Preserve verified private S2c writer evidence and failed full gate
This commit is contained in:
+37
@@ -0,0 +1,37 @@
|
||||
# Prepared S2c gate admission helper
|
||||
|
||||
New ignored helper: `.local/admit-analysis-s2c-gate.py`. Source-only preparation; helper/admission functions were not invoked. No compiler, gate, full-suite waiver, Git mutation, Gitea or native action occurred. Parent owns review and actual execution after closed gates.
|
||||
|
||||
The helper is pinned to frozen `f1d79df4979121335ed7b4ce4da84b2fca8a9ef4` in `.local/analysis-core-worktree-20260911`; it requires that current HEAD at both initial and final admission. Read-only source preparation independently derived exactly534 scoped Git input files. Relative to admitted a2's531, the three writer files are new and the oracle rename adds one/removes one. The scope is exactly the existing recorder's Cargo manifest/lock/toolchain, .cargo, build, crates, assets, docs, examples and harness/fixtures scope.
|
||||
|
||||
Its fixed baseline is the actual admitted a2 listing142. The helper hard-pins the original a2 list result, inputs, raw log, admission and original S2b admitter. It does not reread the old mutable test EXE or treat the old full failure as a pass. The original S2b helper and all original outcomes remain unchanged.
|
||||
|
||||
The ten writer test names are a fixed set matching the actual frozen Rust test functions; membership is re-derived from the committed test source during admission. Together with all142 prior names, actual future listing must contain exactly152 unique names, with exact raw summary and recorded listing agreement. The future listing remains required; source counting alone does not fabricate an executable listing.
|
||||
|
||||
Only two focused selectors are permitted: `language::analysis_source` (44 actual passes,108 filtered) and `language::raw_tokens` (1 actual pass,151 filtered). Typed admission explicitly requires all ten new writer tests to pass, alongside the34 retained typed tests. Raw-token admission covers only its one actual case and does not claim to run those ten writer tests. All focused individual outcomes must equal the ordered selected listing, with zero failed/ignored/measured cases. Any different selector, wrong count, omitted/repeated case or full command rejects. The historical16 full failures cannot receive a full-pass admission here, even if a caller tries the focused interface.
|
||||
|
||||
Every current gate must be a closed integer-exit0 receipt at the exact source, with unchanged inputs, exact command, one test EXE and matching raw Running path. Actual EXE bytes/hash are reread at admission and must equal the list/focused identity. Exact534 committed file names/bytes/hashes and working-tree bytes must match the input manifest. Focused admission additionally verifies the admitted current listing's original result/input/log hashes, helper hash, executable, source and exact names. Historical baseline and all current inputs/receipts/helper/EXE are watched for final readback before exclusive admission output. Existing admission files cannot be overwritten.
|
||||
|
||||
No `--check-source`, strict-pass or full-pass mode was added. This keeps the helper bounded to the requested listing/focused admission. It uses read-only Git commands only and never invokes Cargo or Rust tests. Strict/full gates retain their own actual raw receipts and separate audit.
|
||||
|
||||
## Future invocation, after parent review and actual gate closure
|
||||
|
||||
Use the existing pinned Python with `-B` and substitute actual closed gate names:
|
||||
|
||||
```text
|
||||
PYTHON -B .local/admit-analysis-s2c-gate.py ACTUAL_LIST_NAME
|
||||
PYTHON -B .local/admit-analysis-s2c-gate.py ACTUAL_TYPED_NAME ACTUAL_LIST_NAME language::analysis_source
|
||||
PYTHON -B .local/admit-analysis-s2c-gate.py ACTUAL_TOKENS_NAME ACTUAL_LIST_NAME language::raw_tokens
|
||||
```
|
||||
|
||||
These commands have not been run. They write only a fresh matching `.admission.json` after all checks. Failed raw gate receipts/logs stay untouched. A future source correction needs a newly reviewed pin/helper adaptation and actual gates; this helper deliberately rejects source drift.
|
||||
|
||||
Preparation checks: Python AST parsing only, plus separate read-only Git membership/test-function extraction and baseline JSON/hash inspection. No helper import or admission invocation occurred. The new runner code remains unexecuted and may still expose actual integration/path/runtime errors. Its admission is evidence for the selected executed scope, not public source8, whole-project save or native acceptance.
|
||||
|
||||
Helper bytes/hash: 9816 / `0202540eec8870f1fd0a03ad39d55653c18c9bb3c533e491d67234e040c42833`.
|
||||
|
||||
## Independent review: r2 replaces the helper for future admission
|
||||
|
||||
The original helper and preparation record above are preserved. Independent review found that Python optimization could remove assert-based admission checks. Parent authorized the narrowly revised `.local/admit-analysis-s2c-gate-r2.py`: **10010 bytes / SHA256 `d2bd3c38feb77b8e916b3d413a278d4b0960baff8e14843aed4c2b20c26c90e1`**. Its only change is a non-assert `if not __debug__: raise RuntimeError(...)` guard immediately after imports, before evidence access or output. Use the r2 filename for all three future invocations above; current listing and focused admission helper hashes must both refer to r2.
