perf(lsp): parse-pipeline hardening — immutable docs, partial-result cache, cancellation, workspace pruning

[klaidliadon]

The parse pipeline had a latent data race (the store handed out shared mutable *Document pointers), re-parsed the same buffer on every keystroke during edits, ignored cancellation entirely, and walked the whole workspace — .git/node_modules included — on every find-references. This hardens all four without changing behavior users rely on.

Second of the prod-readiness stack. Depends on #8 — merge that first.

⚠️ Stack: #8 → this PR. Do not merge before #8.

---

Changes (audit findings)

• I1 — copy-on-write documents (store.go, server.go): DidChange builds a new *Document instead of mutating the shared one; Store.SetResult attaches parse results via COW with a version guard, so a slow parse of superseded content can't clobber a newer result. Latent race today (handlers are serialized by AsyncHandler), but the store no longer relies on that for safety.
• I3 — retain partial results during edits (diagnostics.go): the parser produces a usable AST even on error; caching it lets navigation reuse the partial result instead of re-parsing the same invalid buffer per request.
• I6 — context cancellation (parser.go, diagnostics.go): Parser.Parse takes a ctx and bails before each recursive import parse; the diagnostics path threads it through. A cancelled request no longer surfaces ctx.Err() as a diagnostic, clears diagnostics, or caches incomplete work.
• I7 — bounded workspace scan (references.go): prune .git/node_modules/vendor/hidden dirs and surface walk errors via the logger instead of swallowing them.

Scope boundary (deliberate)

parsePathForNavigation (interactive nav) and interactive code-actions intentionally use context.Background() — single-file parses where threading ctx through the resolution-callback layer is high-churn for negligible benefit. The cancellable callers (diagnostics) use the ctx-aware parsePath.

Deferred (NOT in this PR — flagged for review)

• I2 (debounce + parse-only-changed-doc) — risks cross-file diagnostic staleness (editing an imported file must refresh importers) and needs timer/coalescing concurrency. Wanted interactive-feel validation before landing, so it's held.
• I7 follow-ups — threading cancellation into the WalkDir itself and a cached, watch-invalidated path index (needs file-watching plumbing).

Test plan

$ go test -race ./...
Go test: 130 passed in 6 packages

$ go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint run ./... -c .golangci.yml
0 issues.

New tests: COW invariant (document_cow_test.go), partial-result retention (repurposed diagnostics_test.go), SetResult version guard + missing-doc no-op (documents/store_test.go), parser + parsePath cancellation (parser_test.go, cancellation_test.go), workspace dir pruning (workspace_walk_test.go).

Known coverage gap: the WalkDir per-entry error-logging branch (references.go) is not unit-tested — injecting an unreadable entry hermetically is permission-dependent and flaky in CI. The pruning happy-path is covered; the error branch is by-inspection.

Review

Self-review caught a Critical (cancellation surfaced a bogus "context canceled" diagnostic) — fixed. A Codex adversarial pass (via agent-comms, 3 rounds to convergence) caught two more Important issues: cache poisoning when cancellation hit mid-import-recursion, and the diagnostics candidate-scan still escaping cancellation through the background parser. Both fixed; Codex approved the final revision. Security-review: no findings (WalkDir doesn't follow symlinks, so the scan is narrowed, not a new traversal surface).

---

Stack: ridl-lsp-hardening

1. fix(lsp): crash-safety — panic recovery, layout canary, race+lint CI #8
2. perf(lsp): parse-pipeline hardening — immutable docs, partial-result cache, cancellation, workspace pruning #9 ◀ this PR
3. feat(lsp): polish — graceful shutdown, log level, upstream error-format canaries #10

_{This stack is managed with sdf.}