v2.1.28

Cartograph v2.1.28

Cartograph v2.1.28 makes generation retention resumable, prevents failed
generation cleanup from blocking parse-cache maintenance, improves Rust caller
resolution, and upgrades the native parser and managed search runtime.

Storage cleanup that preserves progress

Large retained generations previously could repeatedly time out while counting
or cascading through their rows, rolling back the entire cleanup attempt.
Retention now moves eligible work into a non-publishable retiring state and
drains child tables in transactions of at most 10,000 actual rows. Committed
batches survive a later failure, and subsequent bounded invocations resume them.

• Connection acquisition, transaction work and completion share the invocation
  deadline. Interrupted transaction connections are discarded safely.
• Byte and derived-relation allowances are checked before pagination, so costly
  old generations cannot hide later eligible work.
• Current generations, live leases, recent in-progress work, incomplete imports
  and the configured superseded history remain protected.
• Parse-cache maintenance runs independently after generation cleanup fails and
  protects the exact current parsing-policy contract.
• db usage reports retiring work, maintenance outcomes and repeated failures,
  empty spill heaps retaining index allocation, and the database/catalog size
  gap. These measurements do not identify files safe to delete.
• db prune --maximum-search-relation-bytes and the corresponding MCP field
  expose an explicit derived-search byte allowance, capped at 64 GiB.

Cleanup work remains bounded. Logical deletion, online B-tree compaction and
heap rewriting are separate operations; installing this release does not
automatically reclaim all previously allocated database files.

Code intelligence and architecture

• Rust self receivers resolve nominal ownership across split implementation
  files, parent modules and supported aliases. Ambiguous or unknown receivers
  remain unresolved.
• Batched source windows share one bounded source capture tied to the expected
  generation. Edited files, cancellation and generation changes remain explicit.
• Embedding and reranking clients reuse bounded HTTP transports with shared
  origin admission, queue deadlines and foreground capacity.
• CLI model bridges deliver prompts while draining bounded output, preserving
  backend rejection when a process exits early and rejecting successful exits
  when prompt delivery failed.
• SCIP overlays use a common source-verified replacement plan for memory and
  PostgreSQL spill construction, with bounded fenced batches and deterministic
  reduction.
• Project configuration and structural-summary workflows have clearer crate
  ownership. Dependency-direction and cycle checks enforce those boundaries.
• Extractor cache invalidation includes the complete lockfile, workspace
  manifests, pinned compiler and relevant build configuration.

Dependency updates

• Rust compiler and minimum supported Rust version: 1.98.1.
• Sole native Tree-sitter runtime: 0.27.0.
• All 41 direct Arborium grammar pins: 2.18.2.
• Published ABAP grammar/support bindings: 31.0.0. A minimal local facade
  reexports 0.27 types to bindings still requesting 0.26; it contains no old
  native parser or conversion code.
• Managed ParadeDB and pg_search: 0.25.6, pinned by immutable image digest.
  The managed image contains PostgreSQL 18.6 and pgvector 0.8.4;
  pgvector 0.8.6 remains the external-service recommendation.
• Updated compatible direct and transitive Rust dependencies. The subsequent
  maintenance audit found no confirmed abandoned package requiring removal.
  Maintenance advisories cover direct and transitive dependencies, and yanked
  packages now fail the dependency gate.

Database compatibility and upgrade

Append-only migration 41 admits generation digest V16. Migration 42 adds
resumable retirement and bounded maintenance telemetry. Earlier migration
checksums remain unchanged. Schema 42 and pg_search 0.25.6 require a
matching binary; old attached processes cannot hot-load these changes.

Start with the resumable project upgrade:

cartograph upgrade --apply --project-path <PATH> --json

If reconciliation requests a managed-database upgrade, create and verify the
reported backup, ensure sufficient free space, quiesce project writers, and use
the exact confirmed db upgrade operation. Resume the same upgrade command
afterward and require completed: true. Do not manually restart a stopped
rollback container against a possibly newer extension catalog. Reopen agent
hosts when required and verify fresh status plus a real indexed query.

Existing storage backlogs need bounded pruning after the matching runtime is
running. Measure allocation afterward before deciding on separately confirmed
compaction or restore. Never delete PostgreSQL data files by filename.

