Recorded per-test traces, phase 2 (selection in shadow mode) Implementation Plan

For agentic workers: REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (- [ ]) syntax for tracking.

Goal: Select tests from recorded per-test traces (rules R1–R7 below), next to today's static selection. The trace selection is computed on every run, compared with the static one, and the comparison and every observed miss are stored and reported. Which tests run does not change in this phase until a project passes the promotion bar (D5) and its host is switched to select: "live".

Architecture: A new TraceSelect module in TestPrune.Trace answers "which tests of this project must run now?" from the trace store alone, plus the current symbol index: a test runs when it has no usable trace, or when anything its trace names (a symbol version, a file input) no longer matches the tree. Code the probes cannot see falls back to today's static walk for the changed symbols that need it. A Shadow module compares that answer with the static selection and stores one row per (run, project) plus one row per miss in the trace database. FsHotWatch computes both selections at the launch it already instruments for CheckReach, runs the static one, and at completion records the comparison, the misses and the trace selection's failure recall. A mutation harness (test-prune-traces mutate) and a report verb (test-prune-traces shadow-report) turn the promotion bar into commands with thresholds.

Tech Stack: F# (net10.0 tooling, net8.0 recorder); Microsoft.Data.Sqlite (already used by the trace store); xUnit v3 on Microsoft Testing Platform v2; Unquote; FsHotWatch plugin framework.

Global Constraints

• Open-source repositories: no private tracker ids, no consumer project names, no session links in code, comments, commits, changelogs or docs. Say "a consumer". Commit trailer: Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>.
• VCS is jj. Describe a change before editing it (jj describe -m "…"), then jj new after it is done. For a message with backticks, $ or quotes, use jj describe --stdin <<'MSG' … MSG.
• F# only, formatted with Fantomas, FSharpLint clean, TreatWarningsAsErrors=true, GenerateDocumentationFile=true on packable projects. Use List.isEmpty, never x = [] (the analyzer stage of the gate rejects it even though lint-project passes).
• TestPrune.Trace.Recorder stays net8.0 with FSharp.Core pinned to 8.0.403 and no other dependency.
• Shadow never changes a run. With select: "shadow", the tests launched, their filters, the verdict, the evidence, the outstanding-failure ledger and every cache are byte-for-byte what select: "off" produces. A shadow failure (an exception, an unreadable store, a timeout) is one warning line and a missing shadow row, never a changed result. F3 has a test that pins this.
• Live selection is a superset rule. Where it is live, a project runs trace ∪ R6-static ∪ R7-static ∪ R9-obligations, and only if the project is eligible (D3). An ineligible project runs today's static selection.
• A trace is only ever read under the fingerprint it was recorded with (ADR 0006). Selection never reuses a trace across fingerprints.
• The trace database keeps its forward-only migrations. This phase appends migration 2 and never edits migration 1.
• With no tests.traces.select key, or "select": "off", FsHotWatch behaves byte-for-byte as it does today.
• Verification:
  • Inner loop: dotnet build, then dotnet run --project tests/<Project> --no-build -- --filter-class <Class>. Run the new test class and every existing class whose file the task touched.
  • Gate: each repository's mise run ci (TestPrune) or fshw check (FsHotWatch). Read the fshw verdict file as well as the exit code.
  • Never pipe a gating command into tail, head or grep. Redirect the output to a file, then read the file and the exit status separately.

Background: the rules, restated

The phase-0 design spike defined the selection rules R1–R9. They are restated here so this plan is self-contained. E is the environment fingerprint (ADR 0006). A test's trace is the union of the scopes it links: its own test scope plus inherited fixture, collection and pool scopes. It holds symbol versions (full name, version hash) and file inputs (kind, key, hash).

Test t is selected iff any of:

Why it is sound, modulo known cases. A deterministic test whose outcome depends only on the code it executed and the inputs it read keeps its outcome while none of those changed. R2 and R3 cover executed code and read inputs, R1, R4 and R5 cover missing or partial evidence, R6 covers code the probes cannot see, and R7 covers inputs the recorder cannot see. New code is reached only through a changed caller, which is in the trace (R2). A trace recorded at any earlier tree stays valid while every entry still verifies, so traces refreshed only by the tests that happened to run are still sound.

Known unsound cases and where this plan measures them:

Decisions (with reasons)

D1. The shadow-mode contract

• Both selections are computed from the same inputs at the same instant. FsHotWatch already retains, at the launch chokepoint, what check would have run (WouldHaveRun) so that a confirm can measure its failure recall (CheckReach). The trace selection is computed at that point, from the same seeds, changed files and index. Computing it later would compare it against a tree the static selection never saw.
• Compared before obligations. The comparison is between the static symbol selection (the tests QueryAffectedTests returns for the run's seeds, plus the static file rules) and the trace selection (R1–R7). R9 obligations, the dependency fanout, the unanalysable-file fallback and the quarantine are applied after either selection, identically, so they are left out of the comparison: including them would dilute both sides with the same tests.
• Compared at two granularities. FsHotWatch launches by test class (--filter-class). The row stores both test-level sets and class-level sets, plus trace_class_tests and static_class_tests: the tests each side would actually launch after class expansion. The payoff bar is judged on launched tests, because method-level savings that class expansion gives back are not savings.
• Stored in the trace database, not in FsHotWatch state. One shadow_selections row per (run, project) and one shadow_misses row per miss. The trace database already survives core schema bumps (ADR 0006), the report verb reads it without a daemon, and a consumer can inspect it with SQLite.
• Written once, at completion. The launch computes the selection and keeps it in memory on the launch record (as WouldHaveRun is kept). Completion writes the row with the outcome half filled in. A run that never completes (cancelled, superseded) leaves no row: the report counts completed runs only, and a half row would be a sample with no outcome.
• Logged as one line per run: trace-shadow: <project> static 2032/41c, trace 85/9c (launch 312), trace-only 3, misses 0, R1 4 R2 61 R6 20, 184 ms.

D2. What counts as a miss, and how each is measured

• Why "failed while its trace verified" is the miss. It is Shake's verifying-trace property tested directly: the trace claimed the test's inputs were unchanged, and its outcome changed anyway. It needs no baseline and works on every run that executed the test, not only on full runs. Every such row is either non-determinism (flaky), a missing probe, a hash that did not see a change, or an unrecorded input: all of them are defects to explain before promotion.
• Tests without traces (the safety net). R1, R4 and R5 select them outright, rather than falling back to static, because a test with no evidence has no business being skipped. The cost is the unverifiable share. A project whose complete-trace share is below 0.99 is ineligible (D3): live mode gives it the static selection, so a project that cannot be traced (the shadow bin refuses it, as it refuses TestPrune.Trace.Tests) is never selected by trace at all.
• Stale traces after content-hash changes. Three cases, each handled without a special rule:
  • The code changed: R2 selects every test whose trace names the old version. That is the rule working, not staleness.
  • What a content hash means changed (a core SchemaVersion bump): the hash scheme is part of E, so every trace becomes an R5 mismatch and is re-recorded. The unverifiable share spikes for one run; the report shows it.
  • The hash did not see a behavioural change: it surfaces as a verified-failure miss (unexplained). Traces recorded by full-runs only go stale between full runs (every edited symbol keeps selecting its tests until the next confirm), so shadow numbers on check runs are only meaningful under record: "every-run". The report states the recording policy of every row's run.
• R8 is not implemented in this phase. SQL text lives in symbols, so a changed query is R2. Migrations applied by fixture code that reads them from disk are file inputs of the fixture scope, so a changed migration is R3 for every test linked to that fixture. Migrations the recorder cannot see (embedded resources) are unclaimed changed files, so R7. The mutation harness samples real changed symbols, which include SQL-emitting ones. Phase 4 adds table-level R8.

D3. The trace selection (TestPrune.Trace TraceSelect)

• Keys. A test's key is <project>|<class>|<method> with + replaced by . on both sides (TraceSelect.keyOf, TraceSelect.normalizeKey). The index stores CLR class names built by FCS; the recorder stores xUnit's TestClassName. Both are CLR names; normalising nested-type separators removes the one difference either could introduce. The end-to-end test (Task 6) asserts every indexed fixture test maps to a stored trace.
• Universe. The project's tests as the index knows them (SymbolStore.GetTestMethodsInProjects). A stored trace of a test the index no longer has is ignored; an indexed test with no trace is R1.
• Set-based verification. R2 reads the distinct symbol versions the project's traces reference, compares each with TraceIngest.versionHashes (the function ingestion used, so the two cannot disagree), and asks the store for the tests linked to the stale ones in one query (json_each, ADR 0003). R3 does the same for distinct inputs, rehashing each with TraceIngest.inputHash, the function ingestion used. Neither reads a trace per test.
• Fallback classes (R6). A changed seed falls back to the static walk when:
  • NotProbed: no probe of the project's latest weave maps to it (test-assembly code, which is woven sites-only; abstract and interface members; record fields; symbols added since the last weave);
  • Inline: the index marks it inline (Task 1): its probe never fires where it was inlined;
  • Literal: it carries [<Literal>] (already indexed as LiteralAttribute): it has no code at all;
  • StaticInit: it executed inside a static constructor in some recorded run of the project, where hits go to S:static-init and no test;

  • OrderUnstable: the order-unstable detector (Task 4) saw it appear in or vanish from a test's trace while nothing that test executed changed.

The static walk is today's QueryAffectedTests, with composition-root barriers and the per-seed fail-safe while they exist. Phase 3 retires them for eligible projects; this phase records each run's fallback seeds (fallback_seeds) so phase 3 has the data.

Note, 2026-09-27 (static-init inheritance landed after this plan). Static-init hits no longer go to one S:static-init scope that no test links. The recorder keeps one S:<type> scope per type initializer, and ingestion (RunScopes.staticInheritance) links it to every test that ran code of that type or code in the source file its initializer is in, transitively through the initializers it touched. An initializer that cannot be placed (no manifest row names its type: a SitesOnly test assembly, or an unnamed one) is linked to every test. So a static-init symbol and the files its initializer read are in the traces of the tests that depend on them, and R2/R3 verify them like any other entry. What this changes for R6: - StaticInit is no longer needed for soundness where the scope was linked: R2 already selects those tests. It is still needed for a symbol whose static-init scope no test of the run inherited (its type was initialized but no test touched it: nothing links, so no trace would select on a change to it). - The fact can therefore narrow to "executed only in static-init scopes that no test linked", which is computable at ingestion from trace_test_scopes. Keeping the broader "executed in any static constructor" fact is still sound, only wider. - Everything in an unplaceable initializer reaches every test's trace, so a change there selects the whole project through R2, not R6. - Why the probed set is stored and not recomputed. Selection runs before a run prepares its shadow bin, so the manifest of the build about to run is not available. The latest ingested weave's joined symbols are. A symbol added since then is NotProbed and falls back, which is conservative. It is stored per (project, E) as trace_symbol_facts rows, replaced by every ingestion. - R7 claims. A changed file is claimed when a trace input of the project has it as its key, or has its directory as a list key. An indexed source file is handled by symbols. Anything else is unclaimed: the static file rules decide (ImpactAnalysis.selectTests over the unclaimed files, which applies DependsOnFile, runtime coverage and the .fsproj rule), and the tests the file census found reading repository files without a recorded input (Task 9) are added. - Eligibility. A project is eligible when at least 0.99 of its universe has a complete trace under the current E. The threshold matches phase 1's census bar.

