test(core): preserve standalone no-op budget boundary

crates/oa-core/src/language/analysis_source/update.rs

@@ -25,6 +25,17 @@ impl<'i, 's> Plan<'i, 's> {
         renames: &BTreeMap<Target, String>,
         budget: &Budget,
     ) -> Result<Self, Error> {
+        let plan = Self::prepare(index, renames, budget)?;
+        plan.validate(index.sources(), budget)?;
+        plan.output_lengths(index.sources(), budget)?;
+        Ok(plan)
+    }
+
+    fn validate_names(
+        index: &Index<'_>,
+        renames: &BTreeMap<Target, String>,
+        budget: &Budget,
+    ) -> Result<(), Error> {
         budget.active()?;
         budget.lowering_entries(renames.len(), Span::default())?;
         let mut bytes = 0usize;
@@ -61,6 +72,16 @@ impl<'i, 's> Plan<'i, 's> {
                 ));
             }
         }
+        Ok(())
+    }
+
+    fn prepare(
+        index: &'i Index<'s>,
+        renames: &BTreeMap<Target, String>,
+        budget: &Budget,
+    ) -> Result<Self, Error> {
+        // Validate record/name storage before copying any owned final names.
+        Self::validate_names(index, renames, budget)?;
         let mut edits = Vec::new();
         for (key, location) in index.occurrences() {
             if renames
@@ -81,26 +102,20 @@ impl<'i, 's> Plan<'i, 's> {
                 edit.location.span.end,
             )
         });
-        let plan = Self {
+        Ok(Self {
             index,
             names: renames.clone(),
             edits,
-        };
-        plan.validate(index.sources(), budget)?;
-        Ok(plan)
+        })
     }
 
     pub fn edit_count(&self) -> usize {
         self.edits.len()
     }
 
-    /// Recheck all files, all edit ownership and all final sizes before any
-    /// output String is allocated. A changed unrelated file is stale too.
-    fn validate(
-        &self,
-        current: &BTreeMap<usize, String>,
-        budget: &Budget,
-    ) -> Result<BTreeMap<usize, usize>, Error> {
+    /// Recheck the complete original witness and complete rename intent.
+    /// A changed unrelated file is stale too. This does not construct output.
+    fn validate(&self, current: &BTreeMap<usize, String>, budget: &Budget) -> Result<(), Error> {
         budget.active()?;
         if current != self.index.sources() {
             return Err(error(
@@ -110,10 +125,6 @@ impl<'i, 's> Plan<'i, 's> {
         }
         budget.lowering_entries(current.len(), Span::default())?;
         budget.lowering_occurrences(self.edits.len(), Span::default())?;
-        let mut lengths: BTreeMap<_, _> = current
-            .iter()
-            .map(|(&file, source)| (file, source.len()))
-            .collect();
         let mut previous: Option<Location> = None;
         let mut seen = BTreeSet::new();
         for edit in &self.edits {
@@ -130,8 +141,7 @@ impl<'i, 's> Plan<'i, 's> {
             {
                 return Err(error(at.span, "Stale original token spelling."));
             }
-            let replacement = self
-                .names
+            self.names
                 .get(&edit.key.target)
                 .ok_or_else(|| error(at.span, "Edit has no final target name."))?;
             if previous.is_some_and(|prior| {
@@ -140,13 +150,6 @@ impl<'i, 's> Plan<'i, 's> {
                 return Err(error(at.span, "Overlapping or unordered source edits."));
             }
             previous = Some(at);
-            let length = lengths
-                .get_mut(&at.file)
-                .ok_or_else(|| error(at.span, "Unknown edit file."))?;
-            *length = length
-                .checked_sub(old.len())
-                .and_then(|size| size.checked_add(replacement.len()))
-                .ok_or_else(|| error(at.span, "Updated source size overflow."))?;
         }
         for (key, at) in self.index.occurrences() {
             let required = self
@@ -160,6 +163,28 @@ impl<'i, 's> Plan<'i, 's> {
                 ));
             }
         }
+        Ok(())
+    }
+
+    /// Standalone output preflight, after ownership validation. Composition
+    /// defers this hypothetical typed-only size to its future combined emitter.
+    fn output_lengths(
+        &self,
+        current: &BTreeMap<usize, String>,
+        budget: &Budget,
+    ) -> Result<BTreeMap<usize, usize>, Error> {
+        let mut lengths: BTreeMap<_, _> = current
+            .iter()
+            .map(|(&file, source)| (file, source.len()))
+            .collect();
+        for edit in &self.edits {
+            let at = edit.location;
+            let length = lengths.get_mut(&at.file).expect("validated edit file");
+            *length = length
+                .checked_sub(at.span.end - at.span.start)
+                .and_then(|size| size.checked_add(self.names[&edit.key.target].len()))
+                .ok_or_else(|| error(at.span, "Updated source size overflow."))?;
+        }
         let mut total = 0usize;
         for length in lengths.values() {
             total = total
@@ -175,7 +200,8 @@ impl<'i, 's> Plan<'i, 's> {
         current: &BTreeMap<usize, String>,
         budget: &Budget,
     ) -> Result<BTreeMap<usize, String>, Error> {
-        let lengths = self.validate(current, budget)?;
+        self.validate(current, budget)?;
+        let lengths = self.output_lengths(current, budget)?;
         let mut result = BTreeMap::new();
         let mut edits = self.edits.iter().peekable();
         for (&file, source) in current {
@@ -194,5 +220,97 @@ impl<'i, 's> Plan<'i, 's> {
     }
 }
 
+/// Private typed-only composition planning. The caller must supply its inherited
+/// parse Budget; this type keeps that same immutable budget through export.
+/// It does not establish the future complete bundle/file-table/parse-session
+/// witness. In particular, an Index currently does not store its parse profile.
+pub(super) struct Composition<'b, 'i, 's> {
+    plan: Plan<'i, 's>,
+    budget: &'b Budget,
+}
+impl std::fmt::Debug for Composition<'_, '_, '_> {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("Composition")
+            .field("plan", &self.plan)
+            .finish_non_exhaustive()
+    }
+}
+impl<'b, 'i, 's> Composition<'b, 'i, 's> {
+    pub fn renames(
+        index: &'i Index<'s>,
+        renames: &BTreeMap<Target, String>,
+        inherited: &'b Budget,
+    ) -> Result<Self, Error> {
+        let plan = Plan::prepare(index, renames, inherited)?;
+        plan.validate(index.sources(), inherited)?;
+        Ok(Self {
+            plan,
+            budget: inherited,
+        })
+    }
+
+    /// Export the entire validated plan against exact original numeric file keys
+    /// and bytes. There is no output allocation, application or subset-accept API.
+    /// A future collector must check this actual index witness and the complete
+    /// combined output bounds before applying either producer's edits once.
+    pub fn original_edits(
+        &self,
+        current: &BTreeMap<usize, String>,
+    ) -> Result<OriginalEdits<'_, 'i, 's>, Error> {
+        Plan::validate_names(self.plan.index, &self.plan.names, self.budget)?;
+        self.plan.validate(current, self.budget)?;
+        Ok(OriginalEdits { plan: &self.plan })
+    }
+}
+
+#[derive(Debug)]
+pub(super) struct OriginalEdits<'p, 'i, 's> {
+    plan: &'p Plan<'i, 's>,
+}
+impl<'s> OriginalEdits<'_, '_, 's> {
+    pub fn index(&self) -> &Index<'s> {
+        self.plan.index
+    }
+    pub fn len(&self) -> usize {
+        self.plan.edits.len()
+    }
+    pub fn is_empty(&self) -> bool {
+        self.plan.edits.is_empty()
+    }
+    pub fn iter(&self) -> impl ExactSizeIterator<Item = OriginalEdit<'_>> {
+        self.plan.edits.iter().map(|edit| OriginalEdit {
+            key: &edit.key,
+            location: edit.location,
+            original: &self.plan.index.sources()[&edit.location.file]
+                [edit.location.span.start..edit.location.span.end],
+            replacement: &self.plan.names[&edit.key.target],
+        })
+    }
+}
+
+/// A borrowed inspection record, never independent edit authority. Only an
+/// intact OriginalEdits batch can carry this producer's complete rename intent.
+#[derive(Debug)]
+pub(super) struct OriginalEdit<'p> {
+    key: &'p OccurrenceKey,
+    location: Location,
+    original: &'p str,
+    replacement: &'p str,
+}
+impl OriginalEdit<'_> {
+    pub fn key(&self) -> &OccurrenceKey {
+        self.key
+    }
+    pub fn location(&self) -> Location {
+        self.location
+    }
+    pub fn original(&self) -> &str {
+        self.original
+    }
+    pub fn replacement(&self) -> &str {
+        self.replacement
+    }
+}
+
 #[cfg(test)]
 mod tests;

