Complete compiler-owned graph snapshots and repository context

[samchon]

Campaign scope

This Draft is the single integrated implementation PR for mission #162. It carries the accepted issue cycle in dependency order:

• [Bulk index] Replace symbol-by-symbol LSP scans with compiler-owned snapshots #63 ? versioned Graph Snapshot Protocol, atomic content-addressed generations, exhaustive coverage/unresolved trust data through memory and MCP, and the TypeScript resident reference conversion
• [Bulk index][Rust] Export rust-analyzer HIR snapshots beyond SCIP #72?[Bulk index][Dart] Export analyzer AnalysisSession snapshots atomically #84 ? language-owned compiler/analyzer routes; TypeScript and Rust are implemented, and C/C++ [Bulk index][C/C++] Share one Clang compilation-universe provider #73 is next
• [Docs] The README documents two strict providers while the registry ships eleven #143 ? generated, fail-closed provider-support manifest and truthful README matrix
• Explore repository-context providers for repository-wide topology #159 ? sibling repository-context fact plane with pnpm, Cargo, Gradle and CMake adapters
• Make shipped-sidecar integrity tests package-complete and toolchain-independent #163 and Make cross-process request-log tests wait for completed marker writes #165 ? package/sidecar and cross-process test-integrity repairs

The PR remains Draft and mission #162 remains open. No merge, release or paid agent benchmark is authorized.

Current integrated state

Exact graph head: cc13fa0f49d9906f217552d01190a91c24b997d7.

The TypeScript producer is maintained in samchon/ttsc#1056, currently at 5829a3d5a0bae1d846b8c9c4d3cd15210182d577 with all producer CI checks green. The Graph consumer negotiates its native protocol-v1 shard transaction, validates project/config/producer/universe coordinates and content-addressed generations before publication, applies explicit upserts/deletes, retains the prior generation on failure, and preserves provenance, coverage, unresolved facts, diagnostics and MCP trust summaries. Published ttsc 0.23.0 remains an honestly labeled legacy full-dump fallback.

Rust #72 is implemented through the owner fork samchon/rust-analyzer#1 at exact producer commit 2850ecba80311bebd4cdaa9fedc5321533b5b1e7. The integrated consumer:

• accepts only the pinned fork version and builds that exact commit in the real experiment workflow with Rust 1.95 and rust-src
• validates complete reconstructed frames in an isolated store before applying any resident delta
• keeps restart cache frames unpublished until the restarted producer validates the raw checkpoint, then reconstructs public shards from raw HIR facts
• binds host-backed facts to exact checker/disk SHA-256 bytes while retaining bundled:/// checker identity without inventing a host disk identity
• accepts producer-owned HIR, file and re-export identities and validates all global edge endpoints
• preserves bounded retry, immutable generations, stale-base refusal, malformed-frame refusal and truthful stock SCIP/LSP/static fallbacks
• reports diskDigests alongside coverage, diagnostics, source digests, universe, unresolved, incremental and validated-checkpoint capabilities

SCIP, ordinary LSP and @samchon/graph-sitter remain compatibility paths. Bounded options still refuse whole-project strict providers instead of silently weakening their authority.

Verification

Exact graph/Rust integration evidence:

• pnpm.cmd coverage: 238 tests, 549.451 s, 100% line/function/branch coverage
• direct LCOV audit: lines 46,406/46,406, functions 1,542/1,542, branches 11,831/11,831; zero 0-hit records
• exact Rust producer release: 108 rust-analyzer tests, 41 slow-wrapper passes with 2 pre-existing policy ignores, all-target clippy with warnings denied, fmt/diff checks, and a clean release reporting 2850ecba8
• exact real mini-redis lifecycle: 1,256 nodes / 4,384 edges; cold, unchanged, body edit, create, rename, delete, Cargo config, expected rejection, retry and deterministic regeneration all passed
• direct exact-producer p95 over 20 samples: no-op 32.78 ms wall / 30 ms producer; body edit 95.55 ms wall / 75 ms producer; no-op emitted no delta and every edit retained the exact base generation
• producer exact-head Individual Self-Review: CLEAN
• graph exact-head Individual Self-Review: CLEAN; the preceding virtual-source digest finding was corrected and the complete coverage gate rerun

Current-head Graph platform and experiment CI is running and will be repaired before this campaign advances. Older red checks belong to superseded heads and are not acceptance evidence.

Remaining work

C/C++ #73 is next, followed by #74?#84 in the campaign DAG. Each route still owes its identity, semantic, lifecycle, platform, real-corpus and phase-separated performance evidence. Final integrated CI, fresh solo Self-Review, issue adjudication and renewed discovery remain required before this Draft can become merge-ready.

[samchon]

Commit c776501 — COMMENT. Outcome: implementation-free campaign claim verified against clean master. Claimed ready set: #63, #72-#84, #143, #159, and #163; mission #162 remains open. No product, test, documentation, workflow, benchmark, or generated artifact changed in this commit.

[samchon]

Commit: 22da7cc
Outcome: PASS for this coherent first implementation phase.

Verified scope:

• establishes #63's Graph Snapshot Protocol v1/common coverage, unresolved, immutable shard-store, dump/memory/MCP trust foundation with deterministic malformed/stale/cancel/delete/configuration regressions;
• completes #163's actual-package sidecar leak surface and toolchain-independent Go command oracles;
• completes #165's non-empty cross-process marker fence;
• corrects the current Rust SCIP claim to contains/references for #72/#143.

Validation: final pnpm.cmd coverage passed with enforced 100% lines, functions, and branches; focused protocol, dump, MCP trust, package boundary, provider command, Rust provider, and request-log lifecycle checks passed. Four solo Self-Review rounds completed for this phase; the final fresh round found no sound additional change.