D4. Predicting the environment fingerprint before a run

Selection needs the current E before the test process exists, and E includes the runtime the process will load (RuntimeInformation.FrameworkDescription).

• Chosen: Fingerprint.predict computes every component from disk and resolves the runtime with the host's roll-forward rules (RuntimeResolution, Task 3) over <App>.runtimeconfig.json and the runtimes installed under DOTNET_ROOT. The recorder's RuntimeIdentity type is the one place the runtime, OS and architecture strings are produced, and both the dump writer and predict use it, so the strings cannot drift.
• Validated on every traced run. Completion compares the predicted E with the E ingestion recorded and stores hit, safe-miss or unsafe-miss (D2). The bar is 0 unsafe misses.
• Rejected: reuse the E of the project's latest recorded run. A runtime update between two runs would then trust traces of the old runtime for one run, with nothing to notice it. Prediction closes that window except where the resolver is wrong, and the validation measures exactly that.
• Rejected: launch the app once to ask. It costs a process start per project per run, which is the latency shadow is meant to avoid measuring.

D5. The promotion bar: every item is a command with a threshold

Measured per test project by dotnet tool run test-prune-traces shadow-report --project <P> (exit 0 when every bar passes). With no --since, the window starts at the project's first shadow row, so it grows until the counts are met:

The payoff bar is not a safety bar. It is there because live mode has a cost (a new code path in every check), and a project where the trace selection launches more than half of what static launches is not worth it yet.

Before promotion, the project must also meet phase 1's bar on that consumer (census, audit, overhead, file census, coverage parity) and run record: "every-run" (phase 1's Task F5).

Promotion is a one-line .fshw.json change per repository: "select": "live". It applies to every eligible project of the repository; an ineligible one keeps static selection. Live mode keeps writing shadow rows (with the static selection as the comparison side), so the misses and recall keep being measured after the switch.

D6. File inputs and child processes

• File reads captured at call sites (phase 1's redirects) are trace inputs of the scope that read them: a fixture's reads are shared by every test linked to that fixture. R3 rehashes each distinct input once per selection.
• What call sites miss is measured by the file census (phase 1 bar: ≤ 5 % symmetric difference). Phase 2 gives the census a use: test-prune-traces file-census --store writes the tests that fail when run outside the repository but recorded no repository input (trace_file_gaps). R7 adds them whenever an unclaimed non-source file changed. The census is re-run (and the gaps replaced) as part of the nightly job the mutation harness runs in.
• The process-level open() interposer stays deferred (ADR 0008). It would turn the census's gap list into per-process read sets. Reconsider it if the gap list grows past 1 % of a project's tests.
• Traced child processes (a woven .NET child) already record into the scope that started them, so their code is in the parent test's trace.
• Untraced child processes (dotnet, sh, sleep, chmod on TestPrune's own suite: 14 tests) mark the starting test incomplete, so R4 selects it on every run. That is sound. Whether a trusted-executable allowlist is worth its risk is decided by a measured threshold (Decisions from review, Q2).

D7. FsHotWatch integration and rollout order

Config (.fshw.json):

{
  "tests": {
    "traces": {
      "record": "every-run",
      "select": "shadow"
    }
  }
}

• select: "off" (the default when the key is absent), "shadow" or "live". Unknown values are a ConfigError. select other than off with record: "off" is a ConfigError (nothing would ever be selected from). live with record: "full-runs" is a ConfigError (traces would go stale between full runs, D2).
• Mode branching stays in TestMode.fs. TestMode.selectsByTrace policy mode is true only for live under ImpactSelection. confirm runs everything by definition. The shadow computation runs in both modes: under PassThrough it is what feeds the trace recall.
• Where: a new src/FsHotWatch.TestPrune/TraceShadow.fs holds everything but the two call sites in TestPrunePlugin.fs: after affectedTestsList at the launch chokepoint, and next to CheckReach.classifyEvidence at completion.
• Symbol store: the flushed index (TestPrune.Ports.toSymbolStore db), the same one ingestion joins against.

Release order (topological; each step waits for the previous to be restorable from NuGet):

1. TestPrune.Core (core-v, Task 1: inline indexed; index SchemaVersion 18 → 19).
2. TestPrune.Trace + Recorder + Cli (trace-v, Tasks 2–10).
3. FsHotWatch (Tasks F1–F4), bundling both.
4. TestPrune's own FsHotWatch pin (Task D1): the dogfood shadow window starts.
5. A consumer's FsHotWatch pin, per its own plan.

The core bump changes the hash scheme folded into E, so every stored trace becomes an R5 mismatch once and is re-recorded by the next full run. That is intended (ADR 0006).

Consumer rollout order (the consumer plan owns the steps; this is the order and the gates):

1. Phase 1's bar met on the consumer's full runs, then record: "every-run".
2. select: "shadow" for the whole repository. Shadow is inert to results, so there is no reason to stage it.
3. Nightly: test-prune-traces file-census --store and test-prune-traces mutate --samples 10 per project.
4. Promote per repository once every project that matters passes shadow-report. Order the consumer's work so the projects without pooled servers reach the bar first (unit before database before browser/integration): integration projects depend on the pool-scope propagation, which is the consumer-side risk.
5. Keep shadow rows flowing after promotion (D5) and re-run shadow-report weekly.

D8. What phase 3 inherits

Phase 3 retires the composition-root barriers and the emptied-project fail-safe for eligible projects. It needs:

• the fallback seeds and their reasons per run (fallback_seeds), to show that no R6 seed reached a marker for 30 days;
• live mode itself (F4), where the barrier walk then only serves R6.

QueryAffectedTests and SeedCoverage are not changed in this phase.

Decisions from review

The first draft's open questions, as settled in review:

• Q1: the Core change is in (Task 1). inline members are indexed as the synthetic attribute TestPrune.Inline, and the index schema goes from 18 to 19. Migration cost, paid once: every host rebuilds its index on the next start, as it does for any schema bump. The hash scheme folded into E is the schema version, so every stored trace becomes an R5 mismatch and is re-recorded by the next full run. Until that run, every test of every project is selected by R5, so every project is ineligible and live mode falls back to static. Nothing is deleted: the old traces stay in the file until garbage collection drops their fingerprint. The alternative (treat every never-executed changed seed as a fallback) needs no Core change, but it brings back the over-selection of code that runs only in production, which is what the design set out to remove.
• Q2: the trusted-executable allowlist is deferred, with a measured decision point. Each shadow row counts child_untraced_tests: the tests selected only by R4 with a child-process-untraced reason. shadow-report prints the median of child_untraced_tests / trace_class_tests over impact rows. If that median exceeds 0.05 (tests held by untraced children are more than 5 % of what the trace selection launches), the allowlist becomes a task. Below it, R4 stays as it is.
• Q3: reflection is answered, and closed by Task 11. A consumer census found no DI or route scanning (every registration is explicit), but two reflection shapes that traces as specified would miss:
  1. Whole-assembly type sweeps. Meta-tests enumerate every type or method of an assembly (wire-contract checks, record-field lint, test-class lint, checks over generated database types), and one production audit loads an assembly by name and enumerates its types, reached only from a test. A new type in an existing file changes their result while no traced symbol changes: the new type has no probe yet, so it is not-probed, and the static walk from it finds no caller, because the call is by reflection.

  2. Union-case enumeration in production code. FSharpType.GetUnionCases over a union, all lists built from it, a generic unionCases<'T> helper, and GetCustomAttributes over the cases. A new case changes behaviour. Adding a case does change the union type's content hash (the header hash keeps the name and order of every case; Task 11 pins it), but the Type symbol is in the enumerating test's trace only if something probed it. typeof<U> compiles to ldtoken, which phase 1 does not probe; a generic helper's typeof<'T> names no type at all; and code that reflects over a value (x.GetType()) has hit only the value's case probes, which join to the DuCase symbols, not to the Type.

Reflection over the type of a value the test itself constructed is already covered where it reads that value's members (its probes are in the trace). Task 11 adds a type-set input (R3) for the first shape and makes ldtoken, repository generic instantiations and the union-reflection APIs touch the Type (R2) for the second. The mutation harness gains a union-type sample kind, and the promotion bar requires it. - Q4: the window is count-driven. The D5 window bar requires the counts, over a minimum of 14 days; the window runs until the counts are met. The counts are not lowered for a repository with few check runs. - Q5: method-level filters are the named next task if class expansion alone fails the payoff bar: the method-level launch ratio (trace_tests / static_tests) passes 0.5 while the class-level one (trace_class_tests / static_class_tests) does not. The report prints both ratios, so the case is visible.

File structure

TestPrune (this repository)

FsHotWatch

Cross-task contracts

Fixed here so tasks that run in parallel agree on names. Every type below is public.

