ttsc 0.30.4 → 0.31.0

package/internal/lspserver/lsp_hints_refresh_keeps_each_producer_isolated_test.go

@@ -2,27 +2,37 @@ package lspserver
 
 import (
   "bytes"
+  "os/exec"
+  "reflect"
   "testing"
 )
 
 // TestLSPHintsRefreshKeepsEachProducerIsolated pins the failure boundary between
 // producers.
 //
-// A refresh re-asks every plugin, and plugins fail independently: one sidecar
-// can be mid-rebuild, locked by a virus scanner, or simply gone while the others
-// answer normally. A refresh that rebuilt one shared slice would let that single
-// failure blank a working producer's corpus — the editor would lose completions
-// it had a second ago for a reason unrelated to the rule that published them.
-// The rule is that only a producer's own successful answer changes its corpus.
+// Two unresolved producer binaries exercise failed discovery after their caches
+// are seeded. A later direct store replaces only the first producer's cache.
+// No producer successfully executes or returns a wire answer in this unit;
+// antivirus/rebuild causes and actual editor presentation are unobserved.
 //
 //  1. Give two producers a good corpus.
 //  2. Run a whole refresh generation in which neither sidecar can be executed.
 //  3. Assert both corpora survived, in manifest order, with nothing logged.
-//  4. Let only the first producer answer, and assert the second is untouched.
+//  4. Directly store the first producer's replacement and assert both literal lists.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual failed discoverCompletionHints preserves the two literal seeded hints in manifest order and writes no log bytes. A direct generation-3 store replaces the first producer's item list while retaining the second producer's literal hint. No successful wire answer or mixed successful/failed discovery is exercised.
+// @evidence contracts/testing.md#independent-expectations The expected corpora are literal hint lists per producer.
+// @evidence contracts/testing.md#distinguishing-cases All-failed discovery and a later one-producer direct store distinguish retained caches from shared-slice replacement. Full literal list comparisons also reject mutations of item contents that trigger/count checks alone would miss.
+// @evidence contracts/testing.md#execution-ownership This Go unit uses actual NativePluginSource store/discovery/snapshot methods and an owned logger. LookPath must reject both original binary names before native resident/direct execution attempts; no sidecar is installed or successfully started. No temporary directory or substituted query operation exists, and runtime selection/execution is unverified.
 func TestLSPHintsRefreshKeepsEachProducerIsolated(t *testing.T) {
   var log bytes.Buffer
   first := NativeLSPPluginEntry{Binary: "ttsc-no-such-plugin-binary-a", Name: "@ttsc/lint"}
   second := NativeLSPPluginEntry{Binary: "ttsc-no-such-plugin-binary-b", Name: "@samchon/evidence"}
+  for _, binary := range []string{first.Binary, second.Binary} {
+    if _, err := exec.LookPath(binary); err == nil {
+      t.Fatalf("missing sidecar premise failed: %q resolves to an executable", binary)
+    }
+  }
   source := &NativePluginSource{
     err:     &log,
     plugins: []NativeLSPPluginEntry{first, second},
@@ -40,10 +50,15 @@ func TestLSPHintsRefreshKeepsEachProducerIsolated(t *testing.T) {
   if len(hints) != 2 || hints[0].After != "@" || hints[1].After != "@evidence " {
     t.Fatalf("a refresh that could reach no producer disturbed the corpus: %#v", hints)
   }
+  if !reflect.DeepEqual(hints, []LSPCompletionHint{
+    {Scope: "jsdoc", After: "@", Items: []LSPCompletionItem{{Insert: "param"}}},
+    {Scope: "jsdoc", After: "@evidence ", Items: []LSPCompletionItem{{Insert: "docs/rfc.md"}}},
+  }) {
+    t.Errorf("failed discovery changed the literal producer corpora: %#v", hints)
+  }
   if log.Len() != 0 {
     t.Errorf(
-      "a producer that could not answer was logged as a failure:\n%s\n"+
-        "refresh runs per save, so that line would print on every save",
+      "unresolved producer discovery wrote unexpected log bytes:\n%s",
       log.String(),
     )
   }
@@ -61,4 +76,10 @@ func TestLSPHintsRefreshKeepsEachProducerIsolated(t *testing.T) {
   if hints[1].After != "@evidence " || len(hints[1].Items) != 1 {
     t.Errorf("an unrelated producer's corpus was disturbed: %#v", hints[1])
   }
+  if !reflect.DeepEqual(hints, []LSPCompletionHint{
+    {Scope: "jsdoc", After: "@", Items: []LSPCompletionItem{{Insert: "param"}, {Insert: "returns"}}},
+    {Scope: "jsdoc", After: "@evidence ", Items: []LSPCompletionItem{{Insert: "docs/rfc.md"}}},
+  }) {
+    t.Errorf("direct store changed the expected producer corpora: %#v", hints)
+  }
 }

package/internal/lspserver/lsp_hints_refresh_replaces_the_session_snapshot_test.go

