carrick 0.3.104 → 0.3.105

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "carrick",
-  "version": "0.3.104",
+  "version": "0.3.105",
   "description": "Maps your entire TypeScript codebase across services and repositories, giving AI agents full context on existing types, routes, and function behaviours over MCP before they write duplicate or breaking code.",
   "keywords": [
     "typescript",
@@ -58,11 +58,11 @@
     "zod": "^3.23.0"
   },
   "optionalDependencies": {
-    "@carrick-tools/cli-darwin-arm64": "0.3.104",
-    "@carrick-tools/cli-darwin-x64": "0.3.104",
-    "@carrick-tools/cli-linux-arm64": "0.3.104",
-    "@carrick-tools/cli-linux-x64": "0.3.104",
-    "@carrick-tools/cli-win32-x64": "0.3.104"
+    "@carrick-tools/cli-darwin-arm64": "0.3.105",
+    "@carrick-tools/cli-darwin-x64": "0.3.105",
+    "@carrick-tools/cli-linux-arm64": "0.3.105",
+    "@carrick-tools/cli-linux-x64": "0.3.105",
+    "@carrick-tools/cli-win32-x64": "0.3.105"
   },
   "devDependencies": {
     "@types/node": "^24.13.3",

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "carrick",
   "description": "Claude Code plugin for Carrick, which indexes TypeScript codebases across service and repository boundaries. After each edit it adds the file's routes, calls, and cross-service type mismatches to the session, and it registers Carrick's language server. It pairs with the Carrick MCP server, which lets agents search functions by intent rather than name.",
-  "version": "0.3.104",
+  "version": "0.3.105",
   "author": {
     "name": "Carrick",
     "email": "hello@carrick.tools"

package/sidecar/dist/src/capture/anchors.d.ts

@@ -49,6 +49,12 @@ export interface ResolvedAnchor {
      * anchor's type holds no unresolved placeholder.
      */
     unresolved?: UnresolvedAtAnchor;
+    /**
+     * carrick#1446: set on a demotion whose alias text names a module the
+     * declaration emit skipped. The text dangles in the emitted tree, which the
+     * record states for a literal anchor, whose text is what the index serves.
+     */
+    namesUnemittedModule?: true;
 }
 /** Repo-root-relative source file -> extensionless specifier from entryDir. */
 export declare function entryRelativeSpecifier(entryDir: string, repoRoot: string, sourceFile: string): string;

