fix(watch): preserve pending semantic update flag

[theSatvik]

Closes #3294.

Problem

_rebuild_code() is an AST-only operation, but each of its three successful exit paths deleted graphify-out/needs_update. That flag records pending semantic re-extraction for changed documents, so a later code rebuild could silently mark unrelated document work as complete even though no LLM-backed extraction ran.

Change

• Stop deleting needs_update from the no-cluster, unchanged-topology, and clustered rebuild paths.
• Add a parameterized regression test covering all three paths.
• Preserve the flag contents as well as its existence, so the code-only pass cannot rewrite pending semantic state.

The semantic workflow remains responsible for clearing the flag after it actually resolves the pending work.

Verification

• Regression test before fix: 3 failed (flag deleted on all paths).
• uv run --frozen pytest tests/test_watch.py -q --tb=short: 145 passed, 3 skipped.
• uv run --frozen pytest tests/ -q --tb=short: 5302 passed, 11 skipped.
• All five tools.skillgen CI guards passed.
• uv run --frozen ruff check graphify/watch.py tests/test_watch.py passed.
• uv run --frozen graphify update . completed successfully.

[graphify-labs]

Graphify reviewed this change.

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).

Formal verification. No changes could be formally verified in this run.

---

Graphify review — findings

Stops _rebuild_code from deleting the needs_update flag, so a code/AST rebuild no longer wipes out pending semantic work (e.g. queued doc paths) recorded there. Adds a parametrized test covering no-cluster, unchanged-topology, and clustered-rebuild paths that asserts the flag's contents survive a rebuild.

No blocking issues surfaced.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 567 functions depend on the 391 functions this change touches.

Health — this change adds coupling hotspots:

• new: _rebuild_code() — 114 callers, 50 callees
• new: dispatch_command() — 2 callers, 123 callees
• new: watch() — 5 callers, 7 callees
• new: _reconcile_graph_html() — 6 callers, 5 callees
• new: _reconcile_existing_graph() — 1 callers, 8 callees
• new: _reconcile_markdown_links() — 1 callers, 6 callees
• new: test_poisoned_manifest_is_healed() — 0 callers, 6 callees

Verification — 567 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 403 function(s) in the blast radius were not formally verified this run

Formal verification

Could not verify: Could not verify \_rebuild\_code.

The verifier did not have enough to check \_rebuild\_code, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: parameter `watch_path` is annotated `Path` — outside the synthesizable primitive/collection set

· 7 more finding(s) on lines outside this diff (see the check run).