Design member inspection projection boundaries

[richlander]

Summary

Defines the proposed architecture that must be accepted before implementation review resumes on #3877/#3880. The model has two typed pipelines joined by typed results: one determines what work the request asks for and is authorized to perform; the other determines which metadata declarations are valid and what they mean.

CLI gesture
  -> immutable parsed intent
  -> minimal authorized target resolution
  -> resolved type/member target
  -> final section catalog and selection
  -> closed typed producer graph
  -> host preflight and authorized closures
  -> typed producer results/failures
  -> presentation

retained assembly bytes
  -> bounded pre-reader format admission
  -> Metadata declaration session
  -> shared declaration validation and facts
  -> full / summary / focused projections
  -> typed C# representability

The core rule is that selection, authorization, metadata validity, and presentation are separate concerns with separate owners. Section names do not grant capability, cached content does not grant authority, presentation cannot start producers, and C# does not reinterpret raw metadata semantics.

Inspection planning

• L3 / CLI parses the gesture into immutable intent and preserves inspection surface, address, selector, discovery-mode, output, and capability-request provenance.
• Target resolution performs only the minimal acquisition and Metadata inventory needed to identify the type or member. It cannot authorize PDB, source, or analysis work.
• The resolver chooses one final catalog -- type list, member list, overload inventory, or exact-member details -- and resolves selectors against it exactly once.
• L2 / Sections binds selected sections to typed queries and applies progressive-disclosure request policy.
• L1 / Queries owns producer prerequisites, conditional successors, cost, capability requirements, execution modes, and probe eligibility.
• Host preflight fixes every executable or denied path before work starts. A cache hit, adjacent PDB, or runtime fallback cannot create new authority.
• Presentation receives completed typed results and cannot trigger acquisition or producer execution.

Schema, discovery, and rendering remain distinct. Static schema performs no target or producer work. Discovery runs only declared probe-eligible producers and returns Applicable, ValidEmpty, Unknown, or Failed; denied or unavailable work cannot become empty success. Rendering executes only the selected, pre-authorized producer closure.

Shared Metadata declaration model

Each top-level operation owns a MetadataOperationContext. Acquisition supplies immutable assembly bytes and an opaque image generation; live MetadataDeclarationSession instances provide bounded access without exposing raw readers or mutable budgets to higher layers.

Full extraction, summary extraction, and focused queries use the same six-stage declaration path:

1. Validate the addressed row and declaring context.
2. Decode and charge cheap admission facts.
3. Validate the bounded dependency closure.
4. Apply the consumer inclusion policy.
5. Lazily decode expensive retained facts.
6. Validate aggregate semantics and materialize the requested projection.

This preserves cheap filtering before expensive signature and MethodImpl work without allowing malformed addressed declarations to disappear behind filtering.

Metadata owns shared typed facts such as accessibility, signature status, accessor aggregates, explicit implementations, and slot relationships. Full, summary, and focused projections derive from the same accepted identities and failures. CSharp owns spelling only and returns Representable, FallbackRequired, Degraded, or Unavailable rather than reconstructing semantics from raw flags or display text.

Properties and events use a bounded, lossless MethodSemantics census instead of SRM convenience GetAccessors() projection. The census preserves physical rows, duplicates, raise, Other, unknown or combined flags, and malformed associations until Metadata validates one complete accessor aggregate.

Content, cache, and lifetime model

• Acquisition owns immutable bytes, content digests, provenance, and liveness.
• Queries consume retained content rather than reopening mutable paths.
• A cache is an optimization, never authorization; current capability, host-policy, and liveness checks run for every operation.
• Persistent entries may bypass stable gates only when the key, gate, producer, and publication all use the same retained evidence and complete gate-contract version.

The successor library effective-catalog subject freezes route evidence, retained assembly bytes and digest, supported-format admission, and probe-time local-symbol evidence including retained PDB identity and provenance. Lookup, every cold producer, and publication consume that exact subject. No component may reopen the path or re-key the result from later evidence. If symbol evidence changes during the operation, publication is declined and a later invocation recomputes.

Portable PDB retention is capped at 64 MiB across all providers. Over-limit content produces a visible typed failure; it cannot become “no PDB” or silently fall through to another provider.

Format and platform boundary

A bounded classifier runs before constructing an assembly MetadataReader and distinguishes supported ECMA-335, no metadata, malformed metadata root, and unsupported Windows Metadata.

WinMD is outside the project scope. The plan adds no projected WinMD reader, compatibility adapter, correspondence model, or incidental semantic support.

Product paths remain SRM-only, Roslyn-free, NativeAOT-friendly, and compatible with single-threaded Browser/Wasm. The proposal does not replace Markout, create a universal metadata object graph, or move C# spelling into Metadata.

Migration

The implementation is ordered into independently mergeable slices:

1. Characterize current routing, discovery, producer, and projection behavior.
2. Introduce immutable parsed and resolved plan types.
3. Enforce the address and member-resolution contract.
4. Lower selected sections into preflighted typed producer plans.
5. Introduce operation-scoped Metadata scaffolding, pre-reader format admission, cache cutover, finite PDB retention, and lossless MethodSemantics handling.
6. Atomically migrate full, summary, and focused declaration admission.
7. Move C# to typed representability outcomes.
8. Remove transitional mutable state, duplicate validators, and bypasses.

Each slice has named MIP or MDP gates. Compatibility adapters may bridge slices, but mixed old/new authority is rejected rather than silently interpreted.

Evidence

• Markdown lint passed for every changed Markdown document.
• Exact head cdbfcc49ef34a16eebea1ff3b97b9d8f2c730c3e passed ci-required and is mergeable.
• Round 22 fixed-head adversarial review was clean: GPT-5.6 Sol and Claude Opus 5 both returned CLEAN.