Cartograph remains a native Rust, PostgreSQL-only executable. Native archives
do not bundle PostgreSQL, ParadeDB, pgvector, a database or a container image.
There is no SQLite runtime, importer, optional feature or fallback.

Full changelog: v2.1.27...v2.1.28

v2.1.27

Cartograph v2.1.27

Cartograph v2.1.27 adds first-class Ada/SPARK and VHDL code intelligence,
improves the precision of Rust numerical hazards, and makes the whole-generation
biomarker refresh timeout explicit and large-project capable.

Ada, SPARK, and VHDL

• Ada .adb, .ads, and .ada files use a pinned native grammar and a
  dedicated bounded walker for packages, subprograms, types, objects, calls,
  and with/use compilation context. SPARK source uses this Ada mode.
• VHDL .vhd and .vhdl files extract entities, architectures, packages,
  functions/procedures, components, types, signals/constants/variables, calls,
  instantiations, and library/use context.
• Basic identifiers are canonicalized case-insensitively. Ada and VHDL imports
  resolve by declared compilation-unit name rather than a filename guess;
  declaration files win over bodies, and duplicate unit declarations remain
  unresolved instead of choosing one.
• The production registry now contains 132 modes: 66 pinned grammar-backed
  modes and 66 bounded custom/scanner modes. The frozen 73-language,
  163-extension v1 boundary is unchanged.

Numerical-analysis precision

• Epsilon literals and epsilon/tolerance-named bounds still produce
  absolute_only_tolerance; general abs(x) <= bound containment and
  magnitude predicates are retained as none_observed evidence instead.
• Finite numeric clamp, min, and max guard sites remain queryable without
  being counted as nan_ordering_unknown hazards.
• asin, acos, log, and square-root calls recognize direct guards and
  same-block immutable clamp/floor bindings. Guarded sites retain explicit
  non-finite/input-provenance unknowns, while unguarded calls remain hazards.

This resolves #154 without suppressing numerical extraction or weakening the
static-evidence boundary.

Biomarker refresh timeout

• databaseQueryTimeoutMs and the generated
  --database-query-timeout-ms flag now explicitly control the inner
  PostgreSQL statement timeout for biomarkers-refresh, from 1 ms through 30
  minutes.
• The old timeoutMs/--timeout-ms spelling remains an exclusive legacy
  alias. Passing both is rejected.
• Dry-run and execution output disclose the exact timeout and its source. The
  generated CLI deadline automatically stays beyond the chosen database
  deadline; MCP callers are told to provide a longer client deadline.

This resolves #153 while preserving dry-run-first and explicit-confirmation
mutation semantics.

Dependencies and storage contract

• The lockfile updates combine from 4.6.7 to 4.6.8 and syn from 3.0.3 to
  3.0.4, and adds exact-pinned tree-sitter-ada 0.1.0 and
  arborium-vhdl 2.18.1 grammar bindings.
• Generation digest V15 fences Ada/VHDL resolver facts and the revised
  numerical classification. Append-only migration 40 admits V15; unchanged
  source indexed by an older binary is stale until a normal index publishes
  current-contract facts.

Upgrade

Use the resumable project upgrade:

cartograph upgrade --apply --project-path <PATH> --json

Require completed: true. Restart or reopen an attached agent host only when
the report says restartRequired: true; an already-attached process cannot
hot-load the new binary.

Cartograph v2.1.27 remains native Rust and PostgreSQL-only. It does not bundle
PostgreSQL, ParadeDB, pgvector, a database, or a container image, and it has no
SQLite runtime, importer, optional feature, or fallback.

Full changelog: v2.1.26...v2.1.27

v2.1.26

Cartograph v2.1.26

Cartograph v2.1.26 corrects the release version published to SonarQube and
adds a fail-closed release contract so Sonar metadata cannot silently lag the
Cargo workspace again.

Release metadata integrity

• sonar.projectVersion now matches the Cargo workspace version used by the
  native binary, signed tag, release notes, and GitHub release.
• The required release-workflow contract reads both tracked sources and fails
  whenever they differ or the Sonar version is missing or duplicated.
• The contract runs in the required exact-SHA validation workflow, so stale
  Sonar release metadata blocks the main-gate attestation and publication.

