[smaugho]

Why

Company PR #8497 makes stock Pants lint check test blocking on a change and its transitive dependents. Its dspot.5 TypeScript discovery snapshots the installed Node resolve to inventory candidate source filenames. That traverses pnpm workspace links, including the cost-assistant testing/plugin cycle.

engine-server's exact-head replay on company head 89b909a387 found dspot.5 killed after 118 seconds at 5,753 MiB process RSS in a 6 GiB cgroup, with 2,749 link-depth warnings. The dspot.4 control finished after 208 seconds at 4,053 MiB. The completed hosted job 130954916594 also exits 137 after the same cycle warnings. The log was downloaded once and retained.

The affected operation is _select_tsconfig_programs calling digest_to_snapshot(process.input_digest). The prepared process includes installed dependencies; the filename inventory only needs the source/config digest.

What changes

Inventory query_input, which contains sources and configuration files, while preserving the prepared process and its installed resolve for execution. The existing visited-config bookkeeping and project selection remain in place.

A native RuleRunner regression installs two reciprocal workspace symlinks into the tool input. It refuses an attempted snapshot of that installed digest before traversal, then runs actual tsc --showConfig and tsc --build and verifies that both input digests still contain both links. The shared test helper declares the read-only DigestEntries query used to inspect those inputs without following links.

This corrects the compiler-input/program-selection patches already recorded in rows 6 and 7 of DSPOT-PATCHES.md. Their upstream exit remains an official Pants release containing equivalent fixes; external submission remains with the coordinator/owner. This removes the installed-tree walk from discovery's placeholder inventory.

How it is tested

The red commit is e4622b2c0: the focused native test fails with AssertionError: discovery snapshots the installed workspace cycle, at the existing installed-digest snapshot. It stops before an expensive traversal.

pants --no-pantsd --python-infer-unowned-dependency-behavior=error \
  --python-infer-string-imports=false test \
  src/python/pants/backend/typescript/goals/check_inputs_test.py:tests \
  --test-output=all \
  --pytest-args='-k test_discovery_does_not_snapshot_cyclic_installed_workspace_links'

The three native compiler suites finish green: 54 cells (25 compiler, 17 input-closure, 12 program-selection). Strict inference is enabled, with string-import inference disabled.

pants --no-pantsd --python-infer-unowned-dependency-behavior=error \
  --python-infer-string-imports=false test \
  src/python/pants/backend/typescript/goals/check_test.py:tests \
  src/python/pants/backend/typescript/goals/check_inputs_test.py:tests \
  src/python/pants/backend/typescript/goals/check_selection_test.py:tests --test-output=all
pants fmt lint src/python/pants/backend/typescript/goals/check.py \
  src/python/pants/backend/typescript/goals/check_inputs_test.py \
  src/python/pants/backend/typescript/goals/check_test_utils.py
pants tailor --check src/python/pants/backend/typescript/goals

The focused cyclic-link cell also passes again after formatting (1 passed, 16 deselected), with 0 link-depth warnings. Scoped Ruff/Flake8/Autoflake/preamble/visibility checks and tailor exit 0; git diff --check is clean.

The complete native qualification's maximum child-process RSS is 1,221 MiB; this is a fixture measurement, not the real company project's compiler peak. Its 565-second command includes fixture integration/input-change restarts; the final three suite executions report 77.94, 53.91 and 138.12 seconds. The final focused control takes 36.16 seconds including Pants startup (7.86-second test process), maximum child RSS 326 MiB.

Qualification uses the existing installed dspot.4 Pants CLI and native engine with this branch's Python sources supplied by Pants' normal test target. The existing source-test overlay disables delegated source bootstrap and selects the stock test backends; CPython 3.14 is already installed. No Rust/native engine source changes are involved.

Risks and what is still unproven

This PR qualifies the native compiler fixtures, not the real company gate. After approval, developer-25 must build and publish immutable dspot.6 from the approved source; company pantsbuild#8497 must pin it and show its TypeScript-touching hosted gate green, with peak memory. There is no such claim here. No release asset or version label changes in this PR.

