fix(resolver): WS7 — SCIP overlay must not add a formal edge conflicting with confident static resolution (D8)

Kills the corpus's one remaining false_confidence data point (fixture I /
D8): false_confidence_rate 0.25 -> 0.0, false_confident_site_rate 0.125 -> 0.0,
call_recall 0.875 (unchanged), no other fixture's outcome changed.

MECHANISM CORRECTION (root-caused live, not from the audit or the fixture's own
oracle note): the wrong `external.py::name@formal` edge is INSERTED by the SCIP
overlay (formal_source='scip', insert_missing_exact_edges), NOT the stack-graphs
`formally_resolved` bare-name upgrade in extract_file_data that the plan/audit
assumed. Verified against the live DB: the call site is already `resolved`, so
extract_file_data's formal upgrade (gated on `!= Resolved`) never fires here.
scip-python follows the `from external import name` binding and reports
external.py::name, missing that the later same-scope `def name` shadows it — so
the overlay added a top-tier edge to a target real Python semantics never calls.

Fix: insert_missing_exact_edges now skips inserting a competing formal/scip edge
when the same call site already carries a CONFIDENT STATIC edge (`resolved`, or
non-scip `formal`) to a DIFFERENT target (has_conflicting_confident_static_edge).
Deliberately narrow: `ambiguous`/`textual`/`inferred` edges stay overridable —
that IS the overlay's job (scip disambiguating fan-out) — only a real
language-rule resolution is protected. The existing "scip rules out other
targets of an ambiguous call site" behavior is unchanged (24/24 ingest tests,
1241/1241 calm-core lib tests green).

Regression test (scip-independent, constructed directly):
scip_does_not_add_formal_edge_conflicting_with_confident_static_resolution.

The separate stack-graphs bare-name upgrade (pipeline.rs) remains a real but
currently-undemonstrated latent false-confidence risk — tracked as follow-up,
not fixed speculatively without a failing fixture.

Wave 0.3 of docs/plans/2026-08-19-evidence-architecture-execution-plan.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: Your Name

benchmarks/resolution_precision/README.md

@@ -5,6 +5,34 @@ Implements **WS0** of
 Every WS2–WS6 change in that plan must attach a before/after run of this benchmark; a change
 merges only if `call_recall` does not drop **and** `false_confidence_rate` does not rise.
 
+## WS7 status: SHIPPED (2026-08-19) — fixture I / D8 false-confidence eliminated, `false_confidence_rate` 0.25 → 0.0
+
+Fixture I (`I_file_symbol_wins_over_import`, the D8 shadowing case) used to emit TWO edges from one
+call site: `caller.py::name@resolved` (correct — tier-1 file-symbol-over-import priority) AND
+`external.py::name@formal` (WRONG). **Root-caused live (2026-08-19), correcting this fixture's own
+oracle note:** the wrong edge is inserted by the *SCIP overlay* (`formal_source = 'scip'`,
+`crates/calm-core/src/scip/ingest.rs::insert_missing_exact_edges`), NOT the bundled stack-graphs
+`formally_resolved` bare-name upgrade the plan/audit assumed. The call site's persisted confidence
+is already `resolved`, so `extract_file_data`'s formal upgrade (gated on `!= Resolved`) never fires
+here; scip-python follows the `from external import name` binding and reports `external.py::name`,
+missing that the later same-scope `def name` shadows it.
+
+Fix: `insert_missing_exact_edges` now skips inserting a competing `formal`/`scip` edge when the same
+call site already carries a CONFIDENT STATIC edge (`resolved`, or non-scip `formal`) to a DIFFERENT
+target (`has_conflicting_confident_static_edge`). Deliberately narrow — `ambiguous`/`textual`/
+`inferred` edges stay overridable (that is the overlay's job); only a real language-rule resolution
+is protected. Regression test (scip-independent, constructed directly):
+`crates/calm-core/src/scip/ingest.rs::scip_does_not_add_formal_edge_conflicting_with_confident_static_resolution`.
+
+Full corpus before → after: `false_confidence_rate` **0.25 → 0.0**, `false_confident_site_rate`
+0.125 → 0.0, `call_recall` 0.875 (unchanged), no other fixture's outcome changed; fixture I went
+FALSE_CONFIDENCE → RECALL_LOWCONF_CORRECT.
+
+The separate stack-graphs `formally_resolved` bare-name upgrade (`pipeline.rs` — upgrades a site to
+`formal` when stack-graphs proved *any* same-named reference resolves in the file) is a real but
+currently-undemonstrated latent false-confidence risk; tracked as a follow-up, not fixed
+speculatively without a failing fixture.
+
 ## WS2 status: SHIPPED (2026-08-18) — verify via unit test, not this corpus
 
