@weftlet/toolkit 0.7.0 → 0.7.1

package/dist/storage/storage.js

@@ -1,11 +1,12 @@
 // Modified for standalone extraction; see docs/extraction-manifest.json.
-import { mkdir, readFile, writeFile, link, rm } from 'node:fs/promises';
+import { mkdir, writeFile, link, rm } from 'node:fs/promises';
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { atomicRename } from './atomic-rename.js';
 import { physicalArtifactKey, temporaryArtifactPath } from '../infrastructure/artifact-paths.js';
+import { readJsonFile, readJsonProperty, writeJsonFile } from './streaming-json.js';
 async function readJson(path) {
     try {
-        return JSON.parse(await readFile(path, 'utf8'));
+        return await readJsonFile(path);
     }
     catch (error) {
         if (error.code === 'ENOENT')
@@ -13,8 +14,8 @@ async function readJson(path) {
         throw error;
     }
 }
-async function readWithLegacyPath(path, legacyPath) {
-    const current = await readJson(path);
+async function readWithLegacyPath(path, legacyPath, read = (readJson)) {
+    const current = await read(path);
     if (current !== undefined || path === legacyPath)
         return current;
     // No old file could have this component on supported filesystems. Do not attempt an
@@ -23,7 +24,7 @@ async function readWithLegacyPath(path, legacyPath) {
         return undefined;
     if (process.platform === 'win32' && /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(basename(legacyPath)))
         return undefined;
-    return readJson(legacyPath);
+    return read(legacyPath);
 }
 async function atomicJson(path, value) {
     await mkdir(dirname(path), { recursive: true });
@@ -65,9 +66,9 @@ export class FileSnapshotStore {
     }
     async write(snapshot) {
         const destination = snapshotPath(this.root, snapshot.manifest.snapshotId);
-        const prior = await this.read(snapshot.manifest.snapshotId);
+        const prior = await this.readManifest(snapshot.manifest.snapshotId);
         if (prior) {
-            if (prior.manifest.contentDigest !== snapshot.manifest.contentDigest) {
+            if (prior.contentDigest !== snapshot.manifest.contentDigest) {
                 throw new Error(`Refusing to overwrite immutable snapshot ${snapshot.manifest.snapshotId} with different content`);
             }
             return; // Preserve an existing legacy file without copying or rewriting its bytes.
@@ -75,15 +76,15 @@ export class FileSnapshotStore {
         await mkdir(dirname(destination), { recursive: true });
         const temporary = temporaryArtifactPath(destination);
         try {
-            await writeFile(temporary, JSON.stringify(snapshot), { flag: 'wx' });
+            await writeJsonFile(temporary, snapshot);
             // Linking a complete file publishes atomically without ever replacing a winner.
             await link(temporary, destination);
         }
         catch (error) {
             if (error.code !== 'EEXIST')
                 throw error;
-            const existing = await this.read(snapshot.manifest.snapshotId);
-            if (existing?.manifest.contentDigest !== snapshot.manifest.contentDigest) {
+            const existing = await this.readManifest(snapshot.manifest.snapshotId);
+            if (existing?.contentDigest !== snapshot.manifest.contentDigest) {
                 throw new Error(`Refusing to overwrite immutable snapshot ${snapshot.manifest.snapshotId} with different content`);
             }
         }
@@ -94,13 +95,36 @@ export class FileSnapshotStore {
     read(snapshotId) {
         return readWithLegacyPath(snapshotPath(this.root, snapshotId), snapshotPath(this.root, snapshotId, true));
     }
+    readManifest(snapshotId) {
+        return readWithLegacyPath(snapshotPath(this.root, snapshotId), snapshotPath(this.root, snapshotId, true), async (path) => {
+            try {
+                const manifest = await readJsonProperty(path, 'manifest');
+                if (!manifest || typeof manifest.contentDigest !== 'string')
+                    throw Error('Invalid snapshot manifest');
+                return manifest;
+            }
+            catch (error) {
+                if (error.code === 'ENOENT')
+                    return undefined;
+                throw error;
+            }
+        });
+    }
     async readHead(headName) {
+        const snapshotId = await this.headId(headName);
+        return snapshotId ? this.read(snapshotId) : undefined;
+    }
+    async readHeadManifest(headName) {
+        const snapshotId = await this.headId(headName);
+        return snapshotId ? this.readManifest(snapshotId) : undefined;
+    }
+    async headId(headName) {
         const key = safeKey(headName);
         const head = await readWithLegacyPath(join(this.root, 'heads', `${physicalArtifactKey(key)}.json`), join(this.root, 'heads', `${key}.json`));
-        return head ? this.read(head.snapshotId) : undefined;
+        return head?.snapshotId;
     }
     async updateHead(headName, snapshotId) {
-        if (!(await this.read(snapshotId)))
+        if (!(await this.readManifest(snapshotId)))
             throw new Error('Cannot point a head to an absent snapshot');
         return atomicJson(join(this.root, 'heads', `${physicalArtifactKey(safeKey(headName))}.json`), { snapshotId });
     }
@@ -138,7 +162,7 @@ export class SemanticArtifactStore {
         await mkdir(dirname(path), { recursive: true });
         const temporary = temporaryArtifactPath(path);
         try {
-            await writeFile(temporary, JSON.stringify(artifact), { flag: 'wx' });
+            await writeJsonFile(temporary, artifact);
             await link(temporary, path);
         }
         catch (error) {