@@ -5,21 +5,21 @@ import (
   "testing"
 )
 
-// TestLSPHintsRefreshReplacesTheSessionSnapshot pins the lifecycle the corpus
-// channel shipped without.
+// TestLSPHintsRefreshReplacesTheSessionSnapshot pins the corpus lifecycle.
 //
-// The first release fetched the corpus once, in a goroutine started by
-// NewNativePluginSource, and every later read was that same slice. A rule
-// enabled after startup, or a contributor index rebuilt from a saved document,
-// could not reach the editor without restarting the language server — which is
-// precisely when a project-derived corpus is most wrong. Each stage below is a
-// state the proxy must serve correctly, including the two that are easy to get
-// backwards: a corpus that shrinks must shrink, and one that never arrived must
-// stay silent rather than fail open.
+// Direct cache stores transition from no hints to one hint, replace that hint
+// with another one, then clear it. Actual proxy accessors expose those values
+// and selected trigger characters. No startup, producer reply, rule toggle,
+// contributor rebuild, editor popup or language-server restart executes here.
 //
-//  1. Read the corpus before any producer has answered.
-//  2. Let a producer answer, and read again through the proxy's completion seam.
-//  3. Let the same producer answer differently, then answer with nothing.
+//  1. Read the empty corpus before a direct cache store.
+//  2. Store one literal hint and read it through the actual proxy accessor.
+//  3. Replace it with another literal hint, then store nil to clear it.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual storeCompletionHints and proxy accessors expose literal transitions empty→param hint→docs/rfc.md hint→empty. Trigger characters are independently asserted before storage and after the two nonempty stores; the cleared state's trigger projection is not separately asserted.
+// @evidence contracts/testing.md#independent-expectations The expected corpus at each stage is a literal.
+// @evidence contracts/testing.md#distinguishing-cases Empty, singleton insertion, singleton replacement and explicit nil clearing reject stale accumulation or retention; replacement changes content and trigger rather than reducing hint count.
+// @evidence contracts/testing.md#execution-ownership This Go unit directly invokes actual NativePluginSource cache storage and Proxy hint/trigger accessors. The supplied binary/name are opaque cache metadata, not executable selection; no directory, sidecar, compiler, process, product host, LSP transport or substituted operation runs.
 func TestLSPHintsRefreshReplacesTheSessionSnapshot(t *testing.T) {
   plugin := NativeLSPPluginEntry{Binary: "ttsc-lint", Name: "@ttsc/lint"}
   source := &NativePluginSource{plugins: []NativeLSPPluginEntry{plugin}}
@@ -39,12 +39,16 @@ func TestLSPHintsRefreshReplacesTheSessionSnapshot(t *testing.T) {
   if len(hints) != 1 || hints[0].After != "@" || len(hints[0].Items) != 1 {
     t.Fatalf("a corpus that arrived after startup did not reach the proxy: %#v", hints)
   }
+  if !reflect.DeepEqual(hints, []LSPCompletionHint{
+    {Scope: "jsdoc", After: "@", Items: []LSPCompletionItem{{Insert: "param"}}},
+  }) {
+    t.Errorf("first snapshot = %#v, want the literal param hint", hints)
+  }
   if got := proxy.pluginCompletionTriggerCharacters(); !reflect.DeepEqual(got, []string{"@"}) {
     t.Fatalf("trigger characters = %#v, want [\"@\"]", got)
   }
 
