[joyful-ii-V-I]

Defect

A C++ member call whose callee carries explicit template arguments minted no call reference at all:
r.get<K>( 1 ), p->get<K>( 1 ), x.template get<K>(), this->template get<K>(). The callee parses as
field_expression field: (template_method …) — inside a dependent_name behind the template keyword — and no C++
reference pattern bound either shape. The drop happened at extraction, before ambiguous=/unresolved= could count
it.

Measured 2026-09-16 on main 3bf884e2, a four-line repro:

struct R { template<class E> E get( int n ) { return E( n ); } int plain( int n ) { return n; } };
enum class K : unsigned char { A, B };
int useTemplate( R& r ) { return int( r.get<K>( 1 ) ); }
int usePlain( R& r ) { return r.plain( 1 ); }

--callers=get --no-cache → count="0"; --callers=plain → count="1". Every verb reading the call graph
under-counted these calls (--callers, --uses, --impact, --safe-delete), and --quality-delta could call a
method reached only this way kind="dead-code".

Two more wrong answers in the same family, on the qualified dependent form (which did extract):

• X::template make<int>() minted a reference named template make, which resolves to nothing.
• X::template Rebind<int>::f() keyed its qualifier as template Rebind, so the canonical tier missed and the call
  split over a same-named definition in another scope.

Free f<T>( x ) and qualified ns::f<T>( x ) (the std::get<0>( t ) shape) were already bound; the gate keeps them
as controls.

Change

• queries/cpp/tags.scm — one alternation pattern binds field: (template_method name: (field_identifier) @name) and
  field: (dependent_name (template_method …)). One node matches one branch, so each call is minted once.
• src/ingest_binds.h — receiverOf reads calleeAccessParent, which steps over template_method and
  dependent_name to the field_expression. Without it the new references classified as BARE calls, and the
  enclosing-class rule bound other.pick<int>() to the caller's own same-named method.
• src/ingest_names.h — skipTemplateDisambiguator (the keyword plus whitespace/comments), applied to the qualifier
  inside immediateScope and to the name in cppResplitRefName. cppResplitRefName is the H4 re-split block moved
  out of captureTagsFacts (its complexity is measured); every other spelling behaves as before.
• kParserVer 96 → 99 on this branch, with kIngestParserVerMirror in the same commit. kCacheVersion stays 22;
  test/qschemetrip.hash re-pinned via UPDATE_GOLDEN=1 with a RE-PIN LOG line; kQSnapCacheScheme stays 12.
  The landing number is assigned by integration train 2 (coordinator: 101, after fix(resolve): a member call through a typed parameter was pinned to the caller's own class #248 97, fix(resolve): an explicit receiver of unknown type was pinned to the caller's own class, and a std:: type narrowed to an in-repo namesake #254 98, fix(resolve): a member field typed std::string narrowed to an in-repo class named string #257 99, fix(ingest): a class template's out-of-line member keyed a second identity with the template arguments in its scope #256 100);
  the branch keeps 99 per the train protocol.

Measured

Pre-fix vs fixed binary on this repo's src/ (169 files, --no-cache, map header + ripwire_probe reference count):

	references	edges	ambiguous	unresolved
pre-fix (f8e6087c)	168,457	18,308	7,788	1,677
fixed	168,463	18,309	7,788	1,677

The six new references are exactly the r.pod<T>() reads in src/gitoracle.h's loadOracleCache:
--uses=pod 1 → 7, and --callers=pod now names loadOracleCache beside Reader::str.

On a template-heavy tree the effect is three orders of magnitude larger. Same binaries (fixed = built_from=1171f7757),
llvm-project 4d5358b1d, clang/include + clang/lib, 2,515 files:

	references	edges	ambiguous	unresolved
pre-fix (f8e6087c)	1,855,925	409,860	81,601	3,893
fixed	1,866,100 (+10,175)	413,767 (+3,907, +0.95%)	82,573 (+972)	3,893

--callers=getAs 48 → 492, --callers=hasAttr 45 → 377. On clang/lib/AST (155 files) the reference delta
(246,367 → 248,394, +2,027) equals the new shape's --match hit count exactly (2,027, hits_capped="0"), so extraction
moved only the intended class.

