ttsc 0.30.4 → 0.31.1

package/internal/graph/dump_path_mapper_caches_alias_resolution_test.go

@@ -2,8 +2,8 @@ package graph
 
 import "testing"
 
-// TestDumpPathMapperCachesAliasResolution verifies repeated graph facts do not
-// repeat filesystem canonicalization for the same raw source path.
+// TestDumpPathMapperCachesAliasResolution counts a test-owned mapper's
+// canonicalizer callback for 100 repetitions of one supplied raw source path.
 //
 // A large graph maps one source through its node, IDs and many edge endpoints;
 // caching only after EvalSymlinks would turn those facts into repeated syscalls.
@@ -11,6 +11,11 @@ import "testing"
 //  1. Install a counting canonicalizer on one mapper.
 //  2. Map the same absolute source path repeatedly.
 //  3. Require one canonicalization and one stable wire coordinate.
+//
+// @evidence contracts/testing.md#behavioral-verification Mapping the same supplied absolute path 100 times must yield src/main.ts each time and call the test-owned canonicalize callback exactly once, without a latched mapper error. Actual graph fact traversal and native canonicalization counts are not observed.
+// @evidence contracts/testing.md#independent-expectations The expectations are literal: mapping the same absolute path 100 times under project C:/checkout/app must always return src/main.ts and call the replaceable canonicalizer exactly once. The test exercises the mapper through its canonicalize seam, so it proves caching, not the real EvalSymlinks result.
+// @evidence contracts/testing.md#distinguishing-cases Install a counting canonicalizer on one mapper; Map the same absolute source path repeatedly; Require one canonicalization and one stable wire coordinate.
+// @evidence contracts/testing.md#execution-ownership This same-package Go unit constructs one mapper and supplies its instance-owned canonicalize callback before directly invoking mapPath. The constructor still attempts best-effort native project canonicalization for host-compatible C:/checkout/app; that work occurs before the counter. No foreign method is replaced, graph Program loaded or product process started.
 func TestDumpPathMapperCachesAliasResolution(t *testing.T) {
   mapper := newDumpPathMapper("C:/checkout/app")
   calls := 0
@@ -26,4 +31,7 @@ func TestDumpPathMapperCachesAliasResolution(t *testing.T) {
   if calls != 1 {
     t.Fatalf("canonicalizer calls = %d, want 1", calls)
   }
+  if err := mapper.err(); err != nil {
+    t.Fatalf("mapping the repeated source path failed: %v", err)
+  }
 }

package/internal/graph/dump_path_mapper_rejects_unportable_roots_and_collisions_test.go

@@ -0,0 +1,53 @@
+package graph
+
+import (
+  "strings"
+  "testing"
+)
+
+// TestDumpPathMapperRejectsUnportableRootsAndCollisions checks two supplied
+// cross-root paths, a directly injected wire-claim collision, and NewDump's
+// cross-drive error. It does not traverse native source aliases or serialize.
+//
+//  1. Reject a different Windows drive and a different UNC share precisely.
+//  2. Force two physical sources through one coordinate and require a collision.
+//  3. Require NewDump to surface the root error before JSON serialization.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual mapPath must latch different-root errors for the authored drive and UNC-share pairs; direct claim calls must latch a collision for two distinct supplied physical keys at shared.ts. NewDump must return a cross-drive error. Its returned Dump and serialized bytes are not examined.
+// @evidence contracts/testing.md#independent-expectations Literal path pairs require different filesystem roots message fragments, distinct physical claim keys at one shared.ts require collide at wire identity, and the authored cross-drive node requires NewDump's root error. Physical key strings are injected test facts, not native SameFile authentication.
+// @evidence contracts/testing.md#distinguishing-cases Different Windows drives and different UNC shares exercise separate root grammar; directly conflicting claims exercise injectivity; a graph node exercises dump-level error propagation. TestDumpPathMapperCachesAliasResolution owns the successful repeated same-root coordinate counterpart, not native alias completeness.
+// @evidence contracts/testing.md#execution-ownership This same-package Go unit directly constructs mappers, supplies instance-owned claim facts and a test-owned Graph, and calls mapPath and NewDump. Host-compatible authored absolute paths can trigger best-effort native canonicalization and ancestor reads. No compiler Program, consumer installation, product command or JSON serialization runs.
+func TestDumpPathMapperRejectsUnportableRootsAndCollisions(t *testing.T) {
+  for _, test := range []struct {
+    name    string
+    project string
+    file    string
+  }{
+    {"windows-drive", "C:/checkout/app", "D:/shared/value.ts"},
+    {"unc-share", "//server/share-a/app", "//server/share-b/value.ts"},
+  } {
+    t.Run(test.name, func(t *testing.T) {
+      mapper := newDumpPathMapper(test.project)
+      mapper.mapPath(test.file)
+      if err := mapper.err(); err == nil || !strings.Contains(err.Error(), "different filesystem roots") {
+        t.Fatalf("cross-root error = %v, want a precise filesystem-root rejection", err)
+      }
+    })
+  }
+
+  collision := newDumpPathMapper("/checkout/app")
+  collision.claim("/physical/one.ts", "shared.ts")
+  collision.claim("/physical/two.ts", "shared.ts")
+  if err := collision.err(); err == nil || !strings.Contains(err.Error(), "collide at wire identity") {
+    t.Fatalf("collision error = %v, want an injectivity rejection", err)
+  }
+
+  file := "D:/shared/value.ts"
+  id := nodeID(file, "value", NodeVariable)
+  _, err := NewDump(&Graph{Nodes: map[string]*Node{
+    id: &Node{ID: id, Name: "value", Simple: "value", Kind: NodeVariable, File: file},
+  }}, "C:/checkout/app", "tsconfig.json", nil, nil, DumpOrigin{})
+  if err == nil || !strings.Contains(err.Error(), "different filesystem roots") {
+    t.Fatalf("NewDump cross-root error = %v, want rejection before serialization", err)
+  }
+}