package/dist/storage/streaming-json.d.ts

@@ -0,0 +1,5 @@
+/** Ordinary JSON bytes, incrementally encoded/decoded; legacy files need no migration. */
+export declare function readJsonFile<T>(path: string): Promise<T>;
+/** Validate the complete document while retaining only a selected root property. */
+export declare function readJsonProperty<T>(path: string, property: string): Promise<T | undefined>;
+export declare function writeJsonFile(path: string, value: unknown): Promise<void>;

package/dist/storage/streaming-json.js

@@ -0,0 +1,45 @@
+import { createReadStream, createWriteStream } from 'node:fs';
+import { pipeline } from 'node:stream/promises';
+import { stringifyChunked } from '@discoveryjs/json-ext';
+import { JSONParser, TokenizerError, TokenParserError } from '@streamparser/json';
+/** Ordinary JSON bytes, incrementally encoded/decoded; legacy files need no migration. */
+export async function readJsonFile(path) {
+    return parseJsonFile(path, '$');
+}
+/** Validate the complete document while retaining only a selected root property. */
+export async function readJsonProperty(path, property) {
+    if (!/^[a-zA-Z][a-zA-Z0-9]*$/.test(property))
+        throw Error('Invalid JSON property selector');
+    return parseJsonFile(path, `$.${property}`);
+}
+async function parseJsonFile(path, selector) {
+    let value;
+    const parser = new JSONParser({ paths: [selector], keepStack: selector === '$' });
+    let complete = false;
+    let hasInput = false;
+    parser.onValue = result => { value = result.value; };
+    parser.onEnd = () => { complete = true; };
+    parser.onError = error => {
+        // Cache inspection distinguishes invalid JSON from I/O/infrastructure errors.
+        // Keep that contract without including artifact contents in the public message.
+        // 0.0.26 reports a truncated container as plain Error, unlike invalid tokens.
+        const incompleteContainer = error.constructor === Error && error.message.startsWith('Parser ended in mid-parsing (state:');
+        if (error instanceof TokenizerError || error instanceof TokenParserError || incompleteContainer) {
+            throw new SyntaxError('Invalid JSON document', { cause: error });
+        }
+        throw error;
+    };
+    for await (const chunk of createReadStream(path)) {
+        if (!hasInput)
+            hasInput = chunk.some(byte => ![9, 10, 13, 32].includes(byte));
+        parser.write(chunk);
+    }
+    if (!parser.isEnded)
+        parser.end();
+    if (!complete || !hasInput)
+        throw new SyntaxError('Incomplete JSON document');
+    return value;
+}
+export async function writeJsonFile(path, value) {
+    await pipeline(stringifyChunked(value), createWriteStream(path, { flags: 'wx' }));
+}

package/docs/1.0-WORK-QUEUE.md

@@ -16,18 +16,28 @@ for this candidate. Prior consumer Codex hydration remains evidence for the esta
 flow; it does not validate the new proposal operation. No further feature milestone is scheduled
 before this candidate. B6b and the explicit official 1.0 decision remain open.
 
