fix(semantics): let a module-scope import alias take the name it rebinds

``action = "run"`` followed by ``import os as action`` left the scan
reporting ``values=['run'], unresolved=false`` while CPython bound the
module object. The gate that reads this treats a resolved set as stronger
evidence than unknown, so the shape produced false certainty rather than a
missed value.

The cause was one set answering two questions. At module scope an import is
how a producer names the owner module it qualifies against, so an import
there must not shadow that qualified binding -- which is why ``imported``
was left empty for ``<module>``. The same set was then reused for
``rebound_by_other_forms``, the check that asks whether a later binding
takes the name away from a plain assignment. Skipping module scope for the
first question silently skipped it for the second, and the superseded
literal survived as a complete set.

The two questions are now asked of two sets. ``import_bound`` collects the
names every import binds, in every scope, and feeds the rebinding check;
``imported`` stays empty at module scope and keeps feeding the shadow set,
so owner-module qualification is untouched. A name has to be both plainly
assigned and import-bound in the same scope for this to change anything,
which is exactly the counterexample and nothing else.

``MODULE_ASSIGNED_THEN_IMPORTED`` adds the module-scope variant to the
executable property test, which runs the snippet under CPython and compares
what it observes against what the scan reports. It fails on the previous
code with the module repr the scan omitted, and passes here.

Nothing on the tracked tree carries the shape: the drift smoke reports the
same unresolved_producer_sites=40 and the same blocker distribution
(annotation_only=5, argument_name_only=10, attribute_read=7, call_result=14,
other=1, unstable_local=3) as before the fix. ``tests/architecture`` 684
passed. Ruff reports the same four findings as main at lines this change
does not touch, and ``git diff --check`` is clean.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: song <22676124+songoow@users.noreply.github.com>

Author: songoow

loopx/semantics/python_production.py

@@ -470,11 +470,19 @@ def collect(node: ast.AST, loops: frozenset[int] = frozenset()) -> None:
         if scope == '<module>':
             nested_names -= local_owner_names | {owner.split('::')[1] for owner in call_arguments
                                                    if owner.split('::')[0] == source.path}
-        imported = set()
-        if scope != '<module>':
-            for node in nodes:
-                if isinstance(node, (ast.Import, ast.ImportFrom)):
-                    imported.update(alias.asname or alias.name.split('.')[0] for alias in node.names)
+        import_bound = set()
+        for node in nodes:
+            if isinstance(node, (ast.Import, ast.ImportFrom)):
+                import_bound.update(alias.asname or alias.name.split('.')[0] for alias in node.names)
+        # Two different questions are asked about the same import. At module
+        # scope an import is how a producer names the owner module it qualifies
+        # against, so it must not shadow that qualified binding -- which is why
+        # ``imported`` stays empty here. Whether it takes the name away from a
+        # plain assignment to that same name is asked separately, through
+        # ``rebound_by_other_forms``, and the answer there is yes in every
+        # scope: ``action = "run"`` followed by ``import os as action`` leaves
+        # the module object bound, not the literal.
+        imported = set() if scope == '<module>' else import_bound
         exception_targets = {n.name for n in nodes if isinstance(n, ast.ExceptHandler) and n.name}
         deleted = {n.id for n in nodes if isinstance(n, ast.Name) and isinstance(n.ctx, ast.Del)}
         shadows = set(assigned) | parameters | nested_names | imported | exception_targets | deleted
@@ -509,7 +517,7 @@ def collect(node: ast.AST, loops: frozenset[int] = frozenset()) -> None:
         # A later ``import as``, ``except as`` or nested ``def``/``class`` takes
         # the name away from the value the plain assignment gave it, so the
         # initializer is no longer the whole story for this scope.
-        rebound_by_other_forms = imported | exception_targets | nested_names
+        rebound_by_other_forms = import_bound | exception_targets | nested_names
         definitions = {name: values for name, values in plain.items()
                        if assigned[name] == len(values) and name not in parameters
                        and name not in declared and name not in deleted

tests/architecture/test_semantic_producer_soundness_regressions.py

@@ -97,6 +97,21 @@ def emit():
     return {"effective_action": str(action)}
 '''
 
+# The same rebinding at module scope, where the scan has a second reason to
+# look at imports: an import is how a producer names the owner module it
+# qualifies against, so an import may not shadow that qualified binding. It
+# must still take the name away from a plain assignment to the same name, and
+# for a while it did not -- the scan reported ``["run"]`` as a complete set
+# while CPython bound the module object.
+MODULE_ASSIGNED_THEN_IMPORTED = '''
+action = "run"
+import os as action
+RESULT = {"effective_action": str(action)}
+
+def emit():
+    return RESULT
+'''
+
 # ``except ... as action`` rebinds the name to the exception and unbinds it at
 # block exit, so the initializer above is not what the field can carry.
 ASSIGNED_THEN_CAUGHT = '''
@@ -155,6 +170,7 @@ def emit():
         pytest.param(MATCH_STAR, [["a"]], id="match-star-rebinds"),
         pytest.param(MATCH_MAPPING_REST, [{"k": 1, "z": 2}], id="match-mapping-rest-rebinds"),
         pytest.param(ASSIGNED_THEN_IMPORTED, [_NO_ARGUMENT], id="import-takes-the-name"),
+        pytest.param(MODULE_ASSIGNED_THEN_IMPORTED, [_NO_ARGUMENT], id="module-import-takes-the-name"),
         pytest.param(ASSIGNED_THEN_CAUGHT, [True], id="except-takes-the-name"),
         pytest.param(NESTED_NONLOCAL_REBIND, ["drop"], id="nested-scope-rebinds"),
         pytest.param(CONTAINER_ALIAS_WRITE, ["drop"], id="alias-writes-the-container"),