-  // The same producer, re-asked, is the whole point: its answer replaces the
-  // previous one rather than accumulating beside it.
+  // The next direct store replaces the first hint rather than accumulating it.
   source.storeCompletionHints(plugin, 2, []LSPCompletionHint{
     {Scope: "jsdoc", After: "@evidence ", Items: []LSPCompletionItem{{Insert: "docs/rfc.md"}}},
   })
@@ -52,13 +56,16 @@ func TestLSPHintsRefreshReplacesTheSessionSnapshot(t *testing.T) {
   if len(hints) != 1 || hints[0].After != "@evidence " {
     t.Fatalf("a changed corpus did not replace the previous one: %#v", hints)
   }
+  if !reflect.DeepEqual(hints, []LSPCompletionHint{
+    {Scope: "jsdoc", After: "@evidence ", Items: []LSPCompletionItem{{Insert: "docs/rfc.md"}}},
+  }) {
+    t.Errorf("replacement snapshot = %#v, want the literal reference hint", hints)
+  }
   if got := proxy.pluginCompletionTriggerCharacters(); !reflect.DeepEqual(got, []string{" "}) {
     t.Fatalf("trigger characters = %#v, want [\" \"] from the new corpus", got)
   }
 
-  // A rule turned off publishes nothing. Treating an empty successful answer as
-  // "keep what you had" would leave a disabled rule's items in the popup for the
-  // rest of the session.
+  // Explicit nil storage clears this producer's prior hint.
   source.storeCompletionHints(plugin, 3, nil)
   if hints := proxy.pluginCompletionHints(); len(hints) != 0 {
     t.Fatalf("a producer that stopped publishing left %d hints behind", len(hints))

package/internal/lspserver/lsp_hints_refresh_scheduled_by_editor_events_test.go

@@ -21,17 +21,20 @@ func (s *refreshCountingSource) RefreshCompletionHints() { s.refreshes.Add(1) }
 // TestLSPHintsRefreshScheduledByEditorEvents pins which editor notifications
 // rediscover the corpus.
 //
-// The corpus projects what a rule's Check found on the saved project, so the
-// events that can invalidate it are the ones that change that project: a saved
-// document, a config change from the editor, a watched file rewritten outside
-// it. The negative half matters just as much. didChange fires per keystroke and
-// leaves disk untouched, and a refresh spawns a sidecar per plugin, so
-// refreshing there would put a process spawn on the typing path — the one thing
-// this channel must never do.
+// An owned optional-capability source records refresh dispatch. The authored
+// positive and quiet notification lists distinguish the proxy's routing policy;
+// no actual hint rediscovery, process spawn, Program load or typing latency is
+// observed. Quiet events are exercised as a batch and checked by its final
+// monotonic count.
 //
 //  1. Send each notification that must schedule a refresh.
 //  2. Assert one refresh per notification.
 //  3. Send the notifications that must not, and assert the count is unchanged.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual handleEditorEnvelope increments the owned RefreshCompletionHints recorder once after each of eight authored positive notifications, including JSON membership/content, package metadata and unreadable watched params. Five quiet notifications leave the final count unchanged. This observes dispatch, not completion of rediscovery.
+// @evidence contracts/testing.md#independent-expectations The expected refresh counts are literal per notification.
+// @evidence contracts/testing.md#distinguishing-cases Saved/config/watched input notifications are positive; empty watched changes, didChange, didOpen, didClose and an empty-source completion request are quiet. No real disk mutation or universal notification classification is certified.
+// @evidence contracts/testing.md#execution-ownership This Go unit builds the actual Proxy with supported discard streams and an owned optional refresher embedding NullPluginSource, parses authored envelopes and invokes the actual handler. It creates no directory or sidecar and starts no compiler, process or host. Document handlers may attempt native read-only disk checks for supplied URIs and schedule NullPluginSource diagnostics without a joined/result oracle; only synchronous refresh counts are asserted.
 func TestLSPHintsRefreshScheduledByEditorEvents(t *testing.T) {
   source := &refreshCountingSource{}
   proxy := NewProxy(ProxyOptions{
@@ -66,9 +69,7 @@ func TestLSPHintsRefreshScheduledByEditorEvents(t *testing.T) {
   }
 
