[ScriptedAlchemy]

Refs #4520

Root cause

Merged #4537 fixed the spurious changed-name set comparison, but a comment-only edit still decoded the sealed file-evidence segments of every file mentioning a carried name. Most of those sealed edges did not land in the edited file. The issue's isolated 6.6k-file profile recorded thousands of unrelated reads.

Fix

• Persist a conservative 256-bit target-path Bloom filter in each sealed file-evidence descriptor.
• Before inflating a candidate dependent's evidence, rule out descriptors that definitely cannot reference an edited path. Possible matches still decode and perform the existing exact edge-target comparison.
• Check the descriptor against actual edge target paths whenever evidence is decoded; a mismatch rejects the seal.
• Advance the generation manifest revision to 22, making filters mandatory and intentionally refusing prior revision seals through the existing typed rebuild path. There is no legacy fallback, compatibility shim, or change to file/edge identity.

Regression and verification

• Sparse regressions require actual unrelated Calls edges, zero unrelated parent evidence reads, positive dependent reads, exact cold-derived chunk partitions, full graph/chunk-corpus equality and incoming-edge repoints without stale targets.
• New review repair: df2217b01e4a0148d3892bc681af84bab3295491. Equal output bytes and content-addressed write deduplication can hide redundant graph resealing. The integration test now counts the existing code_index.seal.collect.emit span around the real publication calls using the canonical scoped tracing capture. A cold control must observe all nine fixture files; the same sparse successor must emit only its edited file and two actual dependent owners, preserve every carried graph descriptor, and avoid reading the five unrelated parent file segments. All existing evidence-read, cold correctness, nonzero delta, edge and corruption assertions remain. This commit changes only sparse_comment_publication.rs; production semantics, format/golden, dependencies and workflows are unchanged. These assertions were executed within the current-head noncached Linux Bazel code_index_suite target (passed); they are small-fixture assertions, not measured full-repository performance results. Its success-only Bazel output does not expose individual libtest counts.
• The filter unit test requires no false negatives through serialization. The codec fixture requires four filter words per descriptor and refuses filterless current-revision manifests. The strict revision-22 state-digest golden remains sha256:08e91a89b2dd82615897c5df08b74740fc483551f8f8cef1ef57cf96a93c837f, obtained from actual hosted Bazel output, not guessed or relaxed.
• Current-head CI (checked 2026-11-10): workflow 42722351191, at df2217b: hosted Linux Bazel build succeeded (469 targets); 183/183 Bazel test targets passed, 92 executed, including noncached //crates/tracedecay-code-index:code_index_suite (19.6 s) and :unit_test (29.1 s). Exact per-suite libtest case counts are not printed in the success-only job output, so no per-case count is asserted. Clippy, Bazel rustfmt/repository policies, Dashboard, scope and feature gates passed. Windows build/typecheck was still running when checked; its native test step was pending. Hosted macOS was skipped, not passed. Benchmark-harness self-tests passed but are not the original 6.6k-file workload.
• Predecessor evidence only: workflow 42592391788 on b5164c11 produced non-cached code_index_suite 223/223 passed (15.63 s) and unit_test 364/364 passed (28.30 s), including sparse graph/chunk/read regressions, target-filter tamper refusal and strict revision-22 golden. Linux test-log artifact; evidence discussion. That Linux fleet overall failed an unrelated automation-runtime suite (435 passed / 2 settlement timeouts); it was not fully green. Clippy, repository gates and Windows Bazel build/typecheck passed; native Windows tests and hosted macOS were skipped, not passed. These results do not validate the new assertions on df2217b.
• The actual original 6.6k-file same-corpus before/after benchmark with reads, graph reseals, changed chunks, wall time and peak RSS, and independent human review, remain outstanding. No native macOS pass is claimed.

Safety

STRICT MERGE HOLD: Keep this PR unmerged and #4520 open until all acceptance evidence is established. General sweeps must not merge it from predecessor results or substitute fixture measurements for the real workload. No Kev/decision-model, release or infrastructure changes.