package/internal/graph/{dump_paths_are_portable_and_injective_test.go → dump_path_mapper_uses_portable_coordinates_test.go}

@@ -1,16 +1,22 @@
 package graph
 
 import (
-  "strings"
   "testing"
 )
 
 // TestDumpPathMapperUsesPortableCoordinates verifies the dump path vocabulary
-// directly, independent of the host OS running the test.
+// for nine authored POSIX, drive, UNC, pnpm-context and bundled path cases.
+// Host-compatible absolute spellings can still undergo native canonicalization;
+// these literals do not authenticate filesystem identities on every OS.
 //
 //  1. Map in-project and sibling paths for POSIX, drive, and UNC layouts.
 //  2. Keep two pnpm version/peer contexts with the same package subpath apart.
 //  3. Preserve compiler virtual identities exactly.
+//
+// @evidence contracts/testing.md#behavioral-verification The actual mapper must return each of nine literal coordinates without a latched error: project and sibling coordinates for three root grammars, two full pnpm context paths, and one unchanged bundled path. This is not cross-platform native identity authentication.
+// @evidence contracts/testing.md#independent-expectations The expectations are the literal coordinates in the table: in-project paths map to src/main.ts, same-root siblings to ../shared/src/value.ts for POSIX, drive and UNC layouts, two pnpm version/peer package paths keep their full distinct node_modules/.pnpm/... paths, and a bundled:/// path is preserved exactly, with no mapping error in any case.
+// @evidence contracts/testing.md#distinguishing-cases Map in-project and sibling paths for POSIX, drive, and UNC layouts; Keep two pnpm version/peer contexts with the same package subpath apart; Preserve compiler virtual identities exactly.
+// @evidence contracts/testing.md#execution-ownership This same-package Go unit directly constructs one mapper per authored path row and calls mapPath. Host-compatible paths can trigger best-effort native canonicalization and ancestor reads; no fixture filesystem objects, compiler Program, installed consumer or product process are created.
 func TestDumpPathMapperUsesPortableCoordinates(t *testing.T) {
   tests := []struct {
     name    string
@@ -50,44 +56,3 @@ func TestDumpPathMapperUsesPortableCoordinates(t *testing.T) {
     })
   }
 }
-
-// TestDumpPathMapperRejectsUnportableRootsAndCollisions pins both fail-closed
-// boundaries of the mapping contract.
-//
-//  1. Reject a different Windows drive and a different UNC share precisely.
-//  2. Force two physical sources through one coordinate and require a collision.
-//  3. Require NewDump to surface the root error before JSON serialization.
-func TestDumpPathMapperRejectsUnportableRootsAndCollisions(t *testing.T) {
-  for _, test := range []struct {
-    name    string
-    project string
-    file    string
-  }{
-    {"windows-drive", "C:/checkout/app", "D:/shared/value.ts"},
-    {"unc-share", "//server/share-a/app", "//server/share-b/value.ts"},
-  } {
-    t.Run(test.name, func(t *testing.T) {
-      mapper := newDumpPathMapper(test.project)
-      mapper.mapPath(test.file)
-      if err := mapper.err(); err == nil || !strings.Contains(err.Error(), "different filesystem roots") {
-        t.Fatalf("cross-root error = %v, want a precise filesystem-root rejection", err)
-      }
-    })
-  }
-
-  collision := newDumpPathMapper("/checkout/app")
-  collision.claim("/physical/one.ts", "shared.ts")
-  collision.claim("/physical/two.ts", "shared.ts")
-  if err := collision.err(); err == nil || !strings.Contains(err.Error(), "collide at wire identity") {
-    t.Fatalf("collision error = %v, want an injectivity rejection", err)
-  }
-
-  file := "D:/shared/value.ts"
-  id := nodeID(file, "value", NodeVariable)
-  _, err := NewDump(&Graph{Nodes: map[string]*Node{
-    id: &Node{ID: id, Name: "value", Simple: "value", Kind: NodeVariable, File: file},
-  }}, "C:/checkout/app", "tsconfig.json", nil, nil, DumpOrigin{})
-  if err == nil || !strings.Contains(err.Error(), "different filesystem roots") {
-    t.Fatalf("NewDump cross-root error = %v, want rejection before serialization", err)
-  }
-}

