perf(javascript): query selected source-to-bundle facts (#6128)

Select completed source-to-bundle mappings and candidates through the shared view owner, preserve reference-file provenance, and retain full Evidence. Reuse bounded JSON reading, heap admission, and cancellation before session writes.

Verified public Redux Toolkit source/map facts with an independent oracle, equivalent CLI/MCP workflows, focused negative controls, and complete CI/review. Historical paired SDK context estimates fall about 64%; timing/resource tradeoffs and final verification receipts are recorded without a general speedup or actual model-token claim.

Fixes #6112.

src/application/javascript/JavaScriptApplicationWorkflowService.ts

@@ -1,3 +1,4 @@
+import type { ResolvedSourceToBundleReference } from "./SourceToBundleReference.js";
 import { z } from "zod";
 
 import { AnalysisProtocolError } from "../../domain/analysisErrorCore.js";
@@ -184,7 +185,8 @@ export const compareApplicationVersionsEvidenceValidated = (
 
 /** Compare source and bundle inputs already parsed by a trusted adapter. */
 export const compareSourceToBundleEvidenceValidated = (
-  input: z.output<typeof compareSourceToBundleInputSchema>,
+  input: ResolvedSourceToBundleReference &
+    Pick<z.output<typeof compareSourceToBundleInputSchema>, "application">,
 ): Result<Evidence, AnalysisError> => {
   const operation = "compare_source_to_bundle";
   const applicationResult = parseApplicationGraphEvidence(input.application, [
@@ -209,6 +211,9 @@ export const compareSourceToBundleEvidenceValidated = (
         {
           reference_root_sha256: input.reference.root_sha256,
           application_evidence_id: application.evidence.evidence_id,
+          ...(input.reference_source === undefined
+            ? {}
+            : { reference_source: input.reference_source }),
         },
         result,
       ),

src/application/javascript/SourceToBundleReference.ts

@@ -0,0 +1,93 @@
+import { requireAuthenticationHeadroom } from "../JsonAuthenticationHeadroom.js";
+import { setImmediate } from "node:timers/promises";
+import type { z } from "zod";
+import type { compareSourceToBundleCliInputSchema } from "../../contracts/javascript/applicationWorkflowInputContracts.js";
+import {
+  historicalSourceGraphSchema,
+  type HistoricalSourceGraph,
+} from "../../domain/referenceSourceGraph.js";
+import type { ArtifactResourceScope } from "../../artifacts/ArtifactResourceScope.js";
+import { AnalysisCancelledError } from "../../domain/analysisErrorCore.js";
+import type { AnalysisError } from "../../domain/analysisErrorBase.js";
+import { analysisInputErrorFromIssues } from "../../domain/inputIssueProjection.js";
+import { err, ok, type Result } from "../../domain/result.js";
+import { readJsonFileWithSource } from "../JsonFiles.js";
+
+/** Historical facts plus the file-origin metadata supplied by the reader, if any. */
+export type ResolvedSourceToBundleReference = {
+  readonly reference: HistoricalSourceGraph;
+  readonly reference_source?: {
+    readonly kind: "file";
+    readonly path: string;
+    readonly requested_path: string;
+  };
+};
+
+/** Resolve one caller-selected historical graph using the shared bounded regular-file reader. No file cache. */
+export const resolveSourceToBundleReference = async (
+  reference: z.output<typeof compareSourceToBundleCliInputSchema>["reference"],
+  signal?: AbortSignal,
+  resources?: ArtifactResourceScope,
+): Promise<Result<ResolvedSourceToBundleReference, AnalysisError>> => {
+  const cancelled = () => signal?.aborted === true;
+  if (cancelled())
+    return err(
+      new AnalysisCancelledError("compare_source_to_bundle", {
+        cause: signal?.reason,
+      }),
+    );
+  if (!("kind" in reference)) return ok({ reference });
+  const read = await readJsonFileWithSource(reference.path, signal, resources);
+  if (!read.ok) {
+    return read.error instanceof AnalysisCancelledError
+      ? err(
+          new AnalysisCancelledError("compare_source_to_bundle", {
+            cause: read.error.cause,
+          }),
+        )
+      : read;
+  }
+  await setImmediate();
+  if (cancelled())
+    return err(
+      new AnalysisCancelledError("compare_source_to_bundle", {
+        cause: signal?.reason,
+      }),
+    );
+  const headroom = requireAuthenticationHeadroom(read.value.data, {
+    operation: "compare_source_to_bundle",
+    path: read.value.path,
+    description:
+      "Insufficient heap headroom to authenticate the historical source graph",
+  });
+  if (!headroom.ok) return headroom;
+  const parsed = historicalSourceGraphSchema.safeParse(read.value.data);
+  // Dispatch aborts queued while synchronous validation and commitment hashing ran.
+  await setImmediate();
+  if (cancelled())
+    return err(
+      new AnalysisCancelledError("compare_source_to_bundle", {
+        cause: signal?.reason,
+      }),
+    );
+  if (!parsed.success)
+    return err(
+      analysisInputErrorFromIssues(
+        "compare_source_to_bundle",
+        parsed.error.issues.map((issue) => ({
+          ...issue,
+          path: ["reference", ...issue.path],
+        })),
+        { reference: read.value.data },
+        { cause: parsed.error },
+      ),
+    );
+  return ok({
+    reference: parsed.data,
+    reference_source: {
+      kind: "file",
+      path: read.value.path,
+      requested_path: reference.path,
+    },
+  });
+};