@weftlet/toolkit 0.7.0 → 0.7.2

package/docs/ADR-012-impact-ranking.md

@@ -1,6 +1,7 @@
 # ADR 012: order impact evidence by proximity and source diversity
 
-Status: implemented as a query-only heuristic; not product policy or an evidence gate.
+Status: historical v1 query heuristic. [ADR 041](ADR-041-bounded-relationship-retrieval.md)
+records the v2 library-hub and relationship-priority revision. Neither is product policy or an evidence gate.
 
 The self-repository evaluation found distractions connected through common imports such as
 `node:fs/promises`. The previous ordering prioritized keyword counts, then Codex/document-link

package/docs/ADR-030-bounded-evidence-paths.md

@@ -1,7 +1,7 @@
 # ADR 030: bounded cited dependency paths
 
-Status: B1b implemented for the next candidate. Hosted validation and merge identity are recorded
-in the change PR; this entry does not announce npm publication or private consumer acceptance.
+Status: B1b shipped in 0.7.0. The query-order revision in [ADR 041](ADR-041-bounded-relationship-retrieval.md)
+replaces depth-first enumeration; publication and consumer acceptance are recorded separately.
 
 ## Meaning and scope
 
@@ -18,8 +18,8 @@ An empty predicate list selects all relations; a nonempty list is an OR filter.
 cited associations, not causality, compatible business obligations or behavior verification.
 They preserve authority, review state, source citations and node variants on every returned fact.
 
-Read the same lossless RDF/SPARQL projection as other queries. Preserve its existing explicit
-100,000-fact projection ceiling; exceeding it fails rather than truncating silently. No model,
+Read the same lossless RDF/SPARQL projection as other queries. The 0.7.1 streaming changes
+removed the former 100,000-fact projection ceiling without truncating evidence. No model,
 indexer, SHACL rerun or graph write is involved. Duplicate fact IDs and mismatched stored snapshot
 IDs fail. Responses reuse coverage, scoped diagnostic and checkout/overlay-state helpers.
 Coverage describes the page's supporting evidence, not a repository completion percentage;
@@ -28,9 +28,10 @@ in snapshot metadata. An exhausted search says nothing about excluded or unextra
 
 ## Enumeration, work and continuation
 
-Use deterministic depth-first traversal with adjacency sorted by assertion ID, independent of
-locale. This is not a shortest-path or importance ranking: alternatives reached later can be
-shorter or more relevant. Do not interpret the first path as the preferred design.
+Use deterministic breadth-first traversal. Within each adjacency list, edges ending at the
+requested target precede other edges, followed by assertion ID order independent of locale.
+Completed paths arrive in nondecreasing edge count; a known direct connection is considered
+first even on a high-branching source. This is not relevance, causality or a preferred design.
 
 Defaults are depth 8 (maximum 32), five paths per page (maximum 20) and 1,000 new candidate-edge
 examinations per page (maximum 10,000). Every considered edge counts, including cycles and depth
@@ -40,10 +41,11 @@ candidate count. Adjacency sorts are O(E log E); the existing RDF projection als
 There is no wall-clock latency guarantee.
 
 Continuations bind the operation version, normalized selectors and page budgets, saved manifest,
-actual facts and diagnostics. A cursor carries only a step offset, never an external stack or
+actual facts and diagnostics. A cursor carries only a step offset, never an external queue or
 assertions. Bounded replay reconstructs state and verifies the offset is a valid page boundary.
-Responses report replayed and new steps separately. Replay is at most the total ceiling; a DFS
-stack is at most depth + 1. This trades bounded repeated CPU work for stateless continuation
+Responses report replayed and new steps separately. Replay is at most the total ceiling.
+At most one queued prefix is allocated per examined edge (100,001 including the root); parent
+links share path prefixes, whose depth is bounded by 32. This trades repeated CPU work for stateless continuation
 without snapshot/cache writes or a large serialized queue. Tokens provide query consistency,
 not authentication. Changing selectors, depth, budgets or saved evidence requires restarting.
 Cumulative cost over many tiny pages can exceed one search's ceiling because replay is repeated;
@@ -53,8 +55,9 @@ The page includes only its completed paths and the union of their unchanged supp
 Work-limited pages may be empty and still have a continuation. Returned path count is not a
 count of all possible paths. A continuation can lead to a final empty page after dead ends/cycles.
 
