vim.uv.cwd() returns nil when the process working directory has been
deleted; the "Debug (using venv)" pythonPath concatenated it unchecked
and aborted the launch with a concat error. a dead cwd now degrades to
the interpreter-name fallback.

package_of called mason_lspconfig.get_mappings() bare while every sibling
registry touch in the file is pcall'd; a drifted or missing get_mappings
threw into the resolver's outer pcall, error-marking every off-$PATH
server with a raw lua error string. the read is now pcall'd and typed
down to mappings.lspconfig_to_package being a table, degrading to the
empty map — $PATH-only classification with the normal missing/unknown
report, re-fetch-while-empty semantics preserved.

attach_registry_events wrapped both registry:on subscriptions in one
pcall deriving one flag: a drift throw from the second subscription
after the first registered left the flag false, and the next attach
registered the install handler a second time — duplicate retry_pending
walks on every later install. each subscription now has its own pcall
and its own flag: a succeeded half never re-registers, a failed half
retries on the next attach, and total failure keeps the status quo.
callback bodies unchanged.

the remote-attach branch validated port strictly but passed config.host
through untouched, so a non-string or empty host surfaced as an opaque
connection failure instead of the clear config-time error the port
already gets. host now mirrors the port contract for shape only (hosts
are free-form, so no format guessing): nil keeps the 127.0.0.1 default,
anything else must be a non-empty string.

mason_root evaluated its sources once: a pre-mason-load first call with
$MASON set cached the env value permanently, so the documented
higher-priority mason.settings.install_root_dir was never adopted once
mason loaded — call timing inverted the priority. worse, a loaded-but-
not-set-up mason.settings (mason-registry requires it with the DEFAULTS;
only setup() applies a custom root) could outrank $MASON.

the settings source is now read live each call, gated on
mason.has_setup: presence decides the branch, existence decides the
return (a configured-but-uncreated root yields nil, never a fallback to
a wrong root). $MASON stays cached as mason_env_root; the data-dir
guess and the user-override memo are unchanged.

… call

the mason_path_added flag short-circuited before the membership check,
so a $PATH overwritten mid-session was never healed and a root that
switched once mason.setup applied a different one never got its bin
appended. the flag is gone: the exact-entry membership check each call
is the idempotence (one plain find per resolve run).

append-only on purpose: identical strings in an externally mutable list
admit no robust ownership proof, so nothing is ever removed — and per
mason PATH mode nothing needs to be (prepend re-orders, append is tail
ordering by choice). mason PATH="skip" remains a documented deviation:
the append keeps availability classification and bare-name spawns in
agreement; honoring skip coherently needs absolute-command
configuration in every consumer, tracked as follow-up.

the "never load mason-registry on a provisioned setup" thunk existed as
byte-identical copies (code and comment) in the dap resolver spec and in
resolve_runtime_tools. tools.default_registry is now the one copy both
specs reference, so a change to the load guard cannot drift between
consumers. spec.registry semantics unchanged: still a value-or-thunk,
still only invoked in phase 2.

run() re-inlined the thunk resolution that session.resolve_registry
already owns, and the inline copy lacked the final table check: a
drifted thunk returning a non-table crashed phase 2 outright
("attempt to index local registry (a boolean value)"), aborting the
whole resolve pass. run() now resolves through the session helper, so
a non-table result degrades to the nil-registry path — a clean
aggregated missing report instead of a crash.

resolve_deps hand-rolled the valid/invalid dep classification with
table.maxn although tools.split_dep_names is the one definition of what
counts as a valid dep entry and nvim-lint already delegates to it. the
container-shape policy stays here (a non-table lsp_deps is dropped
whole, exactly as before); invalid entries now land at the immediate
batch's tail instead of interleaved — unobservable, the collector sorts
its report and classification is per-name.

the "table cmd -> cmd[1] as the probeable binary" extraction existed
five times across server_info and the cache invalidator with varying
outer guards. binary_of_cmd is now the single rule; the self_resolving
branch keeps {} distinct from a function cmd (nil binary without the
flag), byte-equivalent to the old structure.

