonJsEvalCall('m.js', 'v1')).toBe(null);
+    queries.upsertFile(file('v1', null));
+    expect(queries.getCommonJsEvalCall('m.js', 'v1')).toBe(null);
+    queries.setMetadata('commonjs_eval:m.js', '{broken');
+    expect(queries.getCommonJsEvalCall('m.js', 'v1')).toBe(null);
+  });
+
+  it('requires an exact source hash and replaces the verdict on a new store', () => {
+    queries.upsertFile(file('v1', false));
+    expect(queries.getCommonJsEvalCall('m.js', 'v1')).toBe(false);
+    expect(queries.getCommonJsEvalCall('m.js', 'v2')).toBe(null);
+    queries.upsertFile(file('v2', true));
+    expect(queries.getCommonJsEvalCall('m.js', 'v1')).toBe(null);
+    expect(queries.getCommonJsEvalCall('m.js', 'v2')).toBe(true);
+  });
+
+  it('rolls back the fact with the surrounding file-store transaction', () => {
+    queries.upsertFile(file('v1', false));
+    expect(() => queries.runInTransaction(() => {
+      queries.upsertFile(file('v2', true));
+      throw new Error('store failed');
+    })).toThrow('store failed');
+    expect(queries.getFileByPath('m.js')!.contentHash).toBe('v1');
+    expect(queries.getCommonJsEvalCall('m.js', 'v1')).toBe(false);
+  });
+
+  it('removes facts with their file instead of leaking them to a replacement', () => {
+    queries.upsertFile(file('v1', true));
+    queries.deleteFile('m.js');
+    expect(queries.getCommonJsEvalCall('m.js', 'v1')).toBe(null);
+    queries.upsertFile(file('v1'));
+    expect(queries.getCommonJsEvalCall('m.js', 'v1')).toBe(null);
+  });
+});
diff --git a/__tests__/commonjs-eval.test.ts b/__tests__/commonjs-eval.test.ts
new file mode 100644
index 0000000000..6f5b7096db
--- /dev/null
+++ b/__tests__/commonjs-eval.test.ts
@@ -0,0 +1,67 @@
+import { beforeAll, describe, expect, it } from 'vitest';
+import { getParser, loadGrammarsForLanguages } from '../src/extraction/grammars';
+import { hasCommonJsEvalCall } from '../src/extraction/commonjs-eval';
+import type { Language } from '../src/types';
+
+beforeAll(async () => { await loadGrammarsForLanguages(['javascript', 'typescript', 'tsx']); });
+
+function read(source: string, language: Language = 'javascript'): boolean | null {
+  const tree = getParser(language)!.parse(source)!;
+  try { return hasCommonJsEvalCall(tree.rootNode); }
+  finally { tree.delete(); }
+}
+
+describe('AST recognition of CommonJS eval calls', () => {
+  it.each([
+    "eval('exports.load = Store.prototype.load;');",
+    "((eval))(('exports.load = Store.prototype.load;'));",
+    'eval(`exports.load = Store.prototype.load;`);',
+    'eval(`exports.load = ${code};`);',
+    "if (true) (eval)('exports.load = Store.prototype.load;');",
+    "for (let i = 0; i < 1; i++) ((eval))('exports.load = Store.prototype.load;');",
+    "function setup() { return (eval)('exports.load = Store.prototype.load;'); }",
+    "function* setup() { yield (eval)('exports.load = Store.prototype.load;'); }",
+    "const setup = { *run() { yield (eval)('exports.load = Store.prototype.load;'); } };",
+    "function* setup() { const obj = { [yield (eval)('exports.load = Store.prototype.load;')]() {} }; }",
+    "function yield(value) {} yield(eval('exports.load = Store.prototype.load;'));",
+    'const text = `${eval(code)}`;',
+    'eval(code);',
+  ])('finds a real callee: %s', (source) => { expect(read(source)).toBe(true); });
+
+  it.each([
+    'wrap(eval)("ignored");',
+    'wrap((eval))(("ignored"));',
+    '(makeWrap())(eval)("ignored");',
+    'wrap["call"](eval)("ignored");',
+    'wrap?.(eval)("ignored");',
+    'wrap`tag`(eval)("ignored");',
+    'if (eval) ("ignored");',
+    'function await(value) { return function ignore(code) {}; } await(eval)("ignored");',
+    'function yield(value) { return function ignore(code) {}; } yield(eval)("ignored");',
+    'function outer() { function yield(value) {} return yield(eval)("ignored"); }',
+    'function* outer() { function nested() { function yield(value) {} yield(eval)("ignored"); } }',
+    'function yield(value) {} const obj = { *[yield(eval)("ignored")]() {} };',
+    'class Evaluator { eval(code) {} }',
+    'const text = "eval(code)";',
+    'const text = `eval(code)`;',
+    '/* eval(code) */',
+    'const pattern = /eval(code)/;',
+    'holder.eval(code);',
+  ])('does not confuse another expression with the callee: %s', (source) => {
+    expect(read(source)).toBe(false);
+  });
+
+  it.each(['typescript', 'tsx'] as const)('uses the existing %s grammar', (language) => {
+    expect(read("if (true) (eval)('exports.load = Store.prototype.load;');", language)).toBe(true);
+    expect(read('wrap(eval)("ignored");', language)).toBe(false);
+  });
+
+  it('keeps a real call in a JSX expression', () => {
+    expect(read('<div title="eval(code)">{(eval)(code)}</div>', 'tsx')).toBe(true);
+    expect(read('<div title="eval(code)">eval(code)</div>', 'tsx')).toBe(false);
+  });
+
+  it('does not prove absence from malformed source', () => {
+    expect(read('function broken( {')).toBe(null);
+  });
+});
diff --git a/__tests__/commonjs-export-evidence-integration.test.ts b/__tests__/commonjs-export-evidence-integration.test.ts
new file mode 100644
index 0000000000..d0889fc466
--- /dev/null
+++ b/__tests__/commonjs-export-evidence-integration.test.ts
@@ -0,0 +1,330 @@
+import { afterEach, describe, expect, it } from 'vitest';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { CodeGraph } from '../src';
+import { runInNewContext } from 'node:vm';
+import { commonJsValueCases } from './fixtures/commonjs-value-cases';
+import { collectCommonJsExportEvidence as collect } from '../src/resolution/commonjs-export-evidence';
+
+const projects: Array<{ root: string; graph: CodeGraph }> = [];
+afterEach(() => {
+  for (const { root, graph } of projects.splice(0)) {
+    graph.close();
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+async function index(files: Record<string, string>): Promise<CodeGraph> {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cg-export-evidence-'));
+  for (const [file, source] of Object.entries(files)) fs.writeFileSync(path.join(root, file), source);
+  const graph = await CodeGraph.init(root, { index: true });
+  projects.push({ root, graph });
+  return graph;
+}
+
+function calls(graph: CodeGraph, name: string): string[] {
+  const node = graph.getNodesByName(name).find(n => n.kind === 'function')!;
+  expect(node).toBeDefined();
+  return graph.getOutgoingEdges(node.id).filter(e => e.kind === 'calls').map(e => {
+    const target = graph.getNode(e.target)!;
+    return `${target.filePath}:${target.qualifiedName}`;
+  }).sort();
+}
+
+describe('export evidence at the real import boundary', () => {
+  describe.each(['./m', './index'])('value identity through %s', specifier => {
+    it.each([
+      'const api={};api.load=Store.prototype.load;module.exports=api;',
+      'class Factory{};Factory.load=Store.prototype.load;module.exports=Factory;',
+      'function Factory(){};Factory.load=Store.prototype.load;module.exports=Factory;',
+      'const api={};const alias=api;alias.load=Store.prototype.load;module.exports=api;',
+      'const api={};module.exports=api;api.load=Store.prototype.load;',
+    ])('preserves F14 callable ownership: %s', async assignment => {
+      const source = `class Store { load(){return 42;} }\n${assignment}`;
+      const module = { exports: {} as { load(): number } };
+      runInNewContext(source, { module, exports: module.exports });
+      expect(module.exports.load()).toBe(42);
+      const graph = await index({
+        'm.js': source,
+        'index.js': "module.exports=require('./m');",
+        'decoy.js': 'class Decoy { load() {} }',
+        'use.js': `const named=require('${specifier}');function run(){return named.load();}`,
+      });
+      expect(calls(graph, 'run')).toEqual(['m.js:Store::load']);
+    });
+
+    it.each(['const value=42;exports.load=value;', 'const value="payload";module.exports={load:value};'])(
+      'preserves F15 data without creating a call: %s', async source => {
+        const module = { exports: {} as { load(): unknown } };
+        runInNewContext(source, { module, exports: module.exports });
+        expect(() => module.exports.load()).toThrow(/not a function/);
+        const graph = await index({
+          'm.js': source, 'index.js': "module.exports=require('./m');",
+          'use.js': `const named=require('${specifier}');function run(){return named.load();}`,
+        });
+        expect(calls(graph, 'run')).toEqual([]);
+      });
+
+    it('follows an assigned callable rather than its storage variable', async () => {
+      const graph = await index({
+        'm.js': 'function real(){return 42;}let value;value=real;exports.load=value;',
+        'index.js': "module.exports=require('./m');",
+        'use.js': `const named=require('${specifier}');function run(){return named.load();}`,
+      });
+      expect(calls(graph, 'run')).toEqual(['m.js:real']);
+    });
+  });
+  it.each([
+    'const alias = Store.prototype.load; exports.load = alias;',
+    'const alias = Store.prototype.load; module.exports = { load: alias };',
+    'const alias = () => 42; module.exports = { load: alias };',
+  ])('follows the exported callable alias: %s', async (assignment) => {
+    const graph = await index({
+      'm.js': `class Store { load() {} }\n${assignment}`,
+      'decoy.js': 'class Decoy { load() {} }',
+      'use.js': "const named = require('./m'); function run() { named.load(); }",
+    });
+    expect(calls(graph, 'run')).toEqual([assignment.includes('=>') ? 'm.js:alias' : 'm.js:Store::load']);
+  });
+
+  it('honors a typed parameter that shadows the import at the call site', async () => {
+    const graph = await index({
+      'm.js': 'class Store { load() {} } exports.load = Store.prototype.load;',
+      'use.ts': "import named from './m';\nclass Local { load() {} }\nexport function run(named: Local) { named.load(); }",
+    });
+    expect(calls(graph, 'run')).toEqual(['use.ts:Local::load']);
+  });
+
+  it('honors a lexical class that shadows the import at the call site', async () => {
+    const graph = await index({
+      'm.js': 'class Store { load() {} } exports.load = Store.prototype.load;',
+      'use.js': "const named = require('./m');\nfunction outer() { class named { static load() {} } function run() { named.load(); } return run; }",
+    });
+    expect(calls(graph, 'run')).toEqual(['use.js:outer::named::load']);
+  });
+
+  it.each([
+    'module.exports = makeUnknown();',
+    'eval(code);',
+    "function eval(code) {} eval('exports.load = Store.prototype.load;');",
+  ])('does not supply a global target for unsupported export behavior: %s', async (mutation) => {
+    const graph = await index({
+      'm.js': `class Store { load() {} }\n${mutation}`,
+      'decoy.js': 'class Decoy { load() {} }',
+      'use.js': "const named = require('./m'); function run() { named.load(); }",
+    });
+    expect(calls(graph, 'run')).toEqual([]);
+  });
+});
+
+
+describe.each(['./m', './index'])('production value contract through %s', specifier => {
+  it.each(commonJsValueCases)('%s', async (_label, source, status, selector) => {
+    const graph = await index({
+      'm.js': source,
+      'index.js': "module.exports=require('./m');",
+      'decoy.js': 'class Decoy { load() {} }',
+      'use.js': `const named=require('${specifier}');function run(){return named.load();}`,
+    });
+    expect(calls(graph, 'run')).toEqual(status === 'positive' ? [selector] : []);
+  });
+});
+
+describe('callable evidence across import syntax and sync', () => {
+  it.each([
+    "const {load}=require('./index');",
+    "import {load} from './index';",
+    "import load from './index';",
+  ])('does not borrow a global callable for data: %s', async declaration => {
+    const graph = await index({
+      'm.js': 'const value=42;exports.load=value;',
+      'index.js': "module.exports=require('./m');",
+      'decoy.js': 'function load() {}',
+      'use.js': `${declaration}function run(){return load();}`,
+    });
+    expect(calls(graph, 'run')).toEqual([]);
+  });
+
+  it('retains a local function shadow of a destructured require', async () => {
+    const graph = await index({
+      'm.js': 'exports.load=42;',
+      'use.js': "const {load}=require('./m');function outer(){function load(){}function run(){load();}return run;}",
+    });
+    expect(calls(graph, 'run')).toEqual(['use.js:outer::load']);
+  });
+
+  it('recomputes forwarded identity and callability after source edits', async () => {
+    const graph = await index({
+      'm.js': 'class Store{load(){}}const api={};api.load=Store.prototype.load;module.exports=api;',
+      'index.js': "module.exports=require('./m');",
+      'use.js': "const named=require('./index');function run(){named.load();}",
+    });
+    expect(calls(graph, 'run')).toEqual(['m.js:Store::load']);
+    const { root } = projects.find(project => project.graph === graph)!;
+    for (const [source, targets] of [
+      ['const value=42;exports.load=value;', []],
+      ['function real(){}let value;value=real;exports.load=value;', ['m.js:real']],
+      ['function real(){}let value=42;exports.load=value;', []],
+      ['function real(){}let value=real;exports.load=value;', ['m.js:real']],
+      ['const api={};module.exports=api;', []],
+      ['class Store{load(){}}const api={};module.exports=api;api.load=Store.prototype.load;', ['m.js:Store::load']],
+    ] as const) {
+      fs.writeFileSync(path.join(root, 'm.js'), source);
+      await graph.sync();
+      expect(calls(graph, 'run')).toEqual(targets);
+    }
+  });
+});
+
+
+describe.each(['./m', './index'])('named CommonJS values through %s', specifier => {
+  it.each([
+    `const {load}=require('${specifier}');`,
+    `import {load} from '${specifier}';`,
+  ])('follows the stored callable through %s', async declaration => {
+    const graph = await index({
+      'm.js': 'function real(){}let value;value=real;exports.load=value;',
+      'index.js': "module.exports=require('./m');",
+      'use.js': `${declaration}function run(){load();}`,
+    });
+    expect(calls(graph, 'run')).toEqual(['m.js:real']);
+  });
+
+  it('selects a callable property of a named object import', async () => {
+    const graph = await index({
+      'm.js': 'function real(){}const api={load:real};exports.api=api;',
+      'index.js': "module.exports=require('./m');",
+      'use.js': `import {api} from '${specifier}';function run(){api.load();}`,
+      'decoy.js': 'class Decoy{load(){}}',
+    });
+    expect(calls(graph, 'run')).toEqual(['m.js:real']);
+  });
+
+  it('keeps class construction separate from ordinary calls', async () => {
+    const graph = await index({
+      'm.js': 'class Store{}module.exports=Store;',
+      'index.js': "module.exports=require('./m');",
+      'use.js': `const Made=require('${specifier}');function run(){Made();}function construct(){return new Made();}`,
+      'decoy.js': 'function Made(){}',
+    });
+    expect(calls(graph, 'run')).toEqual([]);
+    const construct = graph.getNodesByName('construct').find(node => node.kind === 'function')!;
+    expect(graph.getOutgoingEdges(construct.id).filter(edge => edge.kind === 'instantiates').map(edge => graph.getNode(edge.target)?.qualifiedName)).toEqual(['Store']);
+  });
+});
+
+describe('opaque writes on a known value stay no-edge', () => {
+  it.each([
+    'const api={load:Store.prototype.load};opaque(api);module.exports=api;',
+    'const api={load:Store.prototype.load};api[key]=42;module.exports=api;',
+  ])('never resolves to the storage variable: %s', async exportSource => {
+    const graph = await index({ 'm.js': `class Store { load() { return 42; } }\n${exportSource}`,
+      'use.js': "const named=require('./m');function run(){return named.load();}" });
+    expect(calls(graph, 'run')).toEqual([]);
+  });
+});
+
+describe('sloppy-mode CommonJS stays in the model (F18)', () => {
+  const use = "const svc=require('./m');const {helper}=require('./m');function run(){helper();return svc.main();}";
+  const body = 'function main(){ return 1; }\nfunction helper(){ return 2; }\nmodule.exports = { main, helper };\n';
+  it.each([
+    ['hashbang', `#!/usr/bin/env node\n${body}`],
+    ['hashbang after a BOM', `\uFEFF#!/usr/bin/env node\n${body}`],
+    ['legacy octal literal', `var mode = 0755;\n${body}`],
+    ['legacy octal escape', `var s = "\\101";\n${body}`],
+    ['leading-zero decimal', `var n = 08;\n${body}`],
+    ['escape \\8', `var s = "\\8";\n${body}`],
+    ['Flow annotations', '// @flow\nfunction main(x: number): number { return x; }\nfunction helper(){ return 2; }\nmodule.exports = { main, helper };\n'],
+  ])('%s', async (_label, source) => {
+    expect(collect(source, 'm.js').commonJs).toBe(true);
+    expect(calls(await index({ 'm.js': source, 'use.js': use }), 'run')).toEqual(['m.js:helper', 'm.js:main']);
+  });
+
+  it('a hashbang ended by a lone CR stays modelled and resolves as before', async () => {
+    // The extractor reads `function main` as part of the hashbang line, as it
+    // did before the model; only helper has a node to resolve to.
+    const source = `#!/usr/bin/env node\r${body}`;
+    expect(collect(source, 'm.js').members).toHaveProperty('main');
+    expect(calls(await index({ 'm.js': source, 'use.js': use }), 'run')).toEqual(['m.js:helper']);
+  });
+
+  it('an unparsable file leaves the model', () => {
+    expect(collect(`<!-- legacy\n${body}`, 'm.js')).toMatchObject({ commonJs: false, unmodeled: 'unparsed source' });
+  });
+
+  it('a callback that never writes exports keeps exports closed', async () => {
+    const source = 'function main(){ return 1; }\n[1].forEach(function(x){ return x; });\nmodule.exports = { main };\n';
+    const graph = await index({ 'm.js': source, 'decoy.js': 'function helper() {}\n', 'use.js': use });
+    expect(calls(graph, 'run')).toEqual(['m.js:main']);
+  });
+});
+
+describe('a file outside the value model resolves exactly as before the model', () => {
+  // Each expectation is the pre-PR (87576a8d) graph for the same files.
+  it.each([
+    ["ctorcls", {"c.js":"const svc=require('./m');\nfunction run(){ return svc.load(); }\nmodule.exports=run;\n","m.js":"class Foo {\n  constructor(){ this.x=1; }\n  load(){ return 1; }\n}\nmodule.exports = new Foo();\n"}, ["m.js:Foo::load"], "incomplete: custom construction/inheritance outside contract"],
+    ["extcls", {"c.js":"const svc=require('./m');\nfunction run(){ svc.base(); return svc.load(); }\nmodule.exports=run;\n","m.js":"class Base { base(){ return 2; } }\nclass Foo extends Base {\n  load(){ return 1; }\n}\nmodule.exports = new Foo();\n"}, ["m.js:Base::base","m.js:Foo::load"], "incomplete: custom construction/inheritance outside contract"],
+    ["evbus", {"c.js":"const bus=require('./m');\nfunction run(){ bus.publish(1); }\nmodule.exports=run;\n","m.js":"const EventEmitter = require('events');\nclass Bus extends EventEmitter {\n  publish(x){ this.emit('x', x); }\n}\nmodule.exports = new Bus();\n"}, ["m.js:Bus::publish"], "incomplete: custom construction/inheritance outside contract"],
+    ["oassign", {"c.js":"const api = require('./m');\nconst { load } = require('./m');\nfunction run(){ load(); return api.load(); }\nmodule.exports = run;\n","m.js":"function load(){ return 42; }\nObject.assign(module.exports, { load });\n"}, ["m.js:load"], "incomplete: unmodeled builtin write"],
+    ["spreadreq", {"a.js":"function load(){ return 1; }\nmodule.exports = { load };\n","b.js":"function save(){ return 2; }\nmodule.exports = { save };\n","c.js":"const api = require('./index');\nconst { save } = require('./index');\nfunction run(){ save(); return api.load(); }\nmodule.exports = run;\n","index.js":"module.exports = {\n  ...require('./a'),\n  ...require('./b'),\n};\n"}, ["b.js:save"], null],
+    ["iife", {"c.js":"const lib = require('./m');\nconst { load } = require('./m');\nfunction run(){ load(); return lib.load(); }\nmodule.exports = run;\n","m.js":"(function(){\n  'use strict';\n  function load(){ return 1; }\n  module.exports = { load: load };\n})();\n"}, ["m.js:load","m.js:load"], "unmodeled use of module.exports"],
+    ["thisexp2", {"c.js":"const { load } = require('./m');\nfunction run(){ return load(); }\nmodule.exports=run;\n","m.js":"function load(){ return 1; }\nthis.load = load;\n"}, ["m.js:load"], "top-level this"],
+    ["topret", {"c.js":"const api = require('./m');\nconst { load } = require('./m');\nfunction run(){ load(); return api.load(); }\nmodule.exports = run;\n","m.js":"function load(){ return 1; }\nexports.load = load;\nif (exports.load) return;\nexports.load = 42;\n"}, ["m.js:load","m.js:load"], "top-level return"],
+    ["interop", {"c.ts":"import load, { helper } from './m';\nexport function run(){ helper(); return load(); }\n","e.mjs.js":"import load from './m';\nexport function run2(){ return load(); }\n","m.js":"\"use strict\";\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.helper = helper;\nexports.default = load;\nfunction load(){ return 1; }\nfunction helper(){ return 2; }\n"}, ["m.js:helper","m.js:load"], "ES module interop default"],
+    ["callthis", {"m.js":"function main(){return 1;}\nfunction helper(){return 2;}\n(function(){ module.exports={main,helper}; }).call(this);\n","use.js":"const svc=require(\"./m\");const {helper}=require(\"./m\");function run(){helper();return svc.main();}\n"}, ["m.js:helper"], "unmodeled use of module.exports"],
+    ["newfn", {"m.js":"function main(){return 1;}\nfunction helper(){return 2;}\nnew function(){ module.exports={main,helper}; };\n","use.js":"const svc=require(\"./m\");const {helper}=require(\"./m\");function run(){helper();return svc.main();}\n"}, ["m.js:helper"], "unmodeled use of module.exports"],
+    ["aliasiife", {"m.js":"function main(){return 1;}\nfunction helper(){return 2;}\nconst api=module.exports={};\n(function(){ api.main=main; api.helper=helper; })();\n","use.js":"const svc=require(\"./m\");const {helper}=require(\"./m\");function run(){helper();return svc.main();}\n"}, ["m.js:helper"], "unmodeled use of exports"],
+    ["varclosure", {"m.js":"function main(){return 1;}\nfunction helper(){return 2;}\nconst init=()=>{ module.exports={main,helper}; };\ninit();\n","use.js":"const svc=require(\"./m\");const {helper}=require(\"./m\");function run(){helper();return svc.main();}\n"}, ["m.js:helper"], "unmodeled use of module.exports"],
+    ["fwd1", {"impl.js":"function load(){return 1;}\nObject.assign(exports,{load});\n","index.js":"module.exports = require('./impl');\n","use.js":"const {load}=require(\"./index\");function run(){return load();}\n"}, ["impl.js:load"], null],
+    ["mixb", {"m.js":"function load(){return 1;}\nObject.assign(exports,{load});delete exports.load;\n","use.js":"const {load}=require(\"./m\");function run(){return load();}\n"}, ["m.js:load"], "unmodeled use of exports"],
+    ["initfn", {"c.js":"const lib = require('./m');\nconst { helper } = require('./m');\nfunction run(){ helper(); return lib.load(); }\nmodule.exports = run;\n","m.js":"function load(){ return 1; }\nfunction helper(){ return 2; }\nfunction init(){ module.exports.load = load; module.exports.helper = helper; }\ninit();\n"}, ["m.js:helper"], "unmodeled use of module.exports"],
+    ["namedcb", {"c.js":"const lib = require('./m');\nconst { helper } = require('./m');\nfunction run(){ helper(); return lib.load(); }\nmodule.exports = run;\n","m.js":"function load(){ return 1; }\nfunction helper(){ return 2; }\nfunction install(name){ module.exports[name] = name === 'load' ? load : helper; }\n['load','helper'].forEach(install);\n"}, ["m.js:helper"], "unmodeled use of module.exports"],
+    ["clobber", {"c.js":"const lib = require('./m');\nconst { load } = require('./m');\nfunction run(){ load(); return lib.load(); }\nmodule.exports = run;\n","m.js":"class Impl { load(){ return 1; } }\nexports.load = 42;\nObject.assign(exports, { impl: new Impl() });\n"}, ["m.js:Impl::load"], "incomplete: unmodeled builtin write"],
+    ["fwdesm", {"c.js":"const lib = require('./m');\nconst { helper } = require('./m');\nfunction run(){ helper(); return lib.load(); }\nmodule.exports = run;\n","impl.js":"export function load(){ return 1; }\nexport function helper(){ return 2; }\n","m.js":"module.exports = require('./impl');\n"}, ["impl.js:helper","impl.js:load"], null],
+  ] as const)('%s', async (_name, files, expected, reason) => {
+    const m = Object.keys(files).find(file => file === 'm.js');
+    if (reason && m) expect(collect(files[m as keyof typeof files] as string, m)).toMatchObject({ commonJs: false, unmodeled: reason });
+    expect(calls(await index(files), 'run')).toEqual(expected);
+  });
+});
+
+describe('files the value model keeps', () => {
+  it.each([
+    ["frozen object", {"c.js":"const m=require('./m');\nfunction run(){ return m.load(); }\nmodule.exports=run;\n","m.js":"const api = { load(){ return 1; } };\nObject.freeze(api);\nmodule.exports = api;\n"}, ["m.js:api::load"]],
+    ["legacy octal", {"c.js":"const util = require('./m');\nconst { mkdir } = require('./m');\nfunction run(){ mkdir('x'); return util.load(); }\nmodule.exports = run;\n","m.js":"var fs = require('fs');\nfunction mkdir(p){ return fs.mkdirSync(p, 0755); }\nfunction load(){ return 1; }\nmodule.exports = { mkdir: mkdir, load: load };\n"}, ["m.js:load","m.js:mkdir"]],
+    ["hashbang", {"c.js":"const cli=require('./m');\nconst { helper } = require('./m');\nfunction run(){ helper(); return cli.main(); }\nmodule.exports=run;\n","m.js":"#!/usr/bin/env node\nfunction main(){ return 1; }\nfunction helper(){ return 2; }\nmodule.exports = { main, helper };\n"}, ["m.js:helper","m.js:main"]],
+    ["literal-key data descriptor", {"c.js":"const api = require('./m');\nconst { load } = require('./m');\nfunction run(){ load(); return api.load(); }\nmodule.exports = run;\n","m.js":"function load(){ return 42; }\nObject.defineProperty(module.exports, 'load', { value: load, enumerable: true });\n"}, ["m.js:load","m.js:load"]],
+    ["hoisted function first read in an if arm", {"c.js":"const cli = require('./m');\nconst { parse } = require('./m');\nfunction run(){ parse('y'); return cli.main(); }\nmodule.exports = run;\n","m.js":"if (require.main === module) {\n  main();\n}\nmodule.exports = { main, parse };\nfunction main(){ return parse('x'); }\nfunction parse(s){ return s; }\n"}, ["m.js:main","m.js:parse"]],
+    ["__esModule marker keeps an unexported helper unlinked (R13-4)", {"m.js":"\"use strict\";\nObject.defineProperty(exports, \"__esModule\", { value: true });\nexports.main = void 0;\nfunction helper(){ return 2; }\nfunction main(){ return helper(); }\nexports.main = main;\n","use.js":"const svc=require(\"./m\");\nconst {helper}=require(\"./m\");\nfunction run(){ svc.helper(); helper(); return svc.main(); }\n"}, ["m.js:main"]],
+    ["a closure that only reads module stays modeled (S8)", {"c.js":"const lib = require('./m');\nconst { load } = require('./m');\nfunction run(){ load(); return lib.load(); }\nmodule.exports = run;\n","m.js":"class Impl { load(){ return 1; } }\nexports.load = 42;\nprocess.nextTick(() => { if (require.main === module) console.log('main'); });\n"}, []],
+    ["constructor function with prototype methods", {"c.js":"const { load } = require('./m');\nfunction run(){ return load(); }\nmodule.exports=run;\n","m.js":"function Foo(){}\nFoo.prototype.load = function load(){ return 1; };\nconst foo = new Foo();\nmodule.exports = { load: foo.load };\n"}, ["m.js:load"]],
+  ] as const)('%s', async (_label, files, expected) => {
+    expect(collect(files['m.js' as keyof typeof files] as string, 'm.js').commonJs).toBe(true);
+    expect(calls(await index(files), 'run')).toEqual(expected);
+  });
+});
+
+describe('round 14', () => {
+  it('an unmodelled file uses the pre-model reader verbatim: wrap(eval)(code) is not a direct eval (R14-S1)', async () => {
+    const graph = await index({
+      'm.js': "class Impl { run(){ return 1; } }\nthis.flag = 1;\nexports.load = function load(){ return 2; };\nfunction wrap(f){ return f; }\nwrap(eval)('1');\n",
+      'c.js': 'const lib = require("./m");\nconst { run } = require("./m");\nfunction go(){ run(); return lib.run(); }\nmodule.exports = go;\n',
+    });
+    expect(calls(graph, 'go')).toEqual([]);
+  });
+
+  const use = "const m=require('./m');const {a,b}=require('./m');\nfunction run(){ m.a(); m.b(); a(); b(); }\nmodule.exports=run;\n";
+  const forwarder = 'exports.b=require("./y").b;exports.a=require("./y").a;\n';
+  it.each([
+    ['an ES module', 'export function b(){return 2}\nexport function a(){return 1}\n'],
+    ['an unmodelled CommonJS file', 'function b(){return 2}\nfunction a(){return 1}\n(function(){exports.q=1})();\nexports.b=b;exports.a=a;\n'],
+  ])('a member forwarded into %s resolves in that file (R14-6)', async (_label, target) => {
+    expect(calls(await index({ 'm.js': forwarder, 'y.js': target, 'use.js': use }), 'run')).toEqual(['y.js:a', 'y.js:a', 'y.js:b', 'y.js:b']);
+  });
+
+  it('a same-named declaration the unmodelled file never exports is not the answer', async () => {
+    const target = 'function b(){return 2}\nfunction a(){return 1}\n(function(){exports.q=1})();\nexports.a=a;\n';
+    expect(calls(await index({ 'm.js': forwarder, 'y.js': target, 'use.js': use }), 'run')).toEqual(['y.js:a', 'y.js:a']);
+  });
+});
diff --git a/__tests__/commonjs-export-evidence.test.ts b/__tests__/commonjs-export-evidence.test.ts
new file mode 100644
index 0000000000..e23e5de0ee
--- /dev/null
+++ b/__tests__/commonjs-export-evidence.test.ts
@@ -0,0 +1,82 @@
+import { describe, expect, it } from 'vitest';
+import { collectCommonJsExportEvidence as collect, commonJsExportResult } from '../src/resolution/commonjs-export-evidence';
+
+describe('binding-aware CommonJS export records', () => {
+  it.each([
+    'function pretend(module) { module.exports = {}; }',
+    'const pretend = module => { module.exports = {}; };',
+    '{ const module = {}; module.exports = {}; }',
+    'function pretend() { module.exports = {}; var module; }',
+    'function pretend({module}) { module.exports = {}; }',
+    'try {} catch(module) { module.exports = {}; }',
+  ])('ignores a shadowed wrapper binding: %s', (shadow) => {
+    const record = collect(`exports.known = function known() {};\n${shadow}`, 'm.js');
+    expect(record.defaults).toEqual([]);
+    expect(Object.keys(record.members)).toEqual(['known']);
+  });
+
+  it.each([
+    'module.exports = new Store();',
+    '(module.exports) = new Store();',
+    '((module["exports"])) = { load: Store.prototype.load };',
+    'module.exports &&= new Store();',
+  ])('records declaration ownership for %s', (assignment) => {
+    const record = collect(`class Store { load() {} }\n${assignment}`, 'm.js');
+    expect(record.members.load).toEqual([{ name: 'load', line: 1, column: 14, kind: 'method' }]);
+    expect(record.version).toBe(2);
+    expect(record.sourceHash).toMatch(/^[a-f0-9]{64}$/);
+  });
+
+  it.each([
+    ['module.exports = class R { static make() {} route() {} };\n', 'make', 1, 34],
+    ['const R = class { static make() {} };\nmodule.exports = R;\n', 'make', 1, 25],
+    ['module.exports = { R: class { static make() {} } };\n', 'R.make', 1, 37],
+    ['exports.Store = class StoreImpl {\n  static open() { return 4; }\n};\n', 'Store.open', 2, 9],
+  ] as const)('keeps static methods of an exported class expression (#2499): %s', (source, member, line, column) => {
+    const answer = commonJsExportResult(collect(source, 'm.js'), member);
+    expect(answer.callable).toMatchObject({ status: 'positive', selector: { line, column, kind: 'method' } });
+  });
+
+  it('reads instance methods of an exported class expression through its prototype (#2499)', () => {
+    const answer = commonJsExportResult(collect('module.exports = class R { route() {} };\n', 'm.js'), 'prototype.route');
+    expect(answer.callable).toMatchObject({ status: 'positive', selector: { name: 'route', kind: 'method' } });
+  });
+
+  it('keeps static and instance members on their own exported value', () => {
+    const record = collect('class Store { static make() {} load() {} } module.exports = Store;', 'm.js');
+    expect(record.members.make).toHaveLength(1);
+    expect(record.members.load).toBeUndefined();
+  });
+
+  it('replaces a previous whole value without treating old exports as the new object', () => {
+    const record = collect('class Store { load() {} } module.exports = new Store(); module.exports = {}; exports.load = Store.prototype.load;', 'm.js');
+    expect(record.members.load).toBeUndefined();
+  });
+
+  it('finds literal eval targets in generator scope, including declarations after the call site', () => {
+    const record = collect("function* setup() { const obj = { [yield (eval)('exports.load = Store.prototype.load;')]() {} }; }\nclass Store { load() {} }\nsetup().next();", 'm.js');
+    expect(record.members.load).toEqual([{ name: 'load', line: 2, column: 14, kind: 'method' }]);
+  });
+
+  it('does not interpret a local eval function as the intrinsic', () => {
+    const record = collect("class Store { load() {} } function eval(code) {} eval('exports.load = Store.prototype.load;');", 'm.js');
+    expect(record.members.load).toBeUndefined();
+  });
+
+  it('does not turn a dynamic eval into a declaration relationship', () => {
+    const record = collect('class Store { load() {} } eval(code);', 'm.js');
+    expect(record.unknown).toBe(true);
+    expect(record.members.load).toBeUndefined();
+  });
+
+  it('returns no target on incomplete syntax', () => {
+    const record = collect('module.exports = ;', 'm.js');
+    expect(record.unknown).toBe(true);
+    expect(record.defaults).toEqual([]);
+  });
+
+  it('leaves ESM and TypeScript export assignment to their existing resolver', () => {
+    expect(collect('export default class Store {}', 'm.ts').commonJs).toBe(false);
+    expect(collect('const value = {}; export = value;', 'm.ts').commonJs).toBe(false);
+  });
+});
diff --git a/__tests__/commonjs-export-members.test.ts b/__tests__/commonjs-export-members.test.ts
index 9b423f0f07..e571c3941c 100644
--- a/__tests__/commonjs-export-members.test.ts
+++ b/__tests__/commonjs-export-members.test.ts
@@ -1,7 +1,64 @@
-import { describe, expect, it } from 'vitest';
-import { readCommonJsExportMembers } from '../src/resolution/commonjs-export-members';
+import { beforeAll, describe, expect, it } from 'vitest';
+import { readCommonJsExportMembers as readMembers } from '../src/resolution/commonjs-export-members';
+import { getParser, loadGrammarsForLanguages } from '../src/extraction/grammars';
+import { hasCommonJsEvalCall } from '../src/extraction/commonjs-eval';
+
+beforeAll(async () => { await loadGrammarsForLanguages(['javascript', 'typescript', 'tsx']); });
+
+function readCommonJsExportMembers(source: string, jsx = false) {
+  return readMembers(source, jsx, () => {
+    const language = jsx ? 'tsx' : source.includes('generic<T>') ? 'typescript' : 'javascript';
+    const tree = getParser(language)!.parse(source)!;
+    try { return hasCommonJsEvalCall(tree.rootNode); }
+    finally { tree.delete(); }
+  });
+}
 
 describe('CommonJS export member discovery', () => {
+  describe.each([
+    ['namespace writes', 'exports.known = known;', 'namespace', ['known']],
+    ['direct alias', 'exports.load = Store.prototype.load;', 'namespace', ['load']],
+    ['root object', 'module.exports = { load: Store.prototype.load };', 'value', []],
+    ['root instance', 'module.exports = new Store();', 'value', []],
+    ['computed write', 'exports[key] = Store.prototype.load;', 'opaque', []],
+    ['escaped exports', 'take(exports);', 'opaque', []],
+  ] as const)('%s independently of eval certainty', (_label, assignment, exportForm, members) => {
+    it.each([
+      ['absent', false], ['present', true], ['unknown', null],
+    ] as const)('retains export evidence when eval is %s', (evalState, fact) => {
+      const result = readMembers(`${assignment}\nwrap(eval)("code");`, false, () => fact);
+      expect(result).toMatchObject({ exportForm, evalState });
+      expect([...result.members]).toEqual(members);
+      expect(result.uncertain).toBe(exportForm !== 'namespace' || fact !== false);
+    });
+  });
+
+  it.each([
+    'module["exports"] = new Store();',
+    'module /* root */ ["exports"] = { load: Store.prototype.load };',
+    'exports = module.exports = new Store();',
+    'module.exports = exports = new Store();',
+    'exports.known = known; module.exports = new Store();',
+    'module.exports = new Store(); module.exports.extra = extra;',
+    'module.exports = new Store(); take(module.exports);',
+  ])('retains a stated whole value beside bracket or mixed writes: %s', (source) => {
+    const result = readMembers(`${source}\nwrap(eval)("code");`, false, () => null);
+    expect(result).toMatchObject({ exportForm: 'value', evalState: 'unknown', uncertain: true });
+  });
+
+  it.each([
+    'holder.module.exports = new Store();',
+    'module.exports === new Store();',
+    'module.exports.load = Store.prototype.load;',
+    'const text = "module.exports = new Store();";',
+  ])('does not infer a stated whole value from %s', (source) => {
+    expect(readMembers(source)).not.toHaveProperty('exportForm', 'value');
+  });
+
+  it('does not prove eval absent when the extraction fact is missing or unknown', () => {
+    expect(readMembers('wrap(eval)("ignored");').uncertain).toBe(true);
+    expect(readMembers('wrap(eval)("ignored");', false, () => null).uncertain).toBe(true);
+  });
   it.each([
     'exports.load = Store.prototype.load;',
     'module.exports.load = Store.prototype.load;',
@@ -36,6 +93,13 @@ describe('CommonJS export member discovery', () => {
     'let value: typeof exports.missing = undefined;',
     'type Loader = typeof require.cache;',
     'class Evaluator { eval(code) {} }',
+    'wrap(eval)("ignored");',
+    'wrap((eval))(("ignored"));',
+    '(makeWrap())(eval)("ignored");',
+    'wrap["call"](eval)("ignored");',
+    'wrap?.(eval)("ignored");',
+    'wrap`tag`(eval)("ignored");',
+    'if (eval) ("ignored");',
   ])('ignores non-export text: %s', (source) => {
     const result = readCommonJsExportMembers(source);
     expect([...result.members]).toEqual([]);
@@ -54,6 +118,7 @@ describe('CommonJS export member discovery', () => {
     'eval(`exports.load = ${Store.prototype.load};`);',
     "(eval)('exports.load = Store.prototype.load;');",
     "((eval))(('exports.load = Store.prototype.load;'));",
+    "function setup() { return (eval)('exports.load = Store.prototype.load;'); }",
     'require.cache[__filename].exports = new Store();',
     "const Module = require('node:module');",
     "import { Module } from 'node:module';",
diff --git a/__tests__/commonjs-value-contract.test.ts b/__tests__/commonjs-value-contract.test.ts
new file mode 100644
index 0000000000..23e1ad517c
--- /dev/null
+++ b/__tests__/commonjs-value-contract.test.ts
@@ -0,0 +1,77 @@
+import { expect, it } from 'vitest';
+import { runInNewContext } from 'node:vm';
+import { collectCommonJsExportEvidence as collect, commonJsExportResult as answer } from '../src/resolution/commonjs-export-evidence';
+import { commonJsValueCases as cases } from './fixtures/commonjs-value-cases';
+
+for (const [label, source, status, selector, execute = true] of cases) {
+  it(label, () => {
+    if (execute) {
+      const module = { exports: {} as { load?: () => number } };
+      runInNewContext(source, { module, exports: module.exports });
+      expect(typeof module.exports.load === 'function').toBe(status === 'positive');
+      if (status === 'positive') expect(module.exports.load!()).toBe(42);
+    }
+    const result = answer(collect(source, 'm.js'), 'load');
+    expect(result.callable.status).toBe(status);
+    expect(result.callable.status === 'positive' ? result.callable.selector?.name : undefined).toBe(selector?.split('::').pop()?.split(':').pop());
+  });
+}
+
+it('data reference ownership stays independent of callability', () => {
+  const result = answer(collect('const value=42;exports.load=value;', 'm.js'), 'load');
+  expect(result.reference).toMatchObject({ status: 'positive', selector: { name: 'value', kind: 'value' } });
+  expect(result.callable.status).toBe('non-callable');
+});
+
+it('class construction is distinct from ordinary calls and instances', () => {
+  const cls = answer(collect('class Store{};module.exports=Store;', 'm.js'), null);
+  expect(cls.constructible).toMatchObject({ status: 'positive', selector: { name: 'Store', kind: 'class' } });
+  expect(cls.callable.status).toBe('non-callable');
+  const instance = answer(collect('class Store{};module.exports=new Store();', 'm.js'), null);
+  expect(instance.callable.status).toBe('non-callable');
+  expect(instance.constructible.status).toBe('non-callable');
+});
+
+it.each([
+  'class Store { constructor(){return {};} load(){return 42;} } module.exports=new Store();',
+  'class Base { load(){return 42;} } class Store extends Base {} module.exports=new Store();',
+  'class Store { load(){return 42;} } class Other { load(){return 99;} } Store.prototype={load:Other.prototype.load};module.exports=new Store();',
+])('unsupported construction supplies no guessed callable: %s', source => {
+  expect(answer(collect(source, 'm.js'), 'load').callable.status).toBe('unknown');
+});
+
+it('eval-local data cannot invent an indexed reference selector', () => {
+  const result = answer(collect("eval('var data=42;exports.load=data;');", 'm.js'), 'load');
+  expect(result.reference.status === 'positive' ? result.reference.selector : undefined).toBeUndefined();
+  expect(result.callable.status).toBe('non-callable');
+});
+
+it.each([
+  'class Factory{};if(false)Factory.load=Store.prototype.load;module.exports=Factory;',
+  'function Factory(){};if(false)Factory.load=Store.prototype.load;module.exports=Factory;',
+  'module.exports={};module.exports ||= (exports.load=Store.prototype.load);',
+])('does not infer a write from an unexecuted arm: %s', assignment => {
+  const source = `class Store{load(){return 42;}}${assignment}`;
+  const module = { exports: {} as { load?: unknown } };
+  runInNewContext(source, { module, exports: module.exports });
+  expect(module.exports.load).toBeUndefined();
+  expect(answer(collect(source, 'm.js'), 'load').callable.status).toBe('absent');
+});
+
+it.each([
+  "const indirect=eval;indirect('exports.load=Store.prototype.load;');",
+  "eval?.('exports.load=Store.prototype.load;');",
+  "function invoke(fn){fn('exports.load=Store.prototype.load;');}invoke(eval);",
+])('indirect eval supplies no wrapper-scoped target: %s', expression => {
+  const result = answer(collect(`class Store{load(){}}${expression}`, 'm.js'), 'load');
+  expect(result.callable.status).toBe('unknown');
+});
+
+it('an eval-local class has no indexed constructor selector', () => {
+  expect(answer(collect("eval('class Made{};module.exports=Made;');", 'm.js'), null).constructible.status).toBe('unknown');
+});
+
+it('a conditional value needs agreement on the callable identity', () => {
+  const source = 'function one(){}function two(){}exports.load=flag?one:two;';
+  expect(answer(collect(source, 'm.js'), 'load').callable.status).toBe('unknown');
+});
diff --git a/__tests__/commonjs-value-graph.test.ts b/__tests__/commonjs-value-graph.test.ts
new file mode 100644
index 0000000000..8aff490a51
--- /dev/null
+++ b/__tests__/commonjs-value-graph.test.ts
@@ -0,0 +1,180 @@
+import { test } from 'vitest';
+import assert from 'node:assert/strict';
+import { CommonJsValueGraph as ValueGraph, type CommonJsDeclaration, type CommonJsValue } from '../src/resolution/commonjs-value-graph';
+const d = (name: string): CommonJsDeclaration => ({ name, line: 1, column: 0, kind: 'function' });
+const id = (value: CommonJsValue): string | undefined => value.kind === 'identity' ? value.id : undefined;
+
+const call = (g: ValueGraph, value: CommonJsValue) => g.answer(value).callable;
+const target = (g: ValueGraph, value: CommonJsValue, selector: CommonJsDeclaration) => assert.deepEqual(call(g, value), { status: 'positive', selector, identity: id(value) });
+
+for (const kind of ['object', 'function', 'class'] as const) {
+  test(`F14: ${kind} retains its explicitly assigned callable property`, () => {
+    const g = new ValueGraph();
+    const api = g.allocate(kind, 'api', d('api'));
+    const load = g.allocate('function', 'Store.load', d('Store::load'));
+    g.write(api, 'load', load);
+    g.bind('module.exports', api);
+    target(g, g.read(g.get('module.exports'), 'load'), d('Store::load'));
+  });
+}
+
+for (const value of [42, 'payload', undefined, null, false]) {
+  test(`F15: exported data ${String(value)} has reference identity without callable identity`, () => {
+    const g = new ValueGraph();
+    g.bind('value', g.data(value), d('value'));
+    const result = g.answer(g.get('value'));
+    assert.equal(result.reference.status, 'positive');
+    assert.deepEqual(result.reference.selector, d('value'));
+    assert.deepEqual(result.callable, { status: 'non-callable' });
+  });
+}
+
+test('F15: assigned callable reaches its body, not the storage variable', () => {
+  const g = new ValueGraph();
+  const real = g.allocate('function', 'real', d('real'));
+  g.bind('value', g.data(undefined), d('value'));
+  g.bind('value', real, d('value'));
+  const result = g.answer(g.get('value'));
+  assert.deepEqual(result.reference.selector, d('value'));
+  assert.deepEqual(result.callable.selector, d('real'));
+});
+
+test('an alias shares the object; rebinding the alias leaves the original object intact', () => {
+  const g = new ValueGraph();
+  const api = g.allocate('object', 'api');
+  const real = g.allocate('function', 'real', d('real'));
+  g.bind('api', api); g.bind('alias', g.get('api'));
+  g.write(g.get('alias'), 'load', real);
+  target(g, g.read(g.get('api'), 'load'), d('real'));
+  g.bind('alias', g.allocate('object', 'replacement'));
+  assert.equal(g.answer(g.read(g.get('alias'), 'load')).callable.status, 'absent');
+  target(g, g.read(g.get('api'), 'load'), d('real'));
+});
+
+test('property aliases retain the implementation selector', () => {
+  const g = new ValueGraph();
+  const first = g.allocate('object', 'first'), second = g.allocate('object', 'second');
+  g.write(first, 'load', g.allocate('function', 'real', d('real')));
+  g.write(second, 'load', g.read(first, 'load'));
+  target(g, g.read(second, 'load'), d('real'));
+});
+
+test('a definite data overwrite removes the old callable', () => {
+  const g = new ValueGraph();
+  const api = g.allocate('object', 'api');
+  g.write(api, 'load', g.allocate('function', 'real', d('real')));
+  g.write(api, 'load', g.data(42));
+  assert.equal(call(g, g.read(api, 'load')).status, 'non-callable');
+});
+
+test('post-export writes use the same object identity', () => {
+  const g = new ValueGraph();
+  const api = g.allocate('object', 'api'); g.bind('default', api);
+  g.write(api, 'load', g.allocate('function', 'real', d('real')));
+  target(g, g.read(g.get('default'), 'load'), d('real'));
+});
+
+test('class construction, ordinary calls, and instance identity stay distinct', () => {
+  const g = new ValueGraph();
+  const cls = g.allocate('class', 'Store', d('Store'));
+  const instance = g.allocate('object', 'instance');
+  assert.deepEqual(g.answer(cls).callable, { status: 'non-callable' });
+  assert.deepEqual(g.answer(cls).constructible, { status: 'positive', selector: d('Store'), identity: id(cls) });
+  assert.deepEqual(g.answer(instance).callable, { status: 'non-callable' });
+  assert.deepEqual(g.answer(instance).constructible, { status: 'non-callable' });
+});
+
+test('instances observe their prototype property writes', () => {
+  const g = new ValueGraph();
+  const prototype = g.allocate('object', 'prototype');
+  const instance = g.allocate('object', 'instance');
+  g.setPrototype(instance, prototype);
+  g.write(prototype, 'load', g.allocate('function', 'first', d('first')));
+  target(g, g.read(instance, 'load'), d('first'));
+  g.write(prototype, 'load', g.allocate('function', 'second', d('second')));
+  target(g, g.read(instance, 'load'), d('second'));
+});
+
+test('an unsupported write invalidates only the affected slot', () => {
+  const g = new ValueGraph();
+  const api = g.allocate('object', 'api');
+  const real = g.allocate('function', 'real', d('real'));
+  g.write(api, 'load', real); g.write(api, 'save', real);
+  g.write(api, 'load', g.unknown('unsupported mutation'));
+  assert.equal(call(g, g.read(api, 'load')).status, 'unknown');
+  target(g, g.read(api, 'save'), d('real'));
+});
+
+test('unknown dynamic writes remove stale callable/absence claims without affecting another object', () => {
+  const g = new ValueGraph();
+  const api = g.allocate('object', 'api'), other = g.allocate('object', 'other');
+  const real = g.allocate('function', 'real', d('real'));
+  g.write(api, 'load', real); g.write(other, 'load', real);
+  g.invalidate(api, 'dynamic key');
+  assert.equal(call(g, g.read(api, 'load')).status, 'unknown');
+  assert.equal(g.answer(g.read(api, 'missing')).reference.status, 'unknown');
+  target(g, g.read(other, 'load'), d('real'));
+});
+
+test('escape invalidates reachable property slots, including a prototype', () => {
+  const g = new ValueGraph();
+  const proto = g.allocate('object', 'proto'), api = g.allocate('object', 'api');
+  g.setPrototype(api, proto);
+  g.write(proto, 'load', g.allocate('function', 'real', d('real')));
+  g.escape(api, 'opaque call');
+  assert.equal(call(g, g.read(api, 'load')).status, 'unknown');
+});
+
+test('conflicting branch writes stay unknown; agreement preserves the callable', () => {
+  const g = new ValueGraph();
+  const api = g.allocate('object', 'api'); g.bind('api', api);
+  const first = g.allocate('function', 'first', d('first'));
+  const second = g.allocate('function', 'second', d('second'));
+  const left = g.fork(), right = g.fork();
+  left.write(api, 'load', first); right.write(api, 'load', second);
+  const joined = ValueGraph.join(left, right);
+  assert.equal(call(joined, joined.read(joined.get('api'), 'load')).status, 'unknown');
+  right.write(api, 'load', first);
+  const agreed = ValueGraph.join(left, right);
+  target(agreed, agreed.read(agreed.get('api'), 'load'), d('first'));
+});
+
+test('a branch with a missing member does not prove callability', () => {
+  const g = new ValueGraph(); const api = g.allocate('object', 'api'); g.bind('api', api);
+  const left = g.fork(); left.write(api, 'load', g.allocate('function', 'real', d('real')));
+  const joined = ValueGraph.join(left, g.fork());
+  assert.equal(call(joined, joined.read(joined.get('api'), 'load')).status, 'unknown');
+});
+
+test('unknown branch alternatives cannot contribute a candidate', () => {
+  const g = new ValueGraph();
+  g.bind('value', g.allocate('function', 'real', d('real')));
+  const other = g.fork(); other.bind('value', g.unknown('escape'));
+  const joined = ValueGraph.join(g, other);
+  assert.equal(call(joined, joined.get('value')).status, 'unknown');
+});
+
+test('a property write through an uncertain alias is weak for each possible receiver', () => {
+  const g = new ValueGraph();
+  const api = g.allocate('object', 'api'), other = g.allocate('object', 'other');
+  const alias = g.union([api, other]);
+  g.write(alias, 'load', g.allocate('function', 'real', d('real')));
+  assert.equal(call(g, g.read(api, 'load')).status, 'unknown');
+});
+
+test('same display name in distinct declarations cannot prove one callable', () => {
+  const g = new ValueGraph();
+  const first = g.allocate('function', 'scope-one:real', d('real'));
+  const second = g.allocate('function', 'scope-two:real', d('real'));
+  assert.equal(call(g, g.union([first, second])).status, 'unknown');
+});
+
+test('known storage reference survives unknown runtime value without supplying callability', () => {
+  const g = new ValueGraph();
+  g.bind('scope:value', g.unknown('dynamic initializer'), d('value'));
+  const result = g.answer(g.get('scope:value'));
+  assert.equal(result.reference.status, 'positive');
+  assert.equal(result.reference.identity, 'scope:value');
+  assert.equal(result.callable.status, 'unknown');
+  assert.equal(result.callable.selector, undefined);
+});
diff --git a/__tests__/fixtures/commonjs-value-cases.ts b/__tests__/fixtures/commonjs-value-cases.ts
new file mode 100644
index 0000000000..89097a9212
--- /dev/null
+++ b/__tests__/fixtures/commonjs-value-cases.ts
@@ -0,0 +1,36 @@
+const base = 'class Store { load() { return 42; } }\n';
+const wrapper = 'function yield(v) { return function ignored() {}; } yield?.(eval)("ignored");';
+export const commonJsValueCases: Array<[string, string, string, string?, boolean?]> = [
+  ['F14 object', `${base}const api={};api.load=Store.prototype.load;module.exports=api;`, 'positive', 'm.js:Store::load'],
+  ['F14 class', `${base}class Factory{};Factory.load=Store.prototype.load;module.exports=Factory;`, 'positive', 'm.js:Store::load'],
+  ['F14 function', `${base}function Factory(){};Factory.load=Store.prototype.load;module.exports=Factory;`, 'positive', 'm.js:Store::load'],
+  ['F15 number', 'const value=42;exports.load=value;', 'non-callable'],
+  ['F15 string', 'const value="payload";module.exports={load:value};', 'non-callable'],
+  ['F15 assigned callable', 'function real(){return 42;}let value;value=real;exports.load=value;', 'positive', 'm.js:real'],
+  ['F10 optional wrapper', `exports.known=function known(){};${wrapper}`, 'absent'],
+  ['F11 generator eval', `${base}function* setup(){const obj={ [yield (eval)('exports.load=Store.prototype.load;')](){} };}setup().next();`, 'positive', 'm.js:Store::load'],
+  ['F11 generator key outside generator', 'exports.known=function known(){};function yield(v){return function ignored(){return "key";};}const obj={ *[yield(eval)("ignored")](){} };', 'absent'],
+  ['F12 root object', `${base}module.exports={load:Store.prototype.load};${wrapper}`, 'positive', 'm.js:Store::load'],
+  ['F12 parenthesized instance', `${base}(module["exports"])=new Store();${wrapper}`, 'positive', 'm.js:Store::load'],
+  ['F12 logical instance', `${base}module.exports&&=new Store();${wrapper}`, 'positive', 'm.js:Store::load'],
+  ['F13 parameter', `exports.known=function known(){};function pretend(module){module.exports={};}pretend({});${wrapper}`, 'absent'],
+  ['F13 arrow', `exports.known=function known(){};const pretend=module=>{module.exports={};};pretend({});${wrapper}`, 'absent'],
+  ['F13 block', `exports.known=function known(){};{const module={};module.exports={};}${wrapper}`, 'absent'],
+  ['alias property mutation', `${base}const api={};const alias=api;alias.load=Store.prototype.load;module.exports=api;`, 'positive', 'm.js:Store::load'],
+  ['alias rebind', `${base}const api={};let alias=api;alias={};alias.load=Store.prototype.load;module.exports=api;`, 'absent'],
+  ['property overwrite', `${base}const api={load:Store.prototype.load};api.load=42;module.exports=api;`, 'non-callable'],
+  ['binding overwrite', `${base}let api={load:Store.prototype.load};api={};module.exports=api;`, 'absent'],
+  ['post-export write', `${base}const api={};module.exports=api;api.load=Store.prototype.load;`, 'positive', 'm.js:Store::load'],
+  ['old exports alias', `${base}module.exports={};exports.load=Store.prototype.load;`, 'absent'],
+  ['ambiguous branch', `${base}function other(){return 99;}const api={};if(flag)api.load=Store.prototype.load;else api.load=other;module.exports=api;`, 'unknown', undefined, false],
+  ['agreeing branch', `${base}const api={};if(flag)api.load=Store.prototype.load;else api.load=Store.prototype.load;module.exports=api;`, 'positive', 'm.js:Store::load', false],
+  ['opaque escape', `${base}const api={load:Store.prototype.load};opaque(api);module.exports=api;`, 'unknown', undefined, false],
+  ['unknown dynamic key', `${base}const api={load:Store.prototype.load};api[key]=42;module.exports=api;`, 'unknown', undefined, false],
+  ['local eval', `${base}function eval(code){};eval('exports.load=Store.prototype.load;');`, 'absent'],
+  ['literal eval', `${base}eval('exports.load=Store.prototype.load;');`, 'positive', 'm.js:Store::load'],
+  ['eval property on local identity', `${base}const api={};eval('api.load=Store.prototype.load;');module.exports=api;`, 'positive', 'm.js:Store::load'],
+  ['uncertain receiver alias', `${base}const api={};let alias;if(flag)alias=api;else alias={};alias.load=Store.prototype.load;module.exports=api;`, 'unknown', undefined, false],
+  ['data overwrite after literal eval', `${base}eval('exports.load=Store.prototype.load;');exports.load=42;`, 'non-callable'],
+  ['missing read exported as undefined data', 'const api={};const value=api.missing;exports.load=value;', 'non-callable'],
+  ['logical member initialization', `${base}const api={};api.load??=Store.prototype.load;module.exports=api;`, 'positive', 'm.js:Store::load'],
+];
diff --git a/__tests__/js-default-binding-members.test.ts b/__tests__/js-default-binding-members.test.ts
index 0628622365..d957273774 100644
--- a/__tests__/js-default-binding-members.test.ts
+++ b/__tests__/js-default-binding-members.test.ts
@@ -11,6 +11,7 @@ import { describe, it, expect, afterEach } from 'vitest';
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
+import { runInNewContext } from 'node:vm';
 import { CodeGraph } from '../src';
 
 const roots: string[] = [];
@@ -48,7 +49,64 @@ function callsOf(cg: CodeGraph, fn: string): string[] {
 const CALLER = (binding: string, members: string[]): string =>
   `${binding}\nfunction run() {\n${members.map((m) => `  named.${m}();`).join('\n')}\n}\nmodule.exports.run = run;\n`;
 
+const EVAL_CASES = [
+  ['absent', 'wrap(eval)("ignored");'],
+  ['present', "eval('module.exports.load = Store.prototype.load;');"],
+  ['unknown', 'yield?.(eval)("ignored");'],
+] as const;
+const EXPORT_CASES = [
+  ['namespace', 'exports.known = function known() {};'],
+  ['alias', 'exports.load = Store.prototype.load;'],
+  ['object', 'module.exports = { load: Store.prototype.load };'],
+  ['instance', 'module.exports = new Store();'],
+] as const;
+const EXPORT_BASE = 'class Store { load() { return 42; } }\nfunction wrap(value) { return function ignored() {}; }\nfunction yield(value) { return function ignored() {}; }\n';
+const WRAPPER_FOR_EVIDENCE = 'function yield(value) { return function ignored() {}; }\nyield?.(eval)("ignored");';
+
 describe('a member read through a default binding', () => {
+  describe.each(['./m', './index'])('binding-aware export evidence via %s', (specifier) => {
+    it.each([
+      '(module.exports) = new Store();',
+      '(module.exports) = { load: Store.prototype.load };',
+      'module.exports &&= new Store();',
+    ])('reaches the owned method for %s', async (assignment) => {
+      const source = `class Store { load() { return 42; } }\n${assignment}\n${WRAPPER_FOR_EVIDENCE}`;
+      const runtime = { exports: {} as { load(): number } };
+      runInNewContext(source, { module: runtime, exports: runtime.exports });
+      expect(runtime.exports.load()).toBe(42);
+      const cg = await indexProject({
+        'm.js': source,
+        'index.js': "module.exports = require('./m');",
+        'decoy.js': 'class Decoy { load() {} missing() {} }',
+        'use.js': CALLER(`const named = require('${specifier}');`, ['load', 'missing']),
+      });
+      expect(callsOf(cg, 'run')).toEqual(['3 m.js:Store::load']);
+    });
+
+    it.each([
+      'function pretend(module) { module.exports = {}; } pretend({});',
+      'const pretend = module => { module.exports = {}; }; pretend({});',
+      '{ const module = {}; module.exports = {}; }',
+    ])('does not authorize a target through a shadowed binding: %s', async (shadow) => {
+      const cg = await indexProject({
+        'm.js': `exports.known = function known() {};\n${shadow}\n${WRAPPER_FOR_EVIDENCE}`,
+        'index.js': "module.exports = require('./m');",
+        'decoy.js': 'class Decoy { missing() {} }',
+        'use.js': CALLER(`const named = require('${specifier}');`, ['missing']),
+      });
+      expect(callsOf(cg, 'run')).toEqual([]);
+    });
+
+    it('keeps a literal eval relationship in generator scope beside unrelated methods', async () => {
+      const cg = await indexProject({
+        'm.js': "class Store { load() { return 42; } }\nfunction* setup() { const obj = { [yield (eval)('exports.load = Store.prototype.load;')]() {} }; }\nsetup().next();",
+        'index.js': "module.exports = require('./m');",
+        'decoy.js': 'class Decoy { load() {} }',
+        'use.js': CALLER(`const named = require('${specifier}');`, ['load']),
+      });
+      expect(callsOf(cg, 'run')).toEqual(['3 m.js:Store::load']);
+    });
+  });
   it.each([
     ['anonymous functions', 'exports.first = function () {};\nexports.second = function () {};\n', 'm.js:second'],
     ['named functions', 'exports.first = function first() {};\nexports.second = function second() {};\n', 'm.js:second'],
@@ -285,6 +343,18 @@ describe('a member read through a default binding', () => {
     expect(callsOf(cg, 'run')).toEqual([]);
   });
 
+  it.each([
+    'wrap(eval)("ignored");',
+    'wrap((eval))(("ignored"));',
+  ])('does not mistake a wrapped eval argument for a direct eval call: %s', async (call) => {
+    const cg = await indexProject({
+      'm.js': `exports.known = function known() {};\nfunction wrap(value) { return function ignore(code) {}; }\n${call}\n`,
+      'decoy.js': 'export class Decoy { missing() {} }\n',
+      'use.js': CALLER("const named = require('./m');", ['missing']),
+    });
+    expect(callsOf(cg, 'run')).toEqual([]);
+  });
+
   it.each([
     "eval('exports.load = Store.prototype.load;');",
     'eval(`exports.load = Store.prototype.load;`);',
@@ -298,6 +368,160 @@ describe('a member read through a default binding', () => {
     expect(callsOf(cg, 'run')).toEqual(['3 m.js:Store::load']);
   });
 
