ttsc 0.30.4 → 0.31.0

package/internal/lspserver/lsp_reload_directories_compare_immediate_topology_test.go

@@ -1,33 +1,67 @@
 package lspserver
 
 import (
+  "crypto/sha256"
+  "errors"
+  "fmt"
   "net/url"
   "os"
   "path/filepath"
+  "runtime"
+  "syscall"
   "testing"
 )
 
 // TestLSPReloadDirectoriesCompareImmediateTopology verifies reload-directory
-// notifications restart only when the declared non-recursive topology changes.
+// direct reload-policy results distinguish the authored native mutations.
 //
 // A directory fingerprint represents resolution identity, not the contents of
-// every child. Treating every descendant event as a restart turns ordinary
-// edits into crashes, while ignoring directory identity or symlink targets
-// leaves contributor selection stale.
+// every child. This test observes policy booleans after real mutations, not an
+// actual notification, server restart, crash or contributor-selection reload.
 //
-//  1. Record a directory with one file and one nested directory.
-//  2. Prove child-content and nested-descendant edits leave its digest stable.
-//  3. Prove immediate creation and deletion change the digest.
-//  4. Prove deleting the watched directory itself changes the digest.
-//  5. Where supported, retarget a symlink without renaming it and prove the raw
-//     link target participates in the digest.
-//  6. Replace an empty directory with the same topology and prove its identity
-//     event still restarts selection.
-//  7. Nest one reload directory in another and prove the unchanged parent
-//     cannot hide an immediate topology change in the child.
-//  8. Rediscover project inputs after topology drift and prove refresh retains
-//     the selection-time baseline until the server restarts.
+//  1. Require no match for child-content and undeclared nested-descendant edits.
+//  2. Require matches for immediate create/delete and directory delete/replace.
+//  3. Require a declared nested child and preserved older baseline to match drift.
+//  4. Where privilege permits, require a symlink retarget to match.
+//
+// @evidence contracts/testing.md#behavioral-verification Direct ProjectInputReloadMatchesChange calls return false for two content edits and true for immediate create/delete, directory delete/replace, a declared nested child's creation, drift after explicit baseline preservation and the conditional symlink retarget. Directory-self matches are identity policy, not assertions that its digest changed.
+// @evidence contracts/testing.md#independent-expectations Each mutation has an authored literal true/false expectation. Empty and missing directory topology and directory framing are independently hashed; the physical path key is an observed input to that framing, not an independent identity oracle. No client event/restart or JavaScript interoperability is certified.
+// @evidence contracts/testing.md#distinguishing-cases Content versus immediate topology, undeclared versus declared nested territory, same-topology directory replacement and retained versus recomputed baseline are distinguished by supplied operations. The symlink subtest reports Windows privilege-only unavailability explicitly instead of silently omitting it.
+// @evidence contracts/testing.md#execution-ownership The discoverable Go unit runs actual normalizer, fingerprint preservation and reload matcher over owned temporary native files/directories. It starts no child, installs no consumer or host and substitutes no operation. The symlink lane skips only Windows privilege-not-held; other fixture errors fail.
 func TestLSPReloadDirectoriesCompareImmediateTopology(t *testing.T) {
+  t.Run("empty_and_missing_directory_protocol_frames", func(t *testing.T) {
+    root := t.TempDir()
+    existing := filepath.Join(root, "ExistingDirectory")
+    if err := os.Mkdir(existing, 0o755); err != nil {
+      t.Fatal(err)
+    }
+    for _, row := range []struct {
+      directory     string
+      topologyInput string
+    }{
+      {existing, ""},
+      {filepath.Join(root, "MissingDirectory"), "missing\x00"},
+    } {
+      topology := sha256.Sum256([]byte(row.topologyInput))
+      frame := "directory\x00" + projectInputPhysicalPathKey(row.directory) + "\x00" + fmt.Sprintf("%x", topology)
+      expected := sha256.Sum256([]byte(frame))
+      digest := fmt.Sprintf("%x", expected)
+      if got := projectInputReloadDirectoryDigest(row.directory); got != digest {
+        t.Fatalf("directory %q frame = %s, want %s", row.directory, got, digest)
+      }
+      snapshot, err := normalizeLSPProjectInputSnapshot(LSPProjectInputSnapshot{
+        Root:                   root,
+        ReloadDirectories:      []string{row.directory},
+        ReloadDirectoryDigests: map[string]string{row.directory: digest},
+      }, root)
+      if err != nil {
+        t.Fatal(err)
+      }
+      if !projectInputReloadFingerprintsAreCurrent(snapshot) {
+        t.Fatalf("unchanged directory %q began stale", row.directory)
+      }
+    }
+  })
   root := t.TempDir()
   reloadDirectory := filepath.Join(root, "config-deps")
   nested := filepath.Join(reloadDirectory, "nested")
@@ -173,8 +207,21 @@ func TestLSPReloadDirectoriesCompareImmediateTopology(t *testing.T) {
     }
   }
   link := filepath.Join(reloadDirectory, "selection-link")
-  if err := os.Symlink(firstTarget, link); err == nil {
-    source.projectInputs = snapshot(reloadDirectory)
+  t.Run("symlink retarget", func(t *testing.T) {
+    if err := os.Symlink(firstTarget, link); err != nil {
+      if runtime.GOOS == "windows" && errors.Is(err, syscall.Errno(1314)) {
+        t.Skipf("Windows symlink privilege is unavailable: %v", err)
+      }
+      t.Fatalf("create owned symlink: %v", err)
+    }
+    linkSnapshot, err := normalizeLSPProjectInputSnapshot(LSPProjectInputSnapshot{
+      Root:              root,
+      ReloadDirectories: []string{reloadDirectory},
+    }, root)
+    if err != nil {
+      t.Fatalf("normalize symlink reload directory: %v", err)
+    }
+    source.projectInputs = linkSnapshot
     if err := os.Remove(link); err != nil {
       t.Fatal(err)
     }
@@ -184,5 +231,5 @@ func TestLSPReloadDirectoriesCompareImmediateTopology(t *testing.T) {
     if !source.ProjectInputReloadMatchesChange(uri(link), &changed) {
       t.Fatal("symlink retarget did not change directory topology")
     }
-  }
+  })
 }

