[gadievron]

What

Closes #705 — PR #441's disclosed-but-never-filed limit, verbatim: "The try/except-ImportError shim: a module-level fallback class + an import gives M1 the fallback and M2 the import (two answers for one name; both-hit-emit-both is the deferred refinement)."

The two resolution paths picked different targets for the same name and each emitted only its own edge: the typed-receiver path (t = Thing(); t.go()) bound the local fallback class; the class-name path (Thing.go(None)) bound the import. At parse time the branch of the shim that runs is unknowable, so one of the two edges was always a false negative.

The fix

For an obj.method(...) call whose receiver name carries both a same-file class record and an import record in the caller's file, both edges are emitted — and the hook fires even when the primary resolution abstained, because the dominant real-world shim has an external optional dependency (nothing in-repo to resolve on the import side; the fallback's edge must still be emitted).

The guard carries #318's family exclusions so a single record never fans out:

• a name with one record (local-only or import-only) emits exactly one edge;
• a function-local namesake is not a shim — a non-defining caller sees only the import edge;
• a receiver the caller's own scope binds (a parameter or assignment shadow) is a variable, not a class reference;
• branch A (the local fallback) answers only with the local class's own or inherited method — the same-file base chain — never the cross-file unique-match, so a fallback lacking the method cannot fabricate an edge to an unrelated same-named class elsewhere;
• never a duplicate (the primary is filtered); each branch abstains when it finds nothing.

Disclosed sibling limits (named, not fixed)

The constructor edge on a dual name stays one-answer (Thing() binds the local __init__); the function shim (from x import go + a local def go) stays one-answer; the property read on a dual name stays one-answer (the hook sees only calls). The primary path's own cross-file unique-match (a fallback lacking the method + an unrelated same-named class) still fabricates through the typed-receiver primary — identical at base, a #440-family follow-up, recorded as the probed MISS in the evidence bundle.

Evidence (runs/705)

• RED gate at 7d64bf37..ce0bf611: 10 nodes / 4 witnesses, all assertion-red at base (the M1-both, the M2-both, the external-import M2, the fallback-base-chain variant); the reviewer re-derived the witnesses' behavioral red at base with the symbol pins stripped.
• C4 at the pushed head: two hunk-revert experiments plus a green head control — the hook hunk's revert fails exactly the 4 witnesses (the direct behavioral row; the reviewer diffed the revert tree: it removes only the 16-line call-site block); the helper hunk's revert is an AttributeError existence cascade (the row proves the helper is called; its branch logic is pinned by the battery's F7/F2/F5/base-chain pins).
• fable adversarial review: 3 rounds — F1 (the if resolved: gate starving the external-import shim — the false-negative direction), F2/F5 (the function-local and bound-name guards), F7 (branch A's cross-file fabrication → the same-file restriction), with executed three-way controls (base / pre-fix / head) on every probe; terminal round TERMINAL DRY, three non-blocking notes in reconciliation.
• T8 standing-promises table (5 rows incl. the probed MISS), C2 anchor queries (consumed==total), A4 census (the one open PR disjoint), reconciliation (4 rows).
• Parity — the legs' own terminal lines (the full logs in the evidence bundle):
  • base: 3 failed, 13202 passed, 38 skipped, 1 xfailed, 1 warning in 1694.24s — the standing trio (test_interrupt_then_resume + the two llm_sdk_contract_floor pins), identity-matched in both legs;
  • head-settled: 3 failed, 13213 passed, 38 skipped, 1 xfailed, 1 warning in 1624.21s — the +11 passing = this suite's 10 tests + the 1 parametrized no-hardcoded-paths item; the skips 38=38; the trio identity-matched;
  • the collect-diff: +11 items, 0 removed;
  • the go module: EXIT 0;
  • the head-FULL first run carried the npm-provisioning race (180 collection-time JS skips — the same environment class as the A macro_rules!-wrapped fuzz harness is still unrecognized in the Rust parser — the #228 reachability blackout survives for that form #704 cycle's disclosed transient; preserved as head-parity-full-CONTAMINATED-npm-race.log, no receipt drawn from it; the settled leg is the parity evidence).