package/internal/graph/dump_paths.go

@@ -25,13 +25,17 @@ type dumpPathMapper struct {
   mappingErr     error
 }
 
-func newDumpPathMapper(project string) *dumpPathMapper {
+func newDumpPathMapper(project string, caseSensitive ...bool) *dumpPathMapper {
+  sensitive := true
+  if len(caseSensitive) != 0 {
+    sensitive = caseSensitive[0]
+  }
   raw := shimtspath.NormalizePath(shimtspath.NormalizeSlashes(project))
   normalized := canonicalDumpPath(raw)
   mapper := &dumpPathMapper{
     rawProject:     raw,
     project:        normalized,
-    caseSensitive:  dumpPathRootIsCaseSensitive(normalized),
+    caseSensitive:  sensitive,
     canonicalize:   canonicalDumpPath,
     rawToWire:      map[string]string{},
     physicalToWire: map[string]string{},
@@ -39,14 +43,28 @@ func newDumpPathMapper(project string) *dumpPathMapper {
   }
   if normalized == "" || shimtspath.GetRootLength(normalized) == 0 {
     mapper.mappingErr = fmt.Errorf("ttscgraph: project root %q is not absolute", project)
+  } else if len(caseSensitive) > 1 {
+    mapper.mappingErr = fmt.Errorf("ttscgraph: path projection accepts at most one case policy")
   }
   return mapper
 }
 
-// WireProject returns the canonical filesystem base that owns every relative
+// WireProject returns the best-effort canonical base used for every relative
 // wire path emitted by this package.
-func WireProject(project string) (string, error) {
-  mapper := newDumpPathMapper(project)
+// The optional policy is the producing Program's UseCaseSensitiveFileNames;
+// without a producer, paths retain exact spelling rather than guessing from
+// drive, UNC or POSIX syntax. Supply at most one policy value.
+//
+// @evidence contracts/common.md#principled-implementation The shared mapper checks absolute root syntax and policy arity before publishing a best-effort base; missing or unresolved native paths can retain lexical spelling, without physical identity authentication.
+// @evidence contracts/common.md#clear-and-simple-design A narrow adapter delegates all path policy to one mapper constructor.
+// @evidence contracts/common.md#prohibited-implementation-shortcuts Invalid roots remain errors rather than receiving a fixture-specific fallback base.
+// @evidence contracts/common.md#meaningful-documentation Native prose identifies the canonical base shared by relative wire paths, with documentation-skill tag spacing.
+// @evidence contracts/portability.md#os-neutral-implementation Host-compatible paths use best-effort EvalSymlinks and ancestor fallback. Supplied compiler case policy controls comparison, not authentication of physical spelling or per-directory filesystem behavior.
+// @evidence contracts/performance.md#efficient-algorithms Work includes project normalization and native EvalSymlinks attempts up the ancestor chain, plus suffix reconstruction and fixed map setup. Path bytes, depth and native resolution work contribute; it is not one native query.
+// @evidenceExclude contracts/performance.md#reuse-equivalent-work This single-base adapter owns no repeated mapping consumers; callers projecting many paths retain one mapper.
+// @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The call-local mapper owns no historical cache or handle; its temporary native/path storage becomes unreachable while the returned coordinate transfers to the caller.
+func WireProject(project string, caseSensitive ...bool) (string, error) {
+  mapper := newDumpPathMapper(project, caseSensitive...)
   return mapper.project, mapper.err()
 }
 