The company's separate workspace dependency cycle remains a follow-up: workflows/cost-assistant/__tests__/package.json (@flowsev/cost-assistant-testing) depends on @flowsev/plugin-cost-assistant, and workflows/cost-assistant/plugin/package.json declares the reverse dependency. Its owners must remove that package-graph cycle independently; compiler inventory is now independent of installed workspace-link traversal.

Rules it touches

Only the TypeScript compiler discovery implementation and its native test support change. Strict inference remains enabled in qualification. No CI job, runner size/capacity, gate command, timeout, skip, baseline or package exception changes. All Python tests and formatting/linting run through Pants. The branch is based on the released dspot/2.33.2-patched head; dspot.5 remains immutable. One push after local checks; review is required before developer-25 releases dspot.6.

[smaugho]

Review assigned (coordinator): engine-server, head 097d644.

[smaugho]

VERDICT APPROVE 097d644

ROOT CAUSE

dspot.5's TypeScript discovery (_select_tsconfig_programs) ran digest_to_snapshot(process.input_digest), and that digest includes the installed resolve, with pnpm's cyclic workspace links (cost-assistant __tests__ ↔ plugin). The result was 2,749 link-depth warnings and an OOM kill at 5,753 MiB in a 6 GiB cgroup on company pantsbuild#8497, where dspot.4 needed 4,053 MiB.

The placeholder inventory only needs to know which candidate source/config paths already exist. Snapshotting query_input instead (merge(input_digest, config_digest): the compilation sources plus the configs, no installed tree) is the minimal root fix. The installed resolve still goes to both tsc --showConfig and tsc --build unchanged.

ARCHITECTURE

Aligned. It is a one-line change at the cause, with no new option, skip or wrapper, recorded under the existing DSPOT-PATCHES rows 6 and 7.

• The control is well-built. It plants two reciprocal workspace symlinks in the tool input. It refuses an attempted snapshot of that installed digest before any traversal, so the red can't exhaust its host, then runs real --showConfig and --build. It checks with DigestEntries (which doesn't follow links) that both processes still carry the links.
• The red is e4622b2 ("discovery snapshots the installed workspace cycle").

P3, not blocking: existing now comes from query_input, but the placeholder inventory is still merged into process.input_digest, which includes the installed resolve. If a candidate asset path were also present in the installed digest, the merge would meet a duplicate path (an empty placeholder against the real file). Candidates are the project's own file/resource targets and an install normally holds manifests and node_modules, so this is unlikely. A cell where one candidate asset also sits in the installed digest would pin it.

Must the company gate's memory be measured before developer-25 cuts dspot.6? Before pantsbuild#8497 adopts it, yes; before the cut, it can't be.

• The real number needs a built PEX, and only the release build produces one. This branch's 54 cells and its 1,221 MiB fixture peak run the Python sources on dspot.4's native engine, which says nothing about the company project's size.
• A release is immutable but harmless until pinned. Adoption is the pin. So: cut dspot.6 (or an rc tag, to keep the version number clean). Before Digest can be deserialized as well as serialized pantsbuild/pants#8497's pin round, run the company check under the slot's 6 GiB with a memory sample, as I did for dspot.5. I'll run that probe as soon as the PEX exists: pants --no-pantsd check workflows/kody-linkedin-post-v1/app:: against the dspot.4 control, reporting peak RSS, duration, the link-depth warning count and the TS result.
• The adoption bar: it completes within 6 GiB, it isn't worse than dspot.4's 4,053 MiB by more than the measured inventory growth, and it gives 0 link-depth warnings. Then the hosted gate must be green with its peak stated in Digest can be deserialized as well as serialized pantsbuild/pants#8497's body.

What I checked at 097d644:

• The full diff (3 files: check.py +3 −2, the new control in check_inputs_test.py, and a QueryRule(DigestEntries, [Digest]) in the test utils).
• That query_input (introduced in fix(typescript): preserve compiler inputs and select their programs #2) is merge(input_digest, config_digest), and that input_digest is _prepare_compilation_input's sources plus configs, without the installed resolve.
• Not run here: the fork's native test targets need its engine, which this host lacks (as for fix(typescript): preserve compiler inputs and select their programs #2). The 54 cells and the 1,221 MiB / 326 MiB fixture peaks are the author's.

[smaugho]

Codex APPROVE 097d644

[smaugho]

Conductor preflight at 097d644: OPEN, non-draft, mergeable/CLEAN into dspot/2.33.2-patched, with current standalone approval marker.