|
||||
|
||||
An explicitly authorized `PYTHON -B -O .local/admit-analysis-s2c-gate-r2.py` with no gate arguments actually exited1 at the guard with `S2c admission requires Python assertions; optimized Python is refused.` It did not reach any evidence or admission operation. No normal-mode admission, compiler or S2c test was run. Counts534/152/44/1 and baseline pins were independently rechecked from source and existing records. See `.local/analysis-source-s2c-admission-independent-review-20260913.md` for the finding, exact invocation and active-runner risk limits. No active runner was modified.
|
||||
+44
@@ -0,0 +1,44 @@
|
||||
# S2c admission independent review and narrow r2 correction
|
||||
|
||||
2026-09-13, `/root/source8_lowering_plan`. Reviewed `.local/admit-analysis-s2c-gate.py` and its handoff against committed `f1d79df4979121335ed7b4ce4da84b2fca8a9ef4` and the original admitted a2 listing. No compiler/test/native/Gitea operation occurred; no active runner or source checkout was modified.
|
||||
|
||||
## Finding and authorized correction
|
||||
|
||||
The original helper, SHA256 `0202540eec8870f1fd0a03ad39d55653c18c9bb3c533e491d67234e040c42833`, relies on assert for acceptance checks. Optimized Python removes these checks. The documented `-B` does not prevent `-O`, `-OO`, or inherited PYTHONOPTIMIZE from enabling optimization. In that mode failed case/count/source/hash guards can disappear while the final admission writer remains. This is an actionable false-positive acceptance risk, not evidence that any historical gate ran optimized.
|
||||
|
||||
Parent authorized a new r2 copy only. `.local/admit-analysis-s2c-gate-r2.py` adds, immediately after imports and before paths/evidence handling:
|
||||
|
||||
```python
|
||||
if not __debug__:
|
||||
raise RuntimeError('S2c admission requires Python assertions; optimized Python is refused.')
|
||||
```
|
||||
|
||||
The guard itself is not an assert. Original helper bytes remain unchanged. Revised helper is **10010 bytes**, SHA256 **`d2bd3c38feb77b8e916b3d413a278d4b0960baff8e14843aed4c2b20c26c90e1`**. No other admission rule was changed. New admissions must use r2 consistently for listing and focused helper-hash linkage.
|
||||
|
||||
One specifically authorized non-mutating invocation actually ran:
|
||||
|
||||
```text
|
||||
C:/Users/User/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/python.exe -B -O .local/admit-analysis-s2c-gate-r2.py
|
||||
```
|
||||
|
||||
It exited **1**, at line16, with the exact RuntimeError above. It received no gate name and failed before argument parsing, BASE/ROOT setup, Git/evidence access or output creation. No normal-mode admission/helper execution, Cargo or Rust test occurred. This validates optimization refusal only; S2c runtime tests remain unrun.
|
||||
|
||||
## Independently checked membership and binding
|
||||
|
||||
Read-only Git enumeration at f1 produced **534** files in the helper's exact scopes. The a2-to-f1 source diff adds the three writer files; the oracle is a 100% rename, with no net input count change. The versioned guidance changes are outside harness/fixtures, so they do not add scoped gate inputs.
|
||||
|
||||
The actual a2 record contains **142** listing names, including **34** typed cases. Extracting the actual ten `#[test]` functions from committed writer/tests.rs gives exactly the helper's NEW_NAMES. Their union contains **152 unique** names, **44** matching language::analysis_source and **1** matching language::raw_tokens. Thus 108/151 filtered counts are correct expectations; they are not an executed f1 listing.
|
||||
|
||||
Direct hashes of the original a2 result, inputs, log, admission and S2b helper match every hardcoded baseline pin. Original a2 results and historical failures are not rewritten or reclassified.
|
||||
|
||||
With assertions enabled, the reviewed helper requires an exact source and closed integer-exit0 receipt, exact command, unique raw/recorded listing agreement, complete expected membership, exact focused ordered outcomes and summary, zero ignored/failed/measured cases, and the same admitted current executable identity. Full and unrelated commands are rejected. It compares every scoped committed blob with working-tree and manifest bytes and performs final watched readback. Existing admissions use exclusive creation. Typed mode explicitly includes all ten writer cases; raw-token mode cannot masquerade as running them. No further actionable finding arose within this bounded listing/focused admission contract.