Non-action boundary

This PR changes documentation only. It accepts the direction and ownership boundaries but explicitly marks the target behavior unverified until the named migration gates land. Current product code does not yet enforce the complete model, and implementation review for #3877/#3880 remains paused pending commit-level disposition against the accepted design.

[richlander]

Round 1 review reconciliation for replacement head 9a8deb2f0:

• GPT-5.6 Sol reported seven design defects: source-selection gestures could not satisfy the proposed capability model; discovery modes contradicted current and owning contracts; declaration admission could not evaluate compiler-generated/accessor eligibility; dotted targets lacked precedence/conflicts; degraded signatures lacked a C# outcome; projection migration activated mixed validity semantics; and platform/content/failure boundary claims lacked gates.
• Claude Opus 5 independently confirmed the discovery, admission, authorization, and degraded-signature defects, and additionally identified omitted host/probe-policy conjuncts, undispositioned render-manifest producer execution, and ungated cache-context/budget claims.
• All findings were accepted. 9a8deb2f0 now models capability-request provenance with L2 request policy, host grant, and artifact-lease revalidation; preserves current type/member section-specific discovery probes; defines deterministic dotted-address conflicts; makes declaration admission per-root and dependency-aware; isolates render manifests as post-producer observers; maps degraded signatures to a nonauthoritative C# outcome; activates full/summary/focused admission atomically; and adds stable address, lease, Browser/Wasm, NativeAOT/SRM/load, typed-failure, cache, and degraded-signature gates. The owning progressive-disclosure document now defines request provenance versus authority.
• Markdown lint passes on every changed document. The head moved in response to the round, so Round 1 is converging rather than review-clean and remains pending current-head CI/mergeability.

[richlander]

Round 1 is complete for PR 4545.

• Review models GPT-5.6 Sol and Claude Opus 5 were used for adversarial review.
• Review feedback is: converging.
• Round start: 2026-08-21 11:29 PDT.
• Round end: 2026-08-21 11:47 PDT.
• Round duration: 0:18

Fix description: Accepted all findings and replaced the draft capability, discovery, admission, address-resolution, render-manifest, representability, migration, cache, platform, and failure-verification gaps with explicit typed boundaries and stable gates in 9a8deb2f0. The locked head moved, so the round is complete but not review-clean.

[richlander]

Round 2 review reconciliation for replacement head 32e8297eb:

• GPT-5.6 Sol reported four gaps: progressive-disclosure wording still admitted a gesture-as-grant reading; overlapping address rows produced two possible member sets; MDP009 did not verify equal hostile-input ceilings; and slice 8 ownership cleanup lacked stable architecture gates.
• Claude Opus 5 reported three additional/overlapping gaps: compatibility discovery preserved a reproduced PDB/source escalation and empty-success path; qualified selectors for different types were order-dependent and absent from MIP006; and schema-query.md, which owns realized render-manifest discovery mechanics, was omitted from migration ownership.
• All findings were accepted. Fix commit a3e25c9fb makes host preflight the sole grant in the progressive-disclosure owner; makes discovery selection request no source capability; records the current overload/category discovery escalation and empty-success result as slice-4 correctness bugs rather than compatibility; defines ordered type convergence followed by deterministic member-set union/cardinality; adds qualified/qualified conflicts; expands MDP009 to near-limit/over-limit parity; adds MIP011/MDP011 architecture-closure gates; and includes schema-query.md in slices 4 and 8.
• The replacement candidate integrates current base dfb18cd65 through merge 32e8297eb. The interacting main range only extends typed-query/section-pipeline documentation for Performance work and does not alter these decisions. Markdown lint passes on every changed document.

The head moved in response to the round, so Round 2 is converging rather than review-clean and remains pending current-head CI/mergeability.

[richlander]

Round 2 is complete for PR 4545.

• Review models GPT-5.6 Sol and Claude Opus 5 were used for adversarial review.
• Review feedback is: converging.
• Round start: 2026-08-21 15:40 PDT.
• Round end: 2026-08-21 16:01 PDT.
• Round duration: 0:20

Fix description: Accepted all seven findings. The replacement design makes host preflight the sole capability grant, removes source acquisition and empty-success from discovery compatibility, orders all positional and qualified address combinations, adds hostile-ceiling parity and architecture-closure gates, and assigns realized discovery migration to schema-query.md. Fix commit a3e25c9fb and base merge 32e8297eb moved the locked head, so the round is complete but not review-clean.

[richlander]

Round 3 review reconciliation for replacement head addd3af42:

• GPT-5.6 Sol reported six gaps: cached symbols still appeared usable without a PDB grant; address rows mixed logical-selector conflict with selector-set union and consulted section cardinality too early; discovery failure was not a required non-success case; architecture-closure gates ran after their semantic cutovers; equivalent budgeted work was undefined; and CSharp raw-flag reconstruction could evade the closure gate.
• Claude Opus 5 independently confirmed the address-ordering and discovery-outcome gaps, and additionally identified missing transitive prerequisite capability closure and missing complementary implied/explicit selector semantics.
• All findings were accepted and reproduced against the frozen document/mechanism text. Fix commit 7a403a8e5 now requires a PDB-authorized plan even for embedded/adjacent/cached symbols; resolves canonical types and logical selectors before choosing the target-count-derived catalog; distinguishes identical, complementary, conflicting, and separate selectors; defines Applicable, ValidEmpty, Unknown, and Failed discovery dispositions; injects discovery/producer failure gates; closes required capabilities over every transitive prerequisite; defines equivalent safety work per central policy dimension and requested shared fact; moves authorization/admission/CSharp closure gates to slices 4/6/7; and gates raw-flag as well as reader/handle reconstruction.
• The replacement candidate integrates current base 9c15042d5 through merge addd3af42. That landed range changes only round-governance documentation and does not interact with the inspection design. Markdown lint passes on every changed design document.

