JavaScript instance and inherited members, `super.m()`, a member assigned in a block,
and a class type parameter blocking its name file-wide all abstain today. Each entry
says why and what was tried, so turning one into an edge has to come with a real rule.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
A TSX script's own component, a nested namespace sibling and a rest-parameter callee
all resolve to their exact oracle targets in both routes, so those known gaps are
required now and the parameter shadow stays a hard negative.
The imported annotation pinned USAGE, which es_usage_crossfile_typescript forbids at
such an occurrence. It requires USES_TYPE at that span, and the second-file decoy and
local same-named class are checked on USES_TYPE too. The namespace constructor call
remains a counted gap.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
mkc_c8_typescript_constructor_samefile and lrp_ts_s3_constructor name the declared
`constructor` as the target of `new Widget(name)`, and the edge went to the Class,
which the quality harness reports as WRONG_OCCURRENCE. A class that declares a
constructor now answers with it, in the same file and through an import. A class
without one stays the Class node, the materialized callable ts.same-file-constructor
requires.
Oracle changes, each because a rule is true now and a stricter entry replaces a gap:
- lsp_resolution_probe: implicit `new` targets the Class, required, not an
unmaterialized gap; s3 requires Widget.constructor. Its three TS annotation entries
pinned USAGE, which es_usage_crossfile_typescript forbids at the same occurrence;
they require USES_TYPE at that span, and the b/types.ts decoy is checked on USES_TYPE.
- matrix_known_classes, matrix_new_constructs, node_creation_probe: TS calls that are
now proved are required instead of counted gaps. Their forms and targets are unchanged.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
`accept(target); const target = () => {};` in one scope reads the const in its dead
zone, and `var` reads undefined, so no reference there names the function. The
binder treated a function value as visible everywhere, which published the edge
pipeline_cross_file_method_defines_method_venue_parity forbids. A closure still names
it, its own body included.
Tests: the CommonJS contract now counts the promoted case as found, and the JSX oracle
requires the USAGE that `<UI.Widget />` genuinely has: it reads that namespace member,
while the invocation stays a counted gap.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
`private opaque: unknown = new Tool()` then `this.opaque.fire()` was proved to
Tool.fire: an annotation that is not a plain type name fell through to the
initializer. tslsp_field_new_initializer_issue514 pins that it must abstain. The
initializer only decides a field with no annotation at all.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
`{ [K in Keys]: K }` and `T extends Array<infer U> ? U : never` bind K and U where
they are written. With USES_TYPE now walking every type name, both reached a
same-named module type, which is a wrong edge. They block that name the way a type
parameter does.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
`import { foo as bar }` then `bar()` kept an unresolved_calls row even with the exact
edge admitted. The per-file LSP reported the exported name, and the diagnostic joins
its call site by spelling, so it never found the occurrence that later cleared it.
It reports the spelling the file wrote now.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
es_usage_crossfile_typescript caught a wrong edge: with type positions resolving, a
parameter annotation also published USAGE to the interface. Its oracle forbids that,
because USAGE means a value. Every annotated name in TypeScript did this, so USAGE on
real code counted types as values.
A written type name, and the `Ns` root of `Ns.Type`, now abstains from USAGE with
reason usage_names_a_type. `typeof value` stays USAGE: it reads a value.
USES_TYPE had to take those names over, and it only looked at signatures and a few
body forms. It now walks every type name in the TS family, so class fields, heritage
clauses and alias bodies are not lost.