|
||||
|
||||
This remains local evidence verification using the trusted runner receipts/Git environment, not proof against a party fabricating all raw evidence or changing Git resolution. Compiler/profile/full-suite/public8/native claims remain outside the helper's scope. Actual new listing and focused execution must exist before normal admission is attempted.
|
||||
|
||||
## Active runner assertion-risk inspection
|
||||
|
||||
A read-only process snapshot observed PID7504 running `run-navigation-service-gate.py ... core-full-44095f7 core-full` and PID7872 running `navigation-palette-native-session-command-r2.py launch ...`; both command lines use `-B` and no `-O` or `-OO`. The current tool process's PYTHONOPTIMIZE and User/Machine environment settings were all unset. This does **not** read or prove the already running Python processes' inherited environments; parent separately reports launching without -O.
|
||||
|
||||
`run-navigation-service-gate.py`, `run-navigation-palette-gate.py` and `run-analysis-source-gate.py` use asserts for admission/preflight checks without an optimization guard. Their actual subprocess return codes and final changed-input/head exit logic are ordinary executable code, but optimized execution could skip preflight source/freshness checks. Historical/assert-based admission helpers have the same general risk. Do not mutate active runners; for future launches use a reviewed new guarded copy or verify/record disabled optimization. Existing raw receipts may be independently audited without assuming that this risk occurred.
|
||||
|
||||
The active native runner uses an explicit `require` function rather than assert for its acceptance checks, so this specific optimization-elision finding does not apply to that script. No native process was controlled or altered by this review.
|
||||
+34
@@ -0,0 +1,34 @@
|
||||
# Proposed frozen S2c gates — not started
|
||||
|
||||
Read-only preflight after the desktop lease closed verified both `.local/as2-20260913` and `.local/analysis-core-worktree-20260911` are clean at **f1d79df4979121335ed7b4ce4da84b2fca8a9ef4**, with534 scoped committed inputs. Existing distinct `.local/analysis-checked-save-target-20260913` is a normal directory. Free disk was5106880512 bytes; inherited PYTHONOPTIMIZE was unset. Every proposed `*-f1d79df` output stem is absent. No S2c compiler or test was started by this preflight.
|
||||
|
||||
Binding decision needed before launch: both reviewed helpers hard-code `analysis-core-worktree-20260911`, whereas the parent's latest request named `as2-20260913`. Recommend using the identical frozen analysis-core checkout with these unchanged helpers and its existing cache binding. Using as2 instead requires fresh helper copies with only the checkout binding changed and reviewed; changing shell cwd alone will not redirect these helpers. Parent has been asked to resolve this before execution.
|
||||
|
||||
Reviewed helper pins:
|
||||
|
||||
- `.local/run-analysis-source-gate.py`: `d8d9c1c9e9dc94fdd43afb4118ebc491c8eb6d89082f8441f8395b9d4265b068`.
|
||||
- `.local/admit-analysis-s2c-gate-r2.py`: `d2bd3c38feb77b8e916b3d413a278d4b0960baff8e14843aed4c2b20c26c90e1`.
|
||||
|
||||
The admitter independently pins admitted a2 listing142 plus ten exact writer tests, requiring actual listing152, typed44 and raw-token1. It rereads all534 committed inputs and the actual emitted test executable; original S2b results remain historical. Its non-assert guard refuses optimized Python. The raw recorder still relies on assertions, so the invocation must reject a nonempty PYTHONOPTIMIZE and use Python without `-O`.
|
||||
|
||||
Proposed commands after parent accepts binding and scope, from repository root with the same known Cargo/Rustup/LLVM toolchain environment as desktop, **except** `CARGO_TARGET_DIR` must be the distinct analysis target below:
|
||||
|
||||
```powershell
|
||||
$analysisPython = 'C:/Users/User/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/python.exe'
|
||||
$analysisSource = 'f1d79df4979121335ed7b4ce4da84b2fca8a9ef4'
|
||||
$env:CARGO_TARGET_DIR = 'C:/Users/User/Documents/Git/ARCADIA-Studio/.local/analysis-checked-save-target-20260913'
|
||||
$env:CARGO_BUILD_JOBS = '1'
|
||||
if ($env:PYTHONOPTIMIZE) { throw 'Use unoptimized Python for analysis admission.' }
|
||||
& $analysisPython -B .local/run-analysis-source-gate.py $analysisSource list-f1d79df list
|
||||
& $analysisPython -B .local/admit-analysis-s2c-gate-r2.py list-f1d79df
|
||||
& $analysisPython -B .local/run-analysis-source-gate.py $analysisSource typed-f1d79df focused language::analysis_source
|
||||
& $analysisPython -B .local/admit-analysis-s2c-gate-r2.py typed-f1d79df list-f1d79df language::analysis_source
|
||||
& $analysisPython -B .local/run-analysis-source-gate.py $analysisSource tokens-f1d79df focused language::raw_tokens
|
||||
& $analysisPython -B .local/admit-analysis-s2c-gate-r2.py tokens-f1d79df list-f1d79df language::raw_tokens
|
||||
& $analysisPython -B .local/run-analysis-source-gate.py $analysisSource full-f1d79df full
|
||||
& $analysisPython -B .local/run-analysis-source-gate.py $analysisSource strict-f1d79df clippy
|
||||
```
|
||||
|
||||
These are a proposed serial sequence, not a blindly chained shell script: consume each closed result and require admission before dependent gates. Stop on any new failure. Listing must be152; typed must be44 passes (including all10 writer tests); token must be1 pass. If parent includes full/strict scope, full is expected to remain **136 passed/16 existing unsupported-source8 failures**, reflecting the unchanged public gate plus10 new writer tests; compare the exact failure set against retained `full-a2a28f8` rather than treating exit101 alone as acceptable. There is deliberately no full-pass admission or old-failure waiver in the r2 admitter. Strict all-targets requires actual exit0 and unchanged inputs. Full and strict retain their actual raw receipts for separate review.
