Route package integrations through workspaces

[richlander]

Summary

package --all-libraries now routes explicit Integrations demand through the
workspace model:

• partitions selected managed assemblies into one binding-consistent context
  group per target framework
• composes root-relative dependency resolvers behind one shared group policy,
  then executes AssemblyContextIntegrationsQuery sequentially, retaining one
  participant image at a time
• correlates typed results by acquisition registration and inspects each
  successful library through the same retained immutable image generation
• projects evidence and typed failures into the existing Finding model so
  successful Markdown, tabular, JSON, count, and Integration Opportunities
  output remains available without a second Integrations scan; failed
  prerequisites do not become false opportunity rows
• preserves the group query's exact presence result and records typed failures
  before later host inspection, so malformed participants emit visible
  warnings and return a nonzero incomplete status without hiding healthy rows
• prevents acquisition-budget rejection from falling back to mutable-path
  inspection and isolates malformed managed metadata before group creation

The package workspace's streaming callback preserves the exact participant
registration and provenance, allowing the existing async library pipeline to
suspend without reopening mutable package paths. Remote package provenance uses
the coordinate selected by acquisition, including tool-wrapper redirects,
rather than package-controlled nuspec fields. Local archives use a valid
normalized NuGet coordinate when available and otherwise carry local-archive
provenance.

Compatibility boundary

Direct library and package --library retain their existing controls. The
shared direct-library host now consumes the same grouped query through main's
batch runner, while package --all-libraries keeps the per-TFM streaming host
needed for bounded memory.
Native or descriptor-invalid package files such as blank-name assemblies
continue through the existing per-library path; malformed metadata decoder
failures no longer abort healthy grouped participants.
Execution remains deterministic and sequential; cancellation-aware and
concurrent group executors remain later work.

Validation

• dotnet build dotnet-inspect.slnx -c Release
• dotnet run --project src/DotnetInspector.Queries.Tests -c Release
  • 23 passed
• dotnet run --project tests/ILInspector.Metadata.Tests -c Release
  • 1,329 passed
• dotnet run --project src/dotnet-inspect.Tests -c Release
  • 3,247 total, 0 failed, 4 skipped for platform-specific inputs
• focused PackageCommand_AllLibraries_*,
  PackageIntegrationsWorkspaceTests, acquisition, failure-visibility, and
  workspace lifetime gates
• npx markdownlint-cli over all four changed architecture documents

[richlander]

Round 3 findings are addressed in f806f3e:

• malformed assembly-definition names are classified as invalid images and fall back without aborting healthy participants
• remote provenance uses the resolved acquisition coordinate; local archives use only valid normalized nuspec coordinates, otherwise local provenance
• grouped Integrations failures now emit deduplicated warnings, preserve successful output, and return a nonzero incomplete status

The branch remains based on the current origin/main (1d47eb9). A new fixed-head review will follow after current-head CI is green.

[richlander]

Round 4 reconciliation for reviewed head f806f3e6 (resolved by d33ae958):

• GPT-5.6 Sol and Claude Opus: grouped malformed-metadata failures could disappear when later host inspection returned null. The command now records the typed group failure before host inspection; an end-to-end malformed TypeDef regression preserves healthy rows, warns, and exits incomplete.
• GPT-5.6 Sol and Claude Opus: remote provenance used the wrapper ID, and local nuspec validation accepted invalid separator placement. Provenance now uses the resolved payload coordinate and local IDs enforce NuGet separator grammar.
• GPT-5.6 Sol: stale architecture status was corrected. Group evidence now also carries exact legacy presence rather than reconstructing narrower flags from rendered rows.
• Claude Opus: ecosystem/OpenTelemetry failure remains intentionally atomic as one grouped Integrations query outcome; streaming release remains intentionally terminal. Both contracts are now explicit. Mutable-path races, post-release misuse, and RID provenance do not justify defensive product complexity for this well-behaved extracted-package host.

Local validation on d33ae958: full Release build; 22 query tests; 1,334 metadata tests; 3,216 CLI tests with 0 failures and 4 platform skips; changed Markdown lint.

