diffctx 1.13.0__tar.gz → 1.14.0__tar.gz

{diffctx-1.13.0 → diffctx-1.14.0}/CHANGELOG.md

@@ -7,6 +7,73 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- **Changed secret-classified files (`id_rsa`, `*.key`, `*.pem`, …) are now
+  disclosed in `policy_excluded_count`** (#214): they were silently dropped
+  before the ignore-exclusion disclosure ran, so a change touching only
+  secret paths printed a bare stub and a mixed change under-counted its
+  withheld files. Count only — the paths themselves stay out of the output,
+  same stance as `.diffctx/ignore`. The renderers' note now reads "withheld
+  by exclusion policy" to cover both families.
+- **The compute deadline and the git subprocess timeout are per-run, not
+  process-global** (#210): concurrent MCP requests overwrote each other's
+  ceiling (a short-timeout request could abort a long-timeout one mid-flight,
+  and vice versa disable it), an expired ceiling was never cleared and leaked
+  into later in-process runs, and a single flooding edge builder could outrun
+  the whole timeout between checks. The deadline is now a value threaded
+  through the run, the git timeout is thread-scoped, and the known flooding
+  loops (config-key scan, C-family pairing, Python identifier emission) poll
+  the deadline inside the loop.
+- A failed Aho-Corasick automaton build in the config-edge builder now logs a
+  warning instead of silently disabling the entire keyed channel (#216).
+
+- **A commit touching only excluded paths now renders its disclosure** (#188
+  completion): the YAML/Markdown/text renderers and the CLI's empty-diff exit
+  treated `ignored_changes`/`policy_excluded_count` as "no output", so the one
+  case the disclosure exists for — every hunk withheld — printed a bare stub
+  and exited 4. All three renderers, `locate`, and the exit path now count the
+  disclosure as content.
+- **Scala import with `}` before `{` no longer panics** the edge build
+  (`import a}.{B` in any `.scala`/`.sbt` line aborted the whole run).
+- The corpus harness (`build_diff_context_in_memory`) now passes the per-file
+  admission gate to selection, matching the shipped pipeline; the full corpus
+  is bit-stable under the fix (2902 passed, baseline unchanged).
+- An absurd `timeout` value can no longer wrap the compute deadline into the
+  past (saturating arithmetic); the token-cache eviction sweep no longer
+  deletes another process's in-flight temp file.
+- Text renderer writes one path per line (a comma or newline inside a path
+  made the joined line unparseable).
+
+### Changed
+
+- **New default operating point: per-file admission ON, `tau` 0.12 -> 0.05,
+  `core_budget_fraction` 0.5 -> 0.4** — the v5 evaluation cycle's validated
+  winner. A file whose only connection to the change is proximity (sibling
+  directory, shared rare token, lexical similarity) is no longer selectable as
+  context; it must be naming-reachable (an import/call/type-ref path from the
+  changed set, up to two hops, either direction). The weak stop then spends
+  the freed budget inside that admissible set. Evidence chain: 12-cell
+  screening grid (corpus known-failures 227 -> 196 with three xfails retiring;
+  the strict-tau admission variant was killed by a significant real-commit
+  recall loss), tau x cbf calibration + held-out validation (0.6815 vs 0.6684
+  for the old point), and a six-arm confirmation sweep on the three 500-case
+  test splits: file_recall parity with the old default, contextbench
+  file_precision +0.041 (bootstrap CI excludes zero), dcbench-372 paired
+  nontrivial recall within noise at -4% tokens. Opt out with
+  `DIFFCTX_FILE_ADMISSION=0` and `--tau 0.12` to reproduce the old behaviour
+  (#65).
+
+- **Selection enforces a per-file budget ceiling** (#194): while other files
+  still have unplaced candidates, one file may not consume more than
+  `SELECTION.per_file_budget_fraction` (default 0.25) of the budget — the
+  reporter's +9k-line generated JSON no longer crowds 34 source files out of
+  the output. Blocked candidates are deferred, not dropped: once every other
+  file has had its chance the ceiling lifts, so a single-file change still
+  fills the whole budget.
+
+## [1.13.0] - 2026-08-04
+
 ### Added
 
 - **Inline `<script>` and `<style>` in HTML are parsed with their own
@@ -924,7 +991,8 @@ Earlier releases shipped as `treemapper`; see
 <https://github.com/nikolay-e/diffctx/releases> for the corresponding GitHub
 release notes (`1.0.0` through `1.6.1`).
 