The new sites inherit the plain member call's resolution, wrong binds included. FD->hasAttr<PackedAttr>() in
ASTContext::getDeclAlign (ASTContext.cpp:1878) binds Type::hasAttr(attr::Kind) at lib/AST/Type.cpp:2026, not
Decl::hasAttr<T>() (DeclBase.h:585), with no amb=. In a reduced five-file repro the plain FD->plainAttr() binds
Type::plainAttr(int) the same way on f8e6087c. A resolver defect this change widens the reach of; not fixed here.

Gates

test/cppqualcheck.sh §12 — new corpus test/cppqualtmplfix/member.cpp. It has one hand-read literal per
spelling: member dot and arrow, x.template, p->template, this->template, nested >> arguments, a chained
receiver, X::template, X::Y::template, and a comment after the keyword. It also has four controls the old
patterns already bound, receiver/arity/qualifier decoys, the fixture header (symbols=43 edges=19 ambiguous=0 unresolved=0), and a repo-root arm (--callers=pod names loadOracleCache).

Arm (g), added from the review (F4): the spellings still not bound, each a literal zero behind a source-presence
guard — r.f<0>( x ) (two comparisons; exactly one role="read" row), r.Base::f<T>() and p->Base::f<T>() (the
plain r.Base::f() is pinned 0 too: the qualified-field family), and r.operator()<T>(). These pass on both binaries by
construction: fences for a future widening.

Red first:

• pre-fix binary: 77 PASS / 19 FAIL. The 19 are every new check except the four controls, the determinism arm and
  (g)'s six absence pins. Header edges=6 ambiguous=1.

• mutation build, the same tree with three one-line reversions (8 FAIL), each mechanism reddening its own arms:

  • receiverOf reading the raw parent → tqDecoyCaller binds the decoy :110.
  • skipTemplateDisambiguator inert → the three dependent --uses read 0, the probe name arm fails, and
    tqCallRebind splits onto :133.
  • callArity's hop bound 4 → 3 → tqDepArityCaller splits over both overloads.

  Reverted: the diff is byte-identical to before and the rebuilt binary is byte-identical to the fixed one.

• fixed: 96/96 plain; ALL PASS with asan/ripwire.

test/callformcheck.sh row 11 — b.template memberTmpl<int>() was pinned documented-absent (literal 0 +
probeBlind); it now pins 1 + probeSees. Red on the pre-fix binary: 2 FAIL; green on the fix.

Also run: qextractionkeycheck ALL PASS, qschemetripcheck ALL PASS after the re-pin, printffmtparitycheck ALL PASS
(42 verbs), manifestcheck, chainguardcheck, cudacheck ALL PASS; docs/gatecount_build.py --check (618,
unchanged — no new gate script) and docs/limits_build.py --check clean; --edit-check on receiverOf,
immediateScope and captureTagsFacts: status="unchanged" incompatible="0".

G1: LSAN_OPTIONS=suppressions=lsan_suppressions.txt ./asan/ripwire over test/cppqualtmplfix, test/callformfix/cpp,
a scratch deep-dependent corpus, and src/, plus asan/ripwire_probe on the fixture: rc 0, zero sanitizer lines.

--quality-delta=$(git merge-base origin/main HEAD)..HEAD: regressions="0" gating="0" (api-new-surface="3" —
the three new helpers).

Full suite, one run each, nothing else in flight, python3 test/pargates.py . ./build/ripwire -j 6:

• at 1171f775: gates=632 pass=630 skip=2 fail=0 wall=800.9s
• at 6b234717: gates=632 pass=630 skip=2 fail=0 wall=837.8s (queued 2,520 s behind two peer suites)

The two skips are the environmental argvdiffcheck and editchecknotecheck (asan/ is present and fresh, so
g1freshcheck ran and passed).

Not fixed here

• Resolver misbinds the new sites inherit from the plain member call (see Measured). Parameter-type narrowing
  specifically is fix(resolve): a member call through a typed parameter was pinned to the caller's own class #248's (train 2, ahead of this PR), so the fixture keeps a LOCAL receiver for the climb arm.
• Rust member turbofish w.m::<T>() has the same extraction drop (review F3) — a follow-up lane, not this PR.
• a.b < c > (d) now mints a call named b (F5); X::template operator()<T>() still binds nothing (F6). Both rare.

