fix: credit instanceof ClassName checks as exports consumers

codegraph exports did not credit `instanceof ClassName` checks (or other
bare-reference, no-call-site usages) as consumers. CodegraphError showed
consumerCount:0 via `codegraph exports src/shared/errors.ts --json` despite
two real production usages (src/cli.ts, src/mcp/server.ts) that only ever
reference it via `err instanceof CodegraphError` — never `new
CodegraphError(...)`. Subclasses consumed via constructor calls were
correctly credited (ConfigError, consumerCount:23); only bare-reference
usages like instanceof were invisible to the consumer counter, so any
base/parent class whose primary cross-file use is instanceof narrowing
falsely presented as dead/unused.

Root cause: no edge at all was created for the right-hand operand of an
`instanceof` binary expression — the same "no edge for a bare-identifier
value reference" gap as #1771 (object-literal property values) and #1776
(Lua builtin reassignment), just at a different syntactic position.

Fix: both engines now extract a dynamic `calls` edge (dynamicKind/
dynamic_kind = 'value-ref') when instanceof's right operand is a bare
identifier, reusing the #1771/#1776 taxonomy entry rather than introducing
a new DynamicKind — ADR-002 explicitly anticipated this as "syntax-position-
agnostic" and invited a third extraction site to reuse it. Unlike the
function/method-only #1771/#1776 sites, the resolver-side kind filter for
value-ref now also accepts class-kind targets, since instanceof's operand is
always a class/constructor (never a plain data reference) — it still accepts
function-kind too, correctly covering the pre-ES6 "constructor function"
instanceof idiom (`x instanceof SomeFunction`).

Applied to both engines:
- WASM/TS: src/extractors/javascript.ts (collectInstanceofValueRefCall,
  wired into the shared runCollectorWalk's binary_expression case),
  src/domain/graph/builder/stages/build-edges.ts (resolveFallbackTargets
  kind filter extended to accept 'class'), src/domain/graph/builder/
  incremental.ts (mirrored filter for the incremental/watch-mode path).
- Native: crates/codegraph-core/src/extractors/javascript.rs
  (handle_instanceof_value_ref, wired into match_js_node's binary_expression
  arm — dispatches for JavaScript/TypeScript/Tsx alike), crates/
  codegraph-core/src/domain/graph/builder/stages/build_edges.rs (matching
  kind filter in process_file).
- src/types.ts / docs/architecture/decisions/002-dynamic-call-resolution.md:
  documented instanceof as the third value-ref extraction site and the
  class-kind target-set extension.

Verified against the exact repro on both engines: CodegraphError now shows
consumerCount:2 (src/cli.ts, createCallToolHandler in src/mcp/server.ts),
identical between native and WASM. codegraph roles --role dead does not (and
did not) flag the CodegraphError class itself — exported classes are never
classified dead by role, independent of this fix; the fix's measurable
effect is the consumer-count/fan-in correction. Total dead-symbol count
across the repo's own graph dropped from 816 to 810 as a side effect of
crediting other instanceof-only-referenced symbols codebase-wide.

Resolution-benchmark: no fixture exercises instanceof, so precision/recall
is byte-identical before and after (javascript 100/100, typescript
95.7/93.6, aggregate 63.8% recall) — confirmed empirically, not assumed.

Fixes #1784

docs check acknowledged — internal edge-emission/resolver bug fix, no new
commands, languages, or architecture to document.