Runtime compatibility

This corrective release makes no database migration, generation-digest,
retrieval, dependency, or managed-container change relative to v2.1.25.
PostgreSQL 18, ParadeDB pg_search 0.25.3, managed pgvector 0.8.4, and the
native PostgreSQL-only storage contract are unchanged.

Upgrade

Use the resumable project upgrade:

cartograph upgrade --apply --project-path <PATH> --json

Require completed: true. Restart or reopen an attached agent host only when
the report says restartRequired: true; an already-attached process cannot
hot-load the new binary.

Cartograph v2.1.26 remains native Rust and PostgreSQL-only. It does not bundle
PostgreSQL, ParadeDB, pgvector, a database, or a container image, and it has no
SQLite runtime, importer, optional feature, or fallback.

Full changelog: v2.1.25...v2.1.26

v2.1.25

Cartograph v2.1.25

Cartograph v2.1.25 adds a provider-agnostic, shell-free CLI bridge for optional
generative tiers, hardens managed-database migration and replacement failures,
and prevents parse-cache garbage collection from deleting rows still owned by
durable spill work. It also advances the supported toolchain and dependency
graph to their current compatible releases.

Provider-agnostic CLI bridge

• provider: "cli-bridge" runs an operator-selected executable with an ordered,
  bounded argv template. Cartograph never invokes a shell; only the exact
  {model} and {prompt} placeholders are accepted.
• Prompts can be delivered through bounded stdin or one exact argv token.
  Responses can be decoded as trimmed raw text, through a validated bounded JSON
  path, or through the legacy Claude response envelope.
• Wall-clock timeout, kill-on-drop, stdout, stderr, exit-status, prompt-template,
  command, argv, model, and response-path bounds all fail closed before an
  invalid configuration can run.
• The native llm setup command and MCP llm-plan/llm-apply operations expose
  the same bridge contract. Existing claude-bridge and claudeBin
  configurations remain readable, while the hybrid Claude preset writes the
  generic representation with byte-compatible historical behavior.

Managed-database recovery diagnostics

• Managed startup applies schema migrations with a bounded PostgreSQL statement
  timeout and verifies the append-only ledger after failure. A database that is
  valid but behind now reports its recorded version, required version, and exact
  pending migration instead of surfacing a later missing-column query.
• doctor verifies the schema ledger before reading generation tables, so an
  older supported schema produces actionable upgrade guidance without querying
  a column that its migration has not created yet.
• Managed image replacement proves free space on the exact owned data mount
  before renaming the healthy container. The requirement scales to the current
  schema's full index allocation plus ten percent of database allocation, with
  a 64-MiB floor, so extension rebuilds retain a replacement copy plus bounded
  WAL/catalog scratch. Once an extension catalog has advanced, the existing
  forward-resumable recovery contract still retains the new image and refuses
  an unsafe downgrade restart.

Parse-cache and automatic-sync recovery

• Single-row, batch, and exact parse-cache eviction now preserve cache entries
  referenced by generation spill rows through the durable composite foreign-key
  identity. Live regression coverage exercises both same-path replacement modes
  and exact eviction.
• Automatic sync now opens a bounded circuit after five consecutive revisions
  fail with the same stable non-status error code. Successful sync resets the
  circuit, alternating failures do not trip it, and JSON status reports both
  repeated-failure attempts and retry suppression explicitly.
• db prune --maximum-cascade-rows and MCP prune-generations now expose the
  retention engine's existing hard-bounded row override. This lets an audited
  recovery remove one terminal generation that is slightly larger than the
  conservative five-million-row default without weakening the independent
  search-relation or DDL caps.
• The existing capacity-specific circuit breaker remains unchanged.

Current supported dependencies

• The pinned stable compiler and minimum supported Rust version advance to
  Rust 1.98.0. Linux validation and release builders use digest-pinned official
  Rust 1.98.0 Debian 13 images.
• Direct Tree-sitter dependencies advance to tree-sitter 0.26.13 and
  tree-sitter-sfapex 3.0.1. The lockfile also refreshes compatible transitive
  releases and removes the now-unused arrayref package and BSD-2-Clause
  allowance.
• PostgreSQL 18, ParadeDB pg_search 0.25.3, managed pgvector 0.8.4, and the
  PostgreSQL-only storage contract are unchanged.