package/sidecar/dist/src/capture/anchors.js

@@ -185,10 +185,33 @@ export function resolveAnchor(program, request, args) {
         }
         return finishInferAnchor(program, sourceFile, request, param, args.placeholder, undefined, args.repoRoot);
     }
-    let located = locateNode(sourceFile, request);
-    if (!located) {
+    const found = locate(sourceFile, request);
+    if (!found) {
         return demote(locatorFailureReason(request));
     }
+    // carrick#1785: the line fallback takes the first expression on the line,
+    // and a declaration's NAME is an expression to `ts.isExpression`. On a line
+    // that declares something, that name is all the fallback finds, and its type
+    // is the declared entity's own (a whole alias, a function, a class), never a
+    // payload. The line names the declaration, so the anchor abstains: an
+    // abstain, not a demotion, because the backfill has nothing better to
+    // re-anchor it with (carrick#766). It does not walk on to the next node
+    // either, which on a function's line is its first parameter.
+    if (found.by === 'line') {
+        const declaration = declarationNamedBy(found.node);
+        if (declaration) {
+            return {
+                request,
+                aliasText: 'unknown',
+                serialization: 'structural_fallback',
+                abstainReason: `the line fallback resolved the name of ` +
+                    `${describeNode(sourceFile, request.source_file, declaration)}; a ` +
+                    `declaration's name is not a payload, so the anchor abstains rather ` +
+                    `than publish the declared entity's own type`,
+            };
+        }
+    }
+    let located = found.node;
     // carrick#1162: a serialised body is the JSON of its argument. The call's own
     // `string` result is never the payload's contract, and publishing it reads
     // incompatible against every object-typed counterparty.
@@ -252,17 +275,18 @@ function finishInferAnchor(program, sourceFile, request, located, placeholder, r
     // here.
     //
     // A line alone names nothing. `firstExpressionOnLine` picks whatever comes
-    // first on the line, which on a re-export statement is the first exported
-    // binding. When THAT resolves to a top type the capture holds no payload and
-    // no type, and `export type <alias> = any;` states "a type was inferred and
-    // it collapsed" — a claim the scan cannot back. The honest word is `unknown`
-    // ("no contract stated here"), with the node the line resolved as the reason.
+    // first on the line. When THAT resolves to a top type the capture holds no
+    // payload and no type, and `export type <alias> = any;` states "a type was
+    // inferred and it collapsed" — a claim the scan cannot back. The honest word
+    // is `unknown` ("no contract stated here"), with the node the line resolved
+    // as the reason.
     //
     // Live shape: a route whose handlers are built by a framework factory and
     // re-exported at the bottom of the file. Both of the file's operations
-    // anchor at the export statement, the v1 walk abstains there (carrick#771),
-    // and the alias falls to this line-only locator, which resolves the first
-    // exported binding's identifier.
+    // anchor at the export statement and the v1 walk abstains there
+    // (carrick#771). The export line itself now abstains earlier, as a
+    // declaration's name (carrick#1785); this guard still holds for a line whose
+    // first node is a value that decayed, such as the factory call's binding.
     if (isTopType(type) && isLineOnly(request)) {
         return {
             request,
@@ -914,21 +938,62 @@ function locatorFailureReason(request) {
  * else the first expression starting on line_number.
  */
 export function locateNode(sourceFile, request) {
+    return locate(sourceFile, request)?.node;
+}
+/** The node `locateNode` resolves, and which of its three locators found it. */
+function locate(sourceFile, request) {
     if (request.span_start !== undefined && request.span_end !== undefined) {
         const bySpan = tightestCoveringNode(sourceFile, request.span_start, request.span_end);
         if (bySpan)
-            return bySpan;
+            return { node: bySpan, by: 'span' };
     }
     if (request.expression_text) {
         const byText = nodeByExpressionText(sourceFile, request.expression_text, request.line_number);
         if (byText)
-            return byText;
+            return { node: byText, by: 'text' };
     }
     if (request.line_number !== undefined) {
-        return firstExpressionOnLine(sourceFile, request.line_number);
+        const byLine = firstExpressionOnLine(sourceFile, request.line_number);
+        if (byLine)
+            return { node: byLine, by: 'line' };
     }
     return undefined;
 }
+/**
+ * The declaration `node` is the name of, when it names one (carrick#1785): a
+ * type alias, interface, class, function, method, property, accessor, enum or
+ * enum member, namespace, or an import or export binding (whose `propertyName`
+ * names the binding too: `export { a as b }`).
+ *
+ * Not a binding whose name is also the value read at that position: a
+ * destructured element and a shorthand property keep resolving. A variable,
+ * a parameter and a property assignment never reach here, because each is a
+ * preferred target the line walk takes before its name.
+ */
+function declarationNamedBy(node) {
+    const parent = node.parent;
+    if (!parent)
+        return undefined;
+    // A specifier's only children are its names.
+    if (ts.isImportSpecifier(parent) || ts.isExportSpecifier(parent))
+        return parent;
+    const named = ts.isTypeAliasDeclaration(parent) ||
+        ts.isInterfaceDeclaration(parent) ||
+        ts.isClassDeclaration(parent) ||
+        ts.isFunctionDeclaration(parent) ||
+        ts.isMethodDeclaration(parent) ||
+        ts.isMethodSignature(parent) ||
+        ts.isPropertyDeclaration(parent) ||
+        ts.isPropertySignature(parent) ||
+        ts.isGetAccessorDeclaration(parent) ||
+        ts.isSetAccessorDeclaration(parent) ||
+        ts.isEnumDeclaration(parent) ||
+        ts.isEnumMember(parent) ||
+        ts.isModuleDeclaration(parent) ||
+        ts.isImportClause(parent) ||
+        ts.isNamespaceImport(parent);
+    return named && parent.name === node ? parent : undefined;
+}
 function isPreferredTarget(node) {
     return (ts.isExpression(node) ||
         ts.isVariableDeclaration(node) ||

package/sidecar/dist/src/capture/api.d.ts

@@ -251,6 +251,26 @@ export interface CaptureAliasRecord {
      * absent when there are none.
      */
     undeclared_names?: string[];
+    /**
+     * Every position at which this alias's type, as the emitted tree states it,
+     * holds TypeScript's unresolved-reference placeholder (carrick#1446): `''`
+     * when the alias's own type does not resolve, member paths otherwise, in the
+     * deep walk's notation, sorted by path. The compiler prints the placeholder
+     * as the name it could not follow, so the text reads like a type while every
+     * reader of the tree reads `any` there.
+     *
+     * Read on the self-check program, where the producer's installed packages
+     * resolve, so a name only a missing install leaves unresolved is listed only
+     * on a bare checkout. A literal anchor demoted because its text names a
+     * module the emit skipped is listed at its root: that text is what the
+     * index serves for it, and it names a module the tree does not hold.
+     *
+     * Kept apart from `any_provenance` on purpose: the check phase pre-gates
+     * on `any_provenance[0]`, and this list is what the index tells a reader,
+     * not a verdict. The scanner joins it onto the manifest entry beside the
+     * entry's other provenance. Absent when every position resolves.
+     */
+    unresolved_in_tree?: TypeProvenance[];
 }
 /** Aggregate fidelity metric, emitted per capture (one service). */
 export interface CaptureFidelity {
@@ -295,7 +315,8 @@ export interface CaptureStubOptions {
     /**
      * The scanned repo's root, the upper bound of the search for a tsconfig
      * above `repoRoot` when none is named (carrick#1776). Without it only
-     * `repoRoot` is searched.
+     * `repoRoot` is searched. It is a protected tree as well: `outDir` may
+     * lie inside it only beneath a `.carrick` directory (carrick#1768).
      */
     scanRoot?: string;
 }
@@ -431,8 +452,6 @@ export interface CheckResult {
      * missing (soundness over availability — pinned design, Check step 2). */
     isolation: 'pnpm' | 'unavailable';
     install_ok: boolean;
-    /** Scrubbed install-failure summary when install_ok is false. */
-    install_error?: string;
     ts_version: string;
     /** Verdicts, sorted by pair_id for byte-stable output. */
     verdicts: CheckVerdict[];

package/sidecar/dist/src/capture/check-classify.d.ts

@@ -12,6 +12,7 @@
  *   IsUnknown/IsNever gate fired (TS2344) -> unverifiable
  *   IsVoid gate fired (TS2344)            -> unverifiable (no body read)
  *   IsFormBody gate fired (TS2344)        -> unverifiable (form-encoded body)
+ *   IsByteBody gate fired (TS2344)        -> unverifiable (bytes, even agreeing)
  *   assignment-class error                -> incompatible
  *   no diagnostics                        -> compatible     [lowest precedence]
  *

package/sidecar/dist/src/capture/check-classify.js

@@ -12,6 +12,7 @@
  *   IsUnknown/IsNever gate fired (TS2344) -> unverifiable
  *   IsVoid gate fired (TS2344)            -> unverifiable (no body read)
  *   IsFormBody gate fired (TS2344)        -> unverifiable (form-encoded body)
+ *   IsByteBody gate fired (TS2344)        -> unverifiable (bytes, even agreeing)
  *   assignment-class error                -> incompatible
  *   no diagnostics                        -> compatible     [lowest precedence]
  *
@@ -172,19 +173,18 @@ export function classifyPair(input) {
         };
     }
     // 4c. A body of bytes (carrick#1793): a blob, a buffer or a stream has no JSON
-    //     shape, so a MISMATCH between the containers two sides hold the bytes
-    //     in (a `Uint8Array` sent, read with `.blob()`) is not a drift. It
-    //     overrides a mismatch only: bytes that assign to bytes (a stream sent
-    //     where a stream is read) agree, and that verdict stands. When both
-    //     sides are bytes the sent side is named, whatever order the
-    //     diagnostics came in.
+    //     shape, and the check cannot read a file's content. So a pair with
+    //     bytes on either side states no contract, whether the two sides
+    //     mismatch (a `Uint8Array` sent, read with `.blob()`) or agree (a stream
+    //     sent where a stream is read, carrick#1812). When both sides are bytes
+    //     the sent side is named, whatever order the diagnostics came in.
     const firedGates = new Set(gateDiags.map((d) => plan.gateLines.get(d.line)));
     const bytesGate = firedGates.has('sent:bytes')
         ? 'sent:bytes'
         : firedGates.has('expected:bytes')
             ? 'expected:bytes'
             : undefined;
-    const bytesVerdict = () => {
+    if (bytesGate) {
         const { side } = sideForGate(bytesGate, plan);
         return {
             ...base,
@@ -193,7 +193,7 @@ export function classifyPair(input) {
             diagnostic: `the ${side} body is bytes (a blob, a buffer or a stream), which has no JSON shape to compare with the other side.`,
             ...notAFact(`the ${side} body is bytes`, side),
         };
-    };
+    }
     // 5. Assignment-class error on the DECISIVE assignment line -> incompatible.
     //
     // On an `http` pair that line is the JSON wire assignment, not the declared
@@ -206,8 +206,6 @@ export function classifyPair(input) {
     const decisiveLine = decisiveAssignmentLine(plan);
     const assignDiag = probeDiags.find((d) => d.line === decisiveLine && ASSIGNMENT_CODES.has(d.code));
     if (assignDiag) {
-        if (bytesGate)
-            return bytesVerdict();
         const text = scrubDiagnostic(assignDiag.message, scrubCtx, plan.sentEndpoint.alias, plan.expectedEndpoint.alias);
         return {
             ...base,
@@ -243,8 +241,6 @@ export function classifyPair(input) {
     if (wireOther) {
         const declaredMismatch = probeDiags.find((d) => d.line === plan.assignmentLine && ASSIGNMENT_CODES.has(d.code));
         if (declaredMismatch) {
-            if (bytesGate)
-                return bytesVerdict();
             return {
                 ...base,
                 bucket: 'incompatible',

package/sidecar/dist/src/capture/check-fields.js

@@ -29,6 +29,7 @@
  * Seam: node builtins + `typescript` + this bundle only.
  */
 import ts from 'typescript';
+import { memberPath } from './member-name.js';
 /**
  * Cap on named fields. A mismatch with more differing members than this is
  * better described as two unrelated shapes than as a list, and the text says
@@ -172,7 +173,7 @@ function walk(sent, expected, path, depth, ctx) {
      * makes a sender-only member worth naming beside it. */
     let absent = 0;
     for (const [name, expectedProp] of expectedProps) {
-        const at = join(path, name);
+        const at = memberPath(path, expectedProp, checker);
         const sentProp = sentProps.get(name);
         const supplied = ctx.serverSupplied.has(name);
         if (!sentProp) {
@@ -226,15 +227,12 @@ function walk(sent, expected, path, depth, ctx) {
     // producer returns — nothing is absent and nothing is named.
     if (absent === 0)
         return;
-    for (const [name] of sentProps) {
+    for (const [name, sentProp] of sentProps) {
         if (expectedProps.has(name))
             continue;
-        ctx.found.push({ path: join(path, name), nature: 'extra_in_sent' });
+        ctx.found.push({ path: memberPath(path, sentProp, checker), nature: 'extra_in_sent' });
     }
 }
-function join(path, name) {
-    return path === '' ? name : `${path}.${name}`;
-}
 function isOptional(symbol) {
     return (symbol.flags & ts.SymbolFlags.Optional) !== 0;
 }