Open work: this commit does not complete #63's resident reference conversion, #72-#84 final semantic owners, #159, #143's generated support manifest, integrated performance evidence, or mission #162. No merge/release/paid benchmark was performed.

[samchon]

Commit reviewed: 5db5830ea7340588d06babf687ec5dbc25fd54ba

Outcome: PASS for this corrective commit. This is not a merge-readiness claim for the campaign PR.

This commit resolves the pushed-head early-warning findings by:

• rejecting manifest movement without a shard delta and every successful generation-token reuse;
• running the shared semantic/provenance/source-manifest payload gate inside GraphSnapshotProtocol.Store before publication;
• closing NUL-delimited public identity and path boundaries;
• reporting every relationship family that can affect lookup, entrypoints, and overview results;
• preserving conservative legacy/fallback partial coverage while clarifying that zero published unresolved sites does not imply completeness; and
• making #163's malformed Go sidecar-manifest and absent-toolchain oracles independent.

Fresh solo Self-Review traced delete/retry atomicity, MCP output construction, explicit Store-root ownership, dump/provenance/source keying, and the changed tests. The final round found no further sound improvement in this commit.

Local verification on the exact committed source:

• focused snapshot, dump, MCP trust, provider-command/manifest, and registry tests: pass;
• pnpm.cmd build: pass (known unsafe-regex warnings only);
• pnpm.cmd coverage: pass in 511 seconds;
• c8 authoritative included-source report: 100% statements, branches, functions, and lines globally and for GraphSnapshotProtocol.ts, assertGraphSnapshotPayload.ts, parseGraphDump.ts, and graphTrust.ts individually;
• git diff --check: pass.

No new issue is closed by this correction commit. #63's resident Go or TypeScript reference conversion and the remaining #72-#84, #143, and #159 implementation DAG are still incomplete; mission #162 remains open. Merge is not authorized.

[samchon]

PASS for this corrective commit only.

Reviewed exact head f011c03 across the bounded Graph Snapshot Protocol generation pair, digest-based shard invalidation, public protocol gate, Go duplicate-edge evidence normalization, Python malformed-configuration lifecycle classification, regeneration diagnostics, and their direct regressions.

Local evidence on the exact source state:

• pnpm.cmd --filter @samchon/graph build passed;
• focused protocol and experiment-catalog features passed;
• the non-instrumented complete suite passed in 478 seconds;
• final pnpm.cmd coverage passed in 520.1 seconds at 100% statements, branches, functions, and lines, with no zero-count DA/BRDA record;
• git diff --check passed;
• fresh solo Self-Review found no further sound correction.

The host intentionally has no Go toolchain, so the committed Go unit regression and repeated real Go/Python lifecycle lanes remain CI gates. This review does not claim completion of #63, #80, any other language-owner issue, or mission #162. Draft status and the merge prohibition remain.

[samchon]

PASS — correction commit a5fcad19859cd6a1af41653cbc6f4c5a3779800d

This review covers this correction only. It removes the derived scip-go artifact digest from the Go build-universe/coverage-target identity, removes the now-unused artifact-digest contract, and proves that reordered corroboration documents do not rename an unchanged universe. It also repairs the real-language failure oracle so universe-dependent legacy coverage cannot masquerade as an independently changed semantic publication plane, narrowing the pinned Python result to the observed tolerated unchanged publication.

Local evidence on this exact source state:

• node --check tests/experiment/src/strict-lifecycle.mjs: PASS
• focused experiment-catalog, provider-command, and shipped-source features: PASS
• complete pnpm.cmd test: PASS (470,307 ms runner time)
• complete pnpm.cmd coverage: PASS (404,258 ms runner time), 100% statements/branches/functions/lines and no zero-count DA/BRDA record
• git diff --check: PASS
• fresh solo Self-Review: no further sound correction in this delta

The host has no Go toolchain, so the pushed Go compile/unit lane and repeated real Go/Python lifecycle jobs remain mandatory CI evidence. This commit completes no campaign issue; #63, #80, the remaining DAG, and mission #162 stay open. PR #164 must remain Draft and must not be merged without separate authorization.

[samchon]

PASS — CI compile correction 71721566a13636c018a35008c90ac85f82011f1d

This review covers only the one-line semantic correction in the Go regression fixture: the fixtureScipIndexer.Index receiver is now named because the preceding commit reads indexer.reverseDocuments. Hosted Ubuntu and macOS jobs on a5fcad1 both diagnosed the identical compile failure at main_test.go:693 (undefined: indexer). The product Go real-language experiment on that head passed, so this correction does not change product behavior.

Evidence:

• identical compiler diagnostic on Ubuntu job 90933195099 and macOS job 90933195217
• git diff --check: PASS
• exact receiver use and all fixture call sites re-read
• preceding exact source state already passed complete local test and 100% coverage; local host has no Go toolchain, so the new hosted Go unit lane remains the required compile evidence

This commit completes no campaign issue. #63, #80, the remaining issue DAG, and mission #162 remain open. PR #164 remains Draft and must not be merged without separate authorization.

[samchon]

CLEAN — final solo Self-Review of current integrated head 71721566a13636c018a35008c90ac85f82011f1d

I restarted the complete review after the final compile correction and re-enumerated the full 95e20c9...7172156 consequence surface: protocol/schema and atomic Store, dump/parser/memory/API/MCP trust propagation, strict/LSP/static fallback coverage, identity/source/provenance validation, Go analyzer/SCIP boundary/universe construction, real-language failure/regeneration oracles, public contract parity, package-sidecar and request-log regressions, commit trailers, Draft/merge boundaries, and every changed test. The final receiver-only commit correctly binds the ordering fixture and changes no product behavior. No sound correction or new issue candidate remains in the implemented delta.

