Rewrite Changelog

R840 (325d3284e`+87b06ebc0` slice 1, 317b08b93 slice 2, 341a758a3 slice 3; In Progress → In Review 323454bb3, Done gate in this commit): The spec-by-example corpus became a folder of self-describing, fact-first SDL documents. All 57 fixtures live as graphitron/src/test/resources/corpus/<id>.graphqls with the prelude a document beside them; ClassifiedCorpus and the Java prelude string are retired, and CorpusDocuments loads the folder from the source tree under four floors (non-vacuity ratchet, listing agreement, every document claimed by the parameterized test, split invariant). Each document states what the fact store holds for it as @expectEquals(relation:, rows:) CSV blocks, read back out of the store and compared by anti-join in both directions, with name resolution through StoreCatalog, well-formedness, an assertable-population fence and CHECK-membership checks, planted regressions under each. code-generation-triggers.adoc collapsed from 2474 to 1208 lines: 32 generated-and-committed _example-<id>.adoc fragments are simultaneously the page’s includes and the emitted-names approval files, held by CorpusFragmentTest with three placement floors (a fragment with no document, a document with a projection and no fragment, a fragment no page includes), retiring ClassifiedDocTest, OutcomeBlockDocTest and the paste loop. Adding a worked example is now a document, a regenerated fragment and one include line, no .java edit. The per-axis @classified retirement waits on R682’s relations; each surviving tuple axis is a visible request for one.

R814 (b868b9947-e3ddcd419 the slice-3 promotion round, 9e567f89f the rework; In Progress → In Review 6852fa364, In Review → Ready 151cb1799, Done gate in this commit): docs/architecture/reference/code-generation-triggers.adoc described the classification walk it is organized around, a surface the tree calls "being drained, not a place to extend", and routed a contributor into it. The page is now organized as the chain the generator runs, capture to facts to verdicts to command rows to rendered units, with the verdict layer (intent_authored_field_claim and kin) as its closed vocabulary, a build-generated command-relation fragment that is never committed, a six-package ownership map replacing a Source Map whose opening claim was false, and thirty-two corpus examples each carrying a machine-rendered outcome block beside its SDL. Two guards landed with it, both against habitats nothing scanned: ArchitectureDocSymbolGuardTest resolves every backticked type span on an architecture page against the reactor classpath, and TransientCitationCheck grew a walked habitat over docs/architecture and docs/manual. Both carry anti-vacuous floors and neither carries a burn-down list, those having reached empty and been replaced by direct real-tree assertions. The promotion loop found more than redundancy: two reference rows claimed graphql-java’s default fetcher handled a coordinate the generator emits a method for, one row claimed a Relay trigger by field name where the generator matches by signature, and six type-side fixtures turned out to pin verdicts on schemas the build refuses, which is what a doc example running generation catches and a classification-only corpus does not. Goal 3 (every enumerable claim renders from a gated source, or is not on the page) is deliberately not met, and the reasoning was moved out of a commit message and into the item body at the Done gate’s insistence, which is what let it be carried here rather than deleted with the file. The remainder splits three ways with an owner each: the refusal rows are at their floor, since a success-only corpus has no example to subsume a build failure, and go to R842; the live generating rows go to R845, which states why waiting beats promoting, the paste loop being what R840 abolishes and the sealed leaf vocabulary the rows are written in being what R682 deletes, so an example authored now needs rewriting anyway; and rows a rendered block already subsumes are pure deletion rather than promotion, so the waiting argument never covered them and they were folded in. The Done gate bounced one round, on completeness rather than on code. Round 1 found two of the item’s four stated goals unmet with the stopping argument recorded only in a commit message, a thirteen-part narrative that answered how the work went rather than whether it was done, and four of the five archaeology fragments the item’s own survey had named still on the page as parentheticals inside cells that otherwise stated today’s behaviour. It also found a roadmap plan slug cited on a published page which the item’s own citation gate could not see, the two existing patterns anchoring on an id and on a roadmap/ path while a bare slug offers a regex nothing to match. The rework deleted all four fragments, folded in the @field(name:) scalar-child row after verifying both its spellings render, rewrote the state section into what shipped and what is left with owners, replaced the slug with the live anchor the code uses (Rejection.StubKey.VariantClass), and widened the gate rather than deferring it: a third pattern resolves a backticked span against the files actually under roadmap/, the backtick requirement being load-bearing because a live slug is already spelled out in the manual as an ordinary hyphenated adjective and a shape-only match would report English prose as a citation. Independent-session In Review → Done review, the reviewer sharing no session with any implementation commit: full reactor green under mvn install -Plocal-db. Completeness was checked against the item’s own four goals rather than the build, each verified against the tree: zero R<n> citations and zero resolvable bare-slug citations across both published trees, zero dangling symbols, zero surviving archaeology fragments, and the @field(name:) subsumption confirmed at the coordinate rather than taken on trust (Country.name under @field(name: "country") renders TABLE_COLUMN in the derived-layer example’s outcome block). The widened gate was checked for both directions and for the cost that would have made it unaffordable, the seven new cases covering a planted bare slug, a hyphenated prose collision that must not fire, a backticked span naming no item, and double-reporting when a path citation already fired on the line. The two blocking findings' repairs went beyond what the findings asked in one place worth recording: the gate hole could have been closed by editing one sentence, and was closed by making the guard able to see the shape. Round 1’s build observation was diagnosed rather than dismissed as a flake and filed as R843, the reviewer’s reproduction (passes alone, passes as a class, passes as a module, fails once in the parallel reactor) and the implementer’s diagnosis agreeing: DmlBulkMutationsExecutionTest seeds film_actor rows the splitTableField_bridgingConditionJoin assertion counts, against one shared database at parallelism 4. User-facing-doc check clean, no roadmap-internal marker surviving in either tree; retirement sweep skipped, the item declaring no retired vocabulary; no code-string assertions on generated method bodies, OutcomeBlockRendererTest.theBlockRendersNoCommandRowsAndNoBodies pinning names and parameter lists as the ceiling.

R832 (47cae33a8 the budget split, 72a09d416 the re-measured ceiling; filed 32d1299ac, Backlog → Spec 61a879a6d, Spec → Ready 24c63d94c, Ready → In Progress 47cae33a8, In Progress → In Review 053d577cb, In Review → Ready 6e4e0c3d4, Ready → In Progress 6d0e6b34d, In Progress → In Review 118fa378f; Done-gate review in this commit): CatalogRefreshTest’s single `WAIT_MS carried two independent quantities that happened to share a value, and splitting them by what each pays is what let either be argued at all. FIRE_CEILING_MS is a bound on failure, paid only on a red run because CountDownLatch.await returns the moment the latch counts down, so both positive awaits take it and a generous figure costs a green run nothing; QUIESCENCE_MS is a Thread.sleep the negative test pays in full on every green run, so it stays at sixteen times the debounce, a shorter window being what would turn a mis-wired late fire into a silent pass. Only the ceiling moved, from the inherited 1.6 s to 60.1 s, and the per-run cost is unchanged, which is the property that says the split landed on the right axis. The trigger this budget actually holds is real work, a cold SourceWalker parse through the Compiler Tree API plus the jOOQ writes that land it, where the SchemaWatcherTest the figure was inherited from triggers no-op countDown() runnables; that test keeps its own WAIT_MS, as the item’s out-of-scope section declares, with the disclosed gap that nothing enforces its triggers staying no-ops. The Done gate bounced one round, on the item’s own completeness instrument rather than on its code. The spec had made the headroom ratio the falsifiable evidence and said why, the measurement and the ceiling both living in the javadoc so that a reviewer could re-measure, divide and compare. The ratio did not survive that division: 854 ms and "roughly seventeen times" were a single quiet-machine sample presented as a measurement of a figure whose whole job is to survive a loaded one, and re-measurement under the module’s own four-way class concurrency put the refresh at 4,308 ms, about 3.5x, with two javadoc sentences false as written. The premise came from the approved Spec body rather than from the implementer’s diff, so the finding was a defect in what the gate had signed off, surfaced because this was the item’s first fresh-context reading. The rework took the free axis rather than the weaker claim: sixteen samples between 483 ms and 4,308 ms, and a ceiling raised to about fourteen times the worst of them. The history paragraph got sharper doing it, no longer citing a ratio against a sample but stating that the retired 1,600 ms budget falls under five of the sixteen, which is a checkable statement about the defect and the sharpest available evidence that the flake was real. Independent-session In Review → Done review, the reviewer sharing no session with any implementation commit: full reactor green under mvn install -Plocal-db (BUILD SUCCESS, 14 modules, none skipped, CatalogRefreshTest 3 of 3 in 4.1 s). Completeness was checked by performing the division the spec invites rather than reading it off the plan, all three figures holding: 60,100 over 4,308 is the stated fourteen, the retired budget sits under exactly the five named samples, and 1,600 is sixteen times the 100 ms debounce. The measurement was then retaken independently by the prescribed method, a System.nanoTime bracket around refreshJavaSources with the module’s classes four-way concurrent and three module suites looping alongside, at load average 35 to 41 on fourteen cores, heavier than the campaign the javadoc records: 491, 2,369 and 4,200 ms, inside the recorded spread, its worst not exceeding the recorded worst, and fourteen times under the ceiling. One mechanical premise the ceiling axis depends on and neither round had stated was checked too: nothing in the reactor sets a surefire fork timeout or a JUnit default timeout, so a red run really does reach the 60 s await and report the intended assertion rather than dying as a fork timeout, which is what makes "generous costs a green run nothing" true of the red run as well. Those loaded runs also corroborated the diagnosis, the class total stretching to 27.4 s while the refresh it brackets stayed under 5, which is why one sample never travelled. Every javadoc {@link} was verified against a live symbol, the reference gate reading main sources only and this being test source; the non-blocking observation that test-javadoc-no-fork is named in the root pom as the pair for test sources and not wired is left as Backlog material, as round 1 put it. User-facing-doc check skipped, the item touching no docs/ file; retirement sweep skipped, the item declaring no retired vocabulary; no code-string assertions on generated method bodies, the pins being store rows and a workspace queue.

R828 (8c03600 the four instruments and the page rule, 1472d69 the recipe’s outer loop, 3665bd1 the profiler’s self-sampling clause; driven end to end and rolled back across 5daaeaa-1ae9a48, Backlog → Spec 3e47227, spec review 6be3615, spec revision 6f5db57, Spec → Ready a815b86, In Progress → In Review f216109, Done-gate review 7ea2d25, rework returned 5d34775; Done gate in this commit): the store-performance skill no longer hand-rolls a timing the database was already keeping. SET QUERY_STATISTICS TRUE and INFORMATION_SCHEMA.QUERY_STATISTICS replace the System.nanoTime() probe outright, in step 2’s recipe and as the default in steps 3 and 5, ranking every relation a run touched instead of costing a probe method per relation, and reporting an execution count and a standard deviation with it. Three instruments join it, each placed against a question the skill already asked and could not answer: ConvertTraceFile at trace level 2 beside report-inline-multiplicity, as the measured counterpart to that tool’s static breadth ranking; trace level 3 behind the existing STORE_EXPLAIN guard, for the planner’s own per-index cost evaluation, which EXPLAIN ANALYZE never reports since it names the plan chosen and not the plans rejected; and org.h2.util.Profiler inside step 1, which keeps its place in the evidence order and stops being a dead end, its depth being a public field whose default of 48 truncates a view stack worse than the JFR default the step used to warn about. Four constraints ride with the statistics because each is a silent wrong answer: result reuse must be off or repeats are not repeats, MIN_EXECUTION_TIME reads 0.0 always and is neither a floor nor a tell, a row at EXECUTION_COUNT 1 ranks and does nothing else, and the statistics are the store’s rather than StoreConsole’s, that being a second database of linked tables. `docs/architecture/explanation/fact-model.adoc took the one addition that is an engine rule rather than instrument mechanics, that H2 reuses a repeated identical query’s result so a repeat is not a repeat until OPTIMIZE_REUSE_RESULTS is off, which is what decides whether any timing on a page made of timings is real; the skill cites it rather than copying the number down, and the citation policy gained a third category for figures that measure the tool rather than any relation. Both gates changed the shipped text. The Spec gate refused a tell that fired on every reading, MIN_EXECUTION_TIME having been named as the reuse discriminator while also being always 0.0, and got the cumulative-over-maximum ratio instead, whose error direction admits no false negatives; it also settled the blast radius, declining a second construction path on GraphitronModelStore because both settings are database-wide and two statements on the store’s own connection reach every reader a session mints. The Done gate caught the recipe looping over relations and never over executions, which delivered the single-run reading with no spread that step 1 opens by warning about, and made the mandatory reuse statement inert, since it does nothing measurable to a single execution.

R705 (ea73eed9 classification and emission, 7e107e36 the execution fixtures, the SQL baseline and the manual page, 9e5280d6 the lateral throw generalised off its original caller; filed and specced across 9f6924ab-eb976b34, Spec → Ready 218994c3, Ready → In Progress 46e0712d, plan departures recorded 5b74f76a, In Progress → In Review 21d07484; Done-gate review in this commit): a {condition:} hop is now legal in a @reference filter path, on both filter surfaces and at every position, mixed freely with {key:} and {table:}. The restriction read as a cardinality rule and was not one: the correlated EXISTS a reference filter emits returns each parent once however many rows the path reaches, which the new reverse-FK execution row pins for the first time, so foreign-key-ness was never buying uniqueness in filter position. Four mechanisms carry it. ServiceCatalog.terminalTableForReference becomes total (TableRef, not Optional), because a hop’s target resolves off its TableExpr and never off its on(), which turns the walker’s empty case back into the one thing it should mean, no such column, and hands two candidate-hint call sites real column names instead of an empty list. resolveConditionJoinTarget collapses its terminal-versus-intermediate fork into one rule keyed on the available source, declaredTarget or reflection on the method’s second parameter, with the positional test left at the call site so an intermediate hop still reflects; the preference direction is load-bearing, since preferring the declared target is what keeps a disagreeing concrete parameter a Check 2 finding rather than a resolution failure. FkHop retires in favour of a ReachPath(List<JoinStep.Hop>) carrier whose compact constructor is the filter rail’s single narrowing site, identity-keyed in the renderer’s alias map so per-occurrence locals survive. And the reach’s two dispatch points move onto the projection rail’s own arms, PathFragments.hopZeroCorrelation extracted from correlationWhere’s `OnParentJoin arm and emitBackwardBridging for interior hops, leaving ConditionGlueRenderer with no On switch of its own and JoinFragments below the narrowing where its charter puts it. Two things ride along. The output-side scalar @reference leaf, which failed with a generic unknown-column rejection for the same walker reason, is unlocked with pipeline and execution coverage rather than given a new guard to preserve an accidental rejection. And a correctness fix with its own acceptance row: reachExists never called appendHopFilters, so a {key:, condition:} filter path emitted an EXISTS without the author’s predicate and matched rows the schema excludes; it now emits them, pinned by a seeded execution case over rows sharing an FK slot but differing in the column the predicate reads. The surviving closure is @condition on an FK-target @nodeId field, restated from structural to Rejection.deferred because its old rationale was a mirror of the emitter precondition this item deletes; that carrier binds decoded id columns to the path’s FK slots and a predicate hop has nothing to bind them to. Docs: join-with-references.adoc retires the "Foreign-key hops only" rule and three stale claims (the condition: form is not a runtime-throwing stub, @reference(path: []) does not fail parsing, and a hop’s own predicate is emitted inside the filter’s EXISTS). Coverage across five tiers, the new ConditionGlueRendererTest among them. Independent-session In Review → Done review: full mvn clean install -Plocal-db green; no code-string assertions on generated method bodies at the pipeline tier; retirement sweep clean against all three layers the item declared; user-facing-doc check clean.

R673 (2a446ec9d the delivery, b3c437fe2 the rework round; spec body 1c30a4a78, spec review 5a5b59ac2, revision 86639003a, Spec → Ready e9d1349ea, In Review 4b8ea180f, In Review → Ready f13298dab, back In Review b4baed7fc; Done-gate review in this commit): a by-id lookup returning a multitable interface or union classified clean, generated without a diagnostic, and then accepted ids of one implementation only, each branch’s decode-or-throw helper carrying its own participant’s node type as a generation-time constant so the first branch threw on any id belonging to a different participant (reported as issue #526, and the reporter confirmed dispatch is what they expected). The fix dispatches on the decoded typeId. FieldBuilder.resolveNodeIdArgTargets is the one producer of the cross-participant verdict, sealed as SharedTarget (every participant decodes one node type, ThrowOnMismatch unchanged) or PerParticipant (a SequencedMap of per-participant decode refs, the map itself the dispatch fact, reached through one ParticipantFilterField.nodeIdArgDispatches() accessor; SequencedMap rather than the plan’s Map because the guard’s candidate list and helper registration are order-sensitive, a deviation the spec body states with its reason). A divergent branch lowers with the second NodeIdDecodeKeys arm, PruneOnMismatch, the mode ternary in the glue becoming an exhaustive switch on the seal, and ConditionGlueRenderer.appendPruningAnd renders the mismatch-vs-absent trichotomy per cell so a present-but-mismatched id prunes to DSL.falseCondition() while an absent argument leaves the branch unfiltered. The client error survives at the granularity where a mismatch really is a client mistake: MultiTablePolymorphicEmitter.nodeIdDispatchGuard, emitted ahead of stage 1 in both root fetchers including the @asConnection one, throws when no participant decodes an id, naming every candidate type in participant order, which also catches the right-prefix-wrong-arity id a matching branch’s prune helper would have turned into a silent empty result. A divergent nested-input bare-@nodeId leaf rejects at classification time out of the same producer, naming the leaf, the participants and their differing node types. Independent-session In Review → Done review across two rounds. Round 1 confirmed all seven decisions delivered and sent it back on one test-tier finding: the prune-mode list helper’s absent-or-empty fold was pinned only by a contains("nodeIds.isEmpty()") match on the emitted method body, the code-string assertion the development principles ban at every tier, so the one behaviour the fold exists to produce was unpinned where a regression would be caught. The rework deletes the unit case and pins the behaviour where it is observable, MultiTableFilterExecutionTest.dispatch_emptyIdList_leavesBothBranchesUnfiltered: occupantsByIds(ids: []) returns all seven occupants unfiltered, and dropping the fold turns that into zero rows; no code change was needed, as round 1 predicted. Round 2 verified the tier move and the tree: full reactor green under mvn install -Plocal-db against a private repo head and a per-worktree database, the new case run and passing, no code-string assertion on a generated method body left anywhere in the delivered tests, user-facing-doc check clean on the manual’s global-id and @nodeId reference chapters, retirement sweep skipped with no vocabulary retired.

R818 (b09afc1 the surface, the SDL type arm and both dispatch-matrix guards, bc84555 the directive-target arms; filed and Backlog → Spec cae3a1c, spec review round 1 1215dd1, revision d264f34, Spec → Ready ca3f174, Ready → In Progress folded into b09afc1, plan recorded cb70750, In Progress → In Review 6235f2e; Done-gate review in this commit): the language server answers textDocument/references, so an author about to rename a table binding or retire a @service class can ask what in the schema uses it instead of grepping for a word a description might also contain. referencesProvider is registered and GraphitronTextDocumentService.references answers on StoreRead.REFERENCES through the interactive door, the definition handler’s shape throughout: one span, one store read, one StoreAnswer switch, an empty list when the budget expires. Two arms behind it, keyed off disjoint syntax the way the definition chain already is. TypeReferences takes a cursor on a type declaration name or on a use of one and reads the four use populations (graphql_field and graphql_argument by named_type, graphql_implements, graphql_union_member) as one statement, honouring ReferenceContext.isIncludeDeclaration and listing every declaration site rather than the one a jump would pick. BindingReferences takes a cursor inside a directive argument and dispatches on the exhaustive Behavior switch, so a new binding arm forces a find-references decision at compile time; a @nodeId(typeName:) folds into the type population rather than standing up one of its own, so the same question has one answer from either side. The freshness question the spec split out from precision is settled the honest way: every position is the last capture’s, no buffer refresh, and the manual says so in its own words. The argument is that IntraSchemaDefinitions prefers the open buffer because for one declaration the buffer holds the whole answer, while here it holds only the fraction that happens to be open, and a list half live and half captured is fresher in a way nobody can predict. Both dispatch-matrix seams closed rather than left to review discipline: Reach now requires every surface to carry a verdict on every trigger, with no complement-filling convenience, so a constant added to LspSurface fails the build until all twenty-one rows have decided about it; and LspSurface states its own keying, so the cursor-versus-sweep guard derives its surface set instead of hand-listing one. Two things the implementation found that the plan had not: the class population is every positioned carrier of a class name (@service, @externalField, @enum, @sourceRow, the two condition families and the three reference-step families), not the three the spec listed, and the column arm needs the parent-binding fallback its jump twin has. Slice C (value-level positions in capture, so a result lands on film rather than on @table(name: "film")) is deliberately unshipped, as are field-name and enum-value subjects, the latter now deferred visibly: a cursor on a field declaration name answers empty and a test pins it. Reviewed at In Review -> Done against the tree rather than the plan, which is how the two stale slice SHAs in the plan body and one javadoc sentence misdescribing the class arm’s match as case-insensitive were caught; the match is exact, correctly, since a Java identifier is case-sensitive, and the sentence is corrected in this commit.

R749 (bb0e9d47 the alias namespace and the type-scoped fold, 0cf1b65b the census plus the fan_target fixture and the doc promise, 64a38143 the round-2 argument pin on a fixture that can express it, 981daf28 the codegen schema-version bump; filed 743cb893, Backlog → Spec 91e3ad12, spec revisions 8f1a379d + 57caa525 + 12ad1b9f + 2728e5d9 + 4e49fc9e, Spec → Ready a2f9629e, Ready → In Progress c2a5d6ef, In Progress → In Review e233bb1a, In Review → Ready 153596e3, Ready → In Progress b47323741, round 2 recorded 6e6868c2, In Progress → In Review 6478ffe5): two participants of one single-table discriminated interface declaring a same-named field over different join paths minted one __rk_ alias, and because an aliased jOOQ field compares equal on its alias alone, the fold’s LinkedHashSet dropped the second term and the losing type’s rows read the winner’s column with no diagnostic, no error and no warning. The namespace verdict is now a model fact: AliasOwner (Shared / QualifiedBy) is stamped once at capture in FieldBuilder.aliasOwnerOf off the index TypeBuilder’s existing discriminated-interface scan builds, and both halves of an aliased term compose their prefix from that one value through `ReservedAliases.resultKeyPrefix, so a participant-declared name is owned by the participant type (two distinct terms, each fetcher reading its own) while an interface-declared name is owned by the interface (one identical alias in every arm, the agreeing case still collapsing to one term). The $ delimiter makes the composition injective, GraphQL names admitting no $. Beside it the fold hands each branch a selection restricted to the names whose alias that participant qualifies, which is what makes "a shared alias requires a shared occurrence set" hold by construction: the polarity is the complement of the spec’s, deliberately, because restricting the shared names instead would have re-created this very defect for the bare aliases a spliced nesting unit contributes. The two populations qualification cannot reach are build errors rather than silent drops, as deferred rejections drained by the validator, and the author-facing split is stated in code-generation-triggers.adoc: declaration-time divergence on an interface-declared name is a build error, query-time divergence on one stays a runtime client error, and a participant-declared name resolves per type. Reviewed at In Review -> Done with the emitted tree read rather than the argument: the fold emits Set.of("marks", "target"), each participant’s marks arm correlates on its own FK under __rk_Fan<Alpha|Beta>$ while details keeps the shared __rk_FanItem$, and every fetcher reads back the prefix its own arm wrote.

Reverted: the routine-write hop pairing’s expression-shaped join keys (c702da22c, reverted in this commit): an unnumbered change that repaired nothing, shipped three and a half hours after R819 had closed the regression it was chasing. RoutineWriteFacts.hopPairs joined intent_foreign_key_column_pair on a CASE over fk_on_from, and the mechanism the commit named is real: intent_field_chain_node is recursive and carries four window functions, so no outer predicate prunes it, and fact-model.adoc prices that shape under its rule about a derived relation joined on an expression. What was missing is a measurement. The stated evidence is a thread dump of a stalled generate, which store-performance names as the failure it exists to prevent and which this store has already yielded two retracted conclusions from, and the commit’s own message records that no end-to-end sakila generate completed on the tree it shipped from. A same-fixture control settles it: RoutineWriteCommands.produce over the sakila example’s own schema, three runs per shape against one capture, costs 487, 211 and 248 ms with the projection and 492, 216 and 195 ms without it, five rows either way. The stall it described was R819’s carrier regression rather than this join’s, which is why the five consecutive trunk runs carrying R819 and not this commit finished in 13.6 to 19.8 minutes, one of them (9c3113350) adding the statement-count pin over this very producer. The hazard the commit correctly identified is left where R682’s plan and R765 already put it. The hops reading beside it keeps its own CASE and always could: it joins sql_constraint, a base table rather than a view, so the rule does not reach it.

Discarded: Break the build when the reactor exceeds a wall-clock budget (reactor-wall-clock-budget, R824): superseded by R733 (build-wall-clock-guardrail), which has held the same question in Backlog since 2026-08-19 and which R824 did not cite. The duplication is not only of subject. R733 already settles the shape R824 proposes: under the -T 1C that CI uses, the reactor’s wall clock and its critical path are the same number, mvnd’s own scheduler putting the path at 340s against a 340s wall clock with a forced-sequential build at 339s, so a total-suite budget cannot distinguish a build that got slower from one that got wider, and R733 carries that measurement as the argument against exactly that option and for a per-class ceiling read from the Surefire reports. R824 proposed the total-suite budget on the strength of one incident. What R824 held that R733 does not is the incident itself, and it is not lost: R682’s slice-one reflection carries the eleven consecutive green builds at four times normal wall clock as the guardrail’s motivating case, and R819’s entry below carries the recovery. The structural companion R824 named, a meta-test asserting that every relation a plan-tier facts class names is either registered in meta_materialize or explicitly exempted, was already out of scope in its own body and wants an item of its own; intent_mutation_routine_seat is still an unregistered view on the generate path and would be its first finding. The ID stays a gap, per the never-reused rule. Re-open trigger: none; if R733 is ever descoped to the derived-read slices alone, the guardrail becomes a new item rather than a resumption of this one.

R815 (045ef6ca9 the delivery, 0d1e6a64f + 490674b7d the corrections; specced d972352-reviewed and 5435635-revised, Spec → Ready 0745ac4dc, Ready → In Progress 88d7323da, In Review 3c3ac9384; Done-gate review in this commit): the seven materialized targets were the only tables in a 152-table fact schema with no key on them, and that, rather than materializing itself, is what made three registrations cost some other relation’s read more. The correction the measurement forced is where the cost lands: not on the reader’s own predicate, which for a WITH RECURSIVE reader carrying window functions never pruned the rule either (its coordinate-filtered read and its whole-relation read cost the same scans in both shapes, to the scan), but inside the derivation, on the join a registered view performs against the target once per driving row or once per iteration. So the lever is underneath the reader and no reader was restructured. Five indexes shipped, each on the columns a named reader joins its target on and each naming that reader in a COMMENT ON INDEX, chosen by measuring every candidate shape against every view whose derivation reaches the target with statistics held constant on both sides: the largest set under which all 36 readers improve and none gets dearer. The plan’s expectation inverted, intent_argmapping_pair and intent_node_id_decode_hop_column both earning one and intent_resolved_type_binding and intent_field_column_scope going to the roster instead, the first of those declining the single largest total gain available because no shape of it spares every reader. Nothing is UNIQUE, and not for the nullability reason the spec anticipated: the columns a reader joins are a coordinate prefix and never the grain, so an index here serves readers or it serves nothing. Statistics are the other half, H2 gathering none at this scale; Materializations.analyse supplies them, best-effort against a database refusal and returning a count so the swallow cannot mean unobserved. It could not go where task 2 put it, and for correctness rather than cost: H2 commits the current transaction as a side effect of ANALYZE, verified by inserting, analysing and rolling back to find the row still there, so refreshAll analyses inline and FactCapture analyses after its transaction closes. Both refill paths are covered. MaterializeRegistryGateTest grows three gates, index-or-rostered-with-a-reason asserted by equality on HAND_WRITTEN’s model, every index naming its reader, and analysing a healthy store reaching every registration; all three of `DerivedReadCostTest’s large non-monotonic pairs are gone with the registrations they were charged to unchanged, its fixture now populates the seventh target (inventoryForFilm, an argument whose scope table declares the one key the node type’s table needs), and its budget floor moves from 2 s to 30 s so an equality-pinned exhausted set stops depending on machine load. `SurfaceScanCountTest moved only its per-declaration pair, 42/41 to 40/39, and the class now records why: at three types every target holds a handful of rows, so the ceilings are blind to this lever by fixture size and not by its being imaginary. fact-model.adoc states the conditional and the corrected mechanism. Independent-session In Review → Done review: full mvnd install -Plocal-db green; the one red run before it was GraphQLQueryTest.splitTableField_conditionJoin_returnsActorsPerFilm observing a film_actor row a concurrent mutation test transiently seeds, diagnosed to DmlBulkMutationsExecutionTest’s `(actor 2, film 3) pair and filed as R825, unrelated to this item and to the H2 fact store entirely. No code-string assertions on generated method bodies; retirement sweep skipped, the item retiring no vocabulary; user-facing-doc check clean, the only docs/ change being the contributor-facing fact-model.adoc.

R819 (1f8505076 + 5e78faeb2 the delivery, fd1c4120a the schema-gate fixture; filed 5f0b9655c, spec e40993854, Spec → Ready 3e545b2a0, In Review 85c8d694d; Done-gate review in this commit): the carrier-family read-cost regression beside R682 slice one is repaired by two registrations and one body restructure, no answer changing anywhere. intent_errors_field and intent_carrier_data_field move onto the capture cadence (rules kept in _live views, tables under the canonical names, registry reasons stating the measurements), and the carrier body’s windowed data_channel CTE is named once instead of four times with its three disqualification arms standing on the base tables, which alone took the sakila carrier read from 6.6 s to 173 ms; post-registration the family reads the floor (seat 17 ms from 43 s, hop 53 ms from 10 s, error channel 12 ms from 5 s, carrier-free refresh 12 ms). The intent_poly_member slice was measured and declined on its own control. Both new targets went to the no-index roster on measurement; the read-cost fixture grows a routine-carrier cluster per unit so the gate prices the family (47 readers, 107 cells), and the four named-type pairs it flagged are pinned with their lever filed as R820. Census prose now cites the register without a number.

R800 (42614bd the delivery; filed at Spec aabf6c8, spec reviews 86ae74d + 5e38d68 + 9c51600, spec revisions 12af0dc + 3516a32 + 587c9f7 + 099054b, Spec → Ready f3ec0af; Done-gate review in this commit): a family page in the generated schema reference now presents its family before defending its name, and how two families meet is declared data rather than prose about the store. meta_family gains an introduction column, one plain-language paragraph per family, its column comment carrying the discriminator that an introduction names no relation and no other family because the two rosters carry those and are gated. meta_family_headline authors the relations a reader meets first, membership only: the family comes from the census by join and the blurb from the relation’s own comment, so nothing is authored twice. meta_family_bridge declares the sanctioned normalization crossings, four rows, membership being ownership of a rule spelled in the relation’s own body plus a meeting between two families' vocabularies. meta_relation_reference derives the declared key edges out of INFORMATION_SCHEMA at constraint grain, both ends carrying their census family. StoreCatalog reads the three new relations verbatim, GrainSentence lifts a relation’s first sentence beside it because that convention is the store’s and not the renderer’s, and StoreProse becomes the one reader of the store’s prose corpus so the renderability gate and the drift guard cannot sweep different corpora. The family page is now introduction, "Where to start", "How this family meets the others" in two labeled parts, the charter under "Why the name is right", then the relations; index blurbs read as introductions. The declared crossings are presented as declarations and claim no exhaustiveness, closure against what the views actually read being the follow-up’s derivation. Tests: FamilyRosterGateTest closes both rosters against the observed schema in five gates (non-blank introductions; headlines resolving to a censused relation with ordinals dense from zero per family and at least one per family; bridges naming an observed relation, two rostered distinct families and a rule), GrainSentenceTest pins the extractor’s acceptance line in both directions against the corpus’s real dot hazards and sweeps every censused relation for a sentence that is a prefix of its comment and terminated, SchemaReferencePagesTest pins each renderer floor with its own negative case, and SchemaIdentifierDriftCheck gains the store’s own prose as a second corpus with a bare-token extractor and a vacuity floor, which surfaced four citations the schema does not declare, all fixed. Verified at the gate by a full mvn install -Plocal-db and by reading the rendered pages: all thirteen family pages carry the three new sections, and CI’s docs-deploy published them.

R793 (272ef13 the delivery, fc4535b the rework round; filed and specced with the roadmap sync 0e643f3, Spec → Ready 72f16f7, Ready → In Progress ed71195, In Progress → In Review f163ba7, In Review → Ready d033130 with a corroborating second gate at e9c39d0): the language server’s diagnostics drain issued one statement per graph and that statement did not finish inside the 30 s session budget, so a developer’s squiggles silently stopped tracking their schema. Diagnosed inside the database rather than by profiling the reactor, arm by arm: the drain’s own statement was captured off the production read and each of its 22 select-list arms timed alone against a sakila capture. The budget was hiding most of the defect it reported, the 31310 ms an earlier harness recorded being the time until the abort rather than the statement’s cost, which runs past seven minutes to completion. Two hypotheses died and both refutations changed the plan. The static multiplicity ranking predicted nothing, intent_type_backing_seed measuring 15 ms. And the leading hypothesis named the right mechanism on the wrong lever: the redirect arm’s census-driven join is the worst term, but the driving-side rewrite prescribed for DeclarationFacts was unnecessary here because the ruinous term sits one relation further down. intent_resolved_type_binding carries a COUNT(*) OVER, so no outer predicate prunes it and every naming pays a whole evaluation; filtered to one type the backing arm is 22 ms, filtered to a document’s types it is 1.9 s, and driven from the census it never finishes. Registering it collapsed the redirect, backing and slot arms to single-digit milliseconds and left a 9.5 s residual whose 63758 scans sat on sql_constraint_column, re-entered per row by the unresolved-path arm’s correlated NOT EXISTS against intent_field_column_scope; registering the scope too took one evaluation of intent_field_column_table from 131 s to 144 ms. Whole statement: 191 ms, against a 3 s interactive budget. No Java changed. Both meta_materialize rows carry the arithmetic in their reason column, the pair’s refresh is about 175 ms per capture, and registering the 131-second view itself was refused on exactly the refresh-cost ground the plan reserved for it. The pin is DiagnosticsStatementCountTest.theDrainsStatementStaysCollapsed, which captures the drain’s own statement and EXPLAIN ANALYZE`s it for a total scan-count ceiling, the clock-free currency `SurfaceScanCountTest had already established on trunk. Independent-session In Review → Done review across two rounds. Round 1 passed the delivery on correctness and sent it back on its own named evidence: the pin could not fail on the shape it guarded. Over the class’s four-type fixture the two shapes measure 658 and 1291 scans, so a 20000 ceiling, explained by a hundreds-of-thousands figure belonging to a sakila-scale catalog the tier does not stand up, sat fifteen times above the regression and passed on a tree with the fix entirely removed; a second concurrent gate reproduced both numbers by a different method and measured how far the fixture would have to grow to fix it properly. The rework takes that second repair: the case now stands up its own graph of forty table-bound types, where the collapsed shape totals 6924 scans against the unregistered shape’s 23983, and the ceiling is 15000. Round 2 reproduced both numbers exactly by reverting the two registrations from the DDL, rebuilding the model and re-running the case, which failed on 23983, and by lowering the ceiling on the restored tree to read 6924. Full reactor green under mvnd install -Plocal-db; no code-string assertions on generated method bodies; user-facing-doc check and retirement sweep both skipped, the item touching no docs/ file and retiring no vocabulary. The citations this item left in three sibling roadmap items were restated in the approval commit rather than repointed, its file being the one deleted here.

R803 (ed424f6 the delivery; filed at Spec aa9dad2, spec revisions be57ab3 + 0f6a090 + fb466c6, Spec → Ready 1ae37d3, Ready → In Progress 4948095, In Progress → In Review 24c0c4c): five columns in the fact schema serialized a collection into one scalar, and the discipline they failed is now written down and gated. The discriminator is atomicity plus key-dependence rather than a distaste for renders, which matters because the store legitimately holds renders: diagnostic.coordinate and the _upper folds pass, and intent_type_backing_conflict carries the whole lesson in one relation, candidates passing where class_names failed on the same key. The columns were not oversights and defended themselves in their own comments as canonical group keys, so the item had to answer that defence rather than assert past it; what settled it was a live wrong answer, DiagnosticFacets filtering directives with isNotDistinctFrom against the joined set, so an author asking for conflicts involving @service silently got only those whose entire set was exactly service. The MCP surface trades that dimension for a directive filter that asks membership by joining, and Filter sits beside Dimension rather than inside it because a finding carries several directives and a groupBy over a multi-valued key would multiply the rows the aggregate counts. The message fork resolved onto the post-capture arm on the schema header’s existing first reason: the render’s input is AuthoredClaim’s declaration order, which is not a captured fact of any graph, so no view can state it. `intent_authored_claim_rejection holds it, written at capture cadence, with kind and variant minted alongside from RejectionKind.of and RejectionFacts.classSpelling, which took both Rejection.* string literals out of the DDL and dissolved the Rejection.* half of R807. The load-bearing test is not one the spec asked for: theMintedRejectionMatchesTheViewRowForRowAndWordForWord pins the one-to-one the diagnostics inner join rests on, without which a missed mint would drop a diagnostic silently. CollectionValuedColumnGateTest denies the five constructs in the DDL’s statement regions, blanking -- comments and literal bodies in one pass so the file’s own prose about LISTAGG cannot fail a clean tree, and discloses in its javadoc the half it cannot cover: diagnostic.directory was a collection in a scalar with no aggregate anywhere, so the gate would not have caught it and the fact model’s prose is the enforcer for that half. R804 states the principle in the explanation articles.

R799 (10b7e96 the delivery; filed inside 480bb20, renumbered 61ffdf7, Backlog → Spec ff5b49a, Spec → Ready f8963a0, Ready → In Progress 70c8727, In Progress → In Review 3bd53a4): the inlay-hint read was found already repaired, and what shipped is the enforcer that would have noticed either the defect or the repair. The item was filed from a measurement of 13789 ms and 561746 row scans for one fifty-line inlay request over the sakila example’s 4222-line schema, which is four times INTERACTIVE_READ_BUDGET and therefore no annotations at all; re-measured on trunk a day later the same request cost 65 ms and 21065 scans, and a whole-file request producing all 450 hints cost 170 ms. The attribution is a same-fixture control rather than two runs believed: with the model DDL checked out from 272ef13^ and graphitron-model rebuilt, that window returns to 10205 ms and 561851 scans, so R793’s two meta_materialize registrations, made for the diagnostics drain and not for this surface, are the whole difference, and intent_resolved_type_binding’s `COUNT(*) OVER is the term every arm of the statement reaches. What survives the repair is the shape: the read is region-scoped in its questions and graph-scoped in its evaluation, so a ten-line window and the whole file scan the same rows, and over a grid of types against omitted-name @field sites the cost is linear in both dimensions with no cross term at about 30 scans per declaration. The finding that made the item worth keeping is that SurfaceScanCountTest, written to stop exactly this class of regression, passes green and unmodified against the shape that produced nothing: inlay cost 1544 scans at its own three-type fixture under a ceiling of 1800, and so did every other surface’s ceiling, including the drain’s. So INLAY_CEILING is now 800, placed between two measured shapes at 482 today and 1544 guarded, carrying in its javadoc the rule that a number whose whole value is discrimination cannot be raised on the strength of the current cost alone; and theInlayReadCostsABoundedAmountPerDeclaration states at two schema sizes what a fixed small fixture is structurally blind to, 42 then 41 scans per declaration today against 150 then 141 guarded, asserted as a level rather than a growth ratio because both shapes are flat and a ratio separates nothing. scaledSdl gained a sites dimension while its one-argument form stayed byte-identical, so the census test’s fixture is untouched, and scansFor and recording now take the store they measure, which is what makes a second surface’s assertion one more call rather than a second mechanism. No production code changed, and the item argues for that rather than eliding it: the read is inside its budget on the largest schema the project has, and the levers that would cut the constant are a registration whose refresh every capture pays and a rewrite of arms whose plans do not expand per driving row. The class javadoc now carries both the standing rule that a ceiling is finished when it has been seen to fail, not when it passes, and the named gap that the five other surfaces still have only the net. Independent-session In Review → Done review, mutation-tested rather than accepted for passing: on the reverted DDL both assertions fail at exactly their documented figures, 1544 against 800 and 150 against 80, with theCensusLookupDoesNotTrackTheSchemasSize still green, and all four per-declaration figures were read back individually by lowering each ceiling to 1. Full reactor green under mvnd install -Plocal-db. User-facing-doc check skips, the item touching no docs/ file; the item retired no vocabulary.

R794 (60397ef the delivery; filed f8ddef1, Backlog → Spec 78f94d7, spec reviews d812813 + 278334b, spec revisions 077c173 + 04f89aa, Spec → Ready e8d8fa2, Ready → In Progress f13e6b7): detaching an editor from graphitron:dev no longer fills the dev console with stack traces for answers written onto the socket the teardown just closed. LauncherFactory in graphitron-lsp builds the lsp4j launcher both transports use, the stdio Launcher main and DevServer.serve, so the connection policy is configured once and a third transport inherits it; the policy is quietOnStreamClosed, applied through Launcher.Builder.wrapMessages so it covers both message directions, consulting JsonRpcException.indicatesStreamClosed on a consume failure, dropping the message at slf4j debug on a true verdict and rethrowing everything else so a framing or serialisation failure stays loud. wrapMessages rather than setExceptionHandler because a handler is never consulted for a notification, which is what a publishDiagnostics push to a departed client is: lsp4j catches that write failure itself and logs it at INFO carrying the throwable, and JUL’s default console handler prints a stack trace for any record carrying one, whatever its level, so a SEVERE-only fix or assertion would have left half the noise standing. Teardown also stops leaving the dead connection reachable: Workspace’s recalculate slot became an `AtomicReference with clearRecalculateListener as setRecalculateListener’s compare-and-clear inverse, the service holds its listener `Runnable in a field created once and surrenders that same instance from a new disconnect() chain (GraphitronTextDocumentService to GraphitronLanguageServer to DevServer.serve’s `finally, before the executor shutdown), and the compare is on identity because every evaluation of a method reference is a fresh object, so a clear handed a second evaluation would silently never match while an unconditional clear would silently stop diagnostics for a reconnect that already took the slot. The RejectedExecutionException absorption stays as the guard for the residual race of a mutation that read the slot before the clear. The spec’s history is the process working: each of two review rounds killed a load-bearing factual claim checked against the tree or the 0.24.0 bytecode rather than accepted (round 1: a failed notification write never throws into the recalculating thread, RemoteEndpoint.notify catching it itself; round 2: the drain executor from the item shipped in between already absorbs the stale window’s work, leaving reachability as the second deliverable’s only real cost, and the compare-and-clear needed an identity the plan had not named). Independent-session In Review → Done review, mutation-tested at the gate rather than accepted for passing: with wrapMessages removed both end-to-end pins fail on exactly the two records the item removes, SEVERE: Internal error: ... SocketException: Socket closed and INFO: Failed to send notification message., the response pin five of five in isolation with one observed pass in a full-class run where the record published after the assertion read, a narrow window worth knowing about while the class still went red via the notification case; surrendering a fresh method reference instead of the field fails ConnectionTeardownTest’s positive case. Full reactor green under `mvnd install -Plocal-db, LauncherFactoryTest and ConnectionTeardownTest re-run green on the restored tree. Retirement sweep on "listener slot" found one survivor beyond the three prose sites the item named and rewrote: DiagnosticsDrainThreadingTest’s javadoc still stated the slot is never cleared, and was rewritten to the residual race in the approval commit; the R796 changelog entry keeps the old claim as the historical record it is. User-facing-doc check skips, the item touching no `docs/ file.

R728 (8284400 the named-parameter carrier and the bean-member deferral, c79f4fd the bare spelling, 8df0217 the scope’s second rung; the relations and their stages at 4548c98f, 705f96b6, e1ad3ae3..375943a9, e578ef47..e9dc149f, 417298d3, cb502a21, 9c801d16, 12dabb11, 2e46090a, d0f6358c, 6d70b6a4, 8b819323, 270cc6a3, 2d7223b4, 7287451e, 5335f0ec; In Review → Ready 03267bc, 80c4007, 3dc5ca4): @nodeId encode and decode become relations in the fact store, and an instruction the generator drops fails the build instead of handing a consumer the wire format. The instruction population states all three authored forms over three sites and resolves each to a node type through five disjoint bases; two resolution relations answer the two directions, four decode destinations and two encode sources; intent_node_id_decode_defect mints the two verdicts the walk cannot reach before capture, key arity exceeding a single-valued slot and a key column whose type disagrees with the slot’s, projected into located build errors by NodeIdDecodeDefects as a fourth component on StoreDetections. The junction chain stops being a rejection and becomes absent local columns reaching the hop-general EXISTS, pinned by execution-tier row counts against PostgreSQL rather than by an argument that the EXISTS multiplies nothing. The read family gains its encode at the accessor, by-name, typed-column and @error arms. Site 4a’s refusal separates its two causes and the manual page gains the reverse hop that was authorable all along with nothing telling an author so.

Four independent-session In Review -> Done rounds, and what they found is the item's real shape. Round one refused on both gate questions: at the named-parameter carrier the item newly judged, no schema built at all. The two signatures the store's own refusals prescribe as remedies, a parameter of the key column's type and one of the node table's generated record, both drew `+WireCoercionError.Assignability+`, whose message offers "route the value through a converting scalar / `+@nodeId+` decode" on a schema that had written one, while the parameter typed as the wire format classified to a base64 pass-through, which is the defect the item exists to close. The stand-aside had been wired into `+RoutineDirectiveResolver+` only. Site 2, a `+@nodeId+` scalar on a bean-backed input, reached the same pass-through with no rejection at any tier. Both were invisible to the delivered evidence because the two cases covering them asserted only that a detection reported nothing, which passes equally well against a red build; that is why every case in `+NodeIdProducerSlotDecodePipelineTest+` now asserts the schema *builds* and reads the slot's own transform. Round two found the same fall-through surviving in the bare spelling of the directive that all six new cases wrote explicitly, with the walk and the store disagreeing at identical rows. Round three found the inference the second rework landed sharing one of `+intent_argument_scope_table+`'s two rungs while three places claimed it shared both, so a bare `+@nodeId+` on a service-backed delete was refused for want of a table the store had already resolved through `+MUTATION_TABLE+`; the two javadocs asserting that parity were the part that mattered, standing in main sources where they outlive this item. Round four approved: the delete surface classifies to `+decodeFilm+` on `+film_id+`, rung precedence matches the relation's own ranking, the neither-rung refusal names both ways in, and the corrections landed in all three places. Full reactor green under `+mvnd install -Plocal-db+` on the exact reviewed tree, 14 modules with zero failures, compilation and execution tiers and the docs render included; no code-string assertions on generated method bodies in any delivered test; user-facing-doc check clean over three touched `+.adoc+` files; retirement sweep clean across javadoc, the manual and the architecture docs, the surviving "identity-carrying" occurrences being the concept name for the chain shape rather than the retired gate, requirement framing and rejection text. R691, the Backlog tombstone recording that this item had absorbed the manual page's overstated single-direct-FK no-JOIN claim, deletes at this gate on its own terms: the page now names both single-hop shapes and states the discriminator, that one direct foreign key is not a promise of a single-table predicate and the landing is. The resolver reading these rows stays with R682, stated in the item rather than implied: `+NodeIdLeafResolver+` runs before the rows exist, so this item takes it as far as spelling the relation's rule rather than a second one.

R791 (b4a8ecc the delivery; filed and Backlog → Spec 1ae8063): a friendly explanation article on the fact store’s naming discipline. docs/architecture/explanation/naming-the-row.adoc teaches "name the row, not the question" in simple language: the store as a database of sentences, grain and fact glossed via a spreadsheet-of-sales comparison, a pantry metaphor (label the jar by its contents, never by your plans for it), the type-to-table binding as the worked example over the real relations (graphitron_table, sql_table, intent_spelled_table, intent_bound_table), benefits stated as consequences rather than virtues, and an honest costs section naming the relation census, the ungated nature of the one-sentence check, the sanctioned diagnostic exemption and the disclosed inversions. Linked from the explanation index and from fact-model.adoc’s preamble; every relation cited was verified to exist against a store booted from the DDL and read through `INFORMATION_SCHEMA. Landed outside the reviewer gates on the user’s explicit call; the workflow was waived for this item, so there is no In Review → Done review to record.

R685 (62343d2 the census cut, the classified list and the enforcer, 2d8ad9a the manual sweep at the Done gate; filed 1e3c082, Spec → Ready withheld f6ce1a9, author revision 8e3cead, Spec → Ready da011cf, Ready → In Progress 4b78ba3, In Progress → In Review 748743b, In Review → Ready 87f44bc, Ready → In Progress 1ba1bea, In Progress → In Review 09a2458): the class census stops at the consumer’s declared classpath, and naming past it fails the build. It was taken over the whole transitive closure: 169 classpath entries for graphitron-sakila-example, of which 142 jars arrived behind the 15 the pom declares, carrying 87% of everything the fact store held and 92% of each scan’s read time. Decompression rather than parsing is the bill (13 ms to list every jar’s entries against 486 ms to inflate their .class bytes), which is what decided that the fix is a narrower entry list and not a shallower read; a per-class depth cut was rejected in the spec because completion has to answer before the author has written the name it would offer, and it composes with R762 rather than competing. The narrowing is not two lists. ClasspathEntry(path, origin, coordinate) carries the decision on the element with four origins, PROJECT / DECLARED / SIBLING / TRANSITIVE, produced once by AbstractRewriteMojo.resolveCompileClasspath (the earlier resolveClasspathRoots half is gone rather than left beside a narrower sibling), and every consumer projects from it: the codegen loader, javac and the dev execution loader take every entry, the census skips TRANSITIVE before opening it, so census subset-of loader is a derivation over one list instead of a promise about two that buildCodegenLoader’s own javadoc records as having already broken once. Directness reads `Artifact.getDependencyTrail(), measured populated on all 157 artifacts of a real build with a two-element trail identifying exactly the pom’s 15 declarations, with a groupId/artifactId/type/classifier join (never version, since dependencyManagement rewrites them) as the fallback for an unpopulated trail. The other half is that the narrowing is a rule and not just a performance cut, because an invariant exists only while something fails when it breaks: ClasspathNameability is a resource probe against the classified list, asked for a verdict per author-written class name. The predicate is deliberately not census absence, which the Spec gate caught and sent back: jvm_class filters nested, non-public and jOOQ-package classes, so an absence detection would reject a nested class in the consumer’s own module, reject every JDK class, and stay silent on SIBLING, the one arm whose existence the design argues for. Nor is it getProtectionDomain().getCodeSource(), which the first reviewer suggested and the revision declined with the reason: the codegen loader is parent-first over the plugin’s realm, so a correctly declared graphql-java class loads from the plugin and would be rejected by anything asking where a loaded class came from. Whether a kept entry carries the name is the rule itself, and it is exact where the census is filtered. SIBLING is rejected naming the module to declare, a transitive-only class is rejected naming the coordinate that carries it (the one place a transitive jar is opened, after a name has already failed and the build is failing anyway), a platform-loader class is nameable, and an empty classified list is inert, which is what keeps the whole unit tier alive. Enforcement sits at the author-written sites rather than at every Class.forName: @service, @condition and @externalField in ServiceCatalog, @scalarType through a new ScalarResolution.Rejected.UndeclaredClass arm, @error in TypeBuilder, and @sourceRow in SourceRowDirectiveResolver, the last two being sites the plan’s own enumeration had missed. Because an enumeration defended only by review is the thing that rots, CodegenClassForNameGuardTest fails the build on any Class.forName in graphitron main sources carrying neither a nameability: checked nor a nameability: exempt (<reason>) marker, pinned in both directions against fixture sources and floored on scanned files and detected sites so it cannot pass vacuously. The rule is a breaking change twice over and both are declared rather than left inside a doc edit: naming a transitive class now fails (the migration is one <dependency> block, and it is the undeclared-dependency antipattern maven-dependency-plugin:analyze exists to flag), and the <plugin><dependencies> route is withdrawn, on an argument the item had not originally made, that generated code references these classes so an artifact only the plugin can load already failed the consumer’s own javac at the first generated reference. What the enforcer changes is when they hear about it and what it says. The prose surfaces moved with the population: jvm_class’s table comment and `meta_family’s `jvm_ definition say declared classpath and name the new filter, the two Diagnostics arms state the census’s scope instead of the falsified "not found on the compile classpath" (the LSP holds no fact separating a typo from a real class in an undeclared jar, so the message deliberately leaves the cause open where the build can name it), and ClasspathSources.record states the new silence as design, a skipped entry producing no store_source row at all because provenance is a use-site fact and a jar direct for one module is transitive for another. Measured at implementation, with the prediction that missed recorded as measured per the item’s own rule: 169 entries to 27 exactly as predicted, the scan 672 ms and 11,704 classes to 281 ms and 4,524, the workspace census 424,344 rows and 796 MB to 222,448 and 446 MB, and the write side 12.8 s to 9.2 s of jvm_ statement time per build, 28% rather than the predicted half, with both caveats stated (the narrow runs still scanned wide partitions a preceding run left behind, and the member-level merges R762 targets carry about 5.0 of the remaining 9.2 s, which is where R762’s half lives). Independent-session In Review → Done review, two cycles. The first sent it back on the Retirement sweep rather than on the code: the item declared "has to be on the plugin’s classpath, not the consumer module’s compile classpath" retired and fixed it in external-code.adoc, the one file the first-client check named, but the claim survived in five more manual pages across nine sites, two of them numbered recipe steps that would have produced the build failure this item’s own enforcer emits at @condition and @externalField, and three the per-directive reference entries for directives external-code.adoc itself enumerates as sharing these mechanics. The manual stated the rule and its opposite, at the surfaces a consumer reaches first. The rework brought all nine onto the one rule plus a tenth lead-in found by re-running the sweep, pointing at external-code.adoc#make-the-class-nameable rather than restating it, and withdrew mojo-configuration.adoc’s surviving "rare legitimate case" for `<plugin><dependencies> version pinning; custom-scalars.adoc was already correct and stayed untouched. Second cycle approved on both gate questions: full reactor green under mvnd install -Plocal-db on the exact reviewed tree, the new transitive-not-nameable invoker IT failing a real Maven build naming org.jooq:jooq and asserting nothing was generated, check-adoc-xrefs resolving all 212 cross-file anchored references so the five new xrefs are build-verified, no code-string assertions on generated method bodies, retirement sweep clean across javadoc, DDL, the manual and the architecture docs (the sole surviving occurrence of a retired string being a doesNotContain guard in DiagnosticsTest), and the user-facing-doc check clean over six touched .adoc files. Two non-blocking notes recorded at the gate: classifyElement adds a fifth arm the plan does not enumerate, an unattributable path classified DECLARED with no coordinate, which fails open, is argued in the javadoc and is pinned by ClasspathClassificationDecodeTest.anUnattributablePathStaysInTheCensus; and RecordBindingResolver’s author-written `className sites are marked exempt rather than checked, because ServiceCatalog gates the same @service / @externalField names before that observation pass runs, which is the better placement than the double gate the plan described. R620’s duplicate scan per dev-loop pass and storing entry provenance as a fact stay out of scope, the latter with its reason: an origin column on the store-global, definition-keyed store_source would be silently wrong the first time two modules in one reactor disagree.

R787 (5dc2452 the ordering change, 7c3a305 the coverage judgment, b113aac the symmetry correction; filed e989a82, Backlog → Spec with consult findings 8d94440, Spec → Ready 31bf3a4, Ready → In Progress 6697f47): the documented session flow rebases onto trunk before the verification build instead of discovering divergence at publish time. Sessions work trunk-based and many land commits concurrently, so trunk usually moves while a session works; the old flow (sync -> work + commit -> push own branch -> fast-forward trunk) put the only sync at the ends, so an agent built, invoked publish, learned trunk had moved, and had to rebuild, because a post-build rebase leaves the verification covering a tree that is not the one being pushed. Every trunk movement during a session cost a second full build and the agents were behaving correctly when they paid it. The fix is ordering, not mechanism: the flow now reads sync -> work + commit -> rebase on trunk -> verification build -> push own branch -> fast-forward trunk, which also names a build step the old flow left entirely implicit, and publish-time divergence shrinks from the routine case to the race where trunk moved during the build itself. "Verification build" gets one definition, at the top of CLAUDE.md "Building and testing", absorbing the -pl preference sentence that had lived at the end of "Common commands" plus the never-push-uncovered rule; the session flow, the "Common commands" sentence and the publish skill all reference that definition rather than restating it, three hand-maintained spellings of one obligation being the drift shape the development principles warn about. The fallback command block encodes the new order, the sentence advertising publish reframes its divergence pre-check as the mid-build-race backstop rather than where the rebase normally happens, and the rebase step points at .claude/web-environment.md because a mandatory rebase makes the documented init.sql jOOQ-catalog cascade a routine encounter inside the canonical flow rather than a build failure that reads like the agent’s own diff. .claude/skills/publish/SKILL.md states the caller expectation above step 1 and rewords its step 2 stop to name the situation and the recovery; the stop itself and every hard rule (fast-forward-only trunk, no force-push) are untouched. The item corrected itself in flight, which is the part worth keeping: the first live run of the new flow hit the shipped absolutism, which invalidated a verification build unconditionally on any post-build rebase and so forced a full rebuild when the mid-build movement was another item’s roadmap front-matter that could not interact with the change being pushed, reintroducing exactly the churn the item existed to remove. The rule became a coverage judgment instead, stated once beside the definition: every commit already on trunk passed its own verification build, so a rebase bringing in only plainly non-interacting changes (disjoint files, no shared build surface) lets the two green builds jointly cover the merged tree, with a cheap targeted check where one exists for the single touching point (a mvn -pl roadmap-tool exec:java -q regenerate after concurrent roadmap edits) instead of a full rebuild. A further correction made the criterion symmetric: the first wording treated "the incoming commits touch code" as an unconditional rebuild trigger, which is asymmetric and wrong, incoming generator code against a markdown-only commit interacting exactly as little as verified metadata against a code change, so the trigger is now the read relationship (either side touching build configuration or anything the other side reads, or any doubt) which is the criterion actually doing the work and which correctly catches the item’s own worked example, roadmap markdown being read by the roadmap-tool gates. The invariant that matters survives intact: a new commit of your own always needs a verification build that covers it. roadmap/workflow.adoc and the roadmap, srp and classified-corpus skills were audited and left unchanged, each for a stated reason rather than a blanket claim: workflow.adoc’s before-transition sync already sits upstream of any build the session runs, roadmap and srp already fetch and rebase before acting, and classified-corpus is the one documented verify-then-publish sequence but verifies with scoped -pl :graphitron -am test rather than the full install, so a publish-time rebase there costs a cheap re-run. Deliberately no enforcer: the never-push-uncovered rule lands as prose, and the deferral is filed rather than conditional as R788, which holds the marker-file check publish’s step 2 cannot substitute for, trunk divergence and "did the build cover HEAD" being different predicates. Independent-session In Review → Done review, approved on both gate questions. Full reactor green under mvn install -Plocal-db on the exact reviewed tree (BUILD SUCCESS, 14 modules, 6222 tests across seven module totals with zero failures and zero errors, check-adoc-tables / check-transient-citations / check-module-enumeration all reporting clean, the citation guard being the one that covers this item’s CLAUDE.md edit); no code-string assertions on generated method bodies, the item delivering no tests; user-facing-doc check and retirement sweep both skip, the item touching no docs/ file and retiring no vocabulary. Completeness was held to what a docs-only workflow item can actually show rather than to the build: each acceptance criterion was read against the delivered text at all four surfaces, and the audit the spec asserts as "confirmed, no change" was independently re-run rather than taken on report. The stronger evidence is that the flow has now been exercised twice for real, once by the implementer, whose live run produced the coverage-judgment revision, so the item was corrected by its own use, and once by the reviewing session, which followed the delivered front half and found trunk unmoved across a 6:14 build. Two non-blocking notes recorded at the gate: R788’s enforcer sketch predates the revision and would stop on a HEAD-vs-marker mismatch, which is precisely the carry-forward the judgment now blesses, so whoever specs it must reconcile the predicate (its own open questions reach the adjacent identical-tree rebase case but not the different-tree one); and the coverage judgment now carries one definition plus two short summaries at its referencing sites, the shape the Ready-time consult finding warned against for the verification-build definition, defensible because a bare cross-reference mid-decision serves the reader worse, but a future change to the criterion needs three edits.

R770 (7f78771e both deliverables; filed 4e0c419e, Backlog → Spec e9104229, spec reviews cceea3ef + c7aa2182 + 663d4c0e + 0339b737, Spec → Ready 5562ba7e): store slowness in a derived relation is now a database question with a documented first hour. docs/architecture/explanation/fact-model.adoc gained the general forms its measured H2 rules had been missing, each previously stated only per-registration or in an item body due for deletion: view inlining with no common-subexpression elimination and multiplicities compounding down a tree, a derived relation joined on an expression rather than a column evaluated once per driving row with its three controls, the two extraction cases distinguished so tidiness-extraction and column-projecting extraction do not read as contradicting each other, a recursive term re-evaluating its step’s input once per accumulated row, and the closing rule that what makes a relation expensive is being a view something reads many times rather than how a reader spells the read. Two lever paragraphs sit against the materialized-view ruling: captured fact before registration before rewrite, and materialize where the cost multiplies through, as deep as the sharing goes. .claude/skills/store-performance/SKILL.md carries the ungated half, posture and order of operations, on the split the item settled: the page is scanned by SchemaIdentifierDriftCheck and the skill is scanned by nothing, so the skill names exactly one relation and copies no per-relation number. The lever hierarchy’s reactor-pair figures were deliberately not written, both halves being deltas against a run their own source discarded, which would have put a retracted reactor total on a gated page that the skill’s posture section exists to warn against; the rung is written on its mechanism instead. Acceptance was a dry run against a real capture of the sakila example’s schema and catalog, which refuted its first subject, produced a live 151-second finding filed as R781, and returned two corrections to the skill’s own text.

R744 (e12adb06 the fix; filed 8626e5a6, Backlog → Spec 733e9515, spec revision f57a27f2, Spec → Ready 8a65e82c, Ready → In Progress 06f167eb, In Progress → In Review bb753b9e): two TenantScatterSubstrateTest tests waited for a recorded connect:<tenant> event before quarantining a tenant key, on the belief that the event meant the key’s worker had finished acquiring its connection. It does not: the fake connection records connect: from inside prepareStatement, which runs inside entryFor’s `computeIfAbsent, while the post-check that re-reads the quarantine set is still ahead of the worker. A quarantine landing in that window made the worker abort its own entry, the test’s events.clear() wiped the abort, and releaseAll found nothing left to abort, so the assertion failed on a missing abort: line, which is the shape CI reported. The emitted runtime was never at fault and is untouched: the post-check is what stops a late pin from leaking a live connection into a finished operation, and the contract under test (aborted, never closed under a possibly-live worker, never reused) holds in both interleavings. Only the clock was wrong. Both tests now park their workers on a latch counted down as the first statement of the per-tenant body, which a worker reaches only after entryFor has returned; from there the self-abort path is unreachable and releaseAll is provably the only remaining aborter. That is a proof from the control flow of perTenant.apply(dslFor(key)), not a widened timing margin. The event-polling loops and their deadline arithmetic are gone, the two comments asserting the old false claim are replaced, and the recording site carries a note that the connect event fires mid-pin. Verified with the item’s own mid-pin delay probe: pre-fix it fails both tests every run on the missing abort:A with abort:B surviving, post-fix 3/3 green with the probe still active, and 9/9 green without it. The straggler_releaseAllAbortsItsConnection_ test carries the same defect behind an 800ms margin and is left as is with the reason recorded, since its quarantine comes from a deadline inside scatter that no external latch can gate. Independent-session In Review → Done review; full reactor green under -Plocal-db.

R750 (3fa5432 the mechanism, both guards and the model retype, e4f5498 the fixture conversion; filed 743cb89, Backlog → Spec 1411e45 with the body drafted at be48260, spec reviews 502f286 + 191c863, Spec → Ready cf593c9, Ready → In Progress 2121216, In Progress → In Review 55b27da): a @discriminate interface over a Postgres-enum discriminator column now generates SQL the database accepts. It previously failed on every query with operator does not exist: mpaa_rating = character varying, redacted to a bare reference id at the client, because the three discriminator comparison sites bound their @discriminator(value:) literals with no type information. Each literal now binds as DSL.val("<value>", <tableLocal>.<COL>.getDataType()), the generator’s standing typed-bind idiom, and jOOQ decides the rendering from the bind’s type: cast(? as "<schema>"."<enum_type>") on the enum arm, a plain ? on varchar. Authoring the cast ourselves was the rejected alternative, and the distinction is who decides and which statements pay. DiscriminatedTableFragments mints the qualified reference and the typed operand once each, all four sites calling the reference mint and PathFragments’ cross-table gate composing both rather than respelling the formula, so the comparison sites cannot drift from one another or from the projection. The `__discriminator__ routing projection stays deliberately untyped, an axis split now stated in the class javadoc: in SELECT the discriminator is a routing token the generated TypeResolver reads back as String, not a comparison operand. Two guards make the mechanism total. An unresolvable @discriminate(on:) is a classify-time AuthorError.UnknownName naming the table’s columns as candidates, replacing a silent raw-string fallback that only ever emitted code failing at query time, which makes TypeBuilder the invariant’s single enforcer and retires a stale comment pair where each end claimed the other enforced it. On a closed value domain (a jOOQ-generated enum) every @discriminator(value:) is checked against the enum’s literals, guarding the bind rather than adding a feature: DSL.val converts an unknown literal to null with no warning, so the check is what keeps the loud failure from becoming a silent empty result. EnumMappingResolver.checkEnumConstants’ inner comparison is lifted into `constantMismatches, parameterised on the one axis its two callers differ on: JAVA_NAME for the GraphQL-enum caller whose generated coercion calls valueOf, DATABASE_LITERAL for the directive-value caller, since mpaa_rating’s `'PG-13' literal is the constant PG_13; the literal read is reflective rather than a cast to org.jooq.EnumType, the class coming from the codegen loader. TableInterfaceType.discriminatorColumn and every carrier below it hold the resolved ColumnRef instead of re-collapsing to a bare SQL name, the render sites needing both spellings and Guard 1 making the slot total with no placeholder. Fixture conversion is the test strategy: content.content_type and jti_subject.subject_kind become Postgres enums (with the schema version bumped so an incremental build cannot reuse the stale catalog), reaching all four emission sites, while party_kind stays varchar as the control carrying both rendered forms. content_kind gains a third literal 'PODCAST' with no participant type, so the column’s value domain and the known-participant set are visibly different facts, which is the axis the closed-domain guard sits on. Independent-session In Review → Done review: full reactor green under mvnd install -Plocal-db (BUILD SUCCESS, 624 test classes, zero failures). Acceptance verified against the delivered tree rather than the green build: the baselines carry the cast at all four sites (in (cast(? as "public"."content_kind"), ...), the cross-table = cast(?...), the joined-detail ON "jti_subject"."subject_kind" = cast(? as "public"."subject_kind"), and the DML values (?, cast(?...))) with the __discriminator__ projection uncast; party_kind’s six statements are byte-identical at `= ? and in (?, ?); both guards reach a build failure through validateUnclassifiedType. No code-string assertions were added at the pipeline tier, and the render-tier ones the spec contracted are filed as R774 rather than held against the gate, since the SQL baselines pin the same four facts. User-facing-doc check clean over three touched .adoc files, including a polymorphic-types.adoc how-to sentence the spec did not enumerate. Retirement sweep skipped, no Retired vocabulary declared. One acceptance criterion is met by substitution and disclosed as such: the reproduction shape classifies with its enum ColumnRef in DiscriminatorColumnGuardPipelineTest but is not declared in the example schema, execution proof coming from the two converted families across every consumer path; a third discriminated family would exercise no comparison site they do not. The implementation also corrected its own spec on the read side and filed R754 for it: a String-typed SDL field over a jOOQ-enum column reads the Java constant name, not the database literal, because the emitted fetcher reads the typed jOOQ field and graphql-java serialises the constant with String.valueOf, and a jOOQ-generated enum carries its literal on getLiteral() without overriding toString(). That is invisible in the tree only because every seeded literal in both converted families is a valid Java identifier.