 `import_path` now threads end-to-end (`resolve_tier1` → `CallSiteData` → `call_sites` column →

crates/calm-core/src/scip/ingest.rs

@@ -419,6 +419,21 @@ fn insert_missing_exact_edges(
             let Some(to_symbol) = resolve_unique_symbol_at(conn, def_path, *def_line)? else {
                 continue;
             };
+            // WS7 (evidence reconciliation, fixture I / D8): the static
+            // resolver may have already resolved this EXACT call site to a
+            // DIFFERENT target at a confident tier via a real language rule --
+            // e.g. Python's file-symbol-over-import priority, where a later
+            // same-scope `def name` shadows `from x import name`, so `name()`
+            // never calls the import. SCIP is a strong authority but not an
+            // infallible one: some SCIP indexers follow the import binding and
+            // miss that shadowing. It must NOT silently ADD a competing
+            // `formal` edge contradicting a confident static resolution -- that
+            // is a genuine, live false_confidence_rate data point (a top-tier
+            // edge to a target the language never actually calls). Skip the
+            // insert on conflict; the correct static edge stays.
+            if has_conflicting_confident_static_edge(conn, call_site_id, &to_symbol)? {
+                continue;
+            }
             let added = insert.execute(rusqlite::params![
                 enclosing_qn,
                 to_symbol,
@@ -446,6 +461,35 @@ fn insert_missing_exact_edges(
     Ok(inserted)
 }
 
+/// WS7 reconciliation guard for `insert_missing_exact_edges`: true when this
+/// call site already carries a CONFIDENT STATIC edge to a target OTHER than the
+/// one SCIP wants to add. "Confident static" = `resolved` (tier-1 language-rule
+/// resolution) or a non-SCIP `formal` (e.g. stack-graphs) edge -- deliberately
+/// NOT `ambiguous`/`textual`/`inferred`, which the overlay is SUPPOSED to
+/// override (that is the whole point of SCIP disambiguating fan-out). A SCIP
+/// proof contradicting a confident static resolution is a conflict, not a new
+/// target: adding it would manufacture a false-confidence edge (D8).
+fn has_conflicting_confident_static_edge(
+    conn: &Connection,
+    call_site_id: i64,
+    scip_target: &str,
+) -> rusqlite::Result<bool> {
+    conn.query_row(
+        "SELECT EXISTS(
+             SELECT 1 FROM call_edges
+             WHERE call_site_id = ?1
+               AND to_symbol != ?2
+               AND ruled_out_by_scip = 0
+               AND ( edge_confidence = 'resolved'
+                  OR (edge_confidence = 'formal'
+                      AND (formal_source IS NULL OR formal_source != 'scip')) )
+         )",
+        rusqlite::params![call_site_id, scip_target],
+        |row| row.get::<_, i64>(0),
+    )
+    .map(|exists| exists != 0)
+}
+
 /// Persist evidence only after the graph row itself was accepted.  The SELECT
 /// rechecks the current CallSite/span/file snapshot, so a stale or deleted
 /// edge cannot manufacture a proof record by id alone.
@@ -1397,6 +1441,88 @@ mod tests {
         assert_eq!(source, "scip");
     }
 