+  it.each([
+    "if (true) (eval)('exports.load = Store.prototype.load;');",
+    'if (true) (eval)(`exports.load = Store.prototype.load;`);',
+    "for (let i = 0; i < 1; i++) ((eval))(('exports.load = Store.prototype.load;'));",
+  ])('keeps direct eval in an unbraced control body: %s', async (mutation) => {
+    const cg = await indexProject({
+      'm.js': `class Store { load() {} }\n${mutation}\n`,
+      'use.js': CALLER("const named = require('./m');", ['load']),
+    });
+    expect(callsOf(cg, 'run')).toEqual(['3 m.js:Store::load']);
+  });
+
+  it.each(['await', 'yield'])('does not mistake the CommonJS wrapper %s for a keyword', async (name) => {
+    const cg = await indexProject({
+      'm.js': `exports.known = function known() {};\nfunction ${name}(value) { return function ignore(code) {}; }\n${name}(eval)("ignored");\n`,
+      'decoy.js': 'export class Decoy { missing() {} }\n',
+      'use.js': CALLER("const named = require('./m');", ['missing']),
+    });
+    expect(callsOf(cg, 'run')).toEqual([]);
+  });
+
+  it.each([
+    'yield?.(eval)("ignored");',
+    'const obj = { *[yield(eval)("ignored")]() {} };',
+  ])('does not guess a call through an inconclusive or outer-scope wrapper: %s', async (call) => {
+    const cg = await indexProject({
+      'm.js': `exports.known = function known() {};\nfunction yield(value) { return function ignore(code) { return 'x'; }; }\n${call}\n`,
+      'decoy.js': 'export class Decoy { missing() {} }\n',
+      'use.js': CALLER("const named = require('./m');", ['missing']),
+    });
+    expect(callsOf(cg, 'run')).toEqual([]);
+  });
+
+  it('preserves an eval in a computed method name within an enclosing generator', async () => {
+    const cg = await indexProject({
+      'm.js': "class Store { load() { return 42; } }\nfunction* setup() { const obj = { [yield (eval)('exports.load = Store.prototype.load;')]() {} }; }\nsetup().next();\n",
+      'use.js': CALLER("const named = require('./m');", ['load']),
+    });
+    expect(callsOf(cg, 'run')).toEqual(['3 m.js:Store::load']);
+  });
+
+  it('preserves an explicit callable alias when an eval parse fact is inconclusive', async () => {
+    const cg = await indexProject({
+      'm.js': 'class Store { load() {} }\nexports.load = Store.prototype.load;\nfunction yield(value) { return function ignore(code) {}; }\nyield?.(eval)("ignored");\n',
+      'use.js': CALLER("const named = require('./m');", ['load']),
+    });
+    expect(callsOf(cg, 'run')).toEqual(['3 m.js:Store::load']);
+  });
+
+  it.each([
+    'module.exports = { load: Store.prototype.load };',
+    'module.exports = new Store();',
+  ])('preserves the stated value %s with an inconclusive eval fact', async (assignment) => {
+    const source = `class Store { load() { return 42; } }\n${assignment}\nfunction yield(value) { return function ignored() {}; }\nyield?.(eval)("ignored");\n`;
+    const runtime = { exports: {} as { load(): number } };
+    runInNewContext(source, { module: runtime, exports: runtime.exports });
+    expect(runtime.exports.load()).toBe(42);
+    const cg = await indexProject({
+      'm.js': source,
+      'use.js': CALLER("const named = require('./m');", ['load']),
+    });
+    expect(callsOf(cg, 'run')).toEqual(['3 m.js:Store::load']);
+  });
+
+  it.each([
+    'module["exports"] = { load: Store.prototype.load };',
+    'module["exports"] = new Store();',
+    'exports.known = function known() {}; module.exports = new Store();',
+    'module.exports = new Store(); module.exports.extra = function extra() {};',
+  ])('keeps a stated value with bracket or mixed assignments: %s', async (assignment) => {
+    const source = `${EXPORT_BASE}${assignment}\nyield?.(eval)("ignored");\n`;
+    const runtime = { exports: {} as { load(): number } };
+    runInNewContext(source, { module: runtime, exports: runtime.exports });
+    expect(runtime.exports.load()).toBe(42);
+    const cg = await indexProject({
+      'm.js': source,
+      'use.js': CALLER("const named = require('./m');", ['load']),
+    });
+    expect(callsOf(cg, 'run')).toEqual(['3 m.js:Store::load']);
+  });
+
+  describe.each(['./m', './index'])('export evidence through %s', (specifier) => {
+    describe.each(EXPORT_CASES)('%s', (form, assignment) => {
+      it.each(EVAL_CASES)('resolves the runtime export with eval %s', async (state, mutation) => {
+        const source = `${EXPORT_BASE}${assignment}\n${mutation}\n`;
+        const hasLoad = form !== 'namespace' || state === 'present';
+        const runtime = { exports: {} as { load?: () => number } };
+        runInNewContext(source, { module: runtime, exports: runtime.exports });
+        expect(runtime.exports.load?.()).toBe(hasLoad ? 42 : undefined);
+        const cg = await indexProject({
+          'm.js': source,
+          'index.js': "module.exports = require('./m');\n",
+          'use.js': CALLER(`const named = require('${specifier}');`, ['load']),
+        });
+        expect(callsOf(cg, 'run')).toEqual(hasLoad ? ['3 m.js:Store::load'] : []);
+        if (hasLoad) {
+          const run = cg.getNodesByName('run').find((n) => n.kind === 'function')!;
+          const call = cg.getOutgoingEdges(run.id).find((e) => e.kind === 'calls')!;
+          expect(call.metadata?.typeFrom).toEqual(expect.arrayContaining(
+            specifier === './index' ? ['index.js', 'm.js'] : ['m.js'],
+          ));
+        }
+      });
+    });
+
+    it('refreshes export form and eval certainty consistently with a fresh index', async () => {
+      const initial = `${EXPORT_BASE}${EXPORT_CASES[0][1]}\n${EVAL_CASES[0][1]}\n`;
+      const files = {
+        'm.js': initial,
+        'index.js': "module.exports = require('./m');\n",
+        'use.js': CALLER(`const named = require('${specifier}');`, ['load']),
+      };
+      const cg = await indexProject(files);
+      const modulePath = path.join(roots[roots.length - 1]!, 'm.js');
+      expect(callsOf(cg, 'run')).toEqual([]);
+      for (const [form, state] of [
+        [0, 1], [0, 2], [2, 2], [3, 2], [1, 2], [0, 2], [2, 0], [0, 0], [3, 1],
+      ] as const) {
+        files['m.js'] = `${EXPORT_BASE}${EXPORT_CASES[form][1]}\n${EVAL_CASES[state][1]}\n`;
+        fs.writeFileSync(modulePath, files['m.js']);
+        await cg.sync();
+        const expected = form !== 0 || state === 1 ? ['3 m.js:Store::load'] : [];
+        expect(callsOf(cg, 'run'), `${form}/${state}`).toEqual(expected);
+        const fresh = await indexProject(files);
+        expect(callsOf(cg, 'run')).toEqual(callsOf(fresh, 'run'));
+      }
+    });
+  });
+
+  it('keeps eval facts current through wrapper-to-eval and eval-to-wrapper syncs', async () => {
+    const base = 'exports.known = function known() {};\nclass Store { load() {} }\nfunction wrap(value) { return function ignore(code) {}; }\nfunction yield(value) { return function ignore(code) {}; }\n';
+    const files = {
+      'm.js': `${base}wrap(eval)("ignored");\n`,
+      'use.js': CALLER("const named = require('./m');", ['load']),
+    };
+    const cg = await indexProject(files);
+    const modulePath = path.join(roots[roots.length - 1]!, 'm.js');
+    expect(callsOf(cg, 'run')).toEqual([]);
+    for (const [mutation, expected] of [
+      ["if (true) (eval)('exports.load = Store.prototype.load;');", ['3 m.js:Store::load']],
+      ['yield(eval)("ignored");', []],
+      ['yield?.(eval)("ignored");', []],
+      ["for (let i = 0; i < 1; i++) (eval)('exports.load = Store.prototype.load;');", ['3 m.js:Store::load']],
+      ['wrap(eval)("ignored");', []],
+    ] as const) {
+      files['m.js'] = `${base}${mutation}\n`;
+      fs.writeFileSync(modulePath, files['m.js']);
+      await cg.sync();
+      expect(callsOf(cg, 'run'), mutation).toEqual(expected);
+      const fresh = await indexProject(files);
+      expect(callsOf(cg, 'run'), mutation).toEqual(callsOf(fresh, 'run'));
+    }
+  });
+
   it('links the member a sync brings, and drops the one it takes away', async () => {
     const cg = await indexProject({
       'm.js': 'exports.first = function () {};\n',
diff --git a/__tests__/lazy-engine.test.ts b/__tests__/lazy-engine.test.ts
index eff545d6f9..0f060ab426 100644
--- a/__tests__/lazy-engine.test.ts
+++ b/__tests__/lazy-engine.test.ts
@@ -125,4 +125,10 @@ describe('the engine stays unloaded until something needs it', () => {
       console.log(typeof FileWatcher, typeof MCPServer, typeof LockUnavailableError);`;
     expect(node(['--input-type=module', '-e', script], dir).trim()).toBe('function function function');
   });
+
+  it('loading export evidence does not load its compiler until analysis is requested', () => {
+    const script = `require(${JSON.stringify(path.join(DIST, 'resolution', 'commonjs-export-evidence.js'))});
+      console.log(Object.keys(require.cache).some(k => /typescript[/\\\\]lib[/\\\\]typescript\\.js$/.test(k)));`;
+    expect(node(['-e', script], dir).trim()).toBe('false');
+  });
 });
diff --git a/docs/handoffs/pr29-2026-11-10/START_HERE.md b/docs/handoffs/pr29-2026-11-10/START_HERE.md
new file mode 100644
index 0000000000..3a21e0ad25
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/START_HERE.md
@@ -0,0 +1,63 @@
+# PR29 handoff — start here
+
+Read this file first. The archive contains historical checkpoints, including failures and earlier permissions. This file describes the current state; older notes do not authorize new work.
+
+The user requested that all task notes be committed for continuation in Claude. This is a documentation-only handoff. The implementation remains uncommitted in `/tmp/codegraph-cjs-missing-fix-20261108` on `fix/commonjs-eval-callee-context`. Preserve every existing implementation change. The implementation baseline is `87576a8d9ff0d8aba235db5535f5f4429f14b037`; a documentation commit above it changes the repository HEAD without changing that tested baseline.
+
+## Update 2026-11-10 (Claude): #2499 fix
+
+The full suite (first run on this revision) found that PR29 broke `js-class-expressions` #2499. Class expressions such as `module.exports = class R { static make() {} }` were built without their static members or prototype, so they were wrongly reported as absent. Fixed in `src/resolution/commonjs-export-evidence.ts`, with 5 regression tests in `__tests__/commonjs-export-evidence.test.ts`. Both are uncommitted. `implementation/source-sha256.json` and `implementation/working-tree.patch.gz` include the fix; the patch reconstructs all 30 paths from 87576a8d. The harness was rerun on a build copy of this checkout with the fix (`/tmp/codegraph-pr29-harness-6fevujfy/fix`, all 30 manifest hashes matched; outputs in `/tmp/codegraph-pr29-harness-fix-20261110/`). Every stage matches the pre-fix candidate run below:
+
+- Replay exit 0, with identical fixture verdicts and canaries.
+- Graphs against the candidate are SAME on all 5 corpora. Against baseline it is the same Express −64 edges / +64 unresolved as before.
+- Shadow: 17 SAME and 6 CHANGED, identical per question. All 99 mode comparisons are identical.
+- Metamorphic: all 219 rows are identical, including the same 17 baseline-identical DIFF rows.
+- Full suite: 10983 pass. 2 speed-sensitive UI tests (`ui-server-api` busiest symbol, `ui-trails` FIFO) failed at host load 26–57 and passed on an isolated rerun.
+
+CPU-time indexing at load 15–27 puts the fix within noise of the candidate. Express is still about +40% over baseline, so the indexing regression remains open. Profiling found it is the per-file TypeScript parse and checker in `collectCommonJsExportEvidence` on the main thread. An exact ESM short-circuit gave only about 130 ms on Ky and was not applied. Notes are in `~/.claude/plans/pr29-indexing-perf.md`, local to the WSL machine.
+
+## Read next
+
+1. [Latest harness handoff](plans/handoff-codegraph-pr29-harness-complete-2026-11-10.md) and [full harness report](history/pr29-harness-20261110T013135Z/report.md).
+2. [Implementation handoff](plans/handoff-codegraph-pr29-value-model-integrated-2026-11-09.md).
+3. [PR29 review ledger](ledgers/commonjs-eval-callee-context.md), then [review 11 findings](history/pr29-review11-2026-11-09/merged-review.md) if needed.
+4. [Harness results](harness/results.json), [timing samples](harness/timings.json), and [source hash manifest](implementation/source-sha256.json).
+
+## What is implemented
+
+The CommonJS export collector now tracks binding-owned values and object properties, with independent reference, callable and constructor evidence. Explicit local object/class/function writes retain their callable targets; exported data cannot become call targets; assigned functions target their implementations rather than storage variables. Import resolution carries intent through named/default/namespace imports and forwarding. Alias callers request reference evidence. Failed forwarded calls retry after source changes using the existing bounded importer/barrel walk. Lexical eval handling, caller shadows, source ownership and lazy compiler loading are retained.
+
+F14/F15 are implemented and focused-tested; independent verification of the redesign is still pending.11 dual-review rounds completed historically. No new review was launched during the harness work and the review count was not reset.
+
+## Actual validation
+
+- 819 focused tests passed, 1 native check skipped, over 26 files. Type check and whitespace check passed on the implementation snapshot.
+- Both isolated baseline/candidate normal builds passed, including viewer/grammar/runtime checks. No full repository test suite was run on this implementation revision.
+- 32/32 targeted PR29fixtures passed;70/70 candidate anonymous canaries passed. The 38 existing QA verdicts stayed unchanged:4 FIXED, 32 BROKEN, 2 GUESSED. Known failures are not hidden.
+- Requests, Click, Mux and Ky graphs match baseline. Express removes64 old call edges:52 incorrect targets and12 external-import variables without proven callable bodies; no confirmed correct call lost in that set. Files/nodes are unchanged.
+- Both builds pass 99 execution-mode comparisons across 11 inputs. CLI shadow:17 SAME, 6 CHANGED, 0 FAILED, 0 UNSTABLE.
+- Metamorphic candidate:192 CLEAN, 17 DIFF, 10 N/A over 219 checks; baseline:183 CLEAN, 26 DIFF, 10 N/A. Exact diff comparison finds9 old differences removed and0 new ones.17 baseline-identical differences remain; no indexing errors.
+
+## Current issue: indexing cost
+
+Four fresh indexes per build/project with alternating build order measured:
+
+| Project | Baseline median | Candidate median | Change |
+|---|---:|---:|---:|
+| Requests |2.069s|2.066s|effectively flat|
+| Ky |5.045s|5.676s|+12.5%|
+| Express |2.379s|3.282s|+38.0%|
+
+The Ky/Express timing ranges do not overlap. This is a measured indexing regression on these projects on one shared local host, not a universal bound or a proven cause. Recommended next work is profiling that cost. No performance fixes or profiling have been performed. Ask before implementing further fixes. Preserve existing source and use isolated copies for investigation.
+
+## Resume safely
+
+1. Verify repository, branch, personal identity, and the 30 implementation source hashes before changing anything. Git status should retain all 30 pending source/test/package paths, plus any later explicitly authorized work. Do not reset, stash, clean, or overwrite them.
+2. Summarize the performance finding and confirm the user's next scope. Suggested next action: profile the isolated builds to locate indexing overhead; success means an evidence-backed cost attribution with unchanged source, not a speculative patch.
+3. Keep11 completed review rounds explicit. If a fresh review is authorized, use the native broad/adversarial dual-review workflow and the same ledger, frozen source manifest and exact Git target. Do not claim prior focused passes or harness results are review clearance.
+
+Local-only evidence remains at `/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/`. Both build copies/dependencies/dist remain at `/tmp/codegraph-pr29-harness-6fevujfy`; its `baseline` and `candidate` directories are independent. Exact notes and result JSON are committed here so continuation does not depend on access to the private notes directory.
+
+[The implementation patch](implementation/working-tree.patch.gz) preserves all 30 pending paths against the frozen baseline. It is gzip-compressed and preserves the patch bytes exactly. It is a backup: do not apply it on top of the existing dirty checkout. [inventory.json](inventory.json) records every copied note and its SHA256. Full build archives, dependency trees and raw logs remain local and are referenced from the reports.
+
+The experimental T0 pilot and unrelated QA working changes stay paused and untouched. Native kernel binary is absent; validation is WASM-only. No agent-model A/B, compiler-oracle refresh or overnight private-project history replay was performed. No implementation commit, push, merge, deployment or upstream report is authorized by this handoff. Use the personal `inth3shadows` remote/identity; never use Transactly credentials or identity.
diff --git a/docs/handoffs/pr29-2026-11-10/harness/build-diff.json b/docs/handoffs/pr29-2026-11-10/harness/build-diff.json
new file mode 100644
index 0000000000..099cd3e7f2
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/harness/build-diff.json
@@ -0,0 +1,747 @@
+{
+ "old": "/tmp/codegraph-pr29-harness-6fevujfy/baseline/dist/bin/codegraph.js",
+ "new": "/tmp/codegraph-pr29-harness-6fevujfy/candidate/dist/bin/codegraph.js",
+ "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae",
+ "results": [
+  {
+   "repo": "requests",
+   "old": {
+    "nodes": 1299,
+    "edges": 2976,
+    "unresolved": 2345
+   },
+   "new": {
+    "nodes": 1299,
+    "edges": 2976,
+    "unresolved": 2345
+   },
+   "ms": [
+    2437,
+    2650
+   ],
+   "diff": {},
+   "verdict": "SAME"
+  },
+  {
+   "repo": "click",
+   "old": {
+    "nodes": 2934,
+    "edges": 7770,
+    "unresolved": 4756
+   },
+   "new": {
+    "nodes": 2934,
+    "edges": 7770,
+    "unresolved": 4756
+   },
+   "ms": [
+    4387,
+    4346
+   ],
+   "diff": {},
+   "verdict": "SAME"
+  },
+  {
+   "repo": "mux",
+   "old": {
+    "nodes": 444,
+    "edges": 1921,
+    "unresolved": 1564
+   },
+   "new": {
+    "nodes": 444,
+    "edges": 1921,
+    "unresolved": 1564
+   },
+   "ms": [
+    1727,
+    1843
+   ],
+   "diff": {},
+   "verdict": "SAME"
+  },
+  {
+   "repo": "ky",
+   "old": {
+    "nodes": 1164,
+    "edges": 5278,
+    "unresolved": 12261
+   },
+   "new": {
+    "nodes": 1164,
+    "edges": 5278,
+    "unresolved": 12261
+   },
+   "ms": [
+    6641,
+    7564
+   ],
+   "diff": {},
+   "verdict": "SAME"
+  },
+  {
+   "repo": "express",
+   "old": {
+    "nodes": 1143,
+    "edges": 2334,
+    "unresolved": 9133
+   },
+   "new": {
+    "nodes": 1143,
+    "edges": 2270,
+    "unresolved": 9197
+   },
+   "ms": [
+    3158,
+    4483
+   ],
+   "diff": {
+    "edges": [
+     {
+      "key": "[\"calls\",21,8,\"express.urlencoded\",\"import\",null,\"examples/auth/index.js\",\"examples/auth/index.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"index.js\",1,135]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",12,24,\"users.map\",\"import\",null,\"examples/content-negotiation/index.js\",\"examples/content-negotiation/index.js\",\"javascript\",\"file\",\"variable\",\"users\",\"users\",\"examples/content-negotiation/db.js\",3,3,\"index.js\",1,47]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",18,15,\"users.map\",\"import\",null,\"examples/content-negotiation/index.js\",\"examples/content-negotiation/index.js\",\"javascript\",\"file\",\"variable\",\"users\",\"users\",\"examples/content-negotiation/db.js\",3,3,\"index.js\",1,47]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",6,20,\"users.map\",\"import\",null,\"examples/content-negotiation/users.js\",\"html\",\"javascript\",\"function\",\"variable\",\"users\",\"users\",\"examples/content-negotiation/db.js\",3,3,\"html\",5,9]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",12,11,\"users.map\",\"import\",null,\"examples/content-negotiation/users.js\",\"text\",\"javascript\",\"function\",\"variable\",\"users\",\"users\",\"examples/content-negotiation/db.js\",3,3,\"text\",11,15]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",22,8,\"express.urlencoded\",\"import\",null,\"examples/cookies/index.js\",\"examples/cookies/index.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"index.js\",1,54]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",31,8,\"express.static\",\"import\",null,\"examples/ejs/index.js\",\"examples/ejs/index.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"index.js\",1,58]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",5,12,\"express.Router\",\"import\",null,\"examples/multi-router/controllers/api_v1.js\",\"apiv1\",\"javascript\",\"variable\",\"variable\",\"Router\",\"Router\",\"lib/express.js\",19,19,\"apiv1\",5,5]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",5,12,\"express.Router\",\"import\",null,\"examples/multi-router/controllers/api_v2.js\",\"apiv2\",\"javascript\",\"variable\",\"variable\",\"Router\",\"Router\",\"lib/express.js\",19,19,\"apiv2\",5,5]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",37,8,\"express.static\",\"import\",null,\"examples/mvc/index.js\",\"examples/mvc/index.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"index.js\",1,96]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",47,8,\"express.urlencoded\",\"import\",null,\"examples/mvc/index.js\",\"examples/mvc/index.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"index.js\",1,96]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",31,8,\"express.urlencoded\",\"import\",null,\"examples/route-separation/index.js\",\"examples/route-separation/index.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"index.js\",1,56]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",32,8,\"express.static\",\"import\",null,\"examples/route-separation/index.js\",\"examples/route-separation/index.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"index.js\",1,56]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",21,8,\"express.static\",\"import\",null,\"examples/search/index.js\",\"examples/search/index.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"index.js\",1,84]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",22,8,\"express.static\",\"import\",null,\"examples/static-files/index.js\",\"examples/static-files/index.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"index.js\",1,44]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",30,19,\"express.static\",\"import\",null,\"examples/static-files/index.js\",\"examples/static-files/index.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"index.js\",1,44]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",36,8,\"express.static\",\"import\",null,\"examples/static-files/index.js\",\"examples/static-files/index.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"index.js\",1,44]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",27,2,\"User.count\",\"import\",null,\"examples/view-locals/index.js\",\"examples/view-locals/index.js\",\"javascript\",\"file\",\"function\",\"User\",\"User\",\"examples/view-locals/user.js\",7,11,\"index.js\",1,156]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",29,4,\"User.all\",\"import\",null,\"examples/view-locals/index.js\",\"examples/view-locals/index.js\",\"javascript\",\"file\",\"function\",\"User\",\"User\",\"examples/view-locals/user.js\",7,11,\"index.js\",1,156]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",49,2,\"User.count\",\"import\",null,\"examples/view-locals/index.js\",\"count\",\"javascript\",\"function\",\"function\",\"User\",\"User\",\"examples/view-locals/user.js\",7,11,\"count\",48,54]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",57,2,\"User.all\",\"import\",null,\"examples/view-locals/index.js\",\"users\",\"javascript\",\"function\",\"function\",\"User\",\"User\",\"examples/view-locals/user.js\",7,11,\"users\",56,62]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",87,2,\"User.count\",\"import\",null,\"examples/view-locals/index.js\",\"count2\",\"javascript\",\"function\",\"function\",\"User\",\"User\",\"examples/view-locals/user.js\",7,11,\"count2\",86,92]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",95,2,\"User.all\",\"import\",null,\"examples/view-locals/index.js\",\"users2\",\"javascript\",\"function\",\"function\",\"User\",\"User\",\"examples/view-locals/user.js\",7,11,\"users2\",94,100]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",26,0,\"User.count\",\"import\",null,\"examples/view-locals/index.js\",\"examples/view-locals/index.js::GET:/\",\"javascript\",\"route\",\"function\",\"User\",\"User\",\"examples/view-locals/user.js\",7,11,\"GET /\",26,26]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",79,19,\"express.Router\",\"import\",null,\"test/app.options.js\",\"test/app.options.js\",\"javascript\",\"file\",\"variable\",\"Router\",\"Router\",\"lib/express.js\",19,19,\"app.options.js\",1,117]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",875,19,\"express.Router\",\"import\",null,\"test/app.router.js\",\"test/app.router.js\",\"javascript\",\"file\",\"variable\",\"Router\",\"Router\",\"lib/express.js\",19,19,\"app.router.js\",1,1218]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",60,12,\"express.json\",\"import\",null,\"test/express.json.js\",\"test/express.json.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"express.json.js\",1,756]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",76,12,\"express.json\",\"import\",null,\"test/express.json.js\",\"test/express.json.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"express.json.js\",1,756]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",77,12,\"express.json\",\"import\",null,\"test/express.json.js\",\"test/express.json.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"express.json.js\",1,756]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",513,14,\"express.json\",\"import\",null,\"test/express.json.js\",\"test/express.json.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"express.json.js\",1,756]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",725,10,\"express.json\",\"import\",null,\"test/express.json.js\",\"createApp\",\"javascript\",\"function\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"createApp\",722,740]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",31,12,\"express.raw\",\"import\",null,\"test/express.raw.js\",\"test/express.raw.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"express.raw.js\",1,514]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",68,12,\"express.raw\",\"import\",null,\"test/express.raw.js\",\"test/express.raw.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"express.raw.js\",1,514]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",69,12,\"express.raw\",\"import\",null,\"test/express.raw.js\",\"test/express.raw.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"express.raw.js\",1,514]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",338,14,\"express.raw\",\"import\",null,\"test/express.raw.js\",\"test/express.raw.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"express.raw.js\",1,514]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",495,10,\"express.raw\",\"import\",null,\"test/express.raw.js\",\"createApp\",\"javascript\",\"function\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"createApp\",492,513]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",281,16,\"express.static\",\"import\",null,\"test/express.static.js\",\"test/express.static.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"express.static.js\",1,816]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",356,16,\"express.static\",\"import\",null,\"test/express.static.js\",\"test/express.static.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"express.static.js\",1,816]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",476,19,\"express.static\",\"import\",null,\"test/express.static.js\",\"test/express.static.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"express.static.js\",1,816]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",544,19,\"express.static\",\"import\",null,\"test/express.static.js\",\"test/express.static.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"express.static.js\",1,816]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",695,29,\"express.static\",\"import\",null,\"test/express.static.js\",\"test/express.static.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"express.static.js\",1,816]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",709,30,\"express.static\",\"import\",null,\"test/express.static.js\",\"test/express.static.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"express.static.js\",1,816]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",735,32,\"express.static\",\"import\",null,\"test/express.static.js\",\"test/express.static.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"express.static.js\",1,816]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",759,14,\"express.static\",\"import\",null,\"test/express.static.js\",\"test/express.static.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"express.static.js\",1,816]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",770,30,\"express.static\",\"import\",null,\"test/express.static.js\",\"test/express.static.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"express.static.js\",1,816]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",808,10,\"express.static\",\"import\",null,\"test/express.static.js\",\"createApp\",\"javascript\",\"function\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"createApp\",804,815]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",30,12,\"express.text\",\"import\",null,\"test/express.text.js\",\"test/express.text.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"express.text.js\",1,567]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",63,12,\"express.text\",\"import\",null,\"test/express.text.js\",\"test/express.text.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"express.text.js\",1,567]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",64,12,\"express.text\",\"import\",null,\"test/express.text.js\",\"test/express.text.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"express.text.js\",1,567]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",370,14,\"express.text\",\"import\",null,\"test/express.text.js\",\"test/express.text.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"express.text.js\",1,567]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",552,10,\"express.text\",\"import\",null,\"test/express.text.js\",\"createApp\",\"javascript\",\"function\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"createApp\",549,566]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",31,12,\"express.urlencoded\",\"import\",null,\"test/express.urlencoded.js\",\"test/express.urlencoded.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"express.urlencoded.js\",1,829]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",65,12,\"express.urlencoded\",\"import\",null,\"test/express.urlencoded.js\",\"test/express.urlencoded.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"express.urlencoded.js\",1,829]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",66,12,\"express.urlencoded\",\"import\",null,\"test/express.urlencoded.js\",\"test/express.urlencoded.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"express.urlencoded.js\",1,829]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",616,14,\"express.urlencoded\",\"import\",null,\"test/express.urlencoded.js\",\"test/express.urlencoded.js\",\"javascript\",\"file\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"express.urlencoded.js\",1,829]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",808,10,\"express.urlencoded\",\"import\",null,\"test/express.urlencoded.js\",\"createApp\",\"javascript\",\"function\",\"function\",\"createApplication\",\"createApplication\",\"lib/express.js\",36,56,\"createApp\",805,822]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",22,16,\"express.Router\",\"import\",null,\"test/req.baseUrl.js\",\"test/req.baseUrl.js\",\"javascript\",\"file\",\"variable\",\"Router\",\"Router\",\"lib/express.js\",19,19,\"req.baseUrl.js\",1,89]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",36,17,\"express.Router\",\"import\",null,\"test/req.baseUrl.js\",\"test/req.baseUrl.js\",\"javascript\",\"file\",\"variable\",\"Router\",\"Router\",\"lib/express.js\",19,19,\"req.baseUrl.js\",1,89]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",37,17,\"express.Router\",\"import\",null,\"test/req.baseUrl.js\",\"test/req.baseUrl.js\",\"javascript\",\"file\",\"variable\",\"Router\",\"Router\",\"lib/express.js\",19,19,\"req.baseUrl.js\",1,89]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",38,17,\"express.Router\",\"import\",null,\"test/req.baseUrl.js\",\"test/req.baseUrl.js\",\"javascript\",\"file\",\"variable\",\"Router\",\"Router\",\"lib/express.js\",19,19,\"req.baseUrl.js\",1,89]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",55,17,\"express.Router\",\"import\",null,\"test/req.baseUrl.js\",\"test/req.baseUrl.js\",\"javascript\",\"file\",\"variable\",\"Router\",\"Router\",\"lib/express.js\",19,19,\"req.baseUrl.js\",1,89]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",56,17,\"express.Router\",\"import\",null,\"test/req.baseUrl.js\",\"test/req.baseUrl.js\",\"javascript\",\"file\",\"variable\",\"Router\",\"Router\",\"lib/express.js\",19,19,\"req.baseUrl.js\",1,89]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",57,17,\"express.Router\",\"import\",null,\"test/req.baseUrl.js\",\"test/req.baseUrl.js\",\"javascript\",\"file\",\"variable\",\"Router\",\"Router\",\"lib/express.js\",19,19,\"req.baseUrl.js\",1,89]",
+      "a": 1,
+      "b": 0
+     },
+     {
+      "key": "[\"calls\",160,19,\"express.Router\",\"import\",null,\"test/res.format.js\",\"test/res.format.js\",\"javascript\",\"file\",\"variable\",\"Router\",\"Router\",\"lib/express.js\",19,19,\"res.format.js\",1,249]",
+      "a": 1,
+      "b": 0
+     }
+    ],
+    "unresolved": [
+     {
+      "key": "[\"[\\\"file\\\",\\\"examples/auth/index.js\\\",\\\"examples/auth/index.js\\\",1,135,\\\"javascript\\\"]\",\"examples/auth/index.js\",21,8,\"express.urlencoded\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"examples/content-negotiation/index.js\\\",\\\"examples/content-negotiation/index.js\\\",1,47,\\\"javascript\\\"]\",\"examples/content-negotiation/index.js\",12,24,\"users.map\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"examples/content-negotiation/index.js\\\",\\\"examples/content-negotiation/index.js\\\",1,47,\\\"javascript\\\"]\",\"examples/content-negotiation/index.js\",18,15,\"users.map\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"function\\\",\\\"examples/content-negotiation/users.js\\\",\\\"html\\\",5,9,\\\"javascript\\\"]\",\"examples/content-negotiation/users.js\",6,20,\"users.map\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"function\\\",\\\"examples/content-negotiation/users.js\\\",\\\"text\\\",11,15,\\\"javascript\\\"]\",\"examples/content-negotiation/users.js\",12,11,\"users.map\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"examples/cookies/index.js\\\",\\\"examples/cookies/index.js\\\",1,54,\\\"javascript\\\"]\",\"examples/cookies/index.js\",22,8,\"express.urlencoded\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"examples/ejs/index.js\\\",\\\"examples/ejs/index.js\\\",1,58,\\\"javascript\\\"]\",\"examples/ejs/index.js\",31,8,\"express.static\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"variable\\\",\\\"examples/multi-router/controllers/api_v1.js\\\",\\\"apiv1\\\",5,5,\\\"javascript\\\"]\",\"examples/multi-router/controllers/api_v1.js\",5,12,\"express.Router\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"variable\\\",\\\"examples/multi-router/controllers/api_v2.js\\\",\\\"apiv2\\\",5,5,\\\"javascript\\\"]\",\"examples/multi-router/controllers/api_v2.js\",5,12,\"express.Router\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"examples/mvc/index.js\\\",\\\"examples/mvc/index.js\\\",1,96,\\\"javascript\\\"]\",\"examples/mvc/index.js\",37,8,\"express.static\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"examples/mvc/index.js\\\",\\\"examples/mvc/index.js\\\",1,96,\\\"javascript\\\"]\",\"examples/mvc/index.js\",47,8,\"express.urlencoded\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"examples/route-separation/index.js\\\",\\\"examples/route-separation/index.js\\\",1,56,\\\"javascript\\\"]\",\"examples/route-separation/index.js\",31,8,\"express.urlencoded\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"examples/route-separation/index.js\\\",\\\"examples/route-separation/index.js\\\",1,56,\\\"javascript\\\"]\",\"examples/route-separation/index.js\",32,8,\"express.static\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"examples/search/index.js\\\",\\\"examples/search/index.js\\\",1,84,\\\"javascript\\\"]\",\"examples/search/index.js\",21,8,\"express.static\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"examples/static-files/index.js\\\",\\\"examples/static-files/index.js\\\",1,44,\\\"javascript\\\"]\",\"examples/static-files/index.js\",22,8,\"express.static\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"examples/static-files/index.js\\\",\\\"examples/static-files/index.js\\\",1,44,\\\"javascript\\\"]\",\"examples/static-files/index.js\",30,19,\"express.static\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"examples/static-files/index.js\\\",\\\"examples/static-files/index.js\\\",1,44,\\\"javascript\\\"]\",\"examples/static-files/index.js\",36,8,\"express.static\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"examples/view-locals/index.js\\\",\\\"examples/view-locals/index.js\\\",1,156,\\\"javascript\\\"]\",\"examples/view-locals/index.js\",27,2,\"User.count\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"examples/view-locals/index.js\\\",\\\"examples/view-locals/index.js\\\",1,156,\\\"javascript\\\"]\",\"examples/view-locals/index.js\",29,4,\"User.all\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"function\\\",\\\"examples/view-locals/index.js\\\",\\\"count\\\",48,54,\\\"javascript\\\"]\",\"examples/view-locals/index.js\",49,2,\"User.count\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"function\\\",\\\"examples/view-locals/index.js\\\",\\\"users\\\",56,62,\\\"javascript\\\"]\",\"examples/view-locals/index.js\",57,2,\"User.all\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"function\\\",\\\"examples/view-locals/index.js\\\",\\\"count2\\\",86,92,\\\"javascript\\\"]\",\"examples/view-locals/index.js\",87,2,\"User.count\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"function\\\",\\\"examples/view-locals/index.js\\\",\\\"users2\\\",94,100,\\\"javascript\\\"]\",\"examples/view-locals/index.js\",95,2,\"User.all\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"route\\\",\\\"examples/view-locals/index.js\\\",\\\"examples/view-locals/index.js::GET:/\\\",26,26,\\\"javascript\\\"]\",\"examples/view-locals/index.js\",26,0,\"User.count\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/app.options.js\\\",\\\"test/app.options.js\\\",1,117,\\\"javascript\\\"]\",\"test/app.options.js\",79,19,\"express.Router\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/app.router.js\\\",\\\"test/app.router.js\\\",1,1218,\\\"javascript\\\"]\",\"test/app.router.js\",875,19,\"express.Router\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/express.json.js\\\",\\\"test/express.json.js\\\",1,756,\\\"javascript\\\"]\",\"test/express.json.js\",60,12,\"express.json\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/express.json.js\\\",\\\"test/express.json.js\\\",1,756,\\\"javascript\\\"]\",\"test/express.json.js\",76,12,\"express.json\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/express.json.js\\\",\\\"test/express.json.js\\\",1,756,\\\"javascript\\\"]\",\"test/express.json.js\",77,12,\"express.json\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/express.json.js\\\",\\\"test/express.json.js\\\",1,756,\\\"javascript\\\"]\",\"test/express.json.js\",513,14,\"express.json\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"function\\\",\\\"test/express.json.js\\\",\\\"createApp\\\",722,740,\\\"javascript\\\"]\",\"test/express.json.js\",725,10,\"express.json\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/express.raw.js\\\",\\\"test/express.raw.js\\\",1,514,\\\"javascript\\\"]\",\"test/express.raw.js\",31,12,\"express.raw\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/express.raw.js\\\",\\\"test/express.raw.js\\\",1,514,\\\"javascript\\\"]\",\"test/express.raw.js\",68,12,\"express.raw\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/express.raw.js\\\",\\\"test/express.raw.js\\\",1,514,\\\"javascript\\\"]\",\"test/express.raw.js\",69,12,\"express.raw\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/express.raw.js\\\",\\\"test/express.raw.js\\\",1,514,\\\"javascript\\\"]\",\"test/express.raw.js\",338,14,\"express.raw\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"function\\\",\\\"test/express.raw.js\\\",\\\"createApp\\\",492,513,\\\"javascript\\\"]\",\"test/express.raw.js\",495,10,\"express.raw\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/express.static.js\\\",\\\"test/express.static.js\\\",1,816,\\\"javascript\\\"]\",\"test/express.static.js\",281,16,\"express.static\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/express.static.js\\\",\\\"test/express.static.js\\\",1,816,\\\"javascript\\\"]\",\"test/express.static.js\",356,16,\"express.static\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/express.static.js\\\",\\\"test/express.static.js\\\",1,816,\\\"javascript\\\"]\",\"test/express.static.js\",476,19,\"express.static\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/express.static.js\\\",\\\"test/express.static.js\\\",1,816,\\\"javascript\\\"]\",\"test/express.static.js\",544,19,\"express.static\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/express.static.js\\\",\\\"test/express.static.js\\\",1,816,\\\"javascript\\\"]\",\"test/express.static.js\",695,29,\"express.static\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/express.static.js\\\",\\\"test/express.static.js\\\",1,816,\\\"javascript\\\"]\",\"test/express.static.js\",709,30,\"express.static\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/express.static.js\\\",\\\"test/express.static.js\\\",1,816,\\\"javascript\\\"]\",\"test/express.static.js\",735,32,\"express.static\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/express.static.js\\\",\\\"test/express.static.js\\\",1,816,\\\"javascript\\\"]\",\"test/express.static.js\",759,14,\"express.static\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/express.static.js\\\",\\\"test/express.static.js\\\",1,816,\\\"javascript\\\"]\",\"test/express.static.js\",770,30,\"express.static\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"function\\\",\\\"test/express.static.js\\\",\\\"createApp\\\",804,815,\\\"javascript\\\"]\",\"test/express.static.js\",808,10,\"express.static\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/express.text.js\\\",\\\"test/express.text.js\\\",1,567,\\\"javascript\\\"]\",\"test/express.text.js\",30,12,\"express.text\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/express.text.js\\\",\\\"test/express.text.js\\\",1,567,\\\"javascript\\\"]\",\"test/express.text.js\",63,12,\"express.text\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/express.text.js\\\",\\\"test/express.text.js\\\",1,567,\\\"javascript\\\"]\",\"test/express.text.js\",64,12,\"express.text\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/express.text.js\\\",\\\"test/express.text.js\\\",1,567,\\\"javascript\\\"]\",\"test/express.text.js\",370,14,\"express.text\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"function\\\",\\\"test/express.text.js\\\",\\\"createApp\\\",549,566,\\\"javascript\\\"]\",\"test/express.text.js\",552,10,\"express.text\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/express.urlencoded.js\\\",\\\"test/express.urlencoded.js\\\",1,829,\\\"javascript\\\"]\",\"test/express.urlencoded.js\",31,12,\"express.urlencoded\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/express.urlencoded.js\\\",\\\"test/express.urlencoded.js\\\",1,829,\\\"javascript\\\"]\",\"test/express.urlencoded.js\",65,12,\"express.urlencoded\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/express.urlencoded.js\\\",\\\"test/express.urlencoded.js\\\",1,829,\\\"javascript\\\"]\",\"test/express.urlencoded.js\",66,12,\"express.urlencoded\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/express.urlencoded.js\\\",\\\"test/express.urlencoded.js\\\",1,829,\\\"javascript\\\"]\",\"test/express.urlencoded.js\",616,14,\"express.urlencoded\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"function\\\",\\\"test/express.urlencoded.js\\\",\\\"createApp\\\",805,822,\\\"javascript\\\"]\",\"test/express.urlencoded.js\",808,10,\"express.urlencoded\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/req.baseUrl.js\\\",\\\"test/req.baseUrl.js\\\",1,89,\\\"javascript\\\"]\",\"test/req.baseUrl.js\",22,16,\"express.Router\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/req.baseUrl.js\\\",\\\"test/req.baseUrl.js\\\",1,89,\\\"javascript\\\"]\",\"test/req.baseUrl.js\",36,17,\"express.Router\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/req.baseUrl.js\\\",\\\"test/req.baseUrl.js\\\",1,89,\\\"javascript\\\"]\",\"test/req.baseUrl.js\",37,17,\"express.Router\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/req.baseUrl.js\\\",\\\"test/req.baseUrl.js\\\",1,89,\\\"javascript\\\"]\",\"test/req.baseUrl.js\",38,17,\"express.Router\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/req.baseUrl.js\\\",\\\"test/req.baseUrl.js\\\",1,89,\\\"javascript\\\"]\",\"test/req.baseUrl.js\",55,17,\"express.Router\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/req.baseUrl.js\\\",\\\"test/req.baseUrl.js\\\",1,89,\\\"javascript\\\"]\",\"test/req.baseUrl.js\",56,17,\"express.Router\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/req.baseUrl.js\\\",\\\"test/req.baseUrl.js\\\",1,89,\\\"javascript\\\"]\",\"test/req.baseUrl.js\",57,17,\"express.Router\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     },
+     {
+      "key": "[\"[\\\"file\\\",\\\"test/res.format.js\\\",\\\"test/res.format.js\\\",1,249,\\\"javascript\\\"]\",\"test/res.format.js\",160,19,\"express.Router\",\"calls\"]",
+      "a": 0,
+      "b": 1
+     }
+    ]
+   },
+   "verdict": "DIFFER"
+  }
+ ]
+}
\ No newline at end of file
diff --git a/docs/handoffs/pr29-2026-11-10/harness/execution.json b/docs/handoffs/pr29-2026-11-10/harness/execution.json
new file mode 100644
index 0000000000..e6b632d7bd
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/harness/execution.json
@@ -0,0 +1,23 @@
+{
+  "completed": {
+    "build-baseline": 0,
+    "build-candidate": 0,
+    "replay-baseline": 1,
+    "replay-candidate": 0,
+    "build-diff": 1,
+    "shadow": 1,
+    "modes-baseline": 0,
+    "modes-candidate": 0,
+    "metamorphic-baseline": 1,
+    "metamorphic-candidate": 1,
+    "timings": 0
+  },
+  "explanations": {
+    "replay-baseline": "one anonymous canary changed FIXED to BROKEN; ordinary known bug verdicts do not alone cause nonzero exit",
+    "build-diff": "Express64removed calls/64new unresolved; other4repos SAME",
+    "shadow": "6expected changed answers;17SAME; no FAILED/UNSTABLE",
+    "metamorphic": "Baseline26DIFF, candidate17DIFF, no ERROR; 9previous differences disappear, detailed per-diff comparison saved"
+  },
+  "activeSessions": {},
+  "next": "Harness complete. Report performance regression; no automatic fixes/review/publication."
+}
diff --git a/docs/handoffs/pr29-2026-11-10/harness/express-classification.json b/docs/handoffs/pr29-2026-11-10/harness/express-classification.json
new file mode 100644
index 0000000000..4e741917fd
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/harness/express-classification.json
@@ -0,0 +1,521 @@
+{
+  "counts": {
+    "removed incorrect target": 52,
+    "removed unproven callable target": 12
+  },
+  "rows": [
+    {
+      "file": "examples/auth/index.js",
+      "line": 21,
+      "reference": "express.urlencoded",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "examples/content-negotiation/index.js",
+      "line": 12,
+      "reference": "users.map",
+      "oldTarget": "examples/content-negotiation/db.js:users",
+      "classification": "removed incorrect target",
+      "proof": "Runtime: exported value is an array; users.map is Array.prototype.map, not the exported users array."
+    },
+    {
+      "file": "examples/content-negotiation/index.js",
+      "line": 18,
+      "reference": "users.map",
+      "oldTarget": "examples/content-negotiation/db.js:users",
+      "classification": "removed incorrect target",
+      "proof": "Runtime: exported value is an array; users.map is Array.prototype.map, not the exported users array."
+    },
+    {
+      "file": "examples/content-negotiation/users.js",
+      "line": 6,
+      "reference": "users.map",
+      "oldTarget": "examples/content-negotiation/db.js:users",
+      "classification": "removed incorrect target",
+      "proof": "Runtime: exported value is an array; users.map is Array.prototype.map, not the exported users array."
+    },
+    {
+      "file": "examples/content-negotiation/users.js",
+      "line": 12,
+      "reference": "users.map",
+      "oldTarget": "examples/content-negotiation/db.js:users",
+      "classification": "removed incorrect target",
+      "proof": "Runtime: exported value is an array; users.map is Array.prototype.map, not the exported users array."
+    },
+    {
+      "file": "examples/cookies/index.js",
+      "line": 22,
+      "reference": "express.urlencoded",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "examples/ejs/index.js",
+      "line": 31,
+      "reference": "express.static",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "examples/multi-router/controllers/api_v1.js",
+      "line": 5,
+      "reference": "express.Router",
+      "oldTarget": "lib/express.js:Router",
+      "classification": "removed unproven callable target",
+      "proof": "Old target is the local Router variable holding an external require; the router implementation is outside this source index. Reference ownership alone is not a call-body proof."
+    },
+    {
+      "file": "examples/multi-router/controllers/api_v2.js",
+      "line": 5,
+      "reference": "express.Router",
+      "oldTarget": "lib/express.js:Router",
+      "classification": "removed unproven callable target",
+      "proof": "Old target is the local Router variable holding an external require; the router implementation is outside this source index. Reference ownership alone is not a call-body proof."
+    },
+    {
+      "file": "examples/mvc/index.js",
+      "line": 37,
+      "reference": "express.static",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "examples/mvc/index.js",
+      "line": 47,
+      "reference": "express.urlencoded",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "examples/route-separation/index.js",
+      "line": 31,
+      "reference": "express.urlencoded",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "examples/route-separation/index.js",
+      "line": 32,
+      "reference": "express.static",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "examples/search/index.js",
+      "line": 21,
+      "reference": "express.static",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "examples/static-files/index.js",
+      "line": 22,
+      "reference": "express.static",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "examples/static-files/index.js",
+      "line": 30,
+      "reference": "express.static",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "examples/static-files/index.js",
+      "line": 36,
+      "reference": "express.static",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "examples/view-locals/index.js",
+      "line": 27,
+      "reference": "User.count",
+      "oldTarget": "examples/view-locals/user.js:User",
+      "classification": "removed incorrect target",
+      "proof": "Runtime: User.count and User.all are functions distinct from the User constructor."
+    },
+    {
+      "file": "examples/view-locals/index.js",
+      "line": 29,
+      "reference": "User.all",
+      "oldTarget": "examples/view-locals/user.js:User",
+      "classification": "removed incorrect target",
+      "proof": "Runtime: User.count and User.all are functions distinct from the User constructor."
+    },
+    {
+      "file": "examples/view-locals/index.js",
+      "line": 49,
+      "reference": "User.count",
+      "oldTarget": "examples/view-locals/user.js:User",
+      "classification": "removed incorrect target",
+      "proof": "Runtime: User.count and User.all are functions distinct from the User constructor."
+    },
+    {
+      "file": "examples/view-locals/index.js",
+      "line": 57,
+      "reference": "User.all",
+      "oldTarget": "examples/view-locals/user.js:User",
+      "classification": "removed incorrect target",
+      "proof": "Runtime: User.count and User.all are functions distinct from the User constructor."
+    },
+    {
+      "file": "examples/view-locals/index.js",
+      "line": 87,
+      "reference": "User.count",
+      "oldTarget": "examples/view-locals/user.js:User",
+      "classification": "removed incorrect target",
+      "proof": "Runtime: User.count and User.all are functions distinct from the User constructor."
+    },
+    {
+      "file": "examples/view-locals/index.js",
+      "line": 95,
+      "reference": "User.all",
+      "oldTarget": "examples/view-locals/user.js:User",
+      "classification": "removed incorrect target",
+      "proof": "Runtime: User.count and User.all are functions distinct from the User constructor."
+    },
+    {
+      "file": "examples/view-locals/index.js",
+      "line": 26,
+      "reference": "User.count",
+      "oldTarget": "examples/view-locals/user.js:User",
+      "classification": "removed incorrect target",
+      "proof": "Runtime: User.count and User.all are functions distinct from the User constructor."
+    },
+    {
+      "file": "test/app.options.js",
+      "line": 79,
+      "reference": "express.Router",
+      "oldTarget": "lib/express.js:Router",
+      "classification": "removed unproven callable target",
+      "proof": "Old target is the local Router variable holding an external require; the router implementation is outside this source index. Reference ownership alone is not a call-body proof."
+    },
+    {
+      "file": "test/app.router.js",
+      "line": 875,
+      "reference": "express.Router",
+      "oldTarget": "lib/express.js:Router",
+      "classification": "removed unproven callable target",
+      "proof": "Old target is the local Router variable holding an external require; the router implementation is outside this source index. Reference ownership alone is not a call-body proof."
+    },
+    {
+      "file": "test/express.json.js",
+      "line": 60,
+      "reference": "express.json",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "test/express.json.js",
+      "line": 76,
+      "reference": "express.json",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "test/express.json.js",
+      "line": 77,
+      "reference": "express.json",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "test/express.json.js",
+      "line": 513,
+      "reference": "express.json",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "test/express.json.js",
+      "line": 725,
+      "reference": "express.json",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "test/express.raw.js",
+      "line": 31,
+      "reference": "express.raw",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "test/express.raw.js",
+      "line": 68,
+      "reference": "express.raw",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "test/express.raw.js",
+      "line": 69,
+      "reference": "express.raw",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "test/express.raw.js",
+      "line": 338,
+      "reference": "express.raw",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "test/express.raw.js",
+      "line": 495,
+      "reference": "express.raw",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "test/express.static.js",
+      "line": 281,
+      "reference": "express.static",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "test/express.static.js",
+      "line": 356,
+      "reference": "express.static",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "test/express.static.js",
+      "line": 476,
+      "reference": "express.static",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "test/express.static.js",
+      "line": 544,
+      "reference": "express.static",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "test/express.static.js",
+      "line": 695,
+      "reference": "express.static",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "test/express.static.js",
+      "line": 709,
+      "reference": "express.static",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "test/express.static.js",
+      "line": 735,
+      "reference": "express.static",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "test/express.static.js",
+      "line": 759,
+      "reference": "express.static",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "test/express.static.js",
+      "line": 770,
+      "reference": "express.static",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "test/express.static.js",
+      "line": 808,
+      "reference": "express.static",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "test/express.text.js",
+      "line": 30,
+      "reference": "express.text",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "test/express.text.js",
+      "line": 63,
+      "reference": "express.text",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "test/express.text.js",
+      "line": 64,
+      "reference": "express.text",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "test/express.text.js",
+      "line": 370,
+      "reference": "express.text",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "test/express.text.js",
+      "line": 552,
+      "reference": "express.text",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "test/express.urlencoded.js",
+      "line": 31,
+      "reference": "express.urlencoded",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "test/express.urlencoded.js",
+      "line": 65,
+      "reference": "express.urlencoded",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "test/express.urlencoded.js",
+      "line": 66,
+      "reference": "express.urlencoded",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "test/express.urlencoded.js",
+      "line": 616,
+      "reference": "express.urlencoded",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "test/express.urlencoded.js",
+      "line": 808,
+      "reference": "express.urlencoded",
+      "oldTarget": "lib/express.js:createApplication",
+      "classification": "removed incorrect target",
+      "proof": "lib/express.js assigns these properties to body-parser or serve-static, distinct from createApplication."
+    },
+    {
+      "file": "test/req.baseUrl.js",
+      "line": 22,
+      "reference": "express.Router",
+      "oldTarget": "lib/express.js:Router",
+      "classification": "removed unproven callable target",
+      "proof": "Old target is the local Router variable holding an external require; the router implementation is outside this source index. Reference ownership alone is not a call-body proof."
+    },
+    {
+      "file": "test/req.baseUrl.js",
+      "line": 36,
+      "reference": "express.Router",
+      "oldTarget": "lib/express.js:Router",
+      "classification": "removed unproven callable target",
+      "proof": "Old target is the local Router variable holding an external require; the router implementation is outside this source index. Reference ownership alone is not a call-body proof."
+    },
+    {
+      "file": "test/req.baseUrl.js",
+      "line": 37,
+      "reference": "express.Router",
+      "oldTarget": "lib/express.js:Router",
+      "classification": "removed unproven callable target",
+      "proof": "Old target is the local Router variable holding an external require; the router implementation is outside this source index. Reference ownership alone is not a call-body proof."
+    },
+    {
+      "file": "test/req.baseUrl.js",
+      "line": 38,
+      "reference": "express.Router",
+      "oldTarget": "lib/express.js:Router",
+      "classification": "removed unproven callable target",
+      "proof": "Old target is the local Router variable holding an external require; the router implementation is outside this source index. Reference ownership alone is not a call-body proof."
+    },
+    {
+      "file": "test/req.baseUrl.js",
+      "line": 55,
+      "reference": "express.Router",
+      "oldTarget": "lib/express.js:Router",
+      "classification": "removed unproven callable target",
+      "proof": "Old target is the local Router variable holding an external require; the router implementation is outside this source index. Reference ownership alone is not a call-body proof."
+    },
+    {
+      "file": "test/req.baseUrl.js",
+      "line": 56,
+      "reference": "express.Router",
+      "oldTarget": "lib/express.js:Router",
+      "classification": "removed unproven callable target",
+      "proof": "Old target is the local Router variable holding an external require; the router implementation is outside this source index. Reference ownership alone is not a call-body proof."
+    },
+    {
+      "file": "test/req.baseUrl.js",
+      "line": 57,
+      "reference": "express.Router",
+      "oldTarget": "lib/express.js:Router",
+      "classification": "removed unproven callable target",
+      "proof": "Old target is the local Router variable holding an external require; the router implementation is outside this source index. Reference ownership alone is not a call-body proof."
+    },
+    {
+      "file": "test/res.format.js",
+      "line": 160,
+      "reference": "express.Router",
+      "oldTarget": "lib/express.js:Router",
+      "classification": "removed unproven callable target",
+      "proof": "Old target is the local Router variable holding an external require; the router implementation is outside this source index. Reference ownership alone is not a call-body proof."
+    }
+  ],
+  "limits": "Classification of the64removed baseline edges only. This does not establish complete Express call coverage or prove there are no other missing edges."
+}
\ No newline at end of file
diff --git a/docs/handoffs/pr29-2026-11-10/harness/manifest.json b/docs/handoffs/pr29-2026-11-10/harness/manifest.json
new file mode 100644
index 0000000000..3363dffd37
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/harness/manifest.json
@@ -0,0 +1,8120 @@
+{
+  "work": "/tmp/codegraph-pr29-harness-6fevujfy",
+  "out": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-harness-20261110T013135Z",
+  "baseline": "/tmp/codegraph-pr29-harness-6fevujfy/baseline/dist/bin/codegraph.js",
+  "candidate": "/tmp/codegraph-pr29-harness-6fevujfy/candidate/dist/bin/codegraph.js",
+  "qa": "/tmp/codegraph-pr29-harness-6fevujfy/qa",
+  "baselineHead": "87576a8d9ff0d8aba235db5535f5f4429f14b037",
+  "candidateSourceHashes": [
+    {
+      "sha256": "5612a854aa07ce2db54c5a74e31b95b3b9523a3ff84e6a706708ee9c18ff1bd4",
+      "path": ".cursor/rules/codegraph.mdc"
+    },
+    {
+      "sha256": "74025a3e7234f4316f87d8b8efb4ed1e378823233d4ac9410c9870e95255ee03",
+      "path": ".dockerignore"
+    },
+    {
+      "sha256": "6191eac8a893dc49c126100ccd384c62cb2cc72740ee919116efe10c0a96f30a",
+      "path": ".gitattributes"
+    },
+    {
+      "sha256": "5f29cda8efa94b22c8bc4940f7760530dfd05f917386f499d4cd6fe6023cefab",
+      "path": ".github/workflows/deploy-site.yml"
+    },
+    {
+      "sha256": "ea5af6267406e24d316a27424d68d67b1dbb5e385a8bb0cc9afef1894aa587d7",
+      "path": ".github/workflows/release.yml"
+    },
+    {
+      "sha256": "6defde42a505c5e356376d492545ad730150d959a27b95c189aa569016b2cbb7",
+      "path": ".github/workflows/ts-differential.yml"
+    },
+    {
+      "sha256": "3d1fd4a31ce749b99054ffc8e8215d98d6654c1d0b00662d31d362a5d8f7e02b",
+      "path": ".gitignore"
+    },
+    {
+      "sha256": "619adda931b3bdc2eadc31aaebbc8094244da46664e270fdddca0c1349244a3c",
+      "path": "AGENTS.md"
+    },
+    {
+      "sha256": "d9195a9d1d04fa097c9bf75a664bfd2282d178500c9892d9e481b0988c85f589",
+      "path": "BUNDLING.md"
+    },
+    {
+      "sha256": "ce7b1007c5033ed56ed6ea7557738c53f09ed43f809427404b73cca08602d6d6",
+      "path": "CHANGELOG.md"
+    },
+    {
+      "sha256": "fe478c47fb6c6e3d55147720b68d8b9fa45e7b128531f26121b8f1794e8a05cf",
+      "path": "CLAUDE.md"
+    },
+    {
+      "sha256": "9897185d91e52ad1ce2b74e3c193a2de72eefefe0e8141f746c36bb1c53fc929",
+      "path": "CONTRIBUTING.md"
+    },
+    {
+      "sha256": "e6d98f98c666bebe065ac2492a0a19232cc318d4d67bac3ca42ffb77bacc8809",
+      "path": "LICENSE"
+    },
+    {
+      "sha256": "60483e927e1eb39bd91d7ee6d1292504f76d78a50809a571b65fbea647220b71",
+      "path": "README.md"
+    },
+    {
+      "sha256": "ec8cfed096d1081b1a3ca2516f8d306341ad1701b283850ef0743801d7ee7ec3",
+      "path": "TELEMETRY.md"
+    },
+    {
+      "sha256": "0e30217102a15134ba40815434bbc2877d1fa39f6d3305f3b0921a6bcf5370a5",
+      "path": "__tests__/absent-member-calls.test.ts"
+    },
+    {
+      "sha256": "94740190bf4986632c27ce9344189e5c73b088b167304b53c6fabec0ca99afec",
+      "path": "__tests__/adaptive-explore-sizing.test.ts"
+    },
+    {
+      "sha256": "981ecc94f9a9235928ebb98b4084e97252b55e22e1f30b514eb528e4ce504bd6",
+      "path": "__tests__/add-lang-check-grammar.test.ts"
+    },
+    {
+      "sha256": "ae0ff1077f3344cd2e7e40826fc21c4d4c7ec7170cbc0c8a2edf9986139a7d78",
+      "path": "__tests__/add-lang-verify-extraction.test.ts"
+    },
+    {
+      "sha256": "1ea56b113b3d6a5b05ab64eac24e8c90d327ae0218d8935610764461dc8be467",
+      "path": "__tests__/alias-binding-resolution.test.ts"
+    },
+    {
+      "sha256": "098008e08b19cc35729959347b39365b13da23767312a41c4b344f9d521bf2e1",
+      "path": "__tests__/ambient-module-imports.test.ts"
+    },
+    {
+      "sha256": "86c4ec28c34201dfd0d6a04c36b4152d1d00a92f1255f7eff79f1778cbe6380f",
+      "path": "__tests__/android-res-exclusion.test.ts"
+    },
+    {
+      "sha256": "7f7110c08a27cf5e9e49eaeae03f25d0c2f3e0d87f5c9ba53950649e97f38e3e",
+      "path": "__tests__/angular-router.test.ts"
+    },
+    {
+      "sha256": "3ef0e07bf13d7f8212ebd0be2805f49b0ed668e0d0c2399f723fa34433049954",
+      "path": "__tests__/arkts-resolution.test.ts"
+    },
+    {
+      "sha256": "bec725790ef21f565eb915f7e06e856b2127cedebc91a5d685117d2aa9dc21c8",
+      "path": "__tests__/astro-component-markup-only.test.ts"
+    },
+    {
+      "sha256": "37af02072b684de9b7e4e5437a441bdae6fa70d86e1abd1ee97dd50310368a57",
+      "path": "__tests__/awaited-receiver.test.ts"
+    },
+    {
+      "sha256": "09202f23066bdd0628f2f4e7af38759dafbd6100176caab8d3206059b360288f",
+      "path": "__tests__/bare-call-no-method.test.ts"
+    },
+    {
+      "sha256": "c3a5984e31406adc2bc14d94a3c5e4e0eb70ed62df9da9bee465a421adaf7b86",
+      "path": "__tests__/batched-ref-cleanup.test.ts"
+    },
+    {
+      "sha256": "f4659ad3dd6536e12f265bd28ecfba3cf7a2ae57a4173aeff4abb0a099cc8e31",
+      "path": "__tests__/beta-signup.test.ts"
+    },
+    {
+      "sha256": "999fe724ed77f64d161f5e3cb67c08b29711bcd548402f8b3af6729672c51fde",
+      "path": "__tests__/bounded-source.test.ts"
+    },
+    {
+      "sha256": "20c1d43d25a08eb871754913ea394da8395eef88b84b0d22d0c97ebf57b6724e",
+      "path": "__tests__/branch-guards-languages.test.ts"
+    },
+    {
+      "sha256": "06d1d2124d91cbd4bc1e7682eebfe585dca9ea9ea3c4f265097ad5ea44752d5c",
+      "path": "__tests__/branch-guards.test.ts"
+    },
+    {
+      "sha256": "54a28bf037a635baf3395e31ca2e847b20668c249af529f0a79645aa21019e18",
+      "path": "__tests__/browser-host-globals.test.ts"
+    },
+    {
+      "sha256": "2b325f18edaa487098ffb4c0548c1d4d3a706b13e3a504e4d992fd1539aa2208",
+      "path": "__tests__/bundle-launcher.test.ts"
+    },
+    {
+      "sha256": "a68e5e8453b552414cbd2bf588b1571b96e270f434a90f007456bf14f897def6",
+      "path": "__tests__/c-calls-never-methods.test.ts"
+    },
+    {
+      "sha256": "8f3b467692b48e0cefff988c8682d26930975501226e42cbe0eed14d5dcf854b",
+      "path": "__tests__/c-cpp-declaration-types.test.ts"
+    },
+    {
+      "sha256": "0386faa6e05ac1218ea82a9f41ede1aac4d72a09a1266868f0f565f513630060",
+      "path": "__tests__/c-cpp-member-supertypes.test.ts"
+    },
+    {
+      "sha256": "ebd5f621449b36767c46cc1ccc764f4e1d771aa3b54e511e34e49032b68d7551",
+      "path": "__tests__/c-cpp-member-type-refs.test.ts"
+    },
+    {
+      "sha256": "5b27ee4029b42670d618de165ea0eaf7d33f3dc57327c37fa5574ee3ebcbe9d0",
+      "path": "__tests__/c-feature-macro-variants.test.ts"
+    },
+    {
+      "sha256": "0a4e2112e989cf635d8a95b34854f1018db273abf0625159241343f21f7be7b0",
+      "path": "__tests__/c-fnptr-kernel-sweep.test.ts"
+    },
+    {
+      "sha256": "95547f4188e9b19fced5f679f92dd5af15455d3e9093a71b83e48cd0cff8f731",
+      "path": "__tests__/c-fnptr-synthesizer.test.ts"
+    },
+    {
+      "sha256": "b5151b1399d373d752357da86a609d350ac7f674ed1eb6b928b40cc57f5c2bbb",
+      "path": "__tests__/c-include-lone-macros.test.ts"
+    },
+    {
+      "sha256": "138b4a7497771173732d951af5fb57eebe1712f1a434cabfbf8b43513b6fe46f",
+      "path": "__tests__/c-macro-renames.test.ts"
+    },
+    {
+      "sha256": "d1b8fee7550d4833861b0a023b29c5a860527cdbf63b5d55f948edc1a2793858",
+      "path": "__tests__/c-macro-return-types.test.ts"
+    },
+    {
+      "sha256": "3037f15b5bcc5e106877938eba77c884e37ae52403ecbfe72df17270b393fac7",
+      "path": "__tests__/c-statement-macro-names.test.ts"
+    },
+    {
+      "sha256": "16bb0655a7dafc7c9e4d864dc24afc161b1e794a18b9a6ce47abc7b8cf735172",
+      "path": "__tests__/c-static-call-rescue.test.ts"
+    },
+    {
+      "sha256": "85e313500785b78125d48c6df246a70661bc8021b030b3dcd5b26a55f269d35b",
+      "path": "__tests__/call-receiver-no-fabrication.test.ts"
+    },
+    {
+      "sha256": "5287e18cb75e5dd628de1ab7a95a0b5f71d6018cdaf2dfe38cc6287c3547807c",
+      "path": "__tests__/call-value-targets.test.ts"
+    },
+    {
+      "sha256": "a9308665e961abf2c33743980bdfaebcc6f5c791f90b999799614974a9fd22c9",
+      "path": "__tests__/callers-call-sites.test.ts"
+    },
+    {
+      "sha256": "c797fa446e53e5d6b7f756fee29d0481734c2ed65cffb356bc4f9c2681b628ef",
+      "path": "__tests__/catch-all-path-alias.test.ts"
+    },
+    {
+      "sha256": "498a394d329496c6de3390f11e5d9f858328d46e3a92b889caf7a83a1c2cc419",
+      "path": "__tests__/celery-dispatch-synthesizer.test.ts"
+    },
+    {
+      "sha256": "135db16edcff430d69d9da432de67e6a2ba66ce36625d4a01cc4fa621835f64d",
+      "path": "__tests__/cfml-call-scope.test.ts"
+    },
+    {
+      "sha256": "19a1fe820fad7e9f34d889966536f97c2b6e497f1cfa1eac190f42d274dcc62e",
+      "path": "__tests__/cfml-create-object.test.ts"
+    },
+    {
+      "sha256": "281033cea06e62a4de72dc8bcbb8e14382cd71a90947b027bc38c6756bdce828",
+      "path": "__tests__/cfml-embedded-parse-warning.test.ts"
+    },
+    {
+      "sha256": "956ac0c186ff772776b3eea7f1b223fdaae39e64f9af70dfe8fce90e83a600ca",
+      "path": "__tests__/cfml-include.test.ts"
+    },
+    {
+      "sha256": "39ce9dfbfc7d1de37cd9ca7ab27e0d33eb5087ee406015f0a9dcf7b864181127",
+      "path": "__tests__/cfml-inheritance-resolution.test.ts"
+    },
+    {
+      "sha256": "37ed4e112e7c3598434796acc39719b4df99baf0dab733b39e1edf2c98d49fd9",
+      "path": "__tests__/cfml-receiver-inference.test.ts"
+    },
+    {
+      "sha256": "fa7f60b1681d62e8da07241ee463e46ed4fa590abb16fa142a5b71780a9bab06",
+      "path": "__tests__/cfml-tag-calls.test.ts"
+    },
+    {
+      "sha256": "3c63063ec778cb2e35800d5308e3c233c4eba3887e672ac1472857d0bd3acfcf",
+      "path": "__tests__/child-process-windows-hide.test.ts"
+    },
+    {
+      "sha256": "38836637aee056861968da1f1a44bc57df5ed014ce9212670b47aa8199905600",
+      "path": "__tests__/chinese-filename-retrieval.test.ts"
+    },
+    {
+      "sha256": "8c09319dd3bb20d6de32213e0755a549dc9d9dd7990f751faaaa52e2dfbc7f07",
+      "path": "__tests__/cjk-query-tokens.test.ts"
+    },
+    {
+      "sha256": "1f9626a41b06cbf6b879b56ed176354cc8c277f4c2a37468a315e77bcbb960f9",
+      "path": "__tests__/cli-affected-filter-globs.test.ts"
+    },
+    {
+      "sha256": "47e15edc8271a7b819b0914e036ca38d6a90ae0577114678e9d178b444d8334a",
+      "path": "__tests__/cli-affected-paths.test.ts"
+    },
+    {
+      "sha256": "3451a64fad420776ea92d7381bbf68c3bf73a63e7593fb5f129c094f9297d064",
+      "path": "__tests__/cli-affected-test-conventions.test.ts"
+    },
+    {
+      "sha256": "8dd0540bdae8d465d099565af238bf6688612240ef58199e642657dae2107045",
+      "path": "__tests__/cli-context-command.test.ts"
+    },
+    {
+      "sha256": "c48ce21528bba805d0e57bc6d01278f564e808ac2483b1cc526f3aaf450c11a9",
+      "path": "__tests__/cli-cycles.test.ts"
+    },
+    {
+      "sha256": "fa8759a2a1ac7b70743e2dc1805fa3fa85487ce8c3d970b1b8a7613f7099b7db",
+      "path": "__tests__/cli-definition-grouping.test.ts"
+    },
+    {
+      "sha256": "eea360826fc934b0dd7642fc578decbc8a0c602741a594bacf567402a4df1cfa",
+      "path": "__tests__/cli-files-test-classification.test.ts"
+    },
+    {
+      "sha256": "7cefe5aadc3ba52887b2b8df50b9a297aa0e3a6fbd83c6e22c4825c57a837afb",
+      "path": "__tests__/cli-implementations.test.ts"
+    },
+    {
+      "sha256": "a2a32f31b6472b3071f8ced44fb397683d5ed6c11039679b909630a9b8f023ca",
+      "path": "__tests__/cli-index-explicit-path.test.ts"
+    },
+    {
+      "sha256": "b561f0d45b67f8525f1ab019363fd195943c606595ee8fee16675ff9adeb9e59",
+      "path": "__tests__/cli-install-init.test.ts"
+    },
+    {
+      "sha256": "55ccb64c96f865675dc7deafd02d14fe820bc65f540100dd9a1426757198eecf",
+      "path": "__tests__/cli-no-color.test.ts"
+    },
+    {
+      "sha256": "0f875fb5d1fefb7919dd8348de7594c6ee39609e7d970fe5836f4658c8adee3d",
+      "path": "__tests__/cli-node-command.test.ts"
+    },
+    {
+      "sha256": "0c2d00ec414af0c4ea9b6c9bff0910afb380222dcd8175ed536e0bb892c77f9b",
+      "path": "__tests__/cli-parse-warning.test.ts"
+    },
+    {
+      "sha256": "c5895c9603c6e83ee50b28b4bdc6cc6cf4fcd5b6149f181c38b54832451cb99a",
+      "path": "__tests__/cli-query-command.test.ts"
+    },
+    {
+      "sha256": "81c32bc2df2ca7077627d80a9818cf109c514ac629c124f9f6a8df071acd1e7d",
+      "path": "__tests__/cli-sync-stale-index.test.ts"
+    },
+    {
+      "sha256": "3253e0ff7d7295e13e5110e33665ecc501893701451cd03fb9b491a92f417404",
+      "path": "__tests__/cli-sync.test.ts"
+    },
+    {
+      "sha256": "3c3909879293841c1f1ee2d19848fe1ecb2c3da3fea2b799290af741cfac924c",
+      "path": "__tests__/cli-truncation.test.ts"
+    },
+    {
+      "sha256": "e97999a621141ae24849a0c83d387791e799a8197384478934aa57c728aaed45",
+      "path": "__tests__/cli-ui-command.test.ts"
+    },
+    {
+      "sha256": "bd412b824a3a1a5ef326aab0f0a9df2f8f2e2c9a1b481475904ef8b4be43dded",
+      "path": "__tests__/cli-unlock.test.ts"
+    },
+    {
+      "sha256": "a22e54bf118fd5c4606977e3563bbb6b71d3b1078122a89d1fd4a324091bc9e5",
+      "path": "__tests__/cli-version.test.ts"
+    },
+    {
+      "sha256": "9bbeb015c897025107e3726f8cccc92590d46ab26b928ff27a1e1be2af9a3659",
+      "path": "__tests__/closure-collection-synthesizer.test.ts"
+    },
+    {
+      "sha256": "ab7df4224b067e55b8271e47ec37362e53efcec1c12c8f4094ed0f5a36ec3808",
+      "path": "__tests__/cobol-sequence-area-period.test.ts"
+    },
+    {
+      "sha256": "539b4e5c9eed1bd320830665bb27a9299d45f228075c2d8c8d5bbfb86602fc04",
+      "path": "__tests__/codeigniter.test.ts"
+    },
+    {
+      "sha256": "b5ff6d69d82c04fd096a413437dae9d1eb57469b6f9850a15c529ba858984e54",
+      "path": "__tests__/commonjs-eval-facts.test.ts"
+    },
+    {
+      "sha256": "bde138636b57b2142a722820b057f4826afc7c9dad2155260b2b75e7f22a45c3",
+      "path": "__tests__/commonjs-eval.test.ts"
+    },
+    {
+      "sha256": "61a62b8011b42226de741f6a8dc040ac69fe473ce19b51af9e36f0017e8e0609",
+      "path": "__tests__/commonjs-export-evidence-integration.test.ts"
+    },
+    {
+      "sha256": "5f0367d940df507e83253c20e12b3dcae42b247e5905b02beb53e053a3a73562",
+      "path": "__tests__/commonjs-export-evidence.test.ts"
+    },
+    {
+      "sha256": "01913d19d5d4ea6227d741750567606b31f5a26036c11d71d7629257f59fbe45",
+      "path": "__tests__/commonjs-export-members.test.ts"
+    },
+    {
+      "sha256": "b4ae043dd99242b914a39c4fd3dfc6f2f64b6e1ef57c64139e8eca78707c1f65",
+      "path": "__tests__/commonjs-exports.test.ts"
+    },
+    {
+      "sha256": "92fe9259830556e5f2fb1dbac3ce7087b28393bfbfa548a49c6fbdd602eef025",
+      "path": "__tests__/commonjs-require-calls.test.ts"
+    },
+    {
+      "sha256": "286a9814070ac1f24c1be602498ed5e442c91a0aa4fe8bc02e821c2b16620146",
+      "path": "__tests__/commonjs-require-imports.test.ts"
+    },
+    {
+      "sha256": "25b3aee0d87385a216bf8b45e21dcef621e6d2385159eb357d91ad28d3e4673a",
+      "path": "__tests__/commonjs-value-contract.test.ts"
+    },
+    {
+      "sha256": "adf37404d530d30818d1dbe0b0ff6821023a031b6dbba43546396d50ac2413cd",
+      "path": "__tests__/commonjs-value-graph.test.ts"
+    },
+    {
+      "sha256": "902173a7cd89826ea5fda15c96a2c970e61ae18fd6d315acf6f2aec3e2ecc151",
+      "path": "__tests__/compile-cache-missing-drive.test.ts"
+    },
+    {
+      "sha256": "195def10f140f9f2b36fa23fa91e5ec17e62a5633e30a3dd801ce038af6429b2",
+      "path": "__tests__/component-same-folder.test.ts"
+    },
+    {
+      "sha256": "69f31ae37d4b9036fbe99bc84a6baf0bf50e755afbe5361b12b0c3edb09929bb",
+      "path": "__tests__/concurrent-locking.test.ts"
+    },
+    {
+      "sha256": "ec983a44124329f4542afc6a0ba393a760ef5a0fa58723f8ffaf83cb1999f5cf",
+      "path": "__tests__/config-secret-redaction.test.ts"
+    },
+    {
+      "sha256": "187a2dc599320ff4111a488a8bab6b446e541106b856bd8a93bb271844a24576",
+      "path": "__tests__/const-alias-flow.test.ts"
+    },
+    {
+      "sha256": "c1060b13bd6e29b0dc51b15c1de3309e7023833cc246ae6865fb3e392bb9ff17",
+      "path": "__tests__/context-ranking.test.ts"
+    },
+    {
+      "sha256": "e47c476fa84a0907b0a057c0699c6382b4d76ceebcbaeea62db2f039f2806541",
+      "path": "__tests__/context.test.ts"
+    },
+    {
+      "sha256": "174a0dd418754236038e16f0dc8ea5931b6a74f29bbe73dd4af9960cc13a9e38",
+      "path": "__tests__/cooperative-yield.test.ts"
+    },
+    {
+      "sha256": "1526d2a79690d0af1a01825770f498c6aab0bc3d7a9c6d55f1d124c7a837056d",
+      "path": "__tests__/cpp-absl-holder-receiver.test.ts"
+    },
+    {
+      "sha256": "0f2633612216b2067466b46aeb93cc705e805278c442d818b54210d307facdf9",
+      "path": "__tests__/cpp-alias-inherited-member.test.ts"
+    },
+    {
+      "sha256": "aa407a5a7fbd1fc660ff7eebacd54b1b3cc7f388b9939f0118ee5f2ff0b2a617",
+      "path": "__tests__/cpp-anonymous-union-members.test.ts"
+    },
+    {
+      "sha256": "e898c4b6ab47e66d03f95a5851aa9477d4773286ccb11a0b5a721cf2c770d35a",
+      "path": "__tests__/cpp-attribute-macros.test.ts"
+    },
+    {
+      "sha256": "fc1e6bb6cb8adf5b6a6a45091fcc04056f6a3e721960ce5c0891e86e80828eff",
+      "path": "__tests__/cpp-auto-iterator-arrow.test.ts"
+    },
+    {
+      "sha256": "bbbae400222fcbfe8136e4e55571bbbb03566b10c74afab7b1bef113e02a3164",
+      "path": "__tests__/cpp-auto-local-receiver.test.ts"
+    },
+    {
+      "sha256": "dc5e839ff434b0a33f403ce5c69357d08e7211d09daafcb5b1f5dee9ab42cc45",
+      "path": "__tests__/cpp-auto-range-for-receiver.test.ts"
+    },
+    {
+      "sha256": "31d55cbac9cec72ce954a0149b426fbb054609d6f41521def4481b41c1a2b84d",
+      "path": "__tests__/cpp-base-class-lookup.test.ts"
+    },
+    {
+      "sha256": "52accb3c7667d2763b75066b35d8e4a1ee3e6c5484f442f70ab2cc192170d79e",
+      "path": "__tests__/cpp-binding-and-wrapper-receivers.test.ts"
+    },
+    {
+      "sha256": "71f33456f757f0e652c85dec62016146a3bffa08740fec9930b9d4feac887e39",
+      "path": "__tests__/cpp-block-comment-lines.test.ts"
+    },
+    {
+      "sha256": "a6ee0e12a65146ef8220bcc24ff83c102dc74a55f5dce7940ff0efe316793c81",
+      "path": "__tests__/cpp-brace-scopes.test.ts"
+    },
+    {
+      "sha256": "fb12d8d22dcd80afe5c95eed12dd7b4abe8fdae701a3456401b9d5463719222b",
+      "path": "__tests__/cpp-class-name-receiver-members.test.ts"
+    },
+    {
+      "sha256": "999a66e97dc25db9e15829d78cb9e3a5c3f415d4ae0a7323daf6230b4d7e0869",
+      "path": "__tests__/cpp-comparisons-and-template-declarators.test.ts"
+    },
+    {
+      "sha256": "9dc00b238e4b0e8fdf8e8237b00b5481200d97c5d9595483363726caa8adaf6a",
+      "path": "__tests__/cpp-conditional-class.test.ts"
+    },
+    {
+      "sha256": "5888cd028e2c52e89e162fd423428541544f8a675db5f0223ce90ee50f6a93f0",
+      "path": "__tests__/cpp-container-accessor-calls.test.ts"
+    },
+    {
+      "sha256": "1c8d6f55527ecc76fa3b02bb59edbdec34ba9a96195c5c2427514aee881df20c",
+      "path": "__tests__/cpp-declarator-clause-names.test.ts"
+    },
+    {
+      "sha256": "4849d0ee42c00e2848f9f63d8176dfb0c21bd0b446e963be0229078025197555",
+      "path": "__tests__/cpp-declared-type-receiver.test.ts"
+    },
+    {
+      "sha256": "c0657086b43f7054e06f73d4ba088eda7ecb25b9951237650c33f123a542a0d2",
+      "path": "__tests__/cpp-dereferenced-iterator-calls.test.ts"
+    },
+    {
+      "sha256": "94a8d3b8c38f386533e04fd663eccf1cb233e7eefbe416af6059485cb8f6ba1b",
+      "path": "__tests__/cpp-element-access-calls.test.ts"
+    },
+    {
+      "sha256": "b174dd4bfaa680023a31e8929014a7b27b8070d05ec14335a794f9cf0febb5df",
+      "path": "__tests__/cpp-free-function-overloads.test.ts"
+    },
+    {
+      "sha256": "54339a6edc019cbda5f15f8d9823eb243603744a383cf0c035cc58517ea86d04",
+      "path": "__tests__/cpp-global-alias-target.test.ts"
+    },
+    {
+      "sha256": "aa3edfc18cf8192842f658ffaacf2dd2ed3597219308d1a0548406d334d939d1",
+      "path": "__tests__/cpp-global-scope-names.test.ts"
+    },
+    {
+      "sha256": "bc38b076b54c615d8e541411e8c5b78dca76ced374674e1e4d60ec1115301510",
+      "path": "__tests__/cpp-gtest-fixture-scope.test.ts"
+    },
+    {
+      "sha256": "f44bc869d4cc3bb7d507241de472a3529f67b95fac5003a603ea0825c3177f50",
+      "path": "__tests__/cpp-implicit-this-calls.test.ts"
+    },
+    {
+      "sha256": "747943af566252b259c2e69d50e858cb7ac30c7283587d399a37b01a91bcc231",
+      "path": "__tests__/cpp-included-test-suite.test.ts"
+    },
+    {
+      "sha256": "7b9a8858a5970b63b20be020632f501fbbe6fec7d67f309484ba4a4fbed743bd",
+      "path": "__tests__/cpp-iterator-arrow.test.ts"
+    },
+    {
+      "sha256": "8417d0388a7807d7fd5a6d9497d8ea4b7ffe04e7ebef5b8ccb808097e2e16d27",
+      "path": "__tests__/cpp-library-type-receiver.test.ts"
+    },
+    {
+      "sha256": "a6b0e659def025409cdf2a2b21b4ea691c6e56103c051573fd5c5003bec77ac8",
+      "path": "__tests__/cpp-listed-declarator-receiver.test.ts"
+    },
+    {
+      "sha256": "5904b9e3cb60bd8355dd2994a3c4883d326fe936efb8b06c3648bee8f646c0d1",
+      "path": "__tests__/cpp-local-callable-calls.test.ts"
+    },
+    {
+      "sha256": "67e0b4b48efc7e239d8a7d97c8896bcf14553c0f99c6df51bdf7ffc472277452",
+      "path": "__tests__/cpp-lookup-memos.test.ts"
+    },
+    {
+      "sha256": "6368773b6938a8102f60a90e9292419c02dac7bced8e2302b688c48046ea7489",
+      "path": "__tests__/cpp-macro-and-constructor-calls.test.ts"
+    },
+    {
+      "sha256": "d4eb37eb24bcac86001b1038e536004863f9f5017a4625b0a0c8b73d52891760",
+      "path": "__tests__/cpp-macro-defined-methods.test.ts"
+    },
+    {
+      "sha256": "c113036f8fad65b86baf4d004a445b3ee4bddc0ef0d642e9d8e06edfab4dd238",
+      "path": "__tests__/cpp-macro-include-walk.test.ts"
+    },
+    {
+      "sha256": "16e99a75a38018dc857c09b23b772be68e064463a8e3417247031743c4a984df",
+      "path": "__tests__/cpp-macro-namespace.test.ts"
+    },
+    {
+      "sha256": "f5f62d8ffa2fd901b7f48843eb1c065e5b7f91e91f8758ec800f1ad684c28d72",
+      "path": "__tests__/cpp-map-iterator-calls.test.ts"
+    },
+    {
+      "sha256": "a0ecba42d2e719d9efd43ac9204b6d61b8b94a9b392a567db72bc3ceae4b0fbb",
+      "path": "__tests__/cpp-member-chain-base-members.test.ts"
+    },
+    {
+      "sha256": "d7fbe1751fb5860b666a6edebd0e3177b8978bb25df18a5debb9abacbf49bd81",
+      "path": "__tests__/cpp-member-chain-outside-calls.test.ts"
+    },
+    {
+      "sha256": "1162fb080010a73ddc62a59e0f765c0b6fca382ac86ee1bd6237cbd5047d0e80",
+      "path": "__tests__/cpp-member-chain-project-calls.test.ts"
+    },
+    {
+      "sha256": "029f52d31fe6bd38a77efed9ab1e7ff38e11e0ac29be1d63a80bd26c3a311f4c",
+      "path": "__tests__/cpp-member-receiver.test.ts"
+    },
+    {
+      "sha256": "b40c09a4712525ac52f43b7a7f3804b6755111707e699f4ad5806ddfbe8da8ef",
+      "path": "__tests__/cpp-member-template-returns.test.ts"
+    },
+    {
+      "sha256": "b627c03ab03bc06f634fe992b0884d821c14b4b2faf0fec8c323fb8a230890d0",
+      "path": "__tests__/cpp-namespace-qualifier.test.ts"
+    },
+    {
+      "sha256": "19b7b040b454388eea2697694baf888d47abad3223acc6efaf1d70ab960cd2a0",
+      "path": "__tests__/cpp-nested-template-receiver.test.ts"
+    },
+    {
+      "sha256": "cb1143c4ddebafff2a5bad34aa3841aee302d136b58be71bf67e06b81df6bc01",
+      "path": "__tests__/cpp-nullptr-deleted-overloads.test.ts"
+    },
+    {
+      "sha256": "8c5b67777fdc444315a2c3d39b98828470171f73ebc660fe9d1d56558abb1bca",
+      "path": "__tests__/cpp-operator-arrow-targets.test.ts"
+    },
+    {
+      "sha256": "86ee07e5308cf6458404c5e696f2a5534212ef9d355abb87c6eca992e67fdef2",
+      "path": "__tests__/cpp-outside-type-receiver.test.ts"
+    },
+    {
+      "sha256": "02493c380866c78e85c8ab3ebd794abeff4483a49752263b33edbe28baf5122d",
+      "path": "__tests__/cpp-overload-argument-reentry.test.ts"
+    },
+    {
+      "sha256": "bff1c904bcffbd0b97fa3b76ab382f1fe836036068c98e7e927248c4e182d7c0",
+      "path": "__tests__/cpp-overload-argument-types.test.ts"
+    },
+    {
+      "sha256": "b66d459f4197cbdae2dcde10152be656cd0c521a7f97131f3584d10bc0a79cf3",
+      "path": "__tests__/cpp-overload-choice.test.ts"
+    },
+    {
+      "sha256": "1dcaf302f38f0b002b6dd0a870ddacd5d9c42c806508780a840678b21f60dd5a",
+      "path": "__tests__/cpp-overload-constness.test.ts"
+    },
+    {
+      "sha256": "c2285f1f92dd5bdfefade1cb068eea000f1de6fe72ffafbf0322a453bce038a5",
+      "path": "__tests__/cpp-pimpl-member-chains.test.ts"
+    },
+    {
+      "sha256": "6c18ed3d0511dfffc5196cfa5d467dd39543e53abe3f679aa9293d027ee11bd1",
+      "path": "__tests__/cpp-qualified-declarator-receiver.test.ts"
+    },
+    {
+      "sha256": "dc05cf917955df284916be39a9bb138ae1916b30188fd2423b2984cf5a3a1178",
+      "path": "__tests__/cpp-range-for-receiver.test.ts"
+    },
+    {
+      "sha256": "c7414159f5d380c75b42e6ec1eea72a85a3c8a023f928f68867b7bcc5a2c0d0f",
+      "path": "__tests__/cpp-raw-string-delimiter-haserror.test.ts"
+    },
+    {
+      "sha256": "5c1e451baa31421a9e9dfacb96af500e842a2b53ab4e5276b71cd7f9f1c7195b",
+      "path": "__tests__/cpp-raw-string-preparse-1505.test.ts"
+    },
+    {
+      "sha256": "d031189faa5a163cd417a725ce806619cae7601b46c6dac6ac6d4beb119bb91e",
+      "path": "__tests__/cpp-raw-strings.test.ts"
+    },
+    {
+      "sha256": "54d9b1e771b9f2681375abd0013772839c070745055c22144c3409af1bc31f69",
+      "path": "__tests__/cpp-receiver-global-far-library.test.ts"
+    },
+    {
+      "sha256": "0cc5b669ebb5cf20fc49e64b0da278860dc5a286c098145151d1d0ff9ae3cc16",
+      "path": "__tests__/cpp-smart-pointer-receiver.test.ts"
+    },
+    {
+      "sha256": "7902740426be02e5f47e3fa0a859b1fa9b2647fd516f2c066b3e2d082ccaee80",
+      "path": "__tests__/cpp-specialization-names.test.ts"
+    },
+    {
+      "sha256": "b6b22bf54afe2671fcc6d56ec76674910ea81eedc95cd836aa9c97d6557c87a5",
+      "path": "__tests__/cpp-specialization-qualifiers.test.ts"
+    },
+    {
+      "sha256": "934ca6369382db955c75a7fbedd6391e076b646a437dc2eb1d5a71684dad199e",
+      "path": "__tests__/cpp-string-literal-declarations.test.ts"
+    },
+    {
+      "sha256": "fef26b5fb666956635277a77670cfc602674478afe3860efe24bdec0dc4bf1a2",
+      "path": "__tests__/cpp-template-member-types.test.ts"
+    },
+    {
+      "sha256": "7a13f813c537fe25791e311469677baf47a9ae457b59e894a4fd69ae4a96f5de",
+      "path": "__tests__/cpp-test-fixture-call.test.ts"
+    },
+    {
+      "sha256": "635d0ce9a05714cb4ebc76a81c378e8dcb83cb8b982d567de2c1ca35adf99380",
+      "path": "__tests__/cpp-test-translation-unit.test.ts"
+    },
+    {
+      "sha256": "0c54080c2193022693717beaf667dd427bdde5f6aed4006804c7ff9c5220b6af",
+      "path": "__tests__/cpp-translation-unit-visibility.test.ts"
+    },
+    {
+      "sha256": "28b2a0f75f4bfa26acea05b416fdfcd960cebad2a5ae8db5f24e7089b68fb26e",
+      "path": "__tests__/cpp-translation-unit.test.ts"
+    },
+    {
+      "sha256": "aebecabf8aacb79fe31c93c1589682481ec096380186f7777e199d34b2050a28",
+      "path": "__tests__/cpp-two-line-receivers.test.ts"
+    },
+    {
+      "sha256": "cb3006ede6804e01211474f1a821b3acf829df100f6fe699fac435a7bbc4daaa",
+      "path": "__tests__/cpp-type-alias-receiver.test.ts"
+    },
+    {
+      "sha256": "ea6d91667248f3d400729816e828fe97387a0cfde88950e8feed3fb9a0941884",
+      "path": "__tests__/cpp-undeclared-qualifier.test.ts"
+    },
+    {
+      "sha256": "455e633706fcfa9ee6380b4645766a746930bfb07b74d053b9986ebf485154dc",
+      "path": "__tests__/cpp-written-scope-class-names.test.ts"
+    },
+    {
+      "sha256": "a6869b95e822c56952d960effe570f0ba9f74c5b49672db8057a5adc7f35770a",
+      "path": "__tests__/cross-file-visibility.test.ts"
+    },
+    {
+      "sha256": "d1f30861c8159f0854da1b3278e36d0ebd306622050af18bf03dadeb74b4e610",
+      "path": "__tests__/cross-language-resolution.test.ts"
+    },
+    {
+      "sha256": "33bc92f01dc896ab7e074d392c66c18e5a1fff6e8007a764ddfa86787ea09546",
+      "path": "__tests__/csharp-bare-member-scope.test.ts"
+    },
+    {
+      "sha256": "47bf44502ff920d2c990950cb923699ccc8221e797983b313fab101e918bc4da",
+      "path": "__tests__/csharp-declared-receivers.test.ts"
+    },
+    {
+      "sha256": "66fadd2e49c5af84846debc772a9fb1f745c32bb539aa53521660b2e1bb54537",
+      "path": "__tests__/csharp-member-initializers.test.ts"
+    },
+    {
+      "sha256": "8b4359575315d24d2781affacaa850828d15f8798eee56dd2fcd099c68986cec",
+      "path": "__tests__/csharp-namespace-scope.test.ts"
+    },
+    {
+      "sha256": "828d28819171cf4bc2eb98466eae68a1f4192c9395de82ca0f98af6c40db6782",
+      "path": "__tests__/csharp-namespace-visibility.test.ts"
+    },
+    {
+      "sha256": "141c763bd12f1da74b1a99f7989472face988f6651d05ab470bff8c4a92303c3",
+      "path": "__tests__/csharp-property-accessors.test.ts"
+    },
+    {
+      "sha256": "e460c83eb4bc6055f7219a553de2b7fa9b698928cc15b5c68efe4ab73b3acc80",
+      "path": "__tests__/csharp-type-position-refs.test.ts"
+    },
+    {
+      "sha256": "17ece67f2a73012e83011dddc7430cfec0acfc5876f7b314c42941c995fce735",
+      "path": "__tests__/curried-wrapper-handlers.test.ts"
+    },
+    {
+      "sha256": "f2aa581dc957d315eb1af17b23c191c261dbc71068a166ecee49c3be7eb720a5",
+      "path": "__tests__/daemon-attach-log.test.ts"
+    },
+    {
+      "sha256": "c57f7d5902a45d3d521205a2d3cb45c3269dcc6f490cd9041f0639c5c5b1f75b",
+      "path": "__tests__/daemon-bind-failure.test.ts"
+    },
+    {
+      "sha256": "ace981770815b5cfbe7db1d7a8dfded144664558f3be1f423e0468518ae535c8",
+      "path": "__tests__/daemon-candidates.ts"
+    },
+    {
+      "sha256": "a738ce9327e1c7a0ac02110382e57a02ee5cd77e6259734b5706752d8b4e227b",
+      "path": "__tests__/daemon-client-liveness.test.ts"
+    },
+    {
+      "sha256": "4333e6cf9621b5e404b2467970edf9f7735e5690775a367c2c31308abf6dd4bf",
+      "path": "__tests__/daemon-install-check.test.ts"
+    },
+    {
+      "sha256": "79730612a812733014cc2466efebab394fdc53eef782c724a76884a668e3d655",
+      "path": "__tests__/daemon-lock-holder.test.ts"
+    },
+    {
+      "sha256": "624e79ff078a952bd5b868fdea3d41ecc91a29f4c344132ef7f981ba10ca1668",
+      "path": "__tests__/daemon-lock-refresh.test.ts"
+    },
+    {
+      "sha256": "3c0578a566692c53c3f906d93119bbf575f9325be1286d758a7dcd9363f1851c",
+      "path": "__tests__/daemon-manager.test.ts"
+    },
+    {
+      "sha256": "94905e78f27b79e7c975934e8c075be039da311c03d305514cd45419686d2abb",
+      "path": "__tests__/daemon-older-version.test.ts"
+    },
+    {
+      "sha256": "a515fb0e67c06ad090b1e972c2843f9eb39edc54b6048f762af2cec61eb52e47",
+      "path": "__tests__/daemon-pid-reuse.test.ts"
+    },
+    {
+      "sha256": "84fad9e54209b764f0e6941b02ba7c3765495f92c2170c39b333e28f8d79ea5f",
+      "path": "__tests__/daemon-registry.test.ts"
+    },
+    {
+      "sha256": "3b4d52e7c8320d9a4ed4d2252296f8ffb78a09e203b01c2bffff757af371ccdd",
+      "path": "__tests__/daemon-rendezvous-case.test.ts"
+    },
+    {
+      "sha256": "5025b530bdbf71d88039531b0a811031093507c80693f26f4819f606b05b7b0c",
+      "path": "__tests__/daemon-silent-holder.test.ts"
+    },
+    {
+      "sha256": "cd62f9dff31302a0a4ede41be295e0ee0a9b636764838ccc6da1f7e5ec8a01c6",
+      "path": "__tests__/daemon-socket-fallback.test.ts"
+    },
+    {
+      "sha256": "a30b701764b4318368d88593c5d173bdf913567a1af9434aa645f162c4b8a377",
+      "path": "__tests__/dart-annotated-member-docs.test.ts"
+    },
+    {
+      "sha256": "0f6439c622f62aa9cf23f1094527eda42c7044723a6bb190222fa1eb34a85c10",
+      "path": "__tests__/dart-annotation-comments.test.ts"
+    },
+    {
+      "sha256": "2f557e41e0ab46ef39184a67ac3a6161131fce449e7e7d8ef46da89303346c31",
+      "path": "__tests__/dart-annotation-targets.test.ts"
+    },
+    {
+      "sha256": "5e7e1e903a38afdcbf55c8bd9f7d0a7edb2ef27686290fc4d8d497ab36361709",
+      "path": "__tests__/dart-bare-call-scope.test.ts"
+    },
+    {
+      "sha256": "d33a5475b46eeee52b99e1b16c9e0f5edfed1acc4dbb3bd404a5d8d7ed08a14b",
+      "path": "__tests__/dart-bodiless-member-docs.test.ts"
+    },
+    {
+      "sha256": "6db92318a2dbd547cd12b869ceacef57a73f94860274fac7fa899ff846a2f2b6",
+      "path": "__tests__/dart-chain-links.test.ts"
+    },
+    {
+      "sha256": "875c079a6e5b0f1a16dc9db56a5137dffc0d40d87543f5b2a3bf58220e2df457",
+      "path": "__tests__/dart-comment-split-chains.test.ts"
+    },
+    {
+      "sha256": "0a1da3879412dd6088ad247548a0aabff802283c1a8f99a4ed08c9ce932c325a",
+      "path": "__tests__/dart-const-constructors.test.ts"
+    },
+    {
+      "sha256": "4bd4f480cdc41804df8f55656bdf4d0d73342d6c3b76b13dff55c52e300a5a3c",
+      "path": "__tests__/dart-extension-receiver.test.ts"
+    },
+    {
+      "sha256": "491fe76dc13be7a41c4e382b35e86af0b03b190405e78a76eb3f46b4741e0cfc",
+      "path": "__tests__/dart-extension-type.test.ts"
+    },
+    {
+      "sha256": "74cfd72c784411a93537087eb9e14d1f4bb97b378441c55cf910d48f4642a68d",
+      "path": "__tests__/dart-generic-calls.test.ts"
+    },
+    {
+      "sha256": "4a4ee71d6ecc89ee8cd1878ffc2582f0f12307ea24921bca1ea65af0e558802e",
+      "path": "__tests__/dart-generic-factory-chain.test.ts"
+    },
+    {
+      "sha256": "ef4a4a132a8ce655d7f147832458fa0453cf7b2f25f4d9adcbacd0923844cb35",
+      "path": "__tests__/dart-getter-reads.test.ts"
+    },
+    {
+      "sha256": "85c7726b96f9097fb22820eeec4d6f12cc714efbf57c93ae36432e273b72aaf0",
+      "path": "__tests__/dart-import-prefix-calls.test.ts"
+    },
+    {
+      "sha256": "04e028fc716d541ed9f7ac1ca25f0e1a22a36dfee4bec6d43f9f4ddc9c3bbf46",
+      "path": "__tests__/dart-import-uris.test.ts"
+    },
+    {
+      "sha256": "5306c76327665c45a0c13f2d9c4700aac078d8f5619ea6a53a4690ca747704e8",
+      "path": "__tests__/dart-initializer-calls.test.ts"
+    },
+    {
+      "sha256": "389565843061be7104fd93784116ca1430aaade4ab3aea8da6d4311f7e8fdca4",
+      "path": "__tests__/dart-library-visibility.test.ts"
+    },
+    {
+      "sha256": "a09847262e67c9dc9cd1494efe1dee99a98f5bb918578b357fbc2c8aba3f8a0f",
+      "path": "__tests__/dart-local-call-scope.test.ts"
+    },
+    {
+      "sha256": "71b56f85367fb3da8b6fa8e5f22eb60e6ebda2dcd850a3bbfbb60563cd33907d",
+      "path": "__tests__/dart-part-directives.test.ts"
+    },
+    {
+      "sha256": "70d61332f914281cd7a14a0c492ab6703c905dde259b2e7075df8b282033f9d2",
+      "path": "__tests__/dart-part-privacy.test.ts"
+    },
+    {
+      "sha256": "d52a8531a93e8f8a3ba1df295db93d2de4f4cc28fc2210350f1099bd59e83b91",
+      "path": "__tests__/dart-type-positions.test.ts"
+    },
+    {
+      "sha256": "47bc2e1ef2ac0980c6a0a69374c78dbf696a246d677fd400d3e8d9e09cfce176",
+      "path": "__tests__/dart-typedef-refs.test.ts"
+    },
+    {
+      "sha256": "c93406a5fe0921fa661c24dd8274bdd7da35cc6f6b0e1b562eda7962772b5369",
+      "path": "__tests__/dart-unnamed-extension.test.ts"
+    },
+    {
+      "sha256": "c85f637925327d6d7e9882e6368c588adfdd2e84f6d637fc77707eb3cf0cff58",
+      "path": "__tests__/db-perf.test.ts"
+    },
+    {
+      "sha256": "d4c46e34baa7bf956647306f352c3d3c724f1108a50b2e18d06b410f2f13b893",
+      "path": "__tests__/db-reopen-on-replace.test.ts"
+    },
+    {
+      "sha256": "c7aca6804971862723daf9353e489a15597d861dc96a768f7c3b557b1bd357e3",
+      "path": "__tests__/dead-code.test.ts"
+    },
+    {
+      "sha256": "5e529bda48cf3259123530dfd3d9f634f69a3ed470e4c7bb82dc944680bc35fb",
+      "path": "__tests__/declared-member-receiver.test.ts"
+    },
+    {
+      "sha256": "8e0ae2b4dd16724fd245fdb205b4fa1ebf27d837f3fa3ce2d246cdd905f77777",
+      "path": "__tests__/default-export-declaration.test.ts"
+    },
+    {
+      "sha256": "3cab44e34b6c2a15f2599549462b5ed3e08233d5137db5f49d32264fa41fdf7d",
+      "path": "__tests__/deprioritize-config.test.ts"
+    },
+    {
+      "sha256": "672bc7c43ae35fe6347180878f7e87335cd1dfa51402733511f4969e1ab92f51",
+      "path": "__tests__/destructured-call-result.test.ts"
+    },
+    {
+      "sha256": "6d7dff706bf729e0001165d1a3cac074731b64872f357b8ea7aa4c41ec0220c2",
+      "path": "__tests__/dominant-file-cache.test.ts"
+    },
+    {
+      "sha256": "08c5a98e8cad5e3c99b2e2df9d51fb3c6f8be8bafa3785a7fd3423041a9b5851",
+      "path": "__tests__/dominant-file-plan.test.ts"
+    },
+    {
+      "sha256": "754c0cfd8be6247c280136ae9080ee266e890dc53f95b7690e9e83725d3280f1",
+      "path": "__tests__/dominant-file-window.test.ts"
+    },
+    {
+      "sha256": "ed3b876da425971b339d49d75a56ced19ad1648b5ec1dd07425d9146f72009b0",
+      "path": "__tests__/dotdot-folder-names.test.ts"
+    },
+    {
+      "sha256": "9b1b3717e3182993384a326f6acdc64434f0e723a562e08954112cbc1eb8dbba",
+      "path": "__tests__/drupal-services.test.ts"
+    },
+    {
+      "sha256": "190bca1bebcfeb374b874440e9c10dd68e0ec3145408cccaa3376511e4a1ef40",
+      "path": "__tests__/drupal.test.ts"
+    },
+    {
+      "sha256": "fa4c220641522cab042bf79e8fae11245916e066fa36f26b906983d5152c7ab7",
+      "path": "__tests__/dynamic-boundaries.test.ts"
+    },
+    {
+      "sha256": "c02c363962df7b12e2ce02bba65a6586a9731dc512208ac596bdad0af43fd09d",
+      "path": "__tests__/dynamic-import-binding.test.ts"
+    },
+    {
+      "sha256": "a919f2fccc16904d99a2659b127938bbe34a55b4b857f21443c7e3e989a92246",
+      "path": "__tests__/enclosing-class-member-call.test.ts"
+    },
+    {
+      "sha256": "dc29b4daba2bae8ae181d41765dd7989376eeffc56dea79a723fff039c61d0cf",
+      "path": "__tests__/enum-constant-bodies.test.ts"
+    },
+    {
+      "sha256": "87c60fabced6175fa937c12c63d9d9a93c6ac343c88cbb1a23f7b55a03d71aae",
+      "path": "__tests__/erlang-arity-resolution.test.ts"
+    },
+    {
+      "sha256": "01bdb790e532602b98aadc854231000d3e14bc10b2cf41d39af91265964f1c07",
+      "path": "__tests__/erlang-behaviour-synthesizer.test.ts"
+    },
+    {
+      "sha256": "75bc4f90fc23cb7d6ba977b8b2fd3d3b2d0464c558c821c59b5fe67221858d8c",
+      "path": "__tests__/esm-unexported-binding.test.ts"
+    },
+    {
+      "sha256": "ca59600f26be1a671dfe0fd331ea0907af65251e8571e8f899cda54c4f7b3833",
+      "path": "__tests__/evaluation/runner.ts"
+    },
+    {
+      "sha256": "87e2485380968bef4c135b0acac5f6e2547b48fe49e96c6a0a1862b2bbad6251",
+      "path": "__tests__/evaluation/scoring.ts"
+    },
+    {
+      "sha256": "f4a8f75e5db2d2f14b736e5139ad3180f4b33d32ba9ef4cea55de15600004f2a",
+      "path": "__tests__/evaluation/test-cases.ts"
+    },
+    {
+      "sha256": "19051cb0ce49307005718d188dbdab2d101fffdfc33a988d475b102e4e0eee14",
+      "path": "__tests__/evaluation/types.ts"
+    },
+    {
+      "sha256": "46574fc0e42da50841cc491c0382957690f3a452e58527e31dc980690371c8a0",
+      "path": "__tests__/exact-name-binding.test.ts"
+    },
+    {
+      "sha256": "c7e7d903e1c206eaf2494d2a17d5b127ba4ba3b2b8993eeee97591b14a0abe70",
+      "path": "__tests__/exclude-config.test.ts"
+    },
+    {
+      "sha256": "b91a7a07f38352826e2f3579735ec12be328aaf97fc1b437d14eef2b54b98b90",
+      "path": "__tests__/explore-allocation-1500.test.ts"
+    },
+    {
+      "sha256": "d5141e558da8f5f4b091be3297cc95c02a94fd94dee7f6b29601066363f45266",
+      "path": "__tests__/explore-allocation-e2e.test.ts"
+    },
+    {
+      "sha256": "8097e10bb9bb466da42c0423b143f3e9062f93493f959f885c0be290c37430c8",
+      "path": "__tests__/explore-blast-radius.test.ts"
+    },
+    {
+      "sha256": "ca40cb36ca8bf77ed1fbf04e327062ba14261645f23dc4c6ac71517caab263b7",
+      "path": "__tests__/explore-cluster-starvation.test.ts"
+    },
+    {
+      "sha256": "648f2173fe5a523a410d05d79a0b0b516d2272c9d82f0ded7ac8c7cf80641671",
+      "path": "__tests__/explore-cobol-copybook.test.ts"
+    },
+    {
+      "sha256": "4673ce2f9feb9d5ccf4f394b0f76077385a4082580a67997ac6ceb635ff8c77b",
+      "path": "__tests__/explore-completeness-note.test.ts"
+    },
+    {
+      "sha256": "1c62b5a7a33fb8e0789af58e2be961811d0f2b992e22eb60f3fc08e2c708ed09",
+      "path": "__tests__/explore-corroboration-ranking.test.ts"
+    },
+    {
+      "sha256": "b78bf185dda86e87b9295c7a65cbdae568b3f1f162689dc4428eb72b6cb6b9f8",
+      "path": "__tests__/explore-cross-call-dedup.test.ts"
+    },
+    {
+      "sha256": "be1c9558eddd49f32b2fe1c37ee28a24f364943b401ace18c2e7a9079965569e",
+      "path": "__tests__/explore-declaration-only.test.ts"
+    },
+    {
+      "sha256": "4da6fcac0b441afc81b83cc143425b4ac5766fadfcb414db11c883090a746655",
+      "path": "__tests__/explore-diagnostics.test.ts"
+    },
+    {
+      "sha256": "21bd00b35eb3b5377c35b9b6cc970bd7ae72c8a2645a6307bb1a0f440c2e6e5c",
+      "path": "__tests__/explore-displacement-guard.test.ts"
+    },
+    {
+      "sha256": "e4af226f7dc9c6b4655b1b1a9146fed50c0dab13200c1548548236755d12f9b1",
+      "path": "__tests__/explore-elided-symbol-names.test.ts"
+    },
+    {
+      "sha256": "a31b32a267e1aea908e6fda63c42d7f85e9192a15c0263791934484249421acc",
+      "path": "__tests__/explore-empty-diagnostics.test.ts"
+    },
+    {
+      "sha256": "dee8692912e053a1c8deae8b977633fc9b3881aeb44d086e7f3b8167c4e1acda",
+      "path": "__tests__/explore-exact-target.test.ts"
+    },
+    {
+      "sha256": "990a3300ebc15a780cce68a553a49f27e6ff65be950c3857f657ad592e218e9e",
+      "path": "__tests__/explore-factory-closure.test.ts"
+    },
+    {
+      "sha256": "69b5990c661f8afb9df06a7404ec4dc652da5c53f5feb2a1ab516df0d4eec0f5",
+      "path": "__tests__/explore-isolated-named-cluster.test.ts"
+    },
+    {
+      "sha256": "f35af7cf61bd57fbe14118a6a254821cdbfe183d7ad38147eba30db64d5c6674",
+      "path": "__tests__/explore-long-query.test.ts"
+    },
+    {
+      "sha256": "8346985fb7134e8a16a7c238a264f2a9e162effea1ac9fc36faaca8b895ff506",
+      "path": "__tests__/explore-low-value-tests.test.ts"
+    },
+    {
+      "sha256": "2c387a2fd5cef93c4013a599841c43393bf438e8a4cca2854b5cb660a03cb1e6",
+      "path": "__tests__/explore-merged-spine-cluster.test.ts"
+    },
+    {
+      "sha256": "0479e6e18644ccf6ed535588a7d6e5c053977b26308604f8f3e9186ece29b6d7",
+      "path": "__tests__/explore-named-file-valve.test.ts"
+    },
+    {
+      "sha256": "96e50aaadc8d3931f7d0fc6430f0067b162de20d34c04ae67299c8b9f110ac6a",
+      "path": "__tests__/explore-named-gap-budget.test.ts"
+    },
+    {
+      "sha256": "825848993ede458d30a956b3588e5676e2a7541a8d2c7f602c30dc4c2c44cab9",
+      "path": "__tests__/explore-named-symbol-render.test.ts"
+    },
+    {
+      "sha256": "f31b637cfc11818bc2aa9e1a18b6c8430835536cc79bc53e13bb66675b036acc",
+      "path": "__tests__/explore-nl-stopword-collision.test.ts"
+    },
+    {
+      "sha256": "02ba07c780917a6c86b5590eade5abddda2aa9b8fc5abe9969a2bb4528f76b65",
+      "path": "__tests__/explore-output-budget.test.ts"
+    },
+    {
+      "sha256": "2f6d82075f624376ff5bac26340f8d30bc0d93faa223ed61de7905a043be3b73",
+      "path": "__tests__/explore-oversize-member.test.ts"
+    },
+    {
+      "sha256": "e692106100dc2eaabc607f372c02f986b87a3736481e15d5d6de519a8d55df91",
+      "path": "__tests__/explore-path-pinning.test.ts"
+    },
+    {
+      "sha256": "b5540c2ba883b5ab926cd4d6b25fc7ef072a7ed45a30444f5ea0cc4c38ef28d8",
+      "path": "__tests__/explore-pinned-allocation.test.ts"
+    },
+    {
+      "sha256": "48cfde0cede3dd7619c2460a84132a7418eb0eb300fda49135cdfc555c45aa23",
+      "path": "__tests__/explore-pinned-cap-named.test.ts"
+    },
+    {
+      "sha256": "b91d8a5294872bc8ca908cdc46bf9d02f375c3c78f945f7b690594b6551ac69d",
+      "path": "__tests__/explore-proportional-allocation.test.ts"
+    },
+    {
+      "sha256": "ac565990d4bb7b65d08255fb236686d52a955502915d2d5165a51826e208e3db",
+      "path": "__tests__/explore-queried-oversize-symbol.test.ts"
+    },
+    {
+      "sha256": "0dad9c587bb8f3def381a2acd45619bc86b26033e27a7e0a3132c1535e8c43d0",
+      "path": "__tests__/explore-relevance-scoring.test.ts"
+    },
+    {
+      "sha256": "eaf24c190d1caae4ad9f406344e09ff60f5f78a8a884243410c72800430a890e",
+      "path": "__tests__/explore-reservation-invariant.test.ts"
+    },
+    {
+      "sha256": "982f9905cd8cfaecba70702f1281436d5f97c430512ff10f5032917a733a1310",
+      "path": "__tests__/explore-result-count.test.ts"
+    },
+    {
+      "sha256": "bf627256e9db319a3c0a5234b16cfe367bab5be49e2e5ec9c8c9049133899941",
+      "path": "__tests__/explore-same-basename-pin.test.ts"
+    },
+    {
+      "sha256": "cf6861d63ff8c9900b7aeb96cc60b92188eb6d572dcaff8a30d070393a74b7c3",
+      "path": "__tests__/explore-session-state.test.ts"
+    },
+    {
+      "sha256": "9a140e37967f4c7866e45b6942c09ea9ff7d6c6a9d36c765f9cfce5bc1b88d89",
+      "path": "__tests__/explore-synth-constant-endpoints.test.ts"
+    },
+    {
+      "sha256": "75a1d0f6808d56fc7e0d8e0d80366a14e55f4f520b21ab6848f6bcbb5e42e4b5",
+      "path": "__tests__/explore-synth-link-endpoints.test.ts"
+    },
+    {
+      "sha256": "3997b7c559ef1ce223366d6d06e5b48e85642dce63611ae470ba2518243d5856",
+      "path": "__tests__/explore-unindexed-names.test.ts"
+    },
+    {
+      "sha256": "2bbe68dbb671f498b1d7e9f13b45f8669caea3c93da2b003abec57d57e7b925f",
+      "path": "__tests__/expo-modules.test.ts"
+    },
+    {
+      "sha256": "f996bb63922efd8c1b01cc0196a70045f03e799c32c46e31cb2e7aee7ef89776",
+      "path": "__tests__/expo-router.test.ts"
+    },
+    {
+      "sha256": "18909208f1d7dfe30bf1338b0f3bd98f4f645a721cee3e25a0fdeb95700f49a2",
+      "path": "__tests__/express-heuristic-same-file.test.ts"
+    },
+    {
+      "sha256": "b8e1179756ebb5758160ee5a746c9800b471d90f915fd811bcf137c4bdaa4328",
+      "path": "__tests__/express-inline-function-handler.test.ts"
+    },
+    {
+      "sha256": "32d4e18d86cf29050c3778053427d32d2235c7009dd83145dabe70e3f8ab0e5e",
+      "path": "__tests__/expression-receiver-calls.test.ts"
+    },
+    {
+      "sha256": "4a06a5d1c577c26946b17e4a1b5ef7b4b7923f904f8f8e236dd37cbea2ccdd35",
+      "path": "__tests__/extension-mapping.test.ts"
+    },
+    {
+      "sha256": "6f549388870f81a9efaceae88bf13a88230d0c1210fbb5c8947f23fabc0abd26",
+      "path": "__tests__/external-declared-receiver.test.ts"
+    },
+    {
+      "sha256": "a88a75ec6dd38d3fe85df5aaf1beeb371ff96d64173841d2ed2ceae277120447",
+      "path": "__tests__/external-type-receiver.test.ts"
+    },
+    {
+      "sha256": "525abe27de1d221021479286f9132abb0d20d62a0b33eb8a9ba62d2fe22547ec",
+      "path": "__tests__/extraction-old-git.test.ts"
+    },
+    {
+      "sha256": "5b5666a125fdd4f55cee80437babfc06c8ad76373df22c954183d54c6e387352",
+      "path": "__tests__/extraction.test.ts"
+    },
+    {
+      "sha256": "266331becbb9c1521bf2709fe641b1208080e0e53e7c2014fe983e1616d84bea",
+      "path": "__tests__/fabric-view.test.ts"
+    },
+    {
+      "sha256": "583cf8e4ff04632badf0e8b6766112eaffe02add3a3128625c77e03e5ddd76be",
+      "path": "__tests__/fastendpoints-routes.test.ts"
+    },
+    {
+      "sha256": "2091c67a05175ebb341423cf31a08ae6a9259cb78c02ee2a071bae537a1fc438",
+      "path": "__tests__/fatal-handler.test.ts"
+    },
+    {
+      "sha256": "6b7c9642362718ee91e2fb3052fb88a57c5eac9eb084cef013ceda20956ff505",
+      "path": "__tests__/field-channel-scope.test.ts"
+    },
+    {
+      "sha256": "10eeafd7d449cc5e03148803759cb6802bc85bde8d77158b55bbd40e1f0b158b",
+      "path": "__tests__/field-name-retrieval.test.ts"
+    },
+    {
+      "sha256": "9eeb60c43a04fbe157973813de64cbe4987d0cf7b9893266a1647d3d89945bef",
+      "path": "__tests__/file-cycles.test.ts"
+    },
+    {
+      "sha256": "e938f0d97cdb8f76d8839b1f29e27f498e7b426a7e35b31359829d9aa3540719",
+      "path": "__tests__/file-routed-page-component.test.ts"
+    },
+    {
+      "sha256": "518bfd9165f23b664af814a326f7bc4f59777b1c77364ff9992c91146b87d6be",
+      "path": "__tests__/filelock-stale-takeover.test.ts"
+    },
+    {
+      "sha256": "e085362156a4a1703e6d278eef1418995dfeb72c3f7939632b74ca8023d81274",
+      "path": "__tests__/fixtures/ambient-decls-ts/package.json"
+    },
+    {
+      "sha256": "0996ed3828cc01e3d9665ad8a0d0355a28282f2c4de2aba9271f53429ba0ab7f",
+      "path": "__tests__/fixtures/ambient-decls-ts/src/lib/bucket.ts"
+    },
+    {
+      "sha256": "d080ddacb82adb394badb021921fd89607b9335010b452dcd720acbce29c189e",
+      "path": "__tests__/fixtures/ambient-decls-ts/src/lib/queue.ts"
+    },
+    {
+      "sha256": "6477f0bcb8027a25fb1b41a294996ad9d3d214f7d91ee1f576d53d0fabead70d",
+      "path": "__tests__/fixtures/ambient-decls-ts/src/lib/request.ts"
+    },
+    {
+      "sha256": "8fe184a61d0d1be016a494c8b6f04e30c25d877c6ac263fb41bf4f2ff7f46191",
+      "path": "__tests__/fixtures/ambient-decls-ts/src/routes/upload.ts"
+    },
+    {
+      "sha256": "14bacde03a4728065bfe6d2481199f9b59ef8b19c082f4cc6d7731b64b04dfd5",
+      "path": "__tests__/fixtures/ambient-decls-ts/src/storage/metadata.ts"
+    },
+    {
+      "sha256": "5fca3cb503fa6b7c79cd4d03a390dc92be8562f28180d3550e7b6fe643c70368",
+      "path": "__tests__/fixtures/ambient-decls-ts/src/storage/stream.ts"
+    },
+    {
+      "sha256": "f11f12e1ce257249ed2a18ac381f45922f97e4da8cf6cc3e2ca25c232893e8ed",
+      "path": "__tests__/fixtures/ambient-decls-ts/src/storage/types.ts"
+    },
+    {
+      "sha256": "13e45572bab67a3c1b88f99bfbcaa97d4f7d04006420c493af0734d63b83ee83",
+      "path": "__tests__/fixtures/ambient-decls-ts/types/platform-shims.d.ts"
+    },
+    {
+      "sha256": "ebdaa170093e083d7670dfd51a80f873d77b0f11883bb06bece6e9c6d0f6065b",
+      "path": "__tests__/fixtures/ambient-decls-ts/types/worker-configuration.d.ts"
+    },
+    {
+      "sha256": "bcb7ac47fcee48b65000b923e5d3953f11f0d9e60429ce84ebe43f741a060bf9",
+      "path": "__tests__/fixtures/commonjs-value-cases.ts"
+    },
+    {
+      "sha256": "636353e9fdd9557a6a0601311593461fd2c86df6d3a873404704514165ce134b",
+      "path": "__tests__/fixtures/dense-header-ts/package.json"
+    },
+    {
+      "sha256": "f7858fc0e818604d40370bdb351a6050ee0a51897b7520f0428145252e11f1c4",
+      "path": "__tests__/fixtures/dense-header-ts/src/core/queue.ts"
+    },
+    {
+      "sha256": "4ce38e384d34b62e6ec7845ca6c3420bcf35094ff31f78ce7ddb7521625a2df8",
+      "path": "__tests__/fixtures/dense-header-ts/src/core/request-builder.ts"
+    },
+    {
+      "sha256": "c6228ea0d8185df2c4dba40881ca75754bafaae9dd94cb9bb4d6684dfc0739c7",
+      "path": "__tests__/fixtures/dense-header-ts/src/core/task-factory.ts"
+    },
+    {
+      "sha256": "57d44d11b60cc58f77b8d08f7fa1f0b22626fe8cea15cf2e16e274fbf368d3f0",
+      "path": "__tests__/fixtures/dense-header-ts/src/core/types.ts"
+    },
+    {
+      "sha256": "36599f2419d001e4814d7cd66dd189bdae21bf6ba2b1b0c00218405c8f9114e0",
+      "path": "__tests__/fixtures/dense-header-ts/src/index.ts"
+    },
+    {
+      "sha256": "437447cdc65445b4f19dd58f8e94e05e9ee148af8269726f33ccdd5f5281ef9a",
+      "path": "__tests__/fixtures/dense-header-ts/src/net/session.ts"
+    },
+    {
+      "sha256": "7c7d7b0516095acdaa95944facd4703c1c130faa25b7bb22f69706cb5feadf72",
+      "path": "__tests__/fixtures/displacement-ts/package.json"
+    },
+    {
+      "sha256": "c26e949c6d374bf9d1fcf2e72f5c41634ae7e01a35312800f399530b9411ff02",
+      "path": "__tests__/fixtures/displacement-ts/src/index.ts"
+    },
+    {
+      "sha256": "9702cb56c1a6beb84d85f06be016e2eba6149c86d2d61a18c72acd02cc6015b5",
+      "path": "__tests__/fixtures/displacement-ts/src/pipeline/enrich.ts"
+    },
+    {
+      "sha256": "b2876a044181a2525d8957bd86c5a9f4fcc04a5fcbf2f86c55364b3919f01133",
+      "path": "__tests__/fixtures/displacement-ts/src/pipeline/ingest.ts"
+    },
+    {
+      "sha256": "c0a4619746a2515a9c0c0ad0a7d8e6167415e62bf8009729c903ff85f3c78313",
+      "path": "__tests__/fixtures/displacement-ts/src/pipeline/normalize.ts"
+    },
+    {
+      "sha256": "76a39f6b01d0d4541e774529ad2540afff874385e0dd9515a94bea857b2313d7",
+      "path": "__tests__/fixtures/displacement-ts/src/pipeline/publish.ts"
+    },
+    {
+      "sha256": "26b7cf8874651db6fbe4c3aabe1d5d985b31fc30f61905b4c1c4db5197070b27",
+      "path": "__tests__/fixtures/displacement-ts/src/pipeline/sink.ts"
+    },
+    {
+      "sha256": "f38776cf83a69e50cafcf839c8c1cb8a462d3580006e561eb1d51514577be63e",
+      "path": "__tests__/fixtures/displacement-ts/src/pipeline/types.ts"
+    },
+    {
+      "sha256": "cdbbf355639d452868058cc48cf84b86edd5893dbc2dea7ae033c85066f3ee46",
+      "path": "__tests__/fixtures/explore-path-pinning/package.json"
+    },
+    {
+      "sha256": "f5168c44b89b27e6afc6e86142fbe631e76d60dd410c376dab7326c167a3a0ea",
+      "path": "__tests__/fixtures/explore-path-pinning/src/lib/background-image-table.ts"
+    },
+    {
+      "sha256": "e6f43c001af263bb229bdb317a5b874b5b84f8d805be63a22f9b6284d22a2bf9",
+      "path": "__tests__/fixtures/explore-path-pinning/src/lib/background-store.ts"
+    },
+    {
+      "sha256": "abd9a7e30c88b3a508b086023e831de1a2d060cbd99e6cda0a82e4e3817169dc",
+      "path": "__tests__/fixtures/explore-path-pinning/src/lib/runs-store.ts"
+    },
+    {
+      "sha256": "8475319ca73f16fd2f857a608c5727cd72dddbe07a03745cf5266f00ef465a44",
+      "path": "__tests__/fixtures/explore-path-pinning/src/routes/(protected)/chat-window/+page.ts"
+    },
+    {
+      "sha256": "727dc7f9e44a8a1fc0ee01c1550f48636f31c3a180b5da45afcc3e058df3483f",
+      "path": "__tests__/fixtures/explore-path-pinning/src/routes/m/projects/[id]/runs/[runId]/+page.ts"
+    },
+    {
+      "sha256": "4ecae5ad54878a42c1afa283afb7d3b1229b3e7e871a262c9ee076b523715313",
+      "path": "__tests__/fixtures/factory-closure-ts/package.json"
+    },
+    {
+      "sha256": "90996569471bf91b29e3584c89d72e669657fb126d4b02eefab2b9e57a7fbf8a",
+      "path": "__tests__/fixtures/factory-closure-ts/src/index.ts"
+    },
+    {
+      "sha256": "ffcb23d50a75766a7b454231fdd517886e88da11b9ff3e35dcedda44b9928261",
+      "path": "__tests__/fixtures/factory-closure-ts/src/lib/http.ts"
+    },
+    {
+      "sha256": "e14e91834157bb662c259b7be5c4fe7c3c98bafbb4209392ec57d7c251a72d8c",
+      "path": "__tests__/fixtures/factory-closure-ts/src/lib/metrics.ts"
+    },
+    {
+      "sha256": "cdea26dda795eaf057c7cfbc3e766d968a7f247e03fbb9ffd223a98fdf9102c5",
+      "path": "__tests__/fixtures/factory-closure-ts/src/services/filter-parser.ts"
+    },
+    {
+      "sha256": "b54256232bc21010c23d8c2f22a4e23f000ea464873266e44facd4f3ebad7f53",
+      "path": "__tests__/fixtures/factory-closure-ts/src/services/metric-service.ts"
+    },
+    {
+      "sha256": "2c178614fd412380d396b2c01505e57954d36723f1c7b8e71ef3806c793acd65",
+      "path": "__tests__/fixtures/factory-closure-ts/src/stores/alerts-store.ts"
+    },
+    {
+      "sha256": "f69d8218257ebc3ffaec3e712b92d1c91a06901cf92f12cd2165811582c1535a",
+      "path": "__tests__/fixtures/factory-closure-ts/src/stores/dashboard-store.ts"
+    },
+    {
+      "sha256": "f08b3b3acb9217f0fbd5d48c19cdea60ee8da60806bb53f7e43cdbf2ab5d6adb",
+      "path": "__tests__/fixtures/factory-closure-ts/src/stores/session-store.ts"
+    },
+    {
+      "sha256": "48662c8752dff79f1b3566a974dca6fe49b4c8d47ce133b62bad85f71f6496f0",
+      "path": "__tests__/fixtures/factory-closure-ts/src/stores/types.ts"
+    },
+    {
+      "sha256": "b51f5563a964d280b60954fac20ad03ace0550def3f2e36b892b94111ec59627",
+      "path": "__tests__/fixtures/factory-closure-ts/src/ui/panel.ts"
+    },
+    {
+      "sha256": "4bbb13079db6ba11dde99fae92956a03ef163bf9476bfc7b089c58d460417622",
+      "path": "__tests__/fixtures/filelock-contender.cjs"
+    },
+    {
+      "sha256": "6fecf09e403bd9d3b5f3e584439922886075a543fe284e19ca1b72755da321ae",
+      "path": "__tests__/fixtures/kernel-parity/ScalaCompanions.scala"
+    },
+    {
+      "sha256": "178f3e57cabe581d4f435088657d6b49360266b1f0ee9109aa57102f6ffda9be",
+      "path": "__tests__/fixtures/kernel-parity/Torture.cs"
+    },
+    {
+      "sha256": "3f2f4de2c7d624218d6127c673f922bd65db3d93ef617c3edb944f810f526479",
+      "path": "__tests__/fixtures/kernel-parity/Torture.java"
+    },
+    {
+      "sha256": "9762a74506a3b487efad10ac80f5de22b25115410e3d44c84b35b89ff7626ed2",
+      "path": "__tests__/fixtures/kernel-parity/TortureAnnotatedComments.dart"
+    },
+    {
+      "sha256": "b9f78fe5c5e0762765e968465dcd9fedb96d579212cc72e4b4901dded93cb64a",
+      "path": "__tests__/fixtures/kernel-parity/TortureAnnotatedDocs.dart"
+    },
+    {
+      "sha256": "b690da7109a0b4821627cd3daf52b8b15c817be50850df45a9942a116b9aebf5",
+      "path": "__tests__/fixtures/kernel-parity/TortureCommentChains.dart"
+    },
+    {
+      "sha256": "0eefc9f6febefd98a2b56cda21cb3c44e73563b3bade7884e7b2eb3a96158a2c",
+      "path": "__tests__/fixtures/kernel-parity/TortureConstCtors.dart"
+    },
+    {
+      "sha256": "e4c2168f93769a8324c908227ef8e3a1ddacc03d04d6c48d8efb140d6c9bf6e3",
+      "path": "__tests__/fixtures/kernel-parity/TortureCtors.dart"
+    },
+    {
+      "sha256": "0ef572243e86d1bd6452f5b8453c5e6dcfc46e564702c932873391bbcefe1904",
+      "path": "__tests__/fixtures/kernel-parity/TortureDeclarationDocs.dart"
+    },
+    {
+      "sha256": "776cf046bef48375447b3a15af247bf870987fc2084e9b019a39685e51365579",
+      "path": "__tests__/fixtures/kernel-parity/TortureDirectives.dart"
+    },
+    {
+      "sha256": "0a2bde78c9b2d778db78008bec17ab82f294f2bd78eaa2119e0e25e9c89d1d9c",
+      "path": "__tests__/fixtures/kernel-parity/TortureDocs.scala"
+    },
+    {
+      "sha256": "9d0f3fa6e25fb466efe03039a315a9de4c4dd33f9b5cfa2b8b90f94eafdda366",
+      "path": "__tests__/fixtures/kernel-parity/TortureDoubleWalk.dart"
+    },
+    {
+      "sha256": "962dc86ddc36909194d9a495de9e7f25e6649cf9c14a6b2d83db9d26b514898b",
+      "path": "__tests__/fixtures/kernel-parity/TortureExt.scala"
+    },
+    {
+      "sha256": "71fe438eb99e98fb7cf9f47f00ffb51069ed0510f4b69d547baa589b90ff73c5",
+      "path": "__tests__/fixtures/kernel-parity/TortureFileScoped.cs"
+    },
+    {
+      "sha256": "dd0a58e4cdb5aba926ae041f32cbbc9e74ea4f6828f02535f983b4c402a624b5",
+      "path": "__tests__/fixtures/kernel-parity/TortureFnref.scala"
+    },
+    {
+      "sha256": "f8b9f39f90476ae7944173b3d917e9f3cac38cb002796ff77945209e0c2f476d",
+      "path": "__tests__/fixtures/kernel-parity/TortureFnrefDart.dart"
+    },
+    {
+      "sha256": "11934759522159ad852337bcd9460df570d56b78a94a880e622838d44c0b9f91",
+      "path": "__tests__/fixtures/kernel-parity/TortureGenericCalls.dart"
+    },
+    {
+      "sha256": "3f7cee6a84375ce509baf5e4acbbf5d8eb09d70074c200afe56c06550c74afbb",
+      "path": "__tests__/fixtures/kernel-parity/TortureGiven.scala"
+    },
+    {
+      "sha256": "31daa47200a15d7ec38e63f65beb5944782e938255a75f4d168b4a93b8a7c2cb",
+      "path": "__tests__/fixtures/kernel-parity/TortureHtml.php"
+    },
+    {
+      "sha256": "48567c236185de31a43793efaba4358fc664eccf375c026f22c61a29d10edf7a",
+      "path": "__tests__/fixtures/kernel-parity/TortureIndent.scala"
+    },
+    {
+      "sha256": "3512be7c6723e49c56345ee3a4d37e7604bb59c1ee89e6ef1cda6c202205ae6c",
+      "path": "__tests__/fixtures/kernel-parity/TortureInitializers.dart"
+    },
+    {
+      "sha256": "9e0c2b2e19f99295c733d8bbabc7d1e2fbdfb2936680bbae4ea98069de3bd3ae",
+      "path": "__tests__/fixtures/kernel-parity/TortureMini.dart"
+    },
+    {
+      "sha256": "fa5df3d3067850fbb9be2bdeb3ac0c6f7a783754fab976f17e7e6f5b12b575fa",
+      "path": "__tests__/fixtures/kernel-parity/TortureMisc.scala"
+    },
+    {
+      "sha256": "e387de74092d7f29d1a2c3744951572b7709c34b03489b4bf37acc9c842ba4fd",
+      "path": "__tests__/fixtures/kernel-parity/TortureModule.module"
+    },
+    {
+      "sha256": "94a921b08ad1439136a1b906b514468b39e8587464632951f94289dfaa50e38d",
+      "path": "__tests__/fixtures/kernel-parity/TorturePartOfName.dart"
+    },
+    {
+      "sha256": "6a088d0849db62a49908be852dc866776376c92cdca99d12313d21619de308cf",
+      "path": "__tests__/fixtures/kernel-parity/TortureReadsTypes.dart"
+    },
+    {
+      "sha256": "3bf4733083d82a4e5ef30610ed05de4d11303b899ce0b7164c41f7200308f041",
+      "path": "__tests__/fixtures/kernel-parity/TortureRecord.java"
+    },
+    {
+      "sha256": "c961c00cd2fe820ea16f25e8768f3d1d257feed2637d48e02bf39ddbd7ae6140",
+      "path": "__tests__/fixtures/kernel-parity/TortureScript.kts"
+    },
+    {
+      "sha256": "2a68973854601713123b5ea7e69337e704c0af4c14f4bcef62fd52481854d712",
+      "path": "__tests__/fixtures/kernel-parity/TortureScript.sc"
+    },
+    {
+      "sha256": "1023eacb408c1810196121978a2da808a06c23d002794094caf8776078227de0",
+      "path": "__tests__/fixtures/kernel-parity/TortureSigs.dart"
+    },
+    {
+      "sha256": "4f25b8f5be57de8aa94b607581393afb834821f8730991394dc892a15a538679",
+      "path": "__tests__/fixtures/kernel-parity/TortureTopLevel.cs"
+    },
+    {
+      "sha256": "d52861352ff1166e62a1b93b32308562475f8ffef85930d2bd39bcf2f6b3a309",
+      "path": "__tests__/fixtures/kernel-parity/TortureTry.swift"
+    },
+    {
+      "sha256": "e6bd68eb169f04666c5f4c858ec88cdba6dc18ef3d54928fd0e905f54e9f9a0b",
+      "path": "__tests__/fixtures/kernel-parity/TortureTypedefs.dart"
+    },
+    {
+      "sha256": "c38146dfd8f3aa32ace3c7710204db6a000215d17eb92a9956dd21c2e0052e89",
+      "path": "__tests__/fixtures/kernel-parity/TortureVref.scala"
+    },
+    {
+      "sha256": "8321b8718b051b9ae579052116244933b91d29efb24d159e0e67d9cba6dcf82a",
+      "path": "__tests__/fixtures/kernel-parity/TortureVrefDart.dart"
+    },
+    {
+      "sha256": "9cd594f457ac53edf64f198908f7dc545695bc14a8bf66902aedc5fffcd92c33",
+      "path": "__tests__/fixtures/kernel-parity/TortureWrappedCalls.swift"
+    },
+    {
+      "sha256": "f3ff539de4f9b969fe7fcb3e873877f5a0521740f0c824de6cad803a4701f61a",
+      "path": "__tests__/fixtures/kernel-parity/docstrings.py"
+    },
+    {
+      "sha256": "c605b8d9fbe79e81743189fa0fa6427b00d624c16b5a8dd0150cec15bb1a0a0b",
+      "path": "__tests__/fixtures/kernel-parity/torture-macros-ctors.cpp"
+    },
+    {
+      "sha256": "6b46ab6aab7ba582d04509c8f37731c24bd859fac29f72b12d1a31d132cec2be",
+      "path": "__tests__/fixtures/kernel-parity/torture-macros.c"
+    },
+    {
+      "sha256": "5401b6ca8f9a42b2f2f40c89d5be650b1a055e58f0d3951adb96fb5bbeb6ea11",
+      "path": "__tests__/fixtures/kernel-parity/torture.R"
+    },
+    {
+      "sha256": "72e51b37c26fda34e90c3d11774747973287740d0183bff3385dce6a3c040ee9",
+      "path": "__tests__/fixtures/kernel-parity/torture.c"
+    },
+    {
+      "sha256": "74a24c7c338be3cf22cd05c10d6f71b3cc19e086126aa767862209ea62fe68f8",
+      "path": "__tests__/fixtures/kernel-parity/torture.cpp"
+    },
+    {
+      "sha256": "5922427c19f6746d7193e9ce2aba0ffd9b904e1e718c61223298255d0a69bbc4",
+      "path": "__tests__/fixtures/kernel-parity/torture.dart"
+    },
+    {
+      "sha256": "817370a09149d61927459399b63c56cf3d1a179c0a36837da5f319b2dfe4529a",
+      "path": "__tests__/fixtures/kernel-parity/torture.go"
+    },
+    {
+      "sha256": "2e334b909e6deb95845b14399b16e1e978703d4acd53ccc06d5d5ffec3795d25",
+      "path": "__tests__/fixtures/kernel-parity/torture.hpp"
+    },
+    {
+      "sha256": "081ef268492261696e9d37a9b10c3806d8e7f7cf3c1488a7b8d38cb6866dddd9",
+      "path": "__tests__/fixtures/kernel-parity/torture.js"
+    },
+    {
+      "sha256": "641da8b886beb513a399cbed2b40c372b8a39ec971a872c47f8e19d3a7b90f89",
+      "path": "__tests__/fixtures/kernel-parity/torture.kt"
+    },
+    {
+      "sha256": "f61bd96fc5553f16af94919c44e411116cecc63d4224ce9d6a1b2a23afdbca0f",
+      "path": "__tests__/fixtures/kernel-parity/torture.lua"
+    },
+    {
+      "sha256": "aac81d5c1b47036eeaff4d8c68358f70ff8ab8e4b60ceb2bd93c4ffcc829b50f",
+      "path": "__tests__/fixtures/kernel-parity/torture.luau"
+    },
+    {
+      "sha256": "11c95981a3f992a9d1881a34fc29f3b10622a866b7fd93cbc986e62882c735d8",
+      "path": "__tests__/fixtures/kernel-parity/torture.php"
+    },
+    {
+      "sha256": "49b8923584b23ae7c4b82768ed7a3af7063706e0ef3bc956236ceda63ab06e17",
+      "path": "__tests__/fixtures/kernel-parity/torture.py"
+    },
+    {
+      "sha256": "846da38911e408f2a4a9a5c1bf463c5048966ab9f44f49f5b2ff3d7c341c2432",
+      "path": "__tests__/fixtures/kernel-parity/torture.rb"
+    },
+    {
+      "sha256": "d18d41301745ef236d2f19fea2d25029bc631519b1e2e941f4966421c80771a1",
+      "path": "__tests__/fixtures/kernel-parity/torture.rs"
+    },
+    {
+      "sha256": "0adcba5e965079bb3d750de9ac45a9833f1bc1e2ed7643b7f19aeba86a0e7b66",
+      "path": "__tests__/fixtures/kernel-parity/torture.scala"
+    },
+    {
+      "sha256": "165349fff00ae6abef4c09f58be18a74cc5abe82e662d71fdf347ba7c41ec217",
+      "path": "__tests__/fixtures/kernel-parity/torture.swift"
+    },
+    {
+      "sha256": "3964f9ea108d5544a1eae978a0643bbff66c5fed9d2f56cb4848418f4885434a",
+      "path": "__tests__/fixtures/kernel-parity/torture.tsx"
+    },
+    {
+      "sha256": "69fd5507de211478db65cee279604dc0b9008172c29bf5b153ae5566e762eb3a",
+      "path": "__tests__/fixtures/older-daemon.cjs"
+    },
+    {
+      "sha256": "173c940b11224f9cfdea3fb7cc4bb7c250b9cc75592676acb8f79fd7df83433e",
+      "path": "__tests__/fixtures/oversize-member-ts/package.json"
+    },
+    {
+      "sha256": "303fc837aed15b2b3c77d67f3b0ccf8a1622c6cece6822496db74c34f1fa5058",
+      "path": "__tests__/fixtures/oversize-member-ts/src/index.ts"
+    },
+    {
+      "sha256": "a5ba517a9ad4fd1777aae2d3dfab1a9f431f5ef2c558ab81e6124fd40c0b5d26",
+      "path": "__tests__/fixtures/oversize-member-ts/src/report/format.ts"
+    },
+    {
+      "sha256": "06ffb1e1185562b609f8b2db16570c1dff49832964424eb3316085105b240d89",
+      "path": "__tests__/fixtures/oversize-member-ts/src/report/monthly.ts"
+    },
+    {
+      "sha256": "90d2feadaf3a981da8ff9eab80b4813ff0a39a3999e742a39d269fcd50ae0f9e",
+      "path": "__tests__/fixtures/oversize-member-ts/src/report/quarterly.ts"
+    },
+    {
+      "sha256": "f79ed5f8e3b8f21d06b7693c59c3d947d498e53c4baefb7514e9d4c97457fcd3",
+      "path": "__tests__/fixtures/oversize-member-ts/src/report/store.ts"
+    },
+    {
+      "sha256": "b67a6feecf7fee0f4d31ac28c22d4e8a03750eceb44681e81ca0d8d4b9b050f1",
+      "path": "__tests__/fixtures/oversize-member-ts/src/report/types.ts"
+    },
+    {
+      "sha256": "8a942917489e017f2f0e4e3638ea400999f024ae28fba283dc6fcb27284980a4",
+      "path": "__tests__/fixtures/oversize-member-ts/src/report/weekly.ts"
+    },
+    {
+      "sha256": "1c029502ca1a2dc52c5b3f66cbff4c9ba2c6fcbfdbfc9baf38a6644e9346787b",
+      "path": "__tests__/fixtures/payroll-go/README.md"
+    },
+    {
+      "sha256": "4d21ebf4c75072f90260ca762755b5c37ed7c62387ca7e10d632fd7270b9ddd3",
+      "path": "__tests__/fixtures/payroll-go/cmd/payrolld/main.go"
+    },
+    {
+      "sha256": "da554687b83c68d35264a4771e9e4900776c37a581c584037eaceb33790bb99b",
+      "path": "__tests__/fixtures/payroll-go/go.mod"
+    },
+    {
+      "sha256": "d9d0fb395c2c211f1d50e934c6145bd1805861716cec1ab9aeb261cee2de7a3b",
+      "path": "__tests__/fixtures/payroll-go/internal/domain/payroll/payslip.go"
+    },
+    {
+      "sha256": "9592f327b159ca9d5749449cd41e0e3cab3499252dcc0668601ba54bd43a76f6",
+      "path": "__tests__/fixtures/payroll-go/internal/gen/fkit/employee/contract.go"
+    },
+    {
+      "sha256": "c620cba32cec55b4016039f86689ae68833be218c3d633a1893263bb7366d168",
+      "path": "__tests__/fixtures/payroll-go/internal/gen/fkit/employee/employee.go"
+    },
+    {
+      "sha256": "25986cbe63fccf6cb4cd59f07d400c2a409a9119b2ca4077c4a2bd2e8ee5119f",
+      "path": "__tests__/fixtures/payroll-go/internal/gen/fkit/payroll/calculate.go"
+    },
+    {
+      "sha256": "d455dc920a1f79454271378d7aef5297c217bb475c4884aaec48229361a596d2",
+      "path": "__tests__/fixtures/payroll-go/internal/gen/fkit/payroll/dto.go"
+    },
+    {
+      "sha256": "f3af4d93df712d33b944818f2d2ca84e6d91090adccd7664299e94ecfd639419",
+      "path": "__tests__/fixtures/payroll-go/internal/gen/fkit/payroll/payroll_cycle.go"
+    },
+    {
+      "sha256": "db3677df3566ef32c4d754cc20695cfff8481365861f81fc5d48a13c790cff36",
+      "path": "__tests__/fixtures/payroll-go/internal/gen/fkit/payroll/payslip.go"
+    },
+    {
+      "sha256": "c70b8e416fe79b07d9d0f04ac69b501ee74015d61058e1e1176a8296376b460e",
+      "path": "__tests__/fixtures/payroll-go/internal/gen/fkit/payroll/store.go"
+    },
+    {
+      "sha256": "0d4320629229060c6772a4139668e5ec7fdb328e1267b91165f3518c75284979",
+      "path": "__tests__/fixtures/payroll-go/internal/gen/fkit/timesheet/timesheet.go"
+    },
+    {
+      "sha256": "b774700bf21bfd93d356beebb0a391e2416f940cdd2812875fa9c6c051ba4dbb",
+      "path": "__tests__/fixtures/payroll-go/internal/gen/payrollpb/payroll.pb.go"
+    },
+    {
+      "sha256": "da6caee4334053da31977a0acfb100d266cc6b7d981c10dff6b6bc0e621041d2",
+      "path": "__tests__/fixtures/payroll-go/internal/gen/payrollpb/payroll_grpc.pb.go"
+    },
+    {
+      "sha256": "47c56844cd4fcaf84bfcce66c38dd7613112c7d95927c442136c2b29d5832fd1",
+      "path": "__tests__/fixtures/payroll-go/internal/platform/clock/clock.go"
+    },
+    {
+      "sha256": "260e135c811e604d94f19f8dfc736f89d37ce9b000d851a0ccb92505c83935d5",
+      "path": "__tests__/fixtures/payroll-go/internal/store/payslipstore/store.go"
+    },
+    {
+      "sha256": "cd4c5bd53cbf06e026c36655b8bfe6d20826c9ab7f777c0360f19e1e925fffae",
+      "path": "__tests__/fixtures/payroll-go/internal/transport/httpapi/payroll_handler.go"
+    },
+    {
+      "sha256": "4fcbb1d7e70a4dcddc6bec3e18e137af2fecb6c44eb93aa29cb079f52fd4fcfc",
+      "path": "__tests__/fixtures/payroll-go/internal/transport/httpapi/router.go"
+    },
+    {
+      "sha256": "d4064829e72e2672a32105699c2d4c8878687fcfcc8ad3378729be33ce08f585",
+      "path": "__tests__/fixtures/payroll-go/internal/usecase/payroll/cycle.go"
+    },
+    {
+      "sha256": "8aa3d67ef442fd45f3f17c9ba7f8d81c60ef0dc344748fcfa351ad1a50683d09",
+      "path": "__tests__/fixtures/payroll-go/internal/usecase/payroll/payslip_builder.go"
+    },
+    {
+      "sha256": "d3516245d894c5086a6fce552738e207b36013c0e32f6f43cb87c15d918279af",
+      "path": "__tests__/fixtures/payroll-go/internal/usecase/payroll/prorate.go"
+    },
+    {
+      "sha256": "45b62f7b5da670aa17883aaf11c461abaca6273a626ad0f7c7fe15238a2332c1",
+      "path": "__tests__/fixtures/php-import-alias-static/app/Http/Controllers/Backend/SettleController.php"
+    },
+    {
+      "sha256": "2cf7365536390e409e6c82b1619c7f8272920a78f150d51008fdfcce81fab160",
+      "path": "__tests__/fixtures/php-import-alias-static/app/Repositories/SettleRepository.php"
+    },
+    {
+      "sha256": "6d82291696610a714c99254bdac28d59e1d9b4a0c1140e7064ba6c59688dcffc",
+      "path": "__tests__/fixtures/php-import-alias-static/app/Services/SettleService.php"
+    },
+    {
+      "sha256": "90e2ac4b9f46b9be57150d308365c962fca592e0739b2d36c15902cfb3e1e290",
+      "path": "__tests__/fixtures/record-detached-spawns.cjs"
+    },
+    {
+      "sha256": "4df3804e1ce12ffdeafb5932702a6fcbf2ebca9da766c392259251dd5b40cfcd",
+      "path": "__tests__/fixtures/starved-cluster-ts/package.json"
+    },
+    {
+      "sha256": "25326b2d2c9d1e866f7e10d2266719ecec6ded58a674f5beed1d8bb30b115f34",
+      "path": "__tests__/fixtures/starved-cluster-ts/src/app/client.ts"
+    },
+    {
+      "sha256": "af06363d32fc39c1846234564b2f4d097ca7c786c8ed14a48ff51ba3a90ddb0e",
+      "path": "__tests__/fixtures/starved-cluster-ts/src/app/config.ts"
+    },
+    {
+      "sha256": "3dbf25ebd7eb607d62f33db4b0bd69173ce105bc5ef27b4fd4ef8984791e1271",
+      "path": "__tests__/fixtures/starved-cluster-ts/src/index.ts"
+    },
+    {
+      "sha256": "c5a56751ecd731f4fee79e256089ddb645a894aa754084c1402d3e8216394e0d",
+      "path": "__tests__/fixtures/starved-cluster-ts/src/pipeline/chain.ts"
+    },
+    {
+      "sha256": "331f8bab6ad95262b9b875c58b7076bae1bfa671cc4b883c35d7681eacc47eb1",
+      "path": "__tests__/fixtures/starved-cluster-ts/src/pipeline/framing.ts"
+    },
+    {
+      "sha256": "c7ea834f76a3b29b01cdc3273c5b628858863c77811352ae71ad4f9a312fc2d9",
+      "path": "__tests__/fixtures/starved-cluster-ts/src/pipeline/interceptors.ts"
+    },
+    {
+      "sha256": "85b2b305d8a6fa593a7ee979698ea0e7b7a3dd0a6a1db65d97ce6fddaa13dd82",
+      "path": "__tests__/fixtures/starved-cluster-ts/src/pipeline/types.ts"
+    },
+    {
+      "sha256": "715daee9825478281d24723ffbe404a69f04e92fb8eefb66496f8265a261b0d1",
+      "path": "__tests__/fixtures/starved-cluster-ts/src/transport/socket.ts"
+    },
+    {
+      "sha256": "bfc49e33b5117dd1dcfcfe43552d6720f3f5104b3b34ae94abc15135a148a165",
+      "path": "__tests__/fixtures/tail-render-ts/README.md"
+    },
+    {
+      "sha256": "179407a57d7629846e0e18fad56ff7aa0d1cba99be7e48e676ce0807b6877fc5",
+      "path": "__tests__/fixtures/tail-render-ts/package.json"
+    },
+    {
+      "sha256": "f984278740f2e7eee1cf697b9a121fcc49d5c4c433e30067f3f2b60f03576f1e",
+      "path": "__tests__/fixtures/tail-render-ts/src/components/ChatComposer.ts"
+    },
+    {
+      "sha256": "af8ee84324c0a4f38003c26f610e71f58220c7becf536c02f43fe2dfe3c009db",
+      "path": "__tests__/fixtures/tail-render-ts/src/lib/message-builder.ts"
+    },
+    {
+      "sha256": "d926204b993e78092b4fba43e21eeb1c3f98aa4aae3479cd056c92f0e77596c7",
+      "path": "__tests__/fixtures/tail-render-ts/src/lib/session-store.ts"
+    },
+    {
+      "sha256": "bd454f575e4b16997e5143a83ca842d021bf442de15f4dda76c222e436cf442e",
+      "path": "__tests__/fixtures/tail-render-ts/src/lib/socket.ts"
+    },
+    {
+      "sha256": "a5e7de420ef3a5924f79fef9d3c59c26f815ba6bc7abf554138cdfa23d7d2bee",
+      "path": "__tests__/fixtures/tail-render-ts/types/worker-configuration.d.ts"
+    },
+    {
+      "sha256": "cdbae06f2aa8fd24f4a1ed083d5cb8011ea93d08a9ab2cf787df791a6cade489",
+      "path": "__tests__/fixtures/ts-syntax/abstract-construct.ts"
+    },
+    {
+      "sha256": "f432377813402b52e6f5744e671931cf307788066afdde739e1285f5ad1bcd75",
+      "path": "__tests__/fixtures/ts-syntax/abstract-member-name.ts"
+    },
+    {
+      "sha256": "7f9407c1ce4b15dd4d3c47d67edd2b18471a732987a781ec942f16b6ae4ea2c6",
+      "path": "__tests__/fixtures/ts-syntax/abstract-member-name.tsx"
+    },
+    {
+      "sha256": "711487cd302cd0bb34eb431db37d98d7d9dc5aec59d70312065d1be2ec9072cc",
+      "path": "__tests__/fixtures/ts-syntax/accessor-member-name.ts"
+    },
+    {
+      "sha256": "711487cd302cd0bb34eb431db37d98d7d9dc5aec59d70312065d1be2ec9072cc",
+      "path": "__tests__/fixtures/ts-syntax/accessor-member-name.tsx"
+    },
+    {
+      "sha256": "2b7d9d0111ea881d375e9d56b35d3b6de340a67fd36fcbb31e7af193daef572e",
+      "path": "__tests__/fixtures/ts-syntax/accessor-modifiers.ts"
+    },
+    {
+      "sha256": "2b7d9d0111ea881d375e9d56b35d3b6de340a67fd36fcbb31e7af193daef572e",
+      "path": "__tests__/fixtures/ts-syntax/accessor-modifiers.tsx"
+    },
+    {
+      "sha256": "80f0ed7002db1cf99a11220231626b0d13c56e858989f88580110ce9ca7d4205",
+      "path": "__tests__/fixtures/ts-syntax/accessor-type-name.ts"
+    },
+    {
+      "sha256": "80f0ed7002db1cf99a11220231626b0d13c56e858989f88580110ce9ca7d4205",
+      "path": "__tests__/fixtures/ts-syntax/accessor-type-name.tsx"
+    },
+    {
+      "sha256": "99215b5c1fb87ec552cad43ede7e4da65d9f39e1c92178652758516ac5c5b548",
+      "path": "__tests__/fixtures/ts-syntax/accessor.ts"
+    },
+    {
+      "sha256": "2d23fccaa92753c2ea2b5b9f835d35a5ce2511e9638f0f1330523c55efb58b00",
+      "path": "__tests__/fixtures/ts-syntax/asi-in-names.ts"
+    },
+    {
+      "sha256": "2d23fccaa92753c2ea2b5b9f835d35a5ce2511e9638f0f1330523c55efb58b00",
+      "path": "__tests__/fixtures/ts-syntax/asi-in-names.tsx"
+    },
+    {
+      "sha256": "31b7ed866b3e56ec5d527e1bf97cd9a5c8b5efb401b3dcbf361a7faa00bd932e",
+      "path": "__tests__/fixtures/ts-syntax/asserts.ts"
+    },
+    {
+      "sha256": "60c102e885b59ddeacc37baee921e3ed0b432b794316730874a5fc4650ba102c",
+      "path": "__tests__/fixtures/ts-syntax/const-type-params.ts"
+    },
+    {
+      "sha256": "12613b13cde4976c1e7e1f01e729549468addb2b6e2b44c7b156456987381f87",
+      "path": "__tests__/fixtures/ts-syntax/cts-module.cts"
+    },
+    {
+      "sha256": "da7a3ac0a9a2fbfc6586b52792fae3bf24322f54e7bea5373e19d0006e0abc10",
+      "path": "__tests__/fixtures/ts-syntax/declarations.d.ts"
+    },
+    {
+      "sha256": "a80faa839f7fc295313cb2ab6678f9bc0113f5064b2e381fb0d00f60f1ccfde8",
+      "path": "__tests__/fixtures/ts-syntax/decorators.ts"
+    },
+    {
+      "sha256": "c09a99c0bb5080da71d27c282335deba455f54355ce665d84fa21e11d853b02e",
+      "path": "__tests__/fixtures/ts-syntax/enums-namespaces.ts"
+    },
+    {
+      "sha256": "220db2728ae9a3a982fa595348ae2f35b0d881c9a102a1c65bbb75602a1f43f0",
+      "path": "__tests__/fixtures/ts-syntax/export-type-star.ts"
+    },
+    {
+      "sha256": "220db2728ae9a3a982fa595348ae2f35b0d881c9a102a1c65bbb75602a1f43f0",
+      "path": "__tests__/fixtures/ts-syntax/export-type-star.tsx"
+    },
+    {
+      "sha256": "08ef50de8056e749cd03089a20e0722563b975252aca330197a59694849a43f3",
+      "path": "__tests__/fixtures/ts-syntax/for-var-in-newline.ts"
+    },
+    {
+      "sha256": "be26f7a38d1f593be5ddfec86ae039a611c0d8aca8de675b4f6b435c9dae2a9f",
+      "path": "__tests__/fixtures/ts-syntax/for-var-in-newline.tsx"
+    },
+    {
+      "sha256": "fa2b2dc63116d99413c738bbbc5d9bc1ff15c315f06fbcf6cfe7dfab1bff547a",
+      "path": "__tests__/fixtures/ts-syntax/gap-await-using-in-for.ts"
+    },
+    {
+      "sha256": "9ecf4e7691afbe7844ee2a60042f861a9a6b5a5be82d62cd44c05c98ceae2548",
+      "path": "__tests__/fixtures/ts-syntax/gap-export-named-from-attributes.ts"
+    },
+    {
+      "sha256": "4ead9012cf2f7aa97ce14f114f61c8083c18327ac08fd16e02fc4b4d9f55e35b",
+      "path": "__tests__/fixtures/ts-syntax/gap-export-star-from-attributes.ts"
+    },
+    {
+      "sha256": "e2bb3f992224b06bc59a1454f726205fc0901e5c3f7805fae33e410e6fba3862",
+      "path": "__tests__/fixtures/ts-syntax/gap-using-in-for.ts"
+    },
+    {
+      "sha256": "06e7e1677bab13913f7b16578dd1370c37eabadbe77256ab2eb7c716fade3907",
+      "path": "__tests__/fixtures/ts-syntax/generic-arrow.tsx"
+    },
+    {
+      "sha256": "44faacd00c355ff61625860db30cf66fdd0dc8783435e995b34f7e6bc4656fb0",
+      "path": "__tests__/fixtures/ts-syntax/import-attributes.ts"
+    },
+    {
+      "sha256": "dd637f22a21bdd5982dadcb358e3bb7d75bf0751f35a967c9b514eed6f5adfed",
+      "path": "__tests__/fixtures/ts-syntax/import-type-primary.ts"
+    },
+    {
+      "sha256": "dd637f22a21bdd5982dadcb358e3bb7d75bf0751f35a967c9b514eed6f5adfed",
+      "path": "__tests__/fixtures/ts-syntax/import-type-primary.tsx"
+    },
+    {
+      "sha256": "e2a88423e4a9f1590f47103bccd6fcdbd31b706a02ef20ee3ef3e9edb88d2ef5",
+      "path": "__tests__/fixtures/ts-syntax/in-member-after-arrow-field.ts"
+    },
+    {
+      "sha256": "e2a88423e4a9f1590f47103bccd6fcdbd31b706a02ef20ee3ef3e9edb88d2ef5",
+      "path": "__tests__/fixtures/ts-syntax/in-member-after-arrow-field.tsx"
+    },
+    {
+      "sha256": "224d09d3b1492ff8cbf11f9c7c9a778c876413a5cc421712f42741e0029a7611",
+      "path": "__tests__/fixtures/ts-syntax/in-member-space-paren.ts"
+    },
+    {
+      "sha256": "224d09d3b1492ff8cbf11f9c7c9a778c876413a5cc421712f42741e0029a7611",
+      "path": "__tests__/fixtures/ts-syntax/in-member-space-paren.tsx"
+    },
+    {
+      "sha256": "81f5401d85aeec1f5b44d3f251de9a9061367bee573a65a33477b8e0489655bc",
+      "path": "__tests__/fixtures/ts-syntax/in-operator-ternary-after-field.ts"
+    },
+    {
+      "sha256": "81f5401d85aeec1f5b44d3f251de9a9061367bee573a65a33477b8e0489655bc",
+      "path": "__tests__/fixtures/ts-syntax/in-operator-ternary-after-field.tsx"
+    },
+    {
+      "sha256": "58ef5ad4ee3c80dcbc01f9094c5aef5bc7aa29c0ed6739e0c492c74ea5d7bbfe",
+      "path": "__tests__/fixtures/ts-syntax/in-paren-strings-comments.ts"
+    },
+    {
+      "sha256": "58ef5ad4ee3c80dcbc01f9094c5aef5bc7aa29c0ed6739e0c492c74ea5d7bbfe",
+      "path": "__tests__/fixtures/ts-syntax/in-paren-strings-comments.tsx"
+    },
+    {
+      "sha256": "441eb575effd366811476e4bd540f05e223650e4d186c0db422aa1262e57f6f5",
+      "path": "__tests__/fixtures/ts-syntax/infer-extends.ts"
+    },
+    {
+      "sha256": "a0851cfc9d202eb2220daa8389ce1f8b2530e4cf263102613f61a55449199392",
+      "path": "__tests__/fixtures/ts-syntax/member-type-params-newline.ts"
+    },
+    {
+      "sha256": "a0851cfc9d202eb2220daa8389ce1f8b2530e4cf263102613f61a55449199392",
+      "path": "__tests__/fixtures/ts-syntax/member-type-params-newline.tsx"
+    },
+    {
+      "sha256": "bcc50bea0c77a8df46833fa7acd63418a9a3099b283055543f7f524bbfe121ff",
+      "path": "__tests__/fixtures/ts-syntax/misc-modern.mts"
+    },
+    {
+      "sha256": "591a384247dab8fb7b5abf10a03acc5e469a3b61d1b559d5209463e1db7219ee",
+      "path": "__tests__/fixtures/ts-syntax/overload-asi.ts"
+    },
+    {
+      "sha256": "591a384247dab8fb7b5abf10a03acc5e469a3b61d1b559d5209463e1db7219ee",
+      "path": "__tests__/fixtures/ts-syntax/overload-asi.tsx"
+    },
+    {
+      "sha256": "903776a9afd5f3bc859e52916ddb9c6f52e720dac9101900670ff507b26b7cb3",
+      "path": "__tests__/fixtures/ts-syntax/reserved-word-alias.ts"
+    },
+    {
+      "sha256": "903776a9afd5f3bc859e52916ddb9c6f52e720dac9101900670ff507b26b7cb3",
+      "path": "__tests__/fixtures/ts-syntax/reserved-word-alias.tsx"
+    },
+    {
+      "sha256": "47e9d72053bb413bd89c8a6a16cd070d6b041e001137f2ccbb0192af1f233468",
+      "path": "__tests__/fixtures/ts-syntax/satisfies.ts"
+    },
+    {
+      "sha256": "4e78e70640d7643d10d986b7de28f3b585e036f88bb9d0582b1d2d4b62497b83",
+      "path": "__tests__/fixtures/ts-syntax/static-accessor.ts"
+    },
+    {
+      "sha256": "afe2c2153adcde16627b9013910178b880d4ad4064764d78e328635e44e8cd88",
+      "path": "__tests__/fixtures/ts-syntax/static-blocks.ts"
+    },
+    {
+      "sha256": "df3edfac28d6fb73fcf55278c5afd9a31a94ae455ceacee204b2dc77034203b9",
+      "path": "__tests__/fixtures/ts-syntax/tagged-template-invalid-escape.ts"
+    },
+    {
+      "sha256": "756fa47dfd3cc231e810b52416a8c10cb954f0b6606a227500d3df89272da180",
+      "path": "__tests__/fixtures/ts-syntax/tagged-template-invalid-escape.tsx"
+    },
+    {
+      "sha256": "08cc7f713eed6c8e8002093213694218aae1da90683934ef08dc8e0ee8d5b012",
+      "path": "__tests__/fixtures/ts-syntax/tagged-template-type-args.ts"
+    },
+    {
+      "sha256": "08cc7f713eed6c8e8002093213694218aae1da90683934ef08dc8e0ee8d5b012",
+      "path": "__tests__/fixtures/ts-syntax/tagged-template-type-args.tsx"
+    },
+    {
+      "sha256": "c98cfd1b70fd59601d3cb796a66407692bf735ddf5f0cadb57851ce3f3390dda",
+      "path": "__tests__/fixtures/ts-syntax/template-literal-escapes.ts"
+    },
+    {
+      "sha256": "c98cfd1b70fd59601d3cb796a66407692bf735ddf5f0cadb57851ce3f3390dda",
+      "path": "__tests__/fixtures/ts-syntax/template-literal-escapes.tsx"
+    },
+    {
+      "sha256": "8580984242e193271c9b3055c6395d23c97cd931f47c191862e9b4397e099c21",
+      "path": "__tests__/fixtures/ts-syntax/template-literal-types.ts"
+    },
+    {
+      "sha256": "7587b95a4d4e8ff012a9a34977df24d8c8b2784de33ad6a5db78286bca1de2f3",
+      "path": "__tests__/fixtures/ts-syntax/tuple-keyword-type-names.ts"
+    },
+    {
+      "sha256": "7587b95a4d4e8ff012a9a34977df24d8c8b2784de33ad6a5db78286bca1de2f3",
+      "path": "__tests__/fixtures/ts-syntax/tuple-keyword-type-names.tsx"
+    },
+    {
+      "sha256": "19d95844e166a4e80eb4d715e5ec08862aeb1757f0b7b13fa65ac6187c5233df",
+      "path": "__tests__/fixtures/ts-syntax/tuple-label-keyword.ts"
+    },
+    {
+      "sha256": "19d95844e166a4e80eb4d715e5ec08862aeb1757f0b7b13fa65ac6187c5233df",
+      "path": "__tests__/fixtures/ts-syntax/tuple-label-keyword.tsx"
+    },
+    {
+      "sha256": "b3386111c1da9e5912fb56c0f39c10f8a0736ff637425a7f31a513f51bcfa2ae",
+      "path": "__tests__/fixtures/ts-syntax/tuples.ts"
+    },
+    {
+      "sha256": "5a04ffe76fbd7f12133bc01bbd38ada3f8f9eafee261bd0c123268bb3782d1ee",
+      "path": "__tests__/fixtures/ts-syntax/typeof-abstract-comparison.ts"
+    },
+    {
+      "sha256": "5a04ffe76fbd7f12133bc01bbd38ada3f8f9eafee261bd0c123268bb3782d1ee",
+      "path": "__tests__/fixtures/ts-syntax/typeof-abstract-comparison.tsx"
+    },
+    {
+      "sha256": "b98254f563caf6494d0e7b9de4e8f08581bd96f5c94b6af345be4608c539c8dd",
+      "path": "__tests__/fixtures/ts-syntax/typeof-abstract.ts"
+    },
+    {
+      "sha256": "b98254f563caf6494d0e7b9de4e8f08581bd96f5c94b6af345be4608c539c8dd",
+      "path": "__tests__/fixtures/ts-syntax/typeof-abstract.tsx"
+    },
+    {
+      "sha256": "cdd92a9b27d996f42bf3e6796273da948f0d22d8c868f62a7e5d495788ea39d3",
+      "path": "__tests__/fixtures/ts-syntax/typeof-reserved-member.ts"
+    },
+    {
+      "sha256": "cdd92a9b27d996f42bf3e6796273da948f0d22d8c868f62a7e5d495788ea39d3",
+      "path": "__tests__/fixtures/ts-syntax/typeof-reserved-member.tsx"
+    },
+    {
+      "sha256": "beeb2127754ea2282c089840b8db692d3fa765908b9f0e375515929a8018f435",
+      "path": "__tests__/fixtures/ts-syntax/unique-comment-line-separator.ts"
+    },
+    {
+      "sha256": "beeb2127754ea2282c089840b8db692d3fa765908b9f0e375515929a8018f435",
+      "path": "__tests__/fixtures/ts-syntax/unique-comment-line-separator.tsx"
+    },
+    {
+      "sha256": "1cd9dc05f438b54660b8cd0126597334ba3bc1f240eb1403c15254c3d792dfc4",
+      "path": "__tests__/fixtures/ts-syntax/unique-comment-symbol.ts"
+    },
+    {
+      "sha256": "1cd9dc05f438b54660b8cd0126597334ba3bc1f240eb1403c15254c3d792dfc4",
+      "path": "__tests__/fixtures/ts-syntax/unique-comment-symbol.tsx"
+    },
+    {
+      "sha256": "94cd162f5ad64c3356fa267abf74844bbf0ba6a346eaa43cea9c6b5faa2f9841",
+      "path": "__tests__/fixtures/ts-syntax/unique-identifier.ts"
+    },
+    {
+      "sha256": "94cd162f5ad64c3356fa267abf74844bbf0ba6a346eaa43cea9c6b5faa2f9841",
+      "path": "__tests__/fixtures/ts-syntax/unique-identifier.tsx"
+    },
+    {
+      "sha256": "f025fa6ec4b898a17ac1525442c0c40bb30dd2aa978842cd6709ed8c4e0fe640",
+      "path": "__tests__/fixtures/ts-syntax/unique-symbol-unicode-space.ts"
+    },
+    {
+      "sha256": "f025fa6ec4b898a17ac1525442c0c40bb30dd2aa978842cd6709ed8c4e0fe640",
+      "path": "__tests__/fixtures/ts-syntax/unique-symbol-unicode-space.tsx"
+    },
+    {
+      "sha256": "b7278f9d78b9bdf112b22c3d81e38b6b9e207718f8d1d3360d2e0999656713c6",
+      "path": "__tests__/fixtures/ts-syntax/using.ts"
+    },
+    {
+      "sha256": "47cb50e6ad90d89b190113318e13499c49438172cc8de7d4508b6f66df475626",
+      "path": "__tests__/fixtures/ts-syntax/variance-out-name.ts"
+    },
+    {
+      "sha256": "cb8ea2ba1920207e006aa7f29e679040a44652c6338b9ad76fc53bc1561f23d3",
+      "path": "__tests__/fixtures/ts-syntax/variance-out-name.tsx"
+    },
+    {
+      "sha256": "01cb4743139dec3fb7396bbde25eefa7da006f66e682ba00e52f9c6936e1ca53",
+      "path": "__tests__/fixtures/ts-syntax/variance.ts"
+    },
+    {
+      "sha256": "417d5396fe66ade8a56ed38829bc0e57355426184e25724a616ce0e2cafc1ab4",
+      "path": "__tests__/flask-url-rules.test.ts"
+    },
+    {
+      "sha256": "a13a71907628c2be78efb2de06cb46079ca1896a96d1cf82e91a9ffafc800f67",
+      "path": "__tests__/flow-directed-exact-names.test.ts"
+    },
+    {
+      "sha256": "ba3ece42b86cbd685fa361a0af9c9022a036aead9577f7de866ead7bdfdd8b04",
+      "path": "__tests__/flow-js.test.ts"
+    },
+    {
+      "sha256": "52b372812c1ed8b2ee2ba7923e8d077a1aa917c3f54a98b789edcfc2ea4a2882",
+      "path": "__tests__/flow-library-globals.test.ts"
+    },
+    {
+      "sha256": "03480743b38706d563e3fb4938cad81404b589d11060fb17657c80435fb4b094",
+      "path": "__tests__/flow-named-implementation.test.ts"
+    },
+    {
+      "sha256": "d66adccd05ec4c80120de356dd19a316c47c2a43c7b3a1d8c7e9d7eed02ce313",
+      "path": "__tests__/flow-named-longer-route.test.ts"
+    },
+    {
+      "sha256": "2c8571d59bf8247581ecd910827d476748e60a5acaab5d7d54082d7bd996089e",
+      "path": "__tests__/foundation-enum-macros.test.ts"
+    },
+    {
+      "sha256": "441888d339b389d8d2c003c38eecb0b580e439804a0f20afa8be1a6855d32a50",
+      "path": "__tests__/foundation.test.ts"
+    },
+    {
+      "sha256": "9acdba6bf34ce096bde84fc5eda80f5f4d5af8917767f516f3dd08dc9ef5fd0e",
+      "path": "__tests__/framework-edge-name.test.ts"
+    },
+    {
+      "sha256": "28452047a60c89ea0a4cddfc4b45f34edc5cdcd52661f4804ab3f41e312ae7d4",
+      "path": "__tests__/framework-hint-resolver-only.test.ts"
+    },
+    {
+      "sha256": "015e74b36bd599596c64c95ccc994b960536aae3e05931c852466aa64a8c866e",
+      "path": "__tests__/framework-name-heuristic-scope.test.ts"
+    },
+    {
+      "sha256": "91fcc62be382d6d68c90014b33d13ff57df8e989905d3033d554dff3a8c4ee40",
+      "path": "__tests__/framework-resolve-language.test.ts"
+    },
+    {
+      "sha256": "0e542afc7cd1afe40140e8b65675d76f7c236bfdf275af0fb453642069232564",
+      "path": "__tests__/frameworks-integration.test.ts"
+    },
+    {
+      "sha256": "eb94df84cc26f04962ad6845a5e775a35d9864ae3562f9bad8fc9d8012cbafa0",
+      "path": "__tests__/frameworks.test.ts"
+    },
+    {
+      "sha256": "20b81d4dd9a4e32c8ae29cd040a069454608e1b9b216cbf088bd183f1b14af61",
+      "path": "__tests__/frontload-hook.test.ts"
+    },
+    {
+      "sha256": "ae39668821fc61a9a54e3356a032bba8328cb714b6cac34b3e0c265c1bc56f03",
+      "path": "__tests__/fts5-fallback.test.ts"
+    },
+    {
+      "sha256": "88a3b9b1b53ef0b7ea97dcc1b36dc44e9ea9783f638b70133ed8e836adb33ca8",
+      "path": "__tests__/function-ref-package-imports.test.ts"
+    },
+    {
+      "sha256": "de63b0c90eab8c33ba219601b2f73ce2f34bd14c05b8ea51a0f17d52bbc57ed1",
+      "path": "__tests__/function-ref-project-imports.test.ts"
+    },
+    {
+      "sha256": "095e399c3ff24562539f5b0f880d5e7fad035c855720b4bbddc7e2447ecda161",
+      "path": "__tests__/function-ref.test.ts"
+    },
+    {
+      "sha256": "f1e53b117e0df8a9d47c5863a478e526ff1c1c808ddf44ce2f27466d0e3c70e5",
+      "path": "__tests__/fuzzy-case-sensitivity.test.ts"
+    },
+    {
+      "sha256": "e22f4b3e95f9f6f3e5e5b7f820bb18fd619d01bcc7d0659862a3b4758a705ea8",
+      "path": "__tests__/fuzzy-lexical-reach.test.ts"
+    },
+    {
+      "sha256": "8f60dbd32a97b2137ebfce9e0e23952428449c2414295776cb29436c656af26b",
+      "path": "__tests__/generated-detection.test.ts"
+    },
+    {
+      "sha256": "afcd7331fe2a4763cd29a6602f05964223fafc5d75f267fd435351ef95589f28",
+      "path": "__tests__/generated-flag-index.test.ts"
+    },
+    {
+      "sha256": "d7baa80a2d0f4beef0f09d32ceee9c52537f47d145a8c358a8e043131049fdfb",
+      "path": "__tests__/generic-supertypes.test.ts"
+    },
+    {
+      "sha256": "b214c49786b11fa6842bf50cb539e64272f4bf73233bd951f3b60b0262c4ee70",
+      "path": "__tests__/gin-middleware-chain.test.ts"
+    },
+    {
+      "sha256": "ce587afb8698a6a820740773289b28752cd14bdc2d3adf31707ad4be558072fd",
+      "path": "__tests__/git-changed-untracked-dir.test.ts"
+    },
+    {
+      "sha256": "ead7f35f01f3f6f8862663fa6f73e247fa729eb6c2cb5859e55a7d5a5abfadef",
+      "path": "__tests__/git-hooks.test.ts"
+    },
+    {
+      "sha256": "4c1c61c39c5f9517fae13d66be88d53c6b95d765a41354de7195b1c79e65fe01",
+      "path": "__tests__/git-ignored-dirs-scope.test.ts"
+    },
+    {
+      "sha256": "7b441b0537a2c91453f5bfcb5f5dbdfd02ce3a7eab4accb0596cc1556b965289",
+      "path": "__tests__/git-index-currency.test.ts"
+    },
+    {
+      "sha256": "fcccc1937527ee660a6b365996ef0ae6b14b9a9039f477e6767694b27ffa24e2",
+      "path": "__tests__/git-status-subdir-project.test.ts"
+    },
+    {
+      "sha256": "cbe78eb19a2f820673b223b8e82fb506a610c714b80f8c42975e9207a1221007",
+      "path": "__tests__/gitignore-pattern-parity.test.ts"
+    },
+    {
+      "sha256": "f239f6cc64965a22d69f869e290d137b02b1fa41cd3a5999593955a86e69997e",
+      "path": "__tests__/global-setup-dist.test.ts"
+    },
+    {
+      "sha256": "656920b6ad0b4d0a7ba62a4d3bf61936cdfb3b1b8e85199d2615d16d033c6e52",
+      "path": "__tests__/global-setup-dist.ts"
+    },
+    {
+      "sha256": "f5d68e3cb38cb8a1131c089cbc83ef4c25879243db5f7eff8aa9f9448c183e2a",
+      "path": "__tests__/global-setup-home-sandbox.ts"
+    },
+    {
+      "sha256": "fa84a0ea3bd5438cdb5f119c605d60b3a520841ad93d3a17caea368b051473f6",
+      "path": "__tests__/glyphs.test.ts"
+    },
+    {
+      "sha256": "1fde5a33106332db07d2b50f181bb917bc6c9ed5f113366daf0b1122c465d0ce",
+      "path": "__tests__/go-asserted-locals.test.ts"
+    },
+    {
+      "sha256": "c7eb9e3dcf06e5390707ec14f17eb54a27e6e15b33bf2001225c80ff368d013b",
+      "path": "__tests__/go-bare-call-no-method.test.ts"
+    },
+    {
+      "sha256": "3697a3b0911076b50d38ae5a169466e7cd37b8219892d811f41e7b57f0484ac1",
+      "path": "__tests__/go-build-constraint-twins.test.ts"
+    },
+    {
+      "sha256": "b38406e24801ba53bf96ef177d79571e6d27998516997a7132e1230efd0f2336",
+      "path": "__tests__/go-chained-receivers.test.ts"
+    },
+    {
+      "sha256": "3d81ed460a332427797f0a0404fb03555741eff5877200462fa0603ff765a730",
+      "path": "__tests__/go-conversion-references.test.ts"
+    },
+    {
+      "sha256": "92b92c292691e02cd5835bc89fea5df9ba304ec192e9039b722a9aa6b179ddf4",
+      "path": "__tests__/go-declared-receiver.test.ts"
+    },
+    {
+      "sha256": "c9764d8aa0e9c3bc1befc407607c065d60e58caee3ee636d4a46deaf54799972",
+      "path": "__tests__/go-defined-type-refs.test.ts"
+    },
+    {
+      "sha256": "fa7a0bf0c77df85804fd13542d8fe386a093852860c09715cb4689fce5f36fe8",
+      "path": "__tests__/go-detached-doc-comments.test.ts"
+    },
+    {
+      "sha256": "e3f57b923229010519b60d6032b195fbe5b544b33e2f44281c504fae4c4a88eb",
+      "path": "__tests__/go-doc-directives.test.ts"
+    },
+    {
+      "sha256": "e8dc40898b45404720c76d004955b7fce53bfbd533fb35930f2c706ca48d5567",
+      "path": "__tests__/go-dot-import-field-type.test.ts"
+    },
+    {
+      "sha256": "ee440ca5f4fde814957a15f9dec64bd1bab8b53d8688eb7b5cf67bd13c65d703",
+      "path": "__tests__/go-embedding-no-override.test.ts"
+    },
+    {
+      "sha256": "11f7e19bdb628013d411f2aab34ede1ccc23dc29f35814accf4280cf0f995980",
+      "path": "__tests__/go-external-package-qualifier.test.ts"
+    },
+    {
+      "sha256": "89e348d34fc26ee12062400ecae3cda5e252b5ad5b2cea0d0adc992c48091f35",
+      "path": "__tests__/go-external-test-package.test.ts"
+    },
+    {
+      "sha256": "9f7a63772584882290cfc2d724dec89fe16bd13b03717b12c6c318827a6acc34",
+      "path": "__tests__/go-framework-own-package.test.ts"
+    },
+    {
+      "sha256": "a6d1e4e32c9c9349535d5943ae39545e7755b8fc9bb08af601124db5c51a941b",
+      "path": "__tests__/go-func-field-dispatch.test.ts"
+    },
+    {
+      "sha256": "3bcfbaec599983de6ca40594191e8fefa90840d82ccf6080ceffd9012a646a0f",
+      "path": "__tests__/go-grouped-const-docs.test.ts"
+    },
+    {
+      "sha256": "8e9551ec849442b099debcceb2fc96d15b33fec8a3438e2d2d9a8bcdbe0262db",
+      "path": "__tests__/go-implements-arity.test.ts"
+    },
+    {
+      "sha256": "c78f8ea0874b254130a7a3f32cfe2e72c81f8f65aa684078f0268e206aa73b96",
+      "path": "__tests__/go-implements-defined-types.test.ts"
+    },
+    {
+      "sha256": "6987567ea8856dd6285e00c99d0c9b6f6630aacc0ff09fa2f3c27fd656058162",
+      "path": "__tests__/go-implements-embedding.test.ts"
+    },
+    {
+      "sha256": "5043052999f1e646c40a273f25a6ff59ece856e02e22a5f658e915ecf291619c",
+      "path": "__tests__/go-implements-stdlib.test.ts"
+    },
+    {
+      "sha256": "203c64597969f840d6038f0174f1545b6647d3547e3f621f8411e634179897d0",
+      "path": "__tests__/go-implements-types.test.ts"
+    },
+    {
+      "sha256": "a3ed90269d8cfdae62b6a0ee2d16b39713bb934bd6eab613b9a26991064c04b3",
+      "path": "__tests__/go-implements-unexported.test.ts"
+    },
+    {
+      "sha256": "e72b17e88dc59c07e4da9288c39c7cb0ac6012bc9a391b66f572d86b75d07db8",
+      "path": "__tests__/go-import-alias-precedence.test.ts"
+    },
+    {
+      "sha256": "03e827ccf92bec9d2c90beb966ce3294d17e7747de21956b43ceab1de7ea0959",
+      "path": "__tests__/go-import-package-names.test.ts"
+    },
+    {
+      "sha256": "50e8641fb8bb4d7132d392c68a4d55f9364dd6dd2d5195844e00724b589f4f8e",
+      "path": "__tests__/go-indexed-receiver.test.ts"
+    },
+    {
+      "sha256": "41498b900851e622cdd883acee295f7959dfa0889e3b17c41f122775a7722e23",
+      "path": "__tests__/go-interface-embedding.test.ts"
+    },
+    {
+      "sha256": "169731823d4b4eba5edffd495e6121183f3032a33b449ae55c998d62005601ca",
+      "path": "__tests__/go-interface-method-types.test.ts"
+    },
+    {
+      "sha256": "055cc553d7e73ede07170327b1300c4c4a4ae6ab515de5d1fbc5904ed544b727",
+      "path": "__tests__/go-local-shadows-function.test.ts"
+    },
+    {
+      "sha256": "d34fbe6eb38e131f58b8a0c85617da328bff3a237690f3bf4f942f23582c47d3",
+      "path": "__tests__/go-nested-module.test.ts"
+    },
+    {
+      "sha256": "0dc6a0ea3f9feaac2e0d1dd6de1e36eb1c5bd0bdfb390bc66496097ae2b94eaf",
+      "path": "__tests__/go-package-value-exported.test.ts"
+    },
+    {
+      "sha256": "504093844ff946a427bceac7fcb05ed18f209b3ff51988ab1f59e06a9fa90e17",
+      "path": "__tests__/go-package-value-receivers.test.ts"
+    },
+    {
+      "sha256": "7574a220c5b427b0aef363e04dc0b4fe007eedb13b8fac4c9217d4dec9df2d26",
+      "path": "__tests__/go-promoted-dispatch.test.ts"
+    },
+    {
+      "sha256": "b94a84fbb13938e51a2fdbf51b34233efc01a2dae0a204b493ef447c241631b9",
+      "path": "__tests__/go-receiver-type.test.ts"
+    },
+    {
+      "sha256": "d99bc47c731ca8e29742df9f46f5b4db5c1640373103b15e086c7b1c44941029",
+      "path": "__tests__/go-ref-qualifier.test.ts"
+    },
+    {
+      "sha256": "7b20a7dbe00a41c901002a2727ae901a893aba9f493a2f610aae347c9f0bf4e9",
+      "path": "__tests__/go-shadowed-function-value.test.ts"
+    },
+    {
+      "sha256": "f6dd832505fa1214c644e010a17159532560b01177ec8874d1928239554a8aa5",
+      "path": "__tests__/go-std-method-receivers.test.ts"
+    },
+    {
+      "sha256": "0d6a83bd90a6b4b0e428cb3afa3683c11327ee9a623bf1647c4efe2755514f31",
+      "path": "__tests__/go-stdlib-named-locals.test.ts"
+    },
+    {
+      "sha256": "9cb0e6e4d6e21861060a836e8a1b2c6fab56f9c511b3dbab5be9845ce132f0d5",
+      "path": "__tests__/go-stdlib-named-package.test.ts"
+    },
+    {
+      "sha256": "5b0f20da40e3164bc583ce0ebbdbf2c8e88abfd34a4191500d8ea2c36105fb32",
+      "path": "__tests__/go-struct-field-refs.test.ts"
+    },
+    {
+      "sha256": "cfe4540b25ef88db139da175831f0b24f22bdc2b2dd2bf908754c9e9b30c52f1",
+      "path": "__tests__/go-type-alias.test.ts"
+    },
+    {
+      "sha256": "22b2f410027593296448428ab0b5d749d6aef9fb5906630ec27e5939172f080e",
+      "path": "__tests__/go-type-assertion-calls.test.ts"
+    },
+    {
+      "sha256": "06099fb0293b5023ae4df10c6ef388eae17637f0e196e8370377bc0039b15bc3",
+      "path": "__tests__/go-type-doc-comments.test.ts"
+    },
+    {
+      "sha256": "373af3fdc13e8d2e99662207be8b54bca4aad8262dcebc05e8a98c5c8c664727",
+      "path": "__tests__/go-type-position-kinds.test.ts"
+    },
+    {
+      "sha256": "93a7c20fd5b07db8655e5e0153042f92a8f3c026a4e7a04729f38186c1bb2bd7",
+      "path": "__tests__/go-unexported-namesake.test.ts"
+    },
+    {
+      "sha256": "b6063191ddcaff6a32e1886f6000472444c2cde0fa4e219fae3def292c3f1bb2",
+      "path": "__tests__/go-unexported-receiver.test.ts"
+    },
+    {
+      "sha256": "df911cb809a1a9f7b45acba93b5ea4833641ebb54adfed582435196e126b7c9b",
+      "path": "__tests__/go-unread-file-methods.test.ts"
+    },
+    {
+      "sha256": "ba3685d3328058c9a9e94d302da798659084cfe938ea9a1677224ea7bc289c8e",
+      "path": "__tests__/go-var-groups.test.ts"
+    },
+    {
+      "sha256": "902bd195185001f686c3dad377b70ac1a9fc61f65ea0bbf173275d19663a808e",
+      "path": "__tests__/goframe.test.ts"
+    },
+    {
+      "sha256": "232bdde0ca60161177f77b5debc8eb294dea6d21cde5643f3627475ddda3f04f",
+      "path": "__tests__/gradle-kts-dsl-calls.test.ts"
+    },
+    {
+      "sha256": "480b6f5a32771d78865459f68c9444e03617d81c52ea4e02100670193d9ba04d",
+      "path": "__tests__/grammar-load-failure.test.ts"
+    },
+    {
+      "sha256": "016fdc39b54ad5b43de13a4af613556996d5aa3b2ebda5c39e2fe63c486a6ef1",
+      "path": "__tests__/grammar-wasm-bytes.test.ts"
+    },
+    {
+      "sha256": "d7d6accc305be5d7ca69601a23ad6bac690a7a2d0c0e34a18c83fe9043828175",
+      "path": "__tests__/graph.test.ts"
+    },
+    {
+      "sha256": "8f2d81eca88b5528696657f269e7183fe8fa8b97a4aa8c851a645e5d5600d848",
+      "path": "__tests__/identifier-segments.test.ts"
+    },
+    {
+      "sha256": "c0556a2498c3d873780d0c0c3ee6273f617efa4ec1b73943b7420a4539c5295f",
+      "path": "__tests__/import-default-as.test.ts"
+    },
+    {
+      "sha256": "0784bf2a2b6b5cfa71dafaba2240bb8a023c06838862e47b3c0b9c49b2533e9d",
+      "path": "__tests__/import-emitted-specifier.test.ts"
+    },
+    {
+      "sha256": "1a27ddf604202cac773d278a878fa8e9d52bbbf3f635094272a0f0e6465a1174",
+      "path": "__tests__/import-object-member-namesake.test.ts"
+    },
+    {
+      "sha256": "e662847acd6e217f955b414527ad43da6c4ff06be62dc9f903eb9c16f72e197a",
+      "path": "__tests__/import-path-spelling.test.ts"
+    },
+    {
+      "sha256": "bfb9ff5d833831d357e0e4d30e6528e38be847097cabb5e0013e77f8411677a2",
+      "path": "__tests__/import-type-modifier.test.ts"
+    },
+    {
+      "sha256": "e6c6fcecc95aae10812976d12c6924e97f490fbd07a13712de4c49ed6759432a",
+      "path": "__tests__/include-config.test.ts"
+    },
+    {
+      "sha256": "ae5e386f58a9098b98fa7c66d6566cd57a9ba0406ef66fff83af5dfb3d47d83c",
+      "path": "__tests__/include-ignored-config.test.ts"
+    },
+    {
+      "sha256": "ebd1236a83f490af9cfa62b5f0faa3c39dad12a80012659034f3168fffb780b8",
+      "path": "__tests__/index-command.test.ts"
+    },
+    {
+      "sha256": "af29d5eec56f91a715ae54da152fadb47894830217e60378a6e29cc07e1a0f9c",
+      "path": "__tests__/index-daemon-rebuild.test.ts"
+    },
+    {
+      "sha256": "408d5b9e001c25c7f0acdc7de525d1be45fa56038911f5e68414a21dfc899b86",
+      "path": "__tests__/index-files-write-lock.test.ts"
+    },
+    {
+      "sha256": "ffff50765b5c8307f076a0c9cc1b12aa115a1404e6c92b3859d59cd88d4b0bc0",
+      "path": "__tests__/index-gone-tracked-files.test.ts"
+    },
+    {
+      "sha256": "e8eb71b4658ca3a95e93d28fe676fd0c8bb50169d01fc5b1bb4cb9471f51f056",
+      "path": "__tests__/index-orphan-watchdog.test.ts"
+    },
+    {
+      "sha256": "ca2898d443acf97063cbf828b5771661c2eae923d320abf26c228b37c4e2b2fd",
+      "path": "__tests__/index-recovery-off-thread.test.ts"
+    },
+    {
+      "sha256": "bfd87859bb5b5da8173b88fe31011f7459042216222ac434cf410559a821d01a",
+      "path": "__tests__/index-store-failure.test.ts"
+    },
+    {
+      "sha256": "65501b011669a7c808675244131194b6115912cd34ea60c2d69f1d4eab1ca014",
+      "path": "__tests__/inherited-class-method.test.ts"
+    },
+    {
+      "sha256": "0b2cf509a38d2d8d70f0a6bbbb76dbdd08c3e3a72a1b9d415d79e4e83bb21662",
+      "path": "__tests__/install-ps1-version.test.ts"
+    },
+    {
+      "sha256": "7bd417cbd73d401ebeb7eca88e9c29ad23cdef5b9381f343a563915074ef6aba",
+      "path": "__tests__/install-sh-prune.test.ts"
+    },
+    {
+      "sha256": "7d6b4aadbb1ef54cb56aab471a410d439a689b349ce61522bbf832fa1bc49dc2",
+      "path": "__tests__/installer-links-simulated.test.ts"
+    },
+    {
+      "sha256": "70e2a4156a87650f6e79596ba9b420e2895f594d6b29a7c6a80a5e7b8eef1a3d",
+      "path": "__tests__/installer-targets.test.ts"
+    },
+    {
+      "sha256": "41e3d887a9bfd3c6739ba758b98c7ea690a836bec94b26480b3b313d2ecf626f",
+      "path": "__tests__/installer.test.ts"
+    },
+    {
+      "sha256": "b58ab6c9cdd9e5a6c7207898716644ace77fd324d4ddb9676d9953ea4c082891",
+      "path": "__tests__/integration/full-pipeline.test.ts"
+    },
+    {
+      "sha256": "0741adb0c5eae700b116cd3944ee0b3db7105197a8c20935e4ea8d5384382481",
+      "path": "__tests__/integration/lru-cache.test.ts"
+    },
+    {
+      "sha256": "50cea728de59a9f6b51115c7c6e4d07e517bc2cdd3f0e3952867342e07a3205a",
+      "path": "__tests__/integration/mcp-input-limits.test.ts"
+    },
+    {
+      "sha256": "0cf547a13b1a748db9617dddc95bfc7ca0643dc06de1a4bdeb6af93452ead231",
+      "path": "__tests__/is-test-file.test.ts"
+    },
+    {
+      "sha256": "6a20687573daa73ef0249c2642b5d9ac13904bf73662536f7544db66eb5a4a9f",
+      "path": "__tests__/iterate-nodes-by-kind.test.ts"
+    },
+    {
+      "sha256": "1144fb49509caf9c8ac1ca16a7aeabc78b1375cafe9ef67a044b9850e8ec5bb4",
+      "path": "__tests__/java-bare-call-scope.test.ts"
+    },
+    {
+      "sha256": "faa2358b5e0eddf01b9e5cf6cb23f2206d1554656197d151f911014cb1deb0f9",
+      "path": "__tests__/java-declared-receiver.test.ts"
+    },
+    {
+      "sha256": "55e091ce8fd8e13a4eb626d919e3edfd06bffe370dcd339fe7784aff1fd49445",
+      "path": "__tests__/java-outside-imports.test.ts"
+    },
+    {
+      "sha256": "e3c5143036159b5182ac420413d25d0cf5bd3c342d5d1c98f90399f09b019ba5",
+      "path": "__tests__/java-overload-arguments.test.ts"
+    },
+    {
+      "sha256": "76d524c4a7928dd2ca70fa4dbb2278339d114afc9c260ca198fb2e208523cc79",
+      "path": "__tests__/java-receiver-type.test.ts"
+    },
+    {
+      "sha256": "73839b16dde8082b8765a4a2ef1b58ddddfa34248099c0a619fd7cb2d1675385",
+      "path": "__tests__/java-records.test.ts"
+    },
+    {
+      "sha256": "a22232a334efb1e60bd432bc336ee9ce20c9f64581c9890dd6a215d5b932479e",
+      "path": "__tests__/java-static-field-receivers.test.ts"
+    },
+    {
+      "sha256": "87ca7d8e574b4ce263dbc32115295469e9cd9316182fc80beaea79581d64e796",
+      "path": "__tests__/java-supertype-reach.test.ts"
+    },
+    {
+      "sha256": "2d29c2a753592d4cff8f30fdf2458d54cabb8f4d40db35f71c2cdb6e46ff40c7",
+      "path": "__tests__/java-type-name-visibility.test.ts"
+    },
+    {
+      "sha256": "fabc20b9b6899efc93c4369cd08bd17a9b9165ffbee0e77e1c43e25177509344",
+      "path": "__tests__/java-value-reads.test.ts"
+    },
+    {
+      "sha256": "500228b7ce9477fdeb21416998db6d3bad19c8f572b89de4e481a954376c5e92",
+      "path": "__tests__/jest-manual-mocks.test.ts"
+    },
+    {
+      "sha256": "c5cb00134b9c5cd37072e3a4f3fb8c621c15cc840b21f64b377d5148abf3a603",
+      "path": "__tests__/js-braceless-statement-call.test.ts"
+    },
+    {
+      "sha256": "c62b83010aac4a3d265518334c2b08aed201aad09f4b8750e1802ee2c335f004",
+      "path": "__tests__/js-builtin-method-calls.test.ts"
+    },
+    {
+      "sha256": "722b1f130c47cc723dcd07e23a23267cd9a1fa13f4a79d1cca657a173bf2f620",
+      "path": "__tests__/js-class-expressions.test.ts"
+    },
+    {
+      "sha256": "541f1ddd1d3f45f11b1d81d21e426491f0f99f39f82a3108ba76ceec8a334f23",
+      "path": "__tests__/js-default-binding-members.test.ts"
+    },
+    {
+      "sha256": "01455007665fc98d744eaee7014e07c93e1112ec927b8c523fdcf39c02606b45",
+      "path": "__tests__/js-function-local-binding.test.ts"
+    },
+    {
+      "sha256": "893f95e1329ff806195246bab1c5bc4e74e9093eef5d6299c9fc0ac95a6b1aa2",
+      "path": "__tests__/js-imports-ts-modules.test.ts"
+    },
+    {
+      "sha256": "04b63ca1c3e30f6b63487ee59b6e567017905c4d8b8801f0b1ae10df0c3c93b0",
+      "path": "__tests__/js-local-binding-backtracking.test.ts"
+    },
+    {
+      "sha256": "e67b7a6584e359d50057a35ae221b1ab5e8fc5d267d749d54ea6c75252d9567b",
+      "path": "__tests__/js-member-guessing.test.ts"
+    },
+    {
+      "sha256": "b80617f589b104b268466a943d6d70003e2155e9d674a6908a4f803be8cea5ae",
+      "path": "__tests__/js-object-literal-members.test.ts"
+    },
+    {
+      "sha256": "a662ff64ae5018659cd8d1714e1ec74d8909e370b6ad0cd82b2ce498e94813f3",
+      "path": "__tests__/js-prototype-member-guess.test.ts"
+    },
+    {
+      "sha256": "c03959f831eab91e087e0c0e22e9125334e6a06cb6479b65cf52853cff594036",
+      "path": "__tests__/js-receiver-binding-scope.test.ts"
+    },
+    {
+      "sha256": "bc86aa4bfcf5a45215678cf2510a697d07d5183bbe62b8956bd068137558b0c8",
+      "path": "__tests__/js-resolution-work.test.ts"
+    },
+    {
+      "sha256": "5e3de8db687bcdbe0023937c74dc857db9f46a5d513fc8d9263db9d88563f96f",
+      "path": "__tests__/js-static-override-dispatch.test.ts"
+    },
+    {
+      "sha256": "00a6421b8f026321e63ab4a04e03971d62f6eff39b94f9bfb82a1abdaa9c579e",
+      "path": "__tests__/js-super-calls.test.ts"
+    },
+    {
+      "sha256": "1110180027e18f1cf6d4f59a38d79fa581e924836db99093016a6f7f4621f56d",
+      "path": "__tests__/jsx-child-disambiguation.test.ts"
+    },
+    {
+      "sha256": "d3c26a168153f18d3365681f9acfb5358397d7084de79c73353034a19e326449",
+      "path": "__tests__/jsx-override-dispatch.test.ts"
+    },
+    {
+      "sha256": "70a84bbc7a91c67cb1b26d6efc6d648538d9736121abe8f4f835c36e7fcae5e3",
+      "path": "__tests__/jsx-package-imports.test.ts"
+    },
+    {
+      "sha256": "c7ade03ad1e2cf790395fa504d01c94a13b0bb2530d51b00cf447f264ad3aab1",
+      "path": "__tests__/jsx-render-outside-function.test.ts"
+    },
+    {
+      "sha256": "1f865bbcff64fc4be4aa8ac13bfabd7334bb7274fd190b061246767ac716018a",
+      "path": "__tests__/jsx-render-work.test.ts"
+    },
+    {
+      "sha256": "7939cf37999fd17429ec019624bc89d3ac2e2a1899e5348147becb4d35d70e21",
+      "path": "__tests__/jvm-cross-language-imports.test.ts"
+    },
+    {
+      "sha256": "af9f35fc594d8d18bb4cf259cf1641060aa113bdf029a95270c78ebf6d3a289b",
+      "path": "__tests__/jvm-dotted-supertypes.test.ts"
+    },
+    {
+      "sha256": "f5fa6486269c9398f4189075f3a4f28b7a40bb4fb44734d3f42cb94fa25fbf24",
+      "path": "__tests__/kernel-ccpp-parity.test.ts"
+    },
+    {
+      "sha256": "2c2dcbfada26414daa0e3e5bef04d3ccef47bbc94d0c1d19369b3ad0bcedfe12",
+      "path": "__tests__/kernel-csharp-parity.test.ts"
+    },
+    {
+      "sha256": "740855e1bf1dc968c666600829997ba99f298e70b0df2f386db16a18e9abf7ed",
+      "path": "__tests__/kernel-dart-parity.test.ts"
+    },
+    {
+      "sha256": "d8e5be74c9b77b6a89853419c92bd864bc23912fb6e762e31768e447e2d96111",
+      "path": "__tests__/kernel-deep-nesting.test.ts"
+    },
+    {
+      "sha256": "cffb54393c84e8c9d26b8ec751f0edf99863d59882cb7c5a5ae99c87188d4ea2",
+      "path": "__tests__/kernel-grammar-parity.test.ts"
+    },
+    {
+      "sha256": "34e277e5d7cf1551ba9c6756c9eb0c16ffff79ca43a046199f804824721b9a84",
+      "path": "__tests__/kernel-kotlin-parity.test.ts"
+    },
+    {
+      "sha256": "519a6d8955eaed2ec2e929cc037831fb82eb375672da1118813e823c51b106ba",
+      "path": "__tests__/kernel-lua-parity.test.ts"
+    },
+    {
+      "sha256": "6a56db11c8a49e276e23463c90d8db0b70b96f64ea2a2c254d21589e140ea825",
+      "path": "__tests__/kernel-node-id-parity.test.ts"
+    },
+    {
+      "sha256": "e126ffdcb53e9a16878d834b89a78454cbeb4c33760f12408a2dd83976b74e25",
+      "path": "__tests__/kernel-php-parity.test.ts"
+    },
+    {
+      "sha256": "834374c3ef305f07f8174463f72f3f9ea45f9ad2b7e37f6cbc3242612e196d0e",
+      "path": "__tests__/kernel-python-call-fabrication.test.ts"
+    },
+    {
+      "sha256": "ab797ea66da99f85683779804314e8b108bd2bcaf4c9622f0ab93010055fe232",
+      "path": "__tests__/kernel-r-parity.test.ts"
+    },
+    {
+      "sha256": "1a3778e640f4873adbd773d0f1d19d5ecde3e47ff43bc433bb6135160b37102b",
+      "path": "__tests__/kernel-retry-materialize.test.ts"
+    },
+    {
+      "sha256": "34d92863d266d1b96a68b9e7a39680488453ed16fed9b1ed423b7d4084cb0506",
+      "path": "__tests__/kernel-ruby-parity.test.ts"
+    },
+    {
+      "sha256": "2621f56f4bd2cd5693e4d541685ee481572c41c1fcd25b40e6806fac6e9849f1",
+      "path": "__tests__/kernel-rustlang-parity.test.ts"
+    },
+    {
+      "sha256": "61db23d1ec40e6567a3031a01c17eead9f0a7424e887988916b1cbebeba61edb",
+      "path": "__tests__/kernel-scaffold.test.ts"
+    },
+    {
+      "sha256": "300bff6bd79635798e429b0daeed4960678c61044d603e44b45ffc3c029fd1b5",
+      "path": "__tests__/kernel-scala-parity.test.ts"
+    },
+    {
+      "sha256": "81087e2e53cce7be2b509110cdd918cd7b85f7cd005fe42060412d91bc6a5a94",
+      "path": "__tests__/kernel-swift-parity.test.ts"
+    },
+    {
+      "sha256": "5bd01ea19561a2050bff8b9efc50a4bb54aa365715be49f06ee6999b88c70e12",
+      "path": "__tests__/kernel-tsjs-parity.test.ts"
+    },
+    {
+      "sha256": "a9bab980ba61ac02776bc0521fceb94b7bc1120bf1d6b8885ca8406fc15fb1ef",
+      "path": "__tests__/kotlin-bare-member-scope.test.ts"
+    },
+    {
+      "sha256": "3412612293e2b9bc8f621c98c29062f007ab732c0aa6a59962148f8abbf08b98",
+      "path": "__tests__/kotlin-call-result-receiver.test.ts"
+    },
+    {
+      "sha256": "1a4c16bdc1d6b452276604d3f36ddc7837456b7792bea7d2061f13b1c1dc4729",
+      "path": "__tests__/kotlin-expect-actual-callers.test.ts"
+    },
+    {
+      "sha256": "7a390bd82a13b47221f825ddc961e5ca805eac02140144f88148183012b24d71",
+      "path": "__tests__/kotlin-extension-on-imported-type.test.ts"
+    },
+    {
+      "sha256": "2bf511a4942d1ea610e947f4944e9783ed310869fb67e2d73d661da3d81c5883",
+      "path": "__tests__/kotlin-infix-calls.test.ts"
+    },
+    {
+      "sha256": "4b018b2c4aa15c25c0cf7f0248881f20290bb543188bc726e6d2232ffb43f6f4",
+      "path": "__tests__/kotlin-infix-e-parse.test.ts"
+    },
+    {
+      "sha256": "cf5de25e716242b794022c1b34fde441e3988667aba5673935ba003bf35d504a",
+      "path": "__tests__/kotlin-lambda-receiver.test.ts"
+    },
+    {
+      "sha256": "bccef615640615d47f718157a69156360966d0c078aef576ef12b3806b42b664",
+      "path": "__tests__/kotlin-newer-syntax.test.ts"
+    },
+    {
+      "sha256": "464719cfac0d4071511515809e30de6bcdc17e6f0353bf3e30af94bca4f27818",
+      "path": "__tests__/kotlin-property-receiver.test.ts"
+    },
+    {
+      "sha256": "761ff15867125d6c1b89f85469996d05f6666f2e5bd4723945c07ba83be3840c",
+      "path": "__tests__/kotlin-split-constructor-std-chain.test.ts"
+    },
+    {
+      "sha256": "675ef8df5838bb7ae61b46e805359fc16ff9116fd6a727f4fda5152a0197756f",
+      "path": "__tests__/kotlin-top-level-visibility.test.ts"
+    },
+    {
+      "sha256": "a0f4aaf037e9d2c0515874dc18caadc3db08fa8ba4a321a3864539c0dd0d56f6",
+      "path": "__tests__/kotlin-value-holder-chains.test.ts"
+    },
+    {
+      "sha256": "0bc208b9a486555c1fd0a8d7cae51681ab75fff18e9dbee44cd45ab1980a1329",
+      "path": "__tests__/language-extractor-hooks.test.ts"
+    },
+    {
+      "sha256": "461fa7ee99cb01fee2d75430e5f1c6a97f69dfd7855ef3160ea5184e18d5b67f",
+      "path": "__tests__/laravel-controller-strings.test.ts"
+    },
+    {
+      "sha256": "d435feba5f3867aac65dba07fbfe4f60e1458e4c1e480f6ce684d7bd12984d21",
+      "path": "__tests__/laravel-event-synthesizer.test.ts"
+    },
+    {
+      "sha256": "e77ca2fd4fd6376eb866fec6fcb94516c5cc26e51e4e5e9c08f2e7e9c7387175",
+      "path": "__tests__/laravel-route-paths.test.ts"
+    },
+    {
+      "sha256": "b3bfd4b718f87bf9d82494b255066161293097d604c7c92688f2fde86195759f",
+      "path": "__tests__/large-corpus-regressions.test.ts"
+    },
+    {
+      "sha256": "993115995d34f0356edead8615a8760aa512eddfc7a4356ab0a82606d8745459",
+      "path": "__tests__/lazy-engine-eager.ts"
+    },
+    {
+      "sha256": "03691cd343e280d135d381110ae49965829f407ac9af3f17bd7fcc7732545008",
+      "path": "__tests__/lazy-engine.test.ts"
+    },
+    {
+      "sha256": "23ec16af703075b9e92b643fe47af334ff0b0ecddbef2d2e3ed66f365a486210",
+      "path": "__tests__/lazy-frameworks-eager.ts"
+    },
+    {
+      "sha256": "117d2b9bb4f24f00739f6965108aa2724887fe844e3b308c9f65fd8a1bc9b492",
+      "path": "__tests__/lazy-frameworks.test.ts"
+    },
+    {
+      "sha256": "92c74240b9f2abb5e5cbcdbdc2d11336cc836bc084a9d317d85252382ffa839b",
+      "path": "__tests__/library-method-calls.test.ts"
+    },
+    {
+      "sha256": "e9427efdb9bdea858db94546efd1cd0d59d3e19816fd0c533dfb1743d473630b",
+      "path": "__tests__/library-receiver-calls.test.ts"
+    },
+    {
+      "sha256": "ec21eaf42475588bd21f473f9ba5a92d5b198fd74a0ee87fe4ccd539b25168cc",
+      "path": "__tests__/liveness-watchdog-projects.test.ts"
+    },
+    {
+      "sha256": "a2ec0ee75f7fe3ad64e9277686eae2131759f9877387f7d7538eecccd16bf3b4",
+      "path": "__tests__/liveness-watchdog.test.ts"
+    },
+    {
+      "sha256": "b36d6622c91041de0fc2a21f699c9d750c254aa8d3ac6013c22eef540327bd25",
+      "path": "__tests__/local-only-gitignore.test.ts"
+    },
+    {
+      "sha256": "fc635a3bff4d739accb36cde21725143c8a5df07afd1143301c3755d10742908",
+      "path": "__tests__/lombok.test.ts"
+    },
+    {
+      "sha256": "b6b4ee9a9830b7fa0a252fccab0ef6179d5d75d84576dd000c0e59c3e24d3eae",
+      "path": "__tests__/lua-bare-builtins.test.ts"
+    },
+    {
+      "sha256": "726eff7c40dc4243db78d293ab8a77a7befe716a7fbd3885863fc7014d32af5b",
+      "path": "__tests__/lua-library-calls.test.ts"
+    },
+    {
+      "sha256": "753857b17fa6df4e4bbb602ea181328e8a60b8e02491c54b1d042388c8be26cf",
+      "path": "__tests__/lua-local-alias-calls.test.ts"
+    },
+    {
+      "sha256": "2fa492da00cec4f35e39690158ba797acdacd030fa62738f1ffd0cb9ef49a96c",
+      "path": "__tests__/lua-local-visibility.test.ts"
+    },
+    {
+      "sha256": "1120f7285e9853fa188c572537a3b2b42b6219eb6d5ac63eb5c55d5674eda813",
+      "path": "__tests__/mcp-callers-truncation.test.ts"
+    },
+    {
+      "sha256": "934a9395c6f0b9c972cf4e2497ae517bf4374f9064c5917a767f3a8c5a4f2290",
+      "path": "__tests__/mcp-catchup-gate.test.ts"
+    },
+    {
+      "sha256": "cb3c2fcb38f3dc91265c091a46e51c8e0dcf2005529fb5834514d70f5bdafff2",
+      "path": "__tests__/mcp-daemon.test.ts"
+    },
+    {
+      "sha256": "4e95340dca85f405080514901fc65093a1dfbd65015abc3e20350a9add16f837",
+      "path": "__tests__/mcp-debounce-env.test.ts"
+    },
+    {
+      "sha256": "f2abc7eb58e939c21605fab5c3a969df8a095d03b56702143c319cbaa3a9c849",
+      "path": "__tests__/mcp-files-path-normalization.test.ts"
+    },
+    {
+      "sha256": "99cfd3b64032fe431085e30262f45e5f506b7a7f3af1abc32fc9cf284935bf7a",
+      "path": "__tests__/mcp-freshness-bounds.test.ts"
+    },
+    {
+      "sha256": "f7dcc2259b185b6414fadf24447aa1c77dcd7475a6c4d6424a9a444001a10d2e",
+      "path": "__tests__/mcp-idle-release-order.test.ts"
+    },
+    {
+      "sha256": "a97538b9516f1a7a70b1563f282dd256ba425f9dd47cb0da299f1f9f22e885b6",
+      "path": "__tests__/mcp-index-version-warning.test.ts"
+    },
+    {
+      "sha256": "20f4b01299967dfa19f24a63c2ee202e762cc41deb8a81c0a06740605d8df83e",
+      "path": "__tests__/mcp-initialize.test.ts"
+    },
+    {
+      "sha256": "d2b1f1aaad742952283c6a67ef5f9c4001eb5dc3be3fcbae1ecb1967e7aaca9d",
+      "path": "__tests__/mcp-nested-repo-projectpath.test.ts"
+    },
+    {
+      "sha256": "379dcb1ce8eb76db80c4d512ff1372d1ccf4ba9debea1cd9d6673f0f84ab81fb",
+      "path": "__tests__/mcp-ppid-watchdog.test.ts"
+    },
+    {
+      "sha256": "42c7c0330a7ef9b4400969e2745e7a35fb130a1579d3f1cb0dc713e75399c3b6",
+      "path": "__tests__/mcp-projectpath-file.test.ts"
+    },
+    {
+      "sha256": "e4b2a7756ff5c5652d9bec809a93d3f9c078f93575cf5086e6b9fa6c64710217",
+      "path": "__tests__/mcp-projectpath-lifecycle.test.ts"
+    },
+    {
+      "sha256": "383357691ce734050eab6f3959a92d2ea23a81b30773b5e10edf4f57af5faa4e",
+      "path": "__tests__/mcp-require-project-path.test.ts"
+    },
+    {
+      "sha256": "48514feb38595dd10dc90ba48cf46643fdf4e5dfdc5ddf23dfc784a690cbef05",
+      "path": "__tests__/mcp-roots.test.ts"
+    },
+    {
+      "sha256": "278d43b839c2f389ef592d30cb41d7c619ebd4b3fc115d1a628c49f5e49c8566",
+      "path": "__tests__/mcp-server-discover.test.ts"
+    },
+    {
+      "sha256": "520eacab14cf3dd75ee4540a18868b92b4afe90dd3cf0e4097a8ef5792c77e01",
+      "path": "__tests__/mcp-stale-refusal.test.ts"
+    },
+    {
+      "sha256": "d9d3b3e3c06f8a21a4e9eb55d2e58942e7ada0c166e145997e02e71aee2af754",
+      "path": "__tests__/mcp-stale-slice.test.ts"
+    },
+    {
+      "sha256": "e7e53b1a8ee2d522ea5cf8a18f4e8652821b6bfea612596efd118d92994e85fa",
+      "path": "__tests__/mcp-staleness-banner.test.ts"
+    },
+    {
+      "sha256": "092000bf520e7a7bb08f8b8f8596121aa29905ac9adda3bc3da25044c6e7e913",
+      "path": "__tests__/mcp-startup-orphan.test.ts"
+    },
+    {
+      "sha256": "5053468afaf49d16e3a6d5624e8065ce5e0c0fb69da2f25fcb3da66f107399a7",
+      "path": "__tests__/mcp-status-freshness.test.ts"
+    },
+    {
+      "sha256": "ce6a590db76b564ef009335b530cca000cffe222f2954e56ac9c0e4af602a97b",
+      "path": "__tests__/mcp-stdout-failure.test.ts"
+    },
+    {
+      "sha256": "bc5c9c6953d80a3573e4fdb037c07fb6ab2b75e051f131fea0f42f790126c599",
+      "path": "__tests__/mcp-subproject-adoption.test.ts"
+    },
+    {
+      "sha256": "fd5642c45b76a351663bc64983c4c9ff2cec2bb4ad93f24bf62c2451a6d4dcba",
+      "path": "__tests__/mcp-tool-allowlist.test.ts"
+    },
+    {
+      "sha256": "8c0c574f038388fb82716255e3a050dcc198821d6c280a842679f78acfea535b",
+      "path": "__tests__/mcp-tool-annotations.test.ts"
+    },
+    {
+      "sha256": "26554efb4dae4cfe0e853fa1c68f770b8fb73431c9bcf8d2a32ec6bb91543e90",
+      "path": "__tests__/mcp-tool-call-arguments.test.ts"
+    },
+    {
+      "sha256": "da2c9f7f9cc3d4351b4500b58c203fdb7c6293a8f1fe218e5991eb8c6c075506",
+      "path": "__tests__/mcp-unindexed.test.ts"
+    },
+    {
+      "sha256": "d5cc4d779b0d288ca17343a7c570b46f63026982b2a6a753d05e1841223a1fb4",
+      "path": "__tests__/mcp-writer-lock.test.ts"
+    },
+    {
+      "sha256": "92a2a906d4c55d63faee0df0477ac8a9374a261c4ceac146ab7c13d9ff88af02",
+      "path": "__tests__/mediatr-dispatch-synthesizer.test.ts"
+    },
+    {
+      "sha256": "12e832ef6be3b3824db43214ace21d0e790429631d2e8f9540c44cfd7ca283fe",
+      "path": "__tests__/member-function-ref-owner.test.ts"
+    },
+    {
+      "sha256": "a9936d7b5dc175bc97085ebe682c0316ab86b35b9159c5ac1d26c672d2dc80e5",
+      "path": "__tests__/method-call-owner-class.test.ts"
+    },
+    {
+      "sha256": "d6a37c49ad0f5ffd0e51fda9a33e6be4a6bfa79e82b7546e852d2ada5be51bc4",
+      "path": "__tests__/migration-concurrent-opens.test.ts"
+    },
+    {
+      "sha256": "24ae4b25d940b700cc800967fab58a8aead137a9769cf325c4c03e1542798f77",
+      "path": "__tests__/migrations-synthesis-json.test.ts"
+    },
+    {
+      "sha256": "14cfd0d61de36ed5eabb47fcdec4796062d483d320d482a3236e78f84013a332",
+      "path": "__tests__/minified-call-targets.test.ts"
+    },
+    {
+      "sha256": "be5a7ce6e6ab9d0d57ee739414717a0fdb7947446de616fea64eec2dbae5a0ca",
+      "path": "__tests__/monorepo-app-frameworks.test.ts"
+    },
+    {
+      "sha256": "69cd7cee6bc736ba6e000298000a9b86fd49674441783241f429318be31b5975",
+      "path": "__tests__/mpeg-ts-not-typescript.test.ts"
+    },
+    {
+      "sha256": "86c24d6a52bf644c4c644d91dabafbfe9d518ccdd8530b6233a10b828b6b2980",
+      "path": "__tests__/multi-repo-workspace.test.ts"
+    },
+    {
+      "sha256": "83b393ddd4c419bc56c05a765cb39cbe480a28743cff634bd86b5e7e1180f2a3",
+      "path": "__tests__/mybatis-extractor-robustness.test.ts"
+    },
+    {
+      "sha256": "655f86597bae1f58c7c6c9589ba278a43fae90c48f8f17354a9e6bf86664c2f9",
+      "path": "__tests__/name-lookup-index.test.ts"
+    },
+    {
+      "sha256": "efc5d2b51bbcbeeb3aef6d3e3a02421eb3b9e4d339da4b33f6184912e3a28c1d",
+      "path": "__tests__/name-match-language-family.test.ts"
+    },
+    {
+      "sha256": "3ac785251e6da7cc820950d6a0d1d6fef10526ea022d9811d6b048a6d71e04d0",
+      "path": "__tests__/name-matcher-memo-clears.test.ts"
+    },
+    {
+      "sha256": "ae1d89b7b718985bf3b076007af6c8584be787246e07b8db40c9f7826cf397cd",
+      "path": "__tests__/named-reexport-module.test.ts"
+    },
+    {
+      "sha256": "44ae511379fcdbece4d5346940cadc3fef405ff03414a00ce6f9d9455eee3ca7",
+      "path": "__tests__/namespace-object-resolution.test.ts"
+    },
+    {
+      "sha256": "121c85d25c51cde7507af61f9ac2b6b89bcb1aa99dc97bde261169315bc60f55",
+      "path": "__tests__/namespace-reexport.test.ts"
+    },
+    {
+      "sha256": "d37f44bb77ac4d823a4122bf83e56f30f52b0ee2109f68053254b115647b9c0e",
+      "path": "__tests__/nested-declarator-functions.test.ts"
+    },
+    {
+      "sha256": "e93cda8f1229d6c82622b04cfd276f2291122f2470ad678165ef92e7a97ec4ac",
+      "path": "__tests__/nestjs-global-prefix.test.ts"
+    },
+    {
+      "sha256": "aac0367a13b9d4e7975c2d49c1f2802203db47a749ab5053dd56f940529e62c3",
+      "path": "__tests__/nestjs-provider-same-file.test.ts"
+    },
+    {
+      "sha256": "944422bcad168a9756808406e2b49c62e6b4e78eab6b651d7a1a7379b4d95a17",
+      "path": "__tests__/new-expression-receiver.test.ts"
+    },
+    {
+      "sha256": "24ed110061fc886e62f8d9b22c0371faa9245d69f721bff64e40102eaa6ab7ee",
+      "path": "__tests__/new-receiver-twin-classes.test.ts"
+    },
+    {
+      "sha256": "66df6123b9075067fca839d8dc6e83804466e461bc1b0cc1f7318ab6fd4f9df6",
+      "path": "__tests__/nextjs-proxy.test.ts"
+    },
+    {
+      "sha256": "4659b8441e206d11d9ce01e3d51f08f77a156913a002bd8de53033d561294b4d",
+      "path": "__tests__/nextjs.test.ts"
+    },
+    {
+      "sha256": "c38561ddd4bf60c5e376ba28f3268f226055f5dddf2233b8f13289490e4a76a1",
+      "path": "__tests__/nix-option-synthesizer.test.ts"
+    },
+    {
+      "sha256": "87568a086ca50c4f2991379b40b2c41ce49e5586c15a262c36ad6e2a42990e9c",
+      "path": "__tests__/no-silent-fuzzy-symbol.test.ts"
+    },
+    {
+      "sha256": "4d0f50420d3108373db1d8eb661415b8f4b76c37316f0b00de317450c57cde3f",
+      "path": "__tests__/node-file-view.test.ts"
+    },
+    {
+      "sha256": "100641f7eb954d5376f516a4da20be27f0a7926a18f796f3925deed554f2df8d",
+      "path": "__tests__/node-overload-spread.test.ts"
+    },
+    {
+      "sha256": "75aab60cdccee4560c88676526d54df395b60c3c273eb36a1835416ce5dbf9e0",
+      "path": "__tests__/node-rows.test.ts"
+    },
+    {
+      "sha256": "5faa9beadab2fd06a773670ff03ae78502ebb1ff9d3a972af80c12553345900f",
+      "path": "__tests__/node-sqlite-backend.test.ts"
+    },
+    {
+      "sha256": "9774e57f8b0114872db368cd98f400ad0714e38513ecba3fa6e15ebbc54a7493",
+      "path": "__tests__/node-version-check.test.ts"
+    },
+    {
+      "sha256": "b81f393ccb8bd6b5041604f788702e1de181c145c6a88c2fd8672eb318472380",
+      "path": "__tests__/npm-sdk.test.ts"
+    },
+    {
+      "sha256": "c437ee9a46f5f31b39eae0312293b20a09ed79d343de3cc54c3a43bdf54d7e71",
+      "path": "__tests__/npm-shim.test.ts"
+    },
+    {
+      "sha256": "fdd960d6aae08d457bd7f35daac7108faca81e8bb0ac64ce73d4d3da3b642d30",
+      "path": "__tests__/nuxt-navigate-to.test.ts"
+    },
+    {
+      "sha256": "739fd46c279c02a44ba043ea90c643ca458eb9a53b98ae0bfb54e79632fe4d98",
+      "path": "__tests__/objc-declaration-types.test.ts"
+    },
+    {
+      "sha256": "0dfc92bc87c64cdc894c9574dd4b84d0f3ca36395409e2a798b12b11cd910389",
+      "path": "__tests__/objc-file-scope-variables.test.ts"
+    },
+    {
+      "sha256": "743eab4252f106a439684eccc64a774dc37795148f05df86232d2acffb110b1f",
+      "path": "__tests__/objc-implementation-docs.test.ts"
+    },
+    {
+      "sha256": "2287dbc502dfc51e4ab2ee2cc80630f9e506bea2886b6f94f064627577033639",
+      "path": "__tests__/objc-lone-macro-lines.test.ts"
+    },
+    {
+      "sha256": "536210737c42240b3e4a15568df1a17474c4f0ddc5fc5ba706f5a1b27c3c56a5",
+      "path": "__tests__/objc-member-type-refs.test.ts"
+    },
+    {
+      "sha256": "2becf0ac3087cc16f659460e000e7fecd1832920346f3a448b180a396d51c068",
+      "path": "__tests__/objc-message-scope.test.ts"
+    },
+    {
+      "sha256": "f986ea25b252bdcc23a4af45b0b0d36d56aae5a9baa472ecfa81486b90cbe493",
+      "path": "__tests__/objc-same-name-protocol.test.ts"
+    },
+    {
+      "sha256": "abf60e8c4f0eb6bab16ddcb617ad8e877bdb161ae9ae63c0f3d7cd23b64e0f0f",
+      "path": "__tests__/objc-super-send.test.ts"
+    },
+    {
+      "sha256": "0373426380fd273fcacfaa08962acdda9b090bf2b75200e8c3377d6ae6f3b83d",
+      "path": "__tests__/objc-typed-receivers.test.ts"
+    },
+    {
+      "sha256": "43bade5803431694b22bb6c595b9511c7be35a13e2e6654bf90e9753bdc6d42b",
+      "path": "__tests__/object-literal-methods.test.ts"
+    },
+    {
+      "sha256": "7525b643c5dc03b0ca4c3c9787b830dda866eafc0372db76a3854c26fac28df0",
+      "path": "__tests__/object-registry-synthesizer.test.ts"
+    },
+    {
+      "sha256": "f3bf98e3c935e12617b28327845f40b494f3ee81ca9329dbe2659d779a661235",
+      "path": "__tests__/operator-method-names.test.ts"
+    },
+    {
+      "sha256": "dce84e458d44bf2dce4d1a60f5d4c93e684bd10a54788eed443e9c08a88cde8f",
+      "path": "__tests__/orphaned-refs-sweep.test.ts"
+    },
+    {
+      "sha256": "3ff5133f36e7224ecd858f7bdb6a2c53e54f772bceb3abc7c69d852ded6b7cc5",
+      "path": "__tests__/out-of-repo-import-shadow.test.ts"
+    },
+    {
+      "sha256": "27ba21f7f22cea11048cc08315cfe64816a14e24f991598da6aab5d9e4a07495",
+      "path": "__tests__/override-overload-pairing.test.ts"
+    },
+    {
+      "sha256": "fbd194bde98954d8d9055672f767b308d501d3030f8744e5189b6cd23a2b79ad",
+      "path": "__tests__/oversize-file-not-read.test.ts"
+    },
+    {
+      "sha256": "8d38dfb13902da3a8c3648243eb259e192f425783bd195fdce84ba09f66f94af",
+      "path": "__tests__/owning-package.test.ts"
+    },
+    {
+      "sha256": "3b0f1516d68c78930a7854078e338e7706c5853d603be0a18f535fc8930a2933",
+      "path": "__tests__/package-deps.test.ts"
+    },
+    {
+      "sha256": "e193579c08d905083a575ec8587389513a6c0a92de763bae51411b0080e1af02",
+      "path": "__tests__/param-default-calls.test.ts"
+    },
+    {
+      "sha256": "0de855717b487826c148955ce1950ff4c4d0feca7f11797269cac70507a25dbd",
+      "path": "__tests__/parameter-flow.test.ts"
+    },
+    {
+      "sha256": "afa5bd4ce295280e542636739afd3e3bda97829d1f7dccafc5a3dcff7a50e183",
+      "path": "__tests__/parse-pool.test.ts"
+    },
+    {
+      "sha256": "ecfa42fde4942214a3a9f41afeee83303febf07f020affee4895e5c6dd75e9b2",
+      "path": "__tests__/pascal-chained-calls.test.ts"
+    },
+    {
+      "sha256": "d00fa3713386b28abe36aaec999d568c0058922307b639fdcfec650054c26afb",
+      "path": "__tests__/pascal-delphi-syntax.test.ts"
+    },
+    {
+      "sha256": "5e52ef82e506f77e2805c312bb4b71f8e540b52d779872377deb65c183eec70b",
+      "path": "__tests__/pascal-for-in-var.test.ts"
+    },
+    {
+      "sha256": "0b644933d393ab3e3a50333374f5598bf75252be2531a0af36a5fa9cfb1bc1b9",
+      "path": "__tests__/pascal-inc-detection.test.ts"
+    },
+    {
+      "sha256": "ef5c9f4ab126170550ff7bb40eac0c41db0278478d5b1a4a74ed01576712bc7a",
+      "path": "__tests__/pascal-nested-routines.test.ts"
+    },
+    {
+      "sha256": "c181fe8be66a54f09a6446e3d56258f7a466c15fa7df11951ca299d0fb53cd9d",
+      "path": "__tests__/pascal-param-attributes.test.ts"
+    },
+    {
+      "sha256": "8057b65ec369943e7556d627a68e225f4b64a119416b041812aa2ecae45ae766",
+      "path": "__tests__/pascal-parenless-calls.test.ts"
+    },
+    {
+      "sha256": "85716f38883a564573e6225ba0bb37e7a4484e0787e0e85e3f284200cd84b549",
+      "path": "__tests__/pascal-reference-boundaries.test.ts"
+    },
+    {
+      "sha256": "6994512572e87de4e5e73e5e269080816328d10154fc574e9feb1f58acbe4480",
+      "path": "__tests__/pascal-system-calls.test.ts"
+    },
+    {
+      "sha256": "9240d19bd6c1aa5383e924b7ea7b564a4bbfb38003f8cb3ab5822b70cd402c70",
+      "path": "__tests__/path-alias-overlap.test.ts"
+    },
+    {
+      "sha256": "4f90d51955223824c9206a93d94b529bd1e7a12e4056d7ecbcaf58103a2d01d5",
+      "path": "__tests__/php-import-alias-static-resolution.test.ts"
+    },
+    {
+      "sha256": "c2a03e4d55ed138a47d4dd4ba168b871403231b3f1b3855b4a7cdcfa7d945d0b",
+      "path": "__tests__/php-namespace-alias-instantiation.test.ts"
+    },
+    {
+      "sha256": "f0734451c1370bb6d879924ef2d815281bc004f412b524f0085420cd055357a0",
+      "path": "__tests__/php-namespace-class-visibility.test.ts"
+    },
+    {
+      "sha256": "3b1746ba50878393923429284112335eba4f3f6e5e288eef25cf6f4635c6b112",
+      "path": "__tests__/php-property-receiver-resolution.test.ts"
+    },
+    {
+      "sha256": "ad6a26c3ac0c17205c0ddfe2af7b369b6599246b4c2fc5c90bb8a437b4d2d93e",
+      "path": "__tests__/php-receiver-class-ancestry.test.ts"
+    },
+    {
+      "sha256": "7e61f6ec7e4f29bee1e668e68af9e5a500f681b9f6709b83a80475ece42d9b47",
+      "path": "__tests__/php-receiver-guess.test.ts"
+    },
+    {
+      "sha256": "7565ee569ddcecab1e9bb8b18c0bb35958148b365314df82c9acf2534c40274b",
+      "path": "__tests__/php-this-hierarchy.test.ts"
+    },
+    {
+      "sha256": "9a2790393be6019f1295cc7e750e0d1302f3c9cd269231df022c07691914e6ad",
+      "path": "__tests__/pinia-store-synthesizer.test.ts"
+    },
+    {
+      "sha256": "33f96fb2ade35b74770c7c0b1818358b5a4970f6ed6aa42270bcb969d2e8fe1f",
+      "path": "__tests__/play-nested-projects.test.ts"
+    },
+    {
+      "sha256": "20e40d450de0e49378c1f06cca32ed06c069b54a5c87c7c1d88bbb644bb45553",
+      "path": "__tests__/ppid-watchdog.test.ts"
+    },
+    {
+      "sha256": "79520118d9edb00a16e3ecbf0a3539fbb049919ca7ee65a88ca314eac0366794",
+      "path": "__tests__/pr19-improvements.test.ts"
+    },
+    {
+      "sha256": "d1ec05c34786c0ee60827cf83d94f4f4b68b59145da8aefed161ec8c9e41b5ce",
+      "path": "__tests__/preload-languages.test.ts"
+    },
+    {
+      "sha256": "2f799695f10a3a5adca5ea550545253f2213d723fb35f714a687ab38e46606ba",
+      "path": "__tests__/prepare-release.test.ts"
+    },
+    {
+      "sha256": "574724ac9cec22da0bf5b200b887a35b60274491b9cb21f0d89953f815f3ae1f",
+      "path": "__tests__/prod-to-test-suite.test.ts"
+    },
+    {
+      "sha256": "f6fa3c483f377c599d242388f82b719cf766300f76dbeaa1fa97098a964bb6e1",
+      "path": "__tests__/proxy-connect.test.ts"
+    },
+    {
+      "sha256": "10aba9a5ff2f1bdf0fea3f22a5217109cddd53e57c69b5a6646a2a5edc5d3f2c",
+      "path": "__tests__/proxy-liveness-watchdog.test.ts"
+    },
+    {
+      "sha256": "969822bf5fe07d718aa9eb463613ccfdbe3e26bdf7537f58779e770ef51f8983",
+      "path": "__tests__/proxy-shutdown.test.ts"
+    },
+    {
+      "sha256": "f040cf7c16d97af2780455d84a59857a613812009b1910af9b9eda24e8a19b0d",
+      "path": "__tests__/pytest-fixture-receiver.test.ts"
+    },
+    {
+      "sha256": "30f0aeba933db4e3b8b0030f91d7fe665db4862e9e716a481740c01fe679b91c",
+      "path": "__tests__/python-attr-chain.test.ts"
+    },
+    {
+      "sha256": "97242c5fcc29a86f05fa0f26665016fb90aee7439864a52bc58bbabac4cea424",
+      "path": "__tests__/python-attr-types.test.ts"
+    },
+    {
+      "sha256": "8c32ef663db2ee55becdd0f124a41a34c264e56c68438d1c3d29b21d90058337",
+      "path": "__tests__/python-body-docstrings.test.ts"
+    },
+    {
+      "sha256": "f83dd6b8b9ed99deadde914986ccb518bc03bcbc5f1c7873eab75c8665f830e5",
+      "path": "__tests__/python-dotted-chain-target.test.ts"
+    },
+    {
+      "sha256": "647db4a87755dfcc85393d3cd1ffae679ed813577e2dd30c9f86c52170405578",
+      "path": "__tests__/python-external-module-receiver.test.ts"
+    },
+    {
+      "sha256": "77a9c362d33a6a1379a93a46390b982f99201999d353215cdfae269e02041f7e",
+      "path": "__tests__/python-from-import-module-file.test.ts"
+    },
+    {
+      "sha256": "5f68409a69d47c4fec3b18440cb7f6f5f4d2ac02a1676e70714ddfe356122c77",
+      "path": "__tests__/python-from-import-module-name.test.ts"
+    },
+    {
+      "sha256": "332bacf5746649888eb3ad1530afc1591723195acf5eda413f584c795588c8ec",
+      "path": "__tests__/python-function-value-scope.test.ts"
+    },
+    {
+      "sha256": "27f78d3fe3a9d124c780e036c4697a68cc9bfda8c9906cef6200d5e532412af7",
+      "path": "__tests__/python-generic-bases.test.ts"
+    },
+    {
+      "sha256": "89a6c03a4c1b7c31c51b9ddd02864fe7b9896122f40cdfea767cd4fd4f44e1f7",
+      "path": "__tests__/python-local-binding-order.test.ts"
+    },
+    {
+      "sha256": "27feb910c1217c156b6fb98b658a40400cecd1050681e1de4fc38f578626d1f4",
+      "path": "__tests__/python-local-binding.test.ts"
+    },
+    {
+      "sha256": "8f6a5c5cda292a7074716d85ae9c0a97000f7726c5b0cad95ce41c447fddfb3d",
+      "path": "__tests__/python-local-import-alias.test.ts"
+    },
+    {
+      "sha256": "1279dd5b6239ada59d20d0b989742aca00acb5d42de1a31467f11bb2950bd622",
+      "path": "__tests__/python-module-global-receiver-call.test.ts"
+    },
+    {
+      "sha256": "8df524a0c72b771e630feecbed3ee81eb36b767f8cea2a45bb2aebd5c4acedc9",
+      "path": "__tests__/python-module-resolution.test.ts"
+    },
+    {
+      "sha256": "7cc5a1269695482958f4117db9b559317b175f6fbf0fed726c58b27f3012c406",
+      "path": "__tests__/python-module-scope-collection-methods.test.ts"
+    },
+    {
+      "sha256": "fea1edc4d0e16a77588da3eeecb7f6cbff5d2778a188ad0d67694d3cbc4575c0",
+      "path": "__tests__/python-multiline-bases.test.ts"
+    },
+    {
+      "sha256": "7637db5b68d50bc356654580264bf3e0af207cb18d7c306cce994f9c396b751a",
+      "path": "__tests__/python-outside-bases.test.ts"
+    },
+    {
+      "sha256": "005e9b08f1b3ab4d6ca6a7e2b9ad0179453d403c62b688fc03ade2878d72f059",
+      "path": "__tests__/python-package-reexports.test.ts"
+    },
+    {
+      "sha256": "5a1b73fdac3ca847937a6f2f33a28e8bb5d7f084fe141fdaec9320074b66176c",
+      "path": "__tests__/python-pep695-bases.test.ts"
+    },
+    {
+      "sha256": "84bfe607e27120fc36db5090f187f952244e618ffb9d7b122ded04e228711be6",
+      "path": "__tests__/python-quoted-annotation.test.ts"
+    },
+    {
+      "sha256": "30aecb92a10b89a6c148ce1377c3feb5b0b8f33276cc301a3c83c1f555f9d66e",
+      "path": "__tests__/python-receiver-guess.test.ts"
+    },
+    {
+      "sha256": "728a4a141e16dfb3385c0911f60dd461c965528936c3031f8af03217bc606c43",
+      "path": "__tests__/python-receiver-guessing.test.ts"
+    },
+    {
+      "sha256": "3dc113b754dc7b7f6bab238b1877ddcf55643fccfae73d541a951e31ef8afd7c",
+      "path": "__tests__/python-receiver-rebinding.test.ts"
+    },
+    {
+      "sha256": "884fbfcc4aac9ac81203154a7eff46323b38d62b9221a595bdc0625497d729d2",
+      "path": "__tests__/python-resolution-work.test.ts"
+    },
+    {
+      "sha256": "479a717fecf021d382e38e251bae2b166809f6bb9db5ab690e3701861cdfd205",
+      "path": "__tests__/python-self-call-not-import.test.ts"
+    },
+    {
+      "sha256": "c248d4427c95a5752b047f4416b279fc34c29eb86e85f3471858c9737d2eadbb",
+      "path": "__tests__/python-subscript-receivers.test.ts"
+    },
+    {
+      "sha256": "1966e0673006a893eb00912fa0675112f22be7c34aebab7ed1bfbb983b1913ee",
+      "path": "__tests__/python-supertype-type-arguments.test.ts"
+    },
+    {
+      "sha256": "28dcbd9ea5c9b1bf3bb689c4bc30ee00f1a3c342036b3017bd212bc9763ca8b2",
+      "path": "__tests__/python-typed-builtin-method-calls.test.ts"
+    },
+    {
+      "sha256": "7651549468535e591c1425d0db185236f8902befd0a53d3d748330e1bf1fdb31",
+      "path": "__tests__/qualified-lookup-boundary.test.ts"
+    },
+    {
+      "sha256": "1598e927e7cfaab6cfc3376fdf571ef65799d53588b73c02615f132aff4624e5",
+      "path": "__tests__/qualified-name-boundary.test.ts"
+    },
+    {
+      "sha256": "5f527a2a417159f1fa0d69918df0d9e9fe601cabdbf266ca64d923a5c69a2474",
+      "path": "__tests__/query-paths.test.ts"
+    },
+    {
+      "sha256": "ab489f40e19579c141a380592f6ce129c7f0dfc7225c9b5ab1fa512ca12ccb14",
+      "path": "__tests__/query-pool.test.ts"
+    },
+    {
+      "sha256": "94b3066e94ec5369abc8b37d1805f95e3805d385b7498ffc59bd4692dbd18c0d",
+      "path": "__tests__/r-call-skips-data-binding.test.ts"
+    },
+    {
+      "sha256": "50eeaa23ef989287cb6b40399b3aec8e7c1139f45eb87dbc5fb48a9ee2fd404c",
+      "path": "__tests__/r-test-file-scope.test.ts"
+    },
+    {
+      "sha256": "c31220c3e4a8fa9448761caa3abd538494b1b5f4b104695942e1bff9cc65a5f3",
+      "path": "__tests__/rails-only-except-forms.test.ts"
+    },
+    {
+      "sha256": "f4cf09d691e906281efeb2bdb7d9173c5738cb8a57aa90cfc0a7a46908302391",
+      "path": "__tests__/rails-scoped-routes.test.ts"
+    },
+    {
+      "sha256": "d232d88735bc6c13441de381e0a768455704102551403ab4b9bd77cd15340263",
+      "path": "__tests__/razor-script.test.ts"
+    },
+    {
+      "sha256": "e4f52a7d0848c3910ee7fd105a50cdfbeb67ed879f15d3bffb8e5e922a4a08e7",
+      "path": "__tests__/react-heuristic-same-file.test.ts"
+    },
+    {
+      "sha256": "e89618981c45ec0bd9e310c3711b5bf908d4cb37d5e8a15f967a280ac8ac1bb1",
+      "path": "__tests__/react-hoc-component.test.ts"
+    },
+    {
+      "sha256": "6c31b50ddbfce18e14b6deb49086450aac29a8b30590d27215d0609287e76d59",
+      "path": "__tests__/react-hook-handlers.test.ts"
+    },
+    {
+      "sha256": "1968c178acc4d4cdb3e5965f786ce1e010a529c8f77d57737381737f069e1ddc",
+      "path": "__tests__/react-native-bridge.test.ts"
+    },
+    {
+      "sha256": "692c3d4355d368e2aa19533d7b4db5ce192c059b9f62005ca605ae4b4b10c895",
+      "path": "__tests__/react-own-declaration.test.ts"
+    },
+    {
+      "sha256": "a4832e229ad65c85af1b3648282f607e5324e59ed96b6571a56f4409a433d884",
+      "path": "__tests__/react-resolver-language.test.ts"
+    },
+    {
+      "sha256": "e390d55bd8996d0057de34f75c4cd3bc51e634ee1235525f1e77c42d6d673827",
+      "path": "__tests__/react-router-barrel-imports.test.ts"
+    },
+    {
+      "sha256": "e2b55917bd19bc0354ad7017a38f2e3d8cb3ae6692592ddb571a17aa6234f691",
+      "path": "__tests__/react-router-call-tables.test.ts"
+    },
+    {
+      "sha256": "a3ad832a9ea1f383fee22c00d4eaba715f33bde5e475ffb4a1758fbd347d7807",
+      "path": "__tests__/react-router-config-href.test.ts"
+    },
+    {
+      "sha256": "465ba726615a28bb3fc9904f8e8b7e99649b938d5059dab00e6ba1669a18a9ee",
+      "path": "__tests__/react-router-lazy-barrel.test.ts"
+    },
+    {
+      "sha256": "0d1c281d21b6323a580da63107154fc248c4aca99994f337931e89fe4962b260",
+      "path": "__tests__/react-router-lazy-member.test.ts"
+    },
+    {
+      "sha256": "fdd9363593d9cd9a29a36dbd06ffac042f2f125ac36bb7683951c661e76bbcd0",
+      "path": "__tests__/react-router-nested-lazy.test.ts"
+    },
+    {
+      "sha256": "93fd66e78644e1f7426cfae75893864e1e26673921731643ab960ca1720c6e89",
+      "path": "__tests__/react-router-outlet-routes.test.ts"
+    },
+    {
+      "sha256": "392aace846cafed3a8b743fd0339a3cf2384f49ad09f22e76fceee420c780f12",
+      "path": "__tests__/react-router-returned-tables.test.ts"
+    },
+    {
+      "sha256": "0cd2baefebcbb2dc1ea93bfd10d3bc232197e293f0b8e0f9b93c0618868a1061",
+      "path": "__tests__/react-router.test.ts"
+    },
+    {
+      "sha256": "5cbb9f0f4766bea6c92e4d9746a2f02b9c9f95bba51f45bedaf1331edda1632b",
+      "path": "__tests__/react-wrapper-initializers.test.ts"
+    },
+    {
+      "sha256": "88cc73386bee3239845aac6c32a6d86471eccd8f6c850fc13d641db13ef8c460",
+      "path": "__tests__/read-commands-during-rebuild.test.ts"
+    },
+    {
+      "sha256": "bb7e4e9ed5323660da8618129bf8baa7753399486bb04a90a0c38a2b74dd5da3",
+      "path": "__tests__/redux-thunk-synthesizer.test.ts"
+    },
+    {
+      "sha256": "819e3f667e9b1058dbe76a9af7e4e4aa3606ba9b4450bf6f14ec350e91014cb8",
+      "path": "__tests__/reference-target-kind.test.ts"
+    },
+    {
+      "sha256": "11cbcc5b8148596f1133f0aa01a4bc9cd2c0bcd4de5444b9a4cefdef2ce0380c",
+      "path": "__tests__/refs-by-files-spread.test.ts"
+    },
+    {
+      "sha256": "14a1bade80843a1a7cdec9fdff7cbac66e669989a5c62fef25d77fd3f2e2dda1",
+      "path": "__tests__/release-main-regressions.test.ts"
+    },
+    {
+      "sha256": "7c02743ec9fca8123aaf81bfad276726441240c8fadb3bf0e523615a5f8bb67b",
+      "path": "__tests__/remove-binary.test.ts"
+    },
+    {
+      "sha256": "d99478a6b77ed36bfd02462e927144e98b6da431e105f0bca124aa9e53708f82",
+      "path": "__tests__/require-default.test.ts"
+    },
+    {
+      "sha256": "b37139ff53675421385fb362287a7464e968d50dca0659de3dc915526c9b87fc",
+      "path": "__tests__/resolution-file-read.test.ts"
+    },
+    {
+      "sha256": "c1c5f5f160f9fdda5875ca05b08fd183673aac6eccadfd070214bf236f714e3d",
+      "path": "__tests__/resolution-fileexists-containment.test.ts"
+    },
+    {
+      "sha256": "c8b9f06a5019c6f8068c7ee85edadf204da427da7c13120bf702cc1d356ef513",
+      "path": "__tests__/resolution.test.ts"
+    },
+    {
+      "sha256": "0cd522ccb0d4e25992ee0bd52e35406924d97ebab8d6cdc0a0055859bf8766db",
+      "path": "__tests__/resolver-pool-pipeline.test.ts"
+    },
+    {
+      "sha256": "f66faa4d5b031d0f2f162278a4fb8a2b117af68a11e803131dc5e67056e4f38e",
+      "path": "__tests__/resolver-pool-sizing.test.ts"
+    },
+    {
+      "sha256": "c8f38e4c41e77b1dc4fc76e7ca11f19a66288190b64e0a32189412ea63ee2ac0",
+      "path": "__tests__/resolver-project-scans.test.ts"
+    },
+    {
+      "sha256": "bfbab76a2cd11898926405aec420afd7401bde6283b66ff9dd67c6291c142fff",
+      "path": "__tests__/resolver-shared-frameworks.test.ts"
+    },
+    {
+      "sha256": "eb9919d5447dbabe2db419ada575ac0e1dcb533ab244f518cca0f2953972c1dd",
+      "path": "__tests__/rn-event-channel.test.ts"
+    },
+    {
+      "sha256": "c734dc2a5c5412d7c9cfd6ba500f60b3609fc22c9af6c5f5518b7ab982c1dab5",
+      "path": "__tests__/root-identity.test.ts"
+    },
+    {
+      "sha256": "fa785179f9d3f594d61f6d32831dc9a38ea065195ccce8338a5fd2afda5d10b4",
+      "path": "__tests__/route-inline-handler-calls.test.ts"
+    },
+    {
+      "sha256": "c5525c5718f68f6b290f778770b06de7fdf04e43d1cb2582059730a3bef6009d",
+      "path": "__tests__/rtk-query-synthesizer.test.ts"
+    },
+    {
+      "sha256": "1c661527ad51934f0ab9d466ada3a634fdabed9982166d6c8fb05fdb0b2e1034",
+      "path": "__tests__/ruby-call-scope.test.ts"
+    },
+    {
+      "sha256": "d2ce19b37068b68ac99229f489d1bd3f0ad353505f74530aeee158108ad24c76",
+      "path": "__tests__/ruby-constructed-receivers.test.ts"
+    },
+    {
+      "sha256": "a3e58d6c0857b538111a0637806b59f3077b4c3a6fdc2896b5bca01995621b90",
+      "path": "__tests__/ruby-ivar-receivers.test.ts"
+    },
+    {
+      "sha256": "5853e09d88d4c20b24c6505f75ab2c74f7babfce72ef8dd104bb8c29bc108f61",
+      "path": "__tests__/ruby-namespaced-receiver.test.ts"
+    },
+    {
+      "sha256": "305f4fb7037a54a20a4a7b34174cad9a789cfec067eb2e27a5bb9de562ecc53b",
+      "path": "__tests__/ruby-receiver-class-ancestry.test.ts"
+    },
+    {
+      "sha256": "e64509c79f504c27d1b2cacb988cf38449ab5e0fa538158d894bb0310e55b5b5",
+      "path": "__tests__/ruby-singleton-methods.test.ts"
+    },
+    {
+      "sha256": "58e276a0cc11f082c5098b7519974a513789c72b60dc3d18610e043aea0236ac",
+      "path": "__tests__/rust-as-mut-chains.test.ts"
+    },
+    {
+      "sha256": "c9175e3248b6cfcd4ec0f30942005cdaf2a0c1da14ea64151ff439c4189c4562",
+      "path": "__tests__/rust-assoc-qualified-self.test.ts"
+    },
+    {
+      "sha256": "f743fb7ea6d2722975216124571e67ed7308c83406f01857f26a5d1f19df58d4",
+      "path": "__tests__/rust-associated-item-scope.test.ts"
+    },
+    {
+      "sha256": "7b0c9f5db368d863ce5886acf701f97389f5315c2ed673eb16e7727a15528e44",
+      "path": "__tests__/rust-crate-roots.test.ts"
+    },
+    {
+      "sha256": "40d1e927d4542d4ea81aa78fe7e875b97dccf55b01fde6420613010e1e00b79c",
+      "path": "__tests__/rust-cross-crate.test.ts"
+    },
+    {
+      "sha256": "9aa50e04d6df771183abcb1c975c6c7cf3786f848894788db61bf6202159cec1",
+      "path": "__tests__/rust-declared-type-scope.test.ts"
+    },
+    {
+      "sha256": "75c5f32e04d7c0e28e5b14b48ead363692a68a48517902b70f67f9592ac18007",
+      "path": "__tests__/rust-enum-variant-reference.test.ts"
+    },
+    {
+      "sha256": "ce4e9a5a8457378a2b6881bb6ecda93ec1efc27ff0ffad81a1ef8fbb4df5e39a",
+      "path": "__tests__/rust-foreign-impl-calls.test.ts"
+    },
+    {
+      "sha256": "97c3edd3b43cf0e2c3b3c88567ebf788ff27f6af7e0d858fd8f2a24effe621d2",
+      "path": "__tests__/rust-framework-name-scope.test.ts"
+    },
+    {
+      "sha256": "29d05bc7e0ced1f983a3e9dcb9c7e7099f3b315f5f2c4e9a99584540df74039b",
+      "path": "__tests__/rust-generic-bound-paths.test.ts"
+    },
+    {
+      "sha256": "b12be86206fb4d649d415e7f99aed268f89f4a6c32db8a23ebd92858a50b6279",
+      "path": "__tests__/rust-glob-use-items.test.ts"
+    },
+    {
+      "sha256": "bbce9fdf5c3f557c0b000580f4e6f028ce8329f65b5a7837fb3e5ca0795d8ee8",
+      "path": "__tests__/rust-go-call-shape.test.ts"
+    },
+    {
+      "sha256": "a24a363b43b73d3cfa561873138b932ca161b43a8fe73bc7816ca18b3973f6fe",
+      "path": "__tests__/rust-loop-tuple-field-types.test.ts"
+    },
+    {
+      "sha256": "df0934575f8a795df9300a0526cf88f7b71333a4524833beaa8fa9947d7ee5ea",
+      "path": "__tests__/rust-manifest-paths.test.ts"
+    },
+    {
+      "sha256": "49c0d1d06e1893ce08008509558b62fe2764e766de23f1a543460fbc9f8b73b2",
+      "path": "__tests__/rust-method-value-types.test.ts"
+    },
+    {
+      "sha256": "0609a6f38e218341522a265ed6a738649edc3104ebab1301cb6856303fc36733",
+      "path": "__tests__/rust-module-path-call.test.ts"
+    },
+    {
+      "sha256": "15f4d7b5565227dc52a43d601bfac7697363f846a78ab395dfb140af6c7a6a2e",
+      "path": "__tests__/rust-path-attribute-modules.test.ts"
+    },
+    {
+      "sha256": "0ac754f2a3b5fbbb2594ac58621811536272ae2ea2e3a9932e0e9f35b3ba7183",
+      "path": "__tests__/rust-path-same-file.test.ts"
+    },
+    {
+      "sha256": "1cd0fdd49621cc0de13138b0a6cb267c92537e95f5c49ea57988e967f8189b99",
+      "path": "__tests__/rust-path-super-glob.test.ts"
+    },
+    {
+      "sha256": "3d7ac19124bd070ebede03b6eb9d1b1e4edd6738d200e30b7628f8a49f41919a",
+      "path": "__tests__/rust-prelude-scope.test.ts"
+    },
+    {
+      "sha256": "32df0a9d68907970ce8d61baac63dc403efe28d78d56d2474b963843191f8228",
+      "path": "__tests__/rust-private-item-scope.test.ts"
+    },
+    {
+      "sha256": "d75e98589d0eb3246c55dd7cd22b42e6d49fb24718c701379b7bf96b1a6526e2",
+      "path": "__tests__/rust-receiver-chains.test.ts"
+    },
+    {
+      "sha256": "b87062422b2977bd73ee3f0e862074f4bb050144908fb04d05805c6e5ec636f5",
+      "path": "__tests__/rust-route-handler-line.test.ts"
+    },
+    {
+      "sha256": "09a98442358e86357c89f882925a4d756dfeb55248e3b6203f2c81525b758a27",
+      "path": "__tests__/rust-self-associated-type.test.ts"
+    },
+    {
+      "sha256": "cfae89c273ac00ea40695b709cd72e5dd9e7019420b5a2af71f34d8193bc9ebb",
+      "path": "__tests__/rust-self-field-types.test.ts"
+    },
+    {
+      "sha256": "a1ef3f8f7a86bb13215c88b5ef954f65373e9dd5849d14b62b2dc2c3df032601",
+      "path": "__tests__/rust-self-owner.test.ts"
+    },
+    {
+      "sha256": "074c58211c8e15207ec290a9e5b62dda8f7cef2e0fbe8872fa1616d17022c3f4",
+      "path": "__tests__/rust-self-path-calls.test.ts"
+    },
+    {
+      "sha256": "79ca2bd5cf4e7a4214bc9f4e09fd10604ce0ab9dea8faef4b52bc06c6cc48389",
+      "path": "__tests__/rust-turbofish-calls.test.ts"
+    },
+    {
+      "sha256": "e374e48c4b59b17bb8056dee65375ccb58c8618f2865e3e1db44e79e37beaec6",
+      "path": "__tests__/rust-type-member-paths.test.ts"
+    },
+    {
+      "sha256": "f6cfd4b1385c399ae7a618acc4b4af0da68af2fc1aa679e1d45c38981ffc353e",
+      "path": "__tests__/rust-type-scope.test.ts"
+    },
+    {
+      "sha256": "ffdbe454690682d7b60bb791552372cc2e0cf93aaa1569c23437f30a895e99ec",
+      "path": "__tests__/rust-typed-receivers.test.ts"
+    },
+    {
+      "sha256": "3007b1112712e985feec20a952728669da274fa54c1f73ae5654391392b9b868",
+      "path": "__tests__/rust-use-call.test.ts"
+    },
+    {
+      "sha256": "bb69a1bbf88cd812f9644829ddec373aeba68ad26c269c09996fcc85ae912a66",
+      "path": "__tests__/rust-use-path-module.test.ts"
+    },
+    {
+      "sha256": "aaef53b414b2b4c34a472500b1f37297bca977053228bbbd4cfd5b9fe5e33ae5",
+      "path": "__tests__/rust-use-scopes.test.ts"
+    },
+    {
+      "sha256": "be8efe825616a622bcb9bb2cdbe9f3a73810089abc2671ca6a0d16ae37e05420",
+      "path": "__tests__/rust-wrapped-self-calls.test.ts"
+    },
+    {
+      "sha256": "b05c4f2466c46933348b12ca47c54d35eb0a1b9ade7e916c41aaffa7ed304c4d",
+      "path": "__tests__/rust-written-receivers.test.ts"
+    },
+    {
+      "sha256": "70478f0f9ac9722df15e371235f0df8a95069daa0ae7ee9ceb45214edede6215",
+      "path": "__tests__/same-file-match-confidence.test.ts"
+    },
+    {
+      "sha256": "45734c194c4809496a0f824ca3f0aad05bcd7dfdeb6d80b4d090b16c9f54f653",
+      "path": "__tests__/same-module-copy-resolution.test.ts"
+    },
+    {
+      "sha256": "cf9fbaf84bed4a7d048ed80fb3830e0277ae13880b45d065fd976eaae8af983f",
+      "path": "__tests__/same-name-disambiguation.test.ts"
+    },
+    {
+      "sha256": "52f8ceaf54063cabec71a96dd393e1a6c2e22983505063debde1282b9e2170e6",
+      "path": "__tests__/scala-bare-call-scope.test.ts"
+    },
+    {
+      "sha256": "b0e661bcab959a55f498e91cb1f3860ee048d274f9c34074fdf16bba85bd9055",
+      "path": "__tests__/scala-block-locals.test.ts"
+    },
+    {
+      "sha256": "41ce737595262ae905996af9596b1c2281915204c3f785351f1041d3a2ef2319",
+      "path": "__tests__/scala-chain-object.test.ts"
+    },
+    {
+      "sha256": "34f14973a74d46a020fc65c99c88f559c54658d5d2231ddb438087645c939b36",
+      "path": "__tests__/scala-kind-projector.test.ts"
+    },
+    {
+      "sha256": "a60e49f31d5cac177a9af220122ba8f641b5cec89366c7667052a9f86d72e92d",
+      "path": "__tests__/scala-package-object-scope.test.ts"
+    },
+    {
+      "sha256": "05b2049c8848d905fffb11c1c92148f3fece4a491c0bb815709c5bf83627c280",
+      "path": "__tests__/schemaless-db-not-initialized.test.ts"
+    },
+    {
+      "sha256": "a405a97da910202f29fe56e14ec7bb4103aa8e845bb9f9172afeba33d09d034f",
+      "path": "__tests__/search-field-filters.test.ts"
+    },
+    {
+      "sha256": "365dd9395438f65bffa0c42c2dd27f6674c8d9e083226dd19759ab4d39c601b6",
+      "path": "__tests__/search-query-parser.test.ts"
+    },
+    {
+      "sha256": "cd61a4d3010455e6c4ad49749064c4ba8ae53d48f181786b9f4a0cedc26664aa",
+      "path": "__tests__/search-special-characters.test.ts"
+    },
+    {
+      "sha256": "4a2a1c1b022743e2dbc3c1f5cfabdf4c3c98640efab0cb14e4eb047c6d8ff6c4",
+      "path": "__tests__/security.test.ts"
+    },
+    {
+      "sha256": "2124aae3c1196cd5ecb7c88d29585649ee021ded2b989547ce81c44bfb3c91ad",
+      "path": "__tests__/segment-vocab.test.ts"
+    },
+    {
+      "sha256": "4684651aa4c93f48818689ec80edc6c96608069e754f456429536183406b139d",
+      "path": "__tests__/self-call-delegation.test.ts"
+    },
+    {
+      "sha256": "3e8b7841fb6390bb0700ff8ad5bdf28d31f642c74c1099c37e1e9fa159e67aba",
+      "path": "__tests__/self-overload-calls.test.ts"
+    },
+    {
+      "sha256": "aa18f2b315fb352a7d288671b6e7a052d64b28e2d9c54a08c7184ecfc8df5d55",
+      "path": "__tests__/serve-no-telemetry.test.ts"
+    },
+    {
+      "sha256": "8b1e3475df59f806355a3a91420d997cf5c4c5137f591ac76fad6a28624c1437",
+      "path": "__tests__/setup-home-sandbox.ts"
+    },
+    {
+      "sha256": "186e48e23d5c8905852492f2c1bc4f805610f21456cfdaf6d64ccd07d86ad054",
+      "path": "__tests__/sfc-alias-module-imports.test.ts"
+    },
+    {
+      "sha256": "1efeda1e53b25193d0b5f61a8c085c0714d70b6c3bad88f861b5bd010a1331fa",
+      "path": "__tests__/sfc-component-owns-script.test.ts"
+    },
+    {
+      "sha256": "797e9743ae49317706df26c018eee8ddfbd56d182d5543bd4de12b0c8fcb2cb4",
+      "path": "__tests__/sfc-private-declarations.test.ts"
+    },
+    {
+      "sha256": "dda0bff9a5d3a9a04d2fa8d1b2e9f867b21daf23a4d4f3e4f9c89e9048ec0901",
+      "path": "__tests__/sidekiq-dispatch-synthesizer.test.ts"
+    },
+    {
+      "sha256": "80f2065fa40e291c86d6036fdf5d4e56d399b207aebdbd62010771c9e9213a1c",
+      "path": "__tests__/solidity-erlang-call-scope.test.ts"
+    },
+    {
+      "sha256": "70f792c7ee8daa4da598e26faf7851d27a854af6f5b254e0de6c3b6ff3578bb7",
+      "path": "__tests__/solidity-overload-calls.test.ts"
+    },
+    {
+      "sha256": "0b78e0e82b1b117d2a5183601111574dbfe52f2dbc04077c3975d8676c0a8e80",
+      "path": "__tests__/sparse-checkout.test.ts"
+    },
+    {
+      "sha256": "c286a1cecaffa36afdfc771dac3f5a20be8c3b5351f8ee9b1350e996dc4ceb4b",
+      "path": "__tests__/spring-event-synthesizer.test.ts"
+    },
+    {
+      "sha256": "34605f85625f50f1239302c017f56f288169af4e965c6f2493b0f0f3be0dcdf6",
+      "path": "__tests__/spring-model-name-scope.test.ts"
+    },
+    {
+      "sha256": "bd940a88af78c47970c877892e0d91cdf96ab77ec00860da567b2d98636df18b",
+      "path": "__tests__/spring-route-handlers.test.ts"
+    },
+    {
+      "sha256": "1a1e7142825d960089a1d0ab4810a173da4a0d5f381e470459f45bdf4420b745",
+      "path": "__tests__/sqlite-backend.test.ts"
+    },
+    {
+      "sha256": "71674421cdf6a9f786d6cd292652a14ae83f8e72a19d84297a68ffbe1366867c",
+      "path": "__tests__/sqlite-open-error.test.ts"
+    },
+    {
+      "sha256": "ba841fc44c429978285c4a92c794093ebab3722573dd97bb2a4197b0167a4137",
+      "path": "__tests__/src-build-folders.test.ts"
+    },
+    {
+      "sha256": "bc2041c1ceb7023bda5b67deeae9e66a3e5d3759a60829b8c6e31466db918e22",
+      "path": "__tests__/startup-handshake.test.ts"
+    },
+    {
+      "sha256": "a9311830328e0b0256cda28b882c50b30663a22436d5b00f13aaf761396c6939",
+      "path": "__tests__/status-during-rebuild.test.ts"
+    },
+    {
+      "sha256": "a8816f7a4b89e63f87d0f995fc3950a41e1cbfebd54d71a3efc7c237303e5c34",
+      "path": "__tests__/status-index-health.test.ts"
+    },
+    {
+      "sha256": "9a1ad7d80362b11f1135dd5262fcebf602c62065d356a8d81b794de376521c94",
+      "path": "__tests__/status-json.test.ts"
+    },
+    {
+      "sha256": "844d5382c62ad4c20e0e161d3518a0918f90f34f7ce59674d18031451b98a2c9",
+      "path": "__tests__/status-language-coverage.test.ts"
+    },
+    {
+      "sha256": "152f863abad0959c0708ccf5db48d4edbb3030042e7f7a095a507780b22e1dcd",
+      "path": "__tests__/status-sparse-checkout.test.ts"
+    },
+    {
+      "sha256": "d41d49d799e1521fb0a42d74fe964acddc59ea66e5d510292ea781e365650605",
+      "path": "__tests__/stdin-teardown.test.ts"
+    },
+    {
+      "sha256": "228d4e25444ab1643778119ac2e670c28fa9297484706691717551af5ca3fd99",
+      "path": "__tests__/stdout-teardown.test.ts"
+    },
+    {
+      "sha256": "43bbbdae047f7545436eace00b9f3463f7d5f37c2c3b60b520a428375332386b",
+      "path": "__tests__/steps-server-rendered-replies.test.ts"
+    },
+    {
+      "sha256": "804530099b8934c4f91240e4c05b6b2ec3c31210fe639b76ff2802f0b757bd86",
+      "path": "__tests__/store-binding-cache.test.ts"
+    },
+    {
+      "sha256": "0e75a7cfe807b0e220ef4d4def25f3d4db2ce13813a9a75bf661b3161a6b32b9",
+      "path": "__tests__/store-exported-later.test.ts"
+    },
+    {
+      "sha256": "f77811b3685dd09565dd3db2665cad9c36dd393f4f92db6229b0210b50cfa819",
+      "path": "__tests__/strip-comments.test.ts"
+    },
+    {
+      "sha256": "6a274c2127661dbba42cb7c3e6e3a4e534ad4fa8e540b715497d01a7876626bb",
+      "path": "__tests__/strip-cstyle-differential.test.ts"
+    },
+    {
+      "sha256": "03cef936a4aedcb9c098379fb8b451a09e8c0b867cea938bf38a9e7db06e27e1",
+      "path": "__tests__/subprocess-timeouts.test.ts"
+    },
+    {
+      "sha256": "b60c7bc2b7d2112251715decc24160f3f8299e9ef20ae68d5d65742ffa8ab4c7",
+      "path": "__tests__/super-call-self-edge.test.ts"
+    },
+    {
+      "sha256": "42c1f4808e99ca6f0a9174d919ca74d8ed45cf989989356737e8d0aff8aa45b4",
+      "path": "__tests__/supertype-not-self.test.ts"
+    },
+    {
+      "sha256": "f8ea8bfcab391170c01f57ab3bf3760175eb18c2b0817dfa7d1d9272c282b8fb",
+      "path": "__tests__/svelte-self-closing-script.test.ts"
+    },
+    {
+      "sha256": "51efa09a0a3dd3a74af27d49af9fc306ae25b7f3faac4d27e5a5f81f72a1ccb1",
+      "path": "__tests__/sveltekit-route-names.test.ts"
+    },
+    {
+      "sha256": "78cf6bd474dba313946d5095e005fa965c899fc935cff618ccf53826439fbbfd",
+      "path": "__tests__/sveltekit-router.test.ts"
+    },
+    {
+      "sha256": "9581956c2a913a56a6b0e895c62b054caf7507490395667d4d75768275f078bf",
+      "path": "__tests__/swift-call-shape.test.ts"
+    },
+    {
+      "sha256": "9af14ebf3d4bf77029908799b8cd7ceca8b8cef56fa360811f848192b4940afd",
+      "path": "__tests__/swift-composition-continuation.test.ts"
+    },
+    {
+      "sha256": "828630513cfb3ddcd2e805dc2c4048701e00cb532afc6e6464e9eca30a66b947",
+      "path": "__tests__/swift-constructed-receiver.test.ts"
+    },
+    {
+      "sha256": "face83e777666f31a3c42e7aad133bcb4031ed6e7cff02ba1168ae04706d1e42",
+      "path": "__tests__/swift-label-overload.test.ts"
+    },
+    {
+      "sha256": "246fd768589cb20e1e0196397167d3760c0443c6249544b9724e48e1aec8ac4d",
+      "path": "__tests__/swift-member-receiver.test.ts"
+    },
+    {
+      "sha256": "b4c0f15c8daea102f6ef9687f965b619daa431d77118bd0d530d4208398a4410",
+      "path": "__tests__/swift-objc-bridge-resolver.test.ts"
+    },
+    {
+      "sha256": "418231d2bb499079604b3bfd0793249b4296055569a0ba2d9d100afb537f3005",
+      "path": "__tests__/swift-objc-bridge.test.ts"
+    },
+    {
+      "sha256": "118e5994f323626984ccdb738504eacc04ea556d7a08b1c3b19afdd66e11f643",
+      "path": "__tests__/swift-overload-closure.test.ts"
+    },
+    {
+      "sha256": "e27ff9e8c4ea7deb558a6e10ab8b393d16f7a258a0009c12212c14f02ee5a6ca",
+      "path": "__tests__/swift-try-initialized-locals.test.ts"
+    },
+    {
+      "sha256": "815627573fb2c38e4e80bf7194ea2c3d48d3bddeeb052a1e135b6922b43fd317",
+      "path": "__tests__/swift-type-path-calls.test.ts"
+    },
+    {
+      "sha256": "6342c3ba9da16e731084b15f26a5dbd9321aa5bb40ee8a13ed2c59d7309c0b12",
+      "path": "__tests__/swift-type-visibility.test.ts"
+    },
+    {
+      "sha256": "3ee593c4c0d3cd529844d35a14f7f5d2d9ed67d1e3971047f5d75ea637a7c0df",
+      "path": "__tests__/swift-wrapped-call-receivers.test.ts"
+    },
+    {
+      "sha256": "54262db4f38bcec478b77b4c0cb374d8d7c90832e8e5ee7f68923924d6230e81",
+      "path": "__tests__/swiftui-viewer-noise.test.ts"
+    },
+    {
+      "sha256": "54abbf6519ababd710855bcebacd8892d117c27b1d97f4f0d190a81828adbdca",
+      "path": "__tests__/symbol-lookup-go-packages.test.ts"
+    },
+    {
+      "sha256": "7cb94e26c026830313a2e0286c91fbf50df3b8bbe79c12d2abcd51d11e9e3164",
+      "path": "__tests__/symbol-lookup.test.ts"
+    },
+    {
+      "sha256": "e8185f0159ddd21448dece349c40e22d32ea5da37bc13bf8f0314e9d06785487",
+      "path": "__tests__/sync-barrel-renamed-reexport.test.ts"
+    },
+    {
+      "sha256": "da0f8e37c3cbac641559bc06c97dfeddd3c6ce9e14a660b108293c97dff43d17",
+      "path": "__tests__/sync-barrel-retarget.test.ts"
+    },
+    {
+      "sha256": "42351ea6689d075d4b86699591b83b6a3446557b224c1e5585c3471e9f14f04d",
+      "path": "__tests__/sync-default-export-change.test.ts"
+    },
+    {
+      "sha256": "3e35b62f66f60071be0203352cc9f397733a95b34341818bf116e14fc571bb5e",
+      "path": "__tests__/sync-framework-detection.test.ts"
+    },
+    {
+      "sha256": "222d45844ee2fb108635080ca5b78005c1fd8c026e9213b2fbdb7da1c45f0005",
+      "path": "__tests__/sync-import-binding-retry.test.ts"
+    },
+    {
+      "sha256": "53ad4cf995d266bf8bfca4de3a1ef39598f503486f1ccac1c2e83260297407f6",
+      "path": "__tests__/sync-import-member-retry.test.ts"
+    },
+    {
+      "sha256": "e0fa77e09743e5bb8c5158a6d6790aeaa3621b814bdcf0edc9679470b38e7386",
+      "path": "__tests__/sync-import-retry-crowded-key.test.ts"
+    },
+    {
+      "sha256": "dd1aee2fc18da940a21b5ab3f6e429c1d7944c8f4d9b72735231301eda93c716",
+      "path": "__tests__/sync-import-retry.test.ts"
+    },
+    {
+      "sha256": "552c571a3053f53c165a024749684038e8553b8973bad261871488898ab4c183",
+      "path": "__tests__/sync-jsx-import-forwarding.test.ts"
+    },
+    {
+      "sha256": "fab35183131e2bf7e54bf27843236861d7e81d8d52281aab42bde54e65c41d01",
+      "path": "__tests__/sync-lazy-route-value.test.ts"
+    },
+    {
+      "sha256": "8c37b674dcbbc63dbf6ebd7a516d3cb102ff8750557403b32e071616cc22bd77",
+      "path": "__tests__/sync-memo-lifetime.test.ts"
+    },
+    {
+      "sha256": "a2d7ee966a0e60f71ffd30f8c7b5b9844cccae126c3a3b2cfb8b77b51748d50f",
+      "path": "__tests__/sync-module-config-change.test.ts"
+    },
+    {
+      "sha256": "6e13ca52d7014d94786d7f882ca03b589f2c3719c192d75e271ddf03ca52dd17",
+      "path": "__tests__/sync-module-importers.test.ts"
+    },
+    {
+      "sha256": "506e54f05fa492da8d20efe9af5b25722ec4ba58858f523594821ae1d6ba3fb1",
+      "path": "__tests__/sync-name-matched-imports.test.ts"
+    },
+    {
+      "sha256": "4739e439749206f2e8cd5ddedc70e91e263264cd7ba9db0ab3461c9b9cebfb9f",
+      "path": "__tests__/sync-navigation-retry.test.ts"
+    },
+    {
+      "sha256": "100383dbdc2737d928c8468a766f45ec2c609df5e35a560f84fba733ed050716",
+      "path": "__tests__/sync-nested-barrel-route.test.ts"
+    },
+    {
+      "sha256": "e2fbfcbd8f462a9a2c7b49b98d3eae195e3b466aead240842c84aa16450eba49",
+      "path": "__tests__/sync-path-reference-retry.test.ts"
+    },
+    {
+      "sha256": "545c579a74136c5f032adec7c663f8ec0119c385c9361bf8dfdb62a646e354e5",
+      "path": "__tests__/sync-python-import-binding-retry.test.ts"
+    },
+    {
+      "sha256": "d203ef7b6e3db0db7604a332288198819ffa9080872e144b2b4afbf177e8e297",
+      "path": "__tests__/sync-rebuild-convergence.test.ts"
+    },
+    {
+      "sha256": "16497509001595e492e829f59257b1e60076fe4f632d8a968b665d164402493a",
+      "path": "__tests__/sync-removed-competitor.test.ts"
+    },
+    {
+      "sha256": "7941ca3e2bcce50c81c13c4810c0b8388c73c934465cf40284546694be8609a1",
+      "path": "__tests__/sync-route-module-retry.test.ts"
+    },
+    {
+      "sha256": "da0f2cabf664288481626e8fed18ede5278aa63947c2f0361ca8d1b53a833d51",
+      "path": "__tests__/sync-size-cap-shrink.test.ts"
+    },
+    {
+      "sha256": "0ef74a881703e0a836e3d1e99dca13f36243cf7a223f982c21404bd26d66fa4a",
+      "path": "__tests__/sync-synthesis-input-package.test.ts"
+    },
+    {
+      "sha256": "48a491c24bb6d343c85946e3f8e582dbc2bacc8141867adf48aea67cf71bf7b5",
+      "path": "__tests__/sync-synthesis-inputs.test.ts"
+    },
+    {
+      "sha256": "a74ee4b2ff2f0e35ca686c72f9ac16c35aee0c35b653e8a1c17e9972198bb049",
+      "path": "__tests__/sync-synthesis-interval.test.ts"
+    },
+    {
+      "sha256": "eb321b00b2e07759f767adf25efaf9cb5428dcea232fcf456ca8e095177b55e5",
+      "path": "__tests__/sync-typed-local-member-retry.test.ts"
+    },
+    {
+      "sha256": "2209bbb7b17d009971fcccd468301d7185c6ed47a149fbc240b1ccc965c409ff",
+      "path": "__tests__/sync.test.ts"
+    },
+    {
+      "sha256": "7bdb7bdfb38ea4a5d5b1df34af53450334612b2850a4b74b8ed1404582819a59",
+      "path": "__tests__/synthesis-progress.test.ts"
+    },
+    {
+      "sha256": "fbbed0b94ea5d6db8c0937118999e655fe498eedb42c1807079b1d1219f6f992",
+      "path": "__tests__/synthesis-tail-scaling.test.ts"
+    },
+    {
+      "sha256": "44beca98a54abb63b29d240a16d9972ee7207f5d3d04b59dc05bfd6b2f914102",
+      "path": "__tests__/synthesized-hop.test.ts"
+    },
+    {
+      "sha256": "2d1654182893dc10019e0b0eebcdf447b700859d4950a5a89993128ae995d4ec",
+      "path": "__tests__/tanstack-router.test.ts"
+    },
+    {
+      "sha256": "2c083418ab15acc5fd15b1bd65bbcd8a8c0d34bbe128c845d4d98c61fe176334",
+      "path": "__tests__/tauri-command-dead-code.test.ts"
+    },
+    {
+      "sha256": "0b41b810f33353149c3af8d8a7fa25b752e1429ffa71ff5d55fbede91a89e9d9",
+      "path": "__tests__/tauri-ipc.test.ts"
+    },
+    {
+      "sha256": "fcaac48f82ae0cb8ee9595d101bcb5edcf3ebdd97b1e2de1b4fbcdf6343f7c99",
+      "path": "__tests__/telemetry-optout.test.ts"
+    },
+    {
+      "sha256": "032c1548ea94a5c6e50fb0d16882792bd594a1e3061a08b8bee4fa58a0e4290b",
+      "path": "__tests__/telemetry-services.test.ts"
+    },
+    {
+      "sha256": "7eb1cfcfea9e0995d836b18c46413abd0fec0b6ba7edcbceb0479f01c61a9d18",
+      "path": "__tests__/telemetry.test.ts"
+    },
+    {
+      "sha256": "617b6808c1d9516f1cb9e92e5633a1a6f72dedbf046cec05042b15c66886b411",
+      "path": "__tests__/test-double-unique-guess.test.ts"
+    },
+    {
+      "sha256": "ee2c0c21a21ff6aec7eddeaf0ef43bab2269b9ec99e04e159cac126f3404e2a4",
+      "path": "__tests__/test-home-sandbox.test.ts"
+    },
+    {
+      "sha256": "771ee95ad8c6e561251a7b1ffeeaf951e6572d79d4d5fa73e5d46d6d857b507e",
+      "path": "__tests__/test-request-edges.test.ts"
+    },
+    {
+      "sha256": "b0619764572ca0f4ff916dab775ec193d41b7cf90702dd5ce9d6c4ec3da282f6",
+      "path": "__tests__/ts-abstract-methods.test.ts"
+    },
+    {
+      "sha256": "6300cefdc5fc7f3f82d1c843220886a1b891596d63de557e8ccfaf2f9e1af8a4",
+      "path": "__tests__/ts-alias-typed-receivers.test.ts"
+    },
+    {
+      "sha256": "a4a91d46959f2856666b4e4baf71e2f550521c63f0f3ff6a636e75698c6b2311",
+      "path": "__tests__/ts-ambient-exports.test.ts"
+    },
+    {
+      "sha256": "1b44544e7fff3594292c0cba817dc21cd63d76d0bedd6b2be871ced99ec19446",
+      "path": "__tests__/ts-array-annotated-receivers.test.ts"
+    },
+    {
+      "sha256": "08d5c42c9228f4c9a7690207a5774cca707de8ca01983c8d87587dfcaf042d7a",
+      "path": "__tests__/ts-chained-receiver.test.ts"
+    },
+    {
+      "sha256": "cb7dd76d9b30708e82de3c5318628227cb1a31f3b7755022a71aac58a8d6730a",
+      "path": "__tests__/ts-dollar-method-calls.test.ts"
+    },
+    {
+      "sha256": "2097c5a88881533865038bea14395b0e59203f3623131e8ef919ae77844c7f3c",
+      "path": "__tests__/ts-export-type-star.test.ts"
+    },
+    {
+      "sha256": "e9da0816f0be41d8f432118fb3abd95192244fc90dc8dd854ec906444952e829",
+      "path": "__tests__/ts-field-classification.test.ts"
+    },
+    {
+      "sha256": "d194d3c39d88e64f4a8bf9ae266f71b7ddcc43fb1ea87404e8745b79d8423bb0",
+      "path": "__tests__/ts-generic-class-heads.test.ts"
+    },
+    {
+      "sha256": "92f673ddbfbecacdfa707c2450a948c18a07bc6ccee3522dfbd3767860b8d9e0",
+      "path": "__tests__/ts-imported-type-receivers.test.ts"
+    },
+    {
+      "sha256": "aba7246d7940487b314c66b4e04654278ec5bcdcd5d2f4c1c3de59ac9aa07137",
+      "path": "__tests__/ts-injected-receivers.test.ts"
+    },
+    {
+      "sha256": "f0f1b78c3b0b3b11684f32bb05bbfb89e750762f3e02886c102ea738fab5b7c8",
+      "path": "__tests__/ts-interface-extends.test.ts"
+    },
+    {
+      "sha256": "fb3f05c6460f75ddd2aa34fac41224c44da853b9583767a64057468e655048ff",
+      "path": "__tests__/ts-known-class-methods.test.ts"
+    },
+    {
+      "sha256": "09e31d836f7fa71b2d57db2885779db3ac3718b10f9f70ed44d4667e06e26e42",
+      "path": "__tests__/ts-qualified-type-names.test.ts"
+    },
+    {
+      "sha256": "dd3fb7c78ba88c1aca6befcdb6830d7bd25de673502cc69dbcee82cb82c1d361",
+      "path": "__tests__/ts-this-field-bases.test.ts"
+    },
+    {
+      "sha256": "bd5cc3fce2899d0849fc315e761e87707e047ea5855ea02d82b2b696e83fa238",
+      "path": "__tests__/ts-this-field-call.test.ts"
+    },
+    {
+      "sha256": "cfcc8b5e6c5e1ad18a04723dd69b60cfa5df119e98cd25eb13f2c0f83c683e30",
+      "path": "__tests__/ts-this-field-element.test.ts"
+    },
+    {
+      "sha256": "4ce90bc78829e4d68c87c48d1fcf000b2199138d8eb8c78443f701933bb7423c",
+      "path": "__tests__/ts-type-modifier-imports.test.ts"
+    },
+    {
+      "sha256": "69042e03d112efb4d4a6677c3c6646beb8d2dc379edc0c313cd8a00ef11c23a5",
+      "path": "__tests__/ts-type-reference-scope.test.ts"
+    },
+    {
+      "sha256": "9cc7690482c3eda646a210a4be8577d438450ae8ff1a1afde469dff11e7ed841",
+      "path": "__tests__/ts-wrapped-field-initializers.test.ts"
+    },
+    {
+      "sha256": "14730182512cb2f2e7e820ed0252a4cbcdf849f3572a5c54bb192656ef0403c7",
+      "path": "__tests__/tsconfig-baseurl-imports.test.ts"
+    },
+    {
+      "sha256": "47764dc7f916ba411aaf79b01bc94b05b2a03c67dd0dc74667526d6f1d09e7c7",
+      "path": "__tests__/tsconfig-extends-aliases.test.ts"
+    },
+    {
+      "sha256": "8aaf1ef8238568d127990426f46ad496ae19e70401584e0321364203344f9dfc",
+      "path": "__tests__/tsx-error-recovery-hang.test.ts"
+    },
+    {
+      "sha256": "4a455e535e32374dbe57c7ecc0f2ee5597c9948d2b3f5b6ca219298d257390bd",
+      "path": "__tests__/type-hierarchy.test.ts"
+    },
+    {
+      "sha256": "7f88a4f298704ccd470972d3ffa77f9715602146082932cd3a2e7d370c4548ac",
+      "path": "__tests__/type-parameter-refs.test.ts"
+    },
+    {
+      "sha256": "18fe0f6c0ee8b052680d7dfcef8048b522763bc29ab6af945bc9423fe2fc2ac8",
+      "path": "__tests__/typescript-grammar-fork-shapes.test.ts"
+    },
+    {
+      "sha256": "2ba3974034d2da6b960c100e1ad53f14ca15e3df29ccd500e56459fbab2e3ad6",
+      "path": "__tests__/typescript-member-asi-parse.test.ts"
+    },
+    {
+      "sha256": "bb2b2a3782d7cf2ce4526417c5f7139e2be3755e487c833cc1e2e6bfe6174c9c",
+      "path": "__tests__/typescript-variance-parse.test.ts"
+    },
+    {
+      "sha256": "61dbc7f855d99c470ea2c4d98c0746dee6d481899a5a4fb11ae5674687e6d417",
+      "path": "__tests__/ui-conditions.test.ts"
+    },
+    {
+      "sha256": "c66220a77a7086a557d71ecc26c7dbf21f9d558cfc10234b65b32b4ca0f6a0ed",
+      "path": "__tests__/ui-effects.test.ts"
+    },
+    {
+      "sha256": "5778a1764dce1553480e1e2f619c96a3d0c3cf96844e62fb8ef4eab80153be6a",
+      "path": "__tests__/ui-entry-model.test.ts"
+    },
+    {
+      "sha256": "303ac6164ed00d7fbb9a0a8b5f19b666b274ffa5d205955dd9dae6db1dc6f5a3",
+      "path": "__tests__/ui-entrypoints-api.test.ts"
+    },
+    {
+      "sha256": "25ec268880c6766e4b43cf9d303be30ee6adee0a99edb6a4cbfb7e8d57c541e8",
+      "path": "__tests__/ui-events-api.test.ts"
+    },
+    {
+      "sha256": "9a38dfb090b29fdd44c9972f8ded1db220141606b260f578b66b45306041e4e4",
+      "path": "__tests__/ui-export-svg.test.ts"
+    },
+    {
+      "sha256": "799455940ea8611a6ee84d439cbd069dcf1aa752556221015786efd150d0048a",
+      "path": "__tests__/ui-file-model.test.ts"
+    },
+    {
+      "sha256": "7399eb9c1c95657624f1ad03a54ae7e85c0e8677e526c98c3fc024ec1e7336f1",
+      "path": "__tests__/ui-filecode-api.test.ts"
+    },
+    {
+      "sha256": "8b4271206d45755b7d12b6d8d862c2d9c78ecbad70759e7a0deeb2adba7aa7a0",
+      "path": "__tests__/ui-filecode-model.test.ts"
+    },
+    {
+      "sha256": "4ebf22048f6ea5906f7e240fb65598d2e1bc7a6ae2df2bfc5e083cf8b06ff1d2",
+      "path": "__tests__/ui-flow-api.test.ts"
+    },
+    {
+      "sha256": "c18b82018a36316b2fc0b2b2750cf268c15bbc3f65099466fce88253caf1dbee",
+      "path": "__tests__/ui-flow-model.test.ts"
+    },
+    {
+      "sha256": "fecfebbff9f29ca6a1ff8b740e45b40957e32552b0fa4b3191719d26906cce46",
+      "path": "__tests__/ui-highlight-bounded.test.ts"
+    },
+    {
+      "sha256": "5aeeb06c177a848fdec110617b4b8e1df1e34ca24fbdbf09e1ebc6ef2f1491af",
+      "path": "__tests__/ui-highlight.test.ts"
+    },
+    {
+      "sha256": "af8fa46eeafa8c6f9d17c07bcfeee1f444c27298bb1852c65bc99796b6db0f61",
+      "path": "__tests__/ui-map-api.test.ts"
+    },
+    {
+      "sha256": "76eba9c12763a3573be220c9656758235d7e076c7edf110508e64eca2bfe52cf",
+      "path": "__tests__/ui-map-model.test.ts"
+    },
+    {
+      "sha256": "3b9dd6c3da4e47efb9c9b77bfa2288b9119c92b792d671db226ebf4bc473a79d",
+      "path": "__tests__/ui-package.test.ts"
+    },
+    {
+      "sha256": "758ff31d41e63c4720a47626f13bb01672ecc91e067a57ca2978bf48bf3d389a",
+      "path": "__tests__/ui-program-model.test.ts"
+    },
+    {
+      "sha256": "94a0a6eea3e4140c56902442e17e5cc75515f972cf6183247d6db526dc3c6ea1",
+      "path": "__tests__/ui-repeated-keys.test.ts"
+    },
+    {
+      "sha256": "64165ee70ba826ba8b2886381da869d7a39df54c2fbc540a778a26a3b8762aa0",
+      "path": "__tests__/ui-screens-model.test.ts"
+    },
+    {
+      "sha256": "fe95bda7540ea3d12adf3b9dc97b84ee76bbd7f71dd84c837782eae3bc1d1185",
+      "path": "__tests__/ui-search-model.test.ts"
+    },
+    {
+      "sha256": "b5075fb5eda277638915d6529028a0652bdc50ba321b3b78c5ebe10265b3a704",
+      "path": "__tests__/ui-server-api.test.ts"
+    },
+    {
+      "sha256": "fcdb37487b708c39f49abf0980359bc556f10e4cbb6b1b41d4efbe79dfd3e52e",
+      "path": "__tests__/ui-server.test.ts"
+    },
+    {
+      "sha256": "50b646add0ea8c9b4cd0089a698deb890a76143d5054b8c03654ae5f16a5e51c",
+      "path": "__tests__/ui-steps-api-servers.test.ts"
+    },
+    {
+      "sha256": "3f24d9ea97637bd90fbbcca8d1d616d6a5321404f7c8912e7260405f9158e38f",
+      "path": "__tests__/ui-steps-api.test.ts"
+    },
+    {
+      "sha256": "95bb5e3ef75464d4331e9b58e97546ce771f1fa2f2ed34fa177a145af296dbcc",
+      "path": "__tests__/ui-steps-cross-tier.test.ts"
+    },
+    {
+      "sha256": "95ba852eec62d2b860d36ec3aadfc04cd52d5dc098a1b59cb0c9a3c77df20b76",
+      "path": "__tests__/ui-steps-model.test.ts"
+    },
+    {
+      "sha256": "1aca8962c2b6eed985f7c0ca2dd634c827b8c8d3e08a701e06ec55bd31fdf531",
+      "path": "__tests__/ui-steps-program.test.ts"
+    },
+    {
+      "sha256": "1ae73285ccda386aecaee311f815c66b55eaf47c6623c34f5c32aefccc46afcf",
+      "path": "__tests__/ui-symbol-model.test.ts"
+    },
+    {
+      "sha256": "46175a56408a2f1b3e5ffa141beb1fa056d239cc360e0ec1437f164135998960",
+      "path": "__tests__/ui-trails-model.test.ts"
+    },
+    {
+      "sha256": "392d7d1b923c4ee25a22d890d6973945f26ffcfe3d8453884644921544a4b766",
+      "path": "__tests__/ui-trails.test.ts"
+    },
+    {
+      "sha256": "fef3f2eef002cdf4bbf8bc2f2e1d89d51b41c1159b9f7753be140aa6e26281c1",
+      "path": "__tests__/unittest-named-files.test.ts"
+    },
+    {
+      "sha256": "66d095ab546ae8a9fba14c28c0077b4a2abbbaf42cdd05d36e941c58685a6f4d",
+      "path": "__tests__/unittests-directories.test.ts"
+    },
+    {
+      "sha256": "33cda8e5165a705beb1238441f217dfda879787c0da859d871d1824818bdb394",
+      "path": "__tests__/unresolved-supertype-query.test.ts"
+    },
+    {
+      "sha256": "d1bc89fd216b10626ae891eaf7162b6dcb906ce8c4b4af0ab2af2723b625e0fd",
+      "path": "__tests__/unsafe-index-root.test.ts"
+    },
+    {
+      "sha256": "8830f52c0fe07057f6c63f63266379b368375ad490a8e2f23be10139e75a654a",
+      "path": "__tests__/update-check.test.ts"
+    },
+    {
+      "sha256": "3a64514a517dfe294dd625bc345ad3963907abe5b5bb3419ff6a00106915f3d9",
+      "path": "__tests__/upgrade.test.ts"
+    },
+    {
+      "sha256": "e6ca50851122c7491f78e274175bdb0a50a6b130ccb387c56030483919783a9c",
+      "path": "__tests__/value-reference-edges.test.ts"
+    },
+    {
+      "sha256": "1d3cec1f03d6ed04c971f2a07d1873c00772e1f71997d5da192580424b209fc9",
+      "path": "__tests__/vapor-closure-route-body.test.ts"
+    },
+    {
+      "sha256": "55b883a59341c5642d09b34c0800c41be354af0d5676f326b1e074457cf1788e",
+      "path": "__tests__/vapor-closure-routes.test.ts"
+    },
+    {
+      "sha256": "868056137d9a33542fc853026685f5f01192f1038f87ca6261e1d347fe205a8c",
+      "path": "__tests__/vapor-route-handlers.test.ts"
+    },
+    {
+      "sha256": "f7b7b5c686784144a1a98926069b51ab1b28a6d68109ff7e87743dca1c14853d",
+      "path": "__tests__/vbnet-bare-member-scope.test.ts"
+    },
+    {
+      "sha256": "bf3e4f0d2f59e179e31d9c1824758d9259be558a08bee3c718b0e7491e4aea9f",
+      "path": "__tests__/vbnet-instance-member-refs.test.ts"
+    },
+    {
+      "sha256": "93344f7e351fc7a954b859590d7999f2218e1ec68ac062535aa8ed4a3ba567b8",
+      "path": "__tests__/vbnet-keyword-prefixed-names.test.ts"
+    },
+    {
+      "sha256": "3ca1ee0f87596a318ee23afe1928eb3d3261dae52df48d2e6ef1668d4c34f2f3",
+      "path": "__tests__/vbnet-member-access-scope.test.ts"
+    },
+    {
+      "sha256": "a189fec12d81ee528bfa55f39f64da336ade7c35639bb58a9c73eeb095411311",
+      "path": "__tests__/vbnet-member-access.test.ts"
+    },
+    {
+      "sha256": "a6cc167f2135c55969eabf01cbe9f8700258bdbdeec9ad0568c6285da59b060c",
+      "path": "__tests__/vbnet-member-bodies.test.ts"
+    },
+    {
+      "sha256": "1ee2d3c69a0120f8c821ac5926fb016cc9e5f108948a5471b9d1e4069d3f4c47",
+      "path": "__tests__/vbnet-project-ties.test.ts"
+    },
+    {
+      "sha256": "ff36dd56e8120236f2647cdadd34e3ad9ac3d0a01ad9a37234d4637e73a506a3",
+      "path": "__tests__/vbnet-receiver-types.test.ts"
+    },
+    {
+      "sha256": "313988ad4ffb7971213c0337fba6275e7efb656d443195a6bdede72c48220472",
+      "path": "__tests__/vbnet-shared-member-refs.test.ts"
+    },
+    {
+      "sha256": "869463fe252474adccaba231310e08e060436ff864833998069b957daa22e52d",
+      "path": "__tests__/vbnet-std-methods.test.ts"
+    },
+    {
+      "sha256": "af2b4c8501530045d29ad35c53353323acf2b0261fb8ed107eb8ae313eef7702",
+      "path": "__tests__/viewer-gate.test.ts"
+    },
+    {
+      "sha256": "06e7afadffb8d245f7e1f48eef1302aba04bc0db749a60338de8fd8030da74bb",
+      "path": "__tests__/vitest-worker-flags.test.ts"
+    },
+    {
+      "sha256": "3888072154ee5f7ef7babf78bb06cb0cd9a1eb2255685af70701e1790ea9565e",
+      "path": "__tests__/vue-module-imports.test.ts"
+    },
+    {
+      "sha256": "8760ae085182f7607d456196ce428d3f57586828782de533f2554edd704c176a",
+      "path": "__tests__/vue-options-api.test.ts"
+    },
+    {
+      "sha256": "4e7695946d061e287b2725a9825f550f53371a785772137e5f1935ebbe9d71d7",
+      "path": "__tests__/vue-resolver-language.test.ts"
+    },
+    {
+      "sha256": "b79eb645b4c4b91747686a88ed9916359afb3c2f2d81a7e367fa39fb03b4f80f",
+      "path": "__tests__/vue-router.test.ts"
+    },
+    {
+      "sha256": "d05dbeb59f016396eb14053482a5b40a7e4eb7eab1a6f9d79d569cce4402b426",
+      "path": "__tests__/vue-self-closing-script.test.ts"
+    },
+    {
+      "sha256": "418c3ceea7af908692b68bb04789e8290f4fb066bec0fe2e492792a2ceadc471",
+      "path": "__tests__/vue-store-extraction.test.ts"
+    },
+    {
+      "sha256": "eef9f5cefdd61f3487b570eb3767a23358e0635390e1269bfd68486ba8094ff9",
+      "path": "__tests__/vue-template-calls.test.ts"
+    },
+    {
+      "sha256": "a83aa6cdd122a419f515445098528bf5acfdb36b397b3a523401bd2b352dd8fe",
+      "path": "__tests__/vue-tsx-script.test.ts"
+    },
+    {
+      "sha256": "31196e55aa9a7da066fbde67e907fb80c29165dec81a7f09cad46022667a73f5",
+      "path": "__tests__/vuex-dispatch-synthesizer.test.ts"
+    },
+    {
+      "sha256": "0f632585f1d621074bc1dbc056534d17e1b4105bf68fa2f0f0cebd68685b083f",
+      "path": "__tests__/wal-deferral.test.ts"
+    },
+    {
+      "sha256": "68aba87d88530f16d8070a89980c110f8cb0ed7feca64ff2cac05b1f1e152f87",
+      "path": "__tests__/wal-heal.test.ts"
+    },
+    {
+      "sha256": "57cfa11cb7923e55a76bab494b6715d9511fb8c4e08627d9124b5e21b4635472",
+      "path": "__tests__/wasm-runtime-flags.test.ts"
+    },
+    {
+      "sha256": "33e8e43137f38dd3ed7610c87fa8924813b981661c22dd81a4acdd18bbbd32de",
+      "path": "__tests__/watch-policy.test.ts"
+    },
+    {
+      "sha256": "f54740fb4e8515b5d4b2799054e0650585ca32ff049ad1286b0bbf3550d659e4",
+      "path": "__tests__/watcher-replaced-db.test.ts"
+    },
+    {
+      "sha256": "a02a3a5f940d27e1989b08c9192fae8080d1bfd5ba1bb2edba0a3b94e5055e37",
+      "path": "__tests__/watcher.test.ts"
+    },
+    {
+      "sha256": "07eb8af37ab1528f18c4acb84eb01d381a10998681c057fed27229494e31cc16",
+      "path": "__tests__/worker-teardown.test.ts"
+    },
+    {
+      "sha256": "ea6cfab12c795066148ee38420435daa14a018d06c39232eb0c9960cc76b76fd",
+      "path": "__tests__/workspace-browser-and-nested-roots.test.ts"
+    },
+    {
+      "sha256": "77e36b762c1078e1751025737e7f0a566e6302adccaaf7f77c5d05926174e818",
+      "path": "__tests__/workspace-nested-globs.test.ts"
+    },
+    {
+      "sha256": "f433ffc1aa63ff6a6b0333731966f4c059ad0b09e4aa398ca47616be03414b30",
+      "path": "__tests__/workspace-package-entries.test.ts"
+    },
+    {
+      "sha256": "c0c74e90319e91fd263ebd9740e4256196766d3269799bb8ad7500031a0a3674",
+      "path": "__tests__/worktree-detection.test.ts"
+    },
+    {
+      "sha256": "d27bac3fb6c62064b78626aeaad7d5895a903682010589469680ad1716a657c5",
+      "path": "__tests__/writer-lock.test.ts"
+    },
+    {
+      "sha256": "206b73460e04ce3d732c0f1354eba62abe906efee53c8399c5f5ba32b55e34b7",
+      "path": "__tests__/wsl-shared-index.test.ts"
+    },
+    {
+      "sha256": "8f24cebdb7ebc1864c8d57a7c028d5a2ac7178431254ae47fc73ba5ca78fa35f",
+      "path": "assets/codegraph-ui-symbol-view.png"
+    },
+    {
+      "sha256": "5ec701edf5661f8473850730e3395aeed1b6a4b36d581835a2273e77afb7db96",
+      "path": "assets/generate-language-tiles.py"
+    },
+    {
+      "sha256": "ba38011935f11debabee120571b91a8a4dbf204900bdb9c0478031b514854e99",
+      "path": "assets/languages/arkts.svg"
+    },
+    {
+      "sha256": "1f721ed424b4b7a89207e8dfeae5b7aa34b919fbce7811d7b77f79c72155df6b",
+      "path": "assets/languages/astro.svg"
+    },
+    {
+      "sha256": "cf4932bcb315e5ccfc9d8115bebea43da693795174b7a91431683f43055cb72c",
+      "path": "assets/languages/c.svg"
+    },
+    {
+      "sha256": "1db061e6071fa15bb14fa20169ec55a94f015bdb77e88c77cb8bfa738e049251",
+      "path": "assets/languages/cfml.svg"
+    },
+    {
+      "sha256": "a5f0f8c2c6dd8ecbda3871b15aa8730d684d1e91051294627dbc1d5e606778e5",
+      "path": "assets/languages/cobol.svg"
+    },
+    {
+      "sha256": "1f12f4590ce4e0b22a3df1d1d59098dfd081fe0e8c19c8773bf41b140be1dfba",
+      "path": "assets/languages/cpp.svg"
+    },
+    {
+      "sha256": "cb4f4370dcbe5d4534cce53132bdaa12bd919efe605d3c5256a5794d0eb35c1b",
+      "path": "assets/languages/csharp.svg"
+    },
+    {
+      "sha256": "387ea424cc4b622bf1a7a5fbd65160acf315d5441d2b9066fe819ff503dda4b7",
+      "path": "assets/languages/cuda.svg"
+    },
+    {
+      "sha256": "ea49af3a10761ea42485b84b217fcbaf88dfc1bb365240a704355a05e3be631a",
+      "path": "assets/languages/dart.svg"
+    },
+    {
+      "sha256": "742ac6f9ed4d61e11345f206369ca843ae8d615e829197fa4c8a4a2ab05e609d",
+      "path": "assets/languages/delphi.svg"
+    },
+    {
+      "sha256": "ef371d347dca3df0d12cc60fef5072a56cb3f0ec264899ceabbfcb3cf201e1aa",
+      "path": "assets/languages/erlang.svg"
+    },
+    {
+      "sha256": "797dac280fe3dbef7674f1d075e1f3366f380b35f654fa783c71273056840206",
+      "path": "assets/languages/go.svg"
+    },
+    {
+      "sha256": "962568a13d567be4200cbf84f3b9912c52ca7a6b33ddaf7c07dabc9ce7c5b06a",
+      "path": "assets/languages/java.svg"
+    },
+    {
+      "sha256": "2def4cc1b0a45281d287eac739650c3f881d9d69f5f74015b3dadbb99641e2c6",
+      "path": "assets/languages/javascript.svg"
+    },
+    {
+      "sha256": "7069511438c0b27440f1d2ab0f1ad24db06061f4a2a3a36045c58a529bd9f0ee",
+      "path": "assets/languages/kotlin.svg"
+    },
+    {
+      "sha256": "2d6385e00570f7464d22bc29c2c10715410ba0ca6a18bbc9620112fba99c21e2",
+      "path": "assets/languages/liquid.svg"
+    },
+    {
+      "sha256": "f12f180f46f85c0d3ff20e2c9c956ef9765065c49558810443989a1eecdff4c8",
+      "path": "assets/languages/lua.svg"
+    },
+    {
+      "sha256": "50d22f5883c72b7bd266f98c57bbcd2fae7c4a62a2742e5e968de9b3577b00d9",
+      "path": "assets/languages/luau.svg"
+    },
+    {
+      "sha256": "00b0e699d4dc5901d3f075dd8a63af5050b0a402209681390602e38b27180cd1",
+      "path": "assets/languages/metal.svg"
+    },
+    {
+      "sha256": "2373e78e25c2eea4a2585c717c56f15b0b6d0bc5f7459a24d63187cb6ec2edc3",
+      "path": "assets/languages/nix.svg"
+    },
+    {
+      "sha256": "25400269b569f188b4fbd7590d241df755eb7f48fe5e6e974c0eabbc8837635d",
+      "path": "assets/languages/objective-c.svg"
+    },
+    {
+      "sha256": "e5dfa9b4d71af0552f4772bfd545580bbb64b113e5f8068117c90dc349c31745",
+      "path": "assets/languages/php.svg"
+    },
+    {
+      "sha256": "cb95496076cc99b16a4a6fe19013b72a340e0799aeda5e9a70653d93c0505a8e",
+      "path": "assets/languages/python.svg"
+    },
+    {
+      "sha256": "c7b6c23e86952599dc5569e582d44b5a1288932065b02975987a88f857aa525f",
+      "path": "assets/languages/r.svg"
+    },
+    {
+      "sha256": "341847823f7fb29e5fef1c9d179dc974a258348e9d8b644a448b01aa5ff69867",
+      "path": "assets/languages/ruby.svg"
+    },
+    {
+      "sha256": "132cfef1401841740d163b75f5ce142b29452fb59665303ac94a2dad6735a93f",
+      "path": "assets/languages/rust.svg"
+    },
+    {
+      "sha256": "1437cff51bab7b09ca551c1cdfa442940c51a4c8f951194d453bee7b0c16a28f",
+      "path": "assets/languages/scala.svg"
+    },
+    {
+      "sha256": "980b1cb5a847a11cab04b1f7ece5eff6c96a8a5d24235e54bc90add5c3e1c87c",
+      "path": "assets/languages/solidity.svg"
+    },
+    {
+      "sha256": "7791fc71fff5458b064c50b3a69dc4826dec0f395714f4d964301114a7b5a2d0",
+      "path": "assets/languages/svelte.svg"
+    },
+    {
+      "sha256": "c08d53a7e862de0e3d1357287bf47a5058b691597c665f2435d5f53ac529d6a2",
+      "path": "assets/languages/swift.svg"
+    },
+    {
+      "sha256": "e6ea36fe77477fa8c4b32efdc0b088d3651481c76e96aa581252aa1821dcfbf3",
+      "path": "assets/languages/terraform.svg"
+    },
+    {
+      "sha256": "ee4e5fe8dee9063e3d8994ce4a5b7a546945442cf48020f1981eeda3f751182e",
+      "path": "assets/languages/typescript.svg"
+    },
+    {
+      "sha256": "67f230351c9d789d2d6bca7cced1bc289b77e6cb23618076d7d243cea2a7a2af",
+      "path": "assets/languages/vbnet.svg"
+    },
+    {
+      "sha256": "ac5aac0d84b8636eaa2bfd15ddde523fdc2b4a67338bd0e89344d01d012b0f31",
+      "path": "assets/languages/vue.svg"
+    },
+    {
+      "sha256": "9694b03dee6d275821d9edf012632bd9183f2a97eb8dae70620c9a85daed66b3",
+      "path": "assets/rust-logo-dark.svg"
+    },
+    {
+      "sha256": "4f8cf2caf57797c4ccebb82ad2f4ebaf82edb047a3d9ed03270cd6268b33aa45",
+      "path": "assets/rust-logo.svg"
+    },
+    {
+      "sha256": "36bab4c2f3ffd0505e3ff469b84a8f722ae460354be6de5ac040b36ef831c05a",
+      "path": "assets/waitlist.svg"
+    },
+    {
+      "sha256": "57ff6512824080e37b271f4028450fff5a2c23e4a032b9b269a7524fea027d35",
+      "path": "codegraph-kernel/.gitignore"
+    },
+    {
+      "sha256": "2980bfa421669d9213a9cff4e22b3833f02739b44fb6f9e29d358a98d8506302",
+      "path": "codegraph-kernel/Cargo.lock"
+    },
+    {
+      "sha256": "86d4e24ab343f44adf5c652608c65ee28355f81be4898f9efe0001c0b5bfe1c0",
+      "path": "codegraph-kernel/Cargo.toml"
+    },
+    {
+      "sha256": "dcb109411a46a1a969175f058e1e0a71c472a4b8a0a52ecd371e4e3a8868da30",
+      "path": "codegraph-kernel/build.rs"
+    },
+    {
+      "sha256": "d270cb3a4985d75033bd77d875ccebff1d66e32788a3f727891e28d76132dd46",
+      "path": "codegraph-kernel/grammars/dart/LICENSE"
+    },
+    {
+      "sha256": "5a42b47abb4d494f125dbdee9138979248041689b1aa36355550fa3e28dcb8b8",
+      "path": "codegraph-kernel/grammars/dart/parser.c"
+    },
+    {
+      "sha256": "07a7b7818b175e9460523e705dd88d20f7b5141bac95c593d4426e6d52284996",
+      "path": "codegraph-kernel/grammars/dart/scanner.c"
+    },
+    {
+      "sha256": "b29c1c9fb7cc82f58c84b376df1297d6e2737a1d655fd356db0859e3c29c2fea",
+      "path": "codegraph-kernel/grammars/dart/tree_sitter/alloc.h"
+    },
+    {
+      "sha256": "5bdf6ed1a78e3409fd443e085ca967a64c188a5d082aaf7f819bccd53a471c94",
+      "path": "codegraph-kernel/grammars/dart/tree_sitter/array.h"
+    },
+    {
+      "sha256": "180b893c8734778fd32f372dfbc27bd6ad1cd2221f26150b31256ff6716320d2",
+      "path": "codegraph-kernel/grammars/dart/tree_sitter/parser.h"
+    },
+    {
+      "sha256": "54104a7ef1555c265b746c790e0f8bb953cc17806e9df0c3af82f7f62c06a70a",
+      "path": "codegraph-kernel/grammars/kotlin/parser.c"
+    },
+    {
+      "sha256": "2ca842dd04b60b0a6df59a03e9ad01209d8c5641f079a79a84d65708669b6cb6",
+      "path": "codegraph-kernel/grammars/kotlin/scanner.c"
+    },
+    {
+      "sha256": "253b44a7b4313a7afd0c505c2fc6e7ce4b8e78955ebf4be3ea000532ec060673",
+      "path": "codegraph-kernel/grammars/kotlin/tree_sitter/alloc.h"
+    },
+    {
+      "sha256": "4ff743903dc46f5db6aa54f31c6b4d160a8a9779e5b2ab1ee59ae7ebcd850ea1",
+      "path": "codegraph-kernel/grammars/kotlin/tree_sitter/array.h"
+    },
+    {
+      "sha256": "a3eb18ef034b3f4255b965a26caa276f9cfe13a79573b402f1a12dc5018052aa",
+      "path": "codegraph-kernel/grammars/kotlin/tree_sitter/parser.h"
+    },
+    {
+      "sha256": "9a32b02e4c917b1ce6b5e79d8ea81e25cefd7f27d89c7235f2afb262c06cf32e",
+      "path": "codegraph-kernel/grammars/lua/LICENSE"
+    },
+    {
+      "sha256": "b34a362e43f0311f405721f3089e94f97f31da403b154d456d093e64609a4081",
+      "path": "codegraph-kernel/grammars/lua/parser.c"
+    },
+    {
+      "sha256": "35bbd630b5a7421d46d2e91185eeea09bf78565d44cb676b63ca20d0f1b54bbd",
+      "path": "codegraph-kernel/grammars/lua/scanner.c"
+    },
+    {
+      "sha256": "b29c1c9fb7cc82f58c84b376df1297d6e2737a1d655fd356db0859e3c29c2fea",
+      "path": "codegraph-kernel/grammars/lua/tree_sitter/alloc.h"
+    },
+    {
+      "sha256": "5bdf6ed1a78e3409fd443e085ca967a64c188a5d082aaf7f819bccd53a471c94",
+      "path": "codegraph-kernel/grammars/lua/tree_sitter/array.h"
+    },
+    {
+      "sha256": "180b893c8734778fd32f372dfbc27bd6ad1cd2221f26150b31256ff6716320d2",
+      "path": "codegraph-kernel/grammars/lua/tree_sitter/parser.h"
+    },
+    {
+      "sha256": "1f95ed26e1f4074074c9c7083e61c0a9e4c3b9f435745044995f3beb4ed28575",
+      "path": "codegraph-kernel/grammars/scala/LICENSE"
+    },
+    {
+      "sha256": "9f6d03fa6c63d2d855b6f9e0368046a58568587eefc38b5e38bdb001e8ec68db",
+      "path": "codegraph-kernel/grammars/scala/parser.c"
+    },
+    {
+      "sha256": "daed58e6cf61f5b034adf51029c566141da5fb181540b77c8a28654a26e4ddd7",
+      "path": "codegraph-kernel/grammars/scala/scanner.c"
+    },
+    {
+      "sha256": "b29c1c9fb7cc82f58c84b376df1297d6e2737a1d655fd356db0859e3c29c2fea",
+      "path": "codegraph-kernel/grammars/scala/tree_sitter/alloc.h"
+    },
+    {
+      "sha256": "31e60a1bff6f715afacce03b5b70efe42b58371b4f9595dd4af52a577ff9608c",
+      "path": "codegraph-kernel/grammars/scala/tree_sitter/array.h"
+    },
+    {
+      "sha256": "180b893c8734778fd32f372dfbc27bd6ad1cd2221f26150b31256ff6716320d2",
+      "path": "codegraph-kernel/grammars/scala/tree_sitter/parser.h"
+    },
+    {
+      "sha256": "3533cec129bb4bba015c0d61d86dd7c3b7e82110e4d2ff7837a01eff5bad5ccc",
+      "path": "codegraph-kernel/grammars/swift/LICENSE"
+    },
+    {
+      "sha256": "d3edff6effe31b9a507f496577407987343b101b23eb7bee7a9b050e8ab5d27a",
+      "path": "codegraph-kernel/grammars/swift/parser.c"
+    },
+    {
+      "sha256": "8acafef098ea4a52ebfc4cdf2fe26706113a22ac8ba2faf7d952755ff350cad6",
+      "path": "codegraph-kernel/grammars/swift/scanner.c"
+    },
+    {
+      "sha256": "b29c1c9fb7cc82f58c84b376df1297d6e2737a1d655fd356db0859e3c29c2fea",
+      "path": "codegraph-kernel/grammars/swift/tree_sitter/alloc.h"
+    },
+    {
+      "sha256": "31e60a1bff6f715afacce03b5b70efe42b58371b4f9595dd4af52a577ff9608c",
+      "path": "codegraph-kernel/grammars/swift/tree_sitter/array.h"
+    },
+    {
+      "sha256": "180b893c8734778fd32f372dfbc27bd6ad1cd2221f26150b31256ff6716320d2",
+      "path": "codegraph-kernel/grammars/swift/tree_sitter/parser.h"
+    },
+    {
+      "sha256": "49bf33cf78ef5897e4e161ce1517df7de1ae5042a65b6bcfd44401e0fc606559",
+      "path": "codegraph-kernel/grammars/typescript/LICENSE"
+    },
+    {
+      "sha256": "23fd656d7e82f80bf66e0b9b8ef96aa6102ef5bfd9f32c561a4caabe08b9fd34",
+      "path": "codegraph-kernel/grammars/typescript/common/scanner.h"
+    },
+    {
+      "sha256": "34f37cd33244724c9d5dc4863123f3a5f6a919f4f472c31981610f6442077394",
+      "path": "codegraph-kernel/grammars/typescript/tsx/src/parser.c"
+    },
+    {
+      "sha256": "d563cd30b2f39718c9ae4292795c5ce03a2ad01954ba3a86ef84c2781a736673",
+      "path": "codegraph-kernel/grammars/typescript/tsx/src/scanner.c"
+    },
+    {
+      "sha256": "b29c1c9fb7cc82f58c84b376df1297d6e2737a1d655fd356db0859e3c29c2fea",
+      "path": "codegraph-kernel/grammars/typescript/tsx/src/tree_sitter/alloc.h"
+    },
+    {
+      "sha256": "5bdf6ed1a78e3409fd443e085ca967a64c188a5d082aaf7f819bccd53a471c94",
+      "path": "codegraph-kernel/grammars/typescript/tsx/src/tree_sitter/array.h"
+    },
+    {
+      "sha256": "180b893c8734778fd32f372dfbc27bd6ad1cd2221f26150b31256ff6716320d2",
+      "path": "codegraph-kernel/grammars/typescript/tsx/src/tree_sitter/parser.h"
+    },
+    {
+      "sha256": "db8c411258ff82520df32ad7213be1c9a60c0cec77fdb6d28858014ae92ea0aa",
+      "path": "codegraph-kernel/grammars/typescript/typescript/src/parser.c"
+    },
+    {
+      "sha256": "9125013b42cb888379d9be909f1d73dfb75a37626c2cdbf4122718a2b431a6d3",
+      "path": "codegraph-kernel/grammars/typescript/typescript/src/scanner.c"
+    },
+    {
+      "sha256": "b29c1c9fb7cc82f58c84b376df1297d6e2737a1d655fd356db0859e3c29c2fea",
+      "path": "codegraph-kernel/grammars/typescript/typescript/src/tree_sitter/alloc.h"
+    },
+    {
+      "sha256": "5bdf6ed1a78e3409fd443e085ca967a64c188a5d082aaf7f819bccd53a471c94",
+      "path": "codegraph-kernel/grammars/typescript/typescript/src/tree_sitter/array.h"
+    },
+    {
+      "sha256": "180b893c8734778fd32f372dfbc27bd6ad1cd2221f26150b31256ff6716320d2",
+      "path": "codegraph-kernel/grammars/typescript/typescript/src/tree_sitter/parser.h"
+    },
+    {
+      "sha256": "264e0504c180553f39929c2ca1bc79f89328467ed7663daacd661d53dee1f35e",
+      "path": "codegraph-kernel/src/buffers.rs"
+    },
+    {
+      "sha256": "e94dfed1a75a0e5e8c8595bc415b709222bbd3eec81492748c73935491a55617",
+      "path": "codegraph-kernel/src/ccpp/brace_scopes.rs"
+    },
+    {
+      "sha256": "b1150bf6f9fed274bc0fa37b409c002fdef6cdd334dc0419c2957bf9f6515c18",
+      "path": "codegraph-kernel/src/ccpp/mod.rs"
+    },
+    {
+      "sha256": "031e3261dab08d6369c5181184ced66205f04477be400e6c9defd92a58f65e25",
+      "path": "codegraph-kernel/src/cfnptr.rs"
+    },
+    {
+      "sha256": "f43a0fc76784648c1629c4381241e4565ecbbb57fbcaebf254e3a43c1c3bf5cc",
+      "path": "codegraph-kernel/src/csharp.rs"
+    },
+    {
+      "sha256": "2605cd041841cfc9d722078dd0fd328d3fcfae56d65584dc98ea6d26dbb0147b",
+      "path": "codegraph-kernel/src/dart.rs"
+    },
+    {
+      "sha256": "05c6e716f8a4b03749b3032de35774f6b0a6f604125653dad193070357a794af",
+      "path": "codegraph-kernel/src/docstring.rs"
+    },
+    {
+      "sha256": "ff31f9107c501bcbeebf223d20550d0b7142e91c190c447582d96ee33e8ed84e",
+      "path": "codegraph-kernel/src/go.rs"
+    },
+    {
+      "sha256": "57075ff1be959f1f4e85bfbc0429e78b53972085bafcb284964713fee953f727",
+      "path": "codegraph-kernel/src/ids.rs"
+    },
+    {
+      "sha256": "989777eb6ea7bad76827c57f6fae7cbd43f9bfd3f14baa92f23de63808a76256",
+      "path": "codegraph-kernel/src/java.rs"
+    },
+    {
+      "sha256": "ecb5d1fe03125a87ba445a75ac88591b8747d6baba12267600b70cc6c6d18d7d",
+      "path": "codegraph-kernel/src/kotlin.rs"
+    },
+    {
+      "sha256": "6b9a2ffa29ba321f969db9904b8e851f993abd5caa164c12c3f367772f1ceaa5",
+      "path": "codegraph-kernel/src/langs.rs"
+    },
+    {
+      "sha256": "f69036224516209b490c038dd523f54ea250e8c60f2dc88efda57a732d14da9a",
+      "path": "codegraph-kernel/src/lib.rs"
+    },
+    {
+      "sha256": "171238764d62c9fe92882e6e3a3a42446005a19ec2b4fb08a8575bdd362a4c03",
+      "path": "codegraph-kernel/src/lua.rs"
+    },
+    {
+      "sha256": "7ae513bd0ac97648a9411b9260492db0a11ae4849e461ada1aadbbe50cd2fbb4",
+      "path": "codegraph-kernel/src/php.rs"
+    },
+    {
+      "sha256": "edcd6375c83befe84c12750facb3bd0905ef0564af17074ac453274a38a4a176",
+      "path": "codegraph-kernel/src/python.rs"
+    },
+    {
+      "sha256": "e16046c0223fef2809b866612203b083679d2816e4bc7d23efc1761bbcaeb659",
+      "path": "codegraph-kernel/src/rlang.rs"
+    },
+    {
+      "sha256": "16302f703b3392a0fc62ddb9c7697a03cf8ccb584d6e97ef8e9e660426af85d5",
+      "path": "codegraph-kernel/src/ruby.rs"
+    },
+    {
+      "sha256": "1ad7b824cf6e463a0f63d645e86f6eac9ebb8c64bf9e83bff7a124de1a63acac",
+      "path": "codegraph-kernel/src/rustlang.rs"
+    },
+    {
+      "sha256": "44989e76d8c1d6a324364462febc65f5fbf5da6975255df08a8e9019251b6711",
+      "path": "codegraph-kernel/src/scala.rs"
+    },
+    {
+      "sha256": "539146c275ac7ee21f9c693d10dada1476d8b9326cfb2542a973e981fb63fcd3",
+      "path": "codegraph-kernel/src/stack.rs"
+    },
+    {
+      "sha256": "872d66dba4668dccff686154da66c234245e8e10568ab6f1e1c4f3e66368dcd5",
+      "path": "codegraph-kernel/src/swift.rs"
+    },
+    {
+      "sha256": "e77cd4dcacb5476c08e235d03e2c3ab72b3b695fd9381d939304f13137f6b281",
+      "path": "codegraph-kernel/src/textutil.rs"
+    },
+    {
+      "sha256": "b3d29442ce6bfc7c7fe01c6e6cfb216834ad922303d4b42dab8db0a3c5f1bd7c",
+      "path": "codegraph-kernel/src/tsjs/extractors.rs"
+    },
+    {
+      "sha256": "06a655099d21f841ae3be95f39f68c2373fcd1403405c164ccb167677660ba85",
+      "path": "codegraph-kernel/src/tsjs/fnref.rs"
+    },
+    {
+      "sha256": "2591c0aef0f739fe238e5274cdd12fc1354252b8105c74b0a5acde7148c3caa4",
+      "path": "codegraph-kernel/src/tsjs/mod.rs"
+    },
+    {
+      "sha256": "070f93a29ba47f4d8243fddb26851dffea162736177cd0129a1b600036828653",
+      "path": "codegraph-kernel/vendor/tree-sitter/Cargo.toml"
+    },
+    {
+      "sha256": "c50887b756d2d0089e320d2669dbe36cc587fd6fdc4868078f6144e62a2b58b1",
+      "path": "codegraph-kernel/vendor/tree-sitter/Cargo.toml.orig"
+    },
+    {
+      "sha256": "9ecd06f9241e791712d05fb5015209e319a545f17a0d212c89a44c45871af152",
+      "path": "codegraph-kernel/vendor/tree-sitter/binding_rust/README.md"
+    },
+    {
+      "sha256": "db118aa2f6d14a594e64de02f1095a5e36d326f325ac6060d946b6aeb50ab41c",
+      "path": "codegraph-kernel/vendor/tree-sitter/binding_rust/bindings.rs"
+    },
+    {
+      "sha256": "5e9e95f604397345a5fb169c4da752de60ce935c64dbca3d4a44963ce8dd1d8c",
+      "path": "codegraph-kernel/vendor/tree-sitter/binding_rust/build.rs"
+    },
+    {
+      "sha256": "2a1030f6dfcb50db9937ea9d11590687a663814b1b9fe5eacbf9d831bcb8d79d",
+      "path": "codegraph-kernel/vendor/tree-sitter/binding_rust/ffi.rs"
+    },
+    {
+      "sha256": "7b7b43dc996200abfb15e4a28eb38001148fa7055fed286852009565694d1a13",
+      "path": "codegraph-kernel/vendor/tree-sitter/binding_rust/lib.rs"
+    },
+    {
+      "sha256": "5b828e25f6f426827f72356bd07e2fc11db8a30facee832f7d62897d018bc8f6",
+      "path": "codegraph-kernel/vendor/tree-sitter/binding_rust/util.rs"
+    },
+    {
+      "sha256": "061970e5c72bac9b8cb43a897571a69bda09c944e3eb0eaf0093a0e803b7a7db",
+      "path": "codegraph-kernel/vendor/tree-sitter/binding_rust/wasm_language.rs"
+    },
+    {
+      "sha256": "937c5389713f99318ac7adbdb3a95e9976bbd211e35e37ed5df878f29aa86c30",
+      "path": "codegraph-kernel/vendor/tree-sitter/include/tree_sitter/api.h"
+    },
+    {
+      "sha256": "c7d15b9015568f439af4adf28ead9e2bd14901221819276727c11227a29576da",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/alloc.c"
+    },
+    {
+      "sha256": "2ad7cc5391be8043ffdcc111b9b21b7767f592790fc8389acb6fcee7fd1acb61",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/alloc.h"
+    },
+    {
+      "sha256": "2ee1350009660a2dd5d116f9e9644d280f1703ef1c7b460d9d46a7f3dee1c816",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/array.h"
+    },
+    {
+      "sha256": "bbc630cb913ac64274ce4412bc9d504174220323993f306ded74abe502867e74",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/atomic.h"
+    },
+    {
+      "sha256": "abd8fa83a805900f8e03b8b2b1abd47f9c7b8252f4401485c060348c407f5448",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/clock.h"
+    },
+    {
+      "sha256": "0e8d1a21e0d60981e762989108231df6610d95591892f631c6c78a9ef831a2ab",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/error_costs.h"
+    },
+    {
+      "sha256": "337fd1af9c62987345d4a2b29bdfe8596ccb21c9a621cac6fc537c8c843ea058",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/get_changed_ranges.c"
+    },
+    {
+      "sha256": "f394bd0b6fce006be460fd16cbea3cc96e248c810a4d97e8830463c29c85e4a5",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/get_changed_ranges.h"
+    },
+    {
+      "sha256": "e1982b9795b9c52b5ab564d8b9876189d65a97ca02f78351e1740b0985992fd2",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/host.h"
+    },
+    {
+      "sha256": "4d9a84865d12e92364d6b7250e66b850d960e36931b2ab17e9847e5e10be8557",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/language.c"
+    },
+    {
+      "sha256": "56e32fb53672609be6e8bfa7e6d0f92ef463fd53d2be910d169a07ee5f03df1b",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/language.h"
+    },
+    {
+      "sha256": "7fc186fb4bf50233059e8be9ca68efe95e66d34ced4b8a8f38f14497352faeb1",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/length.h"
+    },
+    {
+      "sha256": "56a418eb47351b85d8f73729fa756765e2d9b3c6873d6be8f240a2e7fad22431",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/lexer.c"
+    },
+    {
+      "sha256": "7d76308f7a2d3246a3e28fb27698be928f848130d1bfacc39f9f623127671b74",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/lexer.h"
+    },
+    {
+      "sha256": "6bca070a6a70740c8e8af244af8a7311dbea09fbb60372376f5260facaf785f0",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/lib.c"
+    },
+    {
+      "sha256": "bfe9c7867881142600ad48570ef345dbb2b25319e61e1e08c7a15cc519dcb6a6",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/node.c"
+    },
+    {
+      "sha256": "612383a469d79c61f8b5b749714d60a6a85ca2b49c708e10ad0901be5b3987d0",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/parser.c"
+    },
+    {
+      "sha256": "180b893c8734778fd32f372dfbc27bd6ad1cd2221f26150b31256ff6716320d2",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/parser.h"
+    },
+    {
+      "sha256": "0929027be2ff54627be560f3bafc1af59e81ac6d5a8d5864455601a0dbee50ff",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/point.h"
+    },
+    {
+      "sha256": "61f1ea13901973c37e44c3cd2459b13d771546149c1cac2e993451835a65ea30",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/portable/endian.h"
+    },
+    {
+      "sha256": "b2a0f2204cfa050b072b510a8299f919c2ec38ae1495c76174990ee2cafae707",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/query.c"
+    },
+    {
+      "sha256": "8f40396e431d7ff558694ca248eed1332b6cf6f7e6255f06cddfde78020bd308",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/reduce_action.h"
+    },
+    {
+      "sha256": "10be747ea4c733ca181dc43d55d155ac8e5b8caa247079621cca0ce633347bfb",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/reusable_node.h"
+    },
+    {
+      "sha256": "f70b7e5823e82901801193562908037db4c1a73721e48da0fe54cdb2a6b5856d",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/stack.c"
+    },
+    {
+      "sha256": "13a2fb028036cf889fa92d55c3d7c0b57ba368a274f20a1961e695207cf3b91c",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/stack.h"
+    },
+    {
+      "sha256": "ec4c8ca9e9957ab1effcf1ba36d6820b751c2ded0276e2d332c787eabb1265c8",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/subtree.c"
+    },
+    {
+      "sha256": "9380a9984a3a071d6a32ed05f7fad8b8853afa991f0a36cc29ccb90f1e3a1a0f",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/subtree.h"
+    },
+    {
+      "sha256": "ef55fd2d34daad7e43605ba0469f6c67a9afb31963077e9c73f2fb0478e254bb",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/tree.c"
+    },
+    {
+      "sha256": "60591fb35ca078a8bb323004ece0377ac4f4c6cdbd3c4473af6e2b97186e024b",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/tree.h"
+    },
+    {
+      "sha256": "8d94832d6d68784252b2ff4c8abf9c37dd1672d2af9c4ab5588f342ed44b106e",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/tree_cursor.c"
+    },
+    {
+      "sha256": "3e8d9671ab1397bcaeb3e0cbf153a61a99e214782b43c09e5cde5a01e8283a1a",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/tree_cursor.h"
+    },
+    {
+      "sha256": "ac1ec4b7ba388a9d8708feeb6c5c766b2927cecfd6db644b939772e1dc086526",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/ts_assert.h"
+    },
+    {
+      "sha256": "6cf0ec5a54e72644e506cca20b854dc7c49249cb1cff0d806635a10c8efba340",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/unicode.h"
+    },
+    {
+      "sha256": "2879b4cf5a2c625c6509c26e341b9c8b0c50fde284113b449e00567bdf4e593c",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/unicode/ICU_SHA"
+    },
+    {
+      "sha256": "6a18c5fac70d7860b57f5b72b4e2c9a1ba6b3d2741eef7ff9767c5379364f10d",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/unicode/LICENSE"
+    },
+    {
+      "sha256": "73bbccbcf2e6648385d188d914b16ae56b4553a0f1efb033e6b6d6242e41df1d",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/unicode/README.md"
+    },
+    {
+      "sha256": "a87e9710c9cad7b08a945f4fb8b9d4629189897cc535f8ac927640c210a94b69",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/unicode/ptypes.h"
+    },
+    {
+      "sha256": "2d79c0903d9e73e247b948bc0a12b6a785257ca0273bddab56fb59561f8d7391",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/unicode/umachine.h"
+    },
+    {
+      "sha256": "a87e9710c9cad7b08a945f4fb8b9d4629189897cc535f8ac927640c210a94b69",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/unicode/urename.h"
+    },
+    {
+      "sha256": "a87e9710c9cad7b08a945f4fb8b9d4629189897cc535f8ac927640c210a94b69",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/unicode/utf.h"
+    },
+    {
+      "sha256": "c370d9069f37fad2b53981c06dc648bbc21923db1655517a31bb237df4fba041",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/unicode/utf16.h"
+    },
+    {
+      "sha256": "39651224b2ca2452359c7f3339f3cc0a841fe7db64f8a00c9c5ec19c0389645c",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/unicode/utf8.h"
+    },
+    {
+      "sha256": "a9396e1f1a0369090ff8a548b38fb7dcd4472d7318f75c937d0e007cc511dc16",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/wasm/stdlib-symbols.txt"
+    },
+    {
+      "sha256": "3def5432c46630c6ff8a8a742cf301dcdaac0ae1339519bec70d64321bced4b5",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/wasm/stdlib.c"
+    },
+    {
+      "sha256": "805520eb9fb1e590a1470d740f5afa29cd48aa4f681b887d171cef13ad600aca",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/wasm/wasm-stdlib.h"
+    },
+    {
+      "sha256": "bb3434364fd50960a2c0936e211f66c9fa005a0dcea26de63692ebae3ae33c83",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/wasm_store.c"
+    },
+    {
+      "sha256": "4f70d0500b0775e5d862a8e7d191b3853d73378c65e020e01767838a18debe0e",
+      "path": "codegraph-kernel/vendor/tree-sitter/src/wasm_store.h"
+    },
+    {
+      "sha256": "7241e4e811cae67048dd77ca3d232b2a1f981767d17f8564c49ba4b88fbe1e94",
+      "path": "docs/AGENTS.md"
+    },
+    {
+      "sha256": "2c3aea922a0a04823b3a35bcd9f88dd037cf678eb09b09fb70828cde11391c3a",
+      "path": "docs/README.md"
+    },
+    {
+      "sha256": "a8659a19824a0bcbccd95af3221a339363337b6a3a223f56c2f27275f12c6e12",
+      "path": "docs/SEARCH_QUALITY_LOOP.md"
+    },
+    {
+      "sha256": "b75cfd7b912a5c58ff8844bc52b712fecad41e1f2afe5dc6003346ca28753274",
+      "path": "docs/benchmarks/agent-eval-feedback-metrics.md"
+    },
+    {
+      "sha256": "997302f583774c656cd0b64b38711c549e19df4815a7c6b3c3bdca77fd505e9b",
+      "path": "docs/benchmarks/answer-directly-vs-explore-agent.md"
+    },
+    {
+      "sha256": "a788631c191e413c2b449d3e68cfc73434b2faa1b8097c94642b9e05884be375",
+      "path": "docs/benchmarks/call-sequence-analysis.md"
+    },
+    {
+      "sha256": "5056c35bff69bff2debdeb23b60e576d189eeb7c030cfaa392e5b08601585be7",
+      "path": "docs/benchmarks/codegraph-ab-matrix.md"
+    },
+    {
+      "sha256": "e225e347342eed87d0dc22aac3db02b87142bcc5e25054fffdaad82d5a0bbe58",
+      "path": "docs/benchmarks/explore-allocation-ab-1500.md"
+    },
+    {
+      "sha256": "bf12a20a684389008ce6742794de07db89c76eb9574acaadc56d7332423079fb",
+      "path": "docs/benchmarks/explore-allocation-efficiency.md"
+    },
+    {
+      "sha256": "4e6531f006eaae391bcec20d97c62d06cfe8ca4995aa01df0c080071af00de8f",
+      "path": "docs/benchmarks/explore-cluster-starvation-cg36.md"
+    },
+    {
+      "sha256": "2ddf4cbc5a40115cc58acf6d49263952f3c9ed3e27c07647e6b5a4ae4a724091",
+      "path": "docs/benchmarks/explore-completeness-note.md"
+    },
+    {
+      "sha256": "330232cb72748feb0f8c6268b1b27b636dfc7c5f4bf25bf4fe852dfc02164289",
+      "path": "docs/benchmarks/explore-declaration-only-cg28.md"
+    },
+    {
+      "sha256": "cb0d469ffe6ca2f655fbfed997a915378cbc35f8ccc80aa2eb6c662dcb0b837c",
+      "path": "docs/benchmarks/explore-dedup-ab-cg20.md"
+    },
+    {
+      "sha256": "d8d796ab73b9ab36ce5d3415ffdd4125352b984610580022c317ca6293bb6c3a",
+      "path": "docs/benchmarks/explore-displacement-guard-ab-cg31.md"
+    },
+    {
+      "sha256": "282a843b5e01e1287bd0edd5e10d7d33f742c24e3b9e4aa6f6934cdf649a1141",
+      "path": "docs/benchmarks/explore-factory-closure-cg27.md"
+    },
+    {
+      "sha256": "fbd467dcf5cb93702cd889f247da25594ee8fb5b0dd34f06d936fd950dee5e83",
+      "path": "docs/benchmarks/explore-noise-epic-cg24.md"
+    },
+    {
+      "sha256": "3168476b1fb459e439abe41f0c3da83bed20abaf424ac19dbbd782877c8b1a99",
+      "path": "docs/benchmarks/explore-oversize-member-ab-cg30.md"
+    },
+    {
+      "sha256": "83a7763569331419389f0a44f61b08212c63fb4d2e6c99f4ccfbb1f765d4a72e",
+      "path": "docs/benchmarks/explore-reservation-invariant-ab-cg26.md"
+    },
+    {
+      "sha256": "3975295fd83e7f7e1b3ed0d14ccdb4c642e8020a0591eb069aca5636dedde9bd",
+      "path": "docs/benchmarks/explore-sufficiency.md"
+    },
+    {
+      "sha256": "4219af85940da88abebbf41e0a209f3d3da288576244d8e165896d11f3523450",
+      "path": "docs/benchmarks/explore-tail-render-cg38.md"
+    },
+    {
+      "sha256": "8a114b4bf3a344f5bd7d16ddcbc3e8ab0e5b9065f7317e68a0ebf44985e5a641",
+      "path": "docs/benchmarks/index-drift-cg33.md"
+    },
+    {
+      "sha256": "466e3c951c1d464afc2a98b0f2a213a0755256102025d5b389a5c5013d0ab7c2",
+      "path": "docs/benchmarks/regression-audit-2026-09.md"
+    },
+    {
+      "sha256": "c62c8ea5e2bb9de92b0c46c701eeab8fa436cf9935ff7d82671d9267600cfd41",
+      "path": "docs/benchmarks/residual-context-occupancy.md"
+    },
+    {
+      "sha256": "e111d2cf38b2f88f47c421a1942acfbeaf173659cc69f26544f840bc9dcb5252",
+      "path": "docs/design/adaptive-explore-sizing.md"
+    },
+    {
+      "sha256": "55b6cc31e2dc5df15d466f587efe3749d21e3775846edeaa4cab3d967897e0d1",
+      "path": "docs/design/agent-codegraph-adoption.md"
+    },
+    {
+      "sha256": "0d17257434d85657c8372f9691d72201d26cf9e6e71777b626418085f373b76c",
+      "path": "docs/design/callback-edge-synthesis.md"
+    },
+    {
+      "sha256": "4ec0101f57f436adfac3dfb5c98dff5554af7ae1ce09b8e5c667fc9e402cb41e",
+      "path": "docs/design/ccpp-kernel-port-checklist.md"
+    },
+    {
+      "sha256": "b1372f9101ad3a5794cdd0bad94b6c702b825ed85390d45b0de5926f9d3fba9f",
+      "path": "docs/design/cg57-highlighting-parity.md"
+    },
+    {
+      "sha256": "afbc2212c7130c6c37460d4860466a5293ecb8c479b57791a4cf5930f6b7a11b",
+      "path": "docs/design/cg57-highlighting-parity/csharp.png"
+    },
+    {
+      "sha256": "5e3c33f0f592cdb541f975179de044881576855e8947efbcd80e01e0a15a1e1b",
+      "path": "docs/design/cg57-highlighting-parity/go.png"
+    },
+    {
+      "sha256": "4604d3a2fc6417fea6df449b21d0d5a64cbe6cd1785294046b5d18e82d80211d",
+      "path": "docs/design/cg57-highlighting-parity/php.png"
+    },
+    {
+      "sha256": "a6f282fabaed3d2e2d2edd505f0680d48814f6a47c2116e1255d3b194e4f90b0",
+      "path": "docs/design/cg57-highlighting-parity/python.png"
+    },
+    {
+      "sha256": "8205a4323c712c8cfeb1e05767093448b0a0b929e8266d9a402d01ffaab69c79",
+      "path": "docs/design/cg57-highlighting-parity/ruby.png"
+    },
+    {
+      "sha256": "b7a4349f298d097b16bef580e271dca9c532b9cec4f03662b40324bab5c7ae13",
+      "path": "docs/design/cg57-highlighting-parity/rust.png"
+    },
+    {
+      "sha256": "7cb71090151f50981faac36f4d4f931f22b0c097603d4935abd962a03e4176bb",
+      "path": "docs/design/cg57-highlighting-parity/swift.png"
+    },
+    {
+      "sha256": "97d7ff357da7622f66cb2fbd2d342b2c75a658b44b1510bf62975a75b0db7c5c",
+      "path": "docs/design/cg57-highlighting-parity/typescript.png"
+    },
+    {
+      "sha256": "d4acef6cd4c82e18dca24c4512f7d42b3a5ea7734e39389599314b091bdbc36e",
+      "path": "docs/design/chained-call-resolution.md"
+    },
+    {
+      "sha256": "275019dd24debf43cbddd18169b23504d2d5328e574450e362037d3bd7f0c222",
+      "path": "docs/design/codegraph-ui-design-spec.md"
+    },
+    {
+      "sha256": "c41605ef3e2e81cdef3044a2af682d192afab79767920bf105949b3edaf5dd88",
+      "path": "docs/design/csharp-kernel-port-checklist.md"
+    },
+    {
+      "sha256": "3fe12a6af0ac1187b13e6ed238d6b68633b16d97e127cc7626538dccbc9beb13",
+      "path": "docs/design/dart-kernel-port-checklist.md"
+    },
+    {
+      "sha256": "fbdb6047f8a665abe8ade911fe48c061223ebce42c740de34496b217db1b8c61",
+      "path": "docs/design/dispatch-synthesizer-backlog.md"
+    },
+    {
+      "sha256": "4819d66dfcf43d4c81857feb2cd5db759c3a081390bdd99a7146b0cc11496e00",
+      "path": "docs/design/dynamic-dispatch-coverage-playbook.md"
+    },
+    {
+      "sha256": "74655d809bb5081e009b86601d158f0e0291006b650d7857cea746c4a7ad5e4e",
+      "path": "docs/design/explore-budget-allocation.md"
+    },
+    {
+      "sha256": "5218d550e0fc56d6685991eb8bdf439f3344cc1c46ed86e187389250587a963e",
+      "path": "docs/design/explore-session-dedup.md"
+    },
+    {
+      "sha256": "76d45316da0464b410ab3085162dabf22b66d560fffb758733708247d2c124ef",
+      "path": "docs/design/framework-coverage.md"
+    },
+    {
+      "sha256": "9d713c953bb4f898149993e1be1877a1683a595eb209525cdcd61cf9422b179d",
+      "path": "docs/design/function-ref-capture.md"
+    },
+    {
+      "sha256": "37aada7a3acebd2040d1a2ef6a34ee25d3527c7f73adcdc4385c669ba3261521",
+      "path": "docs/design/generated-file-detection.md"
+    },
+    {
+      "sha256": "37dd4b6612b0954401cd09d135b222aaf6868fc93b6d3b61dccc939d34b0eb41",
+      "path": "docs/design/kotlin-kernel-port-checklist.md"
+    },
+    {
+      "sha256": "128b5c62b22cd424643f23f03219d618c831fe6acac75d43bab5bd4abbc6da5a",
+      "path": "docs/design/lua-luau-kernel-port-checklist.md"
+    },
+    {
+      "sha256": "30c8fc68adccc70d5c08285a1abbe69a12d9c48ae22e73f784ab2390879465f5",
+      "path": "docs/design/main-thread-stall-followup.md"
+    },
+    {
+      "sha256": "709e9023a58e18a7f02fe57559fffbdc529b29fb0dbfc17e0e5fb3aa665b6ce3",
+      "path": "docs/design/mixed-ios-and-react-native-bridging.md"
+    },
+    {
+      "sha256": "80d50602da334e09e66fcc6ab2bcde5a43ad29c5a2d5abfe584d9a6ce4dc2a8d",
+      "path": "docs/design/native-extraction-kernel.md"
+    },
+    {
+      "sha256": "6805aa7abb3c5a2b4e4aafe5e864738937a5b629804c5e6130d14976be7893f7",
+      "path": "docs/design/php-kernel-port-checklist.md"
+    },
+    {
+      "sha256": "2df13d442fd7a7c53e019b95d4c0897b4fad90d17284d583bec13a3b46a96e1b",
+      "path": "docs/design/r-kernel-port-checklist.md"
+    },
+    {
+      "sha256": "791c532a4cd79f054919a3c5ca577aee3296c1905444b932acde73d0b15eb7b6",
+      "path": "docs/design/ruby-kernel-port-checklist.md"
+    },
+    {
+      "sha256": "710531fb847d6f2924bd16cda77d3798051acbe02fdcba18cd132528d5b353b2",
+      "path": "docs/design/rust-kernel-migration-plan.md"
+    },
+    {
+      "sha256": "abf0df16d450b93884ad3b5f7a8f83a1f8c856d819d1c11fb922d452b207f0ca",
+      "path": "docs/design/rust-lang-kernel-port-checklist.md"
+    },
+    {
+      "sha256": "bf7cb55a1e2f73a9666cf3566c94c4ca7ceaf44f7a046816f696821f287c256d",
+      "path": "docs/design/scala-kernel-port-checklist.md"
+    },
+    {
+      "sha256": "a66ab1c24af0b71245f3f0511c124fc3e96a13971f0a67bb460736fdcc73f404",
+      "path": "docs/design/swift-kernel-port-checklist.md"
+    },
+    {
+      "sha256": "daff56ef17a38059f0c6485cc2f9aea45e3cabd14dc73fef1e0629e507549489",
+      "path": "docs/design/telemetry.md"
+    },
+    {
+      "sha256": "7ddf53824e6455276d76d6632713444689b11ab9639a944c903fe678c9599482",
+      "path": "docs/design/template-markup-parser.md"
+    },
+    {
+      "sha256": "20f6c723c8ad009c132b035f8b671b42d18a3b62181e5deb2dd03da737c78c85",
+      "path": "docs/design/value-reference-edges-playbook.md"
+    },
+    {
+      "sha256": "81143251fe59a5f98a90e46b5d0a9cc3acef80a6f9b7a53ad8a81af434aded6b",
+      "path": "docs/design/value-reference-edges.md"
+    },
+    {
+      "sha256": "3a1da98294a7e5dce10c3dde235190655d7964d1cfd759e96ca16842c6a2376e",
+      "path": "docs/from-chat/no-it-s-the-opposite.md"
+    },
+    {
+      "sha256": "11d9d21a5d01a1a53ce46195227fc4f13335073fa5e76960a01cb536bf4eb331",
+      "path": "docs/grammars/tree-sitter-cobol.md"
+    },
+    {
+      "sha256": "1ac407155e29e0b90e34b662f07f0d63ce3a0af310afdd40b4ed5b674b672a1d",
+      "path": "docs/grammars/tree-sitter-cobol.patch"
+    },
+    {
+      "sha256": "de05e926c3b34ffffc4195baa56a4f9bca765c3afbfd04ba5d643b23da3f2073",
+      "path": "docs/grammars/tree-sitter-kotlin.md"
+    },
+    {
+      "sha256": "5f10fc2ddd9b6c4dc2b5ae0d255231368027a4c1866976daafc0b17a7edc2e87",
+      "path": "docs/grammars/tree-sitter-kotlin.patch"
+    },
+    {
+      "sha256": "6265269727eb8c44ef74eca67e843c4fea23505ea57ec69a6004502a8feb6a16",
+      "path": "docs/grammars/tree-sitter-swift.md"
+    },
+    {
+      "sha256": "81c246f61946ac6dc6fdbbe82616ad44992c85af48ca8e9d2b563e5f687c2b24",
+      "path": "docs/grammars/tree-sitter-swift.patch"
+    },
+    {
+      "sha256": "0a677492e7c72337d008d3ff52e01f0a0b7ded34da3c79ee6daba5e979d567da",
+      "path": "docs/grammars/tree-sitter-typescript.md"
+    },
+    {
+      "sha256": "13ceb5f72a82c0954b3792ae76044bc06ce541d529ee1b9dfe843fc6f1b410eb",
+      "path": "docs/grammars/tree-sitter-typescript.patch"
+    },
+    {
+      "sha256": "daedbe782662467e0229d3cf95ddea4f7da2fd7f334c91380b2ad1d27347a546",
+      "path": "docs/grammars/tree-sitter-vbnet.md"
+    },
+    {
+      "sha256": "89124753d87a89a54f3f915bfdbec61cff81d3c6106fbd243633440233fbb8fa",
+      "path": "docs/grammars/tree-sitter-vbnet.patch"
+    },
+    {
+      "sha256": "0b3bb5bb8886764c871c05a1505aeff575c1344c9cf2d0b2bd4a3b66b450c89f",
+      "path": "docs/grammars/ts-differential.md"
+    },
+    {
+      "sha256": "8756add55125badecadee843413015b544267d11011ad3ab5f66de7840295abd",
+      "path": "docs/grammars/web-tree-sitter-runtime.md"
+    },
+    {
+      "sha256": "c2818515e33bd7fb52306981816ce0b313032ea60bef74f9231847cd7318059a",
+      "path": "docs/grammars/web-tree-sitter-runtime.patch"
+    },
+    {
+      "sha256": "50d84ee87000f08a613349e955625877408965aa28b0d3a239db65ee3a02805b",
+      "path": "docs/plans/2026-04-24-framework-resolver-extract.md"
+    },
+    {
+      "sha256": "9ec983aa6c6f3176e67e7f01d448f15800666f5af291eb4e021d939967e5a11a",
+      "path": "docs/plans/2026-08-28-steps-and-screens-for-apis-and-web.md"
+    },
+    {
+      "sha256": "3350b9c1a9a910868ef1e37dba32daeaff1081ce90c9e02aa57aefe3abaf734a",
+      "path": "docs/plans/2026-08-29-steps-in-code-order.md"
+    },
+    {
+      "sha256": "96f23660a46dc137bf794cbf604fb421817d17dfcbb80600e4e37ca08e0a4afe",
+      "path": "docs/viewer-launch-changelog.md"
+    },
+    {
+      "sha256": "024091f428cac6eaa217bae8f840a9572a91daab974a8354085ba72f86f6aee1",
+      "path": "install.ps1"
+    },
+    {
+      "sha256": "e8bbcc694584d5c88fa7c25103fc0f9c238d63a86c1494ca03448b680dbcc86e",
+      "path": "install.sh"
+    },
+    {
+      "sha256": "dfe0cdd6613508566d4c5f4eee00bcb1bb3e87bfb24cac3e9f83ba32a1f34895",
+      "path": "package-lock.json"
+    },
+    {
+      "sha256": "f9355cee809ed0065b6d76851608475195ce10dfb07c76e8e8af4a5b909d1692",
+      "path": "package.json"
+    },
+    {
+      "sha256": "c1214d5da2e231d7f8d4bf59f68158ca64e34f7bb8ab2013fd151e43307d3f51",
+      "path": "scripts/add-lang/bench.sh"
+    },
+    {
+      "sha256": "2d75d687d1780af337a7a177e9daf6c6e1101f4021e8f9286cce3433fcd4d2a3",
+      "path": "scripts/add-lang/check-grammar.mjs"
+    },
+    {
+      "sha256": "2a0c71d70ad4f639537d8a0095078db25a88abd17604bd7ae2397837501cc262",
+      "path": "scripts/add-lang/dump-ast.mjs"
+    },
+    {
+      "sha256": "71df5a6aa6324e18e23c8a9251102d22b252b09afb0ea8258df6bd16ad117fa0",
+      "path": "scripts/add-lang/verify-extraction.mjs"
+    },
+    {
+      "sha256": "3088b35e56ee5b86463b5998e3454fcde10c9f3f298547ec64b156eb35995179",
+      "path": "scripts/agent-eval/ab-adoption.sh"
+    },
+    {
+      "sha256": "e2100cff3c1542067fbb52cb56e11cd0977013710c59482cffeb69abeb8a779f",
+      "path": "scripts/agent-eval/ab-hook.sh"
+    },
+    {
+      "sha256": "7015578ebbfb4fa8097fd113d6048bd13d85983aaa708b18baf16e065018412e",
+      "path": "scripts/agent-eval/ab-impl.sh"
+    },
+    {
+      "sha256": "6ed5cbda490b4c2c9d16f8860a8b8d644d499915a85c1f8cbe5902e322d3fae4",
+      "path": "scripts/agent-eval/ab-new-vs-baseline.sh"
+    },
+    {
+      "sha256": "1654e4e4ea7d69de498cc0090a020ac70ca60215d12d2addad9f6caf963391f6",
+      "path": "scripts/agent-eval/ab-sufficiency.sh"
+    },
+    {
+      "sha256": "8938b8d0c45bb2e02fc2b322c9d3857896d1e90b323fee11184b370a9bc788b3",
+      "path": "scripts/agent-eval/allocation-fixtures.json"
+    },
+    {
+      "sha256": "573d67fcd5f25316310070430f5f5dcfb8a05540bf024429d567b54b4f641861",
+      "path": "scripts/agent-eval/arms-F.sh"
+    },
+    {
+      "sha256": "8bac09e98ac9621a7ecb645652c3f8fb6adb8663a68674267795cf99d555c1f8",
+      "path": "scripts/agent-eval/arms-matrix.sh"
+    },
+    {
+      "sha256": "58bcf7dc002f2bb53990a66de7bea7b4af24dde6597425975a2907106d9e57dc",
+      "path": "scripts/agent-eval/audit.sh"
+    },
+    {
+      "sha256": "ea39934c3ed2af80f68606ff33616f534edfd6febb111cca454f07189a60adfb",
+      "path": "scripts/agent-eval/bench-readme.sh"
+    },
+    {
+      "sha256": "0a71ed8f3c7f4007d6656e63d58afed6e37941d6798a8a11ddb17d1e487bc7dc",
+      "path": "scripts/agent-eval/bench-why-repo.sh"
+    },
+    {
+      "sha256": "8c447e367d0b6b3f3a3bc4ee81e6601d7b638bbee48fbd819ac89e9509301336",
+      "path": "scripts/agent-eval/block-read-hook.sh"
+    },
+    {
+      "sha256": "2e421fe14a985ca0fe4ea7659f0a74befb4af568075164aef8bce57e4798bcfa",
+      "path": "scripts/agent-eval/compare-arms.mjs"
+    },
+    {
+      "sha256": "b6984a558767a6618c3040339b8ebefa56f2744e498b122036e15cdf33994cfc",
+      "path": "scripts/agent-eval/diff-index-drift.mjs"
+    },
+    {
+      "sha256": "bab6491ed370ed4ebc60e3c579540e197b622e86f2ace649a8db333d1b3c93e6",
+      "path": "scripts/agent-eval/hook-settings.json"
+    },
+    {
+      "sha256": "1806ddc3c7e6ae48b6b25ccc31b32caa8415c87544333f18bffe2742535064f3",
+      "path": "scripts/agent-eval/itrun.sh"
+    },
+    {
+      "sha256": "c78dce9f9c3d0e69d7acd34295a8753ae3276a716bd0d6fa82a47561122101a4",
+      "path": "scripts/agent-eval/no-cli-shim.sh"
+    },
+    {
+      "sha256": "e04979085cff1581f7dc888599b2d3cfe5a3dadbcbf521c9785dba6274594012",
+      "path": "scripts/agent-eval/offload-eval-3arm.sh"
+    },
+    {
+      "sha256": "f4f546efc8bf5a9979af7893b6dca708b05456537c444e2db7b73227361c6d05",
+      "path": "scripts/agent-eval/offload-eval-cost.mjs"
+    },
+    {
+      "sha256": "6e8bcec6afd2f5b3404f140805761fea7994fcccae10fd3664d9563ef7b96e28",
+      "path": "scripts/agent-eval/offload-eval-effort.mjs"
+    },
+    {
+      "sha256": "82a24f23b74736b2f1f8b945d4803ce39af469cd47fc3711a9c175dd6cbcc432",
+      "path": "scripts/agent-eval/offload-eval-frontload-matrix.sh"
+    },
+    {
+      "sha256": "7220e7f0479ddf79763290fdf44ef0cf0a28d9271c95812d68852295d0fb31a4",
+      "path": "scripts/agent-eval/offload-eval-frontload.sh"
+    },
+    {
+      "sha256": "d75fa3e2a1878a295f729060573bb4aeef1e77e9a51cbbbe4f7c948aa47fad5a",
+      "path": "scripts/agent-eval/offload-eval-ground-truth.json"
+    },
+    {
+      "sha256": "9d557c7479ace4c340f4fb96a3b0c78c0b04512cb61e58c63dd271d2f597c340",
+      "path": "scripts/agent-eval/offload-eval-hook.mjs"
+    },
+    {
+      "sha256": "691c21e5ed5c5aca356e7d3dac7bef1adfaa995d641295da0e0e73958c3522b6",
+      "path": "scripts/agent-eval/offload-eval-judge.mjs"
+    },
+    {
+      "sha256": "07b513f6d6fcebaa9470cdddfa7b4bab6f60421d6f7a0e589d596314454b27f6",
+      "path": "scripts/agent-eval/offload-eval-matrix.sh"
+    },
+    {
+      "sha256": "5fdf287610f27dcc0aabf0f81069b118af6633b82657562ef695d9d32e2191e8",
+      "path": "scripts/agent-eval/offload-eval-metrics.mjs"
+    },
+    {
+      "sha256": "862e13d9b1b4dcc55dd2b452e18e042a18e9696e7fa14f2baf015ce3851a5de1",
+      "path": "scripts/agent-eval/offload-eval-refs1.sh"
+    },
+    {
+      "sha256": "d494a002144426284e9b5a2f8f5121f4ac53271c9677f463ccbcd4d405d72822",
+      "path": "scripts/agent-eval/offload-eval-setup.sh"
+    },
+    {
+      "sha256": "10b2089196c866d5b6f43bebb82caa80128ebcc8e74ac708142c65fc8b981464",
+      "path": "scripts/agent-eval/offload-eval-styles.sh"
+    },
+    {
+      "sha256": "1c07fdf2e400521f8fdc9e67ec72c5cf9e5feeaf8ff575882a5d2481f27d3bf8",
+      "path": "scripts/agent-eval/offload-eval-summarize.mjs"
+    },
+    {
+      "sha256": "fd302522a0d9be512731c65e4aaccfce9ba3d48685d5cd5a02117e94578b2269",
+      "path": "scripts/agent-eval/offload-eval.md"
+    },
+    {
+      "sha256": "4d6e184328964b4b580fcd441fd6b9b2e888483844c1ef601e58443652a2f8b1",
+      "path": "scripts/agent-eval/parse-arms.mjs"
+    },
+    {
+      "sha256": "e6e613a6aa9f5fff8f6ee631ba19359687a21632c1733dbddfeb27623186b7cc",
+      "path": "scripts/agent-eval/parse-bench-readme.mjs"
+    },
+    {
+      "sha256": "5e430b735b74be11c3a02ec357e636e293a48e94fde0384bd09f27ded4767b89",
+      "path": "scripts/agent-eval/parse-run.mjs"
+    },
+    {
+      "sha256": "eb7f7c06867a5a91c81262144f8d26759862b8d112c400a2a1f72916074f4453",
+      "path": "scripts/agent-eval/parse-session.mjs"
+    },
+    {
+      "sha256": "6f6584d4ce673987d0309154fda54b82a301814bb10e9c5e6e606eb1cd8745cd",
+      "path": "scripts/agent-eval/probe-allocation.mjs"
+    },
+    {
+      "sha256": "8ee6337716b902ab52c238ea62944b8fe636e5dbafc9a86f07224e9949d78246",
+      "path": "scripts/agent-eval/probe-context.mjs"
+    },
+    {
+      "sha256": "2e75118d8524aa26dd1a337ba8cfff0d39fdcd0183cc8d5e27ef5c0b76dfee8a",
+      "path": "scripts/agent-eval/probe-decl-only.mjs"
+    },
+    {
+      "sha256": "27d65b3aa2986e61bb49b3bad8c24ec934c3c56d001be587f90cf459c9ffb058",
+      "path": "scripts/agent-eval/probe-explore.mjs"
+    },
+    {
+      "sha256": "d54a93a0e628c10ee8efa5021dcb954d1b09a71e7c20d1342c68c75dd73f7eac",
+      "path": "scripts/agent-eval/probe-factory-closure.mjs"
+    },
+    {
+      "sha256": "4705bf317f1cf6c6a1a49a8cea874885daf076c824bf3443fc65da817dfeea4f",
+      "path": "scripts/agent-eval/probe-file-spend.mjs"
+    },
+    {
+      "sha256": "e33100c18aab1d3172398c36795e1f2142a37ddfe4ca45696675fcbe6fa9d686",
+      "path": "scripts/agent-eval/probe-named-symbol.mjs"
+    },
+    {
+      "sha256": "91dd71874765968a8b315543be630f7c4da4de3606581e15e518836e89bf7884",
+      "path": "scripts/agent-eval/probe-node.mjs"
+    },
+    {
+      "sha256": "753958f05047fe64bc8aaabd2762401c5a6705e2d585a38d0fdd8514882d2f5a",
+      "path": "scripts/agent-eval/probe-suite-envelope.mjs"
+    },
+    {
+      "sha256": "7549868597a92e9894954599e37d2f3c79e85153091599772279a9ff8b4f06b8",
+      "path": "scripts/agent-eval/probe-sweep.mjs"
+    },
+    {
+      "sha256": "be222f9fa0b067e4085a5f706c024ed120b483540c4a41daf1a8ef02338ec2d1",
+      "path": "scripts/agent-eval/probe-trace.mjs"
+    },
+    {
+      "sha256": "80b452911b785f1a9fad6faa9c4f93c04e7e90100b41923510b62b0feea23fdb",
+      "path": "scripts/agent-eval/redirect-read-hook.sh"
+    },
+    {
+      "sha256": "f59fabb37c46ab79fad54a2fbca82a01b6fa8432c9bdeb9571139eb38a353461",
+      "path": "scripts/agent-eval/repro-concurrent-explore.mjs"
+    },
+    {
+      "sha256": "0d990354fef2beef20e7a81e2d8c9f2030f4a7caa575519777f8906e69c6c9a1",
+      "path": "scripts/agent-eval/repro-daemon-clients.mjs"
+    },
+    {
+      "sha256": "b7898f47b9542913bdabfab78e73c2cc32ac616bbdd1536b35f7bc997ef2d413",
+      "path": "scripts/agent-eval/run-agent.sh"
+    },
+    {
+      "sha256": "6df9a9bf7a59e32ad75dff97e8f4aea22148c4c0b03261ee9d5644d1476c77f4",
+      "path": "scripts/agent-eval/run-all.sh"
+    },
+    {
+      "sha256": "31b47a6f0fe4013fe365955bbe7f42dcac6d41f57da82936faf2b0dbbf1f7efb",
+      "path": "scripts/agent-eval/run-arms.sh"
+    },
+    {
+      "sha256": "d3a8992d913035a3397be80fbf8e0901afdce0814c596719406530028eac48a1",
+      "path": "scripts/agent-eval/seq-matrix.mjs"
+    },
+    {
+      "sha256": "6535864adb05539e7b236c8e95af78b358edd0949967e96edbff1fc54e3dec2f",
+      "path": "scripts/benchmarks/measure-index.cjs"
+    },
+    {
+      "sha256": "3315ff7ecb71912e75fb0b8997289caddee1f2c1782918084b71d51ba063ab1b",
+      "path": "scripts/benchmarks/observe-index.py"
+    },
+    {
+      "sha256": "5aa40f6f60f3e305c56265c108931b1a739758ab65a749003bd3f84ad4e25d97",
+      "path": "scripts/build-bundle.sh"
+    },
+    {
+      "sha256": "19f43f1ab3cf5b2c4b0f4def3d87014de2fcda211127a01307dcb537cf3d6011",
+      "path": "scripts/build-kernel.sh"
+    },
+    {
+      "sha256": "d4cb5fc4d1c765d183aa33e8e84c21245ff55748d0f03562e3b6c04c0727c548",
+      "path": "scripts/check-ui-build.mjs"
+    },
+    {
+      "sha256": "920bb8e9b1aa72d35bf0ef60c3a989b6952f237cf22a1a1ff79aa76a4fb59983",
+      "path": "scripts/check-ui-package.mjs"
+    },
+    {
+      "sha256": "3a50d09655d7e295d1c0339aed960a68cbdaaa6185adb5c1c5a1f805c8f66ffc",
+      "path": "scripts/dump-graph.mjs"
+    },
+    {
+      "sha256": "cb9a9a4a5eec30b66d0767adc9def79fcc6e9b6cd275517420cced9d12fe9a43",
+      "path": "scripts/extract-release-notes.mjs"
+    },
+    {
+      "sha256": "fd933f4663c255accaca6377494f0131da153586cd08b39fcfc916be10f41b53",
+      "path": "scripts/gen-go-stdlib-methods.mjs"
+    },
+    {
+      "sha256": "fa1ebcd6cab9a8c32a1e2994a96bcaea53be3192b52707920da8e0be1483f707",
+      "path": "scripts/kernel-parity.mjs"
+    },
+    {
+      "sha256": "a7b3505a072cd4d5cce51f2fa86ed450b7605925a1a720889da61f42b3a7b6d9",
+      "path": "scripts/local-install.sh"
+    },
+    {
+      "sha256": "d3918be4847bfb387eea87074131849f7df4c21f609038ed3b7214073c190880",
+      "path": "scripts/npm-sdk.js"
+    },
+    {
+      "sha256": "c20166caa9725a1f36370eb1b101804336bef75bc075b46fc39a0d7be2502f99",
+      "path": "scripts/npm-shim.js"
+    },
+    {
+      "sha256": "7fc0fdea5063114de25cecc8578ea00b7f47b1732ddcd111aa98521f018f47ae",
+      "path": "scripts/pack-npm.sh"
+    },
+    {
+      "sha256": "c2b6acfde905394c66e14dadac7b0394c30ce79f329569ab553d0c7a905ceb14",
+      "path": "scripts/prepare-release.mjs"
+    },
+    {
+      "sha256": "25267a727c10944b7c7d60de0c25d577d23e08da3ba721cb353a211356f1f02f",
+      "path": "scripts/sync-ui-version.mjs"
+    },
+    {
+      "sha256": "e2d744996a8c70bb60e59f5c0bedf7296e9d88a15700167c804a33ad27960432",
+      "path": "scripts/tree-sitter-runtime.mjs"
+    },
+    {
+      "sha256": "000ab24c5f7829793803985ef6ee5ccbb281f4f6200b6515e4d8f5065119c407",
+      "path": "scripts/try-repo.sh"
+    },
+    {
+      "sha256": "3f31aa6a8b2a54cc07a87d40f72fe13e657c0287f6e2e0bec199752082d13e1b",
+      "path": "scripts/ts-differential.baseline.json"
+    },
+    {
+      "sha256": "7a6e920ec05a8477fcebb652c43b7c87bff53e8d6d4462308e18d2e2d600c58f",
+      "path": "scripts/ts-differential.corpora.json"
+    },
+    {
+      "sha256": "16e4eebf100eea82e5b24f322be43284526a50fcee4fa66c0638b8e34588b5c8",
+      "path": "scripts/ts-differential.mjs"
+    },
+    {
+      "sha256": "aed4acb5efe62ec7d514fbdfcdb4227c7904d6c4ad17be6157c4c453cdab9578",
+      "path": "site/.gitignore"
+    },
+    {
+      "sha256": "4817bd9256b72dc69d41668e46469b3e6cc2a1c90b9138aad863b2f7b152d7a0",
+      "path": "site/README.md"
+    },
+    {
+      "sha256": "14bfbf369f117c7aa54737f443414445598ba8ab5e0a18cc7ab7a0fdb5795a8a",
+      "path": "site/astro.config.mjs"
+    },
+    {
+      "sha256": "d6a92f8f09ebc256df066e450a421f69c7c27486734cc0dc85d633f68dea7d5c",
+      "path": "site/package-lock.json"
+    },
+    {
+      "sha256": "804542929ee9e9c93c9449fb849f00637d088152d1166f97c90ad7f62234a064",
+      "path": "site/package.json"
+    },
+    {
+      "sha256": "29a86771367203f7cd9a8faecd33ef1b5539045d788f36156b5dbc297e01ec95",
+      "path": "site/public/favicon.svg"
+    },
+    {
+      "sha256": "64f2d3879c52d8159874e0e79dcd1c9f81eed525c01b2a655229fe8613da746e",
+      "path": "site/src/components/GraphDiagram.astro"
+    },
+    {
+      "sha256": "4e5a7fa7baaa99eb95a13c758abfc26a87eb82fa9f0ffc24029019df34901848",
+      "path": "site/src/components/SiteTitle.astro"
+    },
+    {
+      "sha256": "9fe20272451aa124c583267eb9fc682aae6df6f5fb807bb9bae261553061efea",
+      "path": "site/src/components/SocialIcons.astro"
+    },
+    {
+      "sha256": "219d8b0c1870d43ba4e59fa712d262acb61e93101a8234ef75224d026c8ccba1",
+      "path": "site/src/content.config.ts"
+    },
+    {
+      "sha256": "3d11b786bac742dd88fa6468783faf3c459ce77c519bef1507f5c553d2ed2a58",
+      "path": "site/src/content/docs/core-concepts/how-it-works.md"
+    },
+    {
+      "sha256": "97f6ac3989c444bec6210d5057e9b0b7438603f426ca483ed431a002687649e2",
+      "path": "site/src/content/docs/core-concepts/knowledge-graph.md"
+    },
+    {
+      "sha256": "1f0b54dfdd8174e69e0c0f57b207dda66d5576a8b9cf9aacf1746f9d1e91ff35",
+      "path": "site/src/content/docs/core-concepts/resolution.md"
+    },
+    {
+      "sha256": "d54f2fa1cccd56edc83cfce946ea18aefc5b49f63847d02b499f99b36062a730",
+      "path": "site/src/content/docs/getting-started/configuration.md"
+    },
+    {
+      "sha256": "08c92016753f8223f8eb461408241aeea6a4cac5707762e4fbae9d1350a9cff1",
+      "path": "site/src/content/docs/getting-started/installation.md"
+    },
+    {
+      "sha256": "2e0d9480ad3d3189e33f341856fe5b8b8b0bc4a164f5a8dcb5f5ae0da2f8fcd2",
+      "path": "site/src/content/docs/getting-started/introduction.md"
+    },
+    {
+      "sha256": "adc3fc4aa6d9e44aeb085421240101a23a455d54d43c3aefdbc09e44ccf0c07e",
+      "path": "site/src/content/docs/getting-started/next-steps.md"
+    },
+    {
+      "sha256": "9ae97bf76106bf8beacc9a723fdd79ac7aa7b33d9fd3d7082234c852b9cf7688",
+      "path": "site/src/content/docs/getting-started/quickstart.md"
+    },
+    {
+      "sha256": "ca8d4e3c5e793608ae4247cb48c23cc8bffb4b3cdaa339b241a992ae73aa8cf7",
+      "path": "site/src/content/docs/getting-started/your-first-graph.md"
+    },
+    {
+      "sha256": "089711f7cb8cd6d73292740a7b4f8964429eb20a1904a1fd1ea36adeb2491c67",
+      "path": "site/src/content/docs/guides/affected-tests.md"
+    },
+    {
+      "sha256": "1961a07d394efb50b40b7b64bf9d0c99bc423062d25e13ec0eebaad7fe737d8e",
+      "path": "site/src/content/docs/guides/framework-routes.md"
+    },
+    {
+      "sha256": "d1f6257031df6b0624519d46596d5b80504aafc9e57b6ac9258acce85adc79e0",
+      "path": "site/src/content/docs/guides/indexing.md"
+    },
+    {
+      "sha256": "c81227da888c309823f41a91e0d258b9f56f5113ed471ebb306e50945c6d9802",
+      "path": "site/src/content/docs/guides/viewer.md"
+    },
+    {
+      "sha256": "01adfe48f0aba272b7f3127fa57fb217ad66762e7cd299d8d12bf5d034de30d1",
+      "path": "site/src/content/docs/reference/api.md"
+    },
+    {
+      "sha256": "89f4bd6c512cf00a858838246e6a0b80bc9bef46fb7c1a05e928ebb323328368",
+      "path": "site/src/content/docs/reference/cli.md"
+    },
+    {
+      "sha256": "c077c8b981646105f4801b90ca767c976ae0f45774be63570df316cfc032971a",
+      "path": "site/src/content/docs/reference/integrations.md"
+    },
+    {
+      "sha256": "25caf488b3abc04bec19fcb0587b72467dcdd8dc46acf7e1867d6f4373aea41b",
+      "path": "site/src/content/docs/reference/languages.md"
+    },
+    {
+      "sha256": "bba545f21a0f9b84b3d00a5a8fc1889f99b8af8a83d0563f83d0ccaf8c63d785",
+      "path": "site/src/content/docs/reference/mcp-server.md"
+    },
+    {
+      "sha256": "9c44b5daa72c682f070b177e2f0a5f97b5b774f22180e448641045efedeabd0e",
+      "path": "site/src/content/docs/troubleshooting.md"
+    },
+    {
+      "sha256": "a1ccf112162328b89b346faa6edaa9d99f88e943a6f3fe2aa113c080e1b56c56",
+      "path": "site/src/lib/github.ts"
+    },
+    {
+      "sha256": "adabc98534ae37bd607c72df2fa0823ee1af7f337d9bda088dea79e6a7e5d548",
+      "path": "site/src/pages/index.astro"
+    },
+    {
+      "sha256": "f82fbed95f3320e498535c765acfe84cc3aa92383a46ed59eb91557076711237",
+      "path": "site/src/styles/theme.css"
+    },
+    {
+      "sha256": "b5b0a5b04a14cddd7713c5e1c82e86c79c17c2f86b170e26e9b170b3d5e01cd9",
+      "path": "site/tsconfig.json"
+    },
+    {
+      "sha256": "5a82580b35949e595b2f1b02f2cf66931a9a64ba2f249d9d1a0370ec67843987",
+      "path": "src/bin/codegraph.ts"
+    },
+    {
+      "sha256": "4979b59fed8dac4029555c97b31ebd97517ad6961cd7f3a897797ef0f566d844",
+      "path": "src/bin/command-supervision.ts"
+    },
+    {
+      "sha256": "76568ee7eb52e87bde7342889e4323f89b0b45a6a7a56391decabeafed7ee10a",
+      "path": "src/bin/fatal-handler.ts"
+    },
+    {
+      "sha256": "220e4d03d62dc73d21d4691ff31c76745bf3efa4a78e6d3c0def52c5eece2894",
+      "path": "src/bin/node-version-check.ts"
+    },
+    {
+      "sha256": "84572356a6296a158cf2957a9c404965f99b5133f72dcf491d37f49febf8cb97",
+      "path": "src/bin/uninstall.ts"
+    },
+    {
+      "sha256": "9073d1375bfc431aa4668a1bb6384cf6b2341e2338f53c3ccf69da90c10aabf3",
+      "path": "src/bin/viewer-gate.ts"
+    },
+    {
+      "sha256": "df96ea5570df39960f54178a68a37dc7f153d000833ba2cf8ea2580eaa9b3cfb",
+      "path": "src/compile-cache.ts"
+    },
+    {
+      "sha256": "91a8ab80fed68e548d5b2aaf64b601ba4352a88ef5d5c13f4c66c1e2de9d4083",
+      "path": "src/context/formatter.ts"
+    },
+    {
+      "sha256": "6f1ef940544255da29826d3823491eddb0f4e4a221fa8d89888eba5ecab1a352",
+      "path": "src/context/index.ts"
+    },
+    {
+      "sha256": "78914262dea5355a85caa7adf810646dedf1ba0901d09aff934770d097a9077a",
+      "path": "src/context/markers.ts"
+    },
+    {
+      "sha256": "acdebf3843d2f4006ccaf5b420895772ce1d8f42524e1363cbaf8adf5beda337",
+      "path": "src/db/index.ts"
+    },
+    {
+      "sha256": "639198044223996691a9335f7675c78bb628331cdd45bb5a468aec41ffa5ef00",
+      "path": "src/db/migrations.ts"
+    },
+    {
+      "sha256": "65f5ceaac2926b8201646e6fb192d9e77a9214f0b14ab3abb71a19d020df6a91",
+      "path": "src/db/name-substring-index.ts"
+    },
+    {
+      "sha256": "b9c08e9cbeb4fdc7241a997914f09b05f9f4a1b2520554fff06512009f24dc0a",
+      "path": "src/db/node-sqlite.ts"
+    },
+    {
+      "sha256": "86470400ae6457363474a365ecf896abfe9baf940c3ebcb7196eb38b32ac40c3",
+      "path": "src/db/open-error.ts"
+    },
+    {
+      "sha256": "df86acd7d0b5b39baec6b75b68ba3573b124424a41e26d00a3b6d0b8ccf9d382",
+      "path": "src/db/parameter-flow-queries.ts"
+    },
+    {
+      "sha256": "b87a71ce7ce2170f224ab81ee8e02de5f3ca07501cd5165142ab5fd12e23dca4",
+      "path": "src/db/queries.ts"
+    },
+    {
+      "sha256": "86276f8acb75e0f94ddd65d8b408862938653e97b24e47b7f64f6783f7edd342",
+      "path": "src/db/reference-tail.ts"
+    },
+    {
+      "sha256": "c204a9a927e65ac8d909a5af32f0e7ee8029c788f9a4dbe19796295a83a5dedb",
+      "path": "src/db/schema.sql"
+    },
+    {
+      "sha256": "8723a415cf1591a6608420e5aa1f138cf7e169e57eca02be50e2ebef0e6c9df5",
+      "path": "src/db/sqlite-adapter.ts"
+    },
+    {
+      "sha256": "607968eb9888d437d804da355ddd390b3daa154a7d43a1cc241e5d100b67a7d6",
+      "path": "src/db/synthesis-stage.ts"
+    },
+    {
+      "sha256": "4e18fb4d801516ad31ec4802be9657fe21dcdbd6ee0a0d9a7fa425eeea221f59",
+      "path": "src/db/wal-valve.ts"
+    },
+    {
+      "sha256": "739a963a0a377bafe0216a8f299b2d24481173ecb29b6cb00f68d92c7e31d17a",
+      "path": "src/db/wsl-shared-index.ts"
+    },
+    {
+      "sha256": "228922199aa85574c718bc837310fd02c2078174e9fefe8bb009db1fa9ecc4f3",
+      "path": "src/directory.ts"
+    },
+    {
+      "sha256": "8eba050f1f4e7dfa7577c20c55dbeac9d0649877968f726b5f41fb8879449901",
+      "path": "src/engine.ts"
+    },
+    {
+      "sha256": "0d09c85b6d9aac9e6f655991a608d2d3f9d09c8ca6b80e764c2f2f18991ab8c0",
+      "path": "src/errors.ts"
+    },
+    {
+      "sha256": "1395e23810a211768af8ddb08d14d9ddc648d62caf8aefd98defdaec702b65e7",
+      "path": "src/extraction/astro-extractor.ts"
+    },
+    {
+      "sha256": "bcf5dca68136c6dba9ccdc58e4cb5a2538bc32355b104840143e52c78aad9d35",
+      "path": "src/extraction/cfml-extractor.ts"
+    },
+    {
+      "sha256": "c194fa2bc6d0306351a19ee7056edf8cc83a3c9b2d0f71acc1eaba7186c9ee7f",
+      "path": "src/extraction/commonjs-eval.ts"
+    },
+    {
+      "sha256": "416c2d0831d7dd61478fee71298e94ed122360fe38056a4a3fc38036455634a2",
+      "path": "src/extraction/commonjs-requires.ts"
+    },
+    {
+      "sha256": "83ca36b679bce28048c485b7a1c974c6cab0811350170320d6aada18bda49072",
+      "path": "src/extraction/dfm-extractor.ts"
+    },
+    {
+      "sha256": "4cdb5a2ce0ca9ee76c7ea48168c7441a93c8d6149652eb279e29f9cce06c02f8",
+      "path": "src/extraction/extraction-version.ts"
+    },
+    {
+      "sha256": "398eccd9a8807e9460f50ac3389fa3ec80effa3eb5cfe0179f80a6ecfb95d0c6",
+      "path": "src/extraction/function-ref.ts"
+    },
+    {
+      "sha256": "5a4a4ba90920b184944f7a87ae0c0af67a41ca19497655be4a84e3e9631de52a",
+      "path": "src/extraction/generated-detection.ts"
+    },
+    {
+      "sha256": "4624209413eb7f6dbe4a394cf9cd59a4f2aa540960e2d3c99dd34c3ebea347c8",
+      "path": "src/extraction/grammars.ts"
+    },
+    {
+      "sha256": "539d2e22b6cbbc96524a9c288291a26a20489cd216d759ea08fd1eb26fd3e232",
+      "path": "src/extraction/index.ts"
+    },
+    {
+      "sha256": "c895619d01a0189d842b70b07fa605d0b029409d29b1a5c41a1cc044c23ad6f3",
+      "path": "src/extraction/kernel/decode.ts"
+    },
+    {
+      "sha256": "d1eeb86bf08c3c1e51401620cff0d6f214fbfea91849dbb8c5ebbddbac634e88",
+      "path": "src/extraction/kernel/index.ts"
+    },
+    {
+      "sha256": "e155d02dd147b53ce20119c30c94419f43de4d3c7723edc28c52f4bd11403203",
+      "path": "src/extraction/kernel/layout.ts"
+    },
+    {
+      "sha256": "80242011fec43535ee02c1e135fc7d7e4fbd9593628ea1191febb5f7758ff7ca",
+      "path": "src/extraction/kernel/loader.ts"
+    },
+    {
+      "sha256": "0c63bc9f2c8d81a0678a5e7db338a0607663318c56e3eb37be4d62df38a83fb3",
+      "path": "src/extraction/languages/arkts.ts"
+    },
+    {
+      "sha256": "3bb1f3b8051eb5db21db0af8d34678cf74cbe775aa676954ff9d5b95bd01147a",
+      "path": "src/extraction/languages/c-cpp.ts"
+    },
+    {
+      "sha256": "d0a967836f5d42f957f003cc68d491fc8131068212d33e5a8fa6c115ce22dbb7",
+      "path": "src/extraction/languages/cfquery.ts"
+    },
+    {
+      "sha256": "f20560b514179f8807ecf9c66bb94c5ea4b1f63e87a06f7f0fedfe644d083d65",
+      "path": "src/extraction/languages/cfscript.ts"
+    },
+    {
+      "sha256": "22321401f57a1d54fa3d15ac194e7ce36899cb58115b71d5ab8be6b6957ddd24",
+      "path": "src/extraction/languages/cobol.ts"
+    },
+    {
+      "sha256": "71dd828952737b1e42457ab42e241d538b78015da21dbaee425375971f8753b4",
+      "path": "src/extraction/languages/cpp-brace-scopes.ts"
+    },
+    {
+      "sha256": "826b211a8565b95e3a3db5b624edc6ffd4cc85478019d4ac8d1fb550739da840",
+      "path": "src/extraction/languages/cpp-macro-methods.ts"
+    },
+    {
+      "sha256": "c9a9ca20eaf05c5ad787dccccb3015d4972808c32260d4a4c1fa1f8b3738f022",
+      "path": "src/extraction/languages/csharp.ts"
+    },
+    {
+      "sha256": "ab2512b038e35000d1ed09eb2a453dea47bccecbc720289ea3d624c31c330115",
+      "path": "src/extraction/languages/dart.ts"
+    },
+    {
+      "sha256": "821f7690ac6a9b17f94cc29f0950a14d4131cfbc5797bc135a81d02b81056776",
+      "path": "src/extraction/languages/erlang.ts"
+    },
+    {
+      "sha256": "b58fb1a4147c24eb05dc441336af5bdd0481bb834c2bd47004e86f25483d6a5d",
+      "path": "src/extraction/languages/go.ts"
+    },
+    {
+      "sha256": "0edf8998340f0b38f6891cea36b74d07dff065c74d509b580922c083ee69ae89",
+      "path": "src/extraction/languages/index.ts"
+    },
+    {
+      "sha256": "264570376abc7fdbe9c1a5c8b78afcb095908e74062ec8fc3b56456e25d20470",
+      "path": "src/extraction/languages/java.ts"
+    },
+    {
+      "sha256": "7f364c6ae43c037ccecceaab8a4b722a2551bdf474b2c886f54b0bad4026bd26",
+      "path": "src/extraction/languages/javascript.ts"
+    },
+    {
+      "sha256": "587c6be444d55f9feb1b20f0ba5713b46368412d906fe6c7271cd0c09ebece69",
+      "path": "src/extraction/languages/kotlin.ts"
+    },
+    {
+      "sha256": "c3c16670b5848a1c758f271f362f4aa6963109efe5f0818c6e373bab7f504e8a",
+      "path": "src/extraction/languages/lua.ts"
+    },
+    {
+      "sha256": "0700bc2351acd0f28e1645e6983c056596d1e1f05e03e74575ce79f0cdd34181",
+      "path": "src/extraction/languages/luau.ts"
+    },
+    {
+      "sha256": "bb5fdf393eed145c4d4e85cc40d4348bab1af63ed1a8970867c1d49ce6e8aae2",
+      "path": "src/extraction/languages/nix.ts"
+    },
+    {
+      "sha256": "4db8ca81876697b174e5d82d4f8bd7622fedfe7727013d1abd40b676f251c16e",
+      "path": "src/extraction/languages/objc.ts"
+    },
+    {
+      "sha256": "412ac268535a075f63316b91639143ea27237bb904282abb116a318fc1ae1433",
+      "path": "src/extraction/languages/pascal-preparse.ts"
+    },
+    {
+      "sha256": "a65cfd9a8a475963cf47f51aef087554d08e036e7fce90e65df76acb6e9b8082",
+      "path": "src/extraction/languages/pascal-system.ts"
+    },
+    {
+      "sha256": "2d575ef9c6cf47b8f41bc5e3f3df9c45ec1d3f87d6101b233a8e68f868496df9",
+      "path": "src/extraction/languages/pascal.ts"
+    },
+    {
+      "sha256": "87e5ce9bf893a212bc93ae68829e3f20b4129cfc9669da890257c1f2e466743d",
+      "path": "src/extraction/languages/php.ts"
+    },
+    {
+      "sha256": "2b8310daacb8ffd05df135d5dd214b2d0c18b91d2c2113307d2742b05f2b02e8",
+      "path": "src/extraction/languages/python.ts"
+    },
+    {
+      "sha256": "9328da2860321f3bc4bea1ebe0df1f0079788caa9c298d347e40dabd16e7ddd0",
+      "path": "src/extraction/languages/r.ts"
+    },
+    {
+      "sha256": "2d247cd3f140c79cadbfcf8f0af9bfa70a60232bde430681481c8907fea3c177",
+      "path": "src/extraction/languages/ruby.ts"
+    },
+    {
+      "sha256": "e0f6792e5369b26447885d0999dd9ba040c27692ea7532dd36160ed32eeac315",
+      "path": "src/extraction/languages/rust.ts"
+    },
+    {
+      "sha256": "9c757ea51a2af565b9a4f34a36c4644f042f672051234027238cb1ef12b1bcb7",
+      "path": "src/extraction/languages/scala.ts"
+    },
+    {
+      "sha256": "0599e2a5ec2e38d00de19731a66cc8f2b84066e374a9e40bf7bf84e226f3d5fe",
+      "path": "src/extraction/languages/solidity.ts"
+    },
+    {
+      "sha256": "95d346801d7c88e4c2174298bd9f770ed8126091198d640d627bcea0126987f9",
+      "path": "src/extraction/languages/swift.ts"
+    },
+    {
+      "sha256": "a17da65504b59aa0053cf1f85791d55cd0d3740c33c1760a6df87c7db20e7f36",
+      "path": "src/extraction/languages/terraform.ts"
+    },
+    {
+      "sha256": "6be173fda01275618378ece9f54a3b28e572e1d25c5ceed07fcf157c399da6ca",
+      "path": "src/extraction/languages/typescript.ts"
+    },
+    {
+      "sha256": "d2f8544452766d2b5d415b90e3132bbd049478326080950988fe12db08880748",
+      "path": "src/extraction/languages/vbnet.ts"
+    },
+    {
+      "sha256": "9468c4ce85f46ad1531b6eda321ce6d52205406d15f83872b4f574dd90f4a1f8",
+      "path": "src/extraction/lazy-frameworks.ts"
+    },
+    {
+      "sha256": "f8b0c69365e34d08c5915afe5bc26679bca9bb343978b12ef0c1ba0af1bef90e",
+      "path": "src/extraction/liquid-extractor.ts"
+    },
+    {
+      "sha256": "2ba6537c26f05b02ef686db21f6630d74a3f2bf5f88e0cf9c77586f667b51270",
+      "path": "src/extraction/mybatis-extractor.ts"
+    },
+    {
+      "sha256": "9283bac7869e0287b1e1cc9d973e8c9549f85537a01921ec59bb1a94332cdfd0",
+      "path": "src/extraction/parse-budget.ts"
+    },
+    {
+      "sha256": "b211a78bc87ac70ea694e044b683b30bfaf5b6b5fa574678a0e67760855247cd",
+      "path": "src/extraction/parse-pool.ts"
+    },
+    {
+      "sha256": "4b4a833dfb90a359ce02b371b6f2cf2c4099e33e03a6d951b478d4698fde3c24",
+      "path": "src/extraction/parse-worker.ts"
+    },
+    {
+      "sha256": "55e128e9e040ec770a4e9aa7a0c7ab8c3bc56a4b90869261baf0da7309d73cb5",
+      "path": "src/extraction/razor-extractor.ts"
+    },
+    {
+      "sha256": "529c2290f42ee3f5f0f0cb1be00b7799f575133de8abc4b0072d990ed23fd5ad",
+      "path": "src/extraction/razor-script.ts"
+    },
+    {
+      "sha256": "d48b82be2c17998ef4b2b9ab0cadbbd5ae838ef6ff0eca37b9c12ab887988d78",
+      "path": "src/extraction/runtime/tree-sitter.wasm"
+    },
+    {
+      "sha256": "0246057517a7d3873e2fbb53b0f34a439696c6effd1d3e54e51816c65fe2791f",
+      "path": "src/extraction/sfc-script.ts"
+    },
+    {
+      "sha256": "ba372e279b90ae2220b435dc92afb052b30621a88adaeb1b92bb996e1f495342",
+      "path": "src/extraction/store-worker.ts"
+    },
+    {
+      "sha256": "388a202a2fadb0bc9a9873f9bbbeb386151b49dc8be7f83357fc06bf96ed60cb",
+      "path": "src/extraction/store-writer.ts"
+    },
+    {
+      "sha256": "f3de90b3639c5c86244e544fc459592a3bc28dc29b8c1b79aad222d2a7779f20",
+      "path": "src/extraction/svelte-extractor.ts"
+    },
+    {
+      "sha256": "cd25de294b911959e8e419758071f3fded843df6a86caa1e08a353f4e408ff3d",
+      "path": "src/extraction/syntax-tokens.ts"
+    },
+    {
+      "sha256": "a35d6a7c68c54eb7cb1ca8bbbe3988b34b02ac6f9abd1248980348a4d0d3214b",
+      "path": "src/extraction/tree-sitter-helpers.ts"
+    },
+    {
+      "sha256": "68c17e089f8e7f9bf4b38f5c16e645e49cf7dbaf46a784951942a29ea8aca871",
+      "path": "src/extraction/tree-sitter-types.ts"
+    },
+    {
+      "sha256": "da1cbace568e89a1f468114eb9320a96a49189e3575a86b6a102eb80972c7c27",
+      "path": "src/extraction/tree-sitter.ts"
+    },
+    {
+      "sha256": "cc5cddc937b25890f527bcd32ebf9845e280975436443f75bb82da1b812b4b19",
+      "path": "src/extraction/vue-extractor.ts"
+    },
+    {
+      "sha256": "5341961267be72640738669871ab8350f673d4684b213755f1d162bffd9a9076",
+      "path": "src/extraction/vue-options-api.ts"
+    },
+    {
+      "sha256": "c6f1f5e93352bc2a6041e9f661cc30a4e293afd6cc402ec52b3be28510dec34d",
+      "path": "src/extraction/vue-template-calls.ts"
+    },
+    {
+      "sha256": "9938e3d4528323b332bb0cd2f8a192cf989ef59b9abe40d09d642a305f4dc1a7",
+      "path": "src/extraction/wasm-runtime-flags.ts"
+    },
+    {
+      "sha256": "db0812971109457d22b3fe9dcdb1cd8e614fba2a338e220670bd254485753623",
+      "path": "src/extraction/wasm/tree-sitter-arkts.wasm"
+    },
+    {
+      "sha256": "a271e584616c7c3c0ac663f01cd05dd5f1a6c2ce6d4cd23096548985a95d0ccb",
+      "path": "src/extraction/wasm/tree-sitter-c.wasm"
+    },
+    {
+      "sha256": "6f69e1cae44e1c32c1eccc170dc5a9778fb94ff716f71113fe1f8c4299aa2f40",
+      "path": "src/extraction/wasm/tree-sitter-c_sharp.wasm"
+    },
+    {
+      "sha256": "17aeb294c58dd47045b470fc082ccceac3100c8e548b13764d4f3987a062322f",
+      "path": "src/extraction/wasm/tree-sitter-cfml.wasm"
+    },
+    {
+      "sha256": "9d4eaaec46eec7e6400d4b8d6c85fac7dfe33867ed5b4e5c218dfa7851c32558",
+      "path": "src/extraction/wasm/tree-sitter-cfquery.wasm"
+    },
+    {
+      "sha256": "e381db5d2b8a7744fc7d8e51b0a14ff03f86c8ff497cdfe32d1da467f19d4096",
+      "path": "src/extraction/wasm/tree-sitter-cfscript.wasm"
+    },
+    {
+      "sha256": "a72425462f3fffc827dee97498b613ddd2d3d56e20c1e3913a6538d7026d3155",
+      "path": "src/extraction/wasm/tree-sitter-cobol.wasm"
+    },
+    {
+      "sha256": "70f5e2b9976dad56bdcd1fafcb3af8c839c7a92e7beaa437162bcf45f390e83d",
+      "path": "src/extraction/wasm/tree-sitter-cpp.wasm"
+    },
+    {
+      "sha256": "7f5364e4256cf7e55efd01dd52421ef2663caa8061b82659b7e4bf61064545ec",
+      "path": "src/extraction/wasm/tree-sitter-dart.wasm"
+    },
+    {
+      "sha256": "dbab33f03e07b89f4385fcdd48d87d86ba35c82a0a426788d55b8c25410bc491",
+      "path": "src/extraction/wasm/tree-sitter-erlang.wasm"
+    },
+    {
+      "sha256": "4eda5d91c99ca981e88bc7d3d33f0db166b4bab0a84d0021a9abf39b364c78ef",
+      "path": "src/extraction/wasm/tree-sitter-go.wasm"
+    },
+    {
+      "sha256": "181a6fbc34d7864a551d91c13882fc33007e923b3c81a4bdbe7fa47492090077",
+      "path": "src/extraction/wasm/tree-sitter-java.wasm"
+    },
+    {
+      "sha256": "7978e62bcc851ab1d1f6dcd4678f9eda79df2b3b3490e75f81dd819d9bccccfa",
+      "path": "src/extraction/wasm/tree-sitter-javascript.wasm"
+    },
+    {
+      "sha256": "e2ef7c0c83e5fd4bece547d2acd41b9f89da2fed5644d74be139b9765d4c74af",
+      "path": "src/extraction/wasm/tree-sitter-kotlin.wasm"
+    },
+    {
+      "sha256": "6d95607fc7d78964cfdf065ccb1ba76be5ed217c5ec0d0a3cace13c59fa1ae43",
+      "path": "src/extraction/wasm/tree-sitter-lua.wasm"
+    },
+    {
+      "sha256": "f1647052518f2bdfae8e8c0b033ffdeca1193d69d11c78ba20f84c8374fd0fe3",
+      "path": "src/extraction/wasm/tree-sitter-luau.wasm"
+    },
+    {
+      "sha256": "4acffa1c013df751193a21ce429777ca214c7d3a7e3665085b6df00dad8869f0",
+      "path": "src/extraction/wasm/tree-sitter-nix.wasm"
+    },
+    {
+      "sha256": "be3634fca99c19f5e1035a1a9c7d93d6ee82b35e6d5024f02be4883b71329c3e",
+      "path": "src/extraction/wasm/tree-sitter-pascal.wasm"
+    },
+    {
+      "sha256": "6545a9a110bc878e26ed329950147e190c83da038bb17e999de646fe6c4d6c82",
+      "path": "src/extraction/wasm/tree-sitter-php.wasm"
+    },
+    {
+      "sha256": "a7fdc587e77bd729b9f5b783c659be23c896e305a2c374472bed7114d9e01fac",
+      "path": "src/extraction/wasm/tree-sitter-python.wasm"
+    },
+    {
+      "sha256": "2a8f5acd1c53d91e0ec5c01a6830d8ac7f5a7f96f0ac4b3768c016c8e9d07711",
+      "path": "src/extraction/wasm/tree-sitter-r.wasm"
+    },
+    {
+      "sha256": "4cb5a4b12870876ca864c1e92fe1f5cd47036b2adc083e9306488af88867dbb4",
+      "path": "src/extraction/wasm/tree-sitter-ruby.wasm"
+    },
+    {
+      "sha256": "206031e0f67fb41ecae505868ca3bb917df7375031aebafd2f97314a849713fe",
+      "path": "src/extraction/wasm/tree-sitter-rust.wasm"
+    },
+    {
+      "sha256": "37d7fe5a91ca98941dc05493b0c05a0df0f36df5035890fa00b02497c68aaac3",
+      "path": "src/extraction/wasm/tree-sitter-scala.wasm"
+    },
+    {
+      "sha256": "cc77a63b8487956270e2f385e29a03ba0773ba532a3c8a8844a26b4c98793843",
+      "path": "src/extraction/wasm/tree-sitter-swift.wasm"
+    },
+    {
+      "sha256": "0d9ef3ae926acc0411bfecba9b34df4ea659061917b96455570a45a70824e890",
+      "path": "src/extraction/wasm/tree-sitter-terraform.wasm"
+    },
+    {
+      "sha256": "a64f018a0a2843df0d46ece1fbf87d89a0d3e5001fd94c75f9fb2e4c0fea0a77",
+      "path": "src/extraction/wasm/tree-sitter-tsx.wasm"
+    },
+    {
+      "sha256": "abeb7a0a4eea3007ac0e83a383c0068e336b25880de9e374a57267c15ed5fe9d",
+      "path": "src/extraction/wasm/tree-sitter-typescript.wasm"
+    },
+    {
+      "sha256": "5a8aa2911e28e43e22b077ae56c8143ccfe52485bb6719152b60e2e66a1a9e53",
+      "path": "src/extraction/wasm/tree-sitter-vbnet.wasm"
+    },
+    {
+      "sha256": "9da6a87ea5dc2422a511a8f29a2249c057edde2df8755a3b992f18fa330e1150",
+      "path": "src/file-limits.ts"
+    },
+    {
+      "sha256": "606601656087d6cc5eb1ab9bfb48213666eace04f2c3655354a03e0f95c411f8",
+      "path": "src/graph/branch-guards.ts"
+    },
+    {
+      "sha256": "7eaaf11751afa5180bfa2134a57e5a0de1ea93a40ef04d1c6a8e502348d480ba",
+      "path": "src/graph/call-sites.ts"
+    },
+    {
+      "sha256": "02a9e3b93c3aeb60e6de5b4c28cdb6c89794fd90a78f73bfed361ea677407562",
+      "path": "src/graph/cobol-copybooks.ts"
+    },
+    {
+      "sha256": "042a10558a06348347c0f4085aab6b1fcf459435a5c737bc035ae3e4aefe6ac8",
+      "path": "src/graph/dead-code.ts"
+    },
+    {
+      "sha256": "0c984bc41c74c4546c605be18e6026a9512ac38cf52ef2076d6fe6be637e7839",
+      "path": "src/graph/dynamic-boundary-report.ts"
+    },
+    {
+      "sha256": "a8f2fd88aa1fca7f6b9fb008c10195f56fd43373decc6e2db98e1acc545c038a",
+      "path": "src/graph/file-cycles.ts"
+    },
+    {
+      "sha256": "cee8a48d6e40a7a958d8066611c49091c1c341dd3521052e0805e49fab4ec4ff",
+      "path": "src/graph/go-package.ts"
+    },
+    {
+      "sha256": "6c57dcb410913a112411dc717c74c56d6a54120a216ee68ada6a08a84ddd49b0",
+      "path": "src/graph/index.ts"
+    },
+    {
+      "sha256": "a098549736be7aead7a2ae5892170fa3437da455ced99b73bb917ee309264b25",
+      "path": "src/graph/named-symbol-flow.ts"
+    },
+    {
+      "sha256": "c4f0a81e9b7901ac032fccb7f29cb84c7b777b38d2086c4f45b6c1e1c9134858",
+      "path": "src/graph/owning-package.ts"
+    },
+    {
+      "sha256": "53524e6f1a1693b06dc6bd265f7a6b239266861ac2c52da5a91b7a23ae60a2de",
+      "path": "src/graph/queries.ts"
+    },
+    {
+      "sha256": "feeed7e3b4cacda5674b0507dad82c23bc3e66b103e7695e804cc6e9f52e178d",
+      "path": "src/graph/symbol-lookup.ts"
+    },
+    {
+      "sha256": "763f585ddc092950e50273f30fdaff578c37f2ebc947fb216f14a4709fd52d40",
+      "path": "src/graph/synthesized-hop.ts"
+    },
+    {
+      "sha256": "891bcecf94dd726b2db64a52ccd1680714c7d77a24590bf8bdb737bc506f4f62",
+      "path": "src/graph/test-code.ts"
+    },
+    {
+      "sha256": "ab5d6d2aa48d7ae686edb62aa287cb9dcf30707c525e5efd7b7cfc2040460411",
+      "path": "src/graph/traversal.ts"
+    },
+    {
+      "sha256": "c29cd993cb49e997c22a97e8dc780df6003956f9bc5a05dc5f52a8eb217df3c0",
+      "path": "src/graph/type-hierarchy.ts"
+    },
+    {
+      "sha256": "c37a323df3d68e44b76fe659d2590756661ebbfb6971ea78ec79787c2c45fce3",
+      "path": "src/index.ts"
+    },
+    {
+      "sha256": "811033ec3bac72c4c952ffba0bbf4040b458a10e832c50ebdb68d3cf726b8341",
+      "path": "src/installer/beta-signup.ts"
+    },
+    {
+      "sha256": "58b8e20c9be2cb9306f035f86215a795487ce5a28c46b8b83e7f40d8374e8d22",
+      "path": "src/installer/clack.d.ts"
+    },
+    {
+      "sha256": "b333da9d33f485e5ee2ae2bf9a33635b6012b46e9c4655f21fabb68273d2b818",
+      "path": "src/installer/config-writer.ts"
+    },
+    {
+      "sha256": "71e68a9c8ba931dd7130a6a50b38b49b97173909214ac83cd2871fc90ef3925e",
+      "path": "src/installer/index.ts"
+    },
+    {
+      "sha256": "2e3694400d77bb6b1d77ee8849b5ec79c7f85b18356242d3cc6af0e3dff84b8a",
+      "path": "src/installer/instructions-template.ts"
+    },
+    {
+      "sha256": "c51e3de50b0bdd44b41270288f348b5682fb3cc5f8e60c4706b3906a263464cc",
+      "path": "src/installer/targets/antigravity.ts"
+    },
+    {
+      "sha256": "b7a5bad71782b5c7707345dcd636fea7c16b99b20f8c7f5d155de4013baa00a2",
+      "path": "src/installer/targets/bob.ts"
+    },
+    {
+      "sha256": "21ee4904e675ac1bd1b431f052a6706f35bb782e3ec4fd07213c93fb5bdd63a4",
+      "path": "src/installer/targets/claude.ts"
+    },
+    {
+      "sha256": "fe471737cbe45cb5a4637a3400d0b872b57b4b2199f777ab2287630ca3363f97",
+      "path": "src/installer/targets/codex.ts"
+    },
+    {
+      "sha256": "3ade255285073183d6ff36b74a91929ff9e5fca06189bf76cc3564d1434b0dee",
+      "path": "src/installer/targets/copilot-cli.ts"
+    },
+    {
+      "sha256": "5b5cd37184f923b25a2e47caa9279e12fe94eef28ea49f88b6cd55d0311f3db4",
+      "path": "src/installer/targets/copilot-jetbrains.ts"
+    },
+    {
+      "sha256": "2fa59aaae9993c6465edb1485a2cfb94c3f892375ccd7b1469555597b1d6ee75",
+      "path": "src/installer/targets/copilot-vscode.ts"
+    },
+    {
+      "sha256": "83474b05eb0c34600884d359560d6904109b65cec97153fe8a1958a604770651",
+      "path": "src/installer/targets/cursor.ts"
+    },
+    {
+      "sha256": "2637753ec852f0da131f0ac49f1772abdb4cf2231ba9897f051d85d9d804d4aa",
+      "path": "src/installer/targets/droid.ts"
+    },
+    {
+      "sha256": "80c9fec3f8260606b354d0e5fd2ad2ec46787f960a4d3e5f4c7eb433b3ad4cc6",
+      "path": "src/installer/targets/dsh.ts"
+    },
+    {
+      "sha256": "132a4e80dd42ad663148fea2ba64a04fac9b69a953004343407491285037d4c5",
+      "path": "src/installer/targets/gemini.ts"
+    },
+    {
+      "sha256": "3f7e442573319f48211fd109d820783eb5f5bab0918b10de82fb63e49a48d4e5",
+      "path": "src/installer/targets/grok.ts"
+    },
+    {
+      "sha256": "8bf23a7d1776605395495403a576e034365eef52233e78b4c5f38c247be2c222",
+      "path": "src/installer/targets/hermes.ts"
+    },
+    {
+      "sha256": "de98b171e3ac80caca54ef13234b0478a7e079dae0071b39705a2e447aedaa8b",
+      "path": "src/installer/targets/json-config.ts"
+    },
+    {
+      "sha256": "905622bf3b255b4ff79fca4d15ca1e09895392f2746ee6513cac9db2b820b013",
+      "path": "src/installer/targets/kimi.ts"
+    },
+    {
+      "sha256": "99fe42c909a1a2464d71283fb706855e507ac1df8a80760c3cd03c2c7d479e7c",
+      "path": "src/installer/targets/kiro.ts"
+    },
+    {
+      "sha256": "5a1dc7f17b9cd8de8fbf19665e180f917ab8fcadef0143f09bc8c7f73fa9bed3",
+      "path": "src/installer/targets/opencode.ts"
+    },
+    {
+      "sha256": "3200a757f61c9b7e7abffdfc81b5483c4f899986c38a50045aecfd974cd4ca84",
+      "path": "src/installer/targets/pi.ts"
+    },
+    {
+      "sha256": "0cfc28e99f6658b16996df0b69e5da4cc19df35e5bc2b97e5d7ee25beb89426d",
+      "path": "src/installer/targets/qoder.ts"
+    },
+    {
+      "sha256": "0e17222fe3004ab9ac5fa745994c6ad270b08ec8899313582f91b3fb24368f55",
+      "path": "src/installer/targets/qwen.ts"
+    },
+    {
+      "sha256": "77c734de08dc4506f760fe245e37da5ca04b915e0cf6c18be42fef033e5f8e6b",
+      "path": "src/installer/targets/registry.ts"
+    },
+    {
+      "sha256": "612311287afb136e06e1eb95d9518cef7bb7d8030246389e837ca1db471a6991",
+      "path": "src/installer/targets/shared.ts"
+    },
+    {
+      "sha256": "0fd698e7ae3a67ce2c15917eb58a58fabe2589756c9ec86b5bf48d262901642e",
+      "path": "src/installer/targets/toml.ts"
+    },
+    {
+      "sha256": "8c6ab165c9b32798801312888ca14410352afb59ec165deeeb9856a909c9b36e",
+      "path": "src/installer/targets/types.ts"
+    },
+    {
+      "sha256": "ab8d211a342b4b0cd62379fef3a57378335947e7a4bf2b633ac7f6e3c6f322ce",
+      "path": "src/installer/targets/windsurf.ts"
+    },
+    {
+      "sha256": "63902d1547a56efe68c390ea059954cc16a82d2bbaea2f3b9f9a2978be2f2436",
+      "path": "src/lazy-engine.ts"
+    },
+    {
+      "sha256": "efdede20e6908cc7bc88f6ff26f0f15cdd543b6787cb78277111837b147a5ef0",
+      "path": "src/mcp/answer-freshness.ts"
+    },
+    {
+      "sha256": "0a1a88a1476df735c350d1493cf8722e11fff8ae193c660cad9f2fc5908ed940",
+      "path": "src/mcp/daemon-manager.ts"
+    },
+    {
+      "sha256": "3bacb7a73b26dd0ede0bdd917933ad867c40672dc807c499ed8cfe72db24f5e0",
+      "path": "src/mcp/daemon-paths.ts"
+    },
+    {
+      "sha256": "384bb223da6d3a10599f71d185bffcaebec2f3e9b54ae35de5ee9ba02e93b3e8",
+      "path": "src/mcp/daemon-registry.ts"
+    },
+    {
+      "sha256": "15ecd3ac7b09df446334556f3db641898a407032d0f5d032ed167783e492e268",
+      "path": "src/mcp/daemon.ts"
+    },
+    {
+      "sha256": "538a25bdf589d5b19db293449e5c2683183c42a4b8e68eb0fbb641811084bc6d",
+      "path": "src/mcp/dynamic-boundaries.ts"
+    },
+    {
+      "sha256": "147009f9329ea2c40f96a99ed7dfe646f2830f46e5e2481820d344a573efe42e",
+      "path": "src/mcp/early-ppid.ts"
+    },
+    {
+      "sha256": "3cd86fdc2290b4db2b4ff3862dcd63b11cb6d00f36216aa10ba0230cb88f6786",
+      "path": "src/mcp/engine.ts"
+    },
+    {
+      "sha256": "abaf30dc0dabd3ed1e8950dab35a9439c6004076be54d9fa8a821151e86615a9",
+      "path": "src/mcp/explore-dedup.ts"
+    },
+    {
+      "sha256": "82a6a79d2e5743442eaca8d2f17721230a26e1cbfc37d3a2fd89f9c58e11819b",
+      "path": "src/mcp/explore-diagnostics.ts"
+    },
+    {
+      "sha256": "84ce087255a854c99cf5426d0302f25cfdefb348f770b8d75ade396cb363ba24",
+      "path": "src/mcp/explore-session-state.ts"
+    },
+    {
+      "sha256": "af475a23616dc4e601c2020685d169e236e2613944588b7c78c5b53f5a4e9349",
+      "path": "src/mcp/index-freshness-worker.ts"
+    },
+    {
+      "sha256": "8e02070d4b67c13a70771b9aa9525f7f1f3ddd01a64485b0898f9b3d8b15f164",
+      "path": "src/mcp/index-freshness.ts"
+    },
+    {
+      "sha256": "84db1c1da886f674a34c1ddf7acc524f3b85094eebd645ac9d2253234336932b",
+      "path": "src/mcp/index-version-warning.ts"
+    },
+    {
+      "sha256": "b423934ce3bdb8c4af7cb7966c846d4ab4a4b446af2a016469ce6df9e1145716",
+      "path": "src/mcp/index.ts"
+    },
+    {
+      "sha256": "167f778c6a2461d4c6ab0380414d4e60f597c0027ce6e5b0365a001ac9b702cb",
+      "path": "src/mcp/liveness-watchdog.ts"
+    },
+    {
+      "sha256": "b30618c91ed3d5efbc9596d45f1bcc16e50569c87b8f5b324997913f9d651339",
+      "path": "src/mcp/ppid-watchdog.ts"
+    },
+    {
+      "sha256": "6072fcc5ea0cc904314d07d006de4b22065d3e01750dd776964d6349b8e5db68",
+      "path": "src/mcp/process-identity.ts"
+    },
+    {
+      "sha256": "54bad3ee9ed027b3d4a8d579c0400cdaa0db6229ae89f6309fc7d4dfa198bd47",
+      "path": "src/mcp/project-lifecycle.ts"
+    },
+    {
+      "sha256": "5d28033199a347b8d4605931c4ce97229114cb20f2b71cf54802532b5374feec",
+      "path": "src/mcp/proxy.ts"
+    },
+    {
+      "sha256": "b4a96769c59c2ed48e896e12d70d741bbf86e01cfd11499920341a0cf5c86b0e",
+      "path": "src/mcp/query-pool.ts"
+    },
+    {
+      "sha256": "90ca018bf608458f061f7e8508ae73b9d94ddb69c435b2b72fe5683e5a6dea87",
+      "path": "src/mcp/query-worker.ts"
+    },
+    {
+      "sha256": "88310566d5a15ca4bb601030d11af00f811821e77e728c0b1f993478205a7e76",
+      "path": "src/mcp/server-instructions.ts"
+    },
+    {
+      "sha256": "2dd7a62a9961dc50e9ce3350aa5126f0bffe45485760543d0a77ffb0ddd674f0",
+      "path": "src/mcp/session.ts"
+    },
+    {
+      "sha256": "710bb4f21ef8c4695f0835983abcf49a263deb727b6b3719d2dbc4fe68d0c178",
+      "path": "src/mcp/startup-handshake.ts"
+    },
+    {
+      "sha256": "fd0c100ebd7c203b345923ded4e41910e6dbafefd28f0f7ad4ab0e5483fdbaf4",
+      "path": "src/mcp/stdin-teardown.ts"
+    },
+    {
+      "sha256": "28c58828e9af248558bc9fc00789419755eb6dc6c7b3792ca04c53e9b7fc8da5",
+      "path": "src/mcp/stdout-teardown.ts"
+    },
+    {
+      "sha256": "20990286262b552c3de04fb00488f879633f03fae10acf9ed7d799b9ade3367f",
+      "path": "src/mcp/tools.ts"
+    },
+    {
+      "sha256": "067ea1d14ba90793dd5dfa9379a3c35b82d73c45e2fa113481e25f098c7f8fa4",
+      "path": "src/mcp/transport.ts"
+    },
+    {
+      "sha256": "4a19646535fedbce920af3d1de32ca8589ae7a597acb2232b159b0cee5a54a55",
+      "path": "src/mcp/version.ts"
+    },
+    {
+      "sha256": "384d3ad9fa503b872342a3e222b97504c2f8e93a4b79901512346d04997c9700",
+      "path": "src/mcp/writer-lock.ts"
+    },
+    {
+      "sha256": "2257fdcd55e2971b9b7e6dc1931d94d581d0faf99f20d0f750ed91a00c88715a",
+      "path": "src/project-config.ts"
+    },
+    {
+      "sha256": "a858f336db25fa7431a4488317ac770c2601a96b46a81dad76d8ddb03a486407",
+      "path": "src/resolution/alias-binding.ts"
+    },
+    {
+      "sha256": "00f6d2a82d8bea3dcbd4ccc26eb1c15b9cfa2f8548fa17052ea577f7050c5730",
+      "path": "src/resolution/ambient-modules.ts"
+    },
+    {
+      "sha256": "b6600d39b86b557999f8c372eb6ea281b207b61aff49c9ccdceb0ffbdc53dc97",
+      "path": "src/resolution/angular-template-synthesizer.ts"
+    },
+    {
+      "sha256": "82128f5b45f98913c9a7fbf6c3ea7291eadc449d579c17977a8a90b8292d7766",
+      "path": "src/resolution/c-feature-variants.ts"
+    },
+    {
+      "sha256": "312c3f460a013a60466925bdd5a18c10a06dbba61048d4888e8da1db3b6ae915",
+      "path": "src/resolution/c-fnptr-synthesizer.ts"
+    },
+    {
+      "sha256": "e0c5a8b7d4f2ef006cd080e6ac814625ab3fd58a9d49f03bf818e1456a548fb0",
+      "path": "src/resolution/c-macro-renames.ts"
+    },
+    {
+      "sha256": "76d2735e16c0a7a2f0124e89974049a031778296bb71b4cc9472f6135391ead8",
+      "path": "src/resolution/callback-synthesizer.ts"
+    },
+    {
+      "sha256": "680c876d9ae5b6126f37aa1ccc44c865cf29acb2d0ebc907cc66d2d25f1aec86",
+      "path": "src/resolution/commonjs-export-evidence.ts"
+    },
+    {
+      "sha256": "15ab8a9dd27053d16e6592821a2e35e867a88dcd5dce44a393f1be13aae48b5d",
+      "path": "src/resolution/commonjs-export-members.ts"
+    },
+    {
+      "sha256": "6dff32adaab254f720b669449b934bc3d97203ee862edc58027364e8a9ddf5cc",
+      "path": "src/resolution/commonjs-value-graph.ts"
+    },
+    {
+      "sha256": "9e7b6ff1557d019ae0ee53c4d53d3a4ca444c111c53c50ba365f311c1bcbd8a0",
+      "path": "src/resolution/const-alias-synthesizer.ts"
+    },
+    {
+      "sha256": "ecc7873e9a9d58cff0e100d4b6eade6072c25dfa35b5e910febd1e663cb80c06",
+      "path": "src/resolution/cooperative-yield.ts"
+    },
+    {
+      "sha256": "4c3bc26644448a9c921b5193ace778011d42cd243237026e1cda5621781f1bb6",
+      "path": "src/resolution/cpp-constructor.ts"
+    },
+    {
+      "sha256": "658220d76d2847c9874cfa38833995baf80564fcc274daa3000365ce05742eea",
+      "path": "src/resolution/cpp-includers.ts"
+    },
+    {
+      "sha256": "60e41ca182016c780e55cd6168866795b9d9634f5e5161361bac23728f255eba",
+      "path": "src/resolution/cpp-macro-visibility.ts"
+    },
+    {
+      "sha256": "92b7c932b53ad77e9c2636dd409456e61c01790c9d15d48737eb23687e950658",
+      "path": "src/resolution/cpp-namespaces.ts"
+    },
+    {
+      "sha256": "776beefff56575b464e8ddbef104502ddecebafc5c358008aec3c9eb55af7aaa",
+      "path": "src/resolution/cpp-raw-strings.ts"
+    },
+    {
+      "sha256": "7639bb5535e7a2ec43f54688a69e2c7dfb296ded16be6abf968c7e8acf8ec350",
+      "path": "src/resolution/cpp-supertypes.ts"
+    },
+    {
+      "sha256": "9a41fbc13ca02ece3b78ac1b3b11c59f7f1a370aa50f22b3593407f97278f1da",
+      "path": "src/resolution/cpp-type-aliases.ts"
+    },
+    {
+      "sha256": "8d4f678ea007e9209268d84cdbe2c9af045c96dcfe27a123666ac6bca969d241",
+      "path": "src/resolution/dart-libraries.ts"
+    },
+    {
+      "sha256": "3fb950bf503c1379ae931beb1b95ef88a2a1ac6991dba6737149366deae44e23",
+      "path": "src/resolution/dart-local-scope.ts"
+    },
+    {
+      "sha256": "1fe6cfb90aab69ac4630e917be7a4e3d0b4c0284bfb338668b45cde6595ff762",
+      "path": "src/resolution/expo-router-synthesizer.ts"
+    },
+    {
+      "sha256": "97cda0e594cdb74b243aa552556ecb6bb07bed45f929cc4787066bd92eee9a61",
+      "path": "src/resolution/frameworks/angular-router.ts"
+    },
+    {
+      "sha256": "5731617bb961e7da121f04eb58b3b06881674adebedee44d5cc9d919cb0a8b68",
+      "path": "src/resolution/frameworks/astro.ts"
+    },
+    {
+      "sha256": "063469e7d4b4c984bb8e260ad898fbb8dbb6adf9d04fc8f94194d07b0f64d676",
+      "path": "src/resolution/frameworks/cargo-workspace.ts"
+    },
+    {
+      "sha256": "0147bd63b1e7f8dcac87b1e6b447b21b88ffb12842f87e2b2e7b45e81ed5a9a3",
+      "path": "src/resolution/frameworks/cics.ts"
+    },
+    {
+      "sha256": "703e83099ed7751fe4f64bf802f2fb5251ff2852c2f53b35bb92f7702b3f5731",
+      "path": "src/resolution/frameworks/codeigniter.ts"
+    },
+    {
+      "sha256": "31a163fdaaea41324a96d96f90be8b721dc868547e8fd768e92174dc406f6792",
+      "path": "src/resolution/frameworks/component-folder.ts"
+    },
+    {
+      "sha256": "45a94998e3de27a159dcf50c6b76ecdd058fb16230b4361b6ef99b2072d0d7ce",
+      "path": "src/resolution/frameworks/csharp.ts"
+    },
+    {
+      "sha256": "b9da7bb708409b46646031b7db89e779dc504df1fc62816012ae05480187275a",
+      "path": "src/resolution/frameworks/drupal.ts"
+    },
+    {
+      "sha256": "2be2b8c2eae0b59ebf841f3e9a54cdb1db785b6576808bdb3e485c3786866153",
+      "path": "src/resolution/frameworks/expo-modules.ts"
+    },
+    {
+      "sha256": "665fe2c89a2aee597a1f605dc51b5615778ee33347039dc5262a9f84caf85342",
+      "path": "src/resolution/frameworks/expo-router.ts"
+    },
+    {
+      "sha256": "824e6752c2b286384ee719b8349d475ad07049f5710df308e099fb1fcc4d670a",
+      "path": "src/resolution/frameworks/express.ts"
+    },
+    {
+      "sha256": "ac63287561b6070a071143ec0417d148c20810798751d7ecba37bae43d0d4a8d",
+      "path": "src/resolution/frameworks/fabric.ts"
+    },
+    {
+      "sha256": "a46731aea156e270ec49fd59321a21c89ce6d60acaffda5261f03d1ec014a26e",
+      "path": "src/resolution/frameworks/go.ts"
+    },
+    {
+      "sha256": "cae5049735a984e5414d03798f4979b3392bd745971cc1e7c27172561c4e1814",
+      "path": "src/resolution/frameworks/goframe.ts"
+    },
+    {
+      "sha256": "460f1e989587fecc8d7a4ce75556fdf81aef539a9eed27ecb69a111259844623",
+      "path": "src/resolution/frameworks/index.ts"
+    },
+    {
+      "sha256": "28c6df0a4ab3bd300be01fcbd6ff9f336c10e0625956aefa15d7cb6c7ae9cf59",
+      "path": "src/resolution/frameworks/java.ts"
+    },
+    {
+      "sha256": "1fe7e5950bc1c7ef1a2dbc171bc0e3022bb1191eb39d7c7201f7cbc96a9c0761",
+      "path": "src/resolution/frameworks/laravel.ts"
+    },
+    {
+      "sha256": "042c3748e61d96af57810505370c104f86403af2aa6078c8122c1a422613132b",
+      "path": "src/resolution/frameworks/name-heuristic.ts"
+    },
+    {
+      "sha256": "294f9d33d4dc5f7bf9cbceceba5cbc427dd7da3339238e33ccd310954d51fb6a",
+      "path": "src/resolution/frameworks/nestjs.ts"
+    },
+    {
+      "sha256": "272aa628dfca72c1f5811370a22069b74a5dfbc3ce28d33923e0c69f44cfe123",
+      "path": "src/resolution/frameworks/next-proxy.ts"
+    },
+    {
+      "sha256": "97134cff2aa73c7cf98b112218ab2664e32cccf758fc0a11317ba80b9cb81898",
+      "path": "src/resolution/frameworks/nextjs.ts"
+    },
+    {
+      "sha256": "9d74053662d0f9c6b555f0aca457eca17a8017a308feb28e3b48e94adefa6eb8",
+      "path": "src/resolution/frameworks/object-literal.ts"
+    },
+    {
+      "sha256": "e6d155dd94ea5390a81ae34f130d35bd2bff57c70cb26be9696c23385c8d59fe",
+      "path": "src/resolution/frameworks/package-deps.ts"
+    },
+    {
+      "sha256": "25c8d69597a7fb092d9d8685423d115a128eccbd1a1f12c167ce41b7e8a70216",
+      "path": "src/resolution/frameworks/page-component.ts"
+    },
+    {
+      "sha256": "9f3dc5f07ecca8567364069afa0ef07796078e89e269a77b0edcb38fdbf69023",
+      "path": "src/resolution/frameworks/play.ts"
+    },
+    {
+      "sha256": "8c87371862582308812ff11ed10aed28537368db8ac0be5a6a5077ddc1e12c34",
+      "path": "src/resolution/frameworks/python.ts"
+    },
+    {
+      "sha256": "145fd18eadbc285bc1d3af5c7ff6ab53660370e809bae3eeeb44c2350a42d34c",
+      "path": "src/resolution/frameworks/react-native.ts"
+    },
+    {
+      "sha256": "eb780a0373971a3cf43c5db39e5b7cc2cb53f31cd89be8d13ebf87a55f315ce4",
+      "path": "src/resolution/frameworks/react-router.ts"
+    },
+    {
+      "sha256": "5930afd13c8e6c36ee70a3f4e244acbae9ed21abbbcf5f986e3ae1dec86cee5b",
+      "path": "src/resolution/frameworks/react.ts"
+    },
+    {
+      "sha256": "7a4e8e53ba17ea005547f372eb141db3406a36785408535d7a53f3bb4f969882",
+      "path": "src/resolution/frameworks/ruby.ts"
+    },
+    {
+      "sha256": "cee78b4b4b56a407308ee8e40e9bbf68373b8c24206d1c7b7de5be1d3074a07d",
+      "path": "src/resolution/frameworks/rust.ts"
+    },
+    {
+      "sha256": "9280bbbc377c2d85544c55563729e92e9a36d81670357fb81eb96ca5d93ae20c",
+      "path": "src/resolution/frameworks/svelte.ts"
+    },
+    {
+      "sha256": "4b1cca2e10d07415b6bdfd1c9537a76f9acd467da06d66914af94fa6b38965da",
+      "path": "src/resolution/frameworks/sveltekit-router.ts"
+    },
+    {
+      "sha256": "667233fee237033871fd9b45890f28f0e90334289eea238086f9fc8b2b1ec8bb",
+      "path": "src/resolution/frameworks/swift-objc.ts"
+    },
+    {
+      "sha256": "6f6609090f81387d745c1afef7e1fcb09763b805d416045e8dfdf9e0294e4a3d",
+      "path": "src/resolution/frameworks/swift.ts"
+    },
+    {
+      "sha256": "34d9e8aa99f2d27c1860c405abe3da29a913d7726b954010dd719603a4b1aa1c",
+      "path": "src/resolution/frameworks/tanstack-router.ts"
+    },
+    {
+      "sha256": "3d34bb64e5ded90fd0378e00a24e84cebfd22024ca36402fa8f39d7859ac7ec4",
+      "path": "src/resolution/frameworks/terraform.ts"
+    },
+    {
+      "sha256": "cc2176bb34f06b0b0e27f2729f0233f1079edf40c93d9db3106d9a7ccc9b4b64",
+      "path": "src/resolution/frameworks/vue-router.ts"
+    },
+    {
+      "sha256": "9ee9ca54aec5ba9bd6d5049d66ceba7dc2dbfe29065728b7d077ec1b06351b22",
+      "path": "src/resolution/frameworks/vue.ts"
+    },
+    {
+      "sha256": "6434fae9b7645375d8175a38a109c1bbb3da8d9f995605384e81785ffdd88c55",
+      "path": "src/resolution/go-func-field-synthesizer.ts"
+    },
+    {
+      "sha256": "c46c1e26fe0a1b18c0e61b298f65e4a634d87021eac641ef4805d90a061b7a45",
+      "path": "src/resolution/go-module.ts"
+    },
+    {
+      "sha256": "3e23482680b659228eb9a7814b08a90477e1febd0f5f9e0c69464ddd3fb92894",
+      "path": "src/resolution/go-stdlib-methods.ts"
+    },
+    {
+      "sha256": "30239ea5915a02061988c7b4f909ca573903820d2d19f1b223b5b1bda8d709fc",
+      "path": "src/resolution/goframe-synthesizer.ts"
+    },
+    {
+      "sha256": "1bb89401511ff3603b1ecd3800595688236e0ac75df18ef962e138ca30aad6d4",
+      "path": "src/resolution/import-resolver.ts"
+    },
+    {
+      "sha256": "0af20fe98cde962ee13d5381574224bf17b6a753ced449e275639ac53955fa4b",
+      "path": "src/resolution/index.ts"
+    },
+    {
+      "sha256": "d2fabba053b18ea5c27444b432dada4b6b1966a2c6d69bcf46f560bc8e43b9e9",
+      "path": "src/resolution/js-builtins.ts"
+    },
+    {
+      "sha256": "a12a55287a3daad19d2a103755e8f43384093ed9039ea8b2974e326e3361dc4c",
+      "path": "src/resolution/js-class-expressions.ts"
+    },
+    {
+      "sha256": "4832c0833b58994e14b52b69fca8607de378e16140a0b7a91bb977563259daa3",
+      "path": "src/resolution/js-super-calls.ts"
+    },
+    {
+      "sha256": "50aa00e081fd43fa4be3ec307a3adbe082bfdee5657d62b52e71cb5984c29dff",
+      "path": "src/resolution/jsx-code.ts"
+    },
+    {
+      "sha256": "38bae51129bdb52cc562726ddf4a8a8b1c35981840eb63b911fccd8b3ad15d86",
+      "path": "src/resolution/lru-cache.ts"
+    },
+    {
+      "sha256": "f91eb1dd90820a9b4ea784ade39d3c4e413683c12fd573c94d701034469ee6e0",
+      "path": "src/resolution/memory-budget.ts"
+    },
+    {
+      "sha256": "e4deb458c8eb2c6599eacc46a441e7f8a41df00556a6297d711267ebdb5dd053",
+      "path": "src/resolution/module-importers.ts"
+    },
+    {
+      "sha256": "5c86a224368d28486ec31e2ddd2072f17b9db2b716da0dbd931f452284fd4ae5",
+      "path": "src/resolution/name-matcher.ts"
+    },
+    {
+      "sha256": "5049732ad18e6ed7d78db5beb55ef4b8b25ef5c1fb48f250f9cda7d24c9264b9",
+      "path": "src/resolution/next-router-synthesizer.ts"
+    },
+    {
+      "sha256": "b2e6f297ebba980d8b352e83807b9fbf2f501db690c5ffb8fb0d90f6e9feb982",
+      "path": "src/resolution/override-parameters.ts"
+    },
+    {
+      "sha256": "04be7611d98c3764e83408fbb9f01ef7c88d4fd8f786687cca703e8e8cf88b8a",
+      "path": "src/resolution/parameter-flow.ts"
+    },
+    {
+      "sha256": "a5e50222732471145d21b27fde8547dd1cd34292e2035c42770eb6028c891669",
+      "path": "src/resolution/pascal-scope.ts"
+    },
+    {
+      "sha256": "27452b4be6fd24701950b0e652f7b802eb92f04df503d684e0f865200c2126b9",
+      "path": "src/resolution/path-aliases.ts"
+    },
+    {
+      "sha256": "6ab0d6ed62769b54fe72e386b09ec77ac64e7ab4cbf8f661fbfd084574882a2f",
+      "path": "src/resolution/project-scans.ts"
+    },
+    {
+      "sha256": "5b00d5a88c132f537dba977b06b86e9b46aa8bd13ff0ee36210fbc109231f09c",
+      "path": "src/resolution/react-router-synthesizer.ts"
+    },
+    {
+      "sha256": "832920017cc05967ad218d3f1548589e64a3691bba82f4f08928766dd11094bf",
+      "path": "src/resolution/resolver-pool.ts"
+    },
+    {
+      "sha256": "dedfbafc1b1a4b7df3816214f550a9da7591b85d489b7272d028877db2772c17",
+      "path": "src/resolution/resolver-worker.ts"
+    },
+    {
+      "sha256": "f0a272ecc5503ead8a442940dbf70551a4b7802fd3c4aa3ed4c7d54ef4550c11",
+      "path": "src/resolution/resurrect-ref.ts"
+    },
+    {
+      "sha256": "d41e20cf543fc8a439fb674370d09feba1335b3983a079fc8aea4260280e5c8c",
+      "path": "src/resolution/ruby-constant-paths.ts"
+    },
+    {
+      "sha256": "c0a4ec73ffbfa9ae6c717ec719d3b2e208c904f44646bc10827db42d66521f8f",
+      "path": "src/resolution/ruby-parameter-flow.ts"
+    },
+    {
+      "sha256": "d1505ce0476cbaa0060dabb6a9ab5628ca00eea24f3981f9c9e5d3172d09b753",
+      "path": "src/resolution/rust-scopes.ts"
+    },
+    {
+      "sha256": "ec35302a6fc7d4aae01f7584f0b0588e5076ac486986d246398b4b3c7d59ba6f",
+      "path": "src/resolution/shopify-themes.ts"
+    },
+    {
+      "sha256": "b32a0711ca98d014358dd6287d084b472be5960f30b99ac85035a82db0d18d18",
+      "path": "src/resolution/strip-comments.ts"
+    },
+    {
+      "sha256": "7be6e2cec6957a41dc1ba26e08c6701395f8b1ce995e117452ffd9c1f2879d01",
+      "path": "src/resolution/sveltekit-synthesizer.ts"
+    },
+    {
+      "sha256": "3e322f343ab6ef5ccaf8957f184e3e2658b7d3e0f6959db793bd3507c098b7f8",
+      "path": "src/resolution/swift-objc-bridge.ts"
+    },
+    {
+      "sha256": "82163d03b8c87331fef8343012aa82bb5c016286dd04f2fbfcdbd34a5e68ce3f",
+      "path": "src/resolution/swift-type-visibility.ts"
+    },
+    {
+      "sha256": "1c89a872a6a31cb9291e461f4306eb108063d749a07cd479d0de9859133681b8",
+      "path": "src/resolution/synth-utils.ts"
+    },
+    {
+      "sha256": "ab45c72ad58d43b8f59587cb584bf07f18f7335ae50468df475c90635bed60df",
+      "path": "src/resolution/tanstack-router-synthesizer.ts"
+    },
+    {
+      "sha256": "03f2a799ecfcbce1c2dd3645c76627bea12bf84476bfe16b768d535e7cd103d2",
+      "path": "src/resolution/tauri-synthesizer.ts"
+    },
+    {
+      "sha256": "5dded38f7b9e53a58488e95fb514a9ced764a99651f7c26689c72ef96a3ac00a",
+      "path": "src/resolution/tier-synthesizer.ts"
+    },
+    {
+      "sha256": "90fa946c7840b0201968fac6d196317dee2727ae7b2c7b741c6429a879612d2f",
+      "path": "src/resolution/type-parameters.ts"
+    },
+    {
+      "sha256": "47fddba8a07fc4e2b58052b75e3e31c5c386ae267a87a66cf5bad073ef3c0f99",
+      "path": "src/resolution/types.ts"
+    },
+    {
+      "sha256": "c766020a05117e4d220959dcfecb9216cd13a6b4bd486ad2974f60052ab913db",
+      "path": "src/resolution/vbnet-receivers.ts"
+    },
+    {
+      "sha256": "00cbe42135044a85f22e24bdbbcd488ff637eea046acb5d421216ba148bb433a",
+      "path": "src/resolution/vue-router-synthesizer.ts"
+    },
+    {
+      "sha256": "8eba2085a281d05036ea3dee5456992dc5e0f7153d27d39df1af54ca92ce491d",
+      "path": "src/resolution/workspace-packages.ts"
+    },
+    {
+      "sha256": "0ed5d2e0054836884e1a805aff0f83459a3c902bc25b9a7c29b4bac6f2285557",
+      "path": "src/search/identifier-segments.ts"
+    },
+    {
+      "sha256": "77fc631789116d37f0b64ccac63083d467fe10a232c702d08bcf12b147dd568e",
+      "path": "src/search/query-parser.ts"
+    },
+    {
+      "sha256": "ac4a5c74b9a1e828a309017e3999e13176e5f64615a5db4b06bd9a6829897b5f",
+      "path": "src/search/query-paths.ts"
+    },
+    {
+      "sha256": "f60dc82ed3e34e2008de9fb31f2123da2195d63643ba4b7dc5b4a28189350256",
+      "path": "src/search/query-utils.ts"
+    },
+    {
+      "sha256": "6005ea9bddd46e6fb29bdd7c2c983d955af1ccb0ec28d8b391045fc91bf9efbf",
+      "path": "src/sync/git-hooks.ts"
+    },
+    {
+      "sha256": "afeb472b1b20e1ec78fce425440b23b71b00e27e6b56d9f95667045e86c6f506",
+      "path": "src/sync/index.ts"
+    },
+    {
+      "sha256": "e95f39b2dc8f873e7ccb03b4e9298596dd5cf421062e322b3023a0225aa9421b",
+      "path": "src/sync/watch-policy.ts"
+    },
+    {
+      "sha256": "f15d76166f2b0c339c2adaf8b8a074740ba810007700bd2441d784328e721a58",
+      "path": "src/sync/watcher.ts"
+    },
+    {
+      "sha256": "a4a93fe5846bfc1d30d9ae714227ee6adff8a02202a0d3cfd29842e7229835f5",
+      "path": "src/sync/worktree.ts"
+    },
+    {
+      "sha256": "e462bfede8f24c4a038ade4774892d34aeb1c5689d15dfab6af5f3c48673103e",
+      "path": "src/telemetry/index.ts"
+    },
+    {
+      "sha256": "f976a65f75555979f4ad73058f3ba6765c3fb515bd401b05b4ceb7e1847db949",
+      "path": "src/types.ts"
+    },
+    {
+      "sha256": "eb2dcf653c7420af09ac358da14936424227dd91c39b3bc52ae0b36501cc243b",
+      "path": "src/ui-server/api/deadcode.ts"
+    },
+    {
+      "sha256": "2408dadc760b11b2e0d2a14e388b3bdda7175f97deb1d5e0596035231405ed34",
+      "path": "src/ui-server/api/effects.ts"
+    },
+    {
+      "sha256": "071c8634d06d6e3b60affae37620bb217effff81d9a34bf617db806861e4447a",
+      "path": "src/ui-server/api/entrypoints.ts"
+    },
+    {
+      "sha256": "93ee96a584f084e85e4e41ce81e0d973c02daa9f8083e86f0f05be4d4a9d72dd",
+      "path": "src/ui-server/api/events.ts"
+    },
+    {
+      "sha256": "dfe484cf151eaf8b1b89ec762afcabe7c97a1c45c0236599f5ef40c528028125",
+      "path": "src/ui-server/api/file.ts"
+    },
+    {
+      "sha256": "d57834b2ce7d18150c7c9843057dd4f2830bf098232808dabdcd50227719a58d",
+      "path": "src/ui-server/api/filecode.ts"
+    },
+    {
+      "sha256": "9a90155bc0225f269c30dfb508a876ab70f335b11b8712435fb8f95e19c92994",
+      "path": "src/ui-server/api/flow.ts"
+    },
+    {
+      "sha256": "7ed76733277fd2561df8fa07d18b19be8960e6956c7f8d69eda3f33b613b26b9",
+      "path": "src/ui-server/api/hierarchy.ts"
+    },
+    {
+      "sha256": "f6a7303e89e3e9dca16fc5ba05d13f5598c954dcb49c22d4e8dc39914ad2e572",
+      "path": "src/ui-server/api/index.ts"
+    },
+    {
+      "sha256": "d83b6b4e1efa28976936d8bfdae71b41daae3f5f248c12beee9716fbc3cde2a4",
+      "path": "src/ui-server/api/map.ts"
+    },
+    {
+      "sha256": "9bfe625bdd86a508d673a21dd5f0b35535edd0aebc313a150f3c2e904bb49117",
+      "path": "src/ui-server/api/node.ts"
+    },
+    {
+      "sha256": "1b466fb23c3eec235ec4cba500a3c5fbac6e1e6352188c573f0b56ac6e493db8",
+      "path": "src/ui-server/api/nodes.ts"
+    },
+    {
+      "sha256": "670f683b55a28b5c62d6e7622073ebd729a2f2893e9f2536b2a158563651a105",
+      "path": "src/ui-server/api/program.ts"
+    },
+    {
+      "sha256": "9ead1ebf9b7ff881e7a140cdfdf19d5d7cb0c8b16ae9694213c847f12b47a108",
+      "path": "src/ui-server/api/respond.ts"
+    },
+    {
+      "sha256": "09f6fdfb370f6f07c2f76a196f016e3f4d99b025d2944994ac3a59e068085c37",
+      "path": "src/ui-server/api/route-roots.ts"
+    },
+    {
+      "sha256": "a2a111fd4fddae36451b9b6c07779c69ac56d2c680fc439d09b0f4d652cfe897",
+      "path": "src/ui-server/api/routes.ts"
+    },
+    {
+      "sha256": "878de095b6d2e502bc741756b986d584fa3077a404bd7df04c4c4d9170a32c83",
+      "path": "src/ui-server/api/screens.ts"
+    },
+    {
+      "sha256": "db1c8d972aa7772f419fe53e3ed7a451178d98822f16d57843fc2b8eef13ed02",
+      "path": "src/ui-server/api/search.ts"
+    },
+    {
+      "sha256": "d62012b9d9b31ac8da2f84fe3e5b7f0ec795f7728898138811bdefdfba9ba3d2",
+      "path": "src/ui-server/api/session.ts"
+    },
+    {
+      "sha256": "4faef663d77be011dea1acb6c663b9ac56d877e4bcb2a5238a86ab42cd2b01de",
+      "path": "src/ui-server/api/source.ts"
+    },
+    {
+      "sha256": "e78e90daec6376051d97e2d974b03fb06a90cf95e6eaf567cb9b78e57e712bf2",
+      "path": "src/ui-server/api/stats.ts"
+    },
+    {
+      "sha256": "a8980ff20a396457d7347b4e913f5a187f4ff3714e2eb84d550399e131c781f0",
+      "path": "src/ui-server/api/steps.ts"
+    },
+    {
+      "sha256": "1d2a9997d02a8cb5b4b2301cc8f6a450d8b7d454f858fb6d732cb9adc510ebc7",
+      "path": "src/ui-server/api/trail-store.ts"
+    },
+    {
+      "sha256": "110a076f8bd652ab53c5aa71dfa6c64812253fc8e06f0a10a38b7a19849eb83c",
+      "path": "src/ui-server/api/trails.ts"
+    },
+    {
+      "sha256": "51597600586babfb47d3eb3bdf8313418386cff05c0e9238a5f502f903ad648a",
+      "path": "src/ui-server/api/when.ts"
+    },
+    {
+      "sha256": "39b2e62c53376bb9f61ee162fdc22a72e7186caa8b48a18a9f5f1d0914397ed5",
+      "path": "src/ui-server/api/wire.ts"
+    },
+    {
+      "sha256": "30e3712347e9a6c1f60cd52dba7cca98282b439678088c2fead80be2f8551f27",
+      "path": "src/ui-server/assets.ts"
+    },
+    {
+      "sha256": "55a4f8a787f593891482b1910fd46dab14226926c2be2390b42f2389c4c8b5d9",
+      "path": "src/ui-server/constants.ts"
+    },
+    {
+      "sha256": "be11123833540dcfe3e6512594b83e4c793b4877c92bf70c820bf4354c6cf55a",
+      "path": "src/ui-server/highlight/bounded-tokenize.ts"
+    },
+    {
+      "sha256": "4c45b97f8eb7d16cbe1619d3e719601ee61d685186ebfe1d9bc75dfa2ce18c5c",
+      "path": "src/ui-server/highlight/index.ts"
+    },
+    {
+      "sha256": "7c5c9e6d9bea56cbe603807fc3fa25853126ffc1033c3d245e6bdc197e961736",
+      "path": "src/ui-server/highlight/languages.ts"
+    },
+    {
+      "sha256": "248402dba55575fe7126391664b77b988bc8f61ddc0af9eabfc356d5c9ff0950",
+      "path": "src/ui-server/highlight/tokenize-worker.ts"
+    },
+    {
+      "sha256": "a04efea281ce3cc884fad5ba97f7e60b6b3811f94c4f608f05c7010e8ea2361c",
+      "path": "src/ui-server/index.ts"
+    },
+    {
+      "sha256": "6aae1992a8c6fb2ca9f1566f79833d08a1457acf121a2d5e1529df61b1b59d32",
+      "path": "src/ui-server/open-browser.ts"
+    },
+    {
+      "sha256": "0faf20a1e1b0d4ef494cc618c30d319aaf68b60bd6128f518af9b2c5546aadc1",
+      "path": "src/ui-server/security.ts"
+    },
+    {
+      "sha256": "e660ad85bf930f144837092e474df65b7c3aff2f6287a789df1187524d615bc9",
+      "path": "src/ui-server/static.ts"
+    },
+    {
+      "sha256": "79422c54c3fd73c476b35cc2de24bc9ff0cb2dd91e79783a1262a7499b84793e",
+      "path": "src/ui/color.ts"
+    },
+    {
+      "sha256": "5174ed59dfe9e54768a8c8841dd932ee3fd5c18903172433b869eece592c6ba5",
+      "path": "src/ui/glyphs.ts"
+    },
+    {
+      "sha256": "3a94ca9a3b10c27458c4713d608a37675d2f80b9c4d27d8a40f90d01eb367212",
+      "path": "src/ui/shimmer-progress.ts"
+    },
+    {
+      "sha256": "adc18c4d9c40bc675dc01367d99b1fc41b7aa3174b5c29c7c2deb5487b6e5570",
+      "path": "src/ui/shimmer-worker.ts"
+    },
+    {
+      "sha256": "a950c69a6b5ca50ce886898d6ca04e0027bc686b8f73e5bc043be6c10f71f5ee",
+      "path": "src/ui/types.ts"
+    },
+    {
+      "sha256": "a41d16023ee120e1d50887fdd5698a244be87e664ad09e0b04473ac418b354ed",
+      "path": "src/upgrade/index.ts"
+    },
+    {
+      "sha256": "5b327a465d80bf6783f3c320958ace05a4d4869d2bd2ae5382785d0a835a3877",
+      "path": "src/upgrade/remove-binary.ts"
+    },
+    {
+      "sha256": "0e5af58e2139a122e978d624985854260d57d59dc54cf4e9fb0319ddfe7b5ce5",
+      "path": "src/upgrade/update-check.ts"
+    },
+    {
+      "sha256": "175d949c3be041d2fac188fcced9e4b06cb249924973337b1b2ee1a709736c32",
+      "path": "src/utils.ts"
+    },
+    {
+      "sha256": "1398c892be314efd7a5b432c8cda0ef997bd499f70679c0f078f82be70a7394e",
+      "path": "src/web-tree-sitter.d.ts"
+    },
+    {
+      "sha256": "ad183627572817df6d1d8874a39ad3a7cccd5dc7e029a26fe1f87491f68ff280",
+      "path": "src/worker-teardown.ts"
+    },
+    {
+      "sha256": "2928eef8f996538d49d49bc92f64d10563b0ec05b16e9c59e49a4ee13e298f91",
+      "path": "telemetry-dashboard/.dev.vars.example"
+    },
+    {
+      "sha256": "8b6a25398251aa9bdff2bc9fcc1a2130f165701bb15d458d1562b12e4679659e",
+      "path": "telemetry-dashboard/.gitignore"
+    },
+    {
+      "sha256": "ab736901624e4d1fe6f9cf453f4ea1089c5e3e50823df9da44fc7f55b49932b7",
+      "path": "telemetry-dashboard/README.md"
+    },
+    {
+      "sha256": "f9b90a1720ac4d08cae8a6c7e84dd710e19e894c2622ae1848dc5cbe21b76138",
+      "path": "telemetry-dashboard/package-lock.json"
+    },
+    {
+      "sha256": "67fdd43344c7d603d480071c0f31c5ff86941dcb35b3212c1406c29768703cff",
+      "path": "telemetry-dashboard/package.json"
+    },
+    {
+      "sha256": "a6f15531594154e187f3a67e9f6548586f4275bf3385f93bf97612845e70e0b6",
+      "path": "telemetry-dashboard/public/app.js"
+    },
+    {
+      "sha256": "71462d6b52791b380dc2e64321ae2d12d5fca16188bb2c8c62e09d67054d7dbf",
+      "path": "telemetry-dashboard/public/index.html"
+    },
+    {
+      "sha256": "fd1df995193ad1556571d77827588f3bd25d5e757582344e0bd7392bdb3f6653",
+      "path": "telemetry-dashboard/public/panels.js"
+    },
+    {
+      "sha256": "e26b9d327d7088137fba894b89a8c8fbe28713dac4743490c1f29e4e1ff85c47",
+      "path": "telemetry-dashboard/public/styles.css"
+    },
+    {
+      "sha256": "51f62cff2b612e469f13b828c83fcdffb107c2dee11528700a36d4b1db90609b",
+      "path": "telemetry-dashboard/public/theme.js"
+    },
+    {
+      "sha256": "0adb923e426335c80ef04e410bd678a3e7d70533245452d5a2868b5a41729d1e",
+      "path": "telemetry-dashboard/scripts/fixture.sql"
+    },
+    {
+      "sha256": "8d1b0be411a1cc760fb05472a68976969be8b8794908909df0e89fff5fb0e858",
+      "path": "telemetry-dashboard/scripts/render-check.mjs"
+    },
+    {
+      "sha256": "a2fedafb8478d42141d0d01e70dd0edca5a376e4339d59a0279accf23956aa04",
+      "path": "telemetry-dashboard/scripts/seed-fixture.sh"
+    },
+    {
+      "sha256": "7682ec7d203b458ad57282e635c0e9e8fedaae8a256752751a65730cd3282df1",
+      "path": "telemetry-dashboard/scripts/smoke-api.sh"
+    },
+    {
+      "sha256": "3dd24d807ce136ac78c45b8e7129df91a66f98de171373189e72dd4e455e420b",
+      "path": "telemetry-dashboard/scripts/smoke-auth.sh"
+    },
+    {
+      "sha256": "c446a1dddfc85867c6ca4c4dccc0e541cdda524e9739ec708dde4019f54c82f8",
+      "path": "telemetry-dashboard/scripts/vendor-assets.mjs"
+    },
+    {
+      "sha256": "31b2c1ea5b22ad7f9e5343be771d07d1f3e95c18ad6d640a1285bd61af18051c",
+      "path": "telemetry-dashboard/src/api.ts"
+    },
+    {
+      "sha256": "a12841c384e464952dc7173610538a2c2867f00589ffb36569ebf5734b0cfbfa",
+      "path": "telemetry-dashboard/src/auth.ts"
+    },
+    {
+      "sha256": "bc217a1689b28bd46ac86634143896aa79969a5515f45b84238db1d426e7b7f0",
+      "path": "telemetry-dashboard/src/index.ts"
+    },
+    {
+      "sha256": "b142fc6b94af0ecce2be5c0f674b117f80eca6ec7cf8f496b13a1616a41f39af",
+      "path": "telemetry-dashboard/src/login-page.ts"
+    },
+    {
+      "sha256": "c9639f9926f3f6658be8a283f9688725065aec2ca39801416dafa6267c49be34",
+      "path": "telemetry-dashboard/tsconfig.json"
+    },
+    {
+      "sha256": "f3dd1e138b4dcb1f6c962f8f1e39b87f9fa2794538415f7d539f230a1170008c",
+      "path": "telemetry-dashboard/wrangler.jsonc"
+    },
+    {
+      "sha256": "8b5c4b4bdf72e55a64f7301c1198f1efae66f7c9d1ed2fba9fecc5847a52331d",
+      "path": "telemetry-worker/.dev.vars.example"
+    },
+    {
+      "sha256": "5a9af61bcd6339f52173ca9d9fcca18e78c08fcc818560f66e66696c51e07e5c",
+      "path": "telemetry-worker/.gitignore"
+    },
+    {
+      "sha256": "c3cfd939b0bcad9e6495898d24379100c12fb7abf6953d002bf9dbdfabc35664",
+      "path": "telemetry-worker/README.md"
+    },
+    {
+      "sha256": "89b6eb822c9404d3f866d4faa6a853109a474e19566481f59fe2963fd285365a",
+      "path": "telemetry-worker/migrations/0001_init.sql"
+    },
+    {
+      "sha256": "3693c1a387cfaa369927b348e935d42e7f34182702d8f0bd28360b902e2fbd66",
+      "path": "telemetry-worker/migrations/0002_first_index_day.sql"
+    },
+    {
+      "sha256": "d76b93ef5e4e580edf93b661df6662508de2240c6112b6973c9d1702d93b5f8c",
+      "path": "telemetry-worker/migrations/0003_usage_daily.sql"
+    },
+    {
+      "sha256": "af0b138ad5d5d52bec718ca97e4fbfa289abc9064b1082e488ec01a5ad9e7716",
+      "path": "telemetry-worker/migrations/0004_drop_events_machine_day.sql"
+    },
+    {
+      "sha256": "ff22ac518c862dac3d189340c6964f10a8a58170691e736b100e07c81846abb5",
+      "path": "telemetry-worker/package-lock.json"
+    },
+    {
+      "sha256": "93fa973bf297d77cb73e4e4685511bd3a1612060f77ace07ab28af4cc91219b7",
+      "path": "telemetry-worker/package.json"
+    },
+    {
+      "sha256": "13bf914cf5f94264c5fcf652aa4e51546ced6cb6618bfaade243098a5b2dc5d5",
+      "path": "telemetry-worker/scripts/backfill-rollup.sh"
+    },
+    {
+      "sha256": "fbfd1c5c2344b935bd7e904bddb32a7812ea888e3e5f1624c55cb0e4b08e792d",
+      "path": "telemetry-worker/scripts/smoke-cutover.sh"
+    },
+    {
+      "sha256": "e61c0e5fa6aa49c6ab8260536d762e926584124afe9d3744ac3e79597f6231da",
+      "path": "telemetry-worker/scripts/smoke-ingest.sh"
+    },
+    {
+      "sha256": "1f43e592e706238114e30dc8af3a685c6ab4a82b350e985c833893990fb74b47",
+      "path": "telemetry-worker/scripts/smoke-rollup.sh"
+    },
+    {
+      "sha256": "a41e713f830e8bc1c811984d607e5f7df4867ea911bd3c4385d05ba9a789d62e",
+      "path": "telemetry-worker/src/env.d.ts"
+    },
+    {
+      "sha256": "22f9c1adb213e68e81f39c5264f673f5cc99611959d0179dcb0742777cb91de5",
+      "path": "telemetry-worker/src/index.ts"
+    },
+    {
+      "sha256": "1ef992e9ff358d15d4ddc3814e8c4e8ff4b8cab154798b25bc9dcb5af668238c",
+      "path": "telemetry-worker/src/rollup.ts"
+    },
+    {
+      "sha256": "c9639f9926f3f6658be8a283f9688725065aec2ca39801416dafa6267c49be34",
+      "path": "telemetry-worker/tsconfig.json"
+    },
+    {
+      "sha256": "a5f15ffafd2f1535475369cbcd315e7bcd7d6c534affba47d9f72472d45bed4e",
+      "path": "telemetry-worker/wrangler.jsonc"
+    },
+    {
+      "sha256": "95e9368d71bfebc92e1adc07ebc5b0f01084fa8b4d7af9c2f34679c9f7e9d23c",
+      "path": "tsconfig.json"
+    },
+    {
+      "sha256": "fbbac019aeac3e57c81b9e5ca45525e912f778bfcc73445dccb2fca0bfdea65b",
+      "path": "ui/README.md"
+    },
+    {
+      "sha256": "3b92362afaa37a44831b163805b16e1dd56ba48db937ea5a0361159bd9741060",
+      "path": "ui/index.html"
+    },
+    {
+      "sha256": "9a8f45d6a21b6b26463ce78808f6892304e52c340f10914174763f2d25734475",
+      "path": "ui/package.json"
+    },
+    {
+      "sha256": "18bbb33202a468798d3bddb6bbb5bbec83a0391641eb46595f0215d52ab157c0",
+      "path": "ui/src/App.svelte"
+    },
+    {
+      "sha256": "dea80417e3463d5718ef584e73e4e3dce4e44cf86e90164cf10cd2fd7a25aeb0",
+      "path": "ui/src/app.css"
+    },
+    {
+      "sha256": "cbd7f499d891a586d3662634f1e170d151ebdd00baaead3f4b55ee1f46655d34",
+      "path": "ui/src/components/CodegraphUi.svelte"
+    },
+    {
+      "sha256": "b17ae7dc9f962b3d09425b6dc1cb34a040226088c100e0c1043afa0bf8343443",
+      "path": "ui/src/components/DriftBanner.svelte"
+    },
+    {
+      "sha256": "2d9d12029f6ecd7dad0e4c2d7cf8b4c09c0366bfe72312d51fb0ccb63876baa4",
+      "path": "ui/src/components/ExportButtons.svelte"
+    },
+    {
+      "sha256": "08865eaab88e55df9d733c9123c8f3efd2da873300cb6e5d24fb135f2de9a004",
+      "path": "ui/src/components/KindGlyph.svelte"
+    },
+    {
+      "sha256": "da44a36b967b42e333c083079203df0e070e2f77547253d3e0cb50161ded439c",
+      "path": "ui/src/components/PalettePanel.svelte"
+    },
+    {
+      "sha256": "ef06dfaa268673ae8cef0014aca2808dd7e373e46ff63455e68127e599e63a06",
+      "path": "ui/src/components/PaletteRows.svelte"
+    },
+    {
+      "sha256": "c4b7d7f9e67ce2ebbbd009b7b59de9aee10d6d559f2e4a0498e0ff5cd4e1a667",
+      "path": "ui/src/components/SavedTrails.svelte"
+    },
+    {
+      "sha256": "fece087dddd2395e19cb620b94a4da86ecb68d4ff3ab55c3bc04437a60af2220",
+      "path": "ui/src/components/SearchPalette.svelte"
+    },
+    {
+      "sha256": "6b29ad874ca4bde16bb2a8d44c73544d77a7654ec142b09756043f91fcd8f527",
+      "path": "ui/src/components/Toast.svelte"
+    },
+    {
+      "sha256": "e9fc27734e62aae80f2093e264a1863aec33eebf7ea5a40d6d2f7866572d7aa2",
+      "path": "ui/src/components/TopBar.svelte"
+    },
+    {
+      "sha256": "14e5db2fd0a508f2629615159a2e873c6d20dd93a9c73c839cfbf6f1b94493dd",
+      "path": "ui/src/components/TrailBar.svelte"
+    },
+    {
+      "sha256": "1c2c3136642f3dd3ee3287189fa26cd3b6b4cbca3d85a58e26fef4fa8fa146b5",
+      "path": "ui/src/components/entry/EntrySection.svelte"
+    },
+    {
+      "sha256": "3b870c284502cf7fbe71182e3a543fd23fd070dbc8173996d74781d9fd4e42ae",
+      "path": "ui/src/components/file/CodeArcs.svelte"
+    },
+    {
+      "sha256": "57247677fa79f4177b343aee8c8a25423b18713e2984873dc556507bba5e65fe",
+      "path": "ui/src/components/file/FileCodeBlock.svelte"
+    },
+    {
+      "sha256": "3eabb87744bfce2d643933803f1960162614b4638568fe7bee4e598cf88451cb",
+      "path": "ui/src/components/file/FileCodeOutline.svelte"
+    },
+    {
+      "sha256": "d9d365fd48ade247289a09d5da0a257ad2252db0e39fb8ea3b6c1c8df2dd6d01",
+      "path": "ui/src/components/file/FileCodeRail.svelte"
+    },
+    {
+      "sha256": "b247fa92b094ccb2ae27715b289c6f7e6765245585fdcaa7eb9ee392ecd3610d",
+      "path": "ui/src/components/file/FileModeTabs.svelte"
+    },
+    {
+      "sha256": "1f140ba6db870080d5cbfc34882424546e75b2662009013088031a2ae5750b51",
+      "path": "ui/src/components/file/FileOutline.svelte"
+    },
+    {
+      "sha256": "f37e4ca4193f33bae3c0a0f2c29336662488722a843c89de293764ffb828d454",
+      "path": "ui/src/components/file/FileRail.svelte"
+    },
+    {
+      "sha256": "3f91bc92ce9034f7fa3010510a0f22a632720ef65c389dd3332e50c0dc13801e",
+      "path": "ui/src/components/flow/FlowCard.svelte"
+    },
+    {
+      "sha256": "5f8d9d5f039935667763208d44928d57269744373e16c658b1a729013b483b82",
+      "path": "ui/src/components/flow/FlowEndCap.svelte"
+    },
+    {
+      "sha256": "0acef15d3135906554f9f3b151e5d8348dcbe5cafe8d0b786fbcf85333ca5160",
+      "path": "ui/src/components/flow/FlowLink.svelte"
+    },
+    {
+      "sha256": "bb1867bc632db0330b36e349630e926e8928942d57b8070fbf89aceb45776043",
+      "path": "ui/src/components/map/MapKey.svelte"
+    },
+    {
+      "sha256": "9f9bf6e3ff1b57bc85ca145afea72e77d90a4b86c61c528d7a81f8cce20971e2",
+      "path": "ui/src/components/map/MapSidePanel.svelte"
+    },
+    {
+      "sha256": "5032caf5c567fbadb02b7c6e18609a031a6db10f2bfee00ebc0f35862eac142d",
+      "path": "ui/src/components/map/ModuleEdge.svelte"
+    },
+    {
+      "sha256": "d74c8fcfbd65c62bc9b4e07b43a91862836e6787b38ac678ac6661a8dcafb35b",
+      "path": "ui/src/components/map/ModuleNode.svelte"
+    },
+    {
+      "sha256": "81fb1856e7298119f271393b560d55978f37161476aea7afd7990f4924f68705",
+      "path": "ui/src/components/screens/ScreenEdge.svelte"
+    },
+    {
+      "sha256": "db8bee20b9c233d3ca97ed1e177d128d0569a338ef93fb2c22a5b8920043642f",
+      "path": "ui/src/components/screens/ScreenNode.svelte"
+    },
+    {
+      "sha256": "60a0eb259531a7b30e5274389d056fe6c679095c00d785d5ba42234411a7eaea",
+      "path": "ui/src/components/steps/DecisionCaption.svelte"
+    },
+    {
+      "sha256": "9d21e8a52709b7a0f92c8499f601fddbed5a8a37df05c07b2cf09a6d6af8580b",
+      "path": "ui/src/components/steps/ForkPoint.svelte"
+    },
+    {
+      "sha256": "37dc63a67f0509019018197c9fe6c1132ec577227ef860a2d1a73403f8cdb7f3",
+      "path": "ui/src/components/steps/RegionCaption.svelte"
+    },
+    {
+      "sha256": "8f185b19798bf3a66d6ab5f5c6d5d9eb47348f24a16ebb20ece6c8d8641732d2",
+      "path": "ui/src/components/steps/StepBox.svelte"
+    },
+    {
+      "sha256": "cb3799e54e91a757284c176769ed5164322105ed05584f9079ee4a60fd3ffebe",
+      "path": "ui/src/components/steps/StepNode.svelte"
+    },
+    {
+      "sha256": "d122a12edbc6d1b60afab8499ae65699b00b0da201c498e6992b1f9bbd595868",
+      "path": "ui/src/components/steps/StepStubs.svelte"
+    },
+    {
+      "sha256": "d0b3ebdabea4de23ddae2b3b482840cbeeae1fe0e212eb1c3a0f7f9d7471fef7",
+      "path": "ui/src/components/steps/StepsKey.svelte"
+    },
+    {
+      "sha256": "70430e656d3b9c68aa74352de4264531bb6fb4b9eb2b57debfe446dfab611f25",
+      "path": "ui/src/components/symbol/BlastStrip.svelte"
+    },
+    {
+      "sha256": "bc14321ff0b99fef686a683fbf8ca1649c770c7e8209737bf9a5e32385650c57",
+      "path": "ui/src/components/symbol/CalleeRail.svelte"
+    },
+    {
+      "sha256": "c555d52e118b7cd72886dd8907b72a7c76dabe7d4902c87559e73c81a409c722",
+      "path": "ui/src/components/symbol/CallersRail.svelte"
+    },
+    {
+      "sha256": "84d3b552f99e4d541adbad1f53cf2fe8f09b802b30e613c6ad89c38d92a7d5c3",
+      "path": "ui/src/components/symbol/Connectors.svelte"
+    },
+    {
+      "sha256": "3158699af150e09f6cea51c5c46d937f4dc32d85fdfa4dab17f88c7beb573385",
+      "path": "ui/src/components/symbol/MembersOutline.svelte"
+    },
+    {
+      "sha256": "f010d1ba0a3908cc4ada0b65a8e0d279123757c1393245d121cb600af0de0c36",
+      "path": "ui/src/components/symbol/SourceBlock.svelte"
+    },
+    {
+      "sha256": "6b3d6baef18e2cedd4d98f5675539cb153a85acf83317bc1f6e8b7c1c65a6f50",
+      "path": "ui/src/components/symbol/SymbolHeader.svelte"
+    },
+    {
+      "sha256": "fa73495d9729b14bb7908aa7d351b4a69cc3f84068aa1326628755827af6f140",
+      "path": "ui/src/components/symbol/TypeHierarchy.svelte"
+    },
+    {
+      "sha256": "5e9e2455f181ad0056d17a894e492e4515ab2de03f07034ffd150ce51f5618be",
+      "path": "ui/src/index.ts"
+    },
+    {
+      "sha256": "733c6edab713ccb2d6079df64849d3bdabe9ad2e94aa5128ac52ab51c18c15f2",
+      "path": "ui/src/lib/adapter.ts"
+    },
+    {
+      "sha256": "9fb1d3fd4d13b6a39fb903c986f03f4644490fa80861789392d6130fc66c3de3",
+      "path": "ui/src/lib/api.ts"
+    },
+    {
+      "sha256": "93ae4b0ebf9533f9b6da62cd3021f57401e310bb92a0b89ed64ebfbb9bf063fe",
+      "path": "ui/src/lib/conditions.ts"
+    },
+    {
+      "sha256": "9ecb2ae600728307f6e265d83a62c7b6bce7089521e8af2f3a929ec2ab1ddbdd",
+      "path": "ui/src/lib/deadcode-model.ts"
+    },
+    {
+      "sha256": "4e30aedd9b49f1547e193f4ecf0224223030b5e23f489941f0ca4e3fbf785850",
+      "path": "ui/src/lib/entry-model.ts"
+    },
+    {
+      "sha256": "a336e3a4058daba1a7ad2e22e33bd4fbf50ceec5257b4c22c5f1d4089be86178",
+      "path": "ui/src/lib/export-image.ts"
+    },
+    {
+      "sha256": "b8379cae966679e3bb78912f27f7d348f363ffe0402fd99bc0cf1ddfee982d86",
+      "path": "ui/src/lib/export-svg.ts"
+    },
+    {
+      "sha256": "fc201d0ed4c5f414c024b365424b6b12552b8f2fad8118e613cddb099aab8dde",
+      "path": "ui/src/lib/file-model.ts"
+    },
+    {
+      "sha256": "ad5cd97a2f925328d065908a109f70b1af57067f36f9081441ab5e076714cd6a",
+      "path": "ui/src/lib/filecode-model.ts"
+    },
+    {
+      "sha256": "3842b087800f619edfd42592f6b2a0f886fb993b71af071b9867a3fcc208f341",
+      "path": "ui/src/lib/flow-model.ts"
+    },
+    {
+      "sha256": "91921e7ad75fb43206d78e970ede84d067258ba6d9c77117f39d9cecff8329ce",
+      "path": "ui/src/lib/focus.svelte.ts"
+    },
+    {
+      "sha256": "b8ae749f87706f13927f1f06b214a2daf48af343554c54db897430a0a1a8400f",
+      "path": "ui/src/lib/hierarchy-model.ts"
+    },
+    {
+      "sha256": "a41dfc6ec531269c05f4247b42354011c4a16f400fedaabd8db9394a85af311f",
+      "path": "ui/src/lib/highlight.ts"
+    },
+    {
+      "sha256": "523579cb403bd0a7ca9586d8b35d16f924b9e569e3f00b4a174387ec55ac828f",
+      "path": "ui/src/lib/kinds.ts"
+    },
+    {
+      "sha256": "9ee4ea579e3fa2903a95b20747ae754a394312200e05317c625e00a5cb06c074",
+      "path": "ui/src/lib/live.svelte.ts"
+    },
+    {
+      "sha256": "2a22887635d5f394dad01f16ad18425790f5d49839fcada3097f74fb13f9fbf8",
+      "path": "ui/src/lib/map-model.ts"
+    },
+    {
+      "sha256": "f065b6e98d0f0fad0014aef43d95bce3e82c340d2036361dda22eaf2749a746e",
+      "path": "ui/src/lib/navigation.ts"
+    },
+    {
+      "sha256": "f12b040b8477ebf55336a80e3761990b1ee9118ae639079db2d9f309d4eceab1",
+      "path": "ui/src/lib/palette.svelte.ts"
+    },
+    {
+      "sha256": "7c87d8fdaabcb46e23956228ec67ea96d5ac049609912054bfa43e4c2ef66ebf",
+      "path": "ui/src/lib/program-model.ts"
+    },
+    {
+      "sha256": "e64e66450918402c14e3a65a0b43472d16ef4dcfa10c77f3bf91d6313367acc4",
+      "path": "ui/src/lib/project.svelte.ts"
+    },
+    {
+      "sha256": "9d0b41a3db00303eec3bea4a36dd0fb1e93365347cec543c5bc2bee4975943de",
+      "path": "ui/src/lib/router.svelte.ts"
+    },
+    {
+      "sha256": "8cc1f059402ba73da4baf3951e22c11d3bc7a29330a525ec30dfbe1237cacade",
+      "path": "ui/src/lib/screens-model.ts"
+    },
+    {
+      "sha256": "5ed9258153b8e1c2bd8660d30d6a25b0c9409e9d435b2f275abb50becbed7f2f",
+      "path": "ui/src/lib/search-model.ts"
+    },
+    {
+      "sha256": "529bbca7259358f3ca4d1b8e9604dc0a14c36d81e60dbf3e9fe85903c0e1cf9e",
+      "path": "ui/src/lib/steps-model.ts"
+    },
+    {
+      "sha256": "86ccdde4e6186ebcd112a07be2a9a282827b67fe748a6d31a375c5d99359e41c",
+      "path": "ui/src/lib/symbol-model.ts"
+    },
+    {
+      "sha256": "9a0e812bc30decd91edd99e43f89f1f8d98d9ca984ba7b70c175c8dfe9502eab",
+      "path": "ui/src/lib/theme.css"
+    },
+    {
+      "sha256": "38dfdfab54c6263133a86e1228f860a69c4e2e5a08fefe918c6eed6df3ff5ff1",
+      "path": "ui/src/lib/toast.svelte.ts"
+    },
+    {
+      "sha256": "a1d50aefba871f5fb1f227b9fb40eafb50048b9c7519a748585daecb4d314165",
+      "path": "ui/src/lib/trail-codec.ts"
+    },
+    {
+      "sha256": "5a1ba25690b847d30dccc598038b176dc0532db887fdb1d80b804c2d36dacdda",
+      "path": "ui/src/lib/trail.svelte.ts"
+    },
+    {
+      "sha256": "80bccb1e33ec259d601089e14d64b3f9553e27ab80c06360fc8e1e6e7a3f4002",
+      "path": "ui/src/lib/trails-model.ts"
+    },
+    {
+      "sha256": "bc1844201c11c1c5aee1746521b90e52657b088cb8035eef228029ed1ca12fd4",
+      "path": "ui/src/lib/trails.svelte.ts"
+    },
+    {
+      "sha256": "85e587aa5bb70699a49cc9391760a21db138027ce21376d9c99308f0c57ed5a7",
+      "path": "ui/src/lib/walk.ts"
+    },
+    {
+      "sha256": "1d66046413a5ebeaa9ff6ff325c786a2b0ae5d130698c03b1c6675e64f1e4c2a",
+      "path": "ui/src/lib/wire.ts"
+    },
+    {
+      "sha256": "a2d7b76e38931b9a02eb5943e2d4fb54909dca3b3899cf48874198e603676438",
+      "path": "ui/src/main.ts"
+    },
+    {
+      "sha256": "362241216efdef4a8df2e4d5734a4dab9d6a845d13c36a990cc89f7d5b0e497b",
+      "path": "ui/src/views/DeadCodeView.svelte"
+    },
+    {
+      "sha256": "fc2245c16620673a53006e8fb7cfbdc9adf0dc18ef05441275a5b91bc340b11e",
+      "path": "ui/src/views/EntryView.svelte"
+    },
+    {
+      "sha256": "fff8a84ae30b1cc1e2961952376894b48d5a3781529cb988454ea0f39f7d7037",
+      "path": "ui/src/views/FileCodeView.svelte"
+    },
+    {
+      "sha256": "17a7b0b744221c6093def28589fb5fa141a61d364a426690ba85db69fd77f5fa",
+      "path": "ui/src/views/FileView.svelte"
+    },
+    {
+      "sha256": "26b270a875f44cac829d073a8124edce752910615915511cf27d47e9cc9b4b19",
+      "path": "ui/src/views/FlowView.svelte"
+    },
+    {
+      "sha256": "516d6773139a37ea85304809e84e711ad1a6d7cca7b9444eaa8a94df651cc624",
+      "path": "ui/src/views/HomeView.svelte"
+    },
+    {
+      "sha256": "aaf27d6e719fe46c56349d397a94f0356e4176b04b071b247576699693136f7b",
+      "path": "ui/src/views/MapView.svelte"
+    },
+    {
+      "sha256": "367579cebe430aaada4643bcba3df6e24f6fe04fe0298cc969695698504bc3c7",
+      "path": "ui/src/views/NotFoundView.svelte"
+    },
+    {
+      "sha256": "bceecf2b76033c8b2ff21eedf346b20c4af1ddd90c86dc0a58a8adb4d8cba6e5",
+      "path": "ui/src/views/ScreensView.svelte"
+    },
+    {
+      "sha256": "e1480398bbd0931a8648cbdc33ea55d03cc86d7c716b4ea11bbbf09ac9c95eb8",
+      "path": "ui/src/views/StepsView.svelte"
+    },
+    {
+      "sha256": "fd46b7593451c272f8386666124fdf66597d1f9074d13c71d8ac1c1e18e50b09",
+      "path": "ui/src/views/SymbolView.svelte"
+    },
+    {
+      "sha256": "38f4ed7a7ec5e5c793b4f3809b8f85876ce2ee232392e56c25c2d076e30370a4",
+      "path": "ui/svelte.config.js"
+    },
+    {
+      "sha256": "7b8a114dfab2068a3d5f3d08dd9ac53fc32c854b22fdf90425ee63b0dda40391",
+      "path": "ui/tsconfig.json"
+    },
+    {
+      "sha256": "3f956d4549f5866e923c7db2881ad7e3ae3e921fd43d304ccc4fde4d1a6fb15c",
+      "path": "ui/vite.config.ts"
+    },
+    {
+      "sha256": "f75c4b5ade065e05891979cf7bfc3ba1e6c335bc475ffe78d4f33005044ff962",
+      "path": "vitest.config.mts"
+    }
+  ],
+  "corpus": [
+    {
+      "name": "requests",
+      "source": "/home/ericm/.cache/codegraph-oracle/work/w-pub-requests/repo",
+      "copy": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/requests",
+      "sha": "3c7baaa05ab4aa49cc819ce3a819d260de19c157"
+    },
+    {
+      "name": "click",
+      "source": "/home/ericm/.cache/codegraph-oracle/work/w-pub-click/repo",
+      "copy": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/click",
+      "sha": "2247b35ea1c47c727d7a06e51fa280e12a863ff6"
+    },
+    {
+      "name": "mux",
+      "source": "/home/ericm/.cache/codegraph-oracle/work/w-pub-mux/repo",
+      "copy": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/mux",
+      "sha": "db9d1d0073d27a0a2d9a8c1bc52aa0af4374d265"
+    },
+    {
+      "name": "ky",
+      "source": "/home/ericm/.cache/codegraph-oracle/work/w-pub-ky/repo",
+      "copy": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/ky",
+      "sha": "3541888878c4d303a8bc2ad61815f4e048f55a5d"
+    },
+    {
+      "name": "express",
+      "source": "/home/ericm/.cache/codegraph-oracle/work/w-pub-express/repo",
+      "copy": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/express",
+      "sha": "43fca52d28a422c8be48fd489cbd4f2d6152bab6"
+    }
+  ],
+  "node": "v22.22.2",
+  "notes": "Independent filesystem copies, dependency copies, no checkout/reset/stash/commit; WASM kernel only. Experimental T0 excluded."
+}
diff --git a/docs/handoffs/pr29-2026-11-10/harness/metamorphic-baseline.json b/docs/handoffs/pr29-2026-11-10/harness/metamorphic-baseline.json
new file mode 100644
index 0000000000..10ceefd892
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/harness/metamorphic-baseline.json
@@ -0,0 +1,3241 @@
+[
+ {
+  "seed": "a",
+  "relation": "decoy",
+  "edges": 4,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 5,
+  "challengeSha256": "8c804eb586ccf55b9834b3e12464b4641abb273e917b1283890b6196d6322582",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "a",
+  "relation": "shift",
+  "edges": 4,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "handler.ts",
+   "lib.ts"
+  ],
+  "challengeSha256": "ef572074d46bceae1b317fcc1252dcddae4aa1c38d72ae2e675a5b1b0004decf",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "a",
+  "relation": "repeat",
+  "edges": 4,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "23c74e58b799e92c5954773a12193b60652aea7953503e7755fe0f7b2f3fb08b",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "b",
+  "relation": "decoy",
+  "edges": 1,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [
+    "queries.ts:8 take -calls-> session.ts:Session::snapshot (instance-method)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 5,
+  "challengeSha256": "0630e262fed84f7373d1271f85deac715094084ac5674e536917032a9f5d698e",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "b",
+  "relation": "shift",
+  "edges": 1,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "queries.ts",
+   "session.ts"
+  ],
+  "challengeSha256": "a9fc526b55bffa2e07db1e7ccbe93f28e0aa57430b5df0d74bed1adc49472a9b",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "b",
+  "relation": "repeat",
+  "edges": 1,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "e62bc5451f37da2a2d83497020c5c6e544c40decec19679394a4887dadbe4f14",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "c",
+  "relation": "decoy",
+  "edges": 1,
+  "diffs": {
+   "CAPTURED": [
+    "orch.ts:5 Orchestrator::check -calls-> zz_cg_decoy/decoy-fns.ts:has (exact-match)"
+   ],
+   "LOST": [
+    "orch.ts:5 Orchestrator::check -calls-> cache.ts:Cache::has (exact-match)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 6,
+  "challengeSha256": "f9af1e114a9028ad0fdf6e0dd6d8272aedca300f0705f03412629080474326f8",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "c",
+  "relation": "shift",
+  "edges": 1,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "cache.ts",
+   "orch.ts"
+  ],
+  "challengeSha256": "f1a17e3a7a9de3e0864f44665003080ad289dbe3aaeb24ce8ecb165e3a1b8e1c",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "c",
+  "relation": "repeat",
+  "edges": 1,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "1f8f44d8ae2346657173aade2442e76b5b31b4fd8da05680aba17af27b1145ab",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "g1-go-new-receiver",
+  "relation": "decoy",
+  "edges": 9,
+  "diffs": {},
+  "decoys": 0,
+  "notApplicable": true,
+  "reason": "no supported source call/class names",
+  "challengeSha256": "e80d5f340c90ca81c9f529f75c6a385a351524cfb56675de75d82aacf79aa92c",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "g1-go-new-receiver",
+  "relation": "shift",
+  "edges": 9,
+  "diffs": {},
+  "shiftedFiles": [],
+  "notApplicable": true,
+  "reason": "no supported files to shift",
+  "challengeSha256": "ea26e8d9c6b8827dd0ad38813a22e6dfaa0796f7502b4a30c68a71fe40b8f352",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "g1-go-new-receiver",
+  "relation": "repeat",
+  "edges": 9,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "76dba48fb10798207eed5d79fdca6bf4b5eaa0682860e1ef849fa634045f56c6",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2944",
+  "relation": "decoy",
+  "edges": 5,
+  "diffs": {
+   "CAPTURED": [
+    "a.test.ts:1 a.test.ts -calls-> zz_cg_decoy/decoy-fns.ts:describe (exact-match)",
+    "a.test.ts:23 a.test.ts -calls-> zz_cg_decoy/decoy-fns.ts:it (exact-match)",
+    "a.test.ts:25 a.test.ts -calls-> zz_cg_decoy/decoy-fns.ts:describe (exact-match)",
+    "a.test.ts:27 a.test.ts -calls-> zz_cg_decoy/decoy-fns.ts:it (exact-match)"
+   ],
+   "LOST": [
+    "a.test.ts:1 a.test.ts -calls-> decl.d.ts:describe (exact-match)",
+    "a.test.ts:23 a.test.ts -calls-> decl.d.ts:it (exact-match)",
+    "a.test.ts:25 a.test.ts -calls-> decl.d.ts:describe (exact-match)",
+    "a.test.ts:27 a.test.ts -calls-> decl.d.ts:it (exact-match)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 6,
+  "challengeSha256": "d4a7e906b515d5441ba21bfb35ea4988e313b931f54233fe0b17cda7fef6e527",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2944",
+  "relation": "shift",
+  "edges": 5,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "a.test.ts",
+   "decl.d.ts"
+  ],
+  "challengeSha256": "19d80bed394c4999e4fc7923317fa9c8f5475a93e764be2351148a92b8cec28b",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2944",
+  "relation": "repeat",
+  "edges": 5,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "1567661684212f0851f4c840735640adc59c3fef433884775bf45a61f8a3a6e0",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2944-arrow",
+  "relation": "decoy",
+  "edges": 6,
+  "diffs": {
+   "CAPTURED": [
+    "a.test.ts:1 a.test.ts -calls-> zz_cg_decoy/decoy-fns.ts:describe (exact-match)",
+    "a.test.ts:23 a.test.ts -calls-> zz_cg_decoy/decoy-fns.ts:it (exact-match)",
+    "a.test.ts:25 a.test.ts -calls-> zz_cg_decoy/decoy-fns.ts:describe (exact-match)",
+    "a.test.ts:27 a.test.ts -calls-> zz_cg_decoy/decoy-fns.ts:it (exact-match)"
+   ],
+   "LOST": [
+    "a.test.ts:1 a.test.ts -calls-> decl.d.ts:describe (exact-match)",
+    "a.test.ts:23 a.test.ts -calls-> decl.d.ts:it (exact-match)",
+    "a.test.ts:25 a.test.ts -calls-> decl.d.ts:describe (exact-match)",
+    "a.test.ts:27 a.test.ts -calls-> decl.d.ts:it (exact-match)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 6,
+  "challengeSha256": "58510d6f32312e64962ecec1d943ea3e81d0e8d89f3f156c5af57394c40e7a7d",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2944-arrow",
+  "relation": "shift",
+  "edges": 6,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "a.test.ts",
+   "decl.d.ts"
+  ],
+  "challengeSha256": "02502bcbd33040a5ef40e82fa76ffa9ee9ceca5c4e1e46e1348466d908cbae7d",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2944-arrow",
+  "relation": "repeat",
+  "edges": 6,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "03baf07209e3a2bb37e10affb6d379609adc91442b4393a786cdb96d21ab5a2b",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2944-verbatim",
+  "relation": "decoy",
+  "edges": 6,
+  "diffs": {
+   "CAPTURED": [
+    "a.test.ts:1 a.test.ts -calls-> zz_cg_decoy/decoy-fns.ts:describe (exact-match)",
+    "a.test.ts:23 a.test.ts -calls-> zz_cg_decoy/decoy-fns.ts:it (exact-match)",
+    "a.test.ts:25 a.test.ts -calls-> zz_cg_decoy/decoy-fns.ts:describe (exact-match)",
+    "a.test.ts:27 a.test.ts -calls-> zz_cg_decoy/decoy-fns.ts:it (exact-match)"
+   ],
+   "LOST": [
+    "a.test.ts:1 a.test.ts -calls-> decl.d.ts:describe (exact-match)",
+    "a.test.ts:23 a.test.ts -calls-> decl.d.ts:it (exact-match)",
+    "a.test.ts:25 a.test.ts -calls-> decl.d.ts:describe (exact-match)",
+    "a.test.ts:27 a.test.ts -calls-> decl.d.ts:it (exact-match)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 6,
+  "challengeSha256": "39ad0a6dade9823b712df049144cdfe3ba7f9e40d2cbd02aa3b62f16d6bf9bfa",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2944-verbatim",
+  "relation": "shift",
+  "edges": 6,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "a.test.ts",
+   "decl.d.ts"
+  ],
+  "challengeSha256": "ebecff07883134a22106ec41bf410f59ac0fea9f2723091f4b2a0b665386cf2c",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2944-verbatim",
+  "relation": "repeat",
+  "edges": 6,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "4c2a691f2b65b7cb48f5d177a28cec4d030336c78b406f9353e0b483f91bb06c",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2946",
+  "relation": "decoy",
+  "edges": 13,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 18,
+  "challengeSha256": "3cdb37b49b8af6537ba0fd5f3070392a6e4f2e3eed05fba17695f5c9b2df837e",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2946",
+  "relation": "shift",
+  "edges": 13,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "db.ts",
+   "use.ts",
+   "writer.ts"
+  ],
+  "challengeSha256": "92cb8575936110478738fde0458178992253d3dc554875f498b05324e1ac809d",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2946",
+  "relation": "repeat",
+  "edges": 13,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "31c403ad778521ce51ad30d75dc5043593f73a63d860d3b604d9358119b8e560",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2947",
+  "relation": "decoy",
+  "edges": 4,
+  "diffs": {
+   "CAPTURED": [
+    "use.ts:1 use.ts -imports-> zz_cg_decoy/decoy-fns.ts:createRoot (exact-match)",
+    "use.ts:4 a -calls-> zz_cg_decoy/decoy-fns.ts:createRoot (exact-match)"
+   ],
+   "LOST": [
+    "use.ts:4 a -calls-> app.ts:App::render (instance-method)",
+    "use.ts:5 b -calls-> app.ts:App::close (instance-method)",
+    "use.ts:6 c -calls-> app.ts:App::close (instance-method)",
+    "use.ts:7 d -calls-> app.ts:App::translate (instance-method)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 23,
+  "challengeSha256": "42ba3b0da1eec27de381feaa294bd93da495a0ded651a4daadaf03f8991f7a47",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2947",
+  "relation": "shift",
+  "edges": 4,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "app.ts",
+   "use.ts"
+  ],
+  "challengeSha256": "50b62e871841fb48123b9780d6da1f955f401e8b232cb0791a9ff1121e3a698d",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2947",
+  "relation": "repeat",
+  "edges": 4,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "d6f80a444a1ed09e8191b046bc8fc42707d1c672b02a4adc9c0e72167c587e69",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2948",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [
+    "use.ts:3 Scene::a -calls-> zz_cg_decoy/decoy-fns.ts:push (exact-match)",
+    "use.ts:4 Scene::b -calls-> zz_cg_decoy/decoy-fns.ts:includes (exact-match)"
+   ],
+   "LOST": [
+    "use.ts:3 Scene::a -calls-> heap.ts:BinaryHeap::push (exact-match)",
+    "use.ts:4 Scene::b -calls-> heap.ts:Conf::includes (exact-match)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 16,
+  "challengeSha256": "996e0dd677d062bea5d03aacf7f6150d7978d61e24a664687d14072093f468e2",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2948",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "heap.ts",
+   "use.ts"
+  ],
+  "challengeSha256": "ac2d2fb3508a8deb548d7e5817df7a309fb577913cd77ff32ce54f4fa74caccc",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2948",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "b53b3852325f76dd08ca3c2a1d2b1c4a19530081bc32e5da1b83b1c426af28fd",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2949",
+  "relation": "decoy",
+  "edges": 7,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 14,
+  "challengeSha256": "798bef1c4bf087b9cf02807fa4dcf69f2eb3878f09474ca5b84258d75db73816",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2949",
+  "relation": "shift",
+  "edges": 7,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "lib.ts",
+   "use.ts"
+  ],
+  "challengeSha256": "8f315f61302a6e4db79bafbd7f26f9bc9c53ec030ece448c9565669648731da8",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2949",
+  "relation": "repeat",
+  "edges": 7,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "c170ba769ddfbdda7e5f80b619e26e8b76ba192324f48635d0460892d57a03f1",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2949-pkg",
+  "relation": "decoy",
+  "edges": 6,
+  "diffs": {
+   "CAPTURED": [
+    "use.ts:1 use.ts -imports-> zz_cg_decoy/decoy-fns.ts:skipString (exact-match)"
+   ],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 14,
+  "challengeSha256": "b320d56aad93ec44df87387c0b3e132b88daf414cb57b659985d01d8c1505527",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2949-pkg",
+  "relation": "shift",
+  "edges": 6,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "use.ts"
+  ],
+  "challengeSha256": "3f119fcfad7a8ea1ece1e05f40f99332ff0e2e44d9e0865d728893b058d38a0c",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2949-pkg",
+  "relation": "repeat",
+  "edges": 6,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "711eab9cfcb68343a534cc41ce1d1d2b6cfed8875f4b7ba6517f644e806cb116",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2951",
+  "relation": "decoy",
+  "edges": 16,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [
+    "a.ts:2 useA -calls-> schemas.ts:ZodString::ipv4 (instance-method)",
+    "c.ts:2 useC -calls-> schemas.ts:ZodString::ipv4 (instance-method)",
+    "d.ts:2 useD -calls-> schemas.ts:ZodString::ipv4 (instance-method)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 10,
+  "challengeSha256": "fb4b88b43e33d2ff1c7a6c51d62da3b6d79ba1593adea46968e9e7dd63d24601",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2951",
+  "relation": "shift",
+  "edges": 16,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "a.ts",
+   "b.ts",
+   "c.ts",
+   "d.ts",
+   "external.ts",
+   "index.ts",
+   "index2.ts",
+   "index3.ts",
+   "schemas.ts"
+  ],
+  "challengeSha256": "0b577fb910a14d0a8788a073bc978c2d259a43cb2a4a7fb5857bb0c55fbee932",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2951",
+  "relation": "repeat",
+  "edges": 16,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "8cc78053c6aebc40472c53955c2f62e6c446dc32531af6bf38856249422c473d",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2952",
+  "relation": "decoy",
+  "edges": 4,
+  "diffs": {
+   "CAPTURED": [
+    "test/utils.js:2 t -calls-> zz_cg_decoy/decoy-methods.js:CgDecoyHost::etag (instance-method)"
+   ],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 14,
+  "challengeSha256": "982a1391db6e154f2b43b03e3be7d960d963897e64b1fed523070bc51bcf812d",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2952",
+  "relation": "shift",
+  "edges": 4,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "lib/utils.js",
+   "test/utils.js"
+  ],
+  "challengeSha256": "8fda9afb8e1e51a6a4aa1b7daeb08707708fc848abf9fd08cd8131f17f442913",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2952",
+  "relation": "repeat",
+  "edges": 4,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "3a59f7547e89908d3a227a87da5ceb84eb96ad7c0e3055bb65cae77143a55fd7",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2953",
+  "relation": "decoy",
+  "edges": 16,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [
+    "app.ts:16 handlerS -calls-> streaming.ts:StreamApi::onAbort (instance-method)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 52,
+  "challengeSha256": "f009f0705d7cbf2b498f89920d146883f58cd27845610205a1cc707f62b41c32",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2953",
+  "relation": "shift",
+  "edges": 16,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "app.ts",
+   "cjsapp.js",
+   "lib/reply.js",
+   "streaming.ts"
+  ],
+  "challengeSha256": "518a181a60309254fb70c95e31e0d3929dceaaa524d6716af08b1679d8673b9e",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2953",
+  "relation": "repeat",
+  "edges": 16,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "fdf0a998bbc9db293ff0e1b9f437438c5c6c7991aac2a06042b632502504d21e",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2954",
+  "relation": "decoy",
+  "edges": 7,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 11,
+  "challengeSha256": "8403c64e458ea0a2b6e7cfcc17438174ae192677144de668408b2d2c44e85f5e",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2954",
+  "relation": "shift",
+  "edges": 7,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "lib.ts",
+   "tools.ts"
+  ],
+  "challengeSha256": "1e9a93fe5d348d8ad8cbbe8ab8cee290c3f8526ebb62b3d64ab68a46c1197080",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2954",
+  "relation": "repeat",
+  "edges": 7,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "77c3fbfcbbab91adcf0b2183b9a503eb1ee811f1aeb88235663b587f5d5d7a12",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2957",
+  "relation": "decoy",
+  "edges": 13,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 14,
+  "challengeSha256": "9a3954b224013c8c2d224bca1f2d46f0363b825e2668715e89560c0ca2705db4",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2957",
+  "relation": "shift",
+  "edges": 13,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "pkg/__init__.py",
+   "pkg/_client.py",
+   "use.py"
+  ],
+  "challengeSha256": "7b5c48b9a1ac4175512e43f27eeb74a21fb314f88a69299ff731de8d7d57590c",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2957",
+  "relation": "repeat",
+  "edges": 13,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "e23035fc96c4f6429f742f690be5994664a56674e7126dfdcf75fffe65ccb36e",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2958",
+  "relation": "decoy",
+  "edges": 1,
+  "diffs": {
+   "CAPTURED": [
+    "examples/factory.py:2 create_app -calls-> zz_cg_decoy/decoy_fns.py:object (exact-match)"
+   ],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 7,
+  "challengeSha256": "aa25e39221a4ac7b52420ca376bc8eb70041066f29f201fd95ce93d3613e5ae0",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2958",
+  "relation": "shift",
+  "edges": 1,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "examples/factory.py",
+   "pkg/cli.py"
+  ],
+  "challengeSha256": "2be896c898e7443762c3999270265beb6fa871305963331ec763219788162452",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2958",
+  "relation": "repeat",
+  "edges": 1,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "2d7a0357b706a5f7fe49e5150865be9380654c69e5e47764b7c058727ced0d27",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2962",
+  "relation": "decoy",
+  "edges": 3,
+  "diffs": {
+   "CAPTURED": [
+    "use.tsx:1 use.tsx -imports-> zz_cg_decoy/decoy-fns.ts:useForm (exact-match)",
+    "use.tsx:3 objSpread -calls-> zz_cg_decoy/decoy-fns.ts:useForm (exact-match)",
+    "use.tsx:8 jsxSpread -calls-> zz_cg_decoy/decoy-fns.ts:useForm (exact-match)",
+    "use.tsx:12 jsxSpreadNested -calls-> zz_cg_decoy/decoy-fns.ts:useForm (exact-match)",
+    "use.tsx:16 controls -calls-> zz_cg_decoy/decoy-fns.ts:useForm (exact-match)",
+    "use.tsx:18 controls -calls-> zz_cg_decoy/decoy-fns.ts:useForm (exact-match)",
+    "use.tsx:20 controls -calls-> zz_cg_decoy/decoy-fns.ts:useForm (exact-match)",
+    "use.tsx:22 controls -calls-> zz_cg_decoy/decoy-fns.ts:useForm (exact-match)"
+   ],
+   "LOST": [
+    "use.tsx:4 objSpread -calls-> auth.ts:register (exact-match)",
+    "use.tsx:9 jsxSpread -calls-> auth.ts:register (exact-match)",
+    "use.tsx:13 jsxSpreadNested -calls-> auth.ts:register (exact-match)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 18,
+  "challengeSha256": "ed3f2ecaa88c40f0a7cdb89cb431f2b1a845d1664ba318785ca71bb68137f054",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2962",
+  "relation": "shift",
+  "edges": 3,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "auth.ts",
+   "use.tsx"
+  ],
+  "challengeSha256": "426b02a8b2a5cc6649e5e8e8be2b10d317e39cf1e0284b7fd23505cf0067d5dd",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2962",
+  "relation": "repeat",
+  "edges": 3,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "793a141de5d88361744a7ebcd15726af028ede594d3e6439276e13aed88f1bdf",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2963",
+  "relation": "decoy",
+  "edges": 12,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 11,
+  "challengeSha256": "f30e9716975268ec8d99bf507df687bafbbde9a4378b63813c37a9e5e4cb82c2",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2963",
+  "relation": "shift",
+  "edges": 12,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "pkg/__init__.py",
+   "pkg/deco.py",
+   "use.py"
+  ],
+  "challengeSha256": "a3b6af93f14bc251eb28b9c96e52f02cbfbc98e1413d322d8ad1b7fbc567e60b",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2963",
+  "relation": "repeat",
+  "edges": 12,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "6c577c5aeeaadb8933094f44548f5b67ef10d36ca84c535606995718fc85c525",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2964",
+  "relation": "decoy",
+  "edges": 14,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 20,
+  "challengeSha256": "97e1c347e0318d432feee1d17fc6fe48947b1ab7aa9a04caec199f91ac61475e",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2964",
+  "relation": "shift",
+  "edges": 14,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "b.js",
+   "lib/index.js",
+   "lib/inner/entry.js",
+   "srv.js",
+   "test/a.test.js"
+  ],
+  "challengeSha256": "beb3f2f76327af0c718d446f467825f08463fe8f8be6219e174c6c84f26fee95",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2964",
+  "relation": "repeat",
+  "edges": 14,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "21f8cefe8ab94ecaa92f6accdb88abb328fc77b5ab33106edc0fe31df52106dc",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2966",
+  "relation": "decoy",
+  "edges": 12,
+  "diffs": {
+   "CAPTURED": [
+    "lib/reply.js:3 lib/reply.js -calls-> zz_cg_decoy/decoy-fns.js:getHeader (exact-match)"
+   ],
+   "LOST": [
+    "lib/model.js:3 init -calls-> lib/other.js:Cast::insertMany (instance-method)",
+    "lib/reply.js:3 lib/reply.js -calls-> lib/types.d.ts:FastifyReply::getHeader (exact-match)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 52,
+  "challengeSha256": "e5ef350885b5a6bc27e2774c2dd34e082cde5dff993fa23b98afaf3afde644be",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2966",
+  "relation": "shift",
+  "edges": 12,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "lib/application.js",
+   "lib/context.js",
+   "lib/hooks.js",
+   "lib/model.js",
+   "lib/other.js",
+   "lib/reply.js",
+   "lib/types.d.ts",
+   "lib/validation.js",
+   "test/model.test.js"
+  ],
+  "challengeSha256": "01e6001b79229b8fd58c0268316cd2d9e3c6cc299e24bbe6101f1ce23eafb8b1",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2966",
+  "relation": "repeat",
+  "edges": 12,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "3baf1e85f5ea2326fe20361475e20b4c0c93f930a14e0f1a44f81a80e39e8593",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2967",
+  "relation": "decoy",
+  "edges": 11,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 44,
+  "challengeSha256": "e9ad32cc634bd5a98409a44610206ddb63a590318fe92bd605b58c5b3cde4dec",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2967",
+  "relation": "shift",
+  "edges": 11,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "mod.js",
+   "mod.ts",
+   "page.tsx",
+   "use.js",
+   "use.ts",
+   "use.tsx"
+  ],
+  "challengeSha256": "c855386f09e184c143f8d91ecceb468f855ab464195dd191dc43fab46946563a",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2967",
+  "relation": "repeat",
+  "edges": 11,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "1e3d79dd143acb566334917d19676b5d9d2db8a00284ede3bbab5fdb87bc302b",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2973",
+  "relation": "decoy",
+  "edges": 6,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 15,
+  "challengeSha256": "89ae8834656fc616f90e02196e3194f56fe996c8870835ba90919745da6dbbad",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2973",
+  "relation": "shift",
+  "edges": 6,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "src/a_cart.js",
+   "src/b_profile.js"
+  ],
+  "challengeSha256": "fd3aa3f8674646dc39a44fefab71c13c44a5ba3d50cd921c91aa9d0a44a0ee99",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2973",
+  "relation": "repeat",
+  "edges": 6,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "ac3e2a2ed7e41157bedcd89db9376ab173fa8ab61652896f83843b7bee440a8e",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2974",
+  "relation": "decoy",
+  "edges": 4,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 14,
+  "challengeSha256": "861b3f189632f9f09ee4c3e260251f482fcff38d93807bf5243d433e38151ff1",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2974",
+  "relation": "shift",
+  "edges": 4,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "src/client.js",
+   "src/server.js"
+  ],
+  "challengeSha256": "f123a674afd499ab5b6b7acd69da5c32e6ad6f70738a8fdb01daf02b6c0d0640",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2974",
+  "relation": "repeat",
+  "edges": 4,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "2d46570ce196b1e3810ce4d3e29e41ba5854e68d3ffc892e38ab32f94a882165",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2975",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {},
+  "decoys": 0,
+  "notApplicable": true,
+  "reason": "no supported source call/class names",
+  "challengeSha256": "975dab35105a07d57d39063c0c53015da9e9f6ab759d4b0b7648895c8b3d9ba7",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2975",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {},
+  "shiftedFiles": [],
+  "notApplicable": true,
+  "reason": "no supported files to shift",
+  "challengeSha256": "3d5c7651fe4b6b6cbd372fdf52fbc2aa0b5726370e3589de82abee7bd748e315",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2975",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "7b3b5b167cb3d64933d555c60cdcfca236b1eea4f94e3d8152d39142a82ac793",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2976",
+  "relation": "decoy",
+  "edges": 3,
+  "diffs": {},
+  "decoys": 0,
+  "notApplicable": true,
+  "reason": "no supported source call/class names",
+  "challengeSha256": "3ac6a80e77f08c474ba3f4b8d5861d4e4194d42674b5d658c18da48ff4ddcdbf",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2976",
+  "relation": "shift",
+  "edges": 3,
+  "diffs": {},
+  "shiftedFiles": [],
+  "notApplicable": true,
+  "reason": "no supported files to shift",
+  "challengeSha256": "4f0aa829bbbd1d9d77102f5b1ea01883ad1d3f47fd14d996e333c22117f51c6f",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2976",
+  "relation": "repeat",
+  "edges": 3,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "404a0bb172ac884ed4d5942c1799fe9bcb9b4bd1e4c9afef5ce291685d73ba7a",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "j1-java-overload",
+  "relation": "decoy",
+  "edges": 4,
+  "diffs": {},
+  "decoys": 0,
+  "notApplicable": true,
+  "reason": "no supported source call/class names",
+  "challengeSha256": "37fbd957763d7f1a0df607fd9f3cc052e0b4a0c41aa2924bd145037dc976e912",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "j1-java-overload",
+  "relation": "shift",
+  "edges": 4,
+  "diffs": {},
+  "shiftedFiles": [],
+  "notApplicable": true,
+  "reason": "no supported files to shift",
+  "challengeSha256": "26b4ed9c667a9022c50bbd2259ba61253667c6152a798d5d034d1cc7ca79da7a",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "j1-java-overload",
+  "relation": "repeat",
+  "edges": 4,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "74123f6f2427e523cfac577f6cbf7b83d2d7707d435849f28ce5d24c9e689c31",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "kmp-22",
+  "relation": "decoy",
+  "edges": 4,
+  "diffs": {},
+  "decoys": 0,
+  "notApplicable": true,
+  "reason": "no supported source call/class names",
+  "challengeSha256": "6fcc4943012921d5df9433172701584de52c96cf06d10fca7136da2d1f083bf7",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "kmp-22",
+  "relation": "shift",
+  "edges": 4,
+  "diffs": {},
+  "shiftedFiles": [],
+  "notApplicable": true,
+  "reason": "no supported files to shift",
+  "challengeSha256": "0b12037175e542d14a99d28bae180753286a66ce02fda1a643c34c9e76089b4b",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "kmp-22",
+  "relation": "repeat",
+  "edges": 4,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "589f9db58e1cecb64d06736f0ec4c2189d7b22be06bce8f0c7a2bfa2537e23cb",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "m1-py-super",
+  "relation": "decoy",
+  "edges": 4,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 14,
+  "challengeSha256": "4e6e4369476acb809f896fae88a70d69abbe0db61cf30541fe1ca2db6310bcdb",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "m1-py-super",
+  "relation": "shift",
+  "edges": 4,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "base.py",
+   "child.py"
+  ],
+  "challengeSha256": "0ac2ad1fb2e4749929afaeaed870ec2d84cbe089a2c74d080e9977ca8db45db9",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "m1-py-super",
+  "relation": "repeat",
+  "edges": 4,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "7141273322faf938586c0ded1c9d922ec95c6f72ea1736ec8993e74c180c9938",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "m2-py-method-return-local",
+  "relation": "decoy",
+  "edges": 7,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 18,
+  "challengeSha256": "e0e4ec228ca9e88e4eeac5d08b4f2db02974fa664b78dd21ee1917ef396cced5",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "m2-py-method-return-local",
+  "relation": "shift",
+  "edges": 7,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "t.py"
+  ],
+  "challengeSha256": "8dd74b8d3bd89df9fd16a8abba4ac4c3bdefb76a85824fafffaedb046da54118",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "m2-py-method-return-local",
+  "relation": "repeat",
+  "edges": 7,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "38abe521ff6b4d686623334f17447a0b7764299517a51bb3dccbf563a9a932f7",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "n1-py-local-import",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 4,
+  "challengeSha256": "863754a727e10eb615f4ff640b0eac298852c613c5922d863296ea1c2d5d4883",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "n1-py-local-import",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "pkg/__init__.py",
+   "pkg/core.py",
+   "t_local_import.py"
+  ],
+  "challengeSha256": "881ab911d8416f9a3b7e33a4d2ad536931f783152b3164d10d19cec692bf3b81",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "n1-py-local-import",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "fdd5142e1817cfb5faa7c19e8e8d4f8f65911c1b5463047bc17fb8f8e0b43a36",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "n2-py-comprehension",
+  "relation": "decoy",
+  "edges": 1,
+  "diffs": {
+   "CAPTURED": [
+    "other/far.py:1 p -calls-> zz_cg_decoy/decoy_fns.py:object (exact-match)",
+    "t.py:2 comp -calls-> zz_cg_decoy/decoy_fns.py:p (exact-match)"
+   ],
+   "LOST": [
+    "t.py:2 comp -calls-> other/far.py:p (exact-match)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 6,
+  "challengeSha256": "f2c75f3d390ab53d28fe24e871d5d8d8db0512a5c28dacc08d79f96135292f70",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "n2-py-comprehension",
+  "relation": "shift",
+  "edges": 1,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "other/__init__.py",
+   "other/far.py",
+   "t.py"
+  ],
+  "challengeSha256": "b453df2db3a03a9365a7461910b6c9363b8c6f2938e651f8da824d2359f56268",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "n2-py-comprehension",
+  "relation": "repeat",
+  "edges": 1,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "02033dd71ec0431af635f5285fae8e7857ce29c9a5dd56945a52c48cd989f801",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "n3-py-enclosing-local",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "cc46d85864db41337a3383776373c1011eb152724ca2674a2e541912732d64df",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "n3-py-enclosing-local",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "other/__init__.py",
+   "other/far.py",
+   "t.py"
+  ],
+  "challengeSha256": "dbada0564c0471918f2273bf751e6f80a49c34ff341d6f3da485fc820e5accb8",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "n3-py-enclosing-local",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "86c28dc938f33a33b387914e19b9a174b22c85c1d75d5f8ef97c0ec7cd098f7f",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "n4-py-builtin",
+  "relation": "decoy",
+  "edges": 1,
+  "diffs": {
+   "CAPTURED": [
+    "t.py:2 run -calls-> zz_cg_decoy/decoy_fns.py:TimeoutError (exact-match)"
+   ],
+   "LOST": [
+    "t.py:2 run -instantiates-> other/far.py:TimeoutError (exact-match)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 5,
+  "challengeSha256": "0ba6e0635266a5694483eed8094d9be7c56781f69f41108548b709eb491e95a6",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "n4-py-builtin",
+  "relation": "shift",
+  "edges": 1,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "other/__init__.py",
+   "other/far.py",
+   "t.py"
+  ],
+  "challengeSha256": "2fdc9aaaba97965ebbe616f206d373d7777f50b51f648bd23a405cf266025b9d",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "n4-py-builtin",
+  "relation": "repeat",
+  "edges": 1,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "d7e431aaeebc1210fb6e6e56825ee64d043cd692ef9ac8e0f46bca7528278460",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "n5-ts-barrel-member",
+  "relation": "decoy",
+  "edges": 8,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 10,
+  "challengeSha256": "8566f9dc4caccd868d815bc49250bc1278c449b148516f8fc6d55299ddce0e03",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "n5-ts-barrel-member",
+  "relation": "shift",
+  "edges": 8,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "b.ts",
+   "c.ts",
+   "fx/deaf.ts",
+   "fx/index.ts",
+   "fx/mark.ts"
+  ],
+  "challengeSha256": "5ab5f7667807f7bcc54388636cad835aef0a93bd10d885c788146a7dd3141413",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "n5-ts-barrel-member",
+  "relation": "repeat",
+  "edges": 8,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "fb8fdd913b30072445724ada3ad65c4cd850519978bb9f6903f75ca8af7c4d50",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "p1",
+  "relation": "decoy",
+  "edges": 1,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "a59df48b24dfa544497393965d0ad418fb85e763ca03d6dba66582cd9d10b329",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "p1",
+  "relation": "shift",
+  "edges": 1,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "t.py"
+  ],
+  "challengeSha256": "c1e702fbeda71c7c879d7adfde8986cad206723be1efec07d333367e3ee36b3f",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "p1",
+  "relation": "repeat",
+  "edges": 1,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "3dc67957a9a5d9445990636a211e725407ea304a2d8f8f1d0c556f17d6f389c0",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "p3",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [
+    "use.py:14 size_of_made -calls-> arm.py:Arm::stat (instance-method)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 9,
+  "challengeSha256": "78c7b6103e1d2f78f88f02c6514f71be58391ce31a814b1cec2a5cc74d0c6e1f",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "p3",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "arm.py",
+   "use.py"
+  ],
+  "challengeSha256": "1f2d733591f5689c6f220a880719b690d07c6683caf42d03de1f88626cb79d03",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "p3",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "e34e7a91eae5e6e3d26644bff713094a9e73a77ab1218ca2614d92e2e5d49e9b",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "p4",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "59c253f511e0e2f252487fc0bec371be76222f151eb3c8749f19784398111fa5",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "p4",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "lab/model.py",
+   "other/features.py"
+  ],
+  "challengeSha256": "9aa9295bc6a1e960ea435427accde81b584de1d81b363d27781d2fcaf2cac1c7",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "p4",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "b2b2f73bc9e2544cc8012ea750f4abbbbef5488a3b5dc79e61cda2d175304be3",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "p5-py-stdlib-import",
+  "relation": "decoy",
+  "edges": 1,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "cee8e4c99ca97ebd33aaafcaa02fc243f642c0f5ae35abb70b4ca39d0f294ae9",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "p5-py-stdlib-import",
+  "relation": "shift",
+  "edges": 1,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "clock.py",
+   "use.py"
+  ],
+  "challengeSha256": "070294366d8d0f42d5898f2762706e1e276e4fa1ac23e7d33eb82f50202ee7a2",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "p5-py-stdlib-import",
+  "relation": "repeat",
+  "edges": 1,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "4688b072cc370cb3c32ab7b6065d1e1b5f3107b50ca0f09615ef70b0f8bb38d9",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-01-f14-object",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "29cac43dac6cd057d75e1fc7c83eff5cd68fac6e1ae76b54e39d61c4bd988c0a",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-01-f14-object",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "bf9d97062c12381067134b4279c56efffadcae1ae0bb06f81d48e2f1fdd4fae5",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-01-f14-object",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "e1c852e5f158880429530372cc64c101b43e81390c0967298a9876edcf9b9fe1",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-02-f14-class",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 9,
+  "challengeSha256": "be877ca70b8763e533d64aabdfb86b1c5f773b5af0723d27fee17c2be1df36bc",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-02-f14-class",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "3813fefb9ed95d22b966f7b7377d6af6a233411c43a2e77854aa011c7ee5a977",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-02-f14-class",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "d4328afa999e791463c2bd558ae418b1431473e40a2b04d1ce865e7e27d895b5",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-03-f14-function",
+  "relation": "decoy",
+  "edges": 3,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 10,
+  "challengeSha256": "dc5feef7e2b9e674586092f6b5c818a6449dd702e3b0ea2ce487cb803ada996d",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-03-f14-function",
+  "relation": "shift",
+  "edges": 3,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "b857133fa86245725450fb3e83c1d1b51c2380ee00460078a1d8db8a532f919d",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-03-f14-function",
+  "relation": "repeat",
+  "edges": 3,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "0356a782b9065d54c54d16cd8a90459b3a56085c8fcbc054a96132bc8d92bd6a",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-04-f15-number",
+  "relation": "decoy",
+  "edges": 3,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [
+    "use.js:1 run -calls-> decoy.js:Decoy::load (instance-method)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 7,
+  "challengeSha256": "37c838abc940fec1e7149145c266434bc6c13c1ee3433158dc4c58efde257fc3",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-04-f15-number",
+  "relation": "shift",
+  "edges": 3,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "58a6e774b2089e203c7c6796cd61167375fb40c0fbc05363e2c8fe800ebd0d56",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-04-f15-number",
+  "relation": "repeat",
+  "edges": 3,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "a9e62313a67d33a4703f6c4f11374094190634352e03fe5990160ac9f79ea043",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-05-f15-string",
+  "relation": "decoy",
+  "edges": 3,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [
+    "use.js:1 run -calls-> decoy.js:Decoy::load (instance-method)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 7,
+  "challengeSha256": "3fe629956c5301f47a176ca51675530aaa1c89d5a6f96d070d2d19802acbd7ee",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-05-f15-string",
+  "relation": "shift",
+  "edges": 3,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "8f17a1f0716ed0e7292c1df7197ccabb192fe244f7883bbdbfad699a4fd18286",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-05-f15-string",
+  "relation": "repeat",
+  "edges": 3,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "875e959478d3b7cdace46d25fce34a08c7046fdd15e9c4247d259ec091cea97d",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-06-f15-assigned-callable",
+  "relation": "decoy",
+  "edges": 4,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [
+    "use.js:1 run -calls-> decoy.js:Decoy::load (instance-method)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 9,
+  "challengeSha256": "acc636f0e70e160a2a056c9ee431502e2a046e22a57cb7e0e7e1de2e29fe7189",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-06-f15-assigned-callable",
+  "relation": "shift",
+  "edges": 4,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "e0bb0ad787b044c0edce9961348590d76ee5c818ac2b1ff5a0e70c93a9d37348",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-06-f15-assigned-callable",
+  "relation": "repeat",
+  "edges": 4,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "2aba3c2cfc277ebf653a53e8d292e16f0ac098324b41b3bad3f23a0bf909aa8b",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-07-f10-optional-wrapper",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 11,
+  "challengeSha256": "597be9860c62e834bc5e7327d93565fe38a005d88567a92b7f3610163fccbf0d",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-07-f10-optional-wrapper",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "ed9e6511f37c6dbab8fa5a85aaefdc1f5f6050f83b226bd38d4e44084c47b975",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-07-f10-optional-wrapper",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "b618652954dab8027c93a3149118fc716d5fbfc5b9bcbdcb4e223b419bc2b0a4",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-08-f11-generator-eval",
+  "relation": "decoy",
+  "edges": 3,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 12,
+  "challengeSha256": "b1797d049a36b666520a675caf07910e8dceb4e364c209326aa634e808971770",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-08-f11-generator-eval",
+  "relation": "shift",
+  "edges": 3,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "60145f490d00dd0fb4ec9f1ca5627fa066593af2947d4486cca10ad8e71320c3",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-08-f11-generator-eval",
+  "relation": "repeat",
+  "edges": 3,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "278986fcc5018bd0abe8a81fd856160863500fecdad7e5c20062ae9a543a80aa",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-09-f11-generator-key-outside-generator",
+  "relation": "decoy",
+  "edges": 3,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [
+    "use.js:1 run -calls-> decoy.js:Decoy::load (instance-method)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 11,
+  "challengeSha256": "bfd93ab2a9f0eacb47155a2e4335d2e1a5c55dd0e8f8332a50e7da1ed526d2f9",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-09-f11-generator-key-outside-generator",
+  "relation": "shift",
+  "edges": 3,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "028dfdcfe38b68ab7c97c375904d7712beed2154af93f90ecedb0e6950da0cc1",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-09-f11-generator-key-outside-generator",
+  "relation": "repeat",
+  "edges": 3,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "35bbb96f676ea2250eaa8674ceb7f22c65b2161eba0b4da63340482478b67298",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-10-f12-root-object",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 10,
+  "challengeSha256": "b278c24946b772620b6dac302bdd12667650054ead89bf6ef11224019efc4ad7",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-10-f12-root-object",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "1d115f2a9b7100cfa02542d33b3782c92945fb1094ec1262643d756787d4421b",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-10-f12-root-object",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "2a90e3f1f80d533d47551ba4137fc4e2ccd96283c49febf9dd23b15093785df3",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-11-f12-parenthesized-instance",
+  "relation": "decoy",
+  "edges": 3,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 12,
+  "challengeSha256": "ab2d58583899182b0d1f53205132f330668f1461d2dedb11be2c645ccdb0d0a1",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-11-f12-parenthesized-instance",
+  "relation": "shift",
+  "edges": 3,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "d0db1e0df99a48ca18408ad2f079b3b66b9e612a3b1c5c406a300830c055f5fe",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-11-f12-parenthesized-instance",
+  "relation": "repeat",
+  "edges": 3,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "c160e8f2912a85dff6089149480be566543bb38c208bb3927aaa7bb61f53289e",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-12-f12-logical-instance",
+  "relation": "decoy",
+  "edges": 3,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 12,
+  "challengeSha256": "223f8e0f17acafa61e47ed85eaec0ac1f36defc9caf509a9eba33cddabd8285d",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-12-f12-logical-instance",
+  "relation": "shift",
+  "edges": 3,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "2ba9ed9fc5351377ea463dcf5ede6a2e52f646b07a317b99ad01491770f72eb7",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-12-f12-logical-instance",
+  "relation": "repeat",
+  "edges": 3,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "a286aeaed867b852c8f696eb22064bc469608a3bd3b68aeb70f8bdc3eaf08e88",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-13-f13-parameter",
+  "relation": "decoy",
+  "edges": 4,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [
+    "use.js:1 run -calls-> decoy.js:Decoy::load (instance-method)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 13,
+  "challengeSha256": "17b9c518e8954f48dde99822d72cce45d5dbb47faeb827a4fab66826a72bb7f2",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-13-f13-parameter",
+  "relation": "shift",
+  "edges": 4,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "cf53bab00a2211b12c6e90ae3e1136e056681e958a180a3ea2201e7907c380a3",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-13-f13-parameter",
+  "relation": "repeat",
+  "edges": 4,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "9d50e3cbf23726408f1ab5fb1fad6a8d0c10703d198f23e43600f0014348181c",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-14-f13-arrow",
+  "relation": "decoy",
+  "edges": 4,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [
+    "use.js:1 run -calls-> decoy.js:Decoy::load (instance-method)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 13,
+  "challengeSha256": "6faeba5beacfb399bde90b23be658b7ef14e550b57d2443b668b1480c94cb00f",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-14-f13-arrow",
+  "relation": "shift",
+  "edges": 4,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "c4009ee3e5891768cc6adbd172afb2e60f325031f8f6aca12a89eb43225f3f42",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-14-f13-arrow",
+  "relation": "repeat",
+  "edges": 4,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "95a35f2916095af1de2cf2d526662f1c4e7b63b5edc2702e3a8c6c57a0f8bf36",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-15-f13-block",
+  "relation": "decoy",
+  "edges": 3,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [
+    "use.js:1 run -calls-> decoy.js:Decoy::load (instance-method)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 11,
+  "challengeSha256": "3e268f7eadbe4a411a4e66eca0a6a74e2ba381b30d3a7d74fffbe1c435d43915",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-15-f13-block",
+  "relation": "shift",
+  "edges": 3,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "1e2359fee773acf28281b0abb10a95edd201a78c516f5470b7a3b29b3ec7480e",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-15-f13-block",
+  "relation": "repeat",
+  "edges": 3,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "235af960c3304a173beff3d755e9be809859322c809a55023104ba69190a55b2",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-16-alias-property-mutation",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "19d7eb11864a854c82d99b42908ebff7dbe2890ca2aeeed7d917f04a327a9bdb",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-16-alias-property-mutation",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "503246f4fcba5cc19d071a932e96b080f9ac8f9a351b4d322981935c60c05d61",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-16-alias-property-mutation",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "644f7b21fd70614fd82dbdf334ded60909517566976d9e9efa7989ba1dcbeb58",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-17-alias-rebind",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "13098a1baee5e118249aaf055789f280b1e854b0c03c4a15aaf22663f8b08987",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-17-alias-rebind",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "a8a6915f19e26f8526d4f9e2222b9ed1995fe5459c24faa339a6b79af9ae5f1c",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-17-alias-rebind",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "70eba97dba0599b7fd47db499bf73985dff3ced6e5b93f239d9f697ee03eba92",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-18-property-overwrite",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "a8df6c7c6e8c657e03580dc6b129a494ad28a249bc468decee74f7aceb600096",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-18-property-overwrite",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "256b52741d39d04ade6b27ec51357930093916e528bb0cbcb55093d86489acc5",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-18-property-overwrite",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "05d1eba506aafe02327c1e07e3abd64e262d6172ca88cd01db74fe5c58548adf",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-19-binding-overwrite",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "760b1a4938f23988913de9fcc5be898ddfc38c2a7630cadd31fd95ead8fed58c",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-19-binding-overwrite",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "b34ca0409a60874caf1d6193c031736b2e07a52f0c38cb5f7df7fc0825312781",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-19-binding-overwrite",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "ef072765ee85c5746dcc48cf3944d5937d5f204e3be2dce22201c8ede1382ea8",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-20-post-export-write",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "de82cbea24197eaeb3d637c7ede7e741b8cb0515280c64aae830bc11b86b5d7c",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-20-post-export-write",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "7623b8d184e49da3e59d574d20acd6a34ac7ea03ec1a8b5fd177a1d79710493e",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-20-post-export-write",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "867496479c589f4b69b3defd9c8ea9d54a41fb9f09cd2787b4fed0e8bf28111e",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-21-old-exports-alias",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "72c07fdaa55dbde066e384ca884b7135601b7148534c34ce5a37a7a91ca33cca",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-21-old-exports-alias",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "ac3e46623e1588cc5d933390f1184060896cdbca51ca6fe5bce08479972b6e53",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-21-old-exports-alias",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "be2cf1bf578603cfa0ce2ea78ff51a1b6eb7f21f82cd86922f7cc9a94dc5af64",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-22-ambiguous-branch",
+  "relation": "decoy",
+  "edges": 3,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 10,
+  "challengeSha256": "561ea2bd6f3d124d5a889a2b09d514ddf84a1f78646c355d8187b9dc44bcd19a",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-22-ambiguous-branch",
+  "relation": "shift",
+  "edges": 3,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "9a665cbe3ba4a33314ec8bd601b31177429fc1434ab27130ef3b6ce3145056ad",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-22-ambiguous-branch",
+  "relation": "repeat",
+  "edges": 3,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "749d67c147026c91038e4b8554bf10eff6096c1f68434e64257099050f59aa50",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-23-agreeing-branch",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "6d672a038b638174d019e884f590bd321e69d5f0505b2f072197087e679df468",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-23-agreeing-branch",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "0a38cf42e7671c45a572ffa12ba3224100abdc5680351b118027e662630b0b47",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-23-agreeing-branch",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "1b217de943f1dbc591d6dd70e9e26307a1a7fa47cf911b8568004803ef74aff1",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-24-opaque-escape",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [
+    "m.js:2 m.js -calls-> zz_cg_decoy/decoy-fns.js:opaque (exact-match)"
+   ],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 10,
+  "challengeSha256": "068040fbad9c35ff114888eaf794ff9b42cf11a9940d31f4849df436cfd0decf",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-24-opaque-escape",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "4e4da4355359a9d8a194ae1676f738b1b5aee5a631a6f5007a6fa1563fc08a8b",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-24-opaque-escape",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "af1ee5c5984ec4b6e7e9f385b28e14dcde1e579729ff29a1e8ca46f30bb7ddaf",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-25-unknown-dynamic-key",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "e64cadb2a67a055366b536f517afcc5f9139899a8e26ffd4570bb17d820a0769",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-25-unknown-dynamic-key",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "ac3644c5ca50bc491038b965c46715acea1032db2e1227bb60c08eb9508d0462",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-25-unknown-dynamic-key",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "71a39af48952bdc6a7f3cced8ee26045cb5525d2e7bbd8cd0c08e411804b5abb",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-26-local-eval",
+  "relation": "decoy",
+  "edges": 3,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "4ba4dbfa98c444e2d23c635afba7cfeaa2fd07bb2dd97d6b5a87e58670b2970d",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-26-local-eval",
+  "relation": "shift",
+  "edges": 3,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "91471b1b7ed95c1826307576e343c0e6bc554266ea6f0d33d1b72d49558c8222",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-26-local-eval",
+  "relation": "repeat",
+  "edges": 3,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "6568e213ba5b3d9d9e38bab14c1c2fa7dbd19f9b1dd6f712cb19320add5b0ace",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-27-literal-eval",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "43dcb6d954d2d7ca77da0e382f6360f10cd8d9736f9b6144b4f4b93013372757",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-27-literal-eval",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "d7406afe6f2dae6d32308971cbc77a82282a70881073a3a96ac76a6c38ff7874",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-27-literal-eval",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "59de166a04e8b8b871b91de19e755463474101da40bd4e2d07bb1563559eee7f",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-28-eval-property-on-local-identity",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "ae026bb9d891d6e7835e7a56b2d1e2b8858671facf82cf4445782911f2687de7",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-28-eval-property-on-local-identity",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "39cc5d781ebec8eb2db7ed4b94be2405b914ae66a1af173b1030523eed7c355b",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-28-eval-property-on-local-identity",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "0d7ad16c4e6e74c8306cd6de39a68aacc4e702eadb5a84383320bbb933d728c8",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-29-uncertain-receiver-alias",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "b32f71d281ae6ca9070dce8ad40a5e9eee1ad0d98854e401c083a14b9edb3ed9",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-29-uncertain-receiver-alias",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "2b5f8d2442a00d68d758e1cf9bbd78d8b55c2bbb5947db4790321bdc21b2c539",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-29-uncertain-receiver-alias",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "ea3cc8a6904debc063e12ed3cba0f0ec9416e3ae09e28b04d03709eff7d81393",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-30-data-overwrite-after-literal-eval",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "c91d4e006c81cdc59fffd829b2b25b880a4f43fd6b4c3990d115de94a4aea5cd",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-30-data-overwrite-after-literal-eval",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "f74e7abd03d9a51ced5a28b64bf93a1c53e67b03f258bd9733b5544ca9b42691",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-30-data-overwrite-after-literal-eval",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "cfbfa20afbe306a605937087d187593fbfb94d40e2061ee0804c29f8f19e4ec9",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-31-missing-read-exported-as-undefined-data",
+  "relation": "decoy",
+  "edges": 3,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [
+    "use.js:1 run -calls-> decoy.js:Decoy::load (instance-method)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 7,
+  "challengeSha256": "d809d330757e7adaa9ccd66e2d4e173f75a92526436d77e86ec1ef8ba42d6652",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-31-missing-read-exported-as-undefined-data",
+  "relation": "shift",
+  "edges": 3,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "6a38b2474fe9bb5cda1accc21f375346e0b82b32cfa4e53fa38313dec6aeacfe",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-31-missing-read-exported-as-undefined-data",
+  "relation": "repeat",
+  "edges": 3,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "98fd5f692611fcf125381c7da4a91d8bab7d2bd2815cde6e87cda8d24e4bbc34",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-32-logical-member-initialization",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "ed9b5f1db073f0355d1987249efda00b7aeb8d72adace9eccb7164a2813adf58",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-32-logical-member-initialization",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "df3fefe59102265a61529283472fc97961b752b11657c687582c84ae86620eb7",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-32-logical-member-initialization",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "163d93fd14368c432a570aa851103aa716de164d2ec2022f907fc7e5dce0c910",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "t1-ts-global-builtin",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 13,
+  "challengeSha256": "5471fcbe384ec58f70017e954af1cb833d612f2965bd0350339a8002cb362e7a",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "t1-ts-global-builtin",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "lib/other.ts",
+   "use.ts"
+  ],
+  "challengeSha256": "f9628e6b2eed869a68171abfc114d1eff528d110f4abea4770dc9ac6eda8cfef",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "t1-ts-global-builtin",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "27ff91204c32d3545923620cf2bde3b26ace047dac416de5b15702a45b9063d0",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ }
+]
\ No newline at end of file
diff --git a/docs/handoffs/pr29-2026-11-10/harness/metamorphic-candidate.json b/docs/handoffs/pr29-2026-11-10/harness/metamorphic-candidate.json
new file mode 100644
index 0000000000..0fb34df4c5
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/harness/metamorphic-candidate.json
@@ -0,0 +1,3223 @@
+[
+ {
+  "seed": "a",
+  "relation": "decoy",
+  "edges": 4,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 5,
+  "challengeSha256": "8c804eb586ccf55b9834b3e12464b4641abb273e917b1283890b6196d6322582",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "a",
+  "relation": "shift",
+  "edges": 4,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "handler.ts",
+   "lib.ts"
+  ],
+  "challengeSha256": "ef572074d46bceae1b317fcc1252dcddae4aa1c38d72ae2e675a5b1b0004decf",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "a",
+  "relation": "repeat",
+  "edges": 4,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "23c74e58b799e92c5954773a12193b60652aea7953503e7755fe0f7b2f3fb08b",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "b",
+  "relation": "decoy",
+  "edges": 1,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [
+    "queries.ts:8 take -calls-> session.ts:Session::snapshot (instance-method)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 5,
+  "challengeSha256": "0630e262fed84f7373d1271f85deac715094084ac5674e536917032a9f5d698e",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "b",
+  "relation": "shift",
+  "edges": 1,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "queries.ts",
+   "session.ts"
+  ],
+  "challengeSha256": "a9fc526b55bffa2e07db1e7ccbe93f28e0aa57430b5df0d74bed1adc49472a9b",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "b",
+  "relation": "repeat",
+  "edges": 1,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "e62bc5451f37da2a2d83497020c5c6e544c40decec19679394a4887dadbe4f14",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "c",
+  "relation": "decoy",
+  "edges": 1,
+  "diffs": {
+   "CAPTURED": [
+    "orch.ts:5 Orchestrator::check -calls-> zz_cg_decoy/decoy-fns.ts:has (exact-match)"
+   ],
+   "LOST": [
+    "orch.ts:5 Orchestrator::check -calls-> cache.ts:Cache::has (exact-match)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 6,
+  "challengeSha256": "f9af1e114a9028ad0fdf6e0dd6d8272aedca300f0705f03412629080474326f8",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "c",
+  "relation": "shift",
+  "edges": 1,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "cache.ts",
+   "orch.ts"
+  ],
+  "challengeSha256": "f1a17e3a7a9de3e0864f44665003080ad289dbe3aaeb24ce8ecb165e3a1b8e1c",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "c",
+  "relation": "repeat",
+  "edges": 1,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "1f8f44d8ae2346657173aade2442e76b5b31b4fd8da05680aba17af27b1145ab",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "g1-go-new-receiver",
+  "relation": "decoy",
+  "edges": 9,
+  "diffs": {},
+  "decoys": 0,
+  "notApplicable": true,
+  "reason": "no supported source call/class names",
+  "challengeSha256": "e80d5f340c90ca81c9f529f75c6a385a351524cfb56675de75d82aacf79aa92c",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "g1-go-new-receiver",
+  "relation": "shift",
+  "edges": 9,
+  "diffs": {},
+  "shiftedFiles": [],
+  "notApplicable": true,
+  "reason": "no supported files to shift",
+  "challengeSha256": "ea26e8d9c6b8827dd0ad38813a22e6dfaa0796f7502b4a30c68a71fe40b8f352",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "g1-go-new-receiver",
+  "relation": "repeat",
+  "edges": 9,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "76dba48fb10798207eed5d79fdca6bf4b5eaa0682860e1ef849fa634045f56c6",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2944",
+  "relation": "decoy",
+  "edges": 5,
+  "diffs": {
+   "CAPTURED": [
+    "a.test.ts:1 a.test.ts -calls-> zz_cg_decoy/decoy-fns.ts:describe (exact-match)",
+    "a.test.ts:23 a.test.ts -calls-> zz_cg_decoy/decoy-fns.ts:it (exact-match)",
+    "a.test.ts:25 a.test.ts -calls-> zz_cg_decoy/decoy-fns.ts:describe (exact-match)",
+    "a.test.ts:27 a.test.ts -calls-> zz_cg_decoy/decoy-fns.ts:it (exact-match)"
+   ],
+   "LOST": [
+    "a.test.ts:1 a.test.ts -calls-> decl.d.ts:describe (exact-match)",
+    "a.test.ts:23 a.test.ts -calls-> decl.d.ts:it (exact-match)",
+    "a.test.ts:25 a.test.ts -calls-> decl.d.ts:describe (exact-match)",
+    "a.test.ts:27 a.test.ts -calls-> decl.d.ts:it (exact-match)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 6,
+  "challengeSha256": "d4a7e906b515d5441ba21bfb35ea4988e313b931f54233fe0b17cda7fef6e527",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2944",
+  "relation": "shift",
+  "edges": 5,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "a.test.ts",
+   "decl.d.ts"
+  ],
+  "challengeSha256": "19d80bed394c4999e4fc7923317fa9c8f5475a93e764be2351148a92b8cec28b",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2944",
+  "relation": "repeat",
+  "edges": 5,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "1567661684212f0851f4c840735640adc59c3fef433884775bf45a61f8a3a6e0",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2944-arrow",
+  "relation": "decoy",
+  "edges": 6,
+  "diffs": {
+   "CAPTURED": [
+    "a.test.ts:1 a.test.ts -calls-> zz_cg_decoy/decoy-fns.ts:describe (exact-match)",
+    "a.test.ts:23 a.test.ts -calls-> zz_cg_decoy/decoy-fns.ts:it (exact-match)",
+    "a.test.ts:25 a.test.ts -calls-> zz_cg_decoy/decoy-fns.ts:describe (exact-match)",
+    "a.test.ts:27 a.test.ts -calls-> zz_cg_decoy/decoy-fns.ts:it (exact-match)"
+   ],
+   "LOST": [
+    "a.test.ts:1 a.test.ts -calls-> decl.d.ts:describe (exact-match)",
+    "a.test.ts:23 a.test.ts -calls-> decl.d.ts:it (exact-match)",
+    "a.test.ts:25 a.test.ts -calls-> decl.d.ts:describe (exact-match)",
+    "a.test.ts:27 a.test.ts -calls-> decl.d.ts:it (exact-match)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 6,
+  "challengeSha256": "58510d6f32312e64962ecec1d943ea3e81d0e8d89f3f156c5af57394c40e7a7d",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2944-arrow",
+  "relation": "shift",
+  "edges": 6,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "a.test.ts",
+   "decl.d.ts"
+  ],
+  "challengeSha256": "02502bcbd33040a5ef40e82fa76ffa9ee9ceca5c4e1e46e1348466d908cbae7d",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2944-arrow",
+  "relation": "repeat",
+  "edges": 6,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "03baf07209e3a2bb37e10affb6d379609adc91442b4393a786cdb96d21ab5a2b",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2944-verbatim",
+  "relation": "decoy",
+  "edges": 6,
+  "diffs": {
+   "CAPTURED": [
+    "a.test.ts:1 a.test.ts -calls-> zz_cg_decoy/decoy-fns.ts:describe (exact-match)",
+    "a.test.ts:23 a.test.ts -calls-> zz_cg_decoy/decoy-fns.ts:it (exact-match)",
+    "a.test.ts:25 a.test.ts -calls-> zz_cg_decoy/decoy-fns.ts:describe (exact-match)",
+    "a.test.ts:27 a.test.ts -calls-> zz_cg_decoy/decoy-fns.ts:it (exact-match)"
+   ],
+   "LOST": [
+    "a.test.ts:1 a.test.ts -calls-> decl.d.ts:describe (exact-match)",
+    "a.test.ts:23 a.test.ts -calls-> decl.d.ts:it (exact-match)",
+    "a.test.ts:25 a.test.ts -calls-> decl.d.ts:describe (exact-match)",
+    "a.test.ts:27 a.test.ts -calls-> decl.d.ts:it (exact-match)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 6,
+  "challengeSha256": "39ad0a6dade9823b712df049144cdfe3ba7f9e40d2cbd02aa3b62f16d6bf9bfa",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2944-verbatim",
+  "relation": "shift",
+  "edges": 6,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "a.test.ts",
+   "decl.d.ts"
+  ],
+  "challengeSha256": "ebecff07883134a22106ec41bf410f59ac0fea9f2723091f4b2a0b665386cf2c",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2944-verbatim",
+  "relation": "repeat",
+  "edges": 6,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "4c2a691f2b65b7cb48f5d177a28cec4d030336c78b406f9353e0b483f91bb06c",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2946",
+  "relation": "decoy",
+  "edges": 13,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 18,
+  "challengeSha256": "3cdb37b49b8af6537ba0fd5f3070392a6e4f2e3eed05fba17695f5c9b2df837e",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2946",
+  "relation": "shift",
+  "edges": 13,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "db.ts",
+   "use.ts",
+   "writer.ts"
+  ],
+  "challengeSha256": "92cb8575936110478738fde0458178992253d3dc554875f498b05324e1ac809d",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2946",
+  "relation": "repeat",
+  "edges": 13,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "31c403ad778521ce51ad30d75dc5043593f73a63d860d3b604d9358119b8e560",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2947",
+  "relation": "decoy",
+  "edges": 4,
+  "diffs": {
+   "CAPTURED": [
+    "use.ts:1 use.ts -imports-> zz_cg_decoy/decoy-fns.ts:createRoot (exact-match)",
+    "use.ts:4 a -calls-> zz_cg_decoy/decoy-fns.ts:createRoot (exact-match)"
+   ],
+   "LOST": [
+    "use.ts:4 a -calls-> app.ts:App::render (instance-method)",
+    "use.ts:5 b -calls-> app.ts:App::close (instance-method)",
+    "use.ts:6 c -calls-> app.ts:App::close (instance-method)",
+    "use.ts:7 d -calls-> app.ts:App::translate (instance-method)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 23,
+  "challengeSha256": "42ba3b0da1eec27de381feaa294bd93da495a0ded651a4daadaf03f8991f7a47",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2947",
+  "relation": "shift",
+  "edges": 4,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "app.ts",
+   "use.ts"
+  ],
+  "challengeSha256": "50b62e871841fb48123b9780d6da1f955f401e8b232cb0791a9ff1121e3a698d",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2947",
+  "relation": "repeat",
+  "edges": 4,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "d6f80a444a1ed09e8191b046bc8fc42707d1c672b02a4adc9c0e72167c587e69",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2948",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [
+    "use.ts:3 Scene::a -calls-> zz_cg_decoy/decoy-fns.ts:push (exact-match)",
+    "use.ts:4 Scene::b -calls-> zz_cg_decoy/decoy-fns.ts:includes (exact-match)"
+   ],
+   "LOST": [
+    "use.ts:3 Scene::a -calls-> heap.ts:BinaryHeap::push (exact-match)",
+    "use.ts:4 Scene::b -calls-> heap.ts:Conf::includes (exact-match)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 16,
+  "challengeSha256": "996e0dd677d062bea5d03aacf7f6150d7978d61e24a664687d14072093f468e2",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2948",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "heap.ts",
+   "use.ts"
+  ],
+  "challengeSha256": "ac2d2fb3508a8deb548d7e5817df7a309fb577913cd77ff32ce54f4fa74caccc",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2948",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "b53b3852325f76dd08ca3c2a1d2b1c4a19530081bc32e5da1b83b1c426af28fd",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2949",
+  "relation": "decoy",
+  "edges": 7,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 14,
+  "challengeSha256": "798bef1c4bf087b9cf02807fa4dcf69f2eb3878f09474ca5b84258d75db73816",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2949",
+  "relation": "shift",
