Changelog

All notable changes to this project are documented in this file.

The format is based on Keep a Changelog, and the project follows Semantic Versioning. Before 1.0, breaking changes to the CLI or library APIs bump the minor version and are listed under “Changed” / “Removed”.

Unreleased

0.29.0 - 2026-10-07

This release lets a program rewrite part of a transcript (regenerate %mor/%gra or %wor, or split an utterance) while everything it keeps is still checked against the source it came from. Each of these operations parses once, never reparses its own output, and never certifies more than it checked. One validation rule changes: a %wor word bullet that ends before it starts is E362. The typed CST traversal is regenerated, which is breaking for code that names its types.

Added

Dependent-tier replacement (`talkbank-parser`)

TreeSitterParser::admit_replacing_tiers parses once, removes the selected dependent tiers (ReplacementTiers::Morphosyntax: %mor with %gra; ReplacementTiers::WordTiming: %wor) before lowering, and validates every retained domain with the normal rules and tier-alignment checks. Headers, main tiers, retained dependent tiers and unclassified parser recovery still refuse. The result, AdmittedReplacement, retains the producing parse and a RemovedTier receipt (tier, span, syntax recovery) for every concrete tier it removed, without declaring the original source valid. Refusals are ReplacementFailure (Internal, SourceUnavailable, RetainedParse, Validation); an internal tool failure is never reported as invalid CHAT.
TreeSitterParser::admit_planned_tiers decides the removal from the document’s own typed headers (all of them, misplaced ones included) within the same parse; headers and utterances each lower once. Selecting nothing preserves and validates every tier. AdmittedDisposition distinguishes Preserved (an AdmittedPreservation, which carries the original bytes together with the ValidChatFile admitted from them), Replaced and Regenerating.
TreeSitterParser::admit_word_timing_plan chooses, per document, between WordTimingPlan::Preserve and WordTimingPlan::PreferRetained. Under PreferRetained, valid word timing is kept, partial timing included. When complete admission fails, only the %wor tiers the evidence names are removed (a tier whose own lowering fails, or that holds a validation error inside its source span, such as a reversed word bullet or a duplicate %wor), and the reduced document is validated again; errors located in no word tier remove every remaining word tier, and retained faults still refuse. RemovedTier::cause returns the RemovalCause (Selected, OwnLowering, LocatedValidation, UnattributedValidation) with the diagnostics that cost the tier. When removing recorded word timing leaves linked media without timing, the result is WordTimingAdmission::Regenerating, an AdmittedTimingRegeneration that holds a PendingTimingChatFile and can never become a ValidChatFile.

Timing regeneration (`talkbank-model`)

ChatFile::validate_for_timing_regeneration admits retained structure for an operation that will produce timing. It returns TimingRegenerationAdmission::Ready when every requirement is already met, or Pending with a PendingTimingChatFile whose MediaTimingObligation names the linked-media declaration (E544) still awaiting timing. A pending file cannot be converted to a ValidChatFile. PendingTimingChatFile::document_mut writes regenerated timing into the document without separating it from its obligation, and PendingTimingChatFile::discharge checks that document with the rule that issued the obligation: it hands the document back once E544 no longer fires, and the payload back while it would. Complete admission of the returned document still runs every rule.
ChatFile::timing_evidence returns TranscriptTimingEvidence: Absent, or Recorded with a RecordedTranscriptTiming witness bound to the actual bullet and its document. E544 asks the same question through the same code. Presence of a bullet does not certify that the timing is valid.
ValidationFailure::into_rejection returns the rejected document and the diagnostics that rejected it, both by move, or hands an internal tool failure back unchanged, since that is no evidence about the document.
InternalFailure::tool_fault records a fault a tool detected in itself as one internal-error diagnostic.

Source-bound admission and utterance splitting (`talkbank-transform`)

parse_source_with_parser parses once and returns ParsedSourceChat, which keeps the source bytes and the parse product together so a policy can inspect the parsed model before deciding. ParsedSourceChat::admit admits that same parse, tier alignment included and without reparsing, into an AdmittedSourceChat: the original bytes with the ValidChatFile admitted from them. No constructor pairs separately supplied text and model; AdmittedSourceChat::from_preservation takes the parser’s AdmittedPreservation.
utterance_split::UtteranceSplitPlan admits a child assignment against the very utterance it will rebuild, in the morphology/extraction word domain (for_morphology) or the %wor word domain (for_word_timing). It refuses (SplitRefusal) a slot-count mismatch, a child that reappears after another, a boundary inside one indivisible content item (such as a multi-word replacement), and a boundary that would strand a separator at the start of a child. execute returns SplitOutcome::Unchanged when nothing splits, so the caller keeps the utterance it already holds and nothing is copied, or SplitOutcome::Split(SplitChildren): the rebuilt children, with an InvalidatedTier receipt (TierInvalidationReason) for every dependent tier that could not be carried over. Children are not validity proof: a document holding them must still pass complete admission before it is written.
utterance_split::WordSpeakerSplitPlan splits an utterance by the measured speaker ownership of each word. A diarization timeline is projected through complete, count-matched, lexically corroborated %wor timing, with the same held-time policy as whole-turn rediarization; a tie or an uncovered word refuses (WordSpeakerSplitRefusal) instead of inventing a track. WordSpeakerSource::admit admits the source timing before any acoustic inference is run, and WordSpeakerSource::bind_timeline later binds the timeline to that same utterance without rematching it. The outcome’s WordSpeakerPartition is Relabeled { speaker } when one track owns every word, or Split with relabeled children and their tier-loss receipts; ownership reports every word’s measured distribution. Track labels are not claims of personal identity; participants and IDs remain the caller’s responsibility.
utterance_split::build_word_to_content_map maps each extracted word to the main-tier content item it came from, and extract::count_utterance_content counts what collect_utterance_content would extract, through the same walk, without building the words.

Changed

Breaking: talkbank_parser::generated_traversal is regenerated from tree-sitter-grammar-utils’ redesigned carriers. Each carrier and choice is declared once, generic over a range phase R (default Raw) and, when it reaches a slot the compiled grammar proves is never MISSING, a kind proof K (default Broad) before it, so X<'tree> still names the reading extract_<rule> returns. AdmittedX is now an alias of the KindAdmitted reading, emitted only for a shape with the kind axis; for any other shape, and for every AdmittedXBoundView, write X / XBoundView, which is the same type under both proofs. A narrowed slot is a NarrowedKindSlot whose Missing payload is NarrowedMissing<K, KindMissing<T>>: the placeholder under Broad, uninhabited under KindAdmitted, so a by-value match on an admitted slot omits the arm. Code generic over a kind slot bounds the payload by what it reads (KindPlaceholder<T>, RecoveryNode, SourceRecovery) rather than naming KindMissing<T>. A placeholder at a narrowed slot under the admitted proof is the new ReconstructionFault::ContradictedKindProof. Parsing, validation and serialization are unchanged.
The runtime that generated_traversal embeds no longer contributes its examples as talkbank-parser doctests: they are written against tree-sitter-grammar-utils’ own crate path, so in a consumer one failed to compile and the compile_fail ones passed only because their import did not resolve. They are now ignore examples; the generator’s own crate still runs them.
A %wor word bullet that ends before it starts is now E362, reported at the bullet’s own source span. A transcript containing one, which validated before, is now rejected. Zero-duration, overlapping and out-of-order word bullets remain legal (CLAN CHECK checks no word bullets; chatter rejects only the self-contradictory case); timing consumers refuse zero-duration word intervals at their own boundary.
The free-text dependent tiers (the nine bullet-payload tiers, the fifteen raw-text tiers and %x tiers) read their body under the admitted kind proof. The body is a nonterminal tree-sitter never inserts as a MISSING placeholder, so the reader no longer has a branch that parsed a placeholder’s empty text as content.
Dependency updates: comrak 0.56, cc 1.6 and insta 1.49; for the desktop application’s tooling, WebdriverIO 10, @vitejs/plugin-react 6.1.2 and Vite 8.3.3. The desktop’s “reveal in file manager” action goes through its typed desktop capability instead of a component-local Tauri import.

