fix(indexer,server): B7-v2 Express+Zod root-cause fixes, canonical PolicyDecision gate

Three fixes from this session's audit of the product-uplift roadmap, each
root-caused, fixed, and verified with a full workspace test run + real B7
benchmark re-run:

1. Express (`rename_express_set_charset`): `build_resolution_context`'s
   `path_lang` map was populated only from the `symbols` table, so a file
   with zero top-level named declarations (any Mocha/Jest-style
   `describe`/`it` test file) never got a `path_lang` entry, silently
   zeroing every outgoing call edge from that file regardless of
   confidence. Fixed by seeding `path_lang` from `file_index` instead,
   which records every indexed file regardless of symbol count.

2. Zod (`rename_zod_prettify_error`): `import_node_types` never walked
   `export_statement` for JS/TS, so `export { x } from 'y'` re-exports
   never produced an `import_edges` row. Zod's real re-export is a 2-hop
   wildcard barrel chain, so `reference_impact`'s import-edge lookup is
   now a bounded BFS (`REFERENCE_IMPACT_MAX_REEXPORT_HOPS`) instead of a
   single-hop query. New `parse_js_export_from` reuses the existing
   `symbols_used = '[]'` wildcard convention from `parse_rust_import`.

3. Canonical PolicyDecision (roadmap item 3): `compute_touch_risk` — the
   function feeding both real write gates (`edit_lines_impl_gated`'s
   block decision and `edit_context`'s `gate_prediction`) — never
   considered `touches_manifest`/`touches_uncovered_code`, two axes
   `policy::evaluate()` already escalates to `Policy::default()`'s
   maximally-conservative `high` floor. Those axes were only ever
   computed on the CCK-10 authority-digest branch, never on the plain
   confirm/reason path every edit_lines/edit_symbol call takes by
   default. Fixed by folding both floors into compute_touch_risk's own
   escalation chain (reads the project's real policy.toml config, not
   hardcoded), so a manifest edit or an edit to uncovered code is finally
   gated the same way on both paths. Also corrected a stale policy/mod.rs
   doc comment claiming nothing reads the policy module yet.

B7 benchmark now passes 6/6 via the calm_v2 arm with zero regressions.
Full details, root-cause narratives, and verification chains in
docs/plans/2026-08-20-product-uplift-and-b7v2-roadmap.md (§8-§14).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: Your Name

benchmarks/b7_task_correctness/README.md

@@ -298,6 +298,125 @@ which is not committed and safe to delete between runs.
 
