fix(storage): ingest-sarif upsert no longer clobbers a finding's host node into a placeholder

[theagenticguy]

Summary

Data-corruption fix. Any function, method, or class that contains a scanner finding was silently deleted from the code graph and replaced by a <placeholder> Route node. Cross-module context/impact then treated the host symbol as an unreferenced island.

This is the root cause of the field report's Issue 1 (headline): get_bedrock_client showed up orphaned into <external>/<unresolved> nodes, and blast-radius didn't cross module boundaries.

Root cause (found by execution, not inspection)

Two earlier hypotheses were refuted by repro before this one was confirmed:

• The report guessed a SCIP FQN-vs-filepath alias mismatch — wrong; scip-python emits one symbol string for the def and every ref.
• A multi-agent analysis guessed the lbug node COPY drops the row via empty-string sentinel struct-typing — wrong; encodeNodeCol passes all strings through identically. A 2-node and a full-584-node bulkLoad both persisted the node fine.

The actual mechanism:

1. codehub analyze does a replace-mode bulkLoad of all real nodes. The host Function persists correctly here (verified).
2. Then scan + ingest-sarif does a second bulkLoad(findingGraph, { mode: "upsert" }) where findingGraph holds only Finding nodes + FOUND_IN edges.
3. A Semgrep finding at client.py:165 sits inside get_bedrock_client, so ingest adds Finding → Function:…get_bedrock_client. That Function id is not in the upsert batch.
4. synthesizePlaceholderNodes minted a kind:Route placeholder for the missing endpoint, and upsert mergeNodes (DETACH DELETE + re-insert) destroyed the real Function.

Confirmed on disk: id Function:…get_bedrock_client stored kind=Route, name=<the id>, lines=null — the placeholder shape. The @cache decorator and src/ layout were red herrings; the discriminator is "host of a scanner finding", so this corrupted every indexed repo.

Fix

synthesizePlaceholderNodes now takes an optional alreadyPersisted id set. In upsert mode, #bulkLoadOnce computes it via filterExistingNodeIds(edgeEndpointIds(edges)) (a thin wrapper over the existing listNodes({ ids }) finder) and skips synthesis for any edge endpoint that already exists in the store. Genuine orphans (unresolved FETCHES placeholders) still get synthesized so the edge COPY's PK constraint holds. Replace mode is unchanged (store was just truncated → undefined).

Test plan

• End-to-end on the subject repo: after re-analyze, context get_bedrock_client resolves the Function with 11 inbound (incl. cross-module mcp_server.py:nova_web_grounding) + 5 outbound; impact tiers it CRITICAL, 124 reachable, crossing the module boundary. Before: orphaned, island.
• 2 regression tests in graphdb-roundtrip.test.ts: (1) upsert with a FOUND_IN edge to an existing node keeps it a Function (not clobbered into a Route placeholder); (2) a genuinely-orphan FETCHES endpoint still synthesizes a placeholder.
• @opencodehub/storage: 161/161 pass (1 pre-existing vector-backend skip).
• tsc --noEmit workspace clean; biome check clean.

Follow-ups (separate PRs, from the same field report)

Issues 2–6 (vulture .venv exclude, MCP-only→CLI wrappers, sql docs, status retrieval mode, doctor bandit[sarif] probe) plus the confirmed Python import-parser bugs (multi-line parenthesized imports dropped; src-layout dotted-import resolution) are queued.