fix: full-reindex leaves stale T1 facts + bundle import ignores config drift

Two independent correctness fixes found together this session:

- A full reindex cleared symbols/call_sites/etc but not type_relations/
  symbol_effects. Both key off qualified_name (not symbols.id), so a stale
  fact from a prior full reindex could silently coexist with the current
  fact for any symbol whose qualified name survived the rebuild --
  corrupting T1 facts and the Architecture Digest built from them.
  Regression tests lock this in via a real two-pass reindex.

- import_bundle computed force_full_reindex from only commit_matches/
  version_matches, silently ignoring config_matches even though
  config_fingerprint was already being compared and returned in the same
  ImportReport. A bundle built with different ignore rules than the
  importing repo's current config would activate without the recommended
  full reindex.

Also threads the real ignore_patterns into rebuild_graph/
incremental_graph_update's compute_package_dependencies call, which
previously always passed an empty list.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: Your Name

crates/calm-core/src/bundle.rs

@@ -34,10 +34,12 @@
 //! needs a C compiler, the exact problem class this workspace has
 //! repeatedly hit and removed on musl cross-compiles.
 //!
-//! **Import-as-seed triggers on ANY git-commit mismatch, not just "tree
-//! doesn't match".** If the bundle's `git_commit` differs from the
-//! importing repo's current HEAD (or either side has none), the bundle is
-//! still activated -- but `ImportReport::force_full_reindex` is set,
+//! **Import-as-seed triggers on ANY git-commit, `calm_version`, or
+//! `config_fingerprint` mismatch, not just "tree doesn't match".** If the
+//! bundle's `git_commit` differs from the importing repo's current HEAD (or
+//! either side has none), or the bundle's languages/ignore rules
+//! (`config_fingerprint`) don't match this project's current config, the
+//! bundle is still activated -- but `ImportReport::force_full_reindex` is set,
 //! telling the caller to run a full reindex afterward rather than trust
 //! incremental reconciliation, which only re-touches files whose content
 //! actually changed and so could never notice "the code that INTERPRETS
@@ -134,9 +136,11 @@ pub struct ImportReport {
     pub manifest: BundleManifest,
     pub commit_matches: bool,
     pub config_matches: bool,
-    /// `true` when EITHER the git commit doesn't match OR `calm_version`
-    /// differs from this binary's own version -- see the module doc
-    /// comment's "Import-as-seed" section for why both trigger this.
+    /// `true` when the git commit doesn't match, OR `calm_version` differs
+    /// from this binary's own version, OR `config_fingerprint` (languages/
+    /// ignore rules) doesn't match this project's current config -- see the
+    /// module doc comment's "Import-as-seed" section for why all three
+    /// trigger this.
     pub force_full_reindex: bool,
     pub activated_path: PathBuf,
 }
@@ -310,7 +314,7 @@ pub fn import_bundle(
     };
     let config_matches = manifest.config_fingerprint == config_fingerprint(config);
     let version_matches = manifest.calm_version == env!("CARGO_PKG_VERSION");
-    let force_full_reindex = !commit_matches || !version_matches;
+    let force_full_reindex = !commit_matches || !version_matches || !config_matches;
 
     // Drop any stale WAL/SHM sidecars belonging to the file about to be
     // replaced -- VACUUM INTO's own output is always a single plain file
@@ -683,6 +687,64 @@ mod tests {
         assert!(report.config_matches);
     }
 
