Train 26b: name-only calls marked, typed receivers resolve, honest path gaps and counts

.coderabbit.yaml

@@ -5,6 +5,8 @@
 #   - No re-review on every push: each fix commit used to start a new pass over a new diff.
 #   - No automatic reply inside review threads: every in-thread answer used to wake another pass.
 #   - Vendored parsers and generated/pinned files are excluded; a review of them cannot change them.
+#   - Gate fixture trees (test/*fix/) are excluded: they are inputs, and a train carrying many of them
+#     went over the 300-file review limit (the whole review was skipped).
 #   - No docstring-coverage pre-merge check: the house style documents contracts where they bite, not every symbol.
 # CodeRabbit reads this file from the PR's head branch, so a fork PR picks it up once it merges main.
 reviews:
@@ -17,6 +19,7 @@ reviews:
     - "!docs/captures/**"
     - "!test/*.hash"
     - "!test/printf_parity.manifest"
+    - "!test/*fix/**"                # gate fixture trees (inputs a gate parses); keeps a train PR under the 300-file review limit
   path_instructions:
     - path: "src/**"
       instructions: >-

.github/pargates-shard-weights.json

@@ -93,6 +93,7 @@
 "constcheck.sh": 2.7,
 "contextratiocheck.sh": 2.8,
 "coplintcheck.sh": 0.9,
+"countfloorcheck.sh": 14.0,
 "cppbenchcheck.sh": 170.6,
 "cppoperatorcheck.sh": 5.5,
 "cppqualcheck.sh": 36.1,
@@ -112,6 +113,7 @@
 "deckclaimcheck.sh": 0.1,
 "deeptailcheck.sh": 1.0,
 "defaultceilingcheck.sh": 20.1,
+"defectshapecheck.sh": 14.2,
 "defoverdeclcheck.sh": 1.4,
 "degradedhintcheck.sh": 2.5,
 "dependencypincheck.sh": 2.0,
@@ -197,6 +199,7 @@
 "forrankordercheck.sh": 77.9,
 "forrootlegendcheck.sh": 8.6,
 "forsectioncollapsecheck.sh": 5.2,
+"forsigspancheck.sh": 6.0,
 "freshclonecheck.sh": 170.8,
 "freshnesscheck.sh": 4.4,
 "g1configcheck.sh": 0.8,
@@ -209,6 +212,7 @@
 "gitstampcheck.sh": 84.3,
 "goinstcheck.sh": 0.2,
 "gointerfacecheck.sh": 0.4,
+"gokindcheck.sh": 0.6,
 "graphlegendbudgetcheck.sh": 2.5,
 "graphqueryrefusecheck.sh": 1.9,
 "grepandcheck.sh": 8.8,
@@ -386,6 +390,7 @@
 "pargatescheck.sh": 8.9,
 "parsehealthcheck.sh": 1.9,
 "partitioncheck.sh": 7.2,
+"pathgapcheck.sh": 1.5,
 "patterncheck.sh": 5.0,
 "perfharnesscheck.sh": 8.6,
 "phpcheck.sh": 2.4,
@@ -463,6 +468,7 @@
 "recalltablecheck.sh": 0.2,
 "recalltotalcheck.sh": 24.7,
 "receiptpostcheck.sh": 20.4,
+"receiverevidencecheck.sh": 36.0,
 "redactcheck.sh": 2.2,
 "redactfixcheck.sh": 0.3,
 "refusaltailcheck.sh": 3.4,

.github/workflows/ci.yml

@@ -723,6 +723,16 @@ jobs:
       - name: Sanitizer-only class — crashsweepcheck far-future timestamp and fixed-name shapes (test/crashsweepcheck.sh)
         run: RIPWIRE_BIN=asan/ripwire RIPWIRE_ASAN_BIN=asan/ripwire bash test/crashsweepcheck.sh
 
+      # A lifetime class only a sanitizer shows: one long-lived `--mcp` session rebuilt in place (a chmod, a new non-source
+      # file, an edit, a root switch, a memory release) and queried again each time. A cached ValueRefIndex once outlived
+      # the index it pointed into (heap-use-after-free) and no single-query gate could see it. The gate drives that session
+      # on this binary for 20 cycles and checks every answer against a one-shot CLI run; one binary plays both roles.
+      # LeakSanitizer is off in this step on BOTH legs (the gate sets detect_leaks=0 for its own processes; its subject is
+      # lifetime, not leaks, and the Linux leg has not yet shown a clean exit-time leak set for it).
+      # A failure leaves the gate's sanitizer reports in /tmp/asanlog-mcpreload.* for the upload step below.
+      - name: Sanitizer-only class — MCP index reloads under ASan (test/mcpreloadasancheck.sh)
+        run: RIPWIRE_BIN=asan/ripwire bash test/mcpreloadasancheck.sh
+
       - name: det-gate — 2-run byte-identical diff (ASan binary)
         run: |
           ./asan/ripwire test/fixture --no-cache >/tmp/run_a.xml