package/sidecar/dist/src/capture/check-probe.js

@@ -155,8 +155,8 @@ export function buildProbe(spec, packageOf) {
     // them in, so a route sending a `Uint8Array` read with `.blob()` is not a
     // mismatch, and neither is the same route read as text. Either side, either
     // half: a file upload states no fields a declared body could be compared
-    // with. The classifier lets this gate override a mismatch only, so bytes
-    // that assign to bytes still read compatible. `null`/`undefined` are
+    // with. Bytes that assign to bytes are not a contract either: the check
+    // cannot read a file's content (carrick#1812). `null`/`undefined` are
     // dropped first, so `Blob | null` still gates, while a bare `null`,
     // `undefined` or `never` leaves nothing to test.
     if (spec.protocol === 'http') {
@@ -182,6 +182,12 @@ export function buildProbe(spec, packageOf) {
         //     or several (ambiguous envelope, or a bare payload whose own fields
         //     include more than one object-shaped property) keep the whole type —
         //     the unwrap never fires on anything but an unambiguous envelope;
+        //   - a consumer that names a field only the outer object has (not the
+        //     payload under its one object-shaped property) reads that object, so
+        //     it keeps the whole type (carrick#1764): a bare payload with one
+        //     object-shaped property is not an envelope around it. A field both
+        //     declare says nothing either way, and neither does `__typename`, which
+        //     the server puts on every object (see below);
         //   - `GqlObjLike` can never select `any`/`unknown`/`never` (top/bottom
         //     types fail both its array and its object arm), and the comparand is
         //     re-gated below anyway — the v2 port of v1's comparand re-guard, so
@@ -191,6 +197,10 @@ export function buildProbe(spec, packageOf) {
         push(`type GqlPayloadKeys<T> = { [K in keyof T]-?: [GqlObjLike<T[K]>] extends [true] ? K : never }[keyof T];`);
         push(`type GqlSingleKey<K> = [K] extends [never] ? never : ([GqlIsUnion<K>] extends [false] ? K : never);`);
         push(`type GqlPayloadOf<S> = [S] extends [readonly unknown[]] ? never : [GqlIsUnion<S>] extends [true] ? never : [S] extends [object] ? ([GqlSingleKey<GqlPayloadKeys<S>>] extends [never] ? never : S[GqlSingleKey<GqlPayloadKeys<S>> & keyof S]) : never;`);
+        // The field names a reading declares: the keys of every object member, so
+        // a nullable or union consumer names what each member names.
+        push(`type GqlNames<T> = T extends object ? keyof T : never;`);
+        push(`type GqlReadsOuter<S, E> = [Extract<Exclude<GqlNames<S>, GqlNames<GqlPayloadOf<S>>>, Exclude<GqlNames<E>, '__typename'>>] extends [never] ? false : true;`);
         // carrick#1759: the server supplies `__typename` on every object a
         // selection asks for, so the consumer's `__typename` is read as OPTIONAL,
         // at any depth. It keeps its declared type: a producer that states a
@@ -208,14 +218,14 @@ export function buildProbe(spec, packageOf) {
         //     nothing observable, so a consumer with no `__typename` to relax is
         //     judged, and named in the headline, exactly as before.
         //
-        // The envelope short-circuit below tests the RELAXED consumer: a bare
-        // payload with one object-shaped property would otherwise fail it on
-        // `__typename` alone and unwrap onto that property.
+        // The envelope short-circuit below tests the RELAXED consumer: a consumer
+        // that names only fields the payload shares would otherwise fail it on
+        // `__typename` alone and unwrap onto that payload.
         push(`type GqlDepth = [never, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15];`);
         push(`type GqlTypenameParts<T, D extends number> = { [K in keyof T as K extends '__typename' ? never : K]: GqlTypenameOptional<T[K], GqlDepth[D]> } & { [K in keyof T as K extends '__typename' ? K : never]?: T[K] };`);
         push(`type GqlTypenameOptional<T, D extends number = 16> = [D] extends [never] ? T : T extends (...args: any[]) => any ? T : T extends object ? ('__typename' extends keyof T ? { [K in keyof GqlTypenameParts<T, D>]: GqlTypenameParts<T, D>[K] } : { [K in keyof T]: GqlTypenameOptional<T[K], GqlDepth[D]> }) : T;`);
         push(`type GqlExpected = [GqlTypenameOptional<Expected>] extends [Expected] ? Expected : GqlTypenameOptional<Expected>;`);
-        push(`type GqlComparand = [Sent] extends [GqlExpected] ? Sent : ([GqlPayloadOf<Sent>] extends [never] ? Sent : GqlPayloadOf<Sent>);`);
+        push(`type GqlComparand = [Sent] extends [GqlExpected] ? Sent : ([GqlPayloadOf<Sent>] extends [never] ? Sent : [GqlReadsOuter<Sent, Expected>] extends [true] ? Sent : GqlPayloadOf<Sent>);`);
         gateLines.set(push(`type _G_comparand_any = Assert<Not<IsAny<GqlComparand>>>;`), 'sent:any');
         gateLines.set(push(`type _G_comparand_unknown = Assert<Not<IsUnknown<GqlComparand>>>;`), 'sent:unknown');
         gateLines.set(push(`type _G_comparand_never = Assert<Not<IsNever<GqlComparand>>>;`), 'sent:never');

package/sidecar/dist/src/capture/check-scrub.d.ts

@@ -16,6 +16,9 @@
 export interface ScrubContext {
     /** Absolute path of the scratch workspace root (fully removed from output). */
     workspaceRoot: string;
+    /** The same root with symlinks resolved, as a tool that prints real paths
+     * names it (pnpm, under a macOS temp dir). Absent when there is no tree. */
+    workspaceRealRoot?: string;
     /** Workspace package dir (== sanitized service) -> the @carrick/<dir> label. */
     packageLabelOf: (packageDir: string) => string | undefined;
 }

package/sidecar/dist/src/capture/check-scrub.js

@@ -46,10 +46,14 @@ export function scrubPaths(text, ctx) {
     let out = text.replace(IMPORT_PATH_RE, (_m, p1) => {
         return `import("${labelForImportPath(p1, ctx)}")`;
     });
-    // Defensive: no raw temp path may survive anywhere in the message.
-    if (ctx.workspaceRoot) {
-        out = out.split(ctx.workspaceRoot).join('');
-        out = out.split(ctx.workspaceRoot.split('/').join('\\')).join('');
+    // Defensive: no raw temp path may survive anywhere in the message. The real
+    // root goes first: the given root can be its suffix (`/private/var/...`
+    // against `/var/...`), and stripping that first would strand the prefix.
+    for (const root of [ctx.workspaceRealRoot, ctx.workspaceRoot]) {
+        if (!root)
+            continue;
+        out = out.split(root).join('');
+        out = out.split(root.split('/').join('\\')).join('');
     }
     return out;
 }

package/sidecar/dist/src/capture/check.js

@@ -103,15 +103,18 @@ export async function runCheck(opts, onProgress) {
     // to a flat npm install that manufactures nominal false-incompatibles. Fail
     // explicitly instead (design Check step 2).
     if (!fs.existsSync(pnpmPath)) {
-        const planned = planPairs(opts, (s) => `@carrick/${s}`);
+        // Capture-decay verdicts stand without isolation too (carrick#1833).
+        const { preGated, probing } = preGate(planPairs(opts, (s) => `@carrick/${s}`), readStubAliasRecords(opts.stubs));
         return {
             success: false,
             workspace_dir: '',
             isolation: 'unavailable',
             install_ok: false,
-            install_error: 'vendored pnpm not found; type isolation is unavailable',
             ts_version: tsVersion,
-            verdicts: sortVerdicts(unverifiableAll(planned, 'isolation:unavailable', 'type isolation unavailable (pnpm missing); compatibility cannot be verified.')),
+            verdicts: sortVerdicts([
+                ...unverifiableAll(probing, 'isolation:unavailable', 'type isolation unavailable (pnpm missing); compatibility cannot be verified.'),
+                ...preGated,
+            ]),
             degraded_services: opts.stubs.map((s) => ({
                 service_name: s.service_name,
                 reason: 'isolation unavailable',
@@ -126,6 +129,7 @@ export async function runCheck(opts, onProgress) {
     });
     const scrubCtx = {
         workspaceRoot: ws.workspaceDir,
+        workspaceRealRoot: fs.realpathSync(ws.workspaceDir),
         packageLabelOf: ws.packageLabelOf,
     };
     // Generate probes. A pair naming a service with no stub is unverifiable.
@@ -154,61 +158,25 @@ export async function runCheck(opts, onProgress) {
         const spec = opts.pairs.find((p) => p.pair_key === v.pair_key);
         v.pair_id = fnvOfSpec(spec);
     }
-    // Capture-time deep-decay pre-gate (adversarial-review finding 1): a
-    // member-level `any`/`unknown` recorded by the capture self-check with no
-    // failing-external explanation. The probe gates below are WHOLE-type only
-    // — `{ orderId: string; metadata: any }` sails through IsAny and the
-    // assignment compiles clean — so such pairs must never reach a probe.
-    // `any` routes to gate_caught_baked_any, `unknown` to unverifiable; both
-    // read as None downstream, never compatible.
-    const aliasRecords = readStubAliasRecords(opts.stubs);
-    const preGated = [];
-    const probing = [];
-    for (const plan of plans) {
-        const hit = deepDecayOf(plan, aliasRecords);
-        if (!hit) {
-            probing.push(plan);
-            continue;
-        }
-        preGated.push({
-            pair_id: plan.pairId,
-            pair_key: plan.spec.pair_key,
-            // `any` is a confirmed baked top type -> gate_caught_baked_any; `unknown`
-            // and `budget_exhausted` (a subtree the capture walk could not finish)
-            // are "cannot verify" -> unverifiable. All read as None downstream.
-            bucket: hit.kind === 'any' ? 'gate_caught_baked_any' : 'unverifiable',
-            gate: `capture:${hit.side}:${hit.kind}`,
-            diagnostic: hit.kind === 'budget_exhausted'
-                ? `the ${hit.side} type is too deep or wide to verify within the ` +
-                    `capture budget (at '${hit.path}'); compatibility cannot be ` +
-                    `verified — abstaining so a buried 'any' can never read compatible.`
-                : `the ${hit.side} type carries '${hit.kind}' at '${hit.path}' from ` +
-                    `capture; compatibility cannot be verified (a partially-unresolved ` +
-                    `type would let an arbitrary shape read compatible).`,
-            codes: [],
-            resolved: false,
-            unresolved_side: hit.side,
-            unresolved_reason: hit.kind === 'budget_exhausted'
-                ? `the ${hit.side} type is too deep or wide to verify at '${hit.path}'`
-                : `the ${hit.side} type carries '${hit.kind}' at '${hit.path}'`,
-            notes: [],
-        });
-    }
+    const { preGated, probing } = preGate(plans, readStubAliasRecords(opts.stubs));
     writeProbes(ws, probing);
     const errors = [];
     const degraded = [];
     // ---- Install (async, off the event loop) --------------------------------
     progress('installing', 'installing pinned dependencies');
     const install = await runProcess(pnpmPath, ['install'], ws.workspaceDir);
-    const installOk = install.code === 0;
-    let installError;
-    if (!installOk) {
-        installError = scrubPaths((install.stderr || install.stdout).trim().slice(0, 2000), scrubCtx);
+    if (install.code !== 0) {
+        const installError = scrubPaths((install.stderr || install.stdout).trim().slice(0, 2000), scrubCtx);
+        // `errors` says why the run failed (carrick#1821); each pair the install
+        // stopped says it too, because the client reads every pair's own verdict
+        // on a failed check (carrick#1833).
+        errors.push(`workspace dependency install failed${installError ? `: ${installError}` : ''}`);
         for (const s of opts.stubs) {
             degraded.push({ service_name: s.service_name, reason: 'workspace install failed' });
         }
         const verdicts = sortVerdicts([
-            ...unverifiableAll(probing, 'install:failed', 'workspace dependency install failed; compatibility cannot be verified.'),
+            ...unverifiableAll(probing, 'install:failed', 'workspace dependency install failed; compatibility cannot be verified.' +
+                (installError ? ` Installer output: ${installError}` : '')),
             // Capture-decay verdicts stand regardless of the install outcome.
             ...preGated,
             ...unresolved,
@@ -220,7 +188,6 @@ export async function runCheck(opts, onProgress) {
             workspace_dir: cleanup ? '' : ws.workspaceDir,
             isolation: 'pnpm',
             install_ok: false,
-            install_error: installError,
             ts_version: tsVersion,
             verdicts,
             degraded_services: degraded,
@@ -249,7 +216,9 @@ export async function runCheck(opts, onProgress) {
             });
         }
         const verdicts = sortVerdicts([
-            ...unverifiableAll(probing, 'tsc:abnormal-termination', 'the type checker terminated abnormally; compatibility cannot be verified.'),
+            ...unverifiableAll(probing, 'tsc:abnormal-termination', `the type checker terminated abnormally (exit code ${tsc.code ?? 'null'}); ` +
+                'compatibility cannot be verified.' +
+                (excerpt ? ` Compiler output: ${excerpt}` : '')),
             ...preGated,
             ...unresolved,
         ]);
@@ -341,6 +310,51 @@ function readStubAliasRecords(stubs) {
     }
     return byService;
 }
+/**
+ * Capture-time deep-decay pre-gate (adversarial-review finding 1): a
+ * member-level `any`/`unknown` recorded by the capture self-check with no
+ * failing-external explanation. The probe gates are WHOLE-type only —
+ * `{ orderId: string; metadata: any }` sails through IsAny and the assignment
+ * compiles clean — so such pairs must never reach a probe. `any` routes to
+ * gate_caught_baked_any, `unknown` to unverifiable; both read as None
+ * downstream, never compatible. These verdicts come from the capture alone,
+ * so they stand whatever the install or the compiler then does (carrick#1833).
+ */
+function preGate(plans, aliasRecords) {
+    const preGated = [];
+    const probing = [];
+    for (const plan of plans) {
+        const hit = deepDecayOf(plan, aliasRecords);
+        if (!hit) {
+            probing.push(plan);
+            continue;
+        }
+        preGated.push({
+            pair_id: plan.pairId,
+            pair_key: plan.spec.pair_key,
+            // `any` is a confirmed baked top type -> gate_caught_baked_any; `unknown`
+            // and `budget_exhausted` (a subtree the capture walk could not finish)
+            // are "cannot verify" -> unverifiable. All read as None downstream.
+            bucket: hit.kind === 'any' ? 'gate_caught_baked_any' : 'unverifiable',
+            gate: `capture:${hit.side}:${hit.kind}`,
+            diagnostic: hit.kind === 'budget_exhausted'
+                ? `the ${hit.side} type is too deep or wide to verify within the ` +
+                    `capture budget (at '${hit.path}'); compatibility cannot be ` +
+                    `verified — abstaining so a buried 'any' can never read compatible.`
+                : `the ${hit.side} type carries '${hit.kind}' at '${hit.path}' from ` +
+                    `capture; compatibility cannot be verified (a partially-unresolved ` +
+                    `type would let an arbitrary shape read compatible).`,
+            codes: [],
+            resolved: false,
+            unresolved_side: hit.side,
+            unresolved_reason: hit.kind === 'budget_exhausted'
+                ? `the ${hit.side} type is too deep or wide to verify at '${hit.path}'`
+                : `the ${hit.side} type carries '${hit.kind}' at '${hit.path}'`,
+            notes: [],
+        });
+    }
+    return { preGated, probing };
+}
 /** First side (producer, then consumer) whose capture recorded a deep decay. */
 function deepDecayOf(plan, aliasRecords) {
     for (const side of ['producer', 'consumer']) {