+    /// Bug fix 2026-08-08: `force_full_reindex` used to be computed from
+    /// only `commit_matches`/`version_matches`, silently ignoring
+    /// `config_matches` even though `config_fingerprint` was already being
+    /// compared and returned in the same `ImportReport`. Uses a real git
+    /// repo (same commit on both sides) so `commit_matches` is isolated as
+    /// `true`, proving `config_matches` alone now drives the recommendation.
+    #[test]
+    fn import_reports_force_full_reindex_when_only_config_differs() {
+        let src_dir = tempfile::tempdir().unwrap();
+        let run = |args: &[&str]| {
+            std::process::Command::new("git")
+                .args(args)
+                .current_dir(src_dir.path())
+                .output()
+                .unwrap()
+        };
+        run(&["init", "-q"]);
+        run(&[
+            "-c",
+            "user.email=t@t",
+            "-c",
+            "user.name=t",
+            "commit",
+            "--allow-empty",
+            "-q",
+            "-m",
+            "x",
+        ]);
+
+        let db_path = src_dir.path().join("index.db");
+        seed_index_db(&db_path);
+        let export_config = Config::default();
+        let archive_path = src_dir.path().join("bundle.tar.gz");
+        export_bundle(&db_path, src_dir.path(), &export_config, &archive_path).unwrap();
+
+        let dest_db_path = src_dir.path().join("imported.db");
+        let mut import_config = Config::default();
+        import_config
+            .ignore
+            .push("some_custom_ignore_rule".to_string());
+        let report =
+            import_bundle(&archive_path, src_dir.path(), &dest_db_path, &import_config).unwrap();
+
+        assert!(
+            report.commit_matches,
+            "same repo, same HEAD commit on both sides"
+        );
+        assert!(
+            !report.config_matches,
+            "ignore rules differ between export and import config"
+        );
+        assert!(
+            report.force_full_reindex,
+            "a config_fingerprint mismatch alone must force a full reindex \
+             recommendation, even when the commit matches"
+        );
+    }
+
     #[test]
     fn import_removes_stale_wal_sidecars_next_to_the_activated_path() {
         let src_dir = tempfile::tempdir().unwrap();

crates/calm-core/src/indexer/pipeline.rs

@@ -1403,6 +1403,7 @@ fn rebuild_graph(
     churn_since: &str,
     hub_config: &crate::config::HubThresholdConfig,
     maps: &ResolutionMaps,
+    ignore: &[String],
 ) -> rusqlite::Result<()> {
     let ctx = build_resolution_context(tx, &maps.namespace_map)?;
 
@@ -1461,7 +1462,7 @@ fn rebuild_graph(
     crate::graph::boundary::update_boundary_ambiguous_flags(tx)?;
     crate::graph::churn::update_churn_scores(tx, project_root, churn_since)?;
     crate::graph::digest::compute_digests(tx)?;
-    crate::indexer::package_deps::compute_package_dependencies(tx, project_root, &[])?;
+    crate::indexer::package_deps::compute_package_dependencies(tx, project_root, ignore)?;
     Ok(())
 }
 
@@ -1488,6 +1489,7 @@ pub fn rebuild_graph_from_index(
         &config.hotspots.default_since,
         &config.hub_threshold,
         &maps,
+        &config.ignore,
     )?;
     tx.execute(
         "UPDATE graph_generation_state SET generation = generation + 1 WHERE id = 1",
@@ -1520,6 +1522,7 @@ pub enum IncrementalOutcome {
 /// loaded and (b) how much of `call_edges` gets deleted first; see plan
 /// §3.1 for the proof that `delta_paths` below is sufficient to catch every
 /// input `resolve_sites_to_edges` depends on.
+#[allow(clippy::too_many_arguments)]
 pub fn incremental_graph_update(
     tx: &rusqlite::Transaction,
     project_root: &std::path::Path,
@@ -1528,6 +1531,7 @@ pub fn incremental_graph_update(
     names_delta: &HashSet<String>,
     hub_config: &crate::config::HubThresholdConfig,
     maps: &ResolutionMaps,
+    ignore: &[String],
 ) -> rusqlite::Result<IncrementalOutcome> {
     // Step 1 (plan D1): delta_paths = delta_seed ∪ {from_path of call_sites
     // whose callee_name ∈ names_delta} — a site in an UNCHANGED file that
@@ -1562,7 +1566,7 @@ pub fn incremental_graph_update(
             "delta_paths.len()={} > {MAX_INCREMENTAL_DELTA_PATHS}",
             delta_paths.len()
         );
-        rebuild_graph(tx, project_root, churn_since, hub_config, maps)?;
+        rebuild_graph(tx, project_root, churn_since, hub_config, maps, ignore)?;
         return Ok(IncrementalOutcome::FellBackToFull(reason));
     }
 
@@ -1652,7 +1656,7 @@ pub fn incremental_graph_update(
     crate::graph::boundary::update_boundary_ambiguous_flags(tx)?;
     crate::graph::churn::update_churn_scores(tx, project_root, churn_since)?;
     crate::graph::digest::compute_digests(tx)?;
-    crate::indexer::package_deps::compute_package_dependencies(tx, project_root, &[])?;
+    crate::indexer::package_deps::compute_package_dependencies(tx, project_root, ignore)?;
 
