Reader recovery: partial trees and every error (ADR 0009 phase 4)

[ademar]

What

Phase 4 of ADR 0009 — the last of the runtime-side phases.

Parser.readLocatedExprListRecovering parses as much of a broken input as possible: every form that parses, plus one error per broken region, all with exact spans. The design keeps recovery outside the grammar — broken regions are re-windowed and re-run through the same strict parsers, with a small exact position-remap rule (a window position on line 1 shifts by the base column; every later line already has real columns) — so the strict readers compile depends on are untouched.

Semantics:

• Recovery resumes at the next line that opens a form at column 1 — the convention that makes top-level forms recovery points.
• The final broken region is re-parsed with its unclosed brackets closed (string- and comment-aware, [/( tracked as a stack), so the form being typed still yields a tree.
• Deliberately not done, and recorded in the ADR: mid-file broken regions are not bracket-completed, a broken region's own content is dropped up to the resync point, and error positions stay the strict reader's.

Payoffs, exactly where phase 3 predicted

• The language server's last-good-parse defines cache is deleted: completion and semantic tokens now run against the actual buffer mid-edit. A buffer like (define twice (vau …))␊)␊(twice still classifies the trailing twice as an operative and publishes both errors.
• ik check reports every broken region in a file (--json emits them all), instead of stopping at the first.
• The server publishes every diagnostic per change, not just the first.

The ADR also corrects its own estimate in place: "the largest single piece" landed smaller than the language server, because composing recovery from the strict parsers avoided the rewrite the estimate priced in.

Verification

• Clean --no-incremental rebuild: zero warnings. Full suite: 446/446 (10 new: 8 recovering-reader tests — clean-input parity with the strict reader, resync, stray closers, per-region errors with exact line assertions, trailing completion, exact span remap, unclosed-string guard, nesting-bomb control — plus multi-region check and a broken-buffer LSP test asserting the full semantic-token encoding and both diagnostics).
• Real-binary smoke: ik check --json on a two-region file emits two diagnostics at lines 1 and 3, exit 1.
• All examples run (yingyang skipped); CLR fault sweep: faulted (process aborted): 0.
• Benchmarks deliberately skipped: the recovering reader is cold code reached only by check and the language server; the strict parse path is byte-identical.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}