crates/oa-core/src/language/analysis_source/update/tests.rs

@@ -322,3 +322,423 @@ fn output_and_plan_limits_are_aggregate_and_do_not_reset_parse_work() {
     limits.entries = 0;
     assert!(Plan::renames(&index, &rename_map(), &Budget::new(limits).unwrap()).is_err());
 }
+
+#[test]
+fn composition_exports_complete_borrowed_swap_witnesses_and_empty_noops() {
+    use super::super::index::TokenRole;
+    use super::super::lower::{Child, Field, Role};
+    type Key = (Id, Option<Field>, Option<Vec<Child>>, TokenRole, Target);
+    type Row = (Location, String, String, Key);
+
+    let sources = sources();
+    let mut work = budget();
+    let (index, _) = Index::parse(&skeleton(), &sources, &mut work).unwrap();
+    let usage = work.usage;
+    let numeric = work.numeric_units();
+    let composition = Composition::renames(&index, &rename_map(), &work).unwrap();
+    assert!(std::ptr::eq(composition.budget, &work));
+    // A byte-identical snapshot is valid; records still borrow the actual index.
+    let batch = composition.original_edits(&sources.clone()).unwrap();
+    assert!(std::ptr::eq(batch.index(), &index));
+    assert_eq!(batch.len(), 13);
+    assert!(!batch.is_empty());
+    assert_eq!(batch.iter().len(), 13);
+
+    // Independently authored occurrence identities and full source contexts.
+    // No index offset/path or generated output defines this oracle.
+    let mut expected: Vec<Row> = Vec::new();
+    let mut add = |file, context: &str, prefix: &str, old: &str, new: &str, key: Key| {
+        let start = sources[&file].find(context).unwrap() + prefix.len();
+        assert_eq!(&sources[&file][start..start + old.len()], old);
+        expected.push((
+            Location {
+                file,
+                span: Span {
+                    start,
+                    end: start + old.len(),
+                },
+            },
+            old.into(),
+            new.into(),
+            key,
+        ));
+    };
+    for (id, old, new, context) in [
+        (0x100, "f", "g", "calculation f "),
+        (0x200, "g", "f", "calculation g "),
+    ] {
+        add(
+            11,
+            context,
+            "calculation ",
+            old,
+            new,
+            (
+                Id::from_u128(id),
+                None,
+                None,
+                TokenRole::Declaration,
+                global(id),
+            ),
+        );
+    }
+    for (id, old, new, context, edge, prefix) in [
+        (0x200, "a", "b", "input a id", Child::Left, "body $"),
+        (0x201, "b", "a", "input b id", Child::Right, "body $a + $"),
+    ] {
+        let target = parameter(0x100, id);
+        add(
+            11,
+            context,
+            "input ",
+            old,
+            new,
+            (
+                Id::from_u128(0x100),
+                Some(Field::Input(a::ParameterId(Id::from_u128(id)))),
+                None,
+                TokenRole::Use(Role::ParameterDeclaration),
+                target,
+            ),
+        );
+        add(
+            11,
+            "body $a + $b;",
+            prefix,
+            old,
+            new,
+            (
+                Id::from_u128(0x100),
+                Some(Field::Body),
+                Some(vec![edge]),
+                TokenRole::Use(Role::ParameterUse),
+                target,
+            ),
+        );
+    }
+    for (context, path) in [
+        ("@f(b: 2, a: 1)", vec![Child::Left, Child::Left]),
+        ("@f(a: 3, b: 4)", vec![Child::Left, Child::Right]),
+    ] {
+        add(
+            23,
+            context,
+            "@",
+            "f",
+            "g",
+            (
+                Id::from_u128(0x300),
+                Some(Field::Body),
+                Some(path.clone()),
+                TokenRole::Use(Role::CallTarget),
+                global(0x100),
+            ),
+        );
+        for (id, old, new) in [(0x200, "a", "b"), (0x201, "b", "a")] {
+            let offset = context.find(&format!("{old}:")).unwrap();
+            add(
+                23,
+                context,
+                &context[..offset],
+                old,
+                new,
+                (
+                    Id::from_u128(0x300),
+                    Some(Field::Body),
+                    Some(path.clone()),
+                    TokenRole::Use(Role::ArgumentLabel),
+                    parameter(0x100, id),
+                ),
+            );
+        }
+    }
+    add(
+        23,
+        "@g(a: 5, b: 6)",
+        "@",
+        "g",
+        "f",
+        (
+            Id::from_u128(0x300),
+            Some(Field::Body),
+            Some(vec![Child::Right]),
+            TokenRole::Use(Role::CallTarget),
+            global(0x200),
+        ),
+    );
+    expected.sort_by_key(|row| (row.0.file, row.0.span.start, row.0.span.end));
+    let actual: Vec<Row> = batch
+        .iter()
+        .map(|edit| {
+            let key = edit.key();
+            (
+                edit.location(),
+                edit.original().into(),
+                edit.replacement().into(),
+                (
+                    key.owner,
+                    key.field,
+                    key.path.as_ref().map(|path| path.edges()),
+                    key.role,
+                    key.target,
+                ),
+            )
+        })
+        .collect();
+    assert_eq!(actual, expected);
+
+    let noop = Composition::renames(
+        &index,
+        &BTreeMap::from([
+            (global(0x100), "f".into()),
+            (parameter(0x200, 0x200), "a".into()),
+        ]),
+        &work,
+    )
+    .unwrap();
+    let empty = noop.original_edits(&sources).unwrap();
+    assert!(empty.is_empty());
+    assert_eq!(empty.len(), 0);
+    assert_eq!(empty.iter().count(), 0);
+    assert_eq!(work.usage, usage);
+    assert_eq!(work.numeric_units(), numeric);
+}
+
+#[test]
+fn composition_rejects_stale_or_damaged_complete_batches_before_export() {
+    let mut sources = sources();
+    sources.insert(99, "// unrelated 雪\r\n".into());
+    let original = sources.clone();
+    let mut work = budget();
+    let (index, _) = Index::parse(&skeleton(), &sources, &mut work).unwrap();
+    for damage in 0..10 {
+        let mut current = sources.clone();
+        let mut composition = Composition::renames(&index, &rename_map(), &work).unwrap();
+        match damage {
+            0 => current.get_mut(&99).unwrap().push_str("changed"),
+            1 => {
+                current.remove(&23);
+            }
+            2 => {
+                current.insert(101, String::new());
+            }
+            3 => composition.plan.edits[0].location.span.start += 1,
+            4 => composition
+                .plan
+                .edits
+                .insert(1, composition.plan.edits[0].clone()),
+            5 => {
+                composition.plan.edits.pop();
+            }
+            6 => composition.plan.edits.swap(0, 1),
+            7 => {
+                composition
+                    .plan
+                    .names
+                    .insert(global(0x100), "bad name".into());
+            }
+            8 => {
+                composition.plan.names.insert(global(0x100), "f".into());
+            }
+            _ => {
+                composition.plan.names.insert(global(999), "missing".into());
+            }
+        }
+        let before = current.clone();
+        assert!(
+            composition.original_edits(&current).is_err(),