[changeset-bot]

⚠️ No Changeset found

Latest commit: df2217b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[ScriptedAlchemy]

Review finding (source-level, not a completed CI result): the new serialized target_filter: Some(...) in PartitionedFileEvidenceDescriptorV1 changes the canonical generation manifest payload, while partitioned_codec_has_stable_bytes_and_round_trips explicitly asserts envelope["state_digest"] == PARTITIONED_FORMAT_STATE_DIGEST in tests/code_index_suite/production_orchestration.rs. This test fixture has nonempty file_evidence, so the current golden digest looks certain to fail even if the new filter is correct. Please verify using Bazel and update the canonical format/fixture expectations only after checking that the format revision and old-reader refusal contract remain correct; do not weaken/remove the stable-bytes assertion. This is separate from #4507's source-proof test PR #4791, so I have not changed this lane.

[ScriptedAlchemy]

#4520 ownership / merge coordination: hold PR #4789; do not auto-merge it from the hourly general PR sweep. This is an issue-specific code-index performance fix, not Kev/decision-model work. It was marked ready only so the repository's normal PR workflow schedules the Bazel Linux authority (draft PRs skip that job). Correctness, canonical golden bytes, independent review, and a real 6.6k-file benchmark are not all proven yet. Leave #4520 open and this PR unmerged until those are verified. Current source commits: d009fee (strict revision 22 + rustfmt) and 52db4ab (filterless seal refusal regression). Refs #4520.

[ScriptedAlchemy]

Published c54dc47, preserving the concurrent formatting repair f1c9564 as its sole parent. Branch update used expected-head, force=false; no duplicate PR or rewritten history.

The new parser-backed code_index_suite::sparse_comment_publication module closes a validation gap: the earlier read-avoidance regression compared cold output from a separate rebuild. This test checks the same measured sparse successor, with only the edited file captured. It requires real evidence descriptors for four unrelated callers, unchanged read counters for them, positive reads for a genuine dependent, exact chunk-delta equality against independently cold-built after-state, nonzero changed chunks and reuse, exact sparse/cold edge equality, three required incoming-edge repoints, no references to the old target occurrences, and exact nonzero fan-in/fan-out. It is registered in the existing Bazel integration suite; no assertions, tests, limits, or golden checks were removed or weakened.

Validation is still pending, not a claimed pass. Hosted CI for this exact head is https://github.com/ScriptedAlchemy/tracedecay/actions/runs/42435823939. The previous head passed repository formatting/gates and Clippy, but those results do not validate this new test. No local Rust/Bazel execution was possible, and Cargo was not invoked.

Keep the merge hold. The canonical manifest state-digest golden must still be obtained from actual Bazel output and reviewed, not guessed or loosened. The real 6.6k-file before/after workload and independent review remain outstanding. The existing native test workflow requires manual workflow_dispatch (run_os=true, native_platform=macos, suitable code-index targets); the available connector exposes no dispatch action, so no native execution is claimed. #4520 remains open; no master, release, Kev/decision-model, infrastructure, or production changes.

Refs #4520

[ScriptedAlchemy]

Refs #4520 — CI repair published as 96b71325, fast-forwarding the existing branch with exact expected old head c54dc475, no rewrite. Prior exact-head CI exposed E0277 in both Clippy and Linux Bazel compilation: a sha2::digest::GenericArray does not implement Rust LowerHex, so the new test could not compile. The repair formats each digest byte explicitly and retains the same stable content-addressed 12-byte prefix convention used by the existing sparse tests. It changes only the test fixture, not production or an assertion. New exact-head CI was queued at publication; no new-head pass is claimed. The non-vacuous integration, canonical manifest digest golden, real 6.6k-file benchmark, and independent review remain gated; do not merge or close.

