feat: release Dever 0.1.4 with enforceable project guidance

.trellis/spec/backend/compiler-contracts.md

@@ -28,7 +28,7 @@ Applies to AST/HIR contract metadata, typed LLVM/resource/coroutine lowering, pr
 - Application tests use `test/<component>/<domain>/<topic>.dever[.md]`; the filename selects the one ordinary zero-input, zero-output `<topic>() ()` entry. Test helpers/types remain private to that file. Tests call same-domain App/Domain and cross-domain App only; they cannot call Model operations, Port, Adapter, API or another test, and production cannot call tests.
 - Test assertions are compiler-owned `assert(Bool)` and `assert_eq(actual, expected)`. Equality requires the same comparable type; only `null`/empty expressions that already require context receive the left type, so numeric promotion does not make unequal source types valid. Business failures continue through `result(call)` and explicit recovery.
 - CLI: `check <root>`, `test <root>`, `run <root> [--tenant <id>] [-- <cmd> <json>]`, `build <root> --output <new-file>`, `tenant migrate <root> <id>`, `tenant owner <root> <id> <site> <user-id>` and `tenant component enable|disable <root> <id> <component>`. Run/build collect checked API/CMD/Job declarations into one generated entry and reject application `main.dever`. Test checks `module/ + test/` before running stable-sorted cases; check/run/build load only module/. Deployment and database settings come only from `config/setting.json`.
-- CLI check and application compilation share `Program::application_errors()` before resource preparation: C016 rejects unreachable App/Domain functions and recognized trivial private forwarders or Model CRUD wrappers, not every wrapper shape. Check remains static and offline, with no Worker preparation, runtime pack, native compilation, service or database execution. Test retains its case-local roots and Port fakes without applying production reachability; core library checking still permits exports whose consumers are unknown.
+- CLI check and application compilation share `Program::application_errors()` before resource preparation: C016 rejects unreachable App/Domain functions and recognized trivial private forwarders or Model CRUD wrappers, not every wrapper shape. Within production-reachable App/Domain, it also rejects same-owner private implementations with identical full contracts/bodies and empty transitive effects, and repeated pure calls with unchanged inputs whose previous result remains available. Reuse the W003 structural key and W004 version/result proof rather than interpreting warning text. Do not promote effectful W003 matches: the structural key does not encode every Model query property. Keep different owners/contracts, mutations, Adapter and bundled code outside these two hard rules. Check remains static and offline, with no Worker preparation, runtime pack, native compilation, service or database execution. Test retains its case-local roots and Port fakes without applying production application errors; core library checking still permits exports whose consumers are unknown.
 - Module API files contain declarations such as `get profile = app.profile`, `post publish = app.publish`, `cmd bootstrap = app.bootstrap` and `rest model`; they do not contain handler function bodies. HTTP routes inherit the App signature and return the fixed envelope. `public` is valid only on one HTTP declaration. Recursive `api/<site-path>/<topic>.dever` supplies configured site ownership without source `site` statements.
 - Authentication providers, sites, external HTTP origins, Cookie names/lifetimes and tenant routing come only from `config/setting.json`. Verify is one read-only App function from `Claims` to an App-owned record with exactly `id: Text`, `user_id: ModelId?`, and `tenant_id: ModelId?`; it cannot return permissions. A protected site's generated entry verifies its configured provider, enters trusted tenant scope, checks every reachable tenant component and authorizes the exact permission before reading business input or dispatching App. A `public` declaration ignores an ambient browser Cookie, but an explicitly supplied invalid `Authorization` credential remains an authentication error.
 
@@ -82,7 +82,7 @@ Facts, effects and failures share `contracts/dependencies.rs` for function/stati
 
 Domain dependency edges come only from resolved type, function and handler references. Physical role files in one domain share one dependency boundary; cross-domain cycles remain invalid and function recursion remains independently invalid. Source code does not duplicate edges in a header, and dependency inference does not install or download packages.
 
