Rewrite Changelog

R465 (a9deae5, Spec c3ae081/145afd1): Bump the two graphql-java satellite artifacts in the root pom dependency-management block, federation-graphql-java-support 6.0.0 → 6.2.0 and graphql-java-extended-scalars 22.0 → 24.0, holding graphql-java itself at 25.0 (the 25 → 26 jump breaks generator compilation and outruns what the two satellites officially support; deliberately out of scope as the conservative, ready-now half of the graphql-java catch-up). Federation 6.2.0 (built against graphql-java 25.0) and extended-scalars 24.0 both resolve cleanly and introduce no failures. R464 having already removed the convention table and its drift guard, the six new extended-scalars constants (YearMonth, Year, AccurateDuration, NominalDuration, SecondsSinceEpoch, HexColorCode) need no map-or-exclude curation: the reflective @scalarType resolver binds any public-static GraphQLScalarType constant on the classpath automatically, so they become resolvable candidates with no code change. Pure two-line version bump; no generator, generated-output, or test changes, exactly as scoped. A tree-wide grep confirms no live source, test, or user-facing doc still references the deleted convention table or its conventionTable_coversEveryExtendedScalarsField drift guard. Independent-session In Review → Done review; full reactor green under -Plocal-db across all 13 modules.

R346 (ab70c35/41c0b70): Regenerate and guard the generated supported-directives.adoc migration fragment against directive-set drift. The fragment (included by migrating-from-legacy.adoc, emitted by directive-support --mode=migration) promised in its own header a "verify-mode CI guard" that never existed, so it drifted silently every time a directive changed. The directive-support CLI gains an additive --verify flag mirroring leaf-coverage --verify: it regenerates the fragment in memory, compares against the committed --output file, and throws BuildFailure with a copy-pasteable REGENERATE_COMMAND on any drift (--verify requires --output, else exit 64). To keep the verify path inside the rewrite tree (standalone-build principle), the frozen 25-directive legacy set is snapshotted verbatim from graphitron-common/src/main/resources/directives.graphqls at tag v9.3.0 (pre-R182 delete) into roadmap-tool/src/main/resources/legacy-directives.graphqls rather than read from the legacy module; a stripped-before-parse provenance header documents the source. A phase-bound verify-supported-directives execution in roadmap-tool/pom.xml runs the guard on every mvn verify (PRs included), alongside verify-roadmap-readme and check-adoc-tables, so drift fails on the PR that introduces it rather than after merge. The one-time regeneration corrects the generated Supported-directives prose (R346 decision 2): it drops the unbacked "exercised by …​ a test fixture" claim (migration mode never computes that signal into the list, which gates on rewriteByName.containsKey minus the rejected/withheld sets) and states the real criterion (declared + supported, documented in the architecture chapter). Coverage: DirectiveSupportReportTest gains the prose assertion plus the --verify round-trip (zero on match, BuildFailure on drift, exit 64 without --output); the guard is its own regression net. The sibling supported-schema-shapes.adoc fragment (identical unguarded gap, but a build-trace-dependent guard shape) is deferred to a Backlog follow-up. Independent-session In Review → Done review; guard verified to fail cleanly on a deliberate fragment edit; full reactor green under -Plocal-db.

R464 (7786ce4, Spec f79855e/b1ff238): Remove convention-based scalar resolution; make @scalarType(scalar: "fully.qualified.Class.FIELD") the single explicit way to bind any non-spec, non-federation scalar. Generator side is pure deletion: ScalarTypeResolver loses CONVENTION_TABLE, conventionTable(), and resolveByConvention(), and TypeBuilder’s classification ladder loses its convention rung so a directive-less non-spec/non-federation scalar falls straight to the `@scalarType-pointing hard error (message simplified to name the directive as the single fix). This deletes the classpath-dependent classification surprise (a transitive extended-scalars pull silently resolving a bare scalar BigDecimal with no directive and no intent) and retires the convention-table drift test that gated extended-scalars / graphql-java upgrades (it tripped on the extended-scalars 24.0 dry run and blocked R465). The five spec built-ins and the federation-namespace scalars are untouched. Rather than dropping editor support, the LSP completion is upgraded: ClasspathScanner gains a readScalarConstants pass reading public static GraphQLScalarType fields by exact JVM descriptor match (the JOOQ_CONDITION_DESCRIPTOR idiom; final deliberately not required since the reflective resolver binds a non-final constant just as well), surfaced on a new CompletionData.ExternalReference.scalarConstants slot (with a back-compat 5-arg constructor keeping ~20 test callers compiling); ScalarTypeCompletions now completes className.fieldName from that scan, so it offers the consumer’s own scalar constants (com.example.Scalars.MONEY) plus any library’s with no coupling to extended-scalars, preferring a case-insensitive field-name match for the enclosing scalar X. The sakila scalar BigDecimal and the GraphitronSchemaBuilderTest R355 fixtures gain explicit @scalarType; the two CONVENTION_LAYER classification cases are deleted, the single-path UnclassifiedType contract case survives (asserting the new message so a re-added fallback fails loudly), and the old DIRECTIVE_BEATS_CONVENTION case is retained reframed as DIRECTIVE_ALIASES_TO_DIFFERENT_CONSTANT. Coverage: scanner test pins the public+static+GraphQLScalarType filter with three negatives (wrong field type, non-static, non-public), rewritten LSP completion + text-edit tests feed a populated CompletionData and assert the className.fieldName items, field-name-first preference, case-insensitivity, and the empty-on-other-directive guard; no code-string assertions on generated bodies. Docs sweep: custom-scalars.adoc, scalarType.adoc, and code-generation-triggers.adoc drop the convention layer, and resolution order is now two implicit paths (spec built-ins, federation-namespaced) plus the directive. Pre-1.0 breaking change; the actionable error message points at the mechanical fix. Independent-session In Review → Done review; full reactor green under -Plocal-db. Unblocks R465.

R459 (ed5b79b): CompileDependencyGraphBuilder now models the schema-shape → fetcher wiring edge for fetcher-owning plain-object nesting types. A nested type that owns a fetcher (any classified nested field, per R303) emits a <Type>Fetchers class its <Type>Type schema-shape wires (FilmMetaType → FilmMetaFetchers); the builder registered only the schema-shape node, so the wiring loop never added the edge and the TypeSpecReferenceWalk completeness oracle (correctly) flagged the superset gap. Fix is a dedicated addNestedFetcherNodes() walk (called from build() before addBlanketAndWiringEdges) that mirrors TypeFetcherGenerator.collectNestedFetcherClasses’ reachability verbatim: iterate `TableBackedType roots, walk each NestingField tree, dedup nested types by name, recurse into inner NestingField`s unconditionally, and register `units.fetchers(name) gated on a mirrored nestedTypeOwnsFetchers predicate (no FetcherEmitter coupling, same discipline as the builder’s filtersDecodeNodeId / hasSqlGeneratingField mirrors). Registering the node is the whole fix: the existing wiring loop then supplies schemaShape → fetcher, schemaClass → fetcher, and the blanket edges for free. Coverage: unit CompileDependencyGraphBuilderTest.fetcherOwningNestingTypeRegistersFetcherNodeAndWiringEdges and a pipeline IncrementalCompileHarnessTest corpus extension (Film.meta: FilmMeta { language: Language @reference }, single-valued inline TableField that exercises exactly the wiring edge and not the deferred per-field gap). Independent-session In Review → Done review verified the fixture is non-vacuous (disabling the walk reddens the oracle with exactly the one FilmMetaType → FilmMetaFetchers gap, nothing else); full reactor green under -Plocal-db. The nested fetcher’s own outgoing per-field edges are deferred to Backlog R462 (nested-fetcher-outgoing-field-edges).

R457 (7588358, core c2e818b, cutover c41752d, gate-fix 376ecd8, In Review e83532b): @mutation(table:) names a @mutation(typeName: DELETE) field’s write target on the consuming field, retiring @table-on-input for DELETE and making R332’s deprecation warning actionable. A DELETE commonly returns a bare ID / Boolean / count and can never return the deleted row’s @table type (R287 rejects DELETE → @table at authoring time, backstopped by MutationDeleteTableField’s compact constructor), so the only place to name the write target is the field: `deleteFilm(in: FilmDeleteInput!): ID @mutation(typeName: DELETE, table: "film"), the field-level analogue of @service(argMapping:). Precedence is @mutation(table:) (preferred) > the input’s @table (deprecated migration bridge, silently outranked when both are present, never cross-checked). The spec’s rung 1 (return-derived table) was dropped by author/user agreement precisely because R287 makes it unbuildable for DELETE; rungs 2 (override) and 3 (bridge) ship and fully satisfy the goal. Mechanism: directives.graphqls gains table: String on @mutation (documented DELETE-only); DmlWalkerInputArgResolution gains a RawArg arm making "the single input arg is not a TableInputType`" a normal outcome rather than an immediate reject, with UPDATE translating it back to the pre-R457 rejection verbatim (byte-identical) via `rawArgUpdateRejection while the DELETE classifiers own the fallback; FieldBuilder.resolveDeleteWriteTarget resolves the table by precedence and re-derives the input fields through TypeBuilder.resolveInputFields (factored out of buildTableInputType so both routes share one classification loop, returning the narrow (fields | failure) fact, not a synthesized TableInputType); the R330 validator-bypass is closed by mirroring GraphitronSchemaValidator.collectInputFieldRejections at the field-derived call site (a field-derived input never lands in the registry validateTableInputType walk); table: on a non-DELETE verb rejects loudly with the typed, sealed MutationTableArgError.UnsupportedVerb (stable graphitron.mutation-table-arg.* LSP code), with the classifier and mvn graphitron:validate reading one TABLE_ARG_SUPPORTED_VERBS set. Commit 1’s R332 DELETE carve-out is repurposed at cutover (additive-then-cutover, no dead set) from suppression to selecting the DELETE-specific replacement wording, so the warning now names @mutation(table:). Coverage: pipeline-tier MutationTableArgClassificationTest (7 cases: byte-identical carrier vs @table-on-input, no-@table classifies, unknown-table reject, no-write-target message leads with @mutation(table:) and cites R287, INSERT/UPDATE unsupported-verb rejections, validator-mirror parity on both paths), TableOnInputDeprecationWarningTest, execution-tier FixtureWarningsGateTest (FilmDeleteInput warns naming @mutation(table:)), and the deleteStorageBinByCode round-trip in DmlBulkMutationsExecutionTest (the sakila fixture dropped @table and set @mutation(table: "storage_bin"), round-trips identically against PostgreSQL); drift guards RejectionSeverityCoverageTest + SealedHierarchyDocCoverageTest; no code-string assertions on generated bodies. Docs: mutation.adoc (signature, parameter table, "Naming the DELETE write target" section, reworked constraint bullet), table.adoc WARNING, deprecations.adoc, code-generation-triggers.adoc, typed-rejection.adoc. A DELETE-scoped slice of R97’s "the write target is the consuming field’s property" axis; R97 remains the home for the general @table-on-input removal. Independent-session In Review → Done review; full reactor green under -Plocal-db (MutationTableArgClassificationTest 7, TableOnInputDeprecationWarningTest 4, FixtureWarningsGateTest 2, DmlBulkMutationsExecutionTest round-trip all pass).

R455 (f1d93a8, workstream B 319e668, In Review 991c2ae): Fix the TypeSpecReferenceWalk blind spots that silently falsified the R410 incremental-compile completeness oracle’s superset guarantee (walkEdges(u) ⊆ modelGraph.directReferences(u)), so the dev-loop incremental compiler could prune a dependent an ABI change should have recompiled while the oracle stayed green. Two coupled workstreams, landed model-first so every trunk commit stays green. Workstream A (graphitron-javapoet): TypeSpec.referencedClassNames() now descends $L args that are a nested CodeBlock / anonymous-class TypeSpec / AnnotationSpec (a $T stored opaque in a $L block was previously lost, missed across 60+ emitter sites) and walks type- and method-level type-variable-bound declarations, guarded by an identity-visited set so self-referential bounds (T extends Comparable<T>) terminate; the javadoc is corrected so the sole remaining blind spot is a class name baked into a raw string ($L String / $S). Workstream B (CompileDependencyGraphBuilder): a separate top-down projection walk mirroring TypeClassGenerator’s emit seam models the type-to-type projection-composition edges that were entirely absent (`types.Film → types.Language for each inline TableField/LookupTableField composing Target.$fields(…​)), attributing every edge to the hosting type class so nesting-hosted fields land on the outer type (not their immediate parentTypeName()), reaching NodeIdEncoder precisely when an inline filter decodes a @nodeId argument, adding the generated <Type>Conditions edge for a GeneratedConditionFilter, and blanketing the frozen GraphitronClientException scaffold. The per-child dispatch is a no-default exhaustive switch over the ChildField leaves carrying the one-model drift guard (a future inline-projecting leaf fails to compile until its edge is declared). TypeSpecReferenceWalk’s javadoc documents the shrunk review-only residual (same-package raw code-bearing string) with a discovery recipe; net 2’s FQCN scan is kept as-is (a same-package simple-name literal scan would over-collect). The demonstrated false green (`Film → Language inline projection on the R410 harness) is now true-green, and the harness corpus is extended with an inline @nodeId-decoding list reference (Language.films) exercising the typeClass → NodeIdEncoder, → conditions, and same-package nested-$L projection edges end-to-end. The fetcher-owning-nesting-type wiring gap the fix would otherwise surface is filed separately as R459. Coverage: 7 TypeSpecReferencedClassNamesTest unit tests (nested $L at depth ≥ 2, anonymous class, annotation, type/method type-variable bounds, recursive-bound termination, raw-string residual), 4 new CompileDependencyGraphBuilderTest unit tests (projection target, GraphitronClientException blanket, NodeIdEncoder only-when-decoding, nesting-hosted attribution to the outer class), and the extended IncrementalCompileHarnessTest; MultiSchemaPipelineTest’s R78 guard gets deeper coverage for free and stays green. Independent-session In Review → Done review; oracle + builder + multi-schema suites green under `-Plocal-db, javapoet unit tests verified passing on demand.

R456 (80a3df7, In Review e8571cc): Guard WorkspaceFile source/tree reads against a concurrent didChange edit/swap/close. The LSP handed the live, mutable WorkspaceFile out of its lock (Workspace.get) and let the five async request handlers (hover, completion, codeAction, definition, inlayHint, all on ForkJoinPool.commonPool) plus the diagnostic-recalc drain walk its tree-sitter tree and read its byte[] source on pool threads while didChange edited the byte array, swapped the tree, and eager-close()`d the previous native tree on the dispatch thread; the fields were plain (non-`volatile, non-synchronized). That raced a walk of a freed native tree (arena IllegalStateException / use-after-free killing the request), a torn (source, tree, version) triple so Nodes.text extracted garbage and hover/diagnostic ranges were wrong, and worst a WorkspaceEdit computed against mismatched offsets that the client applies and corrupts the user’s schema file (completion could even tear against itself across an interleaved edit). Design (settled at Spec via the principles-architect consult): copy-on-read snapshots scoped by the workspace. New immutable FileSnapshot(tree, source, version) record carries a ts_tree_copy clone (jtreesitter’s documented cross-thread mechanism) whose native lifetime is independent of the live file’s, so the eager previous.close() and in-place tree.edit() on the dispatch thread stay exactly as they were and cannot invalidate a reader’s clone; WorkspaceFile.snapshot() captures the triple under the Workspace lock (the same lock the mutators run under, giving the happens-before edge, so no volatile on the plain fields). FileSnapshot is a deliberately distinct type from WorkspaceFile with no shared read interface, so the compiler (not convention) enforces "safe to read off the dispatch thread" and a call site cannot rebind the mutable instance. Workspace exposes lambda-scoped accessors, not the snapshot’s lifetime: withView(uri, absent, present) snapshots one file (or short-circuits to absent), withAllViews(present) snapshots every open file under one lock acquisition into an ordered Map<String, FileSnapshot> so a composed cross-document WorkspaceEdit is computed against one consistent generation of the whole workspace; both close every clone (including partials taken before the lambda throws) in a finally, making leak-by-omission structurally impossible (jtreesitter registers no Cleaner, so an unclosed clone leaks native memory until process exit) and keeping the native lifecycle in the imperative shell. The live-file handout Workspace.get and the now-orphaned openUris are removed from the public surface; WorkspaceFile no longer escapes Workspace. All reader call sites migrate: the five async handlers wrap their supplyAsync bodies, publishDiagnosticsForRecalculate snapshots per drained URI, CodeActions.compute and IntraSchemaDefinitions.compute use withAllViews for a consistent cross-document generation, and feature compute() signatures switch from WorkspaceFile to FileSnapshot (accessor names match, so mechanical); the completion self-tear is fixed since one snapshot now feeds its position, directive, and value reads. FileSnapshot deliberately omits declaredTypes() / dependsOnDeclarations() (consumed only by Workspace’s own under-lock mutators, never off-thread). Coverage: `FileSnapshotConcurrencyTest is the named enforcer (plain JUnit in graphitron-lsp; the generator’s four-tier taxonomy does not cover LSP concurrency and these need no catalog) ; a snapshot stays walkable and pre-edit-consistent (text + version) after applyEdit and replaceContent eager-close the original tree, close is independent in both directions, and withAllViews pins one generation across a concurrent didChange; the existing handler/feature tests are the behaviour oracle for the mechanical migration. Tests mint snapshots through a package-local WorkspaceFileTestSupport bridge to the package-private snapshot(). Alternatives rejected: an immutable WorkspaceFile behind a volatile (needs a home for the reused incremental-parse Parser and refcounting/Cleaner for old-tree lifetime, more churn same result), and serialising requests against edits per document (holds the lock across slow feature computation, kills request concurrency). No user-visible surface (no protocol/goal/directive change), so no user-doc draft. Establishes the safety precondition for R347 Slice 5’s didClose close() (which must land on top of this, where closing the live tree cannot invalidate any snapshot); test 1 is the mechanical enforcer that keeps this true regardless of commit order. Independent-session In Review → Done review; full graphitron-lsp suite green (468 tests, 0 failures) under -Plocal-db.

R452 (723266d, Spec c175917, Ready 91310e7): Reject explicit @reference and same-table participants on multi-table interface/union child fields, closing a silent-wrong-data hole. A single-cardinality multi-table polymorphic child field whose join path was an explicit @reference (condition or multi-hop) or whose participant shared the parent table built green yet returned an arbitrary participant row per parent: MultiTablePolymorphicEmitter.branchParentFkWhere returned null for any non-single-hop-FK shape and the caller lowered null to "no WHERE", so every parent resolved the field to the same wrong data with no error at any tier (the batched list sibling failed loud on a blind cast, proving the single arm was the odd one out). The fix is a classification-time gate plus a type lift, both landing at the single choke point FieldBuilder.resolveChildPolymorphicJoinPaths (all four producers: interface/union × table-backed/record-backed parent). Rule 1a rejects any field-level @reference structurally (a single stated path applies the same hops to every participant, so it is terminal-correct for at most one and cannot express a distinct join per participant; author-correctable by removing the directive); rule 1b rejects a same-table participant as a Deferred capability (participant table equals parent/hub → parsePath skips FK discovery → empty path → no correlation derivable; a self-FK participant is a legitimate schema, not an author error); rule 1c wraps zero/multi-FK auto-discovery failures with multi-table-child context so fkCountMessage’s generic "add a `@reference`" steer no longer leads straight into rule 1a. Both deferred sites point at the follow-up capability item (`per-participant-multitable-child-join-paths, filed as R458). The type lift changes the per-participant carrier on ChildField.InterfaceField/UnionField from a raw Map<String, List<JoinStep>> to Map<String, ParticipantFkPath>, a new record carrying the resolved single-hop FK column-pair slots with a non-empty invariant enforced at construction: the classifier decides "supported shape" exactly once and the emitter cannot represent an unsupported one, retiring branchParentFkWhere’s `instanceof/null-for-unsupported arm and batchedBranchJoinPredicate’s `(On.ColumnPairs) JoinStep.Hop) path.get(0.on() blind cast (null survives only for the legitimate root-fetcher / participant-absent case). The single-hop-FK shape predicate is single-sourced (singleHopFkColumnPairs) across the multi-table arm and the single-table validateSingleHopFkJoin, and the stale stub-interface-union-fetchers.md pointer (R36 shipped) is dropped. Docs: polymorphic-types.adoc and multitableReference.adoc now state the rejection and point at the deferred capability. Coverage: new pipeline-tier MultiTableChildReferencePathRejectionPipelineTest (9 cases: condition/multi-hop/single-hop-{key:} @reference all reject identically by directive presence, union + record-backed-parent producer arms, same-table deferred rejection, zero-FK/multi-FK context wrappers, and the auto-discovered control carrying a non-empty ParticipantFkPath); TypeFetcherGeneratorTest fixtures migrated to the new carrier. Independent-session In Review → Done review; full reactor green under -Plocal-db -P!docs.

R453 (c529322, Spec e9cb78d): Reject sort-enum values that declare neither @order nor @index instead of silently skipping them. A partially-annotated sort enum bound to @orderBy built cleanly, contradicting the docs' promise of a per-value build failure (sort-results.adoc, order.adoc, orderBy.adoc all state a missing value "fails the build with a per-value diagnostic"); at runtime OrderByResolver continue`d past the unannotated value, and a request selecting only such values generated an empty ORDER BY, which on a paginated connection made keyset pagination slice a nondeterministic set (rows duplicate or vanish across pages). The rejection lands at the parse boundary in `OrderByResolver.resolveOrderByArgSpec: it accumulates every value lacking both directives while iterating the enum and, if the set is non-empty, returns a Resolved.Rejected after the loop, making the empty-ORDER-BY state unrepresentable in the model (namedOrders complete by construction). A new AuthorError.SortEnumMissingOrder(String enumTypeName, List<String> missingValues) arm carries the sort enum’s type name plus the full list of unannotated values (accumulate-all, not fail-fast, so the author sees every missing value at once; typed list rides for LSP fix-its rather than prose), following the RecordBindingMultiProducer shape for message() and prefixedWith. Per the Spec: the classifier’s anyMatch detection stays (detection vs completeness are distinct facts; a fully-unannotated enum never reaches the resolver and is already rejected as unclassified); no validator mirror (the parse-boundary rejection makes the bad state unrepresentable, and the model carries no full value list to re-derive); no generated-code guard (the resolver rejection is the single enforcer; emitted code carries no defensive guards for classifier-guaranteed shapes); and the annotated-value catalog-lookup fail-fast path is left untouched as a distinct failure class. No user-manual change (the docs already promise this exact failure; the change aligns code with the promise). Coverage: pipeline-tier GraphitronSchemaBuilderTest (partial annotation → build error naming the unannotated value; two unannotated values → single accumulate-all rejection listing both), plus drift guards RejectionSeverityCoverageTest (sample for the new arm) and SealedHierarchyDocCoverageTest (typed-rejection.adoc paragraph + drift-list mention); no generation-tier assertion (code-string assertions banned, the guard it would pin is dropped) and no execution-tier test (the nondeterministic state is now unbuildable). Sibling of R181 (validate-order-directive-args, the empty-@order / @order+@index-coexistence gap); the arm is named so R181 can fold into a shared order-directive family later. Independent-session In Review → Done review; full reactor green under -Plocal-db.

R449 (89746df, In Review dc70e62): Close the routine-chain classification edges surfaced by R435’s second-pass In Review review. Five design points, none gating R435’s shipped surface: (D1) gate the R435 root-chain interception on Query ; the interception read parentType instanceof RootType and routed root multi-node chains to classifyRootRoutineChain, so a @routine chain on Mutation landed a QueryRoutineTableField whose source() falsely asserts Root.Query; FieldBuilder.classifyField now reads the root position once (isRoot/isQueryRoot/isMutationRoot) and a Mutation @routine (multi-node in the interception, single-node from classifyMutationField’s top) lands a typed `Deferred signposting routine-mutation-write (R451’s write arm, a capability gap not an authoring error), while Subscription and non-routine Mutation chains fall through to their classifyRootField stories. (D2) fold @routine into both conflict detectors via a pairwise verdict table ; a sealed PairVerdict (Conflict | Deferred(planSlug) | Composes) that reduceDirectiveConflict projects over every unordered pair and reduces with Conflict-dominates-Deferred precedence, so @routine @lookupKey @service rejects the @service conflict rather than short-circuiting to the @routine×@lookupKey defer (the three-directive hole a slot-count carve-out would reintroduce); detectQueryFieldConflict is hoisted into classifyField before the interception and its old call inside classifyQueryField deleted (one detector site per position). (D4) repoint BuildContext.computeTerminalTargetVerdict’s `On.Lateral comment at FieldBuilder.routineChainVerdict (the SplitRowsMethodEmitter javadoc repairs stay R450’s scope). (D5) route the root routine fetcher (TypeFetcherGenerator) through the shared RoutineCallEmitter.emitCall via a new payload-free PreviousNodeRef.None arm and JoinPathEmitter.emitTableExpression, deleting the duplicated nonRoutineParamSource helper and inline ParamSource switch; QueryRoutineTableField’s compact constructor now pins every start binding to `ParamSource.Arg, making the None×SourceColumn arm genuinely classifier-unreachable (construction throws before any emit), and the consolidation is byte-identical (root correlated is false, so no DSL.val wrap). (D3) three text-only R435 rejection fixtures gain isInstanceOf arm assertions (DirectiveConflict for repeated @reference on ARGUMENT_DEFINITION; AuthorError.Structural for the input-field and element-less cases) plus a new fixture pinning the R300 single-node root desugar to hops = []. Coverage: 11 new pipeline-tier fixtures in GraphitronSchemaBuilderTest’s R435 block (D1 Mutation/Subscription landings, D2 conflict/defer/precedence verdicts across child + root single-node + root multi-node, the desugar pin); D4/D5 need no new tests (comments have no runtime surface; the consolidation is behaviour-identical under the existing R435 pipeline + execution suite, and the D5 constructor pin is exercised by every fixture that lands `QueryRoutineTableField); no code-string assertions on generated bodies. Independent-session In Review → Done review; full reactor green under -Plocal-db (503 GraphitronSchemaBuilderTest cases, 0 failures). Out of scope: the routine write arm itself (R451), R450’s SplitRowsMethodEmitter correlation rework, and lifting root position into a sealed RootType (a model-cleanup follow-up).

R446 (03dfe0b + c57fc57): Fix codegen crashing on array-typed database columns and reject array columns used as key elements. The R436 per-column TableRecord key reconstruction called ClassName.bestGuess(col.columnClass()) for every column in allColumns(), and for an array column jOOQ’s Field.getType().getName() is the JVM binary descriptor ([Ljava.lang.Boolean;), which bestGuess rejects, so any node type with an array-typed mapped column aborted graphitron:dev / generate with IllegalArgumentException: couldn’t make a guess for [Ljava.lang.Boolean;. Fixed at the grain: decide each column’s Java type once at the jOOQ reflection boundary and carry it as a TypeName columnType on ColumnRef / JooqCatalog.ColumnEntry, decoded via TypeName.get(col.getType()) (array-safe, mirroring RoutineParam) at the three reflection sites and threaded through every construction site; the 31 ClassName.bestGuess(<ref>.columnClass()) codegen sites read <ref>.columnType(). The raw columnClass string is left in binary form intact for the consumers that depend on it (EnumMappingResolver Class.forName, SourceRowDirectiveResolver Class.getName() compares, GraphitronSchemaValidator), so this is a dual-fact split, not a replacement. ClassName-typed locals and DomainReturnType.Plain widen to TypeName (safe: TypeName.equals/hashCode are toString()-based and a scalar column still decodes to a ClassName, so R204/R279 multi-producer agreement is unchanged for scalars and distinguishes arrays). A validate-time rejection is added for an array-typed column used as a @node NodeId key column (validateNodeType) or a DataLoader @splitQuery batch key (validateField over BatchKeyField.sourceKey().columns()), because Java arrays compare by reference identity and would silently mis-batch / mis-match at runtime; merely "not throwing" there would turn a build-time crash into a silent correctness bug. A test-only 3-/4-arg auxiliary constructor derives columnType from a source-form columnClass (shared scalar-only decode, null on placeholders, array columns can’t reach it) so ~161 hand-built fixtures stay unchanged; ColumnTypeConstructorArityGuardTest scans the main-source tree and fails the build if any production construction regresses to the string-decoding form. Coverage: unit-tier ArrayColumnTypeDecodeTest (boundary decode: ClassName for scalars, ArrayTypeName of the right element for boolean[]/text[], columnClass stays the binary descriptor), pipeline-tier ArrayColumnCodegenPipelineTest (regression pin over a new array_holder fixture through the TableRecord key-extraction path, verified to reproduce the crash when reverted), and ArrayKeyColumnRejectionValidationTest (@node array-key rejection + scalar control); no code-string assertions on generated bodies. Compilation/execution tiers not added via sakila-example (array columns aren’t surfaced there; emitted-form validity is pinned by the boundary-decode toString()), and the DataLoader batch-key rejection arm has no fixture (unconstructable: PostgreSQL disallows an array FK target). Bug fix, regression from R436; no user-facing surface. Independent-session In Review → Done review; full reactor green under -Plocal-db.

R435 (impl c0620e5..7a58239, In Review e288670): Order-significant @routine / @reference composition ; a jOOQ table-valued function is a table node (R333’s tableExpr RoutineCall) that can be a field’s row source, its projected terminus, or sit between tables in the join chain. Both directives become repeatable and their written order defines the table chain (implicit head → contributions → terminus, last node == the field’s @table); ReferenceElement gains no arm and @reference no new luggage, so composition is directive co-occurrence plus order, not a widened input (the rejected-alternatives log records why the @oneOf element arm, a slim path directive, @reference(from:), and a fixed-orientation rule were all turned down). Discharges R333’s deferred SDL-surface residue and its root-entry-validator residue (b). Model: on R438’s two-axis Hop(TableExpr target, On on) substrate, adds TableExpr.RoutineCall, the positive On.Lateral arm, On.Keying (ForeignKey | NameMatchedKey, the FK-less name-matched key for hops adjacent to a routine result), ParentCorrelation.OnLateralArgs, and a ParamSource.SourceColumn arm so a routine IN parameter has exactly one source shape (argMapping → Arg, columnMapping → SourceColumn, the correlated CROSS JOIN LATERAL case); every pre-existing sealed switch on On / ParentCorrelation gained an explicit arm and the root QueryRoutineTableField was re-homed onto the (start, hops) chain (R300 desugars to hops = []). Shipped end to end at root and child positions: correlated single-node (lateral), routine-then-hops, hops-then-routine, sandwich, and repeated-@reference composed chains, through one chain walker shared by root and child classifiers; inline correlated multiset and the @splitQuery batched keyed re-query on table-backed parents (batch key = the routine’s column-bound inputs). Typed classify-time rejections (root-head, terminus, columnMapping existence/type/one-source, repeated @reference off FIELD_DEFINITION, Connection-terminus, uncorrelated-@splitQuery) each carry a validator projection and a fixture; @orderBy / @condition / catalog-terminus-pagination / @lookupKey land typed Deferred. Coverage: pipeline fixtures per chain shape in GraphitronSchemaBuilderTest’s R435 block, execution-tier proofs on a `films_for_actor fixture function (RoutineFieldExecutionTest, per-parent correlation, mixed column/argument binding, batched-vs-inline row equivalence, hops projecting a film-only column so a mis-keyed hop cannot pass), and the full rejection-fixture set; no code-string assertions. routine.adoc / reference.adoc rewritten for the composition surface and order contract. Remaining fetch-form breadth (multi-routine chains, record-backed / TableInterfaceType parents, @lookupKey) re-homed to R447; ordering/binding/corpus residue to R448. Independent-session In Review → Done review; full reactor green under -Plocal-db (3802 tests). Builds on R333/R438; supersedes R300’s root-only @routine.

R445 (579ec14, In Review 39ecbb9): Resolve a participant cross-table @reference column read by the FK-pinned terminal TableRef (class identity), not a bare SQL name re-resolved through the catalog. Seventh audited site of the schema-qualified @table bug class (siblings R396, R440, R441, R442, R422, R444), found by R444’s spec-time audit. TypeBuilder.extractCrossTableFields held the FK-pinned fk.targetTable() (identity-carrying since R441) and the resolved interfaceTable, but re-resolved their bare tableName() strings through JooqCatalog’s string lookups, which return `TableResolution.Ambiguous when the FK terminal’s bare name collides across generated schemas: the column resolve came back empty and the field was silently skipped from the participant’s cross-table set, falling through to FieldBuilder’s scalar `@reference path where (post-R444) it misclassified as a plain ColumnReferenceField instead of ParticipantColumnReferenceField, so the interface fetcher emitted no conditional LEFT JOIN / alias projection and a participant field’s classification came to depend on whether an unrelated schema happened to hold a same-named table. No author-side workaround: the FK terminal is not author-named (the @reference key is TABLE__CONSTRAINT on the source table), and this path never routes through ServiceCatalog.resolveColumnForReference, so R444’s overload retirement could not catch it. Design (same as R440/R441/R422/R444, "decide once, carry the decision as a type"): consume the carried refs directly via R444’s TableRef.column(String) matcher and TableRef.allColumns(), retiring all four string-keyed catalog reads from the method ; R388 defect-2 guard predicate + base column set → interfaceTable.column / allColumns; detail-only candidate hint → fk.targetTable().allColumns(); column resolve → fk.targetTable().column(columnSqlName), dropping the manual ColumnEntry → ColumnRef conversion. extractCrossTableFields now holds zero string-keyed catalog reads, one resolution story instead of two. Behavioral deltas: a colliding FK terminal now yields a ParticipantColumnReferenceField (the fix), and the R388 rejection’s candidate hint is non-empty when the detail table collides; unknown columns still skip to the field-level classifier and the guard still fires on base-resident columns. Coverage: pipeline-tier QualifiedParticipantCrossTableReferencePipelineTest (sibling of R444’s QualifiedTerminalReferenceColumnPipelineTest and R422’s QualifiedReturnTypeReferencePipelineTest, over the existing multischema fixture, no new DDL) ; a cross-schema-colliding FK terminal classifies green as ParticipantColumnReferenceField with the resolved column asserted (not vacuous); a column present only on the other schema’s same-named table still rejects (schema-pinned, not search-all-schemas), its diagnostic naming the FK-pinned A-side candidates; a base-resident column trips the R388 contradiction guard with a now-non-empty detail-only candidate hint. Out of scope by design: ctx.parsePath’s path-start `tableName() echo (author-named and qualifiable per R396). Independent-session In Review → Done review; red-before-green verified (tests 1 and 3 fail with the fix reverted); full graphitron suite green (2489 tests) under -Plocal-db. Closes the audited no-workaround FK-terminal @reference sub-class (R444 scalar + R445 participant cross-table); does not claim the whole schema-qualified @table class closed ; the author-qualifiable bare-name reads (ServiceCatalog.resolveColumn, path-start echoes) remain by design.

R444 (e5f3944, In Review 3785229): Resolve a scalar @reference terminal column read by the FK-pinned terminal TableRef (class identity), not a bare SQL name re-resolved through the catalog. This was the sixth site of the schema-qualified @table bug class (siblings R396, R440, R441, R442, R422): despite R422’s changelog claiming the class closed, R422 only fixed the object-return-type terminal verdict; the scalar @reference column read was a separate unaudited path with the identical defect. ServiceCatalog.terminalTableSqlName walked the FK path and returned hop.targetTable().tableName(), collapsing the identity-resolved terminal TableRef (which R441 populated with a tableClass identity) to a bare name string; resolveColumnInTable then re-resolved it through JooqCatalog.findColumn(String, …), which hit TableResolution.Ambiguous when the terminal table name collides across generated schemas and demoted the field to UnclassifiedField with a spurious "column could not be resolved" author error and no author-side workaround (the @reference key names the FK on the source table, so there is no syntax to qualify the FK terminal). Design (same as R440/R441/R422, "decide once, carry the decision as a type"): replace terminalTableSqlName / terminalTableSqlNameForReference with the ref-carrying terminalTableForReference(List<JoinStep>, TableRef) (walk the path, terminal is the last hop’s targetTable(), empty path yields start, condition-only steps still bail to empty); retype resolveColumnForReference to take the start as TableRef and resolve the column off the terminal ref via new TableRef.column(String) ; the single model-side matcher home mirroring findColumn’s order (`javaName equalsIgnoreCase across all columns, then sqlName), never a bare-name catalog re-resolve. The scalar-output unknown-column diagnostic now enumerates the terminal TableRef.allColumns() java names (previously empty on a colliding terminal, ambiguity-broken too); the argument-filter (FieldBuilder) and input-field (BuildContext) sites pass their already-resolved TableRef. Behavioral deltas: a colliding terminal now resolves; condition-only paths, unknown columns, and empty paths keep today’s outcomes. Coverage: pipeline-tier QualifiedTerminalReferenceColumnPipelineTest (sibling of R422’s QualifiedReturnTypeReferencePipelineTest, over the existing multischema fixture, no new DDL) ; a @reference read on the cross-schema-colliding FK terminal classifies green as ChildField.ColumnReferenceField (with the resolved column asserted, not vacuous); a column present only on the other schema’s same-named table still rejects (schema-pinned, not search-all-schemas); a genuine unknown column rejects with a non-empty candidate list. Two adjacent bare-name reads stay out of scope by design: the direct non-@reference scalar read (source @table echo resolves qualified, author has a workaround) and the participant cross-table @reference path (a genuine seventh site, no workaround, tracked as R445, which consumes this item’s TableRef.column matcher). Independent-session In Review → Done review; full graphitron suite green (2526 tests) under -Plocal-db. Closes the FK-terminal @reference column-read sub-class (scalar output field, argument filter, input field); does not close the whole bug class (the participant cross-table path is R445).

R422 (6955bf6, In Review a1edbe0): Compare return-type identity in the @reference terminal-target verdict, not the verbatim @table echo. BuildContext.computeTerminalTargetVerdict decided whether an @reference path’s terminal hop lands on the field’s return-type table via TableRef.sameTable (a bare equalsIgnoreCase against the return type’s verbatim @table string), so a schema-qualified return @table (e.g. multischema_a.widget while the hop resolves to jOOQ’s unqualified canonical widget) spuriously reported Mismatch and demoted the field to UnclassifiedField. Last open member of the schema-qualified @table bug class after R396 (source-side FK predicate), R440 (FK-join endpoint/FK identity), R441 (landed TableRef.denotesSameTableAs), R442 (condition-param match). Chosen design (settled at Spec against a full parsePath String→identity migration): thread the already-resolved return-type TableRef into parsePath as its own nullable axis alongside the existing targetSqlTableName String ; name stays the input to the name-based plumbing (empty-path FK inference, condition-join terminal build), the ref is consumed only by the verdict, which now compares via R441’s TableRef.denotesSameTableAs (both sides catalog-constructed, so identity-vs-identity). The seven non-null-target call sites pass the ref they already hold one frame up (six in FieldBuilder, plus NodeIdLeafResolver which hoists its findTable above resolveFkJoinPath so ref and name pass together); the return-side null gate moves to returnTableRef == null and the Mismatch message keeps rendering the author’s verbatim echo. No R440-style resolve-or-fall-back contract (an unresolvable return name is unreachable here and re-resolving could reintroduce the bug on a bare cross-schema collision). Coverage: pipeline-tier QualifiedReturnTypeReferencePipelineTest (sibling of R396’s QualifiedSourceReferencePipelineTest over the multischema jOOQ fixture, no new DDL) ; the schema-qualified return @table classifies green as ChildField.TableField and the terminal hop genuinely lands on widget, paired with a genuine mismatch (return type bound to event, hop lands on widget) that still rejects to UnclassifiedField; no code-string assertions. TableRef.denotesSameTableAs already pinned by R441’s TableRefSameTablePredicateTest, no new predicate coverage. Independent-session In Review → Done review; full reactor green under -Plocal-db. Builds on R396/R441; closes the schema-qualified @table bug class.

R440 (d0bd8ca, Spec 6cfda86/426c586): Resolve FK-join synthesis endpoints and the FK itself by jOOQ class / reference identity, not bare SQL name. BuildContext.synthesizeFkJoin already held the jOOQ ForeignKey object (whose endpoint Table classes it pins exactly) but re-looked-up both endpoints and the FK by bare name, reintroducing the ambiguity R396 removed: two schemas sharing a bare table name yielded TableResolution.Ambiguous and the join failed, and a constraint name colliding across schemas silently returned the first-hit FK (a wrong-join hazard, not a rejection). Another member of the schema-qualified @table bug class (R396 done; R441/R442 the accessor and condition-param siblings landed just prior; R422 Backlog). Four moves, all "decide once, carry the decision as a type": (D1) new JooqCatalog.findForeignKeyRef(ForeignKey) resolves the Keys-class constant by reference identity in the FK-holder schema only (the FK-child endpoint class structurally pins the owning schema), the FK-singleton invariant its named enforcer; fkJavaConstantName retargeted onto the FK object; the false-docstring findForeignKeyByName deleted. (D2) synthesizeFkJoin resolves both endpoints via findTableByClass off the FK, so UnknownTable becomes a defensive-only arm (fires on catalog-vs-FK mismatch, never bare-name ambiguity); the fabricated-source test case retired in favour of upstream membership checks. (D3) the Optional-returning findForeignKey(String) (which could only collapse a collision into "not found") replaced by a scoped, sealed findForeignKey(name, sourceSqlName) returning ForeignKeyLookup (Resolved/NotInCatalog/Ambiguous); the three author-facing sites ({key:} path element, IdReference synthesis shim, explicit @reference(key:) record-FK) reject Ambiguous through a new ambiguousForeignKeyRejection structural builder naming the colliding schemas + qualified forms, while the non-author-facing qualifierForFk migrates keeping its Optional contract. (D4) findUniqueFkToTable returns Optional<ForeignKey> and NodeIdLeafResolver consumes the object directly, dropping the name round-trip that re-collided after findForeignKeysBetweenTables had already resolved by class. Fixture: a note table in both multischema schemas, each with an FK named note_event_fk into its own schema’s event, giving both a colliding bare target-table name and a colliding FK constraint name, plus seed rows for execution-tier reuse. Coverage: unit-tier JooqCatalogMultiSchemaTest D1-D4 cases (per-schema Keys-class ref resolution, endpoint-by-class from each side, scoped disambiguation, null-scope Ambiguous naming both schemas, structural-prose rejection) plus the {key:} membership enforcer parsePathElement_keyNotTouchingSource_rejectsBeforeSynthesis; findUniqueFkToTable directionality cases migrated to the FK-object shape in JooqCatalogIdRefTest; no code-string assertions on generated bodies. Resolver-tier wiring judged disproportionate (nodeid fixtures stay single-schema; the collision lives at the catalog/BuildContext tier), recorded in the item. ForeignKeyLookup is a JooqCatalog-local result type in the TableResolution/ForeignKeyResolution/RoutineResolution family, out of scope for VariantCoverageTest/SealedHierarchyDocCoverageTest; the ambiguous arm produces an existing Rejection.structural leaf, adding no typed-rejection.adoc obligation. Independent-session In Review → Done review; full reactor green under -Plocal-db. Builds on R396/R438; sibling of R441/R442/R422.

R442 (87d25a9, Spec b9c8cfa): Make the R379 Check-2 concrete-condition-param table match compare by jOOQ class identity, not a bare-vs-qualified name string. BuildContext.checkConcreteParamTable compared the parameter’s bare jOOQ table name (event) against the hop’s possibly schema-qualified @table echo (multischema_a.event) with equalsIgnoreCase, so in a multi-schema catalog a concrete @condition parameter typed with the correct generated table class was false-rejected (author’s only workaround: widen to Table<?>, discarding the type safety), and two same-named tables in different schemas were indistinguishable. Another member of the schema-qualified @table bug class (R396 done, R441 the accessor-side sibling landed just prior, R422/R440 Backlog); surfaced from gap D of the opptak multi-schema migration. Design shape 1 (chosen over re-resolving the string inside the check): thread the resolved TableRef`s down the validator chain instead of name strings. `validateConditionParamTables / checkConcreteParamTable now take TableRef source/target; the condition-hop site threads the hoisted conditionOrigin (null when the source is not table-backed, the existing skip) and r.target(), the where-filter site threads hop.originTable() / hop.targetTable(). The final compare is TableRef.denotesSameTableAs (the shared identity-body-with-name-fallback predicate R441 landed first and this item reused verbatim per the coordination note, dropping the predicate + consumer-audit scope), so a parameter typed with the right class classifies green even against a qualified echo and cross-schema collisions stay distinct; the mismatch message renders the declared side schema-qualified so a bare-name collision stays actionable. Coverage: pipeline-tier MultiSchemaConditionParamTest + MultiSchemaConditionStub over the colliding-event multischema fixture, covering source (terminal condition + where-filter) and target (terminal condition) operands, both green and by-identity wrong-schema rejection; the catalog-built wrong-schema cases double as the fallback-arm enforcer. Additive multischema_a.event_log DDL (jOOQ schema version bumped 2.4→2.5) backs the where-filter source shape. Test-plan deviation recorded in the item + landing commit: target-side coverage rides a terminal condition hop rather than the spec’s where-filter hop, because the where-filter FK-endpoint resolves event by bare name through synthesizeFkJoin (ambiguous across the two schemas), which is R440’s scope, not R442’s. Independent-session In Review → Done review; full graphitron suite green under -Plocal-db (2471 tests). Builds on R379; reuses R441’s predicate.

R441 (e0b878a implementation; Backlog → Spec 62d1222, Spec → Ready d5117fa, In Progress 9d3756c, In Review 2fdb708; independent-session In Review → Done review): Typed-accessor match on a free-form DTO payload parent now compares reified jOOQ table-class identity, not the bare @table name. Same multischema migration as R396/R422’s family (gap E of graphitron-qualified-names-gaps): once an element type’s @table is schema-qualified to disambiguate a cross-schema bare-name collision (multischema_a.event vs multischema_b.event), the verbatim @table echo never equalsIgnoreCase’d jOOQ’s always-unqualified canonical `event, so FieldBuilder.collectAccessorMatches silently dropped the accessor and the payload parent rejected with RecordTableField … requires a typed accessor or @sourceRow plus cascading WrapperArm errors transport failures on the sibling errors field. Fix routes the comparison through the identity already in hand: TableRef.denotesSameTableAs(TableRef) compares the carried tableClass (ClassName, structural equals) when both refs have one, falling back to the case-insensitive name compare only for fixture-built classless refs (catalog-constructed refs via JooqCatalog.TableEntry.toTableRef always populate it, so production always takes the identity arm); collectAccessorMatches threads the expected TableRef instead of its bare SQL name and filters via denotesSameTableAs, with the accessor side already resolved by record-class identity (ServiceCatalog.resolveTableByRecordClass) so the compare is identity-vs-identity. The predicate’s javadoc names the two identity homes (parse-boundary raw-Table<?> primitives on JooqCatalog per R396 vs. model-side reified ClassName here) so a future consumer picks by where it stands rather than growing a third mechanism. Upgrading the predicate body silently switched the four other consumers (TypeBuilder ×3, GraphitronSchemaValidator, FieldBuilder hop-origin) to identity comparison; each compares two same-catalog-derived refs, so any change of verdict is a cross-schema false-positive becoming correctly false (strictly tightening). Gap D stayed out of scope, filed as R442 which subsequently adopted the same predicate. Coverage: unit-tier TableRefSameTablePredicateTest pins all three arms (same class/divergent names → true; same bare name/different class → false, the silent-regression guard; classless fallback); pipeline-tier TypedAccessorSchemaQualifiedIdentityPipelineTest over the multischema fixture pins both directions (qualified echo classifies green as RecordTableField with accessor-derived source and schema-A tableClass; different-schema record dropped and field rejects), asserting classifier outcomes and sourceKey, no code-string assertions on generated bodies. TableNameComparisonCaseGuardTest untouched (identity route lives in the guard’s excluded PREDICATE_HOME). Full reactor green under -Plocal-db.

R438 (materialize-joinpath-facts; slices 3754f40 JoinConditionRef, 8106991 axes minted, 099aa30 producer/reader cutover, d3dafa3 flat-variant delete, b0ab513 self-review fixes; independent-session In Review → Done review): JoinStep reshaped onto R333’s two orthogonal axes ; Hop(TableExpr target, On on, originTable, JoinConditionRef filter, alias) with On.ColumnPairs | On.Predicate and the day-one TableExpr.Catalog arm; the flat FkJoin / ConditionJoin variants and the WithTarget capability deleted, slot iteration now the standalone HasSlots capability shared by On.ColumnPairs and the transitional LiftedHop (both retired by R431). Absorbed and closed R16. Generated output byte-identical per slice; gate review re-verified the full reactor green under -Plocal-db and fixed one stale WithTarget mention in emitter-conventions.adoc.

R16 (fkjoin-model-cleanup; absorbed and closed by R438’s slice 1 + cutover): the join-condition calling convention is now typed. JoinConditionRef wraps the MethodRef population called as method(srcAlias, tgtAlias) by JoinPathEmitter.emitTwoArgMethodCall, which takes the wrapper directly so call sites stop extracting raw MethodRef`s; handing a `WhereFilter-convention method to a join-condition emit site is a compile error. R16’s whereFilter naming complaint dissolved structurally in the R438 cutover: the ON-clause condition and the WHERE-appended filter became differently-named components (On.Predicate.condition vs JoinStep.Hop.filter) instead of one overloaded whereFilter.

R439 (d34ef37 implementation; filed 66dea39, Backlog → In Review ea67d6c at the user’s direction with the implementation pre-landed and validated in the originating session, the Spec/Ready flips recorded as mechanical passthrough; independent-session In Review → Done review): Background dev-environment warm-up for Claude Code Web sessions. The SessionStart hook (.claude/scripts/session-start-web-env.sh) now runs asynchronously in web sessions (CLAUDE_CODE_REMOTE=true): it emits {"async": true} so the session starts immediately, establishes the prerequisites (JDK 25 + alternatives/profile retarget, PostgreSQL rewrite_test drop/reseed, Maven settings de-proxy, libtree-sitter 0.26.9) in the background, then warms the whole reactor with mvn -B -ntp install -P 'local-db,!docs' -DskipTests, tracking state in /tmp/graphitron-web-env.status (prereqs/warm-build/done/failed + hook PID + epoch, with an EXIT/TERM/INT trap so a killed hook leaves failed, never a stuck running state) and logging to /tmp/graphitron-web-env.log. A new PreToolUse Bash guard (.claude/scripts/wait-for-web-env.sh, registered in .claude/settings.json with a 2700s timeout) extracts the command from the hook JSON and holds mvn commands through both phases and psql commands through the prereqs window, so a foreground build can never race the background one into the catalog-jar clobber; it fails open on a dead hook PID, a stale (>2400s) status, or an unparseable status file, and is also runnable by hand as a wait-with-log-tail. The JDK step additionally persists JAVA_HOME through $CLAUDE_ENV_FILE so agent shells stop inheriting a stale JAVA_HOME=java-21 past the enforcer. Local sessions keep the fully synchronous behavior and never create the status file. Dev-tooling only, no generator code affected; gate review re-verified the guard’s hold/release/fail-open matrix against synthetic status files and observed the live warm-up (async start, warm-build → done, BUILD SUCCESS, JDK 25 in the agent shell) in the reviewing session’s own sandbox.

R434 (3b38beb implementation; Spec → Ready ee39933, In Progress → In Review 3cac680; independent-session In Review → Done review): Restructured the rewrite design principles doc around axioms with named enforcement. rewrite-design-principles.adoc (28 flat peer sections, the type-system family stated five times, the central R222 thesis living only in a preamble pointer) is replaced by docs/architecture/explanation/development-principles.adoc: six axioms (decide once at the parse boundary / orthogonal facts are independent axes / one model many views / boundaries decode and encode / every invariant has an enforcer / generated code is a consumer artifact), each principle carrying rule + exemplar + smell + an Enforced by: line naming what fails when it breaks (compiler / named meta-test / build tier / the honest gap label "review only", which doubles as the meta-test gap list). The ingress states the FCIS + normalization spine and coins the drift smell once (R268 narrated solely under the enforcement axiom; field/model/format instances cite it). The Emitter Conventions catalogue extracted to docs/architecture/reference/emitter-conventions.adoc (plus a new cursor encode/decode section); the dunder-rule full semantics moved to GeneratedSourcesLintTest’s javadoc next to their enforcer; additive-then-cutover change discipline relocated to `roadmap/workflow.adoc. The doc budgets itself at 3,500 words (landed at 3,456), enforced by new DocSizeBudgetTest.developmentPrinciplesStaysUnderBudget. Citation sweep retargeted every live reference (docs xrefs with changed section anchors, javadoc, .claude prompts, CLAUDE.md, roadmap-tool boilerplate, live roadmap items); historical records keep the old name. Docs-only plus the budget meta-test; full reactor green under -Plocal-db. Builds on R433.

R433 (420cd32 implementation, d905fac rework 1, 2ba655a rework 2; Ready sign-off under the user’s in-session short-circuit, In Review → Ready gate 1 ad18fa5, In Review → Ready gate 2 aa6fe29): docs/architecture/explanation/rewrite-design-principles.adoc violated its own "Documentation names only live tests/code" rule by carrying unguarded live-inventory enumerations (arm lists, file censuses, occurrence counts, a dated compliance roster) that rot silently as the codebase moves, and canonized surfaces the R222/R333 pivot dissolves. New "Principles are stated at altitude" section codifies the discriminator: an inventory belongs in a principle only when a named live test pins it (the GeneratorCoverageTest-guarded dispatch partition is the kept exemplar); otherwise state the rule, one canonical exemplar, and the smell. Applied across SourceKey.Reader/Wrap arm enumerations, the four-axis SourceKey/LoaderRegistration census, two parse-boundary file censuses, the CallSiteExtraction strategy list, the candidateHint occurrence census, the helper-locality compliance roster, and the R50 retired-carrier roster; vision-alignment forward notes added pointing SourceKey at R431 and MethodBackedField at its R222 retirement (ServiceField as the current capability exemplar); stale ArgCallEmitter.buildNodeIdDecodeExtraction/R260 citation replaced (R260 shipped; R334 tracks the live instance). Two review rounds found and fixed residual rot the first pass missed: gate 1 caught a still-enumerated retired TextMapLookup permit (R229), an 11-of-12 module census, an unguarded "thirteen resolver siblings" count, and an over-inclusive java.lang.reflect-import discovery recipe (keyed onto Type-tree reads instead), plus same-family ride-alongs in code-generation-triggers.adoc, argument-resolution.adoc, typed-rejection.adoc, SealedHierarchyDocCoverageTest, and SourceKey.Reader’s javadoc; gate 2 caught a sentence-initial "Thirteen directive resolvers" in `typed-rejection.adoc that survived gate 1’s case-sensitive grep sweep, fixed with a case-insensitive re-sweep (zero remaining hits outside an unrelated PGThirteen test fixture). This is a docs-only item: no generated-output or runtime change; verification is the stale-reference check on every symbol/test/roadmap-id the revised doc names, plus a clean AsciiDoctor render. Full reactor green under -Plocal-db at each gate.