@@ -55,8 +73,18 @@ func WireProject(project string) (string, error) {
 // keep one dumpPathMapper so collision detection spans every path; callers
 // shaping a single source/config coordinate use this helper and receive the
 // same filesystem-alias and cross-root behavior.
-func WirePath(project, file string) (string, error) {
-  mapper := newDumpPathMapper(project)
+// The optional case policy follows WireProject's producer-owned convention.
+//
+// @evidence contracts/common.md#principled-implementation One source/config coordinate uses the complete dump's alias resolution and cross-root checks.
+// @evidence contracts/common.md#clear-and-simple-design The mapper owns all identity policy; this adapter returns one coordinate and its accumulated error.
+// @evidence contracts/common.md#prohibited-implementation-shortcuts Paths on another native root fail rather than collapsing to a misleading package tail or guessed relative identity.
+// @evidence contracts/common.md#meaningful-documentation Native prose distinguishes single-coordinate callers from whole-graph collision ownership, following the documentation skill.
+// @evidence contracts/portability.md#os-neutral-implementation Host-compatible paths attempt native alias resolution, falling back to existing ancestors or lexical spelling. Supplied compiler case policy, or exact spelling without it, is not a per-directory case or snapshot proof.
+// @evidence contracts/performance.md#efficient-algorithms Project and selected-path normalization, native ancestor resolution, relative projection and string-key hashing/comparison contribute. Depth and symlink/native work are not bounded by two string lengths alone.
+// @evidence contracts/performance.md#reuse-equivalent-work Within this projection, mapper keys reuse successful normalized/policy-folded raw projections and physical claims. Separate aliases can require new native resolution; wider collision detection requires a shared mapper and stable caller inputs.
+// @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The call-local mapper/path maps become unreachable; returned path strings transfer to the caller. No historical cache or native handle is retained by this adapter.
+func WirePath(project, file string, caseSensitive ...bool) (string, error) {
+  mapper := newDumpPathMapper(project, caseSensitive...)
   wire := mapper.mapPath(file)
   return wire, mapper.err()
 }
@@ -65,16 +93,36 @@ func WirePath(project, file string) (string, error) {
 // the same portable vocabulary as NewDumpFacts. Resident stores use it when a
 // wire-level external reference count must be reconciled with the immutable
 // graph.Node cache, whose keys retain compiler-physical paths.
-func WireNodeID(project, id string) (string, error) {
-  ids, err := WireNodeIDs(project, []string{id})
+// The optional case policy follows WireProject's producer-owned convention.
+//
+// @evidence contracts/common.md#principled-implementation The parser maps the declaration path and module-name path component, preserving other decoded symbol names and kind strings. It checks grammar separators, not vocabulary or producer authenticity.
+// @evidence contracts/common.md#clear-and-simple-design The single-ID adapter delegates to the batch mapper, sharing its grammar and error semantics.
+// @evidence contracts/common.md#prohibited-implementation-shortcuts Missing separators or empty name/kind suffixes return codec errors, while arbitrary nonempty kind strings are not validated here. No fixture-specific endpoint is substituted.
+// @evidence contracts/common.md#meaningful-documentation Native prose explains native-cache versus wire-store identity reconciliation, with documentation-skill spacing.
+// @evidence contracts/portability.md#os-neutral-implementation The shared best-effort mapper retains native ancestor/lexical fallback limits and supplied case policy; protocol parsing does not authenticate filesystem aliases or freeze a snapshot.
+// @evidence contracts/performance.md#efficient-algorithms ID decoding/re-encoding and map string keys add byte costs to project/path normalization and native ancestor-resolution attempts. Work is independent of graph population, not native depth or symlink traversal.
+// @evidence contracts/performance.md#reuse-equivalent-work It shares the same batch implementation and mapper-local alias cache; no output is reused across unrelated snapshots.
+// @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The local batch/mapper storage becomes unreachable and one returned ID string transfers to the caller. No historical cache or native handle is owned; temporary bytes follow ID/path inputs.
+func WireNodeID(project, id string, caseSensitive ...bool) (string, error) {
+  ids, err := WireNodeIDs(project, []string{id}, caseSensitive...)
   return ids[id], err
 }
 
 // WireNodeIDs maps a set of internal node IDs through one path mapper. Sharing
-// the mapper preserves cross-ID collision detection and resolves each repeated
-// filesystem alias only once per snapshot generation.
-func WireNodeIDs(project string, ids []string) (map[string]string, error) {
-  mapper := newDumpPathMapper(project)
+// the mapper preserves policy-relative collision detection and reuses each repeated
+// successful raw-path projection within this call, without freezing native aliases.
+// The optional case policy follows WireProject's producer-owned convention.
+//
+// @evidence contracts/common.md#principled-implementation All IDs share detected path-collision checks under supplied case policy and best-effort canonical spelling. Policy-folded or unresolved paths are not independent physical identities, and input stability remains the caller's responsibility.
+// @evidence contracts/common.md#clear-and-simple-design One loop composes the node grammar with the reusable path boundary.
+// @evidence contracts/common.md#prohibited-implementation-shortcuts Malformed grammar returns nil/error immediately; cross-root or collision errors are latched and returned after the loop, potentially with an output map. Callers must reject errored projections rather than use partial coordinates.
+// @evidence contracts/common.md#meaningful-documentation Native prose states shared collision detection and generation-local alias resolution, following the documentation skill.
+// @evidence contracts/portability.md#os-neutral-implementation Filesystem-bearing components use protocol slashes and host-compatible best-effort native resolution; supplied compiler case policy is not proof of each directory's physical identity.
+// @evidence contracts/performance.md#efficient-algorithms Aggregate ID decoding/re-encoding, string-key hashing/comparison and project/path projection costs include native ancestor attempts and symlink work. Repeated successful raw keys reuse mapping; distinct aliases can still require separate native queries.
+// @evidence contracts/performance.md#reuse-equivalent-work Repeated successful raw keys reuse results within this call; physical aliases still require their own canonicalization before a shared claim is found. Each invocation creates a new mapper, not a stable filesystem snapshot.
+// @evidence contracts/performance.md#bound-retention-and-release-resources Uncapped raw/physical/wire caches and output strings grow with batch path populations and byte lengths. Local maps become unreachable on return; successful output transfers to the caller, and detected mapping error can accompany an output map. No historical eviction policy or native handle is owned.
+func WireNodeIDs(project string, ids []string, caseSensitive ...bool) (map[string]string, error) {
+  mapper := newDumpPathMapper(project, caseSensitive...)
   wireIDs := make(map[string]string, len(ids))
   for _, id := range ids {
     wire, err := wireNodeID(mapper, id)
@@ -250,18 +298,6 @@ func dumpPathUsesHostFilesystem(path string) bool {
   return strings.HasPrefix(path, "/") && !strings.HasPrefix(path, "//")
 }
 
