deep mode: nodes with out-of-scope source_file are warned about but still written to graph.json #1895

Version: 0.9.15

Deep-mode extraction created nodes whose source_file points at files that .graphifyignore excludes and that were never dispatched to the extractor. The LLM saw references to those files inside documents it did read, and set source_file to the referent rather than to the containing document. The node therefore asserts a provenance that never existed.

graphify partially detects this. Per offending file it emits:

RuntimeWarning: semantic cache skipped out-of-scope source_file '<path>';
the file was not dispatched for extraction

and correctly keeps the entry out of the cache — but the node is still written to graph.json. So the warning implies the situation was handled, while the graph carries the fabricated provenance.

Observed

3 warnings, and exactly 3 corresponding out-of-scope nodes in the final graph (paths under scripts/ and spine/attestations/, excluded by the ignore file's globs). The warning count was a reliable detector; the graph was not actually protected by it.

Expected

The same out-of-scope check that guards the cache write should also run before the graph write — dropping the node, re-attributing source_file to the containing document, or at minimum flagging it in the node so downstream consumers can filter it.

Related: #1757 fixed the cache-overwrite consequence of this same source_file mis-attribution. The graph-write consequence appears to remain.