   quiet := []string{
-    // An editor that reports no change gets no refresh: the proxy already
-    // refuses to drop the resident daemon's warm Program for that notification,
-    // and a corpus refresh costs a whole Program load per plugin.
+    // An empty change list dispatches no refresh.
     `{"jsonrpc":"2.0","method":"workspace/didChangeWatchedFiles","params":{"changes":[]}}`,
     `{"jsonrpc":"2.0","method":"textDocument/didChange","params":{"textDocument":{"uri":"file:///a.ts","version":2},"contentChanges":[{"text":"const a = 1;"}]}}`,
     `{"jsonrpc":"2.0","method":"textDocument/didOpen","params":{"textDocument":{"uri":"file:///a.ts","languageId":"typescript","version":1,"text":"const a = 1;"}}}`,
@@ -80,8 +81,7 @@ func TestLSPHintsRefreshScheduledByEditorEvents(t *testing.T) {
   }
   if got := source.refreshes.Load(); got != int64(len(refreshing)) {
     t.Fatalf(
-      "an event that cannot change the saved project refreshed the corpus (%d refreshes, want %d); "+
-        "a refresh spawns a sidecar per plugin",
+      "the authored quiet event batch dispatched a refresh (%d refreshes, want %d)",
       got, len(refreshing),
     )
   }

package/internal/lspserver/lsp_hints_refresh_serves_completion_while_running_test.go

@@ -8,16 +8,20 @@ import (
 // TestLSPHintsRefreshServesCompletionWhileRunning pins the reader's view during
 // a refresh.
 //
-// Completion is answered from the corpus on the request path while a refresh
-// writes it from a background goroutine, so this is a real concurrent
-// reader/writer pair rather than a theoretical one — the user types while their
-// save is still being re-indexed. Two failures hide here that a single-threaded
-// test cannot see: a data race on the snapshot, and a reader catching the corpus
-// mid-rebuild and offering a truncated list. Run with -race.
+// Two writer and four reader goroutines exercise actual cache stores/accessors.
+// Each observed snapshot must have the expected count, manifest order, scope
+// and an allowed insertion per producer. Scheduling does not guarantee a
+// particular read/write interleaving, and this unit does not observe editor
+// typing, native producer refresh or a race-detector result.
 //
 //  1. Seed two producers so a torn snapshot is distinguishable from a whole one.
 //  2. Rewrite both producers' corpora repeatedly while readers ask for them.
-//  3. Assert every snapshot a reader saw was a whole corpus of known hints.
+//  3. Assert selected fields of every observed snapshot against literal expectations.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual cache stores and Proxy hint accessors run in two writer/four reader goroutines. Each observed snapshot has two hints in literal trigger order, each with scope jsdoc and one item whose insertion is the producer's initial value or refreshed. The unit joins its goroutines and reports collected failures; unobserved interleavings, other fields and a race-detector result are not certified.
+// @evidence contracts/testing.md#independent-expectations Count two, trigger order @ then @evidence-space, scope jsdoc and allowed insertion pairs param/refreshed and docs/rfc.md/refreshed are authored literals, not values generated by the store or accessor.
+// @evidence contracts/testing.md#distinguishing-cases Two producers with distinguishable corpora make a torn snapshot detectable.
+// @evidence contracts/testing.md#execution-ownership This Go unit invokes actual NativePluginSource cache storage and Proxy hint accessors on owned entries/corpora and waits for both goroutine groups. Binary/name are opaque cache metadata, not executable selection; no directory, sidecar, compiler, process, host or LSP transport runs, and no operation is substituted. Runtime/race-mode selection remains unverified.
 func TestLSPHintsRefreshServesCompletionWhileRunning(t *testing.T) {
   first := NativeLSPPluginEntry{Binary: "ttsc-lint", Name: "@ttsc/lint"}
   second := NativeLSPPluginEntry{Binary: "ttsc-evidence", Name: "@samchon/evidence"}
@@ -70,7 +74,7 @@ func TestLSPHintsRefreshServesCompletionWhileRunning(t *testing.T) {
           }
           return
         }
-        for _, hint := range hints {
+        for index, hint := range hints {
           if len(hint.Items) != 1 || hint.Items[0].Insert == "" {
             select {
             case failures <- "a completion request saw an empty hint group":
@@ -78,6 +82,15 @@ func TestLSPHintsRefreshServesCompletionWhileRunning(t *testing.T) {
             }
             return
           }
+          if hint.Scope != "jsdoc" ||
+            (index == 0 && hint.Items[0].Insert != "param" && hint.Items[0].Insert != "refreshed") ||
+            (index == 1 && hint.Items[0].Insert != "docs/rfc.md" && hint.Items[0].Insert != "refreshed") {
+            select {
+            case failures <- "a snapshot contained scope or insertion outside the literal producer corpus":
+            default:
+            }
+            return
+          }
         }
       }
     }()

package/internal/lspserver/lsp_index_byte_from_bounds_its_search_start_test.go

@@ -2,18 +2,20 @@ package lspserver
 
 import "testing"
 