Core (Task 1):

// TestPrune.AstAnalyzer
[<Literal>]
let InlineAttributeName = "TestPrune.Inline"
// TestPrune.Database.SchemaVersion = 19

Recorder (Tasks 3, 7):

namespace TestPrune.Trace.Recorder

/// The strings a dump records for its environment. The one producer: the dump writer and
/// `Fingerprint.predict` both call it.
[<AbstractClass; Sealed>]
type RuntimeIdentity =
    static member Runtime: unit -> string   // RuntimeInformation.FrameworkDescription, e.g. ".NET 10.0.0"
    static member Os: unit -> string        // what the dump's "os" field holds today
    static member Arch: unit -> string      // string RuntimeInformation.ProcessArchitecture

/// Thrown by a probe whose id is listed in TESTPRUNE_TRACE_MUTATE.
type MutantHitException =
    inherit System.Exception
    new: id: int -> MutantHitException
    member Id: int

// Contract.MutateEnv = "TESTPRUNE_TRACE_MUTATE"   (comma-separated probe ids)

Trace store (Task 2), in TestPrune.Trace.TraceStore:

type SymbolFact =
    | Probed        // "probed": some probe of the latest weave joins to the symbol; replaced per ingestion
    | StaticInit    // "static-init": executed inside a static constructor; accumulated
    | Unstable      // "unstable": appeared in or vanished from a trace with nothing changed; accumulated

type VerificationFacts =
    {
        /// Stored test key (unnormalised) -> (complete, incomplete-reason codes).
        Tests: Map<string, bool * string list>
        /// Distinct (symbol_versions.id, full name, version hash) the project's traces reference.
        Versions: (int64 * string * string) list
        /// Distinct (kind, key, hash) inputs of the project's traces.
        Inputs: (string * string * string) list
        /// Stored test keys that have a trace only under another fingerprint.
        OtherFingerprintKeys: Set<string>
        Probed: Set<string>
        StaticInit: Set<string>
        Unstable: Set<string>
    }

type ShadowRunMode =
    | ImpactRun   // "impact": a `check`
    | FullSuiteRun // "full": a `confirm` or nightly (not `RunKind.FullRun`, which names a recorded run)

type SelectPolicy =
    | ShadowPolicy   // "shadow"
    | LivePolicy     // "live"

type FingerprintOutcome =
    | PredictionHit      // "hit"
    | SafeMiss           // "safe-miss"
    | UnsafeMiss         // "unsafe-miss"
    | NotTraced          // "untraced": the run recorded no traces for the project

type ShadowSelectionRow =
    { RunId: string
      TestProject: string
      Mode: ShadowRunMode
      Policy: SelectPolicy
      RecordPolicy: string          // "full-runs" | "every-run"
      TreeHash: string
      RecordedAt: System.DateTimeOffset
      PredictedFingerprint: string
      ActualFingerprint: string option
      FingerprintOutcome: FingerprintOutcome
      Eligible: bool
      CompleteShare: float
      Universe: int
      StaticTests: int
      TraceTests: int
      StaticClasses: int
      TraceClasses: int
      StaticClassTests: int
      TraceClassTests: int
      RuleCounts: Map<string, int>  // "R1".."R7" -> tests carrying that rule
      StaticOnlyClasses: string list   // at most 200, sorted
      TraceOnlyTests: string list      // at most 200, sorted
      ChildUntracedTests: int          // selected only by R4 with a child-process-untraced reason (Q2 decision point)
      Seeds: string list
      FallbackSeeds: Map<string, string>  // seed -> FallReason code
      SelectMs: int64
      TraceRecall: string   // "r/t" | "n/a: <reason>"
      StaticRecall: string }

type MissKind =
    | VerifiedFailure   // "verified-failure"
    | MutationMiss      // "mutation"

type MissCause =
    | Flaky        // "flaky"
    | Unexplained  // "unexplained"

type ShadowMiss =
    { RunId: string          // a run id, or "mutation:<sample id>"
      TestProject: string
      TestKey: string        // normalised
      Kind: MissKind
      Cause: MissCause
      Detail: string }

type MutationOutcome =
    | Measured      // "measured": the mutant made at least one test fail
    | NoFailure     // "no-failure": no test failed
    | NotMutable    // "not-mutable": no probe id maps to the symbol
    | RunFailed     // "run-failed": no CTRF report

type MutationKind =
    | SymbolMutant     // "symbol": the probes of a changed seed throw
    | UnionTypeMutant  // "union-type": every probe and reflective use of a union type throws (Task 11)

type MutationSample =
    { TestProject: string
      Kind: MutationKind
      Symbol: string
      TreeHash: string
      RecordedAt: System.DateTimeOffset
      Outcome: MutationOutcome
      Failing: int
      Selected: int
      Missed: string list }

// Store members added:
//   VerificationFacts(testProject, envFingerprint) : VerificationFacts
//   TestsWithVersions(testProject, envFingerprint, versionIds: int64 list) : (string * string) list      // (test key, symbol)
//   TestsWithInputs(testProject, envFingerprint, inputs: (string * string) list) : (string * string * string) list  // (test key, kind, key)
//   RecordSymbolFacts(testProject, envFingerprint, fact: SymbolFact, symbols: (string * string) list) : unit     // (symbol, evidence)
//   RunFingerprint(runId, testProject) : string option
//   LatestFingerprint(testProject) : string option
//   HasTraces(testProject, envFingerprint) : bool
//   RecordShadow(row: ShadowSelectionRow, misses: ShadowMiss list) : unit
//   RecordMutation(sample: MutationSample, misses: ShadowMiss list) : unit
//   ShadowRows(testProject, since: DateTimeOffset) : ShadowSelectionRow list
//   Misses(testProject, since: DateTimeOffset) : (ShadowMiss * DateTimeOffset) list
//   MutationSamples(testProject, since: DateTimeOffset) : MutationSample list
//   RecordFileGaps(testProject, testKeys: string list) : unit     // replaces the project's gaps
//   FileGaps(testProject) : Set<string>

Selection (Task 5), TestPrune.Trace.TraceSelect:

type FallReason = NotProbed | Inline | Literal | StaticInitOnly | OrderUnstable

type Rule =
    | NoTrace                                 // R1
    | SymbolChanged of symbol: string         // R2
    | InputChanged of kind: string * key: string   // R3
    | Incomplete of reasons: string list      // R4
    | FingerprintMismatch                     // R5
    | StaticFallback of reason: FallReason    // R6
    | UntracedInput of file: string           // R7

type Request =
    { TestProject: string
      EnvFingerprint: string
      Tests: TestPrune.AstAnalyzer.TestMethodInfo list
      CurrentVersions: Map<string, string>
      CurrentInput: string -> string -> string        // kind -> key -> hash now
      Seeds: string list
      ChangedFiles: string list                       // repo-relative, '/'-separated
      IsIndexed: string -> bool
      AttributesOf: string -> string list
      StaticWalk: string list -> TestPrune.AstAnalyzer.TestMethodInfo list
      FileFallback: string list -> TestPrune.AstAnalyzer.TestMethodInfo list option   // None = every test
      FileGaps: Set<string> }

type Selection =
    { TestProject: string
      Eligible: bool
      CompleteShare: float
      Universe: Set<string>             // normalised keys
      Selected: Map<string, Rule list>  // normalised key -> rules, in rule order
      FallbackSeeds: Map<string, FallReason> }

val EligibilityThreshold: float      // 0.99
val normalizeKey: string -> string
val keyOf: TestPrune.AstAnalyzer.TestMethodInfo -> string
val ruleCode: Rule -> string         // "R1".."R7"
val fallCode: FallReason -> string   // "not-probed" | "inline" | "literal" | "static-init" | "order-unstable"
val fallReason: TraceStore.VerificationFacts -> (string -> string list) -> string -> FallReason option
val staticFileFallback: TestPrune.Ports.SymbolStore -> string list -> TestPrune.AstAnalyzer.TestMethodInfo list option
val select: TraceStore.Store -> Request -> Selection

Shadow (Task 6), TestPrune.Trace.Shadow:

type Comparison =
    { StaticTests: Set<string>; TraceTests: Set<string>
      StaticOnly: Set<string>; TraceOnly: Set<string>
      StaticClasses: Set<string>; TraceClasses: Set<string>
      StaticClassTests: int; TraceClassTests: int }

val compare: universe: TestMethodInfo list -> staticSelection: TestMethodInfo list -> trace: TraceSelect.Selection -> Comparison
val verifiedFailureMisses: runId: string -> trace: TraceSelect.Selection -> failedKeys: string list -> isFlaky: (string -> bool) -> TraceStore.ShadowMiss list
val fingerprintOutcome: predicted: string -> actual: string option -> predictedHadTraces: bool -> TraceStore.FingerprintOutcome
val row: ShadowRowInputs -> TraceStore.ShadowSelectionRow

Task graph and parallel groups

G0:  T1 (Core)  ∥  T2 (store)  ∥  T3 (prediction)  ∥  F1  ∥  F2
G1:  T4 (ingest; T2, T3)  ∥  T7a (recorder mutation mode; none)
G1b: T5 (select; T1 interface, T2, T4)
G2:  T6 (shadow; T5)  ∥  T9 (census gaps; T2)  ∥  T11 (reflection inputs; T4, T5 for its reproducers)
G3:  T7b (mutation harness + verb; T5, T7a, T11)  ∥  T8 (report; T2, T6)
G4:  T10 docs + release: core-v (T1), then trace-v (T2–T9, T11)
G5:  F3 shadow wiring (T10 released, F1, F2)  →  F4 live wiring  →  FsHotWatch release
G6:  D1 TestPrune dogfood shadow window (F3/F4 released and pinned)
G7:  D2 promotion of TestPrune to live (D1 bar met)   ∥   consumer rollout (its own plan)

Every task ships on its own:

• New modules are inert until a host calls them.
• Migration 2 adds tables and a column; a phase-1 reader ignores them.
• F3 and F4 are gated on tests.traces.select ≠ off.

Task 1: Index inline as a synthetic attribute (TestPrune.Core)

Files:

• Modify: src/TestPrune.Core/AstAnalyzer.fs (the member-attribute loop near line 2524; add the literal next to the other [<Literal>] names near the top)
• Modify: src/TestPrune.Core/Database.fs:365 (SchemaVersion = 19)
• Modify: src/TestPrune.Core/CHANGELOG.md
• Test: tests/TestPrune.Tests/AstAnalyzerTests.fs (new nested module at the end, in the FCS-AstAnalyzer collection)

Interfaces:

• Produces: TestPrune.AstAnalyzer.InlineAttributeName ("TestPrune.Inline"); every inline member gets one SymbolAttribute { AttributeName = InlineAttributeName; ArgsJson = "[]" }. [<Literal>] values are already indexed with AttributeName = "LiteralAttribute"; this task pins that with a test.

Migration cost (accepted in review, see "Decisions from review", Q1): every host rebuilds its index once, and every stored trace becomes an R5 mismatch until the next full run re-records it. State this in the changelog entry so consumers expect one slow run and one full-suite check after upgrading.

• [ ] Step 1: Describe the change

jj describe -m "Index inline members as the TestPrune.Inline attribute"

• [ ] Step 2: Write the failing tests

Append to tests/TestPrune.Tests/AstAnalyzerTests.fs:

[<Collection("FCS-AstAnalyzer")>]
module ``Traceability attributes`` =

    let private attributesOf (result: AnalysisResult) (name: string) =
        result.Attributes
        |> List.filter (fun a -> a.SymbolFullName = name)
        |> List.map (fun a -> a.AttributeName)

    [<Fact>]
    let ``an inline function carries the TestPrune.Inline attribute`` () =
        let result =
            analyze
                """
module M
let inline twice x = x + x
let plain x = x + 1
"""

        test <@ attributesOf result "M.twice" = [ InlineAttributeName ] @>
        test <@ attributesOf result "M.plain" |> List.isEmpty @>

    [<Fact>]
    let ``an inline member carries the TestPrune.Inline attribute`` () =
        let result =
            analyze
                """
module M
type T() =
    member inline _.Twice(x: int) = x + x
"""

        test <@ result.Attributes |> List.exists (fun a -> a.SymbolFullName.EndsWith "Twice" && a.AttributeName = InlineAttributeName) @>

    [<Fact>]
    let ``a literal is already indexed as LiteralAttribute`` () =
        let result =
            analyze
                """
module M
[<Literal>]
let Answer = 42
"""

        test <@ attributesOf result "M.Answer" = [ "LiteralAttribute" ] @>

• [ ] Step 3: Run the tests and see them fail

Run: dotnet build && dotnet run --project tests/TestPrune.Tests --no-build -- --filter-class "TestPrune.Tests.AstAnalyzerTests+Traceability attributes" Expected: build error The value or constructor 'InlineAttributeName' is not defined.