|
||||
|
||||
No source8/public wiring or S2b source mutation is proposed. This is staged private writer/parser/lowerer evidence, not public source8, production source indexing, save/migration or native acceptance. The root desktop target and preserved feab test/GUI executables must remain untouched by analysis compilation.
|
||||
+21
@@ -0,0 +1,21 @@
|
||||
# Private S2c executable gate closure — 2026-09-13
|
||||
|
||||
Frozen source: `f1d79df4979121335ed7b4ce4da84b2fca8a9ef4`, clean `.local/analysis-core-worktree-20260911`; separate existing `.local/analysis-checked-save-target-20260913` target. All 534 scoped inputs matched the admitted listing and original committed bytes throughout; final source readback clean.
|
||||
|
||||
| Actual gate | Result | UTC closure |
|
||||
| --- | --- | --- |
|
||||
| list | 152 exact names; admitted | 2026-09-13T12:08:00.913025+00:00 |
|
||||
| typed | 44 passed; admitted | 2026-09-13T12:09:47.043155+00:00 |
|
||||
| tokens | 1 passed; admitted | 2026-09-13T12:13:55.998167+00:00 |
|
||||
| full | 136 passed, 16 failed, 0 ignored; Cargo 101 | 2026-09-13T12:15:46.279177+00:00 |
|
||||
| strict | All targets with -D warnings passed; Cargo 0 | 2026-09-13T12:24:00.805354+00:00 |
|
||||
|
||||
The full suite remains **FAILED**. Its 152 exact outcomes retain all 142 prior a2 outcomes and add ten passing writer tests. All sixteen failure blocks match the prior unsupported schema-8 header behavior. The separate full comparison is not a full-suite pass admission.
|
||||
|
||||
Receipts and exact hashes: [closure-f1d79df.json](analysis-source-gates-20260913/closure-f1d79df.json). The retained full comparison source was executed inline before its identical content was saved as `full-f1d79df-comparison.py`; it checks original baseline hashes, exact outcome membership/no duplicates, all unchanged baseline statuses, ten new writer successes, failure identity/message and 534 actual input bytes.
|
||||
|
||||
Commands and environment are in each immutable result. Reviewed runner SHA256 `d8d9c1c9e9dc94fdd43afb4118ebc491c8eb6d89082f8441f8395b9d4265b068`; listing/focused r2 admitter SHA256 `d2bd3c38feb77b8e916b3d413a278d4b0960baff8e14843aed4c2b20c26c90e1`. Python ran without optimization. All child sessions closed; compiler lease released after strict closure.
|
||||
|
||||
The separate desktop test binary readback remains `a0bc95a60c7daf3400788a8821257bc964a34f7442d015f3745663d6646ad279`; preserved feab GUI remains `521ca576337a4b5add70c8fb7f101e459274f9b4462a5c0bdd3290cc1ca72b58`. No desktop compiler or GUI was invoked.
|
||||
|
||||
This establishes the private staged S2c writer tests and strict checks only. Public source8 remains unsupported; ordinary/typed production composition, include admission, S3 indexing/update and S4 activation remain separate work. No source edits or Gitea actions were performed during these gates.
|
||||
+76
@@ -0,0 +1,76 @@
|
||||
# S2c typed canonical writer checkpoint
|
||||
|
||||
2026-09-13. Delegated owner: `/root/source8_lowering_plan`; integration, executable gates and publication: `/root`. This is a **source-only, private staged implementation**. All ten newly authored writer tests are **UNRUN**. No Cargo, compiler, GUI or Gitea operation was performed by this contribution.
|
||||
|
||||
## Frozen source and checks
|
||||
|
||||
- Worktree: `.local/as2-20260913`, branch `codex/analysis-s2-956atf-20260913`, clean after commit.
