Finalize integrated Windows prerelease notes and validation

.gitattributes

@@ -89,3 +89,5 @@ harness/experiments/analysis-source-s2a-windows-20260913/** -text whitespace=-bl
 
 # Preserve the pinned Iced dependency bytes and upstream manifest.
 crates/vendor/iced_widget/** -text whitespace=cr-at-eol
+harness/experiments/analysis-mixed-syntax-20260923/** -text whitespace=-blank-at-eol,-blank-at-eof,cr-at-eol
+harness/experiments/state-multiselect-delivery-audit-20260923/** -text whitespace=-blank-at-eol,-blank-at-eof,cr-at-eol

AGENTS.md

@@ -4,12 +4,12 @@
 
 - Follow `PROJECT_GOAL.md` and the user's current instructions. Work autonomously within scope. Resolve discoverable questions yourself; record, test, and revise reversible assumptions. Ask only when a consequential decision needs information or authorization not already available. Continue independent useful work while blocked elsewhere.
 - Map unfamiliar domains through primary sources, comparable systems, and real user workflows. Identify underlying needs, valuable concepts, and avoidable friction; evaluate improvements rather than merely reproducing features. Synthesize findings into decisions or experiments, and stop research when another action offers greater value.
-- Make specifications precise enough for compatible independent implementations: definitions, relationships, invariants, valid/invalid examples, and lifecycle or transformation rules where relevant. Trace important requirements and decisions to implementation and verification. Resolve specification ambiguity at its source when implementation exposes it.
+- Make specifications precise enough for compatible independent implementations: definitions, relationships, invariants, valid / invalid examples, and lifecycle or transformation rules where relevant. Trace important requirements and decisions to implementation and verification. Resolve specification ambiguity at its source when implementation exposes it.
 - For consequential uncertain choices, compare materially different candidates against explicit user-derived criteria. Ask independent critics to challenge assumptions and attempt to falsify proposals; refine or replace candidates as evidence warrants. Record the choice, evidence, tradeoffs, rejected approaches, and reasons to revisit it. Use proportionate effort for reversible local choices.
 - Plan milestones that resolve uncertainty or deliver useful capability, with explicit dependencies. Test foundational assumptions before substantial downstream work. At checkpoints, assess progress toward the actual objective and replan when evidence invalidates the strategy or progress stalls.
 - Define observable success and suitable evaluators before repeated improvement: invariants, examples, round trips, transformations, performance checks, realistic user tasks, or explicit review rubrics. Ensure the evaluator measures the intended outcome. For experiments, record the question, expectations, method, result, and implications; isolate exploratory prototypes from production architecture.
-- Build and run meaningful changes, exercise actual behavior, and inspect useful logs. Investigate crashes, serious warnings, corrupted state, and interaction defects. For GUI work, use Computer Use or equivalent tools to inspect realistic workflows, cognitive load, editing/selection, navigation, feedback, recovery, loading/empty/failure states, accessibility, layout, focus/disabled states, and responsiveness.
-- Match independent reviews to the artifact and risks. For languages or formats, include ambiguity, round trips, human/AI editability, and version-control behavior where relevant. Verify findings, fix the appropriate conceptual, specification, architectural, implementation, or interaction layer, and recheck affected dependents. Reuse valid evidence; repeat checks for concrete risks, changes, findings, or required gates. Compilation, screenshots, and worker reports alone do not establish correctness or usability.
+- Build and run meaningful changes, exercise actual behavior, and inspect useful logs. Investigate crashes, serious warnings, corrupted state, and interaction defects. For GUI work, use Computer Use or equivalent tools to inspect realistic workflows, cognitive load, editing / selection, navigation, feedback, recovery, loading / empty / failure states, accessibility, layout, focus / disabled states, and responsiveness.
+- Match independent reviews to the artifact and risks. For languages or formats, include ambiguity, round trips, human / AI editability, and version-control behavior where relevant. Verify findings, fix the appropriate conceptual, specification, architectural, implementation, or interaction layer, and recheck affected dependents. Reuse valid evidence; repeat checks for concrete risks, changes, findings, or required gates. Compilation, screenshots, and worker reports alone do not establish correctness or usability.
 - Favor the simplest maintainable design satisfying known requirements and justified extensibility. Avoid speculative abstraction, unrelated refactoring, and repeating approaches already invalidated by evidence.
 
 ## User input
@@ -24,10 +24,10 @@ Keep one authoritative home for each kind of information. Use links and brief sc
 
 | Information | Authoritative home |
 | --- | --- |
-| Live plans, priorities, dependencies, ownership, status, blockers, and handoffs | Gitea issues/milestones; linked PRs hold change review and validation. |
-| Specifications, architecture, interfaces, and build/run documentation | Established version-controlled project documents. |
+| Live plans, priorities, dependencies, ownership, status, blockers, and handoffs | Gitea issues / milestones; linked PRs hold change review and validation. |
+| Specifications, architecture, interfaces, and build / run documentation | Established version-controlled project documents. |
 | Durable decisions and reusable evidence | `harness/DECISIONS.md` and relevant topic notes, or existing equivalents. |
-| Navigation and integrated-state checkpoint | `harness/STATE.md`: links, verified code commit/release, capabilities, and material limitations. No live task ledger. |
+| Navigation and integrated-state checkpoint | `harness/STATE.md`: links, verified code commit / release, capabilities, and material limitations. No live task ledger. |
 | Shared entrypoint | Gitea Wiki: overview and links, without duplicating versioned documentation. |
 | Published deliverables | Gitea releases, tied to source commits and verification. |
 
@@ -38,9 +38,9 @@ Use Gitea for live coordination and the relevant code version for implementation
 All independent agents coordinating through Gitea run on completely separate machines, each with its own clone, filesystem, tools, processes, and runtime. Gitea and pushed Git history are the shared communication and delivery channels. Local files (including `harness`), unpushed commits, worktrees, test results, and localhost services are not accessible to peers. Matching branch names or paths do not imply synchronized contents.
 
 1. On starting or resuming, including after compaction, inspect the working branch, local changes, applicable instructions, relevant shared records, and existing implementation. Recover context from authoritative records. Check for newer shared instructions on the actual remote default branch without overwriting local work. Read what is relevant; avoid repeated full-history scans and constant polling.
-2. Search before creating tasks. Claim a meaningful outcome in its Gitea issue with a stable session identity, scope, remote repository/branch, and acceptance criteria. Keep small steps within that task. Recheck after claiming; comments are not atomic locks. Respect existing ownership and resolve overlapping claims before overlapping work.
-3. Independent sessions are peers. Each owns its contribution and delegated work on its own machine. Record one integration/release owner when a milestone needs shared coordination. Use distinct remote work branches, partition files/interfaces, and coordinate changes to shared specifications and documents. Worktrees provide local isolation only; they do not share work between machines.
-4. At meaningful checkpoints or handoffs, record changed results, commit/PR links, verification commands and environment, blockers, and next actions. Identify the tested code version and label uncommitted or unpublished work as local-only. Before asking peers to consume results, push the required code and versioned documentation, including relevant `harness` updates; publish other required artifacts in Gitea and link them. Use repository-relative paths with commit references, reproducible commands, and necessary environment details; local paths and localhost URLs alone are not handoffs. Do not assume another agent is running or has read a message; silence alone does not establish abandonment. Record evidence and preserve existing work when reassigning a task.
+2. Search before creating tasks. Claim a meaningful outcome in its Gitea issue with a stable session identity, scope, remote repository / branch, and acceptance criteria. Keep small steps within that task. Recheck after claiming; comments are not atomic locks. Respect existing ownership and resolve overlapping claims before overlapping work.
+3. Independent sessions are peers. Each owns its contribution and delegated work on its own machine. Record one integration / release owner when a milestone needs shared coordination. Use distinct remote work branches, partition files / interfaces, and coordinate changes to shared specifications and documents. Worktrees provide local isolation only; they do not share work between machines.
+4. At meaningful checkpoints or handoffs, record changed results, commit / PR links, verification commands and environment, blockers, and next actions. Identify the tested code version and label uncommitted or unpublished work as local-only. Before asking peers to consume results, push the required code and versioned documentation, including relevant `harness` updates; publish other required artifacts in Gitea and link them. Use repository-relative paths with commit references, reproducible commands, and necessary environment details; local paths and localhost URLs alone are not handoffs. Do not assume another agent is running or has read a message; silence alone does not establish abandonment. Record evidence and preserve existing work when reassigning a task.
 5. Follow project review and merge conventions. Fetch the relevant remote branches and inspect the identified commits before reviewing or integrating another machine's work. Resolve conflicts while preserving others' edits, and verify the combined result locally; report material environment differences. Local instruction-file edits reach peers only after publication and retrieval. Do not overwrite others' work or force-push shared history to resolve coordination problems.
 6. Close work when its acceptance criteria are met and the result is integrated or delivered as appropriate. Mark duplicates and superseded tasks explicitly with replacement links. Then choose further useful unowned work while the requested objective remains incomplete.
 
@@ -64,10 +64,10 @@ Preserve concise records of decisions and rationale, useful experiments, failed
 
 Consolidate duplicates, repair stale guidance, and remove obsolete temporary files alongside useful project work. Before removing material, check references, active ownership, and ongoing use; preserve unique knowledge and update affected links. Prefer closing, superseding, or archiving history over deletion. User input is excluded from autonomous cleanup.
 
-If legacy local task ledgers or plans duplicate Gitea, migrate their live content once into existing or appropriately scoped issues, preserve useful decisions/evidence, and mark the old records superseded. Record the migration so later sessions do not repeat it. Do not create empty documents or maintain records for ceremony.
+If legacy local task ledgers or plans duplicate Gitea, migrate their live content once into existing or appropriately scoped issues, preserve useful decisions / evidence, and mark the old records superseded. Record the migration so later sessions do not repeat it. Do not create empty documents or maintain records for ceremony.
 
 ## Delivery
 
-Publish versioned Gitea releases at meaningful working milestones; mark unfinished versions as prereleases. Check existing releases/tags and coordinate one owner and version before publishing. Build from an identified integrated commit and verify the packaged result and launch steps.
+Publish versioned Gitea releases at meaningful working milestones; mark unfinished versions as prereleases. Check existing releases / tags and coordinate one owner and version before publishing. Build from an identified integrated commit and verify the packaged result and launch steps.
 
-Include runnable builds or appropriate artifacts, concise release notes, build/run/deployment instructions as applicable, known limitations, tested platforms, and verification evidence. Confirm publication and artifact availability. Use existing authorized API access or project tooling when MCP lacks a needed release/upload operation. Do not silently replace published versions with different contents.
+Include runnable builds or appropriate artifacts, concise release notes, build / run / deployment instructions as applicable, known limitations, tested platforms, and verification evidence. Confirm publication and artifact availability. Use existing authorized API access or project tooling when MCP lacks a needed release / upload operation. Do not silently replace published versions with different contents.

PROJECT_GOAL.md

@@ -17,14 +17,14 @@ Apply these criteria to the scope requested by the user:
 - Consequential decisions have evidence and rationale. Major assumptions have been validated, explicitly accepted, or isolated without compromising required behavior.
 - The result builds, runs, and operates on the required platforms. Relevant tests and evaluators pass; integrations, edge cases, and failure states have been exercised against the actual result.
 - User-facing behavior and usability have been exercised directly, using representative data and workflows.
-- A fresh independent review covers requirements, domain/semantic consistency, usability, architecture, correctness, regressions, runtime behavior, documentation, and remaining risks. Valid material findings are addressed, blocking and high-impact issues resolved, and affected behavior reverified; no known blocker or high-severity defect remains.
+- A fresh independent review covers requirements, domain / semantic consistency, usability, architecture, correctness, regressions, runtime behavior, documentation, and remaining risks. Valid material findings are addressed, blocking and high-impact issues resolved, and affected behavior reverified; no known blocker or high-severity defect remains.
 - Deliverables are maintainable, appropriately extensible, documented, and published as required by `AGENTS.md`. Obsolete scaffolding is removed; documentation and shared state accurately describe the result. Another engineer or agent can reproduce the verification and continue the work.
 
 If required work or verification is blocked, record the specific gap and continue independent useful work without claiming completion.
 
 ## Final handoff
 
-Link the delivered result and summarize capabilities, discoveries, architecture and decisions, relevant rejected approaches, verification and independent review, remaining limitations, and exact build/run/deployment/verification instructions. Refer to authoritative records instead of repeating the project history.
+Link the delivered result and summarize capabilities, discoveries, architecture and decisions, relevant rejected approaches, verification and independent review, remaining limitations, and exact build / run / deployment / verification instructions. Refer to authoritative records instead of repeating the project history.
 
 ## USER-OWNED APPLICATION SPECIFICATION
 

crates/oa-desktop/src/app.rs

@@ -18,6 +18,8 @@ mod hosted;
 mod reference_authoring;
 #[cfg(test)]
 mod review_navigation_tests;
+#[cfg(test)]
+mod source_indentation_tests;
 pub(crate) mod source_rename;
 mod source_symbols;
 pub(crate) mod text_workspace;
@@ -427,6 +429,7 @@ pub enum Message {
     Pan(iced::Vector),
     Fit,
     SourceEdit(text_editor::Action),
+    SourceIndent(crate::source_navigation::SymbolContext, bool),
     ApplySource,
     RevertSource,
     SourceUndo,
@@ -3314,10 +3317,16 @@ impl App {
                 self.pan += delta;
             }
             Message::Fit => self.fit(),
-            Message::SourceEdit(action) => {
+            Message::SourceEdit(_) | Message::SourceIndent(..) => {
                 self.source_jump = None;
                 let before = self.source_editor.text();
-                self.source_editor.perform(action);
+                match message {
+                    Message::SourceEdit(action) => self.source_editor.perform(action),
+                    Message::SourceIndent(_, outdent) => {
+                        crate::source_indentation::apply(&mut self.source_editor, outdent);
+                    }
+                    _ => unreachable!(),
+                }
                 let after = self.source_editor.text();
                 if after != before {
                     self.source_navigation.refresh(&after);

crates/oa-desktop/src/app/source_indentation_tests.rs

@@ -0,0 +1,77 @@
+//! Controller acceptance: one indentation gesture is one draft transaction.
+use super::*;
+
+fn fixture(source: &str) -> App {
+    let mut app = App::with_project(Project::empty());
+    app.page = Page::Text;
+    app.source_workspace = Workspace::new(
+        &oa_core::source_project::SourceBundle {
+            entry: "project.arcadia".into(),
+            files: std::collections::BTreeMap::from([("project.arcadia".into(), source.into())]),
+        },
+        true,
+    );
+    app.show_source_file(false);
+    app
+}
+fn indent(app: &mut App, outdent: bool) {
+    let message = Message::SourceIndent(app.source_symbol_context(), outdent);
+    let _ = app.update(message);
+}
+
+#[test]
+fn indentation_updates_draft_snapshot_version_and_single_undo_redo_without_model_change() {
+    let source = "雨\r\n🚀\r\n";
+    let mut app = fixture(source);
+    app.source_editor.perform(text_editor::Action::SelectAll);
+    let version = app.source_version;
+    let revision = app.source_workspace.revision();
+    let model = app.document.revision();
+    indent(&mut app, false);
+    let after = "    雨\r\n    🚀\r\n";
+    assert_eq!(app.source_editor.text(), after);
+    assert_eq!(app.source_snapshot.as_ref(), after);
+    assert_eq!(app.source_workspace.files["project.arcadia"].text, after);
+    assert!(app.source_workspace.has_edits());
+    assert_eq!(app.source_version, version + 1);
+    assert_eq!(app.source_workspace.revision(), revision + 1);
+    assert_eq!(app.document.revision(), model);
+    let _ = app.update(Message::SourceUndo);
+    assert_eq!(app.source_editor.text(), source);
+    assert!(!app.source_workspace.has_edits());
+    let _ = app.update(Message::SourceRedo);
+    assert_eq!(app.source_editor.text(), after);
+    assert_eq!(app.document.revision(), model);
+}
+
+#[test]
+fn stale_hidden_and_modal_indentation_is_rejected_before_navigation_invalidation() {
+    for rejected in 0..7 {
+        let mut app = fixture("alpha");
+        let mut context = app.source_symbol_context();
+        match rejected {
+            0 => context.path = "elsewhere.arcadia".into(),
+            1 => context.session = Id::new_v4(),
+            2 => app.page = Page::Home,
+            3 => app.busy = true,
+            4 => app.delete_pending = true,
+            5 => app.hosted.visible = true,
+            _ => app.pending = Some(Pending::New),
+        }
+        let interaction = app.source_symbols.interaction;
+        let version = app.source_version;
+        let _ = app.update(Message::SourceIndent(context, false));
+        assert_eq!(app.source_editor.text(), "alpha");
+        assert_eq!(app.source_version, version);
+        assert_eq!(app.source_symbols.interaction, interaction);
+    }
+}
+
+#[test]
+fn no_op_outdent_does_not_add_history_or_increment_source_version() {
+    let mut app = fixture("alpha");
+    let version = app.source_version;
+    indent(&mut app, true);
+    assert_eq!(app.source_version, version);
+    assert!(!app.source_workspace.undo(false));
+}

crates/oa-desktop/src/app/source_symbols.rs

@@ -33,6 +33,9 @@ fn admission_notice(error: query::AdmissionError) -> String {
 impl App {
     pub(super) fn source_input_envelope(&self, message: &Message) -> bool {
         match message {
+            Message::SourceIndent(context, _) => {
+                context == &self.source_symbol_context() && self.source_navigation_available()
+            }
             Message::SourceSymbols(context, event) => {
                 context.session == self.source_workspace.session()
                     && context.path == self.source_workspace.active

crates/oa-desktop/src/main.rs

@@ -28,6 +28,7 @@ mod recovery;
 mod route_edit;
 mod semantic_review;
 mod source_annotations;
+mod source_indentation;
 mod source_navigation;
 mod source_rename;
 mod source_tree;

crates/oa-desktop/src/source_indentation.rs

@@ -0,0 +1,94 @@
+//! Source indentation is one workspace edit, with physical line endings intact.
+use iced::{
+    advanced::{graphics, text},
+    widget::text_editor::{Action, Content, Cursor, Edit, Position},
+};
+use std::sync::Arc;
+
+const INDENT: &str = "    ";
+
+/// Plain Tab inserts one canonical four-space level at a caret, or prefixes
+/// every selected line. Shift+Tab removes one leading tab or up to four spaces.
+/// A selection ending at column zero excludes that final line. All patches are
+/// local to lines, so CRLF, LF and Unicode bytes outside indentation survive.
+/// The caller records the resulting buffer once in workspace undo/history.
+pub fn apply<R>(content: &mut Content<R>, outdent: bool)
+where
+    R: text::Renderer<Editor = graphics::text::Editor>,
+{
+    let raw = content.cursor();
+    let selected = content.selection().is_some_and(|s| !s.is_empty());
+    if !selected && !outdent {
+        content.perform(Action::Edit(Edit::Paste(Arc::new(INDENT.into()))));
+        return;
+    }
+    // Determine affected lines before normalizing Word/Line mode. Those modes
+    // expand columns within their endpoint lines; the copied LF count reveals
+    // whether a zero-column endpoint includes the next line or only its edge.
+    let anchor = raw.selection.unwrap_or(raw.position);
+    let first = raw.position.line.min(anchor.line);
+    let mut last = raw.position.line.max(anchor.line);
+    if selected {
+        let selected_text = content.selection().unwrap();
+        let line_breaks = selected_text.bytes().filter(|b| *b == b'\n').count();
+        // Effective selection starts on the minimum raw endpoint line.
+        last = first + line_breaks;
+        if last > first && selected_text.ends_with('\n') {
+            last -= 1;
+        }
+    }
+    let patches: Vec<_> = (first..=last)
+        .filter_map(|line| {
+            let removed = if outdent {
+                let text = content.line(line)?;
+                if text.text.starts_with('\t') {
+                    1
+                } else {
+                    text.text.bytes().take(4).take_while(|b| *b == b' ').count()
+                }
+            } else {
+                0
+            };
+            (!outdent || removed > 0).then_some((line, removed))
+        })
+        .collect();
+    if patches.is_empty() {
+        return;
+    }
+    let cursor = crate::source_navigation::selection::capture_for_edit(content);
+    let replacement = Arc::new(if outdent {
+        String::new()
+    } else {
+        INDENT.into()
+    });
+    // Descending order leaves Iced's earliest changed line at the first patch.
+    for &(line, removed) in patches.iter().rev() {
+        content.move_to(Cursor {
+            position: Position { line, column: 0 },
+            selection: Some(Position {
+                line,
+                column: removed,
+            }),
+        });
+        content.perform(Action::Edit(Edit::Paste(replacement.clone())));
+    }
+    let transform = |mut position: Position| {
+        if let Some((_, removed)) = patches.iter().find(|(line, _)| *line == position.line) {
+            position.column = if outdent {
+                position.column.saturating_sub(*removed)
+            } else {
+                position.column + INDENT.len()
+            };
+        }
+        position
+    };
+    content.move_to(Cursor {
+        position: transform(cursor.position),
+        selection: cursor.selection.map(transform),
+    });
+}
+
+#[cfg(all(test, debug_assertions))]
+mod keyboard_tests;
+#[cfg(test)]
+mod tests;

crates/oa-desktop/src/source_indentation/keyboard_tests.rs

@@ -0,0 +1,106 @@
+//! Real mounted Iced keyboard dispatch, using the production binding function.
+use crate::{app::Message, source_navigation::SymbolContext, views::source_tests::FontLayout};
+use iced::advanced::widget::operation::Focusable;
+use iced::{
+    Element, Font, Rectangle, Size,
+    advanced::{Layout, Shell, layout, text, widget as core_widget},
+    keyboard::{
+        self, Key, Modifiers,
+        key::{Code, Named, Physical},
+    },
+    widget::{
+        self,
+        text_editor::{Content, State},
+    },
+};
+
+#[test]
+fn mounted_tab_dispatches_only_for_focused_editable_editor_and_plain_shift_variants() {
+    for focused in [false, true] {
+        for editable in [false, true] {
+            for modifiers in [
+                Modifiers::empty(),
+                Modifiers::SHIFT,
+                Modifiers::CTRL,
+                Modifiers::ALT,
+                Modifiers::LOGO,
+            ] {
+                let context = SymbolContext {
+                    session: oa_core::Id::new_v4(),
+                    path: "project.arcadia".into(),
+                };
+                let content = Content::<FontLayout>::with_text("rain");
+                let mut editor = widget::text_editor(&content)
+                    .font(Font::MONOSPACE)
+                    .size(14)
+                    .padding(16)
+                    .height(iced::Fill)
+                    .key_binding(|press| crate::views::source_binding(press, &context, None));
+                if editable {
+                    editor = editor.on_action(Message::SourceEdit);
+                }
+                let mut view: Element<'_, Message, iced::Theme, FontLayout> = editor.into();
+                let mut tree = core_widget::Tree::new(view.as_widget());
+                let size = Size::new(600., 240.);
+                let node = view.as_widget_mut().layout(
+                    &mut tree,
+                    &FontLayout,
+                    &layout::Limits::new(Size::ZERO, size),
+                );
+                if focused {
+                    tree.state
+                        .downcast_mut::<State<text::highlighter::PlainText>>()
+                        .focus();
+                }
+                let event = iced::Event::Keyboard(keyboard::Event::KeyPressed {
+                    key: Key::Named(Named::Tab),
+                    modified_key: Key::Named(Named::Tab),
+                    physical_key: Physical::Code(Code::Tab),
+                    location: keyboard::Location::Standard,
+                    modifiers,
+                    text: None,
+                    repeat: false,
+                });
+                let mut messages = Vec::new();
+                let captured;
+                {
+                    let mut shell = Shell::new(&mut messages);
+                    view.as_widget_mut().update(
+                        &mut tree,
+                        &event,
+                        Layout::new(&node),
+                        iced::mouse::Cursor::Unavailable,
+                        &FontLayout,
+                        &mut iced::advanced::clipboard::Null,
+                        &mut shell,
+                        &Rectangle::with_size(size),
+                    );
+                    captured = shell.is_event_captured();
+                }
+                let plain = modifiers.is_empty() || modifiers == Modifiers::SHIFT;
+                let expected = focused && editable && plain;
+                let indentation: Vec<_> = messages
+                    .iter()
+                    .filter_map(|message| match message {
+                        Message::SourceIndent(emitted, outdent) => Some((emitted, outdent)),
+                        _ => None,
+                    })
+                    .collect();
+                assert_eq!(
+                    indentation.len(),
+                    usize::from(expected),
+                    "focused={focused}, editable={editable}, modifiers={modifiers:?}"
+                );
+                if expected {
+                    assert!(captured, "Tab must not escape to global focus traversal");
+                    assert_eq!(indentation[0], (&context, &modifiers.shift()));
+                } else if !focused || !editable {
+                    assert!(
+                        !captured,
+                        "non-editing Tab must remain available to focus traversal"
+                    );
+                }
+            }
+        }
+    }
+}

crates/oa-desktop/src/source_indentation/tests.rs

@@ -0,0 +1,112 @@
+use super::*;
+use iced::widget::text_editor::Motion;
+
+type Buffer = Content<iced::Renderer>;
+fn at(line: usize, column: usize) -> Position {
+    Position { line, column }
+}
+fn range(start: Position, end: Position, reverse: bool) -> Cursor {
+    Cursor {
+        position: if reverse { start } else { end },
+        selection: Some(if reverse { end } else { start }),
+    }
+}
+
+#[test]
+fn caret_inserts_four_spaces_and_outdent_removes_only_leading_whitespace() {
+    let mut content = Buffer::with_text("  雨🚀\r\nnext");
+    content.move_to(Cursor {
+        position: at(0, "  雨".len()),
+        selection: None,
+    });
+    apply(&mut content, false);
+    assert_eq!(content.text(), "  雨    🚀\r\nnext");
+    assert_eq!(content.cursor().position, at(0, "  雨    ".len()));
+    apply(&mut content, true);
+    assert_eq!(content.text(), "雨    🚀\r\nnext");
+    assert_eq!(content.cursor().position, at(0, "雨    ".len()));
+    apply(&mut content, true);
+    assert_eq!(content.text(), "雨    🚀\r\nnext");
+}
+
+#[test]
+fn directional_blocks_preserve_unicode_endings_and_exclude_final_zero_column() {
+    let source = "雨\r\n🚀\nlast\r\n";
+    for reverse in [false, true] {
+        let mut content = Buffer::with_text(source);
+        let original = range(at(0, 0), at(2, 0), reverse);
+        content.move_to(original);
+        apply(&mut content, false);
+        assert_eq!(content.text(), "    雨\r\n    🚀\nlast\r\n");
+        assert_eq!(content.cursor(), range(at(0, 4), at(2, 0), reverse));
+        apply(&mut content, true);
+        assert_eq!(content.text(), source);
+        assert_eq!(content.cursor(), original);
+    }
+}
+
+#[test]
+fn outdent_handles_tabs_partial_spaces_and_clamps_endpoint_inside_removed_indent() {
+    for reverse in [false, true] {
+        let mut content = Buffer::with_text("\t雨\r\n  🚀\n    fin");
+        content.move_to(range(at(0, 0), at(2, 2), reverse));
+        apply(&mut content, true);
+        assert_eq!(content.text(), "雨\r\n🚀\nfin");
+        assert_eq!(content.cursor(), range(at(0, 0), at(2, 0), reverse));
+    }
+}
+
+#[test]
+fn word_and_line_selections_indent_effective_range_in_both_directions() {
+    for line_mode in [false, true] {
+        for reverse in [false, true] {
+            let mut content = Buffer::with_text("one alpha\r\ntwo beta\nthree gamma");
+            content.move_to(Cursor {
+                position: if reverse { at(2, 8) } else { at(0, 6) },
+                selection: None,
+            });
+            content.perform(if line_mode {
+                Action::SelectLine
+            } else {
+                Action::SelectWord
+            });
+            content.perform(Action::Select(if reverse {
+                Motion::DocumentStart
+            } else {
+                Motion::DocumentEnd
+            }));
+            let selected = content.selection().unwrap();
+            apply(&mut content, false);
+            assert_eq!(
+                content.text(),
+                "    one alpha\r\n    two beta\n    three gamma"
+            );
+            let cursor = content.cursor();
+            assert_eq!(
+                cursor.position.line < cursor.selection.unwrap().line,
+                reverse
+            );
+            apply(&mut content, true);
+            assert_eq!(content.text(), "one alpha\r\ntwo beta\nthree gamma");
+            assert_eq!(content.selection(), Some(selected));
+        }
+    }
+}
+
+#[test]
+fn no_op_outdent_preserves_semantic_word_selection_and_last_empty_line_is_excluded() {
+    let mut content = Buffer::with_text("alpha tail\r\n");
+    content.move_to(Cursor {
+        position: at(0, 2),
+        selection: None,
+    });
+    content.perform(Action::SelectWord);
+    let raw = content.cursor();
+    apply(&mut content, true);
+    assert_eq!(content.cursor(), raw);
+    assert_eq!(content.selection().as_deref(), Some("alpha"));
+    content.perform(Action::SelectAll);
+    apply(&mut content, false);
+    assert_eq!(content.text(), "    alpha tail\r\n");
+    assert_eq!(content.cursor().position, at(1, 0));
+}

crates/oa-desktop/src/source_navigation/selection.rs

@@ -1,10 +1,12 @@
-//! Effective selected-byte ranges for a committed departure from a source view.
+//! Effective selected-byte ranges for committed source departures and edits.
 //!
 //! Iced's `Cursor` omits cosmic-text's Word/Line selection kind. Saving its raw
 //! endpoints can therefore save an empty range for a visibly selected word/line.
-//! Capture only after navigation admission and destination validation succeed,
-//! immediately before replacing/leaving the live editor. Never use this to inspect
-//! pending queries, failed/no-op navigation, or restore focus to the same editor.
+//! Departure capture requires navigation admission and destination validation,
+//! immediately before replacing/leaving the live editor. Edit capture requires
+//! an admitted edit with a nonempty patch plan. Neither is a passive query:
+//! never use these to inspect pending queries, failed/no-op navigation, or restore
+//! focus to the same editor.
 use iced::advanced::{graphics, text};
 use iced::widget::text_editor::{Action, Content, Cursor, Motion, Position};
 
@@ -21,6 +23,23 @@ use iced::widget::text_editor::{Action, Content, Cursor, Motion, Position};
 /// selection joins editor lines with LF regardless of physical CRLF/LF endings.
 /// Only the selected text is temporarily copied; retained state is one Cursor.
 pub fn capture<R>(content: &mut Content<R>) -> Cursor
+where
+    R: text::Renderer<Editor = graphics::text::Editor>,
+{
+    effective_range(content)
+}
+
+/// Capture immediately before a committed indentation edit. Like departure,
+/// this converts Word/Line selections to their effective directional byte range.
+/// The caller restores the transformed range after editing the same Content.
+pub fn capture_for_edit<R>(content: &mut Content<R>) -> Cursor
+where
+    R: text::Renderer<Editor = graphics::text::Editor>,
+{
+    effective_range(content)
+}
+
+fn effective_range<R>(content: &mut Content<R>) -> Cursor
 where
     R: text::Renderer<Editor = graphics::text::Editor>,
 {

crates/oa-desktop/src/views.rs

@@ -1178,6 +1178,15 @@ pub(crate) fn source_binding(
     use crate::source_navigation::{SymbolEvent, query::Action};
     use iced::keyboard::{Key, key::Named};
     use widget::text_editor::{Binding, Status};
+    if matches!(press.status, Status::Focused { .. })
+        && press.key == Key::Named(Named::Tab)
+        && (press.modifiers.is_empty() || press.modifiers == iced::keyboard::Modifiers::SHIFT)
+    {
+        return Some(Binding::Custom(Message::SourceIndent(
+            context.clone(),
+            press.modifiers.shift(),
+        )));
+    }
     if matches!(press.status, Status::Focused { .. })
         && press.modifiers.is_empty()
         && press.key == Key::Named(Named::F2)

harness/DECISIONS.md

@@ -1,5 +1,64 @@
 # Architectural and product decisions
 
+## Private mixed syntax boundary — 2026-09-23
+
+Proceed with the [reviewed syntax-only slice](analysis-mixed-parser-review-20260923.md)
+on tested private source `10d7f334`, retaining current root `195ddbb` as an
+ordinary-compatibility reference. Direct comparison found the relevant ordinary
+syntax/include machinery equal or equivalent; whole-file drift chiefly concerns
+semantic/editor behavior. A full root merge is not a prerequisite for this
+private experiment, and neither whole language/updater file may replace the
+other during eventual integration.
+
+One opaque complete-bundle result borrows the actual original files and owns
+the shared budget, canonical file table, ordinary occurrence positions and typed
+unresolved syntax. It supplies no admitted Project, Index or edit authority.
+Explicit IDs are a staging restriction; missing IDs reject before generation.
+Retain duplicate syntax occurrences until semantic uniqueness is checked.
+Ordinary signed numbers require byte adjacency and complete value spans;
+typed subtraction retains its separate grammar. Bound aggregate syntax storage
+without silently reinterpreting caller model-record or ordered-step limits.
+Propagate phase-check failures even where the Budget does not latch them.
+
+The [proposal](analysis-mixed-parser-proposal-20260923.md) and review define the
+independent fixtures and rejected shortcuts. Same-pass unresolved syntax is a
+dependency of later mixed resolution/index/composition, not public source8
+activation or a substitute for whole-output admission. Source implementation,
+fresh review and runtime checks remain required.
+
+## Private source composition decision — 2026-09-23
+
+Adopt the opaque validated original-span rename batch as the next private
+analysis adapter step, with the [independent review's clarifications](analysis-original-span-review-20260923.md).
+The [original proposal](analysis-original-span-proposal-20260922.md) compares
+this against replacing both ordinary and typed edit representations. The narrow
+adapter preserves current ordinary compatibility and reduces migration risk;
+a shared edit AST remains a candidate if structural composition demonstrates a
+need. Neither sequentially applying producers with stale offsets nor canonical
+rewriting is acceptable for authored-source preservation.
+
+The immediate patch exports complete borrowed rename records and splits
+ownership validation from standalone final-output size preflight. It may defer
+only hypothetical typed-only output sizing; active inherited budget, plan/name
+storage, qualified namespace, source equality and complete occurrence checks
+remain mandatory. Standalone rename/apply semantics remain intact. This is
+private staging, not a complete parse-session or public source8 boundary.
+
+Before production composition, one checked parsed-bundle witness must bind the
+complete source/entry/file map, ordinary model, typed index, profile and complete
+target intent. Ordinary syntax-kind replacement currently emits same-start
+insertion/deletion pairs; explicitly normalize such owned operations with exact
+trivia oracles before admitting them, keeping cross-producer collisions errors.
+Gate supported changes by a precise complete-model diff. Compile the actual
+emitted full bundle, use normal admission, and compare the complete intended
+Project before installation. Exact untouched bytes are an independent gate.
+Subtree edits, parameter lifecycle, repaired deletion, reidentity, relocation,
+missing-ID stabilization, migration/history and checked-save remain required
+delivery work; passing the private rename slice cannot close those requirements.
+
+The source-pinned proposal/review retain their original local provenance labels.
+The accepted underlying repair contract is [r2 at analysis source 1b1c3e3](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/src/commit/1b1c3e3abb6fc3d0934c9dbfbd21fddc8ae4f594/harness/analysis-source8-20260913/analysis-source8-repair-design-r2-20260913.md).
+
 ## Current continuation decisions — 2026-09-06
 
 - Saving under another source entry basename is destination bookkeeping, not an engineering edit. Adopt an exact current save receipt without adding Undo or clearing Redo; rebase uniform entry names across retained history after collision and compilation checks. Stale receipts cannot redirect newer raw source. Native discovery and eleven focused regression results are in release-save-as-runtime-packaging.md; updated native verification remains required.
@@ -456,3 +515,51 @@ Missing global and scoped parameter IDs remain explicit stabilization metadata,
 not new random identities assigned on each parse. Public source8 integration must
 thread the same accounting through the outer project and included files; this
 private checkpoint does not itself admit a complete version8 source bundle.
+
+## Complete mixed Project before typed editing index — 2026-09-23
+
+Choose the [private Project-first contract](analysis-mixed-project-contract-20260923.md)
+as the next semantic dependency, conditional on acceptance of its frozen syntax
+prerequisite. Reuse ordinary construction and typed lowering once, then check the
+complete Project and retain original syntax, the global lowering-site arena and
+its file ownership for later indexing. Including the typed index now would also
+change source-view/updater compatibility and several simultaneous allocation
+phases, while still leaving ordinary occurrence editing incomplete. This split
+preserves a concrete no-rescan/no-relower continuation and isolates model
+correctness from later edit authority; it does not narrow the required parity goal.
+
+The [independent critique](reviews/mixed-project-contract-20260923.md) requires a
+full hand-authored retained-site oracle and a single admission result preserving
+static usage and every warning. Existing raw architectural diagnostic production
+is explicitly outside preallocation accounting; new mapped/retained storage must
+be reserved before copying or retention. Revisit the split if actual ownership
+work shows sites cannot be retained without duplicated models or repeated parsing.
+Public source8, mixed editing, checked-save and root reconciliation remain later
+dependencies, not capabilities delivered by this design decision.
+
+## 2026-09-24 — preserve mixed bundle authority through index construction
+
+Adopt the [mixed typed-index contract](analysis-mixed-index-contract-20260924.md):
+consume the sealed complete-Project witness into a distinct read-only owner and
+reuse private structural/token verification, with aggregate retained-ledger
+accounting. A copied verifier would duplicate correction work; reparsing into
+the old numeric-source Index would discard bundle/profile authority. The
+[independent review](analysis-mixed-index-review-20260924.md) resolved storage
+domain and completeness-proof ambiguities before adoption. This is a bounded
+implementation decision, not runtime acceptance or full editing parity. Revisit
+if a concrete verifier invariant prevents reuse or multiple retained owners
+become necessary; no generic public indexing framework is justified now.
+
+## 2026-09-24 — index ordinary authored names before rename composition
+
+Adopt the [ordinary occurrence successor](analysis-ordinary-index-contract-20260924.md)
+after source mapping and independent critique. Retain the accepted typed owner
+and add a physical-token-keyed ordinary map from sealed original positions.
+This isolates complete coverage/ownership from later edit intent and avoids a
+new structural path arena or parser. A fused streaming rename planner could
+save map storage, but would combine two unverified boundaries; revisit after
+coverage is established and a real consumer demonstrates the benefit.
+The contract explicitly handles synthetic brace-containing roots, complete
+reference extents and the existing ordinary depth policy. It grants read-only
+name-occurrence authority only. Rename composition and complete editing parity
+remain separate required capabilities.

harness/STATE.md

@@ -1,20 +1,97 @@
-# Verified branch checkpoint — 2026-09-13 UTC
+# Verified branch checkpoint — 2026-09-24 UTC
 
 This describes Codex-956atf's contribution, not a combined release.
 [PROJECT_GOAL.md](../PROJECT_GOAL.md) remains authoritative. The complete OA/SA
 application is unfinished; published previews and finite prototypes are intermediate.
 
-**Linux/WSL builds and checks remain deferred until the user explicitly reports
-networking resolved.** No guest setup, diagnosis, restart or cache transfer is
-active. The VPN remains untouched.
+**The current prerelease is Windows-only. Linux/WSL builds and checks remain
+excluded by the user's explicit request, including after networking recovers.**
+
+The separately assembled Windows source is
+**715036e132677dd2bc2fb37ed316d93dc9987aec** on
+`codex/prerelease-integrated-956atf-20260924`. Its
+[source handoff](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/src/commit/715036e132677dd2bc2fb37ed316d93dc9987aec/harness/prerelease-integrated-source-20260924.md)
+identifies the integrated contributions, reviewed event correction and exact
+test paths. Combined runtime/package acceptance is separate from the
+contribution-specific evidence below. [Issue37](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/37)
+owns current build and release coordination.
+The Route helper qualification and Allocation Text Apply test import corrections
+are included; both earlier compile failures occurred before tests ran. The candidate's 66 package
+documents/examples pass [closure and source-identity verification](reviews/prerelease37-windows-documents-20260924.md).
+The separate e68a839 Route contribution's raw test/lint evidence passed an
+[independent evidence review](reviews/prerelease37-route-evidence-20260924.md);
+its results do not establish combined-candidate execution.
+The full Windows test run at `8ddfadf4` failed a State picker fixture whose
+canvas-relative coordinates hit the added selection toolbar. The current
+source includes peer `a9cd364e`'s measured picker slot and capture assertion;
+the [independent source review](reviews/prerelease37-state-picker-20260924.md)
+retains its bounded assumptions. [Reviewed targeted evidence](reviews/prerelease37-state-picker-evidence-20260924.md)
+at `a9cd364e` passes formatting and all26 State tests, including the original
+failure. The corrected combined [test-evidence review](reviews/prerelease37-final04-tests-20260924.md)
+at `715036e` verifies 2,200 passed, eight ignored and zero failed across all
+2,208 names in 61 native harnesses, including all 29 required cases. The
+[complete gate review](reviews/prerelease37-final04-complete-20260924.md) verifies
+all 3,709 inputs against immutable Git bytes, strict workspace Clippy and the
+individual Studio/server builds. The supplemental combined build also passes;
+its differing artifacts are not the selected package inputs. Packaged acceptance
+remains separate. The [downloaded package](reviews/prerelease37-downloaded-package-20260924.md)
+passes exact archive/product/document checks. [Server evidence](reviews/prerelease37-package-server-20260924.md)
+verifies 16 requests and exact model/source/revision/ETag persistence across an
+owned forced restart; the initial legacy-schema fixture expectation failure is
+preserved. Packaged GUI and separate-machine QA remain distinct from these checks.
 
 ## Current integrated candidate and evidence
 
 Branch `codex/behavior-authoring-20260910`, published as `codex/release1-956atf`.
-Current source **c28abcf13a834585a9954f7e54175d47c0a0460b** adds Find focus and
-departure-selection corrections. Combined execution and native acceptance are
-not yet established; [integration issue27](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/27)
-holds current verification and release coordination.
+Integrated code checkpoint **4ffff0d9d94bd1875e6b316b84ac11e5c5c9657c** combines
+the reviewed ordinary/Text contribution **3f9e6a18af96b5cd10940da4093be8da28b9c835**
+with source-editor Tab/Shift+Tab indentation. Windows desktop verification passes
+1,188 tests with six existing ignores; all 1,194 names and nine targeted
+indentation cases are accounted for. Strict desktop Clippy and matching GUI
+build pass on 711 unchanged inputs. The closed native trials cover caret and
+forward/reverse block indentation, text undo/redo, empty drafts, continued caret
+typing and Apply/Save/reopen. The saved 577 bytes exactly preserve the baseline's
+mixed line endings and Unicode while indenting its 13 physical lines. The first
+trial restored the baseline and is not a save oracle. Find's Tab does not advance
+focus; this inherited limitation is distinct from the verified editor boundary.
+This is Windows contribution acceptance, not complete editor accessibility,
+public source8, a combined peer union, or a packaged release.
+[Exact gates, original native captures and independent review](experiments/text-indentation-4ffff0d-20260923/README.md)
+retain both the failed initial compilation and the interrupted first trial.
+
+Earlier code checkpoint **8abc144cf233c64e43c6bee5033c22ee818e2d14** preserves
+the production inputs of **feab2020d8e5b6bfdb59c86ab4aee161617b8b6f**. Its Windows
+desktop suite passes 1,096 tests with three existing manual ignores; all 1,099
+names are admitted. Targeted navigation/rename checks, strict desktop Clippy and
+the matching development GUI build pass. The closed native trial verifies
+Details-to-Preview scroll restoration, explicit reset boundaries, and exact
+six-file preservation after Cancel and Save. The
+[portable evidence](experiments/rename-scroll-feab202-20260913/README.md), published
+at **f95d0310482565e91220a97e13fc756f27f9d590**, retains the initial failing test,
+20 original frames and independent review. Its committed bytes and verifier were
+rechecked on September 22. This narrow trial does not establish Text integration,
+complete rename acceptance or release readiness.
+
+Earlier production source follows; each result retains its original code scope.
+Verified production source **44095f78c28b79d6d085863dc928adba8e24d955** includes
+Find focus, departure-selection and scoped Escape corrections. Its Windows
+desktop suite passes1095 with3 existing manual ignores; core passes471 with1
+manual ignore; server passes56. All three strict Clippy scopes and the matching
+development GUI/server build pass. [Exact source, commands and raw evidence](release-navigation-440-windows-20260913.md).
+The integrated documentation checkpoint **3c22fe2629fc242714d32805790262fa2c4e33b9**
+preserves those production inputs and includes the updated AGENTS instructions.
+
+The actual440 native trial closed normally with79 notes,78 images and14 complete
+saved-model/source comparisons. Rename/Undo/Redo/reopen, scoped selection,
+placement/state targeting and sampled OA/SA lifecycle/topology navigation are
+verified within the [closed trial's explicit scope](experiments/navigation-native-440-20260913/REPORT.md).
+It found a same-page Details-to-Preview scroll-loss defect; initial keyboard
+Delete after chooser navigation also required an explicit canvas click. Neither
+is hidden by passing saved-byte checks. The scroll defect is corrected and
+verified by the separate feab trial above; the initial chooser-to-canvas keyboard
+focus friction remains a limitation of the 440 trial. This remains a development
+checkpoint, not a combined release. [Integration issue27](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/27)
+owns current verification, correction and release coordination.
 Earlier source **e1240295bd114d23d3f67a69e6b38bdb2e25bb0d** combines the canvas
 contribution with source/diagram navigation and reviewed alias rename. Its1082-test
 listing,17 cross-feature tests,4 mounted preview-scroll tests and strict all-target
@@ -70,16 +147,121 @@ failures and corrections. Earlier authoring and allocation checkpoints remain in
 
 ## Isolated contributions and material limitations
 
-Analysis/core source checkpoint **b2c970b4673e062e47eadd12906d2316c4b1a7b3**,
+Combined peer candidate **e34ba27e26ede3ab55f276acc250d92b2e0c3204**, published on
+`codex/peer-union-956atf-20260923`, composes current Text/Tab with saved Scenario,
+final inspector actions, attachments, State bends and the transition footer.
+The literal Windows workspace suite passes 2,005 tests with zero failures and
+eight named ignores; all 2,013 listed names across 60 executables and three
+doctest sections are accounted for. Strict workspace/all-target Clippy and the
+matching native/external-oracle builds pass on 760 unchanged inputs. The
+[portable gate evidence](experiments/peer-union-e34-windows-20260923/README.md)
+binds three rebuilt executables through fresh listings and preserves the failed
+historical f82 desktop run (1,337 passed, three failed, seven ignored), the
+missing-DLL listing attempt, and capture limitations. Its verifier passes the
+positive case and rejects all 12 semantic mutations. The preceding
+[partial gate archive](experiments/peer-union-windows-20260923/README.md) retains
+earlier Scenario and lint failures. The separate
+[native checkpoint](experiments/peer-union-e34-native-20260924/README.md) records
+33 successful whole-model/source checkpoints, the retained failed G2 pointer
+attempt and its recovery, and five transition checks through fresh reopen and
+unchanged reapply. The first trace identity and all resulting source-bundle bytes
+remain exact. Independent review checks 245 frame pins and inspects 38 keyframes;
+17 transition-oracle controls meet their expected outcomes. The original
+interrupted process and later normal-close observations remain distinct. Dirty
+middle-button pan, held-drag Escape and short-window Scenario Apply are unobserved.
+Public format and release acceptance remain incomplete; accepted root production
+remains4ffff0d. The newer prerelease candidate and live coordination are in
+[issue37](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/37).
+
+Analysis/core source checkpoint **a2a28f8d23a46ba1696b6a8410d4d3b5c1808f49**,
 publication branch `codex/analysis-core-956atf-20260911`, is not integrated into
-production. It adds source-save decode/equality containment and a private staged
-expression/declaration parser, then repairs the frozen source3 lowering envelope.
-Its129-test library run has113 passes and16 failures, all at the unsupported
-source8 header. All22 expression/declaration/token cases and8 bridge/save guards
-pass; strict all-target Clippy passes on524 unchanged inputs. The separate language
-integration target has7 passes and9 failures:8 unsupported headers and an old V2
-oracle that omits the new empty definitions catalog. [Exact S2a evidence](release-analysis-source-s2a-20260913.md)
-preserves every failure and the independent structural comparison.
+production. Its private staged typed parser/lowerer has142 listed tests,
+34 passing typed cases,1 passing raw-token case and strict all-target core Clippy
+on531 unchanged inputs. The complete library run remains126 passed/16 failed,
+with all16 failures at the unsupported public source8 header. The original
+fixture error and its test-only correction remain in [exact S2b evidence](release-analysis-source-s2b-20260913.md).
+Published private writer **f1d79df4979121335ed7b4ce4da84b2fca8a9ef4** has
+[portable S2c evidence](experiments/analysis-source-s2c-windows-20260913/README.md):
+152 listed, 44 typed and one token test passed, strict Clippy passed; the full
+library result remains 136 passed / 16 failed at unsupported public source8.
+Published source **1b1c3e3abb6fc3d0934c9dbfbd21fddc8ae4f594** adds a private
+qualified source index/rename plan and the independently reviewed cleanup for
+the demonstrated depth129 rejected-tree stack overflow. Its
+[S3 evidence](experiments/analysis-source-s3-windows-20260922/README.md), published
+at **345a42e4658f6e0e8e01ef64a2df8f4e28a8945a**, records 167 listed tests,
+59 typed passes (nine index/five update), one token pass, three clean stack
+controls and strict Clippy on 538 unchanged inputs. The original overflow and
+dirty diagnostic/probe results are retained. No current full-core pass is
+claimed. Public source8 parser, writer, source-update and persistence composition
+remain incomplete; these branches are not integrated production analysis.
+
+Published private source **10d7f3340d5cd61a656dc0bcf7c143f8897c5551** adds
+complete borrowed original-span export for later edit composition. Its
+[Windows evidence](experiments/analysis-original-span-20260923/README.md) records
+173 listed tests (all prior 167 retained), 65 typed passes including all 11
+updater cases, and strict core all-target Clippy on the same 538 committed
+inputs. Review caught and corrected an intermediate standalone budget
+regression. This is an isolated export adapter; the later syntax checkpoint
+below supplies mixed-bundle ownership, while output compilation and public
+source8 remain incomplete.
+
+Published private mixed-syntax source
+**a578ac98a06772a60bec00ae287e65650680d119** retains the complete source bundle,
+original positions and exact caller policy, using shared ordinary/typed token
+consumption with explicit identities and aggregate file/byte admission. Its
+[Windows evidence](experiments/analysis-mixed-syntax-20260923/README.md) records
+194 listed tests, all prior 173 retained, 20 focused mixed passes and 85 typed
+passes within the actual full result: **178 passed / 16 failed**. All 152
+historical statuses are unchanged and all 42 later tests pass. Strict core
+all-target Clippy passes on 541 unchanged committed inputs. Formatting remains
+failed in six inherited, unchanged files. Original failed gates and the host
+clock discontinuity are retained; a fresh actual direct listing binds the final
+focused/full executable after Cargo rebuilt it. This syntax witness does not
+resolve or admit a complete mixed Project, activate public source8 or implement
+editing composition. The accepted
+[complete-Project contract](analysis-mixed-project-contract-20260923.md) defines
+the semantic boundary implemented by the separate private checkpoint below.
+
+Published private complete-Project source
+**aaec78fcc9b273d1485497126392afdd1fb2e54e** retains the original syntax, bundle,
+budgets and limits while resolving/admitting the complete ordinary/typed model.
+The next [mixed typed-index contract](analysis-mixed-index-contract-20260924.md)
+is accepted after source review and resolved accounting/completeness findings.
+Private typed-index source **93eb6117f95353d25d594d59780018f197c51672** implements
+the consumed witness and shared verifier. Its
+[Windows evidence and independent oracle review](experiments/analysis-mixed-index-20260924/README.md)
+verify strict core Clippy, all seven new cases and the complete 216-name inventory
+on 545 unchanged inputs. Full library remains **200 passed / 16 failed**,
+preserving all 209 baseline statuses; formatting still has the identical eight
+inherited blocks. Original lint and depth-expectation test failures are preserved.
+The [source review](analysis-mixed-index-20260924/source-review.md) records three
+repaired diagnostic findings; its reviewed production hashes are unchanged.
+The new owner keeps legacy updater authority separate. Ordinary occurrence
+indexing, complete mixed editing and public source8 remain required.
+The [ordinary occurrence successor contract](analysis-ordinary-index-contract-20260924.md)
+uses retained parser positions and physical token keys, with a separate consumed
+read-only owner; it is an accepted design, not an implemented capability.
+The preceding Project [Windows evidence](experiments/analysis-mixed-project-20260924/README.md)
+distinguishes runtime source **71cadfa0cd0e112caa29588d2494753301f3cb6c** from
+the formatting-only aaec successor. Strict core all-target Clippy, actual listing
+209, Project 13/13, shared validation 2/2 and four exact public compatibility
+cases pass on 544 unchanged inputs. Full lib remains **193 passed / 16 failed**,
+preserving all prior statuses and exact unsupported-public-source8 diagnostics.
+Successor formatting remains failed on eight inherited blocks in five unchanged
+files; no aaec runtime rerun is claimed. The parent-reviewed portable verifier
+and all 15 finite controls pass, with independent raw-output/pin readback.
+This private source is not integrated into the application prerelease. Public
+source8, complete mixed indexing/edit composition, checked output and UI parity remain
+unfinished.
+
+The [reviewed S1/S7 assessment](issue28-s1-s7-assessment-956atf-20260923.md)
+distinguishes static analysis/case overlays from contextual inheritance,
+fixed/default bindings and executable trade studies with durable result
+provenance. Strengthened fixture and parity criteria remain proposals, not
+implemented evaluation or a replacement metamodel decision.
+Earlier [S2a evidence](release-analysis-source-s2a-20260913.md) retains its
+129-test113/16 library result and separate7/9 language integration result,
+including the old V2 oracle that omitted the empty definitions catalog.
 [Earlier bridge evidence](release-analysis-source3-bridge-20260913.md) remains scoped
 to6216cff.
 The earlier2c515cf full library run had98 passes and16 failures:14 rejected the