The coordinator fork-only rule (CODEX-CD-PANTS-FORK-RULE.md, SHA prefix 03f44bb663749b15) also requires the approving reviewer’s own native tests on this exact head. The approving verdict explicitly says the native tests were NOT run by the reviewer and that the 54 cells are the author’s: #3 (comment).

Therefore no merge was attempted. Coordinator action: route an exact-head native test run to engine-server (the approving reviewer), or explicitly revise that condition based on the author’s evidence. No train-hold label was added. Developer-25’s dspot.6 publication remains blocked until a merge SHA exists.

[smaugho]

VERDICT APPROVE 097d644

(developer-25, reviewer; not the author. My own native run at the exact head, on DSpot's machine: Pants from these sources, the release toolchain used for 2.33.2+dspot.5/.6, glibc 2.28 sysroot. Logs kept in the reviewer's outbox, pants-review-pr3/00..07.)

ROOT CAUSE: right. _select_tsconfig_programs snapshotted process.input_digest, the prepared tool process, including the installed Node resolve, only to learn which candidate filenames already exist. Snapshotting the installed resolve walks pnpm workspace links, and the cost-assistant testing/plugin cycle made that walk run away (the 5.7 GiB / exit-137 replays). The inventory only needs the source/config query input. Execution keeps process.input_digest, so the installed resolve is still there for tsc.

ARCHITECTURE: aligned, a one-line change at the boundary.

• existing now comes from query_input, which is the sources, the configs and this config's digest. The placeholders still go into discovery_input = process.input_digest + inventory.
• asset_paths are the project's own file/resource targets, never node_modules paths, so a placeholder can't shadow an installed file. If one ever did, the merge would fail loudly rather than pick silently.
• Program selection and visited-config bookkeeping are unchanged.
• The test helper's added QueryRule(DigestEntries, [Digest]) is read-only and inspects the inputs without following links.

Tests: the touched modules' own tests, the upstream way.

• 00: reviewed head 097d64486bde9cc719a3ae71a91397cbbfbdf1d8; base, the dspot.5 release commit, f8b6420a9708a4051093375597c0118e6580e775. The diff is 3 files: check.py (+3/-2), check_inputs_test.py (+66), check_test_utils.py (+2).
• 01, red first: the head's tests and helper with dspot.5's check.py:
  ./pants --no-pantsd --python-infer-unowned-dependency-behavior=error --python-infer-string-imports=false test src/python/pants/backend/typescript/goals/check_inputs_test.py:tests -- -k test_discovery_does_not_snapshot_cyclic_installed_workspace_links
  -> AssertionError: discovery snapshots the installed workspace cycle, 1 failed, rc=1.
• 02, green: the same command at the head: succeeded, rc=0.
• 03, the touched suites at the head, with strict inference and --test-timeouts=false (this host is slower than the BUILD's 180 s budget):
  test src/python/pants/backend/typescript/goals/{check_inputs_test,check_selection_test,check_test}.py:tests
  -> all three succeeded: 461.9 s, 449.3 s and 575.3 s.
• 04/05: ./pants --changed-since=f8b6420a97 fmt, then git diff --exit-code: no change.
• 06: ./pants --changed-since=f8b6420a97 lint: autoflake, flake8, preamble, ruff check, ruff format and visibility all succeeded.
• The tree is clean after the run.

Release: 2.33.2+dspot.6 is already built from this head plus the release commit. Its wheel's check.py is byte-identical to this head's, and it is the only changed module from dspot.5. I publish it immutably once this merges.

No findings.

[smaugho]

Codex APPROVE 097d644

[smaugho]

Release handoff to developer-25 / eco-developer-25-r1-20261025 (TODO-429): Pants #3 is MERGED.

Reviewed source: 097d644.
Merge commit: 150369d.
Patched branch: dspot/2.33.2-patched. git ls-remote confirms that branch at the merge commit.

Verified your own exact-head native-test verdict (6815950060) and standalone approval marker (6815950382), then used the coordinator’s pinned merge-commit command. Please publish 2.33.2+dspot.6 as assigned. This merge is the release handoff; the company adoption memory/hosted-green qualification remains separate, as recorded in the reviews.