|
||||
- Commit: **`f1d79df4979121335ed7b4ce4da84b2fca8a9ef4`**, `Stage bounded typed source8 canonical and subtree writers`.
|
||||
- Parent: **`bed5b0e8320bfc106b1f5f62e42339ca23b900cd`**, accepted versioned Negate guidance addendum. That parent follows the corrected S2b pin `a2a28f8d23a46ba1696b6a8410d4d3b5c1808f49`.
|
||||
- Six files, 1,863 insertions and two deletions. No edits to public `language.rs`, source_project, model, semantic admission, parser/Budget, source3 bridge, header dispatch, ordinary writers, or user-owned specification.
|
||||
- Rustfmt completed and subsequent `rustfmt --check --edition 2024 --config skip_children=true` passed for the six affected Rust paths using the root `.local/toolchain` environment. Staged `git diff --check` passed. These checks are not compilation or behavioral evidence.
|
||||
- The oracle was moved byte-for-byte from `analysis_source/lower/oracle.rs` to `analysis_source/model_oracle.rs`; both Git blobs are `7acca881a5f5b1243a8df760b230f57619212eef`. Lowerer tests change only their module import. No oracle values or constructors changed.
|
||||
- Parent-reported prior a2 executable evidence: listing 142 admitted, typed 34 passed, raw_tokens one passed, full 126 passed / 16 existing unsupported-header failures, strict all targets passed at 07:09:57Z, with 531 unchanged inputs. **None of this is evidence that S2c compiles or passes.** Original analysis-core a2 and root 440 checkouts remain untouched.
|
||||
|
||||
## File partition
|
||||
|
||||
Paths below are relative to `crates/oa-core/src/language/`.
|
||||
|
||||
| File | Change |
|
||||
| --- | --- |
|
||||
| `analysis_source.rs` | Registers private writer and shared test oracle. Existing staged module admission remains unchanged. |
|
||||
| `analysis_source/lower/tests.rs` | Uses the shared oracle instead of its former local module. |
|
||||
| `analysis_source/model_oracle.rs` | Mechanical 100% rename of the independently authored complete Rust Project oracle. |
|
||||
| `analysis_source/write.rs` | 664 lines: bounded output sink, lookup/scope tables, declaration/type/binding/item formatting and fallible fragment interfaces. |
|
||||
| `analysis_source/write/expression.rs` | 284 lines: iterative expression task stack, all 13 Expr variants, precedence-aware parent context. |
|
||||
| `analysis_source/write/tests.rs` | 910 lines: ten authored tests and local staged parse/lower helpers. |
|
||||
|
||||
## Private interfaces
|
||||
|
||||
All interfaces remain inside the existing private staged `analysis_source` module; there is no new public test API or production entry point.
|
||||
|
||||
- `Limits { bytes, entries }`, constructed with `Limits::source8(ParseLimits)` using the existing candidate source8 hard limits. `Writer::new` rejects caller limits above the hard ceilings.
|
||||
- `Writer::new(&Project, Limits) -> Result<Writer, Error>` borrows the complete model, collects calculation parameter scopes once, and rejects duplicate IDs/names within a calculation. Reused parameter IDs across owners or between a parameter and a global object remain allowed.
|
||||
- `Usage { bytes, entries }` is available through `usage()`. Work and output counters aggregate across successful fragment calls; they do not restart for each declaration or subtree.
|
||||
- `Error { owner: Option<Id>, field: &'static str, message: String }` reports model context, without inventing source spans.
|
||||
- `definition(Id)`, `analysis_element(Id)` return a complete typed declaration; `typed_declarations()` returns `Vec<(Id, String)>` in definitions-by-ID then analysis-elements-by-ID order, including unused definitions and unbound declarations.
|
||||
- `value_type(owner, &AnalysisType)` emits a type value. `binding(owner, lower::Field)` emits the actual model binding and validates its owner/field context.
|
||||
- `expression(owner, Field, &Expr, Parent)` emits a supplied expression, retaining owner/field parameter scope. `Parent` is `Root`, `Binary(BinaryOp, Side)` or `Negate`; `Side` is Left/Right. This is the explicit S3 replacement boundary: a retained binary/unary parent can request the grouping needed to preserve topology.
|
||||
- `parameter(calculation, ParameterId)` emits a complete `input ...;` item with explicit scoped ID. `override_entry(case, property)` emits a complete `@property = binding;` entry and fails if absent. Other fragment APIs emit values without field keywords or semicolons.
|
||||
|
||||
The byte sink checks remaining capacity before growth and uses `serde_json::to_writer` directly for quoted strings, matching existing `language::quote`. Raw alias and quoted-string size checks precede their variable-size work. Exact values use existing `Exact::canonical_literal()`; its scratch is bounded by the model's two 4096-bit components. No float conversion, recursive child-string construction, JSON payload transport, or reparsing/normalization of Exact values is introduced.