The head moved in response to the round, so Round 3 is converging rather than review-clean and remains pending current-head CI/mergeability.

[richlander]

Round 3 is complete for PR 4545.

• Review models GPT-5.6 Sol and Claude Opus 5 were used for adversarial review.
• Review feedback is: converging.
• Round start: 2026-08-21 16:36 PDT.
• Round end: 2026-08-21 17:00 PDT.
• Round duration: 0:24

Fix description: Accepted all ten findings as seven owner-level corrections. The design now requires PDB authority for cached symbols, resolves member targets before catalog selection, types discovery applicability/empty/unknown/failure outcomes, closes capabilities over prerequisites, defines equivalent safety work, moves closure gates to slices 4/6/7, and prohibits CSharp raw-flag reconstruction. Fix commit 7a403a8e5 and base merge addd3af42 moved the locked head, so the round is complete but not review-clean.

[richlander]

Round 4 review reconciliation at unchanged head addd3af42:

• GPT-5.6 Sol reported three gaps: set-valued bare/glob inventory filters were forced through singular ResolvedMemberTarget; MIP004 omitted transitive execution-mode/probe-policy denial; and several active cutovers did not require the safety gates for the properties they activate.
• Claude Opus 5 independently confirmed the resolver/catalog defect at higher severity: realized behavior has type/member-list, name-scoped overload-inventory, and exact-detail catalogs selected by selector kind and explicit detail demand, not target count. Claude also found that the repo-wide local-symbol wording unintentionally denies the gated plain-library discovery probe for embedded/adjacent/cached PDBs.
• All five findings were accepted after reproduction against the frozen docs and realized code. The evidence confirms that bare names/globs retain sets while MemberTargetResolver rejects ambiguity; ApiMemberSectionPipelines owns three selector-kind-driven catalogs; plain library discovery has an explicitly bounded local-PDB path; MIP004 lacks a probe-capable/direct plus render-only/prerequisite close negative; and the slice exit lists omit gates at their first active boundary.
• Per the current locked-head round rules, no files were edited in Round 4. The Round 5 fix cycle will add typed inventory-filter set resolution and three-catalog selection, distinguish bounded LocalPdbRead from PDB acquisition/source fetch while updating section-model.md, close execution-mode policy over prerequisites, and assign every safety gate to the earliest activating slice.

Round 4 is converging but not review-clean. The reviewed head remains unchanged; accepted findings require a replacement candidate in Round 5.

[richlander]

Round 4 is complete for PR 4545.

• Review models GPT-5.6 Sol and Claude Opus 5 were used for adversarial review.
• Review feedback is: converging.
• Round start: 2026-08-21 18:18 PDT.
• Round end: 2026-08-21 18:34 PDT.
• Round duration: 0:15

Fix description: No files were changed while the Round 4 head lock was held. Five accepted findings were reconciled: inventory filters need typed set resolution and selector-kind-driven three-catalog selection; bounded local-PDB reads must remain distinct from acquisition/source capabilities; execution-mode policy must close over prerequisites; and safety gates must move to their first activating slice. These fixes will form the Round 5 replacement candidate.

[richlander]

Round 5 replacement candidate is frozen at 12b865a3149b709efb4e3fbda3b14570c0f246ce, containing effective base 3caa958191abc7988263695321c9b3eade39f3c3.

This candidate implements all accepted Round 4 findings:

• replaces cardinality-driven catalog selection with selector-kind-driven type/member-list, name-scoped overload-inventory, and exact-member-detail catalogs;
• introduces a typed set-valued inventory-filter path for bare names, globs, unions, deduplication, and zero/one/many outcomes while retaining MemberTargetResolver for exact overload/digest targets;
• distinguishes bounded LocalPdbRead from PdbAcquire and SourceContent, preserving the authorized plain-library SourceLink probe without granting symbol access to named/category type/member discovery;
• extends closed-plan authorization to transitive execution-mode and probe-policy compatibility, not capabilities alone;
• moves every safety gate to the earliest migration slice that activates its property and splits C# failure containment from the Metadata/CLI cutover.

The documentation focused gate passed after the second base integration. The head is locked pending exact-head CI/mergeability and Round 5 fixed-head review.

[richlander]

Round 5 review reconciliation for frozen head 12b865a

Reviewers: GPT-5.6 Sol and Claude Opus 5. Both reviewed exact effective base 3caa958 through the frozen head. All six findings were reproduced against the clean head and are accepted.