Upgrade

Use the resumable project upgrade:

cartograph upgrade --apply --project-path <PATH> --json

Require completed: true. This release adds no database migration or generation
digest change. Restart or reopen an attached agent host only when the report
says restartRequired: true; an already-attached process cannot hot-load the
new binary.

Cartograph v2.1.25 remains native Rust and PostgreSQL-only. It does not bundle
PostgreSQL, ParadeDB, pgvector, a database, or a container image, and it has no
SQLite runtime, importer, optional feature, or fallback.

Full changelog: v2.1.24...v2.1.25

v2.1.24

Cartograph v2.1.24

Cartograph v2.1.24 centralizes every workspace dependency contract, adds a
fail-closed CI check that prevents member manifests from drifting, and updates
the ABAP Tree-sitter package to its current major release without changing the
published grammar behavior.

Complete workspace dependency inheritance

• All internal cartograph-* crates are declared once in
  [workspace.dependencies], and member manifests inherit those canonical
  paths with workspace = true across normal, development, build, and
  target-specific dependency tables.
• A deterministic workspace contract derives the authoritative member set from
  locked Cargo metadata, parses each TOML manifest, and rejects missing root
  declarations, direct member paths or versions, and non-inherited internal
  dependencies.
• The contract includes adversarial coverage for comments, indentation, dotted
  keys, dependency subtables, implicit members, and globbed members.

Fail-closed release validation

• The full GitHub quality gate now runs the workspace dependency contract as an
  exact blocking step. Documentation-only validation remains bounded to its
  approved allowlist, while dependency, workflow, source, and unknown changes
  continue to select the complete gate.
• The release-workflow contract parses GitHub Actions YAML and rejects semantic
  job- or step-level continue-on-error keys, including quoted, escaped,
  explicit-key, and whitespace variants. It also requires the workspace
  dependency check exactly once under the full-gate condition.

Current ABAP grammar package

• tree-sitter-abap-sqry and its support crate are updated from 29.0.6 to
  30.0.0 while retaining Tree-sitter 0.26 compatibility.
• The published 29.0.6 and 30.0.0 parser, grammar, node types, headers, Rust
  bindings, build script, and support implementation are byte-identical. The
  package-major update therefore does not change extraction identities or the
  generation digest contract.

Upgrade

Use the resumable project upgrade:

cartograph upgrade --apply --project-path <PATH> --json

Require completed: true. This release adds no database migration or generation
digest change. Restart or reopen an attached agent host only when the report
says restartRequired: true; an already-attached process cannot hot-load the
new binary.

Cartograph v2.1.24 remains native Rust and PostgreSQL-only. It does not bundle
PostgreSQL, ParadeDB, pgvector, a database, or a container image, and it has no
SQLite runtime, importer, optional feature, or fallback.

Full changelog: v2.1.23...v2.1.24

v2.1.23

Cartograph v2.1.23

Cartograph v2.1.23 aligns OpenAI-compatible endpoint probing with live model
clients, makes the optional biomarker lifecycle explicit and non-blocking, and
bounds dead-code evidence early enough for large graphs while isolating digest
sections. This resolves
issue #147,
issue #148, and
issue #149.

Consistent model endpoints

• Doctor's model-catalog probe now uses the shared endpoint normalizer used by
  embedding and reranking clients. An endpoint already ending in /v1
  requests /v1/models instead of the invalid /v1/v1/models path.
• Known OpenAI-compatible operation suffixes are normalized through the same
  bounded URL builder, so doctor, smoke, embedding, and reranking retain one
  path contract without exposing credentials or relaxing loopback/TLS policy.

Explicit biomarker lifecycle

• Biomarker stats, ranked/symbol reads, verbose status, and inline status
  rollups no longer trigger whole-generation detector computation. Before a
  complete exact relation exists they return a typed not_computed state;
  rollups preserve the rest of status and return an empty biomarker array, and
  review-risk does not mislabel that absence as a ready zero-finding lens.
• cartograph admin biomarkers-refresh is a working dry-run-first boundary.
  Execute mode requires --no-dry-run --confirm and accepts a bounded
  --timeout-ms; MCP uses the equivalent dryRun, confirm, and timeoutMs
  fields. Validation and timeout failures carry actionable safe messages.
• The stored relation remains generation- and input-fingerprint-fenced.
  Indexing continues to publish canonical graph facts without silently
  computing this optional derived relation.

Bounded dead-code and resilient digest

• The deterministic dead-code query filters and materializes a
  PageRank-prioritized maxCandidates orphan window before outgoing-edge
  aggregation and source lookup. Framework, entry-point, public-container,
  test, and fixture exemptions remain inside that pre-enrichment boundary.
• A PostgreSQL statement timeout is now surfaced as the typed
  dead_code_query_timeout error with bounded retry guidance instead of a
  generic tool failure.
• Digest preserves all successful concurrent sections when one section times
  out or is unavailable. sectionStatus reports each outcome, failed sections
  receive safe empty/null fallbacks, and degraded identifies a partial digest.

Upgrade

Use the resumable project upgrade:

cartograph upgrade --apply --project-path <PATH> --json

Require completed: true. This release adds no database migration or generation
digest change. Restart or reopen an attached agent host only when the report
says restartRequired: true; an already-attached process cannot hot-load the
new binary.

Cartograph v2.1.23 remains native Rust and PostgreSQL-only. It does not bundle
PostgreSQL, ParadeDB, pgvector, a database, or a container image, and it has no
SQLite runtime, importer, optional feature, or fallback.

Full changelog: v2.1.22...v2.1.23

v2.1.22

Cartograph v2.1.22

Cartograph v2.1.22 keeps generation admission and freshness consistent,
provides an explicit bounded heap-reclaim path, makes capacity configuration
failures actionable, and gives find a uniform text/JSON output selector. This
resolves
issue #143,
issue #144,
issue #145, and
issue #146.

Generation capacity and source admission

• Capacity failures now state that maxGenerationBytes has a hard 8 GiB
  maximum. When PostgreSQL spill is already selected and the ceiling is
  reached, the next action points to generated/compiled artifact exclusions
  instead of recommending an impossible increase.
• An out-of-range maxGenerationBytes reports the exact field and inclusive
  1..=8589934592 range through direct CLI and MCP errors.
• Migration 39 records run-scoped exclusion globs on the generation they
  build. Status, source context, changed-since, automatic synchronization,
  sync-if-dirty, and resumable upgrade replay that policy, so a just-published
  subset generation can remain current.
• Public status/debug output exposes only the number of run exclusions. A later
  explicit index without --exclude intentionally clears the run-scoped list;
  automatic reconciliation inherits it.

Bounded heap recovery

• cartograph db compact --heap is a read-only plan that measures dead and
  reusable-free allocation in allowlisted Cartograph main and TOAST heaps with
  pgstattuple_approx. It reports estimated reclaimable bytes, total relation
  bytes, headroom, truncation, and the exclusive-lock requirement.
• Apply requires the separate compact-heap-relations confirmation, verified
  filesystem headroom, and no live Cartograph operation leases. It runs one
  VACUUM FULL at a time outside a transaction, fences existing and newly
  attempted project-operation leases, and records exact before/after
  bytes plus any stable partial-stop reason.
• Managed database initialization installs pgstattuple; external PostgreSQL
  operators install it explicitly. Existing online B-tree compaction remains
  unchanged under compact-online-indexes.
• Fenced failed-generation cleanup now deletes that generation's exact spill
  root and cascaded staging payload immediately, making pages reusable before
  a retry rather than retaining live spill rows until a later prune.

Consistent find output

• Public cartograph find accepts --format text|json on every search axis.
  JSON remains the compatibility default; text renders concise deterministic
  freshness, count, truncation, name/kind/path/line, and abstention evidence.
• --compact remains independent and continues to control the exact-name JSON
  payload sent through the shared MCP tool boundary.

