Docs fold 5: K12a-2, sanity 20, K39b

docs/decisions.md

@@ -517,6 +517,7 @@ result files when the documentation was cleaned up on 2026-10-17.
 | d528 | 2026-10-22 | DECISION | traverse | K26-1 (PR 197, G1): the engine half of the frontier confirmer, in `lci-maps` only and unreachable until K26-2 wires a key. After the gate and the beam, and before the reranker frontier, the kept hops whose only witnesses are `grep.live` text proposals with a site are taken in hop-value order, cut at the call's `top_k`, and sent in one call to a `FrontierConfirmer` (`lci-maps/src/traverse/confirm.rs`). `Confirmed` (the definition at the site is the source node): the hop keeps its value, its witness becomes `Lsp` and its confidence rises to at least 90. `Refuted` (an answered place held by another symbol): the hop is dropped and still corroborates at 0. `Unknown` (no answer, an error, the deadline, the call cap, or an answer only a file can hold, such as an import or re-export line or a symbol the index lacks): unchanged, fail-open, and a walk never ends on the confirmer. Each proposal is at most one `definition` request; the engine clamps the confirmer's reported calls to the pop's remaining external calls and charges them there. Totals `confirm_*` and `confirm_ms`, the expand event's `confirm` field and `start.confirm` are added; a handle records the setting only when it is on (a default handle's bytes and hash are unchanged) and refuses a resume under the other value. `LspLive::confirmer` asks `definition` at each site. `relabel` changes the witness, the offer and the confidences, not the claims, so corroboration grouping still reads a text group; whether a confirmed group should stop counting as text is a K26-2 decision, as are the byte-column versus UTF-16 column of a site after non-ASCII text, the places kind in the confirmer's identity, and sampling (src, holder) pairs of refutations before the refuted share is trusted. No key, no default, no golden line. | bf7e832, 642912c (PR 197; merge a1fe140) |
 | d529 | 2026-10-22 | DECISION | lsp | K12a-1: `index_status` (and `lci status`) gain `servers[]` (per adapter, sorted by provider: provider, languages, languages_in_index, configured, enabled, command, probe {probed\|not_probed}, breaker_open_ms (ms left in an open breaker window, null when none), root, session) and `languages_without_server`; a report built from the manager's memo and sessions, no probe run and no server started. `analyzers` and `analyzers_running` unchanged. No key. `Manager::probe_state` reads the `probe_once` success memo; it is filled only by priming and the `lsp.live` warm start (`/ready` probes the adapter directly and does not count), and a failed probe is not remembered, so it reads not_probed; an open breaker window shows as `breaker_open_ms` (`Manager::breaker_remaining`, a read) instead of a third probe state. `root` is always "." until K12a-2. | 0e16d61, b377635 (PR 206; merge 0da50ed) |
 | d531 | 2026-10-22 | DECISION | lsp | K11b-3 Sol review (merge after fixes), coordinator decisions. (1) HIGH: under `places = "scip"` a tree with no SCIP index paid for LSP with 0 cards (18 of 18 calls, d509), so the default becomes `[run_profile.lsp] places = "auto"` (values "auto", "scip", "outline"): per walk, SCIP places when the SCIP graph loaded for the workspace has at least one node, else the server's outline places; "scip" and "outline" keep their exact behaviour when set explicitly, and an indexed tree walks byte for byte as under "scip". The rust places pair that kept "scip" (d516 rule) was a SCIP-present comparison and does not apply to the no-index fallback. (2) HIGH: `deadline_ms` is not a wall-time promise: the version probe (bounded by its own readiness timeout), the seed search and the tree barrier are credited back by design (d470); documented, not changed (config.example.toml, README and architecture say `deadline_ms` bounds the walk, not setup). (3) LOW: stale lines in architecture (the breaker is on since K11b-3; a walk has one restart per walk: the pre-seed barrier plus the backend's barrier, which restarts only if the stamp changed between them). One of the two allowed Sol re-checks: merge. Sanity 17 added: auto is per workspace, so a rust tree with a SCIP index plus python or typescript files takes SCIP places and those languages get 0 cards while their servers warm; named in the PR and the row, with a per-language auto as a follow-up gated on a mixed-tree measurement (confirmed by d553). | private run record (K11b plan file, Sol review); PR 205 |
