From fb9b0c5caad96691034943ba281fe996c68a848d Mon Sep 17 00:00:00 2001 From: "sorokin.oleg.edu" Date: Thu, 24 Sep 2026 20:18:29 -0700 Subject: [PATCH] Select ordinary source8 compatibility before broader mixed adoption --- ...source8-compatibility-contract-20260925.md | 71 +++++++ .../ADOPTION-CRITIQUE.md | 45 ++++ .../ADOPTION-MAP.md | 198 ++++++++++++++++++ 3 files changed, 314 insertions(+) create mode 100644 harness/ordinary-source8-compatibility-contract-20260925.md create mode 100644 harness/ordinary-source8-design-20260925/ADOPTION-CRITIQUE.md create mode 100644 harness/ordinary-source8-design-20260925/ADOPTION-MAP.md diff --git a/harness/ordinary-source8-compatibility-contract-20260925.md b/harness/ordinary-source8-compatibility-contract-20260925.md new file mode 100644 index 00000000..e6ab0ebf --- /dev/null +++ b/harness/ordinary-source8-compatibility-contract-20260925.md @@ -0,0 +1,71 @@ +# Restore ordinary current-schema source round trips + +Baseline `edf096cd33350865ecfc3c65ec266a6c0d3c4000`. The public model and writers +already use schema8, while the ordinary public reader admits only3–7. Six nested +source tests and ten disk-transaction tests stop at that version rejection. The +selected immediate outcome restores existing ordinary OA/SA workflows without +claiming the private mixed analysis pipeline is publicly integrated. + +## Decision and boundaries + +Select ordinary source8 compatibility before broad mixed read/edit adoption. +Independent [mapping](ordinary-source8-design-20260925/ADOPTION-MAP.md) and +[critique](ordinary-source8-design-20260925/ADOPTION-CRITIQUE.md) identify the +writer→reader mismatch and the coupled public compilation callers. Existing +compile_bundle performs identity stabilization, source migration and indexing; +updates, checked save, history and server preparation depend on that complete +result. A private AcceptedRename cannot replace it with an incomplete index. + +Admit current schema8 through the existing supported ordinary grammar and model +admission. Preserve version3–7 migration, caller limits, exact locations, omitted +UUID stabilization, lexical ownership, source index and unchanged-input refusal +semantics. Preserve future-version rejection with an accurate supported-version +diagnostic. Current-schema input must report no migration; old migrated output +must recompile idempotently at the current schema. + +Keep explicit analysis-record refusal in ordinary conversion and refusal of short +typed declaration syntax. Do not promote cfg(test) mixed hooks, invent an empty +typed index, add unchecked constructors, change formatters, or silently accept +unsupported analysis payloads. The public formatter's missing typed definitions +and generic analysis payload output remain separate integration limitations. +Existing complete-model checks must still reject lossy checked-save output before +filesystem staging. Ordinary acceptance is not full source8 language support. + +Do not change generic value depth64, typed logical depth128, parser/storage limits, +DEPTH_128_VALIDATED=false, codec platform qualification, or the separately recorded +full-pipeline stack limitation. Source and JSON checked-save paths must both be +exercised when the formerly first-failing source path begins to work; this does +not qualify depth128 or waive user-deferred Linux work. + +## Finite acceptance + +- Preserve all292 existing core tests. The16 named schema-refusal failures must + run their actual nested/migration/update/transaction assertions. Investigate any + newly reached failure at its own layer; neither changing an expected outcome + nor observing a different failure closes it. +- Add a focused direct ordinary current-schema formatter→parser and bundle + formatter→compile→compile regression. Check whole OA/SA models and actual source + identities, current no-migration behavior and old3–7 migration/idempotence. + Reuse substantial existing fixtures rather than creating a second model writer. +- Verify included/nested ordinary declarations with omitted IDs, Unicode/CRLF, + comment preservation, historical fields, exact warning/error attribution and + stabilized index spans in the returned bytes. Existing relevant integration + tests may supply this evidence when actually run on the candidate. +- Assert both short typed syntax and long ordinary analysis constructors remain + rejected through public entry points. Keep malformed/future headers rejected; + retain existing overbudget, stale compiled input and lossy-save safeguards. +- Run the core library suite, relevant existing