harness/analysis-mixed-index-20260924/ORACLE.md

@@ -0,0 +1,116 @@
+# Exhaustive authored mixed typed-index oracle
+
+2026-09-24. Independent source/data derivation for private source `aaec78fcc9b273d1485497126392afdd1fb2e54e`. Reuse fixture and independent model construction in `crates/oa-core/src/language/analysis_source/mixed/project/tests.rs:254–330`, `expected` at line 52, and the explicit site oracle at lines 331–538. No Index, lowerer, formatter, parser or compiler executed to produce expectations. Numeric spans below were checked using direct unique substring locations in independently reconstructed literal source; all original fixture bytes are ASCII/LF. This is suggested test data, not a passing-test report.
+
+## Fixture identity and file binding
+
+Use the existing `id(n)` helper (line 9): it formats n as twelve decimal digits inside a UUID then parses that UUID. **Do not substitute `Id::from_u128(n)`**: for n=10 the fixture suffix is `000000000010`, not `00000000000a`.
+
+Retain entry `main.arcadia`; canonical numeric files are 0=`a.arcadia` (213 bytes), 1=`b.arcadia` (213 bytes), 2=`main.arcadia` (474 bytes), aggregate 900 original bytes. Include spelling/order in main is b then a; numeric file order is canonical a then b. File 0 has calculation f/id(10), file 1 g/id(11); both declare parameter x/id(1), y/id(12). Parameter x UUID also equals the Project's global id(1).
+
+Main's ordinary node n points forward to typed property v; property v's subject points forward to ordinary activity w. Its base is exactly `@f(y: 2, x: @g(x: 3, y: 4)) + @f(x: 5, y: 6)`. Typed declarations begin after the Project header, includes and ordinary node. Reuse the existing independently built full Project, including the diagram/node defaults and both calculation bodies; do not replace full equality with an index-only projection.
+
+Notation: `G(n)` = `Target::Global(id(n))`; `Q(c,p)` = `Target::Parameter { calculation: id(c), parameter: ParameterId(id(p)) }`. Paths are complete **root-to-leaf** `Child` sequences: L=Left, R=Right, A1=Argument(ParameterId(id(1))), A12=Argument(ParameterId(id(12))). `[]` is a real empty expression-root path. `—` means `None`, not `Some(empty)`. All spans are half-open full-original-file byte spans.
+
+## Entire expected names catalog (G=11)
+
+| Qualified target | Name | Original declaration anchor |
+|---|---|---|
+| G(1) | p | main: `project p` |
+| G(2) | w | main: `oa_activity w` |
+| G(3) | v | main: `oa_property v` |
+| G(4) | n | main: `node n` |
+| G(5) | d | main: `diagram d` |
+| G(10) | f | a: `calculation f` |
+| G(11) | g | b: `calculation g` |
+| Q(10,1) | x | a: `input x` |
+| Q(10,12) | y | a: `input y` |
+| Q(11,1) | x | b: `input x` |
+| Q(11,12) | y | b: `input y` |
+
+Global p/w/n/d names are required even though this typed index must contain **no ordinary declaration/reference occurrences** for them. There are 7 global names plus 4 scoped names; every name is one UTF-8 byte.
+
+## Entire expected expression map (E=15)
+
+Each row is `(ExpressionKey { owner, field, path }, Location { file, span })`. E labels are explanatory, not persisted arena positions or part of key identity. The order below matches the authored lower-site oracle only for ease of comparison; compare a complete map/set of keys rather than relying on BTree ordering of Path.
+
+| Row | File | Owner | Field | Path | Span | Exact source slice / unique anchor |
+|---|---:|---:|---|---|---|---|
+| E0 | 0 | 10 | Body | [] | 202..209 | `$x + $y` |
+| E1 | 0 | 10 | Body | [L] | 202..204 | `$x` |
+| E2 | 0 | 10 | Body | [R] | 207..209 | `$y` |
+| E3 | 1 | 11 | Body | [] | 202..209 | `$x - $y` |
+| E4 | 1 | 11 | Body | [L] | 202..204 | `$x` |
+| E5 | 1 | 11 | Body | [R] | 207..209 | `$y` |
+| E6 | 2 | 3 | Base | [] | 290..334 | `@f(y: 2, x: @g(x: 3, y: 4)) + @f(x: 5, y: 6)` |
+| E7 | 2 | 3 | Base | [L] | 290..317 | `@f(y: 2, x: @g(x: 3, y: 4))` |
+| E8 | 2 | 3 | Base | [L,A12] | 296..297 | `y: 2`, offset 3, length 1 |
+| E9 | 2 | 3 | Base | [L,A1] | 302..316 | `@g(x: 3, y: 4)` |
+| E10 | 2 | 3 | Base | [L,A1,A1] | 308..309 | `x: 3`, offset 3, length 1 |
+| E11 | 2 | 3 | Base | [L,A1,A12] | 314..315 | `y: 4`, offset 3, length 1 |
+| E12 | 2 | 3 | Base | [R] | 320..334 | `@f(x: 5, y: 6)` |
+| E13 | 2 | 3 | Base | [R,A1] | 326..327 | `x: 5`, offset 3, length 1 |
+| E14 | 2 | 3 | Base | [R,A12] | 332..333 | `y: 6`, offset 3, length 1 |
+
+There are 3 roots and 12 nonroot sites, hence **P=12 distinct allocated shared Path Steps** under one-Step-per-child construction. Maximum expression depth including root is 4. Same spans 202..209 and parameter token positions in a/b are deliberately different owners/files.
+
+## Entire expected occurrence map (H+O=21)
+
+Each row spells every `OccurrenceKey` field: owner, optional field, optional path, token role and qualified target, plus physical file/span. `Decl` means `TokenRole::Declaration`; every other role below means `TokenRole::Use(lower::Role::<name>)`. Input1/Input12 mean `Field::Input(ParameterId(id(1/12)))`. Every token length is 1, with @/$ excluded.
+
+| Row | File | Owner | Field | Path | Role | Target | Span | Exact spelling / independent source anchor |
+|---|---:|---:|---|---|---|---|---|---|
+| H0 | 0 | 10 | — | — | Decl | G(10) | 12..13 | f; `calculation f`, +12 |
+| H1 | 1 | 11 | — | — | Decl | G(11) | 12..13 | g; `calculation g`, +12 |
+| H2 | 2 | 3 | — | — | Decl | G(3) | 206..207 | v; `oa_property v`, +12 |
+| O0 | 0 | 10 | Input1 | — | ParameterDeclaration | Q(10,1) | 68..69 | x; `input x`, +6 |
+| O1 | 0 | 10 | Input12 | — | ParameterDeclaration | Q(10,12) | 128..129 | y; `input y`, +6 |
+| O2 | 0 | 10 | Body | [L] | ParameterUse | Q(10,1) | 203..204 | x; `$x`, +1 |
+| O3 | 0 | 10 | Body | [R] | ParameterUse | Q(10,12) | 208..209 | y; `$y`, +1 |
+| O4 | 1 | 11 | Input1 | — | ParameterDeclaration | Q(11,1) | 68..69 | x; `input x`, +6 |
+| O5 | 1 | 11 | Input12 | — | ParameterDeclaration | Q(11,12) | 128..129 | y; `input y`, +6 |
+| O6 | 1 | 11 | Body | [L] | ParameterUse | Q(11,1) | 203..204 | x; `$x`, +1 |
+| O7 | 1 | 11 | Body | [R] | ParameterUse | Q(11,12) | 208..209 | y; `$y`, +1 |
+| O8 | 2 | 3 | Subject | — | Reference | G(2) | 269..270 | w; `subject @w`, +9 |
+| O9 | 2 | 3 | Base | [L] | CallTarget | G(10) | 291..292 | f; `@f(y:`, +1 |
+| O10 | 2 | 3 | Base | [L] | ArgumentLabel | Q(10,12) | 293..294 | y; `y: 2`, +0 |
+| O11 | 2 | 3 | Base | [L] | ArgumentLabel | Q(10,1) | 299..300 | x; `x: @g`, +0 |
+| O12 | 2 | 3 | Base | [L,A1] | CallTarget | G(11) | 303..304 | g; `@g(x:`, +1 |
+| O13 | 2 | 3 | Base | [L,A1] | ArgumentLabel | Q(11,1) | 305..306 | x; `x: 3`, +0 |
+| O14 | 2 | 3 | Base | [L,A1] | ArgumentLabel | Q(11,12) | 311..312 | y; `y: 4`, +0 |
+| O15 | 2 | 3 | Base | [R] | CallTarget | G(10) | 321..322 | f; `@f(x: 5`, +1 |
+| O16 | 2 | 3 | Base | [R] | ArgumentLabel | Q(10,1) | 323..324 | x; `x: 5`, +0 |
+| O17 | 2 | 3 | Base | [R] | ArgumentLabel | Q(10,12) | 329..330 | y; `y: 6`, +0 |
+
+Totals: H=3 typed global headers. O=18 lower occurrences: 4 parameter declarations, 4 parameter uses, 1 subject reference, 3 call targets, 6 labels. Header occurrences are produced by indexing and are absent from the retained lower O vector. Repeated f labels have different full paths; nested g labels differ by both path and calculation scope. Ordinary node's `element @v` remains absent from this typed occurrence map.
+
+For executable expected records, reuse the existing unique-anchor `span(source, context, offset, len)` helper at line 156; assert the numeric values above for the unmodified fixture. Build expected paths from these literal Child arrays, not by following `resolved.expressions.parent` or enumerating actual Index keys. Construct expected keys/targets explicitly from this table. Exhaustive equality must compare all 11 names, all 15 expressions, all 21 occurrences, and the entire independent Project.
+
+## Exact added retained storage and scratch anchors
+
+Under accepted contract dimensions and current three-map/shared-Step design:
+
+| New retained representation | Entry slots | Occurrence slots | Owned text bytes |
+|---|---:|---:|---:|
+| Qualified names | 11 | 0 | 11 |
+| Occurrence map | 21 | 0 | 0 |
+| Expression map | 15 | 0 | 0 |
+| Unique Path Steps | 12 | 0 | 0 |
+| **Added retained total** | **59** | **0** | **11** |
+
+Thus final Ledger is exactly the incoming accepted-witness Ledger plus `(entries:59, occurrences:0, text:11)` if no additional retained representation is introduced. The baseline retains the raw 15 expression-site entry slots and 18 occurrence slots; neither is released merely because indexed versions now exist. Original source bytes 900 are borrowed and are not added again to text storage.
+
+Known scratch sizes are owner map 3, physical-token set 21, path lookup Vec 15, call map 3, reverse-name maps 11, syntax-site lookup 15. The original all-roots-first LIFO syntax traversal's peak work Vec has 5 elements (root main pops, right call contributes x/y while a/b roots and left call remain). This 5 is specific to the present traversal order, not a requirement to preserve that order. A final retained delta is fixed; a whole-construction cap must separately account for the chosen scratch lifetime/ordering and for any earlier resolution peak. Do not claim `baseline.entries+59` is a sufficient construction cap while scratch is alive. With all original scratch still alive at syntax-walk peak, scratch is 3+21+15+3+11+15+5=73; explicit earlier releases can reduce this overlap. Any implementation reserving conservative bounds should state the difference instead of weakening exact semantic oracles.
+
+## Corruption that must reach the call-site check
+
+Before Index construction, mutate only O11 (main 299..300, owner3, Base, expression site7 / path[L]) from target `Q(10,1)` to `Q(11,1)`. Keep source, tokens, owner, field, expression and span unchanged.
+
+This is deliberately not an unknown-target or spelling error: both calculations have x/id(1); both qualified target names are `x`. The token is the same full Word inside its expression/owner. The changed key does not collide with nested g's label because that label has path[L,A1], and physical ownership remains unique. ArgumentLabel role accepts a scoped target with a path. The call at path[L] still targets G(10), so `index.rs:438–448` must reject with `Argument label crosses its called calculation.` at span299..300. Assert this diagnostic, not merely any error. Repeating with O10's y Q(10,12)->Q(11,12) is equivalent but unnecessary duplication.
+
+A distinct runtime omission negative removes O11 while leaving its argument child E9: the qualified-label check (`index.rs:455–469`) must reject `Argument child has no qualified label.` at E9 span302..316. By contrast removing O0 or O8 is an exhaustive-output-oracle failure, not a promised current runtime rejection.
+
+## Optional direct extensions without changing oracle provenance
+
+- **SA:** apply the same rich additions to `bundle(Layer::Sa)` and construct model from `expected(Layer::Sa)`. Its system s/id(6) adds one global name. H/O/E/P and all expression/token spans through main's base remain the same because `sa_property` and `oa_property` have equal length and the system/diagram-layer differences occur later. G=12, new retained entries=60, name bytes=12. Assert the system in the complete Project and catalog; it contributes no typed occurrence.
+- **Unicode/CRLF:** independently prefix each file with `// 雨\r\n` (8 UTF-8 bytes) and replace each original LF with CRLF. For any original endpoint b in these ASCII files, the transformed byte endpoint is `8 + b + count(original[..b] == LF)`. This raw-byte transformation is independent of parsing/indexing and applies separately to start/end. Or use the same unique literal anchors against transformed sources; Rust string find returns byte offsets. Keep exact original bundle comparison. Do not carry the ASCII numeric offsets unchanged into this variant.

harness/analysis-mixed-index-20260924/check_oracle_bytes.py

@@ -0,0 +1,51 @@
+"""Parent raw-byte check of independently authored fixture/index expectations."""
+from pathlib import Path
+import json
+import re
+
+def ident(n):
+    return f'00000000-0000-0000-0000-{n:012}'
+
+body = (f'node n id "{ident(4)}" {{ diagram @d; element @v; }}\n'
+        f'oa_property v "Value" id "{ident(3)}" {{ subject @w; type Number; base 1; }}\n'
+        f'oa_activity w "Work" id "{ident(2)}" {{}}\n'
+        f'diagram d "Diagram" id "{ident(5)}" {{  }}\n')
+main = f'arcadia 8;\nproject p "Project" id "{ident(1)}" {{\n{body}\n}}\n'
+main = main.replace('base 1;', 'base @f(y: 2, x: @g(x: 3, y: 4)) + @f(x: 5, y: 6);')
+main = main.replace('node n', 'include "b.arcadia"; include "a.arcadia";\nnode n')
+files = []
+for alias, name, n, op in [('f', 'F', 10, '+'), ('g', 'G', 11, '-')]:
+    files.append((f'calculation {alias} "{name}" id "{ident(n)}" {{\n'
+                  f'input x id "{ident(1)}" : Number;\n'
+                  f'input y id "{ident(12)}" : Number;\n'
+                  f'result Number; body $x {op} $y;\n}}\n').encode())
+files.append(main.encode())
+assert list(map(len, files)) == [213, 213, 474]
+oracle = Path(__file__).with_name('ORACLE.md').read_text(encoding='utf-8')
+rows = [line.split('|')[1:-1] for line in oracle.splitlines() if re.match(r'\| (E|H|O)\d+ \|', line)]
+expressions = [r for r in rows if r[0].strip().startswith('E')]
+occurrences = [r for r in rows if not r[0].strip().startswith('E')]
+expected_expressions = ['$x + $y', '$x', '$y', '$x - $y', '$x', '$y',
+    '@f(y: 2, x: @g(x: 3, y: 4)) + @f(x: 5, y: 6)',
+    '@f(y: 2, x: @g(x: 3, y: 4))', '2', '@g(x: 3, y: 4)', '3', '4',
+    '@f(x: 5, y: 6)', '5', '6']
+expected_occurrences = ['f', 'g', 'v', 'x', 'y', 'x', 'y', 'x', 'y', 'x', 'y',
+                        'w', 'f', 'y', 'x', 'g', 'x', 'y', 'f', 'x', 'y']
+assert len(expressions) == 15 and len(occurrences) == 21
+checks = []
+for group, expected, span_column in [(expressions, expected_expressions, 5),
+                                      (occurrences, expected_occurrences, 7)]:
+    for row, value in zip(group, expected, strict=True):
+        name, file = row[0].strip(), int(row[1])
+        start, end = map(int, row[span_column].strip().split('..'))
+        assert files[file][start:end] == value.encode(), (name, files[file][start:end], value)
+        transformed = b'// \xe9\x9b\xa8\r\n' + files[file].replace(b'\n', b'\r\n')
+        shifted_start = 8 + start + files[file][:start].count(b'\n')
+        shifted_end = 8 + end + files[file][:end].count(b'\n')
+        assert transformed[shifted_start:shifted_end] == value.encode()
+        checks.append(name)
+assert 11 + 21 + 15 + 12 == 59
+print(json.dumps({'result': 'PASS', 'file_bytes': list(map(len, files)),
+                  'original_span_checks': len(checks), 'unicode_crlf_span_checks': len(checks),
+                  'retained_entries': 59, 'retained_name_bytes': 11,
+                  'scope': 'Independent raw fixture/byte arithmetic, no parser, lowerer, index or compiler execution.'}))

harness/analysis-mixed-index-20260924/source-review.md

@@ -0,0 +1,74 @@
+# Private mixed typed-index source review
+
+Parent publication note: production was frozen at
+`a18b7966e5ac6f5526deecdc4dd6ae8ca0e5ac51` with all three final reviewed production
+hashes below verified unchanged. Final test bytes at that commit are
+`f7561e05fb6c03f6d4926bb1583f87c91dabccc4370d221d80b1f9251d994caf`;
+they include the corrected nested-abs lifecycle fixture after the reviewer's
+supporting test snapshot. Successor `1d02206c57d5c32caa67f08c6e58f345c0fb5970`
+changes only an equivalent test range pattern and an implementation note after
+the first strict lint failure. The original review's source-only scope and
+findings are retained; this note does not claim runtime acceptance.
+
+2026-09-24. Reviewer: `/root/mixed_index_source_review` (GPT-6 Astra). Parent owns acceptance, publication, and integration. This is local-only preliminary source evidence; no compiler, test execution, Gitea mutation, source edit, or commit was performed by this reviewer. Issue 37 and its frozen Windows prerelease source were not touched.
+
+## Scope and exact source
+
+Reviewed the uncommitted production delta in `.local/as3batch`, branch `codex/analysis-mixed-index-956atf-20260924`, HEAD/base `aaec78fcc9b273d1485497126392afdd1fb2e54e`, against root `harness/analysis-mixed-index-contract-20260924.md` and its accepted independent design review. Paths below are relative to `crates/oa-core/src/` in that checkout. Parent-owned AGENTS.md changes are excluded.
+
+Initial SHA-256 source inventory (after first source read, before reported repairs):
+
+| File | SHA-256 |
+| --- | --- |
+| `language/analysis_source/index.rs` | `BEC770704DE957134AD05DC6FFA1117F114B5AC8787032A312B7D31B28FA05F5` |
+| `language/analysis_source/mixed/project.rs` | `EDC2D182FFC2F03F4039872A8B392174FF78185DD41F0A1B5611C6A93502878C` |
+| `language/analysis_source/mixed/project/accounting.rs` | `3EE9FF1ECDDAE29B35062DFF4738322C7941DED773D128C20D37EAE2BAAF30F6` |
+
+Final production source reinspection after builder reported its freeze (SHA-256):
+
+| File | SHA-256 |
+| --- | --- |
+| `language/analysis_source/index.rs` | `7C02DDA3622957D837B4AC39D477AE7842570BF3F0709ED48CD5495652636781` |
+| `language/analysis_source/mixed/project.rs` | `7FE6EF88729718C38D2FFFD46331CDD03624E1B52108DE0B7609DA4FBBDBAC2A` |
+| `language/analysis_source/mixed/project/accounting.rs` | `3EE9FF1ECDDAE29B35062DFF4738322C7941DED773D128C20D37EAE2BAAF30F6` |
+
+New test-source snapshot at that checkpoint: `language/analysis_source/mixed/project/tests/index_tests.rs` SHA-256 `6AEC4BE3CCA5D2F69A47DF3F88CC56BB012142E828305A8E121B7FE0A780A074`. The reviewer inspected corruption/transport/storage tests as supporting source, but did not perform a complete independent test-oracle audit or execute them. `git diff --check` returned exit 0.
+
+## Concrete findings and current disposition
+
+1. **Late call checks lost current file ownership.** `IndexData::build` initially updated `Original.at` while populating calls, but not while checking argument-label/callee agreement or argument-child/label agreement. A failure in either later loop could combine the current span with the last file in the preceding occurrence loop. Sent directly to parent and builder. Builder added `sources.at.set(Some(at.file))` and `sources.at.set(Some(site.file))` at the respective loop heads. Source reinspection confirms the repair. Runtime corruption controls must assert the relevant canonical file as well as the message.
+
+2. **Invalid numeric files acquired fabricated entry-file offsets.** `ResolvedMixedProject::index` initially filtered out-of-range `failure.file` to `None`, then passed the untouched span to `Failure::typed`, whose existing fallback selects the entry file. Corrupting an expression/occurrence file to `files.len()` therefore assigns an unrelated offset to the entry. Parent independently identified the same concern. Builder now explicitly resets the span to `Span::default()` for missing/out-of-range file authority before transport; source reinspection confirms that fallback repair. Valid canonical file failures continue to retain their span.
+
+3. **UTF-8 split offsets can panic during diagnostic conversion.** An internal expression/occurrence span whose start splits a multibyte character is rejected by the verifier, but `Failure::typed` passes its start to `language::diagnostic`, which slices `&source[..start]` without checking UTF-8 boundaries (`language.rs:178` onward). Thus the required damaged-span rejection could panic while reporting the intended error. Sent directly to parent and builder. Builder now tests the full error span with `source.get(start..end)` at the mixed consumed-constructor transport seam. Invalid UTF-8/range spans reset to `Span::default()` while retaining a known canonical file; unknown/out-of-range file authority uses the entry default. Source reinspection confirms the repair, and the added source test specifically chooses a byte inside `雨` and asserts the real `a.arcadia` path with default span. It does not alter unrelated public diagnostic code. Runtime execution remains pending. This was a concrete source control-flow issue reachable through required internal corruption, not through arbitrary fabrication of the sealed witness.
+
+## Ownership and compatibility assessment
+
+- `ResolvedMixedProject::index(self)` consumes the retained witness and moves it unchanged into an opaque `IndexedMixedProject`. It neither clones the complete Project nor reparses/re-lowers any source. Its views borrow the wrapper, whose retained syntax still borrows the original `SourceBundle`.
+- `IndexInput`'s private `files` field seals construction within the witness module; no method exports an input value. Shared verifier access to project/sites and borrowed original tokens does not expose an authenticated sibling constructor accepting replaceable source/token maps. No self-reference is stored in the output. The nested input lifetime/covariance still requires compilation to establish Rust acceptance; source design does not require unsafe code.
+- `IndexedMixedProject` has no `Deref`, `AsRef`, conversion, or updater adapter to legacy `Index`. `update::Plan`/`Composition` still use the nominal legacy type. Arbitrarily constructible internal `IndexData` alone cannot construct either provenance wrapper.
+- The mixed catalog streams Project, definitions, elements, relations, diagrams, diagram nodes/placements, artifact links, and traces exactly once, plus `(calculation, parameter)` names. This matches all `Project::identities` categories without allocating its temporary Vec. Scoped parameter UUID reuse cannot collide with globals or parameters of another calculation.
+- Typed-only name construction, borrowed numeric sources, output wrapper, and local budget checks are preserved. Shared `Storage(None)` adds no reservations; the existing local occurrence-cap and scalar-visited checks remain enabled only on that path. Owner/expression/token/call/structural check order remains equivalent, aside from earlier scratch destruction and unobserved diagnostic attribution. No typed-only semantic regression was identified by source comparison; test/compiler compatibility is not claimed here.
+
+## Structural and token invariants
+
+The extracted verifier retains owner containment; binding-field validity; parent-before-child rejection of forward/cyclic edges; file/owner/field agreement; proper subtree spans; unique qualified expression paths; role/qualified-target checks; whole original Word-token boundaries and spelling; duplicate physical-token/qualified occurrence rejection; call-label/callee agreement; required label existence for argument-child edges; and authored-syntax traversal comparing actual child edges to arena claims. The syntax-site lookup and visited total reject missing/extra expressions. It still intentionally trusts sealed lowering for complete non-expression reference/parameter occurrence emission; no additional completeness claim follows from the runtime checks.
+
+## Aggregate live-storage review
+
+Let G be global-plus-scoped names, H typed headers, O raw occurrences, E raw expression sites, P nonroot sites, C calls, W live syntax work items. The source adds retained entry slots `R = G + H + O + E + P`, zero occurrence slots, and exactly copied-name UTF-8 bytes. Prior raw E entries and O occurrence slots remain charged in the consumed ledger throughout.
+
+- Every owned name reserves one entry and its bytes before copying/insertion.
+- Each owner reserves one scratch entry before insertion; each new occurrence reserves two entries before its physical-token-set and retained-map insertions.
+- Each nonroot path reserves one retained Step before `Arc::new`. Each expression reserves two entries before retained-map insertion and scratch-path-vector push. Arc clones allocate no additional Step; enclosing map/vector slots remain charged.
+- After occurrence validation, owners and physical tokens are explicitly dropped before releasing H and H+O scratch entries. Paths and call entries are explicitly dropped/released after argument-child validation. P shared path-node reservations remain retained while map keys still own those nodes.
+- Reverse borrowed-name maps reserve G before insertion, syntax-site lookup reserves E incrementally before insertion, and each root/child walk push reserves one entry. A popped work slot is released immediately according to the accepted logical-live-slot policy; the scalar visited total adds no mixed allocation charge. Reverse maps/sites/work are dropped before the final scratch release.
+- No allocated declaration/file adapter table or copied path vector was introduced. `Path::edges` remains used only by tests. Error transport remains outside successful retained storage, consistent with the existing witness policy.
+
+The success-path peak expressions are: occurrence completion `R + H + (H + O) + E`; call validation `R + E + C`; syntax traversal `R + G + E + W`, in addition to the inherited baseline. These are source-derived formulas, not measured peaks. Earlier prefixes cannot exceed the first expression under valid monotonic accumulation; alternative fixture peaks still need exact tests. Checked aggregate `Ledger::reserve` precedes all new allocation growth; normal reserve failures return immediately and consume/drop the whole witness, so no stale lease or partial success can escape.
+
+## Destruction and remaining gates
+
+Persistent Path comparison/debug/drop remain iterative; final Arc ownership peels parents without recursive Step destruction. New verifier traversal is iterative and retains the inherited frame check. Syntax/Project destruction remains on existing lifecycle policy; runtime success and late-rejection small-stack checks are required, not established by this source review. No parse-byte/token/entry/reference or Exact-work charging calls were added to the mixed index path, and complete admission is not repeated; frame checking may update deepest-frame usage as permitted.
+
+All three concrete findings are repaired by source inspection at the final production hashes above. No remaining blocking source finding was identified for this bounded implementation. Compilation, runtime and oracle acceptance remain unverified by this reviewer. Required full numeric authored oracles, qualified repeated/reordered calls, all intended corruption controls, exact aggregate cap/cap-minus-one tests, provenance/metadata checks, small-stack execution, inherited typed-only index/update/export compatibility, strict core Clippy, and inherited full-library disposition remain parent acceptance gates. This read-only private index is a prerequisite for complete original-coordinate mixed editing; it does not implement ordinary occurrence indexing, public source8, or the user's full editing/UI parity objective.

harness/analysis-mixed-index-contract-20260924.md

@@ -0,0 +1,203 @@
+# Mixed typed occurrence index: successor contract
+
+Accepted bounded implementation contract, 2026-09-24, after parent source
+inspection and [independent critique](analysis-mixed-index-review-20260924.md).
+This is a design decision, not an implemented or verified index. Implementation facts refer to
+`aaec78fcc9b273d1485497126392afdd1fb2e54e`, not the Windows prerelease.
+This continues the [complete-Project contract](analysis-mixed-project-contract-20260923.md),
+especially section 7, and the [original-span composition review](analysis-original-span-review-20260923.md).
+Issue 7 owns scope/status; issue 37's frozen source is unaffected.
+
+The requested end state remains complete graphical/textual/API parity for
+quantities, calculations and constraints, with preservation, checked persistence
+and usable workflows. A private typed occurrence index is a dependency, not that
+end state. Ordinary occurrence indexing, update composition, public source8,
+structural editing, migration, UI and transport acceptance remain required.
+
+## Current evidence and problem
+
+- `language/analysis_source/mixed/project.rs:18` owns one admitted complete
+  Project, original `ParsedMixedSyntax`, warnings, static limits/usage, retained
+  expression/occurrence arenas and their aggregate storage ledger. Only Project
+  and warnings are exposed read-only. It does not provide an editing index.
+- `language/analysis_source/mixed.rs:39` retains the exact borrowed SourceBundle,
+  caller ProjectLimits, canonical file table, full-buffer tokens, original typed
+  declarations and ordinary syntax positions. Numeric file keys belong to this
+  table; equal offsets in different files are unrelated locations.
+- Existing typed-only `analysis_source/index.rs:122-243` owns names and occurrence/
+  expression maps but borrows a caller numeric source map. Its private builder
+  combines an ordinary Project with separate Lowered model maps. Feeding the
+  complete mixed Project into that path unchanged duplicates typed globals.
+  Its local map-size checks do not account for the retained mixed ledger.
+- `analysis_source/update.rs` accepts the typed-only Index in its standalone
+  Plan and opaque Composition/OriginalEdits adapter. Those APIs do not establish
+  complete SourceBundle entry/path/profile authority for mixed input.
+- Public `source_project.rs:93-117` exposes mutable bundle/model/index fields;
+  `update_bundle_with_identity_map` recompiles and compares all three before
+  editing (640 onward). Its ordinary collector applies edits, then runs the
+  structural updater, then recompiles and compares the complete intended Project
+  (868 onward). This later-coordinate structural pass cannot be relabeled as
+  original-coordinate mixed composition. That public contract is unchanged here.
+
+## Accepted choice
+
+Criteria are exact original ownership, complete semantic coverage within the
+declared index scope, aggregate resource accounting, compatibility and avoiding
+two divergent implementations of structural verification.
+
+| Candidate | Evidence / tradeoff |
+| --- | --- |
+| Shared private verification/maps with distinct provenance wrappers | Reuses the existing structural-path, token, owner and call-label checks. Requires explicit source/declaration/site views and storage reservations. Preferred if the extraction remains small and typed-only behavior is preserved. |
+| Separate copy of the typed index for mixed input | Simpler initial access to mixed fields, but duplicates the nontrivial syntax-edge and call-label verifier and would need every later correction twice. Reject unless extraction exposes a concrete incompatible invariant. |
+| Reparse mixed fragments into the old numeric-map Index | Loses complete bundle/profile authority, repeats accounting and can lose original coordinates. Reject. No substring, masked-source or canonicalized bridge. |
+
+Adopt the first candidate with the consumed mixed wrapper below. The critique's
+two findings are resolved here: storage domains are fixed by the existing
+contract, and reference completeness is distinguished from runtime expression
+verification. Revisit only for a demonstrated incompatible verifier invariant
+or a concrete requirement for multiple independently retained index owners.
+
+Do not add a public generic indexing framework. Shared helpers may consume
+private borrowed inputs only inside the authenticated constructors. There must
+be no public or sibling-callable API that treats arbitrary Lowered sites and
+caller-replaced token/location maps as an authenticated mixed index.
+
+## Ownership and construction invariant
+
+The proposed mixed constructor consumes `ResolvedMixedProject<'s>` and returns
+an opaque `IndexedMixedProject<'s>` owning that witness plus its index maps.
+Names are illustrative API identifiers. The output borrows the original bundle
+through its retained witness; it contains no self-references. Its read-only
+views borrow the output. Construction either succeeds completely or returns
+diagnostics with no usable partial index.
+
+Consuming the witness prevents creating multiple independently retained indexes
+while charging only one to its ledger. If a borrowed-construction alternative is
+chosen, it must prove reservation lifetime/release and simultaneous-index bounds;
+extra reservation lease machinery is not justified without a demonstrated need.
+
+The mixed wrapper must not dereference/convert to the old Index or implement an
+adapter accepted by old `Plan::renames`, `Plan::apply` or `Composition::renames`.
+Read-only access to names/locations does not grant edit authority. A later
+compositor must bind the full original entry, file set, canonical paths, bytes,
+limits/profile and complete target, not merely compare touched file bytes.
+
+Build from retained full-file tokens/declarations and the existing expression/
+occurrence arenas without reparsing, lowering again or duplicating Project
+records. Iterate typed declarations with their canonical numeric file keys;
+do not clone them into old owned Units. Derive global names exactly once from
+the complete Project, including project, definitions, elements, relations,
+diagrams, placements, artifacts and traces. Add calculation parameters under
+`(calculation_id, parameter_id)`; a parameter UUID reused by another calculation
+or a global remains distinct. Parameter spelling is calculation scoped.
+
+Reuse existing expression/occurrence key semantics: file-qualified locations,
+owner, binding field, structural child path, token role and qualified target.
+Headers and all typed reference roles must be included. Ordinary targets may
+appear in the catalog and typed references, but this view does not invent an
+ordinary declaration/reference occurrence index. Document that distinction in
+the read-only API and tests.
+
+Verify owner containment, UTF-8 source boundaries, exact token spelling and
+token classification, uniqueness of physical token ownership and qualified
+keys, parent-before-child/path/depth rules, and call-target/parameter-label
+agreement. Check structural edges against retained authored syntax, not only
+internally consistent arena claims. Keep file ownership when reporting errors;
+use an explicit invariant-error location fallback when no one file is justified.
+
+## Live storage and failure policy
+
+Continue the retained ledger and Budget/profile; do not initialize a fresh
+permissive budget or recharge original source/token/exact-number parsing.
+Reserve checked aggregate additions before allocation, combining the existing
+syntax/sites/warnings baseline with new retained maps and all live scratch.
+
+The implementation must inventory names and owned name bytes, occurrence and
+expression map entries, unique persistent Path nodes, and temporary owners,
+physical locations, path lookup vector, call map, global/parameter spelling
+lookups, syntax-site lookup and iterative walk slots. An Arc clone shares a path
+node but still occupies its enclosing map/vector slot. No copied path vectors
+are needed to construct keys. If `Project::identities()` is used, account for
+its temporary Vec (`model.rs:1763`); a streaming traversal avoids that allocation.
+
+Retained lowerer occurrences and newly retained occurrence-map entries coexist.
+Preserve the preceding contract's dimensions: lowerer occurrence records retain
+their occurrence-slot reservations; new index map/vector/set entries and unique
+Path nodes consume entry slots. Separately owned names consume text bytes.
+Both representations count once in their respective domains; neither record
+is charged twice merely because it is called an occurrence. Do not reset or
+release the old arena's reservation while its vectors remain live. Release scratch reservations only
+after the corresponding allocations are dropped. Preserve prior logical-slot
+scope: this is not an allocator-capacity/RSS or raw model/validator-heap bound.
+
+For the current three-map design let G be complete global-plus-scoped names,
+H typed declaration headers, O retained lowerer occurrences, E expression sites,
+and P nonroot expression sites. Added retained storage is entry slots
+`G + (H + O) + E + P`, occurrence slots zero, and text bytes the sum of copied
+names' UTF-8 lengths. The prior baseline still contains E raw expression entries
+and O occurrence slots. One Path Step is allocated per nonroot expression; any
+additional retained representation requires an explicit additional reservation.
+
+Peak scratch additionally includes owner map H, physical-token set H+O,
+arena-position/path/depth vector E, call-site map C, borrowed reverse-name maps
+G, syntax-site lookup E and live iterative walk slots W. Count any allocated
+file/declaration adapter table too. Drop owners/physical tokens after occurrence
+validation, and paths/calls after argument-child validation before syntax-edge
+work where possible; otherwise sum their overlapping reservations. A popped
+work item releases one logical slot. The scalar visited count consumes no
+allocated entry per visited node. Path-node reservations survive dropping the
+temporary vector while retained map keys still share those nodes.
+
+Budget errors abort construction. Existing depth checks may update deepest-frame
+usage; this is not reparsing or Exact-work recharge. Warning retention and prior static admission
+metadata stay unchanged. Neither indexing nor failure recovery repeats complete
+model admission or constructs replacement source. Rejection and destruction must
+retain the existing bounded-stack policy; no production depth128 enablement is
+implied by a narrow private test.
+
+## Required evaluators before implementation acceptance
+
+The [independently enumerated rich-fixture oracle](analysis-mixed-index-20260924/ORACLE.md)
+provides concrete names, keys, spans and retained-storage totals. Parent raw-byte
+verification passes all 36 original and 36 transformed Unicode/CRLF spans using
+the adjacent `check_oracle_bytes.py`, without running the parser, lowerer, index
+or compiler. This validates the test data's byte arithmetic, not implementation.
+
+1. Hand-enumerated OA and SA mixed bundles: entire name catalog plus every typed
+   declaration/reference/expression key, full-file span and spelling. Include
+   interleaved ordinary declarations, cross-file references in both semantic
+   directions, Unicode/CRLF and coincident offsets. The expected index must not
+   be generated by the builder, formatter or lowerer under test.
+2. Reuse the complete-Project repeated/reordered-call fixture with shared
+   parameter UUIDs in distinct calculations; compare all qualified labels and
+   structural paths, including repeated identical expression text.
+3. Internal corruption controls: swapped file ownership, wrong owner/field,
+   parent cycle/forward edge, structurally wrong but internally consistent child,
+   duplicate physical token, missing/extra expression, duplicate occurrence,
+   wrong call label/target, missing required argument label, and wrong token
+   classification/spelling. Every control must reach its intended existing
+   structural/token check rather than an unrelated earlier parse refusal.
+   Complete reference occurrence emission remains an invariant of the sealed
+   lowerer, tested by the independent exhaustive oracles in items 1 and 2.
+   The existing syntax-edge checker verifies the expression arena; it does not
+   prove all parameter-declaration or non-expression type-reference occurrences
+   are present. Do not claim arbitrary omitted occurrences are runtime-rejected
+   or introduce an unreviewed duplicate full syntax-reference verifier.
+4. Hand-counted live-storage cap and cap-minus-one cases: retained baseline plus
+   names/paths/maps, peak overlapping scratch, copied-name bytes, and simultaneous
+   occurrence representations. Check unchanged parse/numeric counters and exact
+   intended refusal phase; no success by clearing the baseline.
+5. Read-only provenance and lifecycle: exact entry/path/file/byte retention,
+   unchanged whole Project/warnings/admission metadata, no old-updater-compatible
+   conversion, and no usable failed result. Exercise complete success/drop and
+   representative late rejection/drop on the existing small-stack harness.
+6. Existing typed-only index/update/export tests and full inherited compatibility
+   dispositions must remain accounted for after shared-helper extraction.
+   Strict core Clippy and current-source checks remain required. Private full
+   library source8 failures are not to be suppressed or called passed.
+
+After this dependency, integrate real ordinary and typed original-coordinate
+edit producers, combined preflight/emission, output recompile/admission and
+whole intended-Project equality. Extend to structural edits, identity changes,
+missing-ID stabilization and checked-save/history before claiming the required
+editing parity. This proposal does not authorize a smaller final product.

harness/analysis-mixed-index-review-20260924.md

@@ -0,0 +1,61 @@
+# Mixed typed-index seam: independent source/design critic
+
+2026-09-24. Source-only review of clean private source `aaec78fcc9b273d1485497126392afdd1fb2e54e`; source paths below are relative to `crates/oa-core/src/`. Read root mixed-Project contract section 7, original-span proposal and accepted review, and parent's draft `harness/analysis-mixed-index-contract-20260924.md`. The reviewer performed no compiler, source/build/Gitea mutation, or runtime check. Parent subsequently verified and resolved the findings and adopted the revised [contract](analysis-mixed-index-contract-20260924.md). Initial findings and final disposition are preserved below. Prerelease #37 is unaffected.
+
+## Assessment and two precise draft refinements
+
+The consumed wrapper plus shared private verifier is the smallest sound next slice. It preserves original complete-bundle authority without claiming an ordinary occurrence index or enabling editing. Separate mixed verifier duplication offers no demonstrated benefit over narrow borrowed-input extraction. Parent's draft is implementable after settling these two points explicitly:
+
+1. **Set accounting dimensions in the contract, not during implementation.** Existing mixed-Project contract section 3 assigns map/vector/work entries and expression sites to entry slots; occurrence slots cover lowerer occurrence records. Consequently every new index-map entry, including an occurrence-map entry, charges `entry_slots`; retained `lower::Occurrence` records keep their existing `occurrence_slots`. Owned copied names charge text bytes separately. Parent draft lines 115–119 currently leave this choice open. Applying the old `Index::insert` local `lowering_occurrences(map.len())` check would not satisfy that inherited aggregate policy (`analysis_source/index.rs:643`).
+2. **Separate runtime damage checks from completeness by sealed origin.** Parent draft lines 138–144 list missing/extra occurrences among corruption controls. The existing verifier does not independently enumerate all expected syntax references: its own module header states that occurrence completeness trusts the lowerer (`index.rs:1–5`). `check_syntax_edges` only traverses expression structure (`:478–632`). Deleting an isolated parameter-declaration occurrence or a non-expression type reference can leave all runtime checks satisfied. Do not promise arbitrary omission rejection without adding a separate reviewed reference-syntax verifier. For this minimal slice, retain sealed parse/lower completeness, use hand-enumerated full occurrence output as the independent oracle, and restrict mandatory runtime omission rejection to checks actually present (missing expression, missing call label for an existing argument child). This is not a reason to widen scope or expose fabrication APIs.
+
+## Concrete ownership/API candidate
+
+A private constructor consumes `ResolvedMixedProject<'s>` and returns `IndexedMixedProject<'s> { resolved, data }`. `resolved` owns the unchanged accepted Project, syntax, warnings, admission metadata, raw sites and Ledger (`mixed/project.rs:16–32`, `:535–543`). `data` owns names and the typed expression/occurrence maps. Read-only methods return views borrowing the wrapper; a view may expose canonical file/path/source lookup and qualified keys, but no mutable fields, raw-site constructor or old `Index` conversion. No extra lifetime is needed for self-references because `data` owns its copied name Strings and keys rather than borrowing fields of `resolved`.
+
+During construction, narrowly split borrows of retained immutable syntax/project/sites, mutable Budget (for the existing depth check), and mutable Ledger. These borrows exist only inside the builder and end before returning the owner. The retained `SourceBundle` borrow outlives the wrapper and prevents safe mutation while it is live; identical lifetimes alone are not provenance, so neither source nor file table is a separately supplied parameter. Keep the constructor in the witness's module boundary or expose only a constructor-authenticated private view to the shared verifier.
+
+Do not reconstruct `BTreeMap<usize, String>` from mixed files. `ParsedMixedSyntax.files` already fixes canonical ordering, original source strings and tokens (`mixed.rs:36–58`, `:370–376`). A borrowed file lookup can return `(original_source, token_slice)` for either existing typed-only inputs or the mixed file table. Typed declaration iteration should yield `(file_key, &Declaration)` over retained vectors; site inputs are borrowed expression/occurrence slices. Avoid allocating cloned `Unit` declarations, relexing, rebuilding Lowered model maps, rerunning admission or generating replacement source.
+
+The old nominal `Index<'s>` remains the only input to `Plan` and `Composition` (`update.rs:15–27`, `:238–245`). A shared private `IndexData`/verification implementation does not justify a generic update trait, `Deref<Index>`, `AsRef<Index>`, or a public adapter. Keep the old `sources: &BTreeMap<usize, String>` authority in its wrapper (`index.rs:122–128`) and preserve typed-only checks/semantics. Mixed-only aggregate reservations must not be accidentally imposed on legacy tests via an unreviewed policy change.
+
+## Reuse boundary and scope
+
+Reuse structural key/path semantics (`index.rs:15–120`), owner/physical-token checks (`:246–283`, `:635–675`), expression-parent/path construction (`:288–359`), qualified roles and call-label checks (`:360–472`), and original-syntax expression-edge verification (`:478–632`). Extract these algorithms with small private input/storage adapters, rather than introduce a public generic indexing framework.
+
+Replace the current name-construction assumption only for mixed input. It currently enumerates ordinary identities and then separate Lowered definitions/elements (`index.rs:209–241`); mixed resolution already moved those models into the complete Project (`mixed/project.rs:439–459`). Iterate every complete Project global once, then scoped parameters once. Global categories include Project, definitions, elements, relations, diagrams and placements, artifacts, and traces (`model.rs:1763–1783`). A streaming borrowed walk avoids `Project::identities()`'s temporary Vec; otherwise reserve that Vec before calling it. Names include ordinary globals for resolution/namespace purposes, but indexed declarations/references remain typed-owned. Ordinary references to typed targets are preserved in syntax/model but not supplied by this view.
+
+A separate mixed-index implementation would duplicate roughly the whole path/call/syntax-edge verifier and its damage tests; later fixes could diverge. Reconsider only if extraction exposes an actual incompatible invariant, rather than because mixed fields require private access. The distinct wrappers already express the genuine provenance difference.
+
+## Aggregate storage inventory and release points
+
+Continue `Ledger::reserve`'s checked totals and inherited Budget (`mixed/project/accounting.rs:43–70`), including retained syntax, warnings, expression sites and occurrences. Never start from zero. One consumed owner prevents repeated retained indexes using one accounting baseline.
+
+For a successful simple implementation let G be complete global-plus-scoped name count, H typed headers, O retained lower occurrences, E expression sites, P nonroot expression sites, and C calls. The added retained logical storage is **entry slots = G + (H + O) + E + P; occurrence slots = 0; owned text = sum of the copied names' UTF-8 lengths**. The existing baseline already contains E raw-site entry slots and O raw-occurrence slots. P counts each allocated shared Path Step once; Arc clones do not allocate another Step but their map/vector records still count. This formula assumes exactly the current three maps and one Step per nonroot expression; any added representation must be listed separately.
+
+Scratch must additionally reserve before growth:
+
+- typed owner map H; physical-token set H + O;
+- arena-position/path/depth vector E; call-site map C;
+- borrowed reverse-name maps G; syntax-site lookup E; iterative syntax work slots W;
+- any allocated file/declaration view table, error mapping retained in success, or identity-visitor scratch.
+
+Borrowed reverse-name strings cost no new text bytes. Work-pop releases its logical slot; this remains a logical live-element policy, not retained Vec capacity/RSS metering. Scalars such as `visited` are not a separately allocated entry per visited expression.
+
+Explicitly drop/release owners and physical-set storage after occurrence validation, then paths/calls after argument-child validation and before syntax-edge work where possible. Otherwise all remain live and must be summed at that peak. Retained Path Steps remain charged even after dropping the temporary path vector, because expression/occurrence maps share them. Failure drops the entire consumed owner; no partial reusable success or stale reservation lease escapes. Preserve iterative Path destruction (`index.rs:68–79`). `Path::edges` allocates a Vec (`:82–90`) and currently has test-only call sites; do not turn it into a new unmetered production materialization API.
+
+## Discriminating acceptance cases
+
+1. Independently enumerate complete names and all typed key/location/spelling tuples in OA and SA mixed files with Unicode/CRLF, ordinary prefixes and coincident offsets across canonical paths. Compare every tuple and original whole bundle, Project, warnings and admission metadata; do not generate expectations by the builder/lowerer. Include a parameter UUID equal to a global and reused in two calculations.
+2. Reordered repeated calls must retain distinct parent paths, correct callee-scoped labels and original argument order. Corrupt a label to an existing other callee with the same parameter UUID/spelling so token/catalog checks cannot mask the intended call-site rejection (`index.rs:426–469`).
+3. Runtime negatives: missing/extra expression; forward/cyclic parent; cross-file/owner/field location; internally consistent but syntax-wrong child edge; duplicate physical token or qualified occurrence; non-Word/partial/UTF-8-split token; missing call label with an argument child. Record which exact check rejects. For arbitrary reference omission, the full authored oracle must fail; do not label this builder rejection unless new syntax completeness logic exists.
+4. Hand-count a retained baseline plus the formula above and peak scratch: exact cap succeeds, cap minus one fails at the intended reservation before growth. Separate copied-name-byte pressure and overlapping temporary maps. A case where old baseline and new maps each fit alone but their sum does not catches ledger reset; retain both raw and indexed representations throughout. No parse byte/token/entry/reference or Exact-work recharge is permitted; inspect control flow as well as counters. The existing `Budget::frame` may update deepest-frame usage while checking depth (`budget.rs:118–121`); this is not another parse.
+5. Type/API inspection must establish no old-updater-compatible conversion and no replaceable bundle/table/profile inputs; wrong-session composition is a later compositor negative, not an invented runtime API in this read-only slice. Test original provenance through views and success/late-failure cleanup on the existing small-stack harness. Re-run legacy Index/update/export oracles after extraction.
+
+## Dependencies deliberately still open
+
+This slice neither authenticates a complete ordinary occurrence set nor authorizes rename emission. Subsequent work must derive both edit producers and complete rename intent from the same witness/target; define the precise supported ordinary diff/compound-edit normalization; aggregate and validate original-coordinate edits; emit once; recompile/admit the actual complete result; compare the whole independently intended Project; and preserve atomic history/save behavior. Full parity still requires typed subtree and parameter edits, repaired deletion/reidentity, file movement/ownership, missing-ID stabilization/reindexing, migration/public dispatch, and editor/root reconciliation. These remain delivery requirements, not reasons to expand this next read-only dependency.
+
+## Revised parent draft disposition
+
+Re-read the updated contract's live-storage and evaluator clauses after parent revision. Both requested refinements are now explicit: new map/vector/set/Path storage uses entry slots while retained lower occurrences keep occurrence slots, and runtime expression/token/call checks are separated from complete occurrence emission guaranteed by sealed lowering and independently enumerated output tests. Those changes resolve the two design ambiguities identified above. No remaining blocking source/design finding for this bounded implementation proposal. The concrete retained-storage formula and failure cases in this report are implementation guidance, not measured results or a final accepted decision. Parent retains adoption and gate authority.