Exact-head evidence:

• local complete test: PASS (470,307 ms runner time)
• local complete coverage: PASS (404,258 ms runner time), 100% statements/branches/functions/lines, no zero-count DA/BRDA
• hosted Test run 30561322330: PASS on Ubuntu, macOS and Windows, including Go sidecar tests and coverage
• hosted Experiment run 30561322532: PASS for every language lane, including Go regeneration and Python malformed-config lifecycle
• Socket checks: PASS
• exactly-one 7172156 early-warning pass: CLEAN
• git diff --check, local/remote/PR SHA, Draft state: PASS

This clean review accepts the current implemented correction surface only. The surviving implementation closes #163 and #165; #63, #72–#84, #143, #159 and mission #162 remain unfinished. PR #164 is therefore not merge-ready and must remain Draft; no merge is authorized.

[samchon]

Exact-head campaign review for be05d7c1a06cd450a1b348e96db9e5181e9c7873 (feat: convert TypeScript snapshots to graph protocol).

PASS for this commit's bounded reference-provider conversion. The resident ttscgraph path now frames complete compiler dumps as Graph Snapshot Protocol v1 transactions, reuses content-addressed source/dependency shards, emits explicit dependency deletion, publishes exhaustive fact-family coverage, preserves producer schema provenance, and keeps host warnings/validation inside the atomic pre-publication boundary. Local evidence at this exact source state: build passed; complete test suite passed (377,141 ms runner time); complete coverage passed (472,877 ms runner time, 100% statements/branches/functions/lines); focused protocol and native lifecycle tests passed; git diff --check passed.

This review does not authorize merge and does not claim #63 complete: #63 remains the parent of unfinished #72-#84, and #143, #159, and mission #162 remain open. Hosted exact-head checks are still running. No paid benchmark was run.

[samchon]

Exact-head campaign review for d02b5e7 (fix: preserve graph protocol uncertainty).

PASS for this bounded corrective commit. It resolves three accepted early-warning findings from be05d7c: registered ttscgraph fact families are now partial with explicit provider-gap evidence instead of unsupported complete claims; the store recomputes the source/configuration/dependency input-manifest digest from the reconstructed committed shards; and the selected dump.tsconfig must belong to the producer's build-universe config chain. Build and focused protocol, atomic ttscgraph lifecycle, malformed adapter, and dependency-deletion tests pass; git diff --check passes.

The fourth accepted warning remains open by design: current changed ttscgraph responses still build, serialize, parse, partition, and hash a complete graph. Therefore #63's invalidated-closure-proportional reference conversion is not complete, #72-#84 remain pending, hosted exact-head checks are running, and this review does not authorize merge.

[samchon]

Exact-head bounded review for 13da35ddbd471f285388720365e2fbe7e61bcf49.

Outcome: PASS for this correction only.

The public input-manifest helper now has the same identity semantics as atomic
shard assembly: byte-identical source/configuration/dependency inputs shared by
multiple shards contribute once, while the same file with conflicting checker
or disk digests fails closed. Regressions cover direct helper canonicalization,
direct conflict rejection, and a successful generation with one input shared
across source and coverage shards.

Validation:

• pnpm.cmd --filter @samchon/graph build
• pnpm.cmd --filter @samchon/graph-test build
• node tests/test-graph/lib/index.mjs --include=graph_snapshot_protocol
• git diff --check
• local HEAD, remote branch and Draft PR head all resolve to this exact commit

This review closes no mission issue. #63 remains open because the current
TypeScript producer still builds, serializes and partitions a complete graph for
every changed response; #72-#84, #159, #143 and mission #162 remain unfinished.
The pull request must remain Draft and must not merge.

[samchon]

PASS — bounded exact-head review for b6e8feb6628bc1dfbd1110becc2dbbdd1993a444.

Scope reviewed: the complete #159 repository-context slice from
13da35ddbd471f285388720365e2fbe7e61bcf49 through this exact head.

The change keeps repository topology in a sibling versioned fact plane instead
of weakening language-provider or GraphEdgeKind authority. pnpm, Cargo,
Gradle and CMake derive their supported topology only from the authoritative
model named in the public contract. Resident refresh publishes immutable,
content-addressed generations atomically; no-op, changed-input, failure,
repeated-failure, recovery, cancellation and stale-response paths are covered.
The typed MCP topology branch reports provenance and operation-scoped coverage,
bounds topology edges and file joins separately, and permits file joins only
across a stable current code generation. Static graph-file serving and
unavailable providers fail closed.

Validation reviewed:

• pnpm.cmd coverage: 468 tests in 404,132 ms; 100% statements, branches,
  functions and lines.
• Graph build, test build, application-contract parity, source-export
  convention, focused protocol/adapter/resident/MCP suites and
  git diff --check: PASS.
• Real local pnpm dogfood: 65 nodes, 109 declared edges; ten no-op refreshes
  returned the same dump identity at 54.26 ms p50 and 73.78 ms maximum.

No sound #159 correction remains in this bounded review. This PASS covers only
#159. It does not approve merge or claim completion of #63, #72-#84, #143 or
mission #162. The pull request must remain Draft while those scopes, integrated
CI/Self-Review and the separately authorized merge gate remain unfinished.

[samchon]

PASS — bounded exact-head review for
edd8bc94217f16241797a97ec964be4705370b08.

Scope reviewed: the pushed-commit early-warning corrections to #159 from
b6e8feb6628bc1dfbd1110becc2dbbdd1993a444 through this exact head. This
review supersedes the earlier #159 PASS where the accepted warning candidates
overlap it.