-// TestLSPIndexByteFromBoundsItsSearchStart verifies the line scanner behind
-// offsetForPosition answers identically at and past the edges of the buffer.
+// TestLSPIndexByteFromBoundsItsSearchStart checks the helper's search boundaries.
 //
-// The hand-rolled loop this replaced started at `from` and compared `from <
-// len(text)` on every step, so an out-of-range start simply fell out of the
-// loop. Slicing before delegating to strings.IndexByte would panic on the same
-// input, and the position path reaches it for a cursor on the last line of a
-// buffer that has no trailing newline.
+// An out-of-range start must simply find nothing. Slicing before delegating to
+// strings.IndexByte would panic on those cases. No active position conversion
+// calls this helper; the unit does not certify offsetForPosition or a request.
 //
 //  1. Search from inside, at, and past the end of a buffer.
 //  2. Search from a negative start.
 //  3. Assert every answer is the offset the caller can index with, or -1.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual indexByteFrom returns six literal offsets for newline searches with start, interior, after-last-newline, EOF, past-EOF and negative starts, plus -1 for an empty buffer. A panic fails these calls; other target bytes or arbitrary integer/string inputs are not certified.
+// @evidence contracts/testing.md#independent-expectations Expected offsets are literals for each start position.
+// @evidence contracts/testing.md#distinguishing-cases Inside, end, past-end and negative starts are the boundary inputs.
+// @evidence contracts/testing.md#execution-ownership This Go unit directly calls the actual package-local string helper with authored strings/start offsets and compares literal integers. It substitutes no operation and creates no directory or sidecar; no compiler, process, product host, position-conversion caller or LSP transport runs.
 func TestLSPIndexByteFromBoundsItsSearchStart(t *testing.T) {
   const text = "alpha\nbeta\ngamma"
   for _, entry := range []struct {

package/internal/lspserver/lsp_initialize_constrains_position_encoding_to_utf16_test.go

@@ -6,26 +6,31 @@ import (
   "errors"
   "io"
   "testing"
+  "time"
 )
 
-// TestLSPInitializeConstrainsPositionEncodingToUTF16 verifies that the offer
-// forwarded to tsgo can only ever select UTF-16, and that a client which did not
-// offer UTF-8 reaches tsgo byte for byte as before.
+// TestLSPInitializeConstrainsPositionEncodingToUTF16 checks authored offer
+// rewrites, selected sibling values, pass-through bytes and a buffered pump.
 //
-// LSP 3.17 negotiates one PositionEncodingKind per session. The pinned
-// typescript-go selects `utf-8` whenever a client offers it and advertises that
-// choice back through the proxy, while every position ttsc computes itself — the
-// incremental buffer cache, plugin completion, the lint sidecar's ranges, the
-// graph symbol provider — counts UTF-16 code units. ttscserver therefore settles
-// the negotiation at the initialize request instead of tracking it, so the two
-// halves of one editor response cannot disagree.
+// Three explicit non-UTF16 offers are rewritten to the UTF16 singleton; seven
+// authored already-default/non-request cases retain their original bytes.
+// The actual editor pump writes a constrained frame to a bytes.Buffer, not to
+// an executing tsgo process. This does not certify every downstream position
+// consumer, an actual negotiated session or all sibling fields/byte spelling.
+// A separate empty-stream group owns pre-initialize EOF, unchanged empty
+// editor output, nil proxy result and actual in-process upstream input closure.
+// Its bounded wait is a test failure guard, not a product close deadline.
 //
 //  1. Forward an initialize request offering UTF-8 first and assert the upstream
-//     frame offers UTF-16 alone while every sibling field survives verbatim.
+//     frame offers UTF-16 alone while selected decoded sibling values survive.
 //  2. Assert an offer of UTF-16 alone, an absent offer, and a non-initialize
 //     envelope are returned unchanged.
-//  3. Drive the real editor-to-upstream pump and assert the rewrite is what tsgo
-//     actually receives.
+//  3. Drive the actual buffered pump and assert the emitted offer is UTF-16.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual constrainInitializePositionEncoding rewrites three authored offers to the literal UTF16 singleton, preserves selected decoded sibling values and returns seven quiet-case bodies byte for byte. The framed pump emits UTF16 and returns ErrFrameClosed. Actual Proxy.Run before initialize returns nil with empty editor bytes and closes the owned upstream io.Pipe writer so its reader observes EOF; no upstream process consumes bytes here.
+// @evidence contracts/testing.md#independent-expectations Expected offer values, selected sibling values and EOF sentinel are independent literals; pass-through cases compare to their original authored bytes. Rewritten-frame byte identity and unlisted sibling fields are not asserted.
+// @evidence contracts/testing.md#distinguishing-cases UTF8+UTF16, UTF8-only and UTF32+UTF8 offers change; UTF16-only, missing/null/empty offer, missing general capabilities, another method and an initialize notification pass through. Shared branches are not claimed as ten distinct algorithms.
+// @evidence contracts/testing.md#execution-ownership This Go unit directly invokes the actual constraint and actual framed editor-to-upstream pump through supported streams, then decodes returned frames. The empty-stream group runs actual Proxy.Run with owned io.Pipe endpoints and no supplied peer responses to verify EOF closure/returned nil; it authenticates no OS child or initialized server. No compiler, native process, installed consumer, product host or editor runs.
 func TestLSPInitializeConstrainsPositionEncodingToUTF16(t *testing.T) {
   const offeringUTF8 = `{"jsonrpc":"2.0","id":1,"method":"initialize","params":` +
     `{"processId":4242,"rootUri":"file:///project","capabilities":` +
@@ -33,7 +38,7 @@ func TestLSPInitializeConstrainsPositionEncodingToUTF16(t *testing.T) {
     `"textDocument":{"completion":{"dynamicRegistration":true}}}}}`
 