1. Conditional PDB authority: the mandatory union of LocalPdbRead and PdbAcquire cannot preserve an offline local hit while authorizing acquisition only on a miss. Round 6 will model pre-authorized conditional producer branches. Local hit, denied miss, and authorized acquisition become separate gated outcomes.
2. Partial inventory-filter misses: the union-only no-match rule would let one valid filter hide a typo in another filter. Round 6 will retain a typed outcome per logical filter, require every filter to match, then deduplicate the matched union. MIP006 will cover partial misses and overlaps.
3. Detail-demand phase loop: descriptor-owned exact-detail demand currently depends on catalog expansion before the catalog is chosen, especially for categories and globs. Round 6 will define a typed preliminary demand-classification pass against the initial catalog declarations, followed by at most one typed promotion and final validation against the chosen catalog.
4. Static-schema ambiguity: after the three-catalog split, the inventory catalog is no longer unique for an unresolved dotted type-or-member spelling. Round 6 will make explicit command surfaces syntax-deterministic and represent commandless dotted ambiguity as labeled structural catalog alternatives, never as a final union-shaped selection.
5. Type-command compatibility: selector kind alone would move type T -m name from the type/member-list catalog to the member overload-inventory catalog, dropping working type sections such as Called Types. Round 6 will make parsed inspection surface an explicit catalog-selection input. MIP006 will pin type -m versus member behavior.
6. Probe-policy disposition: the plan-level authorization conjunction conflicts with per-section Unknown for a probe-capable producer whose prerequisite is render-only, and CapabilityDenied cannot represent mode or policy denial. Round 6 will distinguish typed plan denials from per-section discovery dispositions. Ineligible discovery closures become Unknown for that section while eligible sections proceed; explicit render closures fail with the typed reason.

The findings are converging and expose coherent missing plan dimensions rather than a new architectural direction. This head moved in response to Round 4 and will move again for these fixes, so Round 5 is complete but not review-clean. Round 6 will be the final round in the currently authorized block.

[richlander]

Round 6 replacement candidate is frozen at c509659, containing effective base 799fc8f.

This candidate addresses every accepted Round 5 finding:

• makes inspection surface an explicit planning input, preserving type -m on the type/member-list catalog while member inventory and exact selectors use their own catalogs;
• resolves every logical member filter independently, preserves all misses and suggestions, and deduplicates only after every filter succeeds;
• adds a target-shape-only section-demand index for exact-name, alias, category, and glob promotion without letting provisional selection validate shape or authorize work;
• represents unresolved commandless dotted static schema as labeled structural catalog alternatives rather than a final union;
• models local-PDB fallback as preflighted conditional producer paths, allowing a local hit while recording an unrequested or denied acquisition successor before execution;
• preflights independent section closures with typed request, capability, cost, execution-mode, and probe-policy outcomes, mapping discovery denial to per-section Unknown and explicit-render denial to non-success.

The documentation focused gate passed after the second base integration. The head is locked pending exact-head CI/mergeability and Round 6 fixed-head review. Round 6 is the final round in the current authorized block.

[richlander]

Round 6 review reconciliation for frozen head c509659

Reviewers: GPT-5.6 Sol and Claude Opus 5. Both reviewed exact effective base 799fc8f through the frozen head. All five findings were reproduced and are accepted.

1. Cross-catalog demand semantics: the same stable section identity can exist in member-inventory and detail catalogs with different cardinality behavior. Coalescing by identity leaves exact-member promotion circular or breaks legitimate member-group sections such as Source Locations. The next fix must give each semantic section a canonical producer-owned target-shape policy independent of catalog-local CanRender, and require compatible declarations or distinct stable identities.
2. Commandless static-schema ownership: ArgumentPreprocessor and RouterTokenRewriter currently perform target resolution before type/member parsers. The migration does not assign that path to a slice, so StructuralCatalogAlternatives is unreachable. The router/preprocessor path must be dispositioned and moved into the slice-2 typed-intent cutover, with structural gestures classified before router acquisition.
3. Missing assembly-wide type-list catalog: the type surface has a fourth catalog for targetless, glob, failed-exact/prefix-browse, and assembly-wide listing routes. The current three-catalog model cannot represent those paths. The catalog and its route states must join the planning matrix and MIP006.
4. Shared semantic-fact parity: MDP001 compares accepted identities and rejection IDs but does not compare Metadata-owned accessibility, accessor, explicit-interface, MethodImpl, and slot facts shared across projections. A declaration-derived fact-parity gate must compare every shared fact requested by more than one projection while allowing declared erasure.
5. FallbackRequired evidence: no gate proves complete discriminating identity/signature payloads and artifact-text containment for rendered fallbacks. A dedicated gate must cover methods, properties, events, indexers, hostile names, and overload-distinguishing signatures.

Convergence analysis after six rounds: the remaining defects are not harness-only findings or reviewers expanding the threat model. Three are architectural omissions caused by an incomplete census of realized catalogs/routing and an under-specified cross-catalog identity contract. Two are missing product-level evidence gates. The proposed remedy is one focused design pass that completes the surface/catalog/router census, assigns canonical target-shape policy to semantic section identities, derives semantic-fact parity from the shared fact declaration, and adds a dedicated fallback-payload gate.

Round 6 is complete but not review-clean. No Round 7 fix or review will begin without explicit authorization for another block.

[richlander]

Round 7 candidate frozen at 14897f5ba3a32c1cf1abc2ad92db8759dd9598af.

Effective base: 799fc8f985c382cd4e30a93b4e68fc603eb49f7f.

Focused gate: npx markdownlint-cli docs/design/member-inspection-planning-and-metadata-projection.md passed.

This head resolves all five accepted Round 6 findings: it enumerates the four realized catalogs and route states, makes target demand a canonical semantic-section property across catalogs, moves commandless structural classification ahead of router acquisition, derives shared-fact parity from typed projection requests, and adds the MDP015 fallback identity/containment gate. The head is locked pending current-head CI and Round 7 review.

[richlander]

Round 7 review reconciliation for frozen head 14897f5ba3a32c1cf1abc2ad92db8759dd9598af

Reviewers: GPT-5.6 Sol and Claude Opus 5. All three findings were reproduced and are accepted.