0.28.0 - 2026-10-02

This release is about telling the truth about a validation run: how it ended, what it read, what it did with the cache, and what each output promises. Most of it is breaking for library callers and for scripts that relied on a command silently ignoring something; each such change is marked.

Changed

Closed-stdout subprocess tests construct a pipe with its reader already closed before launching the child. A consuming endpoint capability removes the parent/child scheduling race without sleeps, retries or weaker assertions.
Cache-write test doubles retain ResolvedPath instead of erasing it to a raw path, so unresolved spellings cannot construct expected cache identities. Path-resolution contracts explicitly follow native Windows and POSIX rules for .. through missing directories; no platform’s semantics are emulated.
Workspace tests and native-platform CI collect all failing test binaries with --no-fail-fast. Failures still fail the command; no tests are retried or ignored to obtain a passing result.
Cache handles offer close(self), which consumes the query capability and waits for pooled connections and SQLite workers to shut down. Callers that remove an owned database can close every owned handle explicitly instead of relying on background destructor timing. Cache lifecycle tests close both writer and inspector before deletion, then obtain Absent by fresh inspection; they no longer query an unlinked database or assume it can be removed while open on Windows. Non-current schema inspection, ledger-read errors, failed migration and refused validation-scope admission also await shutdown of unretained pools. Observations without a query handle no longer leave inspection workers holding a database file.
Breaking (Rust API): RunEnding::Complete requires producer-admitted CompleteStats; Stopped and Incomplete require PartialStats. Read counts through snapshot() and shortfalls through missing_files(); the separate unprocessed and lost_files fields are removed. Cloning stopped-run counts cannot promote them to complete-run success. CLI JSON and desktop event formats are unchanged.
Documentation publication metadata follows its own Git history: rendered book headers use the existing Git-date preprocessor, and other affected documents link to their own history. Content-preserving release squashes do not require fresh content-review dates. The date check admits the header itself, so a placeholder example in the body or a history link to another document cannot mask a stale handwritten date. The existing stale-document baseline is unchanged.

How a validation run ends

Breaking (CLI): a chatter validate run that did not cover every file fails the command (exit 1) and says so. A run told to stop (Ctrl-C, or --max-errors) reports how many files it left, Stopped after reaching the error limit (N); M file(s) were not validated. (or Validation cancelled; ...), and a stop that came after the last file is no stop at all: the run is complete. A run that found no transcript says Error: no .cha files found in PATH and exits 1.
Breaking (CLI): the TUI’s exit status is the run’s, as the other outputs’ are: closing it (q or Esc) exits 0 only after a complete run with no invalid, unreadable or tool-failed file, and 1 otherwise, including when it is closed before the run ends or the terminal fails. Ctrl-C stops the run and leaves the TUI open on its ending; a second Ctrl-C force-quits at once with exit 130, as it always did, whatever the run found. It lists every file that failed, a file it could not read, a failed roundtrip and a tool failure among them, says “No .cha files found” for an input with none, and shows the --suppress and cache notes the other outputs print. An unreadable argument used to show “no errors found” and exit 0.
Breaking (CLI): --max-errors N counts errors only, never warnings, and the validation runner enforces it: each worker counts its file’s errors before taking the next file, so with --jobs 1 the stop is exact, and the text, JSON, audit and TUI surfaces all honour it. The CLI used to count every rendered diagnostic, so a warnings-only file could spend the limit and the run still exit 0 with files never validated; the TUI ignored the limit. --max-errors 0 is a usage error (exit 2).
A run that lost files says why: workers that panicked, workers that could not create their parser, or a worker thread the system refused, every one observed and none hidden behind another, or no explanation (a validator defect). A worker that could not create its parser used to return an empty tally, so a run in which every worker failed that way read as a stop, or as a loss with nothing to explain it. Text, audit and TUI endings and the desktop’s incomplete state say the cause.
Breaking (CLI JSON): validate --format json reports the ending on stdout: the summary’s cancelled is replaced by outcome ("complete", "stopped" or "incomplete"); a stopped run emits a stop record (reason "max_errors" with limit, or "cancelled", and unprocessed_files) before its summary; a run that lost files emits an incomplete record (lost_files, total_files, cause ("worker_faults" or "unexplained") and detail); a run that died emits an aborted record. All of these were stderr text, which JSON mode promises to keep empty.
JSON mode keeps stderr empty by construction. --suppress and the deprecated --check-xphon are notice records, as is a Ctrl-C handler that could not be installed (interrupt_unavailable); cache maintenance is a cache record, Ctrl-C prints nothing (the run ends with a cancelled stop record), and an unwritable --audit file is reported by the command instead of exiting from inside the renderer.
validate --format json writes each record straight to stdout, with no intermediate string, and a consumer that closes the pipe ends the stream: the run exits 1 with stderr empty. It panicked (exit 101, a panic message on stderr).
Breaking (CLI JSON): a run that found no transcript ends with a summary whose outcome is "nothing_found" and which carries no counts; it was a "complete" summary of total_files: 0.
validate --format json records and --audit JSONL lines are serialized from typed models: a diagnostic’s severity (Error, Warning) is spelled by the model rather than taken from a Debug rendering, and keys come in a fixed order (type first).
Breaking (CLI JSON): validate --format json emits exactly one file record per file. A file with warnings and no error is one valid record carrying a warnings array; it was an invalid record followed by a valid one. An invalid record’s error_count counts errors only (it counted warnings too), while its errors array still lists every diagnostic with its severity. A roundtrip_failed record carries its diff and any warnings, and the contract lists that status.