[richlander]

Round 5 findings on d33ae958 are resolved by 7e54363a and 9fd37c03:

• GPT-5.6 Sol: acquisition-budget Rejected entries no longer invoke host
  inspection with a null retained descriptor, so the budget cannot be bypassed
  by reopening the path.
  GroupedRejection_DoesNotFallBackToPathInspection gates the orchestration.
• GPT-5.6 Sol: the malformed-participant regression now executes Markdown,
  JSON, count, and tabular output and asserts each real shape plus nonzero
  incomplete status.
• Claude Opus: descriptor preflight now catches the same metadata range and
  overflow decoder failures as snapshot acquisition; package workspace
  preflight preserves the failure, healthy output, warning, and incomplete
  status. The late grouped decoder boundary maps those exceptions to the
  existing typed malformed-image result.
  PackageCommand_AllLibraries_MetadataOverflowPreservesHealthyOutput uses
  the reduced metadata-stream-count repro.
• GPT's blank-AssemblyDef concern was withdrawn after reconciling the explicit
  compatibility boundary: those images never become workspace participants,
  so the grouped Rejected/Failed contract does not apply.

Local validation on 9fd37c03: full Release build; 22 query tests; 1,334
metadata tests; 3,218 CLI tests with 0 failures and 4 platform skips; changed
Markdown lint.

[richlander]

Integrated origin/main after the round-6 clean head moved behind interacting changes.

• Reviewed head: 9fd37c0336185934c1037202bcb35695e3437900
• Previous main tip: 1d47eb94
• Integrated main tip: 355196a8579a6feb1b2aa02b4e381b0c2782ba63
• New head: 8d97575cd6ded532157a82d6201ddf8437f17ae2

The range included the shared assembly-context Integrations CLI adoption (#3929), empty-section selector changes (#3894), and multi-assembly output rewrite (#3931), overlapping this PR across the query host, acquisition descriptors, package orchestration, and rendering. Conflict resolution keeps main's shared direct-library runner and current output pipeline authoritative while retaining this PR's package-specific per-TFM streaming workspace, exact-presence projection, failure visibility, and bounded-memory behavior. The direct runner was also aligned with package preflight containment for malformed metadata-header overflow. #3934 was non-interacting decompiler work carried by the merge.

Per the explicit approval to integrate these interacting changes, round 7 will review this exact head.

[richlander]

Pre-round gate update: main moved once more before round 7 began. I integrated 945e7502 (#3898) at new head 0fc7517cd5e60d7bc4050c6f9f6af50fb2fb2e4b.

The commit has no textual overlap with this PR, but it changes AssemblyDependencyResolver, which the package workspace composes once per root and target-framework group, so it was behaviorally relevant. The merge was conflict-free; the current Release build, 381 shared-services tests, and 35 focused package/direct Integrations host tests pass. No reviewer had started on the prior head.

[richlander]

Round-7 finding resolution at 4d22870480da00500478974f600f68d35cffa73c:

• GPT-5.6 Sol: found that managed metadata failing with BadImageFormatException during package preflight was omitted from grouped failures, retried through the legacy path, and could exit 0 without an incomplete diagnostic.
• Reproduced: a package with one healthy participant and one truncated managed metadata table exited 0 with no grouped warning on the reviewed head.
• Fixed: package preflight now distinguishes non-managed/blank-identity compatibility skips from malformed managed metadata. The malformed participant enters the existing typed grouped failure channel; healthy output remains available and Markdown, JSON, count, and TSV all return incomplete status.
• Gates: real package output-shape test, blank-identity compatibility test, acquisition-path test, full Release build, 1,329 metadata tests, and 3,231 CLI tests (0 failed, 4 platform skips).
• Claude Opus 5: clean on the prior head; both required reviewers will re-review this fixed exact head.

[richlander]

Pre-re-review gate update: main advanced to 26decd5f before the fixed-head review began. The new range included typed extension-method query migration (#3896), which overlaps the same query registry, LibraryMetadataService, sections, and coherence tests as this PR, plus exact output line limits (#3942).

Integrated at 817b8050ecab20b8d97678cb360b68a95d307214. Main's typed extension query and output changes remain authoritative; conflict resolution keeps the extension query on the command-owned borrowed metadata session and preserves package Integrations per-TFM streaming. Current local evidence: Release solution build, 234 section/workspace tests, both malformed/blank package gates, Markdown lint, and 3,238 CLI tests with 0 failures and 4 platform skips. No fixed-head re-review had started.

