gitnexus 1.6.11-rc.8 → 1.6.11

package/dist/core/lbug/csv-generator.js

@@ -100,6 +100,15 @@ export const escapeCSVNumber = (value, defaultValue = -1) => {
         return String(defaultValue);
     return String(value);
 };
+/**
+ * A numeric column that may legitimately have NO value.
+ *
+ * `escapeCSVNumber` substitutes a sentinel (-1) for absence, which is right
+ * where every row has a span and wrong where absence is the fact being
+ * recorded. An empty field is loaded as NULL by COPY, so the column can say
+ * "there is no line here" instead of pointing at line -1.
+ */
+export const escapeCSVNullableNumber = (value) => typeof value === 'number' && Number.isFinite(value) ? String(value) : '';
 const formatCSVStringArray = (value) => {
     const items = Array.isArray(value)
         ? value.filter((item) => typeof item === 'string')
@@ -152,14 +161,15 @@ export const isBinaryContent = (content) => {
     }
     return nonPrintable / end > 0.1;
 };
+const EMPTY_PREPARED = { content: '', lines: [''], isBinary: false };
 /**
  * LRU content cache — avoids re-reading the same source file for every
  * symbol defined in it. Sized generously so most files stay cached during
- * the single-pass node iteration.
+ * the single-pass node iteration. Insertion order on the Map is LRU
+ * (delete+set on touch).
  */
 class FileContentCache {
     cache = new Map();
-    accessOrder = [];
     maxSize;
     repoPath;
     constructor(repoPath, maxSize = 3000) {
@@ -168,36 +178,36 @@ class FileContentCache {
     }
     async get(relativePath) {
         if (!relativePath)
-            return '';
+            return EMPTY_PREPARED;
         const cached = this.cache.get(relativePath);
         if (cached !== undefined) {
-            // Move to end of accessOrder (LRU promotion)
-            const idx = this.accessOrder.indexOf(relativePath);
-            if (idx !== -1) {
-                this.accessOrder.splice(idx, 1);
-                this.accessOrder.push(relativePath);
-            }
+            this.cache.delete(relativePath);
+            this.cache.set(relativePath, cached);
             return cached;
         }
         try {
             const fullPath = path.join(this.repoPath, relativePath);
             const content = await fs.readFile(fullPath, 'utf-8');
-            this.set(relativePath, content);
-            return content;
+            const prepared = {
+                content,
+                lines: content.split('\n'),
+                isBinary: isBinaryContent(content),
+            };
+            this.set(relativePath, prepared);
+            return prepared;
         }
         catch {
-            this.set(relativePath, '');
-            return '';
+            this.set(relativePath, EMPTY_PREPARED);
+            return EMPTY_PREPARED;
         }
     }
     set(key, value) {
-        if (this.cache.size >= this.maxSize) {
-            const oldest = this.accessOrder.shift();
-            if (oldest)
+        if (this.cache.size >= this.maxSize && !this.cache.has(key)) {
+            const oldest = this.cache.keys().next().value;
+            if (oldest !== undefined)
                 this.cache.delete(oldest);
         }
         this.cache.set(key, value);
-        this.accessOrder.push(key);
     }
 }
 /**
@@ -247,12 +257,13 @@ const formatFtsDescription = (description) => isBinaryContent(description) ? ''
 const EXACT_SYMBOL_CONTENT_LABELS = SYMBOL_NODE_LABELS;
 const extractContent = async (node, contentCache) => {
     const filePath = node.properties.filePath;
-    const content = await contentCache.get(filePath);
+    const prepared = await contentCache.get(filePath);
+    const content = prepared.content;
     if (!content)
         return '';
     if (node.label === 'Folder')
         return '';
-    if (isBinaryContent(content))
+    if (prepared.isBinary)
         return '[Binary file - content not stored]';
     // File content is stored in full — intentionally NOT length-capped here, so
     // text past the old 10KB cutoff stays FTS-searchable (#2317). It is already
@@ -266,7 +277,7 @@ const extractContent = async (node, contentCache) => {
     const endLine = node.properties.endLine;
     if (startLine === undefined || endLine === undefined)
         return '';
-    const lines = content.split('\n');
+    const lines = prepared.lines;
     const exactSymbolContent = EXACT_SYMBOL_CONTENT_LABELS.has(node.label);
     const start = Math.max(0, exactSymbolContent ? startLine : startLine - 2);
     const end = Math.min(lines.length - 1, exactSymbolContent ? endLine : endLine + 2);
@@ -340,7 +351,7 @@ class BufferedCSVWriter {
 // ============================================================================
 /** Canonical relationship CSV header — shared by the emit pass and the
  * `splitRelCsvByLabelPair` differential oracle. */
-export const REL_CSV_HEADER = 'from,to,type,confidence,reason,step';
+export const REL_CSV_HEADER = 'from,to,type,confidence,reason,step,staticGated';
 /** Build the escaped CSV row (no trailing newline) for one relationship.
  * Single source of the relationship row bytes — used by the emit pass and by
  * the byte-identity differential test that feeds the legacy split oracle. */
@@ -351,6 +362,10 @@ export const buildRelRow = (rel) => [
     escapeCSVNumber(rel.confidence, 1.0),
     escapeCSVField(rel.reason),
     escapeCSVNumber(rel.step, 0),
+    // `staticGated` persists as 0/1 (LadybugDB BOOLEAN COPY accepts both).
+    // Every edge that does not carry the flag writes 0, so readers treat
+    // absence and `false` identically.
+    rel.staticGated === true ? '1' : '0',
 ].join(',');
 /** Canonical BasicBlock node CSV header — taint/PDG substrate (issue #2080).
  * No `name` column; blocks are identified by id + source span. Shared by the
@@ -428,9 +443,11 @@ export const streamAllCSVsToDisk = async (graph, repoPath, csvDir, onNodePhaseCo
         // Section nodes have an extra 'level' column
         const sectionWriter = new BufferedCSVWriter(path.join(csvDir, 'section.csv'), 'id,name,filePath,startLine,endLine,level,content,description');
         // Route nodes for API endpoint mapping
-        const routeWriter = new BufferedCSVWriter(path.join(csvDir, 'route.csv'), 'id,name,filePath,responseKeys,errorKeys,middleware,method,handlerSymbolId');
+        const routeWriter = new BufferedCSVWriter(path.join(csvDir, 'route.csv'), 'id,name,filePath,responseKeys,errorKeys,middleware,method,handlerSymbolId,runtimeConfirmed,runtimeSource,runtimeStatus');
         // Tool nodes for MCP tool definitions
         const toolWriter = new BufferedCSVWriter(path.join(csvDir, 'tool.csv'), 'id,name,filePath,description');
+        // Destination nodes for async messaging (Kafka topics, Rabbit exchanges, …)
+        const destinationWriter = new BufferedCSVWriter(path.join(csvDir, 'destination.csv'), 'id,name,filePath,startLine,endLine,address,broker,resolution,configKey,configDefault,description');
         // BasicBlock nodes — taint/PDG substrate (issue #2080). No `name` column;
         // blocks are identified by id + source span. Emitted by no phase yet.
         const basicBlockWriter = new BufferedCSVWriter(path.join(csvDir, 'basicblock.csv'), BASICBLOCK_CSV_HEADER);
@@ -578,6 +595,9 @@ export const streamAllCSVsToDisk = async (graph, repoPath, csvDir, onNodePhaseCo
                         escapeCSVField(middlewareStr),
                         escapeCSVField(String(node.properties.method ?? '')),
                         escapeCSVField(String(node.properties.handlerSymbolId ?? '')),
+                        node.properties.runtimeConfirmed === true ? 'true' : 'false',
+                        escapeCSVField(String(node.properties.runtimeSource ?? '')),
+                        escapeCSVField(String(node.properties.runtimeStatus ?? '')),
                     ].join(','));
                     break;
                 }
@@ -589,6 +609,48 @@ export const streamAllCSVsToDisk = async (graph, repoPath, csvDir, onNodePhaseCo
                         escapeCSVField(formatFtsDescription(node.properties.description || '')),
                     ].join(','));
                     break;
+                case 'Destination':
+                    // `address` is the cross-service join key and is written as an EMPTY
+                    // field for an unresolved destination, which COPY loads as NULL —
+                    // mirroring the in-memory rule that the property is absent there, and
+                    // measured on a real index (`spring-destinations-lbug.test.ts` asserts
+                    // both the NULL and the zero-false-join it buys). Writing the
+                    // placeholder text into this column instead would make two services
+                    // that merely both wrote `${app.topic}` join on it, reintroducing
+                    // below the database line the exact false connection the
+                    // location-based node id prevents above it. The placeholder is
+                    // carried by `name`, which nothing joins on.