R436 (2992d25 implementation; Backlog → Spec 20b5072, Spec → Ready 97c0bb3, In Progress → In Review e263020): Fix unsafe into() key extraction colliding with multiset aliases and escaping error redaction. Two defects on a @service/@splitQuery split field over a @table parent whose DataLoader key wrap is SourceKey.Wrap.TableRecord. Defect 1: the key read did a whole-record env.getSource().into(Tables.X), mapping the parent row into the typed record by column name; a sibling multiset-backed object field aliased (.as(fieldName)) to a name case-insensitively shadowing a physical column (the incident: dager/tider over range columns; the sakila repro: Film.Length over FILM.LENGTH smallint) poisoned the conversion and threw a MappingException, aggravated by R426 widening the parent SELECT to the full row. Defect 2: that throw ran synchronously in the DataFetcher body before dispatch and the async .exceptionally router, so it escaped DataFetcher.get() unrouted and leaked jOOQ’s raw record-dumping message past ErrorRouter redaction (a privacy hole; per-node repetition blew the OTel gRPC 4 MiB export limit). Fix (Defect 1): the parent $fields projects the full row under reserved src_<col> aliases (GraphQL reserves leading- for introspection, so no client-driven sibling alias can collide) and GeneratorUtils.buildKeyExtraction’s `TableRecord arm rebuilds the typed record column by column with explicit types (no runtime Field<?> loop / unchecked cast). Both emit sites drive off a new generation-time TableRef.allColumns (populated in JooqCatalog), single-homing the projected names and the extraction’s lookup names so they cannot drift. RequiredProjection reshaped from a sealed { FullParentRow | Columns } sum to a product record (boolean reservedFullRow, List<ColumnRef> baseColumns) ; the reserved full row no longer supplies base-named columns that the Wrap.Row/Wrap.Record/TableMethodField reads still need, so the two axes are co-present and both emitted (R426’s absorbing "type fact" javadoc rewritten). A narrow build-time validator (GraphitronSchemaValidator.validateAliasKeyColumnCollisions + parentProjectionAlias, mirroring emitSelectionSwitch) rejects a sibling alias shadowing a key/correlation column read by base name (the residual the reserved-alias fix cannot cover), with field/column/remedy in the message; the broad whole-row collision is fixed not rejected, so legitimate schemas keep working. Fix (Defect 2): DataLoaderFetcherEmitter.build wraps extraction + dispatch + async tail in try/catch (Throwable) routing through the same asyncRouterCall disposition the .exceptionally arm uses (single-homed in TypeFetcherGenerator, threaded to both arms so they cannot diverge), lifted into a completed future; the R268 preRegistrationPrelude stays outside the guard by design. Coverage: execution-tier GraphQLQueryTest.films_titleTitlecase_withCollidingMultisetSibling_bothResolve_noMappingException (both fields resolve post-fix), pipeline-tier ServiceProjectionPipelineTest two-axis emit + AliasKeyColumnCollisionValidationTest (rejection + no-false-positive), unit-tier DataLoaderFetcherEmitterTest guard-shape (registration outside / extraction inside / catch-arm routes), R426 contract tests still green; no code-string assertions on generated bodies. Reserved src_* reaches generated code only as string literals, so the dunder lints need no allowlist entry (docs updated); handle-services.adoc extraction phrasing updated. Spec-permitted fallback taken on the execution-tier redaction test (no bespoke throwing-accessor fixture): the sync catch is unit-proven, shares one router-call definition with the async arm, and the async arm’s redaction is already execution-proven via Film.durabilityError. Independent-session In Review → Done review; full reactor green under -Plocal-db (all 13 modules incl. the graphitron-sakila-example execution + Java-17 compile tier). Builds on R426/R425/R415/R268.

R437 (f293803 implementation; Backlog → Spec 4119cf7, Spec → Ready d8c8653, Ready → In Progress 0fef51c, In Progress → In Review e41a4d8): Shape-aware create<Record> / create<Record>List @service helper dedup, fixing an R311/R315 silent-column-drop correctness bug. The jOOQ-TableRecord @service param helpers were deduplicated by record class alone (putIfAbsent(recordClass, …) at two collection sites, and both call-site namers derived from recordClass.simpleName()), so two @service fields on one type binding the same record through different input shapes (different @field column sets) collapsed to the first-seen helper; every call site routed to that survivor and the other mutation silently wrote its unique columns as NULL/default (found in fs-plattform’s `registrerCampusForUtdanningsmulighet vs deaktivereCampusForUtdanningsmulighet, where DATO_FRA was dropped to 1900-01-01). The fix re-keys dedup, naming, and call-site routing by the full binding shape (record class + ordered ColumnBinding`s + ordered `RecordKeyDecode`s): a new `JooqRecordHelperNames resolver dedups on the carrier’s own structural equals (D1 ; exactly "these two emit an identical helper body", so no parallel signature function can drift), names uncontended record classes with the bare create<Record> (byte-identical to pre-R437, no churn) and contended ones with canonicalRender-ordered 1-based ordinal suffixes plus a one-line column-naming javadoc (D2), and is built once from every jOOQ-record carrier on the <Type>Fetchers class (both coordinates) and stashed on TypeFetcherEmissionContext before any field body emits, so the helper drain and both call-site emitters (ArgCallEmitter child, ServiceMethodCallEmitter root incl. the list arm) resolve the same name by construction (D3); a populated resolver throws on an uncollected carrier rather than silently falling back to a bare name (routing-hole tripwire), while the default bare() resolver preserves today’s behaviour for schema-free/unit/out-of-band contexts. Accepted limitation: collapse compares bindings in producer order, so identical columns in different SDL declaration order would not collapse (a missed collapse, not a correctness bug). Coverage: pipeline-tier JooqRecordServiceParamPipelineTest R437 group ; contended-singular red regression (two distinct helpers, each fetcher routes to its own, exactly one sets RELEASE_YEAR), contended-list arm pinned separately, cross-input-type collapse to one bare helper (pins shape-keying over input-type-name keying), determinism across runs, and contended-vs-uncontended javadoc; the R311/R315/R322/R336 pins keep passing (36/36). Independent-session In Review → Done review; full reactor green under -Plocal-db incl. the graphitron-sakila-example Java-17 compile (no generated-output churn). Builds on R311/R315.

R410 (e7ae955 slice 1, 1fae7e9 slice 2, 55e04e3 slice 3, 6149cfe slice 4, a0e6950 slice 5, d77fd0c slice 6; review fixes in the In Review → Done commit range): graphitron:dev owns incremental compilation of generated sources. The dev loop now turns generated .java into .class in-process, into the graphitron-exclusive target/graphitron-classes (sole-writer dir, first-on-classpath precedence for consumers that load external .class; quarkus:dev empirically confirmed not to consume it, so the Quarkus value routes to the in-process MCP query-execution driver, filed as R428/R429). Composition: the idempotent writer reports its per-run delta (slice 1); CompileDependencyGraph is projected from the classified model through exhaustive switches over the GraphitronType/GraphitronField leaves mirroring projectFieldClassification, with frozen-vs-growing UtilSingleton classification so blanket over-approximation never harms pruning (slice 2); AbiSignature hashes the signature surface (constant values included for javac inlining; type variables with bounds added in review) and RecompileSet computes delta ∪ ABI-changed reverse-transitive dependents as pure functions (slice 3); a warm JavaCompiler/StandardJavaFileManager engine with per-round fresh tasks, orphan .class sweep, and a dedicated CompileDiagnostic channel kept separate from ValidationReport (slice 4); the two-clause acceptance harness (incremental tree byte-for-byte equals clean full compile; body-edit prunes / ABI-edit propagates) plus the TypeSpecReferenceWalk completeness oracle (slice 5); DevMojo wiring with -Dgraphitron.dev.compile=false opt-out, no fail-fast (exclusive dir degrades safely), conservative whole-tree recompile on consumer .class change, and compile diagnostics surfacing through the console block (CompileErrorFormatter) and the MCP diagnostics tool with a source: "schema"|"compile" discriminator (slice 6). Independent-session In Review → Done review landed four fixes: the completeness oracle widened with a @node type, which falsified missing node-lookup wiring edges (QueryNodeFetcher/EntityFetcherDispatch including the per-node-type types.<T> projection references and entitiesByType federation targets) ; closed model-sourced in the builder; failed compile rounds now carry a retry set so an unrelated save can never report clean while a stale last-good .class lingers; a first recompile with no ABI baseline (skipInitial) establishes the full image instead of a half-populated dir; AbiSignature gained type-variable/bounds coverage and DevMojo.lastGeneration became volatile (cross-watcher-thread visibility). The spec’s third diagnostics channel (LSP publish against generated-file URIs, best-effort) did not ship and is filed as R430. Residuals accepted per spec: no live graph-completeness guard (offline oracle only); generated→consumer invalidation is conservative whole-tree pending R333’s method graph, where the sourcing seam re-targets its live exhaustive switches. Full reactor green under -Plocal-db.

R426 (3931908 implementation; Backlog → Spec ccbaea5, Spec → Ready b774532, In Progress → In Review 0d01fc1): Project the full parent row for TableRecord-sourced @service children, honoring the already-documented contract of the typed-TableRecord source shape. A @service child whose Sources parameter is a typed TableRecord (Set<FilmRecord>, SourceKey.Wrap.TableRecord) receives keys via env.getSource().into(Tables.X), but the parent $fields SELECT projected only the client’s selection plus R425’s force-included key columns, so a service body reading a non-key column (FilmService.titleTitlecase’s `film.getTitle()) got a silent null whenever the client didn’t happen to select that column; the in-tree execution test passed only because its query selected title alongside, and the federation _entities shape (router selects just the service child) hit the failure in production form. The manual (handle-services.adoc) already promised "fully-populated parent records (every column on the parent table)", so the fix makes the codegen honor the written contract rather than rewriting it. Implementation folds R425’s key-column collection and the new full-row signal into one walk (TypeClassGenerator.collectRequiredProjection) returning a sealed RequiredProjection { FullParentRow | Columns } with an absorbing combine (FullParentRow dominates; "full row subsumes columns" is a type fact, not a dedup accident); build$FieldsMethod switches once, the full-row arm emitting a single Collections.addAll(fields, table.fields()) append that is alias-correct by construction (the caller’s table param carries base column names, the same names into(Tables.X) reads by). Gated on the key wrap (SourceKey.Wrap.TableRecord), not the sealed field variants, so any future BatchKeyField acquiring the wrap gets the right projection for free; sits after R425’s record-parent guard so only table-parent fields reach it. Coverage: pipeline-tier ServiceProjectionPipelineTest R426 group (full-row append for ServiceTableField and ServiceRecordField TableRecord-sourced children via the new TypeSpecAssertions.appendsFullParentRow helper, a Record1-sourced contrast sibling pinning the wrap gating, and a NestingField recursion case); execution-tier GraphQLQueryTest.films_titleTitlecase_withoutSelectingTitle_readsNonKeyColumnOffSourceRecord unmasks the in-tree reproducer ({ films { titleTitlecase } } with no title selected, red pre-fix); federation execution-tier FederationEntitiesDispatchTest.entities_tableRecordServiceChildOnly_nonKeyColumnReadResolvesNonNull (representations-driven fetch, non-key read). Docs: handle-services.adoc contract prose stated plainly, projection-cost note added, and the caveat paragraph’s false table-parent half reconciled. Known residual imprecision noted at review: the full-row append is unconditional in $fields (fires on every fetch of a parent type carrying such a child, selected or not), so the docs' "whenever the field is selected" cost framing understates the trigger; this matches R425’s unconditional force-include shape, and selection-gating the required projection is a possible future refinement. Builds on R425. Independent-session In Review → Done review; full reactor green under -Plocal-db.

R424 (7400c67 core, 1a855a4 rework; Backlog → Spec 889f6cb, Spec → Ready c205824, In Review → Ready rework 814e255, In Progress → In Review a5c485f): Route inline (non-@splitQuery) @reference field argument reads through the field’s own SelectedField instead of the ancestor fetcher’s env. Inside the generated <Type>.$fields(sel, table, env) method, env belongs to the top-level operation fetcher, so env.getArgument("filter") returned null, the filter condition collapsed to noCondition(), and the field silently returned unfiltered rows (data-correctness bug, discovered via an opptak-subgraph reproducer where a @nodeId filter on Studiekurv.kladder was ignored; the @splitQuery sibling behaved because its env genuinely is the field’s own). Fix threads a sealed ArgumentValueSource (Env | FromSelectedField(sfLocal)) through FkTargetConditionEmitter.emitTerm → ArgCallEmitter.buildCallArgs → buildArgExtraction; root/split sites pass Env (byte-identical output), the two inline emitters pass FromSelectedField(sfName) so runtime reads resolve sf.getArguments().get(name). Covers the filter-condition path, the inline first pagination limit, and the JooqConvert+list pre-lift (emitJooqConvertKeyLifts, added to both inline emitters by parity ; pre-R424 that inline shape emitted a reference to an undeclared <name>Keys local; the helper takes FromSelectedField directly since it has no Env caller). ContextArg stays env-based (request-scoped context is legitimately the ancestor env); never-inline arms (InputBean/JooqRecord) guard with IllegalStateException. The $fields host stamps @SuppressWarnings("unchecked") via the source-aware CallParam.emitsUncheckedCastFromSelectedField, keeping the Env hosts' warning-free output unchanged. Coverage: pipeline-tier InlineFilterArgumentSourcePipelineTest (source-aware suppression stamp incl. the top-level JooqConvert+list pin over the non-@node store → customer FK, scalar negative case, end-to-end generation; annotation/model assertions only), execution-tier GraphQLQueryTest against real PostgreSQL (Store.customersByFirstName{,Split} narrowing + inline/split parity, customersFirstN limit, and the decode-consuming CustomerByNodeIdFilter fixture where a foreign store’s node id narrows the inline child list to empty with a @splitQuery parity mirror); compilation tier via the sakila-example -Werror build. Independent-session In Review → Done review; full reactor green under -Plocal-db.

R425 (9c2c9ab implementation; Backlog → Spec 119bfb2, Spec → Ready 2969866, In Progress → In Review 70484cd): Force-include a @service/@splitQuery child’s SourceKey columns in the parent $fields projection so its DataLoader key is never silently null. A @splitQuery child builds its DataLoader key off the parent source record (Record) env.getSource(.into(<ParentTable>)), but the parent SELECT is driven purely by the client’s GraphQL selection set, so when the client selected the child without selecting a field mapping to the key column, the column was absent from the parent row, key extraction read null, and the child resolved to null with no error, biting hardest under federation where an Apollo Router _entities fetch supplies keys via representations without re-selecting them. Root cause was a pattern-match omission: TypeClassGenerator.collectRequiredProjectionColumns matched the two Split* arms (so split-@reference children were already covered) but let ServiceTableField/ServiceRecordField fall through to Stream.empty(). Fixed by collapsing the two Split* arms into a single BatchKeyField capability arm returning sourceKey().columns() (the capability-interface case per the capability-vs-sealed-switch principle; the enumeration already had a blind spot, its javadoc listed six implementers where seven exist). The three record-parent implementers (RecordTableField, RecordLookupTableField, RecordTableMethodField) are guarded with a loud IllegalStateException rather than routed: they key off a Java accessor via buildRecordParentKeyExtraction and can carry target-aligned columns, so a leak into the table-parent walk would silently project wrong columns, the same silent-null family this item fixes; the guard fails at generation time instead. One refinement beyond the literal spec: a null SourceKey (a @service method taking no Sources param, a plain per-parent delegation with no key read) contributes no columns rather than NPEing. Fold-ins: BatchKeyField javadoc gains the missing RecordTableMethodField; the two force-include taxonomy comments name the capability instead of enumerating Split*. Coverage: pipeline-tier ServiceProjectionPipelineTest (table-bound return ServiceTableField, scalar return ServiceRecordField, and a service child nested under a NestingField, each on a parent with no other force-projecting child, asserting TypeSpecAssertions.appendsRequiredColumn on the parent PK); execution-tier GraphQLQueryTest on a new unmasked City fixture (no @splitQuery/@tableMethod sibling, so the @service children are the only reason CITY_ID is projected) covering cityUppercase (Wrap.TableRecord, the silent-null shape) and cityLowercase (Wrap.Row, the loud-throw shape) queried without any key-mapped field, backed by the new CityService; federation execution-tier FederationEntitiesDispatchTest with a representations-driven _entities fetch selecting only the service child (the opptak reproducer shape, City promoted to a @key entity, FederationBuildSmokeTest’s `_Entity union pin updated); plus a note on the existing Film service-child tests that cast/castByKey mask this behaviour for Film. No code-string assertions on generated method bodies (pipeline tier uses the spec-named appendsRequiredColumn shape helper). Developer-side Wrap.TableRecord contract hazard filed separately as R426; distinct from R424 (child arguments read from the wrong env). Independent-session In Review → Done review; full reactor green under mvn install -Plocal-db.

R421 (fb4ca33 guard + tests + pom + seam; 8337c14 test references the seam’s FAULT_HEADER constant; 44fc1b0 move fault seam to a test @Alternative + pin the true single contract; Spec be489aa/514e2f0, Spec → Ready 9927eb8, In Progress → In Review 83d792a, spec wording correction 6ac9f29): Stop GraphqlResource.execute() in graphitron-jakarta-rest from leaking internals when the server-side execution path throws. The resource shaped every request error (400/405/422) into a spec-compliant application/graphql-response+json body but ran the consumer-implemented, auth-seeded application.newExecutionInput() SPI seam and engine.execute() unguarded; a fault there (observed: the seam forcing a JDBC connection with the DB down, a CreationException wrapping PSQLException) escaped past every spec-shaping branch into the container’s generic error handler, dumping the exception chain, stack, DB host/port, and internal package names as a non-spec response. Fixed with an ordered two-arm catch around both calls: catch (WebApplicationException) re-throws unredacted so a consumer signalling a client-facing 4xx from its adapter (e.g. ForbiddenException → 403) has JAX-RS map the intended status rather than collapsing it to a redacted 500 (arm order is load-bearing: WebApplicationException is a RuntimeException, so the broad arm would otherwise swallow it); catch (Exception) mints a UUID correlation id, logs the real cause server-side via SLF4J, and returns HTTP 500 (modern) / 200 (legacy) carrying the reference-only wire shape {errors:[{message:"An error occurred. Reference: <uuid>."}]} with no extensions, byte-identical to the message the generated ErrorRouter.redact emits (ErrorRouterClassGenerator line 481). This resource-level guard is the structural complement to ErrorRouter’s per-fetcher redaction: `newExecutionInput() runs before graphql-java execution begins, the one region neither ErrorRouter nor graphql-java’s own handling can see. The single-contract claim is the reference message, not byte-identity of the whole error object: the fetcher path builds through graphql-java’s GraphqlErrorBuilder which serialises a default extensions.classification, while the resource emits a plain {message} with no extensions, consistent with its own 400/422 errors; matching graphql-java’s classification from the resource was rejected (would contradict the no-extensions requirement and misclassify a pre-execution input-building fault as a data-fetching one). Vendor-neutral: the only dependency added to the module pom is org.slf4j:slf4j-api at provided scope (already version-pinned in the parent dependencyManagement); jakarta.ws.rs.WebApplicationException rides the existing provided jakarta.ws.rs-api, and no RESTEasy/Quarkus type is named. Testing lives in graphitron-sakila-example’s `GraphQLOverHttpConformanceTest (R399: the graphitron-jakarta-rest module carries no @Test classes of its own): four R421 cases (redacted 500 modern with no leaked internals, redacted 200 legacy, WebApplicationException → 403 passthrough, and redactionShapeMatchesFetcherPath pinning message-identity on both legs / no-extensions on the resource leg / classification-present-but-clean on the fetcher leg via the existing Film.durabilityError @service leaf). Fault injection is a test-scoped @Alternative @Priority bean, FaultInjectingGraphitronApplication, which subclasses the real adapter and throws on a sentinel X-Graphitron-Fault header while delegating every other request to super.newExecutionInput(), so execute() still drives the real seam wiring end-to-end and the shipped reference adapter (SakilaGraphitronApplication, a subgraph-author template) stays pristine. No code-string assertions on generated bodies. The trace-correlation follow-up (redaction reference id derived from an OTel trace_id via MDC, rather than a fresh UUID) was deliberately deferred to Backlog R423. Independent-session In Review → Done review; full reactor green under mvn install -Plocal-db (GraphQLOverHttpConformanceTest 15/15, 0 failures across the reactor).

R408 (352b05bc implementation, option A; In Progress → In Review 599cbc28, Spec → Ready a3564f2a): Give consumers a build-side lint-finding suppression mechanism, the suppression half of the configurability follow-on R398 deferred. A <lint> block on the Maven plugin config carries two axes with deliberately different scope: <disabledRules> names rule ids to silence everywhere, and <excludedTypes> names type-name globs ( any run, ? one char) to skip in the SDL lint engine’s AST walk. Option A (project config, whole-rule + type-name-pattern disable) was chosen at Ready sign-off over the node-local @lintDisable directive (option B, deferred until a consumer hits granularity a name pattern cannot express) and inline SDL comments (option C, rejected for fragile graphql-java comment-to-node anchoring). LintBinding collapses the POM block into a LintConfig(Set<String> disabledRuleIds, List<String> excludedTypePatterns) record on RewriteContext; LintConfig.validated types each disabled id against LintRule.ids() and fails the build (via MojoExecutionException) naming the offending id(s) and listing the valid namespace, so a typo is a build error not a silently-ignored line. Suppression is applied at the one build evaluator (GraphQLRewriteGenerator.withLintFindings), not in a Maven-log-only filter: the disabled-rule filter runs over the *combined BuildWarning list after classifier advisories (schema.warnings()) and engine findings are concatenated, so it keys on the typed rule id and covers both channels (a Source.CLASSIFIER advisory like splitquery-redundant-on-record-parent is suppressible by id like any engine rule); the type-name-glob filter runs inside LintEngine.run, widening the same per-type skip boundary the bundled-type and R407 federation-injected exclusions use, and stays scoped to the engine’s AST walk. That asymmetry is deliberate and pinned by test: the classifier advisories arrive pre-formed with no structured owning-type handle to glob against, so a classifier advisory on an excludedTypes-matched type still fires (reverse-mapping a location or scraping the type name out of message text is the fragile-anchor trap option C rejects). Because the LSP replays the ValidationReport and the MCP diagnostics tool projects it, and DevMojo builds its context through the same buildLintConfig seam, a suppressed finding never surfaces in CI, the editor squiggle, or the MCP tool, from one definition with no second filter. Non-goals held: no severity overrides / error-capable lint (everything stays a warning), no @lintDisable directive, no plugin SPI for new rules. Coverage: pipeline-tier LintSuppressionPipelineTest (5: disabled-rule drops that rule while others fire, excludedTypes skips the matching type but not siblings, glob match, classifier-advisory-by-id suppression, and the engine-scoped excludedTypes asymmetry), unit-tier LintConfigTest (unknown-id validation failure listing the valid namespace, both-axes build, empty config), and single-evaluator parity tests at the LSP tier (LintSuppressionDiagnosticsParityTest: a build-suppressed finding does not replay as a squiggle while a co-present rule still does) and MCP tier (same, through the live diagnostics tool); assertions key on the typed LintRule / lintRule wire field, no code-string assertions on generated bodies. User docs shipped to their real home (docs/manual/reference/mojo-configuration.adoc, the <lint> parameter row plus a "Silencing lint warnings" section). Independent-session In Review → Done review; full reactor green under mvn install -Plocal-db. Builds on R398 (build-is-single-evaluator spine, typed LintRule id); the "author chooses not to fix" sibling of R407’s "cannot fix" exclusion, landing at the same LintEngine.run boundary.

R396 (2509653 implementation; In Progress → In Review e79a746, site-6 Spec review 0aeb581, Spec revise 7082fa5, Backlog → Spec 5ff535b): Accept schema-qualified or case-mismatched @table(name:) base names on the @reference FK-connection-and-orientation path. A type declared @table(name: "multischema_a.signal") (or multischema_a.SIGNAL over the real lowercase name) could not attach an @reference(path: [{key: "<fk>"}]) field: the verbatim, case-preserved @table echo was compared by bare equalsIgnoreCase against jOOQ’s always-unqualified FK endpoint names, so the FK read as "does not connect" (Author error: key '<fk>' does not connect to table '<name>'), and where a partial fix let it through, the same bare compare in the orientation predicate silently mis-oriented the join (origin/target swapped, slot pairing inverted). Reported against 10.0.0-RC21 (opptak), the @reference sibling of R395. Fixed by identity comparison, not input sanitization: two new JooqCatalog primitives, foreignKeyTouchesTable (source-side membership, either endpoint) and foreignKeyOnSource (orientation; self-referential FKs fall to the caller’s selfRefHint), resolve the source through the schema-aware findTable and compare FK endpoints by jOOQ table class identity (endpoint.getClass() == resolvedSource.getClass()), falling back to the historical bare compare when the source is Ambiguous/NotInCatalog so the diagnostic surface for genuinely-unknown names is unchanged; class identity also distinguishes same-named tables across schemas, which a normalized bare-name compare cannot. All six spec-enumerated sites routed through the primitives: Phase 1 ({key:} path) parsePathElement connection check → foreignKeyTouchesTable; orientation decided once via foreignKeyOnSource in synthesizeFkJoin and threaded into resolveFkSlots as a precomputed boolean fkOnSource (signature change), so the FK-orientation predicate lives in exactly one place; resolveRecordFkTargetColumns (site 5) uses the primitive for both its implicit-inference directional filter and slot orientation. Phase 2 ({table:} + empty inference) findForeignKeysBetweenTables resolves each argument to class identity; findUniqueFkToTable (site 4) and qualifierForFk (site 6, the synthesis-shim path whose bare re-filter turned a qualified-@table input type into a hard IllegalStateException) re-filter through foreignKeyOnSource. One documented deviation, endorsed on review: site 6 uses foreignKeyOnSource(…, selfRefHint=true) rather than the spec’s suggested foreignKeyTouchesTable, preserving the method’s strictly source-side semantics and the existing qualifierForFk_wrongSourceTable_returnsEmpty test. The verbatim echo stays the source name everywhere, so author-error diagnostics still quote what the user wrote; only the comparison changed. Phase 3 (qualified return-type terminal verdict via TableRef.sameTable) split out to R422 per the spec’s own scope recommendation. Coverage: unit-tier JooqCatalogMultiSchemaTest (both primitives over signal_widget_id_fkey with qualified and upper-case sources, referenced-side/non-endpoint/cross-schema-same-name cases, qualified-both-args findForeignKeysBetweenTables, and a synthesizeFkJoin qualified-source orientation guard pinning origin=signal/target=widget and slot orientation); pipeline-tier QualifiedSourceReferencePipelineTest (all three @reference forms plus the qualified-and-upper-case spelling classify to a correctly-oriented FkJoin, no author error); execution-tier MultiSchemaQueryTest with the R395 fixture tightened from @table(name: "signal") to its originally-specified @table(name: "multischema_a.SIGNAL"), rows still routing to the discriminated types and AlertSignal.widgetName populating through the now-validated cross-table @reference, with R395’s discriminator-qualifier coverage preserved (FROM still renders "multischema_a"."signal"). Known residual, non-blocking: foreignKeysTouchingTable (candidate-hint scoping on the error path) keeps the bare compare, thinning the "did you mean" list for a qualified source without affecting any verdict. Builds on R395 (dependency honored: R395 Done at f6cc9ae before R396 entered In Progress at 3518bb9); spawns R422. Independent-session In Review → Done review; full reactor green under mvn install -Plocal-db (unit 55, pipeline 4, execution 4 in the touched suites; 0 failures across the reactor).

R418 (8213374 implementation; In Progress → In Review 2eb9752, Spec → Ready 8d80d72, Backlog → Spec 440b207, Backlog 146d334): Make the web-sandbox SessionStart hook drop-and-recreate rewrite_test on every start, so the fixture DB is a pure function of the checked-out init.sql. Step 2 of .claude/scripts/session-start-web-env.sh previously created + seeded rewrite_test only when the database was absent; a sandbox first seeded from an older init.sql (e.g. one predating R389’s party_* joined-table fixtures + the jti_* composite PKs) kept that stale schema forever, and -Plocal-db jOOQ codegen then built its catalog against the stale DB, cascading into the UnclassifiedType/UnclassifiedField failures (Query.allParties, JoinedTableInheritancePipelineTest, and siblings) that every recent Done review documented as a manual re-seed. The existence guard is replaced by an unconditional DROP DATABASE IF EXISTS rewrite_test WITH (FORCE) (PG13+, cluster is PG16, so a lingering backend from a prior session cannot block the drop) + CREATE DATABASE + reseed, still inside the unchanged pg_ctlcluster/pg_isready gate so local dev (TestContainers, no persistent rewrite_test) stays a no-op; the password-reset line and its pg_was_running guard are untouched, and no checksum/skip optimization is added (sub-second reseed, and a skip-guard would reintroduce the staleness window). .claude/web-environment.md updated: the "Brings up PostgreSQL" step-2 bullet now states the drop/recreate/reseed-every-session behavior, and the Catalog-jar clobber section gains a note that a stale sandbox DB was a second, now-eliminated cause of the same cascade so a future reader does not misfile a DB-staleness failure as a catalog-jar clobber. Web-sandbox tooling only, no reactor/generator/test or init.sql change; the R389 jooq.codegen.schema.version bump is orthogonal and untouched. Verification is manual shell testing (spec § Verification): bash -n parses; the hook run against the live PG16 cluster fully replaces a stale DB (party present, 3 rows; a planted stale marker gone), force-terminates a lingering backend, and two back-to-back runs both succeed. Independent-session In Review → Done review; on the reviewer sandbox the reseeded catalog resolved the party corpus (JoinedTableInheritancePipelineTest 5/5, VariantCoverageTest 3/3 green under -Plocal-db). This item is the standing fix R413/R414/R384/R415/R407/R182 named for the recurring stale-rewrite_test review artifact.

R413 (0d4a2d3 implementation; In Progress → In Review 93e57a0, Spec → Ready d4f7401, Backlog → Spec dc18b15): Bind the parent-input VALUES cells of split/reference DataLoader rows methods through the key column’s jOOQ Converter DataType. The rows methods built each parent-key cell straight from the raw key Field (typed by ColumnRef.columnClass(), the converted user type), so a converter-backed or domain-typed key column rendered at the wrong SQL type and the correlation JOIN had no matching operator; against the utdanningsregisteret consumer schema, Campus.ORGANISASJONSKODE (kodeverk.kode_numerisk_domain over BIGINT with a Converter<Long, String>) bound as character varying and every @splitQuery/@reference child nulled out with operator does not exist: kodeverk.kode_numerisk_domain = character varying, invisible on the plain-typed Sakila keys. Fixed at the VALUES-emission seam (the one choke point every key passes through), not at key construction: all four parent-input sites, SplitRowsMethodEmitter.emitParentInputAndFkChain (list/single/connection prelude) + emitFromBridgeAndParentJoin, emitRecordTableMethodBody (@tableMethod variant), buildServiceTableLift (R285 lift-back re-projection), and MultiTablePolymorphicEmitter.buildParentInputValuesEmitter + per-branch ON lookups, now route their cells through ValuesJoinRowBuilder.cellsCode (extended with a constants-class-table-expression variant, making its single-VALUES-cell-authority javadoc claim true), emitting DSL.val(<scalar>, Tables.<OWNER>.<COL>.getDataType()) so jOOQ binds through the registered Converter at the DB type (coerce and cast were verified against jOOQ 3.20.11 and rejected in the Spec). The scalar extraction forks on SourceKey.Wrap, the axis that actually decides value accessors (replacing the coupled reader() instanceof AccessorCall fork): RecordN keys read k.valueN(); RowN keys recover the value from the bind Param via a new per-fetcher-class parentKeyCellValue helper with a loud statement-body throw, the documented contract for @sourceRow lifter keys (unenforceable at validate time, so pinned live at the execution tier). The owner table is a model fact: ParentCorrelation.parentKeyOwnerTable() folds the three-arm fork once (FkJoin origin / LiftedHop target / ConditionJoin parent); the polymorphic arm’s owner (the parent/hub table) rides InterfaceField/UnionField as a non-null parentKeyOwnerTable component threaded from the resolution sites. JOIN-predicate parentInput.field(…​) lookups switch to the owner column’s DataType for symmetric type metadata; RowN/RecordN generic type-args stay columnClass()-typed (the converter’s user type IS the Java-side type). Fixtures pin end-to-end: org_code_domain (BIGINT) + converter_org/converter_campus in the fixture DB (schema version 2.3→2.4), OrgCodeStringConverter in graphitron-fixtures-codegen registered via <forcedTypes>, and sakila-example execution tests covering single-cardinality @splitQuery (the reported Campus.organisasjon shape), list-cardinality @splitQuery, and a @sourceRow lifter over the converter-backed key (the live parentKeyCellValue Param-contract pin); existing unit expectations updated in place, no new body-substring assertions. Independent-session In Review → Done review; full reactor green under mvn clean install -Plocal-db (2419 core tests + sakila-example compilation/execution tiers, GraphQLQueryTest 297 tests, 0 failures) after re-seeding a stale local rewrite_test DB (missing the R389 party fixtures and R413’s own converter_* tables), the same Query.allParties / JoinedTableInheritancePipelineTest stale-DB artifact every recent Done review documents (standing fix: R418), on paths R413 does not touch.

R414 (f106d52 implementation; In Progress → In Review ae9226b, Spec → Ready c0b4ff7, Backlog → Spec 6ea032b): Serve a real per-parent totalCount on split/DataLoader-backed connections, closing the last classification path that produced null-(table, condition) ConnectionResult carriers on reachable queries. A nested (non-root) @splitQuery connection advertised totalCount: Int in the emitted SDL but always resolved it to null: the scatter path (SplitRowsMethodEmitter.scatterConnectionByIdx) built each per-parent ConnectionResult through the (result, page) convenience constructor, which passed null for the (table, condition) pair the generated ConnectionHelper.totalCount needs to issue its SELECT count(). The fix mirrors the B4c-2 polymorphic-batched semantics (MultiTablePolymorphicEmitter.buildBatchedConnectionRowsMethod): the rows method hoists its WHERE into a single Condition where local (buildWhereCondition called exactly once, since it declares FK-target alias locals as a side effect) shared by the windowed page query and a new cursor-independent countSource derived table (same join topology via emitFromBridgeAndParentJoin, no orderBy/seek so the count is window-independent); scatterConnectionByIdx gains a Table<?> countSource parameter and binds each per-parent carrier via the 4-arg ConnectionResult constructor with countSource.field("idx", Integer.class).eq(DSL.inline(i)), so ConnectionHelper.totalCount runs SELECT count() FROM countSource WHERE idx = i lazily on selection (zero count SQL when unselected, N counts for a batch of N parents when selected). The now-dead two-arg (result, page) ConnectionResult constructor is removed (scatterConnectionByIdx was its only caller; this is generated-into-consumer source, not published API); the nullable (table, condition) field shape and the if (cr.table() == null || cr.condition() == null) return null guard stay for the one validator-unreachable producer that remains, MultiTablePolymorphicEmitter.buildRootConnectionFetcher’s defensive empty-participants `new ConnectionResult(List.of(), page, null, null), and the three "Split-Connection scatter passes null" comments are re-pointed to name that remaining producer rather than narrowed to non-null. Sakila’s ActorsConnection (shared by Film.actorsConnection + Film.actorsOrderedConnection, both @splitQuery) gains totalCount: Int. True B4c-2 structural unification (a shared materialised pre-window derived table feeding both the ranked window and the count) is a deliberate non-goal: the split page query’s .orderBy(page.effectiveOrderBy()).seek() reference live terminal-alias columns, and re-pointing them at derived-table fields would rework well-tested pagination for no user-visible gain; the dual topology emission shares one emitFromBridgeAndParentJoin helper and the single hoisted where, so drift risk is low (possible follow-up if it ever drifts). Coverage: execution-tier GraphQLQueryTest (splitQueryConnection_totalCount_isParentScoped counts 2/2/1/1/1 for films 1-5 against the seeded film_actor rows with first: 1 to distinguish the count from the page size; isCursorIndependent still reports 2 paging past an after cursor; _isLazyOnSelection asserts no select count SQL when unselected and exactly N per-parent count statements when selected) and pipeline-tier SplitTableFieldPipelineTest (structural: scatterConnectionByIdx carries the Table<?> countSource parameter), no code-string assertions on generated method bodies. Mirrors B4c-2’s count semantics; per-parent totalCount for hypothetical future split shapes (SplitLookupTableField has no connection arm today) stays out of scope. Independent-session In Review → Done review; full reactor green under mvn install -Plocal-db (2418 core tests + the sakila-example compilation/execution tiers, 0 failures). The graphitron-core red first seen in the review sandbox (Query.allParties → UnclassifiedField; JoinedTableInheritancePipelineTest ClassCast on the R389 party/jti* fixtures) was the known stale-rewrite_test-DB artifact every recent Done review documents, the local DB predating the R389 fixtures and jOOQ’s schemaVersionProvider suppressing catalog regeneration; re-seeding from init.sql + a clean catalog regen produced a fully green reactor including R414’s execution tier, on paths R414 does not touch (the R418 always-reseed hook is the standing fix).

R384 (60b58ae phase 0 plumbing, 6021bda phase a JooqConvert, fb1b2e4 phase b NodeIdDecodeKeys, feadbcb phase c developer @condition, 24b2527 In Progress → In Review; Spec → Ready re-review bd2e761): Lift the remaining filter-argument kinds onto multitable interface/union root query fields, completing the arc R363 (branch-safe Direct/EnumValueOf/ContextArg) and R383 (nested-input @field) opened. Where R383 needed zero new plumbing, these three kinds share it, so the work is one multi-phase item over a single seam: phase 0 widens MultiTablePolymorphicEmitter’s root entry points to carry the enclosing `<Type>Fetchers class’s CompositeDecodeHelperRegistry and pre-declares (as statements ahead of the inline stage-1 union) the locals branch filter terms cannot introduce themselves, FK-target join-hop aliases (FkTargetConditionEmitter.declareAliases per participant, namespaced by the stage1_<Type> base), deduped <name>Keys locals for JooqConvert-list args, and shared lifted-outer Map locals, replacing branchFilterWhere’s former `emitTerm(…​, null, null, Map.of()) with the threaded values (behaviorally inert, proving the seam before any arm flips). Phase a flips the JooqConvert arm branch-safe and, per R267 (fix a deprecation-for-removal at the source, never suppress), replaces the deprecated-for-removal DataType.convert(Object) in ArgCallEmitter’s shared arm with the non-deprecated `DSL.val(raw, col.getDataType()).getValue() coercion (the design-principles §"Column value binding" idiom, .equals-identical to the deprecated form on a converted domain type, verified against jOOQ 3.20.11), correcting the single-table path in the same change; it also aligns the nested @field leaf with top-level conversion semantics (an ID-typed nested @field over a plain column now carries a JooqConvert leaf instead of the hardcoded Direct) and carves JooqConvert leaves out of CallParam.emitsUncheckedCast (the instanceof List<?> guard casts nothing). Phase b flips NodeIdDecodeKeys branch-safe, homing the drained decode helpers on the <Type>Fetchers class hosting the branch call site (a documented revision of the Ready text’s per-participant-composer wording, which put wire-decode machinery on the env-free pure-function composer and was not implementable; the per-class collectInto bracket is the true single-table precedent). Phase c removes the R363 field/arg-level hasCondition pre-guard and relaxes firstUnsupportedFilterArg’s first guard so developer `@condition filters (ConditionFilter/FkTargetConditionFilter) gate uniformly on their per-param extractions; the developer method reflects once per participant and runs against each branch’s stage-1 alias, a Table<?> first parameter serving every branch while a concrete-table parameter surfaces a mismatch at consumer javac (R379 semantics). The exhaustive nine-permit isBranchSafeExtraction switch stays the forcing function: NodeIdDecodeRecord/InputBean/JooqRecord remain explicit false arms (mutation-input/record-decode shapes that do not occur as a multitable root-query filter arg). Coverage: pipeline-tier MultiTableFilterLoweringTest (each kind’s rejection test flips to a lowered per-participant assertion on the model, JooqConvert/NodeIdDecodeKeys extraction, nested-leaf alignment, three @condition cases including nested-input) and execution-tier MultiTableFilterExecutionTest over the AddressOccupant = Customer | Staff union (occupantsByStoreId per-branch coercion, occupantsByAddress decode-and-filter plus a wrong-type-id client-error, occupantsStartingWithM/occupantsByNamePrefix/OccupantFilter.namePrefix via the new Table<?>-generic MultiTableConditionFixtures), with graphitron-sakila-example’s `-Xlint:all -Werror compile the pin that phase a stays off the deprecated form; no code-string assertions on generated bodies. Independent-session In Review → Done review; full reactor green under mvn clean install -Plocal-db (0 failures) after re-seeding a stale local rewrite_test DB (missing the R389 party fixture) and regenerating the jOOQ catalog, the same Query.allParties / JoinedTableInheritancePipelineTest stale-DB artifact earlier Done reviews noted, on paths R384 does not touch. Builds on R363 / R383; pins jOOQ coercion with R267 / R379.

R415 (4be03d6; Spec → Ready 197307d, Backlog → Spec 51503c5): Clamp connection first/last at the single runtime choke point and unify the no-channel error disposition. A negative first/last on a connection field flowed unvalidated into the SQL LIMIT, so PostgreSQL threw LIMIT must not be negative, which the framework redacted into an opaque correlation-id 500 instead of a client-facing validation error; first: 2147483647 produced the identical redacted 500 via limit = pageSize + 1 wrapping to Integer.MIN_VALUE. Fixed in the emitted ConnectionHelper.pageRequest (the one choke point every connection flavour funnels through): three guards next to the existing mutual-exclusion check, all throwing the R378 client-error marker GraphitronClientException so the real message reaches the client, negative first, negative last, and the derived-limit overflow (pageSize == Integer.MAX_VALUE, guarding the value PostgreSQL actually enforces rather than each input, which also covers a pathological defaultPageSize); the pre-existing mutual-exclusion IllegalArgumentException("first and last must not both be specified") migrated onto the same marker (same client-mistake family, same redaction defect). first: 0 stays valid. The purity note reworded to the load-bearing property (pageRequest takes no DataFetchingEnvironment; the marker subclasses GraphqlErrorException, so "no graphql-java dependency" was never the true invariant) at both ConnectionHelperClassGenerator and TypeFetcherGenerator:4792. Second defect, drift R378 introduced: the no-channel disposition is one decision at four emit sites across two emitters, and R378 flipped only the two sync catch arms to surfaceClientErrorOrRedact while leaving the two async .exceptionally arms on plain redact, so a client error on a nested (DataLoader-based) @splitQuery connection would still redact. Lifted the router call into one shared definition ErrorRouterClassGenerator.noChannelRouterCall(outputPackage, throwableVar) consulted by all no-channel sites, both noChannelCatchArm`s, both `asyncWrapTail no-channel branches, and ChannelCatchArmEmitter (a fifth site already on the right disposition); the two async arms flip to surfaceClientErrorOrRedact, whose cause-chain walk unwraps the CompletionException DataLoader wraps around a batch-function throw, so the marker surfaces while everything else keeps redacting (blast radius bounded to the marker type). The next disposition change is now one edit, not a four-site hand-coordination. Prose that named the old behaviour fixed in the same pass (TypeFetcherGenerator:6303/:6498, MultiTablePolymorphicEmitter:2006). Coverage: execution-tier GraphQLQueryTest (filmsConnection negative first/last surface the argument-naming message and never contain An error occurred. Reference:, first: 2147483647 surfaces the overflow message, first: 0 returns an empty page with a computable hasNextPage, the migrated collision message, and the load-bearing filmById(…​) { actorsConnection(first: -1) } proving the async-arm flip end-to-end through the DataLoader CompletionException unwrap, which a root-connection test alone would pass without the flip), unit-tier ErrorRouterClassGeneratorTest.noChannelRouterCall_emitsSurfaceClientErrorOrRedact, and updated TypeFetcherGeneratorTest arm pins. Out of scope, filed nowhere yet: malformed after/before cursor redaction (same family, different surface) and a configurable maximum page size (a DoS policy cap, distinct from this correctness-only overflow guard). Builds on R378. Independent-session In Review → Done review; full reactor green under mvn install -Plocal-db (GraphQLQueryTest 294 tests, 0 failures) after re-seeding a stale local rewrite_test DB (missing the R389 party + jti_* joined-table fixtures) and a clean jOOQ catalog regen, the same Query.allParties / JoinedTableInheritancePipelineTest stale-DB artifact the R416/R407/R182 Done reviews documented, on paths R415 does not touch.

R416 (71f5429 In Progress → In Review implementation; d58ae37 Dependabot #504/#506 closure record; d893673 self-review charset-tolerant asset content-type assertions; Spec → Ready 943884f, Backlog → Spec 9ad3ff1, Backlog c3623f2): Self-host the GraphiQL playground assets in graphitron-jakarta-rest, retiring the runtime unpkg CDN. The playground page (GET /graphql, Accept: text/html) previously loaded React + GraphiQL from unpkg at latest (unpinned, so it silently tracked upstream) and was dead behind a strict CSP or on an air-gapped network, unacceptable for "the first hand-written runtime artifact consumers depend on" serving Sikt’s gov/edu consumers. Now a version-pinned GraphiQL 5 + React bundle (graphiql@5.2.2, react@18.3.1, graphql@16.13.2, @graphiql/toolkit@0.11.3, built with vite@6.4.2 / @vitejs/plugin-react@4.7.0) ships as plain classpath resources under no/sikt/graphitron/jakarta/rest/graphiql/ and is streamed by a new path-traversal-safe @GET assets/{name} method on GraphqlResource (a [A-Za-z0-9.-]+ allowlist + explicit .. reject + extension→MIME gate over js/css/map/ttf/woff/woff2/svg, all behind the existing graphiqlEnabled() seam). Vendor-neutral by design: getResourceAsStream, not META-INF/resources/ (which only serves on Quarkus, contradicting the module’s Jakarta-EE-neutral ethos). graphiql() gained @Context UriInfo and rewrites a {{ASSET_BASE}} placeholder to the absolute per-request …​/graphql/assets/ prefix, so the entry files resolve at any mount point (/graphql, /api/graphql, …​) while every code-split chunk/worker/codicon-font resolves relative to them via the bundle’s base: './'. The Vite recipe was git mv’d from the (now GraphiQL-free) `graphitron-sakila-example into graphitron-jakarta-rest/tools/graphiql-build/ as a one-shot commit-the-output recipe: no <build> binding, so the reactor’s "CI never touches node" property holds; the committed bundle is the artifact, the recipe the reproducibility receipt. Deviations from the plan, all documented and justified: a JS-entry Vite build (GraphiQL 5 is a monaco bundler SPA, not the old UMD global-script shape) rather than the literal "swap four URLs"; staying on vite 6 / plugin-react 4 rather than #506’s vite 8 / plugin-react 6 majors (plugin-react 6 drops Babel for Oxc, a larger change with no benefit here); the MIME map extended past the plan’s js/css/map to cover monaco’s codicon .ttf and fonts; the broader R399 app-section README drift (dead GraphqlEngine/GraphqlResource/AppContext links) split out as follow-up R417 rather than expanded into scope. The companion/opt-in -graphiql artifact (the architect’s leanness-preserving "option C") was consciously deferred: the consumer set is small and known, so the bundle weight is accepted in the core jar now, with option C the escape hatch if a real consumer is pinched. Docs reconciled across every GraphiQL surface (the graphiql.html rationale comment, the relocated recipe README, modules.adoc, both tutorial pages, the sakila-example README’s GraphiQL entries); Dependabot #504 (linkify-it) and #506 (vite/plugin-react) closed as superseded, each pointing at R416. Coverage per R399 (jakarta-rest carries no @Test classes): graphitron-sakila-example’s `GraphqlResourceSmokeTest gained six page + asset conformance checks (self-hosted page has the mount div, no unpkg.com, and a resolved …​/graphql/assets/ base; the entry graphiql.js/graphiql.css stream with the right content-type; missing and unknown-extension names 404). Independent-session In Review → Done review; full reactor green under mvn clean install -Plocal-db (2416 core tests + the sakila-example compilation/execution tiers, GraphqlResourceSmokeTest 6/6, 0 failures). The graphitron-core red the implementer reported as "pre-existing trunk breakage" (Query.allParties → UnclassifiedField, JoinedTableInheritancePipelineTest, and the Person/AppAccount joined-table schema-validation failures in sakila-example generation) was in fact the known stale-rewrite_test-DB artifact the R407 and R182 Done reviews already documented, the local DB predating the R389 party + jti* fixtures so its jOOQ catalog lacked the detail tables' primary keys; re-seeding from init.sql + a clean catalog regen produced a fully green reactor and let the conformance test run in-pipeline, on paths R416 does not touch.

R407 (406f80d implementation; In Progress → In Review 2f5f741, Ready → In Progress d910a1f, Spec → Ready 825b524, build-command fixup b483e1e): Exclude generator-injected federation/@link definitions from the R398 SDL lint engine. A consumer schema carrying a federation @link saw type-names-pascal-case and types-and-fields-have-descriptions warnings on federationFieldSet, linkImport, and siblings the author never wrote and cannot rename (names dictated by the federation spec) or document (descriptions owned by federation-graphql-java-support); these definitions carry a null source, the tell that they came from no consumer .graphqls. Fixed by provenance, not a name.contains("_") heuristic and not by borrowing ScalarTypeResolver.FEDERATION_NAMESPACE_SCALARS (a hand-maintained expectation free to drift on a spec bump): FederationLinkApplier.apply now returns the Set<String> of names it injected (collected in its existing defs.forEach loop, the sole contributor) instead of a bare boolean. AttributedRegistry carries that set as injectedNames() and derives federationLink() from it ("injected anything"), collapsing the two facts into one component rather than a parallel carrier; AttributedRegistry.from(…​) derives the set the same way for ad-hoc test registries. LintEngine.run gains an overload taking the set and unions it with the existing BUNDLED_TYPE_NAMES exclusion at the two skip points it already has, widening the name-set skip to a second generator-owned contributor with no new skip mechanism, no new LintRule, no new LintNodeKind. KeyNodeSynthesiser is untouched: it decorates author @node types in place with @key and injects no new definitions, so folding its names in would wrongly silence real author violations; it keeps its void signature. Coverage: pipeline-tier LintInjectedFederationDefinitionsTest carries a federation @link plus an author type lowercase @node (the exact type synthesis decorates), exercising the real injection path and pinning both halves in one fixture, injected names stay silent while the author type’s pascal-case violation still fires; findings asserted on the typed LintRule and the minimum node-identity check, no rendered-message or generated-body assertions; FederationLinkApplierTest updated to assert on the returned name set. No per-name unit list. Reuses R398’s BUNDLED_TYPE_NAMES mechanism; sibling to R408 (author-driven suppression, the "chooses not to fix" half). Independent-session In Review → Done review; full reactor green under mvn install -Plocal-db (2407 core tests + sakila-example compilation/execution tiers, 0 failures) after re-seeding a stale local rewrite_test DB (missing the R389 party + jti* joined-table fixtures) and regenerating the jOOQ catalog, the same Query.allParties / JoinedTableInheritancePipelineTest stale-DB artifact earlier Done reviews noted, on paths R407 does not touch.

R182 (In Review → Done; landing sequence 657dd71 delete legacy reactor, a505cab unwrap rewrite to repo root, aad2f61 restructure architecture docs into Diataxis docs/architecture/, cbaeb64 CI/CD workflows, 31750bf docs+tooling paths; In Review transition b0cb778; In Progress e90e321; R19 discard adb071a): Retired the legacy graphitron-parent reactor and unnested graphitron-rewrite/ to the repo root. The six legacy modules (graphitron-codegen-parent, graphitron-common, graphitron-example, graphitron-maven-plugin, graphitron-servlet-parent, graphitron-schema-transform) and the legacy root pom.xml + maven-build.yml are gone; the rewrite aggregator (graphitron-rewrite-parent) is now the root POM with its eleven modules + docs at the top level, and the duplicate graphitron-javapoet collapses to one copy. This closes the release-event publish hazard: maven-publish.yml on main drops the -f graphitron-rewrite/pom.xml flag and carries the RC-aware tag regex, so a release tag can no longer republish deleted legacy artifacts at 10.0.0. Docs restructured: the flat graphitron-rewrite/docs/ tree became a Diataxis-shaped docs/architecture/{explanation,reference,how-to}/ folded into the site module (README.adoc split into index.adoc + reference/modules.adoc + explanation/pipeline-overview.adoc; getting-started.adoc dissolved into the manual how-to pages plus a new how-to/dev-loop-internals.adoc carrying the #dev-loop-detail / #native-runtime-dependency anchors), and roadmap-internal workflow.adoc moved out of the site to roadmap/workflow.adoc. roadmap-tool’s `Main.java gained a quadrant-aware mapAdocTarget (driven by an ARCH_QUADRANT slug table) plus repointed README/status-board headers; the ~11 inbound docs/** architecture xrefs were repointed; CI path prefixes and the tree-sitter-natives-release.yml env vars were de-prefixed. verify-standalone-build.sh retired, the CLAUDE.md legacy-scope rule removed, and rewrite-design-principles.adoc’s standalone-vs-legacy invariant reworded now that no legacy tree exists. Closes R26’s last open sub-item and supersedes R19 (discarded, not squashed). Step 8 (cut a release tag to exercise the consolidated publish workflow end-to-end) is inherently post-merge: the hazard only closes once this lands on `main. Independent-session In Review → Done review; full reactor green under mvn install -Plocal-db (2406 tests in graphitron, docs site renders the Diataxis /architecture/ tree with workflow.adoc correctly absent). The graphitron-core red first seen in the review sandbox (Query.allParties → UnclassifiedField) was the known stale-rewrite_test-DB artifact (the pre-existing DB predated the R389 party fixture and jOOQ skipped codegen against it); re-seeding from init.sql + a clean catalog regen produced a fully green reactor, orthogonal to the R182 diff.

R19 (discarded, superseded by R182): "Rebase and squash rewrite branch onto main" is abandoned. R182 retires the legacy reactor and unnests the rewrite by moving the tree up one level in three ordinary commits (delete, unwrap, docs restructure), not by rewriting history; R19’s squash approach is not the accepted path. R19’s own numbers were stale (April-2026 commit counts against a since-moved merge base). File deleted per the 2026-07-01 staleness audit.

