fix: resolve scoped/static (Class::method) call targets for PHP and Rust

[NaeemHaque]

Summary

Scoped/static calls (Mailer::send() in PHP, Mailer::send(x) / Self::method() in Rust) were stored as CALLS edges with the intermediate Class::method target, which matches neither the qualified-name lookup (<file>::Class.method) nor the bare-name lookup. The edges dangled, so callers_of, get_impact_radius, and tests_for silently missed these callers — especially impactful in Rust, where Type::method() / Self::method() is the dominant call form.

Fixes #567.

What this does

Adds a post-build resolver (code_review_graph/scoped_resolver.py) in the same style as the existing Spring/Temporal/ReScript resolvers. It rewrites resolvable Class::method CALLS targets to the canonical node qualified name, wired into both full build and incremental update (gated to .php/.rs).

It is deliberately conservative so it never fabricates an edge:

• Only genuine two-part Class::method targets are resolved. Multi-segment Rust module paths (a::b::c) are left alone — resolving them by their last two segments would point at unrelated types.
• PHP namespaces are stripped before lookup (App\Mailer → Mailer).
• self / Self resolve to the enclosing class.
• Resolves on a single matching (class, method) node, or disambiguates via the caller file's IMPORTS_FROM edges. Ambiguous or unknown targets (external types like Vec::new) are left untouched.
• Rewritten edges are tagged confidence_tier = INFERRED to distinguish them from directly-extracted ones.

Known limitation: same-name collisions across files with no import statement have nothing to disambiguate on and stay unresolved. Strictly better than today, not 100%.

Scope is PHP and Rust — the two languages that actually produce a dangling Class::method edge. C++/Ruby produce no CALLS edge for scoped calls (a separate extraction gap), and R's :: is external-package access; both are out of scope here.

Tests

tests/test_scoped_resolver.py (14 tests): PHP cross-file and namespaced calls, Rust cross-file and Self::, the multi-segment false-edge guard, external-target-left-untouched, import disambiguation (resolved + ambiguous), incremental re-resolution, idempotency, and INFERRED tagging.

• uv run pytest — all pass (full suite green)
• uv run ruff check code_review_graph/ — clean
• mypy clean; coverage gate (65%) passes

[itxaiohanglover]

Clean implementation — follows the existing resolver pattern (_run_temporal_resolver etc.) consistently. The _SCOPED_CALL_EXTS comment explaining why only PHP and Rust are included is helpful.

One minor question: in incremental_update, the condition checks spring_changed for temporal stats but scoped_changed for scoped stats — is that intentional? If spring and scoped are independent, looks correct. Just confirming the temporal → spring coupling is existing behavior.

[NaeemHaque]

Hey @itxaiohanglover — thanks for taking the time to review this!

Yes, that's intentional. Temporal shares Spring's check on purpose, and scoped has its own. The temporal one is existing behavior — I just left it as-is.

[itxaiohanglover]

Good work on this! I had commented on #567 about Class::method calls not being tracked. Restricting to PHP and Rust makes sense — the comment about C++/Ruby not emitting CALLS edges and R being external package access shows good understanding of the grammar differences.

The incremental update guard with _SCOPED_CALL_EXTS is efficient. Have you thought about adding a test fixture with a scoped call to verify the resolver actually rewrites the target correctly?

[NaeemHaque]

That's already covered. tests/test_scoped_resolver.py has tests that do exactly this: they build a scoped call and assert the resolver rewrites the target to the real node (e.g. Mailer::send → Mailer.php::Mailer.send, and the raw Mailer::send is gone), plus the Rust equivalent (Notifier::notify). There are 14 tests in there covering self::, namespaced calls, the multi-segment guard, idempotency, etc.