Fix three extraction gaps found by widening the benchmark corpus (#171)

All three were invisible to the fixtures, because a fixture only encodes the
forms its author already knew about. Adding public repositories for languages
the corpus had no coverage for surfaced them within minutes.

- Retrofit `@GET(value = "…")`. Kotlin allows any single-argument annotation
  to be written with its argument named, and real Android code does. Matching
  only the positional form yielded no client routes at all — not wrong routes,
  none — so no mobile-to-backend edges existed, silently.

- Axum `.route(p, get(h).layer(mw))`. A non-verb method in the MethodRouter
  chain terminated the walk, dropping the route entirely with the verb in
  plain sight. Non-verb methods are now transparent decorators. Unchanged and
  still deliberate: `.route(p, handler_var)` emits nothing, because there is no
  verb to infer and a guessed one could false-match another repo's endpoint.

- TypeScript path aliases. Overlapping prefixes were resolved by map
  iteration, taking the first match rather than the longest — wrong by tsconfig
  semantics, and different between runs. It was the only reproducibility
  failure in the corpus, and it made the gate report edge churn on a tree
  nobody had touched. Longest prefix wins, ties broken on the prefix string.

cacheVersion v144 and v145, each with its cachecov entry. Five tests; the alias
test repeats every resolution 50 times so it is a regression test rather than a
coin flip that happened to land.

Author: dejo1307

README.md

@@ -119,7 +119,7 @@ enola check --warn-only          # report everything, fail nothing
 
 Not a language model, and not embeddings. enola parses your source with tree-sitter and language-specific extractors, normalizes it into a typed fact model, links it into a directed graph, and runs real graph algorithms over it — Tarjan's SCC for cycles, cycle-safe longest-path for dependency depth, mean+2σ outlier tests for the statistical findings.
 
-That means the same commit yields the same answer, every time — measured, not asserted: across 30 open-source repositories indexed three times each, all 30 produced a byte-identical snapshot ID and a byte-identical fact file, over 3.9 million facts with zero parse errors ([BENCHMARKS.md](docs/BENCHMARKS.md)). Every snapshot carries a **receipt**: enola's version, the git ref and whether the tree was dirty, the extractors used, and a snapshot ID that's a `sha256` fingerprint of the facts rather than a random UUID. Before trusting a comparison, enola checks the two snapshots were even built the same way — a different extractor set or changed ignore rules makes a diff meaningless, and it says so instead of reporting churn as if it were your change.
+That means the same commit yields the same answer, every time — measured, not asserted: across 38 open-source repositories indexed three times each, all 38 produced a byte-identical snapshot ID and a byte-identical fact file, over 4.2 million facts with zero parse errors ([BENCHMARKS.md](docs/BENCHMARKS.md)). Every snapshot carries a **receipt**: enola's version, the git ref and whether the tree was dirty, the extractors used, and a snapshot ID that's a `sha256` fingerprint of the facts rather than a random UUID. Before trusting a comparison, enola checks the two snapshots were even built the same way — a different extractor set or changed ignore rules makes a diff meaningless, and it says so instead of reporting churn as if it were your change.
 
 Nothing leaves your machine. It's a local binary reading local files.
 

