CLI affected and god-nodes never refresh the strict hook's orientation stamp nor write the query ledger #3053

Summary

The strict read hook's admission contract is the "recently oriented" stamp: running graphify query / path / explain touches graphify-out/cache/last_query_stamp, and while it is fresh the strict guard lets raw file reads through (CHANGELOG 0.9.19). Those three verbs also write the opt-in query ledger (graphify/querylog.py, the GRAPHIFY_QUERY_LOG* gates).

Two other read-only graph verbs do neither:

• graphify affected — cli.py elif cmd == "affected": (line 1189 on current v8): loads the graph, prints format_affected(...), and returns. No _touch_query_stamp, no querylog.log_query.
• graphify god-nodes — cli.py elif cmd in ("god-nodes", "god_nodes"): (line 1257 on current v8, wired by affected/reverse-dep false negatives; god_nodes not a CLI subcommand; --output flag ignored on extract (v0.9.18, Windows) #2004): computes and prints the hubs, and returns. Same two omissions.

Compare the query verb right above them: querylog.log_query(...) at cli.py:1177 and _touch_query_stamp(gp) at cli.py:1187 on the same success path.

Why it matters

• An agent that orients through affected ("what breaks if X changes") or god-nodes ("what are this graph's hubs") is still treated as blind by the strict guard: its next raw read is denied — after it already consulted the graph. This is exactly the failure mode of Orienting through the MCP server never refreshes the strict hook's "recently oriented" stamp — agents that consult the graph via query_graph still get their first read denied #3039, one door over: there the MCP tools didn't stamp; here two of the CLI's own verbs don't.
• The runs are also invisible to the query ledger when logging is enabled, so any audit of graph usage undercounts real orientation.

Expected

affected and god-nodes are graph consults exactly like query/path/explain: a successful run should refresh the stamp and append a ledger line (kind affected with the impacted-node count; kind god_nodes with the returned-hub count), fail-silent like the existing call sites, ledger still opt-in.

Community check

Searched issues/PRs for "affected stamp", "god-nodes stamp", "last_query_stamp", "strict hook affected", "querylog affected", "query ledger orientation": no prior reports; the nearest neighbors are our own #3039/#3042 (the MCP half of the same defect class).

We run graphify in production on an agent-operated Obsidian ops vault where a deny-hook enforces graph-first reading; this surfaced in tonight's audit of which doors refresh the stamp. Fix PR with tests to follow shortly.