fix: close residual project-input, CI, graph, and runtime liveness gaps by samchon · Pull Request #1017 · samchon/ttsc

samchon · 2026-07-26T04:15:06Z

fix: close the residual project-input, CI, graph, and runtime liveness gaps

Campaign

This draft pull request implements the verified ledger from the renewed
repository-wide issue campaign after PR #1009. Discovery repeated through five
fresh whole-repository rounds; the fifth round was empty.

Tracked issues:

ttscserver hands sidecars physical paths as the project identity, collapsing logicalConfigPath #1002 — preserve logical project identity for LSP sidecar loading
ttscserver classifies a declared glob's root as a selection change while the CLI treats it as data #1003 — align declared glob-root reload classification
A rejected project-input watch root is retired for the session, silently ending observation #1004 — recover rejected project-input watch roots
fix(ttsc): keep the compiler watch lane alive when outDir contains the project #1005 — retain compiler watching when outDir contains the project
fix(ttscserver): stop folding case globally in Go-side project-input identities #1006 — use per-directory case semantics in Go identities
fix(ci): make the format gate stable across Windows checkout line endings #1010 — make formatting stable across checkout line endings
fix(paths): honor per-directory Windows case sensitivity in JavaScript hosts #1011 — use per-directory case semantics in JavaScript hosts
ci(deps): remediate and gate high-severity dependency advisories #1012 — remediate and gate high/critical dependency advisories
fix(ci): ignore generated mirrors in committed test-owner discovery #1013 — restrict committed test-owner discovery to tracked suites
fix(graph): handle viewer HTTP listen failures without an uncaught error #1014 — handle graph viewer listen errors
fix(wasm): bound runtime initialization and recover poisoned single-flight state #1015 — bound WASM/playground initialization and recover single-flight state
fix(graph): validate viewer dump schema before reduction #1016 — validate graph viewer dump schema before reduction

The squash commit messages carry the closing references. They take effect only
when this pull request merges.

Delivery contract

One coherent pushed implementation commit per issue.
Exactly one read-only Individual Self-Review after each pushed implementation
or correction commit; sound findings are folded before final validation.
Package-owned focused tests first, then the repository's canonical format,
type, lint, build, test, packaging, and platform gates.
A final exhaustive Overall Self-Review is posted as a PR review event after
all checks are green on the exact head.

samchon

Individual Self-Review — #1010 implementation

Reviewed pushed commit:
ee2a5a141bbc748fb2518e3011c1a58e3a86876c

Scope reviewed

repository-wide * text=auto eol=lf checkout semantics;
Prettier-owned TypeScript/Markdown behavior under Git for Windows;
binary detection and byte preservation;
the temporary-repository regression under core.autocrlf=true and false;
CI ownership of the new executable Node test;
workflow trigger paths and the canonical format gate.

Finding

Medium — sound and corrected. The regression test copied
.gitattributes as its policy input, but the workflow's push.paths and
pull_request.paths did not include .gitattributes. A future
attribute-only regression could therefore avoid the very test intended to
protect it.

The implementation logic itself was sound: the real Git clone regression
proved LF text checkout under both autocrlf modes, preserved a NUL-bearing
binary byte-for-byte, and kept each checkout clean.

Resolution

Correction commit 9bcedf69460d818f8b10904bc29a21a981dd2295
adds the exact root .gitattributes path to both workflow event filters.

Verification

node --test scripts/ci/line-endings.test.cjs — passed.
Full Prettier TypeScript/Markdown list-different scan — clean.
Changed workflow Prettier/YAML parse — passed.
git diff --check — passed.
No tracked content changes remained from the original Windows CRLF
presentation; the seven apparent files hashed identically to their Git
blobs after normalization.

Disposition: implementation accepted with the correction above; no finding
remains open.

samchon

Individual Self-Review — #1010 correction

Reviewed pushed correction:
9bcedf69460d818f8b10904bc29a21a981dd2295

Parent:
ee2a5a141bbc748fb2518e3011c1a58e3a86876c

Result

CLEAN — no sound findings.

The exact root .gitattributes path now participates in both
push.paths and pull_request.paths. Push remains intentionally restricted to
master, while every pull request whose changed-file set includes the
attribute contract triggers the owning workflow.

GitHub accepted the committed workflow and created pull-request run
30187842164 for this exact correction head. The run was later cancelled by
the workflow's expected concurrency policy after a newer branch push, not by a
syntax or trigger failure.

Verification

git diff --check ee2a5a141 9bcedf694 — passed.
Committed workflow parsed with Prettier's YAML parser.
Line-ending regression — passed under both autocrlf modes.
No relevant event or repository surface remains outside the trigger.

Disposition: correction accepted as clean.

samchon

Individual Self-Review — #1013 implementation

Reviewed pushed commit:
51056b21f8cf15cb80a905a836748828b97aa6ec

Scope reviewed

the source of truth used to discover committed Go, end-to-end, and Node test owners;
behavior in clean and build-populated worktrees;
ignored/generated test-shaped mirrors under packages/wasm/shim-vendor;
the two-way invariant between discovered owners and explicit CI claims;
path normalization and failure behavior outside a Git checkout;
whether the regression independently exercised a physical ignored tree.

Findings

P2 — sound and corrected. The initial e2e predicate accepted every
tracked second path component beginning with test-. A top-level file such
as tests/test-notes.md therefore became a fictitious e2e package owner,
which would fail the ownership gate even though no package existed.
P3 — sound and corrected. The ignored-mirror assertion depended on a
previous build having materialized the mirror. In a clean checkout it could
pass vacuously because the unit test did not create a real ignored,
test-shaped file itself.

The central implementation was otherwise sound. git ls-files -z makes Git's
tracked set—not the mutable worktree directory tree—the discovery boundary;
the harness derives its executable suites from the same ownership map; and a
non-Git invocation fails explicitly instead of silently reporting no owners.

Resolution

Correction commit 88ed3ba500b5686d6ef9cb185cad17a4e9e5304d
requires an e2e package to have a child path and adds both a negative top-level
file case and a physical ignored Go fixture.

Verification

node --test scripts/ci/test-owners.test.cjs — passed after correction.
node scripts/ci/test-owners.cjs — all discovered owners were claimed.
Synthetic tracked Go, e2e, and Node paths entered the unclaimed invariant.
The real ignored Go fixture was absent from tracked-file discovery.
Git-unavailable behavior failed with an explicit diagnostic.
node --check, Prettier, and git diff --check — passed.

Disposition: implementation accepted with the two corrections above; neither
finding remains open.

samchon

Individual Self-Review — #1013 first correction

Reviewed pushed correction:
88ed3ba500b5686d6ef9cb185cad17a4e9e5304d

Parent:
51056b21f8cf15cb80a905a836748828b97aa6ec

Scope reviewed

the new e2e package-depth predicate;
the physical ignored-tree regression and its cleanup lifecycle;
isolation between repeated or concurrent test processes;
failure paths before and after cleanup registration.

Finding

Low — sound and corrected. The ignored fixture used a PID-derived directory
with recursive creation and recursive cleanup. After an interrupted run and
PID reuse, a later test could adopt a pre-existing directory and delete
contents it did not create. Cleanup was also registered after the write, and a
newly created parent could be left behind on an earlier failure.

The functional fixes were correct: top-level tests/test-*.md files no longer
become e2e packages, nested e2e packages remain discoverable, and the test now
materializes an ignored Go-shaped file instead of relying on build state.

Resolution

Correction commit 31e53bbf937cc956b8e87a9d6baa4bfa174753e1
uses mkdtempSync for a uniquely owned fixture and registers cleanup
immediately.

Verification

Exact committed test suite — 7/7 passed.
Positive Go/e2e/Node and negative top-level-file probes — passed.
Physical ignored fixture was excluded and its unique child was removed.
Windows/POSIX path normalization checks — passed.
node --check, Prettier, and git diff --check — passed.

Disposition: first correction accepted with the fixture-ownership hardening
above.

samchon

Individual Self-Review — #1013 second correction

Reviewed pushed correction:
31e53bbf937cc956b8e87a9d6baa4bfa174753e1

Parent:
88ed3ba500b5686d6ef9cb185cad17a4e9e5304d

Scope reviewed

uniqueness and ownership of the mkdtempSync fixture;
cleanup ordering after fixture allocation;
ownership of the shared ignored shim-vendor parent;
exact behavior under deliberately interleaved concurrent test runs.

Finding

P2 — sound and corrected. createdVendorRoot = !existsSync(...) did not
grant exclusive ownership of the shared parent. One run could create the
parent, another could pass mkdirSync and pause, and the first could then
remove the still-empty parent before the second called mkdtempSync. That
interleaving was reproduced on Windows as an ENOENT failure.

The unique fixture directory itself was correctly isolated, and cleanup was
registered early enough to cover subsequent write and assertion failures.

Resolution

Correction commit 416cf1fa09106eaafe9da145d7283526dc8ce293
removes cleanup of the shared parent entirely. Each test process now removes
only the unique child directory that it demonstrably owns.

Verification

Exact committed suite — 7/7 passed.
Targeted generated-owner regression — passed.
Forced concurrent interleaving reproduced the parent-removal race before
the correction.
Pre-existing parent and interrupted-run cases were inspected.
Prettier and git diff --check — passed.

Disposition: second correction accepted with the concurrency fix above.

samchon

Individual Self-Review — #1013 final correction

Reviewed pushed correction:
416cf1fa09106eaafe9da145d7283526dc8ce293

Parent:
31e53bbf937cc956b8e87a9d6baa4bfa174753e1

Result

CLEAN — no sound findings.

Every test process allocates its own mkdtempSync child and removes only that
child. The shared packages/wasm/shim-vendor directory is no longer treated as
exclusively owned, so no process can remove it between another process's
mkdirSync and mkdtempSync calls. Cleanup is still registered immediately
after allocation and therefore covers all later write and assertion failures.

Leaving the empty ignored parent is intentional and safe: it is generated
state, is not tracked by Git, and cannot be removed safely without coordination
among concurrent processes.

Verification

Targeted generated test-shaped file regression — passed.
Exact diff check 31e53bbf9..416cf1fa0 — passed.
Unique child ownership, pre-existing parent behavior, and concurrent
execution consequence surface were reviewed.
The only full-suite stale-owner diagnostic observed came from the separate,
uncommitted #1012 dependency-audit test in the shared worktree; it is not
present in either reviewed commit.

Disposition: correction accepted as clean; the #1013 implementation chain has
no remaining review finding.

socket-security · 2026-07-26T05:11:11Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance
npm/next@15.5.18 ⏵ 15.5.22		⁺³¹	⁺¹
npm/postcss@8.5.15 ⏵ 8.5.23	⁺¹	⁺¹⁶	^-1
npm/vite@7.3.3 ⏵ 7.3.6		⁺¹⁸
npm/@vscode/vsce@3.9.1 ⏵ 3.9.2	⁺¹		⁺¹	^-1

View full report

socket-security · 2026-07-26T05:11:12Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `next` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

samchon

Individual Self-Review — #1012 implementation

Reviewed pushed commit:
46ee51601ebe502e804e8d6419adbb3d33c5afcd

Issue:
#1012 — remediate and gate high-severity dependency advisories

Scope reviewed

every high/critical package resolution and advisory owner recorded in #1012;
direct-owner upgrades for Next, PostCSS, Vite, and @vscode/vsce;
transitive remediation for brace-expansion, fast-uri, form-data, js-yaml,
linkify-it, sharp, shell-quote, tmp, undici, and websocket-driver;
lockfile importer, package, snapshot, optional-platform, and peer-resolution
consequences;
the two pnpm overrides and whether their parents permit the patched version;
the canonical check:dependencies script, JSON interpretation, diagnostics,
command/network failure behavior, and CI ownership;
frozen-install, website, VS Code, graph, and unplugin compatibility;
Dependabot's new routine update owner.