internal/cachecov/coverage_test.go

@@ -173,6 +173,8 @@ var versionCoverage = map[int][]string{
 	141: {"TestExtractHTTPClientFacts_NestedGenericTypeArg", "TestExtractHTTPClientFacts_LowercaseVerbCalls", "TestExtractHTTPClientFacts_LowercaseInterpolatedBaseNotMatched", "TestExtractHTTPClientFacts_TestFileCallsAreNotClientRoutes", "TestExtractHTTPClientFacts_VerbNamedCalls", "TestGolden"},
 	142: {"TestDecoratorRoutes_NestObjectForm", "TestDecoratorRoutes_NestStringFormAndBareVerb", "TestDecoratorRoutes_Inversify", "TestDecoratorRoutes_RequiresControllerDecorator", "TestDecoratorRoutes_VocabulariesDoNotMix", "TestDecoratorRoutes_DecoratorsDoNotCarryAcrossMembers", "TestDecoratorRoutes_TestFileEmitsNothing", "TestDecoratorRoutes_CommentBetweenDecoratorAndMethod", "TestGolden"}, // TypeScript's first server-side route DSL: @Controller/@controller classes emit one server route per verb-decorated method, both argument forms, gated on the controller decorator and on IsTestPath // a nested type argument (fetch<ApiResponse<Foo>>) no longer defeats client-call detection, and lowercase verb calls (axios.get('/x')) are detected when the argument is a "/"-rooted literal — the condition that keeps map.get('key')/cache.delete(id) out                                                                                                                                                                                                                                                                                                                                        // a directory without __init__.py starts a new source root, so bare-name sibling imports inside it resolve (while a like-named third-party dir whose parent IS a package stays excluded); and a function passed to a decorator as a value is recorded as a reference instead of reading as dead
 	143: {"TestServerRoutes_ExpressApp", "TestServerRoutes_UnmountedRouterEmitsNothing", "TestServerRoutes_SameFileMountComposes", "TestServerRoutes_DoNotStealClientCalls", "TestServerRoutes_NoDoubleEmission", "TestServerRoutes_OtherFrameworks", "TestServerRoutes_TestFileEmitsNothing", "TestGolden"}, // call-registered server routes (Express/Fastify/Hono/Koa), separated from v141 client calls by receiver binding; an unmounted sub-router and a bare catch-all emit nothing
+	144: {"TestRetrofit_NamedValueArgument", "TestAxum_PerRouteLayerDoesNotSwallowTheVerb", "TestAxum_HandlerValueWithoutVerbStillEmitsNothing"}, // Retrofit @GET(value=) + Axum per-route .layer()
+	145: {"TestResolveImportPath_LongestAliasWinsDeterministically", "TestResolveImportPath_NonAliasPathsUnchanged"}, // TS overlapping-alias resolution: specificity + determinism
 	139: {"TestLooksGenerated", "TestApplyDecoratorProps_FrameworkRegistered", "TestApplyDecoratorProps_ModalNeedsImportGuard", "TestGolden"},                                                                                                                                                                                                                                                                                                                                                                                                                         // facts from files carrying a codegen banner gain generated=true (language-agnostic, matched against the file head), and Python decorator-registered handlers (FastAPI exception_handler/middleware/on_event/websocket, Modal local_entrypoint and — gated on a modal import — function/cls) gain framework_registered=true, so the dead-code detector can drop findings it can never act on
 	138: {"TestResolveImports_NestedLookalikeDoesNotCaptureThirdParty", "TestResolveImports_MultiSourceRootSurvivesPackageBoundaryRule", "TestResolveImports_SubpackageNotReachableByBareName", "TestBuildSuffixIndex_NoPackageDirsStaysPermissive", "TestResolveCallTargets_NestedLookalikeThirdPartyDropped", "TestResolveCallTargets_ClassQualifiedChainResolves", "TestResolveCallTargets_ClassQualifiedUnconfirmedStaysDotted", "TestResolveCallTargets_ClassQualifiedThroughReexport", "TestResolveCallTargets_SingleSegmentNeedsNoConfirmation", "TestGolden"}, // Python: (a) a directory is only a top-level package if its parent is not one, so an internal dir sharing a third-party name no longer captures its imports; (b) call-target resolution walks the module/symbol split leftwards with an exact module lookup, so a class-qualified chain binds to module.Class.method instead of being silently rewritten to module.method — multi-segment symbols must be confirmed against real symbol names // Python: a call target imported through a package __init__.py re-export resolves to the module that defines the symbol instead of dangling as a dotted string that matches no node; exact module resolution still wins and an ambiguous re-export stays dotted rather than binding arbitrarily // Python implements plugin.TestRefExtractor (which now also receives the production file list, needed to resolve dotted absolute-import targets); a symbol exercised only by a pytest file stops reading as dead, while the pass emits ONLY KindTestRef facts so a fixture's include_router cannot re-enter the production route graph                                                                                                          // "**/testdata/**" joins the default ignore globs, and the two extractors that walk the repo themselves — OpenAPI (Extract) and gRPC (Detect) — repeat it in skipDir, which the globs cannot reach; Go fixture repos are miniature codebases whose routes and client call sites were being attributed to the host repo's service, manufacturing a cross-repo coverage gap
 }