R406 (landing e72eb02; rework onto R405 trunk from first pass 1b6971d, In Review → rework 1f4412f, Spec → Ready 6296d0b, spec 5f5ebc2, filed 1633934): Support a single-table discriminated interface (@table @discriminate, implementers pinned by @discriminator(value:), all sharing one jOOQ table, e.g. Content over content) as a DML @mutation(typeName: INSERT|UPDATE) return type. Before this, such a return was not rejected but silently mis-accepted (a TableInterfaceType is a TableBackedType, so it classified through the TableBoundReturnType arm to ProjectedSingle/ProjectedList) and emitted a <Type>.$fields(…​) re-projection that never generates for an interface, so the sources failed to compile. The write half is a plain single-@table write (the discriminator is an ordinary @field(name: "CONTENT_TYPE") input column the client sets; resolveInput unchanged); the entire fix is on the return half. Model: added the sibling DmlReturnExpression.DiscriminatedSingle/DiscriminatedList arms carrying the read-side discrimination data (interfaceName, discriminatorColumn, knownDiscriminatorValues, TableBound participants) sourced verbatim from the TableInterfaceType verdict, the DML sibling of R405’s ServiceTableInterfaceField; both map to the same Record/Table domain-return + target shape as Projected. A new return-shape arm (not a per-verb MutationField leaf) keeps the fork off the write-verb axis, per "lift the fork into the model": the write half is uniform across INSERT/UPDATE and the model already carries the return-shape seam. Classify: the single DML chokepoint buildDmlField resolves the return’s look-ahead verdict once and threads it into the still-static buildDmlReturnExpression, which builds the Discriminated* arm when the verdict is a TableInterfaceType. Validate: dispatchPerformsReFetch recognises the Discriminated* arms as re-fetching, keeping the emitter and OutputField.requiresReFetch() in lockstep under the build-time drift guard; the DELETE and @asConnection floors already fire for the interface case through the shared TableBoundReturnType arm. Emit: consumes R405’s shared read-side re-projection TypeFetcherGenerator.buildTableInterfaceReprojection (passing List.of() for alwaysProject, since the DML path keys the follow-up SELECT by a PK-IN Condition off the RETURNING keys rather than re-mapping by PK like the service path); the duplicate buildDiscriminatedReprojection from the first pass is deleted. Step 1 (PK-only RETURNING in dsl.transactionResult) and the composite-safe PK-IN builder were extracted into emitKeysTransaction + buildPkKeysCondition, R406-owned and shared only between emitProjected and emitDiscriminated (the DML write half has no R405 equivalent; they key off the RETURNING keys local, distinct from R405’s records-keyed MultiTablePolymorphicEmitter.buildPkInCondition). The generated row carries discriminator; the interface’s existing TypeResolver sets typename per row, so no new resolver and no per-typename UNION. Drop/write-read asymmetry aligned with R405: an INSERT of an unknown discriminator commits its row (the transaction closed before the follow-up SELECT) yet returns null, since the discriminator filter cannot name a subtype outside the known set; enforcing the discriminator domain is the database’s job (a CHECK constraint), not a graphitron pre-screen. Scope: INSERT/UPDATE only; DELETE (encoded-ID, own floor), UPSERT (blocked on R144/R145), unions (permanently), and Connection stay out. Coverage: unit-tier GraphitronSchemaBuilderTest (DiscriminatedSingle INSERT + UPDATE + DiscriminatedList classification, a regression pin against the pre-R406 ProjectedSingle silent-accept, and a DELETE-floor rejection pin), pipeline-tier FetcherPipelineTest INSERT/UPDATE shape assertions, and execution-tier DmlTableInterfaceReturnExecutionTest (real PostgreSQL over the content fixture + a new ContentInput/createContent/updateContent schema fixture: per-typename routing off the live discriminator, the cross-table FilmContent.rating join, same-table ShortContent.description isolation, and the unknown-discriminator write/read asymmetry). Independent-session In Review → Done review; full reactor green under mvn -f graphitron-rewrite/pom.xml install -Plocal-db. The full-reactor graphitron-core red first observed in the review sandbox (Query.allParties → UnclassifiedField; JoinedTableInheritancePipelineTest ClassCast on the R389 jti_* fixtures) was the known stale-rewrite_test-DB artifact (missing jti_app_account/jti_person composite PKs) compounded by jOOQ’s up-to-date codegen skip; re-seeding from init.sql + a clean catalog regen produced a fully green reactor including R406’s execution tier, and the failures are orthogonal to R406. Consumes R405’s buildTableInterfaceReprojection (extracted read-side, landed 7b9d051). Non-blocking carry noted at review: the two FetcherPipelineTest cases use CodeBlock.toString().contains(…​) body-string assertions (existing DML-fetcher precedent in the same file; model shape pinned in GraphitronSchemaBuilderTest, behaviour at the execution tier).

R370 (core four sites + fixtures + R412 filing a13523e; two remaining in-hand @service-path sites + witnesses 4e22ee4; Spec → Ready 7a853a5, In Review → Ready rework 352cc16): A record-backed parent with a nested backing class emitted the non-compiling $-qualified Outer$Nested because ClassName.bestGuess re-parses a binary class name and never splits on $. Fixed at the six sites that already hold a structurally-correct name in hand, so the swap is a one-for-one ClassName.get(Class) / captured-TypeName substitution at the source boundary rather than a per-consumer patch: the two AccessorRef producers (deriveAccessorRecordParentSource, derivePolymorphicHubSource), the @service return-type validator (checkServiceReturnMatchesPayload, previously spuriously rejecting nested payloads at classify time), and the query + mutation @service fetcher return types (computeServiceRecordReturnType, computeMutationServiceRecordReturnType, both collapsed to ServiceMethodCall.javaReturnType() so the twins no longer drift), plus the @service Outcome payload ctor arm (resolveErrorChannel → ClassName.get(payloadCls)). Restores AccessorRef’s own javadoc contract and corrects the now-true "Identical policy" mirror javadoc; the stale R370 hazard note in `buildScalarPerParentFetcher was removed. Coverage: two compilation-tier fixtures, one per AccessorRef producer (NestedFilmsPayload list-arm via buildAccessorKeyMany, NestedOccupantCarrier single-cardinality polymorphic via buildScalarPerParentFetcher); a mutation + @error-channel compilation fixture (NestedFilmReviewPayload) reaching computeMutationServiceRecordReturnType and resolveErrorChannel; and a classification-tier ErrorChannelClassificationTest.childServiceRecordField_nestedPayloadBacking_payloadClassIsStructurallyResolved pinning the resolved PayloadClass.payloadClass() to the structural Outer.Nested by object-equality on the TypeName (no code-string assertion on any generated body). The review corrected the spec’s second-witness premise: after the R244 Outcome flip, root @service outcome fields classify to ErrorChannel.Mapped (no developer payload class emitted), so resolveErrorChannel’s `PayloadClass arm is reached only by a child @service field, hence the classification-tier witness rather than a sakila compile fixture. The remaining bestGuess-over-fqClassName emit sites that hold no reflected Class/captured TypeName (backingClassOf, recordColumnReadArgs, FetcherEmitter, several ChildField sites) need a model-lift, not a call swap, and were filed as R412. Independent-session In Review → Done review; full reactor green under mvn -f graphitron-rewrite/pom.xml install -Plocal-db (2406 core tests + the sakila-example compilation/execution tiers, 0 failures) after re-seeding a locally-clobbered rewrite_test catalog (the Query.allParties / JoinedTableInheritancePipelineTest cascade was a stale-DB artifact orthogonal to R370).

R405 (landing 7b9d051; Spec → Ready e133e55, Backlog → Spec ca05952, flow/mechanism capture f61566b, filed 1633934): Support a single-table discriminated interface (@table @discriminate, implementers pinned by @discriminator(value:), all sharing one jOOQ table) as a root @service polymorphic return, closing the last deferred shape on the @service polymorphic surface. Route (a) (R365, multitable) dispatches each service-returned record on its runtime Java class, which cannot tell same-table subtypes apart; this path instead reuses the read-side discriminator mechanism. New QueryServiceTableInterfaceField / MutationServiceTableInterfaceField leaves (single-table siblings of ServicePolymorphicField) carry the shared-@table TableBoundReturnType, discriminator column + known values, and TableBound participants plus the service binding; target shape Interface keeps requiresReFetch() false. Both root classifiers' TableBound arms build the new variant when the verdict is a TableInterfaceType (deferServiceTableInterface deleted). Emit reuses the read-side projection: the shared discriminator-filter + discriminator projection + cross-table LEFT JOIN assembly was extracted from the two read fetchers into a package-private TypeFetcherGenerator.buildTableInterfaceReprojection (read paths pass an empty alwaysProject, output unchanged); the new MultiTablePolymorphicEmitter service fetcher calls the service, normalises the return to List<Record> (extracted shared snippet), collects the shared table’s PKs into a composite-safe DSL.row(pk…).in(rows) condition, runs one by-PK SELECT through the shared helper, and re-maps rows to input positions by PK (drop contract aligned with route (a): an unmatched PK drops from a list, yields null for a single). Validate mirrors the single-table floor (validateCardinality only, not the multi-table participant check). Union returns stay permanently unsupported; child @service polymorphic returns and @asConnection stay out of scope. Coverage: pipeline-tier ServiceTableInterfaceReturnPipelineTest, unit-tier classification flip (serviceReturningTableInterface_classifiesAsServiceTableInterfaceField + mutation twin) and ServiceTableInterfaceFieldValidationTest, the two ClassifiedCorpus examples + GeneratorCoverageTest leaf-partition pin, and execution-tier ServiceTableInterfaceReturnExecutionTest (real PostgreSQL: list routes each row to FilmContent/ShortContent off the live discriminator, populates FilmContent.rating via the cross-table join, honours the drop contract, single + mutation cardinality). Independent-session In Review → Done review. R405’s own tests are green; the full-reactor graphitron-core red observed in the review sandbox (Query.allParties → UnclassifiedField; JoinedTableInheritancePipelineTest ClassCast) was a stale-rewrite_test-DB artifact (missing party_ tables + jti_person PK) compounded by jOOQ schemaVersionProvider regeneration caching, reproduced identically at the pre-R405 parent 8fca064 and orthogonal to R405; re-seeding the local DB from init.sql + a clean rebuild produced a fully green reactor including R405’s execution tier. Non-blocking follow-up noted at review: the pipeline test uses CodeBlock.toString().contains(…​) body-string assertions (repo precedent exists; behaviour is independently pinned at the execution tier). R406 reuses this item’s read-side dispatch for its DML return half.

R332 (cb99991 implementation; 8fca064 fixture-gate accounting; Spec → Ready 6ad75dd): Deprecation signal for @table on input types, a signal-only precursor ahead of R97’s consumer-derived removal (classification behaviour unchanged). Two tiers per D1. Prose tier (ships unconditionally, carries the carve-out in words): the @table description in directives.graphqls gains the input-type deprecation note + replacement instruction (no SDL @deprecated marker, the spec forbids it on a directive location); a directive-level row in deprecations.adoc with the section heading/intro widened from "whole directives" to "whole directives and directive locations"; a WARNING admonition on the canonical table.adoc page; and the code-generation-triggers.adoc Input type with @table row annotated. Actionable tier (fires per @table-on-input type, respects the carve-out): a post-classification GraphitronSchemaBuilder.emitTableOnInputDeprecationWarnings(ctx) pass placed beside rejectCaseInsensitiveTypeCollisions, walking ctx.schema input types that explicitly declare @table and emitting a non-fatal BuildWarning.NoRule per usage (the plain non-lint arm per D1, not LintFinding; message names no R<n> per D2; unconditional per D4). The encoded-ID / scalar-return INSERT/UPSERT carve-out (D3) is computed by encodedWriteTargetInputTypes(ctx) off the classified model (the MutationInsertTableField/MutationUpsertTableField leaves whose returnExpression() is an Encoded* arm), needing no lookAheadVerdict or reflection, so R332 stays depends-on: []; the type-level conservative rule suppresses an input reused by any encoded INSERT/UPSERT. encodedWriteTargetInputTypes is the named find-usages anchor R97 Phase 2b retires (forward edge R97 → R332). Coverage: pipeline-tier TableOnInputDeprecationWarningTest (projected-return INSERT warns with source location; encoded-ID INSERT carved out; D3 reuse suppression) 3/3 green; DeprecationsDocCoverageTest gains "table" in WHOLE_DIRECTIVE_DEPRECATIONS; FixtureWarningsGateTest segregates the R332 category out of its exactly-one advisory scope (mirroring the ENGINE-lint filter) and adds a count-independent carve-out test (FilmCreateInput/FilmDeleteInput warn, encoded-ID CreateKeyedNodeInput does not); no code-string assertions on generated bodies. Independent-session In Review → Done review; TableOnInputDeprecationWarningTest green and the emitted NoRule message shape matches both gate matchers by inspection. The two graphitron-sakila-example tests could not execute because that module’s generate goal is blocked on trunk by the pre-existing R389 fixture breakage (party / party_individual / jti_person catalog tables absent, Query.allParties unclassified); the 11 graphitron-core failures (JoinedTableInheritancePipelineTest ClassCast + the Query.allParties corpus cascade) were confirmed to reproduce identically with R332 reverted, so they route through R389, not this item. Remaining work: R97 Phase 2b empties the carve-out and lets the warning fire on encoded INSERT/UPSERT inputs, at which point this item folds or retires.

R398 (1d520fa engine + nine visitors, 82fd246 sealed BuildWarning + advisory tagging + MCP projection, 148c8ac LSP finding-keyed QuickFix, fd38fb0 @record deprecation-marker alignment, 53d475b report/LSP integration pins, d5b0a57 In Progress → In Review, 3a4a190 explicit-fix decoupling; Spec → Ready 3ee7062): SDL lint engine with ESLint-style built-in visitors. A single shared traversal over the build’s parsed graphql-java AST dispatches each node to the LintVisitor`s subscribed to its `LintNodeKind; adding a rule is registering it in LintRules, not editing a central switch. Rule identity is a type (LintRule enum, stable kebab-case id(), a Source{ENGINE, CLASSIFIER} axis), never a string bag. Findings ride the existing warning channel via a sealed BuildWarning (NoRule arm for the pre-existing untagged advisories; LintFinding arm carrying the typed LintRule + Optional<LintFix>), so a finding’s rule is a type and its fix lives only on the arm where it is meaningful, no nullable field; both arms flow into ValidationReport unchanged, so the LSP replay (Diagnostics.validatorDiagnostics, R139 freshness-silence intact) and the MCP diagnostics tool project findings with no second evaluator, the MCP wire additionally carrying the LintRule id. Nine syntactic engine visitors ship (type-names-pascal-case, field-names-camel-case, input-and-argument-names-camel-case, enum-values-screaming-snake-case, deprecations-have-a-reason, types-and-fields-have-descriptions, input-object-name-suffix, no-deprecated-directive-usage, no-typename-prefix); the three existing classifier advisories (splitquery-redundant-on-record-parent, redundant-record-directive, asconnection-same-table-pk-in) are surfaced and tagged at their FieldBuilder/TypeBuilder emit sites, never re-derived, so the classifier stays their sole emitter and each coordinate is warned exactly once (no-deprecated-directive-usage excludes @record, owned by the redundant-record advisory). Optional LintFix is a suggestion the LSP turns into a QuickFix CodeAction (a new finding-keyed branch alongside the detector-driven SdlActions path, sharing only the WorkspaceEdit/TextEdit emit primitives); the build never mutates SDL. Fixes are registered explicitly, never divined from a deprecation’s prose reason, and are offered only where the edit is provably safe within the document: additive inserts (deprecations-have-a-reason, types-and-fields-have-descriptions), local renames offered only for undescribed fields (field-names-camel-case, no-typename-prefix, since graphql-java reports a described node’s location at the description, not the name token), and bare-form-only safe deletions for the two ignored-directive advisories (@record(record: {…​}) has no computable end location, so it reports without a fix). Rename-class rules whose fix would ripple to references (type-names-pascal-case, input-object-name-suffix, enum-values-screaming-snake-case, input-and-argument-names-camel-case) ship no fix in v1. The pure graphql-java DeprecationRecognizer (the @deprecated docstring-token regex + native-marker read + typed DeprecationInfo{NATIVE, DOCSTRING}) is extracted down from graphitron-lsp into the graphitron build module so visitor 8 can consume it build-side; LspVocabulary now delegates and keeps its SchemaCoordinate adapter LSP-side (zero behaviour change, pinned by LspVocabularyTest/SdlActionDriftTest), and @record gains the docstring @deprecated marker so the convention is uniform. Coverage: pipeline-tier LintEngineTest (per-rule positive/negative/range + fix edit-range pins), LintRuleRegistryCoverageTest (every ENGINE rule registered exactly once, no CLASSIFIER advisory in the registry, subscribed ∪ not-linted partitions LintNodeKind with no overlap/gap, mirroring VariantCoverageTest/EdgeCoverageTest), ClassifierAdvisoryFixPipelineTest (emit-site fixes + bare-only guard), LSP-tier LintQuickFixTest + ValidatorDiagnosticsTest (build-side finding replays into a Warning squiggle at its range and applies to the corrected SDL, silenced on a stale snapshot per R139), and MCP-tier GraphitronMcpServerTest (both arms: no-rule advisory carries no lintRule, lint finding carries its id on the wire); findings asserted on the typed LintRule + SourceLocation, no code-string assertions on rendered diagnostic text or generated bodies. Deferred as designed: the plugin SPI, per-rule enable/disable + severity overrides + error-capable lint, a declarative rule-config DSL, reference-aware rename refactoring, and a second tree-sitter evaluator. Subsumes and retires R121 (redundant @splitQuery on @record) and R296 (deprecated-directive usage). Independent-session In Review → Done review; the full reactor is green under -Plocal-db once the local rewrite_test DB is seeded from the current init.sql and jOOQ regenerated (a stale sandbox catalog missing the R389 party joined-table fixtures reproduces the same Query.allParties/JoinedTableInheritancePipelineTest classification failures earlier Done reviews noted, on paths R398 does not touch). Approval corrected one false-invariant javadoc on LintNodeKind (it claimed a throw-on-unmapped instanceof chain the engine does not implement; the engine names the kind explicitly per dispatch site).

R409 (d2c8363 implementation, 9a22265 In Progress → In Review; Spec → Ready 972aeaf): Quiet the non-actionable mvn graphitron:dev RAG-warm startup log noise and document the recommended consumer .mvn/jvm.config for the warnings a plugin cannot un-print. A new RagLogQuieting helper lives in graphitron-mcp (where the RAG logger names are facts about the langchain4j-ONNX + Lucene dependency set R341/R372 dependency-quarantine, not knowledge the plugin’s compile surface should learn) and is called once from DevMojo.bindServer before the warms start() on the dev thread, so thread-start’s happens-before edge publishes the suppression to the graphitron-warm- daemon threads that load the noisy classes (in-code comment forbids reordering it after start()). Group 1 (DJL HuggingFace tokenizer maxLength warning): non-actionable, no public knob, so muted defensively across providers, the slf4j-simple per-logger level property *and the logger’s JUL level raised to SEVERE, so a Maven binding swap degrades to "noise returns" rather than a silent no-op; the DJL logger FQCN ai.djl.huggingface.tokenizers.HuggingFaceTokenizer confirmed against the 1.16.3-beta26 bge jar. Group 2 (Lucene VectorizationProvider incubator-module warning): actionable and directional, so demote-do-not-swallow, its JUL logger raised to SEVERE and, only when jdk.incubator.vector is absent (ModuleLayer.boot().findModule(…​)), one concise graphitron-owned dev line names the --add-modules jdk.incubator.vector flag in place of Lucene’s multi-line dump; present module → silent (fast path already on). Group 3 (Maven-runtime jansi native-access / guava Unsafe warnings): documented only in getting-started’s new "Quieting startup warnings" note with a recommended .mvn/jvm.config, since the JVM prints them for Maven’s own lib/ jars before any plugin code runs. Helper javadoc names only what is attempted ("best-effort quieting"), never asserts the warning is gone, and pins the dev-goal-only scope (explicitly not shared with GenerateMojo/ValidateMojo, not triggered by the GraphitronMcpServer constructor, not to be hoisted). Coverage: unit-tier RagLogQuietingTest (Lucene JUL SEVERE; DJL slf4j-simple property error + its JUL SEVERE; calling twice a no-op; the incubator-hint decision as a pure function of module presence) ; 5 tests, no code-string assertions on generated bodies. Dev-tooling plumbing: no sealed variant, no classification, no emitted Java. Independent-session In Review → Done review; R409’s graphitron-mcp + graphitron-maven-plugin modules compile clean and RagLogQuietingTest is green, and the full-reactor graphitron-core failures (Query.allParties → UnclassifiedField; JoinedTableInheritancePipelineTest ClassCast) were confirmed to reproduce identically at the pre-R409 parent commit 5027e30, on classification paths R409 does not touch.

R261 (landing 6d5ce8b, Spec → Ready 7af72bf): Generation-time wire-coercion cast guard, Slice 1 (the three @service arg-classification sites). Before this, every arg-classification site fell through to CallSiteExtraction.Direct and emitted a raw (DeclaredType) wireValue cast that compiled cleanly and ClassCastException`d (or, for enums, `IllegalArgumentException`d) on the first request, since graphql-java delivers `ID/enum as String, Int as Integer, Float as Double, input-objects as Map. The fix homes the "coercion output assignable to declared type" verdict at the classifier in a new WireCoercionResolver (a sealed PassThrough | Rejected result, mirroring EnumMappingResolver.EnumValidation), consuming a new pure forward mapping ScalarTypeResolver.coercionOutputType (SDL scalar name → coercion-output TypeName, over spec built-ins, federation scalars, and classified @scalarType resolutions), keeping the verdict off ScalarTypeResolver (D1). A new WireCoercionError sub-seal of Rejection.AuthorError carries two arms on two axes (D4): Assignability (coercion class ≠ declared type; sites A-D) and EnumConstantDivergence (declared type is the enum but an SDL value name has no matching Java constant; site E), each with a stable lspCode() under graphitron.wire-coercion. wired into Diagnostics.lspCodeOf, RejectionSeverityCoverageTest, and typed-rejection.adoc (+ drift list). ServiceCatalog.argExtraction (site B) is widened to take the resolved SDL leaf and return a sealed Resolved | Rejected; InputBeanResolver.bindField (sites A/E) calls the predicate on the scalar arm (widening R195’s jOOQ-record-only reject to the full wire-incompatible family) and routes the enum arm through EnumMappingResolver.checkEnumConstants, an extracted column-agnostic single parity home reused by validateEnumFilter (column path) and the @service enum producers (D3). Coverage: WireCoercionCastGuardPipelineTest asserts per arm on the typed rejection’s lspCode()/components (no code-string assertions on generated bodies), plus the ID→String, custom-@scalarType, and matching-enum non-regression cases that guard against over-rejection. Independent-session In Review → Done review; all R261-touched tests green and the whole graphitron-lsp module clean. Sites C (@condition) and D (@externalField) were carved into R411 (reject-wire-coercion-nonservice-sites, depends-on dimensional-model-pivot), which consumes this predicate unchanged; R261 dropped dimensional-model-pivot from depends-on and closes on the @service slice alone, with the @tableMethod/@condition caller deliberately left on ServiceCatalog.legacyArgExtraction until R411 threads the predicate through R222’s channel. The sandbox’s pre-existing Query.allParties / JoinedTableInheritancePipelineTest failures (missing PK metadata on the jti_ fixture catalog) were confirmed to fail identically at the pre-R261 parent commit 6ad75dd, so they are not an R261 regression. (Landing commit message misnames the carve-out item as "R407"; the sibling item, spec body, and README all correctly reference R411.)

R63 (landing 5ce8bc1, Spec → Ready 9ea2a8c): Lift the DML UPSERT/UPDATE dialect requirement off hand-built postDslGuard CodeBlock`s onto typed model data. A new sealed `DialectRequirement (None / RequiresFamily / RejectsFamily) plus a graphitron-internal SqlDialectFamily enum (a jOOQ SQLDialect.family() collapse; name-prefix fromDialectName covers the commercial-only ORACLE* / POSTGRESPLUS spellings the OSS jOOQ distribution omits) make the "UPSERT rejects Oracle" / "bulk UPDATE requires Postgres" facts discoverable on MutationField.DmlTableField.dialectRequirement() (never null), so the verb-neutral buildDmlFetcher skeleton stays verb-neutral and a future validator can read the constraint at validate time. Each of the four DML records carries the component, populated at its FieldBuilder construction site (UPSERT → RejectsFamily(ORACLE), bulk UPDATE → RequiresFamily(POSTGRES) selected on inputArg.list(), INSERT/DELETE/single-row UPDATE → None.INSTANCE); MappingsConstantNameDedup threads it through the error-channel rebuild. buildDmlFetcher’s `postDslGuard CodeBlock param becomes a DialectRequirement, collapsing three overloads into two, and a new emitDialectGuard helper renders the guard. Divergence from the Ready draft (documented in the spec body and landing commit, and verified in review): the draft emitted a reference to the generator-internal SqlDialectFamily enum into generated code, which does not compile in a consumer, where graphitron is test-scoped (graphitron-sakila-example/pom.xml) while the generated fetchers compile as the consumer’s main sources (GenerateMojo adds them via project.addCompileSourceRoot); the emitted guard instead stays self-contained, comparing jOOQ’s own dsl.dialect().family().name() against the family’s jooqFamilyName() (the reachable bulk-UPDATE output is byte-identical to the former inline family().name().equals("POSTGRES") guard, and jOOQ’s family() folds every ORACLE* spelling to ORACLE, so the UPSERT gate still catches them). fromDialectName is retained on the model for the future validator-time check. postInGuard, the sibling free-form CodeBlock carrying imperative per-row emission mechanics, stays a CodeBlock (documented non-goal: no DialectRequirement-shaped datum hides in it). Coverage: unit-tier SqlDialectFamilyTest (fromDialectName collapse + jooqFamilyName incl. the OTHER rejection), pipeline-tier DmlDialectRequirementClassificationTest (per-verb population), emitter TypeFetcherGeneratorTest (self-contained Oracle guard from a directly-constructed field + None emits nothing; UPSERT can’t classify through the pipeline under R144), and the bulk-UPDATE FetcherPipelineTest assertion re-anchored to the typed guard; no code-string assertions on generated bodies beyond the intentional guard-shape pins. Independent-session In Review → Done review; all R63-touched tests green (213), and the sandbox’s pre-existing Query.allParties / JoinedTableInheritancePipelineTest failures (missing PK metadata on the jti_* fixture catalog) confirmed to fail identically at the pre-R63 parent commit. Carries forward the R22 post-shipping follow-up.

R26: Umbrella tracker closed. Retiring graphitron-maven-plugin + graphitron-schema-transform into graphitron-rewrite shipped its build surface (schema loading, tagged inputs, Maven plugin, aggregator-standalone, content-idempotent writes) and @asConnection emit-time synthesis; the Java LSP rewrite + dev goal landed under R18; @notGenerated directive removal shipped on its own plan; Federation SDL integration continues under the separate Apollo Federation via federation-jvm transform backlog item; and the programmatic-schema architecture (Graphitron.buildSchema(…​)) pruned type-extension merging, directive stripping, and client-SDL feature-flag splits from scope outright. Closed now rather than held open for its last sub-item, deleting graphitron-maven-plugin wholesale and unnesting the rewrite aggregator, which continues as its own item, R182 (unnest-rewrite-aggregator.md); an umbrella tracker has no reason to outlive the work it was scoping once every other bullet under it has landed.

R400 (Stage 1 0584430; Stage 2 page deletion 27412d3 + xref strip 2ea7900; In Review 4771bcd; rework fix 76d5ac9; spec/AC notes cff3120/2eca156; In Review 160ecef): Withhold the not-in-use directives from the v1 advertised directive surface, a docs-and-report-only trim with no generator behaviour change. DirectiveSupportReport.renderMigration (the roadmap-tool that generates docs/manual/_generated/supported-directives.adoc) gained two curated policy sets: REJECTED_ON_USE = {notGenerated, multitableReference} moved out of "Supported" into a new "Removed / rejected directives" section that tells migrating consumers to delete them, and WITHHELD_FROM_V1 = {tableMethod, sourceRow, experimental_constructType} silently excluded from "Supported" (declared and behaviourally unchanged, just outside the v1 surface). @record stays advertised as-is (deprecated + silently ignored, kept for v1 per the 2026-06-30 user decision). Stage 2 deleted the withheld trio’s dedicated reference pages (reference/directives/{tableMethod,sourceRow,experimental_constructType}.adoc) and the how-to/source-row.adoc recipe, and stripped every now-dangling xref and teaching passage across the index and recipe pages while keeping factual inline-code mentions (the directives are withheld, not removed); the AsciiDoctor fail-on-WARN render is the guardrail that no dangling xref survives. directives.graphqls is untouched and no classify-time rejection was added. Recovery is anchor-free (git log --diff-filter=D + checkout <commit>^ — <path>) and ticketed under R403 (@tableMethod rethink + recover), R404 (@sourceRow recover), R69 (@experimental_constructType, gated on an emitter). Independent-session In Review → Done review across two cycles: the first requested rework because deleting the trio’s pages while keeping them declared broke R68’s DirectiveDocCoverageTest declared-directive ↔ reference-page bijection (a hard build failure); fixed by 76d5ac9, which narrows the invariant to "a directive needs a page only if it is on the advertised surface" and derives the exempt set from the generated supported-directives.adoc fragment (declared − mentioned = withheld) so the test cannot drift from the report that owns WITHHELD_FROM_V1. Coverage: DirectiveSupportReportTest (exclusion took effect: withheld trio + rejected pair absent from "Supported", rejected pair under "Removed / rejected", @record retained) and the carved-out DirectiveDocCoverageTest; full reactor green under -Plocal-db. Absorbs and supersedes the upstream "Remove the @tableMethod directive" proposal. Spawns R403/R404.

R389 (reshape a3899f4; classifier/emitter/party fixture 3586c06; pipeline tests 6aa4bb3; composite jti_* re-author d08eacb; rejection tests 521dd59; corpus + architecture-doc prose e163d59; In Review 5451c0f; self-review be47c31; schema-version rework 3dc0a3a): First-class discriminated joined-table (class-table) inheritance, where each participant declares its own detail @table distinct from the discriminated base and its inherited (base-resident) fields carry @reference back to the base. A new ParticipantRef.JoinedTableBound sealed variant carries the resolved child→parent JoinStep.FkJoin; residence is declared by the per-field @reference (base-resident → ColumnReferenceField, detail-resident → plain ColumnField) and read off the field variant, never recomputed, so no residence-aware resolver was added to FieldBuilder. TypeBuilder.buildParticipantList detects the detail-table participant, resolves the hop, skips the cross-table pass, and surfaces PK=FK / same-base / no-nameable-join violations as INVALID_SCHEMA diagnostics with candidate-FK hints. The interface fetcher selects FROM base with a per-participant discriminator-gated LEFT JOIN to each detail table (base-resident + shared-key fields off the base, detail-exclusive fields off the detail alias, NULL-through for non-matching rows); the same concrete type stays first-class standalone, resolving inherited fields through the parent reference. Both shared-key shapes ship: a new single-column party/party_individual/party_company fixture and the composite jti_* fixture re-authored to R389 (subsuming the R388 workaround). Coverage: @ExecutionTier allParties (routing + per-participant projection + NULL-through), allIndividuals (standalone), and the converted allSubjects composite cases against real PostgreSQL; @PipelineTier JoinedTableInheritancePipelineTest (positive shape, mixed discriminator-only + joined participant, three rejection invariants); a joined-table-interface R281 corpus example + code-generation-triggers.adoc prose; no code-string assertions on generated method bodies. Independent-session In Review → Done review across two cycles: the first requested rework for a missing jooq.codegen.schema.version bump (R389 changed init.sql but left it at 2.2, so jOOQ skipped catalog regeneration on incremental -Plocal-db builds → an UnclassifiedType cascade across 11 tests); fixed by 3dc0a3a (2.2 → 2.3) and verified with an incremental build that regenerates and is green. Builds on R388/R392; sets up R393 (base→detail join disambiguation).

R399 (In Review 75c4894; JSON-B switch e57bdbd; empty-body guard d6254dc): New graphitron-jakarta-rest module, a reusable spec-conformant GraphQL-over-HTTP serving library over a Graphitron schema, ending the four-dialect drift between the reference app and the tilgangsstyring-style consumer copies (each had diverged on media types, status codes, /schema, and GraphiQL). The dependency-inversion seam is a consumer-implemented GraphitronApplication SPI (schema(), newExecutionInput(), default engineBuilder(), default graphiqlEnabled()) plus an AbstractGraphitronApplication base that caches the schema from a supplier lambda over the generated facade, so the library never names a per-subgraph type. GraphqlResource (@Path("/graphql")) owns POST/GET content negotiation, the media-type-driven status watershed (modern application/graphql-response+json: unparseable → 400, malformed/validation/coercion → 422, executed → 200; legacy application/json always 200), GET mutation → 405, /graphql/schema via SchemaPrinter, and a CDN-based GraphiQL page; an application-scoped GraphqlEngine caches the built GraphQL. No custom JAX-RS providers: the resource reads the raw body and parses a GraphqlRequest record so it can shape parse errors as spec 4xx and own the status watershed. Two refinements from the signed-off spec, both sound: graphiqlEnabled() rides the SPI interface (callable through the injected reference, overridable by a direct implementor), and body marshalling uses the Jakarta JSON Binding (JSON-B) API rather than Jackson, leaving the library with zero concrete JSON dependency (consumer supplies the provider; Yasson / quarkus-jsonb) consistent with its all-jakarta.-at-provided stance. The module is the first hand-written *runtime artifact consumers depend on, a third Java-version category (rewrite-design-principles.adoc grew the bullet): it compiles at <release>17</release> (the Java-17 floor consumers share), is publishable, and joins the deploy set. graphitron-sakila-example refactored onto it (its GraphqlResource/GraphqlEngine copies and self-hosted GraphiQL assets deleted, replaced by a one-class SakilaGraphitronApplication adapter). Batching stays out of scope (the spec defines none). Coverage: an 11-case @ExecutionTier GraphQLOverHttpConformanceTest run through the reference app exercises the real library end-to-end, one citing case per committed normative requirement, each carrying the verbatim spec sentence + section + revision as a @DisplayName plus a requirement → section → test pointer table; the library itself carries no @Test classes by design (keeps the per-module tier-enforcement in-scope list from growing). No code-string assertions on generated bodies. The most spec-load-bearing, least-typed spot, statusFor’s `422-by-exclusion arm, is documented with the unit-tier escape hatch should a graphql-java upgrade ever add a pre-execution ErrorType. Independent-session In Review → Done review; full reactor green under mvn -f graphitron-rewrite/pom.xml install -Plocal-db (clean build, 2313 core tests + all 11 conformance cases, 0 failures; an initial red run traced to a stale sandbox rewrite_test DB missing R389’s party_* tables, resolved by a re-seed + clean rebuild, not a code defect in either item).

R401 (Half A 8a08759 + dispatch fix f225eeb; Half B e6cbe70; In Review e288bf4): Bundle the tree-sitter runtime in the natives jar so the LSP has zero native system dependency. no.sikt:graphitron-tree-sitter-natives now ships libtree-sitter alongside the grammar for all four supported platforms (eight lib/<os>-<arch>/ entries), built in CI from the pinned upstream v0.26.9 source tag (POSIX make; Windows MinGW-w64 with static-linked gcc runtime), gated on exported-symbol + transitive-dep allowlist assertions and a post-deploy-verify load+parse on all four platforms with no system libtree-sitter present; 0.26.9-1 published to Central by a human-dispatched release. BundledLibraryLookup extracts both binaries and returns grammar.or(bundledRuntime) (system probe deleted); GraphqlLanguage collapses the dual missing/too-old diagnostic apparatus (classifyInstalledRuntime, RuntimeStatus, runtimeProbePaths, tooOldRuntimeMessage, missingRuntimeMessage, ABI_VERSION_SYMBOL) to a single bundled-load-failure message naming the extracted temp path, with DOCS_URL repointed to the reference page. The lsp-requirements, getting-started #native-runtime-dependency, and reference-index docs collapse to "nothing to install" (per-platform install matrix and NixOS shell.nix snippet removed). Coverage: NativeLibraryBundleTest (per-platform @EnabledOnOs; linux-x86_64 loads the bundled runtime + grammar via the SPI and parses), TreeSitterSmokeTest, GraphqlLanguageErrorTranslationTest (the single-diagnostic + classifier + missing-path contract). Independent-session In Review → Done review (approval commit also corrected the natives pom.xml header comment and the UPSTREAM.md Windows build command, which still described the pre-bundle grammar-only module); full graphitron-lsp suite + reactor green under mvn -f graphitron-rewrite/pom.xml install -Plocal-db. Supersedes the system-dependency model from R203.

R269 (077f8f3 implementation; Spec → Ready fa6f38d, spec revisions 81ba814, spec refresh 1ac70fb): Null-guard the record-parent split-query accessor key extraction so a nullable to-one/to-many @table relation that resolves to no row renders null/[] instead of NPEing. GeneratorUtils.buildAccessorKeySingle (the ONE arm, the reported bug) read a nested jOOQ record off the parent backing via ((Backing) sourceExpr).accessor() and called .into(<PK columns>) on it with no null guard, so when a nullable to-one accessor returned null on an otherwise-successful parent the emitted fetcher threw Cannot invoke "…​Record.into(…​)" because "element" is null on the success arm rather than resolving the field; buildAccessorKeyMany had the analogous hazard one level out, the bare for-each over a never-populated to-many backing NPEing before any .into(…​). The ONE arm now emits if (element == null) return CompletableFuture.completedFuture(null); between the accessor read and the key build, mirroring the FK-side buildKeyExtractionWithNullCheck precedent (a key that can’t match the terminal PK must not dispatch the loader; the to-one’s faithful "no row" rendering is null, and the fetcher’s CompletableFuture<DataFetcherResult<Record>> return makes completedFuture(null) assignable). The MANY arm took design fork (a): hoist the accessor result to a typed Iterable<Element> local and skip the for-loop when it is null so keys stays empty and the existing loadMany dispatch renders [] (the extraction block does not own its return path; both DataLoaderFetcherEmitter and MultiTablePolymorphicEmitter append their own dispatch, so skipping the loop is the consumer-agnostic shape). The asymmetry is deliberate and documented in both helpers: the ONE arm preserves null-vs-present (a to-one’s "no row" faithfully renders null) while the MANY arm collapses null-vs-empty (a to-many has no surface distinction between "never populated" and "zero rows" once the loader returns). Element-level nulls inside a populated collection stay unguarded (a malformed backing, not a cardinality to model). Emit-only: no model/classifier/AccessorRef/SourceKey change; producer/consumer linkage to the field’s nullability classification carried as a one-line rationale comment per the design-principles prescription (no validator invariant to mirror). The shared null key → completedFuture(null) seam across buildKeyExtractionWithNullCheck / buildAccessorKeySingle is named as a drift-prone follow-up, left out of scope as a refactor with its own blast radius. Coverage: execution-tier GraphQLQueryTest.inventoryById_filmCardDataNullAccessor_rendersFilmNullWithoutNpe (a FilmCardData accessor returning null for even film_id`s renders `film null with no error, odd film_id`s still resolve their `Film row through the same loader, the mixed-batch proof) and AccessorDerivedBatchKeyTest.accessorDerivedManyPayloads_nullToManyBacking_rendersEmptyListWithoutNpe (a CreateFilmsPayload with a null films() backing renders [], the present sibling still resolves); the RecordTableField + AccessorCall + Cardinality.ONE/MANY classifier shape the guards depend on is already pinned by GraphitronSchemaBuilderTest’s `AccessorDerivedSourceCase matrix; no code-string assertions on generated bodies. Split out of R268 (the error-arm short-circuit) and orthogonal to it; R271 had already retired the elt/k dunders. Independent-session In Review → Done review; full reactor green under mvn -f graphitron-rewrite/pom.xml install -Plocal-db (GraphQLQueryTest 286, AccessorDerivedBatchKeyTest 2, 0 failures).

R262 (c71885c, In Review c453aaf, Spec → Ready 498ddf7, Backlog → Spec d8ed14d): Reject @nodeId on non-ID coordinates and federation encoded @key fields at validate time. The SDL directive permits @nodeId on FIELD_DEFINITION | INPUT_FIELD_DEFINITION | ARGUMENT_DEFINITION with no ID restriction, but every decode/encode arm is gated on "ID".equals(…​), so a non-ID @nodeId was silently dropped and the raw base64 wire String bound undecoded: a green build with a production SQL bind/type error or never-matches predicate. Two build-time soundness reductions on the shared diagnostic channel (the R317-slice-5 / R204 / R194 pattern) close it. rejectNonIdNodeId(ctx) in GraphitronSchemaBuilder (sibling to rejectCaseInsensitiveTypeCollisions, same orchestration region) walks ctx.schema applied directives across all three on-locations, object/interface field definitions plus their arguments plus input-object fields, and registers an INVALID_SCHEMA ValidationError for any whose GraphQLTypeUtil.unwrapAll is not ID (findings F, G, and the output FIELD_DEFINITION encode mechanism that has no ID gate at all); it reads the raw schema rather than the registry precisely because a dropped @nodeId leaves no trace on the classified field. EntityResolutionBuilder rejects a federation @key whose referenced field resolves to a ChildField.ColumnReferenceField carrying CallSiteCompaction.NodeIdEncodeKeys (finding H, where the _entities DIRECT path would bind the encoded global id undecoded into the VALUES table) fatally via a new AltResult.Fatal arm carrying the typed Rejection.invalidSchema, distinct from and not co-located with the existing non-fatal compound-id BuildWarning; the column lookup is refactored from lookupColumn to columnOf(field) so the caller can inspect the field instance before reducing to ColumnRef. Decode-into-rep for encoded @key values, the cast-axis defects in wire-coercion-cast-guard, and consolidating the replicated @nodeId-site predicate stay out of scope. Coverage: pipeline-tier RejectNonIdNodeIdPipelineTest (6 tests, asserting the typed ValidationError coordinate + RejectionKind + message for the non-ID input field, argument, and output field plus the federation encoded-@key sub-case, and the legitimate ID input/argument/output coordinates and federation NODE_ID happy path that must keep passing); no code-string assertions on generated bodies. Independent-session In Review → Done review; RejectNonIdNodeIdPipelineTest green 6/6 in isolation under -Plocal-db. NB: the full reactor is currently red on three JoinedTableInheritancePipelineTest failures owned by R389 (an unrelated In-Progress item that landed after R262, 6aa4bb3); R262’s own delivery is independently green and those failures route through R389, not this item. Sibling of R397 (@error on bare-entity query fields) and R273 (NodeId mismatch semantics).

R378 (3ca8428; Spec → Ready e5dcd59, Backlog → Spec f146e1e): Authored @nodeId filters now throw on a malformed or wrong-type id instead of silently dropping it to the unfiltered baseline (the reported soknadId: ["IKKE_EN_ID"] returns-the-whole-table bug). The four authored filter producers (argument-level same-table and FK-target in FieldBuilder, input-object-field same-table and FK-target in BuildContext) flip from CallSiteExtraction.NodeIdDecodeKeys.SkipMismatchedElement to ThrowOnMismatch; the Relay heterogeneous-id-source pattern is given up deliberately per the user decision. CompositeDecodeHelperRegistry’s `Mode.THROW body is enriched once (list and scalar arms) with a two-branch message computed from NodeIdEncoder.peekTypeId on the offending wire value: peeked == null || expectedTypeId.equals(peeked) reads as structurally-malformed ("not a valid <Type> id"), any other non-null prefix as well-formed-wrong-type ("decodes to type <got>, expected a <Type> id"); the expected typeId is threaded onto HelperRef.Decode as a generation-time constant so the right-type-wrong-arity sub-case folds into the malformed branch. Error surfacing took path B (forward-compatible with a future query @error lift, R397): a generated <outputPackage>.schema.GraphitronClientException (subclass of graphql.GraphqlErrorException, so natively a GraphQLError, channel-matchable, serialisable into the errors array, serialVersionUID emitted for clean -Xlint:serial) is the stable client-error marker the THROW arm raises; new ErrorRouter.surfaceClientErrorOrRedact walks the cause chain and surfaces a GraphitronClientException’s real message while still redacting genuine internal faults to a correlation id, and the no-channel catch disposition is repointed at it uniformly across `TypeFetcherGenerator (renamed noChannelCatchArm), MultiTablePolymorphicEmitter, and ChannelCatchArmEmitter’s empty arm. Deliberate boundaries held: the two `_NODE* synthesis-shim arms stay on SkipMismatchedElement (R273/shim-retirement track), and LookupValuesJoinEmitter’s separate N×M decode-throw site keeps its plain `GraphqlErrorException and still redacts (the R195/R315 record-decode boundary). No new validate-time rule (both arms and both registry modes were already fully implemented, so the flip introduces no unhandled classification; "validator mirrors classifier" satisfied vacuously). Coverage: execution-tier GraphQLQueryTest (malformed surfaces the real message naming the bad value + not a valid Film id; wrong-type surfaces decodes to type "FilmActor" / expected a Film id; mixed surfaces; input-object-field filter surface exercises the soknadId shape; a genuine internal fault still redacts to a correlation id, pinning the surface arm narrows to the client-error type; empty-list R375 baselines retained), pipeline-tier NodeIdPipelineTest / IdReferenceShimClassificationTest (authored arms pinned to ThrowOnMismatch, shim arms held at SkipMismatchedElement), unit-tier CompositeDecodeHelperRegistryTest + ErrorRouterClassGeneratorTest + GraphitronClientExceptionClassGeneratorTest (registry tests assert on code strings by that file’s existing convention; behaviour proven at the execution tier). Independent-session In Review → Done review; full reactor green under mvn -f graphitron-rewrite/pom.xml install -Plocal-db (GraphQLQueryTest 283, :graphitron 477 / :graphitron-sakila-example tiers all 0 failures). Orthogonal to R375; predecessor of R397.

R121, R296 (Backlog items, discarded as superseded by R398): the redundant-@splitQuery-on-@record LSP diagnostic (R121) and the deprecated-directive-usage BuildWarning (R296) are folded into R398’s starter lint-visitor set (visitors 9 and 8 respectively). Neither shipped a standalone implementation; their intent moves wholesale into the R398 SDL lint engine, which evaluates such rules build-side and projects them into the LSP. The build-tier @splitQuery warning R121 layered on already exists (FieldBuilder.warnIfSplitQueryOnRecordParent); R398 formalizes it as a visitor and adds the edit-time surface. IDs R121 and R296 are retired and not reused.

R395 (27325cd3e implementation, fixture-comment rework 7febb70b3; Spec → Ready 05e652893, Backlog → Spec bd0287f3e): Qualify the discriminated-interface discriminator column off the FROM table’s own jOOQ instance, not the @table(name:) directive string. R388 had changed the three discriminator SQL-emission sites in TypeFetcherGenerator (the discriminator routing projection in buildInterfaceFieldsList, the …​ IN (knownValues) restriction in buildDiscriminatorFilter, and the cross-table LEFT JOIN ON-clause gate in buildCrossTableJoinChain) to qualify via tableRef.tableName(), the verbatim case-preserved directive string. jOOQ renders the FROM table by its real schema-qualified, case-folded catalog name, so whenever the directive name differed in case or schema the qualifier did not match FROM and Postgres rejected the query with missing FROM-clause entry (reported against 10.0.0-RC21 by the opptak consumer: @table(name: "INNBOKS_MELDING") over kommunikasjon.innboks_melding). All three sites now emit <tableLocal>.getQualifiedName().append(DSL.name(col)) typed Object.class (so the .as / .in / .eq chains compile), producing the exact qualifier jOOQ renders in FROM by construction; tableRef.tableName() no longer reaches any discriminator site, and the read-side fourth site stayed correct (R392 had routed the TypeResolver off the synthetic discriminator alias). The default-schema path does not over-qualify because the rewrite sakila tables sit in jOOQ’s unnamed default schema (getQualifiedName() contributes no schema part). Coverage: four regression-lock unit assertions in TypeFetcherGeneratorTest pin each site to the table-instance qualifier and forbid the directive-name string via a case-mismatched INTERFACE_BASE fixture (the case/schema-mismatch dimension lives here); a non-default-schema execution guard MultiSchemaQueryTest.signalsRouteToDiscriminatedTypesUnderNamedSchema over a new multischema_a.signal @discriminate interface (AlertSignal carrying a cross-table @reference to widget, NoticeSignal) covers the dimension R388 regressed on; the default-schema guards PolymorphicProjectionQueryTest and GraphQLQueryTest allContent / allSubjects confirm no over-qualification. Documented deviation: the execution fixture uses the unqualified @table(name: "signal") rather than the spec’s schema-qualified / upper-case form, which a separate @reference FK-connection check (filed as R396) rejects; the unqualified directive still renders FROM as "multischema_a"."signal" and so still fires the pre-fix bug, matching the reported consumer shape. In Review → Done reviewed by a session distinct from the implementer; full reactor green under mvn -f graphitron-rewrite/pom.xml install -Plocal-db.

R386 (c68b000 implementation; Spec → Ready 270b0c1, Backlog → Spec 3c6430b, filed 27d9c9e): catalog.search MCP tool (R118 slice 10) ; the semantic counterpart to the structured catalog.tables / catalog.describe, giving an MCP-aware agent fuzzy natural-language discovery over the database catalog ("where are customer addresses stored?") so a developer pointing graphitron at a large existing schema finds tables without knowing their SQL names. CatalogDescriptors is a pure, ONNX-free composer that turns each R362 CatalogFacts.Table into one readable descriptor carrying both the raw SQL token (so BM25 matches film_actor exactly) and its normalized words (a state-machine splitWords splitting snake_case / camelCase / acronym / digit runs ; customerID → "customer id", IDColumn → "id column", address2 → "address 2" ; the model-agnostic retrieval lift of R118 OQ3), degrading to names-only when jOOQ captured no comments (OQ4); the SHA-256 corpusHash is length-prefixed over the exact descriptor strings handed to embedDocuments, so the hashed thing and the embedded thing cannot drift. CatalogSearchIndex owns the warm-managed, self-observing Lucene index, mirroring R374’s ReverseEdgeIndex.Cache (no BuildArtifacts component, no Workspace field, no DevMojo listener): each search reads the live catalogFacts through two gates ; reference identity (the cheap common path), then content hash (a no-op recompile that swaps the reference but not the content re-embeds nothing) ; and a changed hash kicks an AsyncWarm re-embed off the classpath-watcher thread, re-entering the existing WarmState.Warming shape (no new "refreshing" state) so the prior Ready index keeps serving while the new one builds. The index persists under ${project.build.directory}/graphitron-mcp-rag/catalog/<corpusHash>/ as a Lucene FSDirectory (survives dev restarts, dies on mvn clean), with an embedder-identity manifest (getClass().getName() + dimension()) written beside each index so loading a future multilingual-e5-small index under the English bge embedder (both 384-dim, indistinguishable by dimension alone) is rejected and rebuilt rather than silently mis-served (closes the R118 OQ2 cross-model trap now); sibling hash dirs are reaped keeping the current plus one prior. The tool takes query (required) + limit (default 10), returns {status, results:[{id, schema, name, comment?, score}]} by the same schema-qualified SQL id catalog.describe accepts (discovery hands off to description), and returns the shared WarmState.degradationMessage + {status: warming|failed} while the index is not Ready. Threaded through GraphitronMcpServer’s widened five-arg constructor (`RagConfig as a growable record, back-compat overloads default it to a temp dir) and DevMojo.bindServer (supplying the build-dir cache root); the multilingual swap is flagged, not done. Coverage: unit-tier CatalogDescriptorsTest (split normalization cases, comment-present vs name-only degradation, raw+normalized tokens, length-prefixed hash stability/segmentation) and CatalogSearchIndexTest over FakeEmbedder + FSDirectory (hash-gated re-embed via an embed-call-count spy, warming-on-change re-entry, embedder-identity rejection-then-acceptance, persistence round-trip + current-plus-one-prior reaping, cross-warm Failed propagation), MCP-handler-tier GraphitronMcpServerTest (catalog.search advertised in tools/list; a ready-arm call returns ranked schema.table ids whose top feeds a follow-on catalog.describe; the warming-arm call returns status: warming ; structured-content assertions only), and infrastructure-tier @Tag("slow") CatalogSearchOnnxTest (real bge ONNX embeds a Sakila-shaped CatalogFacts, asserts public.address / public.payment rank for natural-language queries ; the retrieval-quality + normalization payoff pin); no code-string assertions on generated bodies. getting-started.adoc gains the agent-facing tool note (semantic search, the warming/refresh behaviour, the jOOQ-comment-capture lift). Builds on R372 (RAG foundation: Embedder + the Lucene EmbeddingStore), R362 (CatalogFacts + the schema-qualified ids), and R341/R361 (the graphitron-mcp module + the shared-model / dev-trigger seam); sibling of R385 (docs.search, slice 9). In Review → Done reviewed by a session distinct from the implementer; full reactor green under mvn -f graphitron-rewrite/pom.xml install -Plocal-db.

R392 (d832aaa, In Review flip 2a808d4): Route the discriminated single-table interface (@table + @discriminate) TypeResolver off a synthetic discriminator alias instead of the raw column name. R388 qualified the three SQL emission sites but left a fourth, read-side site: the generated TypeResolver read the discriminator with a bare record.get(DSL.field(DSL.name(col))). When the interface also exposes the discriminator as a queryable field, the participant $fields projects the real catalog column too, so the result carries the discriminator twice (the two-part routing add and the three-part schema-qualified column); the bare read matches both and jOOQ logs Ambiguous match found, resolving to the first by luck. Fix mirrors the multi-table typename convention: a shared MultiTablePolymorphicEmitter.DISCRIMINATOR_COLUMN = "discriminator" constant (declared with its collision rationale, reaching generated code only as string literals ; a .as("discriminator") projection and a record.get(DSL.name(…​)) read), projected under that alias in TypeFetcherGenerator.buildInterfaceFieldsList and read back in GraphitronSchemaClassGenerator, so routing is unambiguous and the user-facing discriminator field still resolves from its own column. The WHERE filter and LEFT JOIN ON-clause keep referencing the real qualified column (unaffected). Coverage: execution-tier GraphQLQueryTest.allSubjects_discriminatorFieldInsideFragment_routesViaSyntheticAlias (discriminator field selected inside the inline fragment; asserts routing per type plus the as "discriminator__" projection via SQL_LOG) and the schema-generator unit test build_typeResolver_routesOffSyntheticDiscriminatorAlias (alias read replaces the raw-column read, per that class’s documented runtime-dispatch-infrastructure body-content exception). Residual hole left by R388; first-class per-participant @table joined-table inheritance remains R389. Independent-session In Review → Done review; full reactor green under -Plocal-db.

R383 (6df5616 implementation, In Review flip 0770918; Spec → Ready 0657369): Support nested-input @field filters on multitable interface/union root queries. R363 lowered @field-mapped filter inputs onto multitable interface/union fields but scoped day one to the branch-safe top-level extractions (Direct / EnumValueOf / ContextArg), so the idiomatic input-object shape (occupants(filter: OccupantFilter) with OccupantFilter { firstNames: [String!] @field(…​) }) lowered to a NestedInputField(filter → firstNames, leaf) call-site extraction that FieldBuilder.firstUnsupportedFilterArg rejected at classify time with an author-error, even though the leaf is a plain scalar; consumers hit it as a hard build failure on an ordinary filter-input schema. The fix is a classifier relaxation only, no registry / lift-context plumbing: FieldBuilder.isBranchSafeExtraction becomes a recursive switch where a NestedInputField is branch-safe exactly when its leaf is (Direct / EnumValueOf / ContextArg admitted; a NodeIdDecodeKeys leaf stays rejected through the recursion, a developer @condition stays rejected by the GeneratedConditionFilter guard), and the switch is exhaustive over the sealed CallSiteExtraction with no default (the five non-branch-safe permits listed as explicit false arms) so R384 lifting one fails to compile and forces a deliberate decision at this gate. The "this list-typed nested leaf extracts as (List<X>) map.get(key), an unchecked cast" fact is lifted onto the model as CallParam.emitsUncheckedCast() (single source of truth, Generation-thinking); both hosts (MultiTablePolymorphicEmitter’s `buildMainFetcher / buildRootConnectionFetcher and the single-table QueryConditionsGenerator) fold over their call params and ask the model rather than each re-deriving list() && instanceof NestedInputField, so R384 adds its unchecked-emitting arm in one place and neither host can drift. The condition-method generator is extraction-agnostic, so the generated <Participant>Conditions method is byte-identical whether the value arrives top-level or Map-traversed. Coverage: pipeline-tier MultiTableFilterLoweringTest (nestedInputFieldFilter_lowersPerParticipantWithNestedExtraction asserts the NestedInputField(filter → firstNames, Direct) call param per participant; nestedInputFieldCondition_rejectedStructuralNotDeferred keeps a nested-input developer @condition a structural author error) and execution-tier MultiTableFilterExecutionTest over AddressOccupant = Customer | Staff (occupantsByFilter(filter: { firstNames: […​] }) filters per branch and returns one matching row each, an empty filter narrows by nothing), with a new sakila OccupantFilter input + Query.occupantsByFilter fixture; no code-string assertions on generated bodies. The converted (JooqConvert / ID-typed), @nodeId-decoded, and developer-@condition kinds remain deferred to R384, which carries the registry / FK-target-alias plumbing they need. Builds on R363; sibling of R384. In Review → Done reviewed by a session distinct from the implementer; full reactor green under mvn -f graphitron-rewrite/pom.xml install -Plocal-db.