-API snapshots sort semantic names and contracts, not source paths/IDs. A baseline is optional, explicit and create-new; checks never update it. Protect its edits outside the language. CLI suppresses bundled-source suggestions only; Program retains diagnostics and bundled hard errors remain visible. Entry-specific export advice must not infer unknown library consumers.
+API snapshots sort semantic names and contracts, not source paths/IDs. A baseline is optional, explicit and create-new; checks never update it. Protect its edits outside the language. Program retains all warnings. CLI suppresses bundled-source suggestions and W003/W004/W005 already represented by a C016 with the same primary and nonempty ordered related spans. Different evidence or warning codes remain visible, as do bundled hard errors. Baseline failure takes precedence and retains original warnings; API/Test do not apply production-error suppression. Entry-specific export advice must not infer unknown library consumers.
 
 Test authority comes from compiler-assigned source origin, never a user-controlled path string. A checked `TestCase` holds the private function ID and database-effect metadata; native compilation accepts only that checked identity and does not relax normal entry visibility. Each case runs serially in its own native process and temporary project. Successful child output stays captured; failed stdout/stderr is reported in labelled sections, later tests continue, and any failed case makes the command fail. Tests cannot reach `dever.api.serve()`.
 
@@ -125,6 +125,7 @@ Sensitivity belongs to the cached type graph in `types.rs`: Secret and private M
 | Invalid Model or transaction database contract | C014 |
 | Contract analysis exceeds bounded work | C015, no executable Program |
 | Proven redundant check / duplicate private implementation / repeated pure call / trivial private forwarding | W002 / W003 / W004 / W005 |
+| Production App/Domain orphan, recognized forwarding/CRUD wrapper, same-owner identical private effect-free implementation or proven reusable pure call | C016 before resource preparation; libraries/Test retain warnings |
 | Unused or overwritten write | Existing W001, no duplicate W006 |
 | Unneeded exposure for a selected application | W007, not a hard error |
 | API drift or unreadable baseline | CLI failure before native compilation |
@@ -164,6 +165,8 @@ LLVM changes select root `llvm_lowering` and embedded-bridge `llvm_native`: real
 
 Select `structured_concurrency`, `async_native`, `contract_syntax`, `contract_facts`, `contract_semantics`, `contract_api`, `contract_redundancy`, `contract_execution`, `error_effects` according to changes. Assert suspension propagation through ordinary calls and concrete handler substitution, non-transferable liveness, worker boundaries, API omission, alias mutation, handler variance, short-circuit/empty traversal, overwrite/projection obligations, bounded shared graphs and unchanged native results. Error capture tests cover native/reference wrapping, explicit outer identity, ambiguity and discarded captures. Parser tests must reject the removed package-header dependency clause; formatter round trips must prove it cannot be emitted. Do not run the entire suite or service tests by default.
 
+For C016 duplication changes, `contract_redundancy` must exercise actual production roots, identical private pure implementations and reusable pure calls, unchanged library warnings, and exclusions for effects, input/field/result mutation, owners and output/recovery contracts. CLI `llvm_cli` must reject both proven cases identically through check/run/build before missing runtime packs, database access or output creation; show each hard error and its evidence once, keep distinct-proof/unrelated warnings, and preserve baseline/API/Test behavior. Statically check maintained CMS plain/Markdown and skill examples with application errors; no native execution or database is required for this gate.
+
 For this source/API contract select `source_architecture`, `source_visibility`, `contract_execution`, `markdown_source`, `api_declarations`, `rest_model`, `native_entry`, `api_routes`, `auth_runtime`, `authorization_runtime`, `secure_contracts`, `tenant_database`, `durable_jobs` and `upload_boundary` as needed. Assert App aliases, topic hiding, role call direction, Model ownership, layout rejection, generated roots, strict inputs, JSON envelopes, Markdown parity, site/auth ownership, exact permission keys, duplicate-key rejection, public-to-tenant rejection, REST row scope and Upload cleanup. Authentication coverage includes public Cookie isolation, explicit invalid Authorization, exact Origin, staged metadata ordering, generated System roots, site-scoped multi-role union, Owner isolation and User Job current-role checks. Actual loopback HTTP verification requires an explicitly scoped service check.
 
 Application-test changes select `application_testing`, `formatter` and `cms_project`. Assert stable discovery, plain/Markdown duplicates, filename entry validation, both visibility directions, assertion typing/rendered source locations, existing result-choice recovery, failure continuation/output capture, zero-test success, per-case SQLite Seed isolation, ignored deployment settings, production commands ignoring test sources and module/test formatting preflight.

.trellis/spec/backend/directory-structure.md

@@ -42,6 +42,6 @@
 - `examples/README.md`: current CMS commands and the archive boundary. Historical rejection fixtures keep their original diagnostics only when invoked by dedicated compiler-level tests, not as current application projects.
 - `test/dever-tests/tests/`: permanent focused tests. Parser, checker and formatter share `test/dever-tests/fixtures/core/complete_package.dever`; public tests do not depend on private task records.
 
-Core foundations, formatting, optional reference evaluation, official library follow-through and the SQLite/PostgreSQL static ORM have concrete implementations. Compiler distribution and self-hosting remain unshipped; validation evidence belongs to the active task, not this directory map. Compiler phase APIs are bootstrap internals, not an alternative program source format.
+Core foundations, formatting, optional reference evaluation, official library follow-through and the SQLite/PostgreSQL static ORM have concrete implementations. Linux x86_64 compiler distribution is shipped; other host distributions and self-hosting remain unfinished. Validation evidence belongs to task records, not this directory map. Compiler phase APIs are bootstrap internals, not an alternative program source format.
 
 Use one owning implementation for each language rule. Do not introduce a generic parser framework, service layer or backend registry for a single concrete implementation.

.trellis/spec/backend/quality-guidelines.md

@@ -12,6 +12,8 @@ Explicit LLVM Worker acceptance consumes the prepared immutable `target/native-r
 
 Explicit single-libtest acceptance uses `run_command(..., single_harness=True)` and requires the final parent summary to contain exactly one passed test, no failures and no ignored tests. Nested probe summaries must not be added to that parent count; ordinary Cargo multi-harness commands retain aggregate counting. A zero-test parent, failed parent or missing summary is not a pass even if a child probe succeeded. `test/ci/test_gate.py` owns these rejection cases.
 
+CI source fingerprints include `skills/`: its instructions, embedded project templates and shipped examples are product inputs, so changed or deleted files invalidate prior evidence. The Python stage executes the existing `test/skill_examples.py` for relocated local links, release file budgets, standard-library signatures and tutorial-source bindings; do not duplicate its validators or treat zero-test/failed execution as success. Each `dever` fence in `skills/references/*.md` must immediately follow a `源码：[label](relative-path)` link and a blank line. Its nonempty bytes must uniquely match a continuous excerpt in a shipped template/example module or test source. Missing bindings, changed documentation/source, ambiguous excerpts and unclosed fences fail. Rust `skill_examples` checks the complete projects, production roots, configuration, case-local effects and formatting, including the template; its inventory must cover every example directory. Collections use one-output `each` for mapping, zero-output `each` for actions, and `filter/reduce`; there is no `map` operation. Focused CI wiring checks use `test/ci/test_gate.py` and the actual skill checker, retain its observed test count, and reject deliberate link/signature/tutorial drift through a nonzero exit and the specific failed/error case. Run the collection cases and ordinary-command fake case in owned temporary projects; do not invoke real third-party binaries, databases, services or the full gate.
+
 The shared `test/native-runtime-abi/managed-driver.c` runs one warmup and 64 repeated entries on joined host threads, then checks strict allocation balance after each join/TLS destruction. Rust's bounded-channel producer may first allocate its 48-byte thread-local Context only after warmup when the queue fills; measuring before the host thread exits misreports that cache as a leak. Preserve process initialization before any thread, original result checks and strict zero allocation delta; do not add retries, random warmups or an allowed-leak threshold. This measures entry-plus-host-thread cleanup, not unbounded TLS growth on a long-lived embedding thread. `test/ci/test_driver.py` compiles the shared driver with the explicit existing author C tool and verifies late TLS cleanup succeeds while intentional per-entry leaks and changed results fail. Suite probes include the same driver instead of copying its ledger.
 