package/internal/lspserver/lsp_reload_directories_separate_glob_territory_test.go

@@ -1,25 +1,33 @@
 package lspserver
 
 import (
+  "errors"
   "net/url"
   "os"
   "path/filepath"
+  "runtime"
+  "syscall"
   "testing"
 )
 
 // TestLSPReloadDirectoriesSeparateGlobTerritory verifies the native LSP host
-// applies the same data-versus-selection boundary as the CLI watcher.
+// reload matcher distinguishes the supplied glob territory and selection paths.
 //
 // A reload directory records resolution topology, but a declared glob's
 // literal root appearing strictly below it is an ordinary data-population
-// transition. Restarting the JavaScript launcher for that event loses the
-// resident process that should instead reload its Program.
+// transition in the direct policy. This unit does not run a CLI watcher,
+// JavaScript launcher, resident process or Program reload.
 //
 //  1. Create a missing glob root directly inside a reload directory and prove
 //     it remains on the warm data lane.
 //  2. Prove unrelated immediate entries and the directory itself remain cold.
 //  3. Prove exact reload files are never exempt inside glob territory.
 //  4. Prove a glob rooted on or above the reload directory exempts nothing.
+//
+// @evidence contracts/testing.md#behavioral-verification Direct reload-policy booleans exempt a newly created literal glob root and its in-root symlink form, but match unrelated immediate entries, the directory itself, an exact reload file, an outside-root symlink target and globs rooted on or above the reload directory. Warm/cold process lifetimes are not observed.
+// @evidence contracts/testing.md#independent-expectations Each supplied native mutation has a literal true/false expectation independent of the matcher. Real normalized snapshots establish baselines; no particular digest value or process reuse is certified.
+// @evidence contracts/testing.md#distinguishing-cases The six named subtests distinguish below-root territory, exact-file precedence, symlink targets inside/outside the reload directory and globs on/above it. Both symlink cases expose Windows privilege-only skips; other fixture errors fail.
+// @evidence contracts/testing.md#execution-ownership The discoverable Go unit and its named subtests call actual snapshot normalization and NativePluginSource.ProjectInputReloadMatchesChange over owned temporary native inputs. The snapshot helper receives the current subtest's testing handle for failure ownership. No child, installed consumer, substitute operation or product host is used.
 func TestLSPReloadDirectoriesSeparateGlobTerritory(t *testing.T) {
   uri := func(location string) string {
     normalized := filepath.ToSlash(location)
@@ -29,6 +37,7 @@ func TestLSPReloadDirectoriesSeparateGlobTerritory(t *testing.T) {
     return (&url.URL{Scheme: "file", Path: normalized}).String()
   }
   snapshot := func(
+    t *testing.T,
     root string,
     globs []string,
     reloadFiles []string,
@@ -55,6 +64,7 @@ func TestLSPReloadDirectoriesSeparateGlobTerritory(t *testing.T) {
     globRoot := filepath.Join(root, "api")
     source := &NativePluginSource{
       projectInputs: snapshot(
+        t,
         root,
         []string{filepath.Join(globRoot, "**", "*.json")},
         nil,
@@ -68,6 +78,7 @@ func TestLSPReloadDirectoriesSeparateGlobTerritory(t *testing.T) {
     }
 