+Consumer blocker, 2026-11-02: 0.7.0's richer code graph exceeded Node's whole-string limit before
+strict SHACL/publication. [ADR 040](ADR-040-bounded-graph-io.md) tracks the hashing, persistence,
+RDF/query and bounded-validation patch. Its public large-corpus lifecycle and hosted Linux/Windows checks
+pass; patch publication and private acceptance remain separate steps. No 1.0 approval is implied.
+
+All three public 554,516-fact strict SHACL passes succeeded but took about 35–37 minutes each
+in this cloud. This is a capacity result, not a 30-minute hydration qualification. B6b must record
+full hydration and agent-query latency on the consumer workload as well as correctness.
+Any further validation optimization must retain full constraints and parity evidence.
+
 | Task | Status / dependency | Deliverable and check |
 | --- | --- | --- |
-| **B1a — Exact node neighborhoods** | Implemented; next candidate pending. Validation in ADR 029 and the change PR | `graph.neighbors` through the shared public API, CLI and MCP. Exact snapshot/node IDs, direction/relation filters, cited assertion pagination, remaining-neighbor counts, further-expansion hints and shared evidence state. Check duplicate labels, cycles, self-links, parallel evidence, missing/deleted nodes, stale/tampered cursors, dirty overlays and real extracted cross-service facts. |
-| **B1b — Bounded dependency paths** | Implemented; next candidate pending. Validation in ADR 030 and the change PR | `graph.paths` enumerates cited simple paths through API/CLI/MCP, with depth/work/output limits, continuation and explicit pending/depth-cut frontier. The offline viewer uses the same search function on displayed facts. Check competing branches, cycles, deep paths, scope omissions and all 4,096 directed four-node graphs against an independent oracle. |
+| **B1a — Exact node neighborhoods** | Shipped in 0.7.0. Validation in ADR 029 and the change PR | `graph.neighbors` through the shared public API, CLI and MCP. Exact snapshot/node IDs, direction/relation filters, cited assertion pagination, remaining-neighbor counts, further-expansion hints and shared evidence state. Check duplicate labels, cycles, self-links, parallel evidence, missing/deleted nodes, stale/tampered cursors, dirty overlays and real extracted cross-service facts. |
+| **B1b — Bounded dependency paths** | Shipped in 0.7.0. Validation in ADR 030 and the change PR | `graph.paths` enumerates cited simple paths through API/CLI/MCP, with depth/work/output limits, continuation and explicit pending/depth-cut frontier. The offline viewer uses the same search function on displayed facts. Check competing branches, cycles, deep paths, scope omissions and all 4,096 directed four-node graphs against an independent oracle. |
 | **B2a — Freeze code-graph comparison** | Frozen; verifier and fixture typechecks pass | 51 labeled code cases, three explicit gaps, unchanged A1–A3/dispatch controls, eight scenarios, pinned tools and bounded metrics in `evaluations/code-graph`. Read-only verification rejects input/label drift and supports immutable Git refs. No comparative execution or private/model inputs. |
 | **B2b — Run comparison and decide** | Measured; [ADR 031](ADR-031-code-extractor-selection.md) selects richer SCIP projection | Compare current projection, richer raw SCIP and pinned Graphify static extraction. Record correctness, citations, identity stability, cold/edit/repeat cost and packaging. Make an evidence-backed keep/improve/replace decision before B3's code-entity schema. |
-| **B3a — Explicit rule-to-symbol resolution** | Implemented in two increments ([ADR 032](ADR-032-scip-code-evidence.md), [ADR 033](ADR-033-document-symbol-bindings.md)); next candidate pending | Retain local/private symbols, same-file references and repeated source occurrences before resolving explicit document paths/symbol references. Include aliases, overloads, duplicate names, rename/delete and unresolved targets; retain both source spans/revisions and mapping authority. Follow the canonical [same-file acceptance boundary](PRE-1.0-BASELINE.md#same-file-exploration-acceptance). |
-| **B3b — Assess missing mappings** | Deterministic assessment complete ([ADR 034](ADR-034-mapping-gaps.md)); bounded opt-in implementation complete ([ADR 039](ADR-039-mapping-proposals.md)); live validation tentative and deferred by the maintainer for 0.7.0 | Identify gaps remaining after explicit resolution. Evaluate a bounded inference proposal only if justified, with an approved model budget before paid work. Never infer owner approval or silently convert proposed mappings into proven behavior. Record any scoped deferral for maintainer review. |
-| **B3c — Same-file call exploration** | Implemented ([ADR 035](ADR-035-static-call-evidence.md)); next candidate pending | Select and test static call analysis, preserving caller/callee/callsite and unresolved targets. Distinguish direct calls from references and callback registration; never claim observed execution. Meet the public large-file extraction/query acceptance in the canonical boundary, including recursion, unrelated functions, shadowed names, repeated sites and cross-file callers. No duplicate-behavior equivalence or mandatory second indexer. |
