fix(neo4j): scope bolt full-run orphan prune to the application anchor

Closes #45

The full-run prune deleted any :PyModule whose file_key was not in the current
emit across the ENTIRE database -- not just the application being written -- so a
full-run push for application B wiped application A's modules, leaving an orphaned
:PyApplication with zero PY_HAS_MODULE edges. A single Neo4j database therefore
could not hold multiple applications via full-run --emit neo4j.

Anchor the prune to the :PyApplication {name} being emitted
(MATCH (:PyApplication {name:$app})-[:PY_HAS_MODULE]->(m:PyModule) WHERE NOT
m.file_key IN $present ...), so it only removes that application's vanished
modules. Adds a container regression test (app-b push leaves app-a intact).

Author: rahlk

codeanalyzer/neo4j/bolt.py

@@ -77,6 +77,13 @@ def session():
             for stmt in [*CONSTRAINTS, *INDEXES]:
                 s.run(stmt)
 
+        # The application anchor (a shared node) — used to scope the orphan prune
+        # so it never touches modules belonging to a different :PyApplication.
+        app_name = next(
+            (n.value for n in rows.nodes if n.labels and n.labels[0] == "PyApplication"),
+            None,
+        )
+
         # Partition nodes by owning module; shared nodes have no _module.
         by_module: Dict[str, List[NodeRow]] = {}
         shared: List[NodeRow] = []
@@ -135,13 +142,17 @@ def _purge(tx, module=m, node_keys=keys):
         _upsert_edges(session, neo4j, edges)
 
         # 6. orphan prune — only safe on a full run (a targeted run can't tell deleted from untargeted).
-        if full_run:
+        # Scope to THIS application's anchor so a full run for application B never
+        # deletes application A's modules from a shared database.
+        if full_run and app_name is not None:
             present = list(by_module.keys())
             with session() as s:
                 res = s.run(
-                    "MATCH (m:PyModule) WHERE NOT m.file_key IN $present "
+                    "MATCH (:PyApplication {name: $app})-[:PY_HAS_MODULE]->(m:PyModule) "
+                    "WHERE NOT m.file_key IN $present "
                     f"OPTIONAL MATCH (m)-{DESCENDANTS}->(x) DETACH DELETE x, m "
                     "RETURN count(m) AS pruned",
+                    app=app_name,
                     present=present,
                 )
                 pruned = res.single()

test/test_neo4j_bolt.py

@@ -15,9 +15,24 @@
 
 from codeanalyzer.neo4j import project
 from codeanalyzer.neo4j.bolt import BoltConfig, bolt_writer
+from codeanalyzer.schema import PyApplication, PyCallable, PyModule
 
 from sample_graph_app import make_sample_app
 
+
+def _single_module_app(file_key: str = "appb/main.py") -> PyApplication:
+    """A minimal second application with its own (distinct) module file_key."""
+    fn = PyCallable(
+        name="main", path=file_key, signature="appb.main", return_type="None",
+        code="def main():\n    ...", start_line=1, end_line=2,
+        code_start_line=1, cyclomatic_complexity=1,
+    )
+    mod = PyModule(
+        file_path=file_key, module_name="appb.main", functions={"main": fn},
+        content_hash="h-b", last_modified=1.0, file_size=10,
+    )
+    return PyApplication(symbol_table={file_key: mod}, call_graph=[])
+
 pytestmark = pytest.mark.skipif(
     not os.environ.get("RUN_CONTAINER_TESTS"),
     reason="opt-in: set RUN_CONTAINER_TESTS=1 (needs Docker/Podman) to run the Neo4j bolt test",
@@ -105,6 +120,21 @@ def test_full_push_materializes_the_whole_graph_and_schema(driver, cfg):
     assert _num(driver, "MATCH (e:PyExternal) RETURN count(e)") >= 1
 
 
+def test_full_run_does_not_prune_another_applications_modules(driver, cfg):
+    """Regression for #45: a full-run push for one application must not prune the
+    modules of a *different* application sharing the database."""
+    bolt_writer(project(make_sample_app(), "app-a"), cfg, full_run=True)
+    before = _num(driver, "MATCH (:PyApplication {name:'app-a'})-[:PY_HAS_MODULE]->(m) RETURN count(m)")
+    assert before > 0
+
+    # A full-run push for a different application must leave app-a untouched.
+    bolt_writer(project(_single_module_app(), "app-b"), cfg, full_run=True)
+
+    after = _num(driver, "MATCH (:PyApplication {name:'app-a'})-[:PY_HAS_MODULE]->(m) RETURN count(m)")
+    assert after == before, "full-run push for app-b pruned app-a's modules (#45)"
+    assert _num(driver, "MATCH (:PyApplication {name:'app-b'})-[:PY_HAS_MODULE]->(m) RETURN count(m)") == 1
+
+
 def test_re_pushing_identical_analysis_is_idempotent(driver, cfg):
     rows = project(make_sample_app(), "sample-app")
     bolt_writer(rows, cfg, full_run=True)