   rewritten := constrainInitializePositionEncoding(mustParseEnvelope(t, offeringUTF8), []byte(offeringUTF8))
-  assertPositionEncodings(t, rewritten, []string{positionEncodingUTF16})
+  assertPositionEncodings(t, rewritten, []string{"utf-16"})
   assertInitializeSiblingsSurvive(t, rewritten)
 
   const offeringUTF8Only = `{"jsonrpc":"2.0","id":1,"method":"initialize","params":` +
@@ -41,7 +46,7 @@ func TestLSPInitializeConstrainsPositionEncodingToUTF16(t *testing.T) {
   assertPositionEncodings(
     t,
     constrainInitializePositionEncoding(mustParseEnvelope(t, offeringUTF8Only), []byte(offeringUTF8Only)),
-    []string{positionEncodingUTF16},
+    []string{"utf-16"},
   )
 
   const offeringUTF32 = `{"jsonrpc":"2.0","id":1,"method":"initialize","params":` +
@@ -49,11 +54,10 @@ func TestLSPInitializeConstrainsPositionEncodingToUTF16(t *testing.T) {
   assertPositionEncodings(
     t,
     constrainInitializePositionEncoding(mustParseEnvelope(t, offeringUTF32), []byte(offeringUTF32)),
-    []string{positionEncodingUTF16},
+    []string{"utf-16"},
   )
 
-  // Negative twins: a client that never offered UTF-8 must reach tsgo exactly as
-  // it wrote its request, so no existing session changes shape.
+  // These authored default/non-request cases keep their original bytes.
   unchanged := []struct {
     name string
     body string
@@ -105,8 +109,7 @@ func TestLSPInitializeConstrainsPositionEncodingToUTF16(t *testing.T) {
     })
   }
 