[gadievron]

R3/R4 — PR 868, at head ba21b348

@sounil — eligible non-author CODEOWNER, re-derived from .github/CODEOWNERS at live master (dbb79937) this arc, never cached: a single * rule naming seven owners, of whom the PR's author is one, so R5 applies (an author-waived PR additionally requires the agent panel on the current head with zero unresolved blocking findings). Three review requests already exist server-side (sounil, shahar-davidson, dgeyshis) — read and recorded per D3, never re-issued. A notice for the record, not a gate on any merge.

DISCLOSURE, re-derived live this arc and not inherited: repo-visibility public · enforce_admins=false · required_approving_review_count=1 · required_reviews unmet. This PR carries zero reviews of any state and zero issue comments at this head, so the approving count is 0 and none was manufactured. The merge rides the admin escape hatch, which is not a bypass allowance: the allowance exists and names ar7casper, not the acting identity. Both objects were read separately — the ruleset ci-required (id 23956162) has bypass_actors of length 0 across its 14 required contexts, so nothing waives the CI requirement, while branch protection carries the review bypass allowance with require_code_owner_reviews=true.

R2 — THE NEVER-WAIVE CLASS, NAMED TWICE OVER

Re-derived from the whole diff (2 paths, +402 / −0 against master dbb79937): one production file, libs/openant-core/parsers/python/call_graph_builder.py (+104 / −0), plus the new 298-line #705 suite. Zero deletions anywhere in the diff.

parsers/* and a graph writer — this file is the python call-graph writer, and the change alters which call edges are emitted, i.e. which units are reachable — are both named in §6 R2's never-waive list (PROCESS-PR-MERGE-V1.md:371-373: "reachability — parsers/*, graph writers, entry_point_detector, reachability consumers"). So R2 = REACHABILITY / parsers/* + graph-writer, the never-AGENT-waive class. No PR-specific maintainer R2 comment exists and none is claimed here — the override rides the committed class grant under the authority ruling Q2 (13dbd03c: R2 is never-AGENT-waive, not never-maintainer-waive), the 782/817/818/867 and 788/815/845 precedents, and it is recorded on the receipt as well as here.

What it is NOT, each checked by execution at this head: zero .gohtml, types.go, schemas.py or CODEOWNERS paths; zero .github/workflows paths; the string to_dict occurs zero times in the diff; config/models.json untouched; zero entry_point_detector paths. The six sibling-language call_graph_builder.py files (c, php, ruby, rust, swift, zig) are separate files and none is touched — the blast radius is the python parser alone.

THE OVER-SEED QUESTION, ANSWERED BY EXECUTION ON BOTH LEGS

The campaign's safety rule for a reachability SAST is that an over-seed beats a false negative. Twenty-four shapes were run on BOTH legs — a git archive export of master dbb79937 and one of this head — and in no shape does the head emit fewer call edges, fewer functions or fewer classes than master. The shapes where a regression could have hidden are the negative controls, and they read identical on both legs:

shape	master	this head
M1 typed receiver on a dual name (t = Thing(); t.go())	1 edge → the local fallback	2 — the import edge added
M2 class-name form on a dual name (Thing.go(None))	1 edge → the import	2 — the fallback edge added
external-import shim, M2 form — the primary abstains	0 edges	1 → the fallback (the F1 catch, measured)
fallback inherits go() from a same-file base	1 → Base.go	2 — the import edge added
fallback lacks the method, a vendor class has it	0 edges	1 → the import only
local-only name (no import record)	1	identical — no fan-out
import-only name (no class record)	1	identical — no fan-out
function-local namesake + a plain import (the F2 guard)	1	identical — no fan-out
bound-name shadow (def caller(Thing): Thing.go(), the F5 guard)	1	identical — no fan-out
the constructor on a dual name (disclosed limit)	1 → local __init__	identical
the function shim (from x import go + local def go, disclosed limit)	1 → local go	identical
the property read on a dual name (disclosed limit)	1 → local val	identical
both branches already answered from two call sites	2	identical — no duplicate
both branches resolve to the same id (dedup)	1	identical
receiver is an attribute chain (self.t.go())	0	identical
200 ordinary calls, no shim anywhere (stress)	200	identical
the regression floor — an ordinary repo, no shim at all	6 edges	byte-identical edge set