 ## Next steps
 
+## v2 (2026-08-20): a third `calm_v2` arm, and why it did NOT close the gap
+
+## Update (same day): Express's real bug found and FIXED — `path_lang` gap in `context.rs`
+
+## Update (same day): Zod's real bug found and FIXED too — transitive re-export walk
+
+Per an explicit follow-up ask, the zod gap (§7.1/§6.1's "materially bigger feature") was fixed in
+the same session. Two changes: (1) `crates/calm-core/src/indexer/imports.rs` now walks
+`export_statement` for JS/TS and parses `export {...} from '...'` / `export * from '...'` into
+`import_edges` (previously zero export syntax was ever indexed, for any JS/TS project); (2)
+`reference_impact`'s import-edge lookup (`crates/calm-server/src/tools/trace.rs`) is now a bounded
+BFS through wildcard re-export chains instead of a single-hop query, closing zod's actual two-hop
+barrel-file case. Full detail, including a real fallback-chain bug caught and fixed before it
+shipped: `docs/plans/2026-08-20-product-uplift-and-b7v2-roadmap.md` §10.
+
+`cargo test --workspace --release`: 0 failed. Re-ran all 6 B7 tasks end-to-end:
+
+| task | calm_v2, before | calm_v2, after |
+|---|---|---|
+| rename_zod_prettify_error | 0.5/False | **1.0/True** |
+| the other 5 tasks (incl. express) | 1.0/True | 1.0/True (unchanged) |
+
+**B7 now passes 6/6 via the `calm_v2` arm.** `calm` v1 stays at 0.5/False for zod by design (v1
+never calls `reference_impact`, the tool this fix lives in). Not covered, documented as a known
+scoped-out gap: `export * as ns from` namespace re-exports, and an `as`-aliased re-export changing
+the name partway through a chain.
+
+The deeper audit above (triggered by a user follow-up: "is there truly no way to fix this?") found
+that the actual root cause was neither `reference_impact`'s coverage nor the parser — it was
+`build_resolution_context`'s `path_lang` map being derived only from the `symbols` table, so a
+file with zero top-level named declarations anywhere (any Mocha/Jest/Vitest-style `describe`/`it`/
+`test` file, including the real `test/utils.js`) never got a language entry, causing
+`resolve_sites_to_edges`'s same-language safety filter to empty out every outgoing call that file
+made — regardless of confidence tier. Full root-cause trace: `docs/plans/2026-08-20-product-uplift-
+and-b7v2-roadmap.md` §8.
+
+**Fixed** in `crates/calm-core/src/indexer/pipeline/context.rs` (`path_lang` now seeded from
+`file_index`, which already tracks every indexed file's language regardless of symbol count) —
+same doc's §9 has the full verification chain. Re-ran all 6 B7 tasks end-to-end against the fixed
+binary:
+
+| task | calm / calm_v2, before | calm / calm_v2, after |
+|---|---|---|
+| rename_express_set_charset | 0.667/False · 0.667/False | **1.0/True · 1.0/True** |
+| rename_zod_prettify_error | 0.5/False · 0.5/False | 0.5/False · 0.5/False (unchanged — separate bug, §7.1) |
+| the other 4 tasks | 1.0/True | 1.0/True (unchanged, no regression) |
+
+`cargo test --workspace --release`: 0 failed. New permanent regression test:
+`test_call_from_a_file_with_no_named_symbols_still_gets_a_call_edge` in
+`crates/calm-core/src/indexer/pipeline.rs`. Fix is currently uncommitted, pending the user's
+go-ahead to commit/push.
+
+Full rationale and audit trail: `docs/plans/2026-08-20-product-uplift-and-b7v2-roadmap.md`.
+
+A third arm, `calm_v2`, was added (`run_calm_arm_v2` in `run_benchmark.py`, alongside `naive`/
+`calm` — `calm` v1 kept unchanged for comparison). It supplements `edit_context`'s `callers()`
+with `reference_impact`'s `must_change`/`likely_change` hits, on the hypothesis (from
+`reference_impact`'s own source comment, `crates/calm-server/src/tools/trace.rs:780-784`, which
+names both tasks below) that this tool — built specifically to close this benchmark's own
+documented gap — would fix Express and Zod.
+
+**Result: it did not.** Both tasks scored identically to v1:
+
+| task | v1 (`calm`) recall/build | v2 (`calm_v2`) recall/build |
+|---|---|---|
+| rename_express_set_charset | 0.667 / False | 0.667 / False |
+| rename_zod_prettify_error | 0.5 / False | 0.5 / False |
+
+The other four tasks (fd, flask, gin, spring-petclinic) stayed at 1.0/True in `calm_v2` too — no
+regression from the wider `reference_impact` surface.
+
+**Root-caused, not assumed:**
+
+- **Zod**: `reference_impact` returned `must_change_count: 0` for `prettifyError`. Both missing
+  files re-export it via `export { …, prettifyError, … } from "../core/index.js";`. Traced to
+  `crates/calm-core/src/indexer/imports.rs::import_node_types`, which for `"javascript" |
+  "typescript"` only walks `["import_statement", "variable_declarator"]` — **`export_statement` is
+  never walked at all**, so no `import_edges` row is ever created for a re-export, for any JS/TS
+  project. This is a real, previously-undocumented gap in the import extraction, not something
+  `reference_impact`'s existing import-edge tier can see. (The two real `z.prettifyError(...)` call
+  sites did get a call_edge, but at `"ambiguous"` confidence, correctly bucketed as `review` —
+  `edit_context.callers()` already covered those, so this was never where the miss came from.)
+- **Express**: `reference_impact` produced 0 `review` hits and 7 `textual_only` hits for
+  `setCharset` — `test/utils.js`'s `utils.setCharset(...)` (property access on a bare
+  `require('../lib/utils')`) still produces no call_edge at all. Confirms this is exactly the
+  pre-existing `parser.rs` call-site-extraction gap already named in this section's own "Next
+  steps" above — orthogonal to what an import/export-edge fix could address.
+
+**Correction to `reference_impact`'s own source comment**: its claim to catch "the exact gap
+behind" both tasks holds for a plain-`import`-side reference, but not for Zod's actual `export {
+X } from 'y'` re-export shape, and not for Express's case at all (a different bug class — call-site
+extraction, not import/export tracking). Worth narrowing that comment once the `export_statement`
+gap below is fixed.
+
+**Follow-up, not done in this pass — revised after a deeper audit** (full detail:
+`docs/plans/2026-08-20-product-uplift-and-b7v2-roadmap.md` §6-§7): walking `export_statement` in
+`import_node_types`/`extract_imports_from_tree` is real and necessary, but **not sufficient on its
+own** for Zod — its actual re-export is a two-hop barrel chain (`external.ts` names `prettifyError`
+re-exporting from `core/index.ts`, which itself re-exports `errors.ts` via a *wildcard*
+`export * from './errors.js'` naming no symbols at all). A single-hop `import_edges` fix would
+point `external.ts` at `core/index.ts`, not at `errors.ts` where the symbol is actually defined —
+`reference_impact`'s direct `to_path` lookup still wouldn't find it. Closing this needs transitive
+import-edge resolution through wildcard re-export chains, not a single-function patch — re-run
+`rename_zod_prettify_error` after landing whichever shape of fix to confirm empirically, not
+assume (this file's own history is a live example of why: the original `reference_impact` source
+comment claimed to close this gap and, empirically re-run here, did not). Express's gap needs a
+separate `parser.rs` call-site-extraction fix (property-access call through a required module's
+bare identifier), already scoped above — unaffected by anything import/export-related.
+
+Also independently re-verified this session (adversarial self-audit, not just re-reading the
+numbers): both failures reproduce identically outside the benchmark harness (`npm test` /
+`pnpm test` run directly against the renamed corpus copies — same `TypeError`/`TypeCheckError` as
+above); both symbols are collision-free and false-positive-free in the pinned corpora (manual grep
+matches `oracle_callsite_files` exactly for both); and naive's "1.0 recall" on every task is close
+to tautological by construction (`run_naive_arm`'s file-selection regex and `oracle.py`'s
+ground-truth regex are near-identical) — the informative, independent signal is `build_pass` on
+both arms, which is real compiler/test ground truth and was the first thing re-verified. See the
+roadmap doc's §7 for the full adversarial audit trail.
+
 1. Investigate the express `setCharset` call-graph gap directly in
    `parser.rs`'s JS/TS call-site extraction (property-access call through a
    required module's bare identifier vs. a destructured bare-name call to