internal/engine/cache.go

@@ -844,7 +844,47 @@ import (
 // the same file are composed; cross-file mount resolution needs a repo-wide pass and
 // is deliberately not attempted. Bare catch-alls (app.get('*')) are skipped for the
 // same reason: a SPA fallback is not an endpoint and would match any client path.
-const cacheVersion = "v143"
+// v144: two annotation/chain forms that real code uses and the extractors did not
+// read, each found by adding a production repository to the benchmark corpus rather
+// than by inspection — which is the point of having one.
+//
+// Kotlin/Retrofit: `@GET(value = "topics")`. Kotlin permits any single-argument
+// annotation to be written with its argument named, and Google's reference Android
+// app writes EVERY endpoint that way. Matching only the positional form yielded zero
+// client routes there, and a Retrofit interface with no routes contributes no
+// mobile-to-backend edges at all — so "which screens break if I change this
+// endpoint" answered nothing, silently, on an entire class of Android codebase.
+//
+// Rust/Axum: `.route("/x", get(handler).layer(mw))`. A non-verb method in the
+// MethodRouter chain was treated as a terminator, so per-route middleware — which is
+// idiomatic Axum — discarded the verbs beneath it and dropped the route entirely,
+// with `get` sitting in plain sight. Non-verb methods are now transparent: the walk
+// recurses past them and keeps the chain below. Only ever applied to the second
+// argument of `.route(path, …)`, which is a MethodRouter by construction, so any
+// method on it is a wrapper around one.
+//
+// Unchanged, and still deliberate: `.route(path, handler_var)` emits nothing. There
+// is no verb to infer, and inventing one would produce a route that could false-match
+// another repository's endpoint — worse than the visible gap.
+// v145: TypeScript alias resolution picked among OVERLAPPING aliases by Go map
+// iteration order, taking the first match rather than the most specific one.
+//
+// Wrong twice over. tsconfig `paths` resolution is most-specific-first, so a project
+// mapping both "@acme/schema" and "@acme/" means the former for "@acme/schema/x" —
+// the old code could resolve it to either. And because map iteration is randomized,
+// "either" meant a DIFFERENT answer on different runs of the same unchanged tree.
+//
+// Measured on a 15k-file monorepo that maps one package both to its source and to its
+// built output: 2 facts of 163,582 flipped between runs — enough that three
+// consecutive `enola check` runs on an untouched tree reported `edges +1/-1`, then
+// `+6/-6`, then clean. It was the only repository of 38 that failed byte-level
+// reproducibility, and the failure is the expensive kind: a delta tool that invents
+// churn is worse than one that is merely incomplete, because invented churn is
+// indistinguishable from a real change.
+//
+// Longest matching prefix now wins, ties broken on the prefix string so the result is
+// a total order rather than a less-arbitrary one.
+const cacheVersion = "v145"
 
 // extractorCache holds per-extractor facts keyed by a content hash of the files
 // the extractor depends on. It is loaded from disk at the start of a snapshot and

internal/extractors/kotlinextractor/retrofit.go

@@ -13,7 +13,17 @@ import (
 //
 //	@GET("/api/settings/entitlements/users/{userID}/active")
 //	@POST("auth/login")
-var retrofitAnnotation = regexp.MustCompile(`@(GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS)\s*\(\s*"([^"]*)"`)
+//	@GET(value = "topics")
+//
+// The `value =` form is the same annotation written with its argument named, which
+// Kotlin allows for any single-argument annotation and which real Android codebases
+// use — Google's own reference app writes every endpoint that way. Matching only the
+// positional form yielded ZERO client routes for such a repository, and a Retrofit
+// interface with no routes produces no mobile-to-backend edges at all, silently: the
+// "which screens break if I change this endpoint" question just returns nothing.
+// Found by adding a real Android application to the benchmark corpus; see
+// DEFECTS_FOUND.md.
+var retrofitAnnotation = regexp.MustCompile(`@(GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS)\s*\(\s*(?:value\s*=\s*)?"([^"]*)"`)
 
