Sunrisepeak · Oct 9, 2026 · Oct 9, 2026 · Oct 9, 2026 · Oct 9, 2026 · Oct 9, 2026
diff --git a/.agents/docs/2026-10-06-mcppls-clangd-plan.md b/.agents/docs/2026-10-06-mcppls-clangd-plan.md
@@ -1,5 +1,7 @@
 # mcppls-clangd: overall plan and architecture (v1, for review)
 
+> 2026-10-07 review update: the [joint 0.0.12 release contract](2026-10-07-joint-0.0.12-release-plan.md) supersedes this draft's release sequencing and unproven cache/performance assumptions. Current patches are not release-ready. Correctness, root-cause evidence and four-platform product acceptance are mandatory; general mcppls containment is retained.
+
 2026-10-06. First PR. Everything here is a proposal to review — nothing is
 built yet.
 

diff --git a/.agents/docs/2026-10-06-up25-completion-latency-plan.md b/.agents/docs/2026-10-06-up25-completion-latency-plan.md
@@ -1,5 +1,7 @@
 # UP-25 completion latency: root-cause layers and the fix plan (for review)
 
+> 2026-10-07 review update: see the [joint release contract](2026-10-07-joint-0.0.12-release-plan.md). The implemented 0006 loses member semantics and the candidate fails module-export update C7. Its latency is not proof of a valid fix. S2-B below is an unproven design candidate, not a guaranteed durable fix or delivery estimate; scope/visibility, templates, invalidation and serialization must be proved before adoption.
+
 2026-10-06. Companion to [2026-10-06-clangd-fix-register-plan.md](2026-10-06-clangd-fix-register-plan.md)
 §2.5 (measurements) and the PR1 plan §7. This document commits to actually
 closing the remaining gap — "module-project completion at header-project

diff --git a/.agents/docs/2026-10-06-windows-crash-plan.md b/.agents/docs/2026-10-06-windows-crash-plan.md
@@ -1,5 +1,7 @@
 # UP-12/13/20 Windows crashes: from "no stack" to fixes (for review)
 
+> 2026-10-07 review update: [joint release contract](2026-10-07-joint-0.0.12-release-plan.md) controls acceptance. UP-20 has Linux observations and is not established as Windows-only. The corpus is currently empty and the nonempty workflow branch does not replay entries, so its green result is not crash-fix evidence.
+
 2026-10-06. Companion to the fix-register plan. These three rows are the
 crash class mcppls keeps containing on the outside:
 
@@ -12,8 +14,8 @@ crash class mcppls keeps containing on the outside:
   partial stack may already exist for this one.
 
 This plan turns the fork's Windows builds from "packaging target" into the
-crash-analysis instrument, then fixes each crash at its root and retires the
-mcppls-side containment.
+crash-analysis instrument, then fixes each crash at its root. Feature-specific
+workarounds may retire after direct canaries; general mcppls containment stays.
 
 ## 1. Why no stack exists today (three separate gaps)
 
@@ -58,13 +60,14 @@ New job `win-crash-corpus` (windows-2022):
    while any corpus entry still crashes (that failing state IS the row's
    status).
 
-### C2 — the fork crash handler (1–2 days, carried patch 0006, Windows-only)
+### C2 — the fork crash handler (carried patch 0007, Windows-only)
 
 `PrintStackTrace` exists but shows nothing without symbols and catches only
 LLVM's registered signals. Add an SEH-based last-chance handler around clangd's
 main and the worker-thread entry: `__try/__except` → `MiniDumpWriteDump` into a
-flag-gated directory (`--crash-dumps-dir=`, default off upstream-side; mcppls
-enables it for its bundled builds) → process continues to terminate. Effects:
+flag-gated directory (`--crash-dumps-dir=`, default off; mcppls enables it only
+with explicit user opt-in and a dump size/count/retention budget) → process
+continues to terminate. This is capture infrastructure, not a crash fix. Effects:
 
 - every future field crash on Windows yields a .dmp analyzable with the public
   PDBs — UP-13's "prints none" blocker disappears **at the source**;
@@ -80,15 +83,16 @@ Working hypotheses to confirm/refute with the first stacks:
 |---|---|---|
 | UP-12 | null deref downstream of a failed prerequisite build (unresolved import path returns `FailedPrerequisiteModules` and a consumer assumes success), or clang modules code hitting an unimplemented Windows path | guard + diagnostic at the clangd module-builder boundary (upstreamable), else clang fix per stack |
 | UP-13 | same family as UP-12 with correct commands — points at clang core (serialization/Sema) on Windows; stack decides | clang fix per stack |
-| UP-20 | **stack overflow** is the prime suspect: a crash *loop* on rapid saves of one generated file smells like recursive parse/instantiation blowing the worker stack, then mcppls restarting into the same file. Also verify content: `mcpp.manifest.types` fan-out may present pathological macro/initializer depth | (a) raise clangd worker-thread stack (Linux default 8 MB; verify what the Windows threads get and set 32–64 MB in the fork), (b) recursion guard if a specific recursion shows, (c) upstream the stack-size finding |
+| UP-20 | unknown until symbolized stacks and a reduced fan-out save sequence exist; investigate lifetime/races, dependency failure and recursion based on evidence | fix the demonstrated cause; no blanket 32–64 MB worker-stack increase without a measured stack-exhaustion diagnosis and regression/resource tests |
 