benchmarks/b7_task_correctness/run_benchmark.py

@@ -183,6 +183,74 @@ def run_calm_arm(corpus: Path, task: dict, real_repo_root: Path, lang: str) -> d
     finally:
         client.close()
 
+def run_calm_arm_v2(corpus: Path, task: dict, real_repo_root: Path, lang: str) -> dict:
+    """CALM-scripted, v2 -- docs/plans/2026-08-20-product-uplift-and-b7v2-roadmap.md
+    Phase 0 item 1. Same as run_calm_arm above, but supplements edit_context's
+    `callers()` with `reference_impact`'s must_change/likely_change hits.
+    `reference_impact` was purpose-built (landed 2026-08-04, commit 60ff9c9 --
+    AFTER this file's Phase-2 results were last recorded, 2026-07-30) to close
+    exactly the two gaps this benchmark's own README documents in its Phase 2
+    section: a bare re-export/import edge that never becomes a call edge
+    (zod's `prettifyError`), and (empirically checked here, not assumed) a
+    property-access call through a required module's bare identifier
+    (express's `setCharset`) -- see that function's own doc comment in
+    crates/calm-server/src/tools/trace.rs, which names both tasks by id.
+
+    `review`/`textual_only` hits are counted but deliberately NOT
+    auto-renamed -- same caution AGENTS.md's documented workflow already
+    recommends (a textual-only match can be an unrelated same-named symbol;
+    see this README's own `slugify` 3-way-collision finding). A real agent
+    would surface those counts and decide, not silently skip or silently
+    rename them; this arm reports them in the result row instead of hiding
+    the number, matching this repo's stated benchmark policy of not hiding
+    an inconvenient measurement."""
+    client = MCPClient(project_root=str(corpus), repo_root=str(real_repo_root))
+    tool_calls = 0
+    try:
+        client.wait_until_indexed()
+        provider = _SCIP_PROVIDER_BY_LANG.get(lang, lang)
+        try:
+            client.call_tool("scip_refresh", {"lang": provider})
+        except Exception:  # noqa: BLE001 -- best-effort, matches B12's posture
+            pass
+        raw = client.call_tool("edit_context", {"symbol": task["symbol"]})
+        tool_calls += 1
+        ctx = json.loads(raw)
+        touch_files = set()
+        for c in ctx.get("callers", []):
+            sym = c.get("symbol", "")
+            if "::" in sym:
+                touch_files.add(sym.split("::", 1)[0])
+        touch_files.add(task["def_path"])
+
+        ri_raw = client.call_tool("reference_impact", {"symbol": task["symbol"]})
+        tool_calls += 1
+        ri = json.loads(ri_raw)
+        review_hits = 0
+        textual_only_hits = 0
+        for hit in ri.get("references", []):
+            cls = hit.get("classification")
+            if cls in ("must_change", "likely_change"):
+                touch_files.add(hit["path"])
+            elif cls == "review":
+                review_hits += 1
+            elif cls == "textual_only":
+                textual_only_hits += 1
+
+        edited = [f for f in sorted(touch_files) if apply_rename_at(corpus, f, task["symbol"], task["new_name"])]
+        tool_calls += len(touch_files)
+        client.call_tool("diff_impact", {})  # mandatory post-edit verification, AGENTS.md Stage 7
+        tool_calls += 1
+        return {
+            "arm": "calm_v2", "files_touched": sorted(edited),
+            "calm_reported_touch_files": sorted(touch_files), "tool_calls": tool_calls,
+            "reference_impact_review_count": review_hits,
+            "reference_impact_textual_only_count": textual_only_hits,
+        }
+    finally:
+        client.close()
+
+
 