CMakeLists.txt

@@ -1015,13 +1015,78 @@ if(WIN32)
 endif()
 
 if(RIPWIRE_ASAN)
-  # AppleClang 17's ASan runtime hangs in its own start-up on macOS 26 (Darwin 25), before main, so every
-  # sanitizer run times out. CI's Xcode 26.6 AppleClang 21 is unaffected. A warning, not an error: the
-  # tree still builds, and CONTRIBUTING's sanitizer section has the Homebrew LLVM 22 recipe.
-  if(APPLE AND CMAKE_CXX_COMPILER_ID STREQUAL "AppleClang" AND CMAKE_CXX_COMPILER_VERSION VERSION_LESS 21
-     AND CMAKE_HOST_SYSTEM_VERSION VERSION_GREATER_EQUAL 25)
-    message(WARNING "RIPWIRE_ASAN: AppleClang ${CMAKE_CXX_COMPILER_VERSION} on macOS 26 is known to hang in "
-      "ASan start-up before main. Configure this tree with Homebrew LLVM 22 (CONTRIBUTING.md, Sanitizer build).")
+  # Some macOS toolchains ship an ASan runtime that deadlocks in its own start-up, before main (Apple clang 17.0.0 /
+  # Command Line Tools 26.3 on macOS 26.7: libSystem's malloc init enters AsanInitFromRtl, whose shadow-memory
+  # set-up allocates through dyld and re-enters it). Every sanitizer binary and every ASan gate then just hangs, and
+  # the contributor sees only timeouts. So on Apple, with ASan on, run an empty -fsanitize=address program once, under
+  # a timeout, and stop with the fix if it does not finish. Nothing here runs without RIPWIRE_ASAN or off Apple, and a
+  # pass is cached per (compiler, version, host OS) so a reconfigure does not pay for it again and prints nothing new.
+  if(APPLE AND CMAKE_SYSTEM_NAME STREQUAL "Darwin" AND NOT CMAKE_CROSSCOMPILING
+     AND CMAKE_CXX_COMPILER_ID MATCHES "Clang")
+    set(RIPWIRE_ASAN_PROBE_TIMEOUT 10 CACHE STRING "seconds the configure-time ASan start-up probe may take (macOS)")
+    # CMake never re-detects CMAKE_CXX_COMPILER_VERSION (or the host OS version) in an existing build tree, and a Command
+    # Line Tools/Xcode update replaces the compiler behind the same /usr/bin/c++. So the key also carries the ASan
+    # runtime the compiler links today (its path and modification time): an in-place toolchain update re-runs the probe.
+    execute_process(COMMAND ${CMAKE_CXX_COMPILER} ${CMAKE_CXX_COMPILER_ARG1} -print-file-name=libclang_rt.asan_osx_dynamic.dylib
+      OUTPUT_VARIABLE _ripwire_asan_rt OUTPUT_STRIP_TRAILING_WHITESPACE ERROR_QUIET)
+    set(_ripwire_asan_rt_stamp "")
+    if(EXISTS "${_ripwire_asan_rt}")
+      file(TIMESTAMP "${_ripwire_asan_rt}" _ripwire_asan_rt_stamp "%s" UTC)
+    endif()
+    set(_ripwire_asan_probe_key
+      "${CMAKE_CXX_COMPILER}|${CMAKE_CXX_COMPILER_VERSION}|${CMAKE_HOST_SYSTEM_VERSION}|${CMAKE_OSX_SYSROOT}|${CMAKE_EXE_LINKER_FLAGS}|${_ripwire_asan_rt}@${_ripwire_asan_rt_stamp}")
+    if(NOT "${_ripwire_asan_probe_key}" STREQUAL "${_RIPWIRE_ASAN_PROBE_PASSED}")
+      set(_ripwire_asan_probe_dir "${CMAKE_BINARY_DIR}/CMakeFiles/ripwire_asan_probe")
+      file(MAKE_DIRECTORY "${_ripwire_asan_probe_dir}")
+      file(WRITE "${_ripwire_asan_probe_dir}/probe.cpp" "int main() { return 0; }\n")
+      set(_ripwire_asan_probe_cmd ${CMAKE_CXX_COMPILER} ${CMAKE_CXX_COMPILER_ARG1})
+      if(CMAKE_OSX_SYSROOT)
+        list(APPEND _ripwire_asan_probe_cmd -isysroot "${CMAKE_OSX_SYSROOT}")
+      endif()
+      if(CMAKE_OSX_ARCHITECTURES)
+        foreach(_ripwire_asan_probe_arch IN LISTS CMAKE_OSX_ARCHITECTURES)