source-project/identity/migration/ + checked-save/disk-transaction integration tests, strict core all-target Clippy + and format disposition. Inventory test names before selecting focused commands + so a zero-test invocation cannot count. Prior private acceptance and stack + controls remain required regressions. +- Build a non-test consumer and exercise a real CLI source check and rename + preview over an ordinary multi-file input. Assert expected report/model/bytes + and that check/preview leaves every input unchanged. Use existing CLI semantics; + do not bypass discovery or perform a disk write merely to prove preview. + +Keep source fixes and new evaluator expectations separate in the evidence. Record +initial failures, source/artifact identities and the precise tests that now reach +previously masked behavior. Root owns compilation, integration acceptance and +publication; bounded workers may implement and independently review. The remote +publication/comment failure does not turn local commits into shared handoffs. diff --git a/harness/ordinary-source8-design-20260925/ADOPTION-CRITIQUE.md b/harness/ordinary-source8-design-20260925/ADOPTION-CRITIQUE.md new file mode 100644 index 00000000..6cb2e04d --- /dev/null +++ b/harness/ordinary-source8-design-20260925/ADOPTION-CRITIQUE.md @@ -0,0 +1,45 @@ +# Independent public-adoption critique + +Source-only assessment at `edf096cd33350865ecfc3c65ec266a6c0d3c4000`. No production changes, builds, execution or remote writes. Written independently before reading the implementation agent's ADOPTION-MAP. These are proposed next outcomes, not an adoption decision or acceptance claim. + +## Recommended immediate outcome + +First restore the **existing ordinary architecture source8 round trip**, retaining explicit refusal of unsupported typed analysis declarations. This is smaller and more immediately useful than promoting the complete private mixed pipeline into the existing editing authority: the public writer already emits version8 while the ordinary public reader rejects it. Repair that compatibility boundary, then exercise the actual ordinary compilation/migration/edit/save workflows it enables. Do not describe this as complete source8 analysis support or assume one version-token change makes the whole checkpoint pass. + +All16 currently inherited library failures stop at the same public schema refusal: six nesting/source examples and ten disk transaction controls. Several never reach the behavior their test names describe. The final raw full log therefore establishes a concrete compatibility blocker, not16 demonstrated defects in transaction or nesting algorithms. Removing the gate can reveal further defects; the tests must actually complete afterward. Restoring these existing user paths is a useful dependency, not a replacement for mixed authoring parity. + +If the next selected milestone specifically needs mixed-analysis users to gain a capability, choose a separately scoped **source8 check/lint path** before generic editable compilation. It may return exact input-coordinate diagnostics without producing the legacy mutable compiled/index structure. Include discovery, caller limits and explicit-ID scope must be handled deliberately; a dispatch only at the last parse call is insufficient. Full public mixed read acceptance still needs its language/identity contract, described below. + +## Source-grounded seams and hazards + +| Seam | Actual behavior and implication | +| --- | --- | +| `oa-core/src/model.rs:9`, `language.rs:506`, `source_project.rs:586` | SCHEMA_VERSION is8 and both public formatters emit it. `language.rs:1541` admits only3..7 outside the private mixed mode. This blocks ordinary writer→reader and migrated-output recompilation today. | +| `language.rs:343..493`, `source_project.rs:287..306` | Public parse has model/report semantics; compile_bundle additionally inserts omitted UUIDs, recompiles returned bytes and performs migration. Neither is merely a predicate. `source_migration.rs:5..83` rewrites the version to current8 and then recompiles. | +| `language.rs:1291`, `analysis_source/mixed.rs:239..260` | Private mixed mode rejects omitted ordinary/header IDs and typed/parameter IDs. The public ordinary compiler promises stabilization, including nested declarations. A blind mixed dispatch would regress valid authoring with omitted identities; do not invent untracked random IDs inside the new consumed witness. | +| `language.rs:522..607`, `analysis_source/write.rs:427,518,626` | The public declaration formatter has no definitions loop; analysis elements go through the generic serde payload writer. The private typed Writer provides separate definition/analysis-element/typed-declaration methods but is not composed into public canonical output. A complete admitted model is therefore not evidence of a lossless public export. | +| `source_project.rs:111`, `:620..714`, `:877` | CompiledSourceProject exposes bundle/model/index as mutable data. The updater defensively recompiles, compares the complete index/model/bundle, formats old/new declarations, performs structural edits and recompiles/equality-checks the result. The private occurrence maps are not this SourceIndex, and rename-only coverage cannot stand in for generic structural edits. Existing equality guards cause many unsupported changes to fail closed; corruption is not inevitable, but successful editing is unproved. | +| `source_project.rs:203..265`, `source_files.rs:390..533` | Disk include discovery calls inspect_includes, which uses the legacy parse_unit. The loader subsequently compiles if discovery succeeded. A new full-bundle mixed reader alone cannot load a disk project whose entry/include inspection still rejects its syntax. Preserve strict syntax-based discovery and aggregate file/edge/depth/path checks; do not substitute a regex include scan. | +| `source_files.rs:819..879` | Save revalidates compiled bundle, model, index and entry before publication/conflict checks. AcceptedRename has no legacy SourceIndex. Do not bypass this revalidation by manufacturing a CompiledSourceProject from the accepted model and an incomplete index. Existing conflict/journal/path rules remain useful and required. | +| `oa-desktop/src/document.rs:299..395` | Commands call update_bundle_with_identity_map; apply_compiled recompiles public fields; commit/undo/redo store the complete Arc. History-byte estimation also serializes the model (`:24`). Adopting only accepted model or only source breaks the existing paired-state boundary; source8 work cannot silently claim history support from the private owning result. | +| `oa-server/src/store.rs:117..173` | New models are formatted then compiled and equality-checked; source imports compile; commands/replacements use the same generic updater. Changing compile_bundle affects server adoption too, not just a local reader. | +| `oa-cli/src/lib.rs:213..357` | Check and rename share prepare: disk discovery, raw lint, then unconditional compile/stabilization. Check refuses write, but its present implementation still needs CompiledSourceProject. A diagnostic-only mixed check needs an explicit early report route; switching only lint would still encounter legacy compile. | + +Private `language::analysis_source` and Parser mixed state are currently under cfg(test) (`language.rs:6..9,1219` and producer hooks). Any real adoption must compile a non-test consumer, not merely pass more oa-core unit tests. Promote only the required production seams; fixture constructors must remain test-only. `mixed.rs:279..341` currently derives bounded private Limits separately from final ProjectLimits and identifies the ceilings as uncalibrated public policy. Select those ceilings explicitly for the new entry point, preserve caller constraints, and retain the existing logical-domain exclusions; neither silently dropping the limits nor inventing universal heap accounting is justified. + +Depth contracts are different: ordinary recursive values retain64 (`language.rs:1407`), typed expressions retain logical128 (`analysis_source/syntax.rs:367`), and declaration/include traversal has separate limits. `language_nesting_tests.rs:239..263` explicitly protects ordinary depth64. Enabling typed expressions is not permission to raise every generic record/value limit or conflate logical depth with native stack capacity. + +## Candidate comparison and precise boundaries + +1. **Ordinary source8 compatibility — recommended first.** Preserve ordinary grammar, explicit analysis refusal at `language.rs:1861`, ID stabilization, migration reports and existing source index/update contracts; admit the current schema only through the supported ordinary path. Demonstrate all ordinary formatter/migration outputs reparse completely. Keep short typed declarations and long analysis constructors rejected through public edit paths until their adapter is actually complete. This does not waive future typed writer, scoped names or identity support. +2. **Separate mixed check/lint — safe as an explicitly bounded next capability.