Fix adversarial findings on N+1 residuals, index identity, and boot payload.

CharField N+1 hits were still copied into review residuals after the rule
dropped them. Client node-id changes now bump INDEX_REVISION so incremental
graphs rebuild. Malformed django.setup() JSON becomes a skip residual.

Co-authored-by: Damon  <Modsofthenation@users.noreply.github.com>

Author: cursoragent

src/loadpath/extractors/django_boot.py

@@ -74,32 +74,46 @@ def _boot_subprocess(repo_root: Path, config: LoadpathConfig) -> ExtractedGraph:
         graph = ExtractedGraph()
         graph.residuals.append("django.setup() skipped: boot subprocess returned invalid JSON")
         return graph
+    return _graph_from_boot_data(data)
+
+
+def _graph_from_boot_data(data: dict) -> ExtractedGraph:
     graph = ExtractedGraph()
     graph.residuals.extend(data.get("residuals") or [])
-    for row in data.get("nodes") or []:
-        graph.nodes.append(
-            Node(
-                id=row["id"],
-                type=NodeType(row["type"]),
-                name=row["name"],
-                qualified_name=row["qualified_name"],
-                file_path=row.get("file_path"),
-                start_line=row.get("start_line"),
-                end_line=row.get("end_line"),
-                context=row.get("context"),
-                extra=row.get("extra") or {},
+    try:
+        for row in data.get("nodes") or []:
+            extra = row.get("extra") or {}
+            if isinstance(extra, str):
+                extra = json.loads(extra)
+            graph.nodes.append(
+                Node(
+                    id=row["id"],
+                    type=NodeType(row["type"]),
+                    name=row["name"],
+                    qualified_name=row["qualified_name"],
+                    file_path=row.get("file_path"),
+                    start_line=row.get("start_line"),
+                    end_line=row.get("end_line"),
+                    context=row.get("context"),
+                    extra=extra if isinstance(extra, dict) else {},
+                )
             )
-        )
-    for row in data.get("edges") or []:
-        graph.edges.append(
-            Edge(
-                src=row["src"],
-                dst=row["dst"],
-                type=EdgeType(row["type"]),
-                confidence=float(row.get("confidence") or 1),
-                extra=row.get("extra") or {},
+        for row in data.get("edges") or []:
+            extra = row.get("extra") or {}
+            if isinstance(extra, str):
+                extra = json.loads(extra)
+            graph.edges.append(
+                Edge(
+                    src=row["src"],
+                    dst=row["dst"],
+                    type=EdgeType(row["type"]),
+                    confidence=float(row.get("confidence") or 1),
+                    extra=extra if isinstance(extra, dict) else {},
+                )
             )
-        )
+    except (KeyError, TypeError, ValueError, json.JSONDecodeError) as exc:
+        graph = ExtractedGraph()
+        graph.residuals.append(f"django.setup() skipped: boot payload malformed ({exc})")
     return graph
 
 

src/loadpath/index.py

@@ -14,6 +14,8 @@
 
 PY_SKIP = {"migrations"}  # still extract migrations, just not skip
 INDEX_EXTENSIONS = {".py", ".ts", ".tsx", ".js", ".jsx"}
+# Bump when extractor/stitch node identity changes so incremental indexes rebuild.
+INDEX_REVISION = "3"
 
 
 def default_db_path(repo_root: Path) -> Path:
@@ -80,6 +82,7 @@ def _sidecar_digest(repo_root: Path, config: LoadpathConfig) -> str:
             digest.update(rel.encode())
             digest.update(path.read_bytes())
     digest.update(_config_digest(repo_root).encode())
+    digest.update(INDEX_REVISION.encode())
     return digest.hexdigest()
 