+  "edges": 7,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "lib.ts",
+   "use.ts"
+  ],
+  "challengeSha256": "8f315f61302a6e4db79bafbd7f26f9bc9c53ec030ece448c9565669648731da8",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2949",
+  "relation": "repeat",
+  "edges": 7,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "c170ba769ddfbdda7e5f80b619e26e8b76ba192324f48635d0460892d57a03f1",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2949-pkg",
+  "relation": "decoy",
+  "edges": 6,
+  "diffs": {
+   "CAPTURED": [
+    "use.ts:1 use.ts -imports-> zz_cg_decoy/decoy-fns.ts:skipString (exact-match)"
+   ],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 14,
+  "challengeSha256": "b320d56aad93ec44df87387c0b3e132b88daf414cb57b659985d01d8c1505527",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2949-pkg",
+  "relation": "shift",
+  "edges": 6,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "use.ts"
+  ],
+  "challengeSha256": "3f119fcfad7a8ea1ece1e05f40f99332ff0e2e44d9e0865d728893b058d38a0c",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2949-pkg",
+  "relation": "repeat",
+  "edges": 6,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "711eab9cfcb68343a534cc41ce1d1d2b6cfed8875f4b7ba6517f644e806cb116",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2951",
+  "relation": "decoy",
+  "edges": 16,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [
+    "a.ts:2 useA -calls-> schemas.ts:ZodString::ipv4 (instance-method)",
+    "c.ts:2 useC -calls-> schemas.ts:ZodString::ipv4 (instance-method)",
+    "d.ts:2 useD -calls-> schemas.ts:ZodString::ipv4 (instance-method)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 10,
+  "challengeSha256": "fb4b88b43e33d2ff1c7a6c51d62da3b6d79ba1593adea46968e9e7dd63d24601",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2951",
+  "relation": "shift",
+  "edges": 16,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "a.ts",
+   "b.ts",
+   "c.ts",
+   "d.ts",
+   "external.ts",
+   "index.ts",
+   "index2.ts",
+   "index3.ts",
+   "schemas.ts"
+  ],
+  "challengeSha256": "0b577fb910a14d0a8788a073bc978c2d259a43cb2a4a7fb5857bb0c55fbee932",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2951",
+  "relation": "repeat",
+  "edges": 16,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "8cc78053c6aebc40472c53955c2f62e6c446dc32531af6bf38856249422c473d",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2952",
+  "relation": "decoy",
+  "edges": 5,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 14,
+  "challengeSha256": "982a1391db6e154f2b43b03e3be7d960d963897e64b1fed523070bc51bcf812d",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2952",
+  "relation": "shift",
+  "edges": 5,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "lib/utils.js",
+   "test/utils.js"
+  ],
+  "challengeSha256": "8fda9afb8e1e51a6a4aa1b7daeb08707708fc848abf9fd08cd8131f17f442913",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2952",
+  "relation": "repeat",
+  "edges": 5,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "3a59f7547e89908d3a227a87da5ceb84eb96ad7c0e3055bb65cae77143a55fd7",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2953",
+  "relation": "decoy",
+  "edges": 16,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [
+    "app.ts:16 handlerS -calls-> streaming.ts:StreamApi::onAbort (instance-method)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 52,
+  "challengeSha256": "f009f0705d7cbf2b498f89920d146883f58cd27845610205a1cc707f62b41c32",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2953",
+  "relation": "shift",
+  "edges": 16,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "app.ts",
+   "cjsapp.js",
+   "lib/reply.js",
+   "streaming.ts"
+  ],
+  "challengeSha256": "518a181a60309254fb70c95e31e0d3929dceaaa524d6716af08b1679d8673b9e",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2953",
+  "relation": "repeat",
+  "edges": 16,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "fdf0a998bbc9db293ff0e1b9f437438c5c6c7991aac2a06042b632502504d21e",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2954",
+  "relation": "decoy",
+  "edges": 7,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 11,
+  "challengeSha256": "8403c64e458ea0a2b6e7cfcc17438174ae192677144de668408b2d2c44e85f5e",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2954",
+  "relation": "shift",
+  "edges": 7,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "lib.ts",
+   "tools.ts"
+  ],
+  "challengeSha256": "1e9a93fe5d348d8ad8cbbe8ab8cee290c3f8526ebb62b3d64ab68a46c1197080",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2954",
+  "relation": "repeat",
+  "edges": 7,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "77c3fbfcbbab91adcf0b2183b9a503eb1ee811f1aeb88235663b587f5d5d7a12",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2957",
+  "relation": "decoy",
+  "edges": 13,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 14,
+  "challengeSha256": "9a3954b224013c8c2d224bca1f2d46f0363b825e2668715e89560c0ca2705db4",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2957",
+  "relation": "shift",
+  "edges": 13,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "pkg/__init__.py",
+   "pkg/_client.py",
+   "use.py"
+  ],
+  "challengeSha256": "7b5c48b9a1ac4175512e43f27eeb74a21fb314f88a69299ff731de8d7d57590c",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2957",
+  "relation": "repeat",
+  "edges": 13,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "e23035fc96c4f6429f742f690be5994664a56674e7126dfdcf75fffe65ccb36e",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2958",
+  "relation": "decoy",
+  "edges": 1,
+  "diffs": {
+   "CAPTURED": [
+    "examples/factory.py:2 create_app -calls-> zz_cg_decoy/decoy_fns.py:object (exact-match)"
+   ],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 7,
+  "challengeSha256": "aa25e39221a4ac7b52420ca376bc8eb70041066f29f201fd95ce93d3613e5ae0",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2958",
+  "relation": "shift",
+  "edges": 1,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "examples/factory.py",
+   "pkg/cli.py"
+  ],
+  "challengeSha256": "2be896c898e7443762c3999270265beb6fa871305963331ec763219788162452",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2958",
+  "relation": "repeat",
+  "edges": 1,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "2d7a0357b706a5f7fe49e5150865be9380654c69e5e47764b7c058727ced0d27",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2962",
+  "relation": "decoy",
+  "edges": 3,
+  "diffs": {
+   "CAPTURED": [
+    "use.tsx:1 use.tsx -imports-> zz_cg_decoy/decoy-fns.ts:useForm (exact-match)",
+    "use.tsx:3 objSpread -calls-> zz_cg_decoy/decoy-fns.ts:useForm (exact-match)",
+    "use.tsx:8 jsxSpread -calls-> zz_cg_decoy/decoy-fns.ts:useForm (exact-match)",
+    "use.tsx:12 jsxSpreadNested -calls-> zz_cg_decoy/decoy-fns.ts:useForm (exact-match)",
+    "use.tsx:16 controls -calls-> zz_cg_decoy/decoy-fns.ts:useForm (exact-match)",
+    "use.tsx:18 controls -calls-> zz_cg_decoy/decoy-fns.ts:useForm (exact-match)",
+    "use.tsx:20 controls -calls-> zz_cg_decoy/decoy-fns.ts:useForm (exact-match)",
+    "use.tsx:22 controls -calls-> zz_cg_decoy/decoy-fns.ts:useForm (exact-match)"
+   ],
+   "LOST": [
+    "use.tsx:4 objSpread -calls-> auth.ts:register (exact-match)",
+    "use.tsx:9 jsxSpread -calls-> auth.ts:register (exact-match)",
+    "use.tsx:13 jsxSpreadNested -calls-> auth.ts:register (exact-match)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 18,
+  "challengeSha256": "ed3f2ecaa88c40f0a7cdb89cb431f2b1a845d1664ba318785ca71bb68137f054",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2962",
+  "relation": "shift",
+  "edges": 3,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "auth.ts",
+   "use.tsx"
+  ],
+  "challengeSha256": "426b02a8b2a5cc6649e5e8e8be2b10d317e39cf1e0284b7fd23505cf0067d5dd",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2962",
+  "relation": "repeat",
+  "edges": 3,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "793a141de5d88361744a7ebcd15726af028ede594d3e6439276e13aed88f1bdf",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2963",
+  "relation": "decoy",
+  "edges": 12,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 11,
+  "challengeSha256": "f30e9716975268ec8d99bf507df687bafbbde9a4378b63813c37a9e5e4cb82c2",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2963",
+  "relation": "shift",
+  "edges": 12,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "pkg/__init__.py",
+   "pkg/deco.py",
+   "use.py"
+  ],
+  "challengeSha256": "a3b6af93f14bc251eb28b9c96e52f02cbfbc98e1413d322d8ad1b7fbc567e60b",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2963",
+  "relation": "repeat",
+  "edges": 12,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "6c577c5aeeaadb8933094f44548f5b67ef10d36ca84c535606995718fc85c525",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2964",
+  "relation": "decoy",
+  "edges": 14,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 20,
+  "challengeSha256": "97e1c347e0318d432feee1d17fc6fe48947b1ab7aa9a04caec199f91ac61475e",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2964",
+  "relation": "shift",
+  "edges": 14,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "b.js",
+   "lib/index.js",
+   "lib/inner/entry.js",
+   "srv.js",
+   "test/a.test.js"
+  ],
+  "challengeSha256": "beb3f2f76327af0c718d446f467825f08463fe8f8be6219e174c6c84f26fee95",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2964",
+  "relation": "repeat",
+  "edges": 14,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "21f8cefe8ab94ecaa92f6accdb88abb328fc77b5ab33106edc0fe31df52106dc",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2966",
+  "relation": "decoy",
+  "edges": 12,
+  "diffs": {
+   "CAPTURED": [
+    "lib/reply.js:3 lib/reply.js -calls-> zz_cg_decoy/decoy-fns.js:getHeader (exact-match)"
+   ],
+   "LOST": [
+    "lib/model.js:3 init -calls-> lib/other.js:Cast::insertMany (instance-method)",
+    "lib/reply.js:3 lib/reply.js -calls-> lib/types.d.ts:FastifyReply::getHeader (exact-match)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 52,
+  "challengeSha256": "e5ef350885b5a6bc27e2774c2dd34e082cde5dff993fa23b98afaf3afde644be",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2966",
+  "relation": "shift",
+  "edges": 12,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "lib/application.js",
+   "lib/context.js",
+   "lib/hooks.js",
+   "lib/model.js",
+   "lib/other.js",
+   "lib/reply.js",
+   "lib/types.d.ts",
+   "lib/validation.js",
+   "test/model.test.js"
+  ],
+  "challengeSha256": "01e6001b79229b8fd58c0268316cd2d9e3c6cc299e24bbe6101f1ce23eafb8b1",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2966",
+  "relation": "repeat",
+  "edges": 12,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "3baf1e85f5ea2326fe20361475e20b4c0c93f930a14e0f1a44f81a80e39e8593",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2967",
+  "relation": "decoy",
+  "edges": 11,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 44,
+  "challengeSha256": "e9ad32cc634bd5a98409a44610206ddb63a590318fe92bd605b58c5b3cde4dec",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2967",
+  "relation": "shift",
+  "edges": 11,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "mod.js",
+   "mod.ts",
+   "page.tsx",
+   "use.js",
+   "use.ts",
+   "use.tsx"
+  ],
+  "challengeSha256": "c855386f09e184c143f8d91ecceb468f855ab464195dd191dc43fab46946563a",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2967",
+  "relation": "repeat",
+  "edges": 11,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "1e3d79dd143acb566334917d19676b5d9d2db8a00284ede3bbab5fdb87bc302b",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2973",
+  "relation": "decoy",
+  "edges": 6,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 15,
+  "challengeSha256": "89ae8834656fc616f90e02196e3194f56fe996c8870835ba90919745da6dbbad",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2973",
+  "relation": "shift",
+  "edges": 6,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "src/a_cart.js",
+   "src/b_profile.js"
+  ],
+  "challengeSha256": "fd3aa3f8674646dc39a44fefab71c13c44a5ba3d50cd921c91aa9d0a44a0ee99",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2973",
+  "relation": "repeat",
+  "edges": 6,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "ac3e2a2ed7e41157bedcd89db9376ab173fa8ab61652896f83843b7bee440a8e",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2974",
+  "relation": "decoy",
+  "edges": 4,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 14,
+  "challengeSha256": "861b3f189632f9f09ee4c3e260251f482fcff38d93807bf5243d433e38151ff1",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2974",
+  "relation": "shift",
+  "edges": 4,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "src/client.js",
+   "src/server.js"
+  ],
+  "challengeSha256": "f123a674afd499ab5b6b7acd69da5c32e6ad6f70738a8fdb01daf02b6c0d0640",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2974",
+  "relation": "repeat",
+  "edges": 4,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "2d46570ce196b1e3810ce4d3e29e41ba5854e68d3ffc892e38ab32f94a882165",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2975",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {},
+  "decoys": 0,
+  "notApplicable": true,
+  "reason": "no supported source call/class names",
+  "challengeSha256": "975dab35105a07d57d39063c0c53015da9e9f6ab759d4b0b7648895c8b3d9ba7",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2975",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {},
+  "shiftedFiles": [],
+  "notApplicable": true,
+  "reason": "no supported files to shift",
+  "challengeSha256": "3d5c7651fe4b6b6cbd372fdf52fbc2aa0b5726370e3589de82abee7bd748e315",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2975",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "7b3b5b167cb3d64933d555c60cdcfca236b1eea4f94e3d8152d39142a82ac793",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2976",
+  "relation": "decoy",
+  "edges": 3,
+  "diffs": {},
+  "decoys": 0,
+  "notApplicable": true,
+  "reason": "no supported source call/class names",
+  "challengeSha256": "3ac6a80e77f08c474ba3f4b8d5861d4e4194d42674b5d658c18da48ff4ddcdbf",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2976",
+  "relation": "shift",
+  "edges": 3,
+  "diffs": {},
+  "shiftedFiles": [],
+  "notApplicable": true,
+  "reason": "no supported files to shift",
+  "challengeSha256": "4f0aa829bbbd1d9d77102f5b1ea01883ad1d3f47fd14d996e333c22117f51c6f",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "issue-2976",
+  "relation": "repeat",
+  "edges": 3,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "404a0bb172ac884ed4d5942c1799fe9bcb9b4bd1e4c9afef5ce291685d73ba7a",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "j1-java-overload",
+  "relation": "decoy",
+  "edges": 4,
+  "diffs": {},
+  "decoys": 0,
+  "notApplicable": true,
+  "reason": "no supported source call/class names",
+  "challengeSha256": "37fbd957763d7f1a0df607fd9f3cc052e0b4a0c41aa2924bd145037dc976e912",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "j1-java-overload",
+  "relation": "shift",
+  "edges": 4,
+  "diffs": {},
+  "shiftedFiles": [],
+  "notApplicable": true,
+  "reason": "no supported files to shift",
+  "challengeSha256": "26b4ed9c667a9022c50bbd2259ba61253667c6152a798d5d034d1cc7ca79da7a",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "j1-java-overload",
+  "relation": "repeat",
+  "edges": 4,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "74123f6f2427e523cfac577f6cbf7b83d2d7707d435849f28ce5d24c9e689c31",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "kmp-22",
+  "relation": "decoy",
+  "edges": 4,
+  "diffs": {},
+  "decoys": 0,
+  "notApplicable": true,
+  "reason": "no supported source call/class names",
+  "challengeSha256": "6fcc4943012921d5df9433172701584de52c96cf06d10fca7136da2d1f083bf7",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "kmp-22",
+  "relation": "shift",
+  "edges": 4,
+  "diffs": {},
+  "shiftedFiles": [],
+  "notApplicable": true,
+  "reason": "no supported files to shift",
+  "challengeSha256": "0b12037175e542d14a99d28bae180753286a66ce02fda1a643c34c9e76089b4b",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "kmp-22",
+  "relation": "repeat",
+  "edges": 4,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "589f9db58e1cecb64d06736f0ec4c2189d7b22be06bce8f0c7a2bfa2537e23cb",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "m1-py-super",
+  "relation": "decoy",
+  "edges": 4,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 14,
+  "challengeSha256": "4e6e4369476acb809f896fae88a70d69abbe0db61cf30541fe1ca2db6310bcdb",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "m1-py-super",
+  "relation": "shift",
+  "edges": 4,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "base.py",
+   "child.py"
+  ],
+  "challengeSha256": "0ac2ad1fb2e4749929afaeaed870ec2d84cbe089a2c74d080e9977ca8db45db9",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "m1-py-super",
+  "relation": "repeat",
+  "edges": 4,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "7141273322faf938586c0ded1c9d922ec95c6f72ea1736ec8993e74c180c9938",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "m2-py-method-return-local",
+  "relation": "decoy",
+  "edges": 7,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 18,
+  "challengeSha256": "e0e4ec228ca9e88e4eeac5d08b4f2db02974fa664b78dd21ee1917ef396cced5",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "m2-py-method-return-local",
+  "relation": "shift",
+  "edges": 7,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "t.py"
+  ],
+  "challengeSha256": "8dd74b8d3bd89df9fd16a8abba4ac4c3bdefb76a85824fafffaedb046da54118",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "m2-py-method-return-local",
+  "relation": "repeat",
+  "edges": 7,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "38abe521ff6b4d686623334f17447a0b7764299517a51bb3dccbf563a9a932f7",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "n1-py-local-import",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 4,
+  "challengeSha256": "863754a727e10eb615f4ff640b0eac298852c613c5922d863296ea1c2d5d4883",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "n1-py-local-import",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "pkg/__init__.py",
+   "pkg/core.py",
+   "t_local_import.py"
+  ],
+  "challengeSha256": "881ab911d8416f9a3b7e33a4d2ad536931f783152b3164d10d19cec692bf3b81",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "n1-py-local-import",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "fdd5142e1817cfb5faa7c19e8e8d4f8f65911c1b5463047bc17fb8f8e0b43a36",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "n2-py-comprehension",
+  "relation": "decoy",
+  "edges": 1,
+  "diffs": {
+   "CAPTURED": [
+    "other/far.py:1 p -calls-> zz_cg_decoy/decoy_fns.py:object (exact-match)",
+    "t.py:2 comp -calls-> zz_cg_decoy/decoy_fns.py:p (exact-match)"
+   ],
+   "LOST": [
+    "t.py:2 comp -calls-> other/far.py:p (exact-match)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 6,
+  "challengeSha256": "f2c75f3d390ab53d28fe24e871d5d8d8db0512a5c28dacc08d79f96135292f70",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "n2-py-comprehension",
+  "relation": "shift",
+  "edges": 1,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "other/__init__.py",
+   "other/far.py",
+   "t.py"
+  ],
+  "challengeSha256": "b453df2db3a03a9365a7461910b6c9363b8c6f2938e651f8da824d2359f56268",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "n2-py-comprehension",
+  "relation": "repeat",
+  "edges": 1,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "02033dd71ec0431af635f5285fae8e7857ce29c9a5dd56945a52c48cd989f801",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "n3-py-enclosing-local",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "cc46d85864db41337a3383776373c1011eb152724ca2674a2e541912732d64df",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "n3-py-enclosing-local",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "other/__init__.py",
+   "other/far.py",
+   "t.py"
+  ],
+  "challengeSha256": "dbada0564c0471918f2273bf751e6f80a49c34ff341d6f3da485fc820e5accb8",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "n3-py-enclosing-local",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "86c28dc938f33a33b387914e19b9a174b22c85c1d75d5f8ef97c0ec7cd098f7f",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "n4-py-builtin",
+  "relation": "decoy",
+  "edges": 1,
+  "diffs": {
+   "CAPTURED": [
+    "t.py:2 run -calls-> zz_cg_decoy/decoy_fns.py:TimeoutError (exact-match)"
+   ],
+   "LOST": [
+    "t.py:2 run -instantiates-> other/far.py:TimeoutError (exact-match)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 5,
+  "challengeSha256": "0ba6e0635266a5694483eed8094d9be7c56781f69f41108548b709eb491e95a6",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "n4-py-builtin",
+  "relation": "shift",
+  "edges": 1,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "other/__init__.py",
+   "other/far.py",
+   "t.py"
+  ],
+  "challengeSha256": "2fdc9aaaba97965ebbe616f206d373d7777f50b51f648bd23a405cf266025b9d",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "n4-py-builtin",
+  "relation": "repeat",
+  "edges": 1,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "d7e431aaeebc1210fb6e6e56825ee64d043cd692ef9ac8e0f46bca7528278460",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "n5-ts-barrel-member",
+  "relation": "decoy",
+  "edges": 8,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 10,
+  "challengeSha256": "8566f9dc4caccd868d815bc49250bc1278c449b148516f8fc6d55299ddce0e03",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "n5-ts-barrel-member",
+  "relation": "shift",
+  "edges": 8,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "b.ts",
+   "c.ts",
+   "fx/deaf.ts",
+   "fx/index.ts",
+   "fx/mark.ts"
+  ],
+  "challengeSha256": "5ab5f7667807f7bcc54388636cad835aef0a93bd10d885c788146a7dd3141413",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "n5-ts-barrel-member",
+  "relation": "repeat",
+  "edges": 8,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "fb8fdd913b30072445724ada3ad65c4cd850519978bb9f6903f75ca8af7c4d50",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "p1",
+  "relation": "decoy",
+  "edges": 1,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "a59df48b24dfa544497393965d0ad418fb85e763ca03d6dba66582cd9d10b329",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "p1",
+  "relation": "shift",
+  "edges": 1,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "t.py"
+  ],
+  "challengeSha256": "c1e702fbeda71c7c879d7adfde8986cad206723be1efec07d333367e3ee36b3f",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "p1",
+  "relation": "repeat",
+  "edges": 1,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "3dc67957a9a5d9445990636a211e725407ea304a2d8f8f1d0c556f17d6f389c0",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "p3",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [
+    "use.py:14 size_of_made -calls-> arm.py:Arm::stat (instance-method)"
+   ],
+   "GAINED": []
+  },
+  "decoys": 9,
+  "challengeSha256": "78c7b6103e1d2f78f88f02c6514f71be58391ce31a814b1cec2a5cc74d0c6e1f",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "p3",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "arm.py",
+   "use.py"
+  ],
+  "challengeSha256": "1f2d733591f5689c6f220a880719b690d07c6683caf42d03de1f88626cb79d03",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "p3",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "e34e7a91eae5e6e3d26644bff713094a9e73a77ab1218ca2614d92e2e5d49e9b",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "p4",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "59c253f511e0e2f252487fc0bec371be76222f151eb3c8749f19784398111fa5",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "p4",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "lab/model.py",
+   "other/features.py"
+  ],
+  "challengeSha256": "9aa9295bc6a1e960ea435427accde81b584de1d81b363d27781d2fcaf2cac1c7",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "p4",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "b2b2f73bc9e2544cc8012ea750f4abbbbef5488a3b5dc79e61cda2d175304be3",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "p5-py-stdlib-import",
+  "relation": "decoy",
+  "edges": 1,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "cee8e4c99ca97ebd33aaafcaa02fc243f642c0f5ae35abb70b4ca39d0f294ae9",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "p5-py-stdlib-import",
+  "relation": "shift",
+  "edges": 1,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "clock.py",
+   "use.py"
+  ],
+  "challengeSha256": "070294366d8d0f42d5898f2762706e1e276e4fa1ac23e7d33eb82f50202ee7a2",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "p5-py-stdlib-import",
+  "relation": "repeat",
+  "edges": 1,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "4688b072cc370cb3c32ab7b6065d1e1b5f3107b50ca0f09615ef70b0f8bb38d9",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-01-f14-object",
+  "relation": "decoy",
+  "edges": 3,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "29cac43dac6cd057d75e1fc7c83eff5cd68fac6e1ae76b54e39d61c4bd988c0a",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-01-f14-object",
+  "relation": "shift",
+  "edges": 3,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "bf9d97062c12381067134b4279c56efffadcae1ae0bb06f81d48e2f1fdd4fae5",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-01-f14-object",
+  "relation": "repeat",
+  "edges": 3,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "e1c852e5f158880429530372cc64c101b43e81390c0967298a9876edcf9b9fe1",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-02-f14-class",
+  "relation": "decoy",
+  "edges": 3,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 9,
+  "challengeSha256": "be877ca70b8763e533d64aabdfb86b1c5f773b5af0723d27fee17c2be1df36bc",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-02-f14-class",
+  "relation": "shift",
+  "edges": 3,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "3813fefb9ed95d22b966f7b7377d6af6a233411c43a2e77854aa011c7ee5a977",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-02-f14-class",
+  "relation": "repeat",
+  "edges": 3,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "d4328afa999e791463c2bd558ae418b1431473e40a2b04d1ce865e7e27d895b5",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-03-f14-function",
+  "relation": "decoy",
+  "edges": 4,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 10,
+  "challengeSha256": "dc5feef7e2b9e674586092f6b5c818a6449dd702e3b0ea2ce487cb803ada996d",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-03-f14-function",
+  "relation": "shift",
+  "edges": 4,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "b857133fa86245725450fb3e83c1d1b51c2380ee00460078a1d8db8a532f919d",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-03-f14-function",
+  "relation": "repeat",
+  "edges": 4,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "0356a782b9065d54c54d16cd8a90459b3a56085c8fcbc054a96132bc8d92bd6a",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-04-f15-number",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 7,
+  "challengeSha256": "37c838abc940fec1e7149145c266434bc6c13c1ee3433158dc4c58efde257fc3",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-04-f15-number",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "58a6e774b2089e203c7c6796cd61167375fb40c0fbc05363e2c8fe800ebd0d56",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-04-f15-number",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "a9e62313a67d33a4703f6c4f11374094190634352e03fe5990160ac9f79ea043",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-05-f15-string",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 7,
+  "challengeSha256": "3fe629956c5301f47a176ca51675530aaa1c89d5a6f96d070d2d19802acbd7ee",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-05-f15-string",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "8f17a1f0716ed0e7292c1df7197ccabb192fe244f7883bbdbfad699a4fd18286",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-05-f15-string",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "875e959478d3b7cdace46d25fce34a08c7046fdd15e9c4247d259ec091cea97d",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-06-f15-assigned-callable",
+  "relation": "decoy",
+  "edges": 4,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 9,
+  "challengeSha256": "acc636f0e70e160a2a056c9ee431502e2a046e22a57cb7e0e7e1de2e29fe7189",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-06-f15-assigned-callable",
+  "relation": "shift",
+  "edges": 4,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "e0bb0ad787b044c0edce9961348590d76ee5c818ac2b1ff5a0e70c93a9d37348",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-06-f15-assigned-callable",
+  "relation": "repeat",
+  "edges": 4,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "2aba3c2cfc277ebf653a53e8d292e16f0ac098324b41b3bad3f23a0bf909aa8b",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-07-f10-optional-wrapper",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 11,
+  "challengeSha256": "597be9860c62e834bc5e7327d93565fe38a005d88567a92b7f3610163fccbf0d",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-07-f10-optional-wrapper",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "ed9e6511f37c6dbab8fa5a85aaefdc1f5f6050f83b226bd38d4e44084c47b975",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-07-f10-optional-wrapper",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "b618652954dab8027c93a3149118fc716d5fbfc5b9bcbdcb4e223b419bc2b0a4",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-08-f11-generator-eval",
+  "relation": "decoy",
+  "edges": 4,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 12,
+  "challengeSha256": "b1797d049a36b666520a675caf07910e8dceb4e364c209326aa634e808971770",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-08-f11-generator-eval",
+  "relation": "shift",
+  "edges": 4,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "60145f490d00dd0fb4ec9f1ca5627fa066593af2947d4486cca10ad8e71320c3",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-08-f11-generator-eval",
+  "relation": "repeat",
+  "edges": 4,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "278986fcc5018bd0abe8a81fd856160863500fecdad7e5c20062ae9a543a80aa",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-09-f11-generator-key-outside-generator",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 11,
+  "challengeSha256": "bfd93ab2a9f0eacb47155a2e4335d2e1a5c55dd0e8f8332a50e7da1ed526d2f9",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-09-f11-generator-key-outside-generator",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "028dfdcfe38b68ab7c97c375904d7712beed2154af93f90ecedb0e6950da0cc1",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-09-f11-generator-key-outside-generator",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "35bbb96f676ea2250eaa8674ceb7f22c65b2161eba0b4da63340482478b67298",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-10-f12-root-object",
+  "relation": "decoy",
+  "edges": 3,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 10,
+  "challengeSha256": "b278c24946b772620b6dac302bdd12667650054ead89bf6ef11224019efc4ad7",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-10-f12-root-object",
+  "relation": "shift",
+  "edges": 3,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "1d115f2a9b7100cfa02542d33b3782c92945fb1094ec1262643d756787d4421b",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-10-f12-root-object",
+  "relation": "repeat",
+  "edges": 3,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "2a90e3f1f80d533d47551ba4137fc4e2ccd96283c49febf9dd23b15093785df3",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-11-f12-parenthesized-instance",
+  "relation": "decoy",
+  "edges": 4,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 12,
+  "challengeSha256": "ab2d58583899182b0d1f53205132f330668f1461d2dedb11be2c645ccdb0d0a1",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-11-f12-parenthesized-instance",
+  "relation": "shift",
+  "edges": 4,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "d0db1e0df99a48ca18408ad2f079b3b66b9e612a3b1c5c406a300830c055f5fe",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-11-f12-parenthesized-instance",
+  "relation": "repeat",
+  "edges": 4,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "c160e8f2912a85dff6089149480be566543bb38c208bb3927aaa7bb61f53289e",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-12-f12-logical-instance",
+  "relation": "decoy",
+  "edges": 4,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 12,
+  "challengeSha256": "223f8e0f17acafa61e47ed85eaec0ac1f36defc9caf509a9eba33cddabd8285d",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-12-f12-logical-instance",
+  "relation": "shift",
+  "edges": 4,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "2ba9ed9fc5351377ea463dcf5ede6a2e52f646b07a317b99ad01491770f72eb7",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-12-f12-logical-instance",
+  "relation": "repeat",
+  "edges": 4,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "a286aeaed867b852c8f696eb22064bc469608a3bd3b68aeb70f8bdc3eaf08e88",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-13-f13-parameter",
+  "relation": "decoy",
+  "edges": 3,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 13,
+  "challengeSha256": "17b9c518e8954f48dde99822d72cce45d5dbb47faeb827a4fab66826a72bb7f2",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-13-f13-parameter",
+  "relation": "shift",
+  "edges": 3,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "cf53bab00a2211b12c6e90ae3e1136e056681e958a180a3ea2201e7907c380a3",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-13-f13-parameter",
+  "relation": "repeat",
+  "edges": 3,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "9d50e3cbf23726408f1ab5fb1fad6a8d0c10703d198f23e43600f0014348181c",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-14-f13-arrow",
+  "relation": "decoy",
+  "edges": 3,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 13,
+  "challengeSha256": "6faeba5beacfb399bde90b23be658b7ef14e550b57d2443b668b1480c94cb00f",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-14-f13-arrow",
+  "relation": "shift",
+  "edges": 3,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "c4009ee3e5891768cc6adbd172afb2e60f325031f8f6aca12a89eb43225f3f42",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-14-f13-arrow",
+  "relation": "repeat",
+  "edges": 3,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "95a35f2916095af1de2cf2d526662f1c4e7b63b5edc2702e3a8c6c57a0f8bf36",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-15-f13-block",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 11,
+  "challengeSha256": "3e268f7eadbe4a411a4e66eca0a6a74e2ba381b30d3a7d74fffbe1c435d43915",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-15-f13-block",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "1e2359fee773acf28281b0abb10a95edd201a78c516f5470b7a3b29b3ec7480e",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-15-f13-block",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "235af960c3304a173beff3d755e9be809859322c809a55023104ba69190a55b2",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-16-alias-property-mutation",
+  "relation": "decoy",
+  "edges": 3,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "19d7eb11864a854c82d99b42908ebff7dbe2890ca2aeeed7d917f04a327a9bdb",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-16-alias-property-mutation",
+  "relation": "shift",
+  "edges": 3,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "503246f4fcba5cc19d071a932e96b080f9ac8f9a351b4d322981935c60c05d61",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-16-alias-property-mutation",
+  "relation": "repeat",
+  "edges": 3,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "644f7b21fd70614fd82dbdf334ded60909517566976d9e9efa7989ba1dcbeb58",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-17-alias-rebind",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "13098a1baee5e118249aaf055789f280b1e854b0c03c4a15aaf22663f8b08987",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-17-alias-rebind",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "a8a6915f19e26f8526d4f9e2222b9ed1995fe5459c24faa339a6b79af9ae5f1c",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-17-alias-rebind",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "70eba97dba0599b7fd47db499bf73985dff3ced6e5b93f239d9f697ee03eba92",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-18-property-overwrite",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "a8df6c7c6e8c657e03580dc6b129a494ad28a249bc468decee74f7aceb600096",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-18-property-overwrite",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "256b52741d39d04ade6b27ec51357930093916e528bb0cbcb55093d86489acc5",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-18-property-overwrite",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "05d1eba506aafe02327c1e07e3abd64e262d6172ca88cd01db74fe5c58548adf",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-19-binding-overwrite",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "760b1a4938f23988913de9fcc5be898ddfc38c2a7630cadd31fd95ead8fed58c",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-19-binding-overwrite",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "b34ca0409a60874caf1d6193c031736b2e07a52f0c38cb5f7df7fc0825312781",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-19-binding-overwrite",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "ef072765ee85c5746dcc48cf3944d5937d5f204e3be2dce22201c8ede1382ea8",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-20-post-export-write",
+  "relation": "decoy",
+  "edges": 3,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "de82cbea24197eaeb3d637c7ede7e741b8cb0515280c64aae830bc11b86b5d7c",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-20-post-export-write",
+  "relation": "shift",
+  "edges": 3,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "7623b8d184e49da3e59d574d20acd6a34ac7ea03ec1a8b5fd177a1d79710493e",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-20-post-export-write",
+  "relation": "repeat",
+  "edges": 3,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "867496479c589f4b69b3defd9c8ea9d54a41fb9f09cd2787b4fed0e8bf28111e",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-21-old-exports-alias",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "72c07fdaa55dbde066e384ca884b7135601b7148534c34ce5a37a7a91ca33cca",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-21-old-exports-alias",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "ac3e46623e1588cc5d933390f1184060896cdbca51ca6fe5bce08479972b6e53",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-21-old-exports-alias",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "be2cf1bf578603cfa0ce2ea78ff51a1b6eb7f21f82cd86922f7cc9a94dc5af64",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-22-ambiguous-branch",
+  "relation": "decoy",
+  "edges": 3,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 10,
+  "challengeSha256": "561ea2bd6f3d124d5a889a2b09d514ddf84a1f78646c355d8187b9dc44bcd19a",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-22-ambiguous-branch",
+  "relation": "shift",
+  "edges": 3,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "9a665cbe3ba4a33314ec8bd601b31177429fc1434ab27130ef3b6ce3145056ad",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-22-ambiguous-branch",
+  "relation": "repeat",
+  "edges": 3,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "749d67c147026c91038e4b8554bf10eff6096c1f68434e64257099050f59aa50",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-23-agreeing-branch",
+  "relation": "decoy",
+  "edges": 3,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "6d672a038b638174d019e884f590bd321e69d5f0505b2f072197087e679df468",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-23-agreeing-branch",
+  "relation": "shift",
+  "edges": 3,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "0a38cf42e7671c45a572ffa12ba3224100abdc5680351b118027e662630b0b47",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-23-agreeing-branch",
+  "relation": "repeat",
+  "edges": 3,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "1b217de943f1dbc591d6dd70e9e26307a1a7fa47cf911b8568004803ef74aff1",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-24-opaque-escape",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [
+    "m.js:2 m.js -calls-> zz_cg_decoy/decoy-fns.js:opaque (exact-match)"
+   ],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 10,
+  "challengeSha256": "068040fbad9c35ff114888eaf794ff9b42cf11a9940d31f4849df436cfd0decf",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-24-opaque-escape",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "4e4da4355359a9d8a194ae1676f738b1b5aee5a631a6f5007a6fa1563fc08a8b",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-24-opaque-escape",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "af1ee5c5984ec4b6e7e9f385b28e14dcde1e579729ff29a1e8ca46f30bb7ddaf",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-25-unknown-dynamic-key",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "e64cadb2a67a055366b536f517afcc5f9139899a8e26ffd4570bb17d820a0769",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-25-unknown-dynamic-key",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "ac3644c5ca50bc491038b965c46715acea1032db2e1227bb60c08eb9508d0462",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-25-unknown-dynamic-key",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "71a39af48952bdc6a7f3cced8ee26045cb5525d2e7bbd8cd0c08e411804b5abb",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-26-local-eval",
+  "relation": "decoy",
+  "edges": 3,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "4ba4dbfa98c444e2d23c635afba7cfeaa2fd07bb2dd97d6b5a87e58670b2970d",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-26-local-eval",
+  "relation": "shift",
+  "edges": 3,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "91471b1b7ed95c1826307576e343c0e6bc554266ea6f0d33d1b72d49558c8222",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-26-local-eval",
+  "relation": "repeat",
+  "edges": 3,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "6568e213ba5b3d9d9e38bab14c1c2fa7dbd19f9b1dd6f712cb19320add5b0ace",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-27-literal-eval",
+  "relation": "decoy",
+  "edges": 3,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "43dcb6d954d2d7ca77da0e382f6360f10cd8d9736f9b6144b4f4b93013372757",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-27-literal-eval",
+  "relation": "shift",
+  "edges": 3,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "d7406afe6f2dae6d32308971cbc77a82282a70881073a3a96ac76a6c38ff7874",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-27-literal-eval",
+  "relation": "repeat",
+  "edges": 3,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "59de166a04e8b8b871b91de19e755463474101da40bd4e2d07bb1563559eee7f",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-28-eval-property-on-local-identity",
+  "relation": "decoy",
+  "edges": 3,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "ae026bb9d891d6e7835e7a56b2d1e2b8858671facf82cf4445782911f2687de7",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-28-eval-property-on-local-identity",
+  "relation": "shift",
+  "edges": 3,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "39cc5d781ebec8eb2db7ed4b94be2405b914ae66a1af173b1030523eed7c355b",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-28-eval-property-on-local-identity",
+  "relation": "repeat",
+  "edges": 3,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "0d7ad16c4e6e74c8306cd6de39a68aacc4e702eadb5a84383320bbb933d728c8",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-29-uncertain-receiver-alias",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "b32f71d281ae6ca9070dce8ad40a5e9eee1ad0d98854e401c083a14b9edb3ed9",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-29-uncertain-receiver-alias",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "2b5f8d2442a00d68d758e1cf9bbd78d8b55c2bbb5947db4790321bdc21b2c539",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-29-uncertain-receiver-alias",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "ea3cc8a6904debc063e12ed3cba0f0ec9416e3ae09e28b04d03709eff7d81393",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-30-data-overwrite-after-literal-eval",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "c91d4e006c81cdc59fffd829b2b25b880a4f43fd6b4c3990d115de94a4aea5cd",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-30-data-overwrite-after-literal-eval",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "f74e7abd03d9a51ced5a28b64bf93a1c53e67b03f258bd9733b5544ca9b42691",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-30-data-overwrite-after-literal-eval",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "cfbfa20afbe306a605937087d187593fbfb94d40e2061ee0804c29f8f19e4ec9",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-31-missing-read-exported-as-undefined-data",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 7,
+  "challengeSha256": "d809d330757e7adaa9ccd66e2d4e173f75a92526436d77e86ec1ef8ba42d6652",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-31-missing-read-exported-as-undefined-data",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "6a38b2474fe9bb5cda1accc21f375346e0b82b32cfa4e53fa38313dec6aeacfe",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-31-missing-read-exported-as-undefined-data",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "98fd5f692611fcf125381c7da4a91d8bab7d2bd2815cde6e87cda8d24e4bbc34",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-32-logical-member-initialization",
+  "relation": "decoy",
+  "edges": 3,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 8,
+  "challengeSha256": "ed9b5f1db073f0355d1987249efda00b7aeb8d72adace9eccb7164a2813adf58",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-32-logical-member-initialization",
+  "relation": "shift",
+  "edges": 3,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "decoy.js",
+   "index.js",
+   "m.js",
+   "use.js"
+  ],
+  "challengeSha256": "df3fefe59102265a61529283472fc97961b752b11657c687582c84ae86620eb7",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "pr29-32-logical-member-initialization",
+  "relation": "repeat",
+  "edges": 3,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "163d93fd14368c432a570aa851103aa716de164d2ec2022f907fc7e5dce0c910",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "t1-ts-global-builtin",
+  "relation": "decoy",
+  "edges": 2,
+  "diffs": {
+   "CAPTURED": [],
+   "LOST": [],
+   "GAINED": []
+  },
+  "decoys": 13,
+  "challengeSha256": "5471fcbe384ec58f70017e954af1cb833d612f2965bd0350339a8002cb362e7a",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "t1-ts-global-builtin",
+  "relation": "shift",
+  "edges": 2,
+  "diffs": {
+   "MOVED": [],
+   "LOST": []
+  },
+  "shiftedFiles": [
+   "lib/other.ts",
+   "use.ts"
+  ],
+  "challengeSha256": "f9628e6b2eed869a68171abfc114d1eff528d110f4abea4770dc9ac6eda8cfef",
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ },
+ {
+  "seed": "t1-ts-global-builtin",
+  "relation": "repeat",
+  "edges": 2,
+  "diffs": {
+   "REPEAT": []
+  },
+  "challengeSha256": "27ff91204c32d3545923620cf2bde3b26ace047dac416de5b15702a45b9063d0",
+  "byteIdentical": true,
+  "subject": "codegraph",
+  "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae"
+ }
+]
\ No newline at end of file
diff --git a/docs/handoffs/pr29-2026-11-10/harness/metamorphic-comparison.json b/docs/handoffs/pr29-2026-11-10/harness/metamorphic-comparison.json
new file mode 100644
index 0000000000..e2e69f1e86
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/harness/metamorphic-comparison.json
@@ -0,0 +1,208 @@
+{
+  "candidateNewInvariantDifferences": [],
+  "removedBaselineDifferences": [
+    {
+      "seed": "issue-2952",
+      "relation": "decoy",
+      "kind": "CAPTURED",
+      "removed": [
+        "test/utils.js:2 t -calls-> zz_cg_decoy/decoy-methods.js:CgDecoyHost::etag (instance-method)"
+      ]
+    },
+    {
+      "seed": "pr29-04-f15-number",
+      "relation": "decoy",
+      "kind": "LOST",
+      "removed": [
+        "use.js:1 run -calls-> decoy.js:Decoy::load (instance-method)"
+      ]
+    },
+    {
+      "seed": "pr29-05-f15-string",
+      "relation": "decoy",
+      "kind": "LOST",
+      "removed": [
+        "use.js:1 run -calls-> decoy.js:Decoy::load (instance-method)"
+      ]
+    },
+    {
+      "seed": "pr29-06-f15-assigned-callable",
+      "relation": "decoy",
+      "kind": "LOST",
+      "removed": [
+        "use.js:1 run -calls-> decoy.js:Decoy::load (instance-method)"
+      ]
+    },
+    {
+      "seed": "pr29-09-f11-generator-key-outside-generator",
+      "relation": "decoy",
+      "kind": "LOST",
+      "removed": [
+        "use.js:1 run -calls-> decoy.js:Decoy::load (instance-method)"
+      ]
+    },
+    {
+      "seed": "pr29-13-f13-parameter",
+      "relation": "decoy",
+      "kind": "LOST",
+      "removed": [
+        "use.js:1 run -calls-> decoy.js:Decoy::load (instance-method)"
+      ]
+    },
+    {
+      "seed": "pr29-14-f13-arrow",
+      "relation": "decoy",
+      "kind": "LOST",
+      "removed": [
+        "use.js:1 run -calls-> decoy.js:Decoy::load (instance-method)"
+      ]
+    },
+    {
+      "seed": "pr29-15-f13-block",
+      "relation": "decoy",
+      "kind": "LOST",
+      "removed": [
+        "use.js:1 run -calls-> decoy.js:Decoy::load (instance-method)"
+      ]
+    },
+    {
+      "seed": "pr29-31-missing-read-exported-as-undefined-data",
+      "relation": "decoy",
+      "kind": "LOST",
+      "removed": [
+        "use.js:1 run -calls-> decoy.js:Decoy::load (instance-method)"
+      ]
+    }
+  ],
+  "candidateRemainingDifferences": [
+    {
+      "seed": "b",
+      "relation": "decoy",
+      "diffs": {
+        "LOST": 1
+      }
+    },
+    {
+      "seed": "c",
+      "relation": "decoy",
+      "diffs": {
+        "CAPTURED": 1,
+        "LOST": 1
+      }
+    },
+    {
+      "seed": "issue-2944",
+      "relation": "decoy",
+      "diffs": {
+        "CAPTURED": 4,
+        "LOST": 4
+      }
+    },
+    {
+      "seed": "issue-2944-arrow",
+      "relation": "decoy",
+      "diffs": {
+        "CAPTURED": 4,
+        "LOST": 4
+      }
+    },
+    {
+      "seed": "issue-2944-verbatim",
+      "relation": "decoy",
+      "diffs": {
+        "CAPTURED": 4,
+        "LOST": 4
+      }
+    },
+    {
+      "seed": "issue-2947",
+      "relation": "decoy",
+      "diffs": {
+        "CAPTURED": 2,
+        "LOST": 4
+      }
+    },
+    {
+      "seed": "issue-2948",
+      "relation": "decoy",
+      "diffs": {
+        "CAPTURED": 2,
+        "LOST": 2
+      }
+    },
+    {
+      "seed": "issue-2949-pkg",
+      "relation": "decoy",
+      "diffs": {
+        "CAPTURED": 1
+      }
+    },
+    {
+      "seed": "issue-2951",
+      "relation": "decoy",
+      "diffs": {
+        "LOST": 3
+      }
+    },
+    {
+      "seed": "issue-2953",
+      "relation": "decoy",
+      "diffs": {
+        "LOST": 1
+      }
+    },
+    {
+      "seed": "issue-2958",
+      "relation": "decoy",
+      "diffs": {
+        "CAPTURED": 1
+      }
+    },
+    {
+      "seed": "issue-2962",
+      "relation": "decoy",
+      "diffs": {
+        "CAPTURED": 8,
+        "LOST": 3
+      }
+    },
+    {
+      "seed": "issue-2966",
+      "relation": "decoy",
+      "diffs": {
+        "CAPTURED": 1,
+        "LOST": 2
+      }
+    },
+    {
+      "seed": "n2-py-comprehension",
+      "relation": "decoy",
+      "diffs": {
+        "CAPTURED": 2,
+        "LOST": 1
+      }
+    },
+    {
+      "seed": "n4-py-builtin",
+      "relation": "decoy",
+      "diffs": {
+        "CAPTURED": 1,
+        "LOST": 1
+      }
+    },
+    {
+      "seed": "p3",
+      "relation": "decoy",
+      "diffs": {
+        "LOST": 1
+      }
+    },
+    {
+      "seed": "pr29-24-opaque-escape",
+      "relation": "decoy",
+      "diffs": {
+        "CAPTURED": 1
+      }
+    }
+  ]
+}
diff --git a/docs/handoffs/pr29-2026-11-10/harness/mode-seeds.json b/docs/handoffs/pr29-2026-11-10/harness/mode-seeds.json
new file mode 100644
index 0000000000..57bae7f3da
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/harness/mode-seeds.json
@@ -0,0 +1 @@
+["/tmp/codegraph-pr29-harness-6fevujfy/qa/fixtures/oracle-candidates/pr29-01-f14-object", "/tmp/codegraph-pr29-harness-6fevujfy/qa/fixtures/oracle-candidates/pr29-04-f15-number", "/tmp/codegraph-pr29-harness-6fevujfy/qa/fixtures/oracle-candidates/pr29-06-f15-assigned-callable", "/tmp/codegraph-pr29-harness-6fevujfy/qa/fixtures/oracle-candidates/pr29-08-f11-generator-eval", "/tmp/codegraph-pr29-harness-6fevujfy/qa/fixtures/oracle-candidates/pr29-22-ambiguous-branch", "/tmp/codegraph-pr29-harness-6fevujfy/qa/fixtures/oracle-candidates/pr29-23-agreeing-branch", "/tmp/codegraph-pr29-harness-6fevujfy/qa/fixtures/oracle-candidates/pr29-29-uncertain-receiver-alias", "/tmp/codegraph-pr29-harness-6fevujfy/qa/fixtures/oracle-candidates/pr29-32-logical-member-initialization", "/tmp/codegraph-pr29-harness-6fevujfy/qa/fixtures/oracle-candidates/n5-ts-barrel-member", "/tmp/codegraph-pr29-harness-6fevujfy/corpus/express", "/tmp/codegraph-pr29-harness-6fevujfy/corpus/requests"]
\ No newline at end of file
diff --git a/docs/handoffs/pr29-2026-11-10/harness/modes-baseline.json b/docs/handoffs/pr29-2026-11-10/harness/modes-baseline.json
new file mode 100644
index 0000000000..9960ba8f5f
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/harness/modes-baseline.json
@@ -0,0 +1,1172 @@
+{
+ "build": "/tmp/codegraph-pr29-harness-6fevujfy/baseline/dist/bin/codegraph.js",
+ "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae",
+ "modes": [
+  "repeat",
+  "parse1",
+  "parse4",
+  "resolve-pool",
+  "no-parallel-resolve",
+  "no-store-worker",
+  "no-fast-init",
+  "reindex",
+  "sync-from-empty"
+ ],
+ "results": [
+  {
+   "dir": "/tmp/codegraph-pr29-harness-6fevujfy/qa/fixtures/oracle-candidates/pr29-01-f14-object",
+   "results": [
+    {
+     "mode": "base",
+     "ms": 955,
+     "size": {
+      "nodes": 11,
+      "edges": 9,
+      "unresolved": 3
+     },
+     "verdict": "BASE"
+    },
+    {
+     "mode": "repeat",
+     "ms": 1001,
+     "size": {
+      "nodes": 11,
+      "edges": 9,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse1",
+     "ms": 924,
+     "size": {
+      "nodes": 11,
+      "edges": 9,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse4",
+     "ms": 944,
+     "size": {
+      "nodes": 11,
+      "edges": 9,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "resolve-pool",
+     "ms": 1180,
+     "size": {
+      "nodes": 11,
+      "edges": 9,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-parallel-resolve",
+     "ms": 1080,
+     "size": {
+      "nodes": 11,
+      "edges": 9,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-store-worker",
+     "ms": 1089,
+     "size": {
+      "nodes": 11,
+      "edges": 9,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-fast-init",
+     "ms": 1193,
+     "size": {
+      "nodes": 11,
+      "edges": 9,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "reindex",
+     "ms": 1992,
+     "size": {
+      "nodes": 11,
+      "edges": 9,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "sync-from-empty",
+     "ms": 1559,
+     "size": {
+      "nodes": 11,
+      "edges": 9,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    }
+   ]
+  },
+  {
+   "dir": "/tmp/codegraph-pr29-harness-6fevujfy/qa/fixtures/oracle-candidates/pr29-04-f15-number",
+   "results": [
+    {
+     "mode": "base",
+     "ms": 921,
+     "size": {
+      "nodes": 9,
+      "edges": 8,
+      "unresolved": 2
+     },
+     "verdict": "BASE"
+    },
+    {
+     "mode": "repeat",
+     "ms": 918,
+     "size": {
+      "nodes": 9,
+      "edges": 8,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse1",
+     "ms": 898,
+     "size": {
+      "nodes": 9,
+      "edges": 8,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse4",
+     "ms": 974,
+     "size": {
+      "nodes": 9,
+      "edges": 8,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "resolve-pool",
+     "ms": 1119,
+     "size": {
+      "nodes": 9,
+      "edges": 8,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-parallel-resolve",
+     "ms": 858,
+     "size": {
+      "nodes": 9,
+      "edges": 8,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-store-worker",
+     "ms": 825,
+     "size": {
+      "nodes": 9,
+      "edges": 8,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-fast-init",
+     "ms": 975,
+     "size": {
+      "nodes": 9,
+      "edges": 8,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "reindex",
+     "ms": 1715,
+     "size": {
+      "nodes": 9,
+      "edges": 8,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "sync-from-empty",
+     "ms": 1477,
+     "size": {
+      "nodes": 9,
+      "edges": 8,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    }
+   ]
+  },
+  {
+   "dir": "/tmp/codegraph-pr29-harness-6fevujfy/qa/fixtures/oracle-candidates/pr29-06-f15-assigned-callable",
+   "results": [
+    {
+     "mode": "base",
+     "ms": 857,
+     "size": {
+      "nodes": 10,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "BASE"
+    },
+    {
+     "mode": "repeat",
+     "ms": 849,
+     "size": {
+      "nodes": 10,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse1",
+     "ms": 828,
+     "size": {
+      "nodes": 10,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse4",
+     "ms": 898,
+     "size": {
+      "nodes": 10,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "resolve-pool",
+     "ms": 1122,
+     "size": {
+      "nodes": 10,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-parallel-resolve",
+     "ms": 837,
+     "size": {
+      "nodes": 10,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-store-worker",
+     "ms": 828,
+     "size": {
+      "nodes": 10,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-fast-init",
+     "ms": 976,
+     "size": {
+      "nodes": 10,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "reindex",
+     "ms": 1714,
+     "size": {
+      "nodes": 10,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "sync-from-empty",
+     "ms": 1482,
+     "size": {
+      "nodes": 10,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    }
+   ]
+  },
+  {
+   "dir": "/tmp/codegraph-pr29-harness-6fevujfy/qa/fixtures/oracle-candidates/pr29-08-f11-generator-eval",
+   "results": [
+    {
+     "mode": "base",
+     "ms": 887,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 5
+     },
+     "verdict": "BASE"
+    },
+    {
+     "mode": "repeat",
+     "ms": 840,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 5
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse1",
+     "ms": 829,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 5
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse4",
+     "ms": 929,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 5
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "resolve-pool",
+     "ms": 1151,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 5
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-parallel-resolve",
+     "ms": 890,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 5
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-store-worker",
+     "ms": 923,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 5
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-fast-init",
+     "ms": 1001,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 5
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "reindex",
+     "ms": 1876,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 5
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "sync-from-empty",
+     "ms": 1639,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 5
+     },
+     "verdict": "IDENTICAL"
+    }
+   ]
+  },
+  {
+   "dir": "/tmp/codegraph-pr29-harness-6fevujfy/qa/fixtures/oracle-candidates/pr29-22-ambiguous-branch",
+   "results": [
+    {
+     "mode": "base",
+     "ms": 1015,
+     "size": {
+      "nodes": 12,
+      "edges": 11,
+      "unresolved": 3
+     },
+     "verdict": "BASE"
+    },
+    {
+     "mode": "repeat",
+     "ms": 1134,
+     "size": {
+      "nodes": 12,
+      "edges": 11,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse1",
+     "ms": 1066,
+     "size": {
+      "nodes": 12,
+      "edges": 11,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse4",
+     "ms": 1102,
+     "size": {
+      "nodes": 12,
+      "edges": 11,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "resolve-pool",
+     "ms": 1326,
+     "size": {
+      "nodes": 12,
+      "edges": 11,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-parallel-resolve",
+     "ms": 1010,
+     "size": {
+      "nodes": 12,
+      "edges": 11,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-store-worker",
+     "ms": 1025,
+     "size": {
+      "nodes": 12,
+      "edges": 11,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-fast-init",
+     "ms": 1163,
+     "size": {
+      "nodes": 12,
+      "edges": 11,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "reindex",
+     "ms": 2083,
+     "size": {
+      "nodes": 12,
+      "edges": 11,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "sync-from-empty",
+     "ms": 1790,
+     "size": {
+      "nodes": 12,
+      "edges": 11,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    }
+   ]
+  },
+  {
+   "dir": "/tmp/codegraph-pr29-harness-6fevujfy/qa/fixtures/oracle-candidates/pr29-23-agreeing-branch",
+   "results": [
+    {
+     "mode": "base",
+     "ms": 1028,
+     "size": {
+      "nodes": 11,
+      "edges": 9,
+      "unresolved": 3
+     },
+     "verdict": "BASE"
+    },
+    {
+     "mode": "repeat",
+     "ms": 1017,
+     "size": {
+      "nodes": 11,
+      "edges": 9,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse1",
+     "ms": 1064,
+     "size": {
+      "nodes": 11,
+      "edges": 9,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse4",
+     "ms": 1156,
+     "size": {
+      "nodes": 11,
+      "edges": 9,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "resolve-pool",
+     "ms": 1441,
+     "size": {
+      "nodes": 11,
+      "edges": 9,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-parallel-resolve",
+     "ms": 1020,
+     "size": {
+      "nodes": 11,
+      "edges": 9,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-store-worker",
+     "ms": 1022,
+     "size": {
+      "nodes": 11,
+      "edges": 9,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-fast-init",
+     "ms": 1126,
+     "size": {
+      "nodes": 11,
+      "edges": 9,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "reindex",
+     "ms": 2128,
+     "size": {
+      "nodes": 11,
+      "edges": 9,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "sync-from-empty",
+     "ms": 1965,
+     "size": {
+      "nodes": 11,
+      "edges": 9,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    }
+   ]
+  },
+  {
+   "dir": "/tmp/codegraph-pr29-harness-6fevujfy/qa/fixtures/oracle-candidates/pr29-29-uncertain-receiver-alias",
+   "results": [
+    {
+     "mode": "base",
+     "ms": 1118,
+     "size": {
+      "nodes": 12,
+      "edges": 10,
+      "unresolved": 3
+     },
+     "verdict": "BASE"
+    },
+    {
+     "mode": "repeat",
+     "ms": 1135,
+     "size": {
+      "nodes": 12,
+      "edges": 10,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse1",
+     "ms": 992,
+     "size": {
+      "nodes": 12,
+      "edges": 10,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse4",
+     "ms": 1092,
+     "size": {
+      "nodes": 12,
+      "edges": 10,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "resolve-pool",
+     "ms": 1398,
+     "size": {
+      "nodes": 12,
+      "edges": 10,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-parallel-resolve",
+     "ms": 1070,
+     "size": {
+      "nodes": 12,
+      "edges": 10,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-store-worker",
+     "ms": 1017,
+     "size": {
+      "nodes": 12,
+      "edges": 10,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-fast-init",
+     "ms": 1159,
+     "size": {
+      "nodes": 12,
+      "edges": 10,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "reindex",
+     "ms": 2018,
+     "size": {
+      "nodes": 12,
+      "edges": 10,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "sync-from-empty",
+     "ms": 1764,
+     "size": {
+      "nodes": 12,
+      "edges": 10,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    }
+   ]
+  },
+  {
+   "dir": "/tmp/codegraph-pr29-harness-6fevujfy/qa/fixtures/oracle-candidates/pr29-32-logical-member-initialization",
+   "results": [
+    {
+     "mode": "base",
+     "ms": 1062,
+     "size": {
+      "nodes": 11,
+      "edges": 9,
+      "unresolved": 3
+     },
+     "verdict": "BASE"
+    },
+    {
+     "mode": "repeat",
+     "ms": 1015,
+     "size": {
+      "nodes": 11,
+      "edges": 9,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse1",
+     "ms": 1031,
+     "size": {
+      "nodes": 11,
+      "edges": 9,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse4",
+     "ms": 1127,
+     "size": {
+      "nodes": 11,
+      "edges": 9,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "resolve-pool",
+     "ms": 1420,
+     "size": {
+      "nodes": 11,
+      "edges": 9,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-parallel-resolve",
+     "ms": 1028,
+     "size": {
+      "nodes": 11,
+      "edges": 9,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-store-worker",
+     "ms": 1039,
+     "size": {
+      "nodes": 11,
+      "edges": 9,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-fast-init",
+     "ms": 1246,
+     "size": {
+      "nodes": 11,
+      "edges": 9,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "reindex",
+     "ms": 2143,
+     "size": {
+      "nodes": 11,
+      "edges": 9,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "sync-from-empty",
+     "ms": 1741,
+     "size": {
+      "nodes": 11,
+      "edges": 9,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    }
+   ]
+  },
+  {
+   "dir": "/tmp/codegraph-pr29-harness-6fevujfy/qa/fixtures/oracle-candidates/n5-ts-barrel-member",
+   "results": [
+    {
+     "mode": "base",
+     "ms": 1019,
+     "size": {
+      "nodes": 15,
+      "edges": 18,
+      "unresolved": 1
+     },
+     "verdict": "BASE"
+    },
+    {
+     "mode": "repeat",
+     "ms": 1054,
+     "size": {
+      "nodes": 15,
+      "edges": 18,
+      "unresolved": 1
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse1",
+     "ms": 1008,
+     "size": {
+      "nodes": 15,
+      "edges": 18,
+      "unresolved": 1
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse4",
+     "ms": 1122,
+     "size": {
+      "nodes": 15,
+      "edges": 18,
+      "unresolved": 1
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "resolve-pool",
+     "ms": 1593,
+     "size": {
+      "nodes": 15,
+      "edges": 18,
+      "unresolved": 1
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-parallel-resolve",
+     "ms": 1050,
+     "size": {
+      "nodes": 15,
+      "edges": 18,
+      "unresolved": 1
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-store-worker",
+     "ms": 1005,
+     "size": {
+      "nodes": 15,
+      "edges": 18,
+      "unresolved": 1
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-fast-init",
+     "ms": 1195,
+     "size": {
+      "nodes": 15,
+      "edges": 18,
+      "unresolved": 1
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "reindex",
+     "ms": 2427,
+     "size": {
+      "nodes": 15,
+      "edges": 18,
+      "unresolved": 1
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "sync-from-empty",
+     "ms": 1855,
+     "size": {
+      "nodes": 15,
+      "edges": 18,
+      "unresolved": 1
+     },
+     "verdict": "IDENTICAL"
+    }
+   ]
+  },
+  {
+   "dir": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/express",
+   "results": [
+    {
+     "mode": "base",
+     "ms": 3198,
+     "size": {
+      "nodes": 1143,
+      "edges": 2334,
+      "unresolved": 9133
+     },
+     "verdict": "BASE"
+    },
+    {
+     "mode": "repeat",
+     "ms": 3296,
+     "size": {
+      "nodes": 1143,
+      "edges": 2334,
+      "unresolved": 9133
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse1",
+     "ms": 3721,
+     "size": {
+      "nodes": 1143,
+      "edges": 2334,
+      "unresolved": 9133
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse4",
+     "ms": 3074,
+     "size": {
+      "nodes": 1143,
+      "edges": 2334,
+      "unresolved": 9133
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "resolve-pool",
+     "ms": 3678,
+     "size": {
+      "nodes": 1143,
+      "edges": 2334,
+      "unresolved": 9133
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-parallel-resolve",
+     "ms": 3550,
+     "size": {
+      "nodes": 1143,
+      "edges": 2334,
+      "unresolved": 9133
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-store-worker",
+     "ms": 3183,
+     "size": {
+      "nodes": 1143,
+      "edges": 2334,
+      "unresolved": 9133
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-fast-init",
+     "ms": 3167,
+     "size": {
+      "nodes": 1143,
+      "edges": 2334,
+      "unresolved": 9133
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "reindex",
+     "ms": 6187,
+     "size": {
+      "nodes": 1143,
+      "edges": 2334,
+      "unresolved": 9133
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "sync-from-empty",
+     "ms": 5692,
+     "size": {
+      "nodes": 1143,
+      "edges": 2334,
+      "unresolved": 9133
+     },
+     "verdict": "IDENTICAL"
+    }
+   ]
+  },
+  {
+   "dir": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/requests",
+   "results": [
+    {
+     "mode": "base",
+     "ms": 2714,
+     "size": {
+      "nodes": 1299,
+      "edges": 2976,
+      "unresolved": 2345
+     },
+     "verdict": "BASE"
+    },
+    {
+     "mode": "repeat",
+     "ms": 2899,
+     "size": {
+      "nodes": 1299,
+      "edges": 2976,
+      "unresolved": 2345
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse1",
+     "ms": 2888,
+     "size": {
+      "nodes": 1299,
+      "edges": 2976,
+      "unresolved": 2345
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse4",
+     "ms": 2688,
+     "size": {
+      "nodes": 1299,
+      "edges": 2976,
+      "unresolved": 2345
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "resolve-pool",
+     "ms": 2785,
+     "size": {
+      "nodes": 1299,
+      "edges": 2976,
+      "unresolved": 2345
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-parallel-resolve",
+     "ms": 2697,
+     "size": {
+      "nodes": 1299,
+      "edges": 2976,
+      "unresolved": 2345
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-store-worker",
+     "ms": 2673,
+     "size": {
+      "nodes": 1299,
+      "edges": 2976,
+      "unresolved": 2345
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-fast-init",
+     "ms": 2795,
+     "size": {
+      "nodes": 1299,
+      "edges": 2976,
+      "unresolved": 2345
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "reindex",
+     "ms": 4974,
+     "size": {
+      "nodes": 1299,
+      "edges": 2976,
+      "unresolved": 2345
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "sync-from-empty",
+     "ms": 4423,
+     "size": {
+      "nodes": 1299,
+      "edges": 2976,
+      "unresolved": 2345
+     },
+     "verdict": "SAME-GRAPH"
+    }
+   ]
+  }
+ ]
+}
\ No newline at end of file
diff --git a/docs/handoffs/pr29-2026-11-10/harness/modes-candidate.json b/docs/handoffs/pr29-2026-11-10/harness/modes-candidate.json
new file mode 100644
index 0000000000..683a3b9698
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/harness/modes-candidate.json
@@ -0,0 +1,1172 @@
+{
+ "build": "/tmp/codegraph-pr29-harness-6fevujfy/candidate/dist/bin/codegraph.js",
+ "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae",
+ "modes": [
+  "repeat",
+  "parse1",
+  "parse4",
+  "resolve-pool",
+  "no-parallel-resolve",
+  "no-store-worker",
+  "no-fast-init",
+  "reindex",
+  "sync-from-empty"
+ ],
+ "results": [
+  {
+   "dir": "/tmp/codegraph-pr29-harness-6fevujfy/qa/fixtures/oracle-candidates/pr29-01-f14-object",
+   "results": [
+    {
+     "mode": "base",
+     "ms": 1432,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "BASE"
+    },
+    {
+     "mode": "repeat",
+     "ms": 1712,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse1",
+     "ms": 1690,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse4",
+     "ms": 1626,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "resolve-pool",
+     "ms": 1958,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-parallel-resolve",
+     "ms": 1279,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-store-worker",
+     "ms": 1156,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-fast-init",
+     "ms": 1434,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "reindex",
+     "ms": 2542,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "sync-from-empty",
+     "ms": 1813,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    }
+   ]
+  },
+  {
+   "dir": "/tmp/codegraph-pr29-harness-6fevujfy/qa/fixtures/oracle-candidates/pr29-04-f15-number",
+   "results": [
+    {
+     "mode": "base",
+     "ms": 1156,
+     "size": {
+      "nodes": 9,
+      "edges": 7,
+      "unresolved": 3
+     },
+     "verdict": "BASE"
+    },
+    {
+     "mode": "repeat",
+     "ms": 1165,
+     "size": {
+      "nodes": 9,
+      "edges": 7,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse1",
+     "ms": 1056,
+     "size": {
+      "nodes": 9,
+      "edges": 7,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse4",
+     "ms": 1119,
+     "size": {
+      "nodes": 9,
+      "edges": 7,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "resolve-pool",
+     "ms": 1372,
+     "size": {
+      "nodes": 9,
+      "edges": 7,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-parallel-resolve",
+     "ms": 1129,
+     "size": {
+      "nodes": 9,
+      "edges": 7,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-store-worker",
+     "ms": 1112,
+     "size": {
+      "nodes": 9,
+      "edges": 7,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-fast-init",
+     "ms": 1211,
+     "size": {
+      "nodes": 9,
+      "edges": 7,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "reindex",
+     "ms": 2164,
+     "size": {
+      "nodes": 9,
+      "edges": 7,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "sync-from-empty",
+     "ms": 1729,
+     "size": {
+      "nodes": 9,
+      "edges": 7,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    }
+   ]
+  },
+  {
+   "dir": "/tmp/codegraph-pr29-harness-6fevujfy/qa/fixtures/oracle-candidates/pr29-06-f15-assigned-callable",
+   "results": [
+    {
+     "mode": "base",
+     "ms": 1111,
+     "size": {
+      "nodes": 10,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "BASE"
+    },
+    {
+     "mode": "repeat",
+     "ms": 1085,
+     "size": {
+      "nodes": 10,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse1",
+     "ms": 1071,
+     "size": {
+      "nodes": 10,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse4",
+     "ms": 1102,
+     "size": {
+      "nodes": 10,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "resolve-pool",
+     "ms": 1361,
+     "size": {
+      "nodes": 10,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-parallel-resolve",
+     "ms": 1075,
+     "size": {
+      "nodes": 10,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-store-worker",
+     "ms": 983,
+     "size": {
+      "nodes": 10,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-fast-init",
+     "ms": 1232,
+     "size": {
+      "nodes": 10,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "reindex",
+     "ms": 2015,
+     "size": {
+      "nodes": 10,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "sync-from-empty",
+     "ms": 1760,
+     "size": {
+      "nodes": 10,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    }
+   ]
+  },
+  {
+   "dir": "/tmp/codegraph-pr29-harness-6fevujfy/qa/fixtures/oracle-candidates/pr29-08-f11-generator-eval",
+   "results": [
+    {
+     "mode": "base",
+     "ms": 1204,
+     "size": {
+      "nodes": 11,
+      "edges": 11,
+      "unresolved": 4
+     },
+     "verdict": "BASE"
+    },
+    {
+     "mode": "repeat",
+     "ms": 1130,
+     "size": {
+      "nodes": 11,
+      "edges": 11,
+      "unresolved": 4
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse1",
+     "ms": 1117,
+     "size": {
+      "nodes": 11,
+      "edges": 11,
+      "unresolved": 4
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse4",
+     "ms": 1277,
+     "size": {
+      "nodes": 11,
+      "edges": 11,
+      "unresolved": 4
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "resolve-pool",
+     "ms": 1685,
+     "size": {
+      "nodes": 11,
+      "edges": 11,
+      "unresolved": 4
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-parallel-resolve",
+     "ms": 1232,
+     "size": {
+      "nodes": 11,
+      "edges": 11,
+      "unresolved": 4
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-store-worker",
+     "ms": 1203,
+     "size": {
+      "nodes": 11,
+      "edges": 11,
+      "unresolved": 4
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-fast-init",
+     "ms": 1217,
+     "size": {
+      "nodes": 11,
+      "edges": 11,
+      "unresolved": 4
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "reindex",
+     "ms": 2199,
+     "size": {
+      "nodes": 11,
+      "edges": 11,
+      "unresolved": 4
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "sync-from-empty",
+     "ms": 1773,
+     "size": {
+      "nodes": 11,
+      "edges": 11,
+      "unresolved": 4
+     },
+     "verdict": "IDENTICAL"
+    }
+   ]
+  },
+  {
+   "dir": "/tmp/codegraph-pr29-harness-6fevujfy/qa/fixtures/oracle-candidates/pr29-22-ambiguous-branch",
+   "results": [
+    {
+     "mode": "base",
+     "ms": 1061,
+     "size": {
+      "nodes": 12,
+      "edges": 11,
+      "unresolved": 3
+     },
+     "verdict": "BASE"
+    },
+    {
+     "mode": "repeat",
+     "ms": 1037,
+     "size": {
+      "nodes": 12,
+      "edges": 11,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse1",
+     "ms": 995,
+     "size": {
+      "nodes": 12,
+      "edges": 11,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse4",
+     "ms": 1063,
+     "size": {
+      "nodes": 12,
+      "edges": 11,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "resolve-pool",
+     "ms": 1325,
+     "size": {
+      "nodes": 12,
+      "edges": 11,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-parallel-resolve",
+     "ms": 1026,
+     "size": {
+      "nodes": 12,
+      "edges": 11,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-store-worker",
+     "ms": 1025,
+     "size": {
+      "nodes": 12,
+      "edges": 11,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-fast-init",
+     "ms": 1141,
+     "size": {
+      "nodes": 12,
+      "edges": 11,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "reindex",
+     "ms": 2033,
+     "size": {
+      "nodes": 12,
+      "edges": 11,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "sync-from-empty",
+     "ms": 1650,
+     "size": {
+      "nodes": 12,
+      "edges": 11,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    }
+   ]
+  },
+  {
+   "dir": "/tmp/codegraph-pr29-harness-6fevujfy/qa/fixtures/oracle-candidates/pr29-23-agreeing-branch",
+   "results": [
+    {
+     "mode": "base",
+     "ms": 1002,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "BASE"
+    },
+    {
+     "mode": "repeat",
+     "ms": 1029,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse1",
+     "ms": 999,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse4",
+     "ms": 1076,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "resolve-pool",
+     "ms": 1301,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-parallel-resolve",
+     "ms": 995,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-store-worker",
+     "ms": 972,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-fast-init",
+     "ms": 1173,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "reindex",
+     "ms": 2105,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "sync-from-empty",
+     "ms": 1720,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    }
+   ]
+  },
+  {
+   "dir": "/tmp/codegraph-pr29-harness-6fevujfy/qa/fixtures/oracle-candidates/pr29-29-uncertain-receiver-alias",
+   "results": [
+    {
+     "mode": "base",
+     "ms": 1051,
+     "size": {
+      "nodes": 12,
+      "edges": 10,
+      "unresolved": 3
+     },
+     "verdict": "BASE"
+    },
+    {
+     "mode": "repeat",
+     "ms": 1175,
+     "size": {
+      "nodes": 12,
+      "edges": 10,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse1",
+     "ms": 1162,
+     "size": {
+      "nodes": 12,
+      "edges": 10,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse4",
+     "ms": 1222,
+     "size": {
+      "nodes": 12,
+      "edges": 10,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "resolve-pool",
+     "ms": 1645,
+     "size": {
+      "nodes": 12,
+      "edges": 10,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-parallel-resolve",
+     "ms": 1252,
+     "size": {
+      "nodes": 12,
+      "edges": 10,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-store-worker",
+     "ms": 1259,
+     "size": {
+      "nodes": 12,
+      "edges": 10,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-fast-init",
+     "ms": 1448,
+     "size": {
+      "nodes": 12,
+      "edges": 10,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "reindex",
+     "ms": 2381,
+     "size": {
+      "nodes": 12,
+      "edges": 10,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "sync-from-empty",
+     "ms": 1952,
+     "size": {
+      "nodes": 12,
+      "edges": 10,
+      "unresolved": 3
+     },
+     "verdict": "IDENTICAL"
+    }
+   ]
+  },
+  {
+   "dir": "/tmp/codegraph-pr29-harness-6fevujfy/qa/fixtures/oracle-candidates/pr29-32-logical-member-initialization",
+   "results": [
+    {
+     "mode": "base",
+     "ms": 1206,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "BASE"
+    },
+    {
+     "mode": "repeat",
+     "ms": 1160,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse1",
+     "ms": 1166,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse4",
+     "ms": 1243,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "resolve-pool",
+     "ms": 1603,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-parallel-resolve",
+     "ms": 1430,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-store-worker",
+     "ms": 1168,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-fast-init",
+     "ms": 1421,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "reindex",
+     "ms": 2513,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "sync-from-empty",
+     "ms": 2143,
+     "size": {
+      "nodes": 11,
+      "edges": 10,
+      "unresolved": 2
+     },
+     "verdict": "IDENTICAL"
+    }
+   ]
+  },
+  {
+   "dir": "/tmp/codegraph-pr29-harness-6fevujfy/qa/fixtures/oracle-candidates/n5-ts-barrel-member",
+   "results": [
+    {
+     "mode": "base",
+     "ms": 1345,
+     "size": {
+      "nodes": 15,
+      "edges": 18,
+      "unresolved": 1
+     },
+     "verdict": "BASE"
+    },
+    {
+     "mode": "repeat",
+     "ms": 1314,
+     "size": {
+      "nodes": 15,
+      "edges": 18,
+      "unresolved": 1
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse1",
+     "ms": 1241,
+     "size": {
+      "nodes": 15,
+      "edges": 18,
+      "unresolved": 1
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse4",
+     "ms": 1272,
+     "size": {
+      "nodes": 15,
+      "edges": 18,
+      "unresolved": 1
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "resolve-pool",
+     "ms": 1595,
+     "size": {
+      "nodes": 15,
+      "edges": 18,
+      "unresolved": 1
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-parallel-resolve",
+     "ms": 1176,
+     "size": {
+      "nodes": 15,
+      "edges": 18,
+      "unresolved": 1
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-store-worker",
+     "ms": 1161,
+     "size": {
+      "nodes": 15,
+      "edges": 18,
+      "unresolved": 1
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-fast-init",
+     "ms": 1341,
+     "size": {
+      "nodes": 15,
+      "edges": 18,
+      "unresolved": 1
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "reindex",
+     "ms": 2390,
+     "size": {
+      "nodes": 15,
+      "edges": 18,
+      "unresolved": 1
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "sync-from-empty",
+     "ms": 1971,
+     "size": {
+      "nodes": 15,
+      "edges": 18,
+      "unresolved": 1
+     },
+     "verdict": "IDENTICAL"
+    }
+   ]
+  },
+  {
+   "dir": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/express",
+   "results": [
+    {
+     "mode": "base",
+     "ms": 4430,
+     "size": {
+      "nodes": 1143,
+      "edges": 2270,
+      "unresolved": 9197
+     },
+     "verdict": "BASE"
+    },
+    {
+     "mode": "repeat",
+     "ms": 4364,
+     "size": {
+      "nodes": 1143,
+      "edges": 2270,
+      "unresolved": 9197
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse1",
+     "ms": 4725,
+     "size": {
+      "nodes": 1143,
+      "edges": 2270,
+      "unresolved": 9197
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse4",
+     "ms": 4471,
+     "size": {
+      "nodes": 1143,
+      "edges": 2270,
+      "unresolved": 9197
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "resolve-pool",
+     "ms": 4812,
+     "size": {
+      "nodes": 1143,
+      "edges": 2270,
+      "unresolved": 9197
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-parallel-resolve",
+     "ms": 4493,
+     "size": {
+      "nodes": 1143,
+      "edges": 2270,
+      "unresolved": 9197
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-store-worker",
+     "ms": 4628,
+     "size": {
+      "nodes": 1143,
+      "edges": 2270,
+      "unresolved": 9197
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-fast-init",
+     "ms": 4726,
+     "size": {
+      "nodes": 1143,
+      "edges": 2270,
+      "unresolved": 9197
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "reindex",
+     "ms": 10107,
+     "size": {
+      "nodes": 1143,
+      "edges": 2270,
+      "unresolved": 9197
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "sync-from-empty",
+     "ms": 7356,
+     "size": {
+      "nodes": 1143,
+      "edges": 2270,
+      "unresolved": 9197
+     },
+     "verdict": "IDENTICAL"
+    }
+   ]
+  },
+  {
+   "dir": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/requests",
+   "results": [
+    {
+     "mode": "base",
+     "ms": 2700,
+     "size": {
+      "nodes": 1299,
+      "edges": 2976,
+      "unresolved": 2345
+     },
+     "verdict": "BASE"
+    },
+    {
+     "mode": "repeat",
+     "ms": 2646,
+     "size": {
+      "nodes": 1299,
+      "edges": 2976,
+      "unresolved": 2345
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse1",
+     "ms": 2753,
+     "size": {
+      "nodes": 1299,
+      "edges": 2976,
+      "unresolved": 2345
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "parse4",
+     "ms": 2718,
+     "size": {
+      "nodes": 1299,
+      "edges": 2976,
+      "unresolved": 2345
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "resolve-pool",
+     "ms": 2855,
+     "size": {
+      "nodes": 1299,
+      "edges": 2976,
+      "unresolved": 2345
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-parallel-resolve",
+     "ms": 2651,
+     "size": {
+      "nodes": 1299,
+      "edges": 2976,
+      "unresolved": 2345
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-store-worker",
+     "ms": 2764,
+     "size": {
+      "nodes": 1299,
+      "edges": 2976,
+      "unresolved": 2345
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "no-fast-init",
+     "ms": 2984,
+     "size": {
+      "nodes": 1299,
+      "edges": 2976,
+      "unresolved": 2345
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "reindex",
+     "ms": 5403,
+     "size": {
+      "nodes": 1299,
+      "edges": 2976,
+      "unresolved": 2345
+     },
+     "verdict": "IDENTICAL"
+    },
+    {
+     "mode": "sync-from-empty",
+     "ms": 4720,
+     "size": {
+      "nodes": 1299,
+      "edges": 2976,
+      "unresolved": 2345
+     },
+     "verdict": "SAME-GRAPH"
+    }
+   ]
+  }
+ ]
+}
\ No newline at end of file
diff --git a/docs/handoffs/pr29-2026-11-10/harness/pr29-fixtures.json b/docs/handoffs/pr29-2026-11-10/harness/pr29-fixtures.json
new file mode 100644
index 0000000000..38cdfaa724
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/harness/pr29-fixtures.json
@@ -0,0 +1,194 @@
+[
+  {
+    "name": "pr29-01-f14-object",
+    "label": "F14 object",
+    "status": "positive",
+    "selector": "m.js:Store::load"
+  },
+  {
+    "name": "pr29-02-f14-class",
+    "label": "F14 class",
+    "status": "positive",
+    "selector": "m.js:Store::load"
+  },
+  {
+    "name": "pr29-03-f14-function",
+    "label": "F14 function",
+    "status": "positive",
+    "selector": "m.js:Store::load"
+  },
+  {
+    "name": "pr29-04-f15-number",
+    "label": "F15 number",
+    "status": "non-callable",
+    "selector": null
+  },
+  {
+    "name": "pr29-05-f15-string",
+    "label": "F15 string",
+    "status": "non-callable",
+    "selector": null
+  },
+  {
+    "name": "pr29-06-f15-assigned-callable",
+    "label": "F15 assigned callable",
+    "status": "positive",
+    "selector": "m.js:real"
+  },
+  {
+    "name": "pr29-07-f10-optional-wrapper",
+    "label": "F10 optional wrapper",
+    "status": "absent",
+    "selector": null
+  },
+  {
+    "name": "pr29-08-f11-generator-eval",
+    "label": "F11 generator eval",
+    "status": "positive",
+    "selector": "m.js:Store::load"
+  },
+  {
+    "name": "pr29-09-f11-generator-key-outside-generator",
+    "label": "F11 generator key outside generator",
+    "status": "absent",
+    "selector": null
+  },
+  {
+    "name": "pr29-10-f12-root-object",
+    "label": "F12 root object",
+    "status": "positive",
+    "selector": "m.js:Store::load"
+  },
+  {
+    "name": "pr29-11-f12-parenthesized-instance",
+    "label": "F12 parenthesized instance",
+    "status": "positive",
+    "selector": "m.js:Store::load"
+  },
+  {
+    "name": "pr29-12-f12-logical-instance",
+    "label": "F12 logical instance",
+    "status": "positive",
+    "selector": "m.js:Store::load"
+  },
+  {
+    "name": "pr29-13-f13-parameter",
+    "label": "F13 parameter",
+    "status": "absent",
+    "selector": null
+  },
+  {
+    "name": "pr29-14-f13-arrow",
+    "label": "F13 arrow",
+    "status": "absent",
+    "selector": null
+  },
+  {
+    "name": "pr29-15-f13-block",
+    "label": "F13 block",
+    "status": "absent",
+    "selector": null
+  },
+  {
+    "name": "pr29-16-alias-property-mutation",
+    "label": "alias property mutation",
+    "status": "positive",
+    "selector": "m.js:Store::load"
+  },
+  {
+    "name": "pr29-17-alias-rebind",
+    "label": "alias rebind",
+    "status": "absent",
+    "selector": null
+  },
+  {
+    "name": "pr29-18-property-overwrite",
+    "label": "property overwrite",
+    "status": "non-callable",
+    "selector": null
+  },
+  {
+    "name": "pr29-19-binding-overwrite",
+    "label": "binding overwrite",
+    "status": "absent",
+    "selector": null
+  },
+  {
+    "name": "pr29-20-post-export-write",
+    "label": "post-export write",
+    "status": "positive",
+    "selector": "m.js:Store::load"
+  },
+  {
+    "name": "pr29-21-old-exports-alias",
+    "label": "old exports alias",
+    "status": "absent",
+    "selector": null
+  },
+  {
+    "name": "pr29-22-ambiguous-branch",
+    "label": "ambiguous branch",
+    "status": "unknown",
+    "selector": null
+  },
+  {
+    "name": "pr29-23-agreeing-branch",
+    "label": "agreeing branch",
+    "status": "positive",
+    "selector": "m.js:Store::load"
+  },
+  {
+    "name": "pr29-24-opaque-escape",
+    "label": "opaque escape",
+    "status": "unknown",
+    "selector": null
+  },
+  {
+    "name": "pr29-25-unknown-dynamic-key",
+    "label": "unknown dynamic key",
+    "status": "unknown",
+    "selector": null
+  },
+  {
+    "name": "pr29-26-local-eval",
+    "label": "local eval",
+    "status": "absent",
+    "selector": null
+  },
+  {
+    "name": "pr29-27-literal-eval",
+    "label": "literal eval",
+    "status": "positive",
+    "selector": "m.js:Store::load"
+  },
+  {
+    "name": "pr29-28-eval-property-on-local-identity",
+    "label": "eval property on local identity",
+    "status": "positive",
+    "selector": "m.js:Store::load"
+  },
+  {
+    "name": "pr29-29-uncertain-receiver-alias",
+    "label": "uncertain receiver alias",
+    "status": "unknown",
+    "selector": null
+  },
+  {
+    "name": "pr29-30-data-overwrite-after-literal-eval",
+    "label": "data overwrite after literal eval",
+    "status": "non-callable",
+    "selector": null
+  },
+  {
+    "name": "pr29-31-missing-read-exported-as-undefined-data",
+    "label": "missing read exported as undefined data",
+    "status": "non-callable",
+    "selector": null
+  },
+  {
+    "name": "pr29-32-logical-member-initialization",
+    "label": "logical member initialization",
+    "status": "positive",
+    "selector": "m.js:Store::load"
+  }
+]
\ No newline at end of file
diff --git a/docs/handoffs/pr29-2026-11-10/harness/preservation-audit.json b/docs/handoffs/pr29-2026-11-10/harness/preservation-audit.json
new file mode 100644
index 0000000000..cc319933ab
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/harness/preservation-audit.json
@@ -0,0 +1,9 @@
+{
+  "checkedAt": "2026-11-10T11:18:35.214793+00:00",
+  "originalTrackedPathsChecked": 2019,
+  "originalChangedPaths": [],
+  "gitStatusUnchanged": true,
+  "workingDiffUnchanged": true,
+  "candidateSnapshotChangedPaths": [],
+  "stagedDiff": ""
+}
diff --git a/docs/handoffs/pr29-2026-11-10/harness/qa-input-sha256.json b/docs/handoffs/pr29-2026-11-10/harness/qa-input-sha256.json
new file mode 100644
index 0000000000..e703c6d343
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/harness/qa-input-sha256.json
@@ -0,0 +1,1836 @@
+{
+  "files": [
+    {
+      "sha256": "6b4faee7cbdb1494396111cc3e96a67114a0e28d8249fe50dfb9eb6a9f8fe8e1",
+      "path": "bin/cgqa"
+    },
+    {
+      "sha256": "3692cc0ac001ce2b88fb78746fbbfdddc0de9ac722c4ce1b1320c5cd7ec87ed3",
+      "path": "metamorphic/relations.mjs"
+    },
+    {
+      "sha256": "61c36ac885780a1d0ed396bbc3363f091ec4dd2f92b25a478c2c8b9ed4315ecb",
+      "path": "metamorphic/run.mjs"
+    },
+    {
+      "sha256": "4bc03d739287d5fbc251ab02fc963e33ff81deb0ea599a41345600c76f9e8c5a",
+      "path": "lib/scores-test.mjs"
+    },
+    {
+      "sha256": "de1bc933b9c4856f9e235d054e0dfd7595c4ed7bffc78594174488ee53eb9924",
+      "path": "lib/anti-gaming-test.mjs"
+    },
+    {
+      "sha256": "ae36e0142cbc7899a2ae41083387fa879f42686db28d25bd8e8e4c299158b359",
+      "path": "lib/fixture.mjs"
+    },
+    {
+      "sha256": "30cce70cf048cbac961d845375c622af3f34b389ef6e04023ae65556cc206a26",
+      "path": "lib/snapshot.mjs"
+    },
+    {
+      "sha256": "2e4b2328dceb4994b9733e64cd3e75751e1ba843f34f9d31345c11aab1722c73",
+      "path": "lib/conformance.mjs"
+    },
+    {
+      "sha256": "4bac861cbf636fc134ba72317247e144601ffe62d8c4bf2bfde798686d9932c0",
+      "path": "lib/expect.mjs"
+    },
+    {
+      "sha256": "bb19968325f3ca5360e70c87720648eb96606edb70437b296d1cf1a5a9eb457d",
+      "path": "lib/provenance.mjs"
+    },
+    {
+      "sha256": "499d692bae5ea5028d2f299f87fdd7e5a5f05bf013818860a5cd5d8adfda4ead",
+      "path": "lib/manifest.mjs"
+    },
+    {
+      "sha256": "f287639d22f91a169eb8a854862af745a45e43da703ee07658e6cf7ca2855d95",
+      "path": "lib/config.mjs"
+    },
+    {
+      "sha256": "9a4a2c0be2af5b539b4e7037ee84b7d1fcf3a854c4e35efef15e5395f182a2ff",
+      "path": "lib/scores.mjs"
+    },
+    {
+      "sha256": "340242976dcef5573a8c5eb4b565047c16376d1938cb6c60807637554c2f00b1",
+      "path": "lib/scip.mjs"
+    },
+    {
+      "sha256": "1529a2c1c7d3727bff3e98eda250eee401daa67f88f3df9b0cbe00e03381e47f",
+      "path": "fixtures/replay.mjs"
+    },
+    {
+      "sha256": "486afcfd5d6fa4a9acaa7f976b55e34f8f7588a29829fdeb5665f45c382655b8",
+      "path": "differential/questions.json"
+    },
+    {
+      "sha256": "18ffb861ffbbcaa823f42b56a19ea7e2c105a23bb575779829151a772c33d20d",
+      "path": "differential/modes.mjs"
+    },
+    {
+      "sha256": "82c2971a79dee37c22e4d9fdc40e49ae580260b9beb901f0dfecf52989370915",
+      "path": "differential/builds.mjs"
+    },
+    {
+      "sha256": "dd1d13e73a3cbee4bc7f588b7a6eeaa0dfe2c766ecc900bc05df82b7d210a89d",
+      "path": "differential/shadow.mjs"
+    },
+    {
+      "sha256": "4476b1caae91cfe702011b960812b92f9fe2befe1656970a6fdd7e7b862b04ae",
+      "path": "differential/test.mjs"
+    },
+    {
+      "sha256": "7ed3c61549a2cfd3bbf78cba6266b20ae9e9d52afd096fb2464960e0116481bb",
+      "path": "corpus/v1.txt"
+    },
+    {
+      "sha256": "e6aa7e0d6c81c1d04435958ea610058b998c670da8d9954306bd65cbc940ad22",
+      "path": "corpus/v2.txt"
+    },
+    {
+      "sha256": "5fb6ea6bafcd92bab76950464409b396e02197d0017c5dc7f14a1012b78e0633",
+      "path": "schema/questions.v1.json"
+    },
+    {
+      "sha256": "565a8b9580fee9606ea81af6bcb2ba616555dec542aa9ae54160aa877b8a8b20",
+      "path": "schema/expect.v1.json"
+    },
+    {
+      "sha256": "0c46e4efb1dcd7bf91675c3caa3fb1069459e593584e192bcc371454f371e049",
+      "path": "schema/snapshot.v1.json"
+    },
+    {
+      "sha256": "b4b9225a687440498b963a50fe6b2d6229586f1923e7ae2acc787e279b9fc68a",
+      "path": "oracle/oracle.mjs"
+    },
+    {
+      "sha256": "3a11985108f1eb46a8eebb292811952a7ea6adad5238b78880f33b714b93ec58",
+      "path": "oracle/scip-java.sh"
+    },
+    {
+      "sha256": "6388f3f27f865589f39e7db53f3f8f28cd46210c88933da5deedce3281016098",
+      "path": "oracle/targets.txt"
+    },
+    {
+      "sha256": "e3bf0a21b4d4c48954de844737e3aef52748f7079892d8da96c6baf320292043",
+      "path": "oracle/baseline.mjs"
+    },
+    {
+      "sha256": "5f714ee1083e4132e7fd513332c10d04370b3625fa460dee5fac6d5c47be5688",
+      "path": "oracle/site.mjs"
+    },
+    {
+      "sha256": "a82e5eace691c5a9444779b2fb6bc756bcc0e94972d51d28899bcbd0466f7ec7",
+      "path": "oracle/scip-python.sh"
+    },
+    {
+      "sha256": "b7299fcd5326b72f5e5196722a24408d74949d1f1f1eafc6946d5514c1e17e1a",
+      "path": "oracle/run.sh"
+    },
+    {
+      "sha256": "918a011f6b642050add4d7cfb720962910dd2df35a0159cfc29b8f9c8e46d828",
+      "path": "oracle/run-all.sh"
+    },
+    {
+      "sha256": "2793723074234e7e74aa9165f9012a4b82876a72b1f5dbba46887914e50d56c6",
+      "path": "oracle/site-test.mjs"
+    },
+    {
+      "sha256": "5f7696ee9b5741c9a58507b574153c22e9e045fc19cafb02e457c2328fc84cd7",
+      "path": "oracle/test/regen.mjs"
+    },
+    {
+      "sha256": "10b0e3dba0c464dc1a2e8e403e3d8c7d677a1965aa1d28d64f8db49a43c5c3be",
+      "path": "oracle/test/run.mjs"
+    },
+    {
+      "sha256": "3d8c14cc02fd5be543a52c2e43847412c3af079fd839ce13bed9fa5e6aecb127",
+      "path": "oracle/test/js-missing/case.json"
+    },
+    {
+      "sha256": "d5479ea82e1d2058415b15962855fe639068165e53831c48f8d23fbe991c7224",
+      "path": "oracle/test/js-missing/index.scip.json"
+    },
+    {
+      "sha256": "9fdb81ad750da09eceb3becca3b2a1ab46692f5420f7d951cd6ecec482aa173f",
+      "path": "oracle/test/js-missing/lib.js"
+    },
+    {
+      "sha256": "4e80bbba261ca5f24d171832cb171755b6087232fe8f4ff2630cc50a6815d380",
+      "path": "oracle/test/js-missing/use.js"
+    },
+    {
+      "sha256": "a91b396ec0382577526190026523f560ed9ba811ccaa2eff152456e2b9bf5055",
+      "path": "oracle/test/js-missing/snapshot.json"
+    },
+    {
+      "sha256": "1819aa6268f637cd42eb7e88b50ad53703e872f839405ef99d0d4bb84f6c5c86",
+      "path": "oracle/test/py-forward/closure.py"
+    },
+    {
+      "sha256": "f13c97e3621f055b793aa8013649cd4cd16e31ffb5520d4afb1537b749bf5d81",
+      "path": "oracle/test/py-forward/shadow.py"
+    },
+    {
+      "sha256": "c283dab55a7a5e93fd0db00aa0f685968d904d598d1b47e52006f73ec8ef0866",
+      "path": "oracle/test/py-forward/case.json"
+    },
+    {
+      "sha256": "9faab3a2eaec3f83d6a8496ded312b8b12215b25cb255247db9275452d817f3e",
+      "path": "oracle/test/py-forward/imported.py"
+    },
+    {
+      "sha256": "b5245e36a3abf8cfa742ece91c3b405ab6a11c7da68547a9b2b30ca6a2d0ea7f",
+      "path": "oracle/test/py-forward/raiser.py"
+    },
+    {
+      "sha256": "a5c4ee17ea50dd6633b428e7f47ef67f07f2360205be41cac8b47edd3ea2150f",
+      "path": "oracle/test/py-forward/twice.py"
+    },
+    {
+      "sha256": "170b2d2b78d87f56d485a43142c5dab20a8b3f4cf2ff4a16c593353a93059aa7",
+      "path": "oracle/test/py-forward/test_fix.py"
+    },
+    {
+      "sha256": "f5ccc600161d44272c15524bd4498fe4bdecdf956bda29bf81e5fdc4c7fcfd9a",
+      "path": "oracle/test/py-forward/index.scip.json"
+    },
+    {
+      "sha256": "1519363cefdc3b99aaa2d1802933137e8774138b36d5495e7e401819caa39f95",
+      "path": "oracle/test/py-forward/snapshot.json"
+    },
+    {
+      "sha256": "a1a60eb305bc026e880dce8b3ac6a73bf13d1ea124f50c98218cd58bf681786f",
+      "path": "oracle/test/ts-forward/api.ts"
+    },
+    {
+      "sha256": "8588114d305b603c5222ff516ba3e6216eaea8587da130c8cb3562859ac2f383",
+      "path": "oracle/test/ts-forward/db.ts"
+    },
+    {
+      "sha256": "53b6333bd2ff6b52d0865702d5a2ed2adda2f8d9bdb0e1912201b03be7654eec",
+      "path": "oracle/test/ts-forward/widget.ts"
+    },
+    {
+      "sha256": "f025b3438417820a352be8be4927eeb4a22208c7ca8bb8ffbc7a9b706632b322",
+      "path": "oracle/test/ts-forward/heap.ts"
+    },
+    {
+      "sha256": "b3efef6ef5896a9e9eb4c53d4b215ac29213d5928486d39e18d9e1b8f08b85ee",
+      "path": "oracle/test/ts-forward/tsconfig.json"
+    },
+    {
+      "sha256": "bd45fcd16fc2227b397345ffc0e5e7b4c5f07f5061157af50b1c4a833339f72c",
+      "path": "oracle/test/ts-forward/case.json"
+    },
+    {
+      "sha256": "c2471844a7ba8931d847a6d0fdee13da649fa50a450c6c5d43c0f55b63c696b4",
+      "path": "oracle/test/ts-forward/scene.ts"
+    },
+    {
+      "sha256": "6cffe8884ba774d32d3f22422eeb058827d20ffe81e61b28b591d605d41dcad4",
+      "path": "oracle/test/ts-forward/package.json"
+    },
+    {
+      "sha256": "effd182ec8e8fb2529f793118f57a2bea5bfcc8abf9fa45d043944bd156e5c65",
+      "path": "oracle/test/ts-forward/dyn.ts"
+    },
+    {
+      "sha256": "840d4bcc25722ca40660a5b56ff946b2f4e49db772cdc47bbcac439a2322a89b",
+      "path": "oracle/test/ts-forward/helper.mjs"
+    },
+    {
+      "sha256": "db2d681977adb2e57d64f5e825e35fbdca705b5135f9f5fde292eb5bb31800da",
+      "path": "oracle/test/ts-forward/lib.ts"
+    },
+    {
+      "sha256": "c404d811e91409a42a6fc0f726fdaa867cf889a958af38e9ee7c7fece8005efe",
+      "path": "oracle/test/ts-forward/index.scip.json"
+    },
+    {
+      "sha256": "382940f8129ef52632b18fecd01f1e4a07c6f4d478f4a422fc90d35ae5522da6",
+      "path": "oracle/test/ts-forward/conf.ts"
+    },
+    {
+      "sha256": "1b607244f56bd3a8742844f8b99129bd2dd604784c8327eb4bf5a56fdd954aa6",
+      "path": "oracle/test/ts-forward/outside.ts"
+    },
+    {
+      "sha256": "066fd9802bf0478aad6d8ef3e471c145402102ca2aad63a16f7f73e6a5a713be",
+      "path": "oracle/test/ts-forward/store.ts"
+    },
+    {
+      "sha256": "9c8a335db772c04044695516ded69ddf3c86afd843652bda1333980d4365a1a2",
+      "path": "oracle/test/ts-forward/snapshot.json"
+    },
+    {
+      "sha256": "cea271c0cac40dd2fa179a6ffcddd03793219a102a2c1c70a0e07f37c8929947",
+      "path": "oracle/test/py-missing/base.py"
+    },
+    {
+      "sha256": "ce6b949bc89bcf024f007cbdadec805c3008db22630f22bb801aadf13fcdafce",
+      "path": "oracle/test/py-missing/case.json"
+    },
+    {
+      "sha256": "a5892c4b3e084df90c94f2043fa9909b926abb11e2c02871ca11f04c566f469a",
+      "path": "oracle/test/py-missing/index.scip.json"
+    },
+    {
+      "sha256": "bb8c5bc3da5f40a6da07c05b794115e9e9a8ed7cd725d3fe26ff10aa306429d1",
+      "path": "oracle/test/py-missing/snapshot.json"
+    },
+    {
+      "sha256": "eac96a79e4507b4642c7b64104fe1c8f49765ef62f939a30a06c09f1cd9bf003",
+      "path": "oracle/test/py-overload/case.json"
+    },
+    {
+      "sha256": "dc4c5f32d0ee773de6bef3a75f4151919f3a754da1cc93edb04b707e1dc7f472",
+      "path": "oracle/test/py-overload/use.py"
+    },
+    {
+      "sha256": "9af0e87823a830210c0bda8bf64c6bf38cccc873edbe7b2ae1c49b4c509ecaf6",
+      "path": "oracle/test/py-overload/index.scip.json"
+    },
+    {
+      "sha256": "1f0c076a7c5cc1dbc4bea7c2c7b892e0f82b866538361c8bfa3192cbc341d5a5",
+      "path": "oracle/test/py-overload/ctx.py"
+    },
+    {
+      "sha256": "b845b43f379b96e3ed57324a8a9ff56f34b1c3a8470764e7b0be551549b70f0d",
+      "path": "oracle/test/py-overload/snapshot.json"
+    },
+    {
+      "sha256": "5ffb2b6bd36870fb903b08316b074e417779a60aa4d06eac544dc9a27c6eb869",
+      "path": "oracle/test/ts-missing/shapes.ts"
+    },
+    {
+      "sha256": "ed3144839ab14cdd52e668bab481391bbbd7870e09c6d0f01d5c92fe3d7fde47",
+      "path": "oracle/test/ts-missing/tsconfig.json"
+    },
+    {
+      "sha256": "64007ac4cdbbe7eb0217147ccd8972d353873adb91c181dad387ec562c50e5e3",
+      "path": "oracle/test/ts-missing/case.json"
+    },
+    {
+      "sha256": "b19dfd9dcb4bc8190d54e5f7421d4050e44ece61757166b690f3624884eb71f6",
+      "path": "oracle/test/ts-missing/index.scip.json"
+    },
+    {
+      "sha256": "3fa746ac44f74227c75dcf327e6db14c3faaa77dfe2efbf779eda018d4d6f550",
+      "path": "oracle/test/ts-missing/snapshot.json"
+    },
+    {
+      "sha256": "325d25fce6ad0d989235bbd2d491c877643771ad06d7666b83d369ea3ee554a6",
+      "path": "oracle/test/ts-forward/app/page.tsx"
+    },
+    {
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+      "path": "oracle/test/py-forward/other/__init__.py"
+    },
+    {
+      "sha256": "9bf52028a5d7f3f17bd2c01dcb4ec81d65727930ecea759f4ea8d5a12f808ee9",
+      "path": "oracle/test/py-forward/other/far.py"
+    },
+    {
+      "sha256": "7dfbadcbe4903aac566bdf53e8b9b95c138d6944c36a215608fe9e2cb1e945c3",
+      "path": "oracle/test/py-forward/ex/tsp/evaluator.py"
+    },
+    {
+      "sha256": "76d1e4850e9ad55a6da70d47695fb9c8f2879f126c8a805742a6453c80b713ef",
+      "path": "oracle/test/py-forward/ex/tsp/utils/utils.py"
+    },
+    {
+      "sha256": "2ce51da88e2be7d26e625c8695fcec7a9ec7b566a2b6d55af42ec8b969c5b896",
+      "path": "fixtures/sync-history/H-size-cap-shrink.mjs"
+    },
+    {
+      "sha256": "b262816de11efe9230c25c74b3d5fb9728756075e9c07fa96db0c4d0c2ba741f",
+      "path": "fixtures/sync-history/fx.sh"
+    },
+    {
+      "sha256": "829c5ca1146939d24f0bfd4ae3fc8aff06b5c5045590a111b6075c8b967841ed",
+      "path": "fixtures/sync-history/rp.mjs"
+    },
+    {
+      "sha256": "3b7faae62d19a582b848150175e7268221afbfea6c626266fd7cc620e6061c34",
+      "path": "fixtures/oracle-candidates/p1/expect.json"
+    },
+    {
+      "sha256": "f952a9690ae8f6bc4eaa1b0ea8cbd9cfdc805f863a50639789e90f161b672a09",
+      "path": "fixtures/oracle-candidates/p1/t.py"
+    },
+    {
+      "sha256": "ebb4055c6f1be938a0e03be7bb7957088c44ebaa5f051daa1a1dc899ab08463e",
+      "path": "fixtures/oracle-candidates/pr29-07-f10-optional-wrapper/m.js"
+    },
+    {
+      "sha256": "a0ab23316c59805d661e3afd64df9c2d9bb630a29482682d8c7aef9870d4cb22",
+      "path": "fixtures/oracle-candidates/pr29-07-f10-optional-wrapper/expect.json"
+    },
+    {
+      "sha256": "b0fbccb47ab8d128f1e2bf779f5a13e42cdf18716507fea811c640478c39565d",
+      "path": "fixtures/oracle-candidates/pr29-07-f10-optional-wrapper/decoy.js"
+    },
+    {
+      "sha256": "42fc2f059791bb8d60a80208840e783df7888bb0c4a8601fc5e03229791ab3bb",
+      "path": "fixtures/oracle-candidates/pr29-07-f10-optional-wrapper/index.js"
+    },
+    {
+      "sha256": "9e5f1f415ea438751c9427b105a2b0db5a51ad362b24c284ede676ef8b3f5656",
+      "path": "fixtures/oracle-candidates/pr29-07-f10-optional-wrapper/use.js"
+    },
+    {
+      "sha256": "85b236b4aa3a2473696f398147d8ba9ccafa0b812038aa96e20c30bef20edc1f",
+      "path": "fixtures/oracle-candidates/issue-2954/expect.json"
+    },
+    {
+      "sha256": "66ffde7681621be4c58f3d066afb396accab511938c6f9ac2552e0cd800c2792",
+      "path": "fixtures/oracle-candidates/issue-2954/lib.ts"
+    },
+    {
+      "sha256": "26bb2f8d651d2915401193460814ac36e0f49673b54d8189e4f4c20231ac8c8a",
+      "path": "fixtures/oracle-candidates/issue-2954/tools.ts"
+    },
+    {
+      "sha256": "1e1839dcb8db2911cc49ef8b1973aaea44ba040388403d17957cfb47c229a09f",
+      "path": "fixtures/oracle-candidates/issue-2949/expect.json"
+    },
+    {
+      "sha256": "aa9ee880fd19c7a90cce15848809d0ce3da2b1d3143fdaed5fa8b596a7beac39",
+      "path": "fixtures/oracle-candidates/issue-2949/lib.ts"
+    },
+    {
+      "sha256": "69c3676ce35cd5461b85912d88163093bd90816bbfcfe880179c49cffb383e59",
+      "path": "fixtures/oracle-candidates/issue-2949/use.ts"
+    },
+    {
+      "sha256": "f333e17c664371f1a91f3b401ec79360923f08cf5e29e4bb2d4a11cbd1ddc1ad",
+      "path": "fixtures/oracle-candidates/pr29-21-old-exports-alias/m.js"
+    },
+    {
+      "sha256": "a0ab23316c59805d661e3afd64df9c2d9bb630a29482682d8c7aef9870d4cb22",
+      "path": "fixtures/oracle-candidates/pr29-21-old-exports-alias/expect.json"
+    },
+    {
+      "sha256": "b0fbccb47ab8d128f1e2bf779f5a13e42cdf18716507fea811c640478c39565d",
+      "path": "fixtures/oracle-candidates/pr29-21-old-exports-alias/decoy.js"
+    },
+    {
+      "sha256": "42fc2f059791bb8d60a80208840e783df7888bb0c4a8601fc5e03229791ab3bb",
+      "path": "fixtures/oracle-candidates/pr29-21-old-exports-alias/index.js"
+    },
+    {
+      "sha256": "9e5f1f415ea438751c9427b105a2b0db5a51ad362b24c284ede676ef8b3f5656",
+      "path": "fixtures/oracle-candidates/pr29-21-old-exports-alias/use.js"
+    },
+    {
+      "sha256": "b0daad482806702bbd2d7fc509baabb896ffb801424224be84feef29b12a6c15",
+      "path": "fixtures/oracle-candidates/issue-2948/heap.ts"
+    },
+    {
+      "sha256": "a8264bddb498f480a37e89a1de89fd8020cb5cfbcae31b739666895e3668bad5",
+      "path": "fixtures/oracle-candidates/issue-2948/expect.json"
+    },
+    {
+      "sha256": "46112efe2524e4fd833ad9bf3421184617abc2de6f3395e5b09b0efababb1b83",
+      "path": "fixtures/oracle-candidates/issue-2948/use.ts"
+    },
+    {
+      "sha256": "91e7d67dde88860c783a83817ebdf00412a71a3579903aa81d4d696befeae9d0",
+      "path": "fixtures/oracle-candidates/issue-2967/mod.ts"
+    },
+    {
+      "sha256": "b4ec5093519f31d71a12a3b7a3763698b565b404adae57f11e5277e56772bad9",
+      "path": "fixtures/oracle-candidates/issue-2967/mod.js"
+    },
+    {
+      "sha256": "d37e4ab8679ebb76f24914b8a7521408242ac0e05290c7def708102a4e79c0c7",
+      "path": "fixtures/oracle-candidates/issue-2967/use.tsx"
+    },
+    {
+      "sha256": "f26ace7f9dda3befd5a8adf642e86ecc95f545f9600ded3b65d7908d4242969f",
+      "path": "fixtures/oracle-candidates/issue-2967/expect.json"
+    },
+    {
+      "sha256": "71363223b4ecd53d7e192b10d93b0c09e71d12211fdc1cc96c56ef27e27dac1a",
+      "path": "fixtures/oracle-candidates/issue-2967/page.tsx"
+    },
+    {
+      "sha256": "2fe8f2c7a4dedd0da10df50138cb44fa92b82bd806536990ddd2f9ba00ace071",
+      "path": "fixtures/oracle-candidates/issue-2967/use.ts"
+    },
+    {
+      "sha256": "0e8baaedd38305834af4c80b3720affeda047535bcd95b2d491a139565faaf22",
+      "path": "fixtures/oracle-candidates/issue-2967/use.js"
+    },
+    {
+      "sha256": "1400e76760cde6bb4813bda3f98a72d74b465ac2533c0890387f265754018151",
+      "path": "fixtures/oracle-candidates/p5-py-stdlib-import/expect.json"
+    },
+    {
+      "sha256": "46e28cbb94d4284c88f9cbb5e0f3dc509b68981f1cc8711d894019e0e9050153",
+      "path": "fixtures/oracle-candidates/p5-py-stdlib-import/use.py"
+    },
+    {
+      "sha256": "743fa6c7072a1a850cbcc407981640469d59e83a946ffbdf49f6bbbf3b27a9b0",
+      "path": "fixtures/oracle-candidates/p5-py-stdlib-import/clock.py"
+    },
+    {
+      "sha256": "0acf06d57dbba754e1b17266cdd6fe0858a75dd069ca27066d5cea035115112c",
+      "path": "fixtures/oracle-candidates/pr29-20-post-export-write/m.js"
+    },
+    {
+      "sha256": "0fafb03bd978c9d85cca857293a329daba849d2ea66d9eed3c2d6db9bf3fae6c",
+      "path": "fixtures/oracle-candidates/pr29-20-post-export-write/expect.json"
+    },
+    {
+      "sha256": "b0fbccb47ab8d128f1e2bf779f5a13e42cdf18716507fea811c640478c39565d",
+      "path": "fixtures/oracle-candidates/pr29-20-post-export-write/decoy.js"
+    },
+    {
+      "sha256": "42fc2f059791bb8d60a80208840e783df7888bb0c4a8601fc5e03229791ab3bb",
+      "path": "fixtures/oracle-candidates/pr29-20-post-export-write/index.js"
+    },
+    {
+      "sha256": "9e5f1f415ea438751c9427b105a2b0db5a51ad362b24c284ede676ef8b3f5656",
+      "path": "fixtures/oracle-candidates/pr29-20-post-export-write/use.js"
+    },
+    {
+      "sha256": "943ce79856b8df6a5d8a1bbaf6b3a6508649b016fcee36cb050e73ca22dacb46",
+      "path": "fixtures/oracle-candidates/c/orch.ts"
+    },
+    {
+      "sha256": "95f5917e8f3258e18faa4c1bc76da22fd9189d1ebdf8725665bc9e8a442be803",
+      "path": "fixtures/oracle-candidates/c/expect.json"
+    },
+    {
+      "sha256": "c74fc3ad8bd134c612a57012b3df5486b33eed14d97b8d202d977ce03ea8a985",
+      "path": "fixtures/oracle-candidates/c/cache.ts"
+    },
+    {
+      "sha256": "b839557a1c7a0462aec83a2e34f32871dbd95764d32e104e1bdd7080a0690c79",
+      "path": "fixtures/oracle-candidates/issue-2952/expect.json"
+    },
+    {
+      "sha256": "812bddc1e2b9652ae37ff5dc552ea4ef3311e56ab8a845cc1211fe261a0ba2d7",
+      "path": "fixtures/oracle-candidates/pr29-28-eval-property-on-local-identity/m.js"
+    },
+    {
+      "sha256": "0fafb03bd978c9d85cca857293a329daba849d2ea66d9eed3c2d6db9bf3fae6c",
+      "path": "fixtures/oracle-candidates/pr29-28-eval-property-on-local-identity/expect.json"
+    },
+    {
+      "sha256": "b0fbccb47ab8d128f1e2bf779f5a13e42cdf18716507fea811c640478c39565d",
+      "path": "fixtures/oracle-candidates/pr29-28-eval-property-on-local-identity/decoy.js"
+    },
+    {
+      "sha256": "42fc2f059791bb8d60a80208840e783df7888bb0c4a8601fc5e03229791ab3bb",
+      "path": "fixtures/oracle-candidates/pr29-28-eval-property-on-local-identity/index.js"
+    },
+    {
+      "sha256": "9e5f1f415ea438751c9427b105a2b0db5a51ad362b24c284ede676ef8b3f5656",
+      "path": "fixtures/oracle-candidates/pr29-28-eval-property-on-local-identity/use.js"
+    },
+    {
+      "sha256": "bbb41f20ed7554a859e89829e126c86fe2c349849cb67f874b1b8b4668c07306",
+      "path": "fixtures/oracle-candidates/pr29-24-opaque-escape/m.js"
+    },
+    {
+      "sha256": "a0ab23316c59805d661e3afd64df9c2d9bb630a29482682d8c7aef9870d4cb22",
+      "path": "fixtures/oracle-candidates/pr29-24-opaque-escape/expect.json"
+    },
+    {
+      "sha256": "b0fbccb47ab8d128f1e2bf779f5a13e42cdf18716507fea811c640478c39565d",
+      "path": "fixtures/oracle-candidates/pr29-24-opaque-escape/decoy.js"
+    },
+    {
+      "sha256": "42fc2f059791bb8d60a80208840e783df7888bb0c4a8601fc5e03229791ab3bb",
+      "path": "fixtures/oracle-candidates/pr29-24-opaque-escape/index.js"
+    },
+    {
+      "sha256": "9e5f1f415ea438751c9427b105a2b0db5a51ad362b24c284ede676ef8b3f5656",
+      "path": "fixtures/oracle-candidates/pr29-24-opaque-escape/use.js"
+    },
+    {
+      "sha256": "5026727d51bac41e02b5cb3bd3ea65f898d761030019af0714cd53cdb2bf3585",
+      "path": "fixtures/oracle-candidates/p3/expect.json"
+    },
+    {
+      "sha256": "614531d59c47f80f9801dfe302f6c07c2485a8072d84175e5630703bb941bd3c",
+      "path": "fixtures/oracle-candidates/p3/use.py"
+    },
+    {
+      "sha256": "355fc11e1231893ab01182dee5133adb99c999368c7e5efe241b9c5984e52ebd",
+      "path": "fixtures/oracle-candidates/p3/arm.py"
+    },
+    {
+      "sha256": "68125fb77a45e7840ec8e796dc037d8bee78bee0b761d2b35e032d8d92b128c9",
+      "path": "fixtures/oracle-candidates/issue-2944/expect.json"
+    },
+    {
+      "sha256": "9a5adb9e66d18b36a5d01fb5abbfff2c9f7976d8bb6e6f5c1da6bea917f282ec",
+      "path": "fixtures/oracle-candidates/issue-2944/decl.d.ts"
+    },
+    {
+      "sha256": "1f5fc69b9e51ab1a59cb96b12d7a29586a0d84fcc34d18e31b3a2de3f1642db5",
+      "path": "fixtures/oracle-candidates/issue-2944/a.test.ts"
+    },
+    {
+      "sha256": "6701650334a24b606e652522e62bac01bab173f9bac37da9023377a129bf2df0",
+      "path": "fixtures/oracle-candidates/pr29-23-agreeing-branch/m.js"
+    },
+    {
+      "sha256": "0fafb03bd978c9d85cca857293a329daba849d2ea66d9eed3c2d6db9bf3fae6c",
+      "path": "fixtures/oracle-candidates/pr29-23-agreeing-branch/expect.json"
+    },
+    {
+      "sha256": "b0fbccb47ab8d128f1e2bf779f5a13e42cdf18716507fea811c640478c39565d",
+      "path": "fixtures/oracle-candidates/pr29-23-agreeing-branch/decoy.js"
+    },
+    {
+      "sha256": "42fc2f059791bb8d60a80208840e783df7888bb0c4a8601fc5e03229791ab3bb",
+      "path": "fixtures/oracle-candidates/pr29-23-agreeing-branch/index.js"
+    },
+    {
+      "sha256": "9e5f1f415ea438751c9427b105a2b0db5a51ad362b24c284ede676ef8b3f5656",
+      "path": "fixtures/oracle-candidates/pr29-23-agreeing-branch/use.js"
+    },
+    {
+      "sha256": "f803bd22bdeb496690a9734334e3693e39ce1465ae8f95901c190442b8b4926e",
+      "path": "fixtures/oracle-candidates/pr29-14-f13-arrow/m.js"
+    },
+    {
+      "sha256": "a0ab23316c59805d661e3afd64df9c2d9bb630a29482682d8c7aef9870d4cb22",
+      "path": "fixtures/oracle-candidates/pr29-14-f13-arrow/expect.json"
+    },
+    {
+      "sha256": "b0fbccb47ab8d128f1e2bf779f5a13e42cdf18716507fea811c640478c39565d",
+      "path": "fixtures/oracle-candidates/pr29-14-f13-arrow/decoy.js"
+    },
+    {
+      "sha256": "42fc2f059791bb8d60a80208840e783df7888bb0c4a8601fc5e03229791ab3bb",
+      "path": "fixtures/oracle-candidates/pr29-14-f13-arrow/index.js"
+    },
+    {
+      "sha256": "9e5f1f415ea438751c9427b105a2b0db5a51ad362b24c284ede676ef8b3f5656",
+      "path": "fixtures/oracle-candidates/pr29-14-f13-arrow/use.js"
+    },
+    {
+      "sha256": "719d727c957229c005342581081c50503046fa1bb564d0b0afceae73fa03242f",
+      "path": "fixtures/oracle-candidates/n3-py-enclosing-local/expect.json"
+    },
+    {
+      "sha256": "8e518ff23f77614d52d0f41defe24aa6772a018f8474ef7a86243c2ca4ef6c8d",
+      "path": "fixtures/oracle-candidates/n3-py-enclosing-local/t.py"
+    },
+    {
+      "sha256": "432c80ce5cddcd5c09d8d6da7fad547385a912b9625f3ef317f5e4730eba31f8",
+      "path": "fixtures/oracle-candidates/pr29-10-f12-root-object/m.js"
+    },
+    {
+      "sha256": "0fafb03bd978c9d85cca857293a329daba849d2ea66d9eed3c2d6db9bf3fae6c",
+      "path": "fixtures/oracle-candidates/pr29-10-f12-root-object/expect.json"
+    },
+    {
+      "sha256": "b0fbccb47ab8d128f1e2bf779f5a13e42cdf18716507fea811c640478c39565d",
+      "path": "fixtures/oracle-candidates/pr29-10-f12-root-object/decoy.js"
+    },
+    {
+      "sha256": "42fc2f059791bb8d60a80208840e783df7888bb0c4a8601fc5e03229791ab3bb",
+      "path": "fixtures/oracle-candidates/pr29-10-f12-root-object/index.js"
+    },
+    {
+      "sha256": "9e5f1f415ea438751c9427b105a2b0db5a51ad362b24c284ede676ef8b3f5656",
+      "path": "fixtures/oracle-candidates/pr29-10-f12-root-object/use.js"
+    },
+    {
+      "sha256": "1eb7c4b356cde690bb362a74b8fcece5f909bede4113dae104aeb257011707b2",
+      "path": "fixtures/oracle-candidates/pr29-30-data-overwrite-after-literal-eval/m.js"
+    },
+    {
+      "sha256": "a0ab23316c59805d661e3afd64df9c2d9bb630a29482682d8c7aef9870d4cb22",
+      "path": "fixtures/oracle-candidates/pr29-30-data-overwrite-after-literal-eval/expect.json"
+    },
+    {
+      "sha256": "b0fbccb47ab8d128f1e2bf779f5a13e42cdf18716507fea811c640478c39565d",
+      "path": "fixtures/oracle-candidates/pr29-30-data-overwrite-after-literal-eval/decoy.js"
+    },
+    {
+      "sha256": "42fc2f059791bb8d60a80208840e783df7888bb0c4a8601fc5e03229791ab3bb",
+      "path": "fixtures/oracle-candidates/pr29-30-data-overwrite-after-literal-eval/index.js"
+    },
+    {
+      "sha256": "9e5f1f415ea438751c9427b105a2b0db5a51ad362b24c284ede676ef8b3f5656",
+      "path": "fixtures/oracle-candidates/pr29-30-data-overwrite-after-literal-eval/use.js"
+    },
+    {
+      "sha256": "efb61b6b7fb6d1f9c8c1230cec4c1cc07638c6f689583b43916e350e30fc7761",
+      "path": "fixtures/oracle-candidates/issue-2953/cjsapp.js"
+    },
+    {
+      "sha256": "a197a8ea35f9f0f49e1591811e52259d4165064be260ded1d39d8dda5c6f8590",
+      "path": "fixtures/oracle-candidates/issue-2953/expect.json"
+    },
+    {
+      "sha256": "dc2498e6e2a656f6654b4d9ab65b50833ff438c124993aa642efd03db7f78b1e",
+      "path": "fixtures/oracle-candidates/issue-2953/streaming.ts"
+    },
+    {
+      "sha256": "e20037e0139de7af6001560f5eb2a923b746231ee52153762c90759d9692465d",
+      "path": "fixtures/oracle-candidates/issue-2953/app.ts"
+    },
+    {
+      "sha256": "14047bc48f5ecfcf4c320537a989d6899d5f14e73076c827aa4ba6061d8dd089",
+      "path": "fixtures/oracle-candidates/issue-2974/expect.json"
+    },
+    {
+      "sha256": "06f92005a2e61b73fffefc508135792acbbfcdb6c524a9367f4158283f4d1c98",
+      "path": "fixtures/oracle-candidates/issue-2974/package.json"
+    },
+    {
+      "sha256": "97ba5995677220ea34260c6f8949cdbf655f5c350ad8fb7c525c968e7bd88531",
+      "path": "fixtures/oracle-candidates/issue-2957/expect.json"
+    },
+    {
+      "sha256": "b3f122e43d49f3b9afab8d079144e484e6498f4c8afd958699693712b8456b62",
+      "path": "fixtures/oracle-candidates/issue-2957/use.py"
+    },
+    {
+      "sha256": "640ff5ca5dff8106c80626ec645cd082d2ba30d7e4c6e294bb7f6796d95d624f",
+      "path": "fixtures/oracle-candidates/issue-2958/expect.json"
+    },
+    {
+      "sha256": "1ffe7f75849e1d30c2d49af1fb093c9be4aa932672c5b0c536ebc2e64bc01591",
+      "path": "fixtures/oracle-candidates/issue-2964/expect.json"
+    },
+    {
+      "sha256": "8f532ca53b0fe56747672654c2e8b03fadbe3b195a69326bf611eb0c84106f26",
+      "path": "fixtures/oracle-candidates/issue-2964/srv.js"
+    },
+    {
+      "sha256": "39bf1c97f7b867899bda1dbd969bbcf4b74f5f346dc52f5f4de358e038816f57",
+      "path": "fixtures/oracle-candidates/issue-2964/package.json"
+    },
+    {
+      "sha256": "e0c71af287dc63b7de2fd090f513a534e4aa3ea76dfb2df2d7468cabd7305326",
+      "path": "fixtures/oracle-candidates/issue-2964/b.js"
+    },
+    {
+      "sha256": "ff961ef54fd43a3a57b40974520ed471c6f92b29b69737762cbaacbd30821d4e",
+      "path": "fixtures/oracle-candidates/issue-2975/expect.json"
+    },
+    {
+      "sha256": "56fef556c3db4a1b0be44cbeb57d9cdda538cf91196cc5d3a1f98a70f04f963c",
+      "path": "fixtures/oracle-candidates/issue-2975/artisan"
+    },
+    {
+      "sha256": "9a5adb9e66d18b36a5d01fb5abbfff2c9f7976d8bb6e6f5c1da6bea917f282ec",
+      "path": "fixtures/oracle-candidates/issue-2944-arrow/decl.d.ts"
+    },
+    {
+      "sha256": "3660e7e6289363ca573ef48049934c7ab5dbadd37fce08bed92a1207f2e3e9de",
+      "path": "fixtures/oracle-candidates/issue-2944-arrow/a.test.ts"
+    },
+    {
+      "sha256": "3f6d1abcb6f4a9bfe087ebfb240610607c1f08a4e03a8f5c460bd61501cdbf77",
+      "path": "fixtures/oracle-candidates/pr29-22-ambiguous-branch/m.js"
+    },
+    {
+      "sha256": "a0ab23316c59805d661e3afd64df9c2d9bb630a29482682d8c7aef9870d4cb22",
+      "path": "fixtures/oracle-candidates/pr29-22-ambiguous-branch/expect.json"
+    },
+    {
+      "sha256": "b0fbccb47ab8d128f1e2bf779f5a13e42cdf18716507fea811c640478c39565d",
+      "path": "fixtures/oracle-candidates/pr29-22-ambiguous-branch/decoy.js"
+    },
+    {
+      "sha256": "42fc2f059791bb8d60a80208840e783df7888bb0c4a8601fc5e03229791ab3bb",
+      "path": "fixtures/oracle-candidates/pr29-22-ambiguous-branch/index.js"
+    },
+    {
+      "sha256": "9e5f1f415ea438751c9427b105a2b0db5a51ad362b24c284ede676ef8b3f5656",
+      "path": "fixtures/oracle-candidates/pr29-22-ambiguous-branch/use.js"
+    },
+    {
+      "sha256": "12c4483ebb46358730abc915213a9279c5e28e11e704fac9a753fd62c729fd6b",
+      "path": "fixtures/oracle-candidates/pr29-01-f14-object/m.js"
+    },
+    {
+      "sha256": "0fafb03bd978c9d85cca857293a329daba849d2ea66d9eed3c2d6db9bf3fae6c",
+      "path": "fixtures/oracle-candidates/pr29-01-f14-object/expect.json"
+    },
+    {
+      "sha256": "b0fbccb47ab8d128f1e2bf779f5a13e42cdf18716507fea811c640478c39565d",
+      "path": "fixtures/oracle-candidates/pr29-01-f14-object/decoy.js"
+    },
+    {
+      "sha256": "42fc2f059791bb8d60a80208840e783df7888bb0c4a8601fc5e03229791ab3bb",
+      "path": "fixtures/oracle-candidates/pr29-01-f14-object/index.js"
+    },
+    {
+      "sha256": "9e5f1f415ea438751c9427b105a2b0db5a51ad362b24c284ede676ef8b3f5656",
+      "path": "fixtures/oracle-candidates/pr29-01-f14-object/use.js"
+    },
+    {
+      "sha256": "3d19420c76363e9e6f24b7f396963ba6af30cfeee4f9368582fdde06db5bac67",
+      "path": "fixtures/oracle-candidates/pr29-16-alias-property-mutation/m.js"
+    },
+    {
+      "sha256": "0fafb03bd978c9d85cca857293a329daba849d2ea66d9eed3c2d6db9bf3fae6c",
+      "path": "fixtures/oracle-candidates/pr29-16-alias-property-mutation/expect.json"
+    },
+    {
+      "sha256": "b0fbccb47ab8d128f1e2bf779f5a13e42cdf18716507fea811c640478c39565d",
+      "path": "fixtures/oracle-candidates/pr29-16-alias-property-mutation/decoy.js"
+    },
+    {
+      "sha256": "42fc2f059791bb8d60a80208840e783df7888bb0c4a8601fc5e03229791ab3bb",
+      "path": "fixtures/oracle-candidates/pr29-16-alias-property-mutation/index.js"
+    },
+    {
+      "sha256": "9e5f1f415ea438751c9427b105a2b0db5a51ad362b24c284ede676ef8b3f5656",
+      "path": "fixtures/oracle-candidates/pr29-16-alias-property-mutation/use.js"
+    },
+    {
+      "sha256": "7785481aa6b87869486096bbd412a54bab9ed74af6f1ca93fd7c3bde246a0781",
+      "path": "fixtures/oracle-candidates/issue-2946/writer.ts"
+    },
+    {
+      "sha256": "8b874e81ac982a017cdc5817e7622df85932cc1e57d6843618da7dcd346e62fc",
+      "path": "fixtures/oracle-candidates/issue-2946/db.ts"
+    },
+    {
+      "sha256": "ea389886f9fe01838234b578c4e3d8d216cdf908ee120601917e6a1749fdec12",
+      "path": "fixtures/oracle-candidates/issue-2946/expect.json"
+    },
+    {
+      "sha256": "8a3994649b49408f228ad732a9b2ea4c84ab5d2b47e633834bf20f650e505017",
+      "path": "fixtures/oracle-candidates/issue-2946/use.ts"
+    },
+    {
+      "sha256": "de896aa22311892237abf358cd2734720ba69a1da918246b1fe2078237cfabb7",
+      "path": "fixtures/oracle-candidates/g1-go-new-receiver/go.mod"
+    },
+    {
+      "sha256": "4da2eb8b00d4f2aca0e0c10c83f95c4c31f47ec5cb58284a6b0acf892cfe2a16",
+      "path": "fixtures/oracle-candidates/g1-go-new-receiver/expect.json"
+    },
+    {
+      "sha256": "07b19972c079b8c778bf10e01b93ff5972771f50ea598f10322bf939298b19db",
+      "path": "fixtures/oracle-candidates/g1-go-new-receiver/a_router.go"
+    },
+    {
+      "sha256": "ede73844a0ac2bf5ea3dd41a9939b07f012a93425cebec26a4288fdb599bf326",
+      "path": "fixtures/oracle-candidates/g1-go-new-receiver/b_route.go"
+    },
+    {
+      "sha256": "da517c72c73fd2bfa63d9245365b6991a23d5b5828d1f8c96c833c697d83bb92",
+      "path": "fixtures/oracle-candidates/g1-go-new-receiver/use.go"
+    },
+    {
+      "sha256": "d8bfdabef5ef3d978c75fc3289822e1a05f8e2ca2f0bf4a3348a0eb38fb61a23",
+      "path": "fixtures/oracle-candidates/pr29-09-f11-generator-key-outside-generator/m.js"
+    },
+    {
+      "sha256": "a0ab23316c59805d661e3afd64df9c2d9bb630a29482682d8c7aef9870d4cb22",
+      "path": "fixtures/oracle-candidates/pr29-09-f11-generator-key-outside-generator/expect.json"
+    },
+    {
+      "sha256": "b0fbccb47ab8d128f1e2bf779f5a13e42cdf18716507fea811c640478c39565d",
+      "path": "fixtures/oracle-candidates/pr29-09-f11-generator-key-outside-generator/decoy.js"
+    },
+    {
+      "sha256": "42fc2f059791bb8d60a80208840e783df7888bb0c4a8601fc5e03229791ab3bb",
+      "path": "fixtures/oracle-candidates/pr29-09-f11-generator-key-outside-generator/index.js"
+    },
+    {
+      "sha256": "9e5f1f415ea438751c9427b105a2b0db5a51ad362b24c284ede676ef8b3f5656",
+      "path": "fixtures/oracle-candidates/pr29-09-f11-generator-key-outside-generator/use.js"
+    },
+    {
+      "sha256": "1cb8199831131a56bc28580f7762c462e6f3b7619d56c742a8e204ca83a50ee8",
+      "path": "fixtures/oracle-candidates/pr29-31-missing-read-exported-as-undefined-data/m.js"
+    },
+    {
+      "sha256": "a0ab23316c59805d661e3afd64df9c2d9bb630a29482682d8c7aef9870d4cb22",
+      "path": "fixtures/oracle-candidates/pr29-31-missing-read-exported-as-undefined-data/expect.json"
+    },
+    {
+      "sha256": "b0fbccb47ab8d128f1e2bf779f5a13e42cdf18716507fea811c640478c39565d",
+      "path": "fixtures/oracle-candidates/pr29-31-missing-read-exported-as-undefined-data/decoy.js"
+    },
+    {
+      "sha256": "42fc2f059791bb8d60a80208840e783df7888bb0c4a8601fc5e03229791ab3bb",
+      "path": "fixtures/oracle-candidates/pr29-31-missing-read-exported-as-undefined-data/index.js"
+    },
+    {
+      "sha256": "9e5f1f415ea438751c9427b105a2b0db5a51ad362b24c284ede676ef8b3f5656",
+      "path": "fixtures/oracle-candidates/pr29-31-missing-read-exported-as-undefined-data/use.js"
+    },
+    {
+      "sha256": "ab33ab838e198a30e7b9f7777d2dca36d03fcb1d0dca063a0083b7d5b4d22b26",
+      "path": "fixtures/oracle-candidates/pr29-25-unknown-dynamic-key/m.js"
+    },
+    {
+      "sha256": "a0ab23316c59805d661e3afd64df9c2d9bb630a29482682d8c7aef9870d4cb22",
+      "path": "fixtures/oracle-candidates/pr29-25-unknown-dynamic-key/expect.json"
+    },
+    {
+      "sha256": "b0fbccb47ab8d128f1e2bf779f5a13e42cdf18716507fea811c640478c39565d",
+      "path": "fixtures/oracle-candidates/pr29-25-unknown-dynamic-key/decoy.js"
+    },
+    {
+      "sha256": "42fc2f059791bb8d60a80208840e783df7888bb0c4a8601fc5e03229791ab3bb",
+      "path": "fixtures/oracle-candidates/pr29-25-unknown-dynamic-key/index.js"
+    },
+    {
+      "sha256": "9e5f1f415ea438751c9427b105a2b0db5a51ad362b24c284ede676ef8b3f5656",
+      "path": "fixtures/oracle-candidates/pr29-25-unknown-dynamic-key/use.js"
+    },
+    {
+      "sha256": "8f946bba12f93b3ead1ad5f8bc3a7340d857abeaa5290d3b45f439c3d9706428",
+      "path": "fixtures/oracle-candidates/issue-2951/c.ts"
+    },
+    {
+      "sha256": "a91b62874f93ea514db29e0b9beeadd570666b56c0603c566bdac91f63aa4a8f",
+      "path": "fixtures/oracle-candidates/issue-2951/index2.ts"
+    },
+    {
+      "sha256": "db106e86880aa9ac94edab8b260b79e369eded4f01c73fafed611d2c33a7c6eb",
+      "path": "fixtures/oracle-candidates/issue-2951/a.ts"
+    },
+    {
+      "sha256": "d9975e5b60e3a323783abed55b22cfbe1331d40cd4abf22a776cb0db368a6fe0",
+      "path": "fixtures/oracle-candidates/issue-2951/expect.json"
+    },
+    {
+      "sha256": "83ff54c6e13c38b58b564278e264357a807bf061b10bd38d985b0109b98135c7",
+      "path": "fixtures/oracle-candidates/issue-2951/schemas.ts"
+    },
+    {
+      "sha256": "8447bb239c5ec1dc565f41d02e825aa811dfa807d669fbe9f761ba63be90f268",
+      "path": "fixtures/oracle-candidates/issue-2951/index.ts"
+    },
+    {
+      "sha256": "a7d4e577cc53ea0c4b8a408baca4e632c3659d1ca33dc85519608a4abf14890a",
+      "path": "fixtures/oracle-candidates/issue-2951/d.ts"
+    },
+    {
+      "sha256": "995a7344d8afc610dcd0aace6b261a7f7db43922f4368218fa2c5c4d0c71ee84",
+      "path": "fixtures/oracle-candidates/issue-2951/external.ts"
+    },
+    {
+      "sha256": "defbb15f72fa344d43737eddafae62f4fb5051fb799d457f42f18cd9be94d056",
+      "path": "fixtures/oracle-candidates/issue-2951/index3.ts"
+    },
+    {
+      "sha256": "8e3bd6259e93837b4737d2dbdef5f3f2ba201665c9af97ad31bf62159fca0a0f",
+      "path": "fixtures/oracle-candidates/issue-2951/b.ts"
+    },
+    {
+      "sha256": "471c72ee255456dccde5f3a3035cb2705dfa7e861c28a719133c6c5dda7adf0d",
+      "path": "fixtures/oracle-candidates/m1-py-super/base.py"
+    },
+    {
+      "sha256": "680d99157ec2aceb3ea8e0c179f2aa9e48163c1111fcb1130cefa1f09c38eec5",
+      "path": "fixtures/oracle-candidates/m1-py-super/child.py"
+    },
+    {
+      "sha256": "97f9fa858255a3e08eff8e55d5d6f70f885fe0dcc703388be22281cc61fa6e99",
+      "path": "fixtures/oracle-candidates/m1-py-super/expect.json"
+    },
+    {
+      "sha256": "05d752d532aa535b33a9145a07fc2f3b7393e7b704af9d4b8ae17d901858bdb5",
+      "path": "fixtures/oracle-candidates/m2-py-method-return-local/expect.json"
+    },
+    {
+      "sha256": "a982aba00b80151fade24fa8371beff89fba9fb5b1343e2f9eb5387e4012d44d",
+      "path": "fixtures/oracle-candidates/m2-py-method-return-local/t.py"
+    },
+    {
+      "sha256": "a7e4868b299a4fecb72fe9f6a95e3d02f3863b0d9df1710a2675e17a01b72b76",
+      "path": "fixtures/oracle-candidates/pr29-05-f15-string/m.js"
+    },
+    {
+      "sha256": "a0ab23316c59805d661e3afd64df9c2d9bb630a29482682d8c7aef9870d4cb22",
+      "path": "fixtures/oracle-candidates/pr29-05-f15-string/expect.json"
+    },
+    {
+      "sha256": "b0fbccb47ab8d128f1e2bf779f5a13e42cdf18716507fea811c640478c39565d",
+      "path": "fixtures/oracle-candidates/pr29-05-f15-string/decoy.js"
+    },
+    {
+      "sha256": "42fc2f059791bb8d60a80208840e783df7888bb0c4a8601fc5e03229791ab3bb",
+      "path": "fixtures/oracle-candidates/pr29-05-f15-string/index.js"
+    },
+    {
+      "sha256": "9e5f1f415ea438751c9427b105a2b0db5a51ad362b24c284ede676ef8b3f5656",
+      "path": "fixtures/oracle-candidates/pr29-05-f15-string/use.js"
+    },
+    {
+      "sha256": "9a5adb9e66d18b36a5d01fb5abbfff2c9f7976d8bb6e6f5c1da6bea917f282ec",
+      "path": "fixtures/oracle-candidates/issue-2944-verbatim/decl.d.ts"
+    },
+    {
+      "sha256": "5b993018a5e9954ac20b6f92f6498a114074eb399f365006c51c406e6177e890",
+      "path": "fixtures/oracle-candidates/issue-2944-verbatim/a.test.ts"
+    },
+    {
+      "sha256": "bc7a45afa2a0019420a1bbc1c26b0e682eea688e6dff56d9aa6f0bd8f18f288f",
+      "path": "fixtures/oracle-candidates/issue-2973/expect.json"
+    },
+    {
+      "sha256": "05003f4d1d223373199dc661966f299c55fc8763aafe128a3b5a05bbd16b4f9e",
+      "path": "fixtures/oracle-candidates/pr29-12-f12-logical-instance/m.js"
+    },
+    {
+      "sha256": "0fafb03bd978c9d85cca857293a329daba849d2ea66d9eed3c2d6db9bf3fae6c",
+      "path": "fixtures/oracle-candidates/pr29-12-f12-logical-instance/expect.json"
+    },
+    {
+      "sha256": "b0fbccb47ab8d128f1e2bf779f5a13e42cdf18716507fea811c640478c39565d",
+      "path": "fixtures/oracle-candidates/pr29-12-f12-logical-instance/decoy.js"
+    },
+    {
+      "sha256": "42fc2f059791bb8d60a80208840e783df7888bb0c4a8601fc5e03229791ab3bb",
+      "path": "fixtures/oracle-candidates/pr29-12-f12-logical-instance/index.js"
+    },
+    {
+      "sha256": "9e5f1f415ea438751c9427b105a2b0db5a51ad362b24c284ede676ef8b3f5656",
+      "path": "fixtures/oracle-candidates/pr29-12-f12-logical-instance/use.js"
+    },
+    {
+      "sha256": "1032fc43429b69f9877376ce85f9481c02a310157c64c1c24472bb482405c375",
+      "path": "fixtures/oracle-candidates/pr29-06-f15-assigned-callable/m.js"
+    },
+    {
+      "sha256": "b25b5c06e5cbd97f986d37d113ff332d5d7a51035467050863175d528db54b01",
+      "path": "fixtures/oracle-candidates/pr29-06-f15-assigned-callable/expect.json"
+    },
+    {
+      "sha256": "b0fbccb47ab8d128f1e2bf779f5a13e42cdf18716507fea811c640478c39565d",
+      "path": "fixtures/oracle-candidates/pr29-06-f15-assigned-callable/decoy.js"
+    },
+    {
+      "sha256": "42fc2f059791bb8d60a80208840e783df7888bb0c4a8601fc5e03229791ab3bb",
+      "path": "fixtures/oracle-candidates/pr29-06-f15-assigned-callable/index.js"
+    },
+    {
+      "sha256": "9e5f1f415ea438751c9427b105a2b0db5a51ad362b24c284ede676ef8b3f5656",
+      "path": "fixtures/oracle-candidates/pr29-06-f15-assigned-callable/use.js"
+    },
+    {
+      "sha256": "0fcf130e9026123393d548293a71ed14963b58fa9a3c4501f9ebf3777808aea2",
+      "path": "fixtures/oracle-candidates/n1-py-local-import/expect.json"
+    },
+    {
+      "sha256": "bf4db2a335afb73d26113bd87e02b38718375ec06dab7778815ceb8c41d52a8d",
+      "path": "fixtures/oracle-candidates/n1-py-local-import/t_local_import.py"
+    },
+    {
+      "sha256": "a6bf662abea8400ef8f7b8a92e8af9383e55e0d49c8fa94736e21438c9a81756",
+      "path": "fixtures/oracle-candidates/pr29-02-f14-class/m.js"
+    },
+    {
+      "sha256": "0fafb03bd978c9d85cca857293a329daba849d2ea66d9eed3c2d6db9bf3fae6c",
+      "path": "fixtures/oracle-candidates/pr29-02-f14-class/expect.json"
+    },
+    {
+      "sha256": "b0fbccb47ab8d128f1e2bf779f5a13e42cdf18716507fea811c640478c39565d",
+      "path": "fixtures/oracle-candidates/pr29-02-f14-class/decoy.js"
+    },
+    {
+      "sha256": "42fc2f059791bb8d60a80208840e783df7888bb0c4a8601fc5e03229791ab3bb",
+      "path": "fixtures/oracle-candidates/pr29-02-f14-class/index.js"
+    },
+    {
+      "sha256": "9e5f1f415ea438751c9427b105a2b0db5a51ad362b24c284ede676ef8b3f5656",
+      "path": "fixtures/oracle-candidates/pr29-02-f14-class/use.js"
+    },
+    {
+      "sha256": "56c28d577e4f29df7c05e6073633c5013e99f8f4757587fab5dc7a1f40b6fe68",
+      "path": "fixtures/oracle-candidates/p4/expect.json"
+    },
+    {
+      "sha256": "57c6009881ec49428445ec4fa851166e41abbb6116a3d202928b3fa6e9916af3",
+      "path": "fixtures/oracle-candidates/pr29-03-f14-function/m.js"
+    },
+    {
+      "sha256": "0fafb03bd978c9d85cca857293a329daba849d2ea66d9eed3c2d6db9bf3fae6c",
+      "path": "fixtures/oracle-candidates/pr29-03-f14-function/expect.json"
+    },
+    {
+      "sha256": "b0fbccb47ab8d128f1e2bf779f5a13e42cdf18716507fea811c640478c39565d",
+      "path": "fixtures/oracle-candidates/pr29-03-f14-function/decoy.js"
+    },
+    {
+      "sha256": "42fc2f059791bb8d60a80208840e783df7888bb0c4a8601fc5e03229791ab3bb",
+      "path": "fixtures/oracle-candidates/pr29-03-f14-function/index.js"
+    },
+    {
+      "sha256": "9e5f1f415ea438751c9427b105a2b0db5a51ad362b24c284ede676ef8b3f5656",
+      "path": "fixtures/oracle-candidates/pr29-03-f14-function/use.js"
+    },
+    {
+      "sha256": "b5f89cf14cf5f0e9635d06bac185b82e0eac6081b45c08df52e83f260162ff05",
+      "path": "fixtures/oracle-candidates/n5-ts-barrel-member/c.ts"
+    },
+    {
+      "sha256": "9ceab5257268fe108c034970616b411bee3463eee693a40acf965bf8b51ae627",
+      "path": "fixtures/oracle-candidates/n5-ts-barrel-member/tsconfig.json"
+    },
+    {
+      "sha256": "67721d2ddbb462dc97d67da0f4160e75252419fd6ef678881e9a1bee3e778eed",
+      "path": "fixtures/oracle-candidates/n5-ts-barrel-member/expect.json"
+    },
+    {
+      "sha256": "8b18bc71e1cbfab76d2f6823b5dc0451eaf4b5104130d217d52cef23e0a95f3e",
+      "path": "fixtures/oracle-candidates/n5-ts-barrel-member/b.ts"
+    },
+    {
+      "sha256": "f006ca63978268b573bdba45b28d1c321caaa4092ed080b437783e2af1ed5b65",
+      "path": "fixtures/oracle-candidates/n2-py-comprehension/expect.json"
+    },
+    {
+      "sha256": "b2ca7b6753b6b0725bcb4cd182869d9316660947fa8e7ad5e78f084d5dd19fcb",
+      "path": "fixtures/oracle-candidates/n2-py-comprehension/t.py"
+    },
+    {
+      "sha256": "0d5b50dd27616f884b5161b96912c741cc0edfb30328e76e428b69579c55aba3",
+      "path": "fixtures/oracle-candidates/issue-2947/expect.json"
+    },
+    {
+      "sha256": "b5750f8dae89d2670453f43bedd890c1452ad4bc17b5cd557fd86419ee842c7f",
+      "path": "fixtures/oracle-candidates/issue-2947/use.ts"
+    },
+    {
+      "sha256": "81b9af8ef51d199c8195f8d786334f59c565989543b030431fae81cb225243ad",
+      "path": "fixtures/oracle-candidates/issue-2947/app.ts"
+    },
+    {
+      "sha256": "d5b884950da85e90aa03feeef40ef9f9071665f395de97cf2d42b32779e3eb5c",
+      "path": "fixtures/oracle-candidates/pr29-13-f13-parameter/m.js"
+    },
+    {
+      "sha256": "a0ab23316c59805d661e3afd64df9c2d9bb630a29482682d8c7aef9870d4cb22",
+      "path": "fixtures/oracle-candidates/pr29-13-f13-parameter/expect.json"
+    },
+    {
+      "sha256": "b0fbccb47ab8d128f1e2bf779f5a13e42cdf18716507fea811c640478c39565d",
+      "path": "fixtures/oracle-candidates/pr29-13-f13-parameter/decoy.js"
+    },
+    {
+      "sha256": "42fc2f059791bb8d60a80208840e783df7888bb0c4a8601fc5e03229791ab3bb",
+      "path": "fixtures/oracle-candidates/pr29-13-f13-parameter/index.js"
+    },
+    {
+      "sha256": "9e5f1f415ea438751c9427b105a2b0db5a51ad362b24c284ede676ef8b3f5656",
+      "path": "fixtures/oracle-candidates/pr29-13-f13-parameter/use.js"
+    },
+    {
+      "sha256": "5dd303f7afbca3054f931fb0ee3ac3bc60c6c882a3bcaec24c4fc7468cf7542a",
+      "path": "fixtures/oracle-candidates/pr29-08-f11-generator-eval/m.js"
+    },
+    {
+      "sha256": "0fafb03bd978c9d85cca857293a329daba849d2ea66d9eed3c2d6db9bf3fae6c",
+      "path": "fixtures/oracle-candidates/pr29-08-f11-generator-eval/expect.json"
+    },
+    {
+      "sha256": "b0fbccb47ab8d128f1e2bf779f5a13e42cdf18716507fea811c640478c39565d",
+      "path": "fixtures/oracle-candidates/pr29-08-f11-generator-eval/decoy.js"
+    },
+    {
+      "sha256": "42fc2f059791bb8d60a80208840e783df7888bb0c4a8601fc5e03229791ab3bb",
+      "path": "fixtures/oracle-candidates/pr29-08-f11-generator-eval/index.js"
+    },
+    {
+      "sha256": "9e5f1f415ea438751c9427b105a2b0db5a51ad362b24c284ede676ef8b3f5656",
+      "path": "fixtures/oracle-candidates/pr29-08-f11-generator-eval/use.js"
+    },
+    {
+      "sha256": "0dc4810449218082dc66f734d2860188082c2aaddb7318ec80924afc9cb8777a",
+      "path": "fixtures/oracle-candidates/issue-2962/use.tsx"
+    },
+    {
+      "sha256": "888bbed56f7f1cfeb6351df9c9bd2c6cfedb6102c5accfe0ae7cbdbe26d349c3",
+      "path": "fixtures/oracle-candidates/issue-2962/expect.json"
+    },
+    {
+      "sha256": "498c9b36193ce8d9b0b9b93337837738a636768f4163cf90b023c538baaff826",
+      "path": "fixtures/oracle-candidates/issue-2962/auth.ts"
+    },
+    {
+      "sha256": "91e041352cf4f5c371ab38bfb4139b02d495164f18de31f189df5469367fa776",
+      "path": "fixtures/oracle-candidates/n4-py-builtin/expect.json"
+    },
+    {
+      "sha256": "194240aa2f1f2f885116570e1aaba97f3d0870e39009e4960710168bf768ce10",
+      "path": "fixtures/oracle-candidates/n4-py-builtin/t.py"
+    },
+    {
+      "sha256": "707ee0fb3755bd56d64eb439e49ba65345b1836249288f0d88fb45b80db3efd2",
+      "path": "fixtures/oracle-candidates/pr29-26-local-eval/m.js"
+    },
+    {
+      "sha256": "a0ab23316c59805d661e3afd64df9c2d9bb630a29482682d8c7aef9870d4cb22",
+      "path": "fixtures/oracle-candidates/pr29-26-local-eval/expect.json"
+    },
+    {
+      "sha256": "b0fbccb47ab8d128f1e2bf779f5a13e42cdf18716507fea811c640478c39565d",
+      "path": "fixtures/oracle-candidates/pr29-26-local-eval/decoy.js"
+    },
+    {
+      "sha256": "42fc2f059791bb8d60a80208840e783df7888bb0c4a8601fc5e03229791ab3bb",
+      "path": "fixtures/oracle-candidates/pr29-26-local-eval/index.js"
+    },
+    {
+      "sha256": "9e5f1f415ea438751c9427b105a2b0db5a51ad362b24c284ede676ef8b3f5656",
+      "path": "fixtures/oracle-candidates/pr29-26-local-eval/use.js"
+    },
+    {
+      "sha256": "bb994d0c2d71f00e06f6d881766bb908cb21c03b9355f961dbc973b45f685418",
+      "path": "fixtures/oracle-candidates/pr29-27-literal-eval/m.js"
+    },
+    {
+      "sha256": "0fafb03bd978c9d85cca857293a329daba849d2ea66d9eed3c2d6db9bf3fae6c",
+      "path": "fixtures/oracle-candidates/pr29-27-literal-eval/expect.json"
+    },
+    {
+      "sha256": "b0fbccb47ab8d128f1e2bf779f5a13e42cdf18716507fea811c640478c39565d",
+      "path": "fixtures/oracle-candidates/pr29-27-literal-eval/decoy.js"
+    },
+    {
+      "sha256": "42fc2f059791bb8d60a80208840e783df7888bb0c4a8601fc5e03229791ab3bb",
+      "path": "fixtures/oracle-candidates/pr29-27-literal-eval/index.js"
+    },
+    {
+      "sha256": "9e5f1f415ea438751c9427b105a2b0db5a51ad362b24c284ede676ef8b3f5656",
+      "path": "fixtures/oracle-candidates/pr29-27-literal-eval/use.js"
+    },
+    {
+      "sha256": "38acf0e43fbe02d9d031995fbb164a9dd68e91994a36a60c261957234333a9f4",
+      "path": "fixtures/oracle-candidates/pr29-15-f13-block/m.js"
+    },
+    {
+      "sha256": "a0ab23316c59805d661e3afd64df9c2d9bb630a29482682d8c7aef9870d4cb22",
+      "path": "fixtures/oracle-candidates/pr29-15-f13-block/expect.json"
+    },
+    {
+      "sha256": "b0fbccb47ab8d128f1e2bf779f5a13e42cdf18716507fea811c640478c39565d",
+      "path": "fixtures/oracle-candidates/pr29-15-f13-block/decoy.js"
+    },
+    {
+      "sha256": "42fc2f059791bb8d60a80208840e783df7888bb0c4a8601fc5e03229791ab3bb",
+      "path": "fixtures/oracle-candidates/pr29-15-f13-block/index.js"
+    },
+    {
+      "sha256": "9e5f1f415ea438751c9427b105a2b0db5a51ad362b24c284ede676ef8b3f5656",
+      "path": "fixtures/oracle-candidates/pr29-15-f13-block/use.js"
+    },
+    {
+      "sha256": "00b5cbd51024275ef10dabb4686dcc651a3dcd76bed041fd2caef1362b43791b",
+      "path": "fixtures/oracle-candidates/pr29-11-f12-parenthesized-instance/m.js"
+    },
+    {
+      "sha256": "0fafb03bd978c9d85cca857293a329daba849d2ea66d9eed3c2d6db9bf3fae6c",
+      "path": "fixtures/oracle-candidates/pr29-11-f12-parenthesized-instance/expect.json"
+    },
+    {
+      "sha256": "b0fbccb47ab8d128f1e2bf779f5a13e42cdf18716507fea811c640478c39565d",
+      "path": "fixtures/oracle-candidates/pr29-11-f12-parenthesized-instance/decoy.js"
+    },
+    {
+      "sha256": "42fc2f059791bb8d60a80208840e783df7888bb0c4a8601fc5e03229791ab3bb",
+      "path": "fixtures/oracle-candidates/pr29-11-f12-parenthesized-instance/index.js"
+    },
+    {
+      "sha256": "9e5f1f415ea438751c9427b105a2b0db5a51ad362b24c284ede676ef8b3f5656",
+      "path": "fixtures/oracle-candidates/pr29-11-f12-parenthesized-instance/use.js"
+    },
+    {
+      "sha256": "1d432a56bc0dc4f12a3cb9ad2b248e1199846d6b94ac110fc30682ed3dad0eb2",
+      "path": "fixtures/oracle-candidates/pr29-19-binding-overwrite/m.js"
+    },
+    {
+      "sha256": "a0ab23316c59805d661e3afd64df9c2d9bb630a29482682d8c7aef9870d4cb22",
+      "path": "fixtures/oracle-candidates/pr29-19-binding-overwrite/expect.json"
+    },
+    {
+      "sha256": "b0fbccb47ab8d128f1e2bf779f5a13e42cdf18716507fea811c640478c39565d",
+      "path": "fixtures/oracle-candidates/pr29-19-binding-overwrite/decoy.js"
+    },
+    {
+      "sha256": "42fc2f059791bb8d60a80208840e783df7888bb0c4a8601fc5e03229791ab3bb",
+      "path": "fixtures/oracle-candidates/pr29-19-binding-overwrite/index.js"
+    },
+    {
+      "sha256": "9e5f1f415ea438751c9427b105a2b0db5a51ad362b24c284ede676ef8b3f5656",
+      "path": "fixtures/oracle-candidates/pr29-19-binding-overwrite/use.js"
+    },
+    {
+      "sha256": "b575b49f100e98ffde5581673b31bed0a24f1e17f8b30c8e6b60a3bdcbd50495",
+      "path": "fixtures/oracle-candidates/issue-2963/expect.json"
+    },
+    {
+      "sha256": "0c5e556eb015a3c8a8d589e37e188349aee195c23481e616a26ee66c0d5fe05c",
+      "path": "fixtures/oracle-candidates/issue-2963/use.py"
+    },
+    {
+      "sha256": "a43ede7af1bf14505dba00fc6f71a513bc14baddfe0261af66fdebdeae86ee14",
+      "path": "fixtures/oracle-candidates/b/queries.ts"
+    },
+    {
+      "sha256": "2540323fef7f1ba58385ccb8251aff4e79d8047e7ec86fe526461be27fd80c10",
+      "path": "fixtures/oracle-candidates/b/expect.json"
+    },
+    {
+      "sha256": "bfff4442f0c60a623dcd25e4b00937718dbf76c4b439c11d1c8ef807354bad04",
+      "path": "fixtures/oracle-candidates/b/session.ts"
+    },
+    {
+      "sha256": "c89f02719ed984b46bd22140b67262bf09487d8316e38a67151d645bb2e81160",
+      "path": "fixtures/oracle-candidates/pr29-32-logical-member-initialization/m.js"
+    },
+    {
+      "sha256": "0fafb03bd978c9d85cca857293a329daba849d2ea66d9eed3c2d6db9bf3fae6c",
+      "path": "fixtures/oracle-candidates/pr29-32-logical-member-initialization/expect.json"
+    },
+    {
+      "sha256": "b0fbccb47ab8d128f1e2bf779f5a13e42cdf18716507fea811c640478c39565d",
+      "path": "fixtures/oracle-candidates/pr29-32-logical-member-initialization/decoy.js"
+    },
+    {
+      "sha256": "42fc2f059791bb8d60a80208840e783df7888bb0c4a8601fc5e03229791ab3bb",
+      "path": "fixtures/oracle-candidates/pr29-32-logical-member-initialization/index.js"
+    },
+    {
+      "sha256": "9e5f1f415ea438751c9427b105a2b0db5a51ad362b24c284ede676ef8b3f5656",
+      "path": "fixtures/oracle-candidates/pr29-32-logical-member-initialization/use.js"
+    },
+    {
+      "sha256": "b1068b1d10bb61f379e4722237e5155b5f0e2e6c8970ce7006d568f7c92c9700",
+      "path": "fixtures/oracle-candidates/a/handler.ts"
+    },
+    {
+      "sha256": "f2615924fa4f25aabc45570c07dfdf04591af3ee1780ce4fa0b4e724c0dfdcb8",
+      "path": "fixtures/oracle-candidates/a/expect.json"
+    },
+    {
+      "sha256": "0abc20fadfeb672658e0d5293132a4648f9f2192421dfbf3acf10c4d81dac43c",
+      "path": "fixtures/oracle-candidates/a/lib.ts"
+    },
+    {
+      "sha256": "31c0baa2fe6ea740d301b3ff0610de54119c56c2e2fb7c8564739b254df227d4",
+      "path": "fixtures/oracle-candidates/kmp-22/expect.json"
+    },
+    {
+      "sha256": "d5095685b05d2a5e7895cb2c992faf7cf496dedc6aa181843b29ffbff29b7d3a",
+      "path": "fixtures/oracle-candidates/pr29-29-uncertain-receiver-alias/m.js"
+    },
+    {
+      "sha256": "a0ab23316c59805d661e3afd64df9c2d9bb630a29482682d8c7aef9870d4cb22",
+      "path": "fixtures/oracle-candidates/pr29-29-uncertain-receiver-alias/expect.json"
+    },
+    {
+      "sha256": "b0fbccb47ab8d128f1e2bf779f5a13e42cdf18716507fea811c640478c39565d",
+      "path": "fixtures/oracle-candidates/pr29-29-uncertain-receiver-alias/decoy.js"
+    },
+    {
+      "sha256": "42fc2f059791bb8d60a80208840e783df7888bb0c4a8601fc5e03229791ab3bb",
+      "path": "fixtures/oracle-candidates/pr29-29-uncertain-receiver-alias/index.js"
+    },
+    {
+      "sha256": "9e5f1f415ea438751c9427b105a2b0db5a51ad362b24c284ede676ef8b3f5656",
+      "path": "fixtures/oracle-candidates/pr29-29-uncertain-receiver-alias/use.js"
+    },
+    {
+      "sha256": "ba6e6ddb094143349f0c8cc19b551fab200a2fdba1f8f06a768160ff3b7af23e",
+      "path": "fixtures/oracle-candidates/pr29-04-f15-number/m.js"
+    },
+    {
+      "sha256": "a0ab23316c59805d661e3afd64df9c2d9bb630a29482682d8c7aef9870d4cb22",
+      "path": "fixtures/oracle-candidates/pr29-04-f15-number/expect.json"
+    },
+    {
+      "sha256": "b0fbccb47ab8d128f1e2bf779f5a13e42cdf18716507fea811c640478c39565d",
+      "path": "fixtures/oracle-candidates/pr29-04-f15-number/decoy.js"
+    },
+    {
+      "sha256": "42fc2f059791bb8d60a80208840e783df7888bb0c4a8601fc5e03229791ab3bb",
+      "path": "fixtures/oracle-candidates/pr29-04-f15-number/index.js"
+    },
+    {
+      "sha256": "9e5f1f415ea438751c9427b105a2b0db5a51ad362b24c284ede676ef8b3f5656",
+      "path": "fixtures/oracle-candidates/pr29-04-f15-number/use.js"
+    },
+    {
+      "sha256": "1dd04841734090beb573cb31b99f4e2ed85a7de7cfa6ea97fde10ab34629ad05",
+      "path": "fixtures/oracle-candidates/t1-ts-global-builtin/expect.json"
+    },
+    {
+      "sha256": "e1443c8bc2051ce66441db51c80b8e0098ffb2769d3571d8d5f7ad166d93daaa",
+      "path": "fixtures/oracle-candidates/t1-ts-global-builtin/use.ts"
+    },
+    {
+      "sha256": "625fbe29146e34a7c386296fc98973eb4b20e45a1bc4d82923c2ff256f9a2651",
+      "path": "fixtures/oracle-candidates/j1-java-overload/expect.json"
+    },
+    {
+      "sha256": "9be5f0224de4093ecf0b0af72fc62ae8d1855914afb608aafa1b30434dbcd866",
+      "path": "fixtures/oracle-candidates/issue-2966/expect.json"
+    },
+    {
+      "sha256": "1cc18d295936d3d8f5c5e525dcd58428ea6bdac984680bf476f4e91103cc2d4f",
+      "path": "fixtures/oracle-candidates/issue-2976/expect.json"
+    },
+    {
+      "sha256": "c2c55dc6c10d2d324e67dc0b42d0afb5f255d21e4fed56f21c32a22e9dd17781",
+      "path": "fixtures/oracle-candidates/pr29-18-property-overwrite/m.js"
+    },
+    {
+      "sha256": "a0ab23316c59805d661e3afd64df9c2d9bb630a29482682d8c7aef9870d4cb22",
+      "path": "fixtures/oracle-candidates/pr29-18-property-overwrite/expect.json"
+    },
+    {
+      "sha256": "b0fbccb47ab8d128f1e2bf779f5a13e42cdf18716507fea811c640478c39565d",
+      "path": "fixtures/oracle-candidates/pr29-18-property-overwrite/decoy.js"
+    },
+    {
+      "sha256": "42fc2f059791bb8d60a80208840e783df7888bb0c4a8601fc5e03229791ab3bb",
+      "path": "fixtures/oracle-candidates/pr29-18-property-overwrite/index.js"
+    },
+    {
+      "sha256": "9e5f1f415ea438751c9427b105a2b0db5a51ad362b24c284ede676ef8b3f5656",
+      "path": "fixtures/oracle-candidates/pr29-18-property-overwrite/use.js"
+    },
+    {
+      "sha256": "6d29a3f6d80d2f6cc367849d052475518d3fe47b6c5fca75f91c54d6d820c604",
+      "path": "fixtures/oracle-candidates/issue-2949-pkg/use.ts"
+    },
+    {
+      "sha256": "39abe16fa6a1dd889484d0ac57d2392e3fd90ebeaa84777d97969b7cd41c0f31",
+      "path": "fixtures/oracle-candidates/pr29-17-alias-rebind/m.js"
+    },
+    {
+      "sha256": "a0ab23316c59805d661e3afd64df9c2d9bb630a29482682d8c7aef9870d4cb22",
+      "path": "fixtures/oracle-candidates/pr29-17-alias-rebind/expect.json"
+    },
+    {
+      "sha256": "b0fbccb47ab8d128f1e2bf779f5a13e42cdf18716507fea811c640478c39565d",
+      "path": "fixtures/oracle-candidates/pr29-17-alias-rebind/decoy.js"
+    },
+    {
+      "sha256": "42fc2f059791bb8d60a80208840e783df7888bb0c4a8601fc5e03229791ab3bb",
+      "path": "fixtures/oracle-candidates/pr29-17-alias-rebind/index.js"
+    },
+    {
+      "sha256": "9e5f1f415ea438751c9427b105a2b0db5a51ad362b24c284ede676ef8b3f5656",
+      "path": "fixtures/oracle-candidates/pr29-17-alias-rebind/use.js"
+    },
+    {
+      "sha256": "028a5c71d35899ec34410b022842d5ba46950811116a68a509c0a46d8702dbbc",
+      "path": "fixtures/oracle-candidates/issue-2976/src/com/x/m/Main.java"
+    },
+    {
+      "sha256": "bfcad17f2718c801355b570e8ce394553e78288fb8d66338e80d585383194f64",
+      "path": "fixtures/oracle-candidates/issue-2976/src/com/x/b/Util.java"
+    },
+    {
+      "sha256": "19bb37217dce8c5afd992a3b08970f223de68e5b9ee0aea0738875e5ad569a24",
+      "path": "fixtures/oracle-candidates/issue-2976/src/com/x/a/Util.java"
+    },
+    {
+      "sha256": "59822d4f4a0b978cea621bacec575fee67acd1ebdb4947622f3253bdfdc958b6",
+      "path": "fixtures/oracle-candidates/issue-2966/lib/other.js"
+    },
+    {
+      "sha256": "81d1069066610ac1ffb56ae672379b927913fbd5c3f12cdbe94f43b0bab6ab41",
+      "path": "fixtures/oracle-candidates/issue-2966/lib/model.js"
+    },
+    {
+      "sha256": "ecba23599f49ee2a0fcd8abd895a408e5bc18513235933c9f8f5733d7704cb2e",
+      "path": "fixtures/oracle-candidates/issue-2966/lib/context.js"
+    },
+    {
+      "sha256": "96cd6e9df93e3c75f8918a219e75af4b0863dbae7e3c67472ce0e7591398eb65",
+      "path": "fixtures/oracle-candidates/issue-2966/lib/validation.js"
+    },
+    {
+      "sha256": "555d29babc5c186f0b7b28b358d6e5d40fe7c888e5bb2ad11db8016263172af5",
+      "path": "fixtures/oracle-candidates/issue-2966/lib/types.d.ts"
+    },
+    {
+      "sha256": "2e90808505aa534368b2d34d76717c6e9f537e4c299d9f4ccf00d18d8008bcb7",
+      "path": "fixtures/oracle-candidates/issue-2966/lib/application.js"
+    },
+    {
+      "sha256": "fca0c09c99997d0ad748eccb4672bff28acfc4816269c410fb2efc84024dda8d",
+      "path": "fixtures/oracle-candidates/issue-2966/lib/hooks.js"
+    },
+    {
+      "sha256": "705fed6b03a4cc92935bae825a1796c287124179f079e03745511ed4fef1bc2b",
+      "path": "fixtures/oracle-candidates/issue-2966/lib/reply.js"
+    },
+    {
+      "sha256": "25ebeaf27929de9328bd322e9fd171721a3cd67f0b7345b69736e512d2f6151b",
+      "path": "fixtures/oracle-candidates/issue-2966/test/model.test.js"
+    },
+    {
+      "sha256": "b0c9cb0b7621ca47df4eefa14f22332c641fd754929517975c75ec8e84ddedf2",
+      "path": "fixtures/oracle-candidates/j1-java-overload/src/p/App.java"
+    },
+    {
+      "sha256": "bb19dbfe1822f6164ce66f4beee7b5e0e269a5928651f24951a8c1707c1e3a22",
+      "path": "fixtures/oracle-candidates/j1-java-overload/src/p/Util.java"
+    },
+    {
+      "sha256": "3377b0d5d8f26be76fcc2a57028e524bc5068f04178c168808ce4a751ea5a588",
+      "path": "fixtures/oracle-candidates/j1-java-overload/src/p/Parser.java"
+    },
+    {
+      "sha256": "32b42a2737c51d951a90568d17a09653408ce1bc940d6e42048f2a4f37bf84b3",
+      "path": "fixtures/oracle-candidates/t1-ts-global-builtin/lib/other.ts"
+    },
+    {
+      "sha256": "04ff744b84f9efa1a92f9e5e1a3887fbf6d25b26977d77ca7d51de35cfbdd1ea",
+      "path": "fixtures/oracle-candidates/kmp-22/app/src/main/java/b/App.java"
+    },
+    {
+      "sha256": "89b333ccdf751ec37fbf9b91e9e61fbbe19330379b425075834b9d51e848abd1",
+      "path": "fixtures/oracle-candidates/kmp-22/lib/src/commonMain/kotlin/a/Util.kt"
+    },
+    {
+      "sha256": "d984b3a9bc7b0bd0cb66f70fc9ab92a4cf1bc65d251f6e19d5ce4251996108c7",
+      "path": "fixtures/oracle-candidates/kmp-22/lib/src/androidMain/kotlin/a/Util.kt"
+    },
+    {
+      "sha256": "3606ecefeec671e520ab5c6bf8b3ee85673ef37ad2b2aa4c51bbf23a4cc26610",
+      "path": "fixtures/oracle-candidates/issue-2963/pkg/deco.py"
+    },
+    {
+      "sha256": "8dcf81d5785077fbbec81d28b846607cc0b0675871b1b8ed65d057e7a5d01f0f",
+      "path": "fixtures/oracle-candidates/issue-2963/pkg/__init__.py"
+    },
+    {
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+      "path": "fixtures/oracle-candidates/n4-py-builtin/other/__init__.py"
+    },
+    {
+      "sha256": "13c5a4ab4cbe963678e2e1a07699ee84c4ab23b141d1da1c0632d98bc07f3b04",
+      "path": "fixtures/oracle-candidates/n4-py-builtin/other/far.py"
+    },
+    {
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+      "path": "fixtures/oracle-candidates/n2-py-comprehension/other/__init__.py"
+    },
+    {
+      "sha256": "b42973bc1827cc688005202326a1e7c1550ba14d9fe04829d8729b7063e887c7",
+      "path": "fixtures/oracle-candidates/n2-py-comprehension/other/far.py"
+    },
+    {
+      "sha256": "beba4cf670230c0508b9dcf66b0d37bf669670787d189842d0bfd0098063dd3c",
+      "path": "fixtures/oracle-candidates/n5-ts-barrel-member/fx/deaf.ts"
+    },
+    {
+      "sha256": "5c93162a42428600b64c7d7b422d7532712214b74288ac344c9e14d5a92f8a24",
+      "path": "fixtures/oracle-candidates/n5-ts-barrel-member/fx/index.ts"
+    },
+    {
+      "sha256": "3eb7ec3652ee379dff6c5ab4f9b879ebf0d3241ec5cd69ad35c29feab7529532",
+      "path": "fixtures/oracle-candidates/n5-ts-barrel-member/fx/mark.ts"
+    },
+    {
+      "sha256": "ef5e0b9c21c8b89c4dcf93779803488686b0c42abdc0261c0a89c067a9a3711f",
+      "path": "fixtures/oracle-candidates/p4/lab/model.py"
+    },
+    {
+      "sha256": "9292221365869ae6b6f607ab697f7037de75b7fc00133aed3f661767721b6793",
+      "path": "fixtures/oracle-candidates/p4/other/features.py"
+    },
+    {
+      "sha256": "c873cd7099a0dd6333bb28872973461d619bcc8df3c5228bdb80a6baf0b0e66a",
+      "path": "fixtures/oracle-candidates/n1-py-local-import/pkg/core.py"
+    },
+    {
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+      "path": "fixtures/oracle-candidates/n1-py-local-import/pkg/__init__.py"
+    },
+    {
+      "sha256": "14f08e1445b307a118a693255de4317ca21dae9525795a9f156cf7df554b52f2",
+      "path": "fixtures/oracle-candidates/issue-2973/src/a_cart.js"
+    },
+    {
+      "sha256": "74d8276bf528b9f5089c06dad5a15670c23ea7a3fa01981dbec5f8c9acc01a46",
+      "path": "fixtures/oracle-candidates/issue-2973/src/b_profile.js"
+    },
+    {
+      "sha256": "c95d8747523c72793170d8440a894a5153037e4df29be5c87de398741309db40",
+      "path": "fixtures/oracle-candidates/issue-2975/routes/api.php"
+    },
+    {
+      "sha256": "4671ec0241297da4f99957d4dd2351cc5e8d5863477ce880c19fe40a37cb2b69",
+      "path": "fixtures/oracle-candidates/issue-2975/app/Http/Controllers/UserController.php"
+    },
+    {
+      "sha256": "2bfaa44c833308e10f61991a3edce65e46c2e304b91f93c66a4103b3f6b49baa",
+      "path": "fixtures/oracle-candidates/issue-2975/app/Http/Controllers/Admin/UserController.php"
+    },
+    {
+      "sha256": "251a2e323925568a976733f67803e5dbd0c4962e87f72e13b66775a3482e5dec",
+      "path": "fixtures/oracle-candidates/issue-2964/lib/index.js"
+    },
+    {
+      "sha256": "9a46e7bd78062df9ac62737070ae675305ccd34b56eeb51216b34a686ae1b19d",
+      "path": "fixtures/oracle-candidates/issue-2964/test/a.test.js"
+    },
+    {
+      "sha256": "9cc24081bd4a690f0f2484f378121c42dd77b53ccd99866b05e6061cf33d00f8",
+      "path": "fixtures/oracle-candidates/issue-2964/lib/inner/entry.js"
+    },
+    {
+      "sha256": "3c340d0ee647a44026e3c2821a88377d6b8f27a792f33177af9eafd8b115cf12",
+      "path": "fixtures/oracle-candidates/issue-2964/lib/inner/package.json"
+    },
+    {
+      "sha256": "00d5f0593b7423b2b9db12bee4947443a0b70f341458218506a1fe9ab7072b2b",
+      "path": "fixtures/oracle-candidates/issue-2958/pkg/cli.py"
+    },
+    {
+      "sha256": "95afb0156f7f3b68d3319f581cabc8793edf1c2a0c3a92bcc357814a355291f6",
+      "path": "fixtures/oracle-candidates/issue-2958/examples/factory.py"
+    },
+    {
+      "sha256": "e86232c4dbc7cbc5621e84b511d7618dea8354e885ea9019791ade7098a5d867",
+      "path": "fixtures/oracle-candidates/issue-2957/pkg/_client.py"
+    },
+    {
+      "sha256": "e0d5bccb361bca6d01fc49b9de57b88d1997520e79791a09af65cf22edb51f0e",
+      "path": "fixtures/oracle-candidates/issue-2957/pkg/__init__.py"
+    },
+    {
+      "sha256": "6428bc3174dfc6b4bb19648ebe2bd329c05c45e0c3a450e3bea8d248156838d0",
+      "path": "fixtures/oracle-candidates/issue-2974/src/server.js"
+    },
+    {
+      "sha256": "80d320adf5f77c00e2682b4c6ad3a12a80fe425fe9f9b8041dfa0df2992e97bf",
+      "path": "fixtures/oracle-candidates/issue-2974/src/client.js"
+    },
+    {
+      "sha256": "cbfd8d558c2ec86f19d3342227c8782628111fc77f3dd1e8c3b3d4ab794d39e4",
+      "path": "fixtures/oracle-candidates/issue-2953/lib/reply.js"
+    },
+    {
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+      "path": "fixtures/oracle-candidates/n3-py-enclosing-local/other/__init__.py"
+    },
+    {
+      "sha256": "4122ee7b460d475dacf958ae7ff1ada8d4b9066ae9e8bd628c62dd6f46e6f3f5",
+      "path": "fixtures/oracle-candidates/n3-py-enclosing-local/other/far.py"
+    },
+    {
+      "sha256": "048d7a65cf53b705fd3ee169727158a6c25a09bc9f11375016ecbe73931b9c57",
+      "path": "fixtures/oracle-candidates/issue-2952/lib/utils.js"
+    },
+    {
+      "sha256": "dc2eef2d26fbbbc48e7b6638c0f9e3cc0cfb688d8d58c5ae4a132611446384e3",
+      "path": "fixtures/oracle-candidates/issue-2952/test/utils.js"
+    },
+    {
+      "sha256": "44b0f8f39571dc149309216a7d39c6efc7cc00d578c8d32f829d8e457a334483",
+      "path": "fixtures/sync-history/fx-tsx/s0/src/types/other.ts"
+    },
+    {
+      "sha256": "e8f39fcd91dac5bcebcc8ea39c5618abdd559db5fad56d44965085ef16254659",
+      "path": "fixtures/sync-history/fx-tsx/s0/src/types/index.ts"
+    },
+    {
+      "sha256": "d576b7355149493ad741f6e075c981d90d31abffadeeaec58c99f604a1ae5bea",
+      "path": "fixtures/sync-history/fx-tsx/s2/src/pages/ClocksPage.tsx"
+    },
+    {
+      "sha256": "d809c90799fd7f55f1b1d739e28dc3c29eb7f18c8f6bc2ad1c0eed0db8ae93ab",
+      "path": "fixtures/sync-history/fx-tsx/s3/src/types/index.ts"
+    },
+    {
+      "sha256": "6e56038744c22412825f22bf7164665c652cbdb6375c882894066275e94dd7bc",
+      "path": "fixtures/sync-history/fx-tsx/s1/src/types/clocks.ts"
+    },
+    {
+      "sha256": "80d7f6e1c43a7b5c0319f82e119f3f852998abeb64e587cc73c9349293928397",
+      "path": "fixtures/sync-history/fx-ts/s1/lib.ts"
+    },
+    {
+      "sha256": "eec6e37be0ed106e1e4e6d3d8e1f6049e98ff6954e9cbd3b32305c887ce2ed89",
+      "path": "fixtures/sync-history/fx-ts/s0/lib.test.ts"
+    },
+    {
+      "sha256": "cff8b980eb98d090232a4cab41e7fc4d1388bc4845f24641f43621c8bf8a2285",
+      "path": "fixtures/sync-history/fx-ts/s0/lib.ts"
+    },
+    {
+      "sha256": "7ea568490d583211aff47a48b540abffa9e04f938ee130ac2431850edc0986d6",
+      "path": "fixtures/sync-history/fx-tsx2/s0/backend/schemas.py"
+    },
+    {
+      "sha256": "44b0f8f39571dc149309216a7d39c6efc7cc00d578c8d32f829d8e457a334483",
+      "path": "fixtures/sync-history/fx-tsx2/s0/src/types/other.ts"
+    },
+    {
+      "sha256": "e8f39fcd91dac5bcebcc8ea39c5618abdd559db5fad56d44965085ef16254659",
+      "path": "fixtures/sync-history/fx-tsx2/s0/src/types/index.ts"
+    },
+    {
+      "sha256": "d576b7355149493ad741f6e075c981d90d31abffadeeaec58c99f604a1ae5bea",
+      "path": "fixtures/sync-history/fx-tsx2/s2/src/pages/ClocksPage.tsx"
+    },
+    {
+      "sha256": "d809c90799fd7f55f1b1d739e28dc3c29eb7f18c8f6bc2ad1c0eed0db8ae93ab",
+      "path": "fixtures/sync-history/fx-tsx2/s3/src/types/index.ts"
+    },
+    {
+      "sha256": "6e56038744c22412825f22bf7164665c652cbdb6375c882894066275e94dd7bc",
+      "path": "fixtures/sync-history/fx-tsx2/s1/src/types/clocks.ts"
+    },
+    {
+      "sha256": "2c7b259cfac9c946c9fb5504a422dff01f021e7775871300cc16b22d3fe11b03",
+      "path": "fixtures/sync-history/fx-go/s1/model.go"
+    },
+    {
+      "sha256": "515cb85f2332be0feb52479af50b143618694843e5a8f4ba2462a4a8244ec7fb",
+      "path": "fixtures/sync-history/fx-go/s2/open.go"
+    },
+    {
+      "sha256": "dc5866b30768eb6dd07e8ffc042908e24fffe78c00e7aba2619c6952e1af9243",
+      "path": "fixtures/sync-history/fx-go/s0/go.mod"
+    },
+    {
+      "sha256": "c7b16716c9e050ced3613e86eaf62f529f90f9332fe7ed97fc5a0fe1fa09598d",
+      "path": "fixtures/sync-history/fx-go/s0/db/db.go"
+    },
+    {
+      "sha256": "2c7b259cfac9c946c9fb5504a422dff01f021e7775871300cc16b22d3fe11b03",
+      "path": "fixtures/sync-history/fx-go-one/s1/model.go"
+    },
+    {
+      "sha256": "515cb85f2332be0feb52479af50b143618694843e5a8f4ba2462a4a8244ec7fb",
+      "path": "fixtures/sync-history/fx-go-one/s1/open.go"
+    },
+    {
+      "sha256": "dc5866b30768eb6dd07e8ffc042908e24fffe78c00e7aba2619c6952e1af9243",
+      "path": "fixtures/sync-history/fx-go-one/s0/go.mod"
+    },
+    {
+      "sha256": "c7b16716c9e050ced3613e86eaf62f529f90f9332fe7ed97fc5a0fe1fa09598d",
+      "path": "fixtures/sync-history/fx-go-one/s0/db/db.go"
+    },
+    {
+      "sha256": "2293c6331d56b1fb877dd322cdc747b98ec653b229fc92e704eecad5c13e6b84",
+      "path": "fixtures/sync-history/fx-py-ctl/s0/t.py"
+    },
+    {
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+      "path": "fixtures/sync-history/fx-py-ctl/s0/top/__init__.py"
+    },
+    {
+      "sha256": "e0a26041bd37317c8fa601af4513e414c0403be9ce6af715eca951533b2840fa",
+      "path": "fixtures/sync-history/fx-py-ctl/s0/top/sub/h.py"
+    },
+    {
+      "sha256": "4e84e1d53f2d53cf3c176c63eb9ebe58aab1cc3492765ba53890e1c20f7164ae",
+      "path": "fixtures/sync-history/fx-py-ctl/s0/top/sub/__init__.py"
+    },
+    {
+      "sha256": "566b952b70f61b2f6db98ea40f4c65cefccb142dd8e2880cc8506b5eb1f7fcb0",
+      "path": "fixtures/sync-history/fx-py-ctl/s1/top/sub/__init__.py"
+    },
+    {
+      "sha256": "7ea568490d583211aff47a48b540abffa9e04f938ee130ac2431850edc0986d6",
+      "path": "fixtures/sync-history/fx-tsx2-p/s0/backend/schemas.py"
+    },
+    {
+      "sha256": "44b0f8f39571dc149309216a7d39c6efc7cc00d578c8d32f829d8e457a334483",
+      "path": "fixtures/sync-history/fx-tsx2-p/s0/src/types/other.ts"
+    },
+    {
+      "sha256": "e8f39fcd91dac5bcebcc8ea39c5618abdd559db5fad56d44965085ef16254659",
+      "path": "fixtures/sync-history/fx-tsx2-p/s0/src/types/index.ts"
+    },
+    {
+      "sha256": "d576b7355149493ad741f6e075c981d90d31abffadeeaec58c99f604a1ae5bea",
+      "path": "fixtures/sync-history/fx-tsx2-p/s2/src/pages/ClocksPage.tsx"
+    },
+    {
+      "sha256": "6e56038744c22412825f22bf7164665c652cbdb6375c882894066275e94dd7bc",
+      "path": "fixtures/sync-history/fx-tsx2-p/s1/src/types/clocks.ts"
+    },
+    {
+      "sha256": "44b0f8f39571dc149309216a7d39c6efc7cc00d578c8d32f829d8e457a334483",
+      "path": "fixtures/sync-history/fx-tsx-p/s0/src/types/other.ts"
+    },
+    {
+      "sha256": "e8f39fcd91dac5bcebcc8ea39c5618abdd559db5fad56d44965085ef16254659",
+      "path": "fixtures/sync-history/fx-tsx-p/s0/src/types/index.ts"
+    },
+    {
+      "sha256": "d576b7355149493ad741f6e075c981d90d31abffadeeaec58c99f604a1ae5bea",
+      "path": "fixtures/sync-history/fx-tsx-p/s2/src/pages/ClocksPage.tsx"
+    },
+    {
+      "sha256": "6e56038744c22412825f22bf7164665c652cbdb6375c882894066275e94dd7bc",
+      "path": "fixtures/sync-history/fx-tsx-p/s1/src/types/clocks.ts"
+    },
+    {
+      "sha256": "238591e18c6a52da0649019e8c54856c3204959a625cb3ca4ec1602f5a7d677f",
+      "path": "fixtures/sync-history/fx-dup/s1/DELETE"
+    },
+    {
+      "sha256": "5506121a4d39ce698f1ac1143913f2cc66ee035e32c6fac1852a227793236a2f",
+      "path": "fixtures/sync-history/fx-dup/s1/b.ts"
+    },
+    {
+      "sha256": "822a6409f6d528817fc55d9bdb58d24fa23f9dbd81a1a1a28e6695c33f89f1ec",
+      "path": "fixtures/sync-history/fx-dup/s0/t.ts"
+    },
+    {
+      "sha256": "3b181e1cfbe6d580daaae913223d3c14a4306d7d5a663ead0b3e8bdc2d1506b7",
+      "path": "fixtures/sync-history/fx-dup/s0/a.ts"
+    },
+    {
+      "sha256": "613cf172b343bfb1b4ca1bd5aadd34f3875c94845cefd64a3326679a6d88cd1b",
+      "path": "fixtures/sync-history/fx-dup/s0/b.ts"
+    },
+    {
+      "sha256": "12817dac3db65aef3d39e225d1f0fe6e02b13617838ce5c716015a78e378dc13",
+      "path": "fixtures/sync-history/fx-py/s0/t.py"
+    },
+    {
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+      "path": "fixtures/sync-history/fx-py/s0/top/__init__.py"
+    },
+    {
+      "sha256": "e0a26041bd37317c8fa601af4513e414c0403be9ce6af715eca951533b2840fa",
+      "path": "fixtures/sync-history/fx-py/s0/top/sub/h.py"
+    },
+    {
+      "sha256": "4e84e1d53f2d53cf3c176c63eb9ebe58aab1cc3492765ba53890e1c20f7164ae",
+      "path": "fixtures/sync-history/fx-py/s0/top/sub/__init__.py"
+    },
+    {
+      "sha256": "566b952b70f61b2f6db98ea40f4c65cefccb142dd8e2880cc8506b5eb1f7fcb0",
+      "path": "fixtures/sync-history/fx-py/s1/top/sub/__init__.py"
+    },
+    {
+      "sha256": "70f65ecb1a907d5a1cce31495c880887b39ffe9ac75e6ed20a64078e501a7e89",
+      "path": "lib/subjects/codegraph.mjs"
+    },
+    {
+      "sha256": "0909f5127d418fce1c56a7c7b8fa8bf495f930613a3a7fb6c78e9ba9b9d97c60",
+      "path": "lib/subjects/index.mjs"
+    },
+    {
+      "sha256": "b28b80e222144ae9b244985f9b8a9750a307d677fb89abf2cac3f26a83f5d13a",
+      "path": "lib/subjects/code-graph-rag.mjs"
+    }
+  ]
+}
diff --git a/docs/handoffs/pr29-2026-11-10/harness/questions.json b/docs/handoffs/pr29-2026-11-10/harness/questions.json
new file mode 100644
index 0000000000..a953155430
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/harness/questions.json
@@ -0,0 +1,170 @@
+{
+  "note": "Pinned agent-facing questions for differential/shadow.mjs. repo: an oracle/targets.txt name or a path relative to the qa root. q: codegraph CLI arguments (the CLI prints what the MCP tools return).",
+  "questions": [
+    {
+      "repo": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/mux",
+      "q": [
+        "explore",
+        "Router ServeHTTP",
+        "--max-files",
+        "2"
+      ]
+    },
+    {
+      "repo": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/mux",
+      "q": [
+        "explore",
+        "Route Match regexp",
+        "--max-files",
+        "2"
+      ]
+    },
+    {
+      "repo": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/mux",
+      "q": [
+        "callers",
+        "HandleFunc"
+      ]
+    },
+    {
+      "repo": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/mux",
+      "q": [
+        "callees",
+        "ServeHTTP"
+      ]
+    },
+    {
+      "repo": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/mux",
+      "q": [
+        "node",
+        "ServeHTTP"
+      ]
+    },
+    {
+      "repo": "fixtures/oracle-candidates/issue-2952",
+      "q": [
+        "callers",
+        "normalizeType"
+      ]
+    },
+    {
+      "repo": "fixtures/oracle-candidates/issue-2952",
+      "q": [
+        "callees",
+        "t"
+      ]
+    },
+    {
+      "repo": "fixtures/oracle-candidates/j1-java-overload",
+      "q": [
+        "callers",
+        "load"
+      ]
+    },
+    {
+      "repo": "fixtures/oracle-candidates/g1-go-new-receiver",
+      "q": [
+        "callers",
+        "Host"
+      ]
+    },
+    {
+      "repo": "fixtures/oracle-candidates/m2-py-method-return-local",
+      "q": [
+        "callers",
+        "add"
+      ]
+    },
+    {
+      "repo": "fixtures/oracle-candidates/t1-ts-global-builtin",
+      "q": [
+        "callers",
+        "parseInt"
+      ]
+    },
+    {
+      "repo": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/express",
+      "q": [
+        "explore",
+        "createApplication handle use"
+      ]
+    },
+    {
+      "repo": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/express",
+      "q": [
+        "callers",
+        "createApplication"
+      ]
+    },
+    {
+      "repo": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/express",
+      "q": [
+        "callees",
+        "createApplication"
+      ]
+    },
+    {
+      "repo": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/ky",
+      "q": [
+        "explore",
+        "Ky create request"
+      ]
+    },
+    {
+      "repo": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/ky",
+      "q": [
+        "callers",
+        "create"
+      ]
+    },
+    {
+      "repo": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/ky",
+      "q": [
+        "callees",
+        "create"
+      ]
+    },
+    {
+      "repo": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/requests",
+      "q": [
+        "explore",
+        "Session request send"
+      ]
+    },
+    {
+      "repo": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/requests",
+      "q": [
+        "callers",
+        "request"
+      ]
+    },
+    {
+      "repo": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/requests",
+      "q": [
+        "callees",
+        "send"
+      ]
+    },
+    {
+      "repo": "fixtures/oracle-candidates/pr29-01-f14-object",
+      "q": [
+        "callees",
+        "run"
+      ]
+    },
+    {
+      "repo": "fixtures/oracle-candidates/pr29-04-f15-number",
+      "q": [
+        "callees",
+        "run"
+      ]
+    },
+    {
+      "repo": "fixtures/oracle-candidates/pr29-06-f15-assigned-callable",
+      "q": [
+        "callees",
+        "run"
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/handoffs/pr29-2026-11-10/harness/replay-baseline.json b/docs/handoffs/pr29-2026-11-10/harness/replay-baseline.json
new file mode 100644
index 0000000000..f9e2ccbb21
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/harness/replay-baseline.json
@@ -0,0 +1,2025 @@
+{
+ "subject": "codegraph",
+ "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae",
+ "build": "/tmp/codegraph-pr29-harness-6fevujfy/baseline/dist/bin/codegraph.js",
+ "results": [
+  {
+   "name": "a",
+   "issue": 3034,
+   "verdict": "BROKEN",
+   "detail": "Handler::run -calls-> lib.ts:find",
+   "canary": {
+    "marker": "CGQA_CANARY_848ec8f2411b9e2cc3e399a93312dcd3",
+    "files": [
+     "handler.ts",
+     "lib.ts"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "b",
+   "issue": 3035,
+   "verdict": "BROKEN",
+   "detail": "take -calls-> session.ts:Session::snapshot",
+   "canary": {
+    "marker": "CGQA_CANARY_6f5cc81c43ce68632abb432d166ef250",
+    "files": [
+     "queries.ts",
+     "session.ts"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "c",
+   "issue": 3036,
+   "verdict": "BROKEN",
+   "detail": "Orchestrator::check -calls-> cache.ts:Cache::has",
+   "canary": {
+    "marker": "CGQA_CANARY_693845abfd12606104ed231a161583bc",
+    "files": [
+     "cache.ts",
+     "orch.ts"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "g1-go-new-receiver",
+   "issue": 3237,
+   "verdict": "BROKEN",
+   "detail": "viaNew -calls-> a_router.go:Router::Host",
+   "canary": {
+    "marker": "CGQA_CANARY_993953a867628045f18c0ce508207d76",
+    "files": [
+     "a_router.go",
+     "b_route.go",
+     "use.go"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2944",
+   "issue": 2944,
+   "verdict": "BROKEN",
+   "detail": "a.test.ts -calls-> a.test.ts:setup@26",
+   "canary": {
+    "marker": "CGQA_CANARY_86ae861c2465293893f82a1446bd5c53",
+    "files": [
+     "a.test.ts",
+     "decl.d.ts"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2946",
+   "issue": 2946,
+   "verdict": "BROKEN",
+   "detail": "run -calls-> writer.ts:StoreWriter::close",
+   "canary": {
+    "marker": "CGQA_CANARY_1b1807e99aae359f4ae71a9286de1332",
+    "files": [
+     "db.ts",
+     "use.ts",
+     "writer.ts"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2947",
+   "issue": 2947,
+   "verdict": "BROKEN",
+   "detail": "a -calls-> app.ts:App::render; b -calls-> app.ts:App::close; c -calls-> app.ts:App::close; d -calls-> app.ts:App::translate",
+   "canary": {
+    "marker": "CGQA_CANARY_9b3f5158cbd5fcf4e44b97c5c9aab5fa",
+    "files": [
+     "app.ts",
+     "use.ts"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2948",
+   "issue": 2948,
+   "verdict": "BROKEN",
+   "detail": "Scene::a -calls-> heap.ts:BinaryHeap::push; Scene::b -calls-> heap.ts:Conf::includes",
+   "canary": {
+    "marker": "CGQA_CANARY_5ea918c6965f7a28c4a23755c84f7138",
+    "files": [
+     "heap.ts",
+     "use.ts"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2949",
+   "issue": 2949,
+   "verdict": "BROKEN",
+   "detail": "scanD::skipValue -calls-> lib.ts:skipString; scanE::skipValue -calls-> lib.ts:skipString",
+   "canary": {
+    "marker": "CGQA_CANARY_d39dea268ae5931e1034483612fc3a81",
+    "files": [
+     "lib.ts",
+     "use.ts"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2951",
+   "issue": 2951,
+   "verdict": "BROKEN",
+   "detail": "useA -calls-> schemas.ts:ZodString::ipv4; useC -calls-> schemas.ts:ZodString::ipv4; useD -calls-> schemas.ts:ZodString::ipv4",
+   "canary": {
+    "marker": "CGQA_CANARY_6f978f0614887078c73c44de4e35a6cf",
+    "files": [
+     "a.ts",
+     "b.ts",
+     "c.ts",
+     "d.ts",
+     "external.ts",
+     "index.ts",
+     "index2.ts",
+     "index3.ts",
+     "schemas.ts"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2952",
+   "issue": 2952,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_0549dc6165d7af69b01bdc63adc89951",
+    "files": [
+     "lib/utils.js",
+     "test/utils.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2953",
+   "issue": 2953,
+   "verdict": "BROKEN",
+   "detail": "handlerC -calls-> streaming.ts:stream; localConst -calls-> streaming.ts:stream",
+   "canary": {
+    "marker": "CGQA_CANARY_be5b38f5d4c8e0c1386b8d44878ec295",
+    "files": [
+     "app.ts",
+     "cjsapp.js",
+     "lib/reply.js",
+     "streaming.ts"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2954",
+   "issue": 2954,
+   "verdict": "BROKEN",
+   "detail": "Tools::run -calls-> lib.ts:findAll; Tools::size -calls-> lib.ts:getFactor",
+   "canary": {
+    "marker": "CGQA_CANARY_58f0b444ebc9c68901b0fd92ff68c99c",
+    "files": [
+     "lib.ts",
+     "tools.ts"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2957",
+   "issue": 2957,
+   "verdict": "BROKEN",
+   "detail": "attr_named_client -calls-> pkg/_client.py:Client::fetch; with_named_client -calls-> pkg/_client.py:Client::fetch",
+   "canary": {
+    "marker": "CGQA_CANARY_700c38a4080f0535522d2014a952153c",
+    "files": [
+     "pkg/__init__.py",
+     "pkg/_client.py",
+     "use.py"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2958",
+   "issue": 2958,
+   "verdict": "BROKEN",
+   "detail": "ScriptInfo::load_app -calls-> examples/factory.py:create_app",
+   "canary": {
+    "marker": "CGQA_CANARY_2a5c49f877445af0612784a2d7e0d2a2",
+    "files": [
+     "examples/factory.py",
+     "pkg/cli.py"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2962",
+   "issue": 2962,
+   "verdict": "BROKEN",
+   "detail": "objSpread -calls-> auth.ts:register; jsxSpread -calls-> auth.ts:register; jsxSpreadNested -calls-> auth.ts:register",
+   "canary": {
+    "marker": "CGQA_CANARY_586334d1029da893915bfc2e0cf8af61",
+    "files": [
+     "auth.ts",
+     "use.tsx"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2963",
+   "issue": 2963,
+   "verdict": "BROKEN",
+   "detail": "run -calls-> pkg/deco.py:command@5; run -calls-> pkg/deco.py:Prompt::ask@23",
+   "canary": {
+    "marker": "CGQA_CANARY_e0082576aa14d8f0cf1d694775e1ad3d",
+    "files": [
+     "pkg/__init__.py",
+     "pkg/deco.py",
+     "use.py"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2964",
+   "issue": 2964,
+   "verdict": "BROKEN",
+   "detail": "t -calls-> test/a.test.js:Srv; t -calls-> test/a.test.js:Srv2; u -calls-> b.js:inner",
+   "canary": {
+    "marker": "CGQA_CANARY_5a4d6057f4fb6737becc39ec3a0feb2a",
+    "files": [
+     "b.js",
+     "lib/index.js",
+     "lib/inner/entry.js",
+     "srv.js",
+     "test/a.test.js"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2966",
+   "issue": 2966,
+   "verdict": "BROKEN",
+   "detail": "lib/hooks.js -calls-> lib/validation.js:validate; lib/reply.js -calls-> lib/types.d.ts:FastifyReply::getHeader; lib/context.js -calls-> lib/application.js:Application::toJSON; init -calls-> lib/other.js:Cast::insertMany",
+   "canary": {
+    "marker": "CGQA_CANARY_55c52b4854e81dce8c56330b31badb9d",
+    "files": [
+     "lib/application.js",
+     "lib/context.js",
+     "lib/hooks.js",
+     "lib/model.js",
+     "lib/other.js",
+     "lib/reply.js",
+     "lib/types.d.ts",
+     "lib/validation.js",
+     "test/model.test.js"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2967",
+   "issue": 2967,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_2ec561e0802571485714650dbf7d0746",
+    "files": [
+     "mod.js",
+     "mod.ts",
+     "page.tsx",
+     "use.js",
+     "use.ts",
+     "use.tsx"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2973",
+   "issue": 2973,
+   "verdict": "GUESSED",
+   "detail": "guessed saveProfile -calls-> src/a_cart.js:handleSave",
+   "canary": {
+    "marker": "CGQA_CANARY_ae56e5a576e9883eedea3fb0c80408bf",
+    "files": [
+     "src/a_cart.js",
+     "src/b_profile.js"
+    ],
+    "verdict": "GUESSED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2974",
+   "issue": 2974,
+   "verdict": "GUESSED",
+   "detail": "guessed loadGithubProfile -calls-> src/server.js:src/server.js::GET:/users/:id",
+   "canary": {
+    "marker": "CGQA_CANARY_107206d28b104138ed930b813ac233f4",
+    "files": [
+     "src/client.js",
+     "src/server.js"
+    ],
+    "verdict": "GUESSED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2975",
+   "issue": 2975,
+   "verdict": "BROKEN",
+   "detail": "routes/api.php::route:/admin/users/{id} -references-> app/Http/Controllers/UserController.php:App\\Http\\Controllers::UserController::show",
+   "canary": {
+    "marker": "CGQA_CANARY_bc7ee71520de5a4267f352a0a894decd",
+    "files": [
+     "app/Http/Controllers/Admin/UserController.php",
+     "app/Http/Controllers/UserController.php",
+     "routes/api.php"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2976",
+   "issue": 2976,
+   "verdict": "BROKEN",
+   "detail": "com.x.m::Main::go -calls-> src/com/x/a/Util.java:com.x.a::Util::log",
+   "canary": {
+    "marker": "CGQA_CANARY_6a4f96da0bdbfdce53dfb14bf4fca099",
+    "files": [
+     "src/com/x/a/Util.java",
+     "src/com/x/b/Util.java",
+     "src/com/x/m/Main.java"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "j1-java-overload",
+   "issue": 3040,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_82f7c78c9fd8c9a933566a29ee8fa107",
+    "files": [
+     "src/p/App.java",
+     "src/p/Parser.java",
+     "src/p/Util.java"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "kmp-22",
+   "issue": 3033,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_1712209927c85024cb0bc6135ca7f29d",
+    "files": [
+     "app/src/main/java/b/App.java"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "m1-py-super",
+   "issue": 3218,
+   "verdict": "BROKEN",
+   "detail": "missing Child::__init__ -calls-> base.py:Base::__init__; Child::greet -calls-> base.py:Base::greet; LocalChild::run -calls-> child.py:Local::run",
+   "canary": {
+    "marker": "CGQA_CANARY_8656a72f5276606bf2cd6e37ded447f6",
+    "files": [
+     "base.py",
+     "child.py"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "m2-py-method-return-local",
+   "issue": 3240,
+   "verdict": "BROKEN",
+   "detail": "missing via_method -calls-> t.py:Stager::add; via_param_method -calls-> t.py:Stager::add",
+   "canary": {
+    "marker": "CGQA_CANARY_4ec22c11d3e06ef5cc32dd412218209e",
+    "files": [
+     "t.py"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "n1-py-local-import",
+   "issue": 3229,
+   "verdict": "BROKEN",
+   "detail": "test_one -calls-> pkg/core.py:reverts",
+   "canary": {
+    "marker": "CGQA_CANARY_2916a70ddacdb3108870a568bc2a2e9a",
+    "files": [
+     "pkg/__init__.py",
+     "pkg/core.py",
+     "t_local_import.py"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "n2-py-comprehension",
+   "issue": 3230,
+   "verdict": "BROKEN",
+   "detail": "comp -calls-> other/far.py:p",
+   "canary": {
+    "marker": "CGQA_CANARY_498a0a4687d17ee636b7c0f289249ba4",
+    "files": [
+     "other/__init__.py",
+     "other/far.py",
+     "t.py"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "n3-py-enclosing-local",
+   "issue": 3231,
+   "verdict": "BROKEN",
+   "detail": "closure::inner -calls-> other/far.py:evaluate",
+   "canary": {
+    "marker": "CGQA_CANARY_f8554c503c0d6b85ffa71fad349cec70",
+    "files": [
+     "other/__init__.py",
+     "other/far.py",
+     "t.py"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "n4-py-builtin",
+   "issue": 3232,
+   "verdict": "BROKEN",
+   "detail": "run -instantiates-> other/far.py:TimeoutError",
+   "canary": {
+    "marker": "CGQA_CANARY_a2c32ba5e3267d5caaf74fa80a4c79cd",
+    "files": [
+     "other/__init__.py",
+     "other/far.py",
+     "t.py"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "n5-ts-barrel-member",
+   "issue": 3233,
+   "verdict": "BROKEN",
+   "detail": "useNamed -calls-> fx/deaf.ts:DEAF::mark; useNs -calls-> fx/deaf.ts:DEAF::mark",
+   "canary": {
+    "marker": "CGQA_CANARY_a762a6349406106b5c02542fc3f99d9f",
+    "files": [
+     "b.ts",
+     "c.ts",
+     "fx/deaf.ts",
+     "fx/index.ts",
+     "fx/mark.ts"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "p1",
+   "issue": 3037,
+   "verdict": "BROKEN",
+   "detail": "test_one -calls-> t.py:flat",
+   "canary": {
+    "marker": "CGQA_CANARY_eaf6ddd0575d0913040a9fcb026dfe13",
+    "files": [
+     "t.py"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "p3",
+   "issue": 3038,
+   "verdict": "BROKEN",
+   "detail": "size_of_made -calls-> arm.py:Arm::stat",
+   "canary": {
+    "marker": "CGQA_CANARY_0eae1593fc55939cc87a20c44b63648b",
+    "files": [
+     "arm.py",
+     "use.py"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "p4",
+   "issue": 3039,
+   "verdict": "BROKEN",
+   "detail": "MLP::forward -calls-> other/features.py:out",
+   "canary": {
+    "marker": "CGQA_CANARY_5c76a7ddca62f8b6882de5b5208dbb80",
+    "files": [
+     "lab/model.py",
+     "other/features.py"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "p5-py-stdlib-import",
+   "issue": 3239,
+   "verdict": "BROKEN",
+   "detail": "use.py -imports-> clock.py:time",
+   "canary": {
+    "marker": "CGQA_CANARY_6a67c61bde144e96c6a60a685d5e1b60",
+    "files": [
+     "clock.py",
+     "use.py"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-01-f14-object",
+   "issue": 29,
+   "verdict": "CHANGED",
+   "detail": "missing run -calls-> m.js:Store::load",
+   "canary": {
+    "marker": "CGQA_CANARY_5bdb3ec89680151682eb606620ebb7c4",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "CHANGED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-02-f14-class",
+   "issue": 29,
+   "verdict": "CHANGED",
+   "detail": "missing run -calls-> m.js:Store::load",
+   "canary": {
+    "marker": "CGQA_CANARY_2f6c091cff3d9a31362f29ac11436031",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "CHANGED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-03-f14-function",
+   "issue": 29,
+   "verdict": "CHANGED",
+   "detail": "missing run -calls-> m.js:Store::load",
+   "canary": {
+    "marker": "CGQA_CANARY_8c7a94df4899f49e8b6e9f7592073f38",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "CHANGED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-04-f15-number",
+   "issue": 29,
+   "verdict": "BROKEN",
+   "detail": "run -calls-> decoy.js:Decoy::load",
+   "canary": {
+    "marker": "CGQA_CANARY_7b16f1ca0beed3ca2bfd42bf589a3e05",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-05-f15-string",
+   "issue": 29,
+   "verdict": "BROKEN",
+   "detail": "run -calls-> decoy.js:Decoy::load",
+   "canary": {
+    "marker": "CGQA_CANARY_2f7522e333593acc110327175c20e4e9",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-06-f15-assigned-callable",
+   "issue": 29,
+   "verdict": "BROKEN",
+   "detail": "run -calls-> decoy.js:Decoy::load",
+   "canary": {
+    "marker": "CGQA_CANARY_05cf0990292be564154a11421344a331",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-07-f10-optional-wrapper",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_1b27943f6f356460ffe8780a878c755c",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "FAIL"
+   }
+  },
+  {
+   "name": "pr29-08-f11-generator-eval",
+   "issue": 29,
+   "verdict": "CHANGED",
+   "detail": "missing run -calls-> m.js:Store::load",
+   "canary": {
+    "marker": "CGQA_CANARY_683a5781283b95be92ef5cc013ec5e4c",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "CHANGED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-09-f11-generator-key-outside-generator",
+   "issue": 29,
+   "verdict": "BROKEN",
+   "detail": "run -calls-> decoy.js:Decoy::load",
+   "canary": {
+    "marker": "CGQA_CANARY_793850beb0ed6643cbf423006f8ea2f5",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-10-f12-root-object",
+   "issue": 29,
+   "verdict": "CHANGED",
+   "detail": "missing run -calls-> m.js:Store::load",
+   "canary": {
+    "marker": "CGQA_CANARY_171a4dac9e3befef6ad9333f5d2ff5f3",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "CHANGED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-11-f12-parenthesized-instance",
+   "issue": 29,
+   "verdict": "CHANGED",
+   "detail": "missing run -calls-> m.js:Store::load",
+   "canary": {
+    "marker": "CGQA_CANARY_6ee54c2f944b461be89ee51f3f2abdd5",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "CHANGED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-12-f12-logical-instance",
+   "issue": 29,
+   "verdict": "CHANGED",
+   "detail": "missing run -calls-> m.js:Store::load",
+   "canary": {
+    "marker": "CGQA_CANARY_240db09cbf3569bda925ca39a4cbbcb4",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "CHANGED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-13-f13-parameter",
+   "issue": 29,
+   "verdict": "BROKEN",
+   "detail": "run -calls-> decoy.js:Decoy::load",
+   "canary": {
+    "marker": "CGQA_CANARY_92d8c70708e4d6bc736ba6f6faa48d0f",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-14-f13-arrow",
+   "issue": 29,
+   "verdict": "BROKEN",
+   "detail": "run -calls-> decoy.js:Decoy::load",
+   "canary": {
+    "marker": "CGQA_CANARY_f96628d6fac154164234c0e615fe99e3",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-15-f13-block",
+   "issue": 29,
+   "verdict": "BROKEN",
+   "detail": "run -calls-> decoy.js:Decoy::load",
+   "canary": {
+    "marker": "CGQA_CANARY_fffd8bbd892cb1c80d880115d3a918b3",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-16-alias-property-mutation",
+   "issue": 29,
+   "verdict": "CHANGED",
+   "detail": "missing run -calls-> m.js:Store::load",
+   "canary": {
+    "marker": "CGQA_CANARY_4553e96d5749d55bf81f86accfb5ed77",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "CHANGED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-17-alias-rebind",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_11c589adbfe260372fb16242a01ebe84",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-18-property-overwrite",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_2bcfb566e38b509ab52acdc37b74cc2d",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-19-binding-overwrite",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_e604ca09bab79a6570af0fdb0bac4ab8",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-20-post-export-write",
+   "issue": 29,
+   "verdict": "CHANGED",
+   "detail": "missing run -calls-> m.js:Store::load",
+   "canary": {
+    "marker": "CGQA_CANARY_342ea164c9b9a8df09fd55a0c5327d09",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "CHANGED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-21-old-exports-alias",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_2649fa08cf5dc7ac26650c5eeecc7039",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-22-ambiguous-branch",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_9f264fa36376578c236ab737ecd25117",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-23-agreeing-branch",
+   "issue": 29,
+   "verdict": "CHANGED",
+   "detail": "missing run -calls-> m.js:Store::load",
+   "canary": {
+    "marker": "CGQA_CANARY_2855c5947d9bdd97033cb543fd69dacd",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "CHANGED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-24-opaque-escape",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_eb6263fbab3209997695c07c46328bc0",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-25-unknown-dynamic-key",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_e3fbd733edb7bd599aabd9dd6907c9d6",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-26-local-eval",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_a1d8dad97c26e8e22a36d185fff60c74",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-27-literal-eval",
+   "issue": 29,
+   "verdict": "CHANGED",
+   "detail": "missing run -calls-> m.js:Store::load",
+   "canary": {
+    "marker": "CGQA_CANARY_024836eefd61a271e1a81792b7858de8",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "CHANGED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-28-eval-property-on-local-identity",
+   "issue": 29,
+   "verdict": "CHANGED",
+   "detail": "missing run -calls-> m.js:Store::load",
+   "canary": {
+    "marker": "CGQA_CANARY_206007f86bcb155a7951adae1b994591",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "CHANGED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-29-uncertain-receiver-alias",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_958d1bf1e783577323f3601eb25816d1",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-30-data-overwrite-after-literal-eval",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_5eefb6a645f6a54b21700c1833102833",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-31-missing-read-exported-as-undefined-data",
+   "issue": 29,
+   "verdict": "BROKEN",
+   "detail": "run -calls-> decoy.js:Decoy::load",
+   "canary": {
+    "marker": "CGQA_CANARY_f326a00770b73aa649696feb37785185",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-32-logical-member-initialization",
+   "issue": 29,
+   "verdict": "CHANGED",
+   "detail": "missing run -calls-> m.js:Store::load",
+   "canary": {
+    "marker": "CGQA_CANARY_80543097ac47ed4bc940fe5dcbda55b3",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "CHANGED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "t1-ts-global-builtin",
+   "issue": 3238,
+   "verdict": "BROKEN",
+   "detail": "parse -calls-> lib/other.ts:parseInt; reply -instantiates-> lib/other.ts:Response",
+   "canary": {
+    "marker": "CGQA_CANARY_fd66031a97226f4eab6ae1e1f57c0316",
+    "files": [
+     "lib/other.ts",
+     "use.ts"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  }
+ ],
+ "canaries": {
+  "a": {
+   "marker": "CGQA_CANARY_848ec8f2411b9e2cc3e399a93312dcd3",
+   "files": [
+    "handler.ts",
+    "lib.ts"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "b": {
+   "marker": "CGQA_CANARY_6f5cc81c43ce68632abb432d166ef250",
+   "files": [
+    "queries.ts",
+    "session.ts"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "c": {
+   "marker": "CGQA_CANARY_693845abfd12606104ed231a161583bc",
+   "files": [
+    "cache.ts",
+    "orch.ts"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "g1-go-new-receiver": {
+   "marker": "CGQA_CANARY_993953a867628045f18c0ce508207d76",
+   "files": [
+    "a_router.go",
+    "b_route.go",
+    "use.go"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2944": {
+   "marker": "CGQA_CANARY_86ae861c2465293893f82a1446bd5c53",
+   "files": [
+    "a.test.ts",
+    "decl.d.ts"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2946": {
+   "marker": "CGQA_CANARY_1b1807e99aae359f4ae71a9286de1332",
+   "files": [
+    "db.ts",
+    "use.ts",
+    "writer.ts"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2947": {
+   "marker": "CGQA_CANARY_9b3f5158cbd5fcf4e44b97c5c9aab5fa",
+   "files": [
+    "app.ts",
+    "use.ts"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2948": {
+   "marker": "CGQA_CANARY_5ea918c6965f7a28c4a23755c84f7138",
+   "files": [
+    "heap.ts",
+    "use.ts"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2949": {
+   "marker": "CGQA_CANARY_d39dea268ae5931e1034483612fc3a81",
+   "files": [
+    "lib.ts",
+    "use.ts"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2951": {
+   "marker": "CGQA_CANARY_6f978f0614887078c73c44de4e35a6cf",
+   "files": [
+    "a.ts",
+    "b.ts",
+    "c.ts",
+    "d.ts",
+    "external.ts",
+    "index.ts",
+    "index2.ts",
+    "index3.ts",
+    "schemas.ts"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2952": {
+   "marker": "CGQA_CANARY_0549dc6165d7af69b01bdc63adc89951",
+   "files": [
+    "lib/utils.js",
+    "test/utils.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2953": {
+   "marker": "CGQA_CANARY_be5b38f5d4c8e0c1386b8d44878ec295",
+   "files": [
+    "app.ts",
+    "cjsapp.js",
+    "lib/reply.js",
+    "streaming.ts"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2954": {
+   "marker": "CGQA_CANARY_58f0b444ebc9c68901b0fd92ff68c99c",
+   "files": [
+    "lib.ts",
+    "tools.ts"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2957": {
+   "marker": "CGQA_CANARY_700c38a4080f0535522d2014a952153c",
+   "files": [
+    "pkg/__init__.py",
+    "pkg/_client.py",
+    "use.py"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2958": {
+   "marker": "CGQA_CANARY_2a5c49f877445af0612784a2d7e0d2a2",
+   "files": [
+    "examples/factory.py",
+    "pkg/cli.py"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2962": {
+   "marker": "CGQA_CANARY_586334d1029da893915bfc2e0cf8af61",
+   "files": [
+    "auth.ts",
+    "use.tsx"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2963": {
+   "marker": "CGQA_CANARY_e0082576aa14d8f0cf1d694775e1ad3d",
+   "files": [
+    "pkg/__init__.py",
+    "pkg/deco.py",
+    "use.py"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2964": {
+   "marker": "CGQA_CANARY_5a4d6057f4fb6737becc39ec3a0feb2a",
+   "files": [
+    "b.js",
+    "lib/index.js",
+    "lib/inner/entry.js",
+    "srv.js",
+    "test/a.test.js"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2966": {
+   "marker": "CGQA_CANARY_55c52b4854e81dce8c56330b31badb9d",
+   "files": [
+    "lib/application.js",
+    "lib/context.js",
+    "lib/hooks.js",
+    "lib/model.js",
+    "lib/other.js",
+    "lib/reply.js",
+    "lib/types.d.ts",
+    "lib/validation.js",
+    "test/model.test.js"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2967": {
+   "marker": "CGQA_CANARY_2ec561e0802571485714650dbf7d0746",
+   "files": [
+    "mod.js",
+    "mod.ts",
+    "page.tsx",
+    "use.js",
+    "use.ts",
+    "use.tsx"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2973": {
+   "marker": "CGQA_CANARY_ae56e5a576e9883eedea3fb0c80408bf",
+   "files": [
+    "src/a_cart.js",
+    "src/b_profile.js"
+   ],
+   "verdict": "GUESSED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2974": {
+   "marker": "CGQA_CANARY_107206d28b104138ed930b813ac233f4",
+   "files": [
+    "src/client.js",
+    "src/server.js"
+   ],
+   "verdict": "GUESSED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2975": {
+   "marker": "CGQA_CANARY_bc7ee71520de5a4267f352a0a894decd",
+   "files": [
+    "app/Http/Controllers/Admin/UserController.php",
+    "app/Http/Controllers/UserController.php",
+    "routes/api.php"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2976": {
+   "marker": "CGQA_CANARY_6a4f96da0bdbfdce53dfb14bf4fca099",
+   "files": [
+    "src/com/x/a/Util.java",
+    "src/com/x/b/Util.java",
+    "src/com/x/m/Main.java"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "j1-java-overload": {
+   "marker": "CGQA_CANARY_82f7c78c9fd8c9a933566a29ee8fa107",
+   "files": [
+    "src/p/App.java",
+    "src/p/Parser.java",
+    "src/p/Util.java"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "kmp-22": {
+   "marker": "CGQA_CANARY_1712209927c85024cb0bc6135ca7f29d",
+   "files": [
+    "app/src/main/java/b/App.java"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "m1-py-super": {
+   "marker": "CGQA_CANARY_8656a72f5276606bf2cd6e37ded447f6",
+   "files": [
+    "base.py",
+    "child.py"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "m2-py-method-return-local": {
+   "marker": "CGQA_CANARY_4ec22c11d3e06ef5cc32dd412218209e",
+   "files": [
+    "t.py"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "n1-py-local-import": {
+   "marker": "CGQA_CANARY_2916a70ddacdb3108870a568bc2a2e9a",
+   "files": [
+    "pkg/__init__.py",
+    "pkg/core.py",
+    "t_local_import.py"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "n2-py-comprehension": {
+   "marker": "CGQA_CANARY_498a0a4687d17ee636b7c0f289249ba4",
+   "files": [
+    "other/__init__.py",
+    "other/far.py",
+    "t.py"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "n3-py-enclosing-local": {
+   "marker": "CGQA_CANARY_f8554c503c0d6b85ffa71fad349cec70",
+   "files": [
+    "other/__init__.py",
+    "other/far.py",
+    "t.py"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "n4-py-builtin": {
+   "marker": "CGQA_CANARY_a2c32ba5e3267d5caaf74fa80a4c79cd",
+   "files": [
+    "other/__init__.py",
+    "other/far.py",
+    "t.py"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "n5-ts-barrel-member": {
+   "marker": "CGQA_CANARY_a762a6349406106b5c02542fc3f99d9f",
+   "files": [
+    "b.ts",
+    "c.ts",
+    "fx/deaf.ts",
+    "fx/index.ts",
+    "fx/mark.ts"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "p1": {
+   "marker": "CGQA_CANARY_eaf6ddd0575d0913040a9fcb026dfe13",
+   "files": [
+    "t.py"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "p3": {
+   "marker": "CGQA_CANARY_0eae1593fc55939cc87a20c44b63648b",
+   "files": [
+    "arm.py",
+    "use.py"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "p4": {
+   "marker": "CGQA_CANARY_5c76a7ddca62f8b6882de5b5208dbb80",
+   "files": [
+    "lab/model.py",
+    "other/features.py"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "p5-py-stdlib-import": {
+   "marker": "CGQA_CANARY_6a67c61bde144e96c6a60a685d5e1b60",
+   "files": [
+    "clock.py",
+    "use.py"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-01-f14-object": {
+   "marker": "CGQA_CANARY_5bdb3ec89680151682eb606620ebb7c4",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "CHANGED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-02-f14-class": {
+   "marker": "CGQA_CANARY_2f6c091cff3d9a31362f29ac11436031",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "CHANGED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-03-f14-function": {
+   "marker": "CGQA_CANARY_8c7a94df4899f49e8b6e9f7592073f38",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "CHANGED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-04-f15-number": {
+   "marker": "CGQA_CANARY_7b16f1ca0beed3ca2bfd42bf589a3e05",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-05-f15-string": {
+   "marker": "CGQA_CANARY_2f7522e333593acc110327175c20e4e9",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-06-f15-assigned-callable": {
+   "marker": "CGQA_CANARY_05cf0990292be564154a11421344a331",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-07-f10-optional-wrapper": {
+   "marker": "CGQA_CANARY_1b27943f6f356460ffe8780a878c755c",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "FAIL"
+  },
+  "pr29-08-f11-generator-eval": {
+   "marker": "CGQA_CANARY_683a5781283b95be92ef5cc013ec5e4c",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "CHANGED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-09-f11-generator-key-outside-generator": {
+   "marker": "CGQA_CANARY_793850beb0ed6643cbf423006f8ea2f5",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-10-f12-root-object": {
+   "marker": "CGQA_CANARY_171a4dac9e3befef6ad9333f5d2ff5f3",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "CHANGED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-11-f12-parenthesized-instance": {
+   "marker": "CGQA_CANARY_6ee54c2f944b461be89ee51f3f2abdd5",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "CHANGED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-12-f12-logical-instance": {
+   "marker": "CGQA_CANARY_240db09cbf3569bda925ca39a4cbbcb4",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "CHANGED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-13-f13-parameter": {
+   "marker": "CGQA_CANARY_92d8c70708e4d6bc736ba6f6faa48d0f",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-14-f13-arrow": {
+   "marker": "CGQA_CANARY_f96628d6fac154164234c0e615fe99e3",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-15-f13-block": {
+   "marker": "CGQA_CANARY_fffd8bbd892cb1c80d880115d3a918b3",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-16-alias-property-mutation": {
+   "marker": "CGQA_CANARY_4553e96d5749d55bf81f86accfb5ed77",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "CHANGED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-17-alias-rebind": {
+   "marker": "CGQA_CANARY_11c589adbfe260372fb16242a01ebe84",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-18-property-overwrite": {
+   "marker": "CGQA_CANARY_2bcfb566e38b509ab52acdc37b74cc2d",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-19-binding-overwrite": {
+   "marker": "CGQA_CANARY_e604ca09bab79a6570af0fdb0bac4ab8",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-20-post-export-write": {
+   "marker": "CGQA_CANARY_342ea164c9b9a8df09fd55a0c5327d09",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "CHANGED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-21-old-exports-alias": {
+   "marker": "CGQA_CANARY_2649fa08cf5dc7ac26650c5eeecc7039",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-22-ambiguous-branch": {
+   "marker": "CGQA_CANARY_9f264fa36376578c236ab737ecd25117",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-23-agreeing-branch": {
+   "marker": "CGQA_CANARY_2855c5947d9bdd97033cb543fd69dacd",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "CHANGED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-24-opaque-escape": {
+   "marker": "CGQA_CANARY_eb6263fbab3209997695c07c46328bc0",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-25-unknown-dynamic-key": {
+   "marker": "CGQA_CANARY_e3fbd733edb7bd599aabd9dd6907c9d6",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-26-local-eval": {
+   "marker": "CGQA_CANARY_a1d8dad97c26e8e22a36d185fff60c74",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-27-literal-eval": {
+   "marker": "CGQA_CANARY_024836eefd61a271e1a81792b7858de8",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "CHANGED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-28-eval-property-on-local-identity": {
+   "marker": "CGQA_CANARY_206007f86bcb155a7951adae1b994591",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "CHANGED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-29-uncertain-receiver-alias": {
+   "marker": "CGQA_CANARY_958d1bf1e783577323f3601eb25816d1",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-30-data-overwrite-after-literal-eval": {
+   "marker": "CGQA_CANARY_5eefb6a645f6a54b21700c1833102833",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-31-missing-read-exported-as-undefined-data": {
+   "marker": "CGQA_CANARY_f326a00770b73aa649696feb37785185",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-32-logical-member-initialization": {
+   "marker": "CGQA_CANARY_80543097ac47ed4bc940fe5dcbda55b3",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "CHANGED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "t1-ts-global-builtin": {
+   "marker": "CGQA_CANARY_fd66031a97226f4eab6ae1e1f57c0316",
+   "files": [
+    "lib/other.ts",
+    "use.ts"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  }
+ }
+}
\ No newline at end of file
diff --git a/docs/handoffs/pr29-2026-11-10/harness/replay-candidate.json b/docs/handoffs/pr29-2026-11-10/harness/replay-candidate.json
new file mode 100644
index 0000000000..772915e904
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/harness/replay-candidate.json
@@ -0,0 +1,2025 @@
+{
+ "subject": "codegraph",
+ "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae",
+ "build": "/tmp/codegraph-pr29-harness-6fevujfy/candidate/dist/bin/codegraph.js",
+ "results": [
+  {
+   "name": "a",
+   "issue": 3034,
+   "verdict": "BROKEN",
+   "detail": "Handler::run -calls-> lib.ts:find",
+   "canary": {
+    "marker": "CGQA_CANARY_c26ec930fad87fb7b78fefac6bce140a",
+    "files": [
+     "handler.ts",
+     "lib.ts"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "b",
+   "issue": 3035,
+   "verdict": "BROKEN",
+   "detail": "take -calls-> session.ts:Session::snapshot",
+   "canary": {
+    "marker": "CGQA_CANARY_b05d9580d877faed27c4474f2751d2d6",
+    "files": [
+     "queries.ts",
+     "session.ts"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "c",
+   "issue": 3036,
+   "verdict": "BROKEN",
+   "detail": "Orchestrator::check -calls-> cache.ts:Cache::has",
+   "canary": {
+    "marker": "CGQA_CANARY_093da072b5953f6336e67ddc685b1e1d",
+    "files": [
+     "cache.ts",
+     "orch.ts"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "g1-go-new-receiver",
+   "issue": 3237,
+   "verdict": "BROKEN",
+   "detail": "viaNew -calls-> a_router.go:Router::Host",
+   "canary": {
+    "marker": "CGQA_CANARY_1eb5f690f6bc39191248154b988e6321",
+    "files": [
+     "a_router.go",
+     "b_route.go",
+     "use.go"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2944",
+   "issue": 2944,
+   "verdict": "BROKEN",
+   "detail": "a.test.ts -calls-> a.test.ts:setup@26",
+   "canary": {
+    "marker": "CGQA_CANARY_f4894fd72f5854273eadb8040d20e263",
+    "files": [
+     "a.test.ts",
+     "decl.d.ts"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2946",
+   "issue": 2946,
+   "verdict": "BROKEN",
+   "detail": "run -calls-> writer.ts:StoreWriter::close",
+   "canary": {
+    "marker": "CGQA_CANARY_17b983e7242b62b74db5aec3a46c7a6a",
+    "files": [
+     "db.ts",
+     "use.ts",
+     "writer.ts"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2947",
+   "issue": 2947,
+   "verdict": "BROKEN",
+   "detail": "a -calls-> app.ts:App::render; b -calls-> app.ts:App::close; c -calls-> app.ts:App::close; d -calls-> app.ts:App::translate",
+   "canary": {
+    "marker": "CGQA_CANARY_ff5f48ccc8cfbf53ad1c0eff52c26b83",
+    "files": [
+     "app.ts",
+     "use.ts"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2948",
+   "issue": 2948,
+   "verdict": "BROKEN",
+   "detail": "Scene::a -calls-> heap.ts:BinaryHeap::push; Scene::b -calls-> heap.ts:Conf::includes",
+   "canary": {
+    "marker": "CGQA_CANARY_0acfbf0078f7f4cc87f8b1611412c4bd",
+    "files": [
+     "heap.ts",
+     "use.ts"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2949",
+   "issue": 2949,
+   "verdict": "BROKEN",
+   "detail": "scanD::skipValue -calls-> lib.ts:skipString; scanE::skipValue -calls-> lib.ts:skipString",
+   "canary": {
+    "marker": "CGQA_CANARY_1f044df2d4eec5e19940ee786b620564",
+    "files": [
+     "lib.ts",
+     "use.ts"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2951",
+   "issue": 2951,
+   "verdict": "BROKEN",
+   "detail": "useA -calls-> schemas.ts:ZodString::ipv4; useC -calls-> schemas.ts:ZodString::ipv4; useD -calls-> schemas.ts:ZodString::ipv4",
+   "canary": {
+    "marker": "CGQA_CANARY_321c338a94bf5ccde5f14caa86a63ae6",
+    "files": [
+     "a.ts",
+     "b.ts",
+     "c.ts",
+     "d.ts",
+     "external.ts",
+     "index.ts",
+     "index2.ts",
+     "index3.ts",
+     "schemas.ts"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2952",
+   "issue": 2952,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_955f74618d1a1ad1abae661368cdc808",
+    "files": [
+     "lib/utils.js",
+     "test/utils.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2953",
+   "issue": 2953,
+   "verdict": "BROKEN",
+   "detail": "handlerC -calls-> streaming.ts:stream; localConst -calls-> streaming.ts:stream",
+   "canary": {
+    "marker": "CGQA_CANARY_861988abef55f7795e66e8e87e702af7",
+    "files": [
+     "app.ts",
+     "cjsapp.js",
+     "lib/reply.js",
+     "streaming.ts"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2954",
+   "issue": 2954,
+   "verdict": "BROKEN",
+   "detail": "Tools::run -calls-> lib.ts:findAll; Tools::size -calls-> lib.ts:getFactor",
+   "canary": {
+    "marker": "CGQA_CANARY_8ba45a033fccf15b706d655d35dac436",
+    "files": [
+     "lib.ts",
+     "tools.ts"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2957",
+   "issue": 2957,
+   "verdict": "BROKEN",
+   "detail": "attr_named_client -calls-> pkg/_client.py:Client::fetch; with_named_client -calls-> pkg/_client.py:Client::fetch",
+   "canary": {
+    "marker": "CGQA_CANARY_519a5c5d6e9e417deb6145c4a0032e6e",
+    "files": [
+     "pkg/__init__.py",
+     "pkg/_client.py",
+     "use.py"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2958",
+   "issue": 2958,
+   "verdict": "BROKEN",
+   "detail": "ScriptInfo::load_app -calls-> examples/factory.py:create_app",
+   "canary": {
+    "marker": "CGQA_CANARY_38e45a64f4071f3b7f9b63030cc81451",
+    "files": [
+     "examples/factory.py",
+     "pkg/cli.py"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2962",
+   "issue": 2962,
+   "verdict": "BROKEN",
+   "detail": "objSpread -calls-> auth.ts:register; jsxSpread -calls-> auth.ts:register; jsxSpreadNested -calls-> auth.ts:register",
+   "canary": {
+    "marker": "CGQA_CANARY_ad5779c7c44d4cce2466f549f7723211",
+    "files": [
+     "auth.ts",
+     "use.tsx"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2963",
+   "issue": 2963,
+   "verdict": "BROKEN",
+   "detail": "run -calls-> pkg/deco.py:command@5; run -calls-> pkg/deco.py:Prompt::ask@23",
+   "canary": {
+    "marker": "CGQA_CANARY_1e6a7556512cd802dde8b41c94e4cf18",
+    "files": [
+     "pkg/__init__.py",
+     "pkg/deco.py",
+     "use.py"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2964",
+   "issue": 2964,
+   "verdict": "BROKEN",
+   "detail": "t -calls-> test/a.test.js:Srv; t -calls-> test/a.test.js:Srv2; u -calls-> b.js:inner",
+   "canary": {
+    "marker": "CGQA_CANARY_a2de13681ab807080008c49da3b74435",
+    "files": [
+     "b.js",
+     "lib/index.js",
+     "lib/inner/entry.js",
+     "srv.js",
+     "test/a.test.js"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2966",
+   "issue": 2966,
+   "verdict": "BROKEN",
+   "detail": "lib/hooks.js -calls-> lib/validation.js:validate; lib/reply.js -calls-> lib/types.d.ts:FastifyReply::getHeader; lib/context.js -calls-> lib/application.js:Application::toJSON; init -calls-> lib/other.js:Cast::insertMany",
+   "canary": {
+    "marker": "CGQA_CANARY_6064518b8ae602413a6f63043df1b04a",
+    "files": [
+     "lib/application.js",
+     "lib/context.js",
+     "lib/hooks.js",
+     "lib/model.js",
+     "lib/other.js",
+     "lib/reply.js",
+     "lib/types.d.ts",
+     "lib/validation.js",
+     "test/model.test.js"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2967",
+   "issue": 2967,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_92889075c44794c69b9ea810f4b68d53",
+    "files": [
+     "mod.js",
+     "mod.ts",
+     "page.tsx",
+     "use.js",
+     "use.ts",
+     "use.tsx"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2973",
+   "issue": 2973,
+   "verdict": "GUESSED",
+   "detail": "guessed saveProfile -calls-> src/a_cart.js:handleSave",
+   "canary": {
+    "marker": "CGQA_CANARY_9bb0e047812c4cfca921a4e4038304b5",
+    "files": [
+     "src/a_cart.js",
+     "src/b_profile.js"
+    ],
+    "verdict": "GUESSED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2974",
+   "issue": 2974,
+   "verdict": "GUESSED",
+   "detail": "guessed loadGithubProfile -calls-> src/server.js:src/server.js::GET:/users/:id",
+   "canary": {
+    "marker": "CGQA_CANARY_01b46cfb5bda6ddd320f16649cde6f9d",
+    "files": [
+     "src/client.js",
+     "src/server.js"
+    ],
+    "verdict": "GUESSED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2975",
+   "issue": 2975,
+   "verdict": "BROKEN",
+   "detail": "routes/api.php::route:/admin/users/{id} -references-> app/Http/Controllers/UserController.php:App\\Http\\Controllers::UserController::show",
+   "canary": {
+    "marker": "CGQA_CANARY_fd4e8981f5ce3cfa805271ab9f8d5864",
+    "files": [
+     "app/Http/Controllers/Admin/UserController.php",
+     "app/Http/Controllers/UserController.php",
+     "routes/api.php"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "issue-2976",
+   "issue": 2976,
+   "verdict": "BROKEN",
+   "detail": "com.x.m::Main::go -calls-> src/com/x/a/Util.java:com.x.a::Util::log",
+   "canary": {
+    "marker": "CGQA_CANARY_127f358ec1fdb1e5762bf967972aca50",
+    "files": [
+     "src/com/x/a/Util.java",
+     "src/com/x/b/Util.java",
+     "src/com/x/m/Main.java"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "j1-java-overload",
+   "issue": 3040,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_2629d576c9e45e63ecedb5e14fc6446a",
+    "files": [
+     "src/p/App.java",
+     "src/p/Parser.java",
+     "src/p/Util.java"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "kmp-22",
+   "issue": 3033,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_86cac7cd58f3fb1eb559d608ad551432",
+    "files": [
+     "app/src/main/java/b/App.java"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "m1-py-super",
+   "issue": 3218,
+   "verdict": "BROKEN",
+   "detail": "missing Child::__init__ -calls-> base.py:Base::__init__; Child::greet -calls-> base.py:Base::greet; LocalChild::run -calls-> child.py:Local::run",
+   "canary": {
+    "marker": "CGQA_CANARY_63b9be9f647c818bab833a4b15a5116a",
+    "files": [
+     "base.py",
+     "child.py"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "m2-py-method-return-local",
+   "issue": 3240,
+   "verdict": "BROKEN",
+   "detail": "missing via_method -calls-> t.py:Stager::add; via_param_method -calls-> t.py:Stager::add",
+   "canary": {
+    "marker": "CGQA_CANARY_8eea92c6a52bcdc75d803de056fcd622",
+    "files": [
+     "t.py"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "n1-py-local-import",
+   "issue": 3229,
+   "verdict": "BROKEN",
+   "detail": "test_one -calls-> pkg/core.py:reverts",
+   "canary": {
+    "marker": "CGQA_CANARY_84db314c3fa45b02bf5d3a549af92b13",
+    "files": [
+     "pkg/__init__.py",
+     "pkg/core.py",
+     "t_local_import.py"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "n2-py-comprehension",
+   "issue": 3230,
+   "verdict": "BROKEN",
+   "detail": "comp -calls-> other/far.py:p",
+   "canary": {
+    "marker": "CGQA_CANARY_f5a4806492ff64eed46a93cb58fc1173",
+    "files": [
+     "other/__init__.py",
+     "other/far.py",
+     "t.py"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "n3-py-enclosing-local",
+   "issue": 3231,
+   "verdict": "BROKEN",
+   "detail": "closure::inner -calls-> other/far.py:evaluate",
+   "canary": {
+    "marker": "CGQA_CANARY_82185e000122e2de556a26c20094c66e",
+    "files": [
+     "other/__init__.py",
+     "other/far.py",
+     "t.py"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "n4-py-builtin",
+   "issue": 3232,
+   "verdict": "BROKEN",
+   "detail": "run -instantiates-> other/far.py:TimeoutError",
+   "canary": {
+    "marker": "CGQA_CANARY_b02a47871319240b5c253d50f90a00f4",
+    "files": [
+     "other/__init__.py",
+     "other/far.py",
+     "t.py"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "n5-ts-barrel-member",
+   "issue": 3233,
+   "verdict": "BROKEN",
+   "detail": "useNamed -calls-> fx/deaf.ts:DEAF::mark; useNs -calls-> fx/deaf.ts:DEAF::mark",
+   "canary": {
+    "marker": "CGQA_CANARY_0a129395ea496d32e7e854edb2215212",
+    "files": [
+     "b.ts",
+     "c.ts",
+     "fx/deaf.ts",
+     "fx/index.ts",
+     "fx/mark.ts"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "p1",
+   "issue": 3037,
+   "verdict": "BROKEN",
+   "detail": "test_one -calls-> t.py:flat",
+   "canary": {
+    "marker": "CGQA_CANARY_688ace91dc839afbf31ba869832b51d9",
+    "files": [
+     "t.py"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "p3",
+   "issue": 3038,
+   "verdict": "BROKEN",
+   "detail": "size_of_made -calls-> arm.py:Arm::stat",
+   "canary": {
+    "marker": "CGQA_CANARY_259372835481b1f440bdc4ac6176be2d",
+    "files": [
+     "arm.py",
+     "use.py"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "p4",
+   "issue": 3039,
+   "verdict": "BROKEN",
+   "detail": "MLP::forward -calls-> other/features.py:out",
+   "canary": {
+    "marker": "CGQA_CANARY_2c8c58f6c1e61645af99d8855588814e",
+    "files": [
+     "lab/model.py",
+     "other/features.py"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "p5-py-stdlib-import",
+   "issue": 3239,
+   "verdict": "BROKEN",
+   "detail": "use.py -imports-> clock.py:time",
+   "canary": {
+    "marker": "CGQA_CANARY_02348c7c7944ed8b6f2009991253191c",
+    "files": [
+     "clock.py",
+     "use.py"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-01-f14-object",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_af180857e845ea52212d8374afadc4ae",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-02-f14-class",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_b34757d4342dd5b7f7ea6e323b27dd79",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-03-f14-function",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_7cdf6be14963100082cb87c1e4a0b9db",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-04-f15-number",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_dca5c84a4ac01dca47814c29415ad13c",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-05-f15-string",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_7d0ecbbad028ea8befc3e72ce11f771c",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-06-f15-assigned-callable",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_3cd46209c99cce19f7948112e41cd525",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-07-f10-optional-wrapper",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_eed25212d10bc8fdd84092841b770a83",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-08-f11-generator-eval",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_a83c50a273f1bfc3860839e2a24db8c7",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-09-f11-generator-key-outside-generator",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_73c911424f193555fed1ddcb731ee160",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-10-f12-root-object",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_0e104dee8d18fb595370c17cb0219454",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-11-f12-parenthesized-instance",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_76fb3c0653db8637042019b6b4c39cc7",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-12-f12-logical-instance",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_c534366b54f99ba727d20f60729b430e",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-13-f13-parameter",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_441b148bae5f11b51e85c4c205fd18da",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-14-f13-arrow",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_53fd06de374bef59b77a99e6ca3f84f9",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-15-f13-block",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_2ac750066b5adf58b7e6863c263feecf",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-16-alias-property-mutation",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_a7310137a0c11fbe683d6e5fe996f79e",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-17-alias-rebind",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_545c0fdba463577a026be6f7c61392c0",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-18-property-overwrite",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_1bef02ee4a46095a6b130578dc9b38a1",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-19-binding-overwrite",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_5e316dd9e99980df26cddce63952ca0c",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-20-post-export-write",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_02dba7e574bc3ead9576343404c718b9",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-21-old-exports-alias",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_fb49dfd06e514dfc9dcffa040e8d82ed",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-22-ambiguous-branch",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_c20f23bf134371cb84dc0db0c174976d",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-23-agreeing-branch",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_ae1202aca8593970eea22288d6f7cc2f",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-24-opaque-escape",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_bb8a056493560686efa4e986af40a904",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-25-unknown-dynamic-key",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_d7b9e655278e85735a1a2a721bdc5cde",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-26-local-eval",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_12af0466ee789c9bb0ed677beec4c843",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-27-literal-eval",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_61a74a661f4d49b86344b66053dc7e97",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-28-eval-property-on-local-identity",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_d2edaca542927f059b4a69fec223e055",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-29-uncertain-receiver-alias",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_b2c33c02e9119460426cded1390fd852",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-30-data-overwrite-after-literal-eval",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_ed202a0ca0df2e9c587ce692d8e96940",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-31-missing-read-exported-as-undefined-data",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_86073de42642b3f366e12a8220b8dee7",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "pr29-32-logical-member-initialization",
+   "issue": 29,
+   "verdict": "FIXED",
+   "detail": "",
+   "canary": {
+    "marker": "CGQA_CANARY_a5a805cda0e42798a581c81cf10edfa1",
+    "files": [
+     "decoy.js",
+     "index.js",
+     "m.js",
+     "use.js"
+    ],
+    "verdict": "FIXED",
+    "leaks": [],
+    "status": "PASS"
+   }
+  },
+  {
+   "name": "t1-ts-global-builtin",
+   "issue": 3238,
+   "verdict": "BROKEN",
+   "detail": "parse -calls-> lib/other.ts:parseInt; reply -instantiates-> lib/other.ts:Response",
+   "canary": {
+    "marker": "CGQA_CANARY_0ed96b48b36f3e1d5a7cba6e7fe980b3",
+    "files": [
+     "lib/other.ts",
+     "use.ts"
+    ],
+    "verdict": "BROKEN",
+    "leaks": [],
+    "status": "PASS"
+   }
+  }
+ ],
+ "canaries": {
+  "a": {
+   "marker": "CGQA_CANARY_c26ec930fad87fb7b78fefac6bce140a",
+   "files": [
+    "handler.ts",
+    "lib.ts"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "b": {
+   "marker": "CGQA_CANARY_b05d9580d877faed27c4474f2751d2d6",
+   "files": [
+    "queries.ts",
+    "session.ts"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "c": {
+   "marker": "CGQA_CANARY_093da072b5953f6336e67ddc685b1e1d",
+   "files": [
+    "cache.ts",
+    "orch.ts"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "g1-go-new-receiver": {
+   "marker": "CGQA_CANARY_1eb5f690f6bc39191248154b988e6321",
+   "files": [
+    "a_router.go",
+    "b_route.go",
+    "use.go"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2944": {
+   "marker": "CGQA_CANARY_f4894fd72f5854273eadb8040d20e263",
+   "files": [
+    "a.test.ts",
+    "decl.d.ts"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2946": {
+   "marker": "CGQA_CANARY_17b983e7242b62b74db5aec3a46c7a6a",
+   "files": [
+    "db.ts",
+    "use.ts",
+    "writer.ts"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2947": {
+   "marker": "CGQA_CANARY_ff5f48ccc8cfbf53ad1c0eff52c26b83",
+   "files": [
+    "app.ts",
+    "use.ts"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2948": {
+   "marker": "CGQA_CANARY_0acfbf0078f7f4cc87f8b1611412c4bd",
+   "files": [
+    "heap.ts",
+    "use.ts"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2949": {
+   "marker": "CGQA_CANARY_1f044df2d4eec5e19940ee786b620564",
+   "files": [
+    "lib.ts",
+    "use.ts"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2951": {
+   "marker": "CGQA_CANARY_321c338a94bf5ccde5f14caa86a63ae6",
+   "files": [
+    "a.ts",
+    "b.ts",
+    "c.ts",
+    "d.ts",
+    "external.ts",
+    "index.ts",
+    "index2.ts",
+    "index3.ts",
+    "schemas.ts"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2952": {
+   "marker": "CGQA_CANARY_955f74618d1a1ad1abae661368cdc808",
+   "files": [
+    "lib/utils.js",
+    "test/utils.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2953": {
+   "marker": "CGQA_CANARY_861988abef55f7795e66e8e87e702af7",
+   "files": [
+    "app.ts",
+    "cjsapp.js",
+    "lib/reply.js",
+    "streaming.ts"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2954": {
+   "marker": "CGQA_CANARY_8ba45a033fccf15b706d655d35dac436",
+   "files": [
+    "lib.ts",
+    "tools.ts"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2957": {
+   "marker": "CGQA_CANARY_519a5c5d6e9e417deb6145c4a0032e6e",
+   "files": [
+    "pkg/__init__.py",
+    "pkg/_client.py",
+    "use.py"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2958": {
+   "marker": "CGQA_CANARY_38e45a64f4071f3b7f9b63030cc81451",
+   "files": [
+    "examples/factory.py",
+    "pkg/cli.py"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2962": {
+   "marker": "CGQA_CANARY_ad5779c7c44d4cce2466f549f7723211",
+   "files": [
+    "auth.ts",
+    "use.tsx"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2963": {
+   "marker": "CGQA_CANARY_1e6a7556512cd802dde8b41c94e4cf18",
+   "files": [
+    "pkg/__init__.py",
+    "pkg/deco.py",
+    "use.py"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2964": {
+   "marker": "CGQA_CANARY_a2de13681ab807080008c49da3b74435",
+   "files": [
+    "b.js",
+    "lib/index.js",
+    "lib/inner/entry.js",
+    "srv.js",
+    "test/a.test.js"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2966": {
+   "marker": "CGQA_CANARY_6064518b8ae602413a6f63043df1b04a",
+   "files": [
+    "lib/application.js",
+    "lib/context.js",
+    "lib/hooks.js",
+    "lib/model.js",
+    "lib/other.js",
+    "lib/reply.js",
+    "lib/types.d.ts",
+    "lib/validation.js",
+    "test/model.test.js"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2967": {
+   "marker": "CGQA_CANARY_92889075c44794c69b9ea810f4b68d53",
+   "files": [
+    "mod.js",
+    "mod.ts",
+    "page.tsx",
+    "use.js",
+    "use.ts",
+    "use.tsx"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2973": {
+   "marker": "CGQA_CANARY_9bb0e047812c4cfca921a4e4038304b5",
+   "files": [
+    "src/a_cart.js",
+    "src/b_profile.js"
+   ],
+   "verdict": "GUESSED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2974": {
+   "marker": "CGQA_CANARY_01b46cfb5bda6ddd320f16649cde6f9d",
+   "files": [
+    "src/client.js",
+    "src/server.js"
+   ],
+   "verdict": "GUESSED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2975": {
+   "marker": "CGQA_CANARY_fd4e8981f5ce3cfa805271ab9f8d5864",
+   "files": [
+    "app/Http/Controllers/Admin/UserController.php",
+    "app/Http/Controllers/UserController.php",
+    "routes/api.php"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "issue-2976": {
+   "marker": "CGQA_CANARY_127f358ec1fdb1e5762bf967972aca50",
+   "files": [
+    "src/com/x/a/Util.java",
+    "src/com/x/b/Util.java",
+    "src/com/x/m/Main.java"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "j1-java-overload": {
+   "marker": "CGQA_CANARY_2629d576c9e45e63ecedb5e14fc6446a",
+   "files": [
+    "src/p/App.java",
+    "src/p/Parser.java",
+    "src/p/Util.java"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "kmp-22": {
+   "marker": "CGQA_CANARY_86cac7cd58f3fb1eb559d608ad551432",
+   "files": [
+    "app/src/main/java/b/App.java"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "m1-py-super": {
+   "marker": "CGQA_CANARY_63b9be9f647c818bab833a4b15a5116a",
+   "files": [
+    "base.py",
+    "child.py"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "m2-py-method-return-local": {
+   "marker": "CGQA_CANARY_8eea92c6a52bcdc75d803de056fcd622",
+   "files": [
+    "t.py"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "n1-py-local-import": {
+   "marker": "CGQA_CANARY_84db314c3fa45b02bf5d3a549af92b13",
+   "files": [
+    "pkg/__init__.py",
+    "pkg/core.py",
+    "t_local_import.py"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "n2-py-comprehension": {
+   "marker": "CGQA_CANARY_f5a4806492ff64eed46a93cb58fc1173",
+   "files": [
+    "other/__init__.py",
+    "other/far.py",
+    "t.py"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "n3-py-enclosing-local": {
+   "marker": "CGQA_CANARY_82185e000122e2de556a26c20094c66e",
+   "files": [
+    "other/__init__.py",
+    "other/far.py",
+    "t.py"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "n4-py-builtin": {
+   "marker": "CGQA_CANARY_b02a47871319240b5c253d50f90a00f4",
+   "files": [
+    "other/__init__.py",
+    "other/far.py",
+    "t.py"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "n5-ts-barrel-member": {
+   "marker": "CGQA_CANARY_0a129395ea496d32e7e854edb2215212",
+   "files": [
+    "b.ts",
+    "c.ts",
+    "fx/deaf.ts",
+    "fx/index.ts",
+    "fx/mark.ts"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "p1": {
+   "marker": "CGQA_CANARY_688ace91dc839afbf31ba869832b51d9",
+   "files": [
+    "t.py"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "p3": {
+   "marker": "CGQA_CANARY_259372835481b1f440bdc4ac6176be2d",
+   "files": [
+    "arm.py",
+    "use.py"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "p4": {
+   "marker": "CGQA_CANARY_2c8c58f6c1e61645af99d8855588814e",
+   "files": [
+    "lab/model.py",
+    "other/features.py"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "p5-py-stdlib-import": {
+   "marker": "CGQA_CANARY_02348c7c7944ed8b6f2009991253191c",
+   "files": [
+    "clock.py",
+    "use.py"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-01-f14-object": {
+   "marker": "CGQA_CANARY_af180857e845ea52212d8374afadc4ae",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-02-f14-class": {
+   "marker": "CGQA_CANARY_b34757d4342dd5b7f7ea6e323b27dd79",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-03-f14-function": {
+   "marker": "CGQA_CANARY_7cdf6be14963100082cb87c1e4a0b9db",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-04-f15-number": {
+   "marker": "CGQA_CANARY_dca5c84a4ac01dca47814c29415ad13c",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-05-f15-string": {
+   "marker": "CGQA_CANARY_7d0ecbbad028ea8befc3e72ce11f771c",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-06-f15-assigned-callable": {
+   "marker": "CGQA_CANARY_3cd46209c99cce19f7948112e41cd525",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-07-f10-optional-wrapper": {
+   "marker": "CGQA_CANARY_eed25212d10bc8fdd84092841b770a83",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-08-f11-generator-eval": {
+   "marker": "CGQA_CANARY_a83c50a273f1bfc3860839e2a24db8c7",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-09-f11-generator-key-outside-generator": {
+   "marker": "CGQA_CANARY_73c911424f193555fed1ddcb731ee160",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-10-f12-root-object": {
+   "marker": "CGQA_CANARY_0e104dee8d18fb595370c17cb0219454",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-11-f12-parenthesized-instance": {
+   "marker": "CGQA_CANARY_76fb3c0653db8637042019b6b4c39cc7",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-12-f12-logical-instance": {
+   "marker": "CGQA_CANARY_c534366b54f99ba727d20f60729b430e",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-13-f13-parameter": {
+   "marker": "CGQA_CANARY_441b148bae5f11b51e85c4c205fd18da",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-14-f13-arrow": {
+   "marker": "CGQA_CANARY_53fd06de374bef59b77a99e6ca3f84f9",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-15-f13-block": {
+   "marker": "CGQA_CANARY_2ac750066b5adf58b7e6863c263feecf",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-16-alias-property-mutation": {
+   "marker": "CGQA_CANARY_a7310137a0c11fbe683d6e5fe996f79e",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-17-alias-rebind": {
+   "marker": "CGQA_CANARY_545c0fdba463577a026be6f7c61392c0",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-18-property-overwrite": {
+   "marker": "CGQA_CANARY_1bef02ee4a46095a6b130578dc9b38a1",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-19-binding-overwrite": {
+   "marker": "CGQA_CANARY_5e316dd9e99980df26cddce63952ca0c",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-20-post-export-write": {
+   "marker": "CGQA_CANARY_02dba7e574bc3ead9576343404c718b9",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-21-old-exports-alias": {
+   "marker": "CGQA_CANARY_fb49dfd06e514dfc9dcffa040e8d82ed",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-22-ambiguous-branch": {
+   "marker": "CGQA_CANARY_c20f23bf134371cb84dc0db0c174976d",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-23-agreeing-branch": {
+   "marker": "CGQA_CANARY_ae1202aca8593970eea22288d6f7cc2f",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-24-opaque-escape": {
+   "marker": "CGQA_CANARY_bb8a056493560686efa4e986af40a904",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-25-unknown-dynamic-key": {
+   "marker": "CGQA_CANARY_d7b9e655278e85735a1a2a721bdc5cde",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-26-local-eval": {
+   "marker": "CGQA_CANARY_12af0466ee789c9bb0ed677beec4c843",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-27-literal-eval": {
+   "marker": "CGQA_CANARY_61a74a661f4d49b86344b66053dc7e97",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-28-eval-property-on-local-identity": {
+   "marker": "CGQA_CANARY_d2edaca542927f059b4a69fec223e055",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-29-uncertain-receiver-alias": {
+   "marker": "CGQA_CANARY_b2c33c02e9119460426cded1390fd852",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-30-data-overwrite-after-literal-eval": {
+   "marker": "CGQA_CANARY_ed202a0ca0df2e9c587ce692d8e96940",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-31-missing-read-exported-as-undefined-data": {
+   "marker": "CGQA_CANARY_86073de42642b3f366e12a8220b8dee7",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "pr29-32-logical-member-initialization": {
+   "marker": "CGQA_CANARY_a5a805cda0e42798a581c81cf10edfa1",
+   "files": [
+    "decoy.js",
+    "index.js",
+    "m.js",
+    "use.js"
+   ],
+   "verdict": "FIXED",
+   "leaks": [],
+   "status": "PASS"
+  },
+  "t1-ts-global-builtin": {
+   "marker": "CGQA_CANARY_0ed96b48b36f3e1d5a7cba6e7fe980b3",
+   "files": [
+    "lib/other.ts",
+    "use.ts"
+   ],
+   "verdict": "BROKEN",
+   "leaks": [],
+   "status": "PASS"
+  }
+ }
+}
\ No newline at end of file
diff --git a/docs/handoffs/pr29-2026-11-10/harness/results.json b/docs/handoffs/pr29-2026-11-10/harness/results.json
new file mode 100644
index 0000000000..dd76578e29
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/harness/results.json
@@ -0,0 +1,141 @@
+{
+  "status": "harness complete; no new tested correctness regressions, measured indexing regression",
+  "baselineHead": "87576a8d9ff0d8aba235db5535f5f4429f14b037",
+  "candidate": "same30path saved working diff; no source edits during harness",
+  "isolatedNormalBuilds": "bothPASS",
+  "fixtures": {
+    "total": 70,
+    "pr29Fixed": 32,
+    "existingUnchanged": 38,
+    "existingVerdicts": {
+      "BROKEN": 32,
+      "FIXED": 4,
+      "GUESSED": 2
+    }
+  },
+  "canaries": {
+    "baseline": {
+      "PASS": 69,
+      "FAIL": 1
+    },
+    "candidate": {
+      "PASS": 70
+    }
+  },
+  "corpus": {
+    "identical": [
+      "requests",
+      "click",
+      "mux",
+      "ky"
+    ],
+    "express": {
+      "removedIncorrectCalls": 52,
+      "removedUnprovenCallsToExternalVariable": 12,
+      "addedUnresolved": 64,
+      "filesNodesChanged": false,
+      "confirmedCorrectCallsLostInThisSet": 0
+    }
+  },
+  "shadow": {
+    "same": 17,
+    "changed": 6,
+    "failed": 0,
+    "unstable": 0
+  },
+  "modes": {
+    "inputsPerBuild": 11,
+    "comparisonsPerBuild": 99,
+    "identicalPerBuild": 98,
+    "sameGraphDifferentRowOrderPerBuild": 1,
+    "differentOrFailed": 0
+  },
+  "metamorphic": {
+    "seedsPerBuild": 73,
+    "rowsPerBuild": 219,
+    "candidateClean": 192,
+    "candidateKnownDifferences": 17,
+    "candidateNotApplicable": 10,
+    "baselineDifferences": 26,
+    "removedBaselineDifferences": 9,
+    "newInvariantDifferences": 0,
+    "errors": 0
+  },
+  "timings": [
+    {
+      "repo": "requests",
+      "samplesPerBuild": 4,
+      "baseline": {
+        "medianMs": 2069.0,
+        "rangeMs": [
+          2062,
+          2292
+        ]
+      },
+      "candidate": {
+        "medianMs": 2065.5,
+        "rangeMs": [
+          2007,
+          2193
+        ]
+      },
+      "medianChangePercent": -0.16916384726921585
+    },
+    {
+      "repo": "ky",
+      "samplesPerBuild": 4,
+      "baseline": {
+        "medianMs": 5044.5,
+        "rangeMs": [
+          5000,
+          5140
+        ]
+      },
+      "candidate": {
+        "medianMs": 5675.5,
+        "rangeMs": [
+          5474,
+          5783
+        ]
+      },
+      "medianChangePercent": 12.508672811973431
+    },
+    {
+      "repo": "express",
+      "samplesPerBuild": 4,
+      "baseline": {
+        "medianMs": 2378.5,
+        "rangeMs": [
+          2360,
+          2444
+        ]
+      },
+      "candidate": {
+        "medianMs": 3281.5,
+        "rangeMs": [
+          3241,
+          3825
+        ]
+      },
+      "medianChangePercent": 37.9651040571789
+    }
+  ],
+  "preservation": {
+    "checkedAt": "2026-11-10T11:18:35.214793+00:00",
+    "originalTrackedPathsChecked": 2019,
+    "originalChangedPaths": [],
+    "gitStatusUnchanged": true,
+    "workingDiffUnchanged": true,
+    "candidateSnapshotChangedPaths": [],
+    "stagedDiff": ""
+  },
+  "limitations": [
+    "WASM only; native binary absent",
+    "Existing38fixture cases retain32BROKEN2GUESSED4FIXED; remaining17metamorphic differences are unchanged baseline behavior",
+    "Four timing samples per arm per repo on one shared local host; not a general performance bound",
+    "32targeted fixtures derive from existing contract cases; unchanged QA fixtures and metamorphic transformations provide separate controls",
+    "No compiler-oracle refresh, agent-model A/B, experimental T0, overnight history harness or full repository test suite in this run",
+    "Independent code review remains pending; no commits/push/merge/deploy or production fixes"
+  ],
+  "recommendation": "Profile the JavaScript/TypeScript indexing overhead before further implementation or release readiness claims."
+}
diff --git a/docs/handoffs/pr29-2026-11-10/harness/shadow.json b/docs/handoffs/pr29-2026-11-10/harness/shadow.json
new file mode 100644
index 0000000000..1d6a912908
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/harness/shadow.json
@@ -0,0 +1,396 @@
+{
+ "old": "/tmp/codegraph-pr29-harness-6fevujfy/baseline/dist/bin/codegraph.js",
+ "new": "/tmp/codegraph-pr29-harness-6fevujfy/candidate/dist/bin/codegraph.js",
+ "adapterSha256": "7d489e2cc4df242ff9c036806cc367fd606f37fa3bf7e0062a9b70ee41317dae",
+ "results": [
+  {
+   "repo": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/mux",
+   "q": [
+    "explore",
+    "Router ServeHTTP",
+    "--max-files",
+    "2"
+   ],
+   "verdict": "SAME",
+   "lines": [
+    428,
+    428
+   ]
+  },
+  {
+   "repo": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/mux",
+   "q": [
+    "explore",
+    "Route Match regexp",
+    "--max-files",
+    "2"
+   ],
+   "verdict": "SAME",
+   "lines": [
+    440,
+    440
+   ]
+  },
+  {
+   "repo": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/mux",
+   "q": [
+    "callers",
+    "HandleFunc"
+   ],
+   "verdict": "SAME",
+   "lines": [
+    65,
+    65
+   ]
+  },
+  {
+   "repo": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/mux",
+   "q": [
+    "callees",
+    "ServeHTTP"
+   ],
+   "verdict": "SAME",
+   "lines": [
+    33,
+    33
+   ]
+  },
+  {
+   "repo": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/mux",
+   "q": [
+    "node",
+    "ServeHTTP"
+   ],
+   "verdict": "SAME",
+   "lines": [
+    74,
+    74
+   ]
+  },
+  {
+   "repo": "fixtures/oracle-candidates/issue-2952",
+   "q": [
+    "callers",
+    "normalizeType"
+   ],
+   "verdict": "SAME",
+   "lines": [
+    5,
+    5
+   ]
+  },
+  {
+   "repo": "fixtures/oracle-candidates/issue-2952",
+   "q": [
+    "callees",
+    "t"
+   ],
+   "verdict": "CHANGED",
+   "diff": [
+    " ",
+    "-Callees of \"t\" (1):",
+    "+Callees of \"t\" (2):",
+    " ",
+    " function t (javascript) — test/utils.js:2",
+    " function    compileTrust",
+    "   lib/utils.js:4",
+    "+",
+    "+function    generateETag",
+    "+  lib/utils.js:1"
+   ],
+   "lines": [
+    6,
+    9
+   ]
+  },
+  {
+   "repo": "fixtures/oracle-candidates/j1-java-overload",
+   "q": [
+    "callers",
+    "load"
+   ],
+   "verdict": "SAME",
+   "lines": [
+    6,
+    6
+   ]
+  },
+  {
+   "repo": "fixtures/oracle-candidates/g1-go-new-receiver",
+   "q": [
+    "callers",
+    "Host"
+   ],
+   "verdict": "SAME",
+   "lines": [
+    16,
+    16
+   ]
+  },
+  {
+   "repo": "fixtures/oracle-candidates/m2-py-method-return-local",
+   "q": [
+    "callers",
+    "add"
+   ],
+   "verdict": "SAME",
+   "lines": [
+    6,
+    6
+   ]
+  },
+  {
+   "repo": "fixtures/oracle-candidates/t1-ts-global-builtin",
+   "q": [
+    "callers",
+    "parseInt"
+   ],
+   "verdict": "SAME",
+   "lines": [
+    6,
+    6
+   ]
+  },
+  {
+   "repo": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/express",
+   "q": [
+    "explore",
+    "createApplication handle use"
+   ],
+   "verdict": "CHANGED",
+   "diff": [
+    "  ...",
+    " **Blast radius — what depends on these (update/verify before editing)**",
+    " ",
+    "-- `createApplication` (lib/express.js:36) — 118 callers in `lib/express.js`; tests: `examples/auth/index.js`, `examples/cookies/index.js`, `examples/ejs/index.js`, `examples/mvc/index.js` +90",
+    "+- `createApplication` (lib/express.js:36) — 111 callers in `lib/express.js`; tests: `examples/mvc/lib/boot.js`, `test/app.all.js`, `test/app.engine.js`, `test/app.head.js` +90",
+    " - `createETagGenerator` (lib/utils.js:249) — 1 caller in `lib/utils.js`; tested via callers: `test/Route.js`, `test/Router.js` +3",
+    " "
+   ],
+   "lines": [
+    525,
+    525
+   ]
+  },
+  {
+   "repo": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/express",
+   "q": [
+    "callers",
+    "createApplication"
+   ],
+   "verdict": "CHANGED",
+   "diff": [
+    " ",
+    "-Callers of \"createApplication\" (20 of 118):",
+    "+Callers of \"createApplication\" (20 of 111):",
+    " ",
+    " function createApplication (javascript) — lib/express.js:36",
+    "-file        index.js",
+    "-  examples/auth/index.js:21",
+    "-",
+    "-file        index.js",
+    "-  examples/cookies/index.js:22",
+    "-",
+    "-file        index.js",
+    "-  examples/ejs/index.js:31",
+    "-",
+    "-file        index.js",
+    "-  examples/mvc/index.js:37, 47",
+    "-",
+    " file        boot.js",
+    "   examples/mvc/lib/boot.js:21",
+    " ",
+    "-file        index.js",
+    "-  examples/route-separation/index.js:31, 32",
+    "-",
+    "-file        index.js",
+    "-  examples/search/index.js:21",
+    "-",
+    "-file        index.js",
+    "-  examples/static-files/index.js:22, 30, 36",
+    "-",
+    " file        app.all.js",
+    "   test/app.all.js:9, 26",
+    "  ...",
+    "   test/app.route.js:8, 24, 43, 56, 67, 89, 111, 130, 152, 174",
+    " ",
+    "-Showing 20 of 118; pass --limit to widen.",
+    "+file        app.router.js",
+    "+  test/app.router.js:13, 47, 59, 65, 96, 108, 120, 132, 145, 171, +56 more",
+    "+",
+    "+file        app.routes.error.js",
+    "+  test/app.routes.error.js:10, 26",
+    "+",
+    "+file        app.use.js",
+    "+  test/app.use.js:10, 11, 23, 24, 38, 39, 40, 64, 65, 72, +25 more",
+    "+",
+    "+file        config.js",
+    "+  test/config.js:9, 15, 21, 26, 31, 37, 43, 48, 57, 67, +20 more",
+    "+",
+    "+file        exports.js",
+    "+  test/exports.js:54, 59, 72",
+    "+",
+    "+file        express.json.js",
+    "+  test/express.json.js:53, 74, 505",
+    "+",
+    "+file        express.raw.js",
+    "+  test/express.raw.js:24, 66, 330",
+    "+",
+    "+Showing 20 of 111; pass --limit to widen."
+   ],
+   "lines": [
+    65,
+    65
+   ]
+  },
+  {
+   "repo": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/express",
+   "q": [
+    "callees",
+    "createApplication"
+   ],
+   "verdict": "SAME",
+   "lines": [
+    9,
+    9
+   ]
+  },
+  {
+   "repo": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/ky",
+   "q": [
+    "explore",
+    "Ky create request"
+   ],
+   "verdict": "SAME",
+   "lines": [
+    333,
+    333
+   ]
+  },
+  {
+   "repo": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/ky",
+   "q": [
+    "callers",
+    "create"
+   ],
+   "verdict": "SAME",
+   "lines": [
+    21,
+    21
+   ]
+  },
+  {
+   "repo": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/ky",
+   "q": [
+    "callees",
+    "create"
+   ],
+   "verdict": "SAME",
+   "lines": [
+    42,
+    42
+   ]
+  },
+  {
+   "repo": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/requests",
+   "q": [
+    "explore",
+    "Session request send"
+   ],
+   "verdict": "SAME",
+   "lines": [
+    352,
+    352
+   ]
+  },
+  {
+   "repo": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/requests",
+   "q": [
+    "callers",
+    "request"
+   ],
+   "verdict": "SAME",
+   "lines": [
+    70,
+    70
+   ]
+  },
+  {
+   "repo": "/tmp/codegraph-pr29-harness-6fevujfy/corpus/requests",
+   "q": [
+    "callees",
+    "send"
+   ],
+   "verdict": "SAME",
+   "lines": [
+    96,
+    96
+   ]
+  },
+  {
+   "repo": "fixtures/oracle-candidates/pr29-01-f14-object",
+   "q": [
+    "callees",
+    "run"
+   ],
+   "verdict": "CHANGED",
+   "diff": [
+    " ",
+    "-Callees of \"run\" (0):",
+    "+Callees of \"run\" (1):",
+    " ",
+    " function run (javascript) — use.js:1",
+    "-ℹ No callees found for \"run\"",
+    "+method      load",
+    "+  m.js:1"
+   ],
+   "lines": [
+    5,
+    6
+   ]
+  },
+  {
+   "repo": "fixtures/oracle-candidates/pr29-04-f15-number",
+   "q": [
+    "callees",
+    "run"
+   ],
+   "verdict": "CHANGED",
+   "diff": [
+    " ",
+    "-Callees of \"run\" (1):",
+    "+Callees of \"run\" (0):",
+    " ",
+    " function run (javascript) — use.js:1",
+    "-method      load",
+    "-  decoy.js:1",
+    "+ℹ No callees found for \"run\""
+   ],
+   "lines": [
+    6,
+    5
+   ]
+  },
+  {
+   "repo": "fixtures/oracle-candidates/pr29-06-f15-assigned-callable",
+   "q": [
+    "callees",
+    "run"
+   ],
+   "verdict": "CHANGED",
+   "diff": [
+    "  ...",
+    " ",
+    " function run (javascript) — use.js:1",
+    "-method      load",
+    "-  decoy.js:1",
+    "+function    real",
+    "+  m.js:1"
+   ],
+   "lines": [
+    6,
+    6
+   ]
+  }
+ ]
+}
\ No newline at end of file
diff --git a/docs/handoffs/pr29-2026-11-10/harness/timing-summary.json b/docs/handoffs/pr29-2026-11-10/harness/timing-summary.json
new file mode 100644
index 0000000000..026525a0b9
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/harness/timing-summary.json
@@ -0,0 +1,59 @@
+[
+  {
+    "repo": "requests",
+    "samplesPerBuild": 4,
+    "baseline": {
+      "medianMs": 2069.0,
+      "rangeMs": [
+        2062,
+        2292
+      ]
+    },
+    "candidate": {
+      "medianMs": 2065.5,
+      "rangeMs": [
+        2007,
+        2193
+      ]
+    },
+    "medianChangePercent": -0.16916384726921585
+  },
+  {
+    "repo": "ky",
+    "samplesPerBuild": 4,
+    "baseline": {
+      "medianMs": 5044.5,
+      "rangeMs": [
+        5000,
+        5140
+      ]
+    },
+    "candidate": {
+      "medianMs": 5675.5,
+      "rangeMs": [
+        5474,
+        5783
+      ]
+    },
+    "medianChangePercent": 12.508672811973431
+  },
+  {
+    "repo": "express",
+    "samplesPerBuild": 4,
+    "baseline": {
+      "medianMs": 2378.5,
+      "rangeMs": [
+        2360,
+        2444
+      ]
+    },
+    "candidate": {
+      "medianMs": 3281.5,
+      "rangeMs": [
+        3241,
+        3825
+      ]
+    },
+    "medianChangePercent": 37.9651040571789
+  }
+]
diff --git a/docs/handoffs/pr29-2026-11-10/harness/timings.json b/docs/handoffs/pr29-2026-11-10/harness/timings.json
new file mode 100644
index 0000000000..7fa45cb567
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/harness/timings.json
@@ -0,0 +1,197 @@
+{
+  "notes": "Four fresh CLI indexes per arm per repo, alternating build order. Run after other harness processes finish. Same local host and copied source, no native kernel.",
+  "results": [
+    {
+      "name": "requests",
+      "run": 1,
+      "side": "baseline",
+      "ok": true,
+      "status": 0,
+      "ms": 2292
+    },
+    {
+      "name": "requests",
+      "run": 1,
+      "side": "candidate",
+      "ok": true,
+      "status": 0,
+      "ms": 2193
+    },
+    {
+      "name": "requests",
+      "run": 2,
+      "side": "candidate",
+      "ok": true,
+      "status": 0,
+      "ms": 2007
+    },
+    {
+      "name": "requests",
+      "run": 2,
+      "side": "baseline",
+      "ok": true,
+      "status": 0,
+      "ms": 2062
+    },
+    {
+      "name": "requests",
+      "run": 3,
+      "side": "baseline",
+      "ok": true,
+      "status": 0,
+      "ms": 2065
+    },
+    {
+      "name": "requests",
+      "run": 3,
+      "side": "candidate",
+      "ok": true,
+      "status": 0,
+      "ms": 2077
+    },
+    {
+      "name": "requests",
+      "run": 4,
+      "side": "candidate",
+      "ok": true,
+      "status": 0,
+      "ms": 2054
+    },
+    {
+      "name": "requests",
+      "run": 4,
+      "side": "baseline",
+      "ok": true,
+      "status": 0,
+      "ms": 2073
+    },
+    {
+      "name": "ky",
+      "run": 1,
+      "side": "baseline",
+      "ok": true,
+      "status": 0,
+      "ms": 5035
+    },
+    {
+      "name": "ky",
+      "run": 1,
+      "side": "candidate",
+      "ok": true,
+      "status": 0,
+      "ms": 5606
+    },
+    {
+      "name": "ky",
+      "run": 2,
+      "side": "candidate",
+      "ok": true,
+      "status": 0,
+      "ms": 5474
+    },
+    {
+      "name": "ky",
+      "run": 2,
+      "side": "baseline",
+      "ok": true,
+      "status": 0,
+      "ms": 5054
+    },
+    {
+      "name": "ky",
+      "run": 3,
+      "side": "baseline",
+      "ok": true,
+      "status": 0,
+      "ms": 5000
+    },
+    {
+      "name": "ky",
+      "run": 3,
+      "side": "candidate",
+      "ok": true,
+      "status": 0,
+      "ms": 5783
+    },
+    {
+      "name": "ky",
+      "run": 4,
+      "side": "candidate",
+      "ok": true,
+      "status": 0,
+      "ms": 5745
+    },
+    {
+      "name": "ky",
+      "run": 4,
+      "side": "baseline",
+      "ok": true,
+      "status": 0,
+      "ms": 5140
+    },
+    {
+      "name": "express",
+      "run": 1,
+      "side": "baseline",
+      "ok": true,
+      "status": 0,
+      "ms": 2396
+    },
+    {
+      "name": "express",
+      "run": 1,
+      "side": "candidate",
+      "ok": true,
+      "status": 0,
+      "ms": 3284
+    },
+    {
+      "name": "express",
+      "run": 2,
+      "side": "candidate",
+      "ok": true,
+      "status": 0,
+      "ms": 3241
+    },
+    {
+      "name": "express",
+      "run": 2,
+      "side": "baseline",
+      "ok": true,
+      "status": 0,
+      "ms": 2360
+    },
+    {
+      "name": "express",
+      "run": 3,
+      "side": "baseline",
+      "ok": true,
+      "status": 0,
+      "ms": 2361
+    },
+    {
+      "name": "express",
+      "run": 3,
+      "side": "candidate",
+      "ok": true,
+      "status": 0,
+      "ms": 3279
+    },
+    {
+      "name": "express",
+      "run": 4,
+      "side": "candidate",
+      "ok": true,
+      "status": 0,
+      "ms": 3825
+    },
+    {
+      "name": "express",
+      "run": 4,
+      "side": "baseline",
+      "ok": true,
+      "status": 0,
+      "ms": 2444
+    }
+  ]
+}
\ No newline at end of file
diff --git a/docs/handoffs/pr29-2026-11-10/history/ast-f10-f11-corrected-2026-11-09/commonjs-eval-callee-context.md b/docs/handoffs/pr29-2026-11-10/history/ast-f10-f11-corrected-2026-11-09/commonjs-eval-callee-context.md
new file mode 100644
index 0000000000..6d43fcdaa9
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/ast-f10-f11-corrected-2026-11-09/commonjs-eval-callee-context.md
@@ -0,0 +1,118 @@
+# Separate F8 follow-up (review round count remains six)
+
+User explicitly authorized committing/pushing current work to a PR and separating remaining correction. Current snapshot committed5d384989957c91b482068b306535437915a0595b, pushed fix/commonjs-missing-member, DRAFT https://github.com/inth3shadows/codegraph/pull/28 against main. KnownF8 documented, not ready to merge alone. No deploy/merge/upstream report.
+
+New branch fix/commonjs-eval-callee-context based on5d384989. Exact prospective Git target: git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5d384989957c91b482068b306535437915a0595b -- src/resolution/commonjs-export-members.ts __tests__/commonjs-export-members.test.ts __tests__/js-default-binding-members.test.ts
+
+F8 reviewer finding and prior invariants remain in .review/commonjs-missing-member.md; do not reset shared gate/round count. Two sixth reviewers completed; broad demonstrated F8 despite adversarial clearing intended F7 cases. This follow-up has NOT had independent dual review yet.
+
+Correction: distinguish grouping around bare eval from another function's argument list using token before parentheses. Wrapper identifier/call/member/optional-call/tag/control-condition prefixes must not mark exports uncertain. Grouped direct eval, literal/template arguments and expression prefixes such as return must keep prior behavior. Change limited to9helper lines plus independent unit and real-index graph regressions; no matcher/sync/scope changes.
+
+Before fix8FAIL92PASS; tag-result additional case1FAIL49PASS. Final focused2files101PASS, /tmp/codegraph-cjs-eval-followup-focused.log. Build/full pending. Hashes /tmp/codegraph-cjs-followup-frozen.json. Logs /tmp/codegraph-cjs-eval-followup-{before,tag-before,focused,build}.log. Need staged exact3-file diff, personal repo/identity and actual build result before commit/push. Full normal suite required before readiness claim. Keep follow-up draft and explicitly state review pending. No additional reviewer agents launched in this follow-up; user plans to point agents at PRs.
+
+Keep both PRs draft. Follow-up base should be fix/commonjs-missing-member, producing only the small correction diff. Review/merge follow-up into parent branch before considering parent PR for main; no merge authorized by current request. Preserve original T0 pilot and all deploy/control worktrees.
+
+Published DRAFT https://github.com/inth3shadows/codegraph/pull/29, commit87576a8d9ff0d8aba235db5535f5f4429f14b037, base fix/commonjs-missing-member/PR28 at5d384989. Explicit buildPASS; normal full suite RUNNING session62594, /tmp/codegraph-cjs-eval-followup-full.log. Both pushed/draft, neither merged/deployed; follow-up independent review stillpending. Original T0 untouched.
+
+
+FINAL execution verification2026-11-09: normal full suite session62594 EXIT0,873filesPASS19SKIP,10666testsPASS2expectedFAIL448SKIP0unexpectedFAIL,800.20sec. /tmp/codegraph-cjs-eval-followup-full.log. 101focusedPASS and explicit buildPASS on same87576a8dsource. Final3changed-file SHA256 checks PASS, trackedtreeclean; actual remoteheads rechecked5d384989(PR28) and87576a8d(PR29). PR29 body updated with exact final validation. Both PRs still DRAFT/unmerged; no deployment/upstream write. FOLLOW-UP INDEPENDENT REVIEW STILL PENDING: do not conflate fullsuite with review clearance. No further tests/build/review processes running. Saved final checkpoint and full log under original QA two-draft-prs backup.
+
+
+## Seventh native review explicitly requested — PR29 — 2026-11-09
+
+User invoked /dual review29. Exact GitHub base5d384989957c91b482068b306535437915a0595b and head87576a8d9ff0d8aba235db5535f5f4429f14b037 verified. Fresh read-only native lanes review_broad_pr29_round7 and review_adversarial_pr29_round7 launched together with same exact Git target and this ledger. Both focus full3-file29-line correction, F8 closure and nearby invariants; bounded execution probes only, no repeat full/build or source edits. Parent does not reread reviewed diff or duplicate reviewer probes. No review results yet; no independent clearance claim. Do not reset round count/gate, change source, push, merge or deploy in this review-only turn. Stop and report merged findings when both complete.
+
+
+## Seventh native dual review result — PR29 — 2026-11-09
+
+Both fresh read-only lanes completed normally: review_broad_pr29_round7 and review_adversarial_pr29_round7. Exact target remains5d384989957c91b482068b306535437915a0595b..87576a8d9ff0d8aba235db5535f5f4429f14b037. Source hashes verified unchanged, trackedtreeclean except private untracked.review. No source edits/build/fullsuite reruns/commits/pushes/GitHubcomments/merge/deploy. Both PRs remain draft. Current review DOES NOT CLEAR PR29 despite prior101focusedPASS/full10666PASS/buildPASS. Parent merges findings from actual final reports without re-verifying/re-reading diff.
+
+### F9 — P2 — Preserve grouped direct eval in control-statement bodies (BOTH)
+
+Broad location src/resolution/commonjs-export-members.ts:31: rejects any preceding ), including a completed if or for condition. Exact input `class Store { load() { return 42; } }
+if (true) (eval)('exports.load = Store.prototype.load;');`. Runtime exports load() returning42, but current discovery uncertain:false and indexing named.load() produces no call. Removing only new prefix guard in memory restores uncertain:true and m.js:Store::load. Nested grouped eval in unbraced single-iteration for body reproduces too. Broad evidence /tmp/cg-broad-pr29-control-context.{cjs,log}; exact command `node --experimental-wasm-exnref --experimental-wasm-stack-switching /tmp/cg-broad-pr29-control-context.cjs`.
+
+Adversarial independently confirms same location/trace; grouped-template if-body and for-body also reproduce. Evidence /tmp/codegraph-cjs-adversarial7-conditional-eval.{cjs,log}. De-duplicated as one P2 F9. This is a NEW regression introduced in PR29, not a pre-existing parent limitation.
+
+### F8 — P2 — PARTIALLY CORRECTED, remains for contextual-keyword wrapper names (adversarial)
+
+Exact reviewer location src/resolution/commonjs-export-members.ts:29 (whitelist:7). Valid CommonJS `function await(value){return function ignore(code){};} await(eval)("ignored");` passes eval without invoking it, but whitelist exemption produces uncertain:true and falsely resolves named.missing() to decoy.js:Decoy::missing. With exports.known=function known(){}, runtime exports only known; pre-F7 behavior restored in memory produces no call. yield reproduces too. Evidence /tmp/codegraph-cjs-adversarial7-contextual-wrapper.{cjs,log}. This is a RESIDUAL F8 variant, not a new unrelated parent re-audit. Do not label all F8 closed.
+
+### Confirmed preservation / rulings
+
+Both independently clear original F8 forms wrap(eval)("ignored") and wrap((eval))(("ignored")): runtime onlyknown, reader uncertain:false, no decoy call. Broad /tmp/cg-broad-pr29-f8-closure.{cjs,log}. Adversarial13runtime-backed graph controls pass (original2forms +11nearby controls), /tmp/codegraph-cjs-adversarial7-controls.log. True standalone grouped/template eval, return expressions, inert data/method declarations, call/member/optional/tag/condition-prefix negatives retain tested behavior. These controls do not answer F9 control-body context or F8 await/yield wrappers.
+
+### Next boundary
+
+Review-only user request is complete. STOP: no fixes, additional review loop, external review comment, markready, merge or deploy without user instruction. The per-step confirmation request remains in force. This is round7 overall; no gate/state reset. Repeated grouping-prefix patches now demonstrate syntax-context ambiguity: if user asks for remediation, choose an evidence-based smaller boundary/design instead of another unbounded keyword/punctuation whitelist. Preserve both concrete repros and all prior controls. Do not repeat fullsuite/build on unchanged source. Actual durable result/evidence/checksums saved in original QA .review/commonjs-fix-2026-11-08/pr29-review-round7-2026-11-09/.
+
+
+## AST redesign approved and started — 2026-11-09
+
+User explicitly approved AST redesign in PR29, said near usage max and asked for a resumable start, then said proceed. This revokes prior review-only stop for in-scope remediation; do not ask same approval on resume. Preserve per-step/user and actual gate boundaries for later merges/deployments. No grammar/runtime/dependency/database-schema changes, commits or pushes in this partial phase; PRs remain draft at prior heads.
+
+Newgraph regressions FIRST:3control-body direct-eval variants(if string/template, for nestedgroups) +await/yield CommonJS wrappers,5FAIL51SKIP on current87576a8d. /tmp/codegraph-cjs-ast-red.log, EXIT1. This intentionally RED gate remains unchanged because integration pending.
+
+New isolated src/extraction/commonjs-eval.ts reads existing SyntaxNode tree and checks actual call.function after unwrapping parenthesized_expression. Returns true for syntacticdirectevalcall(anyargument), false for provenabsence, null for parseerrors with no foundcall. New __tests__/commonjs-eval.test.ts loads existingJS/TS/TSXgrammars:33PASS, /tmp/codegraph-cjs-ast-helper.log EXIT0. Controls cover reports, grouped/interpolated eval, return, generatorfunctions/methods, nestednongenerator scope, eval inside yieldwrapper argument, inert data/methods/membercalls, JSX and malformedsource. Helper not wired to classifier/extraction yet. Existing lexical reader/EXPRESSION_PREFIX_WORDS unchanged for now. Do not claim F8/F9 closed, new full/buildpass or finalreview.
+
+IMPORTANT new evidence: existingJSgrammar correctly models control-body eval and awaitwrapper but parses legal CommonJS yield(eval)(code) as yield_expression whose operand is a call on(eval), no parseerrors. ASTscope must distinguish nongeneratorwrapper from generator yield. Helper handles direct yieldoperand only via nearestfunction/generator/methodscope; nested true eval in yield(eval(code)) remains detected. Shapeprobe /tmp/codegraph-cjs-ast-shape-probe.{cjs,log}. Extractionreferenceprobe /tmp/codegraph-cjs-eval-reference-probe.{cjs,log} shows currentextractor emits callref eval for genuinecall AND synthetic yieldwrappercase. Consequently raw existing unresolved eval refs alone are insufficient. User was explicitly told this grammar limitation, not falsely assured all cases are parser-perfect. No grammarfiles changed.
+
+Next integrate factualcallresult through existingextraction to resolver. Node has NO metadata field (onlyedges do); do not invent Node.metadata, abuse signature/selfedges/candidates, or introduce schema migration casually. ExtractionResult can carry optionalfact through workerclone; need native/deferred bypass parity. Main bulk parse pools only load grammars in workers; resolver cannot assume synchronous getParser is ready in main. Suggested project_metadata perfile/sourcehash transport or another small explicit extractioncontext capability; persist/refresh under same successfulstore lifecycle, cover storeworker and sync. Decide carefully before editing infrastructure. Resume must preserve all existing tests and5newred cases; unknown/missing/error facts must not masquerade as provenabsence. Keep existing export-member tokenizer and previous sync/scope/alias fixes intact; remove prefixheuristics only onceASTfacts actuallysupplied.
+
+Saved current3sourcefiles, patchrelative87576a8d, hashes, red/green/probe logs under original QA .review/commonjs-fix-2026-11-08/ast-redesign-started-2026-11-09/. No tests/build/reviewers running at checkpoint. Newfiles intent-to-add only so diffincludes them, not readyforcommit. No fresh dualreviewagents this phase. Overall reviewcount7; do not reset gate/controlstate. Resume directly integration and targeted tests; fullsuite/build only after stablefix, fresh focuseddual review as authorized/actualgatepermits, no repetitivewholeprojectwork. OriginalT0stillstopped/uncommitted; liveem40 unchanged; no merges/deploy/upstream writes.
+
+
+## AST integration execution-tested — verify round8 pending
+
+User approved AST redesign with focused review before final fullsuite, then resumed. Current dirty correction target87576a8d..workingtree,15paths captured /tmp/codegraph-cjs-ast-frozen.json (allnewfilesintent-to-add). No sourcecommit/pushyet; publishedPR29still87576a8d. No grammar/runtime/dependency/schema changes.
+
+Implemented AST fact in ExtractionResult and ephemeralFileRecord property; WASM computes from existingtree, native/deferred routes compute with existinggrammar; kernelmaterializer preservesfact. Allstorepaths carryFileRecord fact through existingwriter, upsertFile writes project_metadata commonjs_eval:<file> containingcontentHash/value. Nosecondwriter orNode.metadata. deleteFile removesfact. Coordinatorcontext acceptsboolean onlyonexact SHA256sourcehash. Missing/malformed/stale/nullfacts returnunknown, neverabsenceproof. Tokenreader removed literalEvalCall/EXPRESSION_PREFIX_WORDS, consults lazyASTfact atmostonceonlywhenbareevaltokenpresent; unknown staysconservative. Existingmembertokenizer/sync/typeFrom/scope unchanged. CHANGELOG alreadyrequiresre-indexafterupgrading(line56), which suppliesnewfacts; no legacyfactmigrationclaimed.
+
+Original5newgraphregressionsRED5FAIL51SKIP beforeintegration. Initialintegratedrun blocked by compiler: hashContentisexportedfromextraction/index, notutils; corrected byusingexistingcreateHashcrypto inresolver (sameSHA256algorithm), no circularextractionimport. Then3files140PASS. AddedrealSQLite factlifecycle4cases(missing/malformed/null, hashstale/replace,rollbackwithfiletransaction, deletion) andfreshindex-vs-sync wrapper->if-eval->yield-wrapper->for-eval->wrapper sequence. Final8files166PASS1SKIP, /tmp/codegraph-cjs-ast-expanded.log, CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2; alsoincludesmemo/synccaches/lazy-engine. Nativebinarynotstaged(codegraph-kernel/prebuilds/linux-x64/codegraph-kernel.node absent); kerneltransporttestskipped. Do not claimnativeexecution. Enginecompiledbytestsetup,currentdistmatchesfrozen sources. No explicitfinalnormalbuild/fullsuiteorindependentreviewyet. Priorfull10666PASSbelongs87576a8donly.
+
+Next eighthfreshnativeREADONLYlanes verify this correction, sameledger andexactGitdiff87576a8d..workingtree. Boundedruntimeprobes only, no fullsuite/build orsourcechanges. CheckF8/F9closure,generator-awareyieldworkaround, actualevalvswrappercallee, sourcehashfactlifecycle/workertransport/sync, previouscontrols. Do not re-audit unrelatedparentlimitations. Stop/reportifreviewfindsissues; do notresetgate/count orclaimClaude-onlyskill.
+
+
+## Eighth native review COMPLETED — AST correction NOT CLEARED
+
+Both fresh read-only reviewers completed normally on frozen15-file87576a8d..workingtree correction. Both confirm no source edits/build/full reruns/control changes; source hashes unchanged. No final normalbuild/fullsuite run or commit/push. PublishedPR28/29 remain drafts at5d384989/87576a8d. Prior166focusedPASS1SKIP is true and covers original5reportedgraphcases, but does not clear new findings. Nativebinary absent, no nativeexecutionclaim. Parent uses actual reports, no independent duplicate repro/diffread.
+
+### F10 — P2 — Optional contextual-keyword wrappers regress (adversarial)
+
+Exact reviewer location src/extraction/commonjs-eval.ts:37. Valid CommonJS:
+
+```js
+exports.known = function known() {};
+function yield(value) {
+  return function ignore(code) {};
+}
+yield?.(eval)("ignored");
+```
+
+Runtime exports only known; eval is never invoked. Existing grammar reports parse error, helper returns null, reader marks exports uncertain, and named.missing() falsely calls unrelated decoy.js:Decoy::missing. Actual current correction calls:[decoy.js:Decoy::missing]; base87576a8dreader restored in memory calls:[], uncertain:false. Evidence /tmp/cg-a8-yield-optional.{cjs,log}, /tmp/cg-a8-yield-optional-base.{cjs,log}, /tmp/cg-a8-probe.cjs. New F8-adjacent regression introduced by AST correction. Unknown fact correctly avoids false absence proof but must not license false call targets; current fallback still does.
+
+### F11 — P2 — Computed method names use enclosing scope (broad)
+
+Exact reviewer location src/extraction/commonjs-eval.ts:51. Treats a computed method name as belonging to that method's function scope. Computed names execute in enclosing scope. Confirmed both directions:
+
+1. `class Store { load(){return 42;} } function* setup(){ const obj = { [yield (eval)('exports.load = Store.prototype.load;')]() {} }; } setup().next();` Runtime exports load()->42, currentfactfalse/uncertainfalse, named.load() graphcalls[]. Ordinary computedmethodkey inside outergenerator suppressesgenuineeval.
+2. `exports.known=function known(){}; function yield(value){return function ignore(code){return 'x';}} const obj={ *[yield(eval)("ignored")](){} };` Runtime keysonlyknown, currentfacttrue/uncertaintrue, named.missing() falselycallsDecoy::missing. Generator methodkeyevaluatesoutsidegeneratorbody, so yieldiswrapperhere.
+
+One rootcause/twoexecutiontraces, evidence /tmp/cg-broad-pr29-ast8-computed-scope.{cjs,log}, executed againstcurrentdist with CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2. All15frozenhashesmatch.
+
+### Stop boundary and saved state
+
+Approved redesign progressed to166focusedPASS + real-worker/store/sync/factlifecycle integration, then focusedverifyfoundthese2P2. STOP before anothercorrectioncycle per dual-reviewworkflow/userper-stepconfirmation. Don't spendfullsuiteonknowndefectivecode orpushasready. Usermustdecidenextstep; noautomaticnewreview/fix/merge/deploy. Overallcount8, noreset. Nextremediationifapproved: computedmethodscope must excludecomputedkeys fromnewmethodscope; parseerrorunknown mustnotenableinventedfallbackcalls (requires explicitresolutionpolicy, not anotherkeyword/punctuationguess). Preserve all originalregressions and33ASTcontrols, truealiases/sync/scope/Pythonbehavior. No grammarfiles/schema/deps changed; source remains15dirtypaths, notcommitted. Durablebackup includes allsources/patch/logs andnewreviewevidence, verificationresult/checksums.
+
+
+## F10/F11 corrections approved and execution-verified — independent verification pending
+
+User explicitly answered yes to correcting the two eighth-review findings. Current HEAD87576a8d and15dirtysourcepaths retained; no newcommit/push/merge/deploy/grammar/schema/dependencychanges.
+
+Fail-beforetests:2ASTcomputed-key cases,3graphfindingcases,positivealiascontrol andunknownparse syncstep. Actual2files6FAIL90PASS beforefix, /tmp/codegraph-cjs-ast-f10-f11-before.log EXIT1. Positive explicitcallablealias underunknownparsealreadyPASS beforefix, mustkeep.
+
+F11fix: method_definition suppliesfunctionscope onlywhen calllieswithin ASTbodyorparametersregions. Computednames/decorators useenclosingscope; no newkeyword/punctuation guesses. Bothcomputedkey directionsfixed. F10fix: tokenizer resultrecords evalUnknown separatelyfromuncertain/namespace. Moduleinfo propagatesunknownflag, includingexistingforwarderspread. Themethod-nameguessgate stopsunprovenmatchesforunknown-evalexportswithoutclaimingnamespace/memberabsence; explicitwrittenmemberaliasesremainallowed, andearlierprovenreceiver/typepathsremainunchanged. UnknownASTfactstillnull, no falseparse-success/intrinsicproof. Existingmembertokenizer andfacts/hash/storelifecycleremainunchanged.
+
+Expanded8files172PASS1SKIP EXIT0, /tmp/codegraph-cjs-ast-f10-f11-after.log, CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2. Coversallprevious166checks plusnewcomputed-keyAST/graphcases,optionalcontextualwrapper,realexplicitcallablealiasunderunknownparse,andfreshindex-v-syncincludingknownactualeval->unknownwrapper->actualeval transitions. One skip is nativekerneltransport; nativebinarynotstaged,no nativeexecutionclaim. A matchercommentclarifyingunproven-callpolicyupdatedaftertest; no behaviorchangedafterthispassingrun. gitdiff--checkPASS. No explicitnormalbuild/fullsuite oncurrentcorrection; old10666fullPASSbelongs875only.
+
+Currentcorrectionvsround8snapshot changes5files: ASThelper,exportreader,matcher,ASTtest,graphintegrationtest. Durablebackup originalQA .review/commonjs-fix-2026-11-08/ast-f10-f11-corrected-2026-11-09/ includesall15sourcefiles,currentSHA256,cumulativepatchrelative875,small5filedeltafromround8,fail-before/passafterlogs,verificationmetadata. F10/F11 statusCORRECTED+focusedPASS, NOTindependentlycleared. Overallreviewcount8unchanged,noround9agentslaunched. Userper-stepconfirmationrequiresdecisionbeforefreshfocusedverify; don'tspendnewfull/reviewcycleunasked. No sourcecommit/pushyet; PR28/29remainDRAFT/unmerged. Ifuserapprovesnextreview: exactGitdiff875..workingtree +round8delta/sameledger, freshread-onlynativebroad/adversarial, boundedprobesonly,norepeatfull/build. Respectactualgate/noreset. Runfinalnormalbuild/fullonceonlyafterreviewstable. PreserveT0stopped/uncommitted; liveem40unchanged; noofficialupstreamwrite.
diff --git a/docs/handoffs/pr29-2026-11-10/history/ast-f10-f11-corrected-2026-11-09/commonjs-missing-member.md b/docs/handoffs/pr29-2026-11-10/history/ast-f10-f11-corrected-2026-11-09/commonjs-missing-member.md
new file mode 100644
index 0000000000..76572ce746
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/ast-f10-f11-corrected-2026-11-09/commonjs-missing-member.md
@@ -0,0 +1,260 @@
+# CommonJS missing-member review ledger
+
+Target: /tmp/codegraph-cjs-missing-fix-20261108, branch fix/commonjs-missing-member. Base 5e0664891af0e87e6fd18bbfa16cab39237570f5 to current tracked working tree, unchanged while both reviewers run. Exact diff: `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5e0664891af0e87e6fd18bbfa16cab39237570f5 -- CHANGELOG.md src/resolution/name-matcher.ts __tests__/js-default-binding-members.test.ts`.
+
+Round1 pending two fresh read-only native lanes. No Claude-only /code-review invocation. No resolver fix existed previously; user explicitly authorized implementation and dual review. Fork issue27 is the bug, QA PR27 is evidence only. No official upstream submission before Tuesday verification.
+
+## Findings / fix map
+
+- F1: confirmed upstream defect. `const named=require('./m'); named.missing()` with m.js exporting only known falsely calls unimported Decoy::missing; ref keeps receiver, resolvedBy instance-method/provenance null. Default imports and class-name-alias collision variants also reproduced. Sync adding decoy also fabricates call. Proposed tracked working-tree fix adds default bindings to imported-receiver guard and moves guard before unrelated class-name matching, after actual import/typed/object resolution. Requires reviewer execution and clearance.
+- P0 test baseline: new20-case file on unmodified resolver:15 PASS /5 FAIL. The5 failures are3 parameterized default/require+decoy cases,1 forwarding-module missing member,1 sync-add-decoy. Log /tmp/codegraph-cjs-fix-baseline2.log. No production code edit before this run. Initial baseline command failed because Vitest4 removed --minWorkers; corrected to --maxWorkers=4. Initial two new-test authoring corrections: object variable API used instead of unsupported direct object-literal shorthand shape; expected local object's qualified name corrected to actual fully-qualified extraction name. Neither changes an existing baseline test.
+
+## Rulings / limits
+
+- Direct `module.exports = { read() {} }` without an assigned variable already lacks correct member recovery on base and can be captured by a method decoy. This change must stop wrong calls; new object API positive uses baseline-supported `const api={read(){}}; module.exports=api`. Do not broaden into object-export extraction or claim direct shorthand recovery is implemented.
+- Bare external-package import exact-match issue26 remains separate and unfixed.
+- No import mapping semantics changes, no blanket conversion of require to namespace imports, no source code changes outside one name-matcher guard and changelog/tests.
+- This is a remaining variant of closed upstream2952/merged3162. No global novelty claim. Reproduced on em40/pristine main/pristine release. Native kernel unverified; local deployment is kernel0/WASM.
+
+## Invariants / commands
+
+- Actual exported member resolves beside an unrelated same-name method; missing member has no call. Forwarded CommonJS module preserves real export.
+- Stated CommonJS class static method, assigned object member, instance method, callable direct/default + attached function all remain correct beside decoys.
+- Existing ES default class, instance, typed variable, ambient export=, ordinary ESM namespace, named/anonymous/renamed functions retain calls.
+- Typed local parameters and object literal bindings shadowing default imports retain their local member calls.
+- Sync adds/removes a real export correctly; sync adding/removing a same-name unrelated method never fabricates missing-member calls.
+- Check these with `cd /tmp/codegraph-cjs-missing-fix-20261108 && CODEGRAPH_KERNEL=0 npx vitest run __tests__/js-default-binding-members.test.ts --maxWorkers=1`.
+- Expanded focused suite currently running: js-default-binding-members, commonjs-require-calls, commonjs-require-imports, commonjs-exports, require-default, import-default-as, namespace-object-resolution, import-object-member-namesake, sync-default-export-change, sync-import-member-retry, out-of-repo-import-shadow. Log /tmp/codegraph-cjs-fix-focused.log. Full normal suite/build pending.
+- Additional adversarial probes: class name matching alias, nested receiver paths, defaults with inherited/static/object APIs, lexical shadows and live sync. Each defect needs concrete input/actual wrong output; no style requests or hypothetical findings.
+
+## Round1 review outputs and remediation
+
+Both native lanes finished read-only. Each independently reported the same two P2 regressions at name-matcher.ts:24944; no other demonstrated findings.
+
+- R1 (broad+adversarial): `class Store { load() {} }; module.exports = new Store()` loses its legitimate instance call. Adversarial also demonstrated `export default new Store()` with Store not separately exported. Both base em40 produce Store::load; initial guard none. Remediation: resolve a whole explicit constructor expression to its actual module's local/imported class before the guard. Follow CommonJS forwarding; mask strings/comments/regexes, balance constructor arguments and type arguments, reject chained expressions, memoize with existing export index. Never re-enable generic method-name guessing for default bindings.
+- R2 (broad+adversarial): visible local `class named { static missing(){} }` shadows a default/namespace import; moving guard ahead of class strategy drops correct own-file call. Broad also tested enclosing-function shadow. Remediation: guard exempts a class declaration in the reference's file only when existing isLexicallyReachable proves it visible. Other-file alias-name class decoy remains blocked.
+- Review regression tests run BEFORE remediation: /tmp/codegraph-cjs-fix-review-baseline.log,24 cases19PASS5FAIL (original CommonJS positive +2 constructed-default variants +2 lexical class shadow variants). This pins both findings. Additional constructor argument/forwarder/text controls added; simple first remediation failed3nested/multiline/regex constructor positives in /tmp/codegraph-cjs-fix-constructors-baseline.log before argument-reader correction.
+- After remediation: /tmp/codegraph-cjs-fix-focused4.log,11 files99PASS1SKIP. Final focused run adds no-parentheses and spaced CommonJS constructor controls; /tmp/codegraph-cjs-fix-focused-final.log pending. Earlier temporary TS compile error from passing Language to CommentLang was corrected to JS-family typescript comment handling; not a passing run.
+
+The exact R1 reviewed name-matcher source is saved in .review/round1-name-matcher.ts and reconstructed hash verified against the recorded Git blob512a77a155299de8e6890447aa2d3aea7b81a1f9. Name-matcher remediation diff: `git diff --no-index /tmp/codegraph-cjs-missing-fix-20261108/.review/round1-name-matcher.ts /tmp/codegraph-cjs-missing-fix-20261108/src/resolution/name-matcher.ts`. Import-resolver and new tests are also remediation, diff from5e066489. No intermediate failing-source commit was made.
+
+Verify2 target is current tracked working tree relative5e066489, including CHANGELOG.md, src/resolution/name-matcher.ts, src/resolution/import-resolver.ts, __tests__/js-default-binding-members.test.ts. Check R1/R2 on all paths, all invariants, and defects introduced by remediation. Do not re-raise the pre-existing direct module.exports object-literal recovery limit without new evidence. Full build/suite pending. No merge/deployment occurred.
+
+## Verify2 result — NOT cleared; namespace-only redesign supersedes that target
+
+Both fresh native lanes finished; all findings P2. Broad reported first textual constructor overriding inactive/overwritten exports, valid inline/parenthesized constructors losing calls (R1 still open), and constructor-derived calls remaining stale after sync. Adversarial independently reported constructor lookup overriding typed/object/class lexical shadows (R2 still open), earlier constructor overriding a later stated default, and stale constructor-derived calls after sync. Exact evidence scripts/results under /tmp/cg-broad-verify2-* and /tmp/codegraph-cjs-verify2-*; complete reviewer messages returned to root. Existing explicit-default resolution was safer than the attempted new inference.
+
+Both lanes advised that a smaller boundary is coherent: extend module-namespace ownership only to a require/default whose resolved JS/TS target has no stated or uncertain value default; preserve all existing explicit/unknown default-value inference. Whole-file CommonJS forwarding can follow a namespace leaf; ambiguous assignments/default values must stay base behavior. No nonexistent redesigned code was reviewed or cleared by those design messages.
+
+Implemented redesign: REMOVED all added import-resolver source code; that file is byte-identical to base again. Removed unsafe constructor parsing/inference entirely. Name-matcher now uses existing context.resolveModuleFile, a per-context namespace-classification memo (cleared with existing memos), conservative source checks, pure whole-file forwarders only, bounded/cycle-safe traversal, language-qualified memo keys and JS/TS extensions only (no implicit component defaults). Any raw default keyword/export= or uncertain module use excludes the new guard; comments/text may conservatively prevent a classification. Move-before-class guard keeps lexical own-file class exemption. Changelog narrowed to modules without a value default.
+
+Scope/ruling: arbitrary stated/unknown exported default values and their guessed-member limitations remain pre-existing and explicitly OUTSIDE this fix. Do not claim every default-import missing-member case fixed. Removed new constructor-parser feature tests after deleting that feature, retaining baseline-supported CJS/ESM singleton, stated class/object/callable, lexical shadows and every original missing-module regression. Two dedicated singleton controls initially asserted disambiguation between two .load methods that base itself cannot provide; corrected their newly-authored fixture to a unique .load method, preserving the actual base invariant. Original broader CJS store-vs-decoy control remains unchanged. No baseline existing assertion was weakened.
+
+Full suite on superseded constructor candidate was STOPPED intentionally via guarded SIGINT to only this checkout's Vitest PID702277; final exec83750exit130. It did not pass and must not be reported as a test failure count/green gate. /tmp/codegraph-cjs-fix-full.log belongs that obsolete target. Latest redesigned focused13-file run /tmp/codegraph-cjs-fix-redesign-focused2.log RUNNING; verify actual exit/summary. Explicit build and redesigned full suite remain required.
+
+Third-review exception requested via async user question: skill says third round only if verify found something high severity; these were P2. Await user's explicit answer before launching further reviewers. Both agents' conceptual agreement is not final dual-review clearance. No source commit/push/fix PR/merge/deploy occurred. Original user's conditional merge/deploy request remains dependent on a reviewed green fix; original T0 stays stopped.
+
+## Final testing and local commit — authoritative current state
+
+Namespace redesign focused suite13files108PASS1SKIP, explicit npm run build exit0. Full normal suite exec60370EXIT0:872filesPASS19SKIP;10589testsPASS,2expectedFAIL,448SKIP,0unexpectedFAIL,799.56seconds. /tmp/codegraph-cjs-fix-redesign-full.log. Original portable6-case bug reproduction6/6PASS. Existing independent18-case records match em40baseline exactly. Namespace-to-value default change sync agrees with fresh index (initial no calls, synced/fresh Store::load); /tmp/codegraph-cjs-namespace-sync-probe.{cjs,jsonl}. Native kernel not validated.
+
+Personal repository/remote/identity, source checksums against preserved tested snapshot, staged3-file set and staged diff/check verified before local commit. LOCAL COMMIT d18e40970fc5fbf32f635f6d8d536d1bdb24dacc, tree2363dd0f8923ca59c28a3e45a477573e7364e7c2, branch fix/commonjs-missing-member. Tracked working tree clean; only private .review untracked. No push/fix PR/merge/deployment. Review target now `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5e0664891af0e87e6fd18bbfa16cab39237570f5..d18e40970fc5fbf32f635f6d8d536d1bdb24dacc -- CHANGELOG.md src/resolution/name-matcher.ts __tests__/js-default-binding-members.test.ts`.
+
+Third review still requires the pending user answer. User's later status question did NOT approve it. If authorized use two fresh native lanes with fork_turns=none and self-contained briefs/ledger to avoid carrying unrelated history. Preserve final tests; no redundant full rerun unless code or unresolved concerns change the tested tree. Verification and logs/source/patch are backed up under original QA .review/commonjs-fix-2026-11-08/verification.json and adjacent artifacts. Current canonical handoff handoff-codegraph-commonjs-tested-review-pending-2026-11-08.md supersedes running/constructor handoffs.
+
+## Third round authorized and running
+
+User explicitly answered yes to the third-review request, then asked why another round was needed. Explained earlier reviews covered replaced code while the tested final commit had not been independently reviewed. This question did not revoke approval. Started fresh read-only review_broad_commonjs_final3 and review_adversarial_commonjs_final3 with fork_turns=none, the exact base..d18e4097 target and this ledger, compact self-contained briefs and no full-suite rerun. Their results remain pending. Source unchanged; no push/merge/deployment.
+
+## Third round result — 2026-11-09 — NOT READY TO MERGE
+
+Exact target remains local d18e40970fc5fbf32f635f6d8d536d1bdb24dacc. Tracked tree clean, .review untracked; no source changes after passing tests. User resumed; collected broad final answer and adversarial confirmed messages. Broad lane completed normally. Adversarial lane delivered independently confirmed findings/evidence, then failed finalization with a usage-limit error (retry notice Nov9 1:10AM). Do NOT claim that lane completed normally, final clearance, or a green dual review. No push/PR/merge/deployment.
+
+### F3 — P2 — Namespace classification changes do not invalidate existing guessed calls (broad, independently confirmed adversarial)
+
+Broad location src/resolution/name-matcher.ts:25398. Start with `class Store { load() {} }; module.exports = new Store()` and an unchanged caller requiring that module and calling `.load()`. Replace the export with `exports.known = function known() {};`, retaining the class. After cg.sync(), the graph still calls Store::load; a fresh index correctly produces no call. The new module-text dependency needs to reopen existing member guesses when export shape changes.
+
+Broad reproduction /tmp/cg-broad-final3-sync-reverse.cjs; final evidence /tmp/cg-broad-final3-sync-reverse.log. Baseline comparison confirms its sync and fresh results both retained Store::load (/tmp/cg-broad-final3-sync-reverse-base.log). Adversarial independently reproduced direct and pure forwarder value->namespace->value->namespace retaining Store::load on every sync: /tmp/codegraph-cjs-final3-sync.cjs. Minimum correction recommendation: reopen default-import member guesses when imported module export text/shape changes, or record the imported source dependency on guesses allowed by a false namespace classification.
+
+### F4 — P2 — Explicitly exported callable aliases lose their calls (adversarial confirmed before usage limit)
+
+Location reported src/resolution/name-matcher.ts:25427. m.js `class Store { load() { return 42; } }\nexports.load = Store.prototype.load;`; use.js `const named=require('./m');\nexport function run(){named.load();}`. em40 calls m.js:Store::load; final emits no call. Same independently confirmed for `module.exports.load = Store.prototype.load`. Runtime named.load returns42 and Object.keys(module)=['load']. This is an explicitly exported callable, not the ruled-out direct object/default-value guessing limit. Prototype mutation variants group with the same uncertain-exports classification problem.
+
+Evidence /tmp/codegraph-cjs-final3-export-alias.cjs and /tmp/codegraph-cjs-final3-adversarial{,-base.jsonl,-final.jsonl}. Recommendation: preserve uncertain named-export RHS APIs or resolve the actual callable alias before blocking a fallback. Do not reopen arbitrary guesses for absent exports.
+
+### F5 — P2 — Out-of-scope local class bypasses namespace guard (adversarial confirmed before usage limit; original finding remains open on this path)
+
+Reported location src/resolution/name-matcher.ts:25397 (guard local-class exemption, around25396). Valid CJS: m.js `exports.known=function known(){};`; use.js lines1..8:
+`const named=require('./m');`
+`function run(){`
+`if(true){`
+`class named {static missing(){}}`
+`}`
+`named.missing();`
+`}`
+`module.exports=run;`
+Final returns use.js:run::named::missing atline6, though the class is block-local and imported module has no missing. Also reproduced for a class inside TS namespace Parent. These outputs pre-exist on base, but this is a still-open original false-positive path bypassing the new guard: existing isLexicallyReachable does not establish block visibility. Recommendation: require actual enclosing lexical block visibility before exempting a class. Preserve the genuine inner/enclosing-function shadow controls.
+
+## Merge decision / next boundary
+
+HOLD d18e4097. Passing build/full/focused tests remain factual, but F3/F4 are demonstrated regressions and F5 remains an intended missing-member path. No further agents, tests, source fixes or outward actions started after these reports. Do not rerun the full suite until a changed candidate requires it. User required confirmation before subsequent steps; present this concrete review result and seek the next bounded correction/verification decision. Fourth review is not preauthorized by approval of the third; native review gate may deny round4, so stop and ask rather than bypass. Agent quota exhaustion is additional reason not to relaunch a failed lane automatically.
+
+## Corrections authorized — 2026-11-09
+
+User: if findings are separate, report them; if related, fix them. All three are related: F3/F4 regressions introduced by this guard, F5 remaining original namespace missing-member path. No new issue filing or outside bug work needed. Authorized correcting all three in this branch; no extra reviewer lane or outward action started.
+
+Fail-before tests:11 new regressions fail and24 existing pass on d18e4097, /tmp/codegraph-cjs-fix-r3-regressions-before.log. New tests cover direct and forwarded value->namespace->value->namespace sync vs fresh; explicit dotted/bracket export aliases beside a still-absent-member decoy; alias removal by sync; out-of-scope sibling-block classes vs genuine same-block inner callers; TSnamespaceclassscope.
+
+Changes: F3 uses existing typeFrom dependency tracking on byName default-import member calls, includes each pure-forwarder file; activates the existing dependency-edge reopener for JS/TS paths while keeping failed-attribute retry Python-only. F4 namespace info tracks explicit assigned member names; new guard applies only to absent names. Escaping/computed/prototype-mutated exports remain uncertain and preserve existing behavior. F5 adds existing holderScopeAt block visibility to the class-shadow exemption, retaining function lexical visibility as well. Namespace memo stores traced files/member names; cache not poisoned by depth/cycle cutoffs.
+
+First focused verification AFTER all three corrections:3files49PASS0FAIL, /tmp/codegraph-cjs-fix-r3-regressions-after.log. Includes full35-case default-member suite and memo clearing/lifetime. No existing expected assertion weakened. Pending expanded JS/Python sync controls, normal full suite/build and original6-case repro. No new commit yet; earlier full pass applies d18e4097 only. Current changed files test + name-matcher + src/index.ts + src/extraction/index.ts. No unsafe constructor inference, import-resolver unchanged. Fourth review not yet requested/launched; gate and quota limits remain applicable.
+
+## Corrected commit verified by execution — independent review pending
+
+F3 class-name path also pinned: two new uppercase Store import-alias sync cases failed when only byName answers carried dependency metadata; /tmp/codegraph-cjs-fix-r3-upper-before.log. Final correction records imported-module inputs on name-matcher default-member answers from both class-name and method-name strategies. No change to confidence/byName selection. All original regression assertions retained.
+
+FINAL source tests:16files206PASS1SKIP, including37default-membercases, JS imports/sync andPythonattribute/memo controls. Log/tmp/codegraph-cjs-fix-r3-focused-final.log. Full normal suite exec42040EXIT0:872filesPASS19SKIP,10602testsPASS2expectedFAIL448SKIP0unexpectedFAIL,771.60seconds, /tmp/codegraph-cjs-fix-r3-full.log. Explicit npm run build exec37438EXIT0, /tmp/codegraph-cjs-fix-r3-build.log. Original portable6-case bug reproducer6/6PASS, /tmp/codegraph-cjs-corrected-final-sixcases.log. Node22.22.2/kernel0WASM; native not claimed. Source checksums prove no source changes between focused/full/build/testing and commit.
+
+LOCAL CORRECTION COMMIT559c76df6afd9e40f4d617ff77caa7db4ad03955, tre eb81d2063f4e787da5cfc7d28c619078fdc86e6b6, parentd18e40970fc5fbf32f635f6d8d536d1bdb24dacc. Personalrepository/remote/identity/stagedexact4-filediff andchecks verified. Trackedtreeclean, onlyprivate.reviewuntracked. No push/fixPR/merge/deploy or issuefiling. F3/F4/F5 status CORRECTED+executionPASS, awaiting independent verification; do not claim native review clearance.
+
+FOURTH ROUND ANSWER PENDING: async question asked permission and quoted ~/.codex/AGENTS.md: "where Claude's gate would ask the user at round 4, Codex denies, so stop and ask." User has not answered that new question; elapsed time is not approval. Do not launch fourth reviewers yet or modify gate state/control files. If approved use2freshread-onlynativefork_turns=none, same ledger, correction target `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff d18e40970fc5fbf32f635f6d8d536d1bdb24dacc..559c76df6afd9e40f4d617ff77caa7db4ad03955 -- src/resolution/name-matcher.ts src/index.ts src/extraction/index.ts __tests__/js-default-binding-members.test.ts`. Brief F3-F5, currentcorrections+invariants; no fullsuite rerun unless changes/failures justify it. Stop/ask if gate denies; last third adversarial lane failed finalization due usage cap, don't fabricateclearance.
+
+Durable original-workspace backup .review/commonjs-fix-2026-11-08/corrections-2026-11-09/:4sourcefiles, corrections.patch, checksums.json, before/after/focused/full/build/reprologs, verification.json identifyingfinalcommit/tree/outcomes, verified commonjs-fix.bundle containingbothlocalfixcommits with originalbase5e066489prerequisite. Commit recovery does not depend on /tmp survival. Current canonical handoff handoff-codegraph-commonjs-corrected-review-pending-2026-11-09.md supersedes corrections-running and review-blocked handoffs. OriginalT0unchanged/stopped; Tuesdayconditionalupstreamreport unchanged.
+
+## Fourth verification and modular correction — 2026-11-09
+
+User asked whether errors remain and approved proceeding, specifically requesting a smaller modular strategy for any remaining fix. Two fresh read-only minimal-context lanes review_broad_commonjs_verify4 and review_adversarial_commonjs_verify4 completed. BOTH independently CLEARED F3 direct/forwarded sync for ordinary and class-name aliases; F4 dotted/bracket callable/prototype aliases and removal sync; F5 block/namespace visibility and genuine inner shadows. Adversarial also verified Python failed-call retry/retyping and zero Python retry on JS-only edits. No full/build reruns or source edits by reviewers.
+
+F6 — P2 — src/resolution/name-matcher.ts:25444 raw exported-member discovery accepts comments, strings, regex literals, and unrelated object properties. With m.js exporting only known, adding `// exports.missing = fake;` or `function setup(holder) { holder.exports.missing = 42; }` makes named.missing falsely call decoy.js:Decoy::missing. Clean source has no call. Quoted/template/regex variants reproduce. This is newly added member inclusion, not the previous conservative default-text exclusion ruling. Exact broad evidence /tmp/cg-broad-verify4-classifier.{cjs,log}, /tmp/cg-broad-verify4-probes.cjs; adversarial /tmp/codegraph-cjs-verify4-extra.cjs. Both recommended one isolated token-aware collector validating executable assignments and bare exports/module.exports roots.
+
+Following user's authorized strategy: extracted readCommonJsExportMembers into new48-line(initial) src/resolution/commonjs-export-members.ts, with independent __tests__/commonjs-export-members.test.ts. Replaced matcher raw member/escape scanning with one helper call. Uses exact pinned production js-tokens9.0.1 (CommonJS, built-in types,16071unpackedbytes per officialnpmmetadata), no hand-written lexer or changedsharedstrip-comments scanner. Existingnamespace/default ownership tracing, sync/typeFrom and holderScopeAt behavior retained. Newpackage9chosen to keep CJS compatibility; upstream latestREADME refers to newerESMrequirebehavior. Source tokenizer was verified from officialrepo docs and installed package/types. No Node/packageversionbump.
+
+Fail-before graph regressions:8FAIL/37SKIP on559c76df, /tmp/codegraph-cjs-modular-before.log. New helper independently tests executable dot/bracket writes, template expressions/nesting, TSgenerics, JSXtext-vs-expressions, line/block comments, strings/templates/regex/control-regex, unrelated/Unicode/dollar roots, equality/typequeries, uncertain/prototype/computed APIs. Initial4files89PASS. Additional2positive runtime-API controls (literal eval export and require.cache default) exposed2FAIL before uncertainty handling; /tmp/codegraph-cjs-modular-uncertain-before.log. Added explicit uncertainty for literal eval code and Node module/cache APIs, preserving genuine dynamic exports while ordinary data remains opaque. All existing expected assertions retained.
+
+Latest modular focused gate18files260PASS1SKIP, /tmp/codegraph-cjs-modular-expanded-final.log; includes47default-member graph cases,38pure helper cases, priorJS/Python/sync/memo/lazy-engine controls. Source remains dirty relative559c76df in6files: newhelper/newunit test (intent-to-add makes visible in Gitdiff), existing integrationtest/matcher and package.json/package-lock. No new commit yet. No outwardactions. Full current modular suite/build still pending; parent10602PASS does not cover new modular code.
+
+User's conditional approval includes correcting any residual error with this smaller strategy and verifying it. Next fresh verification target is559c76df..working tree, sameledger and6paths; keep native round count honest (fifthverification), no target/state reset. Stop/ask if host gate denies; do not bypass. Review ONLY F6 closure and regressions of helper/adapter/dependency, plus bounded preservation checks. Source stable after260focusedPASS; no repeatedfull/build by reviewers. Prefer existingdist+scratch probes; underlyingthree corrections already independently cleared.
+
+
+## Fifth verification — modular source reader, 2026-11-09
+
+Fresh read-only lanes review_broad_commonjs_modular5 and review_adversarial_commonjs_modular5 both completed. Both cleared F6 phantom comments/strings/templates/regex and unrelated roots, plus preservation of real aliases, sync, scope and Python behavior. Production js-tokens9.0.1 packaging compatibility cleared. No source edits or redundant full-suite runs by reviewers.
+
+F7 — P2 — src/resolution/commonjs-export-members.ts:37 recognizes eval uncertainty only when a bare eval immediately receives a StringLiteral. Both reviewers reproduced template-literal eval dropping a real Store::load call. Adversarial additionally reproduced `(eval)('exports.load = Store.prototype.load;')`. Both runtime mutations return42; previous reader preserves Store::load, current reader emits no calls. Literal single-quoted bare eval control remains green. Evidence /tmp/codegraph-cjs-adversarial5-eval.{cjs,log}. Fix only the small helper: account for grouped bare eval callee and template literals, preserve class method named eval as non-call text. Add fail-before controls; do not alter name-matcher, sync or scope corrections for F7.
+
+Pre-F7 modular full normal suite EXIT0, 873 files PASS19SKIP, 10650 tests PASS2expectedFAIL448SKIP0unexpectedFAIL,780.27sec. /tmp/codegraph-cjs-modular-full.log. This run does not cover the upcoming F7 correction. Current source remains local and dirty relative559c76df. No push, source PR, merge, deployment or upstream report. Original T0 pilot remains stopped/uncommitted.
+
+
+F7 correction: literalEvalCall now unwraps paired bare-callee parentheses and grouped arguments, accepts StringLiteral/NoSubstitutionTemplate/TemplateHead. Does not execute eval or inspect data token contents; method declaration named eval remains ignored. Added4 pure-reader controls and2 graph positives. Before change:6FAIL85PASS (/tmp/codegraph-cjs-modular-eval-before.log); after:91PASS across2files (/tmp/codegraph-cjs-modular-eval-after.log). git diff --check PASS. No changes to the matcher adapter, sync or scope for F7. Full-suite PASS above predates this correction; normal final full suite and independent review of the F7 correction remain pending. Local changes uncommitted. Build result pending.
+
+Explicit final F7 npm run build EXIT0, /tmp/codegraph-cjs-modular-eval-build.log; viewer,29grammars,runtime and dist engine checks PASS. Final full suite and independent F7 verification still pending; do not conflate pre-F7 full pass with final-tree clearance. Checkpoint backup .review/commonjs-fix-2026-11-08/modular-eval-2026-11-09/ in original QA workspace contains6current sourcefiles, cumulative and modular patches, hashes, logs and this ledger. Source unchanged since91focusedPASS/build.
+
+
+## Sixth verification authorized and running — 2026-11-09
+
+User explicitly answered yes to final verification. Fresh read-only native lanes review_broad_commonjs_eval6 and review_adversarial_commonjs_eval6 launched against559c76df..workingtree six modular paths and same ledger. No gate reset/bypass or Claude-only skill claim. Both focus F7 closure and neighboring invariants; no full/build reruns by reviewers. Parent full normal CODEGRAPH_KERNEL=0 npm test -- --maxWorkers=4 runs session5033, /tmp/codegraph-cjs-eval6-full.log. Snapshot hashes /tmp/codegraph-cjs-eval6-frozen.json. No final results yet. Final explicit build before this full run passed; test setup refreshed engine assets itself. No source changes during review/tests, no outward actions. Personal origin/identity rechecked: inth3shadows/codegraph, Eric Minish / eric.minish@gmail.com. Current six modular files remain uncommitted.
+
+
+## Sixth verification result — 2026-11-09 — NOT READY TO MERGE
+
+Both fresh read-only lanes completed normally. Adversarial CLEARED F7: original3 runtime/graph forms plus11 additional runtime-backed graph controls preserve real exports and reject inert eval-looking data/method declarations. Evidence /tmp/codegraph-cjs-adversarial6-eval.{cjs,log}. Broad independently passed13 intended F7/nearby controls, but found F8 in the correction. No source edits/build/full reruns by reviewers. No final dual clearance.
+
+### F8 — P2 — literalEvalCall mistakes function-argument parentheses for grouped eval callees (broad)
+
+Reviewer location src/resolution/commonjs-export-members.ts:20, loop lines20-24. Exact input:
+
+```js
+exports.known = function known() {};
+function wrap(value) { return function ignore(code) {}; }
+wrap(eval)("ignored");
+```
+
+Runtime exports only known. Current reader returns uncertain:true, making named.missing() falsely resolve to decoy.js:Decoy::missing. Restoring only the pre-F7 literal-eval check in memory returns uncertain:false and no call. wrap((eval))(("ignored")) also reproduces. Evidence /tmp/cg-broad-verify6-callee-compare.log, adjacent .cjs; initial probe /tmp/cg-broad-verify6-callee-context.{cjs,log}. Broad passed all13 intended controls including grouped direct eval, templates, method named eval, real template-expression exports and callable aliases. Adversarial's bounded probes did not include this counterexample; its clearance does not override the demonstrated defect.
+
+Parent full suite intentionally stopped with SIGINT after confirmed F8; exact cwd/argv guarded signal to only isolated checkout main Vitest, tool session5033 EXIT130. /tmp/codegraph-cjs-eval6-full.log is PARTIAL, NOT a full pass/failure result. Avoid wasting a known-defective verification cycle. Prior91focusedPASS and explicit buildPASS remain true for this source, prior10650fullPASS predates F7 and cannot clear current tree. SHA256 snapshot recheck confirms all6 reviewed source paths unchanged during verification. No new source commit, push, fixPR, merge, deployment, version/tag/npm or upstream report.
+
+Stop this correction cycle and report F8. User yes authorized final verification, not another correction/review cycle or publishing. Need user decision before next step, as previously requested. Durable evidence in original QA .review/commonjs-fix-2026-11-08/final-verification-2026-11-09/. Previous modular-eval source/patch backup still matches frozen source. Keep original T0 stopped/uncommitted. Do not reset review count/gate or rewrite control files.
+
+
+## Seventh native dual review result — PR29 — 2026-11-09
+
+Both fresh read-only lanes completed normally: review_broad_pr29_round7 and review_adversarial_pr29_round7. Exact target remains5d384989957c91b482068b306535437915a0595b..87576a8d9ff0d8aba235db5535f5f4429f14b037. Source hashes verified unchanged, trackedtreeclean except private untracked.review. No source edits/build/fullsuite reruns/commits/pushes/GitHubcomments/merge/deploy. Both PRs remain draft. Current review DOES NOT CLEAR PR29 despite prior101focusedPASS/full10666PASS/buildPASS. Parent merges findings from actual final reports without re-verifying/re-reading diff.
+
+### F9 — P2 — Preserve grouped direct eval in control-statement bodies (BOTH)
+
+Broad location src/resolution/commonjs-export-members.ts:31: rejects any preceding ), including a completed if or for condition. Exact input `class Store { load() { return 42; } }
+if (true) (eval)('exports.load = Store.prototype.load;');`. Runtime exports load() returning42, but current discovery uncertain:false and indexing named.load() produces no call. Removing only new prefix guard in memory restores uncertain:true and m.js:Store::load. Nested grouped eval in unbraced single-iteration for body reproduces too. Broad evidence /tmp/cg-broad-pr29-control-context.{cjs,log}; exact command `node --experimental-wasm-exnref --experimental-wasm-stack-switching /tmp/cg-broad-pr29-control-context.cjs`.
+
+Adversarial independently confirms same location/trace; grouped-template if-body and for-body also reproduce. Evidence /tmp/codegraph-cjs-adversarial7-conditional-eval.{cjs,log}. De-duplicated as one P2 F9. This is a NEW regression introduced in PR29, not a pre-existing parent limitation.
+
+### F8 — P2 — PARTIALLY CORRECTED, remains for contextual-keyword wrapper names (adversarial)
+
+Exact reviewer location src/resolution/commonjs-export-members.ts:29 (whitelist:7). Valid CommonJS `function await(value){return function ignore(code){};} await(eval)("ignored");` passes eval without invoking it, but whitelist exemption produces uncertain:true and falsely resolves named.missing() to decoy.js:Decoy::missing. With exports.known=function known(){}, runtime exports only known; pre-F7 behavior restored in memory produces no call. yield reproduces too. Evidence /tmp/codegraph-cjs-adversarial7-contextual-wrapper.{cjs,log}. This is a RESIDUAL F8 variant, not a new unrelated parent re-audit. Do not label all F8 closed.
+
+### Confirmed preservation / rulings
+
+Both independently clear original F8 forms wrap(eval)("ignored") and wrap((eval))(("ignored")): runtime onlyknown, reader uncertain:false, no decoy call. Broad /tmp/cg-broad-pr29-f8-closure.{cjs,log}. Adversarial13runtime-backed graph controls pass (original2forms +11nearby controls), /tmp/codegraph-cjs-adversarial7-controls.log. True standalone grouped/template eval, return expressions, inert data/method declarations, call/member/optional/tag/condition-prefix negatives retain tested behavior. These controls do not answer F9 control-body context or F8 await/yield wrappers.
+
+### Next boundary
+
+Review-only user request is complete. STOP: no fixes, additional review loop, external review comment, markready, merge or deploy without user instruction. The per-step confirmation request remains in force. This is round7 overall; no gate/state reset. Repeated grouping-prefix patches now demonstrate syntax-context ambiguity: if user asks for remediation, choose an evidence-based smaller boundary/design instead of another unbounded keyword/punctuation whitelist. Preserve both concrete repros and all prior controls. Do not repeat fullsuite/build on unchanged source. Actual durable result/evidence/checksums saved in original QA .review/commonjs-fix-2026-11-08/pr29-review-round7-2026-11-09/.
+
+
+## AST redesign approved and started — 2026-11-09
+
+User explicitly approved AST redesign in PR29, said near usage max and asked for a resumable start, then said proceed. This revokes prior review-only stop for in-scope remediation; do not ask same approval on resume. Preserve per-step/user and actual gate boundaries for later merges/deployments. No grammar/runtime/dependency/database-schema changes, commits or pushes in this partial phase; PRs remain draft at prior heads.
+
+Newgraph regressions FIRST:3control-body direct-eval variants(if string/template, for nestedgroups) +await/yield CommonJS wrappers,5FAIL51SKIP on current87576a8d. /tmp/codegraph-cjs-ast-red.log, EXIT1. This intentionally RED gate remains unchanged because integration pending.
+
+New isolated src/extraction/commonjs-eval.ts reads existing SyntaxNode tree and checks actual call.function after unwrapping parenthesized_expression. Returns true for syntacticdirectevalcall(anyargument), false for provenabsence, null for parseerrors with no foundcall. New __tests__/commonjs-eval.test.ts loads existingJS/TS/TSXgrammars:33PASS, /tmp/codegraph-cjs-ast-helper.log EXIT0. Controls cover reports, grouped/interpolated eval, return, generatorfunctions/methods, nestednongenerator scope, eval inside yieldwrapper argument, inert data/methods/membercalls, JSX and malformedsource. Helper not wired to classifier/extraction yet. Existing lexical reader/EXPRESSION_PREFIX_WORDS unchanged for now. Do not claim F8/F9 closed, new full/buildpass or finalreview.
+
+IMPORTANT new evidence: existingJSgrammar correctly models control-body eval and awaitwrapper but parses legal CommonJS yield(eval)(code) as yield_expression whose operand is a call on(eval), no parseerrors. ASTscope must distinguish nongeneratorwrapper from generator yield. Helper handles direct yieldoperand only via nearestfunction/generator/methodscope; nested true eval in yield(eval(code)) remains detected. Shapeprobe /tmp/codegraph-cjs-ast-shape-probe.{cjs,log}. Extractionreferenceprobe /tmp/codegraph-cjs-eval-reference-probe.{cjs,log} shows currentextractor emits callref eval for genuinecall AND synthetic yieldwrappercase. Consequently raw existing unresolved eval refs alone are insufficient. User was explicitly told this grammar limitation, not falsely assured all cases are parser-perfect. No grammarfiles changed.
+
+Next integrate factualcallresult through existingextraction to resolver. Node has NO metadata field (onlyedges do); do not invent Node.metadata, abuse signature/selfedges/candidates, or introduce schema migration casually. ExtractionResult can carry optionalfact through workerclone; need native/deferred bypass parity. Main bulk parse pools only load grammars in workers; resolver cannot assume synchronous getParser is ready in main. Suggested project_metadata perfile/sourcehash transport or another small explicit extractioncontext capability; persist/refresh under same successfulstore lifecycle, cover storeworker and sync. Decide carefully before editing infrastructure. Resume must preserve all existing tests and5newred cases; unknown/missing/error facts must not masquerade as provenabsence. Keep existing export-member tokenizer and previous sync/scope/alias fixes intact; remove prefixheuristics only onceASTfacts actuallysupplied.
+
+Saved current3sourcefiles, patchrelative87576a8d, hashes, red/green/probe logs under original QA .review/commonjs-fix-2026-11-08/ast-redesign-started-2026-11-09/. No tests/build/reviewers running at checkpoint. Newfiles intent-to-add only so diffincludes them, not readyforcommit. No fresh dualreviewagents this phase. Overall reviewcount7; do not reset gate/controlstate. Resume directly integration and targeted tests; fullsuite/build only after stablefix, fresh focuseddual review as authorized/actualgatepermits, no repetitivewholeprojectwork. OriginalT0stillstopped/uncommitted; liveem40 unchanged; no merges/deploy/upstream writes.
+
+
+## Eighth native review COMPLETED — AST correction NOT CLEARED
+
+Both fresh read-only reviewers completed normally on frozen15-file87576a8d..workingtree correction. Both confirm no source edits/build/full reruns/control changes; source hashes unchanged. No final normalbuild/fullsuite run or commit/push. PublishedPR28/29 remain drafts at5d384989/87576a8d. Prior166focusedPASS1SKIP is true and covers original5reportedgraphcases, but does not clear new findings. Nativebinary absent, no nativeexecutionclaim. Parent uses actual reports, no independent duplicate repro/diffread.
+
+### F10 — P2 — Optional contextual-keyword wrappers regress (adversarial)
+
+Exact reviewer location src/extraction/commonjs-eval.ts:37. Valid CommonJS:
+
+```js
+exports.known = function known() {};
+function yield(value) {
+  return function ignore(code) {};
+}
+yield?.(eval)("ignored");
+```
+
+Runtime exports only known; eval is never invoked. Existing grammar reports parse error, helper returns null, reader marks exports uncertain, and named.missing() falsely calls unrelated decoy.js:Decoy::missing. Actual current correction calls:[decoy.js:Decoy::missing]; base87576a8dreader restored in memory calls:[], uncertain:false. Evidence /tmp/cg-a8-yield-optional.{cjs,log}, /tmp/cg-a8-yield-optional-base.{cjs,log}, /tmp/cg-a8-probe.cjs. New F8-adjacent regression introduced by AST correction. Unknown fact correctly avoids false absence proof but must not license false call targets; current fallback still does.
+
+### F11 — P2 — Computed method names use enclosing scope (broad)
+
+Exact reviewer location src/extraction/commonjs-eval.ts:51. Treats a computed method name as belonging to that method's function scope. Computed names execute in enclosing scope. Confirmed both directions:
+
+1. `class Store { load(){return 42;} } function* setup(){ const obj = { [yield (eval)('exports.load = Store.prototype.load;')]() {} }; } setup().next();` Runtime exports load()->42, currentfactfalse/uncertainfalse, named.load() graphcalls[]. Ordinary computedmethodkey inside outergenerator suppressesgenuineeval.
+2. `exports.known=function known(){}; function yield(value){return function ignore(code){return 'x';}} const obj={ *[yield(eval)("ignored")](){} };` Runtime keysonlyknown, currentfacttrue/uncertaintrue, named.missing() falselycallsDecoy::missing. Generator methodkeyevaluatesoutsidegeneratorbody, so yieldiswrapperhere.
+
+One rootcause/twoexecutiontraces, evidence /tmp/cg-broad-pr29-ast8-computed-scope.{cjs,log}, executed againstcurrentdist with CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2. All15frozenhashesmatch.
+
+### Stop boundary and saved state
+
+Approved redesign progressed to166focusedPASS + real-worker/store/sync/factlifecycle integration, then focusedverifyfoundthese2P2. STOP before anothercorrectioncycle per dual-reviewworkflow/userper-stepconfirmation. Don't spendfullsuiteonknowndefectivecode orpushasready. Usermustdecidenextstep; noautomaticnewreview/fix/merge/deploy. Overallcount8, noreset. Nextremediationifapproved: computedmethodscope must excludecomputedkeys fromnewmethodscope; parseerrorunknown mustnotenableinventedfallbackcalls (requires explicitresolutionpolicy, not anotherkeyword/punctuationguess). Preserve all originalregressions and33ASTcontrols, truealiases/sync/scope/Pythonbehavior. No grammarfiles/schema/deps changed; source remains15dirtypaths, notcommitted. Durablebackup includes allsources/patch/logs andnewreviewevidence, verificationresult/checksums.
+
+
+## F10/F11 corrections approved and execution-verified — independent verification pending
+
+User explicitly answered yes to correcting the two eighth-review findings. Current HEAD87576a8d and15dirtysourcepaths retained; no newcommit/push/merge/deploy/grammar/schema/dependencychanges.
+
+Fail-beforetests:2ASTcomputed-key cases,3graphfindingcases,positivealiascontrol andunknownparse syncstep. Actual2files6FAIL90PASS beforefix, /tmp/codegraph-cjs-ast-f10-f11-before.log EXIT1. Positive explicitcallablealias underunknownparsealreadyPASS beforefix, mustkeep.
+
+F11fix: method_definition suppliesfunctionscope onlywhen calllieswithin ASTbodyorparametersregions. Computednames/decorators useenclosingscope; no newkeyword/punctuation guesses. Bothcomputedkey directionsfixed. F10fix: tokenizer resultrecords evalUnknown separatelyfromuncertain/namespace. Moduleinfo propagatesunknownflag, includingexistingforwarderspread. Themethod-nameguessgate stopsunprovenmatchesforunknown-evalexportswithoutclaimingnamespace/memberabsence; explicitwrittenmemberaliasesremainallowed, andearlierprovenreceiver/typepathsremainunchanged. UnknownASTfactstillnull, no falseparse-success/intrinsicproof. Existingmembertokenizer andfacts/hash/storelifecycleremainunchanged.
+
+Expanded8files172PASS1SKIP EXIT0, /tmp/codegraph-cjs-ast-f10-f11-after.log, CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2. Coversallprevious166checks plusnewcomputed-keyAST/graphcases,optionalcontextualwrapper,realexplicitcallablealiasunderunknownparse,andfreshindex-v-syncincludingknownactualeval->unknownwrapper->actualeval transitions. One skip is nativekerneltransport; nativebinarynotstaged,no nativeexecutionclaim. A matchercommentclarifyingunproven-callpolicyupdatedaftertest; no behaviorchangedafterthispassingrun. gitdiff--checkPASS. No explicitnormalbuild/fullsuite oncurrentcorrection; old10666fullPASSbelongs875only.
+
+Currentcorrectionvsround8snapshot changes5files: ASThelper,exportreader,matcher,ASTtest,graphintegrationtest. Durablebackup originalQA .review/commonjs-fix-2026-11-08/ast-f10-f11-corrected-2026-11-09/ includesall15sourcefiles,currentSHA256,cumulativepatchrelative875,small5filedeltafromround8,fail-before/passafterlogs,verificationmetadata. F10/F11 statusCORRECTED+focusedPASS, NOTindependentlycleared. Overallreviewcount8unchanged,noround9agentslaunched. Userper-stepconfirmationrequiresdecisionbeforefreshfocusedverify; don'tspendnewfull/reviewcycleunasked. No sourcecommit/pushyet; PR28/29remainDRAFT/unmerged. Ifuserapprovesnextreview: exactGitdiff875..workingtree +round8delta/sameledger, freshread-onlynativebroad/adversarial, boundedprobesonly,norepeatfull/build. Respectactualgate/noreset. Runfinalnormalbuild/fullonceonlyafterreviewstable. PreserveT0stopped/uncommitted; liveem40unchanged; noofficialupstreamwrite.
diff --git a/docs/handoffs/pr29-2026-11-10/history/ast-integrated-review8-2026-11-09/commonjs-eval-callee-context.md b/docs/handoffs/pr29-2026-11-10/history/ast-integrated-review8-2026-11-09/commonjs-eval-callee-context.md
new file mode 100644
index 0000000000..f61797e302
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/ast-integrated-review8-2026-11-09/commonjs-eval-callee-context.md
@@ -0,0 +1,105 @@
+# Separate F8 follow-up (review round count remains six)
+
+User explicitly authorized committing/pushing current work to a PR and separating remaining correction. Current snapshot committed5d384989957c91b482068b306535437915a0595b, pushed fix/commonjs-missing-member, DRAFT https://github.com/inth3shadows/codegraph/pull/28 against main. KnownF8 documented, not ready to merge alone. No deploy/merge/upstream report.
+
+New branch fix/commonjs-eval-callee-context based on5d384989. Exact prospective Git target: git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5d384989957c91b482068b306535437915a0595b -- src/resolution/commonjs-export-members.ts __tests__/commonjs-export-members.test.ts __tests__/js-default-binding-members.test.ts
+
+F8 reviewer finding and prior invariants remain in .review/commonjs-missing-member.md; do not reset shared gate/round count. Two sixth reviewers completed; broad demonstrated F8 despite adversarial clearing intended F7 cases. This follow-up has NOT had independent dual review yet.
+
+Correction: distinguish grouping around bare eval from another function's argument list using token before parentheses. Wrapper identifier/call/member/optional-call/tag/control-condition prefixes must not mark exports uncertain. Grouped direct eval, literal/template arguments and expression prefixes such as return must keep prior behavior. Change limited to9helper lines plus independent unit and real-index graph regressions; no matcher/sync/scope changes.
+
+Before fix8FAIL92PASS; tag-result additional case1FAIL49PASS. Final focused2files101PASS, /tmp/codegraph-cjs-eval-followup-focused.log. Build/full pending. Hashes /tmp/codegraph-cjs-followup-frozen.json. Logs /tmp/codegraph-cjs-eval-followup-{before,tag-before,focused,build}.log. Need staged exact3-file diff, personal repo/identity and actual build result before commit/push. Full normal suite required before readiness claim. Keep follow-up draft and explicitly state review pending. No additional reviewer agents launched in this follow-up; user plans to point agents at PRs.
+
+Keep both PRs draft. Follow-up base should be fix/commonjs-missing-member, producing only the small correction diff. Review/merge follow-up into parent branch before considering parent PR for main; no merge authorized by current request. Preserve original T0 pilot and all deploy/control worktrees.
+
+Published DRAFT https://github.com/inth3shadows/codegraph/pull/29, commit87576a8d9ff0d8aba235db5535f5f4429f14b037, base fix/commonjs-missing-member/PR28 at5d384989. Explicit buildPASS; normal full suite RUNNING session62594, /tmp/codegraph-cjs-eval-followup-full.log. Both pushed/draft, neither merged/deployed; follow-up independent review stillpending. Original T0 untouched.
+
+
+FINAL execution verification2026-11-09: normal full suite session62594 EXIT0,873filesPASS19SKIP,10666testsPASS2expectedFAIL448SKIP0unexpectedFAIL,800.20sec. /tmp/codegraph-cjs-eval-followup-full.log. 101focusedPASS and explicit buildPASS on same87576a8dsource. Final3changed-file SHA256 checks PASS, trackedtreeclean; actual remoteheads rechecked5d384989(PR28) and87576a8d(PR29). PR29 body updated with exact final validation. Both PRs still DRAFT/unmerged; no deployment/upstream write. FOLLOW-UP INDEPENDENT REVIEW STILL PENDING: do not conflate fullsuite with review clearance. No further tests/build/review processes running. Saved final checkpoint and full log under original QA two-draft-prs backup.
+
+
+## Seventh native review explicitly requested — PR29 — 2026-11-09
+
+User invoked /dual review29. Exact GitHub base5d384989957c91b482068b306535437915a0595b and head87576a8d9ff0d8aba235db5535f5f4429f14b037 verified. Fresh read-only native lanes review_broad_pr29_round7 and review_adversarial_pr29_round7 launched together with same exact Git target and this ledger. Both focus full3-file29-line correction, F8 closure and nearby invariants; bounded execution probes only, no repeat full/build or source edits. Parent does not reread reviewed diff or duplicate reviewer probes. No review results yet; no independent clearance claim. Do not reset round count/gate, change source, push, merge or deploy in this review-only turn. Stop and report merged findings when both complete.
+
+
+## Seventh native dual review result — PR29 — 2026-11-09
+
+Both fresh read-only lanes completed normally: review_broad_pr29_round7 and review_adversarial_pr29_round7. Exact target remains5d384989957c91b482068b306535437915a0595b..87576a8d9ff0d8aba235db5535f5f4429f14b037. Source hashes verified unchanged, trackedtreeclean except private untracked.review. No source edits/build/fullsuite reruns/commits/pushes/GitHubcomments/merge/deploy. Both PRs remain draft. Current review DOES NOT CLEAR PR29 despite prior101focusedPASS/full10666PASS/buildPASS. Parent merges findings from actual final reports without re-verifying/re-reading diff.
+
+### F9 — P2 — Preserve grouped direct eval in control-statement bodies (BOTH)
+
+Broad location src/resolution/commonjs-export-members.ts:31: rejects any preceding ), including a completed if or for condition. Exact input `class Store { load() { return 42; } }
+if (true) (eval)('exports.load = Store.prototype.load;');`. Runtime exports load() returning42, but current discovery uncertain:false and indexing named.load() produces no call. Removing only new prefix guard in memory restores uncertain:true and m.js:Store::load. Nested grouped eval in unbraced single-iteration for body reproduces too. Broad evidence /tmp/cg-broad-pr29-control-context.{cjs,log}; exact command `node --experimental-wasm-exnref --experimental-wasm-stack-switching /tmp/cg-broad-pr29-control-context.cjs`.
+
+Adversarial independently confirms same location/trace; grouped-template if-body and for-body also reproduce. Evidence /tmp/codegraph-cjs-adversarial7-conditional-eval.{cjs,log}. De-duplicated as one P2 F9. This is a NEW regression introduced in PR29, not a pre-existing parent limitation.
+
+### F8 — P2 — PARTIALLY CORRECTED, remains for contextual-keyword wrapper names (adversarial)
+
+Exact reviewer location src/resolution/commonjs-export-members.ts:29 (whitelist:7). Valid CommonJS `function await(value){return function ignore(code){};} await(eval)("ignored");` passes eval without invoking it, but whitelist exemption produces uncertain:true and falsely resolves named.missing() to decoy.js:Decoy::missing. With exports.known=function known(){}, runtime exports only known; pre-F7 behavior restored in memory produces no call. yield reproduces too. Evidence /tmp/codegraph-cjs-adversarial7-contextual-wrapper.{cjs,log}. This is a RESIDUAL F8 variant, not a new unrelated parent re-audit. Do not label all F8 closed.
+
+### Confirmed preservation / rulings
+
+Both independently clear original F8 forms wrap(eval)("ignored") and wrap((eval))(("ignored")): runtime onlyknown, reader uncertain:false, no decoy call. Broad /tmp/cg-broad-pr29-f8-closure.{cjs,log}. Adversarial13runtime-backed graph controls pass (original2forms +11nearby controls), /tmp/codegraph-cjs-adversarial7-controls.log. True standalone grouped/template eval, return expressions, inert data/method declarations, call/member/optional/tag/condition-prefix negatives retain tested behavior. These controls do not answer F9 control-body context or F8 await/yield wrappers.
+
+### Next boundary
+
+Review-only user request is complete. STOP: no fixes, additional review loop, external review comment, markready, merge or deploy without user instruction. The per-step confirmation request remains in force. This is round7 overall; no gate/state reset. Repeated grouping-prefix patches now demonstrate syntax-context ambiguity: if user asks for remediation, choose an evidence-based smaller boundary/design instead of another unbounded keyword/punctuation whitelist. Preserve both concrete repros and all prior controls. Do not repeat fullsuite/build on unchanged source. Actual durable result/evidence/checksums saved in original QA .review/commonjs-fix-2026-11-08/pr29-review-round7-2026-11-09/.
+
+
+## AST redesign approved and started — 2026-11-09
+
+User explicitly approved AST redesign in PR29, said near usage max and asked for a resumable start, then said proceed. This revokes prior review-only stop for in-scope remediation; do not ask same approval on resume. Preserve per-step/user and actual gate boundaries for later merges/deployments. No grammar/runtime/dependency/database-schema changes, commits or pushes in this partial phase; PRs remain draft at prior heads.
+
+Newgraph regressions FIRST:3control-body direct-eval variants(if string/template, for nestedgroups) +await/yield CommonJS wrappers,5FAIL51SKIP on current87576a8d. /tmp/codegraph-cjs-ast-red.log, EXIT1. This intentionally RED gate remains unchanged because integration pending.
+
+New isolated src/extraction/commonjs-eval.ts reads existing SyntaxNode tree and checks actual call.function after unwrapping parenthesized_expression. Returns true for syntacticdirectevalcall(anyargument), false for provenabsence, null for parseerrors with no foundcall. New __tests__/commonjs-eval.test.ts loads existingJS/TS/TSXgrammars:33PASS, /tmp/codegraph-cjs-ast-helper.log EXIT0. Controls cover reports, grouped/interpolated eval, return, generatorfunctions/methods, nestednongenerator scope, eval inside yieldwrapper argument, inert data/methods/membercalls, JSX and malformedsource. Helper not wired to classifier/extraction yet. Existing lexical reader/EXPRESSION_PREFIX_WORDS unchanged for now. Do not claim F8/F9 closed, new full/buildpass or finalreview.
+
+IMPORTANT new evidence: existingJSgrammar correctly models control-body eval and awaitwrapper but parses legal CommonJS yield(eval)(code) as yield_expression whose operand is a call on(eval), no parseerrors. ASTscope must distinguish nongeneratorwrapper from generator yield. Helper handles direct yieldoperand only via nearestfunction/generator/methodscope; nested true eval in yield(eval(code)) remains detected. Shapeprobe /tmp/codegraph-cjs-ast-shape-probe.{cjs,log}. Extractionreferenceprobe /tmp/codegraph-cjs-eval-reference-probe.{cjs,log} shows currentextractor emits callref eval for genuinecall AND synthetic yieldwrappercase. Consequently raw existing unresolved eval refs alone are insufficient. User was explicitly told this grammar limitation, not falsely assured all cases are parser-perfect. No grammarfiles changed.
+
+Next integrate factualcallresult through existingextraction to resolver. Node has NO metadata field (onlyedges do); do not invent Node.metadata, abuse signature/selfedges/candidates, or introduce schema migration casually. ExtractionResult can carry optionalfact through workerclone; need native/deferred bypass parity. Main bulk parse pools only load grammars in workers; resolver cannot assume synchronous getParser is ready in main. Suggested project_metadata perfile/sourcehash transport or another small explicit extractioncontext capability; persist/refresh under same successfulstore lifecycle, cover storeworker and sync. Decide carefully before editing infrastructure. Resume must preserve all existing tests and5newred cases; unknown/missing/error facts must not masquerade as provenabsence. Keep existing export-member tokenizer and previous sync/scope/alias fixes intact; remove prefixheuristics only onceASTfacts actuallysupplied.
+
+Saved current3sourcefiles, patchrelative87576a8d, hashes, red/green/probe logs under original QA .review/commonjs-fix-2026-11-08/ast-redesign-started-2026-11-09/. No tests/build/reviewers running at checkpoint. Newfiles intent-to-add only so diffincludes them, not readyforcommit. No fresh dualreviewagents this phase. Overall reviewcount7; do not reset gate/controlstate. Resume directly integration and targeted tests; fullsuite/build only after stablefix, fresh focuseddual review as authorized/actualgatepermits, no repetitivewholeprojectwork. OriginalT0stillstopped/uncommitted; liveem40 unchanged; no merges/deploy/upstream writes.
+
+
+## AST integration execution-tested — verify round8 pending
+
+User approved AST redesign with focused review before final fullsuite, then resumed. Current dirty correction target87576a8d..workingtree,15paths captured /tmp/codegraph-cjs-ast-frozen.json (allnewfilesintent-to-add). No sourcecommit/pushyet; publishedPR29still87576a8d. No grammar/runtime/dependency/schema changes.
+
+Implemented AST fact in ExtractionResult and ephemeralFileRecord property; WASM computes from existingtree, native/deferred routes compute with existinggrammar; kernelmaterializer preservesfact. Allstorepaths carryFileRecord fact through existingwriter, upsertFile writes project_metadata commonjs_eval:<file> containingcontentHash/value. Nosecondwriter orNode.metadata. deleteFile removesfact. Coordinatorcontext acceptsboolean onlyonexact SHA256sourcehash. Missing/malformed/stale/nullfacts returnunknown, neverabsenceproof. Tokenreader removed literalEvalCall/EXPRESSION_PREFIX_WORDS, consults lazyASTfact atmostonceonlywhenbareevaltokenpresent; unknown staysconservative. Existingmembertokenizer/sync/typeFrom/scope unchanged. CHANGELOG alreadyrequiresre-indexafterupgrading(line56), which suppliesnewfacts; no legacyfactmigrationclaimed.
+
+Original5newgraphregressionsRED5FAIL51SKIP beforeintegration. Initialintegratedrun blocked by compiler: hashContentisexportedfromextraction/index, notutils; corrected byusingexistingcreateHashcrypto inresolver (sameSHA256algorithm), no circularextractionimport. Then3files140PASS. AddedrealSQLite factlifecycle4cases(missing/malformed/null, hashstale/replace,rollbackwithfiletransaction, deletion) andfreshindex-vs-sync wrapper->if-eval->yield-wrapper->for-eval->wrapper sequence. Final8files166PASS1SKIP, /tmp/codegraph-cjs-ast-expanded.log, CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2; alsoincludesmemo/synccaches/lazy-engine. Nativebinarynotstaged(codegraph-kernel/prebuilds/linux-x64/codegraph-kernel.node absent); kerneltransporttestskipped. Do not claimnativeexecution. Enginecompiledbytestsetup,currentdistmatchesfrozen sources. No explicitfinalnormalbuild/fullsuiteorindependentreviewyet. Priorfull10666PASSbelongs87576a8donly.
+
+Next eighthfreshnativeREADONLYlanes verify this correction, sameledger andexactGitdiff87576a8d..workingtree. Boundedruntimeprobes only, no fullsuite/build orsourcechanges. CheckF8/F9closure,generator-awareyieldworkaround, actualevalvswrappercallee, sourcehashfactlifecycle/workertransport/sync, previouscontrols. Do not re-audit unrelatedparentlimitations. Stop/reportifreviewfindsissues; do notresetgate/count orclaimClaude-onlyskill.
+
+
+## Eighth native review COMPLETED — AST correction NOT CLEARED
+
+Both fresh read-only reviewers completed normally on frozen15-file87576a8d..workingtree correction. Both confirm no source edits/build/full reruns/control changes; source hashes unchanged. No final normalbuild/fullsuite run or commit/push. PublishedPR28/29 remain drafts at5d384989/87576a8d. Prior166focusedPASS1SKIP is true and covers original5reportedgraphcases, but does not clear new findings. Nativebinary absent, no nativeexecutionclaim. Parent uses actual reports, no independent duplicate repro/diffread.
+
+### F10 — P2 — Optional contextual-keyword wrappers regress (adversarial)
+
+Exact reviewer location src/extraction/commonjs-eval.ts:37. Valid CommonJS:
+
+```js
+exports.known = function known() {};
+function yield(value) {
+  return function ignore(code) {};
+}
+yield?.(eval)("ignored");
+```
+
+Runtime exports only known; eval is never invoked. Existing grammar reports parse error, helper returns null, reader marks exports uncertain, and named.missing() falsely calls unrelated decoy.js:Decoy::missing. Actual current correction calls:[decoy.js:Decoy::missing]; base87576a8dreader restored in memory calls:[], uncertain:false. Evidence /tmp/cg-a8-yield-optional.{cjs,log}, /tmp/cg-a8-yield-optional-base.{cjs,log}, /tmp/cg-a8-probe.cjs. New F8-adjacent regression introduced by AST correction. Unknown fact correctly avoids false absence proof but must not license false call targets; current fallback still does.
+
+### F11 — P2 — Computed method names use enclosing scope (broad)
+
+Exact reviewer location src/extraction/commonjs-eval.ts:51. Treats a computed method name as belonging to that method's function scope. Computed names execute in enclosing scope. Confirmed both directions:
+
+1. `class Store { load(){return 42;} } function* setup(){ const obj = { [yield (eval)('exports.load = Store.prototype.load;')]() {} }; } setup().next();` Runtime exports load()->42, currentfactfalse/uncertainfalse, named.load() graphcalls[]. Ordinary computedmethodkey inside outergenerator suppressesgenuineeval.
+2. `exports.known=function known(){}; function yield(value){return function ignore(code){return 'x';}} const obj={ *[yield(eval)("ignored")](){} };` Runtime keysonlyknown, currentfacttrue/uncertaintrue, named.missing() falselycallsDecoy::missing. Generator methodkeyevaluatesoutsidegeneratorbody, so yieldiswrapperhere.
+
+One rootcause/twoexecutiontraces, evidence /tmp/cg-broad-pr29-ast8-computed-scope.{cjs,log}, executed againstcurrentdist with CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2. All15frozenhashesmatch.
+
+### Stop boundary and saved state
+
+Approved redesign progressed to166focusedPASS + real-worker/store/sync/factlifecycle integration, then focusedverifyfoundthese2P2. STOP before anothercorrectioncycle per dual-reviewworkflow/userper-stepconfirmation. Don't spendfullsuiteonknowndefectivecode orpushasready. Usermustdecidenextstep; noautomaticnewreview/fix/merge/deploy. Overallcount8, noreset. Nextremediationifapproved: computedmethodscope must excludecomputedkeys fromnewmethodscope; parseerrorunknown mustnotenableinventedfallbackcalls (requires explicitresolutionpolicy, not anotherkeyword/punctuationguess). Preserve all originalregressions and33ASTcontrols, truealiases/sync/scope/Pythonbehavior. No grammarfiles/schema/deps changed; source remains15dirtypaths, notcommitted. Durablebackup includes allsources/patch/logs andnewreviewevidence, verificationresult/checksums.
diff --git a/docs/handoffs/pr29-2026-11-10/history/ast-integrated-review8-2026-11-09/commonjs-missing-member.md b/docs/handoffs/pr29-2026-11-10/history/ast-integrated-review8-2026-11-09/commonjs-missing-member.md
new file mode 100644
index 0000000000..385c84f000
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/ast-integrated-review8-2026-11-09/commonjs-missing-member.md
@@ -0,0 +1,247 @@
+# CommonJS missing-member review ledger
+
+Target: /tmp/codegraph-cjs-missing-fix-20261108, branch fix/commonjs-missing-member. Base 5e0664891af0e87e6fd18bbfa16cab39237570f5 to current tracked working tree, unchanged while both reviewers run. Exact diff: `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5e0664891af0e87e6fd18bbfa16cab39237570f5 -- CHANGELOG.md src/resolution/name-matcher.ts __tests__/js-default-binding-members.test.ts`.
+
+Round1 pending two fresh read-only native lanes. No Claude-only /code-review invocation. No resolver fix existed previously; user explicitly authorized implementation and dual review. Fork issue27 is the bug, QA PR27 is evidence only. No official upstream submission before Tuesday verification.
+
+## Findings / fix map
+
+- F1: confirmed upstream defect. `const named=require('./m'); named.missing()` with m.js exporting only known falsely calls unimported Decoy::missing; ref keeps receiver, resolvedBy instance-method/provenance null. Default imports and class-name-alias collision variants also reproduced. Sync adding decoy also fabricates call. Proposed tracked working-tree fix adds default bindings to imported-receiver guard and moves guard before unrelated class-name matching, after actual import/typed/object resolution. Requires reviewer execution and clearance.
+- P0 test baseline: new20-case file on unmodified resolver:15 PASS /5 FAIL. The5 failures are3 parameterized default/require+decoy cases,1 forwarding-module missing member,1 sync-add-decoy. Log /tmp/codegraph-cjs-fix-baseline2.log. No production code edit before this run. Initial baseline command failed because Vitest4 removed --minWorkers; corrected to --maxWorkers=4. Initial two new-test authoring corrections: object variable API used instead of unsupported direct object-literal shorthand shape; expected local object's qualified name corrected to actual fully-qualified extraction name. Neither changes an existing baseline test.
+
+## Rulings / limits
+
+- Direct `module.exports = { read() {} }` without an assigned variable already lacks correct member recovery on base and can be captured by a method decoy. This change must stop wrong calls; new object API positive uses baseline-supported `const api={read(){}}; module.exports=api`. Do not broaden into object-export extraction or claim direct shorthand recovery is implemented.
+- Bare external-package import exact-match issue26 remains separate and unfixed.
+- No import mapping semantics changes, no blanket conversion of require to namespace imports, no source code changes outside one name-matcher guard and changelog/tests.
+- This is a remaining variant of closed upstream2952/merged3162. No global novelty claim. Reproduced on em40/pristine main/pristine release. Native kernel unverified; local deployment is kernel0/WASM.
+
+## Invariants / commands
+
+- Actual exported member resolves beside an unrelated same-name method; missing member has no call. Forwarded CommonJS module preserves real export.
+- Stated CommonJS class static method, assigned object member, instance method, callable direct/default + attached function all remain correct beside decoys.
+- Existing ES default class, instance, typed variable, ambient export=, ordinary ESM namespace, named/anonymous/renamed functions retain calls.
+- Typed local parameters and object literal bindings shadowing default imports retain their local member calls.
+- Sync adds/removes a real export correctly; sync adding/removing a same-name unrelated method never fabricates missing-member calls.
+- Check these with `cd /tmp/codegraph-cjs-missing-fix-20261108 && CODEGRAPH_KERNEL=0 npx vitest run __tests__/js-default-binding-members.test.ts --maxWorkers=1`.
+- Expanded focused suite currently running: js-default-binding-members, commonjs-require-calls, commonjs-require-imports, commonjs-exports, require-default, import-default-as, namespace-object-resolution, import-object-member-namesake, sync-default-export-change, sync-import-member-retry, out-of-repo-import-shadow. Log /tmp/codegraph-cjs-fix-focused.log. Full normal suite/build pending.
+- Additional adversarial probes: class name matching alias, nested receiver paths, defaults with inherited/static/object APIs, lexical shadows and live sync. Each defect needs concrete input/actual wrong output; no style requests or hypothetical findings.
+
+## Round1 review outputs and remediation
+
+Both native lanes finished read-only. Each independently reported the same two P2 regressions at name-matcher.ts:24944; no other demonstrated findings.
+
+- R1 (broad+adversarial): `class Store { load() {} }; module.exports = new Store()` loses its legitimate instance call. Adversarial also demonstrated `export default new Store()` with Store not separately exported. Both base em40 produce Store::load; initial guard none. Remediation: resolve a whole explicit constructor expression to its actual module's local/imported class before the guard. Follow CommonJS forwarding; mask strings/comments/regexes, balance constructor arguments and type arguments, reject chained expressions, memoize with existing export index. Never re-enable generic method-name guessing for default bindings.
+- R2 (broad+adversarial): visible local `class named { static missing(){} }` shadows a default/namespace import; moving guard ahead of class strategy drops correct own-file call. Broad also tested enclosing-function shadow. Remediation: guard exempts a class declaration in the reference's file only when existing isLexicallyReachable proves it visible. Other-file alias-name class decoy remains blocked.
+- Review regression tests run BEFORE remediation: /tmp/codegraph-cjs-fix-review-baseline.log,24 cases19PASS5FAIL (original CommonJS positive +2 constructed-default variants +2 lexical class shadow variants). This pins both findings. Additional constructor argument/forwarder/text controls added; simple first remediation failed3nested/multiline/regex constructor positives in /tmp/codegraph-cjs-fix-constructors-baseline.log before argument-reader correction.
+- After remediation: /tmp/codegraph-cjs-fix-focused4.log,11 files99PASS1SKIP. Final focused run adds no-parentheses and spaced CommonJS constructor controls; /tmp/codegraph-cjs-fix-focused-final.log pending. Earlier temporary TS compile error from passing Language to CommentLang was corrected to JS-family typescript comment handling; not a passing run.
+
+The exact R1 reviewed name-matcher source is saved in .review/round1-name-matcher.ts and reconstructed hash verified against the recorded Git blob512a77a155299de8e6890447aa2d3aea7b81a1f9. Name-matcher remediation diff: `git diff --no-index /tmp/codegraph-cjs-missing-fix-20261108/.review/round1-name-matcher.ts /tmp/codegraph-cjs-missing-fix-20261108/src/resolution/name-matcher.ts`. Import-resolver and new tests are also remediation, diff from5e066489. No intermediate failing-source commit was made.
+
+Verify2 target is current tracked working tree relative5e066489, including CHANGELOG.md, src/resolution/name-matcher.ts, src/resolution/import-resolver.ts, __tests__/js-default-binding-members.test.ts. Check R1/R2 on all paths, all invariants, and defects introduced by remediation. Do not re-raise the pre-existing direct module.exports object-literal recovery limit without new evidence. Full build/suite pending. No merge/deployment occurred.
+
+## Verify2 result — NOT cleared; namespace-only redesign supersedes that target
+
+Both fresh native lanes finished; all findings P2. Broad reported first textual constructor overriding inactive/overwritten exports, valid inline/parenthesized constructors losing calls (R1 still open), and constructor-derived calls remaining stale after sync. Adversarial independently reported constructor lookup overriding typed/object/class lexical shadows (R2 still open), earlier constructor overriding a later stated default, and stale constructor-derived calls after sync. Exact evidence scripts/results under /tmp/cg-broad-verify2-* and /tmp/codegraph-cjs-verify2-*; complete reviewer messages returned to root. Existing explicit-default resolution was safer than the attempted new inference.
+
+Both lanes advised that a smaller boundary is coherent: extend module-namespace ownership only to a require/default whose resolved JS/TS target has no stated or uncertain value default; preserve all existing explicit/unknown default-value inference. Whole-file CommonJS forwarding can follow a namespace leaf; ambiguous assignments/default values must stay base behavior. No nonexistent redesigned code was reviewed or cleared by those design messages.
+
+Implemented redesign: REMOVED all added import-resolver source code; that file is byte-identical to base again. Removed unsafe constructor parsing/inference entirely. Name-matcher now uses existing context.resolveModuleFile, a per-context namespace-classification memo (cleared with existing memos), conservative source checks, pure whole-file forwarders only, bounded/cycle-safe traversal, language-qualified memo keys and JS/TS extensions only (no implicit component defaults). Any raw default keyword/export= or uncertain module use excludes the new guard; comments/text may conservatively prevent a classification. Move-before-class guard keeps lexical own-file class exemption. Changelog narrowed to modules without a value default.
+
+Scope/ruling: arbitrary stated/unknown exported default values and their guessed-member limitations remain pre-existing and explicitly OUTSIDE this fix. Do not claim every default-import missing-member case fixed. Removed new constructor-parser feature tests after deleting that feature, retaining baseline-supported CJS/ESM singleton, stated class/object/callable, lexical shadows and every original missing-module regression. Two dedicated singleton controls initially asserted disambiguation between two .load methods that base itself cannot provide; corrected their newly-authored fixture to a unique .load method, preserving the actual base invariant. Original broader CJS store-vs-decoy control remains unchanged. No baseline existing assertion was weakened.
+
+Full suite on superseded constructor candidate was STOPPED intentionally via guarded SIGINT to only this checkout's Vitest PID702277; final exec83750exit130. It did not pass and must not be reported as a test failure count/green gate. /tmp/codegraph-cjs-fix-full.log belongs that obsolete target. Latest redesigned focused13-file run /tmp/codegraph-cjs-fix-redesign-focused2.log RUNNING; verify actual exit/summary. Explicit build and redesigned full suite remain required.
+
+Third-review exception requested via async user question: skill says third round only if verify found something high severity; these were P2. Await user's explicit answer before launching further reviewers. Both agents' conceptual agreement is not final dual-review clearance. No source commit/push/fix PR/merge/deploy occurred. Original user's conditional merge/deploy request remains dependent on a reviewed green fix; original T0 stays stopped.
+
+## Final testing and local commit — authoritative current state
+
+Namespace redesign focused suite13files108PASS1SKIP, explicit npm run build exit0. Full normal suite exec60370EXIT0:872filesPASS19SKIP;10589testsPASS,2expectedFAIL,448SKIP,0unexpectedFAIL,799.56seconds. /tmp/codegraph-cjs-fix-redesign-full.log. Original portable6-case bug reproduction6/6PASS. Existing independent18-case records match em40baseline exactly. Namespace-to-value default change sync agrees with fresh index (initial no calls, synced/fresh Store::load); /tmp/codegraph-cjs-namespace-sync-probe.{cjs,jsonl}. Native kernel not validated.
+
+Personal repository/remote/identity, source checksums against preserved tested snapshot, staged3-file set and staged diff/check verified before local commit. LOCAL COMMIT d18e40970fc5fbf32f635f6d8d536d1bdb24dacc, tree2363dd0f8923ca59c28a3e45a477573e7364e7c2, branch fix/commonjs-missing-member. Tracked working tree clean; only private .review untracked. No push/fix PR/merge/deployment. Review target now `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5e0664891af0e87e6fd18bbfa16cab39237570f5..d18e40970fc5fbf32f635f6d8d536d1bdb24dacc -- CHANGELOG.md src/resolution/name-matcher.ts __tests__/js-default-binding-members.test.ts`.
+
+Third review still requires the pending user answer. User's later status question did NOT approve it. If authorized use two fresh native lanes with fork_turns=none and self-contained briefs/ledger to avoid carrying unrelated history. Preserve final tests; no redundant full rerun unless code or unresolved concerns change the tested tree. Verification and logs/source/patch are backed up under original QA .review/commonjs-fix-2026-11-08/verification.json and adjacent artifacts. Current canonical handoff handoff-codegraph-commonjs-tested-review-pending-2026-11-08.md supersedes running/constructor handoffs.
+
+## Third round authorized and running
+
+User explicitly answered yes to the third-review request, then asked why another round was needed. Explained earlier reviews covered replaced code while the tested final commit had not been independently reviewed. This question did not revoke approval. Started fresh read-only review_broad_commonjs_final3 and review_adversarial_commonjs_final3 with fork_turns=none, the exact base..d18e4097 target and this ledger, compact self-contained briefs and no full-suite rerun. Their results remain pending. Source unchanged; no push/merge/deployment.
+
+## Third round result — 2026-11-09 — NOT READY TO MERGE
+
+Exact target remains local d18e40970fc5fbf32f635f6d8d536d1bdb24dacc. Tracked tree clean, .review untracked; no source changes after passing tests. User resumed; collected broad final answer and adversarial confirmed messages. Broad lane completed normally. Adversarial lane delivered independently confirmed findings/evidence, then failed finalization with a usage-limit error (retry notice Nov9 1:10AM). Do NOT claim that lane completed normally, final clearance, or a green dual review. No push/PR/merge/deployment.
+
+### F3 — P2 — Namespace classification changes do not invalidate existing guessed calls (broad, independently confirmed adversarial)
+
+Broad location src/resolution/name-matcher.ts:25398. Start with `class Store { load() {} }; module.exports = new Store()` and an unchanged caller requiring that module and calling `.load()`. Replace the export with `exports.known = function known() {};`, retaining the class. After cg.sync(), the graph still calls Store::load; a fresh index correctly produces no call. The new module-text dependency needs to reopen existing member guesses when export shape changes.
+
+Broad reproduction /tmp/cg-broad-final3-sync-reverse.cjs; final evidence /tmp/cg-broad-final3-sync-reverse.log. Baseline comparison confirms its sync and fresh results both retained Store::load (/tmp/cg-broad-final3-sync-reverse-base.log). Adversarial independently reproduced direct and pure forwarder value->namespace->value->namespace retaining Store::load on every sync: /tmp/codegraph-cjs-final3-sync.cjs. Minimum correction recommendation: reopen default-import member guesses when imported module export text/shape changes, or record the imported source dependency on guesses allowed by a false namespace classification.
+
+### F4 — P2 — Explicitly exported callable aliases lose their calls (adversarial confirmed before usage limit)
+
+Location reported src/resolution/name-matcher.ts:25427. m.js `class Store { load() { return 42; } }\nexports.load = Store.prototype.load;`; use.js `const named=require('./m');\nexport function run(){named.load();}`. em40 calls m.js:Store::load; final emits no call. Same independently confirmed for `module.exports.load = Store.prototype.load`. Runtime named.load returns42 and Object.keys(module)=['load']. This is an explicitly exported callable, not the ruled-out direct object/default-value guessing limit. Prototype mutation variants group with the same uncertain-exports classification problem.
+
+Evidence /tmp/codegraph-cjs-final3-export-alias.cjs and /tmp/codegraph-cjs-final3-adversarial{,-base.jsonl,-final.jsonl}. Recommendation: preserve uncertain named-export RHS APIs or resolve the actual callable alias before blocking a fallback. Do not reopen arbitrary guesses for absent exports.
+
+### F5 — P2 — Out-of-scope local class bypasses namespace guard (adversarial confirmed before usage limit; original finding remains open on this path)
+
+Reported location src/resolution/name-matcher.ts:25397 (guard local-class exemption, around25396). Valid CJS: m.js `exports.known=function known(){};`; use.js lines1..8:
+`const named=require('./m');`
+`function run(){`
+`if(true){`
+`class named {static missing(){}}`
+`}`
+`named.missing();`
+`}`
+`module.exports=run;`
+Final returns use.js:run::named::missing atline6, though the class is block-local and imported module has no missing. Also reproduced for a class inside TS namespace Parent. These outputs pre-exist on base, but this is a still-open original false-positive path bypassing the new guard: existing isLexicallyReachable does not establish block visibility. Recommendation: require actual enclosing lexical block visibility before exempting a class. Preserve the genuine inner/enclosing-function shadow controls.
+
+## Merge decision / next boundary
+
+HOLD d18e4097. Passing build/full/focused tests remain factual, but F3/F4 are demonstrated regressions and F5 remains an intended missing-member path. No further agents, tests, source fixes or outward actions started after these reports. Do not rerun the full suite until a changed candidate requires it. User required confirmation before subsequent steps; present this concrete review result and seek the next bounded correction/verification decision. Fourth review is not preauthorized by approval of the third; native review gate may deny round4, so stop and ask rather than bypass. Agent quota exhaustion is additional reason not to relaunch a failed lane automatically.
+
+## Corrections authorized — 2026-11-09
+
+User: if findings are separate, report them; if related, fix them. All three are related: F3/F4 regressions introduced by this guard, F5 remaining original namespace missing-member path. No new issue filing or outside bug work needed. Authorized correcting all three in this branch; no extra reviewer lane or outward action started.
+
+Fail-before tests:11 new regressions fail and24 existing pass on d18e4097, /tmp/codegraph-cjs-fix-r3-regressions-before.log. New tests cover direct and forwarded value->namespace->value->namespace sync vs fresh; explicit dotted/bracket export aliases beside a still-absent-member decoy; alias removal by sync; out-of-scope sibling-block classes vs genuine same-block inner callers; TSnamespaceclassscope.
+
+Changes: F3 uses existing typeFrom dependency tracking on byName default-import member calls, includes each pure-forwarder file; activates the existing dependency-edge reopener for JS/TS paths while keeping failed-attribute retry Python-only. F4 namespace info tracks explicit assigned member names; new guard applies only to absent names. Escaping/computed/prototype-mutated exports remain uncertain and preserve existing behavior. F5 adds existing holderScopeAt block visibility to the class-shadow exemption, retaining function lexical visibility as well. Namespace memo stores traced files/member names; cache not poisoned by depth/cycle cutoffs.
+
+First focused verification AFTER all three corrections:3files49PASS0FAIL, /tmp/codegraph-cjs-fix-r3-regressions-after.log. Includes full35-case default-member suite and memo clearing/lifetime. No existing expected assertion weakened. Pending expanded JS/Python sync controls, normal full suite/build and original6-case repro. No new commit yet; earlier full pass applies d18e4097 only. Current changed files test + name-matcher + src/index.ts + src/extraction/index.ts. No unsafe constructor inference, import-resolver unchanged. Fourth review not yet requested/launched; gate and quota limits remain applicable.
+
+## Corrected commit verified by execution — independent review pending
+
+F3 class-name path also pinned: two new uppercase Store import-alias sync cases failed when only byName answers carried dependency metadata; /tmp/codegraph-cjs-fix-r3-upper-before.log. Final correction records imported-module inputs on name-matcher default-member answers from both class-name and method-name strategies. No change to confidence/byName selection. All original regression assertions retained.
+
+FINAL source tests:16files206PASS1SKIP, including37default-membercases, JS imports/sync andPythonattribute/memo controls. Log/tmp/codegraph-cjs-fix-r3-focused-final.log. Full normal suite exec42040EXIT0:872filesPASS19SKIP,10602testsPASS2expectedFAIL448SKIP0unexpectedFAIL,771.60seconds, /tmp/codegraph-cjs-fix-r3-full.log. Explicit npm run build exec37438EXIT0, /tmp/codegraph-cjs-fix-r3-build.log. Original portable6-case bug reproducer6/6PASS, /tmp/codegraph-cjs-corrected-final-sixcases.log. Node22.22.2/kernel0WASM; native not claimed. Source checksums prove no source changes between focused/full/build/testing and commit.
+
+LOCAL CORRECTION COMMIT559c76df6afd9e40f4d617ff77caa7db4ad03955, tre eb81d2063f4e787da5cfc7d28c619078fdc86e6b6, parentd18e40970fc5fbf32f635f6d8d536d1bdb24dacc. Personalrepository/remote/identity/stagedexact4-filediff andchecks verified. Trackedtreeclean, onlyprivate.reviewuntracked. No push/fixPR/merge/deploy or issuefiling. F3/F4/F5 status CORRECTED+executionPASS, awaiting independent verification; do not claim native review clearance.
+
+FOURTH ROUND ANSWER PENDING: async question asked permission and quoted ~/.codex/AGENTS.md: "where Claude's gate would ask the user at round 4, Codex denies, so stop and ask." User has not answered that new question; elapsed time is not approval. Do not launch fourth reviewers yet or modify gate state/control files. If approved use2freshread-onlynativefork_turns=none, same ledger, correction target `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff d18e40970fc5fbf32f635f6d8d536d1bdb24dacc..559c76df6afd9e40f4d617ff77caa7db4ad03955 -- src/resolution/name-matcher.ts src/index.ts src/extraction/index.ts __tests__/js-default-binding-members.test.ts`. Brief F3-F5, currentcorrections+invariants; no fullsuite rerun unless changes/failures justify it. Stop/ask if gate denies; last third adversarial lane failed finalization due usage cap, don't fabricateclearance.
+
+Durable original-workspace backup .review/commonjs-fix-2026-11-08/corrections-2026-11-09/:4sourcefiles, corrections.patch, checksums.json, before/after/focused/full/build/reprologs, verification.json identifyingfinalcommit/tree/outcomes, verified commonjs-fix.bundle containingbothlocalfixcommits with originalbase5e066489prerequisite. Commit recovery does not depend on /tmp survival. Current canonical handoff handoff-codegraph-commonjs-corrected-review-pending-2026-11-09.md supersedes corrections-running and review-blocked handoffs. OriginalT0unchanged/stopped; Tuesdayconditionalupstreamreport unchanged.
+
+## Fourth verification and modular correction — 2026-11-09
+
+User asked whether errors remain and approved proceeding, specifically requesting a smaller modular strategy for any remaining fix. Two fresh read-only minimal-context lanes review_broad_commonjs_verify4 and review_adversarial_commonjs_verify4 completed. BOTH independently CLEARED F3 direct/forwarded sync for ordinary and class-name aliases; F4 dotted/bracket callable/prototype aliases and removal sync; F5 block/namespace visibility and genuine inner shadows. Adversarial also verified Python failed-call retry/retyping and zero Python retry on JS-only edits. No full/build reruns or source edits by reviewers.
+
+F6 — P2 — src/resolution/name-matcher.ts:25444 raw exported-member discovery accepts comments, strings, regex literals, and unrelated object properties. With m.js exporting only known, adding `// exports.missing = fake;` or `function setup(holder) { holder.exports.missing = 42; }` makes named.missing falsely call decoy.js:Decoy::missing. Clean source has no call. Quoted/template/regex variants reproduce. This is newly added member inclusion, not the previous conservative default-text exclusion ruling. Exact broad evidence /tmp/cg-broad-verify4-classifier.{cjs,log}, /tmp/cg-broad-verify4-probes.cjs; adversarial /tmp/codegraph-cjs-verify4-extra.cjs. Both recommended one isolated token-aware collector validating executable assignments and bare exports/module.exports roots.
+
+Following user's authorized strategy: extracted readCommonJsExportMembers into new48-line(initial) src/resolution/commonjs-export-members.ts, with independent __tests__/commonjs-export-members.test.ts. Replaced matcher raw member/escape scanning with one helper call. Uses exact pinned production js-tokens9.0.1 (CommonJS, built-in types,16071unpackedbytes per officialnpmmetadata), no hand-written lexer or changedsharedstrip-comments scanner. Existingnamespace/default ownership tracing, sync/typeFrom and holderScopeAt behavior retained. Newpackage9chosen to keep CJS compatibility; upstream latestREADME refers to newerESMrequirebehavior. Source tokenizer was verified from officialrepo docs and installed package/types. No Node/packageversionbump.
+
+Fail-before graph regressions:8FAIL/37SKIP on559c76df, /tmp/codegraph-cjs-modular-before.log. New helper independently tests executable dot/bracket writes, template expressions/nesting, TSgenerics, JSXtext-vs-expressions, line/block comments, strings/templates/regex/control-regex, unrelated/Unicode/dollar roots, equality/typequeries, uncertain/prototype/computed APIs. Initial4files89PASS. Additional2positive runtime-API controls (literal eval export and require.cache default) exposed2FAIL before uncertainty handling; /tmp/codegraph-cjs-modular-uncertain-before.log. Added explicit uncertainty for literal eval code and Node module/cache APIs, preserving genuine dynamic exports while ordinary data remains opaque. All existing expected assertions retained.
+
+Latest modular focused gate18files260PASS1SKIP, /tmp/codegraph-cjs-modular-expanded-final.log; includes47default-member graph cases,38pure helper cases, priorJS/Python/sync/memo/lazy-engine controls. Source remains dirty relative559c76df in6files: newhelper/newunit test (intent-to-add makes visible in Gitdiff), existing integrationtest/matcher and package.json/package-lock. No new commit yet. No outwardactions. Full current modular suite/build still pending; parent10602PASS does not cover new modular code.
+
+User's conditional approval includes correcting any residual error with this smaller strategy and verifying it. Next fresh verification target is559c76df..working tree, sameledger and6paths; keep native round count honest (fifthverification), no target/state reset. Stop/ask if host gate denies; do not bypass. Review ONLY F6 closure and regressions of helper/adapter/dependency, plus bounded preservation checks. Source stable after260focusedPASS; no repeatedfull/build by reviewers. Prefer existingdist+scratch probes; underlyingthree corrections already independently cleared.
+
+
+## Fifth verification — modular source reader, 2026-11-09
+
+Fresh read-only lanes review_broad_commonjs_modular5 and review_adversarial_commonjs_modular5 both completed. Both cleared F6 phantom comments/strings/templates/regex and unrelated roots, plus preservation of real aliases, sync, scope and Python behavior. Production js-tokens9.0.1 packaging compatibility cleared. No source edits or redundant full-suite runs by reviewers.
+
+F7 — P2 — src/resolution/commonjs-export-members.ts:37 recognizes eval uncertainty only when a bare eval immediately receives a StringLiteral. Both reviewers reproduced template-literal eval dropping a real Store::load call. Adversarial additionally reproduced `(eval)('exports.load = Store.prototype.load;')`. Both runtime mutations return42; previous reader preserves Store::load, current reader emits no calls. Literal single-quoted bare eval control remains green. Evidence /tmp/codegraph-cjs-adversarial5-eval.{cjs,log}. Fix only the small helper: account for grouped bare eval callee and template literals, preserve class method named eval as non-call text. Add fail-before controls; do not alter name-matcher, sync or scope corrections for F7.
+
+Pre-F7 modular full normal suite EXIT0, 873 files PASS19SKIP, 10650 tests PASS2expectedFAIL448SKIP0unexpectedFAIL,780.27sec. /tmp/codegraph-cjs-modular-full.log. This run does not cover the upcoming F7 correction. Current source remains local and dirty relative559c76df. No push, source PR, merge, deployment or upstream report. Original T0 pilot remains stopped/uncommitted.
+
+
+F7 correction: literalEvalCall now unwraps paired bare-callee parentheses and grouped arguments, accepts StringLiteral/NoSubstitutionTemplate/TemplateHead. Does not execute eval or inspect data token contents; method declaration named eval remains ignored. Added4 pure-reader controls and2 graph positives. Before change:6FAIL85PASS (/tmp/codegraph-cjs-modular-eval-before.log); after:91PASS across2files (/tmp/codegraph-cjs-modular-eval-after.log). git diff --check PASS. No changes to the matcher adapter, sync or scope for F7. Full-suite PASS above predates this correction; normal final full suite and independent review of the F7 correction remain pending. Local changes uncommitted. Build result pending.
+
+Explicit final F7 npm run build EXIT0, /tmp/codegraph-cjs-modular-eval-build.log; viewer,29grammars,runtime and dist engine checks PASS. Final full suite and independent F7 verification still pending; do not conflate pre-F7 full pass with final-tree clearance. Checkpoint backup .review/commonjs-fix-2026-11-08/modular-eval-2026-11-09/ in original QA workspace contains6current sourcefiles, cumulative and modular patches, hashes, logs and this ledger. Source unchanged since91focusedPASS/build.
+
+
+## Sixth verification authorized and running — 2026-11-09
+
+User explicitly answered yes to final verification. Fresh read-only native lanes review_broad_commonjs_eval6 and review_adversarial_commonjs_eval6 launched against559c76df..workingtree six modular paths and same ledger. No gate reset/bypass or Claude-only skill claim. Both focus F7 closure and neighboring invariants; no full/build reruns by reviewers. Parent full normal CODEGRAPH_KERNEL=0 npm test -- --maxWorkers=4 runs session5033, /tmp/codegraph-cjs-eval6-full.log. Snapshot hashes /tmp/codegraph-cjs-eval6-frozen.json. No final results yet. Final explicit build before this full run passed; test setup refreshed engine assets itself. No source changes during review/tests, no outward actions. Personal origin/identity rechecked: inth3shadows/codegraph, Eric Minish / eric.minish@gmail.com. Current six modular files remain uncommitted.
+
+
+## Sixth verification result — 2026-11-09 — NOT READY TO MERGE
+
+Both fresh read-only lanes completed normally. Adversarial CLEARED F7: original3 runtime/graph forms plus11 additional runtime-backed graph controls preserve real exports and reject inert eval-looking data/method declarations. Evidence /tmp/codegraph-cjs-adversarial6-eval.{cjs,log}. Broad independently passed13 intended F7/nearby controls, but found F8 in the correction. No source edits/build/full reruns by reviewers. No final dual clearance.
+
+### F8 — P2 — literalEvalCall mistakes function-argument parentheses for grouped eval callees (broad)
+
+Reviewer location src/resolution/commonjs-export-members.ts:20, loop lines20-24. Exact input:
+
+```js
+exports.known = function known() {};
+function wrap(value) { return function ignore(code) {}; }
+wrap(eval)("ignored");
+```
+
+Runtime exports only known. Current reader returns uncertain:true, making named.missing() falsely resolve to decoy.js:Decoy::missing. Restoring only the pre-F7 literal-eval check in memory returns uncertain:false and no call. wrap((eval))(("ignored")) also reproduces. Evidence /tmp/cg-broad-verify6-callee-compare.log, adjacent .cjs; initial probe /tmp/cg-broad-verify6-callee-context.{cjs,log}. Broad passed all13 intended controls including grouped direct eval, templates, method named eval, real template-expression exports and callable aliases. Adversarial's bounded probes did not include this counterexample; its clearance does not override the demonstrated defect.
+
+Parent full suite intentionally stopped with SIGINT after confirmed F8; exact cwd/argv guarded signal to only isolated checkout main Vitest, tool session5033 EXIT130. /tmp/codegraph-cjs-eval6-full.log is PARTIAL, NOT a full pass/failure result. Avoid wasting a known-defective verification cycle. Prior91focusedPASS and explicit buildPASS remain true for this source, prior10650fullPASS predates F7 and cannot clear current tree. SHA256 snapshot recheck confirms all6 reviewed source paths unchanged during verification. No new source commit, push, fixPR, merge, deployment, version/tag/npm or upstream report.
+
+Stop this correction cycle and report F8. User yes authorized final verification, not another correction/review cycle or publishing. Need user decision before next step, as previously requested. Durable evidence in original QA .review/commonjs-fix-2026-11-08/final-verification-2026-11-09/. Previous modular-eval source/patch backup still matches frozen source. Keep original T0 stopped/uncommitted. Do not reset review count/gate or rewrite control files.
+
+
+## Seventh native dual review result — PR29 — 2026-11-09
+
+Both fresh read-only lanes completed normally: review_broad_pr29_round7 and review_adversarial_pr29_round7. Exact target remains5d384989957c91b482068b306535437915a0595b..87576a8d9ff0d8aba235db5535f5f4429f14b037. Source hashes verified unchanged, trackedtreeclean except private untracked.review. No source edits/build/fullsuite reruns/commits/pushes/GitHubcomments/merge/deploy. Both PRs remain draft. Current review DOES NOT CLEAR PR29 despite prior101focusedPASS/full10666PASS/buildPASS. Parent merges findings from actual final reports without re-verifying/re-reading diff.
+
+### F9 — P2 — Preserve grouped direct eval in control-statement bodies (BOTH)
+
+Broad location src/resolution/commonjs-export-members.ts:31: rejects any preceding ), including a completed if or for condition. Exact input `class Store { load() { return 42; } }
+if (true) (eval)('exports.load = Store.prototype.load;');`. Runtime exports load() returning42, but current discovery uncertain:false and indexing named.load() produces no call. Removing only new prefix guard in memory restores uncertain:true and m.js:Store::load. Nested grouped eval in unbraced single-iteration for body reproduces too. Broad evidence /tmp/cg-broad-pr29-control-context.{cjs,log}; exact command `node --experimental-wasm-exnref --experimental-wasm-stack-switching /tmp/cg-broad-pr29-control-context.cjs`.
+
+Adversarial independently confirms same location/trace; grouped-template if-body and for-body also reproduce. Evidence /tmp/codegraph-cjs-adversarial7-conditional-eval.{cjs,log}. De-duplicated as one P2 F9. This is a NEW regression introduced in PR29, not a pre-existing parent limitation.
+
+### F8 — P2 — PARTIALLY CORRECTED, remains for contextual-keyword wrapper names (adversarial)
+
+Exact reviewer location src/resolution/commonjs-export-members.ts:29 (whitelist:7). Valid CommonJS `function await(value){return function ignore(code){};} await(eval)("ignored");` passes eval without invoking it, but whitelist exemption produces uncertain:true and falsely resolves named.missing() to decoy.js:Decoy::missing. With exports.known=function known(){}, runtime exports only known; pre-F7 behavior restored in memory produces no call. yield reproduces too. Evidence /tmp/codegraph-cjs-adversarial7-contextual-wrapper.{cjs,log}. This is a RESIDUAL F8 variant, not a new unrelated parent re-audit. Do not label all F8 closed.
+
+### Confirmed preservation / rulings
+
+Both independently clear original F8 forms wrap(eval)("ignored") and wrap((eval))(("ignored")): runtime onlyknown, reader uncertain:false, no decoy call. Broad /tmp/cg-broad-pr29-f8-closure.{cjs,log}. Adversarial13runtime-backed graph controls pass (original2forms +11nearby controls), /tmp/codegraph-cjs-adversarial7-controls.log. True standalone grouped/template eval, return expressions, inert data/method declarations, call/member/optional/tag/condition-prefix negatives retain tested behavior. These controls do not answer F9 control-body context or F8 await/yield wrappers.
+
+### Next boundary
+
+Review-only user request is complete. STOP: no fixes, additional review loop, external review comment, markready, merge or deploy without user instruction. The per-step confirmation request remains in force. This is round7 overall; no gate/state reset. Repeated grouping-prefix patches now demonstrate syntax-context ambiguity: if user asks for remediation, choose an evidence-based smaller boundary/design instead of another unbounded keyword/punctuation whitelist. Preserve both concrete repros and all prior controls. Do not repeat fullsuite/build on unchanged source. Actual durable result/evidence/checksums saved in original QA .review/commonjs-fix-2026-11-08/pr29-review-round7-2026-11-09/.
+
+
+## AST redesign approved and started — 2026-11-09
+
+User explicitly approved AST redesign in PR29, said near usage max and asked for a resumable start, then said proceed. This revokes prior review-only stop for in-scope remediation; do not ask same approval on resume. Preserve per-step/user and actual gate boundaries for later merges/deployments. No grammar/runtime/dependency/database-schema changes, commits or pushes in this partial phase; PRs remain draft at prior heads.
+
+Newgraph regressions FIRST:3control-body direct-eval variants(if string/template, for nestedgroups) +await/yield CommonJS wrappers,5FAIL51SKIP on current87576a8d. /tmp/codegraph-cjs-ast-red.log, EXIT1. This intentionally RED gate remains unchanged because integration pending.
+
+New isolated src/extraction/commonjs-eval.ts reads existing SyntaxNode tree and checks actual call.function after unwrapping parenthesized_expression. Returns true for syntacticdirectevalcall(anyargument), false for provenabsence, null for parseerrors with no foundcall. New __tests__/commonjs-eval.test.ts loads existingJS/TS/TSXgrammars:33PASS, /tmp/codegraph-cjs-ast-helper.log EXIT0. Controls cover reports, grouped/interpolated eval, return, generatorfunctions/methods, nestednongenerator scope, eval inside yieldwrapper argument, inert data/methods/membercalls, JSX and malformedsource. Helper not wired to classifier/extraction yet. Existing lexical reader/EXPRESSION_PREFIX_WORDS unchanged for now. Do not claim F8/F9 closed, new full/buildpass or finalreview.
+
+IMPORTANT new evidence: existingJSgrammar correctly models control-body eval and awaitwrapper but parses legal CommonJS yield(eval)(code) as yield_expression whose operand is a call on(eval), no parseerrors. ASTscope must distinguish nongeneratorwrapper from generator yield. Helper handles direct yieldoperand only via nearestfunction/generator/methodscope; nested true eval in yield(eval(code)) remains detected. Shapeprobe /tmp/codegraph-cjs-ast-shape-probe.{cjs,log}. Extractionreferenceprobe /tmp/codegraph-cjs-eval-reference-probe.{cjs,log} shows currentextractor emits callref eval for genuinecall AND synthetic yieldwrappercase. Consequently raw existing unresolved eval refs alone are insufficient. User was explicitly told this grammar limitation, not falsely assured all cases are parser-perfect. No grammarfiles changed.
+
+Next integrate factualcallresult through existingextraction to resolver. Node has NO metadata field (onlyedges do); do not invent Node.metadata, abuse signature/selfedges/candidates, or introduce schema migration casually. ExtractionResult can carry optionalfact through workerclone; need native/deferred bypass parity. Main bulk parse pools only load grammars in workers; resolver cannot assume synchronous getParser is ready in main. Suggested project_metadata perfile/sourcehash transport or another small explicit extractioncontext capability; persist/refresh under same successfulstore lifecycle, cover storeworker and sync. Decide carefully before editing infrastructure. Resume must preserve all existing tests and5newred cases; unknown/missing/error facts must not masquerade as provenabsence. Keep existing export-member tokenizer and previous sync/scope/alias fixes intact; remove prefixheuristics only onceASTfacts actuallysupplied.
+
+Saved current3sourcefiles, patchrelative87576a8d, hashes, red/green/probe logs under original QA .review/commonjs-fix-2026-11-08/ast-redesign-started-2026-11-09/. No tests/build/reviewers running at checkpoint. Newfiles intent-to-add only so diffincludes them, not readyforcommit. No fresh dualreviewagents this phase. Overall reviewcount7; do not reset gate/controlstate. Resume directly integration and targeted tests; fullsuite/build only after stablefix, fresh focuseddual review as authorized/actualgatepermits, no repetitivewholeprojectwork. OriginalT0stillstopped/uncommitted; liveem40 unchanged; no merges/deploy/upstream writes.
+
+
+## Eighth native review COMPLETED — AST correction NOT CLEARED
+
+Both fresh read-only reviewers completed normally on frozen15-file87576a8d..workingtree correction. Both confirm no source edits/build/full reruns/control changes; source hashes unchanged. No final normalbuild/fullsuite run or commit/push. PublishedPR28/29 remain drafts at5d384989/87576a8d. Prior166focusedPASS1SKIP is true and covers original5reportedgraphcases, but does not clear new findings. Nativebinary absent, no nativeexecutionclaim. Parent uses actual reports, no independent duplicate repro/diffread.
+
+### F10 — P2 — Optional contextual-keyword wrappers regress (adversarial)
+
+Exact reviewer location src/extraction/commonjs-eval.ts:37. Valid CommonJS:
+
+```js
+exports.known = function known() {};
+function yield(value) {
+  return function ignore(code) {};
+}
+yield?.(eval)("ignored");
+```
+
+Runtime exports only known; eval is never invoked. Existing grammar reports parse error, helper returns null, reader marks exports uncertain, and named.missing() falsely calls unrelated decoy.js:Decoy::missing. Actual current correction calls:[decoy.js:Decoy::missing]; base87576a8dreader restored in memory calls:[], uncertain:false. Evidence /tmp/cg-a8-yield-optional.{cjs,log}, /tmp/cg-a8-yield-optional-base.{cjs,log}, /tmp/cg-a8-probe.cjs. New F8-adjacent regression introduced by AST correction. Unknown fact correctly avoids false absence proof but must not license false call targets; current fallback still does.
+
+### F11 — P2 — Computed method names use enclosing scope (broad)
+
+Exact reviewer location src/extraction/commonjs-eval.ts:51. Treats a computed method name as belonging to that method's function scope. Computed names execute in enclosing scope. Confirmed both directions:
+
+1. `class Store { load(){return 42;} } function* setup(){ const obj = { [yield (eval)('exports.load = Store.prototype.load;')]() {} }; } setup().next();` Runtime exports load()->42, currentfactfalse/uncertainfalse, named.load() graphcalls[]. Ordinary computedmethodkey inside outergenerator suppressesgenuineeval.
+2. `exports.known=function known(){}; function yield(value){return function ignore(code){return 'x';}} const obj={ *[yield(eval)("ignored")](){} };` Runtime keysonlyknown, currentfacttrue/uncertaintrue, named.missing() falselycallsDecoy::missing. Generator methodkeyevaluatesoutsidegeneratorbody, so yieldiswrapperhere.
+
+One rootcause/twoexecutiontraces, evidence /tmp/cg-broad-pr29-ast8-computed-scope.{cjs,log}, executed againstcurrentdist with CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2. All15frozenhashesmatch.
+
+### Stop boundary and saved state
+
+Approved redesign progressed to166focusedPASS + real-worker/store/sync/factlifecycle integration, then focusedverifyfoundthese2P2. STOP before anothercorrectioncycle per dual-reviewworkflow/userper-stepconfirmation. Don't spendfullsuiteonknowndefectivecode orpushasready. Usermustdecidenextstep; noautomaticnewreview/fix/merge/deploy. Overallcount8, noreset. Nextremediationifapproved: computedmethodscope must excludecomputedkeys fromnewmethodscope; parseerrorunknown mustnotenableinventedfallbackcalls (requires explicitresolutionpolicy, not anotherkeyword/punctuationguess). Preserve all originalregressions and33ASTcontrols, truealiases/sync/scope/Pythonbehavior. No grammarfiles/schema/deps changed; source remains15dirtypaths, notcommitted. Durablebackup includes allsources/patch/logs andnewreviewevidence, verificationresult/checksums.
diff --git a/docs/handoffs/pr29-2026-11-10/history/ast-integrated-review8-2026-11-09/merged-review.md b/docs/handoffs/pr29-2026-11-10/history/ast-integrated-review8-2026-11-09/merged-review.md
new file mode 100644
index 0000000000..77a0a6b2a4
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/ast-integrated-review8-2026-11-09/merged-review.md
@@ -0,0 +1,32 @@
+
+
+## Eighth native review COMPLETED — AST correction NOT CLEARED
+
+Both fresh read-only reviewers completed normally on frozen15-file87576a8d..workingtree correction. Both confirm no source edits/build/full reruns/control changes; source hashes unchanged. No final normalbuild/fullsuite run or commit/push. PublishedPR28/29 remain drafts at5d384989/87576a8d. Prior166focusedPASS1SKIP is true and covers original5reportedgraphcases, but does not clear new findings. Nativebinary absent, no nativeexecutionclaim. Parent uses actual reports, no independent duplicate repro/diffread.
+
+### F10 — P2 — Optional contextual-keyword wrappers regress (adversarial)
+
+Exact reviewer location src/extraction/commonjs-eval.ts:37. Valid CommonJS:
+
+```js
+exports.known = function known() {};
+function yield(value) {
+  return function ignore(code) {};
+}
+yield?.(eval)("ignored");
+```
+
+Runtime exports only known; eval is never invoked. Existing grammar reports parse error, helper returns null, reader marks exports uncertain, and named.missing() falsely calls unrelated decoy.js:Decoy::missing. Actual current correction calls:[decoy.js:Decoy::missing]; base87576a8dreader restored in memory calls:[], uncertain:false. Evidence /tmp/cg-a8-yield-optional.{cjs,log}, /tmp/cg-a8-yield-optional-base.{cjs,log}, /tmp/cg-a8-probe.cjs. New F8-adjacent regression introduced by AST correction. Unknown fact correctly avoids false absence proof but must not license false call targets; current fallback still does.
+
+### F11 — P2 — Computed method names use enclosing scope (broad)
+
+Exact reviewer location src/extraction/commonjs-eval.ts:51. Treats a computed method name as belonging to that method's function scope. Computed names execute in enclosing scope. Confirmed both directions:
+
+1. `class Store { load(){return 42;} } function* setup(){ const obj = { [yield (eval)('exports.load = Store.prototype.load;')]() {} }; } setup().next();` Runtime exports load()->42, currentfactfalse/uncertainfalse, named.load() graphcalls[]. Ordinary computedmethodkey inside outergenerator suppressesgenuineeval.
+2. `exports.known=function known(){}; function yield(value){return function ignore(code){return 'x';}} const obj={ *[yield(eval)("ignored")](){} };` Runtime keysonlyknown, currentfacttrue/uncertaintrue, named.missing() falselycallsDecoy::missing. Generator methodkeyevaluatesoutsidegeneratorbody, so yieldiswrapperhere.
+
+One rootcause/twoexecutiontraces, evidence /tmp/cg-broad-pr29-ast8-computed-scope.{cjs,log}, executed againstcurrentdist with CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2. All15frozenhashesmatch.
+
+### Stop boundary and saved state
+
+Approved redesign progressed to166focusedPASS + real-worker/store/sync/factlifecycle integration, then focusedverifyfoundthese2P2. STOP before anothercorrectioncycle per dual-reviewworkflow/userper-stepconfirmation. Don't spendfullsuiteonknowndefectivecode orpushasready. Usermustdecidenextstep; noautomaticnewreview/fix/merge/deploy. Overallcount8, noreset. Nextremediationifapproved: computedmethodscope must excludecomputedkeys fromnewmethodscope; parseerrorunknown mustnotenableinventedfallbackcalls (requires explicitresolutionpolicy, not anotherkeyword/punctuationguess). Preserve all originalregressions and33ASTcontrols, truealiases/sync/scope/Pythonbehavior. No grammarfiles/schema/deps changed; source remains15dirtypaths, notcommitted. Durablebackup includes allsources/patch/logs andnewreviewevidence, verificationresult/checksums.
diff --git a/docs/handoffs/pr29-2026-11-10/history/ast-integrated-review8-2026-11-09/review-ledger.md b/docs/handoffs/pr29-2026-11-10/history/ast-integrated-review8-2026-11-09/review-ledger.md
new file mode 100644
index 0000000000..d3604395f2
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/ast-integrated-review8-2026-11-09/review-ledger.md
@@ -0,0 +1,73 @@
+# Separate F8 follow-up (review round count remains six)
+
+User explicitly authorized committing/pushing current work to a PR and separating remaining correction. Current snapshot committed5d384989957c91b482068b306535437915a0595b, pushed fix/commonjs-missing-member, DRAFT https://github.com/inth3shadows/codegraph/pull/28 against main. KnownF8 documented, not ready to merge alone. No deploy/merge/upstream report.
+
+New branch fix/commonjs-eval-callee-context based on5d384989. Exact prospective Git target: git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5d384989957c91b482068b306535437915a0595b -- src/resolution/commonjs-export-members.ts __tests__/commonjs-export-members.test.ts __tests__/js-default-binding-members.test.ts
+
+F8 reviewer finding and prior invariants remain in .review/commonjs-missing-member.md; do not reset shared gate/round count. Two sixth reviewers completed; broad demonstrated F8 despite adversarial clearing intended F7 cases. This follow-up has NOT had independent dual review yet.
+
+Correction: distinguish grouping around bare eval from another function's argument list using token before parentheses. Wrapper identifier/call/member/optional-call/tag/control-condition prefixes must not mark exports uncertain. Grouped direct eval, literal/template arguments and expression prefixes such as return must keep prior behavior. Change limited to9helper lines plus independent unit and real-index graph regressions; no matcher/sync/scope changes.
+
+Before fix8FAIL92PASS; tag-result additional case1FAIL49PASS. Final focused2files101PASS, /tmp/codegraph-cjs-eval-followup-focused.log. Build/full pending. Hashes /tmp/codegraph-cjs-followup-frozen.json. Logs /tmp/codegraph-cjs-eval-followup-{before,tag-before,focused,build}.log. Need staged exact3-file diff, personal repo/identity and actual build result before commit/push. Full normal suite required before readiness claim. Keep follow-up draft and explicitly state review pending. No additional reviewer agents launched in this follow-up; user plans to point agents at PRs.
+
+Keep both PRs draft. Follow-up base should be fix/commonjs-missing-member, producing only the small correction diff. Review/merge follow-up into parent branch before considering parent PR for main; no merge authorized by current request. Preserve original T0 pilot and all deploy/control worktrees.
+
+Published DRAFT https://github.com/inth3shadows/codegraph/pull/29, commit87576a8d9ff0d8aba235db5535f5f4429f14b037, base fix/commonjs-missing-member/PR28 at5d384989. Explicit buildPASS; normal full suite RUNNING session62594, /tmp/codegraph-cjs-eval-followup-full.log. Both pushed/draft, neither merged/deployed; follow-up independent review stillpending. Original T0 untouched.
+
+
+FINAL execution verification2026-11-09: normal full suite session62594 EXIT0,873filesPASS19SKIP,10666testsPASS2expectedFAIL448SKIP0unexpectedFAIL,800.20sec. /tmp/codegraph-cjs-eval-followup-full.log. 101focusedPASS and explicit buildPASS on same87576a8dsource. Final3changed-file SHA256 checks PASS, trackedtreeclean; actual remoteheads rechecked5d384989(PR28) and87576a8d(PR29). PR29 body updated with exact final validation. Both PRs still DRAFT/unmerged; no deployment/upstream write. FOLLOW-UP INDEPENDENT REVIEW STILL PENDING: do not conflate fullsuite with review clearance. No further tests/build/review processes running. Saved final checkpoint and full log under original QA two-draft-prs backup.
+
+
+## Seventh native review explicitly requested — PR29 — 2026-11-09
+
+User invoked /dual review29. Exact GitHub base5d384989957c91b482068b306535437915a0595b and head87576a8d9ff0d8aba235db5535f5f4429f14b037 verified. Fresh read-only native lanes review_broad_pr29_round7 and review_adversarial_pr29_round7 launched together with same exact Git target and this ledger. Both focus full3-file29-line correction, F8 closure and nearby invariants; bounded execution probes only, no repeat full/build or source edits. Parent does not reread reviewed diff or duplicate reviewer probes. No review results yet; no independent clearance claim. Do not reset round count/gate, change source, push, merge or deploy in this review-only turn. Stop and report merged findings when both complete.
+
+
+## Seventh native dual review result — PR29 — 2026-11-09
+
+Both fresh read-only lanes completed normally: review_broad_pr29_round7 and review_adversarial_pr29_round7. Exact target remains5d384989957c91b482068b306535437915a0595b..87576a8d9ff0d8aba235db5535f5f4429f14b037. Source hashes verified unchanged, trackedtreeclean except private untracked.review. No source edits/build/fullsuite reruns/commits/pushes/GitHubcomments/merge/deploy. Both PRs remain draft. Current review DOES NOT CLEAR PR29 despite prior101focusedPASS/full10666PASS/buildPASS. Parent merges findings from actual final reports without re-verifying/re-reading diff.
+
+### F9 — P2 — Preserve grouped direct eval in control-statement bodies (BOTH)
+
+Broad location src/resolution/commonjs-export-members.ts:31: rejects any preceding ), including a completed if or for condition. Exact input `class Store { load() { return 42; } }
+if (true) (eval)('exports.load = Store.prototype.load;');`. Runtime exports load() returning42, but current discovery uncertain:false and indexing named.load() produces no call. Removing only new prefix guard in memory restores uncertain:true and m.js:Store::load. Nested grouped eval in unbraced single-iteration for body reproduces too. Broad evidence /tmp/cg-broad-pr29-control-context.{cjs,log}; exact command `node --experimental-wasm-exnref --experimental-wasm-stack-switching /tmp/cg-broad-pr29-control-context.cjs`.
+
+Adversarial independently confirms same location/trace; grouped-template if-body and for-body also reproduce. Evidence /tmp/codegraph-cjs-adversarial7-conditional-eval.{cjs,log}. De-duplicated as one P2 F9. This is a NEW regression introduced in PR29, not a pre-existing parent limitation.
+
+### F8 — P2 — PARTIALLY CORRECTED, remains for contextual-keyword wrapper names (adversarial)
+
+Exact reviewer location src/resolution/commonjs-export-members.ts:29 (whitelist:7). Valid CommonJS `function await(value){return function ignore(code){};} await(eval)("ignored");` passes eval without invoking it, but whitelist exemption produces uncertain:true and falsely resolves named.missing() to decoy.js:Decoy::missing. With exports.known=function known(){}, runtime exports only known; pre-F7 behavior restored in memory produces no call. yield reproduces too. Evidence /tmp/codegraph-cjs-adversarial7-contextual-wrapper.{cjs,log}. This is a RESIDUAL F8 variant, not a new unrelated parent re-audit. Do not label all F8 closed.
+
+### Confirmed preservation / rulings
+
+Both independently clear original F8 forms wrap(eval)("ignored") and wrap((eval))(("ignored")): runtime onlyknown, reader uncertain:false, no decoy call. Broad /tmp/cg-broad-pr29-f8-closure.{cjs,log}. Adversarial13runtime-backed graph controls pass (original2forms +11nearby controls), /tmp/codegraph-cjs-adversarial7-controls.log. True standalone grouped/template eval, return expressions, inert data/method declarations, call/member/optional/tag/condition-prefix negatives retain tested behavior. These controls do not answer F9 control-body context or F8 await/yield wrappers.
+
+### Next boundary
+
+Review-only user request is complete. STOP: no fixes, additional review loop, external review comment, markready, merge or deploy without user instruction. The per-step confirmation request remains in force. This is round7 overall; no gate/state reset. Repeated grouping-prefix patches now demonstrate syntax-context ambiguity: if user asks for remediation, choose an evidence-based smaller boundary/design instead of another unbounded keyword/punctuation whitelist. Preserve both concrete repros and all prior controls. Do not repeat fullsuite/build on unchanged source. Actual durable result/evidence/checksums saved in original QA .review/commonjs-fix-2026-11-08/pr29-review-round7-2026-11-09/.
+
+
+## AST redesign approved and started — 2026-11-09
+
+User explicitly approved AST redesign in PR29, said near usage max and asked for a resumable start, then said proceed. This revokes prior review-only stop for in-scope remediation; do not ask same approval on resume. Preserve per-step/user and actual gate boundaries for later merges/deployments. No grammar/runtime/dependency/database-schema changes, commits or pushes in this partial phase; PRs remain draft at prior heads.
+
+Newgraph regressions FIRST:3control-body direct-eval variants(if string/template, for nestedgroups) +await/yield CommonJS wrappers,5FAIL51SKIP on current87576a8d. /tmp/codegraph-cjs-ast-red.log, EXIT1. This intentionally RED gate remains unchanged because integration pending.
+
+New isolated src/extraction/commonjs-eval.ts reads existing SyntaxNode tree and checks actual call.function after unwrapping parenthesized_expression. Returns true for syntacticdirectevalcall(anyargument), false for provenabsence, null for parseerrors with no foundcall. New __tests__/commonjs-eval.test.ts loads existingJS/TS/TSXgrammars:33PASS, /tmp/codegraph-cjs-ast-helper.log EXIT0. Controls cover reports, grouped/interpolated eval, return, generatorfunctions/methods, nestednongenerator scope, eval inside yieldwrapper argument, inert data/methods/membercalls, JSX and malformedsource. Helper not wired to classifier/extraction yet. Existing lexical reader/EXPRESSION_PREFIX_WORDS unchanged for now. Do not claim F8/F9 closed, new full/buildpass or finalreview.
+
+IMPORTANT new evidence: existingJSgrammar correctly models control-body eval and awaitwrapper but parses legal CommonJS yield(eval)(code) as yield_expression whose operand is a call on(eval), no parseerrors. ASTscope must distinguish nongeneratorwrapper from generator yield. Helper handles direct yieldoperand only via nearestfunction/generator/methodscope; nested true eval in yield(eval(code)) remains detected. Shapeprobe /tmp/codegraph-cjs-ast-shape-probe.{cjs,log}. Extractionreferenceprobe /tmp/codegraph-cjs-eval-reference-probe.{cjs,log} shows currentextractor emits callref eval for genuinecall AND synthetic yieldwrappercase. Consequently raw existing unresolved eval refs alone are insufficient. User was explicitly told this grammar limitation, not falsely assured all cases are parser-perfect. No grammarfiles changed.
+
+Next integrate factualcallresult through existingextraction to resolver. Node has NO metadata field (onlyedges do); do not invent Node.metadata, abuse signature/selfedges/candidates, or introduce schema migration casually. ExtractionResult can carry optionalfact through workerclone; need native/deferred bypass parity. Main bulk parse pools only load grammars in workers; resolver cannot assume synchronous getParser is ready in main. Suggested project_metadata perfile/sourcehash transport or another small explicit extractioncontext capability; persist/refresh under same successfulstore lifecycle, cover storeworker and sync. Decide carefully before editing infrastructure. Resume must preserve all existing tests and5newred cases; unknown/missing/error facts must not masquerade as provenabsence. Keep existing export-member tokenizer and previous sync/scope/alias fixes intact; remove prefixheuristics only onceASTfacts actuallysupplied.
+
+Saved current3sourcefiles, patchrelative87576a8d, hashes, red/green/probe logs under original QA .review/commonjs-fix-2026-11-08/ast-redesign-started-2026-11-09/. No tests/build/reviewers running at checkpoint. Newfiles intent-to-add only so diffincludes them, not readyforcommit. No fresh dualreviewagents this phase. Overall reviewcount7; do not reset gate/controlstate. Resume directly integration and targeted tests; fullsuite/build only after stablefix, fresh focuseddual review as authorized/actualgatepermits, no repetitivewholeprojectwork. OriginalT0stillstopped/uncommitted; liveem40 unchanged; no merges/deploy/upstream writes.
+
+
+## AST integration execution-tested — verify round8 pending
+
+User approved AST redesign with focused review before final fullsuite, then resumed. Current dirty correction target87576a8d..workingtree,15paths captured /tmp/codegraph-cjs-ast-frozen.json (allnewfilesintent-to-add). No sourcecommit/pushyet; publishedPR29still87576a8d. No grammar/runtime/dependency/schema changes.
+
+Implemented AST fact in ExtractionResult and ephemeralFileRecord property; WASM computes from existingtree, native/deferred routes compute with existinggrammar; kernelmaterializer preservesfact. Allstorepaths carryFileRecord fact through existingwriter, upsertFile writes project_metadata commonjs_eval:<file> containingcontentHash/value. Nosecondwriter orNode.metadata. deleteFile removesfact. Coordinatorcontext acceptsboolean onlyonexact SHA256sourcehash. Missing/malformed/stale/nullfacts returnunknown, neverabsenceproof. Tokenreader removed literalEvalCall/EXPRESSION_PREFIX_WORDS, consults lazyASTfact atmostonceonlywhenbareevaltokenpresent; unknown staysconservative. Existingmembertokenizer/sync/typeFrom/scope unchanged. CHANGELOG alreadyrequiresre-indexafterupgrading(line56), which suppliesnewfacts; no legacyfactmigrationclaimed.
+
+Original5newgraphregressionsRED5FAIL51SKIP beforeintegration. Initialintegratedrun blocked by compiler: hashContentisexportedfromextraction/index, notutils; corrected byusingexistingcreateHashcrypto inresolver (sameSHA256algorithm), no circularextractionimport. Then3files140PASS. AddedrealSQLite factlifecycle4cases(missing/malformed/null, hashstale/replace,rollbackwithfiletransaction, deletion) andfreshindex-vs-sync wrapper->if-eval->yield-wrapper->for-eval->wrapper sequence. Final8files166PASS1SKIP, /tmp/codegraph-cjs-ast-expanded.log, CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2; alsoincludesmemo/synccaches/lazy-engine. Nativebinarynotstaged(codegraph-kernel/prebuilds/linux-x64/codegraph-kernel.node absent); kerneltransporttestskipped. Do not claimnativeexecution. Enginecompiledbytestsetup,currentdistmatchesfrozen sources. No explicitfinalnormalbuild/fullsuiteorindependentreviewyet. Priorfull10666PASSbelongs87576a8donly.
+
+Next eighthfreshnativeREADONLYlanes verify this correction, sameledger andexactGitdiff87576a8d..workingtree. Boundedruntimeprobes only, no fullsuite/build orsourcechanges. CheckF8/F9closure,generator-awareyieldworkaround, actualevalvswrappercallee, sourcehashfactlifecycle/workertransport/sync, previouscontrols. Do not re-audit unrelatedparentlimitations. Stop/reportifreviewfindsissues; do notresetgate/count orclaimClaude-onlyskill.
diff --git a/docs/handoffs/pr29-2026-11-10/history/ast-redesign-started-2026-11-09/commonjs-eval-callee-context.md b/docs/handoffs/pr29-2026-11-10/history/ast-redesign-started-2026-11-09/commonjs-eval-callee-context.md
new file mode 100644
index 0000000000..6978a7daa5
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/ast-redesign-started-2026-11-09/commonjs-eval-callee-context.md
@@ -0,0 +1,62 @@
+# Separate F8 follow-up (review round count remains six)
+
+User explicitly authorized committing/pushing current work to a PR and separating remaining correction. Current snapshot committed5d384989957c91b482068b306535437915a0595b, pushed fix/commonjs-missing-member, DRAFT https://github.com/inth3shadows/codegraph/pull/28 against main. KnownF8 documented, not ready to merge alone. No deploy/merge/upstream report.
+
+New branch fix/commonjs-eval-callee-context based on5d384989. Exact prospective Git target: git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5d384989957c91b482068b306535437915a0595b -- src/resolution/commonjs-export-members.ts __tests__/commonjs-export-members.test.ts __tests__/js-default-binding-members.test.ts
+
+F8 reviewer finding and prior invariants remain in .review/commonjs-missing-member.md; do not reset shared gate/round count. Two sixth reviewers completed; broad demonstrated F8 despite adversarial clearing intended F7 cases. This follow-up has NOT had independent dual review yet.
+
+Correction: distinguish grouping around bare eval from another function's argument list using token before parentheses. Wrapper identifier/call/member/optional-call/tag/control-condition prefixes must not mark exports uncertain. Grouped direct eval, literal/template arguments and expression prefixes such as return must keep prior behavior. Change limited to9helper lines plus independent unit and real-index graph regressions; no matcher/sync/scope changes.
+
+Before fix8FAIL92PASS; tag-result additional case1FAIL49PASS. Final focused2files101PASS, /tmp/codegraph-cjs-eval-followup-focused.log. Build/full pending. Hashes /tmp/codegraph-cjs-followup-frozen.json. Logs /tmp/codegraph-cjs-eval-followup-{before,tag-before,focused,build}.log. Need staged exact3-file diff, personal repo/identity and actual build result before commit/push. Full normal suite required before readiness claim. Keep follow-up draft and explicitly state review pending. No additional reviewer agents launched in this follow-up; user plans to point agents at PRs.
+
+Keep both PRs draft. Follow-up base should be fix/commonjs-missing-member, producing only the small correction diff. Review/merge follow-up into parent branch before considering parent PR for main; no merge authorized by current request. Preserve original T0 pilot and all deploy/control worktrees.
+
+Published DRAFT https://github.com/inth3shadows/codegraph/pull/29, commit87576a8d9ff0d8aba235db5535f5f4429f14b037, base fix/commonjs-missing-member/PR28 at5d384989. Explicit buildPASS; normal full suite RUNNING session62594, /tmp/codegraph-cjs-eval-followup-full.log. Both pushed/draft, neither merged/deployed; follow-up independent review stillpending. Original T0 untouched.
+
+
+FINAL execution verification2026-11-09: normal full suite session62594 EXIT0,873filesPASS19SKIP,10666testsPASS2expectedFAIL448SKIP0unexpectedFAIL,800.20sec. /tmp/codegraph-cjs-eval-followup-full.log. 101focusedPASS and explicit buildPASS on same87576a8dsource. Final3changed-file SHA256 checks PASS, trackedtreeclean; actual remoteheads rechecked5d384989(PR28) and87576a8d(PR29). PR29 body updated with exact final validation. Both PRs still DRAFT/unmerged; no deployment/upstream write. FOLLOW-UP INDEPENDENT REVIEW STILL PENDING: do not conflate fullsuite with review clearance. No further tests/build/review processes running. Saved final checkpoint and full log under original QA two-draft-prs backup.
+
+
+## Seventh native review explicitly requested — PR29 — 2026-11-09
+
+User invoked /dual review29. Exact GitHub base5d384989957c91b482068b306535437915a0595b and head87576a8d9ff0d8aba235db5535f5f4429f14b037 verified. Fresh read-only native lanes review_broad_pr29_round7 and review_adversarial_pr29_round7 launched together with same exact Git target and this ledger. Both focus full3-file29-line correction, F8 closure and nearby invariants; bounded execution probes only, no repeat full/build or source edits. Parent does not reread reviewed diff or duplicate reviewer probes. No review results yet; no independent clearance claim. Do not reset round count/gate, change source, push, merge or deploy in this review-only turn. Stop and report merged findings when both complete.
+
+
+## Seventh native dual review result — PR29 — 2026-11-09
+
+Both fresh read-only lanes completed normally: review_broad_pr29_round7 and review_adversarial_pr29_round7. Exact target remains5d384989957c91b482068b306535437915a0595b..87576a8d9ff0d8aba235db5535f5f4429f14b037. Source hashes verified unchanged, trackedtreeclean except private untracked.review. No source edits/build/fullsuite reruns/commits/pushes/GitHubcomments/merge/deploy. Both PRs remain draft. Current review DOES NOT CLEAR PR29 despite prior101focusedPASS/full10666PASS/buildPASS. Parent merges findings from actual final reports without re-verifying/re-reading diff.
+
+### F9 — P2 — Preserve grouped direct eval in control-statement bodies (BOTH)
+
+Broad location src/resolution/commonjs-export-members.ts:31: rejects any preceding ), including a completed if or for condition. Exact input `class Store { load() { return 42; } }
+if (true) (eval)('exports.load = Store.prototype.load;');`. Runtime exports load() returning42, but current discovery uncertain:false and indexing named.load() produces no call. Removing only new prefix guard in memory restores uncertain:true and m.js:Store::load. Nested grouped eval in unbraced single-iteration for body reproduces too. Broad evidence /tmp/cg-broad-pr29-control-context.{cjs,log}; exact command `node --experimental-wasm-exnref --experimental-wasm-stack-switching /tmp/cg-broad-pr29-control-context.cjs`.
+
+Adversarial independently confirms same location/trace; grouped-template if-body and for-body also reproduce. Evidence /tmp/codegraph-cjs-adversarial7-conditional-eval.{cjs,log}. De-duplicated as one P2 F9. This is a NEW regression introduced in PR29, not a pre-existing parent limitation.
+
+### F8 — P2 — PARTIALLY CORRECTED, remains for contextual-keyword wrapper names (adversarial)
+
+Exact reviewer location src/resolution/commonjs-export-members.ts:29 (whitelist:7). Valid CommonJS `function await(value){return function ignore(code){};} await(eval)("ignored");` passes eval without invoking it, but whitelist exemption produces uncertain:true and falsely resolves named.missing() to decoy.js:Decoy::missing. With exports.known=function known(){}, runtime exports only known; pre-F7 behavior restored in memory produces no call. yield reproduces too. Evidence /tmp/codegraph-cjs-adversarial7-contextual-wrapper.{cjs,log}. This is a RESIDUAL F8 variant, not a new unrelated parent re-audit. Do not label all F8 closed.
+
+### Confirmed preservation / rulings
+
+Both independently clear original F8 forms wrap(eval)("ignored") and wrap((eval))(("ignored")): runtime onlyknown, reader uncertain:false, no decoy call. Broad /tmp/cg-broad-pr29-f8-closure.{cjs,log}. Adversarial13runtime-backed graph controls pass (original2forms +11nearby controls), /tmp/codegraph-cjs-adversarial7-controls.log. True standalone grouped/template eval, return expressions, inert data/method declarations, call/member/optional/tag/condition-prefix negatives retain tested behavior. These controls do not answer F9 control-body context or F8 await/yield wrappers.
+
+### Next boundary
+
+Review-only user request is complete. STOP: no fixes, additional review loop, external review comment, markready, merge or deploy without user instruction. The per-step confirmation request remains in force. This is round7 overall; no gate/state reset. Repeated grouping-prefix patches now demonstrate syntax-context ambiguity: if user asks for remediation, choose an evidence-based smaller boundary/design instead of another unbounded keyword/punctuation whitelist. Preserve both concrete repros and all prior controls. Do not repeat fullsuite/build on unchanged source. Actual durable result/evidence/checksums saved in original QA .review/commonjs-fix-2026-11-08/pr29-review-round7-2026-11-09/.
+
+
+## AST redesign approved and started — 2026-11-09
+
+User explicitly approved AST redesign in PR29, said near usage max and asked for a resumable start, then said proceed. This revokes prior review-only stop for in-scope remediation; do not ask same approval on resume. Preserve per-step/user and actual gate boundaries for later merges/deployments. No grammar/runtime/dependency/database-schema changes, commits or pushes in this partial phase; PRs remain draft at prior heads.
+
+Newgraph regressions FIRST:3control-body direct-eval variants(if string/template, for nestedgroups) +await/yield CommonJS wrappers,5FAIL51SKIP on current87576a8d. /tmp/codegraph-cjs-ast-red.log, EXIT1. This intentionally RED gate remains unchanged because integration pending.
+
+New isolated src/extraction/commonjs-eval.ts reads existing SyntaxNode tree and checks actual call.function after unwrapping parenthesized_expression. Returns true for syntacticdirectevalcall(anyargument), false for provenabsence, null for parseerrors with no foundcall. New __tests__/commonjs-eval.test.ts loads existingJS/TS/TSXgrammars:33PASS, /tmp/codegraph-cjs-ast-helper.log EXIT0. Controls cover reports, grouped/interpolated eval, return, generatorfunctions/methods, nestednongenerator scope, eval inside yieldwrapper argument, inert data/methods/membercalls, JSX and malformedsource. Helper not wired to classifier/extraction yet. Existing lexical reader/EXPRESSION_PREFIX_WORDS unchanged for now. Do not claim F8/F9 closed, new full/buildpass or finalreview.
+
+IMPORTANT new evidence: existingJSgrammar correctly models control-body eval and awaitwrapper but parses legal CommonJS yield(eval)(code) as yield_expression whose operand is a call on(eval), no parseerrors. ASTscope must distinguish nongeneratorwrapper from generator yield. Helper handles direct yieldoperand only via nearestfunction/generator/methodscope; nested true eval in yield(eval(code)) remains detected. Shapeprobe /tmp/codegraph-cjs-ast-shape-probe.{cjs,log}. Extractionreferenceprobe /tmp/codegraph-cjs-eval-reference-probe.{cjs,log} shows currentextractor emits callref eval for genuinecall AND synthetic yieldwrappercase. Consequently raw existing unresolved eval refs alone are insufficient. User was explicitly told this grammar limitation, not falsely assured all cases are parser-perfect. No grammarfiles changed.
+
+Next integrate factualcallresult through existingextraction to resolver. Node has NO metadata field (onlyedges do); do not invent Node.metadata, abuse signature/selfedges/candidates, or introduce schema migration casually. ExtractionResult can carry optionalfact through workerclone; need native/deferred bypass parity. Main bulk parse pools only load grammars in workers; resolver cannot assume synchronous getParser is ready in main. Suggested project_metadata perfile/sourcehash transport or another small explicit extractioncontext capability; persist/refresh under same successfulstore lifecycle, cover storeworker and sync. Decide carefully before editing infrastructure. Resume must preserve all existing tests and5newred cases; unknown/missing/error facts must not masquerade as provenabsence. Keep existing export-member tokenizer and previous sync/scope/alias fixes intact; remove prefixheuristics only onceASTfacts actuallysupplied.
+
+Saved current3sourcefiles, patchrelative87576a8d, hashes, red/green/probe logs under original QA .review/commonjs-fix-2026-11-08/ast-redesign-started-2026-11-09/. No tests/build/reviewers running at checkpoint. Newfiles intent-to-add only so diffincludes them, not readyforcommit. No fresh dualreviewagents this phase. Overall reviewcount7; do not reset gate/controlstate. Resume directly integration and targeted tests; fullsuite/build only after stablefix, fresh focuseddual review as authorized/actualgatepermits, no repetitivewholeprojectwork. OriginalT0stillstopped/uncommitted; liveem40 unchanged; no merges/deploy/upstream writes.
diff --git a/docs/handoffs/pr29-2026-11-10/history/ast-redesign-started-2026-11-09/commonjs-missing-member.md b/docs/handoffs/pr29-2026-11-10/history/ast-redesign-started-2026-11-09/commonjs-missing-member.md
new file mode 100644
index 0000000000..2f6d3e4243
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/ast-redesign-started-2026-11-09/commonjs-missing-member.md
@@ -0,0 +1,215 @@
+# CommonJS missing-member review ledger
+
+Target: /tmp/codegraph-cjs-missing-fix-20261108, branch fix/commonjs-missing-member. Base 5e0664891af0e87e6fd18bbfa16cab39237570f5 to current tracked working tree, unchanged while both reviewers run. Exact diff: `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5e0664891af0e87e6fd18bbfa16cab39237570f5 -- CHANGELOG.md src/resolution/name-matcher.ts __tests__/js-default-binding-members.test.ts`.
+
+Round1 pending two fresh read-only native lanes. No Claude-only /code-review invocation. No resolver fix existed previously; user explicitly authorized implementation and dual review. Fork issue27 is the bug, QA PR27 is evidence only. No official upstream submission before Tuesday verification.
+
+## Findings / fix map
+
+- F1: confirmed upstream defect. `const named=require('./m'); named.missing()` with m.js exporting only known falsely calls unimported Decoy::missing; ref keeps receiver, resolvedBy instance-method/provenance null. Default imports and class-name-alias collision variants also reproduced. Sync adding decoy also fabricates call. Proposed tracked working-tree fix adds default bindings to imported-receiver guard and moves guard before unrelated class-name matching, after actual import/typed/object resolution. Requires reviewer execution and clearance.
+- P0 test baseline: new20-case file on unmodified resolver:15 PASS /5 FAIL. The5 failures are3 parameterized default/require+decoy cases,1 forwarding-module missing member,1 sync-add-decoy. Log /tmp/codegraph-cjs-fix-baseline2.log. No production code edit before this run. Initial baseline command failed because Vitest4 removed --minWorkers; corrected to --maxWorkers=4. Initial two new-test authoring corrections: object variable API used instead of unsupported direct object-literal shorthand shape; expected local object's qualified name corrected to actual fully-qualified extraction name. Neither changes an existing baseline test.
+
+## Rulings / limits
+
+- Direct `module.exports = { read() {} }` without an assigned variable already lacks correct member recovery on base and can be captured by a method decoy. This change must stop wrong calls; new object API positive uses baseline-supported `const api={read(){}}; module.exports=api`. Do not broaden into object-export extraction or claim direct shorthand recovery is implemented.
+- Bare external-package import exact-match issue26 remains separate and unfixed.
+- No import mapping semantics changes, no blanket conversion of require to namespace imports, no source code changes outside one name-matcher guard and changelog/tests.
+- This is a remaining variant of closed upstream2952/merged3162. No global novelty claim. Reproduced on em40/pristine main/pristine release. Native kernel unverified; local deployment is kernel0/WASM.
+
+## Invariants / commands
+
+- Actual exported member resolves beside an unrelated same-name method; missing member has no call. Forwarded CommonJS module preserves real export.
+- Stated CommonJS class static method, assigned object member, instance method, callable direct/default + attached function all remain correct beside decoys.
+- Existing ES default class, instance, typed variable, ambient export=, ordinary ESM namespace, named/anonymous/renamed functions retain calls.
+- Typed local parameters and object literal bindings shadowing default imports retain their local member calls.
+- Sync adds/removes a real export correctly; sync adding/removing a same-name unrelated method never fabricates missing-member calls.
+- Check these with `cd /tmp/codegraph-cjs-missing-fix-20261108 && CODEGRAPH_KERNEL=0 npx vitest run __tests__/js-default-binding-members.test.ts --maxWorkers=1`.
+- Expanded focused suite currently running: js-default-binding-members, commonjs-require-calls, commonjs-require-imports, commonjs-exports, require-default, import-default-as, namespace-object-resolution, import-object-member-namesake, sync-default-export-change, sync-import-member-retry, out-of-repo-import-shadow. Log /tmp/codegraph-cjs-fix-focused.log. Full normal suite/build pending.
+- Additional adversarial probes: class name matching alias, nested receiver paths, defaults with inherited/static/object APIs, lexical shadows and live sync. Each defect needs concrete input/actual wrong output; no style requests or hypothetical findings.
+
+## Round1 review outputs and remediation
+
+Both native lanes finished read-only. Each independently reported the same two P2 regressions at name-matcher.ts:24944; no other demonstrated findings.
+
+- R1 (broad+adversarial): `class Store { load() {} }; module.exports = new Store()` loses its legitimate instance call. Adversarial also demonstrated `export default new Store()` with Store not separately exported. Both base em40 produce Store::load; initial guard none. Remediation: resolve a whole explicit constructor expression to its actual module's local/imported class before the guard. Follow CommonJS forwarding; mask strings/comments/regexes, balance constructor arguments and type arguments, reject chained expressions, memoize with existing export index. Never re-enable generic method-name guessing for default bindings.
+- R2 (broad+adversarial): visible local `class named { static missing(){} }` shadows a default/namespace import; moving guard ahead of class strategy drops correct own-file call. Broad also tested enclosing-function shadow. Remediation: guard exempts a class declaration in the reference's file only when existing isLexicallyReachable proves it visible. Other-file alias-name class decoy remains blocked.
+- Review regression tests run BEFORE remediation: /tmp/codegraph-cjs-fix-review-baseline.log,24 cases19PASS5FAIL (original CommonJS positive +2 constructed-default variants +2 lexical class shadow variants). This pins both findings. Additional constructor argument/forwarder/text controls added; simple first remediation failed3nested/multiline/regex constructor positives in /tmp/codegraph-cjs-fix-constructors-baseline.log before argument-reader correction.
+- After remediation: /tmp/codegraph-cjs-fix-focused4.log,11 files99PASS1SKIP. Final focused run adds no-parentheses and spaced CommonJS constructor controls; /tmp/codegraph-cjs-fix-focused-final.log pending. Earlier temporary TS compile error from passing Language to CommentLang was corrected to JS-family typescript comment handling; not a passing run.
+
+The exact R1 reviewed name-matcher source is saved in .review/round1-name-matcher.ts and reconstructed hash verified against the recorded Git blob512a77a155299de8e6890447aa2d3aea7b81a1f9. Name-matcher remediation diff: `git diff --no-index /tmp/codegraph-cjs-missing-fix-20261108/.review/round1-name-matcher.ts /tmp/codegraph-cjs-missing-fix-20261108/src/resolution/name-matcher.ts`. Import-resolver and new tests are also remediation, diff from5e066489. No intermediate failing-source commit was made.
+
+Verify2 target is current tracked working tree relative5e066489, including CHANGELOG.md, src/resolution/name-matcher.ts, src/resolution/import-resolver.ts, __tests__/js-default-binding-members.test.ts. Check R1/R2 on all paths, all invariants, and defects introduced by remediation. Do not re-raise the pre-existing direct module.exports object-literal recovery limit without new evidence. Full build/suite pending. No merge/deployment occurred.
+
+## Verify2 result — NOT cleared; namespace-only redesign supersedes that target
+
+Both fresh native lanes finished; all findings P2. Broad reported first textual constructor overriding inactive/overwritten exports, valid inline/parenthesized constructors losing calls (R1 still open), and constructor-derived calls remaining stale after sync. Adversarial independently reported constructor lookup overriding typed/object/class lexical shadows (R2 still open), earlier constructor overriding a later stated default, and stale constructor-derived calls after sync. Exact evidence scripts/results under /tmp/cg-broad-verify2-* and /tmp/codegraph-cjs-verify2-*; complete reviewer messages returned to root. Existing explicit-default resolution was safer than the attempted new inference.
+
+Both lanes advised that a smaller boundary is coherent: extend module-namespace ownership only to a require/default whose resolved JS/TS target has no stated or uncertain value default; preserve all existing explicit/unknown default-value inference. Whole-file CommonJS forwarding can follow a namespace leaf; ambiguous assignments/default values must stay base behavior. No nonexistent redesigned code was reviewed or cleared by those design messages.
+
+Implemented redesign: REMOVED all added import-resolver source code; that file is byte-identical to base again. Removed unsafe constructor parsing/inference entirely. Name-matcher now uses existing context.resolveModuleFile, a per-context namespace-classification memo (cleared with existing memos), conservative source checks, pure whole-file forwarders only, bounded/cycle-safe traversal, language-qualified memo keys and JS/TS extensions only (no implicit component defaults). Any raw default keyword/export= or uncertain module use excludes the new guard; comments/text may conservatively prevent a classification. Move-before-class guard keeps lexical own-file class exemption. Changelog narrowed to modules without a value default.
+
+Scope/ruling: arbitrary stated/unknown exported default values and their guessed-member limitations remain pre-existing and explicitly OUTSIDE this fix. Do not claim every default-import missing-member case fixed. Removed new constructor-parser feature tests after deleting that feature, retaining baseline-supported CJS/ESM singleton, stated class/object/callable, lexical shadows and every original missing-module regression. Two dedicated singleton controls initially asserted disambiguation between two .load methods that base itself cannot provide; corrected their newly-authored fixture to a unique .load method, preserving the actual base invariant. Original broader CJS store-vs-decoy control remains unchanged. No baseline existing assertion was weakened.
+
+Full suite on superseded constructor candidate was STOPPED intentionally via guarded SIGINT to only this checkout's Vitest PID702277; final exec83750exit130. It did not pass and must not be reported as a test failure count/green gate. /tmp/codegraph-cjs-fix-full.log belongs that obsolete target. Latest redesigned focused13-file run /tmp/codegraph-cjs-fix-redesign-focused2.log RUNNING; verify actual exit/summary. Explicit build and redesigned full suite remain required.
+
+Third-review exception requested via async user question: skill says third round only if verify found something high severity; these were P2. Await user's explicit answer before launching further reviewers. Both agents' conceptual agreement is not final dual-review clearance. No source commit/push/fix PR/merge/deploy occurred. Original user's conditional merge/deploy request remains dependent on a reviewed green fix; original T0 stays stopped.
+
+## Final testing and local commit — authoritative current state
+
+Namespace redesign focused suite13files108PASS1SKIP, explicit npm run build exit0. Full normal suite exec60370EXIT0:872filesPASS19SKIP;10589testsPASS,2expectedFAIL,448SKIP,0unexpectedFAIL,799.56seconds. /tmp/codegraph-cjs-fix-redesign-full.log. Original portable6-case bug reproduction6/6PASS. Existing independent18-case records match em40baseline exactly. Namespace-to-value default change sync agrees with fresh index (initial no calls, synced/fresh Store::load); /tmp/codegraph-cjs-namespace-sync-probe.{cjs,jsonl}. Native kernel not validated.
+
+Personal repository/remote/identity, source checksums against preserved tested snapshot, staged3-file set and staged diff/check verified before local commit. LOCAL COMMIT d18e40970fc5fbf32f635f6d8d536d1bdb24dacc, tree2363dd0f8923ca59c28a3e45a477573e7364e7c2, branch fix/commonjs-missing-member. Tracked working tree clean; only private .review untracked. No push/fix PR/merge/deployment. Review target now `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5e0664891af0e87e6fd18bbfa16cab39237570f5..d18e40970fc5fbf32f635f6d8d536d1bdb24dacc -- CHANGELOG.md src/resolution/name-matcher.ts __tests__/js-default-binding-members.test.ts`.
+
+Third review still requires the pending user answer. User's later status question did NOT approve it. If authorized use two fresh native lanes with fork_turns=none and self-contained briefs/ledger to avoid carrying unrelated history. Preserve final tests; no redundant full rerun unless code or unresolved concerns change the tested tree. Verification and logs/source/patch are backed up under original QA .review/commonjs-fix-2026-11-08/verification.json and adjacent artifacts. Current canonical handoff handoff-codegraph-commonjs-tested-review-pending-2026-11-08.md supersedes running/constructor handoffs.
+
+## Third round authorized and running
+
+User explicitly answered yes to the third-review request, then asked why another round was needed. Explained earlier reviews covered replaced code while the tested final commit had not been independently reviewed. This question did not revoke approval. Started fresh read-only review_broad_commonjs_final3 and review_adversarial_commonjs_final3 with fork_turns=none, the exact base..d18e4097 target and this ledger, compact self-contained briefs and no full-suite rerun. Their results remain pending. Source unchanged; no push/merge/deployment.
+
+## Third round result — 2026-11-09 — NOT READY TO MERGE
+
+Exact target remains local d18e40970fc5fbf32f635f6d8d536d1bdb24dacc. Tracked tree clean, .review untracked; no source changes after passing tests. User resumed; collected broad final answer and adversarial confirmed messages. Broad lane completed normally. Adversarial lane delivered independently confirmed findings/evidence, then failed finalization with a usage-limit error (retry notice Nov9 1:10AM). Do NOT claim that lane completed normally, final clearance, or a green dual review. No push/PR/merge/deployment.
+
+### F3 — P2 — Namespace classification changes do not invalidate existing guessed calls (broad, independently confirmed adversarial)
+
+Broad location src/resolution/name-matcher.ts:25398. Start with `class Store { load() {} }; module.exports = new Store()` and an unchanged caller requiring that module and calling `.load()`. Replace the export with `exports.known = function known() {};`, retaining the class. After cg.sync(), the graph still calls Store::load; a fresh index correctly produces no call. The new module-text dependency needs to reopen existing member guesses when export shape changes.
+
+Broad reproduction /tmp/cg-broad-final3-sync-reverse.cjs; final evidence /tmp/cg-broad-final3-sync-reverse.log. Baseline comparison confirms its sync and fresh results both retained Store::load (/tmp/cg-broad-final3-sync-reverse-base.log). Adversarial independently reproduced direct and pure forwarder value->namespace->value->namespace retaining Store::load on every sync: /tmp/codegraph-cjs-final3-sync.cjs. Minimum correction recommendation: reopen default-import member guesses when imported module export text/shape changes, or record the imported source dependency on guesses allowed by a false namespace classification.
+
+### F4 — P2 — Explicitly exported callable aliases lose their calls (adversarial confirmed before usage limit)
+
+Location reported src/resolution/name-matcher.ts:25427. m.js `class Store { load() { return 42; } }\nexports.load = Store.prototype.load;`; use.js `const named=require('./m');\nexport function run(){named.load();}`. em40 calls m.js:Store::load; final emits no call. Same independently confirmed for `module.exports.load = Store.prototype.load`. Runtime named.load returns42 and Object.keys(module)=['load']. This is an explicitly exported callable, not the ruled-out direct object/default-value guessing limit. Prototype mutation variants group with the same uncertain-exports classification problem.
+
+Evidence /tmp/codegraph-cjs-final3-export-alias.cjs and /tmp/codegraph-cjs-final3-adversarial{,-base.jsonl,-final.jsonl}. Recommendation: preserve uncertain named-export RHS APIs or resolve the actual callable alias before blocking a fallback. Do not reopen arbitrary guesses for absent exports.
+
+### F5 — P2 — Out-of-scope local class bypasses namespace guard (adversarial confirmed before usage limit; original finding remains open on this path)
+
+Reported location src/resolution/name-matcher.ts:25397 (guard local-class exemption, around25396). Valid CJS: m.js `exports.known=function known(){};`; use.js lines1..8:
+`const named=require('./m');`
+`function run(){`
+`if(true){`
+`class named {static missing(){}}`
+`}`
+`named.missing();`
+`}`
+`module.exports=run;`
+Final returns use.js:run::named::missing atline6, though the class is block-local and imported module has no missing. Also reproduced for a class inside TS namespace Parent. These outputs pre-exist on base, but this is a still-open original false-positive path bypassing the new guard: existing isLexicallyReachable does not establish block visibility. Recommendation: require actual enclosing lexical block visibility before exempting a class. Preserve the genuine inner/enclosing-function shadow controls.
+
+## Merge decision / next boundary
+
+HOLD d18e4097. Passing build/full/focused tests remain factual, but F3/F4 are demonstrated regressions and F5 remains an intended missing-member path. No further agents, tests, source fixes or outward actions started after these reports. Do not rerun the full suite until a changed candidate requires it. User required confirmation before subsequent steps; present this concrete review result and seek the next bounded correction/verification decision. Fourth review is not preauthorized by approval of the third; native review gate may deny round4, so stop and ask rather than bypass. Agent quota exhaustion is additional reason not to relaunch a failed lane automatically.
+
+## Corrections authorized — 2026-11-09
+
+User: if findings are separate, report them; if related, fix them. All three are related: F3/F4 regressions introduced by this guard, F5 remaining original namespace missing-member path. No new issue filing or outside bug work needed. Authorized correcting all three in this branch; no extra reviewer lane or outward action started.
+
+Fail-before tests:11 new regressions fail and24 existing pass on d18e4097, /tmp/codegraph-cjs-fix-r3-regressions-before.log. New tests cover direct and forwarded value->namespace->value->namespace sync vs fresh; explicit dotted/bracket export aliases beside a still-absent-member decoy; alias removal by sync; out-of-scope sibling-block classes vs genuine same-block inner callers; TSnamespaceclassscope.
+
+Changes: F3 uses existing typeFrom dependency tracking on byName default-import member calls, includes each pure-forwarder file; activates the existing dependency-edge reopener for JS/TS paths while keeping failed-attribute retry Python-only. F4 namespace info tracks explicit assigned member names; new guard applies only to absent names. Escaping/computed/prototype-mutated exports remain uncertain and preserve existing behavior. F5 adds existing holderScopeAt block visibility to the class-shadow exemption, retaining function lexical visibility as well. Namespace memo stores traced files/member names; cache not poisoned by depth/cycle cutoffs.
+
+First focused verification AFTER all three corrections:3files49PASS0FAIL, /tmp/codegraph-cjs-fix-r3-regressions-after.log. Includes full35-case default-member suite and memo clearing/lifetime. No existing expected assertion weakened. Pending expanded JS/Python sync controls, normal full suite/build and original6-case repro. No new commit yet; earlier full pass applies d18e4097 only. Current changed files test + name-matcher + src/index.ts + src/extraction/index.ts. No unsafe constructor inference, import-resolver unchanged. Fourth review not yet requested/launched; gate and quota limits remain applicable.
+
+## Corrected commit verified by execution — independent review pending
+
+F3 class-name path also pinned: two new uppercase Store import-alias sync cases failed when only byName answers carried dependency metadata; /tmp/codegraph-cjs-fix-r3-upper-before.log. Final correction records imported-module inputs on name-matcher default-member answers from both class-name and method-name strategies. No change to confidence/byName selection. All original regression assertions retained.
+
+FINAL source tests:16files206PASS1SKIP, including37default-membercases, JS imports/sync andPythonattribute/memo controls. Log/tmp/codegraph-cjs-fix-r3-focused-final.log. Full normal suite exec42040EXIT0:872filesPASS19SKIP,10602testsPASS2expectedFAIL448SKIP0unexpectedFAIL,771.60seconds, /tmp/codegraph-cjs-fix-r3-full.log. Explicit npm run build exec37438EXIT0, /tmp/codegraph-cjs-fix-r3-build.log. Original portable6-case bug reproducer6/6PASS, /tmp/codegraph-cjs-corrected-final-sixcases.log. Node22.22.2/kernel0WASM; native not claimed. Source checksums prove no source changes between focused/full/build/testing and commit.
+
+LOCAL CORRECTION COMMIT559c76df6afd9e40f4d617ff77caa7db4ad03955, tre eb81d2063f4e787da5cfc7d28c619078fdc86e6b6, parentd18e40970fc5fbf32f635f6d8d536d1bdb24dacc. Personalrepository/remote/identity/stagedexact4-filediff andchecks verified. Trackedtreeclean, onlyprivate.reviewuntracked. No push/fixPR/merge/deploy or issuefiling. F3/F4/F5 status CORRECTED+executionPASS, awaiting independent verification; do not claim native review clearance.
+
+FOURTH ROUND ANSWER PENDING: async question asked permission and quoted ~/.codex/AGENTS.md: "where Claude's gate would ask the user at round 4, Codex denies, so stop and ask." User has not answered that new question; elapsed time is not approval. Do not launch fourth reviewers yet or modify gate state/control files. If approved use2freshread-onlynativefork_turns=none, same ledger, correction target `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff d18e40970fc5fbf32f635f6d8d536d1bdb24dacc..559c76df6afd9e40f4d617ff77caa7db4ad03955 -- src/resolution/name-matcher.ts src/index.ts src/extraction/index.ts __tests__/js-default-binding-members.test.ts`. Brief F3-F5, currentcorrections+invariants; no fullsuite rerun unless changes/failures justify it. Stop/ask if gate denies; last third adversarial lane failed finalization due usage cap, don't fabricateclearance.
+
+Durable original-workspace backup .review/commonjs-fix-2026-11-08/corrections-2026-11-09/:4sourcefiles, corrections.patch, checksums.json, before/after/focused/full/build/reprologs, verification.json identifyingfinalcommit/tree/outcomes, verified commonjs-fix.bundle containingbothlocalfixcommits with originalbase5e066489prerequisite. Commit recovery does not depend on /tmp survival. Current canonical handoff handoff-codegraph-commonjs-corrected-review-pending-2026-11-09.md supersedes corrections-running and review-blocked handoffs. OriginalT0unchanged/stopped; Tuesdayconditionalupstreamreport unchanged.
+
+## Fourth verification and modular correction — 2026-11-09
+
+User asked whether errors remain and approved proceeding, specifically requesting a smaller modular strategy for any remaining fix. Two fresh read-only minimal-context lanes review_broad_commonjs_verify4 and review_adversarial_commonjs_verify4 completed. BOTH independently CLEARED F3 direct/forwarded sync for ordinary and class-name aliases; F4 dotted/bracket callable/prototype aliases and removal sync; F5 block/namespace visibility and genuine inner shadows. Adversarial also verified Python failed-call retry/retyping and zero Python retry on JS-only edits. No full/build reruns or source edits by reviewers.
+
+F6 — P2 — src/resolution/name-matcher.ts:25444 raw exported-member discovery accepts comments, strings, regex literals, and unrelated object properties. With m.js exporting only known, adding `// exports.missing = fake;` or `function setup(holder) { holder.exports.missing = 42; }` makes named.missing falsely call decoy.js:Decoy::missing. Clean source has no call. Quoted/template/regex variants reproduce. This is newly added member inclusion, not the previous conservative default-text exclusion ruling. Exact broad evidence /tmp/cg-broad-verify4-classifier.{cjs,log}, /tmp/cg-broad-verify4-probes.cjs; adversarial /tmp/codegraph-cjs-verify4-extra.cjs. Both recommended one isolated token-aware collector validating executable assignments and bare exports/module.exports roots.
+
+Following user's authorized strategy: extracted readCommonJsExportMembers into new48-line(initial) src/resolution/commonjs-export-members.ts, with independent __tests__/commonjs-export-members.test.ts. Replaced matcher raw member/escape scanning with one helper call. Uses exact pinned production js-tokens9.0.1 (CommonJS, built-in types,16071unpackedbytes per officialnpmmetadata), no hand-written lexer or changedsharedstrip-comments scanner. Existingnamespace/default ownership tracing, sync/typeFrom and holderScopeAt behavior retained. Newpackage9chosen to keep CJS compatibility; upstream latestREADME refers to newerESMrequirebehavior. Source tokenizer was verified from officialrepo docs and installed package/types. No Node/packageversionbump.
+
+Fail-before graph regressions:8FAIL/37SKIP on559c76df, /tmp/codegraph-cjs-modular-before.log. New helper independently tests executable dot/bracket writes, template expressions/nesting, TSgenerics, JSXtext-vs-expressions, line/block comments, strings/templates/regex/control-regex, unrelated/Unicode/dollar roots, equality/typequeries, uncertain/prototype/computed APIs. Initial4files89PASS. Additional2positive runtime-API controls (literal eval export and require.cache default) exposed2FAIL before uncertainty handling; /tmp/codegraph-cjs-modular-uncertain-before.log. Added explicit uncertainty for literal eval code and Node module/cache APIs, preserving genuine dynamic exports while ordinary data remains opaque. All existing expected assertions retained.
+
+Latest modular focused gate18files260PASS1SKIP, /tmp/codegraph-cjs-modular-expanded-final.log; includes47default-member graph cases,38pure helper cases, priorJS/Python/sync/memo/lazy-engine controls. Source remains dirty relative559c76df in6files: newhelper/newunit test (intent-to-add makes visible in Gitdiff), existing integrationtest/matcher and package.json/package-lock. No new commit yet. No outwardactions. Full current modular suite/build still pending; parent10602PASS does not cover new modular code.
+
+User's conditional approval includes correcting any residual error with this smaller strategy and verifying it. Next fresh verification target is559c76df..working tree, sameledger and6paths; keep native round count honest (fifthverification), no target/state reset. Stop/ask if host gate denies; do not bypass. Review ONLY F6 closure and regressions of helper/adapter/dependency, plus bounded preservation checks. Source stable after260focusedPASS; no repeatedfull/build by reviewers. Prefer existingdist+scratch probes; underlyingthree corrections already independently cleared.
+
+
+## Fifth verification — modular source reader, 2026-11-09
+
+Fresh read-only lanes review_broad_commonjs_modular5 and review_adversarial_commonjs_modular5 both completed. Both cleared F6 phantom comments/strings/templates/regex and unrelated roots, plus preservation of real aliases, sync, scope and Python behavior. Production js-tokens9.0.1 packaging compatibility cleared. No source edits or redundant full-suite runs by reviewers.
+