** Reuse complete mixed parsing/resolution and exact diagnostics, without emitting source, creating editable compiled authority or calling old formatters. Decide whether this first interface intentionally accepts only already-stable explicit-ID bundles; if so, name/document that finite scope and keep general source8 read acceptance open. A general public replacement must implement omitted-ID semantics instead. Production initial-input authority also needs a deliberate constructor/policy boundary: fixture borrowed-zero authority and a PendingRename carry cannot be substituted for a new raw-input admission path. Preserve the existing owner-relative meaning of C; do not reset a live pending carry to zero. +3. **Dispatch mixed parsing from every existing public compile API immediately — reject as presently incomplete.** It simultaneously promises stabilization/index compatibility to disk save, structural updates, migration, desktop and server callers. The private AcceptedRename deliberately lacks those interfaces. An incomplete SourceIndex is not an acceptable adapter, even if the parsed Project is correct. +4. **Owned rename adoption before broad structural edits — viable narrower write milestone, but larger than read-only checks.** Route an explicit rename intent through the complete original-index→plan→emission→verification pipeline; preserve no-op versus changed outcomes and whole current-bundle stale checks. Then choose one actual adopter, preferably a CLI rename preview before disk commit or history integration. Reuse the existing report's whole-file changes and conflict semantics. Do not send arbitrary Command results to the rename planner, treat parameter names as global aliases, or feed accepted output through the old formatter. A disk-writing adapter still needs authenticated complete returned source/model/diagnostics plus its existing snapshot expectations; a desktop adapter must atomically install and restore the pair. These are concrete adapter obligations, not a reason to redesign all history/storage now. + +## Finite acceptance for the selected next checkpoint + +For ordinary compatibility: run all16 formerly blocked tests to completion, then the existing source_project/nested/identity update, migration and disk transaction integration suites. Add a direct current-schema format→parse and format_bundle→compile→compile equality check, including ordinary OA/SA, nested owners, omitted IDs, comments/Unicode/CRLF and historical trace fields. Exercise at least one real CLI check and rename preview and one non-test consumer build. Confirm old3..7 migrations remain explicit/idempotent and malformed future versions still refuse. Preserve typed-analysis public refusal and private depth/limit controls. This acceptance concerns existing ordinary behavior; its tests do not establish mixed authoring. + +For a mixed diagnostic-only milestone: test both supplied bundles and actual multi-file loader discovery; OA/SA typed roots, scoped parameters, unresolved/duplicate references, complete warning locations, malformed inputs, included-file errors and limits. Assert exact input bytes and disk state remain unchanged, no compiled editing/save authority escapes, and errors on omitted IDs match the declared scope. Include a non-test caller so cfg(test) cannot conceal an absent public path. + +For later owned rename adoption: retain literal whole-byte/model oracles across global/scoped swaps, Unicode/CRLF and untouched files; successful warnings must refer to returned bytes. Exercise no-op, stale source, resource refusal, true input-owner destruction, failed publication/conflict and whichever actual history adapter is selected. Canonical typed writing and full structural composition require their own complete-model round trips; rename success is not their proxy. Keep the known scratch/path-copy and setup-stack limits explicit, with no new universal guarantees inferred from this adoption work. diff --git a/harness/ordinary-source8-design-20260925/ADOPTION-MAP.md b/harness/ordinary-source8-design-20260925/ADOPTION-MAP.md new file mode 100644 index 00000000..6e1f5b7a --- /dev/null +++ b/harness/ordinary-source8-design-20260925/ADOPTION-MAP.md @@ -0,0 +1,198 @@ +# Public source8 adoption map — read-only proposal + +Source `edf096cd33350865ecfc3c65ec266a6c0d3c4000`; parent reports final 11 new +passes, full 276/16 and strict Clippy, with evidence audit pending. This map does +not activate anything or change #7/user requirements. PROJECT_GOAL.md:64–71,83,96 +requires full graphical/text parity, understandable versionable text, calculations, +API editing and text-only model development. Private rename acceptance is a useful +foundation, not satisfaction of those requirements. No Gitea issue reread/write +was attempted under the existing publication blocker; parent owns #7 coordination. + +## Current concrete seams (repository-relative source paths) + +- `crates/oa-core/src/language.rs:8` gates the whole analysis_source module with + cfg(test). Parser mixed state/hooks at1218+ are independently cfg(test), too; + removing only the top-level gate is insufficient. Keep fixture constructors + and tests gated when promoting the actual production path. +- `language::{parse,parse_limited,parse_with_report_limited}` at343–355 reaches + parse_document and old Parser::document. Parser::unit at1551 rejects8 on the + ordinary public path (accepts3–7); ordinary conversion at1862 rejects analysis + records. Merely permitting header8 cannot parse/lower typed declarations. +- `language/analysis_source/mixed::{parse,parse_impl}` already constructs a whole + bundle witness; `mixed/project::resolve` admits complete Project and maps + diagnostics. Current mixed syntax requires explicit ordinary/typed/parameter + IDs. Its borrowed input lifetime is fine for a read that moves out an admitted + Project/warnings and drops syntax before returning; AcceptedRename is not needed + to authenticate an arbitrary initial read, nor should it gain a tuple constructor. +- `source_project::{inspect_includes,compile_bundle}` at207/287 uses parse_unit + and compile_once, stabilizes missing IDs, reparses actual changed bytes, then + upgrades older source. Its public CompiledSourceProject at111 owns bundle, + DecodeResult, SourceIndex and diagnostics. SourceIndex at94+ covers declaration + headers/bodies, lexical owners, fields/includes/project sites, not the complete + typed/scoped occurrence authority of the private index. +- `language::{format,format_declarations}` at505/522 emits schema8 but does not + iterate definitions; analysis elements still pass through ordinary payload + writing. Private `analysis_source/write::Writer::{definition,analysis_element, + typed_declarations}` at427/518/626 already writes typed fragments with limits, + but no complete public composition calls it. This is a real separate writer + integration obligation, not something a parser dispatch switch repairs. +- `source_project::{update_bundle,update_bundle_with_identity_map}` at619/640 + recompiles current bytes and compares model/index/bundle to reject stale public + structs, handles structural/identity intent, then recompiles output and compares + the entire target at876+. Its category/ownership/field editing is broader than + alias-only RenamePlan and must not silently route unsupported edits to renaming. +- `mixed/.../rename/emission/acceptance::AcceptedRename` now owns actual verified + bytes/model/warnings/exact policy/final storage. It has immutable access only, + no SourceIndex or borrowable admitted syntax. Changed emission rejects any + carried syntax, so it is deliberately not a repeated-owned-edit capability. +- `oa-server/src/store.rs::PreparedProject` at114–168 compiles formatted models, + updates source with prepared identity maps, and compares generated model. It + requires CompiledSourceProject, not AcceptedRename. Desktop `document.rs:121` + compiles initial bundles; apply_compiled at323 rechecks bytes/model/index before + history commit. Its saved receipt and undo/redo preserve exact source snapshots. + source_workspace.rs:365 also requires public complete bundle compilation. +- `persistence.rs::save_checked_profile_with_source` at961 emits final bytes, + calls public decode under byte policy, checks whole Project/no migration before + any temp file, then performs expected-byte conflict check and persist. Its + source path uses language::format, so public reader AND complete writer are + necessary for useful checked save. Private rename verify must not replace that + final-byte/storage transaction check or bypass source/JSON version dispatch. + +## Candidate comparison and smallest useful next outcome + +**A — public read/admission first (recommended).