harness/analysis-mixed-parser-proposal-20260923.md

@@ -0,0 +1,91 @@
+# Next private mixed-parser slice
+
+**Original proposal, subsequently narrowed by the [independent review](analysis-mixed-parser-review-20260923.md).** The parent accepted the private syntax-only direction with that review's corrections; implementation and runtime acceptance remain open. In particular, the review resolves the base to A and corrects this proposal's inference of ordinary grammar drift from whole-file statistics. The following inspection is retained as its original reasoning, not a public source8 claim.
+
+Read-only inspection, 2026-09-23. Private source pin A=`10d7f3340d5cd61a656dc0bcf7c143f8897c5551`; current ordinary/public pin R=`195ddbbba5b352af09bca385a6c3e4dd1c77f8c8`. Both pins checked before and after inspection. No compiler, source edits, GUI or Gitea operations. Parent reports A passed Windows 173 listing/65 typed/strict; those gates do not exercise mixed parsing.
+
+Read the published `harness/analysis-original-span-proposal-20260922.md` and `harness/analysis-original-span-review-20260923.md` at R, plus A's `harness/analysis-source8-20260913/analysis-source8-repair-design-r2-20260913.md`, especially “Source pipeline and exact editing” and the resource/older-version contracts. This note narrows their next parser dependency; it does not replace them.
+
+## Recommendation and exact deliverable
+
+Implement **one private complete-bundle syntax parse**, producing an opaque `ParsedMixedSyntax` witness. It retains ordinary unresolved syntax and ordinary edit positions alongside typed unresolved declarations, from one significant-token stream per original file and one inherited budget for the complete pass. Start with explicit stable IDs only, source8 entry, existing ordinary grammar, all existing typed declaration grammar, and normal include/path rules. It returns no Project, Index, rename authority, output text or installed document. A complete semantic/session witness is a dependent slice, not an alternative name for this syntax result.
+
+This resolves actual mixed-file dispatch, full-file coordinates, lexical ownership, aggregate scanning and same-parse ordinary edit provenance before undertaking cross-domain lowering or production composition. Root public dispatch remains closed; a private constructor selects source8 policy before scanning and verifies that the actual entry says 8. No schema constant, public parser acceptance, save route or model change belongs in this patch.
+
+## Existing source seams
+
+Paths below are repository-relative; line numbers belong to their indicated pin.
+
+| Existing site | Consequence for the slice |
+| --- | --- |
+| R `language.rs:1066` `parse_unit`; `:1272` Parser; `:1489` unit | `strict_tokens` owns a separate token Vec; unit mixes entry/header/includes, iterative ordinary declaration nesting and fields. Add a private mixed entry through factored grammar operations, retaining the iterative declaration-owner stack. Public versions currently stop at 7. A has the corresponding unit at `:1332`. |
+| R `language.rs:1155–1270` `edit_declarations`/`edit_positions` | `edit_declarations` reparses and `edit_positions` rescans, derives delimiter ends and assumes token shapes. A mixed caller cannot invoke these helpers on the original mixed file. Factor a positions projection over the already parsed ordinary AST and retained token/span metadata. Keep the legacy wrappers' observable behavior. |
+| R `language.rs:1392` ordinary `value_inner` | Ordinary numbers remain finite JSON values; they are not Exact. Raw `-` + number must be consumed as one ordinary signed value with its complete span; typed `1-2` is subtraction. Preserve ordinary rejects such as `+1`, `1e`, `1_0`, `0x1` and nonfinite JSON numbers. |
+| A `language/raw_tokens.rs` Scanner and legacy adapter; `analysis_source/lex.rs:23` tokens | Scanner already preserves raw full-buffer spans and separates typed operators. Legacy adaptation greedily groups adjacent numeric parts and performs JSON classification. Do not use that whole-file legacy adapter for mixed source; typed lex currently charges bytes/raw tokens, including trivia, before retaining significant tokens. |
+| A `analysis_source/cursor.rs:5` Cursor; `declarations.rs:243` parse | Typed parse already consumes a borrowed significant cursor, checks inherited version=8, rejects lexical owners, and returns unresolved full-buffer declaration/field/reference/literal spans. This is the useful dispatch seam; `analysis_source::parse` is an expression-only whole-input wrapper. |
+| R `source_project.rs:303–605` compile_once | Existing iterative include visitor owns path normalization, cycle/depth/edge/visited checks, aggregate ordinary counts, unreachable-file rejection and located errors. Reuse/factor its traversal policy for private syntax collection; do not call compile_once and discard its model. Its `:429` parse_unit call is the later production substitution point. |
+| A `analysis_source/index.rs:147–195` parse/build | Current parse scans typed-only numeric-keyed files and accepts a separately supplied ordinary Project. Calling it on mixed buffers fails; calling it on extracted typed text invents provenance. Keep build private. This slice does not manufacture an Index. |
+| A `analysis_source/lower.rs:269` lower | Accepts ordinary skeleton plus all typed units; collects all typed globals/signatures before bodies; deliberately does not admit the skeleton. Needed in the next semantic slice after the shared syntax witness exists. |
+| R `source_project.rs:895`, `:918`, `:984`, `:1050–1071` update path | Actual-file ordinary edit ASTs, formatted comparison ASTs and local project-header spans have different roles. Later production editing uses retained actual-file positions; retain CompleteForEdit/Compact formatting and their comparison semantics. Scalar application, structural second pass and full candidate equality remain outside this parser patch. |
+
+R and A's ordinary files are materially different (427 insertions/81 deletions across language.rs/source_project.rs in the inspected comparison). R also contains current CompleteForEdit/Compact work. Do not copy A's whole language/source_project files over R or overwrite the parent's Scenario integration. Pin the combined implementation base and agree ownership of the shared grammar hooks before coding.
+
+## Minimal private interfaces and ownership
+
+Names are illustrative, not a request for a public framework:
+
+```rust
+parse_mixed_syntax(bundle: &SourceBundle, limits: ProjectLimits,
+                   test_profile: /* optional tighter private profile */)
+    -> Result<ParsedMixedSyntax<'_>, Vec<SourceDiagnostic>>;
+```
+
+The result privately borrows the **actual complete SourceBundle**, owns the one finished Budget, canonical file table, parsed units and retained significant tokens/ordinary position metadata. It retains entry, every canonical path and original bytes through that borrow. File keys are minted once from canonical bundle keys before traversal; the include visitor visits each reachable file once. A FileKey is meaningful only through its owning result, never an independently accepted `(usize, path)` mapping. Store paths/source references into the borrowed bundle rather than a self-referential owned Index-plus-source-map structure. Constructors are private; expose read-only inspection only. This establishes syntax provenance, not semantic validity or mutable-current freshness.
+
+Each file result contains its source reference, entry/fragment role, include spans, ordinary declarations with lexical owners, typed declarations, and ordinary edit positions. Positions remain half-open **full original file UTF-8 byte offsets**, even after Unicode comments, the project header, includes or preceding declarations. No header/include offset is added to typed spans. Nested ordinary declaration spans legitimately contain descendant declarations; declaration ranges are descriptive ownership, not automatically disjoint replacement authority.
+
+Use one shared significant-token cursor state. Ordinary grammar methods may have a domain-specific borrowed view; they must advance the same token position used by typed `declarations::parse`, without copying/rescanning a declaration or replaying a speculative parse. Preserve legacy grammar through factoring, not by cloning a second independently maintained ordinary parser. Keep token access/classification adapters small and local; no general parser trait framework is required.
+
+At document scope, dispatch exact typed declaration words before generic ordinary `declaration_kind`. Inside an ordinary element's open body, recognize a typed header only to deliver the existing “must be roots” error; do not reinterpret it as an ordinary field. Contextual words such as `unit`/`calculation` must remain legal aliases where already allowed. Entry descriptions/includes keep current placement rules. Generic derived long analysis kind names must not become an alternative accepted syntax.
+
+For ordinary edit positions, a raw numeric value may cover several significant tokens (`-12.5`). The current token-end heuristic would cover only `-`. Record ordinary value end spans as grammar consumes values (a small per-file side table keyed by the existing AST start offset is sufficient), then project EditValue from that AST plus spans. Keep the shared legacy/migration Ast representation unless a demonstrated need justifies changing it. Record ordinary header token roles from actual parsing as well; do not obtain them with another `edit_header` scan. Typed declaration spans/expressions never enter ordinary EditKind::Record recursion.
+
+**Stable-ID scope:** reject omitted project, ordinary global, typed global or parameter IDs in this first private entry before returning a witness. The ordinary `optional_id` path currently creates UUIDs, so the private mode must reject before that generation; typed IdentitySyntax already retains missing identity/insertion information. This intentionally postpones stabilization instead of assigning hidden IDs or granting edits against pre-insertion offsets. Later accept missing IDs only through bounded insertion into the returned full documents and a new complete parse of those actual bytes.
+
+## Budget and parser invariants
+
+Create one Budget at the private complete-parse boundary from source8 hard ceilings intersected with caller restrictions and any tighter test profile. Own it in the returned witness; lower/index/compose later obtain it from that witness, with no ambient replacement/reset API. Creating a Budget for each include or switching token policy after seeing local fragment syntax is invalid. Selecting explicit private source8 mode before lexing avoids a public version-probe implementation in this slice; eventual public dispatch needs a bounded header read with unambiguous accounting.
+
+Precheck aggregate file/UTF-8 byte size before broad token/String allocations. Charge each file's original bytes once in scanning; a prior noncharging aggregate limit check is not another charge. Charge every raw token including trivia once, before storing; significant filtering and ordinary legacy-compatible numeric consumption do not recharge tokens. EOF carries no token charge. Do not scan or convert typed exact atoms again to derive positions. JSON ordinary values keep their finite numeric domain, and exact numeric WorkMeter use belongs only to typed numeric consumption.
+
+The mixed parser must also bound ordinary temporary containers/references before allocation; existing per-unit graph counts and final `check_model` alone are insufficient. Specify the charge table in the patch: ordinary declaration/field/value/list-entry allocations join the private syntax-storage ceiling; retain caller graph/record accounting separately; ordinary reference storage is bounded before copying, while caller ordered-step/reference semantics remain explicit rather than silently relabeling every scalar reference a model step. Typed existing entry/reference charges stay intact. Count aggregate phase metadata (file table, positions, catalogs later) before reserving; the existing typed budget phase checks are reusable but do not magically bound ordinary additions. Preserve ordinary value-depth64 and separate typed frame256/logical-depth128 semantics and safe failure cleanup. Tests must discriminate which bound fails.
+
+## What this does not yet solve
+
+The dependent **ResolvedMixedBundle** must consume this syntax witness, collect one global alias/identity/category catalog including typed declarations, build the ordinary skeleton against it without premature complete-model admission, lower typed units once, merge them, admit the whole Project, and construct Index internally from the same tokens/units/lowerer result. Only that result can bind complete Project, Index, file table, original bundle and inherited Budget for composition. Current A Index borrows `BTreeMap<usize,String>`; adapting its private source accessor to witness-owned file references is justified there. Exposing `build(Lowered, spans)` to arbitrary callers is not.
+
+R `language::resolve_declarations` combines ordinary construction, version migration and final limits; A additionally migrates source7 through `migrate_v7`. Neither is an appropriate “parse ordinary and admit first” shortcut: forward ordinary references may target typed records, and typed subjects/types/calls may target later files. The semantic slice needs a narrowly extracted non-admitting ordinary construction step, complete catalog, and one final model admission. Syntax witness tests cannot prove these relationships or satisfy intended-Project equality.
+
+Coordinated version7→8 blockers for production are: reconcile root schema7 with private schema8 definitions/analysis and Scenario payload; preserve frozen older DTO/source gates and the source3 old-envelope boundary; choose the one public dispatch/migration change; stabilize missing global/parameter IDs and reindex actual returned bytes; retain required categories and ordinary complete/compact edit behavior; supply complete mixed lowering/index provenance and supported-edit diff gate; compose original edits once and recompile/admit/compare the entire actual output; pass migration/history/checked-save and resource calibration gates. None requires a new metamodel or blocks this private explicit-ID syntax slice. Root should coordinate them, not accept `arcadia 8` early to make a fixture pass.
+
+## Rejected shortcuts and cost comparison
+
+| Approach | Decision |
+| --- | --- |
+| Shared scanner/cursor + existing grammar extraction + same-parse ordinary positions | Recommended: moderate localized factoring; directly tests mixed boundaries and retains ownership. Limit deliverable to syntax until semantic construction is ready. |
+| Parse ordinary and typed projections independently, then combine models/indexes | Reject: masking preserves numeric offsets at best but loses actual-source token/ownership proof; substring/concatenation creates local offsets; separate parses reset or double-charge resources and cannot establish cross-domain global resolution. A clever remap does not repair these invariants. |
+
+Also reject whole-file legacy tokenization (typed punctuation fails/typed number domain changes), silent retries with larger budgets, counter subtraction after rescanning, caller-supplied numeric file remapping, and treating equal bytes/shared lifetimes as proof of the same semantic parse. A full replacement edit AST is unnecessary for this step.
+
+## Six observable first-slice fixtures
+
+All are proposed, unrun. Use independently authored source literals and expected span/substring tables rather than expectations extracted from the result itself.
+
+1. **Interleaved CRLF/Unicode:** entry description/comment, ordinary nested element, typed calculation with `1-2` and `1e-2`, ordinary record with negative coordinates after it. Verify exact original substring at every selected ordinary/typed/header/value span, lexical owners, and byte-identical complete input. Explicit `-12.5` ordinary span must include the minus and full atom. No output Project claim.
+2. **Complete include binding:** root + nested-path module + shared dependency reached twice; mixed declarations after include prefixes in two files with identical local offsets/spellings. Check unique scan count, fixed FileKey/path mapping, exact include spans; cycle, missing, escaping and unreachable-file negatives return no complete witness. Entry/path/map replacement is not an accepted constructor operation.
+3. **Dispatch and grammar separation:** `unit`/`calculation` used as allowed ordinary aliases, all short typed declaration kinds, typed roots between nested ordinary blocks. Reject typed lexical nesting, long derived analysis names, fragment version headers and source7 at this private source8 entry. Existing public source3–7 and public source8 rejection remain unchanged.
+4. **Number/position compatibility:** ordinary signed/exponent JSON values and typed exact ratio/scientific expressions, with comments between legal typed tokens. Ordinary `+1`, split-sign forms not admitted by the old grammar, malformed/nonfinite JSON values reject. Typed values beyond JSON precision retain exact values/literal spans. Existing ordinary token compatibility tests plus independently stated old outcomes prevent broadening by accident.
+5. **Aggregate budget and failure cleanup:** one-file and split-file variants with exact byte/token/ordinary-storage/reference/numeric ceilings and plus-one failures; include trivia; add an earlier ordinary allocation so a later typed declaration crosses the shared ceiling, and reverse producer order. Previously latched failure returns no witness. Test-only scanner visitation/Exact conversion counters demonstrate one scan/one conversion; unchanged counters alone do not. Run retained 128-KiB typed depth/rejection cleanup controls when parser ownership changes warrant them.
+6. **Opaque syntax scope:** explicit-ID positive across all declaration/parameter kinds; remove one ID in each domain and require refusal with original bundle unchanged. Read-only ordinary EditValue and typed occurrence syntax inspect the same witness; no external AST/Lowered/FileKey-map constructor exists. Unresolved forward ordinary/typed references can be retained syntactically, but do not assert they resolve. A following semantic slice must add reordered cross-file forward references, repeated/reordered calls, reused parameter UUIDs, catalog collisions, wrong-session batch rejection and independent whole-Project equality.
+
+First patch completion means these syntax/ownership/resource fixtures and unchanged ordinary compatibility tests pass on an immutable Windows source pin with fresh review. It does not mean mixed renames, source8 save, full S3/S4, public schema activation, or all semantic references work.

harness/analysis-mixed-parser-review-20260923.md

@@ -0,0 +1,35 @@
+# Private mixed syntax proposal: independent review
+
+**Disposition: proceed with a private syntax-only implementation on A=`10d7f3340d5cd61a656dc0bcf7c143f8897c5551`, with the bounded corrections below.** Do not first merge the full current root or copy either side's complete language/updater files. The proposed single-buffer cursor, original coordinates, complete-bundle borrow and inherited budget address the real next dependency. A semantic witness, compositor, ID stabilization and public activation remain separate dependent work.
+
+Reviewed `.local/analysis-mixed-parser-next-slice-20260923.md`, the published original-span proposal/review at R=`195ddbbba5b352af09bca385a6c3e4dd1c77f8c8`, the private r2 design, and actual A/R source. Source/design review only: no tests, compiler, GUI, source/worktree edits or Gitea operations. Parent's reported A gates are export/typed evidence, not mixed-parser evidence. Line references below are pinned to A or R; `analysis_source/*` means `crates/oa-core/src/language/analysis_source/*`.
+
+## Resolve the implementation base now
+
+The proposal's 427/81 whole-file difference is real but does **not** demonstrate materially different ordinary syntax. Direct Git extraction established:
+
+- `source_project.rs` is byte-identical from the file start through the entire include/compiler/edit-application section before `format_bundle`. Thus the traversal policy at R/A `:303–605` has no R/A drift.
+- `parse_unit` and the edit-header/declaration/position section are byte-identical (A `language.rs:905–1109`, R `:1066–1270`). Parser `fields` through `value_inner` is byte-identical (A `:1179–1293`, R `:1336–1450`). The iterative `unit` implementation differs only in A initializing its additional empty `Project.definitions` member. UUID optional-ID behavior is equivalent; R factors the existing shape check into `has_uuid_header_shape`.
+- Real differences requiring later integration include raw-token versus current bounded tolerant-outline tokenization, A's analysis model/migration/source3 bridge, and R's ordinary defaults plus complete/compact formatter/updater. R `language.rs:1757` and `source_project.rs:853` are semantic/edit behavior, not prerequisites for a syntax-only result. A's generic `declaration_kind` also sees a larger `Kind::ALL`; equal grammar function bodies do not imply equal recognized kind sets.
+
+**Concrete base:** keep A's tested private analysis/numeric/export dependency closure and existing module isolation; factor its ordinary syntax/position code in place, using R's pinned ordinary behavior as a compatibility oracle. Implement the mixed unit/bundle owner privately, sharing the factored ordinary grammar and include policy with existing A paths. Do not port R's whole updater, Text outline, Scenario payload or schema constants for this experiment. Keep a narrow compatibility note identifying the equal syntax seams and intentionally deferred semantic/editor differences. Recheck those seams against the parent's eventual integrated pin before proposing production composition. This avoids an unrelated model/GUI integration prerequisite and does not claim A already contains root ordinary default/update behavior.
+
+## Corrections and acceptance conditions
+
+1. **Define ordinary numeric consumption precisely.** A `raw_tokens.rs:158–181` preserves the legacy greedy, *byte-adjacent* numeric alphabet; the mixed significant adapter (`lex.rs:19–51`) discards trivia. A two-token `-` plus Number rule without adjacency would newly admit `- 12.5` and `- //comment\n12.5`. Require contiguous original spans, complete ordinary numeric spelling, finite JSON classification, and the original complete value end. Keep `+1`, `.5`, `1e`, `1_0`, `0x1`, `1-2` invalid as ordinary values; typed `1-2` and exponent `1e-2` retain their different meaning. This belongs in a small ordinary-consumer view over the same cursor, not a second lexer or substring parse. Full field/value spans must include semicolon/delimiters correctly after multi-token negatives. Check nested records/lists and `@ /*not supported*/`-style malformed trivia as well as top-level coordinates. Only `//` comments are supported by the current scanner.
+
+2. **Preserve occurrence ownership before semantic uniqueness.** Explicit IDs are a reasonable first-slice restriction because the ordinary AST and lexical owners currently require `Id`, and edit positions refuse unstabilized declarations (R `language.rs:1232–1240`). Reject missing ordinary/project IDs before `optional_id` generates UUIDs (`:1316–1319`); inspect typed globals and every parameter's existing `IdentitySyntax` (`A declarations.rs:34–42,406–434`). This is staging policy, not proof syntax intrinsically requires explicit IDs. Do not add stabilization here. Conversely, do not key syntax/position storage solely by UUID or alias: ordinary `edit_declarations` explicitly preserves occurrences through temporarily duplicate identities (R `:1151–1154`), and global uniqueness is deferred to resolution. Preserve ordered declaration occurrences and lexical owner occurrence information; either retain duplicate IDs without collapsing nodes, or explicitly label any early uniqueness rejection as additional syntax-slice policy. Reused parameter UUIDs across calculations remain legal. The side table keyed by actual AST start is suitable.
+
+3. **Make the storage table concrete without relabeling model limits.** A `budget.rs:16–24` currently derives syntax entries from caller `max_records` and references from `max_step_references`. Counting every ordinary declaration, field, value and list slot against that same limit can reject a one-project/one-element input under `max_records=2` solely because it has a description field, although the ordinary model has two records. Similarly `parent @x` is not automatically an ordered model step. Keep bounded syntax storage and aggregate ordinary model counts distinct and document which bound each fixture targets. If retaining the existing candidate source8 syntax ceiling is deliberately stricter, state that private policy; do not claim preservation of all caller-limit behavior. Preserve public source3–7 accounting. Tokens/metadata/position copies need an aggregate storage bound, not a fresh per-file check or repeated independent allowance. Do not charge the same AST record again merely because a span references it. A `lowering_entries/index_bytes/lowering_occurrences` are noncharging **phase checks** (`:137–160`) and do not latch failure; all their errors must propagate immediately. `Budget::active` alone is not proof those phase failures were retained.
+
+4. **Keep factoring localized and dispatch contextual.** Share `fields/value/nesting/header` operations; retain the iterative declaration stack. The ordinary parse wrapper can continue selecting its legacy view and the private mixed wrapper its raw-token view, while both call one grammar implementation. No generic parser trait framework or second independently maintained ordinary parser is needed. Inside an ordinary body, reject a *typed declaration header*, not every field whose word happens to be `unit` or `calculation`; ordinary syntax retains generic field names before semantic validation. At document scope, short typed words dispatch first. Explicitly exclude long analysis-derived ordinary kinds on A: `language.rs:236–259` builds names from the expanded `Kind::ALL`, so dispatching short words first alone does not close that alternative syntax.
+
+5. **Provenance is the whole constructor, not token retention alone.** Borrow the actual `SourceBundle`, including entry and all files, validate canonical/case-colliding paths and complete reachability before returning, and mint the path table internally. Maintain one shared cursor index and Budget. Temporary borrowing of the owned token vectors is sufficient; do not create a self-referential stored Cursor. Retaining tokens is justified for the later Index's token witnesses (`A index.rs:185–195`), but there is no need to clone a second token stream or expose a public profile/configuration framework. A test-only tighter-profile constructor or fixed private helper suffices. A result may privately reuse the existing header container with its empty Project shell, but must not expose it as an admitted ordinary model. The distinction between `ParsedMixedSyntax` and a later resolved/admitted witness is sound. Keep construction of the latter internal, with ordinary construction against the full catalog, lower-once, final admission and same-parse Index creation; the current typed-only `Index::parse(ordinary, numeric_files, budget)` is not that authority.
+
+## Bounded first-patch gates
+
+The six proposed fixtures are a useful sufficient scope with these additions: signed-value adjacency and nested value/field ends; a contextual typed word used as an ordinary field/alias; long derived analysis-kind refusal on A; duplicate ordinary identities without position collapse; reused scoped parameter UUIDs; ordinary model-record versus syntax-storage boundaries; shared dependency scanned once; and exact Unicode/CRLF source substrings independently specified. Missing-ID failures must leave input unchanged and never call UUID generation. A deliberate phase-bound failure must return no witness, even though that check does not latch the Budget.
+
+Require compatibility tests for the public legacy token/parse paths actually touched by factoring, including the existing `raw_tokens::tests::legacy_adapter_retains_authored_numeric_operator_and_trivia_tokens`. Retain ordinary depth 64, typed frame 256/logical depth 128, and the applicable small-stack cleanup controls. These are future acceptance tests, not executed results. Do not require unrelated source updater/GUI integration gates to approve a syntax-only private patch; require those when its code is composed into the corresponding production path.
+
+The broader rejection of projection/masking and fabricated `build(Lowered, spans)` provenance is justified. No alternate architecture is needed. The next useful action is this bounded private implementation with the charge table and ordinary numeric adapter specified in its patch, followed by fresh source review and appropriate parser gates.

harness/analysis-mixed-project-contract-20260923.md

@@ -0,0 +1,90 @@
+# Private mixed Project contract
+
+**Accepted design, 2026-09-23; implementation remains gated by syntax acceptance.** This document specifies required behavior and proposed acceptance oracles; it reports no pending gate or fixture as passed. Implementation facts refer to `a578ac98a06772a60bec00ae287e65650680d119`, paths under `crates/oa-core/src/`. The [independent review](reviews/mixed-project-contract-20260923.md) informed the retained-site and diagnostic-allocation requirements below.
+
+This slice supplies an admitted private Project with retained original-source provenance, a dependency toward the [project goal](../PROJECT_GOAL.md). It extends the [mixed-parser ownership contract](../harness/analysis-mixed-parser-proposal-20260923.md#minimal-private-interfaces-and-ownership) and [review corrections](../harness/analysis-mixed-parser-review-20260923.md#corrections-and-acceptance-conditions), while preserving the [original-span namespace/resource/acceptance invariants](../harness/analysis-original-span-proposal-20260922.md#namespace-resource-and-acceptance-invariants) and [reviewed boundary separation](../harness/analysis-original-span-review-20260923.md#concrete-next-implementation-boundaries). It does not activate public source8 or deliver mixed editing.
+
+## 1. Result, authority and order
+
+Consume actual `ParsedMixedSyntax`. A successful opaque result owns the complete Project, mapped warnings, successful static admission limits/usage and retained syntax/lowering provenance. It retains the actual borrowed SourceBundle, exact entry, complete canonical paths and original bytes, canonical numeric-file-key table, exact ProjectLimits and the original Budget. No separately supplied Project, aliases, Lowered, tokens, file remap, replacement Budget or widened limits may establish authority. No mutable Project or edit constructor escapes this read-only boundary.
+
+Required sequence: complete headers/signatures → ordinary construction once → typed body lowering once → checked disjoint moves into complete Project → retained model limits → one static/architectural admission route → accepted result. No rescanning, Exact conversion, ordinary decoder duplication, source emission/reparse, UUID invention, or migration/admission of a partial skeleton. Missing explicit IDs remain refused by syntax. Failure returns no usable partial witness.
+
+Seed the entry Project first. Thereafter process canonical file order and original declaration-start order within each file, merging ordinary/typed header occurrences. Detect alias collision before ID collision when both apply, preserving both source owners. Validate complete catalog uniqueness before Project map insertion. Ordinary construction and typed lowering follow this order restricted to their respective declarations; normal validator order stays unchanged. Syntax/include traversal order is unchanged. This is a phase policy, not a promise of earliest physical error across phases.
+
+Catalog categories include project, ordinary objects, neutral definitions and typed layer roots. Parameter identities/names remain scoped to their calculation; equal parameter UUIDs in different calculations or equal to a global UUID are permitted. Ordinary alias projection derives solely from this complete catalog. Preserve declaration occurrence→file mapping through ordinary conversion errors; UUID lookup cannot distinguish rejected duplicates.
+
+## 2. Shared construction and retained-site handoff
+
+Extract the existing `language.rs:1667 resolve_declarations` construction path, including deferred node attachment. Preserve **both Project and legacy_elements scratch** for the existing source3 tail. Existing source3–7 wrappers retain migrations, required fields, defaults, Scenario MixedLegacy fallback, lexical-parent conflict behavior and diagnostics. Public parser/version acceptance remains unchanged. Use borrowed declaration/unit views over retained per-file ASTs, rather than cloned flattened ASTs or a second ordinary decoder. Existing typed-only lower callers retain their wrapper behavior, including diagnostic precedence.
+
+`lower.rs:113 Lowered` separates model maps from occurrence/expression vectors. Move its typed maps disjointly into Project once; do not retain another typed model. Move these three things into the sealed result **together and unchanged**:
+
+- the one global `Lowered.expressions` arena shared across all files/declarations;
+- the paired occurrence vector, whose `expression` indices address that arena, and each expression's parent-index/Child edge;
+- the canonical numeric-file-key table referenced by both vectors and retained files.
+
+Do not independently sort/compact vectors, join separately numbered per-file arenas or renumber files. Every owner, field, scoped target and original whole-file span retains its meaning. Preserve actual tokens, typed AST, ordinary ordered positions and lexical ownership beside the sites. Numeric arena positions remain private; they are not persistent IDs.
+
+This retained handoff has not performed Index's physical-span, call-site or independent syntax-edge verification. A later typed Index must consume the sealed accepted result, derive names/scoped parameters from complete Project once, and verify original syntax/sites without lexing, lowering or admitting the Project again. Neither the existing numeric-map Index nor its updater is changed in this slice.
+
+## 3. Resource contract
+
+Keep cumulative parsed bytes/tokens/syntax entries/Exact work unchanged. Ordinary active references add once to the existing reference counter. Preserve caller graph/record/step/file/include limits; complete nested model records remain checked at final model admission. Static analysis work remains its existing separate meter.
+
+A private auxiliary ledger tracks checked-add live totals `(entry_slots, occurrence_slots, owned_text_bytes)`. Before allocating or copying an in-scope representation, check the **aggregate of all live reservations** through the inherited Budget: `lowering_entries(total)`, `lowering_occurrences(total)` and `index_bytes(total)`. Overflow or any nonlatching check failure aborts. An allocation move transfers its reservation; copies coexist and both count. Release only when the represented ownership ends. Borrowed text costs zero copied bytes, but its container slots still count. Logical slots do not claim exact allocator capacity or heap/RSS metering.
+
+Entry slots cover syntax/storage metadata, catalog/map/vector/work entries and expression sites. Occurrence slots cover lowerer occurrence records, using the existing entries-plus-reference ceiling. Each slot belongs to one domain. Owned text covers all separately owned in-scope String bytes, including copied keys, paths and retained diagnostic text. Original source bytes are borrowed and already cumulatively admitted; they are not recounted as copied auxiliary text. The auxiliary byte ceiling is distinct from cumulative source bytes.
+
+| Representation / lifetime | Required reservation |
+| --- | --- |
+| Retained syntax, tokens, positions, file references and lexical ownership | Fixed all-file baseline: retain/reconstruct mixed metadata subtotal, plus parsed syntax-entry storage. Avoid counting tokens/positions twice. Existing dropped value-end-map subtotal may remain a conservative overestimate. Sum owned strings by a bounded walk of parsed structures, not a source rescan; counting scratch reserves before growth. Baseline stays live in accepted result. |
+| Complete catalog, ordinary alias projection, diagnostic location registry | Count every distinct map/set/container entry; reserve owned key copies before cloning. Borrow names where existing APIs permit. Projection drops after ordinary construction; catalog drops after lowering once retained locations no longer depend on it. |
+| Ordinary construction coordination | Borrowed ordered occurrence/file views and deferred-node vector reserve before growth. Nodes move into diagrams; coordination storage then drops. The active-reference hook below runs before field cloning. |
+| Typed lowering | Reserve lower occurrence/expression sites and Resolver work/temporary structures before growth across all files. Site vectors and their reservations remain in the accepted result; temporary work reservations end after use. Model maps move once. |
+| Diagnostic mapping and retention | Source mappings, output/retained diagnostic containers, related-location entries, transferred retained strings and newly copied strings share the still-live syntax/sites/locations reservations. Reserve before copy/insertion/retention. Compute line/Unicode column from borrowed file prefixes, or reserve any new cache explicitly. |
+
+This is **auxiliary** accounting, not preallocation admission of every ordinary serde/model allocation. Existing architectural validation, its indexes and its produced raw `Vec<Issue>`/issue-owned strings are explicitly outside this preallocation ledger, as are the architecture/wire allocations excluded by the static meter. An optional cap checked after raw Issue production is only post-production checking. A raw Issue vector must not remain uncharged in the accepted witness: map/move its contents only after acquiring retained reservations, or drop it. Transferring a String avoids a copy but still requires its new retained reservation; copying requires an additional reservation before the copy. If mapped/retained storage cannot fit, return a resource failure, not a success with truncated warnings.
+
+Retained caller max_records/max_graph_objects are enforced on complete Project before success. Deferred nested model checks are not described as preallocation checks. These exclusions must remain visible in code documentation and evidence; neither this ledger nor static events constitutes whole-resolution CPU/allocation metering.
+
+## 4. Active ordinary reference reservation
+
+Add a narrow private hook at the start of each ordinary declaration's construction iteration, **before** the existing `fields.iter().map(Ast::resolve).collect()` and any resulting JSON/model vectors. Borrow witnessed arrays selected by DeclKind and these exact existing body/tag paths:
+
+| Declaration | Active ordered array |
+| --- | --- |
+| Process, FunctionalChain, Scenario element | top-level `steps` |
+| Occurrence element | `body` → externally tagged `Branch` object → `occurrences` |
+| ContextualLink relation | `source.references`, then `target.references` |
+
+These selectors mirror `ParseLimits::check_model` and `ElementBody::steps`. In declaration/item order, charge each occurrence once through the retained `Budget.reference`, including repeated targets and UUID items as well as @references. Charge neither unique-target count nor separate per-file allowances. Locate refusal at the first unaffordable item in its original file; use stored extent or an explicit item-start/field fallback.
+
+Absent/default-empty arrays cost zero. For malformed shapes, conservatively reserve recognizable active arrays and let existing conversion diagnose invalid shapes/items; do not add a decoder just for accounting. A private resource failure can precede malformed-item conversion. Existing public wrappers retain ordinary behavior through a no-op hook.
+
+Exclude scalar parent/owner, endpoint occurrence, purpose fields, unrelated arrays named references, already charged typed fields and **all historical Trace baseline snapshots**. Baseline/model storage still participates in final model limits. The counter therefore equals parsed typed references plus active ordinary steps/contextual-chain items. Final check_model validates the complete model without charging that counter again.
+
+## 5. One admission route, complete warnings and locations
+
+After checked merge and complete model limits, use a narrow shared internal validator route, shared by mixed resolution and the existing `validation::validate` wrapper. Run `admit_structure_checked` once. On success, extract owned static limits/usage, drop the Project-borrowing environment, then run `validate_structure` once and preserve its complete raw warning/error result for mapping. On static failure preserve existing short-circuit behavior. Do not additionally call `analysis::admit`, which would repeat static/architecture work. Existing standalone admit/validate public behavior must remain compatible; no cached/self-borrowing environment enters the new witness.
+
+Static limits use the existing declared profile and must be recorded with usage; they cannot silently replace or reset the syntax/model policies. A shared internal result carries successful static metadata and complete issues to mapping. Architectural Issue production has the exclusion in §3; subsequent mapped/retained allocation does not.
+
+Retain every warning on successful acceptance. Any error refuses the witness. Locations cover ordinary and typed globals plus calculation-scoped parameters/fields, using actual canonical file ownership and full-file offsets. Preserve typed failure file keys and ordinary occurrence mapping. An unmapped semantic field falls back to its owning declaration explicitly. Never choose a file by coincident local byte offset, globalize ParameterId or fabricate a precise field span.
+
+## 6. Discriminating acceptance oracles
+
+All are requirements for authored fixtures and execution, not reported results. Expected models, spans, warning content and thresholds must be independently stated; formatting/lowering the tested input cannot generate its own oracle.
+
+1. **Complete bidirectional model:** tiny OA and SA bundles with ordinary node→later typed property and typed subject→later ordinary work element. Compare entire independently built Project, including ordinary defaults, diagrams and definitions. Reordered presentation retains intended semantics and original source ownership.
+2. **Catalog and legacy boundaries:** interleaved ordinary/typed duplicate aliases and IDs, including simultaneous collision and entry-project collision, prove alias-first errors with both locations before insertion. Scoped parameter UUID/global reuse succeeds. Separately preserve source3 scratch migration, current required-field errors, lexical-parent conflict and omitted Scenario viewpoint behavior through unchanged public source3–7 wrappers.
+3. **Full retained-site oracle:** repeated calls with reversed argument-label order, two calculations sharing parameter UUID/name, nested child expressions and coincident local spans in distinct files. Hand-enumerate every `(file, owner, field, parent-edge/path, role, qualified target, original span)`. Resolve private arena positions to these authored structural identities; check every occurrence.expression targets the intended entry. Do not invoke Index or lower again. Include both directions of ordinary/typed references in whole-Project comparison. Model equality alone cannot satisfy this test.
+4. **Inherited and aggregate limits:** hand-count active ordinary lists/chains plus typed references; exact cap succeeds, cap-minus-one rejects before field cloning with the correct item/file. Repeat ordered occurrences and positive parent/baseline exclusions. Two simultaneously live catalog/projection producers each fit alone but exceed aggregate storage together. Different retained nested-record caps distinguish final admission on identical syntax without replacement limits. Parse/Exact counters remain unchanged; reference delta equals the independent active count.
+5. **Admission/diagnostic producer:** one exact warning-only complete model preserves that warning; one static failure and one architecture failure return no witness. A tight mapped-diagnostic storage cap fails while retained syntax/sites remain live, including copied path/text or transferred-string reservation. Instrument the narrow internal route or inspect its control flow to prove one static admission and one architecture pass on success; equal outputs alone do not prove this. Do not call raw Issue production preallocation-bounded.
+6. **Provenance and cleanup:** complete entry/file/path ownership, Unicode/CRLF coordinates, unchanged global arena/file keys, no externally replaceable authorities and no partially usable failed result. Run relevant existing typed-only lower/export, public parser/traversal and small-stack success/rejection/drop controls after shared-code changes. No source8/editing success is inferred from these controls.
+
+## 7. Deferred dependency and scope boundary
+
+Next typed-Index work must account for names, owner/physical/path/call maps and syntax-edge verification tables against the retained ledger, use original SourceBundle/tokens through a private read-only view, and refuse/hide that view from the old numeric-map updater. It must derive names once from complete Project plus scoped parameters, rather than reusing both complete Project and former Lowered model maps. Ordinary occurrences are still not provided by a typed Index.
+
+Public7→8 dispatch/migrations/admission, missing-ID stabilization, ordinary+typed composition against original bytes, output recompile/admission and intended-Project equality, history/checked-save, root Scenario/editor reconciliation and full graphical/textual parity remain coordinated later work. This checkpoint does not claim those capabilities or a complete occurrence index. Parent owns final scope acceptance, decision/publication and gate disposition.

harness/analysis-ordinary-index-20260924/critique.md

@@ -0,0 +1,47 @@
+# Ordinary occurrence successor: independent design critique
+
+2026-09-24. Source-only review of `ORDINARY-SUCCESSOR-MAP.md` against clean private `93eb6117f95353d25d594d59780018f197c51672` in `.local/as3batch`. No source edits, Cargo, runtime claims or Gitea work. Parent owns adoption. Source paths below are relative to `crates/oa-core/src/`.
+
+**Recommendation: proceed with the proposed consumed, read-only authored-name owner and physical-token ordinary keys. No fundamental design flaw found.** The map correctly separates this dependency from editing and full graphical/textual/API parity. The next contract should resolve the few boundaries below; none requires a generic indexing framework or structural ordinary path arena.
+
+## Completeness and provenance
+
+The retained projection is sufficient for the declared authored-name set. `Ast::resolve` resolves every `Reference` through global aliases and rejects references in unsupported field roles (`language.rs:761–820`); ordinary construction recursively resolves every declaration field, with the explicit Trace baseline exception (`:1684–1693`). `semantic_source.rs:13–31` refuses all `@alias` inside historical semantic payloads, while other baseline fields use ordinary resolution (`:87–100`). Therefore walking every retained `EditKind::Reference` covers admitted ordinary authored alias uses, including ordinary→typed targets; do not introduce a second field-name/schema selector or exclude every field named baseline. The existing active-step accounting selector cannot establish this completeness.
+
+The typed family already includes typed→ordinary references. Its qualified parameter names must not enter the ordinary reverse-name table: an ordinary `@x` binds a global x even when a calculation parameter is also named x or reuses its UUID. Implicit lexical parenthood has no editable name token. Project/ordinary/typed headers together must account for every global exactly once; scoped parameter declarations remain typed occurrences. Model-reference enumeration is an unsuitable substitute because defaults/implicit parents/historical IDs can have no authored alias token.
+
+Keep completeness explicitly grounded in sealed projection emission plus independent complete-set tests. Matching token text does not prove an omitted projection record exists. Rechecking an AST/position parallel walk is an optional stronger invariant, not needed to call the immutable emitted set complete under the already accepted trust model. Do not promise arbitrary coordinated corruption rejection.
+
+## Required containment clarification
+
+The phrase field/declaration containment needs a precise exception. `EditDeclaration.fields` is a **synthetic Record** whose span is `body.start - 1 .. body.end + 1` (`language.rs:1129–1135`), including braces. It is deliberately not contained in the body interior. A blanket check that every walked EditValue lies inside `EditDeclaration.body` would reject valid declarations. Validate that synthetic root against the declaration span; apply body/field containment to actual field values and Reference leaves. Start traversal at its Record children if that makes the distinction simpler.
+
+Nested declarations live in the flat ordinary declaration preorder; the parent's `fields` map does not contain child declaration fields (`language.rs:1479–1534`). Pair each retained position with its corresponding declaration occurrence and use that owner, rather than choosing the broadest containing declaration or scanning its entire byte range. Parent and child declaration spans overlap legitimately. This matters for both exact ownership and future movement semantics.
+
+## Project header and reference token contract
+
+Project `SourceHeader.span.start` is exactly the `project` token, after version syntax and any trivia (`language.rs:1437–1471`). A binary search of retained significant tokens, equality with whole Word `project`, and the immediately next whole Word alias gives a sufficient narrow projection; require the span inside that same header and compare its target/name to the retained header Project and complete global catalog. Retain canonical entry-file ownership. No new header parser, substring scanner or manufactured numeric source map is justified.
+
+For each ordinary Reference, require the retained full extent to begin at the whole `@` punctuation token, then require the next significant token to be a Word with the projected alias and global catalog spelling, and require **that Word's end to equal the Reference extent's end**. The parser consumes exactly that pair, including arbitrary intervening trivia (`language.rs:1333–1336`), and the position projection preserves the full consumed extent (`:1068–1084`). Index only the Word span for replacement. This explicit equality prevents an ambiguous oversized extent from being treated as authenticated just because it contains a matching Word.
+
+The proposed observable tuple includes full Reference extent, but the minimal value sketch lists only owner/role/target. Settle that API detail: retaining the full extent as an inline optional Span is inexpensive and useful for the promised diagnostics/oracle; it adds no logical container slot or owned text. Alternatively keep it construction-only and stop promising it in the returned view. Whole-token validation plus physical duplicate detection is sufficient for overlap safety in rename-only output; do not weaken that requirement to substring spelling checks.
+
+## Storage, frame policy and simpler alternatives
+
+The proposed retained delta **1 + D + A entry slots, zero occurrence slots, zero copied text bytes** is sound for one physical-keyed map with inline owner/role/target/spans. Existing typed maps, raw arenas, original syntax and warnings remain charged. Account the reverse global-name table, typed physical lookup and all actual iterative work entries concurrently. A header-coverage set or AST↔position verification table, if added, is extra scratch; it is not free because the source was previously admitted.
+
+Do not add `Budget::frame(walk_depth)` merely to bound the ordinary traversal. The parser's ordinary value policy is already a separate fixed depth64 (`language.rs:1291–1298`), and semantic declaration nesting uses its own flat/open stack. A new mixed-frame interpretation could reject already accepted ordinary input under a tight typed-frame profile. The proposed iterative reference walk needs only aggregate entry-slot reservations for its live work Vec; it creates no persistent structural path or new recursion. Preserve all usage fields for this successor unless a separately justified depth operation is deliberately specified.
+
+Physical keys are the simpler correct choice here: the owner is immutable and later emission consumes original spans. They are snapshot identities, not semantic IDs across edits. Adding field-name Strings and persistent ordinary paths would raise memory and cleanup costs without improving rename completeness; retained EditValue trees remain available for later scalar/structural work.
+
+A plausible smaller alternative is to stream these same sealed ordinary occurrences directly into a later rename planner instead of retaining an N-entry map. That avoids retaining unchanged occurrences while allocating changed edit records. However it fuses discovery, validation and edit intent and makes the complete read-only boundary less independently inspectable. Given the currently unresolved ordinary ownership coverage, the proposed materialized map is justified as a bounded, testable step. Keep the underlying walker private and simple so a future consumer need not duplicate traversal; do not introduce an additional generalized producer/visitor framework now.
+
+## Falsifiers worth carrying into the next contract
+
+- Nested parent/child ordinary elements, each with explicit references, including one explicit parent and one implicit parent: no synthetic-root containment failure, no double indexing through the parent's overlapping span, no invented token for the implicit edge.
+- `@ /* alias-like @noise */ real_alias` with the same spelling in prose/enums/includes: only the final whole alias Word is indexed, exact full extent remains available, and no prose token appears in the output set.
+- Ordinary global x plus scoped parameter x sharing or reusing a UUID: the ordinary reference targets only Global(x); typed `$x` and call labels keep calculation scope.
+- A tiny mixed bundle's complete global header set equals the global name-catalog set exactly, while its repeated references remain separate physical records. Include canonical file order opposite include traversal and identical offsets in two files.
+- Exact `baseline + N + live scratch` boundary and copied-text delta zero, including late failure/drop; depth64 ordinary values remain under the established policy without borrowing the typed structural-frame metric.
+
+The map's later rename-only scope is a useful subsequent milestone, provided its complete-target diff gate, one inherited authority/profile, complete edit membership, single original-coordinate emission, actual-output admission and whole-Project equality remain mandatory. It must not claim ordinary scalar edits, typed subtree changes, parameter insertion/deletion/reorder, repaired deletion/reidentity, file movement, missing-ID stabilization, public migration, history/checked-save or usable UI/API parity. Those user requirements remain the completion criteria beyond this dependency; no alternative final product is implied by accepting it.

harness/analysis-ordinary-index-20260924/source-map.md

@@ -0,0 +1,121 @@
+# Ordinary original-coordinate occurrence successor: source map
+
+2026-09-24. Local-only bounded research by `/root/mixed_index_source_review` (GPT-6 Astra). Parent owns contract adoption, implementation, integration and publication. No source edits, Cargo, runtime checks, or posts. This report does not reopen the accepted typed index.
+
+## Recommendation and evidence version
+
+The next useful dependency is a **private, consumed owner of the complete authored name-occurrence set**: retain accepted `IndexedMixedProject`, add ordinary/project alias headers and every ordinary authored `@alias` leaf, and keep both occurrence families bound to its original complete bundle and inherited ledger. Do this before adapting edit production. It can reuse the retained ordinary position trees without another parser, ordinary decoder, formatter, or new generic indexing framework.
+
+Then implement a precisely gated **global/scoped rename-only** original-coordinate composition route using this owner and one independently supplied complete target Project. Ordinary scalar changes, insertions, type changes and structural moves are later explicit operation families. This sequencing avoids promising that the existing general ordinary producer already obeys a new mixed one-pass protocol. It is a bounded dependency toward full parity, not an alternative end state.
+
+All source references below are relative to the repository at `.local/as3batch`, clean branch `codex/analysis-mixed-index-956atf-20260924`, commit **`93eb6117f95353d25d594d59780018f197c51672`**. References are to `crates/oa-core/src/` unless prefixed `tests/`. Governing root documents read:
+
+- `harness/analysis-mixed-index-contract-20260924.md`, SHA-256 `A344C69068DCE09A9B03BD3002020C87AFC563C7B4CC859522DDA0D4048CD3FB`.
+- `harness/analysis-mixed-project-contract-20260923.md`, SHA-256 `D10D3EB32122FDF0E6570962C98871D6907E9FE59DBD6ECCF00DF64082E7382F`, especially retained syntax/site handoff and aggregate accounting.
+- `harness/analysis-original-span-review-20260923.md`, SHA-256 `F7200342EA280EF96E80914E336AF0203AEAB530A5255E57D10AA8E763DBE05F`, especially exact diff gates, producer normalization, full-snapshot authority and combined output checks.
+
+Recommendations below are proposals for parent adoption. Source facts and inherited requirements are identified separately.
+
+## Source-grounded seam map
+
+| Existing seam | Verified capability and implication |
+| --- | --- |
+| `language/analysis_source/mixed.rs:39`, `:49` | `ParsedMixedSyntax` owns the exact bundle borrow, caller limits, canonical `files`, Budget and metadata; each `FileSyntax` retains full-file significant tokens, ordinary `SourceUnit`, typed declarations, `positions: Vec<(Id, EditDeclaration)>`, and lexical-owner indices. No remapping or duplicate source table is needed. |
+| `language/analysis_source/mixed.rs:316`, `:332`, `:357` | Ordinary positions are already projected once from that file's retained tokens and original AST after aggregate metadata preflight; the complete result retains those positions. Calling `edit_declarations` again would discard this advantage and charge/work outside the witnessed path. |
+| `language.rs:926`, `:943` | `EditDeclaration` has full-file span/body/header-role spans, lexical owner, and a recursive `EditValue` tree. `EditKind` distinguishes Reference, HistoricalUuid, Atom, Record and List. This is enough to enumerate ordinary name tokens and preserve original nesting without reconstructing the generic model schema. |
+| `language.rs:1068`, `:1076`, `:1100` | Projected Reference/HistoricalUuid spans start at the marker and end at the second significant token; ordinary declaration header maps already expose the alias token. Stabilized IDs are required. A Reference's entire span is not the replacement span: it can contain `@`, whitespace and comments. |
+| `language.rs:895`, `:1437` | `SourceHeader` records the project/header/body/description but no header-role token map. Project alias is the one missing small position projection. Its original header start and complete token stream are already retained. |
+| `language.rs:761`, `:782`, `:799` | Admitted ordinary `Ast::Reference` resolves through the global alias catalog; quoted strings in reference fields are refused. Arrays and records recurse through the same resolver. Ordinary live name uses are not guessed from arbitrary strings or UUID-looking text. |
+| `language/semantic_source.rs:13`, `:34`, `:87` | Semantic Trace baselines reject `@alias` and require historical `uuid "..."` in typed reference slots. Those UUID leaves are not current alias references. Other baseline fields pass through ordinary resolution; the occurrence walker should follow actual `EditKind`, not blindly exclude every field named baseline. |
+| `language/analysis_source/mixed/project.rs:38`, `:43`, `:83`, `:91` | The accepted typed index consumes its resolved witness; the output retains original bundle, canonical files and complete qualified names. A private child module beside this owner can borrow retained fields during construction without exposing replaceable provenance. It need not create a legacy numeric-map Index. |
+| `language/analysis_source/mixed/project.rs:405` | `active_references` only meters selected steps/occurrence/contextual-chain arrays. **It is not a completeness selector for alias occurrences.** Scalar parents, view references, route endpoints, artifact owners and trace endpoints also need rename occurrences. Reusing this hook would omit valid ordinary uses. |
+| `source_project.rs:93`, `:417` | Public `SourceIndex` catalogs declaration/body/field/include locations and lexical ownership, not all name/reference tokens. Its fields are public. It is neither the missing occurrence index nor a trustworthy mixed constructor input. |
+| `source_project.rs:640`, `:647`, `:735` | The public updater recompiles mutable public state, then reparses every original file with `edit_declarations`. It formats old/new declarations and parses those formatted texts to produce a generic syntax diff. This route cannot simply be called on private mixed source8. |
+| `source_project.rs:1043`, `:1075` | `SyntaxUpdate::value` already demonstrates correct preservation for Reference→Reference: replace the last significant alias token only. Reuse that behavior, using retained full-file tokens; do not copy its per-fragment `significant()` rescanning into the new index. |
+| `source_project.rs:1104`, `:918` | Other syntax-kind changes erase individual significant tokens and insert replacement text at the same original start, retaining trivia. Their insertion/deletion pairs do not obey a blanket no-shared-boundary rule without producer-local normalization. This is why rename-only is a precise first scope. |
+| `source_project.rs:539` | Existing `apply_edits` groups every equal `(start,end)` span by concatenating replacement strings, then applies backwards. That permissiveness is not an acceptable cross-producer authority rule for duplicate nonempty replacements. |
+| `source_project.rs:868`; `source_project/source_structure.rs:34`, `:61` | Ordinary scalar edits are applied before the structural updater reparses their result. Those structural spans are in later coordinates. Preserve this public behavior until a separate verified integration replaces it; it is outside the original-coordinate one-pass proof. |
+| `language/analysis_source/update.rs:78`, `:118`, `:169`, `:227` | Existing typed Plan/Composition cleanly separate complete name/edit membership validation from standalone output length checks, but still require legacy `Index` and caller numeric sources/Budget. Their algorithm is useful; their nominal input authority is deliberately incompatible with mixed input. |
+| `source_project.rs:877` | Existing final acceptance recompiles actual emitted bytes and compares the entire resulting Project to intent. The private mixed route needs the equivalent complete parse/resolve/admission/equality boundary, with no public source8 dispatch implied. |
+
+The retained scanner in `language/analysis_source/lex.rs:18` charges raw tokens, including trivia, and retains significant token spans. Reference indexing can therefore binary-search the original `@` token, require the immediately following significant token to be a Word with exact catalog spelling, and preserve all intervening comments without allocating a new token stream.
+
+## Proposed next-index contract
+
+### Scope and ownership
+
+Consume the accepted typed-index owner into another private nominal wrapper, or use an equivalent internal consumed construction step that retains all its fields. Name its capability precisely: complete **authored name occurrences**, not complete scalar/structural editing authority. No public or sibling-fabricable input accepting a Project, token table, occurrence list, source remap or replacement Budget. Do not clone the existing catalog or typed maps; move/retain them once. Avoid self-references: new records own IDs, roles and spans; temporary reverse catalog maps borrow names only during construction.
+
+The new ordinary set consists of:
+
+1. The project alias header, once.
+2. Each ordinary declaration alias header, once, including elements, relations, diagrams, nodes/placements, artifacts and traces actually represented by those declarations.
+3. Every `EditKind::Reference` in every ordinary declaration field tree, including nested records/lists and repeated equal targets. Resolve each spelling to `Target::Global` through the already admitted complete catalog, which includes typed globals. Ordinary references never resolve through parameter-only name entries.
+
+It excludes display names, descriptions, comments, string literals, enum words, include path strings, declaration identity strings and `HistoricalUuid` leaves. Implicit lexical parenthood is a semantic relation with **no alias token**; do not manufacture a reference for it. Explicit `parent @name` is an ordinary reference and must be indexed. Current mixed syntax permits nested ordinary declarations but explicitly refuses typed headers nested in ordinary bodies (`mixed/tests.rs:448`); do not widen that grammar as part of indexing.
+
+### Minimal construction/verification
+
+- Iterate canonical files and their retained ordinary positions. Check the declaration position/ID/header against the corresponding sealed ordinary declaration rather than resolving owner from a coincident offset or the outermost enclosing span. Nested parent declaration spans overlap child spans, so broad range scanning is not a valid ownership rule.
+- Use the existing ordinary header alias span. Project header needs only a narrow retained-token projection anchored at `SourceHeader.span.start`: validate `project`, the following whole alias token and its equality to the retained Project alias. There is no need to call `edit_header(source_slice)`, which lexes again (`language.rs:951`), or build a second complete header grammar. A shared borrowed token-role helper is reasonable only if it remains small and preserves ordinary parser behavior.
+- Walk `EditValue` Record/List iteratively, reserving each live walk slot. An encountered Reference must have valid UTF-8 full-file range, marker `@`, precisely the expected following whole Word alias token and canonical target spelling. Store/edit the alias token span alone. Track the owning declaration and retain its original file. Require field/declaration containment where justified; do not confuse overlapping declaration bodies with reference ownership.
+- Reject duplicate physical token ownership across the combined typed and ordinary sets, including ordinary headers. Count the project header and every global declaration exactly once across the two producer families. A reverse global-name map excludes scoped parameters and borrows the existing names.
+- Continue using explicit safe fallback diagnostics for an unowned/invalid numeric file or malformed span. No panic-prone slicing during error transport. Failure consumes/drops the whole attempted owner and exposes no usable partial index.
+
+Completeness is obtained by exhaustive traversal of the sealed retained parser projection and independently authored output oracles. The existing parser/projection is the trusted emission source. A new reference map does not, by itself, prove arbitrary damage that consistently removes the same reference from retained AST and position tree. If runtime detection of arbitrary projection omissions is required, specify a separate AST↔position walk and account for it; do not silently claim that a token-spelling check proves it.
+
+### Key representation: consequential but bounded choice
+
+| Candidate | Tradeoff against requirements |
+| --- | --- |
+| One ordinary map keyed by canonical `(file, alias-token start, alias-token end)`, values contain declaration owner, Header/Reference role and global target | Recommended for this snapshot-bound rename dependency. Repeated references remain distinct; deterministic physical ordering is immediate; keys need no copied field strings or new path tree. Identity is explicitly ephemeral to this exact immutable snapshot, never a persistent model/command identity. Retained EditValue trees remain the richer structural source for later operations. |
+| Owned structural ordinary keys with record-field/list-index path, comparable to typed paths | Better for structural diagnostics and future field editing, but adds a new edge type, persistent-path storage/drop policy, field-name ownership and duplicated tree metadata before a consumer requires it. Reconsider when a concrete scalar/subtree editing contract needs stable structural keys; list indices still do not supply semantic row identity across edits. |
+| Reuse generic `SyntaxUpdate` as the ordinary index or run public `update_bundle` | Produces broad changes but reparses/formats, lacks retained occurrence authority and includes later-coordinate structural processing. Rejected as the next private original-coordinate seam. |
+| Scan all original Word tokens for catalog names | Superficially small but changes prose/enums/include/header roles incorrectly, cannot establish owner and cannot distinguish historical semantics. Reject. |
+
+Do not force ordinary roles/keys into typed `Field`/`Child` enums. Two sealed occurrence families can share checked source/token lookup and physical-edit validation without a public generic indexing framework. Any helper extraction must leave the accepted typed semantics intact.
+
+### Aggregate storage proposal
+
+Continue the retained mixed Ledger/Budget; accepted typed maps and raw arenas remain live. If the recommended one-map representation has D ordinary declarations and A ordinary Reference leaves, its additional retained entry count is **`N = 1 + D + A`**, zero new lowerer-occurrence slots and zero new owned-name bytes. This formula assumes inline owner/role/target/span records and no copied structural path. Any extra retained map/vector must be added explicitly.
+
+Scratch must include the borrowed reverse global-name map Gg, an efficient cross-producer physical-token lookup for T existing typed locations if used, live iterative walk slots W, and any owner/header/AST↔position validation table actually allocated. A design can use the new map itself for ordinary duplicate-token detection and a T-slot scratch set for typed collision lookup; there is no need to retain a second ordinary physical set. Then a conservative simple peak is baseline plus `N + Gg + T + W`; actual prefix/phase peaks must be hand-counted for cap tests. This is a proposal, not a measured cap.
+
+Reserve before every growth/copy; release scratch only after its allocation is dropped. Borrowed names require map entry slots but no copied text charge. New index records belong to entry slots under the existing contract; do not recharge the old `Budget.reference` parser/active-step counters or lowerer occurrence domain. Do not call `Project::identities()` merely to build another name Vec. If structural keys are chosen instead, inventory their owned field strings and unique path nodes before accepting the alternative.
+
+The ordinary tree was already admitted under its existing depth policy; an iterative reference-only walk need not introduce a new frame interpretation. Preserve inherited frame limits, never widen them, and do not confuse live work-slot reservations with `Usage.deepest_frame`. If an explicit depth check is added, specify whether it uses original ordinary depth or a structural path depth; `Budget::frame` may update the high-water mark, but index scratch does not change parsed byte/token/entry/reference counts. The existing baseline, raw typed arenas and typed persistent Path reservations must survive unchanged throughout this successor.
+
+## Subsequent rename composition seam
+
+This section establishes dependencies, not permission to broaden the next index patch.
+
+1. **Single intent:** derive global aliases and calculation-scoped parameter names by stable identity from one complete target Project and the complete source owner. Validate final global/scoped namespaces simultaneously, permitting swaps. Do not accept independent ordinary and typed final-name maps that can disagree.
+2. **Exact diff gate:** for the first rename route require equality of every old/new Project part except the expressly allowed aliases/parameter names. Global IDs/categories, parameter IDs/order/types, all expressions/bindings/subjects, arrays/order, geometry, names/descriptions, baselines, ownership and all other fields remain equal. Do not silently ignore a scalar change because no occurrence changed. An explicit gate is narrower and clearer than the phrase topology-preserving. The comparison strategy should be chosen before implementation; copying/masking a whole model has allocation implications, while borrowed structural comparison needs complete field coverage.
+3. **One owner/profile:** keep the complete entry, canonical paths, file set, bytes, caller limits, complete old model and index authority bound together. A batch from a different owner cannot be installed merely because touched token bytes or numeric keys match. Bind producer objects to this owner rather than weakening legacy `Index` typing. The existing borrowed `OriginalEdit` is only an inspection record (`update.rs:292`), not transferable authority.
+4. **Small shared algorithms:** reuse/extract private final-name validation, token-membership and edit-order/completeness logic from `update.rs:35`, `:79`, `:117` behind authenticated wrappers when implementing composition. Keep legacy `Plan` behavior and its standalone output preflight. The mixed route must use aggregate live plan storage against its retained ledger, not simply inherit old per-map checks or build a temporary numeric-source `BTreeMap` copy.
+5. **Original edits only:** both families produce alias-token replacements in original file coordinates. This rename-only set has nonempty whole-token ranges and needs no zero-width insertions. Reject duplicates/overlaps across producers; every changed target's entire authenticated occurrence set must be present, including ordinary→typed and typed→ordinary references. Preserve all other bytes exactly.
+6. **Combined preflight/output:** count retained plan records, owned replacement names and scratch before allocation; then compute complete combined per-file and aggregate output lengths, including unchanged files, before constructing output. A shrink may compensate output growth, but cannot erase live source/index/plan storage or prior parse/numeric costs. Emit each file once from original bytes in ascending span order. No `Plan::apply` typed-first intermediate followed by ordinary offsets.
+7. **Actual result acceptance:** parse/resolve/admit the emitted complete bundle under the retained policy and compare the entire Project to the independent target. Return/install nothing on failure. New output gets its own bounded parse pass; do not reset original usage to hide redundant work. Public source8, checked-save/history and GUI activation are later gates.
+
+When adding ordinary scalar operations, define exactly allowed leaf/header forms and a reviewed same-producer normalization for type changes and ordered insertion groups. `SyntaxUpdate` has comment-preserving behavior worth retaining, but its current compound edits require that extra contract. Never relax duplicate/overlap rules globally to accommodate one producer. When adding structural movement/deletion, redesign composition of its ownership pieces in original coordinates or provide a separately verified transformation; the current reparse-after-scalar phase is not evidence for one-pass original-coordinate correctness.
+
+## Required independent evaluators and concrete risks
+
+For the proposed **read-only ordinary occurrence index**:
+
+- Hand-enumerate every ordinary/project header and every Reference tuple `(canonical file, owner, role, global target, full reference extent, alias-token span, spelling)` in tiny OA and SA mixed bundles. Include interleaved typed roots, nested ordinary declarations, explicit and implicit parents, reversed include traversal versus canonical file order, coincident offsets across files, Unicode/CRLF and same-spelling comments/prose. Compare complete sets, not selected counts. Expectations cannot come from builder, formatter or lowerer.
+- Extend the current independent rich fixture (`mixed/project/tests.rs:253`): its `node n` references ordinary diagram d and typed property v, while typed property v refers to ordinary work w. Enumerate ordinary project/node/work/diagram headers and references in addition to the already accepted typed maps. Shared parameter UUID/global identity remains distinct and cannot enter the ordinary reverse alias map.
+- Add category/shape coverage beyond that small fixture: relation endpoints and nested contextual chains, diagram routes/view options, artifact owner, live trace endpoints, nested records/list repeats, and semantic historical UUIDs that coincide with a renamed live target. The latter must remain absent from alias occurrences. Include paths and display/prose alias text stay untouched.
+- Prove `@ /* comment */ alias` indexes only the alias token and preserves marker/trivia; test wrong marker, non-Word token, partial alias range, wrong name/global target, duplicate physical token, owner/file mismatch and UTF-8-split/out-of-range locations reaching intended checks. Distinguish per-record corruption checks from sealed-emission completeness assumptions.
+- Hand-count retained N and peak scratch with accepted typed/maps/syntax baseline still present. Exact cap and cap-minus-one must isolate index growth, not an earlier parse. Parse bytes/tokens/entries/references/Exact work remain unchanged; any frame metric change must have an explicit permitted reason. Success and representative late failure/drop run on the existing small-stack harness.
+- Preserve exact bundle pointer/bytes/entry/file keys, entire Project, warnings and static admission metadata; no mutable authority or legacy updater conversion escapes. Run only affected existing suites after implementation; retain explicit inherited failure dispositions.
+
+For **later rename composition**, separately require exact authored whole-output oracles: simultaneous global/scoped swaps; repeated/reordered typed calls; both reference directions and untouched unrelated files; project/ordinary/typed header renames; same-name no-op; comments/prose/historical UUID unchanged; mixed growing and shrinking replacements with exact combined output cap; stale entry/path/unrelated file; cross-owner batch pairing; missing/duplicate edits and forged physical positions; target containing any unsupported change; and atomic late failure. A parseable/admissible damaged result must fail whole-Project equality, so earlier parse errors do not stand in for the equality gate.
+
+Existing public regression anchors (same commit, under `crates/oa-core/tests/`) are `source_project.rs:496` cross-file alias uses, `:843` exact CRLF/scalar/header preservation, `:877` comments after `@`, `:926` kind changes, `:999` scalar/record conversion, `:1030` reference reorder comments; `source_identity_updates.rs:37` origin ownership and `:81` identity swaps; `source_nested_updates.rs:49` nested token preservation and `:244` nested identity/alias swap plus cross-file movement. These demonstrate existing behavior to preserve, not proof that the new private route already supports those broad edits.
+
+## Remaining choices and completion boundary
+
+Parent should settle ordinary key identity and the exact read-only output surface before implementation. The recommended physical-token key is enough for rename completeness and does not claim semantic identity across edits. Decide whether runtime AST↔position omission verification adds justified value beyond sealed origin plus independent oracles. Either choice must state its guarantee and charge its scratch; it must not be inferred from a misleading test name.
+
+Once this index is accepted, the highest-value next milestone is the precisely gated complete-target rename compositor with actual emitted-bundle admission/equality. Scalar editing, typed subtrees, parameter insertion/deletion/reorder, repaired deletion, reidentity, file ownership/movement, missing-ID stabilization/reindexing, migration, history/checked-save and GUI/API parity remain required. Neither the index nor a private rename milestone completes source8 or the user-owned project specification.