+F7 — P2 — src/resolution/commonjs-export-members.ts:37 recognizes eval uncertainty only when a bare eval immediately receives a StringLiteral. Both reviewers reproduced template-literal eval dropping a real Store::load call. Adversarial additionally reproduced `(eval)('exports.load = Store.prototype.load;')`. Both runtime mutations return42; previous reader preserves Store::load, current reader emits no calls. Literal single-quoted bare eval control remains green. Evidence /tmp/codegraph-cjs-adversarial5-eval.{cjs,log}. Fix only the small helper: account for grouped bare eval callee and template literals, preserve class method named eval as non-call text. Add fail-before controls; do not alter name-matcher, sync or scope corrections for F7.
+
+Pre-F7 modular full normal suite EXIT0, 873 files PASS19SKIP, 10650 tests PASS2expectedFAIL448SKIP0unexpectedFAIL,780.27sec. /tmp/codegraph-cjs-modular-full.log. This run does not cover the upcoming F7 correction. Current source remains local and dirty relative559c76df. No push, source PR, merge, deployment or upstream report. Original T0 pilot remains stopped/uncommitted.
+
+
+F7 correction: literalEvalCall now unwraps paired bare-callee parentheses and grouped arguments, accepts StringLiteral/NoSubstitutionTemplate/TemplateHead. Does not execute eval or inspect data token contents; method declaration named eval remains ignored. Added4 pure-reader controls and2 graph positives. Before change:6FAIL85PASS (/tmp/codegraph-cjs-modular-eval-before.log); after:91PASS across2files (/tmp/codegraph-cjs-modular-eval-after.log). git diff --check PASS. No changes to the matcher adapter, sync or scope for F7. Full-suite PASS above predates this correction; normal final full suite and independent review of the F7 correction remain pending. Local changes uncommitted. Build result pending.
+
+Explicit final F7 npm run build EXIT0, /tmp/codegraph-cjs-modular-eval-build.log; viewer,29grammars,runtime and dist engine checks PASS. Final full suite and independent F7 verification still pending; do not conflate pre-F7 full pass with final-tree clearance. Checkpoint backup .review/commonjs-fix-2026-11-08/modular-eval-2026-11-09/ in original QA workspace contains6current sourcefiles, cumulative and modular patches, hashes, logs and this ledger. Source unchanged since91focusedPASS/build.
+
+
+## Sixth verification authorized and running — 2026-11-09
+
+User explicitly answered yes to final verification. Fresh read-only native lanes review_broad_commonjs_eval6 and review_adversarial_commonjs_eval6 launched against559c76df..workingtree six modular paths and same ledger. No gate reset/bypass or Claude-only skill claim. Both focus F7 closure and neighboring invariants; no full/build reruns by reviewers. Parent full normal CODEGRAPH_KERNEL=0 npm test -- --maxWorkers=4 runs session5033, /tmp/codegraph-cjs-eval6-full.log. Snapshot hashes /tmp/codegraph-cjs-eval6-frozen.json. No final results yet. Final explicit build before this full run passed; test setup refreshed engine assets itself. No source changes during review/tests, no outward actions. Personal origin/identity rechecked: inth3shadows/codegraph, Eric Minish / eric.minish@gmail.com. Current six modular files remain uncommitted.
+
+
+## Sixth verification result — 2026-11-09 — NOT READY TO MERGE
+
+Both fresh read-only lanes completed normally. Adversarial CLEARED F7: original3 runtime/graph forms plus11 additional runtime-backed graph controls preserve real exports and reject inert eval-looking data/method declarations. Evidence /tmp/codegraph-cjs-adversarial6-eval.{cjs,log}. Broad independently passed13 intended F7/nearby controls, but found F8 in the correction. No source edits/build/full reruns by reviewers. No final dual clearance.
+
+### F8 — P2 — literalEvalCall mistakes function-argument parentheses for grouped eval callees (broad)
+
+Reviewer location src/resolution/commonjs-export-members.ts:20, loop lines20-24. Exact input:
+
+```js
+exports.known = function known() {};
+function wrap(value) { return function ignore(code) {}; }
+wrap(eval)("ignored");
+```
+
+Runtime exports only known. Current reader returns uncertain:true, making named.missing() falsely resolve to decoy.js:Decoy::missing. Restoring only the pre-F7 literal-eval check in memory returns uncertain:false and no call. wrap((eval))(("ignored")) also reproduces. Evidence /tmp/cg-broad-verify6-callee-compare.log, adjacent .cjs; initial probe /tmp/cg-broad-verify6-callee-context.{cjs,log}. Broad passed all13 intended controls including grouped direct eval, templates, method named eval, real template-expression exports and callable aliases. Adversarial's bounded probes did not include this counterexample; its clearance does not override the demonstrated defect.
+
+Parent full suite intentionally stopped with SIGINT after confirmed F8; exact cwd/argv guarded signal to only isolated checkout main Vitest, tool session5033 EXIT130. /tmp/codegraph-cjs-eval6-full.log is PARTIAL, NOT a full pass/failure result. Avoid wasting a known-defective verification cycle. Prior91focusedPASS and explicit buildPASS remain true for this source, prior10650fullPASS predates F7 and cannot clear current tree. SHA256 snapshot recheck confirms all6 reviewed source paths unchanged during verification. No new source commit, push, fixPR, merge, deployment, version/tag/npm or upstream report.
+
+Stop this correction cycle and report F8. User yes authorized final verification, not another correction/review cycle or publishing. Need user decision before next step, as previously requested. Durable evidence in original QA .review/commonjs-fix-2026-11-08/final-verification-2026-11-09/. Previous modular-eval source/patch backup still matches frozen source. Keep original T0 stopped/uncommitted. Do not reset review count/gate or rewrite control files.
+
+
+## Seventh native dual review result — PR29 — 2026-11-09
+
+Both fresh read-only lanes completed normally: review_broad_pr29_round7 and review_adversarial_pr29_round7. Exact target remains5d384989957c91b482068b306535437915a0595b..87576a8d9ff0d8aba235db5535f5f4429f14b037. Source hashes verified unchanged, trackedtreeclean except private untracked.review. No source edits/build/fullsuite reruns/commits/pushes/GitHubcomments/merge/deploy. Both PRs remain draft. Current review DOES NOT CLEAR PR29 despite prior101focusedPASS/full10666PASS/buildPASS. Parent merges findings from actual final reports without re-verifying/re-reading diff.
+
+### F9 — P2 — Preserve grouped direct eval in control-statement bodies (BOTH)
+
+Broad location src/resolution/commonjs-export-members.ts:31: rejects any preceding ), including a completed if or for condition. Exact input `class Store { load() { return 42; } }
+if (true) (eval)('exports.load = Store.prototype.load;');`. Runtime exports load() returning42, but current discovery uncertain:false and indexing named.load() produces no call. Removing only new prefix guard in memory restores uncertain:true and m.js:Store::load. Nested grouped eval in unbraced single-iteration for body reproduces too. Broad evidence /tmp/cg-broad-pr29-control-context.{cjs,log}; exact command `node --experimental-wasm-exnref --experimental-wasm-stack-switching /tmp/cg-broad-pr29-control-context.cjs`.
+
+Adversarial independently confirms same location/trace; grouped-template if-body and for-body also reproduce. Evidence /tmp/codegraph-cjs-adversarial7-conditional-eval.{cjs,log}. De-duplicated as one P2 F9. This is a NEW regression introduced in PR29, not a pre-existing parent limitation.
+
+### F8 — P2 — PARTIALLY CORRECTED, remains for contextual-keyword wrapper names (adversarial)
+
+Exact reviewer location src/resolution/commonjs-export-members.ts:29 (whitelist:7). Valid CommonJS `function await(value){return function ignore(code){};} await(eval)("ignored");` passes eval without invoking it, but whitelist exemption produces uncertain:true and falsely resolves named.missing() to decoy.js:Decoy::missing. With exports.known=function known(){}, runtime exports only known; pre-F7 behavior restored in memory produces no call. yield reproduces too. Evidence /tmp/codegraph-cjs-adversarial7-contextual-wrapper.{cjs,log}. This is a RESIDUAL F8 variant, not a new unrelated parent re-audit. Do not label all F8 closed.
+
+### Confirmed preservation / rulings
+
+Both independently clear original F8 forms wrap(eval)("ignored") and wrap((eval))(("ignored")): runtime onlyknown, reader uncertain:false, no decoy call. Broad /tmp/cg-broad-pr29-f8-closure.{cjs,log}. Adversarial13runtime-backed graph controls pass (original2forms +11nearby controls), /tmp/codegraph-cjs-adversarial7-controls.log. True standalone grouped/template eval, return expressions, inert data/method declarations, call/member/optional/tag/condition-prefix negatives retain tested behavior. These controls do not answer F9 control-body context or F8 await/yield wrappers.
+
+### Next boundary
+
+Review-only user request is complete. STOP: no fixes, additional review loop, external review comment, markready, merge or deploy without user instruction. The per-step confirmation request remains in force. This is round7 overall; no gate/state reset. Repeated grouping-prefix patches now demonstrate syntax-context ambiguity: if user asks for remediation, choose an evidence-based smaller boundary/design instead of another unbounded keyword/punctuation whitelist. Preserve both concrete repros and all prior controls. Do not repeat fullsuite/build on unchanged source. Actual durable result/evidence/checksums saved in original QA .review/commonjs-fix-2026-11-08/pr29-review-round7-2026-11-09/.
+
+
+## AST redesign approved and started — 2026-11-09
+
+User explicitly approved AST redesign in PR29, said near usage max and asked for a resumable start, then said proceed. This revokes prior review-only stop for in-scope remediation; do not ask same approval on resume. Preserve per-step/user and actual gate boundaries for later merges/deployments. No grammar/runtime/dependency/database-schema changes, commits or pushes in this partial phase; PRs remain draft at prior heads.
+
+Newgraph regressions FIRST:3control-body direct-eval variants(if string/template, for nestedgroups) +await/yield CommonJS wrappers,5FAIL51SKIP on current87576a8d. /tmp/codegraph-cjs-ast-red.log, EXIT1. This intentionally RED gate remains unchanged because integration pending.
+
+New isolated src/extraction/commonjs-eval.ts reads existing SyntaxNode tree and checks actual call.function after unwrapping parenthesized_expression. Returns true for syntacticdirectevalcall(anyargument), false for provenabsence, null for parseerrors with no foundcall. New __tests__/commonjs-eval.test.ts loads existingJS/TS/TSXgrammars:33PASS, /tmp/codegraph-cjs-ast-helper.log EXIT0. Controls cover reports, grouped/interpolated eval, return, generatorfunctions/methods, nestednongenerator scope, eval inside yieldwrapper argument, inert data/methods/membercalls, JSX and malformedsource. Helper not wired to classifier/extraction yet. Existing lexical reader/EXPRESSION_PREFIX_WORDS unchanged for now. Do not claim F8/F9 closed, new full/buildpass or finalreview.
+
+IMPORTANT new evidence: existingJSgrammar correctly models control-body eval and awaitwrapper but parses legal CommonJS yield(eval)(code) as yield_expression whose operand is a call on(eval), no parseerrors. ASTscope must distinguish nongeneratorwrapper from generator yield. Helper handles direct yieldoperand only via nearestfunction/generator/methodscope; nested true eval in yield(eval(code)) remains detected. Shapeprobe /tmp/codegraph-cjs-ast-shape-probe.{cjs,log}. Extractionreferenceprobe /tmp/codegraph-cjs-eval-reference-probe.{cjs,log} shows currentextractor emits callref eval for genuinecall AND synthetic yieldwrappercase. Consequently raw existing unresolved eval refs alone are insufficient. User was explicitly told this grammar limitation, not falsely assured all cases are parser-perfect. No grammarfiles changed.
+
+Next integrate factualcallresult through existingextraction to resolver. Node has NO metadata field (onlyedges do); do not invent Node.metadata, abuse signature/selfedges/candidates, or introduce schema migration casually. ExtractionResult can carry optionalfact through workerclone; need native/deferred bypass parity. Main bulk parse pools only load grammars in workers; resolver cannot assume synchronous getParser is ready in main. Suggested project_metadata perfile/sourcehash transport or another small explicit extractioncontext capability; persist/refresh under same successfulstore lifecycle, cover storeworker and sync. Decide carefully before editing infrastructure. Resume must preserve all existing tests and5newred cases; unknown/missing/error facts must not masquerade as provenabsence. Keep existing export-member tokenizer and previous sync/scope/alias fixes intact; remove prefixheuristics only onceASTfacts actuallysupplied.
+
+Saved current3sourcefiles, patchrelative87576a8d, hashes, red/green/probe logs under original QA .review/commonjs-fix-2026-11-08/ast-redesign-started-2026-11-09/. No tests/build/reviewers running at checkpoint. Newfiles intent-to-add only so diffincludes them, not readyforcommit. No fresh dualreviewagents this phase. Overall reviewcount7; do not reset gate/controlstate. Resume directly integration and targeted tests; fullsuite/build only after stablefix, fresh focuseddual review as authorized/actualgatepermits, no repetitivewholeprojectwork. OriginalT0stillstopped/uncommitted; liveem40 unchanged; no merges/deploy/upstream writes.
diff --git a/docs/handoffs/pr29-2026-11-10/history/corrections-2026-11-09/handoff.md b/docs/handoffs/pr29-2026-11-10/history/corrections-2026-11-09/handoff.md
new file mode 100644
index 0000000000..a4ad4f448c
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/corrections-2026-11-09/handoff.md
@@ -0,0 +1,19 @@
+# CommonJS corrections tested and committed; fourth review awaits approval
+
+Authoritative2026-11-09. User: if separate findings report, if related fix. AllF3/F4/F5related to currentCommonJSfix; corrected, no separateissuesfiled. No outwardactions.
+
+LOCAL HEAD559c76df6afd9e40f4d617ff77caa7db4ad03955, treeb81d2063f4e787da5cfc7d28c619078fdc86e6b6, parentd18e40970fc5fbf32f635f6d8d536d1bdb24dacc, originalbase5e0664891af0e87e6fd18bbfa16cab39237570f5. Repo/tmp/codegraph-cjs-missing-fix-20261108, branchfix/commonjs-missing-member. Personalorigin inth3shadows/codegraph, EricMinish/eric.minish@gmail.com. Identity/remote/stagedexact4files/diff/checks/tests checked beforecommit. Trackedclean, private.reviewuntracked. No push, fixPR, merge, deployment, tag/npm or officialupstreamwrite. em40remainslive. T0originalQAwork stays stopped/uncommitted/untouched.
+
+Corrections: F3 dependency metadata typeFrom records default-import member name-matcher answers (both class-name and method-name matching), includes pureforwarder files. Existing type-dependent edge reopening now handles JS/TS sourcechanges, while Python failed-attribute retry remains Python-only. F4 namespaceinfo tracks explicit dotted/literal-bracket exportnames; absent-memberguard preserves actual callablealiases and treats escaping/computed/prototype-mutated APIs as uncertain. F5 class-shadow exemption also uses existing holderScopeAt block visibility, so inaccessible sibling-block/TSnamespace classes cannot bypass guard; real visibleclasses retained. No new constructor/default inference; import-resolver unchanged. Bareexternalimport issue26 remainsunfixed/outside scope.
+
+Tests: initial11newFAIL/24existingPASS onparent, then49focusedPASS; added2uppercasealiasclass-strategy cases RED under byName-onlytracking, nowfixedtoo. FINAL16files206PASS1SKIP (37default-membercases), /tmp/codegraph-cjs-fix-r3-focused-final.log. Full normal suite10602PASS2expectedFAIL448SKIP0unexpectedFAIL,872filesPASS19SKIP,771.60sec, /tmp/codegraph-cjs-fix-r3-full.log, exec42040EXIT0. Explicit npm run buildPASS /tmp/codegraph-cjs-fix-r3-build.log, exec37438EXIT0. Original6-caseportablebugrepro6/6PASS /tmp/codegraph-cjs-corrected-final-sixcases.log, exec98603EXIT0. Alltestsranonidenticalsourcehasheslatercommitted. Node22.22.2/kernel0WASM, no native claims. No running tests/builds or reviewer agents for this correctionphase.
+
+REVIEW STILL PENDING. Three earlier rounds reviewed oldercode. Third broad lane confirmedF3; adversarial delivered confirmedF3/F4/F5beforefailingfinalizationwithusagecap. Thesefindingsnowcorrected+executiontested, NOTindependentlycleared. Primaryledger/tmp/codegraph-cjs-missing-fix-20261108/.review/commonjs-missing-member.md contains exactclaims/repros/rulings/invariants/historyandlatestfixmap.
+
+PENDINGUSERANSWER to async question authorizing FOURTH two-native-reviewer round. Exactquote readfrom ~/.codex/AGENTS.md: "where Claude's gate would ask the user at round 4, Codex denies, so stop and ask." Userfixauthorizationpredates thissubsequentreviewquestion and is not its answer. Do notlaunchfourthbeforeactualyes; don'tbypassgate/modifycontrolfiles. Ifyes,2freshREADONLYnativeagents review_broad_* andreview_adversarial_ withfork_turns=none, compactselfcontainedbriefs, sameledger and exactcorrectiontarget:
+`git -C /tmp/codegraph-cjs-missing-fix-20261108 diff d18e40970fc5fbf32f635f6d8d536d1bdb24dacc..559c76df6afd9e40f4d617ff77caa7db4ad03955 -- src/resolution/name-matcher.ts src/index.ts src/extraction/index.ts __tests__/js-default-binding-members.test.ts`
+VerifyonlyF3-F5closure/invariants/newfixdefectsbyexecutingfocusedprobes; no fullsuite rerun forunchangedsource. Sourcehasbeenfrozenandtested. Respectquota/actualgatedenial; don'tclaimClaude-onlyskillran. Holdmerge/deployuntilactualrequiredreviewclearoruserexplicitwaiver withinpolicy.
+
+Durable backup originalQAworkspace .review/commonjs-fix-2026-11-08/corrections-2026-11-09/ contains4sourcefiles, corrections.patchrelativetoparent, checksums.json, before/after/uppercase-red/finalfocused/full/build/reprologs, verification.json (HEAD/tree/testcounts) andVERIFIEDGitbundlecommonjs-fix.bundle (8320bytes) withbothfixcommits andoriginalbase5e066489prerequisite. Canfetchlocalbranchfrombundleintorepohavingbaseif/tmpdisappears; don'toverwriteexistingbranch. Parentd18source/evidence alsoinparentbackupdir. Ledgerlatestcopybackedupafterthischeckpoint.
+
+OfficialupstreamreportstillconditionalTuesdayNov10 afterverification+duplicatecheck. Trackingpersonalcodegraphissue27CommonJS, issue26differentbug; QA PR27isfirstbugreportonly. Don'tmergeQAevidencePRs accidentally. Preserveallsharedsource/deploy/control worktrees; noT0work, no cleanup, no unrelatedreportfiling. Nextfinishuserreviewdecision,actualverificationthenfollowapplicableauthorization/SOPbeforeoutwardactions.
diff --git a/docs/handoffs/pr29-2026-11-10/history/corrections-2026-11-09/review-ledger.md b/docs/handoffs/pr29-2026-11-10/history/corrections-2026-11-09/review-ledger.md
new file mode 100644
index 0000000000..cc67d9b9b4
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/corrections-2026-11-09/review-ledger.md
@@ -0,0 +1,122 @@
+# CommonJS missing-member review ledger
+
+Target: /tmp/codegraph-cjs-missing-fix-20261108, branch fix/commonjs-missing-member. Base 5e0664891af0e87e6fd18bbfa16cab39237570f5 to current tracked working tree, unchanged while both reviewers run. Exact diff: `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5e0664891af0e87e6fd18bbfa16cab39237570f5 -- CHANGELOG.md src/resolution/name-matcher.ts __tests__/js-default-binding-members.test.ts`.
+
+Round1 pending two fresh read-only native lanes. No Claude-only /code-review invocation. No resolver fix existed previously; user explicitly authorized implementation and dual review. Fork issue27 is the bug, QA PR27 is evidence only. No official upstream submission before Tuesday verification.
+
+## Findings / fix map
+
+- F1: confirmed upstream defect. `const named=require('./m'); named.missing()` with m.js exporting only known falsely calls unimported Decoy::missing; ref keeps receiver, resolvedBy instance-method/provenance null. Default imports and class-name-alias collision variants also reproduced. Sync adding decoy also fabricates call. Proposed tracked working-tree fix adds default bindings to imported-receiver guard and moves guard before unrelated class-name matching, after actual import/typed/object resolution. Requires reviewer execution and clearance.
+- P0 test baseline: new20-case file on unmodified resolver:15 PASS /5 FAIL. The5 failures are3 parameterized default/require+decoy cases,1 forwarding-module missing member,1 sync-add-decoy. Log /tmp/codegraph-cjs-fix-baseline2.log. No production code edit before this run. Initial baseline command failed because Vitest4 removed --minWorkers; corrected to --maxWorkers=4. Initial two new-test authoring corrections: object variable API used instead of unsupported direct object-literal shorthand shape; expected local object's qualified name corrected to actual fully-qualified extraction name. Neither changes an existing baseline test.
+
+## Rulings / limits
+
+- Direct `module.exports = { read() {} }` without an assigned variable already lacks correct member recovery on base and can be captured by a method decoy. This change must stop wrong calls; new object API positive uses baseline-supported `const api={read(){}}; module.exports=api`. Do not broaden into object-export extraction or claim direct shorthand recovery is implemented.
+- Bare external-package import exact-match issue26 remains separate and unfixed.
+- No import mapping semantics changes, no blanket conversion of require to namespace imports, no source code changes outside one name-matcher guard and changelog/tests.
+- This is a remaining variant of closed upstream2952/merged3162. No global novelty claim. Reproduced on em40/pristine main/pristine release. Native kernel unverified; local deployment is kernel0/WASM.
+
+## Invariants / commands
+
+- Actual exported member resolves beside an unrelated same-name method; missing member has no call. Forwarded CommonJS module preserves real export.
+- Stated CommonJS class static method, assigned object member, instance method, callable direct/default + attached function all remain correct beside decoys.
+- Existing ES default class, instance, typed variable, ambient export=, ordinary ESM namespace, named/anonymous/renamed functions retain calls.
+- Typed local parameters and object literal bindings shadowing default imports retain their local member calls.
+- Sync adds/removes a real export correctly; sync adding/removing a same-name unrelated method never fabricates missing-member calls.
+- Check these with `cd /tmp/codegraph-cjs-missing-fix-20261108 && CODEGRAPH_KERNEL=0 npx vitest run __tests__/js-default-binding-members.test.ts --maxWorkers=1`.
+- Expanded focused suite currently running: js-default-binding-members, commonjs-require-calls, commonjs-require-imports, commonjs-exports, require-default, import-default-as, namespace-object-resolution, import-object-member-namesake, sync-default-export-change, sync-import-member-retry, out-of-repo-import-shadow. Log /tmp/codegraph-cjs-fix-focused.log. Full normal suite/build pending.
+- Additional adversarial probes: class name matching alias, nested receiver paths, defaults with inherited/static/object APIs, lexical shadows and live sync. Each defect needs concrete input/actual wrong output; no style requests or hypothetical findings.
+
+## Round1 review outputs and remediation
+
+Both native lanes finished read-only. Each independently reported the same two P2 regressions at name-matcher.ts:24944; no other demonstrated findings.
+
+- R1 (broad+adversarial): `class Store { load() {} }; module.exports = new Store()` loses its legitimate instance call. Adversarial also demonstrated `export default new Store()` with Store not separately exported. Both base em40 produce Store::load; initial guard none. Remediation: resolve a whole explicit constructor expression to its actual module's local/imported class before the guard. Follow CommonJS forwarding; mask strings/comments/regexes, balance constructor arguments and type arguments, reject chained expressions, memoize with existing export index. Never re-enable generic method-name guessing for default bindings.
+- R2 (broad+adversarial): visible local `class named { static missing(){} }` shadows a default/namespace import; moving guard ahead of class strategy drops correct own-file call. Broad also tested enclosing-function shadow. Remediation: guard exempts a class declaration in the reference's file only when existing isLexicallyReachable proves it visible. Other-file alias-name class decoy remains blocked.
+- Review regression tests run BEFORE remediation: /tmp/codegraph-cjs-fix-review-baseline.log,24 cases19PASS5FAIL (original CommonJS positive +2 constructed-default variants +2 lexical class shadow variants). This pins both findings. Additional constructor argument/forwarder/text controls added; simple first remediation failed3nested/multiline/regex constructor positives in /tmp/codegraph-cjs-fix-constructors-baseline.log before argument-reader correction.
+- After remediation: /tmp/codegraph-cjs-fix-focused4.log,11 files99PASS1SKIP. Final focused run adds no-parentheses and spaced CommonJS constructor controls; /tmp/codegraph-cjs-fix-focused-final.log pending. Earlier temporary TS compile error from passing Language to CommentLang was corrected to JS-family typescript comment handling; not a passing run.
+
+The exact R1 reviewed name-matcher source is saved in .review/round1-name-matcher.ts and reconstructed hash verified against the recorded Git blob512a77a155299de8e6890447aa2d3aea7b81a1f9. Name-matcher remediation diff: `git diff --no-index /tmp/codegraph-cjs-missing-fix-20261108/.review/round1-name-matcher.ts /tmp/codegraph-cjs-missing-fix-20261108/src/resolution/name-matcher.ts`. Import-resolver and new tests are also remediation, diff from5e066489. No intermediate failing-source commit was made.
+
+Verify2 target is current tracked working tree relative5e066489, including CHANGELOG.md, src/resolution/name-matcher.ts, src/resolution/import-resolver.ts, __tests__/js-default-binding-members.test.ts. Check R1/R2 on all paths, all invariants, and defects introduced by remediation. Do not re-raise the pre-existing direct module.exports object-literal recovery limit without new evidence. Full build/suite pending. No merge/deployment occurred.
+
+## Verify2 result — NOT cleared; namespace-only redesign supersedes that target
+
+Both fresh native lanes finished; all findings P2. Broad reported first textual constructor overriding inactive/overwritten exports, valid inline/parenthesized constructors losing calls (R1 still open), and constructor-derived calls remaining stale after sync. Adversarial independently reported constructor lookup overriding typed/object/class lexical shadows (R2 still open), earlier constructor overriding a later stated default, and stale constructor-derived calls after sync. Exact evidence scripts/results under /tmp/cg-broad-verify2-* and /tmp/codegraph-cjs-verify2-*; complete reviewer messages returned to root. Existing explicit-default resolution was safer than the attempted new inference.
+
+Both lanes advised that a smaller boundary is coherent: extend module-namespace ownership only to a require/default whose resolved JS/TS target has no stated or uncertain value default; preserve all existing explicit/unknown default-value inference. Whole-file CommonJS forwarding can follow a namespace leaf; ambiguous assignments/default values must stay base behavior. No nonexistent redesigned code was reviewed or cleared by those design messages.
+
+Implemented redesign: REMOVED all added import-resolver source code; that file is byte-identical to base again. Removed unsafe constructor parsing/inference entirely. Name-matcher now uses existing context.resolveModuleFile, a per-context namespace-classification memo (cleared with existing memos), conservative source checks, pure whole-file forwarders only, bounded/cycle-safe traversal, language-qualified memo keys and JS/TS extensions only (no implicit component defaults). Any raw default keyword/export= or uncertain module use excludes the new guard; comments/text may conservatively prevent a classification. Move-before-class guard keeps lexical own-file class exemption. Changelog narrowed to modules without a value default.
+
+Scope/ruling: arbitrary stated/unknown exported default values and their guessed-member limitations remain pre-existing and explicitly OUTSIDE this fix. Do not claim every default-import missing-member case fixed. Removed new constructor-parser feature tests after deleting that feature, retaining baseline-supported CJS/ESM singleton, stated class/object/callable, lexical shadows and every original missing-module regression. Two dedicated singleton controls initially asserted disambiguation between two .load methods that base itself cannot provide; corrected their newly-authored fixture to a unique .load method, preserving the actual base invariant. Original broader CJS store-vs-decoy control remains unchanged. No baseline existing assertion was weakened.
+
+Full suite on superseded constructor candidate was STOPPED intentionally via guarded SIGINT to only this checkout's Vitest PID702277; final exec83750exit130. It did not pass and must not be reported as a test failure count/green gate. /tmp/codegraph-cjs-fix-full.log belongs that obsolete target. Latest redesigned focused13-file run /tmp/codegraph-cjs-fix-redesign-focused2.log RUNNING; verify actual exit/summary. Explicit build and redesigned full suite remain required.
+
+Third-review exception requested via async user question: skill says third round only if verify found something high severity; these were P2. Await user's explicit answer before launching further reviewers. Both agents' conceptual agreement is not final dual-review clearance. No source commit/push/fix PR/merge/deploy occurred. Original user's conditional merge/deploy request remains dependent on a reviewed green fix; original T0 stays stopped.
+
+## Final testing and local commit — authoritative current state
+
+Namespace redesign focused suite13files108PASS1SKIP, explicit npm run build exit0. Full normal suite exec60370EXIT0:872filesPASS19SKIP;10589testsPASS,2expectedFAIL,448SKIP,0unexpectedFAIL,799.56seconds. /tmp/codegraph-cjs-fix-redesign-full.log. Original portable6-case bug reproduction6/6PASS. Existing independent18-case records match em40baseline exactly. Namespace-to-value default change sync agrees with fresh index (initial no calls, synced/fresh Store::load); /tmp/codegraph-cjs-namespace-sync-probe.{cjs,jsonl}. Native kernel not validated.
+
+Personal repository/remote/identity, source checksums against preserved tested snapshot, staged3-file set and staged diff/check verified before local commit. LOCAL COMMIT d18e40970fc5fbf32f635f6d8d536d1bdb24dacc, tree2363dd0f8923ca59c28a3e45a477573e7364e7c2, branch fix/commonjs-missing-member. Tracked working tree clean; only private .review untracked. No push/fix PR/merge/deployment. Review target now `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5e0664891af0e87e6fd18bbfa16cab39237570f5..d18e40970fc5fbf32f635f6d8d536d1bdb24dacc -- CHANGELOG.md src/resolution/name-matcher.ts __tests__/js-default-binding-members.test.ts`.
+
+Third review still requires the pending user answer. User's later status question did NOT approve it. If authorized use two fresh native lanes with fork_turns=none and self-contained briefs/ledger to avoid carrying unrelated history. Preserve final tests; no redundant full rerun unless code or unresolved concerns change the tested tree. Verification and logs/source/patch are backed up under original QA .review/commonjs-fix-2026-11-08/verification.json and adjacent artifacts. Current canonical handoff handoff-codegraph-commonjs-tested-review-pending-2026-11-08.md supersedes running/constructor handoffs.
+
+## Third round authorized and running
+
+User explicitly answered yes to the third-review request, then asked why another round was needed. Explained earlier reviews covered replaced code while the tested final commit had not been independently reviewed. This question did not revoke approval. Started fresh read-only review_broad_commonjs_final3 and review_adversarial_commonjs_final3 with fork_turns=none, the exact base..d18e4097 target and this ledger, compact self-contained briefs and no full-suite rerun. Their results remain pending. Source unchanged; no push/merge/deployment.
+
+## Third round result — 2026-11-09 — NOT READY TO MERGE
+
+Exact target remains local d18e40970fc5fbf32f635f6d8d536d1bdb24dacc. Tracked tree clean, .review untracked; no source changes after passing tests. User resumed; collected broad final answer and adversarial confirmed messages. Broad lane completed normally. Adversarial lane delivered independently confirmed findings/evidence, then failed finalization with a usage-limit error (retry notice Nov9 1:10AM). Do NOT claim that lane completed normally, final clearance, or a green dual review. No push/PR/merge/deployment.
+
+### F3 — P2 — Namespace classification changes do not invalidate existing guessed calls (broad, independently confirmed adversarial)
+
+Broad location src/resolution/name-matcher.ts:25398. Start with `class Store { load() {} }; module.exports = new Store()` and an unchanged caller requiring that module and calling `.load()`. Replace the export with `exports.known = function known() {};`, retaining the class. After cg.sync(), the graph still calls Store::load; a fresh index correctly produces no call. The new module-text dependency needs to reopen existing member guesses when export shape changes.
+
+Broad reproduction /tmp/cg-broad-final3-sync-reverse.cjs; final evidence /tmp/cg-broad-final3-sync-reverse.log. Baseline comparison confirms its sync and fresh results both retained Store::load (/tmp/cg-broad-final3-sync-reverse-base.log). Adversarial independently reproduced direct and pure forwarder value->namespace->value->namespace retaining Store::load on every sync: /tmp/codegraph-cjs-final3-sync.cjs. Minimum correction recommendation: reopen default-import member guesses when imported module export text/shape changes, or record the imported source dependency on guesses allowed by a false namespace classification.
+
+### F4 — P2 — Explicitly exported callable aliases lose their calls (adversarial confirmed before usage limit)
+
+Location reported src/resolution/name-matcher.ts:25427. m.js `class Store { load() { return 42; } }\nexports.load = Store.prototype.load;`; use.js `const named=require('./m');\nexport function run(){named.load();}`. em40 calls m.js:Store::load; final emits no call. Same independently confirmed for `module.exports.load = Store.prototype.load`. Runtime named.load returns42 and Object.keys(module)=['load']. This is an explicitly exported callable, not the ruled-out direct object/default-value guessing limit. Prototype mutation variants group with the same uncertain-exports classification problem.
+
+Evidence /tmp/codegraph-cjs-final3-export-alias.cjs and /tmp/codegraph-cjs-final3-adversarial{,-base.jsonl,-final.jsonl}. Recommendation: preserve uncertain named-export RHS APIs or resolve the actual callable alias before blocking a fallback. Do not reopen arbitrary guesses for absent exports.
+
+### F5 — P2 — Out-of-scope local class bypasses namespace guard (adversarial confirmed before usage limit; original finding remains open on this path)
+
+Reported location src/resolution/name-matcher.ts:25397 (guard local-class exemption, around25396). Valid CJS: m.js `exports.known=function known(){};`; use.js lines1..8:
+`const named=require('./m');`
+`function run(){`
+`if(true){`
+`class named {static missing(){}}`
+`}`
+`named.missing();`
+`}`
+`module.exports=run;`
+Final returns use.js:run::named::missing atline6, though the class is block-local and imported module has no missing. Also reproduced for a class inside TS namespace Parent. These outputs pre-exist on base, but this is a still-open original false-positive path bypassing the new guard: existing isLexicallyReachable does not establish block visibility. Recommendation: require actual enclosing lexical block visibility before exempting a class. Preserve the genuine inner/enclosing-function shadow controls.
+
+## Merge decision / next boundary
+
+HOLD d18e4097. Passing build/full/focused tests remain factual, but F3/F4 are demonstrated regressions and F5 remains an intended missing-member path. No further agents, tests, source fixes or outward actions started after these reports. Do not rerun the full suite until a changed candidate requires it. User required confirmation before subsequent steps; present this concrete review result and seek the next bounded correction/verification decision. Fourth review is not preauthorized by approval of the third; native review gate may deny round4, so stop and ask rather than bypass. Agent quota exhaustion is additional reason not to relaunch a failed lane automatically.
+
+## Corrections authorized — 2026-11-09
+
+User: if findings are separate, report them; if related, fix them. All three are related: F3/F4 regressions introduced by this guard, F5 remaining original namespace missing-member path. No new issue filing or outside bug work needed. Authorized correcting all three in this branch; no extra reviewer lane or outward action started.
+
+Fail-before tests:11 new regressions fail and24 existing pass on d18e4097, /tmp/codegraph-cjs-fix-r3-regressions-before.log. New tests cover direct and forwarded value->namespace->value->namespace sync vs fresh; explicit dotted/bracket export aliases beside a still-absent-member decoy; alias removal by sync; out-of-scope sibling-block classes vs genuine same-block inner callers; TSnamespaceclassscope.
+
+Changes: F3 uses existing typeFrom dependency tracking on byName default-import member calls, includes each pure-forwarder file; activates the existing dependency-edge reopener for JS/TS paths while keeping failed-attribute retry Python-only. F4 namespace info tracks explicit assigned member names; new guard applies only to absent names. Escaping/computed/prototype-mutated exports remain uncertain and preserve existing behavior. F5 adds existing holderScopeAt block visibility to the class-shadow exemption, retaining function lexical visibility as well. Namespace memo stores traced files/member names; cache not poisoned by depth/cycle cutoffs.
+
+First focused verification AFTER all three corrections:3files49PASS0FAIL, /tmp/codegraph-cjs-fix-r3-regressions-after.log. Includes full35-case default-member suite and memo clearing/lifetime. No existing expected assertion weakened. Pending expanded JS/Python sync controls, normal full suite/build and original6-case repro. No new commit yet; earlier full pass applies d18e4097 only. Current changed files test + name-matcher + src/index.ts + src/extraction/index.ts. No unsafe constructor inference, import-resolver unchanged. Fourth review not yet requested/launched; gate and quota limits remain applicable.
+
+## Corrected commit verified by execution — independent review pending
+
+F3 class-name path also pinned: two new uppercase Store import-alias sync cases failed when only byName answers carried dependency metadata; /tmp/codegraph-cjs-fix-r3-upper-before.log. Final correction records imported-module inputs on name-matcher default-member answers from both class-name and method-name strategies. No change to confidence/byName selection. All original regression assertions retained.
+
+FINAL source tests:16files206PASS1SKIP, including37default-membercases, JS imports/sync andPythonattribute/memo controls. Log/tmp/codegraph-cjs-fix-r3-focused-final.log. Full normal suite exec42040EXIT0:872filesPASS19SKIP,10602testsPASS2expectedFAIL448SKIP0unexpectedFAIL,771.60seconds, /tmp/codegraph-cjs-fix-r3-full.log. Explicit npm run build exec37438EXIT0, /tmp/codegraph-cjs-fix-r3-build.log. Original portable6-case bug reproducer6/6PASS, /tmp/codegraph-cjs-corrected-final-sixcases.log. Node22.22.2/kernel0WASM; native not claimed. Source checksums prove no source changes between focused/full/build/testing and commit.
+
+LOCAL CORRECTION COMMIT559c76df6afd9e40f4d617ff77caa7db4ad03955, tre eb81d2063f4e787da5cfc7d28c619078fdc86e6b6, parentd18e40970fc5fbf32f635f6d8d536d1bdb24dacc. Personalrepository/remote/identity/stagedexact4-filediff andchecks verified. Trackedtreeclean, onlyprivate.reviewuntracked. No push/fixPR/merge/deploy or issuefiling. F3/F4/F5 status CORRECTED+executionPASS, awaiting independent verification; do not claim native review clearance.
+
+FOURTH ROUND ANSWER PENDING: async question asked permission and quoted ~/.codex/AGENTS.md: "where Claude's gate would ask the user at round 4, Codex denies, so stop and ask." User has not answered that new question; elapsed time is not approval. Do not launch fourth reviewers yet or modify gate state/control files. If approved use2freshread-onlynativefork_turns=none, same ledger, correction target `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff d18e40970fc5fbf32f635f6d8d536d1bdb24dacc..559c76df6afd9e40f4d617ff77caa7db4ad03955 -- src/resolution/name-matcher.ts src/index.ts src/extraction/index.ts __tests__/js-default-binding-members.test.ts`. Brief F3-F5, currentcorrections+invariants; no fullsuite rerun unless changes/failures justify it. Stop/ask if gate denies; last third adversarial lane failed finalization due usage cap, don't fabricateclearance.
+
+Durable original-workspace backup .review/commonjs-fix-2026-11-08/corrections-2026-11-09/:4sourcefiles, corrections.patch, checksums.json, before/after/focused/full/build/reprologs, verification.json identifyingfinalcommit/tree/outcomes, verified commonjs-fix.bundle containingbothlocalfixcommits with originalbase5e066489prerequisite. Commit recovery does not depend on /tmp survival. Current canonical handoff handoff-codegraph-commonjs-corrected-review-pending-2026-11-09.md supersedes corrections-running and review-blocked handoffs. OriginalT0unchanged/stopped; Tuesdayconditionalupstreamreport unchanged.
diff --git a/docs/handoffs/pr29-2026-11-10/history/final-verification-2026-11-09/commonjs-missing-member.md b/docs/handoffs/pr29-2026-11-10/history/final-verification-2026-11-09/commonjs-missing-member.md
new file mode 100644
index 0000000000..6be7f659cd
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/final-verification-2026-11-09/commonjs-missing-member.md
@@ -0,0 +1,176 @@
+# CommonJS missing-member review ledger
+
+Target: /tmp/codegraph-cjs-missing-fix-20261108, branch fix/commonjs-missing-member. Base 5e0664891af0e87e6fd18bbfa16cab39237570f5 to current tracked working tree, unchanged while both reviewers run. Exact diff: `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5e0664891af0e87e6fd18bbfa16cab39237570f5 -- CHANGELOG.md src/resolution/name-matcher.ts __tests__/js-default-binding-members.test.ts`.
+
+Round1 pending two fresh read-only native lanes. No Claude-only /code-review invocation. No resolver fix existed previously; user explicitly authorized implementation and dual review. Fork issue27 is the bug, QA PR27 is evidence only. No official upstream submission before Tuesday verification.
+
+## Findings / fix map
+
+- F1: confirmed upstream defect. `const named=require('./m'); named.missing()` with m.js exporting only known falsely calls unimported Decoy::missing; ref keeps receiver, resolvedBy instance-method/provenance null. Default imports and class-name-alias collision variants also reproduced. Sync adding decoy also fabricates call. Proposed tracked working-tree fix adds default bindings to imported-receiver guard and moves guard before unrelated class-name matching, after actual import/typed/object resolution. Requires reviewer execution and clearance.
+- P0 test baseline: new20-case file on unmodified resolver:15 PASS /5 FAIL. The5 failures are3 parameterized default/require+decoy cases,1 forwarding-module missing member,1 sync-add-decoy. Log /tmp/codegraph-cjs-fix-baseline2.log. No production code edit before this run. Initial baseline command failed because Vitest4 removed --minWorkers; corrected to --maxWorkers=4. Initial two new-test authoring corrections: object variable API used instead of unsupported direct object-literal shorthand shape; expected local object's qualified name corrected to actual fully-qualified extraction name. Neither changes an existing baseline test.
+
+## Rulings / limits
+
+- Direct `module.exports = { read() {} }` without an assigned variable already lacks correct member recovery on base and can be captured by a method decoy. This change must stop wrong calls; new object API positive uses baseline-supported `const api={read(){}}; module.exports=api`. Do not broaden into object-export extraction or claim direct shorthand recovery is implemented.
+- Bare external-package import exact-match issue26 remains separate and unfixed.
+- No import mapping semantics changes, no blanket conversion of require to namespace imports, no source code changes outside one name-matcher guard and changelog/tests.
+- This is a remaining variant of closed upstream2952/merged3162. No global novelty claim. Reproduced on em40/pristine main/pristine release. Native kernel unverified; local deployment is kernel0/WASM.
+
+## Invariants / commands
+
+- Actual exported member resolves beside an unrelated same-name method; missing member has no call. Forwarded CommonJS module preserves real export.
+- Stated CommonJS class static method, assigned object member, instance method, callable direct/default + attached function all remain correct beside decoys.
+- Existing ES default class, instance, typed variable, ambient export=, ordinary ESM namespace, named/anonymous/renamed functions retain calls.
+- Typed local parameters and object literal bindings shadowing default imports retain their local member calls.
+- Sync adds/removes a real export correctly; sync adding/removing a same-name unrelated method never fabricates missing-member calls.
+- Check these with `cd /tmp/codegraph-cjs-missing-fix-20261108 && CODEGRAPH_KERNEL=0 npx vitest run __tests__/js-default-binding-members.test.ts --maxWorkers=1`.
+- Expanded focused suite currently running: js-default-binding-members, commonjs-require-calls, commonjs-require-imports, commonjs-exports, require-default, import-default-as, namespace-object-resolution, import-object-member-namesake, sync-default-export-change, sync-import-member-retry, out-of-repo-import-shadow. Log /tmp/codegraph-cjs-fix-focused.log. Full normal suite/build pending.
+- Additional adversarial probes: class name matching alias, nested receiver paths, defaults with inherited/static/object APIs, lexical shadows and live sync. Each defect needs concrete input/actual wrong output; no style requests or hypothetical findings.
+
+## Round1 review outputs and remediation
+
+Both native lanes finished read-only. Each independently reported the same two P2 regressions at name-matcher.ts:24944; no other demonstrated findings.
+
+- R1 (broad+adversarial): `class Store { load() {} }; module.exports = new Store()` loses its legitimate instance call. Adversarial also demonstrated `export default new Store()` with Store not separately exported. Both base em40 produce Store::load; initial guard none. Remediation: resolve a whole explicit constructor expression to its actual module's local/imported class before the guard. Follow CommonJS forwarding; mask strings/comments/regexes, balance constructor arguments and type arguments, reject chained expressions, memoize with existing export index. Never re-enable generic method-name guessing for default bindings.
+- R2 (broad+adversarial): visible local `class named { static missing(){} }` shadows a default/namespace import; moving guard ahead of class strategy drops correct own-file call. Broad also tested enclosing-function shadow. Remediation: guard exempts a class declaration in the reference's file only when existing isLexicallyReachable proves it visible. Other-file alias-name class decoy remains blocked.
+- Review regression tests run BEFORE remediation: /tmp/codegraph-cjs-fix-review-baseline.log,24 cases19PASS5FAIL (original CommonJS positive +2 constructed-default variants +2 lexical class shadow variants). This pins both findings. Additional constructor argument/forwarder/text controls added; simple first remediation failed3nested/multiline/regex constructor positives in /tmp/codegraph-cjs-fix-constructors-baseline.log before argument-reader correction.
+- After remediation: /tmp/codegraph-cjs-fix-focused4.log,11 files99PASS1SKIP. Final focused run adds no-parentheses and spaced CommonJS constructor controls; /tmp/codegraph-cjs-fix-focused-final.log pending. Earlier temporary TS compile error from passing Language to CommentLang was corrected to JS-family typescript comment handling; not a passing run.
+
+The exact R1 reviewed name-matcher source is saved in .review/round1-name-matcher.ts and reconstructed hash verified against the recorded Git blob512a77a155299de8e6890447aa2d3aea7b81a1f9. Name-matcher remediation diff: `git diff --no-index /tmp/codegraph-cjs-missing-fix-20261108/.review/round1-name-matcher.ts /tmp/codegraph-cjs-missing-fix-20261108/src/resolution/name-matcher.ts`. Import-resolver and new tests are also remediation, diff from5e066489. No intermediate failing-source commit was made.
+
+Verify2 target is current tracked working tree relative5e066489, including CHANGELOG.md, src/resolution/name-matcher.ts, src/resolution/import-resolver.ts, __tests__/js-default-binding-members.test.ts. Check R1/R2 on all paths, all invariants, and defects introduced by remediation. Do not re-raise the pre-existing direct module.exports object-literal recovery limit without new evidence. Full build/suite pending. No merge/deployment occurred.
+
+## Verify2 result — NOT cleared; namespace-only redesign supersedes that target
+
+Both fresh native lanes finished; all findings P2. Broad reported first textual constructor overriding inactive/overwritten exports, valid inline/parenthesized constructors losing calls (R1 still open), and constructor-derived calls remaining stale after sync. Adversarial independently reported constructor lookup overriding typed/object/class lexical shadows (R2 still open), earlier constructor overriding a later stated default, and stale constructor-derived calls after sync. Exact evidence scripts/results under /tmp/cg-broad-verify2-* and /tmp/codegraph-cjs-verify2-*; complete reviewer messages returned to root. Existing explicit-default resolution was safer than the attempted new inference.
+
+Both lanes advised that a smaller boundary is coherent: extend module-namespace ownership only to a require/default whose resolved JS/TS target has no stated or uncertain value default; preserve all existing explicit/unknown default-value inference. Whole-file CommonJS forwarding can follow a namespace leaf; ambiguous assignments/default values must stay base behavior. No nonexistent redesigned code was reviewed or cleared by those design messages.
+
+Implemented redesign: REMOVED all added import-resolver source code; that file is byte-identical to base again. Removed unsafe constructor parsing/inference entirely. Name-matcher now uses existing context.resolveModuleFile, a per-context namespace-classification memo (cleared with existing memos), conservative source checks, pure whole-file forwarders only, bounded/cycle-safe traversal, language-qualified memo keys and JS/TS extensions only (no implicit component defaults). Any raw default keyword/export= or uncertain module use excludes the new guard; comments/text may conservatively prevent a classification. Move-before-class guard keeps lexical own-file class exemption. Changelog narrowed to modules without a value default.
+
+Scope/ruling: arbitrary stated/unknown exported default values and their guessed-member limitations remain pre-existing and explicitly OUTSIDE this fix. Do not claim every default-import missing-member case fixed. Removed new constructor-parser feature tests after deleting that feature, retaining baseline-supported CJS/ESM singleton, stated class/object/callable, lexical shadows and every original missing-module regression. Two dedicated singleton controls initially asserted disambiguation between two .load methods that base itself cannot provide; corrected their newly-authored fixture to a unique .load method, preserving the actual base invariant. Original broader CJS store-vs-decoy control remains unchanged. No baseline existing assertion was weakened.
+
+Full suite on superseded constructor candidate was STOPPED intentionally via guarded SIGINT to only this checkout's Vitest PID702277; final exec83750exit130. It did not pass and must not be reported as a test failure count/green gate. /tmp/codegraph-cjs-fix-full.log belongs that obsolete target. Latest redesigned focused13-file run /tmp/codegraph-cjs-fix-redesign-focused2.log RUNNING; verify actual exit/summary. Explicit build and redesigned full suite remain required.
+
+Third-review exception requested via async user question: skill says third round only if verify found something high severity; these were P2. Await user's explicit answer before launching further reviewers. Both agents' conceptual agreement is not final dual-review clearance. No source commit/push/fix PR/merge/deploy occurred. Original user's conditional merge/deploy request remains dependent on a reviewed green fix; original T0 stays stopped.
+
+## Final testing and local commit — authoritative current state
+
+Namespace redesign focused suite13files108PASS1SKIP, explicit npm run build exit0. Full normal suite exec60370EXIT0:872filesPASS19SKIP;10589testsPASS,2expectedFAIL,448SKIP,0unexpectedFAIL,799.56seconds. /tmp/codegraph-cjs-fix-redesign-full.log. Original portable6-case bug reproduction6/6PASS. Existing independent18-case records match em40baseline exactly. Namespace-to-value default change sync agrees with fresh index (initial no calls, synced/fresh Store::load); /tmp/codegraph-cjs-namespace-sync-probe.{cjs,jsonl}. Native kernel not validated.
+
+Personal repository/remote/identity, source checksums against preserved tested snapshot, staged3-file set and staged diff/check verified before local commit. LOCAL COMMIT d18e40970fc5fbf32f635f6d8d536d1bdb24dacc, tree2363dd0f8923ca59c28a3e45a477573e7364e7c2, branch fix/commonjs-missing-member. Tracked working tree clean; only private .review untracked. No push/fix PR/merge/deployment. Review target now `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5e0664891af0e87e6fd18bbfa16cab39237570f5..d18e40970fc5fbf32f635f6d8d536d1bdb24dacc -- CHANGELOG.md src/resolution/name-matcher.ts __tests__/js-default-binding-members.test.ts`.
+
+Third review still requires the pending user answer. User's later status question did NOT approve it. If authorized use two fresh native lanes with fork_turns=none and self-contained briefs/ledger to avoid carrying unrelated history. Preserve final tests; no redundant full rerun unless code or unresolved concerns change the tested tree. Verification and logs/source/patch are backed up under original QA .review/commonjs-fix-2026-11-08/verification.json and adjacent artifacts. Current canonical handoff handoff-codegraph-commonjs-tested-review-pending-2026-11-08.md supersedes running/constructor handoffs.
+
+## Third round authorized and running
+
+User explicitly answered yes to the third-review request, then asked why another round was needed. Explained earlier reviews covered replaced code while the tested final commit had not been independently reviewed. This question did not revoke approval. Started fresh read-only review_broad_commonjs_final3 and review_adversarial_commonjs_final3 with fork_turns=none, the exact base..d18e4097 target and this ledger, compact self-contained briefs and no full-suite rerun. Their results remain pending. Source unchanged; no push/merge/deployment.
+
+## Third round result — 2026-11-09 — NOT READY TO MERGE
+
+Exact target remains local d18e40970fc5fbf32f635f6d8d536d1bdb24dacc. Tracked tree clean, .review untracked; no source changes after passing tests. User resumed; collected broad final answer and adversarial confirmed messages. Broad lane completed normally. Adversarial lane delivered independently confirmed findings/evidence, then failed finalization with a usage-limit error (retry notice Nov9 1:10AM). Do NOT claim that lane completed normally, final clearance, or a green dual review. No push/PR/merge/deployment.
+
+### F3 — P2 — Namespace classification changes do not invalidate existing guessed calls (broad, independently confirmed adversarial)
+
+Broad location src/resolution/name-matcher.ts:25398. Start with `class Store { load() {} }; module.exports = new Store()` and an unchanged caller requiring that module and calling `.load()`. Replace the export with `exports.known = function known() {};`, retaining the class. After cg.sync(), the graph still calls Store::load; a fresh index correctly produces no call. The new module-text dependency needs to reopen existing member guesses when export shape changes.
+
+Broad reproduction /tmp/cg-broad-final3-sync-reverse.cjs; final evidence /tmp/cg-broad-final3-sync-reverse.log. Baseline comparison confirms its sync and fresh results both retained Store::load (/tmp/cg-broad-final3-sync-reverse-base.log). Adversarial independently reproduced direct and pure forwarder value->namespace->value->namespace retaining Store::load on every sync: /tmp/codegraph-cjs-final3-sync.cjs. Minimum correction recommendation: reopen default-import member guesses when imported module export text/shape changes, or record the imported source dependency on guesses allowed by a false namespace classification.
+
+### F4 — P2 — Explicitly exported callable aliases lose their calls (adversarial confirmed before usage limit)
+
+Location reported src/resolution/name-matcher.ts:25427. m.js `class Store { load() { return 42; } }\nexports.load = Store.prototype.load;`; use.js `const named=require('./m');\nexport function run(){named.load();}`. em40 calls m.js:Store::load; final emits no call. Same independently confirmed for `module.exports.load = Store.prototype.load`. Runtime named.load returns42 and Object.keys(module)=['load']. This is an explicitly exported callable, not the ruled-out direct object/default-value guessing limit. Prototype mutation variants group with the same uncertain-exports classification problem.
+
+Evidence /tmp/codegraph-cjs-final3-export-alias.cjs and /tmp/codegraph-cjs-final3-adversarial{,-base.jsonl,-final.jsonl}. Recommendation: preserve uncertain named-export RHS APIs or resolve the actual callable alias before blocking a fallback. Do not reopen arbitrary guesses for absent exports.
+
+### F5 — P2 — Out-of-scope local class bypasses namespace guard (adversarial confirmed before usage limit; original finding remains open on this path)
+
+Reported location src/resolution/name-matcher.ts:25397 (guard local-class exemption, around25396). Valid CJS: m.js `exports.known=function known(){};`; use.js lines1..8:
+`const named=require('./m');`
+`function run(){`
+`if(true){`
+`class named {static missing(){}}`
+`}`
+`named.missing();`
+`}`
+`module.exports=run;`
+Final returns use.js:run::named::missing atline6, though the class is block-local and imported module has no missing. Also reproduced for a class inside TS namespace Parent. These outputs pre-exist on base, but this is a still-open original false-positive path bypassing the new guard: existing isLexicallyReachable does not establish block visibility. Recommendation: require actual enclosing lexical block visibility before exempting a class. Preserve the genuine inner/enclosing-function shadow controls.
+
+## Merge decision / next boundary
+
+HOLD d18e4097. Passing build/full/focused tests remain factual, but F3/F4 are demonstrated regressions and F5 remains an intended missing-member path. No further agents, tests, source fixes or outward actions started after these reports. Do not rerun the full suite until a changed candidate requires it. User required confirmation before subsequent steps; present this concrete review result and seek the next bounded correction/verification decision. Fourth review is not preauthorized by approval of the third; native review gate may deny round4, so stop and ask rather than bypass. Agent quota exhaustion is additional reason not to relaunch a failed lane automatically.
+
+## Corrections authorized — 2026-11-09
+
+User: if findings are separate, report them; if related, fix them. All three are related: F3/F4 regressions introduced by this guard, F5 remaining original namespace missing-member path. No new issue filing or outside bug work needed. Authorized correcting all three in this branch; no extra reviewer lane or outward action started.
+
+Fail-before tests:11 new regressions fail and24 existing pass on d18e4097, /tmp/codegraph-cjs-fix-r3-regressions-before.log. New tests cover direct and forwarded value->namespace->value->namespace sync vs fresh; explicit dotted/bracket export aliases beside a still-absent-member decoy; alias removal by sync; out-of-scope sibling-block classes vs genuine same-block inner callers; TSnamespaceclassscope.
+
+Changes: F3 uses existing typeFrom dependency tracking on byName default-import member calls, includes each pure-forwarder file; activates the existing dependency-edge reopener for JS/TS paths while keeping failed-attribute retry Python-only. F4 namespace info tracks explicit assigned member names; new guard applies only to absent names. Escaping/computed/prototype-mutated exports remain uncertain and preserve existing behavior. F5 adds existing holderScopeAt block visibility to the class-shadow exemption, retaining function lexical visibility as well. Namespace memo stores traced files/member names; cache not poisoned by depth/cycle cutoffs.
+
+First focused verification AFTER all three corrections:3files49PASS0FAIL, /tmp/codegraph-cjs-fix-r3-regressions-after.log. Includes full35-case default-member suite and memo clearing/lifetime. No existing expected assertion weakened. Pending expanded JS/Python sync controls, normal full suite/build and original6-case repro. No new commit yet; earlier full pass applies d18e4097 only. Current changed files test + name-matcher + src/index.ts + src/extraction/index.ts. No unsafe constructor inference, import-resolver unchanged. Fourth review not yet requested/launched; gate and quota limits remain applicable.
+
+## Corrected commit verified by execution — independent review pending
+
+F3 class-name path also pinned: two new uppercase Store import-alias sync cases failed when only byName answers carried dependency metadata; /tmp/codegraph-cjs-fix-r3-upper-before.log. Final correction records imported-module inputs on name-matcher default-member answers from both class-name and method-name strategies. No change to confidence/byName selection. All original regression assertions retained.
+
+FINAL source tests:16files206PASS1SKIP, including37default-membercases, JS imports/sync andPythonattribute/memo controls. Log/tmp/codegraph-cjs-fix-r3-focused-final.log. Full normal suite exec42040EXIT0:872filesPASS19SKIP,10602testsPASS2expectedFAIL448SKIP0unexpectedFAIL,771.60seconds, /tmp/codegraph-cjs-fix-r3-full.log. Explicit npm run build exec37438EXIT0, /tmp/codegraph-cjs-fix-r3-build.log. Original portable6-case bug reproducer6/6PASS, /tmp/codegraph-cjs-corrected-final-sixcases.log. Node22.22.2/kernel0WASM; native not claimed. Source checksums prove no source changes between focused/full/build/testing and commit.
+
+LOCAL CORRECTION COMMIT559c76df6afd9e40f4d617ff77caa7db4ad03955, tre eb81d2063f4e787da5cfc7d28c619078fdc86e6b6, parentd18e40970fc5fbf32f635f6d8d536d1bdb24dacc. Personalrepository/remote/identity/stagedexact4-filediff andchecks verified. Trackedtreeclean, onlyprivate.reviewuntracked. No push/fixPR/merge/deploy or issuefiling. F3/F4/F5 status CORRECTED+executionPASS, awaiting independent verification; do not claim native review clearance.
+
+FOURTH ROUND ANSWER PENDING: async question asked permission and quoted ~/.codex/AGENTS.md: "where Claude's gate would ask the user at round 4, Codex denies, so stop and ask." User has not answered that new question; elapsed time is not approval. Do not launch fourth reviewers yet or modify gate state/control files. If approved use2freshread-onlynativefork_turns=none, same ledger, correction target `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff d18e40970fc5fbf32f635f6d8d536d1bdb24dacc..559c76df6afd9e40f4d617ff77caa7db4ad03955 -- src/resolution/name-matcher.ts src/index.ts src/extraction/index.ts __tests__/js-default-binding-members.test.ts`. Brief F3-F5, currentcorrections+invariants; no fullsuite rerun unless changes/failures justify it. Stop/ask if gate denies; last third adversarial lane failed finalization due usage cap, don't fabricateclearance.
+
+Durable original-workspace backup .review/commonjs-fix-2026-11-08/corrections-2026-11-09/:4sourcefiles, corrections.patch, checksums.json, before/after/focused/full/build/reprologs, verification.json identifyingfinalcommit/tree/outcomes, verified commonjs-fix.bundle containingbothlocalfixcommits with originalbase5e066489prerequisite. Commit recovery does not depend on /tmp survival. Current canonical handoff handoff-codegraph-commonjs-corrected-review-pending-2026-11-09.md supersedes corrections-running and review-blocked handoffs. OriginalT0unchanged/stopped; Tuesdayconditionalupstreamreport unchanged.
+
+## Fourth verification and modular correction — 2026-11-09
+
+User asked whether errors remain and approved proceeding, specifically requesting a smaller modular strategy for any remaining fix. Two fresh read-only minimal-context lanes review_broad_commonjs_verify4 and review_adversarial_commonjs_verify4 completed. BOTH independently CLEARED F3 direct/forwarded sync for ordinary and class-name aliases; F4 dotted/bracket callable/prototype aliases and removal sync; F5 block/namespace visibility and genuine inner shadows. Adversarial also verified Python failed-call retry/retyping and zero Python retry on JS-only edits. No full/build reruns or source edits by reviewers.
+
+F6 — P2 — src/resolution/name-matcher.ts:25444 raw exported-member discovery accepts comments, strings, regex literals, and unrelated object properties. With m.js exporting only known, adding `// exports.missing = fake;` or `function setup(holder) { holder.exports.missing = 42; }` makes named.missing falsely call decoy.js:Decoy::missing. Clean source has no call. Quoted/template/regex variants reproduce. This is newly added member inclusion, not the previous conservative default-text exclusion ruling. Exact broad evidence /tmp/cg-broad-verify4-classifier.{cjs,log}, /tmp/cg-broad-verify4-probes.cjs; adversarial /tmp/codegraph-cjs-verify4-extra.cjs. Both recommended one isolated token-aware collector validating executable assignments and bare exports/module.exports roots.
+
+Following user's authorized strategy: extracted readCommonJsExportMembers into new48-line(initial) src/resolution/commonjs-export-members.ts, with independent __tests__/commonjs-export-members.test.ts. Replaced matcher raw member/escape scanning with one helper call. Uses exact pinned production js-tokens9.0.1 (CommonJS, built-in types,16071unpackedbytes per officialnpmmetadata), no hand-written lexer or changedsharedstrip-comments scanner. Existingnamespace/default ownership tracing, sync/typeFrom and holderScopeAt behavior retained. Newpackage9chosen to keep CJS compatibility; upstream latestREADME refers to newerESMrequirebehavior. Source tokenizer was verified from officialrepo docs and installed package/types. No Node/packageversionbump.
+
+Fail-before graph regressions:8FAIL/37SKIP on559c76df, /tmp/codegraph-cjs-modular-before.log. New helper independently tests executable dot/bracket writes, template expressions/nesting, TSgenerics, JSXtext-vs-expressions, line/block comments, strings/templates/regex/control-regex, unrelated/Unicode/dollar roots, equality/typequeries, uncertain/prototype/computed APIs. Initial4files89PASS. Additional2positive runtime-API controls (literal eval export and require.cache default) exposed2FAIL before uncertainty handling; /tmp/codegraph-cjs-modular-uncertain-before.log. Added explicit uncertainty for literal eval code and Node module/cache APIs, preserving genuine dynamic exports while ordinary data remains opaque. All existing expected assertions retained.
+
+Latest modular focused gate18files260PASS1SKIP, /tmp/codegraph-cjs-modular-expanded-final.log; includes47default-member graph cases,38pure helper cases, priorJS/Python/sync/memo/lazy-engine controls. Source remains dirty relative559c76df in6files: newhelper/newunit test (intent-to-add makes visible in Gitdiff), existing integrationtest/matcher and package.json/package-lock. No new commit yet. No outwardactions. Full current modular suite/build still pending; parent10602PASS does not cover new modular code.
+
+User's conditional approval includes correcting any residual error with this smaller strategy and verifying it. Next fresh verification target is559c76df..working tree, sameledger and6paths; keep native round count honest (fifthverification), no target/state reset. Stop/ask if host gate denies; do not bypass. Review ONLY F6 closure and regressions of helper/adapter/dependency, plus bounded preservation checks. Source stable after260focusedPASS; no repeatedfull/build by reviewers. Prefer existingdist+scratch probes; underlyingthree corrections already independently cleared.
+
+
+## Fifth verification — modular source reader, 2026-11-09
+
+Fresh read-only lanes review_broad_commonjs_modular5 and review_adversarial_commonjs_modular5 both completed. Both cleared F6 phantom comments/strings/templates/regex and unrelated roots, plus preservation of real aliases, sync, scope and Python behavior. Production js-tokens9.0.1 packaging compatibility cleared. No source edits or redundant full-suite runs by reviewers.
+
+F7 — P2 — src/resolution/commonjs-export-members.ts:37 recognizes eval uncertainty only when a bare eval immediately receives a StringLiteral. Both reviewers reproduced template-literal eval dropping a real Store::load call. Adversarial additionally reproduced `(eval)('exports.load = Store.prototype.load;')`. Both runtime mutations return42; previous reader preserves Store::load, current reader emits no calls. Literal single-quoted bare eval control remains green. Evidence /tmp/codegraph-cjs-adversarial5-eval.{cjs,log}. Fix only the small helper: account for grouped bare eval callee and template literals, preserve class method named eval as non-call text. Add fail-before controls; do not alter name-matcher, sync or scope corrections for F7.
+
+Pre-F7 modular full normal suite EXIT0, 873 files PASS19SKIP, 10650 tests PASS2expectedFAIL448SKIP0unexpectedFAIL,780.27sec. /tmp/codegraph-cjs-modular-full.log. This run does not cover the upcoming F7 correction. Current source remains local and dirty relative559c76df. No push, source PR, merge, deployment or upstream report. Original T0 pilot remains stopped/uncommitted.
+
+
+F7 correction: literalEvalCall now unwraps paired bare-callee parentheses and grouped arguments, accepts StringLiteral/NoSubstitutionTemplate/TemplateHead. Does not execute eval or inspect data token contents; method declaration named eval remains ignored. Added4 pure-reader controls and2 graph positives. Before change:6FAIL85PASS (/tmp/codegraph-cjs-modular-eval-before.log); after:91PASS across2files (/tmp/codegraph-cjs-modular-eval-after.log). git diff --check PASS. No changes to the matcher adapter, sync or scope for F7. Full-suite PASS above predates this correction; normal final full suite and independent review of the F7 correction remain pending. Local changes uncommitted. Build result pending.
+
+Explicit final F7 npm run build EXIT0, /tmp/codegraph-cjs-modular-eval-build.log; viewer,29grammars,runtime and dist engine checks PASS. Final full suite and independent F7 verification still pending; do not conflate pre-F7 full pass with final-tree clearance. Checkpoint backup .review/commonjs-fix-2026-11-08/modular-eval-2026-11-09/ in original QA workspace contains6current sourcefiles, cumulative and modular patches, hashes, logs and this ledger. Source unchanged since91focusedPASS/build.
+
+
+## Sixth verification authorized and running — 2026-11-09
+
+User explicitly answered yes to final verification. Fresh read-only native lanes review_broad_commonjs_eval6 and review_adversarial_commonjs_eval6 launched against559c76df..workingtree six modular paths and same ledger. No gate reset/bypass or Claude-only skill claim. Both focus F7 closure and neighboring invariants; no full/build reruns by reviewers. Parent full normal CODEGRAPH_KERNEL=0 npm test -- --maxWorkers=4 runs session5033, /tmp/codegraph-cjs-eval6-full.log. Snapshot hashes /tmp/codegraph-cjs-eval6-frozen.json. No final results yet. Final explicit build before this full run passed; test setup refreshed engine assets itself. No source changes during review/tests, no outward actions. Personal origin/identity rechecked: inth3shadows/codegraph, Eric Minish / eric.minish@gmail.com. Current six modular files remain uncommitted.
+
+
+## Sixth verification result — 2026-11-09 — NOT READY TO MERGE
+
+Both fresh read-only lanes completed normally. Adversarial CLEARED F7: original3 runtime/graph forms plus11 additional runtime-backed graph controls preserve real exports and reject inert eval-looking data/method declarations. Evidence /tmp/codegraph-cjs-adversarial6-eval.{cjs,log}. Broad independently passed13 intended F7/nearby controls, but found F8 in the correction. No source edits/build/full reruns by reviewers. No final dual clearance.
+
+### F8 — P2 — literalEvalCall mistakes function-argument parentheses for grouped eval callees (broad)
+
+Reviewer location src/resolution/commonjs-export-members.ts:20, loop lines20-24. Exact input:
+
+```js
+exports.known = function known() {};
+function wrap(value) { return function ignore(code) {}; }
+wrap(eval)("ignored");
+```
+
+Runtime exports only known. Current reader returns uncertain:true, making named.missing() falsely resolve to decoy.js:Decoy::missing. Restoring only the pre-F7 literal-eval check in memory returns uncertain:false and no call. wrap((eval))(("ignored")) also reproduces. Evidence /tmp/cg-broad-verify6-callee-compare.log, adjacent .cjs; initial probe /tmp/cg-broad-verify6-callee-context.{cjs,log}. Broad passed all13 intended controls including grouped direct eval, templates, method named eval, real template-expression exports and callable aliases. Adversarial's bounded probes did not include this counterexample; its clearance does not override the demonstrated defect.
+
+Parent full suite intentionally stopped with SIGINT after confirmed F8; exact cwd/argv guarded signal to only isolated checkout main Vitest, tool session5033 EXIT130. /tmp/codegraph-cjs-eval6-full.log is PARTIAL, NOT a full pass/failure result. Avoid wasting a known-defective verification cycle. Prior91focusedPASS and explicit buildPASS remain true for this source, prior10650fullPASS predates F7 and cannot clear current tree. SHA256 snapshot recheck confirms all6 reviewed source paths unchanged during verification. No new source commit, push, fixPR, merge, deployment, version/tag/npm or upstream report.
+
+Stop this correction cycle and report F8. User yes authorized final verification, not another correction/review cycle or publishing. Need user decision before next step, as previously requested. Durable evidence in original QA .review/commonjs-fix-2026-11-08/final-verification-2026-11-09/. Previous modular-eval source/patch backup still matches frozen source. Keep original T0 stopped/uncommitted. Do not reset review count/gate or rewrite control files.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-evidence-prototype-2026-11-09/README.md b/docs/handoffs/pr29-2026-11-10/history/pr29-evidence-prototype-2026-11-09/README.md
new file mode 100644
index 0000000000..f25e5b15b3
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-evidence-prototype-2026-11-09/README.md
@@ -0,0 +1,60 @@
+# CommonJS export evidence experiment
+
+This isolated experiment tests whether compiler binding identities and explicit export-to-target relationships can address the PR29 review failures. It is not integrated into CodeGraph. The production checkout and all 15 dirty source files are unchanged.
+
+Run from this directory:
+
+```bash
+node -e 'require("./bindings.test.cjs"); require("./acceptance.test.cjs")'
+node --expose-gc measure.cjs
+```
+
+The experiment uses Node 22 and the existing development installation of TypeScript 5.9.3. It installs no dependencies. If the original checkout moves, point `CODEGRAPH_PROTOTYPE_REPO` at a checkout with TypeScript installed. The files here do not require the repository's `dist/` output.
+
+## What the experiment established
+
+- Compiler lexical name resolution distinguishes the CommonJS wrapper parameter from shadowed local bindings. `getSymbolAtLocation` is insufficient for this purpose because TypeScript can return inferred CommonJS export symbols; the experiment uses `checker.resolveName` for identifier bindings.
+- Parenthesized/bracket assignment syntax is represented structurally, without spelling exceptions.
+- Targets are reached through modeled export members/values and actual declaration records. There is no search for a method with a matching global name.
+- Object identity and statement order matter. Replacing `module.exports` does not rebind `exports`; old aliases and subsequent prototype writes must retain their identities.
+- Unhandled constructs return `unknown` with a reason and no target. Unknown is distinct from absence in the modeled object subset.
+
+Final verification: **78 tests passed, 0 failed, 0 skipped** in `final-tests.tap`; all six current JavaScript files passed `node --check`.
+
+## Files and contract
+
+- `bindings.cjs`: virtual compiler host, synthetic CommonJS wrapper, lexical symbol identities, source ranges, source hash and analyzer version.
+- `evidence.cjs`: bounded, ordered symbolic reducer. `EvidenceWorkspace.resolveImport(from, specifier, member)` returns `resolved` with target/proof records, `absent` for a missing modeled property, or `unknown` with reasons. Target strings label declarations; proof ranges disambiguate identities. They are not CodeGraph node IDs.
+- `runtime.cjs`: independent binding/assignment behavior oracle using actual Node CommonJS wrappers, executing only fixtures defined in the test file. It never loads or executes project source. The model and oracle share only the small relative fixture-path resolver.
+- `bindings.test.cjs`: 15 compiler identity/parser tests, including eight shadowing forms and the inferred CommonJS symbol pitfall.
+- `acceptance.test.cjs`: 63 acceptance/property/boundary tests.
+- `measure.cjs` / `measurements.json`: reproducible small-fixture measurements.
+- `progress.json`: saved milestones, including actual failures. Earlier source snapshots and red/green TAP logs remain available.
+
+Proof records carry import, whole-export/member-write, declaration, instance and forwarding steps, source ranges, hashes, and analyzer version. Literal eval payload records identify the call site and payload hash separately.
+
+## Supported experimental subset
+
+The reducer models selected synchronous statements, compiler-bound variables/functions, plain object members, classes with ordinary methods and implicit constructors, instance/prototype identity, direct aliases, relative forwarding, and `=`, `&&=`, `||=`, `??=` assignments. It models simple local calls so that a parameter named `module` modifies its argument rather than the wrapper object.
+
+Direct intrinsic eval with a statically known string can supply property assignments in the current modeled scope. Its payload is parsed and reduced; the analyzer does not execute it. Indirect/optional eval returns unknown. A local function called `eval` is modeled as that local function.
+
+The analyzer has 2,048 reduction steps and a call-depth limit of eight. These budgets do not bound the compiler's parsing/binding cost and are not a production robustness claim.
+
+## Explicit limitations
+
+- **Generator execution is unsupported.** The genuine F11 generator-eval example returns unknown. Existing production compatibility therefore remains a blocker. The opposite F11 computed-key wrapper example passes.
+- This already contains a small symbolic evaluator. Do not copy it wholesale into the product as another narrow matcher fix.
+- Arbitrary calls, asynchronous effects, unknown conditions, custom constructors, inheritance, spreads/accessors, destructured/default/rest parameters, and cyclic initialization are outside the subset. Unsupported operations conservatively stop the modeled analysis.
+- This is not a complete ECMAScript interpreter or sound analysis of arbitrary programs. Parse diagnostics are checked; full early-error/semantic validation, all descriptor/prototype semantics and all JavaScript built-ins are not modeled.
+- Tests exercise controlled JavaScript fixtures. They do not establish TypeScript/JSX/native-kernel parity or real-project coverage.
+- Editing an `EvidenceWorkspace` recomputes analysis and is compared with a fresh workspace. This is **not** validation of CodeGraph's actual incremental sync, persisted metadata, cache invalidation or worker transport.
+- There are no production graph edges, node-ID mapping, schema changes or dependency changes here. TypeScript is currently a development dependency in the repository; using it at runtime would require a separate packaging/performance decision.
+
+## Measurements and recommendation
+
+In the recorded run, loading the experimental model/compiler took about 249 ms and increased heap use by about 17 MiB. Warm median resolution was about 1.25 ms for a 147-byte fixture and 1.70 ms through a forwarder. These are process-local toy measurements, not indexing throughput or a performance acceptance bar.
+
+Retain this as an offline reference model and regression corpus. The production direction remains one binding-aware export fact model consumed by import resolution and candidate selection. A candidate needs an export relationship to its declaration/type; a file-level flag must not authorize a global name guess. Production integration needs a defined dynamic-eval contract, one fact producer, node-ID/provenance mapping, and measured runtime/dependency costs. The closed reducer's exact initialization model should not accidentally become the product's promised JavaScript semantics.
+
+F12 equivalent-assignment cases and F13 remain open in the unchanged production checkout. No independent review, normal build/full suite, commit, push, merge or deployment was performed for this experiment.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-evidence-prototype-2026-11-09/handoff-codegraph-pr29-evidence-prototype-complete-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/history/pr29-evidence-prototype-2026-11-09/handoff-codegraph-pr29-evidence-prototype-complete-2026-11-09.md
new file mode 100644
index 0000000000..ede4cd859b
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-evidence-prototype-2026-11-09/handoff-codegraph-pr29-evidence-prototype-complete-2026-11-09.md
@@ -0,0 +1,46 @@
+# PR29 isolated evidence prototype COMPLETE — production unchanged
+
+Latest authoritative checkpoint. User approved an isolated prototype and acceptance tests after round10, then explicitly said save progress as you go. This authorized experimental files only, not production integration, another review, builds/fullsuite, commits/pushes/merge/deploy. No scheduled continuation. Preserve checkout and all dirty work.
+
+## Workspace and state
+
+Production /tmp/codegraph-cjs-missing-fix-20261108, branch fix/commonjs-eval-callee-context, HEAD87576a8d9ff0d8aba235db5535f5f4429f14b037. All15 dirty source/test hashes match the round10 manifest throughout and at completion; no production changes this phase. F12 equivalent-assignment variants and F13 shadowed-module regression remain OPEN in production. Original F12/F10/F11 controls remained cleared at prior snapshot; this experiment is not a new production review. Review count10, no resets.
+
+Prototype is durable at:
+/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-evidence-prototype-2026-11-09
+
+Files: README.md (contract/limits), bindings.cjs, evidence.cjs, runtime.cjs, bindings.test.cjs, acceptance.test.cjs, measure.cjs, progress.json, results.json, measurements.json, artifact-sha256.json; milestone source snapshots and all actual TAP logs. Original QA T0 files untouched; only its allowed private .review directory used. Nothing committed/published. Personal identity/publication boundaries from session-end handoff still apply.
+
+## Actual results
+
+- Milestone1:13 binding/parser tests passed.
+- Acceptance baseline stub:49FAIL/5PASS.
+- Initial reducer:21PASS/33FAIL exposed a compiler API mismatch. getSymbolAtLocation sometimes returns inferred CJS export symbols for assignment uses, not lexical wrapper parameter identity. Added2failing regressions, verified checker.resolveName(name,node,Value,false) gives lexical identity, then15binder+54acceptancePASS.
+- One bounded semantic-boundary pass:8FAIL/55PASS, then63acceptancePASS after modeling shared binding cells, var redeclaration, actual prototype links, indirect/optional eval distinction and explicit unsupported class-prototype replacement. No test expectations weakened.
+- Final combined run:78PASS,0FAIL,0SKIP, final-tests.tap. All6current.cjs files passed node --check. No repository build/fullsuite or new independent reviewers.
+- Small147-byte fixture measurements: model/compiler cold import249.23ms, heap delta17.07MiB; warm median direct1.25ms/forwarded1.70ms,50samples each. These are not CodeGraph indexing/large-repo/cache/worker/native measurements.
+
+Test command from prototype directory:
+node -e 'require("./bindings.test.cjs"); require("./acceptance.test.cjs")'
+Measurement: node --expose-gc measure.cjs
+Requires existing TypeScript5.9.3 dev installation in checkout; CODEGRAPH_PROTOTYPE_REPO can point at another checkout with it installed. No dependency install occurred.
+
+## What is established
+
+TypeScript compiler lexical identities distinguish wrapper module/exports bindings from local function/arrow/block/var/TDZ/destructured/catch/loop bindings. Structural parsing handles reviewed parenthesized/bracket/logical assignments. Bounded reducer follows object identity/order and real declarations; no global method-name search. Results have resolved/absent/unknown statuses, proof steps/ranges, dependency source hashes and analyzer version. Controlled runtime fixtures provide separate CommonJS semantics witnesses. Equivalent-syntax/shadow/decoy properties, direct+forwarded imports, and in-memory update=fresh analysis are pinned.
+
+## Limits / stop condition
+
+This became a small symbolic evaluator; do NOT port it wholesale as a narrow matcher correction. Generator execution, including genuine F11 generator eval, is explicitly unknown. Only controlled JavaScript fixtures exercised. Other unsupported operations return unknown; this is not complete/sound arbitrary ECMAScript analysis. No CodeGraph node-ID mapping, graph edges, real sync/persistence/cache/worker/native validation. TypeScript remains a development dependency; runtime use needs packaging/performance approval. Production compatibility is NOT cleared.
+
+## Recommended next decision (not approved implementation)
+
+Keep prototype as offline reference corpus. Define one binding-aware production export-fact contract before integration:
+1. Per export/member, preserve positive relationship to declaration/type selectors and source ranges; retain wrapper binding identity and forwarding path. File-level flags never authorize global guesses.
+2. Separate positive evidence from completeness/unknown reasons. Missing/stale/version-mismatched facts supply no absence proof or target identity. Source hash plus producer version identify facts.
+3. Model graph relationships as static potential relationships with provenance; do not accidentally promise this prototype's exact module-initialization execution semantics. Assignment order, conditional mutations and eval support need explicit rules.
+4. Decide how literal eval in generator scope produces supported positive evidence while retaining F10/F11. The current closed evaluator does not meet this requirement. Arbitrary eval support must not be inferred from a boolean.
+5. Choose a single fact producer and migrate competing export readers (token reader, extraction helper, import-resolver regex) into consumers or retire them. Runtime compiler dependency vs existing parser needs a measured decision; do not invent another regex binder.
+6. Production acceptance includes current full regression corpus plus binding/operator/scope transformations, real index/sync/worker/store paths, and documented native check limitation until binary available. Final normal build/fullsuite once after stable independently reviewed integration, within actual user approval.
+
+No additional implementation is approved. Report prototype result and limitations; ask before production integration or further review. Read README/results rather than rerunning completed checks without a new reason.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-evidence-prototype-2026-11-09/plan-codegraph-pr29-evidence-prototype-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/history/pr29-evidence-prototype-2026-11-09/plan-codegraph-pr29-evidence-prototype-2026-11-09.md
new file mode 100644
index 0000000000..3c6843f70a
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-evidence-prototype-2026-11-09/plan-codegraph-pr29-evidence-prototype-2026-11-09.md
@@ -0,0 +1,16 @@
+# PR29 isolated export-evidence prototype — approved
+
+User approved isolated prototype + acceptance tests, then requested save-as-you-go checkpoints. Production checkout and its 15 dirty source paths must remain unchanged. Current review state F12 variants/F13 open, round10 complete; no new review/publication authorized.
+
+Workspace: /home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-evidence-prototype-2026-11-09 . Use installed TypeScript 5.9.3 only as a dev-time scope/binding experiment, no dependencies added to project. Node built-in test runner, controlled runtime fixtures only.
+
+Milestones, each saved before proceeding:
+1. Validate established binder: actual CommonJS wrapper parameter identity vs local function/block/arrow bindings; parse diagnostics for F10/F11 contextual yield. Record feasibility and limits before choosing implementation.
+2. Implement minimal evidence model/proof paths in isolated files. Positive export/member/instance evidence, independent unknown states, deterministic conflict/unsupported policy. No global-name fallback. Explicitly constrain initialization/order/conditional/alias behavior. Retain proof provenance/ranges and source hash+analyzer version.
+3. Acceptance tests first/red, then implementation/green: original and variant F12, F13; syntax-equivalence/shadow/decoy properties; direct/forwarded; controlled literal eval vs unknown; fresh vs cached/updated model. Compare controlled Node runtime witnesses where applicable, mark unsupported distinctly. Do not claim real CodeGraph sync/native integration or parity.
+4. Record measurements, failures/limits and next integration decision. Save all prototype source/tests/results and a self-contained handoff in plans. Verify production hashes every milestone. No production code, root dependencies/schema/grammar, fullsuite/build, commits/pushes/merge/deploy.
+
+Approval boundary: further production integration requires user approval. A failed feasibility assumption is a result to report, not permission for an unbounded compiler subsystem.
+
+## Completed
+Isolated prototype complete:78tests,6syntax checks passed. Milestone snapshots and actual failure histories saved; production15hashes unchanged. Final report/limits: /home/ericm/.codex/plans/handoff-codegraph-pr29-evidence-prototype-complete-2026-11-09.md. No production integration approved.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-export-evidence-integration-2026-11-09/commonjs-eval-callee-context.md b/docs/handoffs/pr29-2026-11-10/history/pr29-export-evidence-integration-2026-11-09/commonjs-eval-callee-context.md
new file mode 100644
index 0000000000..ffeaf33199
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-export-evidence-integration-2026-11-09/commonjs-eval-callee-context.md
@@ -0,0 +1,219 @@
+# Separate F8 follow-up (review round count remains six)
+
+User explicitly authorized committing/pushing current work to a PR and separating remaining correction. Current snapshot committed5d384989957c91b482068b306535437915a0595b, pushed fix/commonjs-missing-member, DRAFT https://github.com/inth3shadows/codegraph/pull/28 against main. KnownF8 documented, not ready to merge alone. No deploy/merge/upstream report.
+
+New branch fix/commonjs-eval-callee-context based on5d384989. Exact prospective Git target: git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5d384989957c91b482068b306535437915a0595b -- src/resolution/commonjs-export-members.ts __tests__/commonjs-export-members.test.ts __tests__/js-default-binding-members.test.ts
+
+F8 reviewer finding and prior invariants remain in .review/commonjs-missing-member.md; do not reset shared gate/round count. Two sixth reviewers completed; broad demonstrated F8 despite adversarial clearing intended F7 cases. This follow-up has NOT had independent dual review yet.
+
+Correction: distinguish grouping around bare eval from another function's argument list using token before parentheses. Wrapper identifier/call/member/optional-call/tag/control-condition prefixes must not mark exports uncertain. Grouped direct eval, literal/template arguments and expression prefixes such as return must keep prior behavior. Change limited to9helper lines plus independent unit and real-index graph regressions; no matcher/sync/scope changes.
+
+Before fix8FAIL92PASS; tag-result additional case1FAIL49PASS. Final focused2files101PASS, /tmp/codegraph-cjs-eval-followup-focused.log. Build/full pending. Hashes /tmp/codegraph-cjs-followup-frozen.json. Logs /tmp/codegraph-cjs-eval-followup-{before,tag-before,focused,build}.log. Need staged exact3-file diff, personal repo/identity and actual build result before commit/push. Full normal suite required before readiness claim. Keep follow-up draft and explicitly state review pending. No additional reviewer agents launched in this follow-up; user plans to point agents at PRs.
+
+Keep both PRs draft. Follow-up base should be fix/commonjs-missing-member, producing only the small correction diff. Review/merge follow-up into parent branch before considering parent PR for main; no merge authorized by current request. Preserve original T0 pilot and all deploy/control worktrees.
+
+Published DRAFT https://github.com/inth3shadows/codegraph/pull/29, commit87576a8d9ff0d8aba235db5535f5f4429f14b037, base fix/commonjs-missing-member/PR28 at5d384989. Explicit buildPASS; normal full suite RUNNING session62594, /tmp/codegraph-cjs-eval-followup-full.log. Both pushed/draft, neither merged/deployed; follow-up independent review stillpending. Original T0 untouched.
+
+
+FINAL execution verification2026-11-09: normal full suite session62594 EXIT0,873filesPASS19SKIP,10666testsPASS2expectedFAIL448SKIP0unexpectedFAIL,800.20sec. /tmp/codegraph-cjs-eval-followup-full.log. 101focusedPASS and explicit buildPASS on same87576a8dsource. Final3changed-file SHA256 checks PASS, trackedtreeclean; actual remoteheads rechecked5d384989(PR28) and87576a8d(PR29). PR29 body updated with exact final validation. Both PRs still DRAFT/unmerged; no deployment/upstream write. FOLLOW-UP INDEPENDENT REVIEW STILL PENDING: do not conflate fullsuite with review clearance. No further tests/build/review processes running. Saved final checkpoint and full log under original QA two-draft-prs backup.
+
+
+## Seventh native review explicitly requested — PR29 — 2026-11-09
+
+User invoked /dual review29. Exact GitHub base5d384989957c91b482068b306535437915a0595b and head87576a8d9ff0d8aba235db5535f5f4429f14b037 verified. Fresh read-only native lanes review_broad_pr29_round7 and review_adversarial_pr29_round7 launched together with same exact Git target and this ledger. Both focus full3-file29-line correction, F8 closure and nearby invariants; bounded execution probes only, no repeat full/build or source edits. Parent does not reread reviewed diff or duplicate reviewer probes. No review results yet; no independent clearance claim. Do not reset round count/gate, change source, push, merge or deploy in this review-only turn. Stop and report merged findings when both complete.
+
+
+## Seventh native dual review result — PR29 — 2026-11-09
+
+Both fresh read-only lanes completed normally: review_broad_pr29_round7 and review_adversarial_pr29_round7. Exact target remains5d384989957c91b482068b306535437915a0595b..87576a8d9ff0d8aba235db5535f5f4429f14b037. Source hashes verified unchanged, trackedtreeclean except private untracked.review. No source edits/build/fullsuite reruns/commits/pushes/GitHubcomments/merge/deploy. Both PRs remain draft. Current review DOES NOT CLEAR PR29 despite prior101focusedPASS/full10666PASS/buildPASS. Parent merges findings from actual final reports without re-verifying/re-reading diff.
+
+### F9 — P2 — Preserve grouped direct eval in control-statement bodies (BOTH)
+
+Broad location src/resolution/commonjs-export-members.ts:31: rejects any preceding ), including a completed if or for condition. Exact input `class Store { load() { return 42; } }
+if (true) (eval)('exports.load = Store.prototype.load;');`. Runtime exports load() returning42, but current discovery uncertain:false and indexing named.load() produces no call. Removing only new prefix guard in memory restores uncertain:true and m.js:Store::load. Nested grouped eval in unbraced single-iteration for body reproduces too. Broad evidence /tmp/cg-broad-pr29-control-context.{cjs,log}; exact command `node --experimental-wasm-exnref --experimental-wasm-stack-switching /tmp/cg-broad-pr29-control-context.cjs`.
+
+Adversarial independently confirms same location/trace; grouped-template if-body and for-body also reproduce. Evidence /tmp/codegraph-cjs-adversarial7-conditional-eval.{cjs,log}. De-duplicated as one P2 F9. This is a NEW regression introduced in PR29, not a pre-existing parent limitation.
+
+### F8 — P2 — PARTIALLY CORRECTED, remains for contextual-keyword wrapper names (adversarial)
+
+Exact reviewer location src/resolution/commonjs-export-members.ts:29 (whitelist:7). Valid CommonJS `function await(value){return function ignore(code){};} await(eval)("ignored");` passes eval without invoking it, but whitelist exemption produces uncertain:true and falsely resolves named.missing() to decoy.js:Decoy::missing. With exports.known=function known(){}, runtime exports only known; pre-F7 behavior restored in memory produces no call. yield reproduces too. Evidence /tmp/codegraph-cjs-adversarial7-contextual-wrapper.{cjs,log}. This is a RESIDUAL F8 variant, not a new unrelated parent re-audit. Do not label all F8 closed.
+
+### Confirmed preservation / rulings
+
+Both independently clear original F8 forms wrap(eval)("ignored") and wrap((eval))(("ignored")): runtime onlyknown, reader uncertain:false, no decoy call. Broad /tmp/cg-broad-pr29-f8-closure.{cjs,log}. Adversarial13runtime-backed graph controls pass (original2forms +11nearby controls), /tmp/codegraph-cjs-adversarial7-controls.log. True standalone grouped/template eval, return expressions, inert data/method declarations, call/member/optional/tag/condition-prefix negatives retain tested behavior. These controls do not answer F9 control-body context or F8 await/yield wrappers.
+
+### Next boundary
+
+Review-only user request is complete. STOP: no fixes, additional review loop, external review comment, markready, merge or deploy without user instruction. The per-step confirmation request remains in force. This is round7 overall; no gate/state reset. Repeated grouping-prefix patches now demonstrate syntax-context ambiguity: if user asks for remediation, choose an evidence-based smaller boundary/design instead of another unbounded keyword/punctuation whitelist. Preserve both concrete repros and all prior controls. Do not repeat fullsuite/build on unchanged source. Actual durable result/evidence/checksums saved in original QA .review/commonjs-fix-2026-11-08/pr29-review-round7-2026-11-09/.
+
+
+## AST redesign approved and started — 2026-11-09
+
+User explicitly approved AST redesign in PR29, said near usage max and asked for a resumable start, then said proceed. This revokes prior review-only stop for in-scope remediation; do not ask same approval on resume. Preserve per-step/user and actual gate boundaries for later merges/deployments. No grammar/runtime/dependency/database-schema changes, commits or pushes in this partial phase; PRs remain draft at prior heads.
+
+Newgraph regressions FIRST:3control-body direct-eval variants(if string/template, for nestedgroups) +await/yield CommonJS wrappers,5FAIL51SKIP on current87576a8d. /tmp/codegraph-cjs-ast-red.log, EXIT1. This intentionally RED gate remains unchanged because integration pending.
+
+New isolated src/extraction/commonjs-eval.ts reads existing SyntaxNode tree and checks actual call.function after unwrapping parenthesized_expression. Returns true for syntacticdirectevalcall(anyargument), false for provenabsence, null for parseerrors with no foundcall. New __tests__/commonjs-eval.test.ts loads existingJS/TS/TSXgrammars:33PASS, /tmp/codegraph-cjs-ast-helper.log EXIT0. Controls cover reports, grouped/interpolated eval, return, generatorfunctions/methods, nestednongenerator scope, eval inside yieldwrapper argument, inert data/methods/membercalls, JSX and malformedsource. Helper not wired to classifier/extraction yet. Existing lexical reader/EXPRESSION_PREFIX_WORDS unchanged for now. Do not claim F8/F9 closed, new full/buildpass or finalreview.
+
+IMPORTANT new evidence: existingJSgrammar correctly models control-body eval and awaitwrapper but parses legal CommonJS yield(eval)(code) as yield_expression whose operand is a call on(eval), no parseerrors. ASTscope must distinguish nongeneratorwrapper from generator yield. Helper handles direct yieldoperand only via nearestfunction/generator/methodscope; nested true eval in yield(eval(code)) remains detected. Shapeprobe /tmp/codegraph-cjs-ast-shape-probe.{cjs,log}. Extractionreferenceprobe /tmp/codegraph-cjs-eval-reference-probe.{cjs,log} shows currentextractor emits callref eval for genuinecall AND synthetic yieldwrappercase. Consequently raw existing unresolved eval refs alone are insufficient. User was explicitly told this grammar limitation, not falsely assured all cases are parser-perfect. No grammarfiles changed.
+
+Next integrate factualcallresult through existingextraction to resolver. Node has NO metadata field (onlyedges do); do not invent Node.metadata, abuse signature/selfedges/candidates, or introduce schema migration casually. ExtractionResult can carry optionalfact through workerclone; need native/deferred bypass parity. Main bulk parse pools only load grammars in workers; resolver cannot assume synchronous getParser is ready in main. Suggested project_metadata perfile/sourcehash transport or another small explicit extractioncontext capability; persist/refresh under same successfulstore lifecycle, cover storeworker and sync. Decide carefully before editing infrastructure. Resume must preserve all existing tests and5newred cases; unknown/missing/error facts must not masquerade as provenabsence. Keep existing export-member tokenizer and previous sync/scope/alias fixes intact; remove prefixheuristics only onceASTfacts actuallysupplied.
+
+Saved current3sourcefiles, patchrelative87576a8d, hashes, red/green/probe logs under original QA .review/commonjs-fix-2026-11-08/ast-redesign-started-2026-11-09/. No tests/build/reviewers running at checkpoint. Newfiles intent-to-add only so diffincludes them, not readyforcommit. No fresh dualreviewagents this phase. Overall reviewcount7; do not reset gate/controlstate. Resume directly integration and targeted tests; fullsuite/build only after stablefix, fresh focuseddual review as authorized/actualgatepermits, no repetitivewholeprojectwork. OriginalT0stillstopped/uncommitted; liveem40 unchanged; no merges/deploy/upstream writes.
+
+
+## AST integration execution-tested — verify round8 pending
+
+User approved AST redesign with focused review before final fullsuite, then resumed. Current dirty correction target87576a8d..workingtree,15paths captured /tmp/codegraph-cjs-ast-frozen.json (allnewfilesintent-to-add). No sourcecommit/pushyet; publishedPR29still87576a8d. No grammar/runtime/dependency/schema changes.
+
+Implemented AST fact in ExtractionResult and ephemeralFileRecord property; WASM computes from existingtree, native/deferred routes compute with existinggrammar; kernelmaterializer preservesfact. Allstorepaths carryFileRecord fact through existingwriter, upsertFile writes project_metadata commonjs_eval:<file> containingcontentHash/value. Nosecondwriter orNode.metadata. deleteFile removesfact. Coordinatorcontext acceptsboolean onlyonexact SHA256sourcehash. Missing/malformed/stale/nullfacts returnunknown, neverabsenceproof. Tokenreader removed literalEvalCall/EXPRESSION_PREFIX_WORDS, consults lazyASTfact atmostonceonlywhenbareevaltokenpresent; unknown staysconservative. Existingmembertokenizer/sync/typeFrom/scope unchanged. CHANGELOG alreadyrequiresre-indexafterupgrading(line56), which suppliesnewfacts; no legacyfactmigrationclaimed.
+
+Original5newgraphregressionsRED5FAIL51SKIP beforeintegration. Initialintegratedrun blocked by compiler: hashContentisexportedfromextraction/index, notutils; corrected byusingexistingcreateHashcrypto inresolver (sameSHA256algorithm), no circularextractionimport. Then3files140PASS. AddedrealSQLite factlifecycle4cases(missing/malformed/null, hashstale/replace,rollbackwithfiletransaction, deletion) andfreshindex-vs-sync wrapper->if-eval->yield-wrapper->for-eval->wrapper sequence. Final8files166PASS1SKIP, /tmp/codegraph-cjs-ast-expanded.log, CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2; alsoincludesmemo/synccaches/lazy-engine. Nativebinarynotstaged(codegraph-kernel/prebuilds/linux-x64/codegraph-kernel.node absent); kerneltransporttestskipped. Do not claimnativeexecution. Enginecompiledbytestsetup,currentdistmatchesfrozen sources. No explicitfinalnormalbuild/fullsuiteorindependentreviewyet. Priorfull10666PASSbelongs87576a8donly.
+
+Next eighthfreshnativeREADONLYlanes verify this correction, sameledger andexactGitdiff87576a8d..workingtree. Boundedruntimeprobes only, no fullsuite/build orsourcechanges. CheckF8/F9closure,generator-awareyieldworkaround, actualevalvswrappercallee, sourcehashfactlifecycle/workertransport/sync, previouscontrols. Do not re-audit unrelatedparentlimitations. Stop/reportifreviewfindsissues; do notresetgate/count orclaimClaude-onlyskill.
+
+
+## Eighth native review COMPLETED — AST correction NOT CLEARED
+
+Both fresh read-only reviewers completed normally on frozen15-file87576a8d..workingtree correction. Both confirm no source edits/build/full reruns/control changes; source hashes unchanged. No final normalbuild/fullsuite run or commit/push. PublishedPR28/29 remain drafts at5d384989/87576a8d. Prior166focusedPASS1SKIP is true and covers original5reportedgraphcases, but does not clear new findings. Nativebinary absent, no nativeexecutionclaim. Parent uses actual reports, no independent duplicate repro/diffread.
+
+### F10 — P2 — Optional contextual-keyword wrappers regress (adversarial)
+
+Exact reviewer location src/extraction/commonjs-eval.ts:37. Valid CommonJS:
+
+```js
+exports.known = function known() {};
+function yield(value) {
+  return function ignore(code) {};
+}
+yield?.(eval)("ignored");
+```
+
+Runtime exports only known; eval is never invoked. Existing grammar reports parse error, helper returns null, reader marks exports uncertain, and named.missing() falsely calls unrelated decoy.js:Decoy::missing. Actual current correction calls:[decoy.js:Decoy::missing]; base87576a8dreader restored in memory calls:[], uncertain:false. Evidence /tmp/cg-a8-yield-optional.{cjs,log}, /tmp/cg-a8-yield-optional-base.{cjs,log}, /tmp/cg-a8-probe.cjs. New F8-adjacent regression introduced by AST correction. Unknown fact correctly avoids false absence proof but must not license false call targets; current fallback still does.
+
+### F11 — P2 — Computed method names use enclosing scope (broad)
+
+Exact reviewer location src/extraction/commonjs-eval.ts:51. Treats a computed method name as belonging to that method's function scope. Computed names execute in enclosing scope. Confirmed both directions:
+
+1. `class Store { load(){return 42;} } function* setup(){ const obj = { [yield (eval)('exports.load = Store.prototype.load;')]() {} }; } setup().next();` Runtime exports load()->42, currentfactfalse/uncertainfalse, named.load() graphcalls[]. Ordinary computedmethodkey inside outergenerator suppressesgenuineeval.
+2. `exports.known=function known(){}; function yield(value){return function ignore(code){return 'x';}} const obj={ *[yield(eval)("ignored")](){} };` Runtime keysonlyknown, currentfacttrue/uncertaintrue, named.missing() falselycallsDecoy::missing. Generator methodkeyevaluatesoutsidegeneratorbody, so yieldiswrapperhere.
+
+One rootcause/twoexecutiontraces, evidence /tmp/cg-broad-pr29-ast8-computed-scope.{cjs,log}, executed againstcurrentdist with CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2. All15frozenhashesmatch.
+
+### Stop boundary and saved state
+
+Approved redesign progressed to166focusedPASS + real-worker/store/sync/factlifecycle integration, then focusedverifyfoundthese2P2. STOP before anothercorrectioncycle per dual-reviewworkflow/userper-stepconfirmation. Don't spendfullsuiteonknowndefectivecode orpushasready. Usermustdecidenextstep; noautomaticnewreview/fix/merge/deploy. Overallcount8, noreset. Nextremediationifapproved: computedmethodscope must excludecomputedkeys fromnewmethodscope; parseerrorunknown mustnotenableinventedfallbackcalls (requires explicitresolutionpolicy, not anotherkeyword/punctuationguess). Preserve all originalregressions and33ASTcontrols, truealiases/sync/scope/Pythonbehavior. No grammarfiles/schema/deps changed; source remains15dirtypaths, notcommitted. Durablebackup includes allsources/patch/logs andnewreviewevidence, verificationresult/checksums.
+
+
+## F10/F11 corrections approved and execution-verified — independent verification pending
+
+User explicitly answered yes to correcting the two eighth-review findings. Current HEAD87576a8d and15dirtysourcepaths retained; no newcommit/push/merge/deploy/grammar/schema/dependencychanges.
+
+Fail-beforetests:2ASTcomputed-key cases,3graphfindingcases,positivealiascontrol andunknownparse syncstep. Actual2files6FAIL90PASS beforefix, /tmp/codegraph-cjs-ast-f10-f11-before.log EXIT1. Positive explicitcallablealias underunknownparsealreadyPASS beforefix, mustkeep.
+
+F11fix: method_definition suppliesfunctionscope onlywhen calllieswithin ASTbodyorparametersregions. Computednames/decorators useenclosingscope; no newkeyword/punctuation guesses. Bothcomputedkey directionsfixed. F10fix: tokenizer resultrecords evalUnknown separatelyfromuncertain/namespace. Moduleinfo propagatesunknownflag, includingexistingforwarderspread. Themethod-nameguessgate stopsunprovenmatchesforunknown-evalexportswithoutclaimingnamespace/memberabsence; explicitwrittenmemberaliasesremainallowed, andearlierprovenreceiver/typepathsremainunchanged. UnknownASTfactstillnull, no falseparse-success/intrinsicproof. Existingmembertokenizer andfacts/hash/storelifecycleremainunchanged.
+
+Expanded8files172PASS1SKIP EXIT0, /tmp/codegraph-cjs-ast-f10-f11-after.log, CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2. Coversallprevious166checks plusnewcomputed-keyAST/graphcases,optionalcontextualwrapper,realexplicitcallablealiasunderunknownparse,andfreshindex-v-syncincludingknownactualeval->unknownwrapper->actualeval transitions. One skip is nativekerneltransport; nativebinarynotstaged,no nativeexecutionclaim. A matchercommentclarifyingunproven-callpolicyupdatedaftertest; no behaviorchangedafterthispassingrun. gitdiff--checkPASS. No explicitnormalbuild/fullsuite oncurrentcorrection; old10666fullPASSbelongs875only.
+
+Currentcorrectionvsround8snapshot changes5files: ASThelper,exportreader,matcher,ASTtest,graphintegrationtest. Durablebackup originalQA .review/commonjs-fix-2026-11-08/ast-f10-f11-corrected-2026-11-09/ includesall15sourcefiles,currentSHA256,cumulativepatchrelative875,small5filedeltafromround8,fail-before/passafterlogs,verificationmetadata. F10/F11 statusCORRECTED+focusedPASS, NOTindependentlycleared. Overallreviewcount8unchanged,noround9agentslaunched. Userper-stepconfirmationrequiresdecisionbeforefreshfocusedverify; don'tspendnewfull/reviewcycleunasked. No sourcecommit/pushyet; PR28/29remainDRAFT/unmerged. Ifuserapprovesnextreview: exactGitdiff875..workingtree +round8delta/sameledger, freshread-onlynativebroad/adversarial, boundedprobesonly,norepeatfull/build. Respectactualgate/noreset. Runfinalnormalbuild/fullonceonlyafterreviewstable. PreserveT0stopped/uncommitted; liveem40unchanged; noofficialupstreamwrite.
+
+
+## Ninth native focused verification explicitly authorized and running
+
+User answered yes to next focused dualreview. Fresh READONLY review_broad_pr29_f10_f11_9 and review_adversarial_pr29_f10_f11_9 launched together with exact87576a8d..workingtree15path target, thisledger andsmall5filedelta fromround8. Source matches172focusedPASS snapshot except documentedcommentonlychange, hashmatchesdurablecorrectedbackup. BothreviewclaimsremainPENDING; do notclaimclearance. No sourcechanges/build/fullsuite orpublishingauthorized bythisreviewonlyturn. Source staysfrozen; no gate resets/controlchanges. Parentwillgatherbothactualreports,mergefindings/saveandstop.
+
+
+## Ninth native focused verification completed — F10/F11 cleared, F12 remains
+
+User explicitly authorized thisverificationround. Both fresh read-only lanes review_broad_pr29_f10_f11_9 and review_adversarial_pr29_f10_f11_9 COMPLETED normally on same87576a8d..workingtree15path target and sameledger. Source hashes stillmatch approvedcorrectedsnapshot; no sourceedits/rebuild/fullsuite/controlchanges/networkwritesbyreviewers. No sourcecommit/push/merge/deploy. BothpublishedPRsremaindraftunchanged.
+
+F10/F11 originals independently CLEARED by BOTH: optionalcontextualwrapper nofalsecall; computedkeygenuineevalinsideoutergenerator keepsStore::load; generatormethodkeynongeneratorwrapper nofalsecall. Broad11runtime-backedprobesPASS includingclass/nestedcomputedkeys,generator/nongeneratorbodies,explicitcallablealiasunderunknownfactandgenuineevalcontrols. Evidence /tmp/cg-broad-pr29-ast9-verify.{cjs,log}. Adversarial also confirmsnestednongenerator/gettercomputedkeycontrols. ThesecontrolsdoNOTclearrootwhole-valueexportsbelow.
+
+### F12 — P2 — Unknown eval facts suppress genuine root exports (adversarial)
+
+Exact reviewer location src/resolution/name-matcher.ts:25403. Valid m.js:
+
+```js
+class Store { load() { return 42; } }
+module.exports = { load: Store.prototype.load };
+function yield(v) { return function ignored() {}; }
+yield?.(eval)("ignored");
+```
+
+Caller const named=require('./m'); function run(){named.load();}. Runtime named.load() returns42; currentindexcalls:[]. Readerrecordsnomembersfortherootobjectassignment; newevalUnknowngatedropsthegenuinecallablealias. module.exports=new Store() reproduces too. RemovingONLYnewevalUnknownconditioninmemoryrestoresm.js:Store::loadforbothidenticalinputs. Directexports.load=Store.prototype.loadcontrolstillpasses. ThisisNEWregressionintroducedbyF10correction. Evidence /tmp/cg-a9-root-export-regression.cjs, /tmp/cg-a9-root-export-current.log, /tmp/cg-a9-root-export-oldgate.log. Broadclearedlimitedcontrolsbutdidnotprobeequivalentrootexports; no contradictoryexecutionresult.
+
+STOP/reportmergedfindingonly; useryesauthorizedfocuseddualverify, notanotherunaskedcorrectioncycle. OriginalF10/F11closedatthissnapshot; F12OPEN. No finalreviewclearanceorreadyformergeclaim. No explicitnormalbuild/fullsuiteoncurrentdirtyASTcorrection;172focusedPASS1SKIPremainsactualbutmissesF12. Old10666fullPASSbelongs875only. No test/build/reviewerprocessesrunning. Needuserdecisionbeforefix; preserveactualmodule-valueexportswhileblockingunprovedunknown-evalguesses, notanotherpunctuation/keywordheuristic. Overallcount9honest,noreset/gatebypass. Durableevidence/ledger/resultsavedunderoriginalQA .review/commonjs-fix-2026-11-08/pr29-review9-2026-11-09/; current15sourcefilespatchesremainin adjacentast-f10-f11-correctedbackup. T0/liveem40unchanged, noofficialupstreamwrite.
+
+
+## F12 correction approved and focused verification complete — 2026-11-09
+
+User explicitly approved the focused F12 correction after reading the session-end handoff. Existing checkout/HEAD 87576a8d and all 15 dirty source paths preserved; only two source files and their two tests changed from review 9. No commits, pushes, new review, merge, deploy, grammar/schema/dependency or extraction/storage changes.
+
+Added both runtime-backed F12 regressions FIRST: root object callable alias and new Store() under optional yield wrapper return 42 at runtime but graph calls are empty. Actual 2 FAIL / 61 SKIP, /tmp/codegraph-pr29-f12-red.log, exit 1. Expanded pre-fix reader/graph contract: 33 FAIL / 136 PASS, /tmp/codegraph-pr29-f12-matrix-red.log, exit 1.
+
+Reader now records exportForm (namespace/value/opaque) independently from evalState (present/absent/unknown); replaces the prior evalUnknown flag. Explicit members remain property writes, never a whole-value inventory. Any syntactically stated whole module.exports assignment retains existing value resolution; escapes/mixed writes do not erase that evidence or claim a final member inventory. Namespace absence still requires !uncertain. Inconclusive eval only gates unproven method guesses when no stated whole value is present; explicit property aliases and confirmed eval behavior stay intact. Forwarders propagate the summary through existing spread, and existing typeFrom dependencies remain intact.
+
+Tests cover namespace/direct alias/root object/instance x eval absent/present/unknown, direct and forwarded imports; runtime values and typeFrom metadata asserted. Added fresh-v-sync transitions across both axes, bracket/mixed assignments, opaque reader controls; all prior F10/F11 tests retained unchanged.
+
+Actual verification:
+- First two-file green: 169 PASS, /tmp/codegraph-pr29-f12-matrix-green.log, exit 0. Test setup successfully ran tsc + copied assets for current source.
+- Expanded ten-file run after final four bracket/mixed graph tests: 235 PASS / 1 SKIP / 6 FAIL, /tmp/codegraph-pr29-f12-focused.log, exit 1. All six failures were lazy-engine child stdout empty. Independent minimal spawnSync probe reproduced EPERM for piped Node child output even when the child simply prints 42; file output works. No source/test workaround added.
+- Approved sandbox escalation reran ONLY lazy-engine.test.ts outside sandbox: 6 PASS, /tmp/codegraph-pr29-f12-lazy-unsandboxed.log, exit 0.
+- Combined distinct final checks: 241 PASS / 1 SKIP over 10 files. Skip is native-kernel parity (binary not staged); no native execution claim. git diff --check PASS. No final normal npm run build/fullsuite on dirty AST revision; these remain deferred until stable independent review per user handoff. No tests/build/reviewer processes running.
+
+F12 status: CORRECTED + focused verified, NOT independently cleared. Overall review count remains 9; no gate resets or new agents. STOP and ask before fresh focused dual review, as requested. Proposed two-commit structure stays pending; nothing staged/committed/published. PR28/29 draft state not changed. T0/live/deploy/control files untouched.
+
+Durable backup: original QA .review/commonjs-fix-2026-11-08/pr29-f12-2026-11-09/ contains before/after copies of all 15 dirty source files, hashes, cumulative-from-875.patch, f12-correction.patch, actual red/green/failure/rerun logs and verification.json. Plan: /home/ericm/.codex/plans/plan-codegraph-pr29-f12-2026-11-09.md. Next factual checkpoint: /home/ericm/.codex/plans/handoff-codegraph-pr29-f12-focused-2026-11-09.md.
+
+
+## Tenth native focused verification explicitly authorized and running
+
+User answered yes to next focused dual review. Fresh read-only review_broad_pr29_f12_10 and review_adversarial_pr29_f12_10 launched on exact 87576a8d..workingtree target, same ledger and saved four-file F12 delta. All 15 source hashes match focused-tested F12 checkpoint. Both results PENDING. No source changes, rebuild, full suite or publication in this review-only phase. Completed review count remains 9 until results arrive; no resets or gate bypass. Parent will merge actual reports, save checkpoint and stop.
+
+
+## Tenth native focused verification completed — original F12 clears; F12 variants and new F13 remain
+
+User explicitly authorized this focused review. Both fresh read-only lanes review_broad_pr29_f12_10 and review_adversarial_pr29_f12_10 completed normally against exact git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 87576a8d9ff0d8aba235db5535f5f4429f14b037 -- . and the same ledger / saved F12 delta. All 15 source hashes match the focused-tested F12 snapshot. No source edits, rebuild, fullsuite, commits, pushes, merge, deploy or gate reset. Parent merged actual reports without duplicate probes/source re-audit.
+
+Both independently CLEARED original F12 unparenthesized root object/instance, original F10 optional wrapper, and both F11 computed-key directions. Original passing examples do not clear adjacent syntax/scope findings.
+
+### F13 — P2 — Shadowed module writes disable the unknown-eval guard (adversarial)
+
+Exact location src/resolution/commonjs-export-members.ts:75, gate name-matcher.ts:25403. Concrete input:
+
+```js
+exports.known = function known() {};
+function pretend(module) { module.exports = {}; }
+pretend({});
+function yield(v) { return function ignored() {}; }
+yield?.(eval)("ignored");
+```
+
+Caller const named=require('./m'); function run(){named.missing();}, unrelated export class Decoy { missing() {} }. Actual CommonJS exports only known; missing undefined. Current graph incorrectly calls decoy.js:Decoy::missing. Reader records exportForm:value/evalState:unknown from local parameter's module.exports assignment, bypassing unknown-eval guard. Block-local and arrow parameter variants reproduce. Loading both saved pre-F12 source files in memory yields calls[] on identical inputs, proving NEW regression in latest correction. Evidence /tmp/cg-a10-boundary.{cjs,log}, /tmp/cg-a10-before-loader.cjs, /tmp/cg-a10-boundary-before-source.log, /tmp/cg-a10-shadow-runtime.log.
+
+### F12 — P2 — F12 remains for equivalent whole-value assignment syntax (broad)
+
+Exact location src/resolution/commonjs-export-members.ts:75, gate name-matcher.ts:25403. class Store { load() { return 42; } }; (module.exports) = new Store(); function yield(v){return function ignored(){}} yield?.(eval)("ignored"); with named.load() returns42 at runtime but graph calls[]. Reader expects = immediately after module.exports, records opaque and suppresses call. Parenthesized root object and module.exports &&= new Store() reproduce. Removing only optional wrapper restores Store::load. Direct/forwarded imports both fail; fresh/sync agree, removing wrapper during sync restores edge and typeFrom. This is incompletely corrected F12, not a demonstrated NEW regression in latest correction. Broad evidence /tmp/cg-broad-pr29-f12-10.{cjs,log} (28 runtime/graph probes), /tmp/cg-broad-pr29-f12-10-sync.{cjs,log} (12 asserted sync/fresh comparisons).
+
+STOP/report both P2 findings. No fix or new review authorized by this yes-to-review turn. Review count10 completed honestly, no resets. Prior 241 focused PASS /1native SKIP remains actual but misses these cases. No final normal build/fullsuite on dirty AST revision; no native-kernel execution claim. PR28/29 stay draft/unpublished current correction; T0/live/control/deploy files untouched. Sources remain 15 dirty paths on HEAD87576a8d. Preserve checkout and all work.
+
+Durable review evidence: original QA .review/commonjs-fix-2026-11-08/pr29-review10-2026-11-09/ includes broad/adversarial reports, merged-review.md, completed review-status.json, source hashes, scripts/logs, and ledger. F12 before/after source backups/cumulative+delta patches remain adjacent pr29-f12-2026-11-09/. New handoff /home/ericm/.codex/plans/handoff-codegraph-pr29-review10-two-findings-2026-11-09.md.
+
+
+## Shared production export evidence integrated — focused verification complete
+
+User said "ok run it" after clarification that integration remained unfinished. Authorized production implementation in preserved checkout; no new review or publication in this turn. New binding-aware source record is now used by import resolution and the name-matching guard. F12 equivalent assignments and F13 export/caller shadowing corrected + focused tested, NOT independently cleared. Overall review count remains10.
+
+Implementation: src/resolution/commonjs-export-evidence.ts uses established TypeScript checker.resolveName binding identities and type/member declaration selectors. It handles structural parenthesized/bracket/logical assignments, direct callable aliases, exported class/object/instance members, relative forwarding, and direct literal eval analyzed in its lexical context by a synthetic arrow body. This records static potential relationships without generator execution; genuine F11 generator eval passes beside unrelated methods. Local module/exports/eval bindings and caller parameters/classes are distinguished. Unknown behavior supplies no target. Selector ranges map only to indexed declarations, no global name guess.
+
+The source-hash/versioned record is computed lazily during resolution, memoized by context/file/source, and cleared with resolver caches. No new metadata writer/schema/grammar. Import resolver's CommonJS default regex is replaced by record consumption. All CJS positive member targets resolve through the record before fallback; a CJS binding cannot authorize a global method-name guess. Early import edges preserve typeFrom source/forwarder dependencies. Existing AST eval fact pipeline and tokenizer unit helper were preserved; tokenizer is no longer the production fallback authority. Extraction's existing export-name helper remains node naming, not authorization of these call targets.
+
+TypeScript5.9.3 is promoted from development to runtime dependency (^5.9.3); package lock refreshed offline, npm ls --omit=dev confirms presence. Compiler is required only when analyzing source, not by loading the helper/library/read CLI. Final7lazy tests outside sandbox PASS (same known Node child-pipe EPERM reason as earlier runs).
+
+Actual verification history:14newgraph regressions FAIL before;14PASS after first integration. Expanded10files initially236PASS30FAIL1SKIP from missing dependency metadata (stale sync), object-method node-kind mapping and parenthesized eval arguments; corrected to266PASS1SKIP. Neighbors initially356PASS2FAIL (caller parameter/class shadowing); added compiler-bound call-site receiver facts. Final combined19files624PASS1SKIP, /tmp/codegraph-pr29-evidence-integrated-focused.log. Final7lazyPASS, /tmp/codegraph-pr29-evidence-lazy-final.log. Distinct final631PASS1SKIP over20files. Test setup ran tsc/assets, viewer build/check succeeded earlier. git diff --check PASS. No standalone final npm run build/fullsuite on this revision; deferred to stable review per existing boundary. Native parity skipped because binary absent, no native execution claim.
+
+Small production-collector measurement: module load8.23ms with compilerLoadedBeforeAnalysis:false; cold first analysis277.01ms, heap delta17.70MiB;25warm samples median1.65ms (147byte value fixture),2.37ms (152byte generator eval). These are toy collector measurements, not actual large-project indexing, query latency, cache or worker benchmarks.
+
+CurrentHEAD87576a8d, branchfix/commonjs-eval-callee-context.22dirtypaths total, new3files intent-to-add for review only; no sourcecommit/push/merge/deploy. Integration phase changed9paths: shared source module, import resolver, name matcher, two new test files, default-binding graph tests, lazy test, package.json/lock.13of15prior dirty source paths remain byte-identical; two intentionally extended. All22final hashes saved/verified. T0/live/deploy/control files untouched.
+
+Durable backup: originalQA .review/commonjs-fix-2026-11-08/pr29-export-evidence-integration-2026-11-09/ contains baseline before/, milestone1/2 source snapshots/hashes, final-source/ all22files, source-sha256.json, cumulative-from-875.patch, integration-from-round10.patch, actual red/green/failure/lazy logs, production measurement script/output, results.json/progress.json. STOP and ask before fresh focused dual review; do not auto-review/fix/publish. Final normal build/fullsuite once after stable clearance. Latest handoff /home/ericm/.codex/plans/handoff-codegraph-pr29-export-evidence-integrated-2026-11-09.md.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-export-evidence-integration-2026-11-09/handoff-codegraph-pr29-export-evidence-integrated-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/history/pr29-export-evidence-integration-2026-11-09/handoff-codegraph-pr29-export-evidence-integrated-2026-11-09.md
new file mode 100644
index 0000000000..6cf305dee9
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-export-evidence-integration-2026-11-09/handoff-codegraph-pr29-export-evidence-integrated-2026-11-09.md
@@ -0,0 +1,22 @@
+# PR29 production export-evidence integration tested; independent review pending
+
+
+## Shared production export evidence integrated — focused verification complete
+
+User said "ok run it" after clarification that integration remained unfinished. Authorized production implementation in preserved checkout; no new review or publication in this turn. New binding-aware source record is now used by import resolution and the name-matching guard. F12 equivalent assignments and F13 export/caller shadowing corrected + focused tested, NOT independently cleared. Overall review count remains10.
+
+Implementation: src/resolution/commonjs-export-evidence.ts uses established TypeScript checker.resolveName binding identities and type/member declaration selectors. It handles structural parenthesized/bracket/logical assignments, direct callable aliases, exported class/object/instance members, relative forwarding, and direct literal eval analyzed in its lexical context by a synthetic arrow body. This records static potential relationships without generator execution; genuine F11 generator eval passes beside unrelated methods. Local module/exports/eval bindings and caller parameters/classes are distinguished. Unknown behavior supplies no target. Selector ranges map only to indexed declarations, no global name guess.
+
+The source-hash/versioned record is computed lazily during resolution, memoized by context/file/source, and cleared with resolver caches. No new metadata writer/schema/grammar. Import resolver's CommonJS default regex is replaced by record consumption. All CJS positive member targets resolve through the record before fallback; a CJS binding cannot authorize a global method-name guess. Early import edges preserve typeFrom source/forwarder dependencies. Existing AST eval fact pipeline and tokenizer unit helper were preserved; tokenizer is no longer the production fallback authority. Extraction's existing export-name helper remains node naming, not authorization of these call targets.
+
+TypeScript5.9.3 is promoted from development to runtime dependency (^5.9.3); package lock refreshed offline, npm ls --omit=dev confirms presence. Compiler is required only when analyzing source, not by loading the helper/library/read CLI. Final7lazy tests outside sandbox PASS (same known Node child-pipe EPERM reason as earlier runs).
+
+Actual verification history:14newgraph regressions FAIL before;14PASS after first integration. Expanded10files initially236PASS30FAIL1SKIP from missing dependency metadata (stale sync), object-method node-kind mapping and parenthesized eval arguments; corrected to266PASS1SKIP. Neighbors initially356PASS2FAIL (caller parameter/class shadowing); added compiler-bound call-site receiver facts. Final combined19files624PASS1SKIP, /tmp/codegraph-pr29-evidence-integrated-focused.log. Final7lazyPASS, /tmp/codegraph-pr29-evidence-lazy-final.log. Distinct final631PASS1SKIP over20files. Test setup ran tsc/assets, viewer build/check succeeded earlier. git diff --check PASS. No standalone final npm run build/fullsuite on this revision; deferred to stable review per existing boundary. Native parity skipped because binary absent, no native execution claim.
+
+Small production-collector measurement: module load8.23ms with compilerLoadedBeforeAnalysis:false; cold first analysis277.01ms, heap delta17.70MiB;25warm samples median1.65ms (147byte value fixture),2.37ms (152byte generator eval). These are toy collector measurements, not actual large-project indexing, query latency, cache or worker benchmarks.
+
+CurrentHEAD87576a8d, branchfix/commonjs-eval-callee-context.22dirtypaths total, new3files intent-to-add for review only; no sourcecommit/push/merge/deploy. Integration phase changed9paths: shared source module, import resolver, name matcher, two new test files, default-binding graph tests, lazy test, package.json/lock.13of15prior dirty source paths remain byte-identical; two intentionally extended. All22final hashes saved/verified. T0/live/deploy/control files untouched.
+
+Durable backup: originalQA .review/commonjs-fix-2026-11-08/pr29-export-evidence-integration-2026-11-09/ contains baseline before/, milestone1/2 source snapshots/hashes, final-source/ all22files, source-sha256.json, cumulative-from-875.patch, integration-from-round10.patch, actual red/green/failure/lazy logs, production measurement script/output, results.json/progress.json. STOP and ask before fresh focused dual review; do not auto-review/fix/publish. Final normal build/fullsuite once after stable clearance. Latest handoff /home/ericm/.codex/plans/handoff-codegraph-pr29-export-evidence-integrated-2026-11-09.md.
+
+This supersedes prototype-only state. Read session-end handoff for identity/publication/recovery boundaries; preserve all22dirtypaths. Both next reviewers should receive exact git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 87576a8d9ff0d8aba235db5535f5f4429f14b037 -- . plus integration-from-round10.patch and same ledger. Focus F12/F13 closure and invariants, no repeated whole-parent audit/fullsuite/build. Review only with user approval/actual gate; no resets. Runtime dependency/lazy loading, compiler scoping, member selector ownership, eval lexical context, forwarding/typeFrom and fresh/sync are key review surfaces. The final normal build/fullsuite remain pending; tsc passed in current test setup.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-export-evidence-integration-2026-11-09/plan-codegraph-pr29-export-evidence-integration-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/history/pr29-export-evidence-integration-2026-11-09/plan-codegraph-pr29-export-evidence-integration-2026-11-09.md
new file mode 100644
index 0000000000..e796ef3492
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-export-evidence-integration-2026-11-09/plan-codegraph-pr29-export-evidence-integration-2026-11-09.md
@@ -0,0 +1,23 @@
+# PR29 production export-evidence integration — approved
+
+User said "ok run it" after clarification that production integration is unfinished. This authorizes implementing the shared export evidence path in the preserved checkout. Continue save-as-you-go. No review/commit/publication/merge/deploy authorized. Prior15dirtyfiles and all private/control files preserved; baseline saved in original QA private.review/pr29-export-evidence-integration-2026-11-09.
+
+Contract: one lazily computed source-hash/versioned export record per resolution context/file, consumed by both import resolution and fallback guard. Established TypeScript lexical binding/type APIs, no custom scope engine or prototype evaluator. Existing compiler promoted from dev to runtime dependency; import only on relevant CommonJS analysis to protect lightweight read paths. Measure cost with focused tests.
+
+Record: explicit export members/default targets and forwarding sources, declaration source selectors, completeness/unknown reasons, source hash and analyzer version. Static potential relationships, not exact runtime initialization. Literal direct eval payload assignments analyzed in their lexical context, including generator bodies/computed keys; unknown eval supplies no candidate identity. Shadowed wrapper bindings never authorize CJS records. Parenthesized/bracket/logical targets normalized structurally.
+
+1. Add actual F12-variant/F13 and owned-target regressions first, run red.
+2. Implement shared record producer + declaration-to-index-node matching; integrate default/member import resolution and conservative guard; replace CommonJS regex default reader. Preserve explicit aliases, instances, forwarded dependencies, real eval, F10/F11, local shadow/typed paths.
+3. Run focused graph/AST/cache/lazy/storage/worker-related suites. Typecheck/build through normal test setup; final full build/fullsuite deferred until stable review per prior user boundary. No native claim without binary.
+4. Save source/patches/hash/log checkpoints each milestone, report actual checks and remaining limitations. Ask before fresh focused review.
+
+No exact-runtime JavaScript interpreter, grammar or schema changes. The first record is resolution-local and hash-validated rather than a second persisted writer. Extraction's existing export-name helper remains node naming, not export authorization. Existing user AST/eval transport work preserved; no removal without demonstrated replacement clearance.
+
+## Milestone1 saved
+New14graphcases fail before and pass after shared record integration. Genuine generator eval beside decoy methods passes; F12 variants/F13 direct+forwarded pass. Existing full preservation set not run yet. Source/log snapshot in private.review/pr29-export-evidence-integration-2026-11-09/milestone1-source. Compiler promoted to runtime; offline lock refresh passed. Three initial TypeScript API type errors corrected using public APIs; test setup built engine/viewer. No fullsuite/review/publication.
+
+## Milestone2 saved
+Focused10files266PASS1nativeSKIP after missing import typeFrom metadata, indexed object-method mapping and parenthesized eval argument corrections. Existing F10/F11 and new F12/F13 pass, fresh-v-sync preserved. Source/hash/log snapshot milestone2-source/. New lazy compiler-load test prepared; next neighboring import/default-export coverage. No new review/fullsuite/publication.
+
+## Implementation complete, focused verified
+631distinct finalPASS1nativeSKIP across20files, current source frozen22paths. Review pending; no new review/fullsuite/publication. Latest checkpoint: /home/ericm/.codex/plans/handoff-codegraph-pr29-export-evidence-integrated-2026-11-09.md
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-f12-2026-11-09/commonjs-eval-callee-context.md b/docs/handoffs/pr29-2026-11-10/history/pr29-f12-2026-11-09/commonjs-eval-callee-context.md
new file mode 100644
index 0000000000..30c7e69a2b
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-f12-2026-11-09/commonjs-eval-callee-context.md
@@ -0,0 +1,166 @@
+# Separate F8 follow-up (review round count remains six)
+
+User explicitly authorized committing/pushing current work to a PR and separating remaining correction. Current snapshot committed5d384989957c91b482068b306535437915a0595b, pushed fix/commonjs-missing-member, DRAFT https://github.com/inth3shadows/codegraph/pull/28 against main. KnownF8 documented, not ready to merge alone. No deploy/merge/upstream report.
+
+New branch fix/commonjs-eval-callee-context based on5d384989. Exact prospective Git target: git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5d384989957c91b482068b306535437915a0595b -- src/resolution/commonjs-export-members.ts __tests__/commonjs-export-members.test.ts __tests__/js-default-binding-members.test.ts
+
+F8 reviewer finding and prior invariants remain in .review/commonjs-missing-member.md; do not reset shared gate/round count. Two sixth reviewers completed; broad demonstrated F8 despite adversarial clearing intended F7 cases. This follow-up has NOT had independent dual review yet.
+
+Correction: distinguish grouping around bare eval from another function's argument list using token before parentheses. Wrapper identifier/call/member/optional-call/tag/control-condition prefixes must not mark exports uncertain. Grouped direct eval, literal/template arguments and expression prefixes such as return must keep prior behavior. Change limited to9helper lines plus independent unit and real-index graph regressions; no matcher/sync/scope changes.
+
+Before fix8FAIL92PASS; tag-result additional case1FAIL49PASS. Final focused2files101PASS, /tmp/codegraph-cjs-eval-followup-focused.log. Build/full pending. Hashes /tmp/codegraph-cjs-followup-frozen.json. Logs /tmp/codegraph-cjs-eval-followup-{before,tag-before,focused,build}.log. Need staged exact3-file diff, personal repo/identity and actual build result before commit/push. Full normal suite required before readiness claim. Keep follow-up draft and explicitly state review pending. No additional reviewer agents launched in this follow-up; user plans to point agents at PRs.
+
+Keep both PRs draft. Follow-up base should be fix/commonjs-missing-member, producing only the small correction diff. Review/merge follow-up into parent branch before considering parent PR for main; no merge authorized by current request. Preserve original T0 pilot and all deploy/control worktrees.
+
+Published DRAFT https://github.com/inth3shadows/codegraph/pull/29, commit87576a8d9ff0d8aba235db5535f5f4429f14b037, base fix/commonjs-missing-member/PR28 at5d384989. Explicit buildPASS; normal full suite RUNNING session62594, /tmp/codegraph-cjs-eval-followup-full.log. Both pushed/draft, neither merged/deployed; follow-up independent review stillpending. Original T0 untouched.
+
+
+FINAL execution verification2026-11-09: normal full suite session62594 EXIT0,873filesPASS19SKIP,10666testsPASS2expectedFAIL448SKIP0unexpectedFAIL,800.20sec. /tmp/codegraph-cjs-eval-followup-full.log. 101focusedPASS and explicit buildPASS on same87576a8dsource. Final3changed-file SHA256 checks PASS, trackedtreeclean; actual remoteheads rechecked5d384989(PR28) and87576a8d(PR29). PR29 body updated with exact final validation. Both PRs still DRAFT/unmerged; no deployment/upstream write. FOLLOW-UP INDEPENDENT REVIEW STILL PENDING: do not conflate fullsuite with review clearance. No further tests/build/review processes running. Saved final checkpoint and full log under original QA two-draft-prs backup.
+
+
+## Seventh native review explicitly requested — PR29 — 2026-11-09
+
+User invoked /dual review29. Exact GitHub base5d384989957c91b482068b306535437915a0595b and head87576a8d9ff0d8aba235db5535f5f4429f14b037 verified. Fresh read-only native lanes review_broad_pr29_round7 and review_adversarial_pr29_round7 launched together with same exact Git target and this ledger. Both focus full3-file29-line correction, F8 closure and nearby invariants; bounded execution probes only, no repeat full/build or source edits. Parent does not reread reviewed diff or duplicate reviewer probes. No review results yet; no independent clearance claim. Do not reset round count/gate, change source, push, merge or deploy in this review-only turn. Stop and report merged findings when both complete.
+
+
+## Seventh native dual review result — PR29 — 2026-11-09
+
+Both fresh read-only lanes completed normally: review_broad_pr29_round7 and review_adversarial_pr29_round7. Exact target remains5d384989957c91b482068b306535437915a0595b..87576a8d9ff0d8aba235db5535f5f4429f14b037. Source hashes verified unchanged, trackedtreeclean except private untracked.review. No source edits/build/fullsuite reruns/commits/pushes/GitHubcomments/merge/deploy. Both PRs remain draft. Current review DOES NOT CLEAR PR29 despite prior101focusedPASS/full10666PASS/buildPASS. Parent merges findings from actual final reports without re-verifying/re-reading diff.
+
+### F9 — P2 — Preserve grouped direct eval in control-statement bodies (BOTH)
+
+Broad location src/resolution/commonjs-export-members.ts:31: rejects any preceding ), including a completed if or for condition. Exact input `class Store { load() { return 42; } }
+if (true) (eval)('exports.load = Store.prototype.load;');`. Runtime exports load() returning42, but current discovery uncertain:false and indexing named.load() produces no call. Removing only new prefix guard in memory restores uncertain:true and m.js:Store::load. Nested grouped eval in unbraced single-iteration for body reproduces too. Broad evidence /tmp/cg-broad-pr29-control-context.{cjs,log}; exact command `node --experimental-wasm-exnref --experimental-wasm-stack-switching /tmp/cg-broad-pr29-control-context.cjs`.
+
+Adversarial independently confirms same location/trace; grouped-template if-body and for-body also reproduce. Evidence /tmp/codegraph-cjs-adversarial7-conditional-eval.{cjs,log}. De-duplicated as one P2 F9. This is a NEW regression introduced in PR29, not a pre-existing parent limitation.
+
+### F8 — P2 — PARTIALLY CORRECTED, remains for contextual-keyword wrapper names (adversarial)
+
+Exact reviewer location src/resolution/commonjs-export-members.ts:29 (whitelist:7). Valid CommonJS `function await(value){return function ignore(code){};} await(eval)("ignored");` passes eval without invoking it, but whitelist exemption produces uncertain:true and falsely resolves named.missing() to decoy.js:Decoy::missing. With exports.known=function known(){}, runtime exports only known; pre-F7 behavior restored in memory produces no call. yield reproduces too. Evidence /tmp/codegraph-cjs-adversarial7-contextual-wrapper.{cjs,log}. This is a RESIDUAL F8 variant, not a new unrelated parent re-audit. Do not label all F8 closed.
+
+### Confirmed preservation / rulings
+
+Both independently clear original F8 forms wrap(eval)("ignored") and wrap((eval))(("ignored")): runtime onlyknown, reader uncertain:false, no decoy call. Broad /tmp/cg-broad-pr29-f8-closure.{cjs,log}. Adversarial13runtime-backed graph controls pass (original2forms +11nearby controls), /tmp/codegraph-cjs-adversarial7-controls.log. True standalone grouped/template eval, return expressions, inert data/method declarations, call/member/optional/tag/condition-prefix negatives retain tested behavior. These controls do not answer F9 control-body context or F8 await/yield wrappers.
+
+### Next boundary
+
+Review-only user request is complete. STOP: no fixes, additional review loop, external review comment, markready, merge or deploy without user instruction. The per-step confirmation request remains in force. This is round7 overall; no gate/state reset. Repeated grouping-prefix patches now demonstrate syntax-context ambiguity: if user asks for remediation, choose an evidence-based smaller boundary/design instead of another unbounded keyword/punctuation whitelist. Preserve both concrete repros and all prior controls. Do not repeat fullsuite/build on unchanged source. Actual durable result/evidence/checksums saved in original QA .review/commonjs-fix-2026-11-08/pr29-review-round7-2026-11-09/.
+
+
+## AST redesign approved and started — 2026-11-09
+
+User explicitly approved AST redesign in PR29, said near usage max and asked for a resumable start, then said proceed. This revokes prior review-only stop for in-scope remediation; do not ask same approval on resume. Preserve per-step/user and actual gate boundaries for later merges/deployments. No grammar/runtime/dependency/database-schema changes, commits or pushes in this partial phase; PRs remain draft at prior heads.
+
+Newgraph regressions FIRST:3control-body direct-eval variants(if string/template, for nestedgroups) +await/yield CommonJS wrappers,5FAIL51SKIP on current87576a8d. /tmp/codegraph-cjs-ast-red.log, EXIT1. This intentionally RED gate remains unchanged because integration pending.
+
+New isolated src/extraction/commonjs-eval.ts reads existing SyntaxNode tree and checks actual call.function after unwrapping parenthesized_expression. Returns true for syntacticdirectevalcall(anyargument), false for provenabsence, null for parseerrors with no foundcall. New __tests__/commonjs-eval.test.ts loads existingJS/TS/TSXgrammars:33PASS, /tmp/codegraph-cjs-ast-helper.log EXIT0. Controls cover reports, grouped/interpolated eval, return, generatorfunctions/methods, nestednongenerator scope, eval inside yieldwrapper argument, inert data/methods/membercalls, JSX and malformedsource. Helper not wired to classifier/extraction yet. Existing lexical reader/EXPRESSION_PREFIX_WORDS unchanged for now. Do not claim F8/F9 closed, new full/buildpass or finalreview.
+
+IMPORTANT new evidence: existingJSgrammar correctly models control-body eval and awaitwrapper but parses legal CommonJS yield(eval)(code) as yield_expression whose operand is a call on(eval), no parseerrors. ASTscope must distinguish nongeneratorwrapper from generator yield. Helper handles direct yieldoperand only via nearestfunction/generator/methodscope; nested true eval in yield(eval(code)) remains detected. Shapeprobe /tmp/codegraph-cjs-ast-shape-probe.{cjs,log}. Extractionreferenceprobe /tmp/codegraph-cjs-eval-reference-probe.{cjs,log} shows currentextractor emits callref eval for genuinecall AND synthetic yieldwrappercase. Consequently raw existing unresolved eval refs alone are insufficient. User was explicitly told this grammar limitation, not falsely assured all cases are parser-perfect. No grammarfiles changed.
+
+Next integrate factualcallresult through existingextraction to resolver. Node has NO metadata field (onlyedges do); do not invent Node.metadata, abuse signature/selfedges/candidates, or introduce schema migration casually. ExtractionResult can carry optionalfact through workerclone; need native/deferred bypass parity. Main bulk parse pools only load grammars in workers; resolver cannot assume synchronous getParser is ready in main. Suggested project_metadata perfile/sourcehash transport or another small explicit extractioncontext capability; persist/refresh under same successfulstore lifecycle, cover storeworker and sync. Decide carefully before editing infrastructure. Resume must preserve all existing tests and5newred cases; unknown/missing/error facts must not masquerade as provenabsence. Keep existing export-member tokenizer and previous sync/scope/alias fixes intact; remove prefixheuristics only onceASTfacts actuallysupplied.
+
+Saved current3sourcefiles, patchrelative87576a8d, hashes, red/green/probe logs under original QA .review/commonjs-fix-2026-11-08/ast-redesign-started-2026-11-09/. No tests/build/reviewers running at checkpoint. Newfiles intent-to-add only so diffincludes them, not readyforcommit. No fresh dualreviewagents this phase. Overall reviewcount7; do not reset gate/controlstate. Resume directly integration and targeted tests; fullsuite/build only after stablefix, fresh focuseddual review as authorized/actualgatepermits, no repetitivewholeprojectwork. OriginalT0stillstopped/uncommitted; liveem40 unchanged; no merges/deploy/upstream writes.
+
+
+## AST integration execution-tested — verify round8 pending
+
+User approved AST redesign with focused review before final fullsuite, then resumed. Current dirty correction target87576a8d..workingtree,15paths captured /tmp/codegraph-cjs-ast-frozen.json (allnewfilesintent-to-add). No sourcecommit/pushyet; publishedPR29still87576a8d. No grammar/runtime/dependency/schema changes.
+
+Implemented AST fact in ExtractionResult and ephemeralFileRecord property; WASM computes from existingtree, native/deferred routes compute with existinggrammar; kernelmaterializer preservesfact. Allstorepaths carryFileRecord fact through existingwriter, upsertFile writes project_metadata commonjs_eval:<file> containingcontentHash/value. Nosecondwriter orNode.metadata. deleteFile removesfact. Coordinatorcontext acceptsboolean onlyonexact SHA256sourcehash. Missing/malformed/stale/nullfacts returnunknown, neverabsenceproof. Tokenreader removed literalEvalCall/EXPRESSION_PREFIX_WORDS, consults lazyASTfact atmostonceonlywhenbareevaltokenpresent; unknown staysconservative. Existingmembertokenizer/sync/typeFrom/scope unchanged. CHANGELOG alreadyrequiresre-indexafterupgrading(line56), which suppliesnewfacts; no legacyfactmigrationclaimed.
+
+Original5newgraphregressionsRED5FAIL51SKIP beforeintegration. Initialintegratedrun blocked by compiler: hashContentisexportedfromextraction/index, notutils; corrected byusingexistingcreateHashcrypto inresolver (sameSHA256algorithm), no circularextractionimport. Then3files140PASS. AddedrealSQLite factlifecycle4cases(missing/malformed/null, hashstale/replace,rollbackwithfiletransaction, deletion) andfreshindex-vs-sync wrapper->if-eval->yield-wrapper->for-eval->wrapper sequence. Final8files166PASS1SKIP, /tmp/codegraph-cjs-ast-expanded.log, CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2; alsoincludesmemo/synccaches/lazy-engine. Nativebinarynotstaged(codegraph-kernel/prebuilds/linux-x64/codegraph-kernel.node absent); kerneltransporttestskipped. Do not claimnativeexecution. Enginecompiledbytestsetup,currentdistmatchesfrozen sources. No explicitfinalnormalbuild/fullsuiteorindependentreviewyet. Priorfull10666PASSbelongs87576a8donly.
+
+Next eighthfreshnativeREADONLYlanes verify this correction, sameledger andexactGitdiff87576a8d..workingtree. Boundedruntimeprobes only, no fullsuite/build orsourcechanges. CheckF8/F9closure,generator-awareyieldworkaround, actualevalvswrappercallee, sourcehashfactlifecycle/workertransport/sync, previouscontrols. Do not re-audit unrelatedparentlimitations. Stop/reportifreviewfindsissues; do notresetgate/count orclaimClaude-onlyskill.
+
+
+## Eighth native review COMPLETED — AST correction NOT CLEARED
+
+Both fresh read-only reviewers completed normally on frozen15-file87576a8d..workingtree correction. Both confirm no source edits/build/full reruns/control changes; source hashes unchanged. No final normalbuild/fullsuite run or commit/push. PublishedPR28/29 remain drafts at5d384989/87576a8d. Prior166focusedPASS1SKIP is true and covers original5reportedgraphcases, but does not clear new findings. Nativebinary absent, no nativeexecutionclaim. Parent uses actual reports, no independent duplicate repro/diffread.
+
+### F10 — P2 — Optional contextual-keyword wrappers regress (adversarial)
+
+Exact reviewer location src/extraction/commonjs-eval.ts:37. Valid CommonJS:
+
+```js
+exports.known = function known() {};
+function yield(value) {
+  return function ignore(code) {};
+}
+yield?.(eval)("ignored");
+```
+
+Runtime exports only known; eval is never invoked. Existing grammar reports parse error, helper returns null, reader marks exports uncertain, and named.missing() falsely calls unrelated decoy.js:Decoy::missing. Actual current correction calls:[decoy.js:Decoy::missing]; base87576a8dreader restored in memory calls:[], uncertain:false. Evidence /tmp/cg-a8-yield-optional.{cjs,log}, /tmp/cg-a8-yield-optional-base.{cjs,log}, /tmp/cg-a8-probe.cjs. New F8-adjacent regression introduced by AST correction. Unknown fact correctly avoids false absence proof but must not license false call targets; current fallback still does.
+
+### F11 — P2 — Computed method names use enclosing scope (broad)
+
+Exact reviewer location src/extraction/commonjs-eval.ts:51. Treats a computed method name as belonging to that method's function scope. Computed names execute in enclosing scope. Confirmed both directions:
+
+1. `class Store { load(){return 42;} } function* setup(){ const obj = { [yield (eval)('exports.load = Store.prototype.load;')]() {} }; } setup().next();` Runtime exports load()->42, currentfactfalse/uncertainfalse, named.load() graphcalls[]. Ordinary computedmethodkey inside outergenerator suppressesgenuineeval.
+2. `exports.known=function known(){}; function yield(value){return function ignore(code){return 'x';}} const obj={ *[yield(eval)("ignored")](){} };` Runtime keysonlyknown, currentfacttrue/uncertaintrue, named.missing() falselycallsDecoy::missing. Generator methodkeyevaluatesoutsidegeneratorbody, so yieldiswrapperhere.
+
+One rootcause/twoexecutiontraces, evidence /tmp/cg-broad-pr29-ast8-computed-scope.{cjs,log}, executed againstcurrentdist with CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2. All15frozenhashesmatch.
+
+### Stop boundary and saved state
+
+Approved redesign progressed to166focusedPASS + real-worker/store/sync/factlifecycle integration, then focusedverifyfoundthese2P2. STOP before anothercorrectioncycle per dual-reviewworkflow/userper-stepconfirmation. Don't spendfullsuiteonknowndefectivecode orpushasready. Usermustdecidenextstep; noautomaticnewreview/fix/merge/deploy. Overallcount8, noreset. Nextremediationifapproved: computedmethodscope must excludecomputedkeys fromnewmethodscope; parseerrorunknown mustnotenableinventedfallbackcalls (requires explicitresolutionpolicy, not anotherkeyword/punctuationguess). Preserve all originalregressions and33ASTcontrols, truealiases/sync/scope/Pythonbehavior. No grammarfiles/schema/deps changed; source remains15dirtypaths, notcommitted. Durablebackup includes allsources/patch/logs andnewreviewevidence, verificationresult/checksums.
+
+
+## F10/F11 corrections approved and execution-verified — independent verification pending
+
+User explicitly answered yes to correcting the two eighth-review findings. Current HEAD87576a8d and15dirtysourcepaths retained; no newcommit/push/merge/deploy/grammar/schema/dependencychanges.
+
+Fail-beforetests:2ASTcomputed-key cases,3graphfindingcases,positivealiascontrol andunknownparse syncstep. Actual2files6FAIL90PASS beforefix, /tmp/codegraph-cjs-ast-f10-f11-before.log EXIT1. Positive explicitcallablealias underunknownparsealreadyPASS beforefix, mustkeep.
+
+F11fix: method_definition suppliesfunctionscope onlywhen calllieswithin ASTbodyorparametersregions. Computednames/decorators useenclosingscope; no newkeyword/punctuation guesses. Bothcomputedkey directionsfixed. F10fix: tokenizer resultrecords evalUnknown separatelyfromuncertain/namespace. Moduleinfo propagatesunknownflag, includingexistingforwarderspread. Themethod-nameguessgate stopsunprovenmatchesforunknown-evalexportswithoutclaimingnamespace/memberabsence; explicitwrittenmemberaliasesremainallowed, andearlierprovenreceiver/typepathsremainunchanged. UnknownASTfactstillnull, no falseparse-success/intrinsicproof. Existingmembertokenizer andfacts/hash/storelifecycleremainunchanged.
+
+Expanded8files172PASS1SKIP EXIT0, /tmp/codegraph-cjs-ast-f10-f11-after.log, CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2. Coversallprevious166checks plusnewcomputed-keyAST/graphcases,optionalcontextualwrapper,realexplicitcallablealiasunderunknownparse,andfreshindex-v-syncincludingknownactualeval->unknownwrapper->actualeval transitions. One skip is nativekerneltransport; nativebinarynotstaged,no nativeexecutionclaim. A matchercommentclarifyingunproven-callpolicyupdatedaftertest; no behaviorchangedafterthispassingrun. gitdiff--checkPASS. No explicitnormalbuild/fullsuite oncurrentcorrection; old10666fullPASSbelongs875only.
+
+Currentcorrectionvsround8snapshot changes5files: ASThelper,exportreader,matcher,ASTtest,graphintegrationtest. Durablebackup originalQA .review/commonjs-fix-2026-11-08/ast-f10-f11-corrected-2026-11-09/ includesall15sourcefiles,currentSHA256,cumulativepatchrelative875,small5filedeltafromround8,fail-before/passafterlogs,verificationmetadata. F10/F11 statusCORRECTED+focusedPASS, NOTindependentlycleared. Overallreviewcount8unchanged,noround9agentslaunched. Userper-stepconfirmationrequiresdecisionbeforefreshfocusedverify; don'tspendnewfull/reviewcycleunasked. No sourcecommit/pushyet; PR28/29remainDRAFT/unmerged. Ifuserapprovesnextreview: exactGitdiff875..workingtree +round8delta/sameledger, freshread-onlynativebroad/adversarial, boundedprobesonly,norepeatfull/build. Respectactualgate/noreset. Runfinalnormalbuild/fullonceonlyafterreviewstable. PreserveT0stopped/uncommitted; liveem40unchanged; noofficialupstreamwrite.
+
+
+## Ninth native focused verification explicitly authorized and running
+
+User answered yes to next focused dualreview. Fresh READONLY review_broad_pr29_f10_f11_9 and review_adversarial_pr29_f10_f11_9 launched together with exact87576a8d..workingtree15path target, thisledger andsmall5filedelta fromround8. Source matches172focusedPASS snapshot except documentedcommentonlychange, hashmatchesdurablecorrectedbackup. BothreviewclaimsremainPENDING; do notclaimclearance. No sourcechanges/build/fullsuite orpublishingauthorized bythisreviewonlyturn. Source staysfrozen; no gate resets/controlchanges. Parentwillgatherbothactualreports,mergefindings/saveandstop.
+
+
+## Ninth native focused verification completed — F10/F11 cleared, F12 remains
+
+User explicitly authorized thisverificationround. Both fresh read-only lanes review_broad_pr29_f10_f11_9 and review_adversarial_pr29_f10_f11_9 COMPLETED normally on same87576a8d..workingtree15path target and sameledger. Source hashes stillmatch approvedcorrectedsnapshot; no sourceedits/rebuild/fullsuite/controlchanges/networkwritesbyreviewers. No sourcecommit/push/merge/deploy. BothpublishedPRsremaindraftunchanged.
+
+F10/F11 originals independently CLEARED by BOTH: optionalcontextualwrapper nofalsecall; computedkeygenuineevalinsideoutergenerator keepsStore::load; generatormethodkeynongeneratorwrapper nofalsecall. Broad11runtime-backedprobesPASS includingclass/nestedcomputedkeys,generator/nongeneratorbodies,explicitcallablealiasunderunknownfactandgenuineevalcontrols. Evidence /tmp/cg-broad-pr29-ast9-verify.{cjs,log}. Adversarial also confirmsnestednongenerator/gettercomputedkeycontrols. ThesecontrolsdoNOTclearrootwhole-valueexportsbelow.
+
+### F12 — P2 — Unknown eval facts suppress genuine root exports (adversarial)
+
+Exact reviewer location src/resolution/name-matcher.ts:25403. Valid m.js:
+
+```js
+class Store { load() { return 42; } }
+module.exports = { load: Store.prototype.load };
+function yield(v) { return function ignored() {}; }
+yield?.(eval)("ignored");
+```
+
+Caller const named=require('./m'); function run(){named.load();}. Runtime named.load() returns42; currentindexcalls:[]. Readerrecordsnomembersfortherootobjectassignment; newevalUnknowngatedropsthegenuinecallablealias. module.exports=new Store() reproduces too. RemovingONLYnewevalUnknownconditioninmemoryrestoresm.js:Store::loadforbothidenticalinputs. Directexports.load=Store.prototype.loadcontrolstillpasses. ThisisNEWregressionintroducedbyF10correction. Evidence /tmp/cg-a9-root-export-regression.cjs, /tmp/cg-a9-root-export-current.log, /tmp/cg-a9-root-export-oldgate.log. Broadclearedlimitedcontrolsbutdidnotprobeequivalentrootexports; no contradictoryexecutionresult.
+
+STOP/reportmergedfindingonly; useryesauthorizedfocuseddualverify, notanotherunaskedcorrectioncycle. OriginalF10/F11closedatthissnapshot; F12OPEN. No finalreviewclearanceorreadyformergeclaim. No explicitnormalbuild/fullsuiteoncurrentdirtyASTcorrection;172focusedPASS1SKIPremainsactualbutmissesF12. Old10666fullPASSbelongs875only. No test/build/reviewerprocessesrunning. Needuserdecisionbeforefix; preserveactualmodule-valueexportswhileblockingunprovedunknown-evalguesses, notanotherpunctuation/keywordheuristic. Overallcount9honest,noreset/gatebypass. Durableevidence/ledger/resultsavedunderoriginalQA .review/commonjs-fix-2026-11-08/pr29-review9-2026-11-09/; current15sourcefilespatchesremainin adjacentast-f10-f11-correctedbackup. T0/liveem40unchanged, noofficialupstreamwrite.
+
+
+## F12 correction approved and focused verification complete — 2026-11-09
+
+User explicitly approved the focused F12 correction after reading the session-end handoff. Existing checkout/HEAD 87576a8d and all 15 dirty source paths preserved; only two source files and their two tests changed from review 9. No commits, pushes, new review, merge, deploy, grammar/schema/dependency or extraction/storage changes.
+
+Added both runtime-backed F12 regressions FIRST: root object callable alias and new Store() under optional yield wrapper return 42 at runtime but graph calls are empty. Actual 2 FAIL / 61 SKIP, /tmp/codegraph-pr29-f12-red.log, exit 1. Expanded pre-fix reader/graph contract: 33 FAIL / 136 PASS, /tmp/codegraph-pr29-f12-matrix-red.log, exit 1.
+
+Reader now records exportForm (namespace/value/opaque) independently from evalState (present/absent/unknown); replaces the prior evalUnknown flag. Explicit members remain property writes, never a whole-value inventory. Any syntactically stated whole module.exports assignment retains existing value resolution; escapes/mixed writes do not erase that evidence or claim a final member inventory. Namespace absence still requires !uncertain. Inconclusive eval only gates unproven method guesses when no stated whole value is present; explicit property aliases and confirmed eval behavior stay intact. Forwarders propagate the summary through existing spread, and existing typeFrom dependencies remain intact.
+
+Tests cover namespace/direct alias/root object/instance x eval absent/present/unknown, direct and forwarded imports; runtime values and typeFrom metadata asserted. Added fresh-v-sync transitions across both axes, bracket/mixed assignments, opaque reader controls; all prior F10/F11 tests retained unchanged.
+
+Actual verification:
+- First two-file green: 169 PASS, /tmp/codegraph-pr29-f12-matrix-green.log, exit 0. Test setup successfully ran tsc + copied assets for current source.
+- Expanded ten-file run after final four bracket/mixed graph tests: 235 PASS / 1 SKIP / 6 FAIL, /tmp/codegraph-pr29-f12-focused.log, exit 1. All six failures were lazy-engine child stdout empty. Independent minimal spawnSync probe reproduced EPERM for piped Node child output even when the child simply prints 42; file output works. No source/test workaround added.
+- Approved sandbox escalation reran ONLY lazy-engine.test.ts outside sandbox: 6 PASS, /tmp/codegraph-pr29-f12-lazy-unsandboxed.log, exit 0.
+- Combined distinct final checks: 241 PASS / 1 SKIP over 10 files. Skip is native-kernel parity (binary not staged); no native execution claim. git diff --check PASS. No final normal npm run build/fullsuite on dirty AST revision; these remain deferred until stable independent review per user handoff. No tests/build/reviewer processes running.
+
+F12 status: CORRECTED + focused verified, NOT independently cleared. Overall review count remains 9; no gate resets or new agents. STOP and ask before fresh focused dual review, as requested. Proposed two-commit structure stays pending; nothing staged/committed/published. PR28/29 draft state not changed. T0/live/deploy/control files untouched.
+
+Durable backup: original QA .review/commonjs-fix-2026-11-08/pr29-f12-2026-11-09/ contains before/after copies of all 15 dirty source files, hashes, cumulative-from-875.patch, f12-correction.patch, actual red/green/failure/rerun logs and verification.json. Plan: /home/ericm/.codex/plans/plan-codegraph-pr29-f12-2026-11-09.md. Next factual checkpoint: /home/ericm/.codex/plans/handoff-codegraph-pr29-f12-focused-2026-11-09.md.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-f12-2026-11-09/handoff-codegraph-pr29-f12-focused-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/history/pr29-f12-2026-11-09/handoff-codegraph-pr29-f12-focused-2026-11-09.md
new file mode 100644
index 0000000000..7aff60b166
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-f12-2026-11-09/handoff-codegraph-pr29-f12-focused-2026-11-09.md
@@ -0,0 +1,24 @@
+# PR29 F12 correction complete; focused verification done, review pending
+
+
+## F12 correction approved and focused verification complete — 2026-11-09
+
+User explicitly approved the focused F12 correction after reading the session-end handoff. Existing checkout/HEAD 87576a8d and all 15 dirty source paths preserved; only two source files and their two tests changed from review 9. No commits, pushes, new review, merge, deploy, grammar/schema/dependency or extraction/storage changes.
+
+Added both runtime-backed F12 regressions FIRST: root object callable alias and new Store() under optional yield wrapper return 42 at runtime but graph calls are empty. Actual 2 FAIL / 61 SKIP, /tmp/codegraph-pr29-f12-red.log, exit 1. Expanded pre-fix reader/graph contract: 33 FAIL / 136 PASS, /tmp/codegraph-pr29-f12-matrix-red.log, exit 1.
+
+Reader now records exportForm (namespace/value/opaque) independently from evalState (present/absent/unknown); replaces the prior evalUnknown flag. Explicit members remain property writes, never a whole-value inventory. Any syntactically stated whole module.exports assignment retains existing value resolution; escapes/mixed writes do not erase that evidence or claim a final member inventory. Namespace absence still requires !uncertain. Inconclusive eval only gates unproven method guesses when no stated whole value is present; explicit property aliases and confirmed eval behavior stay intact. Forwarders propagate the summary through existing spread, and existing typeFrom dependencies remain intact.
+
+Tests cover namespace/direct alias/root object/instance x eval absent/present/unknown, direct and forwarded imports; runtime values and typeFrom metadata asserted. Added fresh-v-sync transitions across both axes, bracket/mixed assignments, opaque reader controls; all prior F10/F11 tests retained unchanged.
+
+Actual verification:
+- First two-file green: 169 PASS, /tmp/codegraph-pr29-f12-matrix-green.log, exit 0. Test setup successfully ran tsc + copied assets for current source.
+- Expanded ten-file run after final four bracket/mixed graph tests: 235 PASS / 1 SKIP / 6 FAIL, /tmp/codegraph-pr29-f12-focused.log, exit 1. All six failures were lazy-engine child stdout empty. Independent minimal spawnSync probe reproduced EPERM for piped Node child output even when the child simply prints 42; file output works. No source/test workaround added.
+- Approved sandbox escalation reran ONLY lazy-engine.test.ts outside sandbox: 6 PASS, /tmp/codegraph-pr29-f12-lazy-unsandboxed.log, exit 0.
+- Combined distinct final checks: 241 PASS / 1 SKIP over 10 files. Skip is native-kernel parity (binary not staged); no native execution claim. git diff --check PASS. No final normal npm run build/fullsuite on dirty AST revision; these remain deferred until stable independent review per user handoff. No tests/build/reviewer processes running.
+
+F12 status: CORRECTED + focused verified, NOT independently cleared. Overall review count remains 9; no gate resets or new agents. STOP and ask before fresh focused dual review, as requested. Proposed two-commit structure stays pending; nothing staged/committed/published. PR28/29 draft state not changed. T0/live/deploy/control files untouched.
+
+Durable backup: original QA .review/commonjs-fix-2026-11-08/pr29-f12-2026-11-09/ contains before/after copies of all 15 dirty source files, hashes, cumulative-from-875.patch, f12-correction.patch, actual red/green/failure/rerun logs and verification.json. Plan: /home/ericm/.codex/plans/plan-codegraph-pr29-f12-2026-11-09.md. Next factual checkpoint: /home/ericm/.codex/plans/handoff-codegraph-pr29-f12-focused-2026-11-09.md.
+
+Read session-end handoff for publication/identity boundaries. User approval covered this correction and focused tests, not a new review or publication. Next: ask for fresh native broad/adversarial focused verification of 87576a8d..workingtree, exact target and same ledger, plus saved F12 delta. Do not duplicate parent probes or run full suite before stable review clearance. Current HEAD remains 87576a8d9ff0d8aba235db5535f5f4429f14b037, branch fix/commonjs-eval-callee-context. Do not reset/clean or replace the checkout.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-f12-2026-11-09/plan-codegraph-pr29-f12-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/history/pr29-f12-2026-11-09/plan-codegraph-pr29-f12-2026-11-09.md
new file mode 100644
index 0000000000..54022bfc5c
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-f12-2026-11-09/plan-codegraph-pr29-f12-2026-11-09.md
@@ -0,0 +1,11 @@
+# PR29 F12 correction — approved 2026-11-09
+
+User approved the focused F12 correction after reading the session-end handoff. Preserve this checkout, 15 dirty source paths and private .review. HEAD 87576a8d; no commits, pushes, new reviews, merges or deployments in this phase.
+
+1. Add runtime-backed failures for root object alias and root instance under optional yield wrapper / unknown eval fact.
+2. Record export form independently from eval certainty. A syntactically stated whole module.exports value preserves existing value resolution; the property-write member set is not its inventory. Unknown eval must still suppress unsupported guesses without such a stated value, and must never imply absent eval.
+3. Pin reader matrix namespace writes / direct alias / root object / instance / opaque x eval absent/present/unknown. Cover mixed and bracket assignments. Pin real graph matrix for the first four forms, direct and forwarded, plus fresh-vs-sync transitions and prior F10/F11.
+4. Change only commonjs-export-members.ts and name-matcher.ts plus their two tests. Keep extraction/storage/grammar untouched.
+5. Run focused suite (existing eight files and expanded cases), save source hashes/delta/logs/checkpoint, report and ask before fresh dual review. Final normal build/full suite are deferred until stable review clearance per user handoff.
+
+Review count remains 9. Keep PR29 and proposed two-commit organization; committing remains a later step. Baseline backup: original QA .review/commonjs-fix-2026-11-08/pr29-f12-2026-11-09/before.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-harness-20261110T013135Z/build-diff.md b/docs/handoffs/pr29-2026-11-10/history/pr29-harness-20261110T013135Z/build-diff.md
new file mode 100644
index 0000000000..097544214a
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-harness-20261110T013135Z/build-diff.md
@@ -0,0 +1,22 @@
+## codegraph build edge diff
+
+old `/tmp/codegraph-pr29-harness-6fevujfy/baseline/dist/bin/codegraph.js` → new `/tmp/codegraph-pr29-harness-6fevujfy/candidate/dist/bin/codegraph.js`
+
+| repo | verdict | edges old → new | edges −/+ | nodes −/+ | unresolved −/+ |
+|---|---|---|---|---|---|
+| requests | SAME | 2976 → 2976 | 0 | 0 | 0 |
+| click | SAME | 7770 → 7770 | 0 | 0 | 0 |
+| mux | SAME | 1921 → 1921 | 0 | 0 | 0 |
+| ky | SAME | 5278 → 5278 | 0 | 0 | 0 |
+| express | DIFFER | 2334 → 2270 | −64 / +0 | 0 | −0 / +64 |
+
+<details><summary>express: first 4 of 64 differing edges (old count → new count)</summary>
+
+```
+1 -> 0  ["calls",21,8,"express.urlencoded","import",null,"examples/auth/index.js","examples/auth/index.js","javascript","file","function","createApplication","createApplication","lib/express.js",36,56,"index.js",1,135]
+1 -> 0  ["calls",12,24,"users.map","import",null,"examples/content-negotiation/index.js","examples/content-negotiation/index.js","javascript","file","variable","users","users","examples/content-negotiation/db.js",3,3,"index.js",1,47]
+1 -> 0  ["calls",18,15,"users.map","import",null,"examples/content-negotiation/index.js","examples/content-negotiation/index.js","javascript","file","variable","users","users","examples/content-negotiation/db.js",3,3,"index.js",1,47]
+1 -> 0  ["calls",6,20,"users.map","import",null,"examples/content-negotiation/users.js","html","javascript","function","variable","users","users","examples/content-negotiation/db.js",3,3,"html",5,9]
+```
+
+</details>
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-harness-20261110T013135Z/handoff-codegraph-pr29-harness-complete-2026-11-10.md b/docs/handoffs/pr29-2026-11-10/history/pr29-harness-20261110T013135Z/handoff-codegraph-pr29-harness-complete-2026-11-10.md
new file mode 100644
index 0000000000..57c5538d31
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-harness-20261110T013135Z/handoff-codegraph-pr29-harness-complete-2026-11-10.md
@@ -0,0 +1,11 @@
+# PR29 harness complete — indexing regression measured
+
+Current date2026-11-10. Existing checkout `/tmp/codegraph-cjs-missing-fix-20261108`, HEAD87576a8d, branchfix/commonjs-eval-callee-context preserved with all30dirty paths. User authorized isolated baseline/candidate harness, not fixes, review agents or publication. Original2,019tracked-file hashes/Git status/patch unchanged, staged diff empty. Existing T0 remains stopped.
+
+Results and exact evidence: `/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-harness-20261110T013135Z`. Read report.md/results.json/execution.json first. Work copies remain `/tmp/codegraph-pr29-harness-6fevujfy`; baseline and candidate sources/dependencies/dist are independent. Both normal builds PASS.32targeted fixtures FIXED,70candidate canariesPASS, all38existingverdictsunchanged (32BROKEN2GUESSED4FIXED).4of5publicdevcorpus graphs identical; Express64oldcalltargetsremoved (52incorrect,12externalvariable/unproven), no confirmed correct call lost in that set, files/nodes unchanged.23CLIquestions:17SAME6CHANGED, no failed/unstable. Both builds99modecomparisonsPASS. Metamorphic219rows/build: candidate192CLEAN17DIFF10N/A vs baseline183CLEAN26DIFF10N/A. Exact diff multiset comparison:9baseline differences disappear,0new differences,17remain baseline-identical; no indexing errors.
+
+Paired timing24freshindexes,4perbuildperrepo with alternating order: Requests median about2.069s→2.066s (flat); Ky5.045s→5.676s (+12.5%); Express2.379s→3.282s (+38.0%). JS/TS candidate ranges do not overlap baseline ranges. These are measured indexing regressions on one local host, not a proven cause or universal bound. No profiling/fixes attempted. Recommendation: profile indexing overhead before further implementation or release readiness claims.
+
+All jobs finished normally with actual exit statuses saved. Baseline replay exits1 due one canary failure; graph/shadow diffs exit1 for changed results; both metamorphic jobs exit1 for17+baseline findings. Those are classified results, not unreported process errors. timings exit0. No active sessions.
+
+No new independent review started;11dualreview rounds remain completed historically. Full repository test suite not run here; previous819focusedPASS1nativeSKIP still applies to unchanged source. Nativebinary absent, WASM-only. No compiler-oracle refresh/model-agent A/B/overnight history/T0. Report all limitations honestly. If user authorizes profiling, use the isolated candidate/baseline copies and preserve original tree. Ask before implementing any fixes.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-harness-20261110T013135Z/report.md b/docs/handoffs/pr29-2026-11-10/history/pr29-harness-20261110T013135Z/report.md
new file mode 100644
index 0000000000..83551a8002
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-harness-20261110T013135Z/report.md
@@ -0,0 +1,32 @@
+# PR29 harness comparison
+
+The candidate improved the tested call-resolution behavior and introduced no new correctness differences in this harness. It also introduced a measurable indexing slowdown on the JavaScript and TypeScript projects. This is not a clean performance clearance.
+
+The baseline is PR29 HEAD `87576a8d9ff0d8aba235db5535f5f4429f14b037`; the candidate is the saved30path working diff. Both were copied into independent directories with copied dependencies, then passed normal builds, viewer/grammar/runtime checks. The original checkout was never checked out, stashed, reset, rebuilt, committed or edited. All2,019tracked-file hashes, Git status and working patch match the pre-run snapshot. No staged content.
+
+## Correctness evidence
+
+- **32/32PR29fixtures FIXED** on the candidate. All70anonymous canaries PASS; baseline69PASS1FAIL on the optional-wrapper case. Targeted fixtures extend the frozen contract inputs; they are not32new independently discovered cases.
+- All38existing QA fixture verdicts are unchanged:4FIXED,32BROKEN,2GUESSED. These known failures remain visible; replay exit0alone does not mean they passed.
+- Requests, Click, Mux and Ky have identical canonical graphs. Express loses64call edges and gains64unresolved calls, with no files/nodes changed.52old edges targeted the wrong function/value;12targeted a variable holding an external import without evidence for its call body. No removed edge in this set was a confirmed correct call. See express-classification.json for every site and source/runtime evidence; this does not establish complete Express call coverage.
+- Agent-facing CLI comparison:17SAME,6CHANGED,0FAILED,0UNSTABLE. Changes show the intended PR29targets, removal of incorrect Express callers, and correct returned-function resolution in issue2952.
+- Both builds pass99execution-mode comparisons each across11inputs (98raw IDENTICAL,1SAME-GRAPH). Covers repeat, parse1/4, resolver pool, serial resolution, no store worker, no fast init, reindex and sync-from-empty. The canonical-equivalent row-order difference occurs for Requests sync-from-empty on both builds.
+- Metamorphic comparison:73seeds ×3relations per build. Candidate192CLEAN,17DIFF,10N/A; baseline183CLEAN,26DIFF,10N/A; no indexing errors. Exact diff multiset comparison finds9baseline differences removed and zero new candidate differences. The17remaining differences match baseline exactly. One is unrelated unbound opaque-call-name capture in a PR29seed; its exported-load assertions still pass. Repeat graphs are stable for all73seeds; shift checks pass wherever applicable. All remaining differences are decoy relations.
+
+## Indexing time
+
+Four fresh CLI indexes per build per project, alternating build order, after the other harness jobs finished. Same source copies, node22.22.2, WASM, two parse workers. Median and full range:
+
+| Project | Baseline median (range) | Candidate median (range) | Median change |
+|---|---|---|---|
+| requests | 2.069s (2.062–2.292) | 2.066s (2.007–2.193) | -0.2% |
+| ky | 5.045s (5.000–5.140) | 5.676s (5.474–5.783) | +12.5% |
+| express | 2.378s (2.360–2.444) | 3.281s (3.241–3.825) | +38.0% |
+
+All24indexes completed successfully. Ky and Express timing ranges do not overlap across builds. Requests is effectively flat. These are measurements on one shared local host with four samples per arm; they do not prove behavior for all repositories or identify the cause of the slowdown. Profile the JS/TS indexing path before further implementation or release readiness claims.
+
+## Scope and saved evidence
+
+This run used the existing deterministic QA fixture, canonical build-diff, CLI shadow, execution-mode and metamorphic harnesses, with saved unchanged scorer/adapter code. It did not run a model-agent A/B, refresh the compiler oracle, resume experimental T0, run overnight private-project history replay, run the complete repository test suite, or test native-kernel parity. Independent code review is still pending. No fixes, review agents or publication were performed.
+
+`manifest.json` records corpus pins and candidate source hashes. `qa-inputs/` and its hash manifest preserve exact harness code and inputs. `baseline-source.tar.gz` and `candidate-source.tar.gz` preserve source snapshots; package locks identify dependencies. `candidate.patch`, all actual logs/JSON, exit codes in `execution.json`, timing samples, per-edge classification, metamorphic comparison and the final preservation audit are saved beside this report. Nonzero diff/shadow/metamorphic exits were retained and classified; no failing rows were hidden.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-review-round7-2026-11-09/commonjs-eval-callee-context.md b/docs/handoffs/pr29-2026-11-10/history/pr29-review-round7-2026-11-09/commonjs-eval-callee-context.md
new file mode 100644
index 0000000000..3f6d81ec9f
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-review-round7-2026-11-09/commonjs-eval-callee-context.md
@@ -0,0 +1,47 @@
+# Separate F8 follow-up (review round count remains six)
+
+User explicitly authorized committing/pushing current work to a PR and separating remaining correction. Current snapshot committed5d384989957c91b482068b306535437915a0595b, pushed fix/commonjs-missing-member, DRAFT https://github.com/inth3shadows/codegraph/pull/28 against main. KnownF8 documented, not ready to merge alone. No deploy/merge/upstream report.
+
+New branch fix/commonjs-eval-callee-context based on5d384989. Exact prospective Git target: git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5d384989957c91b482068b306535437915a0595b -- src/resolution/commonjs-export-members.ts __tests__/commonjs-export-members.test.ts __tests__/js-default-binding-members.test.ts
+
+F8 reviewer finding and prior invariants remain in .review/commonjs-missing-member.md; do not reset shared gate/round count. Two sixth reviewers completed; broad demonstrated F8 despite adversarial clearing intended F7 cases. This follow-up has NOT had independent dual review yet.
+
+Correction: distinguish grouping around bare eval from another function's argument list using token before parentheses. Wrapper identifier/call/member/optional-call/tag/control-condition prefixes must not mark exports uncertain. Grouped direct eval, literal/template arguments and expression prefixes such as return must keep prior behavior. Change limited to9helper lines plus independent unit and real-index graph regressions; no matcher/sync/scope changes.
+
+Before fix8FAIL92PASS; tag-result additional case1FAIL49PASS. Final focused2files101PASS, /tmp/codegraph-cjs-eval-followup-focused.log. Build/full pending. Hashes /tmp/codegraph-cjs-followup-frozen.json. Logs /tmp/codegraph-cjs-eval-followup-{before,tag-before,focused,build}.log. Need staged exact3-file diff, personal repo/identity and actual build result before commit/push. Full normal suite required before readiness claim. Keep follow-up draft and explicitly state review pending. No additional reviewer agents launched in this follow-up; user plans to point agents at PRs.
+
+Keep both PRs draft. Follow-up base should be fix/commonjs-missing-member, producing only the small correction diff. Review/merge follow-up into parent branch before considering parent PR for main; no merge authorized by current request. Preserve original T0 pilot and all deploy/control worktrees.
+
+Published DRAFT https://github.com/inth3shadows/codegraph/pull/29, commit87576a8d9ff0d8aba235db5535f5f4429f14b037, base fix/commonjs-missing-member/PR28 at5d384989. Explicit buildPASS; normal full suite RUNNING session62594, /tmp/codegraph-cjs-eval-followup-full.log. Both pushed/draft, neither merged/deployed; follow-up independent review stillpending. Original T0 untouched.
+
+
+FINAL execution verification2026-11-09: normal full suite session62594 EXIT0,873filesPASS19SKIP,10666testsPASS2expectedFAIL448SKIP0unexpectedFAIL,800.20sec. /tmp/codegraph-cjs-eval-followup-full.log. 101focusedPASS and explicit buildPASS on same87576a8dsource. Final3changed-file SHA256 checks PASS, trackedtreeclean; actual remoteheads rechecked5d384989(PR28) and87576a8d(PR29). PR29 body updated with exact final validation. Both PRs still DRAFT/unmerged; no deployment/upstream write. FOLLOW-UP INDEPENDENT REVIEW STILL PENDING: do not conflate fullsuite with review clearance. No further tests/build/review processes running. Saved final checkpoint and full log under original QA two-draft-prs backup.
+
+
+## Seventh native review explicitly requested — PR29 — 2026-11-09
+
+User invoked /dual review29. Exact GitHub base5d384989957c91b482068b306535437915a0595b and head87576a8d9ff0d8aba235db5535f5f4429f14b037 verified. Fresh read-only native lanes review_broad_pr29_round7 and review_adversarial_pr29_round7 launched together with same exact Git target and this ledger. Both focus full3-file29-line correction, F8 closure and nearby invariants; bounded execution probes only, no repeat full/build or source edits. Parent does not reread reviewed diff or duplicate reviewer probes. No review results yet; no independent clearance claim. Do not reset round count/gate, change source, push, merge or deploy in this review-only turn. Stop and report merged findings when both complete.
+
+
+## Seventh native dual review result — PR29 — 2026-11-09
+
+Both fresh read-only lanes completed normally: review_broad_pr29_round7 and review_adversarial_pr29_round7. Exact target remains5d384989957c91b482068b306535437915a0595b..87576a8d9ff0d8aba235db5535f5f4429f14b037. Source hashes verified unchanged, trackedtreeclean except private untracked.review. No source edits/build/fullsuite reruns/commits/pushes/GitHubcomments/merge/deploy. Both PRs remain draft. Current review DOES NOT CLEAR PR29 despite prior101focusedPASS/full10666PASS/buildPASS. Parent merges findings from actual final reports without re-verifying/re-reading diff.
+
+### F9 — P2 — Preserve grouped direct eval in control-statement bodies (BOTH)
+
+Broad location src/resolution/commonjs-export-members.ts:31: rejects any preceding ), including a completed if or for condition. Exact input `class Store { load() { return 42; } }
+if (true) (eval)('exports.load = Store.prototype.load;');`. Runtime exports load() returning42, but current discovery uncertain:false and indexing named.load() produces no call. Removing only new prefix guard in memory restores uncertain:true and m.js:Store::load. Nested grouped eval in unbraced single-iteration for body reproduces too. Broad evidence /tmp/cg-broad-pr29-control-context.{cjs,log}; exact command `node --experimental-wasm-exnref --experimental-wasm-stack-switching /tmp/cg-broad-pr29-control-context.cjs`.
+
+Adversarial independently confirms same location/trace; grouped-template if-body and for-body also reproduce. Evidence /tmp/codegraph-cjs-adversarial7-conditional-eval.{cjs,log}. De-duplicated as one P2 F9. This is a NEW regression introduced in PR29, not a pre-existing parent limitation.
+
+### F8 — P2 — PARTIALLY CORRECTED, remains for contextual-keyword wrapper names (adversarial)
+
+Exact reviewer location src/resolution/commonjs-export-members.ts:29 (whitelist:7). Valid CommonJS `function await(value){return function ignore(code){};} await(eval)("ignored");` passes eval without invoking it, but whitelist exemption produces uncertain:true and falsely resolves named.missing() to decoy.js:Decoy::missing. With exports.known=function known(){}, runtime exports only known; pre-F7 behavior restored in memory produces no call. yield reproduces too. Evidence /tmp/codegraph-cjs-adversarial7-contextual-wrapper.{cjs,log}. This is a RESIDUAL F8 variant, not a new unrelated parent re-audit. Do not label all F8 closed.
+
+### Confirmed preservation / rulings
+
+Both independently clear original F8 forms wrap(eval)("ignored") and wrap((eval))(("ignored")): runtime onlyknown, reader uncertain:false, no decoy call. Broad /tmp/cg-broad-pr29-f8-closure.{cjs,log}. Adversarial13runtime-backed graph controls pass (original2forms +11nearby controls), /tmp/codegraph-cjs-adversarial7-controls.log. True standalone grouped/template eval, return expressions, inert data/method declarations, call/member/optional/tag/condition-prefix negatives retain tested behavior. These controls do not answer F9 control-body context or F8 await/yield wrappers.
+
+### Next boundary
+
+Review-only user request is complete. STOP: no fixes, additional review loop, external review comment, markready, merge or deploy without user instruction. The per-step confirmation request remains in force. This is round7 overall; no gate/state reset. Repeated grouping-prefix patches now demonstrate syntax-context ambiguity: if user asks for remediation, choose an evidence-based smaller boundary/design instead of another unbounded keyword/punctuation whitelist. Preserve both concrete repros and all prior controls. Do not repeat fullsuite/build on unchanged source. Actual durable result/evidence/checksums saved in original QA .review/commonjs-fix-2026-11-08/pr29-review-round7-2026-11-09/.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-review-round7-2026-11-09/commonjs-missing-member.md b/docs/handoffs/pr29-2026-11-10/history/pr29-review-round7-2026-11-09/commonjs-missing-member.md
new file mode 100644
index 0000000000..60b3b51ffe
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-review-round7-2026-11-09/commonjs-missing-member.md
@@ -0,0 +1,200 @@
+# CommonJS missing-member review ledger
+
+Target: /tmp/codegraph-cjs-missing-fix-20261108, branch fix/commonjs-missing-member. Base 5e0664891af0e87e6fd18bbfa16cab39237570f5 to current tracked working tree, unchanged while both reviewers run. Exact diff: `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5e0664891af0e87e6fd18bbfa16cab39237570f5 -- CHANGELOG.md src/resolution/name-matcher.ts __tests__/js-default-binding-members.test.ts`.
+
+Round1 pending two fresh read-only native lanes. No Claude-only /code-review invocation. No resolver fix existed previously; user explicitly authorized implementation and dual review. Fork issue27 is the bug, QA PR27 is evidence only. No official upstream submission before Tuesday verification.
+
+## Findings / fix map
+
+- F1: confirmed upstream defect. `const named=require('./m'); named.missing()` with m.js exporting only known falsely calls unimported Decoy::missing; ref keeps receiver, resolvedBy instance-method/provenance null. Default imports and class-name-alias collision variants also reproduced. Sync adding decoy also fabricates call. Proposed tracked working-tree fix adds default bindings to imported-receiver guard and moves guard before unrelated class-name matching, after actual import/typed/object resolution. Requires reviewer execution and clearance.
+- P0 test baseline: new20-case file on unmodified resolver:15 PASS /5 FAIL. The5 failures are3 parameterized default/require+decoy cases,1 forwarding-module missing member,1 sync-add-decoy. Log /tmp/codegraph-cjs-fix-baseline2.log. No production code edit before this run. Initial baseline command failed because Vitest4 removed --minWorkers; corrected to --maxWorkers=4. Initial two new-test authoring corrections: object variable API used instead of unsupported direct object-literal shorthand shape; expected local object's qualified name corrected to actual fully-qualified extraction name. Neither changes an existing baseline test.
+
+## Rulings / limits
+
+- Direct `module.exports = { read() {} }` without an assigned variable already lacks correct member recovery on base and can be captured by a method decoy. This change must stop wrong calls; new object API positive uses baseline-supported `const api={read(){}}; module.exports=api`. Do not broaden into object-export extraction or claim direct shorthand recovery is implemented.
+- Bare external-package import exact-match issue26 remains separate and unfixed.
+- No import mapping semantics changes, no blanket conversion of require to namespace imports, no source code changes outside one name-matcher guard and changelog/tests.
+- This is a remaining variant of closed upstream2952/merged3162. No global novelty claim. Reproduced on em40/pristine main/pristine release. Native kernel unverified; local deployment is kernel0/WASM.
+
+## Invariants / commands
+
+- Actual exported member resolves beside an unrelated same-name method; missing member has no call. Forwarded CommonJS module preserves real export.
+- Stated CommonJS class static method, assigned object member, instance method, callable direct/default + attached function all remain correct beside decoys.
+- Existing ES default class, instance, typed variable, ambient export=, ordinary ESM namespace, named/anonymous/renamed functions retain calls.
+- Typed local parameters and object literal bindings shadowing default imports retain their local member calls.
+- Sync adds/removes a real export correctly; sync adding/removing a same-name unrelated method never fabricates missing-member calls.
+- Check these with `cd /tmp/codegraph-cjs-missing-fix-20261108 && CODEGRAPH_KERNEL=0 npx vitest run __tests__/js-default-binding-members.test.ts --maxWorkers=1`.
+- Expanded focused suite currently running: js-default-binding-members, commonjs-require-calls, commonjs-require-imports, commonjs-exports, require-default, import-default-as, namespace-object-resolution, import-object-member-namesake, sync-default-export-change, sync-import-member-retry, out-of-repo-import-shadow. Log /tmp/codegraph-cjs-fix-focused.log. Full normal suite/build pending.
+- Additional adversarial probes: class name matching alias, nested receiver paths, defaults with inherited/static/object APIs, lexical shadows and live sync. Each defect needs concrete input/actual wrong output; no style requests or hypothetical findings.
+
+## Round1 review outputs and remediation
+
+Both native lanes finished read-only. Each independently reported the same two P2 regressions at name-matcher.ts:24944; no other demonstrated findings.
+
+- R1 (broad+adversarial): `class Store { load() {} }; module.exports = new Store()` loses its legitimate instance call. Adversarial also demonstrated `export default new Store()` with Store not separately exported. Both base em40 produce Store::load; initial guard none. Remediation: resolve a whole explicit constructor expression to its actual module's local/imported class before the guard. Follow CommonJS forwarding; mask strings/comments/regexes, balance constructor arguments and type arguments, reject chained expressions, memoize with existing export index. Never re-enable generic method-name guessing for default bindings.
+- R2 (broad+adversarial): visible local `class named { static missing(){} }` shadows a default/namespace import; moving guard ahead of class strategy drops correct own-file call. Broad also tested enclosing-function shadow. Remediation: guard exempts a class declaration in the reference's file only when existing isLexicallyReachable proves it visible. Other-file alias-name class decoy remains blocked.
+- Review regression tests run BEFORE remediation: /tmp/codegraph-cjs-fix-review-baseline.log,24 cases19PASS5FAIL (original CommonJS positive +2 constructed-default variants +2 lexical class shadow variants). This pins both findings. Additional constructor argument/forwarder/text controls added; simple first remediation failed3nested/multiline/regex constructor positives in /tmp/codegraph-cjs-fix-constructors-baseline.log before argument-reader correction.
+- After remediation: /tmp/codegraph-cjs-fix-focused4.log,11 files99PASS1SKIP. Final focused run adds no-parentheses and spaced CommonJS constructor controls; /tmp/codegraph-cjs-fix-focused-final.log pending. Earlier temporary TS compile error from passing Language to CommentLang was corrected to JS-family typescript comment handling; not a passing run.
+
+The exact R1 reviewed name-matcher source is saved in .review/round1-name-matcher.ts and reconstructed hash verified against the recorded Git blob512a77a155299de8e6890447aa2d3aea7b81a1f9. Name-matcher remediation diff: `git diff --no-index /tmp/codegraph-cjs-missing-fix-20261108/.review/round1-name-matcher.ts /tmp/codegraph-cjs-missing-fix-20261108/src/resolution/name-matcher.ts`. Import-resolver and new tests are also remediation, diff from5e066489. No intermediate failing-source commit was made.
+
+Verify2 target is current tracked working tree relative5e066489, including CHANGELOG.md, src/resolution/name-matcher.ts, src/resolution/import-resolver.ts, __tests__/js-default-binding-members.test.ts. Check R1/R2 on all paths, all invariants, and defects introduced by remediation. Do not re-raise the pre-existing direct module.exports object-literal recovery limit without new evidence. Full build/suite pending. No merge/deployment occurred.
+
+## Verify2 result — NOT cleared; namespace-only redesign supersedes that target
+
+Both fresh native lanes finished; all findings P2. Broad reported first textual constructor overriding inactive/overwritten exports, valid inline/parenthesized constructors losing calls (R1 still open), and constructor-derived calls remaining stale after sync. Adversarial independently reported constructor lookup overriding typed/object/class lexical shadows (R2 still open), earlier constructor overriding a later stated default, and stale constructor-derived calls after sync. Exact evidence scripts/results under /tmp/cg-broad-verify2-* and /tmp/codegraph-cjs-verify2-*; complete reviewer messages returned to root. Existing explicit-default resolution was safer than the attempted new inference.
+
+Both lanes advised that a smaller boundary is coherent: extend module-namespace ownership only to a require/default whose resolved JS/TS target has no stated or uncertain value default; preserve all existing explicit/unknown default-value inference. Whole-file CommonJS forwarding can follow a namespace leaf; ambiguous assignments/default values must stay base behavior. No nonexistent redesigned code was reviewed or cleared by those design messages.
+
+Implemented redesign: REMOVED all added import-resolver source code; that file is byte-identical to base again. Removed unsafe constructor parsing/inference entirely. Name-matcher now uses existing context.resolveModuleFile, a per-context namespace-classification memo (cleared with existing memos), conservative source checks, pure whole-file forwarders only, bounded/cycle-safe traversal, language-qualified memo keys and JS/TS extensions only (no implicit component defaults). Any raw default keyword/export= or uncertain module use excludes the new guard; comments/text may conservatively prevent a classification. Move-before-class guard keeps lexical own-file class exemption. Changelog narrowed to modules without a value default.
+
+Scope/ruling: arbitrary stated/unknown exported default values and their guessed-member limitations remain pre-existing and explicitly OUTSIDE this fix. Do not claim every default-import missing-member case fixed. Removed new constructor-parser feature tests after deleting that feature, retaining baseline-supported CJS/ESM singleton, stated class/object/callable, lexical shadows and every original missing-module regression. Two dedicated singleton controls initially asserted disambiguation between two .load methods that base itself cannot provide; corrected their newly-authored fixture to a unique .load method, preserving the actual base invariant. Original broader CJS store-vs-decoy control remains unchanged. No baseline existing assertion was weakened.
+
+Full suite on superseded constructor candidate was STOPPED intentionally via guarded SIGINT to only this checkout's Vitest PID702277; final exec83750exit130. It did not pass and must not be reported as a test failure count/green gate. /tmp/codegraph-cjs-fix-full.log belongs that obsolete target. Latest redesigned focused13-file run /tmp/codegraph-cjs-fix-redesign-focused2.log RUNNING; verify actual exit/summary. Explicit build and redesigned full suite remain required.
+
+Third-review exception requested via async user question: skill says third round only if verify found something high severity; these were P2. Await user's explicit answer before launching further reviewers. Both agents' conceptual agreement is not final dual-review clearance. No source commit/push/fix PR/merge/deploy occurred. Original user's conditional merge/deploy request remains dependent on a reviewed green fix; original T0 stays stopped.
+
+## Final testing and local commit — authoritative current state
+
+Namespace redesign focused suite13files108PASS1SKIP, explicit npm run build exit0. Full normal suite exec60370EXIT0:872filesPASS19SKIP;10589testsPASS,2expectedFAIL,448SKIP,0unexpectedFAIL,799.56seconds. /tmp/codegraph-cjs-fix-redesign-full.log. Original portable6-case bug reproduction6/6PASS. Existing independent18-case records match em40baseline exactly. Namespace-to-value default change sync agrees with fresh index (initial no calls, synced/fresh Store::load); /tmp/codegraph-cjs-namespace-sync-probe.{cjs,jsonl}. Native kernel not validated.
+
+Personal repository/remote/identity, source checksums against preserved tested snapshot, staged3-file set and staged diff/check verified before local commit. LOCAL COMMIT d18e40970fc5fbf32f635f6d8d536d1bdb24dacc, tree2363dd0f8923ca59c28a3e45a477573e7364e7c2, branch fix/commonjs-missing-member. Tracked working tree clean; only private .review untracked. No push/fix PR/merge/deployment. Review target now `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5e0664891af0e87e6fd18bbfa16cab39237570f5..d18e40970fc5fbf32f635f6d8d536d1bdb24dacc -- CHANGELOG.md src/resolution/name-matcher.ts __tests__/js-default-binding-members.test.ts`.
+
+Third review still requires the pending user answer. User's later status question did NOT approve it. If authorized use two fresh native lanes with fork_turns=none and self-contained briefs/ledger to avoid carrying unrelated history. Preserve final tests; no redundant full rerun unless code or unresolved concerns change the tested tree. Verification and logs/source/patch are backed up under original QA .review/commonjs-fix-2026-11-08/verification.json and adjacent artifacts. Current canonical handoff handoff-codegraph-commonjs-tested-review-pending-2026-11-08.md supersedes running/constructor handoffs.
+
+## Third round authorized and running
+
+User explicitly answered yes to the third-review request, then asked why another round was needed. Explained earlier reviews covered replaced code while the tested final commit had not been independently reviewed. This question did not revoke approval. Started fresh read-only review_broad_commonjs_final3 and review_adversarial_commonjs_final3 with fork_turns=none, the exact base..d18e4097 target and this ledger, compact self-contained briefs and no full-suite rerun. Their results remain pending. Source unchanged; no push/merge/deployment.
+
+## Third round result — 2026-11-09 — NOT READY TO MERGE
+
+Exact target remains local d18e40970fc5fbf32f635f6d8d536d1bdb24dacc. Tracked tree clean, .review untracked; no source changes after passing tests. User resumed; collected broad final answer and adversarial confirmed messages. Broad lane completed normally. Adversarial lane delivered independently confirmed findings/evidence, then failed finalization with a usage-limit error (retry notice Nov9 1:10AM). Do NOT claim that lane completed normally, final clearance, or a green dual review. No push/PR/merge/deployment.
+
+### F3 — P2 — Namespace classification changes do not invalidate existing guessed calls (broad, independently confirmed adversarial)
+
+Broad location src/resolution/name-matcher.ts:25398. Start with `class Store { load() {} }; module.exports = new Store()` and an unchanged caller requiring that module and calling `.load()`. Replace the export with `exports.known = function known() {};`, retaining the class. After cg.sync(), the graph still calls Store::load; a fresh index correctly produces no call. The new module-text dependency needs to reopen existing member guesses when export shape changes.
+
+Broad reproduction /tmp/cg-broad-final3-sync-reverse.cjs; final evidence /tmp/cg-broad-final3-sync-reverse.log. Baseline comparison confirms its sync and fresh results both retained Store::load (/tmp/cg-broad-final3-sync-reverse-base.log). Adversarial independently reproduced direct and pure forwarder value->namespace->value->namespace retaining Store::load on every sync: /tmp/codegraph-cjs-final3-sync.cjs. Minimum correction recommendation: reopen default-import member guesses when imported module export text/shape changes, or record the imported source dependency on guesses allowed by a false namespace classification.
+
+### F4 — P2 — Explicitly exported callable aliases lose their calls (adversarial confirmed before usage limit)
+
+Location reported src/resolution/name-matcher.ts:25427. m.js `class Store { load() { return 42; } }\nexports.load = Store.prototype.load;`; use.js `const named=require('./m');\nexport function run(){named.load();}`. em40 calls m.js:Store::load; final emits no call. Same independently confirmed for `module.exports.load = Store.prototype.load`. Runtime named.load returns42 and Object.keys(module)=['load']. This is an explicitly exported callable, not the ruled-out direct object/default-value guessing limit. Prototype mutation variants group with the same uncertain-exports classification problem.
+
+Evidence /tmp/codegraph-cjs-final3-export-alias.cjs and /tmp/codegraph-cjs-final3-adversarial{,-base.jsonl,-final.jsonl}. Recommendation: preserve uncertain named-export RHS APIs or resolve the actual callable alias before blocking a fallback. Do not reopen arbitrary guesses for absent exports.
+
+### F5 — P2 — Out-of-scope local class bypasses namespace guard (adversarial confirmed before usage limit; original finding remains open on this path)
+
+Reported location src/resolution/name-matcher.ts:25397 (guard local-class exemption, around25396). Valid CJS: m.js `exports.known=function known(){};`; use.js lines1..8:
+`const named=require('./m');`
+`function run(){`
+`if(true){`
+`class named {static missing(){}}`
+`}`
+`named.missing();`
+`}`
+`module.exports=run;`
+Final returns use.js:run::named::missing atline6, though the class is block-local and imported module has no missing. Also reproduced for a class inside TS namespace Parent. These outputs pre-exist on base, but this is a still-open original false-positive path bypassing the new guard: existing isLexicallyReachable does not establish block visibility. Recommendation: require actual enclosing lexical block visibility before exempting a class. Preserve the genuine inner/enclosing-function shadow controls.
+
+## Merge decision / next boundary
+
+HOLD d18e4097. Passing build/full/focused tests remain factual, but F3/F4 are demonstrated regressions and F5 remains an intended missing-member path. No further agents, tests, source fixes or outward actions started after these reports. Do not rerun the full suite until a changed candidate requires it. User required confirmation before subsequent steps; present this concrete review result and seek the next bounded correction/verification decision. Fourth review is not preauthorized by approval of the third; native review gate may deny round4, so stop and ask rather than bypass. Agent quota exhaustion is additional reason not to relaunch a failed lane automatically.
+
+## Corrections authorized — 2026-11-09
+
+User: if findings are separate, report them; if related, fix them. All three are related: F3/F4 regressions introduced by this guard, F5 remaining original namespace missing-member path. No new issue filing or outside bug work needed. Authorized correcting all three in this branch; no extra reviewer lane or outward action started.
+
+Fail-before tests:11 new regressions fail and24 existing pass on d18e4097, /tmp/codegraph-cjs-fix-r3-regressions-before.log. New tests cover direct and forwarded value->namespace->value->namespace sync vs fresh; explicit dotted/bracket export aliases beside a still-absent-member decoy; alias removal by sync; out-of-scope sibling-block classes vs genuine same-block inner callers; TSnamespaceclassscope.
+
+Changes: F3 uses existing typeFrom dependency tracking on byName default-import member calls, includes each pure-forwarder file; activates the existing dependency-edge reopener for JS/TS paths while keeping failed-attribute retry Python-only. F4 namespace info tracks explicit assigned member names; new guard applies only to absent names. Escaping/computed/prototype-mutated exports remain uncertain and preserve existing behavior. F5 adds existing holderScopeAt block visibility to the class-shadow exemption, retaining function lexical visibility as well. Namespace memo stores traced files/member names; cache not poisoned by depth/cycle cutoffs.
+
+First focused verification AFTER all three corrections:3files49PASS0FAIL, /tmp/codegraph-cjs-fix-r3-regressions-after.log. Includes full35-case default-member suite and memo clearing/lifetime. No existing expected assertion weakened. Pending expanded JS/Python sync controls, normal full suite/build and original6-case repro. No new commit yet; earlier full pass applies d18e4097 only. Current changed files test + name-matcher + src/index.ts + src/extraction/index.ts. No unsafe constructor inference, import-resolver unchanged. Fourth review not yet requested/launched; gate and quota limits remain applicable.
+
+## Corrected commit verified by execution — independent review pending
+
+F3 class-name path also pinned: two new uppercase Store import-alias sync cases failed when only byName answers carried dependency metadata; /tmp/codegraph-cjs-fix-r3-upper-before.log. Final correction records imported-module inputs on name-matcher default-member answers from both class-name and method-name strategies. No change to confidence/byName selection. All original regression assertions retained.
+
+FINAL source tests:16files206PASS1SKIP, including37default-membercases, JS imports/sync andPythonattribute/memo controls. Log/tmp/codegraph-cjs-fix-r3-focused-final.log. Full normal suite exec42040EXIT0:872filesPASS19SKIP,10602testsPASS2expectedFAIL448SKIP0unexpectedFAIL,771.60seconds, /tmp/codegraph-cjs-fix-r3-full.log. Explicit npm run build exec37438EXIT0, /tmp/codegraph-cjs-fix-r3-build.log. Original portable6-case bug reproducer6/6PASS, /tmp/codegraph-cjs-corrected-final-sixcases.log. Node22.22.2/kernel0WASM; native not claimed. Source checksums prove no source changes between focused/full/build/testing and commit.
+
+LOCAL CORRECTION COMMIT559c76df6afd9e40f4d617ff77caa7db4ad03955, tre eb81d2063f4e787da5cfc7d28c619078fdc86e6b6, parentd18e40970fc5fbf32f635f6d8d536d1bdb24dacc. Personalrepository/remote/identity/stagedexact4-filediff andchecks verified. Trackedtreeclean, onlyprivate.reviewuntracked. No push/fixPR/merge/deploy or issuefiling. F3/F4/F5 status CORRECTED+executionPASS, awaiting independent verification; do not claim native review clearance.
+
+FOURTH ROUND ANSWER PENDING: async question asked permission and quoted ~/.codex/AGENTS.md: "where Claude's gate would ask the user at round 4, Codex denies, so stop and ask." User has not answered that new question; elapsed time is not approval. Do not launch fourth reviewers yet or modify gate state/control files. If approved use2freshread-onlynativefork_turns=none, same ledger, correction target `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff d18e40970fc5fbf32f635f6d8d536d1bdb24dacc..559c76df6afd9e40f4d617ff77caa7db4ad03955 -- src/resolution/name-matcher.ts src/index.ts src/extraction/index.ts __tests__/js-default-binding-members.test.ts`. Brief F3-F5, currentcorrections+invariants; no fullsuite rerun unless changes/failures justify it. Stop/ask if gate denies; last third adversarial lane failed finalization due usage cap, don't fabricateclearance.
+
+Durable original-workspace backup .review/commonjs-fix-2026-11-08/corrections-2026-11-09/:4sourcefiles, corrections.patch, checksums.json, before/after/focused/full/build/reprologs, verification.json identifyingfinalcommit/tree/outcomes, verified commonjs-fix.bundle containingbothlocalfixcommits with originalbase5e066489prerequisite. Commit recovery does not depend on /tmp survival. Current canonical handoff handoff-codegraph-commonjs-corrected-review-pending-2026-11-09.md supersedes corrections-running and review-blocked handoffs. OriginalT0unchanged/stopped; Tuesdayconditionalupstreamreport unchanged.
+
+## Fourth verification and modular correction — 2026-11-09
+
+User asked whether errors remain and approved proceeding, specifically requesting a smaller modular strategy for any remaining fix. Two fresh read-only minimal-context lanes review_broad_commonjs_verify4 and review_adversarial_commonjs_verify4 completed. BOTH independently CLEARED F3 direct/forwarded sync for ordinary and class-name aliases; F4 dotted/bracket callable/prototype aliases and removal sync; F5 block/namespace visibility and genuine inner shadows. Adversarial also verified Python failed-call retry/retyping and zero Python retry on JS-only edits. No full/build reruns or source edits by reviewers.
+
+F6 — P2 — src/resolution/name-matcher.ts:25444 raw exported-member discovery accepts comments, strings, regex literals, and unrelated object properties. With m.js exporting only known, adding `// exports.missing = fake;` or `function setup(holder) { holder.exports.missing = 42; }` makes named.missing falsely call decoy.js:Decoy::missing. Clean source has no call. Quoted/template/regex variants reproduce. This is newly added member inclusion, not the previous conservative default-text exclusion ruling. Exact broad evidence /tmp/cg-broad-verify4-classifier.{cjs,log}, /tmp/cg-broad-verify4-probes.cjs; adversarial /tmp/codegraph-cjs-verify4-extra.cjs. Both recommended one isolated token-aware collector validating executable assignments and bare exports/module.exports roots.
+
+Following user's authorized strategy: extracted readCommonJsExportMembers into new48-line(initial) src/resolution/commonjs-export-members.ts, with independent __tests__/commonjs-export-members.test.ts. Replaced matcher raw member/escape scanning with one helper call. Uses exact pinned production js-tokens9.0.1 (CommonJS, built-in types,16071unpackedbytes per officialnpmmetadata), no hand-written lexer or changedsharedstrip-comments scanner. Existingnamespace/default ownership tracing, sync/typeFrom and holderScopeAt behavior retained. Newpackage9chosen to keep CJS compatibility; upstream latestREADME refers to newerESMrequirebehavior. Source tokenizer was verified from officialrepo docs and installed package/types. No Node/packageversionbump.
+
+Fail-before graph regressions:8FAIL/37SKIP on559c76df, /tmp/codegraph-cjs-modular-before.log. New helper independently tests executable dot/bracket writes, template expressions/nesting, TSgenerics, JSXtext-vs-expressions, line/block comments, strings/templates/regex/control-regex, unrelated/Unicode/dollar roots, equality/typequeries, uncertain/prototype/computed APIs. Initial4files89PASS. Additional2positive runtime-API controls (literal eval export and require.cache default) exposed2FAIL before uncertainty handling; /tmp/codegraph-cjs-modular-uncertain-before.log. Added explicit uncertainty for literal eval code and Node module/cache APIs, preserving genuine dynamic exports while ordinary data remains opaque. All existing expected assertions retained.
+
+Latest modular focused gate18files260PASS1SKIP, /tmp/codegraph-cjs-modular-expanded-final.log; includes47default-member graph cases,38pure helper cases, priorJS/Python/sync/memo/lazy-engine controls. Source remains dirty relative559c76df in6files: newhelper/newunit test (intent-to-add makes visible in Gitdiff), existing integrationtest/matcher and package.json/package-lock. No new commit yet. No outwardactions. Full current modular suite/build still pending; parent10602PASS does not cover new modular code.
+
+User's conditional approval includes correcting any residual error with this smaller strategy and verifying it. Next fresh verification target is559c76df..working tree, sameledger and6paths; keep native round count honest (fifthverification), no target/state reset. Stop/ask if host gate denies; do not bypass. Review ONLY F6 closure and regressions of helper/adapter/dependency, plus bounded preservation checks. Source stable after260focusedPASS; no repeatedfull/build by reviewers. Prefer existingdist+scratch probes; underlyingthree corrections already independently cleared.
+
+
+## Fifth verification — modular source reader, 2026-11-09
+
+Fresh read-only lanes review_broad_commonjs_modular5 and review_adversarial_commonjs_modular5 both completed. Both cleared F6 phantom comments/strings/templates/regex and unrelated roots, plus preservation of real aliases, sync, scope and Python behavior. Production js-tokens9.0.1 packaging compatibility cleared. No source edits or redundant full-suite runs by reviewers.
+
+F7 — P2 — src/resolution/commonjs-export-members.ts:37 recognizes eval uncertainty only when a bare eval immediately receives a StringLiteral. Both reviewers reproduced template-literal eval dropping a real Store::load call. Adversarial additionally reproduced `(eval)('exports.load = Store.prototype.load;')`. Both runtime mutations return42; previous reader preserves Store::load, current reader emits no calls. Literal single-quoted bare eval control remains green. Evidence /tmp/codegraph-cjs-adversarial5-eval.{cjs,log}. Fix only the small helper: account for grouped bare eval callee and template literals, preserve class method named eval as non-call text. Add fail-before controls; do not alter name-matcher, sync or scope corrections for F7.
+
+Pre-F7 modular full normal suite EXIT0, 873 files PASS19SKIP, 10650 tests PASS2expectedFAIL448SKIP0unexpectedFAIL,780.27sec. /tmp/codegraph-cjs-modular-full.log. This run does not cover the upcoming F7 correction. Current source remains local and dirty relative559c76df. No push, source PR, merge, deployment or upstream report. Original T0 pilot remains stopped/uncommitted.
+
+
+F7 correction: literalEvalCall now unwraps paired bare-callee parentheses and grouped arguments, accepts StringLiteral/NoSubstitutionTemplate/TemplateHead. Does not execute eval or inspect data token contents; method declaration named eval remains ignored. Added4 pure-reader controls and2 graph positives. Before change:6FAIL85PASS (/tmp/codegraph-cjs-modular-eval-before.log); after:91PASS across2files (/tmp/codegraph-cjs-modular-eval-after.log). git diff --check PASS. No changes to the matcher adapter, sync or scope for F7. Full-suite PASS above predates this correction; normal final full suite and independent review of the F7 correction remain pending. Local changes uncommitted. Build result pending.
+
+Explicit final F7 npm run build EXIT0, /tmp/codegraph-cjs-modular-eval-build.log; viewer,29grammars,runtime and dist engine checks PASS. Final full suite and independent F7 verification still pending; do not conflate pre-F7 full pass with final-tree clearance. Checkpoint backup .review/commonjs-fix-2026-11-08/modular-eval-2026-11-09/ in original QA workspace contains6current sourcefiles, cumulative and modular patches, hashes, logs and this ledger. Source unchanged since91focusedPASS/build.
+
+
+## Sixth verification authorized and running — 2026-11-09
+
+User explicitly answered yes to final verification. Fresh read-only native lanes review_broad_commonjs_eval6 and review_adversarial_commonjs_eval6 launched against559c76df..workingtree six modular paths and same ledger. No gate reset/bypass or Claude-only skill claim. Both focus F7 closure and neighboring invariants; no full/build reruns by reviewers. Parent full normal CODEGRAPH_KERNEL=0 npm test -- --maxWorkers=4 runs session5033, /tmp/codegraph-cjs-eval6-full.log. Snapshot hashes /tmp/codegraph-cjs-eval6-frozen.json. No final results yet. Final explicit build before this full run passed; test setup refreshed engine assets itself. No source changes during review/tests, no outward actions. Personal origin/identity rechecked: inth3shadows/codegraph, Eric Minish / eric.minish@gmail.com. Current six modular files remain uncommitted.
+
+
+## Sixth verification result — 2026-11-09 — NOT READY TO MERGE
+
+Both fresh read-only lanes completed normally. Adversarial CLEARED F7: original3 runtime/graph forms plus11 additional runtime-backed graph controls preserve real exports and reject inert eval-looking data/method declarations. Evidence /tmp/codegraph-cjs-adversarial6-eval.{cjs,log}. Broad independently passed13 intended F7/nearby controls, but found F8 in the correction. No source edits/build/full reruns by reviewers. No final dual clearance.
+
+### F8 — P2 — literalEvalCall mistakes function-argument parentheses for grouped eval callees (broad)
+
+Reviewer location src/resolution/commonjs-export-members.ts:20, loop lines20-24. Exact input:
+
+```js
+exports.known = function known() {};
+function wrap(value) { return function ignore(code) {}; }
+wrap(eval)("ignored");
+```
+
+Runtime exports only known. Current reader returns uncertain:true, making named.missing() falsely resolve to decoy.js:Decoy::missing. Restoring only the pre-F7 literal-eval check in memory returns uncertain:false and no call. wrap((eval))(("ignored")) also reproduces. Evidence /tmp/cg-broad-verify6-callee-compare.log, adjacent .cjs; initial probe /tmp/cg-broad-verify6-callee-context.{cjs,log}. Broad passed all13 intended controls including grouped direct eval, templates, method named eval, real template-expression exports and callable aliases. Adversarial's bounded probes did not include this counterexample; its clearance does not override the demonstrated defect.
+
+Parent full suite intentionally stopped with SIGINT after confirmed F8; exact cwd/argv guarded signal to only isolated checkout main Vitest, tool session5033 EXIT130. /tmp/codegraph-cjs-eval6-full.log is PARTIAL, NOT a full pass/failure result. Avoid wasting a known-defective verification cycle. Prior91focusedPASS and explicit buildPASS remain true for this source, prior10650fullPASS predates F7 and cannot clear current tree. SHA256 snapshot recheck confirms all6 reviewed source paths unchanged during verification. No new source commit, push, fixPR, merge, deployment, version/tag/npm or upstream report.
+
+Stop this correction cycle and report F8. User yes authorized final verification, not another correction/review cycle or publishing. Need user decision before next step, as previously requested. Durable evidence in original QA .review/commonjs-fix-2026-11-08/final-verification-2026-11-09/. Previous modular-eval source/patch backup still matches frozen source. Keep original T0 stopped/uncommitted. Do not reset review count/gate or rewrite control files.
+
+
+## Seventh native dual review result — PR29 — 2026-11-09
+
+Both fresh read-only lanes completed normally: review_broad_pr29_round7 and review_adversarial_pr29_round7. Exact target remains5d384989957c91b482068b306535437915a0595b..87576a8d9ff0d8aba235db5535f5f4429f14b037. Source hashes verified unchanged, trackedtreeclean except private untracked.review. No source edits/build/fullsuite reruns/commits/pushes/GitHubcomments/merge/deploy. Both PRs remain draft. Current review DOES NOT CLEAR PR29 despite prior101focusedPASS/full10666PASS/buildPASS. Parent merges findings from actual final reports without re-verifying/re-reading diff.
+
+### F9 — P2 — Preserve grouped direct eval in control-statement bodies (BOTH)
+
+Broad location src/resolution/commonjs-export-members.ts:31: rejects any preceding ), including a completed if or for condition. Exact input `class Store { load() { return 42; } }
+if (true) (eval)('exports.load = Store.prototype.load;');`. Runtime exports load() returning42, but current discovery uncertain:false and indexing named.load() produces no call. Removing only new prefix guard in memory restores uncertain:true and m.js:Store::load. Nested grouped eval in unbraced single-iteration for body reproduces too. Broad evidence /tmp/cg-broad-pr29-control-context.{cjs,log}; exact command `node --experimental-wasm-exnref --experimental-wasm-stack-switching /tmp/cg-broad-pr29-control-context.cjs`.
+
+Adversarial independently confirms same location/trace; grouped-template if-body and for-body also reproduce. Evidence /tmp/codegraph-cjs-adversarial7-conditional-eval.{cjs,log}. De-duplicated as one P2 F9. This is a NEW regression introduced in PR29, not a pre-existing parent limitation.
+
+### F8 — P2 — PARTIALLY CORRECTED, remains for contextual-keyword wrapper names (adversarial)
+
+Exact reviewer location src/resolution/commonjs-export-members.ts:29 (whitelist:7). Valid CommonJS `function await(value){return function ignore(code){};} await(eval)("ignored");` passes eval without invoking it, but whitelist exemption produces uncertain:true and falsely resolves named.missing() to decoy.js:Decoy::missing. With exports.known=function known(){}, runtime exports only known; pre-F7 behavior restored in memory produces no call. yield reproduces too. Evidence /tmp/codegraph-cjs-adversarial7-contextual-wrapper.{cjs,log}. This is a RESIDUAL F8 variant, not a new unrelated parent re-audit. Do not label all F8 closed.
+
+### Confirmed preservation / rulings
+
+Both independently clear original F8 forms wrap(eval)("ignored") and wrap((eval))(("ignored")): runtime onlyknown, reader uncertain:false, no decoy call. Broad /tmp/cg-broad-pr29-f8-closure.{cjs,log}. Adversarial13runtime-backed graph controls pass (original2forms +11nearby controls), /tmp/codegraph-cjs-adversarial7-controls.log. True standalone grouped/template eval, return expressions, inert data/method declarations, call/member/optional/tag/condition-prefix negatives retain tested behavior. These controls do not answer F9 control-body context or F8 await/yield wrappers.
+
+### Next boundary
+
+Review-only user request is complete. STOP: no fixes, additional review loop, external review comment, markready, merge or deploy without user instruction. The per-step confirmation request remains in force. This is round7 overall; no gate/state reset. Repeated grouping-prefix patches now demonstrate syntax-context ambiguity: if user asks for remediation, choose an evidence-based smaller boundary/design instead of another unbounded keyword/punctuation whitelist. Preserve both concrete repros and all prior controls. Do not repeat fullsuite/build on unchanged source. Actual durable result/evidence/checksums saved in original QA .review/commonjs-fix-2026-11-08/pr29-review-round7-2026-11-09/.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-review-round7-2026-11-09/merged-review.md b/docs/handoffs/pr29-2026-11-10/history/pr29-review-round7-2026-11-09/merged-review.md
new file mode 100644
index 0000000000..3b087367eb
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-review-round7-2026-11-09/merged-review.md
@@ -0,0 +1,24 @@
+
+
+## Seventh native dual review result — PR29 — 2026-11-09
+
+Both fresh read-only lanes completed normally: review_broad_pr29_round7 and review_adversarial_pr29_round7. Exact target remains5d384989957c91b482068b306535437915a0595b..87576a8d9ff0d8aba235db5535f5f4429f14b037. Source hashes verified unchanged, trackedtreeclean except private untracked.review. No source edits/build/fullsuite reruns/commits/pushes/GitHubcomments/merge/deploy. Both PRs remain draft. Current review DOES NOT CLEAR PR29 despite prior101focusedPASS/full10666PASS/buildPASS. Parent merges findings from actual final reports without re-verifying/re-reading diff.
+
+### F9 — P2 — Preserve grouped direct eval in control-statement bodies (BOTH)
+
+Broad location src/resolution/commonjs-export-members.ts:31: rejects any preceding ), including a completed if or for condition. Exact input `class Store { load() { return 42; } }
+if (true) (eval)('exports.load = Store.prototype.load;');`. Runtime exports load() returning42, but current discovery uncertain:false and indexing named.load() produces no call. Removing only new prefix guard in memory restores uncertain:true and m.js:Store::load. Nested grouped eval in unbraced single-iteration for body reproduces too. Broad evidence /tmp/cg-broad-pr29-control-context.{cjs,log}; exact command `node --experimental-wasm-exnref --experimental-wasm-stack-switching /tmp/cg-broad-pr29-control-context.cjs`.
+
+Adversarial independently confirms same location/trace; grouped-template if-body and for-body also reproduce. Evidence /tmp/codegraph-cjs-adversarial7-conditional-eval.{cjs,log}. De-duplicated as one P2 F9. This is a NEW regression introduced in PR29, not a pre-existing parent limitation.
+
+### F8 — P2 — PARTIALLY CORRECTED, remains for contextual-keyword wrapper names (adversarial)
+
+Exact reviewer location src/resolution/commonjs-export-members.ts:29 (whitelist:7). Valid CommonJS `function await(value){return function ignore(code){};} await(eval)("ignored");` passes eval without invoking it, but whitelist exemption produces uncertain:true and falsely resolves named.missing() to decoy.js:Decoy::missing. With exports.known=function known(){}, runtime exports only known; pre-F7 behavior restored in memory produces no call. yield reproduces too. Evidence /tmp/codegraph-cjs-adversarial7-contextual-wrapper.{cjs,log}. This is a RESIDUAL F8 variant, not a new unrelated parent re-audit. Do not label all F8 closed.
+
+### Confirmed preservation / rulings
+
+Both independently clear original F8 forms wrap(eval)("ignored") and wrap((eval))(("ignored")): runtime onlyknown, reader uncertain:false, no decoy call. Broad /tmp/cg-broad-pr29-f8-closure.{cjs,log}. Adversarial13runtime-backed graph controls pass (original2forms +11nearby controls), /tmp/codegraph-cjs-adversarial7-controls.log. True standalone grouped/template eval, return expressions, inert data/method declarations, call/member/optional/tag/condition-prefix negatives retain tested behavior. These controls do not answer F9 control-body context or F8 await/yield wrappers.
+
+### Next boundary
+
+Review-only user request is complete. STOP: no fixes, additional review loop, external review comment, markready, merge or deploy without user instruction. The per-step confirmation request remains in force. This is round7 overall; no gate/state reset. Repeated grouping-prefix patches now demonstrate syntax-context ambiguity: if user asks for remediation, choose an evidence-based smaller boundary/design instead of another unbounded keyword/punctuation whitelist. Preserve both concrete repros and all prior controls. Do not repeat fullsuite/build on unchanged source. Actual durable result/evidence/checksums saved in original QA .review/commonjs-fix-2026-11-08/pr29-review-round7-2026-11-09/.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-review10-2026-11-09/adversarial-report.md b/docs/handoffs/pr29-2026-11-10/history/pr29-review10-2026-11-09/adversarial-report.md
new file mode 100644
index 0000000000..095d50cb3e
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-review10-2026-11-09/adversarial-report.md
@@ -0,0 +1,17 @@
+P2 — Shadowed module writes disable the unknown-eval guard. src/resolution/commonjs-export-members.ts:75 treats a local parameter’s assignment as a CommonJS root export:
+
+exports.known = function known() {};
+function pretend(module) { module.exports = {}; }
+pretend({});
+function yield(v) { return function ignored() {}; }
+yield?.(eval)("ignored");
+
+With caller const named=require('./m'); function run(){named.missing();} and unrelated export class Decoy { missing() {} }, actual CommonJS runtime exports only known; missing is undefined. Current graph incorrectly returns calls:["decoy.js:Decoy::missing"]. The reader records exportForm:"value", evalState:"unknown", bypassing the guard at name-matcher.ts:25403. Block-local and arrow-parameter shadowing reproduce.
+
+Loading both saved pre-F12 source files in memory yields calls:[] for identical inputs, confirming this correction introduces the regression.
+
+Evidence: /tmp/cg-a10-boundary.cjs, /tmp/cg-a10-boundary.log, /tmp/cg-a10-before-loader.cjs, /tmp/cg-a10-boundary-before-source.log, /tmp/cg-a10-shadow-runtime.log.
+
+Original F12 object/instance reproducers independently clear: runtime returns 42, graph reaches m.js:Store::load. Original F10 and both F11 directions independently remain cleared.
+
+Read-only preservation confirmed: all 15 source hashes match the checkpoint. No source/control edits, build, full suite, commits, or network writes.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-review10-2026-11-09/broad-report.md b/docs/handoffs/pr29-2026-11-10/history/pr29-review10-2026-11-09/broad-report.md
new file mode 100644
index 0000000000..a51e900484
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-review10-2026-11-09/broad-report.md
@@ -0,0 +1,19 @@
+One P2 finding: F12 remains for equivalent whole-value assignment syntax at src/resolution/commonjs-export-members.ts:75.
+
+class Store { load() { return 42; } }
+(module.exports) = new Store();
+function yield(v) { return function ignored() {}; }
+yield?.(eval)("ignored");
+
+With const named=require('./m'); function run(){named.load();}, runtime returns 42, but graph calls are []. The reader records exportForm:"opaque" because it expects = immediately after module.exports; name-matcher.ts:25403 then suppresses the genuine call.
+
+Removing only the optional wrapper restores m.js:Store::load. (module.exports) = {load:Store.prototype.load} and module.exports &&= new Store() reproduce. Direct and forwarded imports both fail; fresh indexing and sync agree. Removing the wrapper during sync restores the edge and expected typeFrom dependencies. This is an incompletely corrected F12 case, not a demonstrated new regression introduced by the latest patch.
+
+Independently cleared on current dist:
+- Original F12 unparenthesized root object and instance assignments, including forwarded/bracket/mixed controls.
+- F10 optional wrapper: no Decoy::missing edge.
+- Both F11 computed-key directions: real eval retained; wrapper produces no false edge.
+
+Evidence: 28 runtime/graph probes in /tmp/cg-broad-pr29-f12-10.{cjs,log}; 12 asserted sync/fresh comparisons in /tmp/cg-broad-pr29-f12-10-sync.{cjs,log}. Ran with CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2 CODEGRAPH_TELEMETRY=0 node --liftoff-only.
+
+All 15 source/test hashes remain unchanged against /tmp/cg-broad-pr29-f12-10-source-before.sha256. No repository edits, rebuild, full suite, or native-kernel parity claim. Overall F12 clearance remains pending.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-review10-2026-11-09/commonjs-eval-callee-context.md b/docs/handoffs/pr29-2026-11-10/history/pr29-review10-2026-11-09/commonjs-eval-callee-context.md
new file mode 100644
index 0000000000..d446e88157
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-review10-2026-11-09/commonjs-eval-callee-context.md
@@ -0,0 +1,200 @@
+# Separate F8 follow-up (review round count remains six)
+
+User explicitly authorized committing/pushing current work to a PR and separating remaining correction. Current snapshot committed5d384989957c91b482068b306535437915a0595b, pushed fix/commonjs-missing-member, DRAFT https://github.com/inth3shadows/codegraph/pull/28 against main. KnownF8 documented, not ready to merge alone. No deploy/merge/upstream report.
+
+New branch fix/commonjs-eval-callee-context based on5d384989. Exact prospective Git target: git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5d384989957c91b482068b306535437915a0595b -- src/resolution/commonjs-export-members.ts __tests__/commonjs-export-members.test.ts __tests__/js-default-binding-members.test.ts
+
+F8 reviewer finding and prior invariants remain in .review/commonjs-missing-member.md; do not reset shared gate/round count. Two sixth reviewers completed; broad demonstrated F8 despite adversarial clearing intended F7 cases. This follow-up has NOT had independent dual review yet.
+
+Correction: distinguish grouping around bare eval from another function's argument list using token before parentheses. Wrapper identifier/call/member/optional-call/tag/control-condition prefixes must not mark exports uncertain. Grouped direct eval, literal/template arguments and expression prefixes such as return must keep prior behavior. Change limited to9helper lines plus independent unit and real-index graph regressions; no matcher/sync/scope changes.
+
+Before fix8FAIL92PASS; tag-result additional case1FAIL49PASS. Final focused2files101PASS, /tmp/codegraph-cjs-eval-followup-focused.log. Build/full pending. Hashes /tmp/codegraph-cjs-followup-frozen.json. Logs /tmp/codegraph-cjs-eval-followup-{before,tag-before,focused,build}.log. Need staged exact3-file diff, personal repo/identity and actual build result before commit/push. Full normal suite required before readiness claim. Keep follow-up draft and explicitly state review pending. No additional reviewer agents launched in this follow-up; user plans to point agents at PRs.
+
+Keep both PRs draft. Follow-up base should be fix/commonjs-missing-member, producing only the small correction diff. Review/merge follow-up into parent branch before considering parent PR for main; no merge authorized by current request. Preserve original T0 pilot and all deploy/control worktrees.
+
+Published DRAFT https://github.com/inth3shadows/codegraph/pull/29, commit87576a8d9ff0d8aba235db5535f5f4429f14b037, base fix/commonjs-missing-member/PR28 at5d384989. Explicit buildPASS; normal full suite RUNNING session62594, /tmp/codegraph-cjs-eval-followup-full.log. Both pushed/draft, neither merged/deployed; follow-up independent review stillpending. Original T0 untouched.
+
+
+FINAL execution verification2026-11-09: normal full suite session62594 EXIT0,873filesPASS19SKIP,10666testsPASS2expectedFAIL448SKIP0unexpectedFAIL,800.20sec. /tmp/codegraph-cjs-eval-followup-full.log. 101focusedPASS and explicit buildPASS on same87576a8dsource. Final3changed-file SHA256 checks PASS, trackedtreeclean; actual remoteheads rechecked5d384989(PR28) and87576a8d(PR29). PR29 body updated with exact final validation. Both PRs still DRAFT/unmerged; no deployment/upstream write. FOLLOW-UP INDEPENDENT REVIEW STILL PENDING: do not conflate fullsuite with review clearance. No further tests/build/review processes running. Saved final checkpoint and full log under original QA two-draft-prs backup.
+
+
+## Seventh native review explicitly requested — PR29 — 2026-11-09
+
+User invoked /dual review29. Exact GitHub base5d384989957c91b482068b306535437915a0595b and head87576a8d9ff0d8aba235db5535f5f4429f14b037 verified. Fresh read-only native lanes review_broad_pr29_round7 and review_adversarial_pr29_round7 launched together with same exact Git target and this ledger. Both focus full3-file29-line correction, F8 closure and nearby invariants; bounded execution probes only, no repeat full/build or source edits. Parent does not reread reviewed diff or duplicate reviewer probes. No review results yet; no independent clearance claim. Do not reset round count/gate, change source, push, merge or deploy in this review-only turn. Stop and report merged findings when both complete.
+
+
+## Seventh native dual review result — PR29 — 2026-11-09
+
+Both fresh read-only lanes completed normally: review_broad_pr29_round7 and review_adversarial_pr29_round7. Exact target remains5d384989957c91b482068b306535437915a0595b..87576a8d9ff0d8aba235db5535f5f4429f14b037. Source hashes verified unchanged, trackedtreeclean except private untracked.review. No source edits/build/fullsuite reruns/commits/pushes/GitHubcomments/merge/deploy. Both PRs remain draft. Current review DOES NOT CLEAR PR29 despite prior101focusedPASS/full10666PASS/buildPASS. Parent merges findings from actual final reports without re-verifying/re-reading diff.
+
+### F9 — P2 — Preserve grouped direct eval in control-statement bodies (BOTH)
+
+Broad location src/resolution/commonjs-export-members.ts:31: rejects any preceding ), including a completed if or for condition. Exact input `class Store { load() { return 42; } }
+if (true) (eval)('exports.load = Store.prototype.load;');`. Runtime exports load() returning42, but current discovery uncertain:false and indexing named.load() produces no call. Removing only new prefix guard in memory restores uncertain:true and m.js:Store::load. Nested grouped eval in unbraced single-iteration for body reproduces too. Broad evidence /tmp/cg-broad-pr29-control-context.{cjs,log}; exact command `node --experimental-wasm-exnref --experimental-wasm-stack-switching /tmp/cg-broad-pr29-control-context.cjs`.
+
+Adversarial independently confirms same location/trace; grouped-template if-body and for-body also reproduce. Evidence /tmp/codegraph-cjs-adversarial7-conditional-eval.{cjs,log}. De-duplicated as one P2 F9. This is a NEW regression introduced in PR29, not a pre-existing parent limitation.
+
+### F8 — P2 — PARTIALLY CORRECTED, remains for contextual-keyword wrapper names (adversarial)
+
+Exact reviewer location src/resolution/commonjs-export-members.ts:29 (whitelist:7). Valid CommonJS `function await(value){return function ignore(code){};} await(eval)("ignored");` passes eval without invoking it, but whitelist exemption produces uncertain:true and falsely resolves named.missing() to decoy.js:Decoy::missing. With exports.known=function known(){}, runtime exports only known; pre-F7 behavior restored in memory produces no call. yield reproduces too. Evidence /tmp/codegraph-cjs-adversarial7-contextual-wrapper.{cjs,log}. This is a RESIDUAL F8 variant, not a new unrelated parent re-audit. Do not label all F8 closed.
+
+### Confirmed preservation / rulings
+
+Both independently clear original F8 forms wrap(eval)("ignored") and wrap((eval))(("ignored")): runtime onlyknown, reader uncertain:false, no decoy call. Broad /tmp/cg-broad-pr29-f8-closure.{cjs,log}. Adversarial13runtime-backed graph controls pass (original2forms +11nearby controls), /tmp/codegraph-cjs-adversarial7-controls.log. True standalone grouped/template eval, return expressions, inert data/method declarations, call/member/optional/tag/condition-prefix negatives retain tested behavior. These controls do not answer F9 control-body context or F8 await/yield wrappers.
+
+### Next boundary
+
+Review-only user request is complete. STOP: no fixes, additional review loop, external review comment, markready, merge or deploy without user instruction. The per-step confirmation request remains in force. This is round7 overall; no gate/state reset. Repeated grouping-prefix patches now demonstrate syntax-context ambiguity: if user asks for remediation, choose an evidence-based smaller boundary/design instead of another unbounded keyword/punctuation whitelist. Preserve both concrete repros and all prior controls. Do not repeat fullsuite/build on unchanged source. Actual durable result/evidence/checksums saved in original QA .review/commonjs-fix-2026-11-08/pr29-review-round7-2026-11-09/.
+
+
+## AST redesign approved and started — 2026-11-09
+
+User explicitly approved AST redesign in PR29, said near usage max and asked for a resumable start, then said proceed. This revokes prior review-only stop for in-scope remediation; do not ask same approval on resume. Preserve per-step/user and actual gate boundaries for later merges/deployments. No grammar/runtime/dependency/database-schema changes, commits or pushes in this partial phase; PRs remain draft at prior heads.
+
+Newgraph regressions FIRST:3control-body direct-eval variants(if string/template, for nestedgroups) +await/yield CommonJS wrappers,5FAIL51SKIP on current87576a8d. /tmp/codegraph-cjs-ast-red.log, EXIT1. This intentionally RED gate remains unchanged because integration pending.
+
+New isolated src/extraction/commonjs-eval.ts reads existing SyntaxNode tree and checks actual call.function after unwrapping parenthesized_expression. Returns true for syntacticdirectevalcall(anyargument), false for provenabsence, null for parseerrors with no foundcall. New __tests__/commonjs-eval.test.ts loads existingJS/TS/TSXgrammars:33PASS, /tmp/codegraph-cjs-ast-helper.log EXIT0. Controls cover reports, grouped/interpolated eval, return, generatorfunctions/methods, nestednongenerator scope, eval inside yieldwrapper argument, inert data/methods/membercalls, JSX and malformedsource. Helper not wired to classifier/extraction yet. Existing lexical reader/EXPRESSION_PREFIX_WORDS unchanged for now. Do not claim F8/F9 closed, new full/buildpass or finalreview.
+
+IMPORTANT new evidence: existingJSgrammar correctly models control-body eval and awaitwrapper but parses legal CommonJS yield(eval)(code) as yield_expression whose operand is a call on(eval), no parseerrors. ASTscope must distinguish nongeneratorwrapper from generator yield. Helper handles direct yieldoperand only via nearestfunction/generator/methodscope; nested true eval in yield(eval(code)) remains detected. Shapeprobe /tmp/codegraph-cjs-ast-shape-probe.{cjs,log}. Extractionreferenceprobe /tmp/codegraph-cjs-eval-reference-probe.{cjs,log} shows currentextractor emits callref eval for genuinecall AND synthetic yieldwrappercase. Consequently raw existing unresolved eval refs alone are insufficient. User was explicitly told this grammar limitation, not falsely assured all cases are parser-perfect. No grammarfiles changed.
+
+Next integrate factualcallresult through existingextraction to resolver. Node has NO metadata field (onlyedges do); do not invent Node.metadata, abuse signature/selfedges/candidates, or introduce schema migration casually. ExtractionResult can carry optionalfact through workerclone; need native/deferred bypass parity. Main bulk parse pools only load grammars in workers; resolver cannot assume synchronous getParser is ready in main. Suggested project_metadata perfile/sourcehash transport or another small explicit extractioncontext capability; persist/refresh under same successfulstore lifecycle, cover storeworker and sync. Decide carefully before editing infrastructure. Resume must preserve all existing tests and5newred cases; unknown/missing/error facts must not masquerade as provenabsence. Keep existing export-member tokenizer and previous sync/scope/alias fixes intact; remove prefixheuristics only onceASTfacts actuallysupplied.
+
+Saved current3sourcefiles, patchrelative87576a8d, hashes, red/green/probe logs under original QA .review/commonjs-fix-2026-11-08/ast-redesign-started-2026-11-09/. No tests/build/reviewers running at checkpoint. Newfiles intent-to-add only so diffincludes them, not readyforcommit. No fresh dualreviewagents this phase. Overall reviewcount7; do not reset gate/controlstate. Resume directly integration and targeted tests; fullsuite/build only after stablefix, fresh focuseddual review as authorized/actualgatepermits, no repetitivewholeprojectwork. OriginalT0stillstopped/uncommitted; liveem40 unchanged; no merges/deploy/upstream writes.
+
+
+## AST integration execution-tested — verify round8 pending
+
+User approved AST redesign with focused review before final fullsuite, then resumed. Current dirty correction target87576a8d..workingtree,15paths captured /tmp/codegraph-cjs-ast-frozen.json (allnewfilesintent-to-add). No sourcecommit/pushyet; publishedPR29still87576a8d. No grammar/runtime/dependency/schema changes.
+
+Implemented AST fact in ExtractionResult and ephemeralFileRecord property; WASM computes from existingtree, native/deferred routes compute with existinggrammar; kernelmaterializer preservesfact. Allstorepaths carryFileRecord fact through existingwriter, upsertFile writes project_metadata commonjs_eval:<file> containingcontentHash/value. Nosecondwriter orNode.metadata. deleteFile removesfact. Coordinatorcontext acceptsboolean onlyonexact SHA256sourcehash. Missing/malformed/stale/nullfacts returnunknown, neverabsenceproof. Tokenreader removed literalEvalCall/EXPRESSION_PREFIX_WORDS, consults lazyASTfact atmostonceonlywhenbareevaltokenpresent; unknown staysconservative. Existingmembertokenizer/sync/typeFrom/scope unchanged. CHANGELOG alreadyrequiresre-indexafterupgrading(line56), which suppliesnewfacts; no legacyfactmigrationclaimed.
+
+Original5newgraphregressionsRED5FAIL51SKIP beforeintegration. Initialintegratedrun blocked by compiler: hashContentisexportedfromextraction/index, notutils; corrected byusingexistingcreateHashcrypto inresolver (sameSHA256algorithm), no circularextractionimport. Then3files140PASS. AddedrealSQLite factlifecycle4cases(missing/malformed/null, hashstale/replace,rollbackwithfiletransaction, deletion) andfreshindex-vs-sync wrapper->if-eval->yield-wrapper->for-eval->wrapper sequence. Final8files166PASS1SKIP, /tmp/codegraph-cjs-ast-expanded.log, CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2; alsoincludesmemo/synccaches/lazy-engine. Nativebinarynotstaged(codegraph-kernel/prebuilds/linux-x64/codegraph-kernel.node absent); kerneltransporttestskipped. Do not claimnativeexecution. Enginecompiledbytestsetup,currentdistmatchesfrozen sources. No explicitfinalnormalbuild/fullsuiteorindependentreviewyet. Priorfull10666PASSbelongs87576a8donly.
+
+Next eighthfreshnativeREADONLYlanes verify this correction, sameledger andexactGitdiff87576a8d..workingtree. Boundedruntimeprobes only, no fullsuite/build orsourcechanges. CheckF8/F9closure,generator-awareyieldworkaround, actualevalvswrappercallee, sourcehashfactlifecycle/workertransport/sync, previouscontrols. Do not re-audit unrelatedparentlimitations. Stop/reportifreviewfindsissues; do notresetgate/count orclaimClaude-onlyskill.
+
+
+## Eighth native review COMPLETED — AST correction NOT CLEARED
+
+Both fresh read-only reviewers completed normally on frozen15-file87576a8d..workingtree correction. Both confirm no source edits/build/full reruns/control changes; source hashes unchanged. No final normalbuild/fullsuite run or commit/push. PublishedPR28/29 remain drafts at5d384989/87576a8d. Prior166focusedPASS1SKIP is true and covers original5reportedgraphcases, but does not clear new findings. Nativebinary absent, no nativeexecutionclaim. Parent uses actual reports, no independent duplicate repro/diffread.
+
+### F10 — P2 — Optional contextual-keyword wrappers regress (adversarial)
+
+Exact reviewer location src/extraction/commonjs-eval.ts:37. Valid CommonJS:
+
+```js
+exports.known = function known() {};
+function yield(value) {
+  return function ignore(code) {};
+}
+yield?.(eval)("ignored");
+```
+
+Runtime exports only known; eval is never invoked. Existing grammar reports parse error, helper returns null, reader marks exports uncertain, and named.missing() falsely calls unrelated decoy.js:Decoy::missing. Actual current correction calls:[decoy.js:Decoy::missing]; base87576a8dreader restored in memory calls:[], uncertain:false. Evidence /tmp/cg-a8-yield-optional.{cjs,log}, /tmp/cg-a8-yield-optional-base.{cjs,log}, /tmp/cg-a8-probe.cjs. New F8-adjacent regression introduced by AST correction. Unknown fact correctly avoids false absence proof but must not license false call targets; current fallback still does.
+
+### F11 — P2 — Computed method names use enclosing scope (broad)
+
+Exact reviewer location src/extraction/commonjs-eval.ts:51. Treats a computed method name as belonging to that method's function scope. Computed names execute in enclosing scope. Confirmed both directions:
+
+1. `class Store { load(){return 42;} } function* setup(){ const obj = { [yield (eval)('exports.load = Store.prototype.load;')]() {} }; } setup().next();` Runtime exports load()->42, currentfactfalse/uncertainfalse, named.load() graphcalls[]. Ordinary computedmethodkey inside outergenerator suppressesgenuineeval.
+2. `exports.known=function known(){}; function yield(value){return function ignore(code){return 'x';}} const obj={ *[yield(eval)("ignored")](){} };` Runtime keysonlyknown, currentfacttrue/uncertaintrue, named.missing() falselycallsDecoy::missing. Generator methodkeyevaluatesoutsidegeneratorbody, so yieldiswrapperhere.
+
+One rootcause/twoexecutiontraces, evidence /tmp/cg-broad-pr29-ast8-computed-scope.{cjs,log}, executed againstcurrentdist with CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2. All15frozenhashesmatch.
+
+### Stop boundary and saved state
+
+Approved redesign progressed to166focusedPASS + real-worker/store/sync/factlifecycle integration, then focusedverifyfoundthese2P2. STOP before anothercorrectioncycle per dual-reviewworkflow/userper-stepconfirmation. Don't spendfullsuiteonknowndefectivecode orpushasready. Usermustdecidenextstep; noautomaticnewreview/fix/merge/deploy. Overallcount8, noreset. Nextremediationifapproved: computedmethodscope must excludecomputedkeys fromnewmethodscope; parseerrorunknown mustnotenableinventedfallbackcalls (requires explicitresolutionpolicy, not anotherkeyword/punctuationguess). Preserve all originalregressions and33ASTcontrols, truealiases/sync/scope/Pythonbehavior. No grammarfiles/schema/deps changed; source remains15dirtypaths, notcommitted. Durablebackup includes allsources/patch/logs andnewreviewevidence, verificationresult/checksums.
+
+
+## F10/F11 corrections approved and execution-verified — independent verification pending
+
+User explicitly answered yes to correcting the two eighth-review findings. Current HEAD87576a8d and15dirtysourcepaths retained; no newcommit/push/merge/deploy/grammar/schema/dependencychanges.
+
+Fail-beforetests:2ASTcomputed-key cases,3graphfindingcases,positivealiascontrol andunknownparse syncstep. Actual2files6FAIL90PASS beforefix, /tmp/codegraph-cjs-ast-f10-f11-before.log EXIT1. Positive explicitcallablealias underunknownparsealreadyPASS beforefix, mustkeep.
+
+F11fix: method_definition suppliesfunctionscope onlywhen calllieswithin ASTbodyorparametersregions. Computednames/decorators useenclosingscope; no newkeyword/punctuation guesses. Bothcomputedkey directionsfixed. F10fix: tokenizer resultrecords evalUnknown separatelyfromuncertain/namespace. Moduleinfo propagatesunknownflag, includingexistingforwarderspread. Themethod-nameguessgate stopsunprovenmatchesforunknown-evalexportswithoutclaimingnamespace/memberabsence; explicitwrittenmemberaliasesremainallowed, andearlierprovenreceiver/typepathsremainunchanged. UnknownASTfactstillnull, no falseparse-success/intrinsicproof. Existingmembertokenizer andfacts/hash/storelifecycleremainunchanged.
+
+Expanded8files172PASS1SKIP EXIT0, /tmp/codegraph-cjs-ast-f10-f11-after.log, CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2. Coversallprevious166checks plusnewcomputed-keyAST/graphcases,optionalcontextualwrapper,realexplicitcallablealiasunderunknownparse,andfreshindex-v-syncincludingknownactualeval->unknownwrapper->actualeval transitions. One skip is nativekerneltransport; nativebinarynotstaged,no nativeexecutionclaim. A matchercommentclarifyingunproven-callpolicyupdatedaftertest; no behaviorchangedafterthispassingrun. gitdiff--checkPASS. No explicitnormalbuild/fullsuite oncurrentcorrection; old10666fullPASSbelongs875only.
+
+Currentcorrectionvsround8snapshot changes5files: ASThelper,exportreader,matcher,ASTtest,graphintegrationtest. Durablebackup originalQA .review/commonjs-fix-2026-11-08/ast-f10-f11-corrected-2026-11-09/ includesall15sourcefiles,currentSHA256,cumulativepatchrelative875,small5filedeltafromround8,fail-before/passafterlogs,verificationmetadata. F10/F11 statusCORRECTED+focusedPASS, NOTindependentlycleared. Overallreviewcount8unchanged,noround9agentslaunched. Userper-stepconfirmationrequiresdecisionbeforefreshfocusedverify; don'tspendnewfull/reviewcycleunasked. No sourcecommit/pushyet; PR28/29remainDRAFT/unmerged. Ifuserapprovesnextreview: exactGitdiff875..workingtree +round8delta/sameledger, freshread-onlynativebroad/adversarial, boundedprobesonly,norepeatfull/build. Respectactualgate/noreset. Runfinalnormalbuild/fullonceonlyafterreviewstable. PreserveT0stopped/uncommitted; liveem40unchanged; noofficialupstreamwrite.
+
+
+## Ninth native focused verification explicitly authorized and running
+
+User answered yes to next focused dualreview. Fresh READONLY review_broad_pr29_f10_f11_9 and review_adversarial_pr29_f10_f11_9 launched together with exact87576a8d..workingtree15path target, thisledger andsmall5filedelta fromround8. Source matches172focusedPASS snapshot except documentedcommentonlychange, hashmatchesdurablecorrectedbackup. BothreviewclaimsremainPENDING; do notclaimclearance. No sourcechanges/build/fullsuite orpublishingauthorized bythisreviewonlyturn. Source staysfrozen; no gate resets/controlchanges. Parentwillgatherbothactualreports,mergefindings/saveandstop.
+
+
+## Ninth native focused verification completed — F10/F11 cleared, F12 remains
+
+User explicitly authorized thisverificationround. Both fresh read-only lanes review_broad_pr29_f10_f11_9 and review_adversarial_pr29_f10_f11_9 COMPLETED normally on same87576a8d..workingtree15path target and sameledger. Source hashes stillmatch approvedcorrectedsnapshot; no sourceedits/rebuild/fullsuite/controlchanges/networkwritesbyreviewers. No sourcecommit/push/merge/deploy. BothpublishedPRsremaindraftunchanged.
+
+F10/F11 originals independently CLEARED by BOTH: optionalcontextualwrapper nofalsecall; computedkeygenuineevalinsideoutergenerator keepsStore::load; generatormethodkeynongeneratorwrapper nofalsecall. Broad11runtime-backedprobesPASS includingclass/nestedcomputedkeys,generator/nongeneratorbodies,explicitcallablealiasunderunknownfactandgenuineevalcontrols. Evidence /tmp/cg-broad-pr29-ast9-verify.{cjs,log}. Adversarial also confirmsnestednongenerator/gettercomputedkeycontrols. ThesecontrolsdoNOTclearrootwhole-valueexportsbelow.
+
+### F12 — P2 — Unknown eval facts suppress genuine root exports (adversarial)
+
+Exact reviewer location src/resolution/name-matcher.ts:25403. Valid m.js:
+
+```js
+class Store { load() { return 42; } }
+module.exports = { load: Store.prototype.load };
+function yield(v) { return function ignored() {}; }
+yield?.(eval)("ignored");
+```
+
+Caller const named=require('./m'); function run(){named.load();}. Runtime named.load() returns42; currentindexcalls:[]. Readerrecordsnomembersfortherootobjectassignment; newevalUnknowngatedropsthegenuinecallablealias. module.exports=new Store() reproduces too. RemovingONLYnewevalUnknownconditioninmemoryrestoresm.js:Store::loadforbothidenticalinputs. Directexports.load=Store.prototype.loadcontrolstillpasses. ThisisNEWregressionintroducedbyF10correction. Evidence /tmp/cg-a9-root-export-regression.cjs, /tmp/cg-a9-root-export-current.log, /tmp/cg-a9-root-export-oldgate.log. Broadclearedlimitedcontrolsbutdidnotprobeequivalentrootexports; no contradictoryexecutionresult.
+
+STOP/reportmergedfindingonly; useryesauthorizedfocuseddualverify, notanotherunaskedcorrectioncycle. OriginalF10/F11closedatthissnapshot; F12OPEN. No finalreviewclearanceorreadyformergeclaim. No explicitnormalbuild/fullsuiteoncurrentdirtyASTcorrection;172focusedPASS1SKIPremainsactualbutmissesF12. Old10666fullPASSbelongs875only. No test/build/reviewerprocessesrunning. Needuserdecisionbeforefix; preserveactualmodule-valueexportswhileblockingunprovedunknown-evalguesses, notanotherpunctuation/keywordheuristic. Overallcount9honest,noreset/gatebypass. Durableevidence/ledger/resultsavedunderoriginalQA .review/commonjs-fix-2026-11-08/pr29-review9-2026-11-09/; current15sourcefilespatchesremainin adjacentast-f10-f11-correctedbackup. T0/liveem40unchanged, noofficialupstreamwrite.
+
+
+## F12 correction approved and focused verification complete — 2026-11-09
+
+User explicitly approved the focused F12 correction after reading the session-end handoff. Existing checkout/HEAD 87576a8d and all 15 dirty source paths preserved; only two source files and their two tests changed from review 9. No commits, pushes, new review, merge, deploy, grammar/schema/dependency or extraction/storage changes.
+
+Added both runtime-backed F12 regressions FIRST: root object callable alias and new Store() under optional yield wrapper return 42 at runtime but graph calls are empty. Actual 2 FAIL / 61 SKIP, /tmp/codegraph-pr29-f12-red.log, exit 1. Expanded pre-fix reader/graph contract: 33 FAIL / 136 PASS, /tmp/codegraph-pr29-f12-matrix-red.log, exit 1.
+
+Reader now records exportForm (namespace/value/opaque) independently from evalState (present/absent/unknown); replaces the prior evalUnknown flag. Explicit members remain property writes, never a whole-value inventory. Any syntactically stated whole module.exports assignment retains existing value resolution; escapes/mixed writes do not erase that evidence or claim a final member inventory. Namespace absence still requires !uncertain. Inconclusive eval only gates unproven method guesses when no stated whole value is present; explicit property aliases and confirmed eval behavior stay intact. Forwarders propagate the summary through existing spread, and existing typeFrom dependencies remain intact.
+
+Tests cover namespace/direct alias/root object/instance x eval absent/present/unknown, direct and forwarded imports; runtime values and typeFrom metadata asserted. Added fresh-v-sync transitions across both axes, bracket/mixed assignments, opaque reader controls; all prior F10/F11 tests retained unchanged.
+
+Actual verification:
+- First two-file green: 169 PASS, /tmp/codegraph-pr29-f12-matrix-green.log, exit 0. Test setup successfully ran tsc + copied assets for current source.
+- Expanded ten-file run after final four bracket/mixed graph tests: 235 PASS / 1 SKIP / 6 FAIL, /tmp/codegraph-pr29-f12-focused.log, exit 1. All six failures were lazy-engine child stdout empty. Independent minimal spawnSync probe reproduced EPERM for piped Node child output even when the child simply prints 42; file output works. No source/test workaround added.
+- Approved sandbox escalation reran ONLY lazy-engine.test.ts outside sandbox: 6 PASS, /tmp/codegraph-pr29-f12-lazy-unsandboxed.log, exit 0.
+- Combined distinct final checks: 241 PASS / 1 SKIP over 10 files. Skip is native-kernel parity (binary not staged); no native execution claim. git diff --check PASS. No final normal npm run build/fullsuite on dirty AST revision; these remain deferred until stable independent review per user handoff. No tests/build/reviewer processes running.
+
+F12 status: CORRECTED + focused verified, NOT independently cleared. Overall review count remains 9; no gate resets or new agents. STOP and ask before fresh focused dual review, as requested. Proposed two-commit structure stays pending; nothing staged/committed/published. PR28/29 draft state not changed. T0/live/deploy/control files untouched.
+
+Durable backup: original QA .review/commonjs-fix-2026-11-08/pr29-f12-2026-11-09/ contains before/after copies of all 15 dirty source files, hashes, cumulative-from-875.patch, f12-correction.patch, actual red/green/failure/rerun logs and verification.json. Plan: /home/ericm/.codex/plans/plan-codegraph-pr29-f12-2026-11-09.md. Next factual checkpoint: /home/ericm/.codex/plans/handoff-codegraph-pr29-f12-focused-2026-11-09.md.
+
+
+## Tenth native focused verification explicitly authorized and running
+
+User answered yes to next focused dual review. Fresh read-only review_broad_pr29_f12_10 and review_adversarial_pr29_f12_10 launched on exact 87576a8d..workingtree target, same ledger and saved four-file F12 delta. All 15 source hashes match focused-tested F12 checkpoint. Both results PENDING. No source changes, rebuild, full suite or publication in this review-only phase. Completed review count remains 9 until results arrive; no resets or gate bypass. Parent will merge actual reports, save checkpoint and stop.
+
+
+## Tenth native focused verification completed — original F12 clears; F12 variants and new F13 remain
+
+User explicitly authorized this focused review. Both fresh read-only lanes review_broad_pr29_f12_10 and review_adversarial_pr29_f12_10 completed normally against exact git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 87576a8d9ff0d8aba235db5535f5f4429f14b037 -- . and the same ledger / saved F12 delta. All 15 source hashes match the focused-tested F12 snapshot. No source edits, rebuild, fullsuite, commits, pushes, merge, deploy or gate reset. Parent merged actual reports without duplicate probes/source re-audit.
+
+Both independently CLEARED original F12 unparenthesized root object/instance, original F10 optional wrapper, and both F11 computed-key directions. Original passing examples do not clear adjacent syntax/scope findings.
+
+### F13 — P2 — Shadowed module writes disable the unknown-eval guard (adversarial)
+
+Exact location src/resolution/commonjs-export-members.ts:75, gate name-matcher.ts:25403. Concrete input:
+
+```js
+exports.known = function known() {};
+function pretend(module) { module.exports = {}; }
+pretend({});
+function yield(v) { return function ignored() {}; }
+yield?.(eval)("ignored");
+```
+
+Caller const named=require('./m'); function run(){named.missing();}, unrelated export class Decoy { missing() {} }. Actual CommonJS exports only known; missing undefined. Current graph incorrectly calls decoy.js:Decoy::missing. Reader records exportForm:value/evalState:unknown from local parameter's module.exports assignment, bypassing unknown-eval guard. Block-local and arrow parameter variants reproduce. Loading both saved pre-F12 source files in memory yields calls[] on identical inputs, proving NEW regression in latest correction. Evidence /tmp/cg-a10-boundary.{cjs,log}, /tmp/cg-a10-before-loader.cjs, /tmp/cg-a10-boundary-before-source.log, /tmp/cg-a10-shadow-runtime.log.
+
+### F12 — P2 — F12 remains for equivalent whole-value assignment syntax (broad)
+
+Exact location src/resolution/commonjs-export-members.ts:75, gate name-matcher.ts:25403. class Store { load() { return 42; } }; (module.exports) = new Store(); function yield(v){return function ignored(){}} yield?.(eval)("ignored"); with named.load() returns42 at runtime but graph calls[]. Reader expects = immediately after module.exports, records opaque and suppresses call. Parenthesized root object and module.exports &&= new Store() reproduce. Removing only optional wrapper restores Store::load. Direct/forwarded imports both fail; fresh/sync agree, removing wrapper during sync restores edge and typeFrom. This is incompletely corrected F12, not a demonstrated NEW regression in latest correction. Broad evidence /tmp/cg-broad-pr29-f12-10.{cjs,log} (28 runtime/graph probes), /tmp/cg-broad-pr29-f12-10-sync.{cjs,log} (12 asserted sync/fresh comparisons).
+
+STOP/report both P2 findings. No fix or new review authorized by this yes-to-review turn. Review count10 completed honestly, no resets. Prior 241 focused PASS /1native SKIP remains actual but misses these cases. No final normal build/fullsuite on dirty AST revision; no native-kernel execution claim. PR28/29 stay draft/unpublished current correction; T0/live/control/deploy files untouched. Sources remain 15 dirty paths on HEAD87576a8d. Preserve checkout and all work.
+
+Durable review evidence: original QA .review/commonjs-fix-2026-11-08/pr29-review10-2026-11-09/ includes broad/adversarial reports, merged-review.md, completed review-status.json, source hashes, scripts/logs, and ledger. F12 before/after source backups/cumulative+delta patches remain adjacent pr29-f12-2026-11-09/. New handoff /home/ericm/.codex/plans/handoff-codegraph-pr29-review10-two-findings-2026-11-09.md.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-review10-2026-11-09/handoff-codegraph-pr29-review10-two-findings-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/history/pr29-review10-2026-11-09/handoff-codegraph-pr29-review10-two-findings-2026-11-09.md
new file mode 100644
index 0000000000..fce52cb282
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-review10-2026-11-09/handoff-codegraph-pr29-review10-two-findings-2026-11-09.md
@@ -0,0 +1,32 @@
+# PR29 focused round10 complete: F12 incomplete + new F13; awaiting decision
+
+
+## Tenth native focused verification completed — original F12 clears; F12 variants and new F13 remain
+
+User explicitly authorized this focused review. Both fresh read-only lanes review_broad_pr29_f12_10 and review_adversarial_pr29_f12_10 completed normally against exact git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 87576a8d9ff0d8aba235db5535f5f4429f14b037 -- . and the same ledger / saved F12 delta. All 15 source hashes match the focused-tested F12 snapshot. No source edits, rebuild, fullsuite, commits, pushes, merge, deploy or gate reset. Parent merged actual reports without duplicate probes/source re-audit.
+
+Both independently CLEARED original F12 unparenthesized root object/instance, original F10 optional wrapper, and both F11 computed-key directions. Original passing examples do not clear adjacent syntax/scope findings.
+
+### F13 — P2 — Shadowed module writes disable the unknown-eval guard (adversarial)
+
+Exact location src/resolution/commonjs-export-members.ts:75, gate name-matcher.ts:25403. Concrete input:
+
+```js
+exports.known = function known() {};
+function pretend(module) { module.exports = {}; }
+pretend({});
+function yield(v) { return function ignored() {}; }
+yield?.(eval)("ignored");
+```
+
+Caller const named=require('./m'); function run(){named.missing();}, unrelated export class Decoy { missing() {} }. Actual CommonJS exports only known; missing undefined. Current graph incorrectly calls decoy.js:Decoy::missing. Reader records exportForm:value/evalState:unknown from local parameter's module.exports assignment, bypassing unknown-eval guard. Block-local and arrow parameter variants reproduce. Loading both saved pre-F12 source files in memory yields calls[] on identical inputs, proving NEW regression in latest correction. Evidence /tmp/cg-a10-boundary.{cjs,log}, /tmp/cg-a10-before-loader.cjs, /tmp/cg-a10-boundary-before-source.log, /tmp/cg-a10-shadow-runtime.log.
+
+### F12 — P2 — F12 remains for equivalent whole-value assignment syntax (broad)
+
+Exact location src/resolution/commonjs-export-members.ts:75, gate name-matcher.ts:25403. class Store { load() { return 42; } }; (module.exports) = new Store(); function yield(v){return function ignored(){}} yield?.(eval)("ignored"); with named.load() returns42 at runtime but graph calls[]. Reader expects = immediately after module.exports, records opaque and suppresses call. Parenthesized root object and module.exports &&= new Store() reproduce. Removing only optional wrapper restores Store::load. Direct/forwarded imports both fail; fresh/sync agree, removing wrapper during sync restores edge and typeFrom. This is incompletely corrected F12, not a demonstrated NEW regression in latest correction. Broad evidence /tmp/cg-broad-pr29-f12-10.{cjs,log} (28 runtime/graph probes), /tmp/cg-broad-pr29-f12-10-sync.{cjs,log} (12 asserted sync/fresh comparisons).
+
+STOP/report both P2 findings. No fix or new review authorized by this yes-to-review turn. Review count10 completed honestly, no resets. Prior 241 focused PASS /1native SKIP remains actual but misses these cases. No final normal build/fullsuite on dirty AST revision; no native-kernel execution claim. PR28/29 stay draft/unpublished current correction; T0/live/control/deploy files untouched. Sources remain 15 dirty paths on HEAD87576a8d. Preserve checkout and all work.
+
+Durable review evidence: original QA .review/commonjs-fix-2026-11-08/pr29-review10-2026-11-09/ includes broad/adversarial reports, merged-review.md, completed review-status.json, source hashes, scripts/logs, and ledger. F12 before/after source backups/cumulative+delta patches remain adjacent pr29-f12-2026-11-09/. New handoff /home/ericm/.codex/plans/handoff-codegraph-pr29-review10-two-findings-2026-11-09.md.
+
+Read handoff-codegraph-pr29-session-end-2026-11-09.md for publication/identity/recovery boundaries. Latest checkpoint supersedes F12-focused review-pending state. User must decide next step; do not start another correction or review automatically. Repeated changes in this block warrant revisiting the evidence boundary rather than adding ad hoc syntax exceptions; no new design has been approved. Existing intended two-commit PR29 structure remains pending. No commits/pushes/merge/deploy or upstream writes authorized.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-review10-2026-11-09/merged-review.md b/docs/handoffs/pr29-2026-11-10/history/pr29-review10-2026-11-09/merged-review.md
new file mode 100644
index 0000000000..4d2ff372c2
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-review10-2026-11-09/merged-review.md
@@ -0,0 +1,47 @@
+# PR29 focused verification round 10 — two P2 findings
+
+Both fresh native read-only lanes completed. User explicitly authorized review only. Exact Git target: git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 87576a8d9ff0d8aba235db5535f5f4429f14b037 -- . Ledger: .review/commonjs-eval-callee-context.md. All 15 source hashes match focused-tested F12 checkpoint. No source changes, build/full suite, commits, pushes, merge, deploy or gate reset.
+
+## F13 — P2 — Shadowed module writes disable the unknown-eval guard (adversarial)
+
+P2 — Shadowed module writes disable the unknown-eval guard. src/resolution/commonjs-export-members.ts:75 treats a local parameter’s assignment as a CommonJS root export:
+
+exports.known = function known() {};
+function pretend(module) { module.exports = {}; }
+pretend({});
+function yield(v) { return function ignored() {}; }
+yield?.(eval)("ignored");
+
+With caller const named=require('./m'); function run(){named.missing();} and unrelated export class Decoy { missing() {} }, actual CommonJS runtime exports only known; missing is undefined. Current graph incorrectly returns calls:["decoy.js:Decoy::missing"]. The reader records exportForm:"value", evalState:"unknown", bypassing the guard at name-matcher.ts:25403. Block-local and arrow-parameter shadowing reproduce.
+
+Loading both saved pre-F12 source files in memory yields calls:[] for identical inputs, confirming this correction introduces the regression.
+
+Evidence: /tmp/cg-a10-boundary.cjs, /tmp/cg-a10-boundary.log, /tmp/cg-a10-before-loader.cjs, /tmp/cg-a10-boundary-before-source.log, /tmp/cg-a10-shadow-runtime.log.
+
+Original F12 object/instance reproducers independently clear: runtime returns 42, graph reaches m.js:Store::load. Original F10 and both F11 directions independently remain cleared.
+
+Read-only preservation confirmed: all 15 source hashes match the checkpoint. No source/control edits, build, full suite, commits, or network writes.
+
+## F12 — P2 — F12 remains for equivalent whole-value assignment syntax (broad)
+
+One P2 finding: F12 remains for equivalent whole-value assignment syntax at src/resolution/commonjs-export-members.ts:75.
+
+class Store { load() { return 42; } }
+(module.exports) = new Store();
+function yield(v) { return function ignored() {}; }
+yield?.(eval)("ignored");
+
+With const named=require('./m'); function run(){named.load();}, runtime returns 42, but graph calls are []. The reader records exportForm:"opaque" because it expects = immediately after module.exports; name-matcher.ts:25403 then suppresses the genuine call.
+
+Removing only the optional wrapper restores m.js:Store::load. (module.exports) = {load:Store.prototype.load} and module.exports &&= new Store() reproduce. Direct and forwarded imports both fail; fresh indexing and sync agree. Removing the wrapper during sync restores the edge and expected typeFrom dependencies. This is an incompletely corrected F12 case, not a demonstrated new regression introduced by the latest patch.
+
+Independently cleared on current dist:
+- Original F12 unparenthesized root object and instance assignments, including forwarded/bracket/mixed controls.
+- F10 optional wrapper: no Decoy::missing edge.
+- Both F11 computed-key directions: real eval retained; wrapper produces no false edge.
+
+Evidence: 28 runtime/graph probes in /tmp/cg-broad-pr29-f12-10.{cjs,log}; 12 asserted sync/fresh comparisons in /tmp/cg-broad-pr29-f12-10-sync.{cjs,log}. Ran with CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2 CODEGRAPH_TELEMETRY=0 node --liftoff-only.
+
+All 15 source/test hashes remain unchanged against /tmp/cg-broad-pr29-f12-10-source-before.sha256. No repository edits, rebuild, full suite, or native-kernel parity claim. Overall F12 clearance remains pending.
+
+Both reviewers independently clear the original F12 unparenthesized object/instance cases, F10 optional wrapper, and both F11 computed-key directions. This does not clear the two cases above. STOP: no fixes or another review without user decision. Final normal build/fullsuite remain deferred; prior 241 focused passes/1native skip do not cover these new findings. Review count 10 completed honestly; no resets.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-review11-2026-11-09/adversarial-artifacts/cg-a11-final-report.md b/docs/handoffs/pr29-2026-11-10/history/pr29-review11-2026-11-09/adversarial-artifacts/cg-a11-final-report.md
new file mode 100644
index 0000000000..7cd5f02b16
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-review11-2026-11-09/adversarial-artifacts/cg-a11-final-report.md
@@ -0,0 +1,64 @@
+# PR29 verify round 11 — adversarial lane
+
+Reviewed exact target `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 87576a8d9ff0d8aba235db5535f5f4429f14b037 -- .`, focusing the nine-file shared production export-evidence integration delta. Read-only source; no edits, build, full suite, commits, publication, gate/ledger changes, or native-kernel claim.
+
+## P2 — Do not emit calls to exported non-callable values
+
+Location: `src/resolution/import-resolver.ts:3430` (positive member return), with evidence classification at `src/resolution/commonjs-export-evidence.ts:148-156` and declaration acceptance at `:309-313`.
+
+Complete failing two-file fixture:
+
+```js
+// m.js
+const value=42; exports.load=value;
+// use.js
+const named=require('./m');function run(){return named.load();}module.exports=run;
+```
+
+Runtime: executing `require('./use.js')()` throws `TypeError: named.load is not a function`.
+
+Current real CodeGraph index: `use.js:run` has a `calls` edge to `m.js:value`, whose node kind is `constant`. It is data, not a callable declaration. The collector follows its initializer only for selected expression kinds, then falls through to a `kind:'value'` selector for the numeric variable declaration; the import resolver returns the selected constant directly for a `calls` reference. Thus a positive data-export relationship becomes an invented call target. This is a new integration regression: the exact before-integration import resolver/name matcher, loaded in memory on identical fixtures, has `calls:[]`.
+
+Second complete m.js variant (same use.js):
+
+```js
+const value="payload";module.exports={load:value};
+```
+
+Same runtime TypeError, current `calls:[m.js:value]` (constant), before `calls:[]`.
+
+Callable assignment supporting variant (same use.js):
+
+```js
+function real(){return 42;}let value;value=real;exports.load=value;
+```
+
+Runtime returns42. Current graph calls the uninitialized `m.js:value` variable rather than callable `m.js:real`; before has no target. This illustrates the same declaration fallback and does not add another finding. Preserve legitimate data import/reference relationships while withholding unsupported call identity.
+
+## Original-case clears
+
+Executed runtime-backed real-index controls in `/tmp/cg-a11-evidence-probe.cjs`:
+
+- F12 parenthesized instance, parenthesized object, and `module.exports &&= new Store()` under optional `yield?.(eval)("ignored")`: runtime42; all graph calls exactly `m.js:Store::load`.
+- F13 function parameter, arrow parameter and block-local `module` writes: runtime exports only `known`; graph calls empty, no Decoy.missing.
+- F10 optional wrapper: only `known`, calls empty.
+- F11 real eval in ordinary computed method key inside outer generator: runtime42, Store::load; generator method key in surrounding nongenerator wrapper context: only known, calls empty.
+- Shorthand callable alias and literal-eval local alias: runtime42, Store::load. Whole relative forwarding fixture: runtime42, graph calls impl.js:load. Named default callable function: runtime42, graph calls m.js:load.
+
+Additional uninvoked binding-reassignment, member-forwarding and alias escape gaps were compared against the before integration and also fail there. They are excluded as pre-existing gaps, with no new finding claimed.
+
+## Replay and evidence
+
+Commands ran directly with `CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2 CODEGRAPH_TELEMETRY=0 node --liftoff-only <script>`; real SQLite/temp projects, runtime `require` evaluation, current frozen dist. No test/build invoked.
+
+New defect standalone replay: `/tmp/cg-a11-values.cjs`; current output `/tmp/cg-a11-values-current.log`, structured `/tmp/cg-a11-values-current.json`.
+Before replay: `/tmp/cg-a11-before-values-loader.cjs` with `CG_RESULTS=/tmp/cg-a11-values-before.json`; output `/tmp/cg-a11-values-before.log`, structured `/tmp/cg-a11-values-before.json`.
+Baseline loader uses the saved round10 name matcher from the integration `before/` directory. The import resolver was unchanged before integration, so its exact `87576a8d` source was read with `git show` into `/tmp/cg-a11-before-import-resolver.ts`. Loader transpiles those two files in memory, changing no repo files.
+
+Original cases script/log/results: `/tmp/cg-a11-evidence-probe.cjs`, `/tmp/cg-a11-evidence-probe.log`, `/tmp/cg-a11-evidence-results.json`.
+Filtered gap baseline: `/tmp/cg-a11-before-loader.cjs`, `/tmp/cg-a11-before.log`, `/tmp/cg-a11-before-results.json`.
+Forwarding/alias supporting controls: `/tmp/cg-a11-forward-probe.cjs`, `/tmp/cg-a11-forward-current.{log,json}`, `/tmp/cg-a11-before-forward-loader.cjs`, `/tmp/cg-a11-forward-before.{log,json}`.
+
+Replay dependencies: this frozen checkout's dist/, node_modules/, TypeScript package; baseline source file `/tmp/cg-a11-before-import-resolver.ts`; saved `before/src/resolution/name-matcher.ts` under `/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-export-evidence-integration-2026-11-09`; checkpoint `source-sha256.json` in that same backup. For durable backup copy these scripts/logs/JSON, baseline import resolver source and the saved before name matcher. Temp fixture directories were cleaned by scripts.
+
+Initial 22-source hash check passed with mismatches[]. Final check stored separately in `/tmp/cg-a11-source-hash-check.json`. No remaining processes or further probes planned.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-review11-2026-11-09/adversarial-report.md b/docs/handoffs/pr29-2026-11-10/history/pr29-review11-2026-11-09/adversarial-report.md
new file mode 100644
index 0000000000..7cd5f02b16
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-review11-2026-11-09/adversarial-report.md
@@ -0,0 +1,64 @@
+# PR29 verify round 11 — adversarial lane
+
+Reviewed exact target `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 87576a8d9ff0d8aba235db5535f5f4429f14b037 -- .`, focusing the nine-file shared production export-evidence integration delta. Read-only source; no edits, build, full suite, commits, publication, gate/ledger changes, or native-kernel claim.
+
+## P2 — Do not emit calls to exported non-callable values
+
+Location: `src/resolution/import-resolver.ts:3430` (positive member return), with evidence classification at `src/resolution/commonjs-export-evidence.ts:148-156` and declaration acceptance at `:309-313`.
+
+Complete failing two-file fixture:
+
+```js
+// m.js
+const value=42; exports.load=value;
+// use.js
+const named=require('./m');function run(){return named.load();}module.exports=run;
+```
+
+Runtime: executing `require('./use.js')()` throws `TypeError: named.load is not a function`.
+
+Current real CodeGraph index: `use.js:run` has a `calls` edge to `m.js:value`, whose node kind is `constant`. It is data, not a callable declaration. The collector follows its initializer only for selected expression kinds, then falls through to a `kind:'value'` selector for the numeric variable declaration; the import resolver returns the selected constant directly for a `calls` reference. Thus a positive data-export relationship becomes an invented call target. This is a new integration regression: the exact before-integration import resolver/name matcher, loaded in memory on identical fixtures, has `calls:[]`.
+
+Second complete m.js variant (same use.js):
+
+```js
+const value="payload";module.exports={load:value};
+```
+
+Same runtime TypeError, current `calls:[m.js:value]` (constant), before `calls:[]`.
+
+Callable assignment supporting variant (same use.js):
+
+```js
+function real(){return 42;}let value;value=real;exports.load=value;
+```
+
+Runtime returns42. Current graph calls the uninitialized `m.js:value` variable rather than callable `m.js:real`; before has no target. This illustrates the same declaration fallback and does not add another finding. Preserve legitimate data import/reference relationships while withholding unsupported call identity.
+
+## Original-case clears
+
+Executed runtime-backed real-index controls in `/tmp/cg-a11-evidence-probe.cjs`:
+
+- F12 parenthesized instance, parenthesized object, and `module.exports &&= new Store()` under optional `yield?.(eval)("ignored")`: runtime42; all graph calls exactly `m.js:Store::load`.
+- F13 function parameter, arrow parameter and block-local `module` writes: runtime exports only `known`; graph calls empty, no Decoy.missing.
+- F10 optional wrapper: only `known`, calls empty.
+- F11 real eval in ordinary computed method key inside outer generator: runtime42, Store::load; generator method key in surrounding nongenerator wrapper context: only known, calls empty.
+- Shorthand callable alias and literal-eval local alias: runtime42, Store::load. Whole relative forwarding fixture: runtime42, graph calls impl.js:load. Named default callable function: runtime42, graph calls m.js:load.
+
+Additional uninvoked binding-reassignment, member-forwarding and alias escape gaps were compared against the before integration and also fail there. They are excluded as pre-existing gaps, with no new finding claimed.
+
+## Replay and evidence
+
+Commands ran directly with `CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2 CODEGRAPH_TELEMETRY=0 node --liftoff-only <script>`; real SQLite/temp projects, runtime `require` evaluation, current frozen dist. No test/build invoked.
+
+New defect standalone replay: `/tmp/cg-a11-values.cjs`; current output `/tmp/cg-a11-values-current.log`, structured `/tmp/cg-a11-values-current.json`.
+Before replay: `/tmp/cg-a11-before-values-loader.cjs` with `CG_RESULTS=/tmp/cg-a11-values-before.json`; output `/tmp/cg-a11-values-before.log`, structured `/tmp/cg-a11-values-before.json`.
+Baseline loader uses the saved round10 name matcher from the integration `before/` directory. The import resolver was unchanged before integration, so its exact `87576a8d` source was read with `git show` into `/tmp/cg-a11-before-import-resolver.ts`. Loader transpiles those two files in memory, changing no repo files.
+
+Original cases script/log/results: `/tmp/cg-a11-evidence-probe.cjs`, `/tmp/cg-a11-evidence-probe.log`, `/tmp/cg-a11-evidence-results.json`.
+Filtered gap baseline: `/tmp/cg-a11-before-loader.cjs`, `/tmp/cg-a11-before.log`, `/tmp/cg-a11-before-results.json`.
+Forwarding/alias supporting controls: `/tmp/cg-a11-forward-probe.cjs`, `/tmp/cg-a11-forward-current.{log,json}`, `/tmp/cg-a11-before-forward-loader.cjs`, `/tmp/cg-a11-forward-before.{log,json}`.
+
+Replay dependencies: this frozen checkout's dist/, node_modules/, TypeScript package; baseline source file `/tmp/cg-a11-before-import-resolver.ts`; saved `before/src/resolution/name-matcher.ts` under `/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-export-evidence-integration-2026-11-09`; checkpoint `source-sha256.json` in that same backup. For durable backup copy these scripts/logs/JSON, baseline import resolver source and the saved before name matcher. Temp fixture directories were cleaned by scripts.
+
+Initial 22-source hash check passed with mismatches[]. Final check stored separately in `/tmp/cg-a11-source-hash-check.json`. No remaining processes or further probes planned.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-review11-2026-11-09/broad-report.md b/docs/handoffs/pr29-2026-11-10/history/pr29-review11-2026-11-09/broad-report.md
new file mode 100644
index 0000000000..663a5072c9
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-review11-2026-11-09/broad-report.md
@@ -0,0 +1,62 @@
+# PR29 round11 — broad read-only verify
+
+Exact target: `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 87576a8d9ff0d8aba235db5535f5f4429f14b037 -- .`
+Ledger: `/tmp/codegraph-cjs-missing-fix-20261108/.review/commonjs-eval-callee-context.md`, latest shared-production-evidence section plus previous rulings. Integration delta reviewed; no unrelated parent re-audit.
+
+## Finding — P2: Preserve explicit property aliases on a whole exported local value
+
+Location: `/tmp/codegraph-cjs-missing-fix-20261108/src/resolution/commonjs-export-evidence.ts:226`.
+
+The new collector discards assignments whose left receiver is a local value rather than the wrapper's module/exports bindings. Later `membersOf` enumerates the local value's compiler type, which in this wrapped program does not contain these assigned properties. Therefore a statically explicit callable alias disappears when its containing object/class/function is exported whole. The production import resolver now requires a positive record member at import-resolver.ts:3429 and the fallback guard blocks the old path, so this is an introduced loss of a correct call relationship, not a request to restore global guesses.
+
+Concrete valid `m.js`:
+
+```js
+class Store { load() { return 42; } }
+const api = {};
+api.load = Store.prototype.load;
+module.exports = api;
+```
+
+`use.js`:
+
+```js
+const named = require('./m');
+function run() { return named.load(); }
+module.exports.run = run;
+```
+
+Actual runtime: `named.load()` returns 42. Current collector: defaults points to api, members `{}`, unknown false. Current real CodeGraph graph: calls `[]`. With only the two pre-integration production resolver files loaded from saved source in memory, identical source/runtime yields calls `[{target:"m.js:Store::load",typeFrom:["m.js"]}]`.
+
+The same fail-after/pass-before is independently reproduced for `class Factory {}; Factory.load = Store.prototype.load; module.exports = Factory`, and for `function Factory() {}; Factory.load = Store.prototype.load; module.exports = Factory`. The directly exported object-literal shorthand control continues to resolve with the new collector. This requires preserving the binding-owned property-write relationship in the record; unknown/completeness must not authorize a method-name guess.
+
+Evidence: `cg-broad-pr29-evidence11-expando.cjs` with current and before logs (object/class variants); `cg-broad-pr29-evidence11-factory.cjs` with current and before logs (function variant named function-alias). Both commands exited 0. Runtime is executed with vm against the exact fixture source and graph comes from existing dist via real CodeGraph.init/SQLite/tree-sitter. Logs are observations, not a test-suite pass claim.
+
+Baseline attribution: before-loader transpiles the saved round10 name-matcher.ts and import-resolver.ts from base875 into their existing dist module slots in memory. Import-resolver was unchanged before this integration; round10 had only the prior15 dirty paths. All other current modules remain loaded. No disk source/build mutation occurs. Both exact replacement sources are included in artifacts.
+
+## Independently cleared originals and bounded checks
+
+- F10 original optional `yield?.(eval)("ignored")` wrapper: runtime has only known, graph missing calls `[]`; ast replay asserts it.
+- F11 both original directions: genuine direct eval in an ordinary computed method key inside outer generator resolves m.js:Store::load and runtime42; generator method key in outer nongenerator wrapper produces no missing edge. The asserted 11-case ast replay additionally passes class/nested keys and body/eval controls.
+- F12 original root object/instance and round10 parenthesized/bracket/logical forms: 28-case original replay records genuine m.js:Store::load directly and through forwarders while missing controls remain empty. New 12 asserted sync/fresh comparisons pass across parenthesized object/instance and logical instance, wrapper add/remove, direct/forwarded paths. typeFrom includes m.js or index.js+m.js as appropriate.
+- F13 original parameter/block/arrow module shadowing: runtime missing is undefined; current graph calls `[]` for each, recorded in evidence11.log. The local module assignments do not contribute defaults/members.
+- Declared callable aliases through object shorthand, normal properties and arrow variables resolve correctly in the new record. Existing direct named inline default callable also resolves.
+- Loading existing dist library and shared helper without analysis yielded compilerLoaded:false.
+- git diff --check ran successfully. All22 current tracked source/test/package hashes match the provided final integration source-sha256.json; preservation JSON included.
+
+Other exploratory missing edges were not reported: the same behavior existed before integration, or the old graph selected an unrelated decoy. The mixed import experiment is excluded from runtime conclusions because its exploratory VM step removed the import rather than executing an actual module transpilation.
+
+## Replay and durable dependencies
+
+All report scripts/logs and exact pre-integration replacement sources are in `/tmp/cg-broad-pr29-evidence11-artifacts/`. Copy that whole directory plus this report for durable evidence. `before-loader.cjs` resolves both copied baseline sources relative to itself.
+
+From a preserved checkout with current dist and installed dependencies:
+
+```bash
+CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2 CODEGRAPH_TELEMETRY=0 node --liftoff-only /tmp/cg-broad-pr29-evidence11-artifacts/cg-broad-pr29-evidence11-expando.cjs
+CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2 CODEGRAPH_TELEMETRY=0 node --liftoff-only -r /tmp/cg-broad-pr29-evidence11-artifacts/before-loader.cjs /tmp/cg-broad-pr29-evidence11-artifacts/cg-broad-pr29-evidence11-expando.cjs
+```
+
+For function variant, substitute cg-broad-pr29-evidence11-factory.cjs in both commands and inspect function-alias. Original controls replay with cg-broad-pr29-f12-10.cjs, cg-broad-pr29-ast9-verify.cjs, cg-broad-pr29-evidence11.cjs, cg-broad-pr29-evidence11-sync.cjs. All scripts hardcode the exact reviewed checkout. Runtime needs Node with node:sqlite and --liftoff-only, installed TypeScript5.9.3, current compiled dist and copied grammar WASMs. The before loader additionally needs the two included TS snapshots and uses transpileModule in memory only. Original snapshot pathname remains in a harmless unused loader constant; replacement lookup uses __dirname.
+
+No native parity claimed: binary absent; CODEGRAPH_KERNEL=0. No build/fullsuite/npm test run by this reviewer. No source, ledger, gate, control files, commits, staging, pushes or network writes. Only /tmp scripts/logs/report and disposable fixture directories were written. All spawned probe processes completed and temp fixture projects were removed.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-review11-2026-11-09/commonjs-eval-callee-context.md b/docs/handoffs/pr29-2026-11-10/history/pr29-review11-2026-11-09/commonjs-eval-callee-context.md
new file mode 100644
index 0000000000..2bc6426d67
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-review11-2026-11-09/commonjs-eval-callee-context.md
@@ -0,0 +1,243 @@
+# Separate F8 follow-up (review round count remains six)
+
+User explicitly authorized committing/pushing current work to a PR and separating remaining correction. Current snapshot committed5d384989957c91b482068b306535437915a0595b, pushed fix/commonjs-missing-member, DRAFT https://github.com/inth3shadows/codegraph/pull/28 against main. KnownF8 documented, not ready to merge alone. No deploy/merge/upstream report.
+
+New branch fix/commonjs-eval-callee-context based on5d384989. Exact prospective Git target: git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5d384989957c91b482068b306535437915a0595b -- src/resolution/commonjs-export-members.ts __tests__/commonjs-export-members.test.ts __tests__/js-default-binding-members.test.ts
+
+F8 reviewer finding and prior invariants remain in .review/commonjs-missing-member.md; do not reset shared gate/round count. Two sixth reviewers completed; broad demonstrated F8 despite adversarial clearing intended F7 cases. This follow-up has NOT had independent dual review yet.
+
+Correction: distinguish grouping around bare eval from another function's argument list using token before parentheses. Wrapper identifier/call/member/optional-call/tag/control-condition prefixes must not mark exports uncertain. Grouped direct eval, literal/template arguments and expression prefixes such as return must keep prior behavior. Change limited to9helper lines plus independent unit and real-index graph regressions; no matcher/sync/scope changes.
+
+Before fix8FAIL92PASS; tag-result additional case1FAIL49PASS. Final focused2files101PASS, /tmp/codegraph-cjs-eval-followup-focused.log. Build/full pending. Hashes /tmp/codegraph-cjs-followup-frozen.json. Logs /tmp/codegraph-cjs-eval-followup-{before,tag-before,focused,build}.log. Need staged exact3-file diff, personal repo/identity and actual build result before commit/push. Full normal suite required before readiness claim. Keep follow-up draft and explicitly state review pending. No additional reviewer agents launched in this follow-up; user plans to point agents at PRs.
+
+Keep both PRs draft. Follow-up base should be fix/commonjs-missing-member, producing only the small correction diff. Review/merge follow-up into parent branch before considering parent PR for main; no merge authorized by current request. Preserve original T0 pilot and all deploy/control worktrees.
+
+Published DRAFT https://github.com/inth3shadows/codegraph/pull/29, commit87576a8d9ff0d8aba235db5535f5f4429f14b037, base fix/commonjs-missing-member/PR28 at5d384989. Explicit buildPASS; normal full suite RUNNING session62594, /tmp/codegraph-cjs-eval-followup-full.log. Both pushed/draft, neither merged/deployed; follow-up independent review stillpending. Original T0 untouched.
+
+
+FINAL execution verification2026-11-09: normal full suite session62594 EXIT0,873filesPASS19SKIP,10666testsPASS2expectedFAIL448SKIP0unexpectedFAIL,800.20sec. /tmp/codegraph-cjs-eval-followup-full.log. 101focusedPASS and explicit buildPASS on same87576a8dsource. Final3changed-file SHA256 checks PASS, trackedtreeclean; actual remoteheads rechecked5d384989(PR28) and87576a8d(PR29). PR29 body updated with exact final validation. Both PRs still DRAFT/unmerged; no deployment/upstream write. FOLLOW-UP INDEPENDENT REVIEW STILL PENDING: do not conflate fullsuite with review clearance. No further tests/build/review processes running. Saved final checkpoint and full log under original QA two-draft-prs backup.
+
+
+## Seventh native review explicitly requested — PR29 — 2026-11-09
+
+User invoked /dual review29. Exact GitHub base5d384989957c91b482068b306535437915a0595b and head87576a8d9ff0d8aba235db5535f5f4429f14b037 verified. Fresh read-only native lanes review_broad_pr29_round7 and review_adversarial_pr29_round7 launched together with same exact Git target and this ledger. Both focus full3-file29-line correction, F8 closure and nearby invariants; bounded execution probes only, no repeat full/build or source edits. Parent does not reread reviewed diff or duplicate reviewer probes. No review results yet; no independent clearance claim. Do not reset round count/gate, change source, push, merge or deploy in this review-only turn. Stop and report merged findings when both complete.
+
+
+## Seventh native dual review result — PR29 — 2026-11-09
+
+Both fresh read-only lanes completed normally: review_broad_pr29_round7 and review_adversarial_pr29_round7. Exact target remains5d384989957c91b482068b306535437915a0595b..87576a8d9ff0d8aba235db5535f5f4429f14b037. Source hashes verified unchanged, trackedtreeclean except private untracked.review. No source edits/build/fullsuite reruns/commits/pushes/GitHubcomments/merge/deploy. Both PRs remain draft. Current review DOES NOT CLEAR PR29 despite prior101focusedPASS/full10666PASS/buildPASS. Parent merges findings from actual final reports without re-verifying/re-reading diff.
+
+### F9 — P2 — Preserve grouped direct eval in control-statement bodies (BOTH)
+
+Broad location src/resolution/commonjs-export-members.ts:31: rejects any preceding ), including a completed if or for condition. Exact input `class Store { load() { return 42; } }
+if (true) (eval)('exports.load = Store.prototype.load;');`. Runtime exports load() returning42, but current discovery uncertain:false and indexing named.load() produces no call. Removing only new prefix guard in memory restores uncertain:true and m.js:Store::load. Nested grouped eval in unbraced single-iteration for body reproduces too. Broad evidence /tmp/cg-broad-pr29-control-context.{cjs,log}; exact command `node --experimental-wasm-exnref --experimental-wasm-stack-switching /tmp/cg-broad-pr29-control-context.cjs`.
+
+Adversarial independently confirms same location/trace; grouped-template if-body and for-body also reproduce. Evidence /tmp/codegraph-cjs-adversarial7-conditional-eval.{cjs,log}. De-duplicated as one P2 F9. This is a NEW regression introduced in PR29, not a pre-existing parent limitation.
+
+### F8 — P2 — PARTIALLY CORRECTED, remains for contextual-keyword wrapper names (adversarial)
+
+Exact reviewer location src/resolution/commonjs-export-members.ts:29 (whitelist:7). Valid CommonJS `function await(value){return function ignore(code){};} await(eval)("ignored");` passes eval without invoking it, but whitelist exemption produces uncertain:true and falsely resolves named.missing() to decoy.js:Decoy::missing. With exports.known=function known(){}, runtime exports only known; pre-F7 behavior restored in memory produces no call. yield reproduces too. Evidence /tmp/codegraph-cjs-adversarial7-contextual-wrapper.{cjs,log}. This is a RESIDUAL F8 variant, not a new unrelated parent re-audit. Do not label all F8 closed.
+
+### Confirmed preservation / rulings
+
+Both independently clear original F8 forms wrap(eval)("ignored") and wrap((eval))(("ignored")): runtime onlyknown, reader uncertain:false, no decoy call. Broad /tmp/cg-broad-pr29-f8-closure.{cjs,log}. Adversarial13runtime-backed graph controls pass (original2forms +11nearby controls), /tmp/codegraph-cjs-adversarial7-controls.log. True standalone grouped/template eval, return expressions, inert data/method declarations, call/member/optional/tag/condition-prefix negatives retain tested behavior. These controls do not answer F9 control-body context or F8 await/yield wrappers.
+
+### Next boundary
+
+Review-only user request is complete. STOP: no fixes, additional review loop, external review comment, markready, merge or deploy without user instruction. The per-step confirmation request remains in force. This is round7 overall; no gate/state reset. Repeated grouping-prefix patches now demonstrate syntax-context ambiguity: if user asks for remediation, choose an evidence-based smaller boundary/design instead of another unbounded keyword/punctuation whitelist. Preserve both concrete repros and all prior controls. Do not repeat fullsuite/build on unchanged source. Actual durable result/evidence/checksums saved in original QA .review/commonjs-fix-2026-11-08/pr29-review-round7-2026-11-09/.
+
+
+## AST redesign approved and started — 2026-11-09
+
+User explicitly approved AST redesign in PR29, said near usage max and asked for a resumable start, then said proceed. This revokes prior review-only stop for in-scope remediation; do not ask same approval on resume. Preserve per-step/user and actual gate boundaries for later merges/deployments. No grammar/runtime/dependency/database-schema changes, commits or pushes in this partial phase; PRs remain draft at prior heads.
+
+Newgraph regressions FIRST:3control-body direct-eval variants(if string/template, for nestedgroups) +await/yield CommonJS wrappers,5FAIL51SKIP on current87576a8d. /tmp/codegraph-cjs-ast-red.log, EXIT1. This intentionally RED gate remains unchanged because integration pending.
+
+New isolated src/extraction/commonjs-eval.ts reads existing SyntaxNode tree and checks actual call.function after unwrapping parenthesized_expression. Returns true for syntacticdirectevalcall(anyargument), false for provenabsence, null for parseerrors with no foundcall. New __tests__/commonjs-eval.test.ts loads existingJS/TS/TSXgrammars:33PASS, /tmp/codegraph-cjs-ast-helper.log EXIT0. Controls cover reports, grouped/interpolated eval, return, generatorfunctions/methods, nestednongenerator scope, eval inside yieldwrapper argument, inert data/methods/membercalls, JSX and malformedsource. Helper not wired to classifier/extraction yet. Existing lexical reader/EXPRESSION_PREFIX_WORDS unchanged for now. Do not claim F8/F9 closed, new full/buildpass or finalreview.
+
+IMPORTANT new evidence: existingJSgrammar correctly models control-body eval and awaitwrapper but parses legal CommonJS yield(eval)(code) as yield_expression whose operand is a call on(eval), no parseerrors. ASTscope must distinguish nongeneratorwrapper from generator yield. Helper handles direct yieldoperand only via nearestfunction/generator/methodscope; nested true eval in yield(eval(code)) remains detected. Shapeprobe /tmp/codegraph-cjs-ast-shape-probe.{cjs,log}. Extractionreferenceprobe /tmp/codegraph-cjs-eval-reference-probe.{cjs,log} shows currentextractor emits callref eval for genuinecall AND synthetic yieldwrappercase. Consequently raw existing unresolved eval refs alone are insufficient. User was explicitly told this grammar limitation, not falsely assured all cases are parser-perfect. No grammarfiles changed.
+
+Next integrate factualcallresult through existingextraction to resolver. Node has NO metadata field (onlyedges do); do not invent Node.metadata, abuse signature/selfedges/candidates, or introduce schema migration casually. ExtractionResult can carry optionalfact through workerclone; need native/deferred bypass parity. Main bulk parse pools only load grammars in workers; resolver cannot assume synchronous getParser is ready in main. Suggested project_metadata perfile/sourcehash transport or another small explicit extractioncontext capability; persist/refresh under same successfulstore lifecycle, cover storeworker and sync. Decide carefully before editing infrastructure. Resume must preserve all existing tests and5newred cases; unknown/missing/error facts must not masquerade as provenabsence. Keep existing export-member tokenizer and previous sync/scope/alias fixes intact; remove prefixheuristics only onceASTfacts actuallysupplied.
+
+Saved current3sourcefiles, patchrelative87576a8d, hashes, red/green/probe logs under original QA .review/commonjs-fix-2026-11-08/ast-redesign-started-2026-11-09/. No tests/build/reviewers running at checkpoint. Newfiles intent-to-add only so diffincludes them, not readyforcommit. No fresh dualreviewagents this phase. Overall reviewcount7; do not reset gate/controlstate. Resume directly integration and targeted tests; fullsuite/build only after stablefix, fresh focuseddual review as authorized/actualgatepermits, no repetitivewholeprojectwork. OriginalT0stillstopped/uncommitted; liveem40 unchanged; no merges/deploy/upstream writes.
+
+
+## AST integration execution-tested — verify round8 pending
+
+User approved AST redesign with focused review before final fullsuite, then resumed. Current dirty correction target87576a8d..workingtree,15paths captured /tmp/codegraph-cjs-ast-frozen.json (allnewfilesintent-to-add). No sourcecommit/pushyet; publishedPR29still87576a8d. No grammar/runtime/dependency/schema changes.
+
+Implemented AST fact in ExtractionResult and ephemeralFileRecord property; WASM computes from existingtree, native/deferred routes compute with existinggrammar; kernelmaterializer preservesfact. Allstorepaths carryFileRecord fact through existingwriter, upsertFile writes project_metadata commonjs_eval:<file> containingcontentHash/value. Nosecondwriter orNode.metadata. deleteFile removesfact. Coordinatorcontext acceptsboolean onlyonexact SHA256sourcehash. Missing/malformed/stale/nullfacts returnunknown, neverabsenceproof. Tokenreader removed literalEvalCall/EXPRESSION_PREFIX_WORDS, consults lazyASTfact atmostonceonlywhenbareevaltokenpresent; unknown staysconservative. Existingmembertokenizer/sync/typeFrom/scope unchanged. CHANGELOG alreadyrequiresre-indexafterupgrading(line56), which suppliesnewfacts; no legacyfactmigrationclaimed.
+
+Original5newgraphregressionsRED5FAIL51SKIP beforeintegration. Initialintegratedrun blocked by compiler: hashContentisexportedfromextraction/index, notutils; corrected byusingexistingcreateHashcrypto inresolver (sameSHA256algorithm), no circularextractionimport. Then3files140PASS. AddedrealSQLite factlifecycle4cases(missing/malformed/null, hashstale/replace,rollbackwithfiletransaction, deletion) andfreshindex-vs-sync wrapper->if-eval->yield-wrapper->for-eval->wrapper sequence. Final8files166PASS1SKIP, /tmp/codegraph-cjs-ast-expanded.log, CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2; alsoincludesmemo/synccaches/lazy-engine. Nativebinarynotstaged(codegraph-kernel/prebuilds/linux-x64/codegraph-kernel.node absent); kerneltransporttestskipped. Do not claimnativeexecution. Enginecompiledbytestsetup,currentdistmatchesfrozen sources. No explicitfinalnormalbuild/fullsuiteorindependentreviewyet. Priorfull10666PASSbelongs87576a8donly.
+
+Next eighthfreshnativeREADONLYlanes verify this correction, sameledger andexactGitdiff87576a8d..workingtree. Boundedruntimeprobes only, no fullsuite/build orsourcechanges. CheckF8/F9closure,generator-awareyieldworkaround, actualevalvswrappercallee, sourcehashfactlifecycle/workertransport/sync, previouscontrols. Do not re-audit unrelatedparentlimitations. Stop/reportifreviewfindsissues; do notresetgate/count orclaimClaude-onlyskill.
+
+
+## Eighth native review COMPLETED — AST correction NOT CLEARED
+
+Both fresh read-only reviewers completed normally on frozen15-file87576a8d..workingtree correction. Both confirm no source edits/build/full reruns/control changes; source hashes unchanged. No final normalbuild/fullsuite run or commit/push. PublishedPR28/29 remain drafts at5d384989/87576a8d. Prior166focusedPASS1SKIP is true and covers original5reportedgraphcases, but does not clear new findings. Nativebinary absent, no nativeexecutionclaim. Parent uses actual reports, no independent duplicate repro/diffread.
+
+### F10 — P2 — Optional contextual-keyword wrappers regress (adversarial)
+
+Exact reviewer location src/extraction/commonjs-eval.ts:37. Valid CommonJS:
+
+```js
+exports.known = function known() {};
+function yield(value) {
+  return function ignore(code) {};
+}
+yield?.(eval)("ignored");
+```
+
+Runtime exports only known; eval is never invoked. Existing grammar reports parse error, helper returns null, reader marks exports uncertain, and named.missing() falsely calls unrelated decoy.js:Decoy::missing. Actual current correction calls:[decoy.js:Decoy::missing]; base87576a8dreader restored in memory calls:[], uncertain:false. Evidence /tmp/cg-a8-yield-optional.{cjs,log}, /tmp/cg-a8-yield-optional-base.{cjs,log}, /tmp/cg-a8-probe.cjs. New F8-adjacent regression introduced by AST correction. Unknown fact correctly avoids false absence proof but must not license false call targets; current fallback still does.
+
+### F11 — P2 — Computed method names use enclosing scope (broad)
+
+Exact reviewer location src/extraction/commonjs-eval.ts:51. Treats a computed method name as belonging to that method's function scope. Computed names execute in enclosing scope. Confirmed both directions:
+
+1. `class Store { load(){return 42;} } function* setup(){ const obj = { [yield (eval)('exports.load = Store.prototype.load;')]() {} }; } setup().next();` Runtime exports load()->42, currentfactfalse/uncertainfalse, named.load() graphcalls[]. Ordinary computedmethodkey inside outergenerator suppressesgenuineeval.
+2. `exports.known=function known(){}; function yield(value){return function ignore(code){return 'x';}} const obj={ *[yield(eval)("ignored")](){} };` Runtime keysonlyknown, currentfacttrue/uncertaintrue, named.missing() falselycallsDecoy::missing. Generator methodkeyevaluatesoutsidegeneratorbody, so yieldiswrapperhere.
+
+One rootcause/twoexecutiontraces, evidence /tmp/cg-broad-pr29-ast8-computed-scope.{cjs,log}, executed againstcurrentdist with CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2. All15frozenhashesmatch.
+
+### Stop boundary and saved state
+
+Approved redesign progressed to166focusedPASS + real-worker/store/sync/factlifecycle integration, then focusedverifyfoundthese2P2. STOP before anothercorrectioncycle per dual-reviewworkflow/userper-stepconfirmation. Don't spendfullsuiteonknowndefectivecode orpushasready. Usermustdecidenextstep; noautomaticnewreview/fix/merge/deploy. Overallcount8, noreset. Nextremediationifapproved: computedmethodscope must excludecomputedkeys fromnewmethodscope; parseerrorunknown mustnotenableinventedfallbackcalls (requires explicitresolutionpolicy, not anotherkeyword/punctuationguess). Preserve all originalregressions and33ASTcontrols, truealiases/sync/scope/Pythonbehavior. No grammarfiles/schema/deps changed; source remains15dirtypaths, notcommitted. Durablebackup includes allsources/patch/logs andnewreviewevidence, verificationresult/checksums.
+
+
+## F10/F11 corrections approved and execution-verified — independent verification pending
+
+User explicitly answered yes to correcting the two eighth-review findings. Current HEAD87576a8d and15dirtysourcepaths retained; no newcommit/push/merge/deploy/grammar/schema/dependencychanges.
+
+Fail-beforetests:2ASTcomputed-key cases,3graphfindingcases,positivealiascontrol andunknownparse syncstep. Actual2files6FAIL90PASS beforefix, /tmp/codegraph-cjs-ast-f10-f11-before.log EXIT1. Positive explicitcallablealias underunknownparsealreadyPASS beforefix, mustkeep.
+
+F11fix: method_definition suppliesfunctionscope onlywhen calllieswithin ASTbodyorparametersregions. Computednames/decorators useenclosingscope; no newkeyword/punctuation guesses. Bothcomputedkey directionsfixed. F10fix: tokenizer resultrecords evalUnknown separatelyfromuncertain/namespace. Moduleinfo propagatesunknownflag, includingexistingforwarderspread. Themethod-nameguessgate stopsunprovenmatchesforunknown-evalexportswithoutclaimingnamespace/memberabsence; explicitwrittenmemberaliasesremainallowed, andearlierprovenreceiver/typepathsremainunchanged. UnknownASTfactstillnull, no falseparse-success/intrinsicproof. Existingmembertokenizer andfacts/hash/storelifecycleremainunchanged.
+
+Expanded8files172PASS1SKIP EXIT0, /tmp/codegraph-cjs-ast-f10-f11-after.log, CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2. Coversallprevious166checks plusnewcomputed-keyAST/graphcases,optionalcontextualwrapper,realexplicitcallablealiasunderunknownparse,andfreshindex-v-syncincludingknownactualeval->unknownwrapper->actualeval transitions. One skip is nativekerneltransport; nativebinarynotstaged,no nativeexecutionclaim. A matchercommentclarifyingunproven-callpolicyupdatedaftertest; no behaviorchangedafterthispassingrun. gitdiff--checkPASS. No explicitnormalbuild/fullsuite oncurrentcorrection; old10666fullPASSbelongs875only.
+
+Currentcorrectionvsround8snapshot changes5files: ASThelper,exportreader,matcher,ASTtest,graphintegrationtest. Durablebackup originalQA .review/commonjs-fix-2026-11-08/ast-f10-f11-corrected-2026-11-09/ includesall15sourcefiles,currentSHA256,cumulativepatchrelative875,small5filedeltafromround8,fail-before/passafterlogs,verificationmetadata. F10/F11 statusCORRECTED+focusedPASS, NOTindependentlycleared. Overallreviewcount8unchanged,noround9agentslaunched. Userper-stepconfirmationrequiresdecisionbeforefreshfocusedverify; don'tspendnewfull/reviewcycleunasked. No sourcecommit/pushyet; PR28/29remainDRAFT/unmerged. Ifuserapprovesnextreview: exactGitdiff875..workingtree +round8delta/sameledger, freshread-onlynativebroad/adversarial, boundedprobesonly,norepeatfull/build. Respectactualgate/noreset. Runfinalnormalbuild/fullonceonlyafterreviewstable. PreserveT0stopped/uncommitted; liveem40unchanged; noofficialupstreamwrite.
+
+
+## Ninth native focused verification explicitly authorized and running
+
+User answered yes to next focused dualreview. Fresh READONLY review_broad_pr29_f10_f11_9 and review_adversarial_pr29_f10_f11_9 launched together with exact87576a8d..workingtree15path target, thisledger andsmall5filedelta fromround8. Source matches172focusedPASS snapshot except documentedcommentonlychange, hashmatchesdurablecorrectedbackup. BothreviewclaimsremainPENDING; do notclaimclearance. No sourcechanges/build/fullsuite orpublishingauthorized bythisreviewonlyturn. Source staysfrozen; no gate resets/controlchanges. Parentwillgatherbothactualreports,mergefindings/saveandstop.
+
+
+## Ninth native focused verification completed — F10/F11 cleared, F12 remains
+
+User explicitly authorized thisverificationround. Both fresh read-only lanes review_broad_pr29_f10_f11_9 and review_adversarial_pr29_f10_f11_9 COMPLETED normally on same87576a8d..workingtree15path target and sameledger. Source hashes stillmatch approvedcorrectedsnapshot; no sourceedits/rebuild/fullsuite/controlchanges/networkwritesbyreviewers. No sourcecommit/push/merge/deploy. BothpublishedPRsremaindraftunchanged.
+
+F10/F11 originals independently CLEARED by BOTH: optionalcontextualwrapper nofalsecall; computedkeygenuineevalinsideoutergenerator keepsStore::load; generatormethodkeynongeneratorwrapper nofalsecall. Broad11runtime-backedprobesPASS includingclass/nestedcomputedkeys,generator/nongeneratorbodies,explicitcallablealiasunderunknownfactandgenuineevalcontrols. Evidence /tmp/cg-broad-pr29-ast9-verify.{cjs,log}. Adversarial also confirmsnestednongenerator/gettercomputedkeycontrols. ThesecontrolsdoNOTclearrootwhole-valueexportsbelow.
+
+### F12 — P2 — Unknown eval facts suppress genuine root exports (adversarial)
+
+Exact reviewer location src/resolution/name-matcher.ts:25403. Valid m.js:
+
+```js
+class Store { load() { return 42; } }
+module.exports = { load: Store.prototype.load };
+function yield(v) { return function ignored() {}; }
+yield?.(eval)("ignored");
+```
+
+Caller const named=require('./m'); function run(){named.load();}. Runtime named.load() returns42; currentindexcalls:[]. Readerrecordsnomembersfortherootobjectassignment; newevalUnknowngatedropsthegenuinecallablealias. module.exports=new Store() reproduces too. RemovingONLYnewevalUnknownconditioninmemoryrestoresm.js:Store::loadforbothidenticalinputs. Directexports.load=Store.prototype.loadcontrolstillpasses. ThisisNEWregressionintroducedbyF10correction. Evidence /tmp/cg-a9-root-export-regression.cjs, /tmp/cg-a9-root-export-current.log, /tmp/cg-a9-root-export-oldgate.log. Broadclearedlimitedcontrolsbutdidnotprobeequivalentrootexports; no contradictoryexecutionresult.
+
+STOP/reportmergedfindingonly; useryesauthorizedfocuseddualverify, notanotherunaskedcorrectioncycle. OriginalF10/F11closedatthissnapshot; F12OPEN. No finalreviewclearanceorreadyformergeclaim. No explicitnormalbuild/fullsuiteoncurrentdirtyASTcorrection;172focusedPASS1SKIPremainsactualbutmissesF12. Old10666fullPASSbelongs875only. No test/build/reviewerprocessesrunning. Needuserdecisionbeforefix; preserveactualmodule-valueexportswhileblockingunprovedunknown-evalguesses, notanotherpunctuation/keywordheuristic. Overallcount9honest,noreset/gatebypass. Durableevidence/ledger/resultsavedunderoriginalQA .review/commonjs-fix-2026-11-08/pr29-review9-2026-11-09/; current15sourcefilespatchesremainin adjacentast-f10-f11-correctedbackup. T0/liveem40unchanged, noofficialupstreamwrite.
+
+
+## F12 correction approved and focused verification complete — 2026-11-09
+
+User explicitly approved the focused F12 correction after reading the session-end handoff. Existing checkout/HEAD 87576a8d and all 15 dirty source paths preserved; only two source files and their two tests changed from review 9. No commits, pushes, new review, merge, deploy, grammar/schema/dependency or extraction/storage changes.
+
+Added both runtime-backed F12 regressions FIRST: root object callable alias and new Store() under optional yield wrapper return 42 at runtime but graph calls are empty. Actual 2 FAIL / 61 SKIP, /tmp/codegraph-pr29-f12-red.log, exit 1. Expanded pre-fix reader/graph contract: 33 FAIL / 136 PASS, /tmp/codegraph-pr29-f12-matrix-red.log, exit 1.
+
+Reader now records exportForm (namespace/value/opaque) independently from evalState (present/absent/unknown); replaces the prior evalUnknown flag. Explicit members remain property writes, never a whole-value inventory. Any syntactically stated whole module.exports assignment retains existing value resolution; escapes/mixed writes do not erase that evidence or claim a final member inventory. Namespace absence still requires !uncertain. Inconclusive eval only gates unproven method guesses when no stated whole value is present; explicit property aliases and confirmed eval behavior stay intact. Forwarders propagate the summary through existing spread, and existing typeFrom dependencies remain intact.
+
+Tests cover namespace/direct alias/root object/instance x eval absent/present/unknown, direct and forwarded imports; runtime values and typeFrom metadata asserted. Added fresh-v-sync transitions across both axes, bracket/mixed assignments, opaque reader controls; all prior F10/F11 tests retained unchanged.
+
+Actual verification:
+- First two-file green: 169 PASS, /tmp/codegraph-pr29-f12-matrix-green.log, exit 0. Test setup successfully ran tsc + copied assets for current source.
+- Expanded ten-file run after final four bracket/mixed graph tests: 235 PASS / 1 SKIP / 6 FAIL, /tmp/codegraph-pr29-f12-focused.log, exit 1. All six failures were lazy-engine child stdout empty. Independent minimal spawnSync probe reproduced EPERM for piped Node child output even when the child simply prints 42; file output works. No source/test workaround added.
+- Approved sandbox escalation reran ONLY lazy-engine.test.ts outside sandbox: 6 PASS, /tmp/codegraph-pr29-f12-lazy-unsandboxed.log, exit 0.
+- Combined distinct final checks: 241 PASS / 1 SKIP over 10 files. Skip is native-kernel parity (binary not staged); no native execution claim. git diff --check PASS. No final normal npm run build/fullsuite on dirty AST revision; these remain deferred until stable independent review per user handoff. No tests/build/reviewer processes running.
+
+F12 status: CORRECTED + focused verified, NOT independently cleared. Overall review count remains 9; no gate resets or new agents. STOP and ask before fresh focused dual review, as requested. Proposed two-commit structure stays pending; nothing staged/committed/published. PR28/29 draft state not changed. T0/live/deploy/control files untouched.
+
+Durable backup: original QA .review/commonjs-fix-2026-11-08/pr29-f12-2026-11-09/ contains before/after copies of all 15 dirty source files, hashes, cumulative-from-875.patch, f12-correction.patch, actual red/green/failure/rerun logs and verification.json. Plan: /home/ericm/.codex/plans/plan-codegraph-pr29-f12-2026-11-09.md. Next factual checkpoint: /home/ericm/.codex/plans/handoff-codegraph-pr29-f12-focused-2026-11-09.md.
+
+
+## Tenth native focused verification explicitly authorized and running
+
+User answered yes to next focused dual review. Fresh read-only review_broad_pr29_f12_10 and review_adversarial_pr29_f12_10 launched on exact 87576a8d..workingtree target, same ledger and saved four-file F12 delta. All 15 source hashes match focused-tested F12 checkpoint. Both results PENDING. No source changes, rebuild, full suite or publication in this review-only phase. Completed review count remains 9 until results arrive; no resets or gate bypass. Parent will merge actual reports, save checkpoint and stop.
+
+
+## Tenth native focused verification completed — original F12 clears; F12 variants and new F13 remain
+
+User explicitly authorized this focused review. Both fresh read-only lanes review_broad_pr29_f12_10 and review_adversarial_pr29_f12_10 completed normally against exact git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 87576a8d9ff0d8aba235db5535f5f4429f14b037 -- . and the same ledger / saved F12 delta. All 15 source hashes match the focused-tested F12 snapshot. No source edits, rebuild, fullsuite, commits, pushes, merge, deploy or gate reset. Parent merged actual reports without duplicate probes/source re-audit.
+
+Both independently CLEARED original F12 unparenthesized root object/instance, original F10 optional wrapper, and both F11 computed-key directions. Original passing examples do not clear adjacent syntax/scope findings.
+
+### F13 — P2 — Shadowed module writes disable the unknown-eval guard (adversarial)
+
+Exact location src/resolution/commonjs-export-members.ts:75, gate name-matcher.ts:25403. Concrete input:
+
+```js
+exports.known = function known() {};
+function pretend(module) { module.exports = {}; }
+pretend({});
+function yield(v) { return function ignored() {}; }
+yield?.(eval)("ignored");
+```
+
+Caller const named=require('./m'); function run(){named.missing();}, unrelated export class Decoy { missing() {} }. Actual CommonJS exports only known; missing undefined. Current graph incorrectly calls decoy.js:Decoy::missing. Reader records exportForm:value/evalState:unknown from local parameter's module.exports assignment, bypassing unknown-eval guard. Block-local and arrow parameter variants reproduce. Loading both saved pre-F12 source files in memory yields calls[] on identical inputs, proving NEW regression in latest correction. Evidence /tmp/cg-a10-boundary.{cjs,log}, /tmp/cg-a10-before-loader.cjs, /tmp/cg-a10-boundary-before-source.log, /tmp/cg-a10-shadow-runtime.log.
+
+### F12 — P2 — F12 remains for equivalent whole-value assignment syntax (broad)
+
+Exact location src/resolution/commonjs-export-members.ts:75, gate name-matcher.ts:25403. class Store { load() { return 42; } }; (module.exports) = new Store(); function yield(v){return function ignored(){}} yield?.(eval)("ignored"); with named.load() returns42 at runtime but graph calls[]. Reader expects = immediately after module.exports, records opaque and suppresses call. Parenthesized root object and module.exports &&= new Store() reproduce. Removing only optional wrapper restores Store::load. Direct/forwarded imports both fail; fresh/sync agree, removing wrapper during sync restores edge and typeFrom. This is incompletely corrected F12, not a demonstrated NEW regression in latest correction. Broad evidence /tmp/cg-broad-pr29-f12-10.{cjs,log} (28 runtime/graph probes), /tmp/cg-broad-pr29-f12-10-sync.{cjs,log} (12 asserted sync/fresh comparisons).
+
+STOP/report both P2 findings. No fix or new review authorized by this yes-to-review turn. Review count10 completed honestly, no resets. Prior 241 focused PASS /1native SKIP remains actual but misses these cases. No final normal build/fullsuite on dirty AST revision; no native-kernel execution claim. PR28/29 stay draft/unpublished current correction; T0/live/control/deploy files untouched. Sources remain 15 dirty paths on HEAD87576a8d. Preserve checkout and all work.
+
+Durable review evidence: original QA .review/commonjs-fix-2026-11-08/pr29-review10-2026-11-09/ includes broad/adversarial reports, merged-review.md, completed review-status.json, source hashes, scripts/logs, and ledger. F12 before/after source backups/cumulative+delta patches remain adjacent pr29-f12-2026-11-09/. New handoff /home/ericm/.codex/plans/handoff-codegraph-pr29-review10-two-findings-2026-11-09.md.
+
+
+## Shared production export evidence integrated — focused verification complete
+
+User said "ok run it" after clarification that integration remained unfinished. Authorized production implementation in preserved checkout; no new review or publication in this turn. New binding-aware source record is now used by import resolution and the name-matching guard. F12 equivalent assignments and F13 export/caller shadowing corrected + focused tested, NOT independently cleared. Overall review count remains10.
+
+Implementation: src/resolution/commonjs-export-evidence.ts uses established TypeScript checker.resolveName binding identities and type/member declaration selectors. It handles structural parenthesized/bracket/logical assignments, direct callable aliases, exported class/object/instance members, relative forwarding, and direct literal eval analyzed in its lexical context by a synthetic arrow body. This records static potential relationships without generator execution; genuine F11 generator eval passes beside unrelated methods. Local module/exports/eval bindings and caller parameters/classes are distinguished. Unknown behavior supplies no target. Selector ranges map only to indexed declarations, no global name guess.
+
+The source-hash/versioned record is computed lazily during resolution, memoized by context/file/source, and cleared with resolver caches. No new metadata writer/schema/grammar. Import resolver's CommonJS default regex is replaced by record consumption. All CJS positive member targets resolve through the record before fallback; a CJS binding cannot authorize a global method-name guess. Early import edges preserve typeFrom source/forwarder dependencies. Existing AST eval fact pipeline and tokenizer unit helper were preserved; tokenizer is no longer the production fallback authority. Extraction's existing export-name helper remains node naming, not authorization of these call targets.
+
+TypeScript5.9.3 is promoted from development to runtime dependency (^5.9.3); package lock refreshed offline, npm ls --omit=dev confirms presence. Compiler is required only when analyzing source, not by loading the helper/library/read CLI. Final7lazy tests outside sandbox PASS (same known Node child-pipe EPERM reason as earlier runs).
+
+Actual verification history:14newgraph regressions FAIL before;14PASS after first integration. Expanded10files initially236PASS30FAIL1SKIP from missing dependency metadata (stale sync), object-method node-kind mapping and parenthesized eval arguments; corrected to266PASS1SKIP. Neighbors initially356PASS2FAIL (caller parameter/class shadowing); added compiler-bound call-site receiver facts. Final combined19files624PASS1SKIP, /tmp/codegraph-pr29-evidence-integrated-focused.log. Final7lazyPASS, /tmp/codegraph-pr29-evidence-lazy-final.log. Distinct final631PASS1SKIP over20files. Test setup ran tsc/assets, viewer build/check succeeded earlier. git diff --check PASS. No standalone final npm run build/fullsuite on this revision; deferred to stable review per existing boundary. Native parity skipped because binary absent, no native execution claim.
+
+Small production-collector measurement: module load8.23ms with compilerLoadedBeforeAnalysis:false; cold first analysis277.01ms, heap delta17.70MiB;25warm samples median1.65ms (147byte value fixture),2.37ms (152byte generator eval). These are toy collector measurements, not actual large-project indexing, query latency, cache or worker benchmarks.
+
+CurrentHEAD87576a8d, branchfix/commonjs-eval-callee-context.22dirtypaths total, new3files intent-to-add for review only; no sourcecommit/push/merge/deploy. Integration phase changed9paths: shared source module, import resolver, name matcher, two new test files, default-binding graph tests, lazy test, package.json/lock.13of15prior dirty source paths remain byte-identical; two intentionally extended. All22final hashes saved/verified. T0/live/deploy/control files untouched.
+
+Durable backup: originalQA .review/commonjs-fix-2026-11-08/pr29-export-evidence-integration-2026-11-09/ contains baseline before/, milestone1/2 source snapshots/hashes, final-source/ all22files, source-sha256.json, cumulative-from-875.patch, integration-from-round10.patch, actual red/green/failure/lazy logs, production measurement script/output, results.json/progress.json. STOP and ask before fresh focused dual review; do not auto-review/fix/publish. Final normal build/fullsuite once after stable clearance. Latest handoff /home/ericm/.codex/plans/handoff-codegraph-pr29-export-evidence-integrated-2026-11-09.md.
+
+
+## Eleventh native focused verification explicitly authorized and running
+
+User answered yes to the next focused dual review. Fresh read-only review_broad_pr29_evidence_11 and review_adversarial_pr29_evidence_11 launched on exact 87576a8d..workingtree22-file target, same ledger and integration-from-round10.patch. All22source hashes match the631focusedPASS/1nativeSKIP snapshot. Both results PENDING;10rounds completed until reports arrive. No source changes, rebuild, fullsuite, publication or gate resets. Parent will merge actual results, preserve artifacts and stop for user decision.
+
+
+## Eleventh native focused verification complete — F10–F13 clear, new F14/F15 open
+
+Both user-authorized read-only lanes review_broad_pr29_evidence_11 and review_adversarial_pr29_evidence_11 completed normally against exact git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 87576a8d9ff0d8aba235db5535f5f4429f14b037 -- . and the same ledger/integration delta. All22source hashes match focused-tested snapshot. No source/build/fullsuite/commit/publication/gate changes. Parent merged actual reports without duplicate source reading/probes.
+
+Both independently CLEARED original F10/F11/F12/F13, including true generator eval, optional wrapper, parenthesized/logical whole exports, local wrapper shadowing. Broad11asserted AST and12asserted sync/fresh controls pass. Prior631focusedPASS1nativeSKIP is actual but misses new findings.
+
+### F14 — P2 — Preserve explicit property aliases on a whole exported local value (broad)
+
+Exact location src/resolution/commonjs-export-evidence.ts:226. Valid m.js: class Store { load() { return 42; } }; const api = {}; api.load = Store.prototype.load; module.exports = api; Caller named.load() runtime42, current graph[], record.members{}. Before integration, identical source resolves Store::load/typeFrom[m.js]. Class Factory.load and function Factory.load alias variants independently fail-after/pass-before. Collector discards writes on local receivers, and the wrapped compiler type does not supply those assigned properties. This is an introduced loss of correct relationship, not permission to restore global guesses. Report/replay: /tmp/cg-broad-pr29-evidence11-report.md and /tmp/cg-broad-pr29-evidence11-artifacts/ (durably copied below).
+
+### F15 — P2 — Do not emit calls to exported non-callable values (adversarial)
+
+Exact location src/resolution/import-resolver.ts:3430, classification commonjs-export-evidence.ts:148-156/309-313. m.js const value=42; exports.load=value; caller named.load(). Runtime TypeError (not a function), current graph run→m.js:value constant; before calls[]. String-valued object-export variant reproduces. Valid supporting variant function real(){return 42;}let value;value=real;exports.load=value; runtime42/current targets variable value instead of real; before has no target. Same kind:value declaration fallback, one finding. Preserve data imports/references while withholding unsupported call identity. Report/replay /tmp/cg-a11-final-report.md and cg-a11-* scripts/log/JSON.
+
+Review count11 completed honestly, no resets. STOP before fixes/review/publication unless user authorizes. Final normal build/fullsuite not run; native binary absent, no parity claim. HEAD87576a8d,22dirtypaths preserved; PR28/29 publication unchanged. Durable originalQA .review/commonjs-fix-2026-11-08/pr29-review11-2026-11-09/ contains exact reports, merged-review.md, completed review-status.json,22source hashes, broad-artifacts/ including both baseline source files, adversarial-artifacts/ including scripts/logs/baseline import resolver and copied before name matcher. Some adversarial replay scripts hardcode original /tmp baseline paths; restore those saved files to their original paths or adjust only copied replay scripts if /tmp disappears. Actual source snapshots remain adjacent pr29-export-evidence-integration-2026-11-09/final-source/ and before/.
+
+Latest user steering after review: "astra vs sol come up with diff plan?" Parent will obtain independent read-only design plans from Astra and Sol against these same findings; this authorizes planning/comparison, not code or another review. Preserve source.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-review11-2026-11-09/compare-astra-sol-pr29-export-contract-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/history/pr29-review11-2026-11-09/compare-astra-sol-pr29-export-contract-2026-11-09.md
new file mode 100644
index 0000000000..b1d900c1de
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-review11-2026-11-09/compare-astra-sol-pr29-export-contract-2026-11-09.md
@@ -0,0 +1,35 @@
+# Astra vs Sol — independent PR29 design comparison
+
+User asked "astra vs sol come up with diff plan?" Two fresh independent read-only planning lanes ran: gpt-6-astra and gpt-6.1-sol. Both completed and saved plans. No source edits, probes, build, new review, commit or publication. All22source hashes match round11 frozen snapshot. This comparison is about these concrete plans, not general model capability.
+
+## Shared conclusion
+
+Both choose a bounded binding-owned value/relationship graph, keeping the established TypeScript binder and working lexical eval adapter. Both reject two local patches to the current declaration-array contract. Root error: declaration identity, exported value identity and callable implementation identity are conflated. Compiler type shape is not a ledger of explicit property writes.
+
+F14 needs object/class/function identity plus property slots: api.load=Store.prototype.load;module.exports=api must preserve that slot and target. F15 needs callability as independent evidence: const value=42;exports.load=value is a valid data export but no call target. let value;value=real;exports.load=value must resolve the reachable callable or remain unknown, never call the storage variable itself.
+
+## Differences of emphasis
+
+| Plan | Most useful detail |
+|---|---|
+| Astra | Explicit value categories and closed-object completeness; branch alternatives must agree before claiming one callable; strong stop/pivot boundary and safe reduced-scope fallback. |
+| Sol | Clear consumer result separating value/reference selector, callable selector, completeness, and dependencies; bounded def-use transfers, overwrites and aliases. |
+
+This is convergence on one architecture, not competing fundamentally different plans.
+
+## Recommended combined plan
+
+Use Sol's consumer contract with Astra's uncertainty/stop rules. First test only the missing value/property/callability contract in isolation, reusing the existing binder and recorded fixtures rather than restarting the full prototype. Mandatory rows: F10–F15, local object/class/function writes, primitive data/reference-vs-call pairs, callable reassignment, alias identity/overwrites/post-export mutation, ambiguous branches/escapes, forwarder dependencies, and fresh-v-sync. No production integration until one representation satisfies those rows without fixture-specific exceptions.
+
+Keep TypeScript lazy and preserve lexical literal-eval/generator relationships as static potential relationships. Unknown supplies no global guesses and no stale callable. Constructors and ordinary callable functions are separate. Avoid general JS execution. If the bounded model needs arbitrary calls/heap simulation or fails representative performance checks, stop and propose a narrowly scoped rollback/reduced coverage while preserving all existing files.
+
+Likely production scope after validation: commonjs-export-evidence.ts, import-resolver.ts, name-matcher.ts and focused tests; no extraction/schema rewrite. Real representative performance remains unmeasured (toy timing is not sufficient). Neither plan is an implementation approval.
+
+## Current state and next boundary
+
+Round11 completed with new P2 F14/F15 open. Original F10–F13 independently clear. Prior631focusedPASS1nativeSKIP does not clear new findings. Source remains22dirtypaths at87576a8d. No further code/review/fullsuite/publication authorized by this planning request. User decides whether to pursue the combined contract experiment.
+
+Plans:
+- /home/ericm/.codex/plans/plan-astra-pr29-export-contract-2026-11-09.md
+- /home/ericm/.codex/plans/plan-sol-pr29-export-contract-2026-11-09.md
+Review checkpoint: /home/ericm/.codex/plans/handoff-codegraph-pr29-review11-two-findings-2026-11-09.md
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-review11-2026-11-09/handoff-codegraph-pr29-review11-two-findings-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/history/pr29-review11-2026-11-09/handoff-codegraph-pr29-review11-two-findings-2026-11-09.md
new file mode 100644
index 0000000000..08c471e998
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-review11-2026-11-09/handoff-codegraph-pr29-review11-two-findings-2026-11-09.md
@@ -0,0 +1,25 @@
+# PR29 round11 complete; F14/F15 open, Astra/Sol planning requested
+
+
+## Eleventh native focused verification complete — F10–F13 clear, new F14/F15 open
+
+Both user-authorized read-only lanes review_broad_pr29_evidence_11 and review_adversarial_pr29_evidence_11 completed normally against exact git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 87576a8d9ff0d8aba235db5535f5f4429f14b037 -- . and the same ledger/integration delta. All22source hashes match focused-tested snapshot. No source/build/fullsuite/commit/publication/gate changes. Parent merged actual reports without duplicate source reading/probes.
+
+Both independently CLEARED original F10/F11/F12/F13, including true generator eval, optional wrapper, parenthesized/logical whole exports, local wrapper shadowing. Broad11asserted AST and12asserted sync/fresh controls pass. Prior631focusedPASS1nativeSKIP is actual but misses new findings.
+
+### F14 — P2 — Preserve explicit property aliases on a whole exported local value (broad)
+
+Exact location src/resolution/commonjs-export-evidence.ts:226. Valid m.js: class Store { load() { return 42; } }; const api = {}; api.load = Store.prototype.load; module.exports = api; Caller named.load() runtime42, current graph[], record.members{}. Before integration, identical source resolves Store::load/typeFrom[m.js]. Class Factory.load and function Factory.load alias variants independently fail-after/pass-before. Collector discards writes on local receivers, and the wrapped compiler type does not supply those assigned properties. This is an introduced loss of correct relationship, not permission to restore global guesses. Report/replay: /tmp/cg-broad-pr29-evidence11-report.md and /tmp/cg-broad-pr29-evidence11-artifacts/ (durably copied below).
+
+### F15 — P2 — Do not emit calls to exported non-callable values (adversarial)
+
+Exact location src/resolution/import-resolver.ts:3430, classification commonjs-export-evidence.ts:148-156/309-313. m.js const value=42; exports.load=value; caller named.load(). Runtime TypeError (not a function), current graph run→m.js:value constant; before calls[]. String-valued object-export variant reproduces. Valid supporting variant function real(){return 42;}let value;value=real;exports.load=value; runtime42/current targets variable value instead of real; before has no target. Same kind:value declaration fallback, one finding. Preserve data imports/references while withholding unsupported call identity. Report/replay /tmp/cg-a11-final-report.md and cg-a11-* scripts/log/JSON.
+
+Review count11 completed honestly, no resets. STOP before fixes/review/publication unless user authorizes. Final normal build/fullsuite not run; native binary absent, no parity claim. HEAD87576a8d,22dirtypaths preserved; PR28/29 publication unchanged. Durable originalQA .review/commonjs-fix-2026-11-08/pr29-review11-2026-11-09/ contains exact reports, merged-review.md, completed review-status.json,22source hashes, broad-artifacts/ including both baseline source files, adversarial-artifacts/ including scripts/logs/baseline import resolver and copied before name matcher. Some adversarial replay scripts hardcode original /tmp baseline paths; restore those saved files to their original paths or adjust only copied replay scripts if /tmp disappears. Actual source snapshots remain adjacent pr29-export-evidence-integration-2026-11-09/final-source/ and before/.
+
+Latest user steering after review: "astra vs sol come up with diff plan?" Parent will obtain independent read-only design plans from Astra and Sol against these same findings; this authorizes planning/comparison, not code or another review. Preserve source.
+
+See handoff-codegraph-pr29-export-evidence-integrated-2026-11-09.md for implementation/dependency/test details and session-end handoff for identity/publication boundaries. Do not fix or run another review automatically.
+
+## Astra/Sol comparison complete
+Both user-requested independent plans completed read-only. Both converge on binding-owned values/property slots, independent callable identity and bounded def-use; TypeScript binder/eval adapter retained. Recommended Sol result contract plus Astra uncertainty/stop rules. Plans/comparison saved in ~/.codex/plans and durable review11backup. Latest comparison: /home/ericm/.codex/plans/compare-astra-sol-pr29-export-contract-2026-11-09.md. Source22hashes unchanged. User decision required before new contract spike or production edits; planning request was not implementation approval.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-review11-2026-11-09/merged-review.md b/docs/handoffs/pr29-2026-11-10/history/pr29-review11-2026-11-09/merged-review.md
new file mode 100644
index 0000000000..7df8ff0510
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-review11-2026-11-09/merged-review.md
@@ -0,0 +1,30 @@
+# PR29 round11 — two new P2 findings
+
+Exact Git target: git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 87576a8d9ff0d8aba235db5535f5f4429f14b037 -- .
+Same ledger .review/commonjs-eval-callee-context.md. Both fresh native lanes completed read-only. All22tested source hashes remain unchanged. No source edits, build/fullsuite, commit/push/merge/deploy or gate reset.
+
+## F14 — P2 — Preserve explicit property aliases on a whole exported local value (broad)
+
+Location: src/resolution/commonjs-export-evidence.ts:226.
+
+The new collector discards assignments whose left receiver is a local value rather than the wrapper's module/exports bindings. Later membersOf enumerates the local value's compiler type, which in this wrapped program does not contain these assigned properties. Therefore a statically explicit callable alias disappears when its containing object/class/function is exported whole.
+
+class Store { load() { return 42; } }
+const api = {};
+api.load = Store.prototype.load;
+module.exports = api;
+
+Caller named.load(): runtime42, current graph[], record.members{}. Identical before-integration resolver graph reaches m.js:Store::load with typeFrom[m.js]. Class Factory.load and function Factory.load alias variants independently fail-after/pass-before. This is introduced loss of a correct call relationship, not a request to restore global guesses. Full broad claim/repros: broad-report.md and broad-artifacts/.
+
+## F15 — P2 — Do not emit calls to exported non-callable values (adversarial)
+
+Location: src/resolution/import-resolver.ts:3430 (positive member return), with classification at commonjs-export-evidence.ts:148-156 and declaration acceptance at309-313.
+
+m.js: const value=42; exports.load=value;
+use.js: const named=require('./m');function run(){return named.load();}module.exports=run;
+
+Runtime throws TypeError: named.load is not a function. Current graph adds run → m.js:value (constant), identical before-integration graph has no call. String-valued object-export variant reproduces. Supporting valid callable assignment function real(){return 42;}let value;value=real;exports.load=value runtime42/current graph targets variable value rather than callable real; before graph has no target. Same declaration fallback, one finding. Preserve legitimate data import/reference relationships while withholding unsupported call identity. Full adversarial claim/repros: adversarial-report.md and adversarial-artifacts/.
+
+Both independently cleared original F10/F11/F12/F13 cases. Broad11asserted AST controls and12asserted sync/fresh comparisons pass;28original observations correct. Adversarial originals runtime-backed. Other observed gaps were excluded because baseline also missed them or selected an unrelated decoy.
+
+STOP after reporting. Review count11completed, no resets. Prior631focusedPASS1nativeSKIP remains actual but misses new findings. No final normal build/fullsuite or native execution. No fixes or another review authorized by this review-only turn.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-review11-2026-11-09/plan-astra-pr29-export-contract-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/history/pr29-review11-2026-11-09/plan-astra-pr29-export-contract-2026-11-09.md
new file mode 100644
index 0000000000..534970c3d9
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-review11-2026-11-09/plan-astra-pr29-export-contract-2026-11-09.md
@@ -0,0 +1,27 @@
+# Astra: investigate a typed export-value graph before further integration
+
+Recommendation: replace the collector’s declaration-list contract with a bounded, binding-owned value graph; retain its TypeScript binder and lexical eval adapter. Investigate first; estimated L. This is a contract redesign, not an expando patch plus a node-kind filter.
+
+The root error is substituting declaration ownership/type shape for value flow. F14 loses `api.load = Store.prototype.load` because compiler type enumeration is not a mutation ledger. F15 turns the declaration owning a number into a callable target, and cannot follow `value = real`. Both are demonstrated by round11’s reports; no probes were repeated for this plan.
+
+Three viable boundaries:
+
+1. Patch the current collector: capture local writes and filter calls. Smallest diff, but declaration arrays still conflate exported storage, runtime values, and callable implementations; future assignments/aliases remain separate exceptions. Reject.
+2. Use an explicit, narrow value-flow contract over compiler binding identities. More work, but one representation handles both defects and makes unsupported behavior visible. Recommend.
+3. Shrink/revert the latest integration from saved before/after snapshots, retaining earlier AST/eval work and the safety guard; withhold unsupported targets. Lowest architectural commitment, but loses demonstrated relationships and must not restore the old global guesses. Keep as fallback, not a claimed complete fix. Never reset the checkout: preserve all 22 dirty paths and reverse only reviewed integration hunks in a separate worktree.
+
+The contract:
+
+- Values are callable implementation selectors, class constructors, object identities, primitive data, relative-module references, or unknown. Storage bindings/properties point to values; they are not automatically call targets. Compiler symbols identify bindings; source selectors identify indexed declarations.
+- Each lookup returns positive evidence, proven absence/non-callability, or unknown with a reason. Absence requires a closed known object; unsupported mutation destroys that completeness. Unknown never permits a global name fallback or silently retains a stale callable.
+- Reference/default queries may resolve data ownership. Call queries resolve only a uniquely established callable implementation. Constructor queries are separate: classes are constructible, not ordinary callable functions. Function-valued variables must resolve their function body selector, never pass merely because their graph kind is variable/constant.
+- Record literal property writes against object identity, including object/class/function expandos. `alias = api` shares identity; rebinding alias does not replace api. Exporting api retains identity, so later supported property writes remain visible. Track straight-line binding assignment versions and definite overwrites; branch uncertainty joins alternatives and suppresses a unique answer unless all supported alternatives agree. No execution engine, loop simulation, or custom scope parser.
+- Support explicit initializers, direct assignments, literal keys, prototype method selectors, existing object/instance exports, and relative forwarders. Preserve existing supported parenthesized/logical forms. Dynamic keys, getters/proxies, escaping mutation, reflective operations, and unresolved control flow return localized unknown. Document this coverage boundary rather than claiming complete JavaScript export evaluation.
+
+Preserve F10/F11’s exact lexical eval adapter and existing extraction facts. Reuse binder identities across expanded source through original declaration locations; synthetic declarations without indexed bodies remain unresolved. Literal eval contributes potential static relationships, not proof of invocation. Generator/computed-key relationships and optional-call rejection are mandatory controls. Exact runtime exports and these potential relationships cannot be promised simultaneously without substantially broader execution analysis.
+
+Before production edits, authorize an isolated contract spike and a fixed acceptance matrix using saved round11 fixtures plus overwrite, alias/rebinding, post-export mutation, unknown contamination, and reference-versus-call pairs. Gate: F10–F15 behavior correct; F12/F13 remain clear; forwarder dependencies complete; fresh index equals sync after target addition/removal/rebinding. No new global fallback. Baseline existing focused tests before assessing changes.
+
+Likely scope: commonjs-export-evidence.ts, import-resolver.ts, name-matcher.ts, and focused evidence/default-binding tests; no extraction/schema rewrite. Keep source-hash/versioned resolution-local caching and forwarding dependency invalidation. Retain lazy TypeScript runtime dependency only if isolated measurements justify it: compare cold/warm indexing and heap on representative small/large CJS repositories, not toy collector timings; query-only loading must remain compiler-free.
+
+Stop/pivot if passing the matrix requires interpreting arbitrary calls or expanding syntax exceptions. Use option 3 transparently instead. After a successful spike: bounded integration, focused checks, authorized fresh dual review, then normal build/full suite. Existing 631 passes are supporting history, not final clearance.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-review11-2026-11-09/plan-sol-pr29-export-contract-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/history/pr29-review11-2026-11-09/plan-sol-pr29-export-contract-2026-11-09.md
new file mode 100644
index 0000000000..b4efc83fc8
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-review11-2026-11-09/plan-sol-pr29-export-contract-2026-11-09.md
@@ -0,0 +1,35 @@
+# Sol independent plan: separate exported identity from callable identity
+
+Read-only design against HEAD `87576a8d` plus the preserved 22 dirty paths. Evidence: round11 broad/adversarial reports and current collector/consumers; no new probes or source changes.
+
+## Diagnosis and choice
+
+F14 and F15 expose one contract error: declaration ownership is being used as value identity, export shape, and callability simultaneously. The collector returns a variable declaration when value analysis stops; consumers accept it as a call target. Conversely, the compiler's inferred type is treated as the complete exported shape, losing explicit local property writes. Improving syntax recognition alone cannot repair this boundary.
+
+Three viable boundaries:
+
+1. Extend current `targets`/`membersOf`: smallest delta, but preserves conflated contracts and makes every new write form another special case. Reject.
+2. Replace the record's semantics with a small binding-owned value/relationship graph, keeping TypeScript binding and the existing eval adapter. Choose this: explicit properties and callable aliases become the same relationship mechanism.
+3. Restore pre-integration consumers selectively from preserved snapshots, keeping other dirty work. Removes compiler deployment cost but reopens F12/F13 unless replaced with another ownership authority. Reserve for failed feasibility, never silently restore global guesses.
+
+## Contract before implementation
+
+Each export lookup returns independently: value/reference selector, callable selector, property completeness, and evidence dependencies. Use a discriminated result: positive, proven absent/non-callable, or unknown. Unknown never enables name fallback. A positive reference to `value=42` remains valid for data access; invoking it produces no call target. `new Store()` has instance identity, not Store's callable identity; exported classes distinguish constructor invocation from ordinary calls.
+
+Represent local bindings by compiler symbol identity and allocations by declaration/source identity. Record literal-key writes against those identities, including object/class/function expandos and `prototype` method selections. Binding aliases point to values; property aliases point to selected member values. Thus `api.load=Store.prototype.load; module.exports=api` preserves ownership without copying names globally. Direct function/arrow/method declarations supply callable identity; variable/constant node kinds never establish it.
+
+Use a bounded def-use solver, not JavaScript execution: declaration initializers and unambiguous straight-line assignments transfer identities; overwrites supersede prior facts; aliases preserve shared property ownership. Conflicting reaching definitions, escapes, getters, dynamic keys and unsupported control flow mark the affected slot unknown. Do not union overwritten callables into a purported unique target. Do not attempt getters, proxies, arbitrary function returns or heap simulation.
+
+Default imports and references consume value identity; call references consume callable identity. Both import resolver and name-matcher guard consume the same result. Relative forwarders retain dependency paths and cycle/depth limits; unsupported forwarding remains unknown. Source/version caches stay resolution-local, and sync invalidates using all contributing files.
+
+Keep direct literal-eval parsing in its original lexical context, with current source mapping and binding checks. Mandatory F10/F11 compatibility includes genuine generator/computed-key eval and optional/non-direct/local eval rejection. These are static potential relationships, not proof that a generator executed. Runtime-precise reachability and this existing compatibility promise cannot both be claimed.
+
+## Feasibility gate and implementation scope
+
+Before production changes, specify a table of expected reference/call/unknown results and build an isolated throwaway contract spike using current TypeScript binding plus relationship facts. Require F14's object/class/function writes; F15's numeric/string data and assigned callable; overwrite, shadowed binding, alias mutation, ambiguous branch, direct/forwarded and fresh/sync controls; all original F10–F13 fixtures. Reuse recorded evidence; do not rerun old exploratory probes.
+
+Proceed only if one identity model handles every mandatory row without fixture-specific syntax exceptions. Likely production files: `commonjs-export-evidence.ts`, `import-resolver.ts`, `name-matcher.ts`; corresponding collector and graph regression tests. Preserve extraction/eval storage, package dependency and unrelated dirty paths.
+
+Acceptance: exact intended declaration, zero data-call edges/global guesses, consistent shared guards, dependency-complete sync/fresh equality, lazy compiler loading. Retain runtime TypeScript for trustworthy scoping; measure real representative resolution throughput and memory against the frozen integration before claiming acceptable cost. Focused tests precede the repository's normal build/full suite and fresh authorized dual review.
+
+Stop/pivot if mandatory coverage requires general execution or divergent authorities, or measured compiler/solver cost is unacceptable. Present a scoped rollback and explicitly reduced coverage for approval; do not keep accumulating patches.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-review9-2026-11-09/commonjs-eval-callee-context.md b/docs/handoffs/pr29-2026-11-10/history/pr29-review9-2026-11-09/commonjs-eval-callee-context.md
new file mode 100644
index 0000000000..2e4d5bc934
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-review9-2026-11-09/commonjs-eval-callee-context.md
@@ -0,0 +1,145 @@
+# Separate F8 follow-up (review round count remains six)
+
+User explicitly authorized committing/pushing current work to a PR and separating remaining correction. Current snapshot committed5d384989957c91b482068b306535437915a0595b, pushed fix/commonjs-missing-member, DRAFT https://github.com/inth3shadows/codegraph/pull/28 against main. KnownF8 documented, not ready to merge alone. No deploy/merge/upstream report.
+
+New branch fix/commonjs-eval-callee-context based on5d384989. Exact prospective Git target: git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5d384989957c91b482068b306535437915a0595b -- src/resolution/commonjs-export-members.ts __tests__/commonjs-export-members.test.ts __tests__/js-default-binding-members.test.ts
+
+F8 reviewer finding and prior invariants remain in .review/commonjs-missing-member.md; do not reset shared gate/round count. Two sixth reviewers completed; broad demonstrated F8 despite adversarial clearing intended F7 cases. This follow-up has NOT had independent dual review yet.
+
+Correction: distinguish grouping around bare eval from another function's argument list using token before parentheses. Wrapper identifier/call/member/optional-call/tag/control-condition prefixes must not mark exports uncertain. Grouped direct eval, literal/template arguments and expression prefixes such as return must keep prior behavior. Change limited to9helper lines plus independent unit and real-index graph regressions; no matcher/sync/scope changes.
+
+Before fix8FAIL92PASS; tag-result additional case1FAIL49PASS. Final focused2files101PASS, /tmp/codegraph-cjs-eval-followup-focused.log. Build/full pending. Hashes /tmp/codegraph-cjs-followup-frozen.json. Logs /tmp/codegraph-cjs-eval-followup-{before,tag-before,focused,build}.log. Need staged exact3-file diff, personal repo/identity and actual build result before commit/push. Full normal suite required before readiness claim. Keep follow-up draft and explicitly state review pending. No additional reviewer agents launched in this follow-up; user plans to point agents at PRs.
+
+Keep both PRs draft. Follow-up base should be fix/commonjs-missing-member, producing only the small correction diff. Review/merge follow-up into parent branch before considering parent PR for main; no merge authorized by current request. Preserve original T0 pilot and all deploy/control worktrees.
+
+Published DRAFT https://github.com/inth3shadows/codegraph/pull/29, commit87576a8d9ff0d8aba235db5535f5f4429f14b037, base fix/commonjs-missing-member/PR28 at5d384989. Explicit buildPASS; normal full suite RUNNING session62594, /tmp/codegraph-cjs-eval-followup-full.log. Both pushed/draft, neither merged/deployed; follow-up independent review stillpending. Original T0 untouched.
+
+
+FINAL execution verification2026-11-09: normal full suite session62594 EXIT0,873filesPASS19SKIP,10666testsPASS2expectedFAIL448SKIP0unexpectedFAIL,800.20sec. /tmp/codegraph-cjs-eval-followup-full.log. 101focusedPASS and explicit buildPASS on same87576a8dsource. Final3changed-file SHA256 checks PASS, trackedtreeclean; actual remoteheads rechecked5d384989(PR28) and87576a8d(PR29). PR29 body updated with exact final validation. Both PRs still DRAFT/unmerged; no deployment/upstream write. FOLLOW-UP INDEPENDENT REVIEW STILL PENDING: do not conflate fullsuite with review clearance. No further tests/build/review processes running. Saved final checkpoint and full log under original QA two-draft-prs backup.
+
+
+## Seventh native review explicitly requested — PR29 — 2026-11-09
+
+User invoked /dual review29. Exact GitHub base5d384989957c91b482068b306535437915a0595b and head87576a8d9ff0d8aba235db5535f5f4429f14b037 verified. Fresh read-only native lanes review_broad_pr29_round7 and review_adversarial_pr29_round7 launched together with same exact Git target and this ledger. Both focus full3-file29-line correction, F8 closure and nearby invariants; bounded execution probes only, no repeat full/build or source edits. Parent does not reread reviewed diff or duplicate reviewer probes. No review results yet; no independent clearance claim. Do not reset round count/gate, change source, push, merge or deploy in this review-only turn. Stop and report merged findings when both complete.
+
+
+## Seventh native dual review result — PR29 — 2026-11-09
+
+Both fresh read-only lanes completed normally: review_broad_pr29_round7 and review_adversarial_pr29_round7. Exact target remains5d384989957c91b482068b306535437915a0595b..87576a8d9ff0d8aba235db5535f5f4429f14b037. Source hashes verified unchanged, trackedtreeclean except private untracked.review. No source edits/build/fullsuite reruns/commits/pushes/GitHubcomments/merge/deploy. Both PRs remain draft. Current review DOES NOT CLEAR PR29 despite prior101focusedPASS/full10666PASS/buildPASS. Parent merges findings from actual final reports without re-verifying/re-reading diff.
+
+### F9 — P2 — Preserve grouped direct eval in control-statement bodies (BOTH)
+
+Broad location src/resolution/commonjs-export-members.ts:31: rejects any preceding ), including a completed if or for condition. Exact input `class Store { load() { return 42; } }
+if (true) (eval)('exports.load = Store.prototype.load;');`. Runtime exports load() returning42, but current discovery uncertain:false and indexing named.load() produces no call. Removing only new prefix guard in memory restores uncertain:true and m.js:Store::load. Nested grouped eval in unbraced single-iteration for body reproduces too. Broad evidence /tmp/cg-broad-pr29-control-context.{cjs,log}; exact command `node --experimental-wasm-exnref --experimental-wasm-stack-switching /tmp/cg-broad-pr29-control-context.cjs`.
+
+Adversarial independently confirms same location/trace; grouped-template if-body and for-body also reproduce. Evidence /tmp/codegraph-cjs-adversarial7-conditional-eval.{cjs,log}. De-duplicated as one P2 F9. This is a NEW regression introduced in PR29, not a pre-existing parent limitation.
+
+### F8 — P2 — PARTIALLY CORRECTED, remains for contextual-keyword wrapper names (adversarial)
+
+Exact reviewer location src/resolution/commonjs-export-members.ts:29 (whitelist:7). Valid CommonJS `function await(value){return function ignore(code){};} await(eval)("ignored");` passes eval without invoking it, but whitelist exemption produces uncertain:true and falsely resolves named.missing() to decoy.js:Decoy::missing. With exports.known=function known(){}, runtime exports only known; pre-F7 behavior restored in memory produces no call. yield reproduces too. Evidence /tmp/codegraph-cjs-adversarial7-contextual-wrapper.{cjs,log}. This is a RESIDUAL F8 variant, not a new unrelated parent re-audit. Do not label all F8 closed.
+
+### Confirmed preservation / rulings
+
+Both independently clear original F8 forms wrap(eval)("ignored") and wrap((eval))(("ignored")): runtime onlyknown, reader uncertain:false, no decoy call. Broad /tmp/cg-broad-pr29-f8-closure.{cjs,log}. Adversarial13runtime-backed graph controls pass (original2forms +11nearby controls), /tmp/codegraph-cjs-adversarial7-controls.log. True standalone grouped/template eval, return expressions, inert data/method declarations, call/member/optional/tag/condition-prefix negatives retain tested behavior. These controls do not answer F9 control-body context or F8 await/yield wrappers.
+
+### Next boundary
+
+Review-only user request is complete. STOP: no fixes, additional review loop, external review comment, markready, merge or deploy without user instruction. The per-step confirmation request remains in force. This is round7 overall; no gate/state reset. Repeated grouping-prefix patches now demonstrate syntax-context ambiguity: if user asks for remediation, choose an evidence-based smaller boundary/design instead of another unbounded keyword/punctuation whitelist. Preserve both concrete repros and all prior controls. Do not repeat fullsuite/build on unchanged source. Actual durable result/evidence/checksums saved in original QA .review/commonjs-fix-2026-11-08/pr29-review-round7-2026-11-09/.
+
+
+## AST redesign approved and started — 2026-11-09
+
+User explicitly approved AST redesign in PR29, said near usage max and asked for a resumable start, then said proceed. This revokes prior review-only stop for in-scope remediation; do not ask same approval on resume. Preserve per-step/user and actual gate boundaries for later merges/deployments. No grammar/runtime/dependency/database-schema changes, commits or pushes in this partial phase; PRs remain draft at prior heads.
+
+Newgraph regressions FIRST:3control-body direct-eval variants(if string/template, for nestedgroups) +await/yield CommonJS wrappers,5FAIL51SKIP on current87576a8d. /tmp/codegraph-cjs-ast-red.log, EXIT1. This intentionally RED gate remains unchanged because integration pending.
+
+New isolated src/extraction/commonjs-eval.ts reads existing SyntaxNode tree and checks actual call.function after unwrapping parenthesized_expression. Returns true for syntacticdirectevalcall(anyargument), false for provenabsence, null for parseerrors with no foundcall. New __tests__/commonjs-eval.test.ts loads existingJS/TS/TSXgrammars:33PASS, /tmp/codegraph-cjs-ast-helper.log EXIT0. Controls cover reports, grouped/interpolated eval, return, generatorfunctions/methods, nestednongenerator scope, eval inside yieldwrapper argument, inert data/methods/membercalls, JSX and malformedsource. Helper not wired to classifier/extraction yet. Existing lexical reader/EXPRESSION_PREFIX_WORDS unchanged for now. Do not claim F8/F9 closed, new full/buildpass or finalreview.
+
+IMPORTANT new evidence: existingJSgrammar correctly models control-body eval and awaitwrapper but parses legal CommonJS yield(eval)(code) as yield_expression whose operand is a call on(eval), no parseerrors. ASTscope must distinguish nongeneratorwrapper from generator yield. Helper handles direct yieldoperand only via nearestfunction/generator/methodscope; nested true eval in yield(eval(code)) remains detected. Shapeprobe /tmp/codegraph-cjs-ast-shape-probe.{cjs,log}. Extractionreferenceprobe /tmp/codegraph-cjs-eval-reference-probe.{cjs,log} shows currentextractor emits callref eval for genuinecall AND synthetic yieldwrappercase. Consequently raw existing unresolved eval refs alone are insufficient. User was explicitly told this grammar limitation, not falsely assured all cases are parser-perfect. No grammarfiles changed.
+
+Next integrate factualcallresult through existingextraction to resolver. Node has NO metadata field (onlyedges do); do not invent Node.metadata, abuse signature/selfedges/candidates, or introduce schema migration casually. ExtractionResult can carry optionalfact through workerclone; need native/deferred bypass parity. Main bulk parse pools only load grammars in workers; resolver cannot assume synchronous getParser is ready in main. Suggested project_metadata perfile/sourcehash transport or another small explicit extractioncontext capability; persist/refresh under same successfulstore lifecycle, cover storeworker and sync. Decide carefully before editing infrastructure. Resume must preserve all existing tests and5newred cases; unknown/missing/error facts must not masquerade as provenabsence. Keep existing export-member tokenizer and previous sync/scope/alias fixes intact; remove prefixheuristics only onceASTfacts actuallysupplied.
+
+Saved current3sourcefiles, patchrelative87576a8d, hashes, red/green/probe logs under original QA .review/commonjs-fix-2026-11-08/ast-redesign-started-2026-11-09/. No tests/build/reviewers running at checkpoint. Newfiles intent-to-add only so diffincludes them, not readyforcommit. No fresh dualreviewagents this phase. Overall reviewcount7; do not reset gate/controlstate. Resume directly integration and targeted tests; fullsuite/build only after stablefix, fresh focuseddual review as authorized/actualgatepermits, no repetitivewholeprojectwork. OriginalT0stillstopped/uncommitted; liveem40 unchanged; no merges/deploy/upstream writes.
+
+
+## AST integration execution-tested — verify round8 pending
+
+User approved AST redesign with focused review before final fullsuite, then resumed. Current dirty correction target87576a8d..workingtree,15paths captured /tmp/codegraph-cjs-ast-frozen.json (allnewfilesintent-to-add). No sourcecommit/pushyet; publishedPR29still87576a8d. No grammar/runtime/dependency/schema changes.
+
+Implemented AST fact in ExtractionResult and ephemeralFileRecord property; WASM computes from existingtree, native/deferred routes compute with existinggrammar; kernelmaterializer preservesfact. Allstorepaths carryFileRecord fact through existingwriter, upsertFile writes project_metadata commonjs_eval:<file> containingcontentHash/value. Nosecondwriter orNode.metadata. deleteFile removesfact. Coordinatorcontext acceptsboolean onlyonexact SHA256sourcehash. Missing/malformed/stale/nullfacts returnunknown, neverabsenceproof. Tokenreader removed literalEvalCall/EXPRESSION_PREFIX_WORDS, consults lazyASTfact atmostonceonlywhenbareevaltokenpresent; unknown staysconservative. Existingmembertokenizer/sync/typeFrom/scope unchanged. CHANGELOG alreadyrequiresre-indexafterupgrading(line56), which suppliesnewfacts; no legacyfactmigrationclaimed.
+
+Original5newgraphregressionsRED5FAIL51SKIP beforeintegration. Initialintegratedrun blocked by compiler: hashContentisexportedfromextraction/index, notutils; corrected byusingexistingcreateHashcrypto inresolver (sameSHA256algorithm), no circularextractionimport. Then3files140PASS. AddedrealSQLite factlifecycle4cases(missing/malformed/null, hashstale/replace,rollbackwithfiletransaction, deletion) andfreshindex-vs-sync wrapper->if-eval->yield-wrapper->for-eval->wrapper sequence. Final8files166PASS1SKIP, /tmp/codegraph-cjs-ast-expanded.log, CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2; alsoincludesmemo/synccaches/lazy-engine. Nativebinarynotstaged(codegraph-kernel/prebuilds/linux-x64/codegraph-kernel.node absent); kerneltransporttestskipped. Do not claimnativeexecution. Enginecompiledbytestsetup,currentdistmatchesfrozen sources. No explicitfinalnormalbuild/fullsuiteorindependentreviewyet. Priorfull10666PASSbelongs87576a8donly.
+
+Next eighthfreshnativeREADONLYlanes verify this correction, sameledger andexactGitdiff87576a8d..workingtree. Boundedruntimeprobes only, no fullsuite/build orsourcechanges. CheckF8/F9closure,generator-awareyieldworkaround, actualevalvswrappercallee, sourcehashfactlifecycle/workertransport/sync, previouscontrols. Do not re-audit unrelatedparentlimitations. Stop/reportifreviewfindsissues; do notresetgate/count orclaimClaude-onlyskill.
+
+
+## Eighth native review COMPLETED — AST correction NOT CLEARED
+
+Both fresh read-only reviewers completed normally on frozen15-file87576a8d..workingtree correction. Both confirm no source edits/build/full reruns/control changes; source hashes unchanged. No final normalbuild/fullsuite run or commit/push. PublishedPR28/29 remain drafts at5d384989/87576a8d. Prior166focusedPASS1SKIP is true and covers original5reportedgraphcases, but does not clear new findings. Nativebinary absent, no nativeexecutionclaim. Parent uses actual reports, no independent duplicate repro/diffread.
+
+### F10 — P2 — Optional contextual-keyword wrappers regress (adversarial)
+
+Exact reviewer location src/extraction/commonjs-eval.ts:37. Valid CommonJS:
+
+```js
+exports.known = function known() {};
+function yield(value) {
+  return function ignore(code) {};
+}
+yield?.(eval)("ignored");
+```
+
+Runtime exports only known; eval is never invoked. Existing grammar reports parse error, helper returns null, reader marks exports uncertain, and named.missing() falsely calls unrelated decoy.js:Decoy::missing. Actual current correction calls:[decoy.js:Decoy::missing]; base87576a8dreader restored in memory calls:[], uncertain:false. Evidence /tmp/cg-a8-yield-optional.{cjs,log}, /tmp/cg-a8-yield-optional-base.{cjs,log}, /tmp/cg-a8-probe.cjs. New F8-adjacent regression introduced by AST correction. Unknown fact correctly avoids false absence proof but must not license false call targets; current fallback still does.
+
+### F11 — P2 — Computed method names use enclosing scope (broad)
+
+Exact reviewer location src/extraction/commonjs-eval.ts:51. Treats a computed method name as belonging to that method's function scope. Computed names execute in enclosing scope. Confirmed both directions:
+
+1. `class Store { load(){return 42;} } function* setup(){ const obj = { [yield (eval)('exports.load = Store.prototype.load;')]() {} }; } setup().next();` Runtime exports load()->42, currentfactfalse/uncertainfalse, named.load() graphcalls[]. Ordinary computedmethodkey inside outergenerator suppressesgenuineeval.
+2. `exports.known=function known(){}; function yield(value){return function ignore(code){return 'x';}} const obj={ *[yield(eval)("ignored")](){} };` Runtime keysonlyknown, currentfacttrue/uncertaintrue, named.missing() falselycallsDecoy::missing. Generator methodkeyevaluatesoutsidegeneratorbody, so yieldiswrapperhere.
+
+One rootcause/twoexecutiontraces, evidence /tmp/cg-broad-pr29-ast8-computed-scope.{cjs,log}, executed againstcurrentdist with CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2. All15frozenhashesmatch.
+
+### Stop boundary and saved state
+
+Approved redesign progressed to166focusedPASS + real-worker/store/sync/factlifecycle integration, then focusedverifyfoundthese2P2. STOP before anothercorrectioncycle per dual-reviewworkflow/userper-stepconfirmation. Don't spendfullsuiteonknowndefectivecode orpushasready. Usermustdecidenextstep; noautomaticnewreview/fix/merge/deploy. Overallcount8, noreset. Nextremediationifapproved: computedmethodscope must excludecomputedkeys fromnewmethodscope; parseerrorunknown mustnotenableinventedfallbackcalls (requires explicitresolutionpolicy, not anotherkeyword/punctuationguess). Preserve all originalregressions and33ASTcontrols, truealiases/sync/scope/Pythonbehavior. No grammarfiles/schema/deps changed; source remains15dirtypaths, notcommitted. Durablebackup includes allsources/patch/logs andnewreviewevidence, verificationresult/checksums.
+
+
+## F10/F11 corrections approved and execution-verified — independent verification pending
+
+User explicitly answered yes to correcting the two eighth-review findings. Current HEAD87576a8d and15dirtysourcepaths retained; no newcommit/push/merge/deploy/grammar/schema/dependencychanges.
+
+Fail-beforetests:2ASTcomputed-key cases,3graphfindingcases,positivealiascontrol andunknownparse syncstep. Actual2files6FAIL90PASS beforefix, /tmp/codegraph-cjs-ast-f10-f11-before.log EXIT1. Positive explicitcallablealias underunknownparsealreadyPASS beforefix, mustkeep.
+
+F11fix: method_definition suppliesfunctionscope onlywhen calllieswithin ASTbodyorparametersregions. Computednames/decorators useenclosingscope; no newkeyword/punctuation guesses. Bothcomputedkey directionsfixed. F10fix: tokenizer resultrecords evalUnknown separatelyfromuncertain/namespace. Moduleinfo propagatesunknownflag, includingexistingforwarderspread. Themethod-nameguessgate stopsunprovenmatchesforunknown-evalexportswithoutclaimingnamespace/memberabsence; explicitwrittenmemberaliasesremainallowed, andearlierprovenreceiver/typepathsremainunchanged. UnknownASTfactstillnull, no falseparse-success/intrinsicproof. Existingmembertokenizer andfacts/hash/storelifecycleremainunchanged.
+
+Expanded8files172PASS1SKIP EXIT0, /tmp/codegraph-cjs-ast-f10-f11-after.log, CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2. Coversallprevious166checks plusnewcomputed-keyAST/graphcases,optionalcontextualwrapper,realexplicitcallablealiasunderunknownparse,andfreshindex-v-syncincludingknownactualeval->unknownwrapper->actualeval transitions. One skip is nativekerneltransport; nativebinarynotstaged,no nativeexecutionclaim. A matchercommentclarifyingunproven-callpolicyupdatedaftertest; no behaviorchangedafterthispassingrun. gitdiff--checkPASS. No explicitnormalbuild/fullsuite oncurrentcorrection; old10666fullPASSbelongs875only.
+
+Currentcorrectionvsround8snapshot changes5files: ASThelper,exportreader,matcher,ASTtest,graphintegrationtest. Durablebackup originalQA .review/commonjs-fix-2026-11-08/ast-f10-f11-corrected-2026-11-09/ includesall15sourcefiles,currentSHA256,cumulativepatchrelative875,small5filedeltafromround8,fail-before/passafterlogs,verificationmetadata. F10/F11 statusCORRECTED+focusedPASS, NOTindependentlycleared. Overallreviewcount8unchanged,noround9agentslaunched. Userper-stepconfirmationrequiresdecisionbeforefreshfocusedverify; don'tspendnewfull/reviewcycleunasked. No sourcecommit/pushyet; PR28/29remainDRAFT/unmerged. Ifuserapprovesnextreview: exactGitdiff875..workingtree +round8delta/sameledger, freshread-onlynativebroad/adversarial, boundedprobesonly,norepeatfull/build. Respectactualgate/noreset. Runfinalnormalbuild/fullonceonlyafterreviewstable. PreserveT0stopped/uncommitted; liveem40unchanged; noofficialupstreamwrite.
+
+
+## Ninth native focused verification explicitly authorized and running
+
+User answered yes to next focused dualreview. Fresh READONLY review_broad_pr29_f10_f11_9 and review_adversarial_pr29_f10_f11_9 launched together with exact87576a8d..workingtree15path target, thisledger andsmall5filedelta fromround8. Source matches172focusedPASS snapshot except documentedcommentonlychange, hashmatchesdurablecorrectedbackup. BothreviewclaimsremainPENDING; do notclaimclearance. No sourcechanges/build/fullsuite orpublishingauthorized bythisreviewonlyturn. Source staysfrozen; no gate resets/controlchanges. Parentwillgatherbothactualreports,mergefindings/saveandstop.
+
+
+## Ninth native focused verification completed — F10/F11 cleared, F12 remains
+
+User explicitly authorized thisverificationround. Both fresh read-only lanes review_broad_pr29_f10_f11_9 and review_adversarial_pr29_f10_f11_9 COMPLETED normally on same87576a8d..workingtree15path target and sameledger. Source hashes stillmatch approvedcorrectedsnapshot; no sourceedits/rebuild/fullsuite/controlchanges/networkwritesbyreviewers. No sourcecommit/push/merge/deploy. BothpublishedPRsremaindraftunchanged.
+
+F10/F11 originals independently CLEARED by BOTH: optionalcontextualwrapper nofalsecall; computedkeygenuineevalinsideoutergenerator keepsStore::load; generatormethodkeynongeneratorwrapper nofalsecall. Broad11runtime-backedprobesPASS includingclass/nestedcomputedkeys,generator/nongeneratorbodies,explicitcallablealiasunderunknownfactandgenuineevalcontrols. Evidence /tmp/cg-broad-pr29-ast9-verify.{cjs,log}. Adversarial also confirmsnestednongenerator/gettercomputedkeycontrols. ThesecontrolsdoNOTclearrootwhole-valueexportsbelow.
+
+### F12 — P2 — Unknown eval facts suppress genuine root exports (adversarial)
+
+Exact reviewer location src/resolution/name-matcher.ts:25403. Valid m.js:
+
+```js
+class Store { load() { return 42; } }
+module.exports = { load: Store.prototype.load };
+function yield(v) { return function ignored() {}; }
+yield?.(eval)("ignored");
+```
+
+Caller const named=require('./m'); function run(){named.load();}. Runtime named.load() returns42; currentindexcalls:[]. Readerrecordsnomembersfortherootobjectassignment; newevalUnknowngatedropsthegenuinecallablealias. module.exports=new Store() reproduces too. RemovingONLYnewevalUnknownconditioninmemoryrestoresm.js:Store::loadforbothidenticalinputs. Directexports.load=Store.prototype.loadcontrolstillpasses. ThisisNEWregressionintroducedbyF10correction. Evidence /tmp/cg-a9-root-export-regression.cjs, /tmp/cg-a9-root-export-current.log, /tmp/cg-a9-root-export-oldgate.log. Broadclearedlimitedcontrolsbutdidnotprobeequivalentrootexports; no contradictoryexecutionresult.
+
+STOP/reportmergedfindingonly; useryesauthorizedfocuseddualverify, notanotherunaskedcorrectioncycle. OriginalF10/F11closedatthissnapshot; F12OPEN. No finalreviewclearanceorreadyformergeclaim. No explicitnormalbuild/fullsuiteoncurrentdirtyASTcorrection;172focusedPASS1SKIPremainsactualbutmissesF12. Old10666fullPASSbelongs875only. No test/build/reviewerprocessesrunning. Needuserdecisionbeforefix; preserveactualmodule-valueexportswhileblockingunprovedunknown-evalguesses, notanotherpunctuation/keywordheuristic. Overallcount9honest,noreset/gatebypass. Durableevidence/ledger/resultsavedunderoriginalQA .review/commonjs-fix-2026-11-08/pr29-review9-2026-11-09/; current15sourcefilespatchesremainin adjacentast-f10-f11-correctedbackup. T0/liveem40unchanged, noofficialupstreamwrite.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-review9-2026-11-09/commonjs-missing-member.md b/docs/handoffs/pr29-2026-11-10/history/pr29-review9-2026-11-09/commonjs-missing-member.md
new file mode 100644
index 0000000000..6133cf6cc3
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-review9-2026-11-09/commonjs-missing-member.md
@@ -0,0 +1,282 @@
+# CommonJS missing-member review ledger
+
+Target: /tmp/codegraph-cjs-missing-fix-20261108, branch fix/commonjs-missing-member. Base 5e0664891af0e87e6fd18bbfa16cab39237570f5 to current tracked working tree, unchanged while both reviewers run. Exact diff: `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5e0664891af0e87e6fd18bbfa16cab39237570f5 -- CHANGELOG.md src/resolution/name-matcher.ts __tests__/js-default-binding-members.test.ts`.
+
+Round1 pending two fresh read-only native lanes. No Claude-only /code-review invocation. No resolver fix existed previously; user explicitly authorized implementation and dual review. Fork issue27 is the bug, QA PR27 is evidence only. No official upstream submission before Tuesday verification.
+
+## Findings / fix map
+
+- F1: confirmed upstream defect. `const named=require('./m'); named.missing()` with m.js exporting only known falsely calls unimported Decoy::missing; ref keeps receiver, resolvedBy instance-method/provenance null. Default imports and class-name-alias collision variants also reproduced. Sync adding decoy also fabricates call. Proposed tracked working-tree fix adds default bindings to imported-receiver guard and moves guard before unrelated class-name matching, after actual import/typed/object resolution. Requires reviewer execution and clearance.
+- P0 test baseline: new20-case file on unmodified resolver:15 PASS /5 FAIL. The5 failures are3 parameterized default/require+decoy cases,1 forwarding-module missing member,1 sync-add-decoy. Log /tmp/codegraph-cjs-fix-baseline2.log. No production code edit before this run. Initial baseline command failed because Vitest4 removed --minWorkers; corrected to --maxWorkers=4. Initial two new-test authoring corrections: object variable API used instead of unsupported direct object-literal shorthand shape; expected local object's qualified name corrected to actual fully-qualified extraction name. Neither changes an existing baseline test.
+
+## Rulings / limits
+
+- Direct `module.exports = { read() {} }` without an assigned variable already lacks correct member recovery on base and can be captured by a method decoy. This change must stop wrong calls; new object API positive uses baseline-supported `const api={read(){}}; module.exports=api`. Do not broaden into object-export extraction or claim direct shorthand recovery is implemented.
+- Bare external-package import exact-match issue26 remains separate and unfixed.
+- No import mapping semantics changes, no blanket conversion of require to namespace imports, no source code changes outside one name-matcher guard and changelog/tests.
+- This is a remaining variant of closed upstream2952/merged3162. No global novelty claim. Reproduced on em40/pristine main/pristine release. Native kernel unverified; local deployment is kernel0/WASM.
+
+## Invariants / commands
+
+- Actual exported member resolves beside an unrelated same-name method; missing member has no call. Forwarded CommonJS module preserves real export.
+- Stated CommonJS class static method, assigned object member, instance method, callable direct/default + attached function all remain correct beside decoys.
+- Existing ES default class, instance, typed variable, ambient export=, ordinary ESM namespace, named/anonymous/renamed functions retain calls.
+- Typed local parameters and object literal bindings shadowing default imports retain their local member calls.
+- Sync adds/removes a real export correctly; sync adding/removing a same-name unrelated method never fabricates missing-member calls.
+- Check these with `cd /tmp/codegraph-cjs-missing-fix-20261108 && CODEGRAPH_KERNEL=0 npx vitest run __tests__/js-default-binding-members.test.ts --maxWorkers=1`.
+- Expanded focused suite currently running: js-default-binding-members, commonjs-require-calls, commonjs-require-imports, commonjs-exports, require-default, import-default-as, namespace-object-resolution, import-object-member-namesake, sync-default-export-change, sync-import-member-retry, out-of-repo-import-shadow. Log /tmp/codegraph-cjs-fix-focused.log. Full normal suite/build pending.
+- Additional adversarial probes: class name matching alias, nested receiver paths, defaults with inherited/static/object APIs, lexical shadows and live sync. Each defect needs concrete input/actual wrong output; no style requests or hypothetical findings.
+
+## Round1 review outputs and remediation
+
+Both native lanes finished read-only. Each independently reported the same two P2 regressions at name-matcher.ts:24944; no other demonstrated findings.
+
+- R1 (broad+adversarial): `class Store { load() {} }; module.exports = new Store()` loses its legitimate instance call. Adversarial also demonstrated `export default new Store()` with Store not separately exported. Both base em40 produce Store::load; initial guard none. Remediation: resolve a whole explicit constructor expression to its actual module's local/imported class before the guard. Follow CommonJS forwarding; mask strings/comments/regexes, balance constructor arguments and type arguments, reject chained expressions, memoize with existing export index. Never re-enable generic method-name guessing for default bindings.
+- R2 (broad+adversarial): visible local `class named { static missing(){} }` shadows a default/namespace import; moving guard ahead of class strategy drops correct own-file call. Broad also tested enclosing-function shadow. Remediation: guard exempts a class declaration in the reference's file only when existing isLexicallyReachable proves it visible. Other-file alias-name class decoy remains blocked.
+- Review regression tests run BEFORE remediation: /tmp/codegraph-cjs-fix-review-baseline.log,24 cases19PASS5FAIL (original CommonJS positive +2 constructed-default variants +2 lexical class shadow variants). This pins both findings. Additional constructor argument/forwarder/text controls added; simple first remediation failed3nested/multiline/regex constructor positives in /tmp/codegraph-cjs-fix-constructors-baseline.log before argument-reader correction.
+- After remediation: /tmp/codegraph-cjs-fix-focused4.log,11 files99PASS1SKIP. Final focused run adds no-parentheses and spaced CommonJS constructor controls; /tmp/codegraph-cjs-fix-focused-final.log pending. Earlier temporary TS compile error from passing Language to CommentLang was corrected to JS-family typescript comment handling; not a passing run.
+
+The exact R1 reviewed name-matcher source is saved in .review/round1-name-matcher.ts and reconstructed hash verified against the recorded Git blob512a77a155299de8e6890447aa2d3aea7b81a1f9. Name-matcher remediation diff: `git diff --no-index /tmp/codegraph-cjs-missing-fix-20261108/.review/round1-name-matcher.ts /tmp/codegraph-cjs-missing-fix-20261108/src/resolution/name-matcher.ts`. Import-resolver and new tests are also remediation, diff from5e066489. No intermediate failing-source commit was made.
+
+Verify2 target is current tracked working tree relative5e066489, including CHANGELOG.md, src/resolution/name-matcher.ts, src/resolution/import-resolver.ts, __tests__/js-default-binding-members.test.ts. Check R1/R2 on all paths, all invariants, and defects introduced by remediation. Do not re-raise the pre-existing direct module.exports object-literal recovery limit without new evidence. Full build/suite pending. No merge/deployment occurred.
+
+## Verify2 result — NOT cleared; namespace-only redesign supersedes that target
+
+Both fresh native lanes finished; all findings P2. Broad reported first textual constructor overriding inactive/overwritten exports, valid inline/parenthesized constructors losing calls (R1 still open), and constructor-derived calls remaining stale after sync. Adversarial independently reported constructor lookup overriding typed/object/class lexical shadows (R2 still open), earlier constructor overriding a later stated default, and stale constructor-derived calls after sync. Exact evidence scripts/results under /tmp/cg-broad-verify2-* and /tmp/codegraph-cjs-verify2-*; complete reviewer messages returned to root. Existing explicit-default resolution was safer than the attempted new inference.
+
+Both lanes advised that a smaller boundary is coherent: extend module-namespace ownership only to a require/default whose resolved JS/TS target has no stated or uncertain value default; preserve all existing explicit/unknown default-value inference. Whole-file CommonJS forwarding can follow a namespace leaf; ambiguous assignments/default values must stay base behavior. No nonexistent redesigned code was reviewed or cleared by those design messages.
+
+Implemented redesign: REMOVED all added import-resolver source code; that file is byte-identical to base again. Removed unsafe constructor parsing/inference entirely. Name-matcher now uses existing context.resolveModuleFile, a per-context namespace-classification memo (cleared with existing memos), conservative source checks, pure whole-file forwarders only, bounded/cycle-safe traversal, language-qualified memo keys and JS/TS extensions only (no implicit component defaults). Any raw default keyword/export= or uncertain module use excludes the new guard; comments/text may conservatively prevent a classification. Move-before-class guard keeps lexical own-file class exemption. Changelog narrowed to modules without a value default.
+
+Scope/ruling: arbitrary stated/unknown exported default values and their guessed-member limitations remain pre-existing and explicitly OUTSIDE this fix. Do not claim every default-import missing-member case fixed. Removed new constructor-parser feature tests after deleting that feature, retaining baseline-supported CJS/ESM singleton, stated class/object/callable, lexical shadows and every original missing-module regression. Two dedicated singleton controls initially asserted disambiguation between two .load methods that base itself cannot provide; corrected their newly-authored fixture to a unique .load method, preserving the actual base invariant. Original broader CJS store-vs-decoy control remains unchanged. No baseline existing assertion was weakened.
+
+Full suite on superseded constructor candidate was STOPPED intentionally via guarded SIGINT to only this checkout's Vitest PID702277; final exec83750exit130. It did not pass and must not be reported as a test failure count/green gate. /tmp/codegraph-cjs-fix-full.log belongs that obsolete target. Latest redesigned focused13-file run /tmp/codegraph-cjs-fix-redesign-focused2.log RUNNING; verify actual exit/summary. Explicit build and redesigned full suite remain required.
+
+Third-review exception requested via async user question: skill says third round only if verify found something high severity; these were P2. Await user's explicit answer before launching further reviewers. Both agents' conceptual agreement is not final dual-review clearance. No source commit/push/fix PR/merge/deploy occurred. Original user's conditional merge/deploy request remains dependent on a reviewed green fix; original T0 stays stopped.
+
+## Final testing and local commit — authoritative current state
+
+Namespace redesign focused suite13files108PASS1SKIP, explicit npm run build exit0. Full normal suite exec60370EXIT0:872filesPASS19SKIP;10589testsPASS,2expectedFAIL,448SKIP,0unexpectedFAIL,799.56seconds. /tmp/codegraph-cjs-fix-redesign-full.log. Original portable6-case bug reproduction6/6PASS. Existing independent18-case records match em40baseline exactly. Namespace-to-value default change sync agrees with fresh index (initial no calls, synced/fresh Store::load); /tmp/codegraph-cjs-namespace-sync-probe.{cjs,jsonl}. Native kernel not validated.
+
+Personal repository/remote/identity, source checksums against preserved tested snapshot, staged3-file set and staged diff/check verified before local commit. LOCAL COMMIT d18e40970fc5fbf32f635f6d8d536d1bdb24dacc, tree2363dd0f8923ca59c28a3e45a477573e7364e7c2, branch fix/commonjs-missing-member. Tracked working tree clean; only private .review untracked. No push/fix PR/merge/deployment. Review target now `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5e0664891af0e87e6fd18bbfa16cab39237570f5..d18e40970fc5fbf32f635f6d8d536d1bdb24dacc -- CHANGELOG.md src/resolution/name-matcher.ts __tests__/js-default-binding-members.test.ts`.
+
+Third review still requires the pending user answer. User's later status question did NOT approve it. If authorized use two fresh native lanes with fork_turns=none and self-contained briefs/ledger to avoid carrying unrelated history. Preserve final tests; no redundant full rerun unless code or unresolved concerns change the tested tree. Verification and logs/source/patch are backed up under original QA .review/commonjs-fix-2026-11-08/verification.json and adjacent artifacts. Current canonical handoff handoff-codegraph-commonjs-tested-review-pending-2026-11-08.md supersedes running/constructor handoffs.
+
+## Third round authorized and running
+
+User explicitly answered yes to the third-review request, then asked why another round was needed. Explained earlier reviews covered replaced code while the tested final commit had not been independently reviewed. This question did not revoke approval. Started fresh read-only review_broad_commonjs_final3 and review_adversarial_commonjs_final3 with fork_turns=none, the exact base..d18e4097 target and this ledger, compact self-contained briefs and no full-suite rerun. Their results remain pending. Source unchanged; no push/merge/deployment.
+
+## Third round result — 2026-11-09 — NOT READY TO MERGE
+
+Exact target remains local d18e40970fc5fbf32f635f6d8d536d1bdb24dacc. Tracked tree clean, .review untracked; no source changes after passing tests. User resumed; collected broad final answer and adversarial confirmed messages. Broad lane completed normally. Adversarial lane delivered independently confirmed findings/evidence, then failed finalization with a usage-limit error (retry notice Nov9 1:10AM). Do NOT claim that lane completed normally, final clearance, or a green dual review. No push/PR/merge/deployment.
+
+### F3 — P2 — Namespace classification changes do not invalidate existing guessed calls (broad, independently confirmed adversarial)
+
+Broad location src/resolution/name-matcher.ts:25398. Start with `class Store { load() {} }; module.exports = new Store()` and an unchanged caller requiring that module and calling `.load()`. Replace the export with `exports.known = function known() {};`, retaining the class. After cg.sync(), the graph still calls Store::load; a fresh index correctly produces no call. The new module-text dependency needs to reopen existing member guesses when export shape changes.
+
+Broad reproduction /tmp/cg-broad-final3-sync-reverse.cjs; final evidence /tmp/cg-broad-final3-sync-reverse.log. Baseline comparison confirms its sync and fresh results both retained Store::load (/tmp/cg-broad-final3-sync-reverse-base.log). Adversarial independently reproduced direct and pure forwarder value->namespace->value->namespace retaining Store::load on every sync: /tmp/codegraph-cjs-final3-sync.cjs. Minimum correction recommendation: reopen default-import member guesses when imported module export text/shape changes, or record the imported source dependency on guesses allowed by a false namespace classification.
+
+### F4 — P2 — Explicitly exported callable aliases lose their calls (adversarial confirmed before usage limit)
+
+Location reported src/resolution/name-matcher.ts:25427. m.js `class Store { load() { return 42; } }\nexports.load = Store.prototype.load;`; use.js `const named=require('./m');\nexport function run(){named.load();}`. em40 calls m.js:Store::load; final emits no call. Same independently confirmed for `module.exports.load = Store.prototype.load`. Runtime named.load returns42 and Object.keys(module)=['load']. This is an explicitly exported callable, not the ruled-out direct object/default-value guessing limit. Prototype mutation variants group with the same uncertain-exports classification problem.
+
+Evidence /tmp/codegraph-cjs-final3-export-alias.cjs and /tmp/codegraph-cjs-final3-adversarial{,-base.jsonl,-final.jsonl}. Recommendation: preserve uncertain named-export RHS APIs or resolve the actual callable alias before blocking a fallback. Do not reopen arbitrary guesses for absent exports.
+
+### F5 — P2 — Out-of-scope local class bypasses namespace guard (adversarial confirmed before usage limit; original finding remains open on this path)
+
+Reported location src/resolution/name-matcher.ts:25397 (guard local-class exemption, around25396). Valid CJS: m.js `exports.known=function known(){};`; use.js lines1..8:
+`const named=require('./m');`
+`function run(){`
+`if(true){`
+`class named {static missing(){}}`
+`}`
+`named.missing();`
+`}`
+`module.exports=run;`
+Final returns use.js:run::named::missing atline6, though the class is block-local and imported module has no missing. Also reproduced for a class inside TS namespace Parent. These outputs pre-exist on base, but this is a still-open original false-positive path bypassing the new guard: existing isLexicallyReachable does not establish block visibility. Recommendation: require actual enclosing lexical block visibility before exempting a class. Preserve the genuine inner/enclosing-function shadow controls.
+
+## Merge decision / next boundary
+
+HOLD d18e4097. Passing build/full/focused tests remain factual, but F3/F4 are demonstrated regressions and F5 remains an intended missing-member path. No further agents, tests, source fixes or outward actions started after these reports. Do not rerun the full suite until a changed candidate requires it. User required confirmation before subsequent steps; present this concrete review result and seek the next bounded correction/verification decision. Fourth review is not preauthorized by approval of the third; native review gate may deny round4, so stop and ask rather than bypass. Agent quota exhaustion is additional reason not to relaunch a failed lane automatically.
+
+## Corrections authorized — 2026-11-09
+
+User: if findings are separate, report them; if related, fix them. All three are related: F3/F4 regressions introduced by this guard, F5 remaining original namespace missing-member path. No new issue filing or outside bug work needed. Authorized correcting all three in this branch; no extra reviewer lane or outward action started.
+
+Fail-before tests:11 new regressions fail and24 existing pass on d18e4097, /tmp/codegraph-cjs-fix-r3-regressions-before.log. New tests cover direct and forwarded value->namespace->value->namespace sync vs fresh; explicit dotted/bracket export aliases beside a still-absent-member decoy; alias removal by sync; out-of-scope sibling-block classes vs genuine same-block inner callers; TSnamespaceclassscope.
+
+Changes: F3 uses existing typeFrom dependency tracking on byName default-import member calls, includes each pure-forwarder file; activates the existing dependency-edge reopener for JS/TS paths while keeping failed-attribute retry Python-only. F4 namespace info tracks explicit assigned member names; new guard applies only to absent names. Escaping/computed/prototype-mutated exports remain uncertain and preserve existing behavior. F5 adds existing holderScopeAt block visibility to the class-shadow exemption, retaining function lexical visibility as well. Namespace memo stores traced files/member names; cache not poisoned by depth/cycle cutoffs.
+
+First focused verification AFTER all three corrections:3files49PASS0FAIL, /tmp/codegraph-cjs-fix-r3-regressions-after.log. Includes full35-case default-member suite and memo clearing/lifetime. No existing expected assertion weakened. Pending expanded JS/Python sync controls, normal full suite/build and original6-case repro. No new commit yet; earlier full pass applies d18e4097 only. Current changed files test + name-matcher + src/index.ts + src/extraction/index.ts. No unsafe constructor inference, import-resolver unchanged. Fourth review not yet requested/launched; gate and quota limits remain applicable.
+
+## Corrected commit verified by execution — independent review pending
+
+F3 class-name path also pinned: two new uppercase Store import-alias sync cases failed when only byName answers carried dependency metadata; /tmp/codegraph-cjs-fix-r3-upper-before.log. Final correction records imported-module inputs on name-matcher default-member answers from both class-name and method-name strategies. No change to confidence/byName selection. All original regression assertions retained.
+
+FINAL source tests:16files206PASS1SKIP, including37default-membercases, JS imports/sync andPythonattribute/memo controls. Log/tmp/codegraph-cjs-fix-r3-focused-final.log. Full normal suite exec42040EXIT0:872filesPASS19SKIP,10602testsPASS2expectedFAIL448SKIP0unexpectedFAIL,771.60seconds, /tmp/codegraph-cjs-fix-r3-full.log. Explicit npm run build exec37438EXIT0, /tmp/codegraph-cjs-fix-r3-build.log. Original portable6-case bug reproducer6/6PASS, /tmp/codegraph-cjs-corrected-final-sixcases.log. Node22.22.2/kernel0WASM; native not claimed. Source checksums prove no source changes between focused/full/build/testing and commit.
+
+LOCAL CORRECTION COMMIT559c76df6afd9e40f4d617ff77caa7db4ad03955, tre eb81d2063f4e787da5cfc7d28c619078fdc86e6b6, parentd18e40970fc5fbf32f635f6d8d536d1bdb24dacc. Personalrepository/remote/identity/stagedexact4-filediff andchecks verified. Trackedtreeclean, onlyprivate.reviewuntracked. No push/fixPR/merge/deploy or issuefiling. F3/F4/F5 status CORRECTED+executionPASS, awaiting independent verification; do not claim native review clearance.
+
+FOURTH ROUND ANSWER PENDING: async question asked permission and quoted ~/.codex/AGENTS.md: "where Claude's gate would ask the user at round 4, Codex denies, so stop and ask." User has not answered that new question; elapsed time is not approval. Do not launch fourth reviewers yet or modify gate state/control files. If approved use2freshread-onlynativefork_turns=none, same ledger, correction target `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff d18e40970fc5fbf32f635f6d8d536d1bdb24dacc..559c76df6afd9e40f4d617ff77caa7db4ad03955 -- src/resolution/name-matcher.ts src/index.ts src/extraction/index.ts __tests__/js-default-binding-members.test.ts`. Brief F3-F5, currentcorrections+invariants; no fullsuite rerun unless changes/failures justify it. Stop/ask if gate denies; last third adversarial lane failed finalization due usage cap, don't fabricateclearance.
+
+Durable original-workspace backup .review/commonjs-fix-2026-11-08/corrections-2026-11-09/:4sourcefiles, corrections.patch, checksums.json, before/after/focused/full/build/reprologs, verification.json identifyingfinalcommit/tree/outcomes, verified commonjs-fix.bundle containingbothlocalfixcommits with originalbase5e066489prerequisite. Commit recovery does not depend on /tmp survival. Current canonical handoff handoff-codegraph-commonjs-corrected-review-pending-2026-11-09.md supersedes corrections-running and review-blocked handoffs. OriginalT0unchanged/stopped; Tuesdayconditionalupstreamreport unchanged.
+
+## Fourth verification and modular correction — 2026-11-09
+
+User asked whether errors remain and approved proceeding, specifically requesting a smaller modular strategy for any remaining fix. Two fresh read-only minimal-context lanes review_broad_commonjs_verify4 and review_adversarial_commonjs_verify4 completed. BOTH independently CLEARED F3 direct/forwarded sync for ordinary and class-name aliases; F4 dotted/bracket callable/prototype aliases and removal sync; F5 block/namespace visibility and genuine inner shadows. Adversarial also verified Python failed-call retry/retyping and zero Python retry on JS-only edits. No full/build reruns or source edits by reviewers.
+
+F6 — P2 — src/resolution/name-matcher.ts:25444 raw exported-member discovery accepts comments, strings, regex literals, and unrelated object properties. With m.js exporting only known, adding `// exports.missing = fake;` or `function setup(holder) { holder.exports.missing = 42; }` makes named.missing falsely call decoy.js:Decoy::missing. Clean source has no call. Quoted/template/regex variants reproduce. This is newly added member inclusion, not the previous conservative default-text exclusion ruling. Exact broad evidence /tmp/cg-broad-verify4-classifier.{cjs,log}, /tmp/cg-broad-verify4-probes.cjs; adversarial /tmp/codegraph-cjs-verify4-extra.cjs. Both recommended one isolated token-aware collector validating executable assignments and bare exports/module.exports roots.
+
+Following user's authorized strategy: extracted readCommonJsExportMembers into new48-line(initial) src/resolution/commonjs-export-members.ts, with independent __tests__/commonjs-export-members.test.ts. Replaced matcher raw member/escape scanning with one helper call. Uses exact pinned production js-tokens9.0.1 (CommonJS, built-in types,16071unpackedbytes per officialnpmmetadata), no hand-written lexer or changedsharedstrip-comments scanner. Existingnamespace/default ownership tracing, sync/typeFrom and holderScopeAt behavior retained. Newpackage9chosen to keep CJS compatibility; upstream latestREADME refers to newerESMrequirebehavior. Source tokenizer was verified from officialrepo docs and installed package/types. No Node/packageversionbump.
+
+Fail-before graph regressions:8FAIL/37SKIP on559c76df, /tmp/codegraph-cjs-modular-before.log. New helper independently tests executable dot/bracket writes, template expressions/nesting, TSgenerics, JSXtext-vs-expressions, line/block comments, strings/templates/regex/control-regex, unrelated/Unicode/dollar roots, equality/typequeries, uncertain/prototype/computed APIs. Initial4files89PASS. Additional2positive runtime-API controls (literal eval export and require.cache default) exposed2FAIL before uncertainty handling; /tmp/codegraph-cjs-modular-uncertain-before.log. Added explicit uncertainty for literal eval code and Node module/cache APIs, preserving genuine dynamic exports while ordinary data remains opaque. All existing expected assertions retained.
+
+Latest modular focused gate18files260PASS1SKIP, /tmp/codegraph-cjs-modular-expanded-final.log; includes47default-member graph cases,38pure helper cases, priorJS/Python/sync/memo/lazy-engine controls. Source remains dirty relative559c76df in6files: newhelper/newunit test (intent-to-add makes visible in Gitdiff), existing integrationtest/matcher and package.json/package-lock. No new commit yet. No outwardactions. Full current modular suite/build still pending; parent10602PASS does not cover new modular code.
+
+User's conditional approval includes correcting any residual error with this smaller strategy and verifying it. Next fresh verification target is559c76df..working tree, sameledger and6paths; keep native round count honest (fifthverification), no target/state reset. Stop/ask if host gate denies; do not bypass. Review ONLY F6 closure and regressions of helper/adapter/dependency, plus bounded preservation checks. Source stable after260focusedPASS; no repeatedfull/build by reviewers. Prefer existingdist+scratch probes; underlyingthree corrections already independently cleared.
+
+
+## Fifth verification — modular source reader, 2026-11-09
+
+Fresh read-only lanes review_broad_commonjs_modular5 and review_adversarial_commonjs_modular5 both completed. Both cleared F6 phantom comments/strings/templates/regex and unrelated roots, plus preservation of real aliases, sync, scope and Python behavior. Production js-tokens9.0.1 packaging compatibility cleared. No source edits or redundant full-suite runs by reviewers.
+
+F7 — P2 — src/resolution/commonjs-export-members.ts:37 recognizes eval uncertainty only when a bare eval immediately receives a StringLiteral. Both reviewers reproduced template-literal eval dropping a real Store::load call. Adversarial additionally reproduced `(eval)('exports.load = Store.prototype.load;')`. Both runtime mutations return42; previous reader preserves Store::load, current reader emits no calls. Literal single-quoted bare eval control remains green. Evidence /tmp/codegraph-cjs-adversarial5-eval.{cjs,log}. Fix only the small helper: account for grouped bare eval callee and template literals, preserve class method named eval as non-call text. Add fail-before controls; do not alter name-matcher, sync or scope corrections for F7.
+
+Pre-F7 modular full normal suite EXIT0, 873 files PASS19SKIP, 10650 tests PASS2expectedFAIL448SKIP0unexpectedFAIL,780.27sec. /tmp/codegraph-cjs-modular-full.log. This run does not cover the upcoming F7 correction. Current source remains local and dirty relative559c76df. No push, source PR, merge, deployment or upstream report. Original T0 pilot remains stopped/uncommitted.
+
+
+F7 correction: literalEvalCall now unwraps paired bare-callee parentheses and grouped arguments, accepts StringLiteral/NoSubstitutionTemplate/TemplateHead. Does not execute eval or inspect data token contents; method declaration named eval remains ignored. Added4 pure-reader controls and2 graph positives. Before change:6FAIL85PASS (/tmp/codegraph-cjs-modular-eval-before.log); after:91PASS across2files (/tmp/codegraph-cjs-modular-eval-after.log). git diff --check PASS. No changes to the matcher adapter, sync or scope for F7. Full-suite PASS above predates this correction; normal final full suite and independent review of the F7 correction remain pending. Local changes uncommitted. Build result pending.
+
+Explicit final F7 npm run build EXIT0, /tmp/codegraph-cjs-modular-eval-build.log; viewer,29grammars,runtime and dist engine checks PASS. Final full suite and independent F7 verification still pending; do not conflate pre-F7 full pass with final-tree clearance. Checkpoint backup .review/commonjs-fix-2026-11-08/modular-eval-2026-11-09/ in original QA workspace contains6current sourcefiles, cumulative and modular patches, hashes, logs and this ledger. Source unchanged since91focusedPASS/build.
+
+
+## Sixth verification authorized and running — 2026-11-09
+
+User explicitly answered yes to final verification. Fresh read-only native lanes review_broad_commonjs_eval6 and review_adversarial_commonjs_eval6 launched against559c76df..workingtree six modular paths and same ledger. No gate reset/bypass or Claude-only skill claim. Both focus F7 closure and neighboring invariants; no full/build reruns by reviewers. Parent full normal CODEGRAPH_KERNEL=0 npm test -- --maxWorkers=4 runs session5033, /tmp/codegraph-cjs-eval6-full.log. Snapshot hashes /tmp/codegraph-cjs-eval6-frozen.json. No final results yet. Final explicit build before this full run passed; test setup refreshed engine assets itself. No source changes during review/tests, no outward actions. Personal origin/identity rechecked: inth3shadows/codegraph, Eric Minish / eric.minish@gmail.com. Current six modular files remain uncommitted.
+
+
+## Sixth verification result — 2026-11-09 — NOT READY TO MERGE
+
+Both fresh read-only lanes completed normally. Adversarial CLEARED F7: original3 runtime/graph forms plus11 additional runtime-backed graph controls preserve real exports and reject inert eval-looking data/method declarations. Evidence /tmp/codegraph-cjs-adversarial6-eval.{cjs,log}. Broad independently passed13 intended F7/nearby controls, but found F8 in the correction. No source edits/build/full reruns by reviewers. No final dual clearance.
+
+### F8 — P2 — literalEvalCall mistakes function-argument parentheses for grouped eval callees (broad)
+
+Reviewer location src/resolution/commonjs-export-members.ts:20, loop lines20-24. Exact input:
+
+```js
+exports.known = function known() {};
+function wrap(value) { return function ignore(code) {}; }
+wrap(eval)("ignored");
+```
+
+Runtime exports only known. Current reader returns uncertain:true, making named.missing() falsely resolve to decoy.js:Decoy::missing. Restoring only the pre-F7 literal-eval check in memory returns uncertain:false and no call. wrap((eval))(("ignored")) also reproduces. Evidence /tmp/cg-broad-verify6-callee-compare.log, adjacent .cjs; initial probe /tmp/cg-broad-verify6-callee-context.{cjs,log}. Broad passed all13 intended controls including grouped direct eval, templates, method named eval, real template-expression exports and callable aliases. Adversarial's bounded probes did not include this counterexample; its clearance does not override the demonstrated defect.
+
+Parent full suite intentionally stopped with SIGINT after confirmed F8; exact cwd/argv guarded signal to only isolated checkout main Vitest, tool session5033 EXIT130. /tmp/codegraph-cjs-eval6-full.log is PARTIAL, NOT a full pass/failure result. Avoid wasting a known-defective verification cycle. Prior91focusedPASS and explicit buildPASS remain true for this source, prior10650fullPASS predates F7 and cannot clear current tree. SHA256 snapshot recheck confirms all6 reviewed source paths unchanged during verification. No new source commit, push, fixPR, merge, deployment, version/tag/npm or upstream report.
+
+Stop this correction cycle and report F8. User yes authorized final verification, not another correction/review cycle or publishing. Need user decision before next step, as previously requested. Durable evidence in original QA .review/commonjs-fix-2026-11-08/final-verification-2026-11-09/. Previous modular-eval source/patch backup still matches frozen source. Keep original T0 stopped/uncommitted. Do not reset review count/gate or rewrite control files.
+
+
+## Seventh native dual review result — PR29 — 2026-11-09
+
+Both fresh read-only lanes completed normally: review_broad_pr29_round7 and review_adversarial_pr29_round7. Exact target remains5d384989957c91b482068b306535437915a0595b..87576a8d9ff0d8aba235db5535f5f4429f14b037. Source hashes verified unchanged, trackedtreeclean except private untracked.review. No source edits/build/fullsuite reruns/commits/pushes/GitHubcomments/merge/deploy. Both PRs remain draft. Current review DOES NOT CLEAR PR29 despite prior101focusedPASS/full10666PASS/buildPASS. Parent merges findings from actual final reports without re-verifying/re-reading diff.
+
+### F9 — P2 — Preserve grouped direct eval in control-statement bodies (BOTH)
+
+Broad location src/resolution/commonjs-export-members.ts:31: rejects any preceding ), including a completed if or for condition. Exact input `class Store { load() { return 42; } }
+if (true) (eval)('exports.load = Store.prototype.load;');`. Runtime exports load() returning42, but current discovery uncertain:false and indexing named.load() produces no call. Removing only new prefix guard in memory restores uncertain:true and m.js:Store::load. Nested grouped eval in unbraced single-iteration for body reproduces too. Broad evidence /tmp/cg-broad-pr29-control-context.{cjs,log}; exact command `node --experimental-wasm-exnref --experimental-wasm-stack-switching /tmp/cg-broad-pr29-control-context.cjs`.
+
+Adversarial independently confirms same location/trace; grouped-template if-body and for-body also reproduce. Evidence /tmp/codegraph-cjs-adversarial7-conditional-eval.{cjs,log}. De-duplicated as one P2 F9. This is a NEW regression introduced in PR29, not a pre-existing parent limitation.
+
+### F8 — P2 — PARTIALLY CORRECTED, remains for contextual-keyword wrapper names (adversarial)
+
+Exact reviewer location src/resolution/commonjs-export-members.ts:29 (whitelist:7). Valid CommonJS `function await(value){return function ignore(code){};} await(eval)("ignored");` passes eval without invoking it, but whitelist exemption produces uncertain:true and falsely resolves named.missing() to decoy.js:Decoy::missing. With exports.known=function known(){}, runtime exports only known; pre-F7 behavior restored in memory produces no call. yield reproduces too. Evidence /tmp/codegraph-cjs-adversarial7-contextual-wrapper.{cjs,log}. This is a RESIDUAL F8 variant, not a new unrelated parent re-audit. Do not label all F8 closed.
+
+### Confirmed preservation / rulings
+
+Both independently clear original F8 forms wrap(eval)("ignored") and wrap((eval))(("ignored")): runtime onlyknown, reader uncertain:false, no decoy call. Broad /tmp/cg-broad-pr29-f8-closure.{cjs,log}. Adversarial13runtime-backed graph controls pass (original2forms +11nearby controls), /tmp/codegraph-cjs-adversarial7-controls.log. True standalone grouped/template eval, return expressions, inert data/method declarations, call/member/optional/tag/condition-prefix negatives retain tested behavior. These controls do not answer F9 control-body context or F8 await/yield wrappers.
+
+### Next boundary
+
+Review-only user request is complete. STOP: no fixes, additional review loop, external review comment, markready, merge or deploy without user instruction. The per-step confirmation request remains in force. This is round7 overall; no gate/state reset. Repeated grouping-prefix patches now demonstrate syntax-context ambiguity: if user asks for remediation, choose an evidence-based smaller boundary/design instead of another unbounded keyword/punctuation whitelist. Preserve both concrete repros and all prior controls. Do not repeat fullsuite/build on unchanged source. Actual durable result/evidence/checksums saved in original QA .review/commonjs-fix-2026-11-08/pr29-review-round7-2026-11-09/.
+
+
+## AST redesign approved and started — 2026-11-09
+
+User explicitly approved AST redesign in PR29, said near usage max and asked for a resumable start, then said proceed. This revokes prior review-only stop for in-scope remediation; do not ask same approval on resume. Preserve per-step/user and actual gate boundaries for later merges/deployments. No grammar/runtime/dependency/database-schema changes, commits or pushes in this partial phase; PRs remain draft at prior heads.
+
+Newgraph regressions FIRST:3control-body direct-eval variants(if string/template, for nestedgroups) +await/yield CommonJS wrappers,5FAIL51SKIP on current87576a8d. /tmp/codegraph-cjs-ast-red.log, EXIT1. This intentionally RED gate remains unchanged because integration pending.
+
+New isolated src/extraction/commonjs-eval.ts reads existing SyntaxNode tree and checks actual call.function after unwrapping parenthesized_expression. Returns true for syntacticdirectevalcall(anyargument), false for provenabsence, null for parseerrors with no foundcall. New __tests__/commonjs-eval.test.ts loads existingJS/TS/TSXgrammars:33PASS, /tmp/codegraph-cjs-ast-helper.log EXIT0. Controls cover reports, grouped/interpolated eval, return, generatorfunctions/methods, nestednongenerator scope, eval inside yieldwrapper argument, inert data/methods/membercalls, JSX and malformedsource. Helper not wired to classifier/extraction yet. Existing lexical reader/EXPRESSION_PREFIX_WORDS unchanged for now. Do not claim F8/F9 closed, new full/buildpass or finalreview.
+
+IMPORTANT new evidence: existingJSgrammar correctly models control-body eval and awaitwrapper but parses legal CommonJS yield(eval)(code) as yield_expression whose operand is a call on(eval), no parseerrors. ASTscope must distinguish nongeneratorwrapper from generator yield. Helper handles direct yieldoperand only via nearestfunction/generator/methodscope; nested true eval in yield(eval(code)) remains detected. Shapeprobe /tmp/codegraph-cjs-ast-shape-probe.{cjs,log}. Extractionreferenceprobe /tmp/codegraph-cjs-eval-reference-probe.{cjs,log} shows currentextractor emits callref eval for genuinecall AND synthetic yieldwrappercase. Consequently raw existing unresolved eval refs alone are insufficient. User was explicitly told this grammar limitation, not falsely assured all cases are parser-perfect. No grammarfiles changed.
+
+Next integrate factualcallresult through existingextraction to resolver. Node has NO metadata field (onlyedges do); do not invent Node.metadata, abuse signature/selfedges/candidates, or introduce schema migration casually. ExtractionResult can carry optionalfact through workerclone; need native/deferred bypass parity. Main bulk parse pools only load grammars in workers; resolver cannot assume synchronous getParser is ready in main. Suggested project_metadata perfile/sourcehash transport or another small explicit extractioncontext capability; persist/refresh under same successfulstore lifecycle, cover storeworker and sync. Decide carefully before editing infrastructure. Resume must preserve all existing tests and5newred cases; unknown/missing/error facts must not masquerade as provenabsence. Keep existing export-member tokenizer and previous sync/scope/alias fixes intact; remove prefixheuristics only onceASTfacts actuallysupplied.
+
+Saved current3sourcefiles, patchrelative87576a8d, hashes, red/green/probe logs under original QA .review/commonjs-fix-2026-11-08/ast-redesign-started-2026-11-09/. No tests/build/reviewers running at checkpoint. Newfiles intent-to-add only so diffincludes them, not readyforcommit. No fresh dualreviewagents this phase. Overall reviewcount7; do not reset gate/controlstate. Resume directly integration and targeted tests; fullsuite/build only after stablefix, fresh focuseddual review as authorized/actualgatepermits, no repetitivewholeprojectwork. OriginalT0stillstopped/uncommitted; liveem40 unchanged; no merges/deploy/upstream writes.
+
+
+## Eighth native review COMPLETED — AST correction NOT CLEARED
+
+Both fresh read-only reviewers completed normally on frozen15-file87576a8d..workingtree correction. Both confirm no source edits/build/full reruns/control changes; source hashes unchanged. No final normalbuild/fullsuite run or commit/push. PublishedPR28/29 remain drafts at5d384989/87576a8d. Prior166focusedPASS1SKIP is true and covers original5reportedgraphcases, but does not clear new findings. Nativebinary absent, no nativeexecutionclaim. Parent uses actual reports, no independent duplicate repro/diffread.
+
+### F10 — P2 — Optional contextual-keyword wrappers regress (adversarial)
+
+Exact reviewer location src/extraction/commonjs-eval.ts:37. Valid CommonJS:
+
+```js
+exports.known = function known() {};
+function yield(value) {
+  return function ignore(code) {};
+}
+yield?.(eval)("ignored");
+```
+
+Runtime exports only known; eval is never invoked. Existing grammar reports parse error, helper returns null, reader marks exports uncertain, and named.missing() falsely calls unrelated decoy.js:Decoy::missing. Actual current correction calls:[decoy.js:Decoy::missing]; base87576a8dreader restored in memory calls:[], uncertain:false. Evidence /tmp/cg-a8-yield-optional.{cjs,log}, /tmp/cg-a8-yield-optional-base.{cjs,log}, /tmp/cg-a8-probe.cjs. New F8-adjacent regression introduced by AST correction. Unknown fact correctly avoids false absence proof but must not license false call targets; current fallback still does.
+
+### F11 — P2 — Computed method names use enclosing scope (broad)
+
+Exact reviewer location src/extraction/commonjs-eval.ts:51. Treats a computed method name as belonging to that method's function scope. Computed names execute in enclosing scope. Confirmed both directions:
+
+1. `class Store { load(){return 42;} } function* setup(){ const obj = { [yield (eval)('exports.load = Store.prototype.load;')]() {} }; } setup().next();` Runtime exports load()->42, currentfactfalse/uncertainfalse, named.load() graphcalls[]. Ordinary computedmethodkey inside outergenerator suppressesgenuineeval.
+2. `exports.known=function known(){}; function yield(value){return function ignore(code){return 'x';}} const obj={ *[yield(eval)("ignored")](){} };` Runtime keysonlyknown, currentfacttrue/uncertaintrue, named.missing() falselycallsDecoy::missing. Generator methodkeyevaluatesoutsidegeneratorbody, so yieldiswrapperhere.
+
+One rootcause/twoexecutiontraces, evidence /tmp/cg-broad-pr29-ast8-computed-scope.{cjs,log}, executed againstcurrentdist with CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2. All15frozenhashesmatch.
+
+### Stop boundary and saved state
+
+Approved redesign progressed to166focusedPASS + real-worker/store/sync/factlifecycle integration, then focusedverifyfoundthese2P2. STOP before anothercorrectioncycle per dual-reviewworkflow/userper-stepconfirmation. Don't spendfullsuiteonknowndefectivecode orpushasready. Usermustdecidenextstep; noautomaticnewreview/fix/merge/deploy. Overallcount8, noreset. Nextremediationifapproved: computedmethodscope must excludecomputedkeys fromnewmethodscope; parseerrorunknown mustnotenableinventedfallbackcalls (requires explicitresolutionpolicy, not anotherkeyword/punctuationguess). Preserve all originalregressions and33ASTcontrols, truealiases/sync/scope/Pythonbehavior. No grammarfiles/schema/deps changed; source remains15dirtypaths, notcommitted. Durablebackup includes allsources/patch/logs andnewreviewevidence, verificationresult/checksums.
+
+
+## F10/F11 corrections approved and execution-verified — independent verification pending
+
+User explicitly answered yes to correcting the two eighth-review findings. Current HEAD87576a8d and15dirtysourcepaths retained; no newcommit/push/merge/deploy/grammar/schema/dependencychanges.
+
+Fail-beforetests:2ASTcomputed-key cases,3graphfindingcases,positivealiascontrol andunknownparse syncstep. Actual2files6FAIL90PASS beforefix, /tmp/codegraph-cjs-ast-f10-f11-before.log EXIT1. Positive explicitcallablealias underunknownparsealreadyPASS beforefix, mustkeep.
+
+F11fix: method_definition suppliesfunctionscope onlywhen calllieswithin ASTbodyorparametersregions. Computednames/decorators useenclosingscope; no newkeyword/punctuation guesses. Bothcomputedkey directionsfixed. F10fix: tokenizer resultrecords evalUnknown separatelyfromuncertain/namespace. Moduleinfo propagatesunknownflag, includingexistingforwarderspread. Themethod-nameguessgate stopsunprovenmatchesforunknown-evalexportswithoutclaimingnamespace/memberabsence; explicitwrittenmemberaliasesremainallowed, andearlierprovenreceiver/typepathsremainunchanged. UnknownASTfactstillnull, no falseparse-success/intrinsicproof. Existingmembertokenizer andfacts/hash/storelifecycleremainunchanged.
+
+Expanded8files172PASS1SKIP EXIT0, /tmp/codegraph-cjs-ast-f10-f11-after.log, CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2. Coversallprevious166checks plusnewcomputed-keyAST/graphcases,optionalcontextualwrapper,realexplicitcallablealiasunderunknownparse,andfreshindex-v-syncincludingknownactualeval->unknownwrapper->actualeval transitions. One skip is nativekerneltransport; nativebinarynotstaged,no nativeexecutionclaim. A matchercommentclarifyingunproven-callpolicyupdatedaftertest; no behaviorchangedafterthispassingrun. gitdiff--checkPASS. No explicitnormalbuild/fullsuite oncurrentcorrection; old10666fullPASSbelongs875only.
+
+Currentcorrectionvsround8snapshot changes5files: ASThelper,exportreader,matcher,ASTtest,graphintegrationtest. Durablebackup originalQA .review/commonjs-fix-2026-11-08/ast-f10-f11-corrected-2026-11-09/ includesall15sourcefiles,currentSHA256,cumulativepatchrelative875,small5filedeltafromround8,fail-before/passafterlogs,verificationmetadata. F10/F11 statusCORRECTED+focusedPASS, NOTindependentlycleared. Overallreviewcount8unchanged,noround9agentslaunched. Userper-stepconfirmationrequiresdecisionbeforefreshfocusedverify; don'tspendnewfull/reviewcycleunasked. No sourcecommit/pushyet; PR28/29remainDRAFT/unmerged. Ifuserapprovesnextreview: exactGitdiff875..workingtree +round8delta/sameledger, freshread-onlynativebroad/adversarial, boundedprobesonly,norepeatfull/build. Respectactualgate/noreset. Runfinalnormalbuild/fullonceonlyafterreviewstable. PreserveT0stopped/uncommitted; liveem40unchanged; noofficialupstreamwrite.
+
+
+## Ninth native focused verification completed — F10/F11 cleared, F12 remains
+
+User explicitly authorized thisverificationround. Both fresh read-only lanes review_broad_pr29_f10_f11_9 and review_adversarial_pr29_f10_f11_9 COMPLETED normally on same87576a8d..workingtree15path target and sameledger. Source hashes stillmatch approvedcorrectedsnapshot; no sourceedits/rebuild/fullsuite/controlchanges/networkwritesbyreviewers. No sourcecommit/push/merge/deploy. BothpublishedPRsremaindraftunchanged.
+
+F10/F11 originals independently CLEARED by BOTH: optionalcontextualwrapper nofalsecall; computedkeygenuineevalinsideoutergenerator keepsStore::load; generatormethodkeynongeneratorwrapper nofalsecall. Broad11runtime-backedprobesPASS includingclass/nestedcomputedkeys,generator/nongeneratorbodies,explicitcallablealiasunderunknownfactandgenuineevalcontrols. Evidence /tmp/cg-broad-pr29-ast9-verify.{cjs,log}. Adversarial also confirmsnestednongenerator/gettercomputedkeycontrols. ThesecontrolsdoNOTclearrootwhole-valueexportsbelow.
+
+### F12 — P2 — Unknown eval facts suppress genuine root exports (adversarial)
+
+Exact reviewer location src/resolution/name-matcher.ts:25403. Valid m.js:
+
+```js
+class Store { load() { return 42; } }
+module.exports = { load: Store.prototype.load };
+function yield(v) { return function ignored() {}; }
+yield?.(eval)("ignored");
+```
+
+Caller const named=require('./m'); function run(){named.load();}. Runtime named.load() returns42; currentindexcalls:[]. Readerrecordsnomembersfortherootobjectassignment; newevalUnknowngatedropsthegenuinecallablealias. module.exports=new Store() reproduces too. RemovingONLYnewevalUnknownconditioninmemoryrestoresm.js:Store::loadforbothidenticalinputs. Directexports.load=Store.prototype.loadcontrolstillpasses. ThisisNEWregressionintroducedbyF10correction. Evidence /tmp/cg-a9-root-export-regression.cjs, /tmp/cg-a9-root-export-current.log, /tmp/cg-a9-root-export-oldgate.log. Broadclearedlimitedcontrolsbutdidnotprobeequivalentrootexports; no contradictoryexecutionresult.
+
+STOP/reportmergedfindingonly; useryesauthorizedfocuseddualverify, notanotherunaskedcorrectioncycle. OriginalF10/F11closedatthissnapshot; F12OPEN. No finalreviewclearanceorreadyformergeclaim. No explicitnormalbuild/fullsuiteoncurrentdirtyASTcorrection;172focusedPASS1SKIPremainsactualbutmissesF12. Old10666fullPASSbelongs875only. No test/build/reviewerprocessesrunning. Needuserdecisionbeforefix; preserveactualmodule-valueexportswhileblockingunprovedunknown-evalguesses, notanotherpunctuation/keywordheuristic. Overallcount9honest,noreset/gatebypass. Durableevidence/ledger/resultsavedunderoriginalQA .review/commonjs-fix-2026-11-08/pr29-review9-2026-11-09/; current15sourcefilespatchesremainin adjacentast-f10-f11-correctedbackup. T0/liveem40unchanged, noofficialupstreamwrite.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-review9-2026-11-09/merged-review.md b/docs/handoffs/pr29-2026-11-10/history/pr29-review9-2026-11-09/merged-review.md
new file mode 100644
index 0000000000..9ec7e23c52
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-review9-2026-11-09/merged-review.md
@@ -0,0 +1,22 @@
+
+
+## Ninth native focused verification completed — F10/F11 cleared, F12 remains
+
+User explicitly authorized thisverificationround. Both fresh read-only lanes review_broad_pr29_f10_f11_9 and review_adversarial_pr29_f10_f11_9 COMPLETED normally on same87576a8d..workingtree15path target and sameledger. Source hashes stillmatch approvedcorrectedsnapshot; no sourceedits/rebuild/fullsuite/controlchanges/networkwritesbyreviewers. No sourcecommit/push/merge/deploy. BothpublishedPRsremaindraftunchanged.
+
+F10/F11 originals independently CLEARED by BOTH: optionalcontextualwrapper nofalsecall; computedkeygenuineevalinsideoutergenerator keepsStore::load; generatormethodkeynongeneratorwrapper nofalsecall. Broad11runtime-backedprobesPASS includingclass/nestedcomputedkeys,generator/nongeneratorbodies,explicitcallablealiasunderunknownfactandgenuineevalcontrols. Evidence /tmp/cg-broad-pr29-ast9-verify.{cjs,log}. Adversarial also confirmsnestednongenerator/gettercomputedkeycontrols. ThesecontrolsdoNOTclearrootwhole-valueexportsbelow.
+
+### F12 — P2 — Unknown eval facts suppress genuine root exports (adversarial)
+
+Exact reviewer location src/resolution/name-matcher.ts:25403. Valid m.js:
+
+```js
+class Store { load() { return 42; } }
+module.exports = { load: Store.prototype.load };
+function yield(v) { return function ignored() {}; }
+yield?.(eval)("ignored");
+```
+
+Caller const named=require('./m'); function run(){named.load();}. Runtime named.load() returns42; currentindexcalls:[]. Readerrecordsnomembersfortherootobjectassignment; newevalUnknowngatedropsthegenuinecallablealias. module.exports=new Store() reproduces too. RemovingONLYnewevalUnknownconditioninmemoryrestoresm.js:Store::loadforbothidenticalinputs. Directexports.load=Store.prototype.loadcontrolstillpasses. ThisisNEWregressionintroducedbyF10correction. Evidence /tmp/cg-a9-root-export-regression.cjs, /tmp/cg-a9-root-export-current.log, /tmp/cg-a9-root-export-oldgate.log. Broadclearedlimitedcontrolsbutdidnotprobeequivalentrootexports; no contradictoryexecutionresult.
+
+STOP/reportmergedfindingonly; useryesauthorizedfocuseddualverify, notanotherunaskedcorrectioncycle. OriginalF10/F11closedatthissnapshot; F12OPEN. No finalreviewclearanceorreadyformergeclaim. No explicitnormalbuild/fullsuiteoncurrentdirtyASTcorrection;172focusedPASS1SKIPremainsactualbutmissesF12. Old10666fullPASSbelongs875only. No test/build/reviewerprocessesrunning. Needuserdecisionbeforefix; preserveactualmodule-valueexportswhileblockingunprovedunknown-evalguesses, notanotherpunctuation/keywordheuristic. Overallcount9honest,noreset/gatebypass. Durableevidence/ledger/resultsavedunderoriginalQA .review/commonjs-fix-2026-11-08/pr29-review9-2026-11-09/; current15sourcefilespatchesremainin adjacentast-f10-f11-correctedbackup. T0/liveem40unchanged, noofficialupstreamwrite.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-value-contract-spike-2026-11-09/README.md b/docs/handoffs/pr29-2026-11-10/history/pr29-value-contract-spike-2026-11-09/README.md
new file mode 100644
index 0000000000..c068734784
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-value-contract-spike-2026-11-09/README.md
@@ -0,0 +1,65 @@
+# Binding-owned value contract experiment
+
+This is the isolated experiment requested after the independent Astra/Sol plans. Production remains frozen at the round11 snapshot: 22 dirty paths, F14/F15 still open there. No production source, dependency, schema, grammar, index or control file was changed.
+
+## Result
+
+**99 tests pass: 24 pure value-graph tests and 75 source-contract tests.** All seven JavaScript files pass `node --check`. Actual red/green histories and milestone snapshots are preserved.
+
+The selected semantic gate passes, including F10–F15. The standalone source adapter **does not pass a broader coverage gate**: all three installed Commander files tested return unknown because unsupported destructured initialization invalidates the default export too broadly. This is a concrete reason not to promote the adapter wholesale.
+
+## Contract
+
+`ContractWorkspace.lookup(file, path)` returns independent results:
+
+- `reference`: known storage/declaration ownership, absent, or unknown. A data export can retain its binding reference even when its runtime value is unknown.
+- `callable`: a positive implementation selector **and source identity**, proven non-callable, absent, or unknown with a reason.
+- `constructible`: separate from ordinary calls; a class constructor is not an ordinary callable.
+- `complete`, dependency source hashes, and analyzer version.
+
+Selectors are display labels in this experiment. `identity` and `binding` distinguish source declarations/allocations; identical display names never establish equality. Production needs explicit source-range-to-CodeGraph-node mapping. A positive value without an indexed selector cannot produce a graph edge.
+
+Bindings and property slots point to values. Object/class/function identities retain explicit expando writes and share them through aliases. Rebinding an alias preserves the original object's identity. Strong overwrites replace prior facts; writes through uncertain receivers are weak. Branch alternatives must agree on implementation identity before proving a callable. Unknown keys and escapes invalidate affected properties; they never authorize name guessing or stale callable reuse.
+
+An absent property and an exported `undefined` value are distinct: evaluating a missing property as a value yields undefined; a new export containing that value is non-callable rather than absent.
+
+## What is tested
+
+- F14 object/class/function property assignment before whole-value export.
+- F15 numeric/string data exports, data references, and callable reassignment to an actual function body rather than a variable declaration.
+- Original F10/F11 optional wrappers and generator/computed-key literal eval; F12 root/parenthesized/logical exports; F13 function/arrow/block shadowing.
+- Direct and relative-forwarded modules, alias mutation/rebinding, property/binding overwrites, post-export writes, branch agreement/conflict, uncertain receiver writes, escapes and dynamic keys.
+- Separate constructor/call capabilities, same-named distinct declarations, indirect/optional/local eval handling, and synthetic eval declarations lacking indexed bodies.
+- Source updates compared with a fresh workspace. This is not CodeGraph's actual incremental sync.
+
+Runtime witnesses use actual CommonJS wrappers for controlled fixtures only. Unknown-control-flow fixtures are deliberately not executed. No project or dependency JavaScript is executed by the analyzer.
+
+## Files and replay
+
+- `value-graph.cjs`: independent binding/property/value/capability representation.
+- `source-contract.cjs`: bounded syntax-to-fact transfers, using the reused compiler binder and lexical eval expansion. It executes no functions or generators.
+- `bindings.cjs`: TypeScript 5.9.3 lexical identities via `resolveName`, source mapping and public syntactic diagnostics.
+- `runtime.cjs`: controlled-fixture runtime oracle.
+- `*.test.cjs`, `final-tests.tap`: fixed contract/fixture acceptance tests.
+- `measure.cjs`, `measurements-*.json`: read-only source analysis measurements.
+- `progress.json`, `results.json`, snapshots and TAP logs: progress and actual failures.
+
+From this directory:
+
+```bash
+node -e 'require("./value-graph.test.cjs"); require("./source-contract.test.cjs")'
+node --expose-gc measure.cjs baseline
+node --expose-gc measure.cjs contract
+```
+
+The existing checkout supplies TypeScript. Set `CODEGRAPH_PROTOTYPE_REPO` for the binder if it moves; the measurement script also names the original checkout explicitly. No packages were installed. Restore the frozen production dist/dependencies before replaying the baseline comparison.
+
+## Limits and decision
+
+This is a bounded def-use/value experiment, not complete JavaScript analysis. Source lowering supports selected synchronous declarations/assignments and static potential literal-eval relationships. It neither proves generator invocation nor exact runtime exports. Arbitrary function return values, construction/inheritance effects, reflective behavior, many declaration forms and broader module semantics remain unknown. Unindexed declarations introduced inside eval supply no indexed body/constructor selector.
+
+Custom constructors, inheritance and class prototype descriptor replacement are explicitly unknown instead of yielding fabricated class-method calls. Loops and unsupported statements are conservative; the current whole-default invalidation is broader than the desired localized production policy. Destructuring on real dependency sources demonstrates that gap.
+
+The package-file measurements cover Commander sources of 812, 10,289 and 87,209 bytes, in separate sequential processes for baseline and experiment. They are analyzer-only, not real-project indexing, workers, graph queries, sync, native parity or a production performance acceptance bar. Output contracts differ. Initial concurrent measurements are kept separately; final measurements are sequential.
+
+**Recommendation:** reuse the tested value/capability representation and corpus when adapting the existing production collector. Preserve its broader source handling and lexical eval adapter; replace declaration-as-callable and type-shape-as-write-ledger assumptions. Do not replace production with this standalone adapter. Real CodeGraph node mapping, existing-suite compatibility, real sync/dependencies and representative project performance remain integration gates. No fresh review or publication was performed.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-value-contract-spike-2026-11-09/handoff-codegraph-pr29-value-contract-complete-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/history/pr29-value-contract-spike-2026-11-09/handoff-codegraph-pr29-value-contract-complete-2026-11-09.md
