Stop capping workspace fan-out width, narrow inspect_code bridge dispatches (ADR-0095)

A 72-project workspace's nested lint from inspect_code was refused
outright: OrchestrationPolicy.max_project_fanout (64) fired on any
fan-out wider than the cap once orchestration_depth > 0, even though
the width was just the workspace's own project count, not a runaway.
A width cap can never distinguish the two, since a nested fan-out's
width is bounded by the same project count a depth-0 call would use.
Drop it and rely solely on max_recursion_depth, extended to the ER
back-channel (`run_action_in_workspace`) so every fan-out entry point
enforces the same height guard.

The lint/type_check inspect_code bridges were also the source of the
runaway width in the first place: each per-project dispatch sent the
nested action the workspace-wide payload.project_paths instead of its
own project, so the nested instance re-resolved the whole workspace
and gathered across it again — N instances x N projects. Narrow the
dispatched payload to the one project each bridge call owns.

Narrowing exposed a second bug in the lint/type_check handlers' IDE
opened-files branch: a narrowed run reported every open file across
all projects, not just its own, so a foreign project's open file was
sent back with no entry in this run's partial result — an empty list
the IDE reads as "no diagnostics," clearing that file's real ones.
Filter opened files down to the run's own projects before reporting
them.

Author: Aksem

docs/guides/wm-server-internals.md

@@ -437,10 +437,12 @@ the env deleted and recreated. A timed-out check is also retried with a longer d
 (`VERSION_CHECK_TIMEOUTS_SEC`) before the env is declared invalid, and every invalid verdict
 carries its reason into the `prepare-envs` warning.
 
-`OrchestrationPolicy.max_project_fanout` (64) is a *separate* mechanism and is not a capacity
-limit: it refuses, and it applies only when `orchestration_depth > 0`. It guards against runaway
-recursive orchestration, not against a large workspace. A request arriving from a person at depth
-0 is never refused for width — see ADR-0067, which amends ADR-0016 on this point.
+`OrchestrationPolicy.max_recursion_depth` bounds orchestration at every entry point: the
+project executor, and both workspace fan-out entries (`WorkspaceExecutor` and the streaming
+batch handler). Each refuses a call whose caller is already at the limit. There is **no width
+refusal**: a nested fan-out's width can never exceed the workspace's project count, so a width
+cap would measure the workspace rather than a runaway. Subprocess width is bounded at the leaf
+by the process budget above — see ADR-0095, which supersedes ADR-0067's width decision.
 
 ### Auto-repair (`install_env_for_project`)
 

presets/fine_lint/fine_lint/lint_handler.py

@@ -128,8 +128,17 @@ async def run(
             and run_meta.dev_env == code_action.DevEnv.IDE
             and run_meta.trigger == code_action.RunActionTrigger.SYSTEM
         ):
+            # Only this run's projects: a narrowed run (e.g. one project of an
+            # inspect_code bridge) must not report the other projects' open files,
+            # because it would send them as empty -- and an empty list clears that
+            # file's diagnostics in the IDE, racing the project that owns it.
+            opened_by_project = group_files_by_project(
+                self.file_editor.get_opened_files(), project_paths
+            )
             file_uris = [
-                path_to_resource_uri(p) for p in self.file_editor.get_opened_files()
+                path_to_resource_uri(p)
+                for files in opened_by_project.values()
+                for p in files
             ]
         else:
             files = await _list_workspace_files(

presets/fine_lint/fine_lint/lint_inspect_code_bridge_handler.py

@@ -65,7 +65,11 @@ async def _run_lint_for_project(
             payload=LintRunPayload(
                 target=LintTarget(payload.target.value),
                 file_paths=payload.file_paths,
-                project_paths=payload.project_paths,
+                # `lint` is workspace-scoped, and this dispatches it into one
+                # project. Without narrowing, every per-project instance
+                # re-resolves the whole workspace and gathers across it: N
+                # instances x N projects.
+                project_paths=[path_to_resource_uri(project_path)],
             ),
             meta=run_meta,
             project_paths=[project_path],