 Markdown source uses pinned pulldown-cmark in the compiler only. Preserve the `.dever` path and existing semantic/contract checks; shared Markdown extraction/formatting rules and the focused `markdown_source` target are specified in [Toolchain And Official Library Contracts](toolchain-and-library.md).

.trellis/spec/backend/toolchain-and-library.md

@@ -32,7 +32,7 @@ Process main is separate from callable roots. Initialize Unix SIGPIPE policy bef
 
 - First installation: root `install` is the sole installer source and supports `bash install` and `curl -fsSL https://git.dever.cc/shemic/dever/raw/branch/main/install | bash`. Its Bash entry forwards `--version`, `--release`, `--trusted-key`, `--system-root`, and `--no-start` to its embedded Python implementation. Maintain this file directly; skills provide guidance, not another installer, and there is no generation step.
 - Project creation: `dever new <new-directory> [--markdown]`; `project::create(&Path, bool)` consumes the single template source under the ordinary `skills/assets/template` directory in the same repository revision. The machine launcher selects the active core without reading nonexistent target configuration.
-- AI guidance: `dever skill path [project-root]` resolves and verifies the active or project-pinned release's `skills/dever-language`; `dever skill install <new-directory>` atomically publishes a stable loader that invokes the absolute machine launcher. Skill resolution is a public read-only operation and must not open the root-only install lock.
+- AI guidance: `dever skill path [project-root]` resolves and verifies the active or project-pinned release's `skills/dever-language`. `dever skill install` takes no arguments: from a project root, select its compiler version and merge that signed skill's `assets/template/AGENTS.md` into the project's `AGENTS.md`. Reuse the same template as `dever new`; do not copy a full skill or create a second binding command. Create a missing file, append a missing managed block, or replace one complete `<!-- dever-language:start -->` / `<!-- dever-language:end -->` block while preserving all other content. Repeated installs are idempotent. Reject a non-project directory, symbolic links, nonregular/invalid UTF-8 AGENTS, malformed/duplicate markers and missing signed templates before mutation; publish through an owned atomic staging file. The old skill-directory argument is removed without an alias. Skill resolution is a public read-only operation and must not open the root-only install lock; machine installation/update does not scan or rewrite user projects.
 
 - Application target: `dever build <root> --output <new-file> [--target linux-x86_64|linux-aarch64]`; explicit dependency preparation accepts the same target on `dever lib add/install/update/doctor`. Omission selects `BuildTarget::host()`. `CompileRequest.target: BuildTarget` is required and serialized canonically; test requests must use the host.
 