• [ ] Step 4: Implement

Near the other literals at the top of AstAnalyzer.fs:

/// The synthetic attribute the analyser records on every `inline` member. `inline` is a
/// keyword, not an attribute, so FCS reports no attribute for it; recording it here lets
/// consumers of the attribute index (trace selection) see which members are inlined at
/// their call sites and so leave no trace of their own.
[<Literal>]
let InlineAttributeName = "TestPrune.Inline"

In the member loop, directly after the for attr in mfv.Attributes do … block (inside the same try):

                            if mfv.InlineAnnotation = FSharpInlineAnnotation.AlwaysInline then
                                attributes <-
                                    { SymbolFullName = memberName mfv
                                      AttributeName = InlineAttributeName
                                      ArgsJson = "[]" }
                                    :: attributes

In Database.fs: let SchemaVersion = 19. The comment above it lists what each bump changed; add 19: inline members carry the TestPrune.Inline attribute. in the same style.

• [ ] Step 5: Run the tests and the touched classes

Run: dotnet build && dotnet run --project tests/TestPrune.Tests --no-build -- --filter-class "TestPrune.Tests.AstAnalyzerTests+Traceability attributes" Expected: 3 passed. Run the schema-version pins too: dotnet run --project tests/TestPrune.Tests --no-build -- --filter-class TestPrune.Tests.DatabaseTests Expected: PASS. If a test pins SchemaVersion = 18, update it to 19 in the same commit.

• [ ] Step 6: Changelog and commit

src/TestPrune.Core/CHANGELOG.md, under Unreleased: - feat!: inline members are indexed with the synthetic attribute TestPrune.Inline. Index schema 19: existing indexes are rebuilt on first start, and recorded traces (whose fingerprint includes the schema) are re-recorded by the next full run.

mise run ci > "$CLAUDE_JOB_DIR/tmp/t1-ci.log" 2>&1; echo "exit=$?"
jj new

Expected: exit=0.

Task 2: Trace store migration 2 and the selection queries

Files:

• Modify: src/TestPrune.Trace/TraceStore.fs
• Test: tests/TestPrune.Trace.Tests/TraceStoreTests.fs (append a module Phase2)

Interfaces:

• Consumes: the phase-1 Store, RecordRun, CollectGarbage.

• Produces: every type and member in "Cross-task contracts → Trace store".

• [ ] Step 1: Describe the change

jj describe -m "Trace store: migration 2 for selection facts and shadow rows"

• [ ] Step 2: Write the failing tests

Append to tests/TestPrune.Trace.Tests/TraceStoreTests.fs (the file already has a helper that opens a store in a temp directory; reuse it as withStore; if it is named differently, use that name):

module Phase2 =
    open System
    open TestPrune.Trace.Model
    open TestPrune.Trace.TraceStore

    let private run id fp : TraceRun =
        { RunId = id
          TestProject = "P"
          TreeHash = "t"
          EnvFingerprint = fp
          RecordedAt = DateTimeOffset(2026, 9, 27, 0, 0, 0, TimeSpan.Zero)
          Kind = RunKind.FullRun
          Status = Recorded
          Reason = ""
          StatsJson = "{}" }

    let private scope key symbols inputs : ScopeContent =
        { Key = key; Symbols = symbols; Inputs = inputs }

    let private testTrace key reasons scopes : TestTrace =
        { TestKey = key; Status = Some Passed; Reasons = reasons; ScopeKeys = scopes }

    /// Two tests: A executes f and reads a.json through its class fixture; B executes g and
    /// is incomplete. A third test has a trace only under another fingerprint.
    let private seeded (store: Store) =
        store.RecordRun(
            run "r1" "E1",
            [ scope "T:a" [ "N.f", "hf" ] []
              scope "C:K" [] [ "read", "a.json", "ha" ]
              scope "T:b" [ "N.g", "hg" ] [] ],
            [ testTrace "P|K|a" [] [ "T:a"; "C:K" ]
              testTrace "P|K|b" [ NoOutcome ] [ "T:b" ] ]
        )

        store.RecordRun(run "r0" "E0", [ scope "T:c" [ "N.f", "hf" ] [] ], [ testTrace "P|K|c" [] [ "T:c" ] ])

    [<Fact>]
    let ``migration 2 applies to a phase-1 file and keeps its traces`` () =
        let path = IO.Path.Combine(IO.Directory.CreateTempSubdirectory().FullName, "t.db")

        using (Store.OpenWith(List.truncate 1 migrations, path)) (fun v1 ->
            v1.RecordRun(run "r1" "E1", [ scope "T:a" [ "N.f", "hf" ] [] ], [ testTrace "P|K|a" [] [ "T:a" ] ]))

        using (Store.Open path) (fun v2 ->
            test <@ TraceSchemaVersion = 2 @>
            test <@ v2.RunFingerprint("r1", "P") = Some "E1" @>
            test <@ (v2.VerificationFacts("P", "E1")).Tests.ContainsKey "P|K|a" @>)

    [<Fact>]
    let ``verification facts read the project's traces under one fingerprint`` () =
        withStore (fun _ store ->
            seeded store
            let f = store.VerificationFacts("P", "E1")
            test <@ f.Tests = Map.ofList [ "P|K|a", (true, []); "P|K|b", (false, [ "no-outcome" ]) ] @>
            test <@ f.Versions |> List.map (fun (_, n, h) -> n, h) |> List.sort = [ "N.f", "hf"; "N.g", "hg" ] @>
            test <@ f.Inputs = [ "read", "a.json", "ha" ] @>
            test <@ f.OtherFingerprintKeys = set [ "P|K|c" ] @>)

    [<Fact>]
    let ``tests linked to stale versions and inputs, through inherited scopes`` () =
        withStore (fun _ store ->
            seeded store
            let f = store.VerificationFacts("P", "E1")
            let fId = f.Versions |> List.pick (fun (id, n, _) -> if n = "N.f" then Some id else None)
            test <@ store.TestsWithVersions("P", "E1", [ fId ]) = [ "P|K|a", "N.f" ] @>
            test <@ store.TestsWithInputs("P", "E1", [ "read", "a.json" ]) = [ "P|K|a", "read", "a.json" ] @>
            test <@ store.TestsWithVersions("P", "E1", []) |> List.isEmpty @>)

    [<Fact>]
    let ``probed facts are replaced, static-init and unstable facts accumulate`` () =
        withStore (fun _ store ->
            store.RecordSymbolFacts("P", "E1", Probed, [ "N.f", ""; "N.g", "" ])
            store.RecordSymbolFacts("P", "E1", Probed, [ "N.f", "" ])
            store.RecordSymbolFacts("P", "E1", StaticInit, [ "N.s", "" ])
            store.RecordSymbolFacts("P", "E1", StaticInit, [ "N.t", "" ])
            store.RecordSymbolFacts("P", "E1", Unstable, [ "N.u", "P|K|a" ])
            let f = store.VerificationFacts("P", "E1")
            test <@ f.Probed = set [ "N.f" ] @>
            test <@ f.StaticInit = set [ "N.s"; "N.t" ] @>
            test <@ f.Unstable = set [ "N.u" ] @>)

    let private shadowRow runId at : ShadowSelectionRow =
        { RunId = runId
          TestProject = "P"
          Mode = ImpactRun
          Policy = ShadowPolicy
          RecordPolicy = "every-run"
          TreeHash = "t"
          RecordedAt = at
          PredictedFingerprint = "E1"
          ActualFingerprint = Some "E1"
          FingerprintOutcome = PredictionHit
          Eligible = true
          CompleteShare = 1.0
          Universe = 2
          StaticTests = 2
          TraceTests = 1
          StaticClasses = 1
          TraceClasses = 1
          StaticClassTests = 2
          TraceClassTests = 2
          RuleCounts = Map.ofList [ "R2", 1 ]
          StaticOnlyClasses = []
          TraceOnlyTests = []
          ChildUntracedTests = 0
          Seeds = [ "N.f" ]
          FallbackSeeds = Map.empty
          SelectMs = 12L
          TraceRecall = "n/a: impact run"
          StaticRecall = "n/a: impact run" }

    [<Fact>]
    let ``a shadow row and its misses round-trip`` () =
        withStore (fun _ store ->
            let at = DateTimeOffset(2026, 9, 27, 12, 0, 0, TimeSpan.Zero)

            let miss =
                { RunId = "r1"; TestProject = "P"; TestKey = "P|K|b"; Kind = VerifiedFailure
                  Cause = Unexplained; Detail = "failed while its trace verified" }

            store.RecordShadow(shadowRow "r1" at, [ miss ])
            test <@ store.ShadowRows("P", at.AddDays -1.0) = [ shadowRow "r1" at ] @>
            test <@ store.Misses("P", at.AddDays -1.0) = [ miss, at ] @>
            test <@ store.ShadowRows("P", at.AddDays 1.0) |> List.isEmpty @>)

    [<Fact>]
    let ``file gaps are replaced per project`` () =
        withStore (fun _ store ->
            store.RecordFileGaps("P", [ "P|K|a"; "P|K|b" ])
            store.RecordFileGaps("P", [ "P|K|b" ])
            test <@ store.FileGaps "P" = set [ "P|K|b" ] @>)

• [ ] Step 3: Run them and see them fail

Run: dotnet build && dotnet run --project tests/TestPrune.Trace.Tests --no-build -- --filter-class "TestPrune.Trace.Tests.TraceStoreTests+Phase2" Expected: build errors naming VerificationFacts, RecordSymbolFacts, ShadowSelectionRow.