     Ok(IncrementalOutcome::Applied)
 }
@@ -2280,6 +2284,17 @@ fn reindex_all_cancellable_with_phase(
     tx.execute("DELETE FROM symbols", [])?;
     tx.execute("DELETE FROM file_index", [])?;
     tx.execute("DELETE FROM code_chunks", [])?;
+    // Bug fix 2026-08-08: these two were missing from the full-reindex clear
+    // even though `remove_file_rows` (the per-file incremental path) already
+    // clears them. Both tables key off `qualified_name`/`source_path`, not
+    // `symbols.id` (see their schema.rs comments), so a stale row here is not
+    // just orphaned garbage -- it silently re-attaches to whatever symbol the
+    // NEXT full reindex assigns the same qualified name, corrupting T1 facts
+    // and the Architecture Digest built from them for a symbol whose actual
+    // semantics changed. See golden_graph_equivalence.rs for the regression
+    // test locking this in (full-rebuild-on-old-DB must equal fresh-build).
+    tx.execute("DELETE FROM type_relations", [])?;
+    tx.execute("DELETE FROM symbol_effects", [])?;
     // A full baseline invalidates all cached SCIP results. In particular, D4's
     // byte-span identity migration must never let a line-derived cache key skip
     // the first exact overlay pass after rebuilding the graph.
@@ -2340,6 +2355,7 @@ fn reindex_all_cancellable_with_phase(
         &config.hotspots.default_since,
         &config.hub_threshold,
         &maps,
+        &ignore_patterns,
     )?;
     tx.execute(
         "UPDATE graph_generation_state SET generation = generation + 1 WHERE id = 1",
@@ -2858,6 +2874,7 @@ pub fn reindex_changed_cancellable(
                 &summary.names_delta,
                 &config.hub_threshold,
                 &maps,
+                &ignore_patterns,
             )? {
                 IncrementalOutcome::Applied => summary.graph_mode = GraphMode::Incremental,
                 IncrementalOutcome::FellBackToFull(reason) => {
@@ -2871,6 +2888,7 @@ pub fn reindex_changed_cancellable(
                 &config.hotspots.default_since,
                 &config.hub_threshold,
                 &maps,
+                &ignore_patterns,
             )?;
             summary.graph_mode = GraphMode::Full;
         }
@@ -3013,6 +3031,7 @@ pub fn reindex_paths(
                 &summary.names_delta,
                 &config.hub_threshold,
                 &maps,
+                &config.ignore,
             )? {
                 IncrementalOutcome::Applied => summary.graph_mode = GraphMode::Incremental,
                 IncrementalOutcome::FellBackToFull(reason) => {
@@ -3026,6 +3045,7 @@ pub fn reindex_paths(
                 &config.hotspots.default_since,
                 &config.hub_threshold,
                 &maps,
+                &config.ignore,
             )?;
             summary.graph_mode = GraphMode::Full;
         }