Also promotes two known gaps these rules satisfy: the TS parameter annotation and the
CommonJS `module.exports = async function`.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Twelve RQ_KNOWN_GAP cases (inline constructor receivers, implicit constructors,
parameter-property and field receivers, a TS script's own declaration) now resolve
to the exact oracle target, and rq_check reports them as PROMOTE_TO_REQUIRED. Their
oracles are unchanged; only the excuse goes.
tslsp_param_property_this_dispatch_issue514 and tslsp_field_new_initializer_issue514
pinned the inference label lsp_ts_method. Those receivers are proved now, so they
assert the stricter ts514_proved_count at the same exact target; the decoy counts
(wrong override, unknown, factory, plain parameter) are untouched.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
The strict registry stopped binding by name, and with it the `candidate` of an
unresolved_calls row went empty: the row said a call was unresolved and no longer
what it probably meant. pipeline_unresolved_review_* pins that field.
The guess comes back only as text on the coverage row. No edge can be derived from
it, and the same fixtures show no CALLS edge for those sites in either route.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Two things the prior tests demanded and production did not do:
- declares_method read method_names, which exists only for classes swept from the
current file's AST. An imported base never answered, so an inherited method
across files abstained, and an imported subclass's own override could lose to a
same-file base. It now also asks the registry for that exact receiver.
- `x as T` and `x satisfies T` have no `type` field in the grammar, so the type
name was never extracted.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Three CommonJS facts the export table had wrong:
- `exports = x` without module.exports detaches the name, so a later `exports.y`
is not an export. It was published as one.
- `exports.y` or `module.exports.y` written before the last `module.exports =`
went to the replaced object.
- `exports = module.exports = createApp; exports.named = named` makes `named` a
name of the required value. `require(x).named` looked only for a member declared
under createApp, and `module.exports = require('./app')` did not forward names.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
An adversarial read of the member rule found eight wrong edges on one fixture:
- A function inside a nested scope named its `this` owner by spelling, so a
parameter or local `Owner` reached the module-level `Owner`'s members.
- `get m()` was taken for the callable; a call invokes what the getter returned.
- Object.assign, Object.defineProperty, mixin and `delete` replace members without
spelling an assignment.
- A class field initializer inside a member inherited the literal's `this`.
Owners now need a module-level function, mutator calls and `delete` make every
member of that owner unknown, and a class body clears `this`.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Preserves the js-ts lane's on-disk work after its tools were refused. Nothing here has been through a suite: no RED proof, no precision sample for the member rule. Not ready to integrate.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Checkpoint against a usage limit. Proved on express and kilocode subtrees; the
test suites have not run on this tree yet, so later commits may adjust it.
- Real lexical scopes replace the module-wide veto on any local name.
- CommonJS syntax, module extensions, package.json type and TypeScript prove a
module; a classic browser script stays unproved.
- require bindings and an exported-name table: aliases, default exports, barrels,
export *, export * as, module.exports and exports.x.
- Directory imports resolve through main and index.
- TS method proofs survive destructuring, catch, generics and decorators, take
own and inherited methods, this.field and new X() receivers, and have no budget.
- TS annotations give exact type-name occurrences.
- A registered route suppresses the unresolved diagnostic again.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Three pools hold a whole project's proofs under fixed caps, and running out of one
refuses the whole publication with no diagnostic:
shared resolver 4M nodes, 64M work cbm_shared_resolver_build
graph buffer 16M nodes, 4G work cbm_gbuf_new
infra adapters 65536 nodes, 4M work cbm_shared_resolver_adapter_init
proof_hash counts every hashed byte as work, so reaching a cap only means a large
enough repository. django reached the shared cap at 78580 proof nodes, and because
every proof hashes the project name, how soon a cap is reached also depends on the
length of the checkout path.
Measured, graph pool / shared pool work:
redis (967K occurrences) 524M / 1.2M
neovim (1.47M occurrences) 934M / 0.24M
django (672K occurrences) 1.36G / 133M over the shared cap
kubernetes (6.43M occurrences) 5.03G / 2.28G over both, and the adapter cap
These pools hold one node per distinct project fact and each operation is linear in
its own text, so the totals follow the input and are not guarding against a runaway.
cbm_resolve_proof_pool_init_project sets no cap, so only the memory core can refuse.
With this kubernetes publishes, 355464 nodes against main's 355619.