What a run presents, and what it reads

Breaking (CLI): chatter validate decides its output once, from all of --format, --quiet, --audit and --tui-mode: plain text, quiet text, JSON, an audit file, or the TUI. The TUI is chosen automatically only for plain text with stdout a terminal; --format json on a terminal used to open it. Flags that name two outputs are usage errors (exit 2): --audit with --format or --quiet (it printed text and exited 0), --format json with --quiet (--quiet was ignored), and --tui-mode force with any of them.
Breaking (CLI): chatter validate reports an argument it cannot read, a nonexistent one included, as a read error in its results (✗ PATH (read error: ...), a read_error record in JSON mode, counted among the invalid files), validates the rest, and exits 1. It used to refuse the whole run with stderr text a JSON consumer could not see.
One walk finds the input of validate, to-json, fix, the debug commands and the desktop app’s directory runs. A directory or entry that cannot be read is reported, never skipped: validate and the desktop record it as a file that could not be read, and the other commands report it and exit 1 before processing anything. Links are followed (to-json used to skip them), a directory reached twice is walked once, and a link whose target is gone is a failure whatever its name, since it may have been a directory (a link to an unmounted volume’s subcorpus). A file named on the command line of fix or a debug command is used whatever its extension, as validate already did.
A transcript’s stored name is resolved once, where it is found: a walk takes it from the listing that found the file, and a file argument is resolved once before any worker starts. fix and the debug tools refuse an argument whose stored name cannot be resolved before processing anything (exit 1; fix used to skip it with an error line), and to-json on a directory refuses a transcript whose stem is not UTF-8 the same way.
A transcript named twice on the command line (two spellings of one file, dir/a.cha beside ./dir/a.cha or dir/sub/../a.cha, or a file inside a directory also given) is processed once, under the first spelling given.
fix and every debug tool refuse an argument list that names no transcript (exit 1); debug overlap-audit and debug linker-audit used to analyze nothing and exit 0.
Breaking (CLI): a validate --audit file that could not be written whole fails the run (exit 1), and the writer stops at its first failed write; a failed write was a warning, the file kept going with a hole in it, and the run could exit 0.
Breaking (CLI JSONL): every validate --audit record carries severity ("Error" or "Warning", spelled as the --format json records spell it), after code: {"file", "code", "severity", "message", "line", "column"}. A warning record had nothing to tell it from an error, though a warning does not fail its file. The record shape is now documented in the diagnostic contract.
Breaking (CLI): the validate --audit summary counts what its labels say. Files that failed (was Files with errors) counts the files the run failed (invalid, unreadable, a failed roundtrip or a tool failure), so a valid file with warnings is not one, and a file that failed with no diagnostic (unreadable) is. Total errors counts errors only and the new Total warnings counts warnings; Total errors counted every diagnostic. Diagnostics by code (was Errors by code) gives each code’s errors and warnings separately (E301: 2 error(s), 1 warning(s) in 2 file(s)).

The validation cache

chatter cache clear --dry-run writes nothing: it opens the cache read-only, as an audit does (SQLite’s -shm and -wal files may appear beside an existing database, as for an audit), and a cache with no database has nothing to clear. It created the cache directory, its lock file and the database, and ran migrations, to count zero rows.
Breaking (CLI): chatter cache stats only reads the cache, as the dry run does. With no cache database it says No cache database at PATH and exits 0 (no cache yet is a legal state, as the dry run and an audit treat it), and it creates nothing; it created the directory, its lock file and the database, and migrated it, to report zero entries of a cache it had just made. A database an older build left is reported, not migrated.
Breaking (CLI): chatter cache clear --dry-run and chatter cache clear agree, because both start from one look at the cache directory. Over a database of an older schema the dry run exited 1 (“a schema this build does not read”) while the clear migrated it and went ahead; the dry run now says the clear would first migrate the database, and that the number of entries is known only after the migration (which can remove duplicates), and writes nothing; the clear says it migrated, then what it cleared. With no cache database, a clear creates none and says so (Cleared 0 cache entries: no cache database at PATH); it created and migrated an empty database to clear nothing. A database a newer build wrote fails stats, clear and its dry run alike (exit 1).
Cache keys are a specified hash. Every row was keyed by DefaultHasher, whose algorithm Rust does not promise to keep, so a toolchain update could have turned the persistent cache into misses with nothing to say so. Rows are now keyed by blake3 over a written-down encoding of the path’s components and the row’s namespace (the book’s validation-cache chapter gives it). The key scheme is part of the cache version, so rows written by earlier releases are never served and leave through the existing prune of superseded versions: the first run after upgrading revalidates every file once.
The cache knows a transcript by its location with every directory resolved by the operating system and its own name kept as stored, so every spelling of a file is one row: relative or absolute, through .. or a linked directory, and /tmp beside /private/tmp on macOS. validate --force clears the cached verdicts of the files it validates whatever spelling the paths were given in; with a relative argument (validate --force a.cha) it cleared nothing and the stale verdict was served. cache clear --prefix resolves its prefix the same way (a directory since deleted through its deepest existing ancestor), and the missing-file purge no longer depends on where it is run from.
Breaking (CLI): validate --audit only reads the cache: it opens an existing cache read-only, creating, migrating, pruning, clearing and writing nothing (with no cache, or one an older build left, it runs without one and says so), and --audit --force is a usage error (exit 2; it cleared the files’ rows). SQLite may still create its shared-memory and write-ahead-log files (talkbank-cache.db-shm, talkbank-cache.db-wal) beside an existing database, which any reader of a WAL database needs; the database itself is not written.
Validation reads each transcript once and keys the cache by the hash of those bytes, so a verdict is stored for exactly the content validated even if the file changes during the run. A cache read or write that fails is counted and reported (a stderr warning, cache_errors in the JSON summary, a note in the desktop summary) instead of looking like a cold cache.
A run reports cache hits and misses only for files that consulted a cache, and cache_hit_rate (the JSON summary’s, the text summary’s Hit rate, ValidationStatsSnapshot::cache_hit_rate()) is hits over those files (hits plus misses); it was hits over every file, so an unreadable file lowered it. A run whose cache did not open reports no misses, its JSON cache_hit_rate is null (it was 0.0, with every file a miss), and the text summary says Cache: not consulted. A cached roundtrip verdict counts as a hit.
Breaking (CLI JSON): chatter cache stats --format json is tagged by database: {"database": "absent", "cache_dir": ...} when the directory holds no database, {"database": "older_schema", "cache_dir": ...} for a database an older build left (its entries are not counted), and "database": "current" with total_entries, cache_dir, cache_size_bytes and last_modified. It reports what it could not find as null, never as a stand-in: cache_dir is null for an in-memory cache (it was the string "in-memory"); cache_size_bytes is the database file’s length, or null if the file is missing when the statistics are read (it was 0, the same as an empty file); last_modified is UTC with exactly three fractional digits (2026-03-09T13:05:31.000Z), null exactly when cache_size_bytes is (it was the current time). A size or time that cannot be read, a time outside the years -9999 to 9999, and a cache directory that is not UTF-8 fail the command instead of being reported as 0, null or a lossy path. The text output says (in memory) and (no cache file).
Breaking (CLI): chatter cache clear with neither or both of --all and --prefix is a usage error (exit 2; it exited 1). --dry-run with --prefix reports how many entries it would clear, and a clear reports the number its delete removed. --prefix takes any path the system accepts, UTF-8 or not, and selects the rows the cache wrote for it.