new file mode 100644
index 0000000000..e7bc45abd6
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-value-contract-spike-2026-11-09/handoff-codegraph-pr29-value-contract-complete-2026-11-09.md
@@ -0,0 +1,36 @@
+# PR29 isolated value contract experiment complete —99pass, adapter coverage gate fails
+
+Authoritative checkpoint. User said "proceed" after independent Astra/Sol plans converged. Parent announced a bounded isolated contract experiment and kept production unchanged. User's save-as-you-go instruction persisted. No production integration, new review, build/fullsuite, dependency/schema/grammar changes, commits/pushes/merge/deploy or upstream writes in this phase.
+
+## Production state
+
+Repo /tmp/codegraph-cjs-missing-fix-20261108, branch fix/commonjs-eval-callee-context, HEAD87576a8d9ff0d8aba235db5535f5f4429f14b037. All22dirtysource/package/test hashes still match round11. F14 (lost local object/class/function callable property writes before whole export) and F15 (data/variable declaration accepted as callable) remain OPEN in production. Original F10–F13 cleared at round11. Review count11; no reset. Prior631focusedPASS1nativeSKIP is historical and misses open findings. Source/patch recovery remains pr29-export-evidence-integration-2026-11-09/; review11 evidence adjacent. Preserve checkout and all work; T0/live/control/deploy files untouched. Publication/identity boundaries from session-end handoff still apply.
+
+## Experiment, durable workspace
+
+/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-value-contract-spike-2026-11-09
+
+README.md describes contract/limits; results.json/progress.json exact statuses. value-graph.cjs is independent typed value/property/binding representation (JS experiment); source-contract.cjs bounded syntax-to-fact adapter; bindings.cjs reused TypeScript5.9.3 resolveName binder with public syntactic diagnostics; runtime.cjs controlled CommonJS fixture oracle. final-source/, earlier snapshots, all red/green TAP, measurements and artifact-sha256.json saved. No packages installed. No actual project/dependency JavaScript executed; real package files were parsed only.
+
+## Actual verification
+
+Final99PASS0FAIL0SKIP:24core +75source tests, final-tests.tap. All7.cjs files passed node --check. Test command from experiment directory:
+node -e 'require("./value-graph.test.cjs"); require("./source-contract.test.cjs")'
+
+Core includes F14expando object/class/function identities; F15reference vs callable/construct capabilities; reassigned callables; shared aliases/rebinding/overwrites/post-export writes; prototype links; localized unknown/escape; branch joins and weak writes for uncertain receivers. Callable source identity is distinct from display labels, so same-named implementations cannot collapse. Unknown runtime value can retain a storage reference without acquiring callable identity. Missing property read becomes undefined when exported as a value; absence remains distinct.
+
+Source gate covers F10–F15 direct+forwarded, genuine generator/computed-key literal eval without generator execution, local module/eval shadowing, branch agreement/conflict, dynamic keys/escapes, source updates=fresh, indirect/optional eval rejection, unsupported construction/inheritance/prototype-descriptor behavior, and synthetic eval declarations with no indexed selector. Source IDs are experimental source-location identities/labels, not real CodeGraph node IDs. This does not validate actual CodeGraph sync/cache/store/worker/native paths.
+
+History is preserved:21core red baseline then21PASS;59source red baseline then55PASS4FAIL (property-name Identifier treated as wrapper reference in effect scan); generic reference-role correction. Added uncertain-receiver weak-write test (21PASS1FAIL) and identity-vs-label test (22PASS1FAIL), then green. Unsupported construction tests66PASS3FAIL before unknown guards. Reference/presence and synthetic eval selector tests red before corrections. No expectations weakened; expected positive capabilities were strengthened to require identity. See results.json for actual per-run counts rather than reconstructing from prose.
+
+## Coverage/performance screen — reason to stop before promotion
+
+Parsed installed Commander files812/10289/87209bytes, sequential separate processes baseline/current experiment, five warm samples each. No runtime execution or full repo index. Experiment medians~5.31/13.98/46.25ms, import~252ms, retained heap delta~22.11MiB. These are analyzer-only and output contracts differ; no production performance acceptance or semantic parity claim.
+
+All THREE real files returned unknown reference/callable, incomplete, reason "destructured initialization". The adapter invalidates the whole default too broadly for unsupported declaration lowering. Thus selected semantic contract gate PASSES, standalone adapter broader coverage gate DOES NOT PASS. Do not promote it wholesale or describe production bugs as fixed. The experiment is valuable evidence for representation, not a complete JS analysis implementation.
+
+## Recommended next decision
+
+Retain tested value/capability graph and regression corpus. Adapt that representation into the existing production collector while preserving its broader binder/type/source handling and lexical eval adapter. Replace declaration-as-callable and inferred-type-shape-as-write-ledger assumptions. Keep one shared authority consumed by import resolver/guard; no global name fallback. Do not merely bolt an expando map and node-kind filter onto the old contract, and do not port this standalone statement adapter wholesale.
+
+Before claiming production readiness: real indexed-node mapping, current631focused preservation suite + F14/F15 real-graph tests, actual sync/forwarder dependencies, compiler lazy-load checks and representative project coverage/performance. Final full normal build/suite only after stable independent review per prior boundary. User decision needed for production changes/new review; this isolated phase is complete. Avoid another general interpreter or unbounded language expansion. No automatic continuation.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-value-contract-spike-2026-11-09/plan-codegraph-pr29-value-contract-spike-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/history/pr29-value-contract-spike-2026-11-09/plan-codegraph-pr29-value-contract-spike-2026-11-09.md
new file mode 100644
index 0000000000..b961f4bb6e
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-value-contract-spike-2026-11-09/plan-codegraph-pr29-value-contract-spike-2026-11-09.md
@@ -0,0 +1,14 @@
+# PR29 bounded value contract experiment — approved
+
+User said proceed after independent Astra/Sol plans converged. Scope is combined isolated contract experiment, not production integration/review/publication. Preserve22dirtypaths and round11 F14/F15 evidence. Save checkpoints after each milestone.
+
+Workspace: /home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-value-contract-spike-2026-11-09
+
+1. Fixed IR acceptance matrix before code: reference/call/construct distinctions; object/class/function property writes; data exports; reassigned callables; alias identity/rebinding/overwrites/post-export mutation; uncertain branches/escapes; localized completeness. Compiler bindings and existing recorded fixtures reused.
+2. Implement typed value/property/binding graph with independent reference/callable/constructor selectors. No general calls/interpreter or custom scope parser. Failures are contract evidence; do not weaken tests.
+3. Bounded source-to-facts adapter using existing binder and lexical eval expansion. Static potential literal-eval relationships include F10/F11 generator/computed-key cases without executing generators. Unknown supplies no name fallback or stale callable. Original F10–F15 cases mandatory; existing dynamic-eval compatibility must be explicit.
+4. Direct/forwarded source fixtures and update=fresh checks; controlled runtime oracle only. These do not claim actual CodeGraph sync/native integration. Measure only what runs; representative performance remains a later integration gate.
+5. Save all source/tests/red-green logs/contract table/results/handoff. Verify production22hashes at each checkpoint. Stop and report if mandatory coverage requires arbitrary execution or fixture-specific authority; no production edits until user decision.
+
+## Complete
+99testsPASS,7syntaxchecksPASS. Production22hashes unchanged. Representation/selected semantic gate passes; source adapter broader coverage gate fails (3Commander files unknown/destructured initialization). Do not promote adapter wholesale. Latest checkpoint: /home/ericm/.codex/plans/handoff-codegraph-pr29-value-contract-complete-2026-11-09.md . Production integration/new review remain separate decision.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-value-model-integration-2026-11-09/handoff-codegraph-pr29-value-model-integrated-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/history/pr29-value-model-integration-2026-11-09/handoff-codegraph-pr29-value-model-integrated-2026-11-09.md
new file mode 100644
index 0000000000..578ba79ad8
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-value-model-integration-2026-11-09/handoff-codegraph-pr29-value-model-integrated-2026-11-09.md
@@ -0,0 +1,39 @@
+# PR29 production value-model integration — saved and awaiting review
+
+2026-11-09. Checkout `/tmp/codegraph-cjs-missing-fix-20261108`, branch `fix/commonjs-eval-callee-context`, HEAD `87576a8d9ff0d8aba235db5535f5f4429f14b037` unchanged. Preserve checkout and every uncommitted change. User approved production integration after the isolated contract experiment. No new review, commit, push, merge, deployment, or release was authorized or performed.
+
+Implemented the binding-owned value/property graph in the existing lazy TypeScript collector, retaining its lexical binding and eval adapter. Typed source declaration selectors are separate from runtime values, storage references, callability and constructibility. Local object/class/function property writes, aliases and post-export writes retain their identity. Strong overwrites replace slots; uncertain receivers/branches join conservatively; data and unknown values cannot authorize a call. Compiler type seeding distinguishes class statics from instances and does not pre-apply expando writes from unexecuted branches. Logical assignments preserve RHS short-circuit behavior. Unsupported constructors/inheritance/prototype descriptor replacement remain unknown. No schema/grammar/dependency change was added in this phase; TypeScript runtime dependency and persisted eval facts are from prior approved work.
+
+Import resolution selects the actual exported path for default, namespace and named imports, carries reference/call/construct intent through re-exports and memo keys, and preserves typeFrom dependencies. Bare imported CommonJS calls cannot borrow a namesake global; caller shadows remain eligible for local resolution. The const-alias synthesizer now requests reference evidence for the root it reads, rather than pretending to call a class.
+
+The real sync acceptance test exposed failed forwarded calls not retrying after data becomes callable. Added a bounded failed-reference retry using the existing importer/barrel walk and binding-aware whole-module CommonJS forwarding. Positive edges retain their existing typeFrom resurrection. `src/index.ts` still reaches the new helper only through engine(); lazy read loading remains verified.
+
+## Actual final verification
+
+- Combined25files:812PASS,1nativeSKIP. Log `codegraph-pr29-value-verification.log`. Includes CommonJS/export/eval, import and alias resolution, source/type memo lifetimes, actual repeated forwarded sync edits, default export sync, and module-importer/barrel neighbors.
+- Lazy engine7PASS outside sandbox, using previously authorized exception for known child-process pipe restriction. Log `codegraph-pr29-value-lazy.log`.
+- Distinct819PASS,1SKIP over26files; no double counting supplemental runs.171production contract/core/import-boundary tests comprise24value-graph +46source/runtime contract +101real graph tests (included in812).
+- `node node_modules/typescript/bin/tsc --noEmit`:PASS. `git diff --check`:PASS. After intent-to-add made the fixture visible, trimmed one extra EOF blank line; no semantic source changed after final tests.
+- Normal standalone `npm run build` and full suite remain deferred until stable independent review, per existing boundary. Test setup rebuilt engine tsc/assets during implementation. Native kernel binary absent; no parity claim.
+- Installed Commander3-file screen retains explicit exports/forwarded class identities through destructured imports instead of globally poisoning them. Warm analyzer medians approximately8.26ms/13.92ms/64.66ms for812/10289/87209byte files. This is source coverage and analyzer timing only, not an indexing/worker/large-project benchmark. Exact JSON saved.
+
+## Failures diagnosed along the way
+
+-16new F14/F15real-boundary cases failed before implementation; all pass now, direct and forwarded.
+-Initial40PASS1FAIL identified class name's compiler type as the instance; corrected to getTypeOfSymbolAtLocation for the static side.
+-Expanded639PASS1FAIL1SKIP exposed the const-alias caller's false call intent for a class reference; corrected the caller.
+-92PASS1FAIL in real-boundary expansion exposed missing failed-forwarded-call sync retry; bounded retry added and targeted regression passed.
+-778PASS1FAIL1SKIP exposed a property-name token `exports` being treated as a captured wrapper reference in the new opaque-call effect scan; property names excluded. Final147contract+boundary and final812combined are green. Actual logs preserved; no failures suppressed.
+
+## Preservation and evidence
+
+30dirtysource/test/package paths now visible in `git diff`, including four new files marked intent-to-add only. No staged content. Of22pre-phase dirty paths,17remain byte-identical and5were intentionally extended: export evidence collector, import resolver, name matcher, evidence unit tests, evidence integration tests. Four previously clean production paths changed coherently (const-alias synthesizer, module-importers, engine export, index sync caller); four new paths are the typed value graph, its unit tests, production source contract tests and shared fixtures. Prior changes are backed up intact.
+
+Private evidence root:
+`/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-value-model-integration-2026-11-09`
+
+Contains before/22files and hashes, milestone1/2 snapshots, final-source/30files, verified source-sha256.json, cumulative-from-875.patch, integration-from-round11.patch, all actual red/green/failure logs, package screen, results.json/progress.json. Local ledger `.review/commonjs-eval-callee-context.md` updated. Plans stay in ~/.codex/plans.
+
+## Next step and authorization
+
+F14/F15are implemented and focused-tested, awaiting independent verification.11native dual-review rounds have completed historically; no reset and no12thround started. Ask before a fresh focused dual review. If approved, use fresh read-only broad/adversarial native agents with exact target `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 87576a8d9ff0d8aba235db5535f5f4429f14b037 -- .`, same ledger, full30path source hashes and round11delta. Review the source-ownership/value-capability contract, alias caller and failed-forwarding sync work as well as F10–F15preservation. No publication. Normal build/fullsuite once stable review is achieved.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-value-model-integration-2026-11-09/milestone1/status.md b/docs/handoffs/pr29-2026-11-10/history/pr29-value-model-integration-2026-11-09/milestone1/status.md
new file mode 100644
index 0000000000..6d2a764234
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-value-model-integration-2026-11-09/milestone1/status.md
@@ -0,0 +1 @@
+Production value graph and intent wiring implemented. Initial real-boundary run:40pass1fail (static class type query), corrected using getTypeOfSymbolAtLocation;16new F14/F15cases passed. Expanded preservation and production contract tests currently running. No final green claim. No commits/reviews/publication.
diff --git a/docs/handoffs/pr29-2026-11-10/history/pr29-value-model-integration-2026-11-09/milestone2/status.md b/docs/handoffs/pr29-2026-11-10/history/pr29-value-model-integration-2026-11-09/milestone2/status.md
new file mode 100644
index 0000000000..e3ef35c5c3
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/pr29-value-model-integration-2026-11-09/milestone2/status.md
@@ -0,0 +1 @@
+134pass contract/core/alias validation before later additions.92pass1syncfail fresh boundary; sync missing retry repaired, targeted1pass92skipped. Current expanded tests pending. Typed graph used in production; intent-aware alias caller corrected; failed CommonJS imported calls retry through bounded existing importer walk. Save remains uncommitted. No new review.
diff --git a/docs/handoffs/pr29-2026-11-10/history/review-ledger-before-third-round.md b/docs/handoffs/pr29-2026-11-10/history/review-ledger-before-third-round.md
new file mode 100644
index 0000000000..0c772c5ece
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/review-ledger-before-third-round.md
@@ -0,0 +1,55 @@
+# CommonJS missing-member review ledger
+
+Target: /tmp/codegraph-cjs-missing-fix-20261108, branch fix/commonjs-missing-member. Base 5e0664891af0e87e6fd18bbfa16cab39237570f5 to current tracked working tree, unchanged while both reviewers run. Exact diff: `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5e0664891af0e87e6fd18bbfa16cab39237570f5 -- CHANGELOG.md src/resolution/name-matcher.ts __tests__/js-default-binding-members.test.ts`.
+
+Round1 pending two fresh read-only native lanes. No Claude-only /code-review invocation. No resolver fix existed previously; user explicitly authorized implementation and dual review. Fork issue27 is the bug, QA PR27 is evidence only. No official upstream submission before Tuesday verification.
+
+## Findings / fix map
+
+- F1: confirmed upstream defect. `const named=require('./m'); named.missing()` with m.js exporting only known falsely calls unimported Decoy::missing; ref keeps receiver, resolvedBy instance-method/provenance null. Default imports and class-name-alias collision variants also reproduced. Sync adding decoy also fabricates call. Proposed tracked working-tree fix adds default bindings to imported-receiver guard and moves guard before unrelated class-name matching, after actual import/typed/object resolution. Requires reviewer execution and clearance.
+- P0 test baseline: new20-case file on unmodified resolver:15 PASS /5 FAIL. The5 failures are3 parameterized default/require+decoy cases,1 forwarding-module missing member,1 sync-add-decoy. Log /tmp/codegraph-cjs-fix-baseline2.log. No production code edit before this run. Initial baseline command failed because Vitest4 removed --minWorkers; corrected to --maxWorkers=4. Initial two new-test authoring corrections: object variable API used instead of unsupported direct object-literal shorthand shape; expected local object's qualified name corrected to actual fully-qualified extraction name. Neither changes an existing baseline test.
+
+## Rulings / limits
+
+- Direct `module.exports = { read() {} }` without an assigned variable already lacks correct member recovery on base and can be captured by a method decoy. This change must stop wrong calls; new object API positive uses baseline-supported `const api={read(){}}; module.exports=api`. Do not broaden into object-export extraction or claim direct shorthand recovery is implemented.
+- Bare external-package import exact-match issue26 remains separate and unfixed.
+- No import mapping semantics changes, no blanket conversion of require to namespace imports, no source code changes outside one name-matcher guard and changelog/tests.
+- This is a remaining variant of closed upstream2952/merged3162. No global novelty claim. Reproduced on em40/pristine main/pristine release. Native kernel unverified; local deployment is kernel0/WASM.
+
+## Invariants / commands
+
+- Actual exported member resolves beside an unrelated same-name method; missing member has no call. Forwarded CommonJS module preserves real export.
+- Stated CommonJS class static method, assigned object member, instance method, callable direct/default + attached function all remain correct beside decoys.
+- Existing ES default class, instance, typed variable, ambient export=, ordinary ESM namespace, named/anonymous/renamed functions retain calls.
+- Typed local parameters and object literal bindings shadowing default imports retain their local member calls.
+- Sync adds/removes a real export correctly; sync adding/removing a same-name unrelated method never fabricates missing-member calls.
+- Check these with `cd /tmp/codegraph-cjs-missing-fix-20261108 && CODEGRAPH_KERNEL=0 npx vitest run __tests__/js-default-binding-members.test.ts --maxWorkers=1`.
+- Expanded focused suite currently running: js-default-binding-members, commonjs-require-calls, commonjs-require-imports, commonjs-exports, require-default, import-default-as, namespace-object-resolution, import-object-member-namesake, sync-default-export-change, sync-import-member-retry, out-of-repo-import-shadow. Log /tmp/codegraph-cjs-fix-focused.log. Full normal suite/build pending.
+- Additional adversarial probes: class name matching alias, nested receiver paths, defaults with inherited/static/object APIs, lexical shadows and live sync. Each defect needs concrete input/actual wrong output; no style requests or hypothetical findings.
+
+## Round1 review outputs and remediation
+
+Both native lanes finished read-only. Each independently reported the same two P2 regressions at name-matcher.ts:24944; no other demonstrated findings.
+
+- R1 (broad+adversarial): `class Store { load() {} }; module.exports = new Store()` loses its legitimate instance call. Adversarial also demonstrated `export default new Store()` with Store not separately exported. Both base em40 produce Store::load; initial guard none. Remediation: resolve a whole explicit constructor expression to its actual module's local/imported class before the guard. Follow CommonJS forwarding; mask strings/comments/regexes, balance constructor arguments and type arguments, reject chained expressions, memoize with existing export index. Never re-enable generic method-name guessing for default bindings.
+- R2 (broad+adversarial): visible local `class named { static missing(){} }` shadows a default/namespace import; moving guard ahead of class strategy drops correct own-file call. Broad also tested enclosing-function shadow. Remediation: guard exempts a class declaration in the reference's file only when existing isLexicallyReachable proves it visible. Other-file alias-name class decoy remains blocked.
+- Review regression tests run BEFORE remediation: /tmp/codegraph-cjs-fix-review-baseline.log,24 cases19PASS5FAIL (original CommonJS positive +2 constructed-default variants +2 lexical class shadow variants). This pins both findings. Additional constructor argument/forwarder/text controls added; simple first remediation failed3nested/multiline/regex constructor positives in /tmp/codegraph-cjs-fix-constructors-baseline.log before argument-reader correction.
+- After remediation: /tmp/codegraph-cjs-fix-focused4.log,11 files99PASS1SKIP. Final focused run adds no-parentheses and spaced CommonJS constructor controls; /tmp/codegraph-cjs-fix-focused-final.log pending. Earlier temporary TS compile error from passing Language to CommentLang was corrected to JS-family typescript comment handling; not a passing run.
+
+The exact R1 reviewed name-matcher source is saved in .review/round1-name-matcher.ts and reconstructed hash verified against the recorded Git blob512a77a155299de8e6890447aa2d3aea7b81a1f9. Name-matcher remediation diff: `git diff --no-index /tmp/codegraph-cjs-missing-fix-20261108/.review/round1-name-matcher.ts /tmp/codegraph-cjs-missing-fix-20261108/src/resolution/name-matcher.ts`. Import-resolver and new tests are also remediation, diff from5e066489. No intermediate failing-source commit was made.
+
+Verify2 target is current tracked working tree relative5e066489, including CHANGELOG.md, src/resolution/name-matcher.ts, src/resolution/import-resolver.ts, __tests__/js-default-binding-members.test.ts. Check R1/R2 on all paths, all invariants, and defects introduced by remediation. Do not re-raise the pre-existing direct module.exports object-literal recovery limit without new evidence. Full build/suite pending. No merge/deployment occurred.
+
+## Verify2 result — NOT cleared; namespace-only redesign supersedes that target
+
+Both fresh native lanes finished; all findings P2. Broad reported first textual constructor overriding inactive/overwritten exports, valid inline/parenthesized constructors losing calls (R1 still open), and constructor-derived calls remaining stale after sync. Adversarial independently reported constructor lookup overriding typed/object/class lexical shadows (R2 still open), earlier constructor overriding a later stated default, and stale constructor-derived calls after sync. Exact evidence scripts/results under /tmp/cg-broad-verify2-* and /tmp/codegraph-cjs-verify2-*; complete reviewer messages returned to root. Existing explicit-default resolution was safer than the attempted new inference.
+
+Both lanes advised that a smaller boundary is coherent: extend module-namespace ownership only to a require/default whose resolved JS/TS target has no stated or uncertain value default; preserve all existing explicit/unknown default-value inference. Whole-file CommonJS forwarding can follow a namespace leaf; ambiguous assignments/default values must stay base behavior. No nonexistent redesigned code was reviewed or cleared by those design messages.
+
+Implemented redesign: REMOVED all added import-resolver source code; that file is byte-identical to base again. Removed unsafe constructor parsing/inference entirely. Name-matcher now uses existing context.resolveModuleFile, a per-context namespace-classification memo (cleared with existing memos), conservative source checks, pure whole-file forwarders only, bounded/cycle-safe traversal, language-qualified memo keys and JS/TS extensions only (no implicit component defaults). Any raw default keyword/export= or uncertain module use excludes the new guard; comments/text may conservatively prevent a classification. Move-before-class guard keeps lexical own-file class exemption. Changelog narrowed to modules without a value default.
+
+Scope/ruling: arbitrary stated/unknown exported default values and their guessed-member limitations remain pre-existing and explicitly OUTSIDE this fix. Do not claim every default-import missing-member case fixed. Removed new constructor-parser feature tests after deleting that feature, retaining baseline-supported CJS/ESM singleton, stated class/object/callable, lexical shadows and every original missing-module regression. Two dedicated singleton controls initially asserted disambiguation between two .load methods that base itself cannot provide; corrected their newly-authored fixture to a unique .load method, preserving the actual base invariant. Original broader CJS store-vs-decoy control remains unchanged. No baseline existing assertion was weakened.
+
+Full suite on superseded constructor candidate was STOPPED intentionally via guarded SIGINT to only this checkout's Vitest PID702277; final exec83750exit130. It did not pass and must not be reported as a test failure count/green gate. /tmp/codegraph-cjs-fix-full.log belongs that obsolete target. Latest redesigned focused13-file run /tmp/codegraph-cjs-fix-redesign-focused2.log RUNNING; verify actual exit/summary. Explicit build and redesigned full suite remain required.
+
+Third-review exception requested via async user question: skill says third round only if verify found something high severity; these were P2. Await user's explicit answer before launching further reviewers. Both agents' conceptual agreement is not final dual-review clearance. No source commit/push/fix PR/merge/deploy occurred. Original user's conditional merge/deploy request remains dependent on a reviewed green fix; original T0 stays stopped.
diff --git a/docs/handoffs/pr29-2026-11-10/history/review-ledger-tested-pending.md b/docs/handoffs/pr29-2026-11-10/history/review-ledger-tested-pending.md
new file mode 100644
index 0000000000..65f57ba83e
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/review-ledger-tested-pending.md
@@ -0,0 +1,63 @@
+# CommonJS missing-member review ledger
+
+Target: /tmp/codegraph-cjs-missing-fix-20261108, branch fix/commonjs-missing-member. Base 5e0664891af0e87e6fd18bbfa16cab39237570f5 to current tracked working tree, unchanged while both reviewers run. Exact diff: `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5e0664891af0e87e6fd18bbfa16cab39237570f5 -- CHANGELOG.md src/resolution/name-matcher.ts __tests__/js-default-binding-members.test.ts`.
+
+Round1 pending two fresh read-only native lanes. No Claude-only /code-review invocation. No resolver fix existed previously; user explicitly authorized implementation and dual review. Fork issue27 is the bug, QA PR27 is evidence only. No official upstream submission before Tuesday verification.
+
+## Findings / fix map
+
+- F1: confirmed upstream defect. `const named=require('./m'); named.missing()` with m.js exporting only known falsely calls unimported Decoy::missing; ref keeps receiver, resolvedBy instance-method/provenance null. Default imports and class-name-alias collision variants also reproduced. Sync adding decoy also fabricates call. Proposed tracked working-tree fix adds default bindings to imported-receiver guard and moves guard before unrelated class-name matching, after actual import/typed/object resolution. Requires reviewer execution and clearance.
+- P0 test baseline: new20-case file on unmodified resolver:15 PASS /5 FAIL. The5 failures are3 parameterized default/require+decoy cases,1 forwarding-module missing member,1 sync-add-decoy. Log /tmp/codegraph-cjs-fix-baseline2.log. No production code edit before this run. Initial baseline command failed because Vitest4 removed --minWorkers; corrected to --maxWorkers=4. Initial two new-test authoring corrections: object variable API used instead of unsupported direct object-literal shorthand shape; expected local object's qualified name corrected to actual fully-qualified extraction name. Neither changes an existing baseline test.
+
+## Rulings / limits
+
+- Direct `module.exports = { read() {} }` without an assigned variable already lacks correct member recovery on base and can be captured by a method decoy. This change must stop wrong calls; new object API positive uses baseline-supported `const api={read(){}}; module.exports=api`. Do not broaden into object-export extraction or claim direct shorthand recovery is implemented.
+- Bare external-package import exact-match issue26 remains separate and unfixed.
+- No import mapping semantics changes, no blanket conversion of require to namespace imports, no source code changes outside one name-matcher guard and changelog/tests.
+- This is a remaining variant of closed upstream2952/merged3162. No global novelty claim. Reproduced on em40/pristine main/pristine release. Native kernel unverified; local deployment is kernel0/WASM.
+
+## Invariants / commands
+
+- Actual exported member resolves beside an unrelated same-name method; missing member has no call. Forwarded CommonJS module preserves real export.
+- Stated CommonJS class static method, assigned object member, instance method, callable direct/default + attached function all remain correct beside decoys.
+- Existing ES default class, instance, typed variable, ambient export=, ordinary ESM namespace, named/anonymous/renamed functions retain calls.
+- Typed local parameters and object literal bindings shadowing default imports retain their local member calls.
+- Sync adds/removes a real export correctly; sync adding/removing a same-name unrelated method never fabricates missing-member calls.
+- Check these with `cd /tmp/codegraph-cjs-missing-fix-20261108 && CODEGRAPH_KERNEL=0 npx vitest run __tests__/js-default-binding-members.test.ts --maxWorkers=1`.
+- Expanded focused suite currently running: js-default-binding-members, commonjs-require-calls, commonjs-require-imports, commonjs-exports, require-default, import-default-as, namespace-object-resolution, import-object-member-namesake, sync-default-export-change, sync-import-member-retry, out-of-repo-import-shadow. Log /tmp/codegraph-cjs-fix-focused.log. Full normal suite/build pending.
+- Additional adversarial probes: class name matching alias, nested receiver paths, defaults with inherited/static/object APIs, lexical shadows and live sync. Each defect needs concrete input/actual wrong output; no style requests or hypothetical findings.
+
+## Round1 review outputs and remediation
+
+Both native lanes finished read-only. Each independently reported the same two P2 regressions at name-matcher.ts:24944; no other demonstrated findings.
+
+- R1 (broad+adversarial): `class Store { load() {} }; module.exports = new Store()` loses its legitimate instance call. Adversarial also demonstrated `export default new Store()` with Store not separately exported. Both base em40 produce Store::load; initial guard none. Remediation: resolve a whole explicit constructor expression to its actual module's local/imported class before the guard. Follow CommonJS forwarding; mask strings/comments/regexes, balance constructor arguments and type arguments, reject chained expressions, memoize with existing export index. Never re-enable generic method-name guessing for default bindings.
+- R2 (broad+adversarial): visible local `class named { static missing(){} }` shadows a default/namespace import; moving guard ahead of class strategy drops correct own-file call. Broad also tested enclosing-function shadow. Remediation: guard exempts a class declaration in the reference's file only when existing isLexicallyReachable proves it visible. Other-file alias-name class decoy remains blocked.
+- Review regression tests run BEFORE remediation: /tmp/codegraph-cjs-fix-review-baseline.log,24 cases19PASS5FAIL (original CommonJS positive +2 constructed-default variants +2 lexical class shadow variants). This pins both findings. Additional constructor argument/forwarder/text controls added; simple first remediation failed3nested/multiline/regex constructor positives in /tmp/codegraph-cjs-fix-constructors-baseline.log before argument-reader correction.
+- After remediation: /tmp/codegraph-cjs-fix-focused4.log,11 files99PASS1SKIP. Final focused run adds no-parentheses and spaced CommonJS constructor controls; /tmp/codegraph-cjs-fix-focused-final.log pending. Earlier temporary TS compile error from passing Language to CommentLang was corrected to JS-family typescript comment handling; not a passing run.
+
+The exact R1 reviewed name-matcher source is saved in .review/round1-name-matcher.ts and reconstructed hash verified against the recorded Git blob512a77a155299de8e6890447aa2d3aea7b81a1f9. Name-matcher remediation diff: `git diff --no-index /tmp/codegraph-cjs-missing-fix-20261108/.review/round1-name-matcher.ts /tmp/codegraph-cjs-missing-fix-20261108/src/resolution/name-matcher.ts`. Import-resolver and new tests are also remediation, diff from5e066489. No intermediate failing-source commit was made.
+
+Verify2 target is current tracked working tree relative5e066489, including CHANGELOG.md, src/resolution/name-matcher.ts, src/resolution/import-resolver.ts, __tests__/js-default-binding-members.test.ts. Check R1/R2 on all paths, all invariants, and defects introduced by remediation. Do not re-raise the pre-existing direct module.exports object-literal recovery limit without new evidence. Full build/suite pending. No merge/deployment occurred.
+
+## Verify2 result — NOT cleared; namespace-only redesign supersedes that target
+
+Both fresh native lanes finished; all findings P2. Broad reported first textual constructor overriding inactive/overwritten exports, valid inline/parenthesized constructors losing calls (R1 still open), and constructor-derived calls remaining stale after sync. Adversarial independently reported constructor lookup overriding typed/object/class lexical shadows (R2 still open), earlier constructor overriding a later stated default, and stale constructor-derived calls after sync. Exact evidence scripts/results under /tmp/cg-broad-verify2-* and /tmp/codegraph-cjs-verify2-*; complete reviewer messages returned to root. Existing explicit-default resolution was safer than the attempted new inference.
+
+Both lanes advised that a smaller boundary is coherent: extend module-namespace ownership only to a require/default whose resolved JS/TS target has no stated or uncertain value default; preserve all existing explicit/unknown default-value inference. Whole-file CommonJS forwarding can follow a namespace leaf; ambiguous assignments/default values must stay base behavior. No nonexistent redesigned code was reviewed or cleared by those design messages.
+
+Implemented redesign: REMOVED all added import-resolver source code; that file is byte-identical to base again. Removed unsafe constructor parsing/inference entirely. Name-matcher now uses existing context.resolveModuleFile, a per-context namespace-classification memo (cleared with existing memos), conservative source checks, pure whole-file forwarders only, bounded/cycle-safe traversal, language-qualified memo keys and JS/TS extensions only (no implicit component defaults). Any raw default keyword/export= or uncertain module use excludes the new guard; comments/text may conservatively prevent a classification. Move-before-class guard keeps lexical own-file class exemption. Changelog narrowed to modules without a value default.
+
+Scope/ruling: arbitrary stated/unknown exported default values and their guessed-member limitations remain pre-existing and explicitly OUTSIDE this fix. Do not claim every default-import missing-member case fixed. Removed new constructor-parser feature tests after deleting that feature, retaining baseline-supported CJS/ESM singleton, stated class/object/callable, lexical shadows and every original missing-module regression. Two dedicated singleton controls initially asserted disambiguation between two .load methods that base itself cannot provide; corrected their newly-authored fixture to a unique .load method, preserving the actual base invariant. Original broader CJS store-vs-decoy control remains unchanged. No baseline existing assertion was weakened.
+
+Full suite on superseded constructor candidate was STOPPED intentionally via guarded SIGINT to only this checkout's Vitest PID702277; final exec83750exit130. It did not pass and must not be reported as a test failure count/green gate. /tmp/codegraph-cjs-fix-full.log belongs that obsolete target. Latest redesigned focused13-file run /tmp/codegraph-cjs-fix-redesign-focused2.log RUNNING; verify actual exit/summary. Explicit build and redesigned full suite remain required.
+
+Third-review exception requested via async user question: skill says third round only if verify found something high severity; these were P2. Await user's explicit answer before launching further reviewers. Both agents' conceptual agreement is not final dual-review clearance. No source commit/push/fix PR/merge/deploy occurred. Original user's conditional merge/deploy request remains dependent on a reviewed green fix; original T0 stays stopped.
+
+## Final testing and local commit — authoritative current state
+
+Namespace redesign focused suite13files108PASS1SKIP, explicit npm run build exit0. Full normal suite exec60370EXIT0:872filesPASS19SKIP;10589testsPASS,2expectedFAIL,448SKIP,0unexpectedFAIL,799.56seconds. /tmp/codegraph-cjs-fix-redesign-full.log. Original portable6-case bug reproduction6/6PASS. Existing independent18-case records match em40baseline exactly. Namespace-to-value default change sync agrees with fresh index (initial no calls, synced/fresh Store::load); /tmp/codegraph-cjs-namespace-sync-probe.{cjs,jsonl}. Native kernel not validated.
+
+Personal repository/remote/identity, source checksums against preserved tested snapshot, staged3-file set and staged diff/check verified before local commit. LOCAL COMMIT d18e40970fc5fbf32f635f6d8d536d1bdb24dacc, tree2363dd0f8923ca59c28a3e45a477573e7364e7c2, branch fix/commonjs-missing-member. Tracked working tree clean; only private .review untracked. No push/fix PR/merge/deployment. Review target now `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5e0664891af0e87e6fd18bbfa16cab39237570f5..d18e40970fc5fbf32f635f6d8d536d1bdb24dacc -- CHANGELOG.md src/resolution/name-matcher.ts __tests__/js-default-binding-members.test.ts`.
+
+Third review still requires the pending user answer. User's later status question did NOT approve it. If authorized use two fresh native lanes with fork_turns=none and self-contained briefs/ledger to avoid carrying unrelated history. Preserve final tests; no redundant full rerun unless code or unresolved concerns change the tested tree. Verification and logs/source/patch are backed up under original QA .review/commonjs-fix-2026-11-08/verification.json and adjacent artifacts. Current canonical handoff handoff-codegraph-commonjs-tested-review-pending-2026-11-08.md supersedes running/constructor handoffs.
diff --git a/docs/handoffs/pr29-2026-11-10/history/session-end-2026-11-09/exploration.md b/docs/handoffs/pr29-2026-11-10/history/session-end-2026-11-09/exploration.md
new file mode 100644
index 0000000000..fafd9045c1
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/session-end-2026-11-09/exploration.md
@@ -0,0 +1,21 @@
+# Exploration: PR29 export evidence boundary
+
+Recommendation: keep PR29, split into two reviewable commits rather than adding a third stacked PR. Exploration only; no implementation authorized by /explore and no code changes made.
+
+Root cause: reader members records explicit property writes, not a complete inventory of the value assigned by module.exports. The evalUnknown guard treats an empty partial set as grounds to reject root-object/instance calls. Both reported inputs return42 at runtime; current policy drops them.
+
+Proposed contract: represent export form (namespace writes / stated value / opaque) separately from eval certainty (present / absent / unknown). Preserve existing resolution for stated exported values and explicit aliases. Suppress unrelated guesses for namespace members unsupported by available evidence. Unknown eval must not override a stated exported value or pretend the member is absent. Keep existing handling of confirmed eval exports.
+
+Commit boundaries:
+1. AST fact production, transport and source-hash storage, with its tests.
+2. Export classification and resolver policy, with the complete behavior matrix.
+
+Narrow remaining fix scope: src/resolution/commonjs-export-members.ts, src/resolution/name-matcher.ts, and their two test files. Existing extraction/storage/grammar work need not change for F12.
+
+Effort: M by skill file-count rubric (2source+2test files); no new dependencies or schema changes. Integration: export summary -> module classification -> method-guess gate, including existing forwarder propagation and sync invalidation.
+
+Technical checks before coding: establish how root assignments/mixed writes/bracket syntax map to export form; confirm forwarding and sync carry classification consistently. No external account/production/deploy blocker.
+
+Validation: build a matrix of namespace writes, direct aliases, root objects and instances against eval absent/present/unknown, plus forwarding and fresh-v-sync. Include F12's two runtime-backed cases and retain F10/F11 controls. A blanket unknown block loses real calls; a blanket bypass restores false captures. Review the policy contract before another full-suite run.
+
+Current state: checkout/tmp/codegraph-cjs-missing-fix-20261108 HEAD87576a8d,15dirtypaths. PR28/29 remain drafts; ASTrevision not pushed. Latest factual evidence and recovery: handoff-codegraph-pr29-review9-root-export-regression-2026-11-09.md. F10/F11 independentlyclear; F12P2open.172focusedPASS1SKIP predates F12testcoverage; no finalfull/build on dirtyASTrevision. Overallreviewcount9,noreset. Await user decision before implementation; preserve all dirty work/T0/deploy/control files.
diff --git a/docs/handoffs/pr29-2026-11-10/history/session-end-2026-11-09/handoff.md b/docs/handoffs/pr29-2026-11-10/history/session-end-2026-11-09/handoff.md
new file mode 100644
index 0000000000..8dcf7ed257
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/session-end-2026-11-09/handoff.md
@@ -0,0 +1,41 @@
+# Session end: CodeGraph PR29, F12 pending; exploration complete
+
+Authoritative final handoff,2026-11-09. User explicitly ended this session and requested a command starting a NEW Codex session with proper setup. No scheduled/automatic resume. New session should read this and the two linked plans, summarize the next step and ASK before implementation: latest /explore recommendation has NOT been approved. Don't mistake end-session request for authorization to fix/commit/push/merge/deploy. Preserve all current work.
+
+## Exact workspace and publication state
+
+Use EXISTING /tmp/codegraph-cjs-missing-fix-20261108, branch fix/commonjs-eval-callee-context, HEAD87576a8d9ff0d8aba235db5535f5f4429f14b037. Do not create/reset/clean a worktree or discard unstaged changes. Fifteen dirty source paths, newfiles intent-to-add, private.review untracked; all hashes checked at session end against durable source backup. Source should be unchanged from completed ninth review. Personal origin https://github.com/inth3shadows/codegraph.git, Eric Minish / eric.minish@gmail.com (verify again before future commits/pushes); never use work/Transactly identity.
+
+PR28 DRAFT https://github.com/inth3shadows/codegraph/pull/28 at5d384989957c91b482068b306535437915a0595b, base main5e066489(em.40). PR29 DRAFT https://github.com/inth3shadows/codegraph/pull/29 at87576a8d9ff0d8aba235db5535f5f4429f14b037, base PR28 branch fix/commonjs-missing-member. AST redesign/current15files have NOT been committed/pushed; publishedPR29 still oldprefixguard. Neither PR merged/deployed; live em.40 unchanged. Original QA workspace /home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780 is stopped/uncommitted T0pilot(HEAD729da1b); do not resume/edit it. Only its private.review holds backups.
+
+## Read next (exact files)
+
+1. /home/ericm/.codex/plans/handoff-codegraph-pr29-review9-root-export-regression-2026-11-09.md — latest factual review/state/repros/recovery.
+2. /home/ericm/.codex/plans/explore-pr29-export-evidence-boundary-2026-11-09.md — latest recommendation, awaiting user approval.
+3. Repo .review/commonjs-eval-callee-context.md — actual review ledger; history .review/commonjs-missing-member.md. Do not reread all old handoffs/full conversation.
+
+## Current implementation and actual verification
+
+ASTfact pipeline implemented in15dirtypaths. ExistingAST identifies direct eval; generator-scope workaround for JSgrammar's contextualyield ambiguity. OptionalExtractionResult.commonJsEvalCall->ephemeralFileRecord throughbothstorepaths->existingproject_metadata JSON{sourcehash,value}; resolveronlyacceptsfactifcurrentSHA256matches. Missing/stale/errorfactsunknown; oldmanualcallee prefixwhitelistremoved. No grammar/runtime/dependency/schema modifications. NewevalUnknownguard suppresses unprovennameguesses; computedmethodkeys nowcorrectlyuseenclosingscope. Explicit directmemberaliasesstillresolve.
+
+Focused8files172PASS1SKIP, /tmp/codegraph-cjs-ast-f10-f11-after.log; sixFAIL90PASS before lastfix. One skipnativekerneltransport: native.node NOTSTAGED, don'tclaimnativeparity. No explicit finalnormalbuild/fullsuiteoncurrentdirtyASTrevision; old10666fullPASSbelongscommitted875onlyandisNOTcurrentclearance. No test/build/reviewerprocessesrunning.
+
+Ninthnative dualreviewCOMPLETED, sourceunchanged. BothreviewersindependentlyCLEARED priorF10optionalwrappercapture andF11computedkeyscope(bothdirections). Broad11runtimeprobespass. AdversarialfoundF12 P2 atsrc/resolution/name-matcher.ts:25403: withclass Store{load(){return 42;}}, module.exports={load:Store.prototype.load}; function yield(v){return function ignored(){};} yield?.(eval)("ignored"); runtime.load()returns42, graphcalls[]. module.exports=new Store()alsoreproduces. Reader'smemberSetlistspropertywritesonly, notwholeexportedvalueinventory; newevalUnknowngatemistakesemptysetforreason todroprootvaluecalls. RemovingONLYnewevalUnknowngateinmemoryrestoresStore::load; directexports.loadaliaspasses. Repros /tmp/cg-a9-root-export-regression.cjs, /tmp/cg-a9-root-export-current.log, /tmp/cg-a9-root-export-oldgate.log. No parentduplicateprobes/codechangesduringreview. Overallreviewcount9honest; no resets/gatebypass.
+
+## Exploration recommendation — NOT approved yet
+
+KeepPR29; split intoTWOreviewablecommits (ASTfactproduction/transport/storage/tests, thenexportclassification/resolutionpolicy/tests). A thirdstackedPRaddsdependencywithoutseparatingthissamecontract. RemainingF12scope2sourcefiles(commonjs-export-members.ts,name-matcher.ts)+2testfiles(commonjs-export-members.test.ts,js-default-binding-members.test.ts); existingextraction/storage/grammarpipeline needn'tchangeforF12.
+
+Represent exportform(namespacewrites/statedvalue/opaque) independentlyfromevalcertainty(present/absent/unknown). Preserveexistingresolutionofstatedwholemodulevaluesanddirectaliases; suppressunrelatednamespace guesses whenunsupported. Unknown eval alone mustnotoverrideastatedexportedvalueorclaimabsence. Keep confirmedactualevalbehavior. Pin matrix BEFOREcoding: namespacewrites/directaliases/rootobjects/instances x evalabsent/present/unknown, forwarding+fresh/sync. IncludeF12object/instancecasesandretainF10/F11. Checkmixed/bracketassignments andforwarderpropagation; no needanothergrammar/punctuationexception. Explorationhasread-onlycodeinspection; no implementationchangesmadeafterreview9. Usermustapproveproposedstructure/nextcodingstep.
+
+## Resume workflow and boundaries
+
+Newsession command uses -C existingtmpcheckout, workspace-write, --approve-for-me (installedcodex0.167.0helpverified), add-dir ~/.codex/plans and originalQA/.review ONLY forcheckpoints/backups. Omit --worktree andapproval/sandboxbypassflags. Use configuredmodel/profiledefaults; no modelchangeauthorized. ReadpersonalAGENTS/repoAGENTS, preserve work. If sourcecheckoutgone, recover safely fromGitHub875/base5e anddurablepatch WITHOUToverwritingrealexistingfiles.
+
+Afteruserapprovesimplementation: addmeaningfulfailingF12tests, refactorclassificationcontractnarrowly, runfocusedmatrixandpreservationchecks, savecheckpoint. Askbeforeseparatenextreview asuserrequested; freshnative broad/adversariallanes onlywhenapproved, exactGit target+ledger,no wholeparentreaudits/repeatedfullbuilds, no gate resets. Runfinalnormalbuild/fullsuite ONCEafterstableclearance(CODEGRAPH_KERNEL=0 npm test -- --maxWorkers=4,~13min; no --minWorkersVitest4). Beforecommit/pushverifyrepo/remote/personalidentity/stagedexactdiff/sourcehashes/tests. Keepdraftuntiluserdecidesready/merge. Do not auto-merge/deploy/upstream report. No unaskedissue26fix/features/T0work. Userwantsregularconciseupdatesandminimalquota; compact fork_turns=none reviewerbriefs, don'trepeatcompletedchecks.
+
+## Durable recovery locations
+
+OriginalQA .review/commonjs-fix-2026-11-08/ast-f10-f11-corrected-2026-11-09/ hasall15currentsourcefiles, source-sha256.json, cumulative-from-875.patch, correction-from-round8.patch, actualred/greenlogs,ledgers/verification. pr29-review9-2026-11-09/ haslatestactualreviewreports/scripts/logs/results/hashes. OlderbackupsretainverifiedtwobranchGitbundleagainstbase5e; bothpublishedbranchesonGitHub. No lossif/tmpdisappears. Finalcopyofthishandoffandexplorationalsoin session-end-2026-11-09/. Don'tcommitprivate.revieworAIattribution. Don'trewriteagentcontrol/deployworktrees.
+
+Personalcodegraphissue27CommonJS; issue26separateexternalimportbugoutofscope; QA PR27unrelatedevidence. TuesdayNov10 officialupstreamreportstillconditionalonactualverification/duplicatecheckandusergoahead. No officialwriteyet.
diff --git a/docs/handoffs/pr29-2026-11-10/history/third-review-2026-11-09/handoff.md b/docs/handoffs/pr29-2026-11-10/history/third-review-2026-11-09/handoff.md
new file mode 100644
index 0000000000..b537826163
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/third-review-2026-11-09/handoff.md
@@ -0,0 +1,18 @@
+# CommonJS fix: third review found defects — hold merge/deploy
+
+Authoritative2026-11-09 state, supersedes tested-review-pending2026-11-08 handoff. User approved third round, asked why, then resumed. Explained earlier code was replaced and final commit had not been independently reviewed. Used two fresh read-only minimal-context native lanes; no full-suite rerun.
+
+Local commit d18e40970fc5fbf32f635f6d8d536d1bdb24dacc in /tmp/codegraph-cjs-missing-fix-20261108, branch fix/commonjs-missing-member, base5e0664891af0e87e6fd18bbfa16cab39237570f5. Three files CHANGELOG.md, src/resolution/name-matcher.ts, __tests__/js-default-binding-members.test.ts. Tracked tree clean, .review untracked. Personalorigin inth3shadows/codegraph, EricMinish/eric.minish@gmail.com. No push, fix PR, merge, deployment or official-upstream write. em40stilllive. Original QA T0 stopped/uncommitted, untouched. External import issue26 unfixed; CommonJS tracked forkissue27. Conditional TuesdayNov10upstreamreport still held until checks hold.
+
+PASS remains true for this exactcommit: npm run build,13focusedfiles108PASS1SKIP,6/6originalportablebugcases,18independentrecords exactlymatchingbase, namespace->instance sync matchesfresh. Full suite872filesPASS19SKIP,10589testsPASS2expectedFAIL448SKIP0unexpectedFAIL,799.56sec, CODEGRAPH_KERNEL0Node22.22.2. No native claims. No test processes running. Source/patch/logs/verification backup original QA .review/commonjs-fix-2026-11-08/.
+
+REVIEW NOT CLEAR. Broad lane review_broad_commonjs_final3 completed normally. Adversarial review_adversarial_commonjs_final3 delivered confirmed findings/messages then FAILED finalization due usage cap (notice retry Nov9 1:10AM). Do not claim final successful report or clearance from failed lane; do not relaunch automatically or spend another round. Confirmed evidence/messages still preserved in ledger.
+
+Three P2 findings:
+F3 broad + adversarial: value->namespace change after index retains old Store::load via cg.sync; fresh final index correctly[]. Importmodule text/shape is a new guard dependency that does not reopen old member guesses. Repro /tmp/cg-broad-final3-sync-reverse.cjs +log +base.log; /tmp/codegraph-cjs-final3-sync.cjs direct/pureforwarder independent.
+F4 adversarial: actual callable alias exports.load=Store.prototype.load (also module.exports.load) works at runtime and base graphStore::load, finaldropscall. Classifier must preserve uncertain member RHS or resolve actual alias; cannot treat it as absent export. /tmp/codegraph-cjs-final3-export-alias.cjs and -adversarial*.jsonl.
+F5 adversarial still-open original path: constnamed=require('./m'); run(){ if(true){ classnamed{staticmissing(){}} } named.missing(); } binds to inaccessible block-local class. Existing isLexicallyReachable coarse; guard exemption must check real lexical block scope. AlsoTSnamespaceParent. Need preserve real local/enclosing-function class shadows. Same wrong edge preexists base; not a new regression but intendedmissingmemberpathnotfixed.
+
+Full exact findings/locations/claims are appended in /tmp/codegraph-cjs-missing-fix-20261108/.review/commonjs-missing-member.md. Read before any correction; do not reread full reviewed diff as a third reviewer or rerun already-confirmed findings merely to duplicate review. Each correction needs fail-before regression and preservation invariants. Unsafe constructor inference from earlier round is completely removed (import-resolver exactlybase); do not reintroduce. Default/unknown-value guessing remains documented out-of-scope unless concrete regression.
+
+NEXT: report defects/no-merge decision and get the next bounded correction/verification direction; user asked confirmation before next step. No further source fixes/agents started after reports. Third approval does not authorize fourth round; gate4requiresstop/ask, no bypass. Usage cap prevents assuming another lane can run anyway. Do not merge/deployd18e4097 despite green tests. No fixes for other bugs/T0, no publicupstreamissue/PR now, no tag/npm/deploymutations, no source/deploy/control worktree cleanup. Update durable checkpoint after any new authorized work.
diff --git a/docs/handoffs/pr29-2026-11-10/history/third-review-2026-11-09/review-ledger.md b/docs/handoffs/pr29-2026-11-10/history/third-review-2026-11-09/review-ledger.md
new file mode 100644
index 0000000000..1ee2046659
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/history/third-review-2026-11-09/review-ledger.md
@@ -0,0 +1,100 @@
+# CommonJS missing-member review ledger
+
+Target: /tmp/codegraph-cjs-missing-fix-20261108, branch fix/commonjs-missing-member. Base 5e0664891af0e87e6fd18bbfa16cab39237570f5 to current tracked working tree, unchanged while both reviewers run. Exact diff: `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5e0664891af0e87e6fd18bbfa16cab39237570f5 -- CHANGELOG.md src/resolution/name-matcher.ts __tests__/js-default-binding-members.test.ts`.
+
+Round1 pending two fresh read-only native lanes. No Claude-only /code-review invocation. No resolver fix existed previously; user explicitly authorized implementation and dual review. Fork issue27 is the bug, QA PR27 is evidence only. No official upstream submission before Tuesday verification.
+
+## Findings / fix map
+
+- F1: confirmed upstream defect. `const named=require('./m'); named.missing()` with m.js exporting only known falsely calls unimported Decoy::missing; ref keeps receiver, resolvedBy instance-method/provenance null. Default imports and class-name-alias collision variants also reproduced. Sync adding decoy also fabricates call. Proposed tracked working-tree fix adds default bindings to imported-receiver guard and moves guard before unrelated class-name matching, after actual import/typed/object resolution. Requires reviewer execution and clearance.
+- P0 test baseline: new20-case file on unmodified resolver:15 PASS /5 FAIL. The5 failures are3 parameterized default/require+decoy cases,1 forwarding-module missing member,1 sync-add-decoy. Log /tmp/codegraph-cjs-fix-baseline2.log. No production code edit before this run. Initial baseline command failed because Vitest4 removed --minWorkers; corrected to --maxWorkers=4. Initial two new-test authoring corrections: object variable API used instead of unsupported direct object-literal shorthand shape; expected local object's qualified name corrected to actual fully-qualified extraction name. Neither changes an existing baseline test.
+
+## Rulings / limits
+
+- Direct `module.exports = { read() {} }` without an assigned variable already lacks correct member recovery on base and can be captured by a method decoy. This change must stop wrong calls; new object API positive uses baseline-supported `const api={read(){}}; module.exports=api`. Do not broaden into object-export extraction or claim direct shorthand recovery is implemented.
+- Bare external-package import exact-match issue26 remains separate and unfixed.
+- No import mapping semantics changes, no blanket conversion of require to namespace imports, no source code changes outside one name-matcher guard and changelog/tests.
+- This is a remaining variant of closed upstream2952/merged3162. No global novelty claim. Reproduced on em40/pristine main/pristine release. Native kernel unverified; local deployment is kernel0/WASM.
+
+## Invariants / commands
+
+- Actual exported member resolves beside an unrelated same-name method; missing member has no call. Forwarded CommonJS module preserves real export.
+- Stated CommonJS class static method, assigned object member, instance method, callable direct/default + attached function all remain correct beside decoys.
+- Existing ES default class, instance, typed variable, ambient export=, ordinary ESM namespace, named/anonymous/renamed functions retain calls.
+- Typed local parameters and object literal bindings shadowing default imports retain their local member calls.
+- Sync adds/removes a real export correctly; sync adding/removing a same-name unrelated method never fabricates missing-member calls.
+- Check these with `cd /tmp/codegraph-cjs-missing-fix-20261108 && CODEGRAPH_KERNEL=0 npx vitest run __tests__/js-default-binding-members.test.ts --maxWorkers=1`.
+- Expanded focused suite currently running: js-default-binding-members, commonjs-require-calls, commonjs-require-imports, commonjs-exports, require-default, import-default-as, namespace-object-resolution, import-object-member-namesake, sync-default-export-change, sync-import-member-retry, out-of-repo-import-shadow. Log /tmp/codegraph-cjs-fix-focused.log. Full normal suite/build pending.
+- Additional adversarial probes: class name matching alias, nested receiver paths, defaults with inherited/static/object APIs, lexical shadows and live sync. Each defect needs concrete input/actual wrong output; no style requests or hypothetical findings.
+
+## Round1 review outputs and remediation
+
+Both native lanes finished read-only. Each independently reported the same two P2 regressions at name-matcher.ts:24944; no other demonstrated findings.
+
+- R1 (broad+adversarial): `class Store { load() {} }; module.exports = new Store()` loses its legitimate instance call. Adversarial also demonstrated `export default new Store()` with Store not separately exported. Both base em40 produce Store::load; initial guard none. Remediation: resolve a whole explicit constructor expression to its actual module's local/imported class before the guard. Follow CommonJS forwarding; mask strings/comments/regexes, balance constructor arguments and type arguments, reject chained expressions, memoize with existing export index. Never re-enable generic method-name guessing for default bindings.
+- R2 (broad+adversarial): visible local `class named { static missing(){} }` shadows a default/namespace import; moving guard ahead of class strategy drops correct own-file call. Broad also tested enclosing-function shadow. Remediation: guard exempts a class declaration in the reference's file only when existing isLexicallyReachable proves it visible. Other-file alias-name class decoy remains blocked.
+- Review regression tests run BEFORE remediation: /tmp/codegraph-cjs-fix-review-baseline.log,24 cases19PASS5FAIL (original CommonJS positive +2 constructed-default variants +2 lexical class shadow variants). This pins both findings. Additional constructor argument/forwarder/text controls added; simple first remediation failed3nested/multiline/regex constructor positives in /tmp/codegraph-cjs-fix-constructors-baseline.log before argument-reader correction.
+- After remediation: /tmp/codegraph-cjs-fix-focused4.log,11 files99PASS1SKIP. Final focused run adds no-parentheses and spaced CommonJS constructor controls; /tmp/codegraph-cjs-fix-focused-final.log pending. Earlier temporary TS compile error from passing Language to CommentLang was corrected to JS-family typescript comment handling; not a passing run.
+
+The exact R1 reviewed name-matcher source is saved in .review/round1-name-matcher.ts and reconstructed hash verified against the recorded Git blob512a77a155299de8e6890447aa2d3aea7b81a1f9. Name-matcher remediation diff: `git diff --no-index /tmp/codegraph-cjs-missing-fix-20261108/.review/round1-name-matcher.ts /tmp/codegraph-cjs-missing-fix-20261108/src/resolution/name-matcher.ts`. Import-resolver and new tests are also remediation, diff from5e066489. No intermediate failing-source commit was made.
+
+Verify2 target is current tracked working tree relative5e066489, including CHANGELOG.md, src/resolution/name-matcher.ts, src/resolution/import-resolver.ts, __tests__/js-default-binding-members.test.ts. Check R1/R2 on all paths, all invariants, and defects introduced by remediation. Do not re-raise the pre-existing direct module.exports object-literal recovery limit without new evidence. Full build/suite pending. No merge/deployment occurred.
+
+## Verify2 result — NOT cleared; namespace-only redesign supersedes that target
+
+Both fresh native lanes finished; all findings P2. Broad reported first textual constructor overriding inactive/overwritten exports, valid inline/parenthesized constructors losing calls (R1 still open), and constructor-derived calls remaining stale after sync. Adversarial independently reported constructor lookup overriding typed/object/class lexical shadows (R2 still open), earlier constructor overriding a later stated default, and stale constructor-derived calls after sync. Exact evidence scripts/results under /tmp/cg-broad-verify2-* and /tmp/codegraph-cjs-verify2-*; complete reviewer messages returned to root. Existing explicit-default resolution was safer than the attempted new inference.
+
+Both lanes advised that a smaller boundary is coherent: extend module-namespace ownership only to a require/default whose resolved JS/TS target has no stated or uncertain value default; preserve all existing explicit/unknown default-value inference. Whole-file CommonJS forwarding can follow a namespace leaf; ambiguous assignments/default values must stay base behavior. No nonexistent redesigned code was reviewed or cleared by those design messages.
+
+Implemented redesign: REMOVED all added import-resolver source code; that file is byte-identical to base again. Removed unsafe constructor parsing/inference entirely. Name-matcher now uses existing context.resolveModuleFile, a per-context namespace-classification memo (cleared with existing memos), conservative source checks, pure whole-file forwarders only, bounded/cycle-safe traversal, language-qualified memo keys and JS/TS extensions only (no implicit component defaults). Any raw default keyword/export= or uncertain module use excludes the new guard; comments/text may conservatively prevent a classification. Move-before-class guard keeps lexical own-file class exemption. Changelog narrowed to modules without a value default.
+
+Scope/ruling: arbitrary stated/unknown exported default values and their guessed-member limitations remain pre-existing and explicitly OUTSIDE this fix. Do not claim every default-import missing-member case fixed. Removed new constructor-parser feature tests after deleting that feature, retaining baseline-supported CJS/ESM singleton, stated class/object/callable, lexical shadows and every original missing-module regression. Two dedicated singleton controls initially asserted disambiguation between two .load methods that base itself cannot provide; corrected their newly-authored fixture to a unique .load method, preserving the actual base invariant. Original broader CJS store-vs-decoy control remains unchanged. No baseline existing assertion was weakened.
+
+Full suite on superseded constructor candidate was STOPPED intentionally via guarded SIGINT to only this checkout's Vitest PID702277; final exec83750exit130. It did not pass and must not be reported as a test failure count/green gate. /tmp/codegraph-cjs-fix-full.log belongs that obsolete target. Latest redesigned focused13-file run /tmp/codegraph-cjs-fix-redesign-focused2.log RUNNING; verify actual exit/summary. Explicit build and redesigned full suite remain required.
+
+Third-review exception requested via async user question: skill says third round only if verify found something high severity; these were P2. Await user's explicit answer before launching further reviewers. Both agents' conceptual agreement is not final dual-review clearance. No source commit/push/fix PR/merge/deploy occurred. Original user's conditional merge/deploy request remains dependent on a reviewed green fix; original T0 stays stopped.
+
+## Final testing and local commit — authoritative current state
+
+Namespace redesign focused suite13files108PASS1SKIP, explicit npm run build exit0. Full normal suite exec60370EXIT0:872filesPASS19SKIP;10589testsPASS,2expectedFAIL,448SKIP,0unexpectedFAIL,799.56seconds. /tmp/codegraph-cjs-fix-redesign-full.log. Original portable6-case bug reproduction6/6PASS. Existing independent18-case records match em40baseline exactly. Namespace-to-value default change sync agrees with fresh index (initial no calls, synced/fresh Store::load); /tmp/codegraph-cjs-namespace-sync-probe.{cjs,jsonl}. Native kernel not validated.
+
+Personal repository/remote/identity, source checksums against preserved tested snapshot, staged3-file set and staged diff/check verified before local commit. LOCAL COMMIT d18e40970fc5fbf32f635f6d8d536d1bdb24dacc, tree2363dd0f8923ca59c28a3e45a477573e7364e7c2, branch fix/commonjs-missing-member. Tracked working tree clean; only private .review untracked. No push/fix PR/merge/deployment. Review target now `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5e0664891af0e87e6fd18bbfa16cab39237570f5..d18e40970fc5fbf32f635f6d8d536d1bdb24dacc -- CHANGELOG.md src/resolution/name-matcher.ts __tests__/js-default-binding-members.test.ts`.
+
+Third review still requires the pending user answer. User's later status question did NOT approve it. If authorized use two fresh native lanes with fork_turns=none and self-contained briefs/ledger to avoid carrying unrelated history. Preserve final tests; no redundant full rerun unless code or unresolved concerns change the tested tree. Verification and logs/source/patch are backed up under original QA .review/commonjs-fix-2026-11-08/verification.json and adjacent artifacts. Current canonical handoff handoff-codegraph-commonjs-tested-review-pending-2026-11-08.md supersedes running/constructor handoffs.
+
+## Third round authorized and running
+
+User explicitly answered yes to the third-review request, then asked why another round was needed. Explained earlier reviews covered replaced code while the tested final commit had not been independently reviewed. This question did not revoke approval. Started fresh read-only review_broad_commonjs_final3 and review_adversarial_commonjs_final3 with fork_turns=none, the exact base..d18e4097 target and this ledger, compact self-contained briefs and no full-suite rerun. Their results remain pending. Source unchanged; no push/merge/deployment.
+
+## Third round result — 2026-11-09 — NOT READY TO MERGE
+
+Exact target remains local d18e40970fc5fbf32f635f6d8d536d1bdb24dacc. Tracked tree clean, .review untracked; no source changes after passing tests. User resumed; collected broad final answer and adversarial confirmed messages. Broad lane completed normally. Adversarial lane delivered independently confirmed findings/evidence, then failed finalization with a usage-limit error (retry notice Nov9 1:10AM). Do NOT claim that lane completed normally, final clearance, or a green dual review. No push/PR/merge/deployment.
+
+### F3 — P2 — Namespace classification changes do not invalidate existing guessed calls (broad, independently confirmed adversarial)
+
+Broad location src/resolution/name-matcher.ts:25398. Start with `class Store { load() {} }; module.exports = new Store()` and an unchanged caller requiring that module and calling `.load()`. Replace the export with `exports.known = function known() {};`, retaining the class. After cg.sync(), the graph still calls Store::load; a fresh index correctly produces no call. The new module-text dependency needs to reopen existing member guesses when export shape changes.
+
+Broad reproduction /tmp/cg-broad-final3-sync-reverse.cjs; final evidence /tmp/cg-broad-final3-sync-reverse.log. Baseline comparison confirms its sync and fresh results both retained Store::load (/tmp/cg-broad-final3-sync-reverse-base.log). Adversarial independently reproduced direct and pure forwarder value->namespace->value->namespace retaining Store::load on every sync: /tmp/codegraph-cjs-final3-sync.cjs. Minimum correction recommendation: reopen default-import member guesses when imported module export text/shape changes, or record the imported source dependency on guesses allowed by a false namespace classification.
+
+### F4 — P2 — Explicitly exported callable aliases lose their calls (adversarial confirmed before usage limit)
+
+Location reported src/resolution/name-matcher.ts:25427. m.js `class Store { load() { return 42; } }\nexports.load = Store.prototype.load;`; use.js `const named=require('./m');\nexport function run(){named.load();}`. em40 calls m.js:Store::load; final emits no call. Same independently confirmed for `module.exports.load = Store.prototype.load`. Runtime named.load returns42 and Object.keys(module)=['load']. This is an explicitly exported callable, not the ruled-out direct object/default-value guessing limit. Prototype mutation variants group with the same uncertain-exports classification problem.
+
+Evidence /tmp/codegraph-cjs-final3-export-alias.cjs and /tmp/codegraph-cjs-final3-adversarial{,-base.jsonl,-final.jsonl}. Recommendation: preserve uncertain named-export RHS APIs or resolve the actual callable alias before blocking a fallback. Do not reopen arbitrary guesses for absent exports.
+
+### F5 — P2 — Out-of-scope local class bypasses namespace guard (adversarial confirmed before usage limit; original finding remains open on this path)
+
+Reported location src/resolution/name-matcher.ts:25397 (guard local-class exemption, around25396). Valid CJS: m.js `exports.known=function known(){};`; use.js lines1..8:
+`const named=require('./m');`
+`function run(){`
+`if(true){`
+`class named {static missing(){}}`
+`}`
+`named.missing();`
+`}`
+`module.exports=run;`
+Final returns use.js:run::named::missing atline6, though the class is block-local and imported module has no missing. Also reproduced for a class inside TS namespace Parent. These outputs pre-exist on base, but this is a still-open original false-positive path bypassing the new guard: existing isLexicallyReachable does not establish block visibility. Recommendation: require actual enclosing lexical block visibility before exempting a class. Preserve the genuine inner/enclosing-function shadow controls.
+
+## Merge decision / next boundary
+
+HOLD d18e4097. Passing build/full/focused tests remain factual, but F3/F4 are demonstrated regressions and F5 remains an intended missing-member path. No further agents, tests, source fixes or outward actions started after these reports. Do not rerun the full suite until a changed candidate requires it. User required confirmation before subsequent steps; present this concrete review result and seek the next bounded correction/verification decision. Fourth review is not preauthorized by approval of the third; native review gate may deny round4, so stop and ask rather than bypass. Agent quota exhaustion is additional reason not to relaunch a failed lane automatically.
diff --git a/docs/handoffs/pr29-2026-11-10/implementation/integration-from-round11.patch.gz b/docs/handoffs/pr29-2026-11-10/implementation/integration-from-round11.patch.gz
new file mode 100644
index 0000000000..7d7b921136
Binary files /dev/null and b/docs/handoffs/pr29-2026-11-10/implementation/integration-from-round11.patch.gz differ
diff --git a/docs/handoffs/pr29-2026-11-10/implementation/results.json b/docs/handoffs/pr29-2026-11-10/implementation/results.json
new file mode 100644
index 0000000000..4731f56ebf
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/implementation/results.json
@@ -0,0 +1,54 @@
+{
+  "status": "implemented and focused-tested; awaiting user decision on fresh dual review",
+  "head": "87576a8d9ff0d8aba235db5535f5f4429f14b037",
+  "branch": "fix/commonjs-eval-callee-context",
+  "sourcePaths": 30,
+  "previousDirtyPathsPreservedByteForByte": [
+    "__tests__/commonjs-eval-facts.test.ts",
+    "__tests__/commonjs-eval.test.ts",
+    "__tests__/commonjs-export-members.test.ts",
+    "__tests__/js-default-binding-members.test.ts",
+    "__tests__/lazy-engine.test.ts",
+    "package-lock.json",
+    "package.json",
+    "src/db/queries.ts",
+    "src/extraction/commonjs-eval.ts",
+    "src/extraction/index.ts",
+    "src/extraction/kernel/index.ts",
+    "src/extraction/parse-worker.ts",
+    "src/extraction/tree-sitter.ts",
+    "src/resolution/commonjs-export-members.ts",
+    "src/resolution/index.ts",
+    "src/resolution/types.ts",
+    "src/types.ts"
+  ],
+  "previousDirtyPathsIntentionallyExtended": [
+    "__tests__/commonjs-export-evidence-integration.test.ts",
+    "__tests__/commonjs-export-evidence.test.ts",
+    "src/resolution/commonjs-export-evidence.ts",
+    "src/resolution/import-resolver.ts",
+    "src/resolution/name-matcher.ts"
+  ],
+  "focused": {
+    "files": 25,
+    "pass": 812,
+    "skip": 1,
+    "log": "codegraph-pr29-value-verification.log"
+  },
+  "lazy": {
+    "files": 1,
+    "pass": 7,
+    "log": "codegraph-pr29-value-lazy.log",
+    "execution": "outside sandbox for previously demonstrated child-process pipe restriction"
+  },
+  "distinctPass": 819,
+  "nativeParity": "not executed; native binary absent",
+  "typecheck": "node node_modules/typescript/bin/tsc --noEmit passed",
+  "whitespace": "git diff --check passed",
+  "normalBuildAndFullSuite": "deferred until stable independent review, per existing boundary",
+  "completedReviewRounds": 11,
+  "newReviewStarted": false,
+  "commitsPushMergeDeploy": false,
+  "stagedContent": "",
+  "packageScreen": "codegraph-pr29-value-package-screen.json; analyzer source coverage/warm timing only, no integration-performance claim"
+}
diff --git a/docs/handoffs/pr29-2026-11-10/implementation/source-sha256.json b/docs/handoffs/pr29-2026-11-10/implementation/source-sha256.json
new file mode 100644
index 0000000000..c9165fcf94
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/implementation/source-sha256.json
@@ -0,0 +1,32 @@
+{
+  "__tests__/commonjs-eval-facts.test.ts": "b5ff6d69d82c04fd096a413437dae9d1eb57469b6f9850a15c529ba858984e54",
+  "__tests__/commonjs-eval.test.ts": "bde138636b57b2142a722820b057f4826afc7c9dad2155260b2b75e7f22a45c3",
+  "__tests__/commonjs-export-evidence-integration.test.ts": "61a62b8011b42226de741f6a8dc040ac69fe473ce19b51af9e36f0017e8e0609",
+  "__tests__/commonjs-export-evidence.test.ts": "d2fdb828287466f7bf4da7f247534963f0ac360f168c4f3a0e07dc27a0b19a7b",
+  "__tests__/commonjs-export-members.test.ts": "01913d19d5d4ea6227d741750567606b31f5a26036c11d71d7629257f59fbe45",
+  "__tests__/commonjs-value-contract.test.ts": "25b3aee0d87385a216bf8b45e21dcef621e6d2385159eb357d91ad28d3e4673a",
+  "__tests__/commonjs-value-graph.test.ts": "adf37404d530d30818d1dbe0b0ff6821023a031b6dbba43546396d50ac2413cd",
+  "__tests__/fixtures/commonjs-value-cases.ts": "bcb7ac47fcee48b65000b923e5d3953f11f0d9e60429ce84ebe43f741a060bf9",
+  "__tests__/js-default-binding-members.test.ts": "541f1ddd1d3f45f11b1d81d21e426491f0f99f39f82a3108ba76ceec8a334f23",
+  "__tests__/lazy-engine.test.ts": "03691cd343e280d135d381110ae49965829f407ac9af3f17bd7fcc7732545008",
+  "package-lock.json": "dfe0cdd6613508566d4c5f4eee00bcb1bb3e87bfb24cac3e9f83ba32a1f34895",
+  "package.json": "f9355cee809ed0065b6d76851608475195ce10dfb07c76e8e8af4a5b909d1692",
+  "src/db/queries.ts": "b87a71ce7ce2170f224ab81ee8e02de5f3ca07501cd5165142ab5fd12e23dca4",
+  "src/engine.ts": "8eba050f1f4e7dfa7577c20c55dbeac9d0649877968f726b5f41fb8879449901",
+  "src/extraction/commonjs-eval.ts": "c194fa2bc6d0306351a19ee7056edf8cc83a3c9b2d0f71acc1eaba7186c9ee7f",
+  "src/extraction/index.ts": "539d2e22b6cbbc96524a9c288291a26a20489cd216d759ea08fd1eb26fd3e232",
+  "src/extraction/kernel/index.ts": "d1eeb86bf08c3c1e51401620cff0d6f214fbfea91849dbb8c5ebbddbac634e88",
+  "src/extraction/parse-worker.ts": "4b4a833dfb90a359ce02b371b6f2cf2c4099e33e03a6d951b478d4698fde3c24",
+  "src/extraction/tree-sitter.ts": "da1cbace568e89a1f468114eb9320a96a49189e3575a86b6a102eb80972c7c27",
+  "src/index.ts": "c37a323df3d68e44b76fe659d2590756661ebbfb6971ea78ec79787c2c45fce3",
+  "src/resolution/commonjs-export-evidence.ts": "10afb7b84940f107c0d028372d5e9e986b43337649e26f433e6ffa5473a7cc41",
+  "src/resolution/commonjs-export-members.ts": "15ab8a9dd27053d16e6592821a2e35e867a88dcd5dce44a393f1be13aae48b5d",
+  "src/resolution/commonjs-value-graph.ts": "6dff32adaab254f720b669449b934bc3d97203ee862edc58027364e8a9ddf5cc",
+  "src/resolution/const-alias-synthesizer.ts": "9e7b6ff1557d019ae0ee53c4d53d3a4ca444c111c53c50ba365f311c1bcbd8a0",
+  "src/resolution/import-resolver.ts": "1bb89401511ff3603b1ecd3800595688236e0ac75df18ef962e138ca30aad6d4",
+  "src/resolution/index.ts": "0af20fe98cde962ee13d5381574224bf17b6a753ced449e275639ac53955fa4b",
+  "src/resolution/module-importers.ts": "e4deb458c8eb2c6599eacc46a441e7f8a41df00556a6297d711267ebdb5dd053",
+  "src/resolution/name-matcher.ts": "5c86a224368d28486ec31e2ddd2072f17b9db2b716da0dbd931f452284fd4ae5",
+  "src/resolution/types.ts": "47fddba8a07fc4e2b58052b75e3e31c5c386ae267a87a66cf5bad073ef3c0f99",
+  "src/types.ts": "f976a65f75555979f4ad73058f3ba6765c3fb515bd401b05b4ceb7e1847db949"
+}
diff --git a/docs/handoffs/pr29-2026-11-10/implementation/working-tree.patch.gz b/docs/handoffs/pr29-2026-11-10/implementation/working-tree.patch.gz
new file mode 100644
index 0000000000..d219114d5c
Binary files /dev/null and b/docs/handoffs/pr29-2026-11-10/implementation/working-tree.patch.gz differ
diff --git a/docs/handoffs/pr29-2026-11-10/inventory.json b/docs/handoffs/pr29-2026-11-10/inventory.json
new file mode 100644
index 0000000000..7c865352cb
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/inventory.json
@@ -0,0 +1,807 @@
+{
+  "created": "2026-11-10T12:20:35.410641+00:00",
+  "implementationBase": "87576a8d9ff0d8aba235db5535f5f4429f14b037",
+  "files": [
+    {
+      "source": "/home/ericm/.codex/plans/codegraph-commonjs-fix-2026-11-08.md",
+      "file": "plans/codegraph-commonjs-fix-2026-11-08.md",
+      "group": "session plans and handoffs",
+      "sha256": "7096f7e61b3a7bb8a04736ed78e154a148b3b3e649dbf32c3c3359990e2e6e05"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/codegraph-commonjs-review-corrections-2026-11-09.md",
+      "file": "plans/codegraph-commonjs-review-corrections-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "9bc8601105243c2ae0e868b04b97a2f795fff293bcc1030c5d10867f44614b28"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/compare-astra-sol-pr29-export-contract-2026-11-09.md",
+      "file": "plans/compare-astra-sol-pr29-export-contract-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "d48a4ae960f1428523136836139fd0c546148d1ccf6e2af40d0a4ee9dbf91f79"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/compare-astra-sol-pr29-progress-2026-11-09.json",
+      "file": "plans/compare-astra-sol-pr29-progress-2026-11-09.json",
+      "group": "session plans and handoffs",
+      "sha256": "bd2762cdc4f01daf9bfd72cbde09608a602e1671799ad52c4308f9627d88bf58"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/explore-pr29-export-evidence-boundary-2026-11-09.md",
+      "file": "plans/explore-pr29-export-evidence-boundary-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "ba624120f010bafc3e09b563d72ffe5e5c367fc0af8f479dfc59b107d0acd4bf"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/explore-pr29-positive-export-evidence-2026-11-09.md",
+      "file": "plans/explore-pr29-positive-export-evidence-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "3a7bdd7bd22a6fb82eda4b03cd69a3ae2dc71a3d03f5763032d5b51256021406"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/handoff-codegraph-commonjs-corrected-review-pending-2026-11-09.md",
+      "file": "plans/handoff-codegraph-commonjs-corrected-review-pending-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "fd602e86ac29d2eba1d816f91d742aecb98c6cd2158922609103dab0cce6c031"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/handoff-codegraph-commonjs-corrections-running-2026-11-09.md",
+      "file": "plans/handoff-codegraph-commonjs-corrections-running-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "8d8f68aa88d8f56eb18b6b0f7333318e90af4798641b3bd243c0c9535b3d8290"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/handoff-codegraph-commonjs-final-review-f8-2026-11-09.md",
+      "file": "plans/handoff-codegraph-commonjs-final-review-f8-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "8b58124b4421b918194a0db60b68cf688f5d559babf3d6bb85b8b19cac99a7d4"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/handoff-codegraph-commonjs-final-verification-running-2026-11-09.md",
+      "file": "plans/handoff-codegraph-commonjs-final-verification-running-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "15dc862e97d0aca4b797e114bb6ca945c4a8ac55e3ecad8e0d69a2ea4c7212be"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/handoff-codegraph-commonjs-fix-running-2026-11-08.md",
+      "file": "plans/handoff-codegraph-commonjs-fix-running-2026-11-08.md",
+      "group": "session plans and handoffs",
+      "sha256": "3b2d804007afdb2a66c24380aa55da7fa639e86c1c9e831ba1cb96afa439c605"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/handoff-codegraph-commonjs-investigation-2026-11-08.md",
+      "file": "plans/handoff-codegraph-commonjs-investigation-2026-11-08.md",
+      "group": "session plans and handoffs",
+      "sha256": "becfb98694668c70b8a2035355573079d3cb16013d531533e8e007f8466426c2"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/handoff-codegraph-commonjs-modular-eval-2026-11-09.md",
+      "file": "plans/handoff-codegraph-commonjs-modular-eval-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "c94474809d1da4160e5e6b89f7a766415d99dfe547ae762a6e57395caad6f387"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/handoff-codegraph-commonjs-namespace-fix-2026-11-08.md",
+      "file": "plans/handoff-codegraph-commonjs-namespace-fix-2026-11-08.md",
+      "group": "session plans and handoffs",
+      "sha256": "58b139a8586da738ed973f3b7fc6ca27645b76e9ffc12e9c9e7c95681880c098"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/handoff-codegraph-commonjs-review-blocked-2026-11-09.md",
+      "file": "plans/handoff-codegraph-commonjs-review-blocked-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "39ab1843d98d4bb56767e7d183a862fcbe2c161bb88f605eb6351a319c7b19f2"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/handoff-codegraph-commonjs-tested-review-pending-2026-11-08.md",
+      "file": "plans/handoff-codegraph-commonjs-tested-review-pending-2026-11-08.md",
+      "group": "session plans and handoffs",
+      "sha256": "583d53c4f93649a9a46f54f2d609145a53dcddce794b6ce3dfd1c892321bfe00"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/handoff-codegraph-commonjs-tracked-2026-11-08.md",
+      "file": "plans/handoff-codegraph-commonjs-tracked-2026-11-08.md",
+      "group": "session plans and handoffs",
+      "sha256": "e6a55abbcfa05cab301d0c5756b56d96c16a1b5bbe2af283c6c0c471ea1a0c33",
+      "sourceSha256": "b174076d9ef10d75149cbbf5f155bee3bbff9fdc353037f20df7d4ae3f9153a9",
+      "normalization": "removed extra blank line at EOF; original retained at source"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/handoff-codegraph-commonjs-two-draft-prs-testing-2026-11-09.md",
+      "file": "plans/handoff-codegraph-commonjs-two-draft-prs-testing-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "bef5d4b348d9b6a2a959456617ba6cfe1d93189bd6478091d980af103382cf9a"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/handoff-codegraph-commonjs-two-draft-prs-verified-2026-11-09.md",
+      "file": "plans/handoff-codegraph-commonjs-two-draft-prs-verified-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "f6467e7e675e3c2601dc554c1a0c7e4622b5c97cba42f7c447dc4d980a31a752"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/handoff-codegraph-pr29-ast-integrated-review8-running-2026-11-09.md",
+      "file": "plans/handoff-codegraph-pr29-ast-integrated-review8-running-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "a44852c9c86085e9901cdd0dae6cf0d5d7d228cd0beda010b8c11ff3f391a9e6"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/handoff-codegraph-pr29-ast-redesign-started-2026-11-09.md",
+      "file": "plans/handoff-codegraph-pr29-ast-redesign-started-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "b3d215530c3db763fb30ffd4e0a123fd36e9658d668c5d240f992668cade205d"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/handoff-codegraph-pr29-ast-review8-two-findings-2026-11-09.md",
+      "file": "plans/handoff-codegraph-pr29-ast-review8-two-findings-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "9053bcecb8f42d75c7e622171becd47f21175d7a9fdc744796b809ada0f7fb95"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/handoff-codegraph-pr29-dual-review-two-findings-2026-11-09.md",
+      "file": "plans/handoff-codegraph-pr29-dual-review-two-findings-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "daee776e8b3f92dfae06d993122553f1f73c120db45077ef891816854c307a7a"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/handoff-codegraph-pr29-evidence-prototype-complete-2026-11-09.md",
+      "file": "plans/handoff-codegraph-pr29-evidence-prototype-complete-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "9b044463f0aefb6468a3c56285872e5309fd3587d2d53a50deb317ca10cc9a2a"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/handoff-codegraph-pr29-evidence-prototype-progress-2026-11-09.md",
+      "file": "plans/handoff-codegraph-pr29-evidence-prototype-progress-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "dcefc8ad25c7de659867d2e863c2ec4d1b57c0bb7a8e5da0e933e6f89035fe81",
+      "sourceSha256": "23b39ad7a6f83779323c8b07f7fb657b37769ab9a7f2994d2380d78cc2d224f4",
+      "normalization": "Rephrased binding API as binding interface; test-result token and every other word unchanged; original note retained."
+    },
+    {
+      "source": "/home/ericm/.codex/plans/handoff-codegraph-pr29-export-evidence-integrated-2026-11-09.md",
+      "file": "plans/handoff-codegraph-pr29-export-evidence-integrated-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "306dace3f3520484729a61a4dd07b0f9322deccf45cd0931c664f4d885c9d55d"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/handoff-codegraph-pr29-f10-f11-corrected-review-pending-2026-11-09.md",
+      "file": "plans/handoff-codegraph-pr29-f10-f11-corrected-review-pending-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "44f8105295709f96f0bb4a5dfc01addf03742a30b0693024f57fb1cbf5fad71e"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/handoff-codegraph-pr29-f12-focused-2026-11-09.md",
+      "file": "plans/handoff-codegraph-pr29-f12-focused-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "a0b7cd5edcfa1ef71508651892e0cf6b1975f6db421d3b087076c5e34788184a"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/handoff-codegraph-pr29-harness-complete-2026-11-10.md",
+      "file": "plans/handoff-codegraph-pr29-harness-complete-2026-11-10.md",
+      "group": "session plans and handoffs",
+      "sha256": "f1c096c73ea43bcd2b906e5056c719f44f2b7fadaed8416c6448daaf1bacdb1a"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/handoff-codegraph-pr29-review10-two-findings-2026-11-09.md",
+      "file": "plans/handoff-codegraph-pr29-review10-two-findings-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "e8bdb347715071204adfa70455b3d569c6be3327e2131d153760d64017c73603"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/handoff-codegraph-pr29-review11-two-findings-2026-11-09.md",
+      "file": "plans/handoff-codegraph-pr29-review11-two-findings-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "11240d7d4616f7a014b10ac788d69275fe086e003e861c1f0f39944d151c708b"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/handoff-codegraph-pr29-review9-root-export-regression-2026-11-09.md",
+      "file": "plans/handoff-codegraph-pr29-review9-root-export-regression-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "b2194fd6fcae4d4b2561f687d30b79df0c8f47d32ca89a1364d2f39bd70801d2"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/handoff-codegraph-pr29-session-end-2026-11-09.md",
+      "file": "plans/handoff-codegraph-pr29-session-end-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "5ebaabf9e7e80a9ba7b1aa519e163ab074063432e9c8d6b41cc655df45054452"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/handoff-codegraph-pr29-value-contract-complete-2026-11-09.md",
+      "file": "plans/handoff-codegraph-pr29-value-contract-complete-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "b2cff6f81ef062da3b385cbac16164f11a534814722050668929dabb2f88d472"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/handoff-codegraph-pr29-value-contract-progress-2026-11-09.md",
+      "file": "plans/handoff-codegraph-pr29-value-contract-progress-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "21614cb668e8871685b8f11789a8eb25294f5449f44cc92d110eccad111c6a05"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/handoff-codegraph-pr29-value-model-integrated-2026-11-09.md",
+      "file": "plans/handoff-codegraph-pr29-value-model-integrated-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "35b6582cda55528478eb3425719feec3596748d42f37f4fd9337d9700daec3f6"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/plan-astra-pr29-export-contract-2026-11-09.md",
+      "file": "plans/plan-astra-pr29-export-contract-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "2a6bc886d25e0b5a881cedc7cfb762bcc52b83b28e62ecc4d7e69b55a7308226"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/plan-codegraph-pr29-evidence-prototype-2026-11-09.md",
+      "file": "plans/plan-codegraph-pr29-evidence-prototype-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "b94528cf839072bc819807d074cf9d93b088695216e14302772953c45b9b55f3"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/plan-codegraph-pr29-export-evidence-integration-2026-11-09.md",
+      "file": "plans/plan-codegraph-pr29-export-evidence-integration-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "2d542abde5bf892b11d3bae28a74925bbd6b1e3e37059885e66d182664dbb7cb"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/plan-codegraph-pr29-f12-2026-11-09.md",
+      "file": "plans/plan-codegraph-pr29-f12-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "8b4541c1c20db6fbc8c2bbd4c1bae928d80cfa8ce34d8130ec9a35aedca24a18"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/plan-codegraph-pr29-harness-2026-11-09.md",
+      "file": "plans/plan-codegraph-pr29-harness-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "84b7c845b99824f5d985c516033534ab75923935e716877e142ee330242a49d7"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/plan-codegraph-pr29-value-contract-spike-2026-11-09.md",
+      "file": "plans/plan-codegraph-pr29-value-contract-spike-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "3ea01debf0439af87d4d1d6ac23bc2dd7bef647cbd69cb6a1c43c28edb62412a"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/plan-codegraph-pr29-value-model-integration-2026-11-09.md",
+      "file": "plans/plan-codegraph-pr29-value-model-integration-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "23eaa2c832ac8262c50c1788a381e98af72f11daa097b573f2a8b75f5a965740"
+    },
+    {
+      "source": "/home/ericm/.codex/plans/plan-sol-pr29-export-contract-2026-11-09.md",
+      "file": "plans/plan-sol-pr29-export-contract-2026-11-09.md",
+      "group": "session plans and handoffs",
+      "sha256": "e548ff642e44a9d64d20c8b1e23880dfef75ff953ce745f16384e1d4a9f9eb75"
+    },
+    {
+      "source": "/tmp/codegraph-cjs-missing-fix-20261108/.review/checkpoint-corrected-review-pending-2026-11-09.md",
+      "file": "ledgers/checkpoint-corrected-review-pending-2026-11-09.md",
+      "group": "checkout review ledger",
+      "sha256": "fd602e86ac29d2eba1d816f91d742aecb98c6cd2158922609103dab0cce6c031"
+    },
+    {
+      "source": "/tmp/codegraph-cjs-missing-fix-20261108/.review/checkpoint-corrections-running-2026-11-09.md",
+      "file": "ledgers/checkpoint-corrections-running-2026-11-09.md",
+      "group": "checkout review ledger",
+      "sha256": "8d8f68aa88d8f56eb18b6b0f7333318e90af4798641b3bd243c0c9535b3d8290"
+    },
+    {
+      "source": "/tmp/codegraph-cjs-missing-fix-20261108/.review/checkpoint-namespace-redesign.md",
+      "file": "ledgers/checkpoint-namespace-redesign.md",
+      "group": "checkout review ledger",
+      "sha256": "58b139a8586da738ed973f3b7fc6ca27645b76e9ffc12e9c9e7c95681880c098"
+    },
+    {
+      "source": "/tmp/codegraph-cjs-missing-fix-20261108/.review/checkpoint-tested-review-pending.md",
+      "file": "ledgers/checkpoint-tested-review-pending.md",
+      "group": "checkout review ledger",
+      "sha256": "583d53c4f93649a9a46f54f2d609145a53dcddce794b6ce3dfd1c892321bfe00"
+    },
+    {
+      "source": "/tmp/codegraph-cjs-missing-fix-20261108/.review/checkpoint-third-review-blocked-2026-11-09.md",
+      "file": "ledgers/checkpoint-third-review-blocked-2026-11-09.md",
+      "group": "checkout review ledger",
+      "sha256": "39ab1843d98d4bb56767e7d183a862fcbe2c161bb88f605eb6351a319c7b19f2"
+    },
+    {
+      "source": "/tmp/codegraph-cjs-missing-fix-20261108/.review/checkpoint-verify2-running.md",
+      "file": "ledgers/checkpoint-verify2-running.md",
+      "group": "checkout review ledger",
+      "sha256": "3b2d804007afdb2a66c24380aa55da7fa639e86c1c9e831ba1cb96afa439c605"
+    },
+    {
+      "source": "/tmp/codegraph-cjs-missing-fix-20261108/.review/commonjs-eval-callee-context.md",
+      "file": "ledgers/commonjs-eval-callee-context.md",
+      "group": "checkout review ledger",
+      "sha256": "f6c6082e48e440842439c63af886448a2796bafc472bfffa7c275ad96e684055"
+    },
+    {
+      "source": "/tmp/codegraph-cjs-missing-fix-20261108/.review/commonjs-missing-member.md",
+      "file": "ledgers/commonjs-missing-member.md",
+      "group": "checkout review ledger",
+      "sha256": "727333dbbb83a90b22a7af83a853333a785e4f230749d66d19eb4428cf31ca97"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/ast-f10-f11-corrected-2026-11-09/commonjs-eval-callee-context.md",
+      "file": "history/ast-f10-f11-corrected-2026-11-09/commonjs-eval-callee-context.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "0aaa7467f0a3f47522f5c669df5098a140d13a394100c910c7f4fead303c5975"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/ast-f10-f11-corrected-2026-11-09/commonjs-missing-member.md",
+      "file": "history/ast-f10-f11-corrected-2026-11-09/commonjs-missing-member.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "41c9ac2b703a1d07efbb14eaa830fb94081a896fa762f7ecbc980b09dda3cea9"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/ast-integrated-review8-2026-11-09/commonjs-eval-callee-context.md",
+      "file": "history/ast-integrated-review8-2026-11-09/commonjs-eval-callee-context.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "c7ba6c7888a82149c5d54bfc6d2cde0f20e6c5fdfd89c30649083fd313dd1964"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/ast-integrated-review8-2026-11-09/commonjs-missing-member.md",
+      "file": "history/ast-integrated-review8-2026-11-09/commonjs-missing-member.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "dc9ea001528a96e63db9a2e8190e441e262c3d39833eeda9f071efe26e60e39f"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/ast-integrated-review8-2026-11-09/merged-review.md",
+      "file": "history/ast-integrated-review8-2026-11-09/merged-review.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "ae263b15e67998eea1783cf9399d90020ba1a3b3535e8067ccee1ca8fb7e14e5"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/ast-integrated-review8-2026-11-09/review-ledger.md",
+      "file": "history/ast-integrated-review8-2026-11-09/review-ledger.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "b4ccea21a852cbec766494cf4ad40e4fdc7eb083854d9eee7067c8730a47ce52"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/ast-redesign-started-2026-11-09/commonjs-eval-callee-context.md",
+      "file": "history/ast-redesign-started-2026-11-09/commonjs-eval-callee-context.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "b0f723271921f35a949255ea4f377261a9e4afdfcf0815d748f477c7d1907c96"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/ast-redesign-started-2026-11-09/commonjs-missing-member.md",
+      "file": "history/ast-redesign-started-2026-11-09/commonjs-missing-member.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "7b190870e9db4857794441b4b118b53eafec82b60f800ddcce3ae56f0cbeefe9"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/corrections-2026-11-09/handoff.md",
+      "file": "history/corrections-2026-11-09/handoff.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "fd602e86ac29d2eba1d816f91d742aecb98c6cd2158922609103dab0cce6c031"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/corrections-2026-11-09/review-ledger.md",
+      "file": "history/corrections-2026-11-09/review-ledger.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "466bbc29c01840902ecf40102c9c9847f27b8f8d5f2492bc042f5e96443cdd32"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/final-verification-2026-11-09/commonjs-missing-member.md",
+      "file": "history/final-verification-2026-11-09/commonjs-missing-member.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "31e6bb0bd09bf5fb3355e6b43e2a0dd9ea91cc4ea9c37e27867aefd649ae0c46"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-evidence-prototype-2026-11-09/README.md",
+      "file": "history/pr29-evidence-prototype-2026-11-09/README.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "8e3a60901e8335d483967fb24a0791e6063ff3caf895d3bfec21b84a364e8886"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-evidence-prototype-2026-11-09/handoff-codegraph-pr29-evidence-prototype-complete-2026-11-09.md",
+      "file": "history/pr29-evidence-prototype-2026-11-09/handoff-codegraph-pr29-evidence-prototype-complete-2026-11-09.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "9b044463f0aefb6468a3c56285872e5309fd3587d2d53a50deb317ca10cc9a2a"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-evidence-prototype-2026-11-09/plan-codegraph-pr29-evidence-prototype-2026-11-09.md",
+      "file": "history/pr29-evidence-prototype-2026-11-09/plan-codegraph-pr29-evidence-prototype-2026-11-09.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "b94528cf839072bc819807d074cf9d93b088695216e14302772953c45b9b55f3"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-export-evidence-integration-2026-11-09/commonjs-eval-callee-context.md",
+      "file": "history/pr29-export-evidence-integration-2026-11-09/commonjs-eval-callee-context.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "0e7ff75ee55256fe575acc05f374a1913ec4a6d658cde3b4b488c72325ebda85"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-export-evidence-integration-2026-11-09/handoff-codegraph-pr29-export-evidence-integrated-2026-11-09.md",
+      "file": "history/pr29-export-evidence-integration-2026-11-09/handoff-codegraph-pr29-export-evidence-integrated-2026-11-09.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "306dace3f3520484729a61a4dd07b0f9322deccf45cd0931c664f4d885c9d55d"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-export-evidence-integration-2026-11-09/plan-codegraph-pr29-export-evidence-integration-2026-11-09.md",
+      "file": "history/pr29-export-evidence-integration-2026-11-09/plan-codegraph-pr29-export-evidence-integration-2026-11-09.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "2d542abde5bf892b11d3bae28a74925bbd6b1e3e37059885e66d182664dbb7cb"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-f12-2026-11-09/commonjs-eval-callee-context.md",
+      "file": "history/pr29-f12-2026-11-09/commonjs-eval-callee-context.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "984a6fb49f82564f7b9029dc06966a157366ed0d8da41b1aaa039f227fcccf7b"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-f12-2026-11-09/handoff-codegraph-pr29-f12-focused-2026-11-09.md",
+      "file": "history/pr29-f12-2026-11-09/handoff-codegraph-pr29-f12-focused-2026-11-09.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "a0b7cd5edcfa1ef71508651892e0cf6b1975f6db421d3b087076c5e34788184a"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-f12-2026-11-09/plan-codegraph-pr29-f12-2026-11-09.md",
+      "file": "history/pr29-f12-2026-11-09/plan-codegraph-pr29-f12-2026-11-09.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "8b4541c1c20db6fbc8c2bbd4c1bae928d80cfa8ce34d8130ec9a35aedca24a18"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-harness-20261110T013135Z/build-diff.md",
+      "file": "history/pr29-harness-20261110T013135Z/build-diff.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "a6b9b913b94d7bfc749071fca0da9e89d42ee6924b7cc88424083fcf16e11a3d"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-harness-20261110T013135Z/handoff-codegraph-pr29-harness-complete-2026-11-10.md",
+      "file": "history/pr29-harness-20261110T013135Z/handoff-codegraph-pr29-harness-complete-2026-11-10.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "f1c096c73ea43bcd2b906e5056c719f44f2b7fadaed8416c6448daaf1bacdb1a"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-harness-20261110T013135Z/report.md",
+      "file": "history/pr29-harness-20261110T013135Z/report.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "5d4fe80521531c4aa6325cc061a7615996cefe80e7923bffb290da1a93f38723"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-review-round7-2026-11-09/commonjs-eval-callee-context.md",
+      "file": "history/pr29-review-round7-2026-11-09/commonjs-eval-callee-context.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "9174676d7154a6abdf209b8f5b3725bf9557a7a639dbf5aac0b81b36475e382d"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-review-round7-2026-11-09/commonjs-missing-member.md",
+      "file": "history/pr29-review-round7-2026-11-09/commonjs-missing-member.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "9dc7b7555179e9eb6e18e427270deadaf4b720d68affaddcab34b267f100e6c9"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-review-round7-2026-11-09/merged-review.md",
+      "file": "history/pr29-review-round7-2026-11-09/merged-review.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "e8f7ffb119f1bb60d7cceb423837dcf7b34ec688869d4a38e537926623c84a52"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-review10-2026-11-09/adversarial-report.md",
+      "file": "history/pr29-review10-2026-11-09/adversarial-report.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "c883b73283c712cbcdd29ae88cd8b6ff628899068b2b18c4339815b0b741bdd0"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-review10-2026-11-09/broad-report.md",
+      "file": "history/pr29-review10-2026-11-09/broad-report.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "17536e02029d2468cc6220e6d09ca939e730001098b4ce2dfafe6e87422bf660"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-review10-2026-11-09/commonjs-eval-callee-context.md",
+      "file": "history/pr29-review10-2026-11-09/commonjs-eval-callee-context.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "d417b843b9a7a83369938f2a6504a1ccd51de924750f84dcf2a1b7a69c468892"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-review10-2026-11-09/handoff-codegraph-pr29-review10-two-findings-2026-11-09.md",
+      "file": "history/pr29-review10-2026-11-09/handoff-codegraph-pr29-review10-two-findings-2026-11-09.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "e8bdb347715071204adfa70455b3d569c6be3327e2131d153760d64017c73603"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-review10-2026-11-09/merged-review.md",
+      "file": "history/pr29-review10-2026-11-09/merged-review.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "47368ef7b4bb277edf77606bec466b596519a8f9e23940a1efd3b5c88b19a0c6"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-review11-2026-11-09/adversarial-artifacts/cg-a11-final-report.md",
+      "file": "history/pr29-review11-2026-11-09/adversarial-artifacts/cg-a11-final-report.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "5b2620c7ae99653796f3e28d180ed48358f50297f5ee92e438385a7d643e733e"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-review11-2026-11-09/adversarial-report.md",
+      "file": "history/pr29-review11-2026-11-09/adversarial-report.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "5b2620c7ae99653796f3e28d180ed48358f50297f5ee92e438385a7d643e733e"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-review11-2026-11-09/broad-report.md",
+      "file": "history/pr29-review11-2026-11-09/broad-report.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "c10747af4824cd94cec7fd27174bb35afe166509db2fbc1ffc2884c993772409"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-review11-2026-11-09/commonjs-eval-callee-context.md",
+      "file": "history/pr29-review11-2026-11-09/commonjs-eval-callee-context.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "281ae45fdc51f84b6d1937f10ed1870dd0514706ff2f7b6be6e428af9b1fe7b0"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-review11-2026-11-09/compare-astra-sol-pr29-export-contract-2026-11-09.md",
+      "file": "history/pr29-review11-2026-11-09/compare-astra-sol-pr29-export-contract-2026-11-09.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "d48a4ae960f1428523136836139fd0c546148d1ccf6e2af40d0a4ee9dbf91f79"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-review11-2026-11-09/handoff-codegraph-pr29-review11-two-findings-2026-11-09.md",
+      "file": "history/pr29-review11-2026-11-09/handoff-codegraph-pr29-review11-two-findings-2026-11-09.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "11240d7d4616f7a014b10ac788d69275fe086e003e861c1f0f39944d151c708b"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-review11-2026-11-09/merged-review.md",
+      "file": "history/pr29-review11-2026-11-09/merged-review.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "216b78496fee14774c03c4f7065f2c23c8c191d9cca44f0978b9323ee247ca87"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-review11-2026-11-09/plan-astra-pr29-export-contract-2026-11-09.md",
+      "file": "history/pr29-review11-2026-11-09/plan-astra-pr29-export-contract-2026-11-09.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "2a6bc886d25e0b5a881cedc7cfb762bcc52b83b28e62ecc4d7e69b55a7308226"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-review11-2026-11-09/plan-sol-pr29-export-contract-2026-11-09.md",
+      "file": "history/pr29-review11-2026-11-09/plan-sol-pr29-export-contract-2026-11-09.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "e548ff642e44a9d64d20c8b1e23880dfef75ff953ce745f16384e1d4a9f9eb75"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-review9-2026-11-09/commonjs-eval-callee-context.md",
+      "file": "history/pr29-review9-2026-11-09/commonjs-eval-callee-context.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "3be44c0d1f58d49fa29e89c20955f2358ca90a1f03c590adf3f024581552f341"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-review9-2026-11-09/commonjs-missing-member.md",
+      "file": "history/pr29-review9-2026-11-09/commonjs-missing-member.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "727333dbbb83a90b22a7af83a853333a785e4f230749d66d19eb4428cf31ca97"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-review9-2026-11-09/merged-review.md",
+      "file": "history/pr29-review9-2026-11-09/merged-review.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "13c439af3fa583f2153527d90429c60572997f2d34734a642ef129f325a48c8b"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-value-contract-spike-2026-11-09/README.md",
+      "file": "history/pr29-value-contract-spike-2026-11-09/README.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "b365b414e23fff3d96ea29ad8b16d9769a5d3686e78edd19eb81b6d7f57d984d"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-value-contract-spike-2026-11-09/handoff-codegraph-pr29-value-contract-complete-2026-11-09.md",
+      "file": "history/pr29-value-contract-spike-2026-11-09/handoff-codegraph-pr29-value-contract-complete-2026-11-09.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "b2cff6f81ef062da3b385cbac16164f11a534814722050668929dabb2f88d472"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-value-contract-spike-2026-11-09/plan-codegraph-pr29-value-contract-spike-2026-11-09.md",
+      "file": "history/pr29-value-contract-spike-2026-11-09/plan-codegraph-pr29-value-contract-spike-2026-11-09.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "3ea01debf0439af87d4d1d6ac23bc2dd7bef647cbd69cb6a1c43c28edb62412a"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-value-model-integration-2026-11-09/handoff-codegraph-pr29-value-model-integrated-2026-11-09.md",
+      "file": "history/pr29-value-model-integration-2026-11-09/handoff-codegraph-pr29-value-model-integrated-2026-11-09.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "35b6582cda55528478eb3425719feec3596748d42f37f4fd9337d9700daec3f6"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-value-model-integration-2026-11-09/milestone1/status.md",
+      "file": "history/pr29-value-model-integration-2026-11-09/milestone1/status.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "c64eaea8e37dc3aaed3bd73ffcdaf0ae92cd01261d7e00f07c70b587a14c0c35"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-value-model-integration-2026-11-09/milestone2/status.md",
+      "file": "history/pr29-value-model-integration-2026-11-09/milestone2/status.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "5aebba7dc18d3d11901ee9bd4b78f079d0f2486a8787a4f3893e93d4c8352642"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/review-ledger-before-third-round.md",
+      "file": "history/review-ledger-before-third-round.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "e364fc07c233132e8c2516c6f6557a635b8368afb918399252d91447ff31d837"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/review-ledger-tested-pending.md",
+      "file": "history/review-ledger-tested-pending.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "4bc1af5ddc9bc0c68662a2ddeb3b783f45a64b20fb105c1830124d71e6be0d33"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/session-end-2026-11-09/exploration.md",
+      "file": "history/session-end-2026-11-09/exploration.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "ba624120f010bafc3e09b563d72ffe5e5c367fc0af8f479dfc59b107d0acd4bf"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/session-end-2026-11-09/handoff.md",
+      "file": "history/session-end-2026-11-09/handoff.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "5ebaabf9e7e80a9ba7b1aa519e163ab074063432e9c8d6b41cc655df45054452"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/third-review-2026-11-09/handoff.md",
+      "file": "history/third-review-2026-11-09/handoff.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "39ab1843d98d4bb56767e7d183a862fcbe2c161bb88f605eb6351a319c7b19f2"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/third-review-2026-11-09/review-ledger.md",
+      "file": "history/third-review-2026-11-09/review-ledger.md",
+      "group": "archived review and checkpoint notes",
+      "sha256": "1645be5d2b5d892e40817a9b22ade2e9949bf9918bb545f06201bcf03eab8017"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-harness-20261110T013135Z/results.json",
+      "file": "harness/results.json",
+      "group": "complete harness result data",
+      "sha256": "4c56caab4d63aa59fbda75ec243f8c61961d455c1402c74b86cb5f4559746670"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-harness-20261110T013135Z/execution.json",
+      "file": "harness/execution.json",
+      "group": "complete harness result data",
+      "sha256": "3d336dafb0cf98d4f442f2c76e493ea98f168173348a11246602c23e62c2730f"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-harness-20261110T013135Z/manifest.json",
+      "file": "harness/manifest.json",
+      "group": "complete harness result data",
+      "sha256": "36810595131c7789546539e9210b516acb668a096f434e1ca7a4d2d801780eb7",
+      "sourceSha256": "b6498a856c6c0a2f9c543bbe41d1a743cc1dde245ff78659634fa922cf2f718d",
+      "normalization": "Represented independently recomputed SHA256 path-to-digest map as checksum/path records; values unchanged."
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-harness-20261110T013135Z/preservation-audit.json",
+      "file": "harness/preservation-audit.json",
+      "group": "complete harness result data",
+      "sha256": "a362fed978891599515c1a36bfbf8b1e37b3d8dfa9dc2dca37bc99aae4a7136f"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-harness-20261110T013135Z/metamorphic-comparison.json",
+      "file": "harness/metamorphic-comparison.json",
+      "group": "complete harness result data",
+      "sha256": "e620500a4a3d0fb6e9adb76250bff03fde07c1db86771b5dee10aff47e1b7a5c"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-harness-20261110T013135Z/timing-summary.json",
+      "file": "harness/timing-summary.json",
+      "group": "complete harness result data",
+      "sha256": "35842bef49019acda40e53b555a1ca38122778bc3fa22ec17438a8cc8bf76647"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-harness-20261110T013135Z/timings.json",
+      "file": "harness/timings.json",
+      "group": "complete harness result data",
+      "sha256": "50edfde5ec226edbe8c0ba8cf5572c75938522c4bdf081c83224936854ce5454"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-harness-20261110T013135Z/build-diff.json",
+      "file": "harness/build-diff.json",
+      "group": "complete harness result data",
+      "sha256": "1a09fbbc5f4ef86130cc7ff7b6db36c1f599cb6e2ca9c32d14b7bd0e7524114f"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-harness-20261110T013135Z/shadow.json",
+      "file": "harness/shadow.json",
+      "group": "complete harness result data",
+      "sha256": "8e1f8be6550f8e7a3190837bbbb18583334e860fd5a0309ae37262d6ab0c66b6"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-harness-20261110T013135Z/replay-baseline.json",
+      "file": "harness/replay-baseline.json",
+      "group": "complete harness result data",
+      "sha256": "b4b7431e72393b44f666352cbf099be776102de4725938764cda6267163c2a3e"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-harness-20261110T013135Z/replay-candidate.json",
+      "file": "harness/replay-candidate.json",
+      "group": "complete harness result data",
+      "sha256": "9664223b89c9491e871cbcdbb487ebad84d1057a5dc1eab8217374d071068972"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-harness-20261110T013135Z/modes-baseline.json",
+      "file": "harness/modes-baseline.json",
+      "group": "complete harness result data",
+      "sha256": "955947137d27fb29f6ae4c1da14fdd5bf2b7c21b6a7f5696c948e17b1677ba57"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-harness-20261110T013135Z/modes-candidate.json",
+      "file": "harness/modes-candidate.json",
+      "group": "complete harness result data",
+      "sha256": "c24b849fd6368dcfef9804b2ead2bfb2a6aad731110b4942011095c4afeba73b"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-harness-20261110T013135Z/metamorphic-baseline.json",
+      "file": "harness/metamorphic-baseline.json",
+      "group": "complete harness result data",
+      "sha256": "94e6261d587cb0fbfacf625aa2c69a0fa96e9d2ee98fd2a11722936d1000aae9"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-harness-20261110T013135Z/metamorphic-candidate.json",
+      "file": "harness/metamorphic-candidate.json",
+      "group": "complete harness result data",
+      "sha256": "e7e3470deecd4740783bba5131a1067ebc4e79635bc3634af8d57e57a3664010"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-harness-20261110T013135Z/express-classification.json",
+      "file": "harness/express-classification.json",
+      "group": "complete harness result data",
+      "sha256": "1107c6c47cffb1cc195c1b020addc773968e45348b948d73480591b8e16a4ecc"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-harness-20261110T013135Z/pr29-fixtures.json",
+      "file": "harness/pr29-fixtures.json",
+      "group": "complete harness result data",
+      "sha256": "9b820ba0c0a4e0f83b161b23a0e3c4e6c3b6f07c12985436f02f094ec00e9517"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-harness-20261110T013135Z/mode-seeds.json",
+      "file": "harness/mode-seeds.json",
+      "group": "complete harness result data",
+      "sha256": "d44acdc701885d3a5baa4595ff3b85c63d0f930c4c32c99b86e967dfd6a6506d"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-harness-20261110T013135Z/questions.json",
+      "file": "harness/questions.json",
+      "group": "complete harness result data",
+      "sha256": "ac2cb867d1df8eb22a94d5a9caa1399cd66fcaa20ef2cb038e48cdac7ef184c7"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-harness-20261110T013135Z/qa-input-sha256.json",
+      "file": "harness/qa-input-sha256.json",
+      "group": "complete harness result data",
+      "sha256": "176a1d62e5913d3ae7dd8a442b329e51a5fab2900fbf3894f1519967129fca79",
+      "sourceSha256": "07b6a54a9796c6156ac8460e242c8e242363a034b585aee63a445a6c666f7a2c",
+      "normalization": "Represented independently recomputed SHA256 path-to-digest map as checksum/path records; values unchanged."
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-value-model-integration-2026-11-09/results.json",
+      "file": "implementation/results.json",
+      "group": "focused-tested implementation snapshot",
+      "sha256": "4a6d3c15c4730b0da1a134cbb6810917b3d201162831099368fe79f25e4ddb8c"
+    },
+    {
+      "source": "generated from the PR29 checkout working tree, 2026-11-10",
+      "file": "implementation/source-sha256.json",
+      "group": "current implementation snapshot",
+      "sha256": "5f82d8dd0b11185859d19159c2522d067b8a0930248bb15fed09b86cc1ec9c11",
+      "updated": "2026-11-10: includes the #2499 class-expression fix; previous sha256 42b64bf6283c88c2d130c230b4a4a804998eda6046ab9e2638a094e7693ea27a"
+    },
+    {
+      "source": "/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-value-model-integration-2026-11-09/integration-from-round11.patch",
+      "file": "implementation/integration-from-round11.patch.gz",
+      "group": "focused-tested implementation snapshot",
+      "sha256": "069511008964f53864175e29540b572a73b4e5386ed95fc4350a961faaa7fd2a",
+      "sourceSha256": "8775d01ce7a7b3635e107a442876ab3c6cbcf62c49baf95fd356e1decb783bcd",
+      "encoding": "gzip"
+    },
+    {
+      "source": "git diff --binary 87576a8d -- <30 manifest paths>, PR29 checkout, 2026-11-10",
+      "file": "implementation/working-tree.patch.gz",
+      "group": "pending implementation backup",
+      "sha256": "ac2e0fd955aec5bddd35a7271349a12b05646126db22a8e653e2b8b00fbdca9d",
+      "sourceSha256": "d33e5ed82c21384fbbe9036f6f27966e57101e9d517c7ac45047845918affa1a",
+      "encoding": "gzip",
+      "updated": "2026-11-10: includes the #2499 class-expression fix; previous sha256 47898e69e9ef76f56458ed17757839a1ab07f5ebf6258a4ceccce18a28233b75 (source 00807ba2f472296c7a9ab273d0900cc988033f749c77fdb8ed4f5202899379d3)"
+    }
+  ],
+  "notes": "Copies of task-specific notes and result data; original files retained. Historical instructions describe earlier states and are superseded by START_HERE.md. Build archives, dependency trees, raw logs and source snapshots remain in the documented private evidence directories."
+}
diff --git a/docs/handoffs/pr29-2026-11-10/ledgers/checkpoint-corrected-review-pending-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/ledgers/checkpoint-corrected-review-pending-2026-11-09.md
new file mode 100644
index 0000000000..a4ad4f448c
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/ledgers/checkpoint-corrected-review-pending-2026-11-09.md
@@ -0,0 +1,19 @@
+# CommonJS corrections tested and committed; fourth review awaits approval
+
+Authoritative2026-11-09. User: if separate findings report, if related fix. AllF3/F4/F5related to currentCommonJSfix; corrected, no separateissuesfiled. No outwardactions.
+
+LOCAL HEAD559c76df6afd9e40f4d617ff77caa7db4ad03955, treeb81d2063f4e787da5cfc7d28c619078fdc86e6b6, parentd18e40970fc5fbf32f635f6d8d536d1bdb24dacc, originalbase5e0664891af0e87e6fd18bbfa16cab39237570f5. Repo/tmp/codegraph-cjs-missing-fix-20261108, branchfix/commonjs-missing-member. Personalorigin inth3shadows/codegraph, EricMinish/eric.minish@gmail.com. Identity/remote/stagedexact4files/diff/checks/tests checked beforecommit. Trackedclean, private.reviewuntracked. No push, fixPR, merge, deployment, tag/npm or officialupstreamwrite. em40remainslive. T0originalQAwork stays stopped/uncommitted/untouched.
+
+Corrections: F3 dependency metadata typeFrom records default-import member name-matcher answers (both class-name and method-name matching), includes pureforwarder files. Existing type-dependent edge reopening now handles JS/TS sourcechanges, while Python failed-attribute retry remains Python-only. F4 namespaceinfo tracks explicit dotted/literal-bracket exportnames; absent-memberguard preserves actual callablealiases and treats escaping/computed/prototype-mutated APIs as uncertain. F5 class-shadow exemption also uses existing holderScopeAt block visibility, so inaccessible sibling-block/TSnamespace classes cannot bypass guard; real visibleclasses retained. No new constructor/default inference; import-resolver unchanged. Bareexternalimport issue26 remainsunfixed/outside scope.
+
+Tests: initial11newFAIL/24existingPASS onparent, then49focusedPASS; added2uppercasealiasclass-strategy cases RED under byName-onlytracking, nowfixedtoo. FINAL16files206PASS1SKIP (37default-membercases), /tmp/codegraph-cjs-fix-r3-focused-final.log. Full normal suite10602PASS2expectedFAIL448SKIP0unexpectedFAIL,872filesPASS19SKIP,771.60sec, /tmp/codegraph-cjs-fix-r3-full.log, exec42040EXIT0. Explicit npm run buildPASS /tmp/codegraph-cjs-fix-r3-build.log, exec37438EXIT0. Original6-caseportablebugrepro6/6PASS /tmp/codegraph-cjs-corrected-final-sixcases.log, exec98603EXIT0. Alltestsranonidenticalsourcehasheslatercommitted. Node22.22.2/kernel0WASM, no native claims. No running tests/builds or reviewer agents for this correctionphase.
+
+REVIEW STILL PENDING. Three earlier rounds reviewed oldercode. Third broad lane confirmedF3; adversarial delivered confirmedF3/F4/F5beforefailingfinalizationwithusagecap. Thesefindingsnowcorrected+executiontested, NOTindependentlycleared. Primaryledger/tmp/codegraph-cjs-missing-fix-20261108/.review/commonjs-missing-member.md contains exactclaims/repros/rulings/invariants/historyandlatestfixmap.
+
+PENDINGUSERANSWER to async question authorizing FOURTH two-native-reviewer round. Exactquote readfrom ~/.codex/AGENTS.md: "where Claude's gate would ask the user at round 4, Codex denies, so stop and ask." Userfixauthorizationpredates thissubsequentreviewquestion and is not its answer. Do notlaunchfourthbeforeactualyes; don'tbypassgate/modifycontrolfiles. Ifyes,2freshREADONLYnativeagents review_broad_* andreview_adversarial_ withfork_turns=none, compactselfcontainedbriefs, sameledger and exactcorrectiontarget:
+`git -C /tmp/codegraph-cjs-missing-fix-20261108 diff d18e40970fc5fbf32f635f6d8d536d1bdb24dacc..559c76df6afd9e40f4d617ff77caa7db4ad03955 -- src/resolution/name-matcher.ts src/index.ts src/extraction/index.ts __tests__/js-default-binding-members.test.ts`
+VerifyonlyF3-F5closure/invariants/newfixdefectsbyexecutingfocusedprobes; no fullsuite rerun forunchangedsource. Sourcehasbeenfrozenandtested. Respectquota/actualgatedenial; don'tclaimClaude-onlyskillran. Holdmerge/deployuntilactualrequiredreviewclearoruserexplicitwaiver withinpolicy.
+
+Durable backup originalQAworkspace .review/commonjs-fix-2026-11-08/corrections-2026-11-09/ contains4sourcefiles, corrections.patchrelativetoparent, checksums.json, before/after/uppercase-red/finalfocused/full/build/reprologs, verification.json (HEAD/tree/testcounts) andVERIFIEDGitbundlecommonjs-fix.bundle (8320bytes) withbothfixcommits andoriginalbase5e066489prerequisite. Canfetchlocalbranchfrombundleintorepohavingbaseif/tmpdisappears; don'toverwriteexistingbranch. Parentd18source/evidence alsoinparentbackupdir. Ledgerlatestcopybackedupafterthischeckpoint.
+
+OfficialupstreamreportstillconditionalTuesdayNov10 afterverification+duplicatecheck. Trackingpersonalcodegraphissue27CommonJS, issue26differentbug; QA PR27isfirstbugreportonly. Don'tmergeQAevidencePRs accidentally. Preserveallsharedsource/deploy/control worktrees; noT0work, no cleanup, no unrelatedreportfiling. Nextfinishuserreviewdecision,actualverificationthenfollowapplicableauthorization/SOPbeforeoutwardactions.
diff --git a/docs/handoffs/pr29-2026-11-10/ledgers/checkpoint-corrections-running-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/ledgers/checkpoint-corrections-running-2026-11-09.md
new file mode 100644
index 0000000000..b89b4349ef
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/ledgers/checkpoint-corrections-running-2026-11-09.md
@@ -0,0 +1,13 @@
+# CommonJS corrections implemented; full verification running
+
+Current2026-11-09 state supersedes review-blocked handoff. User said if separate report issues, if related fix. Explained all3F3/F4/F5related, corrected together; no separate issues filed. Work only isolated /tmp/codegraph-cjs-missing-fix-20261108, branch fix/commonjs-missing-member, currentHEADd18e40970fc5fbf32f635f6d8d536d1bdb24dacc. Four tracked files changed since that commit: src/resolution/name-matcher.ts, src/index.ts, src/extraction/index.ts, __tests__/js-default-binding-members.test.ts. No new commit/push/PR/merge/deploy yet; em40live; originalT0stopped/uncommitted/untouched.
+
+F3: existing typeFrom metadata now records files of default-import member calls resolved by name matching (including class-name strategy without byName marker), including pure-forwarder chain files. Sync's existing type-dependent edge reopening accepts JS/TS as well as Python; failed Python attribute retry remains Python-only. Old shape changes now reopen guesses so synced/fresh graph agrees. F4: namespace info records explicit dotted/literal-bracket assigned export member names. Guard rejects absent members; explicit callable aliases retain existing resolution. Escaping/computed/prototype-mutated API treated uncertain. F5: lexical-class exemption now also uses existing holderScopeAt block visibility, preserving real inner/enclosing class shadows and blocking inaccessible sibling-block/TSnamespace classes. Import-resolver unchanged; no unsafe constructor inference.
+
+Tests BEFORE corrections:11newFAIL/24existingPASS atd18e4097 (/tmp/codegraph-cjs-fix-r3-regressions-before.log). First focused3files49PASS. Broader16files204PASS1SKIP. Added2class-name alias sync cases demonstrated remaining2FAIL under byName-only tracking (/tmp/codegraph-cjs-fix-r3-upper-before.log); expanded dependency stamp to all name-matcher default-member answers. FINAL focused16files206PASS1SKIP (/tmp/codegraph-cjs-fix-r3-focused-final.log), includes37default-membercases andPythonattribute/sync/memo controls. Original6caseportablebugrepro6/6PASS (/tmp/codegraph-cjs-corrected-final-sixcases.log, /tmp/codegraph-cjs-corrected-final-sixcases-20261109), exec98603exit0. No existing assertion weakened.
+
+RUNNING normal FULL suite exec42040: CODEGRAPH_KERNEL=0 npm test -- --maxWorkers=4, log/tmp/codegraph-cjs-fix-r3-full.log. Poll and inspect actualexit/summary; do NOTclaimpassyet. Previous full10589PASS belonged parentd18e4097, not current corrections. Explicit npm run build still required AFTER suite to avoid rebuild/read races. No source edits since finalfocused/sourcebackup; don't rerun full unless changes/failures justify. Node22.22.2/kernel0WASM; native unverified.
+
+PENDING USER ANSWER: async question asks permission for FOURTH two-reviewer verification while fullsuite runs. Exact source ~/.codex/AGENTS.md read: "where Claude's gate would ask the user at round 4, Codex denies, so stop and ask." Options yes verify or finish tests/hold. No answer received yet. The latest fix authorization is not an answer to this subsequent review question. Do not launch fourth agents until explicit answer; stop/ask on nativegate denial, never bypass state/control files. Last adversarial third lane hit usage limit after delivering confirmed evidence, don't assume retry free/available. If authorized use2freshread-onlynativefork_turns=none, exactGit target+ledger, brief only F3-F5/current fixes/invariants and execution commands, no repeatedfullsuite. Primaryledger .review/commonjs-missing-member.md contains fullhistory; latestcorrectionsection authoritative.
+
+Durable correction backup in original QA workspace .review/commonjs-fix-2026-11-08/corrections-2026-11-09/: explicit4sourcefiles, corrections.patch relatived18e4097, checksums.json, before/after/uppercase-red/finalfocused logs. Source unchanged since checksums saved. Parent source/patch, verification10589passed, priorreview evidence in parentdirectories. Beforecommit verify sourcehashes, personalorigin/identity/stagedexact4files/tests; keep alluntrackedprivateevidence out of commits. Save portablegitbundle after finalcommit if needed fordurability. No officialupstreamissue/PR now; conditionalTuesdayNov10report unchanged. Personalforkissue27isCommonJS, issue26differentexternalimport remainsunfixed. No QA PR26/27merge and noT0work. Do not deploy unreviewed corrections.
diff --git a/docs/handoffs/pr29-2026-11-10/ledgers/checkpoint-namespace-redesign.md b/docs/handoffs/pr29-2026-11-10/ledgers/checkpoint-namespace-redesign.md
new file mode 100644
index 0000000000..93ce7201e7
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/ledgers/checkpoint-namespace-redesign.md
@@ -0,0 +1,25 @@
+# Current authoritative CommonJS fix state — namespace-only redesign
+
+Supersedes constructor-inference state in handoff-codegraph-commonjs-fix-running-2026-11-08.md. Date2026-11-08, personal WSL user inth3shadows, original QA worktree remains stopped/uncommitted.
+
+User approved implementing CommonJS missing-member fix and dual review after no exact upstream report found. Earlier conditional request was merge/deploy IF reviewed. Issue https://github.com/inth3shadows/codegraph/issues/27 tracks exact bug; first external import bug26 remains unfixed. No official upstream writes; Tuesday2026-11-10 remains conditional reporting day.
+
+Isolated repo /tmp/codegraph-cjs-missing-fix-20261108, branch fix/commonjs-missing-member, base5e0664891af0e87e6fd18bbfa16cab39237570f5, personal origin inth3shadows/codegraph, identityEricMinish/eric.minish@gmail.com. Fresh npmci. Only3tracked files modified: CHANGELOG.md, __tests__/js-default-binding-members.test.ts, src/resolution/name-matcher.ts. Added import-resolver code completely removed, exact base again. No source commit/push/fix PR/merge/deployment performed. em40 remains deployed.
+
+Current fix only blocks fallback for imports proven to denote a module namespace: default/require of resolved JS/TS file with no raw default keyword/export= or uncertain module reference, and pure whole-file CJS forwarding to such a namespace. Conservative raw source checks may leave uncertain/text-heavy cases unchanged. Memo keyed(file,language), cleared by normal name-matcher memo clearing, bounded8forwarders and cycle safe, excludes implicit Vue/Svelte defaults. Known namespace guard precedes global class guessing; actual same-file lexically reachable class shadow exempt. All default VALUE inference remains untouched, including pre-existing limitations. Not a claim that all default-import missing-member guesses fixed.
+
+Review history: R1 BOTHread-only native lanes foundP2lost explicit singleton/default-instance call andP2local class shadow loss. Initial attempted constructor-recovery remediation failed VERIFY2: new wrong imported-constructor call overriding local shadows, obsolete/inactive constructor assignment overriding actual exports, stale constructor-derived call aftersync, missing inline/parenthesized constructors. All findingsP2; neither verify2lane cleared. Both conceptually agreed namespace-only boundary is coherent but DID NOT REVIEW OR CLEAR current implementation. Unsafe constructor parser/helper is entirely removed. Ledger .review/commonjs-missing-member.md has details, rulings and exact targets. Do not claim dual-review complete/clear for final redesign.
+
+REQUIRED USER ANSWER PENDING: async question asked whether a THIRD dual-review round may run on final redesign. Skill ~/.codex/skills/dual-review/SKILL.md says third round only if verify found high severity; all these findingsP2, so exception requested with exact skillquote/link. Do not spawn third reviewers without actual user answer. Existing previous user yes predates this question and does NOT answer it. Full build/tests continue independently.
+
+Final redesigned focused verification PASSED:13files108PASS1SKIP, log/tmp/codegraph-cjs-fix-redesign-focused2.log, exec55894exit0. Includes24casesdedicated regression file and memo clearing/lifetime. Explicit normal npm run build PASSED, exec54732exit0, log/tmp/codegraph-cjs-fix-redesign-build.log. Independent original6-case portable bug repro PASSED6/6, exec54104exit0, newresults/tmp/codegraph-cjs-redesigned-sixcases-20261108, log/tmp/codegraph-cjs-redesigned-sixcases.log. The original em40/pristine upstreammain each5/6, release4/6; no fullsameoutcomes acrossreleaseclaim.
+
+Parent regression validation reused reviewer probe scripts on current dist:9records /tmp/codegraph-cjs-redesign-adversarial.jsonl exactly match saved em40base9records;9more records /tmp/codegraph-cjs-redesign-more.jsonl also EXACTLYMATCHbase. These are test/control runs, not an independent final review. No source fix for pre-existing odd targets in those controls. Don't claim all18are correctness passes; they are baseline preservation.
+
+RUNNING final normal FULL SUITE: exec60370, CODEGRAPH_KERNEL=0 npm test -- --maxWorkers=4, log/tmp/codegraph-cjs-fix-redesign-full.log. Poll write_stdin60370 and inspect final summary/exit; do not claim pass before completion. Superseded full run83750STOPPEDexit130 after targeted guardedSIGINT when code was invalid; its /tmp/codegraph-cjs-fix-full.log is not a green gate. Vitest4doesnotaccept--minWorkers; usemaxWorkers4. Kernel0/WASMNode22.22.2; no native validation claims.
+
+Durable original-workspace backup: /home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/. Contains source3files, fix.patch, checksums.json, passing focused/build logs, independent probe results, review ledger before third round. Patch reverse-check against current working tree PASSED (i.e. matches modifications to base). No source changes since this backup. Reconstructed R1 name-matcher snapshot .review/round1-name-matcher.ts (Gitblob512a77a155299de8e6890447aa2d3aea7b81a1f9) preserved in isolatedrepo. No node_modules/.git/credentials copied.
+
+Additional upstream openPR duplicate check:3133(relative require package main),2754(import/export forwarding and constructor defaults),2800(default forwarding/value targets) remain related; titles/bodies examined, no same namespace missing-member method guard found. Related original2952closed,3162merged, target stillf72c9d2e earlierverified. Avoid global novelty claim and repeat duplicate check Tuesday. No upstream report now.
+
+Next: finish fullsuite, save final outcomes; user may approve or decline third review. If yes launch TWO FRESH READ-ONLY native review_broad_* and review_adversarial_* on `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5e0664891af0e87e6fd18bbfa16cab39237570f5 -- CHANGELOG.md src/resolution/name-matcher.ts __tests__/js-default-binding-members.test.ts`, same ledger. Gateround3shouldbeavailable; round4denialrequiresstopandask,never bypass. They must verify priorfindingsdefeated by removal, original missing-memberbug fixed, real exported/default API/shadows/sync/memo semantics preserved. No already-running reviewers remain for this task. Do not claim Claude-only code-review ran. No main/deploy mutation before finalfixactuallyreviewedgreen. Beforecommits/pushes verify source identity, personal remote, stageddiff and actualtests. Preserve .codex/.claude/deploytrees; no publicrelease/npm/tagmoves. Do not resume T0 or expand into bug26.
diff --git a/docs/handoffs/pr29-2026-11-10/ledgers/checkpoint-tested-review-pending.md b/docs/handoffs/pr29-2026-11-10/ledgers/checkpoint-tested-review-pending.md
new file mode 100644
index 0000000000..2115078897
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/ledgers/checkpoint-tested-review-pending.md
@@ -0,0 +1,17 @@
+# CommonJS fix tested, final review awaiting user approval
+
+Current authoritative status2026-11-08; supersedes namespace-running and unsafe-constructor handoffs. User requested CommonJS fix and dual review; earlier merge/deploy request conditional on reviewed fix. Upstream report remains Tuesday2026-11-10 after verification. No upstream writes, no external import issue26 fix, T0 remains stopped/uncommitted/untouched.
+
+LOCAL COMMIT d18e40970fc5fbf32f635f6d8d536d1bdb24dacc, tree2363dd0f8923ca59c28a3e45a477573e7364e7c2 in /tmp/codegraph-cjs-missing-fix-20261108, branch fix/commonjs-missing-member, base5e0664891af0e87e6fd18bbfa16cab39237570f5. Fresh isolated clone originhttps://github.com/inth3shadows/codegraph.git, personalEricMinish/eric.minish@gmail.com. Tracked clean, .review untracked. Three committed files: CHANGELOG.md, src/resolution/name-matcher.ts, __tests__/js-default-binding-members.test.ts. No push/fix PR/merge/deployment. em40remains live. Commit source exactly matches tested and backed-up candidate; identity/remote/stagedset/diff/check verified before commit.
+
+Scope: block method-name/class-name guesses through a namespace import or require/default proven to reach a namespace-only JS/TS module. Preserve all stated/uncertain default-value behavior. Pure CJS forwarder support, bounded/cycle-safe traversal, language-qualified memo cleared with existing memos, lexical same-file class shadow exempt. Conservative raw checks may leave ambiguous/text-heavy cases unchanged. No import-resolver changes remain; unsafe attempted constructor inference was entirely removed. No claim all arbitrary default-value missing-member guesses fixed. Original module-missing-member counterexample fixed.
+
+PASS:13focusedfiles108PASS1SKIP; npm run build;6/6originalportablebugcases;18independent reviewer probe records EXACTLYMATCHem40base; namespace->explicit-instance sync equals fresh(actualStore::load,initialnone). Full normal suite exec60370EXIT0:872filesPASS19SKIP,10589testsPASS2expectedFAIL448SKIP0unexpectedFAIL,799.56seconds. CODEGRAPH_KERNEL=0 Node22.22.2 Vitest4.1.11 --maxWorkers=4. Native not validated. Logs/tmp/codegraph-cjs-fix-redesign-focused2.log,-redesign-build.log,-redesign-full.log, plus/tmp/codegraph-cjs-redesigned-sixcases.log. No running test sessions remain. Superseded constructor candidate fullsuite stoppedexit130 and never passed; don't conflate logs.
+
+DUAL REVIEW NOT COMPLETE FOR FINAL COMMIT. Initial two native reviewers foundP2singleton/default-value loss andP2lexicalclassshadowloss. Verify2 of attempted constructor recovery found newP2falsecalls, shadow override, overwritten/inactive export choice, stale sync, and remaining inline/parenthesized default loss. Both lanes agreed narrower namespace-only design is coherent but did NOT inspect or clear current implementation. Ledger /tmp/codegraph-cjs-missing-fix-20261108/.review/commonjs-missing-member.md has findings/invariants/evidence and exact final target. No pending reviewer agents for this task.
+
+PENDING REQUIRED USER ANSWER: async request asked permission for third dual-review round because ~/.codex/skills/dual-review/SKILL.md says "Run a third round only if the verify round found something high severity in the fix." Findings wereP2. Need explicit user exception; elapsed time and later "status?" are NOT approval. Do not spawn another round before answer. If user approves, TWO fresh READ-ONLY native collaboration agents named review_broad_* and review_adversarial_*; use fork_turns=none with self-contained domain/ledger briefs to avoid unrelated history. Both exact target `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5e0664891af0e87e6fd18bbfa16cab39237570f5..d18e40970fc5fbf32f635f6d8d536d1bdb24dacc -- CHANGELOG.md src/resolution/name-matcher.ts __tests__/js-default-binding-members.test.ts`. Third gate should be available; round4deny must stop/ask, no bypass. Don't claim Claude-only /code-review ran. Fresh lanes verify original negatives, all baseline positives, removal of constructor override paths, lexical shadows, memo/sync and new scope. Native agents run small probesmaxWorkers1 if needed; full tested tree alreadygreen, no redundant full rerun unless source changes.
+
+Durable backup originalworkspace /home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/: three source files, fix.patch, checksums.json, verification.json (commit/tree/outcomes), focused/build/full logs,6casereproresults,18controlresults,syncprobe. Review ledger here is newer than original backup before-third ledger; use isolatedrepo's .review/commonjs-missing-member.md for finalreview. Original .review/commonjs-missing-export-2026-11-08/ preserves actual bug evidence from upstream/em40.
+
+Tracking https://github.com/inth3shadows/codegraph/issues/27. Related upstream2952closed/3162merged; additional open2754,2800,3133related but no exact namespace guard found from docs. Don't claim global novelty. First issue26 and QA reportPR27 untouched. No publicupstreamissue/comment now, no deployment/tag/npm changes. Preserve shared main/deploy/control worktrees and stoppedT0. Continue user's conditional merge/deploy only after actual finalreviewclear+green and applicable authorization/SOP; currently hold.
diff --git a/docs/handoffs/pr29-2026-11-10/ledgers/checkpoint-third-review-blocked-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/ledgers/checkpoint-third-review-blocked-2026-11-09.md
new file mode 100644
index 0000000000..b537826163
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/ledgers/checkpoint-third-review-blocked-2026-11-09.md
@@ -0,0 +1,18 @@
+# CommonJS fix: third review found defects — hold merge/deploy
+
+Authoritative2026-11-09 state, supersedes tested-review-pending2026-11-08 handoff. User approved third round, asked why, then resumed. Explained earlier code was replaced and final commit had not been independently reviewed. Used two fresh read-only minimal-context native lanes; no full-suite rerun.
+
+Local commit d18e40970fc5fbf32f635f6d8d536d1bdb24dacc in /tmp/codegraph-cjs-missing-fix-20261108, branch fix/commonjs-missing-member, base5e0664891af0e87e6fd18bbfa16cab39237570f5. Three files CHANGELOG.md, src/resolution/name-matcher.ts, __tests__/js-default-binding-members.test.ts. Tracked tree clean, .review untracked. Personalorigin inth3shadows/codegraph, EricMinish/eric.minish@gmail.com. No push, fix PR, merge, deployment or official-upstream write. em40stilllive. Original QA T0 stopped/uncommitted, untouched. External import issue26 unfixed; CommonJS tracked forkissue27. Conditional TuesdayNov10upstreamreport still held until checks hold.
+
+PASS remains true for this exactcommit: npm run build,13focusedfiles108PASS1SKIP,6/6originalportablebugcases,18independentrecords exactlymatchingbase, namespace->instance sync matchesfresh. Full suite872filesPASS19SKIP,10589testsPASS2expectedFAIL448SKIP0unexpectedFAIL,799.56sec, CODEGRAPH_KERNEL0Node22.22.2. No native claims. No test processes running. Source/patch/logs/verification backup original QA .review/commonjs-fix-2026-11-08/.
+
+REVIEW NOT CLEAR. Broad lane review_broad_commonjs_final3 completed normally. Adversarial review_adversarial_commonjs_final3 delivered confirmed findings/messages then FAILED finalization due usage cap (notice retry Nov9 1:10AM). Do not claim final successful report or clearance from failed lane; do not relaunch automatically or spend another round. Confirmed evidence/messages still preserved in ledger.
+
+Three P2 findings:
+F3 broad + adversarial: value->namespace change after index retains old Store::load via cg.sync; fresh final index correctly[]. Importmodule text/shape is a new guard dependency that does not reopen old member guesses. Repro /tmp/cg-broad-final3-sync-reverse.cjs +log +base.log; /tmp/codegraph-cjs-final3-sync.cjs direct/pureforwarder independent.
+F4 adversarial: actual callable alias exports.load=Store.prototype.load (also module.exports.load) works at runtime and base graphStore::load, finaldropscall. Classifier must preserve uncertain member RHS or resolve actual alias; cannot treat it as absent export. /tmp/codegraph-cjs-final3-export-alias.cjs and -adversarial*.jsonl.
+F5 adversarial still-open original path: constnamed=require('./m'); run(){ if(true){ classnamed{staticmissing(){}} } named.missing(); } binds to inaccessible block-local class. Existing isLexicallyReachable coarse; guard exemption must check real lexical block scope. AlsoTSnamespaceParent. Need preserve real local/enclosing-function class shadows. Same wrong edge preexists base; not a new regression but intendedmissingmemberpathnotfixed.
+
+Full exact findings/locations/claims are appended in /tmp/codegraph-cjs-missing-fix-20261108/.review/commonjs-missing-member.md. Read before any correction; do not reread full reviewed diff as a third reviewer or rerun already-confirmed findings merely to duplicate review. Each correction needs fail-before regression and preservation invariants. Unsafe constructor inference from earlier round is completely removed (import-resolver exactlybase); do not reintroduce. Default/unknown-value guessing remains documented out-of-scope unless concrete regression.
+
+NEXT: report defects/no-merge decision and get the next bounded correction/verification direction; user asked confirmation before next step. No further source fixes/agents started after reports. Third approval does not authorize fourth round; gate4requiresstop/ask, no bypass. Usage cap prevents assuming another lane can run anyway. Do not merge/deployd18e4097 despite green tests. No fixes for other bugs/T0, no publicupstreamissue/PR now, no tag/npm/deploymutations, no source/deploy/control worktree cleanup. Update durable checkpoint after any new authorized work.
diff --git a/docs/handoffs/pr29-2026-11-10/ledgers/checkpoint-verify2-running.md b/docs/handoffs/pr29-2026-11-10/ledgers/checkpoint-verify2-running.md
new file mode 100644
index 0000000000..a50f1a7c14
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/ledgers/checkpoint-verify2-running.md
@@ -0,0 +1,17 @@
+# CommonJS fix — verify2 and full suite running
+
+User asked whether fix reviewed, then merge/deploy if so. No fix existed; user subsequently authorized implementing CommonJS fix and dual review after confirming no exact upstream report found. Related upstream2952 and3162 exist, exact unrelated-method follow-up tracked only in personal fork issue27. Official upstream reporting remains Tuesday2026-11-10 after verification. Do not post upstream now. Original codegraph-qa T0 pilot stopped/uncommitted, untouched.
+
+Isolated /tmp/codegraph-cjs-missing-fix-20261108, branch fix/commonjs-missing-member, base personal fork main5e0664891af0e87e6fd18bbfa16cab39237570f5. Fresh clone/dependencies. Four tracked files dirty: CHANGELOG, js-default-binding-members.test, import-resolver, name-matcher. No commit/push/PR/merge/deployment yet. Git personal identity EricMinish/eric.minish@gmail.com. origin inth3shadows/codegraph. No source access/write to shared live main or deployment.
+
+Root fix: imported namespace/default receiver must not reach class-name/global-method guessing after module/value lookup failed. Default class/instance/object/callable/real exported functions preserved. Initial guard lost explicit new Store() defaults and lexical local classes shadowing import; BOTH round1 reviewers found these P2 regressions. Added fail-before tests; redesigned with actual constructor evidence and a visible same-file lexical class exception. Constructed-default reader memo uses existing export-index lifetime; masks text/comments/regex, balances constructor/type arguments, rejects chained expressions; pins imported/local class by actual file and follows CommonJS forwarders. No import mappings changed. Direct module.exports={read(){}} member recovery was already missing on base; don't claim implemented. Bare external import bug26 not fixed.
+
+Ledger /tmp/codegraph-cjs-missing-fix-20261108/.review/commonjs-missing-member.md contains exact target, findings/invariants/fix map/logs. R1 reviewed name-matcher saved .review/round1-name-matcher.ts with original Git blob hash512a77a155299de8e6890447aa2d3aea7b81a1f9 verified. Current source blobs name-matcher ba00594eecfb665245a7a2d8c0d0c3352ce2d79f, import-resolver440b1547347e5cb88c85d9eca3b7adc548428062, tests0a4a9bc5a1687286f83e7e4b3c57a02485ae5379. Four tracked files frozen during verify2.
+
+Baseline before any resolver edit:20cases15PASS5FAIL(/tmp/codegraph-cjs-fix-baseline2.log). Round1 regression baselines24cases19PASS5FAIL(/tmp/codegraph-cjs-fix-review-baseline.log). Additional constructor controls caught3failures before balanced-reader correction. Final focused11files101PASS1SKIP(/tmp/codegraph-cjs-fix-focused-final.log), includes31cases in dedicated regression file. Original independent6-case portable QA repro now6/6PASS vs em40/main5/6, release4/6. Repro results /tmp/codegraph-cjs-fixed-sixcases-20261108, log/tmp/codegraph-cjs-fixed-sixcases.log; tool session4682 should be polled/closed. Root old-minWorkers command incompatible withVitest4.1.11 corrected maxWorkers4. Kernel0/WASM on Node22.22.2; native not claimed.
+
+RUNNING full normal suite: exec session83750, CODEGRAPH_KERNEL=0 npm test -- --maxWorkers=4, log/tmp/codegraph-cjs-fix-full.log. Do not claim pass until final exit and summary. Build still needs explicit npm run build (test setup already rebuilt current engine/viewer). No redundant full rerun unless changes/failures require it.
+
+Fresh READ-ONLY native review lanes running: /root/review_broad_commonjs_verify2 and /root/review_adversarial_commonjs_verify2. They have exact gitdiff5e066489 +all4paths and ledger; verify both round1 findings/invariants and actual remediation defects with code execution. Do not report pending reviewers as clear. R1 lanes finished /root/review_broad_commonjs_round1 and /root/review_adversarial_commonjs_round1. Native shared review gate applies; stop ifround4denied, don't bypass or claim Claude-only skill ran. No third parent diff read; work from findings.
+
+Next collect fullsuite/reviewer results; correct defects if needed, obey skill round policy. Save concrete tested/reviewed outcome before outward actions. User earlier required confirmation before next step; don't expand to other bug26/T0/infrastructure/production. Local fork SOP read ~/.claude/plans/codegraph-fork-sop.md, canonical approved fixplan ~/.codex/plans/codegraph-commonjs-fix-2026-11-08.md. Live deployment remains em40; preserve it and allcontrol-plane/deployworktrees. If deployment becomes authorized/ready, use independent versioned copy and actual SOP, never a live source checkout. No publicrelease/npm/tagmutation.
diff --git a/docs/handoffs/pr29-2026-11-10/ledgers/commonjs-eval-callee-context.md b/docs/handoffs/pr29-2026-11-10/ledgers/commonjs-eval-callee-context.md
new file mode 100644
index 0000000000..f84a229f11
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/ledgers/commonjs-eval-callee-context.md
@@ -0,0 +1,252 @@
+# Separate F8 follow-up (review round count remains six)
+
+User explicitly authorized committing/pushing current work to a PR and separating remaining correction. Current snapshot committed5d384989957c91b482068b306535437915a0595b, pushed fix/commonjs-missing-member, DRAFT https://github.com/inth3shadows/codegraph/pull/28 against main. KnownF8 documented, not ready to merge alone. No deploy/merge/upstream report.
+
+New branch fix/commonjs-eval-callee-context based on5d384989. Exact prospective Git target: git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5d384989957c91b482068b306535437915a0595b -- src/resolution/commonjs-export-members.ts __tests__/commonjs-export-members.test.ts __tests__/js-default-binding-members.test.ts
+
+F8 reviewer finding and prior invariants remain in .review/commonjs-missing-member.md; do not reset shared gate/round count. Two sixth reviewers completed; broad demonstrated F8 despite adversarial clearing intended F7 cases. This follow-up has NOT had independent dual review yet.
+
+Correction: distinguish grouping around bare eval from another function's argument list using token before parentheses. Wrapper identifier/call/member/optional-call/tag/control-condition prefixes must not mark exports uncertain. Grouped direct eval, literal/template arguments and expression prefixes such as return must keep prior behavior. Change limited to9helper lines plus independent unit and real-index graph regressions; no matcher/sync/scope changes.
+
+Before fix8FAIL92PASS; tag-result additional case1FAIL49PASS. Final focused2files101PASS, /tmp/codegraph-cjs-eval-followup-focused.log. Build/full pending. Hashes /tmp/codegraph-cjs-followup-frozen.json. Logs /tmp/codegraph-cjs-eval-followup-{before,tag-before,focused,build}.log. Need staged exact3-file diff, personal repo/identity and actual build result before commit/push. Full normal suite required before readiness claim. Keep follow-up draft and explicitly state review pending. No additional reviewer agents launched in this follow-up; user plans to point agents at PRs.
+
+Keep both PRs draft. Follow-up base should be fix/commonjs-missing-member, producing only the small correction diff. Review/merge follow-up into parent branch before considering parent PR for main; no merge authorized by current request. Preserve original T0 pilot and all deploy/control worktrees.
+
+Published DRAFT https://github.com/inth3shadows/codegraph/pull/29, commit87576a8d9ff0d8aba235db5535f5f4429f14b037, base fix/commonjs-missing-member/PR28 at5d384989. Explicit buildPASS; normal full suite RUNNING session62594, /tmp/codegraph-cjs-eval-followup-full.log. Both pushed/draft, neither merged/deployed; follow-up independent review stillpending. Original T0 untouched.
+
+
+FINAL execution verification2026-11-09: normal full suite session62594 EXIT0,873filesPASS19SKIP,10666testsPASS2expectedFAIL448SKIP0unexpectedFAIL,800.20sec. /tmp/codegraph-cjs-eval-followup-full.log. 101focusedPASS and explicit buildPASS on same87576a8dsource. Final3changed-file SHA256 checks PASS, trackedtreeclean; actual remoteheads rechecked5d384989(PR28) and87576a8d(PR29). PR29 body updated with exact final validation. Both PRs still DRAFT/unmerged; no deployment/upstream write. FOLLOW-UP INDEPENDENT REVIEW STILL PENDING: do not conflate fullsuite with review clearance. No further tests/build/review processes running. Saved final checkpoint and full log under original QA two-draft-prs backup.
+
+
+## Seventh native review explicitly requested — PR29 — 2026-11-09
+
+User invoked /dual review29. Exact GitHub base5d384989957c91b482068b306535437915a0595b and head87576a8d9ff0d8aba235db5535f5f4429f14b037 verified. Fresh read-only native lanes review_broad_pr29_round7 and review_adversarial_pr29_round7 launched together with same exact Git target and this ledger. Both focus full3-file29-line correction, F8 closure and nearby invariants; bounded execution probes only, no repeat full/build or source edits. Parent does not reread reviewed diff or duplicate reviewer probes. No review results yet; no independent clearance claim. Do not reset round count/gate, change source, push, merge or deploy in this review-only turn. Stop and report merged findings when both complete.
+
+
+## Seventh native dual review result — PR29 — 2026-11-09
+
+Both fresh read-only lanes completed normally: review_broad_pr29_round7 and review_adversarial_pr29_round7. Exact target remains5d384989957c91b482068b306535437915a0595b..87576a8d9ff0d8aba235db5535f5f4429f14b037. Source hashes verified unchanged, trackedtreeclean except private untracked.review. No source edits/build/fullsuite reruns/commits/pushes/GitHubcomments/merge/deploy. Both PRs remain draft. Current review DOES NOT CLEAR PR29 despite prior101focusedPASS/full10666PASS/buildPASS. Parent merges findings from actual final reports without re-verifying/re-reading diff.
+
+### F9 — P2 — Preserve grouped direct eval in control-statement bodies (BOTH)
+
+Broad location src/resolution/commonjs-export-members.ts:31: rejects any preceding ), including a completed if or for condition. Exact input `class Store { load() { return 42; } }
+if (true) (eval)('exports.load = Store.prototype.load;');`. Runtime exports load() returning42, but current discovery uncertain:false and indexing named.load() produces no call. Removing only new prefix guard in memory restores uncertain:true and m.js:Store::load. Nested grouped eval in unbraced single-iteration for body reproduces too. Broad evidence /tmp/cg-broad-pr29-control-context.{cjs,log}; exact command `node --experimental-wasm-exnref --experimental-wasm-stack-switching /tmp/cg-broad-pr29-control-context.cjs`.
+
+Adversarial independently confirms same location/trace; grouped-template if-body and for-body also reproduce. Evidence /tmp/codegraph-cjs-adversarial7-conditional-eval.{cjs,log}. De-duplicated as one P2 F9. This is a NEW regression introduced in PR29, not a pre-existing parent limitation.
+
+### F8 — P2 — PARTIALLY CORRECTED, remains for contextual-keyword wrapper names (adversarial)
+
+Exact reviewer location src/resolution/commonjs-export-members.ts:29 (whitelist:7). Valid CommonJS `function await(value){return function ignore(code){};} await(eval)("ignored");` passes eval without invoking it, but whitelist exemption produces uncertain:true and falsely resolves named.missing() to decoy.js:Decoy::missing. With exports.known=function known(){}, runtime exports only known; pre-F7 behavior restored in memory produces no call. yield reproduces too. Evidence /tmp/codegraph-cjs-adversarial7-contextual-wrapper.{cjs,log}. This is a RESIDUAL F8 variant, not a new unrelated parent re-audit. Do not label all F8 closed.
+
+### Confirmed preservation / rulings
+
+Both independently clear original F8 forms wrap(eval)("ignored") and wrap((eval))(("ignored")): runtime onlyknown, reader uncertain:false, no decoy call. Broad /tmp/cg-broad-pr29-f8-closure.{cjs,log}. Adversarial13runtime-backed graph controls pass (original2forms +11nearby controls), /tmp/codegraph-cjs-adversarial7-controls.log. True standalone grouped/template eval, return expressions, inert data/method declarations, call/member/optional/tag/condition-prefix negatives retain tested behavior. These controls do not answer F9 control-body context or F8 await/yield wrappers.
+
+### Next boundary
+
+Review-only user request is complete. STOP: no fixes, additional review loop, external review comment, markready, merge or deploy without user instruction. The per-step confirmation request remains in force. This is round7 overall; no gate/state reset. Repeated grouping-prefix patches now demonstrate syntax-context ambiguity: if user asks for remediation, choose an evidence-based smaller boundary/design instead of another unbounded keyword/punctuation whitelist. Preserve both concrete repros and all prior controls. Do not repeat fullsuite/build on unchanged source. Actual durable result/evidence/checksums saved in original QA .review/commonjs-fix-2026-11-08/pr29-review-round7-2026-11-09/.
+
+
+## AST redesign approved and started — 2026-11-09
+
+User explicitly approved AST redesign in PR29, said near usage max and asked for a resumable start, then said proceed. This revokes prior review-only stop for in-scope remediation; do not ask same approval on resume. Preserve per-step/user and actual gate boundaries for later merges/deployments. No grammar/runtime/dependency/database-schema changes, commits or pushes in this partial phase; PRs remain draft at prior heads.
+
+Newgraph regressions FIRST:3control-body direct-eval variants(if string/template, for nestedgroups) +await/yield CommonJS wrappers,5FAIL51SKIP on current87576a8d. /tmp/codegraph-cjs-ast-red.log, EXIT1. This intentionally RED gate remains unchanged because integration pending.
+
+New isolated src/extraction/commonjs-eval.ts reads existing SyntaxNode tree and checks actual call.function after unwrapping parenthesized_expression. Returns true for syntacticdirectevalcall(anyargument), false for provenabsence, null for parseerrors with no foundcall. New __tests__/commonjs-eval.test.ts loads existingJS/TS/TSXgrammars:33PASS, /tmp/codegraph-cjs-ast-helper.log EXIT0. Controls cover reports, grouped/interpolated eval, return, generatorfunctions/methods, nestednongenerator scope, eval inside yieldwrapper argument, inert data/methods/membercalls, JSX and malformedsource. Helper not wired to classifier/extraction yet. Existing lexical reader/EXPRESSION_PREFIX_WORDS unchanged for now. Do not claim F8/F9 closed, new full/buildpass or finalreview.
+
+IMPORTANT new evidence: existingJSgrammar correctly models control-body eval and awaitwrapper but parses legal CommonJS yield(eval)(code) as yield_expression whose operand is a call on(eval), no parseerrors. ASTscope must distinguish nongeneratorwrapper from generator yield. Helper handles direct yieldoperand only via nearestfunction/generator/methodscope; nested true eval in yield(eval(code)) remains detected. Shapeprobe /tmp/codegraph-cjs-ast-shape-probe.{cjs,log}. Extractionreferenceprobe /tmp/codegraph-cjs-eval-reference-probe.{cjs,log} shows currentextractor emits callref eval for genuinecall AND synthetic yieldwrappercase. Consequently raw existing unresolved eval refs alone are insufficient. User was explicitly told this grammar limitation, not falsely assured all cases are parser-perfect. No grammarfiles changed.
+
+Next integrate factualcallresult through existingextraction to resolver. Node has NO metadata field (onlyedges do); do not invent Node.metadata, abuse signature/selfedges/candidates, or introduce schema migration casually. ExtractionResult can carry optionalfact through workerclone; need native/deferred bypass parity. Main bulk parse pools only load grammars in workers; resolver cannot assume synchronous getParser is ready in main. Suggested project_metadata perfile/sourcehash transport or another small explicit extractioncontext capability; persist/refresh under same successfulstore lifecycle, cover storeworker and sync. Decide carefully before editing infrastructure. Resume must preserve all existing tests and5newred cases; unknown/missing/error facts must not masquerade as provenabsence. Keep existing export-member tokenizer and previous sync/scope/alias fixes intact; remove prefixheuristics only onceASTfacts actuallysupplied.
+
+Saved current3sourcefiles, patchrelative87576a8d, hashes, red/green/probe logs under original QA .review/commonjs-fix-2026-11-08/ast-redesign-started-2026-11-09/. No tests/build/reviewers running at checkpoint. Newfiles intent-to-add only so diffincludes them, not readyforcommit. No fresh dualreviewagents this phase. Overall reviewcount7; do not reset gate/controlstate. Resume directly integration and targeted tests; fullsuite/build only after stablefix, fresh focuseddual review as authorized/actualgatepermits, no repetitivewholeprojectwork. OriginalT0stillstopped/uncommitted; liveem40 unchanged; no merges/deploy/upstream writes.
+
+
+## AST integration execution-tested — verify round8 pending
+
+User approved AST redesign with focused review before final fullsuite, then resumed. Current dirty correction target87576a8d..workingtree,15paths captured /tmp/codegraph-cjs-ast-frozen.json (allnewfilesintent-to-add). No sourcecommit/pushyet; publishedPR29still87576a8d. No grammar/runtime/dependency/schema changes.
+
+Implemented AST fact in ExtractionResult and ephemeralFileRecord property; WASM computes from existingtree, native/deferred routes compute with existinggrammar; kernelmaterializer preservesfact. Allstorepaths carryFileRecord fact through existingwriter, upsertFile writes project_metadata commonjs_eval:<file> containingcontentHash/value. Nosecondwriter orNode.metadata. deleteFile removesfact. Coordinatorcontext acceptsboolean onlyonexact SHA256sourcehash. Missing/malformed/stale/nullfacts returnunknown, neverabsenceproof. Tokenreader removed literalEvalCall/EXPRESSION_PREFIX_WORDS, consults lazyASTfact atmostonceonlywhenbareevaltokenpresent; unknown staysconservative. Existingmembertokenizer/sync/typeFrom/scope unchanged. CHANGELOG alreadyrequiresre-indexafterupgrading(line56), which suppliesnewfacts; no legacyfactmigrationclaimed.
+
+Original5newgraphregressionsRED5FAIL51SKIP beforeintegration. Initialintegratedrun blocked by compiler: hashContentisexportedfromextraction/index, notutils; corrected byusingexistingcreateHashcrypto inresolver (sameSHA256algorithm), no circularextractionimport. Then3files140PASS. AddedrealSQLite factlifecycle4cases(missing/malformed/null, hashstale/replace,rollbackwithfiletransaction, deletion) andfreshindex-vs-sync wrapper->if-eval->yield-wrapper->for-eval->wrapper sequence. Final8files166PASS1SKIP, /tmp/codegraph-cjs-ast-expanded.log, CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2; alsoincludesmemo/synccaches/lazy-engine. Nativebinarynotstaged(codegraph-kernel/prebuilds/linux-x64/codegraph-kernel.node absent); kerneltransporttestskipped. Do not claimnativeexecution. Enginecompiledbytestsetup,currentdistmatchesfrozen sources. No explicitfinalnormalbuild/fullsuiteorindependentreviewyet. Priorfull10666PASSbelongs87576a8donly.
+
+Next eighthfreshnativeREADONLYlanes verify this correction, sameledger andexactGitdiff87576a8d..workingtree. Boundedruntimeprobes only, no fullsuite/build orsourcechanges. CheckF8/F9closure,generator-awareyieldworkaround, actualevalvswrappercallee, sourcehashfactlifecycle/workertransport/sync, previouscontrols. Do not re-audit unrelatedparentlimitations. Stop/reportifreviewfindsissues; do notresetgate/count orclaimClaude-onlyskill.
+
+
+## Eighth native review COMPLETED — AST correction NOT CLEARED
+
+Both fresh read-only reviewers completed normally on frozen15-file87576a8d..workingtree correction. Both confirm no source edits/build/full reruns/control changes; source hashes unchanged. No final normalbuild/fullsuite run or commit/push. PublishedPR28/29 remain drafts at5d384989/87576a8d. Prior166focusedPASS1SKIP is true and covers original5reportedgraphcases, but does not clear new findings. Nativebinary absent, no nativeexecutionclaim. Parent uses actual reports, no independent duplicate repro/diffread.
+
+### F10 — P2 — Optional contextual-keyword wrappers regress (adversarial)
+
+Exact reviewer location src/extraction/commonjs-eval.ts:37. Valid CommonJS:
+
+```js
+exports.known = function known() {};
+function yield(value) {
+  return function ignore(code) {};
+}
+yield?.(eval)("ignored");
+```
+
+Runtime exports only known; eval is never invoked. Existing grammar reports parse error, helper returns null, reader marks exports uncertain, and named.missing() falsely calls unrelated decoy.js:Decoy::missing. Actual current correction calls:[decoy.js:Decoy::missing]; base87576a8dreader restored in memory calls:[], uncertain:false. Evidence /tmp/cg-a8-yield-optional.{cjs,log}, /tmp/cg-a8-yield-optional-base.{cjs,log}, /tmp/cg-a8-probe.cjs. New F8-adjacent regression introduced by AST correction. Unknown fact correctly avoids false absence proof but must not license false call targets; current fallback still does.
+
+### F11 — P2 — Computed method names use enclosing scope (broad)
+
+Exact reviewer location src/extraction/commonjs-eval.ts:51. Treats a computed method name as belonging to that method's function scope. Computed names execute in enclosing scope. Confirmed both directions:
+
+1. `class Store { load(){return 42;} } function* setup(){ const obj = { [yield (eval)('exports.load = Store.prototype.load;')]() {} }; } setup().next();` Runtime exports load()->42, currentfactfalse/uncertainfalse, named.load() graphcalls[]. Ordinary computedmethodkey inside outergenerator suppressesgenuineeval.
+2. `exports.known=function known(){}; function yield(value){return function ignore(code){return 'x';}} const obj={ *[yield(eval)("ignored")](){} };` Runtime keysonlyknown, currentfacttrue/uncertaintrue, named.missing() falselycallsDecoy::missing. Generator methodkeyevaluatesoutsidegeneratorbody, so yieldiswrapperhere.
+
+One rootcause/twoexecutiontraces, evidence /tmp/cg-broad-pr29-ast8-computed-scope.{cjs,log}, executed againstcurrentdist with CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2. All15frozenhashesmatch.
+
+### Stop boundary and saved state
+
+Approved redesign progressed to166focusedPASS + real-worker/store/sync/factlifecycle integration, then focusedverifyfoundthese2P2. STOP before anothercorrectioncycle per dual-reviewworkflow/userper-stepconfirmation. Don't spendfullsuiteonknowndefectivecode orpushasready. Usermustdecidenextstep; noautomaticnewreview/fix/merge/deploy. Overallcount8, noreset. Nextremediationifapproved: computedmethodscope must excludecomputedkeys fromnewmethodscope; parseerrorunknown mustnotenableinventedfallbackcalls (requires explicitresolutionpolicy, not anotherkeyword/punctuationguess). Preserve all originalregressions and33ASTcontrols, truealiases/sync/scope/Pythonbehavior. No grammarfiles/schema/deps changed; source remains15dirtypaths, notcommitted. Durablebackup includes allsources/patch/logs andnewreviewevidence, verificationresult/checksums.
+
+
+## F10/F11 corrections approved and execution-verified — independent verification pending
+
+User explicitly answered yes to correcting the two eighth-review findings. Current HEAD87576a8d and15dirtysourcepaths retained; no newcommit/push/merge/deploy/grammar/schema/dependencychanges.
+
+Fail-beforetests:2ASTcomputed-key cases,3graphfindingcases,positivealiascontrol andunknownparse syncstep. Actual2files6FAIL90PASS beforefix, /tmp/codegraph-cjs-ast-f10-f11-before.log EXIT1. Positive explicitcallablealias underunknownparsealreadyPASS beforefix, mustkeep.
+
+F11fix: method_definition suppliesfunctionscope onlywhen calllieswithin ASTbodyorparametersregions. Computednames/decorators useenclosingscope; no newkeyword/punctuation guesses. Bothcomputedkey directionsfixed. F10fix: tokenizer resultrecords evalUnknown separatelyfromuncertain/namespace. Moduleinfo propagatesunknownflag, includingexistingforwarderspread. Themethod-nameguessgate stopsunprovenmatchesforunknown-evalexportswithoutclaimingnamespace/memberabsence; explicitwrittenmemberaliasesremainallowed, andearlierprovenreceiver/typepathsremainunchanged. UnknownASTfactstillnull, no falseparse-success/intrinsicproof. Existingmembertokenizer andfacts/hash/storelifecycleremainunchanged.
+
+Expanded8files172PASS1SKIP EXIT0, /tmp/codegraph-cjs-ast-f10-f11-after.log, CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2. Coversallprevious166checks plusnewcomputed-keyAST/graphcases,optionalcontextualwrapper,realexplicitcallablealiasunderunknownparse,andfreshindex-v-syncincludingknownactualeval->unknownwrapper->actualeval transitions. One skip is nativekerneltransport; nativebinarynotstaged,no nativeexecutionclaim. A matchercommentclarifyingunproven-callpolicyupdatedaftertest; no behaviorchangedafterthispassingrun. gitdiff--checkPASS. No explicitnormalbuild/fullsuite oncurrentcorrection; old10666fullPASSbelongs875only.
+
+Currentcorrectionvsround8snapshot changes5files: ASThelper,exportreader,matcher,ASTtest,graphintegrationtest. Durablebackup originalQA .review/commonjs-fix-2026-11-08/ast-f10-f11-corrected-2026-11-09/ includesall15sourcefiles,currentSHA256,cumulativepatchrelative875,small5filedeltafromround8,fail-before/passafterlogs,verificationmetadata. F10/F11 statusCORRECTED+focusedPASS, NOTindependentlycleared. Overallreviewcount8unchanged,noround9agentslaunched. Userper-stepconfirmationrequiresdecisionbeforefreshfocusedverify; don'tspendnewfull/reviewcycleunasked. No sourcecommit/pushyet; PR28/29remainDRAFT/unmerged. Ifuserapprovesnextreview: exactGitdiff875..workingtree +round8delta/sameledger, freshread-onlynativebroad/adversarial, boundedprobesonly,norepeatfull/build. Respectactualgate/noreset. Runfinalnormalbuild/fullonceonlyafterreviewstable. PreserveT0stopped/uncommitted; liveem40unchanged; noofficialupstreamwrite.
+
+
+## Ninth native focused verification explicitly authorized and running
+
+User answered yes to next focused dualreview. Fresh READONLY review_broad_pr29_f10_f11_9 and review_adversarial_pr29_f10_f11_9 launched together with exact87576a8d..workingtree15path target, thisledger andsmall5filedelta fromround8. Source matches172focusedPASS snapshot except documentedcommentonlychange, hashmatchesdurablecorrectedbackup. BothreviewclaimsremainPENDING; do notclaimclearance. No sourcechanges/build/fullsuite orpublishingauthorized bythisreviewonlyturn. Source staysfrozen; no gate resets/controlchanges. Parentwillgatherbothactualreports,mergefindings/saveandstop.
+
+
+## Ninth native focused verification completed — F10/F11 cleared, F12 remains
+
+User explicitly authorized thisverificationround. Both fresh read-only lanes review_broad_pr29_f10_f11_9 and review_adversarial_pr29_f10_f11_9 COMPLETED normally on same87576a8d..workingtree15path target and sameledger. Source hashes stillmatch approvedcorrectedsnapshot; no sourceedits/rebuild/fullsuite/controlchanges/networkwritesbyreviewers. No sourcecommit/push/merge/deploy. BothpublishedPRsremaindraftunchanged.
+
+F10/F11 originals independently CLEARED by BOTH: optionalcontextualwrapper nofalsecall; computedkeygenuineevalinsideoutergenerator keepsStore::load; generatormethodkeynongeneratorwrapper nofalsecall. Broad11runtime-backedprobesPASS includingclass/nestedcomputedkeys,generator/nongeneratorbodies,explicitcallablealiasunderunknownfactandgenuineevalcontrols. Evidence /tmp/cg-broad-pr29-ast9-verify.{cjs,log}. Adversarial also confirmsnestednongenerator/gettercomputedkeycontrols. ThesecontrolsdoNOTclearrootwhole-valueexportsbelow.
+
+### F12 — P2 — Unknown eval facts suppress genuine root exports (adversarial)
+
+Exact reviewer location src/resolution/name-matcher.ts:25403. Valid m.js:
+
+```js
+class Store { load() { return 42; } }
+module.exports = { load: Store.prototype.load };
+function yield(v) { return function ignored() {}; }
+yield?.(eval)("ignored");
+```
+
+Caller const named=require('./m'); function run(){named.load();}. Runtime named.load() returns42; currentindexcalls:[]. Readerrecordsnomembersfortherootobjectassignment; newevalUnknowngatedropsthegenuinecallablealias. module.exports=new Store() reproduces too. RemovingONLYnewevalUnknownconditioninmemoryrestoresm.js:Store::loadforbothidenticalinputs. Directexports.load=Store.prototype.loadcontrolstillpasses. ThisisNEWregressionintroducedbyF10correction. Evidence /tmp/cg-a9-root-export-regression.cjs, /tmp/cg-a9-root-export-current.log, /tmp/cg-a9-root-export-oldgate.log. Broadclearedlimitedcontrolsbutdidnotprobeequivalentrootexports; no contradictoryexecutionresult.
+
+STOP/reportmergedfindingonly; useryesauthorizedfocuseddualverify, notanotherunaskedcorrectioncycle. OriginalF10/F11closedatthissnapshot; F12OPEN. No finalreviewclearanceorreadyformergeclaim. No explicitnormalbuild/fullsuiteoncurrentdirtyASTcorrection;172focusedPASS1SKIPremainsactualbutmissesF12. Old10666fullPASSbelongs875only. No test/build/reviewerprocessesrunning. Needuserdecisionbeforefix; preserveactualmodule-valueexportswhileblockingunprovedunknown-evalguesses, notanotherpunctuation/keywordheuristic. Overallcount9honest,noreset/gatebypass. Durableevidence/ledger/resultsavedunderoriginalQA .review/commonjs-fix-2026-11-08/pr29-review9-2026-11-09/; current15sourcefilespatchesremainin adjacentast-f10-f11-correctedbackup. T0/liveem40unchanged, noofficialupstreamwrite.
+
+
+## F12 correction approved and focused verification complete — 2026-11-09
+
+User explicitly approved the focused F12 correction after reading the session-end handoff. Existing checkout/HEAD 87576a8d and all 15 dirty source paths preserved; only two source files and their two tests changed from review 9. No commits, pushes, new review, merge, deploy, grammar/schema/dependency or extraction/storage changes.
+
+Added both runtime-backed F12 regressions FIRST: root object callable alias and new Store() under optional yield wrapper return 42 at runtime but graph calls are empty. Actual 2 FAIL / 61 SKIP, /tmp/codegraph-pr29-f12-red.log, exit 1. Expanded pre-fix reader/graph contract: 33 FAIL / 136 PASS, /tmp/codegraph-pr29-f12-matrix-red.log, exit 1.
+
+Reader now records exportForm (namespace/value/opaque) independently from evalState (present/absent/unknown); replaces the prior evalUnknown flag. Explicit members remain property writes, never a whole-value inventory. Any syntactically stated whole module.exports assignment retains existing value resolution; escapes/mixed writes do not erase that evidence or claim a final member inventory. Namespace absence still requires !uncertain. Inconclusive eval only gates unproven method guesses when no stated whole value is present; explicit property aliases and confirmed eval behavior stay intact. Forwarders propagate the summary through existing spread, and existing typeFrom dependencies remain intact.
+
+Tests cover namespace/direct alias/root object/instance x eval absent/present/unknown, direct and forwarded imports; runtime values and typeFrom metadata asserted. Added fresh-v-sync transitions across both axes, bracket/mixed assignments, opaque reader controls; all prior F10/F11 tests retained unchanged.
+
+Actual verification:
+- First two-file green: 169 PASS, /tmp/codegraph-pr29-f12-matrix-green.log, exit 0. Test setup successfully ran tsc + copied assets for current source.
+- Expanded ten-file run after final four bracket/mixed graph tests: 235 PASS / 1 SKIP / 6 FAIL, /tmp/codegraph-pr29-f12-focused.log, exit 1. All six failures were lazy-engine child stdout empty. Independent minimal spawnSync probe reproduced EPERM for piped Node child output even when the child simply prints 42; file output works. No source/test workaround added.
+- Approved sandbox escalation reran ONLY lazy-engine.test.ts outside sandbox: 6 PASS, /tmp/codegraph-pr29-f12-lazy-unsandboxed.log, exit 0.
+- Combined distinct final checks: 241 PASS / 1 SKIP over 10 files. Skip is native-kernel parity (binary not staged); no native execution claim. git diff --check PASS. No final normal npm run build/fullsuite on dirty AST revision; these remain deferred until stable independent review per user handoff. No tests/build/reviewer processes running.
+
+F12 status: CORRECTED + focused verified, NOT independently cleared. Overall review count remains 9; no gate resets or new agents. STOP and ask before fresh focused dual review, as requested. Proposed two-commit structure stays pending; nothing staged/committed/published. PR28/29 draft state not changed. T0/live/deploy/control files untouched.
+
+Durable backup: original QA .review/commonjs-fix-2026-11-08/pr29-f12-2026-11-09/ contains before/after copies of all 15 dirty source files, hashes, cumulative-from-875.patch, f12-correction.patch, actual red/green/failure/rerun logs and verification.json. Plan: /home/ericm/.codex/plans/plan-codegraph-pr29-f12-2026-11-09.md. Next factual checkpoint: /home/ericm/.codex/plans/handoff-codegraph-pr29-f12-focused-2026-11-09.md.
+
+
+## Tenth native focused verification explicitly authorized and running
+
+User answered yes to next focused dual review. Fresh read-only review_broad_pr29_f12_10 and review_adversarial_pr29_f12_10 launched on exact 87576a8d..workingtree target, same ledger and saved four-file F12 delta. All 15 source hashes match focused-tested F12 checkpoint. Both results PENDING. No source changes, rebuild, full suite or publication in this review-only phase. Completed review count remains 9 until results arrive; no resets or gate bypass. Parent will merge actual reports, save checkpoint and stop.
+
+
+## Tenth native focused verification completed — original F12 clears; F12 variants and new F13 remain
+
+User explicitly authorized this focused review. Both fresh read-only lanes review_broad_pr29_f12_10 and review_adversarial_pr29_f12_10 completed normally against exact git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 87576a8d9ff0d8aba235db5535f5f4429f14b037 -- . and the same ledger / saved F12 delta. All 15 source hashes match the focused-tested F12 snapshot. No source edits, rebuild, fullsuite, commits, pushes, merge, deploy or gate reset. Parent merged actual reports without duplicate probes/source re-audit.
+
+Both independently CLEARED original F12 unparenthesized root object/instance, original F10 optional wrapper, and both F11 computed-key directions. Original passing examples do not clear adjacent syntax/scope findings.
+
+### F13 — P2 — Shadowed module writes disable the unknown-eval guard (adversarial)
+
+Exact location src/resolution/commonjs-export-members.ts:75, gate name-matcher.ts:25403. Concrete input:
+
+```js
+exports.known = function known() {};
+function pretend(module) { module.exports = {}; }
+pretend({});
+function yield(v) { return function ignored() {}; }
+yield?.(eval)("ignored");
+```
+
+Caller const named=require('./m'); function run(){named.missing();}, unrelated export class Decoy { missing() {} }. Actual CommonJS exports only known; missing undefined. Current graph incorrectly calls decoy.js:Decoy::missing. Reader records exportForm:value/evalState:unknown from local parameter's module.exports assignment, bypassing unknown-eval guard. Block-local and arrow parameter variants reproduce. Loading both saved pre-F12 source files in memory yields calls[] on identical inputs, proving NEW regression in latest correction. Evidence /tmp/cg-a10-boundary.{cjs,log}, /tmp/cg-a10-before-loader.cjs, /tmp/cg-a10-boundary-before-source.log, /tmp/cg-a10-shadow-runtime.log.
+
+### F12 — P2 — F12 remains for equivalent whole-value assignment syntax (broad)
+
+Exact location src/resolution/commonjs-export-members.ts:75, gate name-matcher.ts:25403. class Store { load() { return 42; } }; (module.exports) = new Store(); function yield(v){return function ignored(){}} yield?.(eval)("ignored"); with named.load() returns42 at runtime but graph calls[]. Reader expects = immediately after module.exports, records opaque and suppresses call. Parenthesized root object and module.exports &&= new Store() reproduce. Removing only optional wrapper restores Store::load. Direct/forwarded imports both fail; fresh/sync agree, removing wrapper during sync restores edge and typeFrom. This is incompletely corrected F12, not a demonstrated NEW regression in latest correction. Broad evidence /tmp/cg-broad-pr29-f12-10.{cjs,log} (28 runtime/graph probes), /tmp/cg-broad-pr29-f12-10-sync.{cjs,log} (12 asserted sync/fresh comparisons).
+
+STOP/report both P2 findings. No fix or new review authorized by this yes-to-review turn. Review count10 completed honestly, no resets. Prior 241 focused PASS /1native SKIP remains actual but misses these cases. No final normal build/fullsuite on dirty AST revision; no native-kernel execution claim. PR28/29 stay draft/unpublished current correction; T0/live/control/deploy files untouched. Sources remain 15 dirty paths on HEAD87576a8d. Preserve checkout and all work.
+
+Durable review evidence: original QA .review/commonjs-fix-2026-11-08/pr29-review10-2026-11-09/ includes broad/adversarial reports, merged-review.md, completed review-status.json, source hashes, scripts/logs, and ledger. F12 before/after source backups/cumulative+delta patches remain adjacent pr29-f12-2026-11-09/. New handoff /home/ericm/.codex/plans/handoff-codegraph-pr29-review10-two-findings-2026-11-09.md.
+
+
+## Shared production export evidence integrated — focused verification complete
+
+User said "ok run it" after clarification that integration remained unfinished. Authorized production implementation in preserved checkout; no new review or publication in this turn. New binding-aware source record is now used by import resolution and the name-matching guard. F12 equivalent assignments and F13 export/caller shadowing corrected + focused tested, NOT independently cleared. Overall review count remains10.
+
+Implementation: src/resolution/commonjs-export-evidence.ts uses established TypeScript checker.resolveName binding identities and type/member declaration selectors. It handles structural parenthesized/bracket/logical assignments, direct callable aliases, exported class/object/instance members, relative forwarding, and direct literal eval analyzed in its lexical context by a synthetic arrow body. This records static potential relationships without generator execution; genuine F11 generator eval passes beside unrelated methods. Local module/exports/eval bindings and caller parameters/classes are distinguished. Unknown behavior supplies no target. Selector ranges map only to indexed declarations, no global name guess.
+
+The source-hash/versioned record is computed lazily during resolution, memoized by context/file/source, and cleared with resolver caches. No new metadata writer/schema/grammar. Import resolver's CommonJS default regex is replaced by record consumption. All CJS positive member targets resolve through the record before fallback; a CJS binding cannot authorize a global method-name guess. Early import edges preserve typeFrom source/forwarder dependencies. Existing AST eval fact pipeline and tokenizer unit helper were preserved; tokenizer is no longer the production fallback authority. Extraction's existing export-name helper remains node naming, not authorization of these call targets.
+
+TypeScript5.9.3 is promoted from development to runtime dependency (^5.9.3); package lock refreshed offline, npm ls --omit=dev confirms presence. Compiler is required only when analyzing source, not by loading the helper/library/read CLI. Final7lazy tests outside sandbox PASS (same known Node child-pipe EPERM reason as earlier runs).
+
+Actual verification history:14newgraph regressions FAIL before;14PASS after first integration. Expanded10files initially236PASS30FAIL1SKIP from missing dependency metadata (stale sync), object-method node-kind mapping and parenthesized eval arguments; corrected to266PASS1SKIP. Neighbors initially356PASS2FAIL (caller parameter/class shadowing); added compiler-bound call-site receiver facts. Final combined19files624PASS1SKIP, /tmp/codegraph-pr29-evidence-integrated-focused.log. Final7lazyPASS, /tmp/codegraph-pr29-evidence-lazy-final.log. Distinct final631PASS1SKIP over20files. Test setup ran tsc/assets, viewer build/check succeeded earlier. git diff --check PASS. No standalone final npm run build/fullsuite on this revision; deferred to stable review per existing boundary. Native parity skipped because binary absent, no native execution claim.
+
+Small production-collector measurement: module load8.23ms with compilerLoadedBeforeAnalysis:false; cold first analysis277.01ms, heap delta17.70MiB;25warm samples median1.65ms (147byte value fixture),2.37ms (152byte generator eval). These are toy collector measurements, not actual large-project indexing, query latency, cache or worker benchmarks.
+
+CurrentHEAD87576a8d, branchfix/commonjs-eval-callee-context.22dirtypaths total, new3files intent-to-add for review only; no sourcecommit/push/merge/deploy. Integration phase changed9paths: shared source module, import resolver, name matcher, two new test files, default-binding graph tests, lazy test, package.json/lock.13of15prior dirty source paths remain byte-identical; two intentionally extended. All22final hashes saved/verified. T0/live/deploy/control files untouched.
+
+Durable backup: originalQA .review/commonjs-fix-2026-11-08/pr29-export-evidence-integration-2026-11-09/ contains baseline before/, milestone1/2 source snapshots/hashes, final-source/ all22files, source-sha256.json, cumulative-from-875.patch, integration-from-round10.patch, actual red/green/failure/lazy logs, production measurement script/output, results.json/progress.json. STOP and ask before fresh focused dual review; do not auto-review/fix/publish. Final normal build/fullsuite once after stable clearance. Latest handoff /home/ericm/.codex/plans/handoff-codegraph-pr29-export-evidence-integrated-2026-11-09.md.
+
+
+## Eleventh native focused verification explicitly authorized and running
+
+User answered yes to the next focused dual review. Fresh read-only review_broad_pr29_evidence_11 and review_adversarial_pr29_evidence_11 launched on exact 87576a8d..workingtree22-file target, same ledger and integration-from-round10.patch. All22source hashes match the631focusedPASS/1nativeSKIP snapshot. Both results PENDING;10rounds completed until reports arrive. No source changes, rebuild, fullsuite, publication or gate resets. Parent will merge actual results, preserve artifacts and stop for user decision.
+
+
+## Eleventh native focused verification complete — F10–F13 clear, new F14/F15 open
+
+Both user-authorized read-only lanes review_broad_pr29_evidence_11 and review_adversarial_pr29_evidence_11 completed normally against exact git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 87576a8d9ff0d8aba235db5535f5f4429f14b037 -- . and the same ledger/integration delta. All22source hashes match focused-tested snapshot. No source/build/fullsuite/commit/publication/gate changes. Parent merged actual reports without duplicate source reading/probes.
+
+Both independently CLEARED original F10/F11/F12/F13, including true generator eval, optional wrapper, parenthesized/logical whole exports, local wrapper shadowing. Broad11asserted AST and12asserted sync/fresh controls pass. Prior631focusedPASS1nativeSKIP is actual but misses new findings.
+
+### F14 — P2 — Preserve explicit property aliases on a whole exported local value (broad)
+
+Exact location src/resolution/commonjs-export-evidence.ts:226. Valid m.js: class Store { load() { return 42; } }; const api = {}; api.load = Store.prototype.load; module.exports = api; Caller named.load() runtime42, current graph[], record.members{}. Before integration, identical source resolves Store::load/typeFrom[m.js]. Class Factory.load and function Factory.load alias variants independently fail-after/pass-before. Collector discards writes on local receivers, and the wrapped compiler type does not supply those assigned properties. This is an introduced loss of correct relationship, not permission to restore global guesses. Report/replay: /tmp/cg-broad-pr29-evidence11-report.md and /tmp/cg-broad-pr29-evidence11-artifacts/ (durably copied below).
+
+### F15 — P2 — Do not emit calls to exported non-callable values (adversarial)
+
+Exact location src/resolution/import-resolver.ts:3430, classification commonjs-export-evidence.ts:148-156/309-313. m.js const value=42; exports.load=value; caller named.load(). Runtime TypeError (not a function), current graph run→m.js:value constant; before calls[]. String-valued object-export variant reproduces. Valid supporting variant function real(){return 42;}let value;value=real;exports.load=value; runtime42/current targets variable value instead of real; before has no target. Same kind:value declaration fallback, one finding. Preserve data imports/references while withholding unsupported call identity. Report/replay /tmp/cg-a11-final-report.md and cg-a11-* scripts/log/JSON.
+
+Review count11 completed honestly, no resets. STOP before fixes/review/publication unless user authorizes. Final normal build/fullsuite not run; native binary absent, no parity claim. HEAD87576a8d,22dirtypaths preserved; PR28/29 publication unchanged. Durable originalQA .review/commonjs-fix-2026-11-08/pr29-review11-2026-11-09/ contains exact reports, merged-review.md, completed review-status.json,22source hashes, broad-artifacts/ including both baseline source files, adversarial-artifacts/ including scripts/logs/baseline import resolver and copied before name matcher. Some adversarial replay scripts hardcode original /tmp baseline paths; restore those saved files to their original paths or adjust only copied replay scripts if /tmp disappears. Actual source snapshots remain adjacent pr29-export-evidence-integration-2026-11-09/final-source/ and before/.
+
+Latest user steering after review: "astra vs sol come up with diff plan?" Parent will obtain independent read-only design plans from Astra and Sol against these same findings; this authorizes planning/comparison, not code or another review. Preserve source.
+
+
+## Production value-model integration — implemented, focused-tested, awaiting new review
+
+User approved integration after the isolated contract experiment. Binding-owned typed values/property identities now drive production reference/call/construct evidence; local object/class/function writes retain their targets, data cannot authorize calls, and assigned functions target their bodies rather than storage. Import intent is preserved through forwarding and memoization; named object members select the called property. Const-alias caller now requests reference evidence. Failed CommonJS calls retry through the existing bounded importer/barrel walk after data-to-callable edits, including unchanged declarations. Wrapper shadows, lexical literal eval, source ownership, cache clearing and lazy compiler loading preserved. No extra dependency/schema/grammar this phase.
+
+Actual final25file run812PASS1nativeSKIP;7lazyPASS outside sandbox (known child-pipe restriction); distinct819PASS1SKIP over26files.171production contract/core/boundary tests included. tsc/noEmit and git diff --check PASS. Normal build/fullsuite deferred to stable review per existing boundary. Commander3-source coverage/timing screen retained exports/forwarded identities; analyzer-only, no large-project/native parity claim. Failures/root causes and exact logs retained in private evidence; final source frozen.
+
+30dirtypaths, no staged content.17of22pre-phase paths byte-identical;5intentionally extended;4previously clean production paths plus4newsource/test/fixture paths added. Full before/final snapshots, verified hashes, cumulative-from875.patch and integration-from-round11.patch saved under originalQA .review/commonjs-fix-2026-11-08/pr29-value-model-integration-2026-11-09/. Latest handoff /home/ericm/.codex/plans/handoff-codegraph-pr29-value-model-integrated-2026-11-09.md. F14/F15implementation awaiting independent verification. Review count remains11completed; no12threview, commit/push/merge/deploy/publication. Ask before fresh dual review.
diff --git a/docs/handoffs/pr29-2026-11-10/ledgers/commonjs-missing-member.md b/docs/handoffs/pr29-2026-11-10/ledgers/commonjs-missing-member.md
new file mode 100644
index 0000000000..6133cf6cc3
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/ledgers/commonjs-missing-member.md
@@ -0,0 +1,282 @@
+# CommonJS missing-member review ledger
+
+Target: /tmp/codegraph-cjs-missing-fix-20261108, branch fix/commonjs-missing-member. Base 5e0664891af0e87e6fd18bbfa16cab39237570f5 to current tracked working tree, unchanged while both reviewers run. Exact diff: `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5e0664891af0e87e6fd18bbfa16cab39237570f5 -- CHANGELOG.md src/resolution/name-matcher.ts __tests__/js-default-binding-members.test.ts`.
+
+Round1 pending two fresh read-only native lanes. No Claude-only /code-review invocation. No resolver fix existed previously; user explicitly authorized implementation and dual review. Fork issue27 is the bug, QA PR27 is evidence only. No official upstream submission before Tuesday verification.
+
+## Findings / fix map
+
+- F1: confirmed upstream defect. `const named=require('./m'); named.missing()` with m.js exporting only known falsely calls unimported Decoy::missing; ref keeps receiver, resolvedBy instance-method/provenance null. Default imports and class-name-alias collision variants also reproduced. Sync adding decoy also fabricates call. Proposed tracked working-tree fix adds default bindings to imported-receiver guard and moves guard before unrelated class-name matching, after actual import/typed/object resolution. Requires reviewer execution and clearance.
+- P0 test baseline: new20-case file on unmodified resolver:15 PASS /5 FAIL. The5 failures are3 parameterized default/require+decoy cases,1 forwarding-module missing member,1 sync-add-decoy. Log /tmp/codegraph-cjs-fix-baseline2.log. No production code edit before this run. Initial baseline command failed because Vitest4 removed --minWorkers; corrected to --maxWorkers=4. Initial two new-test authoring corrections: object variable API used instead of unsupported direct object-literal shorthand shape; expected local object's qualified name corrected to actual fully-qualified extraction name. Neither changes an existing baseline test.
+
+## Rulings / limits
+
+- Direct `module.exports = { read() {} }` without an assigned variable already lacks correct member recovery on base and can be captured by a method decoy. This change must stop wrong calls; new object API positive uses baseline-supported `const api={read(){}}; module.exports=api`. Do not broaden into object-export extraction or claim direct shorthand recovery is implemented.
+- Bare external-package import exact-match issue26 remains separate and unfixed.
+- No import mapping semantics changes, no blanket conversion of require to namespace imports, no source code changes outside one name-matcher guard and changelog/tests.
+- This is a remaining variant of closed upstream2952/merged3162. No global novelty claim. Reproduced on em40/pristine main/pristine release. Native kernel unverified; local deployment is kernel0/WASM.
+
+## Invariants / commands
+
+- Actual exported member resolves beside an unrelated same-name method; missing member has no call. Forwarded CommonJS module preserves real export.
+- Stated CommonJS class static method, assigned object member, instance method, callable direct/default + attached function all remain correct beside decoys.
+- Existing ES default class, instance, typed variable, ambient export=, ordinary ESM namespace, named/anonymous/renamed functions retain calls.
+- Typed local parameters and object literal bindings shadowing default imports retain their local member calls.
+- Sync adds/removes a real export correctly; sync adding/removing a same-name unrelated method never fabricates missing-member calls.
+- Check these with `cd /tmp/codegraph-cjs-missing-fix-20261108 && CODEGRAPH_KERNEL=0 npx vitest run __tests__/js-default-binding-members.test.ts --maxWorkers=1`.
+- Expanded focused suite currently running: js-default-binding-members, commonjs-require-calls, commonjs-require-imports, commonjs-exports, require-default, import-default-as, namespace-object-resolution, import-object-member-namesake, sync-default-export-change, sync-import-member-retry, out-of-repo-import-shadow. Log /tmp/codegraph-cjs-fix-focused.log. Full normal suite/build pending.
+- Additional adversarial probes: class name matching alias, nested receiver paths, defaults with inherited/static/object APIs, lexical shadows and live sync. Each defect needs concrete input/actual wrong output; no style requests or hypothetical findings.
+
+## Round1 review outputs and remediation
+
+Both native lanes finished read-only. Each independently reported the same two P2 regressions at name-matcher.ts:24944; no other demonstrated findings.
+
+- R1 (broad+adversarial): `class Store { load() {} }; module.exports = new Store()` loses its legitimate instance call. Adversarial also demonstrated `export default new Store()` with Store not separately exported. Both base em40 produce Store::load; initial guard none. Remediation: resolve a whole explicit constructor expression to its actual module's local/imported class before the guard. Follow CommonJS forwarding; mask strings/comments/regexes, balance constructor arguments and type arguments, reject chained expressions, memoize with existing export index. Never re-enable generic method-name guessing for default bindings.
+- R2 (broad+adversarial): visible local `class named { static missing(){} }` shadows a default/namespace import; moving guard ahead of class strategy drops correct own-file call. Broad also tested enclosing-function shadow. Remediation: guard exempts a class declaration in the reference's file only when existing isLexicallyReachable proves it visible. Other-file alias-name class decoy remains blocked.
+- Review regression tests run BEFORE remediation: /tmp/codegraph-cjs-fix-review-baseline.log,24 cases19PASS5FAIL (original CommonJS positive +2 constructed-default variants +2 lexical class shadow variants). This pins both findings. Additional constructor argument/forwarder/text controls added; simple first remediation failed3nested/multiline/regex constructor positives in /tmp/codegraph-cjs-fix-constructors-baseline.log before argument-reader correction.
+- After remediation: /tmp/codegraph-cjs-fix-focused4.log,11 files99PASS1SKIP. Final focused run adds no-parentheses and spaced CommonJS constructor controls; /tmp/codegraph-cjs-fix-focused-final.log pending. Earlier temporary TS compile error from passing Language to CommentLang was corrected to JS-family typescript comment handling; not a passing run.
+
+The exact R1 reviewed name-matcher source is saved in .review/round1-name-matcher.ts and reconstructed hash verified against the recorded Git blob512a77a155299de8e6890447aa2d3aea7b81a1f9. Name-matcher remediation diff: `git diff --no-index /tmp/codegraph-cjs-missing-fix-20261108/.review/round1-name-matcher.ts /tmp/codegraph-cjs-missing-fix-20261108/src/resolution/name-matcher.ts`. Import-resolver and new tests are also remediation, diff from5e066489. No intermediate failing-source commit was made.
+
+Verify2 target is current tracked working tree relative5e066489, including CHANGELOG.md, src/resolution/name-matcher.ts, src/resolution/import-resolver.ts, __tests__/js-default-binding-members.test.ts. Check R1/R2 on all paths, all invariants, and defects introduced by remediation. Do not re-raise the pre-existing direct module.exports object-literal recovery limit without new evidence. Full build/suite pending. No merge/deployment occurred.
+
+## Verify2 result — NOT cleared; namespace-only redesign supersedes that target
+
+Both fresh native lanes finished; all findings P2. Broad reported first textual constructor overriding inactive/overwritten exports, valid inline/parenthesized constructors losing calls (R1 still open), and constructor-derived calls remaining stale after sync. Adversarial independently reported constructor lookup overriding typed/object/class lexical shadows (R2 still open), earlier constructor overriding a later stated default, and stale constructor-derived calls after sync. Exact evidence scripts/results under /tmp/cg-broad-verify2-* and /tmp/codegraph-cjs-verify2-*; complete reviewer messages returned to root. Existing explicit-default resolution was safer than the attempted new inference.
+
+Both lanes advised that a smaller boundary is coherent: extend module-namespace ownership only to a require/default whose resolved JS/TS target has no stated or uncertain value default; preserve all existing explicit/unknown default-value inference. Whole-file CommonJS forwarding can follow a namespace leaf; ambiguous assignments/default values must stay base behavior. No nonexistent redesigned code was reviewed or cleared by those design messages.
+
+Implemented redesign: REMOVED all added import-resolver source code; that file is byte-identical to base again. Removed unsafe constructor parsing/inference entirely. Name-matcher now uses existing context.resolveModuleFile, a per-context namespace-classification memo (cleared with existing memos), conservative source checks, pure whole-file forwarders only, bounded/cycle-safe traversal, language-qualified memo keys and JS/TS extensions only (no implicit component defaults). Any raw default keyword/export= or uncertain module use excludes the new guard; comments/text may conservatively prevent a classification. Move-before-class guard keeps lexical own-file class exemption. Changelog narrowed to modules without a value default.
+
+Scope/ruling: arbitrary stated/unknown exported default values and their guessed-member limitations remain pre-existing and explicitly OUTSIDE this fix. Do not claim every default-import missing-member case fixed. Removed new constructor-parser feature tests after deleting that feature, retaining baseline-supported CJS/ESM singleton, stated class/object/callable, lexical shadows and every original missing-module regression. Two dedicated singleton controls initially asserted disambiguation between two .load methods that base itself cannot provide; corrected their newly-authored fixture to a unique .load method, preserving the actual base invariant. Original broader CJS store-vs-decoy control remains unchanged. No baseline existing assertion was weakened.
+
+Full suite on superseded constructor candidate was STOPPED intentionally via guarded SIGINT to only this checkout's Vitest PID702277; final exec83750exit130. It did not pass and must not be reported as a test failure count/green gate. /tmp/codegraph-cjs-fix-full.log belongs that obsolete target. Latest redesigned focused13-file run /tmp/codegraph-cjs-fix-redesign-focused2.log RUNNING; verify actual exit/summary. Explicit build and redesigned full suite remain required.
+
+Third-review exception requested via async user question: skill says third round only if verify found something high severity; these were P2. Await user's explicit answer before launching further reviewers. Both agents' conceptual agreement is not final dual-review clearance. No source commit/push/fix PR/merge/deploy occurred. Original user's conditional merge/deploy request remains dependent on a reviewed green fix; original T0 stays stopped.
+
+## Final testing and local commit — authoritative current state
+
+Namespace redesign focused suite13files108PASS1SKIP, explicit npm run build exit0. Full normal suite exec60370EXIT0:872filesPASS19SKIP;10589testsPASS,2expectedFAIL,448SKIP,0unexpectedFAIL,799.56seconds. /tmp/codegraph-cjs-fix-redesign-full.log. Original portable6-case bug reproduction6/6PASS. Existing independent18-case records match em40baseline exactly. Namespace-to-value default change sync agrees with fresh index (initial no calls, synced/fresh Store::load); /tmp/codegraph-cjs-namespace-sync-probe.{cjs,jsonl}. Native kernel not validated.
+
+Personal repository/remote/identity, source checksums against preserved tested snapshot, staged3-file set and staged diff/check verified before local commit. LOCAL COMMIT d18e40970fc5fbf32f635f6d8d536d1bdb24dacc, tree2363dd0f8923ca59c28a3e45a477573e7364e7c2, branch fix/commonjs-missing-member. Tracked working tree clean; only private .review untracked. No push/fix PR/merge/deployment. Review target now `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5e0664891af0e87e6fd18bbfa16cab39237570f5..d18e40970fc5fbf32f635f6d8d536d1bdb24dacc -- CHANGELOG.md src/resolution/name-matcher.ts __tests__/js-default-binding-members.test.ts`.
+
+Third review still requires the pending user answer. User's later status question did NOT approve it. If authorized use two fresh native lanes with fork_turns=none and self-contained briefs/ledger to avoid carrying unrelated history. Preserve final tests; no redundant full rerun unless code or unresolved concerns change the tested tree. Verification and logs/source/patch are backed up under original QA .review/commonjs-fix-2026-11-08/verification.json and adjacent artifacts. Current canonical handoff handoff-codegraph-commonjs-tested-review-pending-2026-11-08.md supersedes running/constructor handoffs.
+
+## Third round authorized and running
+
+User explicitly answered yes to the third-review request, then asked why another round was needed. Explained earlier reviews covered replaced code while the tested final commit had not been independently reviewed. This question did not revoke approval. Started fresh read-only review_broad_commonjs_final3 and review_adversarial_commonjs_final3 with fork_turns=none, the exact base..d18e4097 target and this ledger, compact self-contained briefs and no full-suite rerun. Their results remain pending. Source unchanged; no push/merge/deployment.
+
+## Third round result — 2026-11-09 — NOT READY TO MERGE
+
+Exact target remains local d18e40970fc5fbf32f635f6d8d536d1bdb24dacc. Tracked tree clean, .review untracked; no source changes after passing tests. User resumed; collected broad final answer and adversarial confirmed messages. Broad lane completed normally. Adversarial lane delivered independently confirmed findings/evidence, then failed finalization with a usage-limit error (retry notice Nov9 1:10AM). Do NOT claim that lane completed normally, final clearance, or a green dual review. No push/PR/merge/deployment.
+
+### F3 — P2 — Namespace classification changes do not invalidate existing guessed calls (broad, independently confirmed adversarial)
+
+Broad location src/resolution/name-matcher.ts:25398. Start with `class Store { load() {} }; module.exports = new Store()` and an unchanged caller requiring that module and calling `.load()`. Replace the export with `exports.known = function known() {};`, retaining the class. After cg.sync(), the graph still calls Store::load; a fresh index correctly produces no call. The new module-text dependency needs to reopen existing member guesses when export shape changes.
+
+Broad reproduction /tmp/cg-broad-final3-sync-reverse.cjs; final evidence /tmp/cg-broad-final3-sync-reverse.log. Baseline comparison confirms its sync and fresh results both retained Store::load (/tmp/cg-broad-final3-sync-reverse-base.log). Adversarial independently reproduced direct and pure forwarder value->namespace->value->namespace retaining Store::load on every sync: /tmp/codegraph-cjs-final3-sync.cjs. Minimum correction recommendation: reopen default-import member guesses when imported module export text/shape changes, or record the imported source dependency on guesses allowed by a false namespace classification.
+
+### F4 — P2 — Explicitly exported callable aliases lose their calls (adversarial confirmed before usage limit)
+
+Location reported src/resolution/name-matcher.ts:25427. m.js `class Store { load() { return 42; } }\nexports.load = Store.prototype.load;`; use.js `const named=require('./m');\nexport function run(){named.load();}`. em40 calls m.js:Store::load; final emits no call. Same independently confirmed for `module.exports.load = Store.prototype.load`. Runtime named.load returns42 and Object.keys(module)=['load']. This is an explicitly exported callable, not the ruled-out direct object/default-value guessing limit. Prototype mutation variants group with the same uncertain-exports classification problem.
+
+Evidence /tmp/codegraph-cjs-final3-export-alias.cjs and /tmp/codegraph-cjs-final3-adversarial{,-base.jsonl,-final.jsonl}. Recommendation: preserve uncertain named-export RHS APIs or resolve the actual callable alias before blocking a fallback. Do not reopen arbitrary guesses for absent exports.
+
+### F5 — P2 — Out-of-scope local class bypasses namespace guard (adversarial confirmed before usage limit; original finding remains open on this path)
+
+Reported location src/resolution/name-matcher.ts:25397 (guard local-class exemption, around25396). Valid CJS: m.js `exports.known=function known(){};`; use.js lines1..8:
+`const named=require('./m');`
+`function run(){`
+`if(true){`
+`class named {static missing(){}}`
+`}`
+`named.missing();`
+`}`
+`module.exports=run;`
+Final returns use.js:run::named::missing atline6, though the class is block-local and imported module has no missing. Also reproduced for a class inside TS namespace Parent. These outputs pre-exist on base, but this is a still-open original false-positive path bypassing the new guard: existing isLexicallyReachable does not establish block visibility. Recommendation: require actual enclosing lexical block visibility before exempting a class. Preserve the genuine inner/enclosing-function shadow controls.
+
+## Merge decision / next boundary
+
+HOLD d18e4097. Passing build/full/focused tests remain factual, but F3/F4 are demonstrated regressions and F5 remains an intended missing-member path. No further agents, tests, source fixes or outward actions started after these reports. Do not rerun the full suite until a changed candidate requires it. User required confirmation before subsequent steps; present this concrete review result and seek the next bounded correction/verification decision. Fourth review is not preauthorized by approval of the third; native review gate may deny round4, so stop and ask rather than bypass. Agent quota exhaustion is additional reason not to relaunch a failed lane automatically.
+
+## Corrections authorized — 2026-11-09
+
+User: if findings are separate, report them; if related, fix them. All three are related: F3/F4 regressions introduced by this guard, F5 remaining original namespace missing-member path. No new issue filing or outside bug work needed. Authorized correcting all three in this branch; no extra reviewer lane or outward action started.
+
+Fail-before tests:11 new regressions fail and24 existing pass on d18e4097, /tmp/codegraph-cjs-fix-r3-regressions-before.log. New tests cover direct and forwarded value->namespace->value->namespace sync vs fresh; explicit dotted/bracket export aliases beside a still-absent-member decoy; alias removal by sync; out-of-scope sibling-block classes vs genuine same-block inner callers; TSnamespaceclassscope.
+
+Changes: F3 uses existing typeFrom dependency tracking on byName default-import member calls, includes each pure-forwarder file; activates the existing dependency-edge reopener for JS/TS paths while keeping failed-attribute retry Python-only. F4 namespace info tracks explicit assigned member names; new guard applies only to absent names. Escaping/computed/prototype-mutated exports remain uncertain and preserve existing behavior. F5 adds existing holderScopeAt block visibility to the class-shadow exemption, retaining function lexical visibility as well. Namespace memo stores traced files/member names; cache not poisoned by depth/cycle cutoffs.
+
+First focused verification AFTER all three corrections:3files49PASS0FAIL, /tmp/codegraph-cjs-fix-r3-regressions-after.log. Includes full35-case default-member suite and memo clearing/lifetime. No existing expected assertion weakened. Pending expanded JS/Python sync controls, normal full suite/build and original6-case repro. No new commit yet; earlier full pass applies d18e4097 only. Current changed files test + name-matcher + src/index.ts + src/extraction/index.ts. No unsafe constructor inference, import-resolver unchanged. Fourth review not yet requested/launched; gate and quota limits remain applicable.
+
+## Corrected commit verified by execution — independent review pending
+
+F3 class-name path also pinned: two new uppercase Store import-alias sync cases failed when only byName answers carried dependency metadata; /tmp/codegraph-cjs-fix-r3-upper-before.log. Final correction records imported-module inputs on name-matcher default-member answers from both class-name and method-name strategies. No change to confidence/byName selection. All original regression assertions retained.
+
+FINAL source tests:16files206PASS1SKIP, including37default-membercases, JS imports/sync andPythonattribute/memo controls. Log/tmp/codegraph-cjs-fix-r3-focused-final.log. Full normal suite exec42040EXIT0:872filesPASS19SKIP,10602testsPASS2expectedFAIL448SKIP0unexpectedFAIL,771.60seconds, /tmp/codegraph-cjs-fix-r3-full.log. Explicit npm run build exec37438EXIT0, /tmp/codegraph-cjs-fix-r3-build.log. Original portable6-case bug reproducer6/6PASS, /tmp/codegraph-cjs-corrected-final-sixcases.log. Node22.22.2/kernel0WASM; native not claimed. Source checksums prove no source changes between focused/full/build/testing and commit.
+
+LOCAL CORRECTION COMMIT559c76df6afd9e40f4d617ff77caa7db4ad03955, tre eb81d2063f4e787da5cfc7d28c619078fdc86e6b6, parentd18e40970fc5fbf32f635f6d8d536d1bdb24dacc. Personalrepository/remote/identity/stagedexact4-filediff andchecks verified. Trackedtreeclean, onlyprivate.reviewuntracked. No push/fixPR/merge/deploy or issuefiling. F3/F4/F5 status CORRECTED+executionPASS, awaiting independent verification; do not claim native review clearance.
+
+FOURTH ROUND ANSWER PENDING: async question asked permission and quoted ~/.codex/AGENTS.md: "where Claude's gate would ask the user at round 4, Codex denies, so stop and ask." User has not answered that new question; elapsed time is not approval. Do not launch fourth reviewers yet or modify gate state/control files. If approved use2freshread-onlynativefork_turns=none, same ledger, correction target `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff d18e40970fc5fbf32f635f6d8d536d1bdb24dacc..559c76df6afd9e40f4d617ff77caa7db4ad03955 -- src/resolution/name-matcher.ts src/index.ts src/extraction/index.ts __tests__/js-default-binding-members.test.ts`. Brief F3-F5, currentcorrections+invariants; no fullsuite rerun unless changes/failures justify it. Stop/ask if gate denies; last third adversarial lane failed finalization due usage cap, don't fabricateclearance.
+
+Durable original-workspace backup .review/commonjs-fix-2026-11-08/corrections-2026-11-09/:4sourcefiles, corrections.patch, checksums.json, before/after/focused/full/build/reprologs, verification.json identifyingfinalcommit/tree/outcomes, verified commonjs-fix.bundle containingbothlocalfixcommits with originalbase5e066489prerequisite. Commit recovery does not depend on /tmp survival. Current canonical handoff handoff-codegraph-commonjs-corrected-review-pending-2026-11-09.md supersedes corrections-running and review-blocked handoffs. OriginalT0unchanged/stopped; Tuesdayconditionalupstreamreport unchanged.
+
+## Fourth verification and modular correction — 2026-11-09
+
+User asked whether errors remain and approved proceeding, specifically requesting a smaller modular strategy for any remaining fix. Two fresh read-only minimal-context lanes review_broad_commonjs_verify4 and review_adversarial_commonjs_verify4 completed. BOTH independently CLEARED F3 direct/forwarded sync for ordinary and class-name aliases; F4 dotted/bracket callable/prototype aliases and removal sync; F5 block/namespace visibility and genuine inner shadows. Adversarial also verified Python failed-call retry/retyping and zero Python retry on JS-only edits. No full/build reruns or source edits by reviewers.
+
+F6 — P2 — src/resolution/name-matcher.ts:25444 raw exported-member discovery accepts comments, strings, regex literals, and unrelated object properties. With m.js exporting only known, adding `// exports.missing = fake;` or `function setup(holder) { holder.exports.missing = 42; }` makes named.missing falsely call decoy.js:Decoy::missing. Clean source has no call. Quoted/template/regex variants reproduce. This is newly added member inclusion, not the previous conservative default-text exclusion ruling. Exact broad evidence /tmp/cg-broad-verify4-classifier.{cjs,log}, /tmp/cg-broad-verify4-probes.cjs; adversarial /tmp/codegraph-cjs-verify4-extra.cjs. Both recommended one isolated token-aware collector validating executable assignments and bare exports/module.exports roots.
+
+Following user's authorized strategy: extracted readCommonJsExportMembers into new48-line(initial) src/resolution/commonjs-export-members.ts, with independent __tests__/commonjs-export-members.test.ts. Replaced matcher raw member/escape scanning with one helper call. Uses exact pinned production js-tokens9.0.1 (CommonJS, built-in types,16071unpackedbytes per officialnpmmetadata), no hand-written lexer or changedsharedstrip-comments scanner. Existingnamespace/default ownership tracing, sync/typeFrom and holderScopeAt behavior retained. Newpackage9chosen to keep CJS compatibility; upstream latestREADME refers to newerESMrequirebehavior. Source tokenizer was verified from officialrepo docs and installed package/types. No Node/packageversionbump.
+
+Fail-before graph regressions:8FAIL/37SKIP on559c76df, /tmp/codegraph-cjs-modular-before.log. New helper independently tests executable dot/bracket writes, template expressions/nesting, TSgenerics, JSXtext-vs-expressions, line/block comments, strings/templates/regex/control-regex, unrelated/Unicode/dollar roots, equality/typequeries, uncertain/prototype/computed APIs. Initial4files89PASS. Additional2positive runtime-API controls (literal eval export and require.cache default) exposed2FAIL before uncertainty handling; /tmp/codegraph-cjs-modular-uncertain-before.log. Added explicit uncertainty for literal eval code and Node module/cache APIs, preserving genuine dynamic exports while ordinary data remains opaque. All existing expected assertions retained.
+
+Latest modular focused gate18files260PASS1SKIP, /tmp/codegraph-cjs-modular-expanded-final.log; includes47default-member graph cases,38pure helper cases, priorJS/Python/sync/memo/lazy-engine controls. Source remains dirty relative559c76df in6files: newhelper/newunit test (intent-to-add makes visible in Gitdiff), existing integrationtest/matcher and package.json/package-lock. No new commit yet. No outwardactions. Full current modular suite/build still pending; parent10602PASS does not cover new modular code.
+
+User's conditional approval includes correcting any residual error with this smaller strategy and verifying it. Next fresh verification target is559c76df..working tree, sameledger and6paths; keep native round count honest (fifthverification), no target/state reset. Stop/ask if host gate denies; do not bypass. Review ONLY F6 closure and regressions of helper/adapter/dependency, plus bounded preservation checks. Source stable after260focusedPASS; no repeatedfull/build by reviewers. Prefer existingdist+scratch probes; underlyingthree corrections already independently cleared.
+
+
+## Fifth verification — modular source reader, 2026-11-09
+
+Fresh read-only lanes review_broad_commonjs_modular5 and review_adversarial_commonjs_modular5 both completed. Both cleared F6 phantom comments/strings/templates/regex and unrelated roots, plus preservation of real aliases, sync, scope and Python behavior. Production js-tokens9.0.1 packaging compatibility cleared. No source edits or redundant full-suite runs by reviewers.
+
+F7 — P2 — src/resolution/commonjs-export-members.ts:37 recognizes eval uncertainty only when a bare eval immediately receives a StringLiteral. Both reviewers reproduced template-literal eval dropping a real Store::load call. Adversarial additionally reproduced `(eval)('exports.load = Store.prototype.load;')`. Both runtime mutations return42; previous reader preserves Store::load, current reader emits no calls. Literal single-quoted bare eval control remains green. Evidence /tmp/codegraph-cjs-adversarial5-eval.{cjs,log}. Fix only the small helper: account for grouped bare eval callee and template literals, preserve class method named eval as non-call text. Add fail-before controls; do not alter name-matcher, sync or scope corrections for F7.
+
+Pre-F7 modular full normal suite EXIT0, 873 files PASS19SKIP, 10650 tests PASS2expectedFAIL448SKIP0unexpectedFAIL,780.27sec. /tmp/codegraph-cjs-modular-full.log. This run does not cover the upcoming F7 correction. Current source remains local and dirty relative559c76df. No push, source PR, merge, deployment or upstream report. Original T0 pilot remains stopped/uncommitted.
+
+
+F7 correction: literalEvalCall now unwraps paired bare-callee parentheses and grouped arguments, accepts StringLiteral/NoSubstitutionTemplate/TemplateHead. Does not execute eval or inspect data token contents; method declaration named eval remains ignored. Added4 pure-reader controls and2 graph positives. Before change:6FAIL85PASS (/tmp/codegraph-cjs-modular-eval-before.log); after:91PASS across2files (/tmp/codegraph-cjs-modular-eval-after.log). git diff --check PASS. No changes to the matcher adapter, sync or scope for F7. Full-suite PASS above predates this correction; normal final full suite and independent review of the F7 correction remain pending. Local changes uncommitted. Build result pending.
+
+Explicit final F7 npm run build EXIT0, /tmp/codegraph-cjs-modular-eval-build.log; viewer,29grammars,runtime and dist engine checks PASS. Final full suite and independent F7 verification still pending; do not conflate pre-F7 full pass with final-tree clearance. Checkpoint backup .review/commonjs-fix-2026-11-08/modular-eval-2026-11-09/ in original QA workspace contains6current sourcefiles, cumulative and modular patches, hashes, logs and this ledger. Source unchanged since91focusedPASS/build.
+
+
+## Sixth verification authorized and running — 2026-11-09
+
+User explicitly answered yes to final verification. Fresh read-only native lanes review_broad_commonjs_eval6 and review_adversarial_commonjs_eval6 launched against559c76df..workingtree six modular paths and same ledger. No gate reset/bypass or Claude-only skill claim. Both focus F7 closure and neighboring invariants; no full/build reruns by reviewers. Parent full normal CODEGRAPH_KERNEL=0 npm test -- --maxWorkers=4 runs session5033, /tmp/codegraph-cjs-eval6-full.log. Snapshot hashes /tmp/codegraph-cjs-eval6-frozen.json. No final results yet. Final explicit build before this full run passed; test setup refreshed engine assets itself. No source changes during review/tests, no outward actions. Personal origin/identity rechecked: inth3shadows/codegraph, Eric Minish / eric.minish@gmail.com. Current six modular files remain uncommitted.
+
+
+## Sixth verification result — 2026-11-09 — NOT READY TO MERGE
+
+Both fresh read-only lanes completed normally. Adversarial CLEARED F7: original3 runtime/graph forms plus11 additional runtime-backed graph controls preserve real exports and reject inert eval-looking data/method declarations. Evidence /tmp/codegraph-cjs-adversarial6-eval.{cjs,log}. Broad independently passed13 intended F7/nearby controls, but found F8 in the correction. No source edits/build/full reruns by reviewers. No final dual clearance.
+
+### F8 — P2 — literalEvalCall mistakes function-argument parentheses for grouped eval callees (broad)
+
+Reviewer location src/resolution/commonjs-export-members.ts:20, loop lines20-24. Exact input:
+
+```js
+exports.known = function known() {};
+function wrap(value) { return function ignore(code) {}; }
+wrap(eval)("ignored");
+```
+
+Runtime exports only known. Current reader returns uncertain:true, making named.missing() falsely resolve to decoy.js:Decoy::missing. Restoring only the pre-F7 literal-eval check in memory returns uncertain:false and no call. wrap((eval))(("ignored")) also reproduces. Evidence /tmp/cg-broad-verify6-callee-compare.log, adjacent .cjs; initial probe /tmp/cg-broad-verify6-callee-context.{cjs,log}. Broad passed all13 intended controls including grouped direct eval, templates, method named eval, real template-expression exports and callable aliases. Adversarial's bounded probes did not include this counterexample; its clearance does not override the demonstrated defect.
+
+Parent full suite intentionally stopped with SIGINT after confirmed F8; exact cwd/argv guarded signal to only isolated checkout main Vitest, tool session5033 EXIT130. /tmp/codegraph-cjs-eval6-full.log is PARTIAL, NOT a full pass/failure result. Avoid wasting a known-defective verification cycle. Prior91focusedPASS and explicit buildPASS remain true for this source, prior10650fullPASS predates F7 and cannot clear current tree. SHA256 snapshot recheck confirms all6 reviewed source paths unchanged during verification. No new source commit, push, fixPR, merge, deployment, version/tag/npm or upstream report.
+
+Stop this correction cycle and report F8. User yes authorized final verification, not another correction/review cycle or publishing. Need user decision before next step, as previously requested. Durable evidence in original QA .review/commonjs-fix-2026-11-08/final-verification-2026-11-09/. Previous modular-eval source/patch backup still matches frozen source. Keep original T0 stopped/uncommitted. Do not reset review count/gate or rewrite control files.
+
+
+## Seventh native dual review result — PR29 — 2026-11-09
+
+Both fresh read-only lanes completed normally: review_broad_pr29_round7 and review_adversarial_pr29_round7. Exact target remains5d384989957c91b482068b306535437915a0595b..87576a8d9ff0d8aba235db5535f5f4429f14b037. Source hashes verified unchanged, trackedtreeclean except private untracked.review. No source edits/build/fullsuite reruns/commits/pushes/GitHubcomments/merge/deploy. Both PRs remain draft. Current review DOES NOT CLEAR PR29 despite prior101focusedPASS/full10666PASS/buildPASS. Parent merges findings from actual final reports without re-verifying/re-reading diff.
+
+### F9 — P2 — Preserve grouped direct eval in control-statement bodies (BOTH)
+
+Broad location src/resolution/commonjs-export-members.ts:31: rejects any preceding ), including a completed if or for condition. Exact input `class Store { load() { return 42; } }
+if (true) (eval)('exports.load = Store.prototype.load;');`. Runtime exports load() returning42, but current discovery uncertain:false and indexing named.load() produces no call. Removing only new prefix guard in memory restores uncertain:true and m.js:Store::load. Nested grouped eval in unbraced single-iteration for body reproduces too. Broad evidence /tmp/cg-broad-pr29-control-context.{cjs,log}; exact command `node --experimental-wasm-exnref --experimental-wasm-stack-switching /tmp/cg-broad-pr29-control-context.cjs`.
+
+Adversarial independently confirms same location/trace; grouped-template if-body and for-body also reproduce. Evidence /tmp/codegraph-cjs-adversarial7-conditional-eval.{cjs,log}. De-duplicated as one P2 F9. This is a NEW regression introduced in PR29, not a pre-existing parent limitation.
+
+### F8 — P2 — PARTIALLY CORRECTED, remains for contextual-keyword wrapper names (adversarial)
+
+Exact reviewer location src/resolution/commonjs-export-members.ts:29 (whitelist:7). Valid CommonJS `function await(value){return function ignore(code){};} await(eval)("ignored");` passes eval without invoking it, but whitelist exemption produces uncertain:true and falsely resolves named.missing() to decoy.js:Decoy::missing. With exports.known=function known(){}, runtime exports only known; pre-F7 behavior restored in memory produces no call. yield reproduces too. Evidence /tmp/codegraph-cjs-adversarial7-contextual-wrapper.{cjs,log}. This is a RESIDUAL F8 variant, not a new unrelated parent re-audit. Do not label all F8 closed.
+
+### Confirmed preservation / rulings
+
+Both independently clear original F8 forms wrap(eval)("ignored") and wrap((eval))(("ignored")): runtime onlyknown, reader uncertain:false, no decoy call. Broad /tmp/cg-broad-pr29-f8-closure.{cjs,log}. Adversarial13runtime-backed graph controls pass (original2forms +11nearby controls), /tmp/codegraph-cjs-adversarial7-controls.log. True standalone grouped/template eval, return expressions, inert data/method declarations, call/member/optional/tag/condition-prefix negatives retain tested behavior. These controls do not answer F9 control-body context or F8 await/yield wrappers.
+
+### Next boundary
+
+Review-only user request is complete. STOP: no fixes, additional review loop, external review comment, markready, merge or deploy without user instruction. The per-step confirmation request remains in force. This is round7 overall; no gate/state reset. Repeated grouping-prefix patches now demonstrate syntax-context ambiguity: if user asks for remediation, choose an evidence-based smaller boundary/design instead of another unbounded keyword/punctuation whitelist. Preserve both concrete repros and all prior controls. Do not repeat fullsuite/build on unchanged source. Actual durable result/evidence/checksums saved in original QA .review/commonjs-fix-2026-11-08/pr29-review-round7-2026-11-09/.
+
+
+## AST redesign approved and started — 2026-11-09
+
+User explicitly approved AST redesign in PR29, said near usage max and asked for a resumable start, then said proceed. This revokes prior review-only stop for in-scope remediation; do not ask same approval on resume. Preserve per-step/user and actual gate boundaries for later merges/deployments. No grammar/runtime/dependency/database-schema changes, commits or pushes in this partial phase; PRs remain draft at prior heads.
+
+Newgraph regressions FIRST:3control-body direct-eval variants(if string/template, for nestedgroups) +await/yield CommonJS wrappers,5FAIL51SKIP on current87576a8d. /tmp/codegraph-cjs-ast-red.log, EXIT1. This intentionally RED gate remains unchanged because integration pending.
+
+New isolated src/extraction/commonjs-eval.ts reads existing SyntaxNode tree and checks actual call.function after unwrapping parenthesized_expression. Returns true for syntacticdirectevalcall(anyargument), false for provenabsence, null for parseerrors with no foundcall. New __tests__/commonjs-eval.test.ts loads existingJS/TS/TSXgrammars:33PASS, /tmp/codegraph-cjs-ast-helper.log EXIT0. Controls cover reports, grouped/interpolated eval, return, generatorfunctions/methods, nestednongenerator scope, eval inside yieldwrapper argument, inert data/methods/membercalls, JSX and malformedsource. Helper not wired to classifier/extraction yet. Existing lexical reader/EXPRESSION_PREFIX_WORDS unchanged for now. Do not claim F8/F9 closed, new full/buildpass or finalreview.
+
+IMPORTANT new evidence: existingJSgrammar correctly models control-body eval and awaitwrapper but parses legal CommonJS yield(eval)(code) as yield_expression whose operand is a call on(eval), no parseerrors. ASTscope must distinguish nongeneratorwrapper from generator yield. Helper handles direct yieldoperand only via nearestfunction/generator/methodscope; nested true eval in yield(eval(code)) remains detected. Shapeprobe /tmp/codegraph-cjs-ast-shape-probe.{cjs,log}. Extractionreferenceprobe /tmp/codegraph-cjs-eval-reference-probe.{cjs,log} shows currentextractor emits callref eval for genuinecall AND synthetic yieldwrappercase. Consequently raw existing unresolved eval refs alone are insufficient. User was explicitly told this grammar limitation, not falsely assured all cases are parser-perfect. No grammarfiles changed.
+
+Next integrate factualcallresult through existingextraction to resolver. Node has NO metadata field (onlyedges do); do not invent Node.metadata, abuse signature/selfedges/candidates, or introduce schema migration casually. ExtractionResult can carry optionalfact through workerclone; need native/deferred bypass parity. Main bulk parse pools only load grammars in workers; resolver cannot assume synchronous getParser is ready in main. Suggested project_metadata perfile/sourcehash transport or another small explicit extractioncontext capability; persist/refresh under same successfulstore lifecycle, cover storeworker and sync. Decide carefully before editing infrastructure. Resume must preserve all existing tests and5newred cases; unknown/missing/error facts must not masquerade as provenabsence. Keep existing export-member tokenizer and previous sync/scope/alias fixes intact; remove prefixheuristics only onceASTfacts actuallysupplied.
+
+Saved current3sourcefiles, patchrelative87576a8d, hashes, red/green/probe logs under original QA .review/commonjs-fix-2026-11-08/ast-redesign-started-2026-11-09/. No tests/build/reviewers running at checkpoint. Newfiles intent-to-add only so diffincludes them, not readyforcommit. No fresh dualreviewagents this phase. Overall reviewcount7; do not reset gate/controlstate. Resume directly integration and targeted tests; fullsuite/build only after stablefix, fresh focuseddual review as authorized/actualgatepermits, no repetitivewholeprojectwork. OriginalT0stillstopped/uncommitted; liveem40 unchanged; no merges/deploy/upstream writes.
+
+
+## Eighth native review COMPLETED — AST correction NOT CLEARED
+
+Both fresh read-only reviewers completed normally on frozen15-file87576a8d..workingtree correction. Both confirm no source edits/build/full reruns/control changes; source hashes unchanged. No final normalbuild/fullsuite run or commit/push. PublishedPR28/29 remain drafts at5d384989/87576a8d. Prior166focusedPASS1SKIP is true and covers original5reportedgraphcases, but does not clear new findings. Nativebinary absent, no nativeexecutionclaim. Parent uses actual reports, no independent duplicate repro/diffread.
+
+### F10 — P2 — Optional contextual-keyword wrappers regress (adversarial)
+
+Exact reviewer location src/extraction/commonjs-eval.ts:37. Valid CommonJS:
+
+```js
+exports.known = function known() {};
+function yield(value) {
+  return function ignore(code) {};
+}
+yield?.(eval)("ignored");
+```
+
+Runtime exports only known; eval is never invoked. Existing grammar reports parse error, helper returns null, reader marks exports uncertain, and named.missing() falsely calls unrelated decoy.js:Decoy::missing. Actual current correction calls:[decoy.js:Decoy::missing]; base87576a8dreader restored in memory calls:[], uncertain:false. Evidence /tmp/cg-a8-yield-optional.{cjs,log}, /tmp/cg-a8-yield-optional-base.{cjs,log}, /tmp/cg-a8-probe.cjs. New F8-adjacent regression introduced by AST correction. Unknown fact correctly avoids false absence proof but must not license false call targets; current fallback still does.
+
+### F11 — P2 — Computed method names use enclosing scope (broad)
+
+Exact reviewer location src/extraction/commonjs-eval.ts:51. Treats a computed method name as belonging to that method's function scope. Computed names execute in enclosing scope. Confirmed both directions:
+
+1. `class Store { load(){return 42;} } function* setup(){ const obj = { [yield (eval)('exports.load = Store.prototype.load;')]() {} }; } setup().next();` Runtime exports load()->42, currentfactfalse/uncertainfalse, named.load() graphcalls[]. Ordinary computedmethodkey inside outergenerator suppressesgenuineeval.
+2. `exports.known=function known(){}; function yield(value){return function ignore(code){return 'x';}} const obj={ *[yield(eval)("ignored")](){} };` Runtime keysonlyknown, currentfacttrue/uncertaintrue, named.missing() falselycallsDecoy::missing. Generator methodkeyevaluatesoutsidegeneratorbody, so yieldiswrapperhere.
+
+One rootcause/twoexecutiontraces, evidence /tmp/cg-broad-pr29-ast8-computed-scope.{cjs,log}, executed againstcurrentdist with CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2. All15frozenhashesmatch.
+
+### Stop boundary and saved state
+
+Approved redesign progressed to166focusedPASS + real-worker/store/sync/factlifecycle integration, then focusedverifyfoundthese2P2. STOP before anothercorrectioncycle per dual-reviewworkflow/userper-stepconfirmation. Don't spendfullsuiteonknowndefectivecode orpushasready. Usermustdecidenextstep; noautomaticnewreview/fix/merge/deploy. Overallcount8, noreset. Nextremediationifapproved: computedmethodscope must excludecomputedkeys fromnewmethodscope; parseerrorunknown mustnotenableinventedfallbackcalls (requires explicitresolutionpolicy, not anotherkeyword/punctuationguess). Preserve all originalregressions and33ASTcontrols, truealiases/sync/scope/Pythonbehavior. No grammarfiles/schema/deps changed; source remains15dirtypaths, notcommitted. Durablebackup includes allsources/patch/logs andnewreviewevidence, verificationresult/checksums.
+
+
+## F10/F11 corrections approved and execution-verified — independent verification pending
+
+User explicitly answered yes to correcting the two eighth-review findings. Current HEAD87576a8d and15dirtysourcepaths retained; no newcommit/push/merge/deploy/grammar/schema/dependencychanges.
+
+Fail-beforetests:2ASTcomputed-key cases,3graphfindingcases,positivealiascontrol andunknownparse syncstep. Actual2files6FAIL90PASS beforefix, /tmp/codegraph-cjs-ast-f10-f11-before.log EXIT1. Positive explicitcallablealias underunknownparsealreadyPASS beforefix, mustkeep.
+
+F11fix: method_definition suppliesfunctionscope onlywhen calllieswithin ASTbodyorparametersregions. Computednames/decorators useenclosingscope; no newkeyword/punctuation guesses. Bothcomputedkey directionsfixed. F10fix: tokenizer resultrecords evalUnknown separatelyfromuncertain/namespace. Moduleinfo propagatesunknownflag, includingexistingforwarderspread. Themethod-nameguessgate stopsunprovenmatchesforunknown-evalexportswithoutclaimingnamespace/memberabsence; explicitwrittenmemberaliasesremainallowed, andearlierprovenreceiver/typepathsremainunchanged. UnknownASTfactstillnull, no falseparse-success/intrinsicproof. Existingmembertokenizer andfacts/hash/storelifecycleremainunchanged.
+
+Expanded8files172PASS1SKIP EXIT0, /tmp/codegraph-cjs-ast-f10-f11-after.log, CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2. Coversallprevious166checks plusnewcomputed-keyAST/graphcases,optionalcontextualwrapper,realexplicitcallablealiasunderunknownparse,andfreshindex-v-syncincludingknownactualeval->unknownwrapper->actualeval transitions. One skip is nativekerneltransport; nativebinarynotstaged,no nativeexecutionclaim. A matchercommentclarifyingunproven-callpolicyupdatedaftertest; no behaviorchangedafterthispassingrun. gitdiff--checkPASS. No explicitnormalbuild/fullsuite oncurrentcorrection; old10666fullPASSbelongs875only.
+
+Currentcorrectionvsround8snapshot changes5files: ASThelper,exportreader,matcher,ASTtest,graphintegrationtest. Durablebackup originalQA .review/commonjs-fix-2026-11-08/ast-f10-f11-corrected-2026-11-09/ includesall15sourcefiles,currentSHA256,cumulativepatchrelative875,small5filedeltafromround8,fail-before/passafterlogs,verificationmetadata. F10/F11 statusCORRECTED+focusedPASS, NOTindependentlycleared. Overallreviewcount8unchanged,noround9agentslaunched. Userper-stepconfirmationrequiresdecisionbeforefreshfocusedverify; don'tspendnewfull/reviewcycleunasked. No sourcecommit/pushyet; PR28/29remainDRAFT/unmerged. Ifuserapprovesnextreview: exactGitdiff875..workingtree +round8delta/sameledger, freshread-onlynativebroad/adversarial, boundedprobesonly,norepeatfull/build. Respectactualgate/noreset. Runfinalnormalbuild/fullonceonlyafterreviewstable. PreserveT0stopped/uncommitted; liveem40unchanged; noofficialupstreamwrite.
+
+
+## Ninth native focused verification completed — F10/F11 cleared, F12 remains
+
+User explicitly authorized thisverificationround. Both fresh read-only lanes review_broad_pr29_f10_f11_9 and review_adversarial_pr29_f10_f11_9 COMPLETED normally on same87576a8d..workingtree15path target and sameledger. Source hashes stillmatch approvedcorrectedsnapshot; no sourceedits/rebuild/fullsuite/controlchanges/networkwritesbyreviewers. No sourcecommit/push/merge/deploy. BothpublishedPRsremaindraftunchanged.
+
+F10/F11 originals independently CLEARED by BOTH: optionalcontextualwrapper nofalsecall; computedkeygenuineevalinsideoutergenerator keepsStore::load; generatormethodkeynongeneratorwrapper nofalsecall. Broad11runtime-backedprobesPASS includingclass/nestedcomputedkeys,generator/nongeneratorbodies,explicitcallablealiasunderunknownfactandgenuineevalcontrols. Evidence /tmp/cg-broad-pr29-ast9-verify.{cjs,log}. Adversarial also confirmsnestednongenerator/gettercomputedkeycontrols. ThesecontrolsdoNOTclearrootwhole-valueexportsbelow.
+
+### F12 — P2 — Unknown eval facts suppress genuine root exports (adversarial)
+
+Exact reviewer location src/resolution/name-matcher.ts:25403. Valid m.js:
+
+```js
+class Store { load() { return 42; } }
+module.exports = { load: Store.prototype.load };
+function yield(v) { return function ignored() {}; }
+yield?.(eval)("ignored");
+```
+
+Caller const named=require('./m'); function run(){named.load();}. Runtime named.load() returns42; currentindexcalls:[]. Readerrecordsnomembersfortherootobjectassignment; newevalUnknowngatedropsthegenuinecallablealias. module.exports=new Store() reproduces too. RemovingONLYnewevalUnknownconditioninmemoryrestoresm.js:Store::loadforbothidenticalinputs. Directexports.load=Store.prototype.loadcontrolstillpasses. ThisisNEWregressionintroducedbyF10correction. Evidence /tmp/cg-a9-root-export-regression.cjs, /tmp/cg-a9-root-export-current.log, /tmp/cg-a9-root-export-oldgate.log. Broadclearedlimitedcontrolsbutdidnotprobeequivalentrootexports; no contradictoryexecutionresult.
+
+STOP/reportmergedfindingonly; useryesauthorizedfocuseddualverify, notanotherunaskedcorrectioncycle. OriginalF10/F11closedatthissnapshot; F12OPEN. No finalreviewclearanceorreadyformergeclaim. No explicitnormalbuild/fullsuiteoncurrentdirtyASTcorrection;172focusedPASS1SKIPremainsactualbutmissesF12. Old10666fullPASSbelongs875only. No test/build/reviewerprocessesrunning. Needuserdecisionbeforefix; preserveactualmodule-valueexportswhileblockingunprovedunknown-evalguesses, notanotherpunctuation/keywordheuristic. Overallcount9honest,noreset/gatebypass. Durableevidence/ledger/resultsavedunderoriginalQA .review/commonjs-fix-2026-11-08/pr29-review9-2026-11-09/; current15sourcefilespatchesremainin adjacentast-f10-f11-correctedbackup. T0/liveem40unchanged, noofficialupstreamwrite.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/codegraph-commonjs-fix-2026-11-08.md b/docs/handoffs/pr29-2026-11-10/plans/codegraph-commonjs-fix-2026-11-08.md
new file mode 100644
index 0000000000..b3ba02e602
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/codegraph-commonjs-fix-2026-11-08.md
@@ -0,0 +1,13 @@
+# CommonJS missing-member fix and dual review
+
+User authorized implementing the remaining CommonJS method-fallback defect and dual review after no exact upstream report was found. Earlier merge/deploy request was conditional on a reviewed fix; complete and report the reviewed change before treating any deployment as ready. Official upstream reporting remains reserved for Tuesday after verification. Personal fork only; no public upstream writes.
+
+Isolated repository: /tmp/codegraph-cjs-missing-fix-20261108, branch fix/commonjs-missing-member, base 5e0664891af0e87e6fd18bbfa16cab39237570f5. Fresh clone from inth3shadows/codegraph, fresh locked dependencies. Original QA T0 work stays stopped/uncommitted and untouched.
+
+1. Add real SQLite regression cases for missing CommonJS/default members beside an unimported method, including receiver-name class collisions, forwarding, real exports, stated class/object/instance/callable defaults, lexical shadows and sync. Run before fix and retain actual outcomes.
+2. Make the smallest resolver guard change after evidence-backed member resolution and before global method-name matching. Preserve import mapping semantics and actual default APIs. Add a user-facing changelog entry.
+3. Run focused regression/invariant suites and normal build/full test suite with at most four workers. Installed Vitest4.1.11 does not accept the historical --minWorkers flag; use --maxWorkers=4. Use kernel0/WASM, matching deployed installation; document native-only skips.
+4. Create private .review ledger with findings, invariants, commands and fix map. Launch fresh read-only review_broad_* and review_adversarial_* native agents on the exact same Git target and ledger; adversarial reviewer executes probes. Follow review gate. Do not claim Claude-only code-review skill ran. Resolve review findings within authorized fix scope, and launch fresh verification reviewers when remediation creates another target.
+5. Save results and checkpoint in ~/.codex/plans. Before any commit/push, verify personal identity, remote, staged diff and tests. No unrelated resolver changes, no external-import issue26 fix, no T0 work. Stop on a missing authorization or mandatory review gate; ask before expanding scope.
+
+Tracking issue: https://github.com/inth3shadows/codegraph/issues/27. Related upstream2952 closed and3162 merged addressed the earlier first-export variant. Evidence at original QA .review/commonjs-missing-export-2026-11-08/.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/codegraph-commonjs-review-corrections-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/codegraph-commonjs-review-corrections-2026-11-09.md
new file mode 100644
index 0000000000..4f0ebeb4e5
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/codegraph-commonjs-review-corrections-2026-11-09.md
@@ -0,0 +1,10 @@
+# CommonJS review corrections
+
+User authorized fixing related findings F3,F4,F5. Work only in isolated /tmp/codegraph-cjs-missing-fix-20261108, branch fix/commonjs-missing-member, parent localcommit d18e40970fc5fbf32f635f6d8d536d1bdb24dacc. No issue filing, T0 changes, upstream submission, push, merge or deployment in this correction step.
+
+1. Pin all3findings with execution regressions. Done:11newFAIL/24existingPASS on parent, then35-case suite and2memo suites49PASS after correction.
+2. Reuse typeFrom dependency reopening for JS/TS default-member guesses and pure forwarders, preserving Python retry behavior; retain explicit export aliases and conservative unknown APIs; require existing lexical block visibility for class shadows.
+3. Run expanded JS/Python sync-focused checks, original6-case reproducer, normal full suite and build. Do not repeat full checks without source changes/failures/remaining concerns.
+4. Save tested correction commit, review ledger and durable source/evidence backup. Review remains uncleared until actual fresh verification. No fourth agents launched automatically: gate4requiresstop/ask if denied, third-review permission was not fourth permission; last adversarial lane hit usage cap. Respect user's confirmation boundary before next phase.
+
+Authoritative ledger isolatedrepo/.review/commonjs-missing-member.md; original backups under original QA .review/commonjs-fix-2026-11-08/. Personal account inth3shadows, EricMinish/eric.minish@gmail.com. Preserve liveem40, shared main, all control/deploy worktrees. Original T0 stays stopped/uncommitted. Official upstream reporting remains conditional TuesdayNov10.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/compare-astra-sol-pr29-export-contract-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/compare-astra-sol-pr29-export-contract-2026-11-09.md
new file mode 100644
index 0000000000..b1d900c1de
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/compare-astra-sol-pr29-export-contract-2026-11-09.md
@@ -0,0 +1,35 @@
+# Astra vs Sol — independent PR29 design comparison
+
+User asked "astra vs sol come up with diff plan?" Two fresh independent read-only planning lanes ran: gpt-6-astra and gpt-6.1-sol. Both completed and saved plans. No source edits, probes, build, new review, commit or publication. All22source hashes match round11 frozen snapshot. This comparison is about these concrete plans, not general model capability.
+
+## Shared conclusion
+
+Both choose a bounded binding-owned value/relationship graph, keeping the established TypeScript binder and working lexical eval adapter. Both reject two local patches to the current declaration-array contract. Root error: declaration identity, exported value identity and callable implementation identity are conflated. Compiler type shape is not a ledger of explicit property writes.
+
+F14 needs object/class/function identity plus property slots: api.load=Store.prototype.load;module.exports=api must preserve that slot and target. F15 needs callability as independent evidence: const value=42;exports.load=value is a valid data export but no call target. let value;value=real;exports.load=value must resolve the reachable callable or remain unknown, never call the storage variable itself.
+
+## Differences of emphasis
+
+| Plan | Most useful detail |
+|---|---|
+| Astra | Explicit value categories and closed-object completeness; branch alternatives must agree before claiming one callable; strong stop/pivot boundary and safe reduced-scope fallback. |
+| Sol | Clear consumer result separating value/reference selector, callable selector, completeness, and dependencies; bounded def-use transfers, overwrites and aliases. |
+
+This is convergence on one architecture, not competing fundamentally different plans.
+
+## Recommended combined plan
+
+Use Sol's consumer contract with Astra's uncertainty/stop rules. First test only the missing value/property/callability contract in isolation, reusing the existing binder and recorded fixtures rather than restarting the full prototype. Mandatory rows: F10–F15, local object/class/function writes, primitive data/reference-vs-call pairs, callable reassignment, alias identity/overwrites/post-export mutation, ambiguous branches/escapes, forwarder dependencies, and fresh-v-sync. No production integration until one representation satisfies those rows without fixture-specific exceptions.
+
+Keep TypeScript lazy and preserve lexical literal-eval/generator relationships as static potential relationships. Unknown supplies no global guesses and no stale callable. Constructors and ordinary callable functions are separate. Avoid general JS execution. If the bounded model needs arbitrary calls/heap simulation or fails representative performance checks, stop and propose a narrowly scoped rollback/reduced coverage while preserving all existing files.
+
+Likely production scope after validation: commonjs-export-evidence.ts, import-resolver.ts, name-matcher.ts and focused tests; no extraction/schema rewrite. Real representative performance remains unmeasured (toy timing is not sufficient). Neither plan is an implementation approval.
+
+## Current state and next boundary
+
+Round11 completed with new P2 F14/F15 open. Original F10–F13 independently clear. Prior631focusedPASS1nativeSKIP does not clear new findings. Source remains22dirtypaths at87576a8d. No further code/review/fullsuite/publication authorized by this planning request. User decides whether to pursue the combined contract experiment.
+
+Plans:
+- /home/ericm/.codex/plans/plan-astra-pr29-export-contract-2026-11-09.md
+- /home/ericm/.codex/plans/plan-sol-pr29-export-contract-2026-11-09.md
+Review checkpoint: /home/ericm/.codex/plans/handoff-codegraph-pr29-review11-two-findings-2026-11-09.md
diff --git a/docs/handoffs/pr29-2026-11-10/plans/compare-astra-sol-pr29-progress-2026-11-09.json b/docs/handoffs/pr29-2026-11-10/plans/compare-astra-sol-pr29-progress-2026-11-09.json
new file mode 100644
index 0000000000..9ec7e47c92
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/compare-astra-sol-pr29-progress-2026-11-09.json
@@ -0,0 +1,27 @@
+{
+  "status": "completed",
+  "user_request": "astra vs sol come up with diff plan?",
+  "scope": "independent read-only design proposals, no implementation",
+  "review_completed": 11,
+  "open_findings": [
+    "F14",
+    "F15"
+  ],
+  "lanes": [
+    {
+      "agent": "plan_astra_pr29",
+      "model": "gpt-6-astra",
+      "plan": "/home/ericm/.codex/plans/plan-astra-pr29-export-contract-2026-11-09.md"
+    },
+    {
+      "agent": "plan_sol_pr29",
+      "model": "gpt-6.1-sol",
+      "plan": "/home/ericm/.codex/plans/plan-sol-pr29-export-contract-2026-11-09.md"
+    }
+  ],
+  "source_frozen": true,
+  "source_hashes_match": true,
+  "conclusion": "Both converge on binding-owned values/property slots and independent callable identity; recommend Sol contract + Astra stop/uncertainty rules",
+  "comparison": "/home/ericm/.codex/plans/compare-astra-sol-pr29-export-contract-2026-11-09.md",
+  "next": "User decision; no implementation approved"
+}
diff --git a/docs/handoffs/pr29-2026-11-10/plans/explore-pr29-export-evidence-boundary-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/explore-pr29-export-evidence-boundary-2026-11-09.md
new file mode 100644
index 0000000000..fafd9045c1
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/explore-pr29-export-evidence-boundary-2026-11-09.md
@@ -0,0 +1,21 @@
+# Exploration: PR29 export evidence boundary
+
+Recommendation: keep PR29, split into two reviewable commits rather than adding a third stacked PR. Exploration only; no implementation authorized by /explore and no code changes made.
+
+Root cause: reader members records explicit property writes, not a complete inventory of the value assigned by module.exports. The evalUnknown guard treats an empty partial set as grounds to reject root-object/instance calls. Both reported inputs return42 at runtime; current policy drops them.
+
+Proposed contract: represent export form (namespace writes / stated value / opaque) separately from eval certainty (present / absent / unknown). Preserve existing resolution for stated exported values and explicit aliases. Suppress unrelated guesses for namespace members unsupported by available evidence. Unknown eval must not override a stated exported value or pretend the member is absent. Keep existing handling of confirmed eval exports.
+
+Commit boundaries:
+1. AST fact production, transport and source-hash storage, with its tests.
+2. Export classification and resolver policy, with the complete behavior matrix.
+
+Narrow remaining fix scope: src/resolution/commonjs-export-members.ts, src/resolution/name-matcher.ts, and their two test files. Existing extraction/storage/grammar work need not change for F12.
+
+Effort: M by skill file-count rubric (2source+2test files); no new dependencies or schema changes. Integration: export summary -> module classification -> method-guess gate, including existing forwarder propagation and sync invalidation.
+
+Technical checks before coding: establish how root assignments/mixed writes/bracket syntax map to export form; confirm forwarding and sync carry classification consistently. No external account/production/deploy blocker.
+
+Validation: build a matrix of namespace writes, direct aliases, root objects and instances against eval absent/present/unknown, plus forwarding and fresh-v-sync. Include F12's two runtime-backed cases and retain F10/F11 controls. A blanket unknown block loses real calls; a blanket bypass restores false captures. Review the policy contract before another full-suite run.
+
+Current state: checkout/tmp/codegraph-cjs-missing-fix-20261108 HEAD87576a8d,15dirtypaths. PR28/29 remain drafts; ASTrevision not pushed. Latest factual evidence and recovery: handoff-codegraph-pr29-review9-root-export-regression-2026-11-09.md. F10/F11 independentlyclear; F12P2open.172focusedPASS1SKIP predates F12testcoverage; no finalfull/build on dirtyASTrevision. Overallreviewcount9,noreset. Await user decision before implementation; preserve all dirty work/T0/deploy/control files.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/explore-pr29-positive-export-evidence-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/explore-pr29-positive-export-evidence-2026-11-09.md
new file mode 100644
index 0000000000..9137ecadcc
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/explore-pr29-positive-export-evidence-2026-11-09.md
@@ -0,0 +1,25 @@
+# PR29 rethink — analysis only
+
+Recommendation: investigate first. Three readers approximate exports independently; a file-level flag permits global name guesses. Existing scope helpers use ranges/regex, not a complete binder.
+
+Fixed: preserve checkout/repros; deterministic local analysis; no production-code execution. Prototype preference: no grammar/dependency/schema changes. Four-file scope is negotiable.
+
+Subjective feasibility/novelty/product (1–5):
+| Approach | F | N | Product |
+|---|---:|---:|---:|
+| Token exceptions | 5 | 1 | 5 |
+| Scope-aware AST facts | 4 | 3 | 12 |
+| Candidate proof paths | 4 | 3 | 12 |
+| Compiler/scope backend | 3 | 2 | 6 |
+| Abstract interpreter | 2 | 4 | 8 |
+| Defer dynamic coverage | 5 | 1 | 5 |
+
+Prefer AST facts plus candidate proof paths: import → exported value/member → declaration/type → target. Resolve wrapper binding identity and normalize syntax structurally. Keep evidence, completeness and eval uncertainty separate. Unknown supplies no target identity.
+
+Prototype first; pivot to established scope machinery if this requires another ad hoc binder. Abstract interpretation adds order/alias complexity; reduced coverage remains a fallback. Decide literal-eval support explicitly: existing true-eval guesses do not establish export relationships.
+
+Beyond example tests: generated equivalent syntax, shadow/decoy insertion, controlled runtime witnesses, minimized counterexamples, sync=fresh. Persist facts with source hash and analyzer version.
+
+Effort L: extraction, fact transport/storage, imports and matcher. Existing transport helps. Blockers: binding completeness, eval compatibility, mutation/conditional policy, performance. No implementation approved. All 15 source hashes unchanged.
+
+References: [Node](https://nodejs.org/docs/latest-v22.x/api/modules.html#the-module-wrapper), [ESLint scopes](https://eslint.org/docs/latest/extend/scope-manager-interface), [tracking](https://eslint-community.github.io/eslint-utils/api/scope-utils.html), [compiler](https://github.com/microsoft/TypeScript/wiki/Using-the-Compiler-API), [generated tests](https://fast-check.dev/docs/advanced/model-based-testing/).
diff --git a/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-corrected-review-pending-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-corrected-review-pending-2026-11-09.md
new file mode 100644
index 0000000000..a4ad4f448c
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-corrected-review-pending-2026-11-09.md
@@ -0,0 +1,19 @@
+# CommonJS corrections tested and committed; fourth review awaits approval
+
+Authoritative2026-11-09. User: if separate findings report, if related fix. AllF3/F4/F5related to currentCommonJSfix; corrected, no separateissuesfiled. No outwardactions.
+
+LOCAL HEAD559c76df6afd9e40f4d617ff77caa7db4ad03955, treeb81d2063f4e787da5cfc7d28c619078fdc86e6b6, parentd18e40970fc5fbf32f635f6d8d536d1bdb24dacc, originalbase5e0664891af0e87e6fd18bbfa16cab39237570f5. Repo/tmp/codegraph-cjs-missing-fix-20261108, branchfix/commonjs-missing-member. Personalorigin inth3shadows/codegraph, EricMinish/eric.minish@gmail.com. Identity/remote/stagedexact4files/diff/checks/tests checked beforecommit. Trackedclean, private.reviewuntracked. No push, fixPR, merge, deployment, tag/npm or officialupstreamwrite. em40remainslive. T0originalQAwork stays stopped/uncommitted/untouched.
+
+Corrections: F3 dependency metadata typeFrom records default-import member name-matcher answers (both class-name and method-name matching), includes pureforwarder files. Existing type-dependent edge reopening now handles JS/TS sourcechanges, while Python failed-attribute retry remains Python-only. F4 namespaceinfo tracks explicit dotted/literal-bracket exportnames; absent-memberguard preserves actual callablealiases and treats escaping/computed/prototype-mutated APIs as uncertain. F5 class-shadow exemption also uses existing holderScopeAt block visibility, so inaccessible sibling-block/TSnamespace classes cannot bypass guard; real visibleclasses retained. No new constructor/default inference; import-resolver unchanged. Bareexternalimport issue26 remainsunfixed/outside scope.
+
+Tests: initial11newFAIL/24existingPASS onparent, then49focusedPASS; added2uppercasealiasclass-strategy cases RED under byName-onlytracking, nowfixedtoo. FINAL16files206PASS1SKIP (37default-membercases), /tmp/codegraph-cjs-fix-r3-focused-final.log. Full normal suite10602PASS2expectedFAIL448SKIP0unexpectedFAIL,872filesPASS19SKIP,771.60sec, /tmp/codegraph-cjs-fix-r3-full.log, exec42040EXIT0. Explicit npm run buildPASS /tmp/codegraph-cjs-fix-r3-build.log, exec37438EXIT0. Original6-caseportablebugrepro6/6PASS /tmp/codegraph-cjs-corrected-final-sixcases.log, exec98603EXIT0. Alltestsranonidenticalsourcehasheslatercommitted. Node22.22.2/kernel0WASM, no native claims. No running tests/builds or reviewer agents for this correctionphase.
+
+REVIEW STILL PENDING. Three earlier rounds reviewed oldercode. Third broad lane confirmedF3; adversarial delivered confirmedF3/F4/F5beforefailingfinalizationwithusagecap. Thesefindingsnowcorrected+executiontested, NOTindependentlycleared. Primaryledger/tmp/codegraph-cjs-missing-fix-20261108/.review/commonjs-missing-member.md contains exactclaims/repros/rulings/invariants/historyandlatestfixmap.
+
+PENDINGUSERANSWER to async question authorizing FOURTH two-native-reviewer round. Exactquote readfrom ~/.codex/AGENTS.md: "where Claude's gate would ask the user at round 4, Codex denies, so stop and ask." Userfixauthorizationpredates thissubsequentreviewquestion and is not its answer. Do notlaunchfourthbeforeactualyes; don'tbypassgate/modifycontrolfiles. Ifyes,2freshREADONLYnativeagents review_broad_* andreview_adversarial_ withfork_turns=none, compactselfcontainedbriefs, sameledger and exactcorrectiontarget:
+`git -C /tmp/codegraph-cjs-missing-fix-20261108 diff d18e40970fc5fbf32f635f6d8d536d1bdb24dacc..559c76df6afd9e40f4d617ff77caa7db4ad03955 -- src/resolution/name-matcher.ts src/index.ts src/extraction/index.ts __tests__/js-default-binding-members.test.ts`
+VerifyonlyF3-F5closure/invariants/newfixdefectsbyexecutingfocusedprobes; no fullsuite rerun forunchangedsource. Sourcehasbeenfrozenandtested. Respectquota/actualgatedenial; don'tclaimClaude-onlyskillran. Holdmerge/deployuntilactualrequiredreviewclearoruserexplicitwaiver withinpolicy.
+
+Durable backup originalQAworkspace .review/commonjs-fix-2026-11-08/corrections-2026-11-09/ contains4sourcefiles, corrections.patchrelativetoparent, checksums.json, before/after/uppercase-red/finalfocused/full/build/reprologs, verification.json (HEAD/tree/testcounts) andVERIFIEDGitbundlecommonjs-fix.bundle (8320bytes) withbothfixcommits andoriginalbase5e066489prerequisite. Canfetchlocalbranchfrombundleintorepohavingbaseif/tmpdisappears; don'toverwriteexistingbranch. Parentd18source/evidence alsoinparentbackupdir. Ledgerlatestcopybackedupafterthischeckpoint.
+
+OfficialupstreamreportstillconditionalTuesdayNov10 afterverification+duplicatecheck. Trackingpersonalcodegraphissue27CommonJS, issue26differentbug; QA PR27isfirstbugreportonly. Don'tmergeQAevidencePRs accidentally. Preserveallsharedsource/deploy/control worktrees; noT0work, no cleanup, no unrelatedreportfiling. Nextfinishuserreviewdecision,actualverificationthenfollowapplicableauthorization/SOPbeforeoutwardactions.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-corrections-running-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-corrections-running-2026-11-09.md
new file mode 100644
index 0000000000..b89b4349ef
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-corrections-running-2026-11-09.md
@@ -0,0 +1,13 @@
+# CommonJS corrections implemented; full verification running
+
+Current2026-11-09 state supersedes review-blocked handoff. User said if separate report issues, if related fix. Explained all3F3/F4/F5related, corrected together; no separate issues filed. Work only isolated /tmp/codegraph-cjs-missing-fix-20261108, branch fix/commonjs-missing-member, currentHEADd18e40970fc5fbf32f635f6d8d536d1bdb24dacc. Four tracked files changed since that commit: src/resolution/name-matcher.ts, src/index.ts, src/extraction/index.ts, __tests__/js-default-binding-members.test.ts. No new commit/push/PR/merge/deploy yet; em40live; originalT0stopped/uncommitted/untouched.
+
+F3: existing typeFrom metadata now records files of default-import member calls resolved by name matching (including class-name strategy without byName marker), including pure-forwarder chain files. Sync's existing type-dependent edge reopening accepts JS/TS as well as Python; failed Python attribute retry remains Python-only. Old shape changes now reopen guesses so synced/fresh graph agrees. F4: namespace info records explicit dotted/literal-bracket assigned export member names. Guard rejects absent members; explicit callable aliases retain existing resolution. Escaping/computed/prototype-mutated API treated uncertain. F5: lexical-class exemption now also uses existing holderScopeAt block visibility, preserving real inner/enclosing class shadows and blocking inaccessible sibling-block/TSnamespace classes. Import-resolver unchanged; no unsafe constructor inference.
+
+Tests BEFORE corrections:11newFAIL/24existingPASS atd18e4097 (/tmp/codegraph-cjs-fix-r3-regressions-before.log). First focused3files49PASS. Broader16files204PASS1SKIP. Added2class-name alias sync cases demonstrated remaining2FAIL under byName-only tracking (/tmp/codegraph-cjs-fix-r3-upper-before.log); expanded dependency stamp to all name-matcher default-member answers. FINAL focused16files206PASS1SKIP (/tmp/codegraph-cjs-fix-r3-focused-final.log), includes37default-membercases andPythonattribute/sync/memo controls. Original6caseportablebugrepro6/6PASS (/tmp/codegraph-cjs-corrected-final-sixcases.log, /tmp/codegraph-cjs-corrected-final-sixcases-20261109), exec98603exit0. No existing assertion weakened.
+
+RUNNING normal FULL suite exec42040: CODEGRAPH_KERNEL=0 npm test -- --maxWorkers=4, log/tmp/codegraph-cjs-fix-r3-full.log. Poll and inspect actualexit/summary; do NOTclaimpassyet. Previous full10589PASS belonged parentd18e4097, not current corrections. Explicit npm run build still required AFTER suite to avoid rebuild/read races. No source edits since finalfocused/sourcebackup; don't rerun full unless changes/failures justify. Node22.22.2/kernel0WASM; native unverified.
+
+PENDING USER ANSWER: async question asks permission for FOURTH two-reviewer verification while fullsuite runs. Exact source ~/.codex/AGENTS.md read: "where Claude's gate would ask the user at round 4, Codex denies, so stop and ask." Options yes verify or finish tests/hold. No answer received yet. The latest fix authorization is not an answer to this subsequent review question. Do not launch fourth agents until explicit answer; stop/ask on nativegate denial, never bypass state/control files. Last adversarial third lane hit usage limit after delivering confirmed evidence, don't assume retry free/available. If authorized use2freshread-onlynativefork_turns=none, exactGit target+ledger, brief only F3-F5/current fixes/invariants and execution commands, no repeatedfullsuite. Primaryledger .review/commonjs-missing-member.md contains fullhistory; latestcorrectionsection authoritative.
+
+Durable correction backup in original QA workspace .review/commonjs-fix-2026-11-08/corrections-2026-11-09/: explicit4sourcefiles, corrections.patch relatived18e4097, checksums.json, before/after/uppercase-red/finalfocused logs. Source unchanged since checksums saved. Parent source/patch, verification10589passed, priorreview evidence in parentdirectories. Beforecommit verify sourcehashes, personalorigin/identity/stagedexact4files/tests; keep alluntrackedprivateevidence out of commits. Save portablegitbundle after finalcommit if needed fordurability. No officialupstreamissue/PR now; conditionalTuesdayNov10report unchanged. Personalforkissue27isCommonJS, issue26differentexternalimport remainsunfixed. No QA PR26/27merge and noT0work. Do not deploy unreviewed corrections.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-final-review-f8-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-final-review-f8-2026-11-09.md
new file mode 100644
index 0000000000..06351f49a4
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-final-review-f8-2026-11-09.md
@@ -0,0 +1,15 @@
+# Final CommonJS verification: F8 remains, user decision required
+
+Authoritative2026-11-09. Supersedes final-verification-running and modular-eval checkpoint statuses. User said yes to final verification only; stop before next correction/publication step, as requested.
+
+Checkout /tmp/codegraph-cjs-missing-fix-20261108, branch fix/commonjs-missing-member, HEAD559c76df6afd9e40f4d617ff77caa7db4ad03955; original base5e0664891af0e87e6fd18bbfa16cab39237570f5(em.40). Six modular source files still dirty/uncommitted: package.json/package-lock.json, src/resolution/commonjs-export-members.ts, src/resolution/name-matcher.ts, __tests__/commonjs-export-members.test.ts, __tests__/js-default-binding-members.test.ts. Source frozen throughout tests/review, hashes rechecked against /tmp/codegraph-cjs-eval6-frozen.json. New files intent-to-add. Personal origin inth3shadows/codegraph and Eric Minish/eric.minish@gmail.com rechecked. No new commit, push, source PR, merge, deployment, version/tag/npm or official upstream write. Live em.40 unchanged. Original T0 pilot stopped/uncommitted.
+
+Sixth native dual review BOTH COMPLETED normally: review_broad_commonjs_eval6 and review_adversarial_commonjs_eval6, read-only. Both pass intended F7 template/grouped direct eval forms. Adversarial3original+11additional runtime graph controls clear; broad13intended controls clear. Broad found F8 P2 in small helper line20: parentheses around function argument eval mistaken as grouping around direct eval callee.
+
+Exact F8 module: exports.known=function known(){}; function wrap(value){return function ignore(code){};} wrap(eval)("ignored"); Runtime only exports known. Current reader uncertain:true makes named.missing() falsely call decoy.js:Decoy::missing. Restoring only pre-F7 literal-eval check in memory returns uncertain:false and no call. wrap((eval))(("ignored")) also reproduces. Evidence /tmp/cg-broad-verify6-callee-compare.{cjs,log}, /tmp/cg-broad-verify6-callee-context.{cjs,log}. Adversarial /tmp/codegraph-cjs-adversarial6-eval.{cjs,log}. Do not misrepresent adversarial clearance as overriding broad's demonstrated defect. Do not reread whole diff/re-verify findings merely to duplicate reviewers. Ledger has exact findings and evidence: /tmp/codegraph-cjs-missing-fix-20261108/.review/commonjs-missing-member.md.
+
+Normal full suite session5033 INTENTIONALLY STOPPED after confirmed F8 with exact cwd/argv-guarded host SIGINT to isolated checkout main Vitest, EXIT130. /tmp/codegraph-cjs-eval6-full.log partial, NOT full pass/failure. No test/build/reviewer processes remain from this phase. Final-source91focusedPASS and explicit npm run buildPASS still valid; prior10650fullPASS predates F7 and cannot clear final source. No redundant full run now; source has known related defect.
+
+Durable evidence/ledger/manifest/logs/checksums/verification in original QA .review/commonjs-fix-2026-11-08/final-verification-2026-11-09/. Current6source files and cumulative/modular patches are in adjacent modular-eval-2026-11-09/, still match frozen source. Parent commits recoverable from adjacent corrections-2026-11-09/commonjs-fix.bundle with base5e prerequisite. No private .review should be committed. No AI attribution.
+
+NEXT: report F8 and ask before another correction cycle. Stay modular, distinguish callee grouping from another function's argument list; second patch to same helper is a design warning, avoid growing an ad-hoc parser or endless costly review rounds. Must preserve real grouped/template eval and inert data/method negatives. If approved, add failing regression first; focused verification and normal repository checks before any readiness claim. Fresh native dual verify only if approved; this was round6, do not reset gate or protected state and stop if actual host denies. Prefer minimal-context bounded probes to save quota. User's per-step confirmation requirement and stop-before-push remain in force. Tuesday Nov10 upstream report conditional on verification/duplicate check, not now. Separate personal issue26 external-import bug remains out of scope; issue27 CommonJS. QA PR27 is first-bug evidence, not source fix. Preserve original T0, deploy and all control worktrees.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-final-verification-running-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-final-verification-running-2026-11-09.md
new file mode 100644
index 0000000000..0a6a1faa77
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-final-verification-running-2026-11-09.md
@@ -0,0 +1,13 @@
+# CommonJS final verification running, 2026-11-09
+
+Supersedes modular-eval checkpoint status only; source/background remains in handoff-codegraph-commonjs-modular-eval-2026-11-09.md.
+
+User explicitly approved final verification. Checkout /tmp/codegraph-cjs-missing-fix-20261108 branch fix/commonjs-missing-member HEAD559c76df6afd9e40f4d617ff77caa7db4ad03955. Six modular source paths still dirty and frozen, manifest /tmp/codegraph-cjs-eval6-frozen.json. Source backup in original QA .review/commonjs-fix-2026-11-08/modular-eval-2026-11-09/. Latest ledger /tmp/codegraph-cjs-missing-fix-20261108/.review/commonjs-missing-member.md.
+
+Full normal CODEGRAPH_KERNEL=0 npm test -- --maxWorkers=4 RUNNING tool session5033; poll write_stdin and tail /tmp/codegraph-cjs-eval6-full.log. Setup rebuild refreshed dist, no source edits. Do not restart full suite just because session compacted. Final pre-full explicit build passed; 91 focused tests passed on same source. Prior10650full pass predates final F7 correction and is not final clearance.
+
+Sixth native review fresh READONLY lanes /root/review_broad_commonjs_eval6 and /root/review_adversarial_commonjs_eval6 RUNNING; gather actual final results, do not claim pending clearance. Minimal-context briefs have exact559c76df working-tree target, shared ledger and F7 forms/nearby invariants. Original F7 three-form probe already passed adversarial lane; broader result remains pending. No reviewer builds/full reruns.
+
+Before any local commit, verify frozen hashes, full outcome, actual dual results, personal repo/remote/identity/staged exact six-file diff. Current origin https://github.com/inth3shadows/codegraph.git and Eric Minish / eric.minish@gmail.com were rechecked. Do not add .review or AI attribution. Save final logs, ledger, source and verified git bundle in original QA backup after commit. No push/PR/merge/deployment/upstream report authorized by this verification yes. Stop before pushing, ask before subsequent step as user requested. Preserve stopped uncommitted T0 pilot and all control/deploy worktrees. Tuesday Nov10 conditional upstream report remains pending. If review finds defects, report evidence and stop rather than starting another unapproved correction cycle.
+
+Running metadata also saved in original QA .review/commonjs-fix-2026-11-08/final-verification-2026-11-09/running.json. Keep user updates under60seconds while active, bounded waits. No test/build claim without actual exit/output.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-fix-running-2026-11-08.md b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-fix-running-2026-11-08.md
new file mode 100644
index 0000000000..a50f1a7c14
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-fix-running-2026-11-08.md
@@ -0,0 +1,17 @@
+# CommonJS fix — verify2 and full suite running
+
+User asked whether fix reviewed, then merge/deploy if so. No fix existed; user subsequently authorized implementing CommonJS fix and dual review after confirming no exact upstream report found. Related upstream2952 and3162 exist, exact unrelated-method follow-up tracked only in personal fork issue27. Official upstream reporting remains Tuesday2026-11-10 after verification. Do not post upstream now. Original codegraph-qa T0 pilot stopped/uncommitted, untouched.
+
+Isolated /tmp/codegraph-cjs-missing-fix-20261108, branch fix/commonjs-missing-member, base personal fork main5e0664891af0e87e6fd18bbfa16cab39237570f5. Fresh clone/dependencies. Four tracked files dirty: CHANGELOG, js-default-binding-members.test, import-resolver, name-matcher. No commit/push/PR/merge/deployment yet. Git personal identity EricMinish/eric.minish@gmail.com. origin inth3shadows/codegraph. No source access/write to shared live main or deployment.
+
+Root fix: imported namespace/default receiver must not reach class-name/global-method guessing after module/value lookup failed. Default class/instance/object/callable/real exported functions preserved. Initial guard lost explicit new Store() defaults and lexical local classes shadowing import; BOTH round1 reviewers found these P2 regressions. Added fail-before tests; redesigned with actual constructor evidence and a visible same-file lexical class exception. Constructed-default reader memo uses existing export-index lifetime; masks text/comments/regex, balances constructor/type arguments, rejects chained expressions; pins imported/local class by actual file and follows CommonJS forwarders. No import mappings changed. Direct module.exports={read(){}} member recovery was already missing on base; don't claim implemented. Bare external import bug26 not fixed.
+
+Ledger /tmp/codegraph-cjs-missing-fix-20261108/.review/commonjs-missing-member.md contains exact target, findings/invariants/fix map/logs. R1 reviewed name-matcher saved .review/round1-name-matcher.ts with original Git blob hash512a77a155299de8e6890447aa2d3aea7b81a1f9 verified. Current source blobs name-matcher ba00594eecfb665245a7a2d8c0d0c3352ce2d79f, import-resolver440b1547347e5cb88c85d9eca3b7adc548428062, tests0a4a9bc5a1687286f83e7e4b3c57a02485ae5379. Four tracked files frozen during verify2.
+
+Baseline before any resolver edit:20cases15PASS5FAIL(/tmp/codegraph-cjs-fix-baseline2.log). Round1 regression baselines24cases19PASS5FAIL(/tmp/codegraph-cjs-fix-review-baseline.log). Additional constructor controls caught3failures before balanced-reader correction. Final focused11files101PASS1SKIP(/tmp/codegraph-cjs-fix-focused-final.log), includes31cases in dedicated regression file. Original independent6-case portable QA repro now6/6PASS vs em40/main5/6, release4/6. Repro results /tmp/codegraph-cjs-fixed-sixcases-20261108, log/tmp/codegraph-cjs-fixed-sixcases.log; tool session4682 should be polled/closed. Root old-minWorkers command incompatible withVitest4.1.11 corrected maxWorkers4. Kernel0/WASM on Node22.22.2; native not claimed.
+
+RUNNING full normal suite: exec session83750, CODEGRAPH_KERNEL=0 npm test -- --maxWorkers=4, log/tmp/codegraph-cjs-fix-full.log. Do not claim pass until final exit and summary. Build still needs explicit npm run build (test setup already rebuilt current engine/viewer). No redundant full rerun unless changes/failures require it.
+
+Fresh READ-ONLY native review lanes running: /root/review_broad_commonjs_verify2 and /root/review_adversarial_commonjs_verify2. They have exact gitdiff5e066489 +all4paths and ledger; verify both round1 findings/invariants and actual remediation defects with code execution. Do not report pending reviewers as clear. R1 lanes finished /root/review_broad_commonjs_round1 and /root/review_adversarial_commonjs_round1. Native shared review gate applies; stop ifround4denied, don't bypass or claim Claude-only skill ran. No third parent diff read; work from findings.
+
+Next collect fullsuite/reviewer results; correct defects if needed, obey skill round policy. Save concrete tested/reviewed outcome before outward actions. User earlier required confirmation before next step; don't expand to other bug26/T0/infrastructure/production. Local fork SOP read ~/.claude/plans/codegraph-fork-sop.md, canonical approved fixplan ~/.codex/plans/codegraph-commonjs-fix-2026-11-08.md. Live deployment remains em40; preserve it and allcontrol-plane/deployworktrees. If deployment becomes authorized/ready, use independent versioned copy and actual SOP, never a live source checkout. No publicrelease/npm/tagmutation.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-investigation-2026-11-08.md b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-investigation-2026-11-08.md
new file mode 100644
index 0000000000..f67960333f
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-investigation-2026-11-08.md
@@ -0,0 +1,15 @@
+# CommonJS missing-export investigation — complete, filing approval pending
+
+User approved investigating the second CommonJS bug candidate only. No engine fix, new issue, PR/report push, deployment or merge performed. Prepared a concrete report draft for review before requesting the next step.
+
+Confirmed: const utils=require('./utils'); utils.missing() falsely binds to an unimported exported class Decoy::missing even though utils.js exports only known(). Ref retains utils.missing; edge resolvedBy instance-method, provenance null. This is different from tracked inth3shadows/codegraph26 (external import/missing dependency metadata): this receiver is a real relative CommonJS module.
+
+Six reduced cases across three actual subjects,18 fresh indexes successful. em40 5e0664891af0e87e6fd18bbfa16cab39237570f5 and pristine upstream main f72c9d2efb14454ff4f9fd7b8460abd82f19a287 have identical case/edge records:5 pass,1 missing-method-decoy failure. Pristine upstream v1.6.2 /6560052a6f856855d3f71eee838fd66ccfa4285d also fails that case; it has4 pass/2 fail because the real-export control also fails there. Do not claim all six cases match across all versions. Previous independently built upstream checkouts reused, source trees remain pristine. Kernel0/WASM, Node22.22.2; no native/package binaries tested.
+
+Controls: no decoy, same-name free function decoy, different-name method, actual exported method and ESM namespace syntax. Latest/main resolve actual exports and ESM namespace correctly, while CJS missing export + class method decoy fails. The common source explains it: import-resolver2194-2207 represents require as isDefault true/isNamespace false; name-matcher25029-25037 + isImportedModuleReceiver25387-25392 guard namespaces or external packages, so local require bypasses it. Generic method-by-name25152+ picks the unique unimported class method around25253-25280. Proposed correction must preserve actual module exports and legitimate stated default class/object/instance APIs; no broad ban on all require defaults.
+
+Related upstream2952 closed,3162 closed fix addressed first-export fallback. This is a remaining method-fallback variant, not a novelty claim or assertion that3162 did nothing. Only the missing-member part is investigated, not factory-produced etag recovery.
+
+Durable draft/repro/results/snapshots/checksums: /home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-missing-export-2026-11-08/. bug-report.md is the reviewable report; reproduce.mjs uses relative QA lib imports and arguments BUILD LABEL NEW_OUT. Repro script syntax checked. Experimental source and logs /tmp/cgqa-commonjs-investigation-20261108. Independent upstream builds remain /tmp/cgqa-pristine-upstream-sr9mi8mh/{main,release}. All original T0 source untouched/stopped.
+
+Next: ask user whether to create a separate tracking issue in personal fork for conditional Tuesday review/upstream submission. Do not file automatically from this handoff. Existing first issue https://github.com/inth3shadows/codegraph/issues/26 and QA evidence PR27 are unchanged. No external comments/issues created for this second investigation.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-modular-eval-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-modular-eval-2026-11-09.md
new file mode 100644
index 0000000000..a064586062
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-modular-eval-2026-11-09.md
@@ -0,0 +1,33 @@
+# CommonJS modular fix: final correction verified locally, final review pending
+
+Authoritative checkpoint, 2026-11-09. User requested status after authorizing related defect corrections using smaller modules. No outward action has happened. Preserve original stopped/uncommitted T0 pilot.
+
+## Implementation checkout
+
+- /tmp/codegraph-cjs-missing-fix-20261108, branch fix/commonjs-missing-member
+- HEAD 559c76df6afd9e40f4d617ff77caa7db4ad03955; original base 5e0664891af0e87e6fd18bbfa16cab39237570f5 (em.40)
+- Six uncommitted source paths: package.json, package-lock.json, src/resolution/commonjs-export-members.ts, src/resolution/name-matcher.ts, __tests__/commonjs-export-members.test.ts, __tests__/js-default-binding-members.test.ts. New files have intent-to-add so git diff includes them.
+- Personal origin https://github.com/inth3shadows/codegraph.git. Identity previously verified Eric Minish / eric.minish@gmail.com; recheck before committing.
+- No source push, fix PR, merge, deployment, npm/tag or official upstream report. Live em.40 unchanged.
+
+## Review and fix status
+
+Fourth dual native review cleared F3 stale sync, F4 genuine aliases and F5 inaccessible class scope; found F6 raw source collecting fake exports from comments/strings/regex/unrelated objects.
+
+F6 modular correction uses isolated readCommonJsExportMembers with exact production js-tokens9.0.1 (CommonJS with types), a small matcher adapter and independent unit tests. No changes to previous sync/scope fixes. Fifth fresh read-only native reviewers review_broad_commonjs_modular5 and review_adversarial_commonjs_modular5 both completed and cleared F6 plus previous invariants and packaging. They found F7: eval with template literal or parenthesized bare callee drops real exported aliases. Evidence /tmp/codegraph-cjs-adversarial5-eval.{cjs,log}. Single-quoted bare eval control works.
+
+F7 correction stays only inside the reader: unwrap grouped bare callee/arguments and accept StringLiteral, NoSubstitutionTemplate and TemplateHead. No execution of eval. Added4 unit cases and2 graph positives; class method named eval remains ignored. Fail-before6FAIL85PASS; final2files91PASS. Explicit npm run build EXIT0, viewer/29grammar/runtime/engine checks pass. git diff --check passed. F7 correction has NOT had independent review or final full-suite run. Do not claim final review clearance or ready to merge.
+
+## Verification
+
+Before final F7 correction: expanded18files260PASS1SKIP; full873filesPASS19SKIP,10650testsPASS2expectedFAIL448SKIP0unexpectedFAIL,780.27sec. This full pass predates F7 correction. Final F7 focused91PASS and normal build PASS. No test/build processes remain from this checkpoint.
+
+Logs /tmp/codegraph-cjs-modular-{expanded-final,full,sixcases}.log and /tmp/codegraph-cjs-modular-eval-{before,after,build}.log. Node22.22.2, CODEGRAPH_KERNEL=0/WASM; no native validation claim. Vitest4.1.11: use --maxWorkers=4, not --minWorkers.
+
+## Durable recovery and next step
+
+Primary ledger /tmp/codegraph-cjs-missing-fix-20261108/.review/commonjs-missing-member.md. Durable source/patch/hash/log backup in original QA workspace .review/commonjs-fix-2026-11-08/modular-eval-2026-11-09/. Previous corrections-2026-11-09/commonjs-fix.bundle recovers both local parent commits against original5e base. Cumulative.patch in new backup includes all current code relative5e. Do not commit private .review.
+
+Remaining: final F7 verification and full suite on unchanged final tree, then local commit after repo/remote/identity/staged diff checks. User has asked for confirmation before subsequent steps; do not turn status into publishing authorization. Review rounds are already fifth: use existing ledger honestly, no gate resets or control-file changes. If another round is approved, two fresh read-only native lanes, minimal fork_turns=none, exact Git target and ledger, bounded F7 verification plus invariants, no redundant full runs by reviewers. Respect any gate denial; stop and ask as applicable. Do not claim Claude-only /code-review ran.
+
+Tuesday Nov10 upstream report remains conditional on actual verification and duplicate check. Personal codegraph issue27 is CommonJS. Issue26 is separate external import bug, outside this fix. QA repo PR27 is first-bug evidence, not source fix. Preserve original T0 and all deploy/control worktrees.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-namespace-fix-2026-11-08.md b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-namespace-fix-2026-11-08.md
new file mode 100644
index 0000000000..93ce7201e7
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-namespace-fix-2026-11-08.md
@@ -0,0 +1,25 @@
+# Current authoritative CommonJS fix state — namespace-only redesign
+
+Supersedes constructor-inference state in handoff-codegraph-commonjs-fix-running-2026-11-08.md. Date2026-11-08, personal WSL user inth3shadows, original QA worktree remains stopped/uncommitted.
+
+User approved implementing CommonJS missing-member fix and dual review after no exact upstream report found. Earlier conditional request was merge/deploy IF reviewed. Issue https://github.com/inth3shadows/codegraph/issues/27 tracks exact bug; first external import bug26 remains unfixed. No official upstream writes; Tuesday2026-11-10 remains conditional reporting day.
+
+Isolated repo /tmp/codegraph-cjs-missing-fix-20261108, branch fix/commonjs-missing-member, base5e0664891af0e87e6fd18bbfa16cab39237570f5, personal origin inth3shadows/codegraph, identityEricMinish/eric.minish@gmail.com. Fresh npmci. Only3tracked files modified: CHANGELOG.md, __tests__/js-default-binding-members.test.ts, src/resolution/name-matcher.ts. Added import-resolver code completely removed, exact base again. No source commit/push/fix PR/merge/deployment performed. em40 remains deployed.
+
+Current fix only blocks fallback for imports proven to denote a module namespace: default/require of resolved JS/TS file with no raw default keyword/export= or uncertain module reference, and pure whole-file CJS forwarding to such a namespace. Conservative raw source checks may leave uncertain/text-heavy cases unchanged. Memo keyed(file,language), cleared by normal name-matcher memo clearing, bounded8forwarders and cycle safe, excludes implicit Vue/Svelte defaults. Known namespace guard precedes global class guessing; actual same-file lexically reachable class shadow exempt. All default VALUE inference remains untouched, including pre-existing limitations. Not a claim that all default-import missing-member guesses fixed.
+
+Review history: R1 BOTHread-only native lanes foundP2lost explicit singleton/default-instance call andP2local class shadow loss. Initial attempted constructor-recovery remediation failed VERIFY2: new wrong imported-constructor call overriding local shadows, obsolete/inactive constructor assignment overriding actual exports, stale constructor-derived call aftersync, missing inline/parenthesized constructors. All findingsP2; neither verify2lane cleared. Both conceptually agreed namespace-only boundary is coherent but DID NOT REVIEW OR CLEAR current implementation. Unsafe constructor parser/helper is entirely removed. Ledger .review/commonjs-missing-member.md has details, rulings and exact targets. Do not claim dual-review complete/clear for final redesign.
+
+REQUIRED USER ANSWER PENDING: async question asked whether a THIRD dual-review round may run on final redesign. Skill ~/.codex/skills/dual-review/SKILL.md says third round only if verify found high severity; all these findingsP2, so exception requested with exact skillquote/link. Do not spawn third reviewers without actual user answer. Existing previous user yes predates this question and does NOT answer it. Full build/tests continue independently.
+
+Final redesigned focused verification PASSED:13files108PASS1SKIP, log/tmp/codegraph-cjs-fix-redesign-focused2.log, exec55894exit0. Includes24casesdedicated regression file and memo clearing/lifetime. Explicit normal npm run build PASSED, exec54732exit0, log/tmp/codegraph-cjs-fix-redesign-build.log. Independent original6-case portable bug repro PASSED6/6, exec54104exit0, newresults/tmp/codegraph-cjs-redesigned-sixcases-20261108, log/tmp/codegraph-cjs-redesigned-sixcases.log. The original em40/pristine upstreammain each5/6, release4/6; no fullsameoutcomes acrossreleaseclaim.
+
+Parent regression validation reused reviewer probe scripts on current dist:9records /tmp/codegraph-cjs-redesign-adversarial.jsonl exactly match saved em40base9records;9more records /tmp/codegraph-cjs-redesign-more.jsonl also EXACTLYMATCHbase. These are test/control runs, not an independent final review. No source fix for pre-existing odd targets in those controls. Don't claim all18are correctness passes; they are baseline preservation.
+
+RUNNING final normal FULL SUITE: exec60370, CODEGRAPH_KERNEL=0 npm test -- --maxWorkers=4, log/tmp/codegraph-cjs-fix-redesign-full.log. Poll write_stdin60370 and inspect final summary/exit; do not claim pass before completion. Superseded full run83750STOPPEDexit130 after targeted guardedSIGINT when code was invalid; its /tmp/codegraph-cjs-fix-full.log is not a green gate. Vitest4doesnotaccept--minWorkers; usemaxWorkers4. Kernel0/WASMNode22.22.2; no native validation claims.
+
+Durable original-workspace backup: /home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/. Contains source3files, fix.patch, checksums.json, passing focused/build logs, independent probe results, review ledger before third round. Patch reverse-check against current working tree PASSED (i.e. matches modifications to base). No source changes since this backup. Reconstructed R1 name-matcher snapshot .review/round1-name-matcher.ts (Gitblob512a77a155299de8e6890447aa2d3aea7b81a1f9) preserved in isolatedrepo. No node_modules/.git/credentials copied.
+
+Additional upstream openPR duplicate check:3133(relative require package main),2754(import/export forwarding and constructor defaults),2800(default forwarding/value targets) remain related; titles/bodies examined, no same namespace missing-member method guard found. Related original2952closed,3162merged, target stillf72c9d2e earlierverified. Avoid global novelty claim and repeat duplicate check Tuesday. No upstream report now.
+
+Next: finish fullsuite, save final outcomes; user may approve or decline third review. If yes launch TWO FRESH READ-ONLY native review_broad_* and review_adversarial_* on `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5e0664891af0e87e6fd18bbfa16cab39237570f5 -- CHANGELOG.md src/resolution/name-matcher.ts __tests__/js-default-binding-members.test.ts`, same ledger. Gateround3shouldbeavailable; round4denialrequiresstopandask,never bypass. They must verify priorfindingsdefeated by removal, original missing-memberbug fixed, real exported/default API/shadows/sync/memo semantics preserved. No already-running reviewers remain for this task. Do not claim Claude-only code-review ran. No main/deploy mutation before finalfixactuallyreviewedgreen. Beforecommits/pushes verify source identity, personal remote, stageddiff and actualtests. Preserve .codex/.claude/deploytrees; no publicrelease/npm/tagmoves. Do not resume T0 or expand into bug26.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-review-blocked-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-review-blocked-2026-11-09.md
new file mode 100644
index 0000000000..b537826163
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-review-blocked-2026-11-09.md
@@ -0,0 +1,18 @@
+# CommonJS fix: third review found defects — hold merge/deploy
+
+Authoritative2026-11-09 state, supersedes tested-review-pending2026-11-08 handoff. User approved third round, asked why, then resumed. Explained earlier code was replaced and final commit had not been independently reviewed. Used two fresh read-only minimal-context native lanes; no full-suite rerun.
+
+Local commit d18e40970fc5fbf32f635f6d8d536d1bdb24dacc in /tmp/codegraph-cjs-missing-fix-20261108, branch fix/commonjs-missing-member, base5e0664891af0e87e6fd18bbfa16cab39237570f5. Three files CHANGELOG.md, src/resolution/name-matcher.ts, __tests__/js-default-binding-members.test.ts. Tracked tree clean, .review untracked. Personalorigin inth3shadows/codegraph, EricMinish/eric.minish@gmail.com. No push, fix PR, merge, deployment or official-upstream write. em40stilllive. Original QA T0 stopped/uncommitted, untouched. External import issue26 unfixed; CommonJS tracked forkissue27. Conditional TuesdayNov10upstreamreport still held until checks hold.
+
+PASS remains true for this exactcommit: npm run build,13focusedfiles108PASS1SKIP,6/6originalportablebugcases,18independentrecords exactlymatchingbase, namespace->instance sync matchesfresh. Full suite872filesPASS19SKIP,10589testsPASS2expectedFAIL448SKIP0unexpectedFAIL,799.56sec, CODEGRAPH_KERNEL0Node22.22.2. No native claims. No test processes running. Source/patch/logs/verification backup original QA .review/commonjs-fix-2026-11-08/.
+
+REVIEW NOT CLEAR. Broad lane review_broad_commonjs_final3 completed normally. Adversarial review_adversarial_commonjs_final3 delivered confirmed findings/messages then FAILED finalization due usage cap (notice retry Nov9 1:10AM). Do not claim final successful report or clearance from failed lane; do not relaunch automatically or spend another round. Confirmed evidence/messages still preserved in ledger.
+
+Three P2 findings:
+F3 broad + adversarial: value->namespace change after index retains old Store::load via cg.sync; fresh final index correctly[]. Importmodule text/shape is a new guard dependency that does not reopen old member guesses. Repro /tmp/cg-broad-final3-sync-reverse.cjs +log +base.log; /tmp/codegraph-cjs-final3-sync.cjs direct/pureforwarder independent.
+F4 adversarial: actual callable alias exports.load=Store.prototype.load (also module.exports.load) works at runtime and base graphStore::load, finaldropscall. Classifier must preserve uncertain member RHS or resolve actual alias; cannot treat it as absent export. /tmp/codegraph-cjs-final3-export-alias.cjs and -adversarial*.jsonl.
+F5 adversarial still-open original path: constnamed=require('./m'); run(){ if(true){ classnamed{staticmissing(){}} } named.missing(); } binds to inaccessible block-local class. Existing isLexicallyReachable coarse; guard exemption must check real lexical block scope. AlsoTSnamespaceParent. Need preserve real local/enclosing-function class shadows. Same wrong edge preexists base; not a new regression but intendedmissingmemberpathnotfixed.
+
+Full exact findings/locations/claims are appended in /tmp/codegraph-cjs-missing-fix-20261108/.review/commonjs-missing-member.md. Read before any correction; do not reread full reviewed diff as a third reviewer or rerun already-confirmed findings merely to duplicate review. Each correction needs fail-before regression and preservation invariants. Unsafe constructor inference from earlier round is completely removed (import-resolver exactlybase); do not reintroduce. Default/unknown-value guessing remains documented out-of-scope unless concrete regression.
+
+NEXT: report defects/no-merge decision and get the next bounded correction/verification direction; user asked confirmation before next step. No further source fixes/agents started after reports. Third approval does not authorize fourth round; gate4requiresstop/ask, no bypass. Usage cap prevents assuming another lane can run anyway. Do not merge/deployd18e4097 despite green tests. No fixes for other bugs/T0, no publicupstreamissue/PR now, no tag/npm/deploymutations, no source/deploy/control worktree cleanup. Update durable checkpoint after any new authorized work.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-tested-review-pending-2026-11-08.md b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-tested-review-pending-2026-11-08.md
new file mode 100644
index 0000000000..2115078897
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-tested-review-pending-2026-11-08.md
@@ -0,0 +1,17 @@
+# CommonJS fix tested, final review awaiting user approval
+
+Current authoritative status2026-11-08; supersedes namespace-running and unsafe-constructor handoffs. User requested CommonJS fix and dual review; earlier merge/deploy request conditional on reviewed fix. Upstream report remains Tuesday2026-11-10 after verification. No upstream writes, no external import issue26 fix, T0 remains stopped/uncommitted/untouched.
+
+LOCAL COMMIT d18e40970fc5fbf32f635f6d8d536d1bdb24dacc, tree2363dd0f8923ca59c28a3e45a477573e7364e7c2 in /tmp/codegraph-cjs-missing-fix-20261108, branch fix/commonjs-missing-member, base5e0664891af0e87e6fd18bbfa16cab39237570f5. Fresh isolated clone originhttps://github.com/inth3shadows/codegraph.git, personalEricMinish/eric.minish@gmail.com. Tracked clean, .review untracked. Three committed files: CHANGELOG.md, src/resolution/name-matcher.ts, __tests__/js-default-binding-members.test.ts. No push/fix PR/merge/deployment. em40remains live. Commit source exactly matches tested and backed-up candidate; identity/remote/stagedset/diff/check verified before commit.
+
+Scope: block method-name/class-name guesses through a namespace import or require/default proven to reach a namespace-only JS/TS module. Preserve all stated/uncertain default-value behavior. Pure CJS forwarder support, bounded/cycle-safe traversal, language-qualified memo cleared with existing memos, lexical same-file class shadow exempt. Conservative raw checks may leave ambiguous/text-heavy cases unchanged. No import-resolver changes remain; unsafe attempted constructor inference was entirely removed. No claim all arbitrary default-value missing-member guesses fixed. Original module-missing-member counterexample fixed.
+
+PASS:13focusedfiles108PASS1SKIP; npm run build;6/6originalportablebugcases;18independent reviewer probe records EXACTLYMATCHem40base; namespace->explicit-instance sync equals fresh(actualStore::load,initialnone). Full normal suite exec60370EXIT0:872filesPASS19SKIP,10589testsPASS2expectedFAIL448SKIP0unexpectedFAIL,799.56seconds. CODEGRAPH_KERNEL=0 Node22.22.2 Vitest4.1.11 --maxWorkers=4. Native not validated. Logs/tmp/codegraph-cjs-fix-redesign-focused2.log,-redesign-build.log,-redesign-full.log, plus/tmp/codegraph-cjs-redesigned-sixcases.log. No running test sessions remain. Superseded constructor candidate fullsuite stoppedexit130 and never passed; don't conflate logs.
+
+DUAL REVIEW NOT COMPLETE FOR FINAL COMMIT. Initial two native reviewers foundP2singleton/default-value loss andP2lexicalclassshadowloss. Verify2 of attempted constructor recovery found newP2falsecalls, shadow override, overwritten/inactive export choice, stale sync, and remaining inline/parenthesized default loss. Both lanes agreed narrower namespace-only design is coherent but did NOT inspect or clear current implementation. Ledger /tmp/codegraph-cjs-missing-fix-20261108/.review/commonjs-missing-member.md has findings/invariants/evidence and exact final target. No pending reviewer agents for this task.
+
+PENDING REQUIRED USER ANSWER: async request asked permission for third dual-review round because ~/.codex/skills/dual-review/SKILL.md says "Run a third round only if the verify round found something high severity in the fix." Findings wereP2. Need explicit user exception; elapsed time and later "status?" are NOT approval. Do not spawn another round before answer. If user approves, TWO fresh READ-ONLY native collaboration agents named review_broad_* and review_adversarial_*; use fork_turns=none with self-contained domain/ledger briefs to avoid unrelated history. Both exact target `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 5e0664891af0e87e6fd18bbfa16cab39237570f5..d18e40970fc5fbf32f635f6d8d536d1bdb24dacc -- CHANGELOG.md src/resolution/name-matcher.ts __tests__/js-default-binding-members.test.ts`. Third gate should be available; round4deny must stop/ask, no bypass. Don't claim Claude-only /code-review ran. Fresh lanes verify original negatives, all baseline positives, removal of constructor override paths, lexical shadows, memo/sync and new scope. Native agents run small probesmaxWorkers1 if needed; full tested tree alreadygreen, no redundant full rerun unless source changes.
+
+Durable backup originalworkspace /home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/: three source files, fix.patch, checksums.json, verification.json (commit/tree/outcomes), focused/build/full logs,6casereproresults,18controlresults,syncprobe. Review ledger here is newer than original backup before-third ledger; use isolatedrepo's .review/commonjs-missing-member.md for finalreview. Original .review/commonjs-missing-export-2026-11-08/ preserves actual bug evidence from upstream/em40.
+
+Tracking https://github.com/inth3shadows/codegraph/issues/27. Related upstream2952closed/3162merged; additional open2754,2800,3133related but no exact namespace guard found from docs. Don't claim global novelty. First issue26 and QA reportPR27 untouched. No publicupstreamissue/comment now, no deployment/tag/npm changes. Preserve shared main/deploy/control worktrees and stoppedT0. Continue user's conditional merge/deploy only after actual finalreviewclear+green and applicable authorization/SOP; currently hold.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-tracked-2026-11-08.md b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-tracked-2026-11-08.md
new file mode 100644
index 0000000000..62444ac2f3
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-tracked-2026-11-08.md
@@ -0,0 +1,13 @@
+# CommonJS bug tracked — 2026-11-08
+
+User approved creating the separate fork tracking issue. Created and fetched back https://github.com/inth3shadows/codegraph/issues/27 (open), title: CommonJS: missing module exports resolve to unrelated unimported class methods. GitHub readback body exactly matches the saved tracking-issue-body.md (6400 characters). No duplicate creation was attempted after context compaction.
+
+The self-contained issue includes the three-file reproduction, commands, tested revisions, controls, root-cause analysis, related upstream work and limitations. Verified missing-member counterexample on em.40, pristine upstream main f72c9d2efb14454ff4f9fd7b8460abd82f19a287 and pristine upstream v1.6.2 6560052a6f856855d3f71eee838fd66ccfa4285d. This failure is not introduced by fork customization. 18 fresh indexes completed; em.40/main have 5 passing cases and 1 semantic failure each, release has 4 passing cases and 2 failures because its real-export control also fails. Kernel0/WASM only. No source fix or deployment.
+
+Evidence directory: /home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-missing-export-2026-11-08/. Files include bug-report.md, reproduce.mjs, three result JSONs, case source/snapshots, checksums.json and the actual posted tracking-issue-body.md. Original evidence checksums exclude the subsequently added tracking-issue-body.md.
+
+First bug remains https://github.com/inth3shadows/codegraph/issues/26. Existing first-bug QA evidence PR remains https://github.com/inth3shadows/codegraph-qa/pull/27; no PR changes were made in this issue-filing step. Do not confuse codegraph issue27 with codegraph-qa PR27.
+
+Official upstream reporting remains conditional on Tuesday, November 10, after final verification and duplicate/related-issue review. For this CommonJS variant review upstream2952 and3162; do not claim a wholly novel family. No official upstream issue/comment has been created by this step. Follow the existing Tuesday plan and ask before moving to another step, consistent with the user's instruction. No resolver fix, merge, deployment or new investigation authorized here.
+
+Original T0 pilot remains stopped and uncommitted; its source files were not edited in this step. Current dirty working tree is the preserved T0 work plus private .review evidence. Do not commit/pull/reset it. The prior investigation handoff's filing-pending status is superseded by this checkpoint.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-two-draft-prs-testing-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-two-draft-prs-testing-2026-11-09.md
new file mode 100644
index 0000000000..da0f8c979f
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-two-draft-prs-testing-2026-11-09.md
@@ -0,0 +1,13 @@
+# Two CommonJS draft PRs published; combined full verification running
+
+Authoritative2026-11-09. User explicitly authorized commit/push/PR of current work and separating last correction. This supersedes earlier stop-before-push restriction for these two branches only; no merge/deploy/upstream write authorized. Do not re-ask publishing approval for these completed actions.
+
+PR28 https://github.com/inth3shadows/codegraph/pull/28 DRAFT, base main, head fix/commonjs-missing-member, commit5d384989957c91b482068b306535437915a0595b. Preserves exact previous snapshot, including known F8 from sixth review. First two local fixes d18e4097 and559c76df included. Personal origin inth3shadows/codegraph and Eric Minish/eric.minish@gmail.com verified before each commit/push. PR28 body documents F8, corrected separately in PR29; hold merge until follow-up integrated.
+
+PR29 https://github.com/inth3shadows/codegraph/pull/29 DRAFT, base fix/commonjs-missing-member, head fix/commonjs-eval-callee-context, commit87576a8d9ff0d8aba235db5535f5f4429f14b037. Small3-file29-line correction: token before grouped callee distinguishes wrap(eval)("ignored") and grouped variant from genuine direct eval, guards call/member/optional/tag/condition contexts, preserves return expression and existing literal/template eval controls. Fail-before8FAIL92PASS plus tag1FAIL49PASS. Final2files101PASS; explicit npm run buildPASS. Do NOT claim independent review of this follow-up: no fresh reviewers launched. Sixth review covered prior snapshot, not87576a8d. Both branches pushed, source tracked clean except private untracked .review. No AI attribution/private artifacts committed.
+
+Implementation repo /tmp/codegraph-cjs-missing-fix-20261108 currently branch fix/commonjs-eval-callee-context at87576a8d. Full normal CODEGRAPH_KERNEL=0 npm test -- --maxWorkers=4 RUNNING tool session62594, /tmp/codegraph-cjs-eval-followup-full.log. Started on exact committed final source after101focusedPASS/build. Poll existing session; do not restart after compaction. Source must stay frozen. Manifest /tmp/codegraph-cjs-followup-frozen.json covers changed3files. Existing prior full10650PASS predates last corrections and cannot clear current branch. Expect about13min run. No new reviewer agents. Do not claim full pass until actual exit/summary.
+
+Remaining in this authorized phase: monitor full suite with regular updates; if green verify source unchanged, update PR29 validation text, save final logs/manifest/ledger/checkpoint. If failures, preserve/report evidence, don't start an unapproved correction cycle. GitHub connector create/update uses repository_full_name and pr_number for update. Both PR bodies already link each other. Don't merge or deploy; user must decide next step. Follow-up still needs independent review before any merge readiness claim, user can point a separate agent directly at PR29.
+
+Durable original QA .review/commonjs-fix-2026-11-08/two-draft-prs-2026-11-09/ contains actual source3files, ledgers, followup.patch, verified two-branch gitbundle(codegraph-cjs-two-prs-20261109.bundle, base5e prerequisite), focusedred/green/buildlogs, manifest and running.json(session62594). Entire parent snapshots also in adjacent previous backups; branches now recoverable from GitHub. Original T0pilot stays stopped/uncommitted/untouched. Live em.40 unchanged; TuesdayNov10 conditional upstream report not yet authorized for posting. Personal codegraph issue27 CommonJS; issue26 externalimportbug separate, QA PR27 evidence unrelated to source PR28/29. Preserve control/deploy worktrees. Review rounds remain six; no state resets.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-two-draft-prs-verified-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-two-draft-prs-verified-2026-11-09.md
new file mode 100644
index 0000000000..521d6fcca7
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-commonjs-two-draft-prs-verified-2026-11-09.md
@@ -0,0 +1,26 @@
+# Two CommonJS draft PRs published and execution-tested; follow-up review pending
+
+Authoritative2026-11-09. Supersedes two-draft-prs-testing/running/F8blocked checkpoints. User explicitly requested commit/push/currentPR and separating remaining correction. Completed exactly those two PRs; no merge/deploy/upstream report.
+
+## Published branches and PRs
+
+- https://github.com/inth3shadows/codegraph/pull/28 DRAFT, base main5e0664891af0e87e6fd18bbfa16cab39237570f5(em.40), head fix/commonjs-missing-member at5d384989957c91b482068b306535437915a0595b. Preserves exact pre-followup snapshot, including known F8. Three commits: d18e4097 namespaceguard,559c76df sync/alias/scope corrections,5d384989 modular tokenizer/exportreader and F7 evalforms. PR28 body explicitly links follow-up29 and says hold merge.
+- https://github.com/inth3shadows/codegraph/pull/29 DRAFT, base fix/commonjs-missing-member5d384989, head fix/commonjs-eval-callee-context at87576a8d9ff0d8aba235db5535f5f4429f14b037. Only3files29addedlines. Corrects F8 wrapper/callee grouping distinction, with focused regression tests and no matcher/sync/scope changes. Both remoteheads rechecked exact. Both unmerged; do not markready or merge without next user decision.
+
+Implementation checkout /tmp/codegraph-cjs-missing-fix-20261108 currently branch fix/commonjs-eval-callee-context at87576a8d. Trackedtreeclean, private .review untracked. Personal origin https://github.com/inth3shadows/codegraph.git; identity Eric Minish/eric.minish@gmail.com verified before commits/pushes. No AI attribution/private .review committed. Original QA T0pilot remains stopped/uncommitted/untouched, HEAD729da1b and existing dirtyfiles unchanged. Live em.40 unchanged.
+
+## Actual verification on final87576a8d
+
+Fail-before F8 regressions8FAIL92PASS; tagged-callee follow-up1FAIL49PASS. Final2files101PASS. Explicit npm run build EXIT0, viewer/29grammars/runtime checks PASS. Full normal CODEGRAPH_KERNEL=0 npm test -- --maxWorkers=4 session62594 completed EXIT0:873filesPASS19SKIP;10666testsPASS2expectedFAIL448SKIP0unexpectedFAIL;800.20seconds. Finalsource hashes match frozen/tested snapshot; trackedtreeclean. Logs /tmp/codegraph-cjs-eval-followup-{before,tag-before,focused,build,full}.log. Node22.22.2/kernel0WASM; no native validation claim. No test/build/reviewer processes remain from this phase. No reason to rerun full/build unless code changes or a new failure/concern warrants it.
+
+## Review boundary
+
+Sixth native dual review completed on prior5d384989 snapshot and found F8: wrap(eval)("ignored") and wrap((eval))(("ignored")) wrongly mark knownnamespace uncertain, allowing named.missing() to call decoy.js:Decoy::missing. Both lanes cleared genuine template/grouped eval controls; broad found F8. The87576a8d correction has NOT had independent dual review. Do not call tests a review clearance. No seventh agents were launched, so no extra review quota spent in this phase. User can point separate agent directly at PR29, exact target `gh pr diff 29 -R inth3shadows/codegraph` (base5d384989..87576a8d). Full primary diff is PR28, and primary must integrate follow-up before main.
+
+If user authorizes next review, fresh read-only native review_broad_* and review_adversarial_* with exact Git/PR target and ledger. Minimal-context briefs, preserve round count6/sharedgate; no resets or protected control edits. No unapproved additional review/correction loops; stop/ask if actual gate denies. Small follow-up ledger /tmp/codegraph-cjs-missing-fix-20261108/.review/commonjs-eval-callee-context.md points to full history .review/commonjs-missing-member.md. Preserve true grouped direct eval, templates, return expressions, inert text/method definitions and no decoy calls for eval merely passed to wrappers; previous alias/sync/scope/Python invariants remain. No full/build reruns by reviewers on unchanged code. Do not claim Claude-only /code-review ran.
+
+## Durable recovery
+
+Original QA .review/commonjs-fix-2026-11-08/two-draft-prs-2026-11-09/ has current3sourcefiles, ledgers, followup.patch, both-branch VERIFIEDgitbundle(codegraph-cjs-two-prs-20261109.bundle; requires base5e), frozen hashes, red/green/build/full logs, verification.json and checksums.json. running.json explicitly updated completed. Parent source/patch/evidence adjacent backups. Both branches now recoverable from GitHub. PR29 body has exact final suite/build/counts and independent-review-pending notice. Both PR bodies link dependency. Nothing lost if /tmp disappears.
+
+Next user decision is review/merge workflow, not more unasked feature work. Safest sequence: review small PR29, integrate into PR28 branch, then assess final parentPR for main. Do not merge/deploy automatically; per-step confirmation remains in force. TuesdayNov10 official upstream report still conditional on verification/duplicate check and user go-ahead; do not post now. Personalcodegraphissue27CommonJS; issue26 separate externalimportbug out of scope. QA PR27 is first-bug evidence and unrelated to sourcePR28/29. Preserve deploy and agent control worktrees.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-ast-integrated-review8-running-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-ast-integrated-review8-running-2026-11-09.md
new file mode 100644
index 0000000000..c0ab47bd63
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-ast-integrated-review8-running-2026-11-09.md
@@ -0,0 +1,23 @@
+# PR29 AST integration tested; eighth dual verification running
+
+Authoritative2026-11-09. User approved ASTredesign(focusedreview beforefinalfullsuite), then resumed; continue withoutreasking in-scopefixapproval. This supersedes ast-redesign-started state. No sourcecommit/pushyet: repo /tmp/codegraph-cjs-missing-fix-20261108 branch fix/commonjs-eval-callee-context HEAD87576a8d9ff0d8aba235db5535f5f4429f14b037,15dirtysourcepaths(allnewfilesintent-to-add) plus private.review. PR29stillDRAFT87576a8d/base5d384989(PR28); PR28stillDRAFT5d384989/base5e066489(main/em40). No merge/deploy/upstream writes, T0originalQAremainsstopped/uncommitted.
+
+## What changed and tested
+
+ASThelper src/extraction/commonjs-eval.ts reads actualcall.function afterparenthesisunwrapping, handlesJSgrammar'snongenerator yieldoperand ambiguity viafunctionscope. Returns true/false/null(errorunknown). OptionalExtractionResult.commonJsEvalCall carriesfact; WASM computesfromexistingtree, native extractFromSource andrawparseworker computewithalreadyloadedgrammar whenrelevant, kernelmaterialize preservesflag. No grammar/dependency/schema changes.
+
+EphemeralFileRecord.commonJsEvalCall carriesfact throughALLexistingfile-store paths(standardwriter/kernelwriter/mainfast/mainchunked). QueryBuilder.upsertFile stores JSON{contentHash,value} underproject_metadata commonjs_eval:<file>; deleteFile removesfact. No secondDBwriter, Node.metadata abuse, schema migration or giantnewcoordinatorcache. QueryBuilder.getCommonJsEvalCall acceptsbooleanonlywhenexactsourcehashmatches; missing/stale/null/malformedunknown. ResolutionContext capability hashescurrentreadsource viaexistingcreateHash(SHA256) andreadsmetadata. Matcher supplieslazyfactgetter toexistingexportmembertokenizer. OldliteralEvalCall/EXPRESSION_PREFIX_WORDS/prefixgrammarheuristics removedentirely. Getterconsultedatmostoncewhenbareevaltokenpresent; unknownneverfalseabsenceproof. Existingnamespace memo/typeFrom/scope behaviorunchanged. CHANGELOG56 alreadyrequiresre-indexafterupgrade(newfacts); nolegacyfactmigrationpromise.
+
+Failbefore5newgraphcases5FAIL51SKIP. ASTunit33PASS. Firstintegrationcompilerfailed wronghashContentimportfromutils; corrected with existingcrypto createHash, avoidingcircularimportfromextraction/index. Final3corefiles140PASS. Expandedfinal8files166PASS1SKIP: CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2 npx vitest run __tests__/commonjs-eval.test.ts __tests__/commonjs-eval-facts.test.ts __tests__/commonjs-export-members.test.ts __tests__/js-default-binding-members.test.ts __tests__/name-matcher-memo-clears.test.ts __tests__/sync-memo-lifetime.test.ts __tests__/lazy-engine.test.ts __tests__/kernel-retry-materialize.test.ts --maxWorkers=4, /tmp/codegraph-cjs-ast-expanded.log EXIT0. RealSQLite tests covermissing/malformed/null, stalehash/replace,rollback,deletion. Actualfreshindex-v-sync sequencewrapper->if-eval->yieldwrapper->for-eval->wrapperagrees onallsteps. Worker2 testpathfreshstoreactive, lazy/memospass. Native .node NOTstaged(codegraph-kernel/prebuilds/linux-x64/codegraph-kernel.node absent), kerneltransporttestskipped; no nativeexecutionclaim.
+
+No explicitnormalnpmrunbuild/fullsuiteforthisdirtycorrectionyet; old10666fullPASSbelongs87576a8donly. Enginecurrentdistwascompiledsuccessfullybyfocusedtestsetup andreflectsfrozen source. No tests/buildrunning; sourcefreeze /tmp/codegraph-cjs-ast-frozen.json maps15pathsSHA256, matchesdurablebackup.
+
+## Eighth native verification RUNNING
+
+FreshREADONLY /root/review_broad_pr29_ast8 and /root/review_adversarial_pr29_ast8 launched, userauthorizedbyacceptedredesignplan+resume. GatherACTUALfinalresults beforeclearance. EXACTtarget `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 87576a8d9ff0d8aba235db5535f5f4429f14b037 -- src/types.ts src/db/queries.ts src/extraction/commonjs-eval.ts src/extraction/tree-sitter.ts src/extraction/parse-worker.ts src/extraction/kernel/index.ts src/extraction/index.ts src/resolution/types.ts src/resolution/index.ts src/resolution/name-matcher.ts src/resolution/commonjs-export-members.ts __tests__/commonjs-eval.test.ts __tests__/commonjs-eval-facts.test.ts __tests__/commonjs-export-members.test.ts __tests__/js-default-binding-members.test.ts`. Sameledger /tmp/codegraph-cjs-missing-fix-20261108/.review/commonjs-eval-callee-context.md latestASTintegrationsection, fullhistoryreferenced. Overallround8honest/noreset orcontrolstate edits. No Claude-onlyskillclaim. Bothboundedexecutionprobes,currentdist,no sourceedits/build/fullsuite/repeatedbroadparentaudit; no subagents. Nativeunavail/disclosureand reindexrequirementbriefed. Don'trereadentirediff/reverifyreviewfindingsyourselfmerelytoduplicate; mergeactualfindingsandstopifissues.
+
+Remaining: collectbothreviewresults, saveevidence/ledger; ifclear andsourceunchanged, runexplicitnpmrunbuild thenfullnormal CODEGRAPH_KERNEL=0 npm test -- --maxWorkers=4 once(~13min),regularupdatesunder60sec. No --minWorkers(Vitest4unsupported). Ifnewdefectreportpreservereprosanduserdecision,ratherthananotherunaskedcorrectionloop. Ifactualhostgate/auto-reviewdenies, stop/askwithreason; nobypass. Currentlaunchessucceeded. Beforelocalcommit/pushfix toexistingPR29verify repo/personaloriginidentity/stagedexactfiles/hashes/tests. Keepdraftuntilrequiredreviewclear; noautomerge/deploy/officialupstream. Userper-stepconfirmationboundaryappliesbeyondthisapprovedredesignphase.
+
+## Durable checkpoint
+
+OriginalQA .review/commonjs-fix-2026-11-08/ast-integrated-review8-2026-11-09/ containsall15sourcefiles, correction.patchrelative875, manifest, focusedlogs(includingcompilerfailureandactual166PASS), ledger andrunning.json. Priorast-redesign-started backupholds5RED/33ASTPASS/probes; priorpr29-review-round7 holdsbothactualP2reports; prior two-draft-prs holdsfullpriorlogsandverifiedtwo-branchgitbundle. BothpublishedbranchesonGitHub, so notmp-onlyloss. Savefinalreview/fullmetadatahereaftersuccess. OriginalQAcontrol/deployworktreesuntouched. Personalorigininth3shadows/codegraph; EricMinish/eric.minish@gmail.com recheckbeforecommit. NoAIattribution. Issue27CommonJS,26separateexternalimportoutofscope; QA PR27unrelatedevidence. TuesdayNov10 officialreportconditionalonverification/duplicatecheckandusergoahead,notnow.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-ast-redesign-started-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-ast-redesign-started-2026-11-09.md
new file mode 100644
index 0000000000..20cf17f594
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-ast-redesign-started-2026-11-09.md
@@ -0,0 +1,42 @@
+# PR29 AST redesign approved: helper33PASS, integration pending,5graphregressions RED
+
+Authoritative2026-11-09. User approved recommendedASTredesign inPR29, explicitly asked start with reliable resume because nearusage max, then said proceed. Resume without re-asking this remediation approval. This supersedes review-only stop in prior handoff. No further bug hunting/features. User still requires confirmation before subsequent merge/deploy phases. No automatic resume timer; next user resume should continue here.
+
+## Current checkout and external state
+
+Repo /tmp/codegraph-cjs-missing-fix-20261108 branch fix/commonjs-eval-callee-context HEAD87576a8d9ff0d8aba235db5535f5f4429f14b037. Three dirty source paths ONLY: new src/extraction/commonjs-eval.ts, new __tests__/commonjs-eval.test.ts (both intent-to-add), modified __tests__/js-default-binding-members.test.ts. Old lexical src/resolution/commonjs-export-members.ts and matcher remain unchanged, so known bugs persist. Private.review untracked. No new commit/push/grammar/runtime/dependency/schema changes. PR29 DRAFT https://github.com/inth3shadows/codegraph/pull/29 still87576a8d, base5d384989957c91b482068b306535437915a0595b(PR28). PR28 https://github.com/inth3shadows/codegraph/pull/28 remains DRAFT at5d384989, base main5e066489(em40). Neither merged/deployed. Personalorigin inth3shadows/codegraph, EricMinish/eric.minish@gmail.com (recheck beforefuturecommit).
+
+## Approved design and actual completed work
+
+Replace token-prefix/keyword guesses for eval with actual ASTcallee classification. Keep existingtokenizer for exportwrites. Add small extractionhelper and feed fact to resolver. Preserve all prior aliases/sync/scope/Python behavior. No parser/grammar dependency bump.
+
+Five meaningful fail-before graphcases added to js-default-binding-members.test.ts: ifbodystring/template, singleiteration for nestedgroups, CommonJS wrapperfunctions namedawait/yield. Actual CODEGRAPH_KERNEL=0 npx vitest run __tests__/js-default-binding-members.test.ts -t 'unbraced control body|CommonJS wrapper' --maxWorkers=1 EXIT1,5FAIL51SKIP. /tmp/codegraph-cjs-ast-red.log. Still RED intentionally because integration not done; don't weaken expectations.
+
+New src/extraction/commonjs-eval.ts (~40lines) exports hasCommonJsEvalCall(root:SyntaxNode):boolean|null. PureexistingASTread, no parsercreation/state. Checks call_expression.function, unwraps parenthesized_expression, matches identifier eval. Any actual argument can be dynamiccode; null means parseerrorspreventabsenceproof. Iterativewalkcurrently pending.push(...node.namedChildren); consider ordinary for-loop if adjusting traversal, don't add unrelatedhardening. New __tests__/commonjs-eval.test.ts33PASS in20.63s (includes automatic enginebuild), /tmp/codegraph-cjs-ast-helper.log. Covers both reports, literals/templates/return, generatorfunction/methodscope, nestednongenerator scope, real evalinsideyieldwrapperargument, inerttext/method/membercalls, TS/TSX/JSX and malformedsource. No explicit finalnormalbuild/fullsuite/review for currentdirtycode. Old full10666PASS belongs87576a8d only. No active test/build/reviewer processes at this checkpoint.
+
+## Crucial grammar and integration evidence (do not rediscover)
+
+ASTshapeprobe /tmp/codegraph-cjs-ast-shape-probe.{cjs,log}: controlbodyeval and awaitwrapper parsed correctly. BUT existingJSgrammar parses legal nongenerator CommonJS yield(eval)(code) as yield_expression with operand call_expression(function:parenthesized_expression(eval)), no syntaxerrors. User was told this caveat explicitly. Helper isolates workaround: only directcalloperand of yield_expression is suppressed outside nearestgeneratorfunction/method; real nested eval in yield(eval(code)) is preserved. No grammarfiles changed. Do not claim entireproblem has no grammarlimitation. Classify by AST and generator scope, not another punctuation/keyword whitelist.
+
+Existingcall-referenceprobe /tmp/codegraph-cjs-eval-reference-probe.{cjs,log}: genericextractor emits referenceName eval for truecall AND this syntheticyieldwrappercase, awaitwrapper correctlyawait. Thus simply querying unresolved eval refs is insufficient.
+
+Extractionintegration already inspected:
+- src/extraction/tree-sitter.ts: extract() parses at~1028, createsfileNode1042, visitNode1070, freesAST in finally~1117, returnsExtractionResult~1126. Can compute fact from thisexistingAST beforedelete.
+- extractFromSource at9977 routes nativekernel tryKernelExtract at~10040; WASMclassfallback only whenkerneldefers. Sharedpost-step needed for nativefacts. src/extraction/parse-worker.ts:~97 tryKernelExtractRaw can bypass extractFromSource entirely; returns emptyarrays+kernelbuffers, sendsresult by structuredclone, then resetsparser periodically. Must cover deferred nativeworkerpath, not just mainWASM.
+- src/extraction/index.ts: bulk parseFile~2618 dispatchesworkers; in-processfallback loadsgrammars at2589, BUT poolmode loadsgrammars in workers only. Resolver cannot assume getParser(main) initialized. Fullsyncpreloads changedlanguages locally~4051. StoreResult~2651 sendswriterbundles OR callsstoreExtractionResult~3319. Native materializeKernelResult may stripaddedproperties ifnotexplicitpreserved; inspect it beforeintegration. Storewriter drain/close~2921-2942; pooldestroy~3103. indexFile storesresults~3261/3283. Sourcefacts must follow successfulstore, includingwriterworker andincrementalsync.
+- src/types.ts Node has NOmetadatafield; only Edge.metadata. Do not abuse node signature, edge/selfrefs or candidates totransportfacts. ExtractionResult at315 can gain optionalfact. Existingproject_metadata table andQueryBuilder getMetadata/setMetadata support sourcehash-keyedfact withoutschema migration; evaluate a small consistenttransport/lifecycle, don't scatter ad-hocDBwrites whilewriteractive. May aggregate workerfacts andflush afterwriterclose; syncmustupdate/remove stalefacts too. Could also useexplicitresolutioncontext capability; keepfactprovenance/sourcehash invalidation.
+- resolver context src/resolution/index.ts createContext~862, getNodesInFile~889; typesinterface src/resolution/types.ts. Matcher defaultModuleNamespace~25420 calls readCommonJsExportMembers~25443. Existingmodulememo/typeFrom invalidation alreadyhandlesJSsync andforwarderfiles; retain it. PasslazyASTfact capability toreader and remove old literalEvalCall/EXPRESSION_PREFIX_WORDS entirely oncewired. Missing/stale/errorfacts must not be falseabsenceproof. Oldindexesneeddefinedcompatibility/reindex behavior; no quiet unsafefallbackguess.
+
+## Next steps on resume
+
+1. Read latest .review/commonjs-eval-callee-context.md (includes fullhistorypointer); keep original5graphREDtests and33ASTunit controls.
+2. Integrate factualcallee result across WASMextractor, native/deferredworker transport andsuccessfulstore toresolver withsourcehash/sync freshness. Do not changegrammars. Keep this small and modular; no database-schema or production work without reason. Ifnativecannotbeexecuted, report limitation honestly.
+3. Adapt exportreader unit tests to supplyrealASTfact; remove manualevaltokenprefixguessing. Run targeted AST/exportreader/defaultbindingtests, expecting5newgraphcasesgreen and allpriorcontrolsunchanged. Addfresh-index-vs-sync transitions for actualeval<->wrapper; cover workerpath, JS/TS/JSX language support anderror/unknownfacts.
+4. Only oncefocusgreen, run boundedfreshnative dualverify perapprovedplan/actualhostgate; overallroundcountalready7, no resets or controlfile edits, stop/ask ifdenied. No full/build reruns byreviewers. Then normalbuild/fullsuite oncefinalstable. Don't useoldgreen result ascurrentclearance. Usernearquota, usefork_turns=none, compactbriefs andregularupdates.
+5. Checkrepo/remote/identity/stagedexactdiff/tests, commit/pushfix toexistingPR29 onlywhenreview/verificationactuallysufficient; keepdraftuntilreviewclear. Saveactualresults/progress. Don'tmerge/deployorpostofficialupstreamwithoutnextgo-ahead.
+
+## Durable recovery
+
+OriginalQA .review/commonjs-fix-2026-11-08/ast-redesign-started-2026-11-09/ contains all3dirtysourcefiles, started.patchrelative87576a8d includingnewfiles, AST/referenceprobe scripts/logs,5graphRED/33ASTPASSlogs, bothledgers,verification.json/checksums.json. Adjacentpr29-review-round7 backupcontainsactualtwoP2reviewreports/evidence; adjacenttwo-draft-prs backuphascompletepriorfull log andverifiedgitbundle recoverableagainstbase5e. BothpublishedbranchesareonGitHub. No lossif/tmpdisappears.
+
+OriginalQA T0pilotremainsstopped/uncommittedanduntouched; liveem40unchanged. Personalissue27CommonJS, issue26separateexternalimportbug outofscope, QA PR27unrelatedevidence. TuesdayNov10 upstreamreportstillconditionalonverification/duplicatecheckanduserapproval. Preservecontrol/deployworktrees; noAIattribution.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-ast-review8-two-findings-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-ast-review8-two-findings-2026-11-09.md
new file mode 100644
index 0000000000..e0c763cb33
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-ast-review8-two-findings-2026-11-09.md
@@ -0,0 +1,31 @@
+# AST integration built and focused-tested; eighth review found F10/F11, user decision pending
+
+Authoritative2026-11-09. Supersedes ast-integrated-review8-running and ast-redesign-started statuses. User approved ASTredesign and resumed; implementation+focusedverification done, then two fresh read-only lanes BOTH COMPLETED with2P2. Stop before anothercorrectioncycle, additionalreview, fullsuite, commit/push/merge/deploy; userper-stepconfirmation and dual-reviewstopboundary. No automaticcorrectionloop. Priorapprovalcoversexistingworkbut don'tinterpretresumeasindefinitenewiterations.
+
+Checkout /tmp/codegraph-cjs-missing-fix-20261108 branch fix/commonjs-eval-callee-context HEAD87576a8d9ff0d8aba235db5535f5f4429f14b037.15dirtysourcepaths(allnewfilesintent-to-add), private.review untracked. No newsourcecommit/push. PR29 DRAFT https://github.com/inth3shadows/codegraph/pull/29 stays87576a8d, base5d384989(PR28); PR28 DRAFT https://github.com/inth3shadows/codegraph/pull/28 stays5d384989, base5e066489(em40main). Neithermerged/deployed. Personalorigininth3shadows/codegraph, EricMinish/eric.minish@gmail.com recheckbeforeanyfuturecommit. T0originalQAremainsstopped/uncommitted/untouched, liveem40unchanged.
+
+## Implemented source (still uncommitted)
+
+New commonjs-eval ASThelperusesactualcall.function, unwrapsgroups, distinguishesnongenerator yieldwrapperfromgeneratoryield viaancestry; true/false/nullfact. ExistingJSgrammar indeedhascontextualyieldlimitations, userhasbeentold; no grammarfiles/runtime/dependencieschanged. WASMextractorcomputesfromexistingtree; native extractFromSource + deferredparseworkercomputeusingexistingloadedgrammar, native materializerpreservesproperty. OptionalExtractionResult.commonJsEvalCall -> ephemeralFileRecord.commonJsEvalCall throughallstorepaths includingnativebufferstoreworker. DB upsertFile storesproject_metadata commonjs_eval:<path> JSON{contentHash,value}; deleteFile removesfact. No schemamigration orsecondDBwriter. ContextgetCommonJsEvalCall hashescurrentreadsourcewithSHA256 andacceptsonlyexactsourcehashboolean; missing/stale/error/malformedunknown. Readeruseslazyfactonceperfilewhenbareevaltokenpresent; oldliteralEvalCall/EXPRESSION_PREFIX_WORDS removed. Existingtokenexportmemberreader/typeFrom/sync/scope unchanged. CHANGELOG56alreadyrequiresreindexfornewfacts, nolegacyfactmigrationpromise.
+
+Newtests: AST33, realSQLitefactlifecycle4, existingexportreadernewunknownfactcase, graphoriginal5regressions and fresh-v-syncwrapper->if-eval->yieldwrapper->for-eval->wrappersequence. Finalfocused8files166PASS1SKIP, /tmp/codegraph-cjs-ast-expanded.log EXIT0, CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2; includesmemos/sync/lazyengine. Actualnative.nodeNOTSTAGED; nativekerneltransporttestskipped. No nativeexecutionclaim. Enginecompiledbytestsetup. FirstintegratedcompilerfailedwronghashContentimport; correctedusingexistingcrypto createHash, no circularextractionindeximport. Prior3corefiles140PASS. No explicitnormalnpmrunbuild/fullsuiteafterthesechanges; don'treuseold10666fullPASS(87576a8donly).
+
+## Eighth dual review ACTUAL findings
+
+Both review_broad_pr29_ast8 and review_adversarial_pr29_ast8 completednormally againstexact87576a8d..workingtree15paths, sameledger .review/commonjs-eval-callee-context.md latestsections. No sourceedits/rebuild/fullsuite/networkwritesbyreviewers. Allfrozen15sourcehashesverifiedunchanged /tmp/codegraph-cjs-ast-frozen.json. Do notclaimclearance/readyforcommit. Parentusesreviewerreportswithoutduplicateprobes/diffreview.
+
+F10 P2, adversarial, src/extraction/commonjs-eval.ts:37: validCJS exports.known=function known(){}; function yield(value){return function ignore(code){};} yield?.(eval)("ignored"); runtimeonlyknown/noevalinvocation. Grammarparseerror=>factnull=>readeruncertain=>named.missing() falselycallsdecoy.js:Decoy::missing. Base87576a8dreaderrestoredinmemoryreturnsuncertainfalse/nocall; thisisnewASTregression. Evidence /tmp/cg-a8-yield-optional.{cjs,log}, /tmp/cg-a8-yield-optional-base.{cjs,log}, /tmp/cg-a8-probe.cjs. Unknownfactsdon'tproveabsencebutmustnotlicenseinventedcalltargets; defineexplicitresolutionpolicyforsyntaxunknowninstead ofanotherlexicalguess.
+
+F11 P2, broad, src/extraction/commonjs-eval.ts:51: computedmethodnamesexecuteinenclosingscope, notnewmethodscope. Twoactualruntime/indextraces:
+1.class Store{load(){return 42;}} + function* setup(){const obj={[yield (eval)('exports.load = Store.prototype.load;')](){}};} setup().next(); runtimeexportsload42; factfalse/uncertainfalse, graphnamed.load nocall.
+2.exports.known=function known(){}; function yield(value){return function ignore(code){return 'x';}} const obj={ *[yield(eval)("ignored")](){} }; runtimeonlyknown; facttrue/uncertaintrue, named.missing=>Decoy::missing. Onecausebothdirections. Evidence /tmp/cg-broad-pr29-ast8-computed-scope.{cjs,log}. Scopefixmustnotattributecomputedkeytonewmethod; preservegeneratorbodies/parametersandnestedfunctioncontrols.
+
+## Next boundary
+
+Reporttwofindingsandsavecheckpoint; askuserbeforeanotherremediationcycle. Ifapproved, addbothprovenregressiontypesfirst, fixscopeboundaryandunknownfactfallbackcoherently, preserveprevious5graphcases/166checks/aliases/sync/Python. Avoidanotherwhitelist/parserguess. Nofullsuiteuntilfocusedreviewclearandstable; runnormalbuild/fullonceafterward, notonknowndefectivecorrection. Freshnativeverifyonlywithappropriateapproval/actualgate, overallcount8honest,noresets/controlchanges. Nativebinaryunavailablelimit remains. Don'tlaunchunaskedagents, fixseparateissue26 orstartT0.
+
+## Durable recovery
+
+OriginalQA .review/commonjs-fix-2026-11-08/ast-integrated-review8-2026-11-09/ containsall15sourcefiles, correction.patchrelative875(includeintent-to-addnewfiles), frozenmanifest, compilefail/140green/166greenlogs, bothledgers, allreview8reproscripts/logs, merged-review.md,review-result.json,checksums.json; running.jsonmarkedCOMPLETEDnofinalclearance. Prioradjacentbackupsretainstart5RED/33ASTPASS andreview7twofindings; publishedbranches+verifiedtwo-branchbundlein two-draft-prsbackup recoverparentcommitsagainst5e. No lossif/tmpdisappears. No test/build/reviewerprocessesrunning.
+
+No grammar/schema/dependencychanges. No newcommits,pushes,PRcomments,markready,merge,deployment orofficialupstreamreportthisphase. TuesdayNov10upstreamconditionalonverification/duplicatecheckandusergoahead,notnow. Personalissue27CommonJS,issue26separateexternalimportoutofscope,QA PR27unrelatedevidence. Preservecontrol/deployworktrees,noAIattribution.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-dual-review-two-findings-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-dual-review-two-findings-2026-11-09.md
new file mode 100644
index 0000000000..605963ea58
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-dual-review-two-findings-2026-11-09.md
@@ -0,0 +1,17 @@
+# PR29 dual review completed: two P2 findings; user decision required
+
+Authoritative2026-11-09. User invoked /dual review29. Review complete, not cleared; STOP before fixes/newreview/markready/merge/deploy. No source changes, commits, pushes or external review comments during this read-only turn. Both PR28 and29 remain draft/unmerged. Prior user asked confirmation before next step.
+
+PR29 https://github.com/inth3shadows/codegraph/pull/29 base5d384989957c91b482068b306535437915a0595b (fix/commonjs-missing-member/PR28) head87576a8d9ff0d8aba235db5535f5f4429f14b037 (fix/commonjs-eval-callee-context). GitHub metadata confirmed exact. Checkout /tmp/codegraph-cjs-missing-fix-20261108 remains at87576a8d, tracked clean, only private.review untracked. Source manifest /tmp/codegraph-cjs-followup-frozen.json rechecked unchanged.
+
+Fresh read-only native agents review_broad_pr29_round7 and review_adversarial_pr29_round7 BOTH COMPLETED normally. Same exact target and ledger .review/commonjs-eval-callee-context.md, referencing full .review/commonjs-missing-member.md. Seventh overall native round, no gate reset/bypass; user explicitly requested this round. Do not claim Claude-only /code-review ran. No extra full/build runs: prior101focusedPASS/full10666PASS2expectedFAIL448SKIP0unexpectedFAIL/buildPASS are valid on same source, but miss findings below and cannot clear review.
+
+F9 NEW P2, BOTH independently: helper src/resolution/commonjs-export-members.ts:31 rejects all preceding closing parentheses, including an unbraced control condition. `class Store { load(){ return 42; } }` followed by `if (true) (eval)('exports.load = Store.prototype.load;');` genuinely exports load returning42, but reader uncertain:false and named.load() produces no graph call. Removing only PR29 prefix guard in memory restores uncertain:true and m.js:Store::load. Grouped-template if and single-iteration unbraced for reproduce. Broad /tmp/cg-broad-pr29-control-context.{cjs,log}; adversarial /tmp/codegraph-cjs-adversarial7-conditional-eval.{cjs,log}.
+
+F8 RESIDUAL P2, adversarial: helper:29 / whitelist:7. Valid CommonJS exports.known=function known(){}; function await(value){return function ignore(code){};} await(eval)("ignored"); merely passes eval, yet keyword exemption makes uncertain:true and named.missing() falsely calls decoy.js:Decoy::missing. Runtime onlyknown; pre-F7 literal check in memory yields no call. yield wrapper same. /tmp/codegraph-cjs-adversarial7-contextual-wrapper.{cjs,log}. F8 status PARTIALLY CORRECTED/OPEN, not closed globally. Prior F8 original wrap(eval) and wrap((eval)) forms are independently CLEARED by both; adversarial13runtime graph controls passed. Broad /tmp/cg-broad-pr29-f8-closure.{cjs,log}; adversarial /tmp/codegraph-cjs-adversarial7-controls.{cjs,log}.
+
+Primary ledgers updated with exact de-duplicated findings, attribution/rulings/invariants and stop boundary. Durable original QA .review/commonjs-fix-2026-11-08/pr29-review-round7-2026-11-09/ holds scripts/logs, merged-review.md, both ledgers, review-result.json and checksums.json. running.json marked both complete. Prior adjacent two-draft-prs backup has current source, complete full log, verified two-branch gitbundle/base5e prerequisite and exact verification metadata. Both branches are on GitHub; no loss if /tmp disappears.
+
+Next: final report only these two findings and stop for user decision. If asked to remediate, don't iterate another broad keyword/punctuation whitelist: repeated patches demonstrate a syntax-context boundary problem. Use concrete repros and small coherent design; preserve genuine control-body/grouped/template eval and no captures for eval merely passed as a value, plus settled prior aliases/sync/scope/Python invariants. No more reviews or full suites on unchanged source. Respect per-step approval/sharedgate and quota; no state resets. No unasked feature work or separate issue26 fix.
+
+Original QA T0pilot stays stopped/uncommitted, live em.40 unchanged. No merge/deploy/upstream report. TuesdayNov10 official upstream report remains conditional on verification/duplicate check and user go-ahead. Personal issue27 CommonJS; issue26 separate externalimportbug; QA PR27 evidence unrelated to sourcePR28/29. Preserve all control/deploy worktrees.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-evidence-prototype-complete-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-evidence-prototype-complete-2026-11-09.md
new file mode 100644
index 0000000000..ede4cd859b
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-evidence-prototype-complete-2026-11-09.md
@@ -0,0 +1,46 @@
+# PR29 isolated evidence prototype COMPLETE — production unchanged
+
+Latest authoritative checkpoint. User approved an isolated prototype and acceptance tests after round10, then explicitly said save progress as you go. This authorized experimental files only, not production integration, another review, builds/fullsuite, commits/pushes/merge/deploy. No scheduled continuation. Preserve checkout and all dirty work.
+
+## Workspace and state
+
+Production /tmp/codegraph-cjs-missing-fix-20261108, branch fix/commonjs-eval-callee-context, HEAD87576a8d9ff0d8aba235db5535f5f4429f14b037. All15 dirty source/test hashes match the round10 manifest throughout and at completion; no production changes this phase. F12 equivalent-assignment variants and F13 shadowed-module regression remain OPEN in production. Original F12/F10/F11 controls remained cleared at prior snapshot; this experiment is not a new production review. Review count10, no resets.
+
+Prototype is durable at:
+/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-evidence-prototype-2026-11-09
+
+Files: README.md (contract/limits), bindings.cjs, evidence.cjs, runtime.cjs, bindings.test.cjs, acceptance.test.cjs, measure.cjs, progress.json, results.json, measurements.json, artifact-sha256.json; milestone source snapshots and all actual TAP logs. Original QA T0 files untouched; only its allowed private .review directory used. Nothing committed/published. Personal identity/publication boundaries from session-end handoff still apply.
+
+## Actual results
+
+- Milestone1:13 binding/parser tests passed.
+- Acceptance baseline stub:49FAIL/5PASS.
+- Initial reducer:21PASS/33FAIL exposed a compiler API mismatch. getSymbolAtLocation sometimes returns inferred CJS export symbols for assignment uses, not lexical wrapper parameter identity. Added2failing regressions, verified checker.resolveName(name,node,Value,false) gives lexical identity, then15binder+54acceptancePASS.
+- One bounded semantic-boundary pass:8FAIL/55PASS, then63acceptancePASS after modeling shared binding cells, var redeclaration, actual prototype links, indirect/optional eval distinction and explicit unsupported class-prototype replacement. No test expectations weakened.
+- Final combined run:78PASS,0FAIL,0SKIP, final-tests.tap. All6current.cjs files passed node --check. No repository build/fullsuite or new independent reviewers.
+- Small147-byte fixture measurements: model/compiler cold import249.23ms, heap delta17.07MiB; warm median direct1.25ms/forwarded1.70ms,50samples each. These are not CodeGraph indexing/large-repo/cache/worker/native measurements.
+
+Test command from prototype directory:
+node -e 'require("./bindings.test.cjs"); require("./acceptance.test.cjs")'
+Measurement: node --expose-gc measure.cjs
+Requires existing TypeScript5.9.3 dev installation in checkout; CODEGRAPH_PROTOTYPE_REPO can point at another checkout with it installed. No dependency install occurred.
+
+## What is established
+
+TypeScript compiler lexical identities distinguish wrapper module/exports bindings from local function/arrow/block/var/TDZ/destructured/catch/loop bindings. Structural parsing handles reviewed parenthesized/bracket/logical assignments. Bounded reducer follows object identity/order and real declarations; no global method-name search. Results have resolved/absent/unknown statuses, proof steps/ranges, dependency source hashes and analyzer version. Controlled runtime fixtures provide separate CommonJS semantics witnesses. Equivalent-syntax/shadow/decoy properties, direct+forwarded imports, and in-memory update=fresh analysis are pinned.
+
+## Limits / stop condition
+
+This became a small symbolic evaluator; do NOT port it wholesale as a narrow matcher correction. Generator execution, including genuine F11 generator eval, is explicitly unknown. Only controlled JavaScript fixtures exercised. Other unsupported operations return unknown; this is not complete/sound arbitrary ECMAScript analysis. No CodeGraph node-ID mapping, graph edges, real sync/persistence/cache/worker/native validation. TypeScript remains a development dependency; runtime use needs packaging/performance approval. Production compatibility is NOT cleared.
+
+## Recommended next decision (not approved implementation)
+
+Keep prototype as offline reference corpus. Define one binding-aware production export-fact contract before integration:
+1. Per export/member, preserve positive relationship to declaration/type selectors and source ranges; retain wrapper binding identity and forwarding path. File-level flags never authorize global guesses.
+2. Separate positive evidence from completeness/unknown reasons. Missing/stale/version-mismatched facts supply no absence proof or target identity. Source hash plus producer version identify facts.
+3. Model graph relationships as static potential relationships with provenance; do not accidentally promise this prototype's exact module-initialization execution semantics. Assignment order, conditional mutations and eval support need explicit rules.
+4. Decide how literal eval in generator scope produces supported positive evidence while retaining F10/F11. The current closed evaluator does not meet this requirement. Arbitrary eval support must not be inferred from a boolean.
+5. Choose a single fact producer and migrate competing export readers (token reader, extraction helper, import-resolver regex) into consumers or retire them. Runtime compiler dependency vs existing parser needs a measured decision; do not invent another regex binder.
+6. Production acceptance includes current full regression corpus plus binding/operator/scope transformations, real index/sync/worker/store paths, and documented native check limitation until binary available. Final normal build/fullsuite once after stable independently reviewed integration, within actual user approval.
+
+No additional implementation is approved. Report prototype result and limitations; ask before production integration or further review. Read README/results rather than rerunning completed checks without a new reason.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-evidence-prototype-progress-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-evidence-prototype-progress-2026-11-09.md
new file mode 100644
index 0000000000..2e778d0fc6
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-evidence-prototype-progress-2026-11-09.md
@@ -0,0 +1,16 @@
+# Isolated prototype — milestone 1 saved
+
+User approved prototype only and explicitly requested save-as-you-go. Workspace: /home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-evidence-prototype-2026-11-09. Production 15 source hashes unchanged; no integration/build/fullsuite/review/publication.
+
+Milestone1: bindings.cjs uses installed TypeScript 5.9.3 Compiler API with synthetic CommonJS wrapper, getSymbolAtLocation identity and noLib/noResolve virtual source host. bindings.test.cjs has13passing tests, milestone1-bindings.tap. Eight shadow variants (fn/arrow/block/var/TDZ/destructured/catch/loop) differ from wrapper binding. Five F10/F11/F12 syntax fixtures parse cleanly. No new production dependency installed.
+
+Next: bounded reducer + acceptance tests/proof paths, using compiler identities. Explicit supported subset and unknown policy required; do not turn this into a full interpreter. Controlled fixture runtime oracle allowed, repo source never executed. Final prototype must state compatibility limits (especially generator eval) and does not prove CodeGraph/native/sync integration. See approved plan-codegraph-pr29-evidence-prototype-2026-11-09.md and progress.json.
+
+## Milestone2 saved
+Initial acceptance stub49FAIL/5PASS; first reducer21PASS/33FAIL exposed getSymbolAtLocation inferred-CJS symbol mismatch. Minimal probe proved checker.resolveName(name,node,Value,false) resolves lexical wrapper identities. Added2regressionsfirst(2FAIL13PASS), updated the binding interface: now15binderPASS and54acceptancePASS. No acceptance weakened. Snapshot milestone2-passing-source/; actual logs/progress.json durable. Prototype bounded AST reducer with object identity/order, local calls, literal assignment-only eval and direct forwarding; unsupported constructs return unknown. Generator execution (F11 genuine eval) deliberately unknown; this is an integration blocker, not a clearance. No CodeGraph graph/native/sync integration claimed. Next bounded boundary-test pass + measurements/limitations, then stop/report. Production hashes unchanged.
+
+## Milestone3 saved
+One bounded semantic-boundary pass added9cases; actual8FAIL55PASS then63acceptancePASS. Shared binding cells correct closure/block writes; var redeclaration no longer resets wrapper. Indirect and optional eval return unknown (cannot use caller bindings); direct assignment-only literal eval still works. Instances reference actual prototype objects, so later prototype-method writes retarget. Class prototype replacement explicitly unsupported. No expectations weakened. Snapshot milestone3-passing-source/, before/after logs durable. Next final combined78tests, syntax checks, small-fixture benchmarks and limitations/report. Production hashes unchanged. This is already a bounded symbolic evaluator, so do not propose porting it wholesale as a small production fix.
+
+## Complete
+Superseded by /home/ericm/.codex/plans/handoff-codegraph-pr29-evidence-prototype-complete-2026-11-09.md. All78tests and6syntax checks passed. All sources/logs/measurements/results saved. Production source hashes unchanged. No integration/review/publication.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-export-evidence-integrated-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-export-evidence-integrated-2026-11-09.md
new file mode 100644
index 0000000000..6cf305dee9
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-export-evidence-integrated-2026-11-09.md
@@ -0,0 +1,22 @@
+# PR29 production export-evidence integration tested; independent review pending
+
+
+## Shared production export evidence integrated — focused verification complete
+
+User said "ok run it" after clarification that integration remained unfinished. Authorized production implementation in preserved checkout; no new review or publication in this turn. New binding-aware source record is now used by import resolution and the name-matching guard. F12 equivalent assignments and F13 export/caller shadowing corrected + focused tested, NOT independently cleared. Overall review count remains10.
+
+Implementation: src/resolution/commonjs-export-evidence.ts uses established TypeScript checker.resolveName binding identities and type/member declaration selectors. It handles structural parenthesized/bracket/logical assignments, direct callable aliases, exported class/object/instance members, relative forwarding, and direct literal eval analyzed in its lexical context by a synthetic arrow body. This records static potential relationships without generator execution; genuine F11 generator eval passes beside unrelated methods. Local module/exports/eval bindings and caller parameters/classes are distinguished. Unknown behavior supplies no target. Selector ranges map only to indexed declarations, no global name guess.
+
+The source-hash/versioned record is computed lazily during resolution, memoized by context/file/source, and cleared with resolver caches. No new metadata writer/schema/grammar. Import resolver's CommonJS default regex is replaced by record consumption. All CJS positive member targets resolve through the record before fallback; a CJS binding cannot authorize a global method-name guess. Early import edges preserve typeFrom source/forwarder dependencies. Existing AST eval fact pipeline and tokenizer unit helper were preserved; tokenizer is no longer the production fallback authority. Extraction's existing export-name helper remains node naming, not authorization of these call targets.
+
+TypeScript5.9.3 is promoted from development to runtime dependency (^5.9.3); package lock refreshed offline, npm ls --omit=dev confirms presence. Compiler is required only when analyzing source, not by loading the helper/library/read CLI. Final7lazy tests outside sandbox PASS (same known Node child-pipe EPERM reason as earlier runs).
+
+Actual verification history:14newgraph regressions FAIL before;14PASS after first integration. Expanded10files initially236PASS30FAIL1SKIP from missing dependency metadata (stale sync), object-method node-kind mapping and parenthesized eval arguments; corrected to266PASS1SKIP. Neighbors initially356PASS2FAIL (caller parameter/class shadowing); added compiler-bound call-site receiver facts. Final combined19files624PASS1SKIP, /tmp/codegraph-pr29-evidence-integrated-focused.log. Final7lazyPASS, /tmp/codegraph-pr29-evidence-lazy-final.log. Distinct final631PASS1SKIP over20files. Test setup ran tsc/assets, viewer build/check succeeded earlier. git diff --check PASS. No standalone final npm run build/fullsuite on this revision; deferred to stable review per existing boundary. Native parity skipped because binary absent, no native execution claim.
+
+Small production-collector measurement: module load8.23ms with compilerLoadedBeforeAnalysis:false; cold first analysis277.01ms, heap delta17.70MiB;25warm samples median1.65ms (147byte value fixture),2.37ms (152byte generator eval). These are toy collector measurements, not actual large-project indexing, query latency, cache or worker benchmarks.
+
+CurrentHEAD87576a8d, branchfix/commonjs-eval-callee-context.22dirtypaths total, new3files intent-to-add for review only; no sourcecommit/push/merge/deploy. Integration phase changed9paths: shared source module, import resolver, name matcher, two new test files, default-binding graph tests, lazy test, package.json/lock.13of15prior dirty source paths remain byte-identical; two intentionally extended. All22final hashes saved/verified. T0/live/deploy/control files untouched.
+
+Durable backup: originalQA .review/commonjs-fix-2026-11-08/pr29-export-evidence-integration-2026-11-09/ contains baseline before/, milestone1/2 source snapshots/hashes, final-source/ all22files, source-sha256.json, cumulative-from-875.patch, integration-from-round10.patch, actual red/green/failure/lazy logs, production measurement script/output, results.json/progress.json. STOP and ask before fresh focused dual review; do not auto-review/fix/publish. Final normal build/fullsuite once after stable clearance. Latest handoff /home/ericm/.codex/plans/handoff-codegraph-pr29-export-evidence-integrated-2026-11-09.md.
+
+This supersedes prototype-only state. Read session-end handoff for identity/publication/recovery boundaries; preserve all22dirtypaths. Both next reviewers should receive exact git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 87576a8d9ff0d8aba235db5535f5f4429f14b037 -- . plus integration-from-round10.patch and same ledger. Focus F12/F13 closure and invariants, no repeated whole-parent audit/fullsuite/build. Review only with user approval/actual gate; no resets. Runtime dependency/lazy loading, compiler scoping, member selector ownership, eval lexical context, forwarding/typeFrom and fresh/sync are key review surfaces. The final normal build/fullsuite remain pending; tsc passed in current test setup.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-f10-f11-corrected-review-pending-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-f10-f11-corrected-review-pending-2026-11-09.md
new file mode 100644
index 0000000000..706c0a74fa
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-f10-f11-corrected-review-pending-2026-11-09.md
@@ -0,0 +1,27 @@
+# PR29 F10/F11 corrected,172focusedPASS; next review decision pending
+
+Authoritative2026-11-09. User explicitly answeredyes to correct bothreview8findings. Completedthiscorrectionslice+focusedverification. No newcommit/push/markready/merge/deploy/upstreamwrite. Stopandaskbeforefreshfocusedreviewasuserper-stepconfirmationrequires; no ninthagentslaunched. PriorASTredesignapprovalremainsforin-scoperemediation, don'tre-askcompletedfixapproval.
+
+Checkout /tmp/codegraph-cjs-missing-fix-20261108 branch fix/commonjs-eval-callee-context HEAD87576a8d9ff0d8aba235db5535f5f4429f14b037,15dirtysourcepaths(newfilesintent-to-add),private.reviewuntracked. PR29 DRAFT https://github.com/inth3shadows/codegraph/pull/29 still87576a8d(base5d384989/PR28), PR28 DRAFT https://github.com/inth3shadows/codegraph/pull/28 still5d384989(base5e066489/mainem40). Neithermerged/deployed. Allcurrentdirtysourcebackedup, no /tmp-onlyloss. OriginalT0pilotstopped/uncommitted/untouched, liveem40unchanged.
+
+## Current fix and execution evidence
+
+ASTpipelineimplementedearlierin15paths: ASTcalleehelperusesexistingWASMtree; native/deferredworkerfactsuseexistingloadedgrammar; ExtractionResult fact->ephemeralFileRecord->existingfile-store upsert metadata{contentHash,value}; contextacceptsbooleanonlyexactSHA256sourcehash,otherwiseunknown. Oldliteral-prefixheuristicsremoved. No grammar/dependency/schema modifications. Native.nodeNOTSTAGED; no runtimeparityclaim. UserknowsexistingJSgrammar ambiguitiesaroundcontextualyield, helpershandlethemwithoutgrammarfileschanges. CHANGELOG56alreadyrequiresre-indexafterupgrade(newfacts),nolegacymigrationclaim.
+
+Review8hadF10P2(optionalvalidCJSyield?.(eval)("ignored") grammarerrorfactnullallowedfakeDecoy::missing), F11P2(computedmethodkeyusesenclosingratherthannewmethodgeneratorscope,bothdirectionsfakeandlostcalls). Bothactualfinalreviewreports/evidenceinpriorast-review8-two-findingshandoff/adjacentbackup,fullledger .review/commonjs-eval-callee-context.md.
+
+Newfailbeforetestsactual2files6FAIL90PASS, /tmp/codegraph-cjs-ast-f10-f11-before.log EXIT1:2ASTcomputedkeycases,3graphreprocases,existing-syncnewunknownstep; positiveexplicitcallablealiascontrolalreadyPASSandpreserved. F11correctionincommonjs-eval.ts: method_definition countsasfunctionscopeonlyifcalliswithinbodyorparametersregion. Computedkeys/decoratorscontinueenclosingancestry,noprefixguesses. F10correctioninreader/matcher: evalUnknownseparateflagfromuncertain/namespace; propagateinModuleNamespaceInfo; preventunprovenmethod-nameguesseswhenASTunknownANDmembernotexplicitlywritten. Doesn'tclaimmemberabsent; earlierprovenreceiver/typepathsremainbeforegate. Explicitexports.load=Store.prototype.loadunderunknownparseSTILLRESOLVES. ASTfactremainsnullhonestly, nofakegrammar-success. Forwardersretainflagviaexistingspread.
+
+Afterfix8files172PASS1SKIP, /tmp/codegraph-cjs-ast-f10-f11-after.log EXIT0,43.64s. Command CODEGRAPH_KERNEL=0 CODEGRAPH_PARSE_WORKERS=2 npx vitest run __tests__/commonjs-eval.test.ts __tests__/commonjs-eval-facts.test.ts __tests__/commonjs-export-members.test.ts __tests__/js-default-binding-members.test.ts __tests__/name-matcher-memo-clears.test.ts __tests__/sync-memo-lifetime.test.ts __tests__/lazy-engine.test.ts __tests__/kernel-retry-materialize.test.ts --maxWorkers=4. IncludesrealSQLitehash/rollback/deletefacts,2workerfreshstore,syncvsfreshactualeval->unknownwrapper->actualeval,oldmemos/lazy. One skipnativekerneltransportbecausebinaryabsent. Matchercommentclarifiedafterpassingrun, no behaviorchangedaftertests. gitdiff--checkPASS. No explicitnormalnpmrunbuild/fullsuiteforcurrentdirtycode; old10666fullPASSbelongs87576a8donly. No test/build/reviewerprocessesrunning.
+
+## Next step
+
+Userdecisionbeforefocusedverifyround9. Ifapproved,2freshnativeREADONLYreview_broad_* /review_adversarial_*, fork_turns=none compactbriefs, SAMEledger andexacttarget `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 87576a8d9ff0d8aba235db5535f5f4429f14b037 -- src/types.ts src/db/queries.ts src/extraction/commonjs-eval.ts src/extraction/tree-sitter.ts src/extraction/parse-worker.ts src/extraction/kernel/index.ts src/extraction/index.ts src/resolution/types.ts src/resolution/index.ts src/resolution/name-matcher.ts src/resolution/commonjs-export-members.ts __tests__/commonjs-eval.test.ts __tests__/commonjs-eval-facts.test.ts __tests__/commonjs-export-members.test.ts __tests__/js-default-binding-members.test.ts`. FocusF10/F11closureandnearbyinvariants,5filedeltafromround8isbackedup; no widerparentaudit,repeatedfull/build ornativeexecutionclaims. Sourcebehaviorcompiledcurrentlyindistfromfocusedsetup; onlyposttestcommentchanged, don'trepeatfullbuildjustforreview. Overallroundcount8honest, don'tresetstate/renamearoundgate; stop/askifactualhostdenies. Do notclaimClaude-only/code-reviewran.
+
+Ifreviewclearandcodeunchanged,runexplicitnormalbuildthenfullsuiteonce(~13min) CODEGRAPH_KERNEL=0 npm test -- --maxWorkers=4(Vitest4no--minWorkers). Regularupdatesunder60s. Anynewreviewfindingreportbeforeanothercorrectioncycle. Finalrepo/remote/personalidentity/stagedexactfiles/sourcehashes/testsrequired beforecommit/pushupdatePR29. Keepdraftuntilactualclearance/userdecision; noautomerge/deploy/officialupstream. Nativeunavailablelimitationremainshonest.
+
+## Durable recovery
+
+OriginalQA .review/commonjs-fix-2026-11-08/ast-f10-f11-corrected-2026-11-09/ containsall15sourcefiles/source-sha256.json,cumulative-from-875.patch,correction-from-round8.patch(5files),red/greenlogs,2ledgers,verification.json. Previousast-integrated-review8backupcontainsprevioussources/allreviewrepros; olderadjacentbackupholdsparentverifiedgitbundle/fullsuiteat875 andpublishedbranchlinks. Currentfullsourcecanberecoveredusing875fromGitHubthenpatch; preserveexistingdirtybranchbeforeapplying. No private.revieworAIattributionindurablecommits.
+
+OriginalT0staysstopped/uncommitted,otheragent/deploy/controlworktreesuntouched. Personalorigininth3shadows/codegraph; identityEricMinish/eric.minish@gmail.comrecheckbeforecommit. Issue27CommonJS,26separateexternalimportoutofscope,QA PR27unrelatedevidence. TuesdayNov10officialreportstillconditionalonverification/duplicatecheckandusergoahead,notnow.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-f12-focused-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-f12-focused-2026-11-09.md
new file mode 100644
index 0000000000..7aff60b166
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-f12-focused-2026-11-09.md
@@ -0,0 +1,24 @@
+# PR29 F12 correction complete; focused verification done, review pending
+
+
+## F12 correction approved and focused verification complete — 2026-11-09
+
+User explicitly approved the focused F12 correction after reading the session-end handoff. Existing checkout/HEAD 87576a8d and all 15 dirty source paths preserved; only two source files and their two tests changed from review 9. No commits, pushes, new review, merge, deploy, grammar/schema/dependency or extraction/storage changes.
+
+Added both runtime-backed F12 regressions FIRST: root object callable alias and new Store() under optional yield wrapper return 42 at runtime but graph calls are empty. Actual 2 FAIL / 61 SKIP, /tmp/codegraph-pr29-f12-red.log, exit 1. Expanded pre-fix reader/graph contract: 33 FAIL / 136 PASS, /tmp/codegraph-pr29-f12-matrix-red.log, exit 1.
+
+Reader now records exportForm (namespace/value/opaque) independently from evalState (present/absent/unknown); replaces the prior evalUnknown flag. Explicit members remain property writes, never a whole-value inventory. Any syntactically stated whole module.exports assignment retains existing value resolution; escapes/mixed writes do not erase that evidence or claim a final member inventory. Namespace absence still requires !uncertain. Inconclusive eval only gates unproven method guesses when no stated whole value is present; explicit property aliases and confirmed eval behavior stay intact. Forwarders propagate the summary through existing spread, and existing typeFrom dependencies remain intact.
+
+Tests cover namespace/direct alias/root object/instance x eval absent/present/unknown, direct and forwarded imports; runtime values and typeFrom metadata asserted. Added fresh-v-sync transitions across both axes, bracket/mixed assignments, opaque reader controls; all prior F10/F11 tests retained unchanged.
+
+Actual verification:
+- First two-file green: 169 PASS, /tmp/codegraph-pr29-f12-matrix-green.log, exit 0. Test setup successfully ran tsc + copied assets for current source.
+- Expanded ten-file run after final four bracket/mixed graph tests: 235 PASS / 1 SKIP / 6 FAIL, /tmp/codegraph-pr29-f12-focused.log, exit 1. All six failures were lazy-engine child stdout empty. Independent minimal spawnSync probe reproduced EPERM for piped Node child output even when the child simply prints 42; file output works. No source/test workaround added.
+- Approved sandbox escalation reran ONLY lazy-engine.test.ts outside sandbox: 6 PASS, /tmp/codegraph-pr29-f12-lazy-unsandboxed.log, exit 0.
+- Combined distinct final checks: 241 PASS / 1 SKIP over 10 files. Skip is native-kernel parity (binary not staged); no native execution claim. git diff --check PASS. No final normal npm run build/fullsuite on dirty AST revision; these remain deferred until stable independent review per user handoff. No tests/build/reviewer processes running.
+
+F12 status: CORRECTED + focused verified, NOT independently cleared. Overall review count remains 9; no gate resets or new agents. STOP and ask before fresh focused dual review, as requested. Proposed two-commit structure stays pending; nothing staged/committed/published. PR28/29 draft state not changed. T0/live/deploy/control files untouched.
+
+Durable backup: original QA .review/commonjs-fix-2026-11-08/pr29-f12-2026-11-09/ contains before/after copies of all 15 dirty source files, hashes, cumulative-from-875.patch, f12-correction.patch, actual red/green/failure/rerun logs and verification.json. Plan: /home/ericm/.codex/plans/plan-codegraph-pr29-f12-2026-11-09.md. Next factual checkpoint: /home/ericm/.codex/plans/handoff-codegraph-pr29-f12-focused-2026-11-09.md.
+
+Read session-end handoff for publication/identity boundaries. User approval covered this correction and focused tests, not a new review or publication. Next: ask for fresh native broad/adversarial focused verification of 87576a8d..workingtree, exact target and same ledger, plus saved F12 delta. Do not duplicate parent probes or run full suite before stable review clearance. Current HEAD remains 87576a8d9ff0d8aba235db5535f5f4429f14b037, branch fix/commonjs-eval-callee-context. Do not reset/clean or replace the checkout.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-harness-complete-2026-11-10.md b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-harness-complete-2026-11-10.md
new file mode 100644
index 0000000000..57c5538d31
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-harness-complete-2026-11-10.md
@@ -0,0 +1,11 @@
+# PR29 harness complete — indexing regression measured
+
+Current date2026-11-10. Existing checkout `/tmp/codegraph-cjs-missing-fix-20261108`, HEAD87576a8d, branchfix/commonjs-eval-callee-context preserved with all30dirty paths. User authorized isolated baseline/candidate harness, not fixes, review agents or publication. Original2,019tracked-file hashes/Git status/patch unchanged, staged diff empty. Existing T0 remains stopped.
+
+Results and exact evidence: `/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-harness-20261110T013135Z`. Read report.md/results.json/execution.json first. Work copies remain `/tmp/codegraph-pr29-harness-6fevujfy`; baseline and candidate sources/dependencies/dist are independent. Both normal builds PASS.32targeted fixtures FIXED,70candidate canariesPASS, all38existingverdictsunchanged (32BROKEN2GUESSED4FIXED).4of5publicdevcorpus graphs identical; Express64oldcalltargetsremoved (52incorrect,12externalvariable/unproven), no confirmed correct call lost in that set, files/nodes unchanged.23CLIquestions:17SAME6CHANGED, no failed/unstable. Both builds99modecomparisonsPASS. Metamorphic219rows/build: candidate192CLEAN17DIFF10N/A vs baseline183CLEAN26DIFF10N/A. Exact diff multiset comparison:9baseline differences disappear,0new differences,17remain baseline-identical; no indexing errors.
+
+Paired timing24freshindexes,4perbuildperrepo with alternating order: Requests median about2.069s→2.066s (flat); Ky5.045s→5.676s (+12.5%); Express2.379s→3.282s (+38.0%). JS/TS candidate ranges do not overlap baseline ranges. These are measured indexing regressions on one local host, not a proven cause or universal bound. No profiling/fixes attempted. Recommendation: profile indexing overhead before further implementation or release readiness claims.
+
+All jobs finished normally with actual exit statuses saved. Baseline replay exits1 due one canary failure; graph/shadow diffs exit1 for changed results; both metamorphic jobs exit1 for17+baseline findings. Those are classified results, not unreported process errors. timings exit0. No active sessions.
+
+No new independent review started;11dualreview rounds remain completed historically. Full repository test suite not run here; previous819focusedPASS1nativeSKIP still applies to unchanged source. Nativebinary absent, WASM-only. No compiler-oracle refresh/model-agent A/B/overnight history/T0. Report all limitations honestly. If user authorizes profiling, use the isolated candidate/baseline copies and preserve original tree. Ask before implementing any fixes.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-review10-two-findings-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-review10-two-findings-2026-11-09.md
new file mode 100644
index 0000000000..fce52cb282
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-review10-two-findings-2026-11-09.md
@@ -0,0 +1,32 @@
+# PR29 focused round10 complete: F12 incomplete + new F13; awaiting decision
+
+
+## Tenth native focused verification completed — original F12 clears; F12 variants and new F13 remain
+
+User explicitly authorized this focused review. Both fresh read-only lanes review_broad_pr29_f12_10 and review_adversarial_pr29_f12_10 completed normally against exact git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 87576a8d9ff0d8aba235db5535f5f4429f14b037 -- . and the same ledger / saved F12 delta. All 15 source hashes match the focused-tested F12 snapshot. No source edits, rebuild, fullsuite, commits, pushes, merge, deploy or gate reset. Parent merged actual reports without duplicate probes/source re-audit.
+
+Both independently CLEARED original F12 unparenthesized root object/instance, original F10 optional wrapper, and both F11 computed-key directions. Original passing examples do not clear adjacent syntax/scope findings.
+
+### F13 — P2 — Shadowed module writes disable the unknown-eval guard (adversarial)
+
+Exact location src/resolution/commonjs-export-members.ts:75, gate name-matcher.ts:25403. Concrete input:
+
+```js
+exports.known = function known() {};
+function pretend(module) { module.exports = {}; }
+pretend({});
+function yield(v) { return function ignored() {}; }
+yield?.(eval)("ignored");
+```
+
+Caller const named=require('./m'); function run(){named.missing();}, unrelated export class Decoy { missing() {} }. Actual CommonJS exports only known; missing undefined. Current graph incorrectly calls decoy.js:Decoy::missing. Reader records exportForm:value/evalState:unknown from local parameter's module.exports assignment, bypassing unknown-eval guard. Block-local and arrow parameter variants reproduce. Loading both saved pre-F12 source files in memory yields calls[] on identical inputs, proving NEW regression in latest correction. Evidence /tmp/cg-a10-boundary.{cjs,log}, /tmp/cg-a10-before-loader.cjs, /tmp/cg-a10-boundary-before-source.log, /tmp/cg-a10-shadow-runtime.log.
+
+### F12 — P2 — F12 remains for equivalent whole-value assignment syntax (broad)
+
+Exact location src/resolution/commonjs-export-members.ts:75, gate name-matcher.ts:25403. class Store { load() { return 42; } }; (module.exports) = new Store(); function yield(v){return function ignored(){}} yield?.(eval)("ignored"); with named.load() returns42 at runtime but graph calls[]. Reader expects = immediately after module.exports, records opaque and suppresses call. Parenthesized root object and module.exports &&= new Store() reproduce. Removing only optional wrapper restores Store::load. Direct/forwarded imports both fail; fresh/sync agree, removing wrapper during sync restores edge and typeFrom. This is incompletely corrected F12, not a demonstrated NEW regression in latest correction. Broad evidence /tmp/cg-broad-pr29-f12-10.{cjs,log} (28 runtime/graph probes), /tmp/cg-broad-pr29-f12-10-sync.{cjs,log} (12 asserted sync/fresh comparisons).
+
+STOP/report both P2 findings. No fix or new review authorized by this yes-to-review turn. Review count10 completed honestly, no resets. Prior 241 focused PASS /1native SKIP remains actual but misses these cases. No final normal build/fullsuite on dirty AST revision; no native-kernel execution claim. PR28/29 stay draft/unpublished current correction; T0/live/control/deploy files untouched. Sources remain 15 dirty paths on HEAD87576a8d. Preserve checkout and all work.
+
+Durable review evidence: original QA .review/commonjs-fix-2026-11-08/pr29-review10-2026-11-09/ includes broad/adversarial reports, merged-review.md, completed review-status.json, source hashes, scripts/logs, and ledger. F12 before/after source backups/cumulative+delta patches remain adjacent pr29-f12-2026-11-09/. New handoff /home/ericm/.codex/plans/handoff-codegraph-pr29-review10-two-findings-2026-11-09.md.
+
+Read handoff-codegraph-pr29-session-end-2026-11-09.md for publication/identity/recovery boundaries. Latest checkpoint supersedes F12-focused review-pending state. User must decide next step; do not start another correction or review automatically. Repeated changes in this block warrant revisiting the evidence boundary rather than adding ad hoc syntax exceptions; no new design has been approved. Existing intended two-commit PR29 structure remains pending. No commits/pushes/merge/deploy or upstream writes authorized.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-review11-two-findings-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-review11-two-findings-2026-11-09.md
new file mode 100644
index 0000000000..08c471e998
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-review11-two-findings-2026-11-09.md
@@ -0,0 +1,25 @@
+# PR29 round11 complete; F14/F15 open, Astra/Sol planning requested
+
+
+## Eleventh native focused verification complete — F10–F13 clear, new F14/F15 open
+
+Both user-authorized read-only lanes review_broad_pr29_evidence_11 and review_adversarial_pr29_evidence_11 completed normally against exact git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 87576a8d9ff0d8aba235db5535f5f4429f14b037 -- . and the same ledger/integration delta. All22source hashes match focused-tested snapshot. No source/build/fullsuite/commit/publication/gate changes. Parent merged actual reports without duplicate source reading/probes.
+
+Both independently CLEARED original F10/F11/F12/F13, including true generator eval, optional wrapper, parenthesized/logical whole exports, local wrapper shadowing. Broad11asserted AST and12asserted sync/fresh controls pass. Prior631focusedPASS1nativeSKIP is actual but misses new findings.
+
+### F14 — P2 — Preserve explicit property aliases on a whole exported local value (broad)
+
+Exact location src/resolution/commonjs-export-evidence.ts:226. Valid m.js: class Store { load() { return 42; } }; const api = {}; api.load = Store.prototype.load; module.exports = api; Caller named.load() runtime42, current graph[], record.members{}. Before integration, identical source resolves Store::load/typeFrom[m.js]. Class Factory.load and function Factory.load alias variants independently fail-after/pass-before. Collector discards writes on local receivers, and the wrapped compiler type does not supply those assigned properties. This is an introduced loss of correct relationship, not permission to restore global guesses. Report/replay: /tmp/cg-broad-pr29-evidence11-report.md and /tmp/cg-broad-pr29-evidence11-artifacts/ (durably copied below).
+
+### F15 — P2 — Do not emit calls to exported non-callable values (adversarial)
+
+Exact location src/resolution/import-resolver.ts:3430, classification commonjs-export-evidence.ts:148-156/309-313. m.js const value=42; exports.load=value; caller named.load(). Runtime TypeError (not a function), current graph run→m.js:value constant; before calls[]. String-valued object-export variant reproduces. Valid supporting variant function real(){return 42;}let value;value=real;exports.load=value; runtime42/current targets variable value instead of real; before has no target. Same kind:value declaration fallback, one finding. Preserve data imports/references while withholding unsupported call identity. Report/replay /tmp/cg-a11-final-report.md and cg-a11-* scripts/log/JSON.
+
+Review count11 completed honestly, no resets. STOP before fixes/review/publication unless user authorizes. Final normal build/fullsuite not run; native binary absent, no parity claim. HEAD87576a8d,22dirtypaths preserved; PR28/29 publication unchanged. Durable originalQA .review/commonjs-fix-2026-11-08/pr29-review11-2026-11-09/ contains exact reports, merged-review.md, completed review-status.json,22source hashes, broad-artifacts/ including both baseline source files, adversarial-artifacts/ including scripts/logs/baseline import resolver and copied before name matcher. Some adversarial replay scripts hardcode original /tmp baseline paths; restore those saved files to their original paths or adjust only copied replay scripts if /tmp disappears. Actual source snapshots remain adjacent pr29-export-evidence-integration-2026-11-09/final-source/ and before/.
+
+Latest user steering after review: "astra vs sol come up with diff plan?" Parent will obtain independent read-only design plans from Astra and Sol against these same findings; this authorizes planning/comparison, not code or another review. Preserve source.
+
+See handoff-codegraph-pr29-export-evidence-integrated-2026-11-09.md for implementation/dependency/test details and session-end handoff for identity/publication boundaries. Do not fix or run another review automatically.
+
+## Astra/Sol comparison complete
+Both user-requested independent plans completed read-only. Both converge on binding-owned values/property slots, independent callable identity and bounded def-use; TypeScript binder/eval adapter retained. Recommended Sol result contract plus Astra uncertainty/stop rules. Plans/comparison saved in ~/.codex/plans and durable review11backup. Latest comparison: /home/ericm/.codex/plans/compare-astra-sol-pr29-export-contract-2026-11-09.md. Source22hashes unchanged. User decision required before new contract spike or production edits; planning request was not implementation approval.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-review9-root-export-regression-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-review9-root-export-regression-2026-11-09.md
new file mode 100644
index 0000000000..0b781ded7d
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-review9-root-export-regression-2026-11-09.md
@@ -0,0 +1,31 @@
+# PR29 review9 complete: F10/F11 clear, F12 root-value-export regression remains
+
+Authoritative2026-11-09. User saidyes to focuseddualverification. BOTHfreshnativeREADONLYlanes review_broad_pr29_f10_f11_9 and review_adversarial_pr29_f10_f11_9 completednormally. Review-onlyrequestdone; STOP/reportF12, nofix/anotherreview/fullsuite/commit/push/markready/merge/deploywithoutuserdecision. Userper-stepconfirmationremains. This supersedes priorcorrected-review-pending/runningcheckpoints.
+
+Checkout /tmp/codegraph-cjs-missing-fix-20261108 branchfix/commonjs-eval-callee-context HEAD87576a8d9ff0d8aba235db5535f5f4429f14b037,15dirtysourcepaths(newfilesintent-to-add),private.reviewuntracked. All15hashesmatchsavedast-f10-f11-correctedbackup, no source changesduringreview. PR29 DRAFT https://github.com/inth3shadows/codegraph/pull/29 still87576a8d/base5d384989(PR28); PR28 DRAFT https://github.com/inth3shadows/codegraph/pull/28 still5d384989/base5e066489(mainem40). Nothingnewcommitted/pushedormerged/deployed. OriginalQA T0pilotstaysstopped/uncommitted/untouched; liveem40unchanged. Personalorigininth3shadows/codegraph, EricMinish/eric.minish@gmail.comrecheckbeforefuturecommit.
+
+CurrentuncommittedASTpipeline/metadatafactsunknownflag/computed-scopefix described in handoff-codegraph-pr29-f10-f11-corrected-review-pending-2026-11-09.md andlatestledger .review/commonjs-eval-callee-context.md(fullhistorypointer .review/commonjs-missing-member.md). No grammar/runtime/schema/dependencychanges. ExistingJSgrammarcontextualyieldlimitationisrealanddocumented; helperhandlesscope. FactsstoredthroughFileRecord->existingstoreprojectmetadatawithSHA256sourcevalidation, nosecondwriter. Unknownfactsdon'tproveabsence; currentevalUnknowngateblocksnameguessesunlessexplicitmemberwritten. ThisguardiswhatF12nowshowsistoo broadforstatedrootvalueexports.
+
+## Actualreviewresults
+
+BOTHindependentlyclearedoriginalF10/F11andnearbycontrols: optionalyieldwrappernocapture, ordinarycomputedkeyinsideoutergeneratorgenuineevalpreserved, generatormethodkeynongeneratorwrappernocapture. Broad11runtime-backedprobesPASS, includingclass/nestedcomputedkeys,generator/nongeneratorbodies,explicitexports.loadaliasunderunknownfact,genuineeval. Evidence /tmp/cg-broad-pr29-ast9-verify.{cjs,log}. Adversarialnestednongenerator/gettercomputedkeysalsopass. No contradictoryresult; broad didn'texerciseroot-valuevariantsbelow.
+
+F12 P2, adversarial, EXACTlocation src/resolution/name-matcher.ts:25403:
+class Store { load() { return 42; } }
+module.exports = { load: Store.prototype.load };
+function yield(v) { return function ignored() {}; }
+yield?.(eval)("ignored");
+
+Withconstnamed=require('./m'); functionrun(){named.load();}, runtimeloadreturns42 butcurrentgraphcalls[]. Whole-objectmodule.exportswritehasnomembersrecordedbytokenreader;newevalUnknowngateconsequentlydropsthegenuinealias. module.exports=new Store()alsoreproduces. RemovingONLYnewevalUnknownconditioninmemoryrestoresm.js:Store::loadforbothidenticalsources. Directexports.load=Store.prototype.loadcontrolpasses. NewregressioninF10fix, notunrelatedparentreaudit. Evidence /tmp/cg-a9-root-export-regression.cjs, /tmp/cg-a9-root-export-current.log, /tmp/cg-a9-root-export-oldgate.log. Parentdidnotre-runreviewprobes/rereaddiffmerelytoduplicate. ReportthisoneP2andstopforuserchoice.
+
+## Verification/nextboundary
+
+Current172focusedPASS1SKIP(8files)remainsvalidandmissesF12; no explicitnormalbuild/fullsuiteforthisdirtyASTcode. Old10666fullPASSbelongs87576a8donly. Native.nodeNOTSTAGED, nokernelruntimeparityclaim. Distbehaviorcurrent; sourcecommentonlyposttestclarificationrecorded. No tests/build/reviewersrunning. No fullsuitespentonknowndefect. No additionalreview/iterationwithoutapproval; count9honest,nogate/state/controlresets. Do notclaimClaude-only/code-reviewran.
+
+IfuserauthorizesF12remediation: firstaddbothrootobjectaliasandnewStore()real-graphregressionswithsameoptional-yieldparseerror; preserveoriginalF10nocapture,F11bothdirections,explicitmemberalias,andfresh/sync/forwarder/typecontrols. Narrowunknown-evalguesspolicytopreservestatedmodulevalueexportsratherthananotherblanketblockorlexicalcall-prefixguess. Existingreaderuncertaintyfordefaultexportvaluemustremainseparatefromevaluncertainty; inspectactualtypes/invariantsbeforeediting. Do not weakenexistingtestsorclaimunknown=absence. Focusedtestsbeforenextverification; newreviewroundonlyperuser/actualgate, noreset. Finalnormalbuild/fullonceafterstableclearance, thenverifiedcommit/pushtoexistingPR29withinactualauthorization, keepdraftuntilclear/userdecidesmerge. Noautomerge/deploy/upstreamreport.
+
+## Durable recovery
+
+OriginalQA .review/commonjs-fix-2026-11-08/pr29-review9-2026-11-09/ containsscripts/logs,bothledgers,merged-review.md,review-result.json,source-sha256.json/checksums. Adjacentast-f10-f11-corrected-2026-11-09/containsALL15currentdirtysourcefiles,cumulativepatchrelative875,5filedeltafromround8,failbefore6FAIL90PASS/passafter172PASS1SKIPlogs; review9-running.jsonupdatedCOMPLETED. OlderAST8backuphaspriorreports/sources; publishedbranchesandverifiedgitbundlerecover875/base5eparents. No lossif/tmpdisappears. Preserveexistingdirtyworkwhenrecovering; don'tcommittheprivate.revieworAIattribution.
+
+OriginalT0andcontrol/deployworktreesuntouched. Personalissue27CommonJS,issue26externalimportbugseparateoutofscope,QA PR27unrelatedevidence. TuesdayNov10officialupstreamreportremainsconditionalonverification/duplicatecheckandusergoahead,notnow.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-session-end-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-session-end-2026-11-09.md
new file mode 100644
index 0000000000..8dcf7ed257
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-session-end-2026-11-09.md
@@ -0,0 +1,41 @@
+# Session end: CodeGraph PR29, F12 pending; exploration complete
+
+Authoritative final handoff,2026-11-09. User explicitly ended this session and requested a command starting a NEW Codex session with proper setup. No scheduled/automatic resume. New session should read this and the two linked plans, summarize the next step and ASK before implementation: latest /explore recommendation has NOT been approved. Don't mistake end-session request for authorization to fix/commit/push/merge/deploy. Preserve all current work.
+
+## Exact workspace and publication state
+
+Use EXISTING /tmp/codegraph-cjs-missing-fix-20261108, branch fix/commonjs-eval-callee-context, HEAD87576a8d9ff0d8aba235db5535f5f4429f14b037. Do not create/reset/clean a worktree or discard unstaged changes. Fifteen dirty source paths, newfiles intent-to-add, private.review untracked; all hashes checked at session end against durable source backup. Source should be unchanged from completed ninth review. Personal origin https://github.com/inth3shadows/codegraph.git, Eric Minish / eric.minish@gmail.com (verify again before future commits/pushes); never use work/Transactly identity.
+
+PR28 DRAFT https://github.com/inth3shadows/codegraph/pull/28 at5d384989957c91b482068b306535437915a0595b, base main5e066489(em.40). PR29 DRAFT https://github.com/inth3shadows/codegraph/pull/29 at87576a8d9ff0d8aba235db5535f5f4429f14b037, base PR28 branch fix/commonjs-missing-member. AST redesign/current15files have NOT been committed/pushed; publishedPR29 still oldprefixguard. Neither PR merged/deployed; live em.40 unchanged. Original QA workspace /home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780 is stopped/uncommitted T0pilot(HEAD729da1b); do not resume/edit it. Only its private.review holds backups.
+
+## Read next (exact files)
+
+1. /home/ericm/.codex/plans/handoff-codegraph-pr29-review9-root-export-regression-2026-11-09.md — latest factual review/state/repros/recovery.
+2. /home/ericm/.codex/plans/explore-pr29-export-evidence-boundary-2026-11-09.md — latest recommendation, awaiting user approval.
+3. Repo .review/commonjs-eval-callee-context.md — actual review ledger; history .review/commonjs-missing-member.md. Do not reread all old handoffs/full conversation.
+
+## Current implementation and actual verification
+
+ASTfact pipeline implemented in15dirtypaths. ExistingAST identifies direct eval; generator-scope workaround for JSgrammar's contextualyield ambiguity. OptionalExtractionResult.commonJsEvalCall->ephemeralFileRecord throughbothstorepaths->existingproject_metadata JSON{sourcehash,value}; resolveronlyacceptsfactifcurrentSHA256matches. Missing/stale/errorfactsunknown; oldmanualcallee prefixwhitelistremoved. No grammar/runtime/dependency/schema modifications. NewevalUnknownguard suppresses unprovennameguesses; computedmethodkeys nowcorrectlyuseenclosingscope. Explicit directmemberaliasesstillresolve.
+
+Focused8files172PASS1SKIP, /tmp/codegraph-cjs-ast-f10-f11-after.log; sixFAIL90PASS before lastfix. One skipnativekerneltransport: native.node NOTSTAGED, don'tclaimnativeparity. No explicit finalnormalbuild/fullsuiteoncurrentdirtyASTrevision; old10666fullPASSbelongscommitted875onlyandisNOTcurrentclearance. No test/build/reviewerprocessesrunning.
+
+Ninthnative dualreviewCOMPLETED, sourceunchanged. BothreviewersindependentlyCLEARED priorF10optionalwrappercapture andF11computedkeyscope(bothdirections). Broad11runtimeprobespass. AdversarialfoundF12 P2 atsrc/resolution/name-matcher.ts:25403: withclass Store{load(){return 42;}}, module.exports={load:Store.prototype.load}; function yield(v){return function ignored(){};} yield?.(eval)("ignored"); runtime.load()returns42, graphcalls[]. module.exports=new Store()alsoreproduces. Reader'smemberSetlistspropertywritesonly, notwholeexportedvalueinventory; newevalUnknowngatemistakesemptysetforreason todroprootvaluecalls. RemovingONLYnewevalUnknowngateinmemoryrestoresStore::load; directexports.loadaliaspasses. Repros /tmp/cg-a9-root-export-regression.cjs, /tmp/cg-a9-root-export-current.log, /tmp/cg-a9-root-export-oldgate.log. No parentduplicateprobes/codechangesduringreview. Overallreviewcount9honest; no resets/gatebypass.
+
+## Exploration recommendation — NOT approved yet
+
+KeepPR29; split intoTWOreviewablecommits (ASTfactproduction/transport/storage/tests, thenexportclassification/resolutionpolicy/tests). A thirdstackedPRaddsdependencywithoutseparatingthissamecontract. RemainingF12scope2sourcefiles(commonjs-export-members.ts,name-matcher.ts)+2testfiles(commonjs-export-members.test.ts,js-default-binding-members.test.ts); existingextraction/storage/grammarpipeline needn'tchangeforF12.
+
+Represent exportform(namespacewrites/statedvalue/opaque) independentlyfromevalcertainty(present/absent/unknown). Preserveexistingresolutionofstatedwholemodulevaluesanddirectaliases; suppressunrelatednamespace guesses whenunsupported. Unknown eval alone mustnotoverrideastatedexportedvalueorclaimabsence. Keep confirmedactualevalbehavior. Pin matrix BEFOREcoding: namespacewrites/directaliases/rootobjects/instances x evalabsent/present/unknown, forwarding+fresh/sync. IncludeF12object/instancecasesandretainF10/F11. Checkmixed/bracketassignments andforwarderpropagation; no needanothergrammar/punctuationexception. Explorationhasread-onlycodeinspection; no implementationchangesmadeafterreview9. Usermustapproveproposedstructure/nextcodingstep.
+
+## Resume workflow and boundaries
+
+Newsession command uses -C existingtmpcheckout, workspace-write, --approve-for-me (installedcodex0.167.0helpverified), add-dir ~/.codex/plans and originalQA/.review ONLY forcheckpoints/backups. Omit --worktree andapproval/sandboxbypassflags. Use configuredmodel/profiledefaults; no modelchangeauthorized. ReadpersonalAGENTS/repoAGENTS, preserve work. If sourcecheckoutgone, recover safely fromGitHub875/base5e anddurablepatch WITHOUToverwritingrealexistingfiles.
+
+Afteruserapprovesimplementation: addmeaningfulfailingF12tests, refactorclassificationcontractnarrowly, runfocusedmatrixandpreservationchecks, savecheckpoint. Askbeforeseparatenextreview asuserrequested; freshnative broad/adversariallanes onlywhenapproved, exactGit target+ledger,no wholeparentreaudits/repeatedfullbuilds, no gate resets. Runfinalnormalbuild/fullsuite ONCEafterstableclearance(CODEGRAPH_KERNEL=0 npm test -- --maxWorkers=4,~13min; no --minWorkersVitest4). Beforecommit/pushverifyrepo/remote/personalidentity/stagedexactdiff/sourcehashes/tests. Keepdraftuntiluserdecidesready/merge. Do not auto-merge/deploy/upstream report. No unaskedissue26fix/features/T0work. Userwantsregularconciseupdatesandminimalquota; compact fork_turns=none reviewerbriefs, don'trepeatcompletedchecks.
+
+## Durable recovery locations
+
+OriginalQA .review/commonjs-fix-2026-11-08/ast-f10-f11-corrected-2026-11-09/ hasall15currentsourcefiles, source-sha256.json, cumulative-from-875.patch, correction-from-round8.patch, actualred/greenlogs,ledgers/verification. pr29-review9-2026-11-09/ haslatestactualreviewreports/scripts/logs/results/hashes. OlderbackupsretainverifiedtwobranchGitbundleagainstbase5e; bothpublishedbranchesonGitHub. No lossif/tmpdisappears. Finalcopyofthishandoffandexplorationalsoin session-end-2026-11-09/. Don'tcommitprivate.revieworAIattribution. Don'trewriteagentcontrol/deployworktrees.
+
+Personalcodegraphissue27CommonJS; issue26separateexternalimportbugoutofscope; QA PR27unrelatedevidence. TuesdayNov10 officialupstreamreportstillconditionalonactualverification/duplicatecheckandusergoahead. No officialwriteyet.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-value-contract-complete-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-value-contract-complete-2026-11-09.md
new file mode 100644
index 0000000000..e7bc45abd6
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-value-contract-complete-2026-11-09.md
@@ -0,0 +1,36 @@
+# PR29 isolated value contract experiment complete —99pass, adapter coverage gate fails
+
+Authoritative checkpoint. User said "proceed" after independent Astra/Sol plans converged. Parent announced a bounded isolated contract experiment and kept production unchanged. User's save-as-you-go instruction persisted. No production integration, new review, build/fullsuite, dependency/schema/grammar changes, commits/pushes/merge/deploy or upstream writes in this phase.
+
+## Production state
+
+Repo /tmp/codegraph-cjs-missing-fix-20261108, branch fix/commonjs-eval-callee-context, HEAD87576a8d9ff0d8aba235db5535f5f4429f14b037. All22dirtysource/package/test hashes still match round11. F14 (lost local object/class/function callable property writes before whole export) and F15 (data/variable declaration accepted as callable) remain OPEN in production. Original F10–F13 cleared at round11. Review count11; no reset. Prior631focusedPASS1nativeSKIP is historical and misses open findings. Source/patch recovery remains pr29-export-evidence-integration-2026-11-09/; review11 evidence adjacent. Preserve checkout and all work; T0/live/control/deploy files untouched. Publication/identity boundaries from session-end handoff still apply.
+
+## Experiment, durable workspace
+
+/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-value-contract-spike-2026-11-09
+
+README.md describes contract/limits; results.json/progress.json exact statuses. value-graph.cjs is independent typed value/property/binding representation (JS experiment); source-contract.cjs bounded syntax-to-fact adapter; bindings.cjs reused TypeScript5.9.3 resolveName binder with public syntactic diagnostics; runtime.cjs controlled CommonJS fixture oracle. final-source/, earlier snapshots, all red/green TAP, measurements and artifact-sha256.json saved. No packages installed. No actual project/dependency JavaScript executed; real package files were parsed only.
+
+## Actual verification
+
+Final99PASS0FAIL0SKIP:24core +75source tests, final-tests.tap. All7.cjs files passed node --check. Test command from experiment directory:
+node -e 'require("./value-graph.test.cjs"); require("./source-contract.test.cjs")'
+
+Core includes F14expando object/class/function identities; F15reference vs callable/construct capabilities; reassigned callables; shared aliases/rebinding/overwrites/post-export writes; prototype links; localized unknown/escape; branch joins and weak writes for uncertain receivers. Callable source identity is distinct from display labels, so same-named implementations cannot collapse. Unknown runtime value can retain a storage reference without acquiring callable identity. Missing property read becomes undefined when exported as a value; absence remains distinct.
+
+Source gate covers F10–F15 direct+forwarded, genuine generator/computed-key literal eval without generator execution, local module/eval shadowing, branch agreement/conflict, dynamic keys/escapes, source updates=fresh, indirect/optional eval rejection, unsupported construction/inheritance/prototype-descriptor behavior, and synthetic eval declarations with no indexed selector. Source IDs are experimental source-location identities/labels, not real CodeGraph node IDs. This does not validate actual CodeGraph sync/cache/store/worker/native paths.
+
+History is preserved:21core red baseline then21PASS;59source red baseline then55PASS4FAIL (property-name Identifier treated as wrapper reference in effect scan); generic reference-role correction. Added uncertain-receiver weak-write test (21PASS1FAIL) and identity-vs-label test (22PASS1FAIL), then green. Unsupported construction tests66PASS3FAIL before unknown guards. Reference/presence and synthetic eval selector tests red before corrections. No expectations weakened; expected positive capabilities were strengthened to require identity. See results.json for actual per-run counts rather than reconstructing from prose.
+
+## Coverage/performance screen — reason to stop before promotion
+
+Parsed installed Commander files812/10289/87209bytes, sequential separate processes baseline/current experiment, five warm samples each. No runtime execution or full repo index. Experiment medians~5.31/13.98/46.25ms, import~252ms, retained heap delta~22.11MiB. These are analyzer-only and output contracts differ; no production performance acceptance or semantic parity claim.
+
+All THREE real files returned unknown reference/callable, incomplete, reason "destructured initialization". The adapter invalidates the whole default too broadly for unsupported declaration lowering. Thus selected semantic contract gate PASSES, standalone adapter broader coverage gate DOES NOT PASS. Do not promote it wholesale or describe production bugs as fixed. The experiment is valuable evidence for representation, not a complete JS analysis implementation.
+
+## Recommended next decision
+
+Retain tested value/capability graph and regression corpus. Adapt that representation into the existing production collector while preserving its broader binder/type/source handling and lexical eval adapter. Replace declaration-as-callable and inferred-type-shape-as-write-ledger assumptions. Keep one shared authority consumed by import resolver/guard; no global name fallback. Do not merely bolt an expando map and node-kind filter onto the old contract, and do not port this standalone statement adapter wholesale.
+
+Before claiming production readiness: real indexed-node mapping, current631focused preservation suite + F14/F15 real-graph tests, actual sync/forwarder dependencies, compiler lazy-load checks and representative project coverage/performance. Final full normal build/suite only after stable independent review per prior boundary. User decision needed for production changes/new review; this isolated phase is complete. Avoid another general interpreter or unbounded language expansion. No automatic continuation.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-value-contract-progress-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-value-contract-progress-2026-11-09.md
new file mode 100644
index 0000000000..85410cd074
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-value-contract-progress-2026-11-09.md
@@ -0,0 +1,11 @@
+# Value contract experiment — milestone1 saved
+
+User approved combined Astra/Sol isolated contract experiment, not production integration. Workspace /home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-value-contract-spike-2026-11-09. Production22source hashes unchanged. Core value-graph.cjs separates reference/call/construct capabilities; binding/property slots share object identities; supports strong overwrites, localized unknown, escape invalidation and branch joins.21IRtests red baseline then21PASS. Snapshot milestone1-source/ and actual logs durable. Next bounded source-to-facts adapter reuses existing compiler binder and lexical eval expansion; no arbitrary calls/generator execution. F10-F15 mandatory, runtime controlled fixtures, in-memory edits=fresh (not real CodeGraph sync). Save each stage; stop if requires general interpreter.
+
+## Semantic gate saved
+89testsPASS(23core+66source), with F10–F15 direct+forwarded, data/reference/call/constructor distinctions, reassigned callables, aliases/overwrites/post-export writes, branch conflict/agreement, weak uncertain-receiver writes, escape/dynamic-key unknown, literal/generator eval and indirect rejection. Callables carry source identity separately from display name. Source lowering executes no functions/generators; eval payloads contribute static relationships. Actual checkpoints include55PASS4FAIL from property-name/reference effect confusion, generic correction plus weak-write and same-label identity red/green checks. Snapshot semantic-gate-source/; production22hashes unchanged at gate.
+
+This phase remains the isolated contract experiment as announced. No production integration occurred; further integration/review/publication require a subsequent user decision. Representative coverage/performance is still required before claiming readiness.
+
+## Experiment complete
+Superseded by handoff-codegraph-pr29-value-contract-complete-2026-11-09.md.99testsPASS/7syntaxchecksPASS; all22productionhashesunchanged. Semantic gate passes but3realCommanderfilesreturnunknownfromdestructuredinitialization, so do not promote standaloneadapter. Use validatedrepresentation/corpus to adapt existing collector; productionF14/F15stillopen.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-value-model-integrated-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-value-model-integrated-2026-11-09.md
new file mode 100644
index 0000000000..578ba79ad8
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/handoff-codegraph-pr29-value-model-integrated-2026-11-09.md
@@ -0,0 +1,39 @@
+# PR29 production value-model integration — saved and awaiting review
+
+2026-11-09. Checkout `/tmp/codegraph-cjs-missing-fix-20261108`, branch `fix/commonjs-eval-callee-context`, HEAD `87576a8d9ff0d8aba235db5535f5f4429f14b037` unchanged. Preserve checkout and every uncommitted change. User approved production integration after the isolated contract experiment. No new review, commit, push, merge, deployment, or release was authorized or performed.
+
+Implemented the binding-owned value/property graph in the existing lazy TypeScript collector, retaining its lexical binding and eval adapter. Typed source declaration selectors are separate from runtime values, storage references, callability and constructibility. Local object/class/function property writes, aliases and post-export writes retain their identity. Strong overwrites replace slots; uncertain receivers/branches join conservatively; data and unknown values cannot authorize a call. Compiler type seeding distinguishes class statics from instances and does not pre-apply expando writes from unexecuted branches. Logical assignments preserve RHS short-circuit behavior. Unsupported constructors/inheritance/prototype descriptor replacement remain unknown. No schema/grammar/dependency change was added in this phase; TypeScript runtime dependency and persisted eval facts are from prior approved work.
+
+Import resolution selects the actual exported path for default, namespace and named imports, carries reference/call/construct intent through re-exports and memo keys, and preserves typeFrom dependencies. Bare imported CommonJS calls cannot borrow a namesake global; caller shadows remain eligible for local resolution. The const-alias synthesizer now requests reference evidence for the root it reads, rather than pretending to call a class.
+
+The real sync acceptance test exposed failed forwarded calls not retrying after data becomes callable. Added a bounded failed-reference retry using the existing importer/barrel walk and binding-aware whole-module CommonJS forwarding. Positive edges retain their existing typeFrom resurrection. `src/index.ts` still reaches the new helper only through engine(); lazy read loading remains verified.
+
+## Actual final verification
+
+- Combined25files:812PASS,1nativeSKIP. Log `codegraph-pr29-value-verification.log`. Includes CommonJS/export/eval, import and alias resolution, source/type memo lifetimes, actual repeated forwarded sync edits, default export sync, and module-importer/barrel neighbors.
+- Lazy engine7PASS outside sandbox, using previously authorized exception for known child-process pipe restriction. Log `codegraph-pr29-value-lazy.log`.
+- Distinct819PASS,1SKIP over26files; no double counting supplemental runs.171production contract/core/import-boundary tests comprise24value-graph +46source/runtime contract +101real graph tests (included in812).
+- `node node_modules/typescript/bin/tsc --noEmit`:PASS. `git diff --check`:PASS. After intent-to-add made the fixture visible, trimmed one extra EOF blank line; no semantic source changed after final tests.
+- Normal standalone `npm run build` and full suite remain deferred until stable independent review, per existing boundary. Test setup rebuilt engine tsc/assets during implementation. Native kernel binary absent; no parity claim.
+- Installed Commander3-file screen retains explicit exports/forwarded class identities through destructured imports instead of globally poisoning them. Warm analyzer medians approximately8.26ms/13.92ms/64.66ms for812/10289/87209byte files. This is source coverage and analyzer timing only, not an indexing/worker/large-project benchmark. Exact JSON saved.
+
+## Failures diagnosed along the way
+
+-16new F14/F15real-boundary cases failed before implementation; all pass now, direct and forwarded.
+-Initial40PASS1FAIL identified class name's compiler type as the instance; corrected to getTypeOfSymbolAtLocation for the static side.
+-Expanded639PASS1FAIL1SKIP exposed the const-alias caller's false call intent for a class reference; corrected the caller.
+-92PASS1FAIL in real-boundary expansion exposed missing failed-forwarded-call sync retry; bounded retry added and targeted regression passed.
+-778PASS1FAIL1SKIP exposed a property-name token `exports` being treated as a captured wrapper reference in the new opaque-call effect scan; property names excluded. Final147contract+boundary and final812combined are green. Actual logs preserved; no failures suppressed.
+
+## Preservation and evidence
+
+30dirtysource/test/package paths now visible in `git diff`, including four new files marked intent-to-add only. No staged content. Of22pre-phase dirty paths,17remain byte-identical and5were intentionally extended: export evidence collector, import resolver, name matcher, evidence unit tests, evidence integration tests. Four previously clean production paths changed coherently (const-alias synthesizer, module-importers, engine export, index sync caller); four new paths are the typed value graph, its unit tests, production source contract tests and shared fixtures. Prior changes are backed up intact.
+
+Private evidence root:
+`/home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-value-model-integration-2026-11-09`
+
+Contains before/22files and hashes, milestone1/2 snapshots, final-source/30files, verified source-sha256.json, cumulative-from-875.patch, integration-from-round11.patch, all actual red/green/failure logs, package screen, results.json/progress.json. Local ledger `.review/commonjs-eval-callee-context.md` updated. Plans stay in ~/.codex/plans.
+
+## Next step and authorization
+
+F14/F15are implemented and focused-tested, awaiting independent verification.11native dual-review rounds have completed historically; no reset and no12thround started. Ask before a fresh focused dual review. If approved, use fresh read-only broad/adversarial native agents with exact target `git -C /tmp/codegraph-cjs-missing-fix-20261108 diff 87576a8d9ff0d8aba235db5535f5f4429f14b037 -- .`, same ledger, full30path source hashes and round11delta. Review the source-ownership/value-capability contract, alias caller and failed-forwarding sync work as well as F10–F15preservation. No publication. Normal build/fullsuite once stable review is achieved.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/plan-astra-pr29-export-contract-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/plan-astra-pr29-export-contract-2026-11-09.md
new file mode 100644
index 0000000000..534970c3d9
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/plan-astra-pr29-export-contract-2026-11-09.md
@@ -0,0 +1,27 @@
+# Astra: investigate a typed export-value graph before further integration
+
+Recommendation: replace the collector’s declaration-list contract with a bounded, binding-owned value graph; retain its TypeScript binder and lexical eval adapter. Investigate first; estimated L. This is a contract redesign, not an expando patch plus a node-kind filter.
+
+The root error is substituting declaration ownership/type shape for value flow. F14 loses `api.load = Store.prototype.load` because compiler type enumeration is not a mutation ledger. F15 turns the declaration owning a number into a callable target, and cannot follow `value = real`. Both are demonstrated by round11’s reports; no probes were repeated for this plan.
+
+Three viable boundaries:
+
+1. Patch the current collector: capture local writes and filter calls. Smallest diff, but declaration arrays still conflate exported storage, runtime values, and callable implementations; future assignments/aliases remain separate exceptions. Reject.
+2. Use an explicit, narrow value-flow contract over compiler binding identities. More work, but one representation handles both defects and makes unsupported behavior visible. Recommend.
+3. Shrink/revert the latest integration from saved before/after snapshots, retaining earlier AST/eval work and the safety guard; withhold unsupported targets. Lowest architectural commitment, but loses demonstrated relationships and must not restore the old global guesses. Keep as fallback, not a claimed complete fix. Never reset the checkout: preserve all 22 dirty paths and reverse only reviewed integration hunks in a separate worktree.
+
+The contract:
+
+- Values are callable implementation selectors, class constructors, object identities, primitive data, relative-module references, or unknown. Storage bindings/properties point to values; they are not automatically call targets. Compiler symbols identify bindings; source selectors identify indexed declarations.
+- Each lookup returns positive evidence, proven absence/non-callability, or unknown with a reason. Absence requires a closed known object; unsupported mutation destroys that completeness. Unknown never permits a global name fallback or silently retains a stale callable.
+- Reference/default queries may resolve data ownership. Call queries resolve only a uniquely established callable implementation. Constructor queries are separate: classes are constructible, not ordinary callable functions. Function-valued variables must resolve their function body selector, never pass merely because their graph kind is variable/constant.
+- Record literal property writes against object identity, including object/class/function expandos. `alias = api` shares identity; rebinding alias does not replace api. Exporting api retains identity, so later supported property writes remain visible. Track straight-line binding assignment versions and definite overwrites; branch uncertainty joins alternatives and suppresses a unique answer unless all supported alternatives agree. No execution engine, loop simulation, or custom scope parser.
+- Support explicit initializers, direct assignments, literal keys, prototype method selectors, existing object/instance exports, and relative forwarders. Preserve existing supported parenthesized/logical forms. Dynamic keys, getters/proxies, escaping mutation, reflective operations, and unresolved control flow return localized unknown. Document this coverage boundary rather than claiming complete JavaScript export evaluation.
+
+Preserve F10/F11’s exact lexical eval adapter and existing extraction facts. Reuse binder identities across expanded source through original declaration locations; synthetic declarations without indexed bodies remain unresolved. Literal eval contributes potential static relationships, not proof of invocation. Generator/computed-key relationships and optional-call rejection are mandatory controls. Exact runtime exports and these potential relationships cannot be promised simultaneously without substantially broader execution analysis.
+
+Before production edits, authorize an isolated contract spike and a fixed acceptance matrix using saved round11 fixtures plus overwrite, alias/rebinding, post-export mutation, unknown contamination, and reference-versus-call pairs. Gate: F10–F15 behavior correct; F12/F13 remain clear; forwarder dependencies complete; fresh index equals sync after target addition/removal/rebinding. No new global fallback. Baseline existing focused tests before assessing changes.
+
+Likely scope: commonjs-export-evidence.ts, import-resolver.ts, name-matcher.ts, and focused evidence/default-binding tests; no extraction/schema rewrite. Keep source-hash/versioned resolution-local caching and forwarding dependency invalidation. Retain lazy TypeScript runtime dependency only if isolated measurements justify it: compare cold/warm indexing and heap on representative small/large CJS repositories, not toy collector timings; query-only loading must remain compiler-free.
+
+Stop/pivot if passing the matrix requires interpreting arbitrary calls or expanding syntax exceptions. Use option 3 transparently instead. After a successful spike: bounded integration, focused checks, authorized fresh dual review, then normal build/full suite. Existing 631 passes are supporting history, not final clearance.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/plan-codegraph-pr29-evidence-prototype-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/plan-codegraph-pr29-evidence-prototype-2026-11-09.md
new file mode 100644
index 0000000000..3c6843f70a
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/plan-codegraph-pr29-evidence-prototype-2026-11-09.md
@@ -0,0 +1,16 @@
+# PR29 isolated export-evidence prototype — approved
+
+User approved isolated prototype + acceptance tests, then requested save-as-you-go checkpoints. Production checkout and its 15 dirty source paths must remain unchanged. Current review state F12 variants/F13 open, round10 complete; no new review/publication authorized.
+
+Workspace: /home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-evidence-prototype-2026-11-09 . Use installed TypeScript 5.9.3 only as a dev-time scope/binding experiment, no dependencies added to project. Node built-in test runner, controlled runtime fixtures only.
+
+Milestones, each saved before proceeding:
+1. Validate established binder: actual CommonJS wrapper parameter identity vs local function/block/arrow bindings; parse diagnostics for F10/F11 contextual yield. Record feasibility and limits before choosing implementation.
+2. Implement minimal evidence model/proof paths in isolated files. Positive export/member/instance evidence, independent unknown states, deterministic conflict/unsupported policy. No global-name fallback. Explicitly constrain initialization/order/conditional/alias behavior. Retain proof provenance/ranges and source hash+analyzer version.
+3. Acceptance tests first/red, then implementation/green: original and variant F12, F13; syntax-equivalence/shadow/decoy properties; direct/forwarded; controlled literal eval vs unknown; fresh vs cached/updated model. Compare controlled Node runtime witnesses where applicable, mark unsupported distinctly. Do not claim real CodeGraph sync/native integration or parity.
+4. Record measurements, failures/limits and next integration decision. Save all prototype source/tests/results and a self-contained handoff in plans. Verify production hashes every milestone. No production code, root dependencies/schema/grammar, fullsuite/build, commits/pushes/merge/deploy.
+
+Approval boundary: further production integration requires user approval. A failed feasibility assumption is a result to report, not permission for an unbounded compiler subsystem.
+
+## Completed
+Isolated prototype complete:78tests,6syntax checks passed. Milestone snapshots and actual failure histories saved; production15hashes unchanged. Final report/limits: /home/ericm/.codex/plans/handoff-codegraph-pr29-evidence-prototype-complete-2026-11-09.md. No production integration approved.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/plan-codegraph-pr29-export-evidence-integration-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/plan-codegraph-pr29-export-evidence-integration-2026-11-09.md
new file mode 100644
index 0000000000..e796ef3492
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/plan-codegraph-pr29-export-evidence-integration-2026-11-09.md
@@ -0,0 +1,23 @@
+# PR29 production export-evidence integration — approved
+
+User said "ok run it" after clarification that production integration is unfinished. This authorizes implementing the shared export evidence path in the preserved checkout. Continue save-as-you-go. No review/commit/publication/merge/deploy authorized. Prior15dirtyfiles and all private/control files preserved; baseline saved in original QA private.review/pr29-export-evidence-integration-2026-11-09.
+
+Contract: one lazily computed source-hash/versioned export record per resolution context/file, consumed by both import resolution and fallback guard. Established TypeScript lexical binding/type APIs, no custom scope engine or prototype evaluator. Existing compiler promoted from dev to runtime dependency; import only on relevant CommonJS analysis to protect lightweight read paths. Measure cost with focused tests.
+
+Record: explicit export members/default targets and forwarding sources, declaration source selectors, completeness/unknown reasons, source hash and analyzer version. Static potential relationships, not exact runtime initialization. Literal direct eval payload assignments analyzed in their lexical context, including generator bodies/computed keys; unknown eval supplies no candidate identity. Shadowed wrapper bindings never authorize CJS records. Parenthesized/bracket/logical targets normalized structurally.
+
+1. Add actual F12-variant/F13 and owned-target regressions first, run red.
+2. Implement shared record producer + declaration-to-index-node matching; integrate default/member import resolution and conservative guard; replace CommonJS regex default reader. Preserve explicit aliases, instances, forwarded dependencies, real eval, F10/F11, local shadow/typed paths.
+3. Run focused graph/AST/cache/lazy/storage/worker-related suites. Typecheck/build through normal test setup; final full build/fullsuite deferred until stable review per prior user boundary. No native claim without binary.
+4. Save source/patches/hash/log checkpoints each milestone, report actual checks and remaining limitations. Ask before fresh focused review.
+
+No exact-runtime JavaScript interpreter, grammar or schema changes. The first record is resolution-local and hash-validated rather than a second persisted writer. Extraction's existing export-name helper remains node naming, not export authorization. Existing user AST/eval transport work preserved; no removal without demonstrated replacement clearance.
+
+## Milestone1 saved
+New14graphcases fail before and pass after shared record integration. Genuine generator eval beside decoy methods passes; F12 variants/F13 direct+forwarded pass. Existing full preservation set not run yet. Source/log snapshot in private.review/pr29-export-evidence-integration-2026-11-09/milestone1-source. Compiler promoted to runtime; offline lock refresh passed. Three initial TypeScript API type errors corrected using public APIs; test setup built engine/viewer. No fullsuite/review/publication.
+
+## Milestone2 saved
+Focused10files266PASS1nativeSKIP after missing import typeFrom metadata, indexed object-method mapping and parenthesized eval argument corrections. Existing F10/F11 and new F12/F13 pass, fresh-v-sync preserved. Source/hash/log snapshot milestone2-source/. New lazy compiler-load test prepared; next neighboring import/default-export coverage. No new review/fullsuite/publication.
+
+## Implementation complete, focused verified
+631distinct finalPASS1nativeSKIP across20files, current source frozen22paths. Review pending; no new review/fullsuite/publication. Latest checkpoint: /home/ericm/.codex/plans/handoff-codegraph-pr29-export-evidence-integrated-2026-11-09.md
diff --git a/docs/handoffs/pr29-2026-11-10/plans/plan-codegraph-pr29-f12-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/plan-codegraph-pr29-f12-2026-11-09.md
new file mode 100644
index 0000000000..54022bfc5c
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/plan-codegraph-pr29-f12-2026-11-09.md
@@ -0,0 +1,11 @@
+# PR29 F12 correction — approved 2026-11-09
+
+User approved the focused F12 correction after reading the session-end handoff. Preserve this checkout, 15 dirty source paths and private .review. HEAD 87576a8d; no commits, pushes, new reviews, merges or deployments in this phase.
+
+1. Add runtime-backed failures for root object alias and root instance under optional yield wrapper / unknown eval fact.
+2. Record export form independently from eval certainty. A syntactically stated whole module.exports value preserves existing value resolution; the property-write member set is not its inventory. Unknown eval must still suppress unsupported guesses without such a stated value, and must never imply absent eval.
+3. Pin reader matrix namespace writes / direct alias / root object / instance / opaque x eval absent/present/unknown. Cover mixed and bracket assignments. Pin real graph matrix for the first four forms, direct and forwarded, plus fresh-vs-sync transitions and prior F10/F11.
+4. Change only commonjs-export-members.ts and name-matcher.ts plus their two tests. Keep extraction/storage/grammar untouched.
+5. Run focused suite (existing eight files and expanded cases), save source hashes/delta/logs/checkpoint, report and ask before fresh dual review. Final normal build/full suite are deferred until stable review clearance per user handoff.
+
+Review count remains 9. Keep PR29 and proposed two-commit organization; committing remains a later step. Baseline backup: original QA .review/commonjs-fix-2026-11-08/pr29-f12-2026-11-09/before.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/plan-codegraph-pr29-harness-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/plan-codegraph-pr29-harness-2026-11-09.md
new file mode 100644
index 0000000000..236d8012e6
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/plan-codegraph-pr29-harness-2026-11-09.md
@@ -0,0 +1,15 @@
+# PR29 isolated harness comparison — approved
+
+User said proceed after recommendation to run baseline-versus-candidate harness on isolated copies. Preserve the original checkout, every uncommitted change, existing QA workspace and paused experimental T0. No implementation edits, review agents, commits, pushes, deployment, account work or publication.
+
+Use the QA workspace's deterministic harness: fixture replay with anonymous canaries on baseline and candidate, canonical graph build comparison on pinned available dev corpus, agent-facing shadow comparison, and execution-mode/metamorphic checks including sync/reindex/repeat. Baseline is original PR29 HEAD87576a8d; candidate is current saved30path working diff. Copy source and dependencies into independent /tmp directories; build only those copies. Keep exact source and adapter hashes, corpus pins, commands, logs, results and limitations in private originalQA .review. No model agents or API spend needed for deterministic measurement.
+
+Classify expected fixes separately from newly lost correct edges, baseline-known problems, harness failures and actual regressions. A successful process exit is not a clean result unless verdicts support it. Preserve failures and stop before fixing discovered defects. Native binary absent, so WASM-only; no native parity claim. Do not resume T0 or run overnight private-project history harness. Verify original source hashes and Git status at the end.
+
+## Running checkpoint
+
+Work /tmp/codegraph-pr29-harness-6fevujfy; durable output /home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-harness-20261110T013135Z. Both isolated normal builds PASS.70fixtures replayed per arm, candidate32/32PR29casesFIXED and70/70canariesPASS; all38existingverdictsunchanged. Baseline canary1FAIL optional-wrapper. Four of five dev corpus graphs identical; Express64oldcalltargetsremoved (52incorrect,12externalvariable/unproven), no files/nodes changed. Shadow17SAME6CHANGED, no failures/unstable. Both modes99comparisonsPASS (11inputs; repeat/workers/reindex/sync), no DIFFER/FAILED. Meta jobs running (sessions82881/24349), timing queued after them. Original2019trackedfilehashes and Git status match. Inputs/source archives copied durably; no fixes. See execution.json/progress.json in output.
+
+## Completed2026-11-10
+
+Harness complete; correctness improves in testedscope, no new invariantdifferences, measured indexing regressions Ky+12.5%,Express+38.0% (4samples/build), Requestsflat. Originalcheckout unchanged. Read /home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-harness-20261110T013135Z/report.md and handoff-codegraph-pr29-harness-complete-2026-11-10.md. No fixes or new review. Recommend profiling next with user authorization before implementation.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/plan-codegraph-pr29-value-contract-spike-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/plan-codegraph-pr29-value-contract-spike-2026-11-09.md
new file mode 100644
index 0000000000..b961f4bb6e
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/plan-codegraph-pr29-value-contract-spike-2026-11-09.md
@@ -0,0 +1,14 @@
+# PR29 bounded value contract experiment — approved
+
+User said proceed after independent Astra/Sol plans converged. Scope is combined isolated contract experiment, not production integration/review/publication. Preserve22dirtypaths and round11 F14/F15 evidence. Save checkpoints after each milestone.
+
+Workspace: /home/ericm/personal_projects/codegraph-qa/codex-20261107-122850-780/.review/commonjs-fix-2026-11-08/pr29-value-contract-spike-2026-11-09
+
+1. Fixed IR acceptance matrix before code: reference/call/construct distinctions; object/class/function property writes; data exports; reassigned callables; alias identity/rebinding/overwrites/post-export mutation; uncertain branches/escapes; localized completeness. Compiler bindings and existing recorded fixtures reused.
+2. Implement typed value/property/binding graph with independent reference/callable/constructor selectors. No general calls/interpreter or custom scope parser. Failures are contract evidence; do not weaken tests.
+3. Bounded source-to-facts adapter using existing binder and lexical eval expansion. Static potential literal-eval relationships include F10/F11 generator/computed-key cases without executing generators. Unknown supplies no name fallback or stale callable. Original F10–F15 cases mandatory; existing dynamic-eval compatibility must be explicit.
+4. Direct/forwarded source fixtures and update=fresh checks; controlled runtime oracle only. These do not claim actual CodeGraph sync/native integration. Measure only what runs; representative performance remains a later integration gate.
+5. Save all source/tests/red-green logs/contract table/results/handoff. Verify production22hashes at each checkpoint. Stop and report if mandatory coverage requires arbitrary execution or fixture-specific authority; no production edits until user decision.
+
+## Complete
+99testsPASS,7syntaxchecksPASS. Production22hashes unchanged. Representation/selected semantic gate passes; source adapter broader coverage gate fails (3Commander files unknown/destructured initialization). Do not promote adapter wholesale. Latest checkpoint: /home/ericm/.codex/plans/handoff-codegraph-pr29-value-contract-complete-2026-11-09.md . Production integration/new review remain separate decision.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/plan-codegraph-pr29-value-model-integration-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/plan-codegraph-pr29-value-model-integration-2026-11-09.md
new file mode 100644
index 0000000000..ec4c8d172c
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/plan-codegraph-pr29-value-model-integration-2026-11-09.md
@@ -0,0 +1,14 @@
+# Production value-model integration — approved
+
+User said proceed after completed99-test value contract experiment and recommendation to adapt its representation into existing collector. This authorizes production implementation in existing checkout; no new review/commit/publication. Save progress each milestone. Preserve all22dirtypaths; baseline private.review/pr29-value-model-integration-2026-11-09.
+
+Replace declaration-as-value/callable contract with typed binding/property/value identities and independent reference/call/construct capabilities. Retain existing TypeScript binder, broader type/source handling, caller shadow detection, lexical eval adapter, sourcehash/version memoization and forwarding/typeFrom dependencies. Do not port standalone statement adapter (Commander coverage failed). Type shapes seed known declared values; explicit local property writes/strong binding changes own their slot and override type guesses. Unknown/ambiguous values produce no global fallback or stale callable.
+
+1. Add real Graph F14 object/class/function writes and F15 data/assigned callable, direct+forwarded and varied import forms first/red.
+2. Implement pure typed value graph; adapt existing collector into it; map source declaration selectors to actual index nodes. Calls require callable selectors, constructors distinct, references may retain data ownership. Keep syntax/TS declarations working and localize unsupported constructs.
+3. Run99contract acceptance against production representation, focused existing631+new regressions, actualsync/typeFrom, caller/import/shadowing, lazycompiler checks; representative installed CJS source coverage/perf screen. Nativebinaryabsent -> no parity claim. Finalnormalfullbuild/fullsuite deferred until stable independentreview per earlier boundary.
+4. Freeze source+hashes, save actual failures/greenlogs/patches/handoff, ask before new focused dualreview. Existing11reviewrounds not reset.
+
+## Saved outcome
+
+Production integration and focused verification complete:819distinctPASS1nativeSKIP over26files; tsc/noEmit and whitespace checks pass.30source paths frozen with hashes/backups, no staged content or commits.11review rounds completed historically; no new review started. Await user decision on fresh dual review. Details: handoff-codegraph-pr29-value-model-integrated-2026-11-09.md. Normal build/fullsuite remain deferred until stable review.
diff --git a/docs/handoffs/pr29-2026-11-10/plans/plan-sol-pr29-export-contract-2026-11-09.md b/docs/handoffs/pr29-2026-11-10/plans/plan-sol-pr29-export-contract-2026-11-09.md
new file mode 100644
index 0000000000..b4efc83fc8
--- /dev/null
+++ b/docs/handoffs/pr29-2026-11-10/plans/plan-sol-pr29-export-contract-2026-11-09.md
@@ -0,0 +1,35 @@
+# Sol independent plan: separate exported identity from callable identity
+
+Read-only design against HEAD `87576a8d` plus the preserved 22 dirty paths. Evidence: round11 broad/adversarial reports and current collector/consumers; no new probes or source changes.
+
+## Diagnosis and choice
+
+F14 and F15 expose one contract error: declaration ownership is being used as value identity, export shape, and callability simultaneously. The collector returns a variable declaration when value analysis stops; consumers accept it as a call target. Conversely, the compiler's inferred type is treated as the complete exported shape, losing explicit local property writes. Improving syntax recognition alone cannot repair this boundary.
+
+Three viable boundaries:
+
+1. Extend current `targets`/`membersOf`: smallest delta, but preserves conflated contracts and makes every new write form another special case. Reject.
+2. Replace the record's semantics with a small binding-owned value/relationship graph, keeping TypeScript binding and the existing eval adapter. Choose this: explicit properties and callable aliases become the same relationship mechanism.
+3. Restore pre-integration consumers selectively from preserved snapshots, keeping other dirty work. Removes compiler deployment cost but reopens F12/F13 unless replaced with another ownership authority. Reserve for failed feasibility, never silently restore global guesses.
+
+## Contract before implementation
+
+Each export lookup returns independently: value/reference selector, callable selector, property completeness, and evidence dependencies. Use a discriminated result: positive, proven absent/non-callable, or unknown. Unknown never enables name fallback. A positive reference to `value=42` remains valid for data access; invoking it produces no call target. `new Store()` has instance identity, not Store's callable identity; exported classes distinguish constructor invocation from ordinary calls.
+
+Represent local bindings by compiler symbol identity and allocations by declaration/source identity. Record literal-key writes against those identities, including object/class/function expandos and `prototype` method selections. Binding aliases point to values; property aliases point to selected member values. Thus `api.load=Store.prototype.load; module.exports=api` preserves ownership without copying names globally. Direct function/arrow/method declarations supply callable identity; variable/constant node kinds never establish it.
+
+Use a bounded def-use solver, not JavaScript execution: declaration initializers and unambiguous straight-line assignments transfer identities; overwrites supersede prior facts; aliases preserve shared property ownership. Conflicting reaching definitions, escapes, getters, dynamic keys and unsupported control flow mark the affected slot unknown. Do not union overwritten callables into a purported unique target. Do not attempt getters, proxies, arbitrary function returns or heap simulation.
+
+Default imports and references consume value identity; call references consume callable identity. Both import resolver and name-matcher guard consume the same result. Relative forwarders retain dependency paths and cycle/depth limits; unsupported forwarding remains unknown. Source/version caches stay resolution-local, and sync invalidates using all contributing files.
+
+Keep direct literal-eval parsing in its original lexical context, with current source mapping and binding checks. Mandatory F10/F11 compatibility includes genuine generator/computed-key eval and optional/non-direct/local eval rejection. These are static potential relationships, not proof that a generator executed. Runtime-precise reachability and this existing compatibility promise cannot both be claimed.
+
+## Feasibility gate and implementation scope
+
+Before production changes, specify a table of expected reference/call/unknown results and build an isolated throwaway contract spike using current TypeScript binding plus relationship facts. Require F14's object/class/function writes; F15's numeric/string data and assigned callable; overwrite, shadowed binding, alias mutation, ambiguous branch, direct/forwarded and fresh/sync controls; all original F10–F13 fixtures. Reuse recorded evidence; do not rerun old exploratory probes.
+
+Proceed only if one identity model handles every mandatory row without fixture-specific syntax exceptions. Likely production files: `commonjs-export-evidence.ts`, `import-resolver.ts`, `name-matcher.ts`; corresponding collector and graph regression tests. Preserve extraction/eval storage, package dependency and unrelated dirty paths.
+
+Acceptance: exact intended declaration, zero data-call edges/global guesses, consistent shared guards, dependency-complete sync/fresh equality, lazy compiler loading. Retain runtime TypeScript for trustworthy scoping; measure real representative resolution throughput and memory against the frozen integration before claiming acceptable cost. Focused tests precede the repository's normal build/full suite and fresh authorized dual review.
+
+Stop/pivot if mandatory coverage requires general execution or divergent authorities, or measured compiler/solver cost is unacceptable. Present a scoped rollback and explicitly reduced coverage for approval; do not keep accumulating patches.
diff --git a/package-lock.json b/package-lock.json
index 7851f8eccd..abf48cc6dd 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -22,6 +22,7 @@
         "picomatch": "^4.0.3",
         "sisteransi": "^1.0.5",
         "tree-sitter-wasms": "^0.1.11",
+        "typescript": "^5.9.3",
         "web-tree-sitter": "0.25.10"
       },
       "bin": {
@@ -32,7 +33,6 @@
         "@types/node": "^20.19.30",
         "@types/picomatch": "^4.0.2",
         "jsdom": "^25.0.1",
-        "typescript": "^5.0.0",
         "vitest": "^4.1.11"
       },
       "engines": {
@@ -2768,7 +2768,6 @@
       "version": "5.9.3",
       "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
-      "dev": true,
       "license": "Apache-2.0",
       "bin": {
         "tsc": "bin/tsc",
diff --git a/package.json b/package.json
index 23c67dcf7f..05074181b4 100644
--- a/package.json
+++ b/package.json
@@ -59,6 +59,7 @@
     "picomatch": "^4.0.3",
     "sisteransi": "^1.0.5",
     "tree-sitter-wasms": "^0.1.11",
+    "typescript": "^5.9.3",
     "web-tree-sitter": "0.25.10"
   },
   "devDependencies": {
@@ -66,7 +67,6 @@
     "@types/node": "^20.19.30",
     "@types/picomatch": "^4.0.2",
     "jsdom": "^25.0.1",
-    "typescript": "^5.0.0",
     "vitest": "^4.1.11"
   },
   "engines": {
diff --git a/src/db/queries.ts b/src/db/queries.ts
index 6647075d8a..2b2d0e0a22 100644
--- a/src/db/queries.ts
+++ b/src/db/queries.ts
@@ -4073,6 +4073,16 @@ export class QueryBuilder {
       // edit must lose the flag on the next sync, not keep a stale 1.
       generated: file.generated ? 1 : 0,
     });
+    if (file.commonJsEvalCall !== undefined) {
+      this.setMetadata(`commonjs_eval:${file.path}`, JSON.stringify({ contentHash: file.contentHash, value: file.commonJsEvalCall }));
+    }
+  }
+
+  /** Only a fact from the exact source can prove an eval call absent. */
+  getCommonJsEvalCall(filePath: string, contentHash: string): boolean | null {
+    const raw = this.getMetadata(`commonjs_eval:${filePath}`);
+    const fact = raw === null ? null : safeJsonParse(raw, null) as { contentHash?: unknown; value?: unknown } | null;
+    return fact?.contentHash === contentHash && typeof fact.value === 'boolean' ? fact.value : null;
   }
 