• [ ] Step 4: Implement migration 2

Append a second entry to migrations (never edit entry 1):

      2,
      """
      ALTER TABLE trace_runs ADD COLUMN fingerprint_inputs TEXT NOT NULL DEFAULT '{}';
      CREATE TABLE trace_symbol_facts (
          test_project TEXT NOT NULL,
          env_fingerprint TEXT NOT NULL,
          fact TEXT NOT NULL CHECK (fact IN ('probed', 'static-init', 'unstable')),
          symbol_full_name TEXT NOT NULL,
          evidence TEXT NOT NULL DEFAULT '',
          PRIMARY KEY (test_project, env_fingerprint, fact, symbol_full_name)) WITHOUT ROWID;
      CREATE TABLE trace_file_gaps (
          test_project TEXT NOT NULL,
          test_key TEXT NOT NULL,
          PRIMARY KEY (test_project, test_key)) WITHOUT ROWID;
      CREATE TABLE shadow_selections (
          id INTEGER PRIMARY KEY,
          run_id TEXT NOT NULL,
          test_project TEXT NOT NULL,
          recorded_at TEXT NOT NULL,
          row_json TEXT NOT NULL,
          UNIQUE (run_id, test_project));
      CREATE INDEX shadow_selections_by_project ON shadow_selections (test_project, recorded_at);
      CREATE TABLE shadow_misses (
          run_id TEXT NOT NULL,
          test_project TEXT NOT NULL,
          test_key TEXT NOT NULL,
          kind TEXT NOT NULL CHECK (kind IN ('verified-failure', 'mutation')),
          cause TEXT NOT NULL CHECK (cause IN ('flaky', 'unexplained')),
          detail TEXT NOT NULL DEFAULT '',
          recorded_at TEXT NOT NULL,
          PRIMARY KEY (run_id, test_project, test_key, kind)) WITHOUT ROWID;
      CREATE TABLE mutation_samples (
          id INTEGER PRIMARY KEY,
          test_project TEXT NOT NULL,
          recorded_at TEXT NOT NULL,
          sample_json TEXT NOT NULL);
      CREATE INDEX mutation_samples_by_project ON mutation_samples (test_project, recorded_at);
      """

A shadow row is stored as one JSON document (row_json) plus the columns the report filters on. The row's shape will grow while shadow runs; a JSON column lets it grow without a migration per field, and the report reads whole rows anyway.

• [ ] Step 5: Implement the types and members

Add the types from "Cross-task contracts → Trace store" above Store. Code tables for the text codes:

let private factCode =
    function
    | Probed -> "probed"
    | StaticInit -> "static-init"
    | Unstable -> "unstable"

let private missKindCode =
    function
    | VerifiedFailure -> "verified-failure"
    | MutationMiss -> "mutation"

let private missKindOf =
    function
    | "mutation" -> MutationMiss
    | _ -> VerifiedFailure

let private causeCode =
    function
    | Flaky -> "flaky"
    | Unexplained -> "unexplained"

let private causeOf =
    function
    | "flaky" -> Flaky
    | _ -> Unexplained

ShadowSelectionRow and MutationSample hold F# unions, which System.Text.Json does not serialise without a converter, and the repository takes no converter package. Serialise them through DTO records whose union fields are the text codes (mode: impact/full, policy: shadow/live, fingerprintOutcome, outcome), with four small functions rowToJson, rowOfJson, sampleToJson, sampleOfJson, each a field-by-field copy plus the code tables. Keep the DTOs public: System.Text.Json serialises a non-public F# record as {}, as RunStats already notes.

Members on Store (each a single statement or one transaction; json_each for every key list, ADR 0003):

    member _.VerificationFacts(testProject: string, envFingerprint: string) : VerificationFacts =
        let ps = [ "@p", box testProject; "@e", box envFingerprint ]

        let tests =
            readRows conn "SELECT test_key, complete, incomplete_reasons FROM trace_tests WHERE test_project = @p AND env_fingerprint = @e" ps (fun r ->
                r.GetString 0, (r.GetInt64 1 = 1L, JsonSerializer.Deserialize<string[]>(r.GetString 2) |> List.ofArray))
            |> Map.ofList

        let versions =
            readRows conn """SELECT DISTINCT v.id, v.symbol_full_name, v.content_hash FROM trace_tests t
                   JOIN trace_test_scopes ts ON ts.test_id = t.id
                   JOIN trace_entries e ON e.scope_id = ts.scope_id
                   JOIN symbol_versions v ON v.id = e.symbol_version_id
                   WHERE t.test_project = @p AND t.env_fingerprint = @e""" ps (fun r -> r.GetInt64 0, r.GetString 1, r.GetString 2)

        let inputs =
            readRows conn """SELECT DISTINCT i.kind, i.key, i.hash FROM trace_tests t
                   JOIN trace_test_scopes ts ON ts.test_id = t.id
                   JOIN trace_inputs i ON i.scope_id = ts.scope_id
                   WHERE t.test_project = @p AND t.env_fingerprint = @e ORDER BY i.kind, i.key""" ps (fun r -> r.GetString 0, r.GetString 1, r.GetString 2)

        let others =
            readRows conn "SELECT DISTINCT test_key FROM trace_tests WHERE test_project = @p AND env_fingerprint <> @e" ps (fun r -> r.GetString 0)
            |> Set.ofList
            |> fun s -> Set.difference s (tests |> Map.keys |> Set.ofSeq)

        let facts =
            readRows conn "SELECT fact, symbol_full_name FROM trace_symbol_facts WHERE test_project = @p AND env_fingerprint = @e" ps (fun r -> r.GetString 0, r.GetString 1)

        let factSet code =
            facts |> List.choose (fun (f, n) -> if f = code then Some n else None) |> Set.ofList

        { Tests = tests
          Versions = versions
          Inputs = inputs
          OtherFingerprintKeys = others
          Probed = factSet "probed"
          StaticInit = factSet "static-init"
          Unstable = factSet "unstable" }

    member _.TestsWithVersions(testProject: string, envFingerprint: string, versionIds: int64 list) : (string * string) list =
        if List.isEmpty versionIds then
            []
        else
            readRows conn """SELECT DISTINCT t.test_key, v.symbol_full_name FROM trace_tests t
                   JOIN trace_test_scopes ts ON ts.test_id = t.id
                   JOIN trace_entries e ON e.scope_id = ts.scope_id
                   JOIN symbol_versions v ON v.id = e.symbol_version_id
                   WHERE t.test_project = @p AND t.env_fingerprint = @e
                     AND e.symbol_version_id IN (SELECT value FROM json_each(@ids))
                   ORDER BY t.test_key, v.symbol_full_name"""
                [ "@p", box testProject; "@e", box envFingerprint; "@ids", box (JsonSerializer.Serialize(Array.ofList versionIds)) ]
                (fun r -> r.GetString 0, r.GetString 1)

    member _.TestsWithInputs(testProject: string, envFingerprint: string, inputs: (string * string) list) : (string * string * string) list =
        if List.isEmpty inputs then
            []
        else
            let pairs = inputs |> List.map (fun (k, key) -> [| k; key |]) |> Array.ofList

            readRows conn """SELECT DISTINCT t.test_key, i.kind, i.key FROM trace_tests t
                   JOIN trace_test_scopes ts ON ts.test_id = t.id
                   JOIN trace_inputs i ON i.scope_id = ts.scope_id
                   WHERE t.test_project = @p AND t.env_fingerprint = @e
                     AND EXISTS (SELECT 1 FROM json_each(@inputs) j
                                 WHERE json_extract(j.value, '$[0]') = i.kind AND json_extract(j.value, '$[1]') = i.key)
                   ORDER BY t.test_key, i.kind, i.key"""
                [ "@p", box testProject; "@e", box envFingerprint; "@inputs", box (JsonSerializer.Serialize pairs) ]
                (fun r -> r.GetString 0, r.GetString 1, r.GetString 2)

    member _.RecordSymbolFacts(testProject: string, envFingerprint: string, fact: SymbolFact, symbols: (string * string) list) : unit =
        inTransaction conn (fun tx ->
            let ps = [ "@p", box testProject; "@e", box envFingerprint; "@f", box (factCode fact) ]

            if fact = Probed then
                exec conn tx "DELETE FROM trace_symbol_facts WHERE test_project = @p AND env_fingerprint = @e AND fact = @f" ps

            for name, evidence in List.distinctBy fst symbols do
                exec conn tx """INSERT OR IGNORE INTO trace_symbol_facts (test_project, env_fingerprint, fact, symbol_full_name, evidence)
                       VALUES (@p, @e, @f, @n, @ev)""" (ps @ [ "@n", box name; "@ev", box evidence ]))

RunFingerprint, LatestFingerprint (the newest recorded run's fingerprint), HasTraces (any trace_tests row), RecordShadow (upsert the row by (run_id, test_project), insert-or-replace each miss with the row's recorded_at, one transaction), RecordMutation (insert the sample; its misses use run id mutation:<new id>), ShadowRows, Misses, MutationSamples (filter recorded_at >= @since on the ISO-8601 text, which sorts chronologically for one offset: always write ToUniversalTime().ToString "O"), RecordFileGaps (delete the project's rows, insert the new set, one transaction) and FileGaps follow the same pattern.

Extend CollectGarbage with one statement at the end: facts of a fingerprint the project no longer has traces under are dropped.

            exec conn tx """DELETE FROM trace_symbol_facts WHERE test_project = @p
                   AND env_fingerprint NOT IN (SELECT DISTINCT env_fingerprint FROM trace_tests WHERE test_project = @p)"""
                [ "@p", box testProject ]

Shadow rows, misses and samples are never garbage-collected by ingestion: they are the measurement record. The report verb reads a window; shadow-report --prune-before <date> (Task 8) is the only delete.

• [ ] Step 6: Run the new and the touched classes

Run: dotnet build && dotnet run --project tests/TestPrune.Trace.Tests --no-build -- --filter-class TestPrune.Trace.Tests.TraceStoreTests Expected: PASS, including every phase-1 test in the file (the migration test that pins version 1 now reads TraceSchemaVersion = 2; update it and keep its "a newer file is refused" case).

• [ ] Step 7: Gate and commit

mise run ci > "$CLAUDE_JOB_DIR/tmp/t2-ci.log" 2>&1; echo "exit=$?"
jj new

Task 3: Predicting the fingerprint (RuntimeIdentity, RuntimeResolution, Fingerprint.predict)

Files:

• Create: src/TestPrune.Trace.Recorder/RuntimeIdentity.fs (compile before DumpWriter.fs)
• Modify: src/TestPrune.Trace.Recorder/DumpWriter.fs:39-41 (use RuntimeIdentity)
• Create: src/TestPrune.Trace/RuntimeResolution.fs (compile after Fingerprint.fs)
• Modify: src/TestPrune.Trace/Fingerprint.fs (toJson, diff, predict)
• Test: tests/TestPrune.Trace.Tests/RuntimeResolutionTests.fs (new), FingerprintTests.fs (append)

Interfaces:

• Produces:

module TestPrune.Trace.RuntimeResolution
/// (framework name, requested version, rollForward) of Microsoft.NETCore.App in a runtimeconfig.json.
val requestedFramework: runtimeConfigJson: string -> (string * string) option     // version, rollForward ("Minor" when absent)
val installed: dotnetRoot: string -> string list          // directory names under shared/Microsoft.NETCore.App
val resolve: requested: string -> rollForward: string -> installed: string list -> string option
val describe: version: string -> string                   // ".NET " + version
val predictRuntime: dotnetRoot: string -> runtimeConfigPath: string -> rollForwardEnv: string option -> string option

module TestPrune.Trace.Fingerprint
val toJson: Inputs -> string                 // the canonical JSON `compute` hashes
val diff: Inputs -> Inputs -> string list    // names of differing components, sorted
val predict: repoRoot: string -> files: string list -> env: string list -> depsJsonSha256: string -> runtime: string -> Inputs

