fix(pipeline): PR#9 slice D -- upsert call_sites by identity instead of delete-all/insert-all (fixes proof churn root cause)

This is the fix ddbc6a0's commit message flagged as still missing: v3's
position-independent identity (slices A-C) alone could never reduce
external_proofs/evidence_conflicts/ambiguity_group_candidates churn,
because driver::remove_file_rows unconditionally deleted every call_sites
row for a changed file before persist_file re-inserted fresh ones --
AUTOINCREMENT never reuses a deleted id, so every reindex of a file
churned every durable proof/conflict/ambiguity row FK'd to call_sites.id
ON DELETE CASCADE, regardless of identity_version.

- driver::remove_file_rows no longer touches call_sites at all (doc
  comment rewritten to explain why). Two new/reused cleanup paths take
  over its old responsibility:
  - driver::delete_call_sites_for_path: the explicit, unconditional
    call_sites DELETE for a path that's genuinely gone (no re-extraction
    follows) -- called from both "file deleted" branches in
    reindex_changed_cancellable/reindex_paths, and from both "file
    changed but language unrecognized" (data=None) branches where
    persist_file never runs.
  - extraction::reconcile_call_sites: the real fix. Loads existing
    call_sites for the path, matches each freshly extracted call site
    against them by IDENTITY (version-aware: byte-absolute key for v1/v2,
    relative-to-enclosing-symbol key for v3+, mirroring db::schema's
    idx_call_sites_v2_identity/idx_call_sites_v3_identity exactly). A
    match keeps its id, UPDATEd in place only if something actually
    changed (including call_line/callee_start_byte/callee_end_byte/
    callee_start_rel/callee_end_rel -- a matched v3 row's RELATIVE
    identity can stay stable while its ABSOLUTE position legitimately
    shifts, e.g. an edit earlier in the same enclosing symbol; a first
    version of this fix missed refreshing those columns, caught live by
    golden_graph_equivalence's own RenameFn mutation round producing a
    real continued-vs-fresh divergence -- fixed in the same slice before
    landing). An unmatched fresh call site is INSERTed (still `OR
    IGNORE`: two call sites within the SAME extraction batch can
    legitimately collide on identity, same pre-existing case
    persist_file_ignores_a_call_site_that_collides_on_the_full_identity_
    tuple covers). An unmatched existing row is DELETEd -- the call
    really is gone, so CASCADE cleanup for it is correct, not churn.
    persist_file now calls this instead of a plain INSERT loop.

Also updates persist_file_ignores_a_call_site_that_collides_on_the_full_
identity_tuple: its own setup (write a.rs, run a real indexing pass first)
is incompatible with persist_file's new contract -- a real pre-existing
call site not present in this test's hand-built (partial, synthetic)
call_sites list would now be correctly treated as removed. Stripped the
now-unnecessary real-indexing setup; the test still verifies exactly what
its own doc comment says (in-batch duplicate-identity dedup), just
without unrelated pre-existing state in the way.

Verified: cargo build/clippy -p calm-core --all-targets clean, cargo test
-p calm-core 1248 passed/0 failed/12 ignored including both
golden_equivalence_{continued,incremental}_vs_fresh_across_mutation_rounds
(the real oracle for this change -- exercises exactly the kind of
same-file, position-shifting edits this fix is about), cargo fmt clean.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: Your Name

crates/calm-core/src/indexer/pipeline.rs

@@ -5097,18 +5097,20 @@ impl StructB {
         // (still an open question -- see design doc) -- it directly verifies
         // the persistence layer's own contract: a duplicate-identity call
         // site must be silently deduped, never crash the transaction.
-        let dir = std::env::temp_dir().join(format!("ci_idx_dupcallsite_{}", std::process::id()));
-        let _ = std::fs::remove_dir_all(&dir);
-        std::fs::create_dir_all(&dir).unwrap();
-        std::fs::write(
-            dir.join("a.rs"),
-            "fn helper() {}\nfn caller() {\n    helper();\n}\n",
-        )
-        .unwrap();
-
+        // PR#9 (docs/plans/2026-08-19-evidence-architecture-execution-plan.md
+        // Part E): no real file/real indexing pass here anymore -- persist_file
+        // now reconciles call_sites by IDENTITY for the whole path (upsert:
+        // update-in-place / insert / delete whatever isn't in the fresh set),
+        // not a pure blind-append. A real prior indexing pass would seed a
+        // REAL call_sites row for "a.rs" that this test's hand-built
+        // `extracted.call_sites` (below) doesn't include, and the new
+        // reconciliation would then (correctly, per its own contract) treat
+        // that real row as removed -- exactly what a previous version of this
+        // test tripped over when slice D landed. This test is about
+        // persist_file's in-batch dedup behavior specifically, which doesn't
+        // need any pre-existing state to exercise.
         let mut conn = Connection::open_in_memory().unwrap();
         init_db(&conn).unwrap();
-        run_indexing_pipeline(&mut conn, &dir, dummy_phase()).unwrap();
 
         let before: i64 = count(&conn, "SELECT COUNT(*) FROM call_sites");
 
@@ -5154,8 +5156,6 @@ impl StructB {
             before + 1,
             "exactly one of the two identical CallSiteData entries should have been persisted"
         );
-
-        let _ = std::fs::remove_dir_all(&dir);
     }
 