Upgrade

Use the resumable project upgrade:

cartograph upgrade --apply --project-path <PATH> --json

Require completed: true. Migration 39 is append-only and gives existing
generations an empty run-exclusion policy. New/reconciled generations retain
the exact policy that built them. Restart or reopen an attached agent host only
when the report says restartRequired: true.

Cartograph v2.1.22 remains native Rust and PostgreSQL-only. It does not bundle
PostgreSQL, ParadeDB, pgvector, a database, or a container image, and it has no
SQLite runtime, importer, optional feature, or fallback.

Full changelog: v2.1.21...v2.1.22

v2.1.21

Cartograph v2.1.21

Cartograph v2.1.21 contains failed automatic indexing before it can create an
unbounded generation backlog, makes large relation-free backlogs practical to
prune, and upgrades the managed PostgreSQL search runtime to ParadeDB 0.25.3.
This resolves
issue #142 and
incorporates the dependency update from
PR #141.

Auto-sync capacity containment

• Generation-capacity failures now share a cross-revision circuit breaker.
  Five unresolved capacity failures suppress further automatic indexing even
  when editor activity continually changes the source revision.
• Every failed automatic publication attempts the existing bounded
  terminal-generation retention path before returning. A persistent failure no
  longer retains one new PostgreSQL spill generation per retry.
• Structured status reports the capacity failure count, circuit state,
  maxGenerationBytes limit, cartograph_process scope, and bounded recovery
  action. An explicit successful index clears the circuit.
• cartograph serve --mcp --no-auto-sync disables both filesystem watching and
  periodic reconciliation for an operator-controlled recovery host.
  --no-startup-sync continues to disable only the initial catch-up.

Bounded backlog recovery

• db prune --maximum-deletions is no longer silently capped at 64 generations
  when failed generations own no derived search relation. A requested batch can
  delete up to 10,000 such generations while relation-bearing work remains
  independently bounded to 64 online relation drops.
• Candidate cascade rows, derived-relation presence, and physical bytes are
  measured in one bounded catalog query before selection. Current, leased,
  recent, and import-recovery generations retain their existing protections.
• Lease heartbeats clamp backward wall-clock adjustments against their durable
  acquisition and heartbeat timestamps. A host clock correction can no longer
  turn a live exact-token heartbeat into a PostgreSQL constraint failure during
  import or publication recovery.
• Documentation now separates logical retained generation data from shared
  heaps, indexes, TOAST allocation, and reusable physical space, and preserves
  backup-first guidance for explicit pruning and online B-tree compaction.

ParadeDB and dependency refresh

• The managed, development, and live-CI image is ParadeDB 0.25.3 at one exact
  multi-architecture digest. Capability checks and managed upgrades now require
  pg_search 0.25.3; the image retains pgvector 0.8.4 and compatibility with
  existing bm25 derived relations.
• Direct crates.io dependencies were audited against the current stable
  registry releases, and the lockfile refreshes all newer Rust 1.97.1-compatible
  transitive releases.
• GitHub artifact provenance uses actions/attest-build-provenance 4.2.2 at its
  reviewed commit, and the pinned Rust/Trixie build and Debian 13 runtime image
  digests are refreshed.

Upgrade

Use the resumable project upgrade:

cartograph upgrade --apply --project-path <PATH> --json

Require completed: true. If project reconciliation requests a managed
database replacement, take the requested backup, use the exact confirmation
phrase, and rerun the same upgrade command to resume. Restart or reopen an
attached agent host only when the report says restartRequired: true.

Cartograph v2.1.21 remains native Rust and PostgreSQL-only. It does not bundle
PostgreSQL, ParadeDB, pgvector, a database, or a container image, and it has no
SQLite runtime, importer, optional feature, or fallback.

Full changelog: v2.1.20...v2.1.21

v2.1.20

Cartograph v2.1.20

Cartograph v2.1.20 fixes two indexing failures reported against v2.1.18. Slang
grammar-recovery nodes can no longer create invalid durable spans, and large
many-crate Rust workspaces select the existing PostgreSQL streaming path before
exhausting the in-process generation bound. This resolves
issue #139 and
issue #140.