Pins moved

• test/qschemetrip.hash — 24fd4dd9… → 01ea4c63… (kParserVer line; RE-PIN LOG entry in test/qschemetripcheck.sh)
• kParserVer / kIngestParserVerMirror 96 → 99 on the branch; train 2 assigns the landing number (101)
• test/cppqualcheck.sh §12 fixture header literal symbols=43 → 54 (commit 6b234717, the §12e block; edges stay 19)
• test/callformcheck.sh row 11: literal 0 → 1

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes

  • Fixed missing call and usage detection for C++ member functions invoked with explicit template arguments, including dot, arrow, dependent, and qualified forms.
  • Improved receiver and name resolution for these calls, including calls using the template disambiguator.
  • Corrected impact analysis, caller/usage results, safe-delete checks, and quality reports so affected methods are no longer incorrectly reported as unused.

• Tests

  • Added comprehensive coverage for template-call extraction, resolution precision, and deterministic analysis results.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 396c5d28-2da7-43dc-87f9-3e90a6be4ba3

📥 Commits

Reviewing files that changed from the base of the PR and between f8e6087 and 1171f77.

⛔ Files ignored due to path filters (1)

• test/qschemetrip.hash is excluded by !test/*.hash

📒 Files selected for processing (11)

• CHANGELOG.md
• queries/cpp/tags.scm
• src/ingest_binds.h
• src/ingest_cache.h
• src/ingest_names.h
• src/ingest_sidecap.h
• src/quality.h
• test/callformcheck.sh
• test/cppqualcheck.sh
• test/cppqualtmplfix/member.cpp
• test/qschemetripcheck.sh

Included review availability: Your plan provides up to 8 included reviews per hour; 6 remain after this review.

---

📝 Walkthrough

Walkthrough

The parser now extracts C++ member calls with explicit template arguments, preserves receiver classification, removes template leakage from qualified names, updates parser identity values, and adds regression coverage.

Changes

C++ member template call handling

Layer / File(s)	Summary
Call extraction and receiver classification queries/cpp/tags.scm, src/ingest_binds.h	The C++ query now binds plain and dependent member-template call shapes. Receiver lookup skips template_method and dependent_name wrappers.
Qualified name normalization src/ingest_names.h, src/ingest_sidecap.h	C++ reference re-splitting now removes the template disambiguator and preserves qualified names, including operator and comment-separated forms.
Versioning and regression validation src/ingest_cache.h, src/quality.h, test/cppqualtmplfix/member.cpp, test/cppqualcheck.sh, test/callformcheck.sh, test/qschemetripcheck.sh, CHANGELOG.md	Parser identity values move from 96 to 99. Tests cover extraction, resolution, decoys, determinism, XML output, and cache scheme behavior. The changelog records the fix.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Bug fix · Severity of issue fixed: Low

Suggested reviewers: andriytyurnikov

Merge Risk: ⚪ Minimal · up to 1171f

The member-template extraction update has matching version metadata and regression coverage, with no supported merge-blocking issue identified.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 34.88% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 43 functions across 9 files. (2 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: fixing C++ member calls with explicit template arguments that failed to produce call references.

Full details: Docstring Coverage

Explanation

Docstring coverage is 34.88% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 43 functions across 9 files. (2 skipped: 2 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch lane/template-call-edges

---

_{Comment @coderabbitai help to get the list of available commands.}

[joyful-ii-V-I]

CodeRabbit pass read, head 1171f775. The review on open covered f8e6087c..1171f775, the whole diff, with no actionable comments, no nitpicks and no out-of-diff notes. Merge risk: Minimal. No fix commit follows, so no re-review is requested.

• Docstring Coverage (34.88% < 80%): not a project rule. House style is a // rationale comment above each function, and the three new helpers have one: calleeAccessParent, skipTemplateDisambiguator and cppResplitRefName. The percentage also counts gate shell functions and pre-existing functions in the touched files.

CI is green on the same head: every release shard, both asan legs, rhel and fallback-emitter.

[joyful-ii-V-I]

Independent review of 1171f775: NEEDS-FIX (small). The code is correct.