-[Unreleased]: https://github.com/nikolay-e/diffctx/compare/v1.12.3...HEAD
+[Unreleased]: https://github.com/nikolay-e/diffctx/compare/v1.13.0...HEAD
+[1.13.0]: https://github.com/nikolay-e/diffctx/compare/v1.12.3...v1.13.0
 [1.12.3]: https://github.com/nikolay-e/diffctx/compare/v1.12.2...v1.12.3
 [1.12.2]: https://github.com/nikolay-e/diffctx/compare/v1.12.1...v1.12.2
 [1.7.0]: https://github.com/nikolay-e/diffctx/compare/v1.6.1...v1.7.0

{diffctx-1.13.0 → diffctx-1.14.0}/Cargo.lock

@@ -4,9 +4,9 @@ version = 4
 
 [[package]]
 name = "aho-corasick"
-version = "1.1.4"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+checksum = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba"
 dependencies = [
  "memchr",
 ]
@@ -123,9 +123,9 @@ checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
 [[package]]
 name = "clap"
-version = "4.6.4"
+version = "4.6.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d91e0c145792ef73a6ad36d27c75ac09f1832222a3c209689d90f534685ee5b7"
+checksum = "473c7e07f409a8d772161724aa8db6a765a2532a70f9667eeb7b49d3d02fbdca"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -133,9 +133,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.6.2"
+version = "4.6.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f09628afdcc538b57f3c6341e9c8e9970f18e4a481690a64974d7023bd33548b"
+checksum = "7b48fea5a88e9ae728a2dcbedbfc0e730f7d60da42e1cb049a83c9fb8b789889"
 dependencies = [
  "anstream",
  "anstyle",
@@ -194,7 +194,7 @@ checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
 
 [[package]]
 name = "diffctx"
-version = "1.13.0"
+version = "1.14.0"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -515,9 +515,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3"
-version = "0.29.0"
+version = "0.29.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd274650b21d4bfc26a0a47587962c1edb425f69287324355cd040c3ea66071c"
+checksum = "4688ddedf473e32662b9b067670129a8afb8c18e351482c70d62ba4a88171e8b"
 dependencies = [
  "libc",
  "once_cell",
@@ -529,18 +529,18 @@ dependencies = [
 
 [[package]]
 name = "pyo3-build-config"
-version = "0.29.0"
+version = "0.29.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c5e2a7d2f0d013342f295c048ad19237add5154a55b1c5a254c0ec93d4109078"
+checksum = "f41027e41b4bd03f6e60f9f417fe24a6341a6bb744edd62b6f709f2a52ea30e9"
 dependencies = [
  "target-lexicon",
 ]
 
 [[package]]
 name = "pyo3-ffi"
-version = "0.29.0"
+version = "0.29.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca85c467da1bbc8d866eea5deff9cf29ea5f7785054a17da36e65bda9c05845b"
+checksum = "e591a95526fead067432c3b3a33fc74770b87b1e04e73671090d9c2055a2b327"
 dependencies = [
  "libc",
  "pyo3-build-config",
@@ -548,9 +548,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros"
-version = "0.29.0"
+version = "0.29.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ac53762fd065daa3194dd09337a38bd793a188100fd1a9304c4ab312d901771"
+checksum = "73225868fc1cd84eef2c3c230ddb91273bf1de46aeb8a4248da76d32a0924a1c"
 dependencies = [
  "proc-macro2",
  "pyo3-macros-backend",
@@ -560,9 +560,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros-backend"
-version = "0.29.0"
+version = "0.29.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ca3a1557399783172dc5bf39cfca835157732532cba56b71d2292161e53b362"
+checksum = "571575aa3749fa6216757dd47d2a3e7ef360f329a40f0666a9fbd14889024952"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -748,9 +748,9 @@ checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
 