The composite resident source now compares complete provider state identities,
so a cancellation after provider-local commits cannot strand the published
composite at its prior generation when the retry reports provider no-ops.
Repository nodes and relations carry fact-level authority: pnpm separates
tool-resolved workspace membership and dependency resolution from declared
manifest facts, while Cargo, Gradle and CMake name owning-tool facts. The
protocol rejects unknown fact authorities and synthesized code-file joins
inherit their source node's authority.

CMake object-index references require codemodel major 2 and cmakeFiles major 1.
Reply freshness covers every owning cmakeFiles-v1.inputs entry, including
included .cmake modules. Bounded topology results report truncation when a
relation endpoint is omitted, and result guidance distinguishes empty,
truncated and complete answers.

Validation reviewed:

• pnpm.cmd coverage: PASS in 508.1 seconds with every test green and 100%
  statements, branches, functions and lines.
• Focused repository-context protocol, adapter, resident and MCP topology
  suites: PASS.
• Graph build, test build and git diff --cached --check: PASS.
• pnpm.cmd parity requires an explicit external samchon/ttsc reference
  checkout and was therefore not a runnable standalone local gate; the
  application-contract parity tests in the complete suite passed.
• Local HEAD, remote branch and Draft PR head all resolve to this exact commit.
• The commit ends with the exact required line:
  Close #159: Explore repository-context providers for repository-wide topology.

No sound correction remains in this bounded review. This PASS closes only the
implemented #159 slice when merged. It does not approve merge or claim
completion of #63, #72-#84, #143 or mission #162. Pull request #164 must remain
Draft while those scopes, integrated CI/Self-Review and the separately
authorized merge gate remain unfinished.

[samchon]

PASS — bounded exact-head review for
15fc4d558b3900ff6c9770799657edfb6f95293c.

Scope reviewed: the second pushed-commit early-warning correction to #159 from
edd8bc94217f16241797a97ec964be4705370b08 through this exact head.

Repository protocol v1 now applies its declared/tool-resolved publication
boundary to the exact node and relation facts as well as the provider hello.
Unknown and inferred authorities have separate rejection regressions.

Bounded topology assembly retains the ordered query seeds before filling any
remaining capacity with adjacent nodes. The exact source query with an
inbound, earlier-sorted workspace and limit: 1 proves that the requested seed
cannot be displaced. Relations whose endpoints do not fit still make the result
explicitly truncated.

CMake File API freshness now refuses an owning cmakeFiles-v1.inputs entry
that has disappeared, as well as one newer than the index. A rename regression
proves that an obsolete codemodel cannot survive a deleted or moved included
module. The public topology contract describes truncation over omitted nodes,
relations and file joins.

Validation reviewed:

• pnpm.cmd coverage: PASS in 517.9 seconds with every test green and 100%
  statements, branches, functions and lines.
• Focused repository-context protocol, adapter, resident and MCP topology
  suites: PASS.
• Graph build, test build and git diff --cached --check: PASS.
• Local HEAD, remote branch and Draft PR head all resolve to this exact commit.

No sound correction remains in this bounded review. This PASS is a follow-up to
the exact #159 closing commit and does not approve merge or claim completion of
#63, #72-#84, #143 or mission #162. Pull request #164 must remain Draft while
those scopes, integrated CI/Self-Review and the separately authorized merge
gate remain unfinished.

[samchon]

Exact-head review: 2f3a8b2

PASS for the bounded #159 follow-up only.

The commit closes the three accepted early-warning gaps on the previously
pushed topology slice:

• topology lookup now preserves the exact ID/name/coordinate contract instead
  of allowing an earlier fuzzy containment match to consume the bound;
• CMake File API selection considers both successful and error replies by
  generation, fails closed on the newest error and gives an error precedence
  at an identical generation; and
• stateless CMake reply keys require exact major-version keys rather than
  prefix matches.

The focused repository-context and MCP regressions pass. The complete
pnpm.cmd coverage gate passes on the integrated working state with every
test green and 100% coverage: 43,357/43,357 lines, 1,417/1,417 functions and
11,014/11,014 branches.

This review does not pass or close #143, #63, or any #72-#84 language mission,
does not convert the pull request from Draft, and does not authorize merge.

[samchon]

Exact-head review: da540fd

PASS for the bounded #159 follow-up only.

The commit closes the accepted case-folding early-warning gap. Exact topology
queries now compare the trimmed request to node IDs, names and coordinates
without changing case. The regression places both source-helper and
case-distinct Source before source, then proves query: "source" with
limit: 1 retains only the exact-case node.

The focused MCP topology and provider-support regressions pass. The complete
pnpm.cmd coverage gate passes on the integrated working state with every
test green and 100% coverage: 43,358/43,358 lines, 1,417/1,417 functions and
11,014/11,014 branches.

This review does not pass or close #143, #63, or any #72-#84 language mission,
does not convert the pull request from Draft, and does not authorize merge.

[samchon]

Commit early-warning pass for 02c357410c1e8c5248f2c2f890fa6e72f322c5da (declared surface: c01a42d..02c3574; this is not the campaign's eventual whole-PR Self-Review).

FINDING ? Unix/macOS branch coverage is still not excluded by the moved hint.

The runtime rewrite is semantically equivalent: both versions return externalGraphFile(absolute) exactly when path.isAbsolute(relative) is true and otherwise return relative. The existing Windows-only regression also exercises a real cross-volume file: URI and verifies both the real manifest path and opaque bundled:///clang/filesystem/... graph identity.