1. Commandless static schema omits router destinations. The pre-router classifier defines only the four type/member catalogs, but the hidden router can resolve the same bare spelling to package or library commands. System.Text.Json -D --schema currently resolves to a library schema, while System.String -D --schema performs an all-framework type lookup. Because target-free static schema cannot perform those probes, the design must either return typed structural alternatives spanning every possible router destination or explicitly reject ambiguous commandless schema. I will add the package/library alternatives and syntax-only precedence, with representative route gates.
2. Type-level fallback is not covered. FallbackRequired and MDP015 currently specify member identity only. TypeShellProducer.ReconstructedBaseTypeDisplay can omit an unsupported base spelling while returning a plausible type shell, so the design must define contained type fallback identity (kind/arity/base/interfaces/modifiers) and gate that valid unrepresentable type facts cannot disappear.
3. The static-schema gate lands too late. Slice 2 moves commandless structural classification ahead of router resolution, but its exit requires only MIP003; the no-target-work assertion is embedded in MIP001, which does not land until slice 4. The change also contradicts slice 2 byte-for-byte compatibility. I will split the static no-target-work gate from the later producer-probe gate, require it in slice 2, and record the commandless schema output/help change there.

Round 7 is complete but not review-clean. Round 8 will fix these three design gaps.

[richlander]

Round 8 candidate frozen at f7819866e1107d09ec0df746ea47c804eca95dd1.

Effective base: f5f52178c1c6209540b4e064eda1971c20e549ec.

Focused gate: npx markdownlint-cli docs/design/member-inspection-planning-and-metadata-projection.md passed.

This head resolves all three accepted Round 7 findings: commandless static schema now composes package/library/type/member catalog owners as syntax-proven results or labeled alternatives; static no-target verification is split into MIP001 and required in Slice 2 while non-schema probe tracing moves to MIP013 in Slice 4; and FallbackRequired now distinguishes complete contained type and member declarations with type-shell omission coverage. The head is locked pending current-head CI and Round 8 review.

[richlander]

Round 8 review reconciliation for frozen head f7819866e1107d09ec0df746ea47c804eca95dd1

Reviewers: GPT-5.6 Sol and Claude Opus 5. Two unique findings were reproduced and are accepted; both reviewers independently found the first.

1. Router destination is not the effective static view. The registry maps Package only to PackageSectionDescriptors, but commandless --library, explicit package --library, package --all-libraries, and direct .nupkg --library routes enter PackageCommand while exposing LibrarySections after acquisition. The current static early return excludes package-library mode, so this remains both a wrong-catalog risk and a target-free-schema violation. The replacement must model package inspection, package-scoped library, and package all-libraries as distinct structural view modes; preserve the realized syntax precedence; derive per-route-to-catalog mapping equality from rewrite/parse registrations; and gate each route in Slice 2 before acquisition.
2. Fallback containment must be lossless. The proposal permits artifact text to be escaped or removed, but untrusted-data-threat-model.md and inert-text.md require canonical, injective, lossless, invertible visual encoding carried as InertString, followed separately by format-specific escaping. Removal can collapse distinct type/member identities. The replacement must require that existing boundary and extend MDP015 with round-trip and injectivity cases for hostile type names, member names, and signature fragments.

Round 8 is complete but not review-clean. Round 9 will fix these two design gaps.

[richlander]

Round 17 formal review dispatched for exact locked head 97b812b169b13866be995fa52907c9b6366296a9 against effective base c9a1b85268832a89bfe5e4800bb13805f0fc7471.

Reviewers: GPT-5.6 Sol and Claude Opus 5. Both reviewers received the same whole-head brief and isolated read-only worktrees. Current-head ci-required is successful, and GitHub reports the PR mergeable with state clean.

[richlander]

Round 17 reconciliation for exact head 97b812b169b13866be995fa52907c9b6366296a9 (effective base c9a1b85268832a89bfe5e4800bb13805f0fc7471).

Reviewers: GPT-5.6 Sol and Claude Opus 5.

Accepted findings:

1. The format classifier can perform unbudgeted row work before admission. GPT-5.6 Sol verified that constructing MetadataReaderOptions.None initializes table readers; when the MethodSemantics sorted bit is clear, SRM scans the full table before GetMetadataReader returns. The proposed classifier therefore cannot inspect MetadataVersion before row work and makes MDP017's no-row-before-reject clause impossible. The replacement will use a separately bounded MetadataPrimitives root-header/version probe over the PE metadata block before constructing any MetadataReader, without opening a general raw-table decoder.

2. MIP004 does not prove exact operation/plan isolation. GPT-5.6 Sol found that granting-versus-denying host tests can pass with a structural key containing host grants while still replaying a first plan's transient producer failure into a second same-host plan. Reusing one immutable plan instance across top-level operations creates the same gap. The replacement will bind completed outcomes to a fresh top-level operation identity, prohibit cross-operation plan-instance reuse for outcomes, and test separately minted same-host plans with failure-then-success in both orders.

3. Session-local declaration caches contradict once-per-operation fact reuse. GPT-5.6 Sol found that summary, focused, and full callbacks can open separate sessions over the same generation and operation entry; only admission and the semantics index are shared, so ordinary declaration facts and charges repeat in callback order. The replacement will put immutable declaration facts and typed failures in the generation-scoped MetadataImageEntry, keyed by complete semantic context, with each observing session rechecking its own lease. MDP009 will permute full/summary/focused sessions under a one-decode budget.

4. The repository-wide cache rewrite conflicts with the shipped persistent library effective cache. Claude Opus 5 reproduced that LibraryCommand persists completed library -D --effective section catalogs in CoreCache (effective-v24) and replays them before inspection. The new section-model.md text prohibits every cross-plan completed outcome while retaining a cache-version-bump rule that only makes sense for a persistent cache; the proposal neither dispositions nor gates this shipped path, and sourcelink-exposure.md still documents it. The replacement will scope operation-local authorization-dependent outcome reuse to the planned type/member path, restore the repository-wide persistent-cache contract, explicitly disposition the library cache and its fixed policy/key assumptions, and reconcile the linked SourceLink/cache documentation.