R390 (5485578, In Review flip 92e7e16): Retain the connection carrier element subgraph in the rebuilt assembled schema. A @table type reachable only through a directive-driven @asConnection carrier was pruned by SchemaTransformer once ConnectionPromoter.rebuildAssembledForConnections retyped the bare-list carrier to name its synthesised Connection: the element type then hangs off the Connection’s nodes / Edge’s node GraphQLTypeReference`s, which the transform treats as leaves, so an element reachable nowhere else (a nested-only chain), and its whole transitive subgraph, dropped out, either silently (its `<Type>Type schema class never emitted, the consumer’s RC20 cannot find symbol javac failure) or as an NPE in the type-reference resolver when a surviving typeRef still pointed at it; because the element was never traversed, a nested carrier’s own @asConnection rewrite was also skipped, leaving that field a bare list while its fetcher was connection-shaped (the report’s variant-3 mismatch). Fix pins each rewritten carrier’s element type (resolved off the pre-rewrite schema by carrierElementType, null-degrading when the parent/field/base type can’t be found) as a GraphQLSchema.additionalType before the transform, deduped by name alongside the synthesised types; every carrier at every nesting depth is in the rewrite set, so pinning the direct carrier elements keeps each element and its concretely-reachable subgraph alive and every nested rewrite applies. Structural (SDL-declared) connections are untouched (no typeRef introduced, element stays concretely referenced). Coverage: pipeline-tier NestedConnectionElementRetentionPipelineTest (2: a Store --@asConnection-→ Customer --@reference-→ Payment nested-reference chain retains both element types in the rebuilt assembled schema; a --@asConnection-→ nested chain retypes Customer.payments to CustomerPaymentsConnection! rather than leaving a bare list, with the synthesised ConnectionType classified), structural assertions only, no code-string assertions on generated bodies. In Review → Done reviewed by a session distinct from the implementer; full reactor green under mvn -f graphitron-rewrite/pom.xml install -Plocal-db.

R385 (b0afcf8 implementation, 6cb322a README regen, d751110 rework, In Review flip ee71c81; Spec → Ready 5cdcbe5, Spec 2f014ce, filed 27d9c9e): docs.search MCP tool (R118 slice 9) ; build-time .adoc chunking + a pre-embedded bundled index, async-loaded at startup for semantic retrieval over the public manual, and the first slice to wire R372’s async-warm lifecycle into the running server + DevMojo. AdocChunker is a pure (adoc, sourcePath) → List<DocChunk> that walks raw .adoc heading syntax (no AsciiDoctor render, so it stays off the docs module’s JRuby cost), splitting on section boundaries with an opt-in // rag:split override, fenced-block awareness (== inside a ---- listing is body, not a heading), explicit override, and a heading-path breadcrumb prepended to each chunk’s embed text so a passage keeps its context. DocsIndexBuilder (bound to process-classes via exec-maven-plugin, reading the public manual under a declared <docs.source.dir>) chunks + embeds via BgeEmbedder.embedDocuments and writes the bundle to target/classes/mcp/docs-index/, gated by a SHA-256 content-hash stamp so an unchanged inner loop skips the ONNX cost. Bundle divergence (settled at Spec): rather than a literal Lucene FSDirectory (unreadable from a jar, would force temp-dir extraction), DocsBundle packages pre-embedded (id, embedText, payload, vector) tuples behind a (magic, version, dimension, count) header with explicit byte-length string prefixes (past the writeUTF 64 KB ceiling); the docs warm rebuilds an in-memory LuceneEmbeddingStore.inMemory(dimension) by re-add()-ing the tuples, re-embedding nothing at runtime. The store-opaque payload is a dependency-free URL-safe Base64 encoding (not the spec’s literal "payloadJson") ; a JSON parser would widen the module’s quarantined RAG dependency surface for a string only this module produces and consumes; this is the slice’s one principled divergence and is documented inline. DocsSearchTool embeds the query (embedder.embedQuery), runs the EmbeddingStore seam, and returns ranked passages with headingPath / sourcePath / anchor / text / score / a https://graphitron.sikt.no/…​; deep link; a once-memoised dimension guard reconciles the runtime embedder against the bundle’s build-time width and degrades cleanly on skew rather than throwing an opaque Lucene KNN error; either warm absent or not-Ready returns the shared WarmState.degradationMessage and no hits, leaving the dev loop structured-only. Wired through GraphitronMcpServer’s new structured-only / injected-warm two-constructor seam and owned by `DevMojo. Rework (returned to Ready at df7525a, re-landed at d751110): the first In Review pass failed the gate on a red build ; DevMojoTest paid a real BgeEmbedder ONNX load that SIGSEGV’d the surefire fork, and the MCP-bind-failure catch arm leaked the warms it had started. Fixed with a package-private warm-factory seam on DevMojo (mirroring the server’s injected-warm pattern; mojoFor defaults to structured-only null warms, the bind-failure test swaps in ONNX-free fakes) and an awaitAndCloseWarms() that joins each warm to its terminal state and closes the warmed docs store on the bind-failure unwind before rethrowing. Coverage: unit-tier AdocChunkerTest (5: nested heading paths, // rag:split override, malformed-rag:-comment near-miss is body not a split, fenced-block heading-syntax is body, explicit anchor override), DocsBundleTest (3: write→read count/ids/dimension/vector-width round-trip, separator-collision-safe payload decode, header-only readDimension), pipeline-tier DocsRagWarmPathTest (the production loadDocsIndex loader end-to-end), MCP-handler-tier GraphitronMcpServerTest (warming/failed/ready/dimension-mismatch cases, structured-content assertions), and DevMojoTest (the bind-failure unwind leaves no live warm and freed the docs store); the build-time ONNX embed itself stays out of the fast suite (R372’s @Tag("slow") BgeEmbedderOnnxTest covers the real load). getting-started.adoc gains a paragraph. Builds on R372 (RAG foundation) and R341/R361 (the graphitron-mcp module + live-Workspace seam); sibling of R386 (catalog.search, slice 10). In Review → Done reviewed by a session distinct from both implementer sessions; full reactor green under mvn -f graphitron-rewrite/pom.xml install -Plocal-db (DevMojoTest 6, GraphitronMcpServerTest 37, AdocChunkerTest 5, DocsBundleTest 3, DocsRagWarmPathTest 1; no SIGSEGV).

R379 (6f68611; Spec → Ready 713d464, spec revise 07c7dd3, Spec/filing db865ef/1d8a78f): Validate that an @reference path’s joins compile, moving two javac-in-generated-code failure modes to build-time classification. Check 1 (terminal hop lands on the return table): InlineTableFieldEmitter.buildArm feeds the terminal hop’s alias to a $fields overload typed for the field return type’s @table, so a terminal hop landing elsewhere (the NusGrupperingFagfelt @table("NUSFAGFELT") reached via a path ending on NUSFAGGRUPPE reproduction, found in a downstream subgraph build) compiled to an incompatible-types error in a consumer’s build. BuildContext.parsePath now computes a typed TerminalTargetVerdict (Match / Mismatch(fieldName, terminalTableName, returnTableName) / NotApplicable) over R232’s already-resolved terminal JoinStep.HasTargetTable.targetTable() and threads it onto ParsedPath, never re-deriving the hop kind from the directive element; the Mismatch diagnostic is formatted from the record’s fields so message and projection cannot drift. Check 2 (condition-method parameter tables): a two-argument condition method (a ConditionJoin ON clause or an FkJoin.whereFilter) emitted positionally as method(sourceAlias, targetAlias) that concretely types a jOOQ Table parameter must match the alias the emitter passes it; validateConditionParamTables / checkConcreteParamTable check parameter 0 against the hop source and parameter 1 against the hop target at each condition resolution site, skipping the idiomatic wildcard Table<?> signature (unverifiable, fully accepted) and routing mismatches through the existing errors → Rejection.AuthorError.Structural channel. Deviation (scope correction, agreed at review): the spec’s draft said to self-reject inside parsePath, but parsePath is shared by callers (@tableMethod, @nodeId, RecordTableField) that carry their own terminal-target checks (FieldBuilder.java:4692/:5778); self-rejecting there would preempt them and re-introduce the Generation-thinking same-predicate-two-consumers smell the item cites. Check 1 instead threads the typed verdict and rejects only at the two inline output callers (TableBoundReturnType, TableInterfaceType in FieldBuilder), the sole emit shape carrying the $fields(terminalAlias) invariant, double-gated on non-null start (excludes @sourceRow) and non-null return table (excludes input-field sites). The verdict is also the typed hook R381 Slice B consumes. Coverage: pipeline-tier ReferencePathTerminalTargetTest (7: terminal {table:} / {key:} / multi-hop landing on the wrong table rejected with pointed diagnostics, happy-path mirrors, a pre-existing mid-path-disconnect regression fence) and ReferencePathConditionParamTest (6: both carriers and both parameter positions rejected, wildcard (Table<?>, Table<?>) and matching-concrete happy paths) over deliberately-mistyped TestConditionStub fixtures, message-content assertions only, no code-string assertions on generated bodies; no emitter behaviour change. In Review → Done reviewed by a session distinct from the implementer; full reactor green under mvn -f graphitron-rewrite/pom.xml install -Plocal-db.

R363 (2ede6e4 implementation, 73bc057 self-review scope-tightening; Spec → Ready 66cb717, spec revises 6a3076d/50a4db9/413753a): Lower @field-mapped filter inputs onto root multitable interface/union query fields, closing a data-correctness leak where a filtered slice was requested but the rewrite emitted a bare UNION ALL and returned every row. The filter surface is per participant, not a single shared list: the same logical @field filter resolves to a different table-specific WhereFilter per participant (e.g. FeideApplikasjonConditions.… vs MaskinportenApplikasjonConditions.…), so a new field-local model/ParticipantFilters record pairs each ParticipantRef.TableBound with the filters lowered against its own table; the carrier is not a component on the type-scoped shared ParticipantRef, and the two fields stay off SqlGeneratingField (their return type is PolymorphicReturnType, a sibling of the TableBoundReturnType the capability’s returnType() requires, so implements would not compile). FieldBuilder lowers once per table-bound participant via resolveTableFieldComponents against the participant table with a participant-named conditions class (participant.typeName(), not elementTypeName, so the per-participant methods do not collide), surfaces any participant’s Rejected (absent or type-incompatible column) as the field’s rejection, and dedupes the @asConnection same-table advisory across the N participant calls. @condition (field- or argument-level) is rejected before the per-participant loop with a non-deferred Rejection.structural (no dangling planSlug), since resolveTableFieldComponents itself lowers a @condition bound to whatever table it is handed; guarding after the loop would pin the developer’s single-table method to the wrong table on N-1 branches. MultiTablePolymorphicEmitter threads a typename-keyed filter map into both branch loops, ANDing each participant’s predicate into its stage1_<Type> branch WHERE (buildStage1Block combines it with the existing parent-FK predicate; buildStage1ConnectionBlock gains a per-branch WHERE it never emitted before); TypeConditionsGenerator is wired to the polymorphic fields' participantFilters since they are not SqlGeneratingField. The self-review pass narrowed day-one extraction scope to the branch-safe Direct / EnumValueOf / ContextArg kinds: FieldBuilder.firstUnsupportedFilterArg structurally rejects JooqConvert (deprecated-for-removal DataType.convert trips the consumer -Werror), NodeIdDecodeKeys (needs the CompositeDecodeHelperRegistry), and nested-input / developer @condition filters (the classifier-guarantees-emitter-assumptions floor that lets branchFilterWhere drop all registry/alias plumbing), with R383 filed for lifting the rest. orderBy is split to R382 (sort doubles as the connection cursor seek key). Coverage: pipeline-tier MultiTableFilterLoweringTest (per-participant lowering for interface + union; absent-column rejection; ID-typed JooqConvert rejected structural; field- and arg-level @condition rejected structural, not deferred) and execution-tier MultiTableFilterExecutionTest (AddressOccupant = Customer | Staff, list + @asConnection forms filter per branch and return only matching rows, exercising both buildStage1Block and buildStage1ConnectionBlock); no code-string assertions on generated bodies. Shares MultiTablePolymorphicEmitter with R365/R366/R367. In Review → Done reviewed by a session distinct from the implementer; full reactor green under mvn -f graphitron-rewrite/pom.xml install -Plocal-db.

R374 (5193fdc; Spec → Ready 44b0146, Backlog → Spec fbb6c1f, filed b106ccc): MCP cross-reference edges (R118 slice 7): the traversal layer over the frozen R362/R368 structured tools, all module-local to graphitron-mcp. A new edges tool (D-A, a dedicated tool rather than a neighbours field retrofitted onto every result, so the eight existing contracts stay frozen) takes exactly one node selector (field / type / table / column+table / method / class) plus a direction (out / in / both) and returns that node’s typed neighbours. D-D: a sealed NodeRef model (TypeNode / FieldNode / TableNode / ColumnNode / MethodNode / ClassNode) owns the whole stable-ID grammar and composes each wire string only at the McpWire boundary (methodRef / new columnId), reconciling the classifier’s bare table names through CatalogFacts.resolve (the qualified schema.table IDs catalog.describe accepts) and its arity-free (class, name) method pairs through the external-reference scan (one RESOLVES edge per overload). D-B: an EdgeKind label enum (BACKS / TARGETS / REFERENCES / RESOLVES / PARTICIPATES) with the varying endpoint shape pushed entirely into NodeRef.target, so the enum carries no kind-dependent nullability (the sealed-over-enum tension resolved); the TARGETS / REFERENCES split falls out of the classifier’s joinPath distinction rather than being re-derived. The arm-to-kind mapping is an exhaustive no-default switch over every FieldClassification (28) and TypeClassification (23) permit, mirroring SchemaView ; the cross-module drift guard: a new classifier permit fails the edge switch to compile. D-C: a lazy, (snapshot, catalogFacts)-reference-pair-memoised ReverseEdgeIndex (the slice’s real deliverable, for impact analysis: which schema fields bind a given column / method / table), built by inverting the same per-field switch the forward producer uses so the two directions cannot disagree, holding no new BuildArtifacts / Workspace field. Stage 3 (neighborhood subgraph tool) and indexing the forward-walkable PARTICIPATES (type → type) direction correctly deferred per R118 OQ6. Deviation from the spec’s mcp/edges/ sub-package: the edge model stays in the flat mcp package to reuse McpWire’s package-private grammar composers, single-sourcing the wire grammar rather than widening `McpWire’s deliberately-internal surface ; judged sound (it serves the same boundary-encoding principle D-D leans on). Coverage: MCP-handler-tier `GraphitronMcpServerTest (forward Column / ColumnReference-with-joinPath / table-bound ServiceBacked / @node-type; reverse column / method / table directions asserting the endpoint slot holds the field not the queried node; ambiguous / notFound / two-overload fan-out reconciliation; Unavailable-before-build and memo-rebuild-on-build-swap), structured-content assertions only, plus unit-tier EdgeCoverageTest partitioning every permit into edge-bearing / no-edge with overlap / missing / stale guards (the live drift-guard pin). In Review → Done reviewed by a session distinct from the implementer; graphitron-mcp module suite (52) and all 35 R374 tests green under mvn -f graphitron-rewrite/pom.xml install -Plocal-db (one full-reactor run flaked on the unrelated R372 BgeEmbedderOnnxTest strict-margin similarity assertion, which passes in isolation and on a focused module run; untouched by R374).

R377 (b44de9b; Spec → Ready 2afdec9, Backlog → Spec 212f21c, filed 26e82a0): decode<typeId> mismatch when multiple @table types share a table. BuildContext.resolveDecodeHelperForTable resolved through findGraphQLTypeForTable, an all-@table index that counts nesting-projection types and so returns empty (ambiguous) for any table backed by more than one object type; that routed decode resolution to a typeId-named fallback (decode<typeId>), which agrees with NodeIdEncoderClassGenerator’s emitted `decode<TypeName> only when typeId equals the type name. A customized numeric @node(typeId:) over such a table (a @node plus a nesting-projection @table, e.g. UTDANNINGSMULIGHET) emitted a decode<typeId> call javac could not resolve, a latent error that surfaced only in the consumer’s compile, found porting utdanningsregisteret to Graphitron 10. Fix: rewrite the resolver to the @node-only NodeIndex by-table view (nodes.forTable), which is exactly the right domain (it sees only @node types, not the projection types sharing the rows), with a three-way outcome: one node → its decodeMethod() (type-name keyed, matching the encoder); two or more → null, which the four callers already map to a validate-time "zero or multiple GraphQL types map to it" rejection rather than a phantom decode<typeId> (validator mirrors classifier invariants); no node → the orphan-input typeId fallback (synthesis-shim retirement track, retire-synthesis-shims.md). The wrong-domain branch 1 is dropped entirely rather than masked behind branch ordering; findGraphQLTypeForTable stays for its one remaining caller (the id-reference synthesis shim). The casing divergence is closed structurally: NodeIndex.byTable is keyed on the lowercased @table(name:) echo at construction (TypeBuilder.buildClassificationIndices) and NodeIndex.forTable lowercases its lookup arg, so a consumer never re-establishes the TableRef.sameTable contract. Coverage: three pipeline-tier NodeIdPipelineTest cases (decode-via-index-not-typeId asserting decodeSharedNode not decode10154; multi-node rejection to UnclassifiedType with the "zero or multiple" message; orphan-input typeId fallback pinning the branch-1-drop decision) over a new nodeidfixture.shared_node table with a customized numeric typeId, plus a graphitron-sakila-example compilation backstop (FilmEndorsementNode @node(typeId: "920534") over film_endorsement, already backed by the FilmEndorsement projection, decoded by a new endorsementsByNodeId query) so the javac-stage failure is caught end-to-end by the module’s <release>17</release> compile; structural assertions only, no code-string assertions on generated bodies. In Review → Done reviewed by a session distinct from the implementer; full reactor green under mvn -f graphitron-rewrite/pom.xml install -Plocal-db.

R375 (8e0887a code, fe4303d plan-body test-name fixup; Spec → Ready 0147443, Backlog → Spec 4b443e9, filed b804f4c): Empty list passed to a fetch-path list-IN filter now narrows by nothing (DSL.noCondition() identity) instead of emitting IN (), which jOOQ renders as the constant false and silently zeroed the query. An external bug report (10.0.0-RC18, regression from 9.3.0) hit this through Apollo Client serialising an empty selection as [] on a list @nodeId filter argument: the empty list AND-ed an unsatisfiable predicate into the WHERE and dropped every row. The rewrite has no hasIds branch (R50/e4b collapsed list @nodeId filters without @condition onto a plain column-shaped BodyParam.In/RowIn), so the symptom was general to every list-IN filter, not @nodeId-specific. Fix: a literal empty guard on all four In/RowIn arms of TypeConditionsGenerator.buildConditionMethod (non-null if (!arg.isEmpty()); nullable folds the emptiness into its existing != null check); Eq/RowEq unchanged (scalars have no empty state). The fetch/lookup split is principled, not a per-field carve-out: on a fetch field a list filter is an optional narrowing predicate whose empty identity is noCondition (the list-arity sibling of the null/omitted case R230 already drops), while a lookup field’s input rows are the FROM-side of a VALUES…JOIN (LookupValuesJoinEmitter), where empty is an empty join domain and 0 rows is the only coherent answer; TypeConditionsGenerator already excludes LookupField upstream (line 63). The guard is emitted as a literal, not lifted into a sealed EmptyBehavior model slot: within this emitter "drop on empty" is a constant invariant with a single value, so the Generation-thinking two-consumer trigger does not fire and a single-case sub-taxonomy would be over-engineering (the DML-consumer lift point is named for if one ever appears). Scope item surfaced during implementation: filmsByNodeIdArg (argument-level same-table @nodeId, R106-lifted onto the WHERE film_id IN (…​) rail) is a fetch field, so its empty and all-malformed execution tests carried stale pre-R106 lookup wording and asserted the empty set only because IN () = false coincidentally zeroed the query; both inverted to the unfiltered baseline. The all-malformed case (SkipMismatchedElement drops every id → empty List<Integer>, indistinguishable from a literal [] at the condition method) follows the same noCondition rule per the wire-format-boundary principle (decode classifies skip-vs-throw at the boundary; downstream sees tuples with no provenance), and whether all-malformed should instead surface a user error is correctly split out to R378 (decode strictness, Backlog). Coverage: pipeline-tier TypeConditionsGeneratorTest (!ids.isEmpty() assertions on the In and RowIn arms + new inFilter_nonNullList_emitsEmptyGuardWithoutNullCheck pinning the non-null arm the nodeId helpers don’t reach), execution-tier GraphQLQueryTest (inverted films_filteredBySameTableNodeId_emptyListReturnsUnfilteredBaseline, new connection regression filmsConnectionByOptionalIds_idsEmptyList_paginatesFullTableAndCountsAll asserting nodes + totalCount both unfiltered, inverted filmsByNodeIdArg_{emptyList,allMalformedIds}_returnsUnfilteredBaseline, and the lookup-divergence comment on inlineLookupTableField_emptyInput_returnsEmpty). In Review → Done reviewed by a session distinct from the implementer; full reactor green under mvn -f graphitron-rewrite/pom.xml install -Plocal-db (GraphQLQueryTest 275, full suite 461 + 65, 0 failures).

R376 (64c6f23 implementation, 35a2e7e stale-javadoc cleanup; Spec → Ready f3f2a26, spec refinements e60d49b 52fc227, filed 21c4e62): Goto-definition (and the declaration-name hover overlay) on a method-backed SDL field name now jumps to the bound Java method, not just the column / accessor / record-component cases that resolve through the enclosing type’s backing. A @service / @externalField / @tableMethod field (and its root query/mutation forms) previously had no field-name jump at all: the cursor had to be parked on the directive’s method: / className: argument before Definitions would navigate. The bound class+method were already resolved on the snapshot’s FieldClassification; goto and hover simply never consulted it for the name trigger. Routing: a new DeclTarget.methodBackedTarget arm consults built.fieldClassification(parentType, member) before the TypeBackingShape dispatch in ofField, so a method-backed classification (six variants: ServiceBacked, Computed, TableMethod, QueryService, QueryTableMethod, MutationService) takes precedence over the parent table’s column backing; it rides the already-projected snapshot (no source-index read in the pure core), keeping the R371 goto/hover structural parity intact. Arity, primary with a name-level floor: DeclTarget.SourceMethod widened from (class, accessorMethodName) to (class, methodName, paramCount) so both consumers key the source index on the same overload, retiring the hover overlay’s arity-0 hardcode (correct only for zero-arg POJO accessors; a service method takes at least a DSLContext, which would have made goto jump while hover returned empty, violating overlayIsPresentExactlyWhenGotoJumps). SourceWalker.Index gains a never-dropped methodsByName view and resolveMethod: the precise (class, name, arity) key first (lands on the correct overload), falling back to the name-level view when that key is absent or was dropped as a same-arity collision, so a same-arity overload still lands on a declaration adjacent to the set rather than declining. DefinitionTarget.Ambiguous is retired: the directive-arg Definitions.methodTarget path is aligned to the same floor (no Ambiguous non-jump remains anywhere on the navigation path, the spec’s open-question fold-in). Two documented, safe-degrading assumptions: the method-backed arm uses default → empty over the 32-variant FieldClassification rather than an exhaustive switch (a future method-backed variant silently won’t extend, scoped out by the spec forbidding a FieldClassification model change), and keys the lookup on the resolved member name, relying on method-backed fields carrying no @field(name:) override (a miss degrades to the prior no-jump, never a wrong jump); for an arity-overloaded service name the classification records no signature, so resolve() takes the first catalog candidate’s arity and the name floor still guarantees a jump. Spans graphitron-lsp plus the small SourceWalker.Index addition in graphitron. Coverage: DeclarationDefinitionsTest (the four named variants jump end-to-end; an arity-distinguishable greet() vs greet(String,int) resolves to the correct overload, not the name floor; a same-arity collision still jumps via the floor; classified-but-unindexed returns empty), DefinitionsTest (the former Ambiguous case now falls back to a name-level jump), DeclarationHoverOverlayParityTest (a non-zero-arity SourceMethod parity case). In Review → Done reviewed by a session distinct from the implementer; full reactor green under mvn -f graphitron-rewrite/pom.xml install -Plocal-db (graphitron-lsp suite + 461 + 65, 0 failures).

R372 (c2acec1; Spec → Ready 5dadff3, Backlog → Spec c154ce2, filed 47e4e24): MCP RAG foundation (R118 slice 8): the semantic-layer infrastructure the docs.search (slice 9) and catalog.search (slice 10) tools sit on, all module-local under graphitron-mcp/…​/rag/, registering no agent-facing tool and leaving GraphitronMcpServer untouched. Three seams plus one lifecycle. D1: a graphitron-owned Embedder seam (embedQuery / embedDocuments / dimension) that owns the bge query/document asymmetry ; BgeEmbedder prepends the bge instruction prefix on the query path only ; and whose Query / Embedding records bundle BM25 text with its KNN vector and name no langchain4j type, so the multilingual swap (R118 OQ2) attaches to this wrapper, not the library; English-only bge-small-en-v1.5-q (384-dim) for V0. D2: an EmbeddingStore seam with LuceneEmbeddingStore (BM25 + KNN in one index, fused by reciprocal-rank fusion) as the sole shipping backend, an in-RAM ByteBuffersDirectory instance of the same class as the seam’s test fake, and the dimension invariant checked once at add against the embedder’s dimension(). D3: a generic sealed WarmState<T> over Warming / Ready / Failed with a handle-agnostic degradation-message helper (exhaustive switch, no default, rejects Ready), and the AsyncWarm<T> background-daemon harness whose await() returns the terminal value (never Warming) so a dependent build-warm maps an upstream Failed into its own Failed rather than hanging; volatile state read mirrors R361’s per-field posture. Dependency quarantine (R341): the one genuinely heavy native dependency (ONNX Runtime JNI, pulled transitively by the bge module) plus Lucene core land on graphitron-mcp alone, never the plugin’s compile surface; surefire on this module gains --enable-native-access=ALL-UNNAMED with no excludedGroups, so CI’s default mvn verify -Plocal-db runs everything. Coverage: seam-tier (fast, no ONNX) asymmetry routing, store KNN round-trip + BM25 hybrid surfacing a lexical match, dimension guard, load-only-rejects-add, WarmState transitions across both type parameters + await propagation / cross-warm failure; infrastructure-tier BgeEmbedderOnnxTest (@Tag("slow"), runs in CI) loads the real bge model asserting dimension 384 and a strict-margin similarity separation. In Review → Done reviewed by a session distinct from the implementer; full reactor green under -Plocal-db (RAG seam + ONNX tests all run, 0 skipped). Blocks slices 9/10/11.

R362 (ea47993 implementation; Spec → Ready 173a7d0, Backlog → Spec 304c39f, filed d7c8d15): MCP catalog.tables / catalog.describe over a build-time CatalogFacts projection (R118 slice 2, on the R361 seam). Resolves R361 D1 to build-time enrichment (option A, not a retained loader): a new frozen CatalogFacts record (tables keyed by schema-qualified SQL name; columns with SQL+Java names, SQL types, nullability, comments; PK / unique keys; indexes; in/out FKs with their column pairs) is built once per catalog rebuild in CatalogBuilder.buildCatalogFacts(JooqCatalog) while the codegen loader is open, carried as a third BuildArtifacts component beside CompletionData and the snapshot, and swapped onto a volatile Workspace.catalogFacts field in setBuildOutput. The load-bearing invariant (no Table<?> / ForeignKey<?,?> / Field / Class retained) is what lets the projection outlive the per-pass withCodegenScope loader close; new resolved-immutable JooqCatalog accessors (allTableEntries, candidateKeys(Table<?>), columnFactsOf, indexFactsOf, foreignKeyFactsOf) reduce every live handle to String at the parse boundary. GraphitronMcpServer registers the two tools mirroring the R361 statusTool shape: catalog.tables (schema + SQL-name-substring filters, opaque base64-offset cursor paging with nextCursor) and catalog.describe (resolved / ambiguous / not-found arms over a parallel CatalogFacts.TableResolution). sqlType maps to the jOOQ DataType.getTypeName() (SQL discovery key, not the Java FQN); no new classifier or validator branch (a read-only projection of already-classified facts). Coverage: pipeline-tier fact capture over the real Sakila catalog (film columns/PK/index/in+out FKs with column pairs, storage_bin unique key distinct from PK) plus a structural recursive no-live-handle walk and a close-then-read smoke test; MCP handler tests driving a real loopback server assert mapped structuredContent for list/filter/page and describe resolved/ambiguous/not-found. In Review → Done reviewed by a session distinct from the implementer; mvn install -Plocal-db green (CatalogFactsTest 9, GraphitronMcpServerTest 11, full suite 460 + 65).

R365 (3366bbe floor, 976e0a3 classifier+emitter, 0e82f71 execution fixture; In Review → Ready rework e7477ac, rework fix b28fe15, mutation fixture + drop-contract fd1f59e; Backlog → Spec b6a6f93, Spec → Ready 0426d42): Restore the graphitron 9.3 ability to return a polymorphic entity from a root @service field (route (a): the service hands back a PK-populated jOOQ TableRecord per branch, and the generated fetcher dispatches on each returned record’s runtime class to pick the participant, tags __typename, and auto-fetches the selected columns by PK). ServiceDirectiveResolver.projectReturnType’s `PolymorphicReturnType arm now resolves to a new Resolved.Polymorphic success (the all-@error errors-channel lift still takes precedence) instead of the old "not yet supported" reject; new QueryServicePolymorphicField / MutationServicePolymorphicField leaves carry the participant set and service method, and MultiTablePolymorphicEmitter.emitServiceMethods reuses the multitable query path’s stage-2 by-PK auto-fetch (buildPerTypenameSelect) verbatim, replacing stage-1 UNION-ALL discovery with record-class dispatch over the returned records. Scope is exactly one shape: a @service returning a distinct-table multitable interface. Three guards keep that floor honest at the one shared validateMultiTableParticipants site and at classify: same-table participants in a plain multitable interface/union are an AUTHOR_ERROR (record-class dispatch cannot tell shared-recordClass participants apart, with or without @discriminator; model as a single-table discriminated TableInterfaceType or split) ; this also guards R363’s query path; a @service returning a union is permanently unsupported (AUTHOR_ERROR, union polymorphism is a generated-query-path capability the service path never grew); a @service returning a single-table discriminated interface (TableInterfaceType) is deferred-rejected (the table-bound service path emits no per-row discriminator dispatch). Child @service polymorphic returns stay deferred (root only). The In Review pass requested rework on a silent-misdispatch hole (same-table participants carrying @discriminator passed the original no-discriminator-only floor and reached a dead-arm instanceof chain in the emitter, contradicting "validator mirrors classifier invariants"); the rework closed it by rejecting both same-table subsets and narrowing scope to interface-only. Route (b) (the { field, errors } payload + errors: envelope shape) remains a separate follow-up on R366/R367. Coverage: pipeline-tier corpus (query-service-polymorphic, mutation-service-polymorphic) + a @ProjectionFor projection test, unit-tier floor pins in QueryInterfaceFieldValidationTest / QueryUnionFieldValidationTest (both same-table subsets → AUTHOR_ERROR), builder negatives (serviceReturningUnion_rejectedAsUnsupported, serviceReturningTableInterface_deferred), and execution-tier ServicePolymorphicReturnExecutionTest (query single + list and a @service mutation list round-trip, each dispatching two distinct-table branches by runtime record class against real PostgreSQL); the route (a) drop contract (a returned record matching no participant or no live PK row is dropped) is documented in buildServiceMainFetcher. Shares MultiTablePolymorphicEmitter with R363/R366/R367. In Review → Done reviewed by a session distinct from the implementer (the independent reviewer requested the rework and verified the green re-run). graphitron (full suite) and graphitron-sakila-example (460 tests) green under -Plocal-db; graphitron-lsp / graphitron-mcp not exercised at review (tree-sitter native runtime unavailable in the agent sandbox, orthogonal to this change which touches no LSP/MCP files).

R367 (208a3e5, 629960b, 162a7fd; Backlog → Spec b6a6f93, Spec → Ready 88e1659, In Review → Ready rework cb2b4b9): Single-cardinality polymorphic child on a record-backed (Pojo / JavaRecord) parent, closing the capability gap the generator deferred at FieldBuilder’s `!fieldIsList arm (whose Rejection.deferred(planSlug: "polymorphic-child-record-parent-single-cardinality") pointed at a roadmap doc that never existed, a dead link in the generator’s own diagnostic). MultiTablePolymorphicEmitter.buildScalarPerParentFetcher gains a record-parent arm: it now takes parentSourceKey and, for a Reader.AccessorCall parent, binds parentRecord to the accessor’s returned hub TableRecord (Backing) env.getSource(.<accessor>()) instead of casting the source to a jOOQ Record (which would ClassCastException on a Pojo source); a null hub yields a null payload, and the table-backed arm keeps the (Record) env.getSource() cast. FieldBuilder.resolvePolymorphicRecordParent drops the deferral so both cardinalities route through derivePolymorphicHubSource, removing the only reference to the dangling slug. Scope is top-level backing classes; the nested-backing-class Outer$Nested non-compiling-cast hazard (shared with the list arm via ClassName.bestGuess over a binary name) is filed as R370. Coverage: the two pipeline-tier deferral assertions in RecordParentMultiTablePolymorphicPipelineTest flip to assert successful AccessorKeyedSingle classification (interface + union), and execution-tier AddressOccupantCarrierSingleCardinalityTest drives a Pojo carrier holding an AddressRecord hub through Query.addressOccupantCarrier, pinning firstOccupant to the first Customer|Staff by sort order (Staff for a populated address) and to null over an occupant-free hub. The rework (162a7fd) fixed a red build the first In Review pass shipped: the no-occupants case queried addressOccupantCarrier(addressId: 4) but init.sql seeded only addresses 1-3, so a fresh DB returned a null carrier and the assertion failed (masked locally by a polluted persistent native DB; reproduced on a clean DB and in CI run 28104926051); the fix seeds an occupant-free address 4 (district Tasmania, no store/staff/customer) so the test exercises the empty-stage-1 null-payload arm over a non-null carrier rather than the null-carrier short-circuit, and corrects a stale SDL comment naming a nonexistent nested AddressOccupantCarrierService.Carrier. Sibling of R366 (list cardinality); enables R365 shape (b); shares MultiTablePolymorphicEmitter with R363. In Review → Done reviewed by a session distinct from the implementer (independent reviewer requested the rework and verified the green re-run). Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db, 12 modules).

R369 (1a8b57d; Backlog → Spec 87544d0, Spec → Ready bf002a5, Ready → In Progress acef1bc): graphitron:dev walks generated-sources of scanned reactor modules so goto-definition / hover reaches jOOQ tables that live in a separate module from the schema module running dev. Root cause was a lifecycle asymmetry between the two root sets AbstractRewriteMojo feeds the LSP: resolveClasspathRoots() reads target/classes (on disk from any prior build, so every reactor sibling is scanned for completion), but resolveCompileSourceRoots() read project.getCompileSourceRoots(), which only carries a generated-sources root once that module’s codegen plugin ran in this session, so a sibling jOOQ module unbuilt this session contributed zero walked source roots and its @table / @field jumps landed on DefinitionTarget.SourceAbsent (silent no-jump), breaking the R351 scan/walk parity invariant. Fix is in the shared resolver, not a dev-only branch (D2): new generatedSourceRoots(MavenProject) does a lifecycle-independent disk scan of the existing immediate subdirs of target/generated-sources/ (the generated-sources/<tool> convention every generator follows, not POM-config parsing ; D1), and compileSourceRootsOf(MavenProject) is the single per-module "what is walked" definition (getCompileSourceRoots() ∪ generatedSourceRoots) that both resolveCompileSourceRoots() and the new unwalkedScannedModules(Iterable<MavenProject>) route through, so resolver and diagnostic cannot drift; collectExistingDirs dedups by normalised absolute path so a root the plugin already registered (full-lifecycle goals) collapses, making the widening a no-op there. DevMojo renders a startup WARN naming any residual scanned-but-unwalked module (the dependency-JAR case with no .java to walk, explicitly out of scope for the auto-include). The stale resolveCompileSourceRoots() javadoc was rewritten to match. Coverage: unit-tier AbstractRewriteMojoTest (+5: disk discovery incl. stray-file exclusion, empty cases, the core widening regression, plugin-registered dedup, unwalkedScannedModules reporting only the genuinely-unwalked module); unit-tier SourceWalkerTest.disjointGeneratorPackagesKeepTableJumpLocatedNotAmbiguous pins the D1 output-package-disjointness argument (a graphitron output root walked alongside a jOOQ root leaves the table-class jump Located, not Ambiguous) rather than leaving it as unpinned prose; no generated-body string assertions. Builds on R351 (parity invariant + collectExistingDirs) and R352 / R90 (SourceWalker.Index, DefinitionTarget empty-resolution contract). In Review → Done reviewed by a session distinct from the implementer. graphitron and graphitron-maven-plugin test tiers green under -Plocal-db (AbstractRewriteMojoTest 9/9, DevMojoTest 6/6, SourceWalkerTest 9/9); the graphitron-lsp / DevServerTest completion-socket tests could not run in the agent sandbox (the tree-sitter native runtime install clones GitHub, which the egress policy denies ; orthogonal to this change, per the spec’s verification caveat).

R361 (d08b6ed; Backlog → Spec 8d0f8e0, Spec → Ready 60e0667): MCP shared-model seam, slice 1 of the R118 MCP programme. The R341 skeleton served static content only (prompts capability alone, an argument-less about prompt) and held no reference to the live generator model. R361 widens GraphitronMcpServer’s constructor to `(InetSocketAddress, Workspace) and holds the live handle; DevMojo.bindServer passes the same Workspace instance it hands the LSP DevServer, so the existing schema / classpath / source watchers refresh it in place with no new trigger, listener, or refresh path (the volatile fields give per-field visibility on the next read). The tools capability is declared (.tools(false), the listChanged boolean) with one liveness status tool that reads Workspace.snapshot() on every call and reports the snapshot on its two orthogonal axes, availability (Built / Unavailable) and freshness (Current / Previous, absent when unavailable), mapped through an exhaustive switch over the LspSchemaSnapshot sealed permits with no default so a new arm forces a compile-time choice rather than silently flattening; no domain counts (those are the later structured-tool slices' wire contracts). D1 keeps the seam Workspace-only: the raw JooqCatalog is not threaded (it reflects lazily against the codegenLoader URLClassLoader that withCodegenScope closes each pass), deferred to slice 2. Adds the acyclic graphitron-mcp → graphitron-lsp compile edge (plugin → {graphitron, lsp, mcp}; mcp → lsp → graphitron), orthogonal to the module’s native-RAG dependency quarantine. Coverage: infrastructure-tier GraphitronMcpServerTest boots a real server and drives it with the real MCP client, asserting tools/list advertises the status tool and tools/call returns the two-axis snapshot on both the default Unavailable arm and a setBuildOutput-driven Built.Current arm; DevMojoTest’s bind-failure unwind retargeted to the widened constructor; no code-string assertions. Builds on R341. In Review → Done reviewed by a session distinct from the implementer. Full reactor green under `-Plocal-db.

R341 (df99ed9; spec lifecycle 115d174, 56e8fb6, b271054, 07755b5, Spec → Ready 83f0542): MCP server skeleton embedded in graphitron:dev. The smallest useful Model Context Protocol server that gives an MCP-aware agent (Claude Code, Cursor) ambient context about a graphitron project and, the load-bearing reason, establishes the transport-and-lifecycle seam the live catalog/schema discovery tools (R118) build on; it serves static content only. New graphitron-mcp module (GraphitronMcpServer implements AutoCloseable) hosts the MCP Java SDK 2.0.0 servlet-based Streamable HTTP transport (HttpServletStreamableServerTransportProvider) in embedded Jetty 12 EE10, bound loopback-only on 127.0.0.1:8488 (the LSP’s is 8487) at the /mcp endpoint, serving the handshake instructions string plus a single argument-less about prompt, both read once at startup from bundled jar resources (mcp/instructions.txt, mcp/about.md) mirroring LspVocabulary’s shape-not-state posture. The dedicated module is the dependency-quarantine seam that keeps R118’s heavy native deps off `graphitron-maven-plugin’s own compile surface (the "Separate business logic from API code" axis the `graphitron-lsp split also serves, not transport symmetry); it is published like graphitron-lsp (the plugin declares a compile-scope dependency and a Maven plugin resolves its declared deps from the consumer’s repositories at execution time), so it carries no maven.deploy.skip. Lifecycle wiring: DevMojo.bindServer constructs the server as a sibling of the LSP DevServer and DevMojo.cleanup closes it; mcpPort defaults to DEFAULT_MCP_PORT = 8488 but is deliberately not a @Parameter (a configurable port stays deferred). A taken MCP port fails fast with a MojoExecutionException naming the conflict (the fail-fast diagnostic promoted out of Deferred for parity with the LSP bind, per "Stability through simplicity") and closes the already-bound LSP socket so a partial bind leaks nothing. The startup log names the MCP URL and a copy-pasteable claude mcp add line; graphitron-sakila-example ships a committed .mcp.json. Coverage (transport-glue layer, outside the four-tier classifier/emitter enforcement by design): infrastructure-tier GraphitronMcpServerTest (3, boots a real server on an ephemeral port and drives it with the SDK’s own client: initialize carries the bundled instructions; about is advertised argument-less and returns the explainer; a taken port throws IOException); DevMojoTest gains the Mojo-message + no-LSP-leak case and a DEFAULT_MCP_PORT == 8488 pin on defaultsMatchPlanContract. Docs: getting-started.adoc gains a user MCP subsection and the contributor "how this is wired" section grows from four to five cooperating components (+ mermaid node, Ctrl+C cleanup); README.adoc module count 9 → 10 and graphitron-mcp added to the publishable surface. Out of scope and staying in R118: live catalog/schema tools over the warm Workspace, docs RAG, any vector store / embeddings / ONNX, the stdio-to-HTTP proxy, and the decision on keeping R118’s heavy deps off the non-dev plugin goals. In Review → Done reviewed by a session distinct from the implementer. Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db, 12 modules).

R358 (58bc29b, 7202e20; spec 61d5a9c, Spec → Ready 2ac746d, revise Ready → Spec 2ad3d45, Spec → Ready d75c838, Ready → In Progress e2e9612, In Progress → In Review e23b203): Guard table-name comparisons against case-sensitivity drift. TableRef.tableName() is the case-preserved verbatim @table(name:) echo, so the same logical table can surface as two differently-cased strings (the verbatim @table casing vs the lowercase jOOQ Table.getName() the record-class resolution path feeds in), and a case-sensitive .equals silently mis-decides under an Oracle-style UPPERCASE @table over a lowercase jOOQ catalog: the R357 bug, which FieldBuilder.resolveCarrierIdEncoder (:3105) was one explicit @nodeId(typeName:) hop from reproducing. Two phases. Phase 1 (58bc29b): convert the :3105 @nodeId(typeName:) NodeType-vs-carrier comparison to case-insensitive, and add TableNameComparisonCaseGuardTest (@UnitTier), a recursive source scan over src/main/java/no/sikt/graphitron/rewrite forbidding the .tableName().equals( spelling with a nonzero-scanned-file tripwire against a vacuous pass. Phase 2 (7202e20): move the comparison onto the type as TableRef.sameTable(String) / denotesSameTableAs(TableRef) (case-insensitive, null-safe canonical identity; tableName() stays the verbatim diagnostic echo), migrate all ~10 comparison sites across FieldBuilder / TypeBuilder / GraphitronSchemaValidator / BuildContext / NodeIdLeafResolver (both operand orientations, behaviour-preserving), and strengthen the guard to forbid every raw tableName() comparison (both .equals / .equalsIgnoreCase, both orientations) excluding the predicate’s home model/TableRef.java. The guard is then a backstop on a predicate correct by construction, the "model carries what the consumer needs" principle (rewrite-design-principles.adoc:17: the same predicate evaluated by multiple consumers is a sign the resolver is under-specified). Coverage: pipeline-tier MutationDmlNodeIdClassificationTest#bulkDeleteIdCarrier_explicitNodeId_caseMismatchedTable_admits (explicit @nodeId(typeName: "Bar") with UPPERCASE @table(name: "BAR") NodeType over lowercase @table(name: "bar") carrier; the spec’s :3105 reachability obligation, option (b)), verified rejecting pre-fix (the carrier drops to a non-SingleRecordIdFieldFromReturning classification) and admitting post-fix (encodeBar wired, empty diagnostics); unit-tier TableRefSameTablePredicateTest (matching/mismatched casing both directions, null arg); the strengthened TableNameComparisonCaseGuardTest as the structural net, verified tripping on a planted raw comparison with a named-site message; no generated-body string assertions. Out of scope and filed as R359 (d1985ec, column-sqlname-comparison-case-guard): the structurally identical ColumnRef.sqlName() sibling (one live .sqlName().equals( at GraphitronSchemaValidator.java:883 alongside six equalsIgnoreCase sites). Canonicalizing tableName() at construction rejected because it would change author-facing diagnostic casing (a documented invariant). Depends-on R357 (which converts FieldBuilder.java:5114; R358 owns :3105 and the structural pin). In Review → Done reviewed by a session distinct from the implementer. Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db).

R357 (faa465b; roadmap add 3b7d54a, Backlog → Spec 8d8cb45, Spec → Ready fdad51d): Case-insensitive @table(name:) match in record-composite carrier accessor resolution. A @service record-composite carrier (R329’s two-level Payload { results: [Result], errors } / Result { @table children } shape) whose result-type @table children declare @table(name:) in a case differing from the lowercase jOOQ catalog name misclassified every such child as UnclassifiedField with the three-option resolveRecordParentSource author error. collectAccessorMatches (FieldBuilder) grounds the DTO and resolves the accessor plus its element table correctly, then dropped the match on a single case-sensitive element-table guard: expectedSqlName carries the verbatim @table(name:) casing (via resolveTable) while the accessor’s element TableRef carries the jOOQ Table.getName() casing (via resolveTableByRecordClass), and the two diverge only when SDL casing differs from catalog casing (the driving utdanningsregisteret schema writes UPPERCASE @table(name:) against lowercase Postgres). The one-line fix aligns that comparison to equalsIgnoreCase, the table-name idiom already used at eight other sites. Surfaced by the utdanningsregisteret Graphitron 10 migration. Coverage: pipeline-tier ServiceRecordCompositeCarrierPipelineTest#caseMismatchedTableName_classifiesCompositeChildrenAsRecordTableField (the R329 FilmWithActors carrier with @table(name: "FILM") / @table(name: "ACTOR") against lowercase film / actor, asserting both children classify as RecordTableField ONE/MANY with empty diagnostics, the verdict not the case-insensitivity mechanism), verified failing pre-fix (both fall to UnclassifiedField) and passing post-fix; no generated-body string assertions. Out of scope and filed as R358 (table-name-comparison-case-guard): the sibling .tableName().equals( at FieldBuilder.java:3105 (R358 carries the conversion and is re-examining whether it is a latent instance of the same bug rather than inert) and a unit-tier guard pinning the idiom; canonicalizing TableRef.tableName() rejected because it would change author-facing diagnostic casing (a documented invariant). In Review → Done reviewed by a session distinct from the implementer. Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db, 11 modules).

R351 (bdabb1e, ffb2589; In Progress → In Review 59e1cc3; absorbs R352): Complete the LSP goto-definition decoupling R349 began, so the jOOQ half rides the source-cadence index too and both halves resolve through one shape. Source-root parity made structural: AbstractRewriteMojo’s scan path (`resolveClasspathRoots) and walk path (resolveCompileSourceRoots) collapse onto one package-private, unit-tested collectExistingDirs traversal over the same reactor project set, so a class scanned for completion provably has its source root walked for goto-definition; DevMojo logs a startup classpath-root / source-root / external-reference count so the "completion works but goto-definition returns nothing" report self-diagnoses. jOOQ half on the source index: CompletionData.Table / Column / Reference drop SourceLocation and instead carry the generated table-class FQN (and the Keys-class FQN for references); Definitions joins those FQNs against the LSP-owned SourceWalker.Index at request time and routes the @table / @field / @reference arms through the same exhaustive DefinitionTarget switch the service half uses, retiring the file-head 0:0 synthesis (a known table whose source is not on a walked root lands on SourceAbsent, a clean non-jump). Hover / description onto the source cadence: CatalogBuilder no longer walks .java at all (descriptions are the build-derivable fallback only: the jOOQ table’s SQL comment, empty for columns and services); a new Descriptions overlay reads the source-derived Javadoc from the index at request time with per-element precedence (table SQL-comment wins; column / class / method source Javadoc wins), and Hovers plus the FieldCompletions / TableCompletions detail read through it, so hover and goto cannot show two snapshots of one declaration mid-edit. Static cache → instance: SourceWalker’s per-file cache moves from a process-wide static onto an instance owned by `Workspace alongside the volatile sourceIndex; Workspace.refreshSourceIndex is the single walk entry point, called by the dev goal’s source-root watcher. Coverage favours real end-to-end over mocks: SourceCadenceHoverAndDefinitionTest walks real .java through the real Workspace / SourceWalker / Hovers / Definitions (asserting hover and goto move together across a source edit with the catalog the same instance, no rebuild); CatalogBuilderSourceTest inverts to pin the build-boundary decoupling (documented sources on the build are not lifted); SourceWalkerTest pins per-instance cache isolation (a same-mtime content change a static path+mtime cache would mis-serve); AbstractRewriteMojoTest pins the collectExistingDirs classpath/source-root parity; DefinitionsTest reaches every jOOQ arm and every DefinitionTarget outcome; no code-string assertions on generated method bodies. In Review → Done reviewed by a session distinct from the implementer. Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db). Predecessor R349 (the service half and the DefinitionTarget typing); absorbed R352 (the jOOQ-half / hover-cadence / static-cache follow-up R349 deferred).

R342 (fa2743f; spec e736a03, Spec → Ready de7490b): Structural dedup + value agreement for bulk UPDATE SET columns written by overlapping carriers. The fourth and last mutation write surface left open by R322 (the bulk UPDATE t SET c = v.c FROM (VALUES …) AS v(…) path) and the lift of R354’s deferred bulk self-FK form. The bulk path walked its SET groups per-group with no cross-group column dedup, so two writers landing on one backing column emitted that column twice in the derived table’s v(…) list and crashed loud (a duplicate-column Postgres/jOOQ error, not a silent drop, which is why R322 deferred it here). Two shapes were affected: a decode-involving within-SET overlap (a plain @field plus a @nodeId FK reference whose lifted child column coincides), and a self-FK @nodeId on a list-input UPDATE (rejected at validate time by UpdateRowsWalker Stage 2b). Plan: TypeFetcherGenerator.setColumnPlan(List<SetGroup>), the SET analogue of insertColumnPlan, groups the set groups' columns by backing-column sqlName into an ordered writer list (each carrying its source SetGroup index, slot, and ColumnRef), shared() when ≥2 writers; the three bulk emitters (emitSetVColNameAdds, emitSetBulkCellAdds, emitSetVFieldPuts) all walk the one deterministic plan, so the v(…) column-name list, the per-row cells, and the sets.put entries emit exactly one entry per distinct column and cannot drift out of positional alignment. Presence gate (setColumnPresenceGate): a disjoint column keeps its single writer’s first-row gate byte-identical to the pre-dedup form; a shared column’s gate is the disjunction of its contributing writers' first-row presence, and the uniform-shape guard makes projecting row 0’s disjunction onto every row safe (a gate keyed on the wrong writer would silently drop a present shared column, the exact silent-drop class R322 closed on the other surfaces; pinned by the two asymmetric-presence execution tests). Cells: the per-row decode locals are hoisted once per row into emitBulkSetDecodeLocals (INSERT-style instanceof String guard + presence-gated throw), so a composite group’s cells and a shared column’s gather all read one decode rather than re-decoding per writer; a shared column gathers the present writers' values (reusing R354’s presence-guarded appendAgreementValue), pairwise-checks them through NodeIdEncoder.requireColumnAgreement, and adds the single coalesced DSL.val(firstPresent, col.getDataType()) cell, emitInsertAgreementPrep’s coalesced-cell shape transplanted into the row loop (no `DSL.defaultValue branch, since the conditional gate guarantees a present writer, and not emitSetAgreementPreamble’s check-then-let-the-puts-run shape, which the bulk derived table’s lack of a last-write-wins `Map.put affordance forbids). Cross-partition (WHERE∩SET self-FK) fork (resolved in In Progress with principles-architect): setColumnPlan sees only SET groups, so a self-FK’s column shared with the WHERE identity is handled outside it, the two v-populating emitters skip a SET column already supplied as a WHERE/lookup v-column, emitSetVFieldPuts keeps the no-op sets.put (keeps sets non-empty so the empty-SET runtime guard does not fire on a minimal self-FK input), and a new emitBulkKeySetAgreement emits the per-row check reusing the already-present per-row decode locals (bulkKey<gi> WHERE-side, bulkSetKey_<gi> SET-side) rather than re-decoding (two decodes/row, not three; the agreement guards the values actually used). Walker: Stage 2b’s bulk self-FK UnsupportedInputFieldShape reject is deleted and the now-dead list parameter dropped from walk (both FieldBuilder call sites + the class javadoc updated); the walk is cardinality-independent, since R354 already routed a self-FK all-SET regardless of the list flag, so removing Stage 2b exposes a shape the classifier already routes correctly. UnsupportedInputFieldShape retains its other producers. Coverage: UpdateRowsWalkerTest (15 pass: the bulk self-FK reject test inverted to admit-and-route-all-SET with the shared mailbox_id in both partitions, plus a decode-involving-overlap-admits-without-PlainColumnCollision test); execution-tier BulkUpdateSetAgreementExecutionTest (7 tests: within-SET agree / disagree-rolls-back / asymmetric-present ×2 on the film_endorsement updateEndorsementsOverlap fixture, self-FK agree-repoints-with-mailbox_id-no-op / disagree-rolls-back / omitted-nullable on the email updateEmailReplies fixture), the list-input siblings of NodeIdValueAgreementExecutionTest / SelfFkNodeIdUpdateExecutionTest; compilation tier via the two new schema fixtures against real jOOQ at Java 17; no generated-body string assertions. Out of scope: the shared overlap-analysis abstraction lift across the now-six instantiation sites (R356, filed alongside this spec, depends on it); non-Postgres dialects; any change to the single-row UPDATE SET / INSERT / @service paths (R322/R354). In Review → Done reviewed by a session distinct from the implementer. Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db, 11 modules).