 

src/loadpath/review/engine.py

@@ -5,7 +5,7 @@
 from pathlib import Path
 from uuid import uuid4
 
-from loadpath.architecture.rules import evaluate
+from loadpath.architecture.rules import _related_accesses, evaluate
 from loadpath.config import LoadpathConfig, load_config
 from loadpath.graph.store import GraphStore
 from loadpath.index import default_db_path, index_drift, index_repo
@@ -243,6 +243,9 @@ def collect_residuals(store: GraphStore, impact_nodes: list[dict], diff: DiffSet
     for line in stored.splitlines():
         if any(f and f in line for f in impact_files) or any(n and str(n) in line for n in impact_names):
             residuals.append(line)
+    fields_by_name: dict[str, list[dict]] = {}
+    for field in store.nodes([NodeType.FIELD]):
+        fields_by_name.setdefault(field["name"], []).append(field)
     for n in impact_nodes:
         extra = n.get("extra") or {}
         if extra.get("get_serializer_class"):
@@ -254,9 +257,12 @@ def collect_residuals(store: GraphStore, impact_nodes: list[dict], diff: DiffSet
         if extra.get("queryset_in_serializer"):
             residuals.append(f"Queryset inside serializer {n['qualified_name']}")
         for hit in extra.get("nplusone") or []:
-            accessed = ", ".join(hit.get("accessed") or []) or "related fields"
+            accessed = list(hit.get("accessed") or [])
+            related, _ = _related_accesses(accessed, fields_by_name, extra.get("app"))
+            if not related:
+                continue
             residuals.append(
-                f"N+1 {accessed} in {n.get('file_path')}:{hit.get('line')} — {hit.get('suggested_fix')}"
+                f"N+1 {', '.join(related)} in {n.get('file_path')}:{hit.get('line')} — {hit.get('suggested_fix')}"
             )
     residuals.extend(_test_field_residuals(impact_nodes, diff))
     residuals.extend(_react_path_residuals(impact_nodes, diff))

tests/e2e/test_brokers_and_django.py

@@ -102,6 +102,14 @@ def test_boot_payload_ignores_stdout_noise():
     assert data["residuals"][0].startswith("django.setup() skipped:")
 
 
+def test_boot_payload_malformed_nodes_become_residual():
+    from loadpath.extractors.django_boot import _graph_from_boot_data
+
+    graph = _graph_from_boot_data({"nodes": [{"id": 1}], "edges": [], "residuals": []})
+    assert not graph.nodes
+    assert any("django.setup() skipped: boot payload malformed" in r for r in graph.residuals)
+
+
 def test_index_counts_grow_with_new_django_files(tmp_path):
     store = index_repo(FIXTURE_ROOT, db_path=tmp_path / "g.sqlite3", incremental=False)
     types = {n["type"] for n in store.nodes()}

tests/unit/test_architecture_rules.py

@@ -136,6 +136,39 @@ def test_nplusone_schema_aware_does_not_add_edges(tmp_path: Path):
     store.close()
 
 
+def test_nplusone_charfield_is_not_a_residual(tmp_path: Path):
+    from loadpath.review.engine import collect_residuals
+
+    store = GraphStore(tmp_path / "g.sqlite3")
+    status = _field("status", "CharField")
+    account = _field("account", "ForeignKey")
+    service = Node(
+        id=node_id(NodeType.SERVICE, "billing.overdue"),
+        type=NodeType.SERVICE,
+        name="overdue",
+        qualified_name="billing.overdue",
+        extra={
+            "app": "billing",
+            "nplusone": [
+                {
+                    "accessed": ["status"],
+                    "loop_var": "invoice",
+                    "line": 4,
+                    "suggested_fix": ".select_related()",
+                }
+            ],
+        },
+    )
+    store.upsert_node(status)
+    store.upsert_node(account)
+    store.upsert_node(service)
+    store.conn.commit()
+    blob = " ".join(collect_residuals(store, [service.to_row()]))
+    assert "N+1" not in blob
+    assert "status" not in blob
+    store.close()
+
+
 def test_cascade_across_contexts_is_warning(tmp_path: Path):
     import shutil