-// Windows drive and UNC roots use case-insensitive path comparison. POSIX
-// roots remain case-sensitive. This decision follows the path's own grammar so
-// synthetic Windows/UNC fixtures behave the same on every CI host.
-func dumpPathRootIsCaseSensitive(path string) bool {
-  rootLength := shimtspath.GetRootLength(path)
-  if rootLength == 0 {
-    return true
-  }
-  root := path[:rootLength]
-  return !(strings.HasPrefix(root, "//") || (len(root) >= 2 && root[1] == ':'))
-}
-
 // dumpPathRootsEqual compares filesystem roots before asking tspath for a
 // relative coordinate. tspath models a UNC root as `//server/`, which is useful
 // for URL-like path operations but too broad for a filesystem identity: on

package/internal/graph/dump_paths_canonicalize_windows_short_root_test.go

@@ -3,25 +3,62 @@
 package graph
 
 import (
+  "os"
   "path/filepath"
+  "strings"
+  "syscall"
   "testing"
 )
 
 // TestDumpPathMapperCanonicalizesWindowsShortRoot verifies that a project
-// selected through an 8.3 path still owns checker sources reported through the
-// expanded physical spelling.
+// selected through a native 8.3 alias maps two absent child paths relative to
+// the same directory, using expanded and short root spellings respectively.
+// No checker source file is created or loaded by this entry.
 //
-//  1. Obtain the environment's temp spelling and its physical spelling.
-//  2. Skip hosts where Windows exposes only one spelling.
-//  3. Require a physical child source to retain a project-relative identity.
+//  1. Obtain the owned temporary directory's real Windows 8.3 spelling.
+//  2. Confirm distinct spellings name the same native directory; report unavailable capability.
+//  3. Require both absent child coordinates to retain project-relative identity.
+//
+// @evidence contracts/testing.md#behavioral-verification Calls Windows GetShortPathNameW, native SameFile checks and the actual dump path mapper; the same native root's expanded-spelling src/main.ts and short-spelling future/main.ts, neither created, must map to their literal relative coordinates without a latched error.
+// @evidence contracts/testing.md#independent-expectations The native API supplies the short spelling of this owned directory, SameFile proves its physical identity, and literal src/main.ts and future/main.ts define the three original mapping/error oracles.
+// @evidence contracts/testing.md#distinguishing-cases Distinct 8.3 versus expanded root spellings are authenticated by native SameFile; two absent children exercise existing-ancestor fallback under each spelling. Existing child sources are not tested. Unavailable or nondistinct 8.3 capability is reported as skipped coverage.
+// @evidence contracts/testing.md#execution-ownership This Windows-build-tagged Go unit invokes the owning mapper against one actual temporary directory and GetShortPathName metadata, without a compiler Program, installed consumer, product host or artifact build. Non-Windows Go test builds exclude this entry; source inventory selection is separate, and a capability skip does not prove mapping assertions executed.
 func TestDumpPathMapperCanonicalizesWindowsShortRoot(t *testing.T) {
-  project := t.TempDir()
+  owned := t.TempDir()
+  long, err := syscall.UTF16PtrFromString(owned)
+  if err != nil {
+    t.Fatal(err)
+  }
+  required, err := syscall.GetShortPathName(long, nil, 0)
+  if err != nil || required == 0 {
+    t.Skipf("Windows short-path capability unavailable: %v", err)
+  }
+  buffer := make([]uint16, required)
+  length, err := syscall.GetShortPathName(long, &buffer[0], uint32(len(buffer)))
+  if err != nil {
+    t.Skipf("Windows short-path capability unavailable: %v", err)
+  }
+  if length >= uint32(len(buffer)) {
+    t.Fatal("Windows short-path result exceeded its observed buffer size")
+  }
+  project := syscall.UTF16ToString(buffer[:length])
   physical, err := filepath.EvalSymlinks(project)
   if err != nil {
     t.Fatal(err)
   }
-  if filepath.Clean(project) == filepath.Clean(physical) {
-    t.Skip("temporary directory has no alternate Windows path spelling")
+  if strings.EqualFold(filepath.Clean(project), filepath.Clean(physical)) {
+    t.Skip("owned temporary directory has no distinct Windows 8.3 spelling")
+  }
+  suppliedInfo, err := os.Stat(project)
+  if err != nil {
+    t.Fatal(err)
+  }
+  ownedInfo, err := os.Stat(owned)
+  if err != nil {
+    t.Fatal(err)
+  }
+  if !os.SameFile(suppliedInfo, ownedInfo) {
+    t.Fatal("Windows short spelling does not name the owned native directory")
   }
 
   mapper := newDumpPathMapper(project)