     source.projectInputs = snapshot(
+      t,
       root,
       []string{filepath.Join(globRoot, "**", "*.json")},
       nil,
@@ -90,6 +101,7 @@ func TestLSPReloadDirectoriesSeparateGlobTerritory(t *testing.T) {
     reloadFile := filepath.Join(globRoot, "selection.json")
     source := &NativePluginSource{
       projectInputs: snapshot(
+        t,
         root,
         []string{filepath.Join(globRoot, "**", "*.json")},
         []string{reloadFile},
@@ -115,13 +127,17 @@ func TestLSPReloadDirectoriesSeparateGlobTerritory(t *testing.T) {
     }
     source := &NativePluginSource{
       projectInputs: snapshot(
+        t,
         root,
         []string{filepath.Join(globRoot, "**", "*.json")},
         nil,
       ),
     }
     if err := os.Symlink(physicalData, globRoot); err != nil {
-      t.Skipf("directory symlinks unavailable: %v", err)
+      if runtime.GOOS == "windows" && errors.Is(err, syscall.Errno(1314)) {
+        t.Skipf("Windows symlink privilege is unavailable: %v", err)
+      }
+      t.Fatalf("create owned directory symlink: %v", err)
     }
     if source.ProjectInputReloadMatchesChange(uri(globRoot), &created) {
       t.Fatal("symlinked glob root lost its physical data identity")
@@ -134,13 +150,17 @@ func TestLSPReloadDirectoriesSeparateGlobTerritory(t *testing.T) {
     physicalData := t.TempDir()
     source := &NativePluginSource{
       projectInputs: snapshot(
+        t,
         root,
         []string{filepath.Join(globRoot, "**", "*.json")},
         nil,
       ),
     }
     if err := os.Symlink(physicalData, globRoot); err != nil {
-      t.Skipf("directory symlinks unavailable: %v", err)
+      if runtime.GOOS == "windows" && errors.Is(err, syscall.Errno(1314)) {
+        t.Skipf("Windows symlink privilege is unavailable: %v", err)
+      }
+      t.Fatalf("create owned directory symlink: %v", err)
     }
     if !source.ProjectInputReloadMatchesChange(uri(globRoot), &created) {
       t.Fatal("glob root outside reload directory exempted selection")
@@ -167,7 +187,7 @@ func TestLSPReloadDirectoriesSeparateGlobTerritory(t *testing.T) {
     t.Run(test.name, func(t *testing.T) {
       root := t.TempDir()
       source := &NativePluginSource{
-        projectInputs: snapshot(root, []string{test.glob(root)}, nil),
+        projectInputs: snapshot(t, root, []string{test.glob(root)}, nil),
       }
       entry := filepath.Join(root, "new-package")
       if err := os.Mkdir(entry, 0o755); err != nil {

package/internal/lspserver/lsp_reload_file_fingerprint_preserves_raw_symlink_target_test.go

@@ -10,29 +10,35 @@ import (
 )
 