What was verified:

• Red and green reproduced: cppqualcheck is 90/90 on this head and 71 PASS / 19 FAIL on f8e6087c; callformcheck row 11 is red on main and green here.
• On clang, new references equal the new call shape's hits: AST 2,027, include 313, CodeGen 1,429. The Sema gap of 2 is inside #if 0.
• fix(cache): a cached enum byte past its enum's last value was believed, and a span-tier memo byte wrote past a stack array #241's enumU8 goes from 0 callers to 6.

To fix:

• F2 (conflict): CHANGELOG.md conflicts with main a55b118e (ci(release): Intel macOS binaries end with 0.6.1; the installer says so instead of failing on a missing asset #240's entry). Merge main; CI must re-run on the new head.
• F1 (docs): "Measured" covers only src/ (+1 edge). On clang include+lib the change adds +10,175 references, +3,907 edges and +972 ambiguous, with unresolved unchanged. Please add that row, and say the new sites resolve the same way the plain member call does. Example: FD->hasAttr<PackedAttr>() binds Type::hasAttr(attr::Kind), and the plain spelling misbinds the same way on main (a separate resolver issue, not this PR's).
• F4 (fold into the same push): pin the still-missed spellings at 0 in cppqualcheck §12: r.f<0>( x ) (parsed as a comparison), r.Base::f<T>(), r.operator()<T>().

Not in this PR:

• F3: Rust x.m::<T>() has the same drop (--uses 0 vs 1). That goes to a follow-up lane.
• F5/F6: a.b < c > (d) now mints a call named b, and X::template operator()<T> keeps its keyword. Both are rare.

CodeRabbit: 0 actionable; the docstring-coverage warning is declined.

Re-pins: kParserVer 99 is fine. Whichever of #243/#244/#235/#233 lands later re-bumps and re-pins qschemetrip.hash. #244 also edits receiverOf in ingest_binds.h; keep both edits, since the new C++ step is inert for TS/JS.

[joyful-ii-V-I]

Disposition of the independent review of 1171f775: one push, one new commit, 6b234717 (tests and docs only; src/ unchanged).

• F1 FIX (6b234717): the CHANGELOG and the PR body now carry the clang measurement. I re-measured it here with both binaries rather than copying it: llvm-project 4d5358b1d clang/include + clang/lib, refs +10,175, edges +3,907, ambiguous +972, unresolved unchanged; clang/lib/AST Δrefs 2,027 = shape hits 2,027. The entry also says the new sites inherit the plain member call's resolution, wrong binds included. I reproduced getDeclAlign's hasAttr<PackedAttr> → Type.cpp:2026, and the reduced plain plainAttr() repro on f8e6087c.
• F4 FIX (6b234717): cppqualcheck §12 arm (g) pins six literal zeros, each behind a source-presence guard: r.f<0>( x ) (exactly one role="read" row), r.Base::f<T>(), p->Base::f<T>(), the plain twin r.Base::f(), and r.operator()<T>(). Results: pre-fix 77 PASS / 19 FAIL (the same 19), fix 96/96, asan ALL PASS.
• F2: not done on this branch. The CI_HANDOFF train protocol supersedes it: lanes stop merging main, integration train 2 resolves the CHANGELOG conflict and assigns kParserVer.
• F3 SKIP: the Rust member turbofish is a follow-up lane.
• F5 SKIP. F6 SKIP: measured on the fix, X::template operator()<int>() extracts under the name operator (no keyword) and binds no edge.
• F7 DECLINE: docstring coverage is not a house rule.
• Also: the CHANGELOG no longer says Rule 2 reads no parameter type, because fix(resolve): a member call through a typed parameter was pinned to the caller's own class #248 changes that in the same train. The gate and fixture comments now date that measurement to f8e6087c.

Checks at 6b234717:

• Full suite: gates=632 pass=630 skip=2 fail=0 (environmental skips only).
• quality-delta (merge-base range): regressions="0" gating="0".
• Generators: gatecount_build --check (618) and limits_build --check are clean.

No CodeRabbit re-review requested: this push is tests and docs.

[joyful-ii-V-I]

This PR is part of integration train 2b, #275, and will show as merged when that train lands.