The PR's own disclosed MISS was reproduced and shown NOT to be deepened: with a fallback lacking the method and exactly one unrelated same-named class elsewhere, the primary's step-3 cross-file unique match fabricates unrelated.py:Thing.go — identically on both legs. The PR names this in its limits list; it is pre-existing #440-family behaviour, not introduced here.

THE REAL-CORPUS LEG — 15,960 functions, not a synthetic argument

The python parser's own pipeline (FunctionExtractor → CallGraphBuilder) was run over the export's whole libs/openant-core on both legs:

	master dbb79937	this head
functions	15,960	15,975
classes	2,065	2,065
forward call edges	25,736	25,770

Zero functions, zero classes and zero call edges were lost. The single apparent "loss" is an id relocation inside the changed file itself: the nested def _visit sits at line 419 at master and line 435 at this head, because the call-site hunk inserts exactly 16 lines above it, and this parser keys a nested unit by its line (_visit#L419 → _visit#L435). Normalising that one relocated id, the base edge set and function set are strict subsets of the head's. Of the 34 gained edges, 31 are the new test file's own calls and 3 are the new helper method's (_extract_calls_from_code → _resolve_shim_dual_branches, and that helper's two calls to _resolve_import / _same_file_base_walk).

A census that bounds the blast radius exactly: across the whole tree — 917 files carrying imports and 2,065 classes — there are ZERO dual-record names. The hook therefore fires zero times on OpenAnt's own source; the only behavioural change on the self-scan is the three new edges of the helper itself. The fix is real (proven on the shapes above) and its effect on this repository's own analysis is nil.

THE CONSUMERS THE DIFF DOES NOT NAME, ENUMERATED FROM THE BASE AND THEN EXECUTED

• tests/conformance/test_F1_receiver_type_contract.py — the RECEIVER-TYPE CONFORMANCE CONTRACT. This is the strict consumer of exactly the surface the hook extends (it loads the python CallGraphBuilder by path and pins receiver-type resolution), the PR does not modify it, and the PR's evidence bundle does not name it. Run on both legs: green on both.
• tests/test_python_call_graph_builder.py — the seven-defect regression file for this very class, not modified, green on both legs.
• tests/parsers/python/test_issue318_typed_receiver_bases.py and test_issue440_mro_import_bases.py — the two families whose guards this hook mirrors (function_local, bound-name, the MRO chain). Not modified; green on both legs; and mutant I below shows the hook is wired tightly enough that breaking its receiver guard breaks Inherited methods resolve through self/super() but not through a typed receiver or the class name, so same-file inherited calls emit no edge #318's pins, not only A try/except-ImportError shim gives one name two resolutions — a typed receiver binds the fallback class while the class-name form binds the import, and each loses the other's edge #705's.
• The reachability consumer selection — test_reachability_synthetic_harness_net.py, test_entry_point_detector.py, test_llm_reachability.py, test_reporter_reachable_units.py, test_reachability_prune_telemetry.py, test_call_graph_output.py — run on both legs: 298 passed / 5 skipped at master, 308 passed / 5 skipped at this head, zero failures either leg, the +10 being exactly this PR's new suite and the skip set identical (4 node/go-binary environment skips plus one out-of-tree harness skip).
• The call site is purely additive into a set. calls.add(extra) cannot remove an edge the primary produced, and _resolve_shim_dual_branches performs no mutation of builder state — so edge-set monotonicity is a structural property here, and the table above is its executed confirmation rather than its only evidence.

RULE 40 — ten mutants, nine killed, one predicted survivor, hash-bound, the instrument checked first

Control call_graph_builder.py 0600ffd58b92c05a → 271 passed, 1 skipped across tests/parsers/python/ plus three reachability consumers. The one skip is named, not hidden: test_F4_entry_root_additive_v3.py's pristine-vs-patched harness needs an out-of-tree pre-#165 checkout and an uncommitted patch file; no receipt below rests on it. Each mutant reverts a promise this PR makes; every anchor was asserted present before the edit; the control was restored byte-exact after each one (10/10) and re-confirmed.

mutant	sha16	result	caught by
A — the hook re-gated behind if resolved: (the F1 false-negative direction)	f780f1d60c5506d1	1 FAILED	test_external_import_shim_class_name_form_gets_the_fallback_edge
B — the BOTH-records guard weakened to has_import alone (over-match)	922dea441e975bc6	1 FAILED	test_function_local_namesake_is_not_a_shim
C — the F5 bound-name guard removed	b1877bdb3040d0a4	1 FAILED	test_bound_name_shadowing_a_dual_name_does_not_fan_out
D — the F2 function-local exclusion removed from has_local	5455801cb9e1776e	1 FAILED	test_function_local_namesake_is_not_a_shim
E — the F7 catch reverted: branch A back through the cross-file unique match	4e4ecfae4fd4086a	1 FAILED	test_fallback_lacking_the_method_never_fabricates_cross_file
F — branch B (the import side) deleted — under-seed	893a3ba307909b01	1 FAILED	test_shim_typed_receiver_reaches_both_branches
G — branch A (the local fallback) deleted — under-seed	14431fc500099636	3 FAILED	the M2, external-import and base-chain pins
H — the local_types typed-receiver remap removed	a50cec3c171f5cdc	1 FAILED	test_shim_typed_receiver_reaches_both_branches
I — the receiver ast.Name guard removed (seeded expecting a possible survivor)	f7d8e23c73ed192c	4 FAILED	test_issue318_typed_receiver_bases.py ×4 — see the honesty note below
J — the duplicate filter removed (seeded expecting a survivor)	e8dd1faa0a607cfc	SURVIVED — as predicted	nothing; see below

Two of these are reported against the PR, not for it.

• J survived, and the prediction was stated before the run. The "never a duplicate" promise in the helper's docstring is not pinned by any test, because the call site adds into a set — a duplicate is absorbed by the consumer, not prevented by the producer. The promise is therefore a property of the consumer, and the filter is defence-in-depth rather than a contract. Harmless, but the docstring states it as if the helper guaranteed it.
• I was killed by an existence cascade, not by a behavioural pin. Removing if not isinstance(recv, ast.Name) makes recv.id raise AttributeError on any attribute-chain receiver, which crashes the builder and takes down four #318 tests. That is a weaker pin than a behavioural one: the A try/except-ImportError shim gives one name two resolutions — a typed receiver binds the fallback class while the class-name form binds the import, and each loses the other's edge #705 suite itself does not test a non-ast.Name receiver. The executed consequence is benign (shape L above: an attribute-chain receiver yields no edge on either leg), so this is a test-coverage note, not a defect.

WHAT THIS PR DOES NOT SAY — enumerated at this head and handed up

1. The guard is broader than the word "shim". The condition is "a local class record and an import record for the same name", which also matches shapes that are not try/except-ImportError shims at all. Two were executed: import vendor + class vendor: (master 1 edge → head 2), and import vendor as Thing + a local class Thing (master 1 → head 2). In both, the head's added edge is to the binding that Python would actually use at runtime (the later module-level class statement shadows the import), so the new edge is arguably the more correct one and the old is retained alongside it — over-seed, the safe direction. But the PR's prose frames the trigger as the shim, and the trigger is in fact the dual record. Not a regression (no edge is lost in either shape) and not blocking; a human should read the framing against #705's intent.
2. Branch A's locality claim is imprecise in the code's own docstring. It says branch A answers with "the local class's own or inherited method — the same-file base chain", but #440 made _same_file_base_walk import-aware (_mro_first_definer), so branch A can legitimately reach a cross-file ancestor. Executed (shape K): a fallback inheriting from an imported base resolves through to basemod.py:LocalBase.go. That edge is a real inheritance relation and it was already present at master via the primary, so nothing changed behaviourally — but "same-file base chain" is no longer what that helper does, and the F7 reasoning in the PR body leans on the word same-file.
3. A fifth copy of an existing predicate. The helper re-implements _method_in_class inline (for func_id in self.methods_by_class.get(class_key, []): if ...get('name') == method_name) rather than calling it; that exact method exists 60 lines above in the same class. Cosmetic, zero behavioural effect, but it is the one-predicate-many-copies shape this repo has been repeatedly bitten by.
4. The three one-answer limits the PR discloses were each verified, not taken on trust — constructor, function shim and property read all read identical on both legs (table above). The disclosure is accurate.
5. The pre-existing over-seed on def caller(Thing): Thing.go() is master's, not this PR's. Master already emits an edge to the imported Thing.go despite the parameter shadow; the new hook correctly declines to add a second. Recorded so the F5 guard is not credited with fixing something it only avoids making worse.

Receipts for every number above: runs/pr868-2026-10-26.md and runs/drain-2026-10-26/.

[gadievron]

HALT at stage 3 — PR 868, head ba21b348 — the behavior-contract gate found a regression

Correcting my own notice above, which was written before this gate ran: this PR is not being merged on this pass. The stage-3 behavior-contract gate (bc_gate, harness pinned at 1420a73abcbe57fa) exits 2 = FAIL at this head, receipt-bound by sha256 44af62632c9cf73d.

The regressed arm is degraded-paths, with two added identities:

libs/openant-core/parsers/python/call_graph_builder.py:local_hit
libs/openant-core/parsers/python/call_graph_builder.py:import_hit

The arm's predicate is AST-based over the whole libs/openant-core/parsers surface: an except Exception: (or bare except:) handler whose body assigns one Name target to {}, [] or None. The new helper contains exactly two such handlers. The arm is correct about the pattern — this is not a mis-parse.

Measured, so the baseline argument can be checked rather than taken on trust. Across the entire nine-directory parsers/ surface, master dbb79937 carries exactly two such handlers (swift/call_graph_builder.py:alias_to_target, zig/call_graph_builder.py:alias_to_target); this head carries four. The PR doubles the census and introduces the first two in the python parser, which had zero. So the reasoning that accepted the template-field finding on #862 — "no worse than the arm's standing baseline" — does not transfer here.

A second measurement sharpens it: the two helpers this PR wraps are called at four other sites in this same file, and every one of them is unguarded — _same_file_base_walk at lines 1112 and 1262, _resolve_import at lines 852, 1232 and 1385. The new code is the only place in this 1,480-line file that converts those two calls into a silent None, and it diverges from the file's own convention in the under-seed direction: the same input can raise loudly through the primary path and resolve to silently-nothing through the hook.

The disproof — executed, and it is a disproof of HARM, not of the pattern

1. A swallow-stripped tree. Both handlers were removed from the exported head so the two calls propagate. The arm re-read on that tree returns to the baseline two identities. The consumer suite reads 308 passed / 5 skipped — identical to the unstripped head, and the real-corpus run reproduces the same analyzer digest b15ef1a44f7ba82e with the same 15,975 functions, 2,065 classes and 25,770 edges. Had either handler ever been entered on any of that input, the digests would differ. They do not.
2. Five adversarial raise probes against an instrumented head that records any exception crossing either helper before re-raising: a mutual base cycle, a self-referential base, a 400-deep base chain, an over-dotted relative import, a malformed from-import. Zero raises, no hang, no fatal in all five; the cycle shape abstains cleanly rather than looping.