-Report every active DFS prefix with its fact-ID prefix, next candidate fact ID and remaining
-adjacency-candidate count. These are not counts of valid paths. Depth cuts retain a total count,
+Report the exact pending-prefix count and up to 32 examples with fact-ID prefixes, next
+candidate fact IDs and remaining adjacency-candidate counts. Report the omitted example count
+explicitly. These are not counts of valid paths. Depth cuts retain a total count,
 up to 20 concrete extension examples and an explicit omitted-example count. Frontier IDs refer
 to saved assertions; use `graph.neighbors` at that node/snapshot to retrieve their full citations.
 
@@ -73,9 +76,9 @@ path controls use one result per page, 1,000 new examinations, selectable direct
 and the same total ceiling. Changing selection resets continuation. Targets show exact IDs next
 to labels. Each highlighted edge is an unchanged fact from that displayed pack.
 
-The prior viewer-only shortest-path implementation is replaced by shared deterministic
-enumeration; labels now say "cited path" rather than promising a shortest route. `impact.scan`
-and `graph.neighbors` remain unchanged. No extraction identity, semantic artifact/cache key,
+The viewer and service share this deterministic enumeration; labels say "cited path".
+ADR 041 separately revises `impact.scan` ranking; `graph.neighbors` is unchanged.
+No extraction identity, semantic artifact/cache key,
 snapshot format, dependency, rule policy or language support changes.
 
 ## Validation boundary
@@ -92,6 +95,6 @@ fresh installed CLI/MCP assets and continuation. Execute rendered viewer control
 DOM test harness and compare every highlighted path with the RDF service; this is script and
 projection parity, not interactive browser rendering or autonomous-agent usefulness evidence.
 
-B1a/B1b mechanisms are implemented; qualification and live product usefulness remain B6. B2's
-Graphify/SCIP comparison is next. No backend replacement or business compatibility inference
-is implied by paths through the existing evidence graph.
+B1a/B1b mechanisms are implemented; qualification and live product usefulness remain B6.
+No backend replacement or business compatibility inference is implied by paths through the
+existing evidence graph.