[ScriptedAlchemy]

Refs #4520 — Additional source-level test correction published in 7b7e179e, expected-old-head, nonforce. GenerationPlanner mints monotonic repository sequences: a cold after-state is generation sequence 1, while the sparse successor is sequence 2. The original new regression mistakenly compared entire chunk-change seals (including intentionally different to_generation and manifest addresses). It now validates the actual published change seal and asserts exact equality of added/changed, deleted, reused count, and reused digest, plus authoritative parent/successor IDs and provably distinct cold/sparse generation identities. This preserves and strengthens content correctness rather than weakening the test. The prior c54dc475 Linux and Clippy failures were traced to GenericArray: LowerHex and fixed in 96b71325. Latest exact-head CI: https://github.com/ScriptedAlchemy/tracedecay/actions/runs/42437748915 (queued; no pass claimed). Continue hold: canonical revision-22 stable digest golden must come from executed Bazel, plus nonzero regression pass, real 6.6k-file benchmark, independent review, and native platform verification. No merge/closure or prohibited scope changes.

[ScriptedAlchemy]

Refs #4520 — guarded source repair published: 1c63f1cac22c, verified current branch tip. Its sole parent is 7b7e179e; the fix/4520-targeted-evidence-repoint ref moved with expected_sha=7b7e179e, force=false. No history rewrite or duplicate PR.

Hosted Bazel on the previous head found: (1) canonical manifest payload digest sha256:08e91a89b2dd82615897c5df08b74740fc483551f8f8cef1ef57cf96a93c837f (not the revision-21 golden); (2) both sparse unit and integration fixtures lacked sealed evidence for their associated-method Other::new() callers; (3) one exact rustfmt wrap. The new commit updates only the verified golden, uses a module-level crate::other::new() call to create concrete unrelated cross-file evidence alongside the same new names, and applies the exact formatter change. Positive dependent reads, changed-chunk/graph equality, and strict no-unrelated-read assertions stay intact.

MERGE HOLD REMAINS. Do not merge or close until exact-head Bazel reports nonzero passing regressions and associated suites, 6.6k-file measured workload, independent review, and native verification. CI on the newly published head is unverified as of this comment. No native or benchmark result claimed. No Kev or release work.

[ScriptedAlchemy]

Refs #4520 — published 2165c4c86de7a8b5d6ba09de0ffd99590f58f50e directly through GitHub, with sole parent 1c63f1cac22ce5476b1f4fc579be2bc25bf18f08 and a verified expected-head, force=false branch update. The concurrent golden, module-level fixture and rustfmt repairs are preserved. The older unreferenced candidate 40ad216e was NOT pushed; do not apply it over this branch.

This commit strengthens the existing integration module without changing production semantics or weakening checks:

• Verify four actual Calls edges to the unrelated src/other.rs::new before taking read-counter baselines and again after restoring the same measured sparse successor. Descriptor presence alone can represent unresolved evidence, so it is not sufficient proof. Qualified symbol identities distinguish the many new definitions.
• Keep all zero-unrelated-read, positive-dependent-read, exact cold-derived chunk partitions, complete graph equality, stale-target exclusion and fan-in/fan-out assertions.
• Add a real sealed-generation corruption regression: select a nonempty target filter, zero it, recompute the outer manifest digest, prove metadata still parses, and require the exact semantic evidence-descriptor refusal during full restore. The untouched seal must still restore its original graph.

Exact-head CI: https://github.com/ScriptedAlchemy/tracedecay/actions/runs/42443667141 (queued when observed; NOT a pass). I inspected the actual prior-head Bazel artifact: code_index_suite 220 passed/2 failed, unit_test 363 passed/1 failed, resident_accounting 4 passed. Those are failure diagnostics, not proof of this new head. No local Rust execution or Cargo invocation occurred.

Keep the merge hold. Require nonzero current-head Bazel regressions/full applicable checks, the actual 6.6k-file time/memory/read/reseal benchmark, independent review, and native evidence. No merge, issue closure, release, Kev/decision-model, infrastructure or production changes.