   /**
@@ -4262,6 +4272,7 @@ export class QueryBuilder {
         this.stmts.deleteFile = this.db.prepare('DELETE FROM files WHERE path = ?');
       }
       this.stmts.deleteFile.run(filePath);
+      this.db.prepare('DELETE FROM project_metadata WHERE key = ?').run(`commonjs_eval:${filePath}`);
     })();
   }
 
diff --git a/src/engine.ts b/src/engine.ts
index 3809052150..e28e681606 100644
--- a/src/engine.ts
+++ b/src/engine.ts
@@ -13,6 +13,7 @@ export { ESM_IMPORT_LANGUAGES } from './resolution/import-resolver';
 export {
   createImportReader,
   reopenNameMatchedImports,
+  reopenFailedReferencesThroughCommonJs,
   reopenReferencesThroughAddedFiles,
   reopenReferencesThroughBarrels,
   reopenReferencesThroughChangedDefaults,
diff --git a/src/extraction/commonjs-eval.ts b/src/extraction/commonjs-eval.ts
new file mode 100644
index 0000000000..086f5a6b61
--- /dev/null
+++ b/src/extraction/commonjs-eval.ts
@@ -0,0 +1,60 @@
+import type { Node as SyntaxNode } from 'web-tree-sitter';
+import type { Language } from '../types';
+import { getParser } from './grammars';
+
+export function isCommonJsEvalLanguage(language: Language): boolean {
+  return language === 'javascript' || language === 'jsx' || language === 'typescript' || language === 'tsx';
+}
+
+/** Native/deferred extraction has no reusable WASM tree. Parse only relevant files. */
+export function commonJsEvalCallFromSource(source: string, language: Language): boolean | null | undefined {
+  if (!isCommonJsEvalLanguage(language) || !source.includes('eval')) return undefined;
+  const tree = getParser(language)?.parse(source);
+  if (!tree) return null;
+  try { return hasCommonJsEvalCall(tree.rootNode); }
+  finally { tree.delete(); }
+}
+
+/**
+ * Whether a file contains a syntactic direct eval call. Null means that parse
+ * errors prevented proving its absence. This reads the existing tree only.
+ */
+export function hasCommonJsEvalCall(root: SyntaxNode): boolean | null {
+  const pending = [root];
+  while (pending.length > 0) {
+    const node = pending.pop()!;
+    if (node.type === 'call_expression') {
+      let callee = node.childForFieldName('function');
+      while (callee?.type === 'parenthesized_expression' && callee.namedChildCount === 1) {
+        callee = callee.namedChild(0);
+      }
+      if (callee?.type === 'identifier' && callee.text === 'eval' && !isNonGeneratorYieldArgument(node)) {
+        return true;
+      }
+    }
+    for (const child of node.namedChildren) pending.push(child);
+  }
+  return root.hasError ? null : false;
+}
+
+/**
+ * The JS grammar accepts yield expressions outside generators. In CommonJS,
+ * yield can instead be a wrapper's identifier: yield(eval)(code). Its operand
+ * looks like an eval call in that tree, but eval was only passed as a value.
+ * A nested real call, yield(eval(code)), is not the direct yield operand and
+ * remains a call. Function ancestry distinguishes this from generator yield.
+ */
+function isNonGeneratorYieldArgument(call: SyntaxNode): boolean {
+  if (call.parent?.type !== 'yield_expression') return false;
+  for (let scope = call.parent.parent; scope; scope = scope.parent) {
+    if (scope.type === 'generator_function' || scope.type === 'generator_function_declaration') return false;
+    if (scope.type === 'method_definition') {
+      // Computed keys and decorators run outside the method's function scope.
+      const regions = [scope.childForFieldName('body'), scope.childForFieldName('parameters')];
+      if (!regions.some((region) => region && region.startIndex <= call.startIndex && call.endIndex <= region.endIndex)) continue;
+      return !scope.children.some((child) => child.type === '*');
+    }
+    if (scope.type === 'function_expression' || scope.type === 'function_declaration' || scope.type === 'arrow_function') return true;
+  }
+  return true;
+}
diff --git a/src/extraction/index.ts b/src/extraction/index.ts
index 08d0c3b15f..8236bc018d 100644
--- a/src/extraction/index.ts
+++ b/src/extraction/index.ts
@@ -2680,7 +2680,7 @@ export class ExtractionOrchestrator {
             filePath,
             language,
             buffers: result.kernelBuffers,
-            file: this.buildFileRecord(filePath, content, language, stats, nodeCount, result.errors),
+            file: this.buildFileRecord(filePath, content, language, stats, nodeCount, result.errors, result.commonJsEvalCall),
             ...(result.unresolvedReferences.length > 0 ? { extraRefs: result.unresolvedReferences } : {}),
           });
         } else {
@@ -3442,6 +3442,7 @@ export class ExtractionOrchestrator {
             nodeCount: result.nodes.length,
             errors: result.errors.length > 0 ? result.errors : undefined,
             generated,
+            commonJsEvalCall: result.commonJsEvalCall,
           },
         });
         // On a fresh bulk index crossFileIncomingEdges is [].
@@ -3511,6 +3512,7 @@ export class ExtractionOrchestrator {
       nodeCount: result.nodes.length,
       errors: result.errors.length > 0 ? result.errors : undefined,
       generated,
+      commonJsEvalCall: result.commonJsEvalCall,
     };
     this.queries.upsertFile(fileRecord);
   }
@@ -3527,7 +3529,8 @@ export class ExtractionOrchestrator {
     language: Language,
     stats: fs.Stats,
     nodeCount: number,
-    resultErrors: ExtractionResult['errors']
+    resultErrors: ExtractionResult['errors'],
+    commonJsEvalCall?: boolean | null
   ): FileRecord {
     return {
       path: filePath,
@@ -3542,6 +3545,7 @@ export class ExtractionOrchestrator {
       // query time (#1500). The header scan short-circuits on a single
       // substring test for ~every hand-written file.
       generated: detectGeneratedFile(filePath, content),
+      commonJsEvalCall,
     };
   }
 
