{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp09_archetype_breadth150_20260804","cell_id":"bulkhead_isolation__computer_science","arm":"BREADTH_PROBE_ONE_SHOT","candidate_id":"bulkhead_isolation__computer_science__P1","proposal_index":1,"version":0,"title":"Workspace-Root Bulkheads for Multi-Root Language Servers","problem":"A language server serving several workspace roots in one editor session can place all roots' indexing jobs, syntax trees, caches, and request handling in one process and memory pool. A malformed generated source tree, recursive symlink, pathological type-analysis case, or rapidly changing build output in one root can exhaust that pool or wedge the shared event loop, causing diagnostics, navigation, and completion to fail for otherwise healthy sibling roots.","actors":["Developers using multi-root editor workspaces","Language-server maintainers","Editor-integration maintainers","Repository and developer-tooling administrators"],"observable_state":"During an indexing or analysis incident originating in one workspace root, process-level memory or CPU reaches its limit, request latency rises across every open root, healthy roots stop receiving diagnostics or navigation results, and recovery requires restarting the shared language-server process and rebuilding unrelated indexes.","consequence":"A local repository defect or analysis workload interrupts development across unrelated workspace roots, discards healthy incremental state, and prevents unaffected codebases from retaining minimum viable language-tooling function.","affected_objective":"Preserve responsive diagnostics, navigation, and completion for healthy workspace roots while permitting the affected root to degrade and recover locally.","intervention":"Run each workspace root, or a small explicitly defined root cohort, in a separately budgeted analysis compartment with its own worker process, memory ceiling, CPU/concurrency allowance, index store, and restart lifecycle. Keep only a thin session coordinator shared. Cross-root symbol lookup must traverse an explicit, bounded interface that exchanges immutable symbol summaries rather than granting direct access to another compartment's mutable heap or index. When a compartment exceeds its budget or becomes unresponsive, quarantine and restart only that compartment while sibling compartments continue serving requests.","structural_mapping":[{"archetype_element":"Shared critical resource and coupled failure domain","domain_realization":"One language-server process shares heap, execution queues, mutable indexes, and restart fate across multiple workspace roots."},{"archetype_element":"Identifiable compartments","domain_realization":"Workspace roots or deliberately configured root cohorts form sibling analysis compartments."},{"archetype_element":"Resource partitioning","domain_realization":"Each compartment receives bounded memory, worker concurrency, CPU allowance, index storage, and request queues."},{"archetype_element":"Containment boundary","domain_realization":"Separate worker processes and index namespaces prevent one root's runaway analysis or corrupted incremental state from consuming or mutating sibling compartments."},{"archetype_element":"Selective coupling through explicit interfaces","domain_realization":"A coordinator routes editor requests and permits cross-root queries only through bounded immutable symbol-summary messages."},{"archetype_element":"Minimum viable function","domain_realization":"Healthy roots continue providing diagnostics and navigation even when one root is quarantined."},{"archetype_element":"Local recoverability","domain_realization":"Only the failed root's worker and derived index are restarted or rebuilt."}],"mechanism_mapping":[{"mechanism_slug":"resource_partitioning","role":"Assigns each root a hard resource budget so a runaway analyzer cannot exhaust the entire session's heap or worker capacity.","counterfactual_removal":"If workers are separate but draw from an unbounded common resource pool, the pathological root can still starve healthy roots and containment is false."},{"mechanism_slug":"fault_domain_isolation","role":"Separates mutable analysis state and restart fate by workspace root.","counterfactual_removal":"If all roots retain one mutable index or process lifecycle, corruption or a crash still forces session-wide recovery."},{"mechanism_slug":"selective_coupling","role":"Preserves useful cross-root navigation through governed summary exchange without restoring shared mutable state.","counterfactual_removal":"With unrestricted cross-root heap or index access, failures can propagate; with no coupling, legitimate cross-repository navigation is lost."}],"causal_chain":["Multiple roots share mutable analysis state and finite execution resources.","A pathological workload in one root consumes or wedges those shared resources.","Because capacity and restart fate are coupled, healthy roots lose language-tooling service.","Per-root worker, quota, and index boundaries cap the originating root's consumption and state mutation.","Explicit summary interfaces retain necessary cross-root queries without exposing sibling mutable state.","The affected compartment can be quarantined and restarted locally.","Healthy compartments retain minimum viable diagnostics and navigation during the incident."],"baseline":"A single long-lived language-server process indexes all workspace roots, uses a common heap and scheduling queue, and responds to overload or corruption with a whole-process restart or full-session index rebuild.","nearest_rivals":["Whole-process watchdog and automatic restart, which shortens recovery but still interrupts and discards state for every root.","Request prioritization or load shedding, which may preserve interactive traffic but does not isolate memory corruption, index corruption, or restart fate.","Analyzer optimization and pathological-input fixes, which address known triggers but leave new root-local failures coupled to the whole session.","Independent language-server instances with no cross-root interface, which isolate failures but sacrifice required cross-root navigation and coordinated editor behavior."],"remaining_contrastive_claim":"The candidate's distinguishing claim is structural: per-root ownership of bounded resources and mutable state, combined with an explicit cross-root summary interface, can make overload and recovery local while retaining selected multi-root behavior. It is not merely a faster restart, a scheduler policy, or complete separation.","authority_safety":{"decision_authority":"The language-server and editor-integration maintainers may authorize an opt-in prototype; repository administrators and developers retain control over whether their workspaces participate.","authorized_first_step":"Build a local test-harness prototype that places two synthetic workspace roots in separate workers and exercises only recorded or generated protocol requests, without changing production defaults or collecting user source code.","excluded_actions":["Enabling the design by default for users","Uploading source, indexes, or protocol traces","Terminating processes outside the prototype harness","Deleting canonical indexes or repository data","Silently blocking cross-root requests","Using compartment limits as a security boundary without separate security review"],"halt_rollback":"Stop the harness if it accesses files outside its synthetic fixtures, interferes with an existing editor process, or cannot attribute resource use by compartment. Roll back by terminating the harness and removing only its temporary worker state."},"negative_tests":{"strongest_counterevidence":"Under an injected runaway analysis in one root, sibling-root requests still stall or fail because the coordinator, filesystem watcher, compiler daemon, or another supposedly shared-safe dependency saturates.","problem_falsifier":"Measurements show that observed multi-root failures are not propagated through shared capacity, mutable state, or restart fate, but arise independently in every root or from an unavoidable session-global dependency.","intervention_falsifier":"After introducing per-root workers and budgets, a failing root still prevents a healthy root from completing bounded diagnostic and navigation requests, or cross-root coordination becomes unusable under ordinary non-failure workloads.","risks":["Hidden coupling through a shared coordinator, filesystem watcher, compiler daemon, or operating-system resource limit may create false isolation.","Fixed budgets may strand memory or CPU in idle compartments while an active root degrades.","Process and index duplication may increase startup cost and baseline resource consumption.","Immutable summaries may become stale and produce inconsistent cross-root navigation.","Over-partitioning may create too many workers and excessive coordination overhead.","Developers may perceive unfair local degradation when one root hits its budget despite spare capacity elsewhere.","Automatic quarantine could mask analyzer defects unless incidents remain observable.","Boundary bypasses added for performance could reintroduce uncontrolled coupling."]},"next_evidence_step":"In one bounded local harness run, create two synthetic roots, establish baseline diagnostic and navigation completion for both, inject an unbounded indexing fixture into one root, and record whether the other root continues completing a fixed request script while only the affected worker reaches its limit and restarts. Also inspect coordinator and shared-dependency resource use to detect containment leakage. This test evaluates feasibility and propagation structure, not production effect size.","prior_art_status":"UNSEARCHED","diversity_from_prior_proposals":"Not assessed against other experiment proposals because runtime isolation forbids inspecting them; this candidate is independently derived from the supplied archetype and domain card.","revision_record":{"parent_version":null,"progress_targets_addressed":[],"conceptual_changes":[],"operational_changes":[],"evidence_changes":[],"claim_changes":[]}}