[ScriptedAlchemy]

Refs #4520 — hosted verification scheduling blocker, not a test result (observed 2026-11-08 around 05:22 UTC): the exact-head PR #4789 workflow 42443667141, for commit 2165c4c86de7a8b5d6ba09de0ffd99590f58f50e, has remained queued since 03:40 UTC (over 100 minutes). Repository gates, Change scope, and Benchmark harness self-tests are all queued with no runner assigned; the Linux Bazel test job has not begun. Other recent repository PR workflows also show queued entries. This does not prove an infrastructure outage or a code failure, and the benchmark-harness self-tests are not the requested 6.6k-file workload.

Fresh source review found no confirmed new defect to justify cancelling this costly run with another speculative push. Revision-22 golden was already measured from hosted Bazel and corrected by 1c63f1ca; the strict, nonvacuous sparse/digest/corruption regressions at 2165c4c8 remain unexecuted on their exact head. No Cargo, releases, infrastructure, Kev work, or other PR changes. Keep PR #4789 unmerged and issue #4520 open. Await nonzero Bazel results before further source repairs; 6.6k-file throughput/read/graph/RSS measurements, independent review, and native macOS proof still remain.

[ScriptedAlchemy]

Refs #4520 — confirmed exact-head CI failure, merge hold unchanged. On 2165c4c86de7a8b5d6ba09de0ffd99590f58f50e, workflow 42443667141 finished Repository gates with a single //crates/tracedecay-code-index:rustfmt_check_2024 failure in tests/code_index_suite/sparse_comment_publication.rs at line 9. Hosted rustfmt requests precisely this import wrap:

-        CodeIndexProductionOwnerV1, CodeIndexPublishedGenerationV1,
-        MemorySealedPublicationStoreV1,
+        CodeIndexProductionOwnerV1, CodeIndexPublishedGenerationV1, MemorySealedPublicationStoreV1,

All eight completed repository-policy Bazel test targets passed; the formatting genrule prevented the overall gate. Change scope and benchmark harness self-tests passed, but the latter is not the 6.6k-file issue workload. At observation Clippy and Linux Bazel were still building/running on this exact head; native macOS skipped. Intentionally preserving that expensive verification before any next nonforce, expected-head format repair, so additional compiler or behavioral failures can be repaired in one narrow commit. No tests weakened, no benchmark/native pass claimed, no merge/closure. Keep PR #4789 held; PR #4791 and the other issues remain separate.

[ScriptedAlchemy]

Refs #4520 — new exact-head CI infrastructure blocker; no code regression inferred. PR #4789 workflow 42458746991 on aadc478c960b229372c927e52d669cbb648d94e6 has now finished Test Linux (fleet) and Dashboard as FAILURE during Bazel external-repository fetch/analysis, before any relevant code-index tests executed.

• Linux fleet job 128670827817: fetch of hermeticbuild/hermetic-launcher release binaries-20261025/finalize-stub-x86_64-linux returned HTTP 504 Gateway Time-out at ~08:54 UTC; Bazel reported analysis errors and 0 usable proof of the new regressions.
• Dashboard job 128670827814: separate fetch of binaries-20261025/runfiles-stub-x86_64-linux returned the same 504 at ~09:03 UTC; Bazel found 0 test targets because analysis failed, not a valid zero-test green.
• Repository gates (including rustfmt), Change scope, and Benchmark harness self-tests passed. The self-tests are NOT the original ~6.6k-file workload benchmark. Clippy and the remaining platform jobs are still queued; macOS was skipped.
• Attempted targeted reruns of the two failed jobs through GitHub Actions, but GitHub returned 403: "The workflow run containing this job is already running". Retry the failed jobs after the overall run becomes eligible. Do not edit sources/CI or cancel other queued checks to work around a transient download timeout.

The prior verified revision-22 golden and all strict sparse/chunk/graph tests remain intact. HOLD MERGE and leave #4520 open until nonzero exact-head Bazel regression passes, real before/after benchmark (reads, graph reseals, changed chunks, time, peak RSS), independent review, and native coverage are proven. No branch commit, workflow/infrastructure modification, or scope-excluded action in this check.

[ScriptedAlchemy]

Refs #4520 — new executed Bazel regression failures, not the previous external-fetch 504. Exact-head CI attempt 2 on aadc478c960b229372c927e52d669cbb648d94e6 reached actual Rust tests. //crates/tracedecay-code-index:unit_test ran 363 passed / 1 failed: production::sparse_increment_tests::a_comment_beside_same_named_symbols_decodes_only_what_it_reaches panicked at sparse_increment_tests.rs:402 because the expected dependent evidence descriptor was absent. //crates/tracedecay-code-index:code_index_suite ran 222 passed / 1 failed: sparse_comment_publication::comment_successor_skips_unrelated_evidence_and_publishes_the_cold_chunk_delta panicked at line 159: src/main.rs must seal real cross-file evidence. The independent falsifiable corruption regression sealed_evidence_refuses_a_resealed_false_negative_target_filter passed; the strict canonical codec golden also passed. These are real nonzero tests, but neither affected suite is green.

Source review points to the fixture's ambiguous src/main.rs dual use beside src/lib.rs, not yet proof of a production filtering defect. The narrow proposed repair is a real src/dependent.rs library module declared in src/lib.rs, using a parser-attested use crate::util::helper; helper() call (the repository has already passing explicit-import binding fixtures). Keep all positive dependent-read, zero unrelated-read, sparse/cold chunk and graph, edge repoint, corruption, and golden assertions intact. Do not treat this hypothesis as a pass until executed.

The broad Linux //... pass also observed three unrelated automation_runner_test scheduler assertions and timeouts in session_suite and tracedecay-global-db:unit_test; those are separate ownership, not a reason to weaken this PR's tests. Clippy, repository gates including rustfmt, Dashboard and change-scope checks passed. Windows native verification remains actively building on the exact head, so no source push was made here that would cancel its costly verification. No merge or issue closure. Original explicit hold on #4789 remains; real 6.6k-file performance measurements, independent human review, native macOS proof and passing exact-head sparse tests are outstanding.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[ScriptedAlchemy]

Refs #4520 — nonzero hosted Bazel regression evidence, on a superseded head only. I downloaded and inspected the actual bazel-test-logs-Linux-fleet artifact (ID 13635795098) for workflow 42521937825 on b06807bebc1a8b8ac3395b7245f33566dc6f3783:

• //crates/tracedecay-code-index:code_index_suite: 223 passed, 0 failed, 20.68 s. Both sparse_comment_publication::comment_successor_skips_unrelated_evidence_and_publishes_the_cold_chunk_delta and sealed_evidence_refuses_a_resealed_false_negative_target_filter passed, as did partitioned_codec_has_stable_bytes_and_round_trips with the strict revision-22 digest.
• //crates/tracedecay-code-index:unit_test: 364 passed, 0 failed, 29.06 s, including a_comment_beside_same_named_symbols_decodes_only_what_it_reaches and sealed_target_filter_round_trip_has_no_false_negatives.
• Clippy, rustfmt/repository gates, Dashboard and change scope passed. The overall Linux fleet was red due to separate tracedecay:automation_runner_test (167 pass / 3 fail) and tracedecay-cli:core_cli_suite (205 pass / 1 fail); do not count the overall fleet green or weaken unrelated tests.

The PR subsequently advanced through two unrelated test-file commits to 1e67b25e1d349cc9e2f938db3ea12738800905cc (same code-index source, but a new exact-head CI run 42527817638 is running). These nonzero results prove the fix's prior head, not the new head or full acceptance. Still missing: a true before/after run on the original ~6.6k-file workload including file/evidence reads, graph reseals, changed chunks, elapsed time and peak RSS; independent HUMAN review; and hosted native macOS when available. The native macOS job was skipped, not passed.