+                    //
+                    // The line columns are written EMPTY (→ NULL) rather than defaulted
+                    // to -1 when the node carries none. A resolved destination has no
+                    // location at all — that is the point of the `filePath` rule two
+                    // fields to the left — and a row saying `filePath` NULL but
+                    // `startLine` -1 makes the two columns disagree about one fact and
+                    // renders as "line -1" in the UI.
+                    //
+                    // `broker` is written for every destination, resolved or not. It is
+                    // part of the resolved node's IDENTITY — the id is minted from
+                    // `(broker, address)` — so a reader who joins on `address` alone and
+                    // sees two rows needs this column to tell them apart, not merely to
+                    // decorate them. Every column named in this row list must also be
+                    // named in DESTINATION_SCHEMA and in the COPY statement in
+                    // `lbug-adapter.ts`; a property the phase writes but those two omit is
+                    // dropped at the database boundary without a warning, and the query
+                    // that reads it back raises a binder error instead.
+                    pending = destinationWriter.addRow([
+                        escapeCSVField(node.id),
+                        escapeCSVField(node.properties.name || ''),
+                        escapeCSVField(node.properties.filePath || ''),
+                        escapeCSVNullableNumber(node.properties.startLine),
+                        escapeCSVNullableNumber(node.properties.endLine),
+                        escapeCSVField(String(node.properties.address ?? '')),
+                        escapeCSVField(String(node.properties.broker ?? '')),
+                        escapeCSVField(String(node.properties.resolution ?? '')),
+                        escapeCSVField(String(node.properties.configKey ?? '')),
+                        escapeCSVField(String(node.properties.configDefault ?? '')),
+                        escapeCSVField(formatFtsDescription(node.properties.description || '')),
+                    ].join(','));
+                    break;
                 case 'BasicBlock':
                     pending = basicBlockWriter.addRow(buildBasicBlockRow(node));
                     break;
@@ -669,6 +731,13 @@ export const streamAllCSVsToDisk = async (graph, repoPath, csvDir, onNodePhaseCo
             sectionWriter,
             routeWriter,
             toolWriter,
+            // A writer missing from THIS list is not a loud failure. `finish()` is
+            // what flushes the buffered rows, while the header is written eagerly and
+            // `.rows` counts rows as they are added — so an unflushed writer still
+            // produces a valid, header-only CSV and a manifest entry claiming rows.
+            // The COPY then succeeds and loads nothing. Adding a node table means
+            // adding it here as well as to the switch and the manifest.
+            destinationWriter,
             basicBlockWriter,
             ...multiLangWriters.values(),
         ];
@@ -692,6 +761,7 @@ export const streamAllCSVsToDisk = async (graph, repoPath, csvDir, onNodePhaseCo
             ['Section', sectionWriter],
             ['Route', routeWriter],
             ['Tool', toolWriter],
+            ['Destination', destinationWriter],
             ['BasicBlock', basicBlockWriter],
             ...Array.from(multiLangWriters.entries()).map(([name, w]) => [name, w]),
         ];

package/dist/core/lbug/graph-emit-sink.d.ts

@@ -19,12 +19,13 @@ import type { KnowledgeGraph } from '../graph/types.js';
  *   METHOD_IMPLEMENTS    - mro-processor
  *   DEFINES              - local-symbol-pruner's isFileDefinesEdge test
  *   INJECTS              - di phase fan-out
+ *   HANDLES_ROUTE        - Spring Actuator runtime handler conflict detection
  *
  * Deliberately NOT retained: STEP_IN_PROCESS / ENTRY_POINT_OF / MEMBER_OF
  * (written only by the `processes` / `communities` phases, which the streaming
  * flag disables), TAINT_PATH / CALL_SUMMARY (their phases are likewise gated
- * off under the flag), and HANDLES_ROUTE / HANDLES_TOOL (written by
- * `routes`/`tools`, never read back mid-pipeline).
+ * off under the flag), and HANDLES_TOOL (written by `tools`, never read back
+ * mid-pipeline).
  *
  * Adding a relationship type that a phase reads back WITHOUT adding it here is
  * a silent-wrong-graph bug, not a crash. The differential round-trip test cannot:

package/dist/core/lbug/graph-emit-sink.js

@@ -117,12 +117,13 @@ import { PDG_EDGE_TYPES } from './pdg-emit-sink.js';
  *   METHOD_IMPLEMENTS    - mro-processor
  *   DEFINES              - local-symbol-pruner's isFileDefinesEdge test
  *   INJECTS              - di phase fan-out
+ *   HANDLES_ROUTE        - Spring Actuator runtime handler conflict detection
  *
  * Deliberately NOT retained: STEP_IN_PROCESS / ENTRY_POINT_OF / MEMBER_OF
  * (written only by the `processes` / `communities` phases, which the streaming
  * flag disables), TAINT_PATH / CALL_SUMMARY (their phases are likewise gated
- * off under the flag), and HANDLES_ROUTE / HANDLES_TOOL (written by
- * `routes`/`tools`, never read back mid-pipeline).
