Tracking: PHP fork fixes — upstream PR status and the not-yet-opened queue

[filipechagas]

Umbrella tracker for the PHP work this fork exists for: what started it, what we found on the way, what is already proposed upstream, and what is still waiting on a dependency before it can be proposed.

Fork is at 0.9.39 (v8 @ 93657ef, fork PR #57 merged 2026-08-07). Everything in sections 1, 2 and 3a–3b has landed on the fork. Nothing has merged upstream yet — all seven upstream PRs are OPEN with no review decision (checked 2026-08-07).

---

1. The original issue and its fix

What	Where	State
Original upstream bug — PHP member/instance calls never resolve to calls edges; only ClassName::method() works	Graphify-Labs#1682 (filed by distribuidornexvia, 2026-07-05)	OPEN upstream
Fork tracking issue + slices	#1 (parent), #2 #3 #4 #5 #6 #7 (implementation slices), #11 #12 #13 #14 (defects found while building it)	all CLOSED
Fork PR	#17 feat/php-member-calls-1682	MERGED
Upstream PR	Graphify-Labs#2492 — fix(php): resolve instance-method calls edges from typed receivers (#1682)	OPEN

---

2. Everything else we found, and where it is upstream

Each row: fork issues → fork PR(s) that landed it → the upstream PR carrying it.

Fork issues	Fork PR(s)	Upstream PR	Upstream issue	Stacking
#19 (capture use FQN/alias metadata), #26 (group-form use function/use const leak)	#29, #30	2502	—	independent
#8, #10, #24, #33 (cross-language leakage: receiver-type indexes, raw-call ownership, import edges)	#28, #34	2503	—	independent
#15 (first-class callables → indirect_call), #9 (union/intersection receivers), #20 (qualified receiver types), #16/#21 (use-claim refusal)	#27, #25, #31, #32	2505	—	stacked on 2492 + 2502
#18 (spec), #22 (declared-FQN positive binding), #23 (incremental parity marker)	#35	2506	—	stacked on 2505
#37 (relational verbs hijack seed selection), #40, #41, #42, #43	#44, #45	2516	2507 — we filed it; maintainer CLOSED it 2026-08-07 after landing the relational-verb demotion in upstream 0.9.35. 2516 carries the two failure modes that survived that fix.	independent
#46 (node identity / stub shadowing) → #47 (mint interface/trait/enum nodes), #49 (find_node_ambiguity sourceless rivals), #39 (relative-scope callees)	#51	2536	—	independent (based on v8 @ 9f25a3a)

So: one upstream issue we filed (2507, closed), one pre-existing upstream issue we're fixing (1682, open), and seven upstream PRs open. The rest of the ~35 fork issues are our own decomposition and never needed an upstream ticket.

Suggested merge order for the maintainer, if asked: 2492 → 2502 → 2505 → 2506 (that chain must go in order); 2503, 2516, 2536 are independent and can go any time.

---

3. Fixes that have NOT been proposed upstream yet

3a. Landed on the fork (PR #51 / 0.9.38), deliberately held back — dependency-blocked

Both are named in 2536's body as "two sibling fixes deliberately not in this PR".

• Stub-shadow fix 2/4: resolve imports edges from their own target_fqn metadata (RC2 of #46) #48 — resolve imports edges from their own target_fqn metadata. Kills ~19k dangling import edges on the measured 46.4k-node corpus. Blocked on 2502, which introduces the use-statement metadata (target_fqn) this reads. 2536 estimates it at a ~60-line follow-up once 2502 merges. Fork commit 258d8e3.
• PHP: docblock-typed property assigned in the constructor body binds no receiver type — missing calls edge (co-cause 2 of #37) #38 — bind a PHP receiver from a constructor-body assignment of a typed param. The pre-promotion Laravel idiom (untyped property + @var docblock + typed ctor param assigned across). Blocked on the 2492 → 2505 → 2506 receiver-typing chain. Fork commit 293d57e.