+            "damage {damage}"
+        );
+        assert_eq!(current, before);
+    }
+    assert_eq!(sources, original);
+    let failure = work.frame(257, Span::default()).unwrap_err();
+    assert_eq!(
+        Composition::renames(&index, &rename_map(), &work).unwrap_err(),
+        failure
+    );
+}
+
+#[test]
+fn composition_defers_only_typed_output_size_with_independent_shrink_arithmetic() {
+    let sources = sources();
+    let cap = sources.values().map(String::len).sum();
+    let mut limits = Limits::source8(ParseLimits::UNLIMITED);
+    limits.bytes = cap;
+    let mut work = Budget::new(limits).unwrap();
+    let (index, _) = Index::parse(&skeleton(), &sources, &mut work).unwrap();
+    assert_eq!(work.usage.bytes, cap);
+    let usage = work.usage;
+    let numeric = work.numeric_units();
+    let names = BTreeMap::from([(global(0x100), "ff".into())]);
+    assert_eq!(
+        Plan::renames(&index, &names, &work).unwrap_err().message,
+        "Source8 index/output byte limit exceeded."
+    );
+    let composition = Composition::renames(&index, &names, &work).unwrap();
+    let batch = composition.original_edits(&sources).unwrap();
+    assert_eq!(batch.len(), 3); // declaration and two distinct call targets
+    let growth: usize = batch
+        .iter()
+        .map(|edit| edit.replacement().len() - edit.original().len())
+        .sum();
+    assert_eq!(growth, 3);
+    assert_eq!(
+        composition.plan.apply(&sources, &work).unwrap_err().message,
+        "Source8 index/output byte limit exceeded."
+    );
+
+    // Independent future ordinary/scalar producer witness on untouched display
+    // name bytes. This is size/offset arithmetic only: this typed-only harness
+    // has no ordinary collector, mixed ownership proof or accepted output.
+    let start = DEFINITIONS.find("\"f a b\"").unwrap() + 1;
+    let shrink = Location {
+        file: 11,
+        span: Span {
+            start,
+            end: start + "f a b".len(),
+        },
+    };
+    assert_eq!(
+        &sources[&shrink.file][shrink.span.start..shrink.span.end],
+        "f a b"
+    );
+    for edit in batch.iter() {
+        let at = edit.location();
+        assert!(
+            at.file != shrink.file
+                || at.span.end <= shrink.span.start
+                || shrink.span.end <= at.span.start
+        );
+    }
+    let original_len = shrink.span.end - shrink.span.start;
+    assert_eq!(cap + growth - original_len + "fa".len(), cap);
+    assert_eq!(cap + growth - original_len + "fab".len(), cap + 1);
+    assert_eq!(work.usage, usage);
+    assert_eq!(work.numeric_units(), numeric);
+}
+
+#[test]
+fn composition_keeps_name_storage_and_rename_record_limits_before_allocation() {
+    let sources = sources();
+    let cap = sources.values().map(String::len).sum();
+    let mut limits = Limits::source8(ParseLimits::UNLIMITED);
+    limits.bytes = cap;
+    let mut work = Budget::new(limits).unwrap();
+    let (index, _) = Index::parse(&skeleton(), &sources, &mut work).unwrap();
+    let exact = BTreeMap::from([(global(0x100), "x".repeat(cap))]);
+    assert_eq!(
+        Composition::renames(&index, &exact, &work)
+            .unwrap()
+            .original_edits(&sources)
+            .unwrap()
+            .len(),
+        3
+    );
+    let over = BTreeMap::from([(global(0x100), "x".repeat(cap + 1))]);
+    assert_eq!(
+        Composition::renames(&index, &over, &work)
+            .unwrap_err()
+            .message,
+        "Source8 index/output byte limit exceeded."
+    );
+    for invalid in [
+        BTreeMap::from([(global(999), "unknown".into())]),
+        BTreeMap::from([(global(0x100), "bad name".into())]),
+        BTreeMap::from([(global(0x100), "g".into())]),
+        BTreeMap::from([(parameter(0x100, 0x200), "b".into())]),
+    ] {
+        assert!(Composition::renames(&index, &invalid, &work).is_err());
+    }
+
+    // A typed-empty fixture isolates the rename-map record bound without
+    // syntax entry usage masking it. No ordinary edits are authorized here.
+    let ordinary = skeleton();
+    let count = ordinary.identities().len();
+    let files = BTreeMap::from([(1, "// empty typed unit\n".into())]);
+    let mut limits = Limits::source8(ParseLimits::UNLIMITED);
+    limits.entries = count;
+    limits.references = 0;
+    let mut inherited = Budget::new(limits).unwrap();
+    let (index, _) = Index::parse(&ordinary, &files, &mut inherited).unwrap();
+    let mut names: BTreeMap<_, _> = index
+        .names()
+        .keys()
+        .enumerate()
+        .map(|(i, target)| (*target, format!("renamed_{i}")))
+        .collect();
+    assert_eq!(names.len(), count);
+    assert!(
+        Composition::renames(&index, &names, &inherited)
+            .unwrap()
+            .original_edits(&files)
+            .unwrap()
+            .is_empty()
+    );
+    names.insert(global(999), "additional".into());
+    assert_eq!(
+        Composition::renames(&index, &names, &inherited)
+            .unwrap_err()
+            .message,
+        "Source8 lowering entry limit exceeded."
+    );
+}
+
+#[test]
+fn composition_checks_edit_record_ceiling_before_duplicate_membership() {
+    let sources = sources();
+    let mut limits = Limits::source8(ParseLimits::UNLIMITED);
+    limits.entries = 128;
+    limits.references = 32;
+    let ceiling = limits.entries + limits.references;
+    let mut work = Budget::new(limits).unwrap();
+    let (index, _) = Index::parse(&skeleton(), &sources, &mut work).unwrap();
+    let mut composition = Composition::renames(&index, &rename_map(), &work).unwrap();
+    assert_eq!(composition.original_edits(&sources).unwrap().len(), 13);
+    let duplicate = composition.plan.edits[0].clone();
+    composition.plan.edits = vec![duplicate.clone(); ceiling];
+    // At the exact count bound validation proceeds to the independent ownership
+    // error. The damaged plan never becomes a successful/authoritative batch.
+    assert_eq!(
+        composition.original_edits(&sources).unwrap_err().message,
+        "Forged or duplicate edit occurrence."
+    );
+    composition.plan.edits.push(duplicate);
+    assert_eq!(
+        composition.original_edits(&sources).unwrap_err().message,
+        "Source8 lowering occurrence limit exceeded."
+    );
+}
+
+#[test]
+fn standalone_noop_apply_keeps_tighter_file_only_budget_and_output_boundary() {
+    let sources = sources();
+    let mut inherited = budget();
+    let (index, _) = Index::parse(&skeleton(), &sources, &mut inherited).unwrap();
+    let plan = Plan::renames(
+        &index,
+        &BTreeMap::from([(global(0x100), "f".into())]),
+        &inherited,
+    )
+    .unwrap();
+    assert_eq!(plan.edit_count(), 0);
+    assert!(index.names().len() > sources.len());
+    let mut limits = Limits::source8(ParseLimits::UNLIMITED);
+    limits.entries = sources.len();
+    limits.references = 0;
+    limits.bytes = sources.values().map(String::len).sum();
+    // Standalone apply checks file/edit records, not the already validated
+    // catalog/name-storage allocation from construction. Rechecking the catalog
+    // under this intentionally tighter probe budget would reject this no-op.
+    assert_eq!(
+        plan.apply(&sources, &Budget::new(limits).unwrap()).unwrap(),
+        sources
+    );
+    limits.bytes -= 1;
+    assert_eq!(
+        plan.apply(&sources, &Budget::new(limits).unwrap())
+            .unwrap_err()
+            .message,
+        "Source8 index/output byte limit exceeded."
+    );
+}

harness/experiments/analysis-source-s3-windows-20260922/.gitattributes

@@ -1 +0,0 @@
-* -text

harness/experiments/analysis-source-s3-windows-20260922/README.md

@@ -1,46 +0,0 @@
-# Private S3 Windows evidence
-
-Source `1b1c3e3abb6fc3d0934c9dbfbd21fddc8ae4f594`, following `90fae14818f684bf778640be2e613f34e3c7e999`. This checkpoint verifies the private typed index/rename slice and the rejected-depth syntax cleanup. **It does not establish current full-core runtime, public source8, integration, native UI or release acceptance.** Parent owns review/publication and integration.
-
-| Recorded scope | Result |
-| --- | --- |
-| Full library listing | 167 test names; original 166 retained plus one cleanup test |
-| Typed source runtime | 59 passed, including all 9 index and 5 update tests |
-| Existing raw-token control | 1 passed |
-| Three focused 128 KiB controls | Original whole-flow, eight-parent cleanup and synthetic 256-frame Path tests passed |
-| Strict core, all targets | Clippy with `-D warnings`, exit0 |
-| Original90fae typed gate | Stack overflow retained; aborted run is not a passing full gate |
-| Temporary diagnostics/probes | Two dirty overflow reproductions; four dirty direct-parser malformed-input probes passed |
-
-Actual platform was Windows x86_64-pc-windows-gnullvm, Rust/Cargo 1.98.1, one compiler job. Every clean gate binds 538 committed inputs before/after, exact commands and source. Raw source manifests, logs, receipts, helper scripts and diagnostic diffs remain byte-for-byte unchanged in [evidence.zip](evidence.zip). Its SHA256 is `4486f4c42b140ae4b9b3caf0aacdf151a2acb1fd85eda09a57764fd69e980574`; 658251 bytes, 61 members. No executables, caches or profiles are included.
-
-The failure occurred when `Cursor::node` recursively dropped a rejected depth129 syntax tree below parser frames. Complete depth128 parsing/indexing/renaming/output/model equality/admission and earlier cleanup had finished. The source fix uses iterative rejected-kind disposal and preserves the existing stack request, depth limit and assertions. The 14 original S3 tests and the added mixed-shape cleanup test now have actual runtime evidence. Ordinary AST destruction and all possible parser-error paths are not claimed iterative or universally stack-safe.
-
-## Reproduce evidence verification
-
-With Python 3 standard library and Git, from any working directory:
-
-```text
-python -B PATH/verify.py --repo PATH/TO/GIT/REPOSITORY
-python -B PATH/negative_controls.py --repo PATH/TO/GIT/REPOSITORY
-```
-
-The repository needs immutable commits `1b1c3e3`, `90fae148` and `1f828323` (the publication commit contains that ancestry). Verification reads commit blobs; it neither depends on nor changes the current checkout. `--evidence-dir PATH` optionally selects another complete extracted payload directory. No archived helper, compiler or native artifact is executed. Optimized Python is refused.
-
-The verifier checks both manifests/ZIP byte integrity, actual listing and exact selected runtime membership, 538 committed inputs, recorded commands/times/environment, strict completion, historical source-artifact manifests and the original aborted gate. It reconstructs the dirty source patches in memory and verifies the corresponding 538 test-input hashes. Broader tracked-file hashes also remain in the original captures; the verifier does not claim to audit unrelated tracked files outside that test-input scope. Binary identities are checked against raw executable-path receipts, not rehashed executable bytes, because binaries are deliberately absent. Initial focused tests and final restored typed/token/listing tests were separate builds of identical source and have their own binary receipts.
-
-[checks.json](checks.json) records the positive working evidence audit and 13 discriminating negative controls. Those controls corrupt evidence only in memory; raw archives stay intact. Semantic cases reach their specific checks instead of failing only at the outer ZIP checksum. Package verification also runs against the saved commit and a fresh extraction; exact publication-commit readback is reported in the handoff to the parent, since embedding a commit's own hash in its contents is not possible.
-
-## Review and historical evidence navigation
-
-Extract the ZIP only if desired; the verifier itself inspects it in memory. Current authoritative raw closure is `closure.json` plus `raw/`. Relevant retained notes inside the ZIP:
-
-- `notes/analysis-source8-s3-index-independent-review-20260913.md`: original S3 source review and required corrections.
-- `notes/analysis-source8-s3-correction-independent-review-20260922.md`: corrected Path/index source review before runtime.
-- `notes/analysis-source3-stack-cleanup-review-20260922.md`: independent review of iterative rejected-kind cleanup.
-- `notes/analysis-source3-stack-cleanup-handoff-20260922.md`: exact failure isolation, fix and completed Windows gates.
-- Original index/correction source manifests bind their respective immutable Git versions; their historical `unrun` labels are preserved and superseded only by the later actual receipts.
-
-The ZIP's initial `README.md` contains the earlier portable-verifier proposal. It is retained as historical package text; this outer README and actual `verify.py` describe the completed verifier. No peer should execute the archived local orchestration helpers to verify evidence.
-
-Source-bound original-span export, mixed ordinary/typed composition, complete output recompile/admission/intended-Project equality and public dispatch/migration/save integration remain separate work. This evidence does not close those requirements.