package/internal/graph/dump_rejects_provenance_only_path_errors_test.go

@@ -14,6 +14,11 @@ import (
 //  1. Build an empty graph under one synthetic Windows drive.
 //  2. Add a provenance-only config input from another drive.
 //  3. Require NewDump to reject the unrepresentable coordinate.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual NewDump with an empty test-owned Graph and one cross-drive provenance config must return the literal root-error fragment. No graph node causes this failure; the returned Dump and JSON bytes are not examined.
+// @evidence contracts/testing.md#independent-expectations Authored C:/checkout/app and D:/shared/tsconfig.json have different drive roots, so the expected error contains different filesystem roots. The config digest is supplied inert data, not independently computed file identity or provenance authentication.
+// @evidence contracts/testing.md#distinguishing-cases Empty graph facts contrast a provenance-only cross-drive config, exercising error detection after fact projection. TestDumpCheckoutPathsAreStable owns valid same-root provenance coordinates; other provenance fields and native volume aliases are not exercised here.
+// @evidence contracts/testing.md#execution-ownership This same-package Go unit directly invokes NewDump with test-owned graph/provenance values. Host-compatible authored absolute paths can trigger best-effort native canonicalization and ancestor reads; no fixture files, compiler Program, serialization, installed consumer or product process are created.
 func TestNewDumpRejectsProvenanceOnlyPathErrors(t *testing.T) {
   _, err := NewDump(
     &Graph{Nodes: map[string]*Node{}},

package/internal/graph/dump_serializes_the_full_graph_test.go

@@ -10,22 +10,23 @@ import (
 )
 
 // TestMarshalDumpSerializesTheFullGraph verifies that MarshalDump projects a
-// built graph onto the IGraphDump wire contract the `ttscgraph dump` command
-// prints and the @ttsc/graph engine loads: the project envelope, every node and
-// edge, project-relative paths, line/col evidence, and the lowercase wire keys.
-//
-// The Node/Edge structs carry no json tags, so dump.go's projection is the only
-// thing standing between the Go fields and the wire. A regression there would
-// ship keys or kinds the engine does not read, so the key and kind assertions
-// are load-bearing, not cosmetic.
+// built two-function graph to JSON with selected envelope, node and call-edge
+// facts, count agreement, endpoint membership and key checks. No graph engine
+// or CLI consumes this output, and counts alone do not certify fact identity.
 //
 //  1. Build a two-function fixture with one call, so the dump has a node set and
 //     a value-call edge.
 //  2. Marshal it with source texts and assert the envelope, counts, and that the
 //     call edge maps to kind "calls" with a line/col evidence span.
 //  3. Assert paths are project-relative, the wire keys are the lowercase json
-//     tags, every edge endpoint resolves to a dumped node, and --pretty indents.
+//     tags, every edge endpoint resolves to a dumped node, and pretty=true indents.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual compact MarshalDump JSON must decode selected project/tsconfig, main/helper and call facts, match the built graph's node/edge counts, contain every edge endpoint and selected lowercase keys, and omit selected Go-field/trust/text keys. Evidence checks require positive start lines, not columns or exact spans. pretty=true must produce indentation; no consumer loader or CLI runs.
+// @evidence contracts/testing.md#independent-expectations Literal tsconfig.json, main ID/file, calls relation, key presence/absence, omitted edge evidence File, endpoint membership and indentation expectations are checked. Counts are derived from the built graph and prove only count agreement, not identity preservation. Project equality reuses canonicalDumpPath and nodeFile decodes the actual edge ID, so neither is an independent filesystem/ID oracle; positive evidence lines do not authenticate exact coordinates.
+// @evidence contracts/testing.md#distinguishing-cases One authored main/helper call provides positive nodes, edge and evidence; selected forbidden keys and missing endpoint identities are negative guards. Compact versus pretty serialization contrasts formatting. Other graph payload families and empty/error cases are not owned here.
+// @evidence contracts/testing.md#execution-ownership This Go source-unit writes a native project, constructs/closes its driver Program in-process and directly calls Build, SourceTexts and compact/pretty MarshalDump, decoding actual JSON and re-encoding edge records. A restored empty linked-plugin manifest excludes ambient hooks; no installed consumer or product process runs.
 func TestMarshalDumpSerializesTheFullGraph(t *testing.T) {
+  t.Setenv(driver.LinkedPluginsEnv, "")
   root := t.TempDir()
   writeFile(t, filepath.Join(root, "tsconfig.json"), fixtureTSConfig)
   writeFile(t, filepath.Join(root, "src", "main.ts"), `export function helper(): void {}
@@ -104,7 +105,7 @@ export function main(): void {
   }
   // The edge's span carries no file: it is the file its `from` id names, which
   // the loader reconstructs (see ITtscGraphDump.IEdge). Sending the path a
-  // second time on every edge is 17% of the document for a value the reader
+  // second time on every edge would bloat the document with a value the reader
   // already holds.
   if call.Evidence == nil || call.Evidence.StartLine == 0 {
     t.Fatalf("call edge missing line/col evidence: %+v", call.Evidence)
@@ -138,15 +139,8 @@ export function main(): void {
       t.Fatalf("dump leaked Go field name %s:\n%s", leaked, s)
     }
   }
-  // Every edge is checker-resolved by construction, so no record carries a
-  // per-edge trust flag saying so — that is the `provenance`/`confidence` pair
-  // 6d74a88c3 removed, and it stays removed. The dump's own `provenance` is a
-  // different thing at a different level: it describes the one program that
-  // produced every record, which no record can state about itself.
-  //
-  // No source body text rides the wire either. The manifest names its fields
-  // `checkerDigest` and `diskDigest` precisely so a digest can never be read as
-  // the text it stands for.
+  // Selected trust/text keys must not appear in this fixture's JSON, and no
+  // decoded edge may serialize a per-edge provenance key.
   for _, gone := range []string{`"confidence":`, `"text":`} {
     if strings.Contains(s, gone) {
       t.Fatalf("dump still emits removed key %s:\n%s", gone, s)