Keep PR #4789 unmerged and issue #4520 open. No merge/auto-merge from the general sweep.

[ScriptedAlchemy]

Refs #4520 — new exact-HEAD executed Bazel evidence and separate fleet failure (2026-11-09, run 42592391788, SHA b5164c11d5ec69a0d96738aebefe75066f98eb49; no source update).

Downloaded hosted Linux-fleet test artifact 13672023782, inspected the actual non-cached test.log and test.xml for both affected Rust targets:

• //crates/tracedecay-code-index:code_index_suite: 223 passed / 0 failed, 15.63s; includes comment_successor_skips_unrelated_evidence_and_publishes_the_cold_chunk_delta, forged-filter refusal, strict rev22 golden/partitioned codec.
• //crates/tracedecay-code-index:unit_test: 364 passed / 0 failed, 28.30s; includes a_comment_beside_same_named_symbols_decodes_only_what_it_reaches and the sealed-filter round trip.
• Both targets show PASSED (not (cached)) in the exact-head Bazel fleet log. This closes the prior current-head nonzero Rust test evidence gap, not the original-workload performance gap.

New unrelated fleet blocker: Bazel completed 182/183 test targets passing (95 executed), but //crates/tracedecay-automation-runtime:unit_test failed 435 passed / 2 failed: retained_pair_attempts_second_leg_and_keeps_both_guards_until_both_finish timed out at settlement/tests.rs:2542 (second pair owner must finish: Elapsed(())); retained_user_job_rebinds_and_recovery_retires_only_terminal_corrupt_spool timed out at line 2906 (published phase: Elapsed(())). Neither file belongs to the nine-file #4789 patch. This is real executed test failure, not an identified sparse code-index regression; another lane should own its investigation rather than changing #4520 or bypassing a gate. Repository gates/rustfmt, Clippy, Dashboard and feature gates passed. Windows native build is still in progress; hosted macOS job was SKIPPED, not passed. Preserve Windows, no speculative push/rerun.

STRICT MERGE HOLD remains: original isolated ~6.6k-file before/after comment-only benchmark with file/evidence read counts, graph page reseals, exact changed chunks, wall time and peak RSS is still absent (260-file fixture/harness self-tests do not count); independent HUMAN review is still absent, and hosted native macOS Bazel verification is unavailable under this PR's skipped job. No merge, issue closure, Kev/release/infra modification, or Cargo.

[ScriptedAlchemy]

Refs #4520 — review repair published in df2217b01e4a0148d3892bc681af84bab3295491, sole parent b5164c11d5ec69a0d96738aebefe75066f98eb49. GitHub ref update used that exact expected SHA and force=false; only tests/code_index_suite/sparse_comment_publication.rs changed. All previous source and peer edits remain.

Confirmed coverage gap: equal graph output and deduplicated writes do not establish that unrelated pages were never regenerated. The same-successor regression now counts the existing graph-emission trace span through the repository's canonical scoped capture. It requires a positive cold control covering all nine fixture files, exactly the edited file plus two genuine dependent graph owners on the sparse publication, and exact preservation of carried descriptors. It also checks no additional reads of the four unrelated caller file segments and their unrelated target. All existing evidence-read, cold chunk/graph equality, incoming-edge, nonzero delta and corruption assertions remain. No production semantics, golden, dependency, format or workflow changed.

Validation pending: new exact-head workflow 42722351191 is queued. The 9-versus-3 requirement is a new fixture assertion, NOT an observed benchmark result or full-repository speedup. I independently re-downloaded predecessor artifact 13672023782 and verified 223/223 integration and 364/364 unit passes; those do not validate this new commit. No local Rust execution or Cargo.

STRICT MERGE HOLD remains. Preserve the new CI run, fix genuine failures without weakening counts, and still require the original ~6.6k-file measured workload, independent HUMAN review and available native macOS verification before acceptance. No merge or issue closure.