harness/experiments/analysis-source-s3-windows-20260922/checks.json

@@ -1,107 +0,0 @@
-{
-  "source": "1b1c3e3abb6fc3d0934c9dbfbd21fddc8ae4f594",
-  "positive_audit": {
-    "source": "1b1c3e3abb6fc3d0934c9dbfbd21fddc8ae4f594",
-    "verified_git_inputs": 538,
-    "listing": 167,
-    "typed_pass": 59,
-    "index_pass": 9,
-    "update_pass": 5,
-    "token_pass": 1,
-    "strict_exit": 0,
-    "historical_overflow_retained": true,
-    "dirty_diagnostics": 2,
-    "dirty_direct_parser_probes_pass": 4,
-    "recorded_test_artifacts": {
-      "stack-fixed-original-1b1c3e3": {
-        "path": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-checked-save-target-20260913\\debug\\deps\\oa_core-73987e0d7089bf1e.exe",
-        "bytes": 39014400,
-        "sha256": "56c0e5cd44ac5cb96b814d25ea403356195271a1aa9b6c6d1165fed4ffd09ddf"
-      },
-      "stack-fixed-shapes-1b1c3e3": {
-        "path": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-checked-save-target-20260913\\debug\\deps\\oa_core-73987e0d7089bf1e.exe",
-        "bytes": 39014400,
-        "sha256": "56c0e5cd44ac5cb96b814d25ea403356195271a1aa9b6c6d1165fed4ffd09ddf"
-      },
-      "stack-fixed-paths-1b1c3e3": {
-        "path": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-checked-save-target-20260913\\debug\\deps\\oa_core-73987e0d7089bf1e.exe",
-        "bytes": 39014400,
-        "sha256": "56c0e5cd44ac5cb96b814d25ea403356195271a1aa9b6c6d1165fed4ffd09ddf"
-      },
-      "typed-fixed-1b1c3e3": {
-        "path": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-checked-save-target-20260913\\debug\\deps\\oa_core-73987e0d7089bf1e.exe",
-        "bytes": 39014400,
-        "sha256": "7b38b54ad94678171bd8b5964b1e00dd7da8346d96276c1ad790d1a6eb335208"
-      },
-      "token-fixed-1b1c3e3": {
-        "path": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-checked-save-target-20260913\\debug\\deps\\oa_core-73987e0d7089bf1e.exe",
-        "bytes": 39014400,
-        "sha256": "7b38b54ad94678171bd8b5964b1e00dd7da8346d96276c1ad790d1a6eb335208"
-      },
-      "list-fixed-1b1c3e3": {
-        "path": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-checked-save-target-20260913\\debug\\deps\\oa_core-73987e0d7089bf1e.exe",
-        "bytes": 39014400,
-        "sha256": "7b38b54ad94678171bd8b5964b1e00dd7da8346d96276c1ad790d1a6eb335208"
-      }
-    },
-    "scope": "Private S3 only; no full-core runtime/public8/integration/native/release acceptance. Recorded binary identities verified against receipts, not rehashed executable bytes; binaries intentionally absent."
-  },
-  "negative_control_count": 13,
-  "negative_controls": [
-    {
-      "name": "changed_zip_bytes",
-      "refusal": "Evidence ZIP SHA256 differs"
-    },
-    {
-      "name": "duplicate_json_key",
-      "refusal": "Duplicate JSON key: source"
-    },
-    {
-      "name": "duplicate_zip_member_with_test_only_pin",
-      "refusal": "Exact unique ZIP membership"
-    },
-    {
-      "name": "unsafe_zip_member_with_test_only_pin",
-      "refusal": "Unsafe ZIP path"
-    },
-    {
-      "name": "truncated_strict_completion",
-      "refusal": "Closed clean strict log"
-    },
-    {
-      "name": "missing_typed_runtime_member",
-      "refusal": "Exact ordered runtime results: typed-fixed-1b1c3e3"
-    },
-    {
-      "name": "altered_gate_command",
-      "refusal": "Exact command: token-fixed-1b1c3e3"
-    },
-    {
-      "name": "altered_committed_input_hash",
-      "refusal": "Exact538 source bindings: typed-fixed-1b1c3e3"
-    },
-    {
-      "name": "dirty_run_mislabeled_as_fixed_source",
-      "refusal": "Dirty capture identity/stability"
-    },
-    {
-      "name": "historical_abort_mislabeled_success",
-      "refusal": "Historical aborted gate"
-    },
-    {
-      "name": "diagnostic_patch_disagrees_with_captured_hash",
-      "refusal": "Reconstructed diagnostic input: crates/oa-core/src/language/analysis_source/index/tests.rs"
-    },
-    {
-      "name": "probe_case_mislabeled",
-      "refusal": "Dirty probe result/case"
-    },
-    {
-      "name": "optimized_python_refused",
-      "refusal": "Optimized Python refused"
-    }
-  ],
-  "verifier_sha256": "4da79ba0c6fe9dc0ae9b81da6589756d3a215620f2e2fd6cbefaa621f646ebc9",
-  "controls_sha256": "a969264c98ab2fb95a0585b81c9d27a277ebe629488f20f45216d4483c26b396",
-  "method": "Raw archive untouched. Semantic corruptions pass directly to audit() after authentic archive validation; ZIP structural negatives temporarily substitute only the test module pin. No compiler, artifact execution or worktree write."
-}

harness/experiments/analysis-source-s3-windows-20260922/manifest.json

@@ -1,36 +0,0 @@
-{
-  "source": "1b1c3e3abb6fc3d0934c9dbfbd21fddc8ae4f594",
-  "archive_sha256": "4486f4c42b140ae4b9b3caf0aacdf151a2acb1fd85eda09a57764fd69e980574",
-  "files": [
-    {
-      "path": ".gitattributes",
-      "bytes": 8,
-      "sha256": "705fd4d6451a31d36b3df7de96f83f30ac976c9b4a6d1e51671d8e2f33e2d0da"
-    },
-    {
-      "path": "README.md",
-      "bytes": 5456,
-      "sha256": "8059aa1794544272e3cdaa622ff48a9d0fdf4c257a4a1ca0daf9cc1adcc8b061"
-    },
-    {
-      "path": "verify.py",
-      "bytes": 17589,
-      "sha256": "4da79ba0c6fe9dc0ae9b81da6589756d3a215620f2e2fd6cbefaa621f646ebc9"
-    },
-    {
-      "path": "negative_controls.py",
-      "bytes": 5767,
-      "sha256": "a969264c98ab2fb95a0585b81c9d27a277ebe629488f20f45216d4483c26b396"
-    },
-    {
-      "path": "checks.json",
-      "bytes": 4506,
-      "sha256": "295acaadd2b1fe0f55c08c71c66c193635f70c2f7c63311ea42b039035065139"
-    },
-    {
-      "path": "evidence.zip",
-      "bytes": 658251,
-      "sha256": "4486f4c42b140ae4b9b3caf0aacdf151a2acb1fd85eda09a57764fd69e980574"
-    }
-  ]
-}