+    #[test]
+    fn scip_does_not_add_formal_edge_conflicting_with_confident_static_resolution() {
+        // WS7 / fixture I (D8): `from external import name; def name(): ...;
+        // name()`. Python's file-symbol-over-import priority correctly resolves
+        // the call to the LOCAL `name` at `resolved`. scip-python follows the
+        // import binding and reports external.py::name -- but real Python
+        // semantics never call it (the later same-scope def shadows the
+        // import). The overlay must NOT insert a competing `formal` edge that
+        // contradicts the confident static resolution (verified live 2026-08-19:
+        // it used to, producing a top-tier false_confidence edge).
+        let conn = Connection::open_in_memory().unwrap();
+        crate::db::schema::init_db(&conn).unwrap();
+        conn.execute_batch(
+            "INSERT INTO symbols (qualified_name, name, kind, language, path, line_start, line_end)
+             VALUES
+                ('caller.py::name', 'name', 'function', 'python', 'caller.py', 4, 5),
+                ('external.py::name', 'name', 'function', 'python', 'external.py', 1, 2);
+             INSERT INTO file_index (path, hash, language, symbol_count, last_indexed)
+             VALUES ('caller.py', 'fresh-source', 'python', 2, 0);
+             INSERT INTO call_sites
+                (from_path, enclosing_qn, callee_name, call_line, callee_start_byte,
+                 callee_end_byte, identity_version, edge_kind)
+             VALUES ('caller.py', 'caller.py::use', 'name', 9, 4, 9, 2, 'call');
+             INSERT INTO call_edges
+                (from_symbol, to_symbol, call_site_line, call_site_id, edge_confidence,
+                 from_path, to_path, edge_kind)
+             VALUES ('caller.py::use', 'caller.py::name', 9, 1, 'resolved',
+                     'caller.py', 'caller.py', 'call');",
+        )
+        .unwrap();
+        let occ = vec![
+            crate::scip::parse::ScipOccurrence {
+                file: "external.py".into(),
+                line: 1,
+                start_byte: None,
+                end_byte: None,
+                source_file_hash: None,
+                symbol: "N".into(),
+                is_def: true,
+                is_local: false,
+                encoding_provenance: crate::scip::parse::EncodingProvenance::Declared,
+                guessed_alt_byte_range: None,
+            },
+            crate::scip::parse::ScipOccurrence {
+                file: "caller.py".into(),
+                line: 9,
+                start_byte: Some(4),
+                end_byte: Some(9),
+                source_file_hash: Some("fresh-source".into()),
+                symbol: "N".into(),
+                is_def: false,
+                is_local: false,
+                encoding_provenance: crate::scip::parse::EncodingProvenance::Declared,
+                guessed_alt_byte_range: None,
+            },
+        ];
+
+        let stats = super::ingest_occurrences(&conn, &occ, true).unwrap();
+        assert_eq!(
+            stats.inserted, 0,
+            "scip must not insert a competing formal edge conflicting with the \
+             confident static (resolved) resolution of the same call site"
+        );
+        let edges: Vec<(String, String, i64)> = {
+            let mut stmt = conn
+                .prepare(
+                    "SELECT to_symbol, edge_confidence, ruled_out_by_scip \
+                     FROM call_edges ORDER BY to_symbol",
+                )
+                .unwrap();
+            stmt.query_map([], |r| Ok((r.get(0)?, r.get(1)?, r.get(2)?)))
+                .unwrap()
+                .collect::<rusqlite::Result<_>>()
+                .unwrap()
+        };
+        assert_eq!(
+            edges,
+            vec![("caller.py::name".to_string(), "resolved".to_string(), 0)],
+            "only the correct local edge should survive, un-ruled-out: {edges:?}"
+        );
+    }
+
     #[test]
     fn exact_span_reference_rules_out_only_other_targets_of_the_same_call_site() {
         let conn = Connection::open_in_memory().unwrap();

docs/plans/2026-08-19-evidence-architecture-execution-plan.md

@@ -111,9 +111,19 @@ immediately.
 - **DoD:** `check-b2-thresholds.sh` passes on a corpus whose oracle coverage is
   measured and documented; thresholds reflect the honest baseline, not aspirational floors.
 
-**0.3 — WS7A: preserve provider target identity** *(the P0 core; ~M)*
-- Change `formally_resolved_names` (`pipeline.rs:400-407`) to stop collapsing to
-  `HashSet<String>`. Return the **pairs** `(reference_symbol, definition_symbol)`.
+**0.3 — WS7A: reconcile provider proof against confident static resolution** *(the P0 core; ~M)* — **SHIPPED 2026-08-19**
+> **Mechanism correction (verified live, not from the audit/fixture comment):** the D8
+> false-confidence edge is inserted by the **SCIP overlay**
+> (`scip/ingest.rs::insert_missing_exact_edges`, `formal_source='scip'`), *not* the
+> stack-graphs `formally_resolved` bare-name upgrade the audit and fixture I's own
+> oracle note blamed — the call site is already `resolved`, so `extract_file_data`'s
+> upgrade (gated on `!= Resolved`) never fires. Fix landed there instead:
+> `insert_missing_exact_edges` skips a competing `formal` insert when the same call
+> site already has a confident static edge (`resolved`/non-scip `formal`) to a different
+> target (`has_conflicting_confident_static_edge`). The stack-graphs bare-name upgrade
+> is a *separate*, currently-undemonstrated latent risk — follow-up, not fixed here.
+- ~~Change `formally_resolved_names` to return `(reference_symbol, definition_symbol)` pairs~~
+  (superseded — that path is not the D8 cause; see correction above).
 - At the upgrade site (`pipeline.rs:771-776`), map `definition_symbol` → the target
   `SymbolId` the static resolver *actually chose* for this call site, and compare:
   - **agree** → confirm `Formal` (today's happy path, now *justified*);