semantifold 0.8.0 → 0.10.0

package/docs/project-build-cli.md

@@ -0,0 +1,147 @@
+# Project manifest and one-shot build CLI
+
+Task 039 adds a strict filesystem boundary above the existing `parseProgram`, `generateProgramArtifactSet`, and `GeneratedArtifactPublisher` APIs. Tasks 040–042 compose the registered developer-check boundary without moving target behavior into the CLI. A build reads one explicit source graph, parses and links it once, generates every ordered target from that semantic program, and makes the complete immutable generation active with one pointer replacement. Ordinary `build` remains generation-only; `build --check` invokes only target-owned non-executing plans. Neither mode executes generated code.
+
+## `semantifold.json` version 1
+
+The manifest is closed JSON: every object rejects unknown fields. The project file's containing directory is the project root.
+
+```json
+{
+  "schema": "SemantifoldProject",
+  "version": 1,
+  "id": "jsdoc-java-example",
+  "publicationRoot": ".semantifold",
+  "sources": [
+    {
+      "id": "main",
+      "path": "src/main.js",
+      "language": "javascript",
+      "entry": true
+    }
+  ],
+  "targets": [
+    {
+      "id": "java-main",
+      "language": "java",
+      "role": "text",
+      "sourceProjection": "targets/java/source",
+      "buildProjection": "targets/java/build"
+    }
+  ]
+}
+```
+
+Root fields are:
+
+- `schema`: exactly `SemantifoldProject`.
+- `version`: exactly `1`.
+- `id`: a stable lowercase project ID matching `[a-z][a-z0-9-]*`.
+- `publicationRoot`: one canonical project-relative portable path owned by the publisher.
+- `sources`: a non-empty ordered array of explicit modules.
+- `targets`: a non-empty ordered array of explicit generated targets.
+
+Each source has exactly `id`, `path`, `language`, and Boolean `entry`. Module IDs are stable logical Task-010 identities. Paths are project-relative source paths; languages are explicit registered frontends that participate in the complete-program profile. All modules use one source-language compatibility profile, paths and IDs are unique, and exactly one module has `entry: true`. Extensions never select a language.
+
+Each target has exactly `id`, `language`, `role`, `sourceProjection`, and optional `buildProjection`. The role is `text`, `binary`, or `application` and must match both the language registry and an implemented complete-program backend. The existing original-five text program backends are supported. A registered single-module target is not automatically a project target; complete-program binary generation is not implemented. Android and Flutter application backends may participate through their default, asset-free requests. iOS requires caller-supplied application identity and deployment configuration that version 1 cannot express, so an iOS application target fails at manifest loading with `UNSUPPORTED_PROJECT_TARGET`; direct public iOS generation with explicit configuration remains supported. This does not define Task 046 watch/check policy.
+
+`sourceProjection` is required. `buildProjection` owns checker/compiler output and defaults to `targets/<target-id>/build`. Both are logical paths inside one immutable generation, never separately promoted output roots. A generation-only build leaves the build projection empty. PHP, Ruby, JavaScript, TypeScript, Rust, Dart, and Zig developer checks leave it empty; Dart 3.13.3 embeds the candidate's absolute source URI, while Zig Debug output retains its absolute project root, so those real native check outputs are removed. Java and Kotlin record class files, Python records its explicit checked-hash `.pyc`, C# records only final `bin/`, and Go/C/C++/Swift record their linked or compiled developer executable after transient restore/intermediate/cache/home/object/target state is removed.
+
+Version 1 has no globs, extension inference, package resolution, environment expansion, configuration callbacks, plugins, shell hooks, commands, target-specific compiler settings, or independent output roots.
+
+## Paths and ownership
+
+Manifest paths use `/`, contain no empty, dot, or dot-dot segment, and are neither absolute nor drive-qualified. Source paths may use valid Unicode scalar filenames, including spaces; their duplicate, prefix, and Unicode case-fold comparisons remain in that source-path domain. Publication and projection paths separately retain the portable ASCII artifact alphabet. Portable source aliases, duplicate module/target IDs, hard-linked source aliases, and colliding or nested projections are rejected.
+
+The manifest, every source, and every existing publication-root component must be real nonsymlink paths under the canonical project root. The publication root cannot contain a source or be a source. Source files may live directly in the project root because the publisher protects their exact paths rather than treating the entire parent directory as source-owned. `GeneratedArtifactPublisher` rechecks source/publication separation and symlink ownership before publication.
+
+The publisher owns only:
+
+```text
+<publicationRoot>/
+  active-generation.json
+  generations/<generation-id>/
+    manifest.json
+    <target source projection>/...
+    <target build projection>/...
+```
+
+Readers resolve `active-generation.json` once and retain the returned immutable generation paths for the whole read. They must not combine paths resolved from separate pointer reads.
+
+## Snapshot and build semantics
+
+`ProjectSnapshotBuilder` reads the exact manifest and all declared source files in manifest order. Descriptor identity, size, modification state, real paths, and exact bytes are checked, and the complete graph is read twice. One inconsistent graph receives one bounded retry. Continued mutation fails with a project-relative `UNSTABLE_PROJECT_SNAPSHOT`; a changed manifest is never combined with the already-validated project value.
+
+The SHA-256 snapshot hash is length-framed over the exact manifest bytes and ordered source IDs, paths, languages, and UTF-8 content. Absolute host paths and wall-clock values are absent. The generation-only ID is `g-<snapshot-hash>`. Each checked invocation uses `g-<snapshot-hash>-checked-<uuid>` for its fresh candidate, so generation-only and compiler-bearing manifests never alias and compiler output produced by one validation run is never mistaken for a later run.
+
+`ProjectBuilder` parses and links the frozen sources once. It generates targets in manifest order through the existing program backend dispatch. With `check: true`, each target must advertise an immutable developer-check capability. The builder discovers exactly that capability's toolchains and attaches a publisher validator; the validator constructs the target-owned plan only after generated artifacts exist in the candidate source subtree. The generic `TargetCheckRunner` validates the complete plan before spawning, owns timeout/cancellation and bounded output, and settles on child `close`. The builder propagates the same cancellation authority through publication, where it is rechecked immediately before the atomic pointer replacement. Only after every target succeeds and cancellation remains inactive does the publisher replace `active-generation.json` once. A configuration, read, parse, link, semantic, generation, discovery, plan, check, cancellation, or pre-pointer publication failure leaves the prior active generation authoritative.
+
+Java's target-owned plan declares only stage `compile` and toolchain `javac`, even though full acceptance metadata also declares later `java` execution. It passes `-d <candidate-build-root>` followed by every staged `.java` artifact. Task 041 adds target-owned PHP `-n -l`, Ruby `--disable=gems -c`, Node `--check`, TypeScript no-emit, Kotlin/JVM class compilation, isolated checked-hash Python bytecode, and offline-isolated C# restore/build plans. Task 042 adds target-owned Go build/vet, strict C/C++ compile/link, Cargo locked/offline build/check, Swift type-check/compile, Dart offline lock verification/compile/format/analyze, and Zig build/format plans. The generic plan declares every staged input, every argv/environment path owner, optional restore-input SHA-256, nullable output ownership, and candidate source/build transient directories that the runner removes only after children close. It publishes the last declared compiler/linker output even when a later non-producing validator succeeds. No generic builder, runner, reporter, CLI, or watcher branch switches on a language ID.
+
+The version-1 project manifest continues to support complete-program text generation only for PHP, Ruby, JavaScript, TypeScript, and Java. Consequently `build --check` can select all five original-language targets immediately; the Task 041–042 Kotlin/Python/C#/Go/C/C++/Rust/Swift/Dart/Zig plans are public and use the same runner for existing generated single-module artifact sets, but do not expand semantic program generation. C# accepts only the exact producer-owned `Semantifold.csproj`, disables ancestor directory-build imports through global properties at restore and compile, and supplies the complete sorted `.cs` set through the manifest's closed compile-item property. Its restore declares a length-framed hash of ordered project/lock content, uses only the staged source root as its package source, and writes packages, HTTP cache, CLI home, user home, temp, and MSBuild intermediates under the candidate build root. Those transient paths are deleted after compile or failure. Dart similarly accepts only its exact dependency-free package/lock, length-frames that restore identity, and removes `.dart_tool`, isolated pub state, and its native check output before publication. Zig removes its root-dependent Debug prefix with the same post-close transient cleanup. An unchanged watch reconciliation admits no cycle, so it cannot perform a restore.
+
+Rebuilding identical generation-only inputs uses the same exact candidate comparison as retained-generation reactivation. If the same deterministic generation is retained but another generation is active, the publisher requires its canonical manifest bytes to equal the validator-free candidate exactly and revalidates the complete inventory, hashes, provenance, symlink boundaries, and hard-link identities before one atomic pointer replacement reactivates it. Task 038 intentionally forbids reactivation requests that carry validators, so a retained same-ID candidate with validators fails with `PUBLICATION_UNOWNED_CONFLICT` instead of trusting previously produced compiler output. Checked builds therefore submit a fresh immutable identity on every invocation and actually rerun every target check, including unchanged and reverted snapshots. A mismatched or malformed retained generation is neither overwritten nor removed, and the previous pointer remains authoritative.
+
+## Command and output
+
+The public package installs one executable:
+
+```sh
+semantifold build
+semantifold build --check
+semantifold build --project path/to/semantifold.json
+semantifold build --project path/to/semantifold.json --check --ndjson
+```
+
+The default is `./semantifold.json`. `build`, `--project <path>`, `--check`, and `--ndjson` are the complete grammar. Options may appear once. Unknown commands/options, missing option values, duplicate options, and positional extras fail with `INVALID_CLI_ARGUMENTS`. The executable passes argument arrays directly to the importable CLI; it does not spawn a shell.
+
+Human mode prints one concise success line only after the active pointer names the committed generation. Failures retain the outer build/publication diagnostic and render each nested Semantifold cause. A check-process failure then prints labeled project/target, tool, stage, exit/signal, duration, and bounded stdout/stderr evidence without repeating its cause line; tool discovery failures instead retain actionable missing, ambiguous, executable, and version details from their nested diagnostics. SIGINT or SIGTERM after a checker closes but before pointer replacement produces one failure terminal record, never a success record. Exit status is `0` only for a committed generation and `1` for the first failure.
+
+`--ndjson` writes one `SemantifoldBuildEvent` version-1 JSON object per line. Every record has `cycle: 1`, `project`, and `state`. Successful builds emit these deterministic states in order:
+
+```json
+{"cycle":1,"project":"jsdoc-java-example","schema":"SemantifoldBuildEvent","version":1,"state":"project-loaded"}
+{"cycle":1,"project":"jsdoc-java-example","schema":"SemantifoldBuildEvent","version":1,"snapshotHash":"<sha256>","state":"snapshot-loaded"}
+{"cycle":1,"project":"jsdoc-java-example","schema":"SemantifoldBuildEvent","version":1,"artifactCount":1,"language":"java","role":"text","state":"target-generated","target":"java-main"}
+{"cycle":1,"project":"jsdoc-java-example","schema":"SemantifoldBuildEvent","version":1,"exitCode":0,"generationId":"g-<sha256>","snapshotHash":"<sha256>","state":"succeeded","targets":[{"artifactCount":1,"id":"java-main","language":"java","role":"text"}],"terminal":true}
+```
+
+There is exactly one record with `terminal: true`. Failure records use `state: "failed"`, `exitCode: 1`, and a stable structured diagnostic. Generation-only records remain deterministic; checked-stage records add the observed lifecycle duration required for process reporting.
+
+Checked builds insert one `target-checked` record per successful stage after `target-generated`. It contains the exact `argv`, target and language, stage, canonical tool ID/command/executable/source/version, exit code or signal, bounded stdout/stderr, and duration. The terminal record includes `checked: true`. Check failures retain the outer publication context and a nested compiler diagnostic rather than flattening away stage/tool/process evidence.
+
+## JavaScript/JSDoc to Java example
+
+Create `src/main.js`:
+
+```js
+/**
+ * @param {number} left
+ * @param {number} right
+ * @returns {number}
+ */
+function add(left, right) {
+  return left + right
+}
+
+console.log(add(2, 3))
+```
+
+Copy the manifest above to `semantifold.json`, then run:
+
+```sh
+npx semantifold build
+npx semantifold build --check
+```
+
+Resolve `.semantifold/active-generation.json` once; the checked generation from this manifest contains Java at `targets/java/source/semantifold/generated/main/Main.java` and compiler output at `targets/java/build/semantifold/generated/main/Main.class`. The two paths belong to the same immutable generation and are never promoted separately. Omitting `buildProjection` instead selects `targets/<target-id>/build`.
+
+`build --check` checks or compiles but never runs generated application behavior. Acceptance code may explicitly invoke committed output afterward. Tasks 043–044 compose the same builder through the packed `semantifold watch --check` JavaScript/JSDoc-to-Java workflow; see [deterministic project watch](project-watch.md) and the shipped [`examples/jsdoc-java-watch`](../examples/jsdoc-java-watch/) project. The terminal all-text acceptance matrix remains Task 045. No build or watch mode garbage-collects committed generations or implements hot reload.
+
+## Importable API and diagnostics
+
+`ProjectManifestLoader`, `SemantifoldProject`, `ProjectSnapshotBuilder`, `ProjectSnapshot`, `ProjectBuilder`, `ProjectBuildReporter`, `ProjectWatchCoordinator`, `ProjectWatchReporter`, `SemantifoldCli`, `parseSemantifoldCliArguments`, `createTargetCheckPlan`, and `TargetCheckRunner` are public ESM exports. `languageCapabilities[].check` truthfully exposes immutable `supported`, `stages`, and `toolchains` fields without claiming execution. The executable is only a thin wrapper around `SemantifoldCli`.
+
+Plan and lifecycle failures use `UNSUPPORTED_TARGET_CHECK`, `INVALID_TARGET_CHECK_PLAN`, `TARGET_CHECK_PREPARATION_FAILURE`, `TARGET_CHECK_LAUNCH_FAILURE`, `TARGET_CHECK_OUTPUT_LIMIT`, `TARGET_CHECK_TIMEOUT`, `TARGET_CHECK_CANCELLED`, `TARGET_CHECK_SIGNAL`, `TARGET_CHECK_NONZERO_EXIT`, `TARGET_CHECK_CLEANUP_FAILURE`, and `TARGET_CHECK_OUTPUT_INVALID`. Restore failures retain stage `restore`; compiler failures retain stage `compile`. Discovery retains `TOOL_NOT_FOUND`, `TOOL_AMBIGUOUS`, and version diagnostics. Publisher validation remains the transaction boundary and preserves the check diagnostic as its structured cause.
+
+Manifest/snapshot diagnostics include `INVALID_PROJECT_MANIFEST`, `INVALID_PROJECT_PATH`, `PROJECT_SOURCE_ALIAS`, `PROJECT_SOURCE_PUBLICATION_OVERLAP`, `PROJECT_PROJECTION_COLLISION`, `PROJECT_SYMLINK_TRAVERSAL`, `PROJECT_MANIFEST_READ_FAILED`, `PROJECT_SOURCE_READ_FAILED`, `INVALID_PROJECT_SOURCE_ENCODING`, `UNSUPPORTED_PROJECT_SOURCE`, `UNSUPPORTED_PROJECT_TARGET`, and `UNSTABLE_PROJECT_SNAPSHOT`. Registry, parser, semantic, backend, artifact, and publication diagnostics retain their existing codes and causes. User output uses project-relative locations and does not print unrelated absolute host paths.