 def score_arm(oracle_files: set[str], result: dict) -> dict:
     touched = set(result["files_touched"])
@@ -245,10 +313,19 @@ def main() -> int:
         calm_result["output_tail"] = calm_bt.output[-1500:]
         row["calm"] = score_arm(oracle_files, calm_result)
 
+        print(f"[b7]   calm_v2 arm (edit_context + reference_impact) ...", file=sys.stderr)
+        calm_v2_corpus = fresh_clone(lang, "calm-v2")
+        calm_v2_result = run_calm_arm_v2(calm_v2_corpus, task, real_repo_root, lang)
+        calm_v2_bt = build_test_gate(calm_v2_corpus, task.get("build_cmd"), task["test_cmd"])
+        calm_v2_result["build_pass"] = calm_v2_bt.passed
+        calm_v2_result["output_tail"] = calm_v2_bt.output[-1500:]
+        row["calm_v2"] = score_arm(oracle_files, calm_v2_result)
+
         rows.append(row)
 
     summary = {
-        "phase": "B7 Phase 1-3 (fd/Rust, flask/Python, express/JS, zod/TS, gin/Go, spring-petclinic/Java)",
+        "phase": "B7 Phase 1-3 (fd/Rust, flask/Python, express/JS, zod/TS, gin/Go, spring-petclinic/Java)"
+                 " + v2 (2026-08-20 roadmap doc, calm_v2 = edit_context + reference_impact)",
         "methodology": "deterministic oracle only (build/test pass + independent "
                         "callsite recall via B12's ground_truth, extension-filtered) "
                         "-- no LLM judge, per design spec constraint",
@@ -258,14 +335,14 @@ def main() -> int:
     out_path.write_text(json.dumps(summary, indent=2))
 
     print()
-    print("| task | baseline | naive build_pass | naive recall | calm build_pass | calm recall |")
-    print("|---|---|---|---|---|---|")
+    print("| task | baseline | naive build_pass | naive recall | calm build_pass | calm recall | calm_v2 build_pass | calm_v2 recall |")
+    print("|---|---|---|---|---|---|---|---|")
     for row in rows:
         if "skipped_reason" in row:
-            print(f"| {row['id']} | SKIPPED | - | - | - | - | ({row['skipped_reason']}) |")
+            print(f"| {row['id']} | SKIPPED | - | - | - | - | - | - | ({row['skipped_reason']}) |")
             continue
-        n, c = row["naive"], row["calm"]
-        print(f"| {row['id']} | green | {n['build_pass']} | {n['recall']} | {c['build_pass']} | {c['recall']} |")
+        n, c, v2 = row["naive"], row["calm"], row["calm_v2"]
+        print(f"| {row['id']} | green | {n['build_pass']} | {n['recall']} | {c['build_pass']} | {c['recall']} | {v2['build_pass']} | {v2['recall']} |")
     print(f"\nfull results written to {out_path}")
     return 0