[richlander]

Round-7 re-review findings resolved at 46dcfe77b825542518cceb103f96cbe9e5707d5f:

• Unreadable preflight fallback (GPT-5.6 Sol): reproduced IOException under an exclusive file lock. Package preflight discarded it, leaving the legacy callback eligible to reopen the path. Unreadable acquisition now records a terminal grouped failure; the exclusive-lock gate proves no inspection callback runs.
• OpenTelemetry presence divergence (GPT-5.6 Sol): reproduced with public OpenTelemetry.Internal.CustomTracer: evidence rows existed while legacy HasSupport was false, but grouped presence inferred true from non-empty rows. Grouped presence now calls the same OpenTelemetryScanner.HasSupport predicate; a synthetic close-negative gate pins rows=1 with presence/count remaining false/0.
• Claude Opus 5: clean on the prior head; both required reviewers will re-review this fixed exact head.

Current local evidence: Release solution build, 23 query tests, 3,239 CLI tests with 0 failures and 4 platform skips, focused exclusive-lock and close-negative gates, and Markdown lint.

[richlander]

Per explicit post-clean-review approval, integrated main commit d90c7ff4
(#3948) at head f35809c9551dc696d281e81fc1fd78ded59fe98d.

The range migrates custom attributes onto the typed query registry and overlaps
this PR's query planning, LibraryMetadataService, LibrarySections,
coherence tests, and workspace architecture docs. Main's typed query remains
authoritative; the merged detailed fallback executes it through
AssemblyInspectionSession.Borrow(pdbContext), preserving the command-owned
retained image used by package streaming. The stale acquisition-gate citation
noted in the clean review is corrected.

Current local evidence: Release solution build, 23 query tests, 242
section/workspace tests, Markdown lint, and 3,247 CLI tests with 0 failures and
4 platform skips. A new exact-head review will follow current-head CI.

[richlander]

Clean-review carry-forward record:

• reviewed head: f35809c9551dc696d281e81fc1fd78ded59fe98d
• old main: 592242eddd9ea9ed8d4bebd6d2df4ee3cce61edf
• new main: 896b812f1ec315f6b4dee251de09f19de0a9c9bf
• integration head: 6895bbb1e114ae68756e42f1e51c269bcbf54340

GPT-5.6 Sol and Claude Opus 5 both returned clean on the reviewed head. The
later main range contains #3953 (decompiler return-sinking fixture extraction)
and #3954 (HTTP-client snapshot test isolation). It has no file overlap with
this PR and does not alter any workspace, query, metadata, package, rendering,
or binding behavior this change uses.

The user approved integrating that non-interacting range and carrying the clean
reviews forward without another round. The merge was conflict-free. The new
head passes the Release solution build, 23 query tests, 1,329 metadata tests,
3,247 CLI tests with 0 failures and 4 platform skips, and Markdown lint.

[richlander]

Integrated the interacting progressive call-graph workspace migration from origin/main with the approved re-review path.

• Previous integrated main tip: 896b812f1ec315f6b4dee251de09f19de0a9c9bf
• New integrated main tip: 151d91022449aac6ec08d6be9dd35f97e1a98dae
• Previous PR head: 6895bbb1e114ae68756e42f1e51c269bcbf54340
• Current merge head: 4e2f873a52d6ae7155e4b251d8fb55947f053911

The overlap is architectural: #3941 makes progressive member call graphs a group-owned Analysis resource and adds failure-preserving deferred disposal. The resolution keeps that lifecycle authoritative while preserving package Integrations’ per-TFM, sequential per-participant streaming and terminal release. Async release now ends the active callback before explicit participant release, so group-owned resources are still disposed before snapshots when disposal races streaming; InspectionWorkspaceTests.AsyncParticipantRelease_PreservesOwnedResourceDisposalOrder gates that interaction.

Local evidence at the current head:

• Release solution build: 0 warnings, 0 errors
• Queries/workspace: 43 passed
• Package Integrations workspace: 17 passed
• Metadata: 1,329 passed with mdv active
• Analysis: 568 passed with IL tools active
• CLI aggregate: all functional outcomes passed with 4 platform skips; the unrelated cyclic-constraint timing gate exceeded its aggregate threshold once and passed immediately in isolation
• Markdown lint: passed

Current-head CI run: https://github.com/richlander/dotnet-inspect/actions/runs/31334851790

[richlander]

Integrated the follow-on MemberCallGraphSession rename before starting the approved review round.

• Previous main tip: 151d91022449aac6ec08d6be9dd35f97e1a98dae
• New main tip: 4279d718f941a70302741a7a3d61755d5e2bbfcd
• Previous PR head: 4e2f873a52d6ae7155e4b251d8fb55947f053911
• Current PR head: 2dd1fad325365bbe92db6b61902ae4a0b4c47a59

The range only renames the progressive call-graph workspace API and its gates. Its sole feature-branch overlap was docs/inspection-space.md; the resolution retains the package Integrations architecture block and adopts the new session name.

