fix(scripting): publish script caches through the shared atomic directory contract #55

Verified on branch / awaiting merge

Production implementation: dd5979c613b0fe8ebd9f7026f25001ceee9f8cee. Delivered head: dbae93e8f211d45a69cdffdb6afa3a33a0af0fa5; the subsequent diff contains documentation/acceptance evidence only. Exact-head CI: Engine CI and NuGet dependency graph passed; all six checks on this exact head are successful. All applicable acceptance conditions for this issue are verified; unavailable physical/manual device checks are explicitly scoped, not reported passed.

Owner: Core atomic directory publication and Compiler-owned complete cache trees. Implementation commits: dd5979c6.

Evidence: complete report, exact-head delivery attachment, portable test-case/raw-measurement/requirement indexes linked by the report. Specific proof: Public Compiler red/green temporary-reader regression; persistent failure, cancellation and exact whole-tree replacement preservation; Core IO41 and Compiler17 complete focused suites; five independent cold/warm formal publications; Corrected-source full matrices, formal companions, products, quantitative results and exact-head CI.

Commands: official tests/Invoke-EditorUiAcceptance.ps1 Contracts/Workflows/Visual/Lifecycle/Products with SDK-selected independent outputs; complete source/entry preparation; formal InnoEngine.Build scripts --ide for the three companions; tests/Invoke-WikiChecks.ps1; controlled public performance fixtures where applicable. The report records original command owners, TRX/binlogs, negative tests, failures, skips, input hashes and device limits.

Profiles overlap; do not sum their pass counts into a distinct-test claim. Windows-only sharing fixtures and Unix-only filesystem fixtures are scoped to the executing host. Real native contexts/simulated display metrics and hidden product feature journeys are not a claim of physical display, OS IME or manual Mac testing. No BGCS/vendor/package/generated-binding modification, parallel Core system, test hook, IVT or private reflection was used.

Keep this issue Open. PR #26 includes an individual Fixes #55 and will close it only when the user merges to master. No automatic merge or premature master-resolution claim.

Original defect, ownership and accepted work

The following baseline observations describe the issue as opened. The verification above supersedes intermediate pending checkpoints; original failed/negative logs remain preserved. Acceptance checkboxes are checked only after the exact delivery-head verification completes.

Parent and approved-plan mapping

Parent #27; prerequisite for #19 script/IDE consistency, #35 workflows and #39 deep Core reuse review. This is a newly observed final-acceptance failure, not a BGCS defect.

Confirmed observations and limits

At 5e329bbe96e4812fcec1207151dd98c520237bbd, all eleven build preparation stages and Contracts/Workflows/Visual/Lifecycle passed. Formal Canvas script/IDE generation then failed in ScriptCompilerEngine.CommitGenerationCache at a raw Directory.Move, with Windows access denied for the owned generation staging directory. The first log is retained under candidate-5e329bbe/companions/Canvas/generation.log in the acceptance evidence owner. One explicit repeat of the same formal command passed; the original failure is not reclassified as success.

Independent public Roslyn 5.9.0 probes using a small emitted dependency and a copy of the actual Canvas assembly did not reproduce a retained-file failure with file-backed references, owned images, explicit metadata disposal or AssemblyName.GetAssemblyName. A public BCL control holding a readable file with delete sharing did reproduce directory rename denial in all three trials. The original handle owner is unknown; do not claim an antivirus, Roslyn or BGCS cause.

Source review confirms that both script cache commits bypass the existing Core IO AtomicDirectory contract and destructively call a best-effort staging deletion helper for an existing invalid published destination. Core already owns bounded platform rename handling, rollback-safe replacement and cancellation-aware create-only publication. Do not add another script-specific retry loop or platform branch.

Owners and boundaries

• Core IO owns atomic directory publication/replacement, its existing bounded filesystem policy and rollback.
• Scripting Compiler owns complete staged assemblies, cache selection/validation and operation cancellation.
• Editor/CLI remain callers; neither acquires platform-specific recovery code.
• BGCS, packages, vendor source and generated bindings remain unchanged.

Implementation plan

1. Reuse Core AtomicDirectory.Publish for an absent cache destination and rollback-safe AtomicDirectory.Install when replacing an invalid owned entry; preserve successful complete reuse.
2. Stop best-effort recursive deletion from being the replacement transaction for published cache trees. Keep private staging cleanup separate from publication semantics.
3. Pass the existing compilation token through assembly and generation commits. If needed, complete the existing Install API with one optional CancellationToken, consistent with Publish, without retaining an old overload. Cancellation before commit must preserve/restore the previous tree; rollback must not be disabled by an already-canceled token; committed publication must not be reported as uncommitted.
4. Add the actual internal Core IO project dependency with correct API visibility; add no cache manager, identity table, event system, compatibility path, test hook, IVT or private reflection.
5. Update current XML/Wiki and actual callers for the changed contract.

Executable acceptance

• A public compiler regression proves that temporary observation of complete staged assemblies is handled by the existing Core publication policy; retain a before-fix failure and after-fix pass.
• Permanent blockage/failure and cancellation do not publish incomplete artifacts or destroy the previous tree; exact ownership and cleanup diagnostics remain visible.
• Core Install cancellation/rollback tests run through public APIs, including canceled preparation and cancellation while a rename is blocked where the platform permits the fixture.
• Fresh independent Canvas copies force actual cold publication; fixed input warm compilation reuses valid outputs without corruption or unnecessary rewriting.
• Formal Canvas, Rendering2D and FlappyBird script/IDE operations pass; product and compile consumers remain consistent.
• Core IO, Compiler, source/architecture/XML/Wiki and complete final applicable UI/product/performance/CI gates pass on the corrected source.
• No script-specific retry, timeout relaxation, forced GC, process kill, fabricated output, BGCS edit or platform coupling is used as the production fix.

Evidence and closure

Evidence owner: D:/InnoEngine-Verification/editor-ui-closure-2026-10-27/script-publication-investigation; preserve roslyn-directory-probe.log, roslyn-actual-payload.log, assembly-name-probe.log, the original failed formal command and canvas-repeat-1.log. A repeat success alone does not establish the original handle's cause. Record implementation commits, raw tests and final commands.

Keep Open until verified on branch and linked by an individual Fixes line in PR #26. Close on merge to master only. PR #26 remains Draft until all applicable final gates pass; no automatic merge is authorized.