|
||||
|
||||
Entry work is charged before scope-table insertion, structural visits and expression scheduling; stack growth has a pending-entry bound. The first failed output call latches its error, discards its unfinished fragment and prevents later calls from returning output. Completed fragments consume the same aggregate quota. No parser Budget reference/literal recharge or semantic admission occurs inside the writer.
|
||||
|
||||
## Formatting contract
|
||||
|
||||
Declarations use LF, four-space declaration indentation, eight-space fields, description first, short typed words and explicit required fields. Definitions retain ID order; parameters and call labels use the callee's parameter vector order; overrides use property ID order. Dimension axes follow the fixed seven-axis order. Empty dimension and override bodies remain explicit `{}`. Units retain exact scale/offset; display-unit none, documented-constraint none, base ModelBaseline and unbound values remain explicit. Headers emit all IDs and display names. Analysis parent must remain none.
|
||||
|
||||
The expression writer handles all 13 model variants iteratively. Binary grouping preserves lower precedence, equal-precedence right children, and comparison nesting on either side. Negate emits `- ` and groups only a binary operand. Negative literal nodes remain `ratio(-1, 1)`, distinct from unary `- 1`. Parameter and global references use typed lookups and owner scope; calls require the exact callee parameter-ID set, emit labels in declaration order, and do not expand the call graph. Depth 128, list width 1024 and exponent bounds remain unchanged.
|
||||
|
||||
The accepted Negate addendum is implemented without parser-limit changes. A source-derived case override with 127 Negates around Number(-1) consumes 130 staged frames; the calculation control consumes 129. The obsolete mandatory-grouping spelling consumes 257 in the case and 256 in the calculation, showing why the calculation-only control was insufficient. Replacing the entire grouped operand in `-(1)` with a binary expression requests `Parent::Negate` and restores required grouping.
|
||||
|
||||
## Authored tests — all UNRUN
|
||||
|
||||
Full prefix: `language::analysis_source::write::tests::`.
|
||||
|
||||
1. `typed_oa_sa_canonical_roundtrips_match_independent_projects`: complete independent OA/SA model equality through typed canonical parse/lower, 14 display-name assertions, one existing semantic admission per candidate, canonical stability and public8 rejection.
|
||||
2. `typed_declaration_order_and_required_empty_values_are_canonical`: independent model additions for empty dimensions, affine algebra, negative unit offset, Unicode symbol, unused zero-input/list-result unbound calculation, explicit none/empty values and sorted overrides; complete model roundtrip/admission/stability and absent-override failure.
|
||||
3. `all_expr_variants_and_precedence_preserve_exact_trees`: independent actual Expr and golden source for all 13 variants, including the corrected semantically valid AsKind; structural roundtrip plus admission in the complete candidate; additional unary, negative-literal, binary, comparison and empty-list topology controls.
|
||||
4. `canonical_calls_use_callee_parameter_order_and_qualified_names`: reversed parameter vectors, map-order independence, reused IDs across scopes and a global ID, caller parameter names versus callee argument labels, complete parameter items and model roundtrip/admission.
|
||||
5. `subtree_output_respects_parent_context_and_retained_delimiters`: replaces the whole `(1)` operand span in `-(1)` with binary, negative literal and unary trees, verifying retained-parent topology; right subtraction child, type fragment and complete override item controls.
|
||||
6. `canonical_strings_and_exact_literals_use_existing_encodings`: quotes/backslash/control characters/NUL/Unicode equality with existing quote encoding, exact literal canonical forms, and typed model roundtrip.
|
||||
7. `writer_limits_are_aggregate_exact_and_latched_without_partial_results`: exact and adjacent byte/entry limits, cross-fragment charging, latched errors, escaped Unicode byte controls and hard-limit rejection.
|
||||
8. `writer_lookup_scope_shape_and_depth_failures_are_model_located`: wrong domains/unknown IDs, out-of-scope parameters, call argument-set mismatch, bad power/list/depth bounds, invalid owner/field contexts and contextual errors.
|
||||
9. `negate_override_roundtrip_preserves_depth128_within_frame256`: source-derived whole-case depth-128 AST, prefix 130/129 and obsolete grouped 257/256 controls, exact 127-unary/negative-literal tree, complete model equality and stable canonical output.
|
||||
10. `iterative_writer_preserves_width1024_and_empty_call_topology`: exact list-1024 and zero-argument-call structural roundtrips.
|
||||
|
||||
## Review and remaining work
|
||||
|
||||
Fresh independent source review and parent-owned compilation/executable gates are next. The writer's model precondition is complete semantic admission by its caller; writer lookup/shape failures do not replace semantic validation. The all-13 tests run the existing admission once per complete candidate. The helper used to inspect a bare expression wraps it in a private probe calculation for structural parsing/lowering; that helper's placeholder result type is not claimed as a semantic oracle.