R755 (1c4028d; filed fe7d0d0, Spec revisions d4b4cb6 + f40e290 + 7480379, Spec → Ready 328f8de, In Progress → In Review 97f1bca, spec collapse 4b6bc75): The srp hand-off templates led with commit bookkeeping and gave the gate questions one sentence apiece, so reviewers came back with nits; roadmap/workflow.adoc now carries a What each gate decides paragraph naming the four questions the two guarded gates turn on, both templates open with those questions restated in reviewer voice and close with the bookkeeping, an explicit out-of-scope section routes naming/phrasing/formatting findings away from the verdict, and the In Review template points the reviewer at the delivered state of the tree with the commit series demoted to provenance. Mechanics dropped from roughly half of each template body to at most a third (27/81 Spec stage, 28/103 Implementation stage). Independent-session In Review → Done review; full reactor green under -Plocal-db.

R742 (4683e29 the mechanism with zero rows registered, 1f87258 the two registrations, b4316b1 the multiplicity report and the shared canonical tree and clean removal, 1c79305 the two follow-on re-measurements, 3506105 the Done-gate rework; filed and specced across 14b0126 + c5f8978 + 48ce5ce + 773bcd1, Spec → Ready 11888bb, spec corrections 6bfcadd, In Progress → In Review 26ca19a, readability pass 42edd94, In Review → Ready eb406d1): GeneratorDeterminismTest cost 229.0 seconds, a third of the whole build, and both halves of why were wrong. It ran the generator four times when its contract needed two, and each run cost 57 seconds of which 97 percent was the fact store re-evaluating its own derived relations. The lever that mattered was the second one, and the finding behind it generalises past this test: H2 inlines a view wherever it is named and eliminates no common subexpression, so one read of intent_argmapping_projection_defect expanded to 2066 relation instantiations, naming intent_argmapping_pair 55 times and intent_spelled_table 39 times inside a single statement, and scanning 2.57 million rows to return a handful of defects. Three measurements closed off the fixes that would otherwise look attractive: EXPLAIN costs 0.2s against 24.5s of execution so it is not compilation, the identical statement twice costs 24.52s then 24.53s so nothing memoises, and several relations in the tree carry window functions so no outer predicate prunes them and no rewrite restores pushdown. What ships is a registry rather than two bespoke reductions. meta_materialize pairs a view stating a rule with the table its rows are materialized into, and the mechanism’s whole trick is that the canonical name moves to the table: the rule keeps its text verbatim under a _live suffix, the sixteen other view bodies naming intent_argmapping_pair and the six naming intent_spelled_table are not edited at all, they simply stop hitting a view and start hitting a table, and so does each relation’s one Java reader. Materializations in graphitron-model refills every registered target inside the capture transaction, per graph where the target carries graph_name and whole where it does not, and that module placement is forced rather than preferred: the seeded fixture lives in its test sources and cannot reach graphitron, and the fixture has to call the same entry point production calls or the claim that the two boundaries cannot drift is empty. The doctrine moved with it, in three places the schema describes itself, from "materialise what a view cannot express" to a second admitted case, "materialise what a view expresses correctly and only too slowly", which is what the registry’s NOT NULL reason column exists to make a registration state. The mechanism landed first with zero rows registered, so it was reviewable on its design before any number depended on it. Measured on full green reactors: the class 229.0s → 15.46s on the two registrations, then 16.24s once the third contract clause was added, and FixtureWarningsGateTest 56.8s → 2.53s in the same build, which is the better number to carry away, being the same store reads under a different consumer. The run count deliberately stayed at four rather than falling to three: the shared canonical tree was built and does its job, and the run it freed was spent on clean removal, the third clause of the output contract, which GeneratorDeterminismTest’s javadoc had claimed for a class that tested two. At cross-cutting breadth that new case immediately found that the generator emits into four subpackages its sweep never visits, so a unit the schema stops calling for is left behind in any of them; that is filed as R756 and the case deliberately asserts nothing about those four, so the fix will read as a fix rather than as a regression. Thirteen `graphitron-model test classes broke on the first registration and none of them was asserting anything that changed: they were coupled to when a derivation runs rather than to what it returns, which named a missing concept rather than thirteen bugs. SeededStore modelled capture and query and had no derivation stratum, because under derive-on-read that stratum is implicit and free; it has one now, calling the same materializer everything else calls, so no test names a materialized relation and a fourth registration costs the fixture nothing. Two interactions the spec’s gate list did not predict were found by the build: StoreRefresh.wholesale() is written in exemption polarity and was emptying the registry on every warm capture with nothing to refill it, the rows being authored DDL, so the meta_ family is now exempt for a reason about authorship rather than cadence; and the DDL file’s first INSERT needed the boot to commit, schema statements committing implicitly where ordinary DML does not. Two further reductions were re-measured rather than done, which is what the item asked of them, and both declined on the numbers: flattening the defect view’s six-arm union now buys 22 percent of a store read that is no longer the dominant cost of a four-second run, and merging the duplicate read of intent_resolved_node_key_projection fell from 8.1s per run to 0.49s, which no longer pays for the wide intermediate row it would introduce across two classes. The multiplicity metric became a roadmap-tool step in the family of AdocXrefAnchorCheck, reporting rather than gating because it counts textual references without knowing which arms a predicate prunes, so a ceiling tight enough to be useful would also be wrong; it carries its two parsing mistakes as tests, the unstripped -- line comments that attributed prose section headers to the preceding view and inflated a total by 83, and the literal pattern that backtracks catastrophically on a 672 KB file. The gate ran two cycles and the first sent it back over a test rather than over production. FactSchemaGateTest.everyMaterializedTargetEqualsItsRule asserted nothing: that class’s fixture declares no argMapping-bearing directive and the capture attached no jOOQ catalog, so both registered relations produced zero rows and every assertion compared an empty list to an empty list. It was proved by mutation rather than by inference, an unscoped DELETE in refreshPartition leaving all twenty cases green, which is exactly the failure the case’s javadoc claims to catch and exactly the defect the item’s own clean-removal deliverable was filed to fix elsewhere. The rework gives the case a fixture written for it and a catalog to resolve against, populates both graphs because an empty sibling partition cannot distinguish "left the sibling alone" from "there was nothing to disturb", and asserts non-emptiness per registration before equality so a later registration this fixture leaves empty fails here rather than quietly contributing nothing. Second-cycle review, independent of the implementing session: full reactor green under mvn install -Plocal-db, 14/14 modules, no code-string assertions on generated method bodies, no docs/ changes for the user-facing-doc check and no retired vocabulary to sweep. The fix was verified by re-running the exposing mutation rather than taken on report, and by a second mutation withholding one target’s refill; the first now fails on the sibling-partition assertion and the second on the non-emptiness guard, and the case’s row counts were printed to confirm it runs over real rows. Also verified rather than assumed: MaterializeRegistryGateTest’s four structural cases are non-vacuous, including the no-ordering-needed claim by transitive closure over the engine’s own view bodies, and registration is invisible to consumers as claimed, `DevMojo being the only store-open outside FactCapture and refreshing on open so a warm start that skipped capture cannot serve the language server or MCP stale rows. Four non-blocking observations were left rather than folded into the rework diff (the twenty mechanical _live column comments the comment gate forces, readAll surviving only for an isNotEmpty() check, graphKeyed re-reading INFORMATION_SCHEMA per registration per refresh, and the class-total figure not reproducing exactly off the item’s 4 vCPU sandbox, which its own caveat covers); a fifth, that no authored page under docs/ mentions the registry and fact-model.adoc’s doctrine sentence still states the narrow version this item widened, is filed as R758. R746 carries the ordering the registry deliberately does not record, and its `depends-on cleared here.

R668 (4195667 the detection relations, 8c60ad3 routine writes emit from a command row, 1a91a24 the projection, a807f3b the openability rule in the grammar, a2607d8 the @condition arm and the type gate, 04a8cc8 the walk stops judging, 85a04bb the per-schema Tables capture, 2ef0b57 the producer reads the store, 25814a1 the Done-gate rework; filed d733f40, Backlog → Spec 813786e, fourteen spec revisions 301d084 + 73551be + cfd84eb + 1b4b8e6 + b267458 + 169b845 + 93b7942 + 3f3cea5 + 46b3ede + 9df5780 + ecf2324 + 9ab6700 + 3a8111b + 4f8cb41, attribution fix f79a112, In Progress → In Review 52d6e2d, In Review → Ready 444ac66, Ready → In Progress 84fda8a, In Review 2ccecdd; the Spec → Ready and first Ready → In Progress flips fall inside a squashed clone baseline and have no individually citable SHA): an argMapping path may open a @nodeId leaf into its node type’s key columns, which closes a silence rather than adding a convenience. Before this, pCustomerId: input.customerId on a @nodeId-carrying ID compiled clean and sent the base64 wire id to an INTEGER routine parameter, failing at runtime far from its cause; every one of the six rejections this lands is a spelling that used to build. The authoring rule is the one the dot already followed, extended rather than special-cased: a dot opens the thing at that position, an input object opens into its fields, and an ID carrying @nodeId(typeName:) opens into that type’s key columns, so input.customerId.customer_id is a path and customer_id is a key column of the node type rather than a field of any SDL type. The resolution is a chain in the fact store and not a scattering, which is the design claim the gate checked hardest: seven graphitron_*_arg_mapping_pair relations reduce to one intent_argmapping_pair with eight site values, then to what each segment bound, then to the leaf and whether it declares a @nodeId, then to a trailing segment naming a key column, then to a projection whose column type the parameter can take, each link reading only the one before it. The relation that had to be invented is intent_argmapping_bound_parameter_type, because the two populations answering "what Java type does this pair’s left side take" are unrelated: a @routine parameter’s type is a catalog fact and every other site’s is a classpath fact, so a reader had to switch on site to know which to ask, nobody did, and the type gate could not exist. That gate is a join predicate and not a check: an emitter reads the projection relation, so a pair whose types disagree is not a projection an emitter can see and there is no order of operations in which one is emitted and then rejected. It fires only where both operands are known and stands aside where either is not, so it strictly adds rejections and removes no emission; a parameter the classpath census cannot name (candidates > 1, a primitive int, a consumer compiled without -parameters) stays an unchecked projection rather than becoming a pair that is neither projection nor defect, which is the silence the item exists to close. intent_argmapping_projection_defect reads the same chain and states six verdicts with no precedence rule, its arms disjoint by construction over node_id_declared, trailing_segments and one existence test; the reviewer re-derived the disjointness pairwise rather than taking it, the load-bearing step being that node_type_ref IS NOT NULL implies node_id_declared in the leaf view, which is what keeps the type-mismatch arm from colliding with MISSING_TYPE_NAME or UNDECLARED_NODE_ID. Two coherent shapes defer rather than reject, and the distinction is the item’s own: a rejection says the author wrote something wrong, a deferral says they wrote something sensible that is not built, and the message points at the follow-up. A list-shaped node id and a projection at a site whose emitter does not read one both defer in Java rather than in SQL, because each is a fact about this codebase and not about the schema; EMITTING_SITES names the three wired sites and @service, the input-field @condition and the three reference-step sites each fail the build saying so. R735 carries the list-shaped emission and the ArgBindingMap.Result deferral arm. One deletion is the shape’s foundation: ArgBindingMap.of runs while the schema is being built, before capture, so it has no store to consult, and on reaching a segment it cannot resolve it now carries every remaining segment as an ordinary path step and decides nothing. A rule spelled there would be an earlier, unfalsifiable second copy of a view’s answer that won by rejecting first, and the two rejections a reader most expects the walk to own, UNDECLARED_NODE_ID and TRAILING_SEGMENTS_BEYOND_ONE, are in the view for exactly that reason; the one rejection that stays in the walk is a head naming no slot in scope, which is a question about the SDL surface the walk holds rather than about captured facts. Two supporting facts landed with it. sql_schema.tables_class_fqn is the per-schema generated Tables class, needed because a store-sourced TableRef cannot otherwise name a column constant, and it follows the rule its keys_class_fqn sibling established: resolved by loading the class off the codegen classpath, never by concatenating a configured package, the two diverging under multi-schema layouts. Its guard is not the agreement case that computes the expectation through the same resolver but perSchemaTablesClassesAreDistinct, which reads each schema’s own source package back out of the store, so a capture that derived one name from a single configured package would satisfy every single-schema assertion and fail that one. ColumnRef.decodeBindingType is the third way to get a columnType right, beside a sibling record’s decoded one and a live Class at the reflection boundary, and the one a store-sourced reader needs; it is array-safe because the captured name is the raw Class.getName() form, whose JVM descriptor is exactly what crashes ClassName.bestGuess, and a boolean-array column is an ordinary column in a consumer’s database rather than bad luck. The plan tier stopped reading the walk in the process: KeyProjectionCommands.produce takes no GraphitronSchema, command/KeyProjection carries only captured facts, and the plan-side seam ratchet went 140 to 139. The key list rides the command row whole rather than just the projected column, because the decode’s fromArray load is positional while the projected column is named, which is what makes a transposed composite projection unconstructable. The gate ran two cycles and the first one sent it back, over a test rather than over production: ArgmappingKeyProjectionEmissionPipelineTest pinned rendered method bodies as code strings in six of its seven cases, which the code-string ban forbids at every tier and which is review-enforced, making the Done gate the enforcement point. The rework re-expressed those cases through TypeSpecAssertions, the codebase’s own named remedy, which grew a projected-key section so the rendered spellings live in the one file that is allowed to know them, and resolved the condition glue structurally by its org.jooq.Condition return type rather than by a name scan. The behavioral half of "the decode precedes the write transaction" moved to the tier that owns behavior: GraphQLQueryTest.rentFilmPayloadProjected_badNodeIdIsARequestErrorAndCommitsNothing sends a malformed string and a well-formed id encoding another type, and asserts a request-level error, a null payload and no committed row, so a client error about an argument cannot be re-reported as a failure of the write. Second-cycle review, independent of both the implementing and the reworking session: full reactor green under mvn install -Plocal-db, the emission test carrying no rendered-body assertion (its one surviving contains reads a method-name list), user-facing-doc check clean over the nodeId.adoc and routine.adoc additions, and no retirement sweep owed. The claims table was re-verified against the tree rather than read off the previous gate’s note, all nine test-count claims matching what the run reported. Two residues are stated rather than rounded off. The emission cases are still body scans, now single-sourced behind typed helpers, which is the tradeoff TypeSpecAssertions exists to make and not an elimination of the scan; and invocationTakesProjectedRead admits other arguments between the invocation and the projected read where the old string required adjacency, a loosening judged not worth a third cycle. The one thing the gate carried forward before deleting the file is R626’s after-a-dot note, which said the "offer nothing rather than a misleading flat list" limitation is uniform across directives and stays uniform. That is now two arms with two different answers available: the input-object arm still needs a nested-input-field projection in the LSP snapshot, while the node-id arm is answerable from intent_resolved_node_key_column today and needs no new capture, graphitron_argument_node_id and graphitron_field_node_id already carrying node_type_ref at both coordinates. What is missing there is only the consumer, ArgMappingCompletions.rightCandidates returning nothing the moment a dot appears, which leaves the editor silent on a spelling the build now both accepts and rejects with a candidate list. The absorbed argmapping-completion-after-a-dot item’s file was already gone, so R626 is where that observation now lives.

Discarded: The assembled schema owns the composed SDL census (assembled-schema-owns-the-sdl-census, R714): absorbed into R743 (sdl-fact-gatherer-staged-pipeline) at the owner’s direction, applying the test the R678 discard states: a piece absorbs when it has no independent success criterion under the chosen strategy. R714 had one under an incremental strategy (swap the graphql_ payload’s transcription source inside the existing one-pass capture, everything else unchanged). The owner then decided the SDL gatherer restructure lands as a big bang, and under that strategy R714’s deliverable is exactly R743’s stage 4: there is no way to implement the full-schema traversal that is not R714, and doing R714 first would build it into the one-pass capture the restructure throws away. Nothing else depended on it (R713 references the composed-payload question but declares no dependency and stays downstream of R743 on the same terms). Its analysis travels rather than dying: R743’s stage-4 section carries the pre-synthesis registry cut and its verify-don’t-assume obligation, the deletion of capture’s extension merge and first-wins claim, the two open decisions (introspection types in or out of the census; applied-directive ordinal stability across base-then-extension merge, pinned by a multi-extension fixture), and the availability cliff resolved as per-census currency rows. Re-open trigger: R743 discarded or re-scoped away from stage 4.

Discarded: Delivery verdict derives from the store, not from a hand-maintained negative-space switch (delivery-verdict-derives-from-the-store, R666): dropped at the user’s direction when R682 (planners-read-facts-emitters-read-commands) was repointed to own the leaf-zoo dissolution outright. The item had grown into the roadmap’s last strangler-shaped migration: it derived one verdict as three views plus a shadow test and a residue record while deliberately flipping no production read, so the walk stayed the only oracle and six Spec passes accumulated their corrections in the description of the walk’s holes rather than in the rule set. Its own scope section already recorded the alternative as an open question raised from outside: fold the delivery verdict into the planner item on the same footing as the other three homeless folds (operation members, connection synthesis, tenant bindings), so the consuming slice’s own test is the specification and neither DeliveryResidue nor DeliveryShadowTest is built. That alternative is what the user chose, and R740 (retire-oracle-diff-shadow-tests) independently argues the general case against oracle-anchored derivations. The design analysis survives in git history for the slice that builds the delivery relation: the seven-arm table (four rule arms, three exemption arms), the four predicate warnings (the binding is intent_resolved_type_binding rather than intent_bound_table, record-handedness is the backing closure rather than the producer-payload seed set, authored type and cardinality read through graphitron_field_synthesis, the structurally declared connection’s element resolves through no shipped relation), and the sibling relationship to intent_field_separate_fetch.

Discarded: Consolidate graphitron-lsp navigation, dispatch, and result-building (lsp-structural-consolidation, R347): the umbrella’s delivered half stands, its remaining half was overtaken. Slices 1-3 shipped under this item and survive as the module’s shared primitives: one navigation home (Nodes grown into the toolkit plus GraphqlNodeKind as DeclarationKind’s structural sibling, retiring 12 `childOfKind copies and three latent NPEs), DirectivePolicy centralizing the directive-name carve-outs with Definitions joining the coordinate-driven dispatch shape, and the CompletionProvider/Completions sealed-switch dispatcher replacing the hand-ordered waterfall, with the InferredDirectiveRenderer registry and InlayHintRendererCoverageTest closing the silently-dropped-entry gap. The unshipped slices' premises were then dissolved by the fact-store migration (R595, R589, R610): the module roughly doubled and re-formed around facts/ store readers and the LspSurface/TriggerDispatch matrix, Workspace’s four torn-readable volatiles became the single `StoreAccess handle the item’s own 2026-08-06 fact-base note predicted, the LspVocabulary.load() overloads lost their last caller, WorkspaceFile gained close discipline, and the native-library probing duplication left with the graphitron-tree-sitter-natives bundle. A 2026-08-19 audit of the remainder against the tree found three small surviving facts (outbound byte-range to Range construction still per-feature, CodeActions running each rewrite three times per match, the recalc queue’s linear-scan dedup), filed as R739 rather than carried by a 290-line umbrella whose problem table no longer describes the module.

R715 (28c4f64 the qualifier split, the folds and the eleven write conversions, 71b7473 the narrowed fold rule, c1dc70c the fact-model page, 0d4e2d1 the Done-gate rework; filed 7594dcd, Backlog → Spec d4f2666, six spec revisions 034a212 + ff2f8a3 + ed6fa19 + 8cb74b9 + 3eb2b78 + 599ce61 + 3474cb2, Spec → Ready 7d4404b, Ready → In Progress df845d2, In Review 4e7c5b9, In Review → Ready 94f6b31, In Review f5ebd84): a decoded grammar lands in a normalized shape rather than being re-flattened into a string every reader takes apart again. Three grammars were audited and two were re-flattened. The dot grammar on nine *_ref columns is now partitioned by capture into a _namespace_part / _name_part pair beside the verbatim value, unconditionally and with no fallback arm: NULL means no period appeared, the empty string means one did with that side empty, and a half-empty reference joins nothing, which is the stated outcome rather than a rule a reader has to know. QualifiedNameGrammar lives in graphitron-model beside the columns it fills, because the split has two writers in two modules and the seeding harness is upstream of the generator. The field-set grammar’s nesting stops being rendered: graphitron_federation_key_field.field_path becomes the child relation graphitron_federation_key_field_segment, FieldSetGrammar.paths returns segments rather than dotted strings, and its tolerance contract is unchanged. graphitron_argument_path_segment is re-keyed from the interning (graph_name, argument_path, position) onto the coordinate (graph_name, type_name, field_name, argument_path, position) with the foreign key to graphql_field that coordinate makes available, reversing the table comment’s own repeating-group defence (a 1NF word carrying a 3NF worry, over a duplication with no update anomaly to prevent and no entity to intern against); intent_type_backing_seed’s join is widened to the new coordinate rather than left correct by absorption. Case folds become generated columns (GENERATED ALWAYS AS (UPPER(...))) on both sides of every crossing, chosen over a written column with a `CHECK because CHECK (x_upper = UPPER(x)) admits UNKNOWN and measurably accepts the drifted row. The fold rule narrowed during implementation and the narrowing is the item’s most reusable output: a fold is minted only where an authored spelling meets a catalog name, a comparison inside one family mints nothing and reaches an existing fold by joining that relation on its key, and a derived view never forwards a fold. That took sql_constraint_column out of the set, so eleven relations converted and not twelve. Because h2 rejects an insert that so much as names a generated column and FactSink.flush() named every column a relation declares, those eleven gained written statements in FactWrites (thirteen newRecord sites, conflict behaviour stated per relation instead of read off a jvm_ / sql_ name prefix), with flush() dispatching to a write function where one exists and rendering generically where none does, because the two arms interleave across the foreign keys and the parents-first ordering has to span both. That is a declared prefix of roadmap/capture-declares-the-columns-it-writes.md’s 123 relations, not a second mechanism, and that sibling’s body now says eleven, thirteen and 112. The views stop taking strings apart: `intent_spelled_table, intent_field_reference_step_hop, intent_column_match_claim and intent_name_matched_key_pair compare stored columns, taking the schema’s reducible budget of 30 UPPER, 8 POSITION and 5 SUBSTRING to zero, 0 and 0, the residual 2 POSITION and 4 SUBSTRING being the bean-accessor rule and two recursion cycle guards that are not case folds at all. WrittenStatementCoverageTest gates the write path without a roster of any kind: every relation the catalog reports a computed column for has a write function, and every write function round-trips a row whose every writable column carries a distinct value, so a dropped column comes back null and a swapped bind comes back swapped. The proposed no-UPPER-in-a-view gate did not land, and the item says why rather than rounding it off: the count reached zero and a concurrently-landing node-identity defect view brought four back, whose two operands are both crawler-produced and so cross no namespace, filed as R724 rather than guessed at. Independent-session In Review → Done review, second cycle: full reactor green under mvn install -Plocal-db (14 modules, 0 failures), no code-string assertions on generated method bodies, user-facing-doc check clean over the one .adoc file, no Retired vocabulary section to sweep though the retired field_path was confirmed gone from every prose surface. All four findings of the first gate were re-verified against the tree rather than taken from the resolution note that the same session wrote: eleven folded relations counted off the DDL, thirteen newRecord sites counted off the capture layer, the sibling’s corrected accounting read in place, and the dropped timing duty confirmed as a structural claim every one of the eleven writers satisfies. The two findings that gate recorded as clean were re-established independently: all eleven written statements agree on column list, marker arity and bind order (checked mechanically, 11/11), and the three rewritten predicates are faithful, POSITION('.') > 0 to namespace_part IS NOT NULL and UPPER(COALESCE(a, b)) to COALESCE(a_upper, b_upper) on UPPER(NULL) being NULL. One finding, not held against the gate because it postdates the delivery: intent_resolved_node_key_projection landed on trunk 91 minutes after this item entered In Review and brought two further per-row UPPER, so the schema holds six and not the four R724 and fact-model.adoc both describe as the single survivor. Unlike R724’s hedge that comparison matches an authored argMapping segment against a catalog column name, so it is a crossing this item’s fold rule does reach; R724’s scope sentence is corrected here, and the premise in R668 that still justifies the per-row fold by appeal to intent_spelled_table and intent_column_match_claim comparing under UPPER() is left for that item’s own gate, which it is still In Progress ahead of.

R693 (passes 1-2 landed inside the squashed clone baseline c07c57b, individual SHAs unavailable post-squash; third pass a50b442; third In Review → Ready gate e0736f8, the first two gates likewise in-squash): Flatten a nested grouping input onto a consumer bean at @service, the member-axis sibling of R336. An SDL input type on a bean-typed @service param may now cluster fields under nested input objects while the backing Java class stays flat. The binding rule is implicit, directive-gated, and three-way: a nested input field whose binding key names a member binds as today (a nested InputBean leaf; adding a member is how an author opts a group back out); a directiveless nested field naming no member is a grouping, whose own fields hoist onto the enclosing bean’s binding-key index under the access path ["g", <leaf>] and bind by the normal rules, recursively; a nested field carrying @field(name:) or @nodeId whose named member does not exist rejects, naming the directive and the missing member, so a typo never becomes silently-different behaviour. @table on a grouping input stays inert (the type flattens exactly as its directiveless twin). D1: CallSiteExtraction.FieldBinding and ValueShape.FieldBinding replace sdlFieldName with an ordered non-empty List<String> accessPath plus a mapKey() accessor returning the last element (the wire Map key; leaf() was taken by the extraction component); replaced rather than added, so every consumer moved under a compile error, and a top-level binding is a one-element path with byte-identical emit. D2: InputBeanResolver.buildInputBeanBody fills sdlByBindingKey by a recursive descent applying the rule; the record arm’s bijection keeps its shape (direction A now finds hoisted components, direction B checks index entries so a hoisted leaf naming no component still fails), the JavaBean arm stays partial for scalars. D3 rejections, each a structural Rejection naming the dotted path: cyclic grouping (SDL-type-name expanding set, since a flattened group has no Java class for the existing visited-set guard), list-shaped grouping (list-lifting the leaves considered and declined: it would silently transpose the client’s wire shape), collision as one rule (a hoisted leaf is a peer of the enclosing type’s own fields; checked once against the fully-built index, the path is message-and-emit data and never identity), no depth limit (the cycle guard bounds descent). D4: the emitted helper opens one Map<?, ?> descent local per distinct group prefix, parent before child, via an instanceof pattern with an empty-map default, so no per-field arm needs a null guard and an absent, null, or non-Map group yields null for every member hoisted out of it; the member axis has no omitted-versus-null tri-state, so this matches omitting the leaves at top level. D5: "Grouping input fields under a nested input type" section in docs/manual/how-to/handle-services.adoc, distinguished from the argMapping dot-path (which rebinds method parameters, a different axis). Five new loud JavaBean-arm build failures, deliberately: today bindJavaBean skips an unmatched SDL field before ever descending, so every one of these builds while silently dropping the group’s data on the floor. After this item, each fails the build naming the SDL that caused it: (1) a group whose hoisted leaf key collides with a top-level field’s key; (2) a directiveless group that reaches itself; (3) a list-shaped group; (4) two groups hoisting the same key; (5) a group carrying @field(name:) or @nodeId whose named member does not exist. None can fire on a schema whose data currently arrives intact; a consumer hitting one was already losing that data, and the break is the item working. Deliberate scalar-axis asymmetry: an unmatched scalar field is still skipped in silence; the arm’s partial-by-design tolerance narrows exactly as far as the item can see (a nested field must be inspected to flatten, a scalar drop needs R695’s diagnostic machinery). The record arm is reject-to-accept only: every newly admitted schema failed its bijection before, so no record-arm schema that builds today stops building. In-scope fix of a pre-existing emit defect: the singular nested-bean helper’s Map<String, Object> parameter forced an unchecked cast at its call site, a hard failure in a consumer build under -Werror; widened to Map<?, ?> with instanceof-pattern narrowing at every call site, the plural helper’s per-element cast wildcarded and its @SuppressWarnings dropped. That rule is stated on InputBeanInstantiationEmitter.buildSingularHelper / buildPluralHelper and enforced by graphitron-sakila-example’s `-Xlint:all -Werror compile of the emitted tree, whose FilmReviewGrouped fixture keeps a singular nested-bean member (headline) inside the gate’s reach; a redundant text lint was considered at review and declined, since it cannot tell a covered cast from an uncovered one without scope analysis. The list-valued twin ((List<String>) root.get(k)) is R703, where the remedy does not transfer. Coverage: pipeline InputBeanGroupingPipelineTest (16 cases, both arms: accept cases asserted structurally on the resolved ValueShape.FieldBinding access paths and leaf shapes, rejections by message substring, no generated-body string assertions), compilation tier via the depth-2 FilmReviewGrouped fixture against a real consumer record at <release>17</release> (parent-before-child descent order is a compile error there), execution tier via submitGroupedReview_flattensTheGroupOntoTheBean round-tripping a present group, an absent group per level, and a matching-member group still arriving nested. Retired: sdlFieldName on both FieldBinding encodings (survives only on out-of-scope carriers: SetColumn, KeyColumn, GraphitronType, PayloadConstructionShape, InputRecordShape, PayloadSdlField, the walker Contribution records); the sweep also caught a bindField local that held a dotted path under the retired name, renamed fieldPath. Three independent In Review gates: the first relocated five banned body-string assertions to their real enforcers, the second accepted that relocation but caught one javadoc clause routing readers to a lint that was never written, the third confirmed the clause now names the -Werror enforcer and approved (full reactor green under mvn install -Plocal-db, 14/14 modules, InputBeanGroupingPipelineTest 16/16, user-facing-doc check and retirement sweep both run). Deferrals filed: R694 (bean-helper dedup keyed by class hides divergent bindings, the R437 twin), R695 (scalar-axis unbound-field diagnostic, now the remainder of this item’s contract-narrowing), R703 (list-valued cast twin), R707 (the sibling `JooqRecordServiceParamPipelineTest’s own body-string assertions).

R710 (95df965 the delivery; Backlog 968592d, Spec cb11feb, spec revision d4f78a6, Spec → Ready c07c57b, Ready → In Progress d7dc3e0, In Review b910259): the jOOQ crawler records the node-identity constants a generated table class publishes as stated, not as validated. Before this the store held no record of __NODE_TYPE_ID / __NODE_KEY_COLUMNS at all; the metadata existed only as a live reflection result behind JooqCatalog.nodeIdMetadata, which answers a validated question, so a malformed constant was indistinguishable in the store from a table publishing nothing. Two base relations in the sql_ family now transcribe them: sql_node_metadata, keyed on sql_table’s own key with a closed form arm per constant (STRING/NULL/OTHER/ABSENT` and FIELD_ARRAY/NULL/OTHER/ABSENT) plus the stated value and the deterministic class-FQN witness, and its ordered sql_node_key_column entries carrying the array index the encoded identity depends on. A row exists when the class declares either constant, so the half-declared pair the live probe folds into silence is visible, and CHECK (NOT (type_id_form = 'ABSENT' AND key_columns_form = 'ABSENT')) keeps "no row" meaning "publishes nothing". Well-formedness moves out of capture into intent_node_metadata_defect, one row per defect over a closed ten-arm vocabulary with no first-failing short-circuit and no reason-text column, every join inside the jOOQ corpus so it stays a derivation over one corpus rather than a validation smuggled into a crawler; KEY_COLUMN_UNRESOLVED mirrors findColumn’s two-tier case-insensitive spelling against `sql_column.jooq_name or column_name rather than the SQL tier alone. JooqCatalog gains NodeMetadataFacts and nodeMetadataFactsOf beside its four existing capture-facing siblings, with StatedConstant and one shared getField probe so the reading half and the reduction cannot disagree about whether a class declared anything; reflection and raw-Object interpretation stay at that one containment site. The sql_ family charter is amended in the same change, having said "database" while this is the first whole relation of generated-model facts under it, where sql_table.class_fqn had put only a column. No behaviour change: the validating path keeps its exact answers, nothing reads the new rows yet, and generator output is unchanged; the reader arrives with the sibling nodehood item. Held by the two form-to-nullability correspondences and the both-absent exclusion as CHECK constraints, entry parentage and position density as FactSchemaGateTest cases, both relations in FactCaptureAgreementTest’s EQUALITY arm with the view as DERIVED, and an agreement assertion comparing the store’s per-table verdict against the live probe’s, called with the qualified spelling so a shared bare name cannot let the gate agree by luck. Independent-session In Review → Done review: full reactor green under `mvn install -Plocal-db (14/14 modules, 5679 tests, 0 failures), no code-string assertions on generated method bodies anywhere in the delivered tests, all ten defect arms covered by seeded rows in the module whose DDL declares the view, reviewer rule confirmed by session trailer on the implementation commit, and both the user-facing-doc check and the retirement sweep skipped (no docs/ changes, no declared retired vocabulary). Two sub-threshold notes recorded rather than filed: NodeMetadataFacts is the one capture-facing sibling without a compact constructor, so its null-tolerant keyColumnNames is unmodifiable only when reduceNodeMetadata builds it, where IndexFacts copies unconditionally; and the agreement assertion’s MALFORMED arm is vacuous over the fixture corpus, which produces no malformed generated class, as the spec anticipated when it pinned the defect derivation against stated rows instead.

R323 (4085a53 the delivery, 3b33f2e the follow-up item’s id; Spec 49b734b, two spec reviews a99e24c`+ed1a601, Spec → Ready `86229aa, Ready → In Progress 7467601, In Review 53901b9): multi-parent NestingField sharing admits the two alias-projected leaves, and the remaining BatchKey deferral stops being an open question. A plain-object nesting type declared on two @table parents has each parent classify the shared type’s leaves against its own table (the anchor), and GraphitronSchemaValidator.compareNestedFieldsShape checks the results agree; arms existed for ColumnBackedField, TableField (R23) and NestingField, and everything else fell to a catch-all deferral. Re-derived at Spec time against the post-R431/R432 model, that catch-all was the sole blocker for exactly three leaf classes, because a leaf reaches the multi-parent question only if isNestedWireableLeaf admits it at nested depth at all: ComputedField and ColumnBackedReferenceField (both admitted at nested depth by R645) and the SourceShape.Table arm of BatchedTableField. Every other BatchKeyField carrier is rejected per-variant first by validateVariantIsSupportedAtNestedDepth (the Record-sourced BatchedTableField arm, ServiceTableField, ServiceRecordField, BatchedPivotField, BatchedInterfaceField / BatchedUnionField, and BatchedTableInterfaceField), so it never reaches this gate on its own account. The first two admit on R23’s own argument and needed no emitter work: ProjectionCommands mints the projection unit per anchor and its $project receives the anchor’s own table local, while the shared <NestedType>Fetchers registration reads the value back by __rk_<resultKey> alias off the source record without consulting the parent, so first-parent-wins registration of the shared nested type is output-identical whichever parent registers it. Stating the rule the arms are instances of is half the item, and it now sits on validateNestingParentCompat’s javadoc in place of a sentence stale since R23: a leaf is multi-parent-safe when every unit and method address it mints under a nested type carries the anchor, and an arm compares exactly the inputs of the addresses that do not. The new arm is keyed on the `ResultKeyAliasedField capability rather than on two class identities, and its two non-obvious constraints are both reified rather than remembered. It sits below the TableField arm because TableField is a member too, so an arm placed higher would swallow it and silently stop comparing filters() where one generated condition method serves every reuse site; that message had no test, and the new negative test makes the ordering a build failure instead of a review note. PivotField is excluded in the predicate rather than merely absent: it is a legitimate member (it does project under a result-key alias) but its unit is addressed pivotUnit(parentTypeName, fieldName) and a nested leaf’s parentTypeName is the nested type, so its address does not carry the anchor. isNestedWireableLeaf keeps it off this gate today, making the exclusion unreachable, but a membership-only predicate would pre-answer the multi-parent question in the affirmative for any future member with nothing to force the check, which is exactly the hand-declared-marker drift development-principles.adoc names. The arm compares domainReturnType() as the read-side analogue of the ColumnBackedField arm’s columnClass check, plus, on the reference half, the joinPath() terminus read straight off the model through JoinStep.HasTargetTable (this validator holds no catalog, and ServiceCatalog.terminalTableForReference answers empty for a non-FK-derived terminus where the comparison still wants both sides). That second fact is not belt-and-braces: a {key: "..."} first step resolves from either endpoint of the named FK, so two anchors sitting on opposite ends traverse it in opposite directions and read two different tables' same-named, same-typed column, which domainReturnType() cannot see; terminal table rather than terminal column name is the grain, because that divergence shares the column name. One draft claim was corrected on contact with the model and recorded rather than quietly fixed: ComputedField.domainReturnType() is not the peeled helper return type, because OutputField.peelToClassName does not unwrap org.jooq.Field, so every instance answers the constant Plain(org.jooq.Field); the base comparison stays as the uniform check but is discriminating on the reference half only, and the honest reason it never fires on the computed half is that every fact that leaf stores bar its per-variant-deferred joinPath derives from the single SDL declaration on the shared nested type. Also here: the class-mismatch check routes a ResultKeyAliasedField membership split through the class-carrying Rejection.deferred overload instead of structural, worded on the FK-orientation fact that actually differs (the only route there is an @nodeId FK-mirror collapse landing on different sides per anchor, and the reference side always co-rejects on its own NodeIdEncodeKeys deferral, so the wording deliberately avoids naming a projected-alias read that side never performs); the catch-all moves onto the same overload and its comment now states the rule plus today’s sole resident, the Table-sourced BatchedTableField arm on both authoring shapes (a plain @splitQuery and a lookup-keyed instance, since isNestedWireableLeaf gates on sourceShape() and reads nothing about lookup()). That deferral stays and becomes the documented end state rather than an open question: GeneratedUnits.rowsMethod addresses the rows method on the nested type so every sharing parent mints the identical reference and the coordinate gets one DataFetcher, while deriveSplitQuerySource reads the batch grain off each anchor’s own correlation columns, so admitting it needs per-anchor minting plus a runtime dispatch inside the single registered fetcher on which anchor the arriving source row came from, and where that discriminator lives on a projected source row is a genuine design problem with no measured downstream demand. No successor item is filed by design; a future admission should be filed fresh, with demand in hand, against whatever the minting machinery looks like then. ResultKeyAliasedField’s javadoc said "the four families" and named three; it now names `PivotField too. Coverage: NestingFieldValidationTest gains both admissions, both divergence rejections (domainReturnType() and terminal table, the latter hand-built on the reverse-{key:} shape and the one case that fails without the second comparison), the membership-split rearm with the test’s own comment recording that no reachable schema produces that message alone, and the arm-ordering guard; the catch-all’s deferral witness migrated off ColumnBackedReferenceField (now admitted) onto a Table-sourced BatchedTableField so the message keeps a live pin. GraphitronSchemaBuilderTest pins per-anchor classification of a shared type carrying both leaves (two different FKs, one terminal table) and the cross-parent R646 assignability rejection, asserted at the outer coordinate because the nesting arm of FieldBuilder.classifyChildFieldOnTableType rewraps a nested UnclassifiedField there, with the consequence asserted deliberately: the rejecting parent’s field is no longer a NestingField, so the shared group drops to one member and compareNestedFieldsShape never runs on that schema. Execution extends the R23 OccupantLocation fixture (shared by Customer and Store, both FK to address) with one leaf per admitted class, a {table: "address"}-entry scalar @field + @reference and an @externalField whose helper takes Table<?> (the form a shared nesting type requires, since the helper is reflected once per anchor), both asserted against their flat siblings under both parents. No @classified corpus verdict flipped, as expected for a validation-time gate. Independent-session In Review → Done review: full reactor green under mvn install -Plocal-db (14/14 modules), no code-string assertions on generated method bodies, reviewer rule confirmed by session trailer on both implementation commits, retirement sweep clean across all three declared terms (surviving hits are the gitignored docs/target/staging render and the historical R23 changelog entry), and no docs/ changes so the user-facing-doc check is skipped. One sub-threshold note recorded rather than filed: the rewritten catch-all comment says other BatchKey carriers "never reach here", where they do reach it and collect a second, redundant error on top of the per-variant rejection, as the spec body itself stated more precisely. Found on the way and filed as R708: the generated $project selection gate switches on graphql-java’s getFieldsGroupedByResultKey(), which is recursive over the whole sub-selection, so a unit’s arm fires for any name selected at any depth below it; the fixture leaves are named occupantDistrict / occupantAddressId to keep this item’s shape off that defect rather than re-pinning ProjectionSqlBaselineTest onto a spuriously projected column.

R704 (e1d9df5 Track A slices 1-3/5-6, c04ffc2 pagination, 482e8a8 routine catalog facts, 306972c chain terminus + name-matched hop arm, 59a746b`+fb851b1` the return binding, a302874 the keying rule as a relation, 68c639f self-review; Ready 36a346a, In Review 1d9d71c): The @routine read surface, unwired and then re-derived from facts. A table-valued function’s result table has no primary key and no foreign keys, and the generator restated that one catalog property as five unrelated refusals in five files: a root @routine field silently dropped @defaultOrder, deferred @orderBy and @condition, rejected @asConnection, demanded a restated @table on its return type, and refused a child’s implicit hop out of the result. Track A deleted the carve-outs rather than building capabilities, the render layer already being generic over all of them: both chain classifiers now resolve the whole read surface through resolveTableFieldComponents against the chain terminus, with the routine’s own IN-parameter arguments excluded off the resolved bindings rather than off the directive text; validateListRequiresOrdering lost its Chain exemption and grew a routine arm, the generic message’s "add a primary key to the target table" being impossible on a function result; pagination needed the arm built rather than unblocked, and composing the hops into a joined table expression is what makes one Table<?> local the FROM, the seek’s source and the connection carrier’s count source at once, so totalCount counts the chain rather than the terminus alone; parsePath’s element-less arm gained the function-ness gate its `{table:} sibling already had. Track B replaced the hardcodes with relations: sql_table.table_type, sql_routine and sql_routine_parameter capture the catalog facts (jOOQ generates no Routine object for a table-valued function at all, which is why the callable is its own subject and table-valuedness is the join); intent_field_chain_terminus states where a chain lands and on what kind of table; intent_routine_return_binding and intent_resolved_type_binding make a routine’s result bind its return type at type scope, with disagreement stated as candidates rather than picked; intent_name_matched_key_pair states the keying rule catalog-only, and the hop view’s new NAME_MATCH arm is its first reader. The classifier half sits at the producing edge beside the carrier’s own fixed point (RecordBindingResolver.groundRoutineReturnType plus TypeBuilder.routineReturnVerdict), because minting the binding globally would collapse the fork classifyMutationRoutineCarrier decides by asking whether the return is already table-bound; three readers of the written directive moved with it. The sakila fixtures keep one spelling of each, ActorFilm derived and Tilgang written, so the execution tier proves them equivalent against a real database. Independent-session In Review → Done review: full reactor green under mvn install -Plocal-db (14/14 modules), no code-string assertions on generated method bodies, and the deterministic-order enforcement mutation-checked at the gate rather than taken on report (restoring the Chain exemption fails ValidateListRequiresOrderingPipelineTest.routineTerminusListWithNoOrderingNamesTheFunctionAndPointsAtFields). Four slices left the item deliberately and are filed: the carrier’s explicit data-field path as R717, the three reads that did not catch up as R718, the carrier-versus-chained discriminator as R719, and the plan-tier pilot onto R682’s launcher step, which is recorded on that item at this gate rather than left in a deleted file. Three residues filed as R720 at the gate: prose in QueryField and RoutineResolution still naming @table where the code holds the binding, bindReturn’s rejection forking on whether `@reference was written rather than on where the chain ends, and one execution-tier order assertion whose fixture row order already equals the order it asserts. The two Java copies of the keying rule (synthesizeNameMatchedJoin, deriveRoutineCarrierPairs) deliberately still run: the re-plan established that they retire when their consumer becomes a planner reading facts, not by teaching the classification walk to read a view, so the two new relations have no generator consumer yet and the store’s own tests are what read them.

Discarded: Routine carrier: admit the explicit data-field reference path, single- and multi-hop (routine-carrier-explicit-data-field-path, R622): superseded by R704 (routine-composition-surface-from-facts) at the user’s direction, from Backlog, before any implementation. R622 owned the write-side half of one gap R704 owns the read-side half of: a hop from a routine result to a @table-bound target. The two seats had exactly inverted affordances and the same derivation written twice. On the read side an author must write @reference(path: [{table: "rolle"}]) even though the child’s return type already names rolle, and the implicit form is rejected with an FK message that steers away from the single-hop spelling that would work; on the carrier’s data field the implicit name-matched hop is the only spelling and @reference is deferred outright. BuildContext.synthesizeNameMatchedJoin and BuildContext.deriveRoutineCarrierPairs are the same loop over the target’s primary-key columns against the routine result’s column names, differing in rejection text and return type. Closing one cell without the other would have left the inversion standing with the duplication still funding it. R622’s own framing anticipated the fold: it declined to spec a new parse seat on the legacy pipeline and asked to be specced as views over graphitron_field_reference_step, naming itself a candidate first consumer pulling the carrier-classification neighbourhood onto the store. That reading is confirmed and understates the position. intent_field_reference_step_hop already enumerates every hop a path element can express and intent_field_reference_step_target already walks them recursively from the enclosing type’s binding, so multi-hop path resolution, which R622 called its real remaining work, is a shipped derivation. What is missing is one arm: both hop-view arms join sql_referential_constraint, so a hop departing a function result yields no rows. A name-matched arm gated on the function-ness discriminator R704 captures serves three consumers that run three separate code paths today, two of them already copies of each other. Nothing is lost: R704 carries R622’s residual-path design work (ParentCorrelation.checkCarrierInvariant pairs a non-empty joinPath only with a hop-anchored correlation, while the carrier’s is the hop-less OnLiftedSlots, so a residual path needs a correlation arm anchoring on the captured record) and its inherited-as-decided constraints from the shipped carrier item (the two-statements rule at every hop count, post-commit hops running under the caller’s identity, and a multi-hop data field resolving null with empty errors being a documented success outcome rather than a defect). Re-open trigger: none; if R704 is descoped to the read side, the carrier path becomes a new item.

Discarded: @defaultOrder on a root routine chain is silently dropped (routine-chain-order-directive-silent-noop, R659): superseded wholesale by R704 (routine-composition-surface-from-facts) at the user’s direction, from Spec, before any implementation. R659 reported one axis of the @routine read surface and diagnosed the shape behind it precisely: four independent read-surface axes governed by one boolean predicate in RoutineDirectiveResolver.orderOrConditionDeferral, one four-way conjunction in QueryField.QueryTableField’s compact constructor, and one `List.of() literal per chain classifier, with nothing binding the three. It then declined to fix the class, recording the shared enforcement question as "nobody’s rider". Two findings made that split untenable. First, the census widened: the same hardcode also refuses @condition, @orderBy and @asConnection, and refuses the return type any spelling but a restated @table. Second, and decisive, R659’s premise that @orderBy and @condition are honest capability deferrals is false. The render layer is already generic over both: OrderingBlock.declareSortView is total over Ordering.Columns and Ordering.Helper, RootLauncherRenderer.conditionStatement already treats an absent WHERE as data, routineBody already composes a .where(...) from hop filters, and OperationMember.Condition.OnReturnTable carries a plain TableRef with no key requirement anywhere in the path. Nothing consults a primary key or a foreign key to build a WHERE or an ORDER BY, so all four axes are unwired slots rather than unbuilt capabilities, and they touch the same six sites. Shipping R659 alone would have written the constructor-pin restatement, the deferral message and the manual’s deferral sentence twice each, with the intermediate version published false. Nothing is lost: R704 carries R659’s field report, its breaking-change population analysis (every single-node root routine list in the wild, since a TVF result table has no primary key), the two author-facing messages that currently tell a routine author to add a primary key to a function result, the measured ordering-target study on PostgreSQL 16 (naming the routine column and the joined catalog column produce byte-identical plans, so ordering target is not a performance lever), the falsified-prose inventory, and the per-tier test plan. Inbound citations repointed in the same commit (R448, R660, R662’s depends-on, R663, R677). Re-open trigger: none; if R704 is descoped back to the architecture half, the read-surface unwiring becomes a new item rather than a resumption of this one.

R57 (6a7b22d the delivery, efd37f3 the second-pass rework; Spec → Ready on the fourth independent Spec review 804af44, In Review → Ready 813ce39, Ready → In Progress d453e67, In Review bab8626): an @nodeId(typeName: X) argument or filter input field whose containing table reaches X.table() through a foreign key targeting columns other than X’s key columns used to be rejected at classify time, deferred to output-side JOIN-with-projection emission. That dependency was false in direction: projection is the encode side (turn a parent key into a result column), this is the decode side (turn already-decoded keys into a predicate), and nothing about the decode side is unsupportable. The decoded key simply has no column on the field’s own table to compare against, so SQL visits the target table and compares its key there, which is a correlated `EXISTS over the FK, the exact BodyParam.RemoteColumnPredicate shape a joined plain @reference filter already emitted. EXISTS is also the semantically right shape rather than a convenient one: no row multiplication when the path is non-unique, and a NULL FK column fails the correlation instead of duplicating or dropping rows. The read path now emits it at both surfaces; the write and @lookupKey rails keep a deferral stated in their own words. The structural half is naming an axis that had three implicit spellings, all answering "which table does this carrier’s value predicate bind against": an empty-joinPath sentinel on ArgumentRef.ScalarArg.ColumnBackedArg, a Direct-vs-NodeIdDecodeKeys extraction test in FieldBuilder.remoteIfReferenceJoin, and a column slot whose referent depended on which case produced it. The extraction test encoded "`@nodeId` implies local", which the translated shape falsifies outright. All three collapse onto the sealed FilterBinding with arms Local(List<ColumnRef> ownTableColumns) and a payload-free Remote; it replaces liftedSourceColumns on both reference carriers and joins ColumnBackedArg beside its joinPath, so wrapIfRemote is the one discrimination and remoteIfReferenceJoin / translatedFkRejection are gone. Remote is payload-free because in both cases reaching it the terminal tuple already is the carrier’s columns(), so only Local carries a tuple columns() cannot supply; joinPath stays deliberately orthogonal, since a Local-bound FK-target with an authored @condition still needs the path for the FkTargetConditionFilter correlation. The invariants live on the carriers, not on the payload-free arm, which is the only place that can see the path: Remote requires a non-empty joinPath, and on ColumnBackedArg (where the local tuple restates columns()) the arities must agree. Retiring the accessor made javac name every reader, with one exception found by hand and worth recording as the general rule: MutationInputResolver.admitMutationInputFields dispatches on the carrier without reading any binding-sensitive slot, so it would have silently admitted a Remote carrier into INSERT until an emitter tripped over it. Four rails now gate with an exhaustive switch so a third arm breaks them all at compile time (INSERT, UpdateRowsWalker.classifyInto, DeleteRowsWalker.classifyInto, FieldBuilder.classifyPlainLookupKeyArg), and they share the message text minted by FilterBinding.remoteBindingUnsupported rather than one Rejection instance, because the walkers' channel is a Rejection.AuthorError sibling a Deferred cannot inhabit; write-side emitters read their columns through one Local-destructuring accessor that throws on Remote, so a bypassed gate fails loudly instead of emitting a wrong statement. Execution fixtures landed in the public schema as the spec decided, costing CREATE TABLE`s plus seed rows in `init.sql, two NodeIdFixtureGenerator.METADATA entries and SDL in the example module’s existing schema.graphqls, with no new Maven execution, jooqPackage or .graphqls: xlat_parent / xlat_child and the composite xlat_comp_parent / xlat_comp_child whose child FK targets a different composite unique constraint. Coverage is TranslatedFkTargetRailGatesPipelineTest (all four gates plus a direct-FK carrier that must still be admitted, asserting the shared text rather than four substrings), the two rewritten NodeIdPipelineTest cases now asserting the carrier shape and the one-hop predicate, the two carrier-invariant tests, and TranslatedFkTargetFilterExecutionTest (list and scalar argument forms, the input-field form, empty and omitted lists contributing no conjunct, a childless parent, the composite twin, malformed and wrong-type ids throwing). Independent-session In Review → Done review, two passes. The first pass passed the delivery against the contract and blocked on one introduced defect: the plain-@reference argument arm passed Remote unconditionally on a precondition it had not checked, and since @reference(path: []) is legal SDL and an argument site calls parsePath with a null target table, the empty path survived, the column resolved against the field’s own table, and the carrier’s own Remote-needs-a-path invariant threw out of classification: a regression from a working bare local Eq to an untyped crash. The invariant was right and the call site was wrong, so the arm now forks on path emptiness and binds Local, mirroring the input-field sibling in BuildContext.classifyInputField whose divergence was the tell; both surfaces are pinned in ReferenceFilterRemoteColumnPipelineTest beside the direct-FK-stays-local guard, so the matrix reads that the binding follows the path in both directions. Whether an inert element-less @reference should be rejected at all is one decision over both positions rather than a property of that arm, filed as R692. Second pass verified at trunk tip: full reactor green under mvn install -Plocal-db, 14/14 modules; reviewer rule confirmed by session trailer on both implementation commits; no code-string assertions on generated method bodies (the execution tier’s SQL_LOG token cross-checks are the sanctioned structural form the test-tier guide names, beside real row assertions); user-facing-doc check clean, the one docs/ change being the widened code-generation-triggers.adoc row; retirement sweep clean across all eleven declared terms, with the surviving encode-side JOIN-with-projection prose and liftedSourceColumns on DirectFk verified as the whitelisted hits the spec named. One sub-threshold note recorded rather than filed: the @lookupKey-is-meaningless rejection text now sits in two literal copies at FieldBuilder.java:1628 and :1645, the pattern remoteBindingUnsupported was minted to avoid one screen below. Deferred rather than folded in, each filed: write-target translation (the scalar-subquery SET / INSERT emission the four gates defer), multi-hop translated paths and condition-join hops, the encode-direction emitter (nodeidreferencefield-join-projection-form), and the manual page whose single-direct-FK no-JOIN claim this item made visibly wrong (R691).

R661 (d048054 implementation; Ready → In Progress c487906, In Progress → In Review a193eeb): the discriminated table interface child batches through a DataLoader, closing the one member of the interface family that never batched. Delivery is leaf identity on cardinality, the multi-table sibling’s rule rather than a marker: list cardinality mints ChildField.BatchedTableInterfaceField (in the TableTargetField seal, implementing BatchKeyField and declining ParentRowDemand because the batched arm of ProjectionCommands.tableTargetContribution precedes the demand arm and both answer the same column list), single cardinality keeps the per-parent TableInterfaceField. The sibling’s table-bound-participant conjunct has no analogue and is stated as structural rather than restated as a guard: TypeBuilder.buildParticipantList’s discriminated arm rejects a non-table implementor, and the invariant is `TableBacked rather than TableBound, since a joined-table discriminated interface populates JoinedTableBound exclusively and porting the sibling’s anyMatch verbatim would have left that shape unbatched; GraphitronType.TableInterfaceType’s javadoc, which claimed the opposite, is corrected at the same name. The batch key is the plain batched child’s, the single FK hop’s source side through `deriveSplitQuerySource, so a composite FK keys and correlates on every slot and the polymorphic pair’s empty-PK rejection has no analogue. @splitQuery becomes redundant rather than honoured or rejected (the re-projection is always its own statement, so the directive’s meaning is satisfied before it is applied, and what an author reaching for it wants is now the default): a new splitquery-redundant-on-discriminated-interface-child lint rule with the computable delete fix, emitted through a warnIfSplitQueryRedundant generalisation that puts both redundancy warners on the gathered marker relation instead of a second directive probe. On the emit side composition rather than duplication: LaunchSource.DiscriminatedCorrelatedChain is a third Correlated arm carrying the DiscriminatedTable payload whole beside the chain topology, which is sound because the two halves are orthogonal (the batch grain never reaches the select list, the discriminator restriction never reaches the topology), and projection() moved off Correlated onto a new Correlated.Projected sub-seal so the member stays total where it is declared; BatchedRowsFragments.discriminatedBody binds the shared prelude, parent-input attach and WHERE fold to DiscriminatedTableFragments.projection plus a newly extracted joinedDetailJoins. No alwaysProject column list is threaded after all, the spec’s expectation: the scatter groups by the parent-input __idx__, never by a projected child column. Both delivery-computing sites gained the arm, the compile-forced leaf crosswalk and DeliveryFactRelation.mint, where the new arm precedes the marker reads so the redundant marker cannot claim the trigger at either cardinality; singleTableBackedVerdict’s `false case stands with its rationale rewritten. Two hazards settled by hand that no gate would have caught: the loader registration routes through TenantDslEmitter.loaderNameDeclaration, because a batch loader resolves one DSLContext from the environment captured at loader creation and a tenant-mixed batch would serve one tenant’s rows to another; and cross-table hop Java locals gained a prefix the alias scheme cannot produce, a latent uncompilable-output bug the batched host exposed whenever a hop target and the discriminated base share a first letter (the projected SQL aliases are untouched). Coverage across every tier the claim is visible at: the cardinality fork and its key derivation at the pipeline tier, the mediaList verdict tuple in the table-interface corpus example, the correlation-key arm, the redundancy warning at both cardinalities, the emitted tenant loader-name expression, the launcher census’s own coordinate, three coordinates in DeliveryFactPinTest (plain list plus both @splitQuery-marked cardinalities, which is what turns the pin into a gate over the marker arms), a whole-statement SQL baseline, and the execution-tier statement count with a cross-table participant field proving the aliases survive the loader scatter. splitQuery.adoc gains the author-facing bullet on the redundant side of the line that page already draws, and supported-schema-shapes.adoc regenerated. Independent-session In Review → Done review, one pass, approved clean: full reactor green under mvn install -Plocal-db, retirement sweep clean across all declared sites, all three of the item’s open questions answered in code and javadoc rather than left implicit. The reviewer’s non-blocking notes went to Backlog rather than holding the gate. Unblocks R650 (root-connection-over-discriminated-interface), whose body was updated in the same commit with the two forks this item settled and the hasConnectionSplitField gate its connection half now has to widen.

Discarded: Decompose TypeFetcherGenerator (decompose-typefetchergenerator, R7): superseded by R682 (planners-read-facts-emitters-read-commands) at the user’s direction, before any implementation. The item was a planning question, which axis the 6,000-line file is actually long along, with decomposing along the field taxonomy into per-variant emitter classes as its leading option and a layout javadoc as the fallback. R682’s emitter half dissolves the question rather than answering it: the file does not get decomposed along the leaves, it empties into render as the emitter families migrate onto command relations, and R682’s census puts the fetcher family (this file plus FetcherEmitter) at 120 of the 129 leaf-dispatch sites the generators-side ratchets count, so the emptying covers what the decomposition would have reorganised. R682’s body already declared the supersession and scheduled this discard for its Ready transition; the discard landed alongside its Spec instead, at the user’s direction, so no session picks the item up in the gap. The 2026-08-17 staleness audit’s R7 row (refresh the hypothetical emitter names in the option list) is superseded by the same motion. Nothing else is lost: the layout-javadoc fallback lives on as source-orientation-javadocs.md’s partial-mitigation option, and the R6 `FieldBuilder precedent it cited is already in the changelog. Re-open trigger: none; the file’s shape is R682’s scope, and a future navigation-only complaint against a file R682 has emptied would be a new item, not a resumption of this one.

Discarded: The emit plan is built from the store, not from the leaf model (emit-plan-reads-the-store, R667): absorbed into R682 (planners-read-facts-emitters-read-commands) at the user’s direction, the same day it was repointed and before any implementation, on the reasoning that the architecture is easier to do properly in one item. The two were filed apart on the premise that the planner half was blocked on a fact population that did not exist yet while the emitter half was not; measuring the DDL dissolved that premise. The expensive population had landed (the per-coordinate classification stratum, which the language server already reads arm by arm), and what remained was four relation-shaped folds with no home (operation members, connection synthesis, tenant bindings, delivery), none of which needs a new rule. Both halves became sequencing problems rather than modelling problems, and sequencing them against each other is the question neither item could answer alone: converting all six relations before any emitter moves leaves emitters reading leaves for the whole programme, while converting emitters first mints command relations from leaves the planner half then re-sources. Nothing in the item is lost. R682 carries its body substantially whole: the measured thirteen-accessor read surface, the six-relation dependency order with the per-relation-increment argument, the three store populations, all four risks, the retired vocabulary and the coverage obligations, plus its declared dependency on R666 (delivery-verdict-derives-from-the-store), inherited verbatim. Its "out of scope" entry for renderers, which named a renderer reading the model directly as a finding to file rather than to fix, is what produced R682 in the first place and is now in scope there. One thing did not survive, and it predates this absorption: R678 (capture-expands-facet-synthesis) was absorbed into R667 under its former slug (capture-precedes-the-classification-walk) as "deliverable 3", and the repoint onto the emit plan dropped that deliverable without recording it, so that entry’s "Nothing is lost: R667 carries the template" has been false since 456ee94. The question is re-filed as R683 rather than carried into R682, because its motivating reason (a store-reading classifier that cannot mint facet types) lapsed with the same repoint and needs re-deciding rather than re-inheriting. Re-open trigger: none; the plan’s conversion is R682’s scope.

R617 (0bf512d root-only scoping, 33218aa rejection attribution and code-string removal; the four earlier implementation SHAs recorded in the item body no longer resolve after a history rewrite): a root lookup returns one slot per input key, holding null where the key matched no row. The manual had documented that positional contract for as long as both had shipped while the generator inner-joined the VALUES table and let a missed key contribute no element, so filmById(film_id: ["1", "999999", "2"]) answered two films rather than three positions; the user settled it in the documented direction, so the emit is what changed. RootLauncherRenderer.lookupBody’s list arm projects the derived table’s `idx as __idx__ and scatters through a new scatterLookupByIdx helper, which is also what carries input order, so the arm emits no ORDER BY, and the launcher’s value type becomes List<Record> because a jOOQ Result cannot hold a null element; two rows landing on one key keeps the first rather than throwing as scatterSingleByIdx does, since a lookup joins on author-declared columns the schema never required to be unique. The contract forces the schema’s hand: [Film!]! cannot carry a miss, GraphQL propagating the null out of the list so one unmatched key would discard every matched row, so GraphitronSchemaValidator.validateRootLookup gains a nullable-element rejection and every existing root lookup declaring non-null elements has to drop the inner !. Root-only throughout: a child @lookupKey coordinate narrows each parent’s list, keeps .orderBy(input.field("idx")), contributes no element for a miss, and correctly keeps [Actor!]!. Coverage: ScatterLookupByIdxTest drives the emitted helper reflectively, including the first-wins tie-break PostgreSQL cannot observe on uniquely-keyed fixtures; the lookup SQL baseline pins the __idx__ projection and the absent ORDER BY; execution pins that languageByKey(language_id: [2, 1, 2, 99, 1]) answers 2, 1, 2, null, 1 and that five repeats of one id answer five times. Four independent Done gates, three of them holding on the manual rather than the emit, which reviewed clean from the first: positional claims stated as measured behaviour, then the NodeId section, then two claims quantified over every @lookupKey shape while describing only the root arm, then the @asConnection sentence attributing one arm’s error message to both. The third gate also removed three code-string body assertions the item had added to RootLauncherRendererTest, each redundant against a sanctioned-tier twin. Spun out rather than folded in: R669 (that file’s remaining pre-existing code-string assertions), R670 (a root @lookupKey plus @asConnection reports a @table error the author cannot act on, and the validator’s connection branch is dead from real SDL), R679 (the child rejection message justifies itself with the root’s positional contract).

Discarded: Capture expands @asFacet the way it already expands @asConnection (capture-expands-facet-synthesis, R678): absorbed into R667 (capture-precedes-the-classification-walk) at the user’s direction, within the session that filed it and before any implementation. Filed as a strict dependency of R667 on the reasoning that a classified-model builder holding no GraphQLSchema cannot mint the facet types only a schema rebuild produces, so capture has to expand them first. The reasoning stands and is now deliverable 3 of R667; what did not stand was the partition. The expansion has no independent success criterion and no independent consumer: a facet expansion nobody reads is another shipped-but-unread relation, and the only thing that demonstrates it is correct is R667’s next deliverable classifying a faceted schema with no schema in reach. Separating it would have doubled the workflow gates (two Spec reviews, two Done reviews, each requiring a different session) around a step that cannot be verified alone. Nothing is lost: R667 carries the template (MacroCapture.expandConnections, its carriers-minted-after-the-walk shape and graphitron_type_declaration_synthesis provenance), the twin to pin against (ConnectionPromoter’s facet arm) and its retirement, and the exit criterion (the named facet subtraction leaves `DemandShadowTest’s reach equality). The contrasting case is R667’s other excluded neighbour, the authored-claim gate flip, which stays a separate item precisely because it does have its own criterion, written on `ClaimDomain, and unblocks on a schedule R667 does not control. Re-open trigger: none; the facet expansion is R667’s scope.

R639 (5b021e9..935c964 implementation; rework f04b1f2/2320aa4; held at the gate f65cd3f): session identity is a Java method resolved at build time, not generated SQL. <sessionState> stops naming database routines as strings for graphitron to assemble a { call fn(?) } around; <mount>fqcn#method</mount> plus an optional <unmount> name public static methods reflected through ServiceCatalog at build time and called directly, the contract being a signature (exactly one seam parameter typed org.jooq.Configuration or java.sql.Connection anywhere in the list, the rest is payload, the return type is the handle), which jOOQ’s own generated Routines executing methods satisfy as-is, so the headline path is zero hand-written Java and the seam rule doubles as the overload selector against jOOQ’s Field-expression siblings. Deleted rather than carried: the <variables> Postgres sugar and with it the runtime’s non-Postgres dialect guard and the session-state-convention-fence lint rule (a build cannot grade a reflected method’s position on the integrity gradient, so the gradient moves to docs/security.adoc where it is explained instead of asserted); <handle> (the return type states it); <stateSurvivesTransactions> and the whole per-settle re-fire, because acquire asserts autocommit before the mount, so the mount is its own committed transaction and no later settle can revert it, which also takes GraphitronTransactionProvider’s `priorAutoCommit field and second constructor; the generated SessionHook interface, its no-op, the runtime’s hook field and RuntimeHookProjection, replaced by one final class with static mount/unmount and nothing at all emitted under the unconfigured arm. Mount payload parameters are ordinary contextArguments (one name-keyed factory slot each, a fact shared with a @service site entering once, type disagreement caught by the classifier’s existing TypeConflict), reversing an earlier disjoint-namespace decision; CLAIMS_KEY goes with it. Two structural moves carry the rest: acquisition is lazy on every path through one unified per-key carrier (ConcurrentHashMap keyed by Optional<tenantKey>, single-tenant as the one-key case, the whole (connection, dsl, handle) entry minted inside one computeIfAbsent), which is what reduces a pinned connection to exactly one transaction provider (two of them over one connection would commit an enclosing transaction at an inner boundary) and what gives the handle a per-tenant Configuration to ride; and the runtime’s source SPI takes a DataSource/SQLDialect/Settings triple per entry, so consumer jOOQ settings finally reach both the fetchers' SQL and the consumer’s own mount call. The handle reaches service code as the $session argMapping sigil (absorbing the former R640 and dissolving its four forks: ordering, staleness, fan-out scope and opt-in surface), owned by ArgMappingSigil which both the build-side parse and fact capture route through, landing in a sibling graphitron_service_arg_mapping_sigil relation rather than quarantining as undecoded overflow; a $session-binding field under a tenant context classifies Inherited so it reads its own tenant’s handle. Five new ReflectionError permits with their typed-rejection.adoc paragraphs; the provenance family collapses to store_graph_session_mount/store_graph_session_unmount with the foreign key making "unmount without mount" structural. Coverage: SessionHookImplGeneratorTest and TenantConnectionsGeneratorTest compile the real emitted TypeSpec`s and drive them (no generated-body string assertions introduced); execution-tier `SessionHookExecutionTest proves the direct-Routines and facade shapes indistinguishable at the database, RLS scoping across a mutation’s commit and rollback on an autoCommit=false DataSource, wholesale overwrite, fail-closed throwing mount, and the contextArgument unification end to end; TenantFanOutExecutionTest proves two tenants read two distinct handles in one operation. Independent-session In Review → Ready → In Review → Done review; both passes green under mvn install -Plocal-db. The first pass held on one blocker: the item specified a located runtime throw for a $session read on an escape-hatch operation, and what shipped was an unguarded cast binding null into a service parameter meant to carry mounted identity. The rework routes every $session read through a generated TenantConnections.sessionHandle(dsl, fieldCoordinate) accessor that throws naming the coordinate, the sigil and the owned entry points, with the pipeline, compiled, emitter-unit and execution rows the first pass lacked. Three review side-items landed with it: R469’s body repointed off the deleted re-fire, the staged-builder trade-off filed as R664, and the jvm_method_parameter census debt plus the $session completions follow-up named in their LSP items. Absorbs R640; feeds R468.