…aths

the mason install-event handler and :ToolsRetry both probed a pending
name's declared bare binaries with the same pcall(binaries_of) +
find_executable core. pending_bins_available is now that one core; the
is_unsettled ownership guards stay per call site because the two paths
interleave different extra evidence around the probe, and the evidence
order is unchanged.

the type(x) == "string" and x or nil sanitization of untrusted
probe/config fields appeared four times (the validates record and the
three runtime-tools probe-result fields). str_or_nil is now the single
sanitizer; the collector's non-empty-string variant is a different rule
and stays inline.

the single-return wrapper (round-3 g8) protected vararg-position callers
from split_dep_names' second return, but every live call site truncates
fine without it. reader audit at removal time:
- repo (rg 'normalize_names' lua/): the wrapper, its M alias, two
  internal single-assignment calls (find_executable, exepath_or_error),
  one external call site (mason-lspconfig lsp_deps set, ipairs position,
  now parenthesized), one comment reference (updated).
- fleet harnesses (rg over /tmp/*smoke*/run.lua): zero hits.
- user overlay: lua/user/ exists (gitignored surface) and is currently
  empty — zero files, zero possible readers.
callers use split_dep_names directly; the one vararg-position site keeps
its truncation via parentheses.

the export has no external runtime caller today; it stays public as the
tested contract of the has_setup-gated root-priority semantics, pinned
directly by the g4-latch and collector harnesses. the docstring now says
so, making the surface self-justifying in source.

the handler rebuilt the 2-element client_modules table on every call
only to compare its first entry against load_client_config's winner
string. the loader now records user_won at cache-build time, where the
module list already exists, and returns the boolean instead — winner
had no other consumer.

resolve_remaining's docstring claimed the parity sweep calls the export;
the sweep calls the local upvalue — the export is the manual escape
hatch and the harness hook, and now says exactly that. the
eager_ft_override_modules export gains its test-hook label (read by the
ft_override_consistency harness scenario; no runtime reader), so both
surfaces are self-justifying in source.

Reattach the attach_registry_events and package_for_binary docstrings to
their actual definitions, add the missing is_unsettled field to the
ToolCollector class annotation, and update the phase-2 comments for LSP's
defer_phase2 adoption. Compress the PATH-mode narrative behind a mason 2.x
semantics anchor, note the async-emit immunity on the update handler, and
state that default_registry is only resolved once leftovers exist. The
mason_root test-hook label now explains WHY it stays public instead of
naming harness scenarios.

Rewrite the user_lsp_configs replay comments around the actual ordering
guarantee (discovery runs after the user module), fix the stale
server_info/invalidate reference, and swap the per-machine verification
claim for the documented :h vim.lsp.enable() semantics. Mark SWEEP_DELAY_MS
as kept in sync with nvim-lint's parity sweep. shuck's header now records
mise as a deliberate choice: Mason ships a shuck package these days, but
the $PATH copy wins under discovery-first; the zsh-dialect caveat gains a
version anchor so it can expire.

The markdownlint-cli2 override rationale dated from the bun node-shim era;
record that mise ships real node now (kept pending re-evaluation) and NOTE
the known limitation that the pattern drops col-less findings (e.g. MD012).
Correct the shuck comment: actionlint DOES lint run: blocks via its
shellcheck pass-through — shuck complements it. Consolidate the
golangcilint blocking-load fact onto refresh_linter and point the other
two sites at it; the rawset comment no longer cites the removed
factory-wrapper machinery.

The prettier --write-on-temp-copy rationale dated from the bun node-shim
era; record that mise ships real node now (kept pending re-evaluation).
Drop the two comments restating the format_on_save code and the null-ls
migration attribution.

Name the user-override materialization as the second mason-nvim-dap load
site, correct the upstream default_setup ipairs claim, and point the
validate-order notes in every client back at the canonical contract in
init.lua. delve: 38697 is the nvim-dap wiki's example port, not a delve
default. lldb: the lldb-dap rename landed in LLVM 18, not 15. python:
cover all raise sites and drop two boilerplate configuration comments.

palette_overwrite is a name -> palette map, not a list: fix the @type.
Soften the nil_ls/nixd/shuck notes into provisioning-preference statements
instead of Mason-registry claims that rot as the registry changes, drop
the duplicated timeout literal and scheduled-notify rationale, and note
the debug keymaps as a dap lazy-load trigger.

The dead block referenced telescope, which left this config in 2026-03.