harness/analysis-ordinary-index-contract-20260924.md

@@ -0,0 +1,147 @@
+# Complete authored-name occurrences: private successor contract
+
+Accepted bounded design, 2026-09-24, based on private source
+`93eb6117f95353d25d594d59780018f197c51672`, after parent source inspection,
+[seam research](analysis-ordinary-index-20260924/source-map.md) and
+[independent critique](analysis-ordinary-index-20260924/critique.md).
+Issue 7 owns work status. This does not alter prerelease source `715036e`.
+
+The user requires complete graphical/text/API parity. This dependency adds
+ordinary name occurrences to the accepted typed index, followed by a separately
+specified rename compositor. It does not redefine parity as renaming, activate
+public source8 or claim scalar/structural editing support.
+
+## Chosen capability and alternatives
+
+Consume `IndexedMixedProject` into an opaque private owner that retains it and
+one ordinary occurrence map. The owner provides read-only views of original
+bundle/files, complete Project, warnings, existing typed maps and new ordinary
+records. No mutable replacement state, legacy Index/updater conversion, public
+factory from loose parts or independently transferable edit authority.
+
+Use physical keys `(canonical file, alias-token start, alias-token end)` for the
+new map. Each inline value contains owning declaration ID, global target ID,
+Header/Reference role and the original full occurrence extent. For headers the
+extent is the alias token; for references it includes `@` and intervening trivia.
+These are snapshot keys, not persistent semantic identities. Preserve the richer
+retained position trees for subsequent structural work. Do not force ordinary
+keys into typed expression `Field`/`Child` types.
+
+This materialized map makes complete coverage inspectable before edit authority
+is added. A fused traversal/rename planner could avoid retained map slots, but
+would combine still-uncertain ownership coverage with intent/diff/output logic.
+Revisit that tradeoff only after evidence demonstrates a useful simplification.
+Owned structural key paths would duplicate retained metadata without a current
+consumer and introduce extra string/path/drop accounting; defer them. Whole-word
+source scans and public `SyntaxUpdate` are unsuitable: the former cannot identify
+reference roles; the latter reparses, formats and later applies structural edits
+in transformed coordinates.
+
+## Complete scope
+
+Add exactly one project alias header, each ordinary declaration alias header,
+and every actual `EditKind::Reference` leaf in every ordinary declaration field
+tree. Include scalar and nested/list references, repeated targets, routes/view
+options, artifact/trace endpoints and references from ordinary syntax into typed
+globals. Resolve only through `Target::Global` names in the existing complete
+catalog; scoped calculation parameters never enter this reverse lookup.
+
+Exclude comments, descriptions, display names, string literals, enum words,
+include paths, identity strings and `HistoricalUuid` leaves. Do not exclude a
+whole field by name merely because some fields use historical references.
+Implicit lexical parenting has no authored alias token; explicit `parent @x`
+does. Preserve the existing restriction against typed declarations nested in
+ordinary bodies. Do not use `active_references`: it only meters selected ordered
+model-step references and is not an alias occurrence selector.
+
+Typed occurrences stay unchanged. Across both families, every global declaration
+header appears once and no physical alias token has two owners. Parameters keep
+their existing calculation-scoped identity even when UUIDs coincide with globals.
+
+## Construction and verification
+
+Reuse sealed `FileSyntax.positions`, ordinary AST and original significant
+tokens. No reparse, fragment lexer, source mask, model copy or formatter.
+
+1. Iterate canonical files and their ordinary declaration/position pairs. Check
+   matching IDs, owner and header containment against that declaration occurrence.
+   Nested declaration spans overlap: their parent range cannot determine ownership.
+2. Project header lacks a role map. Project only its alias from retained tokens
+   anchored at `SourceHeader.span.start`: require `project`, the following complete
+   Word token, containment in that header and exact admitted project spelling.
+   Ordinary header alias spans already exist; verify complete Word identity and
+   the corresponding global declaration before insertion.
+3. Walk Record/List values iteratively. The synthetic root `fields` span includes
+   braces (`body.start-1..body.end+1`); do not require it inside the body interior.
+   Actual field/value/reference spans must remain within their justified parent
+   and owning declaration. Nested declarations are separate flat occurrences,
+   not children discovered through broad span scans.
+4. For a Reference, require a valid original UTF-8 extent and a significant `@`
+   token at its start. The next significant token must be a whole Word whose end
+   equals the retained Reference end, spelling equals the retained reference,
+   and global catalog target agrees. Store only that Word as the alias location,
+   retaining the full extent inline. Comments/whitespace between marker and Word
+   remain outside replacement authority.
+5. Reject duplicate physical alias tokens across ordinary and typed families,
+   repeated declaration headers, wrong owners/files/targets, partial or malformed
+   tokens, and absent global headers. Full-token validation makes separate
+   overlapping partial-token ownership invalid before insertion.
+6. Failure drops the consumed attempt with no partial owner. Preserve known
+   canonical file attribution. Invalid file keys or invalid UTF-8 spans use the
+   explicit safe diagnostic fallback already established by the typed constructor.
+
+Completeness relies on exhaustive traversal of the sealed parser projection,
+checked against independent full-set oracles. Do not add another AST/position
+emitter merely to claim runtime detection of arbitrary coordinated corruption.
+Per-record validation does not prove arbitrary omissions from trusted emission;
+name this boundary accurately in tests and documentation.
+
+## Storage and depth
+
+Retain the entire inherited ledger, typed maps/paths, raw arenas, syntax and
+warnings. With D ordinary declarations and A reference leaves, the one-map design
+adds exactly **N = 1 + D + A entry slots**, zero lowerer occurrence slots and zero
+owned-name bytes. IDs, roles and two spans are inline. Added retained containers
+or copied strings would require a revised explicit accounting decision.
+
+Count the borrowed reverse global map G, typed physical-location lookup T and
+all live iterative work slots W as scratch entries. A header-seen flag can live
+in each reverse-map value; avoid an uncounted extra set. New-map membership
+handles ordinary duplicates. Conservative coexistence is inherited baseline plus
+`N + G + T + W`; tests must hand-count actual phase peaks, not assume this upper
+bound is always simultaneously reached. Reserve before growth, and release only
+after the corresponding allocation is dropped.
+
+Do not recharge parsed bytes/tokens/entries/references, Exact work, raw lowerer
+occurrences or model-step counters. The ordinary tree already satisfies its
+depth-64 parser policy. This iterative reference walk introduces no new
+`Budget::frame` interpretation or raised limit; parsed Usage remains unchanged.
+Workspace stack/lifecycle guarantees remain bounded by actual tested cases.
+
+## Acceptance before subsequent edits
+
+Independently enumerate complete header/reference records for small OA and SA
+mixed bundles, including both reference directions, nested ordinary declarations,
+explicit/implicit parents, noncanonical include traversal, coincident cross-file
+offsets, Unicode/CRLF, marker comments and alias-like prose. Extend the accepted
+rich fixture and separately cover ordinary categories absent from it: relation
+endpoints, contextual chains, routes/view options, artifacts and traces, including
+historical UUIDs equal to live identities. Expected maps must not derive from the
+index, formatter or lowerer.
+
+Require targeted corruptions to reach the intended marker/token/target/owner/file,
+physical uniqueness and safe diagnostic checks. Hand-count retained and peak
+storage with typed baseline still live; isolate exact-cap/cap-minus-one failures
+from earlier parsing. Preserve complete Project, bundle identity/bytes/entry,
+canonical file keys, warnings, static admission metadata and parse/numeric usage.
+Exercise success and late failure on the existing bounded-stack harness. Retain
+all prior typed-index outcomes and explicitly report inherited full-suite/format
+failures. No public API or source8 activation is part of this change.
+
+The next separate contract must gate a complete independent target Project to
+allowed global/scoped renames only, validate final namespaces simultaneously,
+produce both families' complete nonoverlapping edits in original coordinates,
+preflight combined storage/output including untouched files, emit each file once,
+then parse/resolve/admit actual output and compare the whole Project to intent.
+Scalar changes, structural moves, insertion/removal, reidentity, stabilization,
+migration, history/checked save and UI/API parity remain required later work.

harness/analysis-original-span-proposal-20260922.md

@@ -0,0 +1,76 @@
+# S3 original-span composition proposal
+
+**Proposal, not an accepted decision or implementation.** Read-only source inspection on 2026-09-22: private analysis `1b1c3e3abb6fc3d0934c9dbfbd21fddc8ae4f594` in `.local/ai3`; ordinary updater at root `4ffff0d9d94bd1875e6b316b84ac11e5c5c9657c`. No compiler, source mutation, public activation, metamodel change or critic delegation. Parent owns adoption/integration.
+
+Requirements come from `harness/analysis-source8-20260913/analysis-source8-repair-design-r2-20260913.md`, “Source pipeline and exact editing,” and the S3/S2 handoffs `.local/analysis-source8-s3-index-handoff-20260913.md` / `.local/analysis-source8-s2-implementation-plan-20260913.md`. Earlier plans describe intended interfaces; the implementation facts below take precedence for what currently exists.
+
+## Observed seams and smallest useful scope
+
+Private `analysis_source/update.rs` already retains qualified occurrence keys and original locations, validates complete simultaneous final namespaces, exact original numeric-file map/bytes, token spelling, complete required edit membership and overlap. It exports only whole-file `Plan::apply`. `Index::parse` consumes typed-only files; `Index::build` is private and trusts its own lowerer's occurrence completeness. `Writer::expression(owner, field, expr, Parent)` exists for later subtree changes; a rename needs no writer invocation.
+
+Root `source_project.rs` already collects ordinary original-coordinate `Edits = BTreeMap<LogicalPath, Vec<(Span, String)>>` before `apply_edits` (lines271,679,1050). `SyntaxUpdate` uses complete old/new comparison values plus separate compact insertion values; preserve that distinction. Project-header slices explicitly add the header's file offset once. Current `apply_edits` groups identical spans by concatenating text, including nonempty replacements, and validates/mutates one file at a time. That is not a sufficient mixed-producer validation boundary.
+
+After scalar application, `source_structure::update` can reparse and relocate pieces using updated coordinates; it returns immediately when no structural change is needed. Therefore the first integrated slice should explicitly cover stable-ID, topology-preserving global/scoped renames and ordinary scalar edits with disjoint ownership. Reject/defer additions, deletions, moves, reidentity and typed subtree changes at this slice's entry. The existing public updater keeps its current broader behavior until those operations have a compatible composition design; do not claim that its structural second phase already uses the new single-application protocol.
+
+## Two candidates
+
+| Candidate | Preservation and ownership | Cost / limitation |
+| --- | --- | --- |
+| A. Opaque validated typed edit batch + bundle-owned compositor | Keep Index/Plan provenance; ordinary and typed producers own disjoint spans in one original snapshot. Existing ordinary complete/compact semantics stay in place. | Small adapter and merge boundary; genuine mixed parsing and shared budgets still required before public use. Recommended first slice. |
+| B. Replace both producers with one shared semantic edit-plan/AST representation | Could eventually centralize token, subtree, insertion and relocation ownership. | Requires migrating ordinary EditValue/SyntaxUpdate, structural comment ownership and typed paths at once; substantially more compatibility risk before the first rename benefit. Revisit only when demonstrated structural composition needs justify it. |
+
+Applying typed output before ordinary offsets is invalid under either design. Canonicalizing a mixed file as a bridge would destroy required authored preservation.
+
+## Candidate A: concrete interface and file plan
+
+1. **`analysis_source/update.rs`: export an opaque borrowed batch.** Proposed signatures are sketches, not existing APIs:
+
+   ```rust
+   Plan::validated_original_edits(&self, current, budget)
+       -> Result<ValidatedRenameEdits<'_>, Error>
+   ValidatedRenameEdits::iter(&self)
+       -> impl ExactSizeIterator<Item = OriginalNameEdit<'_>>
+   ```
+
+   `OriginalNameEdit` exposes read-only `location: {file, original_span}`, `original: &str`, `replacement: &str`, and `occurrence: &OccurrenceKey`. All fields/constructors remain private with getters; records and batch borrow the Plan/index. Validate the whole batch before returning it. The bundle collector accepts the batch itself and iterates every record; it does not accept a caller-selected subset as a complete rename. An empty/no-op batch is valid. Revalidate complete source equality at final application, not merely iterator construction.
+
+   Factor today's `validate` into (a) ownership/spelling/order/completeness validation and (b) output-length preflight. Keep standalone `Plan::renames`/`apply` behavior. For mixed planning, add a narrowly named composition constructor sharing (a), without checking a fictitious typed-only intermediate output size. Otherwise a typed expansion can be rejected even when a simultaneous ordinary shrink makes the actual final bundle fit. Plan-record/name-memory bounds still apply before allocations, and final combined-output bounds are mandatory. Do not use a fresh Budget to bypass the intermediate check.
+
+2. **`source_project/original_edits.rs` (new private module): bind and merge.** A `SourceSnapshot` borrows the complete original `SourceBundle`, including entry path and every file. A private file table maps each numeric typed file key to exactly one canonical LogicalPath from that snapshot, fixed by the parse session. No recomputation from a different traversal and no caller-supplied unchecked file map. The collector stores typed provenance and ordinary owner/role beside each borrowed/owned replacement until validation completes.
+
+   Collect ordinary `(span, text)` records through an internal adapter that records their expected original substring and source owner; typed records retain their full qualified key. Ordinary owns ordinary headers/fields/references and project header/description; typed owns typed headers and typed occurrences, including references to ordinary targets. Explicitly exclude typed declaration spans from generic SyntaxUpdate so both producers never independently own the same token. A shared physical span is a collision, not a deduplication opportunity.
+
+   Preflight every file before allocating output: exact entry/files/bytes equality, known mapped file, half-open UTF-8 boundaries, expected old bytes, producer ownership, complete typed set, checked counts/text sizes, sorted disjoint spans, per-file and aggregate final lengths. Reject duplicate nonempty ranges even when their replacements agree. Initially reject ambiguous insertions at a replacement boundary and multiple insertions at one position; existing ordinary insertion groups can enter only after their producer explicitly coalesces them in a defined order into one witnessed insertion. The new boundary must not inherit arbitrary concatenation of equal nonempty spans from `apply_edits`.
+
+   Emit each file once by copying untouched original slices and final replacements in ascending original order. Return a new candidate bundle only after complete validation; preserve the input on all failures. This is the sole text application for the supported mixed slice. Entry/include strings, authored paths, comments, literal spellings, line endings and untouched files remain exact.
+
+3. **`source_project.rs`: route the narrow scalar slice.** Extract/retain ordinary edit collection before the existing application point. Add typed batches there, resolve their file keys through the snapshot, and call the new compositor once. Guard the supported scope before any output construction; no declaration relocation/default-file work is hidden in the adapter. Preserve the stale check that recompiles publicly mutable `CompiledSourceProject` fields and checks index/model/bundle, or replace it only with an equally strong opaque checked-snapshot boundary as part of separately reviewed work.
+
+4. **Later `language.rs` / `analysis_source/index.rs` integration:** one opaque parsed-bundle result must carry full-buffer tokens, typed declaration units, lowerer result and file table from the same parse. Construct Index through that provenance, not a newly exposed raw `build(Lowered, spans)` seam. All offsets remain file-relative full-original-buffer byte offsets, including typed declarations after includes or ordinary declarations. Never remove/include-mask bytes, concatenate fragments, or rescan a substring and silently treat its offsets as full-file offsets. Existing local-slice ordinary helpers translate their known base exactly once. No typed rename offset receives a second include/header adjustment.
+
+## Namespace, resource and acceptance invariants
+
+Global aliases share the complete project namespace. Scoped names are keyed by `(calculation Id, ParameterId)`; stable simultaneous final-name validation must include unchanged ordinary globals and unchanged parameters. Reused parameter UUIDs across calculations and UUID equality with a global remain legal. Occurrence identity retains owner, binding field (including override property), complete structural call path, role and qualified target. Call labels bind to the callee, never caller scope or text alone. Rename-only changes preserve authored parameter/call-argument order; reordering unrelated model vectors is outside the narrow rename plan.
+
+Use one inherited parse budget across all reachable ordinary/typed units; charge original bytes/tokens/literals once. Adapter validation does not reset/recharge parsing or numeric work. Combine ordinary+typed edit-record and owned replacement-text counts before reserving the merged list; do not treat each producer passing its own ceiling as aggregate admission. Preflight the complete final bundle against both inherited source8 output bounds and caller ProjectLimits, including unchanged files. A fresh aggregate budget belongs only to the next complete candidate parse. The existing phase byte check is a bounded text-size policy, not an exact heap-allocation accounting claim.
+
+For an integrated candidate, recompile the **actual emitted complete bundle**, run existing structural/static admission through its normal validator (no redundant manual second admission), and require the entire resulting Project to equal the independently intended Project before returning/installing source/history. A parseable output that omits an unchanged definition is failure. Pure adapter tests cannot certify this currently unavailable mixed public path. Preserve the closed public dispatch and checked-save boundaries until the parser/lowerer/migration/acceptance work is integrated and verified.
+
+## Prerequisites versus deliverables available now
+
+**Implementable now on the private analysis branch:** borrowed validated batch export, split validation/preflight internals, and tests for binding/completeness/no output construction. A private composition evaluator can combine this batch with independently authored ordinary edit witnesses and full-buffer expected strings. That demonstrates the merge algorithm, not production ordinary edit generation or mixed compilation. No public schema switch, native GUI, metamodel extension or full S4 completion is needed for this bounded deliverable.
+
+**Actually blocking production mixed integration:** root4ffff is still schema7 and has neither the private analysis model/language integration nor the private raw scanner; its tokenizer still rejects typed punctuation/converts ordinary numbers. Reconcile the analysis contribution with current ordinary CompleteForEdit/Compact work instead of replacing current root files wholesale. A real mixed `parse_unit`/edit-position branch, one shared scanner/cursor/bundle budget, full global/signature lowering and opaque Index provenance are required. Stabilize missing global/parameter IDs into exact returned files and reindex before granting edit authority. Complete-output source8 compile/admission, legacy bridge/migration and checked-save acceptance remain required public gates. Root identity correspondence also needs a distinct definition category before enabling reidentity; current fallback category is node placement. These are dependencies, not permission to invent a new model or activate source8 in this adapter.
+
+**Not blockers for the read-only batch:** subtree writing, comment salvage for removed nodes, parameter insertion/deletion, declaration movement/new-file ownership, migration activation, evaluation and further metamodel work. Keep them out of the initial patch. The existing Writer supplies the future changed-subtree primitive once its real parent/side context and structural ownership are integrated.
+
+## Six independent falsifiers (all proposed, unrun here)
+
+1. **Same-file offset cascade.** Independently authored mixed CRLF source with Unicode trivia, an ordinary global header/reference before a calculation and an ordinary scalar field after it. Simultaneously lengthen a global alias, shrink a parameter name and change the later scalar. Assert the exact entire expected file literal, all untouched bytes and intended Project; applying either producer first must fail the oracle.
+2. **Include/file-coordinate binding.** Root includes two nested-path modules; typed and ordinary declarations share a module after an include/comment prefix, and the same numeric offsets occur in another module. Exact expected full bundle verifies edits land in the owning file at its original absolute offset. Wrong/missing/reordered key-to-path mapping rejects before output; include spellings and ownership stay exact.
+3. **Repeated/reordered calls and namespace swaps.** Two calculations reuse parameter IDs/names, one equals a global UUID. Include two reordered calls to one callee and one to the other, with separate comments. Swap the first callee's two parameter names and two global aliases simultaneously. Independently enumerate every declaration/use/label span: four labels for the repeated callee remain distinct; the other callee's labels, strings and argument order remain unchanged. Add a final-name collision negative control.
+4. **Whole-snapshot and Unicode staleness.** After planning, independently mutate an unrelated file/comment, add/remove a file, or change entry while preserving file text. Each fails before output. Separately forge a span inside a multibyte scalar or attach a valid-looking token from another owner; equal spelling/length must not authorize it. A byte-identical current snapshot is the positive control.
+5. **Producer overlap.** Ordinary whole-field replacement contains a typed rename; equal nonempty spans from both producers; duplicate typed occurrence; insertion at a replacement boundary. Each is rejected atomically. Adjacent disjoint ranges and one explicitly coalesced insertion are positives. No replacement concatenation, silent dropping or producer-order choice is allowed.
+6. **Aggregate output and acceptance.** Independent multi-file edits each fit a producer-local ceiling but exceed the combined cap by one byte; require refusal with unchanged input. Exact-cap positive and typed-growth/ordinary-shrink compensation positive enforce final-output accounting. At integration, deliberately omit an otherwise valid unchanged definition/reference edit from the emitted candidate: exact-output recompile/admission plus whole-Project equality must refuse it. No model projection or compiler success alone can pass.
+
+All positive adapter fixtures also assert source/numeric usage is unchanged by export/merge and that exporting does not construct whole-file typed output. Integrated variants add complete output recompile, intended-Project equality and history/save refusal on failure.

harness/analysis-original-span-review-20260923.md

@@ -0,0 +1,64 @@
+# Original-span source8 adapter: fresh independent design review
+
+2026-09-23 — delegated Astra critic; local-only artifact, parent owns adoption and publication.
+
+**Disposition: proceed with the bounded private adapter, with the clarifications below.** The proposed opaque rename batch plus complete-snapshot compositor is compatible with eventual real mixed source8. A wholesale edit-AST replacement is not justified by the inspected rename problem. No P1 defect was established in this unimplemented proposal. The main risks are accidentally promising more ordinary edits than the collision rules admit, treating matching lifetimes/bytes as complete parse provenance, and allowing the narrow slice to stand in for full source8 editing.
+
+## Evidence and limits
+
+Reviewed `.local/analysis-source8-s3-original-span-adapter-proposal-20260922.md`, SHA-256 `8f99e8ea1ba522371c1e5df1a19ae94ceedeecfacfc96dc5345e0d24f623a9d`; the S2/S3 handoffs; accepted r2 exact-editing requirements in `harness/analysis-source8-20260913/analysis-source8-repair-design-r2-20260913.md` from the analysis checkout; and the actual source below.
+
+- A = `1b1c3e3abb6fc3d0934c9dbfbd21fddc8ae4f594`, `.local/ai3`, clean at inspection.
+- R = `4ffff0d9d94bd1875e6b316b84ac11e5c5c9657c`, requested ordinary-source pin. Root advanced to `cc3d6a48751ac5ab08e727cfd31c2b261bf8ade3` during review; independent Git comparison showed no differences from R in `source_project.rs`, `source_project/source_structure.rs`, or `language.rs`, so reads remain valid for R.
+- Source/design review only. No compiler, runtime, GUI, production changes, or Gitea writes. The proposed falsifiers are unrun; this review is not evidence of a working mixed parser or updater.
+
+## Actionable clarifications
+
+1. **P2 — define the supported ordinary edit set before routing it to the new compositor.** Proposal lines 13 and 47 promise topology-preserving ordinary scalar changes, while line 43 rejects insertion at a replacement boundary. R's `crates/oa-core/src/source_project.rs:1360–1371` deliberately handles a syntax-kind change by calling `erase_syntax` and inserting new text at the original start; `erase_syntax` (`:1101–1113`) emits individual token deletions, leaving trivia. Thus an existing producer can issue a meaningful insertion/deletion pair sharing a boundary. Stable model IDs alone do not exclude this form of syntax change. Either initially allow only explicitly enumerated leaf/header edits whose producer shape is supported, rejecting other changes *before* formatting/planning, or normalize this ordinary-owned compound operation into a single witnessed replacement with the same comment-preservation result. Do not simply relax cross-producer overlap checks. Add a positive oracle for that normalization before broadening the advertised scalar set.
+
+   R's `apply_edits` (`:679–718`) also concatenates all equal-span replacements. The proposal correctly refuses to carry that rule into a mixed ownership boundary. Preserve defined same-position insertion ordering inside one ordinary producer; reject duplicate nonempty replacements from any producer unless a distinct, reviewed compound-operation rule justifies them. Run ordinary compatibility fixtures against the adapter when it becomes a production route, since a stricter validator can expose previously tolerated producer output. No evidence found here establishes that all ordinary duplicate spans are intentional or that they are all bugs.
+
+2. **P2 — make the batch/snapshot relationship and intended rename set constructor invariants.** A's `analysis_source/update.rs:15–19` binds a plan to an Index, and `index.rs:122–128` binds the Index to numeric-keyed source strings. Neither object currently binds itself to a `SourceBundle.entry`, canonical-path table, checked ordinary Project, or parse-budget profile. `Index::parse` (`index.rs:147–178`) intentionally accepts an independently supplied ordinary Project for the private typed-only harness. Rust borrowing prevents dangling references; a shared lifetime does not prove that two borrowed objects came from the same parse session. The proposal's opaque parsed-bundle requirement is therefore essential, not documentation around otherwise sufficient lifetimes.
+
+   For production composition, use one checked parsed-bundle witness that owns or borrows the exact complete bundle, ordinary model, typed index, file table and inherited limits. Create the collector and its complete rename intent from that same witness plus the independently supplied target Project. Permit only the witnessed typed batch for that index, with all global and scoped changes derived by stable identities; do not independently accept several batches whose individually valid final-name maps disagree. Final equality must still catch omitted ordinary references. Keep the old typed-only constructor test/staging-only. Add a negative control pairing a valid batch with another parse session/file table having equal numeric keys/spellings but different ownership, and a positive byte-identical complete snapshot control. No public raw `build(Lowered, spans)` is needed.
+
+3. **P2 — turn the initial scope restriction into a precise diff gate and a bounded completion path.** “Topology-preserving” is not enough to identify supported changes. Require a gate over complete old/new Projects: unchanged global IDs and categories, declaration/lexical ownership, typed bodies/types/subjects/override structure, parameter IDs/order and all unsupported fields, allowing only the specific global/scoped names and ordinary leaf changes implemented in the first slice. An unrelated model-vector reorder, body edit, repaired deletion, or reidentity must not get silently ignored or regenerated. Return a specific unsupported-operation result before output construction. Keep those cases visible as unfinished source8 functionality.
+
+   The accepted r2 contract, “Source pipeline and exact editing” points 5–8, additionally requires subtree edits and retained removed-node comments, scoped parameter changes, global reidentity, explicit definition categories, file ownership, and complete acceptance. The S2 plan's S3 responsibility paragraph adds repaired deletion, missing-ID insertion/reindexing and history. A passing rename compositor does not complete those obligations. Before public activation, either implement their source8 paths or retain a clearly private experimental entrypoint; keeping the existing source7 updater intact does not by itself provide these operations for a source8 model.
+
+## Resource and acceptance conclusions
+
+The typed-growth/ordinary-shrink concern is real. A's `Plan::renames` calls `validate` at `update.rs:89`; `validate` calculates a typed-only aggregate output and applies `index_bytes` (`:154–170`). Consequently, export cannot simply call the existing constructor under the final combined-output ceiling. Accept the proposed split into ownership/completeness validation and standalone output preflight, while preserving standalone `renames`/`apply` behavior.
+
+The composition path should retain the inherited profile rather than accept a more permissive ambient Budget. If callers can tighten limits, use the intersection; do not allow composition to widen the parsed session's ceilings. Existing private tests deliberately construct new Budgets for boundary probes (`update/tests.rs`, `output_and_plan_limits_are_aggregate_and_do_not_reset_parse_work`), which is not proof of production profile binding. Count aggregate records/owned replacement text before merged reservations, then compute the actual combined per-file and whole-bundle output lengths, including unchanged files, before allocating output. A shrink can compensate output growth, but cannot erase already incurred parse, name-storage, record, or numeric costs. Retaining old parse counters unchanged through export is correct; a complete candidate reparse gets its own complete bounded pass. An unchanged usage counter alone does not prove that no redundant parsing occurred, so keep the single-parser control flow inspectable.
+
+The final acceptance boundary is correctly chosen: compile the actual emitted complete bundle, use normal full structural/static admission, compare the entire resulting Project to independent intent, and install nothing on failure. R already checks stale public fields (`source_project.rs:790–802`) and whole-Project equality (`:1058–1071`); preserve those guarantees. Equality is necessary but cannot prove source preservation or edit provenance: retain independently authored exact-output and unchanged-byte oracles too. When choosing the negative omission fixture, keep the damaged output parseable/admissible (for example, omit an unreferenced definition) so the test actually exercises whole-Project equality instead of only an earlier parser error.
+
+## Concrete next implementation boundaries
+
+1. **Private batch patch:** only the typed update module and its focused tests need change initially. Export a borrowed, opaque, complete validated batch; separate composition planning from standalone final-size preflight; prove no whole-file output is constructed. Exercise same-name no-op, full swaps, missing/duplicate occurrence, stale source, and typed-growth/ordinary-shrink compensation with independently authored ordinary witnesses. This is a meaningful deliverable now and needs no public dispatch change.
+2. **Private compositor patch:** implement complete snapshot/file-map binding, owned ordinary-operation normalization for the explicit supported set, aggregate checks and one ascending copy pass. Exercise all-file atomic rejection, Unicode boundaries, wrong session/map, duplicate nonempty spans, ordered insertion groups, adjacent ranges, exact cap and cap-plus-one. Handwritten ordinary witnesses certify this algorithm only, not production ordinary edit collection.
+3. **Real mixed parse prerequisite:** compose one raw scanner/cursor and bundle budget with ordinary and typed declaration parsing; collect full cross-file globals/signatures, lower once, retain full-buffer offsets and same-parse index provenance. Stabilize missing global/parameter IDs into the returned documents and rebuild indexes before granting editing authority. Preserve ordinary signed-number/legacy behavior and complete/compact edit semantics. Do not build a substring/masked-source bridge or expose raw lowerer/span fabrication to make the compositor appear integrated.
+4. **Integrated narrow edit slice:** derive both producers from that checked parse and complete target, enforce the precise diff gate, emit once, and verify the whole candidate. Add independently authored mixed CRLF/Unicode files, cross-file ordinary-to-typed and typed-to-ordinary renames, final namespace swaps, scalar changes on both sides of typed declarations, exact bundle output and whole-Project equality. Include no-op equality and stale unrelated-file/entry refusal.
+5. **Complete required editing and publication:** extend the ownership protocol to typed subtree changes, scoped-parameter insertion/deletion/reorder, same-batch repaired deletion, reidentity, movement/new-file ownership and stabilization/migration; verify history and checked-save failure atomicity. The existing structural second pass (`R:source_project/source_structure.rs:34–84`) reparses updated text and cannot simply be declared part of the original-coordinate one-pass proof. Design and verify its composition explicitly. These are remaining delivery gates, not grounds to postpone the useful private batch patch.
+
+The proposal is appropriately cautious about public activation and does not weaken the required model semantics. With the scope/provenance clarifications above, implementation of the private adapter should now provide more value than another general redesign exercise.
+
+## Immediate export-only acceptance boundary
+
+Parent's narrower first implementation is accepted: **typed opaque batch export and validation split only; no mixed `source_project` compositor, real mixed parser, or public activation in this patch.** Steps 2–5 above describe dependent work, not additional scope for this patch.
+
+The composition constructor must share final-namespace, qualified-target, complete-occurrence, original-source, token-spelling, order/overlap and active-budget checks with the existing standalone path. It may defer **only the hypothetical typed-only final output-length check**. It must still bound rename-map records, owned final-name bytes and edit records before allocation. Export revalidates exact supplied current numeric file keys and bytes and returns an opaque read-only view borrowing the Plan; it cannot return/install a candidate Project or grant ordinary-file ownership. Keep constructors and internal edit fields private. An empty batch is valid. This private batch remains tied to the existing typed-only index provenance; it must not claim the future complete-bundle/session guarantee.
+
+Use one caller-supplied inherited Budget throughout the private test operation, with no fresh permissive budget inside the new constructor/export. This patch need not redesign Budget or Index to store a production parse-session profile. That stronger ownership is deferred with the real parsed-bundle witness and must be settled before production composition. `Budget::active()` remains mandatory, including a previously latched parse/numeric failure.
+
+Minimum focused acceptance oracles:
+
+1. The existing standalone `Plan::renames` and `Plan::apply` keep rejecting typed-only output exceeding the profile. Under that **same profile**, the composition constructor/export accepts the otherwise valid growing batch when its plan/name/record storage fits. Independently calculate an ordinary shrink sufficient to place a hypothetical complete result exactly at the cap, and explicitly label this as deferred-final-size arithmetic, not a compositor test or accepted output. This proves why only output preflight was split.
+2. Source/name-memory/record bounds remain effective on composition construction: invalid alias, final namespace collision, unknown qualified target, over-limit renamed-name bytes and edit count fail. A shrinking hypothetical ordinary edit cannot authorize an over-limit plan. Exact-bound positives and plus-one negatives should isolate the intended bound.
+3. Export rejects missing/changed/extra source files or altered unrelated bytes, a forged/wrong token location, duplicate occurrence and incomplete edit membership. Use module-private damage controls to exercise checks inaccessible to normal callers. Failure returns no batch and leaves input unchanged.
+4. A simultaneous global/scoped swap exposes exactly the independently enumerated original file/span/old spelling/new spelling/qualified key tuples in deterministic order. Include repeated call labels and same UUIDs in distinct parameter/global scopes. Same-name/no-op input exports zero edits.
+5. Construction/export leave parse usage and numeric work unchanged; no whole-file typed output is materialized or `Plan::apply` invoked along the export path. Verify this through the narrow implementation's control flow plus tests of exposed records, rather than treating unchanged counters alone as proof of allocation behavior.
+6. Existing standalone rename, stale-index, namespace and output-limit regressions retain their original oracles. The new type exposes read-only accessors and no mutable record, arbitrary batch constructor, or caller-selected subset acceptance API. Exact complete model/bundle equality remains a later integration gate, not an assertion that this export patch can establish.
+
+Passing these oracles is sufficient to deliver the private export patch. It is not sufficient to close S3/S4 or claim graph/text/source8 functionality. The next dependency is concrete complete parsed-bundle provenance and ordinary-operation normalization, followed by the compositor and actual mixed parser path.

harness/experiments/analysis-mixed-index-20260924/PACKAGE-READBACK.md

@@ -0,0 +1,3 @@
+# Transported evidence archive readback
+
+2026-09-24: independently read `harness/experiments/analysis-mixed-index-20260924/evidence.zip` without extracting or executing archived code. The archive is exactly 465,281 bytes with SHA-256 `9f02302ee6990d33c7c06b6fd9eff2fb50a940e1c09b4556d55cb0d41ff062ce`, matching both the requested pin and manifest. Manifest source is `93eb6117f95353d25d594d59780018f197c51672`. All 47 ZIP members match the manifest's exact names, uncompressed byte lengths and SHA-256 pins; there are no duplicate, missing or extra members. Independently compared 45 members against their original local files: all final/historical gate inputs, receipts and raw logs, baseline gate inputs/receipts/logs, all captured launchers, toolchain text and the three reviews are exact byte copies. The two patch members were checked against manifest pins; their Git semantics were not re-audited in this transport check. No mismatch found. This is transport verification only: it does not repeat or broaden runtime acceptance, change the recorded inherited full-test/format failures, or execute the captured launchers. `RUNTIME-REVIEW.md` and its archived bytes were left unchanged.

harness/experiments/analysis-mixed-index-20260924/README.md

@@ -0,0 +1,64 @@
+# Private mixed typed-index checkpoint
+
+Source **93eb6117f95353d25d594d59780018f197c51672**, published separately on
+`codex/analysis-mixed-index-956atf-20260924`. This implements the consumed
+complete-Project owner and shared typed-site verifier from the
+[accepted contract](../../analysis-mixed-index-contract-20260924.md). It retains
+original bundle/file authority, complete global and scoped parameter names,
+qualified occurrence/expression paths and aggregate storage reservations.
+There is no conversion into the legacy index/updater and no public source8
+activation. The Windows prerelease source is unaffected.
+
+On Windows 11, rustc/Cargo 1.98.1, `x86_64-pc-windows-gnullvm`, strict core
+all-target Clippy passes and all seven new tests pass. The actual inventory has
+216 names. The unfiltered core library remains **FAILED: 200 passed, 16 failed**;
+all 209 prior named outcomes are unchanged, plus seven new passes. Every failure
+retains its unsupported-public-source8 diagnostic. Full formatting remains
+**FAILED** with the byte-identical eight inherited blocks in five files.
+Neither failure is reclassified as success. Linux checks were not run.
+
+The [independent runtime/oracle review](RUNTIME-REVIEW.md) checked all 545 captured
+source inputs against immutable Git and disk bytes, exact raw named outcomes,
+the baseline failures, formatter output and seven authored test oracles.
+Tests cover OA/SA and Unicode/CRLF complete maps, qualified call-label damage,
+physical token uniqueness, retained-plus-new storage boundaries, copied text,
+original authority and bounded-stack success/failure cleanup. The earlier
+[source review](../../analysis-mixed-index-20260924/source-review.md) found three
+diagnostic attribution/fallback defects, repaired before compilation. Those
+reviewed production hashes remain unchanged in this checkpoint.
+
+Two original test failures are preserved: `a18b7966` strict lint rejected a
+manual range pattern; `1d02206c` focused runtime passed six and failed one because
+the test incorrectly held the parser's three-frame peak fixed. The contract
+permits structural depth verification to raise that peak. The exact authored
+root/Left/Argument/Argument path requires four, and `93eb6117` compares against
+that peak while preserving every other usage check. Both correction diffs are
+archived. No production behavior was weakened to obtain a pass.
+
+`evidence.zip` contains 47 pinned members: nine raw attempt receipts/logs/input
+maps, captured launchers, three baseline gate records, source/oracle/runtime
+reviews, the two diffs and a separately captured current toolchain report.
+[manifest.json](manifest.json) records every member's length and SHA-256 plus
+the ZIP identity. Raw launchers are historical execution records: their local
+path assumptions must be adapted deliberately for another checkout, and reading
+or hashing them does not run archived code. Receipts bind a declared source
+input set and selected environment fields; they are not authenticated build
+attestations or exhaustive environmental capture.
+
+To run the meaningful subject gates from the identified source, use the project
+Windows toolchain setup, one compiler job, `CARGO_INCREMENTAL=0`, and no
+`ARCADIA_CODEC_LIFECYCLE_PHASE` or `RUST_MIN_STACK` override:
+
+```text
+cargo test --locked --offline -p oa-core --lib -- --list
+cargo test --locked --offline -p oa-core --lib language::analysis_source::mixed::project::tests::index_tests:: -- --test-threads=1
+cargo test --locked --offline -p oa-core --lib -- --test-threads=1
+cargo clippy --locked --offline -p oa-core --all-targets -- -D warnings
+cargo fmt --all -- --check
+```
+
+The final two failure dispositions above remain expected limitations of this
+private checkpoint, not completion criteria for the application. Ordinary
+occurrence indexing, original-coordinate edit composition, complete output
+admission, public source8, checked persistence and graphical/API parity remain
+required work, coordinated in issue 7.

harness/experiments/analysis-mixed-index-20260924/RUNTIME-REVIEW.md

@@ -0,0 +1,62 @@
+# Mixed typed-index runtime/oracle audit
+
+2026-09-24. Independent read-only audit of private source **93eb6117f95353d25d594d59780018f197c51672**, `.local/as3batch` (HEAD and clean working tree verified). No Cargo, compiler, tests, source edits, process interference or Gitea operations were performed by this reviewer. Evidence below audits parent's recorded runs, their source binding and authored test assertions. It does not authorize public source8 or claim whole-library/format success.
+
+## Disposition
+
+No blocking discrepancy found between the seven new tests and the independent `ORACLE.md`, or between the final receipts and raw logs. All 209 inherited named outcomes are unchanged; seven new names pass. Strict core all-target Clippy passes. **The full library still fails with 16 inherited public-schema failures, and workspace formatting still fails with the identical inherited eight diff blocks.** These remain failures, not waived passes. Parent owns final checkpoint acceptance/publication.
+
+## Raw run and receipt audit
+
+Evidence directory: `.local/analysis-mixed-index-gates-20260924`; all five final runs have source, input-manifest source and head_after exactly equal to 93eb6117, empty changed_inputs and verification_failures, and identical 545-record input inventories.
+
+| Receipt stem | Actual scope | Exit / raw result |
+|---|---|---|
+| index-focused-93eb611-1 | `cargo test --locked --offline -p oa-core --lib language::analysis_source::mixed::project::tests::index_tests:: -- --test-threads=1` | 0; seven named tests pass |
+| index-list-93eb611-1 | `cargo test --locked --offline -p oa-core --lib -- --list` | 0; 216 unique test names |
+| index-full-93eb611-1 | `cargo test --locked --offline -p oa-core --lib -- --test-threads=1` | 101; 200 passed, 16 failed, zero ignored/filtered |
+| index-clippy-93eb611-1 | `cargo clippy --locked --offline -p oa-core --all-targets -- -D warnings` | 0; raw log completes dev-profile check |
+| index-fmt-93eb611-1 | `cargo fmt --all -- --check` | 1; eight inherited formatting blocks across five files |
+
+Independently parsed each raw log. Every focused/full `(name,status)` sequence equals its receipt, and all 216 listing names equal the full-run name set. No duplicate, missing or additional outcome was hidden by map comparison.
+
+Verified SHA-256 of every final raw log, input JSON and captured launcher against its receipt. Final full input manifest's **all 545 paths** were read as binary Git blobs with `git cat-file --batch` at the exact commit and checked for byte length and SHA-256; all matched the captured manifest and current disk files. Focused/list/Clippy/fmt inventories equal that full inventory exactly. This validates the declared launcher input set, not an assertion that unlisted environmental dependencies are covered. The focused/list/full executable artifact's current byte size and SHA-256 also match all three receipts. No artifact was executed by this audit.
+
+Raw log SHA-256:
+
+- focused: `ddf7862fd7264ed6449c07d653f471428421f244fb0fa537960bb5639ccbcf0c`
+- list: `ff3b75a04657d81cd86d82acf33df77c815b374c50c2bee843577d18e40a1615`
+- full: `7f4ede0908156a94c10c1d730f1b7bd89c23b6b777d1daef22693019827e97e1`
+- Clippy: `f2b5481093a92be82ad9cd6cd843a863b7530d387d5d6b7483f107e70ba2f650`
+- fmt: `c1c6b12861c8117ce6ffc6d6742ebf92618aafb10160ec6f99d370ca72ebab2d`
+
+## Exact inherited dispositions
+
+Compared `.local/analysis-mixed-project-gates-20260923/project-full-71cadfa-1.result.json` and its raw log against current full results. Old raw outcomes equal the old receipt: **209 = 193 ok + 16 FAILED**. Every old name is present now with exactly the same status; no old test was removed, renamed or changed from failed to ignored. Exactly these seven new `language::analysis_source::mixed::project::tests::index_tests::` suffixes are added, all `ok` in both focused and full runs:
+
+- copied_name_bytes_coexist_with_retained_warning_bytes
+- damage_reaches_structural_token_and_call_checks
+- distinct_qualified_keys_cannot_share_one_physical_token
+- entire_authored_index_oa_sa_original_and_unicode_crlf
+- invalid_file_and_utf8_span_use_explicit_safe_fallback
+- new_maps_keep_baseline_and_scope_reservations_and_peak_scratch
+- success_and_late_failure_drop_on_small_stack
+
+The same six `language::nesting_tests` and ten `source_files::transaction_tests` fail. Compared all 16 raw failure blocks by test name after replacing only the variable thread ID immediately before `panicked`; all 16 bodies are otherwise identical. Every body contains `Unsupported schema version: expected arcadia 3, 4, 5, 6 or 7.` These public paths have not acquired source8 support, and failures occurring at schema acceptance do not validate their later reparenting/save/recovery behavior.
+
+The new fmt raw log is identical to `.local/analysis-mixed-project-gates-20260923/project-fmt-aaec78f-1.log` even before path/line normalization. Same eight blocks in `crates/oa-core/src/model.rs`, `references.rs`, `semantic/catalog.rs`, `session.rs`, and `transitions.rs`; no new index file is listed. Both runs exit 1. Also verified old full/fmt log, input and launcher hashes against their respective receipts.
+
+## Authored oracle and test review
+
+Source paths here are under `crates/oa-core/src/language/analysis_source/`.
+
+- `mixed/project/tests/index_tests.rs:30–237` implements all authored names and exact key/span maps from ORACLE.md, for OA and SA and both original LF and prefixed Unicode/CRLF source. It compares full Project to independently built `rich_model(layer)`, complete names/maps, original bundle identity/files, warnings, admission metadata and numeric usage. The byte transform at lines 17–26 is independent raw-source arithmetic. All 15 expression paths and 21 occurrence records match the prior authored table; OA/SA names are 11/12, retained deltas 59/60 entry slots and 11/12 owned-name bytes, with unchanged lower occurrence slots. No expected key is generated by walking the actual lowerer parent arena or formatting an actual index.
+- Rich fixture/model extraction in `mixed/project/tests.rs:253–327` preserves the old independent OA model and global arena test; it only factors their literal/model construction for reuse and adds SA parameterization.
+- `index_tests.rs:251–335` tests 13 deliberate corruptions with exact expected messages and applicable file ownership. Case 6 changes occurrence 11's target from Q(10,1) to Q(11,1), exactly the equal-spelling/wrong-callee control in ORACLE.md. Its message is the call-site mismatch, not an earlier unknown-name rejection. Case 7 removes that label and reaches the argument-child check. Existing source checks in `index.rs:619–667` support these claimed phases. Arbitrary non-expression-reference omission is not falsely promised as runtime rejection.
+- `index_tests.rs:339–375` uses inherited baseline plus 97/98 entry-slot caps. The 98 peak is independently consistent with the implemented lifetime policy: final maps/paths 59 + owners 3 + physical entries 21 + path lookup 15; these coexist at the last occurrence. Source drops owners/physical at `index.rs:615–618`, then drops paths/calls at `:669–673`, so later peaks 77 and 90 are lower. The negative requires the exact entry refusal at original main span329..330; success retains only baseline+59 and original occurrence slots.
+- `index_tests.rs:378–402` proves a one-byte name copy is added to retained warning/syntax text: original 236, negative cap236, positive cap237. It does not reset the baseline.
+- `index_tests.rs:405–486` exercises success and late rejection on the 128KiB stack (including depth128), safe diagnostic fallback for invalid file/UTF-8 spans, and physical token uniqueness even when qualified keys differ. This supports the bounded private lifecycle claim, not general GUI or public depth enablement.
+
+The two follow-up test fixes preserve the intended evaluator. `1d02206c` changes only `matches!(case, 6 | 7 | 8)` to equivalent `6..=8`. In `93eb6117`, the prior complete Usage equality becomes equality with **only deepest_frame raised to max(previous,4)**; all other usage fields and numeric work remain checked unchanged. Four is independently derived from root + Left + Argument(1) + Argument(1), already in ORACLE.md, and accepted contract explicitly permits depth verification to update that peak. No production branch or assertion was removed to make these failures pass. Earlier failing receipts should remain in the package as provenance, not be relabeled successful.
+
+This review covers recorded runtime evidence and oracle fidelity, plus the narrow source paths needed to validate those claims. It is not a replacement for the parent's independent full implementation/authority review or the later ordinary-index/composition/public-source8/parity gates.

harness/experiments/analysis-mixed-index-20260924/manifest.json

@@ -0,0 +1,199 @@
+{
+  "source": "93eb6117f95353d25d594d59780018f197c51672",
+  "scope": "Private typed mixed index. Strict lint and seven new tests pass; full library and formatter remain failed with recorded baseline failures.",
+  "archive": {
+    "file": "evidence.zip",
+    "bytes": 465281,
+    "sha256": "9f02302ee6990d33c7c06b6fd9eff2fb50a940e1c09b4556d55cb0d41ff062ce"
+  },
+  "members": {
+    "baseline/launchers/46c9ee5f4130e7854855e44b1509ecc0833dd4a3c41a1f3251955b0ac79cc154.py": {
+      "bytes": 7629,
+      "sha256": "46c9ee5f4130e7854855e44b1509ecc0833dd4a3c41a1f3251955b0ac79cc154"
+    },
+    "baseline/launchers/a3b965c6d4d9f3f7d3d55ea0f142d16e43fccd9adcd9b8121615a2ea16df8af8.py": {
+      "bytes": 7629,
+      "sha256": "a3b965c6d4d9f3f7d3d55ea0f142d16e43fccd9adcd9b8121615a2ea16df8af8"
+    },
+    "baseline/project-fmt-aaec78f-1.inputs.json": {
+      "bytes": 101425,
+      "sha256": "1ec30aeb757d0424598cdf0c52a4845c1645ff8ed0c12cb17e4d18b82d957345"
+    },
+    "baseline/project-fmt-aaec78f-1.log": {
+      "bytes": 6446,
+      "sha256": "c1c6b12861c8117ce6ffc6d6742ebf92618aafb10160ec6f99d370ca72ebab2d"
+    },
+    "baseline/project-fmt-aaec78f-1.result.json": {
+      "bytes": 1882,
+      "sha256": "fbb3e49b2373be566deb81f7c1e40d4a2a174abfe64515b1497e6e121dc31b97"
+    },
+    "baseline/project-full-71cadfa-1.inputs.json": {
+      "bytes": 101425,
+      "sha256": "d09706edfcc24b769c463cfb9972c5db2510382cb5096afed1983cf8a1eb487a"
+    },
+    "baseline/project-full-71cadfa-1.log": {
+      "bytes": 35486,
+      "sha256": "4042844548d046880eb7b0dbdfadc92017a113c32d788dbcbc77b2197624c742"
+    },
+    "baseline/project-full-71cadfa-1.result.json": {
+      "bytes": 30035,
+      "sha256": "73cfb2c6b819e631f0f8df050abc4278278d7e79e6f0d24d96da9bc50f4abbb2"
+    },
+    "baseline/project-list-71cadfa-1.inputs.json": {
+      "bytes": 101425,
+      "sha256": "d09706edfcc24b769c463cfb9972c5db2510382cb5096afed1983cf8a1eb487a"
+    },
+    "baseline/project-list-71cadfa-1.log": {
+      "bytes": 22449,
+      "sha256": "bd849c7c338d06a226cf3d49bc4a332dd6fcf1063e5df121db052f0718731e6d"
+    },
+    "baseline/project-list-71cadfa-1.result.json": {
+      "bytes": 24528,
+      "sha256": "4ae6d131881e5af6f5d7dd001e367af20ac016e81e23cf2a1f52806946cdc500"
+    },
+    "diffs/1d02206-to-93eb611.patch": {
+      "bytes": 2822,
+      "sha256": "8a2af465c373fbfd67c17d9e998ff0953e25e6250c782f5b18cdcae43e6e12f5"
+    },
+    "diffs/a18b796-to-1d02206.patch": {
+      "bytes": 1876,
+      "sha256": "2a27585fa5389497c5999c65ee2ab8fe4bc44ea6f924d1bf7f2815e6ef45b1a4"
+    },
+    "gates/index-clippy-1d02206-1.inputs.json": {
+      "bytes": 101639,
+      "sha256": "55934817651ee38ec574f6eba58dc42ca652a55ec8992fa3e3d703e011ad8de7"
+    },
+    "gates/index-clippy-1d02206-1.log": {
+      "bytes": 165,
+      "sha256": "a615593e1b445a52b5883d2e52a7ff9e6b643947e2cfbf1998e20ad5dabbecef"
+    },
+    "gates/index-clippy-1d02206-1.result.json": {
+      "bytes": 1953,
+      "sha256": "bdcb442256298abd98280cb53f4b197a50e2ff48d40b61ca313aab28ffe96e99"
+    },
+    "gates/index-clippy-93eb611-1.inputs.json": {
+      "bytes": 101639,
+      "sha256": "e3e8f12212ddc111c32dd925179785db5c7a52a87cf4730ad2c2a4b644f7a805"
+    },
+    "gates/index-clippy-93eb611-1.log": {
+      "bytes": 165,
+      "sha256": "f2b5481093a92be82ad9cd6cd843a863b7530d387d5d6b7483f107e70ba2f650"
+    },
+    "gates/index-clippy-93eb611-1.result.json": {
+      "bytes": 1966,
+      "sha256": "107b610c7cddca4a94dc15efb9dce836d6e52b1dbc738a75089090be4df52afa"
+    },
+    "gates/index-clippy-a18b796-1.inputs.json": {
+      "bytes": 101639,
+      "sha256": "12174f0feccc6d8c8fef93a638c27e3500ddfbf887b810015dd29589d778348e"
+    },
+    "gates/index-clippy-a18b796-1.log": {
+      "bytes": 745,
+      "sha256": "891af09af2c6c4af3a5b3ff7369fa6388a12b255d39c2e09fbc5ef850b15349c"
+    },
+    "gates/index-clippy-a18b796-1.result.json": {
+      "bytes": 1968,
+      "sha256": "2ad836c95de39f7333b9b4208d1f22fc84d94939adb69ae77485de5265a474fd"
+    },
+    "gates/index-fmt-93eb611-1.inputs.json": {
+      "bytes": 101639,
+      "sha256": "e3e8f12212ddc111c32dd925179785db5c7a52a87cf4730ad2c2a4b644f7a805"
+    },
+    "gates/index-fmt-93eb611-1.log": {
+      "bytes": 6446,
+      "sha256": "c1c6b12861c8117ce6ffc6d6742ebf92618aafb10160ec6f99d370ca72ebab2d"
+    },
+    "gates/index-fmt-93eb611-1.result.json": {
+      "bytes": 1880,
+      "sha256": "ead7fc6c8673fe8b565f2c0506a81261a0a401854e2c78bc5b12b72722476d62"
+    },
+    "gates/index-focused-1d02206-1.inputs.json": {
+      "bytes": 101639,
+      "sha256": "55934817651ee38ec574f6eba58dc42ca652a55ec8992fa3e3d703e011ad8de7"
+    },
+    "gates/index-focused-1d02206-1.log": {
+      "bytes": 2098,
+      "sha256": "0e37a4b3d74370edd316a5db1e1cd10b4f7a18c57aea989a07fc60742c03a163"
+    },
+    "gates/index-focused-1d02206-1.result.json": {
+      "bytes": 3423,
+      "sha256": "d8d935fbc8b350d0a849b02b2730b2ca59e53af214345c31121cee71672edbfa"
+    },
+    "gates/index-focused-93eb611-1.inputs.json": {
+      "bytes": 101639,
+      "sha256": "e3e8f12212ddc111c32dd925179785db5c7a52a87cf4730ad2c2a4b644f7a805"
+    },
+    "gates/index-focused-93eb611-1.log": {
+      "bytes": 1344,
+      "sha256": "ddf7862fd7264ed6449c07d653f471428421f244fb0fa537960bb5639ccbcf0c"
+    },
+    "gates/index-focused-93eb611-1.result.json": {
+      "bytes": 3416,
+      "sha256": "c5c5aa7ca2866aa8538a26644e97caf9b43b7136b32b56741cf07a02769f7ffc"
+    },
+    "gates/index-full-93eb611-1.inputs.json": {
+      "bytes": 101639,
+      "sha256": "e3e8f12212ddc111c32dd925179785db5c7a52a87cf4730ad2c2a4b644f7a805"
+    },
+    "gates/index-full-93eb611-1.log": {
+      "bytes": 36384,
+      "sha256": "7f4ede0908156a94c10c1d730f1b7bd89c23b6b777d1daef22693019827e97e1"
+    },
+    "gates/index-full-93eb611-1.result.json": {
+      "bytes": 31080,
+      "sha256": "ca638920be3e438a12ee00447fd14e18339654bf10996c01b48032d56abc29a1"
+    },
+    "gates/index-list-1d02206-1.inputs.json": {
+      "bytes": 101639,
+      "sha256": "55934817651ee38ec574f6eba58dc42ca652a55ec8992fa3e3d703e011ad8de7"
+    },
+    "gates/index-list-1d02206-1.log": {
+      "bytes": 23306,
+      "sha256": "63f1f76598c5fe3613bc69a8358abbf7ea3ca5304eb324abf581119fdfa78ce8"
+    },
+    "gates/index-list-1d02206-1.result.json": {
+      "bytes": 25388,
+      "sha256": "9b0aad39096307c0fdb62f5b521c501c9fb9e670c9a2849829d48233757e1145"
+    },
+    "gates/index-list-93eb611-1.inputs.json": {
+      "bytes": 101639,
+      "sha256": "e3e8f12212ddc111c32dd925179785db5c7a52a87cf4730ad2c2a4b644f7a805"
+    },
+    "gates/index-list-93eb611-1.log": {
+      "bytes": 23201,
+      "sha256": "ff3b75a04657d81cd86d82acf33df77c815b374c50c2bee843577d18e40a1615"
+    },
+    "gates/index-list-93eb611-1.result.json": {
+      "bytes": 25377,
+      "sha256": "729c0c04b8ca1d40b97ad93bb799fa840df75ee7870f4c72c880415563d4b495"
+    },
+    "gates/launchers/549008cdaf337116aca50e242f9d95fb51aa81e31dd8678adf21d9151f7e1273.py": {
+      "bytes": 7631,
+      "sha256": "549008cdaf337116aca50e242f9d95fb51aa81e31dd8678adf21d9151f7e1273"
+    },
+    "gates/launchers/885360edbde4700d7beb19e08b0cd08840e53623b8f0dc826b89bde3751b1803.py": {
+      "bytes": 7631,
+      "sha256": "885360edbde4700d7beb19e08b0cd08840e53623b8f0dc826b89bde3751b1803"
+    },
+    "gates/launchers/f3b42e687b33b8a38b717823ae67e6abc2c2fa9c0c9a2c0525c9f564f6f61b4c.py": {
+      "bytes": 7631,
+      "sha256": "f3b42e687b33b8a38b717823ae67e6abc2c2fa9c0c9a2c0525c9f564f6f61b4c"
+    },
+    "notes/toolchain.txt": {
+      "bytes": 536,
+      "sha256": "1f101518dd1f90bc2cba8d26570a762832aba6debebbbe6aa50f97a944590610"
+    },
+    "reviews/ORACLE.md": {
+      "bytes": 11866,
+      "sha256": "9a76556fb4f4381c22ffb5ecee5e4a7fbd8c0df5362e32200f68410164a3cada"
+    },
+    "reviews/RUNTIME-REVIEW.md": {
+      "bytes": 8803,
+      "sha256": "2b9c390c7c43fb187cd70542c19cef16ea56f58425d9b506a41d5a563dc798bc"
+    },
+    "reviews/SOURCE-REVIEW.md": {
+      "bytes": 11151,
+      "sha256": "ee1c123b6e05da4721c51558bf0f6eebe25772d8f3078fdb903636c211209cd3"
+    }
+  }
+}

harness/experiments/analysis-mixed-project-20260924/.gitattributes

@@ -0,0 +1 @@
+* -text

harness/experiments/analysis-mixed-project-20260924/CONTROLS.md

@@ -0,0 +1,28 @@
+# Finite v2 controls — execution pending parent review
+
+`controls.py` has **15 cases total**: one unchanged positive, then fourteen negatives. It stops on the first unexpected result or timeout. It does not import the verifier. After review only:
+
+```text
+python -B controls.py --repo /path/to/ARCADIA-Studio --package /path/to/v2-package --out /fresh/path/to/controls-results
+```
+
+The positive uses original package bytes. Each negative rebuilds one transient ZIP; all changed inner log/input/outcome bindings, payload hashes, ZIP bytes/SHA and verifier bytes/SHA are refreshed, except the two intentional top-level pin controls. Repeated-target artifact negatives therefore reach the new identity check with valid transport hashes. Only compact stdout/stderr/result files remain. Temporary paths are checked beneath the fresh result directory before automatic cleanup; source/package files remain untouched. Peak additional archive storage is about 0.5 MiB, not a retained corpus. Per-case timeout defaults to300 seconds (configurable30–600); timeout is not a successful refusal.
+
+| Case | Mutation / expected discriminator |
+| --- | --- |
+| archive-pin | Append ZIP transport bytes after recording its pin; top-level archive pin differs. |
+| verifier-pin | Corrupt only verifier descriptor; top-level verifier pin differs. |
+| route-pair-artifact | Change only route-error artifact SHA, with refreshed receipt/transport hashes; repeated integration target artifact differs. |
+| source-pair-artifact | Change only aggregate-reference artifact SHA; same pair-identity refusal. |
+| missing-new-outcome | Remove one new full-suite outcome and adjust pass count; exact runtime membership refuses. |
+| changed-inherited-diagnostic | Alter one old diagnostic column while retaining name/status/header error; exact diagnostic comparison refuses. |
+| forged-git-input | Consistently forge one input SHA across all ten71 manifests; immutable Git bytes refuse. |
+| missing-failed-history | Remove b9 failed-focus triple with refreshed membership; mandatory payload inventory refuses. |
+| integration-zero-test | Synthesize successful zero-test result/footer; exactly-one expected outcome refuses. |
+| integration-ignored | Replace one ok outcome/footer with ignored; required status refuses. |
+| integration-wrong-command | Remove `--exact` while retaining genuine outcomes; exact argv refuses. |
+| changed-formatter-body | Alter same inherited body in71/aaec fmt logs; published baseline comparison refuses. |
+| changed-successor-diff | Append text to correction patch; immutable Git diff refuses. |
+| duplicate-zip-member | Add duplicate member and refresh archive pin; ZIP uniqueness refuses. |
+
+A refusal at a different earlier check is an unexpected result, not a pass for the intended discriminator. The driver checks original package hashes after every case and at completion. It launches only the reviewed verifier with read-only Git access, never subject code, compiler, GUI, archived launchers or binaries. This is a finite proposal, not evidence of executed controls.

harness/experiments/analysis-mixed-project-20260924/ORIGINAL-PROPOSAL-README.md

@@ -0,0 +1,19 @@
+# Private mixed Project evidence — unverified proposal
+
+Current source `aaec78fcc9b273d1485497126392afdd1fb2e54e`; actual runtime source `71cadfa0cd0e112caa29588d2494753301f3cb6c`. This compact package is assembled for review. **Its portable verifier has not been executed.** Existing local readbacks are author evidence; package-level acceptance is pending review and an unchanged positive/control run.
+
+Recorded 71 results: strict all-target Clippy PASS; actual listing209; exact Project13 and shared-validation2 PASS; four literal public compatibility cases PASS. Full core lib **FAILED:193 passed/16 failed**, retaining every a578 baseline name/status and exact unsupported-public-source8 failure diagnostic. b9 strict/list success and Project focus **FAILED11/2** are preserved. The two failed one-warning test expectations were corrected at71 without production changes.
+
+The aaec78f formatting successor changes only two ConstructedDeclarations wraps and optional trailing commas. An author readback reports its direct file formatting check passed; that check is not a raw gate independently checked by this verifier. The recorded full fmt **FAILED** with exactly eight unchanged baseline blocks in five files. At71, fmt failed on those eight plus the two corrected language.rs blocks. No fresh aaec Clippy/list/runtime result is claimed. The source diffs and immutable 544-input manifests distinguish each revision.
+
+The ZIP contains raw current receipts/logs/input manifests, one copy of each hash-pinned launcher, the two exact Git correction diffs and concise notes. It contains no binaries or caches. Baseline evidence is referenced through published commit `85cc27fed02ce770c30c9447f35c4ab4d24f9644`, archive `harness/experiments/analysis-mixed-syntax-20260923/evidence.zip`, SHA-256 `f39aab1639ce14e4fe61744cf8881b0883ecbe131fefd6bc65c18edd8c81215d`. The verifier reads that immutable archive for actual listing194/full178/16, historical152 linkage and nine old formatter blocks; it does not duplicate or execute the earlier package.
+
+After review, run with a checkout containing all named Git objects:
+
+```text
+python -B verify.py --repo /path/to/ARCADIA-Studio
+```
+
+Only read-only Git commands execute, with replace objects, external diff, textconv and variable diff rendering disabled. ZIP payloads are read without extraction. Archived launchers, helpers and binaries never execute. The manifest pins the top-level ZIP and the executing packaged verifier. The verifier checks safe unique members/JSON keys, exact payload membership/hashes, complete immutable input membership/bytes, actual output names/footers/statuses, exact argv and the selected recorded environment fields, executable identity across listing/focus/full and each repeated integration-target pair, failed-history preservation, exact diagnostic causes and formatter bodies, and exact correction diffs. It does not capture or prove the complete process environment. Receipt hashes establish consistency, not authenticated authorship or an independent rerun. Keep an externally anchored package commit/checksum during transport.
+
+The notes contain full commands/environment and the source contract/implementation references. This is private complete-Project resolution evidence only. It does not activate public source8, complete mixed indexing/updating/export, prove GUI parity, or establish application completion. Full-suite and formatting failures remain explicit.

harness/experiments/analysis-mixed-project-20260924/README.md

@@ -0,0 +1,29 @@
+# Private mixed Project: verified evidence consistency
+
+The unchanged v2 package passed its portable consistency verifier, and **all15 finite controls passed**: one unchanged positive and14 deliberate corruptions reached their intended acceptance/refusal checks. An independent read-only review confirmed every raw output/result pin and all original package bytes. See [control summary](controls/summary.json), [positive output](controls/unchanged-positive.stdout.log), and [independent review](controls/REVIEW.md). The parent reviewed the verifier and driver before executing this finite set, read the independent results, and preserved its original bytes for delivery.
+
+Source is `aaec78fcc9b273d1485497126392afdd1fb2e54e`; actual runtime-tested source is `71cadfa0cd0e112caa29588d2494753301f3cb6c`. At71: strict all-target core Clippy PASS; actual listing209; Project13/13 and shared-validation2/2 PASS; four exact public compatibility cases PASS. Full core lib remains **FAILED:193 passed/16 failed**, preserving all194 a578 baseline statuses and exact failure diagnostics rejecting public source8. These failures are not passes or application acceptance. The earlier b9 Project focus **FAILED11/2** remains archived; its one-warning expectations were corrected by the test-only71 commit.
+
+The aaec successor changes only two ConstructedDeclarations wraps and optional trailing commas. Its full formatter gate remains **FAILED with eight inherited blocks** in five unchanged baseline files. The two new language.rs blocks from71 are gone. No new aaec Clippy/list/runtime result is claimed. An author readback reports the direct language.rs rustfmt check passed; that is distinct from the raw full-format gate independently checked by the verifier.
+
+The source contract is [aecee2a: analysis-mixed-project-contract-20260923.md](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/src/commit/aecee2aff3f4410648a501a70cb2e6160c81adc5/harness/analysis-mixed-project-contract-20260923.md). The implementation note is [aaec78f: analysis-mixed-project-implementation-20260923.md](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/src/commit/aaec78fcc9b273d1485497126392afdd1fb2e54e/harness/analysis-mixed-project-implementation-20260923.md). Source aaec78f is published on `codex/analysis-mixed-project-956atf-20260923` and its remote ref was verified. The implementation note describes the original source checkpoint; the executed results are recorded here without rewriting that historical architectural record.
+
+The baseline is the separately [published85cc package](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/src/commit/85cc27fed02ce770c30c9447f35c4ab4d24f9644/harness/experiments/analysis-mixed-syntax-20260923/README.md), whose `evidence.zip` SHA256 is `f39aab1639ce14e4fe61744cf8881b0883ecbe131fefd6bc65c18edd8c81215d`. Its immutable archive supplies listing194/full178/16, historical152 linkage and prior formatter blocks. It is referenced rather than duplicated.
+
+## Reproduce the consistency check
+
+Use a checkout containing the named b9/71/aaec source objects and published85cc baseline archive. Source/runtime commands and recorded environment fields remain in the ZIP's author handoff and raw gate receipts.
+
+```text
+python -B verify.py --repo /path/to/ARCADIA-Studio
+```
+
+The verifier performs read-only Git queries and reads ZIP members without extraction. It does not execute archived launchers, subject tests, binaries or compilers. It checks the top-level ZIP/verifier pins, exact payload/input membership and immutable Git bytes, actual output names/statuses/footers, exact commands and selected recorded environment fields, artifact identities across listing/focus/full and repeated integration-target pairs, failure history/causes, formatter bodies and exact correction diffs. It does not establish the full process environment, authenticated receipt authorship, or an independent subject rerun.
+
+Git queries use `--no-replace-objects`. Diff queries disable external diff/textconv/color and explicitly set prefixes, Myers algorithm, indent heuristic, three-line context, seven-character abbreviation and no renames. **Not every Git rendering option is overridden:** a nondefault `diff.interHunkContext` can merge hunks and cause a false refusal of the exact patch comparison. The pinned verifier is unchanged. Run with the original/default setting or set the invoking process's Git configuration to `diff.interHunkContext=0`; do not weaken the exact comparison or edit archived patches to bypass refusal.
+
+## Preserved package and limits
+
+The ZIP, manifest, verifier, control driver and finite control plan are byte-exact copies of the tested v2 package. Its original README is retained as [ORIGINAL-PROPOSAL-README.md](ORIGINAL-PROPOSAL-README.md). The manifest's `NOT RUN` assembly status and original notes are preserved historical text; the completed execution status is recorded separately in the control evidence above. [publication-manifest.json](publication-manifest.json) pins every delivered file except itself. All raw control outputs are under `controls/`; transient corrupted archives were not retained.
+
+This remains **private complete-Project resolution evidence**. Public source8 is not activated; mixed indexing/updating/export and full graphical/textual parity remain deferred. This package neither integrates private parser work into prerelease#37 nor claims shipped application/GUI completion. The private source branch and this evidence are delivered separately from the application release branch. Full-suite and formatting failures remain explicit.

harness/experiments/analysis-mixed-project-20260924/controls.py

@@ -0,0 +1,211 @@
+"""Finite proposal controls. Run only AFTER parent review; never runs subject code.
+
+One unchanged positive, then fourteen negatives, stopping on the first unexpected
+result or timeout. Only one transient ZIP exists; retain compact logs/results.
+"""
+from pathlib import Path
+import argparse
+import copy
+import hashlib
+import json
+import re
+import subprocess
+import sys
+import tempfile
+import zipfile
+
+FULL = 'gates/project-full-71cadfa-1'
+PROJECT_NAME = 'language::analysis_source::mixed::project::tests::complete_oa_sa_forward_model_warning_and_original_authority'
+CASES = [
+    ('archive-pin', 'Top-level archive pin differs'),
+    ('verifier-pin', 'Top-level verifier pin differs'),
+    ('route-pair-artifact', 'Repeated integration target artifact differs'),
+    ('source-pair-artifact', 'Repeated integration target artifact differs'),
+    ('missing-new-outcome', 'Missing/extra runtime outcomes'),
+    ('changed-inherited-diagnostic', 'Exact historical failure diagnostics changed'),
+    ('forged-git-input', 'Git input bytes mismatch'),
+    ('missing-failed-history', 'Missing/extra package payload'),
+    ('integration-zero-test', 'Missing/extra runtime outcomes'),
+    ('integration-ignored', 'Runtime status mismatch'),
+    ('integration-wrong-command', 'Exact command/mode/filter differs'),
+    ('changed-formatter-body', 'Inherited formatter block body differs'),
+    ('changed-successor-diff', 'Exact Git correction diff differs'),
+    ('duplicate-zip-member', 'Duplicate ZIP members'),
+]
+
+
+def sha(raw):
+    return hashlib.sha256(raw).hexdigest()
+
+
+def encode(value):
+    return (json.dumps(value, indent=2) + '\n').encode()
+
+
+def mutate(case, payload):
+    if case in ('route-pair-artifact', 'source-pair-artifact'):
+        kind = 'route-errors' if case.startswith('route-') else 'aggregate-references'
+        name = 'gates/project-' + kind + '-71cadfa-1.result.json'
+        r = json.loads(payload[name])
+        old = r['artifacts'][0]['sha256']
+        r['artifacts'][0]['sha256'] = '0' * 64 if old != '0' * 64 else '1' * 64
+        payload[name] = encode(r)
+        return name + ': change only one repeated target artifact SHA, keeping its path/size and all outcomes.'
+    if case == 'missing-new-outcome':
+        name = FULL + '.log'
+        text = payload[name].decode()
+        text, count = re.subn(r'^test ' + re.escape(PROJECT_NAME) + r' \.\.\. ok\r?\n', '', text, flags=re.M)
+        assert count == 1
+        payload[name] = text.replace('193 passed; 16 failed', '192 passed; 16 failed').encode()
+        return name + ': omit one new outcome and adjust pass count; exact membership must reject.'
+    if case == 'changed-inherited-diagnostic':
+        name = FULL + '.log'
+        text = payload[name].decode()
+        old = 'field: None, line: 1, column: 9, message: "Unsupported schema version:'
+        assert old in text
+        payload[name] = text.replace(old, old.replace('column: 9', 'column: 10'), 1).encode()
+        return name + ': change one inherited diagnostic column, retaining name/status/header error.'
+    if case == 'forged-git-input':
+        for name in list(payload):
+            if name.endswith('-71cadfa-1.inputs.json'):
+                r = json.loads(payload[name])
+                r['inputs'][0]['sha256'] = '0' * 64
+                payload[name] = encode(r)
+        return 'All71 input manifests: consistently forge first input SHA; immutable Git must reject.'
+    if case == 'missing-failed-history':
+        for suffix in ('.result.json', '.log', '.inputs.json'):
+            del payload['gates/project-focused-b9a31bb-1' + suffix]
+        return 'Remove only b9 failed-focus triple; mandatory history membership must reject.'
+    if case in ('integration-zero-test', 'integration-ignored'):
+        name = 'gates/project-route-errors-71cadfa-1.log'
+        text = payload[name].decode()
+        pattern = r'^test invalid_route_source_has_located_errors_and_no_silent_nested_defaults \.\.\. ok\r?\n'
+        replacement = '' if case == 'integration-zero-test' else 'test invalid_route_source_has_located_errors_and_no_silent_nested_defaults ... ignored\n'
+        text, count = re.subn(pattern, replacement, text, flags=re.M)
+        assert count == 1
+        if case == 'integration-zero-test':
+            text = text.replace('running 1 test', 'running 0 tests').replace('1 passed; 0 failed; 0 ignored; 0 measured; 4 filtered out', '0 passed; 0 failed; 0 ignored; 0 measured; 5 filtered out')
+        else:
+            text = text.replace('1 passed; 0 failed; 0 ignored;', '0 passed; 0 failed; 1 ignored;')
+        payload[name] = text.encode()
+        return name + ': synthesize zero-test success or ignored outcome with matching footer.'
+    if case == 'integration-wrong-command':
+        name = 'gates/project-route-errors-71cadfa-1.result.json'
+        r = json.loads(payload[name])
+        r['command'].remove('--exact')
+        payload[name] = encode(r)
+        return name + ': remove --exact while retaining the outcome; exact argv must reject.'
+    if case == 'changed-formatter-body':
+        for short in ('71cadfa', 'aaec78f'):
+            name = 'gates/project-fmt-' + short + '-1.log'
+            text = payload[name].decode()
+            old = '+            Self::EngineeringProperty | Self::AnalysisCase | Self::AnalysisCheck'
+            assert text.count(old) == 1
+            payload[name] = text.replace(old, old + ' /* altered */').encode()
+        return 'Both fmt logs: alter the same inherited block body, retaining locations/counts.'
+    if case == 'changed-successor-diff':
+        name = 'diffs/71cadfa-to-aaec78f.patch'
+        payload[name] += b'\n# altered correction\n'
+        return name + ': append text; exact immutable Git diff must reject.'
+    return 'Transport-only ZIP/verifier pin corruption or duplicate ZIP member.'
+
+
+def repair(payload, manifest):
+    # Refresh every inner receipt binding and outcome vector, then all outer
+    # payload hashes. ZIP and verifier pins are refreshed by materialize below.
+    for name in list(payload):
+        if name.startswith('gates/') and name.endswith('.result.json'):
+            stem = name[:-len('.result.json')]
+            r = json.loads(payload[name])
+            r['log_sha256'] = sha(payload[stem + '.log'])
+            r['inputs_sha256'] = sha(payload[stem + '.inputs.json'])
+            rows = re.findall(r'^test ([^\r\n]+) \.\.\. (ok|FAILED|ignored)\r?$', payload[stem + '.log'].decode(), re.M)
+            r['outcomes'] = [list(row) for row in rows]
+            payload[name] = encode(r)
+    manifest['payloads'] = {name: {'bytes': len(raw), 'sha256': sha(raw)} for name, raw in sorted(payload.items())}
+
+
+def materialize(folder, payload, manifest, verifier, case):
+    (folder / 'verify.py').write_bytes(verifier)
+    archive = folder / 'evidence.zip'
+    with zipfile.ZipFile(archive, 'x', compression=zipfile.ZIP_DEFLATED) as z:
+        for name, raw in sorted(payload.items()):
+            z.writestr(name, raw)
+        if case == 'duplicate-zip-member':
+            name = sorted(payload)[0]
+            z.writestr(name, payload[name])
+    raw = archive.read_bytes()
+    manifest['archive'] = {'file': 'evidence.zip', 'bytes': len(raw), 'sha256': sha(raw)}
+    manifest['verifier'] = {'file': 'verify.py', 'bytes': len(verifier), 'sha256': sha(verifier)}
+    if case == 'archive-pin':
+        with archive.open('ab') as stream:
+            stream.write(b'altered-transport')
+    if case == 'verifier-pin':
+        manifest['verifier']['sha256'] = '0' * 64
+    (folder / 'manifest.json').write_bytes(encode(manifest))
+
+
+def main():
+    if sys.flags.optimize:
+        raise SystemExit('Optimized Python is forbidden for these controls.')
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--repo', type=Path, required=True)
+    parser.add_argument('--package', type=Path, default=Path(__file__).resolve().parent)
+    parser.add_argument('--out', type=Path, required=True)
+    parser.add_argument('--timeout-seconds', type=int, default=300)
+    args = parser.parse_args()
+    package, out = args.package.resolve(), args.out.resolve()
+    assert not out.exists() and not out.is_relative_to(package) and not package.is_relative_to(out), 'Choose a fresh output outside the original package.'
+    assert 30 <= args.timeout_seconds <= 600
+    original = {path.name: path.read_bytes() for path in package.iterdir() if path.is_file()}
+    verifier = original['verify.py']
+    manifest = json.loads(original['manifest.json'])
+    with zipfile.ZipFile(package / 'evidence.zip') as z:
+        assert len(z.namelist()) == len(set(z.namelist()))
+        payload = {name: z.read(name) for name in z.namelist()}
+    out.mkdir(parents=True, exist_ok=False)
+    results = []
+    def unchanged():
+        assert {path.name for path in package.iterdir() if path.is_file()} == set(original)
+        assert all((package / name).read_bytes() == raw for name, raw in original.items()), 'Original package changed.'
+    def run(case, current, expected, mutation):
+        argv = [sys.executable, '-B', str(package / 'verify.py'), '--repo', str(args.repo.resolve()), '--package', str(current)]
+        try:
+            r = subprocess.run(argv, stdout=subprocess.PIPE, stderr=subprocess.PIPE, timeout=args.timeout_seconds)
+            stdout, stderr, code = r.stdout, r.stderr, r.returncode
+            passed = code == 0 if expected is None else code != 0 and expected in stderr.decode(errors='replace') and 'REFUSED:' in stderr.decode(errors='replace')
+            status = 'PASS' if passed else 'UNEXPECTED_RESULT'
+        except subprocess.TimeoutExpired as error:
+            stdout, stderr, code, status = error.stdout or b'', error.stderr or b'', None, 'TIMEOUT'
+        row = {'case': case, 'status': status, 'exit': code, 'expected_refusal': expected, 'mutation': mutation, 'command': argv,
+               'stdout_sha256': sha(stdout), 'stderr_sha256': sha(stderr), 'semantic_transport_hashes_refreshed': expected is not None and case not in ('archive-pin', 'verifier-pin')}
+        (out / (case + '.stdout.log')).write_bytes(stdout)
+        (out / (case + '.stderr.log')).write_bytes(stderr)
+        (out / (case + '.result.json')).write_bytes(encode(row))
+        results.append(row)
+        unchanged()
+        return status == 'PASS'
+    proceed = run('unchanged-positive', package, None, 'Original bytes, no mutation.')
+    if proceed:
+        for case, expected in CASES:
+            current_payload, current_manifest = dict(payload), copy.deepcopy(manifest)
+            mutation = mutate(case, current_payload)
+            repair(current_payload, current_manifest)
+            with tempfile.TemporaryDirectory(prefix='case-', dir=out) as temporary:
+                folder = Path(temporary).resolve()
+                assert folder.parent == out and not folder.is_symlink(), 'Temporary cleanup must remain in the named controls output.'
+                materialize(folder, current_payload, current_manifest, verifier, case)
+                proceed = run(case, folder, expected, mutation)
+            if not proceed:
+                break
+    summary = {'status': 'PASS' if proceed and len(results) == 15 else 'INCOMPLETE_OR_FAILED', 'planned': 15, 'executed': len(results),
+               'package_pins': {name: {'bytes': len(raw), 'sha256': sha(raw)} for name, raw in original.items()}, 'results': results,
+               'limits': 'Evidence consistency controls only. No subject/compiler/GUI execution; no retained mutated archive corpus.'}
+    unchanged()
+    (out / 'summary.json').write_bytes(encode(summary))
+    print(json.dumps({'status': summary['status'], 'executed': len(results), 'summary': str(out / 'summary.json')}, indent=2))
+    return 0 if summary['status'] == 'PASS' else 1
+
+
+if __name__ == '__main__':
+    raise SystemExit(main())

harness/experiments/analysis-mixed-project-20260924/controls/REVIEW.md

@@ -0,0 +1,38 @@
+# Independent v2 control readback
+
+**PASS: one unchanged positive and all fourteen declared negatives reached their intended outcomes.** This was a read-only review of completed evidence, not another verifier/control run. No subject code, compiler or GUI was executed. Only this review file was added.
+
+All 15 per-case result JSONs equal their summary rows; all 30 raw stdout/stderr files match their recorded SHA256. All six original package files still match the frozen package pins. Commands identify the reviewed verifier, the intended repository and either the original positive package or a transient negative package beneath this controls directory.
+
+The positive exited 0 with empty stderr. Its parsed output retains source `aaec78fcc9b273d1485497126392afdd1fb2e54e`, runtime source `71cadfa0cd0e112caa29588d2494753301f3cb6c`, listing 209, Project 13/admission 2/four integration passes, and strict PASS at the runtime source. Crucially, the **full suite remains FAILED: 193 passed/16 failed**, and successor **formatting remains FAILED with eight inherited blocks**. Prior statuses/diagnostics are reported preserved; `successor_runtime_claim` is false. This is private Project evidence, with no public source8 success, GUI completion or prerelease-production acceptance implied.
+
+Each negative exited 1 with empty stdout and exactly one `REFUSED:` stderr line. Observed boundaries:
+
+| Case | Exact refusal after `REFUSED: ` |
+| --- | --- |
+| archive-pin | Top-level archive pin differs |
+| verifier-pin | Top-level verifier pin differs |
+| route-pair-artifact | Repeated integration target artifact differs |
+| source-pair-artifact | Repeated integration target artifact differs |
+| missing-new-outcome | Missing/extra runtime outcomes |
+| changed-inherited-diagnostic | Exact historical failure diagnostics changed |
+| forged-git-input | Git input bytes mismatch: Cargo.lock |
+| missing-failed-history | Missing/extra package payload |
+| integration-zero-test | Missing/extra runtime outcomes |
+| integration-ignored | Runtime status mismatch |
+| integration-wrong-command | Exact command/mode/filter differs |
+| changed-formatter-body | Inherited formatter block body differs |
+| changed-successor-diff | Exact Git correction diff differs |
+| duplicate-zip-member | Duplicate ZIP members |
+
+The semantic cases therefore reached their declared checks, not an incidental stale transport hash. The two top-level pin cases intentionally retained incorrect pins. The reviewed driver refreshes inner receipt/outcome and outer payload/archive bindings for the other cases; raw outcomes agree with that design. Mutated archives were transient and are not retained, so this readback reviews recorded execution plus the frozen mutation code rather than independently reconstructing each mutant.
+
+Reviewed anchors:
+
+- `summary.json`: SHA256 `c39e52c220b0b023382d70ed4344597cf3596e741ca67995fb67edf8e9aa20c8`.
+- Verifier: 23,199 bytes, SHA256 `f94e5f4a733c82c0b240dc4c64557bf34f6705590144df686ccfbc53c076b6ff`.
+- Control driver: 11,834 bytes, SHA256 `0d2cd38c7baffba78cd2f009d832c7a16e9ac46437d56105a484821ce54601e7`.
+- ZIP: 490,311 bytes, SHA256 `a42f29c9adc05adc6bd0c881b716bda3bd098732eb081b0f6214252db5d29d83`.
+- Manifest: 9,112 bytes, SHA256 `9277764168157819faaddaa8dffd2714efe995e2e136c795a51cc10340cd2f50`.
+
+No unexpected refusal, timeout, changed original package pin or contradictory positive result was found. The result establishes this finite consistency-control set; it does not authenticate historical execution or turn retained failures into passes.

harness/experiments/analysis-mixed-project-20260924/controls/archive-pin.result.json

@@ -0,0 +1,19 @@
+{
+  "case": "archive-pin",
+  "status": "PASS",
+  "exit": 1,
+  "expected_refusal": "Top-level archive pin differs",
+  "mutation": "Transport-only ZIP/verifier pin corruption or duplicate ZIP member.",
+  "command": [
+    "C:\\Users\\User\\.cache\\codex-runtimes\\codex-primary-runtime\\dependencies\\python\\python.exe",
+    "-B",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-proposal-v2-20260924\\verify.py",
+    "--repo",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio",
+    "--package",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-controls-v2-20260924-1\\case-7xqikh2m"
+  ],
+  "stdout_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+  "stderr_sha256": "d312212a64253be66ea3dae99ac7596865374f80bd64005481241c3d9b8675f4",
+  "semantic_transport_hashes_refreshed": false
+}

harness/experiments/analysis-mixed-project-20260924/controls/archive-pin.stderr.log

@@ -0,0 +1 @@
+REFUSED: Top-level archive pin differs

harness/experiments/analysis-mixed-project-20260924/controls/changed-formatter-body.result.json

@@ -0,0 +1,19 @@
+{
+  "case": "changed-formatter-body",
+  "status": "PASS",
+  "exit": 1,
+  "expected_refusal": "Inherited formatter block body differs",
+  "mutation": "Both fmt logs: alter the same inherited block body, retaining locations/counts.",
+  "command": [
+    "C:\\Users\\User\\.cache\\codex-runtimes\\codex-primary-runtime\\dependencies\\python\\python.exe",
+    "-B",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-proposal-v2-20260924\\verify.py",
+    "--repo",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio",
+    "--package",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-controls-v2-20260924-1\\case-l9jy1zgj"
+  ],
+  "stdout_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+  "stderr_sha256": "efa75ca69cccfe361e7f15bbf1ab67095f4ad6eaf87293414e51b800888c0c36",
+  "semantic_transport_hashes_refreshed": true
+}

harness/experiments/analysis-mixed-project-20260924/controls/changed-formatter-body.stderr.log

@@ -0,0 +1 @@
+REFUSED: Inherited formatter block body differs

harness/experiments/analysis-mixed-project-20260924/controls/changed-inherited-diagnostic.result.json

@@ -0,0 +1,19 @@
+{
+  "case": "changed-inherited-diagnostic",
+  "status": "PASS",
+  "exit": 1,
+  "expected_refusal": "Exact historical failure diagnostics changed",
+  "mutation": "gates/project-full-71cadfa-1.log: change one inherited diagnostic column, retaining name/status/header error.",
+  "command": [
+    "C:\\Users\\User\\.cache\\codex-runtimes\\codex-primary-runtime\\dependencies\\python\\python.exe",
+    "-B",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-proposal-v2-20260924\\verify.py",
+    "--repo",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio",
+    "--package",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-controls-v2-20260924-1\\case-60ivmn8r"
+  ],
+  "stdout_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+  "stderr_sha256": "3e5dc08afdee9b77cf4c507bea74aed13df97667f9b51d87e03f6ec63114dd4d",
+  "semantic_transport_hashes_refreshed": true
+}

harness/experiments/analysis-mixed-project-20260924/controls/changed-inherited-diagnostic.stderr.log

@@ -0,0 +1 @@
+REFUSED: Exact historical failure diagnostics changed

harness/experiments/analysis-mixed-project-20260924/controls/changed-successor-diff.result.json

@@ -0,0 +1,19 @@
+{
+  "case": "changed-successor-diff",
+  "status": "PASS",
+  "exit": 1,
+  "expected_refusal": "Exact Git correction diff differs",
+  "mutation": "diffs/71cadfa-to-aaec78f.patch: append text; exact immutable Git diff must reject.",
+  "command": [
+    "C:\\Users\\User\\.cache\\codex-runtimes\\codex-primary-runtime\\dependencies\\python\\python.exe",
+    "-B",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-proposal-v2-20260924\\verify.py",
+    "--repo",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio",
+    "--package",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-controls-v2-20260924-1\\case-3imoup9b"
+  ],
+  "stdout_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+  "stderr_sha256": "370188fb9e8276c8c03588a8d8a2e211d3eb4d0f9f7195aa8030485436635fb2",
+  "semantic_transport_hashes_refreshed": true
+}

harness/experiments/analysis-mixed-project-20260924/controls/changed-successor-diff.stderr.log

@@ -0,0 +1 @@
+REFUSED: Exact Git correction diff differs

harness/experiments/analysis-mixed-project-20260924/controls/duplicate-zip-member.result.json

@@ -0,0 +1,19 @@
+{
+  "case": "duplicate-zip-member",
+  "status": "PASS",
+  "exit": 1,
+  "expected_refusal": "Duplicate ZIP members",
+  "mutation": "Transport-only ZIP/verifier pin corruption or duplicate ZIP member.",
+  "command": [
+    "C:\\Users\\User\\.cache\\codex-runtimes\\codex-primary-runtime\\dependencies\\python\\python.exe",
+    "-B",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-proposal-v2-20260924\\verify.py",
+    "--repo",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio",
+    "--package",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-controls-v2-20260924-1\\case-m7ol708v"
+  ],
+  "stdout_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+  "stderr_sha256": "3d2d7e221ca2260dffaec5e5c15488e4317d59339bbf88511a79f58c03a36607",
+  "semantic_transport_hashes_refreshed": true
+}

harness/experiments/analysis-mixed-project-20260924/controls/duplicate-zip-member.stderr.log

@@ -0,0 +1 @@
+REFUSED: Duplicate ZIP members

harness/experiments/analysis-mixed-project-20260924/controls/forged-git-input.result.json

@@ -0,0 +1,19 @@
+{
+  "case": "forged-git-input",
+  "status": "PASS",
+  "exit": 1,
+  "expected_refusal": "Git input bytes mismatch",
+  "mutation": "All71 input manifests: consistently forge first input SHA; immutable Git must reject.",
+  "command": [
+    "C:\\Users\\User\\.cache\\codex-runtimes\\codex-primary-runtime\\dependencies\\python\\python.exe",
+    "-B",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-proposal-v2-20260924\\verify.py",
+    "--repo",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio",
+    "--package",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-controls-v2-20260924-1\\case-p4xl65pf"
+  ],
+  "stdout_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+  "stderr_sha256": "ecdc48f2565108daac7e3686f764d43c94a5bf50e8772fd147c29635d3b546a9",
+  "semantic_transport_hashes_refreshed": true
+}

harness/experiments/analysis-mixed-project-20260924/controls/forged-git-input.stderr.log

@@ -0,0 +1 @@
+REFUSED: Git input bytes mismatch: Cargo.lock

harness/experiments/analysis-mixed-project-20260924/controls/integration-ignored.result.json

@@ -0,0 +1,19 @@
+{
+  "case": "integration-ignored",
+  "status": "PASS",
+  "exit": 1,
+  "expected_refusal": "Runtime status mismatch",
+  "mutation": "gates/project-route-errors-71cadfa-1.log: synthesize zero-test success or ignored outcome with matching footer.",
+  "command": [
+    "C:\\Users\\User\\.cache\\codex-runtimes\\codex-primary-runtime\\dependencies\\python\\python.exe",
+    "-B",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-proposal-v2-20260924\\verify.py",
+    "--repo",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio",
+    "--package",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-controls-v2-20260924-1\\case-cu8mu3sl"
+  ],
+  "stdout_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+  "stderr_sha256": "15d3d0e2c6fb3f20f18c2c8d7ed4f67ec51578df0c66d79cb395c0cd2a955190",
+  "semantic_transport_hashes_refreshed": true
+}

harness/experiments/analysis-mixed-project-20260924/controls/integration-ignored.stderr.log

@@ -0,0 +1 @@
+REFUSED: Runtime status mismatch

harness/experiments/analysis-mixed-project-20260924/controls/integration-wrong-command.result.json

@@ -0,0 +1,19 @@
+{
+  "case": "integration-wrong-command",
+  "status": "PASS",
+  "exit": 1,
+  "expected_refusal": "Exact command/mode/filter differs",
+  "mutation": "gates/project-route-errors-71cadfa-1.result.json: remove --exact while retaining the outcome; exact argv must reject.",
+  "command": [
+    "C:\\Users\\User\\.cache\\codex-runtimes\\codex-primary-runtime\\dependencies\\python\\python.exe",
+    "-B",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-proposal-v2-20260924\\verify.py",
+    "--repo",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio",
+    "--package",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-controls-v2-20260924-1\\case-k0p20tv3"
+  ],
+  "stdout_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+  "stderr_sha256": "6079ceba49384f935331c52ca7bf4d7928a73d311e2a125e36aa1cdd9ae9a982",
+  "semantic_transport_hashes_refreshed": true
+}

harness/experiments/analysis-mixed-project-20260924/controls/integration-wrong-command.stderr.log

@@ -0,0 +1 @@
+REFUSED: Exact command/mode/filter differs

harness/experiments/analysis-mixed-project-20260924/controls/integration-zero-test.result.json

@@ -0,0 +1,19 @@
+{
+  "case": "integration-zero-test",
+  "status": "PASS",
+  "exit": 1,
+  "expected_refusal": "Missing/extra runtime outcomes",
+  "mutation": "gates/project-route-errors-71cadfa-1.log: synthesize zero-test success or ignored outcome with matching footer.",
+  "command": [
+    "C:\\Users\\User\\.cache\\codex-runtimes\\codex-primary-runtime\\dependencies\\python\\python.exe",
+    "-B",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-proposal-v2-20260924\\verify.py",
+    "--repo",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio",
+    "--package",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-controls-v2-20260924-1\\case-z6jk_oy_"
+  ],
+  "stdout_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+  "stderr_sha256": "4ea6eb7a458fba980b8e4d8594be7d265cc93730502d4834f9ea2503185b555e",
+  "semantic_transport_hashes_refreshed": true
+}

harness/experiments/analysis-mixed-project-20260924/controls/integration-zero-test.stderr.log

@@ -0,0 +1 @@
+REFUSED: Missing/extra runtime outcomes

harness/experiments/analysis-mixed-project-20260924/controls/missing-failed-history.result.json

@@ -0,0 +1,19 @@
+{
+  "case": "missing-failed-history",
+  "status": "PASS",
+  "exit": 1,
+  "expected_refusal": "Missing/extra package payload",
+  "mutation": "Remove only b9 failed-focus triple; mandatory history membership must reject.",
+  "command": [
+    "C:\\Users\\User\\.cache\\codex-runtimes\\codex-primary-runtime\\dependencies\\python\\python.exe",
+    "-B",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-proposal-v2-20260924\\verify.py",
+    "--repo",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio",
+    "--package",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-controls-v2-20260924-1\\case-njsb6r9_"
+  ],
+  "stdout_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+  "stderr_sha256": "9996afdaae04ab63cb6907ab75bd732f408cd6af12d2d0a9268cf39bbb54425c",
+  "semantic_transport_hashes_refreshed": true
+}

harness/experiments/analysis-mixed-project-20260924/controls/missing-failed-history.stderr.log

@@ -0,0 +1 @@
+REFUSED: Missing/extra package payload

harness/experiments/analysis-mixed-project-20260924/controls/missing-new-outcome.result.json

@@ -0,0 +1,19 @@
+{
+  "case": "missing-new-outcome",
+  "status": "PASS",
+  "exit": 1,
+  "expected_refusal": "Missing/extra runtime outcomes",
+  "mutation": "gates/project-full-71cadfa-1.log: omit one new outcome and adjust pass count; exact membership must reject.",
+  "command": [
+    "C:\\Users\\User\\.cache\\codex-runtimes\\codex-primary-runtime\\dependencies\\python\\python.exe",
+    "-B",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-proposal-v2-20260924\\verify.py",
+    "--repo",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio",
+    "--package",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-controls-v2-20260924-1\\case-j2xqghr9"
+  ],
+  "stdout_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+  "stderr_sha256": "4ea6eb7a458fba980b8e4d8594be7d265cc93730502d4834f9ea2503185b555e",
+  "semantic_transport_hashes_refreshed": true
+}

harness/experiments/analysis-mixed-project-20260924/controls/missing-new-outcome.stderr.log

@@ -0,0 +1 @@
+REFUSED: Missing/extra runtime outcomes

harness/experiments/analysis-mixed-project-20260924/controls/route-pair-artifact.result.json

@@ -0,0 +1,19 @@
+{
+  "case": "route-pair-artifact",
+  "status": "PASS",
+  "exit": 1,
+  "expected_refusal": "Repeated integration target artifact differs",
+  "mutation": "gates/project-route-errors-71cadfa-1.result.json: change only one repeated target artifact SHA, keeping its path/size and all outcomes.",
+  "command": [
+    "C:\\Users\\User\\.cache\\codex-runtimes\\codex-primary-runtime\\dependencies\\python\\python.exe",
+    "-B",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-proposal-v2-20260924\\verify.py",
+    "--repo",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio",
+    "--package",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-controls-v2-20260924-1\\case-iky8xrqv"
+  ],
+  "stdout_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+  "stderr_sha256": "193b24af95f1d6b7c52237d1ccd2b3aa88be65db6b248eb68e591bef0e6b1d66",
+  "semantic_transport_hashes_refreshed": true
+}

harness/experiments/analysis-mixed-project-20260924/controls/route-pair-artifact.stderr.log

@@ -0,0 +1 @@
+REFUSED: Repeated integration target artifact differs

harness/experiments/analysis-mixed-project-20260924/controls/source-pair-artifact.result.json