• [ ] Step 1: Describe the change

jj describe -m "Predict a traced run's environment fingerprint before it starts"

• [ ] Step 2: Write the failing tests

tests/TestPrune.Trace.Tests/RuntimeResolutionTests.fs:

module TestPrune.Trace.Tests.RuntimeResolutionTests

open Xunit
open Swensen.Unquote
open TestPrune.Trace.RuntimeResolution

let installedSet = [ "8.0.8"; "8.0.11"; "9.0.1"; "10.0.0"; "10.0.2"; "11.0.0-preview.1.25" ]

[<Theory>]
[<InlineData("10.0.0", "Minor", "10.0.2")>]         // same major.minor: its latest patch
[<InlineData("8.0.0", "Minor", "8.0.11")>]
[<InlineData("8.1.0", "Minor", null)>]              // no 8.x >= 8.1 installed
[<InlineData("9.0.0", "LatestPatch", "9.0.1")>]
[<InlineData("9.2.0", "LatestPatch", null)>]
[<InlineData("8.0.0", "Major", "8.0.11")>]
[<InlineData("7.0.0", "Major", "8.0.11")>]          // lowest higher major, its latest patch
[<InlineData("8.0.0", "LatestMinor", "8.0.11")>]
[<InlineData("8.0.0", "LatestMajor", "10.0.2")>]    // releases only while one satisfies
[<InlineData("10.0.0", "Disable", "10.0.0")>]
[<InlineData("10.0.1", "Disable", null)>]
let ``roll-forward picks the runtime the host would`` (requested: string, rollForward: string, expected: string) =
    test <@ resolve requested rollForward installedSet = Option.ofObj expected @>

[<Fact>]
let ``a prerelease is chosen only when the request is a prerelease`` () =
    test <@ resolve "11.0.0-preview.1.25" "Minor" installedSet = Some "11.0.0-preview.1.25" @>
    test <@ resolve "11.0.0" "Minor" installedSet = None @>

[<Fact>]
let ``runtimeconfig framework and rollForward are read`` () =
    let json =
        """{"runtimeOptions":{"tfm":"net10.0","rollForward":"Major","framework":{"name":"Microsoft.NETCore.App","version":"10.0.0"}}}"""

    test <@ requestedFramework json = Some("10.0.0", "Major") @>

[<Fact>]
let ``an app with several frameworks is keyed on Microsoft.NETCore.App`` () =
    let json =
        """{"runtimeOptions":{"frameworks":[{"name":"Microsoft.AspNetCore.App","version":"10.0.0"},{"name":"Microsoft.NETCore.App","version":"10.0.0"}]}}"""

    test <@ requestedFramework json = Some("10.0.0", "Minor") @>

[<Fact>]
let ``the description matches the recorder's for this process`` () =
    let running = System.Environment.Version.ToString 3
    test <@ describe running = TestPrune.Trace.Recorder.RuntimeIdentity.Runtime() @>

Append to FingerprintTests.fs:

[<Fact>]
let ``predict equals gather for the same environment`` () =
    let root = System.IO.Directory.CreateTempSubdirectory().FullName
    System.IO.File.WriteAllText(System.IO.Path.Combine(root, "global.json"), "{}")

    let dump =
        { Pid = 1; ParentScope = None
          Runtime = TestPrune.Trace.Recorder.RuntimeIdentity.Runtime()
          Os = TestPrune.Trace.Recorder.RuntimeIdentity.Os()
          Arch = TestPrune.Trace.Recorder.RuntimeIdentity.Arch()
          IdCount = 0; CpuMs = 0L
          Counters = { Test = 0L; Class = 0L; Collection = 0L; Assembly = 0L; Override = 0L; StaticInit = 0L; Ambient = 0L; Overflow = 0L }
          Scopes = [] }

    let gathered = Fingerprint.gather root [ "global.json" ] [ "HOME" ] dump "deps"
    let predicted = Fingerprint.predict root [ "global.json" ] [ "HOME" ] "deps" dump.Runtime
    test <@ predicted = gathered @>
    test <@ Fingerprint.diff predicted gathered |> List.isEmpty @>

[<Fact>]
let ``diff names the components that differ`` () =
    let a = Fingerprint.predict "/nowhere" [] [] "d1" ".NET 10.0.0"
    let b = { a with Runtime = ".NET 10.0.2"; DepsJsonSha256 = "d2" }
    test <@ Fingerprint.diff a b = [ "deps"; "runtime" ] @>

• [ ] Step 3: Run and see them fail

Run: dotnet build && dotnet run --project tests/TestPrune.Trace.Tests --no-build -- --filter-class TestPrune.Trace.Tests.RuntimeResolutionTests Expected: build error: RuntimeResolution is not defined.

• [ ] Step 4: Implement RuntimeIdentity (recorder, net8.0, no new dependency). Move osNameOf out of DumpWriter.fs into this file unchanged, and make DumpWriter write RuntimeIdentity.Runtime(), RuntimeIdentity.Os() and RuntimeIdentity.Arch(). The dump bytes must not change; the dump round-trip tests pin them.

namespace TestPrune.Trace.Recorder

open System.Runtime.InteropServices

/// The environment strings a dump records. The dump writer and the host's fingerprint
/// prediction both call these, so a prediction compares like with like.
[<AbstractClass; Sealed>]
type RuntimeIdentity =
    // `osNameOf`, moved here verbatim from DumpWriter.fs, as a private static member.

    /// `RuntimeInformation.FrameworkDescription`, e.g. ".NET 10.0.0".
    static member Runtime() : string = RuntimeInformation.FrameworkDescription

    /// The OS name, as the dump's "os" field has always recorded it.
    static member Os() : string = RuntimeIdentity.osNameOf RuntimeInformation.IsOSPlatform

    /// The process architecture, e.g. "Arm64".
    static member Arch() : string = string RuntimeInformation.ProcessArchitecture

• [ ] Step 5: Implement RuntimeResolution

/// Which Microsoft.NETCore.App an apphost will load, computed the way the .NET host
/// resolves it (runtimeconfig `rollForward`, or `DOTNET_ROLL_FORWARD`, over the runtimes
/// installed under DOTNET_ROOT). Used only to predict a fingerprint; every prediction is
/// checked against the runtime the run then reports.
module TestPrune.Trace.RuntimeResolution

open System
open System.IO
open System.Text.Json

type private V =
    { Major: int; Minor: int; Patch: int; Pre: string; Text: string }

let private parse (text: string) : V option =
    let core, pre =
        match text.IndexOf '-' with
        | -1 -> text, ""
        | i -> text.Substring(0, i), text.Substring(i + 1)

    match core.Split '.' |> Array.map Int32.TryParse with
    | [| (true, a); (true, b); (true, c) |] -> Some { Major = a; Minor = b; Patch = c; Pre = pre; Text = text }
    | _ -> None

let private key (v: V) = v.Major, v.Minor, v.Patch

let requestedFramework (runtimeConfigJson: string) : (string * string) option =
    use doc = JsonDocument.Parse runtimeConfigJson
    let opts = doc.RootElement.GetProperty "runtimeOptions"

    let rollForward =
        match opts.TryGetProperty "rollForward" with
        | true, v -> v.GetString()
        | _ -> "Minor"

    let frameworks =
        [ match opts.TryGetProperty "framework" with
          | true, f -> f
          | _ -> ()
          match opts.TryGetProperty "frameworks" with
          | true, fs -> yield! fs.EnumerateArray()
          | _ -> () ]

    frameworks
    |> List.tryFind (fun f -> f.GetProperty("name").GetString() = "Microsoft.NETCore.App")
    |> Option.map (fun f -> f.GetProperty("version").GetString(), rollForward)

let installed (dotnetRoot: string) : string list =
    let dir = Path.Combine(dotnetRoot, "shared", "Microsoft.NETCore.App")

    if Directory.Exists dir then
        Directory.GetDirectories dir |> Array.map Path.GetFileName |> Array.sort |> List.ofArray
    else
        []

let resolve (requested: string) (rollForward: string) (installedVersions: string list) : string option =
    match parse requested with
    | None -> None
    | Some req ->
        let candidates =
            installedVersions
            |> List.choose parse
            // A prerelease runtime satisfies only a prerelease request, as the host does.
            |> List.filter (fun v -> v.Pre = "" || req.Pre <> "")
            |> List.filter (fun v -> key v >= key req)

        let latestPatchOf (vs: V list) (major, minor) =
            vs
            |> List.filter (fun v -> v.Major = major && v.Minor = minor)
            |> List.sortByDescending key
            |> List.tryHead

        let lowestMinorThenLatestPatch (vs: V list) =
            vs
            |> List.sortBy key
            |> List.tryHead
            |> Option.bind (fun v -> latestPatchOf vs (v.Major, v.Minor))

        let sameMajor = candidates |> List.filter (fun v -> v.Major = req.Major)

        let chosen =
            match rollForward.ToLowerInvariant() with
            | "disable" -> candidates |> List.tryFind (fun v -> v.Text = req.Text)
            | "latestpatch" -> latestPatchOf candidates (req.Major, req.Minor)
            | "minor" -> lowestMinorThenLatestPatch sameMajor
            | "major" ->
                lowestMinorThenLatestPatch sameMajor
                |> Option.orElseWith (fun () -> lowestMinorThenLatestPatch candidates)
            | "latestminor" -> sameMajor |> List.sortByDescending key |> List.tryHead
            | "latestmajor" -> candidates |> List.sortByDescending key |> List.tryHead
            | _ -> None

        chosen |> Option.map (fun v -> v.Text)

let describe (version: string) : string = ".NET " + version

let predictRuntime (dotnetRoot: string) (runtimeConfigPath: string) (rollForwardEnv: string option) : string option =
    if not (File.Exists runtimeConfigPath) then
        None
    else
        requestedFramework (File.ReadAllText runtimeConfigPath)
        |> Option.bind (fun (version, configured) ->
            let policy = rollForwardEnv |> Option.defaultValue configured
            resolve version policy (installed dotnetRoot))
        |> Option.map describe

The "Minor" branch follows the host: the requested major.minor if installed, else the lowest higher minor, each at its latest patch. Check the table in the test against the .NET docs page "Framework-dependent apps roll forward" before relying on it, and keep the test as the pin.