 // TestReloadFileFingerprintPreservesRawSymlinkTarget verifies the Go startup
-// validator hashes exact-file symlinks with the launcher's byte protocol.
+// validator hashes one dangling exact-file symlink using raw target bytes.
 //
 // Decoding a POSIX link target as UTF-8 replaces invalid bytes, making an
-// unchanged launcher snapshot disagree with the native validator forever. The
-// capability check keeps the vector portable to filesystems that cannot retain
-// the raw name while requiring byte fidelity wherever they can.
+// unchanged launcher snapshot disagree with the native validator. The unit
+// compares Go output with independently authored protocol records; it does not
+// execute the launcher. A creation error skips without identifying its cause,
+// and successful creation must retain the raw bytes to exercise this vector.
 //
 //  1. Create a dangling symlink with a non-UTF-8 raw target where supported.
 //  2. Read it back and continue only when the filesystem preserved the bytes.
 //  3. Hash the protocol's symlink, raw target, and missing-content records.
 //  4. Assert the production fingerprint is exactly that digest.
+//
+// @evidence contracts/testing.md#behavioral-verification The production fingerprint of a dangling symlink with a non-UTF-8 raw target equals the digest of the protocol's symlink, raw target and missing-content records.
+// @evidence contracts/testing.md#independent-expectations The expected digest is computed independently from the protocol bytes in the test.
+// @evidence contracts/testing.md#distinguishing-cases The target starts with invalid UTF-8 byte 0xff followed by x, and the dangling link contributes the missing-content marker. Successful native read-back must equal those bytes; creation failure or changed read-back skips this vector, without proving a particular capability failure. Valid UTF-8 links, readable linked files and read-error recovery are not covered.
+// @evidence contracts/testing.md#execution-ownership The discoverable Go unit creates and reads one actual symlink in an owned temporary root, calls actual projectInputReloadFileDigest, and constructs expected SHA-256 input independently with literal framing and target bytes. No substituted operation, native child, sidecar, installed consumer, product host or launcher executes.
 func TestReloadFileFingerprintPreservesRawSymlinkTarget(t *testing.T) {
   target := string([]byte{0xff, 'x'})
   link := filepath.Join(t.TempDir(), "reload-link")
   if err := os.Symlink(target, link); err != nil {
-    return
+    t.Skipf("raw-byte symlink fixture creation failed: %v", err)
   }
   retained, err := os.Readlink(link)
   if err != nil {
     t.Fatal(err)
   }
   if !bytes.Equal([]byte(retained), []byte(target)) {
-    return
+    t.Skip("filesystem did not retain the raw non-UTF-8 link target")
   }
 
   digest := sha256.New()

package/internal/lspserver/lsp_reload_fingerprints_read_a_junction_as_a_link_test.go

@@ -0,0 +1,76 @@
+package lspserver
+
+import (
+  "crypto/sha256"
+  "fmt"
+  "os"
+  "path/filepath"
+  "runtime"
+  "testing"
+
+  "github.com/samchon/ttsc/packages/ttsc/driver/windowsjunction"
+)
+
+// TestReloadFingerprintsReadAJunctionAsALink verifies the Go startup validator
+// fingerprints one Windows junction using independently framed link records.
+//
+// The launcher's Node reads a junction as a symbolic link with its target, and
+// Go reports it as an irregular entry, so hashing it as `other` would make an
+// exact input that is a junction, and a reload directory holding one, never match
+// the digests the launcher recorded: pnpm links a package into node_modules as a
+// junction on Windows, and a plugin selection loaded through one would refuse
+// every session as changed during startup.
+//
+//  1. Create a junction to a directory, inside a directory, on Windows.
+//  2. Assert the exact-file fingerprint is the protocol's symlink record: the
+//     target, then missing content, as a directory reads as none.
+//  3. Assert the directory fingerprint lists the junction as a symlink with its
+//     target.
+//
+// @evidence contracts/testing.md#behavioral-verification On Windows actual exact-file and immediate-directory topology digests match independently framed symlink records for a created junction. The directory target contributes missing file content; no actual launcher, pnpm installation or startup session is executed.
+// @evidence contracts/testing.md#independent-expectations Literal file framing and literal link-name/kind topology framing feed a separate SHA-256 calculation. Target bytes come from native os.Readlink, so this distinguishes record-kind/framing errors without independently certifying native target spelling or Node parity.
+// @evidence contracts/testing.md#distinguishing-cases One junction to an empty directory is checked both as an exact file and as the single immediate topology entry. Other entry kinds, retargeting and unreadable targets are not exercised; non-Windows discovery reaches an explicit runtime skip.
+// @evidence contracts/testing.md#execution-ownership The Go unit is discoverable on all platforms and uses a runtime Windows guard, not a Windows build tag. On Windows it owns temporary directories, creates the junction through actual windowsjunction.Create and its native setup child, then calls both actual digest operations. No sidecar, installed consumer, Node launcher or product host runs.
+func TestReloadFingerprintsReadAJunctionAsALink(t *testing.T) {
+  if runtime.GOOS != "windows" {
+    t.Skip("junctions exist only on Windows")
+  }
+  root := t.TempDir()
+  target := filepath.Join(root, "target")
+  if err := os.Mkdir(target, 0o755); err != nil {
+    t.Fatal(err)
+  }
+  parent := filepath.Join(root, "parent")
+  if err := os.Mkdir(parent, 0o755); err != nil {
+    t.Fatal(err)
+  }
+  junction := filepath.Join(parent, "link")
+  if err := windowsjunction.Create(junction, target); err != nil {
+    t.Fatal(err)
+  }
+  retained, err := os.Readlink(junction)
+  if err != nil {
+    t.Fatal(err)
+  }
+
+  file := sha256.New()
+  file.Write([]byte("symlink\x00"))
+  file.Write([]byte(retained))
+  file.Write([]byte{0})
+  file.Write([]byte("missing\x00"))
+  if got, want := projectInputReloadFileDigest(junction),
+    fmt.Sprintf("%x", file.Sum(nil)); got != want {
+    t.Fatalf("junction digest = %s, want the symlink protocol %s", got, want)
+  }
+
+  topology := sha256.New()
+  topology.Write([]byte("link\x00symlink\x00" + retained))
+  if got, want := projectInputReloadDirectoryTopologyDigest(parent),
+    fmt.Sprintf("%x", topology.Sum(nil)); got != want {
+    t.Fatalf(
+      "directory digest = %s, want the junction listed as a symlink %s",
+      got,
+      want,
+    )
+  }
+}

