Call-graph skills: language onboarding, miss sweep, Haiku triage scout (#3779, #3780)

[squid-protocol]

Summary

The second PR under epic #3772. It turns the call-graph tools from #3793 into routines that are repeatable and cheap on tokens.

• .claude/skills/callgraph-language-onboarding (Skill: callgraph-language-onboarding (add a compiler reference for a new language) #3779) is the checklist for adding a language's compiler reference. It covers:
  • picking and pinning the tool (the TypeScript 7 "no JS API" trap);
  • choosing a corpus (not crucible; use import_graph_corpus.json);
  • the adapter naming rules the TypeScript onboarding learned the hard way (member assignments took unmapped callers from 139 to 13; quoted keys; no bodyless defs; / paths);
  • registry, fixture test, first-measurement sanity checks, baseline/CI/hook, docs, and filing findings in milestone 14.
• .claude/skills/callgraph-miss-sweep (Skill: callgraph-miss-sweep, plus a Haiku callgraph-triage-scout agent #3780) is the fix loop: start green, then pick a bucket (precision first, split broad buckets), then check the known-pattern table (Call resolver: an untyped receiver's built-in method call (str.trim(), map.get()) links confidently to a same-named repo method via file/import #3756–[TypeScript] func_start names a quoted method async "array-objects"() {} as async #3760, Delta scans lose inherited-method call links: the rehydrator restores inheritance_parents but the resolver reads inheritance #3786–Import graph (TS/JS): a package's imports of itself by name (from "zod/v4") resolve nowhere, costing ~130 call links on zod #3789, and the untracked in_string / after_nested_def / same_name buckets), then verify against source, root-cause with explain_call, and fix. It adds the net-change rule (Call resolver: several block-scoped definitions of one name in a file (const Node = … per test) all resolve to one of them, not the enclosing scope's #3759's first attempt fixed 3 links and broke 3), then verify and ship.
• .claude/agents/callgraph-triage-scout.md (model: haiku, Skill: callgraph-miss-sweep, plus a Haiku callgraph-triage-scout agent #3780) handles the mechanical runs: triage, split, explain and issue drafts. It pastes tool output verbatim and never judges.
• callgraph_triage.py --split BUCKET classifies every item in a bucket by the shape of its call site and its receiver (spread, spread-qualified, constructor, qualified:recv, chained, bare, template). On a first trial the Haiku scout misread the triage header and misclassified spreads by eye. The classification now lives in the tool, and the agent pastes the tool's output.
• --json samples now carry their source excerpt.

--split resolved_outside on zod (269 edges):

shape:receiver	edges	issue
qualified:z	133	#3789
qualified:processors	53	#3788
spread + spread-qualified:errorUtil	40 + 24	#3787
rest (util.x(), bare, other)	19

Earlier I counted about 51 spreads by eye; the deterministic count is 64.

A re-run of the scout trial with these instructions reproduced the tool output exactly.

Type of change

• Documentation / tooling (skills, agent, test tooling). No engine change.

CI checklist

• ruff format and the ruff, mypy and dead-key audits pass
• New tests: 11 call_shape cases, split on the fixture scan, and the JSON excerpt

Differential Scan target

N/A: no parsing or engine code changed, so golden masters are unaffected.

Verification

python tests/tools/callgraph_check.py --langs typescript,python --skip crucible,tree-sitter (crucible and tree-sitter skipped because nothing in the engine changed):

PASS     gate:typescript    precision 99.9% (1520) recall 57.1% resolution 73.7%  [baseline 99.9% / 57.1% / 73.7%]
PASS     gate:python        precision 99.8% (1806) recall 51.6% resolution 97.5%  [baseline 99.8% / 51.6% / 97.5%]
PASS     tests              301 passed
PASS     lint:ruff / lint:dead-key / lint:mypy / lint:format

Closes #3779
Closes #3780

🤖 Generated with Claude Code

https://claude.ai/code/session_01AbvXUJpva5XxxbssoKG9Jt

---

Generated by Claude Code

[github-actions]

🐦‍⬛ Muninn Security Scan

✅ No security issues found.

🐦‍⬛ Powered by Muninn · Skald Lab

[squid-protocol]

full-suite-matrix (windows-latest, 3.9) is red, but not because of this PR. Two tests fail with KeyError: 'src/LEDGER.cbl':

• tests/cobol_mainframe/test_refractor_engine_channels.py::test_open_sites_survive_a_delta_scan
• tests/cobol_mainframe/test_refractor_engine_channels.py::test_a_baseline_without_open_sites_still_rehydrates

This PR changes only skills, an agent file, docs and tests/tools/callgraph_triage.py plus its test. The failing file came in with #3768. The same failure hit #3793's Windows run, and origin/main still has the unfixed test.

Cause: on Windows, StateRehydrator(...).load_state(...)["ram_cache"] is keyed by native src\LEDGER.cbl paths, but the tests index it with "src/LEDGER.cbl".

Fix: no fix PR exists yet. The test-only patch is in my comment on #3793: a _cached(cache, rel) helper that looks the key up with / or os.sep. Or ram_cache keys could be normalised to / in state_rehydrator.py, if that is the intended contract. I haven't widened this PR with either change; it should land on its own.

---

Generated by Claude Code