@@ -3556,7 +3560,7 @@ export class ExtractionOrchestrator {
       result,
       filePath,
       language,
-      this.buildFileRecord(filePath, content, language, stats, result.nodes.length, result.errors)
+      this.buildFileRecord(filePath, content, language, stats, result.nodes.length, result.errors, result.commonJsEvalCall)
     );
   }
 
diff --git a/src/extraction/kernel/index.ts b/src/extraction/kernel/index.ts
index 17281ffa71..6f641e55db 100644
--- a/src/extraction/kernel/index.ts
+++ b/src/extraction/kernel/index.ts
@@ -300,6 +300,7 @@ export function materializeKernelResult(
     language
   );
   decoded.durationMs = result.durationMs;
+  if (result.commonJsEvalCall !== undefined) decoded.commonJsEvalCall = result.commonJsEvalCall;
   // References read beside the tables (a CommonJS `require`) ride on the transport.
   if (result.unresolvedReferences.length > 0) decoded.unresolvedReferences.push(...result.unresolvedReferences);
   return decoded;
diff --git a/src/extraction/parse-worker.ts b/src/extraction/parse-worker.ts
index aca751f93c..b763bbf5ea 100644
--- a/src/extraction/parse-worker.ts
+++ b/src/extraction/parse-worker.ts
@@ -15,6 +15,7 @@ import { extractFromSource } from './tree-sitter';
 import { detectLanguage, loadGrammarsForLanguages, resetParser } from './grammars';
 import { tryKernelExtractRaw } from './kernel';
 import { commonJsRequireRefs } from './commonjs-requires';
+import { commonJsEvalCallFromSource } from './commonjs-eval';
 import { frameworks } from './lazy-frameworks';
 import { mayDefineCppMacroMethods } from './languages/cpp-macro-methods';
 import type { Language, ExtractionResult } from '../types';
@@ -101,6 +102,7 @@ parentPort!.on('message', async (msg: { type: string; id?: number; filePath?: st
       if (!frameworksNeedDecode && !(language === 'cpp' && mayDefineCppMacroMethods(content!))) {
         const raw = tryKernelExtractRaw(filePath!, content!, language);
         if (raw) {
+          const commonJsEvalCall = commonJsEvalCallFromSource(content!, language);
           result = {
             nodes: [],
             edges: [],
@@ -110,6 +112,7 @@ parentPort!.on('message', async (msg: { type: string; id?: number; filePath?: st
             durationMs: 0,
             kernelBuffers: raw.buffers,
             kernelCounts: raw.counts,
+            ...(commonJsEvalCall !== undefined ? { commonJsEvalCall } : {}),
           };
         }
       }
diff --git a/src/extraction/tree-sitter.ts b/src/extraction/tree-sitter.ts
index 784d13d292..67972b7505 100644
--- a/src/extraction/tree-sitter.ts
+++ b/src/extraction/tree-sitter.ts
@@ -39,6 +39,7 @@ import { MyBatisExtractor } from './mybatis-extractor';
 import { CfmlExtractor } from './cfml-extractor';
 import { tryKernelExtract, takeDeferredPreParse } from './kernel';
 import { commonJsRequireRefs } from './commonjs-requires';
+import { commonJsEvalCallFromSource, hasCommonJsEvalCall, isCommonJsEvalLanguage } from './commonjs-eval';
 import { frameworks } from './lazy-frameworks';
 