3b. Landed on the fork (PR #57 / 0.9.39, MERGED 2026-08-07), not yet proposed upstream

All three issues CLOSED on the fork with acceptance + corpus-grading evidence (−1,341 fabricated calls edges, +2,398 legitimate, on the 46.6k-node api rebuild).

• PHP: global function calls (event()-family) bare-matching method nodes cross-file — needs a resolution policy #52 — a PHP function_call_expression never bare-matches a method — or, widened during review, a class-like node — cross-file. 848 fabricated inbound calls edges on one test method (GetProviderBillingEventsTest::event()) from Laravel's event() helper; the same family covered config() (−290), dispatch() (−186), request() (−15). Fork commit 9069df5. Portability checked against clean upstream/v8: the PHP call-subtype branch it hooks (extractors/engine.py:4373) and the candidate-filter helpers it uses (_lang_is_case_insensitive, global_label_to_nids_ci in extract.py) all already exist there → openable standalone, ahead of the whole chain. This is the tracker's next concrete action.
• serve: query/shortest_path endpoint resolution lacks the sourced-beats-sourceless rule that explain/affected now enforce (#49 gap) #54 — scored endpoint resolution prefers sourced nodes over sourceless stubs. Serve-side only, fork commit 630072e. Blocked on 2536 — it extends Stub-shadow fix 3/4: find_node_ambiguity must not collapse sourceless rivals into one group (RC3 of #46) #49's sourced-beats-sourceless rule to _score_nodes/_pick_scored_endpoint, which 2536's commit 2 introduces.
• PHP: _php_non_class_types receiver refusal is now redundant conservatism — recoverable member-call fan-in left unrealized #53 — lift the now-redundant _php_non_class_types receiver refusal. Fork commit 26f7b03; also fixes a full-vs-incremental parity hole by extending the declared-FQN pre-scan to all four declaration kinds. Blocked on 2536 (Stub-shadow fix 1/4: PHP interface/trait/enum declarations mint canonical nodes (RC1 of #46) #47 must give interface/trait/enum real nodes first) AND on the 2492→2505→2506 receiver chain — it touches extract.py, extractors/php.py, cli.py, watch.py in code none of which exists on clean upstream v8. Last in the queue. Note for the eventual port: this is a deliberate divergence today — upstream has no _php_non_class_types pre-scan at all.

3c. Investigated and written off — no code change anywhere

• PHP: pre-scan short-name conflict drop degrades toward a possible wrong edge, and #53 widened its trigger set #55 — pre-scan short-name conflict drop. Found in the adversarial re-review of PHP: _php_non_class_types receiver refusal is now redundant conservatism — recoverable member-call fan-in left unrealized #53. CLOSED wontfix 2026-08-07 with measured probes (evidence on the ticket): the precondition (a PSR-1-violating multi-namespace file reusing a short name) occurs zero times on the target corpus; the sketched wrong edge is unreachable end-to-end (the two same-short-name declarations sit in the type census, so the single-definition guard refuses regardless of the FQN map); worst reachable effect is an EXTRACTED→INFERRED confidence downgrade on inline-new. Explicitly written off per this tracker's definition of done — it does not ride upstream. Reopen only with a real-corpus wrong-edge repro.