+          list(APPEND _ripwire_asan_probe_cmd -arch "${_ripwire_asan_probe_arch}")
+        endforeach()
+      endif()
+      separate_arguments(_ripwire_asan_probe_ldflags NATIVE_COMMAND "${CMAKE_EXE_LINKER_FLAGS}")
+      execute_process(
+        COMMAND ${_ripwire_asan_probe_cmd} ${_ripwire_asan_probe_ldflags} -fsanitize=address
+                "${_ripwire_asan_probe_dir}/probe.cpp" -o "${_ripwire_asan_probe_dir}/probe"
+        RESULT_VARIABLE _ripwire_asan_probe_build_rc
+        OUTPUT_VARIABLE _ripwire_asan_probe_build_out ERROR_VARIABLE _ripwire_asan_probe_build_out)
+      if(NOT _ripwire_asan_probe_build_rc EQUAL 0)
+        message(FATAL_ERROR "RIPWIRE_ASAN: ${CMAKE_CXX_COMPILER} could not build an empty -fsanitize=address program "
+          "(${_ripwire_asan_probe_build_rc}):\n${_ripwire_asan_probe_build_out}\n"
+          "This toolchain has no usable AddressSanitizer runtime. Install the Command Line Tools/Xcode that ship one, or "
+          "configure with Homebrew LLVM (CONTRIBUTING.md, Sanitizer build):\n"
+          "  cmake -S . -B asan -DRIPWIRE_ASAN=ON -DCMAKE_C_COMPILER=$(brew --prefix llvm@22)/bin/clang "
+          "-DCMAKE_CXX_COMPILER=$(brew --prefix llvm@22)/bin/clang++")
+      endif()
+      execute_process(
+        COMMAND ${CMAKE_COMMAND} -E env ASAN_OPTIONS=detect_leaks=0 "${_ripwire_asan_probe_dir}/probe"
+        TIMEOUT ${RIPWIRE_ASAN_PROBE_TIMEOUT}
+        RESULT_VARIABLE _ripwire_asan_probe_run_rc
+        OUTPUT_QUIET ERROR_QUIET)
+      if(NOT _ripwire_asan_probe_run_rc EQUAL 0 AND NOT _ripwire_asan_probe_run_rc MATCHES "timeout")
+        message(FATAL_ERROR "RIPWIRE_ASAN: an empty program built with ${CMAKE_CXX_COMPILER} -fsanitize=address exited "
+          "(${_ripwire_asan_probe_run_rc}) instead of returning 0: this toolchain's AddressSanitizer runtime fails at "
+          "start-up. Update the Command Line Tools / Xcode, or configure with Homebrew LLVM (CONTRIBUTING.md, Sanitizer "
+          "build).")
+      elseif(NOT _ripwire_asan_probe_run_rc EQUAL 0)
+        message(FATAL_ERROR "RIPWIRE_ASAN: an empty program built with ${CMAKE_CXX_COMPILER} -fsanitize=address did not "
+          "run to completion within ${RIPWIRE_ASAN_PROBE_TIMEOUT} s (${_ripwire_asan_probe_run_rc}). This toolchain's "
+          "AddressSanitizer runtime deadlocks in its own start-up, before main, on this macOS (seen with Apple clang "
+          "17.0.0 / Command Line Tools 26.3 on macOS 26.7), so every sanitizer binary and gate would hang. Either "
+          "update the Command Line Tools / Xcode (softwareupdate, or Xcode's Settings > Components), or configure with "
+          "Homebrew LLVM, which carries a runtime that starts:\n"
+          "  brew install llvm@22\n"
+          "  cmake --fresh -S . -B asan -DRIPWIRE_ASAN=ON -DCMAKE_C_COMPILER=$(brew --prefix llvm@22)/bin/clang "
+          "-DCMAKE_CXX_COMPILER=$(brew --prefix llvm@22)/bin/clang++\n"
+          "(CONTRIBUTING.md, Sanitizer build, has the matching linker flags.) Raise RIPWIRE_ASAN_PROBE_TIMEOUT only if "
+          "this host is simply very busy.")
+      endif()
+      set(_RIPWIRE_ASAN_PROBE_PASSED "${_ripwire_asan_probe_key}" CACHE INTERNAL "ASan start-up probe passed for this toolchain")
+    endif()
   endif()
   set(_ripwire_windows_clangcl_asan OFF)
   set(_ripwire_no_omit_frame_pointer -fno-omit-frame-pointer)

CONTRIBUTING.md

@@ -38,7 +38,10 @@ LSAN_OPTIONS=suppressions=lsan_suppressions.txt ./asan/ripwire <dir> >/dev/null
 **macOS 26 with the Command Line Tools' AppleClang 17: ASan hangs before `main`.** Every
 `-fsanitize=address` binary, even an empty `main`, hangs in ASan's start-up (shadow-memory set-up
 walking the dyld shared cache), so each ASan gate just times out. CI's Xcode 26.6 AppleClang 21 is
-not affected, and CMake warns when it sees the affected pair. Configure the sanitizer tree with
+not affected, and an `-DRIPWIRE_ASAN=ON` configure on macOS now runs an empty ASan program once under a
+10 s timeout and stops with the fix if it hangs (the two fixes: update the Command Line Tools/Xcode, or use
+Homebrew LLVM 22 as below), while the gates that compile their own ASan harness prefer `llvm@22`'s `clang++`
+when it is installed (an explicit `CXX` wins) and otherwise SKIP by name. Configure the sanitizer tree with
 Homebrew LLVM 22 instead, linking its own libc++ so the headers and the dylib are one release
 (Homebrew clang otherwise links the system libc++ against its libc++ 22 headers):
 
@@ -842,6 +845,36 @@ round. Each takes minutes to check; each miss costs a review round.
     claim; a dedup or merge of findings keeps the most severe row, not the first; a substring match on a
     name is whole-word or bounded (probe `catalog` and `dialog` for `log`); a per-tag or per-file cap
     cannot make the result depend on file order.
+14. **A gate fails closed.** A shell gate checks that a value is present and numeric before it compares it, so an
+    erroring comparison never falls through to PASS; it SKIPs a case only for a named, expected missing premise and
+    FAILs on any other; an absence ("no row X", "nothing skipped") is read only off a command that succeeded and
+    produced its root or rows; when one harness call is added to sibling gates, diff the call sites so every arm
+    runs. A wrapper records the runner's own exit status right after it, and a reported `rc=0` is checked against
+    the log's failure count.
+15. **Claims match every surface.** A comment, legend or doc that says a case is handled names the arm that proves
+    it, or the claim goes. After a behaviour change, search every surface that describes it (CLI help, MCP tool
+    descriptions, legends, docs) for sentences the change made false, and re-check size ceilings such as the MCP
+    tool list. A count over a set (overloads, roots, shards) counts distinct entities; probe two members that meet
+    the same one. An external read on an answer path tells "could not read" from "read, empty" and discloses the
+    failure, never "none".
+16. **A match key names the real entity.** A filter, dedup or match identifies owner + name in its binding
+    scope, never file + name; probe two owners of one name in one file, and a bare name beside a same-named
+    class member.
+17. **A gate detects what it needs and skips by name.** A gate that needs a sanitizer, a tool or a locale
+    checks for it itself and SKIPs naming it when absent; a guard on machine state exits rather than printing;
+    a new row or attribute name does not match the name patterns existing gates grep for.
+18. **After any merge, count format placeholders against arguments** at every format call either side
+    touched: two sides adding the same `{}` merge cleanly and silently drop an argument. Never edit a tree
+    while its suite runs.
+19. **Commit before you mutate.** Commit the fix before a mutation test, and undo a mutation by restoring the
+    committed file, never by checking out over uncommitted work; a build's `built_from` matches the commit it
+    claims.
+20. **A text cap cuts on a UTF-8 boundary** and adds the ellipsis only when bytes were dropped; probe a
+    multibyte character straddling the cap, a text of exactly the cap, and the same slot in every language
+    that writes it.
+21. **A derived cache dies with its parent.** A cached object that points into a rebuilt structure is dropped
+    wherever that structure is reassigned, never kept on a content stamp; probe a rebuild that keeps the
+    stamp (a chmod, a new non-source file) under the sanitizer build.
 
 **The gate count is a build product.** It is stated in `README.md`, `docs/EVALS.md` and
 `present/deck5_ripwire_build.js` — eight sites — and every one of them is written by

INSTALL.md

@@ -185,6 +185,12 @@ rm -rf "$h/substitution.jsonl" "$h/routing.jsonl" "$h/routing-pending" "$h/meter
 rmdir "$h" 2>/dev/null || true
 ```
 
+`meter.conf` is optional and the installer never writes it. With no `meter.conf` (and no `RIPWIRE_METER_ARM`
+in the environment) the hooks assign each session to the `treatment` or `control` arm of the router and
+meter A/B by a stable hash of the session id (about half each), so a default install has a control group. Control sessions
+get the same logging and no injected advice. To force every session onto one side, write `arm=treatment` or
+`arm=control` into `$h/meter.conf` (or set `RIPWIRE_METER_ARM`); `arm=auto` spells out the default.
+
 **4. The MCP server** (only if you added it).
 
 - Claude Code: `claude mcp remove ripwire`.