Current-head local evidence: Release solution build completed with no errors (three existing nullable warnings in Metadata tests), Queries/workspace 43 passed, package Integrations workspace 17 passed, and affected Markdown passed lint.

[richlander]

Integrated origin/main through the Markout row-window adoption before review.

• Previous main tip: 4279d718f941a70302741a7a3d61755d5e2bbfcd
• New main tip: 4be245ccded6b0b3744ec94644948930650e9836
• Previous PR head: 2dd1fad325365bbe92db6b61902ae4a0b4c47a59
• Current PR head: 6dbd46202502b8d5b19c59379ea2b74e07b38e3f

The range adopts document-wide projection and row-window behavior. Its package overlap only documents the existing final Markdown limiter and updates projection tests; grouped Integrations failure status and output projection are unchanged. Current-head local evidence: Release solution build completed with no errors (three existing Metadata-test nullable warnings), Queries/workspace 43 passed, package Integrations workspace 17 passed, five package grouped/output projection gates passed, and affected Markdown passed lint.

[richlander]

Resolved the post-review merge conflict by integrating origin/main through e31094bab26d0ca01da4d0b1bba51d56845cd25d.

• Previously reviewed head/base: 57493c165c9c6fde5e00dd38e3e408d85fd7ed19 / cfb406a80b8b83abbeadc7214286fd8a173aab19
• New head: d404c53ad731810c0d7e0c606cbf67e36e5d6e51

The only textual conflict was docs/design/inspection-layers.md; the resolution preserves package --all-libraries per-TFM workspace groups and participant release while adding main’s typed Analysis Diff query status. Product overlap in MethodBodyInspectionSession adopts catalog direct-caller correspondence while retaining the PR’s resolved-assembly/session plumbing. Package-command overlap is source diagnostic wording only.

Local evidence at the new head: Release solution build completed with no errors (three existing Metadata-test nullable warnings), Queries 48 passed, focused CLI/workspace/call-graph/skill gates 300 passed, all 15 PackageCommand_AllLibraries_* gates passed, Analysis 577 passed with IL tools active, and changed Markdown passed lint.

The prior clean reviews do not carry automatically because the merged range changes call-graph/session behavior; a new approved fixed-head round is required after current-head CI.

[richlander]

Integrated the final pre-round main range through eb20768cbed49d907acee004b40922a6f876a082.

• Previous head/main: d404c53ad731810c0d7e0c606cbf67e36e5d6e51 / e31094bab26d0ca01da4d0b1bba51d56845cd25d
• New head: aa7871dadb177a27dbec718798cf3a88afa412ad

The range is non-interacting with grouped Integrations: it fixes --info option scope, Windows package-concurrency tests, and stale CRLF checkout detection. Only README.md overlaps textually and it merged cleanly. Local evidence: Release solution build completed with no errors (three existing Metadata-test nullable warnings), 249 affected CLI/package-concurrency/line-ending tests passed, and README passed lint.

[richlander]

Round 11 is clean on exact base eb20768cbed49d907acee004b40922a6f876a082 and exact head aa7871dadb177a27dbec718798cf3a88afa412ad.

• GPT-5.6 Sol: clean. Verified lifecycle linearization, byte accounting, teardown/failure ordering, grouped acquisition/demand, exact-image borrowing, OpenTelemetry semantics, output completion, source mapping, multi-TFM provenance, and the CatalogDirectCaller/session integration.
• Claude Opus 5: clean. Traced the retained descriptor and binding policy through current call-graph reachability, verified no mutable-path reopen or duplicate release, and re-ran query, Analysis, Metadata, package workspace, and all-libraries gates. Its one aggregate CLI timing failure was unrelated and passed immediately in isolation.

Exact-head CI: https://github.com/richlander/dotnet-inspect/actions/runs/31358473208 (ci-required passed). origin/main remains at the reviewed base, and GitHub reports the PR mergeable.

Ready to merge

[richlander]

Resolved the new product conflict by integrating origin/main through d615b65add875fd5c15f801745d6115fdddb6f3d.

• Previously reviewed head/base: aa7871dadb177a27dbec718798cf3a88afa412ad / eb20768cbed49d907acee004b40922a6f876a082
• New head: 861f4a6bb62b2ef3d39a82cad7b4076d687c6993

The conflict was in the all-libraries Markdown completion path. The resolution adopts main’s LF-only OutputFormatter.WriteLfLine emission while retaining this PR’s completionExitCode, so grouped Integrations failures remain nonzero. PackageCommand_AllLibraries_MalformedMetadataPreflightIsIncompleteAcrossOutputPaths now also asserts the incomplete Markdown output contains no CR characters, directly gating the combined contract on Windows.