Commands

Breaking (CLI): a command whose standard output closes (chatter ... | head) exits 1, silently, from every text writer, as validate --format json already did. Text output caught the println! panic and exited 0, so a validate run that found invalid files exited 0 when its summary had nowhere to go; a missed catch was a panic (exit 101). Every CLI text writer goes through one fallible writer, and the panic hook that matched “Broken pipe” in panic messages is removed.
Breaking (CLI): to-json on a directory with no .cha file (an empty tree, or a mount point with nothing mounted) exits 1 with ERROR: no .cha files found in DIR before converting or pruning anything. With --prune it exited 0 and deleted every .json under --output-dir, each read as an orphan of the empty input; a prune now needs a non-empty population of transcripts by type.
Breaking (CLI): flags are parsed into what they select, and a combination a command would have ignored is a usage error (exit 2): normalize --skip-alignment without --validate; to-json --skip-validation --skip-alignment; validate --list-checks beside a path; and to-json with an option for the other kind of input (--output-dir, --force, --prune or --jobs for a file; -o/--output for a directory). A file input used to ignore the directory options. A directory input without --output-dir is a usage error (exit 2; it exited 1).
Breaking (CLI): a --code (fix) or --suppress (validate) value that names no known error code (or, for --suppress, no known group) is a usage error (exit 2) naming the value; the commands printed their own error and exited 1.
Breaking (CLI): --jobs 0 (on validate and to-json) is a usage error (exit 2); it ran one worker with a logged warning. Omit --jobs to use every CPU.
Breaking (CLI): chatter cache stats takes -f/--format text|json, as validate does, in place of --json.
chatter fix exits 1 when a file could not be read or --apply could not write a fix, and says how many on stderr; it exited 0 after reporting each failure.
chatter to-json and chatter normalize report a failure the same way: a line ERROR: <path>: <failure>, then the rendered diagnostics of a parse failure, a validation failure, an incomplete validation or an internal failure. to-json on one file printed only a one-line summary for some of these, under its own ✗ Validation errors found: and ✗ JSON error: headlines; normalize printed ✗ Validation errors found: for a validation failure and dropped the diagnostics of every other failure behind Error: <failure>.
chatter to-json --prune still never follows a link in the output tree, while the walk that reads transcripts now follows them: its deletions stay inside --output-dir. --prune also no longer deletes a JSON file whose transcript merely could not be checked, and reports a file or empty directory it cannot remove (the run then exits 1).
chatter to-json <dir> warns when it cannot remove the stale JSON of a transcript that now fails to convert, runs on the shared worker pool (a worker that panics is reported with the files it left unconverted, and the run exits 1), and counts files queued on its progress line.
chatter watch validates each changed file through the same one-file pipeline as validate (stored name, cache, rules), with validate’s default cache identity, and opens the cache once when it starts (it reopened and pruned it on every save). It keeps watching when a watched file cannot be read (a rename or a lock mid-edit) instead of exiting, and prints a file’s diagnostics as validate --quiet does.

Library API

Breaking (library, talkbank-cache): RulesVersion::for_testing exists only with the new test-support feature, which no production build enables; a production caller could name a version no rule set produced. The crate’s examples use RulesVersion::current().
Breaking (library, talkbank-model): a file stem is checked where it is made. FileStem::from_stem returns Result<FileStem, FileStemError>, refusing an empty stem and one with a path separator, and OwnedTranscriptName::Named holds an OwnedFileStem (built from a path, a checked string or a FileStem) instead of a String; TranscriptName::to_owned_name makes one. The LSP names a document by its decoded file path (TranscriptName::for_path), so a file name with a space or an accent is matched against @Media as stored, not percent-encoded.
Breaking (library): a validation run takes DistinctTranscripts (talkbank_transform::paths, built only by DistinctTranscripts::new), stored transcripts each named once by resolved location, so validate_files_streaming handed one file under two spellings validates and counts it once, as the argument path already did; it validated it twice. ExpandedArguments::into_parts returns them.
Breaking (library): a validation run’s ending is typed. A stream ends with one ValidationEvent::Finished(RunEnding) (it ended with Finished(stats), FinishedIncomplete or Aborted), where RunEnding is Complete(stats), NothingFound (no transcript at all; it was a complete run of zero files), Stopped { stats, unprocessed, reason }, Incomplete { stats, lost_files, cause: LossCause } (LossCause is WorkerFaults, never empty, or Unexplained) or Aborted(AbortReason), with counts as NonZeroUsize. RunEnding::passed() is the one answer to whether a run vouches for its input, the answer the CLI, the TUI and the desktop all give. AbortReason gains NoEnding, for a consumer whose stream closed without an ending, and the new CancelReason (ErrorLimit { limit } or Requested) implements Display, the wording every surface uses for a stop. ValidationStatsSnapshot has private fields read through accessors, with a non-zero total_files, and only the runner makes one (its cancelled field is gone: a stop is the Stopped ending); RunCoverage is no longer public. The streaming entry points return a Canceller (was Sender<()>) and are no longer generic over the cache (they take a ValidationRun).
Breaking (library): ValidationConfig: check_alignment: bool is alignment: AlignmentValidation; roundtrip is a RoundtripCheck (Skip or Run; was a bool); jobs is Option<NonZeroUsize>; error_limit: ErrorLimit (Unlimited or StopAfter(n)) is new; and directory and cache are removed (every walk descends every level, and the cache is a parameter). DirectoryMode and CacheMode are removed. The atomic ValidationStats is removed: each worker counts its own files and the runner sums them after the join.
Breaking (library): every runner entry point (validate_directory_streaming(directory, &run), validate_files_streaming(files, &run), validate_arguments_streaming(input, &run)) takes a ValidationRun, a ValidationConfig bound to the cache the run may use; they took the configuration and the cache as two arguments, so a library caller could hand a run under one rule set a cache opened for another (strict linkers, another parser) and get that cache’s verdicts. ValidationRun::new(config, cache) refuses a cache whose identity is not config.cache_identity() (CacheIdentityMismatch), ValidationRun::uncached(config) binds none, and ValidationRun::config() reads the bound configuration. VerdictReader gains a required identity(). The CLI opens the cache from the run’s configuration and binds it; the desktop binds the pool it memoizes per identity, and validate_target_streaming_with_config(target, &run) takes the bound run.
Breaking (library): a run’s cache is a RunCache (Absent, ReadOnly(Arc<dyn VerdictReader>) or ReadWrite(Arc<dyn ValidationCache>)), and how a file used the cache is FileCompleteEvent::cache: CacheUse (Hit, Miss, NotConsulted); FileStatus loses its cache_hit fields, and cache_hit_rate() returns Option<f64>.
Breaking (library): the cache traits. VerdictReader (get, get_roundtrip) and ValidationCache: VerdictReader (set, set_roundtrip), all required, take a ResolvedPath (from talkbank-model: the parent directory resolved, the name kept as stored; every StoredTranscript carries its own, StoredTranscript::resolved), the ContentHash of the bytes validated, and an AlignmentValidation, and return Result<CacheLookup<V>, CacheError> (a failed lookup is an error, never a miss). Validation verdicts are CacheOutcome; roundtrip verdicts are the new RoundtripOutcome (Passed, Failed). ReadOnlyCache opens an existing, current cache read-only and writes nothing; it refuses a missing one (CacheError::NoCacheDatabase) or one whose schema is not this build’s (CacheError::SchemaNotCurrent). CachePool’s own get/set methods, clear_prefix and clear_all are removed: maintenance is count(&CacheScope) and clear(&CacheScope) with CacheScope::All or Under(ResolvedPrefix), and clear_paths (any iterator of &ResolvedPath) clears by key in every namespace. CacheStats holds a StorageStats (InMemory, or Directory { cache_dir, database } with DatabaseFile::Missing or Present { size_bytes, modified }); SpaceReclaimed gains VacuumedSizeUnknown; VersionPruneOutcome gains FreshDatabase (an in-memory cache, where no prune ran); VersionPruneReport::versions_deleted is a usize; purge_nonexistent fails on a path it cannot check instead of deleting its entry. New CacheError variants: CorruptColumn, CountOutOfRange, ModifiedOutOfRange, NoCacheDatabase, SchemaNotCurrent.
Breaking (library, talkbank-cache): administration starts from CacheOnDisk::inspect() (or inspect_directory(dir)), one look that creates, migrates and writes nothing and returns what is there: Absent(NoDatabase), OlderSchema(OlderSchema) or Current(InspectionCache). A MaintenanceCache is reached only from that value, by OlderSchema::migrate() or InspectionCache::into_maintenance(): MaintenanceCache::open and open_directory, which created and migrated a database in any directory they were given, and InspectionCache::open and open_directory are removed. A database a newer build migrated is the new CacheError::SchemaNewer (for ReadOnlyCache too, which reported it as SchemaNotCurrent, whose message said a writing run would upgrade it); SchemaNotCurrent now means an older schema only.
Breaking (library): one event per file. ValidationEvent::Errors and RoundtripComplete, with ErrorEvent and RoundtripEvent, are removed: a file’s diagnostics travel inside its FileStatus, in the variants that can have them: Invalid { diagnostics: InvalidDiagnostics } (never empty, with a NonZeroUsize error_count()), Valid { warnings } and RoundtripFailed { warnings, diff } (Option<FileDiagnostics>), and InternalFailure { failure, attempt }, whose FailedAttempt says whether the failure’s diagnostics point into the file’s text (Validation { source }) or into the roundtrip’s serialized text (RoundtripReparse). FileStatus::shown() gives the diagnostics to show against the file, with that text; FileStatus::failed() says whether the file failed. A consumer renders each file once, and the file’s text moves into its status without a copy.
Breaking (library): StoredTranscript carries its ResolvedPath (StoredTranscript::resolved), made when it is admitted, so a transcript whose directory cannot be resolved is refused by resolve and from_entry.
Breaking (library, talkbank-model): the coordinated splice MorTier::splice_range_coordinated(gra, item_range, block, root, redirects) (and splice_coordinated(gra, item_idx, block, root, redirects), the same over one item) takes its replacement as a SplicedBlock, says where the block’s root attaches with a SpanRoot, and where host dependents of the replaced items go with a HostRedirects; it adds no cycle and no second root, so a host %gra tree stays a tree. Every type is re-exported beside MorTier in talkbank_model::model::dependent_tier::mor, with CoordinatedMutationError.
- SplicedBlock::new(mors, relations) replaces the new_mors and new_relations arguments. It parses the block-relative relations once and refuses (SplicedBlockError) a relation count that differs from the chunk count (was CoordinatedMutationError::CountMismatch), a head outside the block (was HeadOutOfNewBlock), a relation whose index is not its chunk (IndexOutOfOrder), a block with no root or several (RootCount), and a cycle (Cycle). The splice wrote a rootless cyclic block into the host: the 1 -> 2, 2 -> 1 reparse of por@s favor@s became a cycle in the host’s %gra. SplicedBlock::root_chunk() exposes the admitted root as a BlockChunk so callers can direct host dependents to it without a separate root scan.
- A host %gra relation that depended on a replaced item keeps depending on that word. The splices rewrote such a head to the first chunk of the new block, by position: in morphotag’s L2 output for ich glaube it's@s:eng working@s:eng und don't@s:eng stop@s:eng . that made und depend on do and stop on it, where they depend on stop and working. The caller states the correspondence: HostRedirects::ByItem (equal item counts, each item following its counterpart) or HostRedirects::PerItem(Vec<ItemTarget>), one target per replaced item: ItemTarget::Chunk(BlockChunk), a chunk of the block, or ItemTarget::Counterpart, the block item at the same position (chunk for chunk when the two items have the same chunk count, otherwise the new item’s head chunk), so a caller can state one target and let the rest follow. A statement that does not fit, or a dependent whose item has no unique head chunk, is refused before either tier changes (RedirectItemCountsDiffer, RedirectCountMismatch, RedirectOutOfBlock, NoCounterpart, NoUniqueHeadChunk).
- SpanRoot replaces the root_anchor_override: Option<usize> argument: UtteranceRoot (head 0, relation ROOT), or HostChunk { chunk, relation }, a host chunk (SemanticWordIndex1) numbered as before the splice and translated by it, with the relation the span root takes under it, an AttachmentRelation, whose constructor refuses a root label (RootRelationUnderHost), so ROOT under a host head cannot be written; the block’s own label for its root is not kept. SpanRoot::from_gra_head builds one from a host relation’s GraHeadRef and the relation. The old anchor was a pre-splice index never shifted, and None took the head of the range’s first chunk: in dont@s:eng mal geh . the span’s do came to depend on mal. A span root at the utterance’s root while a host relation outside the range is already the root is refused (UtteranceRootTaken; the splice wrote two roots), as is a host chunk inside the replaced range or past the host (SpanRootInReplacedRange, SpanRootOutOfHost), or one whose own chain of heads reaches the range (SpanRootDependsOnSpan: with x@s y@s z . and z -> x, anchoring the span x y at z returned a cycle with no root).
- A host whose %gra does not number each relation by its chunk (relation k, from 1, with index k) is refused (HostIndexOutOfOrder), since every head is read as a chunk number. Such a host was spliced anyway, its misnumbered relations’ indices shifted by arithmetic that could wrap below zero on a shrinking splice. Inside the splice, the numberings before and after it, of the block, and of the replaced range are distinct types with one translation between the host’s numbering before and after, so a pre-splice index cannot be written into the result.
- CoordinatedMutationError derives Clone, PartialEq and Eq, and its host-chunk fields are SemanticWordIndex1. It stays exhaustive, as the crate’s error enums are: a new refusal is a compile error for a caller that matches them. talkbank-tools adapts when it moves to this release.
Breaking (library): talkbank_model::ParseValidateOptions has private fields; its public validate, alignment and strict_linkers booleans could say “alignment without validation”. The level is the new CheckLevel (ParseOnly or Validate(AlignmentValidation)), set with with_level and read with level(); should_validate is removed (use validation_policy().is_some()). RuleSelection holds a LinkerChecks.
Breaking (library, talkbank-model async): validate_async and validate_with_rules_async take an OwnedTranscriptName (Named(String) or Anonymous) in place of filename: Option<String>, whose None silently meant “skip the rules about the transcript’s name”.
Breaking (library): chat_to_json, chat_to_json_named, chat_to_json_with_schema_policy and chat_to_json_unvalidated take a JsonLayout (Pretty or Compact; was pretty: bool), and JsonSchemaPolicy::from_skip_flag is removed: the libraries keep no bool-to-mode constructors, and the CLI parses each presence flag straight into the mode it selects.
Breaking (library): timestamps in the TOML decision files are talkbank_transform::recorded_time::RecordedTime, replacing chrono::DateTime<Utc> (PendingEntry::created_at, MergeOverride::decided_at, and the matching parameters of MergeOverride::auto_decision, operator_decision and judgment_to_pending). It is written as New York time in whole seconds with its offset ("2026-05-27T08:41:00-04:00"), whichever host writes it, and reads every RFC 3339 time with an offset, so existing files load unchanged, and in TOML also a native datetime.

Desktop

The desktop app shows a stopped (cancelled) run as its own state, with the number of files it never reached, and an incomplete run with its cause; FrontendStats.cancelled is replaced by a stopped event.
The desktop’s all-valid claim is the runner’s verdict, carried as passed on the finished event, so it agrees with the CLI’s exit status: a run whose files have only warnings is “All N files valid; K warnings”. A target with no transcript is its own nothingFound state, with Re-validate offered; it was a finished run of zero files. Stop, loss and abort reasons are the runner’s own wording.
A validation cache that will not open is said in the run’s summary, with the reason, and the run goes on without it; it was a line on the app’s stderr, which a desktop user never sees.
The validate, open_in_clan and export_results commands each take one request argument (ValidateRequest, OpenInClanRequest, ExportResultsRequest), the value the backend already used, in place of loose ones. A text export writes each file’s status as the app shows it, one label from one owner, where the backend kept its own copy of the sentences.
ValidateRequest’s jobs is Option<NonZeroUsize> (was Option<u32>), so jobs: 0 is refused when the request is deserialized. The Parallel jobs field parses its text into a positive whole number (or empty for all CPUs), says when an entry is not one and which value the next run uses, and never sends 0 or 1.5 on.

Internals

One worker pool, talkbank_transform::worker_pool::fan_out, runs the validation runner and chatter to-json <dir>. Its workers run on the same 16 MiB stack as the CLI’s program thread (they used the 2 MiB thread default), --jobs 1 is the same pool at width one, and each worker returns its own counts instead of updating shared counters.
chatter no longer depends on chrono; it uses jiff.

Removed

Breaking (CLI): chatter fix --dry-run. A bare fix already reports without writing, and --apply --dry-run (meaning “do not apply”) was confusing. Passing --dry-run is an unknown-argument usage error (exit 2), so a script using it fails instead of writing.
Breaking (CLI): chatter to-json’s hidden --validate and -a/--alignment flags, deprecated no-ops since validation and alignment became the default; passing one is a usage error (exit 2) instead of being ignored.
Breaking (library, JSON, desktop protocol): the parse-error file status, which nothing produced (both parsers always return a model with diagnostics, and an unparsable file is Invalid): FileStatus::ParseError, ValidationStatsSnapshot::parse_errors, the JSON summary’s parse_errors (always 0), the parse_error record status, the text summary’s Parse errors: line, and the desktop’s parseError status and parseErrors count. The desktop summary counts “invalid or unreadable files”, which is what invalid_files holds.
chatter’s RoundtripValidationMode, a second copy of RoundtripCheck.
Breaking (CLI): chatter debug overlap-audit -f/--format, which the command never read (it prints TSV, with --database for JSON lines); passing it is a usage error (exit 2).
Breaking (library): LossCause::tag; a JSON consumer reads the CLI’s incomplete record, whose cause is serialized from its own wire type.

Added

W110 warns when the @Media filename and the transcript’s own name differ only in letter case (Session.cha declaring @Media: session). CHECK’s comparison ignores case, so this stays out of E531, but such a name finds its recording on a case-insensitive filesystem and not on a case-sensitive one. Case and Unicode spelling are reported independently, so a name can carry both W110 and W109.
PipelineError::diagnostics() returns the located diagnostics a pipeline failure carries, or None; to-json, normalize and speaker identification report failures through it.
talkbank_model::LinkerChecks (Lenient, Strict) and RuleSelection::with_linkers, so a caller holding the linker choice as a value selects the strict linker checks without a branch of its own.
ChatFile::validate_at(policy, errors, name) validates under a ValidationPolicy: its rules, at its alignment coverage.
talkbank_transform::paths finds input the one way every command uses: walk_files (a Walk of FoundFiles and WalkFailures, with a Links policy, Follow or Skip), walk_transcripts (a TranscriptWalk of FoundTranscripts, each a relative path and a StoredTranscript) and expand_transcript_arguments (ExpandedArguments, one StoredTranscript per resolved location). StoredTranscript::into_path.
talkbank_model::ResolvedPath and ResolvedDirectory, a file’s location with its directory resolved by the operating system and its own name kept, the identity the cache keys by, and ResolvedPrefix, a resolved directory or file that a cache scope selects under (all re-exported by talkbank-cache and talkbank-transform).
validate_arguments_streaming, the runner entry point for expanded command-line arguments, which reports each unreadable argument as a read error in the run’s results.
talkbank_transform::worker_pool (fan_out, PoolRun, PoolOutcome), the one bounded worker pool (see Internals), and PoolOutcome::faults, the one reading of how its workers ended, as PoolFaults (Unwound, ThreadRefused); the runner’s WorkerFault wraps one as Pool.