-| **B4a — Producer/consumer obligations** | Implemented for explicit declarations ([ADR 036](ADR-036-contract-obligation-declarations.md)); next candidate pending | Represent and retrieve cited guarantees/requirements on queue and stored-data contracts, with domain, stage, units, freshness and version where documented. Keep absent fields unknown. |
-| **B4b — Compatibility acceptance** | Implemented for selected explicit numeric declarations ([ADR 037](ADR-037-selected-contract-compatibility.md)); next candidate pending | Public queue/stored-data cases cover subset, insufficient guarantee, disjoint limits, revalidation and unknowns. Shared `graph.compatibility` retains two cited assertions and follow-up IDs. This is advisory; hard failures require approved deterministic policy. |
-| **B5 — Monorepo coverage** | Implemented for saved TypeScript-family inventory and package boundaries ([ADR 038](ADR-038-monorepo-code-coverage.md)); next candidate pending | `graph.coverage` pages selected/requested/indexed files and package connections; shared overview distinguishes saved scope from returned-page counts. Real barrels, aliases, TSX, independent/omitted services, declaration-only and unresolved external targets are tested. Unknown/zero observations never prove no impact. |
+| **B3a — Explicit rule-to-symbol resolution** | Implemented in two increments ([ADR 032](ADR-032-scip-code-evidence.md), [ADR 033](ADR-033-document-symbol-bindings.md)); shipped in 0.7.0 | Retain local/private symbols, same-file references and repeated source occurrences before resolving explicit document paths/symbol references. Include aliases, overloads, duplicate names, rename/delete and unresolved targets; retain both source spans/revisions and mapping authority. Follow the canonical [same-file acceptance boundary](PRE-1.0-BASELINE.md#same-file-exploration-acceptance). |
+| **B3b — Assess missing mappings** | Deterministic assessment complete ([ADR 034](ADR-034-mapping-gaps.md)); bounded opt-in implementation shipped in 0.7.0 ([ADR 039](ADR-039-mapping-proposals.md)); live validation tentative and deferred by the maintainer for 0.7.0 | Identify gaps remaining after explicit resolution. Evaluate a bounded inference proposal only if justified, with an approved model budget before paid work. Never infer owner approval or silently convert proposed mappings into proven behavior. Record any scoped deferral for maintainer review. |
+| **B3c — Same-file call exploration** | Implemented ([ADR 035](ADR-035-static-call-evidence.md)); shipped in 0.7.0 | Select and test static call analysis, preserving caller/callee/callsite and unresolved targets. Distinguish direct calls from references and callback registration; never claim observed execution. Meet the public large-file extraction/query acceptance in the canonical boundary, including recursion, unrelated functions, shadowed names, repeated sites and cross-file callers. No duplicate-behavior equivalence or mandatory second indexer. |
+| **B4a — Producer/consumer obligations** | Implemented for explicit declarations ([ADR 036](ADR-036-contract-obligation-declarations.md)); shipped in 0.7.0 | Represent and retrieve cited guarantees/requirements on queue and stored-data contracts, with domain, stage, units, freshness and version where documented. Keep absent fields unknown. |
+| **B4b — Compatibility acceptance** | Implemented for selected explicit numeric declarations ([ADR 037](ADR-037-selected-contract-compatibility.md)); shipped in 0.7.0 | Public queue/stored-data cases cover subset, insufficient guarantee, disjoint limits, revalidation and unknowns. Shared `graph.compatibility` retains two cited assertions and follow-up IDs. This is advisory; hard failures require approved deterministic policy. |
+| **B5 — Monorepo coverage** | Implemented for saved TypeScript-family inventory and package boundaries ([ADR 038](ADR-038-monorepo-code-coverage.md)); shipped in 0.7.0 | `graph.coverage` pages selected/requested/indexed files and package connections; shared overview distinguishes saved scope from returned-page counts. Real barrels, aliases, TSX, independent/omitted services, declaration-only and unresolved external targets are tested. Unknown/zero observations never prove no impact. |
 | **B6a — Candidate qualification** | B1–B5 decisions/increments reviewed | Freeze tasks and expected downstream obligations before measuring. Run public end-to-end, fresh-install and supported Windows/Linux release gates. Publish a minor acceptance candidate with versioned evidence and limitations. |
 | **B6b — Live consumer and 1.0 decision** | Published candidate | TradePilot runs real hydration/repeat and agent follow-up tasks; retain private requests/citations/timings locally and share a sanitized result. Assess usefulness and misses separately from pipeline success. Fix blockers, then explicitly review official 1.0. |
 