Remediation implemented

The direct owners were advanced only to compatible patched lines:

website: Next ^15.5.21 and PostCSS ^8.5.18;
unplugin and its integration suite: Vite ^7.3.5;
VS Code packaging: @vscode/vsce ^3.9.2.

The refreshed lock selected Next 15.5.22, Vite 7.3.6, vsce 3.9.2,
brace-expansion 2.1.2/5.0.8, fast-uri 3.1.4, form-data 4.0.6, js-yaml
4.3.0, linkify-it 5.0.2, PostCSS 8.5.23, sharp 0.35.0, shell-quote
1.9.0, tmp 0.2.6, undici 7.28.0, and websocket-driver 0.7.5.
No exact high/critical baseline resolution remained.

pnpm run check:dependencies now owns the online invariant. It requires a
successful pnpm audit, valid JSON shape, zero high/critical counts, no
high/critical advisory ids, and exit status zero. Command, malformed JSON, and
registry error paths all fail closed. The typecheck lane runs both the live
gate and its unit regression, and the test-owner auditor claims the new test.

Dependabot now retains a dedicated TypeScript group while also assigning every
other npm dependency to a daily routine group. This replaces the former
TypeScript-only allowlist with an explicit remediation owner.

Findings

P2 — sound and corrected. The refreshed peer graph auto-installed the
registry release [email protected] for website's Typia dependency and pulled its
seven registry native packages into the lockfile. That could make optional
compiler discovery observe the published release instead of the current
workspace and added needless production install weight.
P3 — sound and corrected. The sharp override was global, crossed Next's
declared ^0.34.3 optional range, and did not record either its upstream
owner or the compatibility evidence required by #1012.
P3 — sound and corrected. On JSON parsing failure,
stderr ?? stdout selected an empty stderr and discarded a useful
stdout-only registry body, weakening the actionable failure diagnostic.

Resolution

Correction commit 65eaf4774366db6aaac738c12f43197acaee1033:

adds website's ttsc peer as workspace:*, eliminating the registry
compiler and native packages;
scopes PostCSS and sharp overrides to the exact [email protected] parent edges
and documents why each exception exists and how it is verified;
falls back to stdout when stderr is empty and adds a stdout-only regression.

Verification

pnpm install --frozen-lockfile — passed.
Audit/test-owner Node suites — 11/11 passed; 83 owners all claimed.
Website production build — 89 static pages, RSS test, 9 Typia dependency
graph assertions, Pagefind, and sitemap all passed.
VS Code extension — built and packaged a valid VSIX.
Graph feature suite — passed.
Unplugin feature suite — passed all adapter, Vite serve/build, webpack
cache/watch, and transform-cache scenarios.
Lockfile scan — every exact high/critical baseline resolution absent.
2026-07-26 local online audit — registry returned a gzip-decoding error, so
the new gate correctly remained red rather than fabricating zero counts.
The authoritative clean-network count is delegated to the exact-head GitHub
typecheck lane and is not pre-claimed by this review.
Prettier and git diff --check — passed.

Disposition: implementation accepted with the three corrections above; online
advisory state remains a merge-gate observation, not an ignored local failure.

samchon

Individual Self-Review — #1012 correction

Reviewed pushed correction:
65eaf4774366db6aaac738c12f43197acaee1033

Parent:
46ee51601ebe502e804e8d6419adbb3d33c5afcd

Result

CLEAN — no sound findings.

Peer and lockfile integrity

Website's Typia optional peer now resolves to
ttsc link:../packages/ttsc, backed by a workspace:* dev dependency. The
registry [email protected] snapshot and all seven registry
@ttsc/{darwin,linux,win32}-* packages introduced by the implementation were
removed. Existing workspace platform links remain unchanged.

This preserves one compiler identity throughout the monorepo: build-time
feature discovery can see the current source package, while the website does
not acquire an obsolete published compiler/native bundle as a production
resolution.

Override integrity

The only compatibility exceptions are now:

[email protected]>postcss: 8.5.23, replacing Next's vulnerable exact 8.4.31
edge while remaining inside PostCSS major 8;
[email protected]>sharp: 0.35.0, the patched sharp line that Next's ^0.34.3
optional range cannot select.

Both use pnpm's documented parent-selector form, affect no unrelated parent,
and carry adjacent removal/safety rationale. A runtime probe confirmed that
Next resolves PostCSS 8.5.23 and sharp 0.35.0, PostCSS processes CSS, and sharp
loads and emits a PNG in memory. The full website build exercises the same
static-export path.

Audit diagnostic integrity

Malformed audit output now selects a non-empty stderr first and otherwise
preserves stdout. The new regression feeds an invalid stdout body with empty
stderr and verifies that the body appears in the red diagnostic. Valid empty
JSON, command failure, registry error payloads, nonzero exit status, and
high/critical advisory ids remain fail-closed.

Verification

Dependency audit regression — 4/4 passed.
Test-owner regression plus live owner scan — passed.
Frozen install — passed locally and on Ubuntu, macOS, and Windows CI.
Website production build and postbuild assertions — passed.
VS Code build/package and smoke installation — passed in CI.
Direct resolution probes for workspace ttsc, PostCSS, and sharp — passed.
git diff --check 46ee51601..65eaf4774 — passed.

Disposition: correction accepted as clean. Exact-head online advisory counts
remain required before merge and will be reported from the GitHub typecheck
lane because the local registry transport failed closed.

samchon

Individual Self-Review — #1002 implementation

Reviewed pushed commit:
dd16f6667b92e807573ef9d2746b47fb526481f5

Issue:
#1002 — ttscserver reloads project plugins with a synthetic project root

Scope reviewed

the JavaScript launcher's initial LSP project selection and its confirmation
reload;
the logical and physical project identity carried by readProjectConfig;
package-discovered and config-declared plugin resolution;
symlink/junction spellings of the project directory and tsconfig;
the distinction between an explicit API project root and a root derived from
the selected config;
project-input snapshot root validation and the bounded stable-selection loop;
the native LSP diagnostic path used to observe the selected identity.

Implementation

loadLSPProjectPlugins now reloads from
project.identity.logicalConfigPath and no longer passes
projectRoot: project.root.

The logical config path is the original user-facing spelling selected from the
launcher cwd. Passing the previously collapsed physical config path erased
that spelling during the second readProjectConfig, while injecting the
physical root through projectRoot falsely converted a derived root into an
explicit caller override.

The corrected reload therefore reconstructs the same identity as the first
selection:

logicalConfigPath retains the symlink/junction spelling;
physicalConfigPath still resolves to the real config file;
logicalProjectRoot remains the logical config directory;
physicalProjectRoot remains the real config directory;
invocationCwd remains the launcher's logical cwd;
explicitProjectRoot remains absent because the launcher did not receive
that API-only override.

This does not weaken stability. The confirmation loop compares the full
project identity in lspSelectionSignature, and the native host independently
validates every project-input snapshot against the physical marker root.
Configuration replacement or symlink retargeting between passes therefore
causes reselection or a bounded fail-closed error rather than a false stable
answer.

Finding

Low — sound and corrected. The implementation regression observed
logical config, physical config, and invocation cwd in the LSP diagnostic,
but did not assert the simultaneously restored logicalProjectRoot or that
explicitProjectRoot was empty. Reintroducing the synthetic physical root
could consequently pass the test while violating the identity contract.

Resolution

Correction commit c7c2eeb4a extends the contributor diagnostic with
logicalRoot and makes the LSP regression require:

logicalRoot=<logical symlink/junction root>;
invocation=<same logical root>;
explicit= origin=, proving the explicit-root field is absent rather than a
physical root synthesized by the launcher.

The existing CLI and explicit API assertions remain distinct: the API case
continues to prove a deliberately supplied explicit root survives, while the
launcher case proves no such override is invented.

Verification

CI-equivalent TTSC_BUILD_SCOPE=test-ttsc pnpm run build:current — passed.
Focused project-rule lifecycle corpus before review — passed in 161 seconds.
Focused corpus after the identity assertion correction — passed in 124
seconds.
The review independently reran the focused native-plugin/LSP/watch
regression — passed in 125 seconds.
pnpm exec tsc -p tests/test-ttsc/tsconfig.json — passed for the
implementation.
Prettier and git diff --check — passed.

Disposition: implementation accepted with the complete-identity test
correction above.

samchon

Individual Self-Review — #1003 implementation

Reviewed pushed commit:
a74b3aaf5

Issue:
#1003 — ttscserver classifies a declared glob's root as a selection change
while the CLI treats it as data

Scope reviewed

the CLI projectInputReloadEventShouldNotify contract;
native LSP exact reload-file, reload-directory identity, immediate-entry, and
digest classification;
declared glob literal-root derivation;
strict containment at, below, and above reload directories;
physical path identity under case folding, symlinks, Windows drives, and UNC
spellings;
the protocol documentation shared by both hosts.

Implementation

The native LSP host now applies the same per-directory exemption as the CLI.
After proving that an event names the reload directory or one of its immediate
entries, it derives every declared glob's literal root and classifies the
event as ordinary data only when:

the glob root is strictly below that reload directory;
the changed location is within that glob-root territory;
no exact reload-file declaration already selected the cold lane.

A glob rooted on the reload directory or above it cannot erase the directory's
selection role. Exact reload files remain first in the decision and are never
exempt. Unrelated immediate entries still require a changed topology digest.

The directory-self rule was also aligned with the CLI: an event naming the
reload directory itself selects the cold lane regardless of the LSP change
type. The protocol document now states one contract for both the CLI watcher
and native LSP host.

Finding

Medium — sound and corrected. The implementation passed
candidateEntry, which intentionally preserves the final link name, to the
physical glob-territory comparison. If a missing literal root later appeared
as api -> data, the glob root resolved to data while the event remained
spelled api; the Go host selected cold even though the CLI resolved both
to the same physical data identity.

Resolution

Correction commit 997c99d6e preserves the two necessary identities:

candidateEntry remains the authority for whether the event is the reload
directory itself or one of its lexical immediate entries;
fully resolved candidate is now the authority for whether that event lies
in the glob root's physical data territory.

The correction adds positive and negative twins. A literal-root symlink whose
target remains inside the reload directory stays warm, while one targeting a
directory outside the strict boundary stays cold.

Verification

Focused reload-directory topology and glob-territory Go tests — passed.
Complete internal/lspserver package — passed before and after correction.
Exact reload-file, directory self-event, unrelated immediate entry, on-root,
and above-root cases — passed.
Windows CLI junction probe used by the review — confirmed the expected warm
decision for an in-bound physical alias.
Protocol MDX Prettier check — passed.
git diff --check — passed.