The coverage behavior is not equivalent to the intended accounting, however. In the pinned v8-to-istanbul@9.3.0, an own-line /* c8 ignore next */ marks the following source line ignored. V8's uncovered range for a false multi-line guarded if starts on the if line and spans its body; here line 803 is not ignored, while only the return on line 805 is. A read-only inspector probe using the installed converter and this exact multi-line shape produced an uncovered Istanbul branch with count 0. That matches the prior exact-head bccefe4 Ubuntu/macOS failures at 99.99% branch coverage. Exact-head test run 30809086113 for 02c3574 has not yet reached Coverage, so it supplies no contrary evidence yet.

A precise read-only probe of the narrow alternative confirms the pinned converter's behavior: put /* c8 ignore next */ immediately before a one-line if (path.isAbsolute(relative)) return externalGraphFile(absolute);, then retain return relative; on its own next line. The guarded Windows-only range is ignored while the Unix fallthrough remains measured.

[samchon]

Commit early-warning pass for e9aba080c80cf0bc3fdd3f07105f8b903b0a70a7 (declared surface: 02c3574..e9aba08; this is not the campaign's eventual whole-PR Self-Review): CLEAN.

The one-file correction is runtime-equivalent. Both forms call externalGraphFile(absolute) exactly when path.isAbsolute(relative) is true and otherwise return relative; no source identity, URI, digest, graph edge, public contract, or test behavior changed.

Coverage scoping is now exact under the pinned c8@10.1.3 / v8-to-istanbul@9.3.0 implementation. Its source parser marks an own-line /* c8 ignore next */ comment and exactly the following source line ignored. Here those are lines 803-804: the comment and one-line Windows cross-volume/UNC guard. The separate line 805 return relative; remains ignore=false, so ordinary Unix/same-filesystem fallthrough stays measured. The converter derives branch suppression from the mapped original branch start line, so the unavailable guarded range is covered by the hint without hiding the fallthrough statement.

Independent evidence:

• Previous exact-head run 30809086113 on 02c3574 passed Build and Test on Ubuntu, macOS, and Windows; only Ubuntu/macOS Coverage failed, identifying the old Windows-only return at CppGraphSnapshotAdapter.ts:806, while Windows Coverage passed.
• The existing Windows-gated regression constructs a real foreign-drive file: URI and asserts both the host manifest identity and opaque bundled:///clang/filesystem/... graph identity, so the real guarded behavior remains tested where executable.
• Exact e9aba08 focused C++ adapter/client test passed locally in 18.3 seconds.
• Exact e9aba08 focused c8 run for CppGraphSnapshotAdapter.ts passed at 100% statements, branches, functions, and lines.
• git diff --check 02c3574..e9aba08 passed.

Exact-head hosted test run 30810863191 was queued/in progress at review time and had not yet reached Coverage, so it is not claimed as completed evidence here. No actionable runtime, coverage-integrity, test, documentation, or contract finding remains in this bounded commit. Issue #73's broader accepted implementation is unchanged; mission #162 and the eventual integrated Self-Review remain open, and PR #164 must stay Draft.

[samchon]

Commit 246d3193 — Open every changed feature case with its contract comment.

What it landed. Case-opening contract comments on the fourteen feature suites this cycle adds or modifies. Comments only: no assertion, fixture, or behaviour changed.

Why it exists. A complete solo Self-Review over the whole origin/master...HEAD diff (182 files, 25,735 insertions) found that fourteen suites opened with no case-opening doc comment, which the development skill requires for every new or modified case. Six of them are new suites introduced by this pull request:

Suite	Kind
test_rust_hir_client_restores_retries_and_fails_closed	new
test_rust_hir_snapshot_adapter_fences_generations	new
test_repository_context_protocol_commits_atomic_shards	new
test_repository_context_adapters_preserve_authoritative_models	new
test_resident_repository_context_is_atomic_and_retryable	new
test_mcp_topology_fences_file_joins_by_code_generation	new

The remaining eight are suites this pull request modified. An earlier round closed three members of this defect class; this closes the rest.

Each comment names the invariant the case locks rather than restating the filename — the seam neither side can see alone, the failure that leaves no trace in a result, or the condition whose absence is indistinguishable from success.

Issues resolved. None. This is a review correction inside the existing cycle; the closing set is unchanged.

Everything else in the diff survived the round. The snapshot protocol store and its coverage/unresolved fences, the Rust and Clang adapters and clients, the ttscgraph native shard store, the repository-context plane and its resident merge, the indexer/LSP/MCP/structure/typing changes, the generated provider-support manifest and its CI check, the experiment catalog and provisioning, and the Go sidecar edge-evidence canonicalization.

Local verification. pnpm coverage on this tree: 239 tests, 100 percent line, function and branch coverage. The full pnpm test suite passed at 239 tests in 1,337.7 s.

Recorded, not fixed here. The solo campaign development document and the pull-request skill both state that .github/workflows/experiment.yml sets cancel-in-progress. It sets no concurrency block at all and carries the opposite comment. The inaccuracy predates this pull request and is outside this review's declared surface, so it is a candidate for the next full-scope discovery round.

[samchon]

Commit 53e70f12 — Build the pinned Clang producer with the whole runner. Red-CI repair.

The failure. Both producer-building lanes on 6d24b12 were killed by the job timeout, which GitHub records as cancelled: c LSP ran 90m14s and cpp LSP 90m16s against the 90-minute bound. Every other lane on that head was green, including the pinned-fork rust LSP job and all three platform lanes of test.

Diagnosis, from job 91753078230's own log rather than from inference.