     /// Regression for the import-graph false positive: a bare `use

crates/calm-core/src/indexer/pipeline/driver.rs

@@ -48,11 +48,29 @@ use super::{
 };
 use crate::indexer::lang_constants::{is_recognized_unparsed_extension, language_for_extension};
 
-/// Drop all rows belonging to a single file (symbols, call sites, file_index).
+/// Drop all rows belonging to a single file (symbols, import_edges,
+/// file_index, code_chunks, type_relations, symbol_effects) -- EXCEPT
+/// `call_sites`, deliberately (PR#9,
+/// docs/plans/2026-08-19-evidence-architecture-execution-plan.md Part E):
+/// a blanket delete-then-reinsert here would give every call site in the
+/// file a brand-new `id` on every single reindex, even one that changes
+/// nothing about a given call -- and `external_proofs`/`evidence_
+/// conflicts`/`ambiguity_group_candidates` are all FK'd to `call_sites.id`
+/// `ON DELETE CASCADE`, so that churns every durable proof/conflict/
+/// ambiguity record for the whole file on every edit, defeating the whole
+/// point of the v3 position-independent identity these rows now carry
+/// (see `extraction::reconcile_call_sites`'s own doc comment). Callers
+/// that ARE re-extracting this same path immediately after (the common
+/// case) must call [`extraction::persist_file`] right after this, which
+/// reconciles `call_sites` by identity (update-in-place / insert / delete
+/// only what actually changed) instead of blindly replacing them.
+/// Callers where the file has genuinely been REMOVED (no re-extraction
+/// following) must call [`delete_call_sites_for_path`] explicitly --
+/// `remove_file_rows` alone is no longer sufficient to fully clear a
+/// deleted file's rows.
 /// Call edges are rebuilt globally by [`rebuild_graph`], so they are not touched here.
 fn remove_file_rows(tx: &rusqlite::Transaction, rel: &str) -> rusqlite::Result<()> {
     tx.execute("DELETE FROM symbols WHERE path = ?1", [rel])?;
-    tx.execute("DELETE FROM call_sites WHERE from_path = ?1", [rel])?;
     tx.execute("DELETE FROM import_edges WHERE from_path = ?1", [rel])?;
     tx.execute("DELETE FROM file_index WHERE path = ?1", [rel])?;
     tx.execute("DELETE FROM code_chunks WHERE path = ?1", [rel])?;
@@ -61,6 +79,18 @@ fn remove_file_rows(tx: &rusqlite::Transaction, rel: &str) -> rusqlite::Result<(
     Ok(())
 }
 
+/// PR#9 companion to `remove_file_rows` (see that function's own doc
+/// comment for the full rationale): the explicit, unconditional
+/// `call_sites` cleanup for a path that has genuinely gone away -- no
+/// re-extraction is coming to reconcile against, so there is nothing to
+/// preserve an `id` FOR. CASCADE naturally cleans up `external_proofs`/
+/// `evidence_conflicts`/`ambiguity_group_candidates` for these rows,
+/// correctly -- the call sites really are gone, not just repositioned.
+fn delete_call_sites_for_path(tx: &rusqlite::Transaction, rel: &str) -> rusqlite::Result<()> {
+    tx.execute("DELETE FROM call_sites WHERE from_path = ?1", [rel])?;
+    Ok(())
+}
+
 /// Bare `name`s currently persisted for `path`, read BEFORE
 /// `remove_file_rows` clears them — the `old_names` half of Phase B plan
 /// D2's `names_delta = old_names ∪ new_names` union; the `new_names` half
@@ -404,6 +434,12 @@ pub fn reindex_changed_cancellable(
                     .names_delta
                     .extend(data.symbols.iter().map(|s| s.name.clone()));
                 persist_file(&tx, &c.rel, &c.hash, data)?;
+            } else {
+                // PR#9: no fresh call sites to reconcile call_sites against
+                // (unrecognized language) -- clean up explicitly, same as
+                // a genuinely-deleted path, since persist_file (which now
+                // owns call_sites reconciliation) never runs in this branch.
+                delete_call_sites_for_path(&tx, &c.rel)?;
             }
             upsert_file_index(
                 &tx,
@@ -423,6 +459,7 @@ pub fn reindex_changed_cancellable(
         if !seen_paths.contains(path) {
             summary.names_delta.extend(names_for_path(&tx, path)?);
             remove_file_rows(&tx, path)?;
+            delete_call_sites_for_path(&tx, path)?;
             summary.deleted += 1;
             summary.changed_paths.push(path.clone());
         }
@@ -535,6 +572,7 @@ pub fn reindex_paths(
             if existing_hash.is_some() {
                 summary.names_delta.extend(names_for_path(&tx, rel)?);
                 remove_file_rows(&tx, rel)?;
+                delete_call_sites_for_path(&tx, rel)?;
                 summary.deleted += 1;
                 summary.changed_paths.push(rel.clone());
             }
@@ -573,6 +611,11 @@ pub fn reindex_paths(
                 .names_delta
                 .extend(data.symbols.iter().map(|s| s.name.clone()));
             persist_file(&tx, rel, &hash, data)?;
+        } else {
+            // PR#9: see the identical branch in reindex_changed_cancellable
+            // for why this is needed now that remove_file_rows no longer
+            // touches call_sites.
+            delete_call_sites_for_path(&tx, rel)?;
         }
         upsert_file_index(
             &tx,