From 5aa24dec9040ca38df772c699b41774994927961 Mon Sep 17 00:00:00 2001 From: sunerpy Date: Thu, 20 Aug 2026 21:53:02 +0800 Subject: [PATCH] docs(upstream-sync): record the post-1.5.0 triage and four shipped tiers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Upstream's newest tag is still v1.5.0, so a version-delta sync had nothing to pull — but `main` had accumulated 104 unreleased commits past that tag, and two months of issues had never been triaged. The ledger now says so, and the header tells the next sync to diff `v1.5.0..origin/main` rather than trusting the tag list alone. Records the five releases this round produced, the two agent findings that dissolved on measurement (candidate ordering and the staleness banner were both already correct), the upstream premise upstream itself measured and rejected, and the telemetry / vector-RAG divergences that our guardrail makes permanent. Tracked parity stays 1.5.0: none of these releases ports an upstream release range. --- docs/upstream-sync/UPSTREAM.md | 100 +++++++++++++++++++++++++++++++-- 1 file changed, 96 insertions(+), 4 deletions(-) diff --git a/docs/upstream-sync/UPSTREAM.md b/docs/upstream-sync/UPSTREAM.md index a5a93cf9..f90a523f 100644 --- a/docs/upstream-sync/UPSTREAM.md +++ b/docs/upstream-sync/UPSTREAM.md @@ -13,10 +13,14 @@ `1.2.0 → 1.4.1` subset landed across `v0.28.3`–`v0.39.0`; see the 2026-07-17 CLOSEOUT entry) - **This project version:** see `Cargo.toml` (`codegraph-rs`, independent line) -- **Last sync:** `2026-08-04` — the two triaged issues left open by the - `1.4.1 → 1.5.0` round (**#1495**, **#1482 / #1482b**) have shipped, alongside two - project-local fixes; see the 2026-08-04 entry. Tracked parity stays `1.5.0` — - none of the four releases is an upstream-range port +- **Last sync:** `2026-08-20` — the post-`v1.5.0` **unreleased** range (104 commits + on upstream `main` past the `v1.5.0` tag) was triaged and four tiers shipped + across `v0.43.2` → `v0.45.0`; see the 2026-08-20 entry. Tracked parity stays + `1.5.0` — none of these releases is a port of an upstream *release* range, and + upstream's newest tag is still `v1.5.0` +- **Next sync starts here:** `git ls-remote --tags` alone is not enough. Diff + `v1.5.0..origin/main` too — this round found 104 unreleased commits behind an + unchanged tag - **Upstream repo:** https://github.com/colbymchenry/codegraph > **1.4.1 → 1.5.0 sync: COMPLETE** (codegraph-rs `v0.42.1` → `v0.42.4`). Every @@ -69,6 +73,94 @@ ## Sync log +### 2026-08-20 — post-`v1.5.0` unreleased range TRIAGED, four tiers SHIPPED (`v0.43.2` → `v0.45.0`; tracked parity stays `1.5.0`) + +`git ls-remote --tags` still reports `v1.5.0` as upstream's newest tag, so a +version-delta sync had nothing to pull. But `main` had accumulated **104 +unreleased commits** past that tag (43 source files, +5737/−368), and issues +#1496–#1566 / PRs #1402–#1564 had never been triaged. "No new version" is not +"no new content" — that is the lesson worth carrying into the next sync. + +Three parallel triages ran (extraction/kernel, `explore`/MCP, issues/PRs), and +every disposition below marked MEASURED was reproduced against a built binary +before being acted on. Tracked parity stays `1.5.0`: none of these releases is a +port of an upstream *release* range. + +#### Shipped + +| release | PR | what landed | upstream refs | +| --- | --- | --- | --- | +| `v0.43.2` | #209 | one shared file-classification signal across every surface | #1507 + the path table behind #1500 | +| `v0.43.3` | #211 | stop binding calls, imports and supertypes to coincidences | #1496, #1566, #1537/#1536 (PR #1538) | +| `v0.44.0` | #213 | unions, unit structs and COM `interface` as containers | PR #1516, #1513/PR #1514, #1519 | +| `v0.44.1` | #215 | imported members, cross-module Go calls, declaration initializers | #1518, #1521, #1510/PR #1511, #1524, #1512, #1504, #671 | +| `v0.45.0` | #217 | Tauri commands bound to their `invoke` call sites | #1543 | + +`v0.43.2` also carried `h2` 0.4.16 for **RUSTSEC-2026-0258** — unrelated to the +sync, but it is why that release exists at that moment: the advisory published +mid-round and turned CI red on a lockfile nobody had touched. + +#### Two agent findings REFUTED by measurement — recorded so the next sync skips them + +| claim | verdict | +| --- | --- | +| `Store::nodes_by_name` lacks `ORDER BY`, so sync and rebuild can bind different same-name targets (upstream CG-33) | **ALREADY-HAVE.** Both production resolution contexts sort candidates themselves — `context.rs:111,125` and `snapshot_context.rs:118-124` call `order_candidates` / `order_candidates_pub`, keyed `(file_path, start_line, start_column, id)`: upstream's key plus an extra total-order `id` tie-break. MEASURED twice — sync and `index --force` both bind `caller.run → pct@alpha.ts` even when sync's rowid order puts `zeta` first. | +| the `explore` staleness banner can be truncated away by our own budget logic | **ALREADY-HAVE.** The banner is *prepended after* truncation: `cut_at_section_boundary` → `mark_surviving_explore_citations(kept_prefix_len)` → `with_staleness_banner`. A cut section's citation is dropped first, so the banner correctly omits it. Pinned by the pre-existing `staleness_banner_omits_a_citation_removed_from_the_final_response`. The agent had conflated the in-section inline warning with the top-level banner. | + +#### One upstream premise upstream itself REJECTED — never port it + +**CG-27** — treating `function`/`method` as >50% envelope containers so inner +closures rank independently. Upstream measured and rejected it +(`91cb5b4:docs/benchmarks/explore-factory-closure-cg27.md`): delivered chars +7,539 → 397, inner closures 7/11 → 0/11, ~5,200 of a 5,601 reservation unused. +The cautious variant moved nine queries by 68 → 69 definitions total. Our +envelope drop stays limited to `is_container`. The real defect it exposed — +a trivial cluster winning on density while the answer cluster is dropped whole — +is tracked separately as the Tier 5 `explore` work. + +#### Divergences to record, not port + +- **Self-hosted telemetry** (`49c11fc`, Cloudflare D1 + a password-gated + dashboard replacing PostHog) and **#1509's request for a Qdrant/vector-RAG + integration**. Both are permanent divergences: `scripts/guardrail.sh` is a CI + gate rejecting qdrant/lancedb/candle/onnx/ort, byte-stable output is + incompatible with a nondeterministic retrieval stage, and our indexing path + makes no network call. Nothing vector-related is merged upstream yet — the + stance is recorded now so it is a decision rather than a surprise. `package.json` + in this range adds no AI dependency. + +#### N/A — TypeScript/Node-only, no Rust analogue + +#1532 (FTS5 absent from official Node builds — we compile it into `rusqlite`), +#1558 (V8 spread-arg limit), #1559 (V8 RegExp code space — the `regex` crate has +no such budget), #1544/#1547/#1564 (Vapor regex catastrophic backtracking — +`regex` is linear-time by construction), #1553 (V8 4 GB heap), #1549 +(`git ls-files --recurse-submodules` on git <2.34 — we never call it), +#1476/#1477 (npm CVEs), #1550 (npm platform bundle). + +#### NOT REPRODUCED here — closed questions, with the measurement + +#1555 (C/C++ hex-blob header stall — a 360 KB header with 60,000 `0x..` +initializers indexed in **326 ms**), #1522 (16-char raw-string delimiter — both +functions extracted), #1505 (400-function anonymous namespace — all 402 +extracted), #1565 (init/sync symbol-count divergence — our byte-equality is a +gated invariant). #1560 (JSX synthesis fabricating edges in a pure C/C++ index) +**cannot occur**: we have no synthesis pass at all. The flip side is that we lack +`jsx-render` edges entirely — a separate known gap. + +#### Where we are AHEAD of upstream + +Upstream is only now adding GDScript (#1499), which we shipped with a full +framework resolver (F1 autoload calls, F2 signal handlers, F3 impact/affected +unification) and a byte-stable golden corpus. + +#### Still open from this range + +The `explore` budget/selection epic (CG-38/36/30/28/26/31) and content-header +generated detection (#1500's `files.generated` column) are planned and reviewed +but not yet shipped. The 26 DEFER items and the permanently-N/A `0682137` +recorded in earlier entries are unchanged. + ### 2026-08-04 — the two open triaged issues SHIPPED, plus two project-local fixes (`v0.42.5` → `v0.42.8`; tracked parity stays `1.5.0`) Four releases. Two of them close the issues the 2026-08-02 CLOSEOUT left open