…tion

Three targeted fixes to the Go call graph builder hot path:

1. buildParentMap once: findContainingGoFunction and findParentGoFunction
   previously rebuilt the full child→parent reverse-edge map on every call
   node (225k nodes × 65k calls ≈ 14.7B iterations on Ollama). Both now
   accept a pre-built parentMap passed from their call sites.

2. buildPkgVarIndex once: Source 3 in resolveGoCallTarget previously did a
   full O(N) scan of all CodeGraph nodes per unresolved method call to find
   package-level variables. Replaced with a map[dir::varName]*Node index
   built once before Pass 4, making each lookup O(1).

3. isBuiltin package-level var: promoted the builtin name map from a
   per-call allocation to a package-level var.

All existing tests pass unchanged.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- resolveGoCallTarget now returns resolveSource as 4th value:
  "thirdparty_local" for Pattern 1a import calls and Check 2.5 method
  calls into third-party packages; "" for all other paths
- Outer resolution loop propagates resolveSource to CallSite.TypeSource
  so resolution-report stats correctly count third-party resolutions
  instead of mislabeling them as user-code
- Remove unused codeGraph parameter from resolveGoCallTarget
- Add built-in type names (int, float64, string, rune, byte, etc.) to
  goBuiltins so T(x) type-conversion expressions resolve to
  builtin.T instead of being counted as unresolved function calls
- Add TestThirdPartyResolution_TypeSourceLabeling verifying both
  Pattern 1a and Check 2.5 paths emit TypeSource=thirdparty_local

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Three new call resolution improvements:

1. Receiver variable binding (go_variables.go):
   - Extracts receiver name (e.g. `s` in `func (s *Store) Method()`)
   - Adds typed GoVariableBinding to the method scope
   - Fixes `s.db.Query()`, `s.sched.Run()` etc. inside method bodies
   - New helper: extractReceiverName()

2. var_declaration support (go_variables.go):
   - Handles `var sb strings.Builder`, `var mu sync.Mutex` etc.
   - Uses explicit type annotation (confidence 0.9) when present
   - Falls back to RHS inference for `var x = someFunc()`
   - New functions: processVarDeclaration(), processVarSpec()

3. Struct field index + Source 4 (go_builder.go, core/types.go):
   - Builds GoStructFieldIndex: "PkgType.Field" → resolved field type FQN
   - Source 4 splits ObjectName="a.KNorm" → looks up root type then field
   - Resolves `a.KNorm.Forward()`, `m.TextEncoder.Encode()`, `db.conn.QueryRow()`
   - No signature changes: index stored in CallGraph.GoStructFieldIndex

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

The two [debug-1b] Fprintf(os.Stderr) calls in resolveGoCallTarget fired
unconditionally for every method call where scope lookup missed — tens of
thousands of syscalls on large projects like Ollama.

- Add logger *output.Logger parameter to BuildGoCallGraph and
  resolveGoCallTarget (nil-safe: tests pass nil, cmd callers pass logger)
- Replace both fmt.Fprintf calls with logger.Debug(), guarded by
  logger.IsDebug() — only fires when --debug / VerbosityDebug is active
- All four cmd entry points (scan, ci, serve, resolution-report) thread
  the existing logger through

All tests pass unchanged.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…t field index

- go_variables_vardecl_test.go: 11 tests covering processVarDeclaration /
  processVarSpec (stdlib qualified, bytes.Buffer, sync.Mutex, net/url alias,
  multi-name, grouped var block, unqualified same-pkg, method body scope,
  RHS value fallback) and extractReceiverName (pointer + value receivers)
- go_builder_structfield_test.go: 6 tests covering buildStructFieldIndex
  (basic mapping, same-package field, non-struct skip, embedded field skip)
  and Source 4 end-to-end (Attention.KNorm.Forward, Store.db.QueryRow)

Also fixes processVarSpec condition: typeFQN != typeStr was incorrectly
preventing bindings for stdlib packages where alias == import path
(e.g. strings→strings, bytes→bytes).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…ply pattern

Split the sequential Pass 4 resolution loop into two stages:
- Stage 1: N workers each resolve a shard of callsites independently,
  collecting (callerFQN, targetFQN, callSite) results into per-shard
  local slices. All reads in resolveGoCallTarget are immutable-by-Pass-4
  or RWMutex-protected; no shared writes occur during this stage.
- Stage 2: Single goroutine applies shard results sequentially via
  AddEdge/AddCallSite, eliminating the need for any mutex on the
  call graph write path.

Progress is tracked via atomic.Int64 with \r overwrite matching
the existing Pass 2b display pattern.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Add go_builder_pass4_test.go with 23 targeted tests covering all
previously uncovered branches in the parallel Pass 4 code and the
helper functions it depends on:

Pass 4 worker body:
- TestPass4_UnresolvedCallSiteRecorded  — unresolved else branch (lines 289-303)
- TestPass4_Source2EnrichmentStripsPointerPrefix — * stripping in Source 2 enrichment (lines 251-253)

Debug logger paths:
- TestResolveGoCallTarget_DebugLoggerScopeNoBinding (lines 587-589)
- TestResolveGoCallTarget_DebugLoggerNoScope (lines 590-592)

S4 struct field chained resolution:
- TestResolveGoCallTarget_S4Source1FunctionParam (lines 624-630)
- TestResolveGoCallTarget_S4Source3PkgVar (lines 644-648)

Stdlib/ThirdParty loader paths:
- TestResolveGoCallTarget_StdlibLoaderMethodFound (lines 674-676)
- TestResolveGoCallTarget_ThirdPartyLoaderFound (lines 669-676)
- TestResolveGoCallTarget_PromotedMethodViaCheck3 (lines 702-704)

Pattern 4 unresolved:
- TestResolveGoCallTarget_Pattern4Unresolved (line 740)

buildStructFieldIndex edge cases:
- TestBuildStructFieldIndex_DirNotInRegistry (lines 849-850)
- TestBuildStructFieldIndex_EmptyTypeAfterPointerStrip (lines 863-864)

Parent-map multilevel walk:
- TestFindContainingGoFunction_MultilevelWalk (line 901)
- TestFindParentGoFunction_MultilevelWalk (line 923)

resolvePromotedMethod with StdlibLoader (lines 1040-1050):
- TestResolvePromotedMethod_StdlibLoaderTypeNotFound
- TestResolvePromotedMethod_StdlibLoaderInvalidFQN
- TestResolvePromotedMethod_StdlibLoaderCallsFromFields

resolvePromotedMethodFromFields method found (lines 1071-1076):
- TestResolvePromotedMethodFromFields_MethodFoundInEmbedded

All 29 packages pass; builder coverage 80.9% → 83.2%.
Remaining 3 uncovered ranges are pre-existing progress-print paths
requiring 5000+ nodes and an import-extraction error path.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…olution

- Add GetPackage to GoStdlibLoader interface for package-wide type scanning
- Check 2b: scan package interfaces for promoted methods not listed on the
  concrete type in CDN data (e.g. testing.T.Fatalf → testing.TB.Fatalf)
- S4-Source4b: lazy CDN lookup for stdlib struct fields (net/http.Request.Header
  → net/http.Header) when user-code struct index has no entry
- Expand short-qualified CDN field types (url.URL) using calling file's
  importMap (url → net/url) before Check 4 rejects them as incomplete FQNs
- Remove GoStructFieldIndex guard on Source 4 so S4-Source4b fires even for
  projects with no user-defined struct fields
- Add gopls-based ground-truth validation tool under tools/validate_go_resolution
- Improve Go call resolution: 79.1% → 88.4% on ollama, 94.8% on sast-engine

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…ion_report

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>