 [[package]]
 name = "similar"
-version = "3.1.1"
+version = "3.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6505efef05804732ed8a3f2d4f279429eb485bd69d5b0cc6b19cc02005cda16"
+checksum = "85ee016af5d736b69fc89e19254540fa4b5f5492853fb5503920f084011c78b6"
 dependencies = [
  "bstr",
 ]
@@ -816,18 +816,18 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "2.0.19"
+version = "2.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09a43598840e33d5b0331f38c5e30d13bb11c11210a4b58f0d9b18a5a5eefcd9"
+checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.19"
+version = "2.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43cbfe0cf76104d42a574802844187e84a305e531ed54455f11fbde0f10541cd"
+checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1252,9 +1252,9 @@ dependencies = [
 
 [[package]]
 name = "tree-sitter-scala"
-version = "0.26.0"
+version = "0.26.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de5a4a7ff23a55474ce6a741d52aaeca7a82fe9421bb982b86e98c6ac8629397"
+checksum = "24e0ab4505990bfe30051761d40a7bf4033ce5a81c9eda9e20e987a5cdc84826"
 dependencies = [
  "cc",
  "tree-sitter-language",

{diffctx-1.13.0 → diffctx-1.14.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: diffctx
-Version: 1.13.0
+Version: 1.14.0
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers
@@ -162,7 +162,7 @@ keeps its git meaning.
 | `--scoring` | `ego`   | `ego` = bounded expansion around changed nodes (fast, predictable radius); `ppr` = Personalized PageRank (global, smoother decay, slower); `bm25` = lexical retrieval against the diff hunks (baseline for sparse graphs); `rrf` = reciprocal-rank fusion of `ego` and `bm25` (widest recall, no scale calibration between the two signals) |
 | `--budget`  | auto    | Hard cap in o200k_base tokens (see [Token counting](docs/product/token-budget.md)): `N` enforces a fixed cap, `-1` disables it, `0` is a strict-zero floor (empty selection; use `--full` for changed files only) |
 | `--alpha`   | 0.60    | PPR damping; higher = context clusters tighter around changes (`--scoring ppr` only) |
-| `--tau`     | 0.12    | Relevance threshold for full fragment content; lower-scoring fragments are stubbed or dropped (lower = more context) |
+| `--tau`     | 0.05    | Relevance threshold for full fragment content; lower-scoring fragments are stubbed or dropped (lower = more context) |
 | `--full`    | false   | Only the changed files, every fragment, no related-code context          |
 | `--timeout` | 300     | Wall-clock deadline in seconds; on expiry diffctx exits 124 instead of hanging |
 | `--with-raw-diff` | false | Also embed git's raw unified diff ahead of the selected fragments — additive (selection unchanged), not charged to `--budget`, lock/ignored/secret-like sections omitted. Python CLI only |
@@ -221,7 +221,7 @@ ctx = build_diff_context(
     "HEAD~1..HEAD",
     budget_tokens=None,       # None = auto; 0 = strict-zero floor (empty); -1 = uncapped; N = hard cap
     alpha=0.6,
-    tau=0.12,
+    tau=0.05,
     full=False,
     scoring_mode="ego",
     timeout=300,

{diffctx-1.13.0 → diffctx-1.14.0}/README.md

@@ -84,7 +84,7 @@ keeps its git meaning.
 | `--scoring` | `ego`   | `ego` = bounded expansion around changed nodes (fast, predictable radius); `ppr` = Personalized PageRank (global, smoother decay, slower); `bm25` = lexical retrieval against the diff hunks (baseline for sparse graphs); `rrf` = reciprocal-rank fusion of `ego` and `bm25` (widest recall, no scale calibration between the two signals) |
 | `--budget`  | auto    | Hard cap in o200k_base tokens (see [Token counting](docs/product/token-budget.md)): `N` enforces a fixed cap, `-1` disables it, `0` is a strict-zero floor (empty selection; use `--full` for changed files only) |
 | `--alpha`   | 0.60    | PPR damping; higher = context clusters tighter around changes (`--scoring ppr` only) |
-| `--tau`     | 0.12    | Relevance threshold for full fragment content; lower-scoring fragments are stubbed or dropped (lower = more context) |
+| `--tau`     | 0.05    | Relevance threshold for full fragment content; lower-scoring fragments are stubbed or dropped (lower = more context) |
 | `--full`    | false   | Only the changed files, every fragment, no related-code context          |
 | `--timeout` | 300     | Wall-clock deadline in seconds; on expiry diffctx exits 124 instead of hanging |
 | `--with-raw-diff` | false | Also embed git's raw unified diff ahead of the selected fragments — additive (selection unchanged), not charged to `--budget`, lock/ignored/secret-like sections omitted. Python CLI only |
@@ -143,7 +143,7 @@ ctx = build_diff_context(
     "HEAD~1..HEAD",
     budget_tokens=None,       # None = auto; 0 = strict-zero floor (empty); -1 = uncapped; N = hard cap
     alpha=0.6,
-    tau=0.12,
+    tau=0.05,
     full=False,
     scoring_mode="ego",
     timeout=300,

{diffctx-1.13.0 → diffctx-1.14.0}/crates/diffctx-native/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "diffctx"
-version = "1.13.0"
+version = "1.14.0"
 edition = "2024"
 rust-version = "1.85"
 description = "Selects the minimum code an LLM needs to review a git diff: walks the dependency graph outward from changed lines and stops when extra context stops paying for itself"

{diffctx-1.13.0 → diffctx-1.14.0}/crates/diffctx-native/README.md

@@ -84,7 +84,7 @@ keeps its git meaning.
 | `--scoring` | `ego`   | `ego` = bounded expansion around changed nodes (fast, predictable radius); `ppr` = Personalized PageRank (global, smoother decay, slower); `bm25` = lexical retrieval against the diff hunks (baseline for sparse graphs); `rrf` = reciprocal-rank fusion of `ego` and `bm25` (widest recall, no scale calibration between the two signals) |
 | `--budget`  | auto    | Hard cap in o200k_base tokens (see [Token counting](docs/product/token-budget.md)): `N` enforces a fixed cap, `-1` disables it, `0` is a strict-zero floor (empty selection; use `--full` for changed files only) |
 | `--alpha`   | 0.60    | PPR damping; higher = context clusters tighter around changes (`--scoring ppr` only) |
-| `--tau`     | 0.12    | Relevance threshold for full fragment content; lower-scoring fragments are stubbed or dropped (lower = more context) |
+| `--tau`     | 0.05    | Relevance threshold for full fragment content; lower-scoring fragments are stubbed or dropped (lower = more context) |
 | `--full`    | false   | Only the changed files, every fragment, no related-code context          |
 | `--timeout` | 300     | Wall-clock deadline in seconds; on expiry diffctx exits 124 instead of hanging |
 | `--with-raw-diff` | false | Also embed git's raw unified diff ahead of the selected fragments — additive (selection unchanged), not charged to `--budget`, lock/ignored/secret-like sections omitted. Python CLI only |
@@ -143,7 +143,7 @@ ctx = build_diff_context(
     "HEAD~1..HEAD",
     budget_tokens=None,       # None = auto; 0 = strict-zero floor (empty); -1 = uncapped; N = hard cap
     alpha=0.6,
-    tau=0.12,
+    tau=0.05,
     full=False,
     scoring_mode="ego",
     timeout=300,

{diffctx-1.13.0 → diffctx-1.14.0}/crates/diffctx-native/src/config/limits.rs

@@ -49,11 +49,15 @@ pub const MAX_BLOB_READ_BYTES: usize = 16_000_000;
 pub const DEFAULT_SCORING: &str = "ego";
 
 pub const DEFAULT_PPR_ALPHA: f64 = 0.60;
-/// Confirmed by the v4 re-calibration on the EGO pipeline (5x3 grid,
-/// v1 calibration manifest): validated winner (tau, cbf) = (0.12, 0.5)
-/// at min(per_benchmark file_recall) = 0.6532, validation 0.6604.
-/// Surface flat and monotone (top-3 within 0.004) — choice is robust.
-pub const DEFAULT_STOPPING_THRESHOLD: f64 = 0.12;
+/// v5 re-calibration under per-file admission (4x3 grid, v1 calibration
+/// manifest, held-out validated): winner (tau, cbf) = (0.05, 0.4) at
+/// min(per_benchmark file_recall) = 0.6815 vs 0.6684 for the old point.
+/// Confirmed on the test splits (500x3): file_recall parity with the old
+/// default, contextbench file_precision +0.041 (CI excludes zero), and on
+/// dcbench-372 paired nontrivial recall within noise at -4% tokens. The
+/// weak stop only ships together with the admission gate (#65): without it,
+/// tau=0.05 re-admits the diffuse tail the gate exists to block.
+pub const DEFAULT_STOPPING_THRESHOLD: f64 = 0.05;
 pub const DEFAULT_PIPELINE_TIMEOUT_SECONDS: u64 = 300;
 
 pub struct PPRConfig {

{diffctx-1.13.0 → diffctx-1.14.0}/crates/diffctx-native/src/config/selection.rs

@@ -1,22 +1,32 @@
 use crate::config::env_overrides::{read_env_fraction, read_env_u32};
 
+// v5 re-calibration under per-file admission: validated winner
+// (tau, cbf) = (0.05, 0.4); the tau half lives in limits.rs. Named (and
+// exported through pybridge) so the Python layers read it instead of
+// restating it — the same drift class as #175's tau copies.
+pub const DEFAULT_CORE_BUDGET_FRACTION: f64 = 0.4;
+
 #[derive(Clone)]
 pub struct SelectionConfig {
     pub core_budget_fraction: f64,
     pub r_cap_min: f64,
+    /// Share of the run budget one file may consume while other files still
+    /// have unplaced candidates (#194: a single +9k-line data blob monopolized
+    /// 364 of 370 output sections). The ceiling binds only in the first
+    /// placement phase — leftovers no other file claims flow back to whoever
+    /// wants them, so a single-file change is unaffected.
+    pub per_file_budget_fraction: f64,
 }
 
 impl Default for SelectionConfig {
     fn default() -> Self {
         Self {
-            // Confirmed by the v4 re-calibration on the EGO pipeline
-            // (5x3 grid over the v1 calibration manifest): validated
-            // winner (tau, cbf) = (0.12, 0.5) at min(per_benchmark
-            // file_recall) = 0.6532. Surface is flat and monotone
-            // (top-3 within 0.004), so the choice is robust rather
-            // than tuned to a sharp optimum.
-            core_budget_fraction: 0.5,
+            // cbf margin over 0.5 is small but consistent in direction on
+            // both the calibration and held-out manifests. Surface flat and
+            // monotone, as in v4.
+            core_budget_fraction: DEFAULT_CORE_BUDGET_FRACTION,
             r_cap_min: 0.01,
+            per_file_budget_fraction: 0.25,
         }
     }
 }
@@ -57,8 +67,15 @@ impl Default for BoltzmannConfig {
 