package/internal/graph/dump_symlink_project_publishes_matching_base_test.go

@@ -16,6 +16,11 @@ import (
 //  1. Select a real project directory through a symlink and add sibling inputs.
 //  2. Map an existing sibling, a missing child and a relative config symlink.
 //  3. Require stable coordinates and a canonical published project base.
+//
+// @evidence contracts/testing.md#behavioral-verification Actual directory and file symlinks feed newDumpPathMapper and NewDump, then SameFile checks the sibling resolved from the published project base.
+// @evidence contracts/testing.md#independent-expectations The physical directory, sibling source and linked config are independently created fixture objects; literal ../shared.ts, src/new.ts and ../config/tsconfig.json define expected wire coordinates.
+// @evidence contracts/testing.md#distinguishing-cases A directory alias, a real config-file symlink, a sibling and a missing child distinguish canonical base publication from lexical path joining. Both native link capabilities are required.
+// @evidence contracts/testing.md#execution-ownership This Go unit entry calls the owning path mapper and dump constructor directly with actual temporary directory/file symlinks and SameFile observations; no compiler Program, artifact build or product host runs. Any error from either native Symlink call reports a skip, without proving a permission or unsupported-capability cause; a skip supplies no mapping coverage.
 func TestDumpSymlinkProjectPublishesMatchingBase(t *testing.T) {
   root := t.TempDir()
   realRoot := filepath.Join(root, "real")
@@ -53,6 +58,9 @@ func TestDumpSymlinkProjectPublishesMatchingBase(t *testing.T) {
   if wire := mapper.mapPath("tsconfig.json"); wire != "../config/tsconfig.json" {
     t.Fatalf("relative config wire path = %q, want ../config/tsconfig.json", wire)
   }
+  if err := mapper.err(); err != nil {
+    t.Fatalf("mapping the owned alias fixture failed: %v", err)
+  }
   dump, err := NewDump(&Graph{Nodes: map[string]*Node{}}, alias, "tsconfig.json", nil, nil, DumpOrigin{})
   if err != nil {
     t.Fatal(err)

package/internal/graph/dump_uses_ecma_line_terminators_test.go

@@ -4,20 +4,26 @@ import (
   "encoding/json"
   "path/filepath"
   "testing"
+
+  "github.com/samchon/ttsc/packages/ttsc/driver"
 )
 
 // TestDumpUsesECMALineTerminators verifies graph dump evidence and compact
-// source display use the compiler's complete ECMAScript line model.
-//
-// The graph used to split only on LF, so a CR, LS, or PS file placed every
-// declaration on line one and let a leading // comment consume the rest of the
-// file. Each fixture drives a real compiler program and checks the independent
-// dump coordinates, comment compaction, and regular-expression boundary.
+// source helpers at five authored ECMAScript line terminators. Each fixture
+// uses a real compiler Program and literal evidence coordinates, comment-text
+// preservation and a directly supplied cross-line regular-expression boundary.
+// It does not independently validate every compiler lexical context.
 //
 // 1. Compile the same two-function project with each ECMAScript terminator.
 // 2. Marshal its graph and find both declarations and the call edge.
 // 3. Assert their evidence and source helpers agree on the three logical lines.
+//
+// @evidence contracts/testing.md#behavioral-verification Five named terminator cases load actual Programs and decode MarshalDump results: alpha and beta declaration starts and a calls edge from alpha must occupy their literal lines. Direct source helpers must count three lines, preserve the authored line comment plus following member text, and reject the supplied cross-line regular-expression literal.
+// @evidence contracts/testing.md#independent-expectations Literal expectations for LF, CRLF, CR, U+2028 and U+2029 are alpha line 2 column 1, beta line 3 column 1, a calls edge from alpha at line 2, three line starts, unchanged // lead plus terminator plus value: 1, and regularExpressionEnd returning zero. The edge target, end coordinates and other lexical contexts are not asserted.
+// @evidence contracts/testing.md#distinguishing-cases Compile the same two-function project with each ECMAScript terminator; Marshal its graph and find both declarations and the call edge; Assert their evidence and source helpers agree on the three logical lines.
+// @evidence contracts/testing.md#execution-ownership This Go source-unit entry registers five named cases, each writing a native project and loading/closing a driver Program through dumpBytes before decoding actual graph JSON. Source helpers execute directly on authored strings. A restored empty linked-plugin manifest excludes ambient hooks; no consumer installation, artifact build or product process runs.
 func TestDumpUsesECMALineTerminators(t *testing.T) {
+  t.Setenv(driver.LinkedPluginsEnv, "")
   cases := []struct {
     name       string
     terminator string

package/internal/graph/duplicate_variable_object_members_keep_first_declaration_test.go