Impact: 5 functions changed, 17 affected

Author: carlos-alm

crates/codegraph-core/src/domain/graph/builder/stages/build_edges.rs

@@ -785,16 +785,21 @@ fn process_file<'a>(
         let mut targets = resolve_call_targets(
             ctx, call, fc.rel_path, imported_from, &fc.type_map, caller_name, imported_original_name,
         );
-        // #1771: object-literal property-value references resolve against
-        // function/method-kind targets only — a bare identifier there is as
-        // likely to be a plain data reference (`{ name: SOME_CONSTANT }`) as
-        // a function reference, so drop any non-callable match rather than
-        // fabricating a "calls" edge to a constant/class/etc. Applied once
-        // here (after all resolve_call_targets tiers), mirroring the
+        // #1771/#1784: value-ref references (object-literal property values,
+        // Lua builtin reassignment, `instanceof ClassName`) resolve against
+        // function/method/class-kind targets only. A bare identifier in one
+        // of these positions is as likely to be a plain data reference
+        // (`{ name: SOME_CONSTANT }`) as a real function/class, so drop any
+        // other-kind match rather than fabricating a "calls" edge to a
+        // constant. `class` is included alongside function/method because
+        // `instanceof`'s right operand is always a class/constructor
+        // (#1784) — unlike the original #1771 object-literal case, which is
+        // function/method only. Applied once here (after all
+        // resolve_call_targets tiers), mirroring the
         // `dynamicKind === 'value-ref'` filter in resolveFallbackTargets
         // (stages/build-edges.ts).
         if call.dynamic_kind.as_deref() == Some("value-ref") {
-            targets.retain(|t| t.kind == "function" || t.kind == "method");
+            targets.retain(|t| t.kind == "function" || t.kind == "method" || t.kind == "class");
         }
         sort_targets_by_confidence(&mut targets, fc.rel_path, imported_from);
         emit_call_edges(&targets, caller_id, is_dynamic, fc.rel_path, imported_from, &mut seen_edges, &mut pts_edge_map, edges);

crates/codegraph-core/src/extractors/javascript.rs

@@ -1081,6 +1081,8 @@ fn match_js_node(node: &Node, source: &[u8], symbols: &mut FileSymbols, _depth:
         "shorthand_property_identifier" => {
             handle_object_literal_shorthand_value_ref(node, source, &mut symbols.calls)
         }
+        // #1784: `instanceof ClassName` checks, e.g. `err instanceof CodegraphError`.
+        "binary_expression" => handle_instanceof_value_ref(node, source, &mut symbols.calls),
         _ => {}
     }
 }
@@ -2502,6 +2504,47 @@ fn handle_object_literal_shorthand_value_ref(node: &Node, source: &[u8], calls:
     });
 }
 
+/// Collect a dynamic value-ref `Call` for the right-hand operand of an
+/// `instanceof` binary expression when it's a bare identifier — e.g.
+/// `err instanceof CodegraphError` (issue #1784). `instanceof` reads its
+/// right operand as a value (a prototype-chain check), never calls it, so
+/// this is the same "referenced as a value, not a call site" shape as the
+/// object-literal (#1771) and Lua builtin-reassignment (#1776) sites —
+/// reused rather than given its own `dynamic_kind` (see ADR-002).
+///
+/// Restricted to plain `identifier` right operands: `a instanceof B.C`
+/// (`member_expression`) and `a instanceof (foo())` (parenthesized/call
+/// expressions) are left unresolved rather than guessing — same
+/// "restrict to the simplest syntactic shape" precedent as #1771.
+///
+/// Unlike the function/method-only value-ref sites, `instanceof`'s operand
+/// is always a class/constructor — the resolver-side kind filter in
+/// `build_edges.rs` accepts `class`-kind targets in addition to
+/// function/method for this reason.
+///
+/// Mirrors `collectInstanceofValueRefCall` in `src/extractors/javascript.ts`.
+fn handle_instanceof_value_ref(node: &Node, source: &[u8], calls: &mut Vec<Call>) {
+    let Some(operator_n) = node.child_by_field_name("operator") else { return };
+    if node_text(&operator_n, source) != "instanceof" {
+        return;
+    }
+    let Some(right_n) = node.child_by_field_name("right") else { return };
+    if right_n.kind() != "identifier" {
+        return;
+    }
+    let text = node_text(&right_n, source);
+    if JS_BUILTIN_GLOBALS.contains(&text) {
+        return;
+    }
+    calls.push(Call {
+        name: text.to_string(),
+        line: start_line(&right_n),
+        dynamic: Some(true),
+        dynamic_kind: Some("value-ref".to_string()),
+        ..Default::default()
+    });
+}
+
 /// Extract definitions from destructured object bindings: `const { handleToken,
 /// checkPermissions } = initAuth(...)` creates definitions for `handleToken`
 /// and `checkPermissions`, kind `constant` — matching the convention for plain
@@ -4423,6 +4466,69 @@ mod tests {
         assert!(s.calls.iter().all(|c| c.dynamic_kind.as_deref() != Some("value-ref")));
     }
 
