fix(rust): 10 call-graph correctness bugs (edge recovery + phantom removal)

[gadievron]

Ten correctness bugs in the Rust call-graph parser, found by an adversarial bug-hunt over the parser diff and each proven with a git red/green + reachability receipt. Every fix either recovers a real edge/unit the parser was dropping or removes a phantom edge to an unrelated function; none trades reachability for precision or vice versa.

All changes are confined to libs/openant-core/parsers/rust/ — zero cross-parser impact. 102 tests pass (tests/parsers/rust + test_language_registry + test_parser_registry); each fix ships a regression test.

Reachability-recovering (parser was dropping real edges/units)

A — builtin-name filter dropped resolvable calls (call_graph_builder.py · _find_calls_in_code)
Problem: the RUST_BUILTINS filter deleted any call whose name is a common std method (get/parse/push/…) unless a same-file function shadowed it — even a typed, unambiguous cross-file method call. Its own docstring said the guard was for the unknown-receiver path only.
Solution: keep a builtin-named site when its name is a known repo function/method (repo_names); still drop pure std-only names. This restores the clause the Swift parser (the port source) keeps and the Rust port had dropped.
Verification: c.get() on &Cache → edge present after fix; x.unwrap().clone() with no repo namesake → still no edge (test_rust_builtin_filter.py).

C — multi-bound generic annihilated by an impl-less marker (_resolve_generic_bound_member)
Problem: B: Shape + Marker intersected all bound-trait conformer sets; a marker/blanket/derive/cross-crate trait has an empty trait_impls, so the intersection went empty and dropped every edge.
Solution: intersect only over bounds with ≥1 known conformer (an unseen conformer set is unconstrained, not empty). The real-intersection precision case is unchanged.
Verification: total<B: Shape + Marker> → both Shape conformers; test_rust_bound_intersection.py + the existing intersection-precision test both green.

H — same-named methods collided on func_id (_handle_function (func_id collision block))
Problem: func_id = file:qualified_name with no trait discriminator, so impl Display for P {fn fmt} + impl Debug for P {fn fmt} mapped to one id and the second overwrote the first — a whole unit vanished from extraction and reachability.
Solution: on an actual collision, append the trait to the id; the first occurrence keeps its plain id (class-name resolution and existing Type.method refs unchanged).
Verification: both fmt extracted (test_rust_method_collision.py).

I — impls on non-nominal Self were skipped (_handle_impl)
Problem: _bare_type_name returns None for u32/[u8;4]/(i32,i32)/(), and the guard skipped the whole impl block — every method lost.
Solution: broaden the impl Self-type collection to non-nominal kinds and fall back to the raw type text (test_rust_nonnominal_impl.py).

D — impl-level generic bounds were invisible (build_call_graph merge + _impl_generic_bounds)
Problem: only a fn's own generics were read, so impl<T: Shape> Holder<T> { fn m(&self, x: &T) } had no bound for T; x.area() fell to a bare lookup on the letter, which a blanket impl<U> Audit for U had poisoned with a pseudo-type T.area → phantom + dropped real edge.
Solution: record each impl's own generic bounds and merge them into method resolution. Recovers the conformer edge and removes the blanket phantom (test_rust_impl_level_bounds.py).

F — let-binding mis-typed by the constructor idiom (call_graph_builder.py, function_extractor.py)
Problem: let x = Type::assoc() assumed a Type return; let w = Factory::make() where make() -> Widget mis-typed w and dropped w.process().
Solution: record return types; type the binding by the callee's actual return type, falling back to the qualifier for Self (preserving Type::new()). Also extends to free-fn calls (test_rust_assoc_return_type.py, test_rust_freefn_return_type.py).

Phantom-removing (parser was fabricating edges)

B — macro scan harvested calls from string literals (_scan_macro_body)
panic!("call init() first") fabricated an edge to init. Blank string/char literals before the call-shaped scan; real calls outside literals still recovered (test_rust_macro_string_literal.py).