presets/fine_lint/tests/test_lint_handler_opened_files.py

@@ -0,0 +1,209 @@
+"""The IDE opened-files branch covers only the run's own projects.
+
+A narrowed run (one project of an ``inspect_code`` bridge) must not report the
+other projects' open files. An opened file with no entry in a project's partial
+result is sent as an empty list, and the IDE clears that file's diagnostics —
+so a foreign file in a narrowed run would blank a buffer another project owns.
+"""
+
+from __future__ import annotations
+
+import pathlib
+import typing
+
+from fine_lint.lint_action import LintRunPayload, LintTarget
+from fine_lint.lint_files_action import (
+    LintFilesAction,
+    LintFilesRunResult,
+)
+from fine_lint.lint_handler import LintHandler, LintHandlerConfig
+from fine_src_artifacts.list_src_artifact_files_by_lang_action import (
+    ListSrcArtifactFilesByLangAction,
+)
+from finecode_extension_api.interfaces.iworkspaceinfoprovider import (
+    ProjectConfigStatus,
+    WorkspaceProject,
+)
+from finecode_extension_api.resource_uri import path_to_resource_uri
+
+from finecode_extension_api import code_action
+
+
+class _FakeWorkspaceInfoProvider:
+    def __init__(self, project_paths: list[pathlib.Path]) -> None:
+        self._project_paths = project_paths
+
+    async def get_workspace_projects(self) -> list[WorkspaceProject]:
+        return [
+            WorkspaceProject(path=path, config_status=ProjectConfigStatus.VALID)
+            for path in self._project_paths
+        ]
+
+
+class _FakeFileEditor:
+    def __init__(self, opened_files: list[pathlib.Path]) -> None:
+        self._opened_files = opened_files
+
+    def get_opened_files(self) -> list[pathlib.Path]:
+        return list(self._opened_files)
+
+
+class _FakeLogger:
+    def info(self, message: str) -> None: ...
+
+    def debug(self, message: str) -> None: ...
+
+    def warning(self, message: str) -> None: ...
+
+    def error(self, message: str) -> None: ...
+
+
+class _RecordedCall:
+    def __init__(
+        self,
+        action_type: type,
+        payload: code_action.RunActionPayload,
+        project_paths: list[pathlib.Path],
+    ) -> None:
+        self.action_type = action_type
+        self.payload = payload
+        self.project_paths = project_paths
+
+
+class _RecordingWorkspaceActionRunner:
+    def __init__(self) -> None:
+        self.calls: list[_RecordedCall] = []
+
+    async def run_action_in_projects(
+        self,
+        action_type: type,
+        payload: code_action.RunActionPayload,
+        meta: code_action.RunActionMeta,
+        project_paths: list[pathlib.Path] | None = None,
+        concurrently: bool = True,
+    ) -> dict[pathlib.Path, code_action.RunActionResult]:
+        assert project_paths is not None
+        self.calls.append(_RecordedCall(action_type, payload, list(project_paths)))
+        if action_type is LintFilesAction:
+            return {
+                path: LintFilesRunResult(
+                    messages={uri: [] for uri in payload.file_paths}
+                )
+                for path in project_paths
+            }
+        return {}
+
+
+class _CollectingPartialResultSender:
+    def __init__(self) -> None:
+        self.results: list[code_action.RunActionResult] = []
+
+    async def send(self, result: code_action.RunActionResult) -> None:
+        self.results.append(result)
+
+
+class _FakeProgress:
+    async def __aenter__(self) -> typing.Self:
+        return self
+
+    async def __aexit__(self, *exc: object) -> bool:
+        return False
+
+    async def advance(self, steps: int, message: str | None = None) -> None: ...
+
+
+class _FakeRunContext:
+    def __init__(
+        self,
+        sender: _CollectingPartialResultSender,
+        trigger: code_action.RunActionTrigger,
+        dev_env: code_action.DevEnv,
+    ) -> None:
+        self.meta = code_action.RunActionMeta(trigger=trigger, dev_env=dev_env)
+        self.partial_result_sender = sender
+
+    def progress(
+        self, title: str, *, total: int | None = None, cancellable: bool = False
+    ) -> _FakeProgress:
+        return _FakeProgress()
+
+
+def _handler(
+    action_runner: _RecordingWorkspaceActionRunner,
+    project_paths: list[pathlib.Path],
+    opened_files: list[pathlib.Path],
+) -> LintHandler:
+    return LintHandler(
+        config=LintHandlerConfig(),
+        workspace_action_runner=action_runner,  # type: ignore[arg-type]
+        workspace_info_provider=_FakeWorkspaceInfoProvider(project_paths),
+        file_editor=_FakeFileEditor(opened_files),  # type: ignore[arg-type]
+        logger=_FakeLogger(),  # type: ignore[arg-type]
+    )
+
+
+async def test_narrowed_ide_run_lints_only_its_own_opened_files(
+    tmp_path: pathlib.Path,
+) -> None:
+    """With the run narrowed to project A, only A's open files are linted and
+    the other project's open file is never sent as an empty result."""
+    project_a = tmp_path / "a"
+    project_b = tmp_path / "b"
+    file_a = project_a / "mod.py"
+    file_b = project_b / "mod.py"
+    action_runner = _RecordingWorkspaceActionRunner()
+    sender = _CollectingPartialResultSender()
+
+    await _handler(
+        action_runner, [project_a, project_b], [file_a, file_b]
+    ).run(
+        LintRunPayload(
+            target=LintTarget.PROJECT,
+            project_paths=[path_to_resource_uri(project_a)],
+        ),
+        _FakeRunContext(
+            sender, code_action.RunActionTrigger.SYSTEM, code_action.DevEnv.IDE
+        ),  # type: ignore[arg-type]
+    )
+
+    assert len(action_runner.calls) == 1
+    call = action_runner.calls[0]
+    assert call.action_type == LintFilesAction
+    assert call.project_paths == [project_a]
+    assert call.payload.file_paths == [path_to_resource_uri(file_a)]
+    assert ListSrcArtifactFilesByLangAction not in [
+        recorded.action_type for recorded in action_runner.calls
+    ]
+    sent_uris = {uri for result in sender.results for uri in result.messages}
+    assert path_to_resource_uri(file_b) not in sent_uris
+
+
+async def test_unscoped_ide_run_lints_opened_files_in_every_project(
+    tmp_path: pathlib.Path,
+) -> None:
+    """Without a project narrowing the IDE path still lints every project's
+    open files — the filter must not shrink the common direct-lint case."""
+    project_a = tmp_path / "a"
+    project_b = tmp_path / "b"
+    file_a = project_a / "mod.py"
+    file_b = project_b / "mod.py"
+    action_runner = _RecordingWorkspaceActionRunner()
+    sender = _CollectingPartialResultSender()
+
+    await _handler(
+        action_runner, [project_a, project_b], [file_a, file_b]
+    ).run(
+        LintRunPayload(target=LintTarget.PROJECT, project_paths=None),
+        _FakeRunContext(
+            sender, code_action.RunActionTrigger.SYSTEM, code_action.DevEnv.IDE
+        ),  # type: ignore[arg-type]
+    )
+
+    lint_calls = [
+        call for call in action_runner.calls if call.action_type == LintFilesAction
+    ]
+    linted_uris = {uri for call in lint_calls for uri in call.payload.file_paths}
+    assert linted_uris == {
+        path_to_resource_uri(file_a),
+        path_to_resource_uri(file_b),
+    }