fix(resolution): require owned sources for type-use edges

[VasuBansal7576]

A class inside a named function can have no extracted AST node while the symbol resolver still emits its inheritance and member type-reference edges.
Abstract method signatures can produce the same missing-source records.

Require an owned source node before emitting inherits, implements, or references use facts.
This preserves relationships for callback-local classes that the structural extractor does materialize, including their method return types.
It follows the existing ownership boundary for call facts without changing call attribution or adding extraction support for omitted declarations.

The four-file CLI reproduction on upstream 937e59a5476fcb2665d6c4f4b7c0d0a4142011b6 keeps all 12 nodes and changes 24 edges to 22.
Only the two missing-source records disappear; Visible.method → Result remains.

Immutable fixture, raw graphs, exact hashes and CLI receipts.
The images below are offline-rendered raw-graph audit reports, not Graphify viewer screenshots.
Browser capture was unavailable because the browser security policy blocked the local report URL.

Before	After

Validation:

• Three new extraction regressions fail before and pass after: named-function versus callback-local classes, same-named classes in sibling same-basename files, and abstract versus concrete methods.
• 108 tests pass across the new regressions, symbol resolution, and JS import resolution.
• Ruff and git diff --check pass.
• Required graphify update . --no-cluster completed on the sparse development checkout. Optional SQL, DM and Robot parsers were unavailable; the existing Luau fixture reports a syntax warning.
• A separate 22-file OpenClaw preservation control retains all 27 valid relationships lost by an ancestry-based filtering approach. This is bounded evidence, not full-source acceptance.

Duplicate checks included open and closed local-class, abstract-method and missing-source reports.
#2653 concerns nested function materialization; #2040 concerns containment; #1764 concerns synthesized endpoints in other extractors.
#2382 and #3342 concern incremental resolution and external-stub lifecycle paths.
This patch is limited to the shared symbol-use producer ownership check.

[graphify-labs]

Graphify reviewed this change.

Worth a look — the grounded gate found no coupling regressions or blocking issues, but 1 advisory finding(s) below merit a look before merge.

Formal verification. No changes could be formally verified in this run.

---

Graphify review — findings

Drops inherits, implements, and references edges whose source declaration isn't an actually-owned node in _apply_symbol_resolution_facts, so structurally-omitted declarations (named-function-local classes, abstract method signatures) no longer produce edges pointing at nonexistent source nodes. Callback-local and concrete declarations that do own their nodes keep their type relationships, and the fix keys off node ownership rather than file basename so same-named files across directories don't suppress each other.

Worth a look

• Type relationship edges now silently dropped when source not in owned set, changing prior 'calls'-only fallback behavior for other relations — graphify/extractors/resolution.py:1097 · Escalate · medium
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 1729 functions depend on the 130 functions this change touches.

Health — this change adds coupling hotspots:

• new: extract() — 539 callers, 43 callees
• new: _rebuild_code() — 113 callers, 50 callees
• new: _extract_generic() — 18 callers, 25 callees
• new: extract_js() — 85 callers, 4 callees
• new: extract_xaml() — 19 callers, 17 callees
• new: dispatch_command() — 2 callers, 124 callees
• new: extract_objc() — 27 callers, 9 callees
• new: _resolve_js_module_path() — 27 callers, 6 callees
• …and 34 more — each is listed as a finding

Verification — 1729 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 736 function(s) in the blast radius were not formally verified this run

Formal verification

Could not verify: Could not verify \_apply\_symbol\_resolution\_facts.

The verifier did not have enough to check \_apply\_symbol\_resolution\_facts, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: parameter `root` is annotated `Path` — outside the synthesizable primitive/collection set

· 42 more finding(s) on lines outside this diff (see the check run).

[VasuBansal7576]

This is the intended source-ownership boundary, with preservation controls rather than an ancestry filter.
An inherits or implements edge needs a represented class/interface source; moving it to the file node would assert that the file itself inherits or implements that type.
A method type-reference edge likewise should not be reassigned to a different declaration merely because its method node is absent.
The existing file-level fallback for calls is unchanged.

The real CLI fixture keeps all 12 nodes and removes exactly the two records sourced by omitted Hidden declarations.
Both the represented callback-local Visible inheritance and Visible.method → Result reference remain.
The new tests also protect same-named classes in sibling files and a concrete method beside an omitted abstract signature.
A separate 22-file preservation control retains all 27 valid relationships lost by the earlier ancestry-based approach.

Raw before/after graphs and exact hashes and the three extraction regressions provide the reproducing execution that the advisory says was unavailable to its verifier.
Supporting currently omitted declarations would require materializing their class/method nodes; this PR does not claim to add that extraction support.

[safishamsi]

Shipped in v0.9.55 — landed on v8 via cherry-pick with your authorship preserved. Thanks @VasuBansal7576 — type-use edges are no longer fabricated from a symbol that owns no node. Release: https://github.com/Graphify-Labs/graphify/releases/tag/v0.9.55