[DeusData]

What

Design decision (2026-10-18): DATA_FLOWS pair callers and handlers across the test boundary only within one file (R1 + R2):

• R1: a handler defined in a test file pairs only with callers in that same file.
• R2: a caller in a test file pairs only with handlers in that same file.

A test's request to the application, a production caller matched to a test's mock server, and two tests' private mock servers pairing across files are not data flows of the application. Main never implemented this. Since #2689, every caller of a route is linked to every handler of it, so those pairs were made.

try_create_data_flow now refuses a pair when the caller's or the handler's file is a test file and the two files differ. It uses cbm_is_test_file, the per-language rule that extraction already uses for is_test.

• Unchanged: HTTP_CALLS and HANDLES. Only the pairing is scoped.
• Logging: the pass log counts the refused pairs as skipped_test_scope.

This removes most of main's current DATA_FLOWS. On the measured repos, 627 of 696 parallel flows go, nearly all of them a test calling a production controller. That is the 2026-10-18 R1 + R2 design decision applied to the edges as they stand. A test's own HTTP_CALLS stay, so test-to-endpoint reachability is still in the graph.

Evidence

Corpus proof: a from-scratch build of this branch's fix commit 6f00af3 on main 684dcf5 (built from a commit with the identical tree) against a from-scratch build of main 684dcf5. Six repos with route flows, parallel (two runs each, noise 0) and sequential. Only DATA_FLOWS moves, only removals, no attribute changes:

repo	DATA_FLOWS parallel	sequential
thingsboard/thingsboard	432 -> 4	0 -> 0
spring-projects/spring-boot	232 -> 46	396 -> 72
apolloconfig/apollo	15 -> 10	11 -> 6
apache/shenyu	14 -> 9	0 -> 0
Kilo-Org/kilocode	3 -> 0	0 -> 0
microsoft/healthcare-ai-model-evaluator	0 -> 0	0 -> 0

Every removed flow crosses files and involves a test file (classified with the same per-language rule):

• Parallel, 627 removed: test -> production 505, test -> another test file 86, production -> test mock 36.
• Sequential, 329 removed: test -> production 146, test -> another test file 123, production -> test mock 60.

What remains is production -> production (61 parallel) and same-file pairs (8 parallel). These are byte-identical to the base: no added edges and no attribute changes. Sequential DATA_FLOWS are lower on thingsboard because the argument-URL client heuristic runs only on the parallel path (a known, separate parity gap).

Tests:

• infrascan:
  • infrascan_data_flows_test_callers_pair_only_within_their_file: test callers by each language's rule (a tests/ directory, a Java *Test.java, a TypeScript .spec.ts) get no flow to a production handler. The production caller keeps its flow.
  • infrascan_data_flows_test_handlers_pair_only_within_their_file: a production caller gets no flow to a test's mock server. A test reaches the mock server in its own file, but not one in another test file.
• edge_types_probe: data_flows_test_files_pair_within_their_file_sequential and ..._parallel. A Spring controller, a mock controller under src/test/, a production TypeScript fetch client and a .test.ts client all meet on the same __route__ANY__ nodes, and exactly one flow is expected: production client -> production controller.
• Without the fix, all four fail. End to end, both venues give 3 flows instead of 1: the test -> controller pair and the production -> mock pair. With the fix, all four pass.

Suites on the fix commit 6f00af3 (ASan test-runner): infrascan, edge_types_probe, architecture_projection, convergence_probe, edge_structural, extraction, graph_mem, lang_contract, lsp_resolution_probe, matrix_known_classes, ui, route_canon, cross_repo, parallel, pipeline, httpd, incremental. 1,686 passed, plus 1 Windows-only platform skip (#798).

Lint on pass_route_nodes.c is clean: lint-memory-core, the NOLINT check, Homebrew clang-format and CI's cppcheck 2.20.

Head 8d1815c merges main 0f6cc06. Main has not touched this PR's files since 684dcf5, and merge-tree is clean.