package/internal/lspserver/lsp_resident_falls_back_when_serve_unsupported_test.go

@@ -2,36 +2,43 @@ package lspserver
 
 import (
   "bytes"
+  "os/exec"
   "testing"
 )
 
-// TestResidentFallsBackWhenServeUnsupported verifies a sidecar that cannot serve
-// degrades to the spawn-per-verb path instead of losing the verb.
+// TestResidentFallsBackWhenServeUnsupported verifies failed resident launch
+// reports served=false and records unsupported transport state.
 //
-// Every sidecar built before lsp-serve rejects it, and a resident child can also
-// fail to spawn; either way the read verb must still run. serveRun signals that
-// by returning served=false so run() falls through to exec. It must also mark
-// the binary unsupported after a first-spawn failure, or the source would
-// spawn-and-fail per request forever.
+// A resident child can fail to spawn. serveRun reports served=false so its
+// caller can choose direct execution, and marks a transport unsupported when
+// it never answered. This case observes the marker without launching a real
+// older sidecar or counting subsequent failed launch attempts.
 //
-// A binary that cannot be launched reaches the same spawn error as a sidecar
-// that rejects the verb, so an unresolvable name is a faithful stand-in and
-// keeps the test from needing a compiled fixture (mirrors the hint-absence
-// test).
+// A missing executable exercises launch failure, not an actual sidecar's
+// unsupported-verb reply. The unit calls serveRun directly, so it does not
+// observe run's later spawn-per-verb fallback or successful diagnostics.
 //
 //  1. serveRun a read verb against a plugin whose binary cannot launch.
 //  2. Assert it reports served=false (the caller falls back to exec).
-//  3. Assert the binary is marked unsupported, and a second call short-circuits.
+//  3. Assert unsupported state, then assert served=false on a second call.
+//
+// @evidence contracts/testing.md#behavioral-verification Both direct serveRun calls report served=false, and the first establishes the unsupported marker for the authored transport. Actual fallback execution and second-call launch counts are not asserted.
+// @evidence contracts/testing.md#independent-expectations Literal false outcomes and a literal transport-key lookup check the recorded unsupported state. exec.LookPath separately requires the authored binary to be unresolvable before exercising launch failure.
+// @evidence contracts/testing.md#distinguishing-cases The first call begins without unsupported state; the second begins after that marker is observed. A real unsupported reply, successful resident and actual direct fallback are outside these assertions.
+// @evidence contracts/testing.md#execution-ownership The discoverable Go unit calls actual serveRun with an owned source and bytes buffer. The native command launch is attempted only after independently confirming the executable is missing; no fixture is compiled, consumer installed, successful sidecar started or product host run, and no operation is substituted.
 func TestResidentFallsBackWhenServeUnsupported(t *testing.T) {
   source := &NativePluginSource{err: &bytes.Buffer{}}
   plugin := NativeLSPPluginEntry{Binary: "ttsc-no-such-serve-binary", Name: "@ttsc/legacy"}
+  if resolved, err := exec.LookPath(plugin.Binary); err == nil {
+    t.Fatalf("missing executable premise failed: %q resolves to %q", plugin.Binary, resolved)
+  }
 