Observation	Value
LLVM build start	[1/3125] at 16:53:43
Progress when cancelled	[2431/3125] at 18:18:48 — 77.8 % in 85 minutes
Linear extrapolation of the complete build	≈ 109 minutes
Job start to build start	9 minutes (checkout, install, package build, apt toolchain, shallow producer fetch, CMake configure)
OOM / allocation-failure / memory warnings	none

Cause. tests/experiment/src/setup-language.mjs built the fork with cmake --build --parallel 2 — a bare literal in a file that comments every other deliberate constraint. GitHub's hosted ubuntu-24.04 runner has four vCPUs, so the build ran on half the machine. clangd is the single linked target and the log records no memory pressure, so the constant bought nothing but wall clock.

Repair. --parallel now passes os.availableParallelism(), sizing the build by the machine it runs on instead of by a constant.

A repair that was tried and rejected. The first attempt also widened the job bound for the two compiler-building matrix rows. test_workflows_use_current_core_action_runtimes rejected it, and its contract comment names this exact situation:

A per-language exception is how a budget stops being a boundary: the one lane that needed 90 minutes needed it because the provider had been serialized, so raising the budget was preserving the cause rather than bounding it.

The 45-to-90 raise in 887c3b2 was already that move. .github/workflows/experiment.yml is unchanged in this commit; every language still shares one hang boundary, and only the cause was changed.

Local verification. test_workflows_use_current_core_action_runtimes, test_experiment_corpora_are_commit_pinned and test_shipped_source_does_not_leak_benchmark_corpus_names pass. No test, document, or contract pins the parallelism literal. The complete pnpm test suite passed at 239 tests before commit.

Open risk, stated rather than assumed. With the build near 55 minutes at full parallelism plus nine minutes of setup and the real-corpus lifecycle run after it, the repaired lane is expected to fit inside 90 minutes but without wide margin. The run now queued on this head is the measurement. If it still exceeds the bound, the next step is a further reduction of build work — a producer artifact cache keyed by the pinned commit is the obvious candidate, and this repository has no actions/cache convention yet — and not another raise of the boundary that contract protects.

Issues resolved. None. Issue #73 was already closed by 3f069fb; this repairs the lane that proves it.

No merge is authorized from this head. The settled head still owes green ordinary CI and a fresh complete Self-Review round.

[samchon]

Commits edecb85, f4b6995, 748b00f — pushed together; recorded here per commit.

---

edecb85 — Correct every contract comment to what its case actually pins

The required commit early-warning pass on 246d319 read each new comment against the body it sits above and found eight of fourteen describing behaviour their case does not have. Every one reproduced:

Suite	The claim	What the file shows
mcp_server_exposes_inspect_code_graph	drives a cold escape request	escape occurs once — inside the comment
contract_fixture_covers_every_...	whole edge union, in protocol order	stored kinds exclude traversal-only ones; both sides .sort()ed
repository_context_adapters_...	unavailable model → unsupported coverage	unsupported occurs once — inside the comment; every such path throws
shipped_source_does_not_leak_...	no corpus name reaches a published artifact	the published README names all thirteen deliberately; the walk skips .java
lsp_client_closes_servers_...	escalation for a server that never answers	that server answers initialize; the assertion is that no escalation happens
rust_hir_client_restores_...	a refusal retains the previous good generation	both refusals use fresh clients and assert nothing is resident
workflows_use_current_core_...	—	repeated the rationale already stated above MAINTAINED
application_exercises_every_request_branch	catches an arm nothing runs	both compared lists are hand-maintained; branch coverage is that guard

This was a Self-Review failure on my part: the comments were written without checking each claim against the assertions. A comment that is merely evocative is worse than none — the next reader has no reason to doubt it. Each now states only what its case establishes, and every replacement claim was re-verified against the body.

The pass also found joins-file to be the one boundary the repository-context protocol comment claimed without a negative twin. Rather than weaken the comment, the twin was added: a join naming a file the shard never declared is now rejected.

---

f4b6995 — Bound the producer build by memory and stop overclaiming its evidence

Two corrections the pass on 53e70f1 earned. The comment stated a ~55-minute and a ~109-minute build as fact; neither was observed, and the documentation skill asks that measured evidence be distinguished from extrapolation. It also read the absence of allocation failures as proof of memory headroom — but Linking CXX executable bin/clangd appears zero times in that log, because the job was cancelled before the link, which is exactly where an LLVM build peaks. Parallelism is now bounded by total memory as well as core count, and the decision is pinned so a fixed literal cannot silently return.

---

748b00f — Restore the pinned Clang producer instead of rebuilding it (red-CI repair, second attempt)

The parallelism repair did not make the lane fit; both rows were cancelled again at exactly 90 minutes on 53e70f1. The second run measured why:

Job count	Same 2,431 of 3,125 steps
--parallel 2	85.1 min
--parallel 4	81.2 min

A 4.8 percent gain for twice the jobs: four vCPUs are two physical cores, roughly 110 minutes is the floor, and no job count moves it. Serialization was real waste but never the constraint — so this became the second patch aimed at one failure, which is where the development skill says to repair the owning design instead.

The design is that two matrix rows rebuild an identical pinned commit from scratch on every push, about two CPU-hours per workflow to reproduce bytes that cannot have changed. They are restored now, keyed by the producer commit and the build recipe so a bump or recipe edit misses by construction. A restored install is still untrusted input and is admitted only by the evidence a fresh build must also produce — both installed names reporting the pinned commit, and the resource-header tree resolving exactly once. Any missing file, unreadable tree, unexpected version or thrown error falls back to building.

The job bound moves to 150 minutes for exactly the two rows that build a compiler and stays at 90 for the other fourteen.

Change-integrity call-out. test_workflows_use_current_core_action_runtimes was written specifically to refuse this widening, and its stated reason was a cause — the lane wanted more time because its provider had been serialized, so raising the budget preserved the cause. Measurement retired that premise. The contract was changed deliberately, and its comment now carries the measurement rather than the retired reason. The assertion is the exact expression instead of a single number, which is stricter than what it replaced: a third language cannot reach the wider bound, and a different number cannot appear, without editing that line.

