[rahlk]

Epic: codellm-devkit/.github#50 · Spec: 2026-09-02-prune-scope-on-can-id-prefix.md

Closes #219, #218, #217.

Problem

The purge scoped deletion by _module — a bare project-relative file key stamped on every node. It carries no language and no application, so even after #213 anchored it on java-owned labels it was still application-blind: two java applications in one database sharing src/main/java/Foo.java have identical labels and an identical file key. Only identity distinguishes them, which is why no label could fix it.

Fix

The v2 purge scopes on the module's own can:// id — module by equality, declarations by id STARTS WITH <id> + '/'. The id is a path, so a prefix match is containment, and it is scoped to one language, one application and one module at once. Shared nodes fall outside by construction: artifacts are can://artifact/…, packages are pkg:…, and name-keyed nodes have no id to match at all.

_module retires from the v2 contract. It survives as NodeRow.moduleKey, an in-memory field the writer uses to group nodes — the graph never needed telling, since a node's owning module is already its id prefix. RowBuilder lifts it off the emitted properties in one place, so no projector call site changed.

The v1 carve-out, which the spec did not anticipate

v1 ids are FQN-shaped and carry no application segment:

com.l4.Arity#caller(int, int)@22:16-22:25

There is nothing to prefix, so v1 cannot be prefix-scoped. It keeps exactly what it had — _module plus the #213 label anchor — and BoltWriter branches on whether the module's id is a can:// id. MODULE_OWNED is consequently now the v1 vocabulary alone, which its test now asserts rather than assumes.

This means _module retires from the v2 contract but survives on the legacy path, contradicting the spec's claim that it retires outright. The spec needs amending; flagged rather than glossed.

:JCanNode

Nodes keyed on a can:// id gain a :JCanNode marker, declared as a marker label and indexed.

It exists only so the prefix predicate can seek — Neo4j property indexes are label-scoped, so the match would otherwise scan the whole node store once per changed module (that is #217, resolved here by making the property unnecessary rather than by indexing it). It makes no semantic claim, unlike :JSymbol, and being java-namespaced means an anchoring mistake still cannot reach another language's nodes.

STARTS WITH is index-backed on a range index; CONTAINS/ENDS WITH are not — the predicate is written that way deliberately.

One detail worth not inlining

The descendant separator is a named function, not a + "/" at the call site, because dropping it is silent: can://java/app/src/Foo.java also prefixes can://java/app/src/Foo.javaX, and would purge a different module's nodes. There is a test on it.

Verification

suite	512 tests, 1 failure — the pre-existing Docker CodeAnalyzerIntegrationTest
v2 graph.cypher (daytrader8)	0 _module properties, 45 JCanNode, 1 id index
v1 graph.cypher	59 _module, 0 JCanNode — legacy path untouched
analysis.json	byte-identical — _module was always projection-only

Breaking

Graph contract 2.2.0 → 3.0.0: a property is removed. analysis.json is unaffected.