Claude Opus 5 otherwise confirmed the raw version-marker rule, return/failure shapes, named migration surfaces, project references, and cross-document anchors. No findings were dismissed. Exact-head ci-required remains successful, and the PR is mergeable with state clean.

Round 17 ran 22:16–22:28 PDT (0:12). Review feedback is actionable and converging, but this head is not review-clean because all four accepted findings require documentation changes. Round 18 is the final round in the currently authorized 13–18 block and will form a new two-integration candidate.

[richlander]

Round 18 candidate is frozen at exact head 8039e3b3d9bb91764c1a9c5d71805a97e13c0e3c on branch design/inspection-projection-boundaries.

Effective base: f6b6ce67c163ca2b54c3126b83cf0c9b9ca12a95
Second-integration merge: f371663b0
Review-fix commit: 8039e3b3d

This replacement resolves all four accepted Round 17 findings:

• replaces the reader-constructing format classifier with one bounded MetadataPrimitives root-admission guard; it has explicit NoMetadata, supported ECMA-335, unsupported Windows Metadata, malformed-root, and acquisition-failure boundaries, reads at most the ECMA-defined 256-byte padded version field, records the deliberate stricter-than-SRM over-limit rejection, separates lazy block materialization from classifier work, and proves rejection before reader/table/row work;
• binds type/member preflighted plans and completed discovery outcomes to a fresh InspectionOperationContext, including cross-operation, disposed-plan, same-host transient-failure, and legacy-library-cache close negatives;
• moves immutable declaration facts and typed failures into atomically published, generation-scoped MetadataImageEntry state, with subject-entry retention/charging, explicit ephemeral multi-generation fact access, exact participating-session validation, per-session liveness, concurrent single-publication, reentrancy rejection, and full/summary/focused one-decode permutations;
• restores the repository-wide distinction between operation-local planned type/member outcomes and the shipped cross-process bare library -D --effective effective-v* successful catalog, explicitly dispositions that compatibility cache, and reconciles SourceLink and metadata-lens references.

Windows Metadata remains unsupported project-wide. The root guard exists only to reject it before semantic work; no projected reader, compatibility adapter, correspondence model, or WinMD semantic support is introduced.

Focused documentation gate passed: markdownlint on all six changed documents and git diff --check. Round 18 is the final round in the authorized 13-18 block; exact-head CI and the required GPT-5.6 Sol + Claude Opus review remain pending.

[richlander]

Round 18 formal adversarial review is starting for exact head 8039e3b3d9bb91764c1a9c5d71805a97e13c0e3c against effective base f6b6ce67c163ca2b54c3126b83cf0c9b9ca12a95.

Eligibility is complete: exact-head ci-required succeeded and GitHub reports the PR mergeable with state clean.

Reviewers: GPT-5.6 Sol and Claude Opus 5, each in an isolated fixed-head worktree. Both reviewers receive the complete head and the same design brief. CLEAN is an explicitly acceptable result. Round 18 is the final round in the currently authorized 13-18 block; if either reviewer returns a fix-requiring finding, no Round 19 review will begin without the required architectural checkpoint and explicit authorization.

[richlander]

Round 18 reconciliation for exact head 8039e3b3d9bb91764c1a9c5d71805a97e13c0e3c (effective base f6b6ce67c163ca2b54c3126b83cf0c9b9ca12a95).

Reviewers: GPT-5.6 Sol and Claude Opus 5.

• Claude Opus 5: CLEAN. It independently verified the ECMA/SRM 255/256-byte bound and deliberate compatibility boundary, marker-window close negatives, pre-reader MethodSemantics scan premise, oracle selection, routing/inventory claims, operation/generation/session ownership, concurrent single-publication design, lazy materialization statement, and the current effective-v* key/write contract.
• GPT-5.6 Sol: one accepted medium-severity finding. The retained bare-library persistent cache is read before LibraryMetadataService.InspectAsync. A successful pre-cutover effective-v24 entry for the same marker-bearing bytes can therefore return a success-shaped catalog after the new classifier lands. MIP004 correctly prevents the planned type/member executor from reading this cache, but MDP017 does not invalidate or probe pre-cutover library entries.

The finding was reproduced on the exact head in an isolated worktree. A scratch ManagedPEBuilder fixture used metadata version WindowsRuntime 1.4;CLR v4.0.30319; the exact full-path#SHA256#sl0 key was seeded in effective-v24 with Legacy Sentinel. Running bare library <fixture> -D --effective --tips q against that cache returned exit code 0 and:

| Name | Kind |
| ---- | ---- |
| Legacy Sentinel | section |

The path is concrete: LibraryCommand.cs:596-600 returns the cached catalog before inspection at line 617, and the preceding SourceLink probe maps its own exception to false, selecting the seeded sl0 key. The current product can create that entry before the format-classifier cutover.

Accepted remedy for the next candidate:

1. Classify the format-gate cutover as an effectiveness-semantics change requiring an effective-v* category bump.
2. Extend the existing-library-cache disposition and slice-5 migration to require the bump before the classifier becomes authoritative.
3. Extend MDP017 with a pre-cutover successful catalog seeded for the exact marker-bearing image; the old entry must be ignored and the unsupported-input result must remain visible.
4. Pair it with a supported ECMA-335 old-entry close negative that recomputes and writes the new category, preserving the cross-process cache rather than disabling it.