package/docs/ADR-040-bounded-graph-io.md

@@ -0,0 +1,90 @@
+# ADR 040: Preserve evidence while removing whole-graph string and RDF copies
+
+Status: implemented; public large-corpus lifecycle and hosted Linux/Windows checks pass.
+Consumer acceptance remains open.
+
+## Problem
+
+The 0.7.0 consumer report reaches 561,777 facts / 174,710 nodes, reusing 18 semantic artifacts
+without model calls, then fails at `sha256(stableJson(logical))`. Node's string ceiling is
+536,870,888 UTF-16 code units; increasing the heap does not remove it. Snapshot JSON writing,
+JSON reload and full RDF exports had similar allocations. The old internal SPARQL projection
+also rejected more than 100,000 facts.
+
+A generated public TypeScript corpus additionally demonstrated the memory cost of retaining a
+full named N3 dataset and its validation union simultaneously. The fix must retain every assertion,
+test fact, citation, confidence, authority and review state. It does not change extraction scope.
+
+## Decision
+
+- `stableJsonDigest` incrementally hashes the **existing encoding**, including sorted keys,
+  escaping, number formatting and legacy undefined-field behavior. `persistedJsonDigest` retains
+  the existing JSON-normalized digest contract. Neither is a new canonicalization standard.
+- Stream ordinary snapshot/artifact JSON to exclusive temporary files, then publish with the
+  existing atomic hard-link/head replacement rules. Read JSON incrementally with a strict parser.
+  Header-only checks parse the complete document but retain only the manifest. Old files need no
+  migration and existing immutable winners are never rewritten.
+- Stream default semantic N-Triples and optional openCAESAR file digests, preserving their existing
+  byte encodings and hashes. No Docker or provider is required to query saved evidence.
+- Use one RDF encoder for named exports, SPARQL matching and validation partitions. RDF/JS matching
+  streams complete groups and indexes subject/graph lookups; Comunica remains the SPARQL engine.
+  Cardinalities are exact, never guessed for optimizer shortcuts. The traversal record projection
+  has equivalence tests against SPARQL, including duplicate-ID join multiplicity, and no graph-size
+  response cap. Public query result limits still report truncation.
+- `serializeChunks()` / `serializeTo(writable)` export complete N-Quads with backpressure. The
+  legacy `serialize(): Promise<string>` convenience necessarily remains limited by the JavaScript
+  string ceiling. N-Quads ordering can differ from 0.7.0; its quad set is unchanged. Export order
+  is not a snapshot identity. Snapshot JSON encoding and semantic RDF digests are preserved.
+
+## Strict SHACL without two complete RDF stores
+
+Keep `rdf-validate-shacl` and every current constraint. Group all outgoing triples for a subject
+together, including every occurrence of a shared identity; do not validate isolated conflicting
+assertions as if each were a separate node. Current shapes inspect direct outgoing properties;
+their only cross-subject constraint is `sh:class`. Supply complete graph-wide `rdf:type` membership
+for those references. Determine the original targets before adding support-only type triples and
+express those same targets as `sh:targetNode` for the batch. Support-only nodes are checked with
+their complete records in their own batch.
+
+Every subject and constraint is evaluated. Missing proof targets, contradictory metadata, kind
+conflicts, corrupt citations and malformed code evidence still fail. Existing TypeScript proof
+and provenance checks run over all facts after SHACL. No validation result is reused or inferred
+from semantic cache hits. An allowlist rejects new SHACL vocabulary or non-direct paths until
+partition locality is reviewed; unsupported constraints cannot silently pass. Batch progress
+reports completed groups and elapsed time, not an estimated completion time.
+
+This changes execution/storage, not asserted semantics: assembly 12, extractor identities,
+semantic cache keys, schema version and logical snapshot IDs remain unchanged. Old snapshots stay
+addressable; existing extraction incompatibility checks still apply.
+
+## Validation and limits
+
+Tests compare against a frozen 0.7.0 RDF builder at
+`073edab3f1cef875f2fc058ffbc0ddc59cf934d2`. They compare complete named and union quad sets,
+positive/negative verdicts and issues, real SCIP/code-proof metadata, cross-partition class
+references, aggregates and traversal projections. Hash compatibility includes Unicode, surrogate
+boundaries, optional fields and an encoding larger than V8's actual string ceiling. Storage tests
+cover malformed/truncated JSON, special property names, legacy files and concurrent publication.
+
+The repeatable public workload is generated TypeScript with shared helpers, same-file and
+cross-file calls, spec files and 18 prose documents. Its provider is a deterministic fixture
+parser, not a live model. It exercises real SCIP, strict hydration, snapshot reload, streaming
+N-Quads parsing and bounded SPARQL, unchanged repeat and clean comparison; it asserts canonical
+encoding size above the actual string ceiling, exact provenance, semantic reuse, unchanged
+versions and immutable snapshot/artifact bytes.
+
+```sh
+pnpm build
+pnpm exec vitest run tests/large-graph-lifecycle.test.ts tests/rdf-scaling-parity.test.ts
+node --max-old-space-size=8192 --import tsx scripts/large-graph/run.ts 1100 40 --require-large
+```
+
+The large run is deliberately separate from ordinary CI; its scaled fixture runs in CI.
+The [recorded full run](benchmarks/large-graph-2026-11-02/result.json) passes with 554,516 facts,
+a 1 GB snapshot and a complete 5.3 GB RDF export. Each strict SHACL pass takes about 35–37 minutes;
+this does not establish a 30-minute hydration budget. Linux capacity results do not establish
+native Windows consumer acceptance. See VALIDATION.md for source/checkpoint distinctions. This is a capacity regression, not a
+semantic-quality or universal performance guarantee. Parsed graph objects and indexes still use
+memory; a single very large record/identity can exceed a group target. Arbitrary SPARQL joins,
+sorts and aggregates have their own time/memory costs. There is no persistent graph database,
+incremental-validation cache or Rust validator in this change.