Per-file pools keep their limits: they degrade the file's outcomes to LIMITED rather
than stop publication.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Each pool below holds a whole project's proofs and refused publication once its
fixed budget ran out:
shared resolver 64M django needs 133M, kubernetes 2.28G
graph buffer 4G kubernetes needs 5.03G
infra adapters 4M kubernetes' 6456 YAML files exhaust it
The shared test reaches its budget with one small Go file and a long project name,
because every proof hashes that name; the same file under a short name is the
control. The graph and adapter tests spend the former budget up front instead of
building a project that size. The graph pool is private, so that needs a test seam.
RED: cbm_shared_resolver_build returns NULL for the long name only,
cbm_gbuf_record_resolution fails, and the adapter pool refuses a leaf.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
yyjson's strict writer refuses a whole document over one undecodable byte. Source
files can be in any encoding, and the strict resolver puts source text in JSON on
its way to publication, treating a NULL write as fatal:
record_properties call arguments and callee -> aborted_previous_preserved
fact_json proof lookup keys and scopes -> persist_failed
pass_pkgmap import paths and names -> aborted_previous_preserved
lsp_surface definitions and imports -> every file's surface row dropped
Neovim and redis took the first route: a latin-1 string argument in a test file
stopped the whole index. Main writes these same bytes into edge properties raw, so it
published, with invalid UTF-8 inside that JSON.
Add cbm_json_write_text: valid documents are written unchanged at no extra cost,
and only a document the writer refused has its strings repaired, replacing undecodable
bytes with U+FFFD. That covers every field of a document, rather than each field that
happens to carry source text today. The exact-bytes columns (resolver_occurrences
spelling, resolver_lookups key) keep the original bytes; the MCP layer normalizes
those at its own encoding boundary.
The pending unresolved-call key is compared against text read back from that JSON,
so it applies the same replacement to both sides.
The UTF-8 sequence check moves from mcp.c to foundation/str_util so there is one copy.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Each route is one way such bytes reach a strict JSON writer before publication:
a call argument (redis deps/tre/tests/retest.c, neovim's legacy specs), a callee
spelling, and an import path. The parallel leg also checks the argument text
survives on the published edge as U+FFFD.
RED: cbm_pipeline_run returns CBM_PIPELINE_ABORT_PRESERVE_DB or
CBM_PIPELINE_PERSIST_FAILED, depending on the route.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
The strict resolver's syntax audit shared CBM_LSP_MAX_LOOKUP_DEPTH (16), a limit
meant for registry chains. It tripped on any node 17 levels down, even a clean
one under an error-bearing ancestor, and an #ifdef inside an else-if chain gets
there in ordinary C. That set binding_failed for the whole file.
c_proof_prepare then returned before allocating proof_includes, with include_count
already set, and processing carried on: c_proof_type_visible dereferenced NULL.
On redis the worker crashed 10 times; each crash quarantined files that happened to
be in flight on other threads (src/server.c, src/module.c, src/config.c), so the
failure status and the set of missing files changed from run to run.
Walk the audit with a tree cursor instead of recursing, so nesting depth is not a
property the answer can depend on. The result is what proof_syntax_limit already
documents: sites before the first error keep their proofs, sites at or after it
do not. The fail-closed behaviour is unchanged for every site past the error, and
the walk is linear in the error-bearing spine, so the depth and visit guards had
nothing left to bound.
c_proof_type_visible also refuses when binding_failed is set, because a failed
prepare can still leave the table unset on allocation failure.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Shape of redis src/defrag.c🔢 an #ifdef splitting a long else-if chain
puts the first syntax error more than 16 levels under the root. Today that
fails the whole file before its include table exists, and the next declared
binding dereferences it, so the indexing worker dies with SIGSEGV.