Disposition: implementation accepted with the physical-alias correction above.

samchon

Individual Self-Review — #1003 correction

Reviewed pushed correction:
997c99d6e

Parent:
a74b3aaf5

Result

CLEAN — no sound findings.

Identity separation

The correction uses candidateEntry only for topology. It preserves the final
component's declared spelling, which is necessary to recognize a new,
retargeted, or deleted symlink as an immediate entry of the reload directory.

The glob exemption now uses fully resolved candidate. That makes the changed
location and the literal glob root answer in the same physical identity
domain, matching the CLI's identity resolver:

a target inside the reload directory remains eligible for the data lane;
a target outside the directory fails strict containment and remains
selection;
a target equal to the reload directory is rejected by the explicit
equal-root guard;
a different volume or UNC share fails filepath.Rel containment.

Windows drive case, extended drive/UNC forms, and separator normalization
continue through the established projectInputFilesystemPath,
projectInputPathKey, and realProjectInputPath boundaries.

Preserved ordering

Exact reload files are still tested before glob exemption. Reload-directory
self events still select cold without change-type qualification. Non-glob
immediate entries still require a digest change, and ordinary deep descendants
remain outside the non-recursive topology surface.

Verification

Focused topology/glob test pair — passed.
Complete internal/lspserver package — passed.
git diff --check a74b3aaf5 997c99d6e — passed.
The two new symlink subtests run on POSIX. This Windows environment lacked
symlink privilege and skipped those subtests, while the review separately
verified the equivalent CLI boundary with a Windows junction and inspected
the shared Go physical-resolution path.

Disposition: correction accepted as clean.

samchon

Individual Self-Review — `7aff41097`

Verdict: NOT CLEAN — one P2 test-coverage gap.

P2 — the regression test does not exercise the stale install handoff

The new scenario in
tests/test-playground/src/features/test_playground_compiler_lifecycle_fences_stale_dependency_tasks.ts
increments and checks a local sourceVersion, but the reviewed production code
never reads that variable. It proves only the ordering inside
PlaygroundCompilerLifecycle.resetWorkerIfCurrent().

Consequently, deleting the essential PlaygroundShell.tsx branch that observes
a source-version change after service.installDependencies() and resets the
mutated Worker would leave the new test green. The test therefore does not yet
lock the complete failure boundary that motivated this correction.

The correction should add a deterministic delayed-install harness that changes
the source version while installation is blocked, then proves that completion
resets the Worker, clears dependency/editor/runtime metadata, and permits the
current source to install again. The scenario documentation should use the
repository's numbered three-part regression structure.

Verified sound behavior

A source edit during a current-generation reset still clears that Worker's
metadata.
A generation replacement during an old reset prevents the old reset from
clearing replacement-generation metadata.
createCompilerClient.reset() detaches its connection pointer synchronously
before awaiting termination, so a later connection is not accidentally
closed.

Validation

pnpm --filter @ttsc/playground build
pnpm --filter @ttsc/test-playground start — all 40 tests passed
pnpm exec tsc --noEmit -p tests/test-playground/tsconfig.json
git diff --check 7aff41097^ 7aff41097

The review was read-only and made no repository or GitHub changes.

samchon

Individual Self-Review — `4086177c6`

Verdict: NOT CLEAN — one P1 compatibility defect.

P1 — vscode-languageclient 10 requires a LogOutputChannel

[email protected] changed LanguageClientOptions.traceOutputChannel
to LogOutputChannel, while packages/vscode/src/extension.ts still creates
and passes a plain OutputChannel.

This is a runtime defect, not just a type mismatch. Version 10 subscribes to
onDidChangeLogLevel() during initialization and later calls trace(), neither
of which exists on a plain output channel. The extension's esbuild-only package
build did not type-check this path:

extension.ts:285 TS2740: OutputChannel is missing LogOutputChannel members

The correction must:

type every shared trace-channel boundary as LogOutputChannel;
create it with window.createOutputChannel("ttsc (trace)", { log: true });
add tsc --noEmit to the VS Code package build so this API boundary cannot
silently regress behind successful bundling.

Verified sound behavior

The dependency-audit unit tests all passed.
The live audit returned status 1 with only low/moderate advisories, and the
corrected high/critical gate passed as intended.
The lockfile contains only patched [email protected], [email protected], and
[email protected] resolutions for the reviewed edges.
The import sorter works with minimatch 10's named API.
vscode-languageclient's VS Code engine ^1.91.0 is compatible with this
extension's ^1.94.0 engine.

The review was read-only and made no repository or GitHub changes.

samchon

Individual Self-Review — `0e7843611`

Verdict: NOT CLEAN — one P2 and one P3 documentation defect.

P2 — the cache timing is still described too strongly

The document says a path's realpath and case decision are memoized when that
input is first resolved. The implementation caches finer-grained probes:

resolving a descendant can populate an ancestor realpath entry before the
ancestor is directly resolved;
resolving an existing directory does not necessarily probe or cache its case
behavior; a later caseSensitive() call or missing suffix can do so.

Injected filesystem operations reproduced both boundaries. The document must
describe normalized-input, realpath-prefix, and case-decision caches at their
first corresponding probes rather than promising a per-input resolve boundary.

P3 — “nearest existing directory” overstates the ENOTDIR boundary

The implementation treats both ENOENT and ENOTDIR as missing resolution.
When a path continues through a regular file, the nearest successful prefix can
be that file and the platform fallback can fold the remaining case-only suffix.
The existing wording therefore does not describe every accepted invalid path.

The documented missing-suffix guarantee should be scoped to prospective paths
whose nearest existing prefix is a directory. This states the useful public
contract without promising directory semantics for a path that traverses a
non-directory entry.