 // Re-export for backward compatibility
@@ -978,6 +979,7 @@ export class TreeSitterExtractor {
    */
   extract(): ExtractionResult {
     const startTime = Date.now();
+    let commonJsEvalCall: boolean | null | undefined;
 
     if (!isLanguageSupported(this.language)) {
       return {
@@ -1030,6 +1032,9 @@ export class TreeSitterExtractor {
       if (!this.tree) {
         throw new Error('Parser returned null tree');
       }
+      if (isCommonJsEvalLanguage(this.language) && this.source.includes('eval')) {
+        commonJsEvalCall = hasCommonJsEvalCall(this.tree.rootNode);
+      }
       if (this.language === 'cpp' && this.tree.rootNode.hasError) {
         this.cppBraceScopes = scanCppBraceScopes(this.source);
       }
@@ -1129,6 +1134,7 @@ export class TreeSitterExtractor {
       unresolvedReferences: this.unresolvedReferences,
       errors: this.errors,
       durationMs: Date.now() - startTime,
+      ...(commonJsEvalCall !== undefined ? { commonJsEvalCall } : {}),
     };
   }
 
@@ -10040,6 +10046,8 @@ export function extractFromSource(
     const kernelResult = tryKernelExtract(filePath, source, detectedLanguage);
     if (kernelResult) {
       result = kernelResult;
+      const fact = commonJsEvalCallFromSource(source, detectedLanguage);
+      if (fact !== undefined) result.commonJsEvalCall = fact;
     } else {
       // A kernel-deferred file already paid the (offset-preserving) preParse
       // at the route point — reuse those bytes instead of blanking again.
diff --git a/src/index.ts b/src/index.ts
index 2633149803..cd14b69058 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -1119,6 +1119,7 @@ export class CodeGraph {
       moduleConfigLanguages,
       parseModuleConfigSnapshot,
       reopenNameMatchedImports,
+      reopenFailedReferencesThroughCommonJs,
       reopenReferencesThroughAddedFiles,
       reopenReferencesThroughBarrels,
       reopenReferencesThroughChangedDefaults,
@@ -1553,6 +1554,7 @@ export class CodeGraph {
               const file = this.queries.getFileByPath(filePath);
               return file ? [{ path: filePath, language: file.language }] : [];
             });
+            reopenFailedReferencesThroughCommonJs(this.queries, importReader, editedModules);
             const nameMatched = reopenNameMatchedImports(
               this.queries, importReader, editedModules, edgesBeforeResolution,
               (specifier, fromFile, language) => this.resolver.resolveModuleFile(specifier, fromFile, language),
diff --git a/src/resolution/commonjs-export-evidence.ts b/src/resolution/commonjs-export-evidence.ts
new file mode 100644
index 0000000000..9d2dfbda26
--- /dev/null
+++ b/src/resolution/commonjs-export-evidence.ts
@@ -0,0 +1,775 @@
+import { createHash } from 'crypto';
+import type * as TS from 'typescript';
+import type { Node } from '../types';
+import type { ResolutionContext } from './types';
+import { CommonJsValueGraph, type CommonJsValue, type CommonJsValueResult, type CommonJsIntent, type CommonJsDeclaration } from './commonjs-value-graph';
+
+type Declaration = CommonJsDeclaration;
+
+/** Positive static relationships. Completeness never grants a candidate. */
+export interface CommonJsExportEvidence {
+  version: 2;
+  sourceHash: string;
+  commonJs: boolean;
+  defaults: Declaration[];
+  graph: CommonJsValueGraph;
+  exported: CommonJsValue;
+  members: Record<string, Declaration[]>;
+  forwards: string[];
+  /** Modules the whole exported value forwards into (`module.exports = require(…)`). */
+  exportForwards: string[];
+  unknown: boolean;
+  /**
+   * Why this file is outside the model, when it is. Such a record has
+   * commonJs false, so every resolver takes its pre-model path for the file.
+   */
+  unmodeled?: string;
+  importShadows: Array<{ name: string; startLine: number; startColumn: number; endLine: number; endColumn: number }>;
+}
+
+let compiler: typeof TS | undefined;
+// Loading the library/CLI for a read must not load the compiler.
+function api(): typeof TS { return compiler ??= require('typescript') as typeof TS; }
+const records = new WeakMap<ResolutionContext, Map<string, { source: string; record: CommonJsExportEvidence }>>();
+
+export function clearCommonJsExportEvidence(context: ResolutionContext): void { records.delete(context); }
+
+export function commonJsExportEvidence(file: string, context: ResolutionContext): CommonJsExportEvidence | undefined {
+  const record = commonJsExportEvidenceOf(file, context);
+  return record && forwardsOutside(file, record, context);
+}
+
+const outsideCopies = new WeakMap<CommonJsExportEvidence, CommonJsExportEvidence>();
+/**
+ * A modelled file whose exports forward into a file outside the model (ESM,
+ * unparsed, unmodelled) is outside it too: the model cannot answer for the
+ * forwarded part, and the pre-model path can. Checked on every read, since it
+ * depends on other files.
+ */
+function forwardsOutside(file: string, record: CommonJsExportEvidence, context: ResolutionContext, seen = new Set<string>()): CommonJsExportEvidence {
+  if (!record.commonJs || !record.exportForwards.length) return record;
+  seen.add(file);
+  for (const source of record.exportForwards) {
+    const next = context.resolveModuleFile?.(source, file, 'javascript');
+    if (!next || seen.has(next) || seen.size >= 8) continue;
+    const target = commonJsExportEvidenceOf(next, context);
+    if (target && forwardsOutside(next, target, context, seen).commonJs) continue;
+    if (!/\.[cm]?[jt]sx?$/.test(next) || /\.d\.[cm]?ts$/.test(next)) continue;
+    let copy = outsideCopies.get(record);
+    if (!copy) outsideCopies.set(record, copy = { ...record, commonJs: false, unmodeled: 'forward outside the model', unknown: true });
+    return copy;
+  }
+  return record;
+}
+
+/** The cached record of one file, without the cross-file forward check. */
+function commonJsExportEvidenceOf(file: string, context: ResolutionContext): CommonJsExportEvidence | undefined {
+  if (!/\.[cm]?[jt]sx?$/.test(file) || /\.d\.[cm]?ts$/.test(file)) return undefined;
+  const source = context.readFile(file);
+  if (source === null) return undefined;
+  let cache = records.get(context);
+  if (!cache) records.set(context, cache = new Map());
+  const previous = cache.get(file);
+  if (previous?.source === source) return previous.record;
+  const record = collectCommonJsExportEvidence(source, file);
+  cache.set(file, { source, record });
+  return record;
+}
+
+/** No AST/compiler objects escape into the record or its cache. */
+export function collectCommonJsExportEvidence(source: string, file: string): CommonJsExportEvidence {
+  const ts = api();
+  const result: CommonJsExportEvidence = {
+    version: 2, graph: new CommonJsValueGraph(), exported: { kind: 'unknown', reason: 'not analyzed' }, sourceHash: createHash('sha256').update(source).digest('hex'),
+    commonJs: true, defaults: [], members: Object.create(null) as Record<string, Declaration[]>, forwards: [], exportForwards: [], unknown: false, importShadows: [],
+  };
+  const unwrap = (expression: TS.Expression): TS.Expression => {
+    while (ts.isParenthesizedExpression(expression) || ts.isAsExpression(expression) || ts.isNonNullExpression(expression)) expression = expression.expression;
+    return expression;
+  };
+  const bind = (text: string) => {
+    // A hashbang is legal only at offset 0, which the wrapper moves; blank it
+    // in place (after any BOM) so every later offset is unchanged.
+    text = text.replace(/^(\uFEFF?)#![^\n\r\u2028\u2029]*/, (line, bom: string) => bom + ' '.repeat(line.length - bom.length));
+    const prefix = 'function __codegraph_cjs(exports, require, module, __filename, __dirname) {\n';
+    const filename = `/${file}`;
+    const tree = ts.createSourceFile(filename, `${prefix}${text}\n}`, ts.ScriptTarget.Latest, true,
+      /\.tsx$/.test(file) ? ts.ScriptKind.TSX : /\.jsx$/.test(file) ? ts.ScriptKind.JSX : /\.[cm]?ts$/.test(file) ? ts.ScriptKind.TS : ts.ScriptKind.JS);
+    const host: TS.CompilerHost = {
+      getSourceFile: name => name === filename ? tree : undefined,
+      getDefaultLibFileName: () => '', writeFile: () => {}, getCurrentDirectory: () => '/', getDirectories: () => [],
+      fileExists: name => name === filename, readFile: name => name === filename ? tree.text : undefined,
+      getCanonicalFileName: name => name, useCaseSensitiveFileNames: () => true, getNewLine: () => '\n',
+    };
+    const program = ts.createProgram([filename], { allowJs: true, noLib: true, noResolve: true, jsx: ts.JsxEmit.Preserve }, host);
+    const checker = program.getTypeChecker();
+    const wrapper = tree.statements[0] as TS.FunctionDeclaration;
+    const parameters = new Map(wrapper.parameters.map(p => [(p.name as TS.Identifier).text, checker.getSymbolAtLocation(p.name)]));
+    const symbol = (identifier: TS.Identifier) => checker.resolveName(identifier.text, identifier, ts.SymbolFlags.Value, false);
+    const isBinding = (expression: TS.Expression, name: string) => {
+      expression = unwrap(expression);
+      return ts.isIdentifier(expression) && symbol(expression) === parameters.get(name);
+    };
+    return { tree, wrapper, parameters, checker, symbol, isBinding, diagnostics: program.getSyntacticDiagnostics(tree).filter(diagnostic => !SLOPPY_SYNTAX.has(diagnostic.code) &&
+      !(diagnostic.code >= 8002 && diagnostic.code <= 8017)), prefix: prefix.length };
+  };
+  type Bound = ReturnType<typeof bind>;
+  const functionLike = (node: TS.Node): boolean => ts.isFunctionLike(node) || ts.isClassStaticBlockDeclaration(node) ||
+    ts.isPropertyDeclaration(node);
+  /**
+   * Rule 1, an allowlist over uses of the CommonJS bindings (webpack/esbuild
+   * bail out the same way): every reference to `module`, `exports`,
+   * `module.exports` or a top-level alias of them must sit in a position this
+   * analysis models. Any other use leaves the model, so a shape nobody listed
+   * bails instead of reading as complete absence.
+   */
+  const bindingUses = (body: TS.Block, b: Bound): string | undefined => {
+    const skip = (node: TS.Node): TS.Node => {
+      let parent = node.parent;
+      while (parent && (ts.isParenthesizedExpression(parent) || ts.isAsExpression(parent) || ts.isNonNullExpression(parent))) { node = parent; parent = node.parent; }
+      return node;
+    };
+    // aliases: other names for the exports object; values: top-level values
+    // written into it, whose members a nested function must not write either.
+    const aliases = new Set<TS.Symbol>(), values = new Set<TS.Symbol>();
+    const exportsObject = (expression: TS.Expression): boolean => {
+      expression = unwrap(expression);
+      if (ts.isBinaryExpression(expression) && expression.operatorToken.kind === ts.SyntaxKind.EqualsToken) return exportsObject(expression.left) || exportsObject(expression.right);
+      if (moduleExports(expression)) return true;
+      if (!ts.isIdentifier(expression)) return false;
+      const symbol = b.symbol(expression);
+      return b.isBinding(expression, 'exports') || (symbol !== undefined && aliases.has(symbol));
+    };
+    function moduleExports(expression: TS.Expression): boolean {
+      expression = unwrap(expression);
+      const name = ts.isPropertyAccessExpression(expression) ? expression.name.text :
+        ts.isElementAccessExpression(expression) && ts.isStringLiteralLike(unwrap(expression.argumentExpression)) ? (unwrap(expression.argumentExpression) as TS.StringLiteralLike).text : undefined;
+      return name === 'exports' && b.isBinding((expression as TS.PropertyAccessExpression).expression, 'module');
+    }
+    const rootOf = (expression: TS.Expression): TS.Expression => {
+      expression = unwrap(expression);
+      while (ts.isPropertyAccessExpression(expression) || ts.isElementAccessExpression(expression)) {
+        if (moduleExports(expression)) return expression;
+        expression = unwrap(expression.expression);
+      }
+      return expression;
+    };
+    let changed = true;
+    const collect = (node: TS.Node): void => {
+      if (functionLike(node)) return;
+      const add = (set: Set<TS.Symbol>, name: TS.Node): void => {
+        const symbol = ts.isIdentifier(name) ? b.symbol(name) : undefined;
+        if (symbol && !set.has(symbol)) { set.add(symbol); changed = true; }
+      };
+      if (ts.isVariableDeclaration(node) && node.initializer && exportsObject(node.initializer)) add(aliases, node.name);
+      if (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.EqualsToken) {
+        if (ts.isIdentifier(unwrap(node.left)) && exportsObject(node.right) && !exportsObject(node.left)) add(aliases, unwrap(node.left));
+        const root = rootOf(node.left);
+        if (exportsObject(root)) {
+          const value = unwrap(node.right);
+          if (ts.isIdentifier(value)) add(values, value);
+          else if (ts.isObjectLiteralExpression(value)) for (const item of value.properties) {
+            if (ts.isShorthandPropertyAssignment(item)) add(values, item.name);
+            else if (ts.isPropertyAssignment(item) && ts.isIdentifier(unwrap(item.initializer))) add(values, unwrap(item.initializer));
+          }
+        }
+      }
+      ts.forEachChild(node, collect);
+    };
+    for (let round = 0; changed && round < 4; round++) { changed = false; collect(body); }
+    const writeTarget = (node: TS.Node): boolean => {
+      const parent = skip(node).parent;
+      return (ts.isBinaryExpression(parent) && parent.left === skip(node) && parent.operatorToken.kind >= ts.SyntaxKind.FirstAssignment &&
+          parent.operatorToken.kind <= ts.SyntaxKind.LastAssignment) ||
+        ((ts.isPrefixUnaryExpression(parent) || ts.isPostfixUnaryExpression(parent)) &&
+          (parent.operator === ts.SyntaxKind.PlusPlusToken || parent.operator === ts.SyntaxKind.MinusMinusToken));
+    };
+    /** Whether one use of the exports object `node` is modelled. */
+    const allowed = (node: TS.Expression, nested: boolean): boolean => {
+      const outer = skip(node), parent = outer.parent;
+      // A member: reads anywhere; writes only where the walk sees them.
+      if ((ts.isPropertyAccessExpression(parent) || ts.isElementAccessExpression(parent)) && parent.expression === outer) {
+        let member: TS.Node = parent;
+        while ((ts.isPropertyAccessExpression(skip(member).parent) || ts.isElementAccessExpression(skip(member).parent)) &&
+          (skip(member).parent as TS.PropertyAccessExpression).expression === skip(member)) member = skip(member).parent;
+        if (ts.isDeleteExpression(skip(member).parent)) return false;
+        return !(nested && writeTarget(member));
+      }
+      if (ts.isTypeOfExpression(parent)) return true;
+      if (ts.isBinaryExpression(parent) && [ts.SyntaxKind.EqualsEqualsEqualsToken, ts.SyntaxKind.ExclamationEqualsEqualsToken,
+        ts.SyntaxKind.EqualsEqualsToken, ts.SyntaxKind.ExclamationEqualsToken].includes(parent.operatorToken.kind)) return true;
+      if (nested) return false;
+      // Top level: assignments, aliases, and call arguments (an opaque call
+      // makes its arguments' members unknown, which the walk records).
+      if (ts.isBinaryExpression(parent) && parent.operatorToken.kind >= ts.SyntaxKind.FirstAssignment && parent.operatorToken.kind <= ts.SyntaxKind.LastAssignment) return true;
+      if (ts.isVariableDeclaration(parent) && parent.initializer === outer) return true;
+      if ((ts.isCallExpression(parent) || ts.isNewExpression(parent)) && parent.arguments?.includes(outer as TS.Expression)) return true;
+      return ts.isExpressionStatement(parent);
+    };
+    let found: string | undefined;
+    const fail = (reason: string): void => { found ??= reason; };
+    const scan = (node: TS.Node, nested: boolean, thisBound: boolean): void => {
+      if (found) return;
+      // `this` at top level (or in a top-level arrow) is module.exports.
+      if (!thisBound && node.kind === ts.SyntaxKind.ThisKeyword) return fail('top-level this');
+      // A top-level return ends the module where the walk keeps going.
+      if (!nested && ts.isReturnStatement(node)) return fail('top-level return');
+      // A declaration's own name is not a use of what it is initialised to.
+      const declared = (ts.isVariableDeclaration(node.parent) || ts.isParameter(node.parent) || ts.isBindingElement(node.parent) ||
+        ts.isFunctionDeclaration(node.parent) || ts.isFunctionExpression(node.parent) || ts.isClassDeclaration(node.parent) ||
+        ts.isClassExpression(node.parent)) && node.parent.name === node;
+      if (ts.isIdentifier(node) && !declared && !(ts.isPropertyAccessExpression(node.parent) && node.parent.name === node) &&
+          !((ts.isPropertyAssignment(node.parent) || ts.isMethodDeclaration(node.parent) || ts.isPropertyDeclaration(node.parent)) && node.parent.name === node)) {
+        const symbol = b.symbol(node);
+        if (b.isBinding(node, 'module')) {
+          const parent = skip(node).parent;
+          if ((ts.isPropertyAccessExpression(parent) || ts.isElementAccessExpression(parent)) && parent.expression === skip(node)) {
+            if (moduleExports(parent)) { if (!allowed(parent, nested)) return fail('unmodeled use of module.exports'); }
+            else if (ts.isDeleteExpression(skip(parent).parent)) return fail('unmodeled use of module');
+          } else if (!ts.isTypeOfExpression(parent) && !(ts.isBinaryExpression(parent) && [ts.SyntaxKind.EqualsEqualsEqualsToken,
+            ts.SyntaxKind.ExclamationEqualsEqualsToken, ts.SyntaxKind.EqualsEqualsToken, ts.SyntaxKind.ExclamationEqualsToken].includes(parent.operatorToken.kind)) &&
+            !(!nested && (ts.isCallExpression(parent) || ts.isNewExpression(parent)) && parent.arguments?.includes(skip(node) as TS.Expression))) return fail('unmodeled use of module');
+        } else if (b.isBinding(node, 'exports') || (symbol && aliases.has(symbol))) {
+          if (!allowed(node, nested)) return fail('unmodeled use of exports');
+        } else if (symbol && values.has(symbol) && nested) {
+          // A member of an exported value written where the walk does not go.
+          let member: TS.Node = skip(node);
+          while ((ts.isPropertyAccessExpression(member.parent) || ts.isElementAccessExpression(member.parent)) &&
+            (member.parent as TS.PropertyAccessExpression).expression === member) member = skip(member.parent);
+          if (member !== skip(node) && (writeTarget(member) || ts.isDeleteExpression(member.parent))) return fail('unmodeled write to an exported value');
+        }
+      }
+      ts.forEachChild(node, child => { scan(child, nested || functionLike(child), thisBound || (functionLike(child) && !ts.isArrowFunction(child))); });
+    };
+    scan(body, false, false);
+    return found;
+  };
+  /** `Object.defineProperty(target, 'name', { value })` with a literal key and a plain data descriptor. */
+  const dataDefinition = (node: TS.CallExpression): { target: TS.Expression; name: string; value: TS.Expression } | undefined => {
+    const [target, key, descriptor] = node.arguments.map(unwrap);
+    if (node.arguments.length !== 3 || !target || !key || !descriptor || !ts.isStringLiteralLike(key) ||
+        key.text === '__proto__' || key.text === 'prototype' || !ts.isObjectLiteralExpression(descriptor)) return undefined;
+    let value: TS.Expression | undefined;
+    for (const item of descriptor.properties) {
+      if (!ts.isPropertyAssignment(item) || !(ts.isIdentifier(item.name) || ts.isStringLiteralLike(item.name))) return undefined;
+      if (item.name.text === 'value') value = item.initializer;
+      else if (!['enumerable', 'writable', 'configurable'].includes(item.name.text)) return undefined;
+    }
+    return value ? { target, name: key.text, value } : undefined;
+  };
+  const bound = bind(source);
+  const position = (offset: number) => {
+    const before = source.slice(0, Math.max(0, offset));
+    const line = before.split('\n').length;
+    return { line, column: before.length - before.lastIndexOf('\n') - 1 };
+  };
+  // The consumer's receiver must refer to its import too. The same lexical
+  // binding API distinguishes parameters/classes that shadow it at a call.
+  const imports = new Map<string, TS.Symbol>();
+  const remember = (name: TS.Identifier): void => {
+    const symbol = bound.symbol(name);
+    if (symbol) imports.set(name.text, symbol);
+  };
+  for (const statement of bound.wrapper.body?.statements ?? []) {
+    if (ts.isImportDeclaration(statement) && statement.importClause) {
+      const clause = statement.importClause;
+      if (clause.name) remember(clause.name);
+      if (clause.namedBindings) {
+        if (ts.isNamespaceImport(clause.namedBindings)) remember(clause.namedBindings.name);
+        else for (const element of clause.namedBindings.elements) remember(element.name);
+      }
+    }
+    if (ts.isImportEqualsDeclaration(statement)) remember(statement.name);
+    if (ts.isVariableStatement(statement)) for (const declaration of statement.declarationList.declarations) {
+      const value = declaration.initializer && unwrap(declaration.initializer);
+      if (value && ts.isCallExpression(value) && bound.isBinding(value.expression, 'require')) {
+        const rememberPattern = (name: TS.BindingName): void => {
+          if (ts.isIdentifier(name)) remember(name);
+          else for (const element of name.elements) if (ts.isBindingElement(element)) rememberPattern(element.name);
+        };
+        rememberPattern(declaration.name);
+      }
+    }
+  }
+  const receivers = (node: TS.Node): void => {
+    if (ts.isCallExpression(node) || ts.isNewExpression(node)) {
+      let root = unwrap(node.expression);
+      while (ts.isPropertyAccessExpression(root) || ts.isElementAccessExpression(root)) root = unwrap(root.expression);
+      if (ts.isIdentifier(root) && imports.has(root.text) && bound.symbol(root) !== imports.get(root.text)) {
+        const start = position(root.getStart(bound.tree) - bound.prefix);
+        const end = position(node.end - bound.prefix);
+        result.importShadows.push({ name: root.text, startLine: start.line, startColumn: start.column, endLine: end.line, endColumn: end.column });
+      }
+    }
+    ts.forEachChild(node, receivers);
+  };
+  if (bound.wrapper.body) receivers(bound.wrapper.body);
+  if (bound.wrapper.body?.statements.some(statement => ts.isImportDeclaration(statement) || ts.isExportDeclaration(statement) ||
+      ts.isExportAssignment(statement) || (ts.canHaveModifiers(statement) && ts.getModifiers(statement)?.some(modifier => modifier.kind === ts.SyntaxKind.ExportKeyword)))) {
+    result.commonJs = false;
+    return result;
+  }
+  const unmodeled = (reason: string): CommonJsExportEvidence => {
+    result.commonJs = false; result.unmodeled = reason; result.unknown = true;
+    result.graph = new CommonJsValueGraph(); result.exported = { kind: 'unknown', reason };
+    result.defaults = []; result.members = Object.create(null) as Record<string, Declaration[]>; result.forwards = []; result.exportForwards = [];
+    return result;
+  };
+  if (bound.diagnostics.length || !bound.wrapper.body) return unmodeled('unparsed source');
+  const uses = bindingUses(bound.wrapper.body, bound);
+  if (uses) return unmodeled(uses);
+  // Function declarations are hoisted: bind them before any branch forks the
+  // graph, so one first read inside an `if` arm is not a one-armed binding.
+  const hoist = (statement: TS.Statement): void => {
+    if (ts.isFunctionDeclaration(statement) && statement.name) { const symbol = bound.symbol(statement.name); if (symbol) symbolValue(symbol, bound, offset => offset); }
+  };
+  let graph = result.graph;
+  const module = graph.allocate('object', `${file}:module`);
+  const namespace = graph.allocate('object', `${file}:namespace`);
+  const cache = graph.allocate('object', `${file}:require-cache`);
+  const requireValue = graph.allocate('function', `${file}:require`);
+  graph.write(module, 'exports', namespace);
+  graph.write(cache, file, module); graph.write(requireValue, 'cache', cache);
+  for (const name of bound.parameters.keys()) graph.bind(`${file}:wrapper:${name}`,
+    name === 'module' ? module : name === 'exports' ? namespace : name === 'require' ? requireValue :
+      name === '__filename' ? graph.data(file) : graph.unknown('wrapper builtin'));
+  const identity = (selector: Declaration) => `${file}:${selector.kind}:${selector.line}:${selector.column}`;
+  const declaration = (node: TS.Declaration, b: Bound, map: (offset: number) => number): Declaration | undefined => {
+    const named = 'name' in node ? node.name as TS.Node | undefined : undefined;
+    const offset = map((named ?? node).getStart(b.tree) - b.prefix);
+    if (offset < 0) return undefined;
+    const kind: Declaration['kind'] = ts.isClassDeclaration(node) || ts.isClassExpression(node) ? 'class' :
+      ts.isMethodDeclaration(node) || ts.isMethodSignature(node) ? 'method' :
+        ts.isFunctionDeclaration(node) || ts.isFunctionExpression(node) || ts.isArrowFunction(node) ? 'function' : 'value';
+    return { name: named && ts.isIdentifier(named) ? named.text : undefined, ...position(offset), kind };
+  };
+  const binding = (symbol: TS.Symbol, b: Bound, map: (offset: number) => number): string => {
+    for (const [name, parameter] of b.parameters) if (symbol === parameter) return `${file}:wrapper:${name}`;
+    const node = symbol.declarations?.[0];
+    const selector = node && declaration(node, b, map);
+    return selector ? `${file}:binding:${selector.line}:${selector.column}` : `${file}:synthetic:${symbol.name}`;
+  };
+  const processed = new Set<string>();
+  const emptyBodies = new Set<string>();
+  /** A constructible function owns a prototype object, as a class does. */
+  const constructorFunction = (fn: CommonJsValue, selector: Declaration, body: TS.Node | undefined): CommonJsValue => {
+    if (fn.kind !== 'identity') return fn;
+    if (body && ts.isBlock(body) && !body.statements.length) emptyBodies.add(fn.id);
+    const object = graph.objects.get(fn.id)!;
+    if (!object.properties.has('prototype')) graph.write(fn, 'prototype', graph.allocate('object', `${identity(selector)}:prototype`));
+    return fn;
+  };
+  const unsupportedClasses = new Set<string>();
+  const seeding = new Set<string>();
+  const typeValue = (type: TS.Type, at: TS.Node, b: Bound, map: (offset: number) => number, id: string): CommonJsValue => {
+    if (type.flags & (ts.TypeFlags.Any | ts.TypeFlags.Unknown)) return graph.unknown('unresolved type');
+    if (type.flags & (ts.TypeFlags.StringLike | ts.TypeFlags.NumberLike | ts.TypeFlags.BooleanLike | ts.TypeFlags.Null | ts.TypeFlags.Undefined | ts.TypeFlags.Void)) {
+      return graph.data(undefined, false);
+    }
+    for (const signature of type.getCallSignatures()) {
+      const node = signature.getDeclaration();
+      if (node && (ts.isFunctionDeclaration(node) || ts.isFunctionExpression(node) || ts.isArrowFunction(node) || ts.isMethodDeclaration(node)) && node.body) {
+        const selector = declaration(node, b, map);
+        if (selector) return graph.allocate('function', identity(selector), selector, ts.isFunctionDeclaration(node) || ts.isFunctionExpression(node));
+      }
+    }
+    const value = graph.allocate('object', id);
+    seedType(value, type, at, b, map);
+    return value;
+  };
+  const seedType = (owner: CommonJsValue, type: TS.Type, _at: TS.Node, b: Bound, map: (offset: number) => number): void => {
+    if (owner.kind !== 'identity' || seeding.has(owner.id)) return;
+    seeding.add(owner.id);
+    if (type.flags & (ts.TypeFlags.Any | ts.TypeFlags.Unknown)) {
+      const object = graph.objects.get(owner.id)!;
+      object.closed = false; (object.openReasons ??= new Set()).add('unresolved type');
+    }
+    for (const property of type.getProperties()) {
+      if (property.name === 'prototype' || property.name.startsWith('__@') || graph.objects.get(owner.id)!.properties.has(property.name)) continue;
+      const values: CommonJsValue[] = [];
+      for (const node of property.declarations ?? []) {
+        if (ts.isPropertyAssignment(node) || ts.isPropertyDeclaration(node)) {
+          if (node.initializer) values.push(valueOf(node.initializer, b, map));
+        } else if (ts.isShorthandPropertyAssignment(node)) values.push(valueOf(node.name, b, map));
+        else if (ts.isMethodDeclaration(node) && node.body) {
+          const selector = declaration(node, b, map);
+          if (selector) values.push(graph.allocate('function', identity(selector), selector));
+        }
+      }
+      if (values.length) graph.write(owner, property.name, graph.union(values));
+      else if (!property.declarations?.every(node => ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node))) graph.write(owner, property.name, graph.unknown('property value is not established'));
+    }
+  };
+  const symbolValue = (symbol: TS.Symbol, b: Bound, map: (offset: number) => number): CommonJsValue => {
+    const key = binding(symbol, b, map);
+    if (graph.bindings.has(key)) return graph.get(key);
+    if (seeding.has(key)) return graph.unknown('cyclic binding');
+    seeding.add(key);
+    const node = symbol.declarations?.[0];
+    const selector = node && declaration(node, b, map);
+    let value: CommonJsValue = graph.unknown('binding has no established value');
+    if (node && selector && (ts.isFunctionDeclaration(node) || ts.isFunctionExpression(node))) {
+      value = constructorFunction(graph.allocate('function', identity(selector), selector, true), selector, node.body);
+      graph.bind(key, value, selector);
+      seedType(value, b.checker.getTypeOfSymbolAtLocation(symbol, node), node, b, map);
+    } else if (node && selector && (ts.isClassDeclaration(node) || ts.isClassExpression(node))) {
+      value = graph.allocate('class', identity(selector), selector);
+      if (node.heritageClauses?.length || node.members.some(member => ts.isConstructorDeclaration(member))) unsupportedClasses.add(identity(selector));
+      const prototype = graph.allocate('object', `${identity(selector)}:prototype`);
+      graph.write(value, 'prototype', prototype); graph.bind(key, value, selector);
+      seedType(value, b.checker.getTypeOfSymbolAtLocation(symbol, node), node, b, map);
+      seedType(prototype, b.checker.getDeclaredTypeOfSymbol(symbol), node, b, map);
+    } else if (node && ts.isVariableDeclaration(node)) value = node.initializer ? valueOf(node.initializer, b, map) : graph.data(undefined);
+    else if (node && ts.isBindingElement(node)) value = typeValue(b.checker.getTypeAtLocation(node.name), node, b, map, `${key}:value`);
+    graph.bind(key, value, selector);
+    seeding.delete(key);
+    return graph.get(key);
+  };
+  const property = (expression: TS.Expression, b: Bound, map: (offset: number) => number): { owner: CommonJsValue; name?: string } | undefined => {
+    expression = unwrap(expression);
+    if (ts.isPropertyAccessExpression(expression)) return { owner: valueOf(expression.expression, b, map), name: expression.name.text };
+    if (ts.isElementAccessExpression(expression) && expression.argumentExpression) {
+      const key = valueOf(expression.argumentExpression, b, map);
+      return { owner: valueOf(expression.expression, b, map), name: key.kind === 'data' && key.known ? String(key.value) : undefined };
+    }
+    return undefined;
+  };
+  const valueOf = (raw: TS.Expression, b: Bound, map: (offset: number) => number): CommonJsValue => {
+    const expression = unwrap(raw);
+    if (ts.isIdentifier(expression)) {
+      const symbol = b.symbol(expression);
+      return symbol ? symbolValue(symbol, b, map) : expression.text === 'undefined' ? graph.data(undefined) : graph.unknown(expression.text === 'eval' ? 'intrinsic eval' : 'unbound identifier');
+    }
+    if (ts.isStringLiteralLike(expression)) return graph.data(expression.text);
+    if (ts.isNumericLiteral(expression)) return graph.data(Number(expression.text));
+    if (expression.kind === ts.SyntaxKind.NullKeyword) return graph.data(null);
+    if (expression.kind === ts.SyntaxKind.TrueKeyword || expression.kind === ts.SyntaxKind.FalseKeyword) return graph.data(expression.kind === ts.SyntaxKind.TrueKeyword);
+    if (ts.isBinaryExpression(expression) && expression.operatorToken.kind === ts.SyntaxKind.EqualsToken) return valueOf(expression.right, b, map);
+    if (ts.isConditionalExpression(expression)) {
+      const condition = truth(valueOf(expression.condition, b, map));
+      return condition === undefined ? graph.union([valueOf(expression.whenTrue, b, map), valueOf(expression.whenFalse, b, map)]) : valueOf(condition ? expression.whenTrue : expression.whenFalse, b, map);
+    }
+
+    if (ts.isClassExpression(expression)) {
+      // Same seeding as a class declaration: statics, prototype and the
+      // construction contract, or `module.exports = class { static f() {} }`
+      // reports f as absent.
+      const selector = declaration(expression, b, map);
+      if (!selector) return graph.unknown('unindexed synthetic declaration');
+      const id = identity(selector);
+      if (graph.objects.has(id)) return graph.allocate('class', id, selector);
+      const value = graph.allocate('class', id, selector);
+      if (expression.heritageClauses?.length || expression.members.some(member => ts.isConstructorDeclaration(member))) unsupportedClasses.add(id);
+      const prototype = graph.allocate('object', `${id}:prototype`);
+      graph.write(value, 'prototype', prototype);
+      const type = b.checker.getTypeAtLocation(expression);
+      seedType(value, type, expression, b, map);
+      const symbol = type.getSymbol();
+      if (symbol) seedType(prototype, b.checker.getDeclaredTypeOfSymbol(symbol), expression, b, map);
+      return value;
+    }
+    if (ts.isFunctionExpression(expression) || ts.isArrowFunction(expression)) {
+      const selector = declaration(expression, b, map);
+      if (!selector) return graph.unknown('unindexed synthetic declaration');
+      const fn = graph.allocate('function', identity(selector), selector, ts.isFunctionExpression(expression));
+      return ts.isFunctionExpression(expression) ? constructorFunction(fn, selector, expression.body) : fn;
+    }
+    const member = property(expression, b, map);
+    if (member) {
+      const value = member.name === undefined ? graph.unknown('dynamic property') : graph.read(member.owner, member.name);
+      return value.kind === 'absent' ? graph.data(undefined) : value;
+    }
+    if (ts.isObjectLiteralExpression(expression)) {
+      const value = graph.allocate('object', `${file}:object:${map(expression.getStart(b.tree) - b.prefix)}`);
+      for (const item of expression.properties) {
+        if (ts.isPropertyAssignment(item)) {
+          const name = ts.isIdentifier(item.name) || ts.isStringLiteralLike(item.name) ? item.name.text : undefined;
+          if (name !== undefined) graph.write(value, name, valueOf(item.initializer, b, map)); else graph.invalidate(value, 'dynamic object property');
+        } else if (ts.isShorthandPropertyAssignment(item)) graph.write(value, item.name.text, valueOf(item.name, b, map));
+        else if (ts.isMethodDeclaration(item) && item.body) {
+          const selector = declaration(item, b, map);
+          if (selector?.name) graph.write(value, selector.name, graph.allocate('function', identity(selector), selector));
+        } else {
+          graph.invalidate(value, ts.isSpreadAssignment(item) ? 'object spread' : 'unmodeled object member');
+        }
+      }
+      return value;
+    }
+    if (ts.isNewExpression(expression)) {
+      const cls = valueOf(expression.expression, b, map);
+      const value = graph.allocate('object', `${file}:instance:${map(expression.getStart(b.tree) - b.prefix)}`);
+      if (cls.kind === 'identity' && graph.objects.get(cls.id)?.kind === 'class') {
+        const selector = graph.objects.get(cls.id)?.selector;
+        const unsupported = !selector || unsupportedClasses.has(cls.id);
+        if (unsupported) return graph.unknown('custom construction/inheritance outside contract');
+        graph.setPrototype(value, graph.read(cls, 'prototype'));
+      } else if (cls.kind === 'identity' && graph.objects.get(cls.id)?.kind === 'function' && graph.objects.get(cls.id)?.constructible) {
+        // `new Foo()` on a constructor function: Foo.prototype's members,
+        // plus whatever its body writes to `this`, which the walk does not see.
+        graph.setPrototype(value, graph.read(cls, 'prototype'));
+        if (!emptyBodies.has(cls.id)) graph.invalidate(value, 'constructor function body');
+      }
+      else seedType(value, b.checker.getTypeAtLocation(expression), expression, b, map);
+      return value;
+    }
+    if (ts.isCallExpression(expression) && b.isBinding(expression.expression, 'require') && expression.arguments.length === 1 && ts.isStringLiteralLike(unwrap(expression.arguments[0]!))) {
+      const source = (unwrap(expression.arguments[0]!) as TS.StringLiteralLike).text;
+      return graph.allocate('module', `${file}:forward:${source}`, undefined, false, source);
+    }
+    return typeValue(b.checker.getTypeAtLocation(expression), expression, b, map, `${file}:typed:${map(expression.getStart(b.tree) - b.prefix)}`);
+  };
+  const truth = (value: CommonJsValue): boolean | undefined => value.kind === 'identity' ? true : value.kind === 'data' && value.known ? Boolean(value.value) : undefined;
+  const bindPattern = (name: TS.BindingName, value: CommonJsValue, b: Bound, map: (offset: number) => number): void => {
+    if (ts.isIdentifier(name)) {
+      const symbol = b.symbol(name); const node = symbol?.declarations?.[0];
+      if (symbol) graph.bind(binding(symbol, b, map), value, node && declaration(node, b, map));
+    } else for (const element of name.elements) if (ts.isBindingElement(element)) {
+      const key = element.propertyName && (ts.isIdentifier(element.propertyName) || ts.isStringLiteralLike(element.propertyName)) ? element.propertyName.text : ts.isIdentifier(element.name) ? element.name.text : undefined;
+      bindPattern(element.name, key === undefined ? graph.unknown('binding pattern') : graph.read(value, key), b, map);
+    }
+  };
+  const write = (left: TS.Expression, value: CommonJsValue, b: Bound, map: (offset: number) => number, weak: boolean, name?: string): void => {
+    left = unwrap(left);
+    if (name !== undefined) {
+      const owner = valueOf(left, b, map);
+      graph.write(owner, name, weak ? graph.union([graph.read(owner, name), value]) : value);
+      return;
+    }
+    if (ts.isIdentifier(left)) {
+      const symbol = b.symbol(left); if (!symbol) return;
+      const key = binding(symbol, b, map), prior = graph.get(key);
+      const node = symbol.declarations?.[0]; graph.bind(key, weak ? graph.union([prior, value]) : value, node && declaration(node, b, map));
+    } else {
+      const member = property(left, b, map); if (!member) return;
+      if (member.name === undefined || member.name === '__proto__') graph.invalidate(member.owner, 'dynamic property write');
+      else if (member.name === 'prototype' && member.owner.kind === 'identity' && graph.objects.get(member.owner.id)?.kind === 'class') graph.write(member.owner, member.name, graph.unknown('class prototype descriptor'));
+      else graph.write(member.owner, member.name, weak ? graph.union([graph.read(member.owner, member.name), value]) : value);
+    }
+  };
+  const deferredEval: Array<{ node: TS.CallExpression; b: Bound; map: (offset: number) => number }> = [];
+  const evalCalls = (node: TS.Node, b: Bound, map: (offset: number) => number): void => {
+    if (ts.isCallExpression(node)) {
+      const callee = unwrap(node.expression);
+      if (ts.isIdentifier(callee) && callee.text === 'eval' && !b.symbol(callee) && !node.questionDotToken) deferredEval.push({ node, b, map });
+    }
+    ts.forEachChild(node, child => { evalCalls(child, b, map); });
+  };
+  const visit = (node: TS.Node, b: Bound, map: (offset: number) => number, inEval = false, weak = false): void => {
+    if (ts.isFunctionDeclaration(node) || ts.isFunctionExpression(node) || ts.isArrowFunction(node) || ts.isMethodDeclaration(node) || ts.isConstructorDeclaration(node)) {
+      if (ts.isFunctionDeclaration(node) && node.name) { const symbol = b.symbol(node.name); if (symbol) symbolValue(symbol, b, map); }
+      if (!inEval && node.body) evalCalls(node.body, b, map);
+      return;
+    }
+    if (ts.isIfStatement(node)) {
+      visit(node.expression, b, map, inEval, weak);
+      const condition = truth(valueOf(node.expression, b, map));
+      if (condition !== undefined) { const arm = condition ? node.thenStatement : node.elseStatement; if (arm) visit(arm, b, map, inEval, weak); return; }
+      const before = graph.fork(); visit(node.thenStatement, b, map, inEval, weak); const then = graph;
+      graph = before; if (node.elseStatement) visit(node.elseStatement, b, map, inEval, weak);
+      graph = CommonJsValueGraph.join(then, graph); return;
+    }
+    // Logical assignments evaluate their RHS only in the replacing arm.
+    if (ts.isBinaryExpression(node) && [ts.SyntaxKind.AmpersandAmpersandEqualsToken, ts.SyntaxKind.BarBarEqualsToken, ts.SyntaxKind.QuestionQuestionEqualsToken].includes(node.operatorToken.kind)) {
+      visit(node.left, b, map, inEval, weak);
+      const before = valueOf(node.left, b, map), condition = truth(before);
+      const replace = node.operatorToken.kind === ts.SyntaxKind.AmpersandAmpersandEqualsToken ? condition :
+        node.operatorToken.kind === ts.SyntaxKind.BarBarEqualsToken ? condition === undefined ? undefined : !condition :
+          before.kind === 'data' && before.known ? before.value == null : before.kind === 'identity' ? false : undefined;
+      if (replace === false) return;
+      const prior = replace === undefined ? graph.fork() : undefined;
+      visit(node.right, b, map, inEval, weak);
+      write(node.left, valueOf(node.right, b, map), b, map, weak);
+      if (prior) graph = CommonJsValueGraph.join(prior, graph);
+      return;
+    }
+    ts.forEachChild(node, child => { visit(child, b, map, inEval, weak); });
+    if (ts.isVariableDeclaration(node)) bindPattern(node.name, node.initializer ? valueOf(node.initializer, b, map) : graph.data(undefined), b, map);
+    if (ts.isClassDeclaration(node) && node.name) { const symbol = b.symbol(node.name); if (symbol) symbolValue(symbol, b, map); }
+    if (ts.isBinaryExpression(node) && node.operatorToken.kind >= ts.SyntaxKind.FirstAssignment && node.operatorToken.kind <= ts.SyntaxKind.LastAssignment) {
+      const operator = node.operatorToken.kind;
+      if (operator === ts.SyntaxKind.EqualsToken) write(node.left, valueOf(node.right, b, map), b, map, weak);
+      else write(node.left, graph.unknown('compound assignment'), b, map, weak);
+    }
+    if (ts.isCallExpression(node) && !inEval) {
+      const callee = unwrap(node.expression);
+      const intrinsicEval = ts.isIdentifier(callee) && callee.text === 'eval' && !b.symbol(callee);
+      if (!(intrinsicEval && !node.questionDotToken) && !b.isBinding(callee, 'require')) {
+        const builtin = ts.isPropertyAccessExpression(callee) && ts.isIdentifier(callee.expression) && callee.expression.text === 'Object' &&
+          !b.symbol(callee.expression) ? callee.name.text : undefined;
+        const definition = builtin === 'defineProperty' ? dataDefinition(node) : undefined;
+        // `Object.freeze(api)` changes no member. A literal-key data
+        // descriptor (the `__esModule` marker) is one ordinary write.
+        if (definition) write(definition.target, valueOf(definition.value, b, map), b, map, weak, definition.name);
+        if (!definition && !(builtin && OBJECT_READS.has(builtin))) for (const argument of node.arguments)
+          graph.escape(valueOf(argument, b, map), builtin && OBJECT_WRITES.has(builtin) ? 'unmodeled builtin write' : 'opaque call argument');
+        const receiver = property(callee, b, map);
+        if (receiver) graph.escape(receiver.owner, 'opaque method receiver');
+        let localHarmless = false, capturesExports = false;
+        if (ts.isIdentifier(callee)) {
+          const declaration = b.symbol(callee)?.valueDeclaration;
+          if (declaration && ts.isFunctionDeclaration(declaration) && declaration.body) {
+            localHarmless = true;
+            const effects = (child: TS.Node): void => {
+              if (ts.isCallExpression(child)) localHarmless = false;
+              const propertyName = (ts.isPropertyAccessExpression(child.parent) && child.parent.name === child) ||
+                ((ts.isPropertyAssignment(child.parent) || ts.isMethodDeclaration(child.parent)) && child.parent.name === child);
+              if (!propertyName && ts.isIdentifier(child) && (b.isBinding(child, 'module') || b.isBinding(child, 'exports'))) {
+                localHarmless = false; capturesExports = true;
+              }
+              ts.forEachChild(child, effects);
+            };
+            effects(declaration.body);
+          }
+        }
+        const calleeValue = valueOf(callee, b, map);
+        if (capturesExports || (calleeValue.kind === 'unknown' && calleeValue.reason === 'intrinsic eval') || intrinsicEval || (!localHarmless && node.arguments.some(argument => ts.isIdentifier(unwrap(argument)) && (unwrap(argument) as TS.Identifier).text === 'eval'))) {
+          graph.invalidate(graph.read(module, 'exports'), 'indirect eval effects');
+        }
+      }
+      if (ts.isIdentifier(callee) && callee.text === 'eval' && !b.symbol(callee) && !node.questionDotToken) {
+        const marker = `${map(node.getStart(b.tree) - b.prefix)}`;
+        if (processed.has(marker)) return; processed.add(marker);
+        const argument = node.arguments[0] && unwrap(node.arguments[0]);
+        if (!argument || !ts.isStringLiteralLike(argument)) { graph.invalidate(graph.read(module, 'exports'), 'dynamic eval'); result.unknown = true; return; }
+        const from = map(node.getStart(b.tree) - b.prefix), to = map(node.end - b.prefix);
+        const replacement = `(()=>{${argument.text}\n})()`;
+        const expanded = bind(source.slice(0, from) + replacement + source.slice(to));
+        if (expanded.diagnostics.length) { result.unknown = true; return; }
+        const remap = (offset: number): number => offset < from ? offset : offset >= from + replacement.length ? offset - replacement.length + to - from : -1;
+        const payload = (candidate: TS.Node): void => {
+          if (ts.isArrowFunction(candidate) && candidate.getStart(expanded.tree) - expanded.prefix === from + 1) { visit(candidate.body, expanded, remap, true, weak); return; }
+          ts.forEachChild(candidate, payload);
+        };
+        payload(expanded.wrapper.body!);
+      }
+    }
+  };
+  for (const statement of bound.wrapper.body.statements) hoist(statement);
+  visit(bound.wrapper.body, bound, offset => offset);
+  for (const pending of deferredEval) visit(pending.node, pending.b, pending.map);
+  const exportedValue = graph.read(module, 'exports');
+  // A default import of an `__esModule` module means exports.default, which
+  // the import paths do not read (F21).
+  const marker = graph.read(exportedValue, '__esModule');
+  if (marker.kind === 'data' && marker.value === true && graph.read(exportedValue, 'default').kind !== 'absent') return unmodeled('ES module interop default');
+  // Rule 2: the answer is complete or the file leaves the model. Any unknown
+  // reachable from the exports, other than the opaque escapes the model is
+  // ruled to block on, means a member the model cannot answer for.
+  const incomplete = (value: CommonJsValue, depth = 0, seen = new Set<string>()): string | undefined => {
+    if (depth > 8) return undefined;
+    if (value.kind === 'union') { for (const alternative of value.values) { const reason = incomplete(alternative, depth, seen); if (reason) return reason; } return undefined; }
+    if (value.kind === 'unknown') return BLOCKING_UNKNOWNS.has(value.reason) ? undefined : value.reason;
+    if (value.kind !== 'identity' || seen.has(value.id)) return undefined;
+    seen.add(value.id);
+    const object = graph.objects.get(value.id)!;
+    for (const reason of object.openReasons ?? []) if (!BLOCKING_UNKNOWNS.has(reason)) return reason;
+    for (const [name, child] of object.properties) { if (name === 'prototype' && object.kind !== 'object') continue; const reason = incomplete(child, depth + 1, seen); if (reason) return reason; }
+    return object.prototype ? incomplete(object.prototype, depth + 1, seen) : undefined;
+  };
+  const gap = incomplete(exportedValue);
+  if (gap) return unmodeled(`incomplete: ${gap}`);
+  result.graph = graph; result.exported = graph.read(module, 'exports');
+  result.forwards = [...new Set([...graph.objects.values()].flatMap(object => object.source ? [object.source] : []))];
+  const reference = graph.answer(result.exported).reference;
+  result.defaults = reference.status === 'positive' && reference.selector ? [reference.selector] : [];
+  const exportForwards = new Set<string>();
+  const paths = (value: CommonJsValue, prefix = '', depth = 0, seen = new Set<string>()): void => {
+    if (value.kind === 'union') { for (const alternative of value.values) paths(alternative, prefix, depth, new Set(seen)); return; }
+    if (value.kind !== 'identity' || seen.has(value.id) || depth > 3) return;
+    seen.add(value.id); const object = graph.objects.get(value.id)!;
+    if (object.prototype) paths(object.prototype, prefix, depth, new Set(seen));
+    for (const name of object.properties.keys()) {
+      if (name === 'prototype') continue;
+      const item = graph.read(value, name), decision = graph.answer(item).reference;
+      if (decision.status === 'positive' && decision.selector) result.members[prefix + name] = [decision.selector];
+      paths(item, `${prefix}${name}.`, depth + 1, new Set(seen));
+    }
+  };
+  paths(result.exported);
+  // Only a whole-export forward: a member forwarded into an unmodelled file
+  // (express's `exports.application`) answers blocked for that member alone.
+  for (const value of result.exported.kind === 'union' ? result.exported.values : [result.exported]) {
+    const source = value.kind === 'forward' && !value.path.length ? value.source : value.kind === 'identity' ? graph.objects.get(value.id)?.source : undefined;
+    if (source) exportForwards.add(source);
+  }
+  result.exportForwards = [...exportForwards];
+  return result;
+}
+
+export function commonJsEvidenceFiles(file: string, context: ResolutionContext, seen = new Set<string>()): Set<string> {
+  if (seen.has(file) || seen.size >= 8) return seen;
+  seen.add(file);
+  for (const source of commonJsExportEvidence(file, context)?.forwards ?? []) {
+    const next = context.resolveModuleFile?.(source, file, 'javascript');
+    if (next) commonJsEvidenceFiles(next, context, seen);
+  }
+  return seen;
+}
+
+export function commonJsImportShadowed(file: string, receiver: string, line: number, column: number, context: ResolutionContext): boolean {
+  return commonJsExportEvidence(file, context)?.importShadows.some(site => site.name === receiver &&
+    site.startLine <= line && site.endLine >= line &&
+    (site.startLine !== line || site.startColumn <= column) && (site.endLine !== line || site.endColumn >= column)) ?? false;
+}
+
+/** Consumers select a capability, never a declaration-list fallback. */
+export function commonJsExportResult(record: CommonJsExportEvidence, member: string | null): CommonJsValueResult {
+  let value = record.exported;
+  for (const name of member?.split('.') ?? []) value = record.graph.read(value, name);
+  return record.graph.answer(value);
+}
+
+const OBJECT_READS = new Set(['freeze', 'seal', 'preventExtensions', 'isFrozen', 'isSealed', 'isExtensible', 'keys', 'values', 'entries',
+  'getOwnPropertyNames', 'getOwnPropertyDescriptor', 'getPrototypeOf']);
+const OBJECT_WRITES = new Set(['assign', 'defineProperty', 'defineProperties', 'setPrototypeOf']);
+/** Unknowns the model answers as blocked (F17 ruling: an opaque escape or dynamic write on a known value; F12/F13: eval). */
+const BLOCKING_UNKNOWNS = new Set(['opaque call argument', 'opaque method receiver', 'dynamic property write', 'dynamic object property',
+  'dynamic eval', 'indirect eval effects']);
+/** Sloppy-mode syntax the parser reports but parses intact: legacy octal literals, escapes and leading-zero decimals. */
+const SLOPPY_SYNTAX = new Set([1121, 1487, 1488, 1489]);
+
+/**
+ * Resolves a member that a modelled file forwards into a file outside the
+ * model, by that file's pre-model export lookup.
+ */
+export type CommonJsOutsideLookup = (file: string, member: string | null, intent: CommonJsIntent) => Node | undefined;
+
+export function commonJsExportNode(file: string, member: string | null, context: ResolutionContext,
+  intent: CommonJsIntent = 'reference', seen = new Set<string>(), outside?: CommonJsOutsideLookup): Node | undefined {
+  const key = `${file}\0${member ?? ''}\0${intent}`;
+  if (seen.has(key) || seen.size >= 8) return undefined;
+  seen.add(key);
+  const record = commonJsExportEvidence(file, context);
+  if (!record?.commonJs) return undefined;
+  let value = record.exported;
+  for (const name of member?.split('.') ?? []) value = record.graph.read(value, name);
+  const indexed = (declaration: Declaration): Node | undefined => {
+    const candidates = declaration.name ? context.getNodesInFileNamed?.(file, declaration.name) ?? context.getNodesInFile(file).filter(n => n.name === declaration.name) : context.getNodesInFile(file);
+    const matches = candidates.filter(n => n.startLine <= declaration.line && n.endLine >= declaration.line &&
+      (n.startLine !== declaration.line || n.startColumn <= declaration.column) &&
+      (n.endLine !== declaration.line || n.endColumn >= declaration.column) &&
+      (declaration.kind === 'value' ? ['constant', 'variable', 'property', 'field'].includes(n.kind) :
+        declaration.kind === 'method' || declaration.kind === 'function' ? n.kind === 'method' || n.kind === 'function' : n.kind === declaration.kind));
+    matches.sort((a, b) => (a.endLine - a.startLine) - (b.endLine - b.startLine) || b.startColumn - a.startColumn);
+    return matches[0];
+  };
+  const select = (candidate: CommonJsValue): Node | undefined => {
+    if (candidate.kind === 'union') {
+      const nodes = candidate.values.map(select);
+      return nodes.length && nodes.every(node => node && node.id === nodes[0]?.id) ? nodes[0] : undefined;
+    }
+    const source = candidate.kind === 'forward' ? candidate.source : candidate.kind === 'identity' ? record.graph.objects.get(candidate.id)?.source : undefined;
+    if (source && !(intent === 'reference' && candidate.reference)) {
+      const next = context.resolveModuleFile?.(source, file, 'javascript');
+      const path = candidate.kind === 'forward' ? candidate.path.join('.') || null : null;
+      if (!next) return undefined;
+      // A forward into a file outside the model answers as that file does
+      // without the model (R14-6), not as a blocked member.
+      if (!commonJsExportEvidence(next, context)?.commonJs) return path?.includes('.') ? undefined : outside?.(next, path, intent);
+      return commonJsExportNode(next, path, context, intent, new Set(seen), outside);
+    }
+    const decision = record.graph.answer(candidate)[intent];
+    return decision.status === 'positive' && decision.selector ? indexed(decision.selector) : undefined;
+  };
+  return select(value);
+}
diff --git a/src/resolution/commonjs-export-members.ts b/src/resolution/commonjs-export-members.ts
index 5b1fdf8904..87676932c8 100644
--- a/src/resolution/commonjs-export-members.ts
+++ b/src/resolution/commonjs-export-members.ts
@@ -5,8 +5,97 @@ interface Property { name: string | null; next: number }
 
 const TRIVIA = new Set(['WhiteSpace', 'LineTerminatorSequence', 'SingleLineComment', 'MultiLineComment', 'HashbangComment']);
 
+export type CommonJsExportForm = 'namespace' | 'value' | 'opaque';
+export type CommonJsEvalState = 'present' | 'absent' | 'unknown';
+
 /** Syntactic CommonJS writes, without interpreting their values or executing code. */
-export function readCommonJsExportMembers(source: string, jsx = false): { members: ReadonlySet<string>; uncertain: boolean } {
+export function readCommonJsExportMembers(source: string, jsx = false, evalCall?: () => boolean | null): {
+  /** Explicit property writes, not an inventory of a stated whole value. */
+  members: ReadonlySet<string>;
+  uncertain: boolean;
+  exportForm: CommonJsExportForm;
+  evalState: CommonJsEvalState;
+} {
+  const tokens: LexicalToken[] = [...jsTokens(source, { jsx })].filter((t) => !TRIVIA.has(t.type));
+  const members = new Set<string>();
+  let exportForm: CommonJsExportForm = 'namespace';
+  let evalState: CommonJsEvalState = 'absent';
+  let evalResult: boolean | null | undefined;
+  const checkEval = (): void => {
+    if (evalResult === undefined) evalResult = evalCall?.() ?? null;
+    evalState = evalResult === null ? 'unknown' : evalResult ? 'present' : 'absent';
+  };
+  const opaque = (): void => {
+    // An escape cannot erase a stated value. Neither form claims its final
+    // member inventory; a value keeps the resolver's existing value paths.
+    if (exportForm !== 'value') exportForm = 'opaque';
+  };
+  const moduleApi = (token: LexicalToken | undefined): boolean => token?.type === 'StringLiteral' &&
+    (token.value.slice(1, -1) === 'module' || token.value.slice(1, -1) === 'node:module');
+
+  const property = (at: number): Property | null => {
+    const key = tokens[at + 1];
+    if (tokens[at]?.value === '.' && key?.type === 'IdentifierName') {
+      return { name: key.value.includes('\\') ? null : key.value, next: at + 2 };
+    }
+    if (tokens[at]?.value !== '[') return null;
+    if (key?.type === 'StringLiteral' && key.closed && tokens[at + 2]?.value === ']') {
+      const name = key.value.slice(1, -1);
+      return { name: name.includes('\\') ? null : name, next: at + 3 };
+    }
+    return { name: null, next: at + 1 };
+  };
+
+  for (let at = 0; at < tokens.length; at++) {
+    const root = tokens[at];
+    if (root?.type !== 'IdentifierName') continue;
+    // obj.exports and obj.module.exports are not the CommonJS bindings.
+    if (tokens[at - 1]?.value === '.' || tokens[at - 1]?.value === '?.') continue;
+    if (tokens[at - 1]?.value === 'typeof') continue;
+    // Literal eval code and Node's module/cache APIs can supply exports
+    // without an assignment to the ordinary CommonJS bindings in this file.
+    if (root.value === 'eval') {
+      checkEval();
+      continue;
+    }
+    if ((root.value === 'require' && (property(at + 1)?.name === 'cache' ||
+          (tokens[at + 1]?.value === '(' && moduleApi(tokens[at + 2])))) ||
+        (root.value === 'from' && moduleApi(tokens[at + 1])) ||
+        (root.value === 'import' && (moduleApi(tokens[at + 1]) ||
+          (tokens[at + 1]?.value === '(' && moduleApi(tokens[at + 2]))))) {
+      opaque();
+      continue;
+    }
+    if (root.value !== 'exports' && root.value !== 'module') continue;
+    let next = at + 1;
+    if (root.value === 'module') {
+      const exported = property(next);
+      if (exported?.name !== 'exports') { opaque(); continue; }
+      next = exported.next;
+      if (tokens[next]?.value === '=') {
+        exportForm = 'value';
+        continue;
+      }
+    }
+    const member = property(next);
+    // Escaping the object, replacing its default, or mutating its prototype
+    // supplies an API whose absent members cannot be established here.
+    if (!member || member.name === null || member.name === '__proto__') {
+      opaque();
+      continue;
+    }
+    if (tokens[member.next]?.value === '=') members.add(member.name);
+  }
+  return { members, uncertain: exportForm !== 'namespace' || evalState !== 'absent', exportForm, evalState };
+}
+
+const LEXICAL_PREFIX_WORDS = new Set(['return', 'throw', 'case', 'delete', 'void', 'typeof', 'new', 'in', 'instanceof', 'else', 'do', 'await', 'yield']);
+
+/**
+ * The pre-model reader (87576a8d, the PR's first commit), kept verbatim for files outside the CommonJS value
+ * model so their resolution is exactly what it was before the model existed.
+ */
+export function readLexicalCommonJsExportMembers(source: string, jsx = false): { members: ReadonlySet<string>; uncertain: boolean } {
   const tokens: LexicalToken[] = [...jsTokens(source, { jsx })].filter((t) => !TRIVIA.has(t.type));
   const members = new Set<string>();
   let uncertain = false;
@@ -21,6 +110,14 @@ export function readCommonJsExportMembers(source: string, jsx = false): { member
       before--;
       after++;
     }
+    const prefix = tokens[before];
+    // wrap(eval)(code) passes eval as an argument; its parentheses do not
+    // group the callee. The same applies after a member access or call.
+    if (after > at + 1 && prefix && (
+      (prefix.type === 'IdentifierName' && !LEXICAL_PREFIX_WORDS.has(prefix.value)) ||
+      prefix.type.endsWith('Literal') || prefix.type === 'NoSubstitutionTemplate' || prefix.type === 'TemplateTail' ||
+      [')', ']', '?.', '++', '--'].includes(prefix.value)
+    )) return false;
     if (tokens[after]?.value !== '(') return false;
     let argument = after + 1;
     while (tokens[argument]?.value === '(') argument++;
diff --git a/src/resolution/commonjs-value-graph.ts b/src/resolution/commonjs-value-graph.ts
new file mode 100644
index 0000000000..463bb1ade2
--- /dev/null
+++ b/src/resolution/commonjs-value-graph.ts
@@ -0,0 +1,161 @@
+/** Source-owned selectors are distinct from storage bindings and runtime values. */
+export interface CommonJsDeclaration {
+  name?: string;
+  line: number;
+  column: number;
+  kind: 'class' | 'function' | 'method' | 'value';
+}
+
+interface Reference { reference?: CommonJsDeclaration; referenceIdentity?: string }
+export type CommonJsValue = Reference & (
+  { kind: 'data'; value: string | number | boolean | null | undefined; known: boolean } |
+  { kind: 'identity'; id: string } | { kind: 'unknown'; reason: string } |
+  { kind: 'absent' } | { kind: 'union'; values: CommonJsValue[] } |
+  { kind: 'forward'; source: string; path: string[] }
+);
+export type CommonJsIntent = 'reference' | 'callable' | 'constructible';
+export type CommonJsCapability = { status: 'positive'; selector?: CommonJsDeclaration; identity?: string } |
+  { status: 'unknown' | 'absent' | 'non-callable'; reason?: string };
+export interface CommonJsValueResult {
+  reference: CommonJsCapability;
+  callable: CommonJsCapability;
+  constructible: CommonJsCapability;
+  complete: boolean;
+}
+interface OwnedObject {
+  kind: 'object' | 'function' | 'class' | 'module';
+  selector?: CommonJsDeclaration;
+  constructible: boolean;
+  properties: Map<string, CommonJsValue>;
+  prototype?: CommonJsValue;
+  closed: boolean;
+  /** Every reason the object was opened, in no order. */
+  openReasons?: Set<string>;
+  source?: string;
+}
+
+/** The arena contains no ASTs, compiler symbols, or executable code. */
+export class CommonJsValueGraph {
+  readonly bindings = new Map<string, { value: CommonJsValue; reference?: CommonJsDeclaration }>();
+  readonly objects = new Map<string, OwnedObject>();
+
+  data(value: Extract<CommonJsValue, { kind: 'data' }>['value'], known = true): CommonJsValue { return { kind: 'data', value, known }; }
+  unknown(reason: string): CommonJsValue { return { kind: 'unknown', reason }; }
+  absent(): CommonJsValue { return { kind: 'absent' }; }
+  allocate(kind: OwnedObject['kind'], id: string, selector?: CommonJsDeclaration, constructible = false, source?: string): CommonJsValue {
+    if (!this.objects.has(id)) this.objects.set(id, { kind, selector, constructible, source, properties: new Map(), closed: true });
+    return { kind: 'identity', id, reference: selector };
+  }
+  bind(binding: string, value: CommonJsValue, reference?: CommonJsDeclaration): void { this.bindings.set(binding, { value, reference }); }
+  get(binding: string): CommonJsValue {
+    const cell = this.bindings.get(binding);
+    return !cell ? this.unknown('uninitialized binding') : cell.reference ?
+      { ...cell.value, reference: cell.reference, referenceIdentity: binding } : cell.value;
+  }
+  write(owner: CommonJsValue, name: string, value: CommonJsValue): void {
+    if (owner.kind === 'union') {
+      for (const alternative of owner.values) if (alternative.kind === 'identity') {
+        this.objects.get(alternative.id)!.properties.set(name, this.union([this.read(alternative, name), value]));
+      }
+    } else if (owner.kind === 'identity') this.objects.get(owner.id)!.properties.set(name, value);
+  }
+  setPrototype(owner: CommonJsValue, prototype: CommonJsValue): void {
+    if (owner.kind === 'identity') this.objects.get(owner.id)!.prototype = prototype;
+  }
+  read(owner: CommonJsValue, name: string, seen = new Set<string>()): CommonJsValue {
+    if (owner.kind === 'union') return this.union(owner.values.map(value => this.read(value, name, new Set(seen))));
+    if (owner.kind === 'forward') return { ...owner, path: [...owner.path, name] };
+    if (owner.kind === 'unknown' || owner.kind === 'absent') return owner;
+    if (owner.kind === 'data') return owner.value == null ? this.absent() : this.unknown('boxed primitive member');
+    if (seen.has(owner.id) || seen.size >= 16) return this.unknown('prototype cycle/depth');
+    seen.add(owner.id);
+    const object = this.objects.get(owner.id)!;
+    if (object.properties.has(name)) return object.properties.get(name)!;
+    if (object.source) return { kind: 'forward', source: object.source, path: [name] };
+    if (!object.closed) return this.unknown('incomplete properties');
+    return object.prototype ? this.read(object.prototype, name, seen) : this.absent();
+  }
+  invalidate(owner: CommonJsValue, reason: string): void {
+    if (owner.kind === 'union') { for (const value of owner.values) this.invalidate(value, reason); return; }
+    if (owner.kind !== 'identity') return;
+    const object = this.objects.get(owner.id)!;
+    object.closed = false;
+    (object.openReasons ??= new Set()).add(reason);
+    for (const name of object.properties.keys()) object.properties.set(name, this.unknown(reason));
+  }
+  escape(value: CommonJsValue, reason: string, seen = new Set<string>()): void {
+    if (value.kind === 'union') { for (const alternative of value.values) this.escape(alternative, reason, seen); return; }
+    if (value.kind !== 'identity' || seen.has(value.id)) return;
+    seen.add(value.id);
+    const object = this.objects.get(value.id)!;
+    for (const child of object.properties.values()) this.escape(child, reason, seen);
+    if (object.prototype) this.escape(object.prototype, reason, seen);
+    this.invalidate(value, reason);
+  }
+  private key(value: CommonJsValue): string {
+    return value.kind === 'identity' ? `identity:${value.id}` : value.kind === 'data' ? `data:${value.known}:${typeof value.value}:${String(value.value)}` :
+      value.kind === 'forward' ? `forward:${value.source}:${value.path.join('.')}` : value.kind;
+  }
+  union(values: CommonJsValue[]): CommonJsValue {
+    values = values.flatMap(value => value.kind === 'union' ? value.values : [value]);
+    if (values.some(value => value.kind === 'unknown')) return this.unknown('unknown alternative');
+    const unique = new Map<string, CommonJsValue>();
+    for (const value of values) {
+      const key = this.key(value), prior = unique.get(key);
+      unique.set(key, prior && prior.referenceIdentity !== value.referenceIdentity ? { ...value, reference: undefined, referenceIdentity: undefined } : value);
+    }
+    return unique.size === 1 ? [...unique.values()][0]! : { kind: 'union', values: [...unique.values()] };
+  }
+  answer(value: CommonJsValue): CommonJsValueResult {
+    const status = (status: 'unknown' | 'absent' | 'non-callable', reason?: string): CommonJsCapability => ({ status, ...(reason ? { reason } : {}) });
+    if (value.kind === 'unknown' || value.kind === 'absent' || value.kind === 'forward') {
+      const state = value.kind === 'absent' ? 'absent' : 'unknown';
+      const reason = value.kind === 'unknown' ? value.reason : value.kind === 'forward' ? 'forwarded value' : undefined;
+      return { reference: value.reference ? { status: 'positive', selector: value.reference, identity: value.referenceIdentity } : status(state, reason),
+        callable: status(state, reason), constructible: status(state, reason), complete: state === 'absent' };
+    }
+    if (value.kind === 'union') {
+      const answers = value.values.map(alternative => this.answer(alternative));
+      const agree = (intent: CommonJsIntent): CommonJsCapability => {
+        const first = answers[0]?.[intent];
+        return first && answers.every(answer => JSON.stringify(answer[intent]) === JSON.stringify(first)) ? first : status('unknown', 'conflicting alternatives');
+      };
+      return { reference: agree('reference'), callable: agree('callable'), constructible: agree('constructible'), complete: answers.every(answer => answer.complete) };
+    }
+    const object = value.kind === 'identity' ? this.objects.get(value.id)! : undefined;
+    const positive = (): CommonJsCapability => ({ status: 'positive', selector: object!.selector, identity: (value as Extract<CommonJsValue, { kind: 'identity' }>).id });
+    return {
+      reference: { status: 'positive', selector: value.reference, identity: value.referenceIdentity ?? (value.kind === 'identity' ? value.id : undefined) },
+      callable: object?.kind === 'function' ? object.selector ? positive() : status('unknown', 'unindexed callable') : status('non-callable'),
+      constructible: (object?.kind === 'class' || (object?.kind === 'function' && object.constructible)) && object.selector ? positive() : status('non-callable'),
+      complete: object ? object.closed : true,
+    };
+  }
+  fork(): CommonJsValueGraph {
+    const clone = new CommonJsValueGraph();
+    for (const [key, cell] of this.bindings) clone.bindings.set(key, cell);
+    for (const [id, object] of this.objects) clone.objects.set(id, { ...object, properties: new Map(object.properties), openReasons: object.openReasons && new Set(object.openReasons) });
+    return clone;
+  }
+  static join(left: CommonJsValueGraph, right: CommonJsValueGraph): CommonJsValueGraph {
+    const result = left.fork();
+    for (const key of new Set([...left.bindings.keys(), ...right.bindings.keys()])) {
+      const a = left.bindings.get(key), b = right.bindings.get(key);
+      result.bind(key, result.union([a?.value ?? result.unknown('missing binding'), b?.value ?? result.unknown('missing binding')]),
+        JSON.stringify(a?.reference) === JSON.stringify(b?.reference) ? a?.reference : undefined);
+    }
+    for (const id of new Set([...left.objects.keys(), ...right.objects.keys()])) {
+      const a = left.objects.get(id), b = right.objects.get(id);
+      if (!a || !b) { const object = (a ?? b)!; result.objects.set(id, { ...object, properties: new Map(object.properties) }); continue; }
+      const properties = new Map<string, CommonJsValue>();
+      for (const name of new Set([...a.properties.keys(), ...b.properties.keys()])) properties.set(name, result.union([
+        a.properties.get(name) ?? (a.closed ? result.absent() : result.unknown('incomplete branch')),
+        b.properties.get(name) ?? (b.closed ? result.absent() : result.unknown('incomplete branch')),
+      ]));
+      const reasons = new Set([...a.openReasons ?? [], ...b.openReasons ?? []]);
+      result.objects.set(id, { ...a, properties, closed: a.closed && b.closed, openReasons: reasons.size ? reasons : undefined,
+        prototype: a.prototype || b.prototype ? result.union([a.prototype ?? result.absent(), b.prototype ?? result.absent()]) : undefined });
+    }
+    return result;
+  }
+}
diff --git a/src/resolution/const-alias-synthesizer.ts b/src/resolution/const-alias-synthesizer.ts
index 5880136164..61f4a3b97b 100644
--- a/src/resolution/const-alias-synthesizer.ts
+++ b/src/resolution/const-alias-synthesizer.ts
@@ -214,7 +214,7 @@ function aliasTarget(path: string, alias: Node, ctx: ResolutionContext): Node |
     // `ns.f` is the module's export `f`, and an import of a symbol is that symbol.
     if (binding.isNamespace && members.length === 0) return null;
     const referenceName = binding.isNamespace ? `${root}.${members.shift()!}` : root;
-    const hit = ctx.resolveImport?.({ ...at, referenceName });
+    const hit = ctx.resolveImport?.({ ...at, referenceName, referenceKind: 'references' });
     target = hit ? ctx.getNodeById?.(hit.targetNodeId) ?? null : null;
     if (target && binding.isDefault && !isStatedDefaultExport(target, ctx)) return null;
   } else {
diff --git a/src/resolution/import-resolver.ts b/src/resolution/import-resolver.ts
index ca6abd0ccc..b26d41ac8e 100644
--- a/src/resolution/import-resolver.ts
+++ b/src/resolution/import-resolver.ts
@@ -41,6 +41,9 @@ import {
   retargetSelfOverload,
 } from './name-matcher';
 import { JS_ARRAY_METHODS } from './js-builtins';
+import type { CommonJsIntent } from './commonjs-value-graph';
+import { readLexicalCommonJsExportMembers } from './commonjs-export-members';
+import { type CommonJsOutsideLookup, commonJsExportEvidence, commonJsExportNode, commonJsEvidenceFiles, commonJsImportShadowed } from './commonjs-export-evidence';
 
 /**
  * Extension resolution order by language
@@ -274,6 +277,17 @@ const COMMONJS_DEFAULT_EXPORT =
 
 function commonJsDefaultExport(filePath: string, context: ResolutionContext): { source?: string; name?: string } | null {
   if (!JS_FAMILY_FILE.test(filePath)) return null;
+  const record = commonJsExportEvidence(filePath, context);
+  // A file outside the value model keeps the pre-model lexical reading.
+  if (!record?.commonJs) return lexicalCommonJsDefaultExport(filePath, context);
+  const exported = record.exported;
+  const source = exported.kind === 'identity' ? record.graph.objects.get(exported.id)?.source : undefined;
+  if (source) return { source };
+  const node = commonJsExportNode(filePath, null, context);
+  return node ? { name: node.name } : null;
+}
+
+function lexicalCommonJsDefaultExport(filePath: string, context: ResolutionContext): { source?: string; name?: string } | null {
   if (context.fileContains && !context.fileContains(filePath, 'module.exports')) return null;
   const idx = getFileExportIndex(filePath, context);
   if (idx.commonJsDefault !== undefined) return idx.commonJsDefault;
@@ -3422,6 +3436,21 @@ export function resolveViaImport(
           : null;
         const want = { isDefault: imp.isDefault, isNamespace: imp.isNamespace, exportedName, memberName };
 
+        if (resolvedPath && commonJsExportEvidence(resolvedPath, context)?.commonJs &&
+            commonJsImportShadowed(ref.filePath, imp.localName, ref.line, ref.column, context)) continue;
+
+        // Select the value actually used by this reference, including a member
+        // of a named object import. Calling api.load does not call api itself.
+        if (resolvedPath && commonJsExportEvidence(resolvedPath, context)?.commonJs) {
+          const suffix = ref.referenceName.startsWith(imp.localName + '.') ? ref.referenceName.slice(imp.localName.length + 1) : null;
+          const member = imp.isDefault || imp.isNamespace ? suffix : [imp.exportedName, suffix].filter(Boolean).join('.');
+          const node = commonJsExportNode(resolvedPath, member, context, ref.referenceKind === 'calls' ? 'callable' : ref.referenceKind === 'instantiates' ? 'constructible' : 'reference',
+            undefined, outsideModel(ref.language, context, new Set()));
+          if (node) return { original: ref, targetNodeId: node.id, confidence: 0.9, resolvedBy: 'import',
+            metadata: { typeFrom: [...commonJsEvidenceFiles(resolvedPath, context)].sort() } };
+          continue;
+        }
+
         const targetNode = findImportedExport(imp.source, resolvedPath, want, ref, context);
         const memberRead = !imp.isNamespace && ref.referenceName.startsWith(imp.localName + '.');
 
@@ -3567,7 +3596,7 @@ function findImportedExport(
   ref: UnresolvedRef,
   context: ResolutionContext
 ): Node | undefined {
-  const inFile = (): Node | undefined => (file ? findExportedSymbol(file, want, ref.language, context, new Set()) : undefined);
+  const inFile = (): Node | undefined => (file ? findExportedSymbol(file, { ...want, intent: ref.referenceKind === 'calls' ? 'callable' : ref.referenceKind === 'instantiates' ? 'constructible' : 'reference' }, ref.language, context, new Set()) : undefined);
   const declared = isBareModuleSpecifier(source, ref.language) ? findAmbientModuleExport(source, want, ref, context) : undefined;
   if (!declared) return inFile();
   return (isRepositoryModule(source, file, ref, context) ? inFile() : undefined) ?? declared;
@@ -4255,6 +4284,26 @@ export const REEXPORT_MAX_DEPTH = 8;
  * nothing — the existing code only looked for declarations IN the
  * resolved file, not declarations the file forwarded.
  */
+/** A forwarded member in a file outside the CommonJS model: that file's ordinary export lookup. */
+function outsideModel(language: Language, context: ResolutionContext, visited: Set<string>, depth = 0): CommonJsOutsideLookup {
+  return (file, member, intent) => findExportedSymbol(file, { isDefault: member === null, isNamespace: false, exportedName: member ?? 'default', memberName: null, intent },
+    language, context, visited, depth) ?? (member === null ? undefined : uniqueTopLevel(file, member, intent, context));
+}
+
+/**
+ * The one top-level declaration named `member` in a CommonJS file outside the
+ * model that writes `exports.member` (per the pre-model lexical reader), which
+ * the ordinary export index does not list. Several candidates, or none, answer nothing.
+ */
+function uniqueTopLevel(file: string, member: string, intent: CommonJsIntent | undefined, context: ResolutionContext): Node | undefined {
+  const source = context.readFile(file);
+  if (source === null || !readLexicalCommonJsExportMembers(source, /\.(?:[cm]?js|[jt]sx)$/.test(file)).members.has(member)) return undefined;
+  const kinds = intent === 'callable' ? ['function'] : intent === 'constructible' ? ['class', 'function'] : ['function', 'class', 'variable', 'constant'];
+  const named = (context.getNodesInFileNamed?.(file, member) ?? context.getNodesInFile(file).filter(n => n.name === member))
+    .filter(n => kinds.includes(n.kind) && n.qualifiedName === member);
+  return named.length === 1 ? named[0] : undefined;
+}
+
 function findExportedSymbol(
   filePath: string,
   want: {
@@ -4262,6 +4311,7 @@ function findExportedSymbol(
     isNamespace: boolean;
     exportedName: string;
     memberName: string | null;
+    intent?: CommonJsIntent;
   },
   language: Language,
   context: ResolutionContext,
@@ -4279,7 +4329,7 @@ function findExportedSymbol(
       memo = new Map();
       exportedSymbolMemos.set(context, memo);
     }
-    const key = `${filePath}\0${want.isDefault ? 1 : 0}${want.isNamespace ? 1 : 0}\0${want.exportedName}\0${want.memberName ?? ''}\0${language}`;
+    const key = `${filePath}\0${want.isDefault ? 1 : 0}${want.isNamespace ? 1 : 0}\0${want.exportedName}\0${want.memberName ?? ''}\0${language}\0${want.intent ?? 'reference'}`;
     if (memo.has(key)) return memo.get(key);
     const result = findExportedSymbolWalk(filePath, want, language, context, visited, depth);
     memo.set(key, result);
@@ -4295,6 +4345,7 @@ function findExportedSymbolWalk(
     isNamespace: boolean;
     exportedName: string;
     memberName: string | null;
+    intent?: CommonJsIntent;
   },
   language: Language,
   context: ResolutionContext,
@@ -4305,6 +4356,11 @@ function findExportedSymbolWalk(
   if (visited.has(filePath)) return undefined;
   visited.add(filePath);
 
+  if (commonJsExportEvidence(filePath, context)?.commonJs) {
+    return commonJsExportNode(filePath, want.isDefault ? null : want.memberName ?? want.exportedName, context, want.intent,
+      undefined, outsideModel(language, context, visited, depth + 1));
+  }
+
   const exportIndex = getFileExportIndex(filePath, context);
 
   // 1. Direct hit: the symbol is declared in this file.
@@ -4383,6 +4439,7 @@ function findExportedSymbolWalk(
           isNamespace: false,
           exportedName: rex.originalName,
           memberName: null,
+          intent: want.intent,
         },
         language,
         context,
diff --git a/src/resolution/index.ts b/src/resolution/index.ts
index 8ab2d3ad3a..8484a4fa87 100644
--- a/src/resolution/index.ts
+++ b/src/resolution/index.ts
@@ -860,6 +860,8 @@ export class ReferenceResolver {
    */
   private createContext(): ResolutionContext {
     return {
+      getCommonJsEvalCall: (file, source) => this.queries.getCommonJsEvalCall(file,
+        createHash('sha256').update(source).digest('hex')),
       // A C or C++ `#include` the import resolver can't place is linked by the
       // end of its path, as resolveOneInner's name matching does: protobuf's
       // `google/protobuf/descriptor.upb.h`, which two generated copies end in.
diff --git a/src/resolution/module-importers.ts b/src/resolution/module-importers.ts
index 2f23150170..5d3d609f8d 100644
--- a/src/resolution/module-importers.ts
+++ b/src/resolution/module-importers.ts
@@ -26,6 +26,7 @@ import { extractImportMappings, extractReExports, pythonModulePath, REEXPORT_MAX
 import { resurrectRefFromDroppedEdge } from './resurrect-ref';
 import { defaultExportBinding, extractLocalExportAliases } from './alias-binding';
 import { isDeclarationFile, scanAmbientModules } from './ambient-modules';
+import { collectCommonJsExportEvidence, type CommonJsExportEvidence } from './commonjs-export-evidence';
 import { moduleReferenceKeys } from '../db/reference-tail';
 
 /**
@@ -79,6 +80,8 @@ export interface ImportReader {
   mappings(file: string, language: Language): ImportMapping[];
   /** Its ES-module `export … from` statements, which have no import mapping. */
   reExports(file: string, language: Language): ReExport[];
+  /** Binding-aware CommonJS ownership, optional for minimal readers. */
+  commonJs?(file: string, language: Language): boolean;
   /** The modules a Python file star-imports, which have no import mapping. */
   starImports(file: string, language: Language): string[];
   /**
@@ -91,7 +94,7 @@ export interface ImportReader {
 }
 
 export function createImportReader(rootDir: string): ImportReader {
-  const memo = new Map<string, { content: string; mappings: ImportMapping[]; reExports: ReExport[]; starImports: string[]; exported?: Map<string, string[]> }>();
+  const memo = new Map<string, { content: string; mappings: ImportMapping[]; reExports: ReExport[]; starImports: string[]; exported?: Map<string, string[]>; commonJs?: CommonJsExportEvidence }>();
   const read = (file: string, language: Language) => {
     let entry = memo.get(file);
     if (!entry) {
@@ -111,6 +114,11 @@ export function createImportReader(rootDir: string): ImportReader {
     }
     return entry;
   };
+  const commonJs = (file: string, language: Language): CommonJsExportEvidence | undefined => {
+    if (!/\.[cm]?[jt]sx?$/.test(file) || isDeclarationFile(file)) return undefined;
+    const entry = read(file, language);
+    return entry.commonJs ??= collectCommonJsExportEvidence(entry.content, file);
+  };
   const exportsOf = (file: string, language: Language): Map<string, string[]> => {
     const entry = read(file, language);
     if (!entry.exported) {
@@ -133,7 +141,15 @@ export function createImportReader(rootDir: string): ImportReader {
   };
   return {
     mappings: (file, language) => read(file, language).mappings,
-    reExports: (file, language) => read(file, language).reExports,
+    reExports: (file, language) => {
+      const exports = read(file, language).reExports;
+      if (exports.length) return exports;
+      const record = commonJs(file, language);
+      const value = record?.exported;
+      const source = value?.kind === 'identity' ? record!.graph.objects.get(value.id)?.source : undefined;
+      return source ? [{ kind: 'wildcard', source }] : exports;
+    },
+    commonJs: (file, language) => commonJs(file, language)?.commonJs === true,
     starImports: (file, language) => read(file, language).starImports,
     exportedAs: (file, language) => exportsOf(file, language),
   };
@@ -461,6 +477,22 @@ export function reopenReferencesThroughRetargetedModules(
   return reopened;
 }
 
+/** Failed CommonJS reads have no edge on which to retain typeFrom dependencies.
+ * Follow the existing bounded importer/barrel walk so a data-to-callable edit
+ * retries them even when no declaration name changed. Positive edges already
+ * use typeFrom; leave their resurrection to that path.
+ */
+export function reopenFailedReferencesThroughCommonJs(
+  queries: QueryBuilder, reader: ImportReader,
+  modules: ReadonlyArray<{ path: string; language: Language }>,
+): number {
+  const changed = modules.filter(module => reader.commonJs?.(module.path, module.language));
+  if (!changed.length) return 0;
+  const bindings = bindingsOf(importersOf(queries, changed, reader), reader);
+  const failed = [...bindings].flatMap(([file, { modules: named, names }]) => queries.getFailedReferencesThrough(file, named, names));
+  return queries.reopenFailedReferences(failed);
+}
+
 /** An import's module edge into a file that an added file now outranks. */
 interface OutrankedImport {
   edge: Edge & { edgeId: number; sourceFilePath: string; sourceLanguage: Language };
diff --git a/src/resolution/name-matcher.ts b/src/resolution/name-matcher.ts
index 7e2a689908..c36ee85b25 100644
--- a/src/resolution/name-matcher.ts
+++ b/src/resolution/name-matcher.ts
@@ -10,7 +10,8 @@ import { Language, Node, IMPLICIT_RECORD_ACCESSOR_DOC } from '../types';
 import { escapeRegExp, escapesRoot } from '../utils';
 import { UnresolvedRef, ResolvedRef, ResolutionContext, ImportMapping, isSupertypeTarget, CPP_DEFINE_SIGNATURE, isInheritanceRef, isImportableKind } from './types';
 import { blankStringContents, stripCommentsForRegex } from './strip-comments';
-import { readCommonJsExportMembers } from './commonjs-export-members';
+import { readLexicalCommonJsExportMembers } from './commonjs-export-members';
+import { clearCommonJsExportEvidence, commonJsExportEvidence, commonJsEvidenceFiles, commonJsImportShadowed } from './commonjs-export-evidence';
 import { isJsSuperCallSite } from './js-super-calls';
 import { JS_ARRAY_METHODS, JS_BROWSER_HOST_GLOBALS, JS_BUILT_INS, JS_BUILTIN_METHODS, TS_PRIMITIVE_TYPES } from './js-builtins';
 import { SWIFT_TYPE_PATH_CALL, resolveSwiftTypePathCall } from './swift-type-visibility';
@@ -22350,6 +22351,7 @@ function getInferScanStates(context: ResolutionContext): Map<string, InferScanSt
 
 /** Drop the per-context scan states (see ReferenceResolver.clearCaches). */
 export function clearNameMatcherMemos(context: ResolutionContext): void {
+  clearCommonJsExportEvidence(context);
   lastRustNameRead = null;
   lastJavaNameRead = null;
   INFER_SCAN_STATES.delete(context);
@@ -25382,9 +25384,10 @@ export function matchMethodCall(
 
 /**
  * Is a member call's receiver (`z` in `z.string`, `ns` in `ns.util.fn`) an
- * namespace import, a default binding to a namespace-only module, or one
- * from outside the repo? A require of `exports.x = …` is a default binding,
- * but its absent members are no unrelated class's methods.
+ * namespace import, a default binding that cannot justify a method guess,
+ * or one from outside the repo? Known-absent members and inconclusive eval
+ * parsing must not borrow an unrelated class's method. Explicit member
+ * writes and stated whole values keep their existing resolution paths.
  */
 function isImportedModuleReceiver(receiver: string, member: string, ref: UnresolvedRef, context: ResolutionContext): boolean {
   const root = receiver.split('.')[0]!;
@@ -25399,12 +25402,13 @@ function isImportedModuleReceiver(receiver: string, member: string, ref: Unresol
   const module = binding.isDefault ? defaultModuleNamespace(binding.source, ref.filePath, ref.language, context) : null;
   const firstMember = receiver.includes('.') ? receiver.slice(root.length + 1).split('.')[0]! : member;
   return binding.isNamespace ||
-    (module?.namespace === true && !module.members.has(firstMember)) ||
+    ((module?.commonJs === true || module?.namespace === true) && !module.members.has(firstMember)) ||
     context.isOutOfRepoImport?.(binding.source, ref.filePath, ref.language) === true;
 }
 
 interface ModuleNamespaceInfo {
   namespace: boolean;
+  commonJs?: boolean;
   members: ReadonlySet<string>;
   files: ReadonlySet<string>;
   truncated?: boolean;
@@ -25430,18 +25434,26 @@ function defaultModuleNamespace(source: string, from: string, language: Language
   if (cached !== undefined) return cached;
   const code = context.readFile(file);
   let info: ModuleNamespaceInfo = { namespace: false, members, files };
-  if (code !== null && !/\bdefault\b|\bexport\s*=/.test(code)) {
-    // Follow only a whole-file forwarder; extra assignments or other code
-    // make the effective default uncertain. Named module.exports.x writes
-    // still describe the namespace, whereas any other use of module may
-    // replace it (including computed writes or assignment through an alias).
-    const forwarded = /^\s*(?:['"]use strict['"];\s*)?(?:exports\s*=\s*)?module\.exports\s*=\s*(?:exports\s*=\s*)?require\(\s*['"]([^'"]+)['"]\s*\)\s*;?\s*$/.exec(code);
-    if (forwarded) {
-      const next = defaultModuleNamespace(forwarded[1]!, file, language, context, seen);
-      info = { ...next, files: new Set([...files, ...next.files]) };
-    } else {
-      const exported = readCommonJsExportMembers(code, /\.(?:[cm]?js|[jt]sx)$/.test(file));
-      info = { namespace: !exported.uncertain, members: exported.members, files };
+  if (code !== null) {
+    const exported = commonJsExportEvidence(file, context);
+    if (exported?.commonJs) {
+      // All positive members have already had an import-resolution path.
+      // No fact, complete or incomplete, licenses a global name guess.
+      info = { namespace: true, commonJs: true, members, files: commonJsEvidenceFiles(file, context) };
+    } else if (!/\bdefault\b|\bexport\s*=/.test(code)) {
+      // Outside the value model: the pre-model lexical reading. Follow only a
+      // whole-file forwarder; extra assignments or other code make the
+      // effective default uncertain. Named module.exports.x writes still
+      // describe the namespace, whereas any other use of module may replace it
+      // (including computed writes or assignment through an alias).
+      const forwarded = /^\s*(?:['"]use strict['"];\s*)?(?:exports\s*=\s*)?module\.exports\s*=\s*(?:exports\s*=\s*)?require\(\s*['"]([^'"]+)['"]\s*\)\s*;?\s*$/.exec(code);
+      if (forwarded) {
+        const next = defaultModuleNamespace(forwarded[1]!, file, language, context, seen);
+        info = { ...next, files: new Set([...files, ...next.files]) };
+      } else {
+        const exported = readLexicalCommonJsExportMembers(code, /\.(?:[cm]?js|[jt]sx)$/.test(file));
+        info = { namespace: !exported.uncertain, members: exported.members, files };
+      }
     }
   }
   // A depth/cycle cutoff says nothing about a shorter lookup of this file.
@@ -32159,6 +32171,14 @@ export function matchReference(
   ref: UnresolvedRef,
   context: ResolutionContext
 ): ResolvedRef | null {
+  // Import resolution already tried this binding's callable/constructor evidence.
+  // A rejected CommonJS value cannot borrow a same-named global function.
+  if (JS_FAMILY.has(ref.language) && (ref.referenceKind === 'calls' || ref.referenceKind === 'instantiates') && !ref.referenceName.includes('.')) {
+    const imported = context.getImportMappings?.(ref.filePath, ref.language)?.find(binding => binding.localName === ref.referenceName);
+    const file = imported && context.resolveModuleFile?.(imported.source, ref.filePath, ref.language);
+    if (file && commonJsExportEvidence(file, context)?.commonJs &&
+        !commonJsImportShadowed(ref.filePath, ref.referenceName, ref.line, ref.column, context)) return null;
+  }
   const result = gateLanguageMatch(matchReferenceInner(ref, context), ref, context);
   // `this.container.classList.toggle()` inside `toggle()`, `window.$events
   // .listen()` inside `listen()`, Scala's `requestToArmeria(request).execute()`
diff --git a/src/resolution/types.ts b/src/resolution/types.ts
index 32242abb6b..8f58f24a90 100644
--- a/src/resolution/types.ts
+++ b/src/resolution/types.ts
@@ -129,6 +129,8 @@ export interface ResolutionContext {
   fileExists(filePath: string): boolean;
   /** Read file content */
   readFile(filePath: string): string | null;
+  /** AST fact for this exact source; missing/stale/error results are unknown. */
+  getCommonJsEvalCall?(filePath: string, source: string): boolean | null;
   /** `readFile(filePath)?.includes(needle) ?? false` for an ASCII `needle`, without decoding a file that lacks it. */
   fileContains?(filePath: string, needle: string): boolean;
   /**
diff --git a/src/types.ts b/src/types.ts
index b16f55c9ed..942b5c0017 100644
--- a/src/types.ts
+++ b/src/types.ts
@@ -270,6 +270,9 @@ export interface FileRecord {
    * `undefined` as "content signal unknown, fall back to the path check".
    */
   generated?: boolean;
+
+  /** Extraction fact stored with this content hash in project metadata. */
+  commonJsEvalCall?: boolean | null;
 }
 
 /**
@@ -313,6 +316,8 @@ export interface IndexHealth {
  * Result from parsing a source file
  */
 export interface ExtractionResult {
+  /** Direct eval detected from the AST; null means parsing was inconclusive. */
+  commonJsEvalCall?: boolean | null;
   /** Extracted nodes */
   nodes: Node[];