 // absoluteClientURL matches an absolute http(s) URL in a Retrofit annotation,
 // capturing the host and the remaining path. A full URL targets a fixed external

internal/extractors/kotlinextractor/retrofit_test.go

@@ -86,3 +86,45 @@ interface AdService {
 		t.Errorf("relative annotation must not be external; got %+v", rel)
 	}
 }
+
+// TestRetrofit_NamedValueArgument covers the `@GET(value = "…")` form.
+//
+// Kotlin allows any single-argument annotation to be written with its argument
+// named, and real Android codebases do — Google's reference app writes every
+// endpoint that way. Matching only the positional form yielded ZERO client routes
+// for such a repository: not a wrong route, no routes at all, and therefore no
+// mobile-to-backend edges and no answer to "which screens break if I change this
+// endpoint". Found by adding a production Android app to the benchmark corpus.
+func TestRetrofit_NamedValueArgument(t *testing.T) {
+	src := `package com.example.core.network.retrofit
+
+interface NetworkApi {
+    @GET(value = "topics")
+    suspend fun getTopics(@Query("ids") ids: List<String>?): NetworkResponse<List<NetworkTopic>>
+
+    @POST(value = "/api/v1/sync")
+    suspend fun sync(@Body body: SyncRequest): NetworkResponse<Unit>
+
+    @GET("positional/still/works")
+    suspend fun positional(): NetworkResponse<Unit>
+}
+`
+	ff := extractRetrofitFacts([]byte(src), "core/network/retrofit/NetworkApi.kt")
+	if len(ff) != 3 {
+		t.Fatalf("expected 3 client routes, got %d: %+v", len(ff), ff)
+	}
+
+	byName := map[string]string{}
+	for _, f := range ff {
+		byName[f.Name], _ = f.Props["method"].(string)
+	}
+	for path, want := range map[string]string{
+		"topics":                 "GET",
+		"/api/v1/sync":           "POST",
+		"positional/still/works": "GET",
+	} {
+		if got := byName[path]; got != want {
+			t.Errorf("route %q method = %q, want %q (all of: %+v)", path, got, want, byName)
+		}
+	}
+}

internal/extractors/rustextractor/axum.go

@@ -139,7 +139,21 @@ func collectMethodRouterChain(node *sitter.Node, src []byte) []axumRouteEntry {
 		}
 		name := nodeText(field, src)
 		if !axumHTTPMethods[name] {
-			return nil
+			// A non-verb method in the chain is a DECORATOR, not a terminator:
+			// `.route("/x", get(h).layer(mw))` attaches per-route middleware and is
+			// idiomatic Axum, as are `.route_layer(…)` and `.with_state(…)`. Bailing
+			// out here discarded the verbs underneath it, so the whole route vanished
+			// even though `get` was sitting right there — a route silently absent from
+			// the graph, which is the worst way to be wrong. Recurse past it instead
+			// and keep whatever the chain below yields.
+			//
+			// Safe to be permissive: this only ever runs on the SECOND argument of a
+			// `.route(path, …)` call, which is a MethodRouter by construction, so any
+			// method on it is a wrapper around one.
+			//
+			// Found on a production Axum service added to the benchmark corpus; see
+			// DEFECTS_FOUND.md.
+			return collectMethodRouterChain(fn.ChildByFieldName("value"), src)
 		}
 		entries := collectMethodRouterChain(fn.ChildByFieldName("value"), src)
 		return append(entries, axumRouteEntry{method: strings.ToUpper(name), handler: axumFirstArgName(node, src)})