Other checks

The lazy, non-atomic context behavior and platform fallbacks are otherwise
accurate.
Windows drive and UNC root folding matches the implementation.
resolve, isWithin, caseSensitive, and the ttsc/path-identity exports
match the source and built package surfaces.
The focused Prettier check, ttsc build, and parent-to-commit diff check
passed.

The review was read-only and made no repository or GitHub changes.

samchon

Individual Self-Review — `34f0f8483`

Verdict: NOT CLEAN — one P2 test-documentation defect.

P2 — the regression test omitted the required cause paragraph

The test JSDoc now goes directly from its title to a numbered scenario list.
The development contract requires the three-part structure: title, a short
paragraph explaining the non-obvious regression cause, then the numbered
scenario.

The removed paragraph must be replaced with the cause specific to this test:
once an install RPC begins, cancellation cannot undo MemFS writes that already
happened; if matching dependency metadata survives, the next source can skip
the reinstall required by the now-empty or stale Worker.

Functional result

No implementation defect was found.

A source-version change during the install mutation resets the same-generation
Worker, clears the dependency graph, and returns false.
Generation replacement during reset prevents the old reset from clearing
replacement metadata.
Mutation errors still enter the existing partial-mutation recovery because
workerMutated is set before the RPC begins.
The delayed-install test is deterministic and non-vacuous, and its final
successful install proves the clean Worker remains reusable.

Validation

Playground package build passed.
All 40 playground feature tests passed.
The playground test TypeScript no-emit check passed.
The lifecycle regression passed 1,000 repeated runs.
The parent-to-commit diff check passed.

The review was read-only and made no repository or GitHub changes.

samchon

Exact-head CI review — macOS watch registration race

Verdict: NOT CLEAN — one P1 required-check failure on bd446ec12.

The exact-head watch (macos-latest) job failed in run 30213996143, job
89824875108:

source-overlapping output subtree: source edit did not reach compiler watch lane

The failing edit is issued synchronously after topology.refresh(false). That
call creates the native fs.watch handles, but Node exposes no ready event for
the macOS FSEvents registration. The test can therefore write before the native
backend has armed. A later 30-second deadline cannot recover an event that was
never observed.

This is distinct from the prior quiet-boundary correction. Waiting for an event
count to become stable prevents a late fixture event from contaminating the
next assertion, but it cannot make an already-lost first event arrive.

The fixture should allow the newly created native watchers to settle before the
first source write in each scenario. The existing post-event quiet boundary and
output/project assertions remain necessary and unchanged.

The VS Code package also passed its new tsc --noEmit and packaging steps on
this same macOS job before the focused watch suite began, confirming the
separate LogOutputChannel correction is effective on the runner.

samchon

Individual Self-Review — `d627bba59`

Verdict: NOT CLEAN — one P2 operator-contract gap.

P2 — the tracing instructions omit the channel log-level gate

The LogOutputChannel migration is required and type/runtime correct, but it
changes how vscode-languageclient 10 enables protocol tracing. The client reads
ttsc.trace.server only while the ttsc (trace) channel's log level is
Trace; a normal Info channel forces protocol tracing off.

The current README and website say that setting ttsc.trace.server to
"verbose" and reloading is sufficient. That no longer produces a trace in a
default environment.

The extension README, website setup guide, and manifest setting description
must include the VS Code command:

Run Developer: Set Log Level....
Select ttsc (trace) and choose Trace.
Set ttsc.trace.server to "verbose" and reload.

Verified sound behavior

Every trace-channel call boundary consistently uses LogOutputChannel.
The shared channel is owned by ExtensionContext.subscriptions; language
clients do not double-dispose an injected trace channel.
Per-client log-level listeners are removed during client shutdown.
VS Code ^1.94.0 supplies the { log: true } overload and is stricter than
vscode-languageclient 10.1's ^1.91.0 engine.
The package build type-checks before bundling and successfully produces the
VSIX.

The review was read-only and made no repository or GitHub changes.

samchon

Individual Self-Review — `bd446ec12`

Verdict: CLEAN.

The two corrected sentences now match the implementation's actual probe
boundaries:

descendant resolution can populate an ancestor realpath cache before direct
ancestor resolution;
resolving an existing directory need not probe case behavior until a missing
suffix or caseSensitive() needs it;
the missing-suffix guarantee is correctly limited to prospective paths whose
nearest existing prefix is a directory, without promising directory behavior
across an ENOTDIR boundary;
unproven Windows/macOS fallback, other-platform sensitivity, and Windows
drive/UNC root folding remain accurately stated.

The public ttsc/path-identity import works, internal deep imports remain
blocked, and the focused path-identity tests, injected probe scenarios,
Prettier check, and parent-to-commit diff check all passed.

The review was read-only and made no repository or GitHub changes.

samchon

Individual Self-Review — `561b754bc`

Verdict: CLEAN.

The test now follows the required three-part structure: a one-line verification
title, a short non-obvious cause paragraph, and the numbered scenario.

The cause is accurate. An install RPC that has begun can leave MemFS mutations
behind even when its result publication becomes stale; preserving the matching
dependency metadata can then make the next source skip a required reinstall.
“Empty or stale Worker” correctly covers the reset-during-source-change and
install-during-source-change paths without overstating either.

The parent-to-commit diff check, focused Prettier check, and all 40 playground
feature tests passed. The review was read-only and made no repository or GitHub
changes.

samchon

Individual Self-Review — `ecae07194`

Verdict: NOT CLEAN — one P1 troubleshooting defect.

P1 — reloading can close the Trace gate that the instructions just opened

vscode-languageclient 10.1 immediately calls refreshTrace() when either the
channel log level or ttsc.trace.server changes. A window reload is not needed.

VS Code's ordinary Developer: Set Log Level... choice changes the current
channel's session level. Persisting a default uses a separate action. Reloading
the window disposes and recreates the extension context and trace channel, so
the new channel commonly returns to Info and protocol tracing becomes
disabled again.

