PHP: relative-scope calls (parent::/self::/static::) resolve to nothing — needs a base-class-aware resolution pass (#39 follow-up)

[filipechagas]

Split out from the review of upstream Graphify-Labs#2536, where an automated reviewer objected that #39's refusal drops information (thread). The objection to the proposed alternative was declined with measurements (below), but the underlying gap it points at is real and currently untracked.

Current behaviour (correct, but incomplete)

#39 / 075038e refuses parent, self and static as PHP scoped-call callee names (graphify/extractors/engine.py:4382-4394, gated on _PHP_RELATIVE_SCOPE_NAMES). Before it, the handler took the scope text as the callee, so every parent::setUp() emitted a raw call named parent, and the cross-file label pass bound them all to whatever ->parent() accessor existed — 1,698 fabricated calls edges onto ServiceCategory::parent() on the pinned 46.4k-node corpus.

The refusal removes the fabricated edges and invents no replacement. So parent::__construct(), parent::setUp(), self::helper() and static::make() currently produce no calls edge at all, with no diagnostic counter.

Why the obvious alternative does not work

Emitting the method name as an unqualified callee instead — the reviewer's suggestion — was implemented and measured against a PHPUnit-shaped corpus (base class out of corpus, one unrelated in-corpus setUp):

• baseline: 0 edges
• unqualified-callee variant: 1 fabricated INFERRED edge, FooTest::prepare() → App\Models\ServiceCategory::setUp()

The raw call carries is_member_call=False, so it is skipped by neither the member-call guard nor the typed resolver, and reaches the shared normalized-label loop whose index keys .setUp() and setUp() identically → sole candidate → unconditional bind. #52's candidate filter does not cover it (verified by building a tree with #52 applied — still 1 edge): that filter is gated on the php_function_call marker, and #52's own comment explains it cannot be widened to scoped calls, because a scoped_call is also not a member call.

What the real fix needs

The rc_entry built for a raw call carries caller, callee, receiver, receiver type and language — no enclosing class and no base class. The information that would answer "which class does parent denote here" exists in the graph as inherits edges (minted by _php_emit_base), but the shared bare-label loop never consults them.

So a correct fix is a resolution-pass change, not an extractor tweak:

1. Carry the enclosing class on the raw call (or recover it from caller_nid).
2. For a relative scope, resolve it against the caller's own inherits edge — parent → the resolved base class, self/static → the enclosing class itself (late static binding means static is strictly a guess for anything but the declaring class; refusing static while resolving parent/self is a defensible first cut).
3. Look the method up on that resolved type, and refuse when the base class is out of corpus (the PHPUnit case) rather than falling back to a name match.

Point 3 is the load-bearing one: an out-of-corpus base class must yield nothing, or this reintroduces exactly the fabricated-edge shape it replaces.

Notes

• Sequencing: composes with #52's candidate-filtering, which lives on fix/resolution-gaps-52-53-54. Worth landing after that branch merges to v8.
• Extraction-side, so it will need a version bump to roll the AST cache namespace.
• Blast radius if fixed: parent::__construct() and parent::setUp() are ubiquitous in a Laravel/PHPUnit corpus, so this is recall left on the table, not a correctness bug.

[filipechagas]

Triage decision (2026-08-07): valid, accepted — ready for the next fix cycle

The sequencing blocker named in the body is cleared: fix/resolution-gaps-52-53-54 merged to v8 today (fork PR #57, 0.9.39). Fork-side anchors (the body cites upstream-PR-head line numbers): the #39 refusal lives in the scoped_call_expression handler at graphify/extractors/engine.py:5058-5070, gated on _PHP_NON_CONCRETE_TYPE_NAMES (engine.py:752); inherits edges are minted as described.

Decided spec:

1. Scope: resolve parent:: and self::; keep refusing static:: — late static binding makes it a guess for anything but the declaring class, and the refusal discipline (a wrong answer is worse than no answer) is repo-wide precedent.
2. Mechanism: a resolution-pass change, per the body's sketch. Carry the enclosing class on the raw call (or recover it from caller_nid — implementer's choice; note the enclosing-type map _resolve_php_member_calls already builds). parent resolves through the enclosing class's inherits edge; self is the enclosing class itself. Method lookup walks the in-corpus inherits chain (PHP resolves inherited methods up the hierarchy) and refuses at the first out-of-corpus, ambiguous, or missing hop. The load-bearing criterion stands as written: an out-of-corpus base (the PHPUnit TestCase case) yields nothing — that is the exact fabricated-edge shape PHP: clearly-wrong calls edges in the repro neighborhood (.parent() --calls--> .setUp(); .handle() --calls--> test methods) — failure mode #3 evidence #39 killed and it must not return. Trait-provided methods (self::helper() via use SomeTrait): refuse in this cut; note it in the issue if measured recall makes it worth a follow-up.
3. Acceptance criteria (red-first):
   • class B { protected function boot(): void {} } class A extends B { public function init(): void { parent::boot(); } } (two files) → calls edge onto B::boot() (currently nothing — red first).
   • self::helper() with helper() on the enclosing class → edge to it.
   • Inherited lookup: A extends B, B extends C, A calls parent::foo(), foo() declared only on C → edge to C::foo(); same fixture with C replaced by an out-of-corpus name → no edge.
   • PHPUnit shape: class FooTest extends TestCase (vendor, out of corpus), parent::setUp(), plus an unrelated in-corpus setUp() decoy → no edge to the decoy (the body's measured refutation of the unqualified-callee variant becomes a pinned regression test).
   • static::make() → still refused.
   • Full/incremental parity (the PHP: _php_non_class_types receiver refusal is now redundant conservatism — recoverable member-call fan-in left unrealized #53 lesson — its round-1 major was exactly a full-vs-incremental divergence): every positive and negative criterion above asserted in _full_then_incremental shape, with the base class arriving via resolution_context_nodes/_edges.
4. Release note: extraction-side → needs the next version bump to roll the AST cache namespace.

Relabeling ready-for-agent. One heads-up for whoever picks it up: #59 (extract _php_member_receiver() out of walk_calls) is spec'd to ride along with the next slice that edits that region of engine.py — if this fix's step 1 touches walk_calls' rc_entry construction, take #59 as a rider in the same slice (separate commit not required; see #59's triage).