harness/experiments/analysis-source-s3-windows-20260922/negative_controls.py

@@ -1,98 +0,0 @@
-"""Read-only in-memory falsifiers for verify.py; does not modify archived evidence."""
-import argparse
-import importlib.util
-import io
-import json
-from pathlib import Path
-import subprocess
-import sys
-import warnings
-import zipfile
-
-
-def run(repo, directory):
-    spec = importlib.util.spec_from_file_location('s3_evidence_verifier', directory / 'verify.py')
-    verifier = importlib.util.module_from_spec(spec)
-    spec.loader.exec_module(verifier)
-    verifier.require(__debug__, 'Optimized Python refused')
-    raw = (directory / 'evidence.zip').read_bytes()
-    payload = verifier.archive_payload(raw)
-    positive = verifier.audit(repo, payload)
-    cases = []
-
-    def refused(name, expected, action):
-        try:
-            action()
-        except RuntimeError as error:
-            verifier.require(expected in str(error), f'{name}: wrong refusal: {error}')
-            cases.append({'name': name, 'refusal': str(error)})
-        else:
-            raise RuntimeError(name + ': invalid evidence was accepted')
-
-    def changed_json(name, change):
-        candidate = dict(payload)
-        data = verifier.document(candidate[name])
-        change(data)
-        candidate[name] = json.dumps(data).encode()
-        return candidate
-
-    refused('changed_zip_bytes', 'Evidence ZIP SHA256 differs', lambda: verifier.archive_payload(raw + b'tampered'))
-    refused('duplicate_json_key', 'Duplicate JSON key', lambda: verifier.document(b'{"source":1,"source":2}'))
-
-    def changed_zip(mode):
-        buffer = io.BytesIO()
-        with zipfile.ZipFile(buffer, 'w') as archive:
-            for name, content in payload.items():
-                archive.writestr('../README.md' if mode == 'unsafe' and name == 'README.md' else name, content)
-            if mode == 'duplicate':
-                with warnings.catch_warnings():
-                    warnings.simplefilter('ignore', UserWarning)
-                    archive.writestr('README.md', payload['README.md'])
-        malformed = buffer.getvalue()
-        # Test-only pin substitution reaches ZIP structure checks. Production
-        # archive_payload always requires its checked-in immutable ZIP digest.
-        original_pin = verifier.ZIP_SHA
-        try:
-            verifier.ZIP_SHA = verifier.sha(malformed)
-            verifier.archive_payload(malformed)
-        finally:
-            verifier.ZIP_SHA = original_pin
-
-    refused('duplicate_zip_member_with_test_only_pin', 'Exact unique ZIP membership', lambda: changed_zip('duplicate'))
-    refused('unsafe_zip_member_with_test_only_pin', 'Unsafe ZIP path', lambda: changed_zip('unsafe'))
-
-    changed = dict(payload)
-    changed['raw/strict-fixed-1b1c3e3.log'] = b'   Compiling oa-core\n'
-    refused('truncated_strict_completion', 'Closed clean strict log', lambda: verifier.audit(repo, changed))
-    changed = dict(payload)
-    name = 'raw/typed-fixed-1b1c3e3.log'
-    changed[name] = b'\n'.join(line for line in changed[name].split(b'\n') if verifier.NEW.encode() not in line)
-    refused('missing_typed_runtime_member', 'Exact ordered runtime results', lambda: verifier.audit(repo, changed))
-    changed = changed_json('raw/token-fixed-1b1c3e3.result.json', lambda data: data['command'].remove('--offline'))
-    refused('altered_gate_command', 'Exact command', lambda: verifier.audit(repo, changed))
-    changed = changed_json('raw/typed-fixed-1b1c3e3.inputs.json', lambda data: data['inputs'][0].update(sha256='0' * 64))
-    refused('altered_committed_input_hash', 'Exact538 source bindings', lambda: verifier.audit(repo, changed))
-    changed = changed_json('raw/stack-diag-02-dirty.inputs.json', lambda data: data.update(head=verifier.SOURCE))
-    refused('dirty_run_mislabeled_as_fixed_source', 'Dirty capture identity/stability', lambda: verifier.audit(repo, changed))
-    changed = changed_json('raw/typed-90fae148.result.json', lambda data: data.update(exit=0))
-    refused('historical_abort_mislabeled_success', 'Historical aborted gate', lambda: verifier.audit(repo, changed))
-    changed = changed_json('raw/stack-diag-01-dirty.inputs.json', lambda data: data.update(dirty=data['dirty'].replace('STAGE entered', 'STAGE changed')))
-    refused('diagnostic_patch_disagrees_with_captured_hash', 'Reconstructed diagnostic input', lambda: verifier.audit(repo, changed))
-    changed = dict(payload)
-    changed['raw/stack-probe-if-01-dirty.log'] = changed['raw/stack-probe-if-01-dirty.log'].replace(b'PROBE after malformed case 1:', b'PROBE after malformed case 0:')
-    refused('probe_case_mislabeled', 'Dirty probe result/case', lambda: verifier.audit(repo, changed))
-    result = subprocess.run([sys.executable, '-B', '-O', str(directory / 'verify.py'), '--repo', str(repo)], capture_output=True, text=True)
-    verifier.require(result.returncode != 0 and 'Optimized Python refused' in result.stderr, 'Optimized verifier must refuse before audit')
-    cases.append({'name': 'optimized_python_refused', 'refusal': 'Optimized Python refused'})
-    return {'source': verifier.SOURCE, 'positive_audit': positive, 'negative_control_count': len(cases), 'negative_controls': cases, 'verifier_sha256': verifier.sha((directory / 'verify.py').read_bytes()), 'controls_sha256': verifier.sha(Path(__file__).read_bytes()), 'method': 'Raw archive untouched. Semantic corruptions pass directly to audit() after authentic archive validation; ZIP structural negatives temporarily substitute only the test module pin. No compiler, artifact execution or worktree write.'}
-
-
-def main():
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument('--repo', type=Path, required=True)
-    args = parser.parse_args()
-    print(json.dumps(run(args.repo.resolve(), Path(__file__).resolve().parent), indent=2))
-
-
-if __name__ == '__main__':
-    main()