crates/calm-core/tests/golden_graph_equivalence.rs

@@ -1371,3 +1371,144 @@ fn names_delta_over_chunk_size_matches_full() {
         "names_delta chunk-boundary: incremental must match full rebuild",
     );
 }
+
+/// Bug fix 2026-08-08: a full reindex used to clear `symbols`/`call_sites`/
+/// etc. but NOT `type_relations`/`symbol_effects` -- see the fix in
+/// `pipeline.rs`'s `reindex_all_cancellable_with_phase`. Both tables key off
+/// `qualified_name` (not `symbols.id`), so a stale fact from a prior full
+/// reindex used to silently coexist with the current fact for any symbol
+/// whose qualified name survived the rebuild -- corrupting T1 facts and the
+/// Architecture Digest built from them. `run_indexing_pipeline` always takes
+/// the full-baseline path (never incremental), so calling it twice on the
+/// same connection with different file content between calls is exactly the
+/// regression scenario.
+#[test]
+fn full_reindex_does_not_leave_stale_semantic_facts() {
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path().join("ws");
+    std::fs::create_dir_all(&root).unwrap();
+    std::fs::write(
+        root.join("service.py"),
+        "class Service:\n    def save(self):\n        self.cache = 1\n        raise ValueError(\"boom\")\n",
+    )
+    .unwrap();
+
+    let mut db = index_fresh(&root);
+    let effects_before: i64 = db
+        .query_row("SELECT COUNT(*) FROM symbol_effects", [], |r| r.get(0))
+        .unwrap();
+    assert_eq!(
+        effects_before, 2,
+        "fixture must produce exactly 1 throw + 1 write fact to exercise the bug"
+    );
+
+    // Second full reindex (run_indexing_pipeline always takes the
+    // full-baseline path) with the SAME qualified name (`Service::save`
+    // survives) but neither a raise nor a field write in the new source.
+    std::fs::write(
+        root.join("service.py"),
+        "class Service:\n    def save(self):\n        return 1\n",
+    )
+    .unwrap();
+    let phase = std::sync::Arc::new(std::sync::RwLock::new(
+        calm_core::types::IndexingPhase::Scanning,
+    ));
+    calm_core::indexer::pipeline::run_indexing_pipeline(&mut db, &root, phase).unwrap();
+
+    let effects_after: i64 = db
+        .query_row("SELECT COUNT(*) FROM symbol_effects", [], |r| r.get(0))
+        .unwrap();
+    assert_eq!(
+        effects_after, 0,
+        "full reindex must not leave stale symbol_effects behind for a symbol \
+         whose qualified name survived the rebuild"
+    );
+}
+
+/// Same bug, `type_relations` half: a base-class relation recorded in
+/// version A must not survive a full reindex into a version B that dropped
+/// the base class entirely, even though the class's own qualified name is
+/// unchanged.
+#[test]
+fn full_reindex_does_not_leave_stale_type_relations() {
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path().join("ws");
+    std::fs::create_dir_all(&root).unwrap();
+    std::fs::write(
+        root.join("service.py"),
+        "class Base:\n    pass\n\nclass Service(Base):\n    pass\n",
+    )
+    .unwrap();
+
+    let mut db = index_fresh(&root);
+    let relations_before: i64 = db
+        .query_row("SELECT COUNT(*) FROM type_relations", [], |r| r.get(0))
+        .unwrap();
+    assert_eq!(
+        relations_before, 1,
+        "fixture must produce exactly 1 extends fact to exercise the bug"
+    );
+
+    std::fs::write(root.join("service.py"), "class Service:\n    pass\n").unwrap();
+    let phase = std::sync::Arc::new(std::sync::RwLock::new(
+        calm_core::types::IndexingPhase::Scanning,
+    ));
+    calm_core::indexer::pipeline::run_indexing_pipeline(&mut db, &root, phase).unwrap();
+
+    let relations_after: i64 = db
+        .query_row("SELECT COUNT(*) FROM type_relations", [], |r| r.get(0))
+        .unwrap();
+    assert_eq!(
+        relations_after, 0,
+        "full reindex must not leave a stale type_relations row behind for a \
+         symbol whose qualified name survived the rebuild"
+    );
+}
+
+/// Bug fix 2026-08-08: `rebuild_graph`/`incremental_graph_update` used to
+/// call `compute_package_dependencies` with a hardcoded empty ignore list,
+/// so a user's configured `ignore` patterns never applied to package
+/// manifest scanning even though they applied to every other part of
+/// indexing. Both functions now take and forward a real `ignore: &[String]`
+/// parameter sourced from `config.ignore`.
+#[test]
+fn package_dependencies_scan_respects_configured_ignore_rules() {
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path().join("ws");
+    std::fs::create_dir_all(root.join("vendor")).unwrap();
+    // Written before the first index, same reasoning as
+    // enable_incremental_graph's doc comment: config.json must never appear
+    // as a changed path in a later delta.
+    std::fs::write(root.join("config.json"), r#"{"ignore":["vendor"]}"#).unwrap();
+    std::fs::write(
+        root.join("Cargo.toml"),
+        "[package]\nname = \"root_pkg\"\nversion = \"0.1.0\"\n\n[dependencies]\nfoo = \"1\"\n",
+    )
+    .unwrap();
+    std::fs::write(
+        root.join("vendor/Cargo.toml"),
+        "[package]\nname = \"vendored_pkg\"\nversion = \"0.1.0\"\n\n[dependencies]\nserde = \"1\"\n",
+    )
+    .unwrap();
+
+    let db = index_fresh(&root);
+    let names: Vec<String> = {
+        let mut stmt = db
+            .prepare("SELECT dependency_name FROM package_dependencies ORDER BY dependency_name")
+            .unwrap();
+        stmt.query_map([], |r| r.get::<_, String>(0))
+            .unwrap()
+            .collect::<Result<Vec<_>, _>>()
+            .unwrap()
+    };
+
+    assert!(
+        names.iter().any(|n| n == "foo"),
+        "root Cargo.toml's dependency must still be scanned: {names:?}"
+    );
+    assert!(
+        !names.iter().any(|n| n == "serde"),
+        "vendor/ is configured as ignored, so vendor/Cargo.toml's dependency \
+         must not appear: {names:?}"
+    );
+}