package/docs/project-watch.md

@@ -0,0 +1,60 @@
+# Deterministic project watch
+
+Task 043 adds one language-neutral, long-lived coordinator above the existing project snapshot, build/check, and transactional publication contracts. Task 044 proves its first packed checked vertical slice from JavaScript/JSDoc through generated Java and real `javac`. The coordinator accepts filesystem events only as hints, re-reads the complete explicit manifest/source graph, serializes complete cycles, and never executes generated programs.
+
+## Commands
+
+```sh
+semantifold watch
+semantifold watch --project config/semantifold.json
+semantifold watch --check
+semantifold watch --check --ndjson
+```
+
+`watch` accepts the same single `--project`, `--check`, and `--ndjson` options as `build`. Generation-only watch works for every target accepted by the version-1 project manifest. `--check` additionally requires every configured target to advertise a target-owned non-executing developer-check plan. PHP, Ruby, JavaScript, TypeScript, and Java are check-capable among the manifest's existing complete-program text targets; the registry also exposes Kotlin/JVM, Python, and C# plans for their existing generated single-module artifact sets. Neither command runs generated application code.
+
+The coordinator installs `SIGINT` and `SIGTERM` handlers before loading the initial graph and immediately performs cycle 1. Invalid startup configuration or a failed initial build terminates watch with status 1. Once the initial cycle succeeds, an ordinary source, semantic, generation, discovery, check, or pre-commit publication failure emits a failed cycle and keeps watch alive. The next successful candidate is reported as recovered. Clean signal shutdown returns status 0.
+
+## Events, reconciliation, and cycle ownership
+
+The native backend subscribes to every declared source file, the manifest, and their distinct parent directories. Exact parent-event filenames are mapped to declared graph paths, unknown non-publication events conservatively request a complete reconciliation, and writes identified beneath the publisher-owned root are ignored. Parent subscriptions make deletion, recreation, rename, and editor-style atomic replacement observable without relying on recursive Linux watching.
+
+If initial subscription, live watching, or topology resubscription fails, the coordinator closes the complete native subscription set, reports the transition, and switches once to bounded polling. A 1,000 ms reconciliation interval also backs native subscriptions so event loss can be detected. It compares mutation-sensitive state only to decide when to re-read the complete graph and never treats timestamps as build identity; after an invalid graph, the first successful recovery probe preserves one existing quiet timer instead of postponing it on every shorter polling interval. A changed hint starts a 50 ms quiet window. The public `ProjectWatchCoordinator` constructor permits bounded `quietPeriodMs` values from 1 through 10,000 and `pollIntervalMs` values from 1 through 60,000 for embedding and focused tests. The CLI uses the defaults.
+
+After the quiet window, `ProjectManifestLoader` and `ProjectSnapshotBuilder` re-read the complete graph in stable manifest order. The versioned complete content/configuration hash is authoritative. A touch or event burst whose final hash is unchanged does not admit a cycle. Create, change, delete, rename, and replacement hints never select a partial event filename as the compilation input.
+
+Only one cycle and one checker child can be owned at a time. A hint during a cycle sets one dirty marker; it does not terminate a healthy compiler. After every target checker has closed, the builder invokes a complete-snapshot currentness guard at the publisher's pre-pointer boundary. Changed content supersedes and cleans the staged candidate without replacing `active-generation.json`; one immediate follow-up then owns the latest complete state. A hint in the narrow interval after that guard cancels publication before pointer replacement. After a pointer commit, mutation-sensitive state is compared with the pre-cycle polling baseline: a newer state marks the active cycle dirty and is never absorbed as a clean baseline merely because its native event was lost. A committed pointer still selects exactly one immutable generation, and readers continue to resolve it once.
+
+In NDJSON mode, the first hint admitted while a cycle remains active emits nonterminal `state: "cycle-dirty"`. This acknowledges that the coordinator owns one latest-state follow-up; it does not claim that an event filename is a complete input or that its bytes have already been snapshotted. Further hints in the same active cycle collapse into that one dirty generation.
+
+## Failure, reporting, and shutdown
+
+Human output identifies succeeded, failed, recovered, superseded, and cancelled cycles. NDJSON uses `SemantifoldWatchEvent` version 1. State records carry the project, cycle, complete snapshot hash when available, stable changed paths, ordered target/check evidence, and durations. Every admitted cycle emits exactly one record with `terminal: true` and `terminalScope: "cycle"`; shutdown emits exactly one separate watcher terminal with `terminalScope: "watch"`.
+
+Parse or generation failure never starts a checker. Tool/check failure and stale-candidate refusal never switch the active pointer. Failed candidates are removed through the existing publication ownership journal, while all committed generations remain immutable and retention remains an external policy.
+
+On `SIGINT`, `SIGTERM`, or `ProjectWatchCoordinator.stop(reason)`, the coordinator stops admitting cycles, closes every subscription and timer, awaits any in-progress startup read before terminal settlement, aborts the exact active build/check authority, waits for the owned child process group to reach `close`, waits for publisher staging cleanup, emits the watcher terminal once, and resolves. Startup rechecks stop ownership after each asynchronous boundary, so it cannot subscribe, schedule, or report after terminal shutdown. Generated programs are not started, hot-reloaded, or stopped because watch never executes them.
+
+## Importable API and boundaries
+
+`ProjectWatchCoordinator` and `ProjectWatchReporter` are public ESM exports. The coordinator composes `ProjectManifestLoader`, `ProjectSnapshotBuilder`, `ProjectBuilder`, target-owned check plans, and `GeneratedArtifactPublisher`; it contains no language IDs, parser logic, compiler argument construction, or artifact writes.
+
+The coordinator and generic check runner contain no target-language switch. Target-owned modules construct exact PHP, Ruby, Node, TypeScript, Java, Kotlin/JVM, Python, and C# requests; the runner owns their processes and transient candidate state. Native/project text-target plans remain Task 042, their terminal matrix remains Task 045, and binary/application watch policy remains Task 046. Watch adds no globs, ignore language, daemon mode, editor protocol, runtime execution, hot reload, arbitrary hooks, network access, or package installation.
+
+## Copy-ready JavaScript/JSDoc-to-Java watch
+
+The npm package includes [`examples/jsdoc-java-watch`](../examples/jsdoc-java-watch/). Copy that directory outside `node_modules`, enter it, and run:
+
+```sh
+npx semantifold watch --check
+```
+
+The example manifest explicitly selects `src/main.js`, JavaScript, one Java text target, `targets/java/source`, and `targets/java/classes`. Its JSDoc-typed functions cover numeric and Boolean/string control behavior, and `expected-output.txt` records the output used by acceptance. Cycle 1 prints a line of this form only after real `javac` has closed successfully and the pointer has switched:
+
+```text
+Watch cycle 1 succeeded: project 'jsdoc-java-watch' published generation 'g-<snapshot-sha256>-checked-<uuid>'.
+```
+
+An unambiguous supported `javac` must be available on `PATH`, or `SEMANTIFOLD_JAVAC` must name its absolute configured executable. Missing `javac` fails the declared check; watch never silently changes to generation-only operation. Real `java` is not required by watch because watch does not execute generated code. The Task 044 acceptance harness separately discovers real `java`, resolves `active-generation.json` once, verifies the selected manifest/source/class hashes, and executes only that committed class snapshot.
+
+Saving a valid edit produces a later successful generation. Touching the source without changing content reports no cycle. A located JavaScript/JSDoc parse or semantic error never invokes `javac`; a real compiler error at the generic staged check boundary never switches the pointer. Both failures keep a previously successful watcher alive, and the next valid edit reports recovery. Edits admitted during an active check emit `cycle-dirty` in NDJSON, allow the owned child to close, refuse its stale candidate, and run one latest-state follow-up without overlapping compiler processes. `SIGINT` or `SIGTERM` during idle or checking closes subscriptions and the exact checker process before the sole watcher terminal.

package/docs/rust.md

@@ -86,3 +86,7 @@ Tests also execute each built binary directly, distinguish build diagnostics fro
 Focused product specs cover Tasks001–004 round trips, all 18 operations, strings and ownership, branch/order/divergence behavior, both build modes and every overflow, real rustc E0382/E0505 source rejection, native execution at the generated nesting boundary, malformed IR/helper adversaries, deterministic artifacts and rich/V3 forward/reverse mappings around Unicode. Rust fixtures execute in all original-five native targets, and one original-five source per profile executes in Rust in both modes. Task025 owns the expanded-cohort matrix.
 
 The root packed-consumer proof repeats ordinary npm install and clean npm ci with separate fresh caches, empty configuration files, default install-links=false, isolated modern/legacy runtimes, strict TypeScript and native offline Rust in both modes. The local lane still has the complete home mounted: this proves cleaned-environment behavior, not the external source/home/auth-free boundary. Disposable acceptance inputs and exact local evidence are prepared for the coordinator to run across that boundary before delivery. Local testing uses individual focused files sequentially; TensorBuzz owns full/native aggregate acceptance.
+
+## Non-executing developer check
+
+The registered Task 042 plan accepts only the exact producer-owned dependency-free `Cargo.toml`, `Cargo.lock`, and Rust sources. It qualifies both canonical Rustc and Cargo 1.98.1, binds `RUSTC` to the exact discovered compiler even when the tools occupy different directories, and runs `cargo build --offline --locked --target-dir <candidate>` followed by `cargo check --offline --locked --target-dir <candidate>`. CARGO_HOME, HOME, TMPDIR, incremental state, and the target tree are isolated below the candidate build root and removed after both children close, so no dependency, cache lock, or executable is published or run. Debug/release execution remains explicit acceptance coverage.

package/docs/swift.md

@@ -42,3 +42,5 @@ Discovery uses canonical command `/usr/bin/swiftc` after image construction or a
 The Dockerfile selects official image `swift:6.3.3-noble@sha256:56ef1be2c1ca36f4c52440357dc1fcdfdb5e113587134fcadeef57c225c71b54`; its Linux/amd64 child manifest is `sha256:4e0fc24f0f93a5cf9a91bfcf182534bbc0571d70d757389c04ff1f616c1c460f`. A source stage probes the identity and copies only Swift executable/resource paths into the unchanged final `ubuntu:26.04@sha256:3131b4cc82a783df6c9df078f86e01819a13594b865c2cad47bd1bca2b7063bb` stage. It does not copy project source or replace the final `/usr` tree wholesale.
 
 Real acceptance independently materializes each original parser fixture and regenerated `program.swift` in a fresh directory, runs `swiftc -warnings-as-errors -typecheck`, compiles once without optimization and once with `-O`, executes both binaries, checks exact UTF-8 stdout/stderr/status, verifies source bytes are unchanged, and removes the directory. Its deterministic PATH places the resolved compiler directory first, the canonical host-tool directory `/usr/bin` second, and the isolated caller PATH last with first-occurrence deduplication, so archive Swift selects its own compiler companions while Clang can launch the host linker. The rebuilt canonical image passed this exact Swift 6.3.3 x86_64 contract; `spec/swift-native-execution.spec.js` is 6/6.
+
+The registered Task 042 developer plan uses the same explicit driver mode and warnings-as-errors profile for `-typecheck`, then compiles the stable `SemantifoldGenerated` module to a relative object inside a generation-owned transient directory and links generation-owned `semantifold-swift` with the nondeterministic ELF build ID disabled. This avoids the driver's randomized temporary object path entering Swift's module hash, so repeated candidates produce identical executable bytes. The object directory, HOME, XDG cache, and TMPDIR are removed after close. The developer plan never runs the executable; debug and `-O` execution remain explicit acceptance profiles.

package/docs/testing.md

@@ -1,5 +1,39 @@
 # Testing
 
+## Task 044 packed JavaScript/JSDoc-to-Java watch slice
+
+`jsdoc-java-watch-packed-consumer.spec.js` performs the complete Task 044 proof from a real root tarball after ordinary credential-free install and clean `npm ci`, each with default `install-links=false`, an empty user/global npm configuration, a fresh cache, the public registry, full dependency listing, and strict public API typing. One long-lived packed `watch --check --ndjson` process uses an exact-argv test-owned configured compiler boundary that delegates to canonical real `javac`. Event and process markers—not timing sleeps—drive valid edits, no-op touch suppression, a located frontend failure, one controlled invalid staged-Java compiler failure, recovery, dirty-during-check burst supersession, and idle/active signal shutdown. Every successful cycle resolves the active pointer once, verifies manifest and artifact hashes/provenance, and invokes canonical real `java` only from the acceptance harness. Missing `javac`, overlap, leakage, a changed last-good byte, or a missing tool is a failure, never a skip.
+
+Run it as one focused file:
+
+```sh
+npx velocious-test spec/jsdoc-java-watch-packed-consumer.spec.js
+```
+
+## Task 040 target check plans and Java compiler publication
+
+Task 040 uses focused plan, process-lifecycle, real project transaction, CLI, registry/public-API, and packed-consumer specs. `target-check-plan.spec.js` owns immutable capability/plan schema, exact Java argv, target-declared stage/tool validation, generation-only rejection, path ownership, dense immutable arguments/environment, and the developer execution prohibition. `target-check-runner.spec.js` owns launch, non-zero, output-limit, timeout, cancellation, child-signal, late-output, and close-only settlement behavior without timing sleeps. `project-java-check.spec.js` compiles a real two-unit JavaScript/JSDoc → semantic IR → Java project into the generation-scoped build subtree, executes committed classes only in acceptance code, and proves repeated and A→B→A checked builds rerun real `javac`, exact reverted source/class bytes, missing/ambiguous `javac`, invalid Java, pre-pointer failure, exact last-good bytes, cleanup, and recovery. CLI coverage owns strict `--check`, stage/tool/process reporting, nested compiler and tool-discovery diagnostics, the no-execution boundary, and deterministic cancellation after checker close but before pointer replacement with exact last-good source/class preservation. The packed-consumer proof repeats ordinary install and clean `npm ci` with scrubbed credentials/configuration, public declaration use, real package bin/`javac`, committed class resolution, and explicit post-build `java` execution.
+
+Real Java proofs require canonical `javac` and `java`; absence is a failure, never a skip. Run these focused files individually with `npx velocious-test <file>`. Broad discovery and the complete toolchain matrix remain TensorBuzz-owned.
+
+## Task 039 project manifest and one-shot build CLI
+
+Task 039 uses four focused real-filesystem specs plus the public API and nearby publication regression. Manifest coverage owns the closed schema, registered complete-program roles, identities, entry selection, portable paths, source/publication separation, projection collisions, hard-link aliases, and symlink roots. Snapshot coverage owns deterministic ordered hashing and bounded real-file mutation. Build coverage owns one-file JavaScript/JSDoc-to-Java, Task-010 multi-file/multi-target publication, one parse and pointer commit, project-root source ownership, and late-target atomic failure. CLI coverage owns the original generation-only strict arguments, human/NDJSON terminal truth, and exit status. Task 040 extends rather than replaces these proofs.
+
+Run the focused files individually and sequentially:
+
+```sh
+npx velocious-test spec/project-manifest.spec.js
+npx velocious-test spec/project-snapshot.spec.js
+npx velocious-test spec/project-build.spec.js
+npx velocious-test spec/project-cli.spec.js
+npx velocious-test spec/project-cli-packed-consumer.spec.js
+npx velocious-test spec/generated-artifact-publication.spec.js
+npx velocious-test spec/public-api.spec.js
+```
+
+These tests generate and publish source artifacts only. They do not run `javac`, execute generated output, discover packages, or watch files.
+
 ## Task 005 general function signatures and calls
 
 Task 005 stays bounded to PHP, Ruby, JavaScript with JSDoc, TypeScript, and Java. `general-function-signatures-and-calls.spec.js` proves equivalent zero-, one-, and three-parameter signatures, complete signature collection, nested calls, terminating recursion, scalar/void returns, and the stable semantic failures. `general-function-frontend-validation.spec.js` owns the excluded parameter, call, method, receiver, dispatch, annotation, overload, generic, and higher-order source forms. `general-function-backend-validation.spec.js` proves generation/reparse, exact external-IR signature revalidation, target conflicts, the public feature flag, and transactional rejection from every deferred Task 025/Wasm target. `general-function-provenance-and-mapping.spec.js` proves deterministic declaration/resolution identities and exact signature/call mappings. `general-function-runtime-execution.spec.js` invokes real PHP, Ruby, Node, local `tsc` followed by Node, `javac`, and `java`, requiring exact `ready\n6\n` output; a missing command fails.
@@ -346,7 +380,40 @@ Task 017 adds the distinct ordered `restore` stage and configured .NET SDK 10 di
 
 Task 024 adds configured Go 1.26.x discovery restricted to Linux/amd64; the patch release is read from the discovered toolchain rather than fixed by runtime tests. Acceptance obtains `GOROOT` from that exact `go`, requires the companion `gofmt` beside the configured or discovered executable to resolve to the same `GOROOT/bin/gofmt`, and checks `gofmt -d` before native execution. Each dependency-free generated module is run with `GOTOOLCHAIN=local`, `GOPROXY=off`, `GOSUMDB=off`, `GOVCS=off`, `CGO_ENABLED=0`, `GOENV=off`, `GOWORK=off`, `GOOS=linux`, `GOARCH=amd64`, and isolated HOME/GOPATH/build/module caches. The short-lived discovery fixture also writes exact `off` mode into its isolated Go telemetry directory before invoking the tool, then asserts that the mode file is the only telemetry state: Go 1.26 otherwise starts an unawaited uploader sidecar even in default `local` mode, which can recreate `upload/` while the fixture root is being removed. Cleanup errors remain fatal. Stages run offline `go build`, mandatory `go vet`, and `go run`, while compiler-only differential cases use the matching `go tool compile`. Tests require exact status/stdout, unchanged `go.mod`/`main.go`, no `go.sum`/`go.work`/vendor tree, and byte-identical binaries and output in two fresh directories. Missing, wrong-minor, wrong-architecture, mismatched-gofmt, download, cgo, workspace, vet, formatting, nondeterminism, telemetry leakage, or cleanup evidence fails without a skip.
 
-Task 023 adds exact Kotlin/JVM 2.4.20 discovery on the pinned OpenJDK 25.0.4+7 Ubuntu runtime. Ubuntu26.04 development and Ubuntu24.04 TensorBuzz use their exact `25.0.4+7-1~26.04` and `25.0.4+7-1~24.04` package builds. Bootstrap and discovery accept only their two qualified compiler-reported distribution suffixes, never arbitrary output. Original and generated `Program.kt` files compile with `-language-version 2.4 -api-version 2.4 -jvm-target 25 -Werror -include-runtime` into runnable `Program.jar` files, then execute through the exact `java25` discovery contract. Every process uses a fresh directory and exact status/stderr/UTF-8 stdout assertions; no test downloads a compiler or dependency.
+Task 023 adds exact Kotlin/JVM 2.4.20 discovery on pinned OpenJDK 25 Ubuntu runtimes. Ubuntu26.04 development uses exact `25.0.4.1+1-1~26.04.4`; Ubuntu24.04 TensorBuzz retains exact `25.0.4+7-1~24.04`. Bootstrap and discovery accept only those two qualified compiler-reported package identities, never arbitrary output. Original and generated `Program.kt` files compile with `-language-version 2.4 -api-version 2.4 -jvm-target 25 -Werror -include-runtime` into runnable `Program.jar` files, then execute through the exact `java25` discovery contract. Every process uses a fresh directory and exact status/stderr/UTF-8 stdout assertions; no test downloads a compiler or dependency.
+
+Task 041's product checks are separate from runtime acceptance. Run the two focused files sequentially:
+
+```sh
+npx velocious-test spec/managed-target-check-plans.spec.js
+npx velocious-test spec/managed-target-check-real-tools.spec.js
+```
+
+The plan spec proves exact frozen registry descriptors/argv, declared input and path ownership, no execute stage, stable C# project/lock hashing, and source-only changes that do not alter that restore identity. The real-tool spec fails rather than skips when any configured PHP, Ruby, Node, TypeScript, Kotlin, Python, or .NET tool is unavailable. It checks a generated supported fixture twice per target, injects invalid native source at every plan boundary, and requires preserved native output, nonzero structured stage diagnostics, the unchanged last-good pointer/bytes, and no failed candidate/staging residue. A separate malformed C# lockfile produces a real `restore` failure distinct from `compile` failure. The same file exercises all Task 041 targets already admitted by the version-1 complete-program boundary through the unchanged generic CLI.
+
+`spec/csharp-target-check-safety.spec.js` is the focused correction gate. With real .NET it proves that altered project bytes are rejected before a safe project-defined write target can run, ancestor `Directory.Build.targets` is not imported, staged source bytes remain unchanged, and an additional invalid `.cs` artifact reaches the compiler through the exact deterministic compile-item list instead of being merely declared as evidence.
+
+Product checks never execute the generated marker program. PHP uses configuration-free lint, Ruby disables gems for syntax checking, Node uses parse-only `--check`, and TypeScript uses no emit/incremental state plus candidate-only type roots. Kotlin publishes only `classes/`; Python uses isolated `py_compile` with checked-hash invalidation and publishes one build-root `.pyc`; C# accepts only its canonical generated manifest, disables ancestor customization, compiles every staged source, and lets restore consult only the staged local source. All NuGet/CLI/home/temp/intermediate paths are generation-owned and removed after the compiler closes, leaving only `bin/`. Repeated output inventories must match, source trees remain byte-owned by the publisher, and missing tools are failures.
+
+Task 042's native/project checks are covered by two additional focused files, run sequentially:
+
+```sh
+npx velocious-test spec/native-project-target-check-plans.spec.js
+npx velocious-test spec/native-project-target-check-real-tools.spec.js
+```
+
+The plan spec asserts exact frozen registry descriptors, argv arrays, declared inputs, path ownership, non-execution, and isolation for Go, C, C++, Rust, Swift, Dart, and Zig. It proves that Dart's length-framed restore identity contains only the exact producer-owned `pubspec.yaml`/`pubspec.lock` and is stable across source-only changes. The real-tool spec fails rather than skips when any qualified tool is unavailable. For every target it publishes two fresh valid candidates, checks stable source/build inventories and successful native stages, injects invalid staged source, retains native diagnostics and exact target identity, preserves the prior pointer/bytes, and proves the failed candidate plus transient state are gone.
+
+The developer profiles are intentionally bounded and non-executing:
+
+- Go uses exact local Go 1.26, `CGO_ENABLED=0`, `GOTOOLCHAIN=local`, read-only modules, network/VCS/workspace disablement, trimmed/build-ID-free output, and mandatory vet. Its HOME, GOPATH, GOCACHE, GOMODCACHE, and GOTMPDIR are candidate-owned; the qualified version-specific telemetry child guard prevents an unowned uploader descendant.
+- C uses strict Clang C17 at `-O0`, compiling every `.c` unit while declaring every `.h`, then linking the complete object set. C++ uses Clang C++20/libstdc++, no exceptions/RTTI, and the matching strict warnings/encoding/overflow profile. Their objects and temp state are removed, leaving only the linked developer executable. Existing O0/O2 ordinary plus ASan/UBSan/leak runs remain mandatory explicit acceptance/CI profiles; they are not hidden watcher branches.
+- Rust requires the exact dependency-free edition-2021 manifest and format-4 lock, qualifies both exact Rustc and Cargo identities, binds Cargo to the discovered compiler through an exact `RUSTC` tool environment path, then runs `cargo build --offline --locked` and `cargo check --offline --locked` with isolated CARGO_HOME/HOME/temp/target state and no incremental compilation. All Cargo target/cache/lock/executable state is transient.
+- Swift 6.3.3 explicitly uses `--driver-mode=swiftc`, warnings as errors, `-typecheck`, then a stable named-module object compile and native link with the ELF build ID disabled. The owned relative object path avoids randomized driver-temporary paths in `.swift_modhash`; object/HOME/XDG cache/temp state is removed, and the byte-stable compiled output is published but never run.
+- Dart 3.13.3 performs `pub get --offline --dry-run --enforce-lockfile --no-precompile` against the fixed dependency-free package, compiles the selected native executable, verifies formatting with no writes, and runs fatal analysis. PUB_CACHE/HOME/temp, the candidate package's `.dart_tool`, and the path-dependent native check output are declared transient and removed after close; `PUB_HOSTED_URL` is unreachable.
+- Zig 0.15.2 accepts only `build.zig` plus generated Zig sources, runs the Debug project build with generation-owned local/global caches and prefix, then runs `zig fmt --check`. The root-dependent Debug prefix is transient, so no native executable leaks or is published. Canonical format, `zig build test`, and builds/runs in Debug, ReleaseSafe, and ReleaseFast remain mandatory explicit acceptance/CI coverage and are not repeated on every edit.
+
+No Task 042 plan runs a generated executable, fetches a package, consults a user-global dependency home, cross-compiles, or adds a terminal matrix. Native nonzero exit, discovery, invalid plan, restore, compile, link, validation, timeout/cancellation, cleanup, and publication failures retain their distinct existing diagnostics.
 
