[mache-b094fa] Lock Open's laziness, and close the ids-vs-nodes asymmetry

[jamestexas]

Completes mache-b094fa. Follows #627 (RefRange + classified RefTarget).

1. graph.Open must stay lazy — now enforced

modmap assembles a ~100 GB corpus by ATTACH+INSERT across projections. That only works because Open is SQL-per-call. Its own doc already promised it — "Open sidesteps the whole class by not copying anything" — and nothing enforced it. A bulk load added later would break the assembled path silently, at a scale no unit test reaches.

Two assertions, because one is not enough:

• scanOnce/dirChildren/recordIDs empty after Open. Populated exclusively by scanRoot, so emptiness directly observes that no scan ran. Paired with a LookupDef call so "lazy" cannot be satisfied by an Open that does nothing.
• Open's heap cost does not grow with projection size. Catches what the above cannot: a DefsMap warm-up, an index build, a bulk read into the reader cache.

The first version of the second test was wrong

It compared large < small*8 and PASSED with an eager g.DefsMap() spliced into Open: at 400 defs the copy hid inside sql.Open's ~240 KB fixed cost. Ratios are the wrong instrument when a fixed cost dominates. Measured absolutely instead:

	delta, 200 → 2000 defs
lazy	0 B
eager whole-index copy	611,136 B

The 100 KB ceiling sits far above the real measurement and ~6x below the cheapest regression it must catch. Falsified by mutation — which the earlier version survived.

2. LookupDefNodes closes the asymmetry

LookupDef(token)  -> []string          // ids
GetCallers(token) -> ([]*Node, error)  // nodes
GetCallees(id)    -> ([]*Node, error)  // nodes

Ids from one accessor and Nodes from the next is why modmap wrapped this surface in its own callerResolver; their read — "strings where types should be" — was correct.

LookupDef is deliberately unchanged: ids are the right answer when the caller only needs identity, and resolving nodes it will discard is waste. This adds the variant for when it wants the node, as graph.DefsNodeLookuper.

A definition whose node cannot load is skipped rather than failing the call — node_defs can outlive a node during an incremental reparse, and one stale row should not deny a caller the definitions that did resolve.

The test pins symmetry, not shape: both accessors must agree on which definitions exist and differ only in what they return, so a consumer switching between them cannot silently change its answer.

A correction to ADR-0027 (recorded on mache-40faff)

EagerScan is a no-op on the nodes-table path:

if g.useNodesTable { return nil }   // graph/sqlite_graph.go:113

useNodesTable is true for everything mache build produces, so mount's EagerScan call does nothing for modern projections and the scanRoot machinery serves only the legacy path. The short-circuit is correct; what is not is ADR-0027 listing EagerScan as a live capability axis worth ablating — on the default path it cannot vary, so an ablation matrix would measure a constant. Recommend dropping it from the axis list in the ADR's revision. Pinned by a test so the fact cannot drift.

3. [mache-93e84b] — the linter's node-id shape assumption, isolated

Rides along because it landed on this branch. Independent of the two above.

While preparing mache's answers to ley-line-open's integer-nid migration I claimed internal/linter/linter.go would silently match across files under the new keys. That was wrong, and I retracted it on ley-line-open-17c271. LintAST builds its own in-memory _ast from a single-file ASTPayload — no source_id column exists, so cross-file matching was never reachable. I read the SQL and inferred the table instead of reading the table.

The real fragility is narrower but genuine: parent/child containment was reconstructed from the node-id string via three substr/instr expressions spread across the rule SQL. That is a shape assumption in a place where a shape change makes rules silently stop matching — a linter reporting nothing rather than erroring.

Now the table carries an explicit parent_id, the SQL reads c.parent_id = v.node_id, and the sole remaining assumption lives in one named function:

func parentIDOf(nodeID string) string {
	i := strings.LastIndexByte(nodeID, '/')
	if i <= 0 { return "" }
	return nodeID[:i]
}

TestParentIDOf_IsTheOnlyNodeIDShapeAssumption pins that. Falsified by mutating LastIndexByte → IndexByte, which the existing linter tests catch.

Verification

task ci passed via the pre-push gate; task smells returns 0. Every new assertion falsified by mutation. The smell ratchet additionally caught two structurally-identical test functions of mine and was right — grouped into one subtest-based test naming the shared contract.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TtGhz7QzUHZi52a3FeNtEs