+ * off under the flag), and HANDLES_TOOL (written by `tools`, never read back
+ * mid-pipeline).
  *
  * Adding a relationship type that a phase reads back WITHOUT adding it here is
  * a silent-wrong-graph bug, not a crash. The differential round-trip test cannot:
@@ -142,6 +143,7 @@ export const RETAINED_REL_TYPES = new Set([
     'METHOD_IMPLEMENTS',
     'DEFINES',
     'INJECTS',
+    'HANDLES_ROUTE',
     // springAopInheritance reads direct behavior evidence after MRO.
     'ADVISED_BY',
 ]);

package/dist/core/lbug/lbug-adapter.d.ts

@@ -352,11 +352,19 @@ export declare const deleteNodesForFile: (filePath: string, dbPath?: string) =>
 /**
  * Chunk size for {@link deleteNodesForFiles}. 200 paths keeps each
  * statement ~13KB (well inside parser limits) while a ~700-file write set
- * still collapses from ~13,000 statements to 124: 31 statements per chunk
- * (1 CodeEmbedding join-delete + 30 filePath-bearing node tables — the
- * 32-table NODE_TABLES roster minus Community/Process) × 4 chunks. The
+ * still collapses from ~13,000 statements to 128: 32 statements per chunk
+ * (1 CodeEmbedding join-delete + 31 filePath-bearing node tables — the
+ * 33-table NODE_TABLES roster minus Community/Process) × 4 chunks. The
  * original "~40" claim under-counted the per-chunk statement fan-out
  * (tri-review 4669518496 accuracy sweep).
+ *
+ * `Destination` is counted in that 31 because the table IS visited, but a
+ * RESOLVED destination stores no `filePath` and so never matches the
+ * predicate — deliberately, because it is shared across files. See the node
+ * property block in `pipeline-phases/spring-destinations.ts` for why deleting
+ * one here would cut edges belonging to files outside the write set. Because
+ * this pass therefore cannot maintain the layer, {@link deleteAllDestinations}
+ * clears it separately and `extractChangedSubgraph` re-includes it whole.
  */
 export declare const DELETE_FILES_CHUNK_SIZE = 200;
 /**
@@ -377,15 +385,77 @@ export declare const DELETE_FILES_CHUNK_SIZE = 200;
  * EMBEDDING_SCHEMA cannot own embedding rows, so skipping that one
  * statement is sound, while failing would brick every incremental run on
  * such a DB until `--force`. Statement count per chunk is unchanged by the
- * multi-label join: 1 embedding join-delete + 30 node-table deletes = 31
- * (the rejected per-label fallback shape would have been 19 + 30 = 49).
+ * multi-label join: 1 embedding join-delete + 31 node-table deletes = 32
+ * (the rejected per-label fallback shape would have been 19 + 31 = 50).
+ * The 31 is the filePath-bearing half of the 33-table NODE_TABLES roster and
+ * moves whenever a node table is added — it went up by one when `Destination`
+ * joined, and the twin note on DELETE_FILES_CHUNK_SIZE has to move with it.
  * Singleton-connection only: the analyze writeback owns the write lock,
  * and `queryAndDrain` routes through `withConnLock` for it (the WAL
  * checkpoint driver is live during this).
  */
 export declare const deleteNodesForFiles: (filePaths: readonly string[], options?: {
     onChunk?: (filesDone: number, filesTotal: number) => void;
+    /** When set, only these node tables are DETACH DELETEd (#3016). */
+    nodeTables?: readonly string[];
 }) => Promise<void>;
+/**
+ * Which of `candidateTables` currently hold at least one row for `filePaths`.
+ *
+ * The incremental writeback uses this to decide which FTS-backed tables it is
+ * about to DML (#3016). It has to be a question about the DB, not about the
+ * freshly built graph: an edit that DELETES the last Rust trait in a file
+ * leaves no Trait node in the new graph, but the old row is still in the index
+ * and still has to be deleted — and its FTS index still has to come down first.
+ */
+export declare const nodeTablesWithRowsForFiles: (filePaths: readonly string[], candidateTables: readonly string[]) => Promise<Set<string>>;
+/**
+ * One MEMBER_OF / STEP_IN_PROCESS edge, carrying everything needed to recreate
+ * it byte-for-byte: both endpoint labels (so the re-MATCH is label-scoped
+ * rather than a scan of every node) and every column of the relationship
+ * table, `step` included — process traces order by it (`ORDER BY r.step`), so
+ * an edge restored without it silently scrambles the flow it belongs to.
+ */
+export interface DerivedRelSnapshot {
+    sourceId: string;
+    sourceLabel: string;
+    targetId: string;
+    targetLabel: string;
+    type: string;
+    confidence: number;
+    reason: string;
+    step: number;
+}
+/**
+ * Capture the MEMBER_OF / STEP_IN_PROCESS / ENTRY_POINT_OF edges owned by `filePaths`, before a
+ * surgical incremental write DETACH DELETEs their file-side endpoints (#3016).
+ *
+ * Only meaningful on the write plan that keeps the persisted Community/Process
+ * nodes: those nodes survive the delete, but the edges tying this run's changed
+ * files to them do not, and the pipeline did not re-derive them.
+ *
+ * Both endpoints are matched by an EXPLICIT label — `sourceTables` on one side,
+ * the edge type's fixed target table on the other — so the labels come from the
+ * query rather than the rows. `labels(n)[0]` over an unlabelled match returns
+ * an empty string on this engine, which silently produced a snapshot that
+ * restored nothing.
+ *
+ * Read failures propagate. This runs against a warm index whose derived tables
+ * the caller has already established exist, so a failure here is a real fault —
+ * and swallowing it would drop the edges silently, which looks identical to a
+ * repo that genuinely has no communities.
+ */
+export declare const snapshotDerivedRelsForFiles: (filePaths: readonly string[], sourceTables: readonly string[]) => Promise<DerivedRelSnapshot[]>;
+/**
+ * Re-create the edges captured by `snapshotDerivedRelsForFiles`, after the
+ * incremental subgraph load has put their file-side endpoints back.
+ *
+ * Endpoints are matched by label + id, mirroring `fallbackRelationshipInserts`:
+ * an unlabelled `MATCH (a), (b)` is a cartesian product over the whole graph
+ * and does not finish on a real index. An endpoint the load did not restore
+ * simply matches nothing, so the edge is dropped rather than mis-attached.
+ */
+export declare const restoreDerivedRels: (rels: readonly DerivedRelSnapshot[]) => Promise<void>;
 export declare const getEmbeddingTableName: () => string;
 /**
  * Return the distinct repo-relative paths of files that import
@@ -501,6 +571,31 @@ export declare const deleteAllAdvisedBy: () => Promise<{
 export declare const deleteSpringAopEvidenceNodes: () => Promise<{
     nodesDeleted: number;
 }>;
+/**
+ * Drop EVERY `Destination` node before an incremental writeback, so the async
+ * messaging overlay is rebuilt whole from the fresh graph.
+ *
+ * Delete-all rather than delete-by-file, because the file-keyed rule cannot
+ * express this layer in either direction. A RESOLVED destination stores no
+ * `filePath` — that is what stops `deleteNodesForFiles` cutting a node shared
+ * by files outside the write set — which also means it is never deleted when it
+ * SHOULD be, so a destination whose last referrer stopped naming it survived as
+ * an edgeless orphan that still carried `address`, the cross-repository join
+ * key, accumulating on every run. The mirror defect was worse: without a
+ * matching graph-wide re-include, a newly added file publishing to a NEW topic
+ * wrote neither the destination nor the publisher's edge, silently and with a
+ * zero exit.
+ *
+ * The `springDestinations` phase runs on every persisting analyze and recomputes
+ * the full set from the whole file list, so delete-then-re-include is complete.
+ * `extractChangedSubgraph` treats `Destination` as graph-wide to supply the
+ * other half; the two must be changed together. DETACH DELETE also takes the
+ * `CONSUMES_FROM` / `PUBLISHES_TO` edges, which the re-include restores because
+ * every one of them has the destination as an endpoint.
+ */
+export declare const deleteAllDestinations: () => Promise<{
+    nodesDeleted: number;
+}>;
 /**
  * Drop Spring-owned auto-configuration `DECLARES` relationships before
  * incremental writeback. `DECLARES` is generic, so exact reason filtering is