+    // ── #1784: instanceof value-ref extraction ──────────────────────────────
+
+    #[test]
+    fn extracts_value_ref_call_for_instanceof_class_name() {
+        let s = parse_js(
+            "function handle(err) { if (err instanceof CodegraphError) { report(err); } }",
+        );
+        let value_refs: Vec<_> = s
+            .calls
+            .iter()
+            .filter(|c| c.dynamic_kind.as_deref() == Some("value-ref"))
+            .collect();
+        assert!(value_refs.iter().any(|c| c.name == "CodegraphError"));
+        assert!(value_refs.iter().all(|c| c.dynamic == Some(true)));
+    }
+
+    #[test]
+    fn extracts_value_ref_call_for_instanceof_as_expression_value() {
+        let s = parse_js("const isConfig = (err) => err instanceof ConfigError;");
+        let value_refs: Vec<_> = s
+            .calls
+            .iter()
+            .filter(|c| c.dynamic_kind.as_deref() == Some("value-ref"))
+            .collect();
+        assert!(value_refs.iter().any(|c| c.name == "ConfigError"));
+    }
+
+    #[test]
+    fn no_value_ref_call_for_instanceof_member_expression_operand() {
+        let s = parse_js("const check = (a) => a instanceof ns.SomeClass;");
+        assert!(
+            s.calls
+                .iter()
+                .all(|c| !(c.dynamic_kind.as_deref() == Some("value-ref") && c.name == "SomeClass"))
+        );
+    }
+
+    #[test]
+    fn no_value_ref_call_for_instanceof_call_expression_operand() {
+        let s = parse_js("const check = (a) => a instanceof getClass();");
+        assert!(s.calls.iter().all(|c| c.dynamic_kind.as_deref() != Some("value-ref")));
+    }
+
+    #[test]
+    fn no_value_ref_call_for_instanceof_builtin_globals() {
+        let s = parse_js(
+            "function isBuiltin(x) { return x instanceof Error || x instanceof Array || x instanceof Map; }",
+        );
+        assert!(s.calls.iter().all(|c| c.dynamic_kind.as_deref() != Some("value-ref")));
+    }
+
+    #[test]
+    fn no_value_ref_call_for_in_operator() {
+        let s = parse_js("const has = (obj) => 'key' in obj;");
+        assert!(s.calls.iter().all(|c| c.dynamic_kind.as_deref() != Some("value-ref")));
+    }
+
+    #[test]
+    fn no_value_ref_call_for_other_binary_operators() {
+        let s = parse_js("const sum = (a, b) => a + b === Total;");
+        assert!(s.calls.iter().all(|c| c.dynamic_kind.as_deref() != Some("value-ref")));
+    }
+
     #[test]
     fn no_duplicate_call_for_call_expression_arg() {
         let s = parse_js("router.use(checkPermissions(['admin']));");