The reliable sequence is:

Set ttsc.trace.server to "verbose".
Run Developer: Set Log Level..., select ttsc (trace), and choose
Trace.
Do not reload; tracing starts immediately.

The package manifest's gate description, channel and setting names, and the
README/website discoverability are otherwise consistent. The focused Prettier,
diff, and VS Code TypeScript checks passed.

The review was read-only and made no repository or GitHub changes.

samchon

Individual Self-Review — `15b96a921`

Verdict: NOT CLEAN — one P2 determinism defect.

P2 — a fixed sleep cannot prove fs.watch registration is ready

Node exposes no readiness event for macOS FSEvents registration. A one-second
sleep reduces the race but cannot close it: a loaded runner can take longer, the
first source write is still lost, and the existing deadline only waits for an
event that will never arrive. The sleep also adds five seconds to every
platform's successful test run.

The deterministic pattern is to reissue a real source mutation while the
deadline remains, using a new value on each attempt, and stop as soon as an
event for that exact source path reaches the compiler lane. This tests the same
product behavior after registration without assuming a backend-specific setup
duration. The subsequent quiet-boundary, output-suppression, and project-input
assertions remain unchanged and non-vacuous.

The original failing macOS job was run 30213996143, job 89824875108. The
focused test passed repeatedly with the fixed sleep, but that demonstrates only
that one second happened to be sufficient in those runs, not that readiness was
observed.

The review was read-only and made no repository or GitHub changes.

samchon

Individual Self-Review — `c52632bf2`

Verdict: CLEAN.

vscode-languageclient 10.1 immediately refreshes protocol tracing when either
ttsc.trace.server or the trace channel's log level changes. Setting
"verbose" first and then selecting Trace on ttsc (trace) therefore
updates the live server without a restart. VS Code's ordinary per-channel level
is session state, so the explicit “do not reload” warning correctly prevents a
new default-Info channel from closing the trace gate.

The README and website instructions match, and both focused Prettier and
parent-to-commit diff checks passed. The review was read-only and made no
repository or GitHub changes.

samchon

Individual Self-Review — `71ab86f99`

Verdict: CLEAN.

The retrying startup stimulus is deterministic and non-vacuous:

every attempt writes a distinct source revision, so byte-stamp deduplication
cannot discard it as unchanged;
only a new post-baseline compiler event for the exact resolved source path
can satisfy the waiter;
unrelated config, project, or compiler events cannot report success;
late/coalesced source events are drained by the existing quiet boundary
before the output-suppression assertion;
an actually missing watcher still exhausts the original 30-second deadline
and fails.

The correction removes five fixed one-second sleeps from healthy runs while
remaining bounded to small retry writes in a failed scenario. The focused test
passed 20 repeated runs, the full 32-test Windows watch lane passed, and the
parent-to-commit diff check was clean. The original macOS failure evidence from
run 30213996143, job 89824875108, is consistent with the corrected
one-shot-registration race.

The review was read-only and made no repository or GitHub changes.

samchon

Exact-head CI review — macOS lexical/physical source identity

Verdict: NOT CLEAN — one P1 required-check failure on 71ab86f99.

Run 30214783977, job 89826941545, failed the first project root
scenario after the retrying stimulus exhausted its 30-second deadline.

The retry helper requires path.resolve(change.path) === path.resolve(source).
That is not a filesystem identity comparison. macOS hosted runners create
temporary projects through the lexical /var/... alias while fs.realpath and
WatchTopology's registration path use /private/var/.... Both names identify
the same source, but path.resolve() preserves the alias and the helper rejects
every valid physical callback.

This failure does not disprove the retrying stimulus. It proves its exact-path
predicate must use a filesystem oracle rather than lexical normalization. Both
paths exist during the write test, so comparing their native realpaths is
deterministic, independent of the implementation's own identity helper, and
still rejects unrelated compiler events.

The previous Windows review missed this system temporary-directory alias. The
new exact-head macOS evidence supersedes that platform assumption.

samchon

Individual Self-Review — `7756b4609`

Verdict: CLEAN.

Native realpath comparison correctly treats macOS /var/... and
/private/var/... as the same source while preserving the test's strict lane,
defined-path, and exact-file requirements. Repeated writes only overwrite an
existing tracked file, so both callback and fixture paths exist when compared.
The oracle is independent of the production identity helper and also
normalizes POSIX aliases plus Windows junction/short-path spelling.

The focused watch regression passed three repeated Windows runs, the full test
TypeScript no-emit check passed, and the parent-to-commit diff check was clean.
The exact-head macOS job remains the authoritative platform confirmation.

The review was read-only and made no repository or GitHub changes.

samchon

Campaign scope reconciliation

Head inspected: 7756b4609665e7479d37ec36ab16409ce283834f

PR #1017 correctly owns the 12 issues frozen by its recorded discovery gate:
#1002-#1006 and #1010-#1016. Their implementations, closing lines, tests, and
review ledger remain the acceptance surface for this pull request.

The repository also has two later published, accepted issues:

#1018 — cross-copy synthetic-comment state in @ttsc/factory
#1019 — config-evaluator process-failure classification in @ttsc/lint

They were published after this pull request's discovery saturation and claim,
so they were not part of its frozen issue set. Folding them into the settled
head now would discard the exact-head CI and final-review gate and would
retroactively change a claimed cycle after development opened. Starting a
parallel branch or worktree would also violate the solo-campaign workflow.

Disposition: keep #1018 and #1019 open, merge #1017 only after its own exact
head is green and Overall Self-Review is clean, then synchronize master and
start the next full discovery saturation. Revalidate both issues against that
integrated baseline and place them, plus any further accepted candidates found
before the next empty round, in the next single cycle pull request.