@@ -7,18 +7,21 @@ import (
   "github.com/samchon/ttsc/packages/ttsc/driver"
 )
 
-// TestDuplicateVariableObjectMembersKeepFirstDeclaration verifies that a legal
-// repeated var declaration cannot attach its initializer to the first node.
-//
-// Variable symbols merge across declarations, while graph node identity keeps
-// the first declaration. Collecting object members after every add used to
-// combine the first declaration's span with the second declaration's members,
-// producing a node that never existed in the compiler snapshot.
+// TestDuplicateVariableObjectMembersKeepFirstDeclaration checks the first
+// object's member survives two authored var declarations of one name, both
+// in the built graph and in the dump. Declaration spans and complete semantic
+// diagnostic legality are not asserted by this entry.
 //
 //  1. Compile two var declarations with the same symbol and different objects.
-//  2. Assert the graph keeps the first declaration and its direct member.
+//  2. Assert the graph keeps exactly the first object's direct member.
 //  3. Dump the graph and assert the same member remains on the wire.
+//
+// @evidence contracts/testing.md#behavioral-verification Build must retain exactly the member first on the repeated variable node; NewDump must retain that one member with literal signature first: 1 rather than second. Node declaration spans and full Program semantic diagnostics are not checked.
+// @evidence contracts/testing.md#independent-expectations The expectations are literal over two var declarations of one symbol ({ first: 1 } then { second: 2 }): the built node must carry exactly one object member named first, and the dump node src/main.ts#duplicate:variable must carry exactly that member with signature first: 1.
+// @evidence contracts/testing.md#distinguishing-cases Two same-name declarations with different member literals distinguish preservation of the first member from overwrite or member union. Both in-memory member identity and dumped signature are asserted; single-declaration and other initializer forms are not owned here.
+// @evidence contracts/testing.md#execution-ownership This Go source-unit writes a native project and loads/closes its compiler Program in-process, invoking Build, NewDump and SourceTexts directly. A restored empty linked-plugin manifest excludes ambient hooks. Node selection uses the actual Program filename and shared ID formatter, not an independent ID-grammar oracle; no consumer installation or product process runs.
 func TestDuplicateVariableObjectMembersKeepFirstDeclaration(t *testing.T) {
+  t.Setenv(driver.LinkedPluginsEnv, "")
   root := t.TempDir()
   writeFile(t, filepath.Join(root, "tsconfig.json"), fixtureTSConfig)
   writeFile(t, filepath.Join(root, "src", "main.ts"), `export var duplicate = { first: 1 };

package/internal/graph/edge_spans_point_to_resolved_usage_test.go

@@ -8,12 +8,20 @@ import (
   "github.com/samchon/ttsc/packages/ttsc/driver"
 )
 
-// TestEdgeSpansPointToResolvedUsage verifies each checker-resolved edge keeps
-// the source expression that produced it. The edge is still deduped by
-// from/to/kind, but MCP needs the first concrete use span so a truncated
-// declaration can reopen the right line without string-searching for a target
-// name that may appear elsewhere.
+// TestEdgeSpansPointToResolvedUsage checks the selected caller-to-helper and
+// Box.read-to-Box.value spans against literal fixture text. Repeated-use
+// deduplication, first-use selection and consumer reopening are not exercised.
+//
+// 1. Load adjacent helper and helperShadow declarations plus Box.value and Box.read.
+// 2. Resolve the caller-to-helper call and the read-to-value access edges.
+// 3. Require the call slice to equal helper and the access slice to contain this.value, rather than a nearby declaration name.
+//
+// @evidence contracts/testing.md#behavioral-verification Require the call slice to equal helper and the access slice to contain this.value, rather than a nearby declaration name.
+// @evidence contracts/testing.md#independent-expectations The selected call's actual source slice, after TrimSpace, must equal literal helper rather than helperShadow; the selected read-to-value slice must contain literal this.value. The offsets come from the graph under test, so these text checks do not authenticate exact whitespace boundaries or independently derive byte coordinates.
+// @evidence contracts/testing.md#distinguishing-cases Load adjacent helper and helperShadow declarations plus Box.value and Box.read. Resolve the caller-to-helper call and the read-to-value access edges. Require the call slice to equal helper and the access slice to contain this.value, rather than a nearby declaration name.
+// @evidence contracts/testing.md#execution-ownership This Go source-unit writes a native project, constructs/closes its driver Program in-process and directly builds its graph. Local name/kind helpers select actual graph nodes and edge triples before slicing actual Program text. A restored empty linked-plugin manifest excludes ambient hooks; no dump serialization, installed consumer or product process runs.
 func TestEdgeSpansPointToResolvedUsage(t *testing.T) {
+  t.Setenv(driver.LinkedPluginsEnv, "")
   root := t.TempDir()
   writeFile(t, filepath.Join(root, "tsconfig.json"), fixtureTSConfig)
   path := filepath.Join(root, "src", "main.ts")