docs/architecture/decisions/002-dynamic-call-resolution.md

@@ -79,31 +79,41 @@ export type DynamicKind =
   | 'unresolved-dynamic' // detected dynamic call we cannot resolve
   | 'value-ref';          // bare identifier used as a value reference, not a call site —
                           // object-literal property value (dispatch tables, e.g.
-                          // `{ resolve: someFn }`, #1771) or assignment to a Lua
+                          // `{ resolve: someFn }`, #1771), assignment to a Lua
                           // global/builtin identifier (e.g. `require = tracedRequire`,
-                          // #1776) — resolvable against function/method-kind targets
-                          // only
+                          // #1776), or the right operand of an `instanceof` check
+                          // (e.g. `err instanceof CodegraphError`, #1784) —
+                          // resolvable against function/method-kind targets, plus
+                          // class-kind for the instanceof site
 ```
 
 `dynamic?: boolean` is kept to avoid churning every `call.dynamic ? 1 : 0` site.
 
 `value-ref` is Track A (resolvable) but deliberately **not** added to the flag-only
-sink-edge set: when the identifier doesn't resolve to a function/method (e.g. a
+sink-edge set: when the identifier doesn't resolve to a function/method/class (e.g. a
 plain data reference like `{ name: SOME_CONSTANT }`), that's the common case, not
 an undecidable dynamic call site — so it's silently dropped rather than flagged,
 unlike `eval`/`computed-key`/`unresolved-dynamic`.
 
 `value-ref` is deliberately syntax-position-agnostic: any bare identifier that
-names a known function/method and appears somewhere other than a call site
-qualifies, regardless of which language or grammar shape produced it.
-Object-literal property values (#1771) and Lua assignment to a
-global/builtin identifier (#1776, `require = tracedRequire` — a builtin name
-isn't a locally-scoped variable that alias/points-to resolution could ever
-observe, so this is the narrow, language-specific case where a plain
-reference edge is the correct substitute for real alias tracking) are two
-independent extraction sites feeding the same resolution/filtering logic
-downstream; new languages/positions can add a third without touching
-`build-edges.ts` / `incremental.ts` / `build_edges.rs` again.
+names a known function/method/class and appears somewhere other than a call
+site qualifies, regardless of which language or grammar shape produced it.
+Object-literal property values (#1771), Lua assignment to a global/builtin
+identifier (#1776, `require = tracedRequire` — a builtin name isn't a
+locally-scoped variable that alias/points-to resolution could ever observe,
+so this is the narrow, language-specific case where a plain reference edge
+is the correct substitute for real alias tracking), and the right operand of
+an `instanceof` check (#1784, `err instanceof CodegraphError` — `instanceof`
+evaluates its right operand as a value, never calls it) are three independent
+extraction sites feeding the same resolution/filtering logic downstream. The
+`instanceof` site is the first to resolve against `class`-kind targets (the
+other two are function/method only, since `instanceof`'s operand is always a
+class/constructor) — the resolver-side filter is keyed on `dynamicKind`, not
+on which site produced the call, so this is a per-kind allowed-target-kind
+set rather than a per-site one. New languages/positions can add a fourth
+without touching `build-edges.ts` / `incremental.ts` / `build_edges.rs`
+again, beyond widening the allowed-target-kind set if the new site's operand
+isn't a function/method/class.
 
 ### Sink edges reuse `kind='calls'`, not a new edge kind
 

src/domain/graph/builder/incremental.ts

@@ -768,11 +768,14 @@ function buildCallEdges(
       initialTargets,
     );
 
-    // #1771: object-literal property-value references resolve against
-    // function/method-kind targets only — mirrors the same filter in
-    // resolveFallbackTargets (stages/build-edges.ts, full-build path).
+    // #1771/#1784: value-ref references resolve against function/method/
+    // class-kind targets only (class included for `instanceof ClassName`,
+    // #1784) — mirrors the same filter in resolveFallbackTargets
+    // (stages/build-edges.ts, full-build path).
     if (call.dynamicKind === 'value-ref') {
-      targets = targets.filter((t) => t.kind === 'function' || t.kind === 'method');
+      targets = targets.filter(
+        (t) => t.kind === 'function' || t.kind === 'method' || t.kind === 'class',
+      );
     }
 
     edgesAdded += emitIncrementalCallEdges(

src/domain/graph/builder/stages/build-edges.ts

@@ -1380,19 +1380,24 @@ function resolveFallbackTargets(
     if (qualified.length > 0) targets = qualified;
   }
 
-  // #1771: object-literal property-value references (`{ resolve: someFn }`)
-  // resolve against function/method-kind targets only — a bare identifier
-  // there is as likely to be a plain data reference (`{ name: SOME_CONSTANT }`)
-  // as a function, so drop any non-callable match rather than fabricating a
-  // "calls" edge to a constant/class/etc. Applied once here, after every
-  // fallback tier above, so it covers whichever tier produced the match.
+  // #1771/#1784: value-ref references (object-literal property values,
+  // Lua builtin reassignment, `instanceof ClassName`) resolve against
+  // function/method/class-kind targets only. A bare identifier in one of
+  // these positions is as likely to be a plain data reference
+  // (`{ name: SOME_CONSTANT }`) as a real function/class, so drop any