This release supersedes the tag-only v2.1.19 candidate. All four v2.1.19 native
builds passed, but publication stopped before creating a GitHub release because
the release-note guard mistook an ordinary inflected word for an unfinished-note
marker. v2.1.20 makes that guard token-aware and adds a workflow regression
contract while preserving the signed v2.1.19 tag.

Slang span and partial-file recovery

• Missing or zero-width C-family declarator nodes are rejected before symbol
  creation. Ordinary Slang modules with imports, parameter blocks, resources,
  and multiple shader entry points retain valid durable spans.
• An invalid recovery span or a parser stop without cancellation now retains an
  empty partial file and a bounded extraction_invalid_span or
  extraction_parser_stopped degraded-file reason. The remaining files can
  still publish as one complete immutable generation.
• Cancellation, unavailable or mismatched grammars, invalid configuration, and
  modeled-output exhaustion remain fatal rather than being silently hidden.

Streaming large Rust workspaces

• generationStorage: "auto" now selects PostgreSQL spill at 64 Cargo
  manifests, in addition to the existing 10,000-file, 64 MiB source, and 16x
  expansion signals. A workspace at the reported approximately 100-crate scale
  therefore resolves and reduces in bounded batches instead of retaining the
  entire generation in memory.
• maxGenerationBytes is explicitly documented as a Cartograph-process bound,
  not the managed PostgreSQL container's 2 GiB memory limit.
• Direct text and JSON errors now name the limit, scope, and safe next action.
  MCP admin jobs expose the same credential-safe guidance through additive
  failureDetail fields.

Upgrade

Use the resumable project upgrade:

cartograph upgrade --apply --project-path <PATH> --json

Require completed: true. Restart or reopen an attached agent host only when
the report says restartRequired: true; a process that was already attached
cannot hot-load the new native child.

Cartograph v2.1.20 remains native Rust and PostgreSQL-only. It does not bundle
PostgreSQL, ParadeDB, pgvector, a database, or a container image, and it has no
SQLite runtime, importer, optional feature, or fallback.

Full changelog: v2.1.18...v2.1.20

v2.1.18

Cartograph v2.1.18

Cartograph v2.1.18 makes file-local indexing failures actionable without
weakening the source/privacy boundary. It resolves
issue #137: a failed
parse no longer collapses to an unexplained parse_failed result when the
native pipeline can identify the input and a credential-safe cause.

Actionable parse diagnostics

• Memory and PostgreSQL-spill indexing retain one exact normalized
  project-relative input path across the parse worker, indexer supervisor, and
  project runtime boundaries.
• Source drift, bounded source-read failure, unavailable or mismatched grammar,
  parser stop, cancellation, invalid span or nesting policy, nesting exhaustion,
  modeled-output exhaustion, and generation capacity remain distinct fixed
  reasons.
• The failed generation cannot publish. An existing current generation remains
  visible and queryable while the named input is fixed or deliberately ignored.

Structured CLI and MCP output

• Text errors name the escaped project-relative path and qualified stable
  reason code.
• cartograph index <path> --format json exits nonzero and emits standalone
  structured JSON on stderr. The error.file_failure object contains path,
  reason, and a fixed description; the parent object retains the stable
  failure code and stage.
• MCP admin job status carries the same bounded evidence as fileFailure, so a
  background index does not flatten the diagnostic back to parse_failed.
• Auto-sync retains the qualified stable reason code for retry/backoff policy.

Privacy and safety boundary

Only a validated relative NormalizedPath and allowlisted enum reason cross the
native pipeline boundary. Absolute checkout roots, source or parser text,
literal values, database URLs, credentials, and database/driver errors remain
discarded. Text rendering escapes path control characters, JSON uses ordinary
string escaping, and the diagnostic stays bounded to one failed input.

Upgrade

Use the resumable project upgrade:

cartograph upgrade --apply --project-path <PATH> --json

Require completed: true. Restart or reopen an attached agent host only when
the report says restartRequired: true; a process that was already attached
cannot hot-load the new native child.

Cartograph v2.1.18 remains native Rust and PostgreSQL-only. It does not bundle
PostgreSQL, ParadeDB, pgvector, a database, or a container image, and it has no
SQLite runtime, importer, optional feature, or fallback.

Full changelog: v2.1.17...v2.1.18