package/sidecar/dist/src/capture/deep-walk.d.ts

@@ -63,6 +63,9 @@ export declare function findDisqualifyingTopTypes(root: ts.Type, program: ts.Pro
  * names. A walk that runs out of budget reports what it found before it did.
  */
 export declare function findUnresolvedPlaceholders(root: ts.Type, program: ts.Program, checker: ts.TypeChecker, location: ts.Node): string[];
+/** TypeScript's unresolved-reference placeholder: `TypeFlags.Any` with the
+ * internal `intrinsicName === 'error'` (stable since TS 1.x; see `anchors.ts`). */
+export declare function isErrorPlaceholder(t: ts.Type): boolean;
 /** What an anchor's SOURCE program could not resolve (carrick#1164). */
 export interface UnresolvedAtAnchor {
     /** Member paths holding the unresolved-reference placeholder. */
@@ -87,3 +90,20 @@ export interface UnresolvedAtAnchor {
  * one other cause the walk itself can distinguish is its own budget.
  */
 export declare function provenanceOf(finding: DeepTopType, unresolved?: UnresolvedAtAnchor): TypeProvenance;
+/**
+ * The entry for one position at which the emitted tree holds the
+ * unresolved-reference placeholder (carrick#1446): `path` is `''` for the
+ * alias's own type. `names` are the identifiers the self-check could not find
+ * in this alias's statement and the files it reaches.
+ *
+ * The cause is `unresolved_import`, the word a reader already has for "a
+ * reference here did not resolve"; the detail says where it failed to.
+ */
+export declare function unresolvedInTreeProvenance(path: string, names: readonly string[]): TypeProvenance;
+/**
+ * The root entry for a literal anchor demoted because its text names a module
+ * whose declaration emit was skipped (carrick#1446, carrick#1165): that text is
+ * what the index serves for it, and nothing in the emitted tree declares what
+ * it imports.
+ */
+export declare function unemittedModuleProvenance(): TypeProvenance;