 | Tool ID | Canonical command | Absolute-path override | Accepted canonical version |
 | --- | --- | --- | --- |
@@ -357,8 +424,8 @@ Task 023 adds exact Kotlin/JVM 2.4.20 discovery on the pinned OpenJDK 25.0.4+7 U
 | `tsc` | `tsc` | `SEMANTIFOLD_TSC` | TypeScript 7.x |
 | `javac` | `javac` | `SEMANTIFOLD_JAVAC` | JDK 17–29 |
 | `java` | `java` | `SEMANTIFOLD_JAVA` | JRE 17–29 |
-| `java25` | `java` | `SEMANTIFOLD_JAVA` | exact OpenJDK 25.0.4+7 Ubuntu runtime for JVM25 artifacts |
-| `kotlinc` | `kotlinc` | `SEMANTIFOLD_KOTLINC` | exact Kotlin/JVM 2.4.20 on JRE 25.0.4+7 Ubuntu |
+| `java25` | `java` | `SEMANTIFOLD_JAVA` | exact OpenJDK 25.0.4.1+1 development or 25.0.4+7 TensorBuzz runtime for JVM25 artifacts |
+| `kotlinc` | `kotlinc` | `SEMANTIFOLD_KOTLINC` | exact Kotlin/JVM 2.4.20 on the matching qualified OpenJDK 25 Ubuntu package |
 | `python` | `python3` | `SEMANTIFOLD_PYTHON` | Python 3.x |
 | `dotnet` | `dotnet` | `SEMANTIFOLD_DOTNET` | .NET SDK 10.x |
 | `go` | `go` | `SEMANTIFOLD_GO` | Go 1.26.x, Linux/amd64 |

package/docs/watch-build-pipeline.md

@@ -2,7 +2,7 @@
 
 ## Status and verified baseline
 
-This document is a roadmap contract, not an implemented CLI contract.
+Tasks 039–042 implement the strict project manifest, stable one-shot snapshot, deterministic generation orchestration, generic non-executing check-plan contract, Java/`javac`, the interpreted/managed cohort, the native/project cohort, human/NDJSON reporting, and packaged `semantifold build [--check]`. Task 043 implements the language-neutral deterministic watch coordinator and `semantifold watch [--check]`; Task 044 proves its packed JavaScript/JSDoc-to-Java checked vertical slice. Task 045 remains the terminal all-text matrix.
 
 The inspected baseline is `semantifold@0.7.0`, annotated tag `v0.7.0`, commit `8cd70c5a6c7de98df2d4a183d6555ad4f3d5ba5a`. At that revision:
 
@@ -11,31 +11,31 @@ The inspected baseline is `semantifold@0.7.0`, annotated tag `v0.7.0`, commit `8
 - `discoverCanonicalToolchain` finds the configured `javac` and `java` executables.
 - `runAcceptanceStages` materializes an artifact set in a temporary directory and runs caller-supplied exact argument arrays with bounded process execution.
 - A bounded direct proof parsed the 2,648-byte JSDoc fixture `spec/fixtures/compatibility/program.js`, generated `Main.java`, compiled it with `javac 25.0.4`, executed it with Java 25.0.4, and observed the canonical output `compat\nbranch-ok!\npresent\nabsent\n7\n2\n3\n5\n4\n`.
-- `package.json` has no `bin` entry. The public API does not persist generated artifacts, load a project manifest, derive compiler arguments from a target, or watch source files.
+- `package.json` had no `bin` entry. The public API did not persist generated artifacts, load a project manifest, derive compiler arguments from a target, or watch source files.
 - The only repository file-change watcher is a test helper; there is no product watch coordinator, incremental dependency graph, event coalescing policy, or long-lived compiler owner.
 
-The current system therefore already proves **JavaScript/JSDoc → semantic IR → Java → `javac`** as a one-shot composition. The roadmap below turns that composition into a safe project workflow without moving filesystem or process lifecycle concerns into parsers or backends.
+That historical baseline proved **JavaScript/JSDoc → semantic IR → Java → `javac`** as a one-shot composition. Released `semantifold@0.9.0` supplies Task 038's public language-neutral `GeneratedArtifactPublisher`, immutable generation manifests, one atomic active pointer, pointer-once resolution, and journal-bounded recovery. Task 039 adds the package bin, project configuration, and one-shot CLI behavior; Task 040 productizes the generic plan/runner and Java compiler boundary; Task 041 adds PHP, Ruby, JavaScript, TypeScript, Kotlin/JVM, Python, and C# plans; Task 042 adds Go, C, C++, Rust, Swift, Dart, and Zig plans; Task 043 supplies generic watch coordination; and Task 044 supplies the packed credential-free watch proof and public example.
 
 ## Product outcome
 
-A project can declare explicit source modules, one or more generated targets, one publisher-owned project publication root, target-relative generated/build projections, and whether each target is checked with its real toolchain. It can then run:
+A project can declare explicit source modules, one or more generated targets, one publisher-owned project publication root, and target-relative generated/build projections. The one-shot CLI selects generation-only or all-target developer checking with `--check`. It can then run:
 
-- a planned one-shot `semantifold build`; or
-- a planned long-lived `semantifold watch`.
+- the implemented one-shot `semantifold build`; or
+- the implemented long-lived `semantifold watch`.
 
 For the first end-to-end slice, changing a JSDoc-typed JavaScript source regenerates Java and compiles the staged candidate with `javac`. A successful cycle publishes one coherent generated-source/compiler-output generation through one active-generation pointer switch. A parse, semantic, generation, tool-discovery, compiler, or publication failure reports a located diagnostic, keeps the process alive in watch mode, and leaves the previous successful generation usable. A later valid edit recovers without restarting the watcher.
 
-The architecture is target-neutral. Every current text backend eventually supplies one target-owned check plan. Every current source frontend participates through the existing parser/project APIs; the watcher never contains language syntax logic.
+The architecture is target-neutral. All fifteen text targets supply target-owned plans. Every current source frontend participates through the existing parser/project APIs; the watcher never contains language syntax logic.
 
 ## Architecture boundaries
 
-### Project manifest and loader
+### Project manifest and loader (Task 039 implemented)
 
 A versioned, strict manifest declares ordered source modules and target entries. Source language, module identity, entry identity, target language/role, one project publication root, and each target's generated/check subpaths inside an immutable project generation are explicit. These target paths are logical projections, not independently promoted filesystem roots. Version 1 uses explicit file paths rather than introducing a glob language or package-manager resolution.
 
-The loader owns path normalization and rejects unknown fields, duplicate module/target identities, ambiguous target roles, source/publication overlap, publication roots outside the project root, colliding or nested target projections, and symlink/path traversal across the owned publication root. It returns an immutable project request and never parses language syntax.
+The loader owns path normalization and rejects unknown fields, duplicate module/target identities, ambiguous target roles, source/publication overlap, publication roots outside the project root, colliding or nested target projections, symlink/path traversal across the owned publication root, and registered backend capabilities whose required configuration version 1 cannot express. It returns an immutable project request and never parses language syntax.
 
-### Snapshot builder
+### Snapshot builder (Task 039 implemented for one-shot builds)
 
 Each cycle reads a complete content snapshot of every declared source and the project manifest. File events are hints only. Before parsing, the coordinator re-reads and hashes the declared graph in stable order; it never assumes an event filename is complete or authoritative.
 