package/docs/ADR-040-bounded-graph-io.md

@@ -0,0 +1,90 @@
+# ADR 040: Preserve evidence while removing whole-graph string and RDF copies
+
+Status: implemented; public large-corpus lifecycle and hosted Linux/Windows checks pass.
+Consumer acceptance remains open.
+
+## Problem
+
+The 0.7.0 consumer report reaches 561,777 facts / 174,710 nodes, reusing 18 semantic artifacts
+without model calls, then fails at `sha256(stableJson(logical))`. Node's string ceiling is
+536,870,888 UTF-16 code units; increasing the heap does not remove it. Snapshot JSON writing,
+JSON reload and full RDF exports had similar allocations. The old internal SPARQL projection
+also rejected more than 100,000 facts.
+
+A generated public TypeScript corpus additionally demonstrated the memory cost of retaining a
+full named N3 dataset and its validation union simultaneously. The fix must retain every assertion,
+test fact, citation, confidence, authority and review state. It does not change extraction scope.
+
+## Decision
+
+- `stableJsonDigest` incrementally hashes the **existing encoding**, including sorted keys,
+  escaping, number formatting and legacy undefined-field behavior. `persistedJsonDigest` retains
+  the existing JSON-normalized digest contract. Neither is a new canonicalization standard.
+- Stream ordinary snapshot/artifact JSON to exclusive temporary files, then publish with the
+  existing atomic hard-link/head replacement rules. Read JSON incrementally with a strict parser.
+  Header-only checks parse the complete document but retain only the manifest. Old files need no
+  migration and existing immutable winners are never rewritten.
+- Stream default semantic N-Triples and optional openCAESAR file digests, preserving their existing
+  byte encodings and hashes. No Docker or provider is required to query saved evidence.
+- Use one RDF encoder for named exports, SPARQL matching and validation partitions. RDF/JS matching
+  streams complete groups and indexes subject/graph lookups; Comunica remains the SPARQL engine.
+  Cardinalities are exact, never guessed for optimizer shortcuts. The traversal record projection
+  has equivalence tests against SPARQL, including duplicate-ID join multiplicity, and no graph-size
+  response cap. Public query result limits still report truncation.
+- `serializeChunks()` / `serializeTo(writable)` export complete N-Quads with backpressure. The
+  legacy `serialize(): Promise<string>` convenience necessarily remains limited by the JavaScript
+  string ceiling. N-Quads ordering can differ from 0.7.0; its quad set is unchanged. Export order
+  is not a snapshot identity. Snapshot JSON encoding and semantic RDF digests are preserved.
+
+## Strict SHACL without two complete RDF stores
+
+Keep `rdf-validate-shacl` and every current constraint. Group all outgoing triples for a subject
+together, including every occurrence of a shared identity; do not validate isolated conflicting
+assertions as if each were a separate node. Current shapes inspect direct outgoing properties;
+their only cross-subject constraint is `sh:class`. Supply complete graph-wide `rdf:type` membership
+for those references. Determine the original targets before adding support-only type triples and
+express those same targets as `sh:targetNode` for the batch. Support-only nodes are checked with
+their complete records in their own batch.
+
+Every subject and constraint is evaluated. Missing proof targets, contradictory metadata, kind
+conflicts, corrupt citations and malformed code evidence still fail. Existing TypeScript proof
+and provenance checks run over all facts after SHACL. No validation result is reused or inferred
+from semantic cache hits. An allowlist rejects new SHACL vocabulary or non-direct paths until
+partition locality is reviewed; unsupported constraints cannot silently pass. Batch progress
+reports completed groups and elapsed time, not an estimated completion time.
+
+This changes execution/storage, not asserted semantics: assembly 12, extractor identities,
+semantic cache keys, schema version and logical snapshot IDs remain unchanged. Old snapshots stay
+addressable; existing extraction incompatibility checks still apply.
+
+## Validation and limits
+
+Tests compare against a frozen 0.7.0 RDF builder at
+`073edab3f1cef875f2fc058ffbc0ddc59cf934d2`. They compare complete named and union quad sets,
+positive/negative verdicts and issues, real SCIP/code-proof metadata, cross-partition class
+references, aggregates and traversal projections. Hash compatibility includes Unicode, surrogate
+boundaries, optional fields and an encoding larger than V8's actual string ceiling. Storage tests
+cover malformed/truncated JSON, special property names, legacy files and concurrent publication.
+
+The repeatable public workload is generated TypeScript with shared helpers, same-file and
+cross-file calls, spec files and 18 prose documents. Its provider is a deterministic fixture
+parser, not a live model. It exercises real SCIP, strict hydration, snapshot reload, streaming
+N-Quads parsing and bounded SPARQL, unchanged repeat and clean comparison; it asserts canonical
+encoding size above the actual string ceiling, exact provenance, semantic reuse, unchanged
+versions and immutable snapshot/artifact bytes.
+
+```sh
+pnpm build
+pnpm exec vitest run tests/large-graph-lifecycle.test.ts tests/rdf-scaling-parity.test.ts
+node --max-old-space-size=8192 --import tsx scripts/large-graph/run.ts 1100 40 --require-large
+```
+
+The large run is deliberately separate from ordinary CI; its scaled fixture runs in CI.
+The [recorded full run](benchmarks/large-graph-2026-11-02/result.json) passes with 554,516 facts,
+a 1 GB snapshot and a complete 5.3 GB RDF export. Each strict SHACL pass takes about 35–37 minutes;
+this does not establish a 30-minute hydration budget. Linux capacity results do not establish
+native Windows consumer acceptance. See VALIDATION.md for source/checkpoint distinctions. This is a capacity regression, not a
+semantic-quality or universal performance guarantee. Parsed graph objects and indexes still use
+memory; a single very large record/identity can exceed a group target. Arbitrary SPARQL joins,
+sorts and aggregates have their own time/memory costs. There is no persistent graph database,
+incremental-validation cache or Rust validator in this change.

package/docs/ADR-041-bounded-relationship-retrieval.md

@@ -0,0 +1,77 @@
+# ADR 041: useful relationships within bounded retrieval
+
+Status: query-only patch; validation and publication status are recorded in VALIDATION.md.
+
+## Evidence and scope
+
+The maintainer reports successful 0.7.1 hydration, strict validation, persistence/reload and
+unchanged repeat on the consumer's 561,777-fact graph, preserving all 18 cached artifacts.
+Two subsequent failures concern retrieval: a known direct path was displaced by deep branches,
+and specific consumer assertions were displaced by standard-library references.
+
+The consumer independently confirmed that the missing `references` and `consumes` assertions
+exist in the same snapshot and are reachable in expansion round two. Their calculated balanced
+positions were 24,801 and 69,207, outside three pages of 60 assertions at depth three. The
+diagnostic reproduced all 180 original result IDs in order without fetching larger pages or
+modifying evidence. This is ranking displacement for those assertions, not missing extraction.
+No private source, artifact or prompt was imported into this repository.
+
+## Path order
+
+Replace fact-ID depth-first traversal with breadth-first traversal. Adjacency preparation places
+edges closing on the exact target first, then sorts by fact ID. A known direct edge therefore
+appears before unrelated branches consume the first page. All distinct simple paths and parallel
+assertions remain eligible; no global visited-node pruning is introduced. Completed paths are
+ordered by nondecreasing edge count, not business importance or causal confidence.
+
+Retain the existing depth, page, candidate-step and cumulative work limits, including counted
+cycle/depth-cut examinations. Graph loading/indexing is still outside the candidate-step budget.
+The FIFO queue allocates at most one parent-linked prefix per examined edge, bounded by 100,001
+including the root. Return exact pending counts, 32 pending-prefix examples and an explicit
+omitted count; retain the existing bounded depth-cut examples. Stateless replay validates page
+boundaries. `simple-evidence-paths-v2` rejects old cursors; the shared HTML engine uses the same
+search. No full-graph completeness or latency guarantee is added.
+
+## Impact order
+
+Keep the reachable set, extraction, depth semantics and evidence-lane balancing unchanged.
+The `local-relationships-diversity-v2` policy revises the existing weighted-distance/source
+diversity heuristic:
+
+- A citation-only match seeds local endpoints before unresolved symbol endpoints. Referencing a
+  common library symbol in a changed function must not make all its co-users distance-zero peers.
+- Edges touching a `CodeSymbol` with `no-indexed-definition` cost at least eight, and assertions
+  touching such a symbol receive eight additional ordering points. Explicit node/label/native-symbol
+  anchor-text matches exempt that node. Missing definitions are not classified as proven libraries;
+  omitted repository code can also be unindexed. All those assertions remain retrievable.
+- Allocate early slots within each provenance source to saved local `calls`, their exact cited
+  reference proofs, and legacy file-to-symbol consumers matching saved local callable identities.
+  Other cross-file references follow before local occurrence detail. Existing product intent,
+  queue/data contracts, validation and adapter assertions retain their ordinary category.
+- Within these categories use distance, focus and stable semantic tie keys. Add the per-source
+  ordinal to the distance score, then retain the existing evidence-lane balancing among equal
+  scores. Distant relationships still pay distance; local variable repetition cannot consume
+  all of a file's early slots before its consumer relationship is considered.
+
+These are explainable ordering signals, not business rules or authority changes. A file-level
+`consumes` relationship still does not establish invocation; a saved static call does not prove
+runtime execution. Explicit library-symbol queries remain supported. Pagination retains every
+reachable assertion exactly once; old ranking cursors fail with restart instructions.
+
+## Acceptance and compatibility
+
+The frozen [public protocol](../evaluations/relationship-retrieval/protocol.md) uses three actual
+TypeScript producer/queue/worker/test flows, real SCIP and call extraction, and deterministic
+cited prose. It scores 36 specific calls, callsite references and legacy consumers separately
+from 12-file discovery. The budget remains depth three, three pages of 60, all 540 assertions
+in the denominator. Compare the same immutable saved snapshot and unchanged reachable counts.
+Report standard-library share independently of the production unindexed-symbol heuristic.
+
+Also check a 1,500-branch direct-edge case at 1,000 steps, every directed four-node graph against
+an exhaustive path oracle, continuation/replay, incoming/both directions, authority/citation
+preservation, shared viewer parity, explicit library queries and strict extraction/publication.
+
+No extractor/assembly identity, semantic cache, persisted encoding, RDF constraints or snapshot
+content changes. Existing 0.7.1 snapshots use the new ordering without hydration or model calls.
+The 0.7.1 streaming/canonical-hash fixes remain intact. This public regression does not close
+private consumer acceptance; TradePilot must retry the original cases with unchanged budgets.

package/docs/RELEASING.md

@@ -202,14 +202,14 @@ Verify the matching public version in a fresh disposable project after publicati
 
 ```sh
 npm init -y
-npx --yes @weftlet/toolkit@0.7.0 init --yes
-npx --yes @weftlet/toolkit@0.7.0 config validate
+npx --yes @weftlet/toolkit@0.7.2 init --yes
+npx --yes @weftlet/toolkit@0.7.2 config validate
 ```
 
 For local installation, use both prepared archives from the same reviewed release:
 
 ```sh
-npm install --save-dev "/path/to/weftlet/.release/weftlet-core-0.7.0.tgz" "/path/to/weftlet/.release/weftlet-toolkit-0.7.0.tgz"
+npm install --save-dev "/path/to/weftlet/.release/weftlet-core-0.7.2.tgz" "/path/to/weftlet/.release/weftlet-toolkit-0.7.2.tgz"
 ```
 <!-- weftlet:release:end -->
 

package/docs/VALIDATION.md

@@ -1,5 +1,126 @@
 # Validation evidence
 
+## 0.7.1 consumer follow-up and bounded retrieval patch, 2026-11-03
+
+**Maintainer-reported consumer pass:** the published 0.7.1 toolkit hydrates, strictly validates,
+persists and reloads TradePilot's 561,777 facts / 174,710 nodes. Unchanged repeat preserves the
+snapshot and all 18 semantic artifacts. This closes the reported whole-string capacity blocker
+for that workload; it is not general query-usefulness or official 1.0 acceptance.
+
+**Maintainer-reported remaining defect:** a direct connection was absent from a work-limited
+path page, and relevant worker `references`/`consumes` assertions were absent from three 60-fact
+impact pages at depth three. A read-only consumer diagnostic independently reproduced all
+180 query IDs and the 420,837 reachable count. Both assertions exist in that same snapshot,
+are reached in expansion round two, and were ranked at 24,801 and 69,207. This establishes
+ranking displacement for those assertions. No private source or graph was accessed here.
+
+**Public patch evidence:** [ADR 041](ADR-041-bounded-relationship-retrieval.md) and the
+[frozen comparison](../evaluations/relationship-retrieval/README.md) record query-only changes.
+On the same strictly validated 15,549-fact public TypeScript snapshot, both policies retain
+5,128 reachable assertions per case and the full 540 returned-assertion denominator. Expected
+call, callsite-reference and legacy-consumer retrieval improves from **0/36 to 36/36**;
+12/12 file discovery is unchanged. TypeScript standard-library references change from
+450/540 to 0/540 on those bounded pages. Library facts remain stored/reachable, and explicit
+library-symbol queries pass. Seven evidence files, including all three semantic artifacts,
+retain their exact byte digests after rescoring. No hydration or model calls occur in comparison.
+
+A fresh public extraction/strict-publication test passes with all 36 targets, exact repeated
+page IDs and unchanged evidence bytes. The high-branching query-service regression returns the
+same cited direct edge as impact.scan on page one at depth three, three paths and 1,000 steps,
+with explicit pending/omitted frontier counts. Exhaustive four-node path and shared viewer
+parity checks pass. Extraction/assembly identities, canonical hashing, storage and strict SHACL
+constraints are unchanged. Old query cursors require restart; old snapshots need no refresh.
+
+Exact-head release qualification and hosted platform results are recorded on
+[PR 67](https://github.com/jchewitt/weftlet/pull/67); the evidence above records the local focused checks.
+Private fixed-budget retrieval acceptance remains open; the public comparison is not a claim
+about TradePilot's new result positions. Browser interaction and live provider quality retain
+their existing separate validation status.
+
+## 0.7.0 large-graph field blocker follow-up, 2026-11-02
+
+Status: public capacity qualification and hosted Linux/Windows checks pass; patch release pending.
+Private consumer acceptance remains open.
+[ADR 040](ADR-040-bounded-graph-io.md) records the encoding, storage and strict SHACL boundaries.
+The consumer's reported 561,777-fact failure occurs before SHACL at whole-graph canonical
+string construction. Its prior snapshots remain readable; no private inputs were imported here.
+
+Local Linux checks currently establish:
+
+- Production build and 38 core tests pass, including an independently checked canonical hash
+  larger than V8's actual string ceiling. Existing encoding and persisted-JSON digest semantics
+  are retained, including optional fields and Unicode boundaries.
+- 65 focused lifecycle, RDF parity, streaming-storage and release-documentation tests pass.
+  The frozen 0.7.0 reference verifies named/union quad sets, strict positive/negative verdicts,
+  cross-subject proof checks, SPARQL aggregates and lossless traversal projection. A separate
+  100,001-fact test removes the old projection ceiling without truncation.
+- Fresh packed-consumer installation passes setup, preview/cache adoption, traversal hydration
+  and reuse, real SCIP, RDF/SPARQL/SHACL, HTML/DOT/SVG assets and MCP.
+- Inventory and license checks pass; all 79 original source import path/SHA pairs are unchanged.
+  Architecture passes with 15 advisory findings: two additional complexity advisories in the
+  canonical digest visitor and RDF matching function. No baseline, exception or gate changed.
+
+The full suite exposed a corrupt-JSON error-class compatibility regression. The streaming
+reader now preserves SyntaxError classification for malformed/truncated input while retaining
+I/O errors as infrastructure failures; cache-adoption CLI and strict parser regressions pass.
+The full local pass before those fixes completed with 977 passes / 8 failures / 1 optional skip.
+All corrupt-artifact cases pass on rerun (44 cache/preview/storage tests plus 3 CLI cases).
+An overlapping local rebuild interrupted a compiled benchmark subprocess; its 6 tests pass after
+the build. Seven sequential CLI launches exceeded the old aggregate 30-second setup-test budget;
+the test now bounds each process to 30 seconds and the sequence to 180 seconds, retaining all
+assertions (3 setup tests pass). A subsequent 29-test RDF/setup run passes. These corrections
+do not change production operation deadlines. At `85361dbb` both hosted runs
+[41532316889](https://github.com/jchewitt/weftlet/actions/runs/41532316889) and
+[41532326444](https://github.com/jchewitt/weftlet/actions/runs/41532326444) pass Linux and Windows.
+Linux passes 38 core + 985 toolkit tests (1 optional ontology integration skipped), architecture,
+inventory, licenses and fresh packed-consumer smoke. Windows passes 38 core + 878 selected tests,
+inventory and licenses. The final local packed-consumer rerun also passes.
+
+At `d1498a4`, hosted push run
+[41542970652](https://github.com/jchewitt/weftlet/actions/runs/41542970652) passes both platforms.
+The duplicate PR run
+[41542976891](https://github.com/jchewitt/weftlet/actions/runs/41542976891) passes Linux; Windows
+passes 877 selected tests but times out in the four-command failure-reporting test at its
+30-second aggregate deadline, then encounters cleanup EBUSY with the child still using its cwd.
+The harness now retains each 20-second command limit, allows 100 seconds for the combined
+sequence and fixture setup, and aborts/waits for child closure before cleanup. All four local
+failure-reporting tests pass; this changes no production timeout or assertion.
+At `4bc41fd1`, both subsequent hosted runs
+[41545800490](https://github.com/jchewitt/weftlet/actions/runs/41545800490) and
+[41545807452](https://github.com/jchewitt/weftlet/actions/runs/41545807452) pass Linux and Windows,
+including the corrected test and fresh packed-consumer installation.
+
+The optional broader test-source TypeScript check still reports existing diagnostics outside
+the production build. An isolated archive of the base commit has the same 42 diagnostics after
+normalizing checkout paths and ignoring its two absent-build-output errors; this patch adds none.
+
+The [public capacity result](benchmarks/large-graph-2026-11-02/result.json) passes the complete
+hydrate → strict validation → persist/read → unchanged repeat → clean comparison lifecycle.
+It uses 1,100 TypeScript modules with 40 functions each, actual SCIP, spec files and 18
+deterministic prose extractions, with zero live model calls. The run produced **554,516 facts /
+143,044 nodes**, a **1,021,806,445-byte snapshot**, and a **5,331,139,680-byte N-Quads export**
+containing 21,522,256 quads. Every exported record was parsed and matched by ID and canonical
+digest. Bounded real SPARQL and the complete record projection pass without dropping facts.
+
+All three full strict SHACL passes succeed: cold **2,099,768 ms**, repeat **2,225,093 ms**, and
+clean **2,096,881 ms** (about 35–37 minutes each). Both repeat and clean reuse all 18 artifacts
+with zero further extraction. Snapshot identity on repeat, logical/content digests, exact
+provenance, extractor versions, cache keys, original snapshot bytes and all semantic artifact
+bytes are retained. The complete harness took 8,841,003 ms, including three indexing/validation
+runs, large-file round trips, independent assertions and fixture cleanup. This establishes
+capacity/correctness, **not a 30-minute hydration budget** or private-workload performance.
+Other local checks overlapped part of the run; it is not an isolated comparative benchmark.
+
+An independent read of the saved 554,516 facts confirms that 938,267,270 characters of logical
+canonical encoding hash to
+`e6965407b8a8d76ed6d2d7ef8d2daa0297059b5fb327723cd49e73233865c001`
+under both the legacy per-record encoding with exact array separators and `stableJsonDigest`.
+That assertion is now also in the lifecycle harness; its scaled CI fixture passes.
+The long-running capacity process predates the final negative-path shape/error guards and
+harness corrections. Those changes pass separately in the hosted checks above; this is not
+claimed as an exact-final-head large-corpus rerun. Native Windows field acceptance, live provider
+quality and optional openCAESAR runtime remain separate checks.
+
 ## 0.7.0 acceptance release disposition, 2026-11-02
 
 The maintainer authorized publishing the accumulated B1–B5 implementation for live TradePilot

package/docs/benchmarks/large-graph-2026-11-02/result.json

@@ -0,0 +1,156 @@
+{
+  "schemaVersion": 1,
+  "workload": "Generated committed public TypeScript, actual SCIP, deterministic prose provider",
+  "environment": {
+    "os": "Linux x64",
+    "node": "24.19.0",
+    "pnpm": "10.18.2",
+    "nodeHeapLimitMiB": 8192,
+    "cpuQuota": 4,
+    "cgroupMemoryBytes": 34359738368
+  },
+  "command": "NODE_OPTIONS=--max-old-space-size=8192 pnpm exec tsx scripts/large-graph/run.ts 1100 40 --require-large",
+  "qualificationScope": "The capacity process started before the final negative-path shape/error guards and test-harness corrections. Those changes, and the newly embedded legacy-hash assertion, passed separately in hosted Linux/Windows checks at 4bc41fd1eee4169934fc8e50960bb60b7c8ff617. This is not an exact-final-head large-corpus rerun.",
+  "result": {
+    "status": "passed",
+    "elapsedMs": 8841003,
+    "modules": 1100,
+    "functions": 40,
+    "factCount": 554516,
+    "nodeCount": 143044,
+    "bytes": 1021806445,
+    "logicalCharacters": 938267270,
+    "rdfBytes": 5331139680,
+    "quadCount": 21522256,
+    "contentDigest": "2f75e3dbc16e7ca856d177264046034f40a1560b8a39e5df8b998c653c7b8e81",
+    "immutableDigest": "4f48702636a5499e2bfde70f2cca189d2d67836531180685515b4eb3d10ca3f2",
+    "providerCalls": 0,
+    "deterministicProviderExtractions": 18,
+    "repeatReused": 18,
+    "cleanReused": 18,
+    "extractorVersions": {
+      "assembly": "standalone-graph-v12",
+      "repository-contract-extractor": "1.2.0",
+      "scip-symbol-extractor": "2.1.0",
+      "typescript-call-extractor": "1.0.0",
+      "repository-node-identity": "1",
+      "document-linker": "2.0.0",
+      "document-code-binding-extractor": "1.0.0",
+      "document-obligation-extractor": "1.0.0",
+      "semantic": "1.1.0",
+      "scip": "0.4.0",
+      "ontology": "rdf-record-v1",
+      "repository-file-extractor": "2.0.0"
+    }
+  },
+  "legacyCanonicalDigestParity": {
+    "status": "passed",
+    "facts": 554516,
+    "canonicalCharacters": 938267270,
+    "digest": "e6965407b8a8d76ed6d2d7ef8d2daa0297059b5fb327723cd49e73233865c001",
+    "method": "legacy per-record stableJson plus exact array separators vs stableJsonDigest"
+  },
+  "completedPhases": [
+    {
+      "totalElapsedMs": 112233,
+      "phase": "validate-identities",
+      "status": "completed",
+      "factCount": 554516,
+      "nodeCount": 143044,
+      "elapsedMs": 1118
+    },
+    {
+      "totalElapsedMs": 138845,
+      "phase": "build-rdf-evidence",
+      "status": "completed",
+      "factCount": 554516,
+      "nodeCount": 143044,
+      "elapsedMs": 1
+    },
+    {
+      "totalElapsedMs": 344926,
+      "phase": "build-validation-union",
+      "status": "completed",
+      "factCount": 554516,
+      "elapsedMs": 206080,
+      "nodeCount": 143044
+    },
+    {
+      "totalElapsedMs": 2444694,
+      "phase": "validate-shacl",
+      "status": "completed",
+      "factCount": 554516,
+      "elapsedMs": 2099768,
+      "nodeCount": 143044
+    },
+    {
+      "totalElapsedMs": 3525345,
+      "phase": "validate-identities",
+      "status": "completed",
+      "factCount": 554516,
+      "nodeCount": 143044,
+      "elapsedMs": 754
+    },
+    {
+      "totalElapsedMs": 3555601,
+      "phase": "build-rdf-evidence",
+      "status": "completed",
+      "factCount": 554516,
+      "nodeCount": 143044,
+      "elapsedMs": 1
+    },
+    {
+      "totalElapsedMs": 3783233,
+      "phase": "build-validation-union",
+      "status": "completed",
+      "factCount": 554516,
+      "elapsedMs": 227631,
+      "nodeCount": 143044
+    },
+    {
+      "totalElapsedMs": 6008326,
+      "phase": "validate-shacl",
+      "status": "completed",
+      "factCount": 554516,
+      "elapsedMs": 2225093,
+      "nodeCount": 143044
+    },
+    {
+      "totalElapsedMs": 6340553,
+      "phase": "validate-identities",
+      "status": "completed",
+      "factCount": 554516,
+      "nodeCount": 143044,
+      "elapsedMs": 977
+    },
+    {
+      "totalElapsedMs": 6370727,
+      "phase": "build-rdf-evidence",
+      "status": "completed",
+      "factCount": 554516,
+      "nodeCount": 143044,
+      "elapsedMs": 0
+    },
+    {
+      "totalElapsedMs": 6575068,
+      "phase": "build-validation-union",
+      "status": "completed",
+      "factCount": 554516,
+      "elapsedMs": 204340,
+      "nodeCount": 143044
+    },
+    {
+      "totalElapsedMs": 8671949,
+      "phase": "validate-shacl",
+      "status": "completed",
+      "factCount": 554516,
+      "elapsedMs": 2096881,
+      "nodeCount": 143044
+    }
+  ],
+  "limitations": [
+    "Capacity and correctness regression; not a 30-minute hydration qualification.",
+    "Other local checks overlapped part of the run; this is not an isolated comparative performance benchmark.",
+    "No private consumer source, native Windows field acceptance, live model-quality evaluation, or optional openCAESAR runtime is claimed."
+  ]
+}