So the degraded path is not reachable on the suite, on a 15,960-function real corpus, or on five adversarial shapes — the handlers are defensive dead code, not a live silent-degradation path.

What happens next is not this seat's call

bc_gate's only escape is a [BC-ACCEPT] row, which is maintainer-typed after an executed disproof (bc_gate.py:292-297, amendment 51: agents draft it, never type it). No [BC-ACCEPT] exists for this head and none was manufactured. Gate 3a asserts out_exit == 0 and an empty unaccepted set, so stage 3 does not close, [READY] is never emitted, and the merge call is never reached. No merge was attempted.

The recommendation is the author-side repair, not the accept: delete the two except Exception: handlers — a two-line change that the stripped-tree run proves changes nothing measurable. Removing the defect is strictly better than recording an acceptance of it.

Everything else in this arc passed and is unaffected by the halt: stages 0, 1 and 2 CLOSED (8/8, 0/1+1s, 3/6+3s), CI 19/19 with zero reruns, the F3 clean under the lease with both identity proofs equal across it, the over-seed differential 24 shapes + a 15,960-function real corpus with zero losses, and rule 40 at 9 of 10 mutants killed. The template-field arm was checked specifically and did not fire (UNFIXED, added=[]).

Receipts: runs/pr868-2026-10-26.md (the halt and its disproof are rows L32-L36) and runs/drain-2026-10-26/.

[gadievron]

R3/R4 — PR 868, at head 19c94441 (the repaired head)

@sounil — eligible non-author CODEOWNER, re-derived from .github/CODEOWNERS at live master (dbb79937) this arc and not cached: a single * rule naming seven owners, of whom the PR's author is one, so R5 applies. The three server-side review requests (sounil, shahar-davidson, dgeyshis) were read and recorded per D3, never re-issued. A notice for the record, not a gate on any merge.

DISCLOSURE, re-derived live at this head: repo-visibility public · enforce_admins=false · required_approving_review_count=1 · required_reviews unmet (this PR carries zero reviews of any state; the approving count is 0 and none was manufactured). The merge rides the admin escape hatch, which is not a bypass allowance: the allowance exists and names ar7casper, not the acting identity. Both objects were read separately — the ruleset ci-required (id 23956162, active) has bypass_actors of length 0 across its 14 required contexts, so nothing waives CI, while branch protection carries the review bypass allowance with require_code_owner_reviews=true.

WHAT CHANGED SINCE ba21b348, AND WHY

The previous arc halted at stage 3: the behavior-contract degraded-paths arm regressed, +call_graph_builder.py:local_hit,:import_hit. The arm scans all nine parsers/ directories for a handler that catches Exception (or bare) and assigns one name to {}/[]/None; master carries exactly 2 such handlers (swift:187, zig:173) and the authored head carried 4 — the first two in the python resolver core, which had zero. That seat recommended deleting both handlers, on an executed disproof that they were inert.

That recommendation was wrong, and it was refuted by execution, not by argument. On an external-import shim whose local fallback carries a base chain thousands deep, reached by the class-name form only, branch A of the hook is the first walker to touch that chain — on that shape the primary abstains and never walks it. Four trees built from ba21b348, each run through the parser's own pipeline:

tree	result
master dbb79937	OK, no edge
ba21b348 as authored	OK, no edge (swallowed)
both handlers DELETED	RecursionError out of _resolve_shim_dual_branches → main() sys.exit(1) — the whole repo's call graph is lost
this head 19c94441	OK, no edge

So the handlers are a live fail-safe, not dead code, and the deletion would have turned a master-surviving input into a whole-analysis crash — the maximal under-seed.

