fix(graph): dedupe node_rows + use INSERT OR REPLACE to avoid UNIQUE constraint failures — closes #114

[Wolfvin]

What

Fixes RED TEAM issue #114: populate_graph_tables() failed with sqlite3.IntegrityError: UNIQUE constraint failed: graph_nodes.node_id, leaving the graph empty.

Root cause

populate_graph_tables() in scripts/graph_model.py built node_rows from flat_nodes, which can contain duplicate node_id values (file:line:fn) when e.g. a class and its __init__ method share the same line, or when two declarations collide on the same line number. The graph_nodes.node_id column has a UNIQUE constraint, so a bare INSERT raised sqlite3.IntegrityError and rolled back the entire BEGIN EXCLUSIVE transaction — leaving graph_nodes empty.

Fix — two layers of defense

1. Dedupe node_rows by node_id (last occurrence wins, matching the "last match wins" semantics of the flat registry) before the batch insert. Applied to both populate_graph_tables() and incremental_graph_update().

2. Use INSERT OR REPLACE instead of bare INSERT so even if a duplicate slips through (e.g. from a prior partial write), the batch succeeds instead of failing the whole transaction.

# Issue #114: dedupe node_rows by node_id.
if node_rows:
    seen: Dict[str, Tuple[Any, ...]] = {}
    for row in node_rows:
        seen[row[0]] = row
    node_rows = list(seen.values())

# ... later ...
conn.executemany(
    "INSERT OR REPLACE INTO {t} (node_id, node_type, name, file, line, extra_json) "
    "VALUES (?, ?, ?, ?, ?, ?)".format(t=GRAPH_NODES_TABLE),
    node_rows,
)

Verification

# Before: scan would fail with IntegrityError, graph_nodes = 0 rows
# After: scan succeeds, graph_nodes = 31 rows (clean_app fixture)

Test suite: 1183 passed, 1 pre-existing failure (#118 — test expectation mismatch, unrelated).

Test plan

• Scan on clean_app fixture populates graph_nodes (31 nodes, 113 edges)
• No IntegrityError in logs
• Full test suite: 1183 passed (no new regressions)
• CI: full test suite passes

Risk

Low. Dedup uses last-occurrence-wins which matches flat registry semantics. INSERT OR REPLACE is idempotent and the transaction is already wrapped in BEGIN EXCLUSIVE / COMMIT.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud