Decode covdata in-process for indexing speed, and fix nine review-found bugs

[emoss08]

Indexing performance on large workspaces

assay index shelled out to go tool covdata textfmt once per test: each subprocess re-read the package's whole-closure coverage meta and serialised a text profile dominated by zero-count lines that ParseProfile immediately discarded. That cost scales with tests × dependency-closure size — the product that buries large workspaces. BENCHMARKS.md had already named this follow-up and deferred it because the binary formats are internal to the Go toolchain.

This PR builds the in-process decoder for the covmeta/covcounters binary formats (version-stamped, unchanged since Go 1.20), with the maintenance trap fenced rather than walked into blind:

• every read is bounds-checked; any structural surprise — future version, foreign magic, meta-hash mismatch, truncation — makes the whole package fall back to the covdata subprocess path, which stays first-class. An incompatible future toolchain costs time, never correctness.
• a parity test drives the real toolchain end to end (real instrumented build, real harness run) and requires the decoder's blocks to equal the textfmt path's exactly, init window and skipped-test windows included.
• the existing harness-vs-legacy agreement tests pass unchanged.

Measured on a synthetic monorepo-shaped workspace (30 test packages × 20 tests, each closing over 61 instrumented packages, warm build caches, 4 cores): 13.1s → 8.5s wall, user+sys CPU 41.3s → 25.7s. At a 201-package closure: 8.7s → 5.7s. The per-test conversion tax is gone entirely; what remains is compile, link and test execution. Numbers are recorded in BENCHMARKS.md.

Bug fixes

Each fix carries a regression test (the cgo one is covered by the corpus tests); the leak test was verified red against the old code.

Silent under-selection — the failure mode this tool must never have:

• selection: editing an existing test's body selected nothing. Test files classify as narrowable, but coverage never instruments _test.go, so attribution found nothing and the package dropped — the edited test never ran. Test-file edits now run the owning package in full (comment-only edits still drop safely).
• index: fingerprints hashed nothing root-dependent while records intern absolute paths, so two checkouts sharing a cache directory served each other records whose every path missed — and narrowed to nothing. The workspace root is now part of every fingerprint.

Wrong verdicts:

• watch: narrowing to TestMain ran zero tests and printed a green cycle; it now declines refinement like Benchmark/Example.
• watch: a crashed run (panic, -test.timeout dump, os.Exit) credited passes to requested tests it never reached, fabricating the exact conflicting evidence the flake journal exists to detect. Passes are credited only when the failing binary printed its FAIL trailer.
• risk/vcs: git log --numstat prints toplevel-relative paths while risk keys lookups root-relative, so --root <subdir> zeroed all churn and printed a green report produced by a key mismatch. Churn is now keyed relative to the analysis root.
• flake: journal compaction kept the oldest observations on timestamp ties (batched writes share one clock reading), the opposite of the documented contract.

Resource and attribution bugs:

• mutate: the deferred schemata cleanup iterated the live slice the harness path nils, leaking one workdir — overlays plus compiled test binaries — per batch of every default-mode run.
• mutate: syntaxPath fell back to indexing GoFiles positionally for Syntax, two lists that disagree for cgo packages, splicing mutations into the wrong file. The path now comes from the parsed tree's own position info; cgo-generated cache files yield no mutants.
• watch: a staging .tmp binary left by a killed build could be promoted as fresh when a later build of a now-testless package produced no output. The staging path is cleared before every build.

Smaller:

• selection/index: a go.mod under testdata (fixture, never read by the build) forced a whole-workspace run and, hashed as unowned, invalidated the entire index on any fixture edit. It now attributes to its owning package.
• cli: color was decided from stdout's TTY-ness while run/verify/progress write to stderr — assay run 2>log wrote escapes into the log. Stderr-bound output now consults stderr.
• cli: --jobs help claimed a GOMAXPROCS default; the real default has been half of GOMAXPROCS since the inner build-parallelism split.

Testing

• go vet ./... clean, full go test ./... -count=1 green.
• New parity + rejection tests for the decoder; regression tests for each behavioural fix.
• End-to-end smoke: cold assay index on this repo (17 packages / 349 tests), then a warm rerun reusing all 17 records in 5ms.

🤖 Generated with Claude Code

https://claude.ai/code/session_01211tSDyqM7KnfziwEjPzDF

---

Generated by Claude Code