harness/experiments/analysis-source-s3-windows-20260922/verify.py

@@ -1,257 +0,0 @@
-"""Read-only portable S3 evidence verification; never compiles or runs artifacts."""
-import argparse
-from datetime import datetime
-import hashlib
-import io
-import json
-from pathlib import Path, PurePosixPath, PureWindowsPath
-import re
-import subprocess
-import zipfile
-
-SOURCE = '1b1c3e3abb6fc3d0934c9dbfbd21fddc8ae4f594'
-PRIOR = '90fae14818f684bf778640be2e613f34e3c7e999'
-ZIP_SHA = '4486f4c42b140ae4b9b3caf0aacdf151a2acb1fd85eda09a57764fd69e980574'
-RECORDER = '328970b226d9f4c3b8d3feb7d64478fb9756310ae5dfd3caa43b23c8b9d6f245'
-PREFIX = ['cargo', 'test', '--locked', '--offline', '-p', 'oa-core', '--lib']
-SCOPES = ['Cargo.toml', 'Cargo.lock', 'rust-toolchain.toml', '.cargo', 'build', 'crates', 'assets', 'docs', 'examples', 'harness/fixtures', 'vendor']
-STACK = 'deep_parse_index_plan_and_failed_build_cleanup_on_128k_stack'
-NEW = 'every_parent_shape_rejects_depth129_and_cleans_children_on_128k_stack'
-PATHS = 'maximum_index_paths_compare_lookup_debug_and_drop_on_128k_stack'
-OVERFLOW = 3221225725
-
-
-def require(ok, message):
-    if not ok:
-        raise RuntimeError(message)
-
-
-def sha(raw):
-    return hashlib.sha256(raw).hexdigest()
-
-
-def unique(pairs):
-    value = {}
-    for key, item in pairs:
-        require(key not in value, 'Duplicate JSON key: ' + key)
-        value[key] = item
-    return value
-
-
-def document(raw):
-    return json.loads(raw, object_pairs_hook=unique)
-
-
-def git(repo, *args, data=None):
-    return subprocess.check_output(['git', *args], cwd=repo, input=data)
-
-
-def source_inputs(repo, commit):
-    paths = git(repo, 'ls-tree', '-r', '--name-only', commit, '--', *SCOPES).decode().splitlines()
-    require(len(paths) == len(set(paths)) == 538, 'Exactly538 committed test inputs')
-    batch = git(repo, 'cat-file', '--batch', data=''.join(f'{commit}:{p}\n' for p in paths).encode())
-    offset, inputs, blobs = 0, [], {}
-    for path in paths:
-        end = batch.index(b'\n', offset)
-        _, kind, size = batch[offset:end].split()
-        size = int(size)
-        raw = batch[end + 1:end + 1 + size]
-        require(kind == b'blob' and len(raw) == size and batch[end + 1 + size:end + 2 + size] == b'\n', 'Git blob framing: ' + path)
-        inputs.append({'path': path, 'bytes': size, 'sha256': sha(raw)})
-        blobs[path] = raw
-        offset = end + size + 2
-    require(offset == len(batch), 'Complete Git blob stream')
-    return inputs, blobs
-
-
-def archive_payload(raw):
-    require(sha(raw) == ZIP_SHA, 'Evidence ZIP SHA256 differs')
-    with zipfile.ZipFile(io.BytesIO(raw)) as archive:
-        names = archive.namelist()
-        require(len(names) == len(set(names)) == 61, 'Exact unique ZIP membership')
-        for name in names:
-            path = PurePosixPath(name)
-            require(not path.is_absolute() and '..' not in path.parts and str(path) == name and '\\' not in name and ':' not in name, 'Unsafe ZIP path')
-        payload = {name: archive.read(name) for name in names}
-    manifest = document(payload['manifest.json'])
-    require(manifest['source'] == SOURCE, 'Archive manifest source')
-    listed = [item['path'] for item in manifest['files']]
-    require(len(listed) == len(set(listed)) and set(listed) | {'manifest.json'} == set(payload), 'Archive manifest membership')
-    for item in manifest['files']:
-        require(len(payload[item['path']]) == item['bytes'] and sha(payload[item['path']]) == item['sha256'], 'Archive member binding: ' + item['path'])
-    return payload
-
-
-def apply_recorded_diff(blobs, diff):
-    """Reconstruct diagnostic source without touching an index or worktree."""
-    changed = {}
-    sections = re.split(r'(?m)^diff --git ', diff)[1:]
-    require(sections, 'Missing dirty diff')
-    for section in sections:
-        lines = section.splitlines(keepends=True)
-        names = re.fullmatch(r'a/(\S+) b/(\S+)\n', lines[0])
-        require(names is not None and names[1] == names[2] and names[1] in blobs, 'Unexpected diagnostic diff path')
-        path = names[1]
-        old = blobs[path].decode().splitlines(keepends=True)
-        output, cursor, index = [], 0, 1
-        while index < len(lines) and not lines[index].startswith('@@ '):
-            index += 1
-        require(index < len(lines), 'Missing diagnostic hunk')
-        while index < len(lines):
-            match = re.match(r'@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@', lines[index])
-            require(match is not None, 'Invalid diagnostic hunk header')
-            old_start, old_count = int(match[1]), int(match[2] or 1)
-            new_start, new_count = int(match[3]), int(match[4] or 1)
-            start = old_start - 1 if old_count else old_start
-            require(cursor <= start <= len(old), 'Diagnostic hunk position')
-            output.extend(old[cursor:start])
-            cursor = start
-            require(len(output) == (new_start - 1 if new_count else new_start), 'Diagnostic new hunk position')
-            consumed = emitted = 0
-            index += 1
-            while index < len(lines) and not lines[index].startswith('@@ '):
-                line = lines[index]
-                require(line[:1] in [' ', '+', '-'], 'Unsupported diagnostic patch line')
-                if line[0] in ' -':
-                    require(cursor < len(old) and old[cursor] == line[1:], 'Diagnostic old source mismatch')
-                    cursor += 1
-                    consumed += 1
-                if line[0] in ' +':
-                    output.append(line[1:])
-                    emitted += 1
-                index += 1
-            require((consumed, emitted) == (old_count, new_count), 'Diagnostic hunk counts')
-        output.extend(old[cursor:])
-        require(path not in changed, 'Repeated diagnostic path')
-        changed[path] = ''.join(output).encode()
-    return changed
-
-
-def audit(repo, payload):
-    read = lambda name: payload['raw/' + name]
-    doc = lambda name: document(read(name))
-    closure = document(payload['closure.json'])
-    expected, blobs = source_inputs(repo, SOURCE)
-    prior_inputs, prior_blobs = source_inputs(repo, PRIOR)
-    require(git(repo, 'rev-parse', SOURCE + '^').decode().strip() == PRIOR, 'Correction parent')
-    require(sha(payload['helpers/run-analysis-source3-gate-20260922.py']) == RECORDER, 'Recorder bytes')
-    for manifest_name, commit, count in [
-        ('analysis-source8-s3-index-source-manifest-20260913.json', '1f8283236f8ccdefca13814003e7f046860b4f22', 7),
-        ('analysis-source8-s3-index-correction-source-manifest-20260913.json', PRIOR, 2),
-    ]:
-        manifest = document(payload['notes/' + manifest_name])
-        require(manifest['source'] == commit and len(manifest['files']) == count, 'Historical source artifact manifest')
-        for item in manifest['files']:
-            raw = git(repo, 'show', commit + ':' + item['path'])
-            require(len(raw) == item['bytes'] and sha(raw) == item['sha256'] and git(repo, 'rev-parse', commit + ':' + item['path']).decode().strip() == item['git_blob'], 'Historical source artifact: ' + item['path'])
-    names = re.findall(r'^([^\r\n]+): test\r?$', read('list-fixed-1b1c3e3.log').decode(), re.M)
-    old_names = re.findall(r'^([^\r\n]+): test\r?$', read('list-90fae148.log').decode(), re.M)
-    require(len(names) == len(set(names)) == 167 and len(old_names) == len(set(old_names)) == 166, 'Actual listing sizes')
-    qualified_new = 'language::analysis_source::tests::' + NEW
-    require(set(names) == set(old_names) | {qualified_new} and qualified_new not in old_names, 'Retained166 plus one new case')
-    require(len([n for n in names if 'language::analysis_source' in n]) == 59 and len([n for n in names if 'language::raw_tokens' in n]) == 1, 'Typed/token listing counts')
-    for module, count in [('index', 9), ('update', 5)]:
-        path = f'crates/oa-core/src/language/analysis_source/{module}/tests.rs'
-        authored = [f'language::analysis_source::{module}::tests::{name}' for name in re.findall(r'#\[test\]\s*fn (\w+)\(', blobs[path].decode())]
-        require(len(authored) == count and set(authored) == {n for n in names if n.startswith(f'language::analysis_source::{module}::tests::')}, 'Source-derived membership: ' + module)
-    selectors = {'stack-fixed-original-1b1c3e3': STACK, 'stack-fixed-shapes-1b1c3e3': NEW, 'stack-fixed-paths-1b1c3e3': PATHS, 'typed-fixed-1b1c3e3': 'language::analysis_source', 'token-fixed-1b1c3e3': 'language::raw_tokens', 'list-fixed-1b1c3e3': None, 'strict-fixed-1b1c3e3': 'clippy'}
-    environment, artifacts, last_end = None, {}, None
-    for stem, selector in selectors.items():
-        record, log = doc(stem + '.result.json'), read(stem + '.log').decode()
-        require(record['source'] == record['head_after'] == SOURCE and type(record['exit']) is int and record['exit'] == 0 and record['changed_inputs'] == [], 'Clean source/result: ' + stem)