+| d533 | 2026-10-22 | DECISION | lsp | K12a-2 (N4, PR 212): `[run_profile.lsp] roots = "workspace"` (default, today) \| `"manifest"` (opt-in): a server starts at the directory of the topmost manifest its adapter names (`stamp_manifests`), found in the directories of the index's files of its languages and their ancestors (one directory read each, no recursive walk: the index's file list holds source files only and so lists no manifest). The workspace is kept, with the reason in `servers[].root_reason` (`no_manifest`, `several_roots:<n>`, `files_outside_root:<n>`, `no_file_list`, `unreadable`, and `not_served` for a disabled, unconfigured or unserving server whose root is not worked out, reported under `manifest` only), for no manifest, sibling manifests at the same depth, or a root that would leave indexed files of the server's languages outside it. A session fixes its root at start; `Manager::server_root` and `Manager::session_root`; one session per server per workspace either way, session key, stamp and barrier unchanged. The file list reaches the `lsp.live` managers too: the walk's per-call manager (`per_call_manager`) and the CLI's shared manager read the same index file list (`Manager::indexed_source`, `ManifestFiles::new`), so gopls, pyright and typescript-language-server start at the nested root in a walk as in the service. One limit: a one-shot `lci traverse` under `sessions = "per_call"` has no file list, so its servers start at the workspace with `no_file_list` (the service always has the list). `servers[].root` (K12a-1's `.`) now shows the live session's root, else the root a start would choose now (worked out only for an enabled, configured server whose languages the index holds). Default unchanged: the run-profile golden gains the `run_profile.lsp.roots = "workspace"` line and its hash moves; the default path's answers do not. Premise check (stdio tap on the real `rootUri`, small fixtures): pyright gains only when a name resolves through a nested project's own settings (`extraPaths` in its `pyproject.toml`: workspace root 0 of 7, manifest root 5 of 5; a plain src-layout import resolves from either root); typescript-language-server finds the nearest `tsconfig.json` itself and gains nothing; one stray top-level source file sends `manifest` back to the workspace (`files_outside_root:1`). The claim is that pyright-only gain; gopls, csharp-ls and cost are not measured, and the default flip stays gated on the lsp-cost rule in the plan. Fable review: merge after fixes, all docs. No Sol review (opt-in key, default unchanged). | fb78823 (PR 212 merge); private run record (K12a-2 premise check) |
 | d534 | 2026-10-22 | DECISION | traverse | K20c-1 (PR 207): the SCIP-edge arbitration engine in lci-maps only, unreachable until K20c-2 wires a key. An Arbitration names an authority map, subordinate (map, family) pairs and the judged symbol kinds; per expansion, before fusion, a subordinate edge of a listed family to a listed-kind symbol stands if the authority answered it (confirmed) and is removed if the authority answered that family with other destinations (overruled); nothing is removed when the authority did not answer the family, when its call was cut at `EXPAND_LIMIT`, or when it named only non-judged destinations (a File fallback). Counts appear on subordinate calls, the expand and end events and `TraversalResult` only when an arbitration is attached; they are per call (a resume restarts them). No byte changes without an arbitration. K20c-2 carries the handle check (S3) and registered-maps-only (S4). | 8490ef8, 4403207 (PR 207; merge ef6d175) |
 | d535 | 2026-10-22 | DECISION | lsp | K12b plan (Fable planner), coordinator decisions: (1) the section is `[tsgo]`, the provider `typescript-go`, the environment variable `LCI_TSGO_PATH`; (2) typescript and tsgo both enabled is a `Config::validate` error (explicit over first-wins), navigation prefers the first enabled adapter of a language; the default stays typescript-language-server and `init` does not write `[tsgo]`; (3) tsgo (npm `@typescript/native-preview`, Apache-2.0 to be verified from its LICENSE at install; downloads were approved on 2026-10-21) is installed by the coordinator at K12b-2 time outside the repository, its path only in local config; (4) the tsgo against typescript lsp-cost pair shares the quiet window with the K7c cost pass, and the 3-file tree counts for "works" only. K12b-1 starts from main 74e9310 and touches none of K12a-2's or K39a's hunks. | private run record (K12b plan file) |
 | d536 | 2026-10-22 | DECISION | plan | K39a re-aimed at main 74e9310 (planner), coordinator answers: (1) a `traverse_matrix` cell `lsp_default` as its own commit (0b) before the first move, pinning the default `lsp.live` plan; (2) `SEEDS_REPO_MAP` stays in the re-export list if anything reads it; (3) the resolved places choice on `Built` is left to K20c-2; (4) a stale comment stays byte-identical in the registration move and is fixed in K39b's docs pass. Commits land one at a time (implementer per commit, coordinator commits between). | private run record (K39a plan file) |
@@ -546,3 +547,5 @@ result files when the documentation was cleaned up on 2026-10-17.
 | d560 | 2026-10-23 | DECISION | lsp | N118 (PR 221): the status gains a top-level `sync` key (a sibling of `analyzers`, present only while a workspace's sync runs, so byte-equal with sync off or no session) that reports `Manager::sync_status`: backend, the new `failed` flag (neither watcher could start; previously only a `warn!`), and the counters events, batches, forwarded, walks and rescans; a silent Windows stop (N102) shows as events not growing. A sync whose opening task dies is marked failed (review fix). Navigation status test under Watch and Off, sync unit test with an injectable fallback opener; mutation-checked. | 765bd60, fc16725 (PR 221; merge 838867d) |
 | d561 | 2026-10-23 | FINDING | process | Sanity 19: the K11b-4 flip rests on identical cards and a 62-129x cost gap (d553, d555) and holds; its residuals are that python and go have never run on a stock install (shim, d540), per-walk auto was never exercised in a run (d539, d543), and the burst and memory cost of kept servers on a large tree is unmeasured (N119). K20c-2 and K26-2 are layers with no value measurement, as d396 allows. Prior art (Sourcegraph, Serena, mcp-language-server, Codanna, aider) keeps servers resident with watchers and prefers precise over search, but none arbitrates SCIP against a server or confirms a grep frontier live. Picks: K11b-5 merges only after its pre-registered smoke and no-shim lsp-cost; per-language auto moves ahead of K12a-2 and K12b; N118 and the N122 fix join the closing list; K12a-2, K12b-2, K31, K39b move to cycle 2 unless started by 2026-10-24 00:00Z; the one measurement that can reverse a default is the N119 write-storm run on a large tree under the stock default. The cut is the owner's; asked 2026-10-23. | private run record (sanity 19 review) |
 | d562 | 2026-10-23 | FINDING | lsp | K11b-6 per-language places = "auto" (branch feat/k11b-6-per-language-auto, not merged): its pre-registered release-build measurement failed (mixed tree: 0 python lsp.live cards, R1a/R1b; small rust and deadline misses that the diagnosis reads as window noise, every card difference sitting on a deadline- or cap-hit call). The gate itself works: the rust index covers only .rs, python files are outlined and minted as sym:python:, and py01 discovers the two call_site.py members (hops 96 vs 94), but none is popped or listed: Contains edges carry prior 0.5 against 1.0 for calls and references, the 20-pop budget goes to the rust seeds' neighbours and answers keep 8 walk cards. No change inside the slice can surface them, so per-language auto moves to cycle 2 together with mixed-tree surfacing (Contains prior, budget, top_k), measured with a pre-registered python-seeded mixed question. A redo under a rule written after the failure is not taken. M2 closes without it. | private run record (K11b-6 measurement and diagnosis) |
+| d563 | 2026-10-23 | FINDING | process | Sanity 20 (M2 closed, d561 and d562): the direction holds; K11b-6's miss is a walk-ranking and seed finding, not a places one (the gate is verified; hard-coded hop priors, 20 pops, 8 walk cards; vectorless mixed arms), and its remedy is cycle 2 iteration with vectors present, a python-seeded mixed question and a discovered-nodes rule, seed-side before priors; prior art (aider's language-agnostic PageRank, Serena's explicit per-language routing, Sourcegraph's per-language SCIP) surfaces nothing by priors. The finish line is unchanged (d422); what remained was docs fold 4, K39b, K12a-2 narrowed to its measured pyright gain (0 of 7 against 5 of 5, opt-in, tsserver no gain) and the cycle 1 report. Recommended cut: K12b-2 and K31 to cycle 2, K12b-1 parked on its branch, K39b and K12a-2 kept; the K26 and K20c value windows need the owner's placement. Forecast at the time: close about 2026-10-24 02:00Z without K12b and K31. Process: two brittle pre-registrations in a row (K11b-6's positive rules could not fire under the question set; K11b-5's absolute-hash precondition failed literally under a merge of a default-off key, d558). Adopted change: every pre-registered positive rule carries a reachability line naming the baseline artefact that shows its measured quantity's input exists and that the budget leaves room; a precondition compares golden text against the baseline commit ("empty, or only default-off keys named here"), never an absolute hash; a reviewer other than the planner signs both before the quiet window. | private run record (sanity 20 review) |
+| d564 | 2026-10-23 | DECISION | traverse | K39b (PR 223): `run_with_trait_seeds` in `src/app/traverse/mod.rs` is split into private phases, move-only: `prepare` returns `Prepared` (the resolved call: limits as `Cow`, steer, selection, walk_off, store, loaded, observer, rescorer), `WalkSetup` (snapshot, handler, actions, priors, tie_break, identity, preset) and `Ledger` (budget, notes, warnings); the tree barrier stays in the orchestrator because the map context ties the restarts' lifetime to the call; `seeds` returns `Seeded` (found, `maps::Built`, arbitration; `find_seeds`, `build`, the arbitration and confirm checks, the trait-seed hoist); `run_first_stage` returns `Staged` (stage, exact report, stage time); the setup credit stays in the orchestrator at the same sequence point (`plan_maps` is taken, not cloned); `walk` returns `WalkOutcome` (the no-seeds answer or `Walked`: result, effective policy, enabled maps, restored nodes, notes, warnings); `finish` builds the handle, trace, map notes and response. Public paths and signatures and the report JSON are unchanged; the 18-cell `traverse_matrix` was byte-identical after each of the five commits (the fifth is the docs pass: the stale "below" comments in `mod.rs` and `maps.rs` and the module table in `architecture.md`). Fable review by normalised statement diff (495 old statements against 493 new, every residual diff glue or rustfmt reflow; the 30 note and deadline-credit sites in the same sequence; 13 `.clone()` sites unchanged; no new `pub` or `#[allow]`; the three note arms the matrix does not pin read verbatim): MERGE, no kill rule tripped. No Full gate locally (narrow, d520) and no Sol review (no behaviour change). K39 closed. | PR 223; merge 6efaf47; private run record (K39b review) |