feat(callgraph)!: replace Jelly with the defuse linker — tsc + per-callable tiers

[rahlk]

Closes #98. Stacked on #97 (native v2 model). Design record: docs/design/specs/defuse-linker-call-graph.md · audited gate: docs/design/specs/defuse-linker-joern-ledger.md.

What

Jelly is removed wholesale — the whole-program flow analysis (the same cost class as python's removed PyCG), the __jelly multi-call binary mode, CANTS_SELF_JELLY, the @cs-au-dk/jelly dependency and its patch, and BREAKING: the released --call-graph-provider and --tsc-only flags (one code path, no backend flag — python 1.2.0 precedent). Bundle: 998 → 455 modules.

In its place, the defuse linker (src/semantic_analysis/defuseLinker.ts): a deterministic per-callable pass over the tsc resolver's leftovers, python's Jedi+defuse architecture instantiated for TS. Tiers, in order: T1 local value chase (bounded alias hops) · T2 decorator invocations (method/accessor/param owners; class/property decorators attribute to the module) · T3 external-callback rule (function value passed to an external/unresolved callee ⇒ enclosing→lambda — the documented divergence from python; JS is callback-central) · T4 bounded interprocedural votes (param-invoking sites, factory returns; two rounds, no fixpoint) · T5 CHA-by-name fallback (bounded fan, skip-not-truncate). Edges carry prov: ["defuse"]; resolutions reach the L1 call nodes out-of-band and are never persisted into callee_signature (cache provenance rule). Module-scope execution is now a call-graph SOURCE (python #131 parity): top-level calls, class decorators, and the top-level express idiom attribute to the MODULE, id-homed onto the module node.

The validation drove six real analyzer fixes

Iterating the Joern ledger surfaced L1/L2 gaps Jelly had been masking, each now regression-tested:

1. Concise-arrow bodies that ARE the call (u => u.describe()) recorded no call site
2. Module-scope calls had no caller at all
3. Tagged template calls (inline`url(...)`) were invisible end to end
4. Parameter-default initializer calls (f(sel, style = mkSheet())) were never walked
5. JS sources were never discovered (SOURCE_EXTS was ts-only — vscode's vendored marked.js was analyzed through its bodiless .d.ts); .js/.jsx/.mjs/.cjs are first-class now with two-way compiled-sibling/declaration-sibling rules
6. T4c, the ctor-field callback chain — this.field(...) through parameter properties with one bounded parameter hop; vscode's migrateOptions registration pattern closes end-to-end (apply → callback → apply.write), no fixpoint

Gates

• Corpus superset (enforced): residual 0 — 74/74 Joern jssrc2cpg real pairs across sample-app, dataflow-app, anon-app, nestjs-realworld @ c1c2cc4 (ours 126 internal edges vs Joern's 30 there)
• vscode scale audit (microsoft/vscode @ a3c9dc6, 8,735 files / 1.15M LOC): 99.66% of 55,074 single-candidate Joern real pairs covered after seven fix rounds; the 189 residual is classified per family in the ledger (Registry-pattern generics, Promise-executor name shadows, the static/instance signature-collision schema finding, escaped closure-locals = python docs(spec): entrypoint detection for typescript, matching python #150's staged tier, accessor tails)
• Scale: cants L2 5m52s / 24.4GB for 1,024,232 edges (single-threaded) vs Joern parse 9m06s / 30.3GB on 10 cores; the engines this replaces DNF'd at this class (PyCG 3h19m, Fraunhofer OOM at 44GB)
• Jelly recovery: 6/6 jelly-only fixture edges (3 decorator, 1 callback, 2 upgraded to typed tsc resolutions)
• A/B determinism: byte-identical paired runs on every corpus app and the vscode edge dump
• Full suite (136 pass), typecheck, Neo4j conformance + schema.neo4j.json regen byte-stable, binary builds

Follow-ups recorded (not in this PR)

• python-sdk tsc_only kwarg removal (spec release plan; the one known break until then)
• Whole-program propagation tier for escaped closure-locals (python docs(spec): entrypoint detection for typescript, matching python #150 analog)
• Static/instance signature discrimination — id-grammar change, design mode
• schema_version stays 2.1.0; ships in the same next minor as refactor(schema)!: native v2 model — one model family + per-run passes #97 with BREAKING release-note lines

[rahlk]

Superseded by #103, which is now based on main.

These three branches were never a stack in history. feat/issue-101-artifacts and this branch share a merge-base of f49b3f8 — the #96 commit at the bottom — so the artifact branch forked there and re-developed this work in parallel rather than on top of it. The PR bases declared a stack that git never had.

Content-wise, feat/issue-101-artifacts is a superset:

• It merges into main with zero conflicts (+7530/-936 across 90 files).
• Against this branch it is +5939/-40, and every one of those 40 deleted lines is a replacement, not a loss — it carries the streaming PrintWriter in scripts/joern/dump-calls.sc (the JVM 2GB array-cap fix) and structuredClone in src/schema/emit.ts (the vscode L4 OOM fix), where this branch still holds the older StringBuilder and JSON.parse(JSON.stringify(...)).
• src/semantic_analysis/defuseLinker.ts and docs/design/specs/defuse-linker-joern-ledger.md are both present there.

Nothing here is lost by closing. The work lands in #103, which now has a passing CI run — the first any branch in this group has ever had, since the old pull_request: branches: [main] filter exempted every non-main-based PR (fixed in #106).