IDE vertical: hybrid C# host with Roslyn semantic extraction and Rust core

[PhysShell]

Parent: #250
Recommended tier: strong, cross-language
Blocked by: #259 and #260
Informed by: #263
Follows lessons from: #264

Goal

Build the flagship IDE analysis path for real C# without reimplementing C# semantics in Rust:

IDE host / Roslyn semantic model
  -> incremental OwnIR facts
  -> Rust own-bridge/core
  -> diagnostics
  -> editor publication

Roslyn remains the semantic frontend. Rust owns the portable OwnIR/core half.

Design checkpoint

Before implementation, record an ADR covering:

• host process model;
• persistent Rust process over stdio versus FFI;
• request/response framing and versioning;
• document/project version identity;
• cancellation propagation;
• OwnIR full snapshot versus delta protocol;
• crash isolation/restart behavior;
• diagnostic ownership and stale-result prevention;
• security and resource limits.

Do not begin with a generic plugin framework. Implement the narrow C# vertical.

Stage 1: persistent full-snapshot prototype

Build the simplest correct path first:

1. Roslyn host obtains the semantic model for the current document/project.
2. Extract current OwnIR using the established frontend semantics.
3. Send one versioned OwnIR snapshot to a persistent Rust process.
4. Run own-bridge/analysis.
5. Map diagnostics to the exact C# source version.
6. Cancel/suppress stale work.

This stage establishes protocol correctness before delta complexity.

Stage 2: incremental extraction and invalidation

Using #263 profiling, add only the invalidation granularity required to meet the latency budget:

• changed document;
• affected symbols/functions;
• project references;
• interprocedural summary invalidation;
• deleted/renamed documents;
• configuration/reference changes.

The host must never reuse facts across incompatible compilation/project versions.

Protocol requirements

Every request/result carries:

• protocol version;
• workspace/project/document identity;
• source/compilation version;
• request ID;
• cancellation relationship;
• OwnIR schema version;
• content/input hash where useful.

Unknown protocol/schema versions fail loudly and actionably.

Diagnostic publication

• Results publish only against the source version they analyzed.
• Superseded results are discarded.
• Rust diagnostic paths/spans map to the current Roslyn document identities.
• Evidence/related locations may cross files/projects where the current contract supports it.
• Engine crashes produce visible telemetry/logs and do not silently become clean analysis.

Test matrix

• single C# document clean/leak cases;
• syntax-incomplete document while editing;
• rapid successive edits;
• edit that removes a finding;
• edit in a callee affecting a caller summary;
• project reference change;
• file rename/delete;
• multi-project solution;
• Unicode/line-ending controls;
• Rust process crash/restart;
• cancellation during extraction and during Rust analysis;
• stale-result suppression;
• parity against batch owen check for saved snapshots.

Performance

Measure:

• Roslyn extraction time;
• serialization/transport;
• Rust parse/bridge/analysis;
• result mapping/publication;
• warm edit-to-diagnostic;
• no-op edit;
• project-wide invalidation;
• memory of the persistent host/core.

Use #263 budgets. Do not claim success from core-only timings.

Guardrails

• Do not write a C# parser/type system in Rust.
• No new diagnostic semantics.
• No generic frontend/plugin platform.
• No automatic clean result after Rust crash.
• No stale diagnostic publication.
• No delta protocol before the full-snapshot path is correct and measured.
• No mandatory IDE dependency for the batch CLI.

Acceptance

• ADR approved.
• Persistent Roslyn → OwnIR → Rust path works end to end.
• Saved-snapshot results match batch Owen under the established parity contract.
• Rapid edits and cancellation never publish stale diagnostics.
• Cross-file/interprocedural invalidation controls pass.
• Measured edit latency meets the approved budget or remaining bottleneck is isolated and documented.
• Batch CLI and release surfaces remain independent.