E — nested-fn calls bled into the outer fn (_find_calls_in_code AST walk)
A nested fn inner<B: Logger> had l.log() attributed to outer<B: Shape> and resolved under the wrong bound → phantom outer → Circle.log. Skip nested function_item bodies; the nested fn is its own unit, so no edge is lost (test_rust_nested_fn_scope.py).

The one balance-sensitive case (deliberately not relaxed)

G — F2/F3/F4 unknown-receiver gate. The gate declines when ≥2 same-named &self methods exist and the receiver type is unknown, to avoid a Dog → Cat.speak fan-out. That can black out a private inherent method. Two independent reviews (a reachability lens and an adversarial lens) agreed a blanket union re-introduces the fan-out the gate exists to kill (one cross-type phantom per call site). The gate is left intact; the blackout is instead recovered wherever the receiver type is inferable — the return-type inference in fix F now types let c = load() from load() -> Cfg, so those calls resolve precisely and never reach the gate. The residual truly-ambiguous case stays declined and is documented in the gate (call_graph_builder.py _resolve_unknown_receiver_method).

Precision guards (missed-impact sweep)

An adversarial sweep of the fixes above (three lenses: downstream/integration, scale/cost, adversarial) surfaced three narrow cases where the new return-type inference (F) and the builtin keep-clause (A) could emit a wrong-target phantom on compiling Rust. Three decline-guards close them; each declines only when the inference is genuinely unreliable, so recall versus baseline is unchanged (recall-control tests verify the legitimate cases still resolve).

• Duplicate type names. _assoc_return_type now requires a unique return type across same-named qualifiers (mirroring _free_fn_return_type). Two Factory types in different files with differing make() returns no longer resolve to an arbitrary one.
• Closure-shadowed free fn. let helper = || ...; let x = helper() now declines to type x from a same-named repo fn helper (the call is the closure). Only closure bindings shadow a call target — a non-callable rebind (let load = 5) does not, so it never blocks inference.
• External-import shadow. use std::thread::spawn with a repo fn spawn no longer links the bare spawn() to the repo function, unless the name is also repo-imported (use crate::..) in the same file. Same-file calls and genuine repo imports are unaffected.

Known bound: imports are tracked per file, not per lexical scope, so a file that imports the same name from both std and crate:: (in different inline modules) resolves the std-scope call to the repo namesake — a bounded over-approximation, preferred over dropping the legitimate repo edge.

Hygiene

J — thread decorators into unit metadata (parity with the Swift parser). K — add the missing Set import (latent NameError on future refactor).

Tests

$ PYTHONPATH=$PWD python -m pytest tests/parsers/rust tests/test_language_registry.py tests/test_parser_registry.py -q
102 passed in 0.08s

Each of the 10 fix commits carries a RED (pre-fix) → GREEN (post-fix) proof reproduced against its own parent commit via git worktrees; ruff check on the three changed source files passes.

Compatibility

No API or signature changes to public callers. Behavior change is confined to which call-graph edges/units the Rust parser emits: more real edges/units, fewer phantom edges. Call-graph symmetry (callGraph.keys() ⊆ functions.keys()) holds on every test. Reviewer note: recovering real edges raises reachability recall, which correctly increases the set of units downstream analysis considers (a recall/cost trade the project's doctrine resolves in favor of recall).

Author notes

• Q1 (which lines implement it): the anchors (by method, drift-proof): _find_calls_in_code repo_names keep-clause (A), _resolve_generic_bound_member non-empty intersection (C), _find_calls_in_code nested-fn skip (E), _free_fn_return_type/_assoc_return_type (F/G); _handle_function collision block (H), _handle_impl non-nominal fallback + _IMPL_SELF_EXTRA_KINDS (I), _impl_generic_bounds (D), the return_type field (F).
• Q2 (one concrete input previously wrong): impl Display for P {fn fmt} + impl Debug for P {fn fmt} — before, only one fmt existed in the graph (silent data loss); after, both do.
• Q3 (most likely pushback + answer): "does keeping more builtin-named sites add phantoms?" — no: the unknown-receiver builtin path still returns same-file matches only, and typed dispatch resolves precisely; verified that pure-std .unwrap()/.clone() with no repo namesake still create no edge.