@@ -0,0 +1,19 @@
+{
+  "case": "source-pair-artifact",
+  "status": "PASS",
+  "exit": 1,
+  "expected_refusal": "Repeated integration target artifact differs",
+  "mutation": "gates/project-aggregate-references-71cadfa-1.result.json: change only one repeated target artifact SHA, keeping its path/size and all outcomes.",
+  "command": [
+    "C:\\Users\\User\\.cache\\codex-runtimes\\codex-primary-runtime\\dependencies\\python\\python.exe",
+    "-B",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-proposal-v2-20260924\\verify.py",
+    "--repo",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio",
+    "--package",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-controls-v2-20260924-1\\case-kqipt08i"
+  ],
+  "stdout_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+  "stderr_sha256": "193b24af95f1d6b7c52237d1ccd2b3aa88be65db6b248eb68e591bef0e6b1d66",
+  "semantic_transport_hashes_refreshed": true
+}

harness/experiments/analysis-mixed-project-20260924/controls/source-pair-artifact.stderr.log

@@ -0,0 +1 @@
+REFUSED: Repeated integration target artifact differs

harness/experiments/analysis-mixed-project-20260924/controls/summary.json

@@ -0,0 +1,319 @@
+{
+  "status": "PASS",
+  "planned": 15,
+  "executed": 15,
+  "package_pins": {
+    "CONTROLS.md": {
+      "bytes": 3075,
+      "sha256": "caee9431b94df6f85f2c0477fa8c29268c4c84a13672c65a8d99d4e268a18d0d"
+    },
+    "controls.py": {
+      "bytes": 11834,
+      "sha256": "0d2cd38c7baffba78cd2f009d832c7a16e9ac46437d56105a484821ce54601e7"
+    },
+    "evidence.zip": {
+      "bytes": 490311,
+      "sha256": "a42f29c9adc05adc6bd0c881b716bda3bd098732eb081b0f6214252db5d29d83"
+    },
+    "manifest.json": {
+      "bytes": 9112,
+      "sha256": "9277764168157819faaddaa8dffd2714efe995e2e136c795a51cc10340cd2f50"
+    },
+    "README.md": {
+      "bytes": 3455,
+      "sha256": "41aa843ea33740f0d2c8b20a63caa73f41508921b61e881db522c87e11bd2ec6"
+    },
+    "verify.py": {
+      "bytes": 23199,
+      "sha256": "f94e5f4a733c82c0b240dc4c64557bf34f6705590144df686ccfbc53c076b6ff"
+    }
+  },
+  "results": [
+    {
+      "case": "unchanged-positive",
+      "status": "PASS",
+      "exit": 0,
+      "expected_refusal": null,
+      "mutation": "Original bytes, no mutation.",
+      "command": [
+        "C:\\Users\\User\\.cache\\codex-runtimes\\codex-primary-runtime\\dependencies\\python\\python.exe",
+        "-B",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-proposal-v2-20260924\\verify.py",
+        "--repo",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio",
+        "--package",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-proposal-v2-20260924"
+      ],
+      "stdout_sha256": "daee4749971ad9f41a5e1d8f0560b1b61a9168b21f2fd934d8781beddbc6d642",
+      "stderr_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+      "semantic_transport_hashes_refreshed": false
+    },
+    {
+      "case": "archive-pin",
+      "status": "PASS",
+      "exit": 1,
+      "expected_refusal": "Top-level archive pin differs",
+      "mutation": "Transport-only ZIP/verifier pin corruption or duplicate ZIP member.",
+      "command": [
+        "C:\\Users\\User\\.cache\\codex-runtimes\\codex-primary-runtime\\dependencies\\python\\python.exe",
+        "-B",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-proposal-v2-20260924\\verify.py",
+        "--repo",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio",
+        "--package",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-controls-v2-20260924-1\\case-7xqikh2m"
+      ],
+      "stdout_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+      "stderr_sha256": "d312212a64253be66ea3dae99ac7596865374f80bd64005481241c3d9b8675f4",
+      "semantic_transport_hashes_refreshed": false
+    },
+    {
+      "case": "verifier-pin",
+      "status": "PASS",
+      "exit": 1,
+      "expected_refusal": "Top-level verifier pin differs",
+      "mutation": "Transport-only ZIP/verifier pin corruption or duplicate ZIP member.",
+      "command": [
+        "C:\\Users\\User\\.cache\\codex-runtimes\\codex-primary-runtime\\dependencies\\python\\python.exe",
+        "-B",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-proposal-v2-20260924\\verify.py",
+        "--repo",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio",
+        "--package",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-controls-v2-20260924-1\\case-uinxoc7p"
+      ],
+      "stdout_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+      "stderr_sha256": "fca5b1d1f72cba26710c9481743247e50024286837be10e16fa5b04829fa4286",
+      "semantic_transport_hashes_refreshed": false
+    },
+    {
+      "case": "route-pair-artifact",
+      "status": "PASS",
+      "exit": 1,
+      "expected_refusal": "Repeated integration target artifact differs",
+      "mutation": "gates/project-route-errors-71cadfa-1.result.json: change only one repeated target artifact SHA, keeping its path/size and all outcomes.",
+      "command": [
+        "C:\\Users\\User\\.cache\\codex-runtimes\\codex-primary-runtime\\dependencies\\python\\python.exe",
+        "-B",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-proposal-v2-20260924\\verify.py",
+        "--repo",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio",
+        "--package",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-controls-v2-20260924-1\\case-iky8xrqv"
+      ],
+      "stdout_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+      "stderr_sha256": "193b24af95f1d6b7c52237d1ccd2b3aa88be65db6b248eb68e591bef0e6b1d66",
+      "semantic_transport_hashes_refreshed": true
+    },
+    {
+      "case": "source-pair-artifact",
+      "status": "PASS",
+      "exit": 1,
+      "expected_refusal": "Repeated integration target artifact differs",
+      "mutation": "gates/project-aggregate-references-71cadfa-1.result.json: change only one repeated target artifact SHA, keeping its path/size and all outcomes.",
+      "command": [
+        "C:\\Users\\User\\.cache\\codex-runtimes\\codex-primary-runtime\\dependencies\\python\\python.exe",
+        "-B",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-proposal-v2-20260924\\verify.py",
+        "--repo",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio",
+        "--package",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-controls-v2-20260924-1\\case-kqipt08i"
+      ],
+      "stdout_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+      "stderr_sha256": "193b24af95f1d6b7c52237d1ccd2b3aa88be65db6b248eb68e591bef0e6b1d66",
+      "semantic_transport_hashes_refreshed": true
+    },
+    {
+      "case": "missing-new-outcome",
+      "status": "PASS",
+      "exit": 1,
+      "expected_refusal": "Missing/extra runtime outcomes",
+      "mutation": "gates/project-full-71cadfa-1.log: omit one new outcome and adjust pass count; exact membership must reject.",
+      "command": [
+        "C:\\Users\\User\\.cache\\codex-runtimes\\codex-primary-runtime\\dependencies\\python\\python.exe",
+        "-B",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-proposal-v2-20260924\\verify.py",
+        "--repo",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio",
+        "--package",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-controls-v2-20260924-1\\case-j2xqghr9"
+      ],
+      "stdout_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+      "stderr_sha256": "4ea6eb7a458fba980b8e4d8594be7d265cc93730502d4834f9ea2503185b555e",
+      "semantic_transport_hashes_refreshed": true
+    },
+    {
+      "case": "changed-inherited-diagnostic",
+      "status": "PASS",
+      "exit": 1,
+      "expected_refusal": "Exact historical failure diagnostics changed",
+      "mutation": "gates/project-full-71cadfa-1.log: change one inherited diagnostic column, retaining name/status/header error.",
+      "command": [
+        "C:\\Users\\User\\.cache\\codex-runtimes\\codex-primary-runtime\\dependencies\\python\\python.exe",
+        "-B",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-proposal-v2-20260924\\verify.py",
+        "--repo",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio",
+        "--package",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-controls-v2-20260924-1\\case-60ivmn8r"
+      ],
+      "stdout_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+      "stderr_sha256": "3e5dc08afdee9b77cf4c507bea74aed13df97667f9b51d87e03f6ec63114dd4d",
+      "semantic_transport_hashes_refreshed": true
+    },
+    {
+      "case": "forged-git-input",
+      "status": "PASS",
+      "exit": 1,
+      "expected_refusal": "Git input bytes mismatch",
+      "mutation": "All71 input manifests: consistently forge first input SHA; immutable Git must reject.",
+      "command": [
+        "C:\\Users\\User\\.cache\\codex-runtimes\\codex-primary-runtime\\dependencies\\python\\python.exe",
+        "-B",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-proposal-v2-20260924\\verify.py",
+        "--repo",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio",
+        "--package",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-controls-v2-20260924-1\\case-p4xl65pf"
+      ],
+      "stdout_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+      "stderr_sha256": "ecdc48f2565108daac7e3686f764d43c94a5bf50e8772fd147c29635d3b546a9",
+      "semantic_transport_hashes_refreshed": true
+    },
+    {
+      "case": "missing-failed-history",
+      "status": "PASS",
+      "exit": 1,
+      "expected_refusal": "Missing/extra package payload",
+      "mutation": "Remove only b9 failed-focus triple; mandatory history membership must reject.",
+      "command": [
+        "C:\\Users\\User\\.cache\\codex-runtimes\\codex-primary-runtime\\dependencies\\python\\python.exe",
+        "-B",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-proposal-v2-20260924\\verify.py",
+        "--repo",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio",
+        "--package",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-controls-v2-20260924-1\\case-njsb6r9_"
+      ],
+      "stdout_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+      "stderr_sha256": "9996afdaae04ab63cb6907ab75bd732f408cd6af12d2d0a9268cf39bbb54425c",
+      "semantic_transport_hashes_refreshed": true
+    },
+    {
+      "case": "integration-zero-test",
+      "status": "PASS",
+      "exit": 1,
+      "expected_refusal": "Missing/extra runtime outcomes",
+      "mutation": "gates/project-route-errors-71cadfa-1.log: synthesize zero-test success or ignored outcome with matching footer.",
+      "command": [
+        "C:\\Users\\User\\.cache\\codex-runtimes\\codex-primary-runtime\\dependencies\\python\\python.exe",
+        "-B",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-proposal-v2-20260924\\verify.py",
+        "--repo",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio",
+        "--package",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-controls-v2-20260924-1\\case-z6jk_oy_"
+      ],
+      "stdout_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+      "stderr_sha256": "4ea6eb7a458fba980b8e4d8594be7d265cc93730502d4834f9ea2503185b555e",
+      "semantic_transport_hashes_refreshed": true
+    },
+    {
+      "case": "integration-ignored",
+      "status": "PASS",
+      "exit": 1,
+      "expected_refusal": "Runtime status mismatch",
+      "mutation": "gates/project-route-errors-71cadfa-1.log: synthesize zero-test success or ignored outcome with matching footer.",
+      "command": [
+        "C:\\Users\\User\\.cache\\codex-runtimes\\codex-primary-runtime\\dependencies\\python\\python.exe",
+        "-B",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-proposal-v2-20260924\\verify.py",
+        "--repo",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio",
+        "--package",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-controls-v2-20260924-1\\case-cu8mu3sl"
+      ],
+      "stdout_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+      "stderr_sha256": "15d3d0e2c6fb3f20f18c2c8d7ed4f67ec51578df0c66d79cb395c0cd2a955190",
+      "semantic_transport_hashes_refreshed": true
+    },
+    {
+      "case": "integration-wrong-command",
+      "status": "PASS",
+      "exit": 1,
+      "expected_refusal": "Exact command/mode/filter differs",
+      "mutation": "gates/project-route-errors-71cadfa-1.result.json: remove --exact while retaining the outcome; exact argv must reject.",
+      "command": [
+        "C:\\Users\\User\\.cache\\codex-runtimes\\codex-primary-runtime\\dependencies\\python\\python.exe",
+        "-B",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-proposal-v2-20260924\\verify.py",
+        "--repo",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio",
+        "--package",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-controls-v2-20260924-1\\case-k0p20tv3"
+      ],
+      "stdout_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+      "stderr_sha256": "6079ceba49384f935331c52ca7bf4d7928a73d311e2a125e36aa1cdd9ae9a982",
+      "semantic_transport_hashes_refreshed": true
+    },
+    {
+      "case": "changed-formatter-body",
+      "status": "PASS",
+      "exit": 1,
+      "expected_refusal": "Inherited formatter block body differs",
+      "mutation": "Both fmt logs: alter the same inherited block body, retaining locations/counts.",
+      "command": [
+        "C:\\Users\\User\\.cache\\codex-runtimes\\codex-primary-runtime\\dependencies\\python\\python.exe",
+        "-B",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-proposal-v2-20260924\\verify.py",
+        "--repo",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio",
+        "--package",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-controls-v2-20260924-1\\case-l9jy1zgj"
+      ],
+      "stdout_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+      "stderr_sha256": "efa75ca69cccfe361e7f15bbf1ab67095f4ad6eaf87293414e51b800888c0c36",
+      "semantic_transport_hashes_refreshed": true
+    },
+    {
+      "case": "changed-successor-diff",
+      "status": "PASS",
+      "exit": 1,
+      "expected_refusal": "Exact Git correction diff differs",
+      "mutation": "diffs/71cadfa-to-aaec78f.patch: append text; exact immutable Git diff must reject.",
+      "command": [
+        "C:\\Users\\User\\.cache\\codex-runtimes\\codex-primary-runtime\\dependencies\\python\\python.exe",
+        "-B",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-proposal-v2-20260924\\verify.py",
+        "--repo",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio",
+        "--package",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-controls-v2-20260924-1\\case-3imoup9b"
+      ],
+      "stdout_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+      "stderr_sha256": "370188fb9e8276c8c03588a8d8a2e211d3eb4d0f9f7195aa8030485436635fb2",
+      "semantic_transport_hashes_refreshed": true
+    },
+    {
+      "case": "duplicate-zip-member",
+      "status": "PASS",
+      "exit": 1,
+      "expected_refusal": "Duplicate ZIP members",
+      "mutation": "Transport-only ZIP/verifier pin corruption or duplicate ZIP member.",
+      "command": [
+        "C:\\Users\\User\\.cache\\codex-runtimes\\codex-primary-runtime\\dependencies\\python\\python.exe",
+        "-B",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-proposal-v2-20260924\\verify.py",
+        "--repo",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio",
+        "--package",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-controls-v2-20260924-1\\case-m7ol708v"
+      ],
+      "stdout_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+      "stderr_sha256": "3d2d7e221ca2260dffaec5e5c15488e4317d59339bbf88511a79f58c03a36607",
+      "semantic_transport_hashes_refreshed": true
+    }
+  ],
+  "limits": "Evidence consistency controls only. No subject/compiler/GUI execution; no retained mutated archive corpus."
+}

harness/experiments/analysis-mixed-project-20260924/controls/unchanged-positive.result.json

@@ -0,0 +1,19 @@
+{
+  "case": "unchanged-positive",
+  "status": "PASS",
+  "exit": 0,
+  "expected_refusal": null,
+  "mutation": "Original bytes, no mutation.",
+  "command": [
+    "C:\\Users\\User\\.cache\\codex-runtimes\\codex-primary-runtime\\dependencies\\python\\python.exe",
+    "-B",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-proposal-v2-20260924\\verify.py",
+    "--repo",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio",
+    "--package",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-proposal-v2-20260924"
+  ],
+  "stdout_sha256": "daee4749971ad9f41a5e1d8f0560b1b61a9168b21f2fd934d8781beddbc6d642",
+  "stderr_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+  "semantic_transport_hashes_refreshed": false
+}

harness/experiments/analysis-mixed-project-20260924/controls/unchanged-positive.stdout.log

@@ -0,0 +1,18 @@
+{
+  "source": "aaec78fcc9b273d1485497126392afdd1fb2e54e",
+  "runtime_source": "71cadfa0cd0e112caa29588d2494753301f3cb6c",
+  "actual_listing": 209,
+  "Project_pass": 13,
+  "admission_pass": 2,
+  "full_status": "FAILED",
+  "full_passed": 193,
+  "full_failed": 16,
+  "exact_prior_statuses_and_diagnostics_preserved": true,
+  "integration_passes": 4,
+  "strict_status": "PASS at runtime_source",
+  "successor_fmt_status": "FAILED",
+  "successor_fmt_inherited_blocks": 8,
+  "successor_runtime_claim": false,
+  "limits": "Receipt/Git consistency, not subject re-execution or authenticated authorship. Private Project only; no public source8/index/update/UI completion."
+}
+VERIFIED evidence consistency; full suite FAILED193/16; successor formatting FAILED8 inherited blocks; no successor runtime rerun.

harness/experiments/analysis-mixed-project-20260924/controls/verifier-pin.result.json

@@ -0,0 +1,19 @@
+{
+  "case": "verifier-pin",
+  "status": "PASS",
+  "exit": 1,
+  "expected_refusal": "Top-level verifier pin differs",
+  "mutation": "Transport-only ZIP/verifier pin corruption or duplicate ZIP member.",
+  "command": [
+    "C:\\Users\\User\\.cache\\codex-runtimes\\codex-primary-runtime\\dependencies\\python\\python.exe",
+    "-B",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-proposal-v2-20260924\\verify.py",
+    "--repo",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio",
+    "--package",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-project-evidence-controls-v2-20260924-1\\case-uinxoc7p"
+  ],
+  "stdout_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+  "stderr_sha256": "fca5b1d1f72cba26710c9481743247e50024286837be10e16fa5b04829fa4286",
+  "semantic_transport_hashes_refreshed": false
+}

harness/experiments/analysis-mixed-project-20260924/controls/verifier-pin.stderr.log

@@ -0,0 +1 @@
+REFUSED: Top-level verifier pin differs

harness/experiments/analysis-mixed-project-20260924/manifest.json

@@ -0,0 +1,222 @@
+{
+  "schema": 1,
+  "source": "aaec78fcc9b273d1485497126392afdd1fb2e54e",
+  "runtime_source": "71cadfa0cd0e112caa29588d2494753301f3cb6c",
+  "verification_status": "NOT RUN; proposal awaiting review",
+  "payloads": {
+    "baseline-reference.json": {
+      "bytes": 272,
+      "sha256": "4e076c2a66f122fbf639e13a96641f72bd8158627d8de8cf6013fc61e8b76deb"
+    },
+    "diffs/71cadfa-to-aaec78f.patch": {
+      "bytes": 1192,
+      "sha256": "cdf55d848cf8c0af5fb1b378befc81bf7ccbade7fb2c1044e0e1d1774d101f1d"
+    },
+    "diffs/b9a31bb-to-71cadfa.patch": {
+      "bytes": 5640,
+      "sha256": "6e9b6d7a9a5d12d149a4069db69da5581bc980c104a685269227c3fc39a16483"
+    },
+    "gates/launchers/46c9ee5f4130e7854855e44b1509ecc0833dd4a3c41a1f3251955b0ac79cc154.py": {
+      "bytes": 7629,
+      "sha256": "46c9ee5f4130e7854855e44b1509ecc0833dd4a3c41a1f3251955b0ac79cc154"
+    },
+    "gates/launchers/a3b965c6d4d9f3f7d3d55ea0f142d16e43fccd9adcd9b8121615a2ea16df8af8.py": {
+      "bytes": 7629,
+      "sha256": "a3b965c6d4d9f3f7d3d55ea0f142d16e43fccd9adcd9b8121615a2ea16df8af8"
+    },
+    "gates/launchers/bb3e467ba12d55affbb8802987dfcdeb45c62aff507e16d21f5a106e8b0651a4.py": {
+      "bytes": 7629,
+      "sha256": "bb3e467ba12d55affbb8802987dfcdeb45c62aff507e16d21f5a106e8b0651a4"
+    },
+    "gates/project-admission-71cadfa-1.inputs.json": {
+      "bytes": 101425,
+      "sha256": "d09706edfcc24b769c463cfb9972c5db2510382cb5096afed1983cf8a1eb487a"
+    },
+    "gates/project-admission-71cadfa-1.log": {
+      "bytes": 563,
+      "sha256": "e5f476fc5c063910e25e2a8aaab294b618bcd7f79b67f710c8ac18418229c190"
+    },
+    "gates/project-admission-71cadfa-1.result.json": {
+      "bytes": 2572,
+      "sha256": "6e68571d9405d66e33e7933a83cf61295f27ff501f8465ef028e3405a73420dd"
+    },
+    "gates/project-aggregate-references-71cadfa-1.inputs.json": {
+      "bytes": 101425,
+      "sha256": "d09706edfcc24b769c463cfb9972c5db2510382cb5096afed1983cf8a1eb487a"
+    },
+    "gates/project-aggregate-references-71cadfa-1.log": {
+      "bytes": 444,
+      "sha256": "35e0df828ccfa9e68d91efbc0ba58cbb5cb74cbb067cd52c7de2e8e09e0698a6"
+    },
+    "gates/project-aggregate-references-71cadfa-1.result.json": {
+      "bytes": 2603,
+      "sha256": "db0d84900e934e70b8e7449b3afe56689591167796525cede24a2ed794c8f615"
+    },
+    "gates/project-clippy-71cadfa-1.inputs.json": {
+      "bytes": 101425,
+      "sha256": "d09706edfcc24b769c463cfb9972c5db2510382cb5096afed1983cf8a1eb487a"
+    },
+    "gates/project-clippy-71cadfa-1.log": {
+      "bytes": 165,
+      "sha256": "37525eea329fcbfc90c5c5c11bcbad20395c4511e6338f185b54a9551fafdeaf"
+    },
+    "gates/project-clippy-71cadfa-1.result.json": {
+      "bytes": 1969,
+      "sha256": "ba55e83185a806f91125d06359e010e036ecd0331b09335e20a5e20ff4a4c793"
+    },
+    "gates/project-clippy-b9a31bb-1.inputs.json": {
+      "bytes": 101425,
+      "sha256": "2095340b598fbfb6702f49941b6ec4efb658862dcf16b98efc1972e984d83aa9"
+    },
+    "gates/project-clippy-b9a31bb-1.log": {
+      "bytes": 165,
+      "sha256": "6607694cd25a358cd334761604f3144682e5796f84beddd77fa619aa7cdfaab7"
+    },
+    "gates/project-clippy-b9a31bb-1.result.json": {
+      "bytes": 1968,
+      "sha256": "48b57f25b0f18b58a5d02450aa17d17a8d950570be345a298dd0e6938143ba9a"
+    },
+    "gates/project-fmt-71cadfa-1.inputs.json": {
+      "bytes": 101425,
+      "sha256": "d09706edfcc24b769c463cfb9972c5db2510382cb5096afed1983cf8a1eb487a"
+    },
+    "gates/project-fmt-71cadfa-1.log": {
+      "bytes": 7560,
+      "sha256": "c8dd3f62edc5853d7d0ccf536e46e389f0b62e2dd8b3da0e1561bf4bbada96a8"
+    },
+    "gates/project-fmt-71cadfa-1.result.json": {
+      "bytes": 1883,
+      "sha256": "2baecbb8911087d401bc7961ff8b3f9a5b42d784fa6e7aec5a5c2156b8988491"
+    },
+    "gates/project-fmt-aaec78f-1.inputs.json": {
+      "bytes": 101425,
+      "sha256": "1ec30aeb757d0424598cdf0c52a4845c1645ff8ed0c12cb17e4d18b82d957345"
+    },
+    "gates/project-fmt-aaec78f-1.log": {
+      "bytes": 6446,
+      "sha256": "c1c6b12861c8117ce6ffc6d6742ebf92618aafb10160ec6f99d370ca72ebab2d"
+    },
+    "gates/project-fmt-aaec78f-1.result.json": {
+      "bytes": 1882,
+      "sha256": "fbb3e49b2373be566deb81f7c1e40d4a2a174abfe64515b1497e6e121dc31b97"
+    },
+    "gates/project-focused-71cadfa-1.inputs.json": {
+      "bytes": 101425,
+      "sha256": "d09706edfcc24b769c463cfb9972c5db2510382cb5096afed1983cf8a1eb487a"
+    },
+    "gates/project-focused-71cadfa-1.log": {
+      "bytes": 1994,
+      "sha256": "326367daeded59bc983fa0ac1691cd9bfc63f68783afb911a7c108cb506840cd"
+    },
+    "gates/project-focused-71cadfa-1.result.json": {
+      "bytes": 4271,
+      "sha256": "b1813fc381eb1b50dc4e29c8b4bd848858c2cdc5f724d72fae3da1ffd8695b20"
+    },
+    "gates/project-focused-b9a31bb-1.inputs.json": {
+      "bytes": 101425,
+      "sha256": "2095340b598fbfb6702f49941b6ec4efb658862dcf16b98efc1972e984d83aa9"
+    },
+    "gates/project-focused-b9a31bb-1.log": {
+      "bytes": 3167,
+      "sha256": "ec664df53e2d61a7e2b7bf3d524134a568257074db88f7be26f43b6ed0e9bbfc"
+    },
+    "gates/project-focused-b9a31bb-1.result.json": {
+      "bytes": 4282,
+      "sha256": "529ba645d1a93494345ae0594af49d5c3d18c4db05cc859bdae197f44b81aa7d"
+    },
+    "gates/project-fragment-coordinates-71cadfa-1.inputs.json": {
+      "bytes": 101425,
+      "sha256": "d09706edfcc24b769c463cfb9972c5db2510382cb5096afed1983cf8a1eb487a"
+    },
+    "gates/project-fragment-coordinates-71cadfa-1.log": {
+      "bytes": 517,
+      "sha256": "9f16172fdd1b5dcd7defaa42b640814696ce69218442be4894f1ac35b9379058"
+    },
+    "gates/project-fragment-coordinates-71cadfa-1.result.json": {
+      "bytes": 2496,
+      "sha256": "72a54d7bd5200540edf046ebbffb46686ef2e2b292b716d391832447dd89ddda"
+    },
+    "gates/project-full-71cadfa-1.inputs.json": {
+      "bytes": 101425,
+      "sha256": "d09706edfcc24b769c463cfb9972c5db2510382cb5096afed1983cf8a1eb487a"
+    },
+    "gates/project-full-71cadfa-1.log": {
+      "bytes": 35486,
+      "sha256": "4042844548d046880eb7b0dbdfadc92017a113c32d788dbcbc77b2197624c742"
+    },
+    "gates/project-full-71cadfa-1.result.json": {
+      "bytes": 30035,
+      "sha256": "73cfb2c6b819e631f0f8df050abc4278278d7e79e6f0d24d96da9bc50f4abbb2"
+    },
+    "gates/project-list-71cadfa-1.inputs.json": {
+      "bytes": 101425,
+      "sha256": "d09706edfcc24b769c463cfb9972c5db2510382cb5096afed1983cf8a1eb487a"
+    },
+    "gates/project-list-71cadfa-1.log": {
+      "bytes": 22449,
+      "sha256": "bd849c7c338d06a226cf3d49bc4a332dd6fcf1063e5df121db052f0718731e6d"
+    },
+    "gates/project-list-71cadfa-1.result.json": {
+      "bytes": 24528,
+      "sha256": "4ae6d131881e5af6f5d7dd001e367af20ac016e81e23cf2a1f52806946cdc500"
+    },
+    "gates/project-list-b9a31bb-1.inputs.json": {
+      "bytes": 101425,
+      "sha256": "2095340b598fbfb6702f49941b6ec4efb658862dcf16b98efc1972e984d83aa9"
+    },
+    "gates/project-list-b9a31bb-1.log": {
+      "bytes": 22449,
+      "sha256": "8d458e4739f36dbdbe271afd8a4700cd2742c41a58e9a5598619184164551e49"
+    },
+    "gates/project-list-b9a31bb-1.result.json": {
+      "bytes": 24528,
+      "sha256": "c3aca9e89b0e4bf2bd1973db7570748ccaf4813a14a276c0512267c7ff4ee406"
+    },
+    "gates/project-route-defaults-71cadfa-1.inputs.json": {
+      "bytes": 101425,
+      "sha256": "d09706edfcc24b769c463cfb9972c5db2510382cb5096afed1983cf8a1eb487a"
+    },
+    "gates/project-route-defaults-71cadfa-1.log": {
+      "bytes": 532,
+      "sha256": "fa284566c22193188f0e2814a5d47831155503b9a1de1f1c35604a2ee8c051c6"
+    },
+    "gates/project-route-defaults-71cadfa-1.result.json": {
+      "bytes": 2556,
+      "sha256": "485e6c510fbcc4ad0638fada648b5b5100564bdda92b7f0e8c3d3329efa70dc7"
+    },
+    "gates/project-route-errors-71cadfa-1.inputs.json": {
+      "bytes": 101425,
+      "sha256": "d09706edfcc24b769c463cfb9972c5db2510382cb5096afed1983cf8a1eb487a"
+    },
+    "gates/project-route-errors-71cadfa-1.log": {
+      "bytes": 425,
+      "sha256": "99c8ce1de3de2b2fb829cabfc43fc3b8bcd1bba00abe4917b6766671cf4db238"
+    },
+    "gates/project-route-errors-71cadfa-1.result.json": {
+      "bytes": 2534,
+      "sha256": "bab2d61fbeeab681b9ad980f606b2fc4159a70e2943afbc7d20d8c3a4ad39377"
+    },
+    "notes/private-handoff.md": {
+      "bytes": 7092,
+      "sha256": "11ccb063e4bf33ee039b90ea5fba3bbf71534398bb3a264972771ecf85fd33bb"
+    },
+    "notes/successor-format-readback.json": {
+      "bytes": 2520,
+      "sha256": "f1bd3631832376cd21d40341e7b9af2c42f6ea1b5d20dcda3ccdf3eb0e9b332f"
+    },
+    "notes/tested-readback.json": {
+      "bytes": 15401,
+      "sha256": "744e43c828a817e78c82c971157c2199ae2b96155640779fc3d148694a55f840"
+    }
+  },
+  "archive": {
+    "file": "evidence.zip",
+    "bytes": 490311,
+    "sha256": "a42f29c9adc05adc6bd0c881b716bda3bd098732eb081b0f6214252db5d29d83"
+  },
+  "verifier": {
+    "file": "verify.py",
+    "bytes": 23199,
+    "sha256": "f94e5f4a733c82c0b240dc4c64557bf34f6705590144df686ccfbc53c076b6ff"
+  }
+}

harness/experiments/analysis-mixed-project-20260924/publication-manifest.json

@@ -0,0 +1,227 @@
+{
+  "source": "aaec78fcc9b273d1485497126392afdd1fb2e54e",
+  "runtime_source": "71cadfa0cd0e112caa29588d2494753301f3cb6c",
+  "status": "Reviewed delivery: completed consistency/control evidence preserved; no subject rerun",
+  "files": {
+    ".gitattributes": {
+      "bytes": 8,
+      "sha256": "705fd4d6451a31d36b3df7de96f83f30ac976c9b4a6d1e51671d8e2f33e2d0da"
+    },
+    "controls/archive-pin.result.json": {
+      "bytes": 904,
+      "sha256": "01dbefeec9a94f0c0e5a98716b34e26651cdec0da85acd52ca76c12839bc77bb"
+    },
+    "controls/archive-pin.stderr.log": {
+      "bytes": 40,
+      "sha256": "d312212a64253be66ea3dae99ac7596865374f80bd64005481241c3d9b8675f4"
+    },
+    "controls/archive-pin.stdout.log": {
+      "bytes": 0,
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    "controls/changed-formatter-body.result.json": {
+      "bytes": 935,
+      "sha256": "c1ddaccf7d0e959dead8e984831d1bba6bfbdc89ef58dc1ba2eb5ba1cc85c815"
+    },
+    "controls/changed-formatter-body.stderr.log": {
+      "bytes": 49,
+      "sha256": "efa75ca69cccfe361e7f15bbf1ab67095f4ad6eaf87293414e51b800888c0c36"
+    },
+    "controls/changed-formatter-body.stdout.log": {
+      "bytes": 0,
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    "controls/changed-inherited-diagnostic.result.json": {
+      "bytes": 977,
+      "sha256": "feb779acc8f893eda3e3dc9cfe8aaa29cacf6543e30445692222b8a1ef13cba0"
+    },
+    "controls/changed-inherited-diagnostic.stderr.log": {
+      "bytes": 55,
+      "sha256": "3e5dc08afdee9b77cf4c507bea74aed13df97667f9b51d87e03f6ec63114dd4d"
+    },
+    "controls/changed-inherited-diagnostic.stdout.log": {
+      "bytes": 0,
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    "controls/changed-successor-diff.result.json": {
+      "bytes": 933,
+      "sha256": "b56fc4e1116ba9a6265e9e62dedf0b9dffd3c52afdd35904723b8d3a294db02c"
+    },
+    "controls/changed-successor-diff.stderr.log": {
+      "bytes": 44,
+      "sha256": "370188fb9e8276c8c03588a8d8a2e211d3eb4d0f9f7195aa8030485436635fb2"
+    },
+    "controls/changed-successor-diff.stdout.log": {
+      "bytes": 0,
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    "controls/duplicate-zip-member.result.json": {
+      "bytes": 904,
+      "sha256": "9e902da9f73be83e923f8d19d1d5d6253c84169f2fee8661fe3e7b8d0e876adb"
+    },
+    "controls/duplicate-zip-member.stderr.log": {
+      "bytes": 32,
+      "sha256": "3d2d7e221ca2260dffaec5e5c15488e4317d59339bbf88511a79f58c03a36607"
+    },
+    "controls/duplicate-zip-member.stdout.log": {
+      "bytes": 0,
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    "controls/forged-git-input.result.json": {
+      "bytes": 921,
+      "sha256": "9fd202a9ae2944bc5e221e306cbb32ef5a00682903d628df12818789323dee8e"
+    },
+    "controls/forged-git-input.stderr.log": {
+      "bytes": 47,
+      "sha256": "ecdc48f2565108daac7e3686f764d43c94a5bf50e8772fd147c29635d3b546a9"
+    },
+    "controls/forged-git-input.stdout.log": {
+      "bytes": 0,
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    "controls/integration-ignored.result.json": {
+      "bytes": 949,
+      "sha256": "c12504bef20ddb8b3e2f1aa7200b24936af17af9e68cc2ccb1976ae5bb8e8f85"
+    },
+    "controls/integration-ignored.stderr.log": {
+      "bytes": 34,
+      "sha256": "15d3d0e2c6fb3f20f18c2c8d7ed4f67ec51578df0c66d79cb395c0cd2a955190"
+    },
+    "controls/integration-ignored.stdout.log": {
+      "bytes": 0,
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    "controls/integration-wrong-command.result.json": {
+      "bytes": 971,
+      "sha256": "0ad5005e39f6ff9dee93c89e3c2b80034c8b09d557535ddddefa4d93eb1235bc"
+    },
+    "controls/integration-wrong-command.stderr.log": {
+      "bytes": 44,
+      "sha256": "6079ceba49384f935331c52ca7bf4d7928a73d311e2a125e36aa1cdd9ae9a982"
+    },
+    "controls/integration-wrong-command.stdout.log": {
+      "bytes": 0,
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    "controls/integration-zero-test.result.json": {
+      "bytes": 958,
+      "sha256": "aea4bd030470bb8d4d07587376d451642d8a95eb44ab69eabe6beb9f7329d48d"
+    },
+    "controls/integration-zero-test.stderr.log": {
+      "bytes": 41,
+      "sha256": "4ea6eb7a458fba980b8e4d8594be7d265cc93730502d4834f9ea2503185b555e"
+    },
+    "controls/integration-zero-test.stdout.log": {
+      "bytes": 0,
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    "controls/missing-failed-history.result.json": {
+      "bytes": 924,
+      "sha256": "3c85d2007285c650056a71c511879364c0bba807340464607738d874fb453a59"
+    },
+    "controls/missing-failed-history.stderr.log": {
+      "bytes": 40,
+      "sha256": "9996afdaae04ab63cb6907ab75bd732f408cd6af12d2d0a9268cf39bbb54425c"
+    },
+    "controls/missing-failed-history.stdout.log": {
+      "bytes": 0,
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    "controls/missing-new-outcome.result.json": {
+      "bytes": 952,
+      "sha256": "bac5c152ec17de114b6ae0ace1a6f3420321447e3d3940d9dd98d4be909ea876"
+    },
+    "controls/missing-new-outcome.stderr.log": {
+      "bytes": 41,
+      "sha256": "4ea6eb7a458fba980b8e4d8594be7d265cc93730502d4834f9ea2503185b555e"
+    },
+    "controls/missing-new-outcome.stdout.log": {
+      "bytes": 0,
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    "controls/REVIEW.md": {
+      "bytes": 3566,
+      "sha256": "81dd6baa1b89366f18d0b3a2d68745a1facdfb2ff8e090a9d8b1bae85cd721c5"
+    },
+    "controls/route-pair-artifact.result.json": {
+      "bytes": 994,
+      "sha256": "300153195a2965a9250029b2c088bc24760fb3cd8ef5fc5ca2770e9b2c5d9273"
+    },
+    "controls/route-pair-artifact.stderr.log": {
+      "bytes": 55,
+      "sha256": "193b24af95f1d6b7c52237d1ccd2b3aa88be65db6b248eb68e591bef0e6b1d66"
+    },
+    "controls/route-pair-artifact.stdout.log": {
+      "bytes": 0,
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    "controls/source-pair-artifact.result.json": {
+      "bytes": 1003,
+      "sha256": "73b22a33e449bcca491864fbe2dacfd7e90a0bf35235178345a763e583b2b2cd"
+    },
+    "controls/source-pair-artifact.stderr.log": {
+      "bytes": 55,
+      "sha256": "193b24af95f1d6b7c52237d1ccd2b3aa88be65db6b248eb68e591bef0e6b1d66"
+    },
+    "controls/source-pair-artifact.stdout.log": {
+      "bytes": 0,
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    "controls/summary.json": {
+      "bytes": 16232,
+      "sha256": "c39e52c220b0b023382d70ed4344597cf3596e741ca67995fb67edf8e9aa20c8"
+    },
+    "controls/unchanged-positive.result.json": {
+      "bytes": 828,
+      "sha256": "dfd4716a298a345fc4d3e8d6c811429719978a08f0701076da8260762d31f48e"
+    },
+    "controls/unchanged-positive.stderr.log": {
+      "bytes": 0,
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    "controls/unchanged-positive.stdout.log": {
+      "bytes": 815,
+      "sha256": "daee4749971ad9f41a5e1d8f0560b1b61a9168b21f2fd934d8781beddbc6d642"
+    },
+    "controls/verifier-pin.result.json": {
+      "bytes": 906,
+      "sha256": "fb95c45f7a34d50aec00648ebc24145ef150baf6be43af2d9af6678c79125b2b"
+    },
+    "controls/verifier-pin.stderr.log": {
+      "bytes": 41,
+      "sha256": "fca5b1d1f72cba26710c9481743247e50024286837be10e16fa5b04829fa4286"
+    },
+    "controls/verifier-pin.stdout.log": {
+      "bytes": 0,
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    "CONTROLS.md": {
+      "bytes": 3075,
+      "sha256": "caee9431b94df6f85f2c0477fa8c29268c4c84a13672c65a8d99d4e268a18d0d"
+    },
+    "controls.py": {
+      "bytes": 11834,
+      "sha256": "0d2cd38c7baffba78cd2f009d832c7a16e9ac46437d56105a484821ce54601e7"
+    },
+    "evidence.zip": {
+      "bytes": 490311,
+      "sha256": "a42f29c9adc05adc6bd0c881b716bda3bd098732eb081b0f6214252db5d29d83"
+    },
+    "manifest.json": {
+      "bytes": 9112,
+      "sha256": "9277764168157819faaddaa8dffd2714efe995e2e136c795a51cc10340cd2f50"
+    },
+    "ORIGINAL-PROPOSAL-README.md": {
+      "bytes": 3455,
+      "sha256": "41aa843ea33740f0d2c8b20a63caa73f41508921b61e881db522c87e11bd2ec6"
+    },
+    "README.md": {
+      "bytes": 5622,
+      "sha256": "8059b467532fa744e5e34596b22fda547e5b923440cd858f1a52518aa12ca06f"
+    },
+    "verify.py": {
+      "bytes": 23199,
+      "sha256": "f94e5f4a733c82c0b240dc4c64557bf34f6705590144df686ccfbc53c076b6ff"
+    }
+  }
+}

harness/experiments/analysis-mixed-project-20260924/verify.py

@@ -0,0 +1,359 @@
+"""Read-only Project receipt/Git consistency verifier; never runs archived code.
+
+Reuses the published mixed-syntax verifier's ZIP/manifest, unique JSON, immutable
+Git input, actual listing/outcome and exact-command design. Proposal: not run yet.
+"""
+from pathlib import Path, PurePosixPath, PureWindowsPath
+from datetime import datetime
+import argparse
+import hashlib
+import io
+import json
+import re
+import subprocess
+import zipfile
+
+FAILED = 'b9a31bb848a4f74f097aa8a09351cc82c98b5815'
+TESTED = '71cadfa0cd0e112caa29588d2494753301f3cb6c'
+SOURCE = 'aaec78fcc9b273d1485497126392afdd1fb2e54e'
+BASELINE = 'a578ac98a06772a60bec00ae287e65650680d119'
+PUBLISHED = '85cc27fed02ce770c30c9447f35c4ab4d24f9644'
+BASELINE_PATH = 'harness/experiments/analysis-mixed-syntax-20260923/evidence.zip'
+BASELINE_HASH = 'f39aab1639ce14e4fe61744cf8881b0883ecbe131fefd6bc65c18edd8c81215d'
+SCOPE = ['Cargo.toml', 'Cargo.lock', 'rust-toolchain.toml', '.cargo', 'build',
+         'crates', 'assets', 'docs', 'examples', 'harness/fixtures', 'vendor']
+PREFIX = ['cargo', 'test', '--locked', '--offline', '-p', 'oa-core', '--lib']
+PROJECT = 'language::analysis_source::mixed::project::tests::'
+ADMISSION = 'validation::shared_admission_tests::'
+PROJECT_NAMES = [PROJECT + name for name in (
+    'catalog_alias_first_entry_first_and_canonical_occurrence_owners',
+    'complete_global_arena_scoped_calls_and_coincident_file_offsets',
+    'complete_oa_sa_forward_model_warning_and_original_authority',
+    'complete_static_architecture_and_unicode_warning_mapping',
+    'incomplete_call_borrows_large_signature_and_refuses_at_single_admission',
+    'inherited_storage_failure_and_success_drop_deep_syntax_on_128k_stack',
+    'mapped_warning_path_copies_are_admitted_before_retention',
+    'ordinary_steps_add_once_to_inherited_typed_reference_budget',
+    'public_source3_and_source7_preserve_legacy_scratch_defaults_and_errors',
+    'retained_nested_record_policy_cannot_be_replaced_at_resolution',
+    'scoped_parameter_faults_keep_real_file_and_unknown_fields_use_owner_fallback',
+    'selector_counts_branch_and_context_chains_but_excludes_historical_and_scalars',
+    'simultaneous_catalog_storage_is_not_individually_reset')]
+ADMISSION_NAMES = [ADMISSION + name for name in (
+    'static_failure_returns_no_metadata_and_skips_architectural_warnings',
+    'successful_static_metadata_survives_architectural_warnings')]
+FAILED_NAMES = {PROJECT_NAMES[2], PROJECT_NAMES[3]}
+INTEGRATIONS = {
+    'route-defaults': ('route_source', 'omitted_schema_three_routes_default_to_empty_and_v2_reader_stays_frozen'),
+    'route-errors': ('route_source', 'invalid_route_source_has_located_errors_and_no_silent_nested_defaults'),
+    'fragment-coordinates': ('source_project', 'source_errors_keep_exact_fragment_unicode_positions'),
+    'aggregate-references': ('source_project', 'duplicate_include_edges_count_toward_admission_and_ordered_references_are_aggregate'),
+}
+HELPERS = {
+    FAILED: 'bb3e467ba12d55affbb8802987dfcdeb45c62aff507e16d21f5a106e8b0651a4',
+    TESTED: 'a3b965c6d4d9f3f7d3d55ea0f142d16e43fccd9adcd9b8121615a2ea16df8af8',
+    SOURCE: '46c9ee5f4130e7854855e44b1509ecc0833dd4a3c41a1f3251955b0ac79cc154',
+}
+GATES = {}
+for short, source, kinds in (
+    ('b9a31bb', FAILED, ('clippy', 'list', 'focused')),
+    ('71cadfa', TESTED, ('clippy', 'list', 'focused', 'admission', 'full', *INTEGRATIONS, 'fmt')),
+    ('aaec78f', SOURCE, ('fmt',)),
+):
+    for kind in kinds:
+        GATES[f'project-{kind}-{short}-1'] = (source, kind)
+NOTES = {
+    'notes/private-handoff.md', 'notes/tested-readback.json', 'notes/successor-format-readback.json',
+    'diffs/b9a31bb-to-71cadfa.patch', 'diffs/71cadfa-to-aaec78f.patch', 'baseline-reference.json',
+}
+ROOT = 'C:/Users/User/Documents/Git/ARCADIA-Studio'
+
+
+def require(condition, message):
+    if not condition:
+        raise ValueError(message)
+
+
+def sha(raw):
+    return hashlib.sha256(raw).hexdigest()
+
+
+def unique_object(pairs):
+    result = {}
+    for key, value in pairs:
+        require(key not in result, 'Duplicate JSON key: ' + key)
+        result[key] = value
+    return result
+
+
+def document(raw):
+    return json.loads(raw, object_pairs_hook=unique_object)
+
+
+def safe_name(name):
+    require(isinstance(name, str) and name and '\\' not in name and ':' not in name,
+            'Unsafe archive name')
+    p = PurePosixPath(name)
+    require(not p.is_absolute() and str(p) == name and '..' not in p.parts,
+            'Unsafe archive path: ' + name)
+    return name
+
+
+def git(repo, *arguments, data=None):
+    # Ignore replace objects and user-configured diff drivers/rendering. These
+    # fixed options reproduce the archived conventional Git patch format.
+    options = []
+    if arguments[0] == 'diff':
+        options = ['--no-ext-diff', '--no-textconv', '--no-color',
+                   '--src-prefix=a/', '--dst-prefix=b/', '--line-prefix=',
+                   '--diff-algorithm=myers', '--indent-heuristic',
+                   '--unified=3', '--abbrev=7', '--no-renames']
+    return subprocess.check_output(
+        ['git', '--no-replace-objects', '-c', 'color.ui=false', '-c', 'core.quotePath=true',
+         '-C', str(repo), arguments[0], *options, *arguments[1:]], input=data)
+
+
+def git_inputs(repo, source, current):
+    require(current['source'] == source, 'Input source mismatch')
+    records = current['inputs']
+    require(len(records) == 544, 'Unexpected input count')
+    paths = git(repo, 'ls-tree', '-r', '--name-only', source, *SCOPE).decode().splitlines()
+    require(paths == [item['path'] for item in records], 'Git input membership/order mismatch')
+    raw = git(repo, 'cat-file', '--batch', data=''.join(f'{source}:{p}\n' for p in paths).encode())
+    offset = 0
+    for item in records:
+        end = raw.index(b'\n', offset)
+        _, kind, size = raw[offset:end].split()
+        size = int(size)
+        blob = raw[end + 1:end + 1 + size]
+        require(kind == b'blob' and size == item['bytes'] and sha(blob) == item['sha256'],
+                'Git input bytes mismatch: ' + item['path'])
+        offset = end + size + 2
+    require(offset == len(raw), 'Trailing Git batch bytes')
+
+
+def listing(log):
+    names = re.findall(r'^([^\r\n]+): test\r?$', log, re.M)
+    require(len(names) == len(set(names)), 'Duplicate listed test')
+    require(re.findall(r'^(\d+) tests, (\d+) benchmarks\r?$', log, re.M) == [(str(len(names)), '0')],
+            'Listing footer mismatch')
+    return names
+
+
+def outcomes(log, expected, passed, failed, filtered):
+    rows = re.findall(r'^test ([^\r\n]+) \.\.\. (ok|FAILED|ignored)\r?$', log, re.M)
+    require(len(rows) == len({name for name, _ in rows}), 'Duplicate runtime outcome')
+    actual = dict(rows)
+    require(set(actual) == set(expected), 'Missing/extra runtime outcomes')
+    require(sum(v == 'ok' for v in actual.values()) == passed and
+            sum(v == 'FAILED' for v in actual.values()) == failed and
+            'ignored' not in actual.values(), 'Runtime status mismatch')
+    summaries = re.findall(r'^test result: (ok|FAILED)\. (\d+) passed; (\d+) failed; '
+                           r'(\d+) ignored; (\d+) measured; (\d+) filtered out;', log, re.M)
+    require(summaries == [('FAILED' if failed else 'ok', str(passed), str(failed), '0', '0', str(filtered))],
+            'Runtime footer mismatch')
+    return actual
+
+
+def failure_blocks(log, names):
+    blocks = re.findall(r'^---- ([^\r\n]+) stdout ----\r?\n(.*?)(?=^---- |^failures:\r?$|\Z)', log, re.M | re.S)
+    require(len(blocks) == len(names) and {name for name, _ in blocks} == set(names),
+            'Failure-block membership mismatch')
+    tails = re.findall(r'^failures:\r?\n((?:    [^\r\n]+\r?\n)+)', log, re.M)
+    require(len(tails) == 1 and tails[0].split() == sorted(names), 'Failure footer changed')
+    return dict(blocks)
+
+
+def causes(log, names):
+    result = {}
+    for name, block in failure_blocks(log, names).items():
+        details = [line for line in block.splitlines() if line.startswith('called `Result::unwrap()`')]
+        require(len(details) == 1 and 'Unsupported schema version: expected arcadia 3, 4, 5, 6 or 7.' in details[0]
+                and 'invalid_source' in details[0], 'Failure cause changed: ' + name)
+        result[name] = details[0]
+    return result
+
+
+def format_blocks(log):
+    parts = re.split(r'^Diff in [^\n]*?[/\\]as3batch[/\\]([^\n]+):(\d+):\n', log.replace('\r\n', '\n'), flags=re.M)
+    require(not parts[0] and len(parts) > 1 and (len(parts) - 1) % 3 == 0, 'Unexpected formatting output')
+    result = {}
+    for i in range(1, len(parts), 3):
+        key = (parts[i].replace('\\', '/'), int(parts[i + 1]))
+        require(key not in result, 'Duplicate formatter block')
+        result[key] = parts[i + 2]
+    return result
+
+
+def norm(path):
+    return PureWindowsPath(path).as_posix().lower()
+
+
+def baseline(repo, reference):
+    expected = {'commit': PUBLISHED, 'path': BASELINE_PATH, 'sha256': BASELINE_HASH, 'source': BASELINE}
+    require(reference == expected, 'Published baseline reference changed')
+    raw = git(repo, 'show', PUBLISHED + ':' + BASELINE_PATH)
+    require(sha(raw) == BASELINE_HASH, 'Published baseline archive differs')
+    with zipfile.ZipFile(io.BytesIO(raw)) as z:
+        require(len(z.namelist()) == len(set(z.namelist())), 'Duplicate published baseline member')
+        listed = z.read('gates/mixed-direct-list-a578-1.log').decode()
+        full = z.read('gates/mixed-direct-full-a578-1.log').decode()
+        fmt = z.read('gates/mixed-fmt-a578-1.log').decode()
+        historical = z.read('baseline/full-f1d79df.log').decode()
+    names = listing(listed)
+    require(len(names) == 194, 'Published baseline name count differs')
+    statuses = outcomes(full, names, 178, 16, 0)
+    bad = {name for name, status in statuses.items() if status == 'FAILED'}
+    old = dict(re.findall(r'^test ([^\r\n]+) \.\.\. (ok|FAILED|ignored)\r?$', historical, re.M))
+    require(len(old) == 152 and all(statuses.get(name) == status for name, status in old.items()),
+            'Published historical status link differs')
+    return names, statuses, causes(full, bad), format_blocks(fmt)
+
+
+def verify_payload(payload, manifest, repo):
+    require(manifest['schema'] == 1 and manifest['source'] == SOURCE and manifest['runtime_source'] == TESTED,
+            'Manifest source/schema mismatch')
+    expected_members = NOTES | {'gates/launchers/' + value + '.py' for value in HELPERS.values()}
+    expected_members |= {'gates/' + stem + suffix for stem in GATES for suffix in ('.result.json', '.log', '.inputs.json')}
+    require(set(payload) == set(manifest['payloads']) == expected_members, 'Missing/extra package payload')
+    for name, raw in payload.items():
+        safe_name(name)
+        require(manifest['payloads'][name] == {'bytes': len(raw), 'sha256': sha(raw)}, 'Payload hash/size mismatch: ' + name)
+    old_names, old_status, old_causes, old_fmt = baseline(repo, document(payload['baseline-reference.json']))
+    records, logs, inventories = {}, {}, {}
+    for stem, (source, kind) in GATES.items():
+        root = 'gates/' + stem
+        r = document(payload[root + '.result.json'])
+        log = payload[root + '.log'].decode('utf-8')
+        require(r['source'] == r['head_after'] == source and r['changed_inputs'] == [] and r['verification_failures'] == [], 'Gate source/verification drift: ' + stem)
+        require(datetime.fromisoformat(r['start']) < datetime.fromisoformat(r['end']) and r['elapsed_monotonic_seconds'] > 0, 'Gate not closed')
+        env = r['environment']
+        require(env['CARGO_BUILD_JOBS'] == '1' and env['CARGO_INCREMENTAL'] == '0', 'Gate concurrency/profile differs')
+        require(all(env.get(key) is None for key in ('RUSTFLAGS', 'RUSTC', 'RUSTUP_TOOLCHAIN', 'RUST_MIN_STACK', 'ARCADIA_CODEC_LIFECYCLE_PHASE')), 'Compiler/parent override differs')
+        for key, expected in {'CARGO_TARGET_DIR': ROOT + '/.local/analysis-checked-save-target-20260913', 'CARGO_HOME': ROOT + '/.local/toolchain/cargo', 'RUSTUP_HOME': ROOT + '/.local/toolchain/rustup'}.items():
+            require(norm(env[key]) == norm(expected), 'Gate environment path differs: ' + key)
+        require(norm(r['cwd']) == norm(ROOT + '/.local/as3batch') and r['invocation'] == 'cargo', 'Gate invocation/cwd differs')
+        require(r['inputs'] == stem + '.inputs.json' and sha(payload[root + '.inputs.json']) == r['inputs_sha256'] and sha(payload[root + '.log']) == r['log_sha256'], 'Log/input binding differs')
+        helper = HELPERS[source]
+        require(r['launcher_sha256'] == r['launcher_sha256_after'] == helper and r['launcher_copy'].replace('\\', '/') == 'launchers/' + helper + '.py' and sha(payload['gates/launchers/' + helper + '.py']) == helper, 'Launcher differs')
+        current = document(payload[root + '.inputs.json'])
+        if source not in inventories:
+            git_inputs(repo, source, current)
+            inventories[source] = current
+        require(current == inventories[source], 'Same-source input manifests differ')
+        mode = 'integration' if kind in INTEGRATIONS else ('focused' if kind == 'admission' else kind)
+        selected = PROJECT if kind == 'focused' else ADMISSION if kind == 'admission' else INTEGRATIONS[kind][1] if mode == 'integration' else ''
+        target = INTEGRATIONS[kind][0] if mode == 'integration' else None
+        command = {
+            'clippy': ['cargo', 'clippy', '--locked', '--offline', '-p', 'oa-core', '--all-targets', '--', '-D', 'warnings'],
+            'fmt': ['cargo', 'fmt', '--all', '--', '--check'], 'list': PREFIX + ['--', '--list'],
+            'full': PREFIX + ['--', '--test-threads=1'], 'focused': PREFIX + [selected, '--', '--test-threads=1'],
+            'integration': ['cargo', 'test', '--locked', '--offline', '-p', 'oa-core', '--test', target, selected, '--', '--exact', '--test-threads=1'],
+        }[mode]
+        require(r['mode'] == mode and r['filter'] == selected and r['test_target'] == target and r['command'] == command, 'Exact command/mode/filter differs')
+        require(r['exit'] == (1 if kind == 'fmt' else 101 if kind == 'full' or (source == FAILED and kind == 'focused') else 0), 'Gate exit differs')
+        rows = re.findall(r'^test ([^\r\n]+) \.\.\. (ok|FAILED|ignored)\r?$', log, re.M)
+        require(r['outcomes'] == [list(row) for row in rows], 'Receipt outcomes differ from raw log')
+        binary = re.findall(r'^\s*Running ([^\r\n]+) \(([^\r\n]+\.exe)\)', log, re.M)
+        require(len(binary) == len(r['artifacts']) == (0 if mode in ('fmt', 'clippy') else 1), 'Missing/extra actual executable')
+        if binary:
+            label, logged = binary[0]
+            a = r['artifacts'][0]
+            require(norm(logged) == norm(a['path']) and a['bytes'] > 0 and re.fullmatch('[0-9a-f]{64}', a['sha256']), 'Executable record differs')
+            require(label.replace('\\', '/') == ('tests/' + target + '.rs' if mode == 'integration' else 'unittests src/lib.rs'), 'Wrong executable target')
+            require(PureWindowsPath(a['path']).name.startswith((target or 'oa_core') + '-'), 'Wrong artifact basename')
+        if mode == 'list':
+            names = listing(log)
+            require(r['listing_members'] == names and r['listing_count'] == len(names) == 209 and not rows, 'Listing receipt differs')
+            require(set(names) == set(old_names) | set(PROJECT_NAMES) | set(ADMISSION_NAMES), 'Exact listed names differ')
+        else:
+            require(r['listing_members'] == [] and r['listing_count'] == 0, 'Non-list fabricated listing')
+        if mode in ('clippy', 'fmt'):
+            require(not rows and not re.search(r'^running \d+ tests', log, re.M), 'Unexpected tests in non-test gate')
+        if mode == 'clippy':
+            require('Finished `dev` profile' in log and not re.search(r'^error(?:\[|:)', log, re.M), 'Strict log did not close cleanly')
+        records[stem], logs[stem] = r, log
+    prior_end = None
+    for stem in GATES:
+        r = records[stem]
+        started, ended = datetime.fromisoformat(r['start']), datetime.fromisoformat(r['end'])
+        require(prior_end is None or prior_end < started, 'Serialized gate chronology differs')
+        prior_end = ended
+    for short in ('b9a31bb', '71cadfa'):
+        strict, listed, focused = (records[f'project-{kind}-{short}-1'] for kind in ('clippy', 'list', 'focused'))
+        require(datetime.fromisoformat(strict['end']) < datetime.fromisoformat(listed['start']) < datetime.fromisoformat(focused['start']), 'Strict/list/focus order differs')
+        require(listed['artifacts'] == focused['artifacts'], 'Focus not bound to actual listed artifact')
+    require(records['project-list-b9a31bb-1']['listing_members'] == records['project-list-71cadfa-1']['listing_members'], 'Successor actual listing order changed')
+    bad_log = logs['project-focused-b9a31bb-1']
+    bad = outcomes(bad_log, PROJECT_NAMES, 11, 2, 196)
+    require({name for name, status in bad.items() if status == 'FAILED'} == FAILED_NAMES, 'Historical Project failures changed')
+    for name, block in failure_blocks(bad_log, FAILED_NAMES).items():
+        require('assertion `left == right` failed' in block and re.search(r'left: 2\r?\n right: 1', block), 'Historical warning-count failure cause changed')
+    outcomes(logs['project-focused-71cadfa-1'], PROJECT_NAMES, 13, 0, 196)
+    outcomes(logs['project-admission-71cadfa-1'], ADMISSION_NAMES, 2, 0, 207)
+    current_names = records['project-list-71cadfa-1']['listing_members']
+    actual = outcomes(logs['project-full-71cadfa-1'], current_names, 193, 16, 0)
+    require(all(actual[name] == status for name, status in old_status.items()) and all(actual[name] == 'ok' for name in PROJECT_NAMES + ADMISSION_NAMES), 'Historical or added runtime status changed')
+    require(causes(logs['project-full-71cadfa-1'], old_causes) == old_causes, 'Exact historical failure diagnostics changed')
+    for kind in ('admission', 'full'):
+        require(records[f'project-{kind}-71cadfa-1']['artifacts'] == records['project-list-71cadfa-1']['artifacts'], 'Runtime not bound to actual listing artifact')
+    for kind, (target, selected) in INTEGRATIONS.items():
+        outcomes(logs[f'project-{kind}-71cadfa-1'], [selected], 1, 0, 4 if target == 'route_source' else 32)
+    for first, second in (('route-defaults', 'route-errors'), ('fragment-coordinates', 'aggregate-references')):
+        require(records[f'project-{first}-71cadfa-1']['artifacts'] == records[f'project-{second}-71cadfa-1']['artifacts'],
+                'Repeated integration target artifact differs')
+    test_fmt = format_blocks(logs['project-fmt-71cadfa-1'])
+    final_fmt = format_blocks(logs['project-fmt-aaec78f-1'])
+    require(len(old_fmt) == 9 and len(test_fmt) == 10 and len(final_fmt) == 8, 'Formatting block count differs')
+    require(all(key in old_fmt and old_fmt[key] == value and test_fmt.get(key) == value for key, value in final_fmt.items()), 'Inherited formatter block body differs')
+    require(set(old_fmt) - set(final_fmt) == {('crates/oa-core/src/validation.rs', 182)}, 'Baseline formatting removal differs')
+    require(set(test_fmt) - set(final_fmt) == {('crates/oa-core/src/language.rs', 1907), ('crates/oa-core/src/language.rs', 1917)}, 'New formatter correction scope differs')
+    for path in {key[0] for key in final_fmt}:
+        require(git(repo, 'show', BASELINE + ':' + path) == git(repo, 'show', SOURCE + ':' + path), 'Inherited formatting source blob changed')
+    for a, b, changed, name in ((FAILED, TESTED, 'crates/oa-core/src/language/analysis_source/mixed/project/tests.rs', 'diffs/b9a31bb-to-71cadfa.patch'), (TESTED, SOURCE, 'crates/oa-core/src/language.rs', 'diffs/71cadfa-to-aaec78f.patch')):
+        require(git(repo, 'diff', '--name-only', a, b).decode().splitlines() == [changed], 'Source correction scope expanded')
+        require(git(repo, 'diff', '--binary', a, b) == payload[name], 'Exact Git correction diff differs')
+        left, right = inventories[a]['inputs'], inventories[b]['inputs']
+        require([row['path'] for row in left] == [row['path'] for row in right] and [x['path'] for x, y in zip(left, right) if x != y] == [changed], 'Scoped input correction differs')
+    before = git(repo, 'show', TESTED + ':crates/oa-core/src/language.rs').decode()
+    after = git(repo, 'show', SOURCE + ':crates/oa-core/src/language.rs').decode()
+    before, after = (re.sub(r'\s', '', value) for value in (before, after))
+    require(before.count('ConstructedDeclarations{project,legacy_elements}') == after.count('ConstructedDeclarations{project,legacy_elements,}') == 2 and after.replace('ConstructedDeclarations{project,legacy_elements,}', 'ConstructedDeclarations{project,legacy_elements}') == before, 'Successor has non-formatting semantic delta')
+    return {'source': SOURCE, 'runtime_source': TESTED, 'actual_listing': 209, 'Project_pass': 13, 'admission_pass': 2,
+            'full_status': 'FAILED', 'full_passed': 193, 'full_failed': 16, 'exact_prior_statuses_and_diagnostics_preserved': True,
+            'integration_passes': 4, 'strict_status': 'PASS at runtime_source', 'successor_fmt_status': 'FAILED',
+            'successor_fmt_inherited_blocks': 8, 'successor_runtime_claim': False,
+            'limits': 'Receipt/Git consistency, not subject re-execution or authenticated authorship. Private Project only; no public source8/index/update/UI completion.'}
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--repo', type=Path, required=True)
+    parser.add_argument('--package', type=Path, default=Path(__file__).resolve().parent)
+    args = parser.parse_args()
+    manifest = document((args.package / 'manifest.json').read_bytes())
+    archive_path = args.package / 'evidence.zip'
+    require(archive_path.stat().st_size <= 16 * 1024 * 1024, 'Compressed archive exceeds bound')
+    archive_raw = archive_path.read_bytes()
+    require(manifest['archive'] == {'file': 'evidence.zip', 'bytes': len(archive_raw), 'sha256': sha(archive_raw)},
+            'Top-level archive pin differs')
+    verifier_raw = Path(__file__).read_bytes()
+    require(manifest['verifier'] == {'file': 'verify.py', 'bytes': len(verifier_raw), 'sha256': sha(verifier_raw)}
+            and (args.package / 'verify.py').read_bytes() == verifier_raw,
+            'Top-level verifier pin differs')
+    with zipfile.ZipFile(io.BytesIO(archive_raw)) as archive:
+        names = archive.namelist()
+        require(len(names) == len(set(names)), 'Duplicate ZIP members')
+        require(len(names) <= 128 and sum(item.file_size for item in archive.infolist()) <= 16 * 1024 * 1024, 'Archive exceeds bounded evidence size')
+        for name in names:
+            safe_name(name)
+        payload = {name: archive.read(name) for name in names}
+    print(json.dumps(verify_payload(payload, manifest, args.repo), indent=2))
+    print('VERIFIED evidence consistency; full suite FAILED193/16; successor formatting FAILED8 inherited blocks; no successor runtime rerun.')
+
+
+if __name__ == '__main__':
+    try:
+        main()
+    except (ValueError, KeyError, TypeError, OSError, zipfile.BadZipFile, subprocess.CalledProcessError) as error:
+        raise SystemExit('REFUSED: ' + str(error))