0.27.0 - 2026-09-28

Changed

Cross-platform verification keeps Windows workspace doctests on Cargo’s normal C runtime, avoiding a Tauri static-runtime library-search collision. Desktop release packaging retains its static-runtime configuration.
Experimental re2c conversion preserves multiword participant names and treats lexer continuation tokens as separators in logical gem labels. Diagnostic differences remain explicitly assessed, not copied from the default parser; re2c is still not a production validity authority.
Pseudonymization review stores proposed morphology and refused-plan payloads behind owned boxes, reducing inline variant and error sizes without changing admission or output policy. MorphologyOutcome::Proposed::proposed is now Box<Mor> for Rust callers.
Updated the Rust and JavaScript desktop dependencies together, including Tauri and its plugins, and refreshed jsonschema, cc, and Vite.
Participant parsing admits selected source ranges before decoding names and roles. Recovery states are retained; unreadable producer ranges reject the entry as an internal failure rather than admitting a partial participant.
Breaking (low-level Rust parser API): parse_postcode_node accepts a generated SourceBound<PostcodeNode> instead of a node and separate source string. Final-code lowering preserves source association and propagates range failures as internal failures. ChatParser APIs and CHAT/JSON behavior are unchanged.
The primary parser preserves postcode source spans, allowing incremental relocation and diagnostics to retain the original token location. CHAT and JSON output are unchanged.
Breaking (Rust API): Utterance::new starts with unknown provenance; parse_health is private and read through parse_health(). Parser adapters finish through accumulated ParseHealth::finish_utterance. Appending dependent tiers withdraws provenance and alignment caches. Programmatic producers use ChatFile::validate_construction_with_policy for checked typed construction, without reparsing CHAT. ParseHealthState::Constructed permits model checks but never source-byte splicing or a claim of parser-backed cleanliness. JSON remains unchanged and carries no runtime admission evidence.
English decade generation now admits only multiples of ten in 0-90 shorthand or 1100-2990 full-year form. Other suffix-bearing inputs retain their exact spelling instead of acquiring a guessed plural year phrase.
Generated typed-CST carriers support opt-in range admission, preserving recovery while making subsequent payload text reads infallible. @Media body lowering uses this boundary; CHAT and JSON policy are unchanged.
Breaking (generated Rust API): selected repeat/optional elements carry an uninhabited Absent payload. Empty repetitions and optional None remain possible; an element already selected cannot independently become absent.
LSP quick fixes no longer invent participant or language facts for E308, E504 or E507, matching the shared fix catalog. Diagnostic prose is no longer parsed to construct participant declarations; enter the actual facts explicitly.
English ordinal generation preserves tokens outside its supported 0-9999 range unchanged, instead of rewriting their suffix to th.
English ordinal generation omits prose commas in thousands with remainders, retaining the existing conjunction convention. For example, 1234th expands to one thousand two hundred and thirty-fourth, a spoken word sequence.
Breaking (Rust API): ReplacementWords::new and TryFrom<Vec<Word>> reject empty lists; JSON admission enforces the same invariant. Replacement::new accepts admitted ReplacementWords. Use into_vec and checked reconstruction instead of take/retain, or edit elements through mutable slices. Single-word construction remains infallible.
re2c replacements use the existing word grammar directly, retaining source spans instead of splitting/reparsing text or inventing plain words on failure. Empty and unclosed replacements are parser errors. Glued replacements receive a diagnostic on re2c’s opening token, without copied tree-sitter recovery diagnostics. Historical E208 is deprecated; primary-parser E376/E342 rejection and the empty-replacement regression remain.
Breaking (Rust API): PauseTimedDuration::Parsed now carries a checked ParsedPauseDuration with private fields and read-only seconds(), millis() and as_str() accessors. Construct through PauseTimedDuration::new; CHAT and JSON formats are unchanged.
Diagnostic display enrichment preserves legitimate zero-width EOF locations instead of moving them back onto the preceding byte, including when the file ends with a newline.
E306 empty-turn deletion now declines turns with dependent tiers, preventing their content from being silently reassigned to the preceding turn.
E241 marker-spelling repairs now require an exact source-bound word. The existing spelling vocabulary remains authoritative; comment text and omission/shortening notation are not rewritten as plain markers.
E750 group-edge repairs now require source-bound whitespace at the owning annotated group’s content boundary instead of neighboring delimiter bytes. Complete space runs and nested groups retain recovery-repair admission; groups with unrelated structural recovery decline a proposal.
E244 now reports adjacent stress markers once per affected word. Longer runs no longer create duplicate diagnostics and overlapping repair proposals.
Duplicate-comma proposals now require exact source-bound comma tokens in a clean tier body, sharing token admission with semantic comma deletion.
Duplicate-primary-stress repair now traverses source-bound stress tokens. An earlier isolated mark no longer hides a later duplicate run, and all separate primary-duplicate runs in the word are repaired together. Only duplicate tokens are removed; other stress positions and diagnostics remain.
E259 comma-deletion proposals now use source-bound comma, tier-body and whitespace nodes. Removing an initial comma consumes its complete separator instead of leaving leading spaces; interior commas preserve their separator. The proposal remains a semantic change requiring user review.
Missing-terminator fix alternatives now use a source-bound grammar ending for insertion, before final postcodes on main tiers. This prevents misplaced terminators and splitting CRLF line endings, and refuses tiers whose structural boundary cannot be established. Choosing the terminator remains a user decision; these proposals are not automatic repairs.
E501 fix proposals now require source-bound, byte-identical repeated headers with no conflicting declaration of that kind. Conflicts, formatting differences and recovered structure decline a proposal. Complete CST header ranges replace physical-line guessing; the existing header-write restriction is unchanged.
Structured dependent-tier recovery now retains generated source ownership through recursive traversal instead of accepting raw nodes and independent text. Utterance recovery slots likewise preserve their source-bound fields through read admission. Recovery classifications, conservative alignment taint and placeholder behavior are unchanged.
Adding recovery taint no longer promotes unknown parse provenance (such as JSON-imported utterances) into partially clean provenance. Alignment remains unavailable until parser-backed provenance has actually been established.
Unreadable CST source ranges in generic, dependent-tier and utterance recovery now report internal failure, not invalid CHAT or an encoding repair suggestion. Readable recovery diagnostics and conservative alignment taint are unchanged.
Morphology tier-body, main-word and post-clitic parsing now consumes the generated canonical-grammar admission proof. Impossible missing-composite states are removed from these boundaries; lexical and structural recovery, absent children and internal-failure reporting remain distinct.
Fix planning no longer invents participant declarations, roles or default languages for E308/E504/E507. Supply those facts explicitly. E604 removal uses the complete typed GRA tier, preserving intervening dependent tiers and handling continuation lines; multiple targets refuse selection. E306 likewise uses the typed main-tier boundary rather than a line-prefix guess and refuses grammar-recovered main tiers.
splice::catalog_fix now borrows ParsedSource instead of accepting raw source text. Retain the owner from TreeSitterParser::parse_chat_file_with_source and pass diagnostics from the same input. W109 planning reuses this CST instead of creating a parser and reparsing for each diagnostic. Recovery admission and changed-output verification are unchanged.
Speaker-identification input-rejection reports now use the distinct incomplete_validation failure category when parser provenance prevents complete validation. Previously this was collapsed into validation. Consumers of the typed enum or JSON failure category must handle the new variant; no match evidence or CHAT-invalidity claim is inferred from it.
Word spelling is derived from typed structure, including the JSON raw_text field. Imported computed spelling cannot override content. Rust Word::new and new_unchecked no longer accept a separate raw argument; raw_text() returns an owned string and set_raw_text is removed. Use typed builders for markers and streaming WriteChat/Display when appropriate. Original source bytes must be read from the source, not from derived spelling. External token producers should handle fragment-parser refusal instead of falling back to unchecked construction. Shortening/embedded-marker errors retain grammar diagnostics without duplicate raw-spelling rescans.
Number conversion uses exact lexical entries for languages without a language-specific composer. Unsupported numerals, currency and number groups remain unchanged instead of using generic multiplication or partial rewrites.
Transcript construction rejects malformed media source spelling before reducing local paths, including malformed discarded directory components. Admitted remote URLs remain unchanged.
Generated source-bound extract_admitted APIs accept compiled-language evidence and exclude Missing only for proven nonterminal slots. Participant and language headers, document/utterance and main-tier/body/ending reconstruction use this admission; lexical Missing, Error, applicable Absent and source-read failures remain supported. Raw extraction stays broad. ReconstructionFault adds GrammarBinding for failed producer admission; downstream exhaustive matches must handle this as an internal tool failure. Low-level pre-begin and dependent-tier dispatch now consume generated admitted choice types. Document recovery source-ownership failures report E001 rather than classifying a producer fault as invalid CHAT.
Generated repeat elements and present optional elements now use selected-slot types with uninhabited Absent payloads. Consumers can eliminate impossible absence diagnostics while retaining MISSING/ERROR recovery, nested fixed positions, empty repeats and optional None. Kind-preserving projections retain the slot’s absence type.
Low-level %pho/%mod parsing now requires source-bound generated nodes and returns CstFailure for source/reconstruction failures. Compound spelling, grouped content, recovery and string fragment APIs are unchanged.
Low-level %sin parsing now requires a source-bound generated node and returns CstFailure for source/reconstruction failures. Sign-group fallback and empty-token policies remain; string fragment APIs are unchanged.
Low-level %gra parsing requires a source-bound generated node and returns CstFailure for source/reconstruction failures. String fragment APIs, numeric admission, recovery and relation completeness accounting are unchanged.
Low-level %mor tier parsing now requires a source-bound generated node instead of a node plus independent text. Bind through the existing ParsedSource owner; string fragment APIs are unchanged. Recovery and placeholder handling are retained. Word/post-clitic/feature readers retain the same source association; producer faults propagate separately from missing morphological content.
Generated ChoiceSlot makes Unexpected uninhabited: selected-choice extraction consumes its retained match plan and returns producer faults through ReconstructionFault. Parser consumers no longer invent CHAT diagnostics for that impossible choice state. Missing, Error, Absent, displaced nodes and supertype-classification recovery remain supported.
Source-bound bullet/text tier adapters return CstFailure, preserving source-binding failures alongside reconstruction faults without substituting empty content. The nested bullet-content reader propagates the same failures rather than returning a shortened segment list. High-level fragment parser signatures are unchanged.
ChatDate::Valid now holds CheckedChatDate with private fields. Construct dates through ChatDate::from_text or new; match Valid(date) and use day(), month(), year() and as_str() instead of field access. JSON remains a string; format/day-range admission is unchanged (not calendar validation).
Generated concrete CST extraction now returns Result<_, ReconstructionFault>; ERROR-root extraction returns Result<Option<_>, _>. Source-bound match plans retain selection decisions for consumption instead of independently rematching. Affected public header and tier adapters also return Result; callers must propagate producer failure, not substitute empty carriers. DocumentRoot::classify now returns the publicly exported CstFailure.
E001 is classified as DiagnosticKind::InternalFailure, not CHAT invalidity. Validation/admission and transformation pipelines preserve this distinction. CLI file records add internal_failure, summary records add internal_failures, and desktop events carry internalFailure/internalFailures. Failed attempts are neither valid nor invalid and never enter the validation cache. Producer faults during optional roundtrip reparsing also remain internal failures, rather than mismatches, and write neither validation nor roundtrip cache entries. Legacy checked node/source reads report E001 for incompatible ranges or UTF-8 boundaries instead of misclassifying those API faults as CHAT errors.
Flagged reference-first merge drafts return ordering uncertainty exclusively through DraftOrderReview records; they no longer insert generated review @Comment lines. Contributor comments, source ordering and strict-policy refusals are unchanged. Reviews are also accessible on unvalidated MergeDraft. before_output_utterance now has type OutputUtteranceBoundary; use utterances_before() for its count rather than treating it as a line index.
ParseErrorBuilder requires message and location in its type state before finish(), which now returns ParseError directly. Removed ParseErrorBuilderError and try_finish(); callers must supply both fields and remove result/option handling around finishing. Streaming source-range rejection now returns the original parse diagnostic, not a parser-creation error or a fabricated empty document.
Spanish cardinal expansion uses bounded hundreds/thousands composition, correcting 100000 to cien mil. Unsupported noun scales and unresolved agreement preserve the original input rather than inventing a phrase.
Lexical Unicode validation now rejects private-use scalars and noncharacters across all planes instead of copying CHECK’s high-BMP blacklist and private markup exemption. Ordinary compatibility characters are no longer rejected by that range rule; control-character checks are unchanged.
Retrace joining carries admitted utterance ownership into mutation instead of raw line indices. A forward scan preserves header barriers and chain repairs without repeated removal of later lines; repair policies are unchanged.
Vector and small-vector semantic differences share one sequence comparison policy, preserving bounded-report ordering and unmatched-tail diagnostics.
ErrorContext::from_source_with_span now returns Result<_, SourceExcerptError>. Invalid source slices and unrepresentable snippet coordinates are refused, rather than replaced by an empty context. Valid zero-width ranges remain valid.
Context label fields are private. Construct SampleTypeLabel, RoleLabel and ConsentTierLabel through TryFrom<String>; read them with as_str(). Corrected sample-type verdicts share this nonblank admission boundary.
Standalone-word conversion and %wor parsing require producer-bound nodes, not separate node/source pairs. Main-tier words, replacement words, timed words and standalone fragments preserve their source association to conversion.
Main-tier CST conversion now requires a producer-bound MainTierNode, not a typed node paired with independent source text. Fragment, utterance, and EOF recovery callers retain that association through conversion.
Main-tier contents parsing now consumes a bound ContentsNode; the shared contents/group cycle retains generated source association through recursive group and quotation dispatch, including recovery placeholders.
Speaker-mapping strings now refuse repeated source assignments, including identical repeats, instead of silently keeping the last assignment.
AdjudicationError adds InvalidDecisionMapping; exhaustive library matches must handle this refusal when a rename lacks its required adult role.