   if _, served, _ := source.serveRun(plugin, serveVerbDiagnostics, []string{"--uri=file:///a.ts"}); served {
     t.Fatal("a sidecar that cannot spawn must fall back to exec (served=false)")
   }
 
   source.residentMu.Lock()
-  unsupported := source.serveUnsupported[pluginKey(plugin)]
+  unsupported := source.serveUnsupported["ttsc-no-such-serve-binary\x000"]
   source.residentMu.Unlock()
   if !unsupported {
     t.Fatal("a first-spawn failure must mark lsp-serve unsupported so the source stops retrying")

package/internal/lspserver/lsp_resident_invalidation_broadcasts_program_input_overlap_test.go

@@ -3,16 +3,21 @@ package lspserver
 import "testing"
 
 // TestLSPResidentInvalidationBroadcastsProgramInputOverlap verifies an input's
-// contributor ownership never hides its second role as a shared Program input.
+// supplied ownership does not suppress extension-based broadcast queueing.
 //
 // A TypeScript source or resolveJsonModule JSON file can be declared by one
-// producer while belonging to every resident Program. All residents must see
-// the content delta; the daemon itself skips an external path when its Program
-// does not contain it.
+// producer while qualifying for broadcast by the routing policy. This unit
+// inspects queued values on two empty resident records; no actual Program
+// membership, daemon receipt or content delta is executed.
 //
 //  1. Install two resident entries with distinct producer keys.
 //  2. Attribute one shared-Program URI to the first producer only.
 //  3. Assert both residents receive the changed and external deltas.
+//
+// @evidence contracts/testing.md#behavioral-verification Each supplied .ts/.json URI is queued once in both changed and external lists on both resident records despite a first-owner-only map. This observes extension-policy queueing, not native receipt or actual shared Program membership.
+// @evidence contracts/testing.md#independent-expectations Both records must contain exactly the authored URI in each list; those literal values are not derived from the routing result. Generated transport keys populate the input records, not the expected URI queues.
+// @evidence contracts/testing.md#distinguishing-cases Named .ts and .json subtests cover two extension-based broadcasts; the separate owner-only .md case distinguishes non-Program data. Ordinary changes, missing owner lists, duplicate batches and a full-invalidated record are not exercised here.
+// @evidence contracts/testing.md#execution-ownership The discoverable Go unit calls actual NativePluginSource.InvalidateResidentProgramsForOwnedWatchedChanges and its queueing helper on owned empty resident records. Binary names and URIs are opaque routing inputs; no filesystem, native child, installed consumer or product host is created.
 func TestLSPResidentInvalidationBroadcastsProgramInputOverlap(t *testing.T) {
   for _, externalURI := range []string{
     "file:///project/src/shared.ts",

package/internal/lspserver/lsp_resident_invalidation_targets_project_input_owners_test.go

@@ -3,11 +3,16 @@ package lspserver
 import "testing"
 
 // TestLSPResidentInvalidationTargetsProjectInputOwners verifies external data
-// changes reach only resident binaries whose producer declared the input.
+// queueing selects only the record named by the supplied owner map.
 //
 //  1. Install two resident entries with distinct producer keys.
 //  2. Attribute one external URI to the first producer.
 //  3. Assert only the first resident receives changed/external deltas.
+//
+// @evidence contracts/testing.md#behavioral-verification The authored .md URI is queued once in both changed and external lists on the first record and in neither list on the second. The supplied owner map is not derived from actual producer declarations, and no daemon receives an update here.
+// @evidence contracts/testing.md#independent-expectations Exact authored URI values/count one on the first record and count zero on the second are independent queue observations. Transport keys construct the fixture inputs; they do not generate the expected URI lists.
+// @evidence contracts/testing.md#distinguishing-cases One supplied owner and one non-owner distinguish scoped external data from broadcast; the separate overlap test owns .ts/.json broadcast. Missing owner lists, malformed URIs and subsequent queue consumption are outside this case.
+// @evidence contracts/testing.md#execution-ownership The discoverable Go unit directly calls actual NativePluginSource.InvalidateResidentProgramsForOwnedWatchedChanges on two owned empty resident records. It creates no native process or filesystem fixture, installs no consumer or host and substitutes no routing operation.
 func TestLSPResidentInvalidationTargetsProjectInputOwners(t *testing.T) {
   first := NativeLSPPluginEntry{Binary: "first", Name: "@ttsc/first"}
   second := NativeLSPPluginEntry{Binary: "second", Name: "@ttsc/second"}