Also caught while doing it: the cache step was written from memory two majors behind upstream. actions/cache is at v6 here. The guard missed it because cache was absent from MAINTAINED — the same "a policy only covers what it was born with" hole that map's own comment documents, one level down. cache: 6 is now in MAINTAINED, and all six pinned majors were verified current against upstream.

Recorded for the next discovery round: MAINTAINED is compared only against the workflows, never against upstream, so a stale entry there passes silently.

---

Local verification for this head. pnpm coverage: 239 tests, 100 percent line/function/branch. pnpm test: 239 tests, twice. Focused workflow and catalog contracts pass.

Issues resolved. None. All three are review corrections and CI repair inside the existing cycle; the closing set is unchanged. No merge is authorized from this head.

[samchon]

Commits 919a817 and cda5a4a — pushed together; recorded per commit.

---

919a817 — Give the C/C++ producer the time its corpus index needs (red-CI repair, third attempt)

The c lane failed inside the widened bound, not at it — 63.5 minutes of 150. So the build was never the remaining problem:

C/C++ clang graph: producer did not become ready within 180000 ms: graph snapshot is not ready: 62 translation units are still indexing

A whole-compilation-database producer is not ready when it starts; it is ready when clangd has background-indexed every unit the database registers. The 180-second default expired with 62 of libuv's units outstanding, the client fell back exactly as designed, and the row lost the strict provenance it exists to prove. Both rows now state readyTimeoutMs: 1_200_000 and timeoutMs: 600_000 — far above the few minutes observed, far below the job timeout, and still bounds, so a producer that never becomes ready fails the row rather than hanging it.

A correction to what the previous two commits claimed. The same run refutes them:

Job count	Result
--parallel 2	2,431 of 3,125 steps at 85 min, killed unfinished
--parallel 4	complete, [1/3125] → linked clangd, 56.1 min

The earlier "4.8 percent gain, ~110-minute floor no job count moves" compared 2,431 steps to 2,431 steps. Ninja steps are not equal work — an LLVM build front-loads its heavy translation units and its tail is cheap — so a prefix comparison measures the slow part against itself. Sizing by the machine roughly halved the build. The 150-minute bound stands, but on the measurement rather than the retired claim, and every copy of that claim is rewritten.

Neither the cache nor the widened bound could have prevented this failure: it happens after the build, and no run had ever reached that step before.

---

cda5a4a — Stop the topology plane claiming more than it holds

A fresh Self-Review round over the integrated head, hunting in product code for the defect the commit passes kept finding in tests: a sentence claiming more than the code establishes. Three findings, all in the arm this cycle added.

#	Finding	Why it matters
1	The join-unavailable reason named the wrong cause	Three conditions withhold joins, two had sentences. A caller whose planes describe different repositories was told the code generation moved — a race that never happened, in the field a reader consults precisely when expected joins are missing
2	next returned answer over an empty result	The contract defines answer as "the result carries the evidence; stop". Every other operation calls an empty match outside; lookup says so in as many words
3	The public MCP contract documented provenance/coverage/unresolved as "absent only for escape"	The topology arm never builds a trust envelope, so all three are absent there too — and the tool description an agent reads is generated from these comments

Finding 3 was corrected in three places that must agree: the structure, the README excerpt that embeds it, and the parity rule that holds them together.

Two things verified rather than found, worth recording because both looked suspicious: the Gradle sidecar's "no build task was invoked" holds (only connection.getModel(...), no newBuild/forTasks/run), and the Rust adapter's diskDigest = checkerDigest is not an unverified disk claim — movedProviderSource re-reads every file and refuses any provider digest disagreeing with the coordinator's own hash.

Guards tightened where the fourth pass showed them still open. The parallelism pin watched only the build argv while the configure call could cap concurrency from the same region; the cache save's key was asserted nowhere, so saving under a key the restore can never hit passed everything. Both now match comment-stripped sources, and the workflow is read as ordered steps so restore and save are pinned by identity, key, guard and position around the build.

Written down as what they are: tripwires, refusing the regressions that have actually happened here and their nearest spellings — not proofs. Three rounds of trying to make a text-matching assertion adversarially complete each produced a new spelling that evaded it.

---

Local verification for this head. pnpm coverage: 239 tests, 100 percent line/function/branch — twice, on successive trees. Focused runs for every touched suite.

test workflow on cda5a4a: green on Ubuntu, Windows and macOS.

Issues resolved. None. All of this is review correction and CI repair inside the existing cycle; the closing set is unchanged. No merge is authorized until the same head has green ordinary CI and a complete clean review round.

[samchon]

Commits 66ca4d9 and 48fb9bf — round three of solo Self-Review, plus the C/C++ diagnosis.

---

66ca4d9 — Tell a topology caller which of four things went wrong

The reason split in cda5a4a covered the two conditions a test reached and merged the two it did not. The merged pair contained the branch production takes most.

startServer strips the generation token from a --graph-file dump on purpose — nothing revalidates it against the current checkout — so inputGeneration is always undefined there, and every topology call on a static server was told the code generation moved while topology was loading. Nothing moved. The token was withheld deliberately. It was also the one reason no test asserted; all four are pinned now.

The empty-result verdict was likewise too coarse. Topology matches by exact equality against an id, a name or a coordinate — no scoring, no near miss — so a query that misses against a model full of nodes is a spelling, not an absence. outside tells a caller to escape and read source, when the same call without the query would have listed everything the model holds. That case is clarify now; outside is kept for the one case that earns it, a plane with no nodes at all.