No findings were dismissed. Exact-head ci-required remains successful and GitHub reports mergeable state clean. Round 18 is not review-clean because the accepted cache-cutover finding requires a replacement head. This is the end of the authorized 13-18 block; no Round 19 review will begin without the required architectural checkpoint and explicit authorization.

[richlander]

Round 19 candidate formed and frozen.

• Exact head: bc097d53b846e9d82ac730dc3cf7ffdf40ea473c
• Effective base: 570bcb491ceffbb368ee0a12a04edcee8b42de2a
• First integration: merge 1475c1e01ba6ce2921ee544e2323c95aa97dc559
• Second integration: origin/main remained at the same effective base, so the branch was already current
• Focused gate: Markdown lint and git diff --check passed

The replacement makes predecessor-cache invalidation a repository-wide persistent derived-result cache rule. Dynamic authorization and liveness are always rechecked; stable admission may be skipped only for exact content written under the complete gate-contract version. The slice-5 format cutover now bumps effective-v* before lookup, with paired prior-category tests for newly rejected Windows Metadata and still-valid ECMA-335 content.

[richlander]

Round 19 review reconciliation for exact head bc097d53b846e9d82ac730dc3cf7ffdf40ea473c (effective base 570bcb491ceffbb368ee0a12a04edcee8b42de2a).

• Claude Opus 5: CLEAN. It verified the category bump, sl0/sl1 closure, cross-document agreement, SRM marker behavior, and pre-reader MethodSemantics premise.
• GPT-5.6 Sol: one medium-severity finding accepted. A successor category prevents predecessor hits, but CacheEffective can still publish a catalog derived from supported bytes S under marker-bearing bytes W when the mutable path follows W→S→W. The implementation hashes the path before inspection, reopens it for inspection, and rehashes before publication; equal bracket hashes do not prove which bytes were classified. The source comment at LibraryCommand.cs:2430-2443 and open Effective-section cache: derive the key from the bytes the inspection actually parsed #3478 acknowledge this ABA gap.

Independent exact-head reproduction invoked the real CacheEffective after the controlled W→S→W sequence. The pre/post W SHA-256 was AA6A579BE083459AD0DCFADE05BD73BCB03229F32477EEBFA9C64F3CD4FC2B00; TryGetCachedEffective then reported catalog derived from S accepted under W: True. The Round 19 predecessor-category tests would not detect this successor-publication defect.

Disposition: accepted. The replacement design will require the cache key digest, format admission, SourceLink assembly probe, derived catalog, and publication to share one acquisition-owned immutable assembly snapshot. Bracketed mutable-path hashes will be explicitly insufficient, and MDP017 will add W→S→W plus API/architecture closure proving the library effective path cannot reopen the source between identity, classification, inspection, and write. Round 19 therefore needs a replacement head.

[richlander]

Round 19 completed and Round 20 candidate formed.

Round 19 (bc097d53b846e9d82ac730dc3cf7ffdf40ea473c):

• GPT-5.6 Sol found one accepted medium-severity successor-publication ABA gap.
• Claude Opus 5 returned CLEAN.
• Independent reproduction and disposition: Design member inspection projection boundaries #4545 (comment)

Round 20 frozen candidate:

• Exact head: d4d48ab0fe41fc5d968b818648a68d785ce3bbbf
• Effective base: 7eda3a3f806c998b33351f7064f5917d779d6b6d
• Second integration merge: 33736a76daa408dcdd3ee72e82ab3294dbdb86f4
• Focused gate: Markdown lint and git diff --check passed after integration

The replacement makes persistent-cache identity complete across every contributing artifact. The library effective path now retains assembly bytes once, classifies before PDB/cache work, replaces the predecessor sl0/sl1 key with typed identity-validated local-symbol evidence, routes every transitive consumer (including platform surface classification) through retained assembly/PDB references, and gates deterministic W→S→W substitutions plus predecessor-category invalidation. Dynamic authorization and liveness remain freshly enforced and are never represented by cache versions.

[richlander]

Round 20 fixed-head adversarial review dispatched.

• Exact head: d4d48ab0fe41fc5d968b818648a68d785ce3bbbf
• Effective base: 7eda3a3f806c998b33351f7064f5917d779d6b6d
• Reviewers: GPT-5.6 Sol and Claude Opus 5
• Exact-head ci-required: success
• GitHub mergeability: mergeable / clean

Both reviewers are reviewing the whole head. Round 20 specifically asks them to attack the repository-wide multi-artifact cache contract, pre-cache Windows Metadata admission, typed local-symbol evidence completeness, every transitive retained-content consumer, deterministic W→S→W gates, and finite Browser/Wasm budgets. Reporting CLEAN is explicitly acceptable.

[richlander]

Round 20 review reconciliation for exact head d4d48ab0fe41fc5d968b818648a68d785ce3bbbf (effective base 7eda3a3f806c998b33351f7064f5917d779d6b6d).

• Claude Opus 5: CLEAN.
• GPT-5.6 Sol: two medium-severity findings, both independently reproduced and accepted.

1. Root-route provenance aliases catalogs. The exact installed /usr/local/share/dotnet/shared/Microsoft.NETCore.App/11.0.0-preview.7.26381.103/System.Runtime.dll rendered Facade: Yes through the platform route and omitted the field through the direct-file route. The proposed successor key names the same resolved path, assembly digest, and local-symbol evidence for both, so either population order can serve the wrong cached Library Info schema. The replacement will add typed root inspection/acquisition provenance plus declaration-derived closure over every route-dependent section/field predicate.