package/internal/lspserver/lsp_resident_maps_verb_args_test.go

@@ -13,6 +13,11 @@ import "testing"
 //
 //  1. Map a code-actions argv carrying all three fields.
 //  2. Assert each field lands, verbatim, including JSON payloads.
+//
+// @evidence contracts/testing.md#behavioral-verification Direct serveRequestFromArgs maps authored --uri, --range-json and --context-json strings into a request with a literal code-actions verb and each field unchanged. The test does not invoke serveRun or observe daemon receipt or warm Program behavior.
+// @evidence contracts/testing.md#independent-expectations The expected request fields are the literal argv values.
+// @evidence contracts/testing.md#distinguishing-cases One call checks URI text and two opaque JSON-shaped payloads alongside the verb; dropping or changing any checked field fails. Missing, unknown or duplicate flags and JSON syntax validity are not exercised.
+// @evidence contracts/testing.md#execution-ownership The discoverable Go unit directly calls actual serveRequestFromArgs in-process with authored strings. No operation is substituted and no filesystem fixture, native child, sidecar, installed consumer or product host is used.
 func TestResidentMapsVerbArgs(t *testing.T) {
   req := serveRequestFromArgs("lsp-code-actions", []string{
     "--uri=file:///a.ts",

package/internal/lspserver/lsp_same_transport_entries_are_deduplicated_test.go

@@ -1,6 +1,7 @@
 package lspserver
 
 import (
+  "os/exec"
   "path/filepath"
   "testing"
 )
@@ -12,6 +13,11 @@ import (
 // composed aggregate and leaf can therefore have distinct names while invoking
 // the same binary with the same argv; treating them as separate producers would
 // duplicate diagnostics, inputs, completion hints, and command discovery.
+//
+// @evidence contracts/testing.md#behavioral-verification Two supplied entries with one binary and different names select the first representative, yield one literal input-owner key, aggregate one stored diagnostic and select one failed project-diagnostics query. Completion hints, command discovery, actual child argv and successful native output are not observed.
+// @evidence contracts/testing.md#independent-expectations Literal counts one, the first supplied name and an independently authored owner key establish deduplication. Diagnostic aggregation asserts count only, not every field. The missing shared binary is explicitly checked before failed native starts.
+// @evidence contracts/testing.md#distinguishing-cases Identical binary and effective context mode under different names are exercised across selection, stored input ownership, stored diagnostics and failed-query selection. Distinct binaries/context modes are outside this case.
+// @evidence contracts/testing.md#execution-ownership The discoverable Go unit directly calls transport selection and actual NativePluginSource stores, owner matching, snapshot aggregation and refresh. An owned temporary root supplies native path identity; the refresh reaches failed resident/direct starts under the checked missing-binary premise. It installs no consumer or running host and substitutes no operation.
 func TestLSPSameTransportEntriesAreDeduplicated(t *testing.T) {
   aggregate := NativeLSPPluginEntry{
     Binary:             "shared-sidecar",
@@ -22,6 +28,9 @@ func TestLSPSameTransportEntriesAreDeduplicated(t *testing.T) {
   }
   leaf := aggregate
   leaf.Name = "@ttsc/leaf"
+  if path, err := exec.LookPath(aggregate.Binary); err == nil {
+    t.Fatalf("missing-binary premise is false: %s", path)
+  }
 
   selected := selectPluginTransports(
     []NativeLSPPluginEntry{aggregate, leaf},
@@ -42,7 +51,7 @@ func TestLSPSameTransportEntriesAreDeduplicated(t *testing.T) {
   source.storeProjectInputs(aggregate, 1, snapshot)
   source.storeProjectInputs(leaf, 1, snapshot)
   owners := source.ProjectInputOwnersForURI(testFileURI(snapshot.Files[0]))
-  if len(owners) != 1 || owners[0] != pluginKey(aggregate) {
+  if len(owners) != 1 || owners[0] != "shared-sidecar\x000" {
     t.Fatalf("same transport input owners = %#v", owners)
   }