• [ ] Step 6: Implement toJson, diff, predict in Fingerprint.fs:

/// The canonical JSON `compute` hashes; stored with every recorded run so a prediction
/// miss can say which component differed.
let toJson (i: Inputs) : string =
    let pairs (xs: (string * string) list) =
        xs |> List.sort |> List.map (fun (k, v) -> k + "=" + v) |> List.toArray

    JsonSerializer.Serialize(
        { arch = i.Arch
          deps = i.DepsJsonSha256
          env = pairs i.ConfigEnv
          files = pairs i.ConfigFiles
          hashScheme = i.HashScheme
          os = i.Os
          recorder = i.RecorderVersion
          runtime = i.Runtime
          weaver = i.WeaverVersion }
        : CanonicalFingerprint
    )

let compute (i: Inputs) : string =
    toJson i |> Encoding.UTF8.GetBytes |> sha256Hex

/// The canonical field names whose values differ, sorted.
let diff (a: Inputs) (b: Inputs) : string list =
    let fields (i: Inputs) =
        use doc = JsonDocument.Parse(toJson i)
        doc.RootElement.EnumerateObject() |> Seq.map (fun p -> p.Name, p.Value.GetRawText()) |> Map.ofSeq

    let fa, fb = fields a, fields b
    fa |> Map.toList |> List.filter (fun (k, v) -> fb.[k] <> v) |> List.map fst |> List.sort

/// The fingerprint a traced launch will record, computed before it starts: `gather` with
/// the runtime predicted by `RuntimeResolution` and this host's OS and architecture.
let predict (repoRoot: string) (files: string list) (env: string list) (depsJsonSha256: string) (runtime: string) : Inputs =
    let dump: ProcessDump =
        { Pid = 0
          ParentScope = None
          Runtime = runtime
          Os = TestPrune.Trace.Recorder.RuntimeIdentity.Os()
          Arch = TestPrune.Trace.Recorder.RuntimeIdentity.Arch()
          IdCount = 0
          CpuMs = 0L
          Counters =
            { Test = 0L; Class = 0L; Collection = 0L; Assembly = 0L
              Override = 0L; StaticInit = 0L; Ambient = 0L; Overflow = 0L }
          Scopes = [] }

    gather repoRoot files env dump depsJsonSha256

compute keeps its output byte-for-byte (the existing fingerprint tests pin it).

• [ ] Step 7: Run the new and touched classes

Run: dotnet build && dotnet run --project tests/TestPrune.Trace.Tests --no-build -- --filter-class TestPrune.Trace.Tests.RuntimeResolutionTests --filter-class TestPrune.Trace.Tests.FingerprintTests --filter-class TestPrune.Trace.Tests.DumpRoundTripTests Expected: PASS.

• [ ] Step 8: Gate and commit

mise run ci > "$CLAUDE_JOB_DIR/tmp/t3-ci.log" 2>&1; echo "exit=$?"
jj new

Task 4: Ingestion records selection facts and detects order-unstable symbols

Files:

• Modify: src/TestPrune.Trace/TraceIngest.fs
• Modify: src/TestPrune.Trace/TraceStore.fs (TraceRun.FingerprintInputs: string, written into trace_runs.fingerprint_inputs)
• Test: tests/TestPrune.Trace.Tests/TraceIngestTests.fs (append)

Interfaces:

• Consumes: Task 2's RecordSymbolFacts, TryRead.
• Produces:

// TraceIngest
val inputHash: root: string -> kind: string -> key: string -> string   // "read" | "exists" | "list" | "file-level"
val detectUnstable:
    currentVersions: Map<string, string> ->
    old: TraceStore.StoredTrace ->
    newSymbols: Set<string * string> ->
    newInputs: Set<string * string * string> ->
    newComplete: bool ->
        Set<string>
// IngestSummary gains: UnstableSymbols: int

• [ ] Step 1: Describe the change

jj describe -m "Ingestion: record probed and static-init symbols, detect order-unstable ones"

• [ ] Step 2: Write the failing tests (append to TraceIngestTests.fs; the file's World type builds a repository, an index with N.M.f and N.M.g, a three-row manifest and dumps from a real RecorderState; reuse it, and add what is missing to it rather than a second world):

[<Fact>]
let ``ingestion records the probed symbols of the weave`` () =
    use w = new World()
    let summary = w.IngestPassing [ "T:a", [ 0 ] ]
    let facts = w.Store.VerificationFacts("P", summary.EnvFingerprint.Value)
    test <@ facts.Probed = set [ "N.M.f"; "N.M.g" ] @>

[<Fact>]
let ``symbols executed in a static constructor are recorded as static-init facts`` () =
    use w = new World()
    let summary = w.IngestPassingWithStaticInit [ "T:a", [ 0 ] ] [ 1 ]
    let facts = w.Store.VerificationFacts("P", summary.EnvFingerprint.Value)
    test <@ facts.StaticInit = set [ "N.M.g" ] @>

[<Fact>]
let ``a trace that changes with nothing changed flags the differing symbols`` () =
    use w = new World()
    w.IngestPassing [ "T:a", [ 0 ] ] |> ignore
    let second = w.IngestPassing [ "T:a", [ 0; 1 ] ]
    let facts = w.Store.VerificationFacts("P", second.EnvFingerprint.Value)
    test <@ facts.Unstable = set [ "N.M.g" ] @>
    test <@ second.UnstableSymbols = 1 @>

[<Fact>]
let ``a trace that changes because its code changed flags nothing`` () =
    use w = new World()
    w.IngestPassing [ "T:a", [ 0 ] ] |> ignore
    w.EditSymbol "N.M.f" "hf2"
    let second = w.IngestPassing [ "T:a", [ 0; 1 ] ]
    test <@ second.UnstableSymbols = 0 @>

[<Fact>]
let ``detectUnstable is pure over the two traces`` () =
    let old: TraceStore.StoredTrace =
        { TestKey = "P|K|a"; EnvFingerprint = "E"; RunId = "r"; Complete = true; Reasons = []
          Symbols = set [ "a", "1"; "b", "1" ]; Inputs = Set.empty }

    let current = Map.ofList [ "a", "1"; "b", "1"; "c", "1" ]
    test <@ detectUnstable current old (set [ "a", "1"; "c", "1" ]) Set.empty true = set [ "b"; "c" ] @>
    // an incomplete side proves nothing
    test <@ detectUnstable current old (set [ "a", "1" ]) Set.empty false |> Set.isEmpty @>
    // a changed input explains the difference
    test <@ detectUnstable current old (set [ "a", "1" ]) (set [ "read", "x", "h" ]) true |> Set.isEmpty @>
    // a changed version explains the difference
    test <@ detectUnstable (current.Add("b", "2")) old (set [ "a", "1" ]) Set.empty true |> Set.isEmpty @>

[<Fact>]
let ``inputHash is the hash ingestion stores`` () =
    use w = new World()
    w.WriteFile "data/x.json" "{}"
    test <@ inputHash w.Root "read" "data/x.json" = Fingerprint.hashFile w.Root "data/x.json" @>
    test <@ inputHash w.Root "exists" "data/missing" = "absent" @>
    test <@ inputHash w.Root "list" "data" <> "absent" @>
    test <@ inputHash w.Root "file-level" "src/M.fs" = Fingerprint.hashFile w.Root "src/M.fs" @>

World.IngestPassing scopes writes one dump whose test scopes hit the given ids and a CTRF outcome Passed for each, then calls ingest. IngestPassingWithStaticInit also sets the static-init bitset. EditSymbol rewrites the index row's content hash. Add these members to World in this step.

• [ ] Step 3: Run and see them fail

Run: dotnet build && dotnet run --project tests/TestPrune.Trace.Tests --no-build -- --filter-class TestPrune.Trace.Tests.TraceIngestTests Expected: build errors naming inputHash, detectUnstable, UnstableSymbols.

• [ ] Step 4: Implement

• Turn the private inputOf into inputHash plus a thin inputOf:

/// The hash an input of `kind` at repo-relative `key` has now, as ingestion stores it and
/// as selection re-checks it.
let inputHash (root: string) (kind: string) (key: string) : string =
    let p = Path.Combine(root, key)

    match kind with
    | "exists" -> if Path.Exists p then "present" else "absent"
    | "list" ->
        if Directory.Exists p then
            Directory.GetFileSystemEntries p |> Seq.map Path.GetFileName |> Seq.sort |> String.concat "\n" |> sha256Text
        else
            "absent"
    | _ -> Fingerprint.hashFile root key   // "read" and "file-level"

let private kindOf =
    function
    | FileRead -> "read"
    | ExistenceProbe -> "exists"
    | DirectoryListing -> "list"

let private inputOf (root: string) (i: RecordedInput) =
    repoRelative root i.Path
    |> Option.map (fun rel -> kindOf i.Kind, rel, inputHash root (kindOf i.Kind) rel)

1. detectUnstable:

/// Symbols that appeared in or vanished from a test's trace although nothing the test
/// executed or read changed: the old trace's every symbol still has the version it was
/// recorded at, the inputs are identical, and both traces are complete. A deterministic
/// test executes the same code then, so a difference is order or memoisation (a factory
/// only the first test to force it records).
let detectUnstable
    (currentVersions: Map<string, string>)
    (old: StoredTrace)
    (newSymbols: Set<string * string>)
    (newInputs: Set<string * string * string>)
    (newComplete: bool)
    : Set<string> =
    let unchanged =
        old.Symbols |> Set.forall (fun (n, h) -> currentVersions.TryFind n = Some h)

    if not (old.Complete && newComplete && unchanged && old.Inputs = newInputs) then
        Set.empty
    else
        let names = Set.map fst
        let o, n = names old.Symbols, names newSymbols
        Set.union (Set.difference o n) (Set.difference n o)

1. In ingest, after tests is built and before store.RecordRun, compute each test's new symbol and input sets from contents and its ScopeKeys, read the old trace with store.TryRead(key, fp), and collect (symbol, testKey) pairs from detectUnstable (versionHashes req.Symbols) …. After CollectGarbage:

        store.RecordSymbolFacts(req.TestProject, fp, Probed, probedSymbols |> List.map (fun n -> n, ""))
        store.RecordSymbolFacts(req.TestProject, fp, StaticInit, staticInitSymbols |> List.map (fun n -> n, ""))
        store.RecordSymbolFacts(req.TestProject, fp, Unstable, unstable)

where probedSymbols is every ToSymbol n target of joinManifest (compute it where effectsOf already joins, and return it alongside) and staticInitSymbols is the symbol list of the merged StaticInitScope content, when present. versionHashes is computed once per ingestion and passed down; it is the expensive call.

1. TraceRun gains FingerprintInputs: string; ingest passes Fingerprint.toJson inputs and UpsertRun writes it. RecordRunWithoutTraces callers pass "{}". Add FingerprintInputs = "{}" to every TraceRun literal in the existing tests (Task 2's Phase2 module included) in this same commit.

2. [ ] Step 5: Run the new and touched classes

Run: dotnet build && dotnet run --project tests/TestPrune.Trace.Tests --no-build -- --filter-class TestPrune.Trace.Tests.TraceIngestTests --filter-class TestPrune.Trace.Tests.TraceStoreTests --filter-class TestPrune.Trace.Tests.EndToEndTests Expected: PASS.