Discarded: Support @asConnection on a child field returning a single-table discriminated interface (child-connection-over-discriminated-interface, R651): absorbed into R650 (root-connection-over-discriminated-interface) at the user’s direction, four hours after filing and before any implementation, when R650’s Spec review reopened over the route question. The two were split on the premise that the root was a contained emission fix while the child’s delivery story was unsettled. The review dissolved that premise: the root plan proposed keeping the participant cross-table @reference join inside the paginating statement behind a new build-time cardinality invariant, and this item’s own decisive argument against its cheap route, that a per-parent paginated child would be strictly more permissive than the plain child on the same authoring surface for no principled reason, applies verbatim to the root. Both coordinates now turn on the same question, whether the paginating statement is a split query, and specifying them apart would answer it twice. Nothing is lost: R650 carries the child leaf’s delivery facts (ChildField.TableInterfaceField, TypeFetcherGenerator.buildTableInterfaceFieldFetcher, N+1 by construction with no DataLoader), both routes with the rejection argument, the unpinned child deferral in its retired vocabulary, and the seam question as open rather than settled, since the projection / joinedStep split was designed for the rejected route. This item’s third open question, that the interface arm never reads forcesSplitDelivery so @splitQuery is silently swallowed, was filed separately as R661 rather than absorbed, because it is a bug whether or not the connection work proceeds; R650 depends on it. Re-open trigger: none; the child coordinate is R650’s scope.

Discarded: The rewrite’s architectural history as an explanation page (road-to-the-relational-core, R634): filed and shipped the same day, outside the workflow, at the user’s explicit direction that this was not a regular task. The page exists at docs/history/road-to-the-relational-core.adoc, alongside a new docs/history/ section index; the item’s remaining written content was its own gate. Two things it left open were settled in the writing rather than at Spec. Work is cited by roadmap id inline, with no links to per-item files, because those are deleted on ship while roadmap/changelog.md keeps the ids; and the page defers to the present-tense pages under docs/architecture/ and to the model DDL, stating that where they disagree it loses. The history it records was reconstructed from 354 changelog entries, 603 item files and the 14 dated audits, and its March chapter from 95 pre-squash commits recovered from unreachable objects and published as the graphitron-rewrite-history branch, which is the only copy of that history in existence. Re-open trigger: none as an item; further history pages go under docs/history/ as ordinary docs work.

R629 (fe5f35b implementation; Spec → Ready 3499425, Ready → In Progress 368343c): mountable GraphQL-over-HTTP delegates with an explicit operation policy. graphitron-jakarta-rest’s endpoint surface splits out of `GraphqlResource into two public @ApplicationScoped delegates a consumer resource can mount at any path, template parameters included: GraphqlHttpHandler carries the whole decode/decide/execute/encode pipeline with every Jakarta REST input passed as a parameter rather than injected, and GraphiqlBundle carries the self-hosted page and its assets (the {{ASSET_BASE}} rewrite now resolving against whatever path served the page). The GET-mutation guard generalises into OperationPolicy, a final class with three validating factories (queriesOnly(status), queriesOnly(status, message), allowing(Set, status, message)) publishing only permits; the specification’s queries-only-with-405 rule for GET is one more instance of the same type, so there is a single enforcement path and no way for a consumer to weaken conformance. Three design properties carry the boundary structurally rather than by javadoc warning: there is no permissive policy value and no public pre-parsed entry point, so absence of the argument is the unrestricted state and the pre-parse stays conditional (an unrestricted POST still gets graphql-java’s InvalidSyntax result, not the pipeline’s parse-failure wording); GET is routed with the package-private SPEC_GET and the nullable-guard execute is private, so no routable verb can run with no rule attached; and a policy rejection is not legacy-downgraded, being an HTTP-level rule rather than a GraphQL request error. GraphqlResource is now five annotated methods over the two delegates plus a throwing requireBuiltInEndpoint() gate (throwing because schema() returns String, so no published return type widens for the gate’s sake), backed by a new defaulted SPI toggle GraphitronApplication.builtInEndpointEnabled() for consumers that mount their own path and must not leave the ungated one serving; its javadoc is honest that this is a 404 gate on a still-registered route, not a de-registration. The re-exported GraphqlResource.GRAPHQL_RESPONSE_JSON stays a constant expression (verified in the class file), so consumer @Produces annotations naming it keep compiling. Coverage splits by tier rather than habit: unit-tier OperationGuardTest (12 cases, no container) pins the guard as a decision table over resolveOperation × permits, including the operationName smuggling case in both directions, both unresolvable-fall-through cases, the defensive set copy and all four factory validations; execution-tier MountedEndpointTest (12 cases, over a /env/{callingEnvironment}/graphql fixture shaped like the javadoc example) keeps only what a container shows, the policy on the wire with its status/media-type/message, the same mutation executing on the mount that passes no policy, 405 on GET from both mounts, the legacy non-downgrade, the templated asset base and SDL, request-scope ordering across the delegation, a NotAuthorizedException passthrough, and all five built-in routes answering 404 with the toggle off; OverlappingMountTest (3 cases, neutral /probe pair, no profile and no second boot) pins Jakarta REST’s literal-character root-resource sort that makes a templated mount shadow the built-in sub-paths. The single most load-bearing addition is GraphQLOverHttpConformanceTest.unparseableDocumentIsTheEnginesInvalidSyntaxResult, the only assertion in the tree that can see an unconditional pre-parse: without it an implementer could change the response body of every existing consumer and no test would fail. No existing expectation was edited; the smoke test is untouched. Docs reconciled across every surface the split invalidated (modules.adoc, the example README’s app and testing sections, beans.xml’s comment, `GraphqlRequest’s javadoc pointer, the `graphiql.html head comment, both tools/graphiql-build/README.md occurrences). Independent-session In Review → Done review; full reactor green under mvn install -Plocal-db (0 failures). The review’s retirement sweep found one first-pass survivor the implementer’s list missed, R423’s body still naming the retired GraphqlResource.execute(), repointed at GraphqlHttpHandler in the approval commit; below the recurrence bar for `RetiredVocabularyGuardTest’s registry.

R589 (b97b1cb umbrella amendment, 882c037 claim views + conflict detection, fac7704 column-match witness view, 15d44b8 demand/exemption shadow rows, beafe4a carrier split + funnel mints, d20e9cc Conflicted projection, d5cec11 + 3f53bab + 7aefee2 review fixes): classification is a relation; validation adds facts. The intent_ derived stratum arrives: intent_authored_field_claim / intent_authored_type_claim union one arm per claiming graphitron_ relation (position masks in the arms, presence fallbacks where a decode can decline), and AuthoredClaimConflicts, the store’s first reader, replaces the four walk-side conflict sites (reduceDirectiveConflict’s two detector lists, the ad hoc `@service`@mutation+` check, TypeBuilder’s `@table`@error+` check) with one grouping detection per grain; a conflicted coordinate stops tombstoning and keeps its arm-order classification while the violation mints into diagnostics. intent_column_match_claim proves the inferred-claim witness model in shadow; the demand and exemption rules land as rows (intent_*_demand* / intent_*_exemption*, ReachabilityRows materializing the type domain at capture cadence) with corpus agreement against the legacy registry. InputField.ConditionOwnedField splits out of UnboundField (which becomes the genuine-miss carrier, attemptedColumnName non-null), the malformed @condition(override: false) shape mints at the classification funnel keyed by definition and resolving table (closing R221, subsumed, its file deleted with this entry), and the cascade verdict mints use-keyed with the occurrence path (intent_input_occurrence_path* in shadow). FieldClassification.Unclassified splits into Unresolvable and Conflicted(claims, violation): a broken DELETE mutation reads as a DELETE with its intended table on the LSP/MCP surfaces, sourced from decoded slot facts (UnclassifiedField.definition() deleted, containment now structural), with Conflicted edge-bearing through TableClaiming. Accept/reject is unchanged throughout; retired: PairVerdict / pairVerdict / reduceDirectiveConflict, the per-position detector sites, the three-cases-in-one UnboundField reading.

R613 (19dec9a capability, be7c128 docs): generated column filters compose beside the lookup VALUES join. The validate-time deferral was stale rather than a design position, so the whole capability is two deletions and no emitter change: ConditionCommands.requireNoGeneratedFilterOnLookup with the lookup boolean that existed only to reach it, and the lookup arm of GraphitronSchemaValidator.validateConditionEmitImplemented (the method survives for the single-table interface child deferral, a genuine emit gap). The same era’s cardinality co-read went with it: validateRootLookup had been OR-ing LookupMapping.ColumnMapping.hasListArg() with any generated filter body param’s list-ness, which since keys are excluded from that filter upstream could only read a non-key argument, and would have become an active false rejection the moment the guard stopped making the co-presence unreachable. The mapping is now the single source of the key-cardinality fact. RootLookupValidationTest’s three deferral rows became the full twelve-cell cube over key list-ness x return list-ness x non-key-filter list-ness; two cells are exactly where the co-read used to flip the verdict. Three additive sibling sakila fixtures pin the three emitters at the execution tier (languagesByKeyGenerated` root with a whole-statement baseline, Film.actorsGenerated inline multiset, Film.actorsBySplitLookupGenerated batched loader, the latter two asserting the rendered predicate and row content since they mint runtime-prefixed aliases), and ConditionCommandsPipelineTest pins the key-not-restated fact at the model. Docs: lookupKey.adoc gains the positive statement plus the empty-key-list and filtered-key facts a migrating consumer needs, and the coordinate-scoped "`@lookupKey` is exempt from the implicit-predicate path" phrasing narrowed to the argument at all three sites. The measurement that the manual asserted a positional contract the generator did not implement was split out as R617 rather than absorbed, and the doc claim about @lookupKey on an individual input field as R614.

R603 (79b60a2 core, gate rework 76ac937; re-baseline onto the shipped R610 store d0dec98, Ready d157d0d, In Progress 51b2fc0, In Review 6450d93, gate rework requested 79d05b5, rework In Review eb6a328): The fact store gains its sixth family and its first post-capture oracle writer. javac_diagnostic transcribes a dev-loop compile round in javax.tools.Diagnostic’s own vocabulary, which is the point of the naming: the Backlog framing asked where run-output facts could live given that neither the transcription families nor the reserved `intent_ stratum seemed able to hold them, and the landed doctrine dissolves the question rather than answering it. A compile diagnostic is a transcription like any sql_ or jvm_ row; what distinguishes it is not the kind of row but when its writer can run. So there is no output_ umbrella prefix (a role name is exactly what the naming rule rejects), each post-capture oracle gets its own vocabulary-named family, and the DDL header states cadence as its own axis orthogonal to prefix-picking: a family whose writer runs after capture has its own writer on that writer’s cadence, and capture clears the run’s own graph partition of it before regenerating, because the rows describe an emitted tree the run is about to replace. graph_name leads the natural key (file, line, column, ordinal) with a structural FK to store_graph, inheriting R610’s dimension by definition and passing FactSchemaGateTest’s exemption-polarity gate with no case to make; `kind stays an open column because a CHECK enumerating javac’s enum would be a hand-maintained copy of an externally owned taxonomy, code is the typed dimension a display list never had, and the two key columns transcribe absence as javac’s own sentinels (NOPOS’s `-1, the "(no source)" placeholder) rather than NULL, a primary-key column admitting none, with the departure from the NULL-uniform absence discipline argued in the comment rather than drifted into. CompileDiagnostic reshaped while open: severity renamed to kind (it always held Diagnostic.Kind.name()), a nullable code component added, and from normalises the file through the single canonical-URI site at the javac boundary, so console, workspace and store agree on one spelling by construction instead of each sink normalising or not. The ERROR predicate collapsed onto the record’s own severity() projection, read by CompileRound.errors() and the MCP diagnostics tool alike. CompileFacts is the writer, homed with the round’s producer rather than at the workspace layer because the producer owning its transcription is what makes "one flattening, three sinks" true: it takes the dev session’s live store handle (DevMojo opens one at startup and closes it in cleanup, the contract this item fixed so it and R569 could not land incompatible halves) because for this family the store is a delivery channel, not a cache, and a round written where the reader cannot see it is a round the diagnostics surface answers wrongly about. One transaction per round stands in for a completeness stamp; every statement carries the graph predicate, since in R610’s shared store an unscoped delete is one dev session erasing a sibling module’s diagnostics. StoreRefresh needed no code at all, and the reversal is on the record: R610’s spec framed ownership-scoped refresh as taught-per-relation, but its implementation landed the graph half derivationally, so a relation carrying GRAPH_NAME is ownership-scope-cleared by construction. The agreement driver gained an ORACLE arm for relations a post-capture oracle owns, where no independent second walk can re-derive the verdict without re-running javac; its two anchors are deliberately non-vacuous, a two-graph lifecycle anchor (seeded, so "cleared" is distinguishable from "never written", under two graphs, so "cleared what it owns" is distinguishable from "cleared everything") and a write-read content anchor at the oracle’s cadence. Independent-session In Review → Done review, two cycles. The first pass found the delivery otherwise strong and held on two findings. The Diagnostic.Kind partition test could not fail: against the shipped ternary’s catch-all, both of its assertions are tautologies for any enum constant (enum-name uniqueness making the second one true for every present or future kind), so a new Kind would project to "warning" with the suite still green, while two shipped javadocs asserted that a new kind "fails a build instead of falling through silently": prose claiming the second of the three honest forms in development-principles.adoc § "Documentation names only live tests/code" when the named test did not carry the claim. Separately, CompileFacts.java had raw NUL bytes typed into the ordinal key’s separator char literals, so git classified the item’s central new class as binary: it rendered as "Binary files differ" in its own landing diff and grep degraded to a filename match, blinding every future diff-based review of it. The rework added the golden-set pin on Kind.values() beside the existing loop with a message directing whoever trips it to classify the new kind before widening the pin, and spelled the separator '\0'. Two non-blocking notes were also taken: the minted store_graph anchor’s last_captured now carries a comment saying why the write time is the honest value where no capture ran, and the writer’s javadoc narrows its failure promise to the DataAccessException wrapper it actually catches, stating that anything else is a bug it deliberately does not swallow. Second pass verified both closures at trunk tip rather than on report: full reactor green under mvn install -Plocal-db (14/14 modules), the file confirmed NUL-free and ASCII in the committed blob, and the new pin driven to failure by narrowing the golden set, which produced exactly the intended message. Deliberately deferred with their first consumers: the emitted-file inventory and every other output oracle (execution results, test outcomes). Because this item landed before R569, that item’s compile bridge table is never built; its spec already adopts the fork where the diagnostic view’s compile arm reads javac_diagnostic from day one, and decides there how the arm handles the graph column. R430’s body took the one-line correction that its input is now a URI.

R610 (b534810 core, gate rework e344cac; Spec 280e34e after nine revision passes, Ready bc3cdaa, In Progress 945cadc, In Review 652e105, gate rework requested ab51049, rework In Review e6d7fd4): graph_name VARCHAR NOT NULL leads the primary key of every graphql_/graphitron_ base relation (83 of them), so one fact store can hold several graphs without fusing them. The motivation is federation, where User in two subgraphs is deliberately two different types and today’s type-name-only keys would first-wins-merge them into a fictional type or a constraint violation, breaking the split that makes every primary-key violation a capture bug rather than an author error. The dimension ships with its first mechanism rather than ahead of one: the persisted store leaves target/ for the platform’s per-user cache with a per-workspace segment, so a second module of the same workspace puts its graph in the same file the moment it builds. New store_graph anchors the partition (base_dir, build identity, last_captured), the seven parentless family roots take a direct FK to it and everything else reaches it through its existing parent chain, and the graph’s SDL recipe is remembered beside it (store_graph_schema_input / store_graph_schema_extension) so a currency check can re-expand a cold graph’s globs and re-hash its files without building the owning module. jvm_ and sql_ stay graph-free but stop being store-global, leading with their source instead, so two modules' classpaths and catalogs coexist rather than the second build clobbering the first. Capture is graph-scoped through the sink, which stamps the column and namespaces the claim keys so no SDL call site changed; that is the load-bearing half, since claim mirrors every natural key by hand and widening the database keys alone would have relocated the fusion one layer up. Refresh became ownership-scoped: the graph’s own partition clears by graph_name, an owned stale classpath source clears by source, and a source no run named is never examined, because a jar absent from this module’s classpath may be another graph’s live dependency. The store opens in H2 mixed mode so parallel reactor modules attach instead of being handed a cold fallback, which forced three reversals argued on the record: openReadOnly and its copy-to-temp snapshot deleted rather than converted (H2 refuses AUTO_SERVER with ACCESS_MODE_DATA=r), the in-use classifier deleted with it, and a shared store never discarded ; any failure to open or attach falls back to the in-memory store and leaves the file alone, made safe by moving the DDL-hash-and-version stamp into the directory name so an upgrade opens a different file instead of one nobody can use and no run will replace. location() reports where a store landed, which is the only way a test can address a path it cannot name. Consumer surface: <graphName> defaulting to ${project.artifactId} and <storeDirectory> with a graphitron.store.directory property, both documented in mojo-configuration.adoc, plus the workspace resolver that chains siblingModuleBasedirs’ existing one-step aggregator walk to the outermost root (the filesystem aggregator chain, since `MavenSession’s top-level project answers "where was `mvn invoked" and the parent chain is a different graph than the aggregator chain). Three gates joined FactSchemaGateTest, the first two in exemption polarity so a new family is covered by default: leading-key partition dimension, an FK closure from every graph-keyed relation to store_graph, and the two-graph fusion test the motivation promises. Independent-session In Review → Done review, two cycles. The first pass found the delivery otherwise strong and held on two blocking defects, one of which hid the other. The recorded departure sql_referential_constraint.referenced_source_name declares a foreign key that can cross package partitions, while CatalogFactCapture cleared each package’s sql_ partition interleaved with the per-table walk, so a warm refresh over a multi-package catalog deleted one package’s constraints while a not-yet-cleared sibling’s referential rows still pointed at them; measured at the gate against the multischemafixture catalog, not inferred. It had gone unnoticed because FactCapture.run caught DataAccessException and recaptured in memory at debug level, and its javadoc’s claim that this "reproduces a genuine capture bug" does not hold for a warm-only bug whose retry runs cold ; the observable effect being that such a consumer takes the cold path forever while the shared file keeps the first run’s rows, silently. The rework clears every owned package’s referential rows before any owned package’s constraints, over the whole set rather than one package at a time, and retries a failed warm capture once before demoting, logging a deterministic failure at warn with the exception. A retirement-sweep survivor (RewriteContext.withStoreDirectory, whose javadoc still placed the store in the build directory and which had no callers) was deleted, and four smaller gate notes were taken: two self-satisfying assertions in the new gates (store_source/store_stamp compared to themselves, and an FK closure counting graph-free edges), SchemaRecipe.buildFile normalized in its compact constructor to match its own javadoc, and the departures that had shipped documented only in a commit message folded into the item body. Second pass verified each closure at trunk tip rather than on report: full reactor green under mvn install -Plocal-db (14/14 modules), the new WarmStartRefreshTest case drives FactCapture.capture directly so the retry cannot mask a regression and asserts the cross-package row survives, the retirement sweep is clean, and the reactor build writes exactly one workspace segment into ~/.cache/graphitron/model/ with the plugin’s invoker ITs and mojo unit tier pinned under target/. Deliberately deferred with their first readers: store_graph_source membership for the jvm_/sql_ side, eviction (this item writes the last_captured / last_seen stamps it will need), and the freshness check’s driver. R589 and R603 inherit the dimension by definition, and R612 adopts the recipe relations in place without a rekey.

R473 (b48b0f8 + 7eb474f, gate rework dd77f66; Spec 11de611 after six revision passes, In Progress 86b4db2, In Review 0087b5b, gate rework requested 6fc2ca1, back to In Review 177e269): An ID-typed field could still acquire node semantics implicitly, with the identity read from table facts (__NODE_TYPE_ID / __NODE_KEY_COLUMNS) rather than from what the author declared, at four coordinates. While that was true the schema did not say what an ID meant, an author could not tell the two readings apart by looking, and BuildContext.resolveDecodeHelperForTable had no safe deletion point. The grammar makes the implicit reading available in exactly two places where it cannot be ambiguous: Node.id on a node type is that node’s identity by construction (already shipped as R580’s carrier, and typeName: is now rejected there as either a restatement or a contradiction), and an argument or input field named for its target’s Node.id is that node id ; the name carries it, and the node comes from the target rather than from a metadata read at the use site. Bare @nodeId generalised to every coordinate as the middle tier ("node id, target inherited"), which the shipped @nodeId documentation already promised and which @node being on OBJECT makes forced rather than convenient; that generalisation dropped the fixture migration from ~25 sites to zero. The argument coordinate resolves through NodeIndex.forName off the unwrapped element type; the input coordinate holds no type name to discard (InputFieldResolver.resolve threads the input type’s own name, and a mutation input has no node type in its SDL at all) so it resolves through NodeIndex.forTable, singleton or a rejection naming typeName:. One shadowing rule at all three coordinates: a directive-less node-id reading colliding with a real column of that name is an error, not a warning and not a contest either reading wins, and it is literally one method (BuildContext.rejectShadowedNodeId, which R580’s shipped output-side rejection delegates to) because divergent wording would be the first step towards divergent semantics. Deleted: all three synthesis arms, resolveDecodeHelperForTable, buildInputNodeIdReference, findGraphQLTypeForTable, findGraphQLTypesForTable and the typeNamesByTableKey index behind it, both shim loggers, CallSiteExtraction.NodeIdDecodeKeys.SkipMismatchedElement with LookupRows’s effective-row machinery, and two shim-intent test classes; `resolveDecodeHelperForType collapses to the forName lookup and returns an Optional. Two departures from the plan that read better than it: the rejections landed classifier-side rather than in GraphitronSchemaValidator (the classified model exposes no schemaType() at those coordinates, and UnclassifiedField already carries the source location the LSP reads, pinned by a test), and rule 6’s key columns come off the classified NodeType rather than the table’s raw metadata, so SDL keeps winning on typeId and key order. Two fixtures turned out to carry @node without implements Node and had never been NodeType`s at all; the retired typeId-suffix fallback had been masking the malformed declarations. sakila needed no migration, exactly as planned: `filmActorByNodeId(id: [ID!]!) is covered by the name-carried reading and its GraphQLQueryTest round-trip stays green. Consumer exposure is two silent narrowings on coordinates preceding column resolution; the user re-confirmed on 2026-08-09 that sis is the only touched subgraph and is migrating it themselves, so neither needed WARN staging. Absorbed the argument arm from R273 and dissolved R27 (see its discard entry above). Independent-session In Review → Done review, two cycles. The first pass found the build green and the test coverage complete but requested rework on four findings, one of them an invariant break: rule 6’s argument arm read its target from fieldDef.getType() while every caller of resolveTableFieldComponents passes the connection-unwrapped element type and a matching rt, so on an @asConnection field the arm compared a wrapped type name against an unwrapped table and never fired ; bazes(id: ID): [Baz!]! rejected as the grammar says while the same field returning BazConnection resolved silently onto the raw id column, which is exactly the coordinate-specific divergence the uniform rule exists to prevent. The other three were prose the flip had made false and left standing: the migrating-from-legacy recipe still listed the shims as WARN-today behaviour in seven places including a migration step telling a consumer to grep the build log for a WARN string the flip deleted, ten sites across main sources and tests still described the deleted arms, and SkipMismatchedElement had lost its last producer while the renderer still switched on it. Second pass verified each closure independently rather than on report: the fix threads the unwrapped name through classifyArguments/classifyArgument (one caller, so the thread covers all ten resolveTableFieldComponents sites), the connection and plain-list spellings now produce byte-identical rejections, the arm is confirmed reachable through the wrapper on a non-shadowing table, and the new pin fails 1-of-38 in its class when the derivation is reverted. Two residuals filed rather than held at the gate: R615 (graphitron-sakila-db’s `init.sql still documents the live idreffixture DDL as existing for the deleted IdReferenceField shim tests, misdescribing a fixture whose actual consumers are now the qualifier-map and @reference(key:) tests) and R616 (the Implementation section’s landed notes cited pre-rebase SHAs absent from history; recorded because the same trap will catch the next item that collapses its plan after a trunk sync).

Discarded: Retire @nodeId and IdReferenceField synthesis shims (retire-synthesis-shims, R27): its deletion set is empty. R473 (explicit-nodeid-grammar) deleted all three shim sites in the same motion as the grammar that replaces them: the FK-qualifier IdReferenceField synthesis and the bare same-table arm in BuildContext.classifyInputField, and the non-id bare-scalar-ID arm in FieldBuilder, together with both shim loggers, resolveDecodeHelperForTable and the helpers that died with it. The retirement could not be sequenced the other way round: while a directive-less ID could still mean "node identity, resolved from the table", the table-first helper had no safe deletion point, so the grammar had to land with the deletion rather than after it. This item’s remaining written content was its gate ("sis migrated, plus one external-consumer release window") and its WARN-to-error flip. Neither survives: the user re-confirmed on 2026-08-09 that sis is the only touched subgraph and is migrating it themselves, and there is no WARN left to flip, because the grammar replaced the warned readings with rules rather than with errors at the same coordinates. The migration recipe the item carried lives on in the user manual (docs/manual/how-to/migrating-from-legacy.adoc), which is where a consumer reads it. Re-open trigger: none; a future implicit-nodeId reading would be a new item against the grammar, not a resumption of this one.

R580 (cefb16a classifier + 8cf7766 docs, gate rework 47d11a4; re-scoped d9b5616, spec body 81afbee, Spec revisions 9a55d9e`+6b905c1`+b98be81`+3bb3a82, Ready `89fa452, In Progress bd1d6d1, In Review 8ad26c5, gate rework flip 6b2f808`+7eee77b, rework In Review `b886e1c): implements Node declares nodehood and @node supplies or overrides the two identity parameters, so a @table type publishing the Relay contract over a jOOQ class carrying __NODE_TYPE_ID / __NODE_KEY_COLUMNS is a complete node declaration and takes typeId and keyColumns from the catalog. Unchanged on every other axis: @table + metadata without the interface stays a TableType, which is what keeps a nesting projection over a node-bearing table from becoming a second node; explicit @node still wins on the axis it names; @node without the interface is still rejected. The SDL gate is the whole safety argument, because the auto-promotion shim retired from this exact site promoted on metadata alone, and the incident behind its withdrawal was ~200 sis event types over tables sharing __NODE_TYPE_ID = "195" promoting in lockstep and then being symmetrically demoted to UnclassifiedType by the typeId-uniqueness check. The predicate split is the real scope: @node presence and NodeType membership used to be the same set, so several consumers read the directive off SDL and stayed consistent by coincidence, and new NodeDeclaration names the question once for reachability seeding, the arrival fold, federation entity synthesis and the LSP node view. It sits above classification and takes only a JooqCatalog because two of those run before any type is classified. NodeProvenance records per-axis where each identity parameter came from, and earns the slot immediately: the shadowing rejection reads it to point an inferred node at the metadata and a declared one at the declaration. Riding along is a correctness fix on the explicit @node path, not a compatibility rider: a node type whose table also has a column literally named id silently published the raw column as its Relay global id, while the identical declaration over a non-colliding table published an encoded one, and nothing warned. That shipped first as warn-and-flip and was revised at the gate to a rejection naming both remedies (@nodeId for the global id, @field(name:) for the column), because a warning still picks one of two legitimate readings and only narrates the pick, while the reading it picks changes the wire value; the input and argument coordinates make the same call, so the two had to agree. LintRule.NODE_ID_SHADOWS_COLUMN was removed rather than kept for the Source.CLASSIFIER census, since LintRule.ids() is the namespace a consumer’s <lint> config validates against and a rule that can never fire is not configurable. Fixture cost measured rather than estimated: 37 sites across 7 test classes gained an explicit @nodeId or @field, each behaviour-preserving against the shipped warning, and none in graphitron-sakila-example. The hoisted arm is pinned to the Node-interface id field rather than the shim’s any-bare-ID predicate, which would have rerouted externalId: ID on a node type from its column to a nodeId encode. Both decode-helper collision axes are pinned, including the quieter zero-to-one direction, where adding implements Node to an output type changes an input leaf’s emitted helper from the typeId-suffixed fallback to the type-name-keyed one. The execution-tier proof is the sakila example’s FilmActor converted to the inferred spelling rather than a variant added, so the existing filmActorByNodeId round-trip proves it through real generated code, real encode/decode and a real database. Two departures, both narrower than planned: one lint finding rather than two, because neither silencer’s LintFix is attachable (both are directive insertions after the field’s type, and graphql-java records a type node’s start location but not its end); and the decode-helper one-to-two transition is only half reachable since R581 made a call site holding an authoritative type name resolve by name. Deliberately not done: no ClassifiedCorpus sibling (the verdicts are pinned by NodeInferencePipelineTest, and a corpus example is a documentation deliverable rather than missing coverage), and the lint-rule inventory page filed as R592. Independent-session In Review → Done review, two cycles. The first pass found the delivery otherwise exactly as planned and held on a docs finding the plan’s own census had missed: migrating-from-legacy.adoc still asserted the pre-inference rule as current, on the page whose audience is precisely the metadata-carrying legacy population inference exists for. The rework closed it at the heading, the rule paragraph and the summary checklist, added the shadowed-column failure authors on that path will meet, fixed code-generation-triggers.adoc’s prose and variant-table row, and opened a `Named structural errors section in the diagnostics glossary with the drift-protection paragraph amended to keep DiagnosticsDocCoverageTest’s bidirectional guarantee honest. Second pass verified the closure and the delivery at trunk tip rather than on report: full reactor green under `-Plocal-db (14/14 modules, including the sakila PostgreSQL execution tier and the docs render), NodeInferencePipelineTest 37/37, the user-facing-doc check clean across all five touched manual pages, and a retirement sweep run although none was declared, finding the retired lint names only in roadmap history. The sis census was never performed and remains this item’s one unverified safety claim. It cannot be answered from this repository and implementation proceeded with it open on the user’s direction, so it converts to a pre-rollout check rather than lapsing: enumerate consumer object types carrying implements Node and @table and no @node, grouped by the backing table’s __NODE_TYPE_ID, and confirm every group is a singleton and no member’s id is @field-pinned to a non-key column. If any group has more than one member, this change produces a diagnostic per member of that group, and the mitigation is @node(typeId:) on one side, which the collision message names. Three nits were fixed in this closing commit rather than sent back for a cycle: NodeDeclaration’s class javadoc claimed the classifier gate calls the predicate instance and that the two "cannot disagree", when the gate re-derives the conjunction from the shared static helpers because it needs the metadata values anyway, and the two deliberately part on `@node without implements Node (a declaration-level true, a classifier rejection, contained because the type fails the build either way); and two inbound roadmap citations naming this plan page by path were repointed here, which is R596’s 404-on-delete census. The reviewer landed the javadoc correction, so that one-sentence edit has the same session on both sides.

R587 (be60eba core, 81d5073 gate rework; filed 453b916, spec revision 819da51, Ready f3f9faa, In Progress 18c8842, In Review 1db2240, gate rework 61b95d6, rework In Review 00d8c18): Roadmap markdown code spans render inert, so a quoted macro publishes as typed. A markdown code span is literal by definition and a single-backtick AsciiDoc span is not, so the md-to-adoc render published a live link for every backticked xref and resolved, or WARNed on, every backticked attribute reference, invisibly from the markdown source; the only workaround was knowing AsciiDoc passthrough syntax while authoring markdown, which adoc-xref-section-anchor-gate.md had taken up 17 times. New InertSpans owns the vocabulary as one unit: plusFormFits is the single predicate both producers read, so the readable `+content+` form, the ... fallback for content carrying a plus, a backtick or edge whitespace, and the attrlist-safe label producer cannot drift apart, and the recognizer the corpus gate reads is that same definition rather than a second list. The structural half is the payoff: Main’s four hand-composed inline chains (heading titles, body lines, table cells, and a no-op stub for status-board backlog descriptions) collapse into one `inlineMdToAdoc pipeline that the fifth markdown-sourced surface, front-matter titles, also routes through, with one named helper per sink (titleHeading, titleCell, titleLabel). Two mechanics implementation had to settle: spans are held behind a placeholder rather than split out of the text, because bold wrapping a span and a link label carrying one are both common in the corpus and neither pattern matches once the construct is cut in half; and the converter carries the open span delimiter across lines within a paragraph, without which a line that closes one hard-wrapped span and opens another pairs the closer with the opener and wraps the prose between them. GeneratedAdocSpanGateTest renders the real corpus through the real renderers and fails on any monospace span outside listing, literal, comment or passthrough blocks that is not inert; table blocks are deliberately in scope, since the cell is one of the policed surfaces. Retired: Main.escapeAdocInline, and the hand-written plus-delimited passthrough as a roadmap authoring convention (the 17 sites are back to plain backticks and R582’s body is reconciled). Independent-session In Review → Done review, two cycles. The first pass found the mechanism correct and held on the retirement sweep: R582’s body still stated the pre-change world in the present tense at three sites and described the retired hand-written workaround as live practice, so the file contradicted its own reconciled Design note, and fixing it after approval would have meant fixing it with the Retired vocabulary declaration already deleted. Five non-blocking notes travelled with the rework request and were all taken: the by-theme :description: dropped its span (an attribute entry takes the header substitution group, so nothing was live there and a plain-text meta description is the right shape for the sink), the em-dash sweep moved above the link rewrite that releases label spans early, titleLabel dropped the pipe escape it had inherited from a cell context it no longer serves, titleLabel_bareResidue_failsTheCorpusGate pinned the enforcement half of the label contract, and one over-width line was rewrapped. The second pass verified the reconciliation and each note against the staged corpus rather than on report: zero hold-placeholder leaks, zero unconverted markdown links (so the carried-delimiter state cost no link rewrite anywhere), em dashes 700 in source to 9 staged and bold 1665 to 4 with every survivor legitimately inside a span or in a hand-authored copy, and the meta description now plain text. Full reactor green under -Plocal-db at both tips; 31 tests across the two new classes, both in the base build.

Discarded: Dimensional model pivot: slots over cross-product permits (dimensional-model-pivot, R222): retired 2026-08-06 as the fact-base architecture’s board sweep landed (roadmap/audits/2026-08-06-fact-base-impact-sweep.md). The umbrella’s thesis won one layer below where it was looking: axes-as-slots is delivered as per-directive intent_ relations and the claim view’s arm list (R589 over the R595 store), while two of its three load-bearing claims were inverted (producers read captured rows, not graphql-java primitives; validity is violation rows, not a WalkerResult wrapper), its operation axis was delivered by R563 as OperationMember, its input-side premise deleted by R519, and its stage plan replaced by the strangler frame. Residues cut before discard: R601 (unified-diagnostic-stream) and R602 (input-object-directive-locations); the Stage 5/6 legacy-permit deletion inventory migrated into R333’s What dissolves with the Stage 6 end state restated as deletion, and R411 dropped its carve-out dependency. The absorption ledger and rejected design attempts are preserved in roadmap/audits/2026-08-06-r222-lineage.md.

R584 (076e9cc; filed 3830a04, spec body e430740, Spec 4e40d1d, Spec revise 2497c0c`+f91f027, Ready `d3f1524, In Progress 4ca7647, In Review 154ff7f): The MCP handshake instructions string routes an agent to every advertised tool family instead of one. The shipped file spent a full paragraph on catalog.tables / catalog.describe and never named the other ten tools or the directives resource, so agents re-derived from text what the wire already carried: shelling out to python3 to count diagnostics whose pre-paging total was in the tool’s own summary line, and grepping a whole monorepo for DELETE mutations that schema already classifies with a resolved table. The fix is a decision about what the slot is for rather than a longer list. The instructions string is ambient (received once at initialize, held for the session, charged on every request); a tool description is local. That split assigns the work: ambient carries only what no single description can say, which is the mapping from an agent’s question to a tool, plus the conventions holding across tools. The old catalog paragraph inverted it, restating catalog.describe’s own jOOQ-comments caveat and `catalog.tables’s "SQL names drive discovery" almost verbatim; cutting that duplication is what pays for the routing table. What ships is a question-keyed routing table over all twelve tools plus the resource, ordered by the authoring loop rather than registration order, and three cross-tool conventions each drawn from an observed miss (the paged-first-line total, IDs stable and shared across tools, every tool reads the live build and four report snapshot freshness). The string is composed rather than one fixed resource ; base block plus `mcp/instructions-execute.txt appended exactly when executeConfig != null ; mirroring execute’s conditional registration, which is what lets the coverage pin assert agreement per boot rather than over a union and lets the exempt set ship genuinely empty. New `ServerInstructionsTest holds three assertions over one subject: a bidirectional coverage pin (advertised-is-routed, routed-is-advertised) deriving the advertised surface from a booted server via listTools/listResources/listPrompts rather than a hand-written list, asserted against the ambient string per boot and against docs/manual/how-to/mcp-agent-context.adoc at a different grain (presence over the whole document, staleness over the tool table’s first column, since the manual is per-tool where the ambient block is per-question); a pin driving all six McpWire.page tools at limit=1 and asserting the first line carries the unpaged total; and a 3600-character ceiling on the composed string, guarding a per-request cost against unbounded append. Presence is checked in backticked form because the bare word "schema" runs through the prose and a substring check would pass vacuously on the very tool the second episode is about; the reverse direction uses a leading-lowercase-letter token rule ([a-z][a-z0-9]*(?:\.[a-z0-9]+)* matched in full) so Type.field, .graphqls, mvn graphitron:dev and fqcn#method/arity do not read as tool claims, with no ignore list. GraphitronMcpServerTest gains the composed-arm case; its existing verbatim initializeReturnsBundledInstructions now pins the base arm unchanged. The manual needed no rewording: it already named every advertised name. Independent-session In Review → Done review: full reactor green under mvn install -Plocal-db (13/13 modules), no code-string assertions on generated method bodies, and all three pin directions independently mutation-checked at the gate rather than taken on report ; dropping catalog.describe and records from the prose fails the forward direction naming both, inventing a diagnostics.aggregate routing line fails the reverse, renaming edges in the manual fails its forward half, and making the composition unconditional fails the no-database boot on execute, which is the mutation a union check would have passed. Measurements verified against the shipped files: 411 words / 2564 characters base, 452 / 2817 composed. One residual filed rather than held at the gate: R598 (the warm-degradation messages of docs.search / catalog.search carry no tool prefix or count, which is why convention 1 is scoped to the paged tools). R569 needs no depends-on edge ; registering diagnostics.aggregate cannot land without its routing line and manual row, because the coverage pin fails until both exist.

R563 (slices cba24d0/f9f1899/5b78a5a/711933e`+702c7f8/7bb9794`+4546534/98e3623`+043f13e/b1ee673`+030ccf9/9e46d52`+b71a203/850ba5f`+ea5f9db/827a140, rework 608fd85; Spec f107ce4, Ready bf0d649, In Progress 72421e9, In Review e7c420c, gate rework 21b0b699`+bbd829a6, rework In Review `63e164d8): Operations became a relation and the leaf cross-product dissolved additively. coordinate -> operation is the one genuinely multi-valued relation in the classification model, and storing it as a single-valued Operation arm plus leaf identity was the 1NF fault that multiplied leaves: a filtered lookup silently dropped three facts off the operation axis (all three lookup leaves carried filters/orderBy/pagination while their operation() switch mapped them to a Lookup arm with one slot), Paginate fused three verbs into one record, a DML coordinate performed two operations and the model could name only the materialized one, and both structural Operation consumers carried an explicit fallback around the arm for polymorphic filters. Eight slices, each shipping to trunk on its own and the 4-through-7 ones landing as additive-then-destructive halves so each equality is demonstrated in history rather than asserted after the fact: the sealed OperationMember family plus the member view derived from a compile-total 51-leaf crosswalk; the instruments (LeafRatchetTest, the member-grain census); the keystone, where five per-trigger FactVisitor`s joined the pagination precedent and the view re-sourced onto the gathered slots under a canonical-RecordComponent` agreement pin; the tenant re-source and the retirement of OutputField.operation() with its three leaf-identity switches; the back-half re-source, which materialized DeliveryFact and collapsed LauncherCommands.MINTING_KINDS onto a sealed launch verdict; three dissolution slices (the lookup triplet onto their fetch siblings behind a sealed LookupResolution, the DML verb split onto the sealed Write.Dml payload with the dialect requirement becoming a derived accessor, the pivot and routine operation halves); the corpus voice, where @classified(operation:) became a required arm-grain operations: multiset and the 17-arm Operation seal retired outright; and the obligation re-typing. Output leaves fell 51 to 40 (query 12→10, mutation 15→8, child 24→22) with a history line per move, plan leaf references 156 to 124, generator pins 71+76 to 69+59, and LeafReconstructionKeyTest now enforces the acceptance claim leaf = f(source, delivery, target) as a declared triple per surviving leaf, pinned total against GeneratorCoverageTest.sealedLeaves with a collision check whose sole tolerated pair is the single/bulk DML carriers. Emit byte-identical through every slice. Independent-session In Review → Done review, two cycles. The first pass found the architecture sound but the documentation tail broken, and requested rework on four findings: the generated migration fragment had been regenerated from a partial classifier trace at slice 6c and advertised four shipped shapes (MutationServiceTableField, JooqRecordInputType, JooqRecordType, UnclassifiedType) as (not yet supported) on the user manual’s migration page; code-generation-triggers.adoc still named the three leaves 6a retired as live classification verdicts across five tables, though slice 6b had fixed that same file’s DML rows one slice later; LookupValuesJoinEmitter survived in four test-prose sites including a dangling test-source {@link} that no gate catches; and one retired-vocabulary row described a re-grain as a deletion. Slice 8’s claim that the docs/ AsciiDoc audit found zero survivals was corrected in place rather than deleted, so the record now says what the sweep missed. Second pass verified each closure independently: the fragment regenerates byte-identical from a full-reactor trace, the swept doc rows name the surviving leaves plus the keyed lookup arm and the TableTargetField census matches the seal’s four permits exactly, LookupValuesJoinEmitter has zero occurrences outside LeafRatchetTest’s deliberate history lines, and the four test edits are comment-only. Trunk was red from R580’s `NodeInferencePipelineTest when the gate closed; R563’s own In Review tip was built in an isolated worktree and is green 13/13, and the failing class does not exist at that tip. Three residuals filed rather than held at the gate: R590 (the migration fragment carries no --verify execution, so the partial-trace footgun that fired twice in this programme is still unguarded), R591 (SqlGeneratingField remains the storage home for the condition, orderBy and paginate payloads, so on those three axes the member rows are a view over the leaf rather than the reverse), and R586 (the exemption-taxonomy arm census). R222’s operation-axis content and R543’s parked corpus edits are discharged; R333’s stay-Ready call belongs to its own gate.

R579 (59313d7; Spec 4e9c30d, Ready 6e85bd9, In Review f5acb32): Dropped the dead parentTypeName parameter from FieldBuilder.parseExternalRef and followed the orphaned value one frame up, off ExternalFieldDirectiveResolver.resolve as well, since that call site was its only reader. Four removal-only edits, no logic moved: the cascade terminates in ServiceDirectiveResolver.resolve and FieldBuilder.classifyChildFieldOnTableType, where the name is genuinely live (parent-table validation and return-type projection on one side, UnclassifiedField/ComputedField construction on the other). No tests, by design: a signature narrowing has no behavioural axis, so the compiler plus the existing @service and @externalField pipeline coverage is the whole verification story, and a test here would pin an arity rather than a behaviour. Independent-session In Review → Done review: full reactor green under -Plocal-db (13/13 modules), the sweep confirmed complete and correctly terminated (one call site each, both terminal frames still read the name, no orphaned @param javadoc, and every sibling resolver that keeps a leading parentTypeName was checked to actually read it, so no parallel dead parameter escaped). The user-facing-doc check and retirement sweep both skip: no docs/ changes, nothing retired.

R581 (c87667b): @nodeId(typeName:) resolves off the named type instead of reverse-mapping its backing table. Declaring a second @node over a table broke every @nodeId(typeName:) leaf already pointing at that table, including the leaves that named their type and were therefore never ambiguous: NodeIdLeafResolver.resolve settled the type name, derived the target table from it, then asked BuildContext.resolveDecodeHelperForTable to map that table back to a NodeType, and that reverse lookup answers "zero or multiple" as soon as a second @node covers the table. Reported from the sis / utdanningsregisteret federation work, where the shared Organisasjon entity has to live alongside URegOrganisasjon over one table; the second type needed no reference from any query, field or input, and declaring it was enough. BuildContext.resolveDecodeHelperForType is the new name-first entry point (NodeIndex.forName when a NodeType carries the name, the table-keyed helper only for the orphan case it exists for), consumed by NodeIdLeafResolver.resolve and buildInputNodeIdReference; the call sites that genuinely hold only a table name (the synthesis shims, the bare-scalar-ID argument arm in FieldBuilder.classifyArgument) keep the table-keyed helper, and the resolver’s surviving rejection is re-aimed at what is actually wrong at that point. resolveTargetKeys reorders the same way, so a named leaf takes typeId and keyColumns from the type’s own @node rather than from the table’s KjerneJooqGenerator metadata; the old order discarded the per-type reconciliation TypeBuilder performs, which is what lets SDL win on typeId outright and on keyColumns order. This was R473’s phase 1, carved out and driven by the field report; R473 keeps the rest of its grammar and its phase 2 shim retirement. Independent-session In Review → Done review: full reactor green under -Plocal-db (13/13 modules), no code-string assertions in the delivered tests, and each half of the production change empirically confirmed to be load-bearing by reverting it against the whole graphitron module (reverting the name-first decode resolution fails the three new multi-@node cases; reverting the resolveTargetKeys order fails the key-order case, and only that one out of 3120 tests). The manual’s new "Several node types over one table" shape was also run through the classifier at the gate rather than trusted as prose: both types classify as NodeType, both id: ID! @nodeId fields classify, and GraphitronSchemaValidator reports nothing. Two findings filed as follow-ups rather than held at the gate: R583 (the typeId axis of the resolveTargetKeys reorder is unpinned, and it is the wire-format prefix resolveNodeIdRecordDecode feeds into decodeValues on the jOOQ-record input-bean path) and R582 (nodeId.adoc’s new cross-reference targets the AsciiDoc default underscore anchor while the site renders kebab-case section ids, so the link lands at the top of `node.adoc instead of the section; two older instances of the same mistake exist, which is the argument for a gate rather than a sweep). Process note: the item was created and reached In Review in the implementation commit, so it never took a Spec → Ready sign-off.

R566 (e54be59 core, 870bcd1 sweep, cd8538f acceptance fixture, c757b0a verb rebase; Spec e31c51e, revisions b77a5f4`+82a0dc0`+43e12c7, Ready 1539675, In Progress edfb780, In Review 88e7779): Reopened the @table-on-input deprecation window. The cutover that made the location a classify-time rejection did it in one step, with no build that merely warned in between, so a downstream subgraph picking up a newer 10-SNAPSHOT hit six type-level rejections at once. TypeBuilder.buildInputType now falls straight through to the plain path and the deprecation is announced per usage as a BuildWarning.NoRule advisory that says the directive was ignored, not only that it is deprecated: an input whose @table named a table other than the one its consumer resolves is discarded rather than migrated, and the message is the entire mitigation. Dropping the verdict was necessary but not sufficient. Four main-source readers of raw @table on an INPUT_OBJECT were harmless only because the rejection short-circuited them and all four went live the moment the input classified: RecordBindingResolver.groundRootProducers (an input-axis ProducerBinding.RootTable that honored the directive, deciding the backing carrier, and folded against a @service param’s own observation into a RecordBindingMultiProducer rejection, so the build still failed with a backing-class diagnostic instead of a migration message), InputBeanResolver.collectJooqBindings (nested @table rejected as a second DML target), BuildContext.classifyInputField (nesting descent gated on the directive’s absence, so a nested group fell through to the column-lookup path and resolved as a column named after the nested type), and MutationInputResolver.rejectInputFieldDirectives (recursion gated the same way; this one failed open, letting a @condition buried inside a nested @table group escape an admission scan its directiveless twin trips, with no build error). All four deleted, so inertness is uniform. The per-verb replacement wording is read off OperationMember.Write.Dml rather than off the mutation field leaves the pre-cutover version enumerated, which the trunk DML verb split had dissolved: one exhaustive switch over the four sealed arms replaces three leaf-enumerating helpers and the compiler now checks that a new verb cannot ship without wording (UPSERT got an arm rather than the spec’s argument that it was unauthorable). Emitted post-classification, not from buildInputType, so warning multiplicity is not a function of lookAheadVerdict memo timing; fix-less by design, since NoRule carries no fix field and LintFix.deleteBareAppliedDirective gates on the definition declaring no arguments. Coverage: TableOnInputDeprecationWarningTest (all four wordings, per-input not per-consumer multiplicity, unresolvable table name inert, declared-table-disagrees-with-consumer, and one whole-schema acceptance fixture asserting six @table-carrying inputs across every verb and nesting classify with warnings and no rejected type or field), the new TableOnInputIgnoredNestingTest for the two nesting-path deletions plus the fail-open @condition site, the service-param and nested-input rejection cases in JooqRecordServiceParamPipelineTest rewritten as equivalence assertions against their directiveless twins, RecordDirectiveIgnoredWarningTest’s record-shadowing case given a producer so the `OBJECT-only guard is actually exercised (a filter-only input returns at !reachable first and would have passed for the wrong reason), and graphitron-sakila-example’s `CityCountryFilter carrying @table again as the end-to-end proof through the plugin, with FixtureWarningsGateTest asserting both advisories explicitly rather than carving the new one out. The retirement statement was reworded off the SDL descriptions and twelve doc pages, including two that were false rather than stale (argument-resolution.adoc’s “buildInputType rejects any input carrying @table”, `code-generation-triggers.adoc’s `UnclassifiedType + "build fails" row), directives.graphqls’s `@mutation(table:) outranking claim (nothing to outrank), and migrating-from-legacy.adoc, where the location moved out from under == Hard removals into a retitled == WARN today, error later bucket and migration step 1 stopped claiming the build will not compile. R520’s LSP sub-goal is void while the window is open and was re-scoped to documentation-only. Explicitly out of scope: the eventual re-removal, which is a fresh item, and the lesson is that the warning has to ship in a release consumers actually built against first. Independent-session In Review → Done review: full reactor green under -Plocal-db (13/13 modules), retirement sweep clean (no surviving _retired_on_input_types anchor, TABLE_ON_INPUT_RETIRED case, _rejectsAtTheType method suffix, or "outranked"), doc sweep re-run with the spec’s generating grep, and each of the three nesting assertions empirically confirmed to fail with its corresponding guard reinstated (including the @lookupKey case’s narrower claim that it survives the recursion gate alone). Follow-up R574 filed for four residuals the acceptance criterion did not reach: an unused DIR_TABLE static import in InputBeanResolver, two table.adoc Constraints bullets that read unqualified but now hold only on OBJECT/INTERFACE, and migrating-from-legacy.adoc’s intro taxonomy still calling the WARN bucket "the synthesis shims". Process note: the spec body was never updated during In Progress (only `status: moved), so three delivered divergences from the plan (the InputBeanResolver design fork, the verb-switch rebuild, the migration-doc retitle-and-move choice) are recorded in the commit messages and here rather than in the plan.

R564 (14e0442; Spec ea87dc1, plan body a26a5bd, provenance corrections 2376e92`+cbc11bc, Ready `d92af4c): The javadoc {@link} reference gate survives an out-of-range project.build.outputTimestamp. maven-javadoc-plugin 3.12.0 bundles maven-archiver 3.6.4, whose parseBuildOutputTimestamp range-checks against a 1980-01-01T00:00:02Z floor and throws two seconds under it on SOURCE_DATE_EPOCH=315532800, the ZIP epoch NixOS exports from stdenv; the property is never set here, but maven-archiver falls back to that environment variable, so the check-link-references execution died before doing any of its own work and every NixOS contributor lost the whole build to it on a clean checkout. Fixed by overriding the plugin’s bundled maven-archiver to 3.6.5 (which dropped the range check; not 3.6.6, which raises its maven-core baseline to 3.9.12) in the root pom’s pluginManagement, so the release profile’s attach-javadocs jar goal is covered too. Guarded behaviourally rather than by asserting the XML exists: rewrite-build.yml’s reactor build step exports the offending value, so dropping the override reddens the build on the commit that drops it. Declaring `project.build.outputTimestamp was rejected as the fix: it would work by overriding what the environment asked for and would commit the project to a Reproducible Builds policy as a side effect of a bug fix. Independent-session In Review → Done review confirmed the mechanism at the bytecode level (3.6.4 carries the DATE_MIN/DATE_MAX throw, 3.6.5’s numeric branch returns Instant.ofEpochSecond unchecked and still reads the variable), reproduced the failure on the pre-fix tree and its absence after, verified a planted dangling {@link} still fails the gate under the override so the fix does not buy green by weakening what the gate checks, and ran the full reactor green under -Plocal-db (13/13 modules).

R543 (dfb06d6, binding design record e26e18d; Spec 664b37e, revise 3cf90c3`+1a6fd74, Ready `0650a27, In Progress 74dc897, In Review d82b734): The corpus asserts a coordinate’s launcher commitment (R549 slice 8): @commits(source:, result:) lands in the corpus prelude, keyed by coordinate alone like the launcher relation, agreement-checked per coordinate against the relation the harness produces for every example under one stated canonical run configuration, with the outcome typed produced-or-failed (never thrown through the sweep) and the two-entry failure roster ({record-method, service}, the recorded validator-mirror gaps) bound by set equality in both directions. The directive carries arm tokens only, never emitted names, and makes no membership claim; the LauncherSource/LauncherResult prelude enums are mirror-tested against the sealed arm sets. Membership went producer-declared per the Spec’s review round 1: LauncherCommands.MINTING_KINDS, a sealed Leaf/DmlReturn key (the DML family’s membership is return-arm-conditioned, a census-corrected refinement of the Spec’s flat leaf set) with the single covers accessor owning the conjunction; mintedMethodOf and produceWithoutSchema re-sourced onto it, LauncherMembershipTest binds declared to observed minting in both directions over a fixture reaching all thirteen kinds, and the closure test’s hand-maintained twelve-arm isCoveredFamilyMember switch retired. The invocation axis is not an argument (the axis census showed the source arm determines it): INVOCATION_BY_SOURCE is total producer data, pinned at the membership fixture, the closure run and the corpus sweep via the shared LauncherAxisPins. Deliberate absences keep explicit negatives: the root @service passthrough pin stays, the batched polymorphic pair pin was added (the Spec’s premise that one existed was confirmed false; the fixture now instantiates the interface half), and an Encoded-DML pin grounded on the return-arm fact and covers rather than emitsKeyedReQuery() (true for an Encoded DELETE while no row mints; that predicate’s javadoc consumer list corrected). Coverage: the LAUNCHER_COMMITMENT obligation registered in obligations() and corpusObligations(), all 15 LaunchSource`+ResultShape` arms reached by declared-and-agreeing rows with zero exemptions, three new examples (table service child, scalar service child, discriminated-return mutation) reaching the previously unreached arms, and LoaderDelegated’s biconditional entailment stated on the row. `QueryViewRenderer.INTERNAL_DIRECTIVES derived from the parsed prelude (the latent @synthesises leak closed by construction); the Count/Facet exemptions re-anchored on the live ground (synthesised connection fields are not classified coordinates, R562 owns the model question); a launcher-arm occupancy census landed beside the classification one so the next re-measurement is a test run. Emit-neutral (main-source changes limited to the producer’s declaration data and javadoc corrections; sakila expectations byte-identical), PLAN_LEAF_REFERENCES ratchet 144→156 with its history line. Independent-session In Review → Done review re-verified the acceptance criteria against the diff, ran the full reactor green under -Plocal-db (13/13 modules), and swept the one stale carrier-fork sentence off R562’s body in the approval commit.

R541 (slices b7032ca plain root, d3178e8 connection non-faceted, 395b4c4 facet plan + legacy connection builder retired, 8ffe4c0 fanned root + invocation slot, dfc1df9 routine root + source axis, 23415d1 discriminated arm + interface root, 1c88a86 lookup pin freeze, 49de8cb lookup fold closes the migration; In Progress → In Review 9b292ea): Root query launcher, the root SELECT family as launcher commands (R549 slice 3c, the second proof of the command architecture). Every covered root SELECT coordinate (plain single/list, connection faceted and non-faceted, tenant-fanned, routine, single-table-interface, lookup) is produced as a LauncherCommand row keyed by (coordinate, operation) and rendered by RootLauncherRenderer, a total function over the command taking no schema; the root fetchers reduced to thin entry points routing on row presence, and TypeFetcherGenerator shed its five inline root SQL builders (~1000 lines). Membership is one total switch (LauncherCommands.rowOf, no default), so the compiler is the membership enforcer and the migration dial deleted on the closing slice. The exact-SQL equivalence pins (RootLauncherSqlBaselineTest plus the faceted pin in the condition baseline and the per-tenant recording-proxy pin in the fan-out suite) were authored pre-cutover and held byte-identical throughout; the frozen-strings rule held (pins only ever added). Second-proof findings recorded in the slice logs: the extras slot dissolved (cursor columns are a correlated view of the ordering slot), the spec’s payload-free-enum premise failed twice (ResultShape and Invocation both promoted to sealed with their first payload-bearing arm), the strategy decides the unit’s interface (the fanned launcher is env-only), and the source axis (LaunchSource) absorbed table and projection rather than sitting beside them. Cross-family handshake with R552 completed (where glue refs and facet fragment refs cross the seam as data). Validator-mirror gaps surfaced but not owned filed as roadmap/root-family-validator-mirror-gaps.md. Independent-session In Review → Done review; full reactor green under -Plocal-db, 13/13 modules; retirement sweep applied in the approval commit (four stale prose references repointed, one Backlog item body refreshed).

R552 (4d5f48d slice 1, 7cac278 slices 2+3, slice 4 with R541’s b7032ca`+395b4c4; Spec revisions `4d6e15a`+d1e22d8, Ready `61fde1f, In Progress 1ed6f68, In Review cd949ec): The WHERE family as a coordinate-keyed command relation, the third proof of the command architecture (value-shaped unit, cross-kind launcher edge, external-callee edges, the type-keyed GROUP BY exemplar) and the first family to land. One row per covered (coordinate, resolvedTable) key (participants expanded, nested coordinates recursed, lookup keys excluded by the fact), each carrying its ordered predicate list (Generated terms rendered in the glue body, Authored predicates as calls into developer code, reach as producer-proven FkHop lists replacing four render-time throws), its total glue UnitMethodRef, shared-outer lifts and facet fragments as data with the fragment partition and local-name collision-freedom as compact-constructor failures. render/ConditionGlueRenderer replaced QueryConditionsGenerator with single-layer map-taking bodies ((JooqTable, Map<String, Object>), env appended exactly when a binding reads the request context), one producer-named typed local per argument; every WHERE consumer (root fetchers, split rows methods, lookup rows method, inline $fields arms, polymorphic branch folds, the facet-plan block) now emits the one-line ConditionGlueCall, and FkTargetConditionEmitter deleted in full, so no host can compose a fold inline again ; the structural convergence enforcer. The entity layer (TypeConditionsGenerator, the <ReturnType>Conditions/<Participant>Conditions classes, the WhereFilter naming facts) retired with zero callers; slices 2 and 3 merged deliberately so the dual-scheme window and its merge machinery never got built, with EmissionLog’s duplicate-landing-address hard failure kept as the general backstop. `@condition(contextArguments:) implemented rather than rejected (the inline sites had shipped the shim’s missing-helper bug a second time; the glue class owns its graphitronContext(env) helper through a declared-drain collector), R475 dissolved (producer-named locals, no generated parameter list to collide; fixture compiles and executes), R472 closed via the two-step (deferred rejection, then the nested row when nesting types became walkable), R334’s condition-family ternary chains gone by construction, R387 completed by its subject’s retirement. Borrowed-vocabulary verdict for the programme: the borrow held, nothing copied into command (ArgBinding, OuterLift, UnitMethodRef are borrow-plus-producer-data shapes; PackageImportDirectionTest’s borrow dial plus an eighteen-type closure census guard the boundary). SQL equivalence held across all three landings: seven `ConditionSqlBaselineTest whole-statement pins byte-identical, the one sanctioned delta (runtime-prefixed EXISTS aliases) decided before any pin was authored; ConditionMembershipTest pins relation key-set equals an independently derived covered set. Launcher handshake: LauncherCommand.where is a GlueCall copied off the row, facet fragment refs cross into R541’s carrier plan cross-checked at production. Ratchets across the item: entry points 24→22, generator leaf instanceof 104→97, case 89→87. Independent-session In Review → Done review (this entry’s landing commit): full reactor green under -Plocal-db, retirement sweep swept one surviving computeLiftedOuters javadoc cite and the closed window’s prose off EmissionLog, R333’s row 5 and crosswalk row updated with the landed verdict, R475/R387 files deleted, follow-up R561 filed for the pre-existing body-string scans ConditionGluePipelineTest carried through its rename.

R551 (16e45d1, in-review amendment 11947dd; Backlog → Spec da4b5a4, Spec → Ready 47f3e3c, Ready → In Progress c7dd7ae, shipped-at notes e12d2e0`+b88e509`+4077461, In Progress → In Review 39ba5e9): Restated both srp hand-off templates as goal + hard invariants + pointers, dropping the machinery that was shaping reviews into rubric-filling. The two emitted prompts each carried a mandated "Read first (in this order)" sequence, a five-bullet "What to assess" rubric, and a per-finding output format (summary line / location / principle / fix shape); the observed effect was reviews shaped like the rubric rather than like the item, one paragraph per bullet with findings stretched to fill the agenda and nothing surfaced outside it. Current Anthropic guidance for this model generation names that shape as counterproductive: delegate rather than dictate, since a prescribed step sequence fights an agentic loop where each step is chosen from what the previous one revealed; delete instructions rather than add them, since over-specification measurably degrades output; and match freedom to fragility, keeping low degrees of freedom for fragile mechanical steps and high degrees for judgment work. The split the rewrite draws is exactly that line. What a fresh reviewer cannot infer stays prescriptive and survives verbatim in both templates: the sync-first commands with the reason they exist, the reviewer rule with its session-ID trailer convention and git-author fallback for pre-trailer commits, the two-outcome contract with the state-machine action attached to each outcome, and the project facts no reviewer can derive from the tree (where "good" is defined, the stale-reference rule with its FQN-aware-grep hint, the ban on code-string assertions over generated method bodies, and build-green under -Plocal-db as an approval precondition). What is judgment work loses its scaffolding: the reading order becomes an unordered materials list with one line each on why the material matters, the rubrics become a one-sentence statement of the question the gate answers ("would you hand this plan to an implementer as-is" / "does the delivery honor the contract the spec set"), and the output prescription becomes report what materially bears on the decision, anchor it, end with an unambiguous verdict, and say plainly when the item is clean instead of inventing findings. Both templates now grant explicit licence to investigate, since the reviewer is an agent and not a reader. One gap closed along the way: the implementation-stage materials list now names roadmap/workflow.adoc, whose per-gate obligations (the user-facing-doc check and the retirement sweep) the old template never surfaced, so a reviewer had no route to two checks the workflow requires before approval. A Template design intent section pins the shape against re-accretion. The skill’s Procedure, Output rules, and Hard rules are untouched: template consistency across reviewers is itself a workflow property and was not up for relaxation. The sibling reviewer-prompt skill stays out of scope by the Spec-stage reviewer’s explicit answer to the item’s delegated question, since its "What to look for" taxonomy doubles as the project’s canonical review taxonomy. Templates went from 1126 to 942 words combined, with the surviving bulk being the mandated invariants. One amendment landed during the In Review window at the user’s request (11947dd): stripping the machinery had left the templates reading as pure gatekeeping, so both now open by stating that the review exists to help the item land as well as it can, and close by asking for improvement opportunities alongside blocking problems while keeping the two distinct in the verdict. A problem blocks; at the Spec gate an opportunity is the author’s call, at the Done gate an improvement the contract does not demand becomes a follow-up Backlog item rather than rework, and new scope routes to a fresh Backlog item at either gate. That is goal-level framing rather than a reinstated rubric, so it sits inside the design-intent paragraph rather than against it. Independent-session In Review → Done review, itself conducted through the new implementation-stage template; full reactor green under -Plocal-db, 13/13 modules.

R548 (c44ed95, javadoc scoping 51dfb78; Spec a32d87d`+be8484f, Ready `60e6dc5, In Review a74895c): Collapsed the manual’s two hand-maintained directive indexes into one and made the survivor build-enforced. reference/index.adoc reproduced the directives landing’s alphabetical and by-category columns inline and had drifted to 24 of 29 entries, missing @asFacet, @pivot, @routine, @scalarType and @tenantFanOut; since the manual landing routes its Reference quadrant at that page, the path manual → Reference → Directives ended on the stale list with no route to the complete one, which is how a reader concluded @pivot was undocumented. Deleted the duplicate rather than syncing it, leaving a single xref plus a descriptive sentence in the shape the same page already uses for Runtime API, Maven plugin, Editor support, Diagnostics and Deprecations. Generating the index from the SDL was considered and rejected: the alphabetical column is enumerable, but the deprecation and rejection annotations and the category grouping are editorial judgement, so the item guards the hand list instead of half-generating it. DirectiveDocCoverageTest grew a second method extending its seam from SDL→pages to SDL→pages→index: the alphabetical column must equal the page set exactly, and every page must be named somewhere under == By category. The columns are sliced on the two headings rather than regexed whole-file, since the columns overlap and a whole-file match would make the category assertion vacuous. Closing the guard exposed two gaps in the survivor it now rejects: @referenceFor was filed under no category and @record had lost its Mapping slot when @scalarType was added beside it. Membership is guarded; the editorial annotations beside an entry stay prose, and link validity remains `ManualXrefIntegrityTest’s (verified: a by-category entry naming a nonexistent page fails there, not here).

Discarded: Invert the command flow: the core produces method commands, the shell consumes them (core-produced-method-commands, R546): absorbed wholesale into R549 (facts-and-commands) three days after filing, before any implementation. The item’s own open Spec question was what shape MethodCommand should grow into beyond its four strings (coordinate, unit, type path, method name), and R549’s reframing answers "none": the model’s sealed hierarchies are the commands once each sits at its true grain, so a parallel command record is exactly the intermediary model that programme argues is unnecessary. Nothing in the item is lost. Its scope (flip the reentry family from shell-asks-core to core-tells-shell, oracle green, emitted output byte-identical) is R549’s slice 5. Its strongest justification, that CompileDependencyGraphBuilder.fromModel is a 731-line second derivation of the emit call graph whose duplication generates a recurring bug class (R455’s oracle blind spots, R459’s missing node, R462’s missing outgoing edges, all one shape: the graph is derived from coordinates while the emit contains methods no coordinate exposes), is R549’s slice 7, with the full argument and its caveats preserved as gap 7 of roadmap/audits/2026-07-26-fcis-command-layer-distance.md. Its abandon condition and 2026-07-26 baseline became R549’s. R545 (model-free-of-emit-vocabulary) survives independently as R549 slice 2’s invariant 3.

R542 (0a3c0c6; filed 646e779, duplicate-id collision resolved d77c03c, Backlog → Spec 7fd05fe, Spec → Ready 5e32f47, In Progress → In Review 85d2f52): CLAUDE.md is the one document every session reads in full and first, so a wrong fact there is believed without verification and acted on before any file is opened. Four factual errors, three misaimed pointers and one ineffective hook corrected, with a mechanical guard on each of the two drifts that had already recurred silently. The Java-17 floor is two modules for two different reasons, and only one of them was stated: graphitron-sakila-example compiles emitted sources at 17 to verify the generator’s output ceiling, while graphitron-jakarta-rest pins its default-compile execution to 17 because consumers put that hand-written jar on their classpath, making it a constraint on what a contributor may type there. The text now matches the three-category framing in development-principles.adoc. The module enumeration named eleven of twelve, omitting docs, while the same file’s Documentation site section correctly described docs as a Maven module; modules.adoc carried the identical off-by-one in prose and omitted the docs row. The test-tier pointer aimed at development-principles.adoc, whose own text defers tier names and the decision rubric to how-to/testing.adoc; it now aims at the rubric with the principles page kept as the why. Common commands documented no way to run less than everything, so the scoped inner-loop command and -Pquick are named, with the -am / -amd precondition moved into the surrounding prose so it stops contradicting the bare--pl rule three lines above. The publish skill is named as the default git path (the raw commands lose its dirty-tree stop, wip/draft/spike check, trunk-divergence pre-check and network retry) and the em-dash rule now says what it is: guidance binding newly written prose, no build gate, existing occurrences explicitly not a cleanup backlog. Two roadmap-tool tripwires bound to verify in the AdocMarkdownTableCheck shape close the drifts for good. TransientCitationCheck fails the build on an item id or non-permanent roadmap/ path in a declared prose document, which is where the rule that RoadmapReferenceGuardTest enforces across Java sources had no reach: markdown has no comment or string-literal regions, so the two files an agent reads first sat outside every scan and rotted five citations. ModuleEnumerationCheck requires every module the root pom declares to appear as a backticked identifier in both enumerating documents, checked in one direction only since a module identifier and an ordinary backticked word are indistinguishable in prose. Both treat a declared document that moved, and a root pom parsing to no modules, as failures rather than a smaller scan: the floor against a vacuous pass. The trunk-reminder hook emitted systemMessage, which is user-facing, so a nudge aimed at the session that had just pushed landed on the human to relay; it now emits hookSpecificOutput.additionalContext. Moving the payload exposed that the declarative if scoping was never filtering (a systemMessage nobody reads is indistinguishable from one that never fires), so the command body filters on the tool input itself, which also retires a latent bug where reading one line off jq missed a push on the second line of a compound command. Deliberately left open and filed as R547: the same citations live in nine pom.xml comment blocks and in the published docs/architecture/ pages, including two in the modules.adoc row this item edited. Coverage: 24 unit tests across the two checks, each asserting this repository clean from the test tier as well as at verify. Independent-session In Review → Done review re-derived every corrected fact against its file, exercised both guards end to end against a deliberately drifted tree, and ran the hook body against the four tool-input shapes plus a missing-command payload; full reactor green under -Plocal-db.

Discarded: Finish retiring pure-verdict GraphitronSchemaBuilderTest rows onto the classified corpus (classified-corpus-verdict-row-retirement, R539) (726cc71; filed 632c676, prose corrections 60b2933): filed on a misreading and discarded the same session, once the rest of the audit was read. R281’s verdict-row grind is finished: roadmap/audits/classification-test-dsl-inventory.md has all 35 whitelisted rows ticked plus a Slice 3 closeout section recording the endpoint (union net retired, output-field and type coverage moved to ClassifiedCorpus as single source of truth, long tail swept in), and VariantCoverageTest.everyOutputFieldAndTypeLeafIsDemonstratedByTheCorpus confirms it in code by reading coveredLeaves() alone. A re-derivation over the live enum found zero pure-verdict rows left: of 400 ClassificationCase constants the buckets are rejection/warning, slot-asserting, and input-side, all excluded from retirement by design, and the five apparent pure hits all read returnType().wrapper() asserted with isInstanceOf, which is a slot read, not a verdict. The misleading signal was a large surviving GraphitronSchemaBuilderTest (394 of its 400 rows are the excluded buckets) plus a staleness banner that flagged only the row list, which reads as "whitelist unusable, work still pending" rather than "work done". Corrected across five surfaces in 60b2933 (doc-only, no behaviour change): the inventory banner now leads with "closed and historical" and sends readers to the closeout before they draw conclusions about outstanding work; R25 (rebalance-test-pyramid) and R448 (routine-chain-residue) dropped their present-tense "is migrating" / "the grind" framings; ClassifiedCorpus.coveredLeaves()’s javadoc stopped describing the union net slice 3 retired (it claimed an enum row may retire once its leaf is covered there, which would license an unsafe deletion); and the `classified-corpus skill was reframed additive-first with its substrate de-rotted, having cited three symbols that no longer exist (LeafTupleAdapter, ProducerStep, Mapping), the pre-R316 two-axis (producer, mapping) vocabulary instead of (source, operation, target), the retired union net as its retirement safety net, a renderer caveat about absent fragment and input-type-closure support that has since landed, and the exhausted whitelist as step 1’s starting point, plus two contradictory guardrails about trusting VariantCoverageTest (resolved: it proves leaf coverage, not coordinate coverage). Still open and unowned by any item: the audit’s Excluded by rule note promises "a separate mechanism replaces these" for the rejection rows, the largest remaining block in the enum.

R526 (4ae2ce6 core, reviewer-pass javadoc altitude fix in the approval commit; filed 6c89e93, Backlog → Spec bb6c646, Spec → Ready 2218558, Ready → In Progress 665d9ec, In Progress → In Review c22bb0d): Six comment claims the R524 trimming sweep routed out because each needed a code-level decision, resolved per site, with two of the routed premises overturned by investigation rather than transcribed. GraphitronType.JooqTableRecordType now names both fqClassName populations (reflected table-record class vs the stand-in mints that assert only a projected-row source) and points at PojoResultType’s permit-identity split as the intended carrier, without blessing the null; `ReturnTypeRef.ResultReturnType states the copy contract (null exactly when the source component is) and TypeClassification.JooqTableRecord’s third restatement was aligned in the same edit. The garbled `InputType sentence is reconstructed against the code, not the spec’s draft: an input carrying @table always classifies as TableInputType because TypeBuilder.buildInputType short-circuits before the binding resolver runs, so the @table disjunct the spec proposed was false and the two real sources (the reflected method parameter the input flows into; the enclosing bound input’s accessor for a nested input) are named instead, with TypeClassification.PojoInput and PojoInputType’s own false "not specified in the directive" attribution corrected alongside. The `ErrorChannel emit partition became compile-checked: a new sealed ErrorChannel.RouterDispatched (permits PayloadClass, LocalContext) partitions the hierarchy against Mapped, WithErrorChannel.errorChannel() widened to Optional<? extends ErrorChannel> so each field variant declares its narrowest partition as its own record component, and the catchArm / asyncRouterCall seams plus ChannelCatchArmEmitter.emit took the narrowed types ; retiring all three "Additive window" runtime throws, the emitter’s unreachable LocalContext arm, and its sentinel parameter. Reachability analysis first established there was no live bug (Mapped is minted only by FieldBuilder.buildServiceField and routes exclusively through the wrap fork), so the narrowing pins a property rather than fixing a defect. RecordBindingResolver#fromAnyProducer, its reachable set, and the set’s population are deleted; the one live reachability read already derives the fact at the read site. Five dead buildSplitQueryDataFetcher / buildRecordBasedDataFetcher cites resolved three ways, with GraphitronSchemaValidator’s guard rationale truth-verified arm by arm against `buildBatchedDataFetcher rather than renamed, and one rationale made honest: BatchedLookupTableField now routes through the same guarded arms, so its exclusion is stated as an unmade validator decision instead of the stale "not audited". Claim 3 was deliberately not patched here ; a local fix would have added a differently-worded fifth statement of the empty-slot On.ColumnPairs state R527 was about to delete, so the site went onto R527’s inventory instead and R527 has since removed it. Follow-ons filed: R528 (carrier shape), R529 (@tableMethod sub-shape build-time rejection), R533 (single-source the null-source-guard predicate). Reviewer-pass delta: FieldBuilder.buildServiceField’s javadoc named four service variants where eight now use it; restated at altitude per "principles are stated at altitude" so the inventory cannot rot again, and R536 filed for the always-empty `ErrorChannel.Mapped slots on the polymorphic and table-interface variants that the count discrepancy exposed. Independent-session In Review → Done review; full reactor green under -Plocal-db.

R417 (dbc1b87; Spec b381122, survey fix 7ed10f9, Ready 160bec6, In Progress 4665877, In Review f14ccc7): graphitron-sakila-example/README.md app section reconciled with the R399 jakarta-rest extraction. The "three files cover the runtime" framing and the dead GraphqlEngine/GraphqlResource/AppContext links are replaced by the one hand-written adapter, SakilaGraphitronApplication (linked; its gate-protected javadoc stays the single narrated copy) on the owned-connection path, with everything HTTP-shaped attributed to graphitron-jakarta-rest; the newExecutionInput() mention carries the placeholder-credentials caveat pointing at "Producing the claims payload", both README halves name their runtime path, the test-pattern section is restated as an invariant (HTTP tier under app/ with GraphQLOverHttpConformanceTest as the canonical exemplar, querydb/ in-process) instead of the rotted census, and the pom-shape sentence gains graphitron-jakarta-rest + Yasson. New enforcer ReadmeLinkIntegrityTest (@UnitTier markdown twin of ManualXrefIntegrityTest) fails the build on any dangling relative link in a reader-facing README.md, verified to bite on the pre-fix README’s three dead app/ links; modules.adoc now names this README as the one deliberately-maintained per-module README, with the guard as its enforcer. Ride-along: dropped the doubled graphitron-rewrite/graphitron-rewrite/ segment from the four live-doc GitHub URLs (docs/quick-start.adoc, docs/manual/tutorial/index.adoc). Routed out: R530, a manual how-to for the GraphitronApplication SPI adapter shape. Independent-session In Review → Done review re-verified the guard’s bite on the pre-fix README; full reactor green under -Plocal-db.

R335 (5016e6f; Spec f5de169, In Progress 38f38ad, In Review d856b77): The single classify-and-emit walk (R317) now classifies the whole reachable surface, not just the output composites: SchemaReachability’s child function descends the input edges (field argument types, input-object field types; `outputTargets renamed fieldTargets), survivor directive definitions seed their argument types (so federation__FieldSet on @key classifies), ClassifyingVisitor gained input/scalar/enum leaf arms, and the pre-walk leaf sweep in TypeBuilder.prepareForWalk was deleted. Leaf classification is now reachability-pruned exactly like output composites: a declared-but-unreached input/enum/scalar is absent from types(), including a SortDirection retained by the all-declared retainedSupportTypes() scan but reachable from no coordinate. The spec’s enabling fact (registry-read-free field classification) held lexically for FieldBuilder only; the transitive leaf reads were re-routed rather than worked around: keyed reads go through the new BuildContext.lookAheadVerdict (delegating to the memoized TypeBuilder.lookAheadVerdict), the scalar axis became the BuildContext.scalarVerdicts fixed point built beside the node/table/error indices, and classifyAndRegister now registers lookAheadVerdict’s verdict so a reachable multi-producer-rejected input re-registers the exact seeded `UnclassifiedType (equals-idempotent, typed RecordBindingMultiProducer payload preserved). Pinned by SchemaReachabilityTest.walkClassifiesLeavesAndPrunesUnreachedOnes, SingleWalkClassificationOrderTest.noInputTypeIsRegisteredBeforeItsDiscoveringFieldIsVisited, and R96RecordBindingPipelineTest.multiProducerInput_reachableThroughTheWalk_keepsTypedRejection. R531 filed for the classify-time registry-read meta-test. Independent-session In Review → Done review; full reactor green under -Plocal-db.

R525 (eaae5ff, filed ec86c95; collapsed Backlog → In Review flow): TenantFanOutExecutionTest.claimedButUnmappedTenant_failsTheRequestBeforeAnySql failed roughly one run in ten with no product defect: its redaction guard !e.getMessage().contains("99") collided with the random hex correlation id embedded in the redacted message ("An error occurred. Reference: <uuid>."), since a 32-hex-digit UUID contains the substring 99 in about one draw out of ten. The predicate now matches the full redacted template (An error occurred\. Reference: [0-9a-f-]{36}\., the shape GraphQLOverHttpConformanceTest.REFERENCE_MESSAGE already asserts), which proves the reference is present and that nothing else, tenant key included, rides in the message; a comment above the assertion records why a negative contains check is unsound against a correlation-id-bearing message. Sibling sweep found no other unsound instance (downedTenant’s `doesNotContain("tenant 2 is down") cannot occur in hex; GraphQLQueryTest’s `doesNotContain(wrongTypeId) probe is URL-safe Base64 starting with an uppercase letter, unrepresentable in a lowercase hex UUID). Independent-session In Review → Done review; full reactor green under -Plocal-db.

R494 (49e4b84, In Review 23d58e9; assessment 1bae5fe, Spec 6da07b0, Ready cdab0c8, In Progress 28e27e3): The hand-maintained SchemaDirectiveRegistry.GENERATOR_ONLY_DIRECTIVES survivor-filter set had drifted three names behind the declared directives (routine, asFacet, pivot), so their definitions and applications leaked into every emitted schema surface (the sakila schema.graphqls files and the programmatic GraphitronSchema/per-type classes), exposing build-time database internals such as routine names and column mappings to any introspecting consumer. The existing pipeline sweep SchemaSdlEmissionTest.emittedSdlCarriesNoGraphitronInternalSurface was blind to exactly this drift class because its oracle was isSurvivor itself. Fix derives the set instead of extending it: new DeclaredDirectives in rewrite.schema exposes the directive-definition names parsed from the bundled directives.graphqls, sharing a single parse with DirectiveSupportTypes (same resource, same derive-not-hand-maintain precedent), and GENERATOR_ONLY_DIRECTIVES now reads that set, so a directive is generator-only iff declared in directives.graphqls and the drift class is unrepresentable; the registry javadoc drops the severed "kept in sync with BuildContext DIR_*`" contract (the `DIR_* constants stay hand-maintained deliberately, as classifier lookup keys). The spot-check unit test became a 32-name containsExactlyInAnyOrder pinning test (mirroring DirectiveSupportTypesTest), which also guards against graphql-java ever injecting built-in directive definitions into the parsed registry; the emission sweep, now non-circular, extended from three to all five plugin executions (adds multitenant, multischemamutation). Independent-session In Review → Done review verified the regenerated sakila outputs carry no routine/asFacet/pivot definitions or applications (only survivor auth/oneOf applications remain programmatically); full reactor green under -Plocal-db. Surfaced by the R483 javadoc drift audit.

R97 (Phase 2 85d8be0, Phase 2b 30fde4b; Spec 8682ef0/47f6765, Ready 0993d11, In Progress 117bd9a, In Review 4f7326a): Consumer-derived input-table resolution, the slice of the @table-on-input deprecation that shipped. Phase 2 made the last TableInputType-gated call site (arg-level @lookupKey) consumer-derived: a plain (non-@table) input carrying @lookupKey re-derives its fields against the consuming field’s return table through TypeBuilder.resolveInputFields and builds the same TableInputArg the @table bridge produced (FieldBuilder.classifyPlainLookupKeyArg), so the composite-key lookup shape (FilmActorKey) no longer requires @table on the input; a field that does not resolve to a lookup column on the consumer’s table is a classify-time rejection naming that table, never a silent no-op. EnumMappingResolver.buildLookupBindings widened from a TableInputType to a resolved List<InputField> (both callers reach it fully resolved, so the SDL re-walk and its dead null arm went). With that arm consumer-derived and the mutation verbs field-relative, TypeBuilder.buildInputType is now directive-driven only (explicit @table → the deprecated bridge, everything else plain): the findReturnTablesForInput auto-promotion aggregate and the isUsedWithOverrideCondition routing gate are both deleted, so an input reused across tables resolves per-consumer instead of silently demoting. The LSP surfaces the inference: TypeClassification.PojoInput gained resolvedTables, read off each consuming field’s classified target (never a re-read @table), and the hover lists them per-consumer. Phase 2b gave UPDATE a field-relative write target by extending R515’s precedence ladder (return-derived table > @mutation(table:) > the deprecated input @table bridge): INSERT and UPDATE now share one resolver (FieldBuilder.resolveReturnCapableWriteTarget), UPDATE joined RETURN_DERIVED_TABLE_VERBS and TABLE_ARG_SUPPORTED_VERBS, rawArgUpdateRejection and the "@mutation fields only accept @table input" refusal are gone, and the unsupported-verb guard narrowed to {UPSERT}; the R332 deprecation warning gained a UPDATE-consumed clause. Coverage: plain-@lookupKey resolve/reject pipeline cases, per-consumer PlainFilter rewrites, four re-pinned auto-promotion cases, resolved-table hover cases, UPDATE carrier-equality cases (direct/single/bulk) with cross-check and no-write-target rejections, and a updateFilmReturnDerived sakila execution round-trip with @table dropped from the input; carrier equality, never code-string assertions. The remaining phases are their own items: R518 (argMapping grouping fan-out), R519 (remove-table-on-input-directive) ; now the home for the general @table-on-input directive removal ; and R520 (housekeeping). The shared axis rationale (fact-model framing, redundancy argument, what @table-on-input still drives) lives permanently in roadmap/concepts/consumer-derived-input-tables.html, referenced by R519, so this item’s deleted spec file leaves no dangling reference. Independent-session In Review → Done review; full reactor green under -Plocal-db (all 13 modules including the sakila PostgreSQL execution tier). Builds on R457/R514/R515.

R515 (bacfb99; review fixes 639e277; Spec 63f6efa, Ready 0faa819, In Progress 89b3d8f, In Review 3f109f8): INSERT derives its write target from the return side, so an INSERT input no longer needs @table. The write target now resolves by a precedence lattice symmetric with DELETE’s (R457) but with the return-derived rung DELETE structurally cannot have: rung 1 (preferred) is the return’s own @table ; a direct @table return, or a carrier payload’s single @table-element data field, both already carried by the classified model (TableBoundReturnType.table() / the structural payload scan’s DmlElementKind.Table); rung 2 is @mutation(table:) on the field, for the encoded-ID / scalar return whose return names no table (INSERT joins the single-sourced TABLE_ARG_SUPPORTED_VERBS, so the unsupported-verb guard narrows to {UPDATE, UPSERT} and the change flows to mvn graphitron:validate, the LSP, and the binding grounder automatically); rung 3 is the deprecated input @table bridge. It is a must-agree lattice: where rung 1 is present a present rung 2 or rung 3 must name the same table (rung-1-vs-rung-3 reuses the pre-existing requireDmlDataTableMatchesInputTable wording byte-identically; rung-1-vs-rung-2 rejects because the RETURNING projection reads from the write target), rung 2 silently outranks the rung-3 bridge (byte-matching DELETE), and a no-rung INSERT rejects with a message leading with the return-derived fix. The write-target fact stays single-produced: R514’s phase-portable MutationInputResolver.resolveDmlWriteTableRef gains the return-derived rung and both verb gates, so the classifier (FieldBuilder.resolveInsertWriteTarget, dispatched to from the new classifyInsertTableField / classifyInsertPayloadField mirroring the UPDATE/DELETE walker dispatch) and the binding grounder (RecordBindingResolver.groundDmlMutationField) cannot diverge; a pipeline-tier enforcer pins grounded-table == classified-write-target across all three rungs. INSERT is intercepted before the now-retired MutationInputResolver.resolveInput (its INSERT admission set ; admitMutationInputFields, rejectPlainColumnCollision, rejectInputFieldDirectives ; hoisted to shared statics and run over one resolved InputField list regardless of path; the field-derived path re-derives fields through TypeBuilder.resolveInputFields and mirrors GraphitronSchemaValidator.collectInputFieldRejections); the UPSERT deferral moves to the dispatch. The R332 @table-on-input deprecation warning is now actionable for INSERT: the encodedWriteTargetInputTypes carve-out is retired (its stated retirement condition met) and the warning fires on those inputs, naming the return-derived fix and @mutation(table:). Coverage: byte-identical carrier parity (payload single/bulk, direct @table return) between the @table-on-input and return-derived forms, the three rung-mismatch and outranking cases, the no-rung message ordering, admission-set parity across both paths (composite-@nodeId, plain-column collision, @lookupKey/@condition), the grounding-divergence enforcer, a sakila bulk INSERT execution round-trip with @table dropped, and the deprecation-warning flips; mutation.adoc / table.adoc / deprecations.adoc / code-generation-triggers.adoc updated. The In Review → Done review (a different session from the implementer) also landed two fixes on the revision (so this session is not itself the sign-off on those edits): an unresolvable @mutation(table:) naming under a present return-derived rung was silently ignored (rung 1 short-circuits the helper before rung 2’s name is validated) and now rejects like any unknown table, and prose referencing the retired resolveInput (a dangling {@link} in the grounder javadoc, plus EnumMappingResolver / DmlKind claims that INSERT still routes through it) was refreshed. Full reactor green under -Plocal-db.

Discarded: Bounded parallel execution substrate for tenant fan-out (tenant-fanout-parallel-execution, R510): absorbed wholesale into R46 (service-multi-tenant-fanout) as its "Execution substrate: bounded scatter" section and leading slices, once it was clear R46 is the scatter helper’s first and likely only caller; the principles consult on the R510 Spec had already flagged that shipping the substrate with its first execute-tier caller was the fallback if direct concurrency proofs proved impractical, and the R45 precedent (routing surface as an early slice ahead of its fetcher emission) covers the slice shape. Everything worth keeping carried over: the policy-neutral per-tenant Outcome scatter contract, executor/cap/timeout on the GraphitronRuntime constructor, the TenantConnections thread-safety rework with the straggler and re-entrancy invariants, and the considered-and-deferred full-async-fetchers record with its evidence trigger.

R511 (d9c4b95; Spec 2e4fe78, Ready f44fab4, In Progress 3d61fce, In Review f0516bd): A @splitQuery @service child whose key wrap is SourceKey.Wrap.TableRecord (the ergonomic Set<XRecord> service signature) rebuilt the parent’s DataLoader key by reading reserved __src_<col>__ aliases off env.getSource(). Those aliases exist only on an SQL-projected parent row (<Type>.$fields adds them under the reserved-alias scheme that fixed the multiset-alias collision); a @table type handed back raw by a @service (selectFrom(X) → Result<XRecord>, never through $fields) carries only the real columns, so every such child threw IllegalArgumentException: Field "__src_..." is not contained in row type at runtime, defeating a combination the manual already documented as supported. Fix makes GeneratorUtils.buildKeyExtraction’s `TableRecord arm runtime-adaptive on the source’s own type: a typed parent (source instanceof XRecord) is copied column by column by jOOQ field-identity (never a by-name into(...) map, so the multiset-alias collision cannot re-enter), and a generic SQL-projected row is rebuilt from the reserved aliases as before. Both arms mint a fresh record over the same allColumns() enumeration, so the produced key is structurally identical whichever path produced the parent and the live parent is never aliased as the DataLoader key. The fork follows the sanctioned "runtime shape of env.getSource() forks the read" pattern (dispatch-axes.adoc); it is emitted unconditionally rather than gated on a producer-reachability model fact (declined in the spec: a missed path in that walk would reproduce this very bug with the gate asserting it cannot happen; the unconditional fork degrades to one dead-but-correct arm instead of a crash). Producer side untouched: <Type>.$fields, RequiredProjection.reservedFullRow, and ParentProjectionContainmentCheck are byte-identical to pre-fix output. The discriminator’s basis (a $fields SELECT materialises a generic Record, never the typed subclass) is pinned by ServiceParentTableRecordKeyExtractionTest (graphitron-sakila-example internal tier), named in prose from the read-site javadoc rather than by {@link} because the pinning test lives in a downstream module off this module’s javadoc classpath. Coverage: the execution-tier spine filmsByService { titleTitlecase } (service-returned FilmRecord parent; pre-fix threw on the missing __src_ aliases) with the SQL-parent kind still pinned by the existing colliding-multiset fixture, the two-sided discriminator pin, and a ServiceProjectionPipelineTest shape predicate asserting the generated fetcher body carries both read families (shape assertion, not a code-string body pin). handle-services.adoc tightened to state the two-parent-kind mechanism plainly. Independent-session In Review → Done review; full reactor green under -Plocal-db.

R126 (26607a1/51559d3/e472187, In Review ab17c29, Spec 7658c81/994e7c3/6cf2c9b): Scrub the deleted classification vocabulary from prose across every surface. The retired SourceKey.Reader four-arm family (ColumnRead/SourceRowsCall/AccessorCall/ProducedRecordRead), the BatchKey.* permits (AccessorKeyedSingle/AccessorKeyedMany/LifterPathKeyed), SourceKey.Cardinality (bare Cardinality.ONE/MANY), and the Mapped{Row,Record,TableRecord}Keyed service-source shapes no longer exist as types, but still appeared in generator comments/javadoc, one main-source invariant message, test case-descriptions, sakila-service/sakila-example fixture prose and SDL comments, and the author-facing user manual, keeping rot alive in code search and misdescribing what the classifier produces today. Each dead arm maps one-to-one onto its live successor: Reader.AccessorCall/BatchKey.AccessorKeyed* → KeyLift.Accessor(AccessorRef, Arity); LifterPathKeyed/SourceRowsCall → KeyLift.Lifter(LifterRef); ColumnRead → KeyLift.FkColumns(); ProducedRecordRead → KeyLift.ProducedRecords(Arity); Cardinality.* → Arity.*; Mapped*Keyed → SourcesShape(SourceKey.Wrap.*, LoaderRegistration.Container). The mis-shaped SourceKey(Wrap.Row, parent.PK, ColumnRead, Cardinality.ONE) constructor prose (which named components SourceKey never carried) is rewritten as a KeyLift.FkColumns lift with a residue SourceKey over the parent PK. Identifier renames taken in full per the Spec → Ready sign-off (dead type names embedded in test-tier and fixture identifiers keep the vocabulary in code search): AccessorDerivedBatchKeyTest → AccessorDerivedSourceTest, GraphQLQueryTest.inventoryById_filmCardData_firesAccessorKeyedSingleLift... → ...firesAccessorLift... (with its computed-fields.adoc citation), four ServiceCatalogTest classifiedAsMapped*Keyed methods → classifiedAsWrap*, InterfaceFieldValidationTest.rejects_listArm_onAccessorKeyedMany... → ...onAccessorMany..., and the SDL-cited fixture methods TestFilmService.getRankMappedRecordKeyed / TestServiceStub.childServiceMappedRecordKeyedWrongScalarValue, each with its lockstep call sites. The scrub also corrected stale FACTUAL capability claims discovered on the same subsystem (all doc-only, verified against current code): the polymorphic parent-key path is not "follow-up work" (FieldBuilder.derivePolymorphicHubSource produces a KeyLift.Accessor key for class-backed parents, consumed by MultiTablePolymorphicEmitter’s `KeyLift.Accessor branch and pinned by KeyLift.checkResidueAgreement); classifyParticipantRoute does construct ParticipantCorrelation.JoinedCorrelation for multi-hop/condition routes (not a deferred rejection), emittable via branchBridgingJoins/singleBranchCorrelationWhere; ChildField.Transport has three live arms including WrapperArm; TableTargetField permits six variants, not eight; the error-channel carrier classifier shipped (FieldBuilder.resolveErrorChannel); a single-table discriminated @service interface routes to the sibling {Mutation,Query}ServiceTableInterfaceField leaf rather than being deferred; and two stale symbol citations (deriveBatchKeyFromTypedAccessor, TypeFetcherGenerator.buildScatterByIdxHelper) repointed to the live methods. The retirement-provenance carve-outs (mentions explicitly framing the vocabulary as retired, in model/Arity.java, Target.java, KeyLift.java, KeyLiftTest.java, SourceKeyTest.java) stay as documentation of the retirement. Pure doc/identifier scrub: one main-source string edit (the ParentCorrelation invariant message), no production-model, generated-output, or test-behaviour change; the existing tiers remain their own enforcer. Acceptance is the Spec’s sweep grep leaving only the enumerated carve-outs. Sibling item R504 owns the ChildField leaf-taxonomy vocabulary (Single/Record/Split*TableField), deliberately out of scope and not bled into. Independent-session In Review → Done review; full reactor green under -Plocal-db including RoadmapReferenceGuardTest and the javadoc {@link}-reference gate.

R500 (6cc947f, In Review 55818e7, Spec 9d1a788): Aliased duplicate reference selections (a: ref { x } b: ref { y }) minted duplicate SQL aliases, because the $fields selection switch projected each inline reference / computed field by its schema field name rather than its runtime result key: two result-key buckets sharing a field name fired the same arm and emitted two DSL.multiset(...).as("<fieldName>") terms under one alias (a loud duplicate-alias jOOQ error), and the source-only reads could not tell two aliases apart. Fix aliases the four families (list and single TableField, LookupTableField, ComputedField, Direct ColumnReferenceField) by "__rk_" + entry.getKey() on the write side and reads them back by "__rk_" + env.getField().getResultKey() on the read side, so each alias resolves independently; divergent sub-selections and divergent arguments across aliases both come out correct (each result-key bucket emits its own arm). The reserved prefix (GeneratorUtils.RESERVED_RK_ALIAS_PREFIX, single-homed for both sides beside the __src_ precedent) moves minted aliases out of the client-reachable namespace, so a client alias can never shadow a base column, a __src_ full-row alias, or __discriminator__ (an adversarial __rk_foo mints __rk___rk_foo, still distinct). The four families' reads move from source-only LightFetcher bindings to env-dependent bindings; scalar ColumnField / CompositeColumnField arms stay as-is (alias-independent typed-constant reads). Membership single-homed as the recommended design fork: a methodless marker ResultKeyAliasedField on the four families plus a build-time guard on each consuming side’s fall-through (TypeClassGenerator.emitSelectionSwitch’s `default arm and FetcherEmitter’s method-backed fall-through both throw when a marked variant reaches them unhandled), so a future alias-projecting variant that forgets either side is a loud generation-time failure. Two deviations from the Spec’s "pure emit-layer, no validator change", both forced by the reserved-prefix design and confirmed sound on review: (a) `GraphitronSchemaValidator.validateAliasKeyColumnCollisions (and its parentProjectionAlias cluster) was retired because a __rk_-prefixed alias can never equal a base column name, so the shadow it guarded is structurally impossible and leaving it would false-positive-reject now-legal schemas; its test was repurposed to ReferenceProjectionAliasNamespaceTest; (b) the single-table @discriminate base-slice (TypeFetcherGenerator.buildInterfaceFieldsList) hand-projects inherited references and shares the one result-key-aware read, so it now projects each inherited reference per selected result-key bucket, agreeing with the read on both the unaliased and aliased-duplicate paths (left unchanged it would have regressed even the unaliased allSubjects/allParties case). Coverage: unit/pipeline signature assertions (env-dependent method references, no code-string body assertions), ReferenceProjectionAliasNamespaceTest, and five execution-tier enforcers in GraphQLQueryTest (mixed aliased+unaliased scalar/computed, LookupTableField divergent args + sub-selections, list TableField duplicate, single-cardinality nested reference, adversarial __rk_-prefixed client alias). Independent-session In Review → Done review; full reactor green under -Plocal-db (all five new execution tests ran, none skipped). Two test-plan scenarios named but not shipped, both low-risk given the shared $fields/reserved-prefix mechanism and left as possible follow-up: aliased duplicates under an @asConnection query (edges.node / nodes), and a base-column-named client alias as an execution variant (its validate-time equivalent shipped in the pipeline namespace test). Sibling to R499 (within-bucket occurrence merge, orthogonal axis); surfaced during the R499 Spec trace.

R499 (0a399f5, In Progress 93e5d16, Spec f6d4d9e/1bb4ad6): A Relay connection’s <Node>.$fields projection built the SELECT from only the first occurrence of each shared result key, so selecting the same reference field under both edges { node { ... } } and nodes { ... } with divergent sub-selections dropped the diverging side’s columns and the mapper failed per row with a jOOQ "not contained in row type" error (silent null on that side). graphql-java’s getFieldsGroupedByResultKey() flattens the whole subtree, so the two paths collapse into one List<SelectedField> bucket per key; the loop bound sf = entry.getValue().get(0) and recursed over only that occurrence’s selection set. Fix moves the union onto the selection side: a new frozen-scaffold SelectionOccurrences (SelectionOccurrencesClassGenerator, registered in UtilSingleton.ALL) carries mergeByResultKey (concatenate every occurrence’s sub-selection into one insertion-ordered grouped map, so each arm still emits exactly one DSL.multiset(...).as(...) SELECT term per key rather than one per occurrence, which would mint duplicate SQL aliases), plus two consistency guards. Each type class now exposes two public $fields entries (DataFetchingFieldSelectionSet and List<SelectedField>) delegating to one private $fieldsGrouped switch loop; the inline TableField/LookupTableField arms descend via $fields(entry.getValue(), ...) and NestingField recurses over the merged map, so a sub-field requested under either path lands in the SELECT and each reader ignores columns it did not ask for. Divergence the single-name switch cannot represent fails loud as a GraphitronClientException (surfaced raw past ErrorRouter, not redacted): the name guard canonical(key, occurrences) is universal (runs per bucket before every dispatch, since occurrences disagreeing on getName() are two fields aliased to one key), the argument guard requireConsistentArguments is arm-scoped (emitted only where the arm consumes sf for runtime state, driven by the FromSelectedField predicate InlineTableFieldEmitter.readsSelectedFieldArguments; unconditional in the lookup arm whose input-rows helper always reads @lookupKey). Pure emit-layer fix: no classification, model, or validator change, one blanket frozen-scaffold compile-graph edge per type class. Coverage: SelectionOccurrencesClassEmitTest (scaffold signatures), OccurrenceArgumentGuardPipelineTest (guard emission tracks the predicate; lookup arm unconditional), and execution-tier ConnectionSharedResultKeyProjectionTest (10 tests: all four divergence directions on Store.customers, one level deep, a polymorphic searchConnection, argument divergence/agreement on customersFirstN, name divergence on aliased summary/info NestingFields, and a non-connection control). Out of scope and filed as R500 (aliased-duplicate result keys colliding on the SQL .as(...) alias); the whole-subtree flattening substrate stays as-is. Distinct from R481, which shares the "not contained in row type" symptom on a different path. Independent-session In Review → Done review; full reactor green under -Plocal-db (scaffold 5, pipeline 3, execution 10). Surfaced during runtime testing of the opptak subgraph against 10.0.0-RC27; spawns R500.

R484 (ae11947, In Review 608b793, Spec → Ready c1c0e5f): Purge transient roadmap references (R<n> / roadmap/<slug>) from string literals across the in-scope modules, and drop the Rejection.Deferred.planSlug field that rendered one. The structural centerpiece: planSlug is removed from the model, the deferred(...) factories collapse to deferred(summary) / deferred(summary, class), and Deferred.message() becomes a pure function of summary, so a deferred rejection can no longer compose a see roadmap/<slug>.md suffix onto the author-facing validator log or the runtime stub’s UnsupportedOperationException text. The field was unconsumed drift: nothing navigated it (the claimed LSP fix-it that read the slug never existed), its only two render consumers (the validator log surface and the validator-unreachable TypeFetcherGenerator stub) lose it cleanly, and the FieldBuilder DML-pair slug threading and TypeFetcherGenerator.deferredFor slug arg are dropped with it. Three string-literal habitats swept, each restating the fact or naming the live mechanism in prose rather than blind-deleting: author-facing rejection message literals (habitat A), internal invariant-throw messages (habitat B, e.g. "intercepted by their walker classifiers" replacing an R246 / R258 / R266 citation), and documentation text emitted into generated output (habitat C); plus the two @reference-path channel-bypass deferrals and the three synthesis-shim LOG.warn sites. Enforcement is one guard over two lexical habitats: RoadmapReferenceScanner gains a string-literal projection mirroring its comment projection (the same single lexer, appending in the string/char/text-block states instead of the comment states), and RoadmapReferenceGuardTest adds a pass over generator main-source string literals with its own scanned-file floor against a vacuous pass. The main-source scope is deliberate: habitats A/B/C all render to a consumer surface, whereas a test’s @DisplayName or assertion description citing an item as provenance renders to none, so the test tree is out of the string projection’s scope (the comment scan still covers test sources); CLAUDE.md and the scanner javadoc are updated to state this. Docs reconciled: typed-rejection.adoc drops the false LSP-fix-it claim, the planSlug field, and the non-existent StubKey.EmitBlock arm (from both the prose and the mermaid class diagram); four user-manual pages no longer promise a roadmap-path suffix. Test reworks assert on summary / stubKey rather than a slug, and RejectionRenderingTest pins message() both equal to summary and doesNotContain("roadmap/"). Subsumes and discards Backlog stubs R491 (habitat C + guard extension) and R493 (generated-output javadoc). Independent-session In Review → Done review (main-source scope confirmed faithful to the spec’s habitat set and FP-triage premise; guard, scanner, and rendering tests green, graphitron module compiles all call sites); full reactor green under -Plocal-db. Builds on R482 (comment/javadoc guard); subsumes R491/R493.

R488 (ab58f63, In Review 1432ff1, Spec → Ready 3b6ba97): Concept explainer pages declare the roadmap item(s) they back and cross-link them both ways from that one declaration. The page contract gains a second machine attribute on the <h1>, data-concept-items="R<n>[, R<m>...]", alongside data-concept-title: a comma-separated R<n> list (whitespace trimmed) naming the concept’s anchors. Three enforcers fire at build time naming the file, the same discipline as the title contract: well-formedness (each token R[1-9][0-9]*, required and non-blank), an allocated-id bound (n < changelog next-id, so a typo like R999 fails while a shipped item whose file was deleted on Done and a discarded item both pass, keeping shipped items legal anchors), and a kicker enforcer (each declared id must appear in the header kicker line, which now reads Concept explainer · R<n> · theme: <theme>, so the visible restatement cannot silently drift from the attribute). ConceptPages.readTitles (slug → title) is replaced by readPages (slug → ConceptPage carrying title + backing ids), taking the roadmap dir so it can read changelog.md’s `next-id: for the bound; generate, verify, and render-adoc staging all route through it, so every contract is enforced wherever pages are read. The live-vs-shipped question is resolved once in a new ConceptIndex: a declared id becomes a Live(id, slug) or Shipped(id) ItemAnchor (sealed, each variant carrying exactly its fields), plus a reverse index from item id to slug-sorted explainer slugs; render sites switch exhaustively over the resolved outcome and never re-derive liveness, mirroring the mapHref one-place discipline. Both directions derive from the declaration: item side, an explainer link follows the plan link in the README Active table and status board and a parenthesized link on Backlog/Deferred lines, one per backing page in slug order, only for live anchors; concept side, the Concept explainers listings annotate each page (backs R<n>), linked to the item plan when live and plain text when shipped. The one shipped page (per-participant-child-join-paths.html) is refit with data-concept-items="R458" and the kicker update, proving the Shipped arm live (below next-id, no listing link, plain-text annotation); the Live arm is covered by tests. The explainer skill contract documents the attribute, the kicker format, the generate-time derivation, and the refresh-time preservation rule (the attribute is authored, not a derived region). Coverage: ConceptPagesTest extended to 35 (items parsing incl. whitespace/missing/blank/malformed; allocated-id bound incl. the n == next-id boundary and the shipped-but-below case; kicker enforcer; readPages shape and absent-directory empty; ConceptIndex Live/Shipped resolution and slug-sorted reverse index; README and status-board rendering of both link directions incl. two-pages-one-item and the drift property; stage enforces the contract on every staged page). Out of scope and unchanged: backfilling beyond the one page, the tool-injected backlinks refinement (a distinct concept-to-item relation), and the by-theme views. Independent-session In Review → Done review; roadmap-tool green (122 tests, ConceptPagesTest 35/35) and README regenerates with no drift.

R483 (per-slice 2f2dcb8/a40a2e4/da2a248/5fe681d/e7a4a25/434dc90/44a9931/557f332/2f55024/19f4481, outcome + follow-ons 2d4b6c2, In Review d4ff640): Audit javadoc for drift against the current design and implementation across every in-scope module, correcting what had drifted and leaving each module more mechanically pinned than it was found. Ran as a 34-batch reader-plus-verify fan-out over all 517 main-source files (the module rows sub-batched at ~18 files so each was read by exactly one reader; the 7,648-line FieldBuilder was drift-marker-grepped rather than full-read), landing 89 net edits (90 applied, 1 reverted by the adversarial verify stage, which restored a live GeneratedSourcesLintTest.FORBIDDEN_IMPORTS-backed rationale a reader wrongly took for dead narration). The unit of work was not "rewrite prose to match code" but convert an unpinned claim into a form something mechanical breaks on: dead design narration deleted, live-symbol claims relinked to {@link} (now build-enforced by R492’s check-link-references gate), and load-bearing claims that could not be cleanly deleted or relinked routed to follow-ons rather than rewritten into fresh confident prose (the central hazard). The R492-seeded findings were resolved against real current symbols: ChildField.SplitLookupTableField repointed to the live BatchedLookupTableField, the retired BatchKey classification vocabulary corrected to the current KeyLift.* / SourceKey.Wrap.* names, and the stale legacy-GraphQLGenerator clause deleted. Six Backlog follow-ons were filed for still-unpinned load-bearing claims: R493 (roadmap ids in generated-output javadoc), R494 (SchemaDirectiveRegistry.GENERATOR_ONLY_DIRECTIVES out of sync with BuildContext DIR_ROUTINE/DIR_AS_FACET, a possible correctness bug), R495 (InputRecordGenerator service-audit javadoc contradiction), R496 (MappingsConstantNameDedup two-vs-three ErrorChannel arms), R497 (FederationSpec.URL caller census drift), R498 (RAG dev-warm hint pointing at a nonexistent doc section). All 12 ledger rows recorded a pass (10 with SHAs, graphitron-jakarta-rest and graphitron-sakila-example no-drift). Independent-session In Review → Done review (edits confirmed comment/javadoc-only, seeded findings and three spot-checked follow-ons verified against current code, every relink resolved); full reactor green under mvn install -Plocal-db with the R492 reference gate and RoadmapReferenceGuardTest active. Sequenced after R482 (de-noised surface); depends on R492 for relink to count as a real pin; spawns R493-R498.

R492 (adfcb5a, In Review e0baef1; Spec c5d284e/15ce2a0, Ready 78b9933): Add a {@link}/{@see}-reference-validity gate to the routine build, so a dangling doc link fails verify instead of compiling clean and shipping. javac ignores javadoc and the only prior resolver was the release profile’s javadoc jar, so a rename silently orphaned every {@link} naming the old symbol; in a text-editing multi-agent workflow the IDE-refactor tracking {@link} used to carry was near-zero protection. The gate binds the maven-javadoc-plugin javadoc goal (its own resolver, not a hand-rolled scanner that would have to reimplement import/nested/inherited/classpath resolution) with <doclint>reference</doclint> (only the reference group, not the missing-@param firehose) to verify in the main <build> — deliberately not an activeByDefault profile, which Maven silently deactivates whenever -Plocal-db is named; the fast-local escape reuses the existing maven.javadoc.skip lever that -Pquick already sets, and CI’s single mvn verify -Plocal-db picks it up for free. Turning it green meant driving the 41 pre-existing broken references to zero (measured graphitron 30, graphitron-sakila-service 10, graphitron-lsp 1): resolvable links were qualified or FQN-labelled and kept as checked {@link} (nested variants, cross-package public symbols, two cheap repoints OutputField#source(Arrival) and Table#getReferences()), while genuinely unresolvable targets — generated-runtime symbols, package-private cross-package, non-dependency cross-module, and dead symbols — were converted to {@code} (not the prohibited downgrade, which is only rewriting a resolvable link). Retired-vocabulary drift (BatchKey arms, ChildField.SplitLookupTableField, the legacy GraphQLGenerator clause) was flagged into R483’s seeded-findings rather than guessed at. Anti-vacuous-pass guard: JavadocReferenceGateTest pins that the gate is bound in the main build (not a profile), that no covered module opts out with maven.javadoc.skip, and that covered modules have hand-authored sources; the sourceless/generated-only modules are structurally exempt. development-principles.adoc had its now-false "`{@link}: no audit infrastructure" grade rewritten to name the gate (still under the `DocSizeBudgetTest word budget) and CLAUDE.md documents the -Pquick skip. Independent-session In Review → Done review (gate verified live per covered module, a planted dangling {@link} confirmed to fail the build, no prohibited {@code} downgrades on spot-check across every category); full reactor green under mvn install -Plocal-db (unpiped exit 0; one transient BgeEmbedderOnnxTest similarity flake under parallel load, unrelated, passed on rerun). Prerequisite for R483’s relink tool to count as a real pin; sibling to R482.

R314 (d1f13a2 site-level fact + command registry + bidirectional oracle, 7137d1e/4abde9e slices 2a/2b, 4e04345 slice 3, 11122a4 slice 4, 1158c14 slice 5, 88ddf90 docs sweep + In Review; plan 6590535, architect-consulted): Dissolve the re-fetch (reentry) leaf fields ; the reentry family becomes the first emit family driven by the R333 model instead of leaf identity. Slice 1 landed the site-level fact OutputField.emitsKeyedReQuery() next to the value-level requiresReFetch() (false exactly on the root @service passthrough, whose re-projection is realized by downstream $fields), the main-source methodgraph command/name registry (MethodCommand + MethodCommandRegistry, the name authority: emitters obtain the declaration name from the commit, whose gate reads the site-level fact, so a parallel register-beside-the-formula census shape is not constructible) surfaced on GenerationResult.methodCommands(), and thread I’s level-2 bidirectional closure oracle (ReentryCommandClosureTest: model → command, command → emit, exactly-one, plus non-vacuity witnesses and the root-passthrough / table-sourced-split boundary pins). Slice 2a merged buildSplitQueryDataFetcher + buildRecordBasedDataFetcher into the one source-shape-gated buildBatchedDataFetcher (the stored SourceShape gates exactly the two facts it owns, key lift and Outcome/LocalContext prelude; byte-identical sakila output). Slice 2b landed TableExpr.MethodCall as its javadoc reserved and dissolved RecordTableMethodField onto the record-sourced BatchedTableField arm (the developer’s method is the terminal hop’s materialization fact rendered by the shared table-expression switch; SqlRecordTableMethod permit retired; the runtime-stubbed empty-path/multi-hop shapes upgraded to classification-time rejections). Slice 3 stated the seam-worklist row-15 verdict (channel catch / early-return arms stay folded into the Fetcher on the service reentry path) and pinned its load-bearing premise as an enforcer (validateServiceTableField rejects a reentry service field carrying a present error channel), with root service leaves documented as value-level-re-fetch-without-site-level-re-query. Slice 4 moved the projected/discriminated DML follow-up SELECT into named rows<Name> companions (model-carried DmlTableField.reentryRowsMethodName(), minted through the registry; transaction boundary and no-match guard stay in the fetcher; SQL byte-equivalent), completing registry coverage of the whole family; the correlation stays keys-IN as recorded residue with named successor R489 (dml-reentry-values-join-rendering, which also records the RoutineWrite conditional). Slice 5 retired the validator’s dispatchPerformsReFetch mirror and landed the replacement reentry implementedness guard (site-level fact on a leaf outside BatchKeyField/DmlTableField → ValidateMojo error) in the same commit, no window. Acceptance held: R305 reentry execution tier green (SingleRecordPayloadDmlTest, SingleRecordTableFieldServiceProducerExecutionTest), @classified corpus classifying unchanged, level-1 closure oracle green throughout, bidirectional oracle passing for the reentry family. Gate review fixed three doc-level residues (an R-number leak in split-vs-inline.adoc per the workflow’s user-facing-doc check, the registry’s stale pre-slice-4 DML paragraph, a malformed javadoc indent in ChildField) and verified the full reactor green under mvn install -Plocal-db after remediating two sandbox artifacts unrelated to the diff (stale DB seed predating R458’s category_label, then a stale jOOQ schema-version marker stamped against the old seed). Independent-session In Review → Done review. Builds on R305/R316/R333/R431/R432/R461/R463; run-up R431 → R432 → this item held; feeds R471 (direct-SQL OnlyChild emit) and R489.

R482 (d482a79, follow-ons filed da0cc2c): Purge transient roadmap-item citations (R<n> / roadmap/<slug>) from every comment and javadoc region across the in-scope modules, and install a build-time guard against reintroduction. Roadmap items are transient (renumbered, shipped-and-gapped, or discarded), so a comment that leans on one is stale the moment the item moves; each citation was stripped with its prose kept (the default), relinked to a live {@link} where it stood for a symbol, or deleted only when the sentence carried nothing but the pointer, deliberately preserving any load-bearing design claim so the drift audit keeps its raw material. The payload is the guard: RoadmapReferenceScanner (a lexically-scoped detector that inspects only comment/javadoc regions and strips string/char/text-block literals, mirroring the roadmap-tool AsciiDoc-table block discipline), RoadmapReferenceGuardTest (a graphitron unit-tier meta-test that walks the in-scope module trees via a repo-root anchor and fails the build on any surviving citation, with a scanned-file floor so a drifted walk cannot pass vacuously), and RoadmapReferenceScannerTest (pins the detector contract: string/text-block/char literals not flagged, permanent-artifact slugs allowlisted, line-comment-ends-at-newline regression, planted reintroduction caught). The soft half is the CLAUDE.md "Javadoc conventions" rule. String-literal habitats stay out of scope: user-facing rejection/deprecation message slugs are R484, roadmap ids baked into generated javadoc via generator string literals are R491; the source-direct payload errors-object-slot migration surfaced by a stripped pointer is R490. Independent-session In Review → Done review; full reactor green under mvn install -Plocal-db (guard tests RoadmapReferenceGuardTest 1/1, RoadmapReferenceScannerTest 11/11). Spawns R490/R491; separated from R483/R484.

R481 (f5b2eb5/f1515fa, In Review 3a67937, Spec → Ready 0be64fa): Multi-table polymorphic interface/union child fields honor the parent-projection contract, closing the R425 walk-omission family for the correlation reads their fetchers make off the parent row. Before, ChildField.InterfaceField/UnionField fell into the default -> {} arm of TypeClassGenerator.collectRequiredProjection, so a parent-holds-FK participant (self-FK navigate-to-parent, or a cross-table FK like store.address_id → address) whose parent-side correlation column no client selection projected crashed with IllegalArgumentException: Field "<fk-col>" is not contained in row type at single cardinality (gap A) or extracted a null DataLoader key on batched forms (gap B); every existing execution test masked the width of the gap by happening to select a field mapping the parent key. Fix introduces one orthogonal ParentRowDemand capability (a standalone List<ColumnRef> parentRowColumns() interface, mirroring BatchKeyField) carrying the whole projection demand, implemented by TableMethodField (its single-FK-hop source-side columns; the existing dedicated arm collapses onto the capability) and by the polymorphic InterfaceField/UnionField, cardinality-forked: single returns the union across participantJoinPaths of what MultiTablePolymorphicEmitter.singleBranchCorrelationWhere reads (KeyTupleWhere slot / JoinedCorrelation FK hop-0 slot sourceSide() columns; the parent bound key for a condition hop-0; On.Lateral hop-0 throws), list/connection returns parentSourceKey.columns() (the batched key extraction). Three walks consume it keyed on the capability, never on leaf identity: collectRequiredProjection (capability arm + record-source tripwire extended to ParentRowDemand), ParentProjectionContainmentCheck (capability-keyed requirement enumeration alongside the BatchKeyField one), GraphitronSchemaValidator.collectBaseNamedKeyColumns (capability arm replaces the TableMethodField case). Gap C (batched parent-holds-FK correlation, a genuinely absent capability) is closed at build time only: FieldBuilder.classifyParticipantRoute threads field cardinality and rejects DEFERRED, keyed to R487’s slug, a list/connection field whose resolved correlation reads a parent-side column outside the parent/hub table’s primary key (a condition hop-0 correlates on the bound key and is exempt), steering toward single cardinality where the relationship is single-valued. Coverage: ParentRowDemandTest (unit, the cardinality fork across the three correlation shapes), MultiTablePolymorphicParentHoldsFkPipelineTest (single-cardinality off-key classification, the gap C rejection on auto-discovery / explicit @referenceFor / multi-hop hop-0-on-parent arms, list child-holds-FK still classifies), MultiTablePolymorphicParentHoldsFkExecutionTest + a new parentRef fixture in MultiTablePolymorphicSelfFkOrientationExecutionTest (projection-independence proofs that select no parent-key-mapped field; the cross-table twin uses Store.contact over address/staff participants, whose nullable store.manager_staff_id gives a deterministic single-branch match on store 2, where a Customer union over two NOT-NULL FKs would be non-deterministic); no code-string assertions on generated bodies. Docs: one constraints sentence in polymorphic-types.adoc. Independent-session In Review → Done review; full reactor green under mvn install -Plocal-db. Builds on R458; spawns R487 (batched-polymorphic-parent-holds-fk-correlation).

R458 (slice 1 cbb6eb1, slices 2-3 5968d53, rework 4bf1d0c, In Review 7fade80, Spec → Ready 482c693): Per-participant explicit join paths on single-cardinality multi-table interface/union child fields, the deferred capability R452’s rejection gate points at. A new repeatable @referenceFor(type: String!, path: [ReferenceElement!]!) on FIELD_DEFINITION states one participant’s join path from the parent table, overriding single-FK auto-discovery for the named participant only (participants left unnamed keep discovery); path reuses the @reference ReferenceElement grammar unchanged. The syntax consult rejected reviving @multitableReference (its routes: input-wrapper splices the type and path axes) and extending @reference/@discriminate (grain: the correlation is a fact of the (field, participant) pair, and repeated @referenceFor applications are keyed by type: and independent, the opposite of @reference’s concatenating chain, a contrast the reference page carries). Model: a two-arm sealed `ParticipantCorrelation on ChildField.InterfaceField/UnionField, decided once at classification: KeyTupleWhere(On.ColumnPairs) (the branch joins nothing, parent side is bound values, single form) for single-hop FK routes (auto-discovered, multi-FK-disambiguated, same-table self-FK), and JoinedCorrelation(List<JoinStep>) (the branch joins real tables) for multi-hop FK chains and any route carrying an On.Predicate hop; participantJoinPaths becomes Map<String, ParticipantCorrelation> dispatched exhaustively by all three cardinality emitters (single buildStage1Block, batched list, batched connection). Sliced: slice 1 shipped the directive, classification, carrier generalization, and the multi-FK / same-table-self-FK cases (both lower to KeyTupleWhere), turning R452’s rule 1b (same-table participant) and rule 1c (auto-discovery FK-count failure) messages into live steers to @referenceFor; slice 2 the multi-hop all-FK chains (declare one aliased local per intermediate hop, bridge back toward the parent via JoinPathEmitter.emitBackwardBridging, value-bind hop-0 against parentRecord/parentInput); slice 3 the condition correlation (join the aliased parent table bound to the parent’s key, apply the two-arg condition between parent and participant, intermediate filter: hops ANDed onto the branch WHERE). Slice-1 review fixed an orientation bug (every @referenceFor route was resolved with a hardcoded isList=false, so a list/connection field with a same-table self-FK route got the single-valued slot orientation, silently wrong rows; cardinality is now threaded into both explicit and auto-discovery resolution, pinned at pipeline and execution tiers) and filed the latent parent-holds-FK projection crash as R481. Slices 2-3 review found and the rework (4bf1d0c) closed a silent-wrong-data hole: a hop-0 filter: (a {key:, condition:} heading the path) was dropped, not rejected, in both arms (KeyTupleWhere carries only the FK column pairs; JoinedCorrelation’s `appendHopFilters/hopFilterTerms reads only intermediate hops i>=1), so FieldBuilder.classifyParticipantRoute now rejects a hop-0 filter structurally before the carrier fork, naming the participant and steering to a pure {condition:} first hop (which joins the parent alias) or an intermediate-hop filter; both shapes pinned at the pipeline tier. Docs: new referenceFor.adoc reference page with the constraints, the repetition contrast, and the hop-0-filter exclusion carved out (the Done pass corrected the constraints bullet’s meaning-inverting wording). Coverage: MultiTableChildReferenceForPipelineTest (17, classification + all structural/deferred/hop-0-filter rejections), execution-tier MultiTablePolymorphicJoinedCorrelationExecutionTest (multi-hop film -> film_actor -> actor, condition via an EXISTS-over-film_actor, auto-discovered inventory sibling keeping the field multi-table) and MultiTablePolymorphicSelfFkOrientationExecutionTest (list-direction self-FK on a category hierarchy). Independent-session review across slices; In Review → Ready → In Progress → In Review → Done. Full reactor green under mvn install -Plocal-db. Builds on R452 (the build-time gate + type lift, hard dependency); feeds R481. Out of scope: root-level (query) multi-table polymorphic fields (R382 / R76), per-participant fieldsJoin/orderBy emission (R76), and the connection-form and intermediate-hop-filter: execution fixtures (noted acceptable, the connection form shares the batched-list correlation path).

R486 (8aab6a6/c3c2be1, In Review 82846ff, Spec → Ready d1a8ba1): A roadmap-adjacent developer explanation space at roadmap/concepts/<slug>.html, intuition-first HTML background pages for dense or recurring roadmap concepts, distinct from both Diataxis trees and linking into them wherever a concept is covered as-built. The link plumbing is "one classification, two emitters": the target-kind knowledge inline in Main.mapAdocTarget is extracted into a sealed LinkTarget taxonomy (plus new ConceptPage and DeepDocsPath cases), the AsciiDoc emitter is refactored onto it behavior-identically, and a new HTML href emitter in ConceptPages formats the same classification for the concepts-page context, with a cross-Done fallback landing links to shipped (deleted) items on the changelog rather than a 404. The extraction was pinned first: 8aab6a6 captured characterization assertions for every pre-refactor mapAdocTarget branch (external, anchor, sibling, README, changelog, workflow redirect, arch quadrant-mapped and non-quadrant, top-level, legacy module, web-environment, unknown) so the round-trip table pins pre-refactor behavior rather than ratifying the refactor’s own output. ConceptPages also owns the data-concept-title contract (missing or blank fails generate, verify, and render-adoc alike, naming the file), the render-adoc staging step (hrefs rewritten repo-layout → site-layout, assets copied byte-for-byte), and the derived "Concept explainers" listings on the README roll-up and the status board (scanned from the directory, never hand-maintained, so verify catches listing drift). docs/pom.xml gains a <resources> entry carrying the staged pages into generated-docs. The R458 sketch page is refit onto shared concepts.css / concepts.js with the shared header, title attribute, derived-region fences (derived:status / derived:backlinks, owned by the skill’s refresh mode), and an em-dash sweep. The explainer skill encodes the page contract and the generate/refresh intents. Coverage: LinkTargetRoundTripTest (14, adoc direction), ConceptPagesTest (17, href direction + title contract + listings), all 104 roadmap-tool unit tests green; integration verified by a full docs build under which the WARN-fail asciidoctor render passes with the staged page and every href in it (items, changelog, index, manual, architecture, assets) resolves to a real file in generated-docs. Independent-session In Review → Done review. Out of scope and named as follow-ups: tool-injected backlinks at staging time (the drift-free successor to the authored backlink list) and fan-out to further concept pages via the skill.

R432 (3b873c3/9253bca/f6ebfaf/75f0b19, In Review 75f0b19, Spec → Ready df29e28): Collapse the four batched keyed-re-query leaves onto two source-gated ones, the R333 "First slice" beachhead and the first executable proof of the 2026-07-04 re-query unification resolution (full merge, laundered key). SplitTableField + RecordTableField merge into BatchedTableField and SplitLookupTableField + RecordLookupTableField into BatchedLookupTableField, each gated on a stored SourceShape (Table | Record) and spending R431’s types: the lift becomes total, the split arm now carrying KeyLift.FkColumns alongside its SourceKey(entryColumns, Wrap.Row) (the census established the stored difference was exactly one KeyLift lift component and the derived-method fork was emitsSingleRecordPerKey’s `|| LOAD_MANY disjunct, unreachable on the split arm). The gate is stored, not derived, since FkColumns is legitimately carried by both a table-row parent and a jOOQ-record-backed result parent. Six compact-ctor invariants pin the merge (BatchedTableField): total-lift residue agreement + carrier invariant (both arms), and Table-gated sourceShape==Table ⟹ FkColumns (checked-not-structural, the one-model discipline weighed against a second source-shape representation), Record ⟹ non-Connection, the R435 routine-surface pins + OnLateralArgs-nonempty-key guard, and Table ⟹ LOAD_ONE (deriveSplitQuerySource’s former prose guarantee made structural, which is what keeps the unified emitsSingleRecordPerKey formula behavior-identical on the split arm); the lookup leaf mirrors 1/2/3/6, with 4 deliberately absent (a Connection-shaped lookup is an author-reachable schema the validator rejects on both arms, not an unrepresentable generator state). The fresh names are load-bearing, not cosmetic: reuse would let existing narrowing sites (collectRequiredProjection’s `BatchKeyField arm, NESTED_WIREABLE_LEAVES) silently start receiving record-sourced instances, the exact R425 bug family, so every switch arm / instanceof / set membership is compiler-forced through the rename. Slice 1 (3b873c3) shipped the R333 parent-projection containment check ahead of the merge: ParentProjectionContainmentCheck cross-checks the audited collectRequiredProjection walk against an independent demand enumeration at the $fields emit site, keyed on BatchKeyField + sourceShape()==Table (never leaf identity, so slices 2-3 do not touch it) and walking the classifier’s flat field index with its own nesting worklist rather than borrowing the audited recursion (R425’s omission lived inside that recursion); a divergence throws IllegalStateException as a generator invariant (documented at the throw site as deliberately not a typed Rejection, per the Spec → Ready reviewer note), and the unit fire-case is the nesting-omission shape (the R425 family), not a bare set mismatch. Validator set-membership converts to source-gated predicates preserving the pre-merge asymmetries (Table-sourced absent from the LocalContext allow-list, Record-sourced not nest-wireable, RecordLookupTableField still absent from the LocalContext set). The fetcher fork stays behind one sourceShape seam (Table via buildKeyExtraction, Record via buildRecordParentKeyExtraction with the Outcome prelude + null-source guard); unifying the two renderings is R314’s re-platforming, deliberately left forked here so the beachhead does not become the invasion. Slice 4 (75f0b19) reframes the whole KeyLift axis in dispatch-axes.adoc per the reviewer note (from "record-parent lift provenance" to "how the key tuple is lifted off the held jOOQ record", leading the storage rationale with "a total lift removes an absence case and tells no lie" and R314 provisioning as the bonus), plus code-generation-triggers.adoc, the KeyLift/FkColumns/BatchKeyField javadoc, regenerated supported-schema-shapes.adoc + inference-axis-coverage.adoc, and R333’s leaf shipped-notes. Coverage: ParentProjectionContainmentCheckTest (the load-bearing acceptance, unit-proven able to fail on the recursion-omission shape and to pass across the corpus), SourceShapeProjectionTest (the stored-fact-vs-walk cross-check, now stronger than a leaf-identity tautology), GeneratorCoverageTest (dispatch partition exhaustive-and-disjoint), the pairwise-merged BatchedTableFieldValidationTest / BatchedLookupTableFieldValidationTest, renamed BatchedTableFieldPipelineTest, ReFetchDerivationTest, StubbedVariantPipelineTest, and the @classified corpus (renames-only, no verdict delta); no code-string assertions on generated method bodies. Acceptance held: generated output across the sakila corpus was byte-identical to the pre-merge baseline (diff -r empty) on slices 2 and 3, so execution-tier equivalence and fact-level classification stability hold trivially. Independent-session In Review → Done review; full reactor green under mvn install -Plocal-db for the R432-bearing tiers (all graphitron unit/pipeline/execution/audit tests pass), with the sole failure the unrelated BgeEmbedderOnnxTest ONNX-native-binding infrastructure test in graphitron-mcp (a module R432 touches zero files in), flaking on degraded embedding numerics in the web sandbox exactly as the R13 changelog recorded. Depends on R431 (Done); is R333’s beachhead; feeds R314 (which retires the forked fetcher rendering) and keeps the R425/R426/R436 parent-projection regression suites green.

R431 (bab6f35/9c8261b/3229cbe/2ae8529/6c610e7, In Review bdb024c): Decompose the conflated six-component SourceKey (target, columns, path, wrap, cardinality, reader) onto the model’s separable facts, eagerly and mechanically, ahead of the R314 reentry re-platforming and as the type R432 depends on. Landed additive-then-cutover in four slices, each byte-identical against a clean baseline: slice 1 (bab6f35) deleted the denormalized target copy, its four readers migrating to a caller-supplied keyOwnerTable / the leaf’s own returnType.table(), with the null-target case landing as a typed ReturnTypeRef arm rather than a re-invented null; slice 2 (9c8261b) deleted path and retired the transitional JoinStep.LiftedHop onto a hop-less ParentCorrelation.OnLiftedSlots(targetTable, columns) arm (the four defensive unreachable emitter arms became type-level impossibilities, the HasSlots capability died into On.ColumnPairs, and the two empty-path compact-ctor invariants are now pinned structurally); slice 3.1 (3229cbe) moved the arrival-vocabulary half of Cardinality to a top-level Arity enum on the producer/carrier endpoint facts (deliberately not R463’s accumulated Arrival); slice 3.2 (2ae8529) shrank SourceKey to the (columns, wrap) residue (which earns the name), relocated the four live reader arms to the new sealed KeyLift fact (FkColumns / Lifter / Accessor(ref, Arity) / ProducedRecords(Arity)) carried by the three record-parent leaves and, as parentKeyLift, by InterfaceField / UnionField (the required parentSourceKey re-typing), dissolved the service arms into the MethodRef.Param.Sourced signature and ResultRowWalk into SingleRecordIdField plus the first-class SourceEnvelope enum, and deleted the Reader seal; slice 4 (6c610e7) consolidated the repeated bridging-join emit switch into JoinPathEmitter (R438 cleanup 2). Wrap is stored where authored (split/service) and derived via KeyLift.wrap() where inferred, with KeyLift.checkResidueAgreement as the constructor tripwire; the "hard" ResultRowWalk(OUTCOME_SUCCESS) => Wrap.TableRecord invariant is re-asserted (strictly stronger, unconditionally) at its named join site, SingleRecordIdField’s compact constructor. Docs: the `dispatch-axes.adoc chapter is rewritten onto the residue/lift/envelope/arity model with inbound xrefs retargeted. Coverage: unit-tier KeyLiftTest and SingleRecordIdFieldKeyShapeInvariantTest pin the migrated invariants, SourceKeyTest migrated alongside, no code-string assertions on generated bodies; the R425/R426/R436 pipeline and execution suites pin the migrated emit behaviors and stayed green. Independent-session In Review → Done review; full reactor green under mvn install -Plocal-db (all 13 modules, 8176 tests, 0 failures). Follow-ups: R485 (fk-hop-narrowing-helpers, the thinly-coupled R438 cleanup 1, spun out as explicitly permitted when the item ran long) and R180’s deferred per-column accessor lift; feeds R432 and R314.

Discarded: Fold InputType and TableInputType under sealed parent InputLikeType (input-like-type-sealed-parent, R171): the item proposed tightening the input-type hierarchy with a sealed InputLikeType parent, the opposite direction from the dimensional pivot, which dissolves the input-type hierarchy entirely (R97 / R222 / R333). R222’s absorption ledger already recorded it as dissolving; with the team committed to R333 landing, keeping the item is noise that risks someone doing negative work against the pivot. Discarded per user decision 2026-07-15 rather than left as a superseded-pending Backlog entry. R222’s ledger line updated to note the discard.

Discarded: Support @tableMethod under a table-bound NestingField (tablemethod-under-nested-type, R277): @tableMethod is deprecated and withheld from the v1 surface (R400); @routine covers the pressing need it was chasing. Rather than build out nested-depth support for a directive that is not exposed (and that R288 separately flagged as an N+1 sync-fetcher defect this item would have entrenched), the @tableMethod support work is set aside to be redesigned when there is an actual feature request. Discarded per user decision 2026-07-15. R288 is narrowed to the polymorphic-interface N+1 case (a real correctness bug independent of @tableMethod); the @tableMethod inlining folds into the future redesign.