The repair that landed (19c94441, +16/−2, one file): both handlers narrowed from except Exception: to except RecursionError:. That is this file's own idiom — _module_containers already catches (SyntaxError, ValueError, RecursionError) with the comment "never let a bad one abort the whole build_call_graph() — degrade … over-seed floor, not a crash". Recursion depth is the only live raise on either path (_base_chain carries a _stack cycle guard, _resolve_import a seen guard); every other exception now propagates, matching this file's five unguarded calls of the same two helpers (852, 1112, 1232, 1262, 1385) — the divergence the halt named is what the narrowing removes.

Two refinements, resolved against this file's own precedent rather than by preference:

• Placement — kept at the two call sites, not moved one level up. Both of this file's in-class handlers (181, 595) sit at the fragile operation and degrade locally; neither wraps a callee tree. A catch around the per-function _extract_calls_from_code call would degrade every edge of a function instead of one speculative extra — strictly more loss, the wrong direction for an over-seed rule.
• Logging — silent, with a naming comment. Measured in this file: both in-class handlers degrade silently (595 with exactly such a comment); the only handler that prints to stderr is main()'s CLI top level. The hook fires inside the loop over every function in the repo, so a print would be unbounded noise. Named rather than hidden: this is a deliberate silent-named degrade, and the comment is the record.

NOT fixed here, named instead: the typed-receiver form of the same pathological input (t = Thing(); t.go()) raises RecursionError through the primary path (_resolve_class_method → _same_file_base_walk, cgb:1112) on master itself, with this hook nowhere on the stack. That is a master-side defect and covering it is a scope widening #705 does not ask for.

Receipts for the repair, each executed on these bytes: the arm's own predicate returns to the baseline 2 (except RecursionError is not a type it flags — read from d3_degraded.scan_bare_except_empty, not assumed); tests/parsers/python/ + test_python_call_graph_builder.py + test_F1_receiver_type_contract.py = 247 passed, 1 skipped, identical to the authored head; a real-corpus run over the whole libs/openant-core = 15,975 functions / 2,065 classes / 25,770 edges with a byte-identical edge-set digest to the authored head; and two must-still-fail controls — re-seeding a bare except: or except Exception: at the same two sites takes the arm back to 4, so its teeth are intact in both directions.

R2 — THE NEVER-WAIVE CLASS, NAMED TWICE OVER (unchanged by the repair)

Re-derived from the whole diff at this head: 2 paths, +416 / −0 against master dbb79937 — libs/openant-core/parsers/python/call_graph_builder.py (+118 / −0) plus the 298-line #705 suite. Zero deletions anywhere in the diff, the narrowing included (it rewrites lines that are themselves additions against master).

parsers/* and a graph writer — this file is the python call-graph writer, and the change alters which call edges are emitted, i.e. which units are reachable — are both named in §6 R2's never-waive list (PROCESS-PR-MERGE-V1.md:371-373). So R2 = REACHABILITY / parsers/* + graph-writer, the never-AGENT-waive class. No PR-specific maintainer R2 comment exists and none is claimed here — the override rides the committed class grant under the authority ruling Q2 (13dbd03c: R2 is never-AGENT-waive, not never-maintainer-waive), on the 782/817/818/867 and 788/815/845 precedents.

What it is NOT, each checked by execution at this head: zero .gohtml, types.go, schemas.py or CODEOWNERS paths; zero .github/workflows paths; to_dict occurs zero times in the diff; config/models.json untouched; zero entry_point_detector paths. The six sibling-language call_graph_builder.py files (c, php, ruby, rust, swift, zig) are separate files and none is touched.

THE AUTHORITY, STATED PLAINLY

The repair commit rides the maintainer's committed fix-round grant for this PR (ADDENDUM 39, "the fix round on the sibling's branch is GRANTED under this delegation"). It is a prose grant under amendment 51, not the literal [PUSH-GRANT] string §7 C4 asks for — that deviation is disclosed here and on the receipt rather than papered over, as the 661 arc disclosed the same one. The push was lease-pinned (--force-with-lease at ba21b348), fast-forward, master never touched, and the pushed content was read back byte-equal to the local tree.