 pub fn selection() -> SelectionConfig {
     SelectionConfig {
-        core_budget_fraction: read_env_fraction("DIFFCTX_OP_SELECTION_CORE_BUDGET_FRACTION", 0.5),
+        core_budget_fraction: read_env_fraction(
+            "DIFFCTX_OP_SELECTION_CORE_BUDGET_FRACTION",
+            DEFAULT_CORE_BUDGET_FRACTION,
+        ),
         r_cap_min: read_env_fraction("DIFFCTX_OP_SELECTION_R_CAP_MIN", 0.01),
+        per_file_budget_fraction: read_env_fraction(
+            "DIFFCTX_OP_SELECTION_PER_FILE_BUDGET_FRACTION",
+            0.25,
+        ),
     }
 }
 

diffctx-1.14.0/crates/diffctx-native/src/deadline.rs

@@ -0,0 +1,142 @@
+use std::cell::Cell;
+use std::time::{Duration, Instant};
+
+/// Per-run wall-clock ceiling for the compute phases.
+///
+/// The `timeout` parameter only ever reached git subprocesses
+/// (`set_git_timeout`); the native CLI is protected by a process-level
+/// watchdog that exits 124, but the library path — pyo3, and through it the
+/// MCP server — had no ceiling at all: a 420s timeout was observed to sit
+/// through an 8-minute edge build without firing.
+///
+/// A per-run value rather than a process global (#210): the MCP server runs
+/// overlapping pipelines on worker threads, and a shared atomic meant the
+/// last request to arrive overwrote every in-flight request's ceiling — and
+/// an expired ceiling was never cleared, so unrelated later runs in the same
+/// process (the yaml harness above all) inherited it.
+///
+/// Expiry panics with a recognizable message on purpose: the phase runs deep
+/// inside call chains that do not return `Result`, rayon propagates the
+/// unwind to the caller, and pyo3 surfaces it as a Python exception — an
+/// error after `timeout` seconds, where before there was a hang.
+#[derive(Clone, Copy, Debug)]
+pub struct Deadline {
+    expires_at: Option<Instant>,
+}
+
+impl Deadline {
+    /// Saturating: an absurd caller-supplied timeout must clamp to "no
+    /// ceiling", not wrap behind `now` and fire instantly.
+    pub fn from_timeout_secs(timeout_secs: u64) -> Self {
+        Deadline {
+            expires_at: Instant::now().checked_add(Duration::from_secs(timeout_secs)),
+        }
+    }
+
+    pub fn none() -> Self {
+        Deadline { expires_at: None }
+    }
+
+    pub fn check(&self, phase: &str) {
+        if let Some(expires_at) = self.expires_at {
+            check_expired(Instant::now(), expires_at, phase);
+        }
+    }
+
+    /// Publishes this deadline to the current thread for the guard's
+    /// lifetime, so hot loops deep inside edge builders can poll it via
+    /// `check_current_every` without threading a parameter through 51
+    /// `EdgeBuilder::build` implementations. Each rayon worker publishes its
+    /// own copy, so concurrent runs never see each other's ceiling.
+    pub fn enter(&self) -> ScopedDeadline {
+        let prev = CURRENT.with(|c| c.replace(self.expires_at));
+        ScopedDeadline { prev }
+    }
+}
+
+thread_local! {
+    static CURRENT: Cell<Option<Instant>> = const { Cell::new(None) };
+}
+
+pub struct ScopedDeadline {
+    prev: Option<Instant>,
+}
+
+impl Drop for ScopedDeadline {
+    fn drop(&mut self) {
+        let prev = self.prev;
+        CURRENT.with(|c| c.set(prev));
+    }
+}
+
+/// Cheap intra-loop poll: costs a branch on all but every `every`-th
+/// iteration. For the builder loops whose single invocation can outrun the
+/// whole timeout (the envoy 520-`config` cross product, the sentry-scale
+/// config-key scan), where the between-builders check cannot help.
+pub fn check_current_every(i: usize, every: usize, phase: &str) {
+    if i % every != 0 {
+        return;
+    }
+    if let Some(expires_at) = CURRENT.with(|c| c.get()) {
+        check_expired(Instant::now(), expires_at, phase);
+    }
+}
+
+fn check_expired(now: Instant, expires_at: Instant, phase: &str) {
+    if now > expires_at {
+        panic!("diffctx compute deadline exceeded during {phase}");
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn an_expired_deadline_panics_with_the_phase_name() {
+        let deadline = Deadline::from_timeout_secs(0);
+        std::thread::sleep(Duration::from_millis(5));
+        let err = std::panic::catch_unwind(|| deadline.check("edge construction"))
+            .expect_err("deadline did not fire");
+        let msg = err.downcast_ref::<String>().cloned().unwrap_or_default();
+        assert!(msg.contains("edge construction"), "message was: {msg}");
+    }
+
+    #[test]
+    fn an_unexpired_deadline_does_not_fire() {
+        Deadline::from_timeout_secs(1000).check("edge construction");
+        Deadline::none().check("edge construction");
+    }
+
+    #[test]
+    fn concurrent_deadlines_do_not_affect_each_other() {
+        // The #210 defect: request B's short ceiling used to overwrite
+        // request A's. Per-run values make each check see only its own.
+        let short = Deadline::from_timeout_secs(0);
+        let long = Deadline::from_timeout_secs(1000);
+        std::thread::sleep(Duration::from_millis(5));
+        long.check("edge construction");
+        std::panic::catch_unwind(|| short.check("edge construction"))
+            .expect_err("short deadline did not fire");
+        long.check("edge construction");
+    }
+
+    #[test]
+    fn scoped_deadline_clears_on_drop_and_nests() {
+        let outer = Deadline::from_timeout_secs(1000);
+        let guard = outer.enter();
+        check_current_every(0, 1, "edge construction");
+        {
+            let expired = Deadline::from_timeout_secs(0);
+            let inner = expired.enter();
+            std::thread::sleep(Duration::from_millis(5));
+            std::panic::catch_unwind(|| check_current_every(0, 1, "edge construction"))
+                .expect_err("inner deadline did not fire");
+            drop(inner);
+        }
+        check_current_every(0, 1, "edge construction");
+        drop(guard);
+        // No deadline published: must never fire.
+        check_current_every(0, 1, "edge construction");
+    }
+}