Local evidence: Release solution build completed with no errors (three existing Metadata-test nullable warnings), package workspace 17 passed, and all 16 PackageCommand_AllLibraries_* gates passed.

[richlander]

Integrated origin/main from e1889e5535babace317082a5077fd2a994b7a02b through 0aaa78383cc8658913ff086b68381ccfc0eb5832 in merge commit 516ffbf0f683d85afc0dca10303063243a457a33.

Interaction analysis: the relevant overlap is function-pointer-aware call-graph cache identity in GraphIdentity, which is consumed by the workspace-owned graphs. The remaining range is stabilization work (HTTP snapshot rendezvous, Deep Inspect notifier scoping, package-cache test serialization, type-tree member limits, and related tests/docs). No grouped Integrations semantics conflict; the existing LF-only grouped Markdown plus nonzero incomplete exit behavior remains intact.

Local validation at the merged head:

• dotnet build dotnet-inspect.slnx -c Release
• ILInspector.Analysis.Tests: 579 passed
• DotnetInspector.Queries.Tests: 48 passed
• PackageIntegrationsWorkspaceTests plus MemberCallGraphSectionTests: 39 passed
• PackageCommand_AllLibraries_*: 16 passed
• markdownlint docs/design/type-forwarding-resolution.md

[richlander]

Integrated the next origin/main range,
0aaa78383cc8658913ff086b68381ccfc0eb5832..f239b9a025c45e09c5920f4693bbf92697c3921c,
in merge commit e6bee088c9386cab333511907fa847dc367581d7.

The range ports Implementation Diff to a typed query. Its only semantic overlap
with this PR was docs/design/inspection-layers.md; the resolution retains
this PR's per-TFM grouped Integrations lifecycle contract and main's new
descriptor-backed Implementation Diff query boundary. SectionPipelineTests.cs
changed on both sides but merged without a textual conflict and covers
independent section registrations.

Local validation at the merged head:

• Release solution build
• Markdown lint for all three changed documents
• ILInspector.Analysis.Tests: 579 passed
• DotnetInspector.Queries.Tests: 51 passed
• Package workspace, member call-graph, and section-pipeline tests: 268 passed
• PackageCommand_AllLibraries_*: 16 passed

[richlander]

Integrated origin/main
f239b9a025c45e09c5920f4693bbf92697c3921c..f77a127d8a7c2878cd77ada59d6c26f3ecc5b786
in merge commit 3b5037c52ed9c32a7a0ef557abcd96f370bc8f0a;
the validated branch head is
dae853db91a6321dc7b7c03822433593cf299575.

Interaction analysis: this range contains the Markout co-development guidance
and the enum switch pre-guard reconstruction. It shares no files with this PR
and does not alter workspace, package, Integrations, call-graph, or output
behavior.

Local validation:

• Release solution build
• SwitchRaisingSharedGuardTests: 39 passed
• PackageIntegrationsWorkspaceTests: 17 passed
• PackageCommand_AllLibraries_*: 16 passed

[richlander]

Round 12 found one blocking disposal interleaving at
dae853db91a6321dc7b7c03822433593cf299575.

GPT-5.6 Sol found that streamed participant release checked _disposed, then
dropped _lifetimeGate before acquiring ImageLoadGate. Disposal could win
that gap while the callback remained active, defer teardown, and then let the
streamed path release the snapshot before EndCallback disposed group-owned
resources. Claude Opus 5 otherwise returned clean.

I reproduced the finding independently in an exact-head worktree with a
deterministic active-callback interleaving. The resource-disposal assertion
failed because RetainedImageBytes was zero.

Fixed in db85421dfc0120bc145424ebdc4bb04077836867 by arbitrating streamed
participant release and callback completion together under the existing
ImageLoadGate → _lifetimeGate order. If disposal wins, teardown retains
ownership and disposes resources before snapshots; otherwise terminal streamed
release and callback completion happen as one lifetime decision. The old race
test, which had no active callback, is replaced with the reproduced
interleaving.

Validation:

• Deterministic race gate: failed before the fix, passed repeatedly after it
• DotnetInspector.Queries.Tests: 51 passed
• PackageIntegrationsWorkspaceTests: 17 passed
• PackageCommand_AllLibraries_*: 16 passed
• Release solution build

The fixed head still requires a clean two-reviewer re-review.

