feat(repo): reuse CompileError verdicts keyed on the checker's whole program

[systemfsoftware-maker]

Summary

This layer goes on top of #227. An incremental run now reuses CompileError verdicts instead of type-checking every one again. On main, CompileError is an ephemeral status (Mutant.schema.ts:25), so every run re-checks 3,888 mutants: 3,547 in stryker-js, 238 in typescript-checker and 103 in vitest-runner. That re-check is the largest fixed cost per shard; run 37622289361 on db180fc3, with nothing to re-test, still spent about 100 s per shard on stryker-js.

Reuse key (operator rule, cycle 116)

A remembered CompileError is reused only when the reuse key matches. The key covers every input of the type check:

• the mutant's identity and its replacement (existing key);
• the content hash (sha256) of every file in the TS program the checker loaded (Program.getSourceFiles()). That includes lib .d.ts files and node_modules declarations, sorted by normalised path so enumeration order cannot matter;
• every tsconfig the program was built from;
• the TypeScript version, the checker plugin version, and the checker's options.

The checker computes this digest and serves it through a new digest RPC. The engine stamps it beside each CompileError it writes. A missing or different digest means the mutant is re-checked, and the refusal reason is programChanged. Hashing the current program needs the checker running, so this saves the per-mutant checks, not checker startup.

Stream

ReuseReported.reused counts reused CompileError verdicts. ReuseRefusals gains programChanged, added as an optional key so stream lines from earlier engines still decode. The schema version is unchanged.

Breaking (BREAK-1)

Every checker worker must answer the digest RPC. The plugin interface and stryker-js therefore take major bumps; the TypeScript checker and the cli-contract take minor bumps.

Validation

• Failing before: packages/stryker-js/tests/compile-error-reuse.integration.test.ts was run in a scratch worktree on origin/main and failed 4 of 4 scenarios. For example, "an unchanged rerun reuses the CompileError verdicts and checks nothing" got secondRanNothing: 4 (expected 0) and secondReusedAll: false (expected true).
• Passing after (re-run by me): both acceptance suites pass, now including the extends-chain and relocation cases.
  • Engine (compile-error-reuse.integration.test.ts): an unchanged rerun reuses every verdict with zero checks; editing a transitively imported .d.ts re-checks; changing tsconfig re-checks; editing an unrelated test file keeps every verdict.
  • Real TypeScript checker (program-digest.integration.test.ts): runs the same cases against the checker's program digest.
• Key properties: identify-program.workflow.property.test.ts checks that a permuted file set gives the same key, and that changing the TS version, checker version, options, an added file, or the tsconfig moves the key.
• Gates (re-run by me on the head): format and check:ci (112/112, 17/17) pass, the stryker-js and typescript-checker suites pass, and the changeset check passes with intents for all 4 packages. Verdict-Semantics: unchanged: a verdict is reused only when the inputs equal those of the check that produced it, so statuses equal a from-scratch run (EXACT).
• Effect on main: none until a release. Main's Mutation run uses the published CLI, so the effect shows on the second main run after a release that contains this layer; the first run writes the digests.

Review (correctness, adversarial and simplify lenses, before opening)

Fixed, each with a test that fails before the fix:

• P0: the tsconfig extends chain, both relative paths and package specifiers, is now hashed into the digest. The checker and engine suites each gain a test that edits only the base config and expects a re-check.
• P1: digest paths are now relative to the project root. The checker runs inside .stryker-tmp/sandbox-<random>/, so with absolute paths the key would never match on CI. A new test copies the same fixture into two directories and gets the same digest.
• Checker options are canonicalized. An encoding failure now produces no digest, so the mutant is re-checked, where before it produced an empty string.
• A failed closure analysis now gets its own refusal reason.
• Simplified: one key builder, one version reader, and program files are read with bounded concurrency.

Dismissed:

• Hashing the raw tsconfig rather than the checker's override text. The override is a pure function of the raw text and the checker version, and both are in the key.
• One checker failure dropping every digest. That only forces a re-check.
• @noble/hashes. It is the repo convention, and the PLUG-1 build gate passes.

Nothing was run with stryker.

Borrowed / rejected

• Borrowed: Bazel action keys hash every declared input, toolchain version and flags, not just the changed file. PIT history reuses results only when the class and its tests are unchanged.
• Rejected: keying on the mutated file's import closure. The engine's closure analysis excludes .d.ts and node_modules, so that key would be too narrow.

[kiro-systemf]

CompileError reuse keyed on every program file + tsconfigs + TS/checker versions; tests cover .d.ts and tsconfig changes. 8/8 green.