This means a successful merge of #1017 completes its 12-issue cycle but does
not complete the repository-wide campaign. The campaign remains active until
#1018 and #1019 are resolved, a renewed full-scope round is empty, all campaign
pull requests and branches are closed, and the synchronized target checkout is
clean.

samchon

Overall Self-Review — final exact head

Head: 7756b4609665e7479d37ec36ab16409ce283834f

Verdict: CLEAN.

I completed a fresh solo review of the complete pull-request surface against
master, including all 101 changed files, 12 tracked issue contracts, every
production hunk, tests, generated/configuration changes, package wiring,
documentation, and the corrections produced by earlier review rounds.

CI, dependency, and repository gates

The line-ending gate compares generated content independently of checkout
EOL policy and its .gitattributes/workflow triggers cover the gate itself.
Test-owner discovery is derived from tracked repository state, excludes
generated mirrors, distinguishes files from test-package directories, and
has fail-closed fixture cleanup.
Dependency auditing validates the pnpm JSON shape, treats pnpm's documented
low/moderate status 1 as non-blocking, still rejects high/critical advisories,
command/registry errors, malformed output, unexpected statuses, and every
known vulnerable lock resolution.
The patched nested dependency edges are API-compatible in their actual
consumers. The VS Code language-client update now type-checks before
packaging, supplies the required LogOutputChannel, and documents the
live Trace-level gate without a destructive reload step.

Filesystem identity, watch, and LSP

JavaScript and Go hosts consistently use physical path identity and
per-directory case semantics instead of process-wide lowercasing.
Windows drive/UNC roots, junctions, reload-directory fingerprints, logical
project identity, glob territory, and case-sensitive directory boundaries
remain distinct where their contracts require it.
Compiler inputs survive output directories that contain the project, emitted
products remain excluded, rejected project-input roots recover through safe
ancestors, and genuinely unobservable roots surface an error.
Watch regression fixtures establish native watcher stimulus
deterministically, drain late/coalesced input events before negative output
assertions, and compare lexical/physical aliases through native realpaths.
The final macOS correction specifically covers hosted runners' /var to
/private/var temporary-directory identity.
The LSP proxy harness drains successful output, fails transport shutdown
errors, and preserves only the ordering guarantees owned by each stream.

WASM and Playground lifecycle

WASM initialization is bounded through fetch, instantiation, runtime start,
and readiness. A runtime that has begun executing terminally poisons its
Worker instead of allowing a stale readiness callback to hijack a retry.
Terminal compiler failures retain their structured marker through the RPC
boundary and replace the Worker at the Shell-owned recovery boundary.
Compiler, dependency, execution, and client generations fence queued and
active callbacks. A source change during dependency reset or install clears
the mutated Worker and all matching compiler/editor/runtime metadata without
allowing an old generation to clear its replacement.
The delayed-install regression executes the mutation handoff rather than only
testing callback order, and proves a clean current-source install remains
possible afterward.

Graph and public contracts

Graph viewer bind/listen failures are owned, reported once, and release their
HTTP lifecycle without an uncaught exception.
Dump parsing rejects invalid JSON, stale schemas, and malformed current-schema
shapes before reduction or serving, while legacy absolute filename reduction
remains compatible.
ttsc/path-identity is exported in development and packaged surfaces while
internal deep imports remain blocked. Its documentation now states the true
lazy realpath-prefix and case-probe cache boundaries, platform fallback, and
valid prospective-path scope without claiming an atomic filesystem snapshot.
README and website changes match the implemented API, failure, retry,
tracing, and stability contracts.

Review-round disposition

Earlier Overall rounds found and corrected the missing public path-identity
documentation and newly disclosed high-severity dependency resolutions.
Mandatory Individual reviews then found and corrected stale Playground
mutation coverage, VS Code language-client compatibility and tracing
instructions, path-identity wording, and cross-platform watcher fixture
ordering/identity. Every resulting correction commit received exactly one
read-only Individual Self-Review; the final descendants are CLEAN.

This clean verdict is the merge gate for PR #1017's frozen 12-issue scope. The
later published #1018 and #1019 are not findings in this base-to-head diff and
remain open for the next post-merge campaign cycle; therefore this verdict does
not claim that the repository-wide campaign itself is complete.

Validation

pnpm format — clean
pnpm run check:format — clean full Prettier and Go gate
pnpm run assert:project-layout
pnpm run check:flags
pnpm run test:typecheck — every test TypeScript project
pnpm run check:dependencies — low 6, moderate 15, high 0, critical 0
CI unit gates — 20 tests clean
Playground build and all 40 feature tests
VS Code type-check, esbuild, and VSIX packaging
Windows watch lane — all 32 tests; startup stimulus repeated 20 clean runs
Focused graph, WASM, LSP, path-identity, package, and documentation checks
recorded in the linked Individual reviews
Exact-head GitHub checks: 64/64 passed
git diff --check origin/master...HEAD and a clean tracked worktree

A monolithic local pnpm test attempt reached the execution tool's 15-minute
ceiling while still progressing through native feature subprocesses and did not
emit a failing assertion; it is not counted as a pass. Its orphaned test
subprocesses were terminated. The repository's split exact-head CI lanes are
the authoritative complete test execution.

No unresolved correctness, regression, test-quality, documentation, packaging,
or maintainability finding remains on the reviewed head.

samchon added 4 commits July 26, 2026 13:14

chore: claim project-input watch campaign cycle 2

c21339c

fix(ci): stabilize formatting across checkout line endings

ee2a5a1

fix(ci): run line-ending checks for attribute changes

9bcedf6

fix(ci): discover only tracked test owners

51056b2