@@ -64,6 +64,7 @@ Process main is separate from callable roots. Initialize Unix SIGPIPE policy bef
 - `format::format(&SourceFile) -> Result<String, Vec<Diagnostic>>`; `dever fmt <project-root> [--check]` prepares both `module/` and optional `test/` before committing either source set.
 - `SourceMap::load(root)` accepts `.dever` and `.dever.md`; plain `.md` is not program source. It derives package identity from the relative filename, and both source formats use the same `parse/check/api/run/build` contracts.
 - `SourceMap::load_project(module_root, test_root)` preserves separate display/logical paths and assigns Test origin internally. A missing test root is empty; an existing non-directory or unreadable root is an explicit load error.
+- `dever test <root> [--filter <component[.domain[.case]]>] [--timeout-ms <positive-ms>]` checks all sources and compiles one complete indexed suite. Filter matches complete dot-separated identity or a segment prefix, never a substring/glob. Preserve slash-separated report names and original indices. Default case deadline is 60000 ms, starting at process launch, not compilation; unselected cases count as not run and no match is a command error. Linux runner uses an owned process group, NOWAIT leader observation and temporary subreaper ownership: terminate the group before releasing the leader PID, then reap only that group and restore prior state. File output capture avoids pipe backpressure/descendant EOF hangs. Timeout fails that case and later selected cases continue; production config and real Lib remain outside ordinary Test graphs.
 - Static API declarations are generated into the async application entry; application source does not call `dever.api.serve()`. Runtime `api::Inputs` binds GET/DELETE query parameters, POST/PUT JSON objects or a statically selected POST multipart shape, and runtime response helpers build the fixed JSON envelope. `config/setting.json` alone supplies HTTP, site/auth and upload limits; application config never uses environment variables.
 - Optional feature `reference`: `reference::evaluate(&Program, entry) -> Result<Evaluation, String>`, with captured stdout and structured source-span fault. No interpreter production CLI path.
 - `parallel_each(handler, List|Bytes|Stream, workers[, context]) -> ()`; zero-output synchronous handler, 1–256 workers, no recursively nested Stream in worker input/context. In async code the handler must be a named function with no transitive concurrency effect.
@@ -249,6 +250,7 @@ Create a response-body cancellation owner only after the pending-to-committed st
 - Signature/payload/skill corruption, incomplete archive or absent official asset: explicit failure, no active-version switch or fallback. Publishing source code is not evidence that a downloadable binary release exists.
 - Truncated Bash body: no installer or sudo execution. Missing prerequisites: fail before metadata download. Failed authentication through Bash: preserve existing active journal/core/bootstrap and clean only owned staging. Tests load the embedded Python from the actual root entry and exercise Bash file/pipe execution; retain a check against the independently provisioned public key. Successful same-version bootstrap may append an activation record; assert selected-version identity rather than a byte-identical journal.
 - Project has a pinned version: `skill path <project>` resolves that exact installed version. Foreign users must read matching guidance without obtaining the administrator install lock.
+- Test filter/timeout is missing, repeated, non-UTF-8 or malformed: reject before execution. No selected case: fail before compilation. Assertion, process error or timeout: retain labelled captured output, continue later selected cases and return nonzero. Cleanup only the case's process group; never reap unrelated children or leave adopted descendants to PID 1.
 
 Cross build: unknown/duplicate/missing target arguments fail before execution; absent target packs, wrong ELF/archive machine, unsigned target leaves, incompatible lock/runtime/build receipt and changed target inputs fail before cache reuse or linking. Sandbox loader mode must survive both release packing and embedding; a hash-valid non-executable loader is not a usable Worker resource.
 
@@ -320,6 +322,8 @@ Cache miss -> compile and publish; changed inputs -> separate key; incomplete/mo
 
 Onboarding base: `dever new app` followed by `run app -- hello.greeting.greet '{"name":"Dever"}'` returns the standard envelope with `data:"Hello, Dever"`. Good: --markdown generates equivalent checked declarations; two projects/users share core and skill. Installation good: standalone Bash installs a verified local release into an owned image, then pipe reinstall preserves it. Bad: manual main.dever scaffolding, Go service/Page JSON templates, update URLs in project setting.json, a Git login page served as install, or a global skill copied once and allowed to drift from the installed compiler.
 
+Test base: no filter executes all cases serially; no test directory reports zero success. Good: `--filter user.account.register --timeout-ms 10000` selects the original case index while other source errors still fail checking. Bad: using substring matching, renumbering filtered cases, counting no match as success, or timing out only the leader and leaking descendants.
+
 Cross build good: an x86 core uses ARM profiles, ARM Worker assets and x86 Go tools emitting ARM objects. Base: omitted target retains native behavior. Bad: replacing global host identity, executing an ARM build tool on x86, labeling x86 native extensions ARM, or deriving target loader permissions from the host.
 
 Native author base: fixed inputs and temporary key produce a verifiable manifest. Good: two different output names have identical manifests/signatures and payload digests, source mutation does not affect either published copy, and optimized profile programs run through the managed compiler. Bad: hard-link output to build caches, accept a debug all-features archive as four trimmed profiles, or call an unused PostgreSQL configuration a real database test.
@@ -344,7 +348,9 @@ Managed base: a zero-Lib Python/JavaScript Adapter still locks its signed runtim
 
 ## 6. Required Tests
 
-For onboarding select CLI `new_project`, lib `release_source`, shared-toolchain version/skill tests and native-release skill authoring tests, plus `python3 -B -m unittest discover -s test/onboarding -v`. Assert both formats check/format, no-overwrite concurrency, real CMD/Test/build output, exact signed extraction, corrupt-download retention, project-pinned guidance and foreign-user reads. The foreign-user test lowers only an owned client UID. Bootstrap script tests mock final installation; report that separately from real native-template execution. Do not activate host services or run full release/CI suites as an onboarding check.
+For onboarding select CLI `new_project`, lib `release_source`, shared-toolchain version/skill tests and native-release skill authoring tests, plus `python3 -B -m unittest discover -s test/onboarding -v`. Assert both formats check/format, no-overwrite concurrency, real CMD/Test/build output, exact signed extraction, corrupt-download retention, project-pinned guidance and foreign-user reads. Project skill installation must cover actual no-argument launcher dispatch from an owned cwd, create/append/replace/idempotence, preservation of user instructions, pinned template selection and failures before writes; no global AI directory or service is needed. The foreign-user test lowers only an owned client UID. Bootstrap script tests mock final installation; report that separately from real native-template execution. Do not activate host services or run full release/CI suites as an onboarding check.
+
+Test-control changes select CLI bin `test_arguments`, `case_process_captures_output_times_out_and_reaps_only_owned_descendants`, and `llvm_cli::test_filter_still_checks_unselected_sources_and_reports_no_match_before_compilation`. The opt-in `llvm_test_controls_preserve_indices_prefix_boundaries_and_timeout_continuation` consumes an explicitly prepared compiler-relative runtime pack. Assert actual non-first case execution, identity prefix boundaries, no-match failure, source errors outside the selection, timeout output/continuation, large output and owned child/grandchild reap with an unrelated child preserved. Never rebuild runtime archives recursively from tests.
 
 For installer-only changes select `test_install*.py` and `bash -n install`; also run `toolchain::release_source` when its Rust download owner changes. Assert actual Bash file/pipe help, isolated Python, literal argument/exit-status preservation, non-root sudo dispatch, independent-key authentication, new origin paths and rejected redirects. `verify_install_entry.py` is an opt-in actual signed-payload check: source-free entry, image-only first install, repeat install and corrupt-signature preservation. It uses an existing authenticated release/extractor and no host services; old payloads do not establish new-binary or online update acceptance.
 
@@ -406,6 +412,8 @@ Command execution observes guard exec through a private CLOEXEC pipe. Bind the P
 
 Wrong: update a skill symlink separately after changing the active core, treat a cached older version as a successful failed update, or delete a public output tree after a publication race. Correct: resolve core and signed skill from one active journal, return the original download failure, and publish exclusively owned staging with NOREPLACE.
 
+Test wrong: filter the checked source set, use blocking Command.output without a deadline, or reap every child after killing a test. Correct: select stable case indices after full checking, capture in the case-owned directory, enforce the deadline and reap only its retained process group.
+
 Installer wrong: recreate a separate skill installer or generator, take its key from the downloaded package, or assume changing Git remote changes an old launcher. Correct: maintain the sole root install source with its independent key, verify its actual Bash behavior, and migrate changed stable bootstrap binaries through a newly built signed release.
 
 Cross-target wrong: check ELF headers but use the host loader name to assign executable mode. Correct: validate target architecture and independently preserve each declared executable's mode across signed packaging, embedding and extraction; exercise the resulting Worker bootstrap under the target kernel.