[ScriptedAlchemy]

Refs #4520

Root cause

Merged #4537 fixed the spurious changed-name set comparison, but a comment-only edit still decoded the sealed file-evidence segments of every file mentioning a carried name. Most of those sealed edges did not land in the edited file. The issue's isolated 6.6k-file profile recorded thousands of unrelated reads.

Fix

• Persist a conservative 256-bit target-path Bloom filter in each sealed file-evidence descriptor.
• Before inflating a candidate dependent's evidence, rule out descriptors that definitely cannot reference an edited path. Possible matches still decode and perform the existing exact edge-target comparison.
• Check the descriptor against actual edge target paths whenever evidence is decoded; a mismatch rejects the seal.
• Advance the generation manifest revision to 22, making filters mandatory and intentionally refusing prior revision seals through the existing typed rebuild path. There is no legacy fallback, compatibility shim, or change to file/edge identity.

Regression and verification

• The existing sparse successor integration test now asserts zero unrelated parent evidence-segment reads, positive evidence reads for an actual dependent, unchanged carried file-segment reads, and sparse/cold output equivalence after a comment-only edit.
• A new filter unit test establishes no false negatives for sealed target paths through serialization, including a non-vacuous empty-target negative.
• The stable-bytes manifest fixture now asserts that all evidence descriptors have exactly four filter words and that a filterless current-revision manifest is rejected. Its canonical revision-22 state-digest golden is refreshed from the actual hosted Bazel failure: sha256:08e91a89b2dd82615897c5df08b74740fc483551f8f8cef1ef57cf96a93c837f. The existing strict golden assertion remains enabled.
• The latest Bazel run on 7b7e179e showed the stale digest, non-resolving Other::new() fixture edges in both sparse regressions, and a rustfmt wrap. Commit 1c63f1ca fixes all three: verified golden, unambiguous cross-file crate::other::new() function calls, and exact rustfmt formatting. These test fixtures still require a new nonzero executed pass on this head, not merely compilation.
• The real 6.6k-file before/after sparse benchmark and independent human review have not yet been completed. No native macOS pass is claimed.

Safety

Do not merge or close #4520 until the golden, exact-head Bazel tests, independent review, changed-chunk and real-workload performance evidence are satisfied. No Kev/decision-model or release changes.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 1e67b25

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[ScriptedAlchemy]

Review finding (source-level, not a completed CI result): the new serialized target_filter: Some(...) in PartitionedFileEvidenceDescriptorV1 changes the canonical generation manifest payload, while partitioned_codec_has_stable_bytes_and_round_trips explicitly asserts envelope["state_digest"] == PARTITIONED_FORMAT_STATE_DIGEST in tests/code_index_suite/production_orchestration.rs. This test fixture has nonempty file_evidence, so the current golden digest looks certain to fail even if the new filter is correct. Please verify using Bazel and update the canonical format/fixture expectations only after checking that the format revision and old-reader refusal contract remain correct; do not weaken/remove the stable-bytes assertion. This is separate from #4507's source-proof test PR #4791, so I have not changed this lane.

[ScriptedAlchemy]

#4520 ownership / merge coordination: hold PR #4789; do not auto-merge it from the hourly general PR sweep. This is an issue-specific code-index performance fix, not Kev/decision-model work. It was marked ready only so the repository's normal PR workflow schedules the Bazel Linux authority (draft PRs skip that job). Correctness, canonical golden bytes, independent review, and a real 6.6k-file benchmark are not all proven yet. Leave #4520 open and this PR unmerged until those are verified. Current source commits: d009fee (strict revision 22 + rustfmt) and 52db4ab (filterless seal refusal regression). Refs #4520.

[ScriptedAlchemy]

Published c54dc47, preserving the concurrent formatting repair f1c9564 as its sole parent. Branch update used expected-head, force=false; no duplicate PR or rewritten history.

The new parser-backed code_index_suite::sparse_comment_publication module closes a validation gap: the earlier read-avoidance regression compared cold output from a separate rebuild. This test checks the same measured sparse successor, with only the edited file captured. It requires real evidence descriptors for four unrelated callers, unchanged read counters for them, positive reads for a genuine dependent, exact chunk-delta equality against independently cold-built after-state, nonzero changed chunks and reuse, exact sparse/cold edge equality, three required incoming-edge repoints, no references to the old target occurrences, and exact nonzero fan-in/fan-out. It is registered in the existing Bazel integration suite; no assertions, tests, limits, or golden checks were removed or weakened.

Validation is still pending, not a claimed pass. Hosted CI for this exact head is https://github.com/ScriptedAlchemy/tracedecay/actions/runs/42435823939. The previous head passed repository formatting/gates and Clippy, but those results do not validate this new test. No local Rust/Bazel execution was possible, and Cargo was not invoked.

Keep the merge hold. The canonical manifest state-digest golden must still be obtained from actual Bazel output and reviewed, not guessed or loosened. The real 6.6k-file before/after workload and independent review remain outstanding. The existing native test workflow requires manual workflow_dispatch (run_os=true, native_platform=macos, suitable code-index targets); the available connector exposes no dispatch action, so no native execution is claimed. #4520 remains open; no master, release, Kev/decision-model, infrastructure, or production changes.

Refs #4520

[ScriptedAlchemy]

Refs #4520 — CI repair published as 96b71325, fast-forwarding the existing branch with exact expected old head c54dc475, no rewrite. Prior exact-head CI exposed E0277 in both Clippy and Linux Bazel compilation: a sha2::digest::GenericArray does not implement Rust LowerHex, so the new test could not compile. The repair formats each digest byte explicitly and retains the same stable content-addressed 12-byte prefix convention used by the existing sparse tests. It changes only the test fixture, not production or an assertion. New exact-head CI was queued at publication; no new-head pass is claimed. The non-vacuous integration, canonical manifest digest golden, real 6.6k-file benchmark, and independent review remain gated; do not merge or close.

[ScriptedAlchemy]

Refs #4520 — Additional source-level test correction published in 7b7e179e, expected-old-head, nonforce. GenerationPlanner mints monotonic repository sequences: a cold after-state is generation sequence 1, while the sparse successor is sequence 2. The original new regression mistakenly compared entire chunk-change seals (including intentionally different to_generation and manifest addresses). It now validates the actual published change seal and asserts exact equality of added/changed, deleted, reused count, and reused digest, plus authoritative parent/successor IDs and provably distinct cold/sparse generation identities. This preserves and strengthens content correctness rather than weakening the test. The prior c54dc475 Linux and Clippy failures were traced to GenericArray: LowerHex and fixed in 96b71325. Latest exact-head CI: https://github.com/ScriptedAlchemy/tracedecay/actions/runs/42437748915 (queued; no pass claimed). Continue hold: canonical revision-22 stable digest golden must come from executed Bazel, plus nonzero regression pass, real 6.6k-file benchmark, independent review, and native platform verification. No merge/closure or prohibited scope changes.

[ScriptedAlchemy]

Refs #4520 — guarded source repair published: 1c63f1cac22c, verified current branch tip. Its sole parent is 7b7e179e; the fix/4520-targeted-evidence-repoint ref moved with expected_sha=7b7e179e, force=false. No history rewrite or duplicate PR.

Hosted Bazel on the previous head found: (1) canonical manifest payload digest sha256:08e91a89b2dd82615897c5df08b74740fc483551f8f8cef1ef57cf96a93c837f (not the revision-21 golden); (2) both sparse unit and integration fixtures lacked sealed evidence for their associated-method Other::new() callers; (3) one exact rustfmt wrap. The new commit updates only the verified golden, uses a module-level crate::other::new() call to create concrete unrelated cross-file evidence alongside the same new names, and applies the exact formatter change. Positive dependent reads, changed-chunk/graph equality, and strict no-unrelated-read assertions stay intact.

MERGE HOLD REMAINS. Do not merge or close until exact-head Bazel reports nonzero passing regressions and associated suites, 6.6k-file measured workload, independent review, and native verification. CI on the newly published head is unverified as of this comment. No native or benchmark result claimed. No Kev or release work.

[ScriptedAlchemy]

Refs #4520 — published 2165c4c86de7a8b5d6ba09de0ffd99590f58f50e directly through GitHub, with sole parent 1c63f1cac22ce5476b1f4fc579be2bc25bf18f08 and a verified expected-head, force=false branch update. The concurrent golden, module-level fixture and rustfmt repairs are preserved. The older unreferenced candidate 40ad216e was NOT pushed; do not apply it over this branch.

This commit strengthens the existing integration module without changing production semantics or weakening checks:

• Verify four actual Calls edges to the unrelated src/other.rs::new before taking read-counter baselines and again after restoring the same measured sparse successor. Descriptor presence alone can represent unresolved evidence, so it is not sufficient proof. Qualified symbol identities distinguish the many new definitions.
• Keep all zero-unrelated-read, positive-dependent-read, exact cold-derived chunk partitions, complete graph equality, stale-target exclusion and fan-in/fan-out assertions.
• Add a real sealed-generation corruption regression: select a nonempty target filter, zero it, recompute the outer manifest digest, prove metadata still parses, and require the exact semantic evidence-descriptor refusal during full restore. The untouched seal must still restore its original graph.

Exact-head CI: https://github.com/ScriptedAlchemy/tracedecay/actions/runs/42443667141 (queued when observed; NOT a pass). I inspected the actual prior-head Bazel artifact: code_index_suite 220 passed/2 failed, unit_test 363 passed/1 failed, resident_accounting 4 passed. Those are failure diagnostics, not proof of this new head. No local Rust execution or Cargo invocation occurred.

Keep the merge hold. Require nonzero current-head Bazel regressions/full applicable checks, the actual 6.6k-file time/memory/read/reseal benchmark, independent review, and native evidence. No merge, issue closure, release, Kev/decision-model, infrastructure or production changes.

[ScriptedAlchemy]

Refs #4520 — hosted verification scheduling blocker, not a test result (observed 2026-11-08 around 05:22 UTC): the exact-head PR #4789 workflow 42443667141, for commit 2165c4c86de7a8b5d6ba09de0ffd99590f58f50e, has remained queued since 03:40 UTC (over 100 minutes). Repository gates, Change scope, and Benchmark harness self-tests are all queued with no runner assigned; the Linux Bazel test job has not begun. Other recent repository PR workflows also show queued entries. This does not prove an infrastructure outage or a code failure, and the benchmark-harness self-tests are not the requested 6.6k-file workload.

Fresh source review found no confirmed new defect to justify cancelling this costly run with another speculative push. Revision-22 golden was already measured from hosted Bazel and corrected by 1c63f1ca; the strict, nonvacuous sparse/digest/corruption regressions at 2165c4c8 remain unexecuted on their exact head. No Cargo, releases, infrastructure, Kev work, or other PR changes. Keep PR #4789 unmerged and issue #4520 open. Await nonzero Bazel results before further source repairs; 6.6k-file throughput/read/graph/RSS measurements, independent review, and native macOS proof still remain.

[ScriptedAlchemy]

Refs #4520 — confirmed exact-head CI failure, merge hold unchanged. On 2165c4c86de7a8b5d6ba09de0ffd99590f58f50e, workflow 42443667141 finished Repository gates with a single //crates/tracedecay-code-index:rustfmt_check_2024 failure in tests/code_index_suite/sparse_comment_publication.rs at line 9. Hosted rustfmt requests precisely this import wrap:

-        CodeIndexProductionOwnerV1, CodeIndexPublishedGenerationV1,
-        MemorySealedPublicationStoreV1,
+        CodeIndexProductionOwnerV1, CodeIndexPublishedGenerationV1, MemorySealedPublicationStoreV1,

All eight completed repository-policy Bazel test targets passed; the formatting genrule prevented the overall gate. Change scope and benchmark harness self-tests passed, but the latter is not the 6.6k-file issue workload. At observation Clippy and Linux Bazel were still building/running on this exact head; native macOS skipped. Intentionally preserving that expensive verification before any next nonforce, expected-head format repair, so additional compiler or behavioral failures can be repaired in one narrow commit. No tests weakened, no benchmark/native pass claimed, no merge/closure. Keep PR #4789 held; PR #4791 and the other issues remain separate.

[ScriptedAlchemy]

Refs #4520 — new exact-head CI infrastructure blocker; no code regression inferred. PR #4789 workflow 42458746991 on aadc478c960b229372c927e52d669cbb648d94e6 has now finished Test Linux (fleet) and Dashboard as FAILURE during Bazel external-repository fetch/analysis, before any relevant code-index tests executed.

• Linux fleet job 128670827817: fetch of hermeticbuild/hermetic-launcher release binaries-20261025/finalize-stub-x86_64-linux returned HTTP 504 Gateway Time-out at ~08:54 UTC; Bazel reported analysis errors and 0 usable proof of the new regressions.
• Dashboard job 128670827814: separate fetch of binaries-20261025/runfiles-stub-x86_64-linux returned the same 504 at ~09:03 UTC; Bazel found 0 test targets because analysis failed, not a valid zero-test green.
• Repository gates (including rustfmt), Change scope, and Benchmark harness self-tests passed. The self-tests are NOT the original ~6.6k-file workload benchmark. Clippy and the remaining platform jobs are still queued; macOS was skipped.
• Attempted targeted reruns of the two failed jobs through GitHub Actions, but GitHub returned 403: "The workflow run containing this job is already running". Retry the failed jobs after the overall run becomes eligible. Do not edit sources/CI or cancel other queued checks to work around a transient download timeout.

The prior verified revision-22 golden and all strict sparse/chunk/graph tests remain intact. HOLD MERGE and leave #4520 open until nonzero exact-head Bazel regression passes, real before/after benchmark (reads, graph reseals, changed chunks, time, peak RSS), independent review, and native coverage are proven. No branch commit, workflow/infrastructure modification, or scope-excluded action in this check.

[ScriptedAlchemy]

Refs #4520 — new executed Bazel regression failures, not the previous external-fetch 504. Exact-head CI attempt 2 on aadc478c960b229372c927e52d669cbb648d94e6 reached actual Rust tests. //crates/tracedecay-code-index:unit_test ran 363 passed / 1 failed: production::sparse_increment_tests::a_comment_beside_same_named_symbols_decodes_only_what_it_reaches panicked at sparse_increment_tests.rs:402 because the expected dependent evidence descriptor was absent. //crates/tracedecay-code-index:code_index_suite ran 222 passed / 1 failed: sparse_comment_publication::comment_successor_skips_unrelated_evidence_and_publishes_the_cold_chunk_delta panicked at line 159: src/main.rs must seal real cross-file evidence. The independent falsifiable corruption regression sealed_evidence_refuses_a_resealed_false_negative_target_filter passed; the strict canonical codec golden also passed. These are real nonzero tests, but neither affected suite is green.

Source review points to the fixture's ambiguous src/main.rs dual use beside src/lib.rs, not yet proof of a production filtering defect. The narrow proposed repair is a real src/dependent.rs library module declared in src/lib.rs, using a parser-attested use crate::util::helper; helper() call (the repository has already passing explicit-import binding fixtures). Keep all positive dependent-read, zero unrelated-read, sparse/cold chunk and graph, edge repoint, corruption, and golden assertions intact. Do not treat this hypothesis as a pass until executed.

The broad Linux //... pass also observed three unrelated automation_runner_test scheduler assertions and timeouts in session_suite and tracedecay-global-db:unit_test; those are separate ownership, not a reason to weaken this PR's tests. Clippy, repository gates including rustfmt, Dashboard and change-scope checks passed. Windows native verification remains actively building on the exact head, so no source push was made here that would cancel its costly verification. No merge or issue closure. Original explicit hold on #4789 remains; real 6.6k-file performance measurements, independent human review, native macOS proof and passing exact-head sparse tests are outstanding.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[ScriptedAlchemy]

Refs #4520 — nonzero hosted Bazel regression evidence, on a superseded head only. I downloaded and inspected the actual bazel-test-logs-Linux-fleet artifact (ID 13635795098) for workflow 42521937825 on b06807bebc1a8b8ac3395b7245f33566dc6f3783:

• //crates/tracedecay-code-index:code_index_suite: 223 passed, 0 failed, 20.68 s. Both sparse_comment_publication::comment_successor_skips_unrelated_evidence_and_publishes_the_cold_chunk_delta and sealed_evidence_refuses_a_resealed_false_negative_target_filter passed, as did partitioned_codec_has_stable_bytes_and_round_trips with the strict revision-22 digest.
• //crates/tracedecay-code-index:unit_test: 364 passed, 0 failed, 29.06 s, including a_comment_beside_same_named_symbols_decodes_only_what_it_reaches and sealed_target_filter_round_trip_has_no_false_negatives.
• Clippy, rustfmt/repository gates, Dashboard and change scope passed. The overall Linux fleet was red due to separate tracedecay:automation_runner_test (167 pass / 3 fail) and tracedecay-cli:core_cli_suite (205 pass / 1 fail); do not count the overall fleet green or weaken unrelated tests.

The PR subsequently advanced through two unrelated test-file commits to 1e67b25e1d349cc9e2f938db3ea12738800905cc (same code-index source, but a new exact-head CI run 42527817638 is running). These nonzero results prove the fix's prior head, not the new head or full acceptance. Still missing: a true before/after run on the original ~6.6k-file workload including file/evidence reads, graph reseals, changed chunks, elapsed time and peak RSS; independent HUMAN review; and hosted native macOS when available. The native macOS job was skipped, not passed.

Keep PR #4789 unmerged and issue #4520 open. No merge/auto-merge from the general sweep.