fix: preserve review queues and resolve PHP and Statamic dependencies

[eminos]

Summary

PHP dependency graphs miss same-namespace construction, static and type references, which makes referenced classes appear orphaned. Basename guesses can also link an imported trait alias or external class to an unrelated local declaration. Resolve native PHP class symbols in their namespace and alias scopes, linking only unique declarations in the scanned files. Preserve relative and absolute discovery keys, including Composer PSR-4 directories outside conventional roots.

Class-level trait composition was also being reported as an unused namespace import. Keep namespace-import captures in the unused-import query and collect actual trait dependencies through the native class graph.

The workflow fixes keep unassessed initial reviews visible after scores freeze, preserve queue priority when clustering, and deduplicate broader backlog IDs. A successful trusted import remains successful when its optional follow-up scan correctly defers to queued work. Consolidated small-cluster steps pass when their issue references cover every member. Temporary deferrals retain their reflected cluster assignments and pending steps.

Manual-cluster completion now reads persisted member statuses when findings are resolved in separate commands. Earlier fixed members recovered from execution history no longer keep the cluster active or focused. Retain historical IDs, honor current override assignments before historical lookup, and keep missing, open, or temporarily deferred members incomplete.

Stored strategy findings now use the normal issue-resolution path. Synthetic workflow cleanup previously printed success but left their state open, so the next queue immediately reconstructed them. Resolve the stored record, retain unrelated work and scan metadata, and remove the completed item from the queue.

Statamic projects now recognize the seven native application extension folders loaded by ExtensionServiceProvider. Require statamic/cms in Composer and honor the existing framework-detection switch. Ordinary service modules and the same folders in other PHP projects remain subject to orphan detection.

- Statamic native fieldtypes without ordinary imports -> false orphan findings
+ Composer-confirmed native extension registration -> framework entrypoints
- same-namespace new/type/static references -> zero incoming edges
+ exact scanned PHP declarations -> dependency and reverse edges
- aliased trait or external basename -> unrelated local dependency
+ namespace and alias binding -> exact target only
- class-level trait composition -> unused-import finding
+ trait composition -> dependency reference
- first scan with frozen scores -> another scan requested
+ first scan with frozen scores -> initial review remains visible
- review follow-up queue refusal -> successful import reported as failed
+ review follow-up queue refusal -> scan deferred, import succeeds
- clustered queue items -> groups prepended by creation order
+ clustered queue items -> group retains its first member's queue position
- separate resolutions with recovered history -> fixed cluster remains active and focused
+ persisted resolved statuses -> completed cluster, clear focus, retained history
- strategy resolution -> success printed while its stored record stays open
+ ordinary stored-work resolution -> fixed record, unchanged unrelated state, queue cleared
- consolidated steps or retained temporary deferrals -> false triage mismatch
+ complete issue coverage and retained memberships -> valid triage

Evidence

• Native PHP graph/orphan regressions reproduced missing references and guessed edges. Running the new PHP graph fixtures with the committed prior graph produces 30 failures and 12 passes. The patched fixtures cover namespace scopes, source-ordered simple/group aliases, shadowing, class/static/type/trait/attribute references, fully qualified registration, external and unscanned symbols, and unchanged file-key formats.

• Separate trait-composition regressions initially produced 2 failures and 1 pass. Both bare and fully qualified compositions now avoid unused-import findings while retaining graph edges. The control still reports a genuinely unused namespace import.

• The final graph, orphan, tree-sitter, and unused-import focused suite passes 277 tests with 1 skipped. Existing queue, lifecycle, scan reconciliation, review, and triage regressions remain in the full suite.

• Sequential resolution: Two ordinary plan resolve <id> --confirm --note "Implemented and verified the change with regression tests." calls previously fixed both stored findings but still reported one member left and kept the manual cluster active. Ten command/store and boundary regressions now verify completion, clear focus, retained historical membership, and an unchanged unrelated live cluster. Existing terminal dispositions remain closed; missing/open/temporarily deferred members remain incomplete. Explicit override assignments take precedence over old membership. Interrupted metadata is recognized even after overrides clear.

• Resolve, plan, reconciliation, and normalization focused suite: 713 passed. Both changed modules compile without writing bytecode.

• Final full root discovery passes 6924 tests with 18 skipped. All 36 Python files in the PR pass Ruff, and git diff --check passes.

• Stored strategy resolution: The normal public command regression first fails because the item remains open. The corrected plan/resolve/triage slice passes 1,234 tests. Verification on a disposable copy of the application health state fixes exactly three real strategy records while preserving all 468 unrelated records, scan metadata and every active application-state byte. The public persistence test retains an unrelated pending item in the queue.

• Native parser verification uses tree-sitter 0.25.2 and tree-sitter-language-pack 1.5.0 with a provisioned temporary parser cache.

• Statamic detection: All seven native folder regressions initially failed, while six controls passed. The patched framework/orphan/PHP graph slice passes 117 tests. An immutable accepted project mirror has 467 PHP files and 1,782 import edges. The prior detector reported three actual native fieldtypes; the patched detector reports zero orphan files and exempts no ordinary modules. A fresh isolated PHP scan confirms the result without altering active project health state or source bytes.

Merge Danger

Door: two-way

No state schema migration. Existing first-scan plans recover through ordinary queue reads and reconciliation.

Blast Radius: workflow and PHP detection

Queue phase selection, clustering priority, follow-up review scans, and small-cluster triage validation change at their existing boundaries. Actual scan failures and live-work scan guards keep their behavior. Enrichment quality checks and real disposition mismatches still apply.

PHP graph edges now require an exact scanned class declaration. Dynamic class strings and function/constant dependencies remain outside this class-symbol analysis; ambiguous and unresolved external declarations are omitted. Class/namespace aliases use PHP binding rules, and function/constant imports cannot create class aliases. The PHP unused-import query drops only trait-composition captures. Statamic folder recognition is limited to Composer-confirmed projects and respects detect_frameworks=False. Other language graphs and the PHP resolver are unchanged.