R355 (6562b7a; Backlog → Spec 8133ecf, Spec → Ready 42efe84): Infer depth-1 nested @condition arg bindings by name without argMapping. A @condition whose slot is an input object with scalar fields previously required an explicit argMapping to bind the condition method’s parameters to the nested fields, even when the parameter names already matched the nested field names exactly (the motivating searchVektingstallRange(table, fra, til) against SokVerdiRange { fra, til }); R355 drops that boilerplate. Core inference (ServiceCatalog.inferBindingsByType): a new name-keyed depth-1 branch runs on the parameters still unbound after the arity-unique and type-unique branches. For a parameter whose name matches exactly one direct field of a single unclaimed input-object slot, by name AND mapToJavaTypeName (so only canonical-scalar-typed leaves, never a named-input-object / enum / unclassified-scalar leaf the emitter cannot vouch for, the same null-is-no-match discipline the unambiguousReachablePath suggestion uses), it binds the parameter one level in via inferNestedFieldByName → PathExpr.step(head(slot), field, liftsList). The synthesised PathExpr is byte-identical to the one a hand-written argMapping: "p: slot.field" produces; liftsList is computed via ArgBindingMap.isListShaped (relaxed private → package-visible) so a list-shaped leaf is not hardcoded. Zero or >1 candidates leave the parameter unbound, so the existing per-parameter rejection / argMapping suggestion still fires; ranging over the unclaimed slot set keeps it a peer of its siblings and is what makes an ambiguous name fall through. Depth ≥ 2 stays explicit argMapping by design (deeper descent drags in recursive input types and path-dependent uniqueness; one hop is where the name still plainly names its source field). The disambiguator is the parameter name, orthogonal to R219’s count axis, so it lands as a distinct branch. Emit deviation (ConditionResolver.rewrapForNested): the spec’s "Files in play" said no emit change was expected (the PathExpr equals the explicit-argMapping one), but the execution test surfaced a latent gap shared by both forms: the input-field-@condition rewrap folded only the walk’s path to the input field and dropped each parameter’s own descent, so a multi-segment binding cast the whole wrapper Map to the leaf type (a defensive-cast-that-throws, against "classifier guarantees shape emitter assumptions"). A new nestedPath helper now appends the per-parameter path tail (segments after the head, the head naming the input field already at leafPath’s tail) to the `NestedInputField path; a bare-head (single-segment) binding returns leafPath unchanged, byte-identical for every pre-R355 binding, and the fix also completes the explicit-argMapping form for the same shape. The R214 ServiceCatalogTest case that deliberately yielded "to name-based matching" now asserts the concrete inferred binding (input.filmId) R355 produces instead of the suggestion it used to print, the intended R214 → R355 handoff (a strengthened assertion, and the type-unique yield it relies on stays implicitly exercised). Coverage: unit ServiceCatalogTest#inferNestedFieldByName_* (single scalar match, list liftsList=true, name-with-wrong-type → null, two-slot ambiguity → null); pipeline GraphitronSchemaBuilderTest (INFER_NESTED_CONDITION_ARG_BY_NAME asserting the inferred PathExpr chain, its *_EXPLICIT_ARGMAPPING_EQUIVALENT sibling asserting the identical values to pin equality, *_LIST_LIFTS_LIST pinning the computed liftsList=true, *_AMBIGUOUS_FALLS_THROUGH pinning the rejection, all on classifier-output PathExpr values not generated-body strings); execution GraphQLQueryTest#inputFieldCondition_nestedArgInferredByName_filtersSameAsExplicitArgMapping (a rental_rate [2.0, 3.0] round-trip selecting exactly the three 2.99 films, proving both bounds bind to the right nested field, asserted identical to the explicit-argMapping sibling). In Review → Done reviewed by a session distinct from the implementer. Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db, 11 modules). Related: R249 (nested argMapping syntax, the explicit axis), R219 (unify arity-/type-unique under one JavaTypeKey count rule, the type-based inference this sits beside), R214 (the layered type-based inference this follows).

R329 (5b59e4a; spec 268e404, revised 21a0d36, Spec → Ready 8c414b6): Re-admit @service carrier payloads with a record-composite data field, landing R75 Phase 3 on the post-R276 reflection-driven binding model. An @service mutation whose method returns a list (or single) of a consumer-authored composite (a POJO bundling several jOOQ records, e.g. one FilmRecord plus a List<ActorRecord>) is now expressible as a two-level carrier: a payload whose non-@table object data field is a list of an intermediate result type whose @field-mapped @table children map onto the composite’s components. Previously this dangled (rejectDanglingTypeReferences) ; the result axis skipped the wrapper under the cardinality-match guard, and the carrier axis admitted only @table-typed data fields. Binding side: the cardinality decision is lifted into one builder-internal sealed ProducerBindLevel { BindsWrapper, BindsDataFieldElement, NoBind } read by both the single-level and two-level paths (the ArgumentRef-style classify-once/project-into-each-consumer pattern), replacing the old sdlIsList != reflectedIsMulti reject + carrier-admit pair that would desync into a dangle or double-bind; BindsDataFieldElement grounds the data field’s element type to the producer’s reflected return-element on the existing result axis, so no new ProducerBinding arm and no nullable-TableRef generalization of ServiceEmitted. Carrier recognition: carrierTableBinding becomes a sealed CarrierBinding { TableBacked, ClassBacked, NotACarrier } with one carrierVerdict projection shared by lookAheadVerdict, the producing-edge registration, and the nesting/orphan guards, so the verdict cannot drift; the composite carrier classifies as a class-backed ResultType naming the per-element composite, gated on the payload being @service-produced (BuildContext.isServiceProducedPayload, the single producer of that fact, shared with the errors WrapperArm selector) and not itself result-axis-bound. Emit side: a new ChildField.RecordCompositeField leaf, justified by a dimensional row (Record / bareFetch / listOrSingle(Record) / Plain(composite)) distinct from RecordField (Field target), RecordTableField (Table target), and ServiceRecordField (ServiceCall operation); a source-passthrough projection carrying its own SourceEnvelope (DIRECT / OUTCOME_SUCCESS) rather than recomputing it at emit, reusing the existing Outcome WrapperArm for errors with computeMutationServiceRecordReturnType re-levelled to the reflected method return. Validator mirror: the three near-misses surface through existing recognizers (mismatched producer → RecordBindingMultiProducer; a @field child neither @table-backed nor a resolvable composite accessor → accessor-mismatch; the re-levelled cardinality mismatch → checkServiceReturnMatchesPayload), not new predicates kept complementary by hope. Coverage: a ClassifiedCorpus entry pinning the payload classification + data-field verdict, a @ProjectionFor(RecordCompositeField) LSP-projection assertion, RecordCompositeField in IMPLEMENTED_LEAVES (GeneratorCoverageTest stays exhaustive), pipeline-tier positive coverage (ServiceRecordCompositeCarrierPipelineTest: list + single arrival, DIRECT/OUTCOME_SUCCESS envelope, errors WrapperArm, @table children as RecordTableField), validator-tier coverage of the three near-misses (ServiceRecordCompositeCarrierValidationTest), and an execution-tier round-trip in graphitron-sakila-example (GraphQLQueryTest: List<composite> projection + the error arm rendering data: null) backed by the cross-module compile against real jOOQ records; no generated-body string assertions. Surfaced by the utdanningsregisteret Graphitron 10 upgrade (opprettUtdanningsspesifikasjonOgUtdanningsmulighet). The batch-keyed Map<Key, List<composite>> shape stays out of scope for root carriers: a root @service returns the composite list directly, while peelReturnElement/isMultiCardinalityReturn already peel Map for the orthogonal child-batching path and a Map return at a root carrier rejects loudly via checkServiceReturnMatchesPayload (settled, not half-wired). In Review → Done reviewed by a session distinct from the implementer. Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db, 11 modules).

R354 (46522ba; spec 64913b8, Spec → Ready 8e46e7f): Self-FK @nodeId on a Graphitron-owned single-row UPDATE routes all-SET with a cross-partition value-agreement check. The UPDATE sibling of R328 (which shipped the self-FK @nodeId @reference on the INSERT/read sides and the email/mailbox fixture). On @mutation(typeName: UPDATE) a self-FK whose child columns straddle the row’s identity key (email_in_reply_to_fk’s `(mailbox_id, in_reply_to_no), where mailbox_id is a PK member) previously tripped UpdateRowsError.MixedCarrierKeyMembership: the straddle check partitions at input-field granularity, so a self-FK overlapping the PK had no expressible UPDATE form. Design: a self-FK reference is a write of "who this row points at" (its parent), never the row’s own identity, so it routes its lifted columns wholly to SET regardless of key membership; the shared key column then appears in both the WHERE (from the identity field) and the SET (from the self-FK), ordinary SQL whose two decoded values the FK constraint forces equal. Marker: a selfReference boolean on InputField.ColumnReferenceField / CompositeColumnReferenceField, set once at the NodeIdLeafResolver discrimination site (where T.table() equals the containing table) and threaded through BuildContext; every other construction site passes false (the fact-lives-in-the-model lift, the walker reads carrier.selfReference() rather than re-deriving self-ness). Three UpdateRowsWalker sites fork on it: Stage 6 routes all-SET, Stage 4-5 computes key coverage over the non-self-FK columns only (a PK column reachable only via the self-FK correctly fails NoUniqueKeyCoverage, a self-FK cannot pin the row it lives on), and Stage 2b defers a self-FK on a bulk (list-input) UPDATE to R342 with a clear UnsupportedInputFieldShape reject rather than a silently-wrong FROM (VALUES …) derived table. The narrowed MixedCarrierKeyMembership still rejects a genuine cross-table FK straddle (a cross-table FK’s lifted column can legitimately be the row’s own identity, so it keeps partitioning by membership; fkTargetNodeIdRef_arity1_update_admitted pins that the all-SET rule did not leak). Emit: TypeFetcherGenerator.emitKeySetAgreementPreamble adds a cross-partition (WHERE∩SET) agreement preamble in the single-row UPDATE arm, decoding each side into a presence-guarded preamble-local and passing both through R322’s requireColumnAgreement (reused unchanged) before the DML; the throw names both contributing input fields. A second WHERE predicate was rejected as a silent drop wearing a no-match costume. This is the WHERE↔SET boundary R322’s four same-clause agreement sites never crossed, landed as a deliberate fifth instantiation of the gather-and-compare scaffold (the emitAgreementDecodeLocal / appendAgreementValue helpers are the seam, the carrier-agnostic writer-abstraction lift stays R342's). Coverage: UpdateRowsWalkerTest (all-SET routing, coverage-via-self-FK → NoUniqueKeyCoverage, bulk reject, cross-FK straddle still MixedCarrierKeyMembership), MutationDmlNodeIdClassificationTest (updateEmailReply classification + the marker on both carriers), graphitron-sakila-example compilation of UpdateEmailReplyInput against real jOOQ at Java 17, and execution-tier SelfFkNodeIdUpdateExecutionTest (agree repoints in_reply_to_no with the mailbox_id SET a no-op / disagree throws and rolls back, no silent row-move / omitted nullable updates subject only, no agreement check); no generated-body string assertions. docs/typed-rejection.adoc narrowed and RejectionSeverityCoverageTest annotated to reflect the self-FK no longer reaching the straddle arm. In Review → Done reviewed by a session distinct from the implementer. Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db, 11 modules).

R349 (1db8756): Decouple service-half LSP goto-definition positions from the generator build and type the resolution outcome. Goto-definition on a @service / @condition / @externalField class or method reference silently no-opped in a live graphitron:dev session when the reference’s source root was scanned for bytecode (so completion worked) but not walked for positions: CatalogBuilder.enrichExternalReferences left the CompletionData.SourceLocation at the UNKNOWN sentinel (uri="", line=0), which Definitions collapsed to "no jump" through one uri().isEmpty() test, making the recoverable not-yet-indexed case indistinguishable from the two correct no-ops (binary-only source genuinely absent; overload-ambiguous). Change 1, typed outcome: a new sealed DefinitionTarget { Located, SourceAbsent, Ambiguous } (in graphitron-lsp/…​/definition/) replaces the sentinel; Definitions resolves the service half through two pure FQN-join helpers (classTarget / methodTarget) and switches on the typed outcome exhaustively in one place (Definitions.resolve), where SourceAbsent logs a recoverable signal and Ambiguous is a deliberate silent no-jump. SourceWalker.Index now exposes the ambiguousMethods set the merge already computed and discarded, so Ambiguous is distinguishable from SourceAbsent. Change 2, source-cadence index: CompletionData.ExternalReference / Method drop their definition field; the LSP owns a volatile SourceWalker.Index on Workspace (sourceIndex() / setSourceIndex), seeded by DevMojo at startup and refreshed by a third watcher (sibling to the schema and classpath watchers) on .java over the compile source roots, so a declaration that moves in a hand-edited source is jumpable without waiting for a .class rebuild. Definitions joins ref-from-catalog with position-from-source-index at request time on the FQN both carry. CatalogBuilder keeps lifting Javadoc into description on the build cadence (hover untouched). Scope bounded to the service half (the reported bug); the jOOQ half, hover-description cadence, and the static SourceWalker.CACHE are deliberate transitional states, each documented and deferred to the follow-up R352 (complete-lsp-position-decoupling). Coverage: DefinitionsTest pins each DefinitionTarget arm reachable (Located / SourceAbsent / Ambiguous) plus the end-to-end class/method jumps; SourceWalkerTest pins the ambiguousMethods exposure; CatalogBuilderSourceTest asserts the build-cadence Javadoc lift now that positions are LSP-tier; CatalogRefreshTest pins a .java edit refreshing the source index without a catalog rebuild; no code-string assertions on generated method bodies. Predecessors R90 (the source walk) and R351 (the compileSourceRoots/classpathRoots parity stopgap). In Review → Done reviewed by a session distinct from the implementer. Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db).

R350 (8c88f5d): Workspace-wide LSP goto-definition for GraphQL type references. Goto-definition on an intra-schema type reference (the Film in films: [Film!]!, an implements interface, or a union member) previously resolved only when the file declaring the target type was in an open buffer; in a real multi-file schema the declaration is frequently not open, so the jump silently no-opped ([]) even though the TypeDefinitionRegistry already holds every type’s source position and ships to the LSP through the build snapshot. Producer: LspSchemaSnapshot.Built gains a per-type declaration-location map (typeDefinitionLocations(), keyed by SDL type name) plus a typeDefinitionLocation(name) lookup, threaded through both leaf records' canonical constructors and Workspace.demoteSnapshot; a new 5-arg convenience constructor on each of Current/Previous defaults the map empty so existing fixtures compile untouched. CatalogBuilder.buildSnapshot populates it from registry.types() + registry.scalars(), reducing graphql-java’s 1-based SourceLocation to the 0-based coordinates every goto-definition consumer reads (mirroring SourceWalker’s `-1); null-source built-in scalars and the bundled-directive source are dropped rather than emitted as dead file:// URIs, the bundled source-name exposed as RewriteSchemaLoader.DIRECTIVES_SOURCE_NAME. Consumer: IntraSchemaDefinitions.compute takes the snapshot as an explicit parameter (test seam matching the Definitions.compute sibling convention, since the provider’s only Workspace-snapshot install path demands full BuildArtifacts); the open-buffer tree-sitter scan stays first and authoritative, falling back to built.typeDefinitionLocation(typeName) on miss, and GraphitronTextDocumentService passes workspace.snapshot() at the call site. Coverage: IntraSchemaDefinitionTest (the three acceptance arms: snapshot fallback when the declaring file is not open, open-buffer precedence over a deliberately stale snapshot entry, neither-source no-op) and CatalogBuilderSnapshotTest (a producer-side arm over the real RewriteSchemaLoader.load parse path asserting user types/scalars land at 0-based positions while built-ins and bundled-directive inputs/enums are dropped); no code-string assertions on generated method bodies. Out of scope: the pre-existing 1-based sourceLocation(GraphQLScalarType) completion-feed helper (a separate code path, not this fallback). In Review → Done approved by a session distinct from the implementer. Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db, 11 modules incl. graphitron-lsp).

R328 (27d2359): Self-FK @nodeId reference on Graphitron-owned DML mutation inputs. A same-table @nodeId carrying an explicit @reference(path: [{key: …​}]) now means "follow this self-FK and write its child columns" instead of "use my own identity", read/write symmetric and the sibling of R315 (cross-table FK-reference @nodeId) and R322 (the shared-column dedup + agreement it rides on). D1 gates the NodeIdLeafResolver.resolve same-table own-PK short-circuit on @reference being absent; with @reference present the leaf falls through to resolveFkJoinPath, which orients the self-FK with selfRefFkOnSource=true and yields a Resolved.FkTarget.DirectFk whose liftedSourceColumns are the self-FK’s child columns on the row’s own table, the same data shape a cross-table FK carries, so no new sealed variant. The single shared gate lives in resolve(), so the shape is admitted on the read side too (a same-table @nodeId @reference query arg / filter resolves to a DirectFk self-FK filter, WHERE child_cols IN (decoded keys), no self-join, and the @asConnection same-table advisory correctly stops firing). D2 lifts the R315 InputBeanResolver.buildRecordKeyDecode same-table "self-reference out of scope" reject, routing the @service jOOQ-record case through the same BuildContext.resolveRecordFkTargetColumns the cross-table branch uses (oriented selfRefFkOnSource=true), landing the decode on the self-FK child columns, never the record’s own PK. D3 adds no emitter code: R322’s per-column structural dedup + requireColumnAgreement carry the shared-column overlap (the natural CAMPUS/email case where the self-FK’s first child column coincides with a cross-table FK’s), proven end to end. D4 pins cross-path consistency by test rather than a new abstraction: the same-table && !@reference ⇒ self-FK predicate plus the node-key reconciliation are duplicated across the classifier (permutationToKeyColumns) and record-population (resolveRecordFkTargetColumns) paths, so anti-drift tests assert both land identical child columns on the identity permutation (email fixture) and off it (the existing reordered_fk_child fixture forcing a non-identity permutation through both reconciliations). Coverage: resolver-tier NodeIdLeafResolverTest (DirectFk landing + without-@reference identity contrast + two anti-drift cases), MutationDmlNodeIdClassificationTest (INSERT admits the CompositeColumnReferenceField over the self-FK child columns, surfacing the shared mailbox_id), JooqRecordServiceParamPipelineTest (@service classifier, replacing the dropped reject test), SelfFkNodeIdReferenceReadSidePipelineTest (read-side DirectFk filter + no-@asConnection-advisory), and execution-tier SelfFkNodeIdInsertExecutionTest (agree inserts / disagree throws + inserts nothing / omitted nullable leaves the lone decode, on the email/mailbox fixture, jOOQ schema 1.8 → 1.9); no generated-body string assertions. Out of scope: the bulk UPDATE SET decode-overlap dedup, the one surface where a self-FK shared-column overlap still fails loud (a duplicate derived-table column), owned by R342 (Backlog); R328 only makes that gap reachable via a natural self-FK shape rather than a contrived one. In Review → Done reviewed by a session distinct from the implementer (27d2359). Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db, 11 modules).

R322 (42ac9b2 @service jOOQ-record path D3+D4; 0535abb @mutation INSERT path D1/D2/D5; f739fd5 single-row UPDATE SET D3 + UPDATE-path D2; 0a9c8df In Review markup + R342 filing): Runtime value-agreement check for multiple @nodeId decodes onto shared columns. When more than one writer (two @nodeId decodes, a @nodeId decode plus a plain @field, or two composite FKs) lands on a single backing column, agreeing values are harmless but a disagreement would silently overwrite a caller-supplied value, the "no silent drops" failure the generator exists to avoid; the disagreement is only observable at runtime (values arrive off the wire), so it cannot be a build-time reject. D3 adds the shared predicate NodeIdEncoder.requireColumnAgreement(label, DataType, a, b): it coerces both sides through the destination column’s jOOQ DataType (the same coercion the real write applies, riding the class-level @SuppressWarnings for DataType.convert, so format-variant wire values like "01" / 1.0 / BigInteger 1 collapse onto the decoded 1 and agree, while a genuinely varchar "01" vs "1" still disagrees) and throws GraphqlErrorException on disagreement; one home for the message and semantics so the paths cannot drift. D1 resolves, per backing column, the ordered list of contributing writers, consumed by D4 (the @service JooqRecordInstantiationEmitter prepare/agree/load emission, byte-identical when no column overlaps), D5 (the @mutation INSERT structural dedup in TypeFetcherGenerator.insertColumnPlan driving the column list plus a single coalesced typed Field<ColType> VALUES cell, turning the Postgres "column specified more than once" crash into one column + one agreement-checked cell), and the single-row UPDATE SET agreement preamble (emitSetAgreementPreamble before the Map.put`s). D2 moves the build-time-decidable half (two-or-more plain `@field`s on one column, a pure schema fact no runtime input could reconcile) to a validate-time reject on both paths: `MutationInputResolver.rejectPlainColumnCollision (INSERT) and UpdateRowsWalker via the new UpdateRowsError.PlainColumnCollision (UPDATE, single-row + bulk), the mutation mirror of the R336 @service reject. All checks are presence-guarded (an omitted nullable writer is not a writer and cannot conflict) and pairwise against the first present writer (equals transitive). Scope call: extended past the spec’s INSERT focus to the single-row UPDATE SET path, and carved the bulk UPDATE SET decode-overlap to R342 (Backlog) on the grounds that the bulk UPDATE … FROM (VALUES …) join fails loud (a duplicate derived column) rather than silently, so it is self-announcing; with the single-row SET agreement and the all-plain reject in place, no silent drop remains on any mutation write path. Coverage: execution-tier NodeIdValueAgreementExecutionTest (the agree / disagree / presence-guard matrix across all three paths plus the format-variant "01" case pinning the coerced comparison, on storage_bin / film_endorsement fixtures), pipeline-tier JooqRecordServiceParamPipelineTest (two identity decodes / plain-field-plus-decode admitted and deferred to runtime) and MutationDmlNodeIdClassificationTest (the two-plain-fields rejects on INSERT and UPDATE SET), and the RejectionSeverityCoverageTest audit for the new sealed variant; no generated-body string assertions. Documented residual (recorded in the R342 follow-up): the column→writers overlap analysis now exists in per-path instantiations (@service, INSERT, single-row UPDATE SET, the two validate-time rejects); the shared predicate has one home but the structural grouping is re-derived per carrier model / pipeline stage, the lift to one carrier-agnostic writer abstraction deferred to R342 when the bulk-SET path forces it. Spec → Ready and In Review → Done both reviewed by sessions distinct from the implementer. Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db, 11 modules).

R344 (21915b9 exception + loader + DevMojo arm + tests; 1bf9ca7 self-review tightenings + R345 follow-on; 63b033d In Review): Surface schema parse failures as clean dev-watch diagnostics, not infrastructure stack traces. In the graphitron:dev watch loop a syntactically invalid schema (the common mid-edit case) dumped a ~30-frame graphql-java + executor stack trace into the build log on every keystroke, because RewriteSchemaLoader.load wrapped graphql-java’s InvalidSyntaxException in a bare RuntimeException and DevMojo.runGeneratorPass logged that through the "infrastructure" arm getLog().error(…​, e) (with the throwable). A new typed SchemaParseException (a sibling of ValidationFailedException, not a subtype, in no.sikt.graphitron.rewrite) is now thrown from the loader’s InvalidSyntaxException arm only; the IOException / missing-file arms stay bare RuntimeException (genuine infrastructure, keep their trace). Its getMessage() is the existing file-attributed one-liner ("Schema parse failed in <file> at line N column M: <brief>`"), so the three already-quiet catalog-refresh paths (`regenerate / rebuildCatalog / buildOutputQuietly, which catch RuntimeException and print getMessage()) keep printing attribution unchanged; it also carries a nullable SourceLocation + brief consumer-less for now, positioned to feed the deferred LSP-squiggle follow-on (R345). runGeneratorPass gains a catch (SchemaParseException) arm ordered before the generic infrastructure arm that logs the one-liner without the throwable and resets previousErrorKeys = null (a parse failure is not a validator verdict, so it must not feed WatchErrorFormatter’s delta tracker). `GraphQLRewriteGenerator is unchanged: the exception propagates as-is through loadAttributedRegistry() out of all three entry points with no translation step, so the one-shot validate / generate build still fails on a broken schema carrying the attributed message. Two reviewed deliberate deviations: runGeneratorPass relaxed private → package-private as a test seam, and the consumer-less brief field carried per spec for R345. Rejected fork (documented in the retired spec): routing through ValidationFailedException + a fabricated ValidationError/Rejection.InvalidSchema, which would regress the quiet paths to a count string, falsify ValidationFailedException’s javadoc invariant, and stamp a pre-classification failure as a validator verdict. Coverage: unit `RewriteSchemaLoaderTest (throws SchemaParseException with the offending file’s SourceLocation + attributed getMessage() pinned exactly to location + brief as the quiet-path regression guard; still bare RuntimeException for a missing file), SchemaParseExceptionPropagationTest (generate() propagates the same type, no translation), and DevMojoTest (malformed schema → parse arm logs no throwable; missing file → infrastructure arm logs the throwable, pinning catch-arm ordering); no generated-body string assertions. Spec → Ready and In Review → Done both reviewed by sessions distinct from the implementer. Out of scope: the LSP red squiggle for parse failures (deferred to R345), wire/attribution mechanics, any change to ValidationFailedException. Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db, 11 modules).

R300 (8249abb fixture + jOOQ-regen foundation; 0074bd4 model + @routine directive + JooqCatalog.resolveTableValuedFunction + RoutineDirectiveResolver + emitter; 076cc56 execution-tier proof + routine.adoc docs + fixture gates; b0533b1 spec markup): First-class jOOQ routine support, day-one table-valued read slice. A new @routine(name:, argMapping:) directive backs a root Query field with a jOOQ-generated table-valued function (PostgreSQL RETURNS TABLE / SETOF). jOOQ models such a function as a first-class catalog Table<R>, so the slice rides the existing @table-bound return-type and selection-narrowing ($fields) machinery unchanged; only the FROM source differs, becoming a call to the schema’s global Routines convenience method with the routine’s IN parameters bound from GraphQL arguments. The provenance is carried by a new RoutineRef (the catalog-handle twin of @tableMethod’s `MethodRef) on a new QueryField.QueryRoutineTableField leaf, added to TypeFetcherGenerator.IMPLEMENTED_LEAVES so the four-way dispatch partition stays exhaustive; operation() is Fetch and target() projects a bare TargetShape.Table, following the QueryTableMethodTableField precedent. The deferred scalar-read and procedure-write forks reject at validate time via JooqCatalog.resolveTableValuedFunction (they do not resolve as table-valued functions), satisfying "validator mirrors classifier" without a STUBBED_VARIANTS entry, since no leaf is minted for them. Three reviewed deviations from the spec-as-reviewed: emission rides the Routines convenience method rather than <ROUTINE>.call(…​) (same SQL); catalog-based discovery with IN-param names depending on -parameters compilation; classification reuses FieldClassification.QueryTableMethod (a dedicated QueryRoutine is a follow-up). Coverage: ClassifiedCorpus routine-table-valued-read fixture (Query / Fetch / List(Table)), a @ProjectionFor(QueryRoutineTableField) test in GraphitronSchemaBuilderTest, and RoutineFieldExecutionTest running the driving function (tilganger_for_feidebruker_med_fs_fiktivt_fnr) end-to-end against PostgreSQL including a selection-narrowing case; no generated-body string assertions. Spec → Ready and In Review → Done both reviewed by sessions distinct from the implementer. Deferred follow-ups (named in the retired spec): the procedure-write Operation write arm, scalar-function and record-returning reads, child-positioned @routine, heterogeneous binding sources, and the translation of legacy’s 26 procedureCall* rejection fixtures (the follow-up should also add pipeline coverage for day-one’s own resolver rejection arms, not only the legacy forks). Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db).

R336 (688a43c D1-D4 code + tests + CustomerRecordService fixture; doc-fix rework 13695d0): Flatten nested input-object fields in jOOQ-record @service params. A @service param typed as a generated jOOQ TableRecord can now group its columns under nested directiveless input objects that flatten onto the one backing table on the column axis, the analogue of the @table-input nesting the filter axis already supports. D1: CallSiteExtraction.ColumnBinding / RecordKeyDecode carry an ordered, non-empty List<String> access path (was a single sdlFieldName) with a leaf() accessor; the last element is the Map key, earlier elements the enclosing nested-input field names, and a top-level binding is a single-element path byte-identical to before (adopting the NestedInputField representation R186 settled). D2: InputBeanResolver.buildJooqRecord recurses into nested grouping inputs via a new collectJooqBindings, threading the existing ClassifyContext SDL-type-name expanding set for cycle detection, parallel to the member-axis buildInputBean walk rather than routing through classifyInputField (a different carrier family on a different axis). D3: typed Rejection`s through `JooqBuilt.Fail for cycle, list-valued nesting (a single record has one value per column), nested @table (a second DML target, cites R122), and plain-column collision across nesting (decode-vs-decode / decode-vs-column overlaps stay with R322’s value-agreement deferral). D4: JooqRecordInstantiationEmitter wraps each multi-element binding in a null-safe parent-Map descent (the instanceof Map<?,?> chain idiom from ArgCallEmitter generalised to statement form) with collision-free camelJoin-derived locals; an absent / null / non-Map group skips the columns under it, and a non-null identity inside an absent nullable group is skipped rather than thrown (skip-not-throw, since its R195 throw lives in the never-entered block). At depth 1 no wrapping block is emitted and the output is byte-identical to the pre-R336 form. graphql-java constraint surfaced in the execution tier: its coercion drops an explicit-null field from a nested input-object value (both literal and variable wire paths) while retaining it on the top-level argument map, so a present-null nested leaf is indistinguishable from omitted and leaves the column untouched; the top-level present-null → NULL three-way narrows to a nested two-way, with no emitted-code change. Coverage: pipeline JooqRecordServiceParamPipelineTest (8 new cases: flatten with two-element paths, mixed top-level + nested, nested @nodeId decode, depth-2, and the four D3 rejections by message substring) and 6 GraphQLQueryTest execution cases (lands-on-column + omitted sibling, present-null collapse asserted through the variable path, null group, skip-not-throw on an omitted nullable identity group, empty-input, malformed-id-in-present throws), plus the compile tier type-checking createCustomerRecord against the real jOOQ CustomerRecord; no generated-body string assertions. New CustomerRecordService fixture (CustomerRecord avoids the createFilmRecord per-record-class dedup clash on QueryFetchers). Spec → Ready and In Review → Done both reviewed by sessions distinct from the implementer. Out of scope: multi-table nesting, reclassifying the nested grouping type (the PojoInput(null) model/LSP-honesty wart is R337), any change to the @table-input nesting path. Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db, 11 modules).

R340 (006999c): LSP goto-definition for intra-schema type references. The cursor on a GraphQL type reference (a field/arg/input-field type, an implements interface, or a union member) now jumps to that type’s canonical type Foo { …​ } declaration in whichever open workspace file declares it; previously goto-definition resolved only directive arguments (@table / @field / @reference) into the jOOQ-generated Java tree. Adds IntraSchemaDefinitions (a provider in the definition package parallel to hover/DeclarationHovers beside Hovers): it keys on the cursor sitting on a named_type reference name outside any directive, skips TypeNames.BUILTIN_SCALARS, walks open files via the per-URI lock-guarded Workspace.get fast-skipping on the immutable declaredTypes(), and resolves through the new DeclarationKind.findDefinition helper (returns the name node of the canonical non-extension declaration, so navigation lands on type Foo, not extend type Foo); the returned Location carries the real declaration-name byte range via Positions.toLspPosition, not the jOOQ path’s 0:0 placeholder. Wired after Definitions.compute with .or() in GraphitronTextDocumentService.definition(); the two paths key off disjoint syntax (a named_type never sits inside a directive argument) so they never contend. Coverage: IntraSchemaDefinitionTest (9 cases through a real Workspace: same-file, cross-file, implements interface, union member, input field, built-in scalar empty, unknown type empty, cursor-on-declaration empty, definition-wins-over-extension; assertions on the returned Location URI + Range, not walk internals). Out of scope: extend-block navigation, find-references, the JavaParser-gated jOOQ per-line refinement (R90). Filed and implemented as R335; renumbered to R340 on landing after a parallel session allocated R335 to a different item (the input-surface classify-and-emit walk fold) that reached trunk first. Spec → Ready reviewed and In Review → Done approved by a session distinct from the implementer. Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db, 11 modules incl. graphitron-lsp).

R316 (slices 1-3b landed pre-rebase in the squashed root; slice 4a 9f643a7 + 4b 09f3868; slice 5 e522fb4 + prose sweep c900455 + code-generation-triggers.adoc 3e3f607 + changelog forward-notes 903e84d; In Review transition 70ce94e): Pivot the field-dimensional model from carrier × intent × mapping to (source, operation, target). A field is an edge: it arrives into a source (a wrapper around a SourceShape, the arm being the arrival cardinality and the emit-strategy dispatch: Root | OnlyChild | Child), performs an operation (a sealed interface with payload-carrying record arms replacing the flat Intent enum: Fetch / Paginate / Lookup / ServiceCall / Count / Facet / Nest / NodeResolve / EntityResolve / the writes), and projects a target (a Single | List wrapper around a TargetShape, output cardinality read off the GraphQL return type). SourceShape ⊆ TargetShape; cardinality lives only as a wrapper bound to an endpoint, never a free enum (the wrapper-algebra invariant). Built populated, not abstract: ServiceCall collapses the former QueryService / MutationService verb pair (read/write is the Source.Root.Query / Source.Root.Mutation legality gate now), holding the two un-unified call carriers in a transitional Call holder pinned to R314; the fused Mapping.TableConnection decomposes into Target.Single(Connection) (shape) + Operation.Paginate (windowed-read verb); declared-gap arms (Count / Facet / EntityResolve / UpdateMatching / DeleteMatching, plus the Interface / Union participant payloads) are modeled-but-unpopulated with documented known-gap entries. Slices: 1 rewrote the R222 model (docs); 2-3 introduced source() / operation() / target() additively (bridges deriving the retired axes so the corpus classified unchanged); 4a re-derived OutputField.requiresReFetch() + the dispatchPerformsReFetch validator mirror over the new axes (the bare TargetShape.Table × holds-records guard, behaviour-preserving against mapping() != Mapping.Table); 4b migrated the @classified R281 corpus onto source: / operation: / target: + sourceShape: / targetShape:, recut DimensionTuple to compare at the altitude the directive can express (Source by structural equality, Operation by arm type token, Target by (wrapper, outer-shape) token pair), and deleted the bridges and the four retired types (Carrier / Intent / Mapping / SourceCardinality); 5 landed the thoroughness gate. Tests: WrapperAlgebraTest (the sourceWrapperIsTheFoldOfAncestorTargetWrappers invariant, target half mirrored against the parsed SDL output wrapper, source half pinned at the conservative Child strength R305 builds, with the connection decomposition and scalar-projection-leaf exemptions guarded against rot); RetiredDimensionTypesAreGoneTest (type-resurrection backstop: deleted files, no model-package imports, distinctive names Intent / SourceCardinality absent as whole words, carve-outs SourceShape / LookupMapping / MappingEntry retained); ClassifiedDslTest.everyDimensionValueIsExercised (the disjoint-exhaustive coverage partition over the source / Operation seals with the SDL-vs-Java name mirror); ReFetchDerivationTest migrated behaviourally onto the new axes; SourceShapeProjectionTest retained as the source-arm projection guard. No code-string assertions on generated method bodies. The recommended leafReconstructsFromCoordinate completeness pin is deferred (the old flat-enum corpus never pinned payloads either, so nothing regressed). The dispatchPerformsReFetch mirror survives R316 by design (retiring it is R314’s emit re-platforming). Downstream: the SourceKey decomposition becomes the first concrete consumer once this pivot lands. The R290 / R299 / R305 changelog entries carry forward-notes flagging their dimensional vocabulary as historical. In Review → Done review (claude/r316-review-mj53fc) swept three residual retired-vocabulary remnants slice 5 missed (two dangling {@link #intent()} / {@link #mapping()} method-links to deleted methods in OutputField / ChildField, and ReFetchDerivationTest’s class-prose) onto the new vocabulary. Full reactor green (`mvn -f graphitron-rewrite/pom.xml install -Plocal-db, 11 modules incl. graphitron-lsp).

R315 (0bb7161 + nullable-same-table-identity execution rework 0d4acca): Bind FK-reference @nodeId onto jOOQ-record @service params. Generalizes R311’s same-table identity case to cross-table foreign-key references: a @service parameter typed as a generated jOOQ TableRecord can now be populated from an input whose @nodeId fields reference other node types (the status / history / junction-row shape), with each decoded key mapped through the catalog FK constraint to the FK’s child columns on the record. Ports legacy NodeIdReferenceHelpers.mapKeyColumnsThroughForeignKey into the rewrite’s model. Model (D1): CallSiteExtraction.JooqRecord.keyDecode (Optional) becomes keyDecodes (List, so a record may carry several @nodeId fields); RecordKeyDecode generalizes R311’s keyColumns to targetColumns (the resolved columns on this record the decoded values load into, identity or FK-child) and gains a nonNull flag. Deliberately no KeyProjection sub-axis: both arms load targetColumns identically, the identity-vs-FK distinction lives only in the resolver, and nothing downstream branches on it. FK resolution (D3): the FK-orientation-and-pairing core extracts out of BuildContext.synthesizeFkJoin into resolveFkSlots, so the join path and the new resolveRecordFkTargetColumns share one bug-fixed orientation site (parent columns from ForeignKey.getKeyFields(), not getKey().getFields(), which mis-pairs a composite FK whose referenced-column order differs from the parent PK order); target columns reconcile to node-key (decode) order by column identity, not positional zip (a reordered FK whose referenced order differs from the node key would otherwise mis-assign every value). FK deduced when exactly one connects the two tables, else named verbatim by @reference(path: [{key:}]) (only the first path element is consulted for record population). Convergence by rejection (D2): @table on the input classifies it as TableInputType ("Graphitron owns the DML"), which contradicts a jOOQ-record @service param ("the service owns the DML"); InputBeanResolver keeps R311’s JooqTableRecordInputType trigger and adds a narrower isTableRecord reject arm so a @table-present record param fails honestly ("drop @table…") instead of falling to the bean path’s misleading "has no fields matching." Null semantics (D4): JooqRecordInstantiationEmitter switches from a single fromArray batch to per-binding conditional loads keyed on raw.containsKey(…​), applied uniformly to @field columns and each @nodeId decode: a non-null (ID!/!) binding always loads and throws on a null / wrong-type decode (R195); a nullable (ID) binding leaves an omitted column unwritten (changed=false, excluded from the service’s INSERT/UPDATE), sets a present-null to NULL via set(field, null) (reliable changed flag; fromArray null-skips), and decodes-and-loads a present value; coercion stays on the non-deprecated fromArray path. Two R311 behavior changes carried, folded in deliberately (D4): (1) R311’s same-table identity single fromArray batch becomes per-binding conditional loads; (2) a nullable (ID) same-table identity moves from always-throw-on-null to skip-when-omitted (a service-side upsert input: omitted → unset PK → the service-owned INSERT lets the DB assign it). The emitter’s "two disjoint fromArray groups" javadoc and the RecordKeyDecode "always throws … whether ID! or ID`" javadoc are both retired so neither becomes a false invariant. Rejections (build-time `UnclassifiedField): zero/multiple FK without @reference(key:); a node key column not covered by the chosen FK; an explicit @reference on a same-table @nodeId (a self-FK request, out of scope, preserving legacy’s loud forbiddance instead of silently writing the record’s own PK); (unchanged R311) @field→no column, cardinality parity, @nodeId without typeName. The R311 single-@nodeId gate is removed: multiple @nodeId is now legal (each resolves independently; overlapping-load-column value-agreement is a runtime concern deferred to R322, last-write-wins here, never hit by the motivating consumer whose references are disjoint-column). Coverage: pipeline JooqRecordServiceParamPipelineTest (21 cases: FK deduction, the renamed-FK target column endorsed_film≠film_id real pin, reordered composite-key decode-order reconciliation, explicit @reference(key:) disambiguation on the two-FK studierett, the @table reject, mixed identity + FK + plain @field, the full rejection set, the former twoNodeIdFields_reject flipped to a positive two-keyDecodes classification) + SynthesizeFkJoinReorderedKeysTest (slot orientation pinned for both consumers); execution (sakila) the FK-child INSERT readback proving the decoded id lands on the renamed endorsed_film child column, the nullable FK-reference / nullable plain-column omitted-vs-null-vs-set changed-flag contract, and (rework) the nullable same-table identity on AddressRecord (omitted → DB-assigned serial PK via the service-owned INSERT, set → decoded id on the PK), the only tier that observes changed=false exclusion; compile (graphitron-sakila-example) createFilmEndorsementRecord against real jOOQ at Java 17. Adds the public.film_endorsement renamed-FK fixture (FK child endorsed_film ≠ referenced film_id) and reuses idreffixture.studierett / nodeidfixture.reordered_fk_child / child_ref. User docs: FK-reference @nodeId on @service jOOQ-record params documented in nodeId.adoc. Generalizes R311; the @table-on-input deprecation / argMapping grouping stays R97, self-reference and pojo member-axis FK-@nodeId are separate items, overlap value-agreement is R322. Motivated by four utdanningsregisteret-graphql-spec status-mutation consumer shapes. Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db, 11 modules).

R325 (folded into R317, no implementation shipped): Classify in a single field-first visitor walk (retire the eager type pass). Filed 2026-06-17 as a from-first-principles restatement of R317’s goal, then folded into R317 the same day and discarded as a separate item. Its substance lives in R317’s "Read-free visitor invariant and the single walk" section: the read-free visitor invariant (the classifying visit may only register, never read the registry under construction), parent context down the SchemaTraverser var channel, reconciliation in the registry (the visit stays pure), the parent-independent-entry guard that dissolves the dedup worry, the explicit non-field edges (@node/@key seeds, interface<→object structural edges, per-usage input resolution), validations as named post-walk passes, the anti-narrative slicing rule (no remaining slice may be structure-only), and the falsifiable acceptance test (no type registered before its discovering field is visited). The one mechanism fork it raised, no global pre-pass fixed points, was settled by treating a precomputed fixed point passed as an explicit traverser argument as read-free-compatible: the NodeIndex stays precomputed and threaded in, reflection grounding becomes on-demand (no RecordBindingResolver.resolveAll() precondition). R317 stays backwards-compatible: it restructures type classification and keeps the leaf ChildField model untouched; the genuinely distinct idea this thread surfaced, classifying fields directly into the dimensional (source, operation, target) model so the field carries its own type/table binding, is a separate switch off the leaf model that lives with R316 (the (source, operation, target) pivot) and R314 (dimensional emit, where the leaves dissolve), not with the R317 driver. (Independently discarded from trunk’s side as 1ac9c75; the two discards reconciled here.) Number retired, not reused.

R324 (45bf3cb): Lift the single-cardinality multi-hop @splitQuery restriction. A single-cardinality @splitQuery child field (returns T, not [T!]) whose @reference(path:) had more than one hop was rejected at classification time (FieldBuilder.classifyObjectReturnChildField’s `FieldWrapper.Single && elements().size() != 1 Rejection.deferred), even though the supporting classification machinery (deriveSplitQuerySource keying off path.get(0), BuildContext.buildParentCorrelation pinning only firstHop) was already hop-count agnostic. The gap was entirely in SplitRowsMethodEmitter: of the three cardinality siblings only buildSingleMethod never grew the bridging-hop loop, projecting/FROMing off firstAlias with a single-hop-only (firstAlias, firstAlias) per-hop WHERE shortcut. The fix extracts two shared private helpers retiring the list/single/connection topology duplication that caused the drift, emitFromBridgeAndParentJoin (FROM-terminal + bridging-hop loop + OnConditionJoin parent JOIN + parentInput correlation) and buildWhereCondition (per-hop FK whereFilter`s + field-level filters); all three siblings route through both, and the connection WHERE loop’s unconditional `(JoinStep.FkJoin) cast becomes the shared instanceof-guarded form. buildSingleMethod now projects/FROMs off terminalAlias and bridges multi-hop, returning scatterSingleByIdx unchanged; single-hop paths collapse the bridging loop to a no-op, so the RecordTableField emitsSingleRecordPerKey() path that also routes through buildSingleMethod emits exactly as before (audited, no change required). Bridging hops are inner joins consistent with the siblings: a to-one chain resolves to null when any hop is absent; distinguishing intermediate-null from terminal-null (LEFT JOINs) stays out of scope. The classifier guard is removed; the motivating Customer.storeAddress shape (customer → store → address) now classifies as SplitTableField with a 2-hop joinPath. Coverage: pipeline GraphitronSchemaBuilderTest.SPLIT_TABLE_MULTI_HOP_SINGLE_CARDINALITY (the former _REJECTED enum, now a positive 2-hop FkJoin assertion keyed on store_id), execution GraphQLQueryTest.splitTableField_singleCardinality_multiHop_bridgesToTerminalAddressPerCustomer + _dedupesSharedKey_oneBatchRoundTrip (correct Address per customer matching the inline storeAddress navigation, and a single batched rows-method round-trip); the null-where-no-match semantic is structurally covered by ScatterSingleByIdxTest + the existing single-hop null-FK fixtures since Sakila’s customer.store_id / store.address_id are both NOT NULL. The now-false "single-cardinality multi-hop requires split" bullet is dropped from split-vs-inline.adoc (the shape works inline and via split). Emitter-only; no model-shape, directive, or wire-format change. Motivated by a sis-graphql-spec consumer shape. Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db).

R23 (c38779e): Multi-parent NestingField sharing, TableField arm. Lifted the multi-parent shared-shape gate in GraphitronSchemaValidator.compareNestedFieldsShape for ChildField.TableField: a plain-object NestingField type may now be shared across multiple @table parents when its shared leaves include inline TableField`s, where before the catch-all rejected them with "not yet supported across multiple parents". The arm admits the pair without further shape comparison, the upstream class-equality gate (`continue on a getClass() mismatch) already guarantees both sides are TableField, and returnType() derives from the single SDL declaration on the shared nested type so it is identical by construction; per-parent joinPath / filters / orderBy / pagination are intentionally not compared because each parent’s $fields emits its own correlated DSL.multiset arm. No emitter or wiring change: TableField is a PROJECTED_LEAF whose reified read (FetcherEmitter.bind, wrapped in LightFetcher) pulls by field name from the source Record without consulting the outer parent table, so first-parent-wins nested-type registration has no runtime effect for this leaf. Coverage: pipeline GraphitronSchemaBuilderTest#multiParentSharedNesting_inlineTableFieldLeaf_classifiesAndValidatesPerParent (two @table parents sharing a nested type whose address leaf classifies as a TableField with a distinct per-parent FK joinPath; validator emits no error), execution GraphQLQueryTest#multiParentSharedNesting_inlineTableField_returnsAddressPerParent (shared OccupantLocation across Customer and Store, each resolving address per parent, the Customer side pinned to the same row as the direct Customer.address FK navigation), and the existing NestingFieldValidationTest non-TableField rejection stays green. Retired the stale #8 roadmap pointer in the catch-all comment; filed the BatchKey-leaves follow-up (and the open LookupTableField re-scoping question) as R323. Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db, 11 modules).

R321 (6601e39): One-shot mojos (graphitron:validate / generate) now render ValidationFailedException.errors() in the Maven failure output, at parity with DevMojo and the SchemaProblem branch. AbstractRewriteMojo.runGenerator previously special-cased SchemaProblem but let ValidationFailedException fall through to the generic catch (RuntimeException e) arm, which rethrew only the exception’s message (the bare N schema validation error(s) count) so a consumer build (opptak-subgraph) saw no file:line:col detail. The fix adds a sibling catch (ValidationFailedException e) arm ahead of the generic one, mirroring the SchemaProblem arm: it wraps the cause in a null-message intermediary (so Maven’s DefaultExceptionHandler does not append the bare count after the detail) and keeps the exception on the cause chain for -e / -X. Rendering is factored into a package-private validationFailureMessage(List<ValidationError>) that prepends a "GraphQL schema validation failed:" header (matching the SchemaProblemDiagnostic arm) to WatchErrorFormatter.format(errors, null), the same renderer the graphitron:dev loop uses (null previous-key set drops the dev-only delta line), so the one-shot and dev surfaces share one renderer and cannot drift. This covers errors raised at any build stage (validate(), the GraphitronSchemaBuilder.buildBundle federation-recipe rewrap, or TagLinkSynthesiser.apply). Coverage: AbstractRewriteMojoTest asserts the message carries per-error file:line:col detail (not just the count) and embeds the exact tree WatchErrorFormatter.format(errors, null) produces (structural dev-loop parity), at the same formatter-level tier as the sibling SchemaProblemDiagnosticTest. Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db).

R318 (subsumed into R317, no implementation shipped): Validation registers diagnostics without reclassifying (immutable validate phase). Filed 2026-06-17 as a follow-on to R317’s single classification pass, then inlined into R317 the same day as its closing slice when R317 was rescoped from a byte-identical reorder to the full single-edge-driven-classify-pass + immutable-validate arc. No standalone work shipped; the immutable validate phase lands under R317. Number retired, not reused.

R279 (slice 3b inversion ee77a33, slice 4 507242f, slice 5 4a1a117, slice 6 prune 0e13c12 + verb-collapse 2437a84; In Review transition df6c1f7; slices 1/2/3a landed pre-rebase): Field-first reachability-driven classification driver. Replaces the eager type-pass / all-objects field-pass / four-post-pass sequence with a reachability-driven, field-first walk that classifies each type as a byproduct of the field edge that reaches it, then validates, then emits. R222 slice; supersedes R166 (the reachability prune is structural here, not a per-emitter skip-filter), and spins R166’s typed-non-empty-carrier sub-thread to R280. The walk seeds Query + Mutation + Subscription roots plus a @node/@key directive scan, and descends output edges (field→target, union→members native; interface→implementor and object/interface→interface via the custom SchemaTraverser child function, the load-bearing fan-out that keeps a directly-seeded federation implementor from pruning the Node interface its implements clause references). The accumulator owns reconciliation: TypeRegistry.register is the sole write verb (the Q2 verb-collapse), reconciling repeated registrations three ways (equal → idempotent, compatible → merge incl. the cross-carrier federation @tag union and shareable OR for synthesised Connection/Edge/PageInfo, incompatible → demote to UnclassifiedType); the former classify/enrich/synthesize/demote verbs dissolve into it, the trace Op derived from the reconciliation arm so per-call observability survives. The classifier is a pure producer reading only node SDL + reflection + downward TraverserContext context (never sideways/back), making verdicts order-independent; TypeBuilder.findReturnTablesForInput’s global back-scan dissolves into a local field-visit read. What shipped across the slices: order-independent `participantClassification (3a, replacing the sideways ctx.types.get read); the field-first driver inversion with compensating orphan sweeps (3b); DomainReturnType enforcement relocated from a reclassifying post-pass to a GraphitronSchemaValidator rule (collectDomainReturnTypeConflicts + validateUniformDomainReturnType, model change + validator rule in one commit, no enforcement gap); ConnectionPromoter folded into the walk as synthesiseForField with a single-producer rebuildAssembledForConnections (5); orphan prune made observable (an unreachable @table object is no longer classified) and the verb-collapse completed (6). The down-the-walk context admits ancestor-cardinality accumulation as a first-class rider so R308 can compute the source-cardinality ancestor-product without re-walking; R279 itself stays behaviour-preserving and does not compute it. Honest residual: the "true single-pass DFS fold" (approach A, inlining type classification into the field visit and deleting TypeBuilder.buildTypes) is deferred to R317 (now Ready); the driver is field-first and the walk is the sole classifier, but buildTypes still hosts the type-classify loop over the walk’s reachable set. Coverage: SchemaReachabilityTest (the reachable ⊆ classified safety invariant, hardened at slice 6 to "every classified output composite is reachable"), ConnectionAssembledDeltaPipelineTest (the assembled-schema delta, the projection differential’s blind spot), ProjectionSnapshotComparator (dev bisect aid only, never the gate), and the designated primary gate throughout: the GraphitronSchemaBuilderTest exhaustive truth table + sakila pipeline TypeSpec + the Java-17 graphitron-sakila-example compile + the PostgreSQL execution tier; assertions are on classified-model/assembled-schema structure, no generated-body code-string matches. FieldBuilder’s ~5660 lines of per-field logic untouched (the change is the driver, reachability, and registration); LSP `TypeClassification/FieldClassification projections confirmed unaffected. Forward edge R279 → R308; supersedes R166. Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db, 11 modules).

R311 (c0e8626): Bind a jOOQ TableRecord (singular Record or List<…>) directly as a @service input param. A top-level @service parameter whose Java type is a generated jOOQ TableRecord already classified as JooqTableRecordInputType on the type side but could not be bound at the call site: InputBeanResolver.enrich bean-ified it on the Java-member axis, so a @field naming a column matched nothing and the build rejected with a misleading "has no fields matching". enrich now reads the already-classified type (table and all) just after the shared input-object gates (loadable / Map / cardinality-parity) and binds on the column axis instead: each plain @field field resolves to a ColumnRef (a CallSiteExtraction.ColumnBinding), and a single @nodeId field decodes the record’s scalar key (R195’s wire mechanism projected onto the param record’s own identity, a RecordKeyDecode); a lifted record-type-mismatch gate rejects a foreign-table @nodeId. New model: the CallSiteExtraction.JooqRecord permit + the column-axis ColumnBinding / RecordKeyDecode records (siblings to the member-axis InputBean / FieldBinding, each carrying its own sdlFieldName Map key since neither rides a FieldBinding), with a compact-constructor at-least-one-binding floor; and ValueShape.JooqRecordInput, a path-carrying leaf that also carries its construction carrier (the Scalar-carries-leafTransform precedent) so the helper-queue collector registers from the ValueShape alone. A new JooqRecordInstantiationEmitter emits a deduped create<Record>(Map) / create<Record>List(Object) helper pair (record fromArray(…, Tables.<T>.<col>) for the columns, no deprecated DataType.convert, + NodeIdEncoder.decodeValues for the identity), reached identically from the root emitter (ServiceMethodCallEmitter via the new leaf) and the child-coordinate emitter (ArgCallEmitter real arm) ; the binding is coordinate-agnostic (enrich runs for child @service too, before the isRoot gate) and both cardinalities share one construction site (the plural maps the singular per element). The TypeFetcherGenerator dual walk feeds one record-class-keyed dedup queue so either coordinate emits the helper exactly once. The two sealed additions force-flag every exhaustive switch: real arms where reachable (valueShapeExpression / listExpression / ArgCallEmitter.buildArgExtraction / collectFromValueShape), defensive/throw arms where a JooqRecord(Input) is never an InputBean field leaf. The misleading bean message becomes honest, validate-time UnclassifiedField rejections (foreign-table @nodeId, two @nodeId, unresolvable column with a Levenshtein candidate hint, cardinality mismatch at the shared parity gate). Coverage: JooqRecordServiceParamPipelineTest (11 cases: singular, composite key, list → ListOf(JooqRecordInput), the regression pin for the original bug, the child coordinate, and the rejection set), four GraphQLQueryTest execution cases round-tripping the identity decode + column SET against PostgreSQL (singular, composite, list, wrong-type-throws), and the sakila-example compile tier type-checking the emitted helpers + the child ArgCallEmitter call against the real catalog; no generated-body string assertions. A call-site param-binding NOTE lands on the @service surface in code-generation-triggers.adoc (the classification was already documented). Out of scope: Set<TableRecord> (inherits the InputBean path’s imperfect Set handling), FK-reference @nodeId and @table-on-input (both R97). Motivated by the endreUtdanningsspesifikasjonsstatus(List<…Record>) consumer shape. Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db, 11 modules).

R310 (da56aa8): Name the forbidden directive on an otherwise-valid DML payload carrier’s data field. A @mutation(typeName: INSERT/UPDATE/DELETE) field whose payload’s single data field carried a DML-forbidden directive (e.g. @splitQuery) was rejected with the misdirected generic "is not yet supported; use ID or a @table type", pointing at the (fine) return type rather than the one-token edit on the data field that actually disqualified it. A new BuildContext.diagnoseForbiddenCarrierDirective would-admit-but-for-the-directive probe re-runs the structural DML scan under a private ForbiddenDirectivePolicy.IGNORE gate, leaving the public scan contract (scanStructuralDmlPayload / scanStructuralServiceCarrierPayload and every speculative caller) byte-for-byte unchanged; when the payload would admit as a carrier but for the forbidden directive, the single ScalarReturnType arm of MutationInputResolver.validateReturnType (where all three DML kinds converge) surfaces a targeted message naming the data field and the @-prefixed directive, with the @service-carrier @splitQuery asymmetry note (R275, the warnIfSplitQueryOnRecordParent advisory) appended conditionally. The generic message stays the fall-through for genuinely unsupported scalar returns. The rejection keeps the uniform prose Rejection.structural shape of its sibling validateReturnType arms; a typed ReturnTypeError sub-seal lift is deferred. Coverage: four MutationDmlCase pipeline cases (UPDATE + INSERT @splitQuery through two distinct routing paths pinning the "one arm covers all DML kinds" invariant, a non-@splitQuery @condition, and a negative-control would-not-admit two-data-channel payload confirming the probe does not over-fire), asserting load-bearing tokens on UnclassifiedField.reason() with no generated-body string assertions. Discovered during the utdanningsregisteret Graphitron 10 migration; sibling of R213 (message vs location). Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db, 11 modules).

R305 (slice 1 b3f0f68, slice 2 355f9b5, slice 3 collapse 7e672b9 + re-fetch derivation d829d42, source-shape mirror 18d3aee; In Review transitions c6847c6 + 18d3aee): Forward note (R316, 2026-06-19): the carrier / intent / mapping / source-cardinality model this entry describes was pivoted to (source, operation, target); the Carrier / Intent / Mapping / SourceCardinality types named below no longer exist. Read the dimensional vocabulary here as historical. Expand the carrier dimension with source-shape and cardinality; separate re-fetch from intent and collapse SingleRecordTableField into RecordTableField. R222 Stage 3 follow-on to R290. The carrier dimension gains a Source-arm source-shape (Table | Record, the input-side mirror of mapping’s `Table:Column :: Record:Field) and source cardinality (One | Many); Carrier is now sealed (Query / Mutation payload-less, Source(SourceShape, SourceCardinality)). The deeper correction (settled 2026-06-15): intent and re-fetch are orthogonal. Intent classifies the target and how arguments are interpreted (Fetch, Lookup, the writes, QueryService); re-fetch is the derived Record-to-Table crossing. OutputField.requiresReFetch() derives Table mapping × holds-records (Source{Record} received or a Service/DML intent produced), not from intent alone, catching the whole family (former-SRTF, RTF, RLTF, RTMF, STF); GraphitronSchemaValidator.dispatchPerformsReFetch mirrors it. SingleRecordTableField is deleted: the two FieldBuilder carrier sites (R178 DML, R275 @service) now build RecordTableField via buildPayloadCarrierRecordTableField (a single JoinStep.LiftedHop over the target PK folding source=target onto one ColumnRef, plus a new SourceKey.Reader.ProducedRecordRead); intent stays Fetch. The runtime-call insight that settled it: SRTF and RTF are the same shape, the carrier field is called once with the producer’s full held output and feeds the same Split-rows VALUES(idx,pk) JOIN … ORDER BY idx scatter; only the key reader differs. Source cardinality is conservatively hard-coded Many (the absorbing element, always-correct as a one-element batch); the inline One-skip optimisation is kept as dead code until R279 computes the true ancestor-product cardinality. OrderingOwnedByProducer is deleted, its validateListRequiresOrdering exemption replaced by a plain requiresReFetch exemption (also fixing a latent bug: a PK-less idx-ordered re-fetch is now admitted rather than wrongly rejected). The 352-line FetcherEmitter SRTF path is removed with the LocalContext null-source guard preserved; the LSP FieldClassification.SingleRecordTable projection collapsed into RecordTableTarget. One honestly-documented divergence: dispatch routes by leaf identity (every RecordTableField batches) rather than literally reading the Many slot at the fork; net effect matches the spec, R314 filed for the follow-up. Coverage: ReFetchDerivationTest (true across the Record-source family + mirror agreement), SourceShapeProjectionTest (walks every corpus-demonstrated ChildField and cross-checks sourceShape() against the parent type’s independently-classified backing ; TableBackedType → Table, else Record ; exercising both arms, with a reflective sealed-leaf guard over ChildField whose uncovered leaves must carry a documented NOT_CORPUS_COVERED entry; the validator-mirrors-classifier analogue of dispatchPerformsReFetch), the @classified corpus grown with sourceShape / sourceCardinality args and the former-SRTF row retargeted to RecordTableField / Source{Record, Many} / intent Fetch, SingleRecordPayloadPipelineTest instanceof retargets, GeneratorCoverageTest.everyGraphitronFieldLeafHasAKnownDispatchStatus exhaustive/disjoint after the leaf deletion, and the load-bearing execution tier (SingleRecordPayloadDmlTest / SingleRecordTableFieldServiceProducerExecutionTest) preserving R141 / R158 / R275 payload-carrier behaviour (single + bulk, DIRECT + OUTCOME_SUCCESS, fjernSakTagg) end-to-end against PostgreSQL through the batched Split-rows path; no method-body code-string assertions. This is a deliberate leaf change, not byte-invariance: the former-SRTF coordinate’s emitted SQL becomes the batched idx-ordered VALUES-join scatter and its re-fetch verdict flips to true, while the runtime result (same rows, same source order) is preserved. Out of scope: the @service carrier arriving as a list (R308), target-cardinality-many on the One path, and the broader SourceKey.Cardinality wrapper().isList() disentangling (rides R222). Full reactor green (mvn install -Plocal-db, 11 modules incl. graphitron-lsp).

R309 (82f2ba3): Descriptions for query-as-view projections. A # …​ line comment authored above a selected coordinate in a corpus doc-example projection query now renders as that coordinate’s SDL description in QueryViewRenderer output: above a field it describes the field, above …​ on T or a top-level fragment f on T it describes type T; multiple comment lines join into a block-string """…​""" description, and a comment-free projection renders unchanged (the existing seven QueryViewRendererTest cases stay byte-equal). Touched gains type/field description side tables, Walk records them through the single descriptionOf(Node) source seam (where native executable getDescription() reads on FragmentDefinition / VariableDefinition fold in once graphql-java is bumped past the pinned 25.0), and prune / keptFields / stripInternalDirectives stamp them onto the rebuilt DescribedNode`s via a shared `applyDescription helper. Field prose stays comment-sourced because Field is not a DescribedNode in any graphql-java version, making comments the durable carrier rather than a stopgap. This is test-and-docs tooling under src/test, not the production generator path: the catalog corpus example’s query() gains comments so its rendered block on code-generation-triggers.adoc carries field descriptions, and ClassifiedDocTest guards that block verbatim. Coverage: five new QueryViewRendererTest pipeline cases (field description, inline-fragment type, top-level-fragment type, multi-line block string, comment-free no-regression pin), all asserting on rendered SDL rather than generated method bodies. Out of scope: the graphql-java version bump and native-description source read (the descriptionOf extension), descriptions on production generator output, and operation-level (query { …​ }) descriptions. Full reactor green.

R200 (e7be7f4): Honor @field(name:) in InputBeanResolver for @service input-bean/record member binding. The resolver bound consumer-bean/record members by raw SDL-field name, reading zero directives: a Java member name diverging from the SDL field name lost the binding (JavaBeans rejected with "no fields matching"; records silently emitted an under-arity canonical-constructor call). bindingKey(f) now reads @field(name:) per SDL field as the Java-member binding key (the house argString(f, DIR_FIELD, ARG_NAME).orElse(f.getName()) idiom, the input-side mirror of R191’s output accessor axis), and buildInputBeanBody is restructured: the record-vs-JavaBean target is computed once and dispatched via switch (target) into bindRecord / bindJavaBean (the mid-loop isRecord() re-tests collapse; recordOrder / sdlOrder deleted); a single collision-checked sdlByBindingKey index shared by both arms rejects two SDL fields resolving to one member (ambiguity) and a present-but-blank @field(name: ""); the record arm enforces a total bijection in bindRecord (direction A: every component must bind, was a silent under-arity drop; direction B: every SDL field must be consumed, was a silent data drop), retiring the dead "has no component named" branch by construction, while the JavaBean arm keeps partial-population tolerance and the empty-bindings rejection. Per-field leaf classification factors into a shared bindField returning a builder-internal sealed FieldResult (Ok / Fail); no new CallSiteExtraction leaf, so InputBeanInstantiationEmitter’s exhaustive switch is untouched, and `FieldBinding keeps sdlFieldName (the wire/Map key) separate from javaFieldName (the member) so emit stays selection-agnostic. Rejections ride the existing Built.Fail → Rejection.structural → UnclassifiedField path. The @field docstring gains the Java-member axis for both the R191 output (FIELD_DEFINITION) and R200 input (INPUT_FIELD_DEFINITION) sites, paying off R191’s output-axis doc debt. The R97 org.jooq.* looksLikeBeanCandidate seam (jOOQ-TableRecord-as-param) and the R195 @nodeId jOOQ-record-member leaf are untouched. Coverage: pipeline-tier positive cases (record + JavaBean renamed via @field, asserting FieldBinding.javaFieldName() is the directive value while sdlFieldName() stays the SDL name), rejection cases (direction A/B, ambiguity, blank value, all on UnclassifiedField.reason()), a regression floor (a divergent-name JavaBean without @field still rejects "has no fields matching"); execution-tier submitFilmReviewSummary_routesThroughFieldRenamedRecordBean round-trips through a @field-renamed record bean (the round-tripped reviewId proves positional binding); new fixtures TestInputBeanRenamed / TestInputJavaBeanRenamed / TestInputSubsetRecord / FilmReviewSummary. Input-side counterpart of R191; R201 / R202 carry the remaining @field-symmetry items. Full reactor green.

R307 (Part A 2741787 + Part B 5fe85f5; In Review transition cce19f3): Retire stale @record references. @record stays a declared, legal-but-ignored directive (directives.graphqls declaration + readRecordClassName intact, nothing reads it to drive binding), but every treatment that implied it was live is gone. Part A rewrote the five rejection messages that steered authors toward authoring @record (dropping the never-valid @record(class:) form) to name the reflected-backing path instead, and renamed @record-as-jargon for "record-backed type" to "record-backed" / the variant name across main and test source. Part B: (1) the standalone TypeBuilder.emitDirectiveIgnoredWarnings post-classification re-walk is replaced by a per-type emitDirectiveIgnoredWarning called from the single classification pass, so the deprecation warning is a classification output; the three message variants (shadowed-by-@table, redundant/matches, disagrees) and the multi-producer-rejection suppression are preserved unchanged. (2) The LSP no longer treats @record as a live ExternalCodeReference-className binding: no className FQN completion, no "Unknown class" diagnostic, no live-binding hover, and (a warranted extension past the spec’s literal three surfaces) no legacy name:→className: alias nudge. Because the InputField("ExternalCodeReference", "className") coordinate is shared with @enum, each surface gates on the enclosing directive name (mirroring METHOD_VALIDATING_DIRECTIVES); the completion site gained the directive via a new directiveName field threaded from LspVocabulary.CursorLocation into CompletionContext. No @deprecated/deprecatedCoordinates wiring; the editor’s "ignored" signal stays the generator BuildWarning already surfaced through Diagnostics.validatorDiagnostics. (3) Every applied @record was purged from test-fixture SDL in both modules: generator binding-hint drops are classification-neutral (reflection binds via the @service/@mutation producer or @table), warning coverage consolidates into the new RecordDirectiveIgnoredWarningTest (three variants + suppression + reachability + @error-ignored + @table+@record no-conflict, all at the classifier with no generated-body string assertions), the LSP carve-out fixtures keep @record to assert the absence of tooling, and ValidatorDiagnosticsTest pins the @record-ignored BuildWarning surfacing as a usage-site Warning. BuildOutputReportPipelineTest’s report-wiring warning swapped from a redundant `@record to a redundant @splitQuery (the test needs only a model warning). The only applied @record left in either test tree is RecordDirectiveIgnoredWarningTest and the LSP carve-out fixtures. Out of scope (deferred): removing the directives.graphqls declaration. Full reactor green (mvn -f graphitron-rewrite/pom.xml install -Plocal-db, 11 modules).

R264 (98bafe8; In Review transition ef7bd17): roadmap-tool status round-trip no longer strips quotes from front-matter titles. The status subcommand rewrote the block through a snakeyaml load-then-hand-serialize round-trip with no value-quoting, so a quoted title: containing ": " (the common "subtitle: detail" shape, e.g. R256) came back as a bare string and was re-emitted as invalid YAML; the very next parse, including the README regeneration the same subcommand runs, threw ScannerException and left the file unreadable. Replaced the lossy write path with patchFrontMatter, which rewrites only the named keys (status, last-updated) in place and leaves every other line, the body, and the fences byte-for-byte untouched, also removing the latent risk of the round-trip reformatting lists and dates. Routed the sibling writeChangelogNextId through the same helper, retiring its identical hand-serialization loop. Coverage: RoadmapTitleQuoteRoundTripTest runs a full status subcommand (including the regeneration that was the live crash site) over a colon-bearing quoted title and asserts byte-for-byte preservation plus a clean re-parse, with a direct patchFrontMatter unit test for present-key replacement and absent-key append.

R290 (5ebc52c slice 1 + 1227f0c slice 2 + 84a49f2 slice 4; In Review transition 38006ad; docs passes 84de71e + 6ceafb0): Forward note (R316, 2026-06-19): the carrier × intent × mapping model this entry describes was pivoted to (source, operation, target); the Carrier / Intent / Mapping types and the carrier() / intent() / mapping() accessors named below no longer exist. Read the dimensional vocabulary here as historical. Field-side dimensional slots, materialise carrier × intent × mapping on the field and dissolve the fused cross-product’s leaf-identity reads. R222 Stage 3. Slice 1: carrier() / intent() / mapping() land as three narrow accessors on OutputField (the field root that survives Stage 6), computed at classification time, reproducing exactly what R281’s throwaway LeafTupleAdapter reconstructed; the dimension enums Carrier / Intent / Mapping move into the model package, the adapter is deleted, and the classified-corpus harness builds its test-side DimensionTuple by reading the three accessors off the field (ClassifiedHarness line ~114). Three accessors not a neutral tuple, per "narrow component types" and "sub-taxonomies carry distinct information": each consumer reads exactly the axis it forks on (legality reads carrier, polarity reads the intent family, build-vs-consume reads mapping, re-fetch reads intent × mapping jointly). The triple is a total classification (every field has all three), so no No<Family> absence arm. Slice 2: ConstructorField dissolved as wrong-by-design, a @table parent constructing a @record/@service child from its own row, reachable only via self-referential test coverage. The classifier’s ResultType arm in FieldBuilder.classifyChildFieldOnTableType now rejects with an UnclassifiedField whose structural rejection GraphitronSchemaValidator surfaces as a build-time error; the leaf, its dispatch (IMPLEMENTED_LEAVES/FetcherEmitter/TypeFetcherGenerator/CatalogBuilder), and its LeafTupleAdapter arm are removed. The constructor corpus example leaves the classified corpus and becomes ConstructorFieldValidationTest’s rejection fixture; the `GraphitronSchemaBuilderTest verdict + @ProjectionFor sibling are deleted and the SingleRecordPayloadPipelineTest / DummyFetcherFixtures constructor-child fixtures removed. Live leaves 49 → 48. Slice 4: the re-fetch derivation made real, the proof the slots earn their keep. OutputField.requiresReFetch() is the single home of the service/DML → @table re-query predicate, derived from intent × mapping (mapping == Table AND intent in {QueryService, MutationService, Insert, Update, Upsert, Delete}) rather than re-decided per leaf in the consumer; GraphitronSchemaValidator.validateField mirrors it against the generator’s actual re-fetch dispatch (dispatchPerformsReFetch) so the single-homed predicate and the emitter cannot drift, per "validator mirrors classifier invariants". Slice 3 (the SingleRecordTableField → RecordTableField collapse) was split out to R305 once implementation showed it is an emit-mechanism unification, not a leaf merge; R290’s delivered leaf set is 48 (the appendix’s 47 is R305’s post-collapse target). The ChildField → SourceField carrier rename is split to R302. Coverage: ReFetchDerivationTest (behavioural assertions on the accessor and on validation output, no code().toString() body matches), ConstructorFieldValidationTest (retargeted to the build-time rejection), GeneratorCoverageTest.everyGraphitronFieldLeafHasAKnownDispatchStatus (reflection-driven exhaustive/disjoint dispatch partition, stays green with one fewer entry), the R281/R299 classified corpus (byte-identical modulo the one removed constructor example), and the compile + execution tiers against real PostgreSQL as the behavioural backstop. Full reactor green end-to-end.

R303 (fbe9ac6 + 642d67a + 3462bf8; docs-hygiene rework 6adebd5 + 7f98c68): Reify inline datafetchers into named <Type>Fetchers methods. Most generated DataFetcher`s were emitted as anonymous inline value expressions in `<Type>Type.registerFetchers (lambdas, the R244/R268 arm-switch ternary, the record-walking blocks) or bare new ColumnFetcher<>(column) instantiations, leaving a datafetcher with no named symbol to breakpoint, stack-trace, or look up by field. Now every datafetcher is a public static method on the corresponding <Type>Fetchers class and the registration site is uniformly <Type>Fetchers::<field>, for every owning object type (root, table, node, result, nested, connection, edge, @error). Seam: FetcherEmitter’s value-`CodeBlock contract is replaced by a sealed FetcherBinding (Inline | Reified) so the field-name-to-method-name derivation lives in one place and the registration value and method declaration cannot drift; bind returns Reified carrying both the MethodSpec and the registration value (a bare Fetchers::field for env-dependent reads, or new LightFetcher<>(Fetchers::field) for source-only reads), and TypeFetcherGenerator.generateTypeSpec collects the reified method alongside the existing variant switch (method-backed variants return Inline, so no double-emission; the dispatch partition is untouched). The light path is preserved by renaming the generated ColumnFetcher → LightFetcher: it holds a Read<T> source-read SAM (T apply(Object source)) instead of a jOOQ Field<T>, stays a LightDataFetcher, and wraps the named read so the env-skipping fast path survives while the read gains a per-field symbol (the jOOQ column constant moves from the registration site into the method). The BatchKeyField-only gate for nested-type fetcher classes widens to "owns any fetcher" via one shared FetcherEmitter.nestedTypeOwnsFetchers predicate that both the reference site (FetcherRegistrationsEmitter.nestedBody) and the emit site (TypeFetcherGenerator.collectNestedFetcherClasses) call, closing the two-gate drift. Connection/edge get <Conn>Fetchers / <Edge>Fetchers delegate classes (ConnectionFetcherClassGenerator) whose thin per-field methods forward to the shared ConnectionHelper (one home for the pagination logic, hand-auditable; totalCount keeps its SDL-presence gate); @error types get <ErrorType>Fetchers with reified path / message reads (ErrorTypeFetcherClassGenerator) wired in place of the inline cast-lambdas in GraphitronSchemaClassGenerator. The R244/R268 Outcome arm-switch is reified to statement form (if (!(source instanceof Success<?> success)) return null; return …​;), the highest-value readability win and exactly the un-breakpointable expression the "Generated code is read and debugged" principle targets. One shape is honestly deferred: the @error PayloadAccessor errors field stays Inline(PropertyDataFetcher.fetching(name)) because reifying it needs a generation-time resolved accessor that ChildField.ErrorsField / Transport.PayloadAccessor do not carry, a classifier change this Spec scoped out; R304 (filed Backlog) carries the classifier-backed reification plus the resolvesViaPropertyDataFetcher / validateOutcomeChildArmSwitch reconciliation and the DataFetcherKind.PROPERTY_FETCHER retirement. Behaviour-preserving relocation: no classifier branch, no validator-mirror consequence. Coverage: FetcherPipelineTest wiring-kind + method-presence assertions (propertyField_onRecordType_reifiesReadMethod, propertyField_onBackedRecord_wrapsAccessorReadInLightFetcher, recordField_onRecordType_reifiesReadMethod, outcomePayload_columnDataField_armSwitchesInlineReadOnSuccessValue flipped to COLUMN_FETCHER-wrapping-a-method-reference), the per-type "class is emitted" pins for <Conn>/<Edge>/<ErrorType>/no-BatchKeyField-nested classes, TypeSpecAssertions.wiringFor matching new LightFetcher, and the compile-spec (sakila-example, <release>17</release>) + execute-spec tiers as the structural and behavioural backstops; no CodeBlock-string-equality assertions on reified method bodies. Two In Review → Ready cycles of docs-hygiene rework swept the stale ColumnFetcher spelling and the inverted "no per-field fetcher method / emitted inline" invariant out of src/main javadoc per "Documentation names only live tests/code". Full reactor green end-to-end.

R284 (1e2e719 In Review follow-up; the original four-site pass predates distinct history, folded into the squashed trunk): Fix reversed source/target alias order in bridging-hop @reference ConditionJoin emission. An FK-first-hop-then-@condition bridging path emitted the two-arg condition-method call as (targetAlias, sourceAlias), violating R16’s fixed (srcAlias, tgtAlias) convention; with the documented opptak samordnaOrganisasjoner shape (concrete, mutually incompatible junction-vs-leaf jOOQ table types) the generated resolver fails to compile. The same reversed call was duplicated across five emission sites; the initial pass swapped four (InlineColumnReferenceFieldEmitter, InlineTableFieldEmitter, and SplitRowsMethodEmitter’s split-rows + connection-rows arms) and the In Review follow-up swapped the fifth, `InlineLookupTableFieldEmitter, which carried the byte-identical reversed arm and shipped unguarded. The defect shipped silently because every prior condition-join fixture declared generic Table<?> parameters, which compile either way. Guard: the new ReferencePathConditionFixtures.filmActorJunctionToActor(FilmActor, Actor) fixture takes concrete incompatible types, so any future re-reversal fails to compile in compile-spec. Coverage: execution GraphQLQueryTest.splitTableField_bridgingConditionJoin_returnsActorsPerFilm round-trips Film.actorsViaJunctionCondition (split-rows path); inline-lookup guard FilmInlineBundle.actorsByKeyViaJunctionCondition routes the same FK-then-bridging-@condition path through InlineLookupTableFieldEmitter (the fifth site). Full reactor green.

e6d213d (reframe) + cc18815 (impl) → 5e34fb7 (Spec → Ready) ; R299 (intention-classification-dimension): Forward note (R316, 2026-06-19): the carrier x intent x mapping model this entry migrated the corpus onto was itself pivoted to (source, operation, target); the @classified directive and DimensionTuple now carry the new axes. Read the vocabulary here as historical. migrate the R281 corpus from the two-axis (producer, mapping) verdict onto R222’s refined carrier x intent x mapping model, while the leaves are still intact and ahead of R290’s field-side materialisation. DimensionTuple becomes (carrier, intent, mapping); ProducerStep retires; new Carrier {Query, Mutation, Source} and the full-model Intent enum land, mirrored SDL-side in ClassifiedDsl.PRELUDE and checked by carrierMirrorsAdapterValues / intentMirrorsAdapterValues. LeafTupleAdapter reconstructs all three from leaf identity (carrier from the enclosing sealed type, intent from leaf + DmlKind, mapping as before); the switch stays exhaustive over OutputField, and the derived layer (FetchRelated / re-fetch / new-query / polarity) stays computed, never asserted. @classified migrates to (carrier:, intent:, mapping:) across every corpus fixture; everyDimensionValueIsExercised now covers Carrier + Intent with a known-gap allowlist (the five R222 model-completeness gaps plus upstream-rejected Upsert, mirroring NO_CASE_REQUIRED). `code-generation-triggers.adoc’s Field Classification section is rewritten to the three axes + derived layer + assert-vs-derive, the child-table / record-table examples now teaching the derived layer. Corpus-and-docs only: no generator, validator, or field-model change (those are R290).

fc03387 + 6ab5127 + cf8262e (impl) → 97fbc02 (In Review) ; R293 (build-warning-cleanup): clean up build-time warnings so a full mvn install -Plocal-db is warning-free under -Xlint:all -Werror, leaving only declared-out-of-scope environment lines (sandbox jOOQ PG-version mismatch, Maven’s own Guice/Unsafe JVM notes, the R294 BuildWarning-channel fixture advisory). Mechanical sweep (handwritten-source raw types / dangling javadoc / serialVersionUID / getType→getTypeOrNull / Charsets→StandardCharsets, lsp FFM @SuppressWarnings("restricted") + surefire --enable-native-access, maven-plugin descriptor link, junit-platform.properties test-jar exclusion) plus emitter fixes. The generated-code casts the spec slotted for narrowest-scope @SuppressWarnings were instead dropped: env.getArgument / env.getSource are <T> T, so a typed-LHS statement removes the cast via inference (the spec’s preferred step-1 over its mis-categorised example); @SuppressWarnings reserved for the genuinely-unchecked residuals ((List<X>) map.get(key) off Map<?,?>). cf8262e further replaced the record-carrier Outcome.Success<?> capture + unchecked success.value() cast with a checked instanceof Outcome.Success<element> pattern-match (Success<T> implements Outcome<T>), via a shared emitRecordSourceLocal helper. Guard: -Werror added to the parent pom’s global compilerArgs (every -Xlint:all category enforced, none excluded, documented escape hatch), inherited by sakila-example’s release-17 generated-source compile (the cross-module backstop); ratchet comment updated. jOOQ ambiguous keys resolved by disabling <implicitJoinPathsToMany> on the public.* codegen (no catalog consumer navigates those to-many path methods).

2228b67…aa7a45e ; R281 (classification-test-dsl): classification test DSL, @classified spec-by-example. Replaces the doc-prose-plus-405-enum-row double specification of classification behaviour with an annotated SDL corpus that is the readable spec. Two test-only directives, @classified(producer: [ProducerStep!]!, mapping: Mapping!) on output fields and @classifiedType(as: TypeVerdict!) on types (enums ProducerStep / Mapping / TypeVerdict validated SDL-side via ClassifiedDsl.PRELUDE, never leaked into the production directives.graphqls), assert the two-axis dimensional verdict R222’s field pivot will adopt: producer (a pipeline of length ≤ 2: ∅ inline-correlate, or steps Query / Service / Dml) × mapping (Table / TableConnection / Column / Record / Field). The throwaway LeafTupleAdapter bridges today’s fused sealed leaves to those tuples via a compiler-exhaustive switch over OutputField that is R164’s leaf↔dimension truth table. ClassifiedHarness classifies each fixture with today’s classifier and compares; ClassifiedDslTest pins three coverage obligations (adapter totality compiler-enforced, every dimension value exercised, TypeVerdict mirrors GraphitronType’s non-failure leaves with a simple-name-uniqueness guard). `VariantCoverageTest was rewired so output-field and non-failure GraphitronType leaves are owned by ClassifiedCorpus.coveredLeaves() as the single source of truth, while input-field leaves stay on the GraphitronSchemaBuilderTest enum table and the failure leaves stay out of scope. QueryViewRenderer renders doc examples as query/fragment-as-view projections (real SDL regenerated, test directives stripped) with input-object and abstract-output-type closure expansion (pre-migration hardening item 3, QueryViewRendererTest); code-generation-triggers.adoc renders its worked examples from the corpus (ClassifiedDocTest) with reference tables corrected against TypeFetcherGenerator’s four-way emission partition (only `CompositeColumnReferenceField deferred). Retirement inventory committed at roadmap/audits/classification-test-dsl-inventory.md (35 pure-verdict rows, all retired against a corpus coordinate). Drives R222 Stage 3 (field-side pivot) as its executable acceptance spec; the TableInterfaceField / TableMethodField per-parent-query N+1 defect was filed as R288 rather than blessed as a [Query] verdict. Full reactor green.

fae7c6f + 1fdcf18 ; R295 (connection-synthesis-inherits-federation-tags): synthesised Connection / Edge / PageInfo types now inherit the federation @tag applications of their @asConnection carrier field, closing the contract-composition break where a tag-filtered contract kept the carrier field but dropped its untagged return type. ConnectionPromoter collects the arm-appropriate tags (carrier field on the directive arm, SDL Connection type on the structural arm), applies them to the synthesised Connection/Edge schema forms beside the existing shareable arm, and folds a tag union across all promoted carriers into the synthesised PageInfo exactly as pageInfoShareable folds shareable; an author-declared PageInfo is left untouched. Carriers sharing one connectionName: union their tags into the already-registered entry via typeRegistry.enrich on a transformed schemaType() (no parallel tags record component, per Model metadata over parallel type systems). Tests: ConnectionPromoterTest (explicit, repeatable, shared-name union, structural arm, SDL-PageInfo negative pin) + ConnectionFederationTagPipelineTest (<schemaInput tag> via loadAttributedRegistry and a federation-SDL emission round-trip). The deferred shareable boolean collapse is filed as R297. Tags land at the type level only; whether type-level-only tags satisfy a real Apollo contract build (vs. the field-level tags legacy contracts validated against) is the outstanding first-client check, tracked as R298 ; it could not run in the implementation/review sandbox, and the green SDL round-trip proves emission, not composition.

5fa830e + 32d7e0d + 77573c4 (red tests 24387b2, comment refresh 905f9ef) ; R275 (source-record-carrier-service-error-channel): error channel and data projection for source-record-carrier @service mutations, reopened-scope completion. The earlier as-built slice (2026-06-05) closed only the to-one, non-@splitQuery carrier ({ entity: Table, errors } projected off Outcome.Success.value(), bucket C errors: null on the success arm, the NonNullableErrorsField rejection); this completion covers the two data-field shapes the opptak-subgraph saksbehandling mutations actually use, both of which previously emitted an invalid assembled schema (a typeRef to a dropped payload type, graphql.AssertException: type X not found in schema). Slice 1 (5fa830e): @splitQuery-list carriers ({ saker: [Sak!] @splitQuery, errors }) are admitted via the tolerant BuildContext.scanStructuralServiceCarrierPayload (the data field’s PK-keyed follow-up SELECT makes @splitQuery redundant, fired as the established warnIfSplitQueryOnRecordParent advisory), classifying SingleRecordTableField MANY over the OUTCOME_SUCCESS envelope; and a recognized-but-unbound orphan carrier becomes a loud UnclassifiedField at the mutation-field edge. Slice 2 (32d7e0d, requirement 2): @nodeId-from-record support ({ taggId: ID @nodeId, errors } / { tagger: [ID] @nodeId, errors } over a service returning the deleted record(s)) encodes node ids straight off Outcome.Success.value()’s in-memory record(s) with no follow-up SELECT, deletion-safe by construction; structural scan grew a named `CarrierFamily axis (DML vs SERVICE) carrying the forbidden-directive set and the ID-wrapper policy (SERVICE admits the [ID] list-of-nullable the opptak schema declares), the lockstep resolveDeleteIdEncoder + classifyDeleteIdEncoderError pair collapsed into one sealed IdEncoderResolution resolver feeding both DELETE and SERVICE diagnostics, and a new sealed leaf ChildField.SingleRecordIdField (wired through every sealed-coverage site: validator, TypeFetcherGenerator.IMPLEMENTED_LEAVES, FieldClassification.SingleRecordId, LeafTupleAdapter, LSP hover/label). Slice 3 (77573c4, requirement 1): the shape-agnostic GraphitronSchemaBuilder.rejectDanglingTypeReferences builder pass demotes any classified field whose SDL Object return element never registered to UnclassifiedField (fails the build and removes the field from emission), closing the residual hole for errors-only and scan-Reject orphans that the per-shape guard left open; the seven historically-lax arg-mapping fixtures were fixed (not allowlisted) by backing FilmDetails with a real TestFilmDetailsDto. Coverage: pipeline SingleRecordTableFieldServiceProducerPipelineTest, schema-builder GraphitronSchemaBuilderTest RootFieldCase + UnclassifiedFieldCase rows, execution GraphQLQueryTest delete-shaped fixtures whose producers synthesize records with ids absent from the DB (9001/9002) so the encoded node ids prove the no-re-fetch contract structurally; no generated-body string assertions. In Review → Done gate (reviewer session ≠ implementer session 017DpiWem9o8HCVkgDf7ae5a): full mvn -f graphitron-rewrite/pom.xml install -Plocal-db green on JDK 25 across all modules.

b2c0895 ; R291 (strip-internal-directives-from-published-sdl): the published SDL (schema.graphqls, both federation and plain arms) no longer carries Graphitron-internal directive definitions/applications or their supporting types. Two-tier support-type model derived from directives.graphqls (DirectiveSupportTypes): the published tier (SortDirection, now with SDL descriptions) classifies iff a non-support coordinate references it; the strictly internal tier never classifies, and a consumer reference to one rejects the referencing type with a typed AuthorError. The retention decision is schema.types() membership, consumed by both the runtime registration and the SchemaSdlEmitter print seam. Status flip and R253 closure at 80623b0.

b2c0895 ; R253 (pipeline-runtime-sdl-parity-test): closed as subsumed by R291 (strip-internal-directives-from-published-sdl), which implemented R253’s Route 3 at the SchemaSdlEmitter print seam (survivor-filtered directive definitions/applications on both arms, generateServiceSDLV2-mirroring federation printer) and re-enabled FederationBuildSmokeTest.emittedSdlMatchesRuntimeSchema as the pinning parity assertion. One changelog line records both IDs; R291’s own entry lands when it reaches Done.

ecdc7c4 ; R186 (nested-input-types-in-mutation-fields): a plain (non-@table) input object grouping columns of the surrounding @table input is now admitted on @mutation fields, flattening onto that one table instead of being structurally rejected. The grouping is a wire-format ergonomics shape with no DML semantics; the three structural rejections it replaced (UpdateRowsWalker / DeleteRowsWalker UnsupportedInputFieldShape, MutationInputResolver’s R128-attributed `NestingField arm) are gone. Both walkers flatten a NestingField into its leaf carriers in place and the INSERT resolver recurses its leaves under the same per-field rules; each nested leaf’s wire concern rides on a CallSiteExtraction.NestedInputField access path so the flat-leaf partition (UpdateRows.setColumns/keyColumns, DeleteRows.whereColumns, TableInputArg.lookupKeyFields) stays flat and the emitters descend the wire map. The emit honors the same absent-vs-null contract at every nesting layer that top-level mutation inputs do (absent / null group skips its subtree; a present group descends per leaf), proved on real PostgreSQL across INSERT, single + bulk UPDATE, and DELETE. List-typed nestings and nested-group @condition are rejected naming R186; nested @nodeId FK-targets (R189) compose; nested @table inputs that introduce a second DML target remain R122’s territory. New DML_INSERT_NESTING_OK flips the former DML_NESTING_FIELD_DEFERRED. Single-segment access paths emit byte-identically to pre-R186.

57cb7b0 + f1ee7a6 ; R266 (deleterows-walker-carrier): DELETE mutations onto the DeleteRows walker carrier (sealed Identified | Broadcast), mirroring R246/R258’s UPDATE work for the DELETE verb. Row identification is catalog-derived PK-or-UK coverage via the shared MatchedKeys.firstCovered matcher both walkers call (the seam a future LookupRows carrier grows from); Identified’s matched key is a single-row guard, `multiRow: true opts into the Broadcast arm. New DeleteRowsField worn by the migrated MutationDeleteTableField (drops tableInputArg) plus the new MutationDeletePayloadField / MutationBulkDeletePayloadField; MutationDmlRecordField narrowed to {INSERT, UPSERT} and MutationBulkDmlRecordField to {INSERT} (compact-ctors reject DELETE). New DeleteRowsError sub-seal (NoUniqueKeyCoverage, UnsupportedInputFieldShape, OverrideConditionNotSupported) under graphitron.delete-rows.*. Carving DELETE off MutationInputResolver.resolveInput retired the @value directive entirely (absorbing R188): the declaration, DIR_VALUE, DmlKind.acceptsValueMarker / requiresPkCoverage, the valueMarkedNames partition machinery, and value.adoc are all deleted; mutation.adoc rewritten to the catalog-derived rule. Rework (f1ee7a6) closed the In Review feedback: aligned the BuildContext @lookupKey rejection message with the FieldBuilder twin, and shipped the execution-tier UK-covering single-row delete over a dedicated public-schema storage_bin fixture (deleteStorageBinByCode, WHERE on the UNIQUE code / RETURNING the bin_id PK, round-tripped against Postgres).

R8 (docs-as-index-into-tests, superseded by R279): closed as superseded wholesale rather than shipped independently. Steps 1-2 (re-sectioning groundwork, description normalisation) shipped earlier on claude/review-docs-plan-adYJW; step 5 was already retired by the variant-coverage meta-test (GeneratorCoverageTest.everyGraphitronFieldLeafHasAKnownDispatchStatus + VariantCoverageTest.everySealedLeafHasAClassificationCase). The remaining steps 3-4, positioning code-generation-triggers.adoc as a map into the GraphitronSchemaBuilderTest truth table, were deferred until the sealed hierarchy stabilised; that stabilisation is R279’s (field-first-classification-driver) own deliverable; the doc-as-index work (the code-generation-triggers.adoc absorption) landed in R279’s slice 0 and has since moved to R281 (classification-test-dsl), which now owns it and captures R8 by reference. Discarded per the workflow’s superseded-wholesale rule (the successor spec captures the predecessor); file deleted in this commit. Mirrors the R166 retirement precedent.

R259 (primary surface bundled in 048c9c7; sibling-namespace slice this commit): the @reference(key:) "did you mean" FK candidate hint is now scoped to the structurally relevant FKs and rendered in the namespace the author typed. The bug: the hint was built from catalog.allForeignKeySqlNames() ranked by global Levenshtein distance, so on a large schema the nearest five were dominated by unrelated FKs sharing a token, and an author who wrote keys in the jOOQ Java-constant TABLECONSTRAINT namespace got suggestions back in the bare SQL-constraint namespace. The primary surface, BuildContext.parsePathElement via the new fkCandidateNames(sourceSqlTable, attempt) helper (BuildContext.java:897), shipped both fixes: it scopes candidates to JooqCatalog.foreignKeysTouchingTable(…​) (new helper, JooqCatalog.java:270, with a global fallback when the source table has no touching FKs) and switches namespace on attempt.contains(""), rendering fkJavaConstantName vs SQL names. This close adds the cheap half of the sibling surface, BuildContext.unknownForeignKeyRejection (:1009, the @reference(key:) / @nodeId synthesis miss path): it now mirrors the same -namespace detection, drawing from allForeignKeyConstantNames() vs allForeignKeySqlNames(), so both surfaces read in the author’s namespace. The harder half, scoping that sibling (its call sites pass only the FK name, no source table; scoping needs a table threaded through :1115 / :1347 / :1376 / :1889), is filed as R282 (fk-key-hint-sibling-scope). Pinned by JooqCatalogMultiSchemaTest.unknownForeignKeyRejection_mirrorsAuthorFkNamespace_inCandidateHint: against the nodeid fixture’s real FK, a bare-form attempt yields SQL-namespace candidates (no ) and a -form attempt yields constant-namespace candidates (carry ), the latter failing under the pre-R259 always-SQL behaviour. Out of scope (per spec): LSP completion/hover arms and the FK-resolution logic itself. Full mvn -f graphitron-rewrite/pom.xml install -Plocal-db green on JDK 25. (Gate note: the primary surface was implemented by a prior session and reviewed independently here; the small sibling-namespace mirror was authored in this session, so that slice is self-reviewed, mechanically mirroring the already-reviewed fkCandidateNames pattern with the new test and the full build as the safety net.)

R254 (048c9c7, bundled): generated GraphitronSchema.java and every per-type *Type.java are now emitted as flat statement-per-element bodies (one schemaBuilder / b local plus one short statement per root type, additional type, scalar, directive, field, interface, possible-type, and applied directive) instead of a single fluent method-call chain whose depth scaled with schema size. The deep chain overflowed javac’s expression-attribution recursion during incremental compilation under `quarkus:dev on large schemas; flattening removes the unbounded depth. Non-trivial sub-values (synthesised scalars, directive definitions, applied directives, field/argument definitions) are factored into private static factory methods via HelperMethodSink, so emission sites are bare-name references. GraphitronSchemaClassGenerator.generate (:204-235) and ObjectTypeGenerator (object :135-148, interface :175-185, union :203-212, field-def sub-chain :240-269) carry the cutover; the AppliedDirectiveEmitter / directive-definition siblings were already statement-form. Pinned by @PipelineTier SchemaEmissionChainDepthPipelineTest: a maxChainDepth scanner asserts no emitted expression-statement exceeds depth 16 across a federation fixture and a deliberately oversized LARGE_SDL, with a scanner self-test (maxChainDepth_detectsLongChain builds a 21-segment chain and asserts it scores > 16, plus flat-statement = depth-1 cases) proving the bound would trip on a revert to the chained form; statementCountInGraphitronSchemaBuildBody_scalesWithSchemaSize pins growth. The bound is scanned at string level, not asserted as code-string equality on method bodies, with the carve-out documented per design principles. In Review → Done gate (reviewer session != implementer): full mvn -f graphitron-rewrite/pom.xml install -Plocal-db green on JDK 25. (Provenance: the implementation reached trunk bundled inside 048c9c7, whose message reads R244 Ready → In Progress; the granular R254 stage commits were squashed in a rebase and are not reachable from trunk.)

R255 (048c9c7, bundled): fix duplicate column projection in generated $fields() methods (the RC-6 regression). When a type’s composite @node(keyColumns:) overlapped a sibling @field ColumnField on the same column (forced by federation @key + @override entity dispatch always selecting id), both classifier arms appended the same jOOQ TableField, projecting the column twice and spamming jOOQ "Ambiguous match" INFO logs on every fetched row. TypeClassGenerator’s `$fields() accumulator is now a LinkedHashSet<Field<?>> (:215) that dedupes by jOOQ Field identity while preserving projection order, returned as a List via an ArrayList wrap (:236) so the emitted surface is unchanged; the former if (!fields.contains(…​)) guard collapses to a plain add under Set semantics (:227-234). Aliased .as(name) projections stay distinct (jOOQ caches one TableField per aliased Table), so only true duplicates fold. Pinned non-vacuously at the execution tier by FederationEntitiesDispatchTest (:435-464): a federated _entities query selecting both id and customerId (both → customer_id) captures the emitted SQL and asserts customer_id appears in the projection exactly once, which fails under the old ArrayList accumulator; @PipelineTier DedupeReferenceProjectionPipelineTest pins the classifier precondition (composite CompositeColumnField + sibling ColumnField over the same column). In Review → Done gate (reviewer session != implementer): full mvn -f graphitron-rewrite/pom.xml install -Plocal-db green on JDK 25. (Provenance: granular R255 stage commits were squashed in a rebase; the code reached trunk bundled inside 048c9c7.)

R260 (143b0c13): make generated NodeId-decode code readable and debuggable. Every NodeId-decoded condition argument (all key arities, skip and throw, scalar and list) now lifts into a private static decode<Type>Key/Keys/Row/Rows helper on the <Root>Conditions class via CompositeDecodeHelperRegistry, so the call site collapses to helper(wireExpr) (ArgCallEmitter.buildNodeIdDecodeExtraction, :360-389) and the helper body is statement form with meaningful locals (nodeId, key) instead of the former inline nested ternary with underscore pattern-locals and a Supplier-lambda-throw trick (CompositeDecodeHelperRegistry.buildHelper, :86-138). The sibling map/list traversal walkers were converted to map1 / list2 / elem3 bindings, and a registry-less decode now throws IllegalStateException rather than falling back to the old inline form (:378). Pinned by CompositeDecodeHelperRegistryTest (naming matrix, return types, projection and skip/throw bodies, including arity-1 coverage) and end-to-end by execution-tier GraphQLQueryTest.films_filteredByArgNodeId_dropsWrongTypeIdViaSkipHelper, which confirms a wrong-type id decodes to null and is dropped by the lifted helper’s filter(nonNull). The registry unit tests assert on helper-body substrings, defensible for an inherently emitted-shape item since behaviour is pinned separately at the execution tier and the assertions lean on structural API (helper.name() / returnType() / registry.emit() size). Out of scope (correctly excluded): the lookup-key and R195 input-bean decode-local paths. In Review → Done gate (reviewer session != implementer session 0182HAPCJwMRxopaPWwquKyk): full mvn -f graphitron-rewrite/pom.xml install -Plocal-db green on JDK 25.

R64 (retired as obsolete + residual dead-code deletion): the planned lift, making SplitRowsMethodEmitter.buildRuntimeStub accept a typed Rejection.Deferred / EmitBlockReason instead of a free-form String reason, is moot. The premise was that SplitRowsMethodEmitter.unsupportedReason returned Optional<Rejection.Deferred> and four buildFor* callers fed .message() into buildRuntimeStub; the rows-method rework that followed (the buildSingle/buildList/buildConnection cutover) deleted unsupportedReason and the four .message() call sites entirely, leaving buildRuntimeStub as a private, uncalled method (verified: zero call sites repo-wide, no unsupportedReason / Rejection.Deferred / EmitBlockReason reference anywhere in the file). There is nothing left to type-lift. This entry deletes that dead method (and its now-empty // Stubs section header), the actionable residue the obsolete plan left behind. Full mvn -f graphitron-rewrite/pom.xml install -Plocal-db green on JDK 25 across all tiers after the deletion. (Closure framing: retirement of an obsolete Backlog item plus a verified dead-code removal, not an In Review → Done approval of planned work; mirrors the R166 retirement precedent.)

R227 (048c9c7, bundled; retroactive close): mdBodyToAdoc translates markdown tables embedded in .md roadmap plans into AsciiDoc |=== blocks when staging plan bodies into the documentation site, closing the render-side hole R223 explicitly deferred (R223 only flagged the pattern in authored .adoc). The converter detects a markdown-table block (a MD_TABLE_ROW header line immediately followed by a MD_TABLE_SEP separator, then body rows until the first non-table line) and emits [cols="N*", options="header"] + |===, one cell per line. parseMdTableCells strips the conventional leading/trailing pipes, splits on unescaped pipes, unescapes \|, and leaves pipes inside backtick code spans intact (so Map<K|V> survives); each cell runs through the same bold / link / em-dash-sweep transforms as body prose, with literal pipes re-escaped for AsciiDoc. Coverage: MdTableToAdocTest (7 cases) pins the simple conversion + cols="2*" synthesis, in-cell bold/xref transforms, em-dash sweep, the backtick-pipe-protection corner, the code-fence non-conversion skip, and the parseMdTableCells strip/unescape edge cases. Scope cut from the spec: the [cols=…​] attribute is synthesized from the column count only (equal-width N*); GFM alignment markers (:---:) are parsed by the separator regex but not carried into per-column alignment, since no roadmap .md table uses them and equal-width is the safe container-filling default. Provenance note: the implementation and MdTableToAdocTest were committed bundled inside 048c9c7 (whose message reads R244 Ready → In Progress) and the item never transitioned out of Backlog; this entry records the retroactive In Review → Done close. Gate (reviewer session != implementer session 01YQEc4FG3cqf18pHwgVAnsX): implementation and test verified present in-tree and green on trunk.

R166 (Backlog, never specced; retired without a landing commit): graphqlschemavisitor-driven-emission superseded by R279 (field-first-classification-driver). R166 proposed a GraphQLSchemaVisitor-driven emission walk to fix per-emitter skip-filter drift (the R165 bug class) and the missing reachability sweep; R279 delivers both at classification time (the prune is structural, emission stays plain iteration over the pruned GraphitronSchema), so the visitor-driven emitter and R166’s standalone ReachabilityPruner alternative are both unneeded. R166’s emission-side open questions (cross-cutting aggregators, utility-class emitters, visitor ordering/determinism, visitor test ergonomics) evaporate with emission staying iteration-based. The one orthogonal sub-thread, the typed non-empty carrier for FetcherRegistrationsEmitter.emit’s `Map<String, CodeBlock> return (R166 Q7, originally R165), spun out to R280 (fetcher-bodies-nonempty-carrier).

R276 (468b86e + 8498e61 + 4ad9030 + 19681e5 + 9f53f36 + spec correction c69bce5): Record binding is reflection-only and sound. The four classifier/binding sites that still read @record to drive backing-class or kind are gone: RecordBindingResolver.groundServiceField’s `sdlHasRecord gate, TypeBuilder.classifyType’s `|| hasAppliedDirective(DIR_RECORD) arm, and the directive-className fallbacks in buildResultType / buildInputType. The service producer’s reflected return element now grounds the result observation through a shared groundProducerResult helper under a cardinality-match guard (single→single, list→list) plus the @table-backed-SDL and shouldBind guards, so a source-record-carrier payload (no @record) binds to its producer’s JooqTableRecordType rather than degrading to an unbound plain object; the R75 list-carrier path is preserved. @record stays a parseable, registered directive with the ignored-directive warning (emitDirectiveIgnoredWarnings / readRecordClassName), so existing schemas keep loading. D1: @record dropped from detectTypeDirectiveConflict (only @table vs @error remain mutually exclusive; @table/@error + @record warn instead of reject). The reopened completion scope made binding complete and sound: groundComputedField grounds @externalField / ChildField.ComputedField through the same shared helper, and propagateAccessorChains folds-then-cascades parent-accessor bindings (the root fix for the FilmCardWrapper.film / RecordExample.fieldC execution regressions). GraphitronType.PlainObjectType is eliminated as a terminal classification (Javadoc mention only): a genuinely unbound reachable object is routed to UnclassifiedType / left absent and surfaces at the field edge as UnclassifiedField (build-time failure, no silent runtime null), with the double-classification guard hardened. GraphitronType.PojoResultType.NoBacking and TypeClassification.UnbackedPojoResult are deleted (PojoResultType collapses to Backed), with every consumer updated. The spec-correction commit reverses a conflation: the LSP backing-shape projection TypeBackingShape.NoBacking.UnbackedResult is kept (it is load-bearing for eleven still-live GraphitronType variants in CatalogBuilder.projectType plus three LSP tests); only its stale Javadoc was refreshed. R157’s two LSP backing-shape fixtures migrated from @record(className:) to @service producers. Carve-outs: R277 (@tableMethod under a table-bound NestingField) filed to Backlog with its execution test @Disabled; R275 consumes R276’s carrier binding; the PlainObjectType / NoBacking deletions are the subtractive slice R222’s hierarchy cleanup builds on (boundary confirmed non-colliding, R222 still in Spec). Coverage: pipeline R96RecordBindingPipelineTest.unreachable_recordTypeIsIgnored_leftUnclassified + serviceListCarrier_bindsWrapperToJooqTableRecord, SingleRecordPayloadPipelineTest orphan-carrier case, R157PipelineTest LSP migration, the migrated GraphitronSchemaBuilderTest producer cases; no generated-body string assertions. In Review → Done gate (reviewer session ≠ implementer; widened scope re-confirmed at this gate per the spec’s own allowance): full mvn -f graphitron-rewrite/pom.xml install -Plocal-db green on JDK 25 across all eleven modules.

R214 (048c9c7, bundled; retroactive close): infer argMapping when a @condition / @service / @tableMethod Java signature is unambiguous, so authors no longer have to rename a Java parameter or write a redundant argMapping: "javaName: gqlName" for a structurally-unique pairing. ServiceCatalog.inferBindingsByType augments the name-based argByJavaName map after the override-typo check in two layered branches: arity-unique (exactly one unbound Java parameter and one unclaimed GraphQL slot, bound positionally only when the slot has no canonical Java mapping (named input object / enum) and the parameter is not a canonical scalar, so the unambiguousReachablePath dot-path suggestion still wins the scalar-into-wrapper case) and type-unique (each Java type appearing exactly once among unbound parameters and once among unclaimed slots is paired; asymmetric counts stay unbound and the existing diagnostic fires). Table<?>, DSLContext, context-key-named, and SOURCES-shape parameters (couldBeSourcesShape: List<RowN> / List<RecordN> / List<TableRecord> and Set<> equivalents) are held out of the candidate set so the per-parameter SOURCES classifier still wins at child coordinates. Threaded through every reflection caller that has slot types in scope (ConditionResolver, TableMethodDirectiveResolver, ServiceDirectiveResolver, and input-field @condition in BuildContext); the path-step @condition in resolveConditionRef has no slot types and is unaffected. Coverage: TestConditionStub.argConditionTypeUnique / argConditionTwoStrings fixtures plus ServiceCatalogTest.reflectTableMethod_typeUniqueSignature_infersBindingWithoutArgMapping (pins the inferred ParamSource.Arg binding, whatever → arg opptaksNavn) and reflectTableMethod_typeAmbiguousSignature_fallsBackToNameMatchingDiagnostic (pins the floor). Open follow-ups remain live items: inferred-binding provenance for the resolved-coordinate report / LSP (R218) and unifying the two branches under a JavaTypeKey-counted rule (R219). Provenance note: the implementation, fixtures, and resolver pass-throughs were committed bundled inside 048c9c7 (whose message reads R244 Ready → In Progress) and the item never transitioned out of Backlog; this entry records the retroactive In Review → Done close. Gate (reviewer session != implementer session 01YQEc4FG3cqf18pHwgVAnsX): implementation verified present in-tree, and green on trunk through every Done item that landed on top (R244, R246, R195, R271).

R271 (07d6c23 + self-review abee3f1 + e6ec2d5): Retire the -prefixed (dunder) Java locals/params/lambda-vars emitted across the generator (FetcherEmitter r/src/fetched/byPk/ordered/match/key/out/ids; TypeFetcherGenerator validator/violations/v plus the arg_/insertKey/bulkKey/lookupKey/setKey/bulkSetKey base prefixes; GeneratorUtils elt/k; InputRecordGenerator c_/e; ChannelEarlyReturnEmitter violations) in favour of readable names (row, byPk, fetched, violations, element, key), with author-derived locals keeping a readable deterministic prefix (arg_<name>, c_<name>) rather than the dunder. The framing correction at the heart of the spec: the prefix was a lazy default, not a collision guard ; the generator emits every name in scope (signatures included), so a collision is knowable at generation time. The In-Progress audit confirmed no emitter places an author-derived parameter beside a generated local (all dunder locals live in DataFetcher lambdas, batch-loader/helper methods, or fromMap factories with generator-fixed signatures), so no disambiguation machinery was built. Genuine collision-avoidance names stay: synthetic SQL column aliases (sort/idx/rn/typename/pkN) share the result-set column namespace with consumer-controlled table columns and remain -wrapped, now promoted to named constants where they were bare repeated literals (RN_COLUMN/IDX_COLUMN on MultiTablePolymorphicEmitter and SplitRowsMethodEmitter) and documented with the DB-column-collision rationale at each constant; GraphitronSchemaClassGenerator’s synthetic-column `typename routes through a named TYPENAME_COLUMN while the federation entities representation-map typename stays a literal (the GraphQL introspection meta-field, a distinct concept). The stale ChannelCatchArmEmitter javadoc naming t/m (the code emits mapping/cause) is fixed. The standing rule lands in rewrite-design-principles.adoc. No-regression guard ships in two tiers, keying on the Java-identifier-vs-string-literal discriminator (both mask comments + string/char literals before scanning): @PipelineTier DunderFreeEmissionPipelineTest (in-process TypeSpec scan, non-vacuous by an isNotEmpty assertion) and @CompilationTier GeneratedSourcesLintTest.emittedSourcesHaveNoDunderIdentifiers (full Sakila generated-sources walk with a ≥20-file floor against a vacuous pass). External tokens we do not emit (NODE*, federation*, link*) are out of scope. In Review → Done gate (reviewer session ≠ implementer): full mvn -f graphitron-rewrite/pom.xml install -Plocal-db green on JDK 25; both meta-tests run (not skipped) and pass.

R195 (7f7cac0 v1 + rescope 876a621 + composite/list ef8fe80 + c3e10a3 + type-mismatch gate 18f79a2 + rework 36712f7 → 98b5a93): decode @nodeId(typeName:) into jOOQ-Record-typed @service input-bean *member fields instead of miscompiling to a wire-String → Record cast (the R150/R195 ClassCastException family). InputBeanResolver.buildInputBeanBody now branches before else → new Direct() when a member’s element Java type is assignable to org.jooq.Record: with a resolvable @nodeId(typeName:) it classifies to a new CallSiteExtraction.NodeIdDecodeRecord leaf carrying (encoderClass, typeId, keyColumns, TableRef table, nonNull); otherwise it is a typed Result.Failed, so a jOOQ-record member never falls through to Direct again. InputBeanInstantiationEmitter (the one reusable emitter) emits per-type concrete helpers (decode<Type>Record(Object) → <Type>Record, deduped by record type, plus a decode<Type>RecordList stream variant for list members) whose body calls the now-public NodeIdEncoder.decodeValues(typeId, nodeId) then loads values positionally with decoded.fromArray(values, Tables.<T>.<col>…) ; one call regardless of key arity, coercing through the column converter, with no throwaway RecordN, no fromMap(intoMap()) round-trip, and no deprecated-for-removal DataType.convert(Object) (so no @SuppressWarnings leaks into the consumer’s *Fetchers; the encoder’s own decode<Type> convert is tracked separately as R267). All shapes ship: single-key, composite-key, scalar, list, and the list-of-composite corner. Loud rejections are malformed-directive-only (no @nodeId, missing typeName:, unknown NodeType) plus a member-type-vs-@nodeId-@table mismatch gate (18f79a2) that fails generation rather than emitting Tables.<NodeTable>.<col> references for the wrong record. ServiceMethodCallWalker carries the leaf through the R238 ValueShape re-projection unchanged; ArgCallEmitter gets an explicit unreachable arm. Coverage: pipeline NodeIdRecordInputBeanPipelineTest (9 tests, structural only ; helper presence by name, signatures, and a decodeRecordLeaf walk down the classified model asserting NodeIdDecodeRecord typeId/key-column arity/record class/nonNull, plus malformed-directive and type-mismatch Rejection.message() cases; no code().toString() body matches, per rewrite-design-principles.adoc line 131); compilation tier graphitron-sakila-example (single/composite/list/list-of-composite fixtures compile their fromArray field references against the real jOOQ catalog); execution tier GraphQLQueryTest (round-trips each shape against PostgreSQL, plus assignFilmRecord_wrongTypeNodeId_throwsDecodeMismatch pinning the throw-on-mismatch contract behaviourally). Original R195 framing (top-level @service parameter that *is a jOOQ record, @field(name:)/@table-on-input translation) deferred (tangled with R97). In Review → Done gate (reviewer session ≠ implementer/prior-reviewer): full mvn -f graphitron-rewrite/pom.xml install -Plocal-db green on JDK 25.

R246 (8a04c0b + 975f593 + c63c14c + rework f3a39ea): UpdateRows walker carrier (R222 UPDATE slice) with PK-or-UK identification. @mutation(typeName: UPDATE) returning its @table type directly (or ID) now classifies through FieldBuilder.classifyUpdateTableField → UpdateRowsWalker instead of MutationInputResolver. MutationUpdateTableField drops its tableInputArg component (and tableInputArg() comes off the DmlTableField sealed parent; INSERT/DELETE/UPSERT keep their own) and gains two non-Optional slots via the new UpdateRowsField interface: a slim InputArgRef (SDL arg name, input type name, jOOQ TableRef, list flag) built directly by FieldBuilder, and an UpdateRows carrier (sealed, one Identified arm whose compact constructor enforces non-empty setColumns) holding the MatchedKey (PrimaryKey/UniqueKey) plus the SetColumn/KeyColumn partition. The load-bearing claim is PK-or-UK identification: the walker reads jOOQ Table.getPrimaryKey()/getKeys() via JooqCatalog.candidateKeys (PK-first, deduped), matches the first key whose column set is a subset of the input-covered columns, and partitions input fields into WHERE (matched-key) and SET (everything else) halves. multiRow: true on UPDATE is rejected outright at the FieldBuilder pre-check (Rejection.deferred, empty slug, no follow-up planned) ; broadcast UPDATE has no replacement path; covering a PK/UK is the single-row UPDATE shape. The emitter cutover is carrier-driven in place (not a separate UpdateRowsEmitter class): buildMutationUpdateFetcher/buildBulkUpdateFetcher project setColumns()/keyColumns() back into the SetGroup/InputColumnBindingGroup shapes via setGroupsOf/keyGroupsOf, emitting byte-identical SQL. Error taxonomy ships as a sibling sub-seal UpdateRowsError implements Rejection.AuthorError (five arms: NoUniqueKeyCoverage, NoSetFields, MixedCarrierKeyMembership, UnsupportedInputFieldShape, OverrideConditionNotSupported), each with lspCode() under graphitron.update-rows.*, wired into the LSP projector + typed-rejection.adoc + RejectionSeverityCoverageTest. R215’s classify-time admission of @condition(override: true) on UPDATE input fields inverts to a typed walker rejection (the filter was never emitted). Absorbs R146 (PK-or-UK coverage, discarded) and R188’s UPDATE-side partition scope; built as a translator over the already-classified InputField permits rather than raw-SDL re-derivation (the R238-style substrate concession, follow-up filed as R257). Coverage: unit UpdateRowsWalkerTest (11 cases); pipeline GraphitronSchemaBuilderTest (typed-arm migrations + R246_UPDATE_MULTIROW_TRUE_DEFERRED + R246_UPDATE_ARG_CONDITION_STRUCTURAL_REJECTED + R215 inversion); execution via the existing updateFilm round-trip (UK-driven execution case deferred, justified in as-built notes). In Review → Done gate (reviewer session ≠ implementer/prior-reviewer): full mvn -f graphitron-rewrite/pom.xml install -Plocal-db green on JDK 25 (graphitron, graphitron-lsp incl. RejectionSeverityCoverageTest, and the execution tier all pass).

R250 (73e7670 + 39072a3): GraphitronSchemaClassGenerator.generate now emits .withSchemaAppliedDirectives(java.util.List.of(…​)) on the runtime schemaBuilder, immediately after the additionalDirective(survivors) loop and before .codeRegistry(…​), so the consumer’s extend schema @link(url:…​, import:[…​]) propagates into the generated runtime build. Pre-R250 the schema-applied list was lost: GraphQLSchema.newSchema() starts empty and .additionalDirective(…​) only emits directive definitions, not applications; the symptom in one consumer’s deployment was supergraph composition (@apollo/federation-internals completeSubgraphSchema) failing to detect Fed2 because the schema @link(…​) block was missing from the runtime SDL, falling through to completeFed1SubgraphSchema and rejecting the canonically Fed2-shaped @key declarations with "argument fields should have type _FieldSet! but found federationFieldSet!`". `AppliedDirectiveEmitter.applicationsForSchema(GraphQLSchema) is the new entry point; the schema-applied list is not a GraphQLDirectiveContainer in graphql-java so the helper takes the raw GraphQLSchema rather than reusing applicationsFor. Shape contract diverges from the per-container sibling on purpose and is documented inline: applicationsFor returns blocks pre-wrapped in .withAppliedDirective(…​) because the per-type builders take one application at a time; applicationsForSchema returns bare GraphQLAppliedDirective.newDirective()…​build() blocks because GraphQLSchema.Builder#withSchemaAppliedDirectives takes a single List<GraphQLAppliedDirective>. Survivor filter mirrors the per-container path; generator-only directives are skipped. Argument-value rendering routes through the same ValuesResolver.valueToLiteral + AstPrinter.printAst + Parser.parseValue chain the per-type emitter already uses, so @link’s `import: ["@key", …​] round-trips through an AST list literal without per-shape coding. The linkImport scalar and linkPurpose enum referenced by @link’s argument types are already registered on the runtime schema by R248’s `ScalarTypeResolver Synthesised arm and standard enum registration, so emitInputType’s `GraphQLTypeReference.typeRef("linkImport") resolves at schema-build time. Coverage: unit-tier AppliedDirectiveEmitterTest.applicationsForSchema_emitsBlocksForSchemaLevelSurvivorDirectives and applicationsForSchema_skipsGeneratorOnlyDirectives pin the helper output for a schema-applied @link(url:…​, import:["@key"]); unit-tier GraphitronSchemaClassGeneratorTest.build_emitsWithSchemaAppliedDirectives_forSchemaLevelLink pins the emitted call site and its position relative to .codeRegistry(…​), with build_skipsWithSchemaAppliedDirectives_whenNoSchemaLevelSurvivors as the negative arm; pipeline-tier FederationBuildSmokeTest.serviceSdlExposesSchemaAppliedFederationLink builds the full sakila federated schema, queries _service { sdl }, and asserts the printed schema { …​ } block carries @link(url:"https://specs.apollo.dev/federation/v2.10", import:["@key"]), locking the round-trip consumer SDL → applicationsForSchema → withSchemaAppliedDirectives → Federation.transform → _service.sdl against silent removal. The R247 file-emission side gains a sibling assertion in SchemaSdlEmissionTest that the federated file artefact carries schema @link(, closing the loop on the file the supergraph composer actually reads. Out of scope, follow-up filed: multi-federation-@link consumer schemas (FederationLinkApplier already rejects more than one federation @link with a developer-readable error); re-evaluating whether Federation.transform(base).setFederation2(true) is the right runtime wrap (separate concern, entity-resolver wiring is independent); multi-file federation fixture coverage for R247’s file emission (R252, filed). Build green: full mvn -f graphitron-rewrite/pom.xml install -Plocal-db on Java 25.

R247 (73e7670 + 39072a3): New SchemaSdlEmitter runs at the tail of GraphQLRewriteGenerator.runPipeline and renders the assembled GraphQLSchema to target/generated-resources/graphitron/<outputPackage as path>/schema.graphqls; GenerateMojo registers that directory via project.addResource(…​) so maven-resources-plugin copies it into target/classes, shipping the file at <outputPackage as path>/schema.graphqls in the consumer’s JAR. The federation arm runs Federation.transform(assembled).setFederation2(true).build() before ServiceSDLPrinter.generateServiceSDLV2, mirroring the consumer’s runtime build so _Service / _entities / _Entity are present on both sides; the non-federation arm uses graphql-java’s SchemaPrinter with includeDirectives(true) / includeScalarTypes(true) / includeIntrospectionTypes(false) / includeSchemaDefinition(true). RewriteContext gains an outputResourcesDirectory record component; AbstractRewriteMojo.resolveOutputResourcesDirectory(basedir) derives it from project.getBuild().getDirectory() with a basedir/target fallback for hand-built MavenProject test fixtures (no @Parameter, no per-consumer toggle); after the self-review followup runGenerator returns the RewriteContext so GenerateMojo.execute reads outputDirectory and outputResourcesDirectory from one derivation site. Tests: unit-tier SchemaSdlEmitterTest (federation + non-federation + empty-package arms); pipeline-tier SchemaSdlEmissionTest (federated SDL carries the canonical @key, the synthesised federation__FieldSet scalar, the @link directive declaration, and the schema-applied @link(…​) block; non-federation SDL parses through SchemaParser and is missing the federation surface; classpath resource lookup non-null under both outputPackage`s); `GenerateMojoTest.buildContext_derivesResourcesDirectoryFromBuildTarget locks the Maven-convention path against the hardcoded relative segment. Implementation folded the R250 work in per the user’s "ship together" directive (covered separately on R250’s gate). Out of scope, follow-up filed: the pipeline ↔ runtime SDL parity test (FederationBuildSmokeTest.emittedSdlMatchesRuntimeSchema, SchemaDiffing-based) landed @Disabled; closing the remaining non-survivor directive-definition / -application diff is tracked as R253 (Backlog), with Route 1 / 2 / 3 routes laid out. Build green: full mvn -f graphitron-rewrite/pom.xml install -Plocal-db on Java 25.

R251 (1c1b425): AppliedDirectiveEmitter.buildApplication now skips arguments whose getArgumentValue().isNotSet() is true rather than feeding the NOT_SET slot into ValuesResolver.valueToLiteral (which assertShouldNeverHappen`s on it). The reconstructed `GraphQLAppliedDirective carries only explicitly-supplied arguments; consumer-side schema build resolves the rest from the directive definition’s declared defaults, matching graphql-java’s own applied-directive round-trip. Coverage: unit-tier AppliedDirectiveEmitterTest.omittedArguments_areSkipped_notRenderedAsNotSetLiteral builds @audit(reason: "pii") on a directive declaring both reason and ticket and asserts ticket does not appear in the emitted .argument(…​) chain. R248 fixed the adjacent directive-definition-side bug; R251 closes the application-side symmetry.

R248 (a2b1705): DirectiveDefinitionEmitter now round-trips argument default values (.defaultValueProgrammatic(…​) emitted via the same GraphQLValueEmitter.emit path ObjectTypeGenerator.buildArgument already uses for field arguments), so directive @key(resolvable: Boolean = true) survives the JavaPoet reconstruction with its default intact. The federation-namespace scalar fix is a sub-taxonomy lift on ScalarResolution: a new sealed Successful interface (javaType() accessor) sits between the root and Resolved, with a sibling Synthesised arm carrying (javaType, sdlName, coercingSourceOwner, coercingSourceField) for scalars that have no public static final GraphQLScalarType constant on the consumer classpath. ScalarTypeResolver.resolveFederationNamespaceScalar returns Synthesised(String.class, "federationFieldSet", _Any, "type") instead of the old Resolved(String, Scalars, "GraphQLString") placeholder; GraphitronType.ScalarType.resolution widens from Resolved to Successful; TypeBuilder’s federation-namespace branch and Java-type registry lookup narrow to `Successful; TypeBuilder.asRejection switches on Successful (every successful arm throws ; only rejections reach the dispatcher). AppliedDirectiveEmitter.emitInputType emits GraphQLTypeReference.typeRef(name) for federation-namespace scalars instead of Scalars.GraphQLString, so directive-definition and applied-directive argument slots both reference the synthesised scalar by name. GraphitronSchemaClassGenerator.build()’s scalar-registration loop dispatches on the variant: `Resolved emits the existing .additionalType(Owner.FIELD), Synthesised emits an inline .additionalType(GraphQLScalarType.newScalar().name(<sdl>).coercing(<owner>.<field>.getCoercing()).build()); _Any.type.getCoercing() is the same lever federation-jvm uses in ensureFederationV2DirectiveDefinitionsExist when synthesising missing federation scalars at the registry+wiring entry point. The misleading "federation-jvm transform() replaces the placeholder after the base schema is built" comments at ScalarTypeResolver.java:83-95 / :310-314, TypeBuilder.java:601-605 / :647-651, and AppliedDirectiveEmitter.java:122-134 retire ; Federation.transform(GraphQLSchema) only adds _Any / _Entity / _Service and wires entity resolution, never rewrites @key or injects scalars; the divergence reached the printed Service SDL untouched. Coverage: pipeline-tier FederationBuildSmokeTest.serviceSdlExposesCanonicalKeyDirectiveShape asserts the printed SDL carries directive @key(fields: federationFieldSet!, resolvable: Boolean = true) repeatable on OBJECT | INTERFACE and scalar federationFieldSet (the end-to-end behavior subgraph-composition tooling validates against); DirectiveDefinitionEmitterTest extends the existing argument-emit test with a .defaultValueProgrammatic( + "strict" assertion and adds a Boolean-default arm (@flag(enabled: Boolean = true)) to cover the GraphQLValueEmitter.emit dispatch on a different value shape; ScalarTypeResolverTest flips the federation-namespace resolver test to expect Synthesised(_Any, "type") and adds a second arm on linkImport to confirm the dispatch isn’t FieldSet-specific; GraphitronSchemaBuilderTest narrows existing ScalarType.resolution() reads to the Resolved arm they’re testing. Out of scope (called out): argument-level @deprecated on directive definitions (no survivor directive Graphitron emits today carries one); re-emitting @link itself (the federation library injects @link into the registry via LinkDirectiveProcessor, the survivor walker picks it up like any other directive); switching graphitron’s federation entry point from Federation.transform(GraphQLSchema) to the registry+wiring overload (would forfeit the prebuilt-programmatic-schema fast-boot model the rewrite chose in R10’s predecessor landing); federation v1 surface (FederationDirectives.key / _FieldSet.type / ensureFederationDirectiveDefinitionsExist) since FederationSpec.URL pins v2. Build green: full mvn -f graphitron-rewrite/pom.xml install -Plocal-db on Java 25.

R237 (96869ab + e24feac + ee9720f + 246b349 + aa83a16 + 8845717 + 18a37a2): Retire the @LoadBearingClassifierCheck / @DependsOnClassifierCheck annotation pair and the LoadBearingGuaranteeAuditTest audit infrastructure. 183 annotation blocks stripped across 50 Java files; the four annotation classes (LoadBearingClassifierCheck, LoadBearingClassifierChecks, DependsOnClassifierCheck, DependsOnClassifierChecks) and the audit test + auditfixture/ package deleted. Phase 2’s four-bucket classification of the ~59 active producer/consumer keys found |c-signal|=0: every cross-module producer-consumer pair was already mechanically pinned by graphitron-lsp tests (FieldCompletionsTest, HoversTest, DiagnosticsTest, DeclarationHoversTest, ValidatorDiagnosticsTest) or by structural type narrowing on the producer side, leaving no signal-bearing contract that needed a test-side replacement. Phase 3 picked Delete on that strength; two follow-up Backlog items track the structural type-system lifts that retire the residual producer-consumer linkages mechanically rather than via documentation: R239 (column-field-requires-table-backed-parent, b-cheap, single-record parentTable lift to ColumnField record component) and R240 (service-catalog-strict-tablemethod-return + tablemethod-resolver-return-is-table-bound, b-relational, type-token threading on MethodRef.StaticOnly × ReturnTypeRef.TableBoundReturnType). Knock-on: PkResolutionEmitterReachabilityTest.classifyDeleteTableProjectionWearsLoadBearingClassifierCheckPin retired with its annotation dependency (the sibling sealed-arm symmetry test still pins the rejection contract structurally); residual javadoc references rephrased across the rewrite tree in two waves: the initial Phase 5 sweep (aa83a16 + 8845717) covered 11 main-source files, 4 test files, and 18 roadmap-item plan bodies; a self-review follow-up sweep (18a37a2) caught a further 15 main-source, 6 test, 1 schema, and 1 docs site still carrying the retired load-bearing classifier check {key} framing ; each rephrased to anchor on the actual structural pin (sealed-variant arm, compact-constructor invariant, non-null record component, named resolver class) rather than the retired key. rewrite-design-principles.adoc Phase 1 rewrite shipped at 96869ab anchored the principle on the three surviving layers (type-system narrowing at producer, pipeline-tier tests, cross-module compile against graphitron-sakila-example); the principles-architect agent and srp / reviewer-prompt skill rubrics swapped the "Load-bearing classifier checks" rubric for "Missing type-system lift". Build green: full mvn -f graphitron-rewrite/pom.xml install -Plocal-db on Java 25.

R233 (01c0172 + d02859f): LSP @field(name:) completion + hover arms now resolve the column against the @reference path’s terminal table instead of the enclosing type’s @table, closing the bug R224 fixed for diagnostics but not for the two sibling LSP surfaces. FieldClassification gains a sealed nested LspColumnDispatch (permits Resolve(tableName) / Silent / FallThrough) and an exhaustive lspColumnDispatch() default method that switches over all 30 sealed permits with no default arm ; a new permit fails the switch to compile, forcing one deliberate placement before any consumer-side switch. The four column-bearing permits (Column / ColumnReference / CompositeColumn / CompositeColumnReference) produce Resolve(tableName) carrying R224’s already-projected terminal table; InputUnbound / Unclassified produce Silent; every other permit produces FallThrough. The three consumer sites (Diagnostics.validateFieldMember, FieldCompletions.completionsFor, Hovers.columnHover) collapse to a uniform 3-arm switch on the projection: Resolve and Silent return directly, FallThrough drops through to the existing backing-driven dispatch. FieldCompletions switches from TypeContext.enclosingFieldDefinition to enclosingFieldOrInputValueDefinition (R224’s helper) so input-side input_value_definition nodes resolve too; Hovers.columnHover adopts the same helper. A small mergeWithSigil helper in FieldCompletions shares the $source-sigil merge between the new dispatched arm and the existing backing arm. Annotation hygiene: field-classification-payload-faithful now has five consumer sites (InlayHints.compute, DeclarationHovers.compute, Diagnostics.validateFieldMember, FieldCompletions.completionsFor, Hovers.columnHover); the producer description at CatalogBuilder enumerates the five consumers and names lspColumnDispatch() as the routing primitive. Tests: pipeline-tier LspColumnDispatchProjectionTest drives the full classifier on a synthetic schema and pins the three arms (Resolve / Silent / FallThrough) plus a cross-permit invariant that ColumnReference.tableName() == Resolve.tableName(); FieldCompletionsTest gains three R233 regressions parallel to R224’s DiagnosticsTest cases (inputTableWithReferencePathCompletesTerminalTableColumns, outputTableWithReferencePathCompletesTerminalTableColumns, unresolvedReferencePathCompletionSilentOnLspSide); HoversTest gains three symmetric regressions (inputTableWithReferencePathHoversOnTerminalTableColumn, outputTableWithReferencePathHoversOnTerminalTableColumn, unresolvedReferencePathHoverSilentOnLspSide); R224’s three DiagnosticsTest regressions stay green untouched. Self-review cleanup (d02859f) inverted the spec’s double-Optional-of-Optional dispatch shape at the two new consumer sites to direct returns (Resolve and Silent each return directly, FallThrough drops through), preserving the exhaustiveness guarantee while removing the nested generic. Out of scope (called out, filed as R236): the runtime-side BuildContext.classifyInputFieldInternal candidate hint at BuildContext.java:1673 draws its "Did you mean" suggestions from the path-origin table rather than the terminal table ; different surface (compile-time validator message vs. interactive LSP) and audience, owned by a sibling Backlog item. Build green: full mvn -f graphitron-rewrite/pom.xml install -Plocal-db on Java 25.

R232 + R129 absorption (3079b99 + 001eee4 + 41e20a3 + 4bb9d4f + 70152d3 + 8effcbf): @reference(path: [{condition: {…}}]) paths now classify and emit a real correlated subquery / split-rows SELECT, replacing the build-time deferred-rejection that previously short-circuited the six condition-join-affected ChildField variants (TableField, LookupTableField, SplitTableField, SplitLookupTableField, RecordTableField, RecordLookupTableField) plus the seventh sibling ColumnReferenceField. JoinStep.ConditionJoin’s record header gains a `TableRef targetTable resolved at parse time by BuildContext.resolveConditionJoinTarget ; terminal hop from the carrier field’s return-type @table binding, intermediate hop by reflecting on the condition method’s second parameter type via JooqCatalog.findTableByClass ; with a compact-constructor null-check as the structural safety net behind the new condition-join.target-table-resolved-at-parse load-bearing-classifier key. The WithTarget capability splits into a smaller HasTargetTable (target read only) plus the slot-iteration WithTarget extends HasTargetTable, so ConditionJoin joins FkJoin / LiftedHop under one capability for the alias-declaration loop and JoinPathEmitter.targetJavaClassName collapse. A new sealed ParentCorrelation taxonomy (OnFkSlots / OnConditionJoin) lifts the step-0 fork between FK-slot correlation and ConditionJoin-method correlation out of every emitter site into the model, threaded through each affected ChildField variant’s record header with a parentCorrelation.firstStep() == joinPath.get(0) compact-constructor invariant. The inline emitters (InlineTableFieldEmitter, InlineLookupTableFieldEmitter, InlineColumnReferenceFieldEmitter) and the split-rows emitter (SplitRowsMethodEmitter’s `buildListMethod / buildSingleMethod / buildConnectionMethod) read the dispatch off the carrier; FK hops emit .join(alias).onKey(FK), condition hops emit .join(alias).on(method(prev, this)). For split-rows + OnConditionJoin, the prelude declares a fresh parentAlias Table local for the @table-bound parent, emits the step-0 .join(parentAlias).on(condition(…​)) clause, and routes parentInput to JOIN on parent-PK columns. Validator-side: validateVariantIsImplemented’s `SplitRowsMethodEmitter.unsupportedReason consult and validateColumnReferenceField’s `hasConditionJoin branch both delete; validateReferenceLeadsToType folds its WithTarget special-case onto a uniform HasTargetTable read. The ConditionJoinReportable capability interface deletes outright; Rejection.EmitBlockReason enum (six values, all condition-join-step) and Rejection.StubKey.EmitBlock record retire with their last producers; JoinPathEmitter.hasConditionJoin predicate retires with its last consumer; docs/manual/reference/diagnostics-glossary.adoc’s six `=== <variant>-condition-join-step headings delete per DiagnosticsDocCoverageTest. R129 absorption: the column-reference-on-scalar-field-condition-join slug closes ; ColumnReferenceField with a multi-hop path containing a condition step now classifies and emits via InlineColumnReferenceFieldEmitter; a single-hop condition-only path on a scalar return type AUTHOR_ERRORs at the parser with actionable rewrite guidance (use {table:} or {key:}), which is the same diagnostic shape the deferred-rejection used to surface, now produced one stage earlier. Tests. Pipeline-tier ValidationTest cases flip from deferred-rejection to no-error; new HasTargetTableInvariantTest pins the JoinStep-permits-implement-HasTargetTable invariant; ParentCorrelationFirstHopInvariantTest exercises both OnFkSlots and OnConditionJoin arms end-to-end; GraphitronSchemaBuilderTest gains CONDITION_ONLY_TERMINAL_RESOLVES_TARGET_FROM_RETURN_TYPE, TABLE_WITH_CONDITION_PRESERVES_WHERE_FILTER, KEY_WITH_CONDITION_PRESERVES_WHERE_FILTER (the last two are regression guards for the legacy {table:, condition:} / {key:, condition:} whereFilter-fold semantics), CONDITION_ONLY_NO_RETURN_TYPE_TABLE_REJECTED (AUTHOR_ERROR when the terminal-hop carrier’s return type has no @table), CONDITION_INTERMEDIATE_REFLECTS_METHOD_PARAM (reflection on the condition method’s second parameter type resolves the intermediate-hop targetTable), and CONDITION_INTERMEDIATE_TABLE_WILDCARD_REJECTED (AUTHOR_ERROR when the intermediate condition method uses Table<?>); plus extends the existing WITH_CONDITION_PATH fixture with a non-null targetTable() check. *Symmetric finish on RecordTableMethodField: the seventh @record-parent variant gains a ParentCorrelation field on its record header so a {condition:}-first path AUTHOR_ERRORs at parse time (same shape as the sibling RecordTableField / RecordLookupTableField variants ; @record-parents have no @table to anchor the condition method’s source arg, so the synthesis routes through AuthorError); the dead instanceof JoinStep.FkJoin arm in SplitRowsMethodEmitter.buildForRecordTableMethod’s `unsupportedPath predicate retires, leaving only the pre-existing R43 limits (empty + multi-hop). Compile-tier + execution-tier: Sakila gains two condition-method fixtures, Customer.addressByCondition: Address @reference(path: [{condition: …​}]) exercising the inline TableField emission shape and Film.actorsByCondition: [Actor!]! @splitQuery @reference(path: [{condition: …​}]) exercising the split-rows emission shape via an EXISTS-over-junction predicate; ReferencePathConditionFixtures ships the two condition methods. Compile-tier coverage flows through mvn install (generated code compiles against the real jOOQ catalog); execution-tier GraphQLQueryTest.inlineTableField_conditionJoin_returnsAddressPerCustomer and splitTableField_conditionJoin_returnsActorsPerFilm assert end-to-end SQL correctness against PostgreSQL (the inline test cross-checks against the FK-equivalent Customer.address navigation; the split-rows test verifies one batched DataLoader round-trip across five films). Out of scope, follow-up filed: the legacy ReferenceElement { table, key, condition } directive surface conflates join-shape with WHERE-filter and admits seven free combinations; the cleanup is filed as a separate Backlog item (path-element-surface-cleanup, R235).

R229 (ebfa633 + b9121e0): EnumTypeGenerator now honours @field(name:) on enum values by writing .name(<sdl>).value(<runtime>) into the generated <Name>Type.type() body, with the runtime string pre-resolved at classify time on a new no.sikt.graphitron.rewrite.model.EnumValueSpec (sdlName, runtimeValue, description, deprecationReason, source) carried as List<EnumValueSpec> values on GraphitronType.EnumType. Pre-R229 the emitter echoed .name(SDL).value(SDL) and the directive lookup was re-evaluated independently at the resolver site, so a federated subgraph returning the runtime form (e.g. "FØDSELSNUMMER" for FODSELSNUMMER @field(name: …​)) hit Can’t serialize value …​ Unknown value 'FØDSELSNUMMER' at graphql-java’s Coercing layer. With the directive lifted into the .value(…​) slot, graphql-java owns the wire ↔ runtime translation at the boundary in both directions, which collapses the Java-side CallSiteExtraction.TextMapLookup arm into Direct: the sealed permit, EnumMappingResolver.enrichArgExtractions, the TypeConditionsGenerator / TypeFetcherGenerator static _MAP emit paths, the ArgCallEmitter / FieldBuilder switch arms, and the EnumMappingResolver field/constructor params on ServiceDirectiveResolver / TableMethodDirectiveResolver all retire. EnumMappingResolver.buildTextEnumMapping / .validateEnumFilter read from the classified model’s List<EnumValueSpec> (lookup via ctx.types) so the directive is read once at classify time and both consumers share the record component, eliminating the drift R263 reintroduced. Coverage: pipeline-tier GraphitronSchemaBuilderTest.EnumTypeCase.ENUM_WITH_FIELD_NAME_DIRECTIVE pins the classifier output (runtimeValue == "FØDSELSNUMMER"); existing PLAIN_ENUM / ENUM_WITH_DEPRECATED_VALUE cases reroute through EnumValueSpec; new execution-tier EnumSerializationExecutionTest pins three boundary scenarios (directive value round-trips through Coercing on output; input round-trip delivers the runtime form to the resolver; simple-value identity fallback); unit-tier EnumTypeGeneratorTest.typeMethod_routesFieldNameDirectiveIntoRuntimeValue pins the generated .name(sdl).value(runtime) shape; the R53 regression SERVICE_MUTATION_FIELD_NAME_OVERRIDE_TEXT_ENUM flips its assertion from TextMapLookup to Direct (same scenario, conversion has moved to the wire boundary). *Out of scope (called out, filed as R231): graphitron currently lowers text-mapped-enum fields to GraphQL type String at emit time, so R229’s .value() lift is invisible to clients on Sakila’s textRating field; emitting those fields as the enum type is a separate structural fix. Self-review follow-up b9121e0 swept stale TextMapLookup / enrichArgExtractions javadoc citations across InputBeanResolver, ServiceCatalog, ServiceDirectiveResolver, TableMethodDirectiveResolver, ArgCallEmitter, BodyParam, ConditionFilter, InputColumnBinding, InputField, and MethodRef. Build green: full mvn -f graphitron-rewrite/pom.xml install -Plocal-db on Java 25.

R230 (8f59529): Fix BodyParam.nonNull for nested input fields under a nullable enclosing arg. walkInputFieldConditions now ANDs an effectiveNonNull boolean (seeded from the InputTypeArg’s `nonNull() at projectFilters, narrowed at each NestingField recursion) into the value passed to every implicitBodyParam / compositeImplicitBodyParam callsite, so the emitter’s unguarded condition.and(…​) branch only fires when every enclosing link is statically non-null. Pre-R230 a query like soknader(filter: HentSoknadInput): [Soknad!] with HentSoknadInput.soknadId: [ID!]! silently returned the empty set when filter was omitted, because the generator emitted condition.and(film.film_id.in(null)) and jOOQ renders .in(null) as the literal false. Producer contract pinned by a new body-param.nonnull-is-effective-runtime @LoadBearingClassifierCheck on walkInputFieldConditions (single annotation covers both producer sites in its description text ; audit requires producer-key uniqueness) paired with a @DependsOnClassifierCheck on TypeConditionsGenerator.buildConditionMethod. BodyParam.nonNull’s interface-level javadoc tightens to name the producer / emitter contract; the accessor’s one-liner reduces to a forward-pointer. Coverage: `NestedInputFieldEffectiveNonNullPipelineTest pins the three AND transitions on the classified slot (nullable arg → false, both non-null → true, nullable NestingField wrapper between non-null arg and non-null leaf → false); GraphQLQueryTest.filmsByEffectiveNullability_omittedFilter_returnsUnfilteredBaseline is the only tier that observes jOOQ’s .in(null) rendering, asserting the omitted-filter case returns the unfiltered baseline of 5 films rather than the empty set.

R223 (9c25edc + c8813a4): roadmap-tool gains a check-adoc-tables verify-phase subcommand that walks every authored .adoc under graphitron-rewrite/ and docs/, tracks five structural block types (|=== table, ---- listing, …​. literal, //// comment, passthrough), and fails the build on any markdown-separator row (|---|---|, with optional GFM alignment colons) found outside all blocks. Asciidoctor renders markdown table syntax as paragraph text with literal pipes, so the typo was invisible until publish; the truth table at graphitron-rewrite/docs/argument-resolution.adoc § "Truth table (per input-field, per call site)" was carrying this shape and is converted to AsciiDoc [cols=…​] + |=== syntax in the same commit. target/, node_modules/, and .git/ subtrees are skipped; .md files are out of scope (markdown table syntax is native there). AdocMarkdownTableCheckTest pins six fixtures: markdown separator outside any block is flagged; the same characters inside each of the five block types are not flagged; target/ directories and .md files are skipped by the walker; aligned (|:---|---:|) separators are flagged. CLAUDE.md "Writing style" gains a paragraph naming the rule and the new check. Out of scope (called out, owned by R227): mdBodyToAdoc does not translate markdown tables embedded in .md roadmap plans, so rendered roadmap .adoc under target/ still carries raw pipe rows; that render-side hole is tracked separately. Build green: full mvn -f graphitron-rewrite/pom.xml install -Plocal-db on Java 25; verify phase reports "no markdown-formatted tables in authored .adoc files".

R228 (de25b0a + ac5830d): GraphitronSchemaValidator now rejects inline TableField / LookupTableField whose @reference path carries a @condition step at build time, closing the gap that let those two variants reach a runtime UnsupportedOperationException while the four sibling variants surfaced a Rejection.Deferred build error. ChildField.TableField and ChildField.LookupTableField declare ConditionJoinReportable with their own EmitBlockReason values (TABLE_FIELD_CONDITION_JOIN_STEP, LOOKUP_TABLE_FIELD_CONDITION_JOIN_STEP) and displayLabel ("Inline TableField", "Inline LookupTableField"); SplitRowsMethodEmitter.unsupportedReason is the single predicate the validator and both inline emitters consult, so inline stubs render byte-for-byte the same message as before and the four four ChildField variants javadoc/comment sites widen to six. Tests: R58TypedRejectionPipelineTest gains inlineTableField_conditionJoinStep_rejectedAtBuildTime + inlineLookupTableField_conditionJoinStep_rejectedAtBuildTime pipeline-tier coverage; the existing seal-tracking assertion renames conditionJoinReportable_implementedByExpectedFourVariants → conditionJoinReportable_implementedByExpectedSixVariants; TableFieldValidationTest / LookupTableFieldValidationTest flip WITH_CONDITION_ONLY from "no error" to "stub surfaces as build error" and add LIST_WITH_CONDITION_ONLY. docs/manual/reference/diagnostics-glossary.adoc adds === table-field-condition-join-step and === lookup-table-field-condition-join-step paragraphs alongside the four existing entries (DiagnosticsDocCoverageTest gate). Sakila example: Category.similar was an inline-TableField ConditionJoin fixture deliberately admitted by the classifier and stubbed at runtime; the validator now rejects it at build time (intended outcome), so the field and its sole dependent CategoryConditions class are removed from the example along with the README.adoc reference. Out of scope (called out, owned by R3 item 5 + R129): lifting the condition-join restriction itself ; when item 5 ships all six variants' validator arms come out together with the two inline emitter stubs and the four runtime stubs in SplitRowsMethodEmitter. Note on test placement: spec named GraphitronSchemaBuilderTest but GraphitronSchema carries no rejections() accessor; fixtures landed in R58TypedRejectionPipelineTest (existing home for "build schema + run validator + assert typed rejection"). Build green: full mvn -f graphitron-rewrite/pom.xml install -Plocal-db on Java 25.

R224 (5b202fb + d1e8fd6): LSP Diagnostics.validateFieldMember consults the field classification before falling back to the type-backing table, so @field(name:) on a @reference(path:) field validates the column against the path’s terminal table instead of the enclosing type’s @table. For ColumnReference / CompositeColumnReference arms the lookup now resolves through FieldClassification.tableName() (projected via CatalogBuilder.terminalTableName), mirroring the runtime’s ServiceCatalog.resolveColumnForReference walk; Column / CompositeColumn arms route the same way (equivalent target table, sourced from the classification); InputUnbound / Unclassified arms stay silent because the validator already emits a precise message; other arms fall through to the existing backing-driven dispatch. The fix also adds TypeContext.enclosingFieldOrInputValueDefinition so the dispatch resolves the SDL field name on input-side input_value_definition nodes too (the prior enclosingFieldDefinition walked only output-side field_definition). The new emitter site wears @DependsOnClassifierCheck(key = "field-classification-payload-faithful") against the existing CatalogBuilder producer. Tests: DiagnosticsTest gains three regression cases driving synthetic LspSchemaSnapshot.Built.Current snapshots: input @table + @reference retargets to terminal-table column, output @table + @reference mirror, and silence-on-Unclassified (no duplicate "Unknown column …​ on table '<enclosing>'" diagnostic). Build green: full mvn -f graphitron-rewrite/pom.xml install -Plocal-db on Java 25.

R225 (9b753db): LSP Diagnostics.severityOf flips Rejection.Deferred from DiagnosticSeverity.Warning to Error, so the editor squiggle matches the mvn graphitron:dev finality (every Rejection variant throws ValidationFailedException, regardless of arm ; the actionable hint is the roadmap-item slug carried by the rejection, not the severity, reverting the R147 softening). ValidatorDiagnosticsTest.deferredMapsToWarningSeverity renamed to deferredMapsToErrorSeverity with its severity assertion flipped; RejectionSeverityCoverageTest unchanged (asserts only non-null). Build green: full graphitron-lsp test suite (347 tests) passes on Java 25.

R216 (2a15e15 + 70e41cb): LSP classification, hover, inferred-directive, completion, go-to-definition, and @field(name:) member-validation surfaces now walk extend type X { …​ } declarations in parallel with type X { …​ } definitions. A new closed-family DeclarationKind enum (graphitron-lsp/…​/parsing/DeclarationKind.java, 12 constants spanning both _type_definition and *_type_extension kinds) replaces the three out-of-sync Set<String> sources of truth in InlayHints, TypeContext, and DeclarationHovers; DeclarationKind.enclosing(Node) + DeclarationKind.walkAll(Node, Consumer) centralise the two walks every consumer used; isCarrier() filters the field-hover ancestor walk to coordinates where Parent.fieldName is meaningful. TypeContext.tableNameOf is rerouted through the classifier’s name-keyed projection on the snapshot (built.typeClassificationsByName().get(name) → tableNameFromClassification) so an extend type Customer { …​ } whose @table-bearing definition lives in another file still resolves to the authoritative table name; the private tableNameOf(TypeClassification) helper in InlayHints lifts to TypeContext.tableNameFromClassification so inlay / hover / completion / definition / diagnostic surfaces share one switch. Snapshot threading reaches ReferenceCompletions.generate and Definitions.compute (both gain @DependsOnClassifierCheck(key = "type-classification-payload-faithful") so the audit test pins their new dependence on the type-classification projection); GraphitronTextDocumentService wires workspace.snapshot() to both. Tests: InlayHintsTest gains classification, inferred-@field, and absent-@table parity on extend type Query + extend type Customer; DeclarationHoversTest gains type-name and field-name hover parity inside extend type Customer; DiagnosticsTest gains @field(name:) member validation inside extend type Foo (unknown column + valid column); the existing ReferenceCompletionsTest.unknownTableReturnsEmptyForKey adapts to the snapshot-as-source-of-truth posture (classifier maps Foo to a missing table, completion empties). Self-review fix (70e41cb) dropped a defensive LinkedHashSet<Node> dedupe from walkAll ; tree-sitter ASTs are trees, the set guarded against an impossible scenario. *Out of scope (called out): generator-side admission of extend type Foo @table(name:"x") { …​ } (the classifier doesn’t see @table on extensions today, so the snapshot-routed tableNameOf stays silent on extension-declared @table without a corresponding definition ; lifting that constraint is a classifier-side change with its own roadmap item). Build green: full mvn -f graphitron-rewrite/pom.xml install -Plocal-db on Java 25; 1905 graphitron + 337 graphitron-lsp + sakila-example tests pass.

R217 (ee2802f + 72fd454): LSP inlay classification labels surface model leaf names, and a synthetic @table(name: "…​") ghost now renders on declarations whose classification is Table / Node / TableInterface / TableInput but that carry no @table directive at all. LspClassificationLabels.projectionLabel / projectionTypeLabel return each projection record’s simpleName() verbatim ("Column", "Table", "DmlMutation", …​) via exhaustive uniform-body switches that survive as compile-time tripwires for new permits; DeclarationHovers prints the qualified form (FieldClassification.Column / TypeClassification.Table) in hover headers; FieldClassification / TypeClassification class-level Javadoc records the new dual role of projection-record names. The generator-permit fieldLabel(GraphitronField) / typeLabel(GraphitronType) variants had no LSP callers and are deleted. InferredDirectiveArgs.Entry gains an AbsentArm absentArm slot (initial implementation used a boolean renderWhenAbsent flag, replaced in the self-review fix by a sealed AbsentArm strategy interface so a future entry that wants absent-rendering must implement or reuse a permit: flipping the field on without a matching renderer no-ops at compile time, not at runtime, preserving the canonical-arg table’s invariant "downstream consumers either pick it up automatically or fail to compile"). Today only the @table entry carries an arm (AbsentArm.TableName) whose switch encodes the eligibility set and reads tableName() off TypeClassification.{Table, Node, TableInterface, TableInput}; @field / @reference stay off per the spec’s judgement calls. InlayHints.collectAbsentDirectiveHints walks type-definition nodes in parallel with the classification arm, dispatching to entry.absentArm().resolveAbsentValue(c) via virtual call, emitting @<directive>(<arg>: "<resolved>") anchored at the type-name node when the type carries no directive of that name; the existing present-but-bare arm and the new absent arm share the canonical-arg table and the config.inferredDirectives() toggle. The @DependsOnClassifierCheck(key="type-classification-payload-faithful") reliesOn text widens to note the absent-directive arm. Tests: InlayHintsTest.classificationHintsLabelFieldDeclarations flips from "table type", "column" to "Table", "Column"; new absentTableHintRendersOnObjectTypeWithoutDirective, absentTableHintRendersOnInputTypeWithoutDirective, and absentTableHintSuppressedWhenDirectivePresent pin the new arm on object + input declarations and assert it stays quiet when the directive node is present; inferredTableHintSuppressedWhenAuthored extends to noneMatch(label → label.startsWith("@table")); DeclarationHoversTest flips header assertions to the qualified form. Build green: full mvn -f graphitron-rewrite/pom.xml install -Plocal-db on Java 25; 337 graphitron-lsp tests + 1897 catalog tests pass.

R215 (fdb757b + 3d60f40): column-binding requirement captured at classification, not derived at usage. BuildContext.classifyInputField gains a ClassifyContext parameter (carries expandingTypes + enclosingOverride); the recursive descent through NestingField composes ctx.expanding(typeName).withOverride(ctx.enclosingOverride() || nestOverride). InputField.ConditionOnlyField renamed to InputField.UnboundField(parentTypeName, name, location, typeName, nonNull, list, Optional<ArgConditionRef> condition, String attemptedColumnName); the classifier emits this variant uniformly on column-miss (across plain and @table inputs) and on @condition(override: true) with a matching column (the §5 ColumnField+override:true collapse). TypeBuilder.buildTableInputType defers column-coverage to consumption (admits UnboundField instead of rejecting the whole type as UnclassifiedType); FieldBuilder.walkInputFieldConditions becomes a single exhaustive switch with the UnboundField arm consuming enclosingOverride directly and emitting a consumer-side rejection (typed Rejection.AuthorError.UnknownName with Levenshtein hint) when the cascade doesn’t admit. GraphitronSchemaValidator walks TableInputType.inputFields() and rejects UnboundField + @condition(override: false) at the directive’s source location; MutationInputResolver.resolveInput admits UnboundField(condition: present, override: true) on UPDATE / DELETE and rejects on INSERT, plus rejects @condition(override: false) on any mutation input field at SDL-walk time. Eight downstream sealed-switch consumers updated (walkInputFieldConditions, MutationInputResolver, EnumMappingResolver, CatalogBuilder, ContextArgumentClassifier, GraphitronSchemaValidator, TypeFetcherGenerator.NOT_DISPATCHED_LEAVES, plus LSP LspClassificationLabels + DeclarationHovers and FieldClassification.InputUnbound renamed from InputCondition); InputFieldResolver.resolve(typeName, rt, enclosingOverride) takes the cascade flag from FieldBuilder.classifyArgument (fieldOverride || argCondition.map(c → c.override()).orElse(false)). Two new load-bearing classifier-check keys: input-field.unbound-implies-no-column (producer: classifyInputFieldInternal; consumer: walkInputFieldConditions) and input-field.unbound-with-override-condition-admits-on-mutation-update-delete (producer: resolveInput). Coverage: eight new R215 acceptance tests in GraphitronSchemaBuilderTest (r215_plainInputArgLevelOverrideAdmitsNonBindingField, r215_tableInputNonBindingFieldRejectsAtConsumer, r215_tableInputNonBindingFieldAdmittedUnderOverrideCascade, r215_validatorRejectsOverrideFalseOnNonBindingField, r215_validatorRejectsConditionOverrideFalseOnMutationInputField, r215_mutationUpdateConditionOverrideTrueOnNonPkFieldAdmits, r215_mutationInsertConditionOverrideTrueRejects, r215_nestedPlainInputPropagatesCascade); R210’s renamed plainInput_overrideTrueWithoutMatchingColumn_classifiesAsUnboundField + tableInput_overrideTrueWithoutMatchingColumn_classifiesAsUnboundField stay green; six existing tests asserting the pre-R215 rejection shape (EXPLICIT_TABLE_UNRESOLVED_COLUMN, NESTED_INPUT_FIELD_UNKNOWN_COLUMN, NodeIdPipelineTest.InputCase.{ACCESSOR_MISSING, LIST_VARIANT}) updated to assert the new admit-at-type-build behaviour. Late-round patch (after self-review with principles-architect, alf’s pushback on cascade-contract gloss): the first-pass walkInputFieldConditions UnboundField arm silently dropped the inner @condition under an outer @condition(override:true) cascade, contradicting docs/manual/how-to/migrating-from-legacy.adoc#behavior-divergence-condition-cascade ("every @condition you write produces SQL; the override flag controls only the implicit column predicate"). The arm now mirrors the ColumnField arm structure (always emit the explicit @condition when present; decide rejection separately): rejects at the consumer outside the cascade for condition.isEmpty() (no filter contribution) and condition.isPresent() && !override() (structurally malformed shape) ; the second arm acts as a safety net for plain inputs until R221 lifts validator coverage there. New acceptance test #11 r215_innerExplicitConditionFiresOnUnboundFieldUnderOverrideCascade pins the cascade-doc contract (two ConditionFilter`s emitted: outer arg-level + inner field-level); the three R205 Path B regression tests (`ArgumentParsingCase.PLAIN_INPUT_ARG_FIELD_CONDITION_EMITTED, plainInput_unresolvedFieldWithCondition_rejectsAsUnclassifiedFieldWithUnknownName, plainInput_overrideFalseWithoutMatchingColumn_stillRejectsAsUnclassifiedField) keep their pre-R215 rejection assertions green via the consumer-arm safety net. Out of scope (called out, deferred to follow-ups): MutationField.{Value, Condition} sealed projection from MutationInputResolver for downstream DML emitters (acceptance behaviour shipped at the resolver’s per-field admission loop; the structural lift to a sealed projection is a follow-up roadmap item ; no emitter consumes a MutationField projection yet); R213 exact-SourceLocation attribution on the surrounding UnclassifiedField’s `location field (the rejection prose names the field but the wrapper’s location still points at the consuming query field; threading the location through walkInputFieldConditions → projectFilters → projectForFilter → TableFieldComponents.Rejected is the R213 follow-up); R221 validator walks PlainInputArg.fields() for the same UnboundField + @condition(override:false) rejection the shipped validator catches on TableInputType (the consumer-arm safety net above covers non-cascade plain inputs; the cascade case admits-and-emits today, which R221 will reject at the directive’s location). Build green: full mvn -f graphitron-rewrite/pom.xml install -Plocal-db on Java 25; 1906 graphitron tests + 334 graphitron-lsp tests + all sakila-example tests pass.

R211 (831a32d): @condition(override: true) build failure no longer surfaces the misleading "no column 'X' found in table 'Y'" line alongside the actionable condition error. BuildContext.classifyInputFieldInternal reinstates an errorsBefore size-delta check inside the R210 override:true block: when buildInputFieldCondition appends to errors and returns empty, the gate returns a placeholder InputFieldResolution.Unresolved(lookupColumn=null, "@condition(override: true) failed to build; see condition error") instead of falling through to the column-miss arm; the column is unused by construction under override:true. The override:false leg never enters this branch, so R205 acceptance test #6’s typed AuthorError.UnknownName lift survives (InputFieldResolver.resolve’s `canLiftToUnknownName guard sees condErrors non-empty + lookupColumn null and folds to Rejection.structural, which is the right bucket ; the failure shape is condition-method binding, not unknown-column). R210’s existing test plainInput_overrideTrueWithBrokenCondition_rejectsAsUnclassifiedField gains a doesNotContain("no column 'sakskode' found") assertion so a regression that reintroduces the column-miss arm under override:true trips at the existing test site. Surfaced by alf’s production opptak-subgraph (parameter-name mismatches in OpptakFilterInput.opptaksNavn / utdanningstilbud); the related attribution issue from the same investigation is filed as R213. Will be subsumed by R215’s column-binding-at-classification restructure (the override:true gate moves above the column lookup, making the column-miss arm structurally unreachable on this branch); the doesNotContain assertion stays as a regression guard. Build green: full mvn -f graphitron-rewrite/pom.xml install -Plocal-db on Java 25.

R203 (2b8b465 + 8d39ef4 + 9ac3e4c Phase 1 natives module + release workflow; first release no.sikt:graphitron-tree-sitter-natives:0.26.0-1 published to Maven Central via the tree-sitter-natives-release workflow on its four-platform matrix [Phase 2]; ae486d9 Phase 3 graphitron-lsp cutover; bbabb02 BundledLibraryLookup probe for well-known libtree-sitter install prefixes; a94f546 In Review → Ready rework after first review pass; a3338b6 Phase 4 distinguishes too-old libtree-sitter from missing and ships the spec-named error-translation unit test): graphitron-lsp no longer compiles a per-platform tree-sitter runtime + grammar on every mvn install. The vendored libtree-sitter runtime sources and the bkegley tree-sitter-graphql grammar parser.c are gone from graphitron-lsp/src/main/native/ (≈30 000 lines deleted); the three build-native-* Maven profiles and the exec-maven-plugin shell-out are gone from graphitron-lsp/pom.xml. The grammar binary now ships from a new same-repo standalone Maven module graphitron-rewrite/graphitron-tree-sitter-natives/ (groupId no.sikt, version stream <tree-sitter-runtime-ABI>-<build-n>, first release 0.26.0-1; standalone pom intentionally not a child of graphitron-rewrite-parent and not in the parent reactor’s <modules> list, so the release cadence decouples from the rewrite’s 10-SNAPSHOT parent and mvn install -f graphitron-rewrite/pom.xml -Plocal-db pays zero build cost). The natives release workflow is workflow_dispatch-only on a four-platform GitHub Actions matrix (linux-x86_64, linux-aarch64, macos-aarch64, windows-x86_64; macos-x86_64 dropped during Phase 1 dry-run since Sikt LSP developers all run M1+); each matrix runner runs upstream’s tree-sitter build CLI against the vendored grammar to produce one platform-shaped shared library, the jar carries exactly four lib/<os>-<arch>/tree-sitter-graphql.{so,dylib,dll} entries (POSIX lib prefix; Windows unprefixed per platform convention), and a post-deploy load+parse matrix verifies the published artifact resolves into a fresh local m2 and the bundled grammar loads against an OS-installed libtree-sitter on every platform. graphitron-lsp BundledLibraryLookup switches to the four-platform set, drops the previous UnsupportedOperationException Windows branch, and now also probes well-known libtree-sitter install prefixes (Homebrew /opt/homebrew/lib + /usr/local/lib on macOS, vcpkg’s <VCPKG_ROOT|VCPKG_INSTALLATION_ROOT>/installed/x64-windows/bin + the default C:\vcpkg... on Windows, /usr/local/lib on Linux), composing a system-installed runtime onto the SPI grammar lookup via SymbolLookup.or so vanilla brew install tree-sitter / vcpkg install tree-sitter:x64-windows work with no env-var wiring. GraphqlLanguage.loadOrExplain translates UnsatisfiedLinkError / RuntimeException from Language.load into an install-instructions message and now also distinguishes "too-old libtree-sitter installed" (commonly Debian/Ubuntu apt’s libtree-sitter0 0.20.x, which predates the ts_language_abi_version symbol jtreesitter 0.26 looks up) via a probe-path classifier that walks a BundledLibraryLookup-superset including apt’s /usr/lib/<arch>-linux-gnu/libtree-sitter.so.0 and checks the ABI symbol directly. GraphqlLanguageErrorTranslationTest pins the classifier (cause-chain walk, ABI-symbol failure shape, ignores unrelated errors), the missing- and too-old- runtime messages per OS via @EnabledOnOs, and explicitly names libtree-sitter0 in the too-old Linux hint. NativeLibraryBundleTest covers all four platforms via per-platform @EnabledOnOs methods (3 skipped on any single host); rewrite-build.yml source-builds libtree-sitter v0.26.9 so the linux-x86_64 method runs green in CI. getting-started.adoc gains a "Native runtime dependency" section with [#native-runtime-dependency] anchor and a per-platform install + library-discovery table (including a NixOS shell.nix snippet for nix-store layouts and the JAVA_TOOL_OPTIONS=-Djava.library.path=…​ escape hatch for non-default installs). Subsumes and deletes R89 (lsp-native-build-multiplatform-ci): the multi-platform-CI concern is now the post-deploy matrix on the natives release workflow plus the four @EnabledOnOs NativeLibraryBundleTest methods, not a per-PR matrix on rewrite-build.yml. 334 graphitron-lsp tests pass (7 skipped: 3 platform-gated NativeLibraryBundleTest + 4 platform-gated GraphqlLanguageErrorTranslationTest methods on the Linux CI host); full mvn -f graphitron-rewrite/pom.xml install -Plocal-db green on Java 25.