+  // other-kind match rather than fabricating a "calls" edge to a constant.
+  // `class` is included alongside function/method because `instanceof`'s
+  // right operand is always a class/constructor (#1784) — unlike the
+  // original #1771 object-literal case, which is function/method only.
+  // Applied once here, after every fallback tier above, so it covers
+  // whichever tier produced the match.
   if (call.dynamicKind === 'value-ref') {
     // `targets` is typed without `kind` when it flows straight through from
     // resolveCallTargets (call-resolver.ts's declared return type omits it),
     // but every underlying CallNodeLookup method actually populates it — the
     // same gap the preQualifiedTargets cast above already works around.
     targets = (targets as ReadonlyArray<{ id: number; file: string; kind?: string }>).filter(
-      (t) => t.kind === 'function' || t.kind === 'method',
+      (t) => t.kind === 'function' || t.kind === 'method' || t.kind === 'class',
     );
   }
 

src/extractors/javascript.ts

@@ -3185,6 +3185,37 @@ function collectObjectLiteralValueRefCall(pairNode: TreeSitterNode, calls: Call[
   });
 }
 
+/**
+ * Collect a dynamic value-ref `Call` for the right-hand operand of an
+ * `instanceof` binary expression when it's a bare identifier — e.g.
+ * `err instanceof CodegraphError` (issue #1784). `instanceof` reads its
+ * right operand as a value (a prototype-chain check), never calls it, so
+ * this is the same "referenced as a value, not a call site" shape as the
+ * object-literal (#1771) and Lua builtin-reassignment (#1776) sites — reused
+ * rather than given its own DynamicKind (see ADR-002).
+ *
+ * Restricted to plain `identifier` right operands: `a instanceof B.C`
+ * (`member_expression`) and `a instanceof (foo())` (parenthesized/call
+ * expressions) are left unresolved rather than guessing — same
+ * "restrict to the simplest syntactic shape" precedent as #1771.
+ *
+ * Unlike the function/method-only value-ref sites, `instanceof`'s operand is
+ * always a class/constructor — the resolver-side kind filter
+ * (`resolveFallbackTargets` / `build_edges.rs`) accepts `class`-kind targets
+ * in addition to function/method for this reason.
+ */
+function collectInstanceofValueRefCall(binaryNode: TreeSitterNode, calls: Call[]): void {
+  if (binaryNode.childForFieldName('operator')?.text !== 'instanceof') return;
+  const rightNode = binaryNode.childForFieldName('right');
+  if (rightNode?.type !== 'identifier' || BUILTIN_GLOBALS.has(rightNode.text)) return;
+  calls.push({
+    name: rightNode.text,
+    line: nodeStartLine(rightNode),
+    dynamic: true,
+    dynamicKind: 'value-ref',
+  });
+}
+
 function extractReceiverName(objNode: TreeSitterNode | null): string | undefined {
   if (!objNode) return undefined;
   const t = objNode.type;
@@ -3740,11 +3771,11 @@ function collectThisCallAndBindings(
  * `valueRefCalls` is REQUIRED (unlike `calls`) — both paths route
  * object-literal value-ref extraction through this single field, since
  * neither `walkJavaScriptNode` (walk path) nor the compiled query patterns
- * (query path) visit `pair`/`shorthand_property_identifier` nodes on their
- * own (#1771). Both callers pass their own `calls` array here; it's a
- * separate field from the optional `calls` above purely so this collector
- * isn't accidentally gated off by the walk path's "don't double-collect
- * call_expression" omission.
+ * (query path) visit `pair`/`shorthand_property_identifier`/`binary_expression`
+ * nodes on their own (#1771, #1784). Both callers pass their own `calls`
+ * array here; it's a separate field from the optional `calls` above purely
+ * so this collector isn't accidentally gated off by the walk path's "don't
+ * double-collect call_expression" omission.
  */
 interface CollectorWalkTargets {
   definitions: Definition[];
@@ -3849,6 +3880,10 @@ function runCollectorWalk(rootNode: TreeSitterNode, targets: CollectorWalkTarget
           });
         }
         break;
+      case 'binary_expression':
+        // #1784: `instanceof ClassName` checks, e.g. `err instanceof CodegraphError`.
+        collectInstanceofValueRefCall(node, targets.valueRefCalls);
+        break;
     }
     for (let i = 0; i < node.childCount; i++) {
       walk(node.child(i)!, depth + 1, childInDynamicImport);

src/types.ts

@@ -488,7 +488,7 @@ export type DynamicKind =
   | 'reflection' // .call/.apply/.bind / Reflect.* / callable-ref — resolved when target is in codebase; sink edge emitted if unresolved
   | 'eval' // eval() / new Function() — undecidable; always flagged
   | 'unresolved-dynamic' // any other detected dynamic pattern; flagged
-  | 'value-ref'; // bare identifier used as a value reference rather than a call site — object-literal property value (dispatch-table pattern, e.g. `{ resolve: someFn }`, #1771) or assignment to a Lua global/builtin identifier (e.g. `require = tracedRequire`, #1776) — resolved only against function/method-kind targets; unresolved (e.g. plain data references) are dropped silently, NOT flagged
+  | 'value-ref'; // bare identifier used as a value reference rather than a call site — object-literal property value (dispatch-table pattern, e.g. `{ resolve: someFn }`, #1771), assignment to a Lua global/builtin identifier (e.g. `require = tracedRequire`, #1776), or the right operand of an `instanceof` check (e.g. `err instanceof CodegraphError`, #1784) — resolved only against function/method/class-kind targets (class only relevant for the instanceof site); unresolved (e.g. plain data references) are dropped silently, NOT flagged
 
 /** A function/method call detected by an extractor. */
 export interface Call {