package/docs/RELEASING.md

@@ -202,14 +202,14 @@ Verify the matching public version in a fresh disposable project after publicati
 
 ```sh
 npm init -y
-npx --yes @weftlet/toolkit@0.7.0 init --yes
-npx --yes @weftlet/toolkit@0.7.0 config validate
+npx --yes @weftlet/toolkit@0.7.1 init --yes
+npx --yes @weftlet/toolkit@0.7.1 config validate
 ```
 
 For local installation, use both prepared archives from the same reviewed release:
 
 ```sh
-npm install --save-dev "/path/to/weftlet/.release/weftlet-core-0.7.0.tgz" "/path/to/weftlet/.release/weftlet-toolkit-0.7.0.tgz"
+npm install --save-dev "/path/to/weftlet/.release/weftlet-core-0.7.1.tgz" "/path/to/weftlet/.release/weftlet-toolkit-0.7.1.tgz"
 ```
 <!-- weftlet:release:end -->
 

package/docs/VALIDATION.md

@@ -1,5 +1,89 @@
 # Validation evidence
 
+## 0.7.0 large-graph field blocker follow-up, 2026-11-02
+
+Status: public capacity qualification and hosted Linux/Windows checks pass; patch release pending.
+Private consumer acceptance remains open.
+[ADR 040](ADR-040-bounded-graph-io.md) records the encoding, storage and strict SHACL boundaries.
+The consumer's reported 561,777-fact failure occurs before SHACL at whole-graph canonical
+string construction. Its prior snapshots remain readable; no private inputs were imported here.
+
+Local Linux checks currently establish:
+
+- Production build and 38 core tests pass, including an independently checked canonical hash
+  larger than V8's actual string ceiling. Existing encoding and persisted-JSON digest semantics
+  are retained, including optional fields and Unicode boundaries.
+- 65 focused lifecycle, RDF parity, streaming-storage and release-documentation tests pass.
+  The frozen 0.7.0 reference verifies named/union quad sets, strict positive/negative verdicts,
+  cross-subject proof checks, SPARQL aggregates and lossless traversal projection. A separate
+  100,001-fact test removes the old projection ceiling without truncation.
+- Fresh packed-consumer installation passes setup, preview/cache adoption, traversal hydration
+  and reuse, real SCIP, RDF/SPARQL/SHACL, HTML/DOT/SVG assets and MCP.
+- Inventory and license checks pass; all 79 original source import path/SHA pairs are unchanged.
+  Architecture passes with 15 advisory findings: two additional complexity advisories in the
+  canonical digest visitor and RDF matching function. No baseline, exception or gate changed.
+
+The full suite exposed a corrupt-JSON error-class compatibility regression. The streaming
+reader now preserves SyntaxError classification for malformed/truncated input while retaining
+I/O errors as infrastructure failures; cache-adoption CLI and strict parser regressions pass.
+The full local pass before those fixes completed with 977 passes / 8 failures / 1 optional skip.
+All corrupt-artifact cases pass on rerun (44 cache/preview/storage tests plus 3 CLI cases).
+An overlapping local rebuild interrupted a compiled benchmark subprocess; its 6 tests pass after
+the build. Seven sequential CLI launches exceeded the old aggregate 30-second setup-test budget;
+the test now bounds each process to 30 seconds and the sequence to 180 seconds, retaining all
+assertions (3 setup tests pass). A subsequent 29-test RDF/setup run passes. These corrections
+do not change production operation deadlines. At `85361dbb` both hosted runs
+[41532316889](https://github.com/jchewitt/weftlet/actions/runs/41532316889) and
+[41532326444](https://github.com/jchewitt/weftlet/actions/runs/41532326444) pass Linux and Windows.
+Linux passes 38 core + 985 toolkit tests (1 optional ontology integration skipped), architecture,
+inventory, licenses and fresh packed-consumer smoke. Windows passes 38 core + 878 selected tests,