---

48fb9bf — Size the C/C++ waits for nine refreshes, not one

The ready timeout raised in 919a817 was a per-refresh ceiling treated as a per-row budget. CppGraphClient re-arms it on every refresh(), and the strict lifecycle issues nine. Nine cold waits at twenty minutes exceed the job bound on their own, and a row that dies there dies without a diagnosis. Ten minutes and five now, with the comment stating plainly that these bound a refresh and not the row.

The parallelism claim is retracted properly this time. Two commits ago it said "roughly half"; before that, "barely five percent". Both were read out of numbers that cannot support either — 2,431 steps in 81.2 minutes and a complete 3,125-step build in 56.1 cannot both describe four jobs, and the two-job run was killed unfinished so its total is unknown. What the data does show:

Same commit, same job count, one workflow	Build
one runner	56 min
another runner	107 min

Hosted-runner variance of about 2×, which swamps whatever that line is worth. Sizing by the machine is justified on principle — a constant leaving half a runner idle is wrong wherever it runs — and the effect size is now recorded as unmeasured.

---

What the C/C++ lane is actually failing on

The cda5a4a run named it in both rows:

##[error]The runner has received a shutdown signal.

Not the job timeout (c 103.6 min, cpp 81, against 150) and not this repository's code. GitHub reclaimed the hosted runners. The lines before it matter more:

05:26:57  @samchon/graph: indexing with clangd-snapshot(c)
05:31:44  runner shutdown

The strict provider was selected and indexing — no 180-second fallback, no lost provenance. The raised ready timeout did what it was raised to do; the row was killed mid-index by the host.

Both rows reached Save the pinned Clang producer: success first. That is what moving the save ahead of the corpus run bought: a preempted experiment still leaves a valid producer cached, so a re-run restores in seconds rather than rebuilding for ninety minutes — and a job that short is barely exposed to preemption at all.

That also promotes a limitation recorded earlier into the deciding factor: the cache key hashes CPP_CLANG_PRODUCER_COMMIT.ts, catalog.mjs and setup-language.mjs whole, while the bytes depend on two things inside them. Every commit touching those files — including both in this round — invalidates the save the previous run just made and buys another cold job and another chance to be reclaimed. Narrowing the key by isolating the recipe is the right fix and does not belong mid-convergence; what belongs is to stop editing those two files, let one run save, and re-run from the cache.

---

Local verification. pnpm coverage: 239 tests, 100 percent line/function/branch — three consecutive runs across this round. test on 48fb9bf: green on Ubuntu, Windows and macOS.

Issues resolved. None; the closing set is unchanged. No merge until the same head has green ordinary CI and a complete clean review round.

[samchon]

The C/C++ lane's cause, measured — and it is outside this repository

Commits 587c6f1, bed491b, 175bfeb.

What the instrument found

Eight runs had reported only The runner has received a shutdown signal, with no diagnosis of their own. bed491b stopped proposing explanations and printed what the host had left every ten seconds. The next run gave the number:

lane	free memory in the last sample before shutdown
c	173 MiB of 15,990
cpp	35 MiB of 15,990

with a sawtooth before it — 311, 814, 1022, 1873, down again — which is what repeated out-of-memory kills look like from outside the process being killed. The runner agent was the last victim.

The width test, and why it was set up to decide

175bfeb bounded clangd's -j by host memory at eight GiB per worker, which on this host resolves to one. That figure was chosen to be decisive rather than to look sized: sixteen gigabytes was not enough at four workers, so shaving off a single worker would have failed again and explained nothing.

It failed again, and the trace says why with the alternative excluded:

09:55:44  indexing with clangd-snapshot(c)
09:55:52  12,668 MiB free      ← host healthy when the producer starts
09:56:42  11,375 MiB
09:57:42   9,051 MiB
    …
09:59+       459–1,226 MiB     ← never recovers

About twelve gigabytes consumed at a worker count of one. Concurrent AST workers plateau at roughly worker-count times per-unit cost; a single worker cannot produce a steady twelve-gigabyte climb. What climbs steadily while indexing a whole compilation database is retained state, and worker width does not bound it — which is the limit 175bfeb wrote into the code before the run.

The consumer is not the one holding it: the deaths occur while the producer still answers "not ready", before any snapshot is delivered.

Six explanations, five retired by measurement

#	proposed cause	what refuted it
1	build serialization	real waste, but the build then completed in 56 min and the lane still failed
2	job bound too small	failed at 76 and 136 min, inside 150
3	ready timeout	fixed and working — indexing with clangd-snapshot reached, no fallback
4	host preemption of long jobs	a five-minute job died the same way
5	polling pressure	ninety times fewer requests, and cpp died sooner
6	producer memory retention	measured, alternative excluded

Three of those commits' own justifications were also wrong and were corrected in place — the parallelism effect size, the retry mechanism, and the deadline overshoot.

Status: blocked, not complete

Everything this cycle owns is ready: test green on Ubuntu, Windows and macOS; five consecutive local pnpm coverage runs at 239 tests and 100 percent line/function/branch; a clean fourth Self-Review round; the closing set reconciled against HEAD with a surviving fix for each of #72, #73, #143, #159, #163 and #165 and no revert in the range.

The one remaining gate is a lane whose failure cannot be repaired here. Reporting that as blocked rather than as done is what the campaign requires.

The options are the maintainer's, because each changes something an agent should not decide alone:

1. Bound the producer's retention in samchon/llvm-project.
2. Run the two rows on a larger hosted runner — keeps both corpora and the evidence intact.
3. Shrink the C and C++ corpora — weakens what the rows prove.
4. Accept that #73's route is not demonstrable on a 16 GiB hosted runner, and record that against the issue.

No merge is taken on this head.