-  // The helper is only correct if it sits on the forwarding path, so drive the
-  // real pump and read what tsgo would have received.
+  // Drive the actual forwarding pump with buffers and inspect its output frame.
   var editorIn bytes.Buffer
   if err := WriteFrame(&editorIn, []byte(offeringUTF8)); err != nil {
     t.Fatalf("write editor frame: %v", err)
@@ -124,7 +127,40 @@ func TestLSPInitializeConstrainsPositionEncodingToUTF16(t *testing.T) {
   if err != nil {
     t.Fatalf("read forwarded initialize: %v", err)
   }
-  assertPositionEncodings(t, forwarded, []string{positionEncodingUTF16})
+  assertPositionEncodings(t, forwarded, []string{"utf-16"})
+  t.Run("uninitialized_empty_stream_closes_upstream_input", func(t *testing.T) {
+    upstreamRead, upstreamWrite := io.Pipe()
+    t.Cleanup(func() { upstreamWrite.Close(); upstreamRead.Close() })
+    var editorOut bytes.Buffer
+    emptyProxy := NewProxy(ProxyOptions{
+      EditorIn: bytes.NewReader(nil), EditorOut: &editorOut,
+      UpstreamIn: upstreamWrite, UpstreamOut: bytes.NewReader(nil),
+    })
+    if err := emptyProxy.Run(t.Context()); err != nil {
+      t.Fatalf("empty stream result = %v", err)
+    }
+    if editorOut.Len() != 0 {
+      t.Fatalf("empty stream invented editor bytes: %q", editorOut.Bytes())
+    }
+    closed := make(chan error, 1)
+    go func() {
+      var one [1]byte
+      n, err := upstreamRead.Read(one[:])
+      if n != 0 {
+        closed <- errors.New("empty stream wrote upstream bytes")
+        return
+      }
+      closed <- err
+    }()
+    select {
+    case err := <-closed:
+      if !errors.Is(err, io.EOF) {
+        t.Fatalf("upstream input closure = %v", err)
+      }
+    case <-time.After(2 * time.Second):
+      t.Fatal("empty editor EOF did not close its upstream input")
+    }
+  })
 }
 
 func mustParseEnvelope(t *testing.T, body string) Envelope {

package/internal/lspserver/lsp_late_completion_trigger_is_reported_once_test.go

@@ -7,9 +7,9 @@ import (
   "testing"
 )
 
-// mutableCompletionHintSource stands in for a plugin source whose corpus changes
-// mid-session. The lock is real: the proxy reads the corpus from the completion
-// path while a refresh rewrites it.
+// mutableCompletionHintSource owns the supplied corpus for direct proxy calls.
+// Its mutex protects publication and shallow slice copying; this test uses those
+// operations sequentially and does not mutate the nested item slices.
 type mutableCompletionHintSource struct {
   NullPluginSource
   mu    sync.RWMutex
@@ -28,21 +28,21 @@ func (s *mutableCompletionHintSource) publish(hints ...LSPCompletionHint) {
   s.hints = hints
 }
 
-// TestLSPLateCompletionTriggerIsReportedOnce pins the one thing a corpus refresh
-// still cannot deliver on its own.
+// TestLSPLateCompletionTriggerIsReportedOnce observes the proxy's late-trigger
+// notice policy using an owned mutable corpus and a buffered editor output.
+// Calling augmentInitializeResult records the supplied upstream trigger set;
+// its returned response is not sent to or consumed by an editor in this unit.
+// The test does not execute client capability registration, completion requests
+// or an editor's provider behavior.
 //
-// Trigger characters are merged into the initialize response, and the editor has
-// already consumed it by the time a refresh runs. LSP's only remedy is
-// client/registerCapability, which VS Code implements by adding a second
-// completion provider beside the static one — every item tsgo returns would then
-// be offered twice. Corrupting the compiler's list to advertise one character is
-// the worse trade, so the proxy states the gap instead of hiding it. Saying it
-// once per character is the whole design: a refresh runs on every save, and a
-// notice repeated per save would be noise the user learns to ignore.
-//
-//  1. Answer initialize with tsgo's trigger characters and no corpus.
+//  1. Keep a pre-initialize corpus quiet, then record supplied upstream triggers.
 //  2. Publish a corpus whose trigger is new and refresh; expect one notice.
 //  3. Refresh again, and publish a trigger tsgo already advertised; expect none.
+//
+// @evidence contracts/testing.md#behavioral-verification Direct refresh notifications before recorded initialize state emit nothing; a later space trigger emits one buffered window/logMessage notice containing the quoted space and restart text, while its repeat and an advertised @ trigger emit no bytes. This does not observe client delivery or completion item behavior.
+// @evidence contracts/testing.md#independent-expectations Literal zero/one notice counts, quoted-space text and restart text distinguish the supplied policy stages. The notice helper selects stream chunks containing the method text; it does not independently validate frame lengths or every JSON field.
+// @evidence contracts/testing.md#distinguishing-cases The same space corpus is quiet before initialize and reported afterward, then remains quiet on repetition; an upstream-advertised @ corpus is also quiet. Only these supplied trigger distinctions are exercised.
+// @evidence contracts/testing.md#execution-ownership The discoverable Go unit directly calls Proxy augmentation and refresh operations with an owned optional CompletionHints source and bytes.Buffer output. It creates no temporary project, native child, installed consumer or product host; the source's mutex is real but this body runs its writes and reads sequentially.
 func TestLSPLateCompletionTriggerIsReportedOnce(t *testing.T) {
   var editor bytes.Buffer
   source := &mutableCompletionHintSource{}
@@ -84,8 +84,7 @@ func TestLSPLateCompletionTriggerIsReportedOnce(t *testing.T) {
     t.Fatalf("the same late trigger was reported again on the next refresh:\n%s", editor.String())
   }
 
-  // A trigger tsgo already advertises is not late at all — the editor is already
-  // asking for completion on it, so the hint works with no restart.
+  // The supplied initialize result advertised @, so it is not a late trigger.
   source.publish(LSPCompletionHint{Scope: "jsdoc", After: "@", Items: []LSPCompletionItem{{Insert: "param"}}})
   proxy.completionHintsRefreshed()
   if editor.Len() != 0 {

package/internal/lspserver/lsp_native_completion_hints_decode_flat_lint_wire_test.go

@@ -5,7 +5,8 @@ import (
   "testing"
 )
 
-// TestNativeCompletionHintsDecodeFlatLintWire verifies the real lint boundary.
+// TestNativeCompletionHintsDecodeFlatLintWire verifies authored flat-wire
+// decoding followed by direct matching, without invoking a lint producer.
 //
 // @ttsc/lint publishes a flat []rule.Hint rather than the proxy's grouped
 // matching shape. Repeated triggers must coalesce without moving the group or
@@ -13,7 +14,12 @@ import (
 //
 //  1. Decode interleaved flat hints using the exact public rule.Hint JSON shape.
 //  2. Assert first-trigger group order and per-trigger item order are preserved.
-//  3. Feed the decoded corpus to the live matcher and verify it is offerable.
+//  3. Feed the decoded corpus to the actual matcher for one supplied prefix.
+//
+// @evidence contracts/testing.md#behavioral-verification Three authored flat hints decode into two complete literal groups, retaining group and per-trigger item order and selected item fields. A direct matcher call with supplied inJSDoc=true requires docs/ filter and the first group's literal items; no real lint publication or lexical cursor classification runs.
+// @evidence contracts/testing.md#independent-expectations The expected group and item order are literals taken from the public rule.Hint JSON shape.
+// @evidence contracts/testing.md#distinguishing-cases Interleaving one repeated trigger around a distinct trigger distinguishes group/order preservation, including absent optional label/detail fields. One more-specific trigger wins in the supplied prefix; malformed or grouped input and false lexical admission are outside this case.
+// @evidence contracts/testing.md#execution-ownership The discoverable Go unit directly calls actual decodeNativeCompletionHints and matchCompletionHints on authored JSON and prefix values, using complete literal expectations. It builds or starts no native artifact/producer, installs no consumer and creates no filesystem or product host.
 func TestNativeCompletionHintsDecodeFlatLintWire(t *testing.T) {
   body := []byte(`[
     {

package/internal/lspserver/lsp_native_completion_hints_grouped_compatibility_boundary_test.go

@@ -15,6 +15,11 @@ import (
 //  1. Decode a grouped response containing valid and empty entries.
 //  2. Assert the valid group's item order survives and empty entries are dropped.
 //  3. Assert a field with the wrong JSON type rejects the response.
+//
+// @evidence contracts/testing.md#behavioral-verification A grouped hint response keeps valid groups in item order, drops empty items and empty triggers, and a field of the wrong JSON type rejects the response.
+// @evidence contracts/testing.md#independent-expectations The expected corpus and the rejection are literal.
+// @evidence contracts/testing.md#distinguishing-cases One valid grouped hint with an empty middle item is interleaved with grouped/flat empty scope, trigger or item cases and an empty object; a separate numeric flat insert must return an error. This does not execute a third-party publisher or certify every malformed JSON shape.
+// @evidence contracts/testing.md#execution-ownership The discoverable Go unit directly calls actual decodeNativeCompletionHints on two authored JSON payloads. Complete literal grouped/item expectations and an error-presence assertion own the observations; it creates no filesystem, child, substitute operation, installed consumer or product host.
 func TestNativeCompletionHintsKeepGroupedWireAndRejectInvalidEntries(t *testing.T) {
   body := []byte(`[
     {