+inventory and licenses. The final local packed-consumer rerun also passes.
+
+At `d1498a4`, hosted push run
+[41542970652](https://github.com/jchewitt/weftlet/actions/runs/41542970652) passes both platforms.
+The duplicate PR run
+[41542976891](https://github.com/jchewitt/weftlet/actions/runs/41542976891) passes Linux; Windows
+passes 877 selected tests but times out in the four-command failure-reporting test at its
+30-second aggregate deadline, then encounters cleanup EBUSY with the child still using its cwd.
+The harness now retains each 20-second command limit, allows 100 seconds for the combined
+sequence and fixture setup, and aborts/waits for child closure before cleanup. All four local
+failure-reporting tests pass; this changes no production timeout or assertion.
+At `4bc41fd1`, both subsequent hosted runs
+[41545800490](https://github.com/jchewitt/weftlet/actions/runs/41545800490) and
+[41545807452](https://github.com/jchewitt/weftlet/actions/runs/41545807452) pass Linux and Windows,
+including the corrected test and fresh packed-consumer installation.
+
+The optional broader test-source TypeScript check still reports existing diagnostics outside
+the production build. An isolated archive of the base commit has the same 42 diagnostics after
+normalizing checkout paths and ignoring its two absent-build-output errors; this patch adds none.
+
+The [public capacity result](benchmarks/large-graph-2026-11-02/result.json) passes the complete
+hydrate → strict validation → persist/read → unchanged repeat → clean comparison lifecycle.
+It uses 1,100 TypeScript modules with 40 functions each, actual SCIP, spec files and 18
+deterministic prose extractions, with zero live model calls. The run produced **554,516 facts /
+143,044 nodes**, a **1,021,806,445-byte snapshot**, and a **5,331,139,680-byte N-Quads export**
+containing 21,522,256 quads. Every exported record was parsed and matched by ID and canonical
+digest. Bounded real SPARQL and the complete record projection pass without dropping facts.
+
+All three full strict SHACL passes succeed: cold **2,099,768 ms**, repeat **2,225,093 ms**, and
+clean **2,096,881 ms** (about 35–37 minutes each). Both repeat and clean reuse all 18 artifacts
+with zero further extraction. Snapshot identity on repeat, logical/content digests, exact
+provenance, extractor versions, cache keys, original snapshot bytes and all semantic artifact
+bytes are retained. The complete harness took 8,841,003 ms, including three indexing/validation
+runs, large-file round trips, independent assertions and fixture cleanup. This establishes
+capacity/correctness, **not a 30-minute hydration budget** or private-workload performance.
+Other local checks overlapped part of the run; it is not an isolated comparative benchmark.
+
+An independent read of the saved 554,516 facts confirms that 938,267,270 characters of logical
+canonical encoding hash to
+`e6965407b8a8d76ed6d2d7ef8d2daa0297059b5fb327723cd49e73233865c001`
+under both the legacy per-record encoding with exact array separators and `stableJsonDigest`.
+That assertion is now also in the lifecycle harness; its scaled CI fixture passes.
+The long-running capacity process predates the final negative-path shape/error guards and
+harness corrections. Those changes pass separately in the hosted checks above; this is not
+claimed as an exact-final-head large-corpus rerun. Native Windows field acceptance, live provider
+quality and optional openCAESAR runtime remain separate checks.
+
 ## 0.7.0 acceptance release disposition, 2026-11-02
 
 The maintainer authorized publishing the accumulated B1–B5 implementation for live TradePilot