internal/extractors/rustextractor/axum_test.go

@@ -258,3 +258,72 @@ fn app() -> Router {
 		t.Errorf("expected no handler prop for a closure handler, got %v", routes[0].Props["handler"])
 	}
 }
+
+// TestAxum_PerRouteLayerDoesNotSwallowTheVerb covers `.route(p, get(h).layer(mw))`.
+//
+// A non-verb method in the MethodRouter chain used to terminate the walk, so
+// per-route middleware — idiomatic Axum — discarded the verbs beneath it and the
+// route vanished entirely, with `get` sitting in plain sight. A route silently absent
+// from the graph is the worst way to be wrong: nothing reports it, and a client
+// calling that path resolves to nothing. Found on a production Axum service added to
+// the benchmark corpus.
+func TestAxum_PerRouteLayerDoesNotSwallowTheVerb(t *testing.T) {
+	ff := extractComposed(t, map[string]string{
+		"src/router.rs": `
+fn build() -> Router {
+    Router::new()
+        .route("/plain", get(root))
+        .route("/layered", get(openapi::handler).layer(Extension(Arc::new(openapi))))
+        .route("/stacked", post(create).layer(a).route_layer(b))
+        .route("/both_verbs_then_layer", get(list).post(create).layer(mw))
+}`,
+	})
+
+	got := routePaths(ff)
+	for _, want := range []string{"/plain", "/layered", "/stacked", "/both_verbs_then_layer"} {
+		if !got[want] {
+			t.Errorf("missing route %q — a decorator in the chain dropped it; got %v", want, got)
+		}
+	}
+
+	// The verbs under the decorator must survive, not just the path.
+	methods := map[string]map[string]bool{}
+	for _, f := range ff {
+		if f.Kind != facts.KindRoute {
+			continue
+		}
+		m, _ := f.Props["method"].(string)
+		if methods[f.Name] == nil {
+			methods[f.Name] = map[string]bool{}
+		}
+		methods[f.Name][m] = true
+	}
+	if !methods["/layered"]["GET"] {
+		t.Errorf("/layered lost its GET verb: %v", methods["/layered"])
+	}
+	if !methods["/both_verbs_then_layer"]["GET"] || !methods["/both_verbs_then_layer"]["POST"] {
+		t.Errorf("/both_verbs_then_layer should keep both verbs, got %v", methods["/both_verbs_then_layer"])
+	}
+}
+
+// TestAxum_HandlerValueWithoutVerbStillEmitsNothing pins the deliberate half of the
+// same walk: `.route(path, handler_var)` has no verb to infer, and inventing one
+// would produce a route that could false-match another repository's endpoint. The
+// permissive recursion above must not turn this into a guess.
+func TestAxum_HandlerValueWithoutVerbStillEmitsNothing(t *testing.T) {
+	ff := extractComposed(t, map[string]string{
+		"src/router.rs": `
+fn build() -> Router {
+    Router::new()
+        .route("/from_var", okay.clone())
+        .route("/real", get(handler))
+}`,
+	})
+	got := routePaths(ff)
+	if got["/from_var"] {
+		t.Error("/from_var has no HTTP verb and must not be emitted")
+	}
+	if !got["/real"] {
+		t.Error("/real should still be extracted")
+	}
+}

internal/extractors/tsextractor/ts.go

@@ -1415,14 +1415,37 @@ func tryParseTSConfigAliases(tsconfigPath string) (map[string]string, bool) {
 
 // resolveImportPath normalizes a TypeScript import path to a filesystem-relative path.
 // It handles path aliases (@/), relative imports (./), and identifies external packages.
+//
+// When several aliases match, the LONGEST prefix wins. Two rules in one:
+//
+//   - Correctness. tsconfig `paths` resolution is most-specific-first, so a project
+//     mapping both "@acme/schema" and "@acme/" means the former for "@acme/schema/x".
+//     Taking any match resolved such imports to the wrong module.
+//   - Determinism. This used to `range` the alias map and return on first match. Go
+//     randomizes map iteration, so on a monorepo that maps a package BOTH to its source
+//     and to its built output, the same import resolved to a different module on
+//     different runs — and the snapshot stopped being reproducible. Measured on a
+//     15k-file monorepo: 2 facts of 163,582 flipped between runs, which was enough to
+//     make `enola check` report `edges +6/-6` on a tree nobody had touched. A delta
+//     tool that invents churn is worse than one that is merely incomplete, because the
+//     churn is indistinguishable from a real change.
+//
+// Ties are broken on the prefix string so the result is a total order, not merely a
+// less-arbitrary one. See DEFECTS_FOUND.md.
 func resolveImportPath(importPath, fileDir string, aliases map[string]string) (string, bool) {
-	// Try alias resolution first
+	bestPrefix, bestReplacement := "", ""
 	for prefix, replacement := range aliases {
-		if strings.HasPrefix(importPath, prefix) {
-			rest := strings.TrimPrefix(importPath, prefix)
-			return filepath.ToSlash(filepath.Clean(replacement + rest)), false
+		if !strings.HasPrefix(importPath, prefix) {
+			continue
+		}
+		if len(prefix) > len(bestPrefix) || (len(prefix) == len(bestPrefix) && prefix < bestPrefix) {
+			bestPrefix, bestReplacement = prefix, replacement
 		}
 	}
+	if bestPrefix != "" {
+		rest := strings.TrimPrefix(importPath, bestPrefix)
+		return filepath.ToSlash(filepath.Clean(bestReplacement + rest)), false
+	}
 
 	// Relative imports
 	if strings.HasPrefix(importPath, ".") {