@@ -45,30 +45,44 @@ A snapshot is immutable for the cycle. Edits arriving during parse/generation/ch
 
 Frontends, semantic validation, linking, and backends remain pure with respect to the project filesystem. They consume the immutable snapshot and return complete `GeneratedArtifactSet` values. No frontend or backend starts watchers, writes files, spawns a compiler, or reads undeclared project files.
 
-### Transactional artifact publication
+### Transactional artifact publication (Task 038 implemented)
 
-A publisher stages one complete project candidate as a new immutable generation beneath the publisher-owned publication root. Every target's generated artifacts, mappings, and optional compiler outputs live in generation-relative subtrees on the same filesystem. The publisher validates paths, mappings, hashes, collisions, ownership, and manifests before touching committed state.
+`GeneratedArtifactPublisher` stages one complete project candidate as a new immutable generation beneath a dedicated publisher-owned publication directory inside the canonical project root. Every target carries an explicit language-neutral role, and its generated artifacts, mappings, and optional validator/compiler outputs live in generation-relative subtrees on the same filesystem. The publisher validates paths, mappings, hashes, hard-link identities, complete generation inventory, collisions, ownership, and manifests before touching committed state. Its public contract and caller obligations are documented in [transactional generated-artifact publication](generated-artifact-publication.md).
 
-When checking is enabled, target checks run against those staged generation subtrees. Only a fully generated and successfully checked project candidate may be published. The generation manifest is the explicit versioned authority for files the publisher created; it never authorizes mutation outside the publication root.
+When checking is enabled, target checks run against those staged generation subtrees. Each checked invocation owns a fresh immutable candidate identity, including for an unchanged or reverted source snapshot, so it cannot reuse retained compiler output instead of executing the declared checks. Generation-only snapshots retain deterministic same-ID verification and reactivation. Only a fully generated and successfully checked project candidate may be published. The generation manifest is the explicit versioned authority for files the publisher created; it never authorizes mutation outside the publication root.
 
 Publication commits exactly one small active-generation pointer by writing and syncing a sibling temporary pointer, atomically replacing the prior pointer on the same filesystem, and syncing the parent directory before reporting success. A host filesystem that cannot provide atomic same-directory regular-file replacement is rejected before publication; copying, truncating, or rewriting the live pointer in place is never a fallback. Readers resolve that pointer once and consume all generated/build paths from the referenced immutable generation. Configured generated-source and compiler-output names are logical projections returned from that resolved generation; they are never independent directories, symlinks, or manifests promoted one after another. The same rule covers every target in a multi-target cycle.
 
-An interruption before the pointer replacement leaves the previous generation active; an interruption after it leaves either the old or new complete pointer durably recoverable, never a composite state. A recovery journal may finish cleanup of unpublished candidates and temporary pointer files, but it is not used to claim atomicity across multiple filesystem operations. Publication never removes a committed generation, because a reader may already hold its resolved snapshot; committed-generation retention/garbage collection is a separate explicit policy. A failed candidate is removed without changing the active pointer.
+An interruption before the pointer replacement leaves the previous generation active; an interruption after it leaves either the old or new complete pointer durably recoverable, never a composite state. A recovery journal may finish cleanup of unpublished candidates and temporary pointer files, but it is not used to claim atomicity across multiple filesystem operations. Candidate and temporary-pointer parent directories are synchronized before the proving journal is removed and its directory synchronized. Publication never removes a committed generation, because a reader may already hold its resolved snapshot; committed-generation retention/garbage collection is a separate explicit policy. A failed candidate is removed without changing the active pointer.
 
-### Target check-plan registry
+### Target check-plan registry (Tasks 040–042 implemented)
 
-The existing language registry remains authoritative for target identity, roles, declared acceptance stages, and required toolchain IDs. A planned target-check capability derives exact stage requests from a validated staged artifact set and its generation-scoped target build subtree.
+The existing language registry remains authoritative for target identity, roles, declared acceptance stages, and required toolchain IDs. Its explicit immutable `check` capability distinguishes generation-only targets from Java plus PHP, Ruby, JavaScript, TypeScript, Kotlin/JVM, Python, and C# developer checks without claiming execution. The target-owned factory derives exact stage requests from a validated staged artifact set and its generation-scoped target source/build subtrees.
 
-The generic runner owns process lifecycle, locale/timezone normalization, output capture, timeout/cancellation, and close observation. A target check plan owns filenames, exact argv, toolchain IDs, offline/cache policy, and which stages constitute a non-executing developer check. The watcher does not switch on language IDs.
+The generic runner validates immutable dense argv, complete artifact inputs, restore hashes, candidate-path ownership, exact discovered-tool environment bindings, nullable output ownership, and transient candidate directories before spawn. It owns process lifecycle, locale/timezone normalization, bounded output capture, timeout/cancellation, signal forwarding, first failure, close observation, and post-close transient cleanup. A target check plan owns filenames, exact argv, toolchain IDs, offline/cache policy, and which stages constitute a non-executing developer check. The builder and watcher do not switch on language IDs.
 
-The initial check plan is Java/`javac`. Later tasks add current text targets in two cohorts:
+Java/`javac` compiles every staged `.java` artifact together with `-d` directed at the candidate build subtree and never invokes `java`. Task 041 implements the interpreted/managed cohort:
 
-- interpreted/managed: PHP, Ruby, JavaScript, TypeScript, Kotlin/JVM, Python, and C# (Java is supplied by the initial slice);
-- native/project: Go, C, C++, Rust, Swift, Dart, and Zig.
+- PHP, Ruby, and JavaScript run real syntax checks once per generated language artifact;
+- TypeScript type-checks the complete set with no emit and isolated type roots;
+- Kotlin/JVM compiles all sources together to candidate-owned classes;
+- Python produces deterministic checked-hash bytecode at an explicit candidate build path and never creates source-adjacent `__pycache__`;
+- C# requires its exact producer-owned project, disables ancestor MSBuild props/targets, passes every staged `.cs` file in deterministic order, hashes project/lock restore inputs, restores from a local-only staged source into candidate-owned state, builds with `--no-restore`, and removes cache/home/intermediate state before publishing only `bin/` outputs.
 
-A watch check validates or compiles but does not execute generated application code by default. Restore/download behavior is never an implicit per-edit action; targets with project metadata use pinned, offline, isolated state and rerun prerequisite stages only when their declared inputs change.
+Task 042 implements the remaining cohort:
 
-### Watch coordinator
+- Go disables cgo, workspace/toolchain switching, VCS, and network resolution for its build, then vets read-only with isolated HOME/GOPATH/module/build/temp state.
+- C and C++ compile every translation unit and link through the strict Clang C17 or C++20/libstdc++ `-O0` developer profile. Object/temp state is transient; `-O2` and ASan/UBSan remain explicit CI acceptance profiles rather than watcher branches.
+- Rust accepts only the dependency-free generated Cargo manifest/lock, qualifies both Rustc and Cargo, binds Cargo's `RUSTC` to that exact discovered compiler, runs locked offline build/check with isolated Cargo home/target state, and removes that state before publication.
+- Swift type-checks and compiles with exact driver mode and warnings as errors while isolating home/cache/temp state.
+- Dart validates only the producer-owned dependency-free package/lock through an enforced offline dry run, compiles a native executable, verifies format, and analyzes fatally. The restore hash excludes ordinary source edits; `.dart_tool`, pub/home/temp state, and the absolute-source-URI-bearing native check output are transient.
+- Zig accepts only the producer-owned standard-library-only project, builds Debug with isolated local/global caches and an owned transient prefix, then verifies canonical formatting. Multi-mode builds/tests remain explicit acceptance profiles.
+
+None of these developer plans executes its generated program. A later validator does not hide an earlier declared compiler/linker output, and all candidate transient state is removed after child close on success, failure, timeout, or cancellation.
+
+A watch check validates or compiles but does not execute generated application code by default. A content-identical reconciliation admits no cycle and therefore performs no restore. Every fresh C# candidate uses its declared project/lock hash, generation-specific SDK assets, and local-only package source; it reruns restore without network access because checked generations do not share mutable restore state.
+
+### Watch coordinator (Task 043 implemented)
 
 One lifecycle-aware class owns filesystem subscriptions, content snapshots, cycle state, the active checker child, reporting, and shutdown. Its state machine is:
 
@@ -85,11 +99,13 @@ any live state -- SIGINT/SIGTERM --> stopping --> stopped
 
 `failed` means the last candidate failed; it does not discard the last successful output or terminate watch mode. A watcher event during `building`/`rebuilding` sets one dirty generation marker. The coordinator starts exactly one follow-up after the owned child closes. It never starts a retry while prior compiler work is still live.
 