package/docs/benchmarks/large-graph-2026-11-02/result.json

@@ -0,0 +1,156 @@
+{
+  "schemaVersion": 1,
+  "workload": "Generated committed public TypeScript, actual SCIP, deterministic prose provider",
+  "environment": {
+    "os": "Linux x64",
+    "node": "24.19.0",
+    "pnpm": "10.18.2",
+    "nodeHeapLimitMiB": 8192,
+    "cpuQuota": 4,
+    "cgroupMemoryBytes": 34359738368
+  },
+  "command": "NODE_OPTIONS=--max-old-space-size=8192 pnpm exec tsx scripts/large-graph/run.ts 1100 40 --require-large",
+  "qualificationScope": "The capacity process started before the final negative-path shape/error guards and test-harness corrections. Those changes, and the newly embedded legacy-hash assertion, passed separately in hosted Linux/Windows checks at 4bc41fd1eee4169934fc8e50960bb60b7c8ff617. This is not an exact-final-head large-corpus rerun.",
+  "result": {
+    "status": "passed",
+    "elapsedMs": 8841003,
+    "modules": 1100,
+    "functions": 40,
+    "factCount": 554516,
+    "nodeCount": 143044,
+    "bytes": 1021806445,
+    "logicalCharacters": 938267270,
+    "rdfBytes": 5331139680,
+    "quadCount": 21522256,
+    "contentDigest": "2f75e3dbc16e7ca856d177264046034f40a1560b8a39e5df8b998c653c7b8e81",
+    "immutableDigest": "4f48702636a5499e2bfde70f2cca189d2d67836531180685515b4eb3d10ca3f2",
+    "providerCalls": 0,
+    "deterministicProviderExtractions": 18,
+    "repeatReused": 18,
+    "cleanReused": 18,
+    "extractorVersions": {
+      "assembly": "standalone-graph-v12",
+      "repository-contract-extractor": "1.2.0",
+      "scip-symbol-extractor": "2.1.0",
+      "typescript-call-extractor": "1.0.0",
+      "repository-node-identity": "1",
+      "document-linker": "2.0.0",
+      "document-code-binding-extractor": "1.0.0",
+      "document-obligation-extractor": "1.0.0",
+      "semantic": "1.1.0",
+      "scip": "0.4.0",
+      "ontology": "rdf-record-v1",
+      "repository-file-extractor": "2.0.0"
+    }
+  },
+  "legacyCanonicalDigestParity": {
+    "status": "passed",
+    "facts": 554516,
+    "canonicalCharacters": 938267270,
+    "digest": "e6965407b8a8d76ed6d2d7ef8d2daa0297059b5fb327723cd49e73233865c001",
+    "method": "legacy per-record stableJson plus exact array separators vs stableJsonDigest"
+  },
+  "completedPhases": [
+    {
+      "totalElapsedMs": 112233,
+      "phase": "validate-identities",
+      "status": "completed",
+      "factCount": 554516,
+      "nodeCount": 143044,
+      "elapsedMs": 1118
+    },
+    {
+      "totalElapsedMs": 138845,
+      "phase": "build-rdf-evidence",
+      "status": "completed",
+      "factCount": 554516,
+      "nodeCount": 143044,
+      "elapsedMs": 1
+    },
+    {
+      "totalElapsedMs": 344926,
+      "phase": "build-validation-union",
+      "status": "completed",
+      "factCount": 554516,
+      "elapsedMs": 206080,
+      "nodeCount": 143044
+    },
+    {
+      "totalElapsedMs": 2444694,
+      "phase": "validate-shacl",
+      "status": "completed",
+      "factCount": 554516,
+      "elapsedMs": 2099768,
+      "nodeCount": 143044
+    },
+    {
+      "totalElapsedMs": 3525345,
+      "phase": "validate-identities",
+      "status": "completed",
+      "factCount": 554516,
+      "nodeCount": 143044,
+      "elapsedMs": 754
+    },
+    {
+      "totalElapsedMs": 3555601,
+      "phase": "build-rdf-evidence",
+      "status": "completed",
+      "factCount": 554516,
+      "nodeCount": 143044,
+      "elapsedMs": 1
+    },
+    {
+      "totalElapsedMs": 3783233,
+      "phase": "build-validation-union",
+      "status": "completed",
+      "factCount": 554516,
+      "elapsedMs": 227631,
+      "nodeCount": 143044
+    },
+    {
+      "totalElapsedMs": 6008326,
+      "phase": "validate-shacl",
+      "status": "completed",
+      "factCount": 554516,
+      "elapsedMs": 2225093,
+      "nodeCount": 143044
+    },
+    {
+      "totalElapsedMs": 6340553,
+      "phase": "validate-identities",
+      "status": "completed",
+      "factCount": 554516,
+      "nodeCount": 143044,
+      "elapsedMs": 977
+    },
+    {
+      "totalElapsedMs": 6370727,
+      "phase": "build-rdf-evidence",
+      "status": "completed",
+      "factCount": 554516,
+      "nodeCount": 143044,
+      "elapsedMs": 0
+    },
+    {
+      "totalElapsedMs": 6575068,
+      "phase": "build-validation-union",
+      "status": "completed",
+      "factCount": 554516,
+      "elapsedMs": 204340,
+      "nodeCount": 143044
+    },
+    {
+      "totalElapsedMs": 8671949,
+      "phase": "validate-shacl",
+      "status": "completed",
+      "factCount": 554516,
+      "elapsedMs": 2096881,
+      "nodeCount": 143044
+    }
+  ],
+  "limitations": [
+    "Capacity and correctness regression; not a 30-minute hydration qualification.",
+    "Other local checks overlapped part of the run; this is not an isolated comparative performance benchmark.",
+    "No private consumer source, native Windows field acceptance, live model-quality evaluation, or optional openCAESAR runtime is claimed."
+  ]
+}