R202 (2d2ab74, In Review 02821dd, Spec → Ready 73e805d): Honor @field(name:) on an @error type’s extra fields (everything beyond path / message) at both the classify-time source-accessor check and the runtime property read. The accessor-coverage check called ClassAccessorResolver.resolve(sourceClass, sdlField.getName(), …) with the raw SDL name as the accessor base, so an extra field whose handler-source-class accessor diverged from the field name (getErrorCode() under code, SQLException.getSQLState() under state) failed classification with no author escape hatch. The directive is read once at the parse boundary and carried on the model to every consumer: GraphitronType.ErrorType gains a List<FieldAccessorOverride> component (FieldAccessorOverride(sdlFieldName, accessorBase), in SDL declaration order, List.copyOf-guarded, entries only for extra fields carrying the directive) populated by TypeBuilder.buildErrorType, plus a defaulting accessorBaseFor(sdlFieldName) that returns the override or the field name itself. Both check sites, FieldBuilder.checkErrorTypeSourceAccessors (class-backed payload / DML path via resolveErrorChannel) and R244’s walker.internal.HandlerAccessorCheck (@service outcome path), pass accessorBaseFor(...) instead of the raw name, so the remap rule lives in the model and the two bodies cannot drift; each reject string (and ErrorChannelWalkerError.HandlerSourceAccessorMissing, which gains an accessorBaseName component) appends a (remapped to '<base>' by @field) parenthetical so a failed override is diagnosable. Runtime wiring: GraphitronSchemaClassGenerator.buildErrorTypeFieldFetchers now takes the ErrorType and, after the path / message registrations, emits codeRegistry.dataFetcher(coordinates(typeName, sdlFieldName), PropertyDataFetcher.fetching(accessorBase)) per override, so the runtime read matches the classify-time check; non-directive extras keep resolving through graphql-java’s default PropertyDataFetcher by SDL name. buildErrorType rejects a present-but-blank @field(name: "") on an extra field and any @field on path / message (both synthesised by Graphitron, so the directive could never take effect). Stale javadocs on buildErrorTypeFieldFetchers and ErrorTypeFetcherClassGenerator claiming @error types are restricted to path + message are corrected. Docs: error.adoc gains an "Extra fields" section, field.adoc cross-links it, and the @field docstring names the @error extra-field accessor axis; the prose is scoped to the source-accessor read only (R201, the payload-construction half, is still Backlog) so no half-implemented behaviour is advertised. Coverage: pipeline-tier positive remap on both check sites (@service via getLocalizedMessage(), class-backed payload path), remapped-but-still-missing reject naming both field and directive value, three parse-rejection enum cases (blank / path / message); execution-tier round-trip of a divergently-named getAttemptedId() through FilmLookupInvalid.attempted (-7), the first execution coverage of @error extra fields. Independent-session In Review → Done review; full reactor green under -Plocal-db (all 13 modules, 593 graphitron-sakila-example execution tests). Out of scope: R244’s pending consolidation of the two check sites, and R201’s payload-construction site (ship together or back-to-back; the read/construct asymmetry persists until R201 lands).

R479 (9ddf1d7, In Review 56f009b, Spec → Ready 76e1136): Stop a malformed connection after/before cursor from redacting into a correlation-id 500 and give it the same clean, message-bearing client error a bad node id and a bad page-size argument already get. The emitted ConnectionHelper.decodeCursor turned client-supplied wire input into Field<?>[] seek values with no guard, so bad Base64 (IllegalArgumentException), a token count below the order-by arity (ArrayIndexOutOfBoundsException), and a non-coercible token all threw raw runtime exceptions the no-channel disposition redacted, inconsistent with sibling pageRequest (R415) and the single-record node-id decode. Fix wraps decodeCursor’s decode body (Base64 decode, split, token loop) in one try whose narrow multi-catch (IllegalArgumentException | org.jooq.exception.DataTypeException) classifies blame at the wire boundary: every pure-function-of-client-input failure collapses to one `GraphitronClientException("cursor is not valid (was: \"<echo>\")") (echo capped at 100 chars with a trailing …, following R415’s (was: ...) convention), while any other unchecked throw (e.g. an NPE from a buggy custom Converter) stays a genuine server fault and keeps propagating to the redacted 500. Arity is strict in both directions (tokens.length != orderByColumns.size()), rejecting over-split cursors that were previously silently tolerated: encodeCursor emits exactly N NUL-joined tokens and PostgreSQL strings cannot contain NUL, so any other count is a forged/corrupted/stale-across-schema-change token the generator never emitted. Spec-amending discovery landed in the same commit: jOOQ 3.20.11’s deprecated DataType.convert(String) is lenient and returns null for an uncoercible token rather than throwing DataTypeException (verified across numeric, temporal, UUID, and the MpaaRating enum converter), so failure mode 3 would have been a silent defect (seek on a null bound value); the loop therefore also rejects a non-sentinel token that converts to null (a genuine SQL NULL is the \u0001 sentinel, handled in the branch above), with the DataTypeException clause retained as documented-defensive. No router or fetcher-emitter changes: pageRequest is decodeCursor’s only caller and every connection flavour (standard, dynamic-ordering, polymorphic) funnels through it, and R415 already unified the no-channel disposition on both sync and async arms, so the marker surfaces on root and nested (DataLoader) connections alike. Coverage: execution-tier `GraphQLQueryTest next to the R415 guards, each pinning the exact message and doesNotContain("An error occurred. Reference:"): bad Base64 (after), non-coercible token through the null-guard on numeric FILM_ID, under-split on the two-column filmsByRateDescTitleAsc, over-split strictness (new behaviour), and the before variant; existing round-trip tests pin that legitimate cursors are unaffected. Class-javadoc and generator-comment prose gain the rejection contract. Independent-session In Review → Done review; full reactor green under mvn install -Plocal-db (all 13 modules, 593 graphitron-sakila-example execution tests, 0 failures). Builds on R415; this is the exact "malformed cursor redaction, same family, different surface" gap the R415 changelog named as filed nowhere. Out of scope and untouched: capping the node-id path’s uncapped echo (parity cleanup), R476’s totalCount redaction bypass, and a configurable max page size.

R478 (d19a4a6, Spec 289d7ce): Seal KeyAlternative from an enum-carrying record into a sealed interface with Direct/NodeId variants, each carrying its requiredFields/columns contract as structure rather than the unenforced javadoc prose R477 lived in. Direct stores List<RepBinding> (rep field, column) pairs, so "sizes equal, index-by-index" becomes unrepresentable rather than a promise; requiredFields()/columns() unzip the pairs in order. NodeId carries expectedTypeId (the resolved wire prefix) plus columns (the decode arity), with requiredFields() a derived constant ["id"]. HandleMethodBody.emitDecodeAndGroup becomes an exhaustive sealed switch with no default arm (a future third key shape is a compile error at the fork), and the NODE_ID arm’s emit-site prefix re-derivation with its dead typeName fallback deletes: the decision moves to EntityResolutionBuilder, which builds NodeId(nt.typeId(), ...) directly. Single-sources the typeId fact by dropping EntityResolution.nodeTypeId; EntityFetcherDispatchClassGenerator.buildTypenameForTypeIdMethod derives its reverse map from each entity’s NodeId alternative (presence sets coincide with the former nodeTypeId != null test, inclusion ignoring resolvable, key is expectedTypeId) and sheds its now-unused KeyShape import. Also corrects the stale GraphitronType.NodeType.typeId javadoc (never null on a classified NodeType; defaulted to the type name at classify time). Pure model refactor: generated output byte-unchanged, no pipeline-snapshot or execution-test edits, so the churn is KeyAlternative, its consumers/builder, EntityResolution, GraphitronType, and two test files (EntityResolutionBuilderTest rewritten to instanceof + expectedTypeId/bindings pattern assertions plus a NodeId.requiredFields()==["id"] pin; a RejectNonIdNodeIdPipelineTest comment). Depended on R477 (now Done), whose behavioural arity guard this refactor preserves verbatim. Independent-session In Review → Done review; full reactor green under -Plocal-db (all 13 modules, 588 graphitron-sakila-example execution tests). Out of scope and untouched: any behavioural/emitted-code change, routing the batch decode through the per-type decode<TypeName> helpers, and new key shapes (this item only prices their arrival as a compile error at every fork site).

R474 (2efbc47, Spec 5d245ef/04f2645): Adopt mvnd (Apache Maven Daemon) 1.0.6 in the Claude Code web dev environment to cut per-command Maven JVM warmup. A new idempotent SessionStart prereq step in .claude/scripts/session-start-web-env.sh fetches mvnd from downloads.apache.org to /opt/mvnd and symlinks /usr/local/bin/mvnd, failing open to plain mvn on any error (simulated download failure leaves no /opt/mvnd residue and the hook continues); the R439 background warm build now runs through mvnd when the install succeeded, leaving a hot, JIT-warm daemon (3 h idle timeout) so the session’s first foreground command is fast rather than paying a cold daemon start. The PreToolUse guard (wait-for-web-env.sh) match widens from grep -qw mvn to grep -qwE 'mvnd?' so an mvnd command issued during the warm build cannot race it (catalog-jar clobber included). Parallel test tolerance becomes an enforced invariant rather than a sandbox-only aspiration: the CI verify job switches to mvn verify -Plocal-db --batch-mode -T 1C, so a test that fails only under module-parallel execution fails at the gate and the fix is the test, never serializing the build; web sessions run mvnd’s default -T <cores-1> with tests on, keeping sandbox and CI on one execution shape. Docs: CLAUDE.md gains prefer-mvnd-in-web-sessions guidance, .claude/web-environment.md gains the mvnd section with the accepted quirks (Maven 3.9.16 skew vs /opt/maven 3.9.11, -q stdout buffering under mvnd, SNAPSHOT-plugin classloader-cache exclusion, ~1.35 GB daemon RSS) and states mvn/mvnd command interchangeability explicitly. No pom changes; pure accelerator. Independent-session In Review → Done review; full reactor green under mvnd verify -Plocal-db -T 1C in-sandbox (all 13 modules, 588 graphitron-sakila-example execution tests passing while siblings built concurrently) and on trunk CI with -T 1C. Out of scope: within-module surefire/JUnit parallelism, mvnd for local development or as a repo-pinned driver, mvnd 2.x / Maven 4.

R13 (673535a/9732135/896b105/1e15985/795786a + rework 2c8aac4, review 32169ba): Faceted search on @asConnection via a new @asFacet directive on filter-input fields. Each marked field becomes an entry on a synthesised <ConnName>Facets object attached as a nullable facets field on the generated Connection type, with per-(scalar, nullability) <Scalar>FacetValue value types (FacetNaming keys the derived name on both so nullable and non-null facets over one scalar never collide; value mirrors the filter element’s type exactly so facet values round-trip into the filter with no coercion). Synthesis rides ConnectionPromoter’s field-first walk; the resolved `List<FacetSpec> lands on GraphitronType.ConnectionType as a denormalized view carrier (contained route: Operation.Facet stays unpopulated behind the ConnectionType quarantine for R314 to fold in, matching the totalCount precedent), and new FacetsType / FacetValueType sealed arms ride the per-type emit with all exhaustive switches updated. At runtime the root Query connection fetcher assembles a facet plan on ConnectionResult from generated filter-minus-self fragments (<field>FacetBaseCondition over non-facet fields via null-literal suppression keyed on (argument, field) extraction identity, <field>Facet_<g>Condition per facet), and ConnectionHelper.facets(env) issues one UNION ALL of per-facet GROUP BY arms (each under base AND every other facet’s predicate, IS NOT NULL scrub on non-null facets, TEXT-unified value column decoded back through the column’s DataType), lazy on selection, sorted post-decode on count DESC then the typed value’s natural order. The facets delegate routes failures through ErrorRouter.surfaceClientErrorOrRedact so a facet SQL failure degrades to facets: null plus a redacted error while the page resolves. rejectFacetMisuse (definition-keyed half extracted to FacetFieldValidation, one predicate shared with the promoter so the passes cannot drift) rejects every v1-unsupported shape at build time: non-@field bindings, @reference/@condition/@nodeId co-occurrence, ID and input-object values, non-null fields, connectionName: override, unreached inputs, non-root/polymorphic/structural-only carriers, and facet-name collisions across the carrier’s whole filter surface. Independent-session In Review → Ready → In Review → Done review: the first pass reproduced a consumer javac break (undeclared lifted filterMap local in the base fragment on facet-minority filters) and a wrong-counts defect (suppression ignored the outer argument name, folding a same-named sibling-arg filter into the facet’s own predicate); the rework fixed both (the second both by identity fix and by build-time rejection), pinned the NULL bucket and scrub at the execution tier over an all-NULL seeded column, replaced FacetEmitterTest’s banned code-string assertions with method-surface checks, and pinned the failure/redaction contract end to end. Full reactor green under `-Plocal-db on the approval pass (one unrelated BgeEmbedderOnnxTest flake, passing in isolation and on resume). Spawned R475 (duplicate Java parameter names when two filter args share a field name, pre-existing) and R476 (totalCount shares the unredacted-error gap). Covers GG-335; resolves SOPP-141. Hierarchical facets (Phase 6), reference-path facets, and bounded-domain shape F remain follow-ups.

R461 (03a5b25, In Review 0b9308f, Spec fe68a59): Unify the four divergent SDL-field-to-Java-accessor resolution implementations behind one candidate model. ClassAccessorResolver.enumerate becomes the single home for the name rules, the boolean-only is-gate (on the member’s own return type), the member filter (public, non-static, non-bridge, non-synthetic, not Object-declared), and the per-kind parameter-shape rule; it is parametric in the CandidateKind set a consumer accepts so each reduction’s switch is exhaustive over only the arms it can receive. Two reductions consume it: resolve keeps its signature and first-match reduction (now picking up the bridge/synthetic/Object filter it previously lacked, a latent-bug fix, B6) and FieldBuilder.collectAccessorMatches keeps its table-identity/cardinality ambiguity reduction (zero-arg kind only), with the @sourceRow-hint ambiguity rejection preserved. A new discovery-direction probe (sealed AccessorProbe Grounded | NoMatch, never a nullable Type) replaces RecordBindingResolver.findAccessorReturnType and inferAccessorName, which are deleted: the result/input propagation and the R329 producerBindLevel presence probe all call it once per field under @field(name:)-resolved base names and the field’s real argument shape (B2/B3/B4/B5/B8). forBackingClass single-sources the walk’s class-shape→candidate-order rule, pinned equal to the emission-side variant derivation by an order-bridge meta-test over TypeBuilder.resultVariantKindFor. A reason ledger records gated accessor near-misses so the dangling-type-reference backstop (GraphitronSchemaBuilder.rejectDanglingTypeReferences) names the accessor gate for a sole-producer type rather than emitting a generic no-producer cascade. Coverage: unit-tier ClassAccessorResolverTest (order/is-gate/filter/arity/field-fallback table, covariant-bridge skip, order-bridge meta-test) and pipeline-tier R461WalkGroundingPipelineTest (B1 POJO+record order, B2 arity incl. sole-producer arity-gate rejection, B3 rename, B4 sole-producer boolean-gate, B5 field fallback incl. sole-producer field-fallback-with-args rejection, B6 covariant, inheritance, both B8 carrier-discrimination flips); no code-string assertions on generated bodies. Independent-session In Review → Done review; full reactor green under -Plocal-db. Follow-up to R180’s deferred lift; routing the LSP’s CatalogBuilder.beanAccessorSlot through this resolver (audit finding M19) is left as a separate item.

R463 (e9e3313): Consume R279’s ancestor-cardinality rider ; compute the true ancestor-product arrival fold and populate Source.OnlyChild where the product is One, retiring the conservative hard-coded Source.Child on every ChildField. New Arrival (lattice One < Many, Many absorbing, tensor product) and ArrivalIndex, a pure typename-keyed fold over the assembled (pre-connection-promotion) SDL: a composite type is Many if it carries a @node/@key seed or is reached by more than one field edge (fan-in / recursion, which subsumes the fixed point since a reachable cycle implies a second reaching edge), else its single reaching edge’s parent arrival tensored with the edge’s raw SDL list-ness; roots are the empty product (One). Structural edges (interface→implementor, union→member) propagate arrival unchanged while still counting toward the multi-edge test. Computed once in GraphitronSchemaBuilder and threaded onto GraphitronSchema (parse-boundary containment: no graphql-java type survives into the stored Map<String, Arrival>); OutputField.source() becomes the storage-free derived view source(Arrival) (root leaves ignore the argument), read through the single GraphitronSchema.sourceOf(coordinate) seam so arrival stays a parent-typename-grain fact and is never copied to the ~25 leaves. requiresReFetch() reworked to read the leaf’s own sourceShape directly (arrival-agnostic, behaviour-identical), and the GraphitronSchemaValidator re-fetch-mirror diagnostic reads sourceOf. Model + tests only: emitters keep leaf-identity dispatch, so an OnlyChild-classified batch field still emits its one-element DataLoader and generated output is byte-unchanged; the direct-SQL OnlyChild emit and its enforcer ride the R431→R432→R314 chain (forward obligation recorded). The Source.OnlyChild javadoc carries the honesty clause (One is a static per-dispatch guarantee about unaliased projections; the arm must stay row-correct at every arrival count). Coverage: WrapperAlgebraTest pin lifted to the Root law + parent-grain law + a coverage floor observing OnlyChild/Child/Root; ClassifiedDslTest.SOURCE_KNOWN_GAPS loses its OnlyChild exemption (now empty); corpus rows flip to OnlyChild where the fold yields One, plus seven new hand-asserted edge-case fixtures (deep single chain → One, list ancestor → Many, fan-in of two single edges → Many, recursion → Many, @node-seeded → Many, connection ancestor → Many, single mutation payload carrier → One); no code-string assertions on generated bodies. Independent-session In Review → Done review; full reactor green under -Plocal-db. Builds on R305/R316/R317; consumes R279’s rider; R308 landed first and retargeted the three forward references here.

Discarded: Graphitron MCP server programme (graphitron-mcp-server, R118): the programme is delivered; the anchor has nothing left to coordinate. All ten core slices shipped as their own items (R341 transport skeleton, R361 shared-model seam, R372 RAG foundation, R385 docs.search, R386 catalog.search, R428 execute tool, plus the catalog/code/schema/diagnostics tools, the edges tool with reverse index, and the directives resource): the registered surface in GraphitronMcpServer is catalog.tables, catalog.describe, catalog.search, services, conditions, records, schema, diagnostics, edges, docs.search, execute, and the directives resource. The one live open question (English-only bge-small-en-v1.5-q vs Norwegian catalog comments) is carried to R470 (multilingual-catalog-search-embedding). The optional slice 11 (semantic method search) is consciously not re-filed: file it under the dev-loop theme if agent round-trips ever show the structured services/conditions/records tools are not enough. The programme body’s architecture spine (structured vs semantic split, one-model-two-views LSP integration, stability gradient, cross-cutting principles) is embodied in the shipped code and its per-slice changelog entries.

Discarded: roadmap-tool verify tripwires throw BuildFailure, not System.exit (roadmap-tool-tripwire-buildfailure, R394): already delivered without the item being closed. BuildFailure exists and all four verify tripwires throw it (Main.runVerify README drift, Main.validate front-matter, LeafCoverageReport.run drift/no-traces, AdocMarkdownTableCheck.run findings), plus the later-added DirectiveSupportReport guard; CLI/usage/create-file-exists paths correctly remain on System.exit, exactly as scoped.

Discarded: capture test stdout/stderr to per-class files via Surefire redirectTestOutputToFile (surefire-redirect-test-output, R373): already delivered without the item being closed. redirectTestOutputToFile=true is set in both the Surefire and Failsafe configurations of the parent pom, and the graphitron-mcp logback-test.xml WARN clamp was relaxed to root INFO with a comment citing the redirect; both scope points satisfied.

Discarded: render Mermaid diagrams on the published docs site (render-mermaid-diagrams-on-docs-site, R326): the acceptance end-state (mermaid blocks render as inline SVG on the site) was reached by a different mechanism than the item proposed. Instead of an asciidoctorj-diagram/kroki server-side backend, docs/_theme/docinfo-footer.html ships a client-side mermaid.js module loader that rewrites code[data-lang="mermaid"] listings (the [source,mermaid] form roadmap-tool emits) into rendered diagrams in the browser, sidestepping the CI-backend cost the item worried about.

Discarded: add a typeName-first decode-helper entry point (decode-helper-typename-first-resolution, R263): speculative with no consumer, per the 2026-07-13 staleness audit (§A). resolveDecodeHelperForTable now resolves through the @node-only NodeIndex and rejects multi-node ambiguity at validate time rather than silently picking decode<firstType>; both callers pass the table name as primary and none routes an authoritative @nodeId(typeName:). R377 settled the open question the item hedged on. Finding for the record: the fallbackTypeNameOrTypeId argument is still consulted only on the empty branch, so a future typeName-first caller must not expect it to drive the suffix; re-open if a MUST-route @nodeId(typeName:) caller appears.

Discarded: drop or wire FkJoin.alias dead storage (fkjoin-alias-dead-storage, R120): premise dissolved by R438’s join reshape. The named types are gone (FkJoin/ConditionJoin replaced by JoinStep.Hop/LiftedHop), and the stored alias is no longer dead: Hop.alias() is consumed extensively by the routine/chain join emitter in TypeFetcherGenerator, i.e. the item’s "use it" fork happened as a side effect of the reshape. This resolves residue point 2 of R443, whose body is trimmed accordingly. Residual observation, cosmetic and not re-filed: JoinPathEmitter.generateAliases still derives its own per-hop aliases for the inline emitters instead of consuming Hop.alias(), a dual derivation with no generated-code difference.

R465 (a9deae5, Spec c3ae081/145afd1): Bump the two graphql-java satellite artifacts in the root pom dependency-management block, federation-graphql-java-support 6.0.0 → 6.2.0 and graphql-java-extended-scalars 22.0 → 24.0, holding graphql-java itself at 25.0 (the 25 → 26 jump breaks generator compilation and outruns what the two satellites officially support; deliberately out of scope as the conservative, ready-now half of the graphql-java catch-up). Federation 6.2.0 (built against graphql-java 25.0) and extended-scalars 24.0 both resolve cleanly and introduce no failures. R464 having already removed the convention table and its drift guard, the six new extended-scalars constants (YearMonth, Year, AccurateDuration, NominalDuration, SecondsSinceEpoch, HexColorCode) need no map-or-exclude curation: the reflective @scalarType resolver binds any public-static GraphQLScalarType constant on the classpath automatically, so they become resolvable candidates with no code change. Pure two-line version bump; no generator, generated-output, or test changes, exactly as scoped. A tree-wide grep confirms no live source, test, or user-facing doc still references the deleted convention table or its conventionTable_coversEveryExtendedScalarsField drift guard. Independent-session In Review → Done review; full reactor green under -Plocal-db across all 13 modules.

R346 (ab70c35/41c0b70): Regenerate and guard the generated supported-directives.adoc migration fragment against directive-set drift. The fragment (included by migrating-from-legacy.adoc, emitted by directive-support --mode=migration) promised in its own header a "verify-mode CI guard" that never existed, so it drifted silently every time a directive changed. The directive-support CLI gains an additive --verify flag mirroring leaf-coverage --verify: it regenerates the fragment in memory, compares against the committed --output file, and throws BuildFailure with a copy-pasteable REGENERATE_COMMAND on any drift (--verify requires --output, else exit 64). To keep the verify path inside the rewrite tree (standalone-build principle), the frozen 25-directive legacy set is snapshotted verbatim from graphitron-common/src/main/resources/directives.graphqls at tag v9.3.0 (pre-R182 delete) into roadmap-tool/src/main/resources/legacy-directives.graphqls rather than read from the legacy module; a stripped-before-parse provenance header documents the source. A phase-bound verify-supported-directives execution in roadmap-tool/pom.xml runs the guard on every mvn verify (PRs included), alongside verify-roadmap-readme and check-adoc-tables, so drift fails on the PR that introduces it rather than after merge. The one-time regeneration corrects the generated Supported-directives prose (R346 decision 2): it drops the unbacked "exercised by …​ a test fixture" claim (migration mode never computes that signal into the list, which gates on rewriteByName.containsKey minus the rejected/withheld sets) and states the real criterion (declared + supported, documented in the architecture chapter). Coverage: DirectiveSupportReportTest gains the prose assertion plus the --verify round-trip (zero on match, BuildFailure on drift, exit 64 without --output); the guard is its own regression net. The sibling supported-schema-shapes.adoc fragment (identical unguarded gap, but a build-trace-dependent guard shape) is deferred to a Backlog follow-up. Independent-session In Review → Done review; guard verified to fail cleanly on a deliberate fragment edit; full reactor green under -Plocal-db.

R464 (7786ce4, Spec f79855e/b1ff238): Remove convention-based scalar resolution; make @scalarType(scalar: "fully.qualified.Class.FIELD") the single explicit way to bind any non-spec, non-federation scalar. Generator side is pure deletion: ScalarTypeResolver loses CONVENTION_TABLE, conventionTable(), and resolveByConvention(), and TypeBuilder’s classification ladder loses its convention rung so a directive-less non-spec/non-federation scalar falls straight to the `@scalarType-pointing hard error (message simplified to name the directive as the single fix). This deletes the classpath-dependent classification surprise (a transitive extended-scalars pull silently resolving a bare scalar BigDecimal with no directive and no intent) and retires the convention-table drift test that gated extended-scalars / graphql-java upgrades (it tripped on the extended-scalars 24.0 dry run and blocked R465). The five spec built-ins and the federation-namespace scalars are untouched. Rather than dropping editor support, the LSP completion is upgraded: ClasspathScanner gains a readScalarConstants pass reading public static GraphQLScalarType fields by exact JVM descriptor match (the JOOQ_CONDITION_DESCRIPTOR idiom; final deliberately not required since the reflective resolver binds a non-final constant just as well), surfaced on a new CompletionData.ExternalReference.scalarConstants slot (with a back-compat 5-arg constructor keeping ~20 test callers compiling); ScalarTypeCompletions now completes className.fieldName from that scan, so it offers the consumer’s own scalar constants (com.example.Scalars.MONEY) plus any library’s with no coupling to extended-scalars, preferring a case-insensitive field-name match for the enclosing scalar X. The sakila scalar BigDecimal and the GraphitronSchemaBuilderTest R355 fixtures gain explicit @scalarType; the two CONVENTION_LAYER classification cases are deleted, the single-path UnclassifiedType contract case survives (asserting the new message so a re-added fallback fails loudly), and the old DIRECTIVE_BEATS_CONVENTION case is retained reframed as DIRECTIVE_ALIASES_TO_DIFFERENT_CONSTANT. Coverage: scanner test pins the public+static+GraphQLScalarType filter with three negatives (wrong field type, non-static, non-public), rewritten LSP completion + text-edit tests feed a populated CompletionData and assert the className.fieldName items, field-name-first preference, case-insensitivity, and the empty-on-other-directive guard; no code-string assertions on generated bodies. Docs sweep: custom-scalars.adoc, scalarType.adoc, and code-generation-triggers.adoc drop the convention layer, and resolution order is now two implicit paths (spec built-ins, federation-namespaced) plus the directive. Pre-1.0 breaking change; the actionable error message points at the mechanical fix. Independent-session In Review → Done review; full reactor green under -Plocal-db. Unblocks R465.

R459 (ed5b79b): CompileDependencyGraphBuilder now models the schema-shape → fetcher wiring edge for fetcher-owning plain-object nesting types. A nested type that owns a fetcher (any classified nested field, per R303) emits a <Type>Fetchers class its <Type>Type schema-shape wires (FilmMetaType -> FilmMetaFetchers); the builder registered only the schema-shape node, so the wiring loop never added the edge and the TypeSpecReferenceWalk completeness oracle (correctly) flagged the superset gap. Fix is a dedicated addNestedFetcherNodes() walk (called from build() before addBlanketAndWiringEdges) that mirrors TypeFetcherGenerator.collectNestedFetcherClasses’ reachability verbatim: iterate `TableBackedType roots, walk each NestingField tree, dedup nested types by name, recurse into inner NestingField`s unconditionally, and register `units.fetchers(name) gated on a mirrored nestedTypeOwnsFetchers predicate (no FetcherEmitter coupling, same discipline as the builder’s filtersDecodeNodeId / hasSqlGeneratingField mirrors). Registering the node is the whole fix: the existing wiring loop then supplies schemaShape -> fetcher, schemaClass -> fetcher, and the blanket edges for free. Coverage: unit CompileDependencyGraphBuilderTest.fetcherOwningNestingTypeRegistersFetcherNodeAndWiringEdges and a pipeline IncrementalCompileHarnessTest corpus extension (Film.meta: FilmMeta { language: Language @reference }, single-valued inline TableField that exercises exactly the wiring edge and not the deferred per-field gap). Independent-session In Review → Done review verified the fixture is non-vacuous (disabling the walk reddens the oracle with exactly the one FilmMetaType -> FilmMetaFetchers gap, nothing else); full reactor green under -Plocal-db. The nested fetcher’s own outgoing per-field edges are deferred to Backlog R462 (nested-fetcher-outgoing-field-edges).

R457 (7588358, core c2e818b, cutover c41752d, gate-fix 376ecd8, In Review e83532b): @mutation(table:) names a @mutation(typeName: DELETE) field’s write target on the consuming field, retiring @table-on-input for DELETE and making R332’s deprecation warning actionable. A DELETE commonly returns a bare ID / Boolean / count and can never return the deleted row’s @table type (R287 rejects DELETE → @table at authoring time, backstopped by MutationDeleteTableField’s compact constructor), so the only place to name the write target is the field: `deleteFilm(in: FilmDeleteInput!): ID @mutation(typeName: DELETE, table: "film"), the field-level analogue of @service(argMapping:). Precedence is @mutation(table:) (preferred) > the input’s @table (deprecated migration bridge, silently outranked when both are present, never cross-checked). The spec’s rung 1 (return-derived table) was dropped by author/user agreement precisely because R287 makes it unbuildable for DELETE; rungs 2 (override) and 3 (bridge) ship and fully satisfy the goal. Mechanism: directives.graphqls gains table: String on @mutation (documented DELETE-only); DmlWalkerInputArgResolution gains a RawArg arm making "the single input arg is not a TableInputType`" a normal outcome rather than an immediate reject, with UPDATE translating it back to the pre-R457 rejection verbatim (byte-identical) via `rawArgUpdateRejection while the DELETE classifiers own the fallback; FieldBuilder.resolveDeleteWriteTarget resolves the table by precedence and re-derives the input fields through TypeBuilder.resolveInputFields (factored out of buildTableInputType so both routes share one classification loop, returning the narrow (fields | failure) fact, not a synthesized TableInputType); the R330 validator-bypass is closed by mirroring GraphitronSchemaValidator.collectInputFieldRejections at the field-derived call site (a field-derived input never lands in the registry validateTableInputType walk); table: on a non-DELETE verb rejects loudly with the typed, sealed MutationTableArgError.UnsupportedVerb (stable graphitron.mutation-table-arg.* LSP code), with the classifier and mvn graphitron:validate reading one TABLE_ARG_SUPPORTED_VERBS set. Commit 1’s R332 DELETE carve-out is repurposed at cutover (additive-then-cutover, no dead set) from suppression to selecting the DELETE-specific replacement wording, so the warning now names @mutation(table:). Coverage: pipeline-tier MutationTableArgClassificationTest (7 cases: byte-identical carrier vs @table-on-input, no-@table classifies, unknown-table reject, no-write-target message leads with @mutation(table:) and cites R287, INSERT/UPDATE unsupported-verb rejections, validator-mirror parity on both paths), TableOnInputDeprecationWarningTest, execution-tier FixtureWarningsGateTest (FilmDeleteInput warns naming @mutation(table:)), and the deleteStorageBinByCode round-trip in DmlBulkMutationsExecutionTest (the sakila fixture dropped @table and set @mutation(table: "storage_bin"), round-trips identically against PostgreSQL); drift guards RejectionSeverityCoverageTest + SealedHierarchyDocCoverageTest; no code-string assertions on generated bodies. Docs: mutation.adoc (signature, parameter table, "Naming the DELETE write target" section, reworked constraint bullet), table.adoc WARNING, deprecations.adoc, code-generation-triggers.adoc, typed-rejection.adoc. A DELETE-scoped slice of R97’s "the write target is the consuming field’s property" axis; R97 remains the home for the general @table-on-input removal. Independent-session In Review → Done review; full reactor green under -Plocal-db (MutationTableArgClassificationTest 7, TableOnInputDeprecationWarningTest 4, FixtureWarningsGateTest 2, DmlBulkMutationsExecutionTest round-trip all pass).

R455 (f1d93a8, workstream B 319e668, In Review 991c2ae): Fix the TypeSpecReferenceWalk blind spots that silently falsified the R410 incremental-compile completeness oracle’s superset guarantee (walkEdges(u) ⊆ modelGraph.directReferences(u)), so the dev-loop incremental compiler could prune a dependent an ABI change should have recompiled while the oracle stayed green. Two coupled workstreams, landed model-first so every trunk commit stays green. Workstream A (graphitron-javapoet): TypeSpec.referencedClassNames() now descends $L args that are a nested CodeBlock / anonymous-class TypeSpec / AnnotationSpec (a $T stored opaque in a $L block was previously lost, missed across 60+ emitter sites) and walks type- and method-level type-variable-bound declarations, guarded by an identity-visited set so self-referential bounds (T extends Comparable<T>) terminate; the javadoc is corrected so the sole remaining blind spot is a class name baked into a raw string ($L String / $S). Workstream B (CompileDependencyGraphBuilder): a separate top-down projection walk mirroring TypeClassGenerator’s emit seam models the type-to-type projection-composition edges that were entirely absent (types.Film → types.Language` for each inline TableField/LookupTableField composing Target.$fields(...)), attributing every edge to the hosting type class so nesting-hosted fields land on the outer type (not their immediate parentTypeName()), reaching NodeIdEncoder precisely when an inline filter decodes a @nodeId argument, adding the generated <Type>Conditions edge for a GeneratedConditionFilter, and blanketing the frozen GraphitronClientException scaffold. The per-child dispatch is a no-default exhaustive switch over the ChildField leaves carrying the one-model drift guard (a future inline-projecting leaf fails to compile until its edge is declared). TypeSpecReferenceWalk’s javadoc documents the shrunk review-only residual (same-package raw code-bearing string) with a discovery recipe; net 2’s FQCN scan is kept as-is (a same-package simple-name literal scan would over-collect). The demonstrated false green (Film → Language` inline projection on the R410 harness) is now true-green, and the harness corpus is extended with an inline @nodeId-decoding list reference (Language.films) exercising the typeClass → NodeIdEncoder, → conditions, and same-package nested-$L projection edges end-to-end. The fetcher-owning-nesting-type wiring gap the fix would otherwise surface is filed separately as R459. Coverage: 7 TypeSpecReferencedClassNamesTest unit tests (nested $L at depth ≥ 2, anonymous class, annotation, type/method type-variable bounds, recursive-bound termination, raw-string residual), 4 new CompileDependencyGraphBuilderTest unit tests (projection target, GraphitronClientException blanket, NodeIdEncoder only-when-decoding, nesting-hosted attribution to the outer class), and the extended IncrementalCompileHarnessTest; MultiSchemaPipelineTest’s R78 guard gets deeper coverage for free and stays green. Independent-session In Review → Done review; oracle + builder + multi-schema suites green under `-Plocal-db, javapoet unit tests verified passing on demand.

R456 (80a3df7, In Review e8571cc): Guard WorkspaceFile source/tree reads against a concurrent didChange edit/swap/close. The LSP handed the live, mutable WorkspaceFile out of its lock (Workspace.get) and let the five async request handlers (hover, completion, codeAction, definition, inlayHint, all on ForkJoinPool.commonPool) plus the diagnostic-recalc drain walk its tree-sitter tree and read its byte[] source on pool threads while didChange edited the byte array, swapped the tree, and eager-close()`d the previous native tree on the dispatch thread; the fields were plain (non-volatile, non-synchronized). That raced a walk of a freed native tree (arena `IllegalStateException / use-after-free killing the request), a torn (source, tree, version) triple so Nodes.text extracted garbage and hover/diagnostic ranges were wrong, and worst a WorkspaceEdit computed against mismatched offsets that the client applies and corrupts the user’s schema file (completion could even tear against itself across an interleaved edit). Design (settled at Spec via the principles-architect consult): copy-on-read snapshots scoped by the workspace. New immutable FileSnapshot(tree, source, version) record carries a ts_tree_copy clone (jtreesitter’s documented cross-thread mechanism) whose native lifetime is independent of the live file’s, so the eager previous.close() and in-place tree.edit() on the dispatch thread stay exactly as they were and cannot invalidate a reader’s clone; WorkspaceFile.snapshot() captures the triple under the Workspace lock (the same lock the mutators run under, giving the happens-before edge, so no volatile on the plain fields). FileSnapshot is a deliberately distinct type from WorkspaceFile with no shared read interface, so the compiler (not convention) enforces "safe to read off the dispatch thread" and a call site cannot rebind the mutable instance. Workspace exposes lambda-scoped accessors, not the snapshot’s lifetime: withView(uri, absent, present) snapshots one file (or short-circuits to absent), withAllViews(present) snapshots every open file under one lock acquisition into an ordered Map<String, FileSnapshot> so a composed cross-document WorkspaceEdit is computed against one consistent generation of the whole workspace; both close every clone (including partials taken before the lambda throws) in a finally, making leak-by-omission structurally impossible (jtreesitter registers no Cleaner, so an unclosed clone leaks native memory until process exit) and keeping the native lifecycle in the imperative shell. The live-file handout Workspace.get and the now-orphaned openUris are removed from the public surface; WorkspaceFile no longer escapes Workspace. All reader call sites migrate: the five async handlers wrap their supplyAsync bodies, publishDiagnosticsForRecalculate snapshots per drained URI, CodeActions.compute and IntraSchemaDefinitions.compute use withAllViews for a consistent cross-document generation, and feature compute() signatures switch from WorkspaceFile to FileSnapshot (accessor names match, so mechanical); the completion self-tear is fixed since one snapshot now feeds its position, directive, and value reads. FileSnapshot deliberately omits declaredTypes() / dependsOnDeclarations() (consumed only by Workspace’s own under-lock mutators, never off-thread). Coverage: `FileSnapshotConcurrencyTest is the named enforcer (plain JUnit in graphitron-lsp; the generator’s four-tier taxonomy does not cover LSP concurrency and these need no catalog) ; a snapshot stays walkable and pre-edit-consistent (text + version) after applyEdit and replaceContent eager-close the original tree, close is independent in both directions, and withAllViews pins one generation across a concurrent didChange; the existing handler/feature tests are the behaviour oracle for the mechanical migration. Tests mint snapshots through a package-local WorkspaceFileTestSupport bridge to the package-private snapshot(). Alternatives rejected: an immutable WorkspaceFile behind a volatile (needs a home for the reused incremental-parse Parser and refcounting/Cleaner for old-tree lifetime, more churn same result), and serialising requests against edits per document (holds the lock across slow feature computation, kills request concurrency). No user-visible surface (no protocol/goal/directive change), so no user-doc draft. Establishes the safety precondition for R347 Slice 5’s didClose close() (which must land on top of this, where closing the live tree cannot invalidate any snapshot); test 1 is the mechanical enforcer that keeps this true regardless of commit order. Independent-session In Review → Done review; full graphitron-lsp suite green (468 tests, 0 failures) under -Plocal-db.

R452 (723266d, Spec c175917, Ready 91310e7): Reject explicit @reference and same-table participants on multi-table interface/union child fields, closing a silent-wrong-data hole. A single-cardinality multi-table polymorphic child field whose join path was an explicit @reference (condition or multi-hop) or whose participant shared the parent table built green yet returned an arbitrary participant row per parent: MultiTablePolymorphicEmitter.branchParentFkWhere returned null for any non-single-hop-FK shape and the caller lowered null to "no WHERE", so every parent resolved the field to the same wrong data with no error at any tier (the batched list sibling failed loud on a blind cast, proving the single arm was the odd one out). The fix is a classification-time gate plus a type lift, both landing at the single choke point FieldBuilder.resolveChildPolymorphicJoinPaths (all four producers: interface/union × table-backed/record-backed parent). Rule 1a rejects any field-level @reference structurally (a single stated path applies the same hops to every participant, so it is terminal-correct for at most one and cannot express a distinct join per participant; author-correctable by removing the directive); rule 1b rejects a same-table participant as a Deferred capability (participant table equals parent/hub → parsePath skips FK discovery → empty path → no correlation derivable; a self-FK participant is a legitimate schema, not an author error); rule 1c wraps zero/multi-FK auto-discovery failures with multi-table-child context so fkCountMessage’s generic "add a `@reference`" steer no longer leads straight into rule 1a. Both deferred sites point at the follow-up capability item (per-participant-multitable-child-join-paths, filed as R458). The type lift changes the per-participant carrier on `ChildField.InterfaceField/UnionField from a raw Map<String, List<JoinStep>> to Map<String, ParticipantFkPath>, a new record carrying the resolved single-hop FK column-pair slots with a non-empty invariant enforced at construction: the classifier decides "supported shape" exactly once and the emitter cannot represent an unsupported one, retiring branchParentFkWhere’s `instanceof/null-for-unsupported arm and batchedBranchJoinPredicate’s `(On.ColumnPairs) ((JoinStep.Hop) path.get(0)).on() blind cast (null survives only for the legitimate root-fetcher / participant-absent case). The single-hop-FK shape predicate is single-sourced (singleHopFkColumnPairs) across the multi-table arm and the single-table validateSingleHopFkJoin, and the stale stub-interface-union-fetchers.md pointer (R36 shipped) is dropped. Docs: polymorphic-types.adoc and multitableReference.adoc now state the rejection and point at the deferred capability. Coverage: new pipeline-tier MultiTableChildReferencePathRejectionPipelineTest (9 cases: condition/multi-hop/single-hop-{key:} @reference all reject identically by directive presence, union + record-backed-parent producer arms, same-table deferred rejection, zero-FK/multi-FK context wrappers, and the auto-discovered control carrying a non-empty ParticipantFkPath); TypeFetcherGeneratorTest fixtures migrated to the new carrier. Independent-session In Review → Done review; full reactor green under -Plocal-db -P!docs.

R453 (c529322, Spec e9cb78d): Reject sort-enum values that declare neither @order nor @index instead of silently skipping them. A partially-annotated sort enum bound to @orderBy built cleanly, contradicting the docs' promise of a per-value build failure (sort-results.adoc, order.adoc, orderBy.adoc all state a missing value "fails the build with a per-value diagnostic"); at runtime OrderByResolver continue`d past the unannotated value, and a request selecting only such values generated an empty ORDER BY, which on a paginated connection made keyset pagination slice a nondeterministic set (rows duplicate or vanish across pages). The rejection lands at the parse boundary in `OrderByResolver.resolveOrderByArgSpec: it accumulates every value lacking both directives while iterating the enum and, if the set is non-empty, returns a Resolved.Rejected after the loop, making the empty-ORDER-BY state unrepresentable in the model (namedOrders complete by construction). A new AuthorError.SortEnumMissingOrder(String enumTypeName, List<String> missingValues) arm carries the sort enum’s type name plus the full list of unannotated values (accumulate-all, not fail-fast, so the author sees every missing value at once; typed list rides for LSP fix-its rather than prose), following the RecordBindingMultiProducer shape for message() and prefixedWith. Per the Spec: the classifier’s anyMatch detection stays (detection vs completeness are distinct facts; a fully-unannotated enum never reaches the resolver and is already rejected as unclassified); no validator mirror (the parse-boundary rejection makes the bad state unrepresentable, and the model carries no full value list to re-derive); no generated-code guard (the resolver rejection is the single enforcer; emitted code carries no defensive guards for classifier-guaranteed shapes); and the annotated-value catalog-lookup fail-fast path is left untouched as a distinct failure class. No user-manual change (the docs already promise this exact failure; the change aligns code with the promise). Coverage: pipeline-tier GraphitronSchemaBuilderTest (partial annotation → build error naming the unannotated value; two unannotated values → single accumulate-all rejection listing both), plus drift guards RejectionSeverityCoverageTest (sample for the new arm) and SealedHierarchyDocCoverageTest (typed-rejection.adoc paragraph + drift-list mention); no generation-tier assertion (code-string assertions banned, the guard it would pin is dropped) and no execution-tier test (the nondeterministic state is now unbuildable). Sibling of R181 (validate-order-directive-args, the empty-@order / @order`@index+-coexistence gap); the arm is named so R181 can fold into a shared order-directive family later. Independent-session In Review → Done review; full reactor green under `-Plocal-db.

R449 (89746df, In Review dc70e62): Close the routine-chain classification edges surfaced by R435’s second-pass In Review review. Five design points, none gating R435’s shipped surface: (D1) gate the R435 root-chain interception on Query ; the interception read parentType instanceof RootType and routed root multi-node chains to classifyRootRoutineChain, so a @routine chain on Mutation landed a QueryRoutineTableField whose source() falsely asserts Root.Query; FieldBuilder.classifyField now reads the root position once (isRoot/isQueryRoot/isMutationRoot) and a Mutation @routine (multi-node in the interception, single-node from classifyMutationField’s top) lands a typed `Deferred signposting routine-mutation-write (R451’s write arm, a capability gap not an authoring error), while Subscription and non-routine Mutation chains fall through to their classifyRootField stories. (D2) fold @routine into both conflict detectors via a pairwise verdict table ; a sealed PairVerdict (Conflict | Deferred(planSlug) | Composes) that reduceDirectiveConflict projects over every unordered pair and reduces with Conflict-dominates-Deferred precedence, so @routine @lookupKey @service rejects the @service conflict rather than short-circuiting to the @routine×@lookupKey defer (the three-directive hole a slot-count carve-out would reintroduce); detectQueryFieldConflict is hoisted into classifyField before the interception and its old call inside classifyQueryField deleted (one detector site per position). (D4) repoint BuildContext.computeTerminalTargetVerdict’s `On.Lateral comment at FieldBuilder.routineChainVerdict (the SplitRowsMethodEmitter javadoc repairs stay R450’s scope). (D5) route the root routine fetcher (TypeFetcherGenerator) through the shared RoutineCallEmitter.emitCall via a new payload-free PreviousNodeRef.None arm and JoinPathEmitter.emitTableExpression, deleting the duplicated nonRoutineParamSource helper and inline ParamSource switch; QueryRoutineTableField’s compact constructor now pins every start binding to `ParamSource.Arg, making the None×SourceColumn arm genuinely classifier-unreachable (construction throws before any emit), and the consolidation is byte-identical (root correlated is false, so no DSL.val wrap). (D3) three text-only R435 rejection fixtures gain isInstanceOf arm assertions (DirectiveConflict for repeated @reference on ARGUMENT_DEFINITION; AuthorError.Structural for the input-field and element-less cases) plus a new fixture pinning the R300 single-node root desugar to hops = []. Coverage: 11 new pipeline-tier fixtures in GraphitronSchemaBuilderTest’s R435 block (D1 Mutation/Subscription landings, D2 conflict/defer/precedence verdicts across child + root single-node + root multi-node, the desugar pin); D4/D5 need no new tests (comments have no runtime surface; the consolidation is behaviour-identical under the existing R435 pipeline + execution suite, and the D5 constructor pin is exercised by every fixture that lands `QueryRoutineTableField); no code-string assertions on generated bodies. Independent-session In Review → Done review; full reactor green under -Plocal-db (503 GraphitronSchemaBuilderTest cases, 0 failures). Out of scope: the routine write arm itself (R451), R450’s SplitRowsMethodEmitter correlation rework, and lifting root position into a sealed RootType (a model-cleanup follow-up).

R446 (03dfe0b + c57fc57): Fix codegen crashing on array-typed database columns and reject array columns used as key elements. The R436 per-column TableRecord key reconstruction called ClassName.bestGuess(col.columnClass()) for every column in allColumns(), and for an array column jOOQ’s Field.getType().getName() is the JVM binary descriptor ([Ljava.lang.Boolean;), which bestGuess rejects, so any node type with an array-typed mapped column aborted graphitron:dev / generate with IllegalArgumentException: couldn't make a guess for [Ljava.lang.Boolean;. Fixed at the grain: decide each column’s Java type once at the jOOQ reflection boundary and carry it as a TypeName columnType on ColumnRef / JooqCatalog.ColumnEntry, decoded via TypeName.get(col.getType()) (array-safe, mirroring RoutineParam) at the three reflection sites and threaded through every construction site; the 31 ClassName.bestGuess(<ref>.columnClass()) codegen sites read <ref>.columnType(). The raw columnClass string is left in binary form intact for the consumers that depend on it (EnumMappingResolver Class.forName, SourceRowDirectiveResolver Class.getName() compares, GraphitronSchemaValidator), so this is a dual-fact split, not a replacement. ClassName-typed locals and DomainReturnType.Plain widen to TypeName (safe: TypeName.equals/hashCode are toString()-based and a scalar column still decodes to a ClassName, so R204/R279 multi-producer agreement is unchanged for scalars and distinguishes arrays). A validate-time rejection is added for an array-typed column used as a @node NodeId key column (validateNodeType) or a DataLoader @splitQuery batch key (validateField over BatchKeyField.sourceKey().columns()), because Java arrays compare by reference identity and would silently mis-batch / mis-match at runtime; merely "not throwing" there would turn a build-time crash into a silent correctness bug. A test-only 3-/4-arg auxiliary constructor derives columnType from a source-form columnClass (shared scalar-only decode, null on placeholders, array columns can’t reach it) so ~161 hand-built fixtures stay unchanged; ColumnTypeConstructorArityGuardTest scans the main-source tree and fails the build if any production construction regresses to the string-decoding form. Coverage: unit-tier ArrayColumnTypeDecodeTest (boundary decode: ClassName for scalars, ArrayTypeName of the right element for boolean[]/text[], columnClass stays the binary descriptor), pipeline-tier ArrayColumnCodegenPipelineTest (regression pin over a new array_holder fixture through the TableRecord key-extraction path, verified to reproduce the crash when reverted), and ArrayKeyColumnRejectionValidationTest (@node array-key rejection + scalar control); no code-string assertions on generated bodies. Compilation/execution tiers not added via sakila-example (array columns aren’t surfaced there; emitted-form validity is pinned by the boundary-decode toString()), and the DataLoader batch-key rejection arm has no fixture (unconstructable: PostgreSQL disallows an array FK target). Bug fix, regression from R436; no user-facing surface. Independent-session In Review → Done review; full reactor green under -Plocal-db.

R435 (impl c0620e5..7a58239, In Review e288670): Order-significant @routine / @reference composition ; a jOOQ table-valued function is a table node (R333’s tableExpr RoutineCall) that can be a field’s row source, its projected terminus, or sit between tables in the join chain. Both directives become repeatable and their written order defines the table chain (implicit head → contributions → terminus, last node == the field’s @table); ReferenceElement gains no arm and @reference no new luggage, so composition is directive co-occurrence plus order, not a widened input (the rejected-alternatives log records why the @oneOf element arm, a slim path directive, @reference(from:), and a fixed-orientation rule were all turned down). Discharges R333’s deferred SDL-surface residue and its root-entry-validator residue (b). Model: on R438’s two-axis Hop(TableExpr target, On on) substrate, adds TableExpr.RoutineCall, the positive On.Lateral arm, On.Keying (ForeignKey | NameMatchedKey, the FK-less name-matched key for hops adjacent to a routine result), ParentCorrelation.OnLateralArgs, and a ParamSource.SourceColumn arm so a routine IN parameter has exactly one source shape (argMapping → Arg, columnMapping → SourceColumn, the correlated CROSS JOIN LATERAL case); every pre-existing sealed switch on On / ParentCorrelation gained an explicit arm and the root QueryRoutineTableField was re-homed onto the (start, hops) chain (R300 desugars to hops = []). Shipped end to end at root and child positions: correlated single-node (lateral), routine-then-hops, hops-then-routine, sandwich, and repeated-@reference composed chains, through one chain walker shared by root and child classifiers; inline correlated multiset and the @splitQuery batched keyed re-query on table-backed parents (batch key = the routine’s column-bound inputs). Typed classify-time rejections (root-head, terminus, columnMapping existence/type/one-source, repeated @reference off FIELD_DEFINITION, Connection-terminus, uncorrelated-@splitQuery) each carry a validator projection and a fixture; @orderBy / @condition / catalog-terminus-pagination / @lookupKey land typed Deferred. Coverage: pipeline fixtures per chain shape in GraphitronSchemaBuilderTest’s R435 block, execution-tier proofs on a `films_for_actor fixture function (RoutineFieldExecutionTest, per-parent correlation, mixed column/argument binding, batched-vs-inline row equivalence, hops projecting a film-only column so a mis-keyed hop cannot pass), and the full rejection-fixture set; no code-string assertions. routine.adoc / reference.adoc rewritten for the composition surface and order contract. Remaining fetch-form breadth (multi-routine chains, record-backed / TableInterfaceType parents, @lookupKey) re-homed to R447; ordering/binding/corpus residue to R448. Independent-session In Review → Done review; full reactor green under -Plocal-db (3802 tests). Builds on R333/R438; supersedes R300’s root-only @routine.

R445 (579ec14, In Review 39ecbb9): Resolve a participant cross-table @reference column read by the FK-pinned terminal TableRef (class identity), not a bare SQL name re-resolved through the catalog. Seventh audited site of the schema-qualified @table bug class (siblings R396, R440, R441, R442, R422, R444), found by R444’s spec-time audit. TypeBuilder.extractCrossTableFields held the FK-pinned fk.targetTable() (identity-carrying since R441) and the resolved interfaceTable, but re-resolved their bare tableName() strings through JooqCatalog’s string lookups, which return `TableResolution.Ambiguous when the FK terminal’s bare name collides across generated schemas: the column resolve came back empty and the field was silently skipped from the participant’s cross-table set, falling through to FieldBuilder’s scalar `@reference path where (post-R444) it misclassified as a plain ColumnReferenceField instead of ParticipantColumnReferenceField, so the interface fetcher emitted no conditional LEFT JOIN / alias projection and a participant field’s classification came to depend on whether an unrelated schema happened to hold a same-named table. No author-side workaround: the FK terminal is not author-named (the @reference key is TABLE__CONSTRAINT on the source table), and this path never routes through ServiceCatalog.resolveColumnForReference, so R444’s overload retirement could not catch it. Design (same as R440/R441/R422/R444, "decide once, carry the decision as a type"): consume the carried refs directly via R444’s TableRef.column(String) matcher and TableRef.allColumns(), retiring all four string-keyed catalog reads from the method ; R388 defect-2 guard predicate + base column set → interfaceTable.column / allColumns; detail-only candidate hint → fk.targetTable().allColumns(); column resolve → fk.targetTable().column(columnSqlName), dropping the manual ColumnEntry → ColumnRef conversion. extractCrossTableFields now holds zero string-keyed catalog reads, one resolution story instead of two. Behavioral deltas: a colliding FK terminal now yields a ParticipantColumnReferenceField (the fix), and the R388 rejection’s candidate hint is non-empty when the detail table collides; unknown columns still skip to the field-level classifier and the guard still fires on base-resident columns. Coverage: pipeline-tier QualifiedParticipantCrossTableReferencePipelineTest (sibling of R444’s QualifiedTerminalReferenceColumnPipelineTest and R422’s QualifiedReturnTypeReferencePipelineTest, over the existing multischema fixture, no new DDL) ; a cross-schema-colliding FK terminal classifies green as ParticipantColumnReferenceField with the resolved column asserted (not vacuous); a column present only on the other schema’s same-named table still rejects (schema-pinned, not search-all-schemas), its diagnostic naming the FK-pinned A-side candidates; a base-resident column trips the R388 contradiction guard with a now-non-empty detail-only candidate hint. Out of scope by design: ctx.parsePath’s path-start `tableName() echo (author-named and qualifiable per R396). Independent-session In Review → Done review; red-before-green verified (tests 1 and 3 fail with the fix reverted); full graphitron suite green (2489 tests) under -Plocal-db. Closes the audited no-workaround FK-terminal @reference sub-class (R444 scalar + R445 participant cross-table); does not claim the whole schema-qualified @table class closed ; the author-qualifiable bare-name reads (ServiceCatalog.resolveColumn, path-start echoes) remain by design.

R444 (e5f3944, In Review 3785229): Resolve a scalar @reference terminal column read by the FK-pinned terminal TableRef (class identity), not a bare SQL name re-resolved through the catalog. This was the sixth site of the schema-qualified @table bug class (siblings R396, R440, R441, R442, R422): despite R422’s changelog claiming the class closed, R422 only fixed the object-return-type terminal verdict; the scalar @reference column read was a separate unaudited path with the identical defect. ServiceCatalog.terminalTableSqlName walked the FK path and returned hop.targetTable().tableName(), collapsing the identity-resolved terminal TableRef (which R441 populated with a tableClass identity) to a bare name string; resolveColumnInTable then re-resolved it through JooqCatalog.findColumn(String, …), which hit TableResolution.Ambiguous when the terminal table name collides across generated schemas and demoted the field to UnclassifiedField with a spurious "column could not be resolved" author error and no author-side workaround (the @reference key names the FK on the source table, so there is no syntax to qualify the FK terminal). Design (same as R440/R441/R422, "decide once, carry the decision as a type"): replace terminalTableSqlName / terminalTableSqlNameForReference with the ref-carrying terminalTableForReference(List<JoinStep>, TableRef) (walk the path, terminal is the last hop’s targetTable(), empty path yields start, condition-only steps still bail to empty); retype resolveColumnForReference to take the start as TableRef and resolve the column off the terminal ref via new TableRef.column(String) ; the single model-side matcher home mirroring findColumn’s order (javaName` equalsIgnoreCase across all columns, then sqlName), never a bare-name catalog re-resolve. The scalar-output unknown-column diagnostic now enumerates the terminal TableRef.allColumns() java names (previously empty on a colliding terminal, ambiguity-broken too); the argument-filter (FieldBuilder) and input-field (BuildContext) sites pass their already-resolved TableRef. Behavioral deltas: a colliding terminal now resolves; condition-only paths, unknown columns, and empty paths keep today’s outcomes. Coverage: pipeline-tier QualifiedTerminalReferenceColumnPipelineTest (sibling of R422’s QualifiedReturnTypeReferencePipelineTest, over the existing multischema fixture, no new DDL) ; a @reference read on the cross-schema-colliding FK terminal classifies green as ChildField.ColumnReferenceField (with the resolved column asserted, not vacuous); a column present only on the other schema’s same-named table still rejects (schema-pinned, not search-all-schemas); a genuine unknown column rejects with a non-empty candidate list. Two adjacent bare-name reads stay out of scope by design: the direct non-@reference scalar read (source @table echo resolves qualified, author has a workaround) and the participant cross-table @reference path (a genuine seventh site, no workaround, tracked as R445, which consumes this item’s TableRef.column matcher). Independent-session In Review → Done review; full graphitron suite green (2526 tests) under -Plocal-db. Closes the FK-terminal @reference column-read sub-class (scalar output field, argument filter, input field); does not close the whole bug class (the participant cross-table path is R445).

R422 (6955bf6, In Review a1edbe0): Compare return-type identity in the @reference terminal-target verdict, not the verbatim @table echo. BuildContext.computeTerminalTargetVerdict decided whether an @reference path’s terminal hop lands on the field’s return-type table via TableRef.sameTable (a bare equalsIgnoreCase against the return type’s verbatim @table string), so a schema-qualified return @table (e.g. multischema_a.widget while the hop resolves to jOOQ’s unqualified canonical widget) spuriously reported Mismatch and demoted the field to UnclassifiedField. Last open member of the schema-qualified @table bug class after R396 (source-side FK predicate), R440 (FK-join endpoint/FK identity), R441 (landed TableRef.denotesSameTableAs), R442 (condition-param match). Chosen design (settled at Spec against a full parsePath String→identity migration): thread the already-resolved return-type TableRef into parsePath as its own nullable axis alongside the existing targetSqlTableName String ; name stays the input to the name-based plumbing (empty-path FK inference, condition-join terminal build), the ref is consumed only by the verdict, which now compares via R441’s TableRef.denotesSameTableAs (both sides catalog-constructed, so identity-vs-identity). The seven non-null-target call sites pass the ref they already hold one frame up (six in FieldBuilder, plus NodeIdLeafResolver which hoists its findTable above resolveFkJoinPath so ref and name pass together); the return-side null gate moves to returnTableRef == null and the Mismatch message keeps rendering the author’s verbatim echo. No R440-style resolve-or-fall-back contract (an unresolvable return name is unreachable here and re-resolving could reintroduce the bug on a bare cross-schema collision). Coverage: pipeline-tier QualifiedReturnTypeReferencePipelineTest (sibling of R396’s QualifiedSourceReferencePipelineTest over the multischema jOOQ fixture, no new DDL) ; the schema-qualified return @table classifies green as ChildField.TableField and the terminal hop genuinely lands on widget, paired with a genuine mismatch (return type bound to event, hop lands on widget) that still rejects to UnclassifiedField; no code-string assertions. TableRef.denotesSameTableAs already pinned by R441’s TableRefSameTablePredicateTest, no new predicate coverage. Independent-session In Review → Done review; full reactor green under -Plocal-db. Builds on R396/R441; closes the schema-qualified @table bug class.

R440 (d0bd8ca, Spec 6cfda86/426c586): Resolve FK-join synthesis endpoints and the FK itself by jOOQ class / reference identity, not bare SQL name. BuildContext.synthesizeFkJoin already held the jOOQ ForeignKey object (whose endpoint Table classes it pins exactly) but re-looked-up both endpoints and the FK by bare name, reintroducing the ambiguity R396 removed: two schemas sharing a bare table name yielded TableResolution.Ambiguous and the join failed, and a constraint name colliding across schemas silently returned the first-hit FK (a wrong-join hazard, not a rejection). Another member of the schema-qualified @table bug class (R396 done; R441/R442 the accessor and condition-param siblings landed just prior; R422 Backlog). Four moves, all "decide once, carry the decision as a type": (D1) new JooqCatalog.findForeignKeyRef(ForeignKey) resolves the Keys-class constant by reference identity in the FK-holder schema only (the FK-child endpoint class structurally pins the owning schema), the FK-singleton invariant its named enforcer; fkJavaConstantName retargeted onto the FK object; the false-docstring findForeignKeyByName deleted. (D2) synthesizeFkJoin resolves both endpoints via findTableByClass off the FK, so UnknownTable becomes a defensive-only arm (fires on catalog-vs-FK mismatch, never bare-name ambiguity); the fabricated-source test case retired in favour of upstream membership checks. (D3) the Optional-returning findForeignKey(String) (which could only collapse a collision into "not found") replaced by a scoped, sealed findForeignKey(name, sourceSqlName) returning ForeignKeyLookup (Resolved/NotInCatalog/Ambiguous); the three author-facing sites ({key:} path element, IdReference synthesis shim, explicit @reference(key:) record-FK) reject Ambiguous through a new ambiguousForeignKeyRejection structural builder naming the colliding schemas + qualified forms, while the non-author-facing qualifierForFk migrates keeping its Optional contract. (D4) findUniqueFkToTable returns Optional<ForeignKey> and NodeIdLeafResolver consumes the object directly, dropping the name round-trip that re-collided after findForeignKeysBetweenTables had already resolved by class. Fixture: a note table in both multischema schemas, each with an FK named note_event_fk into its own schema’s event, giving both a colliding bare target-table name and a colliding FK constraint name, plus seed rows for execution-tier reuse. Coverage: unit-tier JooqCatalogMultiSchemaTest D1-D4 cases (per-schema Keys-class ref resolution, endpoint-by-class from each side, scoped disambiguation, null-scope Ambiguous naming both schemas, structural-prose rejection) plus the {key:} membership enforcer parsePathElement_keyNotTouchingSource_rejectsBeforeSynthesis; findUniqueFkToTable directionality cases migrated to the FK-object shape in JooqCatalogIdRefTest; no code-string assertions on generated bodies. Resolver-tier wiring judged disproportionate (nodeid fixtures stay single-schema; the collision lives at the catalog/BuildContext tier), recorded in the item. ForeignKeyLookup is a JooqCatalog-local result type in the TableResolution/ForeignKeyResolution/RoutineResolution family, out of scope for VariantCoverageTest/SealedHierarchyDocCoverageTest; the ambiguous arm produces an existing Rejection.structural leaf, adding no typed-rejection.adoc obligation. Independent-session In Review → Done review; full reactor green under -Plocal-db. Builds on R396/R438; sibling of R441/R442/R422.

R442 (87d25a9, Spec b9c8cfa): Make the R379 Check-2 concrete-condition-param table match compare by jOOQ class identity, not a bare-vs-qualified name string. BuildContext.checkConcreteParamTable compared the parameter’s bare jOOQ table name (event) against the hop’s possibly schema-qualified @table echo (multischema_a.event) with equalsIgnoreCase, so in a multi-schema catalog a concrete @condition parameter typed with the correct generated table class was false-rejected (author’s only workaround: widen to Table<?>, discarding the type safety), and two same-named tables in different schemas were indistinguishable. Another member of the schema-qualified @table bug class (R396 done, R441 the accessor-side sibling landed just prior, R422/R440 Backlog); surfaced from gap D of the opptak multi-schema migration. Design shape 1 (chosen over re-resolving the string inside the check): thread the resolved TableRef`s down the validator chain instead of name strings. `validateConditionParamTables / checkConcreteParamTable now take TableRef source/target; the condition-hop site threads the hoisted conditionOrigin (null when the source is not table-backed, the existing skip) and r.target(), the where-filter site threads hop.originTable() / hop.targetTable(). The final compare is TableRef.denotesSameTableAs (the shared identity-body-with-name-fallback predicate R441 landed first and this item reused verbatim per the coordination note, dropping the predicate + consumer-audit scope), so a parameter typed with the right class classifies green even against a qualified echo and cross-schema collisions stay distinct; the mismatch message renders the declared side schema-qualified so a bare-name collision stays actionable. Coverage: pipeline-tier MultiSchemaConditionParamTest + MultiSchemaConditionStub over the colliding-event multischema fixture, covering source (terminal condition + where-filter) and target (terminal condition) operands, both green and by-identity wrong-schema rejection; the catalog-built wrong-schema cases double as the fallback-arm enforcer. Additive multischema_a.event_log DDL (jOOQ schema version bumped 2.4→2.5) backs the where-filter source shape. Test-plan deviation recorded in the item + landing commit: target-side coverage rides a terminal condition hop rather than the spec’s where-filter hop, because the where-filter FK-endpoint resolves event by bare name through synthesizeFkJoin (ambiguous across the two schemas), which is R440’s scope, not R442’s. Independent-session In Review → Done review; full graphitron suite green under -Plocal-db (2471 tests). Builds on R379; reuses R441’s predicate.

R441 (e0b878a implementation; Backlog → Spec 62d1222, Spec → Ready d5117fa, In Progress 9d3756c, In Review 2fdb708; independent-session In Review → Done review): Typed-accessor match on a free-form DTO payload parent now compares reified jOOQ table-class identity, not the bare @table name. Same multischema migration as R396/R422’s family (gap E of graphitron-qualified-names-gaps): once an element type’s @table is schema-qualified to disambiguate a cross-schema bare-name collision (multischema_a.event vs multischema_b.event), the verbatim @table echo never equalsIgnoreCase’d jOOQ’s always-unqualified canonical `event, so FieldBuilder.collectAccessorMatches silently dropped the accessor and the payload parent rejected with RecordTableField … requires a typed accessor or @sourceRow plus cascading WrapperArm errors transport failures on the sibling errors field. Fix routes the comparison through the identity already in hand: TableRef.denotesSameTableAs(TableRef) compares the carried tableClass (ClassName, structural equals) when both refs have one, falling back to the case-insensitive name compare only for fixture-built classless refs (catalog-constructed refs via JooqCatalog.TableEntry.toTableRef always populate it, so production always takes the identity arm); collectAccessorMatches threads the expected TableRef instead of its bare SQL name and filters via denotesSameTableAs, with the accessor side already resolved by record-class identity (ServiceCatalog.resolveTableByRecordClass) so the compare is identity-vs-identity. The predicate’s javadoc names the two identity homes (parse-boundary raw-Table<?> primitives on JooqCatalog per R396 vs. model-side reified ClassName here) so a future consumer picks by where it stands rather than growing a third mechanism. Upgrading the predicate body silently switched the four other consumers (TypeBuilder ×3, GraphitronSchemaValidator, FieldBuilder hop-origin) to identity comparison; each compares two same-catalog-derived refs, so any change of verdict is a cross-schema false-positive becoming correctly false (strictly tightening). Gap D stayed out of scope, filed as R442 which subsequently adopted the same predicate. Coverage: unit-tier TableRefSameTablePredicateTest pins all three arms (same class/divergent names → true; same bare name/different class → false, the silent-regression guard; classless fallback); pipeline-tier TypedAccessorSchemaQualifiedIdentityPipelineTest over the multischema fixture pins both directions (qualified echo classifies green as RecordTableField with accessor-derived source and schema-A tableClass; different-schema record dropped and field rejects), asserting classifier outcomes and sourceKey, no code-string assertions on generated bodies. TableNameComparisonCaseGuardTest untouched (identity route lives in the guard’s excluded PREDICATE_HOME). Full reactor green under -Plocal-db.

R438 (materialize-joinpath-facts; slices 3754f40 JoinConditionRef, 8106991 axes minted, 099aa30 producer/reader cutover, d3dafa3 flat-variant delete, b0ab513 self-review fixes; independent-session In Review → Done review): JoinStep reshaped onto R333’s two orthogonal axes ; Hop(TableExpr target, On on, originTable, JoinConditionRef filter, alias) with On.ColumnPairs | On.Predicate and the day-one TableExpr.Catalog arm; the flat FkJoin / ConditionJoin variants and the WithTarget capability deleted, slot iteration now the standalone HasSlots capability shared by On.ColumnPairs and the transitional LiftedHop (both retired by R431). Absorbed and closed R16. Generated output byte-identical per slice; gate review re-verified the full reactor green under -Plocal-db and fixed one stale WithTarget mention in emitter-conventions.adoc.

R16 (fkjoin-model-cleanup; absorbed and closed by R438’s slice 1 + cutover): the join-condition calling convention is now typed. JoinConditionRef wraps the MethodRef population called as method(srcAlias, tgtAlias) by JoinPathEmitter.emitTwoArgMethodCall, which takes the wrapper directly so call sites stop extracting raw MethodRef`s; handing a `WhereFilter-convention method to a join-condition emit site is a compile error. R16’s whereFilter naming complaint dissolved structurally in the R438 cutover: the ON-clause condition and the WHERE-appended filter became differently-named components (On.Predicate.condition vs JoinStep.Hop.filter) instead of one overloaded whereFilter.

R439 (d34ef37 implementation; filed 66dea39, Backlog → In Review ea67d6c at the user’s direction with the implementation pre-landed and validated in the originating session, the Spec/Ready flips recorded as mechanical passthrough; independent-session In Review → Done review): Background dev-environment warm-up for Claude Code Web sessions. The SessionStart hook (.claude/scripts/session-start-web-env.sh) now runs asynchronously in web sessions (CLAUDE_CODE_REMOTE=true): it emits {"async": true} so the session starts immediately, establishes the prerequisites (JDK 25 + alternatives/profile retarget, PostgreSQL rewrite_test drop/reseed, Maven settings de-proxy, libtree-sitter 0.26.9) in the background, then warms the whole reactor with mvn -B -ntp install -P 'local-db,!docs' -DskipTests, tracking state in /tmp/graphitron-web-env.status (prereqs/warm-build/done/failed + hook PID + epoch, with an EXIT/TERM/INT trap so a killed hook leaves failed, never a stuck running state) and logging to /tmp/graphitron-web-env.log. A new PreToolUse Bash guard (.claude/scripts/wait-for-web-env.sh, registered in .claude/settings.json with a 2700s timeout) extracts the command from the hook JSON and holds mvn commands through both phases and psql commands through the prereqs window, so a foreground build can never race the background one into the catalog-jar clobber; it fails open on a dead hook PID, a stale (>2400s) status, or an unparseable status file, and is also runnable by hand as a wait-with-log-tail. The JDK step additionally persists JAVA_HOME through $CLAUDE_ENV_FILE so agent shells stop inheriting a stale JAVA_HOME=java-21 past the enforcer. Local sessions keep the fully synchronous behavior and never create the status file. Dev-tooling only, no generator code affected; gate review re-verified the guard’s hold/release/fail-open matrix against synthetic status files and observed the live warm-up (async start, warm-build → done, BUILD SUCCESS, JDK 25 in the agent shell) in the reviewing session’s own sandbox.

R434 (3b38beb implementation; Spec → Ready ee39933, In Progress → In Review 3cac680; independent-session In Review → Done review): Restructured the rewrite design principles doc around axioms with named enforcement. rewrite-design-principles.adoc (28 flat peer sections, the type-system family stated five times, the central R222 thesis living only in a preamble pointer) is replaced by docs/architecture/principles/development-principles.adoc: six axioms (decide once at the parse boundary / orthogonal facts are independent axes / one model many views / boundaries decode and encode / every invariant has an enforcer / generated code is a consumer artifact), each principle carrying rule + exemplar + smell + an *Enforced by:* line naming what fails when it breaks (compiler / named meta-test / build tier / the honest gap label "review only", which doubles as the meta-test gap list). The ingress states the FCIS + normalization spine and coins the drift smell once (R268 narrated solely under the enforcement axiom; field/model/format instances cite it). The Emitter Conventions catalogue extracted to docs/architecture/reference/emitter-conventions.adoc (plus a new cursor encode/decode section); the dunder-rule full semantics moved to GeneratedSourcesLintTest’s javadoc next to their enforcer; additive-then-cutover change discipline relocated to `roadmap/workflow.adoc. The doc budgets itself at 3,500 words (landed at 3,456), enforced by new DocSizeBudgetTest.developmentPrinciplesStaysUnderBudget. Citation sweep retargeted every live reference (docs xrefs with changed section anchors, javadoc, .claude prompts, CLAUDE.md, roadmap-tool boilerplate, live roadmap items); historical records keep the old name. Docs-only plus the budget meta-test; full reactor green under -Plocal-db. Builds on R433.

R433 (420cd32 implementation, d905fac rework 1, 2ba655a rework 2; Ready sign-off under the user’s in-session short-circuit, In Review → Ready gate 1 ad18fa5, In Review → Ready gate 2 aa6fe29): docs/architecture/explanation/rewrite-design-principles.adoc violated its own "Documentation names only live tests/code" rule by carrying unguarded live-inventory enumerations (arm lists, file censuses, occurrence counts, a dated compliance roster) that rot silently as the codebase moves, and canonized surfaces the R222/R333 pivot dissolves. New "Principles are stated at altitude" section codifies the discriminator: an inventory belongs in a principle only when a named live test pins it (the GeneratorCoverageTest-guarded dispatch partition is the kept exemplar); otherwise state the rule, one canonical exemplar, and the smell. Applied across SourceKey.Reader/Wrap arm enumerations, the four-axis SourceKey/LoaderRegistration census, two parse-boundary file censuses, the CallSiteExtraction strategy list, the candidateHint occurrence census, the helper-locality compliance roster, and the R50 retired-carrier roster; vision-alignment forward notes added pointing SourceKey at R431 and MethodBackedField at its R222 retirement (ServiceField as the current capability exemplar); stale ArgCallEmitter.buildNodeIdDecodeExtraction/R260 citation replaced (R260 shipped; R334 tracks the live instance). Two review rounds found and fixed residual rot the first pass missed: gate 1 caught a still-enumerated retired TextMapLookup permit (R229), an 11-of-12 module census, an unguarded "thirteen resolver siblings" count, and an over-inclusive java.lang.reflect-import discovery recipe (keyed onto Type-tree reads instead), plus same-family ride-alongs in code-generation-triggers.adoc, argument-resolution.adoc, typed-rejection.adoc, SealedHierarchyDocCoverageTest, and SourceKey.Reader’s javadoc; gate 2 caught a sentence-initial "Thirteen directive resolvers" in `typed-rejection.adoc that survived gate 1’s case-sensitive grep sweep, fixed with a case-insensitive re-sweep (zero remaining hits outside an unrelated PGThirteen test fixture). This is a docs-only item: no generated-output or runtime change; verification is the stale-reference check on every symbol/test/roadmap-id the revised doc names, plus a clean AsciiDoctor render. Full reactor green under -Plocal-db at each gate.

R436 (2992d25 implementation; Backlog → Spec 20b5072, Spec → Ready 97c0bb3, In Progress → In Review e263020): Fix unsafe into() key extraction colliding with multiset aliases and escaping error redaction. Two defects on a @service/@splitQuery split field over a @table parent whose DataLoader key wrap is SourceKey.Wrap.TableRecord. Defect 1: the key read did a whole-record env.getSource().into(Tables.X), mapping the parent row into the typed record by column name; a sibling multiset-backed object field aliased (.as(fieldName)) to a name case-insensitively shadowing a physical column (the incident: dager/tider over range columns; the sakila repro: Film.Length over FILM.LENGTH smallint) poisoned the conversion and threw a MappingException, aggravated by R426 widening the parent SELECT to the full row. Defect 2: that throw ran synchronously in the DataFetcher body before dispatch and the async .exceptionally router, so it escaped DataFetcher.get() unrouted and leaked jOOQ’s raw record-dumping message past ErrorRouter redaction (a privacy hole; per-node repetition blew the OTel gRPC 4 MiB export limit). Fix (Defect 1): the parent $fields projects the full row under reserved __src_<col>__ aliases (GraphQL reserves leading-__ for introspection, so no client-driven sibling alias can collide) and GeneratorUtils.buildKeyExtraction’s `TableRecord arm rebuilds the typed record column by column with explicit types (no runtime Field<?> loop / unchecked cast). Both emit sites drive off a new generation-time TableRef.allColumns (populated in JooqCatalog), single-homing the projected names and the extraction’s lookup names so they cannot drift. RequiredProjection reshaped from a sealed { FullParentRow | Columns } sum to a product record (boolean reservedFullRow, List<ColumnRef> baseColumns) ; the reserved full row no longer supplies base-named columns that the Wrap.Row/Wrap.Record/TableMethodField reads still need, so the two axes are co-present and both emitted (R426’s absorbing "type fact" javadoc rewritten). A narrow build-time validator (GraphitronSchemaValidator.validateAliasKeyColumnCollisions + parentProjectionAlias, mirroring emitSelectionSwitch) rejects a sibling alias shadowing a key/correlation column read by base name (the residual the reserved-alias fix cannot cover), with field/column/remedy in the message; the broad whole-row collision is fixed not rejected, so legitimate schemas keep working. Fix (Defect 2): DataLoaderFetcherEmitter.build wraps extraction + dispatch + async tail in try/catch (Throwable) routing through the same asyncRouterCall disposition the .exceptionally arm uses (single-homed in TypeFetcherGenerator, threaded to both arms so they cannot diverge), lifted into a completed future; the R268 preRegistrationPrelude stays outside the guard by design. Coverage: execution-tier GraphQLQueryTest.films_titleTitlecase_withCollidingMultisetSibling_bothResolve_noMappingException (both fields resolve post-fix), pipeline-tier ServiceProjectionPipelineTest two-axis emit + AliasKeyColumnCollisionValidationTest (rejection + no-false-positive), unit-tier DataLoaderFetcherEmitterTest guard-shape (registration outside / extraction inside / catch-arm routes), R426 contract tests still green; no code-string assertions on generated bodies. Reserved __src_* reaches generated code only as string literals, so the dunder lints need no allowlist entry (docs updated); handle-services.adoc extraction phrasing updated. Spec-permitted fallback taken on the execution-tier redaction test (no bespoke throwing-accessor fixture): the sync catch is unit-proven, shares one router-call definition with the async arm, and the async arm’s redaction is already execution-proven via Film.durabilityError. Independent-session In Review → Done review; full reactor green under -Plocal-db (all 13 modules incl. the graphitron-sakila-example execution + Java-17 compile tier). Builds on R426/R425/R415/R268.

R437 (f293803 implementation; Backlog → Spec 4119cf7, Spec → Ready d8c8653, Ready → In Progress 0fef51c, In Progress → In Review e41a4d8): Shape-aware create<Record> / create<Record>List @service helper dedup, fixing an R311/R315 silent-column-drop correctness bug. The jOOQ-TableRecord @service param helpers were deduplicated by record class alone (putIfAbsent(recordClass, …) at two collection sites, and both call-site namers derived from recordClass.simpleName()), so two @service fields on one type binding the same record through different input shapes (different @field column sets) collapsed to the first-seen helper; every call site routed to that survivor and the other mutation silently wrote its unique columns as NULL/default (found in fs-plattform’s `registrerCampusForUtdanningsmulighet vs deaktivereCampusForUtdanningsmulighet, where DATO_FRA was dropped to 1900-01-01). The fix re-keys dedup, naming, and call-site routing by the full binding shape (record class + ordered ColumnBinding`s + ordered `RecordKeyDecode`s): a new `JooqRecordHelperNames resolver dedups on the carrier’s own structural equals (D1 ; exactly "these two emit an identical helper body", so no parallel signature function can drift), names uncontended record classes with the bare create<Record> (byte-identical to pre-R437, no churn) and contended ones with canonicalRender-ordered 1-based ordinal suffixes plus a one-line column-naming javadoc (D2), and is built once from every jOOQ-record carrier on the <Type>Fetchers class (both coordinates) and stashed on TypeFetcherEmissionContext before any field body emits, so the helper drain and both call-site emitters (ArgCallEmitter child, ServiceMethodCallEmitter root incl. the list arm) resolve the same name by construction (D3); a populated resolver throws on an uncollected carrier rather than silently falling back to a bare name (routing-hole tripwire), while the default bare() resolver preserves today’s behaviour for schema-free/unit/out-of-band contexts. Accepted limitation: collapse compares bindings in producer order, so identical columns in different SDL declaration order would not collapse (a missed collapse, not a correctness bug). Coverage: pipeline-tier JooqRecordServiceParamPipelineTest R437 group ; contended-singular red regression (two distinct helpers, each fetcher routes to its own, exactly one sets RELEASE_YEAR), contended-list arm pinned separately, cross-input-type collapse to one bare helper (pins shape-keying over input-type-name keying), determinism across runs, and contended-vs-uncontended javadoc; the R311/R315/R322/R336 pins keep passing (36/36). Independent-session In Review → Done review; full reactor green under -Plocal-db incl. the graphitron-sakila-example Java-17 compile (no generated-output churn). Builds on R311/R315.

R410 (e7ae955 slice 1, 1fae7e9 slice 2, 55e04e3 slice 3, 6149cfe slice 4, a0e6950 slice 5, d77fd0c slice 6; review fixes in the In Review → Done commit range): graphitron:dev owns incremental compilation of generated sources. The dev loop now turns generated .java into .class in-process, into the graphitron-exclusive target/graphitron-classes (sole-writer dir, first-on-classpath precedence for consumers that load external .class; quarkus:dev empirically confirmed not to consume it, so the Quarkus value routes to the in-process MCP query-execution driver, filed as R428/R429). Composition: the idempotent writer reports its per-run delta (slice 1); CompileDependencyGraph is projected from the classified model through exhaustive switches over the GraphitronType/GraphitronField leaves mirroring projectFieldClassification, with frozen-vs-growing UtilSingleton classification so blanket over-approximation never harms pruning (slice 2); AbiSignature hashes the signature surface (constant values included for javac inlining; type variables with bounds added in review) and RecompileSet computes delta ∪ ABI-changed reverse-transitive dependents as pure functions (slice 3); a warm JavaCompiler/StandardJavaFileManager engine with per-round fresh tasks, orphan .class sweep, and a dedicated CompileDiagnostic channel kept separate from ValidationReport (slice 4); the two-clause acceptance harness (incremental tree byte-for-byte equals clean full compile; body-edit prunes / ABI-edit propagates) plus the TypeSpecReferenceWalk completeness oracle (slice 5); DevMojo wiring with -Dgraphitron.dev.compile=false opt-out, no fail-fast (exclusive dir degrades safely), conservative whole-tree recompile on consumer .class change, and compile diagnostics surfacing through the console block (CompileErrorFormatter) and the MCP diagnostics tool with a source: "schema"|"compile" discriminator (slice 6). Independent-session In Review → Done review landed four fixes: the completeness oracle widened with a @node type, which falsified missing node-lookup wiring edges (QueryNodeFetcher/EntityFetcherDispatch including the per-node-type types.<T> projection references and entitiesByType federation targets) ; closed model-sourced in the builder; failed compile rounds now carry a retry set so an unrelated save can never report clean while a stale last-good .class lingers; a first recompile with no ABI baseline (skipInitial) establishes the full image instead of a half-populated dir; AbiSignature gained type-variable/bounds coverage and DevMojo.lastGeneration became volatile (cross-watcher-thread visibility). The spec’s third diagnostics channel (LSP publish against generated-file URIs, best-effort) did not ship and is filed as R430. Residuals accepted per spec: no live graph-completeness guard (offline oracle only); generated→consumer invalidation is conservative whole-tree pending R333’s method graph, where the sourcing seam re-targets its live exhaustive switches. Full reactor green under -Plocal-db.

R426 (3931908 implementation; Backlog → Spec ccbaea5, Spec → Ready b774532, In Progress → In Review 0d01fc1): Project the full parent row for TableRecord-sourced @service children, honoring the already-documented contract of the typed-TableRecord source shape. A @service child whose Sources parameter is a typed TableRecord (Set<FilmRecord>, SourceKey.Wrap.TableRecord) receives keys via env.getSource().into(Tables.X), but the parent $fields SELECT projected only the client’s selection plus R425’s force-included key columns, so a service body reading a non-key column (FilmService.titleTitlecase’s `film.getTitle()) got a silent null whenever the client didn’t happen to select that column; the in-tree execution test passed only because its query selected title alongside, and the federation _entities shape (router selects just the service child) hit the failure in production form. The manual (handle-services.adoc) already promised "fully-populated parent records (every column on the parent table)", so the fix makes the codegen honor the written contract rather than rewriting it. Implementation folds R425’s key-column collection and the new full-row signal into one walk (TypeClassGenerator.collectRequiredProjection) returning a sealed RequiredProjection { FullParentRow | Columns } with an absorbing combine (FullParentRow dominates; "full row subsumes columns" is a type fact, not a dedup accident); build$FieldsMethod switches once, the full-row arm emitting a single Collections.addAll(fields, table.fields()) append that is alias-correct by construction (the caller’s table param carries base column names, the same names into(Tables.X) reads by). Gated on the key wrap (SourceKey.Wrap.TableRecord), not the sealed field variants, so any future BatchKeyField acquiring the wrap gets the right projection for free; sits after R425’s record-parent guard so only table-parent fields reach it. Coverage: pipeline-tier ServiceProjectionPipelineTest R426 group (full-row append for ServiceTableField and ServiceRecordField TableRecord-sourced children via the new TypeSpecAssertions.appendsFullParentRow helper, a Record1-sourced contrast sibling pinning the wrap gating, and a NestingField recursion case); execution-tier GraphQLQueryTest.films_titleTitlecase_withoutSelectingTitle_readsNonKeyColumnOffSourceRecord unmasks the in-tree reproducer ({ films { titleTitlecase } } with no title selected, red pre-fix); federation execution-tier FederationEntitiesDispatchTest.entities_tableRecordServiceChildOnly_nonKeyColumnReadResolvesNonNull (representations-driven fetch, non-key read). Docs: handle-services.adoc contract prose stated plainly, projection-cost note added, and the caveat paragraph’s false table-parent half reconciled. Known residual imprecision noted at review: the full-row append is unconditional in $fields (fires on every fetch of a parent type carrying such a child, selected or not), so the docs' "whenever the field is selected" cost framing understates the trigger; this matches R425’s unconditional force-include shape, and selection-gating the required projection is a possible future refinement. Builds on R425. Independent-session In Review → Done review; full reactor green under -Plocal-db.

R424 (7400c67 core, 1a855a4 rework; Backlog → Spec 889f6cb, Spec → Ready c205824, In Review → Ready rework 814e255, In Progress → In Review a5c485f): Route inline (non-@splitQuery) @reference field argument reads through the field’s own SelectedField instead of the ancestor fetcher’s env. Inside the generated <Type>.$fields(sel, table, env) method, env belongs to the top-level operation fetcher, so env.getArgument("filter") returned null, the filter condition collapsed to noCondition(), and the field silently returned unfiltered rows (data-correctness bug, discovered via an opptak-subgraph reproducer where a @nodeId filter on Studiekurv.kladder was ignored; the @splitQuery sibling behaved because its env genuinely is the field’s own). Fix threads a sealed ArgumentValueSource (Env | FromSelectedField(sfLocal)) through FkTargetConditionEmitter.emitTerm → ArgCallEmitter.buildCallArgs → buildArgExtraction; root/split sites pass Env (byte-identical output), the two inline emitters pass FromSelectedField(sfName) so runtime reads resolve sf.getArguments().get(name). Covers the filter-condition path, the inline first pagination limit, and the JooqConvertlist pre-lift (`+emitJooqConvertKeyLifts, added to both inline emitters by parity ; pre-R424 that inline shape emitted a reference to an undeclared `<name>Keys local; the helper takes FromSelectedField directly since it has no Env caller). ContextArg stays env-based (request-scoped context is legitimately the ancestor env); never-inline arms (InputBean/JooqRecord) guard with IllegalStateException. The $fields host stamps @SuppressWarnings("unchecked") via the source-aware CallParam.emitsUncheckedCastFromSelectedField, keeping the Env hosts' warning-free output unchanged. Coverage: pipeline-tier InlineFilterArgumentSourcePipelineTest (source-aware suppression stamp incl. the top-level JooqConvertlist pin over the non-`@node+` store → customer FK, scalar negative case, end-to-end generation; annotation/model assertions only), execution-tier GraphQLQueryTest against real PostgreSQL (Store.customersByFirstName{,Split} narrowing + inline/split parity, customersFirstN limit, and the decode-consuming CustomerByNodeIdFilter fixture where a foreign store’s node id narrows the inline child list to empty with a @splitQuery parity mirror); compilation tier via the sakila-example -Werror build. Independent-session In Review → Done review; full reactor green under -Plocal-db.

R425 (9c2c9ab implementation; Backlog → Spec 119bfb2, Spec → Ready 2969866, In Progress → In Review 70484cd): Force-include a @service/@splitQuery child’s SourceKey columns in the parent $fields projection so its DataLoader key is never silently null. A @splitQuery child builds its DataLoader key off the parent source record (((Record) env.getSource()).into(<ParentTable>)), but the parent SELECT is driven purely by the client’s GraphQL selection set, so when the client selected the child without selecting a field mapping to the key column, the column was absent from the parent row, key extraction read null, and the child resolved to null with no error, biting hardest under federation where an Apollo Router _entities fetch supplies keys via representations without re-selecting them. Root cause was a pattern-match omission: TypeClassGenerator.collectRequiredProjectionColumns matched the two Split* arms (so split-@reference children were already covered) but let ServiceTableField/ServiceRecordField fall through to Stream.empty(). Fixed by collapsing the two Split* arms into a single BatchKeyField capability arm returning sourceKey().columns() (the capability-interface case per the capability-vs-sealed-switch principle; the enumeration already had a blind spot, its javadoc listed six implementers where seven exist). The three record-parent implementers (RecordTableField, RecordLookupTableField, RecordTableMethodField) are guarded with a loud IllegalStateException rather than routed: they key off a Java accessor via buildRecordParentKeyExtraction and can carry target-aligned columns, so a leak into the table-parent walk would silently project wrong columns, the same silent-null family this item fixes; the guard fails at generation time instead. One refinement beyond the literal spec: a null SourceKey (a @service method taking no Sources param, a plain per-parent delegation with no key read) contributes no columns rather than NPEing. Fold-ins: BatchKeyField javadoc gains the missing RecordTableMethodField; the two force-include taxonomy comments name the capability instead of enumerating Split*. Coverage: pipeline-tier ServiceProjectionPipelineTest (table-bound return ServiceTableField, scalar return ServiceRecordField, and a service child nested under a NestingField, each on a parent with no other force-projecting child, asserting TypeSpecAssertions.appendsRequiredColumn on the parent PK); execution-tier GraphQLQueryTest on a new unmasked City fixture (no @splitQuery/@tableMethod sibling, so the @service children are the only reason CITY_ID is projected) covering cityUppercase (Wrap.TableRecord, the silent-null shape) and cityLowercase (Wrap.Row, the loud-throw shape) queried without any key-mapped field, backed by the new CityService; federation execution-tier FederationEntitiesDispatchTest with a representations-driven _entities fetch selecting only the service child (the opptak reproducer shape, City promoted to a @key entity, FederationBuildSmokeTest’s `_Entity union pin updated); plus a note on the existing Film service-child tests that cast/castByKey mask this behaviour for Film. No code-string assertions on generated method bodies (pipeline tier uses the spec-named appendsRequiredColumn shape helper). Developer-side Wrap.TableRecord contract hazard filed separately as R426; distinct from R424 (child arguments read from the wrong env). Independent-session In Review → Done review; full reactor green under mvn install -Plocal-db.

R421 (fb4ca33 guard + tests + pom + seam; 8337c14 test references the seam’s FAULT_HEADER constant; 44fc1b0 move fault seam to a test @Alternative + pin the true single contract; Spec be489aa/514e2f0, Spec → Ready 9927eb8, In Progress → In Review 83d792a, spec wording correction 6ac9f29): Stop GraphqlResource.execute() in graphitron-jakarta-rest from leaking internals when the server-side execution path throws. The resource shaped every request error (400/405/422) into a spec-compliant application/graphql-response+json body but ran the consumer-implemented, auth-seeded application.newExecutionInput() SPI seam and engine.execute() unguarded; a fault there (observed: the seam forcing a JDBC connection with the DB down, a CreationException wrapping PSQLException) escaped past every spec-shaping branch into the container’s generic error handler, dumping the exception chain, stack, DB host/port, and internal package names as a non-spec response. Fixed with an ordered two-arm catch around both calls: catch (WebApplicationException) re-throws unredacted so a consumer signalling a client-facing 4xx from its adapter (e.g. ForbiddenException → 403) has JAX-RS map the intended status rather than collapsing it to a redacted 500 (arm order is load-bearing: WebApplicationException is a RuntimeException, so the broad arm would otherwise swallow it); catch (Exception) mints a UUID correlation id, logs the real cause server-side via SLF4J, and returns HTTP 500 (modern) / 200 (legacy) carrying the reference-only wire shape {errors:[{message:"An error occurred. Reference: <uuid>."}]} with no extensions, byte-identical to the message the generated ErrorRouter.redact emits (ErrorRouterClassGenerator line 481). This resource-level guard is the structural complement to ErrorRouter’s per-fetcher redaction: `newExecutionInput() runs before graphql-java execution begins, the one region neither ErrorRouter nor graphql-java’s own handling can see. The single-contract claim is the reference message, not byte-identity of the whole error object: the fetcher path builds through graphql-java’s GraphqlErrorBuilder which serialises a default extensions.classification, while the resource emits a plain {message} with no extensions, consistent with its own 400/422 errors; matching graphql-java’s classification from the resource was rejected (would contradict the no-extensions requirement and misclassify a pre-execution input-building fault as a data-fetching one). Vendor-neutral: the only dependency added to the module pom is org.slf4j:slf4j-api at provided scope (already version-pinned in the parent dependencyManagement); jakarta.ws.rs.WebApplicationException rides the existing provided jakarta.ws.rs-api, and no RESTEasy/Quarkus type is named. Testing lives in graphitron-sakila-example’s `GraphQLOverHttpConformanceTest (R399: the graphitron-jakarta-rest module carries no @Test classes of its own): four R421 cases (redacted 500 modern with no leaked internals, redacted 200 legacy, WebApplicationException → 403 passthrough, and redactionShapeMatchesFetcherPath pinning message-identity on both legs / no-extensions on the resource leg / classification-present-but-clean on the fetcher leg via the existing Film.durabilityError @service leaf). Fault injection is a test-scoped @Alternative @Priority bean, FaultInjectingGraphitronApplication, which subclasses the real adapter and throws on a sentinel X-Graphitron-Fault header while delegating every other request to super.newExecutionInput(), so execute() still drives the real seam wiring end-to-end and the shipped reference adapter (SakilaGraphitronApplication, a subgraph-author template) stays pristine. No code-string assertions on generated bodies. The trace-correlation follow-up (redaction reference id derived from an OTel trace_id via MDC, rather than a fresh UUID) was deliberately deferred to Backlog R423. Independent-session In Review → Done review; full reactor green under mvn install -Plocal-db (GraphQLOverHttpConformanceTest 15/15, 0 failures across the reactor).

R408 (352b05bc implementation, option A; In Progress → In Review 599cbc28, Spec → Ready a3564f2a): Give consumers a build-side lint-finding suppression mechanism, the suppression half of the configurability follow-on R398 deferred. A <lint> block on the Maven plugin config carries two axes with deliberately different scope: <disabledRules> names rule ids to silence everywhere, and <excludedTypes> names type-name globs (* any run, ? one char) to skip in the SDL lint engine’s AST walk. Option A (project config, whole-rule + type-name-pattern disable) was chosen at Ready sign-off over the node-local @lintDisable directive (option B, deferred until a consumer hits granularity a name pattern cannot express) and inline SDL comments (option C, rejected for fragile graphql-java comment-to-node anchoring). LintBinding collapses the POM block into a LintConfig(Set<String> disabledRuleIds, List<String> excludedTypePatterns) record on RewriteContext; LintConfig.validated types each disabled id against LintRule.ids() and fails the build (via MojoExecutionException) naming the offending id(s) and listing the valid namespace, so a typo is a build error not a silently-ignored line. Suppression is applied at the one build evaluator (GraphQLRewriteGenerator.withLintFindings), not in a Maven-log-only filter: the disabled-rule filter runs over the combined BuildWarning list after classifier advisories (schema.warnings()) and engine findings are concatenated, so it keys on the typed rule id and covers both channels (a Source.CLASSIFIER advisory like splitquery-redundant-on-record-parent is suppressible by id like any engine rule); the type-name-glob filter runs inside LintEngine.run, widening the same per-type skip boundary the bundled-type and R407 federation-injected exclusions use, and stays scoped to the engine’s AST walk. That asymmetry is deliberate and pinned by test: the classifier advisories arrive pre-formed with no structured owning-type handle to glob against, so a classifier advisory on an excludedTypes-matched type still fires (reverse-mapping a location or scraping the type name out of message text is the fragile-anchor trap option C rejects). Because the LSP replays the ValidationReport and the MCP diagnostics tool projects it, and DevMojo builds its context through the same buildLintConfig seam, a suppressed finding never surfaces in CI, the editor squiggle, or the MCP tool, from one definition with no second filter. Non-goals held: no severity overrides / error-capable lint (everything stays a warning), no @lintDisable directive, no plugin SPI for new rules. Coverage: pipeline-tier LintSuppressionPipelineTest (5: disabled-rule drops that rule while others fire, excludedTypes skips the matching type but not siblings, glob match, classifier-advisory-by-id suppression, and the engine-scoped excludedTypes asymmetry), unit-tier LintConfigTest (unknown-id validation failure listing the valid namespace, both-axes build, empty config), and single-evaluator parity tests at the LSP tier (LintSuppressionDiagnosticsParityTest: a build-suppressed finding does not replay as a squiggle while a co-present rule still does) and MCP tier (same, through the live diagnostics tool); assertions key on the typed LintRule / lintRule wire field, no code-string assertions on generated bodies. User docs shipped to their real home (docs/manual/reference/mojo-configuration.adoc, the <lint> parameter row plus a "Silencing lint warnings" section). Independent-session In Review → Done review; full reactor green under mvn install -Plocal-db. Builds on R398 (build-is-single-evaluator spine, typed LintRule id); the "author chooses not to fix" sibling of R407’s "cannot fix" exclusion, landing at the same LintEngine.run boundary.

R396 (2509653 implementation; In Progress → In Review e79a746, site-6 Spec review 0aeb581, Spec revise 7082fa5, Backlog → Spec 5ff535b): Accept schema-qualified or case-mismatched @table(name:) base names on the @reference FK-connection-and-orientation path. A type declared @table(name: "multischema_a.signal") (or multischema_a.SIGNAL over the real lowercase name) could not attach an @reference(path: [{key: "<fk>"}]) field: the verbatim, case-preserved @table echo was compared by bare equalsIgnoreCase against jOOQ’s always-unqualified FK endpoint names, so the FK read as "does not connect" (Author error: key '<fk>' does not connect to table '<name>'), and where a partial fix let it through, the same bare compare in the orientation predicate silently mis-oriented the join (origin/target swapped, slot pairing inverted). Reported against 10.0.0-RC21 (opptak), the @reference sibling of R395. Fixed by identity comparison, not input sanitization: two new JooqCatalog primitives, foreignKeyTouchesTable (source-side membership, either endpoint) and foreignKeyOnSource (orientation; self-referential FKs fall to the caller’s selfRefHint), resolve the source through the schema-aware findTable and compare FK endpoints by jOOQ table class identity (endpoint.getClass() == resolvedSource.getClass()), falling back to the historical bare compare when the source is Ambiguous/NotInCatalog so the diagnostic surface for genuinely-unknown names is unchanged; class identity also distinguishes same-named tables across schemas, which a normalized bare-name compare cannot. All six spec-enumerated sites routed through the primitives: Phase 1 ({key:} path) parsePathElement connection check → foreignKeyTouchesTable; orientation decided once via foreignKeyOnSource in synthesizeFkJoin and threaded into resolveFkSlots as a precomputed boolean fkOnSource (signature change), so the FK-orientation predicate lives in exactly one place; resolveRecordFkTargetColumns (site 5) uses the primitive for both its implicit-inference directional filter and slot orientation. Phase 2 ({table:} + empty inference) findForeignKeysBetweenTables resolves each argument to class identity; findUniqueFkToTable (site 4) and qualifierForFk (site 6, the synthesis-shim path whose bare re-filter turned a qualified-@table input type into a hard IllegalStateException) re-filter through foreignKeyOnSource. One documented deviation, endorsed on review: site 6 uses foreignKeyOnSource(…, selfRefHint=true) rather than the spec’s suggested foreignKeyTouchesTable, preserving the method’s strictly source-side semantics and the existing qualifierForFk_wrongSourceTable_returnsEmpty test. The verbatim echo stays the source name everywhere, so author-error diagnostics still quote what the user wrote; only the comparison changed. Phase 3 (qualified return-type terminal verdict via TableRef.sameTable) split out to R422 per the spec’s own scope recommendation. Coverage: unit-tier JooqCatalogMultiSchemaTest (both primitives over signal_widget_id_fkey with qualified and upper-case sources, referenced-side/non-endpoint/cross-schema-same-name cases, qualified-both-args findForeignKeysBetweenTables, and a synthesizeFkJoin qualified-source orientation guard pinning origin=signal/target=widget and slot orientation); pipeline-tier QualifiedSourceReferencePipelineTest (all three @reference forms plus the qualified-and-upper-case spelling classify to a correctly-oriented FkJoin, no author error); execution-tier MultiSchemaQueryTest with the R395 fixture tightened from @table(name: "signal") to its originally-specified @table(name: "multischema_a.SIGNAL"), rows still routing to the discriminated types and AlertSignal.widgetName populating through the now-validated cross-table @reference, with R395’s discriminator-qualifier coverage preserved (FROM still renders "multischema_a"."signal"). Known residual, non-blocking: foreignKeysTouchingTable (candidate-hint scoping on the error path) keeps the bare compare, thinning the "did you mean" list for a qualified source without affecting any verdict. Builds on R395 (dependency honored: R395 Done at f6cc9ae before R396 entered In Progress at 3518bb9); spawns R422. Independent-session In Review → Done review; full reactor green under mvn install -Plocal-db (unit 55, pipeline 4, execution 4 in the touched suites; 0 failures across the reactor).

R418 (8213374 implementation; In Progress → In Review 2eb9752, Spec → Ready 8d80d72, Backlog → Spec 440b207, Backlog 146d334): Make the web-sandbox SessionStart hook drop-and-recreate rewrite_test on every start, so the fixture DB is a pure function of the checked-out init.sql. Step 2 of .claude/scripts/session-start-web-env.sh previously created + seeded rewrite_test only when the database was absent; a sandbox first seeded from an older init.sql (e.g. one predating R389’s party_* joined-table fixtures + the jti_* composite PKs) kept that stale schema forever, and -Plocal-db jOOQ codegen then built its catalog against the stale DB, cascading into the UnclassifiedType/UnclassifiedField failures (Query.allParties, JoinedTableInheritancePipelineTest, and siblings) that every recent Done review documented as a manual re-seed. The existence guard is replaced by an unconditional DROP DATABASE IF EXISTS rewrite_test WITH (FORCE) (PG13+, cluster is PG16, so a lingering backend from a prior session cannot block the drop) + CREATE DATABASE + reseed, still inside the unchanged pg_ctlcluster/pg_isready gate so local dev (TestContainers, no persistent rewrite_test) stays a no-op; the password-reset line and its pg_was_running guard are untouched, and no checksum/skip optimization is added (sub-second reseed, and a skip-guard would reintroduce the staleness window). .claude/web-environment.md updated: the "Brings up PostgreSQL" step-2 bullet now states the drop/recreate/reseed-every-session behavior, and the Catalog-jar clobber section gains a note that a stale sandbox DB was a second, now-eliminated cause of the same cascade so a future reader does not misfile a DB-staleness failure as a catalog-jar clobber. Web-sandbox tooling only, no reactor/generator/test or init.sql change; the R389 jooq.codegen.schema.version bump is orthogonal and untouched. Verification is manual shell testing (spec § Verification): bash -n parses; the hook run against the live PG16 cluster fully replaces a stale DB (party present, 3 rows; a planted stale marker gone), force-terminates a lingering backend, and two back-to-back runs both succeed. Independent-session In Review → Done review; on the reviewer sandbox the reseeded catalog resolved the party corpus (JoinedTableInheritancePipelineTest 5/5, VariantCoverageTest 3/3 green under -Plocal-db). This item is the standing fix R413/R414/R384/R415/R407/R182 named for the recurring stale-rewrite_test review artifact.

R413 (0d4a2d3 implementation; In Progress → In Review 93e57a0, Spec → Ready d4f7401, Backlog → Spec dc18b15): Bind the parent-input VALUES cells of split/reference DataLoader rows methods through the key column’s jOOQ Converter DataType. The rows methods built each parent-key cell straight from the raw key Field (typed by ColumnRef.columnClass(), the converted user type), so a converter-backed or domain-typed key column rendered at the wrong SQL type and the correlation JOIN had no matching operator; against the utdanningsregisteret consumer schema, Campus.ORGANISASJONSKODE (kodeverk.kode_numerisk_domain over BIGINT with a Converter<Long, String>) bound as character varying and every @splitQuery/@reference child nulled out with operator does not exist: kodeverk.kode_numerisk_domain = character varying, invisible on the plain-typed Sakila keys. Fixed at the VALUES-emission seam (the one choke point every key passes through), not at key construction: all four parent-input sites, SplitRowsMethodEmitter.emitParentInputAndFkChain (list/single/connection prelude) + emitFromBridgeAndParentJoin, emitRecordTableMethodBody (@tableMethod variant), buildServiceTableLift (R285 lift-back re-projection), and MultiTablePolymorphicEmitter.buildParentInputValuesEmitter + per-branch ON lookups, now route their cells through ValuesJoinRowBuilder.cellsCode (extended with a constants-class-table-expression variant, making its single-VALUES-cell-authority javadoc claim true), emitting DSL.val(<scalar>, Tables.<OWNER>.<COL>.getDataType()) so jOOQ binds through the registered Converter at the DB type (coerce and cast were verified against jOOQ 3.20.11 and rejected in the Spec). The scalar extraction forks on SourceKey.Wrap, the axis that actually decides value accessors (replacing the coupled reader() instanceof AccessorCall fork): RecordN keys read k.valueN(); RowN keys recover the value from the bind Param via a new per-fetcher-class parentKeyCellValue helper with a loud statement-body throw, the documented contract for @sourceRow lifter keys (unenforceable at validate time, so pinned live at the execution tier). The owner table is a model fact: ParentCorrelation.parentKeyOwnerTable() folds the three-arm fork once (FkJoin origin / LiftedHop target / ConditionJoin parent); the polymorphic arm’s owner (the parent/hub table) rides InterfaceField/UnionField as a non-null parentKeyOwnerTable component threaded from the resolution sites. JOIN-predicate parentInput.field(...) lookups switch to the owner column’s DataType for symmetric type metadata; RowN/RecordN generic type-args stay columnClass()-typed (the converter’s user type IS the Java-side type). Fixtures pin end-to-end: org_code_domain (BIGINT) + converter_org/converter_campus in the fixture DB (schema version 2.3→2.4), OrgCodeStringConverter in graphitron-fixtures-codegen registered via <forcedTypes>, and sakila-example execution tests covering single-cardinality @splitQuery (the reported Campus.organisasjon shape), list-cardinality @splitQuery, and a @sourceRow lifter over the converter-backed key (the live parentKeyCellValue Param-contract pin); existing unit expectations updated in place, no new body-substring assertions. Independent-session In Review → Done review; full reactor green under mvn clean install -Plocal-db (2419 core tests + sakila-example compilation/execution tiers, GraphQLQueryTest 297 tests, 0 failures) after re-seeding a stale local rewrite_test DB (missing the R389 party fixtures and R413’s own converter_* tables), the same Query.allParties / JoinedTableInheritancePipelineTest stale-DB artifact every recent Done review documents (standing fix: R418), on paths R413 does not touch.

R414 (f106d52 implementation; In Progress → In Review ae9226b, Spec → Ready c0b4ff7, Backlog → Spec 6ea032b): Serve a real per-parent totalCount on split/DataLoader-backed connections, closing the last classification path that produced null-(table, condition) ConnectionResult carriers on reachable queries. A nested (non-root) @splitQuery connection advertised totalCount: Int in the emitted SDL but always resolved it to null: the scatter path (SplitRowsMethodEmitter.scatterConnectionByIdx) built each per-parent ConnectionResult through the (result, page) convenience constructor, which passed null for the (table, condition) pair the generated ConnectionHelper.totalCount needs to issue its SELECT count(*). The fix mirrors the B4c-2 polymorphic-batched semantics (MultiTablePolymorphicEmitter.buildBatchedConnectionRowsMethod): the rows method hoists its WHERE into a single Condition where local (buildWhereCondition called exactly once, since it declares FK-target alias locals as a side effect) shared by the windowed page query and a new cursor-independent countSource derived table (same join topology via emitFromBridgeAndParentJoin, no orderBy/seek so the count is window-independent); scatterConnectionByIdx gains a Table<?> countSource parameter and binds each per-parent carrier via the 4-arg ConnectionResult constructor with countSource.field("__idx__", Integer.class).eq(DSL.inline(i)), so ConnectionHelper.totalCount runs SELECT count(*) FROM countSource WHERE __idx__ = i lazily on selection (zero count SQL when unselected, N counts for a batch of N parents when selected). The now-dead two-arg (result, page) ConnectionResult constructor is removed (scatterConnectionByIdx was its only caller; this is generated-into-consumer source, not published API); the nullable (table, condition) field shape and the if (cr.table() == null || cr.condition() == null) return null guard stay for the one validator-unreachable producer that remains, MultiTablePolymorphicEmitter.buildRootConnectionFetcher’s defensive empty-participants `new ConnectionResult(List.of(), page, null, null), and the three "Split-Connection scatter passes null" comments are re-pointed to name that remaining producer rather than narrowed to non-null. Sakila’s ActorsConnection (shared by Film.actorsConnection + Film.actorsOrderedConnection, both @splitQuery) gains totalCount: Int. True B4c-2 structural unification (a shared materialised pre-window derived table feeding both the ranked window and the count) is a deliberate non-goal: the split page query’s .orderBy(page.effectiveOrderBy()).seek() reference live terminal-alias columns, and re-pointing them at derived-table fields would rework well-tested pagination for no user-visible gain; the dual topology emission shares one emitFromBridgeAndParentJoin helper and the single hoisted where, so drift risk is low (possible follow-up if it ever drifts). Coverage: execution-tier GraphQLQueryTest (splitQueryConnection_totalCount_isParentScoped counts 2/2/1/1/1 for films 1-5 against the seeded film_actor rows with first: 1 to distinguish the count from the page size; _isCursorIndependent still reports 2 paging past an after cursor; _isLazyOnSelection asserts no select count SQL when unselected and exactly N per-parent count statements when selected) and pipeline-tier SplitTableFieldPipelineTest (structural: scatterConnectionByIdx carries the Table<?> countSource parameter), no code-string assertions on generated method bodies. Mirrors B4c-2’s count semantics; per-parent totalCount for hypothetical future split shapes (SplitLookupTableField has no connection arm today) stays out of scope. Independent-session In Review → Done review; full reactor green under mvn install -Plocal-db (2418 core tests + the sakila-example compilation/execution tiers, 0 failures). The graphitron-core red first seen in the review sandbox (Query.allParties → UnclassifiedField; JoinedTableInheritancePipelineTest ClassCast on the R389 party/jti_* fixtures) was the known stale-rewrite_test-DB artifact every recent Done review documents, the local DB predating the R389 fixtures and jOOQ’s schemaVersionProvider suppressing catalog regeneration; re-seeding from init.sql + a clean catalog regen produced a fully green reactor including R414’s execution tier, on paths R414 does not touch (the R418 always-reseed hook is the standing fix).

R384 (60b58ae phase 0 plumbing, 6021bda phase a JooqConvert, fb1b2e4 phase b NodeIdDecodeKeys, feadbcb phase c developer @condition, 24b2527 In Progress → In Review; Spec → Ready re-review bd2e761): Lift the remaining filter-argument kinds onto multitable interface/union root query fields, completing the arc R363 (branch-safe Direct/EnumValueOf/ContextArg) and R383 (nested-input @field) opened. Where R383 needed zero new plumbing, these three kinds share it, so the work is one multi-phase item over a single seam: phase 0 widens MultiTablePolymorphicEmitter’s root entry points to carry the enclosing `<Type>Fetchers class’s CompositeDecodeHelperRegistry and pre-declares (as statements ahead of the inline stage-1 union) the locals branch filter terms cannot introduce themselves, FK-target join-hop aliases (FkTargetConditionEmitter.declareAliases per participant, namespaced by the stage1_<Type> base), deduped <name>Keys locals for JooqConvert-list args, and shared lifted-outer Map locals, replacing branchFilterWhere’s former `emitTerm(..., null, null, Map.of()) with the threaded values (behaviorally inert, proving the seam before any arm flips). Phase a flips the JooqConvert arm branch-safe and, per R267 (fix a deprecation-for-removal at the source, never suppress), replaces the deprecated-for-removal DataType.convert(Object) in ArgCallEmitter’s shared arm with the non-deprecated `DSL.val(raw, col.getDataType()).getValue() coercion (the design-principles §"Column value binding" idiom, .equals-identical to the deprecated form on a converted domain type, verified against jOOQ 3.20.11), correcting the single-table path in the same change; it also aligns the nested @field leaf with top-level conversion semantics (an ID-typed nested @field over a plain column now carries a JooqConvert leaf instead of the hardcoded Direct) and carves JooqConvert leaves out of CallParam.emitsUncheckedCast (the instanceof List<?> guard casts nothing). Phase b flips NodeIdDecodeKeys branch-safe, homing the drained decode helpers on the <Type>Fetchers class hosting the branch call site (a documented revision of the Ready text’s per-participant-composer wording, which put wire-decode machinery on the env-free pure-function composer and was not implementable; the per-class collectInto bracket is the true single-table precedent). Phase c removes the R363 field/arg-level hasCondition pre-guard and relaxes firstUnsupportedFilterArg’s first guard so developer `@condition filters (ConditionFilter/FkTargetConditionFilter) gate uniformly on their per-param extractions; the developer method reflects once per participant and runs against each branch’s stage-1 alias, a Table<?> first parameter serving every branch while a concrete-table parameter surfaces a mismatch at consumer javac (R379 semantics). The exhaustive nine-permit isBranchSafeExtraction switch stays the forcing function: NodeIdDecodeRecord/InputBean/JooqRecord remain explicit false arms (mutation-input/record-decode shapes that do not occur as a multitable root-query filter arg). Coverage: pipeline-tier MultiTableFilterLoweringTest (each kind’s rejection test flips to a lowered per-participant assertion on the model, JooqConvert/NodeIdDecodeKeys extraction, nested-leaf alignment, three @condition cases including nested-input) and execution-tier MultiTableFilterExecutionTest over the AddressOccupant = Customer | Staff union (occupantsByStoreId per-branch coercion, occupantsByAddress decode-and-filter plus a wrong-type-id client-error, occupantsStartingWithM/occupantsByNamePrefix/OccupantFilter.namePrefix via the new Table<?>-generic MultiTableConditionFixtures), with graphitron-sakila-example’s `-Xlint:all -Werror compile the pin that phase a stays off the deprecated form; no code-string assertions on generated bodies. Independent-session In Review → Done review; full reactor green under mvn clean install -Plocal-db (0 failures) after re-seeding a stale local rewrite_test DB (missing the R389 party fixture) and regenerating the jOOQ catalog, the same Query.allParties / JoinedTableInheritancePipelineTest stale-DB artifact earlier Done reviews noted, on paths R384 does not touch. Builds on R363 / R383; pins jOOQ coercion with R267 / R379.

R415 (4be03d6; Spec → Ready 197307d, Backlog → Spec 51503c5): Clamp connection first/last at the single runtime choke point and unify the no-channel error disposition. A negative first/last on a connection field flowed unvalidated into the SQL LIMIT, so PostgreSQL threw LIMIT must not be negative, which the framework redacted into an opaque correlation-id 500 instead of a client-facing validation error; first: 2147483647 produced the identical redacted 500 via limit = pageSize + 1 wrapping to Integer.MIN_VALUE. Fixed in the emitted ConnectionHelper.pageRequest (the one choke point every connection flavour funnels through): three guards next to the existing mutual-exclusion check, all throwing the R378 client-error marker GraphitronClientException so the real message reaches the client, negative first, negative last, and the derived-limit overflow (pageSize == Integer.MAX_VALUE, guarding the value PostgreSQL actually enforces rather than each input, which also covers a pathological defaultPageSize); the pre-existing mutual-exclusion IllegalArgumentException("first and last must not both be specified") migrated onto the same marker (same client-mistake family, same redaction defect). first: 0 stays valid. The purity note reworded to the load-bearing property (pageRequest takes no DataFetchingEnvironment; the marker subclasses GraphqlErrorException, so "no graphql-java dependency" was never the true invariant) at both ConnectionHelperClassGenerator and TypeFetcherGenerator:4792. Second defect, drift R378 introduced: the no-channel disposition is one decision at four emit sites across two emitters, and R378 flipped only the two sync catch arms to surfaceClientErrorOrRedact while leaving the two async .exceptionally arms on plain redact, so a client error on a nested (DataLoader-based) @splitQuery connection would still redact. Lifted the router call into one shared definition ErrorRouterClassGenerator.noChannelRouterCall(outputPackage, throwableVar) consulted by all no-channel sites, both noChannelCatchArm`s, both `asyncWrapTail no-channel branches, and ChannelCatchArmEmitter (a fifth site already on the right disposition); the two async arms flip to surfaceClientErrorOrRedact, whose cause-chain walk unwraps the CompletionException DataLoader wraps around a batch-function throw, so the marker surfaces while everything else keeps redacting (blast radius bounded to the marker type). The next disposition change is now one edit, not a four-site hand-coordination. Prose that named the old behaviour fixed in the same pass (TypeFetcherGenerator:6303/:6498, MultiTablePolymorphicEmitter:2006). Coverage: execution-tier GraphQLQueryTest (filmsConnection negative first/last surface the argument-naming message and never contain An error occurred. Reference:, first: 2147483647 surfaces the overflow message, first: 0 returns an empty page with a computable hasNextPage, the migrated collision message, and the load-bearing filmById(...) { actorsConnection(first: -1) } proving the async-arm flip end-to-end through the DataLoader CompletionException unwrap, which a root-connection test alone would pass without the flip), unit-tier ErrorRouterClassGeneratorTest.noChannelRouterCall_emitsSurfaceClientErrorOrRedact, and updated TypeFetcherGeneratorTest arm pins. Out of scope, filed nowhere yet: malformed after/before cursor redaction (same family, different surface) and a configurable maximum page size (a DoS policy cap, distinct from this correctness-only overflow guard). Builds on R378. Independent-session In Review → Done review; full reactor green under mvn install -Plocal-db (GraphQLQueryTest 294 tests, 0 failures) after re-seeding a stale local rewrite_test DB (missing the R389 party + jti_* joined-table fixtures) and a clean jOOQ catalog regen, the same Query.allParties / JoinedTableInheritancePipelineTest stale-DB artifact the R416/R407/R182 Done reviews documented, on paths R415 does not touch.

R416 (71f5429 In Progress → In Review implementation; d58ae37 Dependabot #504/#506 closure record; d893673 self-review charset-tolerant asset content-type assertions; Spec → Ready 943884f, Backlog → Spec 9ad3ff1, Backlog c3623f2): Self-host the GraphiQL playground assets in graphitron-jakarta-rest, retiring the runtime unpkg CDN. The playground page (GET /graphql, Accept: text/html) previously loaded React + GraphiQL from unpkg at latest (unpinned, so it silently tracked upstream) and was dead behind a strict CSP or on an air-gapped network, unacceptable for "the first hand-written runtime artifact consumers depend on" serving Sikt’s gov/edu consumers. Now a version-pinned GraphiQL 5 + React bundle (graphiql@5.2.2, react@18.3.1, graphql@16.13.2, @graphiql/toolkit@0.11.3, built with vite@6.4.2 / @vitejs/plugin-react@4.7.0) ships as plain classpath resources under no/sikt/graphitron/jakarta/rest/graphiql/ and is streamed by a new path-traversal-safe @GET assets/{name} method on GraphqlResource (a [A-Za-z0-9._-]+ allowlist + explicit .. reject + extension→MIME gate over js/css/map/ttf/woff/woff2/svg, all behind the existing graphiqlEnabled() seam). Vendor-neutral by design: getResourceAsStream, not META-INF/resources/ (which only serves on Quarkus, contradicting the module’s Jakarta-EE-neutral ethos). graphiql() gained @Context UriInfo and rewrites a {{ASSET_BASE}} placeholder to the absolute per-request .../graphql/assets/ prefix, so the entry files resolve at any mount point (/graphql, /api/graphql, …​) while every code-split chunk/worker/codicon-font resolves relative to them via the bundle’s base: './'. The Vite recipe was git mv’d from the (now GraphiQL-free) `graphitron-sakila-example into graphitron-jakarta-rest/tools/graphiql-build/ as a one-shot commit-the-output recipe: no <build> binding, so the reactor’s "CI never touches node" property holds; the committed bundle is the artifact, the recipe the reproducibility receipt. Deviations from the plan, all documented and justified: a JS-entry Vite build (GraphiQL 5 is a monaco bundler SPA, not the old UMD global-script shape) rather than the literal "swap four URLs"; staying on vite 6 / plugin-react 4 rather than #506’s vite 8 / plugin-react 6 majors (plugin-react 6 drops Babel for Oxc, a larger change with no benefit here); the MIME map extended past the plan’s js/css/map to cover monaco’s codicon .ttf and fonts; the broader R399 app-section README drift (dead GraphqlEngine/GraphqlResource/AppContext links) split out as follow-up R417 rather than expanded into scope. The companion/opt-in -graphiql artifact (the architect’s leanness-preserving "option C") was consciously deferred: the consumer set is small and known, so the bundle weight is accepted in the core jar now, with option C the escape hatch if a real consumer is pinched. Docs reconciled across every GraphiQL surface (the graphiql.html rationale comment, the relocated recipe README, modules.adoc, both tutorial pages, the sakila-example README’s GraphiQL entries); Dependabot #504 (linkify-it) and #506 (vite/plugin-react) closed as superseded, each pointing at R416. Coverage per R399 (jakarta-rest carries no @Test classes): graphitron-sakila-example’s `GraphqlResourceSmokeTest gained six page + asset conformance checks (self-hosted page has the mount div, no unpkg.com, and a resolved .../graphql/assets/ base; the entry graphiql.js/graphiql.css stream with the right content-type; missing and unknown-extension names 404). Independent-session In Review → Done review; full reactor green under mvn clean install -Plocal-db (2416 core tests + the sakila-example compilation/execution tiers, GraphqlResourceSmokeTest 6/6, 0 failures). The graphitron-core red the implementer reported as "pre-existing trunk breakage" (Query.allParties → UnclassifiedField, JoinedTableInheritancePipelineTest, and the Person/AppAccount joined-table schema-validation failures in sakila-example generation) was in fact the known stale-rewrite_test-DB artifact the R407 and R182 Done reviews already documented, the local DB predating the R389 party + jti_* fixtures so its jOOQ catalog lacked the detail tables' primary keys; re-seeding from init.sql + a clean catalog regen produced a fully green reactor and let the conformance test run in-pipeline, on paths R416 does not touch.

R407 (406f80d implementation; In Progress → In Review 2f5f741, Ready → In Progress d910a1f, Spec → Ready 825b524, build-command fixup b483e1e): Exclude generator-injected federation/@link definitions from the R398 SDL lint engine. A consumer schema carrying a federation @link saw type-names-pascal-case and types-and-fields-have-descriptions warnings on federation__FieldSet, link__Import, and siblings the author never wrote and cannot rename (names dictated by the federation spec) or document (descriptions owned by federation-graphql-java-support); these definitions carry a null source, the tell that they came from no consumer .graphqls. Fixed by provenance, not a name.contains("__") heuristic and not by borrowing ScalarTypeResolver.FEDERATION_NAMESPACE_SCALARS (a hand-maintained expectation free to drift on a spec bump): FederationLinkApplier.apply now returns the Set<String> of names it injected (collected in its existing defs.forEach loop, the sole contributor) instead of a bare boolean. AttributedRegistry carries that set as injectedNames() and derives federationLink() from it ("injected anything"), collapsing the two facts into one component rather than a parallel carrier; AttributedRegistry.from(...) derives the set the same way for ad-hoc test registries. LintEngine.run gains an overload taking the set and unions it with the existing BUNDLED_TYPE_NAMES exclusion at the two skip points it already has, widening the name-set skip to a second generator-owned contributor with no new skip mechanism, no new LintRule, no new LintNodeKind. KeyNodeSynthesiser is untouched: it decorates author @node types in place with @key and injects no new definitions, so folding its names in would wrongly silence real author violations; it keeps its void signature. Coverage: pipeline-tier LintInjectedFederationDefinitionsTest carries a federation @link plus an author type lowercase @node (the exact type synthesis decorates), exercising the real injection path and pinning both halves in one fixture, injected names stay silent while the author type’s pascal-case violation still fires; findings asserted on the typed LintRule and the minimum node-identity check, no rendered-message or generated-body assertions; FederationLinkApplierTest updated to assert on the returned name set. No per-name unit list. Reuses R398’s BUNDLED_TYPE_NAMES mechanism; sibling to R408 (author-driven suppression, the "chooses not to fix" half). Independent-session In Review → Done review; full reactor green under mvn install -Plocal-db (2407 core tests + sakila-example compilation/execution tiers, 0 failures) after re-seeding a stale local rewrite_test DB (missing the R389 party + jti_* joined-table fixtures) and regenerating the jOOQ catalog, the same Query.allParties / JoinedTableInheritancePipelineTest stale-DB artifact earlier Done reviews noted, on paths R407 does not touch.

R182 (In Review → Done; landing sequence 657dd71 delete legacy reactor, a505cab unwrap rewrite to repo root, aad2f61 restructure architecture docs into Diataxis docs/architecture/, cbaeb64 CI/CD workflows, 31750bf docs+tooling paths; In Review transition b0cb778; In Progress e90e321; R19 discard adb071a): Retired the legacy graphitron-parent reactor and unnested graphitron-rewrite/ to the repo root. The six legacy modules (graphitron-codegen-parent, graphitron-common, graphitron-example, graphitron-maven-plugin, graphitron-servlet-parent, graphitron-schema-transform) and the legacy root pom.xml + maven-build.yml are gone; the rewrite aggregator (graphitron-rewrite-parent) is now the root POM with its eleven modules + docs at the top level, and the duplicate graphitron-javapoet collapses to one copy. This closes the release-event publish hazard: maven-publish.yml on main drops the -f graphitron-rewrite/pom.xml flag and carries the RC-aware tag regex, so a release tag can no longer republish deleted legacy artifacts at 10.0.0. Docs restructured: the flat graphitron-rewrite/docs/ tree became a Diataxis-shaped docs/architecture/{explanation,reference,how-to}/ folded into the site module (README.adoc split into index.adoc + reference/modules.adoc + explanation/pipeline-overview.adoc; getting-started.adoc dissolved into the manual how-to pages plus a new how-to/dev-loop-internals.adoc carrying the #dev-loop-detail / #native-runtime-dependency anchors), and roadmap-internal workflow.adoc moved out of the site to roadmap/workflow.adoc. roadmap-tool’s `Main.java gained a quadrant-aware mapAdocTarget (driven by an ARCH_QUADRANT slug table) plus repointed README/status-board headers; the ~11 inbound docs/** architecture xrefs were repointed; CI path prefixes and the tree-sitter-natives-release.yml env vars were de-prefixed. verify-standalone-build.sh retired, the CLAUDE.md legacy-scope rule removed, and rewrite-design-principles.adoc’s standalone-vs-legacy invariant reworded now that no legacy tree exists. Closes R26’s last open sub-item and supersedes R19 (discarded, not squashed). Step 8 (cut a release tag to exercise the consolidated publish workflow end-to-end) is inherently post-merge: the hazard only closes once this lands on `main. Independent-session In Review → Done review; full reactor green under mvn install -Plocal-db (2406 tests in graphitron, docs site renders the Diataxis /architecture/ tree with workflow.adoc correctly absent). The graphitron-core red first seen in the review sandbox (Query.allParties → UnclassifiedField) was the known stale-rewrite_test-DB artifact (the pre-existing DB predated the R389 party fixture and jOOQ skipped codegen against it); re-seeding from init.sql + a clean catalog regen produced a fully green reactor, orthogonal to the R182 diff.

R19 (discarded, superseded by R182): "Rebase and squash rewrite branch onto main" is abandoned. R182 retires the legacy reactor and unnests the rewrite by moving the tree up one level in three ordinary commits (delete, unwrap, docs restructure), not by rewriting history; R19’s squash approach is not the accepted path. R19’s own numbers were stale (April-2026 commit counts against a since-moved merge base). File deleted per the 2026-07-01 staleness audit.

R406 (landing e72eb02; rework onto R405 trunk from first pass 1b6971d, In Review → rework 1f4412f, Spec → Ready 6296d0b, spec 5f5ebc2, filed 1633934): Support a single-table discriminated interface (@table @discriminate, implementers pinned by @discriminator(value:), all sharing one jOOQ table, e.g. Content over content) as a DML @mutation(typeName: INSERT|UPDATE) return type. Before this, such a return was not rejected but silently mis-accepted (a TableInterfaceType is a TableBackedType, so it classified through the TableBoundReturnType arm to ProjectedSingle/ProjectedList) and emitted a <Type>.$fields(...) re-projection that never generates for an interface, so the sources failed to compile. The write half is a plain single-@table write (the discriminator is an ordinary @field(name: "CONTENT_TYPE") input column the client sets; resolveInput unchanged); the entire fix is on the return half. Model: added the sibling DmlReturnExpression.DiscriminatedSingle/DiscriminatedList arms carrying the read-side discrimination data (interfaceName, discriminatorColumn, knownDiscriminatorValues, TableBound participants) sourced verbatim from the TableInterfaceType verdict, the DML sibling of R405’s *ServiceTableInterfaceField; both map to the same Record/Table domain-return + target shape as Projected*. A new return-shape arm (not a per-verb MutationField leaf) keeps the fork off the write-verb axis, per "lift the fork into the model": the write half is uniform across INSERT/UPDATE and the model already carries the return-shape seam. Classify: the single DML chokepoint buildDmlField resolves the return’s look-ahead verdict once and threads it into the still-static buildDmlReturnExpression, which builds the Discriminated* arm when the verdict is a TableInterfaceType. Validate: dispatchPerformsReFetch recognises the Discriminated* arms as re-fetching, keeping the emitter and OutputField.requiresReFetch() in lockstep under the build-time drift guard; the DELETE and @asConnection floors already fire for the interface case through the shared TableBoundReturnType arm. Emit: consumes R405’s shared read-side re-projection TypeFetcherGenerator.buildTableInterfaceReprojection (passing List.of() for alwaysProject, since the DML path keys the follow-up SELECT by a PK-IN Condition off the RETURNING keys rather than re-mapping by PK like the service path); the duplicate buildDiscriminatedReprojection from the first pass is deleted. Step 1 (PK-only RETURNING in dsl.transactionResult) and the composite-safe PK-IN builder were extracted into emitKeysTransaction + buildPkKeysCondition, R406-owned and shared only between emitProjected and emitDiscriminated (the DML write half has no R405 equivalent; they key off the RETURNING keys local, distinct from R405’s records-keyed MultiTablePolymorphicEmitter.buildPkInCondition). The generated row carries __discriminator__; the interface’s existing TypeResolver sets __typename per row, so no new resolver and no per-typename UNION. Drop/write-read asymmetry aligned with R405: an INSERT of an unknown discriminator commits its row (the transaction closed before the follow-up SELECT) yet returns null, since the discriminator filter cannot name a subtype outside the known set; enforcing the discriminator domain is the database’s job (a CHECK constraint), not a graphitron pre-screen. Scope: INSERT/UPDATE only; DELETE (encoded-ID, own floor), UPSERT (blocked on R144/R145), unions (permanently), and Connection stay out. Coverage: unit-tier GraphitronSchemaBuilderTest (DiscriminatedSingle INSERT + UPDATE + DiscriminatedList classification, a regression pin against the pre-R406 ProjectedSingle silent-accept, and a DELETE-floor rejection pin), pipeline-tier FetcherPipelineTest INSERT/UPDATE shape assertions, and execution-tier DmlTableInterfaceReturnExecutionTest (real PostgreSQL over the content fixture + a new ContentInput/createContent/updateContent schema fixture: per-__typename routing off the live discriminator, the cross-table FilmContent.rating join, same-table ShortContent.description isolation, and the unknown-discriminator write/read asymmetry). Independent-session In Review → Done review; full reactor green under mvn -f graphitron-rewrite/pom.xml install -Plocal-db. The full-reactor graphitron-core red first observed in the review sandbox (Query.allParties → UnclassifiedField; JoinedTableInheritancePipelineTest ClassCast on the R389 jti_* fixtures) was the known stale-rewrite_test-DB artifact (missing jti_app_account/jti_person composite PKs) compounded by jOOQ’s up-to-date codegen skip; re-seeding from init.sql + a clean catalog regen produced a fully green reactor including R406’s execution tier, and the failures are orthogonal to R406. Consumes R405’s buildTableInterfaceReprojection (extracted read-side, landed 7b9d051). Non-blocking carry noted at review: the two FetcherPipelineTest cases use CodeBlock.toString().contains(...) body-string assertions (existing DML-fetcher precedent in the same file; model shape pinned in GraphitronSchemaBuilderTest, behaviour at the execution tier).

R370 (core four sites + fixtures + R412 filing a13523e; two remaining in-hand @service-path sites + witnesses 4e22ee4; Spec → Ready 7a853a5, In Review → Ready rework 352cc16): A record-backed parent with a nested backing class emitted the non-compiling $-qualified Outer$Nested because ClassName.bestGuess re-parses a binary class name and never splits on $. Fixed at the six sites that already hold a structurally-correct name in hand, so the swap is a one-for-one ClassName.get(Class) / captured-TypeName substitution at the source boundary rather than a per-consumer patch: the two AccessorRef producers (deriveAccessorRecordParentSource, derivePolymorphicHubSource), the @service return-type validator (checkServiceReturnMatchesPayload, previously spuriously rejecting nested payloads at classify time), and the query + mutation @service fetcher return types (computeServiceRecordReturnType, computeMutationServiceRecordReturnType, both collapsed to ServiceMethodCall.javaReturnType() so the twins no longer drift), plus the @service Outcome payload ctor arm (resolveErrorChannel → ClassName.get(payloadCls)). Restores AccessorRef’s own javadoc contract and corrects the now-true "Identical policy" mirror javadoc; the stale R370 hazard note in `buildScalarPerParentFetcher was removed. Coverage: two compilation-tier fixtures, one per AccessorRef producer (NestedFilmsPayload list-arm via buildAccessorKeyMany, NestedOccupantCarrier single-cardinality polymorphic via buildScalarPerParentFetcher); a mutation + @error-channel compilation fixture (NestedFilmReviewPayload) reaching computeMutationServiceRecordReturnType and resolveErrorChannel; and a classification-tier ErrorChannelClassificationTest.childServiceRecordField_nestedPayloadBacking_payloadClassIsStructurallyResolved pinning the resolved PayloadClass.payloadClass() to the structural Outer.Nested by object-equality on the TypeName (no code-string assertion on any generated body). The review corrected the spec’s second-witness premise: after the R244 Outcome flip, root @service outcome fields classify to ErrorChannel.Mapped (no developer payload class emitted), so resolveErrorChannel’s `PayloadClass arm is reached only by a child @service field, hence the classification-tier witness rather than a sakila compile fixture. The remaining bestGuess-over-fqClassName emit sites that hold no reflected Class/captured TypeName (backingClassOf, recordColumnReadArgs, FetcherEmitter, several ChildField sites) need a model-lift, not a call swap, and were filed as R412. Independent-session In Review → Done review; full reactor green under mvn -f graphitron-rewrite/pom.xml install -Plocal-db (2406 core tests + the sakila-example compilation/execution tiers, 0 failures) after re-seeding a locally-clobbered rewrite_test catalog (the Query.allParties / JoinedTableInheritancePipelineTest cascade was a stale-DB artifact orthogonal to R370).

R405 (landing 7b9d051; Spec → Ready e133e55, Backlog → Spec ca05952, flow/mechanism capture f61566b, filed 1633934): Support a single-table discriminated interface (@table @discriminate, implementers pinned by @discriminator(value:), all sharing one jOOQ table) as a root @service polymorphic return, closing the last deferred shape on the @service polymorphic surface. Route (a) (R365, multitable) dispatches each service-returned record on its runtime Java class, which cannot tell same-table subtypes apart; this path instead reuses the read-side discriminator mechanism. New QueryServiceTableInterfaceField / MutationServiceTableInterfaceField leaves (single-table siblings of *ServicePolymorphicField) carry the shared-@table TableBoundReturnType, discriminator column + known values, and TableBound participants plus the service binding; target shape Interface keeps requiresReFetch() false. Both root classifiers' TableBound arms build the new variant when the verdict is a TableInterfaceType (deferServiceTableInterface deleted). Emit reuses the read-side projection: the shared discriminator-filter + __discriminator__ projection + cross-table LEFT JOIN assembly was extracted from the two read fetchers into a package-private TypeFetcherGenerator.buildTableInterfaceReprojection (read paths pass an empty alwaysProject, output unchanged); the new MultiTablePolymorphicEmitter service fetcher calls the service, normalises the return to List<Record> (extracted shared snippet), collects the shared table’s PKs into a composite-safe DSL.row(pk…).in(rows) condition, runs one by-PK SELECT through the shared helper, and re-maps rows to input positions by PK (drop contract aligned with route (a): an unmatched PK drops from a list, yields null for a single). Validate mirrors the single-table floor (validateCardinality only, not the multi-table participant check). Union returns stay permanently unsupported; child @service polymorphic returns and @asConnection stay out of scope. Coverage: pipeline-tier ServiceTableInterfaceReturnPipelineTest, unit-tier classification flip (serviceReturningTableInterface_classifiesAsServiceTableInterfaceField + mutation twin) and ServiceTableInterfaceFieldValidationTest, the two ClassifiedCorpus examples + GeneratorCoverageTest leaf-partition pin, and execution-tier ServiceTableInterfaceReturnExecutionTest (real PostgreSQL: list routes each row to FilmContent/ShortContent off the live discriminator, populates FilmContent.rating via the cross-table join, honours the drop contract, single + mutation cardinality). Independent-session In Review → Done review. R405’s own tests are green; the full-reactor graphitron-core red observed in the review sandbox (Query.allParties → UnclassifiedField; JoinedTableInheritancePipelineTest ClassCast) was a stale-rewrite_test-DB artifact (missing party_* tables + jti_person PK) compounded by jOOQ schemaVersionProvider regeneration caching, reproduced identically at the pre-R405 parent 8fca064 and orthogonal to R405; re-seeding the local DB from init.sql + a clean rebuild produced a fully green reactor including R405’s execution tier. Non-blocking follow-up noted at review: the pipeline test uses CodeBlock.toString().contains(...) body-string assertions (repo precedent exists; behaviour is independently pinned at the execution tier). R406 reuses this item’s read-side dispatch for its DML return half.

R332 (cb99991 implementation; 8fca064 fixture-gate accounting; Spec → Ready 6ad75dd): Deprecation signal for @table on input types, a signal-only precursor ahead of R97’s consumer-derived removal (classification behaviour unchanged). Two tiers per D1. Prose tier (ships unconditionally, carries the carve-out in words): the @table description in directives.graphqls gains the input-type deprecation note + replacement instruction (no SDL @deprecated marker, the spec forbids it on a directive location); a directive-level row in deprecations.adoc with the section heading/intro widened from "whole directives" to "whole directives and directive locations"; a WARNING admonition on the canonical table.adoc page; and the code-generation-triggers.adoc Input type with @table row annotated. Actionable tier (fires per @table-on-input type, respects the carve-out): a post-classification GraphitronSchemaBuilder.emitTableOnInputDeprecationWarnings(ctx) pass placed beside rejectCaseInsensitiveTypeCollisions, walking ctx.schema input types that explicitly declare @table and emitting a non-fatal BuildWarning.NoRule per usage (the plain non-lint arm per D1, not LintFinding; message names no R<n> per D2; unconditional per D4). The encoded-ID / scalar-return INSERT/UPSERT carve-out (D3) is computed by encodedWriteTargetInputTypes(ctx) off the classified model (the MutationInsertTableField/MutationUpsertTableField leaves whose returnExpression() is an Encoded* arm), needing no lookAheadVerdict or reflection, so R332 stays depends-on: []; the type-level conservative rule suppresses an input reused by any encoded INSERT/UPSERT. encodedWriteTargetInputTypes is the named find-usages anchor R97 Phase 2b retires (forward edge R97 → R332). Coverage: pipeline-tier TableOnInputDeprecationWarningTest (projected-return INSERT warns with source location; encoded-ID INSERT carved out; D3 reuse suppression) 3/3 green; DeprecationsDocCoverageTest gains "table" in WHOLE_DIRECTIVE_DEPRECATIONS; FixtureWarningsGateTest segregates the R332 category out of its exactly-one advisory scope (mirroring the ENGINE-lint filter) and adds a count-independent carve-out test (FilmCreateInput/FilmDeleteInput warn, encoded-ID CreateKeyedNodeInput does not); no code-string assertions on generated bodies. Independent-session In Review → Done review; TableOnInputDeprecationWarningTest green and the emitted NoRule message shape matches both gate matchers by inspection. The two graphitron-sakila-example tests could not execute because that module’s generate goal is blocked on trunk by the pre-existing R389 fixture breakage (party / party_individual / jti_person catalog tables absent, Query.allParties unclassified); the 11 graphitron-core failures (JoinedTableInheritancePipelineTest ClassCast + the Query.allParties corpus cascade) were confirmed to reproduce identically with R332 reverted, so they route through R389, not this item. Remaining work: R97 Phase 2b empties the carve-out and lets the warning fire on encoded INSERT/UPSERT inputs, at which point this item folds or retires.

R398 (1d520fa engine + nine visitors, 82fd246 sealed BuildWarning + advisory tagging + MCP projection, 148c8ac LSP finding-keyed QuickFix, fd38fb0 @record deprecation-marker alignment, 53d475b report/LSP integration pins, d5b0a57 In Progress → In Review, 3a4a190 explicit-fix decoupling; Spec → Ready 3ee7062): SDL lint engine with ESLint-style built-in visitors. A single shared traversal over the build’s parsed graphql-java AST dispatches each node to the LintVisitor`s subscribed to its `LintNodeKind; adding a rule is registering it in LintRules, not editing a central switch. Rule identity is a type (LintRule enum, stable kebab-case id(), a Source{ENGINE, CLASSIFIER} axis), never a string bag. Findings ride the existing warning channel via a sealed BuildWarning (NoRule arm for the pre-existing untagged advisories; LintFinding arm carrying the typed LintRule + Optional<LintFix>), so a finding’s rule is a type and its fix lives only on the arm where it is meaningful, no nullable field; both arms flow into ValidationReport unchanged, so the LSP replay (Diagnostics.validatorDiagnostics, R139 freshness-silence intact) and the MCP diagnostics tool project findings with no second evaluator, the MCP wire additionally carrying the LintRule id. Nine syntactic engine visitors ship (type-names-pascal-case, field-names-camel-case, input-and-argument-names-camel-case, enum-values-screaming-snake-case, deprecations-have-a-reason, types-and-fields-have-descriptions, input-object-name-suffix, no-deprecated-directive-usage, no-typename-prefix); the three existing classifier advisories (splitquery-redundant-on-record-parent, redundant-record-directive, asconnection-same-table-pk-in) are surfaced and tagged at their FieldBuilder/TypeBuilder emit sites, never re-derived, so the classifier stays their sole emitter and each coordinate is warned exactly once (no-deprecated-directive-usage excludes @record, owned by the redundant-record advisory). Optional LintFix is a suggestion the LSP turns into a QuickFix CodeAction (a new finding-keyed branch alongside the detector-driven SdlActions path, sharing only the WorkspaceEdit/TextEdit emit primitives); the build never mutates SDL. Fixes are registered explicitly, never divined from a deprecation’s prose reason, and are offered only where the edit is provably safe within the document: additive inserts (deprecations-have-a-reason, types-and-fields-have-descriptions), local renames offered only for undescribed fields (field-names-camel-case, no-typename-prefix, since graphql-java reports a described node’s location at the description, not the name token), and bare-form-only safe deletions for the two ignored-directive advisories (@record(record: {...}) has no computable end location, so it reports without a fix). Rename-class rules whose fix would ripple to references (type-names-pascal-case, input-object-name-suffix, enum-values-screaming-snake-case, input-and-argument-names-camel-case) ship no fix in v1. The pure graphql-java DeprecationRecognizer (the @deprecated docstring-token regex + native-marker read + typed DeprecationInfo{NATIVE, DOCSTRING}) is extracted down from graphitron-lsp into the graphitron build module so visitor 8 can consume it build-side; LspVocabulary now delegates and keeps its SchemaCoordinate adapter LSP-side (zero behaviour change, pinned by LspVocabularyTest/SdlActionDriftTest), and @record gains the docstring @deprecated marker so the convention is uniform. Coverage: pipeline-tier LintEngineTest (per-rule positive/negative/range + fix edit-range pins), LintRuleRegistryCoverageTest (every ENGINE rule registered exactly once, no CLASSIFIER advisory in the registry, subscribed ∪ not-linted partitions LintNodeKind with no overlap/gap, mirroring VariantCoverageTest/EdgeCoverageTest), ClassifierAdvisoryFixPipelineTest (emit-site fixes + bare-only guard), LSP-tier LintQuickFixTest + ValidatorDiagnosticsTest (build-side finding replays into a Warning squiggle at its range and applies to the corrected SDL, silenced on a stale snapshot per R139), and MCP-tier GraphitronMcpServerTest (both arms: no-rule advisory carries no lintRule, lint finding carries its id on the wire); findings asserted on the typed LintRule + SourceLocation, no code-string assertions on rendered diagnostic text or generated bodies. Deferred as designed: the plugin SPI, per-rule enable/disable + severity overrides + error-capable lint, a declarative rule-config DSL, reference-aware rename refactoring, and a second tree-sitter evaluator. Subsumes and retires R121 (redundant @splitQuery on @record) and R296 (deprecated-directive usage). Independent-session In Review → Done review; the full reactor is green under -Plocal-db once the local rewrite_test DB is seeded from the current init.sql and jOOQ regenerated (a stale sandbox catalog missing the R389 party joined-table fixtures reproduces the same Query.allParties/JoinedTableInheritancePipelineTest classification failures earlier Done reviews noted, on paths R398 does not touch). Approval corrected one false-invariant javadoc on LintNodeKind (it claimed a throw-on-unmapped instanceof chain the engine does not implement; the engine names the kind explicitly per dispatch site).

R409 (d2c8363 implementation, 9a22265 In Progress → In Review; Spec → Ready 972aeaf): Quiet the non-actionable mvn graphitron:dev RAG-warm startup log noise and document the recommended consumer .mvn/jvm.config for the warnings a plugin cannot un-print. A new RagLogQuieting helper lives in graphitron-mcp (where the RAG logger names are facts about the langchain4j-ONNX + Lucene dependency set R341/R372 dependency-quarantine, not knowledge the plugin’s compile surface should learn) and is called once from DevMojo.bindServer before the warms start() on the dev thread, so thread-start’s happens-before edge publishes the suppression to the graphitron-warm-* daemon threads that load the noisy classes (in-code comment forbids reordering it after start()). Group 1 (DJL HuggingFace tokenizer maxLength warning): non-actionable, no public knob, so muted defensively across providers, the slf4j-simple per-logger level property and the logger’s JUL level raised to SEVERE, so a Maven binding swap degrades to "noise returns" rather than a silent no-op; the DJL logger FQCN ai.djl.huggingface.tokenizers.HuggingFaceTokenizer confirmed against the 1.16.3-beta26 bge jar. Group 2 (Lucene VectorizationProvider incubator-module warning): actionable and directional, so demote-do-not-swallow, its JUL logger raised to SEVERE and, only when jdk.incubator.vector is absent (ModuleLayer.boot().findModule(...)), one concise graphitron-owned dev line names the --add-modules jdk.incubator.vector flag in place of Lucene’s multi-line dump; present module → silent (fast path already on). Group 3 (Maven-runtime jansi native-access / guava Unsafe warnings): documented only in getting-started’s new "Quieting startup warnings" note with a recommended .mvn/jvm.config, since the JVM prints them for Maven’s own lib/ jars before any plugin code runs. Helper javadoc names only what is attempted ("best-effort quieting"), never asserts the warning is gone, and pins the dev-goal-only scope (explicitly not shared with GenerateMojo/ValidateMojo, not triggered by the GraphitronMcpServer constructor, not to be hoisted). Coverage: unit-tier RagLogQuietingTest (Lucene JUL SEVERE; DJL slf4j-simple property error + its JUL SEVERE; calling twice a no-op; the incubator-hint decision as a pure function of module presence) ; 5 tests, no code-string assertions on generated bodies. Dev-tooling plumbing: no sealed variant, no classification, no emitted Java. Independent-session In Review → Done review; R409’s graphitron-mcp + graphitron-maven-plugin modules compile clean and RagLogQuietingTest is green, and the full-reactor graphitron-core failures (Query.allParties → UnclassifiedField; JoinedTableInheritancePipelineTest ClassCast) were confirmed to reproduce identically at the pre-R409 parent commit 5027e30, on classification paths R409 does not touch.

R261 (landing 6d5ce8b, Spec → Ready 7af72bf): Generation-time wire-coercion cast guard, Slice 1 (the three @service arg-classification sites). Before this, every arg-classification site fell through to CallSiteExtraction.Direct and emitted a raw (DeclaredType) wireValue cast that compiled cleanly and ClassCastException`d (or, for enums, `IllegalArgumentException`d) on the first request, since graphql-java delivers `ID/enum as String, Int as Integer, Float as Double, input-objects as Map. The fix homes the "coercion output assignable to declared type" verdict at the classifier in a new WireCoercionResolver (a sealed PassThrough | Rejected result, mirroring EnumMappingResolver.EnumValidation), consuming a new pure forward mapping ScalarTypeResolver.coercionOutputType (SDL scalar name → coercion-output TypeName, over spec built-ins, federation scalars, and classified @scalarType resolutions), keeping the verdict off ScalarTypeResolver (D1). A new WireCoercionError sub-seal of Rejection.AuthorError carries two arms on two axes (D4): Assignability (coercion class ≠ declared type; sites A-D) and EnumConstantDivergence (declared type is the enum but an SDL value name has no matching Java constant; site E), each with a stable lspCode() under graphitron.wire-coercion.* wired into Diagnostics.lspCodeOf, RejectionSeverityCoverageTest, and typed-rejection.adoc (+ drift list). ServiceCatalog.argExtraction (site B) is widened to take the resolved SDL leaf and return a sealed Resolved | Rejected; InputBeanResolver.bindField (sites A/E) calls the predicate on the scalar arm (widening R195’s jOOQ-record-only reject to the full wire-incompatible family) and routes the enum arm through EnumMappingResolver.checkEnumConstants, an extracted column-agnostic single parity home reused by validateEnumFilter (column path) and the @service enum producers (D3). Coverage: WireCoercionCastGuardPipelineTest asserts per arm on the typed rejection’s lspCode()/components (no code-string assertions on generated bodies), plus the ID→String, custom-@scalarType, and matching-enum non-regression cases that guard against over-rejection. Independent-session In Review → Done review; all R261-touched tests green and the whole graphitron-lsp module clean. Sites C (@condition) and D (@externalField) were carved into R411 (reject-wire-coercion-nonservice-sites, depends-on dimensional-model-pivot), which consumes this predicate unchanged; R261 dropped dimensional-model-pivot from depends-on and closes on the @service slice alone, with the @tableMethod/@condition caller deliberately left on ServiceCatalog.legacyArgExtraction until R411 threads the predicate through R222’s channel. The sandbox’s pre-existing Query.allParties / JoinedTableInheritancePipelineTest failures (missing PK metadata on the jti_* fixture catalog) were confirmed to fail identically at the pre-R261 parent commit 6ad75dd, so they are not an R261 regression. (Landing commit message misnames the carve-out item as "R407"; the sibling item, spec body, and README all correctly reference R411.)

R63 (landing 5ce8bc1, Spec → Ready 9ea2a8c): Lift the DML UPSERT/UPDATE dialect requirement off hand-built postDslGuard CodeBlock`s onto typed model data. A new sealed `DialectRequirement (None / RequiresFamily / RejectsFamily) plus a graphitron-internal SqlDialectFamily enum (a jOOQ SQLDialect.family() collapse; name-prefix fromDialectName covers the commercial-only ORACLE* / POSTGRESPLUS spellings the OSS jOOQ distribution omits) make the "UPSERT rejects Oracle" / "bulk UPDATE requires Postgres" facts discoverable on MutationField.DmlTableField.dialectRequirement() (never null), so the verb-neutral buildDmlFetcher skeleton stays verb-neutral and a future validator can read the constraint at validate time. Each of the four DML records carries the component, populated at its FieldBuilder construction site (UPSERT → RejectsFamily(ORACLE), bulk UPDATE → RequiresFamily(POSTGRES) selected on inputArg.list(), INSERT/DELETE/single-row UPDATE → None.INSTANCE); MappingsConstantNameDedup threads it through the error-channel rebuild. buildDmlFetcher’s `postDslGuard CodeBlock param becomes a DialectRequirement, collapsing three overloads into two, and a new emitDialectGuard helper renders the guard. Divergence from the Ready draft (documented in the spec body and landing commit, and verified in review): the draft emitted a reference to the generator-internal SqlDialectFamily enum into generated code, which does not compile in a consumer, where graphitron is test-scoped (graphitron-sakila-example/pom.xml) while the generated fetchers compile as the consumer’s main sources (GenerateMojo adds them via project.addCompileSourceRoot); the emitted guard instead stays self-contained, comparing jOOQ’s own dsl.dialect().family().name() against the family’s jooqFamilyName() (the reachable bulk-UPDATE output is byte-identical to the former inline family().name().equals("POSTGRES") guard, and jOOQ’s family() folds every ORACLE* spelling to ORACLE, so the UPSERT gate still catches them). fromDialectName is retained on the model for the future validator-time check. postInGuard, the sibling free-form CodeBlock carrying imperative per-row emission mechanics, stays a CodeBlock (documented non-goal: no DialectRequirement-shaped datum hides in it). Coverage: unit-tier SqlDialectFamilyTest (fromDialectName collapse + jooqFamilyName incl. the OTHER rejection), pipeline-tier DmlDialectRequirementClassificationTest (per-verb population), emitter TypeFetcherGeneratorTest (self-contained Oracle guard from a directly-constructed field + None emits nothing; UPSERT can’t classify through the pipeline under R144), and the bulk-UPDATE FetcherPipelineTest assertion re-anchored to the typed guard; no code-string assertions on generated bodies beyond the intentional guard-shape pins. Independent-session In Review → Done review; all R63-touched tests green (213), and the sandbox’s pre-existing Query.allParties / JoinedTableInheritancePipelineTest failures (missing PK metadata on the jti_* fixture catalog) confirmed to fail identically at the pre-R63 parent commit. Carries forward the R22 post-shipping follow-up.

R26: Umbrella tracker closed. Retiring graphitron-maven-plugin + graphitron-schema-transform into graphitron-rewrite shipped its build surface (schema loading, tagged inputs, Maven plugin, aggregator-standalone, content-idempotent writes) and @asConnection emit-time synthesis; the Java LSP rewrite + dev goal landed under R18; @notGenerated directive removal shipped on its own plan; Federation SDL integration continues under the separate Apollo Federation via federation-jvm transform backlog item; and the programmatic-schema architecture (Graphitron.buildSchema(...)) pruned type-extension merging, directive stripping, and client-SDL feature-flag splits from scope outright. Closed now rather than held open for its last sub-item, deleting graphitron-maven-plugin wholesale and unnesting the rewrite aggregator, which continues as its own item, R182 (unnest-rewrite-aggregator.md); an umbrella tracker has no reason to outlive the work it was scoping once every other bullet under it has landed.

R400 (Stage 1 0584430; Stage 2 page deletion 27412d3 + xref strip 2ea7900; In Review 4771bcd; rework fix 76d5ac9; spec/AC notes cff3120/2eca156; In Review 160ecef): Withhold the not-in-use directives from the v1 advertised directive surface, a docs-and-report-only trim with no generator behaviour change. DirectiveSupportReport.renderMigration (the roadmap-tool that generates docs/manual/_generated/supported-directives.adoc) gained two curated policy sets: REJECTED_ON_USE = {notGenerated, multitableReference} moved out of "Supported" into a new "Removed / rejected directives" section that tells migrating consumers to delete them, and WITHHELD_FROM_V1 = {tableMethod, sourceRow, experimental_constructType} silently excluded from "Supported" (declared and behaviourally unchanged, just outside the v1 surface). @record stays advertised as-is (deprecated + silently ignored, kept for v1 per the 2026-06-30 user decision). Stage 2 deleted the withheld trio’s dedicated reference pages (reference/directives/{tableMethod,sourceRow,experimental_constructType}.adoc) and the how-to/source-row.adoc recipe, and stripped every now-dangling xref and teaching passage across the index and recipe pages while keeping factual inline-code mentions (the directives are withheld, not removed); the AsciiDoctor fail-on-WARN render is the guardrail that no dangling xref survives. directives.graphqls is untouched and no classify-time rejection was added. Recovery is anchor-free (git log --diff-filter=D + checkout <commit>^ -- <path>) and ticketed under R403 (@tableMethod rethink + recover), R404 (@sourceRow recover), R69 (@experimental_constructType, gated on an emitter). Independent-session In Review → Done review across two cycles: the first requested rework because deleting the trio’s pages while keeping them declared broke R68’s DirectiveDocCoverageTest declared-directive ↔ reference-page bijection (a hard build failure); fixed by 76d5ac9, which narrows the invariant to "a directive needs a page only if it is on the advertised surface" and derives the exempt set from the generated supported-directives.adoc fragment (declared − mentioned = withheld) so the test cannot drift from the report that owns WITHHELD_FROM_V1. Coverage: DirectiveSupportReportTest (exclusion took effect: withheld trio + rejected pair absent from "Supported", rejected pair under "Removed / rejected", @record retained) and the carved-out DirectiveDocCoverageTest; full reactor green under -Plocal-db. Absorbs and supersedes the upstream "Remove the @tableMethod directive" proposal. Spawns R403/R404.

R389 (reshape a3899f4; classifier/emitter/party fixture 3586c06; pipeline tests 6aa4bb3; composite jti_* re-author d08eacb; rejection tests 521dd59; corpus + architecture-doc prose e163d59; In Review 5451c0f; self-review be47c31; schema-version rework 3dc0a3a): First-class discriminated joined-table (class-table) inheritance, where each participant declares its own detail @table distinct from the discriminated base and its inherited (base-resident) fields carry @reference back to the base. A new ParticipantRef.JoinedTableBound sealed variant carries the resolved child→parent JoinStep.FkJoin; residence is declared by the per-field @reference (base-resident → ColumnReferenceField, detail-resident → plain ColumnField) and read off the field variant, never recomputed, so no residence-aware resolver was added to FieldBuilder. TypeBuilder.buildParticipantList detects the detail-table participant, resolves the hop, skips the cross-table pass, and surfaces PK=FK / same-base / no-nameable-join violations as INVALID_SCHEMA diagnostics with candidate-FK hints. The interface fetcher selects FROM base with a per-participant discriminator-gated LEFT JOIN to each detail table (base-resident + shared-key fields off the base, detail-exclusive fields off the detail alias, NULL-through for non-matching rows); the same concrete type stays first-class standalone, resolving inherited fields through the parent reference. Both shared-key shapes ship: a new single-column party/party_individual/party_company fixture and the composite jti_* fixture re-authored to R389 (subsuming the R388 workaround). Coverage: @ExecutionTier allParties (routing + per-participant projection + NULL-through), allIndividuals (standalone), and the converted allSubjects composite cases against real PostgreSQL; @PipelineTier JoinedTableInheritancePipelineTest (positive shape, mixed discriminator-only + joined participant, three rejection invariants); a joined-table-interface R281 corpus example + code-generation-triggers.adoc prose; no code-string assertions on generated method bodies. Independent-session In Review → Done review across two cycles: the first requested rework for a missing jooq.codegen.schema.version bump (R389 changed init.sql but left it at 2.2, so jOOQ skipped catalog regeneration on incremental -Plocal-db builds → an UnclassifiedType cascade across 11 tests); fixed by 3dc0a3a (2.2 → 2.3) and verified with an incremental build that regenerates and is green. Builds on R388/R392; sets up R393 (base→detail join disambiguation).

R399 (In Review 75c4894; JSON-B switch e57bdbd; empty-body guard d6254dc): New graphitron-jakarta-rest module, a reusable spec-conformant GraphQL-over-HTTP serving library over a Graphitron schema, ending the four-dialect drift between the reference app and the tilgangsstyring-style consumer copies (each had diverged on media types, status codes, /schema, and GraphiQL). The dependency-inversion seam is a consumer-implemented GraphitronApplication SPI (schema(), newExecutionInput(), default engineBuilder(), default graphiqlEnabled()) plus an AbstractGraphitronApplication base that caches the schema from a supplier lambda over the generated facade, so the library never names a per-subgraph type. GraphqlResource (@Path("/graphql")) owns POST/GET content negotiation, the media-type-driven status watershed (modern application/graphql-response+json: unparseable → 400, malformed/validation/coercion → 422, executed → 200; legacy application/json always 200), GET mutation → 405, /graphql/schema via SchemaPrinter, and a CDN-based GraphiQL page; an application-scoped GraphqlEngine caches the built GraphQL. No custom JAX-RS providers: the resource reads the raw body and parses a GraphqlRequest record so it can shape parse errors as spec 4xx and own the status watershed. Two refinements from the signed-off spec, both sound: graphiqlEnabled() rides the SPI interface (callable through the injected reference, overridable by a direct implementor), and body marshalling uses the Jakarta JSON Binding (JSON-B) API rather than Jackson, leaving the library with zero concrete JSON dependency (consumer supplies the provider; Yasson / quarkus-jsonb) consistent with its all-jakarta.*-at-provided stance. The module is the first hand-written runtime artifact consumers depend on, a third Java-version category (rewrite-design-principles.adoc grew the bullet): it compiles at <release>17</release> (the Java-17 floor consumers share), is publishable, and joins the deploy set. graphitron-sakila-example refactored onto it (its GraphqlResource/GraphqlEngine copies and self-hosted GraphiQL assets deleted, replaced by a one-class SakilaGraphitronApplication adapter). Batching stays out of scope (the spec defines none). Coverage: an 11-case @ExecutionTier GraphQLOverHttpConformanceTest run through the reference app exercises the real library end-to-end, one citing case per committed normative requirement, each carrying the verbatim spec sentence + section + revision as a @DisplayName plus a requirement → section → test pointer table; the library itself carries no @Test classes by design (keeps the per-module tier-enforcement in-scope list from growing). No code-string assertions on generated bodies. The most spec-load-bearing, least-typed spot, statusFor’s `422-by-exclusion arm, is documented with the unit-tier escape hatch should a graphql-java upgrade ever add a pre-execution ErrorType. Independent-session In Review → Done review; full reactor green under mvn -f graphitron-rewrite/pom.xml install -Plocal-db (clean build, 2313 core tests + all 11 conformance cases, 0 failures; an initial red run traced to a stale sandbox rewrite_test DB missing R389’s party_* tables, resolved by a re-seed + clean rebuild, not a code defect in either item).

R401 (Half A 8a08759 + dispatch fix f225eeb; Half B e6cbe70; In Review e288bf4): Bundle the tree-sitter runtime in the natives jar so the LSP has zero native system dependency. no.sikt:graphitron-tree-sitter-natives now ships libtree-sitter alongside the grammar for all four supported platforms (eight lib/<os>-<arch>/ entries), built in CI from the pinned upstream v0.26.9 source tag (POSIX make; Windows MinGW-w64 with static-linked gcc runtime), gated on exported-symbol + transitive-dep allowlist assertions and a post-deploy-verify load+parse on all four platforms with no system libtree-sitter present; 0.26.9-1 published to Central by a human-dispatched release. BundledLibraryLookup extracts both binaries and returns grammar.or(bundledRuntime) (system probe deleted); GraphqlLanguage collapses the dual missing/too-old diagnostic apparatus (classifyInstalledRuntime, RuntimeStatus, runtimeProbePaths, tooOldRuntimeMessage, missingRuntimeMessage, ABI_VERSION_SYMBOL) to a single bundled-load-failure message naming the extracted temp path, with DOCS_URL repointed to the reference page. The lsp-requirements, getting-started #native-runtime-dependency, and reference-index docs collapse to "nothing to install" (per-platform install matrix and NixOS shell.nix snippet removed). Coverage: NativeLibraryBundleTest (per-platform @EnabledOnOs; linux-x86_64 loads the bundled runtime + grammar via the SPI and parses), TreeSitterSmokeTest, GraphqlLanguageErrorTranslationTest (the single-diagnostic + classifier + missing-path contract). Independent-session In Review → Done review (approval commit also corrected the natives pom.xml header comment and the UPSTREAM.md Windows build command, which still described the pre-bundle grammar-only module); full graphitron-lsp suite + reactor green under mvn -f graphitron-rewrite/pom.xml install -Plocal-db. Supersedes the system-dependency model from R203.

R269 (077f8f3 implementation; Spec → Ready fa6f38d, spec revisions 81ba814, spec refresh 1ac70fb): Null-guard the record-parent split-query accessor key extraction so a nullable to-one/to-many @table relation that resolves to no row renders null/[] instead of NPEing. GeneratorUtils.buildAccessorKeySingle (the ONE arm, the reported bug) read a nested jOOQ record off the parent backing via ((Backing) sourceExpr).accessor() and called .into(<PK columns>) on it with no null guard, so when a nullable to-one accessor returned null on an otherwise-successful parent the emitted fetcher threw Cannot invoke "...Record.into(...)" because "element" is null on the success arm rather than resolving the field; buildAccessorKeyMany had the analogous hazard one level out, the bare for-each over a never-populated to-many backing NPEing before any .into(...). The ONE arm now emits if (element == null) return CompletableFuture.completedFuture(null); between the accessor read and the key build, mirroring the FK-side buildKeyExtractionWithNullCheck precedent (a key that can’t match the terminal PK must not dispatch the loader; the to-one’s faithful "no row" rendering is null, and the fetcher’s CompletableFuture<DataFetcherResult<Record>> return makes completedFuture(null) assignable). The MANY arm took design fork (a): hoist the accessor result to a typed Iterable<Element> local and skip the for-loop when it is null so keys stays empty and the existing loadMany dispatch renders [] (the extraction block does not own its return path; both DataLoaderFetcherEmitter and MultiTablePolymorphicEmitter append their own dispatch, so skipping the loop is the consumer-agnostic shape). The asymmetry is deliberate and documented in both helpers: the ONE arm preserves null-vs-present (a to-one’s "no row" faithfully renders null) while the MANY arm collapses null-vs-empty (a to-many has no surface distinction between "never populated" and "zero rows" once the loader returns). Element-level nulls inside a populated collection stay unguarded (a malformed backing, not a cardinality to model). Emit-only: no model/classifier/AccessorRef/SourceKey change; producer/consumer linkage to the field’s nullability classification carried as a one-line rationale comment per the design-principles prescription (no validator invariant to mirror). The shared null key → completedFuture(null) seam across buildKeyExtractionWithNullCheck / buildAccessorKeySingle is named as a drift-prone follow-up, left out of scope as a refactor with its own blast radius. Coverage: execution-tier GraphQLQueryTest.inventoryById_filmCardDataNullAccessor_rendersFilmNullWithoutNpe (a FilmCardData accessor returning null for even film_id`s renders `film null with no error, odd film_id`s still resolve their `Film row through the same loader, the mixed-batch proof) and AccessorDerivedBatchKeyTest.accessorDerivedManyPayloads_nullToManyBacking_rendersEmptyListWithoutNpe (a CreateFilmsPayload with a null films() backing renders [], the present sibling still resolves); the RecordTableField + AccessorCall + Cardinality.ONE/MANY classifier shape the guards depend on is already pinned by GraphitronSchemaBuilderTest’s `AccessorDerivedSourceCase matrix; no code-string assertions on generated bodies. Split out of R268 (the error-arm short-circuit) and orthogonal to it; R271 had already retired the __elt/__k dunders. Independent-session In Review → Done review; full reactor green under mvn -f graphitron-rewrite/pom.xml install -Plocal-db (GraphQLQueryTest 286, AccessorDerivedBatchKeyTest 2, 0 failures).

R262 (c71885c, In Review c453aaf, Spec → Ready 498ddf7, Backlog → Spec d8ed14d): Reject @nodeId on non-ID coordinates and federation encoded @key fields at validate time. The SDL directive permits @nodeId on FIELD_DEFINITION | INPUT_FIELD_DEFINITION | ARGUMENT_DEFINITION with no ID restriction, but every decode/encode arm is gated on "ID".equals(...), so a non-ID @nodeId was silently dropped and the raw base64 wire String bound undecoded: a green build with a production SQL bind/type error or never-matches predicate. Two build-time soundness reductions on the shared diagnostic channel (the R317-slice-5 / R204 / R194 pattern) close it. rejectNonIdNodeId(ctx) in GraphitronSchemaBuilder (sibling to rejectCaseInsensitiveTypeCollisions, same orchestration region) walks ctx.schema applied directives across all three on-locations, object/interface field definitions plus their arguments plus input-object fields, and registers an INVALID_SCHEMA ValidationError for any whose GraphQLTypeUtil.unwrapAll is not ID (findings F, G, and the output FIELD_DEFINITION encode mechanism that has no ID gate at all); it reads the raw schema rather than the registry precisely because a dropped @nodeId leaves no trace on the classified field. EntityResolutionBuilder rejects a federation @key whose referenced field resolves to a ChildField.ColumnReferenceField carrying CallSiteCompaction.NodeIdEncodeKeys (finding H, where the _entities DIRECT path would bind the encoded global id undecoded into the VALUES table) fatally via a new AltResult.Fatal arm carrying the typed Rejection.invalidSchema, distinct from and not co-located with the existing non-fatal compound-id BuildWarning; the column lookup is refactored from lookupColumn to columnOf(field) so the caller can inspect the field instance before reducing to ColumnRef. Decode-into-rep for encoded @key values, the cast-axis defects in wire-coercion-cast-guard, and consolidating the replicated @nodeId-site predicate stay out of scope. Coverage: pipeline-tier RejectNonIdNodeIdPipelineTest (6 tests, asserting the typed ValidationError coordinate + RejectionKind + message for the non-ID input field, argument, and output field plus the federation encoded-@key sub-case, and the legitimate ID input/argument/output coordinates and federation NODE_ID happy path that must keep passing); no code-string assertions on generated bodies. Independent-session In Review → Done review; RejectNonIdNodeIdPipelineTest green 6/6 in isolation under -Plocal-db. NB: the full reactor is currently red on three JoinedTableInheritancePipelineTest failures owned by R389 (an unrelated In-Progress item that landed after R262, 6aa4bb3); R262’s own delivery is independently green and those failures route through R389, not this item. Sibling of R397 (@error on bare-entity query fields) and R273 (NodeId mismatch semantics).

R378 (3ca8428; Spec → Ready e5dcd59, Backlog → Spec f146e1e): Authored @nodeId filters now throw on a malformed or wrong-type id instead of silently dropping it to the unfiltered baseline (the reported soknadId: ["IKKE_EN_ID"] returns-the-whole-table bug). The four authored filter producers (argument-level same-table and FK-target in FieldBuilder, input-object-field same-table and FK-target in BuildContext) flip from CallSiteExtraction.NodeIdDecodeKeys.SkipMismatchedElement to ThrowOnMismatch; the Relay heterogeneous-id-source pattern is given up deliberately per the user decision. CompositeDecodeHelperRegistry’s `Mode.THROW body is enriched once (list and scalar arms) with a two-branch message computed from NodeIdEncoder.peekTypeId on the offending wire value: peeked == null || expectedTypeId.equals(peeked) reads as structurally-malformed ("not a valid <Type> id"), any other non-null prefix as well-formed-wrong-type ("decodes to type <got>, expected a <Type> id"); the expected typeId is threaded onto HelperRef.Decode as a generation-time constant so the right-type-wrong-arity sub-case folds into the malformed branch. Error surfacing took path B (forward-compatible with a future query @error lift, R397): a generated <outputPackage>.schema.GraphitronClientException (subclass of graphql.GraphqlErrorException, so natively a GraphQLError, channel-matchable, serialisable into the errors array, serialVersionUID emitted for clean -Xlint:serial) is the stable client-error marker the THROW arm raises; new ErrorRouter.surfaceClientErrorOrRedact walks the cause chain and surfaces a GraphitronClientException’s real message while still redacting genuine internal faults to a correlation id, and the no-channel catch disposition is repointed at it uniformly across `TypeFetcherGenerator (renamed noChannelCatchArm), MultiTablePolymorphicEmitter, and ChannelCatchArmEmitter’s empty arm. Deliberate boundaries held: the two `__NODE_* synthesis-shim arms stay on SkipMismatchedElement (R273/shim-retirement track), and LookupValuesJoinEmitter’s separate N×M decode-throw site keeps its plain `GraphqlErrorException and still redacts (the R195/R315 record-decode boundary). No new validate-time rule (both arms and both registry modes were already fully implemented, so the flip introduces no unhandled classification; "validator mirrors classifier" satisfied vacuously). Coverage: execution-tier GraphQLQueryTest (malformed surfaces the real message naming the bad value + not a valid Film id; wrong-type surfaces decodes to type "FilmActor" / expected a Film id; mixed surfaces; input-object-field filter surface exercises the soknadId shape; a genuine internal fault still redacts to a correlation id, pinning the surface arm narrows to the client-error type; empty-list R375 baselines retained), pipeline-tier NodeIdPipelineTest / IdReferenceShimClassificationTest (authored arms pinned to ThrowOnMismatch, shim arms held at SkipMismatchedElement), unit-tier CompositeDecodeHelperRegistryTest + ErrorRouterClassGeneratorTest + GraphitronClientExceptionClassGeneratorTest (registry tests assert on code strings by that file’s existing convention; behaviour proven at the execution tier). Independent-session In Review → Done review; full reactor green under mvn -f graphitron-rewrite/pom.xml install -Plocal-db (GraphQLQueryTest 283, :graphitron 477 / :graphitron-sakila-example tiers all 0 failures). Orthogonal to R375; predecessor of R397.

R121, R296 (Backlog items, discarded as superseded by R398): the redundant-@splitQuery-on-@record LSP diagnostic (R121) and the deprecated-directive-usage BuildWarning (R296) are folded into R398’s starter lint-visitor set (visitors 9 and 8 respectively). Neither shipped a standalone implementation; their intent moves wholesale into the R398 SDL lint engine, which evaluates such rules build-side and projects them into the LSP. The build-tier @splitQuery warning R121 layered on already exists (FieldBuilder.warnIfSplitQueryOnRecordParent); R398 formalizes it as a visitor and adds the edit-time surface. IDs R121 and R296 are retired and not reused.

R395 (27325cd3e implementation, fixture-comment rework 7febb70b3; Spec → Ready 05e652893, Backlog → Spec bd0287f3e): Qualify the discriminated-interface discriminator column off the FROM table’s own jOOQ instance, not the @table(name:) directive string. R388 had changed the three discriminator SQL-emission sites in TypeFetcherGenerator (the __discriminator__ routing projection in buildInterfaceFieldsList, the ... IN (knownValues) restriction in buildDiscriminatorFilter, and the cross-table LEFT JOIN ON-clause gate in buildCrossTableJoinChain) to qualify via tableRef.tableName(), the verbatim case-preserved directive string. jOOQ renders the FROM table by its real schema-qualified, case-folded catalog name, so whenever the directive name differed in case or schema the qualifier did not match FROM and Postgres rejected the query with missing FROM-clause entry (reported against 10.0.0-RC21 by the opptak consumer: @table(name: "INNBOKS_MELDING") over kommunikasjon.innboks_melding). All three sites now emit <tableLocal>.getQualifiedName().append(DSL.name(col)) typed Object.class (so the .as / .in / .eq chains compile), producing the exact qualifier jOOQ renders in FROM by construction; tableRef.tableName() no longer reaches any discriminator site, and the read-side fourth site stayed correct (R392 had routed the TypeResolver off the synthetic __discriminator__ alias). The default-schema path does not over-qualify because the rewrite sakila tables sit in jOOQ’s unnamed default schema (getQualifiedName() contributes no schema part). Coverage: four regression-lock unit assertions in TypeFetcherGeneratorTest pin each site to the table-instance qualifier and forbid the directive-name string via a case-mismatched INTERFACE_BASE fixture (the case/schema-mismatch dimension lives here); a non-default-schema execution guard MultiSchemaQueryTest.signalsRouteToDiscriminatedTypesUnderNamedSchema over a new multischema_a.signal @discriminate interface (AlertSignal carrying a cross-table @reference to widget, NoticeSignal) covers the dimension R388 regressed on; the default-schema guards PolymorphicProjectionQueryTest and GraphQLQueryTest allContent / allSubjects confirm no over-qualification. Documented deviation: the execution fixture uses the unqualified @table(name: "signal") rather than the spec’s schema-qualified / upper-case form, which a separate @reference FK-connection check (filed as R396) rejects; the unqualified directive still renders FROM as "multischema_a"."signal" and so still fires the pre-fix bug, matching the reported consumer shape. In Review → Done reviewed by a session distinct from the implementer; full reactor green under mvn -f graphitron-rewrite/pom.xml install -Plocal-db.

R386 (c68b000 implementation; Spec → Ready 270b0c1, Backlog → Spec 3c6430b, filed 27d9c9e): catalog.search MCP tool (R118 slice 10) ; the semantic counterpart to the structured catalog.tables / catalog.describe, giving an MCP-aware agent fuzzy natural-language discovery over the database catalog ("where are customer addresses stored?") so a developer pointing graphitron at a large existing schema finds tables without knowing their SQL names. CatalogDescriptors is a pure, ONNX-free composer that turns each R362 CatalogFacts.Table into one readable descriptor carrying both the raw SQL token (so BM25 matches film_actor exactly) and its normalized words (a state-machine splitWords splitting snake_case / camelCase / acronym / digit runs ; customerID → "customer id", IDColumn → "id column", address2 → "address 2" ; the model-agnostic retrieval lift of R118 OQ3), degrading to names-only when jOOQ captured no comments (OQ4); the SHA-256 corpusHash is length-prefixed over the exact descriptor strings handed to embedDocuments, so the hashed thing and the embedded thing cannot drift. CatalogSearchIndex owns the warm-managed, self-observing Lucene index, mirroring R374’s ReverseEdgeIndex.Cache (no BuildArtifacts component, no Workspace field, no DevMojo listener): each search reads the live catalogFacts through two gates ; reference identity (the cheap common path), then content hash (a no-op recompile that swaps the reference but not the content re-embeds nothing) ; and a changed hash kicks an AsyncWarm re-embed off the classpath-watcher thread, re-entering the existing WarmState.Warming shape (no new "refreshing" state) so the prior Ready index keeps serving while the new one builds. The index persists under ${project.build.directory}/graphitron-mcp-rag/catalog/<corpusHash>/ as a Lucene FSDirectory (survives dev restarts, dies on mvn clean), with an embedder-identity manifest (getClass().getName() + dimension()) written beside each index so loading a future multilingual-e5-small index under the English bge embedder (both 384-dim, indistinguishable by dimension alone) is rejected and rebuilt rather than silently mis-served (closes the R118 OQ2 cross-model trap now); sibling hash dirs are reaped keeping the current plus one prior. The tool takes query (required) + limit (default 10), returns {status, results:[{id, schema, name, comment?, score}]} by the same schema-qualified SQL id catalog.describe accepts (discovery hands off to description), and returns the shared WarmState.degradationMessage + {status: warming|failed} while the index is not Ready. Threaded through GraphitronMcpServer’s widened five-arg constructor (RagConfig` as a growable record, back-compat overloads default it to a temp dir) and DevMojo.bindServer (supplying the build-dir cache root); the multilingual swap is flagged, not done. Coverage: unit-tier CatalogDescriptorsTest (split normalization cases, comment-present vs name-only degradation, raw+normalized tokens, length-prefixed hash stability/segmentation) and CatalogSearchIndexTest over FakeEmbedder + FSDirectory (hash-gated re-embed via an embed-call-count spy, warming-on-change re-entry, embedder-identity rejection-then-acceptance, persistence round-trip + current-plus-one-prior reaping, cross-warm Failed propagation), MCP-handler-tier GraphitronMcpServerTest (catalog.search advertised in tools/list; a ready-arm call returns ranked schema.table ids whose top feeds a follow-on catalog.describe; the warming-arm call returns status: warming ; structured-content assertions only), and infrastructure-tier @Tag("slow") CatalogSearchOnnxTest (real bge ONNX embeds a Sakila-shaped CatalogFacts, asserts public.address / public.payment rank for natural-language queries ; the retrieval-quality + normalization payoff pin); no code-string assertions on generated bodies. getting-started.adoc gains the agent-facing tool note (semantic search, the warming/refresh behaviour, the jOOQ-comment-capture lift). Builds on R372 (RAG foundation: Embedder + the Lucene EmbeddingStore), R362 (CatalogFacts + the schema-qualified ids), and R341/R361 (the graphitron-mcp module + the shared-model / dev-trigger seam); sibling of R385 (docs.search, slice 9). In Review → Done reviewed by a session distinct from the implementer; full reactor green under mvn -f graphitron-rewrite/pom.xml install -Plocal-db.

R392 (d832aaa, In Review flip 2a808d4): Route the discriminated single-table interface (@table + @discriminate) TypeResolver off a synthetic discriminator alias instead of the raw column name. R388 qualified the three SQL emission sites but left a fourth, read-side site: the generated TypeResolver read the discriminator with a bare record.get(DSL.field(DSL.name(col))). When the interface also exposes the discriminator as a queryable field, the participant $fields projects the real catalog column too, so the result carries the discriminator twice (the two-part routing add and the three-part schema-qualified column); the bare read matches both and jOOQ logs Ambiguous match found, resolving to the first by luck. Fix mirrors the multi-table __typename convention: a shared MultiTablePolymorphicEmitter.DISCRIMINATOR_COLUMN = "__discriminator__" constant (declared with its collision rationale, reaching generated code only as string literals ; a .as("__discriminator__") projection and a record.get(DSL.name(...)) read), projected under that alias in TypeFetcherGenerator.buildInterfaceFieldsList and read back in GraphitronSchemaClassGenerator, so routing is unambiguous and the user-facing discriminator field still resolves from its own column. The WHERE filter and LEFT JOIN ON-clause keep referencing the real qualified column (unaffected). Coverage: execution-tier GraphQLQueryTest.allSubjects_discriminatorFieldInsideFragment_routesViaSyntheticAlias (discriminator field selected inside the inline fragment; asserts routing per type plus the as "__discriminator__" projection via SQL_LOG) and the schema-generator unit test build_typeResolver_routesOffSyntheticDiscriminatorAlias (alias read replaces the raw-column read, per that class’s documented runtime-dispatch-infrastructure body-content exception). Residual hole left by R388; first-class per-participant @table joined-table inheritance remains R389. Independent-session In Review → Done review; full reactor green under -Plocal-db.

R383 (6df5616 implementation, In Review flip 0770918; Spec → Ready 0657369): Support nested-input @field filters on multitable interface/union root queries. R363 lowered @field-mapped filter inputs onto multitable interface/union fields but scoped day one to the branch-safe top-level extractions (Direct / EnumValueOf / ContextArg), so the idiomatic input-object shape (occupants(filter: OccupantFilter) with OccupantFilter { firstNames: [String!] @field(...) }) lowered to a NestedInputField(filter -> firstNames, leaf) call-site extraction that FieldBuilder.firstUnsupportedFilterArg rejected at classify time with an author-error, even though the leaf is a plain scalar; consumers hit it as a hard build failure on an ordinary filter-input schema. The fix is a classifier relaxation only, no registry / lift-context plumbing: FieldBuilder.isBranchSafeExtraction becomes a recursive switch where a NestedInputField is branch-safe exactly when its leaf is (Direct / EnumValueOf / ContextArg admitted; a NodeIdDecodeKeys leaf stays rejected through the recursion, a developer @condition stays rejected by the GeneratedConditionFilter guard), and the switch is exhaustive over the sealed CallSiteExtraction with no default (the five non-branch-safe permits listed as explicit false arms) so R384 lifting one fails to compile and forces a deliberate decision at this gate. The "this list-typed nested leaf extracts as (List<X>) map.get(key), an unchecked cast" fact is lifted onto the model as CallParam.emitsUncheckedCast() (single source of truth, Generation-thinking); both hosts (MultiTablePolymorphicEmitter’s `buildMainFetcher / buildRootConnectionFetcher and the single-table QueryConditionsGenerator) fold over their call params and ask the model rather than each re-deriving list() && instanceof NestedInputField, so R384 adds its unchecked-emitting arm in one place and neither host can drift. The condition-method generator is extraction-agnostic, so the generated <Participant>Conditions method is byte-identical whether the value arrives top-level or Map-traversed. Coverage: pipeline-tier MultiTableFilterLoweringTest (nestedInputFieldFilter_lowersPerParticipantWithNestedExtraction asserts the NestedInputField(filter -> firstNames, Direct) call param per participant; nestedInputFieldCondition_rejectedStructuralNotDeferred keeps a nested-input developer @condition a structural author error) and execution-tier MultiTableFilterExecutionTest over AddressOccupant = Customer | Staff (occupantsByFilter(filter: { firstNames: [...] }) filters per branch and returns one matching row each, an empty filter narrows by nothing), with a new sakila OccupantFilter input + Query.occupantsByFilter fixture; no code-string assertions on generated bodies. The converted (JooqConvert / ID-typed), @nodeId-decoded, and developer-@condition kinds remain deferred to R384, which carries the registry / FK-target-alias plumbing they need. Builds on R363; sibling of R384. In Review → Done reviewed by a session distinct from the implementer; full reactor green under mvn -f graphitron-rewrite/pom.xml install -Plocal-db.

R390 (5485578, In Review flip 92e7e16): Retain the connection carrier element subgraph in the rebuilt assembled schema. A @table type reachable only through a directive-driven @asConnection carrier was pruned by SchemaTransformer once ConnectionPromoter.rebuildAssembledForConnections retyped the bare-list carrier to name its synthesised Connection: the element type then hangs off the Connection’s nodes / Edge’s node GraphQLTypeReference`s, which the transform treats as leaves, so an element reachable nowhere else (a nested-only chain), and its whole transitive subgraph, dropped out, either silently (its `<Type>Type schema class never emitted, the consumer’s RC20 cannot find symbol javac failure) or as an NPE in the type-reference resolver when a surviving typeRef still pointed at it; because the element was never traversed, a nested carrier’s own @asConnection rewrite was also skipped, leaving that field a bare list while its fetcher was connection-shaped (the report’s variant-3 mismatch). Fix pins each rewritten carrier’s element type (resolved off the pre-rewrite schema by carrierElementType, null-degrading when the parent/field/base type can’t be found) as a GraphQLSchema.additionalType before the transform, deduped by name alongside the synthesised types; every carrier at every nesting depth is in the rewrite set, so pinning the direct carrier elements keeps each element and its concretely-reachable subgraph alive and every nested rewrite applies. Structural (SDL-declared) connections are untouched (no typeRef introduced, element stays concretely referenced). Coverage: pipeline-tier NestedConnectionElementRetentionPipelineTest (2: a Store --@asConnection--> Customer --@reference--> Payment nested-reference chain retains both element types in the rebuilt assembled schema; a --@asConnection--> nested chain retypes Customer.payments to CustomerPaymentsConnection! rather than leaving a bare list, with the synthesised ConnectionType classified), structural assertions only, no code-string assertions on generated bodies. In Review → Done reviewed by a session distinct from the implementer; full reactor green under mvn -f graphitron-rewrite/pom.xml install -Plocal-db.

R385 (b0afcf8 implementation, 6cb322a README regen, d751110 rework, In Review flip ee71c81; Spec → Ready 5cdcbe5, Spec 2f014ce, filed 27d9c9e): docs.search MCP tool (R118 slice 9) ; build-time .adoc chunking + a pre-embedded bundled index, async-loaded at startup for semantic retrieval over the public manual, and the first slice to wire R372’s async-warm lifecycle into the running server + DevMojo. AdocChunker is a pure (adoc, sourcePath) -> List<DocChunk> that walks raw .adoc heading syntax (no AsciiDoctor render, so it stays off the docs module’s JRuby cost), splitting on section boundaries with an opt-in // rag:split override, fenced-block awareness (== inside a ---- listing is body, not a heading), explicit [[anchor]] override, and a heading-path breadcrumb prepended to each chunk’s embed text so a passage keeps its context. DocsIndexBuilder (bound to process-classes via exec-maven-plugin, reading the public manual under a declared <docs.source.dir>) chunks + embeds via BgeEmbedder.embedDocuments and writes the bundle to target/classes/mcp/docs-index/, gated by a SHA-256 content-hash stamp so an unchanged inner loop skips the ONNX cost. Bundle divergence (settled at Spec): rather than a literal Lucene FSDirectory (unreadable from a jar, would force temp-dir extraction), DocsBundle packages pre-embedded (id, embedText, payload, vector) tuples behind a (magic, version, dimension, count) header with explicit byte-length string prefixes (past the writeUTF 64 KB ceiling); the docs warm rebuilds an in-memory LuceneEmbeddingStore.inMemory(dimension) by re-add()-ing the tuples, re-embedding nothing at runtime. The store-opaque payload is a dependency-free URL-safe Base64 encoding (not the spec’s literal "payloadJson") ; a JSON parser would widen the module’s quarantined RAG dependency surface for a string only this module produces and consumes; this is the slice’s one principled divergence and is documented inline. DocsSearchTool embeds the query (embedder.embedQuery), runs the EmbeddingStore seam, and returns ranked passages with headingPath / sourcePath / anchor / text / score / a https://graphitron.sikt.no/... deep link; a once-memoised dimension guard reconciles the runtime embedder against the bundle’s build-time width and degrades cleanly on skew rather than throwing an opaque Lucene KNN error; either warm absent or not-Ready returns the shared WarmState.degradationMessage and no hits, leaving the dev loop structured-only. Wired through GraphitronMcpServer’s new structured-only / injected-warm two-constructor seam and owned by `DevMojo. Rework (returned to Ready at df7525a, re-landed at d751110): the first In Review pass failed the gate on a red build ; DevMojoTest paid a real BgeEmbedder ONNX load that SIGSEGV’d the surefire fork, and the MCP-bind-failure catch arm leaked the warms it had started. Fixed with a package-private warm-factory seam on DevMojo (mirroring the server’s injected-warm pattern; mojoFor defaults to structured-only null warms, the bind-failure test swaps in ONNX-free fakes) and an awaitAndCloseWarms() that joins each warm to its terminal state and closes the warmed docs store on the bind-failure unwind before rethrowing. Coverage: unit-tier AdocChunkerTest (5: nested heading paths, // rag:split override, malformed-rag:-comment near-miss is body not a split, fenced-block heading-syntax is body, explicit anchor override), DocsBundleTest (3: write→read count/ids/dimension/vector-width round-trip, separator-collision-safe payload decode, header-only readDimension), pipeline-tier DocsRagWarmPathTest (the production loadDocsIndex loader end-to-end), MCP-handler-tier GraphitronMcpServerTest (warming/failed/ready/dimension-mismatch cases, structured-content assertions), and DevMojoTest (the bind-failure unwind leaves no live warm and freed the docs store); the build-time ONNX embed itself stays out of the fast suite (R372’s @Tag("slow") BgeEmbedderOnnxTest covers the real load). getting-started.adoc gains a paragraph. Builds on R372 (RAG foundation) and R341/R361 (the graphitron-mcp module + live-Workspace seam); sibling of R386 (catalog.search, slice 10). In Review → Done reviewed by a session distinct from both implementer sessions; full reactor green under mvn -f graphitron-rewrite/pom.xml install -Plocal-db (DevMojoTest 6, GraphitronMcpServerTest 37, AdocChunkerTest 5, DocsBundleTest 3, DocsRagWarmPathTest 1; no SIGSEGV).

R379 (6f68611; Spec → Ready 713d464, spec revise 07c7dd3, Spec/filing db865ef/1d8a78f): Validate that an @reference path’s joins compile, moving two javac-in-generated-code failure modes to build-time classification. Check 1 (terminal hop lands on the return table): InlineTableFieldEmitter.buildArm feeds the terminal hop’s alias to a $fields overload typed for the field return type’s @table, so a terminal hop landing elsewhere (the NusGrupperingFagfelt @table("NUSFAGFELT") reached via a path ending on NUSFAGGRUPPE reproduction, found in a downstream subgraph build) compiled to an incompatible-types error in a consumer’s build. BuildContext.parsePath now computes a typed TerminalTargetVerdict (Match / Mismatch(fieldName, terminalTableName, returnTableName) / NotApplicable) over R232’s already-resolved terminal JoinStep.HasTargetTable.targetTable() and threads it onto ParsedPath, never re-deriving the hop kind from the directive element; the Mismatch diagnostic is formatted from the record’s fields so message and projection cannot drift. Check 2 (condition-method parameter tables): a two-argument condition method (a ConditionJoin ON clause or an FkJoin.whereFilter) emitted positionally as method(sourceAlias, targetAlias) that concretely types a jOOQ Table parameter must match the alias the emitter passes it; validateConditionParamTables / checkConcreteParamTable check parameter 0 against the hop source and parameter 1 against the hop target at each condition resolution site, skipping the idiomatic wildcard Table<?> signature (unverifiable, fully accepted) and routing mismatches through the existing errors → Rejection.AuthorError.Structural channel. Deviation (scope correction, agreed at review): the spec’s draft said to self-reject inside parsePath, but parsePath is shared by callers (@tableMethod, @nodeId, RecordTableField) that carry their own terminal-target checks (FieldBuilder.java:4692/:5778); self-rejecting there would preempt them and re-introduce the Generation-thinking same-predicate-two-consumers smell the item cites. Check 1 instead threads the typed verdict and rejects only at the two inline output callers (TableBoundReturnType, TableInterfaceType in FieldBuilder), the sole emit shape carrying the $fields(terminalAlias) invariant, double-gated on non-null start (excludes @sourceRow) and non-null return table (excludes input-field sites). The verdict is also the typed hook R381 Slice B consumes. Coverage: pipeline-tier ReferencePathTerminalTargetTest (7: terminal {table:} / {key:} / multi-hop landing on the wrong table rejected with pointed diagnostics, happy-path mirrors, a pre-existing mid-path-disconnect regression fence) and ReferencePathConditionParamTest (6: both carriers and both parameter positions rejected, wildcard (Table<?>, Table<?>) and matching-concrete happy paths) over deliberately-mistyped TestConditionStub fixtures, message-content assertions only, no code-string assertions on generated bodies; no emitter behaviour change. In Review → Done reviewed by a session distinct from the implementer; full reactor green under mvn -f graphitron-rewrite/pom.xml install -Plocal-db.

R363 (2ede6e4 implementation, 73bc057 self-review scope-tightening; Spec → Ready 66cb717, spec revises 6a3076d/50a4db9/413753a): Lower @field-mapped filter inputs onto root multitable interface/union query fields, closing a data-correctness leak where a filtered slice was requested but the rewrite emitted a bare UNION ALL and returned every row. The filter surface is per participant, not a single shared list: the same logical @field filter resolves to a different table-specific WhereFilter per participant (e.g. FeideApplikasjonConditions.… vs MaskinportenApplikasjonConditions.…), so a new field-local model/ParticipantFilters record pairs each ParticipantRef.TableBound with the filters lowered against its own table; the carrier is not a component on the type-scoped shared ParticipantRef, and the two fields stay off SqlGeneratingField (their return type is PolymorphicReturnType, a sibling of the TableBoundReturnType the capability’s returnType() requires, so implements would not compile). FieldBuilder lowers once per table-bound participant via resolveTableFieldComponents against the participant table with a participant-named conditions class (participant.typeName(), not elementTypeName, so the per-participant methods do not collide), surfaces any participant’s Rejected (absent or type-incompatible column) as the field’s rejection, and dedupes the @asConnection same-table advisory across the N participant calls. @condition (field- or argument-level) is rejected before the per-participant loop with a non-deferred Rejection.structural (no dangling planSlug), since resolveTableFieldComponents itself lowers a @condition bound to whatever table it is handed; guarding after the loop would pin the developer’s single-table method to the wrong table on N-1 branches. MultiTablePolymorphicEmitter threads a typename-keyed filter map into both branch loops, ANDing each participant’s predicate into its stage1_<Type> branch WHERE (buildStage1Block combines it with the existing parent-FK predicate; buildStage1ConnectionBlock gains a per-branch WHERE it never emitted before); TypeConditionsGenerator is wired to the polymorphic fields' participantFilters since they are not SqlGeneratingField. The self-review pass narrowed day-one extraction scope to the branch-safe Direct / EnumValueOf / ContextArg kinds: FieldBuilder.firstUnsupportedFilterArg structurally rejects JooqConvert (deprecated-for-removal DataType.convert trips the consumer -Werror), NodeIdDecodeKeys (needs the CompositeDecodeHelperRegistry), and nested-input / developer @condition filters (the classifier-guarantees-emitter-assumptions floor that lets branchFilterWhere drop all registry/alias plumbing), with R383 filed for lifting the rest. orderBy is split to R382 (__sort__ doubles as the connection cursor seek key). Coverage: pipeline-tier MultiTableFilterLoweringTest (per-participant lowering for interface + union; absent-column rejection; ID-typed JooqConvert rejected structural; field- and arg-level @condition rejected structural, not deferred) and execution-tier MultiTableFilterExecutionTest (AddressOccupant = Customer | Staff, list + @asConnection forms filter per branch and return only matching rows, exercising both buildStage1Block and buildStage1ConnectionBlock); no code-string assertions on generated bodies. Shares MultiTablePolymorphicEmitter with R365/R366/R367. In Review → Done reviewed by a session distinct from the implementer; full reactor green under mvn -f graphitron-rewrite/pom.xml install -Plocal-db.

R374 (5193fdc; Spec → Ready 44b0146, Backlog → Spec fbb6c1f, filed b106ccc): MCP cross-reference edges (R118 slice 7): the traversal layer over the frozen R362/R368 structured tools, all module-local to graphitron-mcp. A new edges tool (D-A, a dedicated tool rather than a neighbours field retrofitted onto every result, so the eight existing contracts stay frozen) takes exactly one node selector (field / type / table / column`+table` / method / class) plus a direction (out / in / both) and returns that node’s typed neighbours. D-D: a sealed NodeRef model (TypeNode / FieldNode / TableNode / ColumnNode / MethodNode / ClassNode) owns the whole stable-ID grammar and composes each wire string only at the McpWire boundary (methodRef / new columnId), reconciling the classifier’s bare table names through CatalogFacts.resolve (the qualified schema.table IDs catalog.describe accepts) and its arity-free (class, name) method pairs through the external-reference scan (one RESOLVES edge per overload). D-B: an EdgeKind label enum (BACKS / TARGETS / REFERENCES / RESOLVES / PARTICIPATES) with the varying endpoint shape pushed entirely into NodeRef.target, so the enum carries no kind-dependent nullability (the sealed-over-enum tension resolved); the TARGETS / REFERENCES split falls out of the classifier’s joinPath distinction rather than being re-derived. The arm-to-kind mapping is an exhaustive no-default switch over every FieldClassification (28) and TypeClassification (23) permit, mirroring SchemaView ; the cross-module drift guard: a new classifier permit fails the edge switch to compile. D-C: a lazy, (snapshot, catalogFacts)-reference-pair-memoised ReverseEdgeIndex (the slice’s real deliverable, for impact analysis: which schema fields bind a given column / method / table), built by inverting the same per-field switch the forward producer uses so the two directions cannot disagree, holding no new BuildArtifacts / Workspace field. Stage 3 (neighborhood subgraph tool) and indexing the forward-walkable PARTICIPATES (type → type) direction correctly deferred per R118 OQ6. Deviation from the spec’s mcp/edges/ sub-package: the edge model stays in the flat mcp package to reuse McpWire’s package-private grammar composers, single-sourcing the wire grammar rather than widening `McpWire’s deliberately-internal surface ; judged sound (it serves the same boundary-encoding principle D-D leans on). Coverage: MCP-handler-tier `GraphitronMcpServerTest (forward Column / ColumnReference-with-joinPath / table-bound ServiceBacked / @node-type; reverse column / method / table directions asserting the endpoint slot holds the field not the queried node; ambiguous / notFound / two-overload fan-out reconciliation; Unavailable-before-build and memo-rebuild-on-build-swap), structured-content assertions only, plus unit-tier EdgeCoverageTest partitioning every permit into edge-bearing / no-edge with overlap / missing / stale guards (the live drift-guard pin). In Review → Done reviewed by a session distinct from the implementer; graphitron-mcp module suite (52) and all 35 R374 tests green under mvn -f graphitron-rewrite/pom.xml install -Plocal-db (one full-reactor run flaked on the unrelated R372 BgeEmbedderOnnxTest strict-margin similarity assertion, which passes in isolation and on a focused module run; untouched by R374).

R377 (b44de9b; Spec → Ready 2afdec9, Backlog → Spec 212f21c, filed 26e82a0): decode<typeId> mismatch when multiple @table types share a table. BuildContext.resolveDecodeHelperForTable resolved through findGraphQLTypeForTable, an all-@table index that counts nesting-projection types and so returns empty (ambiguous) for any table backed by more than one object type; that routed decode resolution to a typeId-named fallback (decode<typeId>), which agrees with NodeIdEncoderClassGenerator’s emitted `decode<TypeName> only when typeId equals the type name. A customized numeric @node(typeId:) over such a table (a @node plus a nesting-projection @table, e.g. UTDANNINGSMULIGHET) emitted a decode<typeId> call javac could not resolve, a latent error that surfaced only in the consumer’s compile, found porting utdanningsregisteret to Graphitron 10. Fix: rewrite the resolver to the @node-only NodeIndex by-table view (nodes.forTable), which is exactly the right domain (it sees only @node types, not the projection types sharing the rows), with a three-way outcome: one node → its decodeMethod() (type-name keyed, matching the encoder); two or more → null, which the four callers already map to a validate-time "zero or multiple GraphQL types map to it" rejection rather than a phantom decode<typeId> (validator mirrors classifier invariants); no node → the orphan-input typeId fallback (synthesis-shim retirement track, retire-synthesis-shims.md). The wrong-domain branch 1 is dropped entirely rather than masked behind branch ordering; findGraphQLTypeForTable stays for its one remaining caller (the id-reference synthesis shim). The casing divergence is closed structurally: NodeIndex.byTable is keyed on the lowercased @table(name:) echo at construction (TypeBuilder.buildClassificationIndices) and NodeIndex.forTable lowercases its lookup arg, so a consumer never re-establishes the TableRef.sameTable contract. Coverage: three pipeline-tier NodeIdPipelineTest cases (decode-via-index-not-typeId asserting decodeSharedNode not decode10154; multi-node rejection to UnclassifiedType with the "zero or multiple" message; orphan-input typeId fallback pinning the branch-1-drop decision) over a new nodeidfixture.shared_node table with a customized numeric typeId, plus a graphitron-sakila-example compilation backstop (FilmEndorsementNode @node(typeId: "920534") over film_endorsement, already backed by the FilmEndorsement projection, decoded by a new endorsementsByNodeId query) so the javac-stage failure is caught end-to-end by the module’s <release>17</release> compile; structural assertions only, no code-string assertions on generated bodies. In Review → Done reviewed by a session distinct from the implementer; full reactor green under mvn -f graphitron-rewrite/pom.xml install -Plocal-db.