-Native filesystem events require a bounded reconciliation strategy because Node and TypeScript both document platform-dependent watcher behavior. Version 1 watches the explicit manifest/source files and relevant parent directories, re-scans the declared graph after each hint, supports a documented polling fallback, and suppresses no-op cycles by content hash. The publication root and every generated/build projection are rejected as source roots and are never watched.
+Native filesystem events require a bounded reconciliation strategy because Node and TypeScript both document platform-dependent watcher behavior. Version 1 watches the explicit manifest/source files and their distinct parent directories without recursive watching, filters publisher-owned parent events, re-scans the complete graph after each coalesced hint, supplements native events with a bounded reconciliation interval, switches wholly to polling when native subscription creation or a live watcher fails, and suppresses no-op cycles by content hash. Polling metadata is only a reconciliation hint, and unchanged invalid graphs do not emit repeated failed cycles. The publication root and every generated/build projection are rejected as sources and are never direct subscriptions, preventing publication feedback cycles.
+
+The implemented pre-pointer currentness guard runs only after every target validator/checker has closed. It re-loads and hashes the complete graph; changed content rejects and cleans the stale staged candidate, while one dirty marker admits a single immediate latest-state follow-up. A later event in the narrow guard-to-pointer window cancels publication without cancelling a healthy checker earlier in the cycle.
 
 ### Reporting contract
 
-Human output is concise and stable. A machine-readable mode emits one JSON record per state transition with at least project identity, monotonically increasing cycle number, source snapshot hash, target ID/role, state, timing, changed paths, tool identity, exit status, and a structured diagnostic when present.
+Task 039 human output is concise and stable. Its machine-readable mode emits deterministic state records with project identity, cycle `1`, source snapshot hash, ordered target ID/role/results, exit status, and a structured diagnostic when present. Generation-only records deliberately report state rather than nondeterministic elapsed time. Task 040 checked-stage records add exact tool/process identity and lifecycle timing. Task 043 watch records add stable changed paths, cycle duration, succeeded/failed/recovered/superseded/cancelled classification, one terminal record per admitted cycle, and one separate watcher terminal. Task 044 adds the nonterminal `cycle-dirty` acknowledgement used to synchronize a controlled active-check burst with the coordinator's admitted follow-up ownership.
 
 Exactly one terminal cycle record is emitted per cycle. Process exit is non-zero for failed one-shot builds, but ordinary watch-cycle failures keep the watcher process alive. Startup/configuration failure exits. Signal-driven shutdown forwards cancellation to an active owned child, waits for `close`, removes subscriptions and staging state, and exits once.
 
@@ -115,7 +131,7 @@ Exactly one terminal cycle record is emitted per cycle. Process exit is non-zero
 - the same watcher/materializer/runner code handles every source/target pairing;
 - acceptance uses a bounded matrix: all frontends and all text targets are covered, with the JavaScript/JSDoc-to-Java path plus representative cross-family paths, not a quadratic promise that every semantic feature works for every pair.
 
-Binary and application targets use the same generation watcher only after explicit target policy is defined. Browser Wasm can validate/instantiate in its own lane. Android and Flutter checks are heavier platform builds and must be opt-in rather than an automatic keystroke default. iOS remains generation-only until the separately deferred Apple/Xcode acceptance work is authorized; this roadmap does not reopen Tasks 026 or 027.
+Binary and application targets use the same generation watcher only after explicit target policy is defined. Browser Wasm can validate/instantiate in its own lane. Android and Flutter checks are heavier platform builds and must be opt-in rather than an automatic keystroke default. Direct public iOS generation remains available with explicit configuration, but Task 039 manifest version 1 cannot express that configuration and rejects iOS targets; Apple/Xcode acceptance remains separately deferred. This roadmap does not reopen Tasks 026 or 027.
 
 ## Test strategy
 
@@ -147,7 +163,7 @@ Binary and application targets use the same generation watcher only after explic
                   046 later binary/application policies
 ```
 
-Tasks 038–045 are the selected text-language delivery chain. Task 045 is the single terminal acceptance task for that chain. Task 046 is a non-blocking later extension.
+Tasks 038–041 and 043–044 are the implemented publication, one-shot project-build, Java plus interpreted/managed checks, watch-orchestration foundation, and first packed checked slice. Tasks 042 and 045 remain the selected text-language check/watch delivery chain, with Task 045 as its single terminal acceptance task. Task 046 is a non-blocking later extension.
 
 ## Non-goals
 

package/docs/zig.md

@@ -26,6 +26,8 @@ Strings are immutable `[]const u8`. Literals borrow static storage; concatenatio
 
 `build.zig` exposes only Zig's standard optimization option and the host target. Acceptance copies validated artifacts to a fresh temporary project, uses distinct empty local/global caches per mode, blocks proxy/package-fetch variables, runs `zig fmt --check src/main.zig build.zig`, `zig build test`, `zig build`, and the installed executable in Debug, ReleaseSafe, and ReleaseFast, and verifies that input artifact hashes never change. Cross-compilation and package dependencies are outside this profile.
 
+The registered Task 042 developer plan accepts only that exact standard-library-only `build.zig` and generated Zig sources. It runs the Debug project build with generation-owned local/global caches and `--prefix`, then `zig fmt --check` over the complete staged set. HOME, TMPDIR, both caches, and the absolute-root-bearing Debug output prefix are removed after close, so no executable leaks or is published. `zig build test` plus build/run in Debug, ReleaseSafe, and ReleaseFast remain explicit acceptance/TensorBuzz profiles rather than automatic watcher branches.
+
 ## Provenance and diagnostics
 
 Function, parameter, local, type, assignment, operator/helper, callee, argument, literal, return, condition, output, and entry-statement occurrences retain exact or anchored semantic provenance in `src/main.zig`. The runtime, arena, output helpers, punctuation, ordered-region markers and signatures, typed ordering temporaries, conditional-right-hand plumbing, necessary unused/unmutated binding scaffolds, and entry shell are synthetic with related semantic origins. `build.zig` has artifact-level synthetic configuration provenance. The embedded Source Map v3 names `src/main.zig`; Zig source-map directives and alternate filenames are rejected.

package/examples/jsdoc-java-watch/expected-output.txt

@@ -0,0 +1,3 @@
+task-044
+5
+enabled

package/examples/jsdoc-java-watch/semantifold.json

@@ -0,0 +1,23 @@
+{
+  "schema": "SemantifoldProject",
+  "version": 1,
+  "id": "jsdoc-java-watch",
+  "publicationRoot": ".semantifold",
+  "sources": [
+    {
+      "id": "main",
+      "path": "src/main.js",
+      "language": "javascript",
+      "entry": true
+    }
+  ],
+  "targets": [
+    {
+      "id": "java-main",
+      "language": "java",
+      "role": "text",
+      "sourceProjection": "targets/java/source",
+      "buildProjection": "targets/java/classes"
+    }
+  ]
+}

package/examples/jsdoc-java-watch/src/main.js

@@ -0,0 +1,21 @@
+/**
+ * @param {number} left
+ * @param {number} right
+ * @returns {number}
+ */
+function add(left, right) {
+  return left + right
+}
+
+/**
+ * @param {boolean} enabled
+ * @returns {string}
+ */
+function label(enabled) {
+  if (enabled) return "enabled"
+  else return "disabled"
+}
+
+console.log("task-044")
+console.log(add(2, 3))
+console.log(label(true))