2. Standalone PDB retention is not finitely bounded. An identity-valid adjacent portable PDB was enlarged from 1,955,436 to 538,826,348 bytes with trailing data. Bare effective discovery returned exit 0, exposed @SourceLink, and reached 663,224,320 bytes maximum RSS. Existing limits bound embedded expansion and SourceLink maps, not adjacent/cached/acquired portable-PDB retention. The replacement will add one operation-owned aggregate retained-PDB ceiling enforced before allocation/copy, hashing, or reader construction for every provider, with typed visible over-limit failure and near/over/Browser gates.

Round 20 therefore requires a Round 21 replacement candidate; no finding expands WinMD support.

[richlander]

Round 20 completed and Round 21 candidate formed.

Round 20 (d4d48ab0fe41fc5d968b818648a68d785ce3bbbf):

• GPT-5.6 Sol found two accepted medium-severity gaps: same-content platform/direct route aliasing and unbounded standalone PDB retention.
• Claude Opus 5 returned CLEAN.
• Independent reproductions and disposition: Design member inspection projection boundaries #4545 (comment)

Round 21 frozen candidate:

• Exact head: 9b977351cd7ec2fd35d54c489d888867fad60549
• Effective base: 7eda3a3f806c998b33351f7064f5917d779d6b6d
• Both integrations: already current at the same effective base
• Focused gate: Markdown lint and git diff --check passed

The replacement adds owner-issued LibraryCatalogRouteEvidence and declaration-derived closure for every route-dependent cached section/field, with same-file platform/direct/package ordering tests. It also adds one operation-owned 64 MiB PortablePdbRetentionBudget across adjacent, cached, acquired, and embedded providers, enforced before copy/hash/reader work with visible PortablePdbRetentionLimitExceeded, no provider fallback, deterministic near/over/Browser gates, and no product SourceLinkReadLimits.Unlimited bypass.

[richlander]

Round 21 fixed-head adversarial review dispatched.

• Exact head: 9b977351cd7ec2fd35d54c489d888867fad60549
• Effective base: 7eda3a3f806c998b33351f7064f5917d779d6b6d
• Reviewers: GPT-5.6 Sol and Claude Opus 5
• Exact-head ci-required: success
• GitHub mergeability: mergeable / clean

Both reviewers are reviewing the whole head. Round 21 specifically attacks owner-issued route provenance, declaration-derived route/PDB key closure, the 64 MiB operation-owned PDB retention budget across every provider, pre-allocation and failure semantics, and deterministic cross-process/Browser evidence. Reporting CLEAN is explicitly acceptable.

[richlander]

Round 21 review reconciliation for exact head 9b977351cd7ec2fd35d54c489d888867fad60549 (effective base 7eda3a3f806c998b33351f7064f5917d779d6b6d).

• GPT-5.6 Sol: CLEAN.
• Claude Opus 5: one high-severity finding, independently reproduced and accepted.

The design allowed lookup under probe-time LocalSymbolDiscoveryEvidence but publication under post-inspection evidence. That contradicts the retained-snapshot rule: a catalog produced from None or PDB P1 can be permanently filed under PDB P2 without the producer consuming P2, or else requires the forbidden second PDB open. A controlled exact-head probe invoked the real publication path with a catalog produced without PDB evidence and hasSourceLink: true; the subsequent matching lookup reported catalog produced without PDB accepted under PDB-present key: True.

Disposition: accepted. Round 22 will freeze one owner-bound local-symbol evidence identity across lookup, every PDB-dependent cold producer, and publication. Separately authorized or concurrent symbol warming does not re-key that catalog. If the operation observes an evidence-generation change, it declines publication; the next invocation probes the new evidence and recomputes. The PDB W→S→W and digest/key gates will assert that no catalog is written under evidence the producer did not consume.

[richlander]

Round 22 candidate is frozen at cdbfcc49ef34a16eebea1ff3b97b9d8f2c730c3e on effective base 7eda3a3f806c998b33351f7064f5917d779d6b6d.

The review-driven fix binds route, retained assembly, format admission, and probe-time local-symbol evidence into one immutable effective-catalog subject used by lookup, all cold producers, and publication. Publication cannot substitute post-production evidence; an observed evidence-generation change declines the write and a later invocation recomputes. MDP017 now requires deterministic None→P2 and P1→P2 coverage for that contract.

Focused documentation validation passed before and after the second base integration, which was a no-op.

[richlander]

Round 22 fixed-head adversarial review dispatched.

• Exact base: 7eda3a3f806c998b33351f7064f5917d779d6b6d
• Exact head: cdbfcc49ef34a16eebea1ff3b97b9d8f2c730c3e
• Reviewers: GPT-5.6 Sol and Claude Opus 5
• Current-head ci-required: SUCCESS
• Mergeability: mergeable / clean

This round reviews the whole proposal. Its confirmation focus is the frozen effective-catalog subject: lookup, cold producers, and publication must use the same route, assembly, format-admission, and probe-time local-symbol evidence; no post-production evidence may re-key the result.

[richlander]

Round 22 review reconciliation for exact head cdbfcc49ef34a16eebea1ff3b97b9d8f2c730c3e (effective base 7eda3a3f806c998b33351f7064f5917d779d6b6d).

• GPT-5.6 Sol: CLEAN.
• Claude Opus 5: CLEAN. It specifically confirmed that the Round 21 probe-time/publication evidence mismatch is closed across all owning documents and worked the None→P2, P1→P2, and P1→None transitions.
• No findings require disposition, and the reviewed head did not move.
• Current-head ci-required: SUCCESS.
• Mergeability: mergeable / clean.
• Live base remains the reviewed effective base.

Ready to merge