** Promote a narrow real mixed +read route into the existing public single-source decode dispatch, preserving +3–7 migration and unsupported-version behavior. Map actual source8 diagnostics, +return schema8/no migration, move the actual admitted model, and preserve exact +caller limits. Existing source8 read failures become specific acceptance targets. +This can deliver useful import/validation/API decode without inventing another +owned rename constructor. It does not alone claim editing, formatting or save. + +The next coherent slice after that is complete typed+ordinary canonical writing +and its public actual-output decode/equality round trip, reusing the typed Writer +and existing ordinary writer instead of a new serializer. This directly enables +checked-save acceptance with the existing pre-temp-file containment. Public API +shape needs a decision: current format returns String and cannot report bounded +writer refusal; a checked internal/public formatting result can serve save while +compatibility of the existing convenience formatter is explicitly maintained. +Do not hide writer refusal behind an empty/lossy document or an unconditional panic. + +Bundle/editor adoption then needs one deliberate source8 CompiledSourceProject +projection (or a narrowly selected successor type) for actual returned bytes, +including typed declarations/fields and qualified parameter ownership. No fake +empty SourceIndex or lowering of typed records through old ordinary conversion. +Preserve missing-ID stabilization, include discovery, field diagnostics and +identity-map semantics through explicitly selected integration, not ad hoc adapters. + +**B — repeated-owned rename/adoption first.** Requires borrowing/reindexing the +accepted bundle while its O+warnings remain live, defining another consumed +emission transition that does not drop externally owned carry, handling no-op, +and coherent document/history installation. It also needs public dispatch/index +bridges before existing callers can consume it. It proves a second private rename +but leaves public read/writer/checked-save gaps. Choose it first only for a real +consumer explicitly needing repeated immutable-source rename; no such consumer +is exposed by the current caller graph. This is avoidable as a prerequisite to A. + +## Decisions and finite acceptance + +1. Decide initial public source8 identity policy: reject missing IDs explicitly, + or integrate the existing stabilization promise with actual-byte reparse. + Private explicit-ID admission cannot silently redefine compile_bundle's public + behavior. Qualified parameter IDs/scopes require special attention. +2. Decide source8 caller resource policy and the read result/diagnostic adapter; + reuse named logical-domain bounds without claiming process-memory containment. + Avoid rescanning all text just to dispatch; share the established header/token + decision where possible without feeding already charged work twice. +3. Gate public reader with full mixed OA/SA/included-file cases, historical UUID, + scoped/global aliases, exact numeric values and invalid/overbudget sources. + Preserve legacy migration reports, warnings/source spans and input immutability. + Sixteen currently expected public failures are obligations to inspect and + intentionally resolve by behavior, never rename away or simply update baselines. +4. Gate writer/save with entire Project equality for every typed root and ordinary + carrier, all-file/UTF8/CRLF ownership where applicable, malformed/lossy output + refusal before temp creation, conflict preservation and actual saved receipts. + Keep allocation/diagnostic limits and old failure records visible. +5. Alias-only public editing can reuse sealed mixed plan/emit/verify once caller + adaptation is selected. Reject other changes precisely until structural source8 + editing and identity-map transfers are implemented; do not claim UI/API parity. + Existing command/history atomicity, stale index rejection, whole-result equality, + warning-to-byte identity and detached invalid drafts remain mandatory. + +No extra universal allocator framework, second serde/numeric parser, generic +legacy Index adapter, repeated-owned rename loop or extra fixture-only checkpoint +is intrinsically required before public read integration. Real missing work is +production gating, dispatch/identity policy, public result/index projection and +complete writer/update composition; these cannot be skipped by exposing private +AcceptedRename alone. + +`persistence/json_codec.rs:22` keeps DEPTH_128_VALIDATED=false pending its explicit +Windows/Linux debug/release codec and ordinary-lifecycle gates. Private128KiB +success and current acceptance runs do not flip that switch, prove native-stack +bounds, rerun the old full-pipeline setup limitation or waive the public checked- +save depth regression. Preserve the historical source-header failure and the +unreached JSON iteration until their intended complete public path is tested. + +## Supplement: ordinary current-schema compatibility first + +Independent code assessment, then compared with ADOPTION-CRITIQUE.md: I agree +this is a smaller useful next outcome than my earlier recommendation of public +mixed read first. The earlier map did not separate the already-supported ordinary +language from typed source8 syntax sharply enough. The public ordinary writer +already labels every current model8; the public ordinary parser's header list +alone prevents its existing ordinary constructors from receiving those documents. +Restoring that specific path is a compatibility repair, not a mixed analysis adapter. + +Concrete safety basis: Parser::unit at language.rs:1541 selects private mixed8 +separately from ordinary3–7. construct_declarations rejects every Kind::is_analysis +at1862. Short typed declaration words are absent from ordinary declaration_kind +at236; definitions have no ordinary constructor. finish_declarations at2107 +migrates only4..=7, while its existing following branch checks model limits and +returns migration=None for current8. Thus there is no need to route schema8 through +migrate_v7 or remove the deliberate analysis-record rejection. Public parse and +compile still apply full existing model validation, include traversal and limits. +Source migration already writes the current version then recompiles; ordinary8 +acceptance fixes that coherence too, including actual returned-byte indexing. + +Counterarguments/conditions: this must not be advertised as complete source8 or +as fixing public formatter omission of definitions. A Project containing analysis +definitions still cannot be losslessly exported by language::format; checked-save +must continue comparing the whole intended Project and refusing lossy output +before filesystem staging. Explicit rejection of both long analysis-record words +and short typed definitions/records must be exercised, not assumed from one token +example. Include fragments use the same public ordinary grammar, so rejection and +no-partial-result behavior must hold in non-entry files too. No mixed cfg gates, +private ownership APIs, public index shape or user requirements need changing. +The historical report's 'whitelist-only patch is insufficient' remains true for +*complete analysis/source8 preservation*; this deliberately smaller compatibility +milestone must explicitly leave that obligation open, rather than rewrite it. + +Finite candidate acceptance: direct current ordinary format→parse and modular +format→compile→compile whole-model/bytes/index checks, no migration on8; existing +3–7 migration reports and actual upgraded8 bytes; omitted-ID stabilization and +nested lexical ownership; ordinary OA/SA, diagrams/history/artifacts/traces, +Unicode/CRLF/comment retention; full malformed/future-version refusal. Run all16 +currently header-blocked library cases and their intended transaction/nesting +assertions to completion, without assuming all will now pass. Add negative +analysis-bearing read/import and genuine generated-lossy checked-save controls. +Exercise real non-test CLI check/rename-preview plus existing source project, +identity-map, migration, source_files disk transactions and desktop/server build +seams proportionately. Existing validation/stale/model-equality guards stay intact. + +This also exposes previously hidden persistence work. The exact historical +review_regressions::checked_save_returns_exact_bytes_and_accepts_unchanged_external_content +loop runs .arcadia before .oa.json: once ordinary8 save/reopen succeeds, its repeated +save and ordinary JSON iteration finally execute. Conflict siblings and +language::coordinate_bits_and_permitted_strings_survive_text_and_storage likewise +exercise real later branches. Any new failure is new evidence, not permission to +loosen equality/limits or call the earlier failure solved without completing them. +These are ordinary-model JSON checks, **not depth128 qualification**. The private +JSON depth driver and production_save_always_reopens_with_its_reader_profile have +separate paths; DEPTH_128_VALIDATED remains false and its Windows/Linux debug/release +requirements remain unchanged. Ordinary8 compatibility may remove one prerequisite +blocker but cannot manufacture the still-missing platform/depth evidence. + +Revised ordering recommendation: select bounded ordinary8 compatibility first; +then choose an explicit mixed check/lint or mixed read milestone with identity and +loader-discovery policy; complete typed writing and structural/adoption interfaces +remain required thereafter. Repeated-owned rename is still not a prerequisite. +No implementation, test execution or contract change is authorized by this map.