[richlander]

Round 12 is clean at
db85421dfc0120bc145424ebdc4bb04077836867.

• GPT-5.6 Sol: clean
• Claude Opus 5: clean

Both reviewers independently verified the disposal arbitration, lock ordering,
exactly-once callback and participant release, retained-byte accounting, the
red-before/green-after race gate, per-TFM grouping, immutable-image sharing,
failure rendering, presence semantics, and call-graph composition.

Exact-head ci-required passed in run
31405210362.
The first attempt failed only the unrelated timing-sensitive
ConstraintRestatement_ResolvesManyCyclicListsWithoutPerListWaste; it passed
immediately in isolation and the failed CI lane passed on rerun.

After the clean reviews, origin/main moved from
f77a127d8a7c2878cd77ada59d6c26f3ecc5b786 to
4c7b781cdec7eeea176e375aea8f9fffa555a715 via #3997. The range has no textual
overlap with this PR, though its LibraryBodyIndex decomposition is
behaviorally adjacent to workspace call graphs. The user directed us to hold
the currently reviewed head rather than integrate that range and spend another
review.

Ready to merge.

[richlander]

Evaluated post-review origin/main
f77a127d8a7c2878cd77ada59d6c26f3ecc5b786..4dec48cf197611450a77d37133af3023601dfae7
under the clean-review carry-forward rule.

This range is not non-interacting:

• Decompose library body analysis services #3997 decomposes LibraryBodyIndex, which workspace-owned call graphs consume.
• Route search commands through inspection workspaces #4000 routes extensions, implements, and find through inspection
  workspaces and adds AssemblyInspectionSession facets beside this PR's
  grouped Integrations presence facet.
• The range overlaps docs/design/inspection-layers.md,
  docs/inspection-space.md, and
  src/ILInspector.Metadata/AssemblyInspectionSession.cs.
• GitHub reported a conflict. The sole textual conflict was the layering
  document; its resolution preserves both per-TFM grouped Integrations and the
  new workspace-backed search contract.

The range is integrated in
3e6749283fb35e51029ba04387db41600c7d8314. Because it can affect this PR's
workspace, session, Analysis, and call-graph behavior, the prior clean reviews
are not being carried forward; the resulting head requires a new review round.

Local validation:

• Release solution build
• Markdown lint for all changed documents
• DotnetInspector.Queries.Tests: 55 passed
• ILInspector.Analysis.Tests: 579 passed
• ILInspector.Metadata.Tests: 1342 passed
• Workspace-backed search, package workspace, and call-graph CLI gates:
  52 passed
• PackageCommand_AllLibraries_*: 16 passed

[richlander]

Integrated the next origin/main range,
4dec48cf197611450a77d37133af3023601dfae7..8e6161e85d0004afd0aba398daf1b4909cd8300f,
in merge commit 7594582abbd8c9adf36222d76460ca743cdd0ba1.

The range includes #4001, selectable call-graph output formats. It overlaps
CommandExecutionTests.cs and directly affects this PR's workspace-owned
call-graph surface, so it is part of the new review head rather than eligible
for clean-review carry-forward. The merge had no textual conflicts.

Local validation:

• Restored Release solution build
• Markdown lint for all changed documents
• DotnetInspector.Queries.Tests: 55 passed
• ILInspector.Analysis.Tests: 579 passed
• Call-graph section/parser and package workspace tests: 165 passed
• PackageCommand_AllLibraries_*: 16 passed
• Focused member call-graph output tests: 5 passed

An initial --no-restore build was invalid because #4001 updates the Markout
package API/version; the normal repository build restored that dependency and
passed. A concurrent Analysis run against the stale/partially rebuilt graph
also failed one equivalence assertion; the complete Analysis suite passed
after the restored build.

[richlander]

Final review at 59189d4042ffe1aedcd07b7aad257d8782e6aa5b:

• Claude Opus returned clean.
• GPT-5.6 Sol found no product defect; it identified a test-gate gap: the terminal-release test proves byte release before advancing but does not directly assert that the same participant cannot be reacquired.
• The implementation invariant remains enforced by ParticipantState.Released, exact-head CI is green, and the user explicitly directed that this coverage gap be non-blocking. Follow-up: Gate terminal workspace participant release against reacquisition #4015.
• origin/main remains 383df6e0bdde36b6641c5c593002c6ef776e4ab7, the reviewed base; no review carry-forward is required.

Ready to merge.