RED: SIGSEGV in c_proof_direct_class.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Threads main's Go rel_path (#1910) through the proof-source and import-snapshot variants, keeps main's ADR sidecar so the rebuild no longer re-applies ADRs, and keeps the feature's removal of the import name fallback and JVM tail join, inside which main had added a generated-member filter. Main took semantic index version 12 for Markdown Section names, so the resolver generation becomes version 13.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
The reviewed reconciliation of tests/test_pipeline.c kept main's call sites of cross_file_call_has_strategy but dropped its definition, and test_resolver_integration.c used a bare yyjson.h that no include path provides. Neither candidate had been compiled.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
cbm_gbuf_insert_edge ignored a failed cbm_da_push, registered the secondary and dedup indexes, and returned a positive id. Strict projection treats that as published even though the dump reads only the primary array, and diagnostic reconciliation could then hide the miss. Compare the count around the append and on failure free the edge and return 0 before any index registration. Existing strict projection already treats 0 as failure.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Adds a class-filtered, thread-local, one-shot realloc failure hook compiled only with CBM_MEM_TEST_API, and a regression that fails the primary edge array's first growth. The old code registered the secondary and dedup entries and returned a positive id while the array the dump reads stayed empty, so a retry appeared to succeed and the edge was lost and leaked.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Resolves the nine textual conflicts with the reviewed reconciliation: semantic index version 12 on top of main's migrations, digest stream v3 because both sides independently claimed v2, incremental metadata-current requires main completeness and the strict resolver generation receipt, and exact call joins by extraction index, full span and origin. Unresolved-call diagnostics reconcile only after final proof sealing and successful projection.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Resolved tests/test_pipeline.c as the main version plus this PR diff: the owner-segment field-hint tests follow the new bare init tests, and both RUN_TEST pairs stay registered (pass_parallel.c merged cleanly).
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Go gives `init` no binding in the package block: init functions cannot
be referred to from anywhere in a program, and a method or field named
init needs a selector. A bare `init` is therefore always a local name -
a closure (`init := func(ctx) {...}; init(ctx)`), a parameter, or the
`package init` clause of a directory named init.
Before #1915 same_module bound such a name to the flat package init.
With per-file init QNs it now falls through to the short-name fallback
and binds unrelated methods named init. On kubernetes that minted 24
CALLS (22 e2e storage DefineTests closures among them), 28 WRITES,
7 USAGE and one derived TESTS edge, all false.
cbm_go_suppress_bare_init_bind refuses, for a bare Go `init`, any
registry binding onto a Function (every Go Function named init is a
package init) and a weak short-name binding onto a Method or Field.
lsp_* answers and selector calls (`w.init()`) are untouched. Wired at
the CALLS, USAGE and READS/WRITES seams of both resolvers.
Kubernetes, full index, main vs branch: only those 60 edges removed,
nodes identical, no resolver edge added; the 14 LSP-typed selector
CALLS into init methods are unchanged.
Tests: pipeline_go_bare_init_binds_nothing (+ parallel twin) are RED
with the predicate disabled (closure CALLS, parameter CALLS, closure
WRITES, package-clause USAGE onto Watcher.init) and GREEN with it; the
selector control keeps Watcher.Start/Boot -> Watcher.init.
go_bare_init_never_binds_init_namesake pins the predicate.
Refs #1915
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Go no longer runs the parallel field-type hint (e554a2ab), so the Go test
of this PR passes with or without the owner-segment fix. C# still reaches
try_field_type_hint, and its PascalCase method names make every candidate
QN contain a one-letter receiver's hint: `w.Write()` on a StreamWriter was
upgraded to an arbitrary project Write as field_type_hint. The test is RED
on main's pass_parallel.c and GREEN with the fix, and its positive control
pins `store.Put()` to Store.Put, never FileStore.Put.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Resolve tests/test_pipeline.c as main's file plus this PR's own test hunk; the RUN_TEST line is re-anchored before pipeline_go_multi_init_nodes_survive.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Martin Vogel
dependabot[bot]