[JetSquirrel]

Adds khonsu investigation save and reopen, so a line of inquiry can be kept and picked up later, with any change in the data flagged. The window doesn't save or reopen these files yet, so #34 stays open.

Merge order: #47, #48, then this. This branch is built on both, so its diff shows their work until they land. It targets main. Please merge these with merge commits, not squash or rebase, or each later branch stops containing the one before it (#55).

Updated for #55: nothing here needed changing, since a saved investigation doesn't use the rules. Tests now call khonsu plugin analyze aws exposure.

What it does

save writes a walk's starts and filters, a chosen path, a query and a dashboard to a versioned JSON file. It writes nothing to the graph, and it refuses to replace an existing file without --force.

reopen runs the walk again and reports what differs:

Field	Says
graph_state	unchanged, changed, or not_compared for a graph too large to hash
differences	What changed, in words
path_same	Whether the path still rests on the saved records
missing_seeds, target_missing	Saved records that have gone. Nothing stands in for them
unsure	Records found by an internal ID on a changed graph, which may now be something else

docs/investigations.md has the details.

Also fixes a sync bug

The first CI run on this PR failed and exposed a bug that was already in merge. A full sync removes nodes stamped before its own start, in whole seconds. Two syncs in the same second shared a stamp, so a node gone from the source stayed in the graph while its relationships were removed, with no warning. A real account is unlikely to sync that fast, but a saved-response or CSV source can.

Each sync's stamp is now later than any its source has written, so record_written_at can run a second or so ahead of the clock after quick repeat syncs. An older test slept to avoid the bug, and I removed those sleeps. That test is #[ignore]d by default, so the new test in tests/merge.rs is what guards this in CI.

Choices to review

• Change detection is a whole-graph fingerprint. [v0.4] Source-consistent snapshots and graph diff #37's source snapshots don't exist yet, so this hashes every record, leaving out internal IDs, sync times and plugin versions. A no-op re-sync stays unchanged and a rebuilt graph matches. The trade-off is that an unrelated change also reads as changed, and each save or reopen reads the whole graph.
• Large graphs aren't hashed. Above 200,000 nodes or relationships, only counts are compared. Equal counts give not_compared, never unchanged.
• A saved query is returned, not run. Reopening shouldn't start something expensive on its own.
• Files can hold personal details. The graph's path can include a user name, and queries are saved as typed. Source configuration and credentials are never written. The docs say to check before sharing a file.

Testing

• cargo test --locked --workspace passes on Windows, and CI will cover macOS. The golden file now holds the fixture's fingerprint, so CI also checks that the hash matches across platforms.
• End-to-end tests cover:
  • reopening on unchanged data, a no-op re-sync and a rebuilt graph
  • a changed value, a path that has gone, and a seed and target that have gone
  • a missing graph, and files with bad JSON, the wrong format, missing fields or a newer version
• The HawDB snapshot test now also checks the fingerprint, so an upgrade can't quietly make every saved file read as changed.
• Not tested: a graph over 200,000 records end to end. Only the comparison logic for that case has a test.

Issue status

For #34:

• Done on the CLI: restoring the path and filters, flagging source changes, versioned files, and tests for invalid metadata and a missing graph.
• Still to do: saving and reopening in the window, which "reopen after app restart" needs, along with restoring a dashboard or view state.

Refs #34

🤖 Generated with Claude Code