3d. Triaged ready-for-agent on the fork, not implemented anywhere yet

• PHP: relative-scope calls (parent::/self::/static::) resolve to nothing — needs a base-class-aware resolution pass (#39 follow-up) #58 — base-class-aware resolution for parent::/self:: scoped calls (PHP: clearly-wrong calls edges in the repro neighborhood (.parent() --calls--> .setUp(); .handle() --calls--> test methods) — failure mode #3 evidence #39 follow-up, split out of the 2536 review). Triaged 2026-08-07 with a decided spec: resolve parent/self through the caller's in-corpus inherits chain, keep refusing static::, out-of-corpus base yields nothing, full/incremental parity tests mandatory. Recall left on the table today (parent::__construct()/parent::setUp() are ubiquitous), not a correctness bug. Extraction-side (version bump). Next fork fix cycle; composes with PHP: global function calls (event()-family) bare-matching method nodes cross-file — needs a resolution policy #52's filtering, so it rides upstream behind PHP: global function calls (event()-family) bare-matching method nodes cross-file — needs a resolution policy #52 eventually.
• Refactor (opportunistic): extract _php_member_receiver() out of walk_calls — readability, not a metric fix #59 — extract _php_member_receiver() out of walk_calls — deliberately not a tracker checkbox: triaged as a rider-only refactor (fold into the next slice editing that engine.py region, most likely PHP: relative-scope calls (parent::/self::/static::) resolve to nothing — needs a base-class-aware resolution pass (#39 follow-up) #58's; never its own PR, never its own upstream port).

---

Definition of done for this tracker

Close when: 2492, 2502, 2503, 2505, 2506, 2516 and 2536 have all merged (or been declined) upstream, and every checkbox in section 3 is either merged upstream or explicitly written off as fork-only (#55 already is).

Next concrete action, unblocked today: open #52 upstream standalone — it is the only unshipped item in section 3 with no upstream dependency. (The fork PR for 0.9.39 is done: #57, merged.)

[filipechagas]

Sync check + upstream nudge (2026-08-07)

Fork is not drifted: git rev-list --left-right --count upstream/v8...v8 → 0 59. Zero behind, 59 ahead. upstream/v8 HEAD is still 9f25a3a (2026-08-06 17:29, v0.9.35) — nothing new upstream since their Graphify-Labs#2507 fix, which we absorbed the same day in fork PR #45. Fork 0.9.38 vs upstream 0.9.35.

One deliberate divergence in shared code to remember at merge time: the 0.9.37 sync replaced upstream's hardcoded _RELATIONAL_INTENT_TERMS with a derived superset (graphify/serve.py:851-869) that absorbs all twelve of their words. Disclosed to the maintainer in 2516's description.

On 2507 being closed: upstream fixed 1 of the 3 failure modes we reported (the relational-verb demotion), and 0.9.35's caller/callers addition to _CONTEXT_HINTS introduced a regression our C3 repairs — "callers of X" went from 147 nodes / 3 callers buried (0.9.34) to 1 node / 0 of 3 delivered confidently (0.9.35). 2516 remains OPEN and is the live carrier for the other two modes; the only reviews on it are from graphify-labs[bot], not the maintainer.

Posted, so the closed issue does not imply the whole report is resolved:

• fix(query): skip covered-term seed guarantee; relax starving heuristic context filters (#2507) Graphify-Labs/graphify#2516 (comment) (status + the regression table)
• query: relational-intent verbs ("calls"/"uses") survive stopwording, prefix-match unrelated identifiers, and the #1445 per-term guarantee seats the junk match as a seed Graphify-Labs/graphify#2507 (comment) (forward pointer)

[filipechagas]

Upstream review round handled + corrections to this tracker (2026-08-07)

Review triage: 28 unresolved threads, 1 substantive

Audited every unresolved review thread across the seven upstream PRs. 2502 and 2503 have none. Of the other 28, 25 were automated coupling-metric flags (several posted twice) and 2 were the bot's "agreed by 2 of 2 members but NOT verified" class — one of those (2516 serve.py) was already handled in 234c5f0 and is marked outdated.

That left exactly one thread needing work: 2536 engine.py:584, "relative-scope PHP calls silently dropped", proposing that parent::/self::/static:: emit an unqualified callee instead of being refused. Declined, with measurements — reply:

• The suggested edit patches _php_name_text (engine.py:579-586), which the scoped_call_expression branch never calls — it reads its scope via _read_text at engine.py:4386. Applied literally it changes _php_collect_type_refs/_php_emit_base and leaves relative-scope calls untouched.
• Applied as intended and measured on a PHPUnit-shaped corpus: baseline 0 edges → 1 fabricated INFERRED edge (FooTest::prepare() → App\Models\ServiceCategory::setUp()). is_member_call=False means it reaches the shared normalized-label loop, whose index keys .setUp() and setUp() identically → sole candidate → unconditional bind. Same shape as #39, different label.
• #52's filter does not cover it — verified by building a third tree with #52 applied (still 1 edge). It is gated on the php_function_call marker, and #52's own comment says why it cannot widen to scoped calls.

Follow-ups opened: #58 (the real fix — base-class-aware resolution via inherits; the raw-call record carries no enclosing/base class today) and #59 (opportunistic _php_member_receiver() extraction from walk_calls; explicitly not worth amending an open PR for).

Coupling flags answered as one consolidated comment per PR (2492, 2505, 2506, 2516, 2536) rather than 25 near-identical thread replies. No code changed. The findings that made that defensible:

• _php_method_receiver_types and _resolve_php_member_calls do not exist at base 07b9143d — both introduced by 43cd7a2. No baseline, so no regression.
• resolve_seed: production fan-in unchanged at 1 (format_affected); all 5 added callers are tests in a new file. Its 8→10 callee bump is the extraction of _is_sourced/_prefer_sourced_node — the metric penalised a decomposition.
• walk_calls: the only genuine delta, 13→14 callees, difference is exactly one symbol, on a function already 577 lines at base (734 at head).

Corrections to the issue body above

Section 3b is stale — that work moved while this tracker was being written:

• Fork PR fix(php,serve): function calls never bind methods/classes; lift interface/enum receiver refusal; sourced-first endpoint scoring (#52/#53/#54) #57 is now open (fix/resolution-gaps-52-53-54 → v8, 0.9.39), so "no fork PR open for it yet" no longer holds.
• The branch was rewritten and pushed to origin. The SHAs cited above are dead. Current: ec4d97e (0.9.39 bump), 26f7b03 (PHP: _php_non_class_types receiver refusal is now redundant conservatism — recoverable member-call fan-in left unrealized #53), 630072e (serve: query/shortest_path endpoint resolution lacks the sourced-beats-sourceless rule that explain/affected now enforce (#49 gap) #54), 9069df5 (PHP: global function calls (event()-family) bare-matching method nodes cross-file — needs a resolution policy #52) — replacing 3c92270 / 941784a / 7e79824.
• PHP: global function calls (event()-family) bare-matching method nodes cross-file — needs a resolution policy #52's scope grew: its commit is now "PHP function-call sites never bare-match method or class nodes cross-file". The portability finding still holds — it remains the one section-3 item with no upstream dependency, openable standalone.
• PHP: pre-scan short-name conflict drop degrades toward a possible wrong edge, and #53 widened its trigger set #55 is now CLOSED (2026-08-07T18:09) — section 3c is resolved, and it presumably rides upstream behind PHP: _php_non_class_types receiver refusal is now redundant conservatism — recoverable member-call fan-in left unrealized #53 like the rest of the cycle.

[filipechagas]

Body updated for the 0.9.39 merge (2026-08-07)

What changed since the last correction comment:

• Header: fork is now 0.9.39 (v8 @ 93657ef); fork PR fix(php,serve): function calls never bind methods/classes; lift interface/enum receiver refusal; sourced-first endpoint scoring (#52/#53/#54) #57 MERGED (the correction above caught it while still open).
• Section 3b retitled from "no PR anywhere" to "landed via PR fix(php,serve): function calls never bind methods/classes; lift interface/enum receiver refusal; sourced-first endpoint scoring (#52/#53/#54) #57, not yet proposed upstream" — PHP: global function calls (event()-family) bare-matching method nodes cross-file — needs a resolution policy #52/PHP: _php_non_class_types receiver refusal is now redundant conservatism — recoverable member-call fan-in left unrealized #53/serve: query/shortest_path endpoint resolution lacks the sourced-beats-sourceless rule that explain/affected now enforce (#49 gap) #54 are all CLOSED on the fork with corpus-grading evidence and carry their final SHAs (9069df5 / 630072e / 26f7b03). PHP: global function calls (event()-family) bare-matching method nodes cross-file — needs a resolution policy #52's row now reflects the review-widened scope (methods and class-like nodes) and stays the next-action item: openable upstream standalone.
• Section 3c: PHP: pre-scan short-name conflict drop degrades toward a possible wrong edge, and #53 widened its trigger set #55 resolved the other way — the earlier "presumably rides upstream behind PHP: _php_non_class_types receiver refusal is now redundant conservatism — recoverable member-call fan-in left unrealized #53" is superseded. Triaged with end-to-end probes and closed wontfix: zero corpus occurrences of the precondition, the wrong edge is unreachable (census guard refuses), worst case is a confidence downgrade. Checked off as explicitly written off per the DoD.
• Definition-of-done and next-action lines updated accordingly: the only unblocked move is the standalone upstream PR for PHP: global function calls (event()-family) bare-matching method nodes cross-file — needs a resolution policy #52.

[filipechagas]

Consolidation executed (2026-08-11): upstream strategy changed — everything now rides one PR.

• Consolidated upstream issue: Graphify-Labs#2615 — superset of PHP: member/instance method calls never resolve to calls edges — only static Class::method() works Graphify-Labs/graphify#1682; all nine defect families with the corpus numbers.
• Consolidated upstream PR: Graphify-Labs#2617 — head consolidated/php-support-1682 = v8 @ 4492f9f (the 0.9.41 sync) plus one packaging commit a79ebe0: CHANGELOG rewritten for upstream (all fork-authored bullets under a single 0.9.40 (unreleased) section, sync bookkeeping dropped, three cross-reference phrases adjusted, two lift-notes added), pyproject 0.9.41 → 0.9.40 (one bump over upstream's 0.9.39; uv.lock already read 0.9.40), and the stale interface/enum/trait refusal sentence in docs/how-it-works.md corrected for PHP: _php_non_class_types receiver refusal is now redundant conservatism — recoverable member-call fan-in left unrealized #53.
• All seven upstream PRs are CLOSED with pointer comments: 2492, 2502, 2503, 2505, 2506, 2516, 2536. Their descriptions remain the per-fix review record.
• #2507 got a forward-pointer comment, since its live carrier (2516) is now closed.
• Section 3 status: Stub-shadow fix 2/4: resolve imports edges from their own target_fqn metadata (RC2 of #46) #48, PHP: docblock-typed property assigned in the constructor body binds no receiver type — missing calls edge (co-cause 2 of #37) #38, PHP: global function calls (event()-family) bare-matching method nodes cross-file — needs a resolution policy #52, PHP: _php_non_class_types receiver refusal is now redundant conservatism — recoverable member-call fan-in left unrealized #53, serve: query/shortest_path endpoint resolution lacks the sourced-beats-sourceless rule that explain/affected now enforce (#49 gap) #54 all ride fix(php): consolidated PHP support — member-call resolution, use-import handling, node identity, cross-language isolation, query seeding (#1682, #2615) Graphify-Labs/graphify#2617 — their blockers are inside the same PR, so nothing remains dependency-blocked. PHP: relative-scope calls (parent::/self::/static::) resolve to nothing — needs a base-class-aware resolution pass (#39 follow-up) #58 stays the only unshipped implementation item (spec'd, extraction-side); Refactor (opportunistic): extract _php_member_receiver() out of walk_calls — readability, not a metric fix #59 stays rider-only; PHP: pre-scan short-name conflict drop degrades toward a possible wrong edge, and #53 widened its trigger set #55 stays written off.
• Suite on the PR branch: 4,478 passed / 42 skipped / 0 failed with the openai extra installed; the known labeling flake passed in this run and in isolation.

Definition of done, superseded: read the old list ('2492…2536 merged or declined') as 'Graphify-Labs#2617 merged or declined', plus the standing section-3 rule (every item merged upstream, riding Graphify-Labs#2617, or written off). Next concrete action: respond to maintainer review on Graphify-Labs#2617.