fix(typing): two real defects CI's type gate cannot see (#1791)

[lmeyerov]

Two real defects surfaced by #1791, plus the evidence that CI's type gate cannot see them.

The gate is off, not mis-pinned

The premise in #1791 was that CI pins an older pandas-stubs than the container. The opposite is true, and neither pin is the cause.

	mypy	pandas-stubs	result
CI, as it actually runs today	2.3.0 (uvx)	none	Success: no issues found in 324 source files
CI's own locked env (requirements/test-py3.12.lock)	2.1.0	3.0.3.260530	140 errors in 10 files
test-rapids-official:26.02-gfql-polars	1.19.1	3.0.0.260204	173 errors in 12 files

bin/typecheck.sh resolves MYPY_CMD to uvx mypy whenever uvx is on PATH — and CI puts it there (python -m pip install --upgrade pip uv). uvx runs mypy in an isolated ephemeral environment, so the --require-hashes lockfile install of pandas-stubs, types-requests, types-tqdm, types-defusedxml and the project's own deps is never visible to it. mypy.ini then has ignore_missing_imports = True for pandas.*, numpy.*, pyarrow.* etc., so every external symbol degrades to Any and the whole file set passes vacuously.

Two independent confirmations:

• CI's log installs mypy==2.1.0 from the lock, then reports mypy 2.3.0 (compiled: yes) at run time — a different interpreter entirely.
• mypy --no-site-packages reproduces CI's output byte for byte, including the file count: Success: no issues found in 324 source files.

bin/lint.sh has the same uvx ruff shape. Less harmful (ruff needs no imports and still reads pyproject.toml), but the locked ruff version is likewise bypassed, so a new ruff release can turn CI red with no repo change.

Full triage of all 140 in #1791.

What this PR fixes

Two bucket-B items — real code defects, worth fixing regardless of any stub decision.

1. graphviz: KeyError: None on a bound-but-unlabelled frame

g_to_pgv asserts _nodes/_edges are set, but not that the bindings are. g.nodes(df) with no node= leaves _node None while _nodes is set — and layout_graphviz/render_graphviz only call materialize_nodes() when _nodes is None, so that graph sails through and reaches row[None].

# master
g._node = None
RESULT: KeyError : None

# this PR
RESULT: ValueError : graphviz export requires a bound node id column;
        use g.nodes(df, node='id') or g.materialize_nodes()

Same for g.edges(df) with no source/destination. Bindings are now resolved once into non-Optional locals; validation moved ahead of the optional pygraphviz import so a caller error is not masked by a missing-backend error, and so it is testable without the optional dep. Two regression tests added — they fail on master, pass here, and are not skipped when pygraphviz is absent.

2. search_any: pat bound to both a module and a str in one scope

import pandas.api.types as pat     # line 95
...
    or bool(pat.is_bool_dtype(dt))  # line 100  -> module
...
pat, case = term, case_sensitive    # line 110  -> str
pred = Contains(pat, ...)           # line 118

Exactly the shadowed-name shape #1791 predicted. Ordering saves it today (module use strictly precedes the rebind), so this is a latent hazard rather than a live failure — one statement reorder from AttributeError: 'str' object has no attribute 'is_bool_dtype'. Module alias renamed to pd_types. No behaviour change, so no test; the mypy differential is the evidence.

Also corrects two dtype: object params to the engine-agnostic DType alias — they receive pandas/cuDF/polars dtypes, so object was both less accurate and on the repo's banned-annotation list.

No suppressions

Zero # type: ignore added, zero Any/cast/getattr/setattr/Dict[str, Any]/object. Every one of the 12 errors goes away because the code got more correct.

Gates

• mypy differential, CI's own pin (mypy 2.1.0 + pandas-stubs 3.0.3.260530): 140 → 128, zero new errors, diffed error-set to error-set. search_any.py 9→0, graphviz.py 3→0. Under the container stubs: 173 → 161.
• ruff (bin/ruff.sh, with pyproject.toml present): clean.
• graphistry/tests/compute with --gpus all: 9 failed, 7030 passed, 90 skipped, 15 xfailed — identical to the master baseline; all 9 are the pre-existing igraph/cudf/dask failures.
• graphistry/tests/plugins/test_graphviz.py: 2 passed, 9 skipped (pygraphviz absent); the 2 new tests run and pass.

All measured in graphistry/test-rapids-official:26.02-gfql-polars on dgx-spark.

Not in this PR

Turning the gate back on. It is a two-line change to bin/typecheck.sh, but it flips CI from green to 128 errors, so it needs its own staged PR — recommendation in #1791.

🤖 Generated with Claude Code

https://claude.ai/code/session_015YsqAZQLbqjSDrYSFz2GoB