Keyboard shortcuts

Chatter: TalkBank CHAT Toolchain

0.29.0 - 2026-10-07

0.28.0 - 2026-10-02

0.27.0 - 2026-09-28

0.26.0 - 2026-09-24

0.25.0 - 2026-09-15

0.24.2 - 2026-09-12

0.24.1 - 2026-09-11

0.24.0 - 2026-09-10

0.23.0 - 2026-09-09

0.22.0 - 2026-09-06

0.21.0 - 2026-09-06

0.20.2 - 2026-09-06

0.20.1 - 2026-09-06

0.20.0 - 2026-09-06

0.19.0 - 2026-09-05

0.18.1 - 2026-09-05

0.18.0 - 2026-09-04

0.17.0 - 2026-08-30

0.16.0 - 2026-08-27

0.15.0 - 2026-08-25

0.14.0 - 2026-08-25

0.13.0 - 2026-08-21

0.12.0 - 2026-08-16

0.11.0 - 2026-08-13

0.10.0 - 2026-08-07

0.9.1 - 2026-08-05

0.9.0 - 2026-08-05

0.8.0 - 2026-08-03

0.7.0 - 2026-08-03

0.6.0 - 2026-07-31

0.5.1 - 2026-07-30

0.5.0 - 2026-07-30

0.4.1 - 2026-07-27

0.4.0 - 2026-07-27

0.3.6 - 2026-07-17

0.3.5 - 2026-07-15

0.3.4 - 2026-07-15 [YANKED]

0.3.3 - 2026-07-13 [YANKED]

0.3.2 - 2026-07-10

0.3.1 - 2026-07-08