-        require(record['inputs'] == stem + '.inputs.json' and doc(record['inputs']) == {'source': SOURCE, 'inputs': expected}, 'Exact538 source bindings: ' + stem)
-        require(record['launcher_sha256'] == RECORDER, 'Recorded launcher')
-        start, end = (datetime.fromisoformat(record[k]) for k in ['start', 'end'])
-        require(start.tzinfo is not None and end.tzinfo is not None and start <= end and (last_end is None or last_end <= start), 'Closed ordered gate times')
-        last_end = end
-        if environment is None:
-            environment = record['environment']
-        require(record['environment'] == environment and environment['CARGO_BUILD_JOBS'] == '1' and PureWindowsPath(environment['CARGO_TARGET_DIR']).name == 'analysis-checked-save-target-20260913', 'Recorded environment')
-        if selector == 'clippy':
-            command = ['cargo', 'clippy', '--locked', '--offline', '-p', 'oa-core', '--all-targets', '--', '-D', 'warnings']
-            require(record['artifacts'] == [] and 'Finished `dev` profile [unoptimized]' in log and not re.search(r'^\s*(warning|error)(\[|:)', log, re.M), 'Closed clean strict log')
-            selected = []
-        else:
-            require(len(record['artifacts']) == 1, 'One recorded test artifact')
-            artifact = record['artifacts'][0]
-            emitted = re.findall(r'Running unittests [^\r\n]+ \(([^\r\n]+\.exe)\)', log)
-            require(len(emitted) == 1 and PureWindowsPath(emitted[0]) == PureWindowsPath(artifact['path']) and artifact['bytes'] > 0 and re.fullmatch('[0-9a-f]{64}', artifact['sha256']), 'Recorded executable/log binding')
-            artifacts[stem] = artifact
-            if selector is None:
-                command = PREFIX + ['--', '--list']
-                selected = names
-                require(record['listing_members'] == names and record['listing_count'] == 167 and re.findall(r'^(\d+) tests, (\d+) benchmarks\s*$', log, re.M) == [('167', '0')], 'Listing receipt and summary')
-            else:
-                command = PREFIX + [selector, '--', '--test-threads=1']
-                selected = [name for name in names if selector in name]
-                rows = re.findall(r'^test ([^\r\n]+) \.\.\. (ok|FAILED|ignored)\r?$', log, re.M)
-                require(rows == [(name, 'ok') for name in selected], 'Exact ordered runtime results: ' + stem)
-                require(re.findall(r'^test result: ok\. (\d+) passed; (\d+) failed; (\d+) ignored; (\d+) measured; (\d+) filtered out;', log, re.M) == [(str(len(selected)), '0', '0', '0', str(167-len(selected)))], 'Runtime summary')
-        require(record['command'] == command, 'Exact command: ' + stem)
-        if selector is not None:
-            require(record['listing_count'] == 0 and record['listing_members'] == [], 'Non-list metadata')
-        saved = closure['gates'][stem]
-        require([saved[k] for k in ['command', 'exit', 'start', 'end', 'names']] == [command, 0, record['start'], record['end'], selected], 'Closure gate facts')
-        require(saved['pins'] == {stem+s: sha(read(stem+s)) for s in ['.inputs.json', '.log', '.result.json']}, 'Closure raw pins')
-    require(artifacts['stack-fixed-original-1b1c3e3'] == artifacts['stack-fixed-shapes-1b1c3e3'] == artifacts['stack-fixed-paths-1b1c3e3'], 'First focused build receipt')
-    require(artifacts['typed-fixed-1b1c3e3'] == artifacts['token-fixed-1b1c3e3'] == artifacts['list-fixed-1b1c3e3'], 'Final restored clean build receipt')
-    require([closure[k] for k in ['source', 'parent', 'verified_inputs', 'listing', 'typed_pass', 'index_pass', 'update_pass', 'token_pass', 'strict_exit']] == [SOURCE, PRIOR, 538, 167, 59, 9, 5, 1, 0], 'Closure counts')
-    for stem, mode in [('list-90fae148', 'list'), ('typed-90fae148', 'failed')]:
-        record, log = doc(stem + '.result.json'), read(stem + '.log').decode()
-        require(record['source'] == record['head_after'] == PRIOR and record['changed_inputs'] == [] and record['launcher_sha256'] == RECORDER, 'Historical frozen source')
-        require(doc(stem + '.inputs.json') == {'source': PRIOR, 'inputs': prior_inputs}, 'Historical538 inputs')
-        if mode == 'list':
-            require(record['exit'] == 0 and record['listing_members'] == old_names and record['listing_count'] == 166 and record['command'] == PREFIX + ['--', '--list'], 'Historical listing')
-        else:
-            require(record['exit'] == OVERFLOW and record['command'] == PREFIX + ['language::analysis_source', '--', '--test-threads=1'] and 'STATUS_STACK_OVERFLOW' in log and STACK + ' ...' in log and 'test result:' not in log, 'Historical aborted gate')
-            selected = [n for n in old_names if 'language::analysis_source' in n]
-            failing = 'language::analysis_source::index::tests::' + STACK
-            rows = re.findall(r'^test ([^\r\n]+) \.\.\. (ok|FAILED|ignored)\r?$', log, re.M)
-            require(rows == [(n, 'ok') for n in selected[:selected.index(failing)]] and 'running 58 tests' in log, 'Historical completed prefix before abort')
-    dirty = ['stack-diag-01-dirty', 'stack-diag-02-dirty', 'stack-probe-sum-01-dirty', 'stack-probe-if-01-dirty', 'stack-probe-power-01-dirty', 'stack-probe-trailing-01-dirty']
-    for index, stem in enumerate(dirty):
-        capture, result, log = doc(stem + '.inputs.json'), doc(stem + '.result.json'), read(stem + '.log').decode()
-        diagnostic = index < 2
-        commit, original = (PRIOR, prior_blobs) if diagnostic else (SOURCE, blobs)
-        require(capture['head'] == commit and result['changed'] == [], 'Dirty capture identity/stability')
-        patched = apply_recorded_diff(original, capture['dirty'])
-        expected_paths = {'crates/oa-core/src/language/analysis_source/index/tests.rs'} if diagnostic else {'crates/oa-core/src/language/analysis_source/tests.rs'}
-        if index == 1:
-            expected_paths.add('crates/oa-core/src/language/analysis_source/syntax.rs')
-        require(set(patched) == expected_paths, 'Bounded diagnostic paths')
-        for path, raw in original.items():
-            require(capture['inputs'][path] == sha(patched.get(path, raw)), 'Reconstructed diagnostic input: ' + path)
-        expected_filter = STACK if diagnostic else 'diagnostic_malformed_cleanup_on_128k_stack'
-        require(capture['command'] == PREFIX + [expected_filter, '--', '--test-threads=1', '--nocapture'], 'Diagnostic command')
-        if diagnostic:
-            require(result['exit'] == OVERFLOW and 'STATUS_STACK_OVERFLOW' in log and 'STAGE failed builds dropped' in log and 'STAGE finished' not in log, 'Diagnostic abort')
-            if index == 1:
-                require('STAGE node rejecting depth 129 before kind drop' in log and 'STAGE node rejected kind dropped' not in log, 'Isolated rejected-kind cleanup')
-        else:
-            case = index - 2
-            require(result['exit'] == 0 and f'PROBE before malformed case {case}' in log and f'PROBE after malformed case {case}:' in log and '1 passed; 0 failed; 0 ignored' in log, 'Dirty probe result/case')
-    return {'source': SOURCE, 'verified_git_inputs': 538, 'listing': 167, 'typed_pass': 59, 'index_pass': 9, 'update_pass': 5, 'token_pass': 1, 'strict_exit': 0, 'historical_overflow_retained': True, 'dirty_diagnostics': 2, 'dirty_direct_parser_probes_pass': 4, 'recorded_test_artifacts': artifacts, 'scope': 'Private S3 only; no full-core runtime/public8/integration/native/release acceptance. Recorded binary identities verified against receipts, not rehashed executable bytes; binaries intentionally absent.'}
-
-
-def verify_package(directory):
-    manifest = document((directory / 'manifest.json').read_bytes())
-    require(manifest['source'] == SOURCE and manifest['archive_sha256'] == ZIP_SHA, 'Outer manifest identity')
-    names = [item['path'] for item in manifest['files']]
-    require(set(names) == {'.gitattributes', 'README.md', 'verify.py', 'negative_controls.py', 'checks.json', 'evidence.zip'} and len(names) == len(set(names)), 'Outer manifest membership')
-    for item in manifest['files']:
-        raw = (directory / item['path']).read_bytes()
-        require(len(raw) == item['bytes'] and sha(raw) == item['sha256'], 'Outer manifest bytes: ' + item['path'])
-    return archive_payload((directory / 'evidence.zip').read_bytes())
-
-
-def main():
-    require(__debug__, 'Optimized Python refused')
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument('--repo', type=Path, required=True, help='Git repo containing immutable source commits; current checkout is not used')
-    parser.add_argument('--evidence-dir', type=Path, default=Path(__file__).resolve().parent)
-    args = parser.parse_args()
-    print(json.dumps(audit(args.repo, verify_package(args.evidence_dir)), indent=2))
-
-
-if __name__ == '__main__':
-    main()