harness/experiments/analysis-mixed-syntax-20260923/README.md

@@ -0,0 +1,34 @@
+# Private mixed-syntax Windows evidence
+
+Final source `a578ac98a06772a60bec00ae287e65650680d119`. The packager checks every closed receipt, actual test name/outcome, artifact hash and immutable Git input before emitting this archive. Its results concern this private syntax checkpoint; they do not establish public source8 or application completion.
+
+The complete core unit suite remains **FAILED: 178 passed / 16 known public-header failures, exit 101**. All 152 historical statuses are unchanged; all 42 later tests pass. The corrected listing contains 194 tests, retaining the previous 173; 85 typed tests pass within the full run, including the earlier stack controls, and the focused mixed run passes its exact 20 listed members. Strict core all-target Clippy passes. These counts are package acceptance constraints, verified from raw output before this report is emitted.
+
+The optional formatting gate **FAILED, exit 1** at both intermediate and final pins. Its nine diff blocks affect model.rs, references.rs, semantic/catalog.rs, session.rs, transitions.rs and validation.rs. Read-only Git comparison proves all six complete blobs identical at a578ac9, eeb1069, prior10d7f33 and historical f1d79df. The original eeb formatting note is preserved unchanged; the verifier independently checks final equality and both raw formatting outputs. This is inherited formatting debt, not a formatting pass or proof that fmt was run historically. No unrelated file was reformatted, and there is no blanket all-gates-pass claim.
+
+The original `754a9b4` listing compile failure is preserved, including E0063 at semantic_source.rs:191. Successor `eeb1069` adds only the missing test-only `mixed: None` initializer. **All five eeb gates remain:** listing194 PASS, focused20 PASS, full diagnostic178/16 FAILED101, fmt FAILED1, strict Clippy FAILED101 for unnecessary_unwrap/collapsible_if. Final a578 changes only the two equivalent test-only guards plus the exact shared AGENTS update. Of541 scoped inputs,540 are unchanged; AGENTS is outside that scope. Historical source-only handoffs/reviews retain their temporal claims.
+
+Final strict Clippy passed before the original Cargo listing. Following the host clock rollback, Cargo rebuilt for the focused run and produced a different binary hash: original listing `ae4974da…`, focused `089d7b03…`, both 39,706,624 bytes. Their equivalence is not inferred. A fresh **actual direct listing** of `089d7b03…` returned the same ordered194 names; focused20 and the subsequent unfiltered full direct run bind that exact executable. The original Cargo listing remains separate evidence. The direct recorder uses the package-root working directory, captures real executable output and checks all541 committed inputs plus executable/bound-evidence hashes before and after. It invokes no Cargo and fabricates no Cargo log line. Full178/16 is an actual libtest execution, not a new `cargo test` invocation. The archived review explains this protocol; no cache or source timestamps were changed.
+
+The host UTC clock moved backward during the original Cargo listing. Its receipt
+retains reversed start/end timestamps and 768.422 monotonic elapsed seconds.
+The verifier permits that timestamp ordering only for this exact hash-bound
+receipt; source, artifact, output and all other closure checks remain required.
+See the archived clock disposition. No wall-clock elapsed duration is inferred.
+
+Run from a checkout containing the named source and documentation Git objects:
+
+```
+python -B verify.py --repo /path/to/ARCADIA-Studio
+```
+
+Only read-only Git commands run. No archived Python, Rust, launcher, binary or test is executed. Source input bytes are checked against complete immutable Git input membership (541 at each of754/eeb/a578,538 at prior listing,534 at historical full run). Baseline raw receipts are independently bound to their published Git objects. Every present launcher is preserved once by its content hash; different runs may use different immutable launchers. No binaries, build cache or profile files are included.
+
+The verifier establishes evidence consistency, not independent runtime re-execution or cryptographic authenticity of receipt authorship. Preserve the package's Git commit or external checksums when transporting it. Extraction is unnecessary; ZIP members are checked without execution. The separately supplied verifier is reviewed code, not an archived helper selected by the manifest.
+
+No public source8 activation, complete semantic witness, mixed occurrence index/compositor, full model acceptance, checked-save or application/runtime completion is claimed. Private syntax still defers nested model-record/ordinary-step admission while retaining the original policy for that later boundary.
+
+The parent reran this packaged verifier successfully. Independent
+[real-archive controls](controls/README.md) accepted the unchanged archive and
+refused all 15 corrupted copies. Their raw results preserve an initial host-timeout
+attempt separately; no interrupted attempt is counted as a successful control.

harness/experiments/analysis-mixed-syntax-20260923/controls/README.md

@@ -0,0 +1,25 @@
+# Verifier control evidence
+
+The independently reviewed verifier accepted the unchanged real archive and
+refused all 15 corrupted copies. [Review](REVIEW.md) describes each actual refusal,
+the preserved initial timeout and the limits of this consistency evidence.
+
+`summary.json` indexes all 16 closed cases. Each `cases/NAME/` retains the exact
+control result, payload manifest and actual stdout/stderr. The separate
+`interrupted-known-failure-cause/` preserves the timed-out attempt's manifest and
+streams; it has no closed result and is not counted as a successful control.
+The initial and successor drivers and successor aggregate are preserved exactly.
+Historical paths in those receipts identify the original local execution.
+
+Corrupted ZIP copies remain local scratch and are omitted here to avoid repeating
+the complete evidence 17 times. The drivers define the mutations; their payload
+manifests retain the exact changed member hashes. The recorded ZIP hashes identify
+the original generated copies, not files supplied in this directory. Raw source
+gate evidence is in the adjacent original evidence.zip. None of these controls
+executed archived helpers or the subject test binary.
+
+The successor changes only the timeout from 180 to 900 seconds and selects the
+remaining thirteen cases. Its result is combined with the first three closed
+controls; the interrupted attempt remains distinct. All 49 watched original
+files were unchanged at control closure. Later additions of these publication
+notes do not change the original evidence.zip, manifest.json or verifier.

harness/experiments/analysis-mixed-syntax-20260923/controls/REVIEW.md

@@ -0,0 +1,54 @@
+# Real mixed-syntax archive controls
+
+Scope: independently exercise the separately reviewed receipt/Git verifier against copies of the actual emitted archive. No subject executable, compiler, GUI, archived helper or publication is run by these controls. Original package, harness copy, raw gate directory and external verifier remain read-only.
+
+Verifier SHA256: `2902f0c5e4922b942b3e8b9d0b288810ef6ad8dc71444d28ef8bfa756c4c5338`.
+
+## Initial run and preserved interruption
+
+Driver: `.local/analysis-mixed-syntax-package-controls-20260923.py`; output: `.local/analysis-mixed-syntax-package-negative-controls-20260923/`.
+
+The unchanged real archive was accepted. Removing a new outcome was refused for `Missing/extra runtime outcomes`; changing a new passing outcome was refused for `Runtime status mismatch`. Each closed case retains exact command, exit, monotonic duration, package/log hashes and observed result in its `control-result.json`.
+
+The fourth case, `changed-known-failure-cause`, hit the driver's 180-second subprocess timeout during independently observed host degradation. Its package and stdout/stderr remain in place. This interruption is neither an expected semantic refusal nor acceptance. No final aggregate `controls.json` was emitted by the initial run.
+
+The successor driver `.local/analysis-mixed-syntax-package-controls-successor-20260923.py` preserves the initial driver and changes only the per-process timeout to 900 seconds and the selected cases to the remaining thirteen (`cases[3:]`). The three valid initial controls are reused. It was prepared while execution was paused and was run only after parent host/build clearance.
+
+## Closed results and publication disposition
+
+**All 16 planned controls have their expected results: one unchanged archive accepted, fifteen corrupted copies refused. No further concrete blocker found for publication within the package's documented receipt/Git-consistency scope.** Initial three results plus the successor thirteen are indexed, with exact receipt pins, in `.local/analysis-mixed-syntax-package-controls-summary-20260923.json`. The interruption remains separately preserved and is not counted as a successful control.
+
+| Corruption | Actual refusal |
+| --- | --- |
+| Remove a new test outcome | Missing/extra runtime outcomes |
+| Change a new passing outcome to FAILED | Runtime status mismatch |
+| Change one inherited failure diagnostic | Failure cause changed, naming the affected cross-file reparent test |
+| Forge language.rs input hashes consistently across a578 maps/receipts | Git input bytes mismatch: crates/oa-core/src/language.rs |
+| Duplicate ZIP member | Duplicate ZIP members |
+| Remove intermediate eeb strict gate | Required checkpoint gates missing/ambiguous |
+| Change final formatting diff location | Final formatting failure scope changed |
+| Change exact reversed-clock receipt bytes | Direct historical binding differs |
+| Add byte-identical reversed-clock receipt under another name | Gate not closed |
+| Add a filter to direct full argv | Unexpected direct executable argv |
+| Substitute old listing artifact as direct before artifact | Direct artifact changed or differs from focused binary |
+| Omit one direct bound-file postcheck | Direct bound-file postcheck coverage differs |
+| Prepend fabricated Cargo invocation to direct stdout | Direct output contains a fabricated Cargo invocation line |
+| Record direct launch/verification failure | Direct invocation did not close cleanly |
+| Remove actual new direct listing | Missing bound gates/mixed-direct-list-a578-1.result.json |
+
+The forged a578 input reached immutable Git verification before direct descriptor checks; it was not merely rejected for an out-of-date wrapper binding. The changed clock bytes were rejected by the fixed historical binding before the timestamp predicate; the independent aliased-byte control reached `Gate not closed`. The missing direct listing was rejected when full-run binding resolved its missing record, before the later checkpoint inventory check. These are the observed refusal points, not relabeled predictions.
+
+After closure, independently re-read all 16 per-case receipt/file hashes and all 49 watched original files, including the local package, harness package, raw gate directory and verifier. Every hash still matches. Verified that the successor driver differs from the preserved initial driver only in the two stated changes. Per-case durations are monotonic; no cross-run wall-clock duration is inferred.
+
+| Artifact | SHA256 |
+| --- | --- |
+| Initial driver | `421f8109d583640df9c499878dba89bf12b81054b10e17b3a5b6440a188cc411` |
+| Successor driver | `c68437c5aa807c305215c0bae31c7ec77e216e266a7f48972572bdc6fda518e0` |
+| Successor controls.json | `87b29589b97a44527722feb385c2707c5fb3c7b1d8705568abdbbebf6add88d8` |
+| Combined summary JSON | `fea9d77fe491d6c281cd056e055e8917e363ff31db5e3b1cdd8f3312549aca35` |
+
+## Interpretation boundaries
+
+Corrupted payload manifest hashes and relevant inner receipt hashes are refreshed so semantic/Git controls can reach substantive checks. The final verifier's immutable direct historical binding can reject a changed clock receipt before the timestamp predicate; that is the actual refusal expected from the changed-byte control. A separate byte-identical aliased receipt retains the original for direct bindings and tests that another name cannot inherit the clock exception.
+
+These controls test consistency of recorded evidence with immutable Git and the reviewed protocol. They do not reproduce subject execution or establish protection against fabricated attestation. Existing source/runtime limitations, retained failed gates, separate old/new executable identities and the inherited formatter failure remain part of the package's meaning.

harness/experiments/analysis-mixed-syntax-20260923/controls/cases/aliased-exact-clock-receipt/control-result.json

@@ -0,0 +1,38 @@
+{
+  "case": "aliased-exact-clock-receipt",
+  "expected_accept": false,
+  "observed_accept": false,
+  "exit": 1,
+  "elapsed_monotonic_seconds": 12.31300000000192,
+  "expected_refusal_fragment": "Gate not closed",
+  "actual_refusal": "REFUSED: Gate not closed",
+  "matched": true,
+  "detail": "Keep original for direct bindings; identical reversed-clock receipt under a second name must not inherit exception.",
+  "command": [
+    "C:\\Users\\User\\.cache\\codex-runtimes\\codex-primary-runtime\\dependencies\\python\\python.exe",
+    "-B",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-syntax-evidence-tools-20260923\\verify.py",
+    "--repo",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio",
+    "--package",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-syntax-package-negative-controls-successor-20260923\\aliased-exact-clock-receipt"
+  ],
+  "files": {
+    "evidence.zip": {
+      "bytes": 574492,
+      "sha256": "3f9cc3cddd24e585fb7835a7493f604a2f422a9b45059e719803ac1d77756f53"
+    },
+    "manifest.json": {
+      "bytes": 35432,
+      "sha256": "8a8cdef19a62e95180fcfae669810a644c49c73d7406ac7917e26193b48a1c17"
+    },
+    "stderr.log": {
+      "bytes": 26,
+      "sha256": "82f4d6d3582fe536473a1085fa82393f5e391cff1df7b4a223f20f484f356153"
+    },
+    "stdout.log": {
+      "bytes": 0,
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    }
+  }
+}

harness/experiments/analysis-mixed-syntax-20260923/controls/cases/aliased-exact-clock-receipt/manifest.json

@@ -0,0 +1,565 @@
+{
+  "schema": 1,
+  "source": "a578ac98a06772a60bec00ae287e65650680d119",
+  "payloads": {
+    "baseline/full-f1d79df-comparison.py": {
+      "bytes": 3499,
+      "sha256": "e88c0c630b05d0568b29301efdfb0c6e74135e4b04e27a1f71f27954b8809921"
+    },
+    "baseline/full-f1d79df.comparison.json": {
+      "bytes": 3864,
+      "sha256": "5497ce589c3e8eea6158055af77da598aab1a7c2a92af30c7264bfd311ec89f4"
+    },
+    "baseline/full-f1d79df.inputs.json": {
+      "bytes": 99490,
+      "sha256": "6a4c7e3c8d1e6edb7ad306c19abd05009ee410312eb34b68ec30d6408387967b"
+    },
+    "baseline/full-f1d79df.log": {
+      "bytes": 28480,
+      "sha256": "29a08cbfc02a83922f90c00f0b48f1aa403f93261457e65d29e3b9f46389dce9"
+    },
+    "baseline/full-f1d79df.result.json": {
+      "bytes": 1234,
+      "sha256": "a1465abd64e2b3a29388f5da1912dcb87bfe9aed618c122bad557ff21c52c95b"
+    },
+    "gates/launchers/3043b4ca43f2fb581d9f77361830f0ea86425982d6dee40bc9d71a3444caa14a.py": {
+      "bytes": 16167,
+      "sha256": "3043b4ca43f2fb581d9f77361830f0ea86425982d6dee40bc9d71a3444caa14a"
+    },
+    "gates/launchers/471a2f4f4249575bd594ea0994d549abeb0f53c0fcc1a4e78cabf27aaa24d1de.py": {
+      "bytes": 5319,
+      "sha256": "471a2f4f4249575bd594ea0994d549abeb0f53c0fcc1a4e78cabf27aaa24d1de"
+    },
+    "gates/launchers/83b0720457f0508c8b8f828304e63102b69e43f1f526dde57c0c0ddf99f1f364.py": {
+      "bytes": 5264,
+      "sha256": "83b0720457f0508c8b8f828304e63102b69e43f1f526dde57c0c0ddf99f1f364"
+    },
+    "gates/mixed-clippy-a578-1.inputs.json": {
+      "bytes": 100820,
+      "sha256": "91316ef1384a49e5a097684366abc73a16346fef2cfba6a9ed58d3832a270bde"
+    },
+    "gates/mixed-clippy-a578-1.log": {
+      "bytes": 166,
+      "sha256": "36f453dc344f791cfc5bdfa532df3520008887de673b01c76edac9233e18e913"
+    },
+    "gates/mixed-clippy-a578-1.result.json": {
+      "bytes": 1717,
+      "sha256": "c6f408b0963d8da7514ea87219e5a0b991c04d3ea9f9fe25f7b45752cb57e7a5"
+    },
+    "gates/mixed-clippy-eeb1-1.inputs.json": {
+      "bytes": 100820,
+      "sha256": "a0aabf861b1322cc2843edb8befe85f8eaecda5d4d95d625c0f9886ee0435e1b"
+    },
+    "gates/mixed-clippy-eeb1-1.log": {
+      "bytes": 1996,
+      "sha256": "ab9c0fc8baf8c56230b448f18b1de8dbf2d8e7c85a1f118aea369dea129f3f17"
+    },
+    "gates/mixed-clippy-eeb1-1.result.json": {
+      "bytes": 1720,
+      "sha256": "886eb86c99a261af00207864ba4717735910a092f3ec3352ff455a960de38881"
+    },
+    "gates/mixed-direct-full-a578-1.inputs.json": {
+      "bytes": 100820,
+      "sha256": "91316ef1384a49e5a097684366abc73a16346fef2cfba6a9ed58d3832a270bde"
+    },
+    "gates/mixed-direct-full-a578-1.log": {
+      "bytes": 33333,
+      "sha256": "3af2546378fd0cdd634dd63791d8b3475563c49c19d28aaea1e3a35a2474fbb6"
+    },
+    "gates/mixed-direct-full-a578-1.result.json": {
+      "bytes": 52372,
+      "sha256": "8ba1ef2dca98440b57280ebf0282257ace79a0f0ccfde23f7ad8e7e2c255a0ec"
+    },
+    "gates/mixed-direct-list-a578-1.inputs.json": {
+      "bytes": 100820,
+      "sha256": "91316ef1384a49e5a097684366abc73a16346fef2cfba6a9ed58d3832a270bde"
+    },
+    "gates/mixed-direct-list-a578-1.log": {
+      "bytes": 20334,
+      "sha256": "37551f95fc70a422e394712690bf19b69ad769890a9a07eac73bf9e0fa843242"
+    },
+    "gates/mixed-direct-list-a578-1.result.json": {
+      "bytes": 49871,
+      "sha256": "22db9a6a34d1e0800a71ec1ae88e1f18467d1c50a10a9ad305182d29cc11d904"
+    },
+    "gates/mixed-fmt-a578-1.inputs.json": {
+      "bytes": 100820,
+      "sha256": "91316ef1384a49e5a097684366abc73a16346fef2cfba6a9ed58d3832a270bde"
+    },
+    "gates/mixed-fmt-a578-1.log": {
+      "bytes": 7352,
+      "sha256": "62cafef008281d224d8176df5938084cf17c27b3d31cc80971fbc5594155d792"
+    },
+    "gates/mixed-fmt-a578-1.result.json": {
+      "bytes": 1631,
+      "sha256": "2648337aa67f6978b77e05479321a35ad782ebdad71b322efc62bb46e7180fe0"
+    },
+    "gates/mixed-fmt-eeb1-1.inputs.json": {
+      "bytes": 100820,
+      "sha256": "a0aabf861b1322cc2843edb8befe85f8eaecda5d4d95d625c0f9886ee0435e1b"
+    },
+    "gates/mixed-fmt-eeb1-1.log": {
+      "bytes": 7352,
+      "sha256": "62cafef008281d224d8176df5938084cf17c27b3d31cc80971fbc5594155d792"
+    },
+    "gates/mixed-fmt-eeb1-1.result.json": {
+      "bytes": 1631,
+      "sha256": "0ad50da9ef19f4129f593ffe37173c930b0b151cdd6ea00b1308aec12c973a5b"
+    },
+    "gates/mixed-focused-a578-1.inputs.json": {
+      "bytes": 100820,
+      "sha256": "91316ef1384a49e5a097684366abc73a16346fef2cfba6a9ed58d3832a270bde"
+    },
+    "gates/mixed-focused-a578-1.log": {
+      "bytes": 2911,
+      "sha256": "4acfc2bc654210441ab07b45fcfdb9a8496667f768962c1c51a5a06f73011c60"
+    },
+    "gates/mixed-focused-a578-1.result.json": {
+      "bytes": 2061,
+      "sha256": "fa586319f22c7eb1bd75e9d9da6784cff8cc897b6b93205c84f6591fa9c76b85"
+    },
+    "gates/mixed-focused-eeb1-1.inputs.json": {
+      "bytes": 100820,
+      "sha256": "a0aabf861b1322cc2843edb8befe85f8eaecda5d4d95d625c0f9886ee0435e1b"
+    },
+    "gates/mixed-focused-eeb1-1.log": {
+      "bytes": 2806,
+      "sha256": "1b7d6df5aaa0b0d9828cbbac9a77cb8ace0d8e2e3a8e44d58dcc5b254348628a"
+    },
+    "gates/mixed-focused-eeb1-1.result.json": {
+      "bytes": 2057,
+      "sha256": "2b55c0b63e9bb9f3c8a45b934833a799e811b66a7c1297d40ca1b6edb54b4d75"
+    },
+    "gates/mixed-full-eeb1-1.inputs.json": {
+      "bytes": 100820,
+      "sha256": "a0aabf861b1322cc2843edb8befe85f8eaecda5d4d95d625c0f9886ee0435e1b"
+    },
+    "gates/mixed-full-eeb1-1.log": {
+      "bytes": 33611,
+      "sha256": "ae9e4f3187d053d3ded9ec2475fc7dd469d5df976261fdc30479070e08cbc2b6"
+    },
+    "gates/mixed-full-eeb1-1.result.json": {
+      "bytes": 1981,
+      "sha256": "1f0b3e64142d8a774ad5e59c1d8e8f28c1a94717749b851d22044a41c2e01830"
+    },
+    "gates/mixed-list-754a-1.inputs.json": {
+      "bytes": 100820,
+      "sha256": "020a1ef53d3f30699b66358cb8688add682a33960b3e12721f50af5a9f57a3cb"
+    },
+    "gates/mixed-list-754a-1.log": {
+      "bytes": 473,
+      "sha256": "ff09dcad13a097b29fe80455f9f34b5df71d3dd1ada101dca3ee1a046ab33977"
+    },
+    "gates/mixed-list-754a-1.result.json": {
+      "bytes": 1694,
+      "sha256": "35c109d3f9e05aaae7933f0af955703a8affad45158d3e7de6bd23c35ea76cd8"
+    },
+    "gates/mixed-list-a578-1.inputs.json": {
+      "bytes": 100820,
+      "sha256": "91316ef1384a49e5a097684366abc73a16346fef2cfba6a9ed58d3832a270bde"
+    },
+    "gates/mixed-list-a578-1.log": {
+      "bytes": 20665,
+      "sha256": "7ad105fc530f3f13d5b108f8856d431cf5833209b9dc410428525368aa0fd063"
+    },
+    "gates/mixed-list-a578-1.result.json": {
+      "bytes": 22476,
+      "sha256": "adae5f2c78302616e853765fe1c7e61d026610cb3cb3fa312b727e5c28a92100"
+    },
+    "gates/mixed-list-a578-clock-alias.result.json": {
+      "bytes": 22476,
+      "sha256": "adae5f2c78302616e853765fe1c7e61d026610cb3cb3fa312b727e5c28a92100"
+    },
+    "gates/mixed-list-eeb1-1.inputs.json": {
+      "bytes": 100820,
+      "sha256": "a0aabf861b1322cc2843edb8befe85f8eaecda5d4d95d625c0f9886ee0435e1b"
+    },
+    "gates/mixed-list-eeb1-1.log": {
+      "bytes": 20665,
+      "sha256": "3e07d0c5a843b9a2bc74d4ce8f36976c49ea57b6a14d5a4dc1f334a7e6016bd5"
+    },
+    "gates/mixed-list-eeb1-1.result.json": {
+      "bytes": 22477,
+      "sha256": "d0f7afa28c1a7b976a1729c59c2f6c9c7a04a674658a39e04de09106698005f5"
+    },
+    "helpers/analysis-mixed-syntax-clippy-fix-proof-20260923.py": {
+      "bytes": 3937,
+      "sha256": "95c006b1a84f42400fdad439958c3852aa54dc69ec85aedd29d79cc8c089c803"
+    },
+    "helpers/formatting-proof.py": {
+      "bytes": 5518,
+      "sha256": "731d5c8c9993c81b789edc3c8ab9aa03e141b4334ace8a64c5d101e8315e03b4"
+    },
+    "notes/analysis-mixed-direct-evidence-review-20260923.md": {
+      "bytes": 6608,
+      "sha256": "02e0713681e3a196d91b9cfd170bcd5a54d0e78b7948e30439baf9d051c29d6c"
+    },
+    "notes/analysis-mixed-direct-gate-path-check-20260923.json": {
+      "bytes": 22970,
+      "sha256": "e3455ca847df1fd25e3c8dd4040e647155a917905f38b8b320f4fdfa17ff3d2d"
+    },
+    "notes/analysis-mixed-parser-proposal-20260923.md": {
+      "bytes": 18874,
+      "sha256": "8ad3005d960667267a10e9a73b92f8e151dd4e451cbbaed215bbad74e79677e0"
+    },
+    "notes/analysis-mixed-parser-proposal-review-20260923.md": {
+      "bytes": 10271,
+      "sha256": "d8763a22883cf5fdc6a39b2fb8965f5ac061df8553b7968d3f6f4aa0adc17539"
+    },
+    "notes/analysis-mixed-parser-review-20260923.md": {
+      "bytes": 10271,
+      "sha256": "d8763a22883cf5fdc6a39b2fb8965f5ac061df8553b7968d3f6f4aa0adc17539"
+    },
+    "notes/analysis-mixed-syntax-clippy-fix-handoff-20260923.md": {
+      "bytes": 2848,
+      "sha256": "903676efac11de735cd04b91965ec44bb50dc6fa464192cbb39fa53f4276caf2"
+    },
+    "notes/analysis-mixed-syntax-clippy-fix-proof-20260923.json": {
+      "bytes": 2016,
+      "sha256": "cd91d010d66fda68c247bf64ce3861aa2d85dc9b3a535da80d7743241aad4a9c"
+    },
+    "notes/analysis-mixed-syntax-clock-disposition-20260923.md": {
+      "bytes": 1636,
+      "sha256": "f560270339411c6265127095bd83115143c2f97eb257a20d5f0c64193345b3e2"
+    },
+    "notes/analysis-mixed-syntax-evidence-tools-independent-review-20260923.md": {
+      "bytes": 13228,
+      "sha256": "3f7f6dc2621b111c885550f8d2e519f3668ec8a0f48f917d69419485a3638de4"
+    },
+    "notes/analysis-mixed-syntax-followup-754a9b4-manifest-20260923.json": {
+      "bytes": 688,
+      "sha256": "87079e866306b6418b4a69052286b96f7a3f92d5567c12ebf86fdba5f5cfd607"
+    },
+    "notes/analysis-mixed-syntax-followup-handoff-20260923.md": {
+      "bytes": 3739,
+      "sha256": "cbde5e49a3cc7f3fa6a138680dd4a8efba77038b9489358ce98b0f1beb930218"
+    },
+    "notes/analysis-mixed-syntax-formatting-disposition-20260923.json": {
+      "bytes": 2864,
+      "sha256": "52775e006cbc27df7c6d865b8ef0bf1557d9347d52476b40a62f09eaa732473c"
+    },
+    "notes/analysis-mixed-syntax-formatting-disposition-20260923.md": {
+      "bytes": 2316,
+      "sha256": "430e4350c506944313825fbaff289260c08134f3ba6c7b88323e5071fa7ccbf1"
+    },
+    "notes/analysis-mixed-syntax-independent-review-20260923.md": {
+      "bytes": 15780,
+      "sha256": "057cf307bf914832565fb92a289ac102fdd68c666201af736d7c37557984e0d8"
+    },
+    "notes/analysis-mixed-syntax-source-0fc0826-manifest-20260923.json": {
+      "bytes": 3100,
+      "sha256": "788b0ea775dbbe4772358a488500885132bd41038ac8f278542ed45d0741e24d"
+    },
+    "notes/analysis-mixed-syntax-source-handoff-20260923.md": {
+      "bytes": 11880,
+      "sha256": "afa06df13a87a2be290623bf33d4643c9ec70a2e38886fb1b971e770db3239fe"
+    },
+    "prior/list-10d7f33.inputs.json": {
+      "bytes": 100256,
+      "sha256": "a8310981b743069f6e6abf0ef11857ec03c16562dc7e8264030c1d9d82517e46"
+    },
+    "prior/list-10d7f33.log": {
+      "bytes": 18213,
+      "sha256": "76b9e9ebc0c0d3d8794020dd222cfc94f7dd8cda9deedd0e74e0cd0c3aa5900c"
+    },
+    "prior/list-10d7f33.result.json": {
+      "bytes": 19385,
+      "sha256": "4baf130b68e2c044ad3e43d6e8a2e13c611008192a271d3dfa75ee5a7c1503c1"
+    }
+  },
+  "git_origins": {
+    "baseline/full-f1d79df.log": {
+      "commit": "257984c5dae63dae116a1438fb2a5d3138df8431",
+      "path": "harness/experiments/analysis-source-s2c-windows-20260913/raw/full-f1d79df.log"
+    },
+    "baseline/full-f1d79df.result.json": {
+      "commit": "257984c5dae63dae116a1438fb2a5d3138df8431",
+      "path": "harness/experiments/analysis-source-s2c-windows-20260913/raw/full-f1d79df.result.json"
+    },
+    "baseline/full-f1d79df.inputs.json": {
+      "commit": "257984c5dae63dae116a1438fb2a5d3138df8431",
+      "path": "harness/experiments/analysis-source-s2c-windows-20260913/raw/full-f1d79df.inputs.json"
+    },
+    "baseline/full-f1d79df.comparison.json": {
+      "commit": "257984c5dae63dae116a1438fb2a5d3138df8431",
+      "path": "harness/experiments/analysis-source-s2c-windows-20260913/raw/full-f1d79df.comparison.json"
+    },
+    "baseline/full-f1d79df-comparison.py": {
+      "commit": "257984c5dae63dae116a1438fb2a5d3138df8431",
+      "path": "harness/experiments/analysis-source-s2c-windows-20260913/raw/full-f1d79df-comparison.py"
+    },
+    "prior/list-10d7f33.log": {
+      "commit": "aecee2aff3f4410648a501a70cb2e6160c81adc5",
+      "path": "harness/experiments/analysis-original-span-20260923/evidence.zip",
+      "member": "list-10d7f33.log"
+    },
+    "prior/list-10d7f33.result.json": {
+      "commit": "aecee2aff3f4410648a501a70cb2e6160c81adc5",
+      "path": "harness/experiments/analysis-original-span-20260923/evidence.zip",
+      "member": "list-10d7f33.result.json"
+    },
+    "prior/list-10d7f33.inputs.json": {
+      "commit": "aecee2aff3f4410648a501a70cb2e6160c81adc5",
+      "path": "harness/experiments/analysis-original-span-20260923/evidence.zip",
+      "member": "list-10d7f33.inputs.json"
+    },
+    "notes/analysis-mixed-parser-proposal-20260923.md": {
+      "commit": "aecee2aff3f4410648a501a70cb2e6160c81adc5",
+      "path": "harness/analysis-mixed-parser-proposal-20260923.md"
+    },
+    "notes/analysis-mixed-parser-review-20260923.md": {
+      "commit": "aecee2aff3f4410648a501a70cb2e6160c81adc5",
+      "path": "harness/analysis-mixed-parser-review-20260923.md"
+    }
+  },
+  "verified_summary": {
+    "source": "a578ac98a06772a60bec00ae287e65650680d119",
+    "full_suite": "FAILED",
+    "full_exit": 101,
+    "listed": 194,
+    "prior_173_retained": 173,
+    "typed_passed_in_full": 85,
+    "mixed_focused_passed": 20,
+    "full_passed": 178,
+    "full_failed": 16,
+    "old_152_statuses_unchanged": 152,
+    "new_42_passes": [
+      "language::analysis_source::index::tests::arena_rejects_duplicate_sites_occurrences_and_wrong_callee_labels",
+      "language::analysis_source::index::tests::arena_rejects_forward_cycles_and_cross_owner_field_file_parents",
+      "language::analysis_source::index::tests::deep_parse_index_plan_and_failed_build_cleanup_on_128k_stack",
+      "language::analysis_source::index::tests::index_checks_every_expression_edge_and_keeps_override_fields_distinct",
+      "language::analysis_source::index::tests::index_has_shared_budget_and_never_stabilizes_missing_ids",
+      "language::analysis_source::index::tests::index_rejects_comment_partial_and_non_utf8_occurrence_spans",
+      "language::analysis_source::index::tests::maximum_index_paths_compare_lookup_debug_and_drop_on_128k_stack",
+      "language::analysis_source::index::tests::repeated_reordered_calls_have_stable_full_paths_and_four_labels",
+      "language::analysis_source::index::tests::staged_index_preserves_complete_oa_sa_models_and_original_file_spans",
+      "language::analysis_source::mixed::tests::all_short_typed_roots_share_original_buffers_without_public_activation",
+      "language::analysis_source::mixed::tests::caller_declaration_counts_are_aggregate_and_checked_before_typed_header_allocation",
+      "language::analysis_source::mixed::tests::diamond_includes_return_one_canonical_file_table_and_scan_dependency_once",
+      "language::analysis_source::mixed::tests::duplicate_ordinary_ids_keep_occurrences_and_scoped_parameter_ids_remain_distinct",
+      "language::analysis_source::mixed::tests::every_identity_class_requires_authored_ids_without_mutating_the_bundle",
+      "language::analysis_source::mixed::tests::exact_shared_profile_limits_include_nonlatching_metadata_phase_failures",
+      "language::analysis_source::mixed::tests::exact_work_and_reference_occurrences_accumulate_across_files",
+      "language::analysis_source::mixed::tests::interleaved_unicode_crlf_has_original_typed_and_ordinary_coordinates",
+      "language::analysis_source::mixed::tests::mixed_deep_typed_success_and_rejection_cleanup_on_128k_stack",
+      "language::analysis_source::mixed::tests::mixed_typed_reference_limit_is_inherited_without_charging_ordinary_parent_refs",
+      "language::analysis_source::mixed::tests::ordinary_model_records_and_parent_reference_are_not_syntax_or_step_limits",
+      "language::analysis_source::mixed::tests::ordinary_numeric_adjacency_and_malformed_trivia_match_legacy_refusals",
+      "language::analysis_source::mixed::tests::ordinary_signed_numbers_keep_complete_nested_value_and_field_ends",
+      "language::analysis_source::mixed::tests::ordinary_value_depth_boundary_remains_64_in_both_parser_views",
+      "language::analysis_source::mixed::tests::private_aggregate_preflights_run_before_traversal_path_allocation",
+      "language::analysis_source::mixed::tests::syntax_entries_accumulate_across_both_ordinary_and_typed_producer_orders",
+      "language::analysis_source::mixed::tests::typed_numeric_work_remains_in_the_same_inherited_profile",
+      "language::analysis_source::mixed::tests::typed_words_are_contextual_but_typed_headers_cannot_nest_in_ordinary_bodies",
+      "language::analysis_source::mixed::tests::whole_bundle_rejects_missing_unreachable_cyclic_and_noncanonical_files",
+      "language::analysis_source::mixed::tests::witness_retains_exact_caller_policy_separately_from_syntax_storage",
+      "language::analysis_source::tests::every_parent_shape_rejects_depth129_and_cleans_children_on_128k_stack",
+      "language::analysis_source::update::tests::alias_edits_preserve_unit_type_override_tokens_and_unrelated_authored_bytes",
+      "language::analysis_source::update::tests::composition_checks_edit_record_ceiling_before_duplicate_membership",
+      "language::analysis_source::update::tests::composition_defers_only_typed_output_size_with_independent_shrink_arithmetic",
+      "language::analysis_source::update::tests::composition_exports_complete_borrowed_swap_witnesses_and_empty_noops",
+      "language::analysis_source::update::tests::composition_keeps_name_storage_and_rename_record_limits_before_allocation",
+      "language::analysis_source::update::tests::composition_rejects_stale_or_damaged_complete_batches_before_export",
+      "language::analysis_source::update::tests::output_and_plan_limits_are_aggregate_and_do_not_reset_parse_work",
+      "language::analysis_source::update::tests::rename_rejects_unknown_invalid_and_colliding_final_names_but_allows_noop",
+      "language::analysis_source::update::tests::simultaneous_global_and_scoped_swaps_match_original_token_and_whole_model_oracles",
+      "language::analysis_source::update::tests::stale_file_sets_bytes_forged_spans_and_duplicate_edits_fail_before_output",
+      "language::analysis_source::update::tests::standalone_noop_apply_keeps_tighter_file_only_budget_and_output_boundary",
+      "source_project::traversal::tests::ordinary_compile_once_keeps_include_order_and_cycle_source_location"
+    ],
+    "known_failure_names": [
+      "language::nesting_tests::checked_in_example_supports_cross_file_reparent_without_changing_allocations",
+      "language::nesting_tests::checked_in_nested_example_has_stable_ids_typed_exchanges_and_three_clear_views",
+      "language::nesting_tests::nested_elements_infer_only_parent_and_keep_typed_fields_and_allocations_explicit",
+      "language::nesting_tests::nested_fragment_id_stabilization_preserves_comments_and_indexes_real_bytes",
+      "language::nesting_tests::non_elements_includes_and_declarations_inside_typed_values_are_rejected",
+      "language::nesting_tests::normative_nested_ownership_example_compiles_as_a_source_fragment",
+      "source_files::transaction_tests::interrupted_publication_without_write_marker_never_rolls_back_external_matching_bytes",
+      "source_files::transaction_tests::interrupted_save_and_interrupted_recovery_can_both_be_resumed",
+      "source_files::transaction_tests::malformed_v2_write_marker_refuses_recovery_without_changing_source_bytes",
+      "source_files::transaction_tests::partial_save_failures_restore_every_original_and_write_entry_last",
+      "source_files::transaction_tests::recovery_before_any_write_accepts_v2_marker_and_keeps_v1_rollback_compatibility",
+      "source_files::transaction_tests::recovery_rechecks_external_changes_between_restorations",
+      "source_files::transaction_tests::recovery_rejects_untrusted_escape_paths_before_touching_files",
+      "source_files::transaction_tests::rollback_refuses_external_edits_even_in_an_unchanged_dependency",
+      "source_files::transaction_tests::rollback_removes_only_our_new_file_and_retains_detached_files",
+      "source_files::transaction_tests::unwritten_journal_never_rolls_back_a_completed_writer_with_identical_after_bytes"
+    ],
+    "new_since_173": [
+      "language::analysis_source::mixed::tests::all_short_typed_roots_share_original_buffers_without_public_activation",
+      "language::analysis_source::mixed::tests::caller_declaration_counts_are_aggregate_and_checked_before_typed_header_allocation",
+      "language::analysis_source::mixed::tests::diamond_includes_return_one_canonical_file_table_and_scan_dependency_once",
+      "language::analysis_source::mixed::tests::duplicate_ordinary_ids_keep_occurrences_and_scoped_parameter_ids_remain_distinct",
+      "language::analysis_source::mixed::tests::every_identity_class_requires_authored_ids_without_mutating_the_bundle",
+      "language::analysis_source::mixed::tests::exact_shared_profile_limits_include_nonlatching_metadata_phase_failures",
+      "language::analysis_source::mixed::tests::exact_work_and_reference_occurrences_accumulate_across_files",
+      "language::analysis_source::mixed::tests::interleaved_unicode_crlf_has_original_typed_and_ordinary_coordinates",
+      "language::analysis_source::mixed::tests::mixed_deep_typed_success_and_rejection_cleanup_on_128k_stack",
+      "language::analysis_source::mixed::tests::mixed_typed_reference_limit_is_inherited_without_charging_ordinary_parent_refs",
+      "language::analysis_source::mixed::tests::ordinary_model_records_and_parent_reference_are_not_syntax_or_step_limits",
+      "language::analysis_source::mixed::tests::ordinary_numeric_adjacency_and_malformed_trivia_match_legacy_refusals",
+      "language::analysis_source::mixed::tests::ordinary_signed_numbers_keep_complete_nested_value_and_field_ends",
+      "language::analysis_source::mixed::tests::ordinary_value_depth_boundary_remains_64_in_both_parser_views",
+      "language::analysis_source::mixed::tests::private_aggregate_preflights_run_before_traversal_path_allocation",
+      "language::analysis_source::mixed::tests::syntax_entries_accumulate_across_both_ordinary_and_typed_producer_orders",
+      "language::analysis_source::mixed::tests::typed_numeric_work_remains_in_the_same_inherited_profile",
+      "language::analysis_source::mixed::tests::typed_words_are_contextual_but_typed_headers_cannot_nest_in_ordinary_bodies",
+      "language::analysis_source::mixed::tests::whole_bundle_rejects_missing_unreachable_cyclic_and_noncanonical_files",
+      "language::analysis_source::mixed::tests::witness_retains_exact_caller_policy_separately_from_syntax_storage",
+      "source_project::traversal::tests::ordinary_compile_once_keeps_include_order_and_cycle_source_location"
+    ],
+    "test_artifact": {
+      "path": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-checked-save-target-20260913\\debug\\deps\\oa_core-416e35542925bed6.exe",
+      "bytes": 39706624,
+      "sha256": "089d7b0389bb3f4e98fd350d4d7504294087ce3fc84035672c781547c8a71881"
+    },
+    "strict_core_all_targets": "PASS",
+    "strict_exit": 0,
+    "fmt_exit": 1,
+    "full_invocation": "direct-executable",
+    "listing_artifacts": [
+      {
+        "invocation": "direct-executable",
+        "artifacts": [
+          {
+            "path": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-checked-save-target-20260913\\debug\\deps\\oa_core-416e35542925bed6.exe",
+            "bytes": 39706624,
+            "sha256": "089d7b0389bb3f4e98fd350d4d7504294087ce3fc84035672c781547c8a71881"
+          }
+        ]
+      },
+      {
+        "invocation": "cargo",
+        "artifacts": [
+          {
+            "path": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-checked-save-target-20260913\\debug\\deps\\oa_core-416e35542925bed6.exe",
+            "bytes": 39706624,
+            "sha256": "ae4974da9a58c487e1fe1a4d1461743b106fb7495f3c5a84a20a8999cc9a7ce2"
+          }
+        ]
+      }
+    ],
+    "intermediate_checkpoint": {
+      "source": "eeb1069cfcfc51e4cf73cff850adc2fabc8aae77",
+      "full_suite": "FAILED",
+      "full_exit": 101,
+      "listed": 194,
+      "prior_173_retained": 173,
+      "typed_passed_in_full": 85,
+      "mixed_focused_passed": 20,
+      "full_passed": 178,
+      "full_failed": 16,
+      "old_152_statuses_unchanged": 152,
+      "new_42_passes": [
+        "language::analysis_source::index::tests::arena_rejects_duplicate_sites_occurrences_and_wrong_callee_labels",
+        "language::analysis_source::index::tests::arena_rejects_forward_cycles_and_cross_owner_field_file_parents",
+        "language::analysis_source::index::tests::deep_parse_index_plan_and_failed_build_cleanup_on_128k_stack",
+        "language::analysis_source::index::tests::index_checks_every_expression_edge_and_keeps_override_fields_distinct",
+        "language::analysis_source::index::tests::index_has_shared_budget_and_never_stabilizes_missing_ids",
+        "language::analysis_source::index::tests::index_rejects_comment_partial_and_non_utf8_occurrence_spans",
+        "language::analysis_source::index::tests::maximum_index_paths_compare_lookup_debug_and_drop_on_128k_stack",
+        "language::analysis_source::index::tests::repeated_reordered_calls_have_stable_full_paths_and_four_labels",
+        "language::analysis_source::index::tests::staged_index_preserves_complete_oa_sa_models_and_original_file_spans",
+        "language::analysis_source::mixed::tests::all_short_typed_roots_share_original_buffers_without_public_activation",
+        "language::analysis_source::mixed::tests::caller_declaration_counts_are_aggregate_and_checked_before_typed_header_allocation",
+        "language::analysis_source::mixed::tests::diamond_includes_return_one_canonical_file_table_and_scan_dependency_once",
+        "language::analysis_source::mixed::tests::duplicate_ordinary_ids_keep_occurrences_and_scoped_parameter_ids_remain_distinct",
+        "language::analysis_source::mixed::tests::every_identity_class_requires_authored_ids_without_mutating_the_bundle",
+        "language::analysis_source::mixed::tests::exact_shared_profile_limits_include_nonlatching_metadata_phase_failures",
+        "language::analysis_source::mixed::tests::exact_work_and_reference_occurrences_accumulate_across_files",
+        "language::analysis_source::mixed::tests::interleaved_unicode_crlf_has_original_typed_and_ordinary_coordinates",
+        "language::analysis_source::mixed::tests::mixed_deep_typed_success_and_rejection_cleanup_on_128k_stack",
+        "language::analysis_source::mixed::tests::mixed_typed_reference_limit_is_inherited_without_charging_ordinary_parent_refs",
+        "language::analysis_source::mixed::tests::ordinary_model_records_and_parent_reference_are_not_syntax_or_step_limits",
+        "language::analysis_source::mixed::tests::ordinary_numeric_adjacency_and_malformed_trivia_match_legacy_refusals",
+        "language::analysis_source::mixed::tests::ordinary_signed_numbers_keep_complete_nested_value_and_field_ends",
+        "language::analysis_source::mixed::tests::ordinary_value_depth_boundary_remains_64_in_both_parser_views",
+        "language::analysis_source::mixed::tests::private_aggregate_preflights_run_before_traversal_path_allocation",
+        "language::analysis_source::mixed::tests::syntax_entries_accumulate_across_both_ordinary_and_typed_producer_orders",
+        "language::analysis_source::mixed::tests::typed_numeric_work_remains_in_the_same_inherited_profile",
+        "language::analysis_source::mixed::tests::typed_words_are_contextual_but_typed_headers_cannot_nest_in_ordinary_bodies",
+        "language::analysis_source::mixed::tests::whole_bundle_rejects_missing_unreachable_cyclic_and_noncanonical_files",
+        "language::analysis_source::mixed::tests::witness_retains_exact_caller_policy_separately_from_syntax_storage",
+        "language::analysis_source::tests::every_parent_shape_rejects_depth129_and_cleans_children_on_128k_stack",
+        "language::analysis_source::update::tests::alias_edits_preserve_unit_type_override_tokens_and_unrelated_authored_bytes",
+        "language::analysis_source::update::tests::composition_checks_edit_record_ceiling_before_duplicate_membership",
+        "language::analysis_source::update::tests::composition_defers_only_typed_output_size_with_independent_shrink_arithmetic",
+        "language::analysis_source::update::tests::composition_exports_complete_borrowed_swap_witnesses_and_empty_noops",
+        "language::analysis_source::update::tests::composition_keeps_name_storage_and_rename_record_limits_before_allocation",
+        "language::analysis_source::update::tests::composition_rejects_stale_or_damaged_complete_batches_before_export",
+        "language::analysis_source::update::tests::output_and_plan_limits_are_aggregate_and_do_not_reset_parse_work",
+        "language::analysis_source::update::tests::rename_rejects_unknown_invalid_and_colliding_final_names_but_allows_noop",
+        "language::analysis_source::update::tests::simultaneous_global_and_scoped_swaps_match_original_token_and_whole_model_oracles",
+        "language::analysis_source::update::tests::stale_file_sets_bytes_forged_spans_and_duplicate_edits_fail_before_output",
+        "language::analysis_source::update::tests::standalone_noop_apply_keeps_tighter_file_only_budget_and_output_boundary",
+        "source_project::traversal::tests::ordinary_compile_once_keeps_include_order_and_cycle_source_location"
+      ],
+      "known_failure_names": [
+        "language::nesting_tests::checked_in_example_supports_cross_file_reparent_without_changing_allocations",
+        "language::nesting_tests::checked_in_nested_example_has_stable_ids_typed_exchanges_and_three_clear_views",
+        "language::nesting_tests::nested_elements_infer_only_parent_and_keep_typed_fields_and_allocations_explicit",
+        "language::nesting_tests::nested_fragment_id_stabilization_preserves_comments_and_indexes_real_bytes",
+        "language::nesting_tests::non_elements_includes_and_declarations_inside_typed_values_are_rejected",
+        "language::nesting_tests::normative_nested_ownership_example_compiles_as_a_source_fragment",
+        "source_files::transaction_tests::interrupted_publication_without_write_marker_never_rolls_back_external_matching_bytes",
+        "source_files::transaction_tests::interrupted_save_and_interrupted_recovery_can_both_be_resumed",
+        "source_files::transaction_tests::malformed_v2_write_marker_refuses_recovery_without_changing_source_bytes",
+        "source_files::transaction_tests::partial_save_failures_restore_every_original_and_write_entry_last",
+        "source_files::transaction_tests::recovery_before_any_write_accepts_v2_marker_and_keeps_v1_rollback_compatibility",
+        "source_files::transaction_tests::recovery_rechecks_external_changes_between_restorations",
+        "source_files::transaction_tests::recovery_rejects_untrusted_escape_paths_before_touching_files",
+        "source_files::transaction_tests::rollback_refuses_external_edits_even_in_an_unchanged_dependency",
+        "source_files::transaction_tests::rollback_removes_only_our_new_file_and_retains_detached_files",
+        "source_files::transaction_tests::unwritten_journal_never_rolls_back_a_completed_writer_with_identical_after_bytes"
+      ],
+      "new_since_173": [
+        "language::analysis_source::mixed::tests::all_short_typed_roots_share_original_buffers_without_public_activation",
+        "language::analysis_source::mixed::tests::caller_declaration_counts_are_aggregate_and_checked_before_typed_header_allocation",
+        "language::analysis_source::mixed::tests::diamond_includes_return_one_canonical_file_table_and_scan_dependency_once",
+        "language::analysis_source::mixed::tests::duplicate_ordinary_ids_keep_occurrences_and_scoped_parameter_ids_remain_distinct",
+        "language::analysis_source::mixed::tests::every_identity_class_requires_authored_ids_without_mutating_the_bundle",
+        "language::analysis_source::mixed::tests::exact_shared_profile_limits_include_nonlatching_metadata_phase_failures",
+        "language::analysis_source::mixed::tests::exact_work_and_reference_occurrences_accumulate_across_files",
+        "language::analysis_source::mixed::tests::interleaved_unicode_crlf_has_original_typed_and_ordinary_coordinates",
+        "language::analysis_source::mixed::tests::mixed_deep_typed_success_and_rejection_cleanup_on_128k_stack",
+        "language::analysis_source::mixed::tests::mixed_typed_reference_limit_is_inherited_without_charging_ordinary_parent_refs",
+        "language::analysis_source::mixed::tests::ordinary_model_records_and_parent_reference_are_not_syntax_or_step_limits",
+        "language::analysis_source::mixed::tests::ordinary_numeric_adjacency_and_malformed_trivia_match_legacy_refusals",
+        "language::analysis_source::mixed::tests::ordinary_signed_numbers_keep_complete_nested_value_and_field_ends",
+        "language::analysis_source::mixed::tests::ordinary_value_depth_boundary_remains_64_in_both_parser_views",
+        "language::analysis_source::mixed::tests::private_aggregate_preflights_run_before_traversal_path_allocation",
+        "language::analysis_source::mixed::tests::syntax_entries_accumulate_across_both_ordinary_and_typed_producer_orders",
+        "language::analysis_source::mixed::tests::typed_numeric_work_remains_in_the_same_inherited_profile",
+        "language::analysis_source::mixed::tests::typed_words_are_contextual_but_typed_headers_cannot_nest_in_ordinary_bodies",
+        "language::analysis_source::mixed::tests::whole_bundle_rejects_missing_unreachable_cyclic_and_noncanonical_files",
+        "language::analysis_source::mixed::tests::witness_retains_exact_caller_policy_separately_from_syntax_storage",
+        "source_project::traversal::tests::ordinary_compile_once_keeps_include_order_and_cycle_source_location"
+      ],
+      "test_artifact": {
+        "path": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-checked-save-target-20260913\\debug\\deps\\oa_core-416e35542925bed6.exe",
+        "bytes": 39708672,
+        "sha256": "5482a24e86d6f102c34dec6be9904726488963e8552e514253efbf03dfbcd98c"
+      },
+      "strict_core_all_targets": "FAILED",
+      "strict_exit": 101,
+      "fmt_exit": 1,
+      "full_invocation": "cargo",
+      "listing_artifacts": [
+        {
+          "invocation": "cargo",
+          "artifacts": [
+            {
+              "path": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-checked-save-target-20260913\\debug\\deps\\oa_core-416e35542925bed6.exe",
+              "bytes": 39708672,
+              "sha256": "5482a24e86d6f102c34dec6be9904726488963e8552e514253efbf03dfbcd98c"
+            }
+          ]
+        }
+      ]
+    },
+    "formatting_disposition": "Formatting FAILED at eeb1069; six affected blobs byte-identical at a578ac9, eeb1069, 10d7f33 and f1d79df; final fmt also FAILED exit 1 with identical nine blocks",
+    "unchanged_inputs_from_intermediate": 540,
+    "clock_discontinuity": "Raw final listing UTC end precedes start after host clock moved backward; exact immutable receipt retained; elapsed_monotonic_seconds=768.4220000000059 is the duration evidence. No wall-clock duration inferred.",
+    "limits": "Receipt/Git consistency only; no archived code or binaries executed. No public source8, semantic/compositor or full-suite PASS claim."
+  }
+}