• [ ] Step 6: Gate and commit

mise run ci > "$CLAUDE_JOB_DIR/tmp/t4-ci.log" 2>&1; echo "exit=$?"
jj new

Task 5: TraceSelect: the rules R1–R7 and eligibility

Files:

• Create: src/TestPrune.Trace/TraceSelect.fs (compile after TraceSession.fs)
• Test: tests/TestPrune.Trace.Tests/TraceSelectTests.fs (new)

Interfaces:

• Consumes: Task 2's store members; Task 4's inputHash; TraceIngest.versionHashes, TraceIngest.testKey; Task 1's InlineAttributeName; ImpactAnalysis.selectTests (Core).

• Produces: "Cross-task contracts → Selection".

• [ ] Step 1: Describe the change

jj describe -m "TraceSelect: select tests from recorded traces (R1-R7)"

• [ ] Step 2: Write the failing tests

tests/TestPrune.Trace.Tests/TraceSelectTests.fs:

module TestPrune.Trace.Tests.TraceSelectTests

open System
open Xunit
open Swensen.Unquote
open TestPrune.AstAnalyzer
open TestPrune.Trace
open TestPrune.Trace.Model
open TestPrune.Trace.TraceStore
open TestPrune.Trace.TraceSelect

let private tm cls meth : TestMethodInfo =
    { SymbolFullName = $"T.%s{cls}.%s{meth}"; TestProject = "P"; TestClass = cls; TestMethod = meth }

let private a, b, c, n = tm "K" "a", tm "K" "b", tm "K+Inner" "c", tm "K" "n"

/// A store where: a executes N.f and reads a.json through fixture C:K; b executes N.g;
/// c (a nested class) executes N.h and is incomplete; n (new) has no trace; the project's
/// latest weave probed N.f, N.g and N.h; N.s ran in a static constructor.
let private world () =
    let path = IO.Path.Combine(IO.Directory.CreateTempSubdirectory().FullName, "t.db")
    let store = Store.Open path

    let run: TraceRun =
        { RunId = "r1"; TestProject = "P"; TreeHash = "t"; EnvFingerprint = "E"
          RecordedAt = DateTimeOffset.UnixEpoch; Kind = RunKind.FullRun; Status = Recorded
          Reason = ""; StatsJson = "{}"; FingerprintInputs = "{}" }

    store.RecordRun(
        run,
        [ { Key = "T:a"; Symbols = [ "N.f", "hf" ]; Inputs = [] }
          { Key = "C:K"; Symbols = []; Inputs = [ "read", "a.json", "ha" ] }
          { Key = "T:b"; Symbols = [ "N.g", "hg" ]; Inputs = [] }
          { Key = "T:c"; Symbols = [ "N.h", "hh" ]; Inputs = [] } ],
        [ { TestKey = "P|K|a"; Status = Some Passed; Reasons = []; ScopeKeys = [ "T:a"; "C:K" ] }
          { TestKey = "P|K|b"; Status = Some Passed; Reasons = []; ScopeKeys = [ "T:b" ] }
          { TestKey = "P|K+Inner|c"; Status = Some Passed; Reasons = [ SourceDrift "src/H.fs" ]; ScopeKeys = [ "T:c" ] } ]
    )

    store.RecordSymbolFacts("P", "E", Probed, [ "N.f", ""; "N.g", ""; "N.h", "" ])
    store.RecordSymbolFacts("P", "E", StaticInit, [ "N.s", "" ])
    store

let private request (overrides: Request -> Request) : Request =
    overrides
        { TestProject = "P"
          EnvFingerprint = "E"
          Tests = [ a; b; c; n ]
          CurrentVersions = Map.ofList [ "N.f", "hf"; "N.g", "hg"; "N.h", "hh"; "N.s", "hs" ]
          CurrentInput = fun kind key -> if (kind, key) = ("read", "a.json") then "ha" else "absent"
          Seeds = []
          ChangedFiles = []
          IsIndexed = fun f -> f.EndsWith ".fs"
          AttributesOf = fun _ -> []
          StaticWalk = fun _ -> []
          FileFallback = fun _ -> Some []
          FileGaps = Set.empty }

let private keysOf (s: Selection) = s.Selected |> Map.keys |> Set.ofSeq

[<Fact>]
let ``nothing changed selects only the untraced and the incomplete`` () =
    use store = world ()
    let s = select store (request id)
    test <@ s.Selected.["P|K|n"] = [ NoTrace ] @>
    test <@ s.Selected.["P|K.Inner|c"] = [ Incomplete [ "source-drift:src/H.fs" ] ] @>
    test <@ keysOf s = set [ "P|K|n"; "P|K.Inner|c" ] @>

[<Fact>]
let ``a changed version selects exactly the tests that executed it (R2)`` () =
    use store = world ()
    let s = select store (request (fun r -> { r with CurrentVersions = r.CurrentVersions.Add("N.g", "hg2") }))
    test <@ s.Selected.["P|K|b"] = [ SymbolChanged "N.g" ] @>
    test <@ not (s.Selected.ContainsKey "P|K|a") @>

[<Fact>]
let ``a removed symbol selects the tests that executed it (R2)`` () =
    use store = world ()
    let s = select store (request (fun r -> { r with CurrentVersions = r.CurrentVersions.Remove "N.f" }))
    test <@ s.Selected.["P|K|a"] = [ SymbolChanged "N.f" ] @>

[<Fact>]
let ``a changed input read by a fixture selects every test linked to it (R3)`` () =
    use store = world ()
    let s = select store (request (fun r -> { r with CurrentInput = fun _ _ -> "changed" }))
    test <@ s.Selected.["P|K|a"] = [ InputChanged("read", "a.json") ] @>
    test <@ not (s.Selected.ContainsKey "P|K|b") @>

[<Fact>]
let ``a trace under another fingerprint is R5, not R1`` () =
    use store = world ()
    let s = select store (request (fun r -> { r with EnvFingerprint = "E2" }))
    test <@ s.Selected.["P|K|a"] = [ FingerprintMismatch ] @>
    test <@ s.Selected.["P|K|n"] = [ NoTrace ] @>
    test <@ not s.Eligible @>

[<Theory>]
[<InlineData("N.s", "static-init")>]
[<InlineData("N.unprobed", "not-probed")>]
let ``a seed the probes cannot represent falls back to the static walk (R6)`` (seed: string, reason: string) =
    use store = world ()
    let walked = ref []

    let s =
        select store (request (fun r ->
            { r with
                Seeds = [ seed; "N.f" ]
                StaticWalk = fun seeds -> walked.Value <- seeds; [ b ] }))

    test <@ walked.Value = [ seed ] @>
    test <@ s.Selected.["P|K|b"] |> List.map ruleCode = [ "R6" ] @>
    test <@ s.FallbackSeeds |> Map.map (fun _ r -> fallCode r) = Map.ofList [ seed, reason ] @>

[<Fact>]
let ``inline and literal seeds fall back even when probed`` () =
    use store = world ()

    let attrs =
        function
        | "N.f" -> [ TestPrune.AstAnalyzer.InlineAttributeName ]
        | "N.g" -> [ "LiteralAttribute" ]
        | _ -> []

    let s = select store (request (fun r -> { r with Seeds = [ "N.f"; "N.g"; "N.h" ]; AttributesOf = attrs }))
    test <@ s.FallbackSeeds = Map.ofList [ "N.f", Inline; "N.g", Literal ] @>

[<Fact>]
let ``a static walk never selects another project's tests`` () =
    use store = world ()
    let other = { tm "K" "x" with TestProject = "Q" }
    let s = select store (request (fun r -> { r with Seeds = [ "N.s" ]; StaticWalk = fun _ -> [ other ] }))
    test <@ not (s.Selected.ContainsKey "Q|K|x") @>

[<Fact>]
let ``an unclaimed changed file defers to the static file rules and the census gaps (R7)`` () =
    use store = world ()

    let s =
        select store (request (fun r ->
            { r with
                ChangedFiles = [ "config/app.json" ]
                FileFallback = fun files -> if files = [ "config/app.json" ] then Some [ b ] else Some []
                FileGaps = set [ "P|K|a" ] }))

    test <@ s.Selected.["P|K|b"] = [ UntracedInput "config/app.json" ] @>
    test <@ s.Selected.["P|K|a"] = [ UntracedInput "config/app.json" ] @>

[<Fact>]
let ``a claimed or indexed changed file is not R7`` () =
    use store = world ()
    let fallbackCalls = ref 0

    let _ =
        select store (request (fun r ->
            { r with
                ChangedFiles = [ "a.json"; "src/M.fs" ]
                FileFallback = fun _ -> fallbackCalls.Value <- fallbackCalls.Value + 1; Some [] }))

    test <@ fallbackCalls.Value = 0 @>

[<Fact>]
let ``a file added under a listed directory is claimed by the listing`` () =
    use store = world ()

    store.RecordRun(
        { RunId = "r2"; TestProject = "P"; TreeHash = "t"; EnvFingerprint = "E"; RecordedAt = DateTimeOffset.UnixEpoch
          Kind = RunKind.PartialRun; Status = Recorded; Reason = ""; StatsJson = "{}"; FingerprintInputs = "{}" },
        [ { Key = "T:b"; Symbols = [ "N.g", "hg" ]; Inputs = [ "list", "fixtures", "hl" ] } ],
        [ { TestKey = "P|K|b"; Status = Some Passed; Reasons = []; ScopeKeys = [ "T:b" ] } ]
    )

    let fallbackCalls = ref 0

    let _ =
        select store (request (fun r ->
            { r with
                ChangedFiles = [ "fixtures/new.json" ]
                FileFallback = fun _ -> fallbackCalls.Value <- fallbackCalls.Value + 1; Some [] }))

    test <@ fallbackCalls.Value = 0 @>

[<Fact>]
let ``a fallback of None (a project file changed) selects every test`` () =
    use store = world ()
    let s = select store (request (fun r -> { r with ChangedFiles = [ "src/P.fsproj" ]; FileFallback = fun _ -> None }))
    test <@ keysOf s = set [ "P|K|a"; "P|K|b"; "P|K.Inner|c"; "P|K|n" ] @>

[<Fact>]
let ``eligibility is the complete-trace share of the universe`` () =
    use store = world ()
    let s = select store (request (fun r -> { r with Tests = [ a; b ] }))
    test <@ s.CompleteShare = 1.0 && s.Eligible @>
    let s2 = select store (request id)
    test <@ s2.CompleteShare = 0.5 && not s2.Eligible @>

[<Fact>]
let ``staticFileFallback applies DependsOnFile and the project-file rule`` () =
    let db = TestPrune.Database.Database.create (IO.Path.Combine(IO.Directory.CreateTempSubdirectory().FullName, "i.db"))
    let store = TestPrune.Ports.toSymbolStore db
    test <@ staticFileFallback store [ "src/P.fsproj" ] = None @>
    test <@ staticFileFallback store [ "config/app.json" ] = Some [] @>