fix(php): keep proven vendor types out of project name fallbacks - #2520

Resolve symbols declared in __init__.py under their package while retaining
the raw module identity for file and top-level caller nodes. Carry explicit
language through registry callers, select Python package imports, preserve
long exact names, and report scope allocation failures without partial output.

Signed-off-by: Martin Vogel <[email protected]>

Use tracked zeroed storage for the parallel LSP failure array and
release it with the matching memory class after worker joins.
Share import-filter failure cleanup without changing fallback state.
Keep existing raw-allocation allowances unchanged.

Signed-off-by: Martin Vogel <[email protected]>

cbm_scope_lookup_local() returns the frame binding (CBMVarBinding), not
its type, so passing it to pylsp_init_named_type() did not compile
(-Werror=incompatible-pointer-types). Add pylsp_local_type(), which
returns the binding's type field or NULL when the name is unbound, and
assert on that type as the test intended.

Signed-off-by: Martin Vogel <[email protected]>

…alk call

The cross and register scope-failure cases defined S and called s.m()
inside pkg/__init__.py. The per-file LSP already resolves those calls,
and the parallel driver skips the cross-file walk for a file whose call
sites are all resolved, so CBM_TEST_PY_LSP_SCOPE_FAIL_STAGE=cross and
=register never fired on the parallel path and both parallel cases saw
no file error.

For those two stages, move S into memo_def.py (imported by
pkg/__init__.py) so run() holds calls only the cross walk resolves, and
count that module's File node. The raw stage keeps its single-file
fixture; the error assertions are unchanged.

With the corrected fixture all eight package-scope pipeline cases pass;
removing the CBM_PY_LSP_SCOPE_ERROR capture in pass_parallel.c turns
exactly the two parallel cross/register cases RED again.

Signed-off-by: Martin Vogel <[email protected]>

…vice_edge

The call now carries both the route mount and the caller language;
wrap its arguments the way clang-format lays them out so lint-format
passes. No code change.

Signed-off-by: Martin Vogel <[email protected]>

Signed-off-by: Martin Vogel <[email protected]>

Use tracked allocations for binding arrays and namespace keys, share
IMPORTS cleanup, and consolidate namespace construction failure cleanup.
Preserve libc ownership for existing FQN values and JSON writer buffers.
Remove the redundant condition in binding validation.

Signed-off-by: Martin Vogel <[email protected]>

collect_use_declaration dropped the group prefix of `use A\B\{C as D}`
and read the function/const keyword only from the declaration, so a
grouped alias mapped to the bare `C` with the declaration's kind. The
cross-file LSP then could not recognise a grouped vendor class import as
external, and a grouped `function`/`const` alias was registered as a
class. Prefix each grouped clause with the group namespace and take the
keyword from the clause when the declaration has none, mirroring
emit_php_use_decl in extract_imports.c.

Refs #1186

Signed-off-by: Martin Vogel <[email protected]>

When a cross-file lsp_cross_crate or php_external_receiver row
supersedes the per-file records of its exact parser occurrence, every
matching record was rewritten in place. Two earlier records at one
occurrence therefore became two identical rows, which the dedup table
only indexes and never collapses, so a single call site carried a
duplicated resolution. Rewrite the first matching record and drop the
others at that occurrence; records at other occurrences are untouched.

Refs #1186

Signed-off-by: Martin Vogel <[email protected]>

Two gaps let a call on a vendor class escape the #1186 evidence:

- A vendor class the PHP LSP knows from its seeded library data (for
  example GuzzleHttp.Client) resolved as php_static_resolved or
  php_method_typed. Its target has no graph node either, but without the
  php_external_receiver strategy the pipeline fell through to a
  name-only registry binding. Methods found on a class reached through a
  vendor `use` now carry php_external_receiver as well.

- A vendor call skips the registry, and the extractor names a scoped
  call by its method alone (only a literal `Route::` scope is kept), so
  `GuzzleClient::get('/x')` reached the route-verb fallback and became a
  route registration instead of an HTTP call. When the callee text names
  no service, the service patterns now also see the vendor method the
  LSP proved (`GuzzleHttp.Client.get`, `Kafka.Producer.publish`), in
  both the sequential and the parallel pass.

Refs #1186

Signed-off-by: Martin Vogel <[email protected]>

The vendor-types test never got past its extraction precondition, so
two of its assertions had never run against production:

- The precondition looked for the import alias in the callee text of
  `GuzzleClient::get` and `KafkaProducer::publish`. The extractor names
  a scoped call by its method alone and keeps only a literal `Route::`
  scope (#952). The aliased scope is now proven on the occurrence text
  at the call's site span, which identifies the same call just as
  strictly.

- The sequential/parallel parity fingerprint hashed the HTTP_CALLS and
  ASYNC_CALLS properties whole. The parallel emitter appends the call's
  "args" member last; the sequential pass leaves route/service
  properties without it by design (calls_emit_edge). Those two edge
  types are now compared with only that trailing member removed; their
  type, endpoints and every other property must still agree.

Refs #1186

Signed-off-by: Martin Vogel <[email protected]>

The parallel pass appends the call's ,"args":[...] member to every
HTTP_CALLS and ASYNC_CALLS edge (finalize_and_emit). The sequential pass
appended args to CALLS only, so the same service call produced
different edge properties depending on which pass indexed the repo, and
create_data_flows had no caller_args for small (sequential) repos.

Split the args-and-closing-brace step out of finalize_and_emit as
cbm_pipeline_close_call_props and let the sequential
emit_http_async_edge build its props in the same CBM_SZ_2K buffer and
finish them with that function. Field order, expression sanitizing,
escaping and truncation are therefore one implementation; CALLS edges
and their "line" member are unchanged in both passes.

Refs #1186

Signed-off-by: Martin Vogel <[email protected]>

Both passes now emit byte-identical HTTP_CALLS and ASYNC_CALLS
properties, so the vendor-types parity fingerprint hashes them whole
again instead of trimming the "args" member. The precondition change
from the previous fixture correction stays.

Refs #1186

Signed-off-by: Martin Vogel <[email protected]>