harness/experiments/analysis-mixed-syntax-20260923/controls/cases/aliased-exact-clock-receipt/stderr.log

@@ -0,0 +1 @@
+REFUSED: Gate not closed

harness/experiments/analysis-mixed-syntax-20260923/controls/cases/changed-clock-receipt/control-result.json

@@ -0,0 +1,38 @@
+{
+  "case": "changed-clock-receipt",
+  "expected_accept": false,
+  "observed_accept": false,
+  "exit": 1,
+  "elapsed_monotonic_seconds": 7.359000000004016,
+  "expected_refusal_fragment": "Direct historical binding differs",
+  "actual_refusal": "REFUSED: Direct historical binding differs",
+  "matched": true,
+  "detail": "",
+  "command": [
+    "C:\\Users\\User\\.cache\\codex-runtimes\\codex-primary-runtime\\dependencies\\python\\python.exe",
+    "-B",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-syntax-evidence-tools-20260923\\verify.py",
+    "--repo",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio",
+    "--package",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-syntax-package-negative-controls-successor-20260923\\changed-clock-receipt"
+  ],
+  "files": {
+    "evidence.zip": {
+      "bytes": 567821,
+      "sha256": "e339a7783b4af42c22fc1f4c0a9068b81390af0670f74e42d5762471e6db570e"
+    },
+    "manifest.json": {
+      "bytes": 35265,
+      "sha256": "88c8c090013c486b5c327afdae3fe92a270fa6b4920a176ea757e4cf5acbe37d"
+    },
+    "stderr.log": {
+      "bytes": 44,
+      "sha256": "4431763122db1909bbd7de5d7b75ac49d311cd2441fc3895833480ae7e72a644"
+    },
+    "stdout.log": {
+      "bytes": 0,
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    }
+  }
+}

harness/experiments/analysis-mixed-syntax-20260923/controls/cases/changed-clock-receipt/manifest.json

@@ -0,0 +1,561 @@
+{
+  "schema": 1,
+  "source": "a578ac98a06772a60bec00ae287e65650680d119",
+  "payloads": {
+    "baseline/full-f1d79df-comparison.py": {
+      "bytes": 3499,
+      "sha256": "e88c0c630b05d0568b29301efdfb0c6e74135e4b04e27a1f71f27954b8809921"
+    },
+    "baseline/full-f1d79df.comparison.json": {
+      "bytes": 3864,
+      "sha256": "5497ce589c3e8eea6158055af77da598aab1a7c2a92af30c7264bfd311ec89f4"
+    },
+    "baseline/full-f1d79df.inputs.json": {
+      "bytes": 99490,
+      "sha256": "6a4c7e3c8d1e6edb7ad306c19abd05009ee410312eb34b68ec30d6408387967b"
+    },
+    "baseline/full-f1d79df.log": {
+      "bytes": 28480,
+      "sha256": "29a08cbfc02a83922f90c00f0b48f1aa403f93261457e65d29e3b9f46389dce9"
+    },
+    "baseline/full-f1d79df.result.json": {
+      "bytes": 1234,
+      "sha256": "a1465abd64e2b3a29388f5da1912dcb87bfe9aed618c122bad557ff21c52c95b"
+    },
+    "gates/launchers/3043b4ca43f2fb581d9f77361830f0ea86425982d6dee40bc9d71a3444caa14a.py": {
+      "bytes": 16167,
+      "sha256": "3043b4ca43f2fb581d9f77361830f0ea86425982d6dee40bc9d71a3444caa14a"
+    },
+    "gates/launchers/471a2f4f4249575bd594ea0994d549abeb0f53c0fcc1a4e78cabf27aaa24d1de.py": {
+      "bytes": 5319,
+      "sha256": "471a2f4f4249575bd594ea0994d549abeb0f53c0fcc1a4e78cabf27aaa24d1de"
+    },
+    "gates/launchers/83b0720457f0508c8b8f828304e63102b69e43f1f526dde57c0c0ddf99f1f364.py": {
+      "bytes": 5264,
+      "sha256": "83b0720457f0508c8b8f828304e63102b69e43f1f526dde57c0c0ddf99f1f364"
+    },
+    "gates/mixed-clippy-a578-1.inputs.json": {
+      "bytes": 100820,
+      "sha256": "91316ef1384a49e5a097684366abc73a16346fef2cfba6a9ed58d3832a270bde"
+    },
+    "gates/mixed-clippy-a578-1.log": {
+      "bytes": 166,
+      "sha256": "36f453dc344f791cfc5bdfa532df3520008887de673b01c76edac9233e18e913"
+    },
+    "gates/mixed-clippy-a578-1.result.json": {
+      "bytes": 1717,
+      "sha256": "c6f408b0963d8da7514ea87219e5a0b991c04d3ea9f9fe25f7b45752cb57e7a5"
+    },
+    "gates/mixed-clippy-eeb1-1.inputs.json": {
+      "bytes": 100820,
+      "sha256": "a0aabf861b1322cc2843edb8befe85f8eaecda5d4d95d625c0f9886ee0435e1b"
+    },
+    "gates/mixed-clippy-eeb1-1.log": {
+      "bytes": 1996,
+      "sha256": "ab9c0fc8baf8c56230b448f18b1de8dbf2d8e7c85a1f118aea369dea129f3f17"
+    },
+    "gates/mixed-clippy-eeb1-1.result.json": {
+      "bytes": 1720,
+      "sha256": "886eb86c99a261af00207864ba4717735910a092f3ec3352ff455a960de38881"
+    },
+    "gates/mixed-direct-full-a578-1.inputs.json": {
+      "bytes": 100820,
+      "sha256": "91316ef1384a49e5a097684366abc73a16346fef2cfba6a9ed58d3832a270bde"
+    },
+    "gates/mixed-direct-full-a578-1.log": {
+      "bytes": 33333,
+      "sha256": "3af2546378fd0cdd634dd63791d8b3475563c49c19d28aaea1e3a35a2474fbb6"
+    },
+    "gates/mixed-direct-full-a578-1.result.json": {
+      "bytes": 52372,
+      "sha256": "8ba1ef2dca98440b57280ebf0282257ace79a0f0ccfde23f7ad8e7e2c255a0ec"
+    },
+    "gates/mixed-direct-list-a578-1.inputs.json": {
+      "bytes": 100820,
+      "sha256": "91316ef1384a49e5a097684366abc73a16346fef2cfba6a9ed58d3832a270bde"
+    },
+    "gates/mixed-direct-list-a578-1.log": {
+      "bytes": 20334,
+      "sha256": "37551f95fc70a422e394712690bf19b69ad769890a9a07eac73bf9e0fa843242"
+    },
+    "gates/mixed-direct-list-a578-1.result.json": {
+      "bytes": 49871,
+      "sha256": "22db9a6a34d1e0800a71ec1ae88e1f18467d1c50a10a9ad305182d29cc11d904"
+    },
+    "gates/mixed-fmt-a578-1.inputs.json": {
+      "bytes": 100820,
+      "sha256": "91316ef1384a49e5a097684366abc73a16346fef2cfba6a9ed58d3832a270bde"
+    },
+    "gates/mixed-fmt-a578-1.log": {
+      "bytes": 7352,
+      "sha256": "62cafef008281d224d8176df5938084cf17c27b3d31cc80971fbc5594155d792"
+    },
+    "gates/mixed-fmt-a578-1.result.json": {
+      "bytes": 1631,
+      "sha256": "2648337aa67f6978b77e05479321a35ad782ebdad71b322efc62bb46e7180fe0"
+    },
+    "gates/mixed-fmt-eeb1-1.inputs.json": {
+      "bytes": 100820,
+      "sha256": "a0aabf861b1322cc2843edb8befe85f8eaecda5d4d95d625c0f9886ee0435e1b"
+    },
+    "gates/mixed-fmt-eeb1-1.log": {
+      "bytes": 7352,
+      "sha256": "62cafef008281d224d8176df5938084cf17c27b3d31cc80971fbc5594155d792"
+    },
+    "gates/mixed-fmt-eeb1-1.result.json": {
+      "bytes": 1631,
+      "sha256": "0ad50da9ef19f4129f593ffe37173c930b0b151cdd6ea00b1308aec12c973a5b"
+    },
+    "gates/mixed-focused-a578-1.inputs.json": {
+      "bytes": 100820,
+      "sha256": "91316ef1384a49e5a097684366abc73a16346fef2cfba6a9ed58d3832a270bde"
+    },
+    "gates/mixed-focused-a578-1.log": {
+      "bytes": 2911,
+      "sha256": "4acfc2bc654210441ab07b45fcfdb9a8496667f768962c1c51a5a06f73011c60"
+    },
+    "gates/mixed-focused-a578-1.result.json": {
+      "bytes": 2061,
+      "sha256": "fa586319f22c7eb1bd75e9d9da6784cff8cc897b6b93205c84f6591fa9c76b85"
+    },
+    "gates/mixed-focused-eeb1-1.inputs.json": {
+      "bytes": 100820,
+      "sha256": "a0aabf861b1322cc2843edb8befe85f8eaecda5d4d95d625c0f9886ee0435e1b"
+    },
+    "gates/mixed-focused-eeb1-1.log": {
+      "bytes": 2806,
+      "sha256": "1b7d6df5aaa0b0d9828cbbac9a77cb8ace0d8e2e3a8e44d58dcc5b254348628a"
+    },
+    "gates/mixed-focused-eeb1-1.result.json": {
+      "bytes": 2057,
+      "sha256": "2b55c0b63e9bb9f3c8a45b934833a799e811b66a7c1297d40ca1b6edb54b4d75"
+    },
+    "gates/mixed-full-eeb1-1.inputs.json": {
+      "bytes": 100820,
+      "sha256": "a0aabf861b1322cc2843edb8befe85f8eaecda5d4d95d625c0f9886ee0435e1b"
+    },
+    "gates/mixed-full-eeb1-1.log": {
+      "bytes": 33611,
+      "sha256": "ae9e4f3187d053d3ded9ec2475fc7dd469d5df976261fdc30479070e08cbc2b6"
+    },
+    "gates/mixed-full-eeb1-1.result.json": {
+      "bytes": 1981,
+      "sha256": "1f0b3e64142d8a774ad5e59c1d8e8f28c1a94717749b851d22044a41c2e01830"
+    },
+    "gates/mixed-list-754a-1.inputs.json": {
+      "bytes": 100820,
+      "sha256": "020a1ef53d3f30699b66358cb8688add682a33960b3e12721f50af5a9f57a3cb"
+    },
+    "gates/mixed-list-754a-1.log": {
+      "bytes": 473,
+      "sha256": "ff09dcad13a097b29fe80455f9f34b5df71d3dd1ada101dca3ee1a046ab33977"
+    },
+    "gates/mixed-list-754a-1.result.json": {
+      "bytes": 1694,
+      "sha256": "35c109d3f9e05aaae7933f0af955703a8affad45158d3e7de6bd23c35ea76cd8"
+    },
+    "gates/mixed-list-a578-1.inputs.json": {
+      "bytes": 100820,
+      "sha256": "91316ef1384a49e5a097684366abc73a16346fef2cfba6a9ed58d3832a270bde"
+    },
+    "gates/mixed-list-a578-1.log": {
+      "bytes": 20665,
+      "sha256": "7ad105fc530f3f13d5b108f8856d431cf5833209b9dc410428525368aa0fd063"
+    },
+    "gates/mixed-list-a578-1.result.json": {
+      "bytes": 22477,
+      "sha256": "5be7d8d867842e642c136fa0fe74ed5727013d959f5a13c7a8270c9ea1871e6e"
+    },
+    "gates/mixed-list-eeb1-1.inputs.json": {
+      "bytes": 100820,
+      "sha256": "a0aabf861b1322cc2843edb8befe85f8eaecda5d4d95d625c0f9886ee0435e1b"
+    },
+    "gates/mixed-list-eeb1-1.log": {
+      "bytes": 20665,
+      "sha256": "3e07d0c5a843b9a2bc74d4ce8f36976c49ea57b6a14d5a4dc1f334a7e6016bd5"
+    },
+    "gates/mixed-list-eeb1-1.result.json": {
+      "bytes": 22477,
+      "sha256": "d0f7afa28c1a7b976a1729c59c2f6c9c7a04a674658a39e04de09106698005f5"
+    },
+    "helpers/analysis-mixed-syntax-clippy-fix-proof-20260923.py": {
+      "bytes": 3937,
+      "sha256": "95c006b1a84f42400fdad439958c3852aa54dc69ec85aedd29d79cc8c089c803"
+    },
+    "helpers/formatting-proof.py": {
+      "bytes": 5518,
+      "sha256": "731d5c8c9993c81b789edc3c8ab9aa03e141b4334ace8a64c5d101e8315e03b4"
+    },
+    "notes/analysis-mixed-direct-evidence-review-20260923.md": {
+      "bytes": 6608,
+      "sha256": "02e0713681e3a196d91b9cfd170bcd5a54d0e78b7948e30439baf9d051c29d6c"
+    },
+    "notes/analysis-mixed-direct-gate-path-check-20260923.json": {
+      "bytes": 22970,
+      "sha256": "e3455ca847df1fd25e3c8dd4040e647155a917905f38b8b320f4fdfa17ff3d2d"
+    },
+    "notes/analysis-mixed-parser-proposal-20260923.md": {
+      "bytes": 18874,
+      "sha256": "8ad3005d960667267a10e9a73b92f8e151dd4e451cbbaed215bbad74e79677e0"
+    },
+    "notes/analysis-mixed-parser-proposal-review-20260923.md": {
+      "bytes": 10271,
+      "sha256": "d8763a22883cf5fdc6a39b2fb8965f5ac061df8553b7968d3f6f4aa0adc17539"
+    },
+    "notes/analysis-mixed-parser-review-20260923.md": {
+      "bytes": 10271,
+      "sha256": "d8763a22883cf5fdc6a39b2fb8965f5ac061df8553b7968d3f6f4aa0adc17539"
+    },
+    "notes/analysis-mixed-syntax-clippy-fix-handoff-20260923.md": {
+      "bytes": 2848,
+      "sha256": "903676efac11de735cd04b91965ec44bb50dc6fa464192cbb39fa53f4276caf2"
+    },
+    "notes/analysis-mixed-syntax-clippy-fix-proof-20260923.json": {
+      "bytes": 2016,
+      "sha256": "cd91d010d66fda68c247bf64ce3861aa2d85dc9b3a535da80d7743241aad4a9c"
+    },
+    "notes/analysis-mixed-syntax-clock-disposition-20260923.md": {
+      "bytes": 1636,
+      "sha256": "f560270339411c6265127095bd83115143c2f97eb257a20d5f0c64193345b3e2"
+    },
+    "notes/analysis-mixed-syntax-evidence-tools-independent-review-20260923.md": {
+      "bytes": 13228,
+      "sha256": "3f7f6dc2621b111c885550f8d2e519f3668ec8a0f48f917d69419485a3638de4"
+    },
+    "notes/analysis-mixed-syntax-followup-754a9b4-manifest-20260923.json": {
+      "bytes": 688,
+      "sha256": "87079e866306b6418b4a69052286b96f7a3f92d5567c12ebf86fdba5f5cfd607"
+    },
+    "notes/analysis-mixed-syntax-followup-handoff-20260923.md": {
+      "bytes": 3739,
+      "sha256": "cbde5e49a3cc7f3fa6a138680dd4a8efba77038b9489358ce98b0f1beb930218"
+    },
+    "notes/analysis-mixed-syntax-formatting-disposition-20260923.json": {
+      "bytes": 2864,
+      "sha256": "52775e006cbc27df7c6d865b8ef0bf1557d9347d52476b40a62f09eaa732473c"
+    },
+    "notes/analysis-mixed-syntax-formatting-disposition-20260923.md": {
+      "bytes": 2316,
+      "sha256": "430e4350c506944313825fbaff289260c08134f3ba6c7b88323e5071fa7ccbf1"
+    },
+    "notes/analysis-mixed-syntax-independent-review-20260923.md": {
+      "bytes": 15780,
+      "sha256": "057cf307bf914832565fb92a289ac102fdd68c666201af736d7c37557984e0d8"
+    },
+    "notes/analysis-mixed-syntax-source-0fc0826-manifest-20260923.json": {
+      "bytes": 3100,
+      "sha256": "788b0ea775dbbe4772358a488500885132bd41038ac8f278542ed45d0741e24d"
+    },
+    "notes/analysis-mixed-syntax-source-handoff-20260923.md": {
+      "bytes": 11880,
+      "sha256": "afa06df13a87a2be290623bf33d4643c9ec70a2e38886fb1b971e770db3239fe"
+    },
+    "prior/list-10d7f33.inputs.json": {
+      "bytes": 100256,
+      "sha256": "a8310981b743069f6e6abf0ef11857ec03c16562dc7e8264030c1d9d82517e46"
+    },
+    "prior/list-10d7f33.log": {
+      "bytes": 18213,
+      "sha256": "76b9e9ebc0c0d3d8794020dd222cfc94f7dd8cda9deedd0e74e0cd0c3aa5900c"
+    },
+    "prior/list-10d7f33.result.json": {
+      "bytes": 19385,
+      "sha256": "4baf130b68e2c044ad3e43d6e8a2e13c611008192a271d3dfa75ee5a7c1503c1"
+    }
+  },
+  "git_origins": {
+    "baseline/full-f1d79df.log": {
+      "commit": "257984c5dae63dae116a1438fb2a5d3138df8431",
+      "path": "harness/experiments/analysis-source-s2c-windows-20260913/raw/full-f1d79df.log"
+    },
+    "baseline/full-f1d79df.result.json": {
+      "commit": "257984c5dae63dae116a1438fb2a5d3138df8431",
+      "path": "harness/experiments/analysis-source-s2c-windows-20260913/raw/full-f1d79df.result.json"
+    },
+    "baseline/full-f1d79df.inputs.json": {
+      "commit": "257984c5dae63dae116a1438fb2a5d3138df8431",
+      "path": "harness/experiments/analysis-source-s2c-windows-20260913/raw/full-f1d79df.inputs.json"
+    },
+    "baseline/full-f1d79df.comparison.json": {
+      "commit": "257984c5dae63dae116a1438fb2a5d3138df8431",
+      "path": "harness/experiments/analysis-source-s2c-windows-20260913/raw/full-f1d79df.comparison.json"
+    },
+    "baseline/full-f1d79df-comparison.py": {
+      "commit": "257984c5dae63dae116a1438fb2a5d3138df8431",
+      "path": "harness/experiments/analysis-source-s2c-windows-20260913/raw/full-f1d79df-comparison.py"
+    },
+    "prior/list-10d7f33.log": {
+      "commit": "aecee2aff3f4410648a501a70cb2e6160c81adc5",
+      "path": "harness/experiments/analysis-original-span-20260923/evidence.zip",
+      "member": "list-10d7f33.log"
+    },
+    "prior/list-10d7f33.result.json": {
+      "commit": "aecee2aff3f4410648a501a70cb2e6160c81adc5",
+      "path": "harness/experiments/analysis-original-span-20260923/evidence.zip",
+      "member": "list-10d7f33.result.json"
+    },
+    "prior/list-10d7f33.inputs.json": {
+      "commit": "aecee2aff3f4410648a501a70cb2e6160c81adc5",
+      "path": "harness/experiments/analysis-original-span-20260923/evidence.zip",
+      "member": "list-10d7f33.inputs.json"
+    },
+    "notes/analysis-mixed-parser-proposal-20260923.md": {
+      "commit": "aecee2aff3f4410648a501a70cb2e6160c81adc5",
+      "path": "harness/analysis-mixed-parser-proposal-20260923.md"
+    },
+    "notes/analysis-mixed-parser-review-20260923.md": {
+      "commit": "aecee2aff3f4410648a501a70cb2e6160c81adc5",
+      "path": "harness/analysis-mixed-parser-review-20260923.md"
+    }
+  },
+  "verified_summary": {
+    "source": "a578ac98a06772a60bec00ae287e65650680d119",
+    "full_suite": "FAILED",
+    "full_exit": 101,
+    "listed": 194,
+    "prior_173_retained": 173,
+    "typed_passed_in_full": 85,
+    "mixed_focused_passed": 20,
+    "full_passed": 178,
+    "full_failed": 16,
+    "old_152_statuses_unchanged": 152,
+    "new_42_passes": [
+      "language::analysis_source::index::tests::arena_rejects_duplicate_sites_occurrences_and_wrong_callee_labels",
+      "language::analysis_source::index::tests::arena_rejects_forward_cycles_and_cross_owner_field_file_parents",
+      "language::analysis_source::index::tests::deep_parse_index_plan_and_failed_build_cleanup_on_128k_stack",
+      "language::analysis_source::index::tests::index_checks_every_expression_edge_and_keeps_override_fields_distinct",
+      "language::analysis_source::index::tests::index_has_shared_budget_and_never_stabilizes_missing_ids",
+      "language::analysis_source::index::tests::index_rejects_comment_partial_and_non_utf8_occurrence_spans",
+      "language::analysis_source::index::tests::maximum_index_paths_compare_lookup_debug_and_drop_on_128k_stack",
+      "language::analysis_source::index::tests::repeated_reordered_calls_have_stable_full_paths_and_four_labels",
+      "language::analysis_source::index::tests::staged_index_preserves_complete_oa_sa_models_and_original_file_spans",
+      "language::analysis_source::mixed::tests::all_short_typed_roots_share_original_buffers_without_public_activation",
+      "language::analysis_source::mixed::tests::caller_declaration_counts_are_aggregate_and_checked_before_typed_header_allocation",
+      "language::analysis_source::mixed::tests::diamond_includes_return_one_canonical_file_table_and_scan_dependency_once",
+      "language::analysis_source::mixed::tests::duplicate_ordinary_ids_keep_occurrences_and_scoped_parameter_ids_remain_distinct",
+      "language::analysis_source::mixed::tests::every_identity_class_requires_authored_ids_without_mutating_the_bundle",
+      "language::analysis_source::mixed::tests::exact_shared_profile_limits_include_nonlatching_metadata_phase_failures",
+      "language::analysis_source::mixed::tests::exact_work_and_reference_occurrences_accumulate_across_files",
+      "language::analysis_source::mixed::tests::interleaved_unicode_crlf_has_original_typed_and_ordinary_coordinates",
+      "language::analysis_source::mixed::tests::mixed_deep_typed_success_and_rejection_cleanup_on_128k_stack",
+      "language::analysis_source::mixed::tests::mixed_typed_reference_limit_is_inherited_without_charging_ordinary_parent_refs",
+      "language::analysis_source::mixed::tests::ordinary_model_records_and_parent_reference_are_not_syntax_or_step_limits",
+      "language::analysis_source::mixed::tests::ordinary_numeric_adjacency_and_malformed_trivia_match_legacy_refusals",
+      "language::analysis_source::mixed::tests::ordinary_signed_numbers_keep_complete_nested_value_and_field_ends",
+      "language::analysis_source::mixed::tests::ordinary_value_depth_boundary_remains_64_in_both_parser_views",
+      "language::analysis_source::mixed::tests::private_aggregate_preflights_run_before_traversal_path_allocation",
+      "language::analysis_source::mixed::tests::syntax_entries_accumulate_across_both_ordinary_and_typed_producer_orders",
+      "language::analysis_source::mixed::tests::typed_numeric_work_remains_in_the_same_inherited_profile",
+      "language::analysis_source::mixed::tests::typed_words_are_contextual_but_typed_headers_cannot_nest_in_ordinary_bodies",
+      "language::analysis_source::mixed::tests::whole_bundle_rejects_missing_unreachable_cyclic_and_noncanonical_files",
+      "language::analysis_source::mixed::tests::witness_retains_exact_caller_policy_separately_from_syntax_storage",
+      "language::analysis_source::tests::every_parent_shape_rejects_depth129_and_cleans_children_on_128k_stack",
+      "language::analysis_source::update::tests::alias_edits_preserve_unit_type_override_tokens_and_unrelated_authored_bytes",
+      "language::analysis_source::update::tests::composition_checks_edit_record_ceiling_before_duplicate_membership",
+      "language::analysis_source::update::tests::composition_defers_only_typed_output_size_with_independent_shrink_arithmetic",
+      "language::analysis_source::update::tests::composition_exports_complete_borrowed_swap_witnesses_and_empty_noops",
+      "language::analysis_source::update::tests::composition_keeps_name_storage_and_rename_record_limits_before_allocation",
+      "language::analysis_source::update::tests::composition_rejects_stale_or_damaged_complete_batches_before_export",
+      "language::analysis_source::update::tests::output_and_plan_limits_are_aggregate_and_do_not_reset_parse_work",
+      "language::analysis_source::update::tests::rename_rejects_unknown_invalid_and_colliding_final_names_but_allows_noop",
+      "language::analysis_source::update::tests::simultaneous_global_and_scoped_swaps_match_original_token_and_whole_model_oracles",
+      "language::analysis_source::update::tests::stale_file_sets_bytes_forged_spans_and_duplicate_edits_fail_before_output",
+      "language::analysis_source::update::tests::standalone_noop_apply_keeps_tighter_file_only_budget_and_output_boundary",
+      "source_project::traversal::tests::ordinary_compile_once_keeps_include_order_and_cycle_source_location"
+    ],
+    "known_failure_names": [
+      "language::nesting_tests::checked_in_example_supports_cross_file_reparent_without_changing_allocations",
+      "language::nesting_tests::checked_in_nested_example_has_stable_ids_typed_exchanges_and_three_clear_views",
+      "language::nesting_tests::nested_elements_infer_only_parent_and_keep_typed_fields_and_allocations_explicit",
+      "language::nesting_tests::nested_fragment_id_stabilization_preserves_comments_and_indexes_real_bytes",
+      "language::nesting_tests::non_elements_includes_and_declarations_inside_typed_values_are_rejected",
+      "language::nesting_tests::normative_nested_ownership_example_compiles_as_a_source_fragment",
+      "source_files::transaction_tests::interrupted_publication_without_write_marker_never_rolls_back_external_matching_bytes",
+      "source_files::transaction_tests::interrupted_save_and_interrupted_recovery_can_both_be_resumed",
+      "source_files::transaction_tests::malformed_v2_write_marker_refuses_recovery_without_changing_source_bytes",
+      "source_files::transaction_tests::partial_save_failures_restore_every_original_and_write_entry_last",
+      "source_files::transaction_tests::recovery_before_any_write_accepts_v2_marker_and_keeps_v1_rollback_compatibility",
+      "source_files::transaction_tests::recovery_rechecks_external_changes_between_restorations",
+      "source_files::transaction_tests::recovery_rejects_untrusted_escape_paths_before_touching_files",
+      "source_files::transaction_tests::rollback_refuses_external_edits_even_in_an_unchanged_dependency",
+      "source_files::transaction_tests::rollback_removes_only_our_new_file_and_retains_detached_files",
+      "source_files::transaction_tests::unwritten_journal_never_rolls_back_a_completed_writer_with_identical_after_bytes"
+    ],
+    "new_since_173": [
+      "language::analysis_source::mixed::tests::all_short_typed_roots_share_original_buffers_without_public_activation",
+      "language::analysis_source::mixed::tests::caller_declaration_counts_are_aggregate_and_checked_before_typed_header_allocation",
+      "language::analysis_source::mixed::tests::diamond_includes_return_one_canonical_file_table_and_scan_dependency_once",
+      "language::analysis_source::mixed::tests::duplicate_ordinary_ids_keep_occurrences_and_scoped_parameter_ids_remain_distinct",
+      "language::analysis_source::mixed::tests::every_identity_class_requires_authored_ids_without_mutating_the_bundle",
+      "language::analysis_source::mixed::tests::exact_shared_profile_limits_include_nonlatching_metadata_phase_failures",
+      "language::analysis_source::mixed::tests::exact_work_and_reference_occurrences_accumulate_across_files",
+      "language::analysis_source::mixed::tests::interleaved_unicode_crlf_has_original_typed_and_ordinary_coordinates",
+      "language::analysis_source::mixed::tests::mixed_deep_typed_success_and_rejection_cleanup_on_128k_stack",
+      "language::analysis_source::mixed::tests::mixed_typed_reference_limit_is_inherited_without_charging_ordinary_parent_refs",
+      "language::analysis_source::mixed::tests::ordinary_model_records_and_parent_reference_are_not_syntax_or_step_limits",
+      "language::analysis_source::mixed::tests::ordinary_numeric_adjacency_and_malformed_trivia_match_legacy_refusals",
+      "language::analysis_source::mixed::tests::ordinary_signed_numbers_keep_complete_nested_value_and_field_ends",
+      "language::analysis_source::mixed::tests::ordinary_value_depth_boundary_remains_64_in_both_parser_views",
+      "language::analysis_source::mixed::tests::private_aggregate_preflights_run_before_traversal_path_allocation",
+      "language::analysis_source::mixed::tests::syntax_entries_accumulate_across_both_ordinary_and_typed_producer_orders",
+      "language::analysis_source::mixed::tests::typed_numeric_work_remains_in_the_same_inherited_profile",
+      "language::analysis_source::mixed::tests::typed_words_are_contextual_but_typed_headers_cannot_nest_in_ordinary_bodies",
+      "language::analysis_source::mixed::tests::whole_bundle_rejects_missing_unreachable_cyclic_and_noncanonical_files",
+      "language::analysis_source::mixed::tests::witness_retains_exact_caller_policy_separately_from_syntax_storage",
+      "source_project::traversal::tests::ordinary_compile_once_keeps_include_order_and_cycle_source_location"
+    ],
+    "test_artifact": {
+      "path": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-checked-save-target-20260913\\debug\\deps\\oa_core-416e35542925bed6.exe",
+      "bytes": 39706624,
+      "sha256": "089d7b0389bb3f4e98fd350d4d7504294087ce3fc84035672c781547c8a71881"
+    },
+    "strict_core_all_targets": "PASS",
+    "strict_exit": 0,
+    "fmt_exit": 1,
+    "full_invocation": "direct-executable",
+    "listing_artifacts": [
+      {
+        "invocation": "direct-executable",
+        "artifacts": [
+          {
+            "path": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-checked-save-target-20260913\\debug\\deps\\oa_core-416e35542925bed6.exe",
+            "bytes": 39706624,
+            "sha256": "089d7b0389bb3f4e98fd350d4d7504294087ce3fc84035672c781547c8a71881"
+          }
+        ]
+      },
+      {
+        "invocation": "cargo",
+        "artifacts": [
+          {
+            "path": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-checked-save-target-20260913\\debug\\deps\\oa_core-416e35542925bed6.exe",
+            "bytes": 39706624,
+            "sha256": "ae4974da9a58c487e1fe1a4d1461743b106fb7495f3c5a84a20a8999cc9a7ce2"
+          }
+        ]
+      }
+    ],
+    "intermediate_checkpoint": {
+      "source": "eeb1069cfcfc51e4cf73cff850adc2fabc8aae77",
+      "full_suite": "FAILED",
+      "full_exit": 101,
+      "listed": 194,
+      "prior_173_retained": 173,
+      "typed_passed_in_full": 85,
+      "mixed_focused_passed": 20,
+      "full_passed": 178,
+      "full_failed": 16,
+      "old_152_statuses_unchanged": 152,
+      "new_42_passes": [
+        "language::analysis_source::index::tests::arena_rejects_duplicate_sites_occurrences_and_wrong_callee_labels",
+        "language::analysis_source::index::tests::arena_rejects_forward_cycles_and_cross_owner_field_file_parents",
+        "language::analysis_source::index::tests::deep_parse_index_plan_and_failed_build_cleanup_on_128k_stack",
+        "language::analysis_source::index::tests::index_checks_every_expression_edge_and_keeps_override_fields_distinct",
+        "language::analysis_source::index::tests::index_has_shared_budget_and_never_stabilizes_missing_ids",
+        "language::analysis_source::index::tests::index_rejects_comment_partial_and_non_utf8_occurrence_spans",
+        "language::analysis_source::index::tests::maximum_index_paths_compare_lookup_debug_and_drop_on_128k_stack",
+        "language::analysis_source::index::tests::repeated_reordered_calls_have_stable_full_paths_and_four_labels",
+        "language::analysis_source::index::tests::staged_index_preserves_complete_oa_sa_models_and_original_file_spans",
+        "language::analysis_source::mixed::tests::all_short_typed_roots_share_original_buffers_without_public_activation",
+        "language::analysis_source::mixed::tests::caller_declaration_counts_are_aggregate_and_checked_before_typed_header_allocation",
+        "language::analysis_source::mixed::tests::diamond_includes_return_one_canonical_file_table_and_scan_dependency_once",
+        "language::analysis_source::mixed::tests::duplicate_ordinary_ids_keep_occurrences_and_scoped_parameter_ids_remain_distinct",
+        "language::analysis_source::mixed::tests::every_identity_class_requires_authored_ids_without_mutating_the_bundle",
+        "language::analysis_source::mixed::tests::exact_shared_profile_limits_include_nonlatching_metadata_phase_failures",
+        "language::analysis_source::mixed::tests::exact_work_and_reference_occurrences_accumulate_across_files",
+        "language::analysis_source::mixed::tests::interleaved_unicode_crlf_has_original_typed_and_ordinary_coordinates",
+        "language::analysis_source::mixed::tests::mixed_deep_typed_success_and_rejection_cleanup_on_128k_stack",
+        "language::analysis_source::mixed::tests::mixed_typed_reference_limit_is_inherited_without_charging_ordinary_parent_refs",
+        "language::analysis_source::mixed::tests::ordinary_model_records_and_parent_reference_are_not_syntax_or_step_limits",
+        "language::analysis_source::mixed::tests::ordinary_numeric_adjacency_and_malformed_trivia_match_legacy_refusals",
+        "language::analysis_source::mixed::tests::ordinary_signed_numbers_keep_complete_nested_value_and_field_ends",
+        "language::analysis_source::mixed::tests::ordinary_value_depth_boundary_remains_64_in_both_parser_views",
+        "language::analysis_source::mixed::tests::private_aggregate_preflights_run_before_traversal_path_allocation",
+        "language::analysis_source::mixed::tests::syntax_entries_accumulate_across_both_ordinary_and_typed_producer_orders",
+        "language::analysis_source::mixed::tests::typed_numeric_work_remains_in_the_same_inherited_profile",
+        "language::analysis_source::mixed::tests::typed_words_are_contextual_but_typed_headers_cannot_nest_in_ordinary_bodies",
+        "language::analysis_source::mixed::tests::whole_bundle_rejects_missing_unreachable_cyclic_and_noncanonical_files",
+        "language::analysis_source::mixed::tests::witness_retains_exact_caller_policy_separately_from_syntax_storage",
+        "language::analysis_source::tests::every_parent_shape_rejects_depth129_and_cleans_children_on_128k_stack",
+        "language::analysis_source::update::tests::alias_edits_preserve_unit_type_override_tokens_and_unrelated_authored_bytes",
+        "language::analysis_source::update::tests::composition_checks_edit_record_ceiling_before_duplicate_membership",
+        "language::analysis_source::update::tests::composition_defers_only_typed_output_size_with_independent_shrink_arithmetic",
+        "language::analysis_source::update::tests::composition_exports_complete_borrowed_swap_witnesses_and_empty_noops",
+        "language::analysis_source::update::tests::composition_keeps_name_storage_and_rename_record_limits_before_allocation",
+        "language::analysis_source::update::tests::composition_rejects_stale_or_damaged_complete_batches_before_export",
+        "language::analysis_source::update::tests::output_and_plan_limits_are_aggregate_and_do_not_reset_parse_work",
+        "language::analysis_source::update::tests::rename_rejects_unknown_invalid_and_colliding_final_names_but_allows_noop",
+        "language::analysis_source::update::tests::simultaneous_global_and_scoped_swaps_match_original_token_and_whole_model_oracles",
+        "language::analysis_source::update::tests::stale_file_sets_bytes_forged_spans_and_duplicate_edits_fail_before_output",
+        "language::analysis_source::update::tests::standalone_noop_apply_keeps_tighter_file_only_budget_and_output_boundary",
+        "source_project::traversal::tests::ordinary_compile_once_keeps_include_order_and_cycle_source_location"
+      ],
+      "known_failure_names": [
+        "language::nesting_tests::checked_in_example_supports_cross_file_reparent_without_changing_allocations",
+        "language::nesting_tests::checked_in_nested_example_has_stable_ids_typed_exchanges_and_three_clear_views",
+        "language::nesting_tests::nested_elements_infer_only_parent_and_keep_typed_fields_and_allocations_explicit",
+        "language::nesting_tests::nested_fragment_id_stabilization_preserves_comments_and_indexes_real_bytes",
+        "language::nesting_tests::non_elements_includes_and_declarations_inside_typed_values_are_rejected",
+        "language::nesting_tests::normative_nested_ownership_example_compiles_as_a_source_fragment",
+        "source_files::transaction_tests::interrupted_publication_without_write_marker_never_rolls_back_external_matching_bytes",
+        "source_files::transaction_tests::interrupted_save_and_interrupted_recovery_can_both_be_resumed",
+        "source_files::transaction_tests::malformed_v2_write_marker_refuses_recovery_without_changing_source_bytes",
+        "source_files::transaction_tests::partial_save_failures_restore_every_original_and_write_entry_last",
+        "source_files::transaction_tests::recovery_before_any_write_accepts_v2_marker_and_keeps_v1_rollback_compatibility",
+        "source_files::transaction_tests::recovery_rechecks_external_changes_between_restorations",
+        "source_files::transaction_tests::recovery_rejects_untrusted_escape_paths_before_touching_files",
+        "source_files::transaction_tests::rollback_refuses_external_edits_even_in_an_unchanged_dependency",
+        "source_files::transaction_tests::rollback_removes_only_our_new_file_and_retains_detached_files",
+        "source_files::transaction_tests::unwritten_journal_never_rolls_back_a_completed_writer_with_identical_after_bytes"
+      ],
+      "new_since_173": [
+        "language::analysis_source::mixed::tests::all_short_typed_roots_share_original_buffers_without_public_activation",
+        "language::analysis_source::mixed::tests::caller_declaration_counts_are_aggregate_and_checked_before_typed_header_allocation",
+        "language::analysis_source::mixed::tests::diamond_includes_return_one_canonical_file_table_and_scan_dependency_once",
+        "language::analysis_source::mixed::tests::duplicate_ordinary_ids_keep_occurrences_and_scoped_parameter_ids_remain_distinct",
+        "language::analysis_source::mixed::tests::every_identity_class_requires_authored_ids_without_mutating_the_bundle",
+        "language::analysis_source::mixed::tests::exact_shared_profile_limits_include_nonlatching_metadata_phase_failures",
+        "language::analysis_source::mixed::tests::exact_work_and_reference_occurrences_accumulate_across_files",
+        "language::analysis_source::mixed::tests::interleaved_unicode_crlf_has_original_typed_and_ordinary_coordinates",
+        "language::analysis_source::mixed::tests::mixed_deep_typed_success_and_rejection_cleanup_on_128k_stack",
+        "language::analysis_source::mixed::tests::mixed_typed_reference_limit_is_inherited_without_charging_ordinary_parent_refs",
+        "language::analysis_source::mixed::tests::ordinary_model_records_and_parent_reference_are_not_syntax_or_step_limits",
+        "language::analysis_source::mixed::tests::ordinary_numeric_adjacency_and_malformed_trivia_match_legacy_refusals",
+        "language::analysis_source::mixed::tests::ordinary_signed_numbers_keep_complete_nested_value_and_field_ends",
+        "language::analysis_source::mixed::tests::ordinary_value_depth_boundary_remains_64_in_both_parser_views",
+        "language::analysis_source::mixed::tests::private_aggregate_preflights_run_before_traversal_path_allocation",
+        "language::analysis_source::mixed::tests::syntax_entries_accumulate_across_both_ordinary_and_typed_producer_orders",
+        "language::analysis_source::mixed::tests::typed_numeric_work_remains_in_the_same_inherited_profile",
+        "language::analysis_source::mixed::tests::typed_words_are_contextual_but_typed_headers_cannot_nest_in_ordinary_bodies",
+        "language::analysis_source::mixed::tests::whole_bundle_rejects_missing_unreachable_cyclic_and_noncanonical_files",
+        "language::analysis_source::mixed::tests::witness_retains_exact_caller_policy_separately_from_syntax_storage",
+        "source_project::traversal::tests::ordinary_compile_once_keeps_include_order_and_cycle_source_location"
+      ],
+      "test_artifact": {
+        "path": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-checked-save-target-20260913\\debug\\deps\\oa_core-416e35542925bed6.exe",
+        "bytes": 39708672,
+        "sha256": "5482a24e86d6f102c34dec6be9904726488963e8552e514253efbf03dfbcd98c"
+      },
+      "strict_core_all_targets": "FAILED",
+      "strict_exit": 101,
+      "fmt_exit": 1,
+      "full_invocation": "cargo",
+      "listing_artifacts": [
+        {
+          "invocation": "cargo",
+          "artifacts": [
+            {
+              "path": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-checked-save-target-20260913\\debug\\deps\\oa_core-416e35542925bed6.exe",
+              "bytes": 39708672,
+              "sha256": "5482a24e86d6f102c34dec6be9904726488963e8552e514253efbf03dfbcd98c"
+            }
+          ]
+        }
+      ]
+    },
+    "formatting_disposition": "Formatting FAILED at eeb1069; six affected blobs byte-identical at a578ac9, eeb1069, 10d7f33 and f1d79df; final fmt also FAILED exit 1 with identical nine blocks",
+    "unchanged_inputs_from_intermediate": 540,
+    "clock_discontinuity": "Raw final listing UTC end precedes start after host clock moved backward; exact immutable receipt retained; elapsed_monotonic_seconds=768.4220000000059 is the duration evidence. No wall-clock duration inferred.",
+    "limits": "Receipt/Git consistency only; no archived code or binaries executed. No public source8, semantic/compositor or full-suite PASS claim."
+  }
+}

harness/experiments/analysis-mixed-syntax-20260923/controls/cases/changed-clock-receipt/stderr.log

@@ -0,0 +1 @@
+REFUSED: Direct historical binding differs

harness/experiments/analysis-mixed-syntax-20260923/controls/cases/changed-final-formatting-location/control-result.json

@@ -0,0 +1,38 @@
+{
+  "case": "changed-final-formatting-location",
+  "expected_accept": false,
+  "observed_accept": false,
+  "exit": 1,
+  "elapsed_monotonic_seconds": 11.76600000000326,
+  "expected_refusal_fragment": "Final formatting failure scope changed",
+  "actual_refusal": "REFUSED: Final formatting failure scope changed",
+  "matched": true,
+  "detail": "",
+  "command": [
+    "C:\\Users\\User\\.cache\\codex-runtimes\\codex-primary-runtime\\dependencies\\python\\python.exe",
+    "-B",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-syntax-evidence-tools-20260923\\verify.py",
+    "--repo",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio",
+    "--package",
+    "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-mixed-syntax-package-negative-controls-successor-20260923\\changed-final-formatting-location"
+  ],
+  "files": {
+    "evidence.zip": {
+      "bytes": 567818,
+      "sha256": "de663fd532e194d70c8fdab55d84f3d994b04aef0d122b8815cd376b1b287409"
+    },
+    "manifest.json": {
+      "bytes": 35265,
+      "sha256": "6fdc0d9de10a2802db31a208331cf6ea3453949e9ddae92841a332e30cf6057f"
+    },
+    "stderr.log": {
+      "bytes": 49,
+      "sha256": "35e6a10b94245910d4bd99b1f477a6bf655ed9e482b9ecf57ebee6c4f746eab8"
+    },
+    "stdout.log": {
+      "bytes": 0,
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    }
+  }
+}