R375 (8e0887a code, fe4303d plan-body test-name fixup; Spec → Ready 0147443, Backlog → Spec 4b443e9, filed b804f4c): Empty list passed to a fetch-path list-IN filter now narrows by nothing (DSL.noCondition() identity) instead of emitting IN (), which jOOQ renders as the constant false and silently zeroed the query. An external bug report (10.0.0-RC18, regression from 9.3.0) hit this through Apollo Client serialising an empty selection as [] on a list @nodeId filter argument: the empty list AND-ed an unsatisfiable predicate into the WHERE and dropped every row. The rewrite has no hasIds branch (R50/e4b collapsed list @nodeId filters without @condition onto a plain column-shaped BodyParam.In/RowIn), so the symptom was general to every list-IN filter, not @nodeId-specific. Fix: a literal empty guard on all four In/RowIn arms of TypeConditionsGenerator.buildConditionMethod (non-null if (!arg.isEmpty()); nullable folds the emptiness into its existing != null check); Eq/RowEq unchanged (scalars have no empty state). The fetch/lookup split is principled, not a per-field carve-out: on a fetch field a list filter is an optional narrowing predicate whose empty identity is noCondition (the list-arity sibling of the null/omitted case R230 already drops), while a lookup field’s input rows are the FROM-side of a VALUES…JOIN (LookupValuesJoinEmitter), where empty is an empty join domain and 0 rows is the only coherent answer; TypeConditionsGenerator already excludes LookupField upstream (line 63). The guard is emitted as a literal, not lifted into a sealed EmptyBehavior model slot: within this emitter "drop on empty" is a constant invariant with a single value, so the Generation-thinking two-consumer trigger does not fire and a single-case sub-taxonomy would be over-engineering (the DML-consumer lift point is named for if one ever appears). Scope item surfaced during implementation: filmsByNodeIdArg (argument-level same-table @nodeId, R106-lifted onto the WHERE film_id IN (...) rail) is a fetch field, so its empty and all-malformed execution tests carried stale pre-R106 lookup wording and asserted the empty set only because IN () = false coincidentally zeroed the query; both inverted to the unfiltered baseline. The all-malformed case (SkipMismatchedElement drops every id → empty List<Integer>, indistinguishable from a literal [] at the condition method) follows the same noCondition rule per the wire-format-boundary principle (decode classifies skip-vs-throw at the boundary; downstream sees tuples with no provenance), and whether all-malformed should instead surface a user error is correctly split out to R378 (decode strictness, Backlog). Coverage: pipeline-tier TypeConditionsGeneratorTest (!ids.isEmpty() assertions on the In and RowIn arms + new inFilter_nonNullList_emitsEmptyGuardWithoutNullCheck pinning the non-null arm the nodeId helpers don’t reach), execution-tier GraphQLQueryTest (inverted films_filteredBySameTableNodeId_emptyListReturnsUnfilteredBaseline, new connection regression filmsConnectionByOptionalIds_idsEmptyList_paginatesFullTableAndCountsAll asserting nodes + totalCount both unfiltered, inverted filmsByNodeIdArg_{emptyList,allMalformedIds}_returnsUnfilteredBaseline, and the lookup-divergence comment on inlineLookupTableField_emptyInput_returnsEmpty). In Review → Done reviewed by a session distinct from the implementer; full reactor green under mvn -f graphitron-rewrite/pom.xml install -Plocal-db (GraphQLQueryTest 275, full suite 461 + 65, 0 failures).

R376 (64c6f23 implementation, 35a2e7e stale-javadoc cleanup; Spec → Ready f3f2a26, spec refinements e60d49b 52fc227, filed 21c4e62): Goto-definition (and the declaration-name hover overlay) on a method-backed SDL field name now jumps to the bound Java method, not just the column / accessor / record-component cases that resolve through the enclosing type’s backing. A @service / @externalField / @tableMethod field (and its root query/mutation forms) previously had no field-name jump at all: the cursor had to be parked on the directive’s method: / className: argument before Definitions would navigate. The bound class+method were already resolved on the snapshot’s FieldClassification; goto and hover simply never consulted it for the name trigger. Routing: a new DeclTarget.methodBackedTarget arm consults built.fieldClassification(parentType, member) before the TypeBackingShape dispatch in ofField, so a method-backed classification (six variants: ServiceBacked, Computed, TableMethod, QueryService, QueryTableMethod, MutationService) takes precedence over the parent table’s column backing; it rides the already-projected snapshot (no source-index read in the pure core), keeping the R371 goto/hover structural parity intact. Arity, primary with a name-level floor: DeclTarget.SourceMethod widened from (class, accessorMethodName) to (class, methodName, paramCount) so both consumers key the source index on the same overload, retiring the hover overlay’s arity-0 hardcode (correct only for zero-arg POJO accessors; a service method takes at least a DSLContext, which would have made goto jump while hover returned empty, violating overlayIsPresentExactlyWhenGotoJumps). SourceWalker.Index gains a never-dropped methodsByName view and resolveMethod: the precise (class, name, arity) key first (lands on the correct overload), falling back to the name-level view when that key is absent or was dropped as a same-arity collision, so a same-arity overload still lands on a declaration adjacent to the set rather than declining. DefinitionTarget.Ambiguous is retired: the directive-arg Definitions.methodTarget path is aligned to the same floor (no Ambiguous non-jump remains anywhere on the navigation path, the spec’s open-question fold-in). Two documented, safe-degrading assumptions: the method-backed arm uses default -> empty over the 32-variant FieldClassification rather than an exhaustive switch (a future method-backed variant silently won’t extend, scoped out by the spec forbidding a FieldClassification model change), and keys the lookup on the resolved member name, relying on method-backed fields carrying no @field(name:) override (a miss degrades to the prior no-jump, never a wrong jump); for an arity-overloaded service name the classification records no signature, so resolve() takes the first catalog candidate’s arity and the name floor still guarantees a jump. Spans graphitron-lsp plus the small SourceWalker.Index addition in graphitron. Coverage: DeclarationDefinitionsTest (the four named variants jump end-to-end; an arity-distinguishable greet() vs greet(String,int) resolves to the correct overload, not the name floor; a same-arity collision still jumps via the floor; classified-but-unindexed returns empty), DefinitionsTest (the former Ambiguous case now falls back to a name-level jump), DeclarationHoverOverlayParityTest (a non-zero-arity SourceMethod parity case). In Review → Done reviewed by a session distinct from the implementer; full reactor green under mvn -f graphitron-rewrite/pom.xml install -Plocal-db (graphitron-lsp suite + 461 + 65, 0 failures).

R372 (c2acec1; Spec → Ready 5dadff3, Backlog → Spec c154ce2, filed 47e4e24): MCP RAG foundation (R118 slice 8): the semantic-layer infrastructure the docs.search (slice 9) and catalog.search (slice 10) tools sit on, all module-local under graphitron-mcp/.../rag/, registering no agent-facing tool and leaving GraphitronMcpServer untouched. Three seams plus one lifecycle. D1: a graphitron-owned Embedder seam (embedQuery / embedDocuments / dimension) that owns the bge query/document asymmetry ; BgeEmbedder prepends the bge instruction prefix on the query path only ; and whose Query / Embedding records bundle BM25 text with its KNN vector and name no langchain4j type, so the multilingual swap (R118 OQ2) attaches to this wrapper, not the library; English-only bge-small-en-v1.5-q (384-dim) for V0. D2: an EmbeddingStore seam with LuceneEmbeddingStore (BM25 + KNN in one index, fused by reciprocal-rank fusion) as the sole shipping backend, an in-RAM ByteBuffersDirectory instance of the same class as the seam’s test fake, and the dimension invariant checked once at add against the embedder’s dimension(). D3: a generic sealed WarmState<T> over Warming / Ready / Failed with a handle-agnostic degradation-message helper (exhaustive switch, no default, rejects Ready), and the AsyncWarm<T> background-daemon harness whose await() returns the terminal value (never Warming) so a dependent build-warm maps an upstream Failed into its own Failed rather than hanging; volatile state read mirrors R361’s per-field posture. Dependency quarantine (R341): the one genuinely heavy native dependency (ONNX Runtime JNI, pulled transitively by the bge module) plus Lucene core land on graphitron-mcp alone, never the plugin’s compile surface; surefire on this module gains --enable-native-access=ALL-UNNAMED with no excludedGroups, so CI’s default mvn verify -Plocal-db runs everything. Coverage: seam-tier (fast, no ONNX) asymmetry routing, store KNN round-trip + BM25 hybrid surfacing a lexical match, dimension guard, load-only-rejects-add, WarmState transitions across both type parameters + await propagation / cross-warm failure; infrastructure-tier BgeEmbedderOnnxTest (@Tag("slow"), runs in CI) loads the real bge model asserting dimension 384 and a strict-margin similarity separation. In Review → Done reviewed by a session distinct from the implementer; full reactor green under -Plocal-db (RAG seam + ONNX tests all run, 0 skipped). Blocks slices 9/10/11.

R362 (ea47993 implementation; Spec → Ready 173a7d0, Backlog → Spec 304c39f, filed d7c8d15): MCP catalog.tables / catalog.describe over a build-time CatalogFacts projection (R118 slice 2, on the R361 seam). Resolves R361 D1 to build-time enrichment (option A, not a retained loader): a new frozen CatalogFacts record (tables keyed by schema-qualified SQL name; columns with SQL+Java names, SQL types, nullability, comments; PK / unique keys; indexes; in/out FKs with their column pairs) is built once per catalog rebuild in CatalogBuilder.buildCatalogFacts(JooqCatalog) while the codegen loader is open, carried as a third BuildArtifacts component beside CompletionData and the snapshot, and swapped onto a volatile Workspace.catalogFacts field in setBuildOutput. The load-bearing invariant (no Table<?> / ForeignKey<?,?> / Field / Class retained) is what lets the projection outlive the per-pass withCodegenScope loader close; new resolved-immutable JooqCatalog accessors (allTableEntries, candidateKeys(Table<?>), columnFactsOf, indexFactsOf, foreignKeyFactsOf) reduce every live handle to String at the parse boundary. GraphitronMcpServer registers the two tools mirroring the R361 statusTool shape: catalog.tables (schema + SQL-name-substring filters, opaque base64-offset cursor paging with nextCursor) and catalog.describe (resolved / ambiguous / not-found arms over a parallel CatalogFacts.TableResolution). sqlType maps to the jOOQ DataType.getTypeName() (SQL discovery key, not the Java FQN); no new classifier or validator branch (a read-only projection of already-classified facts). Coverage: pipeline-tier fact capture over the real Sakila catalog (film columns/PK/index/in+out FKs with column pairs, storage_bin unique key distinct from PK) plus a structural recursive no-live-handle walk and a close-then-read smoke test; MCP handler tests driving a real loopback server assert mapped structuredContent for list/filter/page and describe resolved/ambiguous/not-found. In Review → Done reviewed by a session distinct from the implementer; mvn install -Plocal-db green (CatalogFactsTest 9, GraphitronMcpServerTest 11, full suite 460 + 65).

R365 (3366bbe floor, 976e0a3 classifier+emitter, 0e82f71 execution fixture; In Review → Ready rework e7477ac, rework fix b28fe15, mutation fixture + drop-contract fd1f59e; Backlog → Spec b6a6f93, Spec → Ready 0426d42): Restore the graphitron 9.3 ability to return a polymorphic entity from a root @service field (route (a): the service hands back a PK-populated jOOQ TableRecord per branch, and the generated fetcher dispatches on each returned record’s runtime class to pick the participant, tags __typename, and auto-fetches the selected columns by PK). ServiceDirectiveResolver.projectReturnType’s `PolymorphicReturnType arm now resolves to a new Resolved.Polymorphic success (the all-@error errors-channel lift still takes precedence) instead of the old "not yet supported" reject; new QueryServicePolymorphicField / MutationServicePolymorphicField leaves carry the participant set and service method, and MultiTablePolymorphicEmitter.emitServiceMethods reuses the multitable query path’s stage-2 by-PK auto-fetch (buildPerTypenameSelect) verbatim, replacing stage-1 UNION-ALL discovery with record-class dispatch over the returned records. Scope is exactly one shape: a @service returning a distinct-table multitable interface. Three guards keep that floor honest at the one shared validateMultiTableParticipants site and at classify: same-table participants in a plain multitable interface/union are an AUTHOR_ERROR (record-class dispatch cannot tell shared-recordClass participants apart, with or without @discriminator; model as a single-table discriminated TableInterfaceType or split) ; this also guards R363’s query path; a @service returning a union is permanently unsupported (AUTHOR_ERROR, union polymorphism is a generated-query-path capability the service path never grew); a @service returning a single-table discriminated interface (TableInterfaceType) is deferred-rejected (the table-bound service path emits no per-row discriminator dispatch). Child @service polymorphic returns stay deferred (root only). The In Review pass requested rework on a silent-misdispatch hole (same-table participants carrying @discriminator passed the original no-discriminator-only floor and reached a dead-arm instanceof chain in the emitter, contradicting "validator mirrors classifier invariants"); the rework closed it by rejecting both same-table subsets and narrowing scope to interface-only. Route (b) (the { field, errors } payload + errors: envelope shape) remains a separate follow-up on R366/R367. Coverage: pipeline-tier corpus (query-service-polymorphic, mutation-service-polymorphic) + a @ProjectionFor projection test, unit-tier floor pins in QueryInterfaceFieldValidationTest / QueryUnionFieldValidationTest (both same-table subsets → AUTHOR_ERROR), builder negatives (serviceReturningUnion_rejectedAsUnsupported, serviceReturningTableInterface_deferred), and execution-tier ServicePolymorphicReturnExecutionTest (query single + list and a @service mutation list round-trip, each dispatching two distinct-table branches by runtime record class against real PostgreSQL); the route (a) drop contract (a returned record matching no participant or no live PK row is dropped) is documented in buildServiceMainFetcher. Shares MultiTablePolymorphicEmitter with R363/R366/R367. In Review → Done reviewed by a session distinct from the implementer (the independent reviewer requested the rework and verified the green re-run). graphitron (full suite) and graphitron-sakila-example (460 tests) green under -Plocal-db; graphitron-lsp / graphitron-mcp not exercised at review (tree-sitter native runtime unavailable in the agent sandbox, orthogonal to this change which touches no LSP/MCP files).

R367 (208a3e5, 629960b, 162a7fd; Backlog → Spec b6a6f93, Spec → Ready 88e1659, In Review → Ready rework cb2b4b9): Single-cardinality polymorphic child on a record-backed (Pojo / JavaRecord) parent, closing the capability gap the generator deferred at FieldBuilder’s `!fieldIsList arm (whose Rejection.deferred(planSlug: "polymorphic-child-record-parent-single-cardinality") pointed at a roadmap doc that never existed, a dead link in the generator’s own diagnostic). MultiTablePolymorphicEmitter.buildScalarPerParentFetcher gains a record-parent arm: it now takes parentSourceKey and, for a Reader.AccessorCall parent, binds parentRecord to the accessor’s returned hub TableRecord (((Backing) env.getSource()).<accessor>()) instead of casting the source to a jOOQ Record (which would ClassCastException on a Pojo source); a null hub yields a null payload, and the table-backed arm keeps the (Record) env.getSource() cast. FieldBuilder.resolvePolymorphicRecordParent drops the deferral so both cardinalities route through derivePolymorphicHubSource, removing the only reference to the dangling slug. Scope is top-level backing classes; the nested-backing-class Outer$Nested non-compiling-cast hazard (shared with the list arm via ClassName.bestGuess over a binary name) is filed as R370. Coverage: the two pipeline-tier deferral assertions in RecordParentMultiTablePolymorphicPipelineTest flip to assert successful AccessorKeyedSingle classification (interface + union), and execution-tier AddressOccupantCarrierSingleCardinalityTest drives a Pojo carrier holding an AddressRecord hub through Query.addressOccupantCarrier, pinning firstOccupant to the first Customer|Staff by sort order (Staff for a populated address) and to null over an occupant-free hub. The rework (162a7fd) fixed a red build the first In Review pass shipped: the no-occupants case queried addressOccupantCarrier(addressId: 4) but init.sql seeded only addresses 1-3, so a fresh DB returned a null carrier and the assertion failed (masked locally by a polluted persistent native DB; reproduced on a clean DB and in CI run 28104926051); the fix seeds an occupant-free address 4 (district Tasmania, no store/staff/customer) so the test exercises the empty-stage-1 null-payload arm over a non-null carrier rather than the null-carrier short-circuit, and corrects a stale SDL comment naming a nonexistent nested AddressOccupantCarrierService.Carrier. Sibling of R366 (list cardinality); enables R365 shape (b); shares MultiTablePolymorphicEmitter with R363. In Review → Done reviewed by a session distinct from the implementer (independent reviewer requested the rework and verified the green re-run). Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db, 12 modules).

R369 (1a8b57d; Backlog → Spec 87544d0, Spec → Ready bf002a5, Ready → In Progress acef1bc): graphitron:dev walks generated-sources of scanned reactor modules so goto-definition / hover reaches jOOQ tables that live in a separate module from the schema module running dev. Root cause was a lifecycle asymmetry between the two root sets AbstractRewriteMojo feeds the LSP: resolveClasspathRoots() reads target/classes (on disk from any prior build, so every reactor sibling is scanned for completion), but resolveCompileSourceRoots() read project.getCompileSourceRoots(), which only carries a generated-sources root once that module’s codegen plugin ran in this session, so a sibling jOOQ module unbuilt this session contributed zero walked source roots and its @table / @field jumps landed on DefinitionTarget.SourceAbsent (silent no-jump), breaking the R351 scan/walk parity invariant. Fix is in the shared resolver, not a dev-only branch (D2): new generatedSourceRoots(MavenProject) does a lifecycle-independent disk scan of the existing immediate subdirs of target/generated-sources/ (the generated-sources/<tool> convention every generator follows, not POM-config parsing ; D1), and compileSourceRootsOf(MavenProject) is the single per-module "what is walked" definition (getCompileSourceRoots() ∪ generatedSourceRoots) that both resolveCompileSourceRoots() and the new unwalkedScannedModules(Iterable<MavenProject>) route through, so resolver and diagnostic cannot drift; collectExistingDirs dedups by normalised absolute path so a root the plugin already registered (full-lifecycle goals) collapses, making the widening a no-op there. DevMojo renders a startup WARN naming any residual scanned-but-unwalked module (the dependency-JAR case with no .java to walk, explicitly out of scope for the auto-include). The stale resolveCompileSourceRoots() javadoc was rewritten to match. Coverage: unit-tier AbstractRewriteMojoTest (5: disk discovery incl. stray-file exclusion, empty cases, the core widening regression, plugin-registered dedup, `+unwalkedScannedModules` reporting only the genuinely-unwalked module); unit-tier SourceWalkerTest.disjointGeneratorPackagesKeepTableJumpLocatedNotAmbiguous pins the D1 output-package-disjointness argument (a graphitron output root walked alongside a jOOQ root leaves the table-class jump Located, not Ambiguous) rather than leaving it as unpinned prose; no generated-body string assertions. Builds on R351 (parity invariant + collectExistingDirs) and R352 / R90 (SourceWalker.Index, DefinitionTarget empty-resolution contract). In Review → Done reviewed by a session distinct from the implementer. graphitron and graphitron-maven-plugin test tiers green under -Plocal-db (AbstractRewriteMojoTest 9/9, DevMojoTest 6/6, SourceWalkerTest 9/9); the graphitron-lsp / DevServerTest completion-socket tests could not run in the agent sandbox (the tree-sitter native runtime install clones GitHub, which the egress policy denies ; orthogonal to this change, per the spec’s verification caveat).

R361 (d08b6ed; Backlog → Spec 8d0f8e0, Spec → Ready 60e0667): MCP shared-model seam, slice 1 of the R118 MCP programme. The R341 skeleton served static content only (prompts capability alone, an argument-less about prompt) and held no reference to the live generator model. R361 widens GraphitronMcpServer’s constructor to `(InetSocketAddress, Workspace) and holds the live handle; DevMojo.bindServer passes the same Workspace instance it hands the LSP DevServer, so the existing schema / classpath / source watchers refresh it in place with no new trigger, listener, or refresh path (the volatile fields give per-field visibility on the next read). The tools capability is declared (.tools(false), the listChanged boolean) with one liveness status tool that reads Workspace.snapshot() on every call and reports the snapshot on its two orthogonal axes, availability (Built / Unavailable) and freshness (Current / Previous, absent when unavailable), mapped through an exhaustive switch over the LspSchemaSnapshot sealed permits with no default so a new arm forces a compile-time choice rather than silently flattening; no domain counts (those are the later structured-tool slices' wire contracts). D1 keeps the seam Workspace-only: the raw JooqCatalog is not threaded (it reflects lazily against the codegenLoader URLClassLoader that withCodegenScope closes each pass), deferred to slice 2. Adds the acyclic graphitron-mcp → graphitron-lsp compile edge (plugin → {graphitron, lsp, mcp}; mcp → lsp → graphitron), orthogonal to the module’s native-RAG dependency quarantine. Coverage: infrastructure-tier GraphitronMcpServerTest boots a real server and drives it with the real MCP client, asserting tools/list advertises the status tool and tools/call returns the two-axis snapshot on both the default Unavailable arm and a setBuildOutput-driven Built.Current arm; DevMojoTest’s bind-failure unwind retargeted to the widened constructor; no code-string assertions. Builds on R341. In Review → Done reviewed by a session distinct from the implementer. Full reactor green under `-Plocal-db.

R341 (df99ed9; spec lifecycle 115d174, 56e8fb6, b271054, 07755b5, Spec → Ready 83f0542): MCP server skeleton embedded in graphitron:dev. The smallest useful Model Context Protocol server that gives an MCP-aware agent (Claude Code, Cursor) ambient context about a graphitron project and, the load-bearing reason, establishes the transport-and-lifecycle seam the live catalog/schema discovery tools (R118) build on; it serves static content only. New graphitron-mcp module (GraphitronMcpServer implements AutoCloseable) hosts the MCP Java SDK 2.0.0 servlet-based Streamable HTTP transport (HttpServletStreamableServerTransportProvider) in embedded Jetty 12 EE10, bound loopback-only on 127.0.0.1:8488 (the LSP’s is 8487) at the /mcp endpoint, serving the handshake instructions string plus a single argument-less about prompt, both read once at startup from bundled jar resources (mcp/instructions.txt, mcp/about.md) mirroring LspVocabulary’s shape-not-state posture. The dedicated module is the dependency-quarantine seam that keeps R118’s heavy native deps off `graphitron-maven-plugin’s own compile surface (the "Separate business logic from API code" axis the `graphitron-lsp split also serves, not transport symmetry); it is published like graphitron-lsp (the plugin declares a compile-scope dependency and a Maven plugin resolves its declared deps from the consumer’s repositories at execution time), so it carries no maven.deploy.skip. Lifecycle wiring: DevMojo.bindServer constructs the server as a sibling of the LSP DevServer and DevMojo.cleanup closes it; mcpPort defaults to DEFAULT_MCP_PORT = 8488 but is deliberately not a @Parameter (a configurable port stays deferred). A taken MCP port fails fast with a MojoExecutionException naming the conflict (the fail-fast diagnostic promoted out of Deferred for parity with the LSP bind, per "Stability through simplicity") and closes the already-bound LSP socket so a partial bind leaks nothing. The startup log names the MCP URL and a copy-pasteable claude mcp add line; graphitron-sakila-example ships a committed .mcp.json. Coverage (transport-glue layer, outside the four-tier classifier/emitter enforcement by design): infrastructure-tier GraphitronMcpServerTest (3, boots a real server on an ephemeral port and drives it with the SDK’s own client: initialize carries the bundled instructions; about is advertised argument-less and returns the explainer; a taken port throws IOException); DevMojoTest gains the Mojo-message + no-LSP-leak case and a DEFAULT_MCP_PORT == 8488 pin on defaultsMatchPlanContract. Docs: getting-started.adoc gains a user MCP subsection and the contributor "how this is wired" section grows from four to five cooperating components (+ mermaid node, Ctrl+C cleanup); README.adoc module count 9 → 10 and graphitron-mcp added to the publishable surface. Out of scope and staying in R118: live catalog/schema tools over the warm Workspace, docs RAG, any vector store / embeddings / ONNX, the stdio-to-HTTP proxy, and the decision on keeping R118’s heavy deps off the non-dev plugin goals. In Review → Done reviewed by a session distinct from the implementer. Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db, 12 modules).

R358 (58bc29b, 7202e20; spec 61d5a9c, Spec → Ready 2ac746d, revise Ready → Spec 2ad3d45, Spec → Ready d75c838, Ready → In Progress e2e9612, In Progress → In Review e23b203): Guard table-name comparisons against case-sensitivity drift. TableRef.tableName() is the case-preserved verbatim @table(name:) echo, so the same logical table can surface as two differently-cased strings (the verbatim @table casing vs the lowercase jOOQ Table.getName() the record-class resolution path feeds in), and a case-sensitive .equals silently mis-decides under an Oracle-style UPPERCASE @table over a lowercase jOOQ catalog: the R357 bug, which FieldBuilder.resolveCarrierIdEncoder (:3105) was one explicit @nodeId(typeName:) hop from reproducing. Two phases. Phase 1 (58bc29b): convert the :3105 @nodeId(typeName:) NodeType-vs-carrier comparison to case-insensitive, and add TableNameComparisonCaseGuardTest (@UnitTier), a recursive source scan over src/main/java/no/sikt/graphitron/rewrite forbidding the .tableName().equals( spelling with a nonzero-scanned-file tripwire against a vacuous pass. Phase 2 (7202e20): move the comparison onto the type as TableRef.sameTable(String) / denotesSameTableAs(TableRef) (case-insensitive, null-safe canonical identity; tableName() stays the verbatim diagnostic echo), migrate all ~10 comparison sites across FieldBuilder / TypeBuilder / GraphitronSchemaValidator / BuildContext / NodeIdLeafResolver (both operand orientations, behaviour-preserving), and strengthen the guard to forbid every raw tableName() comparison (both .equals / .equalsIgnoreCase, both orientations) excluding the predicate’s home model/TableRef.java. The guard is then a backstop on a predicate correct by construction, the "model carries what the consumer needs" principle (rewrite-design-principles.adoc:17: the same predicate evaluated by multiple consumers is a sign the resolver is under-specified). Coverage: pipeline-tier MutationDmlNodeIdClassificationTest#bulkDeleteIdCarrier_explicitNodeId_caseMismatchedTable_admits (explicit @nodeId(typeName: "Bar") with UPPERCASE @table(name: "BAR") NodeType over lowercase @table(name: "bar") carrier; the spec’s :3105 reachability obligation, option (b)), verified rejecting pre-fix (the carrier drops to a non-SingleRecordIdFieldFromReturning classification) and admitting post-fix (encodeBar wired, empty diagnostics); unit-tier TableRefSameTablePredicateTest (matching/mismatched casing both directions, null arg); the strengthened TableNameComparisonCaseGuardTest as the structural net, verified tripping on a planted raw comparison with a named-site message; no generated-body string assertions. Out of scope and filed as R359 (d1985ec, column-sqlname-comparison-case-guard): the structurally identical ColumnRef.sqlName() sibling (one live .sqlName().equals( at GraphitronSchemaValidator.java:883 alongside six equalsIgnoreCase sites). Canonicalizing tableName() at construction rejected because it would change author-facing diagnostic casing (a documented invariant). Depends-on R357 (which converts FieldBuilder.java:5114; R358 owns :3105 and the structural pin). In Review → Done reviewed by a session distinct from the implementer. Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db).

R357 (faa465b; roadmap add 3b7d54a, Backlog → Spec 8d8cb45, Spec → Ready fdad51d): Case-insensitive @table(name:) match in record-composite carrier accessor resolution. A @service record-composite carrier (R329’s two-level Payload { results: [Result], errors } / Result { @table children } shape) whose result-type @table children declare @table(name:) in a case differing from the lowercase jOOQ catalog name misclassified every such child as UnclassifiedField with the three-option resolveRecordParentSource author error. collectAccessorMatches (FieldBuilder) grounds the DTO and resolves the accessor plus its element table correctly, then dropped the match on a single case-sensitive element-table guard: expectedSqlName carries the verbatim @table(name:) casing (via resolveTable) while the accessor’s element TableRef carries the jOOQ Table.getName() casing (via resolveTableByRecordClass), and the two diverge only when SDL casing differs from catalog casing (the driving utdanningsregisteret schema writes UPPERCASE @table(name:) against lowercase Postgres). The one-line fix aligns that comparison to equalsIgnoreCase, the table-name idiom already used at eight other sites. Surfaced by the utdanningsregisteret Graphitron 10 migration. Coverage: pipeline-tier ServiceRecordCompositeCarrierPipelineTest#caseMismatchedTableName_classifiesCompositeChildrenAsRecordTableField (the R329 FilmWithActors carrier with @table(name: "FILM") / @table(name: "ACTOR") against lowercase film / actor, asserting both children classify as RecordTableField ONE/MANY with empty diagnostics, the verdict not the case-insensitivity mechanism), verified failing pre-fix (both fall to UnclassifiedField) and passing post-fix; no generated-body string assertions. Out of scope and filed as R358 (table-name-comparison-case-guard): the sibling .tableName().equals( at FieldBuilder.java:3105 (R358 carries the conversion and is re-examining whether it is a latent instance of the same bug rather than inert) and a unit-tier guard pinning the idiom; canonicalizing TableRef.tableName() rejected because it would change author-facing diagnostic casing (a documented invariant). In Review → Done reviewed by a session distinct from the implementer. Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db, 11 modules).

R351 (bdabb1e, ffb2589; In Progress → In Review 59e1cc3; absorbs R352): Complete the LSP goto-definition decoupling R349 began, so the jOOQ half rides the source-cadence index too and both halves resolve through one shape. Source-root parity made structural: AbstractRewriteMojo’s scan path (resolveClasspathRoots) and walk path (resolveCompileSourceRoots) collapse onto one package-private, unit-tested `collectExistingDirs traversal over the same reactor project set, so a class scanned for completion provably has its source root walked for goto-definition; DevMojo logs a startup classpath-root / source-root / external-reference count so the "completion works but goto-definition returns nothing" report self-diagnoses. jOOQ half on the source index: CompletionData.Table / Column / Reference drop SourceLocation and instead carry the generated table-class FQN (and the Keys-class FQN for references); Definitions joins those FQNs against the LSP-owned SourceWalker.Index at request time and routes the @table / @field / @reference arms through the same exhaustive DefinitionTarget switch the service half uses, retiring the file-head 0:0 synthesis (a known table whose source is not on a walked root lands on SourceAbsent, a clean non-jump). Hover / description onto the source cadence: CatalogBuilder no longer walks .java at all (descriptions are the build-derivable fallback only: the jOOQ table’s SQL comment, empty for columns and services); a new Descriptions overlay reads the source-derived Javadoc from the index at request time with per-element precedence (table SQL-comment wins; column / class / method source Javadoc wins), and Hovers plus the FieldCompletions / TableCompletions detail read through it, so hover and goto cannot show two snapshots of one declaration mid-edit. Static cache → instance: SourceWalker’s per-file cache moves from a process-wide static onto an instance owned by `Workspace alongside the volatile sourceIndex; Workspace.refreshSourceIndex is the single walk entry point, called by the dev goal’s source-root watcher. Coverage favours real end-to-end over mocks: SourceCadenceHoverAndDefinitionTest walks real .java through the real Workspace / SourceWalker / Hovers / Definitions (asserting hover and goto move together across a source edit with the catalog the same instance, no rebuild); CatalogBuilderSourceTest inverts to pin the build-boundary decoupling (documented sources on the build are not lifted); SourceWalkerTest pins per-instance cache isolation (a same-mtime content change a static path+mtime cache would mis-serve); AbstractRewriteMojoTest pins the collectExistingDirs classpath/source-root parity; DefinitionsTest reaches every jOOQ arm and every DefinitionTarget outcome; no code-string assertions on generated method bodies. In Review → Done reviewed by a session distinct from the implementer. Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db). Predecessor R349 (the service half and the DefinitionTarget typing); absorbed R352 (the jOOQ-half / hover-cadence / static-cache follow-up R349 deferred).

R342 (fa2743f; spec e736a03, Spec → Ready de7490b): Structural dedup + value agreement for bulk UPDATE SET columns written by overlapping carriers. The fourth and last mutation write surface left open by R322 (the bulk UPDATE t SET c = v.c FROM (VALUES …) AS v(…) path) and the lift of R354’s deferred bulk self-FK form. The bulk path walked its SET groups per-group with no cross-group column dedup, so two writers landing on one backing column emitted that column twice in the derived table’s v(…) list and crashed loud (a duplicate-column Postgres/jOOQ error, not a silent drop, which is why R322 deferred it here). Two shapes were affected: a decode-involving within-SET overlap (a plain @field plus a @nodeId FK reference whose lifted child column coincides), and a self-FK @nodeId on a list-input UPDATE (rejected at validate time by UpdateRowsWalker Stage 2b). Plan: TypeFetcherGenerator.setColumnPlan(List<SetGroup>), the SET analogue of insertColumnPlan, groups the set groups' columns by backing-column sqlName into an ordered writer list (each carrying its source SetGroup index, slot, and ColumnRef), shared() when ≥2 writers; the three bulk emitters (emitSetVColNameAdds, emitSetBulkCellAdds, emitSetVFieldPuts) all walk the one deterministic plan, so the v(…) column-name list, the per-row cells, and the sets.put entries emit exactly one entry per distinct column and cannot drift out of positional alignment. Presence gate (setColumnPresenceGate): a disjoint column keeps its single writer’s first-row gate byte-identical to the pre-dedup form; a shared column’s gate is the disjunction of its contributing writers' first-row presence, and the uniform-shape guard makes projecting row 0’s disjunction onto every row safe (a gate keyed on the wrong writer would silently drop a present shared column, the exact silent-drop class R322 closed on the other surfaces; pinned by the two asymmetric-presence execution tests). Cells: the per-row decode locals are hoisted once per row into emitBulkSetDecodeLocals (INSERT-style instanceof String guard + presence-gated throw), so a composite group’s cells and a shared column’s gather all read one decode rather than re-decoding per writer; a shared column gathers the present writers' values (reusing R354’s presence-guarded appendAgreementValue), pairwise-checks them through NodeIdEncoder.requireColumnAgreement, and adds the single coalesced DSL.val(firstPresent, col.getDataType()) cell, emitInsertAgreementPrep’s coalesced-cell shape transplanted into the row loop (no `DSL.defaultValue branch, since the conditional gate guarantees a present writer, and not emitSetAgreementPreamble’s check-then-let-the-puts-run shape, which the bulk derived table’s lack of a last-write-wins `Map.put affordance forbids). Cross-partition (WHERE∩SET self-FK) fork (resolved in In Progress with principles-architect): setColumnPlan sees only SET groups, so a self-FK’s column shared with the WHERE identity is handled outside it, the two v-populating emitters skip a SET column already supplied as a WHERE/lookup v-column, emitSetVFieldPuts keeps the no-op sets.put (keeps sets non-empty so the empty-SET runtime guard does not fire on a minimal self-FK input), and a new emitBulkKeySetAgreement emits the per-row check reusing the already-present per-row decode locals (bulkKey<gi> WHERE-side, bulkSetKey_<gi> SET-side) rather than re-decoding (two decodes/row, not three; the agreement guards the values actually used). Walker: Stage 2b’s bulk self-FK UnsupportedInputFieldShape reject is deleted and the now-dead list parameter dropped from walk (both FieldBuilder call sites + the class javadoc updated); the walk is cardinality-independent, since R354 already routed a self-FK all-SET regardless of the list flag, so removing Stage 2b exposes a shape the classifier already routes correctly. UnsupportedInputFieldShape retains its other producers. Coverage: UpdateRowsWalkerTest (15 pass: the bulk self-FK reject test inverted to admit-and-route-all-SET with the shared mailbox_id in both partitions, plus a decode-involving-overlap-admits-without-PlainColumnCollision test); execution-tier BulkUpdateSetAgreementExecutionTest (7 tests: within-SET agree / disagree-rolls-back / asymmetric-present ×2 on the film_endorsement updateEndorsementsOverlap fixture, self-FK agree-repoints-with-mailbox_id-no-op / disagree-rolls-back / omitted-nullable on the email updateEmailReplies fixture), the list-input siblings of NodeIdValueAgreementExecutionTest / SelfFkNodeIdUpdateExecutionTest; compilation tier via the two new schema fixtures against real jOOQ at Java 17; no generated-body string assertions. Out of scope: the shared overlap-analysis abstraction lift across the now-six instantiation sites (R356, filed alongside this spec, depends on it); non-Postgres dialects; any change to the single-row UPDATE SET / INSERT / @service paths (R322/R354). In Review → Done reviewed by a session distinct from the implementer. Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db, 11 modules).

R355 (6562b7a; Backlog → Spec 8133ecf, Spec → Ready 42efe84): Infer depth-1 nested @condition arg bindings by name without argMapping. A @condition whose slot is an input object with scalar fields previously required an explicit argMapping to bind the condition method’s parameters to the nested fields, even when the parameter names already matched the nested field names exactly (the motivating searchVektingstallRange(table, fra, til) against SokVerdiRange { fra, til }); R355 drops that boilerplate. Core inference (ServiceCatalog.inferBindingsByType): a new name-keyed depth-1 branch runs on the parameters still unbound after the arity-unique and type-unique branches. For a parameter whose name matches exactly one direct field of a single unclaimed input-object slot, by name AND mapToJavaTypeName (so only canonical-scalar-typed leaves, never a named-input-object / enum / unclassified-scalar leaf the emitter cannot vouch for, the same null-is-no-match discipline the unambiguousReachablePath suggestion uses), it binds the parameter one level in via inferNestedFieldByName → PathExpr.step(head(slot), field, liftsList). The synthesised PathExpr is byte-identical to the one a hand-written argMapping: "p: slot.field" produces; liftsList is computed via ArgBindingMap.isListShaped (relaxed private → package-visible) so a list-shaped leaf is not hardcoded. Zero or >1 candidates leave the parameter unbound, so the existing per-parameter rejection / argMapping suggestion still fires; ranging over the unclaimed slot set keeps it a peer of its siblings and is what makes an ambiguous name fall through. Depth ≥ 2 stays explicit argMapping by design (deeper descent drags in recursive input types and path-dependent uniqueness; one hop is where the name still plainly names its source field). The disambiguator is the parameter name, orthogonal to R219’s count axis, so it lands as a distinct branch. Emit deviation (ConditionResolver.rewrapForNested): the spec’s "Files in play" said no emit change was expected (the PathExpr equals the explicit-argMapping one), but the execution test surfaced a latent gap shared by both forms: the input-field-@condition rewrap folded only the walk’s path to the input field and dropped each parameter’s own descent, so a multi-segment binding cast the whole wrapper Map to the leaf type (a defensive-cast-that-throws, against "classifier guarantees shape emitter assumptions"). A new nestedPath helper now appends the per-parameter path tail (segments after the head, the head naming the input field already at leafPath’s tail) to the `NestedInputField path; a bare-head (single-segment) binding returns leafPath unchanged, byte-identical for every pre-R355 binding, and the fix also completes the explicit-argMapping form for the same shape. The R214 ServiceCatalogTest case that deliberately yielded "to name-based matching" now asserts the concrete inferred binding (input.filmId) R355 produces instead of the suggestion it used to print, the intended R214 → R355 handoff (a strengthened assertion, and the type-unique yield it relies on stays implicitly exercised). Coverage: unit ServiceCatalogTest#inferNestedFieldByName_* (single scalar match, list liftsList=true, name-with-wrong-type → null, two-slot ambiguity → null); pipeline GraphitronSchemaBuilderTest (INFER_NESTED_CONDITION_ARG_BY_NAME asserting the inferred PathExpr chain, its *_EXPLICIT_ARGMAPPING_EQUIVALENT sibling asserting the identical values to pin equality, *_LIST_LIFTS_LIST pinning the computed liftsList=true, *_AMBIGUOUS_FALLS_THROUGH pinning the rejection, all on classifier-output PathExpr values not generated-body strings); execution GraphQLQueryTest#inputFieldCondition_nestedArgInferredByName_filtersSameAsExplicitArgMapping (a rental_rate [2.0, 3.0] round-trip selecting exactly the three 2.99 films, proving both bounds bind to the right nested field, asserted identical to the explicit-argMapping sibling). In Review → Done reviewed by a session distinct from the implementer. Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db, 11 modules). Related: R249 (nested argMapping syntax, the explicit axis), R219 (unify arity-/type-unique under one JavaTypeKey count rule, the type-based inference this sits beside), R214 (the layered type-based inference this follows).

R329 (5b59e4a; spec 268e404, revised 21a0d36, Spec → Ready 8c414b6): Re-admit @service carrier payloads with a record-composite data field, landing R75 Phase 3 on the post-R276 reflection-driven binding model. An @service mutation whose method returns a list (or single) of a consumer-authored composite (a POJO bundling several jOOQ records, e.g. one FilmRecord plus a List<ActorRecord>) is now expressible as a two-level carrier: a payload whose non-@table object data field is a list of an intermediate result type whose @field-mapped @table children map onto the composite’s components. Previously this dangled (rejectDanglingTypeReferences) ; the result axis skipped the wrapper under the cardinality-match guard, and the carrier axis admitted only @table-typed data fields. Binding side: the cardinality decision is lifted into one builder-internal sealed ProducerBindLevel { BindsWrapper, BindsDataFieldElement, NoBind } read by both the single-level and two-level paths (the ArgumentRef-style classify-once/project-into-each-consumer pattern), replacing the old sdlIsList != reflectedIsMulti reject + carrier-admit pair that would desync into a dangle or double-bind; BindsDataFieldElement grounds the data field’s element type to the producer’s reflected return-element on the existing result axis, so no new ProducerBinding arm and no nullable-TableRef generalization of ServiceEmitted. Carrier recognition: carrierTableBinding becomes a sealed CarrierBinding { TableBacked, ClassBacked, NotACarrier } with one carrierVerdict projection shared by lookAheadVerdict, the producing-edge registration, and the nesting/orphan guards, so the verdict cannot drift; the composite carrier classifies as a class-backed ResultType naming the per-element composite, gated on the payload being @service-produced (BuildContext.isServiceProducedPayload, the single producer of that fact, shared with the errors WrapperArm selector) and not itself result-axis-bound. Emit side: a new ChildField.RecordCompositeField leaf, justified by a dimensional row (Record / bareFetch / listOrSingle(Record) / Plain(composite)) distinct from RecordField (Field target), RecordTableField (Table target), and ServiceRecordField (ServiceCall operation); a source-passthrough projection carrying its own SourceEnvelope (DIRECT / OUTCOME_SUCCESS) rather than recomputing it at emit, reusing the existing Outcome WrapperArm for errors with computeMutationServiceRecordReturnType re-levelled to the reflected method return. Validator mirror: the three near-misses surface through existing recognizers (mismatched producer → RecordBindingMultiProducer; a @field child neither @table-backed nor a resolvable composite accessor → accessor-mismatch; the re-levelled cardinality mismatch → checkServiceReturnMatchesPayload), not new predicates kept complementary by hope. Coverage: a ClassifiedCorpus entry pinning the payload classification + data-field verdict, a @ProjectionFor(RecordCompositeField) LSP-projection assertion, RecordCompositeField in IMPLEMENTED_LEAVES (GeneratorCoverageTest stays exhaustive), pipeline-tier positive coverage (ServiceRecordCompositeCarrierPipelineTest: list + single arrival, DIRECT/OUTCOME_SUCCESS envelope, errors WrapperArm, @table children as RecordTableField), validator-tier coverage of the three near-misses (ServiceRecordCompositeCarrierValidationTest), and an execution-tier round-trip in graphitron-sakila-example (GraphQLQueryTest: List<composite> projection + the error arm rendering data: null) backed by the cross-module compile against real jOOQ records; no generated-body string assertions. Surfaced by the utdanningsregisteret Graphitron 10 upgrade (opprettUtdanningsspesifikasjonOgUtdanningsmulighet). The batch-keyed Map<Key, List<composite>> shape stays out of scope for root carriers: a root @service returns the composite list directly, while peelReturnElement/isMultiCardinalityReturn already peel Map for the orthogonal child-batching path and a Map return at a root carrier rejects loudly via checkServiceReturnMatchesPayload (settled, not half-wired). In Review → Done reviewed by a session distinct from the implementer. Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db, 11 modules).

R354 (46522ba; spec 64913b8, Spec → Ready 8e46e7f): Self-FK @nodeId on a Graphitron-owned single-row UPDATE routes all-SET with a cross-partition value-agreement check. The UPDATE sibling of R328 (which shipped the self-FK @nodeId @reference on the INSERT/read sides and the email/mailbox fixture). On @mutation(typeName: UPDATE) a self-FK whose child columns straddle the row’s identity key (email_in_reply_to_fk’s `(mailbox_id, in_reply_to_no), where mailbox_id is a PK member) previously tripped UpdateRowsError.MixedCarrierKeyMembership: the straddle check partitions at input-field granularity, so a self-FK overlapping the PK had no expressible UPDATE form. Design: a self-FK reference is a write of "who this row points at" (its parent), never the row’s own identity, so it routes its lifted columns wholly to SET regardless of key membership; the shared key column then appears in both the WHERE (from the identity field) and the SET (from the self-FK), ordinary SQL whose two decoded values the FK constraint forces equal. Marker: a selfReference boolean on InputField.ColumnReferenceField / CompositeColumnReferenceField, set once at the NodeIdLeafResolver discrimination site (where T.table() equals the containing table) and threaded through BuildContext; every other construction site passes false (the fact-lives-in-the-model lift, the walker reads carrier.selfReference() rather than re-deriving self-ness). Three UpdateRowsWalker sites fork on it: Stage 6 routes all-SET, Stage 4-5 computes key coverage over the non-self-FK columns only (a PK column reachable only via the self-FK correctly fails NoUniqueKeyCoverage, a self-FK cannot pin the row it lives on), and Stage 2b defers a self-FK on a bulk (list-input) UPDATE to R342 with a clear UnsupportedInputFieldShape reject rather than a silently-wrong FROM (VALUES …) derived table. The narrowed MixedCarrierKeyMembership still rejects a genuine cross-table FK straddle (a cross-table FK’s lifted column can legitimately be the row’s own identity, so it keeps partitioning by membership; fkTargetNodeIdRef_arity1_update_admitted pins that the all-SET rule did not leak). Emit: TypeFetcherGenerator.emitKeySetAgreementPreamble adds a cross-partition (WHERE∩SET) agreement preamble in the single-row UPDATE arm, decoding each side into a presence-guarded preamble-local and passing both through R322’s requireColumnAgreement (reused unchanged) before the DML; the throw names both contributing input fields. A second WHERE predicate was rejected as a silent drop wearing a no-match costume. This is the WHERE↔SET boundary R322’s four same-clause agreement sites never crossed, landed as a deliberate fifth instantiation of the gather-and-compare scaffold (the emitAgreementDecodeLocal / appendAgreementValue helpers are the seam, the carrier-agnostic writer-abstraction lift stays R342's). Coverage: UpdateRowsWalkerTest (all-SET routing, coverage-via-self-FK → NoUniqueKeyCoverage, bulk reject, cross-FK straddle still MixedCarrierKeyMembership), MutationDmlNodeIdClassificationTest (updateEmailReply classification + the marker on both carriers), graphitron-sakila-example compilation of UpdateEmailReplyInput against real jOOQ at Java 17, and execution-tier SelfFkNodeIdUpdateExecutionTest (agree repoints in_reply_to_no with the mailbox_id SET a no-op / disagree throws and rolls back, no silent row-move / omitted nullable updates subject only, no agreement check); no generated-body string assertions. docs/typed-rejection.adoc narrowed and RejectionSeverityCoverageTest annotated to reflect the self-FK no longer reaching the straddle arm. In Review → Done reviewed by a session distinct from the implementer. Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db, 11 modules).

R349 (1db8756): Decouple service-half LSP goto-definition positions from the generator build and type the resolution outcome. Goto-definition on a @service / @condition / @externalField class or method reference silently no-opped in a live graphitron:dev session when the reference’s source root was scanned for bytecode (so completion worked) but not walked for positions: CatalogBuilder.enrichExternalReferences left the CompletionData.SourceLocation at the UNKNOWN sentinel (uri="", line=0), which Definitions collapsed to "no jump" through one uri().isEmpty() test, making the recoverable not-yet-indexed case indistinguishable from the two correct no-ops (binary-only source genuinely absent; overload-ambiguous). Change 1, typed outcome: a new sealed DefinitionTarget { Located, SourceAbsent, Ambiguous } (in graphitron-lsp/.../definition/) replaces the sentinel; Definitions resolves the service half through two pure FQN-join helpers (classTarget / methodTarget) and switches on the typed outcome exhaustively in one place (Definitions.resolve), where SourceAbsent logs a recoverable signal and Ambiguous is a deliberate silent no-jump. SourceWalker.Index now exposes the ambiguousMethods set the merge already computed and discarded, so Ambiguous is distinguishable from SourceAbsent. Change 2, source-cadence index: CompletionData.ExternalReference / Method drop their definition field; the LSP owns a volatile SourceWalker.Index on Workspace (sourceIndex() / setSourceIndex), seeded by DevMojo at startup and refreshed by a third watcher (sibling to the schema and classpath watchers) on .java over the compile source roots, so a declaration that moves in a hand-edited source is jumpable without waiting for a .class rebuild. Definitions joins ref-from-catalog with position-from-source-index at request time on the FQN both carry. CatalogBuilder keeps lifting Javadoc into description on the build cadence (hover untouched). Scope bounded to the service half (the reported bug); the jOOQ half, hover-description cadence, and the static SourceWalker.CACHE are deliberate transitional states, each documented and deferred to the follow-up R352 (complete-lsp-position-decoupling). Coverage: DefinitionsTest pins each DefinitionTarget arm reachable (Located / SourceAbsent / Ambiguous) plus the end-to-end class/method jumps; SourceWalkerTest pins the ambiguousMethods exposure; CatalogBuilderSourceTest asserts the build-cadence Javadoc lift now that positions are LSP-tier; CatalogRefreshTest pins a .java edit refreshing the source index without a catalog rebuild; no code-string assertions on generated method bodies. Predecessors R90 (the source walk) and R351 (the compileSourceRoots/classpathRoots parity stopgap). In Review → Done reviewed by a session distinct from the implementer. Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db).

R350 (8c88f5d): Workspace-wide LSP goto-definition for GraphQL type references. Goto-definition on an intra-schema type reference (the Film in films: [Film!]!, an implements interface, or a union member) previously resolved only when the file declaring the target type was in an open buffer; in a real multi-file schema the declaration is frequently not open, so the jump silently no-opped ([]) even though the TypeDefinitionRegistry already holds every type’s source position and ships to the LSP through the build snapshot. Producer: LspSchemaSnapshot.Built gains a per-type declaration-location map (typeDefinitionLocations(), keyed by SDL type name) plus a typeDefinitionLocation(name) lookup, threaded through both leaf records' canonical constructors and Workspace.demoteSnapshot; a new 5-arg convenience constructor on each of Current/Previous defaults the map empty so existing fixtures compile untouched. CatalogBuilder.buildSnapshot populates it from registry.types() + registry.scalars(), reducing graphql-java’s 1-based SourceLocation to the 0-based coordinates every goto-definition consumer reads (mirroring SourceWalker’s `-1); null-source built-in scalars and the bundled-directive source are dropped rather than emitted as dead file:// URIs, the bundled source-name exposed as RewriteSchemaLoader.DIRECTIVES_SOURCE_NAME. Consumer: IntraSchemaDefinitions.compute takes the snapshot as an explicit parameter (test seam matching the Definitions.compute sibling convention, since the provider’s only Workspace-snapshot install path demands full BuildArtifacts); the open-buffer tree-sitter scan stays first and authoritative, falling back to built.typeDefinitionLocation(typeName) on miss, and GraphitronTextDocumentService passes workspace.snapshot() at the call site. Coverage: IntraSchemaDefinitionTest (the three acceptance arms: snapshot fallback when the declaring file is not open, open-buffer precedence over a deliberately stale snapshot entry, neither-source no-op) and CatalogBuilderSnapshotTest (a producer-side arm over the real RewriteSchemaLoader.load parse path asserting user types/scalars land at 0-based positions while built-ins and bundled-directive inputs/enums are dropped); no code-string assertions on generated method bodies. Out of scope: the pre-existing 1-based sourceLocation(GraphQLScalarType) completion-feed helper (a separate code path, not this fallback). In Review → Done approved by a session distinct from the implementer. Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db, 11 modules incl. graphitron-lsp).

R328 (27d2359): Self-FK @nodeId reference on Graphitron-owned DML mutation inputs. A same-table @nodeId carrying an explicit @reference(path: [{key: ...}]) now means "follow this self-FK and write its child columns" instead of "use my own identity", read/write symmetric and the sibling of R315 (cross-table FK-reference @nodeId) and R322 (the shared-column dedup + agreement it rides on). D1 gates the NodeIdLeafResolver.resolve same-table own-PK short-circuit on @reference being absent; with @reference present the leaf falls through to resolveFkJoinPath, which orients the self-FK with selfRefFkOnSource=true and yields a Resolved.FkTarget.DirectFk whose liftedSourceColumns are the self-FK’s child columns on the row’s own table, the same data shape a cross-table FK carries, so no new sealed variant. The single shared gate lives in resolve(), so the shape is admitted on the read side too (a same-table @nodeId @reference query arg / filter resolves to a DirectFk self-FK filter, WHERE child_cols IN (decoded keys), no self-join, and the @asConnection same-table advisory correctly stops firing). D2 lifts the R315 InputBeanResolver.buildRecordKeyDecode same-table "self-reference out of scope" reject, routing the @service jOOQ-record case through the same BuildContext.resolveRecordFkTargetColumns the cross-table branch uses (oriented selfRefFkOnSource=true), landing the decode on the self-FK child columns, never the record’s own PK. D3 adds no emitter code: R322’s per-column structural dedup + requireColumnAgreement carry the shared-column overlap (the natural CAMPUS/email case where the self-FK’s first child column coincides with a cross-table FK’s), proven end to end. D4 pins cross-path consistency by test rather than a new abstraction: the same-table && !@reference ⇒ self-FK predicate plus the node-key reconciliation are duplicated across the classifier (permutationToKeyColumns) and record-population (resolveRecordFkTargetColumns) paths, so anti-drift tests assert both land identical child columns on the identity permutation (email fixture) and off it (the existing reordered_fk_child fixture forcing a non-identity permutation through both reconciliations). Coverage: resolver-tier NodeIdLeafResolverTest (DirectFk landing + without-@reference identity contrast + two anti-drift cases), MutationDmlNodeIdClassificationTest (INSERT admits the CompositeColumnReferenceField over the self-FK child columns, surfacing the shared mailbox_id), JooqRecordServiceParamPipelineTest (@service classifier, replacing the dropped reject test), SelfFkNodeIdReferenceReadSidePipelineTest (read-side DirectFk filter + no-@asConnection-advisory), and execution-tier SelfFkNodeIdInsertExecutionTest (agree inserts / disagree throws + inserts nothing / omitted nullable leaves the lone decode, on the email/mailbox fixture, jOOQ schema 1.8 → 1.9); no generated-body string assertions. Out of scope: the bulk UPDATE SET decode-overlap dedup, the one surface where a self-FK shared-column overlap still fails loud (a duplicate derived-table column), owned by R342 (Backlog); R328 only makes that gap reachable via a natural self-FK shape rather than a contrived one. In Review → Done reviewed by a session distinct from the implementer (27d2359). Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db, 11 modules).

R322 (42ac9b2 @service jOOQ-record path D3+D4; 0535abb @mutation INSERT path D1/D2/D5; f739fd5 single-row UPDATE SET D3 + UPDATE-path D2; 0a9c8df In Review markup + R342 filing): Runtime value-agreement check for multiple @nodeId decodes onto shared columns. When more than one writer (two @nodeId decodes, a @nodeId decode plus a plain @field, or two composite FKs) lands on a single backing column, agreeing values are harmless but a disagreement would silently overwrite a caller-supplied value, the "no silent drops" failure the generator exists to avoid; the disagreement is only observable at runtime (values arrive off the wire), so it cannot be a build-time reject. D3 adds the shared predicate NodeIdEncoder.requireColumnAgreement(label, DataType, a, b): it coerces both sides through the destination column’s jOOQ DataType (the same coercion the real write applies, riding the class-level @SuppressWarnings for DataType.convert, so format-variant wire values like "01" / 1.0 / BigInteger 1 collapse onto the decoded 1 and agree, while a genuinely varchar "01" vs "1" still disagrees) and throws GraphqlErrorException on disagreement; one home for the message and semantics so the paths cannot drift. D1 resolves, per backing column, the ordered list of contributing writers, consumed by D4 (the @service JooqRecordInstantiationEmitter prepare/agree/load emission, byte-identical when no column overlaps), D5 (the @mutation INSERT structural dedup in TypeFetcherGenerator.insertColumnPlan driving the column list plus a single coalesced typed Field<ColType> VALUES cell, turning the Postgres "column specified more than once" crash into one column + one agreement-checked cell), and the single-row UPDATE SET agreement preamble (emitSetAgreementPreamble before the Map.put`s). D2 moves the build-time-decidable half (two-or-more plain `@field`s on one column, a pure schema fact no runtime input could reconcile) to a validate-time reject on both paths: `MutationInputResolver.rejectPlainColumnCollision (INSERT) and UpdateRowsWalker via the new UpdateRowsError.PlainColumnCollision (UPDATE, single-row + bulk), the mutation mirror of the R336 @service reject. All checks are presence-guarded (an omitted nullable writer is not a writer and cannot conflict) and pairwise against the first present writer (equals transitive). Scope call: extended past the spec’s INSERT focus to the single-row UPDATE SET path, and carved the bulk UPDATE SET decode-overlap to R342 (Backlog) on the grounds that the bulk UPDATE … FROM (VALUES …) join fails loud (a duplicate derived column) rather than silently, so it is self-announcing; with the single-row SET agreement and the all-plain reject in place, no silent drop remains on any mutation write path. Coverage: execution-tier NodeIdValueAgreementExecutionTest (the agree / disagree / presence-guard matrix across all three paths plus the format-variant "01" case pinning the coerced comparison, on storage_bin / film_endorsement fixtures), pipeline-tier JooqRecordServiceParamPipelineTest (two identity decodes / plain-field-plus-decode admitted and deferred to runtime) and MutationDmlNodeIdClassificationTest (the two-plain-fields rejects on INSERT and UPDATE SET), and the RejectionSeverityCoverageTest audit for the new sealed variant; no generated-body string assertions. Documented residual (recorded in the R342 follow-up): the column→writers overlap analysis now exists in per-path instantiations (@service, INSERT, single-row UPDATE SET, the two validate-time rejects); the shared predicate has one home but the structural grouping is re-derived per carrier model / pipeline stage, the lift to one carrier-agnostic writer abstraction deferred to R342 when the bulk-SET path forces it. Spec → Ready and In Review → Done both reviewed by sessions distinct from the implementer. Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db, 11 modules).

R344 (21915b9 exception + loader + DevMojo arm + tests; 1bf9ca7 self-review tightenings + R345 follow-on; 63b033d In Review): Surface schema parse failures as clean dev-watch diagnostics, not infrastructure stack traces. In the graphitron:dev watch loop a syntactically invalid schema (the common mid-edit case) dumped a ~30-frame graphql-java + executor stack trace into the build log on every keystroke, because RewriteSchemaLoader.load wrapped graphql-java’s InvalidSyntaxException in a bare RuntimeException and DevMojo.runGeneratorPass logged that through the "infrastructure" arm getLog().error(..., e) (with the throwable). A new typed SchemaParseException (a sibling of ValidationFailedException, not a subtype, in no.sikt.graphitron.rewrite) is now thrown from the loader’s InvalidSyntaxException arm only; the IOException / missing-file arms stay bare RuntimeException (genuine infrastructure, keep their trace). Its getMessage() is the existing file-attributed one-liner ("Schema parse failed in <file> at line N column M: <brief>`"), so the three already-quiet catalog-refresh paths (regenerate` / rebuildCatalog / buildOutputQuietly, which catch RuntimeException and print getMessage()) keep printing attribution unchanged; it also carries a nullable SourceLocation + brief consumer-less for now, positioned to feed the deferred LSP-squiggle follow-on (R345). runGeneratorPass gains a catch (SchemaParseException) arm ordered before the generic infrastructure arm that logs the one-liner without the throwable and resets previousErrorKeys = null (a parse failure is not a validator verdict, so it must not feed WatchErrorFormatter’s delta tracker). `GraphQLRewriteGenerator is unchanged: the exception propagates as-is through loadAttributedRegistry() out of all three entry points with no translation step, so the one-shot validate / generate build still fails on a broken schema carrying the attributed message. Two reviewed deliberate deviations: runGeneratorPass relaxed private → package-private as a test seam, and the consumer-less brief field carried per spec for R345. Rejected fork (documented in the retired spec): routing through ValidationFailedException + a fabricated ValidationError/Rejection.InvalidSchema, which would regress the quiet paths to a count string, falsify ValidationFailedException’s javadoc invariant, and stamp a pre-classification failure as a validator verdict. Coverage: unit `RewriteSchemaLoaderTest (throws SchemaParseException with the offending file’s SourceLocation + attributed getMessage() pinned exactly to location + brief as the quiet-path regression guard; still bare RuntimeException for a missing file), SchemaParseExceptionPropagationTest (generate() propagates the same type, no translation), and DevMojoTest (malformed schema → parse arm logs no throwable; missing file → infrastructure arm logs the throwable, pinning catch-arm ordering); no generated-body string assertions. Spec → Ready and In Review → Done both reviewed by sessions distinct from the implementer. Out of scope: the LSP red squiggle for parse failures (deferred to R345), wire/attribution mechanics, any change to ValidationFailedException. Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db, 11 modules).

R300 (8249abb fixture + jOOQ-regen foundation; 0074bd4 model + @routine directive + JooqCatalog.resolveTableValuedFunction + RoutineDirectiveResolver + emitter; 076cc56 execution-tier proof + routine.adoc docs + fixture gates; b0533b1 spec markup): First-class jOOQ routine support, day-one table-valued read slice. A new @routine(name:, argMapping:) directive backs a root Query field with a jOOQ-generated table-valued function (PostgreSQL RETURNS TABLE / SETOF). jOOQ models such a function as a first-class catalog Table<R>, so the slice rides the existing @table-bound return-type and selection-narrowing ($fields) machinery unchanged; only the FROM source differs, becoming a call to the schema’s global Routines convenience method with the routine’s IN parameters bound from GraphQL arguments. The provenance is carried by a new RoutineRef (the catalog-handle twin of @tableMethod’s `MethodRef) on a new QueryField.QueryRoutineTableField leaf, added to TypeFetcherGenerator.IMPLEMENTED_LEAVES so the four-way dispatch partition stays exhaustive; operation() is Fetch and target() projects a bare TargetShape.Table, following the QueryTableMethodTableField precedent. The deferred scalar-read and procedure-write forks reject at validate time via JooqCatalog.resolveTableValuedFunction (they do not resolve as table-valued functions), satisfying "validator mirrors classifier" without a STUBBED_VARIANTS entry, since no leaf is minted for them. Three reviewed deviations from the spec-as-reviewed: emission rides the Routines convenience method rather than <ROUTINE>.call(...) (same SQL); catalog-based discovery with IN-param names depending on -parameters compilation; classification reuses FieldClassification.QueryTableMethod (a dedicated QueryRoutine is a follow-up). Coverage: ClassifiedCorpus routine-table-valued-read fixture (Query / Fetch / List(Table)), a @ProjectionFor(QueryRoutineTableField) test in GraphitronSchemaBuilderTest, and RoutineFieldExecutionTest running the driving function (tilganger_for_feidebruker_med_fs_fiktivt_fnr) end-to-end against PostgreSQL including a selection-narrowing case; no generated-body string assertions. Spec → Ready and In Review → Done both reviewed by sessions distinct from the implementer. Deferred follow-ups (named in the retired spec): the procedure-write Operation write arm, scalar-function and record-returning reads, child-positioned @routine, heterogeneous binding sources, and the translation of legacy’s 26 procedureCall* rejection fixtures (the follow-up should also add pipeline coverage for day-one’s own resolver rejection arms, not only the legacy forks). Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db).

R336 (688a43c D1-D4 code + tests + CustomerRecordService fixture; doc-fix rework 13695d0): Flatten nested input-object fields in jOOQ-record @service params. A @service param typed as a generated jOOQ TableRecord can now group its columns under nested directiveless input objects that flatten onto the one backing table on the column axis, the analogue of the @table-input nesting the filter axis already supports. D1: CallSiteExtraction.ColumnBinding / RecordKeyDecode carry an ordered, non-empty List<String> access path (was a single sdlFieldName) with a leaf() accessor; the last element is the Map key, earlier elements the enclosing nested-input field names, and a top-level binding is a single-element path byte-identical to before (adopting the NestedInputField representation R186 settled). D2: InputBeanResolver.buildJooqRecord recurses into nested grouping inputs via a new collectJooqBindings, threading the existing ClassifyContext SDL-type-name expanding set for cycle detection, parallel to the member-axis buildInputBean walk rather than routing through classifyInputField (a different carrier family on a different axis). D3: typed Rejection`s through `JooqBuilt.Fail for cycle, list-valued nesting (a single record has one value per column), nested @table (a second DML target, cites R122), and plain-column collision across nesting (decode-vs-decode / decode-vs-column overlaps stay with R322’s value-agreement deferral). D4: JooqRecordInstantiationEmitter wraps each multi-element binding in a null-safe parent-Map descent (the instanceof Map<?,?> chain idiom from ArgCallEmitter generalised to statement form) with collision-free camelJoin-derived locals; an absent / null / non-Map group skips the columns under it, and a non-null identity inside an absent nullable group is skipped rather than thrown (skip-not-throw, since its R195 throw lives in the never-entered block). At depth 1 no wrapping block is emitted and the output is byte-identical to the pre-R336 form. graphql-java constraint surfaced in the execution tier: its coercion drops an explicit-null field from a nested input-object value (both literal and variable wire paths) while retaining it on the top-level argument map, so a present-null nested leaf is indistinguishable from omitted and leaves the column untouched; the top-level present-null → NULL three-way narrows to a nested two-way, with no emitted-code change. Coverage: pipeline JooqRecordServiceParamPipelineTest (8 new cases: flatten with two-element paths, mixed top-level + nested, nested @nodeId decode, depth-2, and the four D3 rejections by message substring) and 6 GraphQLQueryTest execution cases (lands-on-column + omitted sibling, present-null collapse asserted through the variable path, null group, skip-not-throw on an omitted nullable identity group, empty-input, malformed-id-in-present throws), plus the compile tier type-checking createCustomerRecord against the real jOOQ CustomerRecord; no generated-body string assertions. New CustomerRecordService fixture (CustomerRecord avoids the createFilmRecord per-record-class dedup clash on QueryFetchers). Spec → Ready and In Review → Done both reviewed by sessions distinct from the implementer. Out of scope: multi-table nesting, reclassifying the nested grouping type (the PojoInput(null) model/LSP-honesty wart is R337), any change to the @table-input nesting path. Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db, 11 modules).