|
||||
|
||||
OA/SA tests combine a separately authored ordinary source7 skeleton with typed declaration output and the existing staged lowerer. Complete Project equality here is **not public whole-source8 parsing, include admission, save admission or migration evidence**. The string-encoding test checks encoding and structure; it does not claim semantic admission of its modified control-character names/symbols. The width/empty-call test checks topology.
|
||||
|
||||
S3 still owns source-qualified indexing, deriving replacement context from existing expression sites, original span selection, comment/ownership-preserving edits, stabilization of missing parameter IDs, and cursor/update behavior. S4 still owns complete ordinary/typed production composition, envelope/include aggregate limits and inherited frames, version/migration/export/save integration, and eventual public8 activation. The writer's aggregate quota currently covers typed output only. `value_type` accepts its owner as error context; binding/expression methods validate model owner/field context. No production-wide writer or public formatter signature changes are included.
|
||||
|
||||
The local accepted implementation plan is `.local/analysis-source8-writer-plan-20260913.md` (SHA256 `e6ef6108792896cfb65e825cd19e984bf1c1729cff242653ed7947b4c6e9a803`). The versioned Negate addendum is `harness/analysis-source8-20260913/writer-canonical-negate-20260913.md` in the bed5 ancestor. Source stays frozen pending parent direction.
|
||||
+48
@@ -0,0 +1,48 @@
|
||||
# S2c typed writer independent source review
|
||||
|
||||
Frozen review pin: `f1d79df4979121335ed7b4ce4da84b2fca8a9ef4`, direct parent `bed5b0e8320bfc106b1f5f62e42339ca23b900cd`, in `.local/as2-20260913`. The worktree was clean at readback. Reviewed the full six-file change, accepted writer plan, author's handoff, actual staged parser/Budget and relevant model/admission contracts. No compiler, Rust tests, formatter, GUI, Gitea or source mutation occurred. Read-only Git object inspection verified the pinned changes and oracle move. Only this report was written.
|
||||
|
||||
**No demonstrated actionable source defect within the private S2c contract.** This disposition does not establish compilation, runtime success, production/public source8 acceptance or complete save/export correctness. All ten added tests remain unrun in this review.
|
||||
|
||||
## Topology and reference review
|
||||
|
||||
`write/expression.rs:14-48` matches the actual Pratt parser's precedence table and left associativity. Lower-precedence binary children and equal-precedence right children are grouped; both comparison-child sides are grouped regardless of equality/ordering precedence. Constructors/list/call arguments use root expression context. `Parent::Negate` groups binary operands only. Canonical negative Exact nodes use ratio syntax, so `- 1`, `ratio(-1, 1)` and `- ratio(-1, 1)` remain distinct trees. The task scheduling reverses complete child/text sequences onto a LIFO stack, preserving left-to-right emission and constructor/list argument order.
|
||||
|
||||
All 13 Expr variants are explicit in the iterative match. Power writes the stored signed exponent with its -16..16 check; it does not turn the exponent into another Expr or evaluate/fold anything. Quantity resolves Unit rather than QuantityKind. Property, definition and parameter domains use separate lookups. Checked definition lookup precedes the call's later indexing, and the immutable Project borrow prevents a intervening mutation.
|
||||
|
||||
`write.rs:294-350` derives argument-value scope from the actual owning binding field. The call path at `write/expression.rs:190-237` validates exactly the called calculation's parameter-ID set and emits argument labels in its parameter Vec order. Child expressions retain the caller's calculation scope; callee names do not redirect caller `$parameter` resolution. Constructor scope tables are per calculation; duplicate IDs/names within a signature fail, while reused IDs across signatures or with a global UUID remain distinct. No call-graph expansion or global parameter-name map is introduced.
|
||||
|
||||
`write.rs:427-625` emits each typed body, explicit UUID/name/description, required none/unbound/empty forms, Vec parameter order and BTreeMap override order. Short OA/SA words and root-only analysis parent handling are explicit. All catalog definitions are emitted, including unused or unbound calculations. Stored aliases are checked, quoted text streams through serde_json and exact numbers use the existing bounded canonical literal implementation.
|
||||
|
||||
## Limits and error boundary
|
||||
|
||||
The sink checks cumulative UTF-8 bytes before extension. Quoted-string encoding streams into that same sink rather than materializing an unbounded escaped intermediate. Name size is checked before lexical validation at `write.rs:165`; Exact's temporary is bounded by existing numeric components. `run` at line179 preserves aggregate counters across successful fragments, discards an incomplete fragment on error and latches that error. `typed_declarations` returns no partial vector on an error.
|
||||
|
||||
Scope-table construction charges definitions/parameters before insertion. Expression tasks charge structural visits; stack extension has a pending-work bound. List width1024, expression depth128 and power bounds fail explicitly. The limits are private typed-output/structural quotas, not a promise that every semantically accepted Project fits every lowered caller quota. Semantic admission remains a caller precondition; the writer does not duplicate global identity/type/layer validation. In particular, `value_type` intentionally uses owner as error context, while binding/expression methods validate owner/field membership. The typed-declaration convenience still scans the complete element map to find analysis entries; its output quota is not a production-wide traversal/export bound. S4 must retain the separately stated complete Project/envelope/include/resource contract.
|
||||
|
||||
## Evaluator adequacy and limits
|
||||
|
||||
The ten source-authored test functions are meaningful for this checkpoint:
|
||||
|
||||
- OA and SA canonical tests start from the independently built complete Project oracle and separately authored ordinary source skeletons. Actual staged parse/lower output must equal the complete original Project, followed by semantic admission and stable re-emission. Expected typed bodies do not come from the writer. Public8 rejection remains explicit.
|
||||
- All-13 tests use independently constructed Expr trees and exact source goldens, then compare actual parsed/lowered topology. The complete candidate is admitted for the semantically valid 13-variant cases; the corrected AsKind example is retained. Additional precedence cases are structural controls and do not claim semantic validity for the temporary probe calculation.
|
||||
- Call tests distinguish callee order from argument-map order, caller versus callee parameter names and reused scoped/global UUIDs. Parameter-item checks and a complete model roundtrip preserve identities. These cover the key alias/scope confusion risk.
|
||||
- Subtree tests exercise explicit parent contexts, retaining Unary topology after replacing the entire grouped operand of `-(1)` with binary, negative-literal or unary values, and preserving a right subtraction child. This is a private fragment contract. They do not exercise S3's actual expression-site selection, source edits, comment ownership or full transaction path.
|
||||
- The exact-byte/one-byte-short controls include escaped Unicode and aggregate output across calls; low entry limits and latched errors are exercised. Wrong domains, missing/extra parameter IDs, invalid scope and nearby width/depth bounds are explicit negative controls. Full performance/memory behavior remains unmeasured.
|
||||
- The previous Negate frame counterexample is retained as a complete case: 127 Unary nodes around a negative Exact leaf, independent tree count, actual staged parser frame counts130/129 and obsolete grouped case/calculation controls257/256. The intended failure records the hard maximum reached at256; it does not falsely assert a successful257-frame parse. Canonical case output must roundtrip to the complete model and remain stable. This directly addresses the earlier design finding rather than relying on a calculation-only witness.
|
||||
|
||||
The test suite samples consequential precedence combinations rather than exhaustively enumerating every binary-operator pair. Source comparison found no missing/mismapped operator. No expanded test framework or unrelated production changes are required by this review. Parent-owned executable gates must still check the new ten tests alongside retained lower/declaration/parser/raw-token tests and strict compilation. Previously failed full-library public-header tests must remain reported as failures until separately repaired; S2c does not fix or waive them.
|
||||
|
||||
## Mechanical move and scope evidence
|
||||
|
||||
The old `lower/oracle.rs` and new `model_oracle.rs` are exactly 8451 identical bytes, Git blob `7acca881a5f5b1243a8df760b230f57619212eef`, SHA256 `fa8bcf0a327debb219b145939601da4636cf85ddf7744a4e34c359542dfe6fb1`. Lower-test changes only replace its local module declaration with the shared private oracle import. `analysis_source.rs` only registers the private writer and cfg(test) oracle. No public parser/version dispatch, model, admission, source_project, migration, grammar or ordinary formatter changes are in this pin.
|
||||
|
||||
Reviewed writer file identities:
|
||||
|
||||
| File under analysis_source | Bytes | SHA256 |
|
||||
| --- | ---: | --- |
|
||||
| write.rs | 24143 | `a49b893225bc03b4ed9324a00ddd0179c73b6b06aed2dbabdd2afa851fb439fe` |
|
||||
| write/expression.rs | 12138 | `8b84f5255ccd51aa20b0f01b4f8d4b3a0b67fe2afe0ffdd4752e38f3253bd446` |
|
||||
| write/tests.rs | 30351 | `50364af0c82a7430a45edd8ec18ff9c5f1248c656a2234608b7a180bf2e39739` |
|
||||
|
||||
Plan SHA256 `e6ef6108792896cfb65e825cd19e984bf1c1729cff242653ed7947b4c6e9a803`; author handoff SHA256 `62c7e60b10b503afc97529707335d47eaebde36cfd6fd3b3bf01a0d7800e2073`. These are design/source records, not executed writer results.
|
||||
Reference in New Issue
Block a user