{diffctx-1.13.0 → diffctx-1.14.0}/crates/diffctx-native/src/discovery.rs

@@ -309,24 +309,6 @@ impl EnsembleDiscovery {
     pub fn new(strategies: Vec<Box<dyn DiscoveryStrategy>>) -> Self {
         Self { strategies }
     }
-
-    pub fn default_ensemble() -> Self {
-        // The lexical channel's breadth into the candidate universe. The
-        // shipped 1 means BM25 contributes a single file to discovery; measured
-        // on dcbench, 79% of nontrivial gold never enters the universe at all,
-        // and most of it shares 3+ path tokens with the diff — exactly what a
-        // wider lexical channel would surface. Env-gated for the universe
-        // ablation (#130); unset, behaviour is byte-identical to before.
-        let bm25_k =
-            crate::config::env_overrides::read_env_usize("DIFFCTX_BM25_DISCOVERY_TOP_K", 1);
-        Self {
-            strategies: vec![
-                Box::new(DefaultDiscovery),
-                Box::new(TestFileDiscovery),
-                Box::new(BM25Discovery::new(bm25_k)),
-            ],
-        }
-    }
 }
 
 impl DiscoveryStrategy for EnsembleDiscovery {
@@ -750,11 +732,4 @@ mod tests {
         assert_eq!(paths.len(), 1);
         assert_eq!(attribution[0].1, "solo");
     }
-
-    #[test]
-    fn default_ensemble_wires_three_channels() {
-        // A channel silently disappearing from the default wiring is exactly
-        // the regression the ensemble's own output cannot reveal.
-        assert_eq!(EnsembleDiscovery::default_ensemble().strategies.len(), 3);
-    }
 }