From 410292264012173e23298e663f4502556b5a693d Mon Sep 17 00:00:00 2001 From: Joseph Doherty Date: Thu, 22 Oct 2026 06:25:32 -0400 Subject: [PATCH] docs(templateengine): drop the removed staleness memo; describe the full shared-script compile gate (review 2026-10-21 04/U2, 04/U3) --- docs/requirements/Component-TemplateEngine.md | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/docs/requirements/Component-TemplateEngine.md b/docs/requirements/Component-TemplateEngine.md index c0a44e20..8f82018b 100644 --- a/docs/requirements/Component-TemplateEngine.md +++ b/docs/requirements/Component-TemplateEngine.md @@ -199,11 +199,12 @@ not replicated between central nodes. A restart, a failover, or any mutation sim misses and falls back to the authoritative full flatten, so the watermark can only ever cause EXTRA work, never stale work. -The same watermark backs a **staleness fast path** in `StaleInstanceProbe`: a -previously computed revision hash is reused when the instance's version, the -structure version, and the version of every template that flatten walked are all -unchanged. This matters most where the probe is called per-instance across a whole -bundle import or a fleet-wide staleness sweep. +The watermark does **not** back any staleness memo. `StaleInstanceProbe` once reused +a previously computed revision hash while the watermark versions were unchanged; that +fast path was removed (MG-3), because the watermark is process-local and a +configuration edit made through the *other* central node never bumps it. Every probe +now starts a fresh flatten session — see `Component-DeploymentManager.md` → +*Authoritative staleness and bulk deadlines* (review 2026-10-21 04/U2). ### Design-time analysis reads @@ -327,7 +328,9 @@ The same validation logic is available to Design users in the Central UI without ### Shared Script Validation -For shared scripts, pre-compilation validation is performed before deployment. Since shared scripts have no instance context, validation uses `RoslynScriptCompiler.ParseDiagnostics` for syntax errors and `ScriptTrustValidator.FindViolations` for the forbidden-API check. Full type-checking compilation is not performed (no globals type is available), but syntax and trust violations are caught and reported. +`SharedScriptService` validates on **create and update** (review 2026-10-21 04/U3 — the MG-8 remediation made this a full gate): a cheap structural pass (`CSharpDelimiterScanner` — balanced delimiters outside strings/comments) followed by the **same authoritative gate as instance scripts**, `ScriptCompiler.TryCompile` — `ScriptTrustValidator.FindViolations` for the forbidden-API check plus a real Roslyn type-checking compile against **`ScriptCompileSurface`**, the instance-script globals surface. A save that fails either stage is rejected with the error text. + +Gating against the instance surface is a design decision worth knowing: a shared script executes inline inside the calling script's context, so it is type-checked as if it were an instance script. A shared script that references an identifier the instance surface does not expose fails at save, and one that uses an instance accessor (`Attributes`, `Instance`, …) compiles — whether that accessor is meaningful at run time depends on the caller. ## Dependencies