R210 (94bc3bf + 47f5f39 + ac2588c): @condition(override: true) on an input field with no matching column no longer rejects as Unresolved under R205’s Path B. New InputField.ConditionOnlyField sealed permit carries the ArgConditionRef with no column data; BuildContext.classifyInputFieldInternal gates on the directive’s override flag at the "no column found" fall-through (cheap read, no errors-list side effects) before building the condition, so the typed AuthorError.UnknownName lift on override:false reflection failures is preserved at the R205 boundary. FieldBuilder.walkInputFieldConditions emits the explicit ConditionFilter only; six other exhaustive InputField consumer sites (ContextArgumentClassifier, GraphitronSchemaValidator, EnumMappingResolver, CatalogBuilder + new FieldClassification.InputCondition record, TypeFetcherGenerator.NOT_DISPATCHED_LEAVES, LSP hover + inlay) grow explicit arms; MutationInputResolver’s existing default-arm rejects condition-only carriers as structurally unfit for DML. Symmetric across plain inputs (the reported opptak-subgraph `SakFilterV2Input.sakskode shape) and @table inputs since both share classifyInputFieldInternal. Coverage: three R210 acceptance tests (plainInput_overrideTrueWithoutMatchingColumn_classifiesAsConditionOnlyField with @ProjectionFor(ConditionOnlyField.class), tableInput_overrideTrueWithoutMatchingColumn_classifiesAsConditionOnlyField, plainInput_overrideTrueWithBrokenCondition_rejectsAsUnclassifiedField) plus a boundary test (plainInput_overrideFalseWithoutMatchingColumn_stillRejectsAsUnclassifiedField) pinning the R205↔R210 behaviour boundary by name; TestConditionStub gains sakskodeCondition / syntheticNameCondition fixtures; VariantCoverageTest.NO_CASE_REQUIRED carries the rationale for the @Test-not-enum-case shape. Out of scope (called out): execution-tier Sakila fixture mirroring the production shape ; deferred (pipeline tier already exercises classifyInputFieldInternal and the projected ConditionFilter). Design alternative considered: InputFieldResolution.ConditionOnly arm (resolution-tier sibling, structurally honest, deferred to a future refactor if the carrier-vs-resolution distinction becomes load-bearing); the carrier-tier InputField.ConditionOnlyField permit chosen for incremental change cost + uniform walking. Build green: full mvn -f graphitron-rewrite/pom.xml install -Plocal-db on Java 25; 1893 tests pass.

R205 (fdada52 restore plain-input filter symmetry + escalate Unresolved to build error, c1de3f8 self-review follow-ups + R209 backlog stub): plain-input (non-@table) filter input types now classify and project identically to @table inputs. InputFieldResolver.resolve returns sealed Resolution.{Ok, Rejected} (mirroring OrderByResolver.Resolved); any InputFieldResolution.Unresolved or @condition reflection failure lifts as a typed Rejection (single column-miss → Rejection.unknownColumn so LSP fix-its consume the structured attempt + candidates; everything else folds to Rejection.structural with joined prose). ArgumentRef.UnclassifiedArg’s `String reason becomes Rejection rejection with a backwards-compatible reason() accessor; the four other construction sites in FieldBuilder.classifyArgument wrap their prose with Rejection.structural(…​). FieldBuilder.projectFilters’ `PlainInputArg branch is now structurally identical to TableInputArg: it allocates a non-null implicitBodyParams and drains it into bodyParams, so the symmetric implicit-predicate emission is a type-system fact (the four per-call implicitBodyParams != null guards in walkInputFieldConditions collapse; the method asserts non-null at entry via requireNonNull). projectFilters / projectForFilter thread List<Rejection> end-to-end via a new foldRejections helper; UnclassifiedArg.rejection.prefixedWith(…​) preserves typed payloads (e.g. AuthorError.UnknownName from a plain-input column miss) through to UnclassifiedField.rejection. ProjectionCoverageTest drops the PojoInputType allowlist entry; a new @ProjectionFor(PojoInputType.class) projection test (plainInput_resolvedColumnWithoutCondition_emitsImplicitBodyParam) pins the implicit-predicate emission on the plain-input path. Six acceptance tests cover symmetric implicit emission, explicit+implicit composition, override propagation, rejection on Unresolved with/without @condition, and rejection on @condition reflection failure (Path B: bare-field-without-@condition signals binding intent just as much as @condition-annotated does). The languagesByPlainInput sakila-example fixture + execution test, which encoded the silent-drop as expected behaviour, are deleted; docs/argument-resolution.adoc retires the per-field-skip rationale paragraph at :400-412 and adds an R205 anchor sentence to the truth table at :262-275. Out of scope (called out): project-wide design-doc-vs-implementation conformance audit (filed as R207); auto-binding via @condition method when no column resolves; FieldRegistry classify-input trace’s typed-Rejection payload loss (filed as R209). Build green: full mvn -f graphitron-rewrite/pom.xml install -Plocal-db on Java 25.

R206 (3a44d47): synthesised ConnectionType / EdgeType carry the @asConnection carrier field’s SourceLocation. ConnectionPromoter.promote now passes BuildContext.locationOf(fieldDef) into the two record constructors instead of null; first-write-wins on dedupe (the existing instanceof ConnectionType early-continue preserves the first carrier’s location) and PageInfoType.location() deliberately stays null because a single PageInfo serves every connection so no carrier site is the actionable one. Downstream, GraphitronSchemaBuilder.rejectCaseInsensitiveTypeCollisions already reads existing.location() when demoting to UnclassifiedType, so SYNTH_VS_SYNTH / SDL_VS_SYNTH / SYNTH_EDGE_VS_SDL ValidationError`s now carry an actionable position an LSP/editor can jump to. `CaseInsensitiveTypeClashCase migrated Consumer<GraphitronSchema> → BiConsumer<GraphitronSchema, String> so each arm sees its own SDL fixture; SYNTH_VS_SYNTH pins both line and column (via new TestSchemaHelper.preludeLineCount); SDL_VS_SYNTH and SYNTH_EDGE_VS_SDL pin the synth side’s carrier column; SYNTH_PAGE_INFO_VS_SDL explicitly asserts the synth member’s null location locking in the design choice. No record-shape changes; pure provenance threading.

R204 (930739a): validate uniform env.getSource() domain return type across OutputField producers on an SDL type. Lifts OutputField as a sealed sub-interface of GraphitronField (permits RootField, ChildField) declaring DomainReturnType domainReturnType(); new sealed DomainReturnType (Record(TableRef) | TableRecord(ClassName) | Plain(ClassName)) mirrors the producer’s env.getSource() Java domain identity without classloading at validator time. Post-classification GraphitronSchemaBuilder.validateUniformDomainReturnType groups OutputField entries by SDL Object return-type name and demotes every participant in a multi-arm group to UnclassifiedField with a typed Rejection.AuthorError.MultiProducerDomainTypeDisagreement; the validator carries @LoadBearingClassifierCheck(key = "output-fields.uniform-domain-return-type") paired with a matching @DependsOnClassifierCheck on FetcherEmitter.buildSingleRecordTableFetcherValue. The two formerly-@Disabled mixed-producer cases in SingleRecordTableFieldServiceProducerPipelineTest now assert against the unified-path diagnostic; unit-tier DomainReturnTypeCoverageTest walks the sealed-permit graph by reflection and pins per-arm structural equality. Per-permit narrowing (design fork from the spec draft’s broad-detection wording): table-bound service producers answer Record(table) rather than TableRecord(recordClass) because typed XRecord IS-A jOOQ Record and children read by name through the generic Record interface; only the carrier-payload case (DML @mutation Record(table) vs @service-on-Mutation TableRecord(XRecord) for the same payload SDL Object) surfaces today. Build green: full mvn -f graphitron-rewrite/pom.xml install -Plocal-db on Java 25.

R190 (182ec24 sealed GraphitronContext + schema-driven Graphitron.newExecutionInput(DSLContext, …) factory: ContextArgumentClassifier walks every MethodRef.Param.Typed whose source is ParamSource.Context, rejects mutually-incompatible Java types per contextArgument name as a typed Rejection.AuthorError.TypeConflict, and stores one ResolvedContextArg(name, javaType, sites) per name on a new Classification carrier; GraphitronContextInterfaceGenerator now emits public sealed interface GraphitronContext with a nested public static final class GraphitronContextImpl implements GraphitronContext (same-compilation-unit permits, no javapoet permits surface needed) carrying a public INSTANCE field and a private constructor, getTenantId removed, getDslContext demoted to a default reading env.getGraphQlContext().get(DSLContext.class); GraphitronFacadeGenerator.newExecutionInput collapsed to a single overload with DSLContext defaultDsl first then one parameter per ResolvedContextArg in alphabetical order, body null-checks every slot and populates GraphQLContext with DSLContext.class, each contextArgument string key, and the singleton GraphitronContextImpl.INSTANCE under GraphitronContext.class; five DataLoader name emission sites de-prefixed (DataLoaderFetcherEmitter, TypeFetcherGenerator ×2, MultiTablePolymorphicEmitter ×2, QueryNodeFetcherClassGenerator); HandleMethodBody federation entity dispatch grouping collapses Map<Integer, Map<String, List<Object[]>>> to Map<Integer, List<Object[]>>; graphitron-sakila-example migrated end-to-end (deleted AppContext.java, GraphqlResource calls Graphitron.newExecutionInput(dsl, "test-user"), 14 anon-impl test sites collapsed, two getTenantId-override tests commented out with forward-reference to R45); 8d99486 14-page user-doc rewrite (getting-started.adoc, runtime-extension-points.adoc, runtime-api.adoc, test-your-schema.adoc substantive rewrites; tenant-scoping.adoc, apollo-federation.adoc, split-vs-inline.adoc deferral banners pointing at R45; index + in-prose touch-ups across how-it-works.adoc, batching-model.adoc, 06-going-further.adoc, add-custom-conditions.adoc, security.adoc, graphitron-rewrite/docs/README.adoc); b408253 L2 ContextArgumentTypeAgreementTest (accepted + three-site conflict fixtures) + L4 ContextArgumentTypeAgreementValidationTest (pins the validator-mirrors-classifier drain renders header + indented per-site lines and exposes the typed sites field); f1a6b7a L4 GraphitronFacadeGeneratorPipelineTest (classified two-@service(contextArguments)-site SDL; asserts alphabetical parameter ordering, per-slot requireNonNull, the graphQLContext lambda body’s typed/string puts, the DataLoaderRegistry attach), L5 example SDL gains the single @service(contextArguments: ["userId"]) site (Query.greetingByUser → UserGreetingService.greet), L6 FilmContextArgumentRoundTripTest (round-trip threading through to the service method; singleton-throws-on-missing-with-factory-hint diagnostic; hand-rolled-ExecutionInput.Builder-redacts-through-framework end-to-end); 0aa1ee7 self-review pass addressing principles-architect findings ; Classification cached on GraphitronSchema as a 6th component populated once at parse boundary (validator + facade emitter both read schema.contextArguments() rather than re-classifying, restoring the "single producer" framing the load-bearing-classifier annotations promised), dead graphitronContextCall parameter dropped from DataLoaderFetcherEmitter.build plus its three TypeFetcherGenerator call sites, CallParam lifted to carry TypeName javaType so ArgCallEmitter’s two Context arms read identical structural data instead of one round-tripping through `ClassName.bestGuess, body-string assertion on the pipeline test deleted (covered by L5 compile + L6 round-trip), Class<T> expectedType slot dropped from getContextArgument and the Java cast moved to the generated call site ((String) graphitronContext(env).getContextArgument(env, "userId")) ; the factory’s typed parameter list IS the load-bearing diagnostic and the runtime expectedType.cast was redundant ceremony; Classification.resolved switched from Map.copyOf to Collections.unmodifiableMap(new LinkedHashMap<>(…)) so the alphabetical TreeMap iteration order survives the defensive copy across JVM hash seeds): single-tenant slice of R45 lands the sealed contract + the schema-driven factory so the multi-tenant rescope can layer tenant-column classification, byTenant overload, per-loader name partitioning, and the @tenantId directive on top of a stable baseline. Out of scope (called out, all reserved for R45): tenant column Mojo config, tenant-scope classification, byTenant factory overload, DataLoader name partitioning by tenant, @tenantId ARGUMENT_DEFINITION directive. Custom validator factory (<validatorFactory> Mojo element) reserved for R192. Follow-ups flagged by self-review, non-blocking: the singleton’s INSTANCE is publicly callable (the L6 missing-value test reaches in directly to inspect the un-redacted message text; javadoc explicitly frames the throw as server-log surface only). Build green: full mvn -f graphitron-rewrite/pom.xml install -Plocal-db on Java 25; 1870 graphitron tests + 347 example tests pass.

R160 (c2dc8d1 C1-C3 sealed FieldClassification + TypeClassification projection families plus CatalogBuilder projector switches landing on LspSchemaSnapshot.Built.{Current,Previous} symmetrically, d02a0bb C4-C5 InlayHints provider with inferred-directive + classification arms plus InlayHintConfig and workspace/didChangeConfiguration push, 039841b C6 classification hover via sealed DeclarationHover parallel dispatch in Hovers.compute, 3d42eeb C7 docs/manual/reference/lsp-inlay-hints.adoc, f647ea5 self-review pass 1 adding the workspace/configuration initialisation pull, the InferredDirectiveArgs indirection, MutationService.tableName parity with QueryService, and a R160 leak from the user-facing doc, 366b07b self-review pass 2 co-locating projection-payload assertions inside GraphitronSchemaBuilderTest’s existing `// ===== <VariantName> ===== classifier blocks via @ProjectionFor plus the ProjectionCoverageTest drift-prevention meta-test): surfaces Graphitron’s inference and classification layers in the editor as inlay hints + rich hover. Three independent client-side toggles all default to false and live under graphitron.inlayHints.inferredDirectives (ghost annotations at bare @table / @field / @reference sites showing the resolved value), graphitron.inlayHints.classification (compact label per field declaration and type declaration), and graphitron.hover.classification (markdown unpacking the variant payload ; table, column, FK chain, target type, error channel, DML verb, …​). Both projection families are sized to distinct hover-payload shapes rather than 1:1 with the generator-side permits, with discriminator fields collapsing siblings that differ only in a label axis (e.g. four MutationField.DmlTableField permits collapse to one DmlMutation(tableName, inputTypeName, errorChannelName, DmlKind) record); the projector’s exhaustive switch over the generator-side permits is the load-bearing coverage contract that fails-to-compile on a new leaf without an LSP-side projection arm. Inferred-directive provenance is read from the live tree-sitter Tree on WorkspaceFile.tree() at request time (the AST asks "did the buffer carry name:?") rather than lifted onto the model ; Provenance discriminators were attempted under a previous design and rolled back (~330 lines across TableRef, ColumnRef, the five @reference-permits, ParticipantRef.CrossTableField); the AST-read keeps the parse boundary closed and adds no model surface. BuildArtifacts shape unchanged: the new fieldClassificationsByCoord / typeClassificationsByName fields live inside LspSchemaSnapshot.Built.{Current,Previous} symmetrically, Workspace.demoteSnapshot preserves them, and stale-snapshot rendering mirrors userArgHover / columnHover’s "prefer stale info over silence" policy. C6 introduces a sealed `DeclarationHover family (FieldDeclarationHover / TypeDeclarationHover) parallel to the directive-arg-keyed Behavior family rather than widening Behavior (the "Capability vs. sealed-switch confusion" principle: Behavior stays directive-argument-binding-shaped, SDL declaration coordinates get their own resolver). Two new @LoadBearingClassifierCheck keys (field-classification-payload-faithful, type-classification-payload-faithful) wear on CatalogBuilder.buildSnapshot with matching @DependsOnClassifierCheck annotations on the three LSP consumers (inferred-directive arm, classification arm, classification hover). Tests: pipeline-tier GraphitronSchemaBuilderTest blocks gain @ProjectionFor-annotated sibling assertions running each canonical fixture through the projector and pinning the projected record type + payload values (24 new @Test methods over ~20 variant blocks); ProjectionCoverageTest walks GraphitronField / GraphitronType sealed leaves and fails on any leaf without a @ProjectionFor cover or a documented NO_PROJECTION_REQUIRED exception; LSP-tier InlayHintsTest covers config gating, the three inferred-directive arms, the classification arm, and Built.Previous stale rendering; DeclarationHoversTest covers field-name and type-name cursor positions, the DmlMutation payload shape, the directive-arg cursor short-circuit, and Unavailable / missing-projection no-ops; GraphitronLanguageServerTest covers the initialisation-time workspace/configuration pull; GraphitronWorkspaceServiceTest covers the push-side didChangeConfiguration parse. Out of scope (called out, not regressed): inlay hints for inferred arguments on directives other than @table / @field / @reference (@nodeId(typeName:), @reference(key:) inference, and future cases extend InferredDirectiveArgs.ENTRIES and gain a renderer arm); inferred return shapes on root fetchers and the inferred join key on @nestingField; a graphitron-shipped editor extension (the LSP exposes the config keys; the editor flips them); inlay hints reflecting unsaved buffer state without a successful generator pass (hints derive from the snapshot, Unavailable means no hints). Follow-ups flagged by review, non-blocking: LspClassificationLabels.{fieldLabel,typeLabel}(model permit) switches are unused at runtime (projection-keyed callers cover both consumers) and can be deleted in a cleanup pass; InferredDirectiveArgs lives in the catalog package with its own string literals rather than under BuildContext’s `ARG_NAME / ARG_PATH, so a rename or new inference rule still maintains two places ; consolidate when a third consumer surfaces. Build green: full mvn -f graphitron-rewrite/pom.xml install -Plocal-db on Java 25; 1869 graphitron tests + 318 graphitron-lsp tests pass.

R191 (2e84eff initial-import omnibus carrying spec + implementation + tests): honor @field(name:) for accessor lookup on free-form @record parents on the table-bound and polymorphic-hub branches. FieldBuilder.collectAccessorMatches takes an accessorBaseName parameter and matches against <base> / get<UcBase> / is<UcBase> instead of the SDL field name; deriveAccessorRecordParentSource, resolveRecordParentSource, and derivePolymorphicHubSource thread the value from their callers (fieldName retained for cardinality-mismatch text that quotes the SDL name). The TableBoundReturnType arm at FieldBuilder.java:3700 reuses the already-computed columnName; classifyRecordParentPolymorphicChild reads @field(name:) at :4327-4329 before dispatching to resolvePolymorphicRecordParent. The accessor-rowkey-shape-resolved and accessor-rowkey-shape-resolved-against-hub @LoadBearingClassifierCheck description blocks each gain a sentence: matched accessor’s name is the directive value when present on a free-form @record parent, else the GraphQL field name. The AccessorRef.methodName() value remains the actual reflected method name, so emitters (buildAccessorKeySingle / buildAccessorKeyMany, TypeFetcherGenerator.buildRecordBasedDataFetcher) invoke by name without caring how it was selected. Restores symmetry with the scalar/result branch on the same parent shape (resolveRecordAccessor already threaded the directive value as accessorBaseName). Coverage: pipeline-tier GraphitronSchemaBuilderTest.AccessorDerivedSourceCase adds ACCESSOR_ROWKEYED_FIELD_NAME_REMAPS_ACCESSOR (admit on RemappedPayload with @field(name: "filmRecord"), asserts RecordTableField + AccessorCall.accessor().methodName() == "filmRecord" + cardinality ONE) and ACCESSOR_ROWKEYED_FIELD_NAME_REJECTS_WITHOUT_DIRECTIVE (pin the divergent-accessor-no-directive arm still falls through to the three-option AUTHOR_ERROR); RecordParentMultiTablePolymorphicPipelineTest.childInterfaceField_recordParent_accessorKeyedMany_fieldNameRemapsAccessor covers the polymorphic-hub admit (ListPayload parent, SDL field referrers with @field(name: "films"), asserts hub film + AccessorCall.methodName == "films" + cardinality MANY). New AccessorPayloads.RemappedPayload(FilmRecord filmRecord) fixture record. Out of scope (called out): renaming or restructuring @field(name:), the FK-derivation path (catalog-metadata-driven, structurally indifferent to the directive), and the three-option rejection text. Build green: full mvn -f graphitron-rewrite/pom.xml install -Plocal-db -P!docs on Java 25.

R194 (5e5f5e3 builder pass + 5 pipeline cases, a1feace self-review: EmitsPerTypeFile capability + typed CaseFoldCollision + 2 cases, f69b479 preserve CaseFoldCollision under prefixedWith): rejects case-insensitive type-name collisions at build time. GraphitronSchemaBuilder.rejectCaseInsensitiveTypeCollisions runs post-ConnectionPromoter.rebuildAssembledForConnections (rather than post-promote, so the assembled GraphQLSchema typeRefs stay resolvable when a synth Connection is demoted) and case-folds via Locale.ROOT; every member of each case-equivalent group demotes to UnclassifiedType carrying a typed Rejection.InvalidSchema.CaseFoldCollision(group, origin, prefix) with Origin ∈ {SDL, SYNTH_CONNECTION, SYNTH_EDGE, SYNTH_PAGE_INFO}. message() specialises the actionable fix hint per origin (@asConnection(connectionName:) for synth arms, generic rename for SDL); validateUnclassifiedType projects one ValidationError per member. The emit-vs-no-emit split is lifted out of GraphitronType onto a new EmitsPerTypeFile capability marker (mirrors SqlGeneratingField / BatchKeyField), implemented by every variant except ScalarType and UnclassifiedType; detector filters via instanceof EmitsPerTypeFile. prefixedWith returns a same-variant CaseFoldCollision with accumulated prefix rather than degrading to Structural, satisfying R58’s typed-rejection-preserved-under-wrap contract (the validator’s prefixedWith("Type 'X': ") is the only path that reaches ValidationError.rejection). Coverage: GraphitronSchemaBuilderTest.CaseInsensitiveTypeClashCase parameterised over 7 SDL fixtures (SDL_VS_SDL, SYNTH_VS_SYNTH, SDL_VS_SYNTH, SYNTH_EDGE_VS_SDL, SYNTH_PAGE_INFO_VS_SDL, THREE_WAY_GROUP, NO_CLASH_BASELINE); RejectionRenderingTest.prefixedWithPreservesCaseFoldCollisionTypedFields pins single + re-prefixed paths; RejectionSeverityCoverageTest + SealedHierarchyDocCoverageTest pick up the new permit; typed-rejection.adoc carries the prose + mermaid-class entry. Out of scope (called out): legacy MakeConnections / graphitron-schema-transform classifier, auto-mangling colliding names, federation cross-subgraph clashes, derived-filename collisions beyond the type-name stem. Build green: full mvn -f graphitron-rewrite/pom.xml install -Plocal-db on Java 25.

R196 (c42ed64 route Workspace recalc through listener seam): lifts "drain follows enqueue" from author-discipline at three of six Workspace public mutators (didOpen, didChange, didClose paired with explicit publishDiagnosticsForRecalculate(); setBuildOutput, demoteSnapshot, markAllForRecalculation unpaired and reachable from DevMojo.regenerate / rebuildCatalog after schema-file + classpath watcher events) to a structural invariant across all six. New private enqueueAndNotify(Runnable) helper performs the queue mutation under lock and fires a single-slot volatile Runnable recalculateListener after lock release; the six public mutators route through it (setBuildOutput / demoteSnapshot transitively via markAllForRecalculation), so toRecalculate writes only happen inside the funnel. GraphitronTextDocumentService.setClient registers this::publishDiagnosticsForRecalculate as the listener; the explicit publish calls in didOpen/didChange/didClose are gone, and the build-trigger paths now publish diagnostics on save without waiting for the next keystroke. didClose’s "clear-for-closed-file" one-shot stays, repositioned before the workspace call to keep the seam uniform (the only direct client call in the LSP service is the close-clear; everything else flows through the listener). Lock-release-before-listener-fire is deliberate: it keeps a build swap on the watcher thread and an editor event on the lsp4j thread from serialising on `lock through the heavy Diagnostics.compute body; idempotency on the drain side (a second drainRecalculate after the first empties the queue returns an empty list) makes "listener fires twice for two mutations interleaved with one drain" a no-op rather than a hazard. Tests: unit-tier WorkspaceTest.everyPublicQueueMutatingMethodFiresTheListener parametrises over the six mutators asserting listener-fire count delta of exactly 1; recalculateListenerDefaultsToNoOpForTestHarnesses pins that mutators on a workspace without setRecalculateListener do not NPE; drainRecalculateIsIdempotentOnEmptyQueue pins the single-extraction property the listener path depends on; demoteSnapshotOnNoOpDoesNotFireListener parametrises over the two no-op starting states (Unavailable, Built.Previous) pinning the only public-mutator path that returns without firing the listener ; the exception branch of the otherwise-uniform "every public mutator notifies" rule. Pipeline-tier BuildTriggerPublishesDiagnosticsTest captures publishDiagnostics calls on a stub LanguageClient and drives the three-step sequence (didOpen empty → setBuildOutput with validator error → setBuildOutput with empty report); pre-R196 the second assertion failed because the listener didn’t fire. Retires the LSP-side half of R149’s deferred end-to-end publish-diagnostics wire test (the producer-side buildOutput() report-population test stays under R149). Out of scope (called out, not regressed): multi-consumer fan-out (one consumer today; lift when a second appears); richer event shapes (sealed RecalculateEvent discriminating editor / build / demotion causes ; drain is cause-agnostic, sub-taxonomy carries no information consumers act on differently); non-DevMojo callers of markAllForRecalculation/demoteSnapshot/setBuildOutput. Build green: full mvn -f graphitron-rewrite/pom.xml install -Plocal-db on Java 25.

R197 (a755e39 wire LSP didSave to in-process regen trigger, 30473f9 In Progress → In Review): wires GraphitronTextDocumentService.didSave to a Consumer<String> onSchemaSaved listener constructor-injected via GraphitronLanguageServer and propagated through DevServer from DevMojo. DevMojo.buildSaveListener(suffixes, debounce, regen) (package-private static) filters URIs by RewriteContext.schemaFileExtensions() and schedules regenerate(workspace) through the same schemaDebounce the FS watcher uses, so editor saves and watcher events coalesce on a single regen. DebounceExecutor construction hoisted from startSchemaWatcher up into execute() so the listener can be built before bindServer. Headless LSP-only use sites (standalone Launcher, existing TextDocumentServiceTest fixtures) keep their behaviour via no-arg / one-arg constructor defaults that pass a no-op Consumer. Workspace is unchanged: the seam lives at the language-server boundary, not in the workspace, so extension-set ownership stays in the Mojo and the LSP module remains suffix-agnostic. Tests: TextDocumentServiceTest.didSave_invokesListenerWithUri pins the URI-typed listener contract, didSave_noopWhenListenerAbsent pins the headless contract, DevMojoTest.saveListener_schemaSuffixSchedulesRegen covers the suffix filter and debounce scheduling. Docs: getting-started.adoc dev-loop prose calls out the dual-path model (LSP didSave primary, FS watcher headless fallback) and the Mermaid diagram gains the LSP didSave → dispatch arrow; DevMojo class-level javadoc updated to match. Out of scope (called out, not regressed): didChange regen (save is the user’s intentional commit point; mid-typing buffers are partial SDL); replacing SchemaWatcher (stays as headless fallback and remains the only path for classpath watching); FSEvents native backend (deferred under R198’s out-of-scope list). Build green: full mvn -f graphitron-rewrite/pom.xml install -Plocal-db on Java 25.

R198 (b39d1c5 lift SchemaWatcher FS-bound tests to synthetic dispatch, e10785c self-review: package-private dispatch + run()-time polling hint): lifts the five SchemaWatcherTest cases that depended on real-FS event delivery (modifyingGraphqlsFile_firesCallback, deletingGraphqlsFile_firesCallback, rapidWrites_firesCallbackOnce, newSubdirectory_isRegisteredAndFiresCallback, and one CatalogRefreshTest case) onto synthetic WatchEvent values driven directly into SchemaWatcher.dispatch. macOS’s JDK ships PollingWatchService with a hardcoded 10 s period (since SensitivityWatchEventModifier was removed in JDK 21), so the suite’s 1.6 s wait could never observe a real-FS event; the assertions the failing tests made were unit-tier invariants on dispatch (suffix filter, OVERFLOW reschedule, on-the-fly subdirectory registration) dressed up as integration tests of the JDK’s WatchService. writingGraphqlsFile_firesCallback survives as the Linux-only inotify smoke (@EnabledOnOs(LINUX)); nonGraphqlsFile_noCallback deleted as a duplicate of dispatch_ignoresUnconfiguredSuffix; graphqlsWriteDoesNotFireClasspathWatcher folded into the synthetic shape. New watchServiceBackend_matchesExpectedPerOs probe pins PollingWatchService on macOS and LinuxWatchService on Linux, so a future JDK shipping an FSEvents-backed WatchService would fail loudly and the Linux-only gate would get revisited. Runtime hint on the first iteration of SchemaWatcher.run() emits two LOGGER.info lines when the underlying WatchService is polling-based (JDK fact + LSP recommendation as separate lines so either can be revised independently); fires once per watcher lifetime in production, silent in synthetic-dispatch tests. SchemaWatcher.dispatch stays package-private; the lone cross-package consumer (CatalogRefreshTest in ..maven.dev) routes through a new test-only DispatchTestSupport class under src/test/java/…​/maven/watch/, matching the existing watchedDirs() test-seam precedent. Test counts: SchemaWatcherTest 11→11, CatalogRefreshTest 2→2. Out of scope (called out, not regressed): swapping the WatchService backend to a native FSEvents library (would add JNA to the plugin’s classpath; size separately); the LSP-driven regen path itself (R197); Linux aarch64 / Windows verification (R89). Build green: full mvn -f graphitron-rewrite/pom.xml install -Plocal-db on Java 25.

R189 (666f0fb admit FK-target @nodeId input fields on @mutation, 9524885 In Progress → In Review): admit InputField.ColumnReferenceField / CompositeColumnReferenceField (FK-target @nodeId(typeName: T) pointing at another @table’s NodeType, classified to `Resolved.FkTarget.DirectFk) on every non-UPSERT @mutation verb. The reference carriers' liftedSourceColumns live on the input’s own table, the extraction is narrowed to CallSiteExtraction.NodeIdDecodeKeys, and the emitters bind decoded keys against liftedSourceColumns positionally ; the same shape the same-table ColumnField / CompositeColumnField NodeId carriers already drive. MutationInputResolver.resolveInput drops the deferred R24 rejection for these two carriers on INSERT / UPDATE / DELETE and removes the misleading "tracked in R24’s scope" hand-off; UPSERT stays refused at the kind gate (R145). InputField.LookupKeyField and InputField.SetField widen permits to include both reference carriers. Load-bearing: EnumMappingResolver.buildLookupBindings adds case ColumnReferenceField / case CompositeColumnReferenceField arms emitting MapGroup / DecodedRecordGroup over liftedSourceColumns(); without this the mutation-input.where-columns-cover-pk check would silently under-count reference contributions and fire false "missing PK column" rejections on schemas whose FK column covers the PK. TypeFetcherGenerator extracts five new helpers (emitSetMapPuts, emitSetExcludedPuts, emitSetVColNameAdds, emitSetBulkCellAdds, emitSetVFieldPuts plus setFieldColumns / setFieldNodeIdExtraction dispatchers) that replace eight (InputField.ColumnField) sf casts over tia.setFields() across the UPDATE / UPSERT-SET / bulk-UPDATE paths; the INSERT-path helpers (anyNodeIdCarrier, buildInsertColumnList, buildPerCellValueList, buildInsertDecodeLocals) widen their carrier-shape switches with mirroring reference arms. Three @LoadBearingClassifierCheck annotations are restated: mutation-input.where-columns-cover-pk (semantic ; filter-column contributions now include liftedSourceColumns() from the two reference carriers), mutation-input.update-set-fields-equal-value-marked (wording ; admissible-carrier set widened), mutation-input.lookup-binding-decoded-record-arity-matches-carrier-columns (wording ; arity guarantee extended to the FK-target composite arm). Tests: pipeline-tier MutationDmlNodeIdClassificationTest adds eight R189 cases ; arity-1 INSERT admission, arity-1 DELETE PK-coverage, arity-1 UPDATE with @value SET field, composite-key DELETE through reordered_pk_parent / reordered_fk_child, composite-key INSERT, and three bracketing rejection cases: fkTargetNodeIdRef_pkCoverage_underCount_negativeRejectionFixture (the load-bearing assertion that pins the validator widening ; without step 4 this exact shape would fire a false "missing: id_1" rejection that slips past both compilation and execution tiers), fkTargetNodeIdRef_pkCoverage_genuinelyMissing_rejected (contrast fixture confirming the canonical missing-PK rejection still fires), and fkTargetNodeIdRef_upsert_stillRejected_underR144 (UPSERT refusal at the kind gate supersedes admission). Out of scope (called out, not regressed): Resolved.FkTarget.TranslatedFk admission (the parent_node + child_ref shape where the FK targets a non-PK NodeType keyColumn ; BuildContext.java:1846-1849 continues to produce InputFieldResolution.Unresolved); UPSERT (R145 territory); the output-side JOIN-with-projection NodeId encoding R24 originally hand-off pointed at. Build green: full mvn -f graphitron-rewrite/pom.xml install -Plocal-db on Java 25.

R187 (8e70b8c In Review: nested @service arg-mismatch diagnostic at non-SOURCES shapes): the unresolved-@service-parameter discriminator in ServiceCatalog now selects the arg-mismatch arm whenever the parameter type is not SOURCES-adjacent, instead of gating that arm on parentPkColumns.isEmpty(). Nested fields with a non-container parameter (LocalDate, String, Integer, …​) whose name doesn’t match any GraphQL argument no longer fall through to "unrecognized sources type" ; they get the actionable "does not match any GraphQL argument or context key" hint with available args + argMapping suggestion. The DTO-shape rejection arm is gated to nested coordinates only (!parentPkColumns.isEmpty()), preserving the root + List<DTO> → arg-mismatch precedence pinned by dtoSources_onRootField_pointsAtArgCtxMismatch (this is the Spec’s "Precedence between DTO-hint and arg-mismatch" rule; the implementation deviates from Spec step-3’s literal wording, which would have moved the DTO arm up unconditionally and broken that test, but matches the Spec’s stated intent). Unit-tier ServiceCatalogTest rewrites reflectServiceMethod_unrecognisedParam_onChildField_* (now asserts arg-mismatch on getWithUnknown(Object) under non-empty parentPkColumns) and adds reflectServiceMethod_nonSourcesPayloadOnChildField_pointsAtArgCtxMismatch pinning the LocalDate reproduction. Pipeline-tier GraphitronSchemaBuilderTest adds SERVICE_ON_CHILD_WITH_NON_SOURCES_PARAM_NAME_MISMATCH_REJECTED alongside the existing root-coordinate rejection case. Follow-up R193 (Backlog) captures the architectural smell flagged by the principles-architect review: the discriminator now has two consumers (R185 + R187) with subtly different precedence; a sealed UnresolvedParam classifier would consolidate the precedence in one place.

R185 (b6539b9): narrow ServiceCatalog.looksLikeSourcesShape to List<RowN> / List<RecordN> only. A root @service whose Java parameter is a List<XRecord> (a concrete TableRecord subtype) under a name that doesn’t match any GraphQL argument was getting the "`@service` at the root does not support List<Row>/List<Record>/List<Object> batch parameters" diagnostic, shadowing the actionable arg-mismatch diagnostic that lists available argument names and suggests argMapping. List<XRecord> at root is the canonical InputBeanResolver shape, so a plain name typo collided with the Sources-shape exception. The concrete TableRecord branch is removed from looksLikeSourcesShape; only the two anonymous-key shapes (RowN, RecordN) keep producing the Sources-batch diagnostic. The user-visible diagnostic also drops /List<Object> to match what now triggers it. Pipeline-tier SERVICE_AT_ROOT_WITH_TABLERECORD_PARAM_NAME_MISMATCH_REJECTED (GraphitronSchemaBuilderTest) asserts the arg-mismatch diagnostic wins for List<FilmRecord> under a mismatched name; the two existing RowN-element cases (SERVICE_AT_ROOT_WITH_SOURCES_PARAM_REJECTED, MUTATION_SERVICE_WITH_SOURCES_PARAM_REJECTED) keep passing and lock the predicate against opposite regression.

R183 (3ccd1ea GitLab pipeline targets graphitron-rewrite reactor on tags, bf5d2c3 provision postgres service + run codegen + tests in publish, 40790fc apt-get gcc so graphitron-lsp’s native build works, 236860f parameterize test.db.url so CLI -D reaches surefire, dcdf0d2 self-review cleanups before re-handoff): replaces the legacy reactor’s snapshot-on-default-branch + release-on-tag publish pipeline with a release-only pipeline targeting the rewrite reactor. publish:snapshot is deleted outright; default-branch pushes (including GitHub → GitLab mirror sync) no longer fire any deploy, eliminating the active hazard of legacy 9-gitlab-SNAPSHOT artifacts accumulating in the Sikt GitLab Packages registry on every mirrored commit. publish:release now runs mvn -f graphitron-rewrite/pom.xml versions:set -DnewVersion=$VERSION -DgenerateBackupPoms=false -DprocessAllModules=true (the processAllModules flag is load-bearing: without it the aggregator pom updates but child modules keep ${revision} and the deploy publishes mismatched coordinates) followed by mvn -f graphitron-rewrite/pom.xml clean deploy -P gitlab,local-db -Ddb.url=jdbc:postgresql://postgres:5432/rewrite_test -Dtest.db.url=jdbc:postgresql://postgres:5432/rewrite_test. The tag regex widens to ^v\d+\.\d+\.\d+(-RC\d+)?$ to accept the -RC<n> suffix Maven Central consumers depend on. A new gitlab profile in graphitron-rewrite/pom.xml declares the GitLab Packages <repository> (no <snapshotRepository> ; the rewrite parent’s invariant per graphitron-rewrite/docs/README.adoc Publishing: an accidental mvn deploy on 10-SNAPSHOT must fail fast) plus deployAtEnd=true and the sources-jar attachment; the root-pom legacy gitlab profile is unreachable from the new caller and dies with the legacy reactor under R182. The pipeline image bumps from maven:3.9-eclipse-temurin-21 to maven:3.9-eclipse-temurin-25 to satisfy the parent pom’s requireJavaVersion enforcer rule. In-runner Postgres: publish:release provisions a postgres:18-alpine service (alias postgres, POSTGRES_HOST_AUTH_METHOD=trust), apt-get install`s `postgresql-client + gcc in the runner, and applies graphitron-rewrite/graphitron-sakila-db/src/main/resources/init.sql via psql. The local-db profile is activated alongside gitlab so jOOQ codegen reads against the live service rather than spinning up a Testcontainer (no Docker-in-Docker). The gcc install covers graphitron-lsp’s `build-native.sh invocation at generate-resources that compiles the tree-sitter native lib bundled into the published graphitron-lsp jar at lib/linux-x86_64/libtree-sitter-graphql.so. Surefire parameterisation: graphitron-sakila-example’s `local-db profile lifts test.db.url / test.db.username / test.db.password from literal <systemPropertyVariables> entries into pom <properties> (localhost defaults unchanged for local devs) so CLI -Dtest.db.url=…​ overrides reach surefire’s fork via property interpolation; without this, the CI’s overrides reached jOOQ codegen but the tests still tried localhost. Tests run in the publish pipeline as a deploy-boundary sanity check now that a real Postgres is in the runner anyway; the earlier "skip tests, GitHub gates them" rationale was load-bearing only when Docker-in-Docker was the alternative, and the GitHub publish workflow on main is itself in flux per R182 so cannot be relied on as a gate. Out of scope (called out, not regressed): retiring the legacy reactor or the root-pom gitlab profile (R182 collapses both); Maven Central publishing on main (separate fix once R182 retires the legacy reactor; this item only touches GitLab); cleanup of existing junk 9-gitlab-SNAPSHOT artifacts already deposited (manual GitLab UI task); a release-cli job creating a GitLab Release object attached to the tag (cosmetic ; consumers depend by Maven coordinate). Verification deferred to a throwaway-tag push (e.g. v10.0.0-RC0) confirming the five expected coordinates deploy to GitLab Packages (no.sikt:graphitron-rewrite-parent pom, no.sikt:graphitron-javapoet, no.sikt:graphitron, no.sikt:graphitron-maven-plugin, no.sikt:graphitron-lsp) while the six maven.deploy.skip=true modules stay out of the registry, and a default-branch push triggers no publish job. Build green locally: full mvn -f graphitron-rewrite/pom.xml install -Plocal-db on Java 25 with the local-db profile pointing at a native Postgres.

R178 (9ee35d9 step 1 DML-only cutover, e41ddb4 step 2a wire transportForParent through selectErrorsTransport, 64dfa33 step 2b @service-carrier classifier wiring, fe270f9 step 3 retire SettKvotesporsmal-bug carrier-walk consultations, c44193b Phase 4 slice 1 delete dead writers, 7cbe4b6 slice 2 retire transitional consultations, 1211e6d slice 3 non-DELETE structural detection, e665e11 slice 4 DELETE arm structural detection, 1e71906 slice 5 lift structural carrier scan to BuildContext, d0de975 slice 6 retire verbless walk’s carrier-walk consultation, 475e2ec slice 7a retire carrier-walk methods + load-bearing re-anchors, a1bbbcd slice 7b retire sealed model types, e06f1c8 slice 7c retire SingleRecordIdentityField permit, 83d2182 slice 7d cosmetic, 4a67b26 self-review cleanup, 1ddb22b rename "Carrier" identifiers to "Payload", f42b819 final self-review, 575cd9b In Progress → In Review): collapses the parallel single-record carrier walk to the unified SourceKey + R96 reflection path. Deletes seven sealed hierarchies (SingleRecordCarrierResolution, SingleRecordCarrierShape, CarrierFieldRole, DataElement, BuildContext.tryResolveSingleRecordCarrier overloads + classifyCarrierField, BuildContext.carrierProducerRegistry, the four register*CarrierDataField writers, ChildField.SingleRecordIdentityField) and three load-bearing keys (single-record-carrier-shape.roles-exhaustively-classified, carrier-data-field.single-producer-kind, carrier-data-field.service-producer-strict-return). Adds two sibling ProducerBinding arms (DmlEmitted(TableRef, DmlKind, Cardinality), ServiceEmitted(TableRef, Cardinality, producer-site)) grounded by R96 in dedicated memos, observed structurally on the payload SDL so the carrier walk’s forbidden-directives loop never fires at observation time (the SettKvotesporsmal bug’s mechanism). A builder-internal sealed result BuildContext.DmlPayloadScan (Admit(dataField, DmlElementKind) | Reject(reason) | NotApplicable) replaces the carrier walk for the @mutation classifier and MutationInputResolver. The @field directive on a non-$source payload data field no longer hard-rejects ; the SettKvotesporsmal contract pin: with and without @field(name:), semantically identical schemas classify identically. The mutation-dml-record-field.data-table-equals-input-table invariant re-anchors on the smaller requireDmlDataTableMatchesInputTable helper covering both DELETE and non-DELETE arms; the error-channel.local-context-transport invariant re-anchors on FieldBuilder.detectStructuralDmlErrorChannel (the new sole producer of ErrorChannel.LocalContext on DML payloads). The unit-tier ErrorsTransportSelectionTest pins the errors-field defaulting rule table; the pipeline-tier SettKvotesporsmalShapeRegressionTest pins both the identical-classification and the diagnostic-wording contracts. The three payload-returning mutation permits (MutationDmlRecordField, MutationBulkDmlRecordField, MutationServiceRecordField) survive structurally; what changes is their classification path. Tests: unit-tier ErrorsTransportSelectionTest (8 cases pinning every branch of FieldBuilder.selectErrorsTransport); pipeline-tier SettKvotesporsmalShapeRegressionTest (3 cases: with-@field admits, without-@field admits identically, ClassBacked return-mismatch diagnostic cites the payload class not the inner record); pipeline-tier SingleRecordPayloadPipelineTest (renamed from SingleRecordCarrierPipelineTest, 33 cases including R178 admits of @field and @deprecated on the data field); execution-tier SingleRecordPayloadDmlTest (renamed, durability pins intact); the MUTATION_DML_RECORD_FIELD / MUTATION_BULK_DML_RECORD_FIELD / DELETE-carrier / SINGLE_RECORD_IDENTITY_FIELD_ORPHAN rows in GraphitronSchemaBuilderTest retarget to the unified path. Phase 5 deferral (called out in spec, separable follow-up): the emit-side migration to Wrap.Row + Reader.ColumnRead ships under R180 (record-parent-column-read-helper); Phase 5 survivors (ChildField.SingleRecordTableField, FromReturning, Reader.ResultRowWalk, the five FetcherEmitter.buildSingleRecord methods, three remaining load-bearing keys) stay alive on the producer side until R180 lifts them. Out of scope (called out, not regressed): RecordBindingResolver walk reshape (R178 adds one new producer arm but does not change the resolver’s model), R156’s NodeId encoder chain, two-step DML emit shape, wire-format serialization, the @table-parent child-classification path. Build green: full mvn -f graphitron-rewrite/pom.xml install -Plocal-db on Java 25.

R184 (05e21d5 Graphitron.newExecutionInput factory + getContextArgument default, 5d308c2 In Progress → In Review): collapses the two pieces of per-request boilerplate every graphitron app repeats (.graphQLContext(b → b.put(GraphitronContext.class, ctx)) to thread the typed context key generated fetchers look up, plus .dataLoaderRegistry(new DataLoaderRegistry()) to satisfy graphql-java’s always-required registry) into a single generated factory entry point on the emitted Graphitron facade. GraphitronFacadeGenerator now emits two static newExecutionInput overloads alongside buildSchema: newExecutionInput(GraphitronContext context) returns ExecutionInput.newExecutionInput().graphQLContext(b → b.put(GraphitronContext.class, context)).dataLoaderRegistry(new DataLoaderRegistry()), and the single-tenant convenience newExecutionInput(DSLContext dsl) delegates to newExecutionInputGraphitronContext) env → dsl). To make the lambda form bind to GraphitronContext’s SAM rather than infer as `Function<DataFetchingEnvironment, DSLContext>, GraphitronContextInterfaceGenerator flips getContextArgument from ABSTRACT to DEFAULT with body return env.getGraphQlContext().get(name); (matching the legacy DefaultGraphitronContext); getDslContext is now the only abstract method on the interface. The interface is deliberately not annotated @FunctionalInterface (a permanent contract that would block ever adding another abstract method); instead a pipeline-tier test pins the count of abstract methods to one, so any future generator change that adds a second abstract method fails the test in tandem with the sakila example’s compile of the lambda form. Tests: pipeline-tier GraphitronFacadeGeneratorTest asserts the two newExecutionInput overloads exist with (GraphitronContext) and (DSLContext) parameter lists, both returning graphql.ExecutionInput.Builder, both public static; pipeline-tier GraphitronContextInterfaceGeneratorTest asserts getContextArgument carries DEFAULT (not ABSTRACT) with the right body and that the emitted interface has exactly one abstract method; compilation-tier NewExecutionInputFactoryTest in graphitron-sakila-example pins three graphql-java contract facts (.dataLoaderRegistry(custom) replaces the factory’s fresh registry rather than merging ; exercises the user-visible override path; the (DSLContext) overload defaults to an empty registry; the (GraphitronContext) overload places the context under the typed GraphitronContext.class key generated fetchers read from). Execution coverage comes from the sakila example’s rewritten GraphqlResource.execute: the six-line builder collapses to three via Graphitron.newExecutionInput(new AppContext(…​, and every existing execution test in graphitron-sakila-example runs through that method. Docs updated to point at the factory (getting-started.adoc hello-world + multi-tenant + DataLoader-registry sections; runtime-extension-points.adoc registration snippet; emitted facade + interface javadocs). Out of scope (called out, not regressed): no federation overload of newExecutionInput (ExecutionInput carries no federation-specific wiring; the same factory serves both schema flavours); no change to DataLoader registration mechanics (generated fetchers continue to populate the registry lazily via computeIfAbsent); no new module, no change to dependency graph; getTenantId and getValidator defaults unchanged (they were already default-method shaped). Build green: full mvn -f graphitron-rewrite/pom.xml install -Plocal-db on Java 25.

R179 (ef0af6c delete ResultAssembly; service success arm is universal passthrough, a3bde69 self-review cleanup: retire stale ResultReturnType coverage claim): deletes the ResultAssembly + ResultSlot model types, the resolveServiceResultAssembly + buildResultAssemblyBeanArm classifier in FieldBuilder, and the buildSuccessPayload / buildSuccessPayloadCtor / buildSuccessPayloadSetters emit helpers in TypeFetcherGenerator. The success arm collapses to a single universal-passthrough body: T result = service.method(…​); return success(result);. The architectural constraint the deletion enforces is that the generator does not construct output DTOs on the happy path: per-field wiring (graphql-java child fetchers) projects SDL fields off the parent’s domain return, and a SDL-declared CreateFilmPayload { film: Film, errors: [Error] } does not need a Java twin. The catch-arm payloadFactoryLambda is the only remaining DTO-construction site, and the boundary is structural ; error-routed lists are produced inside the generator-owned try block where per-field wiring has no parent value to project from. The four service-backed Field records (Query/Mutation × Table/Record) lose their trailing Optional<ResultAssembly> resultAssembly component; the four arms in classifyQueryField / classifyMutationField route through buildServiceField, whose BiFunction<channel, assembly, …​> collapses to Function<channel, …​>. A new surviving classifier check (checkServiceReturnMatchesPayload in FieldBuilder) replaces the three Assembly-specific reject messages with the single legacy-passthrough wording: "@service method '<cls>.<method>' must return '<sdlPayloadTypeName>' to match the field’s declared payload type ; got '<method.returnType()>'". Stale-doc cleanup spans 12 sites (FieldBuilder LoadBearingClassifierCheck descriptions ×2 + ServiceCatalog.reflectServiceMethod description retired ResultReturnType coverage claim, FieldBuilder javadoc ×4, model-class javadocs on DefaultedSlot / PayloadConstructionShape / NonBoundSetter / ErrorsSlot, ServiceDirectiveResolver / MutationInputResolver ResultReturnType arm comments, SettKvotesporsmalShapeRegressionTest + TestServiceStub javadoc). R169 (service-domain-object-execute-coverage, Backlog) deletes in the same commit per workflow.adoc’s "supersession before shipping" Discarded pattern: its entire scope was execute-tier coverage for the now-deleted Assembly arm. One fixture addition beyond the spec’s enumeration: TestServiceStub.runSakWithInputBean(TestInputBean) returning SakPayload, replacing the String-returning stub that the pre-existing FetcherPipelineTest.inputRecord_validatorPreStep_* test had relied on the Assembly arm to admit; the new stub preserves the test’s intent (validator pre-step on Input-typed arg with VALIDATION-bearing channel) without losing the R150 input-bean classification dimension. LoadBearingGuaranteeAuditTest net stays balanced: both payload-construction. producers retain surviving consumers (catch-arm payloadFactoryLambda + validator pre-step declareEarlyPayloadFromErrors / declareEarlyPayloadSetters); no producer becomes orphaned. *Out of scope (called out, not regressed): inlining the success-arm local (kept for catch-arm try-block uniformity); redesigning the catch-arm payloadFactoryLambda path (the only remaining DTO-construction site, principled and unchanged). Build green: full mvn -f graphitron-rewrite/pom.xml install -Plocal-db on Java 25.

R177 (1aba97f child @service rows-method preserves specific XRecord type, de5ed05 self-review: name the third consumer in RowsMethodShape class doc): narrows the child-@service emit site so the rows-method’s V and the matching DataLoader<K, V> value type both honor the TableBoundReturnType classifier guarantee instead of widening to raw org.jooq.Record. RowsMethodShape.strictPerKeyType returns tb.table().recordClass() for the TableBoundReturnType arm (was: a RECORD constant, now deleted); TypeFetcherGenerator’s `ChildField.ServiceTableField arm threads stf.returnType().table().recordClass() as the single servicePerKeyType local into both buildServiceDataFetcher (the DataLoader<K, V> typing line) and buildServiceRowsMethod (the Map<K, V> / List<V> return-type line), so the typed loader populates from the rows-method without a wildcard or defensive cast. ServiceDirectiveResolver.validateChildServiceReturnType’s `@LoadBearingClassifierCheck description is rewritten to name both emit-site consumers explicitly (rows-method .returns(…​) and the typed DataLoader<K, V>), capturing that the strict TypeName.equals arm is now load-bearing for the typed loader’s compile via Java generics invariance ; not just structural symmetry; a new @DependsOnClassifierCheck on buildServiceDataFetcher pins the data-fetcher side to the same key, and the existing annotation on buildServiceRowsMethod is updated to reflect the narrower V. RowsMethodShape’s class-level docstring lifts the consumer count from two to three and names the DataLoader-typing line with the Java-generics-invariance reason. The diagnostic wording on the validator’s strict-return rejection shifts from `must return 'List<Record>' to must return 'List<LanguageRecord>' (the specific record class for the field’s bound table). Tests: six ServiceTableField unit assertions in TypeFetcherGeneratorTest flip from org.jooq.Record to the specific FilmRecord (positional + mapped, single + list, on both data-fetcher and rows-method return); three new R177-axis enum rows in GraphitronSchemaBuilderTest paired with three new fixtures in TestServiceStub cover the migration arm (List<List<Record>> was accepted, now rejected), acceptance arm (List<List<LanguageRecord>> was rejected, now accepted), and cross-record regression (List<List<FilmRecord>> stays rejected); CHILD_SERVICE_TABLE_BOUND_WRONG_RETURN_REJECTED’s diagnostic assertion updated to the narrowed wording; pipeline-tier `TestFilmService.getFilms tightened to List<List<FilmRecord>> with the paired pipeline assertion flipped; new positive compile-tier fixture Film.languageByService in graphitron-sakila-example backed by FilmService.languageByService returning Map<Record1<Integer>, LanguageRecord> makes mvn compile -pl :graphitron-sakila-example the load-bearing guarantee against future re-widening of the emit site. Out of scope (per spec, not regressed): ChildField.ServiceRecordField’s `elementType() fallback path (the asymmetry is principled ; ServiceRecordField carries the broad ReturnTypeRef sealed root rather than TableBoundReturnType, and strictPerKeyType can return null for that variant); the SourceKey.Wrap.TableRecord source-side typing pipeline (R177 brings the target side into alignment with what the source side already does); the rows-method’s outer container shape (Map vs List, single vs list cardinality ; outerRowsReturnType continues to wrap whatever perKey it’s handed); SplitRowsMethodEmitter (the ChildField.SplitTableField arm stays raw Record, explicit non-goal). Build green: full mvn -f graphitron-rewrite/pom.xml install -Plocal-db on Java 25.