 ### C4 — acceptance and retirement
 
-- `win-crash-corpus` green = every corpus entry survives (no crash, no hang)
+- `win-crash-corpus` green requires a nonempty real corpus, actual execution of every entry and usable matching symbols; every corpus entry survives (no crash, no hang)
   on the fork build; loop scenarios (UP-20) run 1000 iterations.
-- mcppls retires the corresponding containment (`-c` avoidance for UP-12,
-  backoff/bundle for UP-20) once the fix ships in a bundled fork; register
-  rows close with the stacks, repros, and fixes linked.
+- mcppls retires only a proven feature-specific workaround after its raw
+  canary and bundled-product tests pass. Correct `-c` compile commands and
+  general watchdog/backoff/isolation/bundle remain; external upstream clangd
+  keeps applicable protection. Register rows close with stacks, repros and fixes.
 - Every fix upstreamed (crashes in clang modules on Windows are upstream's
   bugs as much as ours); carried only until the upstream fix lands in a base
   we bump to.

diff --git a/.agents/docs/2026-10-07-joint-0.0.12-release-plan.md b/.agents/docs/2026-10-07-joint-0.0.12-release-plan.md
@@ -0,0 +1,39 @@
+# mcppls-clangd：联动 mcppls 0.0.12 的 release 契约
+
+状态：2026-10-07，供 review，未实施。联合主方案位于兄弟仓库 [mcppls 0.0.12 joint release plan](../../../mcpp-language-server/.agents/docs/2026-10-07-0.0.12-joint-release-plan.md)，实测依据见 [维护版接入分析](../../../mcpp-language-server/.agents/docs/2026-10-07-maintained-clangd-0.0.12-plan.md)。这些是本地 review 链接；提交到各自 GitHub 后需改为对应不可变 commit 链接，不假称本地文档已发布。
+
+## 1. 本仓交付边界
+
+fork 修复 Clang/clangd 内部根因；mcppls 修复编译器画像、项目/CDB同步、调度/失效和打包。产品 workaround 是 containment，不自动代表引擎问题 fixed。默认启用引擎目标 `23.1.0-mcppls.1`，当前 `.0` 不具备发布资格。
+
+当前阻断：0006 的成员补全污染；产品 inferred C7 模块导出更新180 s超时；raw import hang；const view patch 过宽且仍有假阳性；Windows真实corpus为空/未实现重放；平台构建与recipe不一致；现有bench缺语义断言；release未依赖全部验收。根因仍需逐个定位，不能直接按既有计划登记 steady。
+
+## 2. 与主方案的工作包映射
+
+| 主方案包 | 本仓交付与验收 |
+|---|---|
+| W1 | 修正0006当前行识别与作用域/Sema选择；补全quality断言；隔离0002/0006与C7；trace驱动优化，不靠返回任意全局符号 |
+| W2 | memo可靠失效、provider/CDB查询缓存、扫描复用；失败传播安全后才并行模块DAG，设置CPU/内存并发上限 |
+| W3 | UP-01/02/10 raw复现；锁顺序、取消、didClose、worker生命周期；已复现hang必须根因修复 |
+| W4 | UP-12/13/20符号栈与非空真实corpus/replay；UP-18 owner可靠性；UP-24 crash后copy-on-read回收且活跃BMI安全 |
+| W5 | UP-05 backport、UP-09合法range、UP-15诊断位置、UP-22准确检查；lit覆盖全部新增patch，不仅现有六项 |
+| W6 | mcpp style能力及合法位置的GNU/Clang属性、Windows SEH补全；目标编译器验证，不做无上下文词典注入 |
+| W7 | LLVM resolved SHA、完整fork identity/patch digest、四平台portable包、license/资源与SHA256SUMS；两版本轴与产品kit协调 |
+| W8 | release-mode steady gate、7次有效nightly、语义bench/soak/corpus/portability全部通过才产出可晋升artifact |
+
+## 3. 更正旧设计的强假设
+
+- UP-25：index-only仅在被证明语义完备的上下文启用；关闭当前错误路径只是止损。BMI completion tables属于需要证明的设计候选，不能预先称“2–4周必然完成的durable fix”；Decl/ASTContext不能跨实例直接共享。
+- UP-13：0007 `--crash-dumps-dir` 是取证能力，不是crash修复；产品须按明确opt-in启用并限制敏感dump，Windows PDB必须验证实际可符号化。
+- UP-20：不要把未经证实的stack overflow当首要结论并统一增大栈；先取栈/reduce。Linux观察到的fan-out crash不能自动划成Windows问题。
+- Windows CI：非空manifest必须真实执行；空corpus、找不到debugger、没有匹配PDB都不能作为绿色crash gate。
+- workaround retirement：正确的`-c`编译命令和通用backoff/watchdog/隔离/bundle不移除；仅已证明对应raw canary通过的特定feature保护退休，原版引擎保留保护。
+- 配方是可验证承诺：Linux20.04/glibc2.31、Windows CRT策略、macOS deployment target需要真实构建与最低OS运行验证；不可仅写recipe而runner仍用不同下限。
+
+## 4. 发布共同门槛
+
+联合主方案第4节给出待review预算：raw warm普通/限定名p95≤200 ms、模块成员p95≤300 ms；相同正确路径对约1 s原版至少改善50%；产品缓存p95≤50 ms；小fixture新导出生效≤5 s；已复现hang/crash为0；四平台≥2 h RC soak、fan-out≥1000次，资源/缓存有界。不得以丢符号、排除超时样本、重启成功抵消失败。
+
+同时保持既定连续7次有效nightly soak+bench才steady；声明每个UP的fixed/mitigated/open及证据。基线与候选引擎、最终VSIX/CLI包SHA一起存档；未经联合产品安装验证的fork artifact不得直接成为0.0.12默认引擎。
+
+执行顺序 G0证据/gate → G1正确/稳定 → G2真实性能与功能 → G3四平台产品化 → G4 RC review。当前只同步方案，不改patch/代码/workflow，不发布或删除生产保护。
diff --git a/.github/actions/linux-floor/action.yml b/.github/actions/linux-floor/action.yml
@@ -0,0 +1,40 @@
+name: Linux floor package
+description: Build and execute the engine in the pinned Ubuntu 20.04 rootfs.
+inputs:
+  platform:
+    description: linux-x64 or linux-arm64, matching the runner's architecture
+    default: linux-x64
+runs:
+  using: composite
+  steps:
+    - name: Import verified Ubuntu rootfs
+      shell: bash
+      env:
+        MCPPLS_FLOOR_PLATFORM: ${{ inputs.platform }}
+      run: |
+        set -euo pipefail
+        python3 - <<'PYROOT'
+        import json, os
+        from pathlib import Path
+        platform = os.environ['MCPPLS_FLOOR_PLATFORM']
+        pins = {'linux-x64': 'ci/linux-floor-rootfs.json', 'linux-arm64': 'ci/linux-floor-rootfs-arm64.json'}
+        pin = json.loads(Path(pins[platform]).read_text())
+        with open(os.environ['GITHUB_ENV'], 'a') as out:
+            out.write('MCPPLS_ROOTFS_URL=' + pin['url'] + '\n')
+            out.write('MCPPLS_ROOTFS_SHA256=' + pin['sha256'] + '\n')
+        PYROOT
+    - name: Build and validate final Linux package
+      shell: bash
+      env:
+        MCPPLS_FLOOR_PLATFORM: ${{ inputs.platform }}
+      run: |
+        set -euo pipefail
+        rootfs="$RUNNER_TEMP/mcppls-ubuntu20-root.tar.gz"
+        curl -fL --retry 3 --retry-all-errors "$MCPPLS_ROOTFS_URL" -o "$rootfs"
+        echo "$MCPPLS_ROOTFS_SHA256  $rootfs" | sha256sum -c -
+        docker import "$rootfs" mcppls-linux-floor:20.04
+        docker run --rm -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" \
+          -e JOBS=4 -e DIST_DIR="$GITHUB_WORKSPACE/dist" -e PLATFORM="$MCPPLS_FLOOR_PLATFORM" \
+          -e CCACHE_DIR="$GITHUB_WORKSPACE/.ccache-floor" \
+          mcppls-linux-floor:20.04 bash ci/scripts/linux-floor.sh
+        sudo chown -R "$(id -u):$(id -g)" .ccache-floor dist "build-$MCPPLS_FLOOR_PLATFORM-ubuntu20"
diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml
@@ -25,8 +25,7 @@ jobs:
       - uses: actions/cache@v4
         with:
           path: llvm-project
-          key: llvm-tree-linux-x64-${{ hashFiles('UPSTREAM') }}
-          restore-keys: llvm-tree-linux-x64-
+          key: llvm-tree-linux-x64-${{ hashFiles('UPSTREAM') }}-